@tavora/module-schema 0.0.0-stage → 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,7 @@
+# Changelog
+
+What changed in `@tavora/module-schema`, newest first.
+
+## 0.1.0
+
+- First release on npm: `validateManifest`, `needsNewerTavora` and the JSON Schema for `tavora.module.json`.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 wellbrained
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,20 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# @tavora/module-schema
+
+The rules for `tavora.module.json`, the manifest every [Tavora](https://mytavora.app) module has: a validator (the same one Tavora runs when it installs a module) and a JSON Schema for editors.
+
+```ts
+import { validateManifest } from "@tavora/module-schema";
+
+const result = validateManifest(JSON.parse(text));
+if (!result.ok) console.error(result.errors);
+```
+
+For completion and errors in your editor, point the manifest at the schema:
+
+```json
+{
+  "$schema": "https://docs.mytavora.app/schema/tavora.module.schema.json"
+}
+```
+
+What each field means is in the [manifest reference](https://docs.mytavora.app/reference/manifest). You rarely need this package directly: `@tavora/pack` checks the manifest before it packs a module.

package/dist/index.d.ts

@@ -0,0 +1,111 @@
+export interface ModuleViewport {
+    minWidth: number;
+    minHeight: number;
+    preferredWidth?: number;
+    preferredHeight?: number;
+}
+/**
+ * A named panel type (the decision log, named panels rows of 2026-10-17): one tool a module offers,
+ * such as Inventory or Build planner. Players add each type on its own and may open several copies;
+ * every type shares the module's saved content and permissions.
+ */
+export interface ModulePanelType {
+    /** Stable identity, never shown. Saved layouts keep it, so renaming `name` changes nothing for players. */
+    id: string;
+    /** Short name on the panel's tab, such as `Build planner`. */
+    name: string;
+    /** The page for this type; the module's own `entry` when left out, so one page may serve every type. */
+    entry?: string;
+    /** The tab icon for this type; the module's own `icon` when left out. */
+    icon?: string;
+    /** This type's sizes; the module's own `viewport` when left out. */
+    viewport?: ModuleViewport;
+    /** Panels opened before the module had panel types become this type. At most one type says so; without one, the first type. */
+    continues?: boolean;
+}
+export interface ModuleManifest {
+    $schema?: string;
+    id: string;
+    name: string;
+    description?: string;
+    version: string;
+    apiVersion: "1";
+    /** The oldest Tavora the module works with, such as `0.18.0`. An older Tavora refuses to install or load it, and says why. */
+    minTavora?: string;
+    entry: string;
+    icon?: string;
+    games: string[];
+    viewport: ModuleViewport;
+    /** Named panel types. Without them the module has one panel, made from `entry`, `icon` and `viewport`. */
+    panels?: ModulePanelType[];
+    permissions: {
+        /** Hosts the module asks to reach through network.fetch, such as `api.example.com`. Each needs the player's grant. */
+        network: string[];
+        /** Parts of Tavora that hold a sign-in, which the module asks to use (see CONNECTORS). Each needs the player's grant. */
+        connectors?: Connector[];
+        /** Lets the page compile WebAssembly (Excalidraw's picture resizing needs it). Only Tavora's own modules may ask for it. */
+        webAssembly?: boolean;
+    };
+}
+export type ManifestResult = {
+    ok: true;
+    manifest: ModuleManifest;
+} | {
+    ok: false;
+    errors: string[];
+};
+/** Most panel types one module may offer, and the longest short name a tab shows. */
+export declare const MAX_PANEL_TYPES = 16;
+export declare const MAX_PANEL_NAME = 24;
+export declare function isPanelTypeId(value: unknown): value is string;
+/** A panel type with the module's own entry, icon and viewport filled in where the type has none. */
+export interface ResolvedPanelType {
+    id: string;
+    name: string;
+    entry: string;
+    icon: string | undefined;
+    viewport: ModuleViewport;
+}
+/** The module's panel types, resolved; empty for a module with one panel and no types. */
+export declare function panelTypes(manifest: ModuleManifest): ResolvedPanelType[];
+/** The type a panel opened before the module had types becomes: the one marked `continues`, else the first. Null without types. */
+export declare function continuingPanelType(manifest: ModuleManifest): string | null;
+/** Every page and icon the manifest names, its panel types' included, each once: the files a package must hold. */
+export declare function manifestFiles(manifest: ModuleManifest): {
+    entries: string[];
+    icons: string[];
+};
+export declare function isModuleId(value: unknown): value is string;
+/**
+ * Who owns a module's data (the decision log, publisher row of 2026-10-16):
+ * Tavora's own modules, unsigned local ones, or a publisher's signing key,
+ * named by the hex fingerprint of the publisher's first key. Owners end up in
+ * paths and session partitions, so no dots or other separators.
+ */
+export declare const OFFICIAL_OWNER = "official";
+export declare const LOCAL_OWNER = "local";
+export declare function isOwnerId(value: unknown): value is string;
+export declare function isGameId(value: unknown): value is string;
+/**
+ * Connectors (glossary): parts of Tavora that hold a sign-in and let a granted module use it without
+ * seeing the token. `ai-usage` reads the usage of the player's Claude and Codex accounts; `discord` talks to the
+ * Discord app on this PC with Tavora's Discord sign-in (voice channels, who is talking, joining and muting).
+ */
+export declare const CONNECTORS: readonly ["ai-usage", "discord"];
+export type Connector = (typeof CONNECTORS)[number];
+export declare function isConnector(value: unknown): value is Connector;
+/** Most hosts one manifest may ask for. */
+export declare const MAX_NETWORK_HOSTS = 32;
+/**
+ * A host a module may ask to reach (the decision log, module grants row of 2026-10-16): an exact,
+ * lowercase public name such as `api.example.com`. No wildcards, ports, schemes, IP addresses or
+ * names of this PC or the local network (`localhost`, `.local`), so a grant always names one site.
+ */
+export declare function isNetworkHost(value: unknown): value is string;
+/**
+ * Whether this Tavora is older than the module's `minTavora`. Compares major, minor and patch as
+ * numbers; anything after the patch number of Tavora's own version (a pre-release) is ignored.
+ */
+export declare function needsNewerTavora(manifest: Pick<ModuleManifest, "minTavora">, tavoraVersion: string): boolean;
+export declare function validateManifest(input: unknown): ManifestResult;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,2GAA2G;IAC3G,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,wGAAwG;IACxG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,+HAA+H;IAC/H,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,GAAG,CAAC;IAChB,8HAA8H;IAC9H,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,cAAc,CAAC;IACzB,0GAA0G;IAC1G,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;IAC3B,WAAW,EAAE;QACX,sHAAsH;QACtH,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,yHAAyH;QACzH,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;QACzB,4HAA4H;QAC5H,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;CACH;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,GACtC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAWpC,qFAAqF;AACrF,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,eAAO,MAAM,cAAc,KAAK,CAAC;AAIjC,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE7D;AAED,qGAAqG;AACrG,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,0FAA0F;AAC1F,wBAAgB,UAAU,CAAC,QAAQ,EAAE,cAAc,GAAG,iBAAiB,EAAE,CAQxE;AAED,mIAAmI;AACnI,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAG3E;AAED,mHAAmH;AACnH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,cAAc,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAQ9F;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE1D;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,aAAa,CAAC;AACzC,eAAO,MAAM,WAAW,UAAU,CAAC;AAGnC,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEzD;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExD;AAED;;;;GAIG;AACH,eAAO,MAAM,UAAU,kCAAmC,CAAC;AAC3D,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAE9D;AAED,2CAA2C;AAC3C,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAGpC;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAO7D;AAKD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAS5G;AAuED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAwD/D"}

package/dist/index.js

@@ -0,0 +1,261 @@
+// Manifest v1 for tavora.module.json (apps/docs/reference/manifest.md). The JSON Schema
+// in schema/ describes the same rules for editors; tests keep the two in step.
+// Module and game ids end up in session partitions, origins and file paths,
+// so they are restricted to a small, path-safe alphabet.
+const MODULE_ID = /^[a-z][a-z0-9]*(\.[a-z0-9][a-z0-9-]*){1,4}$/;
+const GAME_ID = /^[a-z0-9][a-z0-9-]{0,63}$/;
+const SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(-[0-9A-Za-z.-]+)?$/;
+const MAX_VIEWPORT = 10_000;
+const FIELDS = ["$schema", "id", "name", "description", "version", "apiVersion", "minTavora", "entry", "icon", "games", "viewport", "panels", "permissions"];
+const VIEWPORT_FIELDS = ["minWidth", "minHeight", "preferredWidth", "preferredHeight"];
+/** Most panel types one module may offer, and the longest short name a tab shows. */
+export const MAX_PANEL_TYPES = 16;
+export const MAX_PANEL_NAME = 24;
+const PANEL_TYPE_ID = /^[a-z][a-z0-9-]{0,31}$/;
+const PANEL_FIELDS = ["id", "name", "entry", "icon", "viewport", "continues"];
+export function isPanelTypeId(value) {
+    return typeof value === "string" && PANEL_TYPE_ID.test(value);
+}
+/** The module's panel types, resolved; empty for a module with one panel and no types. */
+export function panelTypes(manifest) {
+    return (manifest.panels ?? []).map((type) => ({
+        id: type.id,
+        name: type.name,
+        entry: type.entry ?? manifest.entry,
+        icon: type.icon ?? manifest.icon,
+        viewport: type.viewport ?? manifest.viewport,
+    }));
+}
+/** The type a panel opened before the module had types becomes: the one marked `continues`, else the first. Null without types. */
+export function continuingPanelType(manifest) {
+    const panels = manifest.panels ?? [];
+    return (panels.find((type) => type.continues) ?? panels[0])?.id ?? null;
+}
+/** Every page and icon the manifest names, its panel types' included, each once: the files a package must hold. */
+export function manifestFiles(manifest) {
+    const entries = new Set([manifest.entry]);
+    const icons = new Set(manifest.icon === undefined ? [] : [manifest.icon]);
+    for (const type of manifest.panels ?? []) {
+        if (type.entry !== undefined)
+            entries.add(type.entry);
+        if (type.icon !== undefined)
+            icons.add(type.icon);
+    }
+    return { entries: [...entries], icons: [...icons] };
+}
+export function isModuleId(value) {
+    return typeof value === "string" && value.length <= 128 && MODULE_ID.test(value);
+}
+/**
+ * Who owns a module's data (the decision log, publisher row of 2026-10-16):
+ * Tavora's own modules, unsigned local ones, or a publisher's signing key,
+ * named by the hex fingerprint of the publisher's first key. Owners end up in
+ * paths and session partitions, so no dots or other separators.
+ */
+export const OFFICIAL_OWNER = "official";
+export const LOCAL_OWNER = "local";
+const KEY_FINGERPRINT = /^[0-9a-f]{32}$/;
+export function isOwnerId(value) {
+    return value === OFFICIAL_OWNER || value === LOCAL_OWNER || (typeof value === "string" && KEY_FINGERPRINT.test(value));
+}
+export function isGameId(value) {
+    return typeof value === "string" && GAME_ID.test(value);
+}
+/**
+ * Connectors (glossary): parts of Tavora that hold a sign-in and let a granted module use it without
+ * seeing the token. `ai-usage` reads the usage of the player's Claude and Codex accounts; `discord` talks to the
+ * Discord app on this PC with Tavora's Discord sign-in (voice channels, who is talking, joining and muting).
+ */
+export const CONNECTORS = ["ai-usage", "discord"];
+export function isConnector(value) {
+    return CONNECTORS.includes(value);
+}
+/** Most hosts one manifest may ask for. */
+export const MAX_NETWORK_HOSTS = 32;
+const HOST_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+/**
+ * A host a module may ask to reach (the decision log, module grants row of 2026-10-16): an exact,
+ * lowercase public name such as `api.example.com`. No wildcards, ports, schemes, IP addresses or
+ * names of this PC or the local network (`localhost`, `.local`), so a grant always names one site.
+ */
+export function isNetworkHost(value) {
+    if (typeof value !== "string" || value.length > 253)
+        return false;
+    const labels = value.split(".");
+    if (labels.length < 2 || !labels.every((label) => HOST_LABEL.test(label)))
+        return false;
+    const last = labels.at(-1);
+    // A top-level label of digits only is an IP address (or not a name at all).
+    return !/^\d+$/.test(last) && !["localhost", "local", "internal", "arpa"].includes(last);
+}
+/** A Tavora release version: major.minor.patch, numbers only. */
+const TAVORA_VERSION = /^(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})$/;
+/**
+ * Whether this Tavora is older than the module's `minTavora`. Compares major, minor and patch as
+ * numbers; anything after the patch number of Tavora's own version (a pre-release) is ignored.
+ */
+export function needsNewerTavora(manifest, tavoraVersion) {
+    if (!manifest.minTavora)
+        return false;
+    const parts = (version) => version.split(/[-+]/)[0].split(".").map((part) => Number(part) || 0);
+    const need = parts(manifest.minTavora);
+    const have = parts(tavoraVersion);
+    for (let i = 0; i < 3; i++) {
+        if ((have[i] ?? 0) !== (need[i] ?? 0))
+            return (have[i] ?? 0) < (need[i] ?? 0);
+    }
+    return false;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isText(value, maxLength) {
+    return typeof value === "string" && value.trim() !== "" && value.length <= maxLength;
+}
+function isDimension(value) {
+    return Number.isInteger(value) && value > 0 && value <= MAX_VIEWPORT;
+}
+// Paths must be plain and relative inside the package: no "..", no
+// absolute paths, no backslashes, no URL schemes.
+function isPackagePath(value) {
+    if (typeof value !== "string" || value.length === 0 || value.length > 256)
+        return false;
+    if (value.startsWith("/") || value.includes("\\") || value.includes(":") || value.includes("\0"))
+        return false;
+    return value.split("/").every((part) => part !== "" && part !== "." && part !== "..");
+}
+function checkViewport(viewport, at, errors) {
+    if (!isRecord(viewport)) {
+        errors.push(`${at} must be an object`);
+        return;
+    }
+    if (!isDimension(viewport.minWidth) || !isDimension(viewport.minHeight)) {
+        errors.push(`${at}.minWidth and ${at}.minHeight must be positive integers`);
+    }
+    for (const key of ["preferredWidth", "preferredHeight"]) {
+        if (viewport[key] !== undefined && !isDimension(viewport[key]))
+            errors.push(`${at}.${key} must be a positive integer`);
+    }
+    const unknown = Object.keys(viewport).filter((key) => !VIEWPORT_FIELDS.includes(key));
+    if (unknown.length > 0)
+        errors.push(`unknown ${at} fields: ${unknown.join(", ")}`);
+}
+function checkPanels(panels, errors) {
+    if (!Array.isArray(panels) || panels.length === 0 || panels.length > MAX_PANEL_TYPES) {
+        errors.push(`panels must be an array of 1 to ${MAX_PANEL_TYPES} panel types`);
+        return;
+    }
+    const ids = new Set();
+    let continuing = 0;
+    panels.forEach((type, index) => {
+        const at = `panels[${index}]`;
+        if (!isRecord(type)) {
+            errors.push(`${at} must be an object`);
+            return;
+        }
+        if (!isPanelTypeId(type.id))
+            errors.push(`${at}.id must be lowercase letters, digits and -, starting with a letter, at most 32 characters`);
+        else if (ids.has(type.id))
+            errors.push(`panels lists the id ${type.id} twice`);
+        else
+            ids.add(type.id);
+        if (!isText(type.name, MAX_PANEL_NAME))
+            errors.push(`${at}.name must be a non-empty string of at most ${MAX_PANEL_NAME} characters`);
+        if (type.entry !== undefined) {
+            if (!isPackagePath(type.entry))
+                errors.push(`${at}.entry must be a relative path inside the package`);
+            else if (!type.entry.endsWith(".html"))
+                errors.push(`${at}.entry must be an .html file`);
+        }
+        if (type.icon !== undefined) {
+            if (!isPackagePath(type.icon))
+                errors.push(`${at}.icon must be a relative path inside the package`);
+            else if (!/\.(png|webp)$/.test(type.icon))
+                errors.push(`${at}.icon must be a .png or .webp file`);
+        }
+        if (type.viewport !== undefined)
+            checkViewport(type.viewport, `${at}.viewport`, errors);
+        if (type.continues !== undefined && typeof type.continues !== "boolean")
+            errors.push(`${at}.continues must be true or false`);
+        if (type.continues === true)
+            continuing++;
+        const unknown = Object.keys(type).filter((key) => !PANEL_FIELDS.includes(key));
+        if (unknown.length > 0)
+            errors.push(`unknown ${at} fields: ${unknown.join(", ")}`);
+    });
+    if (continuing > 1)
+        errors.push("only one panel type may set continues");
+}
+export function validateManifest(input) {
+    const errors = [];
+    if (!isRecord(input))
+        return { ok: false, errors: ["manifest must be a JSON object"] };
+    if (!isModuleId(input.id))
+        errors.push("id must look like publisher.module-name (lowercase, dot-separated)");
+    if (input.$schema !== undefined && typeof input.$schema !== "string")
+        errors.push("$schema must be a string");
+    if (!isText(input.name, 80))
+        errors.push("name must be a non-empty string of at most 80 characters");
+    if (input.description !== undefined && !isText(input.description, 300)) {
+        errors.push("description must be a non-empty string of at most 300 characters");
+    }
+    if (typeof input.version !== "string" || !SEMVER.test(input.version))
+        errors.push("version must be semver, e.g. 1.0.0");
+    if (input.apiVersion !== "1")
+        errors.push('apiVersion must be "1"');
+    if (input.minTavora !== undefined && (typeof input.minTavora !== "string" || !TAVORA_VERSION.test(input.minTavora)))
+        errors.push("minTavora must be a Tavora version such as 0.18.0");
+    if (!isPackagePath(input.entry))
+        errors.push("entry must be a relative path inside the package");
+    else if (!input.entry.endsWith(".html"))
+        errors.push("entry must be an .html file");
+    if (input.icon !== undefined) {
+        if (!isPackagePath(input.icon))
+            errors.push("icon must be a relative path inside the package");
+        else if (!/\.(png|webp)$/.test(input.icon))
+            errors.push("icon must be a .png or .webp file");
+    }
+    if (!Array.isArray(input.games) || !input.games.every(isGameId)) {
+        errors.push("games must be an array of game ids (empty means any game)");
+    }
+    checkViewport(input.viewport, "viewport", errors);
+    if (input.panels !== undefined)
+        checkPanels(input.panels, errors);
+    const permissions = input.permissions;
+    if (!isRecord(permissions) || !Array.isArray(permissions.network)) {
+        errors.push("permissions.network must be an array");
+    }
+    else {
+        const hosts = permissions.network;
+        if (hosts.length > MAX_NETWORK_HOSTS)
+            errors.push(`permissions.network may name at most ${MAX_NETWORK_HOSTS} hosts`);
+        const bad = hosts.filter((host) => !isNetworkHost(host));
+        if (bad.length > 0) {
+            errors.push(`permissions.network must list exact public host names such as api.example.com (lowercase, no scheme, port or wildcard): ${bad.slice(0, 3).map(String).join(", ")}`);
+        }
+        else if (new Set(hosts).size !== hosts.length) {
+            errors.push("permissions.network lists a host twice");
+        }
+    }
+    if (isRecord(permissions)) {
+        const unsupported = Object.keys(permissions).filter((key) => key !== "network" && key !== "connectors" && key !== "webAssembly");
+        if (unsupported.length > 0)
+            errors.push(`unsupported permissions: ${unsupported.join(", ")}`);
+        if ("connectors" in permissions) {
+            const connectors = permissions.connectors;
+            if (!Array.isArray(connectors) || !connectors.every(isConnector))
+                errors.push(`permissions.connectors must list connectors Tavora has: ${CONNECTORS.join(", ")}`);
+            else if (new Set(connectors).size !== connectors.length)
+                errors.push("permissions.connectors lists a connector twice");
+        }
+        if ("webAssembly" in permissions && typeof permissions.webAssembly !== "boolean")
+            errors.push("permissions.webAssembly must be true or false");
+    }
+    const extra = Object.keys(input).filter((key) => !FIELDS.includes(key));
+    if (extra.length > 0)
+        errors.push(`unknown fields: ${extra.join(", ")}`);
+    if (errors.length > 0)
+        return { ok: false, errors };
+    return { ok: true, manifest: input };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,+EAA+E;AA0D/E,4EAA4E;AAC5E,yDAAyD;AACzD,MAAM,SAAS,GAAG,6CAA6C,CAAC;AAChE,MAAM,OAAO,GAAG,2BAA2B,CAAC;AAC5C,MAAM,MAAM,GAAG,8DAA8D,CAAC;AAC9E,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,MAAM,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC7J,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;AAEvF,qFAAqF;AACrF,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AACjC,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAC/C,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;AAE9E,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAWD,0FAA0F;AAC1F,MAAM,UAAU,UAAU,CAAC,QAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5C,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK;QACnC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;QAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;KAC7C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,mIAAmI;AACnI,MAAM,UAAU,mBAAmB,CAAC,QAAwB;IAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;IACrC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;AAC1E,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,aAAa,CAAC,QAAwB;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AACzC,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AACnC,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEzC,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,WAAW,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACzH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,SAAS,CAAU,CAAC;AAG3D,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAQ,UAAiC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,2CAA2C;AAC3C,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,UAAU,GAAG,wCAAwC,CAAC;AAE5D;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;IAC5B,4EAA4E;IAC5E,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED,iEAAiE;AACjE,MAAM,cAAc,GAAG,wDAAwD,CAAC;AAEhF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA2C,EAAE,aAAqB;IACjG,IAAI,CAAC,QAAQ,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzG,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,SAAiB;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC;AACvF,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,CAAC,IAAK,KAAgB,IAAI,YAAY,CAAC;AAC/F,CAAC;AAED,mEAAmE;AACnE,kDAAkD;AAClD,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IACxF,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/G,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,aAAa,CAAC,QAAiB,EAAE,EAAU,EAAE,MAAgB;IACpE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,sCAAsC,CAAC,CAAC;IAC9E,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,iBAAiB,CAAU,EAAE,CAAC;QACjE,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,6BAA6B,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,WAAW,CAAC,MAAe,EAAE,MAAgB;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QACrF,MAAM,CAAC,IAAI,CAAC,mCAAmC,eAAe,cAAc,CAAC,CAAC;QAC9E,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,CAAC,OAAO,CAAC,CAAC,IAAa,EAAE,KAAK,EAAE,EAAE;QACtC,MAAM,EAAE,GAAG,UAAU,KAAK,GAAG,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,4FAA4F,CAAC,CAAC;aACvI,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,uBAAuB,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;;YAC1E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,+CAA+C,cAAc,aAAa,CAAC,CAAC;QACrI,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,mDAAmD,CAAC,CAAC;iBACjG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,kDAAkD,CAAC,CAAC;iBAC/F,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,oCAAoC,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACxF,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;QAC9H,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,UAAU,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IACH,IAAI,UAAU,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,gCAAgC,CAAC,EAAE,CAAC;IAEvF,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;IAC7G,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC9G,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACrG,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACxH,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG;QAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IACtL,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;SAC5F,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACpF,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;aAC1F,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;IAC3E,CAAC;IAED,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,WAAW,CAAC,OAAoB,CAAC;QAC/C,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB;YAAE,MAAM,CAAC,IAAI,CAAC,wCAAwC,iBAAiB,QAAQ,CAAC,CAAC;QACrH,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,2HAA2H,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnL,CAAC;aAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,aAAa,CAAC,CAAC;QACjI,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,4BAA4B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9F,IAAI,YAAY,IAAI,WAAW,EAAE,CAAC;YAChC,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC;YAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,2DAA2D,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;iBAC7J,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM;gBAAE,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QACzH,CAAC;QACD,IAAI,aAAa,IAAI,WAAW,IAAI,OAAO,WAAW,CAAC,WAAW,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IACjJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEzE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAkC,EAAE,CAAC;AACpE,CAAC"}

package/package.json

@@ -1,6 +1,45 @@
 {
   "name": "@tavora/module-schema",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Validator and JSON Schema for Tavora module manifests (tavora.module.json).",
+  "type": "module",
+  "keywords": [
+    "tavora",
+    "module",
+    "manifest",
+    "json-schema"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/wellbrained/tavora.git",
+    "directory": "packages/module-schema"
+  },
+  "homepage": "https://docs.mytavora.app/",
+  "bugs": "https://github.com/wellbrained/tavora/issues",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./schema.json": "./schema/tavora.module.schema.json",
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "schema",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "devDependencies": {
+    "ajv": "8.20.0",
+    "@types/node": "^22.20.5"
+  },
+  "license": "MIT",
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit -p ."
+  }
 }

package/schema/tavora.module.schema.json

@@ -0,0 +1,249 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "tavora.module.schema.json",
+  "title": "Tavora module manifest (tavora.module.json), apiVersion 1",
+  "description": "Describes a Tavora module package. Tavora Desktop rejects a manifest with unknown fields instead of ignoring them. The TypeScript validator in @tavora/module-schema is the reference; this schema is checked against it in tests.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "id",
+    "name",
+    "version",
+    "apiVersion",
+    "entry",
+    "games",
+    "viewport",
+    "permissions"
+  ],
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "Lets editors find this schema. Ignored by Tavora."
+    },
+    "id": {
+      "type": "string",
+      "maxLength": 128,
+      "pattern": "^[a-z][a-z0-9]*(\\.[a-z0-9][a-z0-9-]*){1,4}$",
+      "description": "Unique module id: publisher.module-name, lowercase and dot-separated. Never change it after release: data and permissions are keyed on it.",
+      "examples": [
+        "community.example.campaign-companion"
+      ]
+    },
+    "name": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 80,
+      "pattern": "\\S",
+      "description": "Name shown to players."
+    },
+    "description": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 300,
+      "pattern": "\\S",
+      "description": "One or two sentences shown in the module picker."
+    },
+    "version": {
+      "type": "string",
+      "pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(-[0-9A-Za-z.-]+)?$",
+      "description": "Module version, semver.",
+      "examples": [
+        "1.0.0"
+      ]
+    },
+    "apiVersion": {
+      "const": "1",
+      "description": "Manifest and bridge contract version. Only \"1\" exists."
+    },
+    "minTavora": {
+      "type": "string",
+      "pattern": "^(0|[1-9]\\d{0,5})\\.(0|[1-9]\\d{0,5})\\.(0|[1-9]\\d{0,5})$",
+      "description": "The oldest Tavora the module works with. An older Tavora refuses to install or load it and says why.",
+      "examples": [
+        "0.18.0"
+      ]
+    },
+    "entry": {
+      "type": "string",
+      "allOf": [
+        {
+          "$ref": "#/definitions/packagePath"
+        },
+        {
+          "pattern": "\\.html$"
+        }
+      ],
+      "description": "HTML page Tavora loads, relative to the package root.",
+      "examples": [
+        "dist/index.html"
+      ]
+    },
+    "icon": {
+      "type": "string",
+      "allOf": [
+        {
+          "$ref": "#/definitions/packagePath"
+        },
+        {
+          "pattern": "\\.(png|webp)$"
+        }
+      ],
+      "description": "Square PNG or WebP icon inside the package, at least 128 × 128 pixels.",
+      "examples": [
+        "assets/icon.png"
+      ]
+    },
+    "games": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "pattern": "^[a-z0-9][a-z0-9-]{0,63}$"
+      },
+      "description": "Game ids this module is made for. Empty means any game.",
+      "examples": [
+        [
+          "poe2"
+        ]
+      ]
+    },
+    "viewport": {
+      "$ref": "#/definitions/viewport",
+      "description": "Panel sizes in CSS pixels. Tavora never makes the panel smaller than the minimum."
+    },
+    "panels": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 16,
+      "description": "Named panel types the module offers, such as Inventory and Build planner. Players add each on its own and may open several copies; all share the module's saved content and permissions. Ids must be unique and at most one type sets continues.",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "id",
+          "name"
+        ],
+        "properties": {
+          "id": {
+            "type": "string",
+            "pattern": "^[a-z][a-z0-9-]{0,31}$",
+            "description": "Stable identity of the panel type, never shown. Saved layouts keep it, so never change it after release.",
+            "examples": [
+              "build-planner"
+            ]
+          },
+          "name": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 24,
+            "pattern": "\\S",
+            "description": "Short name on the panel's tab.",
+            "examples": [
+              "Build planner"
+            ]
+          },
+          "entry": {
+            "type": "string",
+            "allOf": [
+              {
+                "$ref": "#/definitions/packagePath"
+              },
+              {
+                "pattern": "\\.html$"
+              }
+            ],
+            "description": "The page for this type. The module's entry when left out."
+          },
+          "icon": {
+            "type": "string",
+            "allOf": [
+              {
+                "$ref": "#/definitions/packagePath"
+              },
+              {
+                "pattern": "\\.(png|webp)$"
+              }
+            ],
+            "description": "Tab icon for this type. The module's icon when left out."
+          },
+          "viewport": {
+            "$ref": "#/definitions/viewport",
+            "description": "Sizes for this type. The module's viewport when left out."
+          },
+          "continues": {
+            "type": "boolean",
+            "description": "Panels opened before the module had panel types become this type. Without it, the first type."
+          }
+        }
+      }
+    },
+    "permissions": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "network"
+      ],
+      "description": "What the module asks for. Each permission needs the player's grant before it works; the player is asked when they first add the module.",
+      "properties": {
+        "network": {
+          "type": "array",
+          "maxItems": 32,
+          "uniqueItems": true,
+          "description": "Exact public host names the module may reach through network.fetch, such as api.example.com. HTTPS only; no scheme, port, wildcard, IP address or local name.",
+          "items": {
+            "type": "string",
+            "maxLength": 253,
+            "pattern": "^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+(?!(?:[0-9]+|localhost|local|internal|arpa)$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$"
+          }
+        },
+        "connectors": {
+          "type": "array",
+          "uniqueItems": true,
+          "description": "Parts of Tavora that hold a sign-in, which the module asks to use without seeing the token. ai-usage reads the usage of the player's Claude and Codex accounts; discord talks to the Discord app on this PC (voice channels, who is talking, joining and muting).",
+          "items": {
+            "enum": ["ai-usage", "discord"]
+          }
+        },
+        "webAssembly": {
+          "type": "boolean",
+          "description": "Lets the page compile WebAssembly. Only Tavora's own modules may ask for it; any other module that does is not loaded."
+        }
+      }
+    }
+  },
+  "definitions": {
+    "dimension": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 10000
+    },
+    "packagePath": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "pattern": "^(?!/)(?!.*//)(?!(.*/)?\\.\\.?(/|$))[^\\\\:\\u0000]+$",
+      "description": "Relative path inside the package: no leading slash, no '.' or '..' segments, no backslashes or colons."
+    },
+    "viewport": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "minWidth",
+        "minHeight"
+      ],
+      "properties": {
+        "minWidth": {
+          "$ref": "#/definitions/dimension"
+        },
+        "minHeight": {
+          "$ref": "#/definitions/dimension"
+        },
+        "preferredWidth": {
+          "$ref": "#/definitions/dimension"
+        },
+        "preferredHeight": {
+          "$ref": "#/definitions/dimension"
+        }
+      }
+    }
+  }
+}