node_app_manifest/

manifest.rs

//! App manifest domain entity — unified v1/v2 schema.
//!
//! This module defines the canonical `AppManifest` used by the Node daemon to
//! discover, load, and validate mini apps. It is a backward-compatible superset
//! of the existing `PerAppManifest` (now promoted from `apps/server`).
//!
//! # Schema version detection
//!
//! - **v1** (legacy): no `manifest_version` field → `manifest_version = 1`.
//!   All v2-only fields default to their v1-equivalent values. Zero existing
//!   app manifests are invalidated.
//! - **v2** (extended): `manifest_version = 2`. Adds `abi`, `entrypoint`,
//!   `hot_reload`, and the typed `capabilities` block. Requires `abi` to be
//!   present when `manifest_version == 2`.
//!
//! # Path-safety (SEC-H3)
//!
//! `entrypoint` and `ui_path` are validated at parse time:
//! 1. Matches regex `^[a-zA-Z0-9_][a-zA-Z0-9_./-]*$`
//! 2. Contains no `..` segment
//! 3. Does not begin with `/`
//!
//! The canonicalize-inside-install-dir check (step 4) is performed by
//! `tier_validator.rs` at load time because the install directory is not known
//! until the daemon resolves the path.

use serde::{Deserialize, Serialize};
use std::collections::HashMap;

// ── Enums ────────────────────────────────────────────────────────────────────

/// App execution model — determines how the daemon loads and isolates the app.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum AppType {
    /// In-process cdylib loaded via dlopen. First-party path only (SEC-H1).
    Native,
    /// Isolated subprocess managed by the Bun runtime.
    Bun,
    /// Independent systemd-managed service that owns its own Unix domain socket.
    /// The daemon does not start or supervise the process; it only routes
    /// capability invocations to the app's socket as JSON-RPC 2.0.
    /// Requires a `standalone.socket_path` when the manifest declares any
    /// `provides` / `capabilities.provides` entries.
    Standalone,
    /// Packaging-only runtime dependency (for example the shared Bun runtime).
    /// It is installed and versioned like an app package but is never loaded,
    /// registered as a capability provider, or hot-reloaded as an app.
    #[serde(rename = "platform-runtime")]
    PlatformRuntime,
}

impl AppType {
    pub fn as_str(self) -> &'static str {
        match self {
            AppType::Native => "native",
            AppType::Bun => "bun",
            AppType::Standalone => "standalone",
            AppType::PlatformRuntime => "platform-runtime",
        }
    }
}

impl std::fmt::Display for AppType {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        write!(f, "{}", self.as_str())
    }
}

/// Trust/distribution tier — derived at load time from the install path
/// AND (per FR-028 cycle 4) the manifest sidecar's GPG signature.
///
/// This is **not** stored in the manifest; it is computed by `tier_validator`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum AppTier {
    /// App installed at the bundled path (`/usr/share/node/builtin-apps/`)
    /// OR at the apt path with a manifest sidecar signed by a node project key.
    /// May be `Native` or `Bun`. Highest trust.
    FirstParty,
    /// App installed at the optional apt path (`/usr/lib/node/apps/`) with
    /// no/invalid project signature. MUST be `Bun`; `Native` at this tier
    /// triggers `TierError` (FR-028).
    Optional,
    /// App loaded from a developer's local dev directory (`NODE_DEV_APPS_DIR`),
    /// via `node-app-build dev` or manual sideload. Bypasses signature checks
    /// because the dev directory is owned by the developer (security gate is
    /// the file-system path: only the dev user can write to it). Permitted
    /// for `Native` apps so cdylib developers can iterate without per-build
    /// GPG signing.
    ///
    /// Daemon logs every Development-tier load at `info!` so operators of a
    /// real node can see when a non-prod app is active. UI badges this tier
    /// distinctly (amber/red, never green).
    Development,
}

impl AppTier {
    pub fn as_str(self) -> &'static str {
        match self {
            AppTier::FirstParty => "first_party",
            AppTier::Optional => "optional",
            AppTier::Development => "development",
        }
    }
}

impl std::fmt::Display for AppTier {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        write!(f, "{}", self.as_str())
    }
}

/// Host ABI compatibility version declared by the app.
///
/// The runtime's currently supported set is `[V1]`. Apps declaring an
/// unsupported version are rejected with `AbiIncompatible` (FR-018).
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
pub enum AbiVersion {
    V1,
}

impl AbiVersion {
    pub fn as_str(&self) -> &'static str {
        match self {
            AbiVersion::V1 => "v1",
        }
    }

    /// Returns true if this ABI version is supported by the current runtime.
    pub fn is_supported(&self) -> bool {
        matches!(self, AbiVersion::V1)
    }
}

impl std::fmt::Display for AbiVersion {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        write!(f, "{}", self.as_str())
    }
}

/// How in-process (native) app reload is expected to behave.
///
/// Per research.md §R10, native hot-reload is inherently unreliable due to
/// `dlclose` semantics. The manifest field sets correct user expectations.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum HotReloadKind {
    /// Reload is reliable (Bun subprocess restart). Default for `Bun` apps.
    Supported,
    /// Reload attempted but may fail; expect `RequiresRestart` on failure.
    /// Default for `Native` apps (FR-024).
    Experimental,
    /// App must be restarted to pick up changes.
    Unsupported,
}

impl HotReloadKind {
    pub fn default_for(app_type: AppType) -> Self {
        match app_type {
            AppType::Native => HotReloadKind::Experimental,
            AppType::Bun => HotReloadKind::Supported,
            // Standalone apps are restarted by systemd, not the daemon —
            // from the daemon's perspective they are never hot-reloaded.
            AppType::Standalone => HotReloadKind::Unsupported,
            AppType::PlatformRuntime => HotReloadKind::Unsupported,
        }
    }
}

// ── Sub-types ─────────────────────────────────────────────────────────────────

/// Capability declarations from the v2 manifest `capabilities` block.
///
/// Semantic equivalent of the existing `permissions` + `provides` fields;
/// v2 manifests may use either or both (backward compat preserved).
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
pub struct ManifestCapabilities {
    /// Capabilities this app requests from the host or other apps.
    /// Format: `"core.lightning.payment.send:max=1000sat/day"` (see §1.2).
    #[serde(default)]
    pub requires: Vec<String>,

    /// Capabilities this app provides to other apps.
    /// Format: `"core.cron.register"`.
    #[serde(default)]
    pub provides: Vec<String>,
}

/// A single scope provided by an app (existing v1 model, preserved verbatim).
#[derive(Debug, Clone, Serialize, Deserialize, Default)]
pub struct ProvidedScope {
    pub scope: String,
    pub description: String,
    pub resource_pattern: String,
}

/// Declarative per-endpoint access policy (existing v1 model, preserved verbatim).
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct EndpointPolicy {
    pub method: String,
    pub path: String,
    pub required_permissions: Vec<String>,
}

/// Capability provider declaration (existing v1 model, preserved verbatim).
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ProvidedCapability {
    #[serde(default)]
    pub description: String,
    #[serde(default)]
    pub schema: Option<serde_json::Value>,
}

/// Configuration for `AppType::Standalone` apps.
///
/// Carried only by manifests whose `app_type == "standalone"`. The daemon uses
/// `socket_path` to route capability invocations as line-delimited JSON-RPC 2.0
/// over the standalone daemon's own Unix domain socket.
///
/// Path-safety rules (validated by `AppManifest::validate`):
/// - Absolute path.
/// - Lives under `/run/`.
/// - No `..` segments.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct StandaloneConfig {
    pub socket_path: std::path::PathBuf,
}

// ── Path-safety helpers ───────────────────────────────────────────────────────

/// Validate a relative file path declared in a manifest (`entrypoint`, `ui_path`).
///
/// Rules (SEC-H3):
/// 1. Matches `^[a-zA-Z0-9_][a-zA-Z0-9_./-]*$` — rejects shell metacharacters,
///    leading `.`, leading `/`, etc.
/// 2. No `..` segment anywhere.
/// 3. Does not begin with `/` (absolute paths).
///
/// Returns `Ok(())` if valid, `Err(reason)` describing the violation.
pub fn validate_manifest_path(path: &str) -> Result<(), String> {
    if path.is_empty() {
        return Err("path must not be empty".to_string());
    }

    // Rule 3: no absolute paths
    if path.starts_with('/') {
        return Err(format!(
            "path '{}' must not be absolute (starts with /)",
            path
        ));
    }

    // Rule 1: allowed character set
    // ^[a-zA-Z0-9_][a-zA-Z0-9_./-]*$
    let first = path.chars().next().unwrap();
    if !first.is_ascii_alphanumeric() && first != '_' {
        return Err(format!(
            "path '{}' must begin with an alphanumeric character or underscore",
            path
        ));
    }
    for ch in path.chars().skip(1) {
        if !ch.is_ascii_alphanumeric() && !matches!(ch, '_' | '.' | '/' | '-') {
            return Err(format!(
                "path '{}' contains disallowed character '{}'",
                path, ch
            ));
        }
    }

    // Rule 2: no `..` segment
    for segment in path.split('/') {
        if segment == ".." {
            return Err(format!(
                "path '{}' contains a '..' segment (path traversal rejected)",
                path
            ));
        }
    }

    Ok(())
}

// ── AppManifest ───────────────────────────────────────────────────────────────

/// Canonical manifest entity — unified v1/v2 format.
///
/// Deserializes both old (v1, no `manifest_version`) and new (v2) manifests.
/// All v2-only fields use `#[serde(default)]` so that v1 manifests parse
/// correctly without any field changes.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AppManifest {
    /// Schema version. Absent or 1 = legacy v1; 2 = extended v2.
    #[serde(default = "default_manifest_version", rename = "manifest_version")]
    pub manifest_version: u8,

    pub name: String,
    pub version: String,

    #[serde(default = "default_app_type_native")]
    pub app_type: AppType,

    #[serde(default)]
    pub description: String,

    // ── v2-only additions (all optional, v1-compatible defaults) ─────────────
    /// Host ABI compatibility version. Required when `manifest_version == 2`.
    pub abi: Option<AbiVersion>,

    /// Payload entry point relative to the app directory.
    /// Default: `app.so` for Native, `dist/index.js` for Bun.
    pub entrypoint: Option<String>,

    /// Hot-reload behaviour classification.
    /// Default: `experimental` for Native, `supported` for Bun.
    pub hot_reload: Option<HotReloadKind>,

    // ── Existing v1 fields (preserved verbatim — DO NOT RENAME) ──────────────
    #[serde(default)]
    pub critical: bool,

    #[serde(
        default = "default_auto_start",
        deserialize_with = "deserialize_auto_start"
    )]
    pub auto_start: bool,

    #[serde(default)]
    pub has_ui: bool,

    #[serde(default = "default_ui_path")]
    pub ui_path: String,

    #[serde(default)]
    pub permissions: Vec<String>,

    #[serde(default)]
    pub optional_permissions: Vec<String>,

    #[serde(default)]
    pub provides_scopes: Vec<ProvidedScope>,

    #[serde(default)]
    pub endpoint_policies: Vec<EndpointPolicy>,

    #[serde(default)]
    pub capability_scopes: HashMap<String, String>,

    #[serde(default)]
    pub provides: HashMap<String, ProvidedCapability>,

    // ── v2 capabilities block (semantic alias for permissions + provides) ─────
    #[serde(default)]
    pub capabilities: ManifestCapabilities,

    // ── Optional metadata fields ──────────────────────────────────────────────
    #[serde(default)]
    pub author: Option<String>,

    #[serde(default)]
    pub homepage: Option<String>,

    #[serde(default)]
    pub depends_on: Option<Vec<String>>,

    #[serde(default)]
    pub boot_priority: Option<u32>,

    /// Required when `app_type == "standalone"` and the manifest declares any
    /// `provides` / `capabilities.provides` entries. Carries the Unix domain
    /// socket path the daemon dispatches capability calls to.
    #[serde(default)]
    pub standalone: Option<StandaloneConfig>,

    /// Optional TCP-binding block — feature 470 (port registry).
    /// Absence means the app does not bind a TCP port the registry manages.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub tcp: Option<TcpManifest>,
}

/// TCP port preferences for standalone apps that bind their own port.
/// Consumed by the port registry (`system/server/src/services/port_registry/`)
/// at install time.
#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
pub struct TcpManifest {
    /// The TCP port the app would like to bind. Honored when free;
    /// otherwise the registry assigns the next free port from the pool
    /// (default 7000–7099). Absent → registry picks any free pool slot.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub preferred_port: Option<u16>,

    /// When `true`, the platform UI shell builds iframe URLs as direct LAN
    /// connections to the assigned port rather than routing via the
    /// `/api/v2/node-apps/{name}/ui/` reverse-proxy. Intended only for apps
    /// that must outlive a platform restart (e.g. OTA self-upgrade). Remote
    /// users may see a degraded experience — owned by the consuming app's UI,
    /// not this spec (see `specs/470-port-registry/spec.md` Clarifications Q5b).
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub direct_bind: Option<bool>,
}

fn default_manifest_version() -> u8 {
    1
}

fn default_auto_start() -> bool {
    true
}

/// Deserialize `auto_start` from either a bool (manifest v1) or a load-mode
/// string (v2, e.g. `"lazy"`/`"eager"`/`"active"`). Eager-start modes map to
/// `true`; `"lazy"` and other on-demand/inactive states map to `false` (the app
/// is started on first capability use, not at boot). This keeps both manifest
/// schema generations parseable by `AppManifest::from_json`.
fn deserialize_auto_start<'de, D>(deserializer: D) -> Result<bool, D::Error>
where
    D: serde::Deserializer<'de>,
{
    #[derive(Deserialize)]
    #[serde(untagged)]
    enum BoolOrStr {
        Bool(bool),
        Str(String),
    }
    Ok(match BoolOrStr::deserialize(deserializer)? {
        BoolOrStr::Bool(b) => b,
        BoolOrStr::Str(s) => matches!(
            s.trim().to_ascii_lowercase().as_str(),
            "true" | "eager" | "active" | "auto" | "on" | "1"
        ),
    })
}

fn default_ui_path() -> String {
    "dist".to_string()
}

fn default_app_type_native() -> AppType {
    AppType::Native
}

impl AppManifest {
    /// Returns the effective `HotReloadKind` — explicit field or the default
    /// for the app type.
    pub fn effective_hot_reload(&self) -> HotReloadKind {
        self.hot_reload
            .unwrap_or_else(|| HotReloadKind::default_for(self.app_type))
    }

    /// Returns the effective entrypoint — explicit field or the type-specific default.
    ///
    /// Standalone apps have no daemon-managed entrypoint (systemd owns the
    /// lifecycle); the empty string signals "not applicable".
    pub fn effective_entrypoint(&self) -> &str {
        if let Some(ref ep) = self.entrypoint {
            ep.as_str()
        } else {
            match self.app_type {
                AppType::Native => "app.so",
                AppType::Bun => "dist/index.js",
                AppType::Standalone => "",
                AppType::PlatformRuntime => "bun",
            }
        }
    }

    /// True iff this manifest declares at least one capability provider
    /// (via either the v1 `provides` map or the v2 `capabilities.provides` list).
    pub fn has_capability_providers(&self) -> bool {
        !self.provides.is_empty() || !self.capabilities.provides.is_empty()
    }

    /// Merges the v1 `provides` map and the v2 `capabilities.provides` name
    /// list into a single capability→declaration map (composition-root
    /// cleanup Round 4 T28 — extracted from
    /// `control_ipc::handlers::handle_app_register_standalone`, which uses
    /// this to shape a standalone app's declared providers for capability
    /// registration).
    ///
    /// - v1 entries (the `provides` map) carry their real
    ///   description/schema and always win on a name conflict.
    /// - v2-only names (declared only via `capabilities.provides`, format
    ///   `"name"` or `"name:extra"` — only the part before the first `:` is
    ///   used) get a blank declaration, inserted only if the name is not
    ///   already present from v1. Blank/whitespace-only names are skipped.
    pub fn resolved_capability_provides(&self) -> HashMap<String, ProvidedCapability> {
        let mut out: HashMap<String, ProvidedCapability> = self.provides.clone();
        for raw in &self.capabilities.provides {
            let name = raw.split(':').next().unwrap_or(raw).trim().to_string();
            if name.is_empty() {
                continue;
            }
            out.entry(name).or_insert(ProvidedCapability {
                description: String::new(),
                schema: None,
            });
        }
        out
    }

    /// Validate the manifest for structural correctness.
    ///
    /// Returns `Ok(())` on success, or a human-readable error string.
    /// Called by the manifest parser after deserialization.
    pub fn validate(&self) -> Result<(), String> {
        self.validate_with_socket_path_policy(false)
    }

    /// Validate this manifest with an explicit standalone socket-path policy.
    ///
    /// Runtime adapters may opt into non-`/run` paths for development without
    /// making the domain model read process configuration.
    pub fn validate_with_socket_path_policy(&self, allow_non_run: bool) -> Result<(), String> {
        // v2 requires abi field
        if self.manifest_version == 2 && self.abi.is_none() {
            return Err("manifest_version 2 requires an 'abi' field".to_string());
        }

        // Name validation: ^[a-z][a-z0-9-]*(/([a-z][a-z0-9-]*))?$
        // (publisher/name form accepted but not yet semantically used — FR-019)
        validate_app_name(&self.name)?;

        // Path-safety on entrypoint and ui_path
        if let Some(ref ep) = self.entrypoint {
            validate_manifest_path(ep).map_err(|e| format!("entrypoint invalid: {}", e))?;
        }
        // ui_path is only meaningful when has_ui is true, but validate always
        if !self.ui_path.is_empty() && self.ui_path != "dist" {
            validate_manifest_path(&self.ui_path).map_err(|e| format!("ui_path invalid: {}", e))?;
        }

        // Homepage scheme validation (if present)
        if let Some(ref hp) = self.homepage {
            if !hp.starts_with("https://") && !hp.starts_with("http://") {
                return Err(format!(
                    "homepage '{}' must use https:// or http:// scheme",
                    hp
                ));
            }
        }

        // Standalone-app rules:
        // - When `app_type == "standalone"` AND the manifest declares any
        //   capability providers, `standalone.socket_path` is required and
        //   must be an absolute path under `/run/` with no `..` segments.
        // - Non-standalone manifests MUST NOT carry a `standalone` block
        //   (rejected to surface accidental schema misuse).
        match self.app_type {
            AppType::Standalone => {
                if self.has_capability_providers() {
                    let cfg = self.standalone.as_ref().ok_or_else(|| {
                        "standalone apps that declare 'provides' require a \
                         'standalone.socket_path' field"
                            .to_string()
                    })?;
                    validate_standalone_socket_path_with_policy(&cfg.socket_path, allow_non_run)?;
                }
            }
            AppType::Native | AppType::Bun | AppType::PlatformRuntime => {
                if self.standalone.is_some() {
                    return Err(format!(
                        "'standalone' block is only valid when app_type == 'standalone' \
                         (found app_type='{}')",
                        self.app_type
                    ));
                }
            }
        }

        if self.app_type == AppType::PlatformRuntime
            && !self.resolved_capability_provides().is_empty()
        {
            return Err(
                "platform-runtime packages cannot provide runtime capabilities".to_string(),
            );
        }

        Ok(())
    }

    /// Parse from a JSON string, validate, and return the manifest.
    pub fn from_json(json: &str) -> Result<Self, String> {
        Self::from_json_with_socket_path_policy(json, false)
    }

    /// Parse and validate with an explicit standalone socket-path policy.
    pub fn from_json_with_socket_path_policy(
        json: &str,
        allow_non_run: bool,
    ) -> Result<Self, String> {
        let manifest: Self =
            serde_json::from_str(json).map_err(|e| format!("manifest JSON parse error: {}", e))?;
        manifest.validate_with_socket_path_policy(allow_non_run)?;
        Ok(manifest)
    }
}

/// Validate a `StandaloneConfig::socket_path`.
///
/// Rules:
/// 1. Absolute path (starts with `/`).
/// 2. Lives under `/run/` (rejects `/etc/...`, `/tmp/...`, etc. — pins the
///    socket to a tmpfs path predictably writable by the standalone daemon).
///    Runtime adapters can explicitly bypass this restriction for development.
/// 3. No `..` segments anywhere in the path.
pub fn validate_standalone_socket_path(path: &std::path::Path) -> Result<(), String> {
    validate_standalone_socket_path_with_policy(path, false)
}

/// Validate a standalone socket path with an explicit runtime policy.
pub fn validate_standalone_socket_path_with_policy(
    path: &std::path::Path,
    allow_non_run: bool,
) -> Result<(), String> {
    if !path.is_absolute() {
        return Err(format!(
            "standalone.socket_path '{}' must be absolute",
            path.display()
        ));
    }
    if !allow_non_run && !path.starts_with("/run/") {
        return Err(format!(
            "standalone.socket_path '{}' must live under /run/",
            path.display()
        ));
    }
    if path
        .components()
        .any(|c| matches!(c, std::path::Component::ParentDir))
    {
        return Err(format!(
            "standalone.socket_path '{}' must not contain '..' segments",
            path.display()
        ));
    }
    Ok(())
}

/// Validate an app name string.
///
/// Accepts `app-name` (simple) and `publisher/app-name` (publisher-prefixed, FR-019).
fn validate_app_name(name: &str) -> Result<(), String> {
    let (publisher, app) = if let Some(slash) = name.find('/') {
        let (p, rest) = name.split_at(slash);
        (Some(p), &rest[1..])
    } else {
        (None, name)
    };

    let valid_segment = |s: &str| -> bool {
        if s.is_empty() {
            return false;
        }
        let mut chars = s.chars();
        let first = chars.next().unwrap();
        if !first.is_ascii_lowercase() {
            return false;
        }
        chars.all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '-')
    };

    if let Some(pub_name) = publisher {
        if !valid_segment(pub_name) {
            return Err(format!(
                "publisher segment '{}' must match [a-z][a-z0-9-]*",
                pub_name
            ));
        }
    }

    if !valid_segment(app) {
        return Err(format!(
            "app name segment '{}' must match [a-z][a-z0-9-]*",
            app
        ));
    }

    Ok(())
}

// ── Tests ─────────────────────────────────────────────────────────────────────

#[cfg(test)]
mod tests {
    use super::*;

    fn parse_ok(json: &str) -> AppManifest {
        AppManifest::from_json(json).expect("should parse")
    }

    fn parse_err(json: &str) -> String {
        AppManifest::from_json(json).expect_err("should fail")
    }

    // ── v1 manifests ──────────────────────────────────────────────────────────

    #[test]
    fn v1_minimal_native() {
        let m = parse_ok(r#"{"name":"cron","version":"1.0.0","app_type":"native"}"#);
        assert_eq!(m.manifest_version, 1);
        assert_eq!(m.app_type, AppType::Native);
        assert!(m.abi.is_none());
    }

    #[test]
    fn v1_minimal_bun() {
        let m = parse_ok(r#"{"name":"my-app","version":"0.1.0","app_type":"bun"}"#);
        assert_eq!(m.app_type, AppType::Bun);
        assert_eq!(m.effective_entrypoint(), "dist/index.js");
    }

    #[test]
    fn v1_no_manifest_version_field_defaults_to_1() {
        let m = parse_ok(r#"{"name":"example","version":"1.0.0","app_type":"bun"}"#);
        assert_eq!(m.manifest_version, 1);
    }

    #[test]
    fn v1_all_optional_fields_missing() {
        let m = parse_ok(r#"{"name":"example","version":"1.0.0","app_type":"bun"}"#);
        assert!(!m.critical);
        assert!(m.auto_start);
        assert!(!m.has_ui);
        assert_eq!(m.ui_path, "dist");
        assert!(m.permissions.is_empty());
        assert!(m.optional_permissions.is_empty());
    }

    #[test]
    fn v1_with_permissions_and_provides() {
        let json = r#"{
            "name": "example",
            "version": "1.0.0",
            "app_type": "bun",
            "permissions": ["core.storage.kv"],
            "optional_permissions": ["core.notifications.create"],
            "provides": {
                "core.example.run": { "description": "Run example job" }
            }
        }"#;
        let m = parse_ok(json);
        assert_eq!(m.permissions, vec!["core.storage.kv"]);
        assert_eq!(m.optional_permissions, vec!["core.notifications.create"]);
        assert!(m.provides.contains_key("core.example.run"));
    }

    // ── v2 manifests ──────────────────────────────────────────────────────────

    #[test]
    fn v2_minimal_native() {
        let json = r#"{
            "manifest_version": 2,
            "name": "cron",
            "version": "1.0.0",
            "app_type": "native",
            "abi": "v1",
            "entrypoint": "app.so",
            "hot_reload": "experimental"
        }"#;
        let m = parse_ok(json);
        assert_eq!(m.manifest_version, 2);
        assert_eq!(m.abi, Some(AbiVersion::V1));
        assert_eq!(m.entrypoint.as_deref(), Some("app.so"));
        assert_eq!(m.hot_reload, Some(HotReloadKind::Experimental));
    }

    #[test]
    fn v2_minimal_bun_with_capabilities() {
        let json = r#"{
            "manifest_version": 2,
            "name": "example-fullstack",
            "version": "1.0.0",
            "app_type": "bun",
            "abi": "v1",
            "entrypoint": "dist/index.js",
            "hot_reload": "supported",
            "has_ui": true,
            "ui_path": "ui/dist",
            "capabilities": {
                "requires": ["core.storage.kv", "core.lightning.payment.send:max=500sat/day"],
                "provides": []
            }
        }"#;
        let m = parse_ok(json);
        assert_eq!(m.manifest_version, 2);
        assert_eq!(m.capabilities.requires.len(), 2);
    }

    #[test]
    fn v2_missing_abi_is_error() {
        let json = r#"{
            "manifest_version": 2,
            "name": "example",
            "version": "1.0.0",
            "app_type": "bun"
        }"#;
        let err = parse_err(json);
        assert!(err.contains("abi"), "expected abi error, got: {}", err);
    }

    // ── Publisher-prefixed name (FR-019) ──────────────────────────────────────

    #[test]
    fn publisher_prefixed_name_accepted() {
        let m = parse_ok(r#"{"name":"alice/weather","version":"1.0.0","app_type":"bun"}"#);
        assert_eq!(m.name, "alice/weather");
    }

    #[test]
    fn double_slash_name_rejected() {
        let err = parse_err(r#"{"name":"a/b/c","version":"1.0.0","app_type":"bun"}"#);
        assert!(!err.is_empty());
    }

    // ── Malformed names ───────────────────────────────────────────────────────

    #[test]
    fn name_starting_with_digit_rejected() {
        let err = parse_err(r#"{"name":"1bad","version":"1.0.0","app_type":"bun"}"#);
        assert!(!err.is_empty());
    }

    #[test]
    fn name_with_uppercase_rejected() {
        let err = parse_err(r#"{"name":"MyApp","version":"1.0.0","app_type":"bun"}"#);
        assert!(!err.is_empty());
    }

    #[test]
    fn empty_name_rejected() {
        let err = parse_err(r#"{"name":"","version":"1.0.0","app_type":"bun"}"#);
        assert!(!err.is_empty());
    }

    // ── Path-safety (SEC-H3) ─────────────────────────────────────────────────

    #[test]
    fn path_traversal_double_dot_rejected() {
        let json = r#"{
            "manifest_version": 2, "name": "evil", "version": "1.0.0",
            "app_type": "bun", "abi": "v1",
            "entrypoint": "../etc/passwd"
        }"#;
        let err = parse_err(json);
        assert!(err.contains(".."), "expected traversal error, got: {}", err);
    }

    #[test]
    fn path_traversal_encoded_dot_not_decoded() {
        // The regex rejects '%' so encoded traversal fails at char check
        let json = r#"{
            "manifest_version": 2, "name": "evil", "version": "1.0.0",
            "app_type": "bun", "abi": "v1",
            "entrypoint": "foo/../bar"
        }"#;
        let err = parse_err(json);
        assert!(!err.is_empty(), "should have failed: {}", err);
    }

    #[test]
    fn absolute_path_rejected() {
        let json = r#"{
            "manifest_version": 2, "name": "evil", "version": "1.0.0",
            "app_type": "bun", "abi": "v1",
            "entrypoint": "/usr/bin/sh"
        }"#;
        let err = parse_err(json);
        assert!(
            err.contains("absolute"),
            "expected absolute error, got: {}",
            err
        );
    }

    #[test]
    fn shell_metachar_in_path_rejected() {
        let json = r#"{
            "manifest_version": 2, "name": "evil", "version": "1.0.0",
            "app_type": "bun", "abi": "v1",
            "entrypoint": "dist/index.js;rm -rf /"
        }"#;
        let err = parse_err(json);
        assert!(!err.is_empty());
    }

    #[test]
    fn valid_nested_path_accepted() {
        let json = r#"{
            "manifest_version": 2, "name": "my-app", "version": "1.0.0",
            "app_type": "bun", "abi": "v1",
            "entrypoint": "dist/index.js",
            "ui_path": "ui/dist"
        }"#;
        parse_ok(json);
    }

    // ── Homepage scheme ───────────────────────────────────────────────────────

    #[test]
    fn homepage_https_accepted() {
        let json = r#"{
            "name": "my-app", "version": "1.0.0", "app_type": "bun",
            "homepage": "https://example.com"
        }"#;
        parse_ok(json);
    }

    #[test]
    fn homepage_javascript_scheme_rejected() {
        let json = r#"{
            "name": "my-app", "version": "1.0.0", "app_type": "bun",
            "homepage": "javascript:alert(1)"
        }"#;
        let err = parse_err(json);
        assert!(
            err.contains("scheme"),
            "expected scheme error, got: {}",
            err
        );
    }

    #[test]
    fn homepage_file_scheme_rejected() {
        let json = r#"{
            "name": "my-app", "version": "1.0.0", "app_type": "bun",
            "homepage": "file:///etc/passwd"
        }"#;
        let err = parse_err(json);
        assert!(!err.is_empty());
    }

    // ── Effective defaults ────────────────────────────────────────────────────

    #[test]
    fn effective_entrypoint_native_default() {
        let m = parse_ok(r#"{"name":"cron","version":"1.0.0","app_type":"native"}"#);
        assert_eq!(m.effective_entrypoint(), "app.so");
    }

    #[test]
    fn effective_entrypoint_bun_default() {
        let m = parse_ok(r#"{"name":"myapp","version":"1.0.0","app_type":"bun"}"#);
        assert_eq!(m.effective_entrypoint(), "dist/index.js");
    }

    #[test]
    fn effective_hot_reload_native_default_is_experimental() {
        let m = parse_ok(r#"{"name":"cron","version":"1.0.0","app_type":"native"}"#);
        assert_eq!(m.effective_hot_reload(), HotReloadKind::Experimental);
    }

    #[test]
    fn effective_hot_reload_bun_default_is_supported() {
        let m = parse_ok(r#"{"name":"myapp","version":"1.0.0","app_type":"bun"}"#);
        assert_eq!(m.effective_hot_reload(), HotReloadKind::Supported);
    }

    #[test]
    fn hot_reload_unsupported_explicit() {
        let json = r#"{
            "manifest_version": 2, "name": "myapp", "version": "1.0.0",
            "app_type": "bun", "abi": "v1", "hot_reload": "unsupported"
        }"#;
        let m = parse_ok(json);
        assert_eq!(m.effective_hot_reload(), HotReloadKind::Unsupported);
    }

    // ── validate_manifest_path unit tests ─────────────────────────────────────

    #[test]
    fn validate_path_simple_valid() {
        assert!(validate_manifest_path("dist/index.js").is_ok());
        assert!(validate_manifest_path("app.so").is_ok());
        assert!(validate_manifest_path("ui/dist/bundle.js").is_ok());
        assert!(validate_manifest_path("build_output/main").is_ok());
    }

    #[test]
    fn validate_path_empty_rejected() {
        assert!(validate_manifest_path("").is_err());
    }

    #[test]
    fn validate_path_absolute_rejected() {
        assert!(validate_manifest_path("/usr/bin/sh").is_err());
    }

    #[test]
    fn validate_path_double_dot_segment_rejected() {
        assert!(validate_manifest_path("foo/../bar").is_err());
        assert!(validate_manifest_path("../etc/passwd").is_err());
    }

    #[test]
    fn validate_path_leading_dot_rejected() {
        assert!(validate_manifest_path(".hidden").is_err());
    }

    #[test]
    fn validate_path_null_byte_rejected() {
        // null byte is non-ASCII, rejected by char check
        let path = "foo\0bar";
        assert!(validate_manifest_path(path).is_err());
    }

    #[test]
    fn standalone_socket_path_development_override_is_explicit_and_pure() {
        let path = std::path::Path::new("/tmp/node-app/example.sock");
        assert!(validate_standalone_socket_path(path).is_err());
        assert!(validate_standalone_socket_path_with_policy(path, true).is_ok());
        assert!(validate_standalone_socket_path_with_policy(
            std::path::Path::new("/tmp/node-app/../escape.sock"),
            true,
        )
        .is_err());
    }

    // ── ManifestCapabilities defaults ─────────────────────────────────────────

    #[test]
    fn manifest_capabilities_defaults_to_empty() {
        let m = parse_ok(r#"{"name":"myapp","version":"1.0.0","app_type":"bun"}"#);
        assert!(m.capabilities.requires.is_empty());
        assert!(m.capabilities.provides.is_empty());
    }

    // ── resolved_capability_provides (T28 standalone-registration shaping) ────

    #[test]
    fn resolved_capability_provides_v1_only() {
        let json = r#"{
            "name": "example", "version": "1.0.0", "app_type": "bun",
            "provides": { "core.example.run": { "description": "Run example job" } }
        }"#;
        let m = parse_ok(json);
        let out = m.resolved_capability_provides();
        assert_eq!(out.len(), 1);
        assert_eq!(
            out.get("core.example.run").unwrap().description,
            "Run example job"
        );
    }

    #[test]
    fn resolved_capability_provides_v2_names_get_blank_declaration() {
        let json = r#"{
            "manifest_version": 2, "name": "example", "version": "1.0.0",
            "app_type": "bun", "abi": "v1",
            "capabilities": { "requires": [], "provides": ["core.example.run", "core.example.other:extra"] }
        }"#;
        let m = parse_ok(json);
        let out = m.resolved_capability_provides();
        assert_eq!(out.len(), 2);
        assert_eq!(out.get("core.example.run").unwrap().description, "");
        assert!(out.get("core.example.run").unwrap().schema.is_none());
        // Only the part before the first ':' is used as the name.
        assert!(out.contains_key("core.example.other"));
        assert!(!out.contains_key("core.example.other:extra"));
    }

    #[test]
    fn resolved_capability_provides_v1_wins_on_conflict() {
        let json = r#"{
            "manifest_version": 2, "name": "example", "version": "1.0.0",
            "app_type": "bun", "abi": "v1",
            "provides": { "core.example.run": { "description": "v1 wins" } },
            "capabilities": { "requires": [], "provides": ["core.example.run"] }
        }"#;
        let m = parse_ok(json);
        let out = m.resolved_capability_provides();
        assert_eq!(out.len(), 1);
        assert_eq!(out.get("core.example.run").unwrap().description, "v1 wins");
    }

    #[test]
    fn resolved_capability_provides_blank_v2_name_skipped() {
        let json = r#"{
            "manifest_version": 2, "name": "example", "version": "1.0.0",
            "app_type": "bun", "abi": "v1",
            "capabilities": { "requires": [], "provides": ["  ", "core.example.run"] }
        }"#;
        let m = parse_ok(json);
        let out = m.resolved_capability_provides();
        assert_eq!(out.len(), 1);
        assert!(out.contains_key("core.example.run"));
    }

    #[test]
    fn resolved_capability_provides_empty_manifest_yields_empty_map() {
        let m = parse_ok(r#"{"name":"myapp","version":"1.0.0","app_type":"bun"}"#);
        assert!(m.resolved_capability_provides().is_empty());
    }

    // ── ABI version ───────────────────────────────────────────────────────────

    #[test]
    fn abi_v1_is_supported() {
        assert!(AbiVersion::V1.is_supported());
    }

    // ── AppTier display ───────────────────────────────────────────────────────

    #[test]
    fn app_tier_display() {
        assert_eq!(AppTier::FirstParty.to_string(), "first_party");
        assert_eq!(AppTier::Optional.to_string(), "optional");
        assert_eq!(AppTier::Development.to_string(), "development");
    }

    #[test]
    fn app_tier_serde_roundtrip() {
        // Wire format must stay snake_case for the existing API contract.
        for tier in [AppTier::FirstParty, AppTier::Optional, AppTier::Development] {
            let json = serde_json::to_string(&tier).unwrap();
            let back: AppTier = serde_json::from_str(&json).unwrap();
            assert_eq!(
                tier, back,
                "roundtrip failed for {:?}: serialized as {}",
                tier, json
            );
        }
        assert_eq!(
            serde_json::to_string(&AppTier::Development).unwrap(),
            "\"development\""
        );
    }

    // ── AppType display ───────────────────────────────────────────────────────

    #[test]
    fn app_type_display() {
        assert_eq!(AppType::Native.to_string(), "native");
        assert_eq!(AppType::Bun.to_string(), "bun");
        assert_eq!(AppType::PlatformRuntime.to_string(), "platform-runtime");
    }

    #[test]
    fn platform_runtime_is_a_supported_packaging_type() {
        let manifest: AppManifest = serde_json::from_value(serde_json::json!({
            "manifest_version": 2,
            "abi": "v1",
            "name": "bun-runtime",
            "version": "1.0.0",
            "app_type": "platform-runtime",
            "entrypoint": "bun"
        }))
        .expect("platform runtime manifest should parse");

        assert_eq!(manifest.app_type, AppType::PlatformRuntime);
        assert_eq!(manifest.effective_hot_reload(), HotReloadKind::Unsupported);
    }
}