/**
 * Manifest v2: the inert JSON description of a plugin.
 *
 * Core reads this without running any plugin code, so everything that decides
 * whether a plugin may load, what it may do and where its UI appears has to be
 * expressible here.
 *
 * Unknown fields are rejected at every level. A typo'd "contribute" or
 * "permissionGroups" used to validate clean and be silently dropped, which
 * made a manifest look like it declared something it did not.
 */

import semver from "semver";
import { isKnownCapability } from "./capabilities.js";

/**
 * The plugin API this build implements. A minor bump adds to the API and
 * never removes; a major bump may break plugins.
 *
 * engine.api is a semver range checked against this ("1" means any 1.x,
 * "^1.2" needs 1.2 or later). engine.termix is checked against the core
 * version by the server.
 */
export const PLUGIN_API_VERSION = "1.0.0";

/** The API major, the default engine.api for a new plugin. */
export const SUPPORTED_PLUGIN_API_VERSION = String(
  semver.major(PLUGIN_API_VERSION),
);

/** Whether this build's plugin API satisfies a manifest's engine.api. */
export function isApiCompatible(range: string): boolean {
  return (
    semver.validRange(range) !== null &&
    semver.satisfies(PLUGIN_API_VERSION, range)
  );
}

/**
 * Whether a core version satisfies a manifest's engine.termix. A prerelease
 * core (2.9.0-beta.1) counts as that release.
 */
export function isTermixCompatible(
  range: string,
  coreVersion: string | null,
): boolean {
  if (!coreVersion || !semver.valid(semver.coerce(coreVersion))) return true;
  if (semver.validRange(range) === null) return false;
  return semver.satisfies(semver.coerce(coreVersion)!.version, range);
}

export const PLUGIN_CATEGORIES = [
  "Terminal",
  "Files & Transfer",
  "Infrastructure",
  "Monitoring",
  "Networking",
  "Access & Security",
  "Productivity",
] as const;

export const PLUGIN_PLATFORMS = ["linux", "win32", "darwin"] as const;

export const ACTION_CONTRIBUTION_KINDS = ["button", "component"] as const;
export type ActionContributionKind = (typeof ACTION_CONTRIBUTION_KINDS)[number];

const OPEN_FROM_VALUES = ["rail", "host-context-menu", "palette"] as const;

const ID_PATTERN = /^[a-z][a-z0-9-]{1,39}$/;

/**
 * Ids no plugin may take. A permission is registered as <id>.<name>, so a
 * plugin called "admin" would mint admin.* permissions and could default them
 * onto the user role; the rest are names core or the runtime already uses.
 */
export const RESERVED_PLUGIN_IDS: readonly string[] = [
  "admin",
  "hosts",
  "credentials",
  "core",
  "termix",
  "plugin",
  "plugins",
  "users",
  "system",
  "sdk",
];

/** A preset key is a plain property name, never a prototype one. */
const PRESET_KEY_PATTERN = /^[a-zA-Z][a-zA-Z0-9_]{0,63}$/;
const SEMVER_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z-.]+)?(\+[0-9A-Za-z-.]+)?$/;
/** Service names are dotted, e.g. "ssh.transport". */
const SERVICE_PATTERN = /^[a-z0-9-]+(\.[a-z0-9-]+)+$/;
const SECRET_KEY_PATTERN = /^[a-z0-9-]+$/;
/** Action ids name a frontend function, so segments may be camelCase. */
const ACTION_ID_PATTERN = /^[a-z0-9-]+(\.[a-zA-Z0-9-]+)+$/;
const HANDLER_PATTERN = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
/**
 * A plugin-relative permission name. Unlike a full id one segment is fine,
 * and underscores are allowed in the first segment too ("manage_providers").
 */
const PERMISSION_NAME_PATTERN = /^[a-z0-9_-]+(\.[a-z0-9_-]+)*$/;

/** The roles core seeds. A plugin may only set defaults for these. */
export const SYSTEM_ROLE_NAMES = ["admin", "user"] as const;
export type SystemRoleName = (typeof SYSTEM_ROLE_NAMES)[number];

/**
 * Core permission groups. A plugin permission may not start with one of these,
 * or a manifest could declare admin.users.manage and gate a route on it.
 */
export const RESERVED_PERMISSION_PREFIXES = [
  "hosts",
  "credentials",
  "admin",
] as const;

/** The id a plugin-relative permission name is registered under. */
export function qualifyPermission(pluginId: string, name: string): string {
  return `${pluginId}.${name}`;
}

export interface PluginAuthor {
  name: string;
  url?: string;
}

export interface PluginEngine {
  /** Semver range of Termix releases the plugin runs on, e.g. ">=2.9.0". */
  termix: string;
  /**
   * Semver range of the plugin API it needs, e.g. "1" or "^1.2". Use the
   * lowest minor whose API you call, so older cores refuse it cleanly.
   */
  api: string;
}

export interface HostCapabilityContribution {
  key: string;
  labelKey: string;
  editorTab: string;
}

export interface PluginTabContribution {
  id: string;
  titleKey: string;
  icon: string;
  openFrom: string[];
}

/**
 * A sidebar panel or dashboard card the plugin's frontend registers. Declared
 * here so core knows who owns a saved view even while the plugin is off and
 * its code never loaded.
 */
export interface PluginViewContribution {
  id: string;
  titleKey: string;
  icon?: string;
}

/**
 * One role permission a plugin contributes.
 *
 * `name` is short and plugin-relative; core registers it as
 * `<pluginId>.<name>`, so a plugin can never name a core group or another
 * plugin's namespace. The i18n keys are plugin-relative too.
 */
export interface PluginPermissionContribution {
  name: string;
  titleKey: string;
  descriptionKey: string;
  /** System roles that should hold this the first time it is seen. */
  defaultRoles?: SystemRoleName[];
}

export interface PluginActionContribution {
  id: string;
  titleKey: string;
  /** Name of the frontend export implementing this action. */
  handler: string;
  icon?: string;
  permission?: string;
  slot?: string;
  kind?: ActionContributionKind;
}

export interface PluginActionSlot {
  id: string;
  accepts: ActionContributionKind[];
  descriptionKey?: string;
}

export interface PluginServiceProvide {
  service: string;
  version: string;
  /** The role permission a calling user needs. */
  permission: string;
  /**
   * Named providers this plugin registers, for a service several plugins
   * provide side by side (sessions.live, keyed by session type). Omitted, the
   * plugin provides it once, unnamed.
   */
  names?: string[];
}

export interface PluginServiceRequire {
  service: string;
  versionRange: string;
  optional?: boolean;
}

export interface PluginSecretProvide {
  key: string;
  permission: string;
  descriptionKey?: string;
}

export interface PluginSecretRequire {
  plugin: string;
  key: string;
  optional?: boolean;
}

export const SETTINGS_FIELD_TYPES = [
  "boolean",
  "string",
  "number",
  "select",
  "multiselect",
  "secret",
  "textarea",
  "json",
  "custom",
] as const;
export type PluginSettingsFieldType = (typeof SETTINGS_FIELD_TYPES)[number];

export const SETTINGS_SCOPES = ["admin", "user", "host"] as const;
export type PluginSettingsScope = (typeof SETTINGS_SCOPES)[number];

export interface PluginSettingsOption {
  value: string;
  labelKey: string;
}

/**
 * One field on a plugin's settings page.
 *
 * Core renders these; a plugin supplies data only, so it cannot ship its own
 * form styling and drift from the rest of the app. `type: "custom"` is the
 * escape hatch for UI a schema cannot express, and names a component the
 * frontend registered rather than carrying markup.
 */
export interface PluginSettingsField {
  key: string;
  type: PluginSettingsFieldType;
  /** Required except for "custom", which draws its own label. */
  labelKey?: string;
  descriptionKey?: string;
  placeholderKey?: string;
  default?: unknown;
  /** select and multiselect only. */
  options?: PluginSettingsOption[];
  /** number only. */
  min?: number;
  max?: number;
  /** Key of a boolean field in the same scope that must be on. */
  requires?: string;
  /**
   * Who may write it. Admin fields default to admin.plugins.manage; a short
   * name resolves against this plugin's own permissions.
   */
  permission?: string;
  /** Section heading this field sits under. */
  group?: string;
  /** Registered component id. Required when type is "custom". */
  component?: string;
  /**
   * Deprecated and ignored: host defaults cover every host field now. Still
   * accepted so an older manifest loads. Removed in 3.0.0.
   */
  defaultFrom?: string;
  /**
   * Host scope only: whether the field can have a host default (server,
   * user or folder) that hosts follow until they set their own. On by
   * default for every field except secrets and json fields with
   * `secretKeys`. Turn it off for a value that only makes sense per host,
   * such as a MAC address or an API endpoint.
   */
  defaultable?: boolean;
  /**
   * Host scope only: the levels that may set a default for it. Defaults to
   * all three. Leave "admin" out for a value that points at one user's own
   * rows (a snippet id, a profile id).
   */
  defaultLevels?: Array<"admin" | "user" | "folder">;
  /**
   * Host scope only: a look-and-feel value. When the host follows its
   * defaults, a user it is shared with gets their own defaults for it
   * rather than the owner's.
   */
  personal?: boolean;
  /**
   * Host scope only: the lowest share level whose recipients see this value
   * in the host payload. Defaults to "connect", everyone who sees the host.
   */
  shareRead?: "connect" | "view" | "edit" | "manage";
  /** Host scope only: only the host's owner may change it. */
  ownerOnly?: boolean;
  /**
   * JSON fields only: keys inside the stored object that hold secrets, such
   * as a gateway password. Core clears them from exports like any secret.
   */
  secretKeys?: string[];
  /**
   * Stored and validated like any field, but not drawn by the generic
   * settings form, because the plugin edits it in its own UI (a host editor
   * section).
   */
  hidden?: boolean;
}

export interface PluginHostSettingsContribution {
  /** Boolean field rendered first, gating the rest of the section. */
  enableKey?: string;
  enableLabelKey?: string;
  enableDescriptionKey?: string;
  /** What the enable switch reads before a host saves it. Off by default. */
  enableDefault?: boolean;
  /** Host editor strip the generated tab sits in. Defaults to "top". */
  editorGroup?: "top" | "ssh";
  /** Position among that strip's tabs, core ones included. */
  editorOrder?: number;
  fields: PluginSettingsField[];
}

export interface PluginSettingsContribution {
  admin?: PluginSettingsField[];
  user?: PluginSettingsField[];
  host?: PluginHostSettingsContribution;
}

/**
 * What a plugin adds to sign-in and SSH auth. Declared so core can tell who
 * owns an auth type or factor even while the plugin is disabled, and so the
 * login screen knows which bundles it needs before anyone has signed in.
 */
export interface PluginAuthContribution {
  /** Values of ssh_data.auth_type this plugin provides. */
  sshAuthTypes?: string[];
  /** Login method ids. */
  loginMethods?: string[];
  /** Second factor ids. */
  secondFactors?: string[];
  /** Schemes this plugin resolves for "<scheme>://..." secret references, e.g. "op". */
  secretSchemes?: string[];
  /** Keyboard-interactive handler ids, e.g. "warpgate". */
  keyboardInteractive?: string[];
}

export interface PluginContributions {
  tabs?: PluginTabContribution[];
  panels?: PluginViewContribution[];
  dashboardCards?: PluginViewContribution[];
  /**
   * The frontend also runs on anonymous guest pages (shared-session and
   * collab links), where it is activated with app.guest set.
   */
  guest?: boolean;
  /**
   * `?view=` names an anonymous guest page may open. Each must be served by a
   * tab's `standalone` component. Needs `guest: true`.
   */
  guestViews?: string[];
  actions?: PluginActionContribution[];
  actionSlots?: PluginActionSlot[];
  permissions?: PluginPermissionContribution[];
  settings?: PluginSettingsContribution;
  /**
   * A host-editor checkbox backed by a boolean column on the host record.
   * A5/A6/A7 reshape this; it stays in v2 because remote-desktop, docker,
   * proxmox and web-endpoint ship it today.
   */
  hostCapability?: HostCapabilityContribution | HostCapabilityContribution[];
  auth?: PluginAuthContribution;
  http?: PluginHttpContribution;
  /**
   * This plugin's Appearance defaults for each interface preset, read in the
   * frontend with usePluginUiPreferences. Every preset names the same keys;
   * values are booleans, numbers, strings or string arrays.
   */
  uiPresets?: Record<
    "simple" | "balanced" | "advanced",
    Record<string, unknown>
  >;
  /**
   * Wire names of the sync entities this plugin registers with
   * ctx.sync.registerEntity, so a server can name them while the plugin is
   * off and a desktop can list them in its sync settings.
   */
  syncEntities?: string[];
  /**
   * Other plugins' action, slot and extension point ids this plugin calls,
   * fills or extends. Declaration only: nothing breaks when the owner is
   * missing, but the coupling is written down where tools and people can
   * see it.
   */
  uses?: string[];
  /**
   * Keybinding actions this plugin adds to Appearance > Keybindings, with
   * the parameters a saved binding carries. Core validates saved bindings
   * against these without running plugin code, and translates a parameter
   * naming a sync entity over sync.
   */
  keybindingActions?: PluginKeybindingActionContribution[];
  /**
   * Connection protocols whose per-host login core stores, encrypts,
   * shares, exports and syncs for this plugin, read back with
   * ctx.credentials.resolveHostProtocol.
   */
  protocols?: PluginProtocolContribution[];
}

/** A field a protocol login carries besides username and password. */
export interface PluginProtocolCredentialField {
  key: string;
  /** Encrypted with the owner's data key and never sent to a browser. */
  secret?: boolean;
}

export interface PluginProtocolContribution {
  /** Stored with each login. Never change it once hosts use it. */
  id: string;
  credentialFields?: PluginProtocolCredentialField[];
  /**
   * The port an import row without one gets, for a host whose main
   * protocol this is.
   */
  defaultPort?: number;
  /**
   * What the owner's login falls back to from the host's own SSH login
   * when the protocol login leaves it empty.
   */
  hostLoginFallback?: Array<"username" | "password">;
}

/** Protocol ids core keeps for itself. */
export const RESERVED_PROTOCOL_IDS: readonly string[] = ["ssh"];

/** Login keys a declared credential field may not reuse. */
export const RESERVED_PROTOCOL_FIELD_KEYS: readonly string[] = [
  "username",
  "password",
  "authType",
  "credentialId",
];

/** One parameter a saved keybinding action carries next to its type. */
export interface PluginKeybindingParam {
  type: "string" | "boolean";
  required?: boolean;
  /** A regular expression a string value must match. */
  pattern?: string;
  maxLength?: number;
  /**
   * The value is a local row id of this sync entity, stored as a string.
   * Sync sends the row's syncId instead.
   */
  syncEntity?: string;
}

export interface PluginKeybindingActionContribution {
  /**
   * Stored as the binding's action.type. New actions use
   * "<plugin id>.<name>"; the bundled ones keep their 2.8 names.
   */
  id: string;
  params?: Record<string, PluginKeybindingParam>;
}

/** Keybinding action types the shell runs itself; no plugin may declare them. */
export const CORE_KEYBINDING_ACTIONS: readonly string[] = [
  "nextTab",
  "previousTab",
  "openCommandPalette",
  "reconnectSession",
];

/**
 * How a desktop linked to a server treats this plugin.
 * - "mirror": follows the server, installed and switched on or off with it.
 * - "local": each desktop decides for itself (a serial port is local).
 * - "server": only makes sense on a server, never runs on a linked desktop.
 */
export type PluginDesktopMode = "mirror" | "local" | "server";
export const PLUGIN_DESKTOP_MODES: readonly PluginDesktopMode[] = [
  "mirror",
  "local",
  "server",
];

export interface PluginHttpContribution {
  /**
   * Old URLs something outside Termix still calls (a webhook a third party
   * posts to). Each must start with "/<plugin id>/"; a request under it is
   * served by this plugin's router with that prefix removed, so
   * "/automations/webhook/x" reaches the route "/webhook/x". Core routes win
   * a clash.
   */
  legacyPaths?: string[];
  /**
   * Old URLs outside the plugin's namespace that something outside Termix
   * still sends people to (an identity provider's callback, a published
   * resolver URL). A request at `from`, or under it, is redirected to `to`
   * under /plugin-api/<id>/ with the rest of the path and the query kept.
   * Core routes win a clash.
   */
  legacyRedirects?: PluginLegacyRedirect[];
  /**
   * An admin may call this plugin's routes on behalf of another user with
   * the X-Admin-Target-User header (the admin "manage user" panel). Without
   * it core refuses the header on every route under /plugin-api/<id>/.
   */
  adminImpersonation?: boolean;
}

export interface PluginLegacyRedirect {
  /** An absolute path, e.g. "/users/oidc/callback". */
  from: string;
  /** A path in this plugin's router, e.g. "/callback". */
  to: string;
  /** 307 (the default) or 308 for a permanent move. */
  status?: 307 | 308;
}

export interface PluginManifest {
  id: string;
  name: string;
  version: string;
  description: string;
  author: PluginAuthor;
  license: string;
  repository?: string;
  category: string;
  icon?: string;
  engine: PluginEngine;
  /** Catalog capability ids. */
  capabilities: string[];
  /** pluginId -> semver range. A missing one blocks activation. */
  dependencies?: Record<string, string>;
  /** pluginId -> semver range. A missing one is normal. */
  optionalDependencies?: Record<string, string>;
  provides?: PluginServiceProvide[];
  requires?: PluginServiceRequire[];
  providesSecret?: PluginSecretProvide[];
  requiresSecret?: PluginSecretRequire[];
  contributes?: PluginContributions;
  /** Built backend entry, relative to the plugin root. */
  backend?: string;
  /** Built frontend entry, relative to the plugin root. */
  frontend?: string;
  /** Locales directory, relative to the plugin root. */
  locales?: string;
  platforms?: string[];
  /**
   * Bare npm package names carrying a native (.node) binding. The CLI build
   * never bundles them: they stay a real dependency in the plugin's own
   * package.json and are resolved from node_modules at runtime instead,
   * because esbuild bundling a native addon breaks the relative path it uses
   * to locate its compiled binary.
   */
  nativeDependencies?: string[];
  /** How a linked desktop treats this plugin. Defaults to "mirror". */
  desktop?: PluginDesktopMode;
}

export const DEFAULT_BACKEND_ENTRY = "dist/backend.js";
export const DEFAULT_FRONTEND_ENTRY = "dist/frontend.js";
export const DEFAULT_LOCALES_DIR = "locales";

const REQUIRED_TOP_LEVEL = [
  "id",
  "name",
  "version",
  "description",
  "author",
  "license",
  "engine",
  "category",
  "capabilities",
];

const ALLOWED_TOP_LEVEL = new Set([
  ...REQUIRED_TOP_LEVEL,
  "repository",
  "icon",
  "dependencies",
  "optionalDependencies",
  "provides",
  "requires",
  "providesSecret",
  "requiresSecret",
  "contributes",
  "backend",
  "frontend",
  "locales",
  "platforms",
  "nativeDependencies",
  "desktop",
]);

const ALLOWED_CONTRIBUTES = new Set([
  "tabs",
  "panels",
  "dashboardCards",
  "guest",
  "guestViews",
  "actions",
  "actionSlots",
  "permissions",
  "settings",
  "hostCapability",
  "http",
  "uiPresets",
  "auth",
  "syncEntities",
  "uses",
  "keybindingActions",
  "protocols",
]);

const ALLOWED_SETTINGS_FIELD = [
  "key",
  "type",
  "labelKey",
  "descriptionKey",
  "placeholderKey",
  "default",
  "options",
  "min",
  "max",
  "requires",
  "permission",
  "group",
  "component",
  "hidden",
  "defaultFrom",
  "defaultable",
  "defaultLevels",
  "personal",
  "shareRead",
  "ownerOnly",
  "secretKeys",
];

const SHARE_LEVELS = ["connect", "view", "edit", "manage"];

/** Settings keys are stored as-is, so they stay short and index-safe. */
const SETTINGS_KEY_PATTERN = /^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/;

function isPlainObject(value: unknown): value is Record<string, unknown> {
  return typeof value === "object" && value !== null && !Array.isArray(value);
}

/** Pushes an error for every key that is not in `allowed`. */
function rejectUnknown(
  value: Record<string, unknown>,
  allowed: Set<string> | string[],
  where: string,
  errors: string[],
): void {
  const set = Array.isArray(allowed) ? new Set(allowed) : allowed;
  for (const key of Object.keys(value)) {
    if (!set.has(key)) {
      errors.push(`Unknown field "${key}" in ${where}`);
    }
  }
}

/**
 * A path inside the plugin folder. Absolute paths, ".." and backslashes are
 * refused so an entry point or asset folder cannot point outside the plugin.
 */
function requireRelativePath(
  value: string,
  where: string,
  errors: string[],
): void {
  const segments = value.split("/");
  if (
    value.startsWith("/") ||
    /^[A-Za-z]:/.test(value) ||
    value.includes("\\") ||
    value.includes("\0") ||
    segments.includes("..") ||
    segments.every((segment) => segment === "" || segment === ".")
  ) {
    errors.push(
      `Field "${where}" must be a relative path inside the plugin, got: ${JSON.stringify(value)}`,
    );
  }
}

function requireString(
  value: unknown,
  where: string,
  errors: string[],
): value is string {
  if (typeof value !== "string" || value.trim().length === 0) {
    errors.push(`Field "${where}" must be a non-empty string`);
    return false;
  }
  return true;
}

export function validateManifest(manifest: unknown): string[] {
  const errors: string[] = [];

  if (!isPlainObject(manifest)) {
    return ["Manifest must be a JSON object"];
  }

  const m = manifest;
  rejectUnknown(m, ALLOWED_TOP_LEVEL, "the manifest", errors);

  for (const field of REQUIRED_TOP_LEVEL) {
    if (!(field in m)) errors.push(`Missing required field: "${field}"`);
  }

  if ("id" in m) {
    if (typeof m.id !== "string" || !ID_PATTERN.test(m.id)) {
      errors.push(
        `Field "id" must match ${ID_PATTERN} (lowercase, starts with a letter, 2-40 chars), got: ${JSON.stringify(m.id)}`,
      );
    } else if (RESERVED_PLUGIN_IDS.includes(m.id)) {
      errors.push(`Field "id" may not be "${m.id}": that name is reserved`);
    }
  }

  if ("name" in m) requireString(m.name, "name", errors);
  if ("description" in m) requireString(m.description, "description", errors);
  if ("license" in m) requireString(m.license, "license", errors);

  if ("version" in m) {
    if (typeof m.version !== "string" || !SEMVER_PATTERN.test(m.version)) {
      errors.push(
        `Field "version" must be valid semver, got: ${JSON.stringify(m.version)}`,
      );
    }
  }

  if ("repository" in m) requireString(m.repository, "repository", errors);
  if ("icon" in m) requireString(m.icon, "icon", errors);
  for (const field of ["backend", "frontend", "locales"] as const) {
    if (field in m && requireString(m[field], field, errors)) {
      requireRelativePath(m[field] as string, field, errors);
    }
  }

  validateAuthor(m.author, errors);
  validateEngine(m.engine, errors);
  validateCategory(m.category, errors);
  validateCapabilities(m.capabilities, errors);
  validatePlatforms(m.platforms, errors);
  validateNativeDependencies(m.nativeDependencies, errors);
  if (
    m.desktop !== undefined &&
    !PLUGIN_DESKTOP_MODES.includes(m.desktop as PluginDesktopMode)
  ) {
    errors.push(
      `Field "desktop" must be one of: ${PLUGIN_DESKTOP_MODES.join(", ")}`,
    );
  }
  validateDependencyMap(m.dependencies, "dependencies", errors);
  validateDependencyMap(m.optionalDependencies, "optionalDependencies", errors);
  validateProvides(m.provides, errors);
  validateRequires(m.requires, errors);
  validateProvidesSecret(m.providesSecret, errors);
  validateRequiresSecret(m.requiresSecret, errors);
  validateContributes(
    m.contributes,
    typeof m.id === "string" ? m.id : undefined,
    errors,
  );

  return errors;
}

function validateAuthor(author: unknown, errors: string[]): void {
  if (author === undefined) return;
  if (!isPlainObject(author)) {
    errors.push('Field "author" must be an object');
    return;
  }
  rejectUnknown(author, ["name", "url"], '"author"', errors);
  requireString(author.name, "author.name", errors);
  if ("url" in author) requireString(author.url, "author.url", errors);
}

function validateEngine(engine: unknown, errors: string[]): void {
  if (engine === undefined) return;
  if (!isPlainObject(engine)) {
    errors.push('Field "engine" must be an object');
    return;
  }
  rejectUnknown(engine, ["termix", "api"], '"engine"', errors);
  requireString(engine.termix, "engine.termix", errors);
  if (
    typeof engine.termix === "string" &&
    semver.validRange(engine.termix) === null
  ) {
    errors.push(
      `Field "engine.termix" must be a semver range, got: ${JSON.stringify(engine.termix)}`,
    );
  }
  if (
    typeof engine.api !== "string" ||
    semver.validRange(engine.api) === null
  ) {
    errors.push(
      `Field "engine.api" must be a semver range such as "1" or "^1.2", got: ${JSON.stringify(engine.api)}`,
    );
  }
}

function validateCategory(category: unknown, errors: string[]): void {
  if (category === undefined) return;
  if (typeof category !== "string") {
    errors.push('Field "category" must be a string');
    return;
  }
  if (!PLUGIN_CATEGORIES.includes(category as never)) {
    errors.push(
      `Field "category" must be one of: ${PLUGIN_CATEGORIES.join(", ")}, got: "${category}"`,
    );
  }
}

function validateCapabilities(capabilities: unknown, errors: string[]): void {
  if (capabilities === undefined) return;
  if (!Array.isArray(capabilities)) {
    errors.push('Field "capabilities" must be an array of capability ids');
    return;
  }
  const seen = new Set<string>();
  capabilities.forEach((capability, index) => {
    if (typeof capability !== "string") {
      errors.push(`capabilities[${index}] must be a string`);
      return;
    }
    if (!isKnownCapability(capability)) {
      errors.push(
        `capabilities[${index}] is not a known capability: "${capability}"`,
      );
      return;
    }
    if (seen.has(capability)) {
      errors.push(`capabilities[${index}] duplicates "${capability}"`);
    }
    seen.add(capability);
  });
}

function validatePlatforms(platforms: unknown, errors: string[]): void {
  if (platforms === undefined) return;
  if (!Array.isArray(platforms) || platforms.length === 0) {
    errors.push('Field "platforms" must be a non-empty array when present');
    return;
  }
  platforms.forEach((platform, index) => {
    if (!PLUGIN_PLATFORMS.includes(platform as never)) {
      errors.push(
        `platforms[${index}] must be one of: ${PLUGIN_PLATFORMS.join(", ")}, got: ${JSON.stringify(platform)}`,
      );
    }
  });
}

function validateNativeDependencies(value: unknown, errors: string[]): void {
  if (value === undefined) return;
  if (!Array.isArray(value) || value.length === 0) {
    errors.push(
      'Field "nativeDependencies" must be a non-empty array when present',
    );
    return;
  }
  value.forEach((entry, index) => {
    if (typeof entry !== "string" || entry.length === 0) {
      errors.push(`nativeDependencies[${index}] must be a non-empty string`);
    }
  });
}

function validateDependencyMap(
  value: unknown,
  field: string,
  errors: string[],
): void {
  if (value === undefined) return;
  if (!isPlainObject(value)) {
    errors.push(
      `Field "${field}" must be an object of pluginId -> semver range`,
    );
    return;
  }
  for (const [pluginId, range] of Object.entries(value)) {
    if (!ID_PATTERN.test(pluginId)) {
      errors.push(`${field} key "${pluginId}" is not a valid plugin id`);
    }
    if (typeof range !== "string" || !semver.validRange(range)) {
      errors.push(
        `${field}["${pluginId}"] must be a valid semver range, got: ${JSON.stringify(range)}`,
      );
    }
  }
}

function validateProvides(provides: unknown, errors: string[]): void {
  if (provides === undefined) return;
  if (!Array.isArray(provides)) {
    errors.push('Field "provides" must be an array');
    return;
  }
  const seen = new Set<string>();
  provides.forEach((raw, index) => {
    const where = `provides[${index}]`;
    if (!isPlainObject(raw)) {
      errors.push(`${where} must be an object`);
      return;
    }
    rejectUnknown(
      raw,
      ["service", "version", "permission", "names"],
      where,
      errors,
    );

    if (typeof raw.service !== "string" || !SERVICE_PATTERN.test(raw.service)) {
      errors.push(`${where}.service must be a dotted lowercase name`);
    } else {
      if (seen.has(raw.service)) {
        errors.push(`${where}.service duplicates "${raw.service}"`);
      }
      seen.add(raw.service);
    }

    if (typeof raw.version !== "string" || !SEMVER_PATTERN.test(raw.version)) {
      errors.push(`${where}.version must be valid semver`);
    }
    requireString(raw.permission, `${where}.permission`, errors);
    if (raw.names !== undefined) {
      validateNameList(raw.names, `${where}.names`, errors);
    }
  });
}

const PROVIDER_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;

function validateSyncEntities(value: unknown, errors: string[]) {
  const where = "contributes.syncEntities";
  if (!Array.isArray(value) || value.length === 0) {
    errors.push(`${where} must be a non-empty array`);
    return;
  }
  const seen = new Set<string>();
  for (const name of value) {
    if (typeof name !== "string" || !/^[a-zA-Z][a-zA-Z0-9]*$/.test(name)) {
      errors.push(`${where} entries must be letters and digits`);
      continue;
    }
    if (seen.has(name)) errors.push(`${where} duplicates "${name}"`);
    seen.add(name);
  }
}

function validateUses(value: unknown, errors: string[]) {
  const where = "contributes.uses";
  if (!Array.isArray(value) || value.length === 0) {
    errors.push(`${where} must be a non-empty array`);
    return;
  }
  const seen = new Set<string>();
  for (const id of value) {
    if (
      typeof id !== "string" ||
      !/^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)+$/.test(id)
    ) {
      errors.push(
        `${where} entries must be dotted ids such as "terminal.open"`,
      );
      continue;
    }
    if (seen.has(id)) errors.push(`${where} duplicates "${id}"`);
    seen.add(id);
  }
}

function validateNameList(value: unknown, where: string, errors: string[]) {
  if (!Array.isArray(value) || value.length === 0) {
    errors.push(`${where} must be a non-empty array`);
    return;
  }
  const seen = new Set<string>();
  for (const name of value) {
    if (typeof name !== "string" || !PROVIDER_NAME_PATTERN.test(name)) {
      errors.push(`${where} entries must be lowercase names`);
      continue;
    }
    if (seen.has(name)) errors.push(`${where} duplicates "${name}"`);
    seen.add(name);
  }
}

function validateRequires(requires: unknown, errors: string[]): void {
  if (requires === undefined) return;
  if (!Array.isArray(requires)) {
    errors.push('Field "requires" must be an array');
    return;
  }
  requires.forEach((raw, index) => {
    const where = `requires[${index}]`;
    if (!isPlainObject(raw)) {
      errors.push(`${where} must be an object`);
      return;
    }
    rejectUnknown(raw, ["service", "versionRange", "optional"], where, errors);

    if (typeof raw.service !== "string" || !SERVICE_PATTERN.test(raw.service)) {
      errors.push(`${where}.service must be a dotted lowercase name`);
    }
    if (
      typeof raw.versionRange !== "string" ||
      !semver.validRange(raw.versionRange)
    ) {
      errors.push(`${where}.versionRange must be a valid semver range`);
    }
    if ("optional" in raw && typeof raw.optional !== "boolean") {
      errors.push(`${where}.optional must be a boolean`);
    }
  });
}

function validateProvidesSecret(value: unknown, errors: string[]): void {
  if (value === undefined) return;
  if (!Array.isArray(value)) {
    errors.push('Field "providesSecret" must be an array');
    return;
  }
  const seen = new Set<string>();
  value.forEach((raw, index) => {
    const where = `providesSecret[${index}]`;
    if (!isPlainObject(raw)) {
      errors.push(`${where} must be an object`);
      return;
    }
    rejectUnknown(raw, ["key", "permission", "descriptionKey"], where, errors);

    if (typeof raw.key !== "string" || !SECRET_KEY_PATTERN.test(raw.key)) {
      errors.push(`${where}.key must be a lowercase slug`);
    } else {
      if (seen.has(raw.key))
        errors.push(`${where}.key duplicates "${raw.key}"`);
      seen.add(raw.key);
    }
    requireString(raw.permission, `${where}.permission`, errors);
    if ("descriptionKey" in raw) {
      requireString(raw.descriptionKey, `${where}.descriptionKey`, errors);
    }
  });
}

function validateRequiresSecret(value: unknown, errors: string[]): void {
  if (value === undefined) return;
  if (!Array.isArray(value)) {
    errors.push('Field "requiresSecret" must be an array');
    return;
  }
  value.forEach((raw, index) => {
    const where = `requiresSecret[${index}]`;
    if (!isPlainObject(raw)) {
      errors.push(`${where} must be an object`);
      return;
    }
    rejectUnknown(raw, ["plugin", "key", "optional"], where, errors);

    if (typeof raw.plugin !== "string" || !ID_PATTERN.test(raw.plugin)) {
      errors.push(`${where}.plugin must be a valid plugin id`);
    }
    if (typeof raw.key !== "string" || !SECRET_KEY_PATTERN.test(raw.key)) {
      errors.push(`${where}.key must be a lowercase slug`);
    }
    if ("optional" in raw && typeof raw.optional !== "boolean") {
      errors.push(`${where}.optional must be a boolean`);
    }
  });
}

function validateContributes(
  contributes: unknown,
  pluginId: string | undefined,
  errors: string[],
): void {
  if (contributes === undefined) return;
  if (!isPlainObject(contributes)) {
    errors.push('Field "contributes" must be an object');
    return;
  }
  rejectUnknown(contributes, ALLOWED_CONTRIBUTES, '"contributes"', errors);

  validateTabs(contributes.tabs, errors);
  validateViews(contributes.panels, "panels", errors);
  validateViews(contributes.dashboardCards, "dashboardCards", errors);
  if (
    contributes.guest !== undefined &&
    typeof contributes.guest !== "boolean"
  ) {
    errors.push('Field "contributes.guest" must be a boolean');
  }
  if (contributes.guestViews !== undefined) {
    validateNameList(contributes.guestViews, "contributes.guestViews", errors);
    if (contributes.guest !== true) {
      errors.push('Field "contributes.guestViews" needs "contributes.guest"');
    }
  }
  if (contributes.syncEntities !== undefined) {
    validateSyncEntities(contributes.syncEntities, errors);
  }
  if (contributes.uses !== undefined) {
    validateUses(contributes.uses, errors);
  }
  validatePermissions(contributes.permissions, pluginId, errors);
  validateActions(contributes.actions, errors);
  validateActionSlots(contributes.actionSlots, errors);
  validateSettings(contributes.settings, errors);
  validateHostCapability(contributes.hostCapability, errors);
  validateAuthContribution(contributes.auth, errors);
  validateHttpContribution(contributes.http, pluginId, errors);
  validateUiPresets(contributes.uiPresets, errors);
  validateKeybindingActions(contributes.keybindingActions, errors);
  validateProtocols(contributes.protocols, errors);
}

export const PROTOCOL_ID_PATTERN = /^[a-z][a-z0-9-]{0,31}$/;
export const PROTOCOL_FIELD_KEY_PATTERN = /^[a-zA-Z][a-zA-Z0-9]{0,31}$/;

function validateProtocols(value: unknown, errors: string[]): void {
  if (value === undefined) return;
  const where = "contributes.protocols";
  if (!Array.isArray(value)) {
    errors.push(`Field "${where}" must be an array`);
    return;
  }
  const seen = new Set<string>();
  value.forEach((raw, index) => {
    const at = `${where}[${index}]`;
    if (!isPlainObject(raw)) {
      errors.push(`${at} must be an object`);
      return;
    }
    rejectUnknown(
      raw,
      ["id", "credentialFields", "defaultPort", "hostLoginFallback"],
      at,
      errors,
    );
    if (typeof raw.id !== "string" || !PROTOCOL_ID_PATTERN.test(raw.id)) {
      errors.push(
        `${at}.id must be lowercase letters, digits and dashes, starting with a letter`,
      );
    } else if (RESERVED_PROTOCOL_IDS.includes(raw.id)) {
      errors.push(`${at}.id "${raw.id}" belongs to core`);
    } else {
      if (seen.has(raw.id)) errors.push(`${at}.id duplicates "${raw.id}"`);
      seen.add(raw.id);
    }
    if (
      raw.defaultPort !== undefined &&
      (typeof raw.defaultPort !== "number" ||
        !Number.isInteger(raw.defaultPort) ||
        raw.defaultPort < 1 ||
        raw.defaultPort > 65535)
    ) {
      errors.push(`${at}.defaultPort must be a port number`);
    }
    if (raw.hostLoginFallback !== undefined) {
      if (
        !Array.isArray(raw.hostLoginFallback) ||
        raw.hostLoginFallback.some(
          (entry) => entry !== "username" && entry !== "password",
        )
      ) {
        errors.push(
          `${at}.hostLoginFallback must list "username" and/or "password"`,
        );
      }
    }
    if (raw.credentialFields === undefined) return;
    if (!Array.isArray(raw.credentialFields)) {
      errors.push(`${at}.credentialFields must be an array`);
      return;
    }
    const keys = new Set<string>();
    raw.credentialFields.forEach((field, fieldIndex) => {
      const fieldAt = `${at}.credentialFields[${fieldIndex}]`;
      if (!isPlainObject(field)) {
        errors.push(`${fieldAt} must be an object`);
        return;
      }
      rejectUnknown(field, ["key", "secret"], fieldAt, errors);
      if (
        typeof field.key !== "string" ||
        !PROTOCOL_FIELD_KEY_PATTERN.test(field.key)
      ) {
        errors.push(`${fieldAt}.key must be letters and digits`);
      } else if (RESERVED_PROTOCOL_FIELD_KEYS.includes(field.key)) {
        errors.push(`${fieldAt}.key "${field.key}" is part of every login`);
      } else {
        if (keys.has(field.key)) {
          errors.push(`${fieldAt}.key duplicates "${field.key}"`);
        }
        keys.add(field.key);
      }
      if (field.secret !== undefined && typeof field.secret !== "boolean") {
        errors.push(`${fieldAt}.secret must be a boolean`);
      }
    });
  });
}

const KEYBINDING_ACTION_PATTERN = /^[a-zA-Z][a-zA-Z0-9.-]{0,63}$/;
const KEYBINDING_PARAM_PATTERN = /^[a-zA-Z][a-zA-Z0-9]{0,31}$/;

function validateKeybindingParam(
  param: unknown,
  at: string,
  errors: string[],
): void {
  if (!isPlainObject(param)) {
    errors.push(`${at} must be an object`);
    return;
  }
  rejectUnknown(
    param,
    ["type", "required", "pattern", "maxLength", "syncEntity"],
    at,
    errors,
  );
  if (param.type !== "string" && param.type !== "boolean") {
    errors.push(`${at}.type must be "string" or "boolean"`);
  }
  if (param.required !== undefined && typeof param.required !== "boolean") {
    errors.push(`${at}.required must be a boolean`);
  }
  if (param.pattern !== undefined) {
    let valid = typeof param.pattern === "string";
    if (valid) {
      try {
        new RegExp(param.pattern as string);
      } catch {
        valid = false;
      }
    }
    if (!valid) errors.push(`${at}.pattern must be a regular expression`);
  }
  if (
    param.maxLength !== undefined &&
    (typeof param.maxLength !== "number" ||
      !Number.isInteger(param.maxLength) ||
      param.maxLength < 1)
  ) {
    errors.push(`${at}.maxLength must be a positive integer`);
  }
  if (param.syncEntity !== undefined) {
    if (
      typeof param.syncEntity !== "string" ||
      !/^[a-zA-Z][a-zA-Z0-9]*$/.test(param.syncEntity)
    ) {
      errors.push(`${at}.syncEntity must be a sync entity wire name`);
    } else if (param.type !== "string") {
      errors.push(`${at}.syncEntity needs a string parameter`);
    }
  }
}

function validateKeybindingActions(value: unknown, errors: string[]): void {
  if (value === undefined) return;
  const where = "contributes.keybindingActions";
  if (!Array.isArray(value)) {
    errors.push(`Field "${where}" must be an array`);
    return;
  }
  const seen = new Set<string>();
  value.forEach((raw, index) => {
    const at = `${where}[${index}]`;
    if (!isPlainObject(raw)) {
      errors.push(`${at} must be an object`);
      return;
    }
    rejectUnknown(raw, ["id", "params"], at, errors);
    if (typeof raw.id !== "string" || !KEYBINDING_ACTION_PATTERN.test(raw.id)) {
      errors.push(`${at}.id must be letters, digits, dots and dashes`);
    } else if (CORE_KEYBINDING_ACTIONS.includes(raw.id)) {
      errors.push(`${at}.id "${raw.id}" is one of the shell's own actions`);
    } else {
      if (seen.has(raw.id)) errors.push(`${at}.id duplicates "${raw.id}"`);
      seen.add(raw.id);
    }
    if (raw.params === undefined) return;
    if (!isPlainObject(raw.params)) {
      errors.push(`${at}.params must be an object`);
      return;
    }
    for (const [name, param] of Object.entries(raw.params)) {
      if (!KEYBINDING_PARAM_PATTERN.test(name) || name === "type") {
        errors.push(`${at}.params.${name} is not a valid parameter name`);
      }
      validateKeybindingParam(param, `${at}.params.${name}`, errors);
    }
  });
}

/**
 * Checks one saved keybinding action against the parameters its declaration
 * lists. A parameter the declaration does not list is refused, so a binding
 * cannot carry arbitrary data under a declared type.
 */
export function validateKeybindingActionParams(
  action: Record<string, unknown>,
  declaration: PluginKeybindingActionContribution,
): boolean {
  const params = declaration.params ?? {};
  for (const key of Object.keys(action)) {
    if (key !== "type" && !(key in params) && action[key] != null) {
      return false;
    }
  }
  for (const [name, param] of Object.entries(params)) {
    const value = action[name];
    if (value === undefined || value === null) {
      if (param.required) return false;
      continue;
    }
    if (param.type === "boolean") {
      if (typeof value !== "boolean") return false;
      continue;
    }
    if (typeof value !== "string") return false;
    if (param.required && value.length === 0) return false;
    if (value.length > (param.maxLength ?? 65_536)) return false;
    if (param.pattern && !new RegExp(param.pattern).test(value)) return false;
  }
  return true;
}

function isPresetValue(value: unknown): boolean {
  return (
    typeof value === "boolean" ||
    (typeof value === "number" && Number.isFinite(value)) ||
    typeof value === "string" ||
    (Array.isArray(value) && value.every((item) => typeof item === "string"))
  );
}

function validateUiPresets(value: unknown, errors: string[]): void {
  if (value === undefined) return;
  const where = "contributes.uiPresets";
  if (!isPlainObject(value)) {
    errors.push(`Field "${where}" must be an object`);
    return;
  }
  rejectUnknown(value, ["simple", "balanced", "advanced"], where, errors);
  let keys: string | undefined;
  for (const level of ["simple", "balanced", "advanced"]) {
    const preset = value[level];
    if (!isPlainObject(preset)) {
      errors.push(`${where}.${level} must be an object`);
      continue;
    }
    for (const [key, entry] of Object.entries(preset)) {
      if (!PRESET_KEY_PATTERN.test(key)) {
        errors.push(
          `${where}.${level} has an invalid key ${JSON.stringify(key)}`,
        );
      }
      if (!isPresetValue(entry)) {
        errors.push(
          `${where}.${level}.${key} must be a boolean, number, string or string array`,
        );
      }
    }
    const names = Object.keys(preset).sort().join(",");
    if (keys === undefined) keys = names;
    else if (keys !== names) {
      errors.push(`${where} presets must all name the same keys`);
    }
  }
}

const LEGACY_PATH_PATTERN = /^\/[a-z][a-z0-9-]*(\/[A-Za-z0-9_.-]+)+$/;
const REDIRECT_PATH_PATTERN = /^(\/[A-Za-z0-9_.-]+)+$/;
const RESERVED_PREFIXES = ["/plugin-api", "/plugin-ws", "/plugin-assets"];

function validateLegacyRedirects(value: unknown, errors: string[]): void {
  if (value === undefined) return;
  if (!Array.isArray(value)) {
    errors.push('Field "contributes.http.legacyRedirects" must be an array');
    return;
  }
  value.forEach((entry, index) => {
    const at = `contributes.http.legacyRedirects[${index}]`;
    if (!isPlainObject(entry)) {
      errors.push(`${at} must be an object`);
      return;
    }
    rejectUnknown(entry, ["from", "to", "status"], at, errors);
    const { from, to, status } = entry;
    if (typeof from !== "string" || !REDIRECT_PATH_PATTERN.test(from)) {
      errors.push(`${at}.from must be an absolute path`);
    } else if (
      RESERVED_PREFIXES.some(
        (prefix) => from === prefix || from.startsWith(`${prefix}/`),
      )
    ) {
      errors.push(`${at}.from cannot be under ${from.split("/")[1]}`);
    }
    if (typeof to !== "string" || !REDIRECT_PATH_PATTERN.test(to)) {
      errors.push(`${at}.to must be a path in the plugin's router`);
    }
    if (status !== undefined && status !== 307 && status !== 308) {
      errors.push(`${at}.status must be 307 or 308`);
    }
  });
}

function validateHttpContribution(
  value: unknown,
  pluginId: string | undefined,
  errors: string[],
): void {
  if (value === undefined) return;
  if (!isPlainObject(value)) {
    errors.push('Field "contributes.http" must be an object');
    return;
  }
  rejectUnknown(
    value,
    ["legacyPaths", "legacyRedirects", "adminImpersonation"],
    "contributes.http",
    errors,
  );
  if (
    value.adminImpersonation !== undefined &&
    typeof value.adminImpersonation !== "boolean"
  ) {
    errors.push(
      'Field "contributes.http.adminImpersonation" must be a boolean',
    );
  }
  validateLegacyRedirects(value.legacyRedirects, errors);
  const paths = value.legacyPaths;
  if (paths === undefined) return;
  if (!Array.isArray(paths)) {
    errors.push('Field "contributes.http.legacyPaths" must be an array');
    return;
  }
  paths.forEach((path, index) => {
    const at = `contributes.http.legacyPaths[${index}]`;
    if (typeof path !== "string" || !LEGACY_PATH_PATTERN.test(path)) {
      errors.push(`${at} must be an absolute path like "/<plugin id>/name"`);
      return;
    }
    if (pluginId && !path.startsWith(`/${pluginId}/`)) {
      errors.push(`${at} must start with "/${pluginId}/"`);
    }
  });
}

const AUTH_ID_PATTERN = /^[a-z][a-z0-9-]{0,63}$/;

function validateAuthContribution(value: unknown, errors: string[]): void {
  if (value === undefined) return;
  if (!isPlainObject(value)) {
    errors.push('Field "contributes.auth" must be an object');
    return;
  }
  rejectUnknown(
    value,
    [
      "sshAuthTypes",
      "loginMethods",
      "secondFactors",
      "secretSchemes",
      "keyboardInteractive",
    ],
    "contributes.auth",
    errors,
  );
  for (const key of [
    "sshAuthTypes",
    "loginMethods",
    "secondFactors",
    "secretSchemes",
    "keyboardInteractive",
  ]) {
    const list = value[key];
    if (list === undefined) continue;
    if (!Array.isArray(list)) {
      errors.push(`Field "contributes.auth.${key}" must be an array`);
      continue;
    }
    const seen = new Set<string>();
    list.forEach((entry, index) => {
      if (typeof entry !== "string" || !AUTH_ID_PATTERN.test(entry)) {
        errors.push(
          `Field "contributes.auth.${key}[${index}]" must be a lowercase id (letters, digits and dashes)`,
        );
        return;
      }
      if (seen.has(entry)) {
        errors.push(`Duplicate "${entry}" in contributes.auth.${key}`);
      }
      seen.add(entry);
    });
  }
}

function validateSettings(settings: unknown, errors: string[]): void {
  if (settings === undefined) return;
  const where = "contributes.settings";
  if (!isPlainObject(settings)) {
    errors.push(`${where} must be an object`);
    return;
  }
  rejectUnknown(settings, ["admin", "user", "host"], `"${where}"`, errors);

  for (const scope of ["admin", "user"] as const) {
    const value = settings[scope];
    if (value === undefined) continue;
    if (!Array.isArray(value)) {
      errors.push(`${where}.${scope} must be an array of fields`);
      continue;
    }
    validateSettingsFields(value, `${where}.${scope}`, errors);
  }

  if (settings.host !== undefined) {
    const host = settings.host;
    const at = `${where}.host`;
    if (!isPlainObject(host)) {
      errors.push(`${at} must be an object`);
      return;
    }
    rejectUnknown(
      host,
      [
        "enableKey",
        "enableLabelKey",
        "enableDescriptionKey",
        "enableDefault",
        "editorGroup",
        "editorOrder",
        "fields",
      ],
      `"${at}"`,
      errors,
    );

    if ("enableKey" in host) {
      if (
        typeof host.enableKey !== "string" ||
        !SETTINGS_KEY_PATTERN.test(host.enableKey)
      ) {
        errors.push(`${at}.enableKey must be a short alphanumeric key`);
      }
      // An enable switch with no label is a blank row in the host editor.
      requireString(host.enableLabelKey, `${at}.enableLabelKey`, errors);
    }
    if ("enableDescriptionKey" in host) {
      requireString(
        host.enableDescriptionKey,
        `${at}.enableDescriptionKey`,
        errors,
      );
    }
    if ("enableDefault" in host && typeof host.enableDefault !== "boolean") {
      errors.push(`${at}.enableDefault must be a boolean`);
    }
    if (
      "editorGroup" in host &&
      host.editorGroup !== "top" &&
      host.editorGroup !== "ssh"
    ) {
      errors.push(`${at}.editorGroup must be "top" or "ssh"`);
    }
    if (
      "editorOrder" in host &&
      (typeof host.editorOrder !== "number" ||
        !Number.isFinite(host.editorOrder))
    ) {
      errors.push(`${at}.editorOrder must be a number`);
    }

    if (!Array.isArray(host.fields)) {
      errors.push(`${at}.fields must be an array`);
      return;
    }
    validateSettingsFields(
      host.fields,
      `${at}.fields`,
      errors,
      typeof host.enableKey === "string" ? host.enableKey : undefined,
    );

    host.fields.forEach((raw, index) => {
      if (!isPlainObject(raw)) return;
      const fieldAt = `${at}.fields[${index}]`;
      if ("defaultFrom" in raw && typeof raw.defaultFrom !== "string") {
        errors.push(`${fieldAt}.defaultFrom must be a string`);
      }
      for (const flag of ["defaultable", "personal"]) {
        if (flag in raw && typeof raw[flag] !== "boolean") {
          errors.push(`${fieldAt}.${flag} must be a boolean`);
        }
      }
      if ("defaultLevels" in raw) {
        const levels = raw.defaultLevels;
        if (
          !Array.isArray(levels) ||
          levels.length === 0 ||
          levels.some(
            (level) => !["admin", "user", "folder"].includes(level as string),
          )
        ) {
          errors.push(
            `${fieldAt}.defaultLevels must be a non-empty array of "admin", "user" or "folder"`,
          );
        }
      }
      if (raw.type === "secret" && raw.defaultable === true) {
        errors.push(`${fieldAt} is a secret and cannot be defaultable`);
      }
      if (
        "shareRead" in raw &&
        !SHARE_LEVELS.includes(raw.shareRead as string)
      ) {
        errors.push(
          `${fieldAt}.shareRead must be one of: ${SHARE_LEVELS.join(", ")}`,
        );
      }
      if ("ownerOnly" in raw && typeof raw.ownerOnly !== "boolean") {
        errors.push(`${fieldAt}.ownerOnly must be a boolean`);
      }
      if ("secretKeys" in raw) {
        const keys = raw.secretKeys;
        if (raw.type !== "json") {
          errors.push(`${fieldAt}.secretKeys is only valid on json fields`);
        } else if (
          !Array.isArray(keys) ||
          keys.length === 0 ||
          keys.some((key) => typeof key !== "string" || key.length === 0)
        ) {
          errors.push(`${fieldAt}.secretKeys must be a non-empty string array`);
        }
      }
    });
  }
  for (const scope of ["admin", "user"] as const) {
    const fields = settings[scope];
    if (!Array.isArray(fields)) continue;
    fields.forEach((raw, index) => {
      if (!isPlainObject(raw)) return;
      for (const key of [
        "defaultFrom",
        "defaultable",
        "defaultLevels",
        "personal",
        "shareRead",
        "ownerOnly",
      ]) {
        if (key in raw) {
          errors.push(
            `${where}.${scope}[${index}].${key} is only valid on host fields`,
          );
        }
      }
    });
  }
}

/**
 * Validates one scope's fields.
 *
 * `requires` is checked against the keys declared in the same scope, plus the
 * host scope's enableKey, because a field pointing at a key that does not
 * exist would simply never render.
 */
function validateSettingsFields(
  fields: unknown[],
  where: string,
  errors: string[],
  enableKey?: string,
): void {
  const seen = new Set<string>();
  const booleanKeys = new Set<string>();
  if (enableKey) booleanKeys.add(enableKey);

  fields.forEach((raw, index) => {
    const at = `${where}[${index}]`;
    if (!isPlainObject(raw)) {
      errors.push(`${at} must be an object`);
      return;
    }
    rejectUnknown(raw, ALLOWED_SETTINGS_FIELD, at, errors);

    if (typeof raw.key !== "string" || !SETTINGS_KEY_PATTERN.test(raw.key)) {
      errors.push(`${at}.key must be a short alphanumeric key`);
    } else {
      if (seen.has(raw.key)) {
        errors.push(`${at}.key duplicates "${raw.key}"`);
      }
      seen.add(raw.key);
      if (raw.type === "boolean") booleanKeys.add(raw.key);
      if (enableKey && raw.key === enableKey) {
        errors.push(
          `${at}.key "${raw.key}" is already the section's enableKey`,
        );
      }
    }

    if (
      typeof raw.type !== "string" ||
      !(SETTINGS_FIELD_TYPES as readonly string[]).includes(raw.type)
    ) {
      errors.push(
        `${at}.type must be one of: ${SETTINGS_FIELD_TYPES.join(", ")}`,
      );
      return;
    }

    // A custom field draws its own label, so it needs a component instead.
    if (raw.type === "custom") {
      requireString(raw.component, `${at}.component`, errors);
    } else {
      requireString(raw.labelKey, `${at}.labelKey`, errors);
      if ("component" in raw) {
        errors.push(`${at}.component is only valid when type is "custom"`);
      }
    }

    for (const key of ["descriptionKey", "placeholderKey", "group"] as const) {
      if (key in raw) requireString(raw[key], `${at}.${key}`, errors);
    }
    if ("permission" in raw) {
      requireString(raw.permission, `${at}.permission`, errors);
    }
    if ("hidden" in raw && typeof raw.hidden !== "boolean") {
      errors.push(`${at}.hidden must be a boolean`);
    }

    if (raw.type === "select" || raw.type === "multiselect") {
      validateSettingsOptions(raw.options, at, errors);
    } else if ("options" in raw) {
      errors.push(`${at}.options is only valid for select and multiselect`);
    }

    if (raw.type === "number") {
      for (const bound of ["min", "max"] as const) {
        if (bound in raw && typeof raw[bound] !== "number") {
          errors.push(`${at}.${bound} must be a number`);
        }
      }
      if (
        typeof raw.min === "number" &&
        typeof raw.max === "number" &&
        raw.min > raw.max
      ) {
        errors.push(`${at}.min must not be greater than ${at}.max`);
      }
    } else if ("min" in raw || "max" in raw) {
      errors.push(`${at}.min and ${at}.max are only valid for number fields`);
    }
  });

  // Second pass: every key is known by now, so forward references are fine.
  fields.forEach((raw, index) => {
    if (!isPlainObject(raw) || !("requires" in raw)) return;
    const at = `${where}[${index}]`;
    if (typeof raw.requires !== "string") {
      errors.push(`${at}.requires must be a string`);
      return;
    }
    if (!booleanKeys.has(raw.requires)) {
      errors.push(
        `${at}.requires "${raw.requires}" must name a boolean field in the same scope`,
      );
    }
  });
}

function validateSettingsOptions(
  options: unknown,
  where: string,
  errors: string[],
): void {
  if (!Array.isArray(options) || options.length === 0) {
    errors.push(`${where}.options must be a non-empty array`);
    return;
  }
  const seen = new Set<string>();
  options.forEach((raw, index) => {
    const at = `${where}.options[${index}]`;
    if (!isPlainObject(raw)) {
      errors.push(`${at} must be an object`);
      return;
    }
    rejectUnknown(raw, ["value", "labelKey"], at, errors);
    if (requireString(raw.value, `${at}.value`, errors)) {
      if (seen.has(raw.value)) {
        errors.push(`${at}.value duplicates "${raw.value}"`);
      }
      seen.add(raw.value);
    }
    requireString(raw.labelKey, `${at}.labelKey`, errors);
  });
}

function validateTabs(tabs: unknown, errors: string[]): void {
  if (tabs === undefined) return;
  if (!Array.isArray(tabs)) {
    errors.push('Field "contributes.tabs" must be an array');
    return;
  }
  const seen = new Set<string>();
  tabs.forEach((raw, index) => {
    const where = `contributes.tabs[${index}]`;
    if (!isPlainObject(raw)) {
      errors.push(`${where} must be an object`);
      return;
    }
    rejectUnknown(raw, ["id", "titleKey", "icon", "openFrom"], where, errors);

    if (requireString(raw.id, `${where}.id`, errors)) {
      if (seen.has(raw.id)) errors.push(`${where}.id duplicates "${raw.id}"`);
      seen.add(raw.id);
    }
    requireString(raw.titleKey, `${where}.titleKey`, errors);
    requireString(raw.icon, `${where}.icon`, errors);

    if (!Array.isArray(raw.openFrom) || raw.openFrom.length === 0) {
      errors.push(`${where}.openFrom must be a non-empty array`);
      return;
    }
    raw.openFrom.forEach((value: unknown, openIndex: number) => {
      if (!OPEN_FROM_VALUES.includes(value as never)) {
        errors.push(
          `${where}.openFrom[${openIndex}] must be one of: ${OPEN_FROM_VALUES.join(", ")}`,
        );
      }
    });
  });
}

function validateViews(views: unknown, field: string, errors: string[]): void {
  if (views === undefined) return;
  if (!Array.isArray(views)) {
    errors.push(`Field "contributes.${field}" must be an array`);
    return;
  }
  const seen = new Set<string>();
  views.forEach((raw, index) => {
    const where = `contributes.${field}[${index}]`;
    if (!isPlainObject(raw)) {
      errors.push(`${where} must be an object`);
      return;
    }
    rejectUnknown(raw, ["id", "titleKey", "icon"], where, errors);
    if (requireString(raw.id, `${where}.id`, errors)) {
      if (seen.has(raw.id)) errors.push(`${where}.id duplicates "${raw.id}"`);
      seen.add(raw.id);
    }
    requireString(raw.titleKey, `${where}.titleKey`, errors);
    if (raw.icon !== undefined)
      requireString(raw.icon, `${where}.icon`, errors);
  });
}

function validatePermissions(
  permissions: unknown,
  pluginId: string | undefined,
  errors: string[],
): void {
  if (permissions === undefined) return;
  const where = "contributes.permissions";
  if (!Array.isArray(permissions)) {
    errors.push(`${where} must be an array`);
    return;
  }

  const seen = new Set<string>();

  permissions.forEach((entry: unknown, index: number) => {
    const at = `${where}[${index}]`;
    if (!isPlainObject(entry)) {
      errors.push(`${at} must be an object`);
      return;
    }
    rejectUnknown(
      entry,
      ["name", "titleKey", "descriptionKey", "defaultRoles"],
      at,
      errors,
    );

    const name = entry.name;
    if (typeof name !== "string" || !PERMISSION_NAME_PATTERN.test(name)) {
      errors.push(`${at}.name must be a lowercase, dotted permission name`);
    } else {
      if (seen.has(name)) {
        errors.push(`${at}.name "${name}" is declared more than once`);
      }
      seen.add(name);

      // Core groups first: a plugin naming one could gate a route on core
      // authority it was never given.
      const head = name.split(".")[0];
      if ((RESERVED_PERMISSION_PREFIXES as readonly string[]).includes(head)) {
        errors.push(
          `${at}.name "${name}" starts with the reserved core group "${head}". Permissions are registered as <pluginId>.<name>, so drop the prefix.`,
        );
      }
      // "ai" declaring "ai.use" would register as ai.ai.use, which is always
      // a mistake rather than an intent.
      if (pluginId && (name === pluginId || head === pluginId)) {
        errors.push(
          `${at}.name "${name}" already starts with this plugin's id. Permissions are registered as <pluginId>.<name>, so drop the prefix.`,
        );
      }
    }

    requireString(entry.titleKey, `${at}.titleKey`, errors);
    requireString(entry.descriptionKey, `${at}.descriptionKey`, errors);

    if (entry.defaultRoles === undefined) return;
    if (!Array.isArray(entry.defaultRoles)) {
      errors.push(`${at}.defaultRoles must be an array`);
      return;
    }
    entry.defaultRoles.forEach((role: unknown, roleIndex: number) => {
      if (
        typeof role !== "string" ||
        !(SYSTEM_ROLE_NAMES as readonly string[]).includes(role)
      ) {
        errors.push(
          `${at}.defaultRoles[${roleIndex}] must be one of: ${SYSTEM_ROLE_NAMES.join(", ")}`,
        );
      }
    });
  });
}

function validateActions(actions: unknown, errors: string[]): void {
  if (actions === undefined) return;
  if (!Array.isArray(actions)) {
    errors.push('Field "contributes.actions" must be an array');
    return;
  }
  const seen = new Set<string>();
  actions.forEach((raw, index) => {
    const where = `contributes.actions[${index}]`;
    if (!isPlainObject(raw)) {
      errors.push(`${where} must be an object`);
      return;
    }
    rejectUnknown(
      raw,
      ["id", "titleKey", "handler", "icon", "permission", "slot", "kind"],
      where,
      errors,
    );

    if (typeof raw.id !== "string" || !ACTION_ID_PATTERN.test(raw.id)) {
      errors.push(`${where}.id must be a dotted action id`);
    } else {
      if (seen.has(raw.id)) errors.push(`${where}.id duplicates "${raw.id}"`);
      seen.add(raw.id);
    }

    requireString(raw.titleKey, `${where}.titleKey`, errors);

    if (typeof raw.handler !== "string" || !HANDLER_PATTERN.test(raw.handler)) {
      errors.push(`${where}.handler must be a JavaScript identifier`);
    }
    if ("icon" in raw) requireString(raw.icon, `${where}.icon`, errors);
    if ("permission" in raw) {
      requireString(raw.permission, `${where}.permission`, errors);
    }
    if ("slot" in raw) requireString(raw.slot, `${where}.slot`, errors);
    if (
      "kind" in raw &&
      !ACTION_CONTRIBUTION_KINDS.includes(raw.kind as never)
    ) {
      errors.push(
        `${where}.kind must be one of: ${ACTION_CONTRIBUTION_KINDS.join(", ")}`,
      );
    }
  });
}

function validateActionSlots(slots: unknown, errors: string[]): void {
  if (slots === undefined) return;
  if (!Array.isArray(slots)) {
    errors.push('Field "contributes.actionSlots" must be an array');
    return;
  }
  const seen = new Set<string>();
  slots.forEach((raw, index) => {
    const where = `contributes.actionSlots[${index}]`;
    if (!isPlainObject(raw)) {
      errors.push(`${where} must be an object`);
      return;
    }
    rejectUnknown(raw, ["id", "accepts", "descriptionKey"], where, errors);

    if (typeof raw.id !== "string" || !ACTION_ID_PATTERN.test(raw.id)) {
      errors.push(`${where}.id must be a dotted slot id`);
    } else {
      if (seen.has(raw.id)) errors.push(`${where}.id duplicates "${raw.id}"`);
      seen.add(raw.id);
    }

    if (!Array.isArray(raw.accepts) || raw.accepts.length === 0) {
      errors.push(`${where}.accepts must be a non-empty array`);
    } else {
      raw.accepts.forEach((kind: unknown, kindIndex: number) => {
        if (!ACTION_CONTRIBUTION_KINDS.includes(kind as never)) {
          errors.push(
            `${where}.accepts[${kindIndex}] must be one of: ${ACTION_CONTRIBUTION_KINDS.join(", ")}`,
          );
        }
      });
    }
    if ("descriptionKey" in raw) {
      requireString(raw.descriptionKey, `${where}.descriptionKey`, errors);
    }
  });
}

function validateHostCapability(value: unknown, errors: string[]): void {
  if (value === undefined) return;

  const entries = Array.isArray(value) ? value : [value];
  if (Array.isArray(value) && value.length === 0) {
    errors.push(
      'Field "contributes.hostCapability" must not be an empty array',
    );
    return;
  }

  const seen = new Set<string>();
  entries.forEach((raw, index) => {
    const where = Array.isArray(value)
      ? `contributes.hostCapability[${index}]`
      : "contributes.hostCapability";
    if (!isPlainObject(raw)) {
      errors.push(`${where} must be an object`);
      return;
    }
    rejectUnknown(raw, ["key", "labelKey", "editorTab"], where, errors);

    if (requireString(raw.key, `${where}.key`, errors)) {
      if (seen.has(raw.key))
        errors.push(`${where}.key duplicates "${raw.key}"`);
      seen.add(raw.key);
    }
    requireString(raw.labelKey, `${where}.labelKey`, errors);
    requireString(raw.editorTab, `${where}.editorTab`, errors);
  });
}

export interface ParsedManifest {
  manifest?: PluginManifest;
  errors: string[];
}

/**
 * Validates, then applies the cross-field rules a JSON schema cannot express
 * and fills in the entry-point defaults.
 */
export function parseManifest(raw: unknown): ParsedManifest {
  const errors = validateManifest(raw);
  if (errors.length > 0) return { errors };

  const manifest = raw as PluginManifest;

  if (!isApiCompatible(manifest.engine.api)) {
    return {
      errors: [
        `Plugin needs plugin API ${manifest.engine.api}, but this build implements ${PLUGIN_API_VERSION}`,
      ],
    };
  }

  // Full ids: provides, providesSecret and actions all name permissions the
  // way an admin sees them, so they are compared against the qualified form.
  const declared = new Set(
    (manifest.contributes?.permissions ?? []).map((permission) =>
      qualifyPermission(manifest.id, permission.name),
    ),
  );

  // A permission the catalog never sees is one no admin can grant, so the
  // service or action would be invisible rather than denied.
  for (const provide of manifest.provides ?? []) {
    if (!declared.has(provide.permission)) {
      errors.push(
        `provides["${provide.service}"].permission "${provide.permission}" is not declared in contributes.permissions`,
      );
    }
  }
  for (const secret of manifest.providesSecret ?? []) {
    if (!declared.has(secret.permission)) {
      errors.push(
        `providesSecret["${secret.key}"].permission "${secret.permission}" is not declared in contributes.permissions`,
      );
    }
  }
  for (const action of manifest.contributes?.actions ?? []) {
    if (action.permission && !declared.has(action.permission)) {
      errors.push(
        `contributes.actions["${action.id}"].permission "${action.permission}" is not declared in contributes.permissions`,
      );
    }
  }
  // A settings field may gate on one of this plugin's own permissions, or on
  // a core/other-plugin id used as given. Only the first form is checkable
  // here, and an undeclared one would hide the field from every admin.
  const settings = manifest.contributes?.settings;
  const settingsScopes: [string, PluginSettingsField[]][] = [
    ["admin", settings?.admin ?? []],
    ["user", settings?.user ?? []],
    ["host", settings?.host?.fields ?? []],
  ];
  for (const [scope, fields] of settingsScopes) {
    for (const field of fields) {
      if (!field.permission) continue;
      if (field.permission.includes(".")) continue;
      if (!declared.has(qualifyPermission(manifest.id, field.permission))) {
        errors.push(
          `contributes.settings.${scope} field "${field.key}" requires permission "${field.permission}", which is not declared in contributes.permissions`,
        );
      }
    }
  }

  const auth = manifest.contributes?.auth;
  const contributesAuth =
    (auth?.sshAuthTypes?.length ?? 0) +
      (auth?.loginMethods?.length ?? 0) +
      (auth?.secondFactors?.length ?? 0) +
      (auth?.secretSchemes?.length ?? 0) +
      (auth?.keyboardInteractive?.length ?? 0) >
    0;
  if (contributesAuth && !manifest.capabilities.includes("auth:provide")) {
    errors.push(
      'contributes.auth needs the "auth:provide" capability in the capabilities array',
    );
  }

  for (const secret of manifest.requiresSecret ?? []) {
    if (secret.plugin === manifest.id) {
      errors.push(
        `requiresSecret["${secret.key}"] points at this plugin; use ctx.secrets.get instead`,
      );
    }
  }
  for (const dependency of Object.keys(manifest.dependencies ?? {})) {
    if (dependency === manifest.id) {
      errors.push(`dependencies["${dependency}"] points at this plugin`);
    }
    if (manifest.optionalDependencies?.[dependency]) {
      errors.push(
        `"${dependency}" is listed in both dependencies and optionalDependencies`,
      );
    }
  }
  for (const dependency of Object.keys(manifest.optionalDependencies ?? {})) {
    if (dependency === manifest.id) {
      errors.push(
        `optionalDependencies["${dependency}"] points at this plugin`,
      );
    }
  }

  if (errors.length > 0) return { errors };

  return {
    manifest: {
      ...manifest,
      backend: manifest.backend ?? DEFAULT_BACKEND_ENTRY,
      frontend: manifest.frontend ?? DEFAULT_FRONTEND_ENTRY,
      locales: manifest.locales ?? DEFAULT_LOCALES_DIR,
    },
    errors: [],
  };
}