{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "https://cognitivedelivery.co.uk/contract/1.0.0/plugin-manifest.schema.json",
  "title": "CDF Plugin Manifest",
  "description": "A plugin's `plugin.json`, read from `.claude-plugin/plugin.json`. A strict superset of Claude Code's manifest: every key Claude Code defines is honoured with the same meaning, so a Claude Code plugin validates here unchanged and a CDF plugin remains a valid Claude Code plugin. The single addition is the optional `cdf` block, which declares what the harness alone understands — what the plugin contributes, what its own code asks to be allowed, and who vouches for the declaration. `name` is the only required key, which is Claude Code's rule and not a relaxation of ours: a manifest that named nothing could not be addressed, and everything else has a defensible default. A declaration is not an installation: reading this file tells the loader what a plugin says about itself, never that it may run.",
  "definitions": {
    "attestation": {
      "type": "object",
      "description": "Who vouches for the declaration. Optional: a plugin published without a key has nothing to sign with, and the harness records that honestly rather than claiming a signature it does not have. The issuer vocabulary is the lease manifest's, so one reader understands both.",
      "required": [
        "issuer"
      ],
      "properties": {
        "issuer": {
          "type": "string",
          "enum": [
            "agent",
            "bridge",
            "harness",
            "plugin"
          ],
          "description": "Which party produced the declaration."
        },
        "signature": {
          "type": "string",
          "pattern": "^[0-9a-f]+$",
          "description": "Lower-case hex signature over the canonical bytes of the manifest, when the issuer can sign."
        },
        "key_fingerprint": {
          "type": "string",
          "minLength": 1,
          "description": "Fingerprint of the key that produced `signature`. Never the key."
        }
      },
      "additionalProperties": true
    },
    "author": {
      "description": "Who publishes the plugin. An object is the documented form; a bare string is accepted because marketplaces in the wild carry one, and a reader that refused it would refuse a real plugin.",
      "anyOf": [
        {
          "type": "string",
          "minLength": 1
        },
        {
          "type": "object",
          "required": [
            "name"
          ],
          "properties": {
            "name": {
              "type": "string",
              "minLength": 1
            },
            "email": {
              "type": "string"
            },
            "url": {
              "type": "string"
            }
          },
          "additionalProperties": true
        }
      ]
    },
    "capabilities": {
      "type": "object",
      "description": "What the plugin's own code asks to be allowed when the harness runs it out of process. This is the lease manifest's `allow` shape, property for property, because a plugin worker's lease is generated from it and narrowed against the workspace root policy. It is deliberately NOT the store-listing `interface.capabilities` vocabulary a plugin may also carry: that is a shelf label, this is an authorisation request. Every list is optional here — an absent list is a plugin that asks for nothing, which is the correct default — whereas the granted manifest requires all five.",
      "properties": {
        "tools": {
          "type": "array",
          "description": "Governed tool names the agent may call.",
          "items": {
            "type": "string",
            "minLength": 1
          }
        },
        "read_paths": {
          "type": "array",
          "description": "Workspace-relative POSIX globs the agent may read. Absolute paths and any `..` segment are rejected here; the registry re-checks against the workspace root.",
          "items": {
            "type": "string",
            "minLength": 1,
            "pattern": "^(?!/)(?!\\.\\.(/|$))(?!.*/\\.\\.(/|$)).*$"
          }
        },
        "write_paths": {
          "type": "array",
          "description": "Workspace-relative POSIX globs the agent may change. Absolute paths and any `..` segment are rejected here; the registry re-checks against the workspace root, and a change outside the granted set is a scope violation that revokes the lease.",
          "items": {
            "type": "string",
            "minLength": 1,
            "pattern": "^(?!/)(?!\\.\\.(/|$))(?!.*/\\.\\.(/|$)).*$"
          }
        },
        "hosts": {
          "type": "array",
          "description": "Hostnames the agent may reach, with an optional leading wildcard label (`*.example.com`). Enforced by the egress proxy once it keys off the lease.",
          "items": {
            "type": "string",
            "minLength": 1
          }
        },
        "commands": {
          "type": "array",
          "description": "Executable names the agent may run.",
          "items": {
            "type": "string",
            "minLength": 1
          }
        }
      },
      "additionalProperties": true
    },
    "cdf": {
      "type": "object",
      "description": "The additive CDF block. Absent in a plain Claude Code plugin, and its absence is not a defect: such a plugin contributes its skills, commands, agents, hooks and MCP servers and declares nothing further.",
      "required": [
        "schemaVersion"
      ],
      "properties": {
        "schemaVersion": {
          "type": "string",
          "enum": [
            "1.0"
          ],
          "description": "Contract version this block was written against."
        },
        "contributes": {
          "$ref": "#/definitions/contributes"
        },
        "capabilities": {
          "$ref": "#/definitions/capabilities"
        },
        "attestation": {
          "$ref": "#/definitions/attestation"
        }
      },
      "additionalProperties": true
    },
    "check": {
      "type": "object",
      "description": "A data or delivery check the plugin implements. `worker` is a path inside the plugin; the harness runs it out of process, never in the kernel.",
      "required": [
        "id",
        "worker"
      ],
      "properties": {
        "id": {
          "type": "string",
          "minLength": 1
        },
        "worker": {
          "type": "string",
          "minLength": 1,
          "pattern": "^(?!/)(?!\\.\\.(/|$))(?!.*/\\.\\.(/|$)).*$"
        }
      },
      "additionalProperties": true
    },
    "componentPath": {
      "description": "A component directory or file, or a list of them. Claude Code accepts a single string or an array of strings for `skills`, `commands` and `agents`, and scans `skills/`, `commands/` and `agents/` when the key is absent, so an absent key is not an empty contribution.",
      "anyOf": [
        {
          "type": "string",
          "minLength": 1
        },
        {
          "type": "array",
          "items": {
            "type": "string",
            "minLength": 1
          }
        }
      ]
    },
    "componentSource": {
      "description": "A component declared inline as an object, or a path to the file that declares it. Claude Code accepts both spellings for `hooks`, `mcpServers` and `lspServers`.",
      "anyOf": [
        {
          "type": "object"
        },
        {
          "type": "string",
          "minLength": 1
        }
      ]
    },
    "contributes": {
      "type": "object",
      "description": "What the plugin adds to the harness as DATA the kernel reads. Every list is optional. Nothing here is code the kernel executes: a contributed check names a worker the harness spawns, and a contributed provider names a host the egress policy must already permit.",
      "properties": {
        "providers": {
          "type": "array",
          "description": "Model providers the plugin adds to the registry.",
          "items": {
            "$ref": "#/definitions/provider"
          }
        },
        "trackers": {
          "type": "array",
          "description": "Tracker strategies the plugin adds to the mirror.",
          "items": {
            "$ref": "#/definitions/tracker"
          }
        },
        "docPacks": {
          "type": "array",
          "description": "Paths inside the plugin to document packs it contributes.",
          "items": {
            "type": "string",
            "minLength": 1,
            "pattern": "^(?!/)(?!\\.\\.(/|$))(?!.*/\\.\\.(/|$)).*$"
          }
        },
        "checks": {
          "type": "array",
          "description": "Checks the plugin implements.",
          "items": {
            "$ref": "#/definitions/check"
          }
        }
      },
      "additionalProperties": true
    },
    "prices": {
      "type": "object",
      "description": "Declared unit prices, for budget accounting. Advisory: the harness records what it spent, not what it was told it would cost.",
      "properties": {
        "input_per_million": {
          "type": "number",
          "minimum": 0
        },
        "output_per_million": {
          "type": "number",
          "minimum": 0
        }
      },
      "additionalProperties": true
    },
    "provider": {
      "type": "object",
      "description": "A model provider the plugin contributes. `kind` is the closed set of wire protocols the harness speaks; a provider whose protocol is neither is not a provider the harness can drive.",
      "required": [
        "id",
        "kind"
      ],
      "properties": {
        "id": {
          "type": "string",
          "minLength": 1
        },
        "kind": {
          "type": "string",
          "enum": [
            "openai-compatible",
            "anthropic"
          ],
          "description": "The wire protocol. Closed: the harness has exactly these two clients."
        },
        "baseUrl": {
          "type": "string",
          "minLength": 1
        },
        "model": {
          "type": "string",
          "minLength": 1
        },
        "prices": {
          "$ref": "#/definitions/prices"
        },
        "extraHosts": {
          "type": "array",
          "description": "Hostnames beyond the base URL's own that this provider reaches. They must still be permitted by the lease.",
          "items": {
            "type": "string",
            "minLength": 1
          }
        }
      },
      "additionalProperties": true
    },
    "repository": {
      "description": "The source repository, as a URL string or as an object carrying one.",
      "anyOf": [
        {
          "type": "string",
          "minLength": 1
        },
        {
          "type": "object"
        }
      ]
    },
    "tracker": {
      "type": "object",
      "description": "A tracker strategy the plugin contributes. The action ids name integration actions; an id the host does not know is reported, never invented.",
      "required": [
        "id",
        "label",
        "readAction"
      ],
      "properties": {
        "id": {
          "type": "string",
          "minLength": 1
        },
        "label": {
          "type": "string",
          "minLength": 1
        },
        "readAction": {
          "type": "string",
          "minLength": 1
        },
        "commentAction": {
          "type": "string",
          "minLength": 1
        },
        "transitionAction": {
          "type": "string",
          "minLength": 1
        },
        "createAction": {
          "type": "string",
          "minLength": 1
        },
        "externalIdLabel": {
          "type": "string",
          "minLength": 1
        },
        "externalIdPlaceholder": {
          "type": "string",
          "minLength": 1
        }
      },
      "additionalProperties": true
    }
  },
  "type": "object",
  "required": [
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$",
      "description": "The plugin id: lower-case kebab-case, unique within a marketplace. The only required key, and the one a decision record is keyed to."
    },
    "description": {
      "type": "string"
    },
    "version": {
      "type": "string",
      "description": "The plugin's own version. An open string: a plugin is free to version itself however it likes, and a marketplace may pin a different one."
    },
    "author": {
      "$ref": "#/definitions/author"
    },
    "displayName": {
      "type": "string",
      "description": "A human label for a listing. `name` remains the identity."
    },
    "homepage": {
      "type": "string"
    },
    "repository": {
      "$ref": "#/definitions/repository"
    },
    "license": {
      "type": "string"
    },
    "keywords": {
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1
      }
    },
    "category": {
      "type": "string"
    },
    "metadata": {
      "type": "object",
      "description": "Free-form publisher metadata. Carried, never interpreted."
    },
    "defaultEnabled": {
      "type": "boolean",
      "description": "Whether a host that installs this plugin enables it by default. A hint to the host, never an approval: presence is not approval, and neither is this."
    },
    "skills": {
      "$ref": "#/definitions/componentPath"
    },
    "commands": {
      "$ref": "#/definitions/componentPath"
    },
    "agents": {
      "$ref": "#/definitions/componentPath"
    },
    "hooks": {
      "$ref": "#/definitions/componentSource"
    },
    "mcpServers": {
      "$ref": "#/definitions/componentSource"
    },
    "lspServers": {
      "$ref": "#/definitions/componentSource"
    },
    "cdf": {
      "$ref": "#/definitions/cdf"
    }
  },
  "additionalProperties": true
}