fix: declare hostname vectors as an object schema

AGENTS.md

@@ -41,6 +41,16 @@ verstak-sdk/
 ## Capability Registry (известные)
 
 ```
+verstak/core/plugin-manager/v1
+verstak/core/capability-registry/v1
+verstak/core/contribution-registry/v1
+verstak/core/permissions/v1
+verstak/core/events/v1
+verstak/core/files/v1
+verstak/core/workbench/v1
+verstak/core/notifications/v1
+verstak/core/vault/v1
+verstak/core/workspace/v1
 editor.text
 editor.text.markdown
 editor.note.markdown

README.md

@@ -25,6 +25,18 @@ The build emits `dist/`. A packed npm artifact can be made locally with:
 It validates the requested version against `package.json`, then writes an npm
 tarball and `SHA256SUMS` to `release/`.
 
+## Publish a GitHub Release
+
+```bash
+./scripts/publish-github-release.sh v0.1.0
+```
+
+This runs the same local packaging command, then requires a clean, up-to-date
+`main` and an authenticated [`gh`](https://cli.github.com/) CLI. It creates and
+pushes the annotated version tag when needed and uploads the npm tarball and
+`SHA256SUMS` to GitHub Releases. The requested version must match
+`package.json`.
+
 ## Contracts relevant to the alpha
 
 - Workspaces have durable UUID identities; paths are addresses, not identity.

dist/types.d.ts

@@ -50,7 +50,7 @@ export interface CapabilityEntry {
     pluginId: string;
     status: 'stable' | 'draft' | 'deprecated';
 }
-export type Permission = 'vault.read' | 'vault.write' | 'vault.watch' | 'files.read' | 'files.write' | 'files.delete' | 'files.openExternal' | 'workbench.open' | 'storage.namespace' | 'storage.migrations' | 'events.publish' | 'events.subscribe' | 'ui.register' | 'commands.register' | 'network.local' | 'network.remote' | 'process.spawn' | 'secrets.read' | 'secrets.write' | 'sync.participate' | 'browser.receiver.manage';
+export type Permission = 'vault.read' | 'vault.write' | 'vault.watch' | 'files.read' | 'files.write' | 'files.delete' | 'files.openExternal' | 'workbench.open' | 'storage.namespace' | 'storage.migrations' | 'events.publish' | 'events.subscribe' | 'ui.register' | 'commands.register' | 'network.local' | 'network.remote' | 'process.spawn' | 'secrets.read' | 'secrets.write' | 'sync.participate' | 'browser.receiver.manage' | 'notifications.schedule';
 export interface PermissionEntry {
     name: Permission;
     description: string;

schemas/capabilities.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.mirv.top/verstak/verstak-sdk/schemas/capabilities.json",
+  "$id": "https://raw.githubusercontent.com/mirivlad/verstak-sdk/main/schemas/capabilities.json",
   "title": "Verstak Capability Registry",
   "description": "Known capability names and their descriptions for the Verstak platform",
   "type": "object",
@@ -27,6 +27,16 @@
     }
   },
   "capabilities": [
+    { "name": "verstak/core/plugin-manager/v1", "description": "Core plugin discovery and lifecycle management", "status": "draft" },
+    { "name": "verstak/core/capability-registry/v1", "description": "Core capability registry access", "status": "draft" },
+    { "name": "verstak/core/contribution-registry/v1", "description": "Core plugin contribution registry", "status": "draft" },
+    { "name": "verstak/core/permissions/v1", "description": "Core plugin permission enforcement", "status": "draft" },
+    { "name": "verstak/core/events/v1", "description": "Core plugin event bus", "status": "draft" },
+    { "name": "verstak/core/files/v1", "description": "Core vault files API", "status": "draft" },
+    { "name": "verstak/core/workbench/v1", "description": "Core Workbench resource routing", "status": "draft" },
+    { "name": "verstak/core/notifications/v1", "description": "Core native notification scheduling", "status": "draft" },
+    { "name": "verstak/core/vault/v1", "description": "Core vault lifecycle", "status": "draft" },
+    { "name": "verstak/core/workspace/v1", "description": "Core case lifecycle", "status": "draft" },
     { "name": "editor.text", "description": "Text editing capability (any format)", "status": "draft" },
     { "name": "editor.text.markdown", "description": "Markdown text editing", "status": "draft" },
     { "name": "editor.note.markdown", "description": "Markdown note editing (extends editor.text.markdown with note metadata)", "status": "draft" },

schemas/contributions.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.mirv.top/verstak/verstak-sdk/schemas/contributions.json",
+  "$id": "https://raw.githubusercontent.com/mirivlad/verstak-sdk/main/schemas/contributions.json",
   "title": "Verstak Contribution Points Registry",
   "description": "Known contribution points that plugins can register",
   "type": "object",

schemas/events/browser.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.mirv.top/verstak/verstak-sdk/schemas/events/browser.json",
+  "$id": "https://raw.githubusercontent.com/mirivlad/verstak-sdk/main/schemas/events/browser.json",
   "title": "Verstak Browser Events",
   "description": "Event schemas for browser extension and browser-inbox plugin communication",
   "type": "object",

schemas/events/lifecycle.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.mirv.top/verstak/verstak-sdk/schemas/events/lifecycle.json",
+  "$id": "https://raw.githubusercontent.com/mirivlad/verstak-sdk/main/schemas/events/lifecycle.json",
   "title": "Verstak Lifecycle Events",
   "description": "Event schemas for plugin and application lifecycle events",
   "type": "object",

schemas/events/vault.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.mirv.top/verstak/verstak-sdk/schemas/events/vault.json",
+  "$id": "https://raw.githubusercontent.com/mirivlad/verstak-sdk/main/schemas/events/vault.json",
   "title": "Verstak Vault Events",
   "description": "Event schemas for vault and case lifecycle events",
   "type": "object",

schemas/hostname-normalization-v1.json

@@ -1,7 +1,8 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.mirv.top/verstak/verstak-sdk/schemas/hostname-normalization-v1.json",
+  "$id": "https://raw.githubusercontent.com/mirivlad/verstak-sdk/main/schemas/hostname-normalization-v1.json",
   "title": "Verstak canonical hostname normalization v1 test vectors",
+  "type": "object",
   "description": "Canonical hostnames are lowercase ASCII A-labels without a port or trailing DNS dot. Bare hostnames accept DNS names, IPv4, bracketed IPv6, localhost, and internal single-label names. URL inputs accept only HTTP(S). Invalid or excessively long input normalizes to an empty string.",
   "version": 1,
   "bare": [

schemas/manifest.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.mirv.top/verstak/verstak-sdk/schemas/manifest.json",
+  "$id": "https://raw.githubusercontent.com/mirivlad/verstak-sdk/main/schemas/manifest.json",
   "title": "Verstak Plugin Manifest",
   "description": "Schema for Verstak plugin.json manifest files",
   "type": "object",
@@ -126,7 +126,8 @@
           "secrets.read",
           "secrets.write",
           "sync.participate",
-          "browser.receiver.manage"
+          "browser.receiver.manage",
+          "notifications.schedule"
         ]
       },
       "minItems": 1

schemas/permissions.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.mirv.top/verstak/verstak-sdk/schemas/permissions.json",
+  "$id": "https://raw.githubusercontent.com/mirivlad/verstak-sdk/main/schemas/permissions.json",
   "title": "Verstak Permissions Registry",
   "description": "Known runtime permissions and their safety levels",
   "type": "object",
@@ -47,6 +47,7 @@
     { "name": "secrets.read", "description": "Read secrets from the secret store", "dangerous": true },
     { "name": "secrets.write", "description": "Write secrets to the secret store", "dangerous": true },
     { "name": "sync.participate", "description": "Participate in vault sync", "dangerous": true },
-    { "name": "browser.receiver.manage", "description": "View and rotate the local browser receiver pairing token", "dangerous": true }
+    { "name": "browser.receiver.manage", "description": "View and rotate the local browser receiver pairing token", "dangerous": true },
+    { "name": "notifications.schedule", "description": "Replace the plugin's scheduled native notifications", "dangerous": false }
   ]
 }

schemas/sync.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.mirv.top/verstak/verstak-sdk/schemas/sync.json",
+  "$id": "https://raw.githubusercontent.com/mirivlad/verstak-sdk/main/schemas/sync.json",
   "title": "Verstak Sync Operations",
   "description": "Sync operation schemas for vault synchronization between devices",
   "type": "object",

scripts/publish-github-release.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+VERSION="${1:-}"
+REPOSITORY="mirivlad/verstak-sdk"
+RELEASE_SCRIPT="${VERSTAK_RELEASE_SCRIPT:-$ROOT/scripts/release.sh}"
+RELEASE_DIR="${VERSTAK_RELEASE_DIR:-$ROOT/release}"
+GIT_BIN="${GIT_BIN:-git}"
+GH_BIN="${GH_BIN:-gh}"
+
+cd "$ROOT"
+
+if [[ -z "$VERSION" || ! "$VERSION" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]; then
+  echo "usage: $0 <version>" >&2
+  echo "example: $0 v0.1.0" >&2
+  exit 2
+fi
+if ! command -v "$GH_BIN" >/dev/null; then
+  echo "gh CLI is required to publish a GitHub Release" >&2
+  exit 1
+fi
+if [[ "$("$GIT_BIN" branch --show-current)" != "main" ]]; then
+  echo "GitHub releases must be published from main" >&2
+  exit 1
+fi
+if [[ -n "$("$GIT_BIN" status --porcelain)" ]]; then
+  echo "working tree must be clean before publishing a release" >&2
+  exit 1
+fi
+
+"$GH_BIN" auth status
+"$GIT_BIN" fetch origin main --tags
+HEAD="$("$GIT_BIN" rev-parse HEAD)"
+if [[ "$HEAD" != "$("$GIT_BIN" rev-parse origin/main)" ]]; then
+  echo "local main must match origin/main before publishing a release" >&2
+  exit 1
+fi
+
+"$RELEASE_SCRIPT" "$VERSION"
+
+shopt -s nullglob
+ASSETS=("$RELEASE_DIR"/*.tar.gz "$RELEASE_DIR"/*.tgz)
+if [[ -f "$RELEASE_DIR/SHA256SUMS" ]]; then
+  ASSETS+=("$RELEASE_DIR/SHA256SUMS")
+fi
+if [[ ${#ASSETS[@]} -eq 0 ]]; then
+  echo "no release assets found in $RELEASE_DIR" >&2
+  exit 1
+fi
+
+if "$GIT_BIN" rev-parse -q --verify "refs/tags/$VERSION" >/dev/null; then
+  if [[ "$("$GIT_BIN" rev-parse "${VERSION}^{commit}")" != "$HEAD" ]]; then
+    echo "existing tag $VERSION does not point at HEAD" >&2
+    exit 1
+  fi
+else
+  "$GIT_BIN" tag -a "$VERSION" -m "Release $VERSION"
+  "$GIT_BIN" push origin "refs/tags/$VERSION"
+fi
+
+if "$GH_BIN" release view "$VERSION" --repo "$REPOSITORY" >/dev/null 2>&1; then
+  "$GH_BIN" release upload "$VERSION" "${ASSETS[@]}" --repo "$REPOSITORY" --clobber
+else
+  "$GH_BIN" release create "$VERSION" "${ASSETS[@]}" \
+    --repo "$REPOSITORY" \
+    --title "Verstak Plugin SDK $VERSION" \
+    --generate-notes \
+    --latest \
+    --verify-tag
+fi
+
+echo "GitHub release:"
+"$GH_BIN" release view "$VERSION" --repo "$REPOSITORY" --json url --jq .url

scripts/test-publish-github-release.sh

@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+PUBLISHER="$ROOT/scripts/publish-github-release.sh"
+VERSION="v0.0.0-test"
+REPOSITORY="mirivlad/verstak-sdk"
+ASSET_NAME="verstak-plugin-sdk-0.0.0-test.tgz"
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+if [[ ! -x "$PUBLISHER" ]]; then
+  echo "publisher is missing or not executable: $PUBLISHER" >&2
+  exit 1
+fi
+
+mkdir -p "$WORK/bin" "$WORK/release" "$WORK/state"
+LOG="$WORK/log"
+export LOG
+
+cat > "$WORK/release.sh" <<'SCRIPT'
+#!/usr/bin/env bash
+set -euo pipefail
+printf 'release:%s\n' "$1" >> "$LOG"
+printf 'package\n' > "$VERSTAK_RELEASE_DIR/verstak-plugin-sdk-${1#v}.tgz"
+printf 'checksum\n' > "$VERSTAK_RELEASE_DIR/SHA256SUMS"
+SCRIPT
+chmod +x "$WORK/release.sh"
+
+cat > "$WORK/bin/git" <<'SCRIPT'
+#!/usr/bin/env bash
+set -euo pipefail
+if [[ "$PWD" != "${EXPECTED_ROOT:?}" ]]; then
+  echo "publisher did not enter repository root: $PWD" >&2
+  exit 1
+fi
+case "${1:-}" in
+  status) exit 0 ;;
+  branch) echo main ;;
+  fetch) printf 'fetch\n' >> "$LOG" ;;
+  rev-parse)
+    if [[ "${2:-}" == "-q" ]]; then
+      if [[ -f "$TEST_STATE/tag" ]]; then echo test-commit; exit 0; fi
+      exit 1
+    fi
+    echo test-commit
+    ;;
+  tag) touch "$TEST_STATE/tag"; printf 'tag:%s\n' "${3:-}" >> "$LOG" ;;
+  push) printf 'push:%s:%s\n' "${2:-}" "${3:-}" >> "$LOG" ;;
+  *) echo "unexpected git invocation: $*" >&2; exit 1 ;;
+esac
+SCRIPT
+chmod +x "$WORK/bin/git"
+
+cat > "$WORK/bin/gh" <<'SCRIPT'
+#!/usr/bin/env bash
+set -euo pipefail
+case "${1:-}:${2:-}" in
+  auth:status) printf 'auth\n' >> "$LOG" ;;
+  release:view)
+    if [[ -f "$TEST_STATE/release" ]]; then echo https://github.example/release; else exit 1; fi
+    ;;
+  release:create) touch "$TEST_STATE/release"; printf 'create:%s\n' "$*" >> "$LOG" ;;
+  release:upload) printf 'upload:%s\n' "$*" >> "$LOG" ;;
+  *) echo "unexpected gh invocation: $*" >&2; exit 1 ;;
+esac
+SCRIPT
+chmod +x "$WORK/bin/gh"
+
+run_publisher() {
+  VERSTAK_RELEASE_SCRIPT="$WORK/release.sh" \
+  VERSTAK_RELEASE_DIR="$WORK/release" \
+  GIT_BIN="$WORK/bin/git" \
+  GH_BIN="$WORK/bin/gh" \
+  EXPECTED_ROOT="$ROOT" \
+  TEST_STATE="$WORK/state" \
+  "$PUBLISHER" "$VERSION"
+}
+
+run_publisher
+grep -Fqx "release:$VERSION" "$LOG"
+grep -Fqx "tag:$VERSION" "$LOG"
+grep -Fqx "push:origin:refs/tags/$VERSION" "$LOG"
+grep -F "release create $VERSION" "$LOG" >/dev/null
+grep -F "$ASSET_NAME" "$LOG" >/dev/null
+grep -F "SHA256SUMS" "$LOG" >/dev/null
+
+run_publisher
+grep -F "release upload $VERSION" "$LOG" >/dev/null
+
+echo "GitHub release publisher test passed"

src/plugin-api.test.ts

@@ -135,7 +135,28 @@ describe('VerstakPluginAPI contract', () => {
     const permissionEnum = ((manifestSchema as any).properties.permissions.items.enum || []) as string[];
 
     expect(permissions).toContainEqual(expect.objectContaining({ name: 'browser.receiver.manage', dangerous: true }));
+    expect(permissions).toContainEqual(expect.objectContaining({ name: 'notifications.schedule', dangerous: false }));
     expect(permissionEnum).toContain('browser.receiver.manage');
+    expect(permissionEnum).toContain('notifications.schedule');
+  });
+
+  test('desktop core capabilities used by bundled plugins are declared', () => {
+    const capabilities = ((capabilitiesSchema as any).capabilities || []) as Array<{ name: string; status: string }>;
+
+    for (const name of [
+      'verstak/core/plugin-manager/v1',
+      'verstak/core/capability-registry/v1',
+      'verstak/core/contribution-registry/v1',
+      'verstak/core/permissions/v1',
+      'verstak/core/events/v1',
+      'verstak/core/files/v1',
+      'verstak/core/workbench/v1',
+      'verstak/core/notifications/v1',
+      'verstak/core/vault/v1',
+      'verstak/core/workspace/v1',
+    ]) {
+      expect(capabilities).toContainEqual(expect.objectContaining({ name, status: 'draft' }));
+    }
   });
 
   test('file.changed schema documents watcher refresh payload', () => {

src/types.ts

@@ -89,7 +89,8 @@ export type Permission =
   | 'secrets.read'
   | 'secrets.write'
   | 'sync.participate'
-  | 'browser.receiver.manage';
+  | 'browser.receiver.manage'
+  | 'notifications.schedule';
 
 export interface PermissionEntry {
   name: Permission;