Service manifest

Panel entry point. The user adds a service by its manifest URL (or a QR code carrying that URL and a token). The manifest origin (scheme + host + port) becomes the service’s trusted origin.

{
  "contract_version": "0.1.0",
  "service": {
    "id": "shop-admin",
    "name": "Shop — admin",
    "icon_url": "https://example.com/icon.png",
    "tint": "indigo",
    "guard": {
      "attach": {
        "in": "header",
        "name": "Authorization",
        "scheme": "Bearer",
        "use": "access"
      }
    },
    "root_page": "/pages/home",
    "tabs": [
      {
        "id": "home",
        "title": "Summary",
        "icon": "chart.bar",
        "page": "/pages/home"
      },
      {
        "id": "orders",
        "title": "Orders",
        "icon": "cart",
        "page": "/pages/orders",
        "badge_source": "/api/badges/orders"
      }
    ],
    "settings": "/pages/service-settings",
    "setup": "/pages/setup",
    "settings_required": false,
    "push": {
      "enabled": true
    }
  }
}

service fields

Field	Type	Description
`id`	string	Service identifier
`name`	string	Name (sidebar title on iPad/Mac)
`icon_url`	string?	Service icon (CDN, no Authorization)
`tint`	string?	Brand accent — see below
`guard`	object?	Authorization policy — see Authorization
`root_page`	string	First page when `tabs` is not set
`tabs[]`	array?	Top-level service structure
`settings`	string?	SDUI page on top of the client’s “Settings” tab
`setup`	string?	Gate page shown on connect
`settings_required`	bool?	Require filling the gate’s required fields
`push.enabled`	bool?	Single APNs channel

tabs

Each tab is an independent navigation hierarchy.

Field	Type
`id`	string	tab key
`title`	string	label
`icon`	string	SF Symbol
`page`	string	page endpoint
`badge_source`	string?	endpoint returning `{"value": 3}` (`0`/absent = no badge)

iPhone — system tab bar, max 5 tabs (more won’t fit).
iPad / Mac — sidebar sections under the service name.
The client adds a fixed trailing “Settings” tab; the manifest cannot remove or override it.
If tabs is not set — a single root_page without a tab bar.

tint — the only color in the contract

A single brand accent, applied as the accent color across the whole service scene (buttons, links, controls, selection). Status and trend semantics stay system — tint does not affect them.

System color name: indigo, teal, pink, mint, orange, …
Or hex: #5E5CE6, format #RRGGBB or #RRGGBBAA.
Invalid/empty value → default system accent.

Settings gate

setup — a dedicated “Service setup” page for the connection gate. If not set, the gate uses settings.
settings_required: true — before the service is first shown, the user must fill the gate page’s required fields.
Fields with persist: true are stored locally and available to binding as {settings.<field_id>} (see Data binding).