feat(manifest): app manifest + decision crate (strict TOML subset, checked newtypes, capability catalog); docs/apps.md spec

crates/manifest/src/lib.rs

@@ -0,0 +1,37 @@
+//! App manifests and the owner's decisions about them (see docs/apps.md):
+//! parsed strictly from a TOML subset, into checked values. Pure: no
+//! hardware, no kernel, no allocation.
+
+#![no_std]
+#![forbid(unsafe_code)]
+
+mod capability;
+mod decision;
+mod fields;
+mod manifest;
+mod toml;
+
+#[cfg(test)]
+mod tests;
+
+pub use capability::{Capabilities, Capability};
+pub use decision::{Decision, MAX_TEXT as MAX_DECISION_TEXT};
+pub use fields::{Accent, AppId, Command, FileName, Text, Version};
+pub use manifest::Manifest;
+
+/// Why a manifest or decision was refused; `line` is 1-based.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Error {
+    /// Not the TOML subset.
+    Syntax { line: usize },
+    /// A table, key or capability given twice.
+    Duplicate { line: usize },
+    /// A table, key or capability name that does not exist.
+    Unknown { line: usize },
+    /// A value of the right kind but not a valid one (a bad id, say).
+    Invalid { line: usize },
+    /// A required key is absent.
+    Missing(&'static str),
+    /// A capability both required and optional.
+    Conflict,
+}