Feat v0.7.7 api tokens ext permissions (#61)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/handlers/package_validate.go

@@ -27,8 +27,10 @@ type ManifestInfo struct {
 	HasSettings   bool
 	HasExports    bool
 	Dependencies  map[string]any
-	Requires      []string
-	Signature     string // reserved for future package signing
+	Requires        []string
+	Signature       string // reserved for future package signing
+	UserPermissions []string // user-facing permissions declared by the extension
+	GatePermission  string   // if set, checks this user permission before calling on_request
 }
 
 // ValidateManifest parses a manifest map and validates all required fields,
@@ -97,6 +99,16 @@ func ValidateManifest(manifest map[string]any) (*ManifestInfo, error) {
 		}
 	}
 
+	// Extension-declared user permissions
+	if ups, ok := manifest["user_permissions"].([]any); ok {
+		for _, v := range ups {
+			if s, ok := v.(string); ok && s != "" {
+				info.UserPermissions = append(info.UserPermissions, s)
+			}
+		}
+	}
+	info.GatePermission, _ = manifest["gate_permission"].(string)
+
 	info.SchemaVersion = ParseSchemaVersion(manifest)
 
 	// ── Type-specific constraints ────────────────────────────────