Veyn Connect · draft v0.1

Manifest

A manifest is the signed, versioned JSON that declares a connector. It is the only source of what the connector can do.

Draft. Fields may change before launch. At launch only link and web modes and the prepare effect are accepted.

Example

{
  "spec": "veyn-connect/0.1",
  "id": "com.example.rides",
  "version": "1.2.0",
  "name": "Example Rides",
  "developer": {
    "id": "dev_8f2…",
    "contact": "security@example.com",
    "privacy": "https://example.com/privacy",
    "terms": "https://example.com/terms"
  },
  "regions": ["MY", "SG"],
  "locales": ["en", "ms", "zh"],
  "actions": [
    {
      "action": "ride.request",
      "mode": "link",
      "effect": "prepare",
      "scopes": ["place.destination"],
      "link": {
        "ios": "example://ride?dropLat={to.lat}&dropLng={to.lng}&dropName={to.label}",
        "android": "example://ride?dropLat={to.lat}&dropLng={to.lng}&dropName={to.label}",
        "web": "https://example.com/ride?dropLat={to.lat}&dropLng={to.lng}"
      },
      "probe": { "ios": "example://", "android": "com.example.rides" },
      "store": {
        "ios": "https://apps.apple.com/app/id…",
        "android": "https://play.google.com/store/apps/details?id=…"
      },
      "fillsInputs": true
    }
  ],
  "signature": "ed25519:…"
}

Fields

Field	Rules
`spec`	`veyn-connect/<major>.<minor>`. Unknown majors are rejected.
`id`	Reverse-DNS, lower-case, `[a-z0-9.-]`, up to 80 characters. Immutable once published. You must prove control of the domain.
`version`	Semver. A published version is immutable.
`name`	Up to 60 characters. No impersonation of another brand.
`developer`	Verified developer id, security contact, privacy and terms URLs (https).
`regions`	ISO 3166 alpha-2 codes, or `["*"]`. Doyo offers the connector only there.
`actions[]`	1–20 entries, one per action and mode.
`actions[].action`	Must be in Veyn's action catalog.
`actions[].mode`	`link` or `web` at launch. later `intent`, `api`.
`actions[].effect`	`prepare`: the user presses the last button in your service. later `execute`.
`actions[].scopes`	Only the data the action needs, from the scope list below.
`signature`	Detached signature over the canonical JSON by your registered key.

Action catalog

Veyn owns the vocabulary, so every connector for the same action takes the same inputs. Only Veyn adds actions; you can propose one in review.

Action	Inputs	At launch
`ride.request`	`to`, `from?`, `robotaxi?`	prepare
`place.navigate`	`to`, `from?`, `mode?`	prepare
`food.order`	`merchant`, `items[]`, `deliverTo`	later opens your page only
`booking.create`	`service`, `time`, `party?`	later opens your page only
`message.send`	`to`, `body`	later
`pay.request`	`payee`, `amount`, `currency`, `reference`	later

Modes

Mode	Launch	What Veyn does
`link`	yes	Opens your app or site with a link built from your template. Extra fields: `link.{ios,android,web}`, `probe`, `store`, `fillsInputs`.
`web`	yes	Opens your page in a Veyn-controlled web view. Extra fields: `web.url`, `web.allowedHosts[]`.
`intent`	later	Calls an action your app declared to the OS (App Intents, Android intents).
`api`	later	Calls your HTTPS endpoint with a short-lived, scoped token.

When a user has several connectors for the same action, Veyn ranks them api, intent, link, web, after filtering by region and what is installed.

Scopes

A scope is the smallest piece of user data an action may receive. You get only the scopes the called action declares, only for that call.

Scope	You receive	Sensitivity
`place.destination`	The chosen destination (label, address, coordinates)	low
`place.origin`	A chosen origin, never the phone's live location	medium
`contact.recipient`	One recipient the user picked	medium
`order.items`	Items and quantities the user approved	low
`address.delivery`	One delivery address the user picked	high
`time.slot`	A chosen date and time	low
`identity.name`	Display name	medium
`identity.phone`	Phone number	high
`payment.request`	A payee, amount and reference for the user to approve in their own payment app	high

At T1 only low and medium scopes are available. Never offered: location history, other twins, documents, receipts, email, chat history, photos, scans, payment credentials, or any token.

Validation rules

Checked when you submit and again at every call.

Templates are the only place input is interpolated. Allowed placeholders are the action's own inputs, such as {to.lat}. Values are percent-encoded and can never contain a scheme, host or path. A template cannot start with a placeholder.
Schemes and hosts. https is always allowed. A custom scheme must belong to the app named in probe. javascript:, data:, file:, OS-owned schemes, other developers' schemes, and intent: links with a fallback to another host are refused.
No secrets in a manifest: client secrets, API keys and tokens are rejected.
Hosts in web.* must be https on a domain you have verified. Redirects off those hosts are refused.
Size up to 64 KB.
Widening a permission (more scopes, prepare to execute, more regions) is a major change. It goes back to review and asks users to agree again.