@agent-vm/config-contracts 0.0.108 → 0.0.109

package/dist/index.d.ts

@@ -77,6 +77,7 @@ declare const mcpProviderSchema: z.ZodObject<{
   transport: z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"streamable-http">;
     url: z.ZodURL;
+    connectionTimeoutMs: z.ZodOptional<z.ZodNumber>;
     headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
       source: z.ZodLiteral<"environment">;
       name: z.ZodString;
@@ -100,6 +101,7 @@ declare const mcpProviderSchema: z.ZodObject<{
   }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"sse">;
     url: z.ZodURL;
+    connectionTimeoutMs: z.ZodOptional<z.ZodNumber>;
     headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
       source: z.ZodLiteral<"environment">;
       name: z.ZodString;
@@ -124,6 +126,7 @@ declare const mcpProviderSchema: z.ZodObject<{
     kind: z.ZodLiteral<"stdio">;
     command: z.ZodString;
     args: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    connectionTimeoutMs: z.ZodOptional<z.ZodNumber>;
     cwd: z.ZodOptional<z.ZodString>;
     env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
       source: z.ZodLiteral<"environment">;
@@ -170,6 +173,7 @@ declare const mcpConfigSchema: z.ZodObject<{
     transport: z.ZodDiscriminatedUnion<[z.ZodObject<{
       kind: z.ZodLiteral<"streamable-http">;
       url: z.ZodURL;
+      connectionTimeoutMs: z.ZodOptional<z.ZodNumber>;
       headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
         source: z.ZodLiteral<"environment">;
         name: z.ZodString;
@@ -193,6 +197,7 @@ declare const mcpConfigSchema: z.ZodObject<{
     }, z.core.$strict>, z.ZodObject<{
       kind: z.ZodLiteral<"sse">;
       url: z.ZodURL;
+      connectionTimeoutMs: z.ZodOptional<z.ZodNumber>;
       headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
         source: z.ZodLiteral<"environment">;
         name: z.ZodString;
@@ -217,6 +222,7 @@ declare const mcpConfigSchema: z.ZodObject<{
       kind: z.ZodLiteral<"stdio">;
       command: z.ZodString;
       args: z.ZodDefault<z.ZodArray<z.ZodString>>;
+      connectionTimeoutMs: z.ZodOptional<z.ZodNumber>;
       cwd: z.ZodOptional<z.ZodString>;
       env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
         source: z.ZodLiteral<"environment">;
@@ -248,6 +254,7 @@ declare const mcpConfigSchema: z.ZodObject<{
 type McpConfig = z.infer<typeof mcpConfigSchema>;
 type McpProvider = z.infer<typeof mcpProviderSchema>;
 type ResolvedMcpProvider = {
+  readonly connectionTimeoutMs?: number;
   readonly headers: Readonly<Record<string, FormattedSecretValue>>;
   readonly namespace: string;
   readonly transport: 'streamable-http' | 'sse';
@@ -255,6 +262,7 @@ type ResolvedMcpProvider = {
 } | {
   readonly args: readonly string[];
   readonly command: string;
+  readonly connectionTimeoutMs?: number;
   readonly cwd?: string;
   readonly env: Readonly<Record<string, FormattedSecretValue>>;
   readonly namespace: string;
@@ -532,20 +540,224 @@ declare function mcpPortalCallRequiresApproval(profile: ResolvedMcpPortalProfile
 declare const mcpPortalConfigSchemaVersions: {
   readonly mcp: 1;
   readonly mcpPortal: 1;
+  readonly toolPortal: 1;
 };
 declare const mcpPortalConfigSchemaIds: {
   readonly mcp: "agent-vm:mcp:1";
   readonly mcpPortal: "agent-vm:mcp-portal:1";
+  readonly toolPortal: "agent-vm:tool-portal:1";
 };
 declare const mcpPortalConfigSchemaPaths: {
   readonly mcpFromGatewayConfig: "../../schemas/mcp.schema.json";
   readonly mcpPortalFromGatewayConfig: "../../schemas/mcp-portal.schema.json";
+  readonly toolPortalFromGatewayConfig: "../../schemas/tool-portal.schema.json";
 };
 interface ConfigContractSchemaArtifacts {
   readonly mcp: Record<string, unknown>;
   readonly mcpPortal: Record<string, unknown>;
+  readonly toolPortal: Record<string, unknown>;
 }
 declare function createConfigContractSchemaArtifacts(): ConfigContractSchemaArtifacts;
 //#endregion
-export { ConfigContractSchemaArtifacts, FormattedSecretValue, JsonArray, JsonObject, JsonPrimitive, JsonValue, McpConfig, McpPortalAgentConfig, McpPortalApprovalToolAnnotations, McpPortalApprovalToolCall, McpPortalCallPolicyDecision, McpPortalConfig, McpPortalExternalAuthConfig, McpPortalProfileDefinition, McpPortalProxyConfig, McpProvider, NamespaceToolRef, OpenClawMcpPortalPluginConfig, PortalApprovalConfig, PortalToolSelector, ResolvedMcpPortalProfile, ResolvedMcpProvider, SecretFormat, SecretValue, assertJsonObject, createConfigContractSchemaArtifacts, formatSecretValue, formattedSecretValueSchema, isJsonObject, jsonObjectSchema, jsonValueSchema, loadJsonConfigFile, loadMcpConfig, loadMcpPortalConfig, mcpConfigSchema, mcpConfigToResolvedProviders, mcpPortalAgentConfigSchema, mcpPortalCallPolicyDecision, mcpPortalCallRequiresApproval, mcpPortalConfigSchema, mcpPortalConfigSchemaIds, mcpPortalConfigSchemaPaths, mcpPortalConfigSchemaVersions, mcpPortalExternalAuthSchema, mcpPortalProfileDefinitionSchema, mcpPortalProxySchema, mcpProviderSchema, mcpSecretPolicySchema, namespaceToolRefSchema, openClawMcpPortalPluginConfigSchema, portalApprovalConfigSchema, portalToolSelectorSchema, resolveMcpPortalProfile, resolvedMcpPortalProfileSchema, secretFormatSchema, secretValueSchema, secretValueToEnvironmentReference };
+//#region src/tool-portal-config.d.ts
+declare const toolPortalToolSelectorSchema: z.ZodObject<{
+  allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+  deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+type ToolPortalToolSelector = z.infer<typeof toolPortalToolSelectorSchema>;
+declare const toolPortalCallPolicySchema: z.ZodObject<{
+  requiresApproval: z.ZodObject<{
+    allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+    deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  }, z.core.$strict>;
+  withoutApproval: z.ZodObject<{
+    allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+    deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  }, z.core.$strict>;
+}, z.core.$strict>;
+type ToolPortalCallPolicy = z.infer<typeof toolPortalCallPolicySchema>;
+declare const toolPortalBackendBindingSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  kind: z.ZodLiteral<"mcp_provider">;
+}, z.core.$strict>, z.ZodObject<{
+  kind: z.ZodLiteral<"controller_host_action">;
+}, z.core.$strict>, z.ZodObject<{
+  kind: z.ZodLiteral<"tool_vm_runner">;
+}, z.core.$strict>], "kind">;
+type ToolPortalBackendBinding = z.infer<typeof toolPortalBackendBindingSchema>;
+declare const toolPortalCapabilityPolicySchema: z.ZodObject<{
+  backend: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"mcp_provider">;
+  }, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"controller_host_action">;
+  }, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"tool_vm_runner">;
+  }, z.core.$strict>], "kind">;
+  calls: z.ZodObject<{
+    requiresApproval: z.ZodObject<{
+      allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+      deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+    withoutApproval: z.ZodObject<{
+      allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+      deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+  }, z.core.$strict>;
+  tools: z.ZodObject<{
+    allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+    deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  }, z.core.$strict>;
+}, z.core.$strict>;
+type ToolPortalCapabilityPolicy = z.infer<typeof toolPortalCapabilityPolicySchema>;
+declare const toolPortalProfileDefinitionSchema: z.ZodObject<{
+  capabilities: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+    backend: z.ZodDiscriminatedUnion<[z.ZodObject<{
+      kind: z.ZodLiteral<"mcp_provider">;
+    }, z.core.$strict>, z.ZodObject<{
+      kind: z.ZodLiteral<"controller_host_action">;
+    }, z.core.$strict>, z.ZodObject<{
+      kind: z.ZodLiteral<"tool_vm_runner">;
+    }, z.core.$strict>], "kind">;
+    calls: z.ZodObject<{
+      requiresApproval: z.ZodObject<{
+        allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+        deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+      }, z.core.$strict>;
+      withoutApproval: z.ZodObject<{
+        allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+        deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+      }, z.core.$strict>;
+    }, z.core.$strict>;
+    tools: z.ZodObject<{
+      allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+      deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+  }, z.core.$strict>>>;
+}, z.core.$strict>;
+type ToolPortalProfileDefinition = z.infer<typeof toolPortalProfileDefinitionSchema>;
+declare const toolPortalAgentConfigSchema: z.ZodObject<{
+  profile: z.ZodString;
+}, z.core.$strict>;
+type ToolPortalAgentConfig = z.infer<typeof toolPortalAgentConfigSchema>;
+declare const toolPortalConfigSchema: z.ZodObject<{
+  $schema: z.ZodOptional<z.ZodString>;
+  schemaVersion: z.ZodLiteral<1>;
+  agents: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+    profile: z.ZodString;
+  }, z.core.$strict>>>;
+  profiles: z.ZodRecord<z.ZodString, z.ZodObject<{
+    capabilities: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+      backend: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"mcp_provider">;
+      }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"controller_host_action">;
+      }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"tool_vm_runner">;
+      }, z.core.$strict>], "kind">;
+      calls: z.ZodObject<{
+        requiresApproval: z.ZodObject<{
+          allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+          deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>;
+        withoutApproval: z.ZodObject<{
+          allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+          deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>;
+      }, z.core.$strict>;
+      tools: z.ZodObject<{
+        allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+        deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+      }, z.core.$strict>;
+    }, z.core.$strict>>>;
+  }, z.core.$strict>>;
+}, z.core.$strict>;
+type ToolPortalConfig = z.infer<typeof toolPortalConfigSchema>;
+declare function loadToolPortalConfig(configPath: string): Promise<ToolPortalConfig>;
+declare const ToolPortalMcpProjectionNamespaceSchema: z.ZodObject<{
+  calls: z.ZodObject<{
+    requiresApproval: z.ZodObject<{
+      allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+      deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+    withoutApproval: z.ZodObject<{
+      allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+      deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+  }, z.core.$strict>;
+  tools: z.ZodObject<{
+    allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+    deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  }, z.core.$strict>;
+}, z.core.$strict>;
+type ToolPortalMcpProjectionNamespace = z.infer<typeof ToolPortalMcpProjectionNamespaceSchema>;
+declare const ToolPortalMcpProjectionSchema: z.ZodObject<{
+  agentId: z.ZodString;
+  namespaces: z.ZodRecord<z.ZodString, z.ZodObject<{
+    calls: z.ZodObject<{
+      requiresApproval: z.ZodObject<{
+        allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+        deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+      }, z.core.$strict>;
+      withoutApproval: z.ZodObject<{
+        allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+        deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+      }, z.core.$strict>;
+    }, z.core.$strict>;
+    tools: z.ZodObject<{
+      allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+      deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+  }, z.core.$strict>>;
+  profile: z.ZodString;
+}, z.core.$strict>;
+type ToolPortalMcpProjection = z.infer<typeof ToolPortalMcpProjectionSchema>;
+declare const ToolPortalControllerHostActionProjectionNamespaceSchema: z.ZodObject<{
+  calls: z.ZodObject<{
+    requiresApproval: z.ZodObject<{
+      allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+      deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+    withoutApproval: z.ZodObject<{
+      allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+      deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+  }, z.core.$strict>;
+  tools: z.ZodObject<{
+    allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+    deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  }, z.core.$strict>;
+}, z.core.$strict>;
+type ToolPortalControllerHostActionProjectionNamespace = z.infer<typeof ToolPortalControllerHostActionProjectionNamespaceSchema>;
+declare const ToolPortalControllerHostActionProjectionSchema: z.ZodObject<{
+  agentId: z.ZodString;
+  namespaces: z.ZodRecord<z.ZodString, z.ZodObject<{
+    calls: z.ZodObject<{
+      requiresApproval: z.ZodObject<{
+        allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+        deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+      }, z.core.$strict>;
+      withoutApproval: z.ZodObject<{
+        allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+        deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+      }, z.core.$strict>;
+    }, z.core.$strict>;
+    tools: z.ZodObject<{
+      allow: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
+      deny: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+  }, z.core.$strict>>;
+  profile: z.ZodString;
+}, z.core.$strict>;
+type ToolPortalControllerHostActionProjection = z.infer<typeof ToolPortalControllerHostActionProjectionSchema>;
+interface CreateToolPortalMcpProjectionProps {
+  readonly agentId: string;
+  readonly config: ToolPortalConfig;
+}
+declare function createToolPortalMcpProjection(props: CreateToolPortalMcpProjectionProps): ToolPortalMcpProjection;
+interface CreateToolPortalControllerHostActionProjectionProps {
+  readonly agentId: string;
+  readonly config: ToolPortalConfig;
+}
+declare function createToolPortalControllerHostActionProjection(props: CreateToolPortalControllerHostActionProjectionProps): ToolPortalControllerHostActionProjection;
+//#endregion
+export { ConfigContractSchemaArtifacts, CreateToolPortalControllerHostActionProjectionProps, CreateToolPortalMcpProjectionProps, FormattedSecretValue, JsonArray, JsonObject, JsonPrimitive, JsonValue, McpConfig, McpPortalAgentConfig, McpPortalApprovalToolAnnotations, McpPortalApprovalToolCall, McpPortalCallPolicyDecision, McpPortalConfig, McpPortalExternalAuthConfig, McpPortalProfileDefinition, McpPortalProxyConfig, McpProvider, NamespaceToolRef, OpenClawMcpPortalPluginConfig, PortalApprovalConfig, PortalToolSelector, ResolvedMcpPortalProfile, ResolvedMcpProvider, SecretFormat, SecretValue, ToolPortalAgentConfig, ToolPortalBackendBinding, ToolPortalCallPolicy, ToolPortalCapabilityPolicy, ToolPortalConfig, ToolPortalControllerHostActionProjection, ToolPortalControllerHostActionProjectionNamespace, ToolPortalControllerHostActionProjectionNamespaceSchema, ToolPortalControllerHostActionProjectionSchema, ToolPortalMcpProjection, ToolPortalMcpProjectionNamespace, ToolPortalMcpProjectionNamespaceSchema, ToolPortalMcpProjectionSchema, ToolPortalProfileDefinition, ToolPortalToolSelector, assertJsonObject, createConfigContractSchemaArtifacts, createToolPortalControllerHostActionProjection, createToolPortalMcpProjection, formatSecretValue, formattedSecretValueSchema, isJsonObject, jsonObjectSchema, jsonValueSchema, loadJsonConfigFile, loadMcpConfig, loadMcpPortalConfig, loadToolPortalConfig, mcpConfigSchema, mcpConfigToResolvedProviders, mcpPortalAgentConfigSchema, mcpPortalCallPolicyDecision, mcpPortalCallRequiresApproval, mcpPortalConfigSchema, mcpPortalConfigSchemaIds, mcpPortalConfigSchemaPaths, mcpPortalConfigSchemaVersions, mcpPortalExternalAuthSchema, mcpPortalProfileDefinitionSchema, mcpPortalProxySchema, mcpProviderSchema, mcpSecretPolicySchema, namespaceToolRefSchema, openClawMcpPortalPluginConfigSchema, portalApprovalConfigSchema, portalToolSelectorSchema, resolveMcpPortalProfile, resolvedMcpPortalProfileSchema, secretFormatSchema, secretValueSchema, secretValueToEnvironmentReference, toolPortalAgentConfigSchema, toolPortalBackendBindingSchema, toolPortalCallPolicySchema, toolPortalCapabilityPolicySchema, toolPortalConfigSchema, toolPortalProfileDefinitionSchema, toolPortalToolSelectorSchema };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/json-config-file.ts","../src/json-value.ts","../src/secret-value.ts","../src/mcp-config.ts","../src/mcp-portal-config.ts","../src/mcp-portal-approval-policy.ts","../src/schema-artifacts.ts"],"mappings":";;;iBAsBsB,kBAAA,CAAmB,QAAA,WAAmB,OAAA;;;KCpBhD,aAAA;AAAA,KACA,SAAA,GAAY,SAAA;AAAA,KACZ,UAAA;EAAA,CAAgB,GAAA,WAAc,SAAA;AAAA;AAAA,KAC9B,SAAA,GAAY,SAAA,GAAY,UAAA,GAAa,aAAA;AAAA,cAEpC,eAAA,EAAiB,CAAA,CAAE,OAAA,CAAQ,SAAA;AAAA,cAW3B,gBAAA,EAAkB,CAAA,CAAE,OAAA,CAAQ,UAAA;AAAA,iBAEzB,YAAA,CAAa,KAAA,YAAiB,KAAA,IAAS,UAAA;AAAA,iBAIvC,gBAAA,CAAiB,KAAA,WAAgB,KAAA,WAAgB,UAAA;;;cCtBpD,kBAAA,EAAkB,CAAA,CAAA,qBAAA,EAAA,CAAA,CAAA,SAAA;;;;;;cAmClB,iBAAA,EAAiB,CAAA,CAAA,qBAAA,EAAA,CAAA,CAAA,SAAA;;;;;;;cAKjB,0BAAA,EAA0B,CAAA,CAAA,qBAAA,EAAA,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;KAS3B,YAAA,GAAe,CAAA,CAAE,KAAA,QAAa,kBAAA;AAAA,KAC9B,WAAA,GAAc,CAAA,CAAE,KAAA,QAAa,iBAAA;AAAA,KAC7B,oBAAA,GAAuB,CAAA,CAAE,KAAA,QAAa,0BAAA;AAAA,iBAElC,iBAAA,CAAkB,MAAA,EAAQ,oBAAA,EAAsB,QAAA;;;cCNnD,qBAAA,EAAqB,CAAA,CAAA,SAAA;;;;;;;cAuBrB,iBAAA,EAAiB,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAcjB,eAAA,EAAe,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAQhB,SAAA,GAAY,CAAA,CAAE,KAAA,QAAa,eAAA;AAAA,KAC3B,WAAA,GAAc,CAAA,CAAE,KAAA,QAAa,iBAAA;AAAA,KAE7B,mBAAA;EAAA,SAEA,OAAA,EAAS,QAAA,CAAS,MAAA,SAAe,oBAAA;EAAA,SACjC,SAAA;EAAA,SACA,SAAA;EAAA,SACA,GAAA;AAAA;EAAA,SAGA,IAAA;EAAA,SACA,OAAA;EAAA,SACA,GAAA;EAAA,SACA,GAAA,EAAK,QAAA,CAAS,MAAA,SAAe,oBAAA;EAAA,SAC7B,SAAA;EAAA,SACA,SAAA;AAAA;AAAA,iBAGU,aAAA,CAAc,UAAA,WAAqB,OAAA,CAAQ,SAAA;AAAA,iBAIjD,4BAAA,CAA6B,MAAA,EAAQ,SAAA,YAAqB,mBAAA;;;cChH7D,sBAAA,EAAsB,CAAA,CAAA,SAAA;;;;KAOvB,gBAAA,GAAmB,CAAA,CAAE,KAAA,QAAa,sBAAA;AAAA,cAEjC,wBAAA,EAAwB,CAAA,CAAA,SAAA;;;;KAOzB,kBAAA,GAAqB,CAAA,CAAE,KAAA,QAAa,wBAAA;AAAA,cAEnC,0BAAA,EAA0B,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAuB3B,oBAAA,GAAuB,CAAA,CAAE,KAAA,QAAa,0BAAA;AAAA,cAmCrC,gCAAA,EAAgC,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA6BjC,0BAAA,GAA6B,CAAA,CAAE,KAAA,QAAa,gCAAA;AAAA,cAE3C,8BAAA,EAA8B,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAiB/B,wBAAA,GAA2B,CAAA,CAAE,KAAA,QAAa,8BAAA;AAAA,cAEzC,2BAAA,EAA2B,CAAA,CAAA,SAAA;;;;;;;;;KAM5B,2BAAA,GAA8B,CAAA,CAAE,KAAA,QAAa,2BAAA;AAAA,cAS5C,oBAAA,EAAoB,CAAA,CAAA,SAAA;;;;;;;;;KAwBrB,oBAAA,GAAuB,CAAA,CAAE,KAAA,QAAa,oBAAA;AAAA,cAErC,0BAAA,EAA0B,CAAA,CAAA,SAAA;;;;;;;;;;;KAQ3B,oBAAA,GAAuB,CAAA,CAAE,KAAA,QAAa,0BAAA;AAAA,cAErC,qBAAA,EAAqB,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAoB7B,qBAAA,GAAwB,CAAA,CAAE,KAAA,QAAa,qBAAA;AAAA,KAChC,eAAA,GAAkB,IAAA,CAAK,qBAAA;EAAA,SACzB,MAAA,EAAQ,QAAA,CAAS,MAAA,SAAe,oBAAA;AAAA;AAAA,cAG7B,mCAAA,EAAmC,CAAA,CAAA,SAAA;;;;KAOpC,6BAAA,GAAgC,CAAA,CAAE,KAAA,QAAa,mCAAA;AAAA,iBAcrC,mBAAA,CAAoB,UAAA,WAAqB,OAAA,CAAQ,eAAA;AAAA,iBA2FvD,uBAAA,CACf,MAAA,EAAQ,eAAA,EACR,WAAA,WACE,wBAAA;AAAA,iBAQa,iCAAA,CAAkC,MAAA,EAAQ,WAAA;;;UCxUzC,gCAAA;EAAA,SACP,eAAA;EAAA,SACA,YAAA;AAAA;AAAA,UAGO,yBAAA;EAAA,SACP,WAAA,GAAc,gCAAA;EAAA,SACd,SAAA;EAAA,SACA,QAAA;AAAA;AAAA,KAyCE,2BAAA;EAAA,SACE,IAAA;AAAA;EAAA,SACA,IAAA;AAAA;EAAA,SACA,IAAA;AAAA;AAAA,iBAEE,2BAAA,CACf,OAAA,EAAS,wBAAA,EACT,IAAA,EAAM,yBAAA,GACJ,2BAAA;AAAA,iBAqBa,6BAAA,CACf,OAAA,EAAS,wBAAA,EACT,IAAA,EAAM,yBAAA;;;cC7EM,6BAAA;EAAA,SAGH,GAAA;EAAA,SAAA,SAAA;AAAA;AAAA,cAEG,wBAAA;EAAA,SAGH,GAAA;EAAA,SAAA,SAAA;AAAA;AAAA,cAEG,0BAAA;EAAA,SAGH,oBAAA;EAAA,SAAA,0BAAA;AAAA;AAAA,UAEO,6BAAA;EAAA,SACP,GAAA,EAAK,MAAA;EAAA,SACL,SAAA,EAAW,MAAA;AAAA;AAAA,iBAUL,mCAAA,CAAA,GAAuC,6BAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/json-config-file.ts","../src/json-value.ts","../src/secret-value.ts","../src/mcp-config.ts","../src/mcp-portal-config.ts","../src/mcp-portal-approval-policy.ts","../src/schema-artifacts.ts","../src/tool-portal-config.ts"],"mappings":";;;iBAsBsB,kBAAA,CAAmB,QAAA,WAAmB,OAAA;;;KCpBhD,aAAA;AAAA,KACA,SAAA,GAAY,SAAA;AAAA,KACZ,UAAA;EAAA,CAAgB,GAAA,WAAc,SAAA;AAAA;AAAA,KAC9B,SAAA,GAAY,SAAA,GAAY,UAAA,GAAa,aAAA;AAAA,cAEpC,eAAA,EAAiB,CAAA,CAAE,OAAA,CAAQ,SAAA;AAAA,cAW3B,gBAAA,EAAkB,CAAA,CAAE,OAAA,CAAQ,UAAA;AAAA,iBAEzB,YAAA,CAAa,KAAA,YAAiB,KAAA,IAAS,UAAA;AAAA,iBAIvC,gBAAA,CAAiB,KAAA,WAAgB,KAAA,WAAgB,UAAA;;;cCtBpD,kBAAA,EAAkB,CAAA,CAAA,qBAAA,EAAA,CAAA,CAAA,SAAA;;;;;;cAmClB,iBAAA,EAAiB,CAAA,CAAA,qBAAA,EAAA,CAAA,CAAA,SAAA;;;;;;;cAKjB,0BAAA,EAA0B,CAAA,CAAA,qBAAA,EAAA,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;KAS3B,YAAA,GAAe,CAAA,CAAE,KAAA,QAAa,kBAAA;AAAA,KAC9B,WAAA,GAAc,CAAA,CAAE,KAAA,QAAa,iBAAA;AAAA,KAC7B,oBAAA,GAAuB,CAAA,CAAE,KAAA,QAAa,0BAAA;AAAA,iBAElC,iBAAA,CAAkB,MAAA,EAAQ,oBAAA,EAAsB,QAAA;;;cCDnD,qBAAA,EAAqB,CAAA,CAAA,SAAA;;;;;;;cAuBrB,iBAAA,EAAiB,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAcjB,eAAA,EAAe,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAQhB,SAAA,GAAY,CAAA,CAAE,KAAA,QAAa,eAAA;AAAA,KAC3B,WAAA,GAAc,CAAA,CAAE,KAAA,QAAa,iBAAA;AAAA,KAE7B,mBAAA;EAAA,SAEA,mBAAA;EAAA,SACA,OAAA,EAAS,QAAA,CAAS,MAAA,SAAe,oBAAA;EAAA,SACjC,SAAA;EAAA,SACA,SAAA;EAAA,SACA,GAAA;AAAA;EAAA,SAGA,IAAA;EAAA,SACA,OAAA;EAAA,SACA,mBAAA;EAAA,SACA,GAAA;EAAA,SACA,GAAA,EAAK,QAAA,CAAS,MAAA,SAAe,oBAAA;EAAA,SAC7B,SAAA;EAAA,SACA,SAAA;AAAA;AAAA,iBAGU,aAAA,CAAc,UAAA,WAAqB,OAAA,CAAQ,SAAA;AAAA,iBAIjD,4BAAA,CAA6B,MAAA,EAAQ,SAAA,YAAqB,mBAAA;;;cCvH7D,sBAAA,EAAsB,CAAA,CAAA,SAAA;;;;KAOvB,gBAAA,GAAmB,CAAA,CAAE,KAAA,QAAa,sBAAA;AAAA,cAEjC,wBAAA,EAAwB,CAAA,CAAA,SAAA;;;;KAOzB,kBAAA,GAAqB,CAAA,CAAE,KAAA,QAAa,wBAAA;AAAA,cAEnC,0BAAA,EAA0B,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAuB3B,oBAAA,GAAuB,CAAA,CAAE,KAAA,QAAa,0BAAA;AAAA,cAmCrC,gCAAA,EAAgC,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA6BjC,0BAAA,GAA6B,CAAA,CAAE,KAAA,QAAa,gCAAA;AAAA,cAE3C,8BAAA,EAA8B,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAiB/B,wBAAA,GAA2B,CAAA,CAAE,KAAA,QAAa,8BAAA;AAAA,cAEzC,2BAAA,EAA2B,CAAA,CAAA,SAAA;;;;;;;;;KAM5B,2BAAA,GAA8B,CAAA,CAAE,KAAA,QAAa,2BAAA;AAAA,cAS5C,oBAAA,EAAoB,CAAA,CAAA,SAAA;;;;;;;;;KAwBrB,oBAAA,GAAuB,CAAA,CAAE,KAAA,QAAa,oBAAA;AAAA,cAErC,0BAAA,EAA0B,CAAA,CAAA,SAAA;;;;;;;;;;;KAQ3B,oBAAA,GAAuB,CAAA,CAAE,KAAA,QAAa,0BAAA;AAAA,cAErC,qBAAA,EAAqB,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAoB7B,qBAAA,GAAwB,CAAA,CAAE,KAAA,QAAa,qBAAA;AAAA,KAChC,eAAA,GAAkB,IAAA,CAAK,qBAAA;EAAA,SACzB,MAAA,EAAQ,QAAA,CAAS,MAAA,SAAe,oBAAA;AAAA;AAAA,cAG7B,mCAAA,EAAmC,CAAA,CAAA,SAAA;;;;KAOpC,6BAAA,GAAgC,CAAA,CAAE,KAAA,QAAa,mCAAA;AAAA,iBAcrC,mBAAA,CAAoB,UAAA,WAAqB,OAAA,CAAQ,eAAA;AAAA,iBA2FvD,uBAAA,CACf,MAAA,EAAQ,eAAA,EACR,WAAA,WACE,wBAAA;AAAA,iBAQa,iCAAA,CAAkC,MAAA,EAAQ,WAAA;;;UCxUzC,gCAAA;EAAA,SACP,eAAA;EAAA,SACA,YAAA;AAAA;AAAA,UAGO,yBAAA;EAAA,SACP,WAAA,GAAc,gCAAA;EAAA,SACd,SAAA;EAAA,SACA,QAAA;AAAA;AAAA,KAyCE,2BAAA;EAAA,SACE,IAAA;AAAA;EAAA,SACA,IAAA;AAAA;EAAA,SACA,IAAA;AAAA;AAAA,iBAEE,2BAAA,CACf,OAAA,EAAS,wBAAA,EACT,IAAA,EAAM,yBAAA,GACJ,2BAAA;AAAA,iBAqBa,6BAAA,CACf,OAAA,EAAS,wBAAA,EACT,IAAA,EAAM,yBAAA;;;cC5EM,6BAAA;EAAA;;;;cAMA,wBAAA;EAAA;;;;cAMA,0BAAA;EAAA;;;;UAMI,6BAAA;EAAA,SACP,GAAA,EAAK,MAAA;EAAA,SACL,SAAA,EAAW,MAAA;EAAA,SACX,UAAA,EAAY,MAAA;AAAA;AAAA,iBAUN,mCAAA,CAAA,GAAuC,6BAAA;;;cCjC1C,4BAAA,EAA4B,CAAA,CAAA,SAAA;;;;KAO7B,sBAAA,GAAyB,CAAA,CAAE,KAAA,QAAa,4BAAA;AAAA,cAEvC,0BAAA,EAA0B,CAAA,CAAA,SAAA;;;;;;;;;;KAgB3B,oBAAA,GAAuB,CAAA,CAAE,KAAA,QAAa,0BAAA;AAAA,cAErC,8BAAA,EAA8B,CAAA,CAAA,qBAAA,EAAA,CAAA,CAAA,SAAA;;;;;;;KAM/B,wBAAA,GAA2B,CAAA,CAAE,KAAA,QAAa,8BAAA;AAAA,cAEzC,gCAAA,EAAgC,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;KAQjC,0BAAA,GAA6B,CAAA,CAAE,KAAA,QAAa,gCAAA;AAAA,cAE3C,iCAAA,EAAiC,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;KAMlC,2BAAA,GAA8B,CAAA,CAAE,KAAA,QAAa,iCAAA;AAAA,cAE5C,2BAAA,EAA2B,CAAA,CAAA,SAAA;;;KAM5B,qBAAA,GAAwB,CAAA,CAAE,KAAA,QAAa,2BAAA;AAAA,cAEtC,sBAAA,EAAsB,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA4BvB,gBAAA,GAAmB,CAAA,CAAE,KAAA,QAAa,sBAAA;AAAA,iBAExB,oBAAA,CAAqB,UAAA,WAAqB,OAAA,CAAQ,gBAAA;AAAA,cAI3D,sCAAA,EAAsC,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;KAOvC,gCAAA,GAAmC,CAAA,CAAE,KAAA,QACzC,sCAAA;AAAA,cAGK,6BAAA,EAA6B,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;KAQ9B,uBAAA,GAA0B,CAAA,CAAE,KAAA,QAAa,6BAAA;AAAA,cAExC,uDAAA,EAAuD,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;KAGxD,iDAAA,GAAoD,CAAA,CAAE,KAAA,QAC1D,uDAAA;AAAA,cAGK,8CAAA,EAA8C,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;KAW/C,wCAAA,GAA2C,CAAA,CAAE,KAAA,QACjD,8CAAA;AAAA,UAGS,kCAAA;EAAA,SACP,OAAA;EAAA,SACA,MAAA,EAAQ,gBAAA;AAAA;AAAA,iBAGF,6BAAA,CACf,KAAA,EAAO,kCAAA,GACL,uBAAA;AAAA,UAgCc,mDAAA;EAAA,SACP,OAAA;EAAA,SACA,MAAA,EAAQ,gBAAA;AAAA;AAAA,iBAGF,8CAAA,CACf,KAAA,EAAO,mDAAA,GACL,wCAAA"}

package/dist/index.js

@@ -73,15 +73,18 @@ const remoteTransportUrlSchema = z.url().refine((value) => {
 	const protocol = new URL(value).protocol;
 	return protocol === "http:" || protocol === "https:";
 }, { message: "Remote MCP transport URLs must use http or https." });
+const connectionTimeoutMsSchema = z.number().int().min(1).max(3e5);
 const streamableHttpTransportSchema = z.object({
 	kind: z.literal("streamable-http"),
 	url: remoteTransportUrlSchema,
+	connectionTimeoutMs: connectionTimeoutMsSchema.optional(),
 	headers: z.record(z.string(), formattedSecretValueSchema).default({}),
 	requiredEgressHosts: z.array(z.string().min(1)).default([])
 }).strict();
 const sseTransportSchema = z.object({
 	kind: z.literal("sse"),
 	url: remoteTransportUrlSchema,
+	connectionTimeoutMs: connectionTimeoutMsSchema.optional(),
 	headers: z.record(z.string(), formattedSecretValueSchema).default({}),
 	requiredEgressHosts: z.array(z.string().min(1)).default([])
 }).strict();
@@ -89,6 +92,7 @@ const stdioTransportSchema = z.object({
 	kind: z.literal("stdio"),
 	command: z.string().min(1),
 	args: z.array(z.string()).default([]),
+	connectionTimeoutMs: connectionTimeoutMsSchema.optional(),
 	cwd: z.string().min(1).optional(),
 	env: z.record(z.string(), formattedSecretValueSchema).default({}),
 	networkAccess: z.enum(["declared", "none"]).optional(),
@@ -139,15 +143,18 @@ function mcpConfigToResolvedProviders(config) {
 				namespace: provider.namespace,
 				transport: transport.kind
 			};
+			if (transport.connectionTimeoutMs !== void 0) resolvedProvider.connectionTimeoutMs = transport.connectionTimeoutMs;
 			if (transport.cwd !== void 0) resolvedProvider.cwd = transport.cwd;
 			return resolvedProvider;
 		}
-		return {
+		const resolvedProvider = {
 			headers: transport.headers,
 			namespace: provider.namespace,
 			transport: transport.kind,
 			url: transport.url
 		};
+		if (transport.connectionTimeoutMs !== void 0) resolvedProvider.connectionTimeoutMs = transport.connectionTimeoutMs;
+		return resolvedProvider;
 	});
 }
 //#endregion
@@ -343,18 +350,129 @@ function secretValueToEnvironmentReference(secret) {
 	return secret.ref;
 }
 //#endregion
+//#region src/tool-portal-config.ts
+const toolPortalToolSelectorSchema = z.object({
+	allow: z.union([z.literal("*"), z.array(z.string().min(1))]),
+	deny: z.array(z.string().min(1)).default([])
+}).strict();
+const toolPortalCallPolicySchema = z.object({
+	requiresApproval: toolPortalToolSelectorSchema,
+	withoutApproval: toolPortalToolSelectorSchema
+}).strict().superRefine((policy, context) => {
+	if (toolSelectorsOverlap(policy.requiresApproval, policy.withoutApproval)) context.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: "Tool Portal call policy cannot list one tool in both approval selectors.",
+		path: ["withoutApproval"]
+	});
+});
+const toolPortalBackendBindingSchema = z.discriminatedUnion("kind", [
+	z.object({ kind: z.literal("mcp_provider") }).strict(),
+	z.object({ kind: z.literal("controller_host_action") }).strict(),
+	z.object({ kind: z.literal("tool_vm_runner") }).strict()
+]);
+const toolPortalCapabilityPolicySchema = z.object({
+	backend: toolPortalBackendBindingSchema,
+	calls: toolPortalCallPolicySchema,
+	tools: toolPortalToolSelectorSchema
+}).strict();
+const toolPortalProfileDefinitionSchema = z.object({ capabilities: z.record(z.string().min(1), toolPortalCapabilityPolicySchema).default({}) }).strict();
+const toolPortalAgentConfigSchema = z.object({ profile: z.string().min(1) }).strict();
+const toolPortalConfigSchema = z.object({
+	$schema: z.string().min(1).optional(),
+	schemaVersion: z.literal(1),
+	agents: z.record(z.string().min(1), toolPortalAgentConfigSchema).default({}),
+	profiles: z.record(z.string().min(1), toolPortalProfileDefinitionSchema)
+}).strict().superRefine((config, context) => {
+	if (Object.keys(config.profiles).length === 0) context.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: "tool-portal.config.jsonc must define at least one profile.",
+		path: ["profiles"]
+	});
+	for (const [agentId, agentConfig] of Object.entries(config.agents)) if (config.profiles[agentConfig.profile] === void 0) context.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: `Tool Portal agent "${agentId}" references missing profile "${agentConfig.profile}".`,
+		path: [
+			"agents",
+			agentId,
+			"profile"
+		]
+	});
+});
+async function loadToolPortalConfig(configPath) {
+	return toolPortalConfigSchema.parse(await loadJsonConfigFile(configPath));
+}
+const ToolPortalMcpProjectionNamespaceSchema = z.object({
+	calls: toolPortalCallPolicySchema,
+	tools: toolPortalToolSelectorSchema
+}).strict();
+const ToolPortalMcpProjectionSchema = z.object({
+	agentId: z.string().min(1),
+	namespaces: z.record(z.string().min(1), ToolPortalMcpProjectionNamespaceSchema),
+	profile: z.string().min(1)
+}).strict();
+const ToolPortalControllerHostActionProjectionNamespaceSchema = ToolPortalMcpProjectionNamespaceSchema;
+const ToolPortalControllerHostActionProjectionSchema = z.object({
+	agentId: z.string().min(1),
+	namespaces: z.record(z.string().min(1), ToolPortalControllerHostActionProjectionNamespaceSchema),
+	profile: z.string().min(1)
+}).strict();
+function createToolPortalMcpProjection(props) {
+	const agentConfig = props.config.agents[props.agentId];
+	if (agentConfig === void 0) throw new Error(`Tool Portal agent "${props.agentId}" is not configured.`);
+	const profileConfig = props.config.profiles[agentConfig.profile];
+	if (profileConfig === void 0) throw new Error(`Tool Portal agent "${props.agentId}" references missing profile "${agentConfig.profile}".`);
+	const namespaces = Object.fromEntries(Object.entries(profileConfig.capabilities).filter(([, capabilityPolicy]) => capabilityPolicy.backend.kind === "mcp_provider").map(([namespace, capabilityPolicy]) => [namespace, {
+		calls: capabilityPolicy.calls,
+		tools: capabilityPolicy.tools
+	}]));
+	return ToolPortalMcpProjectionSchema.parse({
+		agentId: props.agentId,
+		namespaces,
+		profile: agentConfig.profile
+	});
+}
+function createToolPortalControllerHostActionProjection(props) {
+	const agentConfig = props.config.agents[props.agentId];
+	if (agentConfig === void 0) throw new Error(`Tool Portal agent "${props.agentId}" is not configured.`);
+	const profileConfig = props.config.profiles[agentConfig.profile];
+	if (profileConfig === void 0) throw new Error(`Tool Portal agent "${props.agentId}" references missing profile "${agentConfig.profile}".`);
+	const namespaces = Object.fromEntries(Object.entries(profileConfig.capabilities).filter(([, capabilityPolicy]) => capabilityPolicy.backend.kind === "controller_host_action").map(([namespace, capabilityPolicy]) => [namespace, {
+		calls: capabilityPolicy.calls,
+		tools: capabilityPolicy.tools
+	}]));
+	return ToolPortalControllerHostActionProjectionSchema.parse({
+		agentId: props.agentId,
+		namespaces,
+		profile: agentConfig.profile
+	});
+}
+function toolSelectorsOverlap(left, right) {
+	const leftAllow = left.allow;
+	const rightAllow = right.allow;
+	if (leftAllow === "*" && rightAllow === "*") return true;
+	if (leftAllow === "*") {
+		if (rightAllow === "*") return true;
+		return rightAllow.some((toolName) => !left.deny.includes(toolName));
+	}
+	if (rightAllow === "*") return leftAllow.some((toolName) => !right.deny.includes(toolName));
+	return leftAllow.some((toolName) => rightAllow.includes(toolName) && !left.deny.includes(toolName) && !right.deny.includes(toolName));
+}
+//#endregion
 //#region src/schema-artifacts.ts
 const mcpPortalConfigSchemaVersions = {
 	mcp: 1,
-	mcpPortal: 1
+	mcpPortal: 1,
+	toolPortal: 1
 };
 const mcpPortalConfigSchemaIds = {
 	mcp: "agent-vm:mcp:1",
-	mcpPortal: "agent-vm:mcp-portal:1"
+	mcpPortal: "agent-vm:mcp-portal:1",
+	toolPortal: "agent-vm:tool-portal:1"
 };
 const mcpPortalConfigSchemaPaths = {
 	mcpFromGatewayConfig: "../../schemas/mcp.schema.json",
-	mcpPortalFromGatewayConfig: "../../schemas/mcp-portal.schema.json"
+	mcpPortalFromGatewayConfig: "../../schemas/mcp-portal.schema.json",
+	toolPortalFromGatewayConfig: "../../schemas/tool-portal.schema.json"
 };
 function withSchemaId(schema, schemaId) {
 	return {
@@ -365,10 +483,11 @@ function withSchemaId(schema, schemaId) {
 function createConfigContractSchemaArtifacts() {
 	return {
 		mcp: withSchemaId(zod.toJSONSchema(mcpConfigSchema, { target: "draft-07" }), mcpPortalConfigSchemaIds.mcp),
-		mcpPortal: withSchemaId(zod.toJSONSchema(mcpPortalConfigSchema, { target: "draft-07" }), mcpPortalConfigSchemaIds.mcpPortal)
+		mcpPortal: withSchemaId(zod.toJSONSchema(mcpPortalConfigSchema, { target: "draft-07" }), mcpPortalConfigSchemaIds.mcpPortal),
+		toolPortal: withSchemaId(zod.toJSONSchema(toolPortalConfigSchema, { target: "draft-07" }), mcpPortalConfigSchemaIds.toolPortal)
 	};
 }
 //#endregion
-export { assertJsonObject, createConfigContractSchemaArtifacts, formatSecretValue, formattedSecretValueSchema, isJsonObject, jsonObjectSchema, jsonValueSchema, loadJsonConfigFile, loadMcpConfig, loadMcpPortalConfig, mcpConfigSchema, mcpConfigToResolvedProviders, mcpPortalAgentConfigSchema, mcpPortalCallPolicyDecision, mcpPortalCallRequiresApproval, mcpPortalConfigSchema, mcpPortalConfigSchemaIds, mcpPortalConfigSchemaPaths, mcpPortalConfigSchemaVersions, mcpPortalExternalAuthSchema, mcpPortalProfileDefinitionSchema, mcpPortalProxySchema, mcpProviderSchema, mcpSecretPolicySchema, namespaceToolRefSchema, openClawMcpPortalPluginConfigSchema, portalApprovalConfigSchema, portalToolSelectorSchema, resolveMcpPortalProfile, resolvedMcpPortalProfileSchema, secretFormatSchema, secretValueSchema, secretValueToEnvironmentReference };
+export { ToolPortalControllerHostActionProjectionNamespaceSchema, ToolPortalControllerHostActionProjectionSchema, ToolPortalMcpProjectionNamespaceSchema, ToolPortalMcpProjectionSchema, assertJsonObject, createConfigContractSchemaArtifacts, createToolPortalControllerHostActionProjection, createToolPortalMcpProjection, formatSecretValue, formattedSecretValueSchema, isJsonObject, jsonObjectSchema, jsonValueSchema, loadJsonConfigFile, loadMcpConfig, loadMcpPortalConfig, loadToolPortalConfig, mcpConfigSchema, mcpConfigToResolvedProviders, mcpPortalAgentConfigSchema, mcpPortalCallPolicyDecision, mcpPortalCallRequiresApproval, mcpPortalConfigSchema, mcpPortalConfigSchemaIds, mcpPortalConfigSchemaPaths, mcpPortalConfigSchemaVersions, mcpPortalExternalAuthSchema, mcpPortalProfileDefinitionSchema, mcpPortalProxySchema, mcpProviderSchema, mcpSecretPolicySchema, namespaceToolRefSchema, openClawMcpPortalPluginConfigSchema, portalApprovalConfigSchema, portalToolSelectorSchema, resolveMcpPortalProfile, resolvedMcpPortalProfileSchema, secretFormatSchema, secretValueSchema, secretValueToEnvironmentReference, toolPortalAgentConfigSchema, toolPortalBackendBindingSchema, toolPortalCallPolicySchema, toolPortalCapabilityPolicySchema, toolPortalConfigSchema, toolPortalProfileDefinitionSchema, toolPortalToolSelectorSchema };
 
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/json-config-file.ts","../src/json-value.ts","../src/secret-value.ts","../src/mcp-config.ts","../src/mcp-portal-approval-policy.ts","../src/mcp-portal-config.ts","../src/schema-artifacts.ts"],"sourcesContent":["import { readFile } from 'node:fs/promises';\n\nimport { parse, type ParseError, type ParseOptions, printParseErrorCode } from 'jsonc-parser';\n\nconst parseJsoncToUnknown: (text: string, errors: ParseError[], options: ParseOptions) => unknown =\n\tparse;\n\nfunction formatLineColumn(text: string, offset: number): string {\n\tconst prefix = text.slice(0, offset);\n\tconst line = prefix.split('\\n').length;\n\tconst lastLineBreakIndex = prefix.lastIndexOf('\\n');\n\tconst column = offset - lastLineBreakIndex;\n\treturn `line ${line}, column ${column}`;\n}\n\nfunction formatParseError(filePath: string, text: string, error: ParseError): string {\n\treturn [\n\t\t`Invalid JSONC in ${filePath}: ${formatLineColumn(text, error.offset)}:`,\n\t\tprintParseErrorCode(error.error),\n\t].join(' ');\n}\n\nexport async function loadJsonConfigFile(filePath: string): Promise<unknown> {\n\tconst rawConfig = await readFile(filePath, 'utf8');\n\tconst parseErrors: ParseError[] = [];\n\tconst parsedConfig = parseJsoncToUnknown(rawConfig, parseErrors, {\n\t\tallowTrailingComma: true,\n\t\tdisallowComments: false,\n\t});\n\n\tif (parseErrors.length > 0) {\n\t\tconst firstParseError = parseErrors[0];\n\t\tif (firstParseError !== undefined) {\n\t\t\tthrow new Error(formatParseError(filePath, rawConfig, firstParseError));\n\t\t}\n\t}\n\n\treturn parsedConfig;\n}\n","import { z } from 'zod';\n\nexport type JsonPrimitive = boolean | null | number | string;\nexport type JsonArray = JsonValue[];\nexport type JsonObject = { [key: string]: JsonValue };\nexport type JsonValue = JsonArray | JsonObject | JsonPrimitive;\n\nexport const jsonValueSchema: z.ZodType<JsonValue> = z.lazy(() =>\n\tz.union([\n\t\tz.string(),\n\t\tz.number().finite(),\n\t\tz.boolean(),\n\t\tz.null(),\n\t\tz.array(jsonValueSchema),\n\t\tjsonObjectSchema,\n\t]),\n);\n\nexport const jsonObjectSchema: z.ZodType<JsonObject> = z.record(z.string(), jsonValueSchema);\n\nexport function isJsonObject(value: unknown): value is JsonObject {\n\treturn typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nexport function assertJsonObject(value: unknown, label: string): JsonObject {\n\tif (!isJsonObject(value)) {\n\t\tthrow new Error(`${label} must be a JSON object.`);\n\t}\n\n\treturn jsonObjectSchema.parse(value);\n}\n","import { z } from 'zod';\n\nexport const secretFormatSchema = z.discriminatedUnion('kind', [\n\tz\n\t\t.object({\n\t\t\tkind: z.literal('bearer'),\n\t\t})\n\t\t.strict(),\n\tz\n\t\t.object({\n\t\t\tkind: z.literal('prefix'),\n\t\t\tprefix: z\n\t\t\t\t.string()\n\t\t\t\t.min(1, 'secret format prefix must not be empty.')\n\t\t\t\t.max(64, 'secret format prefix must be 64 characters or fewer.')\n\t\t\t\t.refine(\n\t\t\t\t\t(value) => !/\\s/u.test(value),\n\t\t\t\t\t'secret format prefix must not contain whitespace; agent-vm inserts one space.',\n\t\t\t\t),\n\t\t})\n\t\t.strict(),\n]);\n\nconst environmentSecretValueSchema = z\n\t.object({\n\t\tsource: z.literal('environment'),\n\t\tname: z.string().min(1),\n\t})\n\t.strict();\n\nconst onePasswordSecretValueSchema = z\n\t.object({\n\t\tsource: z.literal('1password'),\n\t\tref: z.string().regex(/^op:\\/\\//u, '1Password refs must start with op://'),\n\t})\n\t.strict();\n\nexport const secretValueSchema = z.discriminatedUnion('source', [\n\tenvironmentSecretValueSchema,\n\tonePasswordSecretValueSchema,\n]);\n\nexport const formattedSecretValueSchema = z.discriminatedUnion('source', [\n\tenvironmentSecretValueSchema.extend({\n\t\tformat: secretFormatSchema.optional(),\n\t}),\n\tonePasswordSecretValueSchema.extend({\n\t\tformat: secretFormatSchema.optional(),\n\t}),\n]);\n\nexport type SecretFormat = z.infer<typeof secretFormatSchema>;\nexport type SecretValue = z.infer<typeof secretValueSchema>;\nexport type FormattedSecretValue = z.infer<typeof formattedSecretValueSchema>;\n\nexport function formatSecretValue(secret: FormattedSecretValue, rawValue: string): string {\n\tif (secret.format === undefined) {\n\t\treturn rawValue;\n\t}\n\tswitch (secret.format.kind) {\n\t\tcase 'bearer':\n\t\t\treturn `Bearer ${rawValue}`;\n\t\tcase 'prefix':\n\t\t\treturn `${secret.format.prefix} ${rawValue}`;\n\t\tdefault: {\n\t\t\tconst exhaustiveFormat: never = secret.format;\n\t\t\treturn exhaustiveFormat;\n\t\t}\n\t}\n}\n","import { z } from 'zod';\n\nimport { loadJsonConfigFile } from './json-config-file.js';\nimport { formattedSecretValueSchema, type FormattedSecretValue } from './secret-value.js';\n\nconst mcpProviderDiscoverySchema = z\n\t.object({\n\t\tsummary: z.string().min(1).optional(),\n\t})\n\t.strict();\n\nconst remoteTransportUrlSchema = z.url().refine(\n\t(value) => {\n\t\tconst protocol = new URL(value).protocol;\n\t\treturn protocol === 'http:' || protocol === 'https:';\n\t},\n\t{ message: 'Remote MCP transport URLs must use http or https.' },\n);\n\nconst streamableHttpTransportSchema = z\n\t.object({\n\t\tkind: z.literal('streamable-http'),\n\t\turl: remoteTransportUrlSchema,\n\t\theaders: z.record(z.string(), formattedSecretValueSchema).default({}),\n\t\trequiredEgressHosts: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nconst sseTransportSchema = z\n\t.object({\n\t\tkind: z.literal('sse'),\n\t\turl: remoteTransportUrlSchema,\n\t\theaders: z.record(z.string(), formattedSecretValueSchema).default({}),\n\t\trequiredEgressHosts: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nconst stdioTransportSchema = z\n\t.object({\n\t\tkind: z.literal('stdio'),\n\t\tcommand: z.string().min(1),\n\t\targs: z.array(z.string()).default([]),\n\t\tcwd: z.string().min(1).optional(),\n\t\tenv: z.record(z.string(), formattedSecretValueSchema).default({}),\n\t\tnetworkAccess: z.enum(['declared', 'none']).optional(),\n\t\trequiredEgressHosts: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nexport const mcpSecretPolicySchema = z\n\t.object({\n\t\thosts: z.array(z.string()).default([]),\n\t\tinjection: z.enum(['env', 'http-mediation']),\n\t})\n\t.strict()\n\t.superRefine((policy, context) => {\n\t\tif (policy.injection === 'http-mediation' && policy.hosts.length === 0) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: 'http-mediation secret policies must declare at least one host.',\n\t\t\t\tpath: ['hosts'],\n\t\t\t});\n\t\t}\n\t\tif (policy.injection === 'env' && policy.hosts.length > 0) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: 'env secret policies must not declare hosts.',\n\t\t\t\tpath: ['hosts'],\n\t\t\t});\n\t\t}\n\t});\n\nexport const mcpProviderSchema = z\n\t.object({\n\t\tkind: z.literal('mcp'),\n\t\tnamespace: z.string().min(1),\n\t\tdiscovery: mcpProviderDiscoverySchema.default({}),\n\t\tsecretPolicies: z.record(z.string().min(1), mcpSecretPolicySchema).default({}),\n\t\ttransport: z.discriminatedUnion('kind', [\n\t\t\tstreamableHttpTransportSchema,\n\t\t\tsseTransportSchema,\n\t\t\tstdioTransportSchema,\n\t\t]),\n\t})\n\t.strict();\n\nexport const mcpConfigSchema = z\n\t.object({\n\t\t$schema: z.string().min(1).optional(),\n\t\tschemaVersion: z.literal(1),\n\t\tproviders: z.record(z.string().min(1), mcpProviderSchema).default({}),\n\t})\n\t.strict();\n\nexport type McpConfig = z.infer<typeof mcpConfigSchema>;\nexport type McpProvider = z.infer<typeof mcpProviderSchema>;\n\nexport type ResolvedMcpProvider =\n\t| {\n\t\t\treadonly headers: Readonly<Record<string, FormattedSecretValue>>;\n\t\t\treadonly namespace: string;\n\t\t\treadonly transport: 'streamable-http' | 'sse';\n\t\t\treadonly url: string;\n\t  }\n\t| {\n\t\t\treadonly args: readonly string[];\n\t\t\treadonly command: string;\n\t\t\treadonly cwd?: string;\n\t\t\treadonly env: Readonly<Record<string, FormattedSecretValue>>;\n\t\t\treadonly namespace: string;\n\t\t\treadonly transport: 'stdio';\n\t  };\n\nexport async function loadMcpConfig(configPath: string): Promise<McpConfig> {\n\treturn mcpConfigSchema.parse(await loadJsonConfigFile(configPath));\n}\n\nexport function mcpConfigToResolvedProviders(config: McpConfig): readonly ResolvedMcpProvider[] {\n\treturn Object.values(config.providers).map((provider) => {\n\t\tconst transport = provider.transport;\n\t\tif (transport.kind === 'stdio') {\n\t\t\tconst resolvedProvider: {\n\t\t\t\targs: readonly string[];\n\t\t\t\tcommand: string;\n\t\t\t\tcwd?: string;\n\t\t\t\tenv: Readonly<Record<string, FormattedSecretValue>>;\n\t\t\t\tnamespace: string;\n\t\t\t\ttransport: 'stdio';\n\t\t\t} = {\n\t\t\t\targs: transport.args,\n\t\t\t\tcommand: transport.command,\n\t\t\t\tenv: transport.env,\n\t\t\t\tnamespace: provider.namespace,\n\t\t\t\ttransport: transport.kind,\n\t\t\t};\n\t\t\tif (transport.cwd !== undefined) {\n\t\t\t\tresolvedProvider.cwd = transport.cwd;\n\t\t\t}\n\t\t\treturn resolvedProvider;\n\t\t}\n\n\t\treturn {\n\t\t\theaders: transport.headers,\n\t\t\tnamespace: provider.namespace,\n\t\t\ttransport: transport.kind,\n\t\t\turl: transport.url,\n\t\t};\n\t});\n}\n","import type { NamespaceToolRef, ResolvedMcpPortalProfile } from './mcp-portal-config.js';\n\nexport interface McpPortalApprovalToolAnnotations {\n\treadonly destructiveHint?: boolean | undefined;\n\treadonly readOnlyHint?: boolean | undefined;\n}\n\nexport interface McpPortalApprovalToolCall {\n\treadonly annotations?: McpPortalApprovalToolAnnotations;\n\treadonly namespace: string;\n\treadonly toolName: string;\n}\n\nfunction selectorMatches(\n\tselectors: readonly NamespaceToolRef[],\n\tnamespace: string,\n\ttoolName: string,\n): boolean {\n\treturn selectors.some(\n\t\t(selector) => selector.namespace === namespace && selector.toolName === toolName,\n\t);\n}\n\nfunction namespaceSelectorMatches(\n\tprofile: ResolvedMcpPortalProfile,\n\tselectorKind: 'requiresApproval' | 'withoutApproval',\n\tnamespace: string,\n\ttoolName: string,\n): boolean {\n\tconst selector = (profile.approval.callPoliciesByNamespace ?? {})[namespace]?.[selectorKind];\n\tif (selector === undefined) {\n\t\treturn false;\n\t}\n\tif ((selector.deny ?? []).includes(toolName)) {\n\t\treturn false;\n\t}\n\treturn selector.allow === '*' || selector.allow.includes(toolName);\n}\n\nfunction hasTrustedReadOnlyAnnotation(\n\tprofile: ResolvedMcpPortalProfile,\n\tcall: McpPortalApprovalToolCall,\n): boolean {\n\treturn (\n\t\tprofile.approval.annotationPolicy === 'destructive-requires-approval' &&\n\t\tprofile.approval.trustedAnnotationNamespaces.includes(call.namespace) &&\n\t\tcall.annotations?.readOnlyHint === true &&\n\t\tcall.annotations.destructiveHint !== true\n\t);\n}\n\nexport type McpPortalCallPolicyDecision =\n\t| { readonly kind: 'allow_without_approval' }\n\t| { readonly kind: 'blocked' }\n\t| { readonly kind: 'requires_approval' };\n\nexport function mcpPortalCallPolicyDecision(\n\tprofile: ResolvedMcpPortalProfile,\n\tcall: McpPortalApprovalToolCall,\n): McpPortalCallPolicyDecision {\n\tif (\n\t\tselectorMatches(profile.approval.allowWithoutApprovalTools, call.namespace, call.toolName) ||\n\t\tnamespaceSelectorMatches(profile, 'withoutApproval', call.namespace, call.toolName) ||\n\t\thasTrustedReadOnlyAnnotation(profile, call)\n\t) {\n\t\treturn { kind: 'allow_without_approval' };\n\t}\n\tif (profile.approval.annotationPolicy === 'always-require-approval') {\n\t\treturn { kind: 'requires_approval' };\n\t}\n\tif (\n\t\tselectorMatches(profile.approval.alwaysAskTools, call.namespace, call.toolName) ||\n\t\tselectorMatches(profile.approval.writeTools, call.namespace, call.toolName) ||\n\t\tnamespaceSelectorMatches(profile, 'requiresApproval', call.namespace, call.toolName)\n\t) {\n\t\treturn { kind: 'requires_approval' };\n\t}\n\treturn { kind: 'blocked' };\n}\n\nexport function mcpPortalCallRequiresApproval(\n\tprofile: ResolvedMcpPortalProfile,\n\tcall: McpPortalApprovalToolCall,\n): boolean {\n\treturn mcpPortalCallPolicyDecision(profile, call).kind === 'requires_approval';\n}\n","import { z } from 'zod';\n\nimport { loadJsonConfigFile } from './json-config-file.js';\nimport { secretValueSchema, type SecretValue } from './secret-value.js';\n\nexport const namespaceToolRefSchema = z\n\t.object({\n\t\tnamespace: z.string().min(1),\n\t\ttoolName: z.string().min(1),\n\t})\n\t.strict();\n\nexport type NamespaceToolRef = z.infer<typeof namespaceToolRefSchema>;\n\nexport const portalToolSelectorSchema = z\n\t.object({\n\t\tallow: z.union([z.literal('*'), z.array(z.string().min(1))]),\n\t\tdeny: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nexport type PortalToolSelector = z.infer<typeof portalToolSelectorSchema>;\n\nexport const portalApprovalConfigSchema = z\n\t.object({\n\t\tallowWithoutApprovalTools: z.array(namespaceToolRefSchema).default([]),\n\t\talwaysAskTools: z.array(namespaceToolRefSchema).default([]),\n\t\tannotationPolicy: z\n\t\t\t.enum(['destructive-requires-approval', 'always-require-approval'])\n\t\t\t.default('destructive-requires-approval'),\n\t\tcallPoliciesByNamespace: z\n\t\t\t.record(\n\t\t\t\tz.string().min(1),\n\t\t\t\tz\n\t\t\t\t\t.object({\n\t\t\t\t\t\trequiresApproval: portalToolSelectorSchema,\n\t\t\t\t\t\twithoutApproval: portalToolSelectorSchema,\n\t\t\t\t\t})\n\t\t\t\t\t.strict(),\n\t\t\t)\n\t\t\t.default({}),\n\t\ttrustedAnnotationNamespaces: z.array(z.string().min(1)).default([]),\n\t\twriteTools: z.array(namespaceToolRefSchema).default([]),\n\t})\n\t.strict();\n\nexport type PortalApprovalConfig = z.infer<typeof portalApprovalConfigSchema>;\n\nconst portalNamespaceCallPolicySchema = z\n\t.object({\n\t\trequiresApproval: portalToolSelectorSchema,\n\t\twithoutApproval: portalToolSelectorSchema,\n\t})\n\t.strict();\n\nconst portalNamespaceApprovalSchema = z\n\t.object({\n\t\tallowWithoutApproval: z.array(z.string().min(1)).default([]),\n\t\talwaysAsk: z.array(z.string().min(1)).default([]),\n\t\ttrustedAnnotations: z.boolean().default(false),\n\t\twrite: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nconst defaultPortalNamespaceApproval = {\n\tallowWithoutApproval: [],\n\talwaysAsk: [],\n\ttrustedAnnotations: false,\n\twrite: [],\n} satisfies z.infer<typeof portalNamespaceApprovalSchema>;\n\nconst portalNamespacePolicySchema = z\n\t.object({\n\t\tapproval: portalNamespaceApprovalSchema.default(defaultPortalNamespaceApproval).optional(),\n\t\tcalls: portalNamespaceCallPolicySchema,\n\t\ttools: portalToolSelectorSchema,\n\t})\n\t.strict();\n\ntype PortalNamespacePolicy = z.infer<typeof portalNamespacePolicySchema>;\n\nexport const mcpPortalProfileDefinitionSchema = z\n\t.object({\n\t\tapproval: z\n\t\t\t.object({\n\t\t\t\tannotationPolicy: portalApprovalConfigSchema.shape.annotationPolicy.optional(),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.optional(),\n\t\tnamespaces: z.record(z.string().min(1), portalNamespacePolicySchema).default({}),\n\t\tlogging: z\n\t\t\t.object({ enabled: z.boolean().default(false) })\n\t\t\t.strict()\n\t\t\t.optional(),\n\t\tpromptContext: z\n\t\t\t.object({\n\t\t\t\tenabled: z.boolean().default(true),\n\t\t\t\tmaxNamespaces: z.number().int().positive().default(12),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.optional(),\n\t\tcache: z\n\t\t\t.object({\n\t\t\t\tcatalogTtlMs: z.number().int().positive().default(60_000),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.optional(),\n\t})\n\t.strict();\n\nexport type McpPortalProfileDefinition = z.infer<typeof mcpPortalProfileDefinitionSchema>;\n\nexport const resolvedMcpPortalProfileSchema = z\n\t.object({\n\t\tenabledNamespaces: z.array(z.string().min(1)),\n\t\tenabledToolsByNamespace: z.record(z.string().min(1), z.array(z.string().min(1))),\n\t\thiddenToolsByNamespace: z.record(z.string().min(1), z.array(z.string().min(1))),\n\t\tlogging: z.object({ enabled: z.boolean() }).strict(),\n\t\tpromptContext: z\n\t\t\t.object({\n\t\t\t\tenabled: z.boolean(),\n\t\t\t\tmaxNamespaces: z.number().int().positive(),\n\t\t\t})\n\t\t\t.strict(),\n\t\tcache: z.object({ catalogTtlMs: z.number().int().positive() }).strict(),\n\t\tapproval: portalApprovalConfigSchema,\n\t})\n\t.strict();\n\nexport type ResolvedMcpPortalProfile = z.infer<typeof resolvedMcpPortalProfileSchema>;\n\nexport const mcpPortalExternalAuthSchema = z\n\t.object({\n\t\tmasterKey: secretValueSchema,\n\t})\n\t.strict();\n\nexport type McpPortalExternalAuthConfig = z.infer<typeof mcpPortalExternalAuthSchema>;\n\nfunction isLoopbackProxyHost(host: string): boolean {\n\tconst normalizedHost = host.toLowerCase();\n\treturn (\n\t\tnormalizedHost === 'localhost' || normalizedHost === '127.0.0.1' || normalizedHost === '::1'\n\t);\n}\n\nexport const mcpPortalProxySchema = z\n\t.object({\n\t\tserver: z\n\t\t\t.object({\n\t\t\t\thost: z\n\t\t\t\t\t.string()\n\t\t\t\t\t.min(1)\n\t\t\t\t\t.refine(isLoopbackProxyHost, {\n\t\t\t\t\t\tmessage: 'mcpProxy.server.host must be loopback-only for HTTP bearer auth.',\n\t\t\t\t\t})\n\t\t\t\t\t.default('127.0.0.1'),\n\t\t\t\tport: z.number().int().min(1).max(65_535).default(18_791),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.default({ host: '127.0.0.1', port: 18_791 }),\n\t\tauth: z\n\t\t\t.object({\n\t\t\t\theaderName: z.string().min(1).default('authorization'),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.default({ headerName: 'authorization' }),\n\t})\n\t.strict();\n\nexport type McpPortalProxyConfig = z.infer<typeof mcpPortalProxySchema>;\n\nexport const mcpPortalAgentConfigSchema = z\n\t.object({\n\t\tcredentialVersion: z.number().int().positive().default(1),\n\t\tprofile: z.string().min(1),\n\t\thmacKey: secretValueSchema.optional(),\n\t})\n\t.strict();\n\nexport type McpPortalAgentConfig = z.infer<typeof mcpPortalAgentConfigSchema>;\n\nexport const mcpPortalConfigSchema = z\n\t.object({\n\t\t$schema: z.string().min(1).optional(),\n\t\tschemaVersion: z.literal(1),\n\t\texternalAuth: mcpPortalExternalAuthSchema.optional(),\n\t\tmcpProxy: mcpPortalProxySchema.optional(),\n\t\tagents: z.record(z.string().min(1), mcpPortalAgentConfigSchema).default({}),\n\t\tprofiles: z.record(z.string().min(1), mcpPortalProfileDefinitionSchema),\n\t})\n\t.strict()\n\t.superRefine((config, context) => {\n\t\tif (Object.keys(config.profiles).length === 0) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: 'mcp-portal.config.jsonc must define at least one profile.',\n\t\t\t\tpath: ['profiles'],\n\t\t\t});\n\t\t}\n\t});\n\ntype ParsedMcpPortalConfig = z.infer<typeof mcpPortalConfigSchema>;\nexport type McpPortalConfig = Omit<ParsedMcpPortalConfig, 'agents'> & {\n\treadonly agents: Readonly<Record<string, McpPortalAgentConfig>>;\n};\n\nexport const openClawMcpPortalPluginConfigSchema = z\n\t.object({\n\t\tconfigDir: z.string().min(1),\n\t\tbinPath: z.string().min(1).optional(),\n\t})\n\t.strict();\n\nexport type OpenClawMcpPortalPluginConfig = z.infer<typeof openClawMcpPortalPluginConfigSchema>;\n\nconst defaultProfile: ResolvedMcpPortalProfile = {\n\tapproval: portalApprovalConfigSchema.parse({}),\n\tcache: { catalogTtlMs: 60_000 },\n\tenabledNamespaces: [],\n\tenabledToolsByNamespace: {},\n\thiddenToolsByNamespace: {},\n\tlogging: { enabled: false },\n\tpromptContext: { enabled: true, maxNamespaces: 12 },\n};\n\ntype AuthoredPortalNamespaces = McpPortalProfileDefinition['namespaces'];\n\nexport async function loadMcpPortalConfig(configPath: string): Promise<McpPortalConfig> {\n\treturn mcpPortalConfigSchema.parse(await loadJsonConfigFile(configPath));\n}\n\nfunction namespaceToolRefs(\n\tnamespaces: Readonly<Record<string, PortalNamespacePolicy>>,\n\tselector: (policy: PortalNamespacePolicy) => readonly string[],\n): readonly NamespaceToolRef[] {\n\treturn Object.entries(namespaces).flatMap(([namespace, policy]) =>\n\t\tselector(policy).map((toolName) => ({ namespace, toolName })),\n\t);\n}\n\nfunction selectorAllowList(selector: PortalToolSelector): readonly string[] {\n\treturn selector.allow === '*' ? [] : selector.allow;\n}\n\nfunction selectorHasVisibleTools(selector: PortalToolSelector): boolean {\n\treturn selector.allow === '*' || selector.allow.length > 0;\n}\n\nfunction activeNamespaces(\n\tnamespaces: Readonly<Record<string, PortalNamespacePolicy>>,\n): Readonly<Record<string, PortalNamespacePolicy>> {\n\treturn Object.fromEntries(\n\t\tObject.entries(namespaces).filter(([, policy]) => selectorHasVisibleTools(policy.tools)),\n\t);\n}\n\nfunction compileNamespaceApproval(\n\tnamespaces: Readonly<Record<string, PortalNamespacePolicy>>,\n\tannotationPolicy: PortalApprovalConfig['annotationPolicy'],\n): PortalApprovalConfig {\n\treturn portalApprovalConfigSchema.parse({\n\t\tallowWithoutApprovalTools: namespaceToolRefs(namespaces, (policy) => [\n\t\t\t...selectorAllowList(policy.calls.withoutApproval),\n\t\t\t...(policy.approval?.allowWithoutApproval ?? []),\n\t\t]),\n\t\tannotationPolicy,\n\t\talwaysAskTools: namespaceToolRefs(namespaces, (policy) => [\n\t\t\t...selectorAllowList(policy.calls.requiresApproval),\n\t\t\t...(policy.approval?.alwaysAsk ?? []),\n\t\t]),\n\t\tcallPoliciesByNamespace: Object.fromEntries(\n\t\t\tObject.entries(namespaces).map(([namespace, policy]) => [namespace, policy.calls]),\n\t\t),\n\t\ttrustedAnnotationNamespaces: Object.entries(namespaces)\n\t\t\t.filter(([, policy]) => policy.approval?.trustedAnnotations)\n\t\t\t.map(([namespace]) => namespace),\n\t\twriteTools: namespaceToolRefs(namespaces, (policy) => policy.approval?.write ?? []),\n\t});\n}\n\nfunction compileEnabledToolsByNamespace(\n\tnamespaces: Readonly<Record<string, PortalNamespacePolicy>>,\n): Record<string, readonly string[]> {\n\treturn Object.fromEntries(\n\t\tObject.entries(namespaces)\n\t\t\t.filter(([, policy]) => policy.tools.allow !== '*')\n\t\t\t.map(([namespace, policy]) => [namespace, selectorAllowList(policy.tools)]),\n\t);\n}\n\nfunction compileHiddenToolsByNamespace(\n\tnamespaces: Readonly<Record<string, PortalNamespacePolicy>>,\n): Record<string, readonly string[]> {\n\treturn Object.fromEntries(\n\t\tObject.entries(namespaces)\n\t\t\t.filter(([, policy]) => (policy.tools.deny ?? []).length > 0)\n\t\t\t.map(([namespace, policy]) => [namespace, policy.tools.deny ?? []]),\n\t);\n}\n\nfunction compileProfileFromNamespaces(\n\tnamespaces: AuthoredPortalNamespaces,\n\tprofile: McpPortalProfileDefinition,\n): ResolvedMcpPortalProfile {\n\tconst annotationPolicy =\n\t\tprofile.approval?.annotationPolicy ?? defaultProfile.approval.annotationPolicy;\n\tconst activeNamespacePolicies = activeNamespaces(namespaces);\n\treturn resolvedMcpPortalProfileSchema.parse({\n\t\tapproval: compileNamespaceApproval(activeNamespacePolicies, annotationPolicy),\n\t\tcache: profile.cache ?? defaultProfile.cache,\n\t\tenabledNamespaces: Object.keys(activeNamespacePolicies),\n\t\tenabledToolsByNamespace: compileEnabledToolsByNamespace(activeNamespacePolicies),\n\t\thiddenToolsByNamespace: compileHiddenToolsByNamespace(activeNamespacePolicies),\n\t\tlogging: profile.logging ?? defaultProfile.logging,\n\t\tpromptContext: profile.promptContext ?? defaultProfile.promptContext,\n\t});\n}\n\nexport function resolveMcpPortalProfile(\n\tconfig: McpPortalConfig,\n\tprofileName: string,\n): ResolvedMcpPortalProfile {\n\tconst profile = config.profiles[profileName];\n\tif (profile === undefined) {\n\t\tthrow new Error(`unknown MCP profile '${profileName}'`);\n\t}\n\treturn compileProfileFromNamespaces(profile.namespaces, profile);\n}\n\nexport function secretValueToEnvironmentReference(secret: SecretValue): string {\n\tif (secret.source === 'environment') {\n\t\treturn `\\${${secret.name}}`;\n\t}\n\treturn secret.ref;\n}\n","import * as zod from 'zod';\n\nimport { mcpConfigSchema } from './mcp-config.js';\nimport { mcpPortalConfigSchema } from './mcp-portal-config.js';\n\nexport const mcpPortalConfigSchemaVersions = {\n\tmcp: 1,\n\tmcpPortal: 1,\n} as const;\n\nexport const mcpPortalConfigSchemaIds = {\n\tmcp: 'agent-vm:mcp:1',\n\tmcpPortal: 'agent-vm:mcp-portal:1',\n} as const;\n\nexport const mcpPortalConfigSchemaPaths = {\n\tmcpFromGatewayConfig: '../../schemas/mcp.schema.json',\n\tmcpPortalFromGatewayConfig: '../../schemas/mcp-portal.schema.json',\n} as const;\n\nexport interface ConfigContractSchemaArtifacts {\n\treadonly mcp: Record<string, unknown>;\n\treadonly mcpPortal: Record<string, unknown>;\n}\n\nfunction withSchemaId(schema: Record<string, unknown>, schemaId: string): Record<string, unknown> {\n\treturn {\n\t\t$id: schemaId,\n\t\t...schema,\n\t};\n}\n\nexport function createConfigContractSchemaArtifacts(): ConfigContractSchemaArtifacts {\n\treturn {\n\t\tmcp: withSchemaId(\n\t\t\tzod.toJSONSchema(mcpConfigSchema, { target: 'draft-07' }),\n\t\t\tmcpPortalConfigSchemaIds.mcp,\n\t\t),\n\t\tmcpPortal: withSchemaId(\n\t\t\tzod.toJSONSchema(mcpPortalConfigSchema, { target: 'draft-07' }),\n\t\t\tmcpPortalConfigSchemaIds.mcpPortal,\n\t\t),\n\t};\n}\n"],"mappings":";;;;;AAIA,MAAM,sBACL;AAED,SAAS,iBAAiB,MAAc,QAAwB;CAC/D,MAAM,SAAS,KAAK,MAAM,GAAG,OAAO;CAIpC,OAAO,QAHM,OAAO,MAAM,KAAK,CAAC,OAGZ,WADL,SADY,OAAO,YAAY,KACJ;;AAI3C,SAAS,iBAAiB,UAAkB,MAAc,OAA2B;CACpF,OAAO,CACN,oBAAoB,SAAS,IAAI,iBAAiB,MAAM,MAAM,OAAO,CAAC,IACtE,oBAAoB,MAAM,MAAM,CAChC,CAAC,KAAK,IAAI;;AAGZ,eAAsB,mBAAmB,UAAoC;CAC5E,MAAM,YAAY,MAAM,SAAS,UAAU,OAAO;CAClD,MAAM,cAA4B,EAAE;CACpC,MAAM,eAAe,oBAAoB,WAAW,aAAa;EAChE,oBAAoB;EACpB,kBAAkB;EAClB,CAAC;CAEF,IAAI,YAAY,SAAS,GAAG;EAC3B,MAAM,kBAAkB,YAAY;EACpC,IAAI,oBAAoB,KAAA,GACvB,MAAM,IAAI,MAAM,iBAAiB,UAAU,WAAW,gBAAgB,CAAC;;CAIzE,OAAO;;;;AC9BR,MAAa,kBAAwC,EAAE,WACtD,EAAE,MAAM;CACP,EAAE,QAAQ;CACV,EAAE,QAAQ,CAAC,QAAQ;CACnB,EAAE,SAAS;CACX,EAAE,MAAM;CACR,EAAE,MAAM,gBAAgB;CACxB;CACA,CAAC,CACF;AAED,MAAa,mBAA0C,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB;AAE5F,SAAgB,aAAa,OAAqC;CACjE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAgB,iBAAiB,OAAgB,OAA2B;CAC3E,IAAI,CAAC,aAAa,MAAM,EACvB,MAAM,IAAI,MAAM,GAAG,MAAM,yBAAyB;CAGnD,OAAO,iBAAiB,MAAM,MAAM;;;;AC3BrC,MAAa,qBAAqB,EAAE,mBAAmB,QAAQ,CAC9D,EACE,OAAO,EACP,MAAM,EAAE,QAAQ,SAAS,EACzB,CAAC,CACD,QAAQ,EACV,EACE,OAAO;CACP,MAAM,EAAE,QAAQ,SAAS;CACzB,QAAQ,EACN,QAAQ,CACR,IAAI,GAAG,0CAA0C,CACjD,IAAI,IAAI,uDAAuD,CAC/D,QACC,UAAU,CAAC,MAAM,KAAK,MAAM,EAC7B,gFACA;CACF,CAAC,CACD,QAAQ,CACV,CAAC;AAEF,MAAM,+BAA+B,EACnC,OAAO;CACP,QAAQ,EAAE,QAAQ,cAAc;CAChC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE;CACvB,CAAC,CACD,QAAQ;AAEV,MAAM,+BAA+B,EACnC,OAAO;CACP,QAAQ,EAAE,QAAQ,YAAY;CAC9B,KAAK,EAAE,QAAQ,CAAC,MAAM,aAAa,uCAAuC;CAC1E,CAAC,CACD,QAAQ;AAEV,MAAa,oBAAoB,EAAE,mBAAmB,UAAU,CAC/D,8BACA,6BACA,CAAC;AAEF,MAAa,6BAA6B,EAAE,mBAAmB,UAAU,CACxE,6BAA6B,OAAO,EACnC,QAAQ,mBAAmB,UAAU,EACrC,CAAC,EACF,6BAA6B,OAAO,EACnC,QAAQ,mBAAmB,UAAU,EACrC,CAAC,CACF,CAAC;AAMF,SAAgB,kBAAkB,QAA8B,UAA0B;CACzF,IAAI,OAAO,WAAW,KAAA,GACrB,OAAO;CAER,QAAQ,OAAO,OAAO,MAAtB;EACC,KAAK,UACJ,OAAO,UAAU;EAClB,KAAK,UACJ,OAAO,GAAG,OAAO,OAAO,OAAO,GAAG;EACnC,SAEC,OADgC,OAAO;;;;;AC5D1C,MAAM,6BAA6B,EACjC,OAAO,EACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU,EACrC,CAAC,CACD,QAAQ;AAEV,MAAM,2BAA2B,EAAE,KAAK,CAAC,QACvC,UAAU;CACV,MAAM,WAAW,IAAI,IAAI,MAAM,CAAC;CAChC,OAAO,aAAa,WAAW,aAAa;GAE7C,EAAE,SAAS,qDAAqD,CAChE;AAED,MAAM,gCAAgC,EACpC,OAAO;CACP,MAAM,EAAE,QAAQ,kBAAkB;CAClC,KAAK;CACL,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,2BAA2B,CAAC,QAAQ,EAAE,CAAC;CACrE,qBAAqB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC3D,CAAC,CACD,QAAQ;AAEV,MAAM,qBAAqB,EACzB,OAAO;CACP,MAAM,EAAE,QAAQ,MAAM;CACtB,KAAK;CACL,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,2BAA2B,CAAC,QAAQ,EAAE,CAAC;CACrE,qBAAqB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC3D,CAAC,CACD,QAAQ;AAEV,MAAM,uBAAuB,EAC3B,OAAO;CACP,MAAM,EAAE,QAAQ,QAAQ;CACxB,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;CACrC,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACjC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,2BAA2B,CAAC,QAAQ,EAAE,CAAC;CACjE,eAAe,EAAE,KAAK,CAAC,YAAY,OAAO,CAAC,CAAC,UAAU;CACtD,qBAAqB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC3D,CAAC,CACD,QAAQ;AAEV,MAAa,wBAAwB,EACnC,OAAO;CACP,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;CACtC,WAAW,EAAE,KAAK,CAAC,OAAO,iBAAiB,CAAC;CAC5C,CAAC,CACD,QAAQ,CACR,aAAa,QAAQ,YAAY;CACjC,IAAI,OAAO,cAAc,oBAAoB,OAAO,MAAM,WAAW,GACpE,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS;EACT,MAAM,CAAC,QAAQ;EACf,CAAC;CAEH,IAAI,OAAO,cAAc,SAAS,OAAO,MAAM,SAAS,GACvD,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS;EACT,MAAM,CAAC,QAAQ;EACf,CAAC;EAEF;AAEH,MAAa,oBAAoB,EAC/B,OAAO;CACP,MAAM,EAAE,QAAQ,MAAM;CACtB,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC5B,WAAW,2BAA2B,QAAQ,EAAE,CAAC;CACjD,gBAAgB,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,sBAAsB,CAAC,QAAQ,EAAE,CAAC;CAC9E,WAAW,EAAE,mBAAmB,QAAQ;EACvC;EACA;EACA;EACA,CAAC;CACF,CAAC,CACD,QAAQ;AAEV,MAAa,kBAAkB,EAC7B,OAAO;CACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACrC,eAAe,EAAE,QAAQ,EAAE;CAC3B,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC;CACrE,CAAC,CACD,QAAQ;AAqBV,eAAsB,cAAc,YAAwC;CAC3E,OAAO,gBAAgB,MAAM,MAAM,mBAAmB,WAAW,CAAC;;AAGnE,SAAgB,6BAA6B,QAAmD;CAC/F,OAAO,OAAO,OAAO,OAAO,UAAU,CAAC,KAAK,aAAa;EACxD,MAAM,YAAY,SAAS;EAC3B,IAAI,UAAU,SAAS,SAAS;GAC/B,MAAM,mBAOF;IACH,MAAM,UAAU;IAChB,SAAS,UAAU;IACnB,KAAK,UAAU;IACf,WAAW,SAAS;IACpB,WAAW,UAAU;IACrB;GACD,IAAI,UAAU,QAAQ,KAAA,GACrB,iBAAiB,MAAM,UAAU;GAElC,OAAO;;EAGR,OAAO;GACN,SAAS,UAAU;GACnB,WAAW,SAAS;GACpB,WAAW,UAAU;GACrB,KAAK,UAAU;GACf;GACA;;;;ACtIH,SAAS,gBACR,WACA,WACA,UACU;CACV,OAAO,UAAU,MACf,aAAa,SAAS,cAAc,aAAa,SAAS,aAAa,SACxE;;AAGF,SAAS,yBACR,SACA,cACA,WACA,UACU;CACV,MAAM,YAAY,QAAQ,SAAS,2BAA2B,EAAE,EAAE,aAAa;CAC/E,IAAI,aAAa,KAAA,GAChB,OAAO;CAER,KAAK,SAAS,QAAQ,EAAE,EAAE,SAAS,SAAS,EAC3C,OAAO;CAER,OAAO,SAAS,UAAU,OAAO,SAAS,MAAM,SAAS,SAAS;;AAGnE,SAAS,6BACR,SACA,MACU;CACV,OACC,QAAQ,SAAS,qBAAqB,mCACtC,QAAQ,SAAS,4BAA4B,SAAS,KAAK,UAAU,IACrE,KAAK,aAAa,iBAAiB,QACnC,KAAK,YAAY,oBAAoB;;AASvC,SAAgB,4BACf,SACA,MAC8B;CAC9B,IACC,gBAAgB,QAAQ,SAAS,2BAA2B,KAAK,WAAW,KAAK,SAAS,IAC1F,yBAAyB,SAAS,mBAAmB,KAAK,WAAW,KAAK,SAAS,IACnF,6BAA6B,SAAS,KAAK,EAE3C,OAAO,EAAE,MAAM,0BAA0B;CAE1C,IAAI,QAAQ,SAAS,qBAAqB,2BACzC,OAAO,EAAE,MAAM,qBAAqB;CAErC,IACC,gBAAgB,QAAQ,SAAS,gBAAgB,KAAK,WAAW,KAAK,SAAS,IAC/E,gBAAgB,QAAQ,SAAS,YAAY,KAAK,WAAW,KAAK,SAAS,IAC3E,yBAAyB,SAAS,oBAAoB,KAAK,WAAW,KAAK,SAAS,EAEpF,OAAO,EAAE,MAAM,qBAAqB;CAErC,OAAO,EAAE,MAAM,WAAW;;AAG3B,SAAgB,8BACf,SACA,MACU;CACV,OAAO,4BAA4B,SAAS,KAAK,CAAC,SAAS;;;;AC/E5D,MAAa,yBAAyB,EACpC,OAAO;CACP,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC5B,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC3B,CAAC,CACD,QAAQ;AAIV,MAAa,2BAA2B,EACtC,OAAO;CACP,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;CAC5D,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC5C,CAAC,CACD,QAAQ;AAIV,MAAa,6BAA6B,EACxC,OAAO;CACP,2BAA2B,EAAE,MAAM,uBAAuB,CAAC,QAAQ,EAAE,CAAC;CACtE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC,QAAQ,EAAE,CAAC;CAC3D,kBAAkB,EAChB,KAAK,CAAC,iCAAiC,0BAA0B,CAAC,CAClE,QAAQ,gCAAgC;CAC1C,yBAAyB,EACvB,OACA,EAAE,QAAQ,CAAC,IAAI,EAAE,EACjB,EACE,OAAO;EACP,kBAAkB;EAClB,iBAAiB;EACjB,CAAC,CACD,QAAQ,CACV,CACA,QAAQ,EAAE,CAAC;CACb,6BAA6B,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CACnE,YAAY,EAAE,MAAM,uBAAuB,CAAC,QAAQ,EAAE,CAAC;CACvD,CAAC,CACD,QAAQ;AAIV,MAAM,kCAAkC,EACtC,OAAO;CACP,kBAAkB;CAClB,iBAAiB;CACjB,CAAC,CACD,QAAQ;AAEV,MAAM,gCAAgC,EACpC,OAAO;CACP,sBAAsB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC5D,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CACjD,oBAAoB,EAAE,SAAS,CAAC,QAAQ,MAAM;CAC9C,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC7C,CAAC,CACD,QAAQ;AASV,MAAM,8BAA8B,EAClC,OAAO;CACP,UAAU,8BAA8B,QAAQ;EARjD,sBAAsB,EAAE;EACxB,WAAW,EAAE;EACb,oBAAoB;EACpB,OAAO,EAAE;EAKsE,CAAC,CAAC,UAAU;CAC1F,OAAO;CACP,OAAO;CACP,CAAC,CACD,QAAQ;AAIV,MAAa,mCAAmC,EAC9C,OAAO;CACP,UAAU,EACR,OAAO,EACP,kBAAkB,2BAA2B,MAAM,iBAAiB,UAAU,EAC9E,CAAC,CACD,QAAQ,CACR,UAAU;CACZ,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC;CAChF,SAAS,EACP,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,MAAM,EAAE,CAAC,CAC/C,QAAQ,CACR,UAAU;CACZ,eAAe,EACb,OAAO;EACP,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;EAClC,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,GAAG;EACtD,CAAC,CACD,QAAQ,CACR,UAAU;CACZ,OAAO,EACL,OAAO,EACP,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,IAAO,EACzD,CAAC,CACD,QAAQ,CACR,UAAU;CACZ,CAAC,CACD,QAAQ;AAIV,MAAa,iCAAiC,EAC5C,OAAO;CACP,mBAAmB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;CAC7C,yBAAyB,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;CAChF,wBAAwB,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;CAC/E,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ;CACpD,eAAe,EACb,OAAO;EACP,SAAS,EAAE,SAAS;EACpB,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;EAC1C,CAAC,CACD,QAAQ;CACV,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ;CACvE,UAAU;CACV,CAAC,CACD,QAAQ;AAIV,MAAa,8BAA8B,EACzC,OAAO,EACP,WAAW,mBACX,CAAC,CACD,QAAQ;AAIV,SAAS,oBAAoB,MAAuB;CACnD,MAAM,iBAAiB,KAAK,aAAa;CACzC,OACC,mBAAmB,eAAe,mBAAmB,eAAe,mBAAmB;;AAIzF,MAAa,uBAAuB,EAClC,OAAO;CACP,QAAQ,EACN,OAAO;EACP,MAAM,EACJ,QAAQ,CACR,IAAI,EAAE,CACN,OAAO,qBAAqB,EAC5B,SAAS,oEACT,CAAC,CACD,QAAQ,YAAY;EACtB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,MAAO,CAAC,QAAQ,MAAO;EACzD,CAAC,CACD,QAAQ,CACR,QAAQ;EAAE,MAAM;EAAa,MAAM;EAAQ,CAAC;CAC9C,MAAM,EACJ,OAAO,EACP,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,gBAAgB,EACtD,CAAC,CACD,QAAQ,CACR,QAAQ,EAAE,YAAY,iBAAiB,CAAC;CAC1C,CAAC,CACD,QAAQ;AAIV,MAAa,6BAA6B,EACxC,OAAO;CACP,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;CACzD,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,SAAS,kBAAkB,UAAU;CACrC,CAAC,CACD,QAAQ;AAIV,MAAa,wBAAwB,EACnC,OAAO;CACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACrC,eAAe,EAAE,QAAQ,EAAE;CAC3B,cAAc,4BAA4B,UAAU;CACpD,UAAU,qBAAqB,UAAU;CACzC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,2BAA2B,CAAC,QAAQ,EAAE,CAAC;CAC3E,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,iCAAiC;CACvE,CAAC,CACD,QAAQ,CACR,aAAa,QAAQ,YAAY;CACjC,IAAI,OAAO,KAAK,OAAO,SAAS,CAAC,WAAW,GAC3C,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS;EACT,MAAM,CAAC,WAAW;EAClB,CAAC;EAEF;AAOH,MAAa,sCAAsC,EACjD,OAAO;CACP,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC5B,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACrC,CAAC,CACD,QAAQ;AAIV,MAAM,iBAA2C;CAChD,UAAU,2BAA2B,MAAM,EAAE,CAAC;CAC9C,OAAO,EAAE,cAAc,KAAQ;CAC/B,mBAAmB,EAAE;CACrB,yBAAyB,EAAE;CAC3B,wBAAwB,EAAE;CAC1B,SAAS,EAAE,SAAS,OAAO;CAC3B,eAAe;EAAE,SAAS;EAAM,eAAe;EAAI;CACnD;AAID,eAAsB,oBAAoB,YAA8C;CACvF,OAAO,sBAAsB,MAAM,MAAM,mBAAmB,WAAW,CAAC;;AAGzE,SAAS,kBACR,YACA,UAC8B;CAC9B,OAAO,OAAO,QAAQ,WAAW,CAAC,SAAS,CAAC,WAAW,YACtD,SAAS,OAAO,CAAC,KAAK,cAAc;EAAE;EAAW;EAAU,EAAE,CAC7D;;AAGF,SAAS,kBAAkB,UAAiD;CAC3E,OAAO,SAAS,UAAU,MAAM,EAAE,GAAG,SAAS;;AAG/C,SAAS,wBAAwB,UAAuC;CACvE,OAAO,SAAS,UAAU,OAAO,SAAS,MAAM,SAAS;;AAG1D,SAAS,iBACR,YACkD;CAClD,OAAO,OAAO,YACb,OAAO,QAAQ,WAAW,CAAC,QAAQ,GAAG,YAAY,wBAAwB,OAAO,MAAM,CAAC,CACxF;;AAGF,SAAS,yBACR,YACA,kBACuB;CACvB,OAAO,2BAA2B,MAAM;EACvC,2BAA2B,kBAAkB,aAAa,WAAW,CACpE,GAAG,kBAAkB,OAAO,MAAM,gBAAgB,EAClD,GAAI,OAAO,UAAU,wBAAwB,EAAE,CAC/C,CAAC;EACF;EACA,gBAAgB,kBAAkB,aAAa,WAAW,CACzD,GAAG,kBAAkB,OAAO,MAAM,iBAAiB,EACnD,GAAI,OAAO,UAAU,aAAa,EAAE,CACpC,CAAC;EACF,yBAAyB,OAAO,YAC/B,OAAO,QAAQ,WAAW,CAAC,KAAK,CAAC,WAAW,YAAY,CAAC,WAAW,OAAO,MAAM,CAAC,CAClF;EACD,6BAA6B,OAAO,QAAQ,WAAW,CACrD,QAAQ,GAAG,YAAY,OAAO,UAAU,mBAAmB,CAC3D,KAAK,CAAC,eAAe,UAAU;EACjC,YAAY,kBAAkB,aAAa,WAAW,OAAO,UAAU,SAAS,EAAE,CAAC;EACnF,CAAC;;AAGH,SAAS,+BACR,YACoC;CACpC,OAAO,OAAO,YACb,OAAO,QAAQ,WAAW,CACxB,QAAQ,GAAG,YAAY,OAAO,MAAM,UAAU,IAAI,CAClD,KAAK,CAAC,WAAW,YAAY,CAAC,WAAW,kBAAkB,OAAO,MAAM,CAAC,CAAC,CAC5E;;AAGF,SAAS,8BACR,YACoC;CACpC,OAAO,OAAO,YACb,OAAO,QAAQ,WAAW,CACxB,QAAQ,GAAG,aAAa,OAAO,MAAM,QAAQ,EAAE,EAAE,SAAS,EAAE,CAC5D,KAAK,CAAC,WAAW,YAAY,CAAC,WAAW,OAAO,MAAM,QAAQ,EAAE,CAAC,CAAC,CACpE;;AAGF,SAAS,6BACR,YACA,SAC2B;CAC3B,MAAM,mBACL,QAAQ,UAAU,oBAAoB,eAAe,SAAS;CAC/D,MAAM,0BAA0B,iBAAiB,WAAW;CAC5D,OAAO,+BAA+B,MAAM;EAC3C,UAAU,yBAAyB,yBAAyB,iBAAiB;EAC7E,OAAO,QAAQ,SAAS,eAAe;EACvC,mBAAmB,OAAO,KAAK,wBAAwB;EACvD,yBAAyB,+BAA+B,wBAAwB;EAChF,wBAAwB,8BAA8B,wBAAwB;EAC9E,SAAS,QAAQ,WAAW,eAAe;EAC3C,eAAe,QAAQ,iBAAiB,eAAe;EACvD,CAAC;;AAGH,SAAgB,wBACf,QACA,aAC2B;CAC3B,MAAM,UAAU,OAAO,SAAS;CAChC,IAAI,YAAY,KAAA,GACf,MAAM,IAAI,MAAM,wBAAwB,YAAY,GAAG;CAExD,OAAO,6BAA6B,QAAQ,YAAY,QAAQ;;AAGjE,SAAgB,kCAAkC,QAA6B;CAC9E,IAAI,OAAO,WAAW,eACrB,OAAO,MAAM,OAAO,KAAK;CAE1B,OAAO,OAAO;;;;ACzUf,MAAa,gCAAgC;CAC5C,KAAK;CACL,WAAW;CACX;AAED,MAAa,2BAA2B;CACvC,KAAK;CACL,WAAW;CACX;AAED,MAAa,6BAA6B;CACzC,sBAAsB;CACtB,4BAA4B;CAC5B;AAOD,SAAS,aAAa,QAAiC,UAA2C;CACjG,OAAO;EACN,KAAK;EACL,GAAG;EACH;;AAGF,SAAgB,sCAAqE;CACpF,OAAO;EACN,KAAK,aACJ,IAAI,aAAa,iBAAiB,EAAE,QAAQ,YAAY,CAAC,EACzD,yBAAyB,IACzB;EACD,WAAW,aACV,IAAI,aAAa,uBAAuB,EAAE,QAAQ,YAAY,CAAC,EAC/D,yBAAyB,UACzB;EACD"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/json-config-file.ts","../src/json-value.ts","../src/secret-value.ts","../src/mcp-config.ts","../src/mcp-portal-approval-policy.ts","../src/mcp-portal-config.ts","../src/tool-portal-config.ts","../src/schema-artifacts.ts"],"sourcesContent":["import { readFile } from 'node:fs/promises';\n\nimport { parse, type ParseError, type ParseOptions, printParseErrorCode } from 'jsonc-parser';\n\nconst parseJsoncToUnknown: (text: string, errors: ParseError[], options: ParseOptions) => unknown =\n\tparse;\n\nfunction formatLineColumn(text: string, offset: number): string {\n\tconst prefix = text.slice(0, offset);\n\tconst line = prefix.split('\\n').length;\n\tconst lastLineBreakIndex = prefix.lastIndexOf('\\n');\n\tconst column = offset - lastLineBreakIndex;\n\treturn `line ${line}, column ${column}`;\n}\n\nfunction formatParseError(filePath: string, text: string, error: ParseError): string {\n\treturn [\n\t\t`Invalid JSONC in ${filePath}: ${formatLineColumn(text, error.offset)}:`,\n\t\tprintParseErrorCode(error.error),\n\t].join(' ');\n}\n\nexport async function loadJsonConfigFile(filePath: string): Promise<unknown> {\n\tconst rawConfig = await readFile(filePath, 'utf8');\n\tconst parseErrors: ParseError[] = [];\n\tconst parsedConfig = parseJsoncToUnknown(rawConfig, parseErrors, {\n\t\tallowTrailingComma: true,\n\t\tdisallowComments: false,\n\t});\n\n\tif (parseErrors.length > 0) {\n\t\tconst firstParseError = parseErrors[0];\n\t\tif (firstParseError !== undefined) {\n\t\t\tthrow new Error(formatParseError(filePath, rawConfig, firstParseError));\n\t\t}\n\t}\n\n\treturn parsedConfig;\n}\n","import { z } from 'zod';\n\nexport type JsonPrimitive = boolean | null | number | string;\nexport type JsonArray = JsonValue[];\nexport type JsonObject = { [key: string]: JsonValue };\nexport type JsonValue = JsonArray | JsonObject | JsonPrimitive;\n\nexport const jsonValueSchema: z.ZodType<JsonValue> = z.lazy(() =>\n\tz.union([\n\t\tz.string(),\n\t\tz.number().finite(),\n\t\tz.boolean(),\n\t\tz.null(),\n\t\tz.array(jsonValueSchema),\n\t\tjsonObjectSchema,\n\t]),\n);\n\nexport const jsonObjectSchema: z.ZodType<JsonObject> = z.record(z.string(), jsonValueSchema);\n\nexport function isJsonObject(value: unknown): value is JsonObject {\n\treturn typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nexport function assertJsonObject(value: unknown, label: string): JsonObject {\n\tif (!isJsonObject(value)) {\n\t\tthrow new Error(`${label} must be a JSON object.`);\n\t}\n\n\treturn jsonObjectSchema.parse(value);\n}\n","import { z } from 'zod';\n\nexport const secretFormatSchema = z.discriminatedUnion('kind', [\n\tz\n\t\t.object({\n\t\t\tkind: z.literal('bearer'),\n\t\t})\n\t\t.strict(),\n\tz\n\t\t.object({\n\t\t\tkind: z.literal('prefix'),\n\t\t\tprefix: z\n\t\t\t\t.string()\n\t\t\t\t.min(1, 'secret format prefix must not be empty.')\n\t\t\t\t.max(64, 'secret format prefix must be 64 characters or fewer.')\n\t\t\t\t.refine(\n\t\t\t\t\t(value) => !/\\s/u.test(value),\n\t\t\t\t\t'secret format prefix must not contain whitespace; agent-vm inserts one space.',\n\t\t\t\t),\n\t\t})\n\t\t.strict(),\n]);\n\nconst environmentSecretValueSchema = z\n\t.object({\n\t\tsource: z.literal('environment'),\n\t\tname: z.string().min(1),\n\t})\n\t.strict();\n\nconst onePasswordSecretValueSchema = z\n\t.object({\n\t\tsource: z.literal('1password'),\n\t\tref: z.string().regex(/^op:\\/\\//u, '1Password refs must start with op://'),\n\t})\n\t.strict();\n\nexport const secretValueSchema = z.discriminatedUnion('source', [\n\tenvironmentSecretValueSchema,\n\tonePasswordSecretValueSchema,\n]);\n\nexport const formattedSecretValueSchema = z.discriminatedUnion('source', [\n\tenvironmentSecretValueSchema.extend({\n\t\tformat: secretFormatSchema.optional(),\n\t}),\n\tonePasswordSecretValueSchema.extend({\n\t\tformat: secretFormatSchema.optional(),\n\t}),\n]);\n\nexport type SecretFormat = z.infer<typeof secretFormatSchema>;\nexport type SecretValue = z.infer<typeof secretValueSchema>;\nexport type FormattedSecretValue = z.infer<typeof formattedSecretValueSchema>;\n\nexport function formatSecretValue(secret: FormattedSecretValue, rawValue: string): string {\n\tif (secret.format === undefined) {\n\t\treturn rawValue;\n\t}\n\tswitch (secret.format.kind) {\n\t\tcase 'bearer':\n\t\t\treturn `Bearer ${rawValue}`;\n\t\tcase 'prefix':\n\t\t\treturn `${secret.format.prefix} ${rawValue}`;\n\t\tdefault: {\n\t\t\tconst exhaustiveFormat: never = secret.format;\n\t\t\treturn exhaustiveFormat;\n\t\t}\n\t}\n}\n","import { z } from 'zod';\n\nimport { loadJsonConfigFile } from './json-config-file.js';\nimport { formattedSecretValueSchema, type FormattedSecretValue } from './secret-value.js';\n\nconst mcpProviderDiscoverySchema = z\n\t.object({\n\t\tsummary: z.string().min(1).optional(),\n\t})\n\t.strict();\n\nconst remoteTransportUrlSchema = z.url().refine(\n\t(value) => {\n\t\tconst protocol = new URL(value).protocol;\n\t\treturn protocol === 'http:' || protocol === 'https:';\n\t},\n\t{ message: 'Remote MCP transport URLs must use http or https.' },\n);\n\nconst connectionTimeoutMsSchema = z.number().int().min(1).max(300_000);\n\nconst streamableHttpTransportSchema = z\n\t.object({\n\t\tkind: z.literal('streamable-http'),\n\t\turl: remoteTransportUrlSchema,\n\t\tconnectionTimeoutMs: connectionTimeoutMsSchema.optional(),\n\t\theaders: z.record(z.string(), formattedSecretValueSchema).default({}),\n\t\trequiredEgressHosts: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nconst sseTransportSchema = z\n\t.object({\n\t\tkind: z.literal('sse'),\n\t\turl: remoteTransportUrlSchema,\n\t\tconnectionTimeoutMs: connectionTimeoutMsSchema.optional(),\n\t\theaders: z.record(z.string(), formattedSecretValueSchema).default({}),\n\t\trequiredEgressHosts: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nconst stdioTransportSchema = z\n\t.object({\n\t\tkind: z.literal('stdio'),\n\t\tcommand: z.string().min(1),\n\t\targs: z.array(z.string()).default([]),\n\t\tconnectionTimeoutMs: connectionTimeoutMsSchema.optional(),\n\t\tcwd: z.string().min(1).optional(),\n\t\tenv: z.record(z.string(), formattedSecretValueSchema).default({}),\n\t\tnetworkAccess: z.enum(['declared', 'none']).optional(),\n\t\trequiredEgressHosts: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nexport const mcpSecretPolicySchema = z\n\t.object({\n\t\thosts: z.array(z.string()).default([]),\n\t\tinjection: z.enum(['env', 'http-mediation']),\n\t})\n\t.strict()\n\t.superRefine((policy, context) => {\n\t\tif (policy.injection === 'http-mediation' && policy.hosts.length === 0) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: 'http-mediation secret policies must declare at least one host.',\n\t\t\t\tpath: ['hosts'],\n\t\t\t});\n\t\t}\n\t\tif (policy.injection === 'env' && policy.hosts.length > 0) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: 'env secret policies must not declare hosts.',\n\t\t\t\tpath: ['hosts'],\n\t\t\t});\n\t\t}\n\t});\n\nexport const mcpProviderSchema = z\n\t.object({\n\t\tkind: z.literal('mcp'),\n\t\tnamespace: z.string().min(1),\n\t\tdiscovery: mcpProviderDiscoverySchema.default({}),\n\t\tsecretPolicies: z.record(z.string().min(1), mcpSecretPolicySchema).default({}),\n\t\ttransport: z.discriminatedUnion('kind', [\n\t\t\tstreamableHttpTransportSchema,\n\t\t\tsseTransportSchema,\n\t\t\tstdioTransportSchema,\n\t\t]),\n\t})\n\t.strict();\n\nexport const mcpConfigSchema = z\n\t.object({\n\t\t$schema: z.string().min(1).optional(),\n\t\tschemaVersion: z.literal(1),\n\t\tproviders: z.record(z.string().min(1), mcpProviderSchema).default({}),\n\t})\n\t.strict();\n\nexport type McpConfig = z.infer<typeof mcpConfigSchema>;\nexport type McpProvider = z.infer<typeof mcpProviderSchema>;\n\nexport type ResolvedMcpProvider =\n\t| {\n\t\t\treadonly connectionTimeoutMs?: number;\n\t\t\treadonly headers: Readonly<Record<string, FormattedSecretValue>>;\n\t\t\treadonly namespace: string;\n\t\t\treadonly transport: 'streamable-http' | 'sse';\n\t\t\treadonly url: string;\n\t  }\n\t| {\n\t\t\treadonly args: readonly string[];\n\t\t\treadonly command: string;\n\t\t\treadonly connectionTimeoutMs?: number;\n\t\t\treadonly cwd?: string;\n\t\t\treadonly env: Readonly<Record<string, FormattedSecretValue>>;\n\t\t\treadonly namespace: string;\n\t\t\treadonly transport: 'stdio';\n\t  };\n\nexport async function loadMcpConfig(configPath: string): Promise<McpConfig> {\n\treturn mcpConfigSchema.parse(await loadJsonConfigFile(configPath));\n}\n\nexport function mcpConfigToResolvedProviders(config: McpConfig): readonly ResolvedMcpProvider[] {\n\treturn Object.values(config.providers).map((provider) => {\n\t\tconst transport = provider.transport;\n\t\tif (transport.kind === 'stdio') {\n\t\t\tconst resolvedProvider: {\n\t\t\t\targs: readonly string[];\n\t\t\t\tcommand: string;\n\t\t\t\tconnectionTimeoutMs?: number;\n\t\t\t\tcwd?: string;\n\t\t\t\tenv: Readonly<Record<string, FormattedSecretValue>>;\n\t\t\t\tnamespace: string;\n\t\t\t\ttransport: 'stdio';\n\t\t\t} = {\n\t\t\t\targs: transport.args,\n\t\t\t\tcommand: transport.command,\n\t\t\t\tenv: transport.env,\n\t\t\t\tnamespace: provider.namespace,\n\t\t\t\ttransport: transport.kind,\n\t\t\t};\n\t\t\tif (transport.connectionTimeoutMs !== undefined) {\n\t\t\t\tresolvedProvider.connectionTimeoutMs = transport.connectionTimeoutMs;\n\t\t\t}\n\t\t\tif (transport.cwd !== undefined) {\n\t\t\t\tresolvedProvider.cwd = transport.cwd;\n\t\t\t}\n\t\t\treturn resolvedProvider;\n\t\t}\n\n\t\tconst resolvedProvider: {\n\t\t\tconnectionTimeoutMs?: number;\n\t\t\theaders: Readonly<Record<string, FormattedSecretValue>>;\n\t\t\tnamespace: string;\n\t\t\ttransport: 'streamable-http' | 'sse';\n\t\t\turl: string;\n\t\t} = {\n\t\t\theaders: transport.headers,\n\t\t\tnamespace: provider.namespace,\n\t\t\ttransport: transport.kind,\n\t\t\turl: transport.url,\n\t\t};\n\t\tif (transport.connectionTimeoutMs !== undefined) {\n\t\t\tresolvedProvider.connectionTimeoutMs = transport.connectionTimeoutMs;\n\t\t}\n\t\treturn resolvedProvider;\n\t});\n}\n","import type { NamespaceToolRef, ResolvedMcpPortalProfile } from './mcp-portal-config.js';\n\nexport interface McpPortalApprovalToolAnnotations {\n\treadonly destructiveHint?: boolean | undefined;\n\treadonly readOnlyHint?: boolean | undefined;\n}\n\nexport interface McpPortalApprovalToolCall {\n\treadonly annotations?: McpPortalApprovalToolAnnotations;\n\treadonly namespace: string;\n\treadonly toolName: string;\n}\n\nfunction selectorMatches(\n\tselectors: readonly NamespaceToolRef[],\n\tnamespace: string,\n\ttoolName: string,\n): boolean {\n\treturn selectors.some(\n\t\t(selector) => selector.namespace === namespace && selector.toolName === toolName,\n\t);\n}\n\nfunction namespaceSelectorMatches(\n\tprofile: ResolvedMcpPortalProfile,\n\tselectorKind: 'requiresApproval' | 'withoutApproval',\n\tnamespace: string,\n\ttoolName: string,\n): boolean {\n\tconst selector = (profile.approval.callPoliciesByNamespace ?? {})[namespace]?.[selectorKind];\n\tif (selector === undefined) {\n\t\treturn false;\n\t}\n\tif ((selector.deny ?? []).includes(toolName)) {\n\t\treturn false;\n\t}\n\treturn selector.allow === '*' || selector.allow.includes(toolName);\n}\n\nfunction hasTrustedReadOnlyAnnotation(\n\tprofile: ResolvedMcpPortalProfile,\n\tcall: McpPortalApprovalToolCall,\n): boolean {\n\treturn (\n\t\tprofile.approval.annotationPolicy === 'destructive-requires-approval' &&\n\t\tprofile.approval.trustedAnnotationNamespaces.includes(call.namespace) &&\n\t\tcall.annotations?.readOnlyHint === true &&\n\t\tcall.annotations.destructiveHint !== true\n\t);\n}\n\nexport type McpPortalCallPolicyDecision =\n\t| { readonly kind: 'allow_without_approval' }\n\t| { readonly kind: 'blocked' }\n\t| { readonly kind: 'requires_approval' };\n\nexport function mcpPortalCallPolicyDecision(\n\tprofile: ResolvedMcpPortalProfile,\n\tcall: McpPortalApprovalToolCall,\n): McpPortalCallPolicyDecision {\n\tif (\n\t\tselectorMatches(profile.approval.allowWithoutApprovalTools, call.namespace, call.toolName) ||\n\t\tnamespaceSelectorMatches(profile, 'withoutApproval', call.namespace, call.toolName) ||\n\t\thasTrustedReadOnlyAnnotation(profile, call)\n\t) {\n\t\treturn { kind: 'allow_without_approval' };\n\t}\n\tif (profile.approval.annotationPolicy === 'always-require-approval') {\n\t\treturn { kind: 'requires_approval' };\n\t}\n\tif (\n\t\tselectorMatches(profile.approval.alwaysAskTools, call.namespace, call.toolName) ||\n\t\tselectorMatches(profile.approval.writeTools, call.namespace, call.toolName) ||\n\t\tnamespaceSelectorMatches(profile, 'requiresApproval', call.namespace, call.toolName)\n\t) {\n\t\treturn { kind: 'requires_approval' };\n\t}\n\treturn { kind: 'blocked' };\n}\n\nexport function mcpPortalCallRequiresApproval(\n\tprofile: ResolvedMcpPortalProfile,\n\tcall: McpPortalApprovalToolCall,\n): boolean {\n\treturn mcpPortalCallPolicyDecision(profile, call).kind === 'requires_approval';\n}\n","import { z } from 'zod';\n\nimport { loadJsonConfigFile } from './json-config-file.js';\nimport { secretValueSchema, type SecretValue } from './secret-value.js';\n\nexport const namespaceToolRefSchema = z\n\t.object({\n\t\tnamespace: z.string().min(1),\n\t\ttoolName: z.string().min(1),\n\t})\n\t.strict();\n\nexport type NamespaceToolRef = z.infer<typeof namespaceToolRefSchema>;\n\nexport const portalToolSelectorSchema = z\n\t.object({\n\t\tallow: z.union([z.literal('*'), z.array(z.string().min(1))]),\n\t\tdeny: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nexport type PortalToolSelector = z.infer<typeof portalToolSelectorSchema>;\n\nexport const portalApprovalConfigSchema = z\n\t.object({\n\t\tallowWithoutApprovalTools: z.array(namespaceToolRefSchema).default([]),\n\t\talwaysAskTools: z.array(namespaceToolRefSchema).default([]),\n\t\tannotationPolicy: z\n\t\t\t.enum(['destructive-requires-approval', 'always-require-approval'])\n\t\t\t.default('destructive-requires-approval'),\n\t\tcallPoliciesByNamespace: z\n\t\t\t.record(\n\t\t\t\tz.string().min(1),\n\t\t\t\tz\n\t\t\t\t\t.object({\n\t\t\t\t\t\trequiresApproval: portalToolSelectorSchema,\n\t\t\t\t\t\twithoutApproval: portalToolSelectorSchema,\n\t\t\t\t\t})\n\t\t\t\t\t.strict(),\n\t\t\t)\n\t\t\t.default({}),\n\t\ttrustedAnnotationNamespaces: z.array(z.string().min(1)).default([]),\n\t\twriteTools: z.array(namespaceToolRefSchema).default([]),\n\t})\n\t.strict();\n\nexport type PortalApprovalConfig = z.infer<typeof portalApprovalConfigSchema>;\n\nconst portalNamespaceCallPolicySchema = z\n\t.object({\n\t\trequiresApproval: portalToolSelectorSchema,\n\t\twithoutApproval: portalToolSelectorSchema,\n\t})\n\t.strict();\n\nconst portalNamespaceApprovalSchema = z\n\t.object({\n\t\tallowWithoutApproval: z.array(z.string().min(1)).default([]),\n\t\talwaysAsk: z.array(z.string().min(1)).default([]),\n\t\ttrustedAnnotations: z.boolean().default(false),\n\t\twrite: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nconst defaultPortalNamespaceApproval = {\n\tallowWithoutApproval: [],\n\talwaysAsk: [],\n\ttrustedAnnotations: false,\n\twrite: [],\n} satisfies z.infer<typeof portalNamespaceApprovalSchema>;\n\nconst portalNamespacePolicySchema = z\n\t.object({\n\t\tapproval: portalNamespaceApprovalSchema.default(defaultPortalNamespaceApproval).optional(),\n\t\tcalls: portalNamespaceCallPolicySchema,\n\t\ttools: portalToolSelectorSchema,\n\t})\n\t.strict();\n\ntype PortalNamespacePolicy = z.infer<typeof portalNamespacePolicySchema>;\n\nexport const mcpPortalProfileDefinitionSchema = z\n\t.object({\n\t\tapproval: z\n\t\t\t.object({\n\t\t\t\tannotationPolicy: portalApprovalConfigSchema.shape.annotationPolicy.optional(),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.optional(),\n\t\tnamespaces: z.record(z.string().min(1), portalNamespacePolicySchema).default({}),\n\t\tlogging: z\n\t\t\t.object({ enabled: z.boolean().default(false) })\n\t\t\t.strict()\n\t\t\t.optional(),\n\t\tpromptContext: z\n\t\t\t.object({\n\t\t\t\tenabled: z.boolean().default(true),\n\t\t\t\tmaxNamespaces: z.number().int().positive().default(12),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.optional(),\n\t\tcache: z\n\t\t\t.object({\n\t\t\t\tcatalogTtlMs: z.number().int().positive().default(60_000),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.optional(),\n\t})\n\t.strict();\n\nexport type McpPortalProfileDefinition = z.infer<typeof mcpPortalProfileDefinitionSchema>;\n\nexport const resolvedMcpPortalProfileSchema = z\n\t.object({\n\t\tenabledNamespaces: z.array(z.string().min(1)),\n\t\tenabledToolsByNamespace: z.record(z.string().min(1), z.array(z.string().min(1))),\n\t\thiddenToolsByNamespace: z.record(z.string().min(1), z.array(z.string().min(1))),\n\t\tlogging: z.object({ enabled: z.boolean() }).strict(),\n\t\tpromptContext: z\n\t\t\t.object({\n\t\t\t\tenabled: z.boolean(),\n\t\t\t\tmaxNamespaces: z.number().int().positive(),\n\t\t\t})\n\t\t\t.strict(),\n\t\tcache: z.object({ catalogTtlMs: z.number().int().positive() }).strict(),\n\t\tapproval: portalApprovalConfigSchema,\n\t})\n\t.strict();\n\nexport type ResolvedMcpPortalProfile = z.infer<typeof resolvedMcpPortalProfileSchema>;\n\nexport const mcpPortalExternalAuthSchema = z\n\t.object({\n\t\tmasterKey: secretValueSchema,\n\t})\n\t.strict();\n\nexport type McpPortalExternalAuthConfig = z.infer<typeof mcpPortalExternalAuthSchema>;\n\nfunction isLoopbackProxyHost(host: string): boolean {\n\tconst normalizedHost = host.toLowerCase();\n\treturn (\n\t\tnormalizedHost === 'localhost' || normalizedHost === '127.0.0.1' || normalizedHost === '::1'\n\t);\n}\n\nexport const mcpPortalProxySchema = z\n\t.object({\n\t\tserver: z\n\t\t\t.object({\n\t\t\t\thost: z\n\t\t\t\t\t.string()\n\t\t\t\t\t.min(1)\n\t\t\t\t\t.refine(isLoopbackProxyHost, {\n\t\t\t\t\t\tmessage: 'mcpProxy.server.host must be loopback-only for HTTP bearer auth.',\n\t\t\t\t\t})\n\t\t\t\t\t.default('127.0.0.1'),\n\t\t\t\tport: z.number().int().min(1).max(65_535).default(18_791),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.default({ host: '127.0.0.1', port: 18_791 }),\n\t\tauth: z\n\t\t\t.object({\n\t\t\t\theaderName: z.string().min(1).default('authorization'),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.default({ headerName: 'authorization' }),\n\t})\n\t.strict();\n\nexport type McpPortalProxyConfig = z.infer<typeof mcpPortalProxySchema>;\n\nexport const mcpPortalAgentConfigSchema = z\n\t.object({\n\t\tcredentialVersion: z.number().int().positive().default(1),\n\t\tprofile: z.string().min(1),\n\t\thmacKey: secretValueSchema.optional(),\n\t})\n\t.strict();\n\nexport type McpPortalAgentConfig = z.infer<typeof mcpPortalAgentConfigSchema>;\n\nexport const mcpPortalConfigSchema = z\n\t.object({\n\t\t$schema: z.string().min(1).optional(),\n\t\tschemaVersion: z.literal(1),\n\t\texternalAuth: mcpPortalExternalAuthSchema.optional(),\n\t\tmcpProxy: mcpPortalProxySchema.optional(),\n\t\tagents: z.record(z.string().min(1), mcpPortalAgentConfigSchema).default({}),\n\t\tprofiles: z.record(z.string().min(1), mcpPortalProfileDefinitionSchema),\n\t})\n\t.strict()\n\t.superRefine((config, context) => {\n\t\tif (Object.keys(config.profiles).length === 0) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: 'mcp-portal.config.jsonc must define at least one profile.',\n\t\t\t\tpath: ['profiles'],\n\t\t\t});\n\t\t}\n\t});\n\ntype ParsedMcpPortalConfig = z.infer<typeof mcpPortalConfigSchema>;\nexport type McpPortalConfig = Omit<ParsedMcpPortalConfig, 'agents'> & {\n\treadonly agents: Readonly<Record<string, McpPortalAgentConfig>>;\n};\n\nexport const openClawMcpPortalPluginConfigSchema = z\n\t.object({\n\t\tconfigDir: z.string().min(1),\n\t\tbinPath: z.string().min(1).optional(),\n\t})\n\t.strict();\n\nexport type OpenClawMcpPortalPluginConfig = z.infer<typeof openClawMcpPortalPluginConfigSchema>;\n\nconst defaultProfile: ResolvedMcpPortalProfile = {\n\tapproval: portalApprovalConfigSchema.parse({}),\n\tcache: { catalogTtlMs: 60_000 },\n\tenabledNamespaces: [],\n\tenabledToolsByNamespace: {},\n\thiddenToolsByNamespace: {},\n\tlogging: { enabled: false },\n\tpromptContext: { enabled: true, maxNamespaces: 12 },\n};\n\ntype AuthoredPortalNamespaces = McpPortalProfileDefinition['namespaces'];\n\nexport async function loadMcpPortalConfig(configPath: string): Promise<McpPortalConfig> {\n\treturn mcpPortalConfigSchema.parse(await loadJsonConfigFile(configPath));\n}\n\nfunction namespaceToolRefs(\n\tnamespaces: Readonly<Record<string, PortalNamespacePolicy>>,\n\tselector: (policy: PortalNamespacePolicy) => readonly string[],\n): readonly NamespaceToolRef[] {\n\treturn Object.entries(namespaces).flatMap(([namespace, policy]) =>\n\t\tselector(policy).map((toolName) => ({ namespace, toolName })),\n\t);\n}\n\nfunction selectorAllowList(selector: PortalToolSelector): readonly string[] {\n\treturn selector.allow === '*' ? [] : selector.allow;\n}\n\nfunction selectorHasVisibleTools(selector: PortalToolSelector): boolean {\n\treturn selector.allow === '*' || selector.allow.length > 0;\n}\n\nfunction activeNamespaces(\n\tnamespaces: Readonly<Record<string, PortalNamespacePolicy>>,\n): Readonly<Record<string, PortalNamespacePolicy>> {\n\treturn Object.fromEntries(\n\t\tObject.entries(namespaces).filter(([, policy]) => selectorHasVisibleTools(policy.tools)),\n\t);\n}\n\nfunction compileNamespaceApproval(\n\tnamespaces: Readonly<Record<string, PortalNamespacePolicy>>,\n\tannotationPolicy: PortalApprovalConfig['annotationPolicy'],\n): PortalApprovalConfig {\n\treturn portalApprovalConfigSchema.parse({\n\t\tallowWithoutApprovalTools: namespaceToolRefs(namespaces, (policy) => [\n\t\t\t...selectorAllowList(policy.calls.withoutApproval),\n\t\t\t...(policy.approval?.allowWithoutApproval ?? []),\n\t\t]),\n\t\tannotationPolicy,\n\t\talwaysAskTools: namespaceToolRefs(namespaces, (policy) => [\n\t\t\t...selectorAllowList(policy.calls.requiresApproval),\n\t\t\t...(policy.approval?.alwaysAsk ?? []),\n\t\t]),\n\t\tcallPoliciesByNamespace: Object.fromEntries(\n\t\t\tObject.entries(namespaces).map(([namespace, policy]) => [namespace, policy.calls]),\n\t\t),\n\t\ttrustedAnnotationNamespaces: Object.entries(namespaces)\n\t\t\t.filter(([, policy]) => policy.approval?.trustedAnnotations)\n\t\t\t.map(([namespace]) => namespace),\n\t\twriteTools: namespaceToolRefs(namespaces, (policy) => policy.approval?.write ?? []),\n\t});\n}\n\nfunction compileEnabledToolsByNamespace(\n\tnamespaces: Readonly<Record<string, PortalNamespacePolicy>>,\n): Record<string, readonly string[]> {\n\treturn Object.fromEntries(\n\t\tObject.entries(namespaces)\n\t\t\t.filter(([, policy]) => policy.tools.allow !== '*')\n\t\t\t.map(([namespace, policy]) => [namespace, selectorAllowList(policy.tools)]),\n\t);\n}\n\nfunction compileHiddenToolsByNamespace(\n\tnamespaces: Readonly<Record<string, PortalNamespacePolicy>>,\n): Record<string, readonly string[]> {\n\treturn Object.fromEntries(\n\t\tObject.entries(namespaces)\n\t\t\t.filter(([, policy]) => (policy.tools.deny ?? []).length > 0)\n\t\t\t.map(([namespace, policy]) => [namespace, policy.tools.deny ?? []]),\n\t);\n}\n\nfunction compileProfileFromNamespaces(\n\tnamespaces: AuthoredPortalNamespaces,\n\tprofile: McpPortalProfileDefinition,\n): ResolvedMcpPortalProfile {\n\tconst annotationPolicy =\n\t\tprofile.approval?.annotationPolicy ?? defaultProfile.approval.annotationPolicy;\n\tconst activeNamespacePolicies = activeNamespaces(namespaces);\n\treturn resolvedMcpPortalProfileSchema.parse({\n\t\tapproval: compileNamespaceApproval(activeNamespacePolicies, annotationPolicy),\n\t\tcache: profile.cache ?? defaultProfile.cache,\n\t\tenabledNamespaces: Object.keys(activeNamespacePolicies),\n\t\tenabledToolsByNamespace: compileEnabledToolsByNamespace(activeNamespacePolicies),\n\t\thiddenToolsByNamespace: compileHiddenToolsByNamespace(activeNamespacePolicies),\n\t\tlogging: profile.logging ?? defaultProfile.logging,\n\t\tpromptContext: profile.promptContext ?? defaultProfile.promptContext,\n\t});\n}\n\nexport function resolveMcpPortalProfile(\n\tconfig: McpPortalConfig,\n\tprofileName: string,\n): ResolvedMcpPortalProfile {\n\tconst profile = config.profiles[profileName];\n\tif (profile === undefined) {\n\t\tthrow new Error(`unknown MCP profile '${profileName}'`);\n\t}\n\treturn compileProfileFromNamespaces(profile.namespaces, profile);\n}\n\nexport function secretValueToEnvironmentReference(secret: SecretValue): string {\n\tif (secret.source === 'environment') {\n\t\treturn `\\${${secret.name}}`;\n\t}\n\treturn secret.ref;\n}\n","import { z } from 'zod';\n\nimport { loadJsonConfigFile } from './json-config-file.js';\n\nexport const toolPortalToolSelectorSchema = z\n\t.object({\n\t\tallow: z.union([z.literal('*'), z.array(z.string().min(1))]),\n\t\tdeny: z.array(z.string().min(1)).default([]),\n\t})\n\t.strict();\n\nexport type ToolPortalToolSelector = z.infer<typeof toolPortalToolSelectorSchema>;\n\nexport const toolPortalCallPolicySchema = z\n\t.object({\n\t\trequiresApproval: toolPortalToolSelectorSchema,\n\t\twithoutApproval: toolPortalToolSelectorSchema,\n\t})\n\t.strict()\n\t.superRefine((policy, context) => {\n\t\tif (toolSelectorsOverlap(policy.requiresApproval, policy.withoutApproval)) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: 'Tool Portal call policy cannot list one tool in both approval selectors.',\n\t\t\t\tpath: ['withoutApproval'],\n\t\t\t});\n\t\t}\n\t});\n\nexport type ToolPortalCallPolicy = z.infer<typeof toolPortalCallPolicySchema>;\n\nexport const toolPortalBackendBindingSchema = z.discriminatedUnion('kind', [\n\tz.object({ kind: z.literal('mcp_provider') }).strict(),\n\tz.object({ kind: z.literal('controller_host_action') }).strict(),\n\tz.object({ kind: z.literal('tool_vm_runner') }).strict(),\n]);\n\nexport type ToolPortalBackendBinding = z.infer<typeof toolPortalBackendBindingSchema>;\n\nexport const toolPortalCapabilityPolicySchema = z\n\t.object({\n\t\tbackend: toolPortalBackendBindingSchema,\n\t\tcalls: toolPortalCallPolicySchema,\n\t\ttools: toolPortalToolSelectorSchema,\n\t})\n\t.strict();\n\nexport type ToolPortalCapabilityPolicy = z.infer<typeof toolPortalCapabilityPolicySchema>;\n\nexport const toolPortalProfileDefinitionSchema = z\n\t.object({\n\t\tcapabilities: z.record(z.string().min(1), toolPortalCapabilityPolicySchema).default({}),\n\t})\n\t.strict();\n\nexport type ToolPortalProfileDefinition = z.infer<typeof toolPortalProfileDefinitionSchema>;\n\nexport const toolPortalAgentConfigSchema = z\n\t.object({\n\t\tprofile: z.string().min(1),\n\t})\n\t.strict();\n\nexport type ToolPortalAgentConfig = z.infer<typeof toolPortalAgentConfigSchema>;\n\nexport const toolPortalConfigSchema = z\n\t.object({\n\t\t$schema: z.string().min(1).optional(),\n\t\tschemaVersion: z.literal(1),\n\t\tagents: z.record(z.string().min(1), toolPortalAgentConfigSchema).default({}),\n\t\tprofiles: z.record(z.string().min(1), toolPortalProfileDefinitionSchema),\n\t})\n\t.strict()\n\t.superRefine((config, context) => {\n\t\tif (Object.keys(config.profiles).length === 0) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: 'tool-portal.config.jsonc must define at least one profile.',\n\t\t\t\tpath: ['profiles'],\n\t\t\t});\n\t\t}\n\n\t\tfor (const [agentId, agentConfig] of Object.entries(config.agents)) {\n\t\t\tif (config.profiles[agentConfig.profile] === undefined) {\n\t\t\t\tcontext.addIssue({\n\t\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\t\tmessage: `Tool Portal agent \"${agentId}\" references missing profile \"${agentConfig.profile}\".`,\n\t\t\t\t\tpath: ['agents', agentId, 'profile'],\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t});\n\nexport type ToolPortalConfig = z.infer<typeof toolPortalConfigSchema>;\n\nexport async function loadToolPortalConfig(configPath: string): Promise<ToolPortalConfig> {\n\treturn toolPortalConfigSchema.parse(await loadJsonConfigFile(configPath));\n}\n\nexport const ToolPortalMcpProjectionNamespaceSchema = z\n\t.object({\n\t\tcalls: toolPortalCallPolicySchema,\n\t\ttools: toolPortalToolSelectorSchema,\n\t})\n\t.strict();\n\nexport type ToolPortalMcpProjectionNamespace = z.infer<\n\ttypeof ToolPortalMcpProjectionNamespaceSchema\n>;\n\nexport const ToolPortalMcpProjectionSchema = z\n\t.object({\n\t\tagentId: z.string().min(1),\n\t\tnamespaces: z.record(z.string().min(1), ToolPortalMcpProjectionNamespaceSchema),\n\t\tprofile: z.string().min(1),\n\t})\n\t.strict();\n\nexport type ToolPortalMcpProjection = z.infer<typeof ToolPortalMcpProjectionSchema>;\n\nexport const ToolPortalControllerHostActionProjectionNamespaceSchema =\n\tToolPortalMcpProjectionNamespaceSchema;\n\nexport type ToolPortalControllerHostActionProjectionNamespace = z.infer<\n\ttypeof ToolPortalControllerHostActionProjectionNamespaceSchema\n>;\n\nexport const ToolPortalControllerHostActionProjectionSchema = z\n\t.object({\n\t\tagentId: z.string().min(1),\n\t\tnamespaces: z.record(\n\t\t\tz.string().min(1),\n\t\t\tToolPortalControllerHostActionProjectionNamespaceSchema,\n\t\t),\n\t\tprofile: z.string().min(1),\n\t})\n\t.strict();\n\nexport type ToolPortalControllerHostActionProjection = z.infer<\n\ttypeof ToolPortalControllerHostActionProjectionSchema\n>;\n\nexport interface CreateToolPortalMcpProjectionProps {\n\treadonly agentId: string;\n\treadonly config: ToolPortalConfig;\n}\n\nexport function createToolPortalMcpProjection(\n\tprops: CreateToolPortalMcpProjectionProps,\n): ToolPortalMcpProjection {\n\tconst agentConfig = props.config.agents[props.agentId];\n\tif (agentConfig === undefined) {\n\t\tthrow new Error(`Tool Portal agent \"${props.agentId}\" is not configured.`);\n\t}\n\n\tconst profileConfig = props.config.profiles[agentConfig.profile];\n\tif (profileConfig === undefined) {\n\t\tthrow new Error(\n\t\t\t`Tool Portal agent \"${props.agentId}\" references missing profile \"${agentConfig.profile}\".`,\n\t\t);\n\t}\n\n\tconst namespaces = Object.fromEntries(\n\t\tObject.entries(profileConfig.capabilities)\n\t\t\t.filter(([, capabilityPolicy]) => capabilityPolicy.backend.kind === 'mcp_provider')\n\t\t\t.map(([namespace, capabilityPolicy]) => [\n\t\t\t\tnamespace,\n\t\t\t\t{\n\t\t\t\t\tcalls: capabilityPolicy.calls,\n\t\t\t\t\ttools: capabilityPolicy.tools,\n\t\t\t\t},\n\t\t\t]),\n\t);\n\n\treturn ToolPortalMcpProjectionSchema.parse({\n\t\tagentId: props.agentId,\n\t\tnamespaces,\n\t\tprofile: agentConfig.profile,\n\t});\n}\n\nexport interface CreateToolPortalControllerHostActionProjectionProps {\n\treadonly agentId: string;\n\treadonly config: ToolPortalConfig;\n}\n\nexport function createToolPortalControllerHostActionProjection(\n\tprops: CreateToolPortalControllerHostActionProjectionProps,\n): ToolPortalControllerHostActionProjection {\n\tconst agentConfig = props.config.agents[props.agentId];\n\tif (agentConfig === undefined) {\n\t\tthrow new Error(`Tool Portal agent \"${props.agentId}\" is not configured.`);\n\t}\n\n\tconst profileConfig = props.config.profiles[agentConfig.profile];\n\tif (profileConfig === undefined) {\n\t\tthrow new Error(\n\t\t\t`Tool Portal agent \"${props.agentId}\" references missing profile \"${agentConfig.profile}\".`,\n\t\t);\n\t}\n\n\tconst namespaces = Object.fromEntries(\n\t\tObject.entries(profileConfig.capabilities)\n\t\t\t.filter(([, capabilityPolicy]) => capabilityPolicy.backend.kind === 'controller_host_action')\n\t\t\t.map(([namespace, capabilityPolicy]) => [\n\t\t\t\tnamespace,\n\t\t\t\t{\n\t\t\t\t\tcalls: capabilityPolicy.calls,\n\t\t\t\t\ttools: capabilityPolicy.tools,\n\t\t\t\t},\n\t\t\t]),\n\t);\n\n\treturn ToolPortalControllerHostActionProjectionSchema.parse({\n\t\tagentId: props.agentId,\n\t\tnamespaces,\n\t\tprofile: agentConfig.profile,\n\t});\n}\n\nfunction toolSelectorsOverlap(\n\tleft: ToolPortalToolSelector,\n\tright: ToolPortalToolSelector,\n): boolean {\n\tconst leftAllow = left.allow;\n\tconst rightAllow = right.allow;\n\tif (leftAllow === '*' && rightAllow === '*') {\n\t\treturn true;\n\t}\n\tif (leftAllow === '*') {\n\t\tif (rightAllow === '*') {\n\t\t\treturn true;\n\t\t}\n\t\treturn rightAllow.some((toolName) => !left.deny.includes(toolName));\n\t}\n\tif (rightAllow === '*') {\n\t\treturn leftAllow.some((toolName) => !right.deny.includes(toolName));\n\t}\n\treturn leftAllow.some(\n\t\t(toolName) =>\n\t\t\trightAllow.includes(toolName) &&\n\t\t\t!left.deny.includes(toolName) &&\n\t\t\t!right.deny.includes(toolName),\n\t);\n}\n","import * as zod from 'zod';\n\nimport { mcpConfigSchema } from './mcp-config.js';\nimport { mcpPortalConfigSchema } from './mcp-portal-config.js';\nimport { toolPortalConfigSchema } from './tool-portal-config.js';\n\nexport const mcpPortalConfigSchemaVersions = {\n\tmcp: 1,\n\tmcpPortal: 1,\n\ttoolPortal: 1,\n} as const;\n\nexport const mcpPortalConfigSchemaIds = {\n\tmcp: 'agent-vm:mcp:1',\n\tmcpPortal: 'agent-vm:mcp-portal:1',\n\ttoolPortal: 'agent-vm:tool-portal:1',\n} as const;\n\nexport const mcpPortalConfigSchemaPaths = {\n\tmcpFromGatewayConfig: '../../schemas/mcp.schema.json',\n\tmcpPortalFromGatewayConfig: '../../schemas/mcp-portal.schema.json',\n\ttoolPortalFromGatewayConfig: '../../schemas/tool-portal.schema.json',\n} as const;\n\nexport interface ConfigContractSchemaArtifacts {\n\treadonly mcp: Record<string, unknown>;\n\treadonly mcpPortal: Record<string, unknown>;\n\treadonly toolPortal: Record<string, unknown>;\n}\n\nfunction withSchemaId(schema: Record<string, unknown>, schemaId: string): Record<string, unknown> {\n\treturn {\n\t\t$id: schemaId,\n\t\t...schema,\n\t};\n}\n\nexport function createConfigContractSchemaArtifacts(): ConfigContractSchemaArtifacts {\n\treturn {\n\t\tmcp: withSchemaId(\n\t\t\tzod.toJSONSchema(mcpConfigSchema, { target: 'draft-07' }),\n\t\t\tmcpPortalConfigSchemaIds.mcp,\n\t\t),\n\t\tmcpPortal: withSchemaId(\n\t\t\tzod.toJSONSchema(mcpPortalConfigSchema, { target: 'draft-07' }),\n\t\t\tmcpPortalConfigSchemaIds.mcpPortal,\n\t\t),\n\t\ttoolPortal: withSchemaId(\n\t\t\tzod.toJSONSchema(toolPortalConfigSchema, { target: 'draft-07' }),\n\t\t\tmcpPortalConfigSchemaIds.toolPortal,\n\t\t),\n\t};\n}\n"],"mappings":";;;;;AAIA,MAAM,sBACL;AAED,SAAS,iBAAiB,MAAc,QAAwB;CAC/D,MAAM,SAAS,KAAK,MAAM,GAAG,OAAO;CAIpC,OAAO,QAHM,OAAO,MAAM,KAAK,CAAC,OAGZ,WADL,SADY,OAAO,YAAY,KACJ;;AAI3C,SAAS,iBAAiB,UAAkB,MAAc,OAA2B;CACpF,OAAO,CACN,oBAAoB,SAAS,IAAI,iBAAiB,MAAM,MAAM,OAAO,CAAC,IACtE,oBAAoB,MAAM,MAAM,CAChC,CAAC,KAAK,IAAI;;AAGZ,eAAsB,mBAAmB,UAAoC;CAC5E,MAAM,YAAY,MAAM,SAAS,UAAU,OAAO;CAClD,MAAM,cAA4B,EAAE;CACpC,MAAM,eAAe,oBAAoB,WAAW,aAAa;EAChE,oBAAoB;EACpB,kBAAkB;EAClB,CAAC;CAEF,IAAI,YAAY,SAAS,GAAG;EAC3B,MAAM,kBAAkB,YAAY;EACpC,IAAI,oBAAoB,KAAA,GACvB,MAAM,IAAI,MAAM,iBAAiB,UAAU,WAAW,gBAAgB,CAAC;;CAIzE,OAAO;;;;AC9BR,MAAa,kBAAwC,EAAE,WACtD,EAAE,MAAM;CACP,EAAE,QAAQ;CACV,EAAE,QAAQ,CAAC,QAAQ;CACnB,EAAE,SAAS;CACX,EAAE,MAAM;CACR,EAAE,MAAM,gBAAgB;CACxB;CACA,CAAC,CACF;AAED,MAAa,mBAA0C,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB;AAE5F,SAAgB,aAAa,OAAqC;CACjE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAgB,iBAAiB,OAAgB,OAA2B;CAC3E,IAAI,CAAC,aAAa,MAAM,EACvB,MAAM,IAAI,MAAM,GAAG,MAAM,yBAAyB;CAGnD,OAAO,iBAAiB,MAAM,MAAM;;;;AC3BrC,MAAa,qBAAqB,EAAE,mBAAmB,QAAQ,CAC9D,EACE,OAAO,EACP,MAAM,EAAE,QAAQ,SAAS,EACzB,CAAC,CACD,QAAQ,EACV,EACE,OAAO;CACP,MAAM,EAAE,QAAQ,SAAS;CACzB,QAAQ,EACN,QAAQ,CACR,IAAI,GAAG,0CAA0C,CACjD,IAAI,IAAI,uDAAuD,CAC/D,QACC,UAAU,CAAC,MAAM,KAAK,MAAM,EAC7B,gFACA;CACF,CAAC,CACD,QAAQ,CACV,CAAC;AAEF,MAAM,+BAA+B,EACnC,OAAO;CACP,QAAQ,EAAE,QAAQ,cAAc;CAChC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE;CACvB,CAAC,CACD,QAAQ;AAEV,MAAM,+BAA+B,EACnC,OAAO;CACP,QAAQ,EAAE,QAAQ,YAAY;CAC9B,KAAK,EAAE,QAAQ,CAAC,MAAM,aAAa,uCAAuC;CAC1E,CAAC,CACD,QAAQ;AAEV,MAAa,oBAAoB,EAAE,mBAAmB,UAAU,CAC/D,8BACA,6BACA,CAAC;AAEF,MAAa,6BAA6B,EAAE,mBAAmB,UAAU,CACxE,6BAA6B,OAAO,EACnC,QAAQ,mBAAmB,UAAU,EACrC,CAAC,EACF,6BAA6B,OAAO,EACnC,QAAQ,mBAAmB,UAAU,EACrC,CAAC,CACF,CAAC;AAMF,SAAgB,kBAAkB,QAA8B,UAA0B;CACzF,IAAI,OAAO,WAAW,KAAA,GACrB,OAAO;CAER,QAAQ,OAAO,OAAO,MAAtB;EACC,KAAK,UACJ,OAAO,UAAU;EAClB,KAAK,UACJ,OAAO,GAAG,OAAO,OAAO,OAAO,GAAG;EACnC,SAEC,OADgC,OAAO;;;;;AC5D1C,MAAM,6BAA6B,EACjC,OAAO,EACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU,EACrC,CAAC,CACD,QAAQ;AAEV,MAAM,2BAA2B,EAAE,KAAK,CAAC,QACvC,UAAU;CACV,MAAM,WAAW,IAAI,IAAI,MAAM,CAAC;CAChC,OAAO,aAAa,WAAW,aAAa;GAE7C,EAAE,SAAS,qDAAqD,CAChE;AAED,MAAM,4BAA4B,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,IAAQ;AAEtE,MAAM,gCAAgC,EACpC,OAAO;CACP,MAAM,EAAE,QAAQ,kBAAkB;CAClC,KAAK;CACL,qBAAqB,0BAA0B,UAAU;CACzD,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,2BAA2B,CAAC,QAAQ,EAAE,CAAC;CACrE,qBAAqB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC3D,CAAC,CACD,QAAQ;AAEV,MAAM,qBAAqB,EACzB,OAAO;CACP,MAAM,EAAE,QAAQ,MAAM;CACtB,KAAK;CACL,qBAAqB,0BAA0B,UAAU;CACzD,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,2BAA2B,CAAC,QAAQ,EAAE,CAAC;CACrE,qBAAqB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC3D,CAAC,CACD,QAAQ;AAEV,MAAM,uBAAuB,EAC3B,OAAO;CACP,MAAM,EAAE,QAAQ,QAAQ;CACxB,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;CACrC,qBAAqB,0BAA0B,UAAU;CACzD,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACjC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,2BAA2B,CAAC,QAAQ,EAAE,CAAC;CACjE,eAAe,EAAE,KAAK,CAAC,YAAY,OAAO,CAAC,CAAC,UAAU;CACtD,qBAAqB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC3D,CAAC,CACD,QAAQ;AAEV,MAAa,wBAAwB,EACnC,OAAO;CACP,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;CACtC,WAAW,EAAE,KAAK,CAAC,OAAO,iBAAiB,CAAC;CAC5C,CAAC,CACD,QAAQ,CACR,aAAa,QAAQ,YAAY;CACjC,IAAI,OAAO,cAAc,oBAAoB,OAAO,MAAM,WAAW,GACpE,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS;EACT,MAAM,CAAC,QAAQ;EACf,CAAC;CAEH,IAAI,OAAO,cAAc,SAAS,OAAO,MAAM,SAAS,GACvD,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS;EACT,MAAM,CAAC,QAAQ;EACf,CAAC;EAEF;AAEH,MAAa,oBAAoB,EAC/B,OAAO;CACP,MAAM,EAAE,QAAQ,MAAM;CACtB,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC5B,WAAW,2BAA2B,QAAQ,EAAE,CAAC;CACjD,gBAAgB,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,sBAAsB,CAAC,QAAQ,EAAE,CAAC;CAC9E,WAAW,EAAE,mBAAmB,QAAQ;EACvC;EACA;EACA;EACA,CAAC;CACF,CAAC,CACD,QAAQ;AAEV,MAAa,kBAAkB,EAC7B,OAAO;CACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACrC,eAAe,EAAE,QAAQ,EAAE;CAC3B,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC;CACrE,CAAC,CACD,QAAQ;AAuBV,eAAsB,cAAc,YAAwC;CAC3E,OAAO,gBAAgB,MAAM,MAAM,mBAAmB,WAAW,CAAC;;AAGnE,SAAgB,6BAA6B,QAAmD;CAC/F,OAAO,OAAO,OAAO,OAAO,UAAU,CAAC,KAAK,aAAa;EACxD,MAAM,YAAY,SAAS;EAC3B,IAAI,UAAU,SAAS,SAAS;GAC/B,MAAM,mBAQF;IACH,MAAM,UAAU;IAChB,SAAS,UAAU;IACnB,KAAK,UAAU;IACf,WAAW,SAAS;IACpB,WAAW,UAAU;IACrB;GACD,IAAI,UAAU,wBAAwB,KAAA,GACrC,iBAAiB,sBAAsB,UAAU;GAElD,IAAI,UAAU,QAAQ,KAAA,GACrB,iBAAiB,MAAM,UAAU;GAElC,OAAO;;EAGR,MAAM,mBAMF;GACH,SAAS,UAAU;GACnB,WAAW,SAAS;GACpB,WAAW,UAAU;GACrB,KAAK,UAAU;GACf;EACD,IAAI,UAAU,wBAAwB,KAAA,GACrC,iBAAiB,sBAAsB,UAAU;EAElD,OAAO;GACN;;;;AC3JH,SAAS,gBACR,WACA,WACA,UACU;CACV,OAAO,UAAU,MACf,aAAa,SAAS,cAAc,aAAa,SAAS,aAAa,SACxE;;AAGF,SAAS,yBACR,SACA,cACA,WACA,UACU;CACV,MAAM,YAAY,QAAQ,SAAS,2BAA2B,EAAE,EAAE,aAAa;CAC/E,IAAI,aAAa,KAAA,GAChB,OAAO;CAER,KAAK,SAAS,QAAQ,EAAE,EAAE,SAAS,SAAS,EAC3C,OAAO;CAER,OAAO,SAAS,UAAU,OAAO,SAAS,MAAM,SAAS,SAAS;;AAGnE,SAAS,6BACR,SACA,MACU;CACV,OACC,QAAQ,SAAS,qBAAqB,mCACtC,QAAQ,SAAS,4BAA4B,SAAS,KAAK,UAAU,IACrE,KAAK,aAAa,iBAAiB,QACnC,KAAK,YAAY,oBAAoB;;AASvC,SAAgB,4BACf,SACA,MAC8B;CAC9B,IACC,gBAAgB,QAAQ,SAAS,2BAA2B,KAAK,WAAW,KAAK,SAAS,IAC1F,yBAAyB,SAAS,mBAAmB,KAAK,WAAW,KAAK,SAAS,IACnF,6BAA6B,SAAS,KAAK,EAE3C,OAAO,EAAE,MAAM,0BAA0B;CAE1C,IAAI,QAAQ,SAAS,qBAAqB,2BACzC,OAAO,EAAE,MAAM,qBAAqB;CAErC,IACC,gBAAgB,QAAQ,SAAS,gBAAgB,KAAK,WAAW,KAAK,SAAS,IAC/E,gBAAgB,QAAQ,SAAS,YAAY,KAAK,WAAW,KAAK,SAAS,IAC3E,yBAAyB,SAAS,oBAAoB,KAAK,WAAW,KAAK,SAAS,EAEpF,OAAO,EAAE,MAAM,qBAAqB;CAErC,OAAO,EAAE,MAAM,WAAW;;AAG3B,SAAgB,8BACf,SACA,MACU;CACV,OAAO,4BAA4B,SAAS,KAAK,CAAC,SAAS;;;;AC/E5D,MAAa,yBAAyB,EACpC,OAAO;CACP,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC5B,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC3B,CAAC,CACD,QAAQ;AAIV,MAAa,2BAA2B,EACtC,OAAO;CACP,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;CAC5D,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC5C,CAAC,CACD,QAAQ;AAIV,MAAa,6BAA6B,EACxC,OAAO;CACP,2BAA2B,EAAE,MAAM,uBAAuB,CAAC,QAAQ,EAAE,CAAC;CACtE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC,QAAQ,EAAE,CAAC;CAC3D,kBAAkB,EAChB,KAAK,CAAC,iCAAiC,0BAA0B,CAAC,CAClE,QAAQ,gCAAgC;CAC1C,yBAAyB,EACvB,OACA,EAAE,QAAQ,CAAC,IAAI,EAAE,EACjB,EACE,OAAO;EACP,kBAAkB;EAClB,iBAAiB;EACjB,CAAC,CACD,QAAQ,CACV,CACA,QAAQ,EAAE,CAAC;CACb,6BAA6B,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CACnE,YAAY,EAAE,MAAM,uBAAuB,CAAC,QAAQ,EAAE,CAAC;CACvD,CAAC,CACD,QAAQ;AAIV,MAAM,kCAAkC,EACtC,OAAO;CACP,kBAAkB;CAClB,iBAAiB;CACjB,CAAC,CACD,QAAQ;AAEV,MAAM,gCAAgC,EACpC,OAAO;CACP,sBAAsB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC5D,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CACjD,oBAAoB,EAAE,SAAS,CAAC,QAAQ,MAAM;CAC9C,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC7C,CAAC,CACD,QAAQ;AASV,MAAM,8BAA8B,EAClC,OAAO;CACP,UAAU,8BAA8B,QAAQ;EARjD,sBAAsB,EAAE;EACxB,WAAW,EAAE;EACb,oBAAoB;EACpB,OAAO,EAAE;EAKsE,CAAC,CAAC,UAAU;CAC1F,OAAO;CACP,OAAO;CACP,CAAC,CACD,QAAQ;AAIV,MAAa,mCAAmC,EAC9C,OAAO;CACP,UAAU,EACR,OAAO,EACP,kBAAkB,2BAA2B,MAAM,iBAAiB,UAAU,EAC9E,CAAC,CACD,QAAQ,CACR,UAAU;CACZ,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC;CAChF,SAAS,EACP,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,MAAM,EAAE,CAAC,CAC/C,QAAQ,CACR,UAAU;CACZ,eAAe,EACb,OAAO;EACP,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;EAClC,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,GAAG;EACtD,CAAC,CACD,QAAQ,CACR,UAAU;CACZ,OAAO,EACL,OAAO,EACP,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,IAAO,EACzD,CAAC,CACD,QAAQ,CACR,UAAU;CACZ,CAAC,CACD,QAAQ;AAIV,MAAa,iCAAiC,EAC5C,OAAO;CACP,mBAAmB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;CAC7C,yBAAyB,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;CAChF,wBAAwB,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;CAC/E,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ;CACpD,eAAe,EACb,OAAO;EACP,SAAS,EAAE,SAAS;EACpB,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;EAC1C,CAAC,CACD,QAAQ;CACV,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ;CACvE,UAAU;CACV,CAAC,CACD,QAAQ;AAIV,MAAa,8BAA8B,EACzC,OAAO,EACP,WAAW,mBACX,CAAC,CACD,QAAQ;AAIV,SAAS,oBAAoB,MAAuB;CACnD,MAAM,iBAAiB,KAAK,aAAa;CACzC,OACC,mBAAmB,eAAe,mBAAmB,eAAe,mBAAmB;;AAIzF,MAAa,uBAAuB,EAClC,OAAO;CACP,QAAQ,EACN,OAAO;EACP,MAAM,EACJ,QAAQ,CACR,IAAI,EAAE,CACN,OAAO,qBAAqB,EAC5B,SAAS,oEACT,CAAC,CACD,QAAQ,YAAY;EACtB,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,MAAO,CAAC,QAAQ,MAAO;EACzD,CAAC,CACD,QAAQ,CACR,QAAQ;EAAE,MAAM;EAAa,MAAM;EAAQ,CAAC;CAC9C,MAAM,EACJ,OAAO,EACP,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,gBAAgB,EACtD,CAAC,CACD,QAAQ,CACR,QAAQ,EAAE,YAAY,iBAAiB,CAAC;CAC1C,CAAC,CACD,QAAQ;AAIV,MAAa,6BAA6B,EACxC,OAAO;CACP,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;CACzD,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,SAAS,kBAAkB,UAAU;CACrC,CAAC,CACD,QAAQ;AAIV,MAAa,wBAAwB,EACnC,OAAO;CACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACrC,eAAe,EAAE,QAAQ,EAAE;CAC3B,cAAc,4BAA4B,UAAU;CACpD,UAAU,qBAAqB,UAAU;CACzC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,2BAA2B,CAAC,QAAQ,EAAE,CAAC;CAC3E,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,iCAAiC;CACvE,CAAC,CACD,QAAQ,CACR,aAAa,QAAQ,YAAY;CACjC,IAAI,OAAO,KAAK,OAAO,SAAS,CAAC,WAAW,GAC3C,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS;EACT,MAAM,CAAC,WAAW;EAClB,CAAC;EAEF;AAOH,MAAa,sCAAsC,EACjD,OAAO;CACP,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC5B,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACrC,CAAC,CACD,QAAQ;AAIV,MAAM,iBAA2C;CAChD,UAAU,2BAA2B,MAAM,EAAE,CAAC;CAC9C,OAAO,EAAE,cAAc,KAAQ;CAC/B,mBAAmB,EAAE;CACrB,yBAAyB,EAAE;CAC3B,wBAAwB,EAAE;CAC1B,SAAS,EAAE,SAAS,OAAO;CAC3B,eAAe;EAAE,SAAS;EAAM,eAAe;EAAI;CACnD;AAID,eAAsB,oBAAoB,YAA8C;CACvF,OAAO,sBAAsB,MAAM,MAAM,mBAAmB,WAAW,CAAC;;AAGzE,SAAS,kBACR,YACA,UAC8B;CAC9B,OAAO,OAAO,QAAQ,WAAW,CAAC,SAAS,CAAC,WAAW,YACtD,SAAS,OAAO,CAAC,KAAK,cAAc;EAAE;EAAW;EAAU,EAAE,CAC7D;;AAGF,SAAS,kBAAkB,UAAiD;CAC3E,OAAO,SAAS,UAAU,MAAM,EAAE,GAAG,SAAS;;AAG/C,SAAS,wBAAwB,UAAuC;CACvE,OAAO,SAAS,UAAU,OAAO,SAAS,MAAM,SAAS;;AAG1D,SAAS,iBACR,YACkD;CAClD,OAAO,OAAO,YACb,OAAO,QAAQ,WAAW,CAAC,QAAQ,GAAG,YAAY,wBAAwB,OAAO,MAAM,CAAC,CACxF;;AAGF,SAAS,yBACR,YACA,kBACuB;CACvB,OAAO,2BAA2B,MAAM;EACvC,2BAA2B,kBAAkB,aAAa,WAAW,CACpE,GAAG,kBAAkB,OAAO,MAAM,gBAAgB,EAClD,GAAI,OAAO,UAAU,wBAAwB,EAAE,CAC/C,CAAC;EACF;EACA,gBAAgB,kBAAkB,aAAa,WAAW,CACzD,GAAG,kBAAkB,OAAO,MAAM,iBAAiB,EACnD,GAAI,OAAO,UAAU,aAAa,EAAE,CACpC,CAAC;EACF,yBAAyB,OAAO,YAC/B,OAAO,QAAQ,WAAW,CAAC,KAAK,CAAC,WAAW,YAAY,CAAC,WAAW,OAAO,MAAM,CAAC,CAClF;EACD,6BAA6B,OAAO,QAAQ,WAAW,CACrD,QAAQ,GAAG,YAAY,OAAO,UAAU,mBAAmB,CAC3D,KAAK,CAAC,eAAe,UAAU;EACjC,YAAY,kBAAkB,aAAa,WAAW,OAAO,UAAU,SAAS,EAAE,CAAC;EACnF,CAAC;;AAGH,SAAS,+BACR,YACoC;CACpC,OAAO,OAAO,YACb,OAAO,QAAQ,WAAW,CACxB,QAAQ,GAAG,YAAY,OAAO,MAAM,UAAU,IAAI,CAClD,KAAK,CAAC,WAAW,YAAY,CAAC,WAAW,kBAAkB,OAAO,MAAM,CAAC,CAAC,CAC5E;;AAGF,SAAS,8BACR,YACoC;CACpC,OAAO,OAAO,YACb,OAAO,QAAQ,WAAW,CACxB,QAAQ,GAAG,aAAa,OAAO,MAAM,QAAQ,EAAE,EAAE,SAAS,EAAE,CAC5D,KAAK,CAAC,WAAW,YAAY,CAAC,WAAW,OAAO,MAAM,QAAQ,EAAE,CAAC,CAAC,CACpE;;AAGF,SAAS,6BACR,YACA,SAC2B;CAC3B,MAAM,mBACL,QAAQ,UAAU,oBAAoB,eAAe,SAAS;CAC/D,MAAM,0BAA0B,iBAAiB,WAAW;CAC5D,OAAO,+BAA+B,MAAM;EAC3C,UAAU,yBAAyB,yBAAyB,iBAAiB;EAC7E,OAAO,QAAQ,SAAS,eAAe;EACvC,mBAAmB,OAAO,KAAK,wBAAwB;EACvD,yBAAyB,+BAA+B,wBAAwB;EAChF,wBAAwB,8BAA8B,wBAAwB;EAC9E,SAAS,QAAQ,WAAW,eAAe;EAC3C,eAAe,QAAQ,iBAAiB,eAAe;EACvD,CAAC;;AAGH,SAAgB,wBACf,QACA,aAC2B;CAC3B,MAAM,UAAU,OAAO,SAAS;CAChC,IAAI,YAAY,KAAA,GACf,MAAM,IAAI,MAAM,wBAAwB,YAAY,GAAG;CAExD,OAAO,6BAA6B,QAAQ,YAAY,QAAQ;;AAGjE,SAAgB,kCAAkC,QAA6B;CAC9E,IAAI,OAAO,WAAW,eACrB,OAAO,MAAM,OAAO,KAAK;CAE1B,OAAO,OAAO;;;;AC1Uf,MAAa,+BAA+B,EAC1C,OAAO;CACP,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;CAC5D,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CAC5C,CAAC,CACD,QAAQ;AAIV,MAAa,6BAA6B,EACxC,OAAO;CACP,kBAAkB;CAClB,iBAAiB;CACjB,CAAC,CACD,QAAQ,CACR,aAAa,QAAQ,YAAY;CACjC,IAAI,qBAAqB,OAAO,kBAAkB,OAAO,gBAAgB,EACxE,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS;EACT,MAAM,CAAC,kBAAkB;EACzB,CAAC;EAEF;AAIH,MAAa,iCAAiC,EAAE,mBAAmB,QAAQ;CAC1E,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,eAAe,EAAE,CAAC,CAAC,QAAQ;CACtD,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,yBAAyB,EAAE,CAAC,CAAC,QAAQ;CAChE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,iBAAiB,EAAE,CAAC,CAAC,QAAQ;CACxD,CAAC;AAIF,MAAa,mCAAmC,EAC9C,OAAO;CACP,SAAS;CACT,OAAO;CACP,OAAO;CACP,CAAC,CACD,QAAQ;AAIV,MAAa,oCAAoC,EAC/C,OAAO,EACP,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,iCAAiC,CAAC,QAAQ,EAAE,CAAC,EACvF,CAAC,CACD,QAAQ;AAIV,MAAa,8BAA8B,EACzC,OAAO,EACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,EAC1B,CAAC,CACD,QAAQ;AAIV,MAAa,yBAAyB,EACpC,OAAO;CACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACrC,eAAe,EAAE,QAAQ,EAAE;CAC3B,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,4BAA4B,CAAC,QAAQ,EAAE,CAAC;CAC5E,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,kCAAkC;CACxE,CAAC,CACD,QAAQ,CACR,aAAa,QAAQ,YAAY;CACjC,IAAI,OAAO,KAAK,OAAO,SAAS,CAAC,WAAW,GAC3C,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS;EACT,MAAM,CAAC,WAAW;EAClB,CAAC;CAGH,KAAK,MAAM,CAAC,SAAS,gBAAgB,OAAO,QAAQ,OAAO,OAAO,EACjE,IAAI,OAAO,SAAS,YAAY,aAAa,KAAA,GAC5C,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS,sBAAsB,QAAQ,gCAAgC,YAAY,QAAQ;EAC3F,MAAM;GAAC;GAAU;GAAS;GAAU;EACpC,CAAC;EAGH;AAIH,eAAsB,qBAAqB,YAA+C;CACzF,OAAO,uBAAuB,MAAM,MAAM,mBAAmB,WAAW,CAAC;;AAG1E,MAAa,yCAAyC,EACpD,OAAO;CACP,OAAO;CACP,OAAO;CACP,CAAC,CACD,QAAQ;AAMV,MAAa,gCAAgC,EAC3C,OAAO;CACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,uCAAuC;CAC/E,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,CAAC,CACD,QAAQ;AAIV,MAAa,0DACZ;AAMD,MAAa,iDAAiD,EAC5D,OAAO;CACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,YAAY,EAAE,OACb,EAAE,QAAQ,CAAC,IAAI,EAAE,EACjB,wDACA;CACD,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,CAAC,CACD,QAAQ;AAWV,SAAgB,8BACf,OAC0B;CAC1B,MAAM,cAAc,MAAM,OAAO,OAAO,MAAM;CAC9C,IAAI,gBAAgB,KAAA,GACnB,MAAM,IAAI,MAAM,sBAAsB,MAAM,QAAQ,sBAAsB;CAG3E,MAAM,gBAAgB,MAAM,OAAO,SAAS,YAAY;CACxD,IAAI,kBAAkB,KAAA,GACrB,MAAM,IAAI,MACT,sBAAsB,MAAM,QAAQ,gCAAgC,YAAY,QAAQ,IACxF;CAGF,MAAM,aAAa,OAAO,YACzB,OAAO,QAAQ,cAAc,aAAa,CACxC,QAAQ,GAAG,sBAAsB,iBAAiB,QAAQ,SAAS,eAAe,CAClF,KAAK,CAAC,WAAW,sBAAsB,CACvC,WACA;EACC,OAAO,iBAAiB;EACxB,OAAO,iBAAiB;EACxB,CACD,CAAC,CACH;CAED,OAAO,8BAA8B,MAAM;EAC1C,SAAS,MAAM;EACf;EACA,SAAS,YAAY;EACrB,CAAC;;AAQH,SAAgB,+CACf,OAC2C;CAC3C,MAAM,cAAc,MAAM,OAAO,OAAO,MAAM;CAC9C,IAAI,gBAAgB,KAAA,GACnB,MAAM,IAAI,MAAM,sBAAsB,MAAM,QAAQ,sBAAsB;CAG3E,MAAM,gBAAgB,MAAM,OAAO,SAAS,YAAY;CACxD,IAAI,kBAAkB,KAAA,GACrB,MAAM,IAAI,MACT,sBAAsB,MAAM,QAAQ,gCAAgC,YAAY,QAAQ,IACxF;CAGF,MAAM,aAAa,OAAO,YACzB,OAAO,QAAQ,cAAc,aAAa,CACxC,QAAQ,GAAG,sBAAsB,iBAAiB,QAAQ,SAAS,yBAAyB,CAC5F,KAAK,CAAC,WAAW,sBAAsB,CACvC,WACA;EACC,OAAO,iBAAiB;EACxB,OAAO,iBAAiB;EACxB,CACD,CAAC,CACH;CAED,OAAO,+CAA+C,MAAM;EAC3D,SAAS,MAAM;EACf;EACA,SAAS,YAAY;EACrB,CAAC;;AAGH,SAAS,qBACR,MACA,OACU;CACV,MAAM,YAAY,KAAK;CACvB,MAAM,aAAa,MAAM;CACzB,IAAI,cAAc,OAAO,eAAe,KACvC,OAAO;CAER,IAAI,cAAc,KAAK;EACtB,IAAI,eAAe,KAClB,OAAO;EAER,OAAO,WAAW,MAAM,aAAa,CAAC,KAAK,KAAK,SAAS,SAAS,CAAC;;CAEpE,IAAI,eAAe,KAClB,OAAO,UAAU,MAAM,aAAa,CAAC,MAAM,KAAK,SAAS,SAAS,CAAC;CAEpE,OAAO,UAAU,MACf,aACA,WAAW,SAAS,SAAS,IAC7B,CAAC,KAAK,KAAK,SAAS,SAAS,IAC7B,CAAC,MAAM,KAAK,SAAS,SAAS,CAC/B;;;;AC7OF,MAAa,gCAAgC;CAC5C,KAAK;CACL,WAAW;CACX,YAAY;CACZ;AAED,MAAa,2BAA2B;CACvC,KAAK;CACL,WAAW;CACX,YAAY;CACZ;AAED,MAAa,6BAA6B;CACzC,sBAAsB;CACtB,4BAA4B;CAC5B,6BAA6B;CAC7B;AAQD,SAAS,aAAa,QAAiC,UAA2C;CACjG,OAAO;EACN,KAAK;EACL,GAAG;EACH;;AAGF,SAAgB,sCAAqE;CACpF,OAAO;EACN,KAAK,aACJ,IAAI,aAAa,iBAAiB,EAAE,QAAQ,YAAY,CAAC,EACzD,yBAAyB,IACzB;EACD,WAAW,aACV,IAAI,aAAa,uBAAuB,EAAE,QAAQ,YAAY,CAAC,EAC/D,yBAAyB,UACzB;EACD,YAAY,aACX,IAAI,aAAa,wBAAwB,EAAE,QAAQ,YAAY,CAAC,EAChE,yBAAyB,WACzB;EACD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-vm/config-contracts",
-  "version": "0.0.108",
+  "version": "0.0.109",
   "description": "Shared agent-vm JSONC config schemas and TypeScript contracts.",
   "homepage": "https://github.com/ShravanSunder/agent-vm#readme",
   "bugs": {