@agent-vm/config-contracts 0.0.59

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025-2026 Shravan Sunder
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.d.ts

@@ -0,0 +1,359 @@
+import { z } from "zod";
+
+//#region src/json-config-file.d.ts
+declare function loadJsonConfigFile(filePath: string): Promise<unknown>;
+//#endregion
+//#region src/json-value.d.ts
+type JsonPrimitive = boolean | null | number | string;
+type JsonArray = JsonValue[];
+type JsonObject = {
+  [key: string]: JsonValue;
+};
+type JsonValue = JsonArray | JsonObject | JsonPrimitive;
+declare const jsonValueSchema: z.ZodType<JsonValue>;
+declare const jsonObjectSchema: z.ZodType<JsonObject>;
+declare function isJsonObject(value: unknown): value is JsonObject;
+declare function assertJsonObject(value: unknown, label: string): JsonObject;
+//#endregion
+//#region src/secret-value.d.ts
+declare const secretValueSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  source: z.ZodLiteral<"environment">;
+  name: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+  source: z.ZodLiteral<"1password">;
+  ref: z.ZodString;
+}, z.core.$strict>], "source">;
+type SecretValue = z.infer<typeof secretValueSchema>;
+//#endregion
+//#region src/mcp-config.d.ts
+declare const mcpProviderSchema: z.ZodObject<{
+  kind: z.ZodLiteral<"mcp">;
+  namespace: z.ZodString;
+  discovery: z.ZodDefault<z.ZodObject<{
+    summary: z.ZodOptional<z.ZodString>;
+  }, z.core.$strict>>;
+  transport: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"streamable-http">;
+    url: z.ZodString;
+    headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+      source: z.ZodLiteral<"environment">;
+      name: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+      source: z.ZodLiteral<"1password">;
+      ref: z.ZodString;
+    }, z.core.$strict>], "source">>>;
+  }, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"sse">;
+    url: z.ZodString;
+    headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+      source: z.ZodLiteral<"environment">;
+      name: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+      source: z.ZodLiteral<"1password">;
+      ref: z.ZodString;
+    }, z.core.$strict>], "source">>>;
+  }, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"stdio">;
+    command: z.ZodString;
+    args: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    cwd: z.ZodOptional<z.ZodString>;
+    env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+      source: z.ZodLiteral<"environment">;
+      name: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+      source: z.ZodLiteral<"1password">;
+      ref: z.ZodString;
+    }, z.core.$strict>], "source">>>;
+  }, z.core.$strict>], "kind">;
+}, z.core.$strict>;
+declare const mcpConfigSchema: z.ZodObject<{
+  $schema: z.ZodOptional<z.ZodString>;
+  schemaVersion: z.ZodLiteral<1>;
+  providers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+    kind: z.ZodLiteral<"mcp">;
+    namespace: z.ZodString;
+    discovery: z.ZodDefault<z.ZodObject<{
+      summary: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    transport: z.ZodDiscriminatedUnion<[z.ZodObject<{
+      kind: z.ZodLiteral<"streamable-http">;
+      url: z.ZodString;
+      headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"environment">;
+        name: z.ZodString;
+      }, z.core.$strict>, z.ZodObject<{
+        source: z.ZodLiteral<"1password">;
+        ref: z.ZodString;
+      }, z.core.$strict>], "source">>>;
+    }, z.core.$strict>, z.ZodObject<{
+      kind: z.ZodLiteral<"sse">;
+      url: z.ZodString;
+      headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"environment">;
+        name: z.ZodString;
+      }, z.core.$strict>, z.ZodObject<{
+        source: z.ZodLiteral<"1password">;
+        ref: z.ZodString;
+      }, z.core.$strict>], "source">>>;
+    }, z.core.$strict>, z.ZodObject<{
+      kind: z.ZodLiteral<"stdio">;
+      command: z.ZodString;
+      args: z.ZodDefault<z.ZodArray<z.ZodString>>;
+      cwd: z.ZodOptional<z.ZodString>;
+      env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"environment">;
+        name: z.ZodString;
+      }, z.core.$strict>, z.ZodObject<{
+        source: z.ZodLiteral<"1password">;
+        ref: z.ZodString;
+      }, z.core.$strict>], "source">>>;
+    }, z.core.$strict>], "kind">;
+  }, z.core.$strict>>>;
+}, z.core.$strict>;
+type McpConfig = z.infer<typeof mcpConfigSchema>;
+type McpProvider = z.infer<typeof mcpProviderSchema>;
+type ResolvedMcpProvider = {
+  readonly headers: Readonly<Record<string, SecretValue>>;
+  readonly namespace: string;
+  readonly transport: 'streamable-http' | 'sse';
+  readonly url: string;
+} | {
+  readonly args: readonly string[];
+  readonly command: string;
+  readonly cwd?: string;
+  readonly env: Readonly<Record<string, SecretValue>>;
+  readonly namespace: string;
+  readonly transport: 'stdio';
+};
+declare function loadMcpConfig(configPath: string): Promise<McpConfig>;
+declare function mcpConfigToResolvedProviders(config: McpConfig): readonly ResolvedMcpProvider[];
+//#endregion
+//#region src/mcp-portal-config.d.ts
+declare const namespaceToolRefSchema: z.ZodObject<{
+  namespace: z.ZodString;
+  toolName: z.ZodString;
+}, z.core.$strict>;
+type NamespaceToolRef = z.infer<typeof namespaceToolRefSchema>;
+declare const portalApprovalConfigSchema: z.ZodObject<{
+  allowWithoutApprovalTools: z.ZodDefault<z.ZodArray<z.ZodObject<{
+    namespace: z.ZodString;
+    toolName: z.ZodString;
+  }, z.core.$strict>>>;
+  alwaysAskTools: z.ZodDefault<z.ZodArray<z.ZodObject<{
+    namespace: z.ZodString;
+    toolName: z.ZodString;
+  }, z.core.$strict>>>;
+  annotationPolicy: z.ZodDefault<z.ZodEnum<{
+    "destructive-requires-approval": "destructive-requires-approval";
+    "always-require-approval": "always-require-approval";
+  }>>;
+  trustedAnnotationNamespaces: z.ZodDefault<z.ZodArray<z.ZodString>>;
+  writeTools: z.ZodDefault<z.ZodArray<z.ZodObject<{
+    namespace: z.ZodString;
+    toolName: z.ZodString;
+  }, z.core.$strict>>>;
+}, z.core.$strict>;
+type PortalApprovalConfig = z.infer<typeof portalApprovalConfigSchema>;
+declare const mcpPortalProfileDefinitionSchema: z.ZodObject<{
+  extends: z.ZodOptional<z.ZodString>;
+  enabledNamespaces: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  enabledToolsByNamespace: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+  hiddenToolsByNamespace: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+  logging: z.ZodOptional<z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+  }, z.core.$strict>>;
+  promptContext: z.ZodOptional<z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    maxNamespaces: z.ZodDefault<z.ZodNumber>;
+  }, z.core.$strict>>;
+  cache: z.ZodOptional<z.ZodObject<{
+    catalogTtlMs: z.ZodDefault<z.ZodNumber>;
+  }, z.core.$strict>>;
+  approval: z.ZodOptional<z.ZodObject<{
+    allowWithoutApprovalTools: z.ZodDefault<z.ZodArray<z.ZodObject<{
+      namespace: z.ZodString;
+      toolName: z.ZodString;
+    }, z.core.$strict>>>;
+    alwaysAskTools: z.ZodDefault<z.ZodArray<z.ZodObject<{
+      namespace: z.ZodString;
+      toolName: z.ZodString;
+    }, z.core.$strict>>>;
+    annotationPolicy: z.ZodDefault<z.ZodEnum<{
+      "destructive-requires-approval": "destructive-requires-approval";
+      "always-require-approval": "always-require-approval";
+    }>>;
+    trustedAnnotationNamespaces: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    writeTools: z.ZodDefault<z.ZodArray<z.ZodObject<{
+      namespace: z.ZodString;
+      toolName: z.ZodString;
+    }, z.core.$strict>>>;
+  }, z.core.$strict>>;
+}, z.core.$strict>;
+type McpPortalProfileDefinition = z.infer<typeof mcpPortalProfileDefinitionSchema>;
+declare const resolvedMcpPortalProfileSchema: z.ZodObject<{
+  enabledNamespaces: z.ZodArray<z.ZodString>;
+  enabledToolsByNamespace: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+  hiddenToolsByNamespace: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+  logging: z.ZodObject<{
+    enabled: z.ZodBoolean;
+  }, z.core.$strict>;
+  promptContext: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    maxNamespaces: z.ZodNumber;
+  }, z.core.$strict>;
+  cache: z.ZodObject<{
+    catalogTtlMs: z.ZodNumber;
+  }, z.core.$strict>;
+  approval: z.ZodObject<{
+    allowWithoutApprovalTools: z.ZodDefault<z.ZodArray<z.ZodObject<{
+      namespace: z.ZodString;
+      toolName: z.ZodString;
+    }, z.core.$strict>>>;
+    alwaysAskTools: z.ZodDefault<z.ZodArray<z.ZodObject<{
+      namespace: z.ZodString;
+      toolName: z.ZodString;
+    }, z.core.$strict>>>;
+    annotationPolicy: z.ZodDefault<z.ZodEnum<{
+      "destructive-requires-approval": "destructive-requires-approval";
+      "always-require-approval": "always-require-approval";
+    }>>;
+    trustedAnnotationNamespaces: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    writeTools: z.ZodDefault<z.ZodArray<z.ZodObject<{
+      namespace: z.ZodString;
+      toolName: z.ZodString;
+    }, z.core.$strict>>>;
+  }, z.core.$strict>;
+}, z.core.$strict>;
+type ResolvedMcpPortalProfile = z.infer<typeof resolvedMcpPortalProfileSchema>;
+declare const mcpPortalServerSchema: z.ZodObject<{
+  host: z.ZodDefault<z.ZodString>;
+  port: z.ZodDefault<z.ZodNumber>;
+  accessHeader: z.ZodObject<{
+    name: z.ZodString;
+    secret: z.ZodDiscriminatedUnion<[z.ZodObject<{
+      source: z.ZodLiteral<"environment">;
+      name: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+      source: z.ZodLiteral<"1password">;
+      ref: z.ZodString;
+    }, z.core.$strict>], "source">;
+  }, z.core.$strict>;
+}, z.core.$strict>;
+type McpPortalServerConfig = z.infer<typeof mcpPortalServerSchema>;
+declare const mcpPortalAgentConfigSchema: z.ZodObject<{
+  profile: z.ZodString;
+  hmacKey: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    source: z.ZodLiteral<"environment">;
+    name: z.ZodString;
+  }, z.core.$strict>, z.ZodObject<{
+    source: z.ZodLiteral<"1password">;
+    ref: z.ZodString;
+  }, z.core.$strict>], "source">>;
+}, z.core.$strict>;
+type McpPortalAgentConfig = z.infer<typeof mcpPortalAgentConfigSchema>;
+declare const mcpPortalConfigSchema: z.ZodObject<{
+  $schema: z.ZodOptional<z.ZodString>;
+  schemaVersion: z.ZodLiteral<1>;
+  server: z.ZodObject<{
+    host: z.ZodDefault<z.ZodString>;
+    port: z.ZodDefault<z.ZodNumber>;
+    accessHeader: z.ZodObject<{
+      name: z.ZodString;
+      secret: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"environment">;
+        name: z.ZodString;
+      }, z.core.$strict>, z.ZodObject<{
+        source: z.ZodLiteral<"1password">;
+        ref: z.ZodString;
+      }, z.core.$strict>], "source">;
+    }, z.core.$strict>;
+  }, z.core.$strict>;
+  agents: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+    profile: z.ZodString;
+    hmacKey: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+      source: z.ZodLiteral<"environment">;
+      name: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+      source: z.ZodLiteral<"1password">;
+      ref: z.ZodString;
+    }, z.core.$strict>], "source">>;
+  }, z.core.$strict>>>;
+  profiles: z.ZodRecord<z.ZodString, z.ZodObject<{
+    extends: z.ZodOptional<z.ZodString>;
+    enabledNamespaces: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enabledToolsByNamespace: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    hiddenToolsByNamespace: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    logging: z.ZodOptional<z.ZodObject<{
+      enabled: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    promptContext: z.ZodOptional<z.ZodObject<{
+      enabled: z.ZodDefault<z.ZodBoolean>;
+      maxNamespaces: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>>;
+    cache: z.ZodOptional<z.ZodObject<{
+      catalogTtlMs: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>>;
+    approval: z.ZodOptional<z.ZodObject<{
+      allowWithoutApprovalTools: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        namespace: z.ZodString;
+        toolName: z.ZodString;
+      }, z.core.$strict>>>;
+      alwaysAskTools: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        namespace: z.ZodString;
+        toolName: z.ZodString;
+      }, z.core.$strict>>>;
+      annotationPolicy: z.ZodDefault<z.ZodEnum<{
+        "destructive-requires-approval": "destructive-requires-approval";
+        "always-require-approval": "always-require-approval";
+      }>>;
+      trustedAnnotationNamespaces: z.ZodDefault<z.ZodArray<z.ZodString>>;
+      writeTools: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        namespace: z.ZodString;
+        toolName: z.ZodString;
+      }, z.core.$strict>>>;
+    }, z.core.$strict>>;
+  }, z.core.$strict>>;
+}, z.core.$strict>;
+type McpPortalConfig = z.infer<typeof mcpPortalConfigSchema>;
+declare const openClawMcpPortalPluginConfigSchema: z.ZodObject<{
+  configDir: z.ZodString;
+  binPath: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+type OpenClawMcpPortalPluginConfig = z.infer<typeof openClawMcpPortalPluginConfigSchema>;
+declare function loadMcpPortalConfig(configPath: string): Promise<McpPortalConfig>;
+declare function resolveMcpPortalProfile(config: McpPortalConfig, profileName: string): ResolvedMcpPortalProfile;
+declare function secretValueToEnvironmentReference(secret: SecretValue): string;
+//#endregion
+//#region src/mcp-portal-approval-policy.d.ts
+interface McpPortalApprovalToolAnnotations {
+  readonly destructiveHint?: boolean | undefined;
+  readonly readOnlyHint?: boolean | undefined;
+}
+interface McpPortalApprovalToolCall {
+  readonly annotations?: McpPortalApprovalToolAnnotations;
+  readonly namespace: string;
+  readonly toolName: string;
+}
+declare function mcpPortalCallRequiresApproval(profile: ResolvedMcpPortalProfile, call: McpPortalApprovalToolCall): boolean;
+//#endregion
+//#region src/schema-artifacts.d.ts
+declare const mcpPortalConfigSchemaVersions: {
+  readonly mcp: 1;
+  readonly mcpPortal: 1;
+};
+declare const mcpPortalConfigSchemaIds: {
+  readonly mcp: "agent-vm:mcp:1";
+  readonly mcpPortal: "agent-vm:mcp-portal:1";
+};
+declare const mcpPortalConfigSchemaPaths: {
+  readonly mcpFromGatewayConfig: "../../schemas/mcp.schema.json";
+  readonly mcpPortalFromGatewayConfig: "../../schemas/mcp-portal.schema.json";
+};
+interface ConfigContractSchemaArtifacts {
+  readonly mcp: Record<string, unknown>;
+  readonly mcpPortal: Record<string, unknown>;
+}
+declare function createConfigContractSchemaArtifacts(): ConfigContractSchemaArtifacts;
+//#endregion
+export { ConfigContractSchemaArtifacts, JsonArray, JsonObject, JsonPrimitive, JsonValue, McpConfig, McpPortalAgentConfig, McpPortalApprovalToolAnnotations, McpPortalApprovalToolCall, McpPortalConfig, McpPortalProfileDefinition, McpPortalServerConfig, McpProvider, NamespaceToolRef, OpenClawMcpPortalPluginConfig, PortalApprovalConfig, ResolvedMcpPortalProfile, ResolvedMcpProvider, SecretValue, assertJsonObject, createConfigContractSchemaArtifacts, isJsonObject, jsonObjectSchema, jsonValueSchema, loadJsonConfigFile, loadMcpConfig, loadMcpPortalConfig, mcpConfigSchema, mcpConfigToResolvedProviders, mcpPortalAgentConfigSchema, mcpPortalCallRequiresApproval, mcpPortalConfigSchema, mcpPortalConfigSchemaIds, mcpPortalConfigSchemaPaths, mcpPortalConfigSchemaVersions, mcpPortalProfileDefinitionSchema, mcpPortalServerSchema, mcpProviderSchema, namespaceToolRefSchema, openClawMcpPortalPluginConfigSchema, portalApprovalConfigSchema, resolveMcpPortalProfile, resolvedMcpPortalProfileSchema, secretValueSchema, secretValueToEnvironmentReference };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/json-config-file.ts","../src/json-value.ts","../src/secret-value.ts","../src/mcp-config.ts","../src/mcp-portal-config.ts","../src/mcp-portal-approval-policy.ts","../src/schema-artifacts.ts"],"mappings":";;;iBAsBsB,kBAAA,CAAmB,QAAA,WAAmB,OAAA;;;KCpBhD,aAAA;AAAA,KACA,SAAA,GAAY,SAAA;AAAA,KACZ,UAAA;EAAA,CAAgB,GAAA,WAAc,SAAA;AAAA;AAAA,KAC9B,SAAA,GAAY,SAAA,GAAY,UAAA,GAAa,aAAA;AAAA,cAEpC,eAAA,EAAiB,CAAA,CAAE,OAAA,CAAQ,SAAA;AAAA,cAW3B,gBAAA,EAAkB,CAAA,CAAE,OAAA,CAAQ,UAAA;AAAA,iBAEzB,YAAA,CAAa,KAAA,YAAiB,KAAA,IAAS,UAAA;AAAA,iBAIvC,gBAAA,CAAiB,KAAA,WAAgB,KAAA,WAAgB,UAAA;;;cCtBpD,iBAAA,EAAiB,CAAA,CAAA,qBAAA,EAAA,CAAA,CAAA,SAAA;;;;;;;KAelB,WAAA,GAAc,CAAA,CAAE,KAAA,QAAa,iBAAA;;;cCoB5B,iBAAA,EAAiB,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAajB,eAAA,EAAe,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAQhB,SAAA,GAAY,CAAA,CAAE,KAAA,QAAa,eAAA;AAAA,KAC3B,WAAA,GAAc,CAAA,CAAE,KAAA,QAAa,iBAAA;AAAA,KAE7B,mBAAA;EAAA,SAEA,OAAA,EAAS,QAAA,CAAS,MAAA,SAAe,WAAA;EAAA,SACjC,SAAA;EAAA,SACA,SAAA;EAAA,SACA,GAAA;AAAA;EAAA,SAGA,IAAA;EAAA,SACA,OAAA;EAAA,SACA,GAAA;EAAA,SACA,GAAA,EAAK,QAAA,CAAS,MAAA,SAAe,WAAA;EAAA,SAC7B,SAAA;EAAA,SACA,SAAA;AAAA;AAAA,iBAGU,aAAA,CAAc,UAAA,WAAqB,OAAA,CAAQ,SAAA;AAAA,iBAIjD,4BAAA,CAA6B,MAAA,EAAQ,SAAA,YAAqB,mBAAA;;;cC5E7D,sBAAA,EAAsB,CAAA,CAAA,SAAA;;;;KAOvB,gBAAA,GAAmB,CAAA,CAAE,KAAA,QAAa,sBAAA;AAAA,cAEjC,0BAAA,EAA0B,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;KAY3B,oBAAA,GAAuB,CAAA,CAAE,KAAA,QAAa,0BAAA;AAAA,cAErC,gCAAA,EAAgC,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA2BjC,0BAAA,GAA6B,CAAA,CAAE,KAAA,QAAa,gCAAA;AAAA,cAE3C,8BAAA,EAA8B,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAiB/B,wBAAA,GAA2B,CAAA,CAAE,KAAA,QAAa,8BAAA;AAAA,cASzC,qBAAA,EAAqB,CAAA,CAAA,SAAA;;;;;;;;;;;;;;KAQtB,qBAAA,GAAwB,CAAA,CAAE,KAAA,QAAa,qBAAA;AAAA,cAEtC,0BAAA,EAA0B,CAAA,CAAA,SAAA;;;;;;;;;;KAO3B,oBAAA,GAAuB,CAAA,CAAE,KAAA,QAAa,0BAAA;AAAA,cAErC,qBAAA,EAAqB,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAmBtB,eAAA,GAAkB,CAAA,CAAE,KAAA,QAAa,qBAAA;AAAA,cAEhC,mCAAA,EAAmC,CAAA,CAAA,SAAA;;;;KAOpC,6BAAA,GAAgC,CAAA,CAAE,KAAA,QAAa,mCAAA;AAAA,iBAgBrC,mBAAA,CAAoB,UAAA,WAAqB,OAAA,CAAQ,eAAA;AAAA,iBAyCvD,uBAAA,CACf,MAAA,EAAQ,eAAA,EACR,WAAA,WACE,wBAAA;AAAA,iBAIa,iCAAA,CAAkC,MAAA,EAAQ,WAAA;;;UChMzC,gCAAA;EAAA,SACP,eAAA;EAAA,SACA,YAAA;AAAA;AAAA,UAGO,yBAAA;EAAA,SACP,WAAA,GAAc,gCAAA;EAAA,SACd,SAAA;EAAA,SACA,QAAA;AAAA;AAAA,iBAyBM,6BAAA,CACf,OAAA,EAAS,wBAAA,EACT,IAAA,EAAM,yBAAA;;;cChCM,6BAAA;EAAA,SAGH,GAAA;EAAA,SAAA,SAAA;AAAA;AAAA,cAEG,wBAAA;EAAA,SAGH,GAAA;EAAA,SAAA,SAAA;AAAA;AAAA,cAEG,0BAAA;EAAA,SAGH,oBAAA;EAAA,SAAA,0BAAA;AAAA;AAAA,UAEO,6BAAA;EAAA,SACP,GAAA,EAAK,MAAA;EAAA,SACL,SAAA,EAAW,MAAA;AAAA;AAAA,iBAUL,mCAAA,CAAA,GAAuC,6BAAA"}

package/dist/index.js

@@ -0,0 +1,264 @@
+import { readFile } from "node:fs/promises";
+import { parse, printParseErrorCode } from "jsonc-parser";
+import * as zod from "zod";
+import { z } from "zod";
+//#region src/json-config-file.ts
+const parseJsoncToUnknown = parse;
+function formatLineColumn(text, offset) {
+	const prefix = text.slice(0, offset);
+	return `line ${prefix.split("\n").length}, column ${offset - prefix.lastIndexOf("\n")}`;
+}
+function formatParseError(filePath, text, error) {
+	return [`Invalid JSONC in ${filePath}: ${formatLineColumn(text, error.offset)}:`, printParseErrorCode(error.error)].join(" ");
+}
+async function loadJsonConfigFile(filePath) {
+	const rawConfig = await readFile(filePath, "utf8");
+	const parseErrors = [];
+	const parsedConfig = parseJsoncToUnknown(rawConfig, parseErrors, {
+		allowTrailingComma: true,
+		disallowComments: false
+	});
+	if (parseErrors.length > 0) {
+		const firstParseError = parseErrors[0];
+		if (firstParseError !== void 0) throw new Error(formatParseError(filePath, rawConfig, firstParseError));
+	}
+	return parsedConfig;
+}
+//#endregion
+//#region src/json-value.ts
+const jsonValueSchema = z.lazy(() => z.union([
+	z.string(),
+	z.number().finite(),
+	z.boolean(),
+	z.null(),
+	z.array(jsonValueSchema),
+	jsonObjectSchema
+]));
+const jsonObjectSchema = z.record(z.string(), jsonValueSchema);
+function isJsonObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function assertJsonObject(value, label) {
+	if (!isJsonObject(value)) throw new Error(`${label} must be a JSON object.`);
+	return jsonObjectSchema.parse(value);
+}
+//#endregion
+//#region src/secret-value.ts
+const secretValueSchema = z.discriminatedUnion("source", [z.object({
+	source: z.literal("environment"),
+	name: z.string().min(1)
+}).strict(), z.object({
+	source: z.literal("1password"),
+	ref: z.string().min(1)
+}).strict()]);
+//#endregion
+//#region src/mcp-config.ts
+const mcpProviderDiscoverySchema = z.object({ summary: z.string().min(1).optional() }).strict();
+const streamableHttpTransportSchema = z.object({
+	kind: z.literal("streamable-http"),
+	url: z.string().url(),
+	headers: z.record(z.string(), secretValueSchema).default({})
+}).strict();
+const sseTransportSchema = z.object({
+	kind: z.literal("sse"),
+	url: z.string().url(),
+	headers: z.record(z.string(), secretValueSchema).default({})
+}).strict();
+const stdioTransportSchema = z.object({
+	kind: z.literal("stdio"),
+	command: z.string().min(1),
+	args: z.array(z.string()).default([]),
+	cwd: z.string().min(1).optional(),
+	env: z.record(z.string(), secretValueSchema).default({})
+}).strict();
+const mcpProviderSchema = z.object({
+	kind: z.literal("mcp"),
+	namespace: z.string().min(1),
+	discovery: mcpProviderDiscoverySchema.default({}),
+	transport: z.discriminatedUnion("kind", [
+		streamableHttpTransportSchema,
+		sseTransportSchema,
+		stdioTransportSchema
+	])
+}).strict();
+const mcpConfigSchema = z.object({
+	$schema: z.string().min(1).optional(),
+	schemaVersion: z.literal(1),
+	providers: z.record(z.string().min(1), mcpProviderSchema).default({})
+}).strict();
+async function loadMcpConfig(configPath) {
+	return mcpConfigSchema.parse(await loadJsonConfigFile(configPath));
+}
+function mcpConfigToResolvedProviders(config) {
+	return Object.values(config.providers).map((provider) => {
+		const transport = provider.transport;
+		if (transport.kind === "stdio") {
+			const resolvedProvider = {
+				args: transport.args,
+				command: transport.command,
+				env: transport.env,
+				namespace: provider.namespace,
+				transport: transport.kind
+			};
+			if (transport.cwd !== void 0) resolvedProvider.cwd = transport.cwd;
+			return resolvedProvider;
+		}
+		return {
+			headers: transport.headers,
+			namespace: provider.namespace,
+			transport: transport.kind,
+			url: transport.url
+		};
+	});
+}
+//#endregion
+//#region src/mcp-portal-approval-policy.ts
+function selectorMatches(selectors, namespace, toolName) {
+	return selectors.some((selector) => selector.namespace === namespace && selector.toolName === toolName);
+}
+function hasTrustedReadOnlyAnnotation(profile, call) {
+	return profile.approval.annotationPolicy === "destructive-requires-approval" && profile.approval.trustedAnnotationNamespaces.includes(call.namespace) && call.annotations?.readOnlyHint === true && call.annotations.destructiveHint !== true;
+}
+function mcpPortalCallRequiresApproval(profile, call) {
+	if (selectorMatches(profile.approval.allowWithoutApprovalTools, call.namespace, call.toolName)) return false;
+	if (profile.approval.annotationPolicy === "always-require-approval") return true;
+	if (selectorMatches(profile.approval.alwaysAskTools, call.namespace, call.toolName) || selectorMatches(profile.approval.writeTools, call.namespace, call.toolName)) return true;
+	return !hasTrustedReadOnlyAnnotation(profile, call);
+}
+//#endregion
+//#region src/mcp-portal-config.ts
+const namespaceToolRefSchema = z.object({
+	namespace: z.string().min(1),
+	toolName: z.string().min(1)
+}).strict();
+const portalApprovalConfigSchema = z.object({
+	allowWithoutApprovalTools: z.array(namespaceToolRefSchema).default([]),
+	alwaysAskTools: z.array(namespaceToolRefSchema).default([]),
+	annotationPolicy: z.enum(["destructive-requires-approval", "always-require-approval"]).default("destructive-requires-approval"),
+	trustedAnnotationNamespaces: z.array(z.string().min(1)).default([]),
+	writeTools: z.array(namespaceToolRefSchema).default([])
+}).strict();
+const mcpPortalProfileDefinitionSchema = z.object({
+	extends: z.string().min(1).optional(),
+	enabledNamespaces: z.array(z.string().min(1)).optional(),
+	enabledToolsByNamespace: z.record(z.string().min(1), z.array(z.string().min(1))).optional(),
+	hiddenToolsByNamespace: z.record(z.string().min(1), z.array(z.string().min(1))).optional(),
+	logging: z.object({ enabled: z.boolean().default(false) }).strict().optional(),
+	promptContext: z.object({
+		enabled: z.boolean().default(true),
+		maxNamespaces: z.number().int().positive().default(12)
+	}).strict().optional(),
+	cache: z.object({ catalogTtlMs: z.number().int().positive().default(6e4) }).strict().optional(),
+	approval: portalApprovalConfigSchema.optional()
+}).strict();
+const resolvedMcpPortalProfileSchema = z.object({
+	enabledNamespaces: z.array(z.string().min(1)),
+	enabledToolsByNamespace: z.record(z.string().min(1), z.array(z.string().min(1))),
+	hiddenToolsByNamespace: z.record(z.string().min(1), z.array(z.string().min(1))),
+	logging: z.object({ enabled: z.boolean() }).strict(),
+	promptContext: z.object({
+		enabled: z.boolean(),
+		maxNamespaces: z.number().int().positive()
+	}).strict(),
+	cache: z.object({ catalogTtlMs: z.number().int().positive() }).strict(),
+	approval: portalApprovalConfigSchema
+}).strict();
+const mcpPortalAccessHeaderSchema = z.object({
+	name: z.string().min(1),
+	secret: secretValueSchema
+}).strict();
+const mcpPortalServerSchema = z.object({
+	host: z.string().min(1).default("127.0.0.1"),
+	port: z.number().int().min(1).max(65535).default(18790),
+	accessHeader: mcpPortalAccessHeaderSchema
+}).strict();
+const mcpPortalAgentConfigSchema = z.object({
+	profile: z.string().min(1),
+	hmacKey: secretValueSchema.optional()
+}).strict();
+const mcpPortalConfigSchema = z.object({
+	$schema: z.string().min(1).optional(),
+	schemaVersion: z.literal(1),
+	server: mcpPortalServerSchema,
+	agents: z.record(z.string().min(1), mcpPortalAgentConfigSchema).default({}),
+	profiles: z.record(z.string().min(1), mcpPortalProfileDefinitionSchema)
+}).strict().superRefine((config, context) => {
+	if (Object.keys(config.profiles).length === 0) context.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: "mcp-portal.config.jsonc must define at least one profile.",
+		path: ["profiles"]
+	});
+});
+const openClawMcpPortalPluginConfigSchema = z.object({
+	configDir: z.string().min(1),
+	binPath: z.string().min(1).optional()
+}).strict();
+const defaultProfile = {
+	approval: portalApprovalConfigSchema.parse({}),
+	cache: { catalogTtlMs: 6e4 },
+	enabledNamespaces: [],
+	enabledToolsByNamespace: {},
+	hiddenToolsByNamespace: {},
+	logging: { enabled: false },
+	promptContext: {
+		enabled: true,
+		maxNamespaces: 12
+	}
+};
+async function loadMcpPortalConfig(configPath) {
+	return mcpPortalConfigSchema.parse(await loadJsonConfigFile(configPath));
+}
+function mergeProfile(base, override) {
+	return resolvedMcpPortalProfileSchema.parse({
+		approval: override.approval ?? base.approval,
+		cache: override.cache ?? base.cache,
+		enabledNamespaces: override.enabledNamespaces ?? base.enabledNamespaces,
+		enabledToolsByNamespace: override.enabledToolsByNamespace ?? base.enabledToolsByNamespace,
+		hiddenToolsByNamespace: override.hiddenToolsByNamespace ?? base.hiddenToolsByNamespace,
+		logging: override.logging ?? base.logging,
+		promptContext: override.promptContext ?? base.promptContext
+	});
+}
+function resolveMcpPortalProfileWithState(config, profileName, state) {
+	const profile = config.profiles[profileName];
+	if (profile === void 0) throw new Error(`unknown MCP profile '${profileName}'`);
+	if (state.stack.includes(profileName)) throw new Error(`MCP profile inheritance cycle: ${[...state.stack, profileName].join(" -> ")}`);
+	return mergeProfile(profile.extends === void 0 ? defaultProfile : resolveMcpPortalProfileWithState(config, profile.extends, { stack: [...state.stack, profileName] }), profile);
+}
+function resolveMcpPortalProfile(config, profileName) {
+	return resolveMcpPortalProfileWithState(config, profileName, { stack: [] });
+}
+function secretValueToEnvironmentReference(secret) {
+	if (secret.source === "environment") return `\${${secret.name}}`;
+	return secret.ref;
+}
+//#endregion
+//#region src/schema-artifacts.ts
+const mcpPortalConfigSchemaVersions = {
+	mcp: 1,
+	mcpPortal: 1
+};
+const mcpPortalConfigSchemaIds = {
+	mcp: "agent-vm:mcp:1",
+	mcpPortal: "agent-vm:mcp-portal:1"
+};
+const mcpPortalConfigSchemaPaths = {
+	mcpFromGatewayConfig: "../../schemas/mcp.schema.json",
+	mcpPortalFromGatewayConfig: "../../schemas/mcp-portal.schema.json"
+};
+function withSchemaId(schema, schemaId) {
+	return {
+		$id: schemaId,
+		...schema
+	};
+}
+function createConfigContractSchemaArtifacts() {
+	return {
+		mcp: withSchemaId(zod.toJSONSchema(mcpConfigSchema, { target: "draft-07" }), mcpPortalConfigSchemaIds.mcp),
+		mcpPortal: withSchemaId(zod.toJSONSchema(mcpPortalConfigSchema, { target: "draft-07" }), mcpPortalConfigSchemaIds.mcpPortal)
+	};
+}
+//#endregion
+export { assertJsonObject, createConfigContractSchemaArtifacts, isJsonObject, jsonObjectSchema, jsonValueSchema, loadJsonConfigFile, loadMcpConfig, loadMcpPortalConfig, mcpConfigSchema, mcpConfigToResolvedProviders, mcpPortalAgentConfigSchema, mcpPortalCallRequiresApproval, mcpPortalConfigSchema, mcpPortalConfigSchemaIds, mcpPortalConfigSchemaPaths, mcpPortalConfigSchemaVersions, mcpPortalProfileDefinitionSchema, mcpPortalServerSchema, mcpProviderSchema, namespaceToolRefSchema, openClawMcpPortalPluginConfigSchema, portalApprovalConfigSchema, resolveMcpPortalProfile, resolvedMcpPortalProfileSchema, secretValueSchema, secretValueToEnvironmentReference };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../src/json-config-file.ts","../src/json-value.ts","../src/secret-value.ts","../src/mcp-config.ts","../src/mcp-portal-approval-policy.ts","../src/mcp-portal-config.ts","../src/schema-artifacts.ts"],"sourcesContent":["import { readFile } from 'node:fs/promises';\n\nimport { parse, type ParseError, type ParseOptions, printParseErrorCode } from 'jsonc-parser';\n\nconst parseJsoncToUnknown: (text: string, errors: ParseError[], options: ParseOptions) => unknown =\n\tparse;\n\nfunction formatLineColumn(text: string, offset: number): string {\n\tconst prefix = text.slice(0, offset);\n\tconst line = prefix.split('\\n').length;\n\tconst lastLineBreakIndex = prefix.lastIndexOf('\\n');\n\tconst column = offset - lastLineBreakIndex;\n\treturn `line ${line}, column ${column}`;\n}\n\nfunction formatParseError(filePath: string, text: string, error: ParseError): string {\n\treturn [\n\t\t`Invalid JSONC in ${filePath}: ${formatLineColumn(text, error.offset)}:`,\n\t\tprintParseErrorCode(error.error),\n\t].join(' ');\n}\n\nexport async function loadJsonConfigFile(filePath: string): Promise<unknown> {\n\tconst rawConfig = await readFile(filePath, 'utf8');\n\tconst parseErrors: ParseError[] = [];\n\tconst parsedConfig = parseJsoncToUnknown(rawConfig, parseErrors, {\n\t\tallowTrailingComma: true,\n\t\tdisallowComments: false,\n\t});\n\n\tif (parseErrors.length > 0) {\n\t\tconst firstParseError = parseErrors[0];\n\t\tif (firstParseError !== undefined) {\n\t\t\tthrow new Error(formatParseError(filePath, rawConfig, firstParseError));\n\t\t}\n\t}\n\n\treturn parsedConfig;\n}\n","import { z } from 'zod';\n\nexport type JsonPrimitive = boolean | null | number | string;\nexport type JsonArray = JsonValue[];\nexport type JsonObject = { [key: string]: JsonValue };\nexport type JsonValue = JsonArray | JsonObject | JsonPrimitive;\n\nexport const jsonValueSchema: z.ZodType<JsonValue> = z.lazy(() =>\n\tz.union([\n\t\tz.string(),\n\t\tz.number().finite(),\n\t\tz.boolean(),\n\t\tz.null(),\n\t\tz.array(jsonValueSchema),\n\t\tjsonObjectSchema,\n\t]),\n);\n\nexport const jsonObjectSchema: z.ZodType<JsonObject> = z.record(z.string(), jsonValueSchema);\n\nexport function isJsonObject(value: unknown): value is JsonObject {\n\treturn typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nexport function assertJsonObject(value: unknown, label: string): JsonObject {\n\tif (!isJsonObject(value)) {\n\t\tthrow new Error(`${label} must be a JSON object.`);\n\t}\n\n\treturn jsonObjectSchema.parse(value);\n}\n","import { z } from 'zod';\n\nexport const secretValueSchema = z.discriminatedUnion('source', [\n\tz\n\t\t.object({\n\t\t\tsource: z.literal('environment'),\n\t\t\tname: z.string().min(1),\n\t\t})\n\t\t.strict(),\n\tz\n\t\t.object({\n\t\t\tsource: z.literal('1password'),\n\t\t\tref: z.string().min(1),\n\t\t})\n\t\t.strict(),\n]);\n\nexport type SecretValue = z.infer<typeof secretValueSchema>;\n","import { z } from 'zod';\n\nimport { loadJsonConfigFile } from './json-config-file.js';\nimport { secretValueSchema, type SecretValue } from './secret-value.js';\n\nconst mcpProviderDiscoverySchema = z\n\t.object({\n\t\tsummary: z.string().min(1).optional(),\n\t})\n\t.strict();\n\nconst streamableHttpTransportSchema = z\n\t.object({\n\t\tkind: z.literal('streamable-http'),\n\t\turl: z.string().url(),\n\t\theaders: z.record(z.string(), secretValueSchema).default({}),\n\t})\n\t.strict();\n\nconst sseTransportSchema = z\n\t.object({\n\t\tkind: z.literal('sse'),\n\t\turl: z.string().url(),\n\t\theaders: z.record(z.string(), secretValueSchema).default({}),\n\t})\n\t.strict();\n\nconst stdioTransportSchema = z\n\t.object({\n\t\tkind: z.literal('stdio'),\n\t\tcommand: z.string().min(1),\n\t\targs: z.array(z.string()).default([]),\n\t\tcwd: z.string().min(1).optional(),\n\t\tenv: z.record(z.string(), secretValueSchema).default({}),\n\t})\n\t.strict();\n\nexport const mcpProviderSchema = z\n\t.object({\n\t\tkind: z.literal('mcp'),\n\t\tnamespace: z.string().min(1),\n\t\tdiscovery: mcpProviderDiscoverySchema.default({}),\n\t\ttransport: z.discriminatedUnion('kind', [\n\t\t\tstreamableHttpTransportSchema,\n\t\t\tsseTransportSchema,\n\t\t\tstdioTransportSchema,\n\t\t]),\n\t})\n\t.strict();\n\nexport const mcpConfigSchema = z\n\t.object({\n\t\t$schema: z.string().min(1).optional(),\n\t\tschemaVersion: z.literal(1),\n\t\tproviders: z.record(z.string().min(1), mcpProviderSchema).default({}),\n\t})\n\t.strict();\n\nexport type McpConfig = z.infer<typeof mcpConfigSchema>;\nexport type McpProvider = z.infer<typeof mcpProviderSchema>;\n\nexport type ResolvedMcpProvider =\n\t| {\n\t\t\treadonly headers: Readonly<Record<string, SecretValue>>;\n\t\t\treadonly namespace: string;\n\t\t\treadonly transport: 'streamable-http' | 'sse';\n\t\t\treadonly url: string;\n\t  }\n\t| {\n\t\t\treadonly args: readonly string[];\n\t\t\treadonly command: string;\n\t\t\treadonly cwd?: string;\n\t\t\treadonly env: Readonly<Record<string, SecretValue>>;\n\t\t\treadonly namespace: string;\n\t\t\treadonly transport: 'stdio';\n\t  };\n\nexport async function loadMcpConfig(configPath: string): Promise<McpConfig> {\n\treturn mcpConfigSchema.parse(await loadJsonConfigFile(configPath));\n}\n\nexport function mcpConfigToResolvedProviders(config: McpConfig): readonly ResolvedMcpProvider[] {\n\treturn Object.values(config.providers).map((provider) => {\n\t\tconst transport = provider.transport;\n\t\tif (transport.kind === 'stdio') {\n\t\t\tconst resolvedProvider: {\n\t\t\t\targs: readonly string[];\n\t\t\t\tcommand: string;\n\t\t\t\tcwd?: string;\n\t\t\t\tenv: Readonly<Record<string, SecretValue>>;\n\t\t\t\tnamespace: string;\n\t\t\t\ttransport: 'stdio';\n\t\t\t} = {\n\t\t\t\targs: transport.args,\n\t\t\t\tcommand: transport.command,\n\t\t\t\tenv: transport.env,\n\t\t\t\tnamespace: provider.namespace,\n\t\t\t\ttransport: transport.kind,\n\t\t\t};\n\t\t\tif (transport.cwd !== undefined) {\n\t\t\t\tresolvedProvider.cwd = transport.cwd;\n\t\t\t}\n\t\t\treturn resolvedProvider;\n\t\t}\n\n\t\treturn {\n\t\t\theaders: transport.headers,\n\t\t\tnamespace: provider.namespace,\n\t\t\ttransport: transport.kind,\n\t\t\turl: transport.url,\n\t\t};\n\t});\n}\n","import type { NamespaceToolRef, ResolvedMcpPortalProfile } from './mcp-portal-config.js';\n\nexport interface McpPortalApprovalToolAnnotations {\n\treadonly destructiveHint?: boolean | undefined;\n\treadonly readOnlyHint?: boolean | undefined;\n}\n\nexport interface McpPortalApprovalToolCall {\n\treadonly annotations?: McpPortalApprovalToolAnnotations;\n\treadonly namespace: string;\n\treadonly toolName: string;\n}\n\nfunction selectorMatches(\n\tselectors: readonly NamespaceToolRef[],\n\tnamespace: string,\n\ttoolName: string,\n): boolean {\n\treturn selectors.some(\n\t\t(selector) => selector.namespace === namespace && selector.toolName === toolName,\n\t);\n}\n\nfunction hasTrustedReadOnlyAnnotation(\n\tprofile: ResolvedMcpPortalProfile,\n\tcall: McpPortalApprovalToolCall,\n): boolean {\n\treturn (\n\t\tprofile.approval.annotationPolicy === 'destructive-requires-approval' &&\n\t\tprofile.approval.trustedAnnotationNamespaces.includes(call.namespace) &&\n\t\tcall.annotations?.readOnlyHint === true &&\n\t\tcall.annotations.destructiveHint !== true\n\t);\n}\n\nexport function mcpPortalCallRequiresApproval(\n\tprofile: ResolvedMcpPortalProfile,\n\tcall: McpPortalApprovalToolCall,\n): boolean {\n\tif (selectorMatches(profile.approval.allowWithoutApprovalTools, call.namespace, call.toolName)) {\n\t\treturn false;\n\t}\n\tif (profile.approval.annotationPolicy === 'always-require-approval') {\n\t\treturn true;\n\t}\n\tif (\n\t\tselectorMatches(profile.approval.alwaysAskTools, call.namespace, call.toolName) ||\n\t\tselectorMatches(profile.approval.writeTools, call.namespace, call.toolName)\n\t) {\n\t\treturn true;\n\t}\n\treturn !hasTrustedReadOnlyAnnotation(profile, call);\n}\n","import { z } from 'zod';\n\nimport { loadJsonConfigFile } from './json-config-file.js';\nimport { secretValueSchema, type SecretValue } from './secret-value.js';\n\nexport const namespaceToolRefSchema = z\n\t.object({\n\t\tnamespace: z.string().min(1),\n\t\ttoolName: z.string().min(1),\n\t})\n\t.strict();\n\nexport type NamespaceToolRef = z.infer<typeof namespaceToolRefSchema>;\n\nexport const portalApprovalConfigSchema = z\n\t.object({\n\t\tallowWithoutApprovalTools: z.array(namespaceToolRefSchema).default([]),\n\t\talwaysAskTools: z.array(namespaceToolRefSchema).default([]),\n\t\tannotationPolicy: z\n\t\t\t.enum(['destructive-requires-approval', 'always-require-approval'])\n\t\t\t.default('destructive-requires-approval'),\n\t\ttrustedAnnotationNamespaces: z.array(z.string().min(1)).default([]),\n\t\twriteTools: z.array(namespaceToolRefSchema).default([]),\n\t})\n\t.strict();\n\nexport type PortalApprovalConfig = z.infer<typeof portalApprovalConfigSchema>;\n\nexport const mcpPortalProfileDefinitionSchema = z\n\t.object({\n\t\textends: z.string().min(1).optional(),\n\t\tenabledNamespaces: z.array(z.string().min(1)).optional(),\n\t\tenabledToolsByNamespace: z.record(z.string().min(1), z.array(z.string().min(1))).optional(),\n\t\thiddenToolsByNamespace: z.record(z.string().min(1), z.array(z.string().min(1))).optional(),\n\t\tlogging: z\n\t\t\t.object({ enabled: z.boolean().default(false) })\n\t\t\t.strict()\n\t\t\t.optional(),\n\t\tpromptContext: z\n\t\t\t.object({\n\t\t\t\tenabled: z.boolean().default(true),\n\t\t\t\tmaxNamespaces: z.number().int().positive().default(12),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.optional(),\n\t\tcache: z\n\t\t\t.object({\n\t\t\t\tcatalogTtlMs: z.number().int().positive().default(60_000),\n\t\t\t})\n\t\t\t.strict()\n\t\t\t.optional(),\n\t\tapproval: portalApprovalConfigSchema.optional(),\n\t})\n\t.strict();\n\nexport type McpPortalProfileDefinition = z.infer<typeof mcpPortalProfileDefinitionSchema>;\n\nexport const resolvedMcpPortalProfileSchema = z\n\t.object({\n\t\tenabledNamespaces: z.array(z.string().min(1)),\n\t\tenabledToolsByNamespace: z.record(z.string().min(1), z.array(z.string().min(1))),\n\t\thiddenToolsByNamespace: z.record(z.string().min(1), z.array(z.string().min(1))),\n\t\tlogging: z.object({ enabled: z.boolean() }).strict(),\n\t\tpromptContext: z\n\t\t\t.object({\n\t\t\t\tenabled: z.boolean(),\n\t\t\t\tmaxNamespaces: z.number().int().positive(),\n\t\t\t})\n\t\t\t.strict(),\n\t\tcache: z.object({ catalogTtlMs: z.number().int().positive() }).strict(),\n\t\tapproval: portalApprovalConfigSchema,\n\t})\n\t.strict();\n\nexport type ResolvedMcpPortalProfile = z.infer<typeof resolvedMcpPortalProfileSchema>;\n\nconst mcpPortalAccessHeaderSchema = z\n\t.object({\n\t\tname: z.string().min(1),\n\t\tsecret: secretValueSchema,\n\t})\n\t.strict();\n\nexport const mcpPortalServerSchema = z\n\t.object({\n\t\thost: z.string().min(1).default('127.0.0.1'),\n\t\tport: z.number().int().min(1).max(65_535).default(18_790),\n\t\taccessHeader: mcpPortalAccessHeaderSchema,\n\t})\n\t.strict();\n\nexport type McpPortalServerConfig = z.infer<typeof mcpPortalServerSchema>;\n\nexport const mcpPortalAgentConfigSchema = z\n\t.object({\n\t\tprofile: z.string().min(1),\n\t\thmacKey: secretValueSchema.optional(),\n\t})\n\t.strict();\n\nexport type McpPortalAgentConfig = z.infer<typeof mcpPortalAgentConfigSchema>;\n\nexport const mcpPortalConfigSchema = z\n\t.object({\n\t\t$schema: z.string().min(1).optional(),\n\t\tschemaVersion: z.literal(1),\n\t\tserver: mcpPortalServerSchema,\n\t\tagents: z.record(z.string().min(1), mcpPortalAgentConfigSchema).default({}),\n\t\tprofiles: z.record(z.string().min(1), mcpPortalProfileDefinitionSchema),\n\t})\n\t.strict()\n\t.superRefine((config, context) => {\n\t\tif (Object.keys(config.profiles).length === 0) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: z.ZodIssueCode.custom,\n\t\t\t\tmessage: 'mcp-portal.config.jsonc must define at least one profile.',\n\t\t\t\tpath: ['profiles'],\n\t\t\t});\n\t\t}\n\t});\n\nexport type McpPortalConfig = z.infer<typeof mcpPortalConfigSchema>;\n\nexport const openClawMcpPortalPluginConfigSchema = z\n\t.object({\n\t\tconfigDir: z.string().min(1),\n\t\tbinPath: z.string().min(1).optional(),\n\t})\n\t.strict();\n\nexport type OpenClawMcpPortalPluginConfig = z.infer<typeof openClawMcpPortalPluginConfigSchema>;\n\nconst defaultProfile: ResolvedMcpPortalProfile = {\n\tapproval: portalApprovalConfigSchema.parse({}),\n\tcache: { catalogTtlMs: 60_000 },\n\tenabledNamespaces: [],\n\tenabledToolsByNamespace: {},\n\thiddenToolsByNamespace: {},\n\tlogging: { enabled: false },\n\tpromptContext: { enabled: true, maxNamespaces: 12 },\n};\n\ninterface ResolveProfileState {\n\treadonly stack: readonly string[];\n}\n\nexport async function loadMcpPortalConfig(configPath: string): Promise<McpPortalConfig> {\n\treturn mcpPortalConfigSchema.parse(await loadJsonConfigFile(configPath));\n}\n\nfunction mergeProfile(\n\tbase: ResolvedMcpPortalProfile,\n\toverride: McpPortalProfileDefinition,\n): ResolvedMcpPortalProfile {\n\treturn resolvedMcpPortalProfileSchema.parse({\n\t\tapproval: override.approval ?? base.approval,\n\t\tcache: override.cache ?? base.cache,\n\t\tenabledNamespaces: override.enabledNamespaces ?? base.enabledNamespaces,\n\t\tenabledToolsByNamespace: override.enabledToolsByNamespace ?? base.enabledToolsByNamespace,\n\t\thiddenToolsByNamespace: override.hiddenToolsByNamespace ?? base.hiddenToolsByNamespace,\n\t\tlogging: override.logging ?? base.logging,\n\t\tpromptContext: override.promptContext ?? base.promptContext,\n\t});\n}\n\nfunction resolveMcpPortalProfileWithState(\n\tconfig: McpPortalConfig,\n\tprofileName: string,\n\tstate: ResolveProfileState,\n): ResolvedMcpPortalProfile {\n\tconst profile = config.profiles[profileName];\n\tif (profile === undefined) {\n\t\tthrow new Error(`unknown MCP profile '${profileName}'`);\n\t}\n\tif (state.stack.includes(profileName)) {\n\t\tthrow new Error(`MCP profile inheritance cycle: ${[...state.stack, profileName].join(' -> ')}`);\n\t}\n\n\tconst parentProfile =\n\t\tprofile.extends === undefined\n\t\t\t? defaultProfile\n\t\t\t: resolveMcpPortalProfileWithState(config, profile.extends, {\n\t\t\t\t\tstack: [...state.stack, profileName],\n\t\t\t\t});\n\treturn mergeProfile(parentProfile, profile);\n}\n\nexport function resolveMcpPortalProfile(\n\tconfig: McpPortalConfig,\n\tprofileName: string,\n): ResolvedMcpPortalProfile {\n\treturn resolveMcpPortalProfileWithState(config, profileName, { stack: [] });\n}\n\nexport function secretValueToEnvironmentReference(secret: SecretValue): string {\n\tif (secret.source === 'environment') {\n\t\treturn `\\${${secret.name}}`;\n\t}\n\treturn secret.ref;\n}\n","import * as zod from 'zod';\n\nimport { mcpConfigSchema } from './mcp-config.js';\nimport { mcpPortalConfigSchema } from './mcp-portal-config.js';\n\nexport const mcpPortalConfigSchemaVersions = {\n\tmcp: 1,\n\tmcpPortal: 1,\n} as const;\n\nexport const mcpPortalConfigSchemaIds = {\n\tmcp: 'agent-vm:mcp:1',\n\tmcpPortal: 'agent-vm:mcp-portal:1',\n} as const;\n\nexport const mcpPortalConfigSchemaPaths = {\n\tmcpFromGatewayConfig: '../../schemas/mcp.schema.json',\n\tmcpPortalFromGatewayConfig: '../../schemas/mcp-portal.schema.json',\n} as const;\n\nexport interface ConfigContractSchemaArtifacts {\n\treadonly mcp: Record<string, unknown>;\n\treadonly mcpPortal: Record<string, unknown>;\n}\n\nfunction withSchemaId(schema: Record<string, unknown>, schemaId: string): Record<string, unknown> {\n\treturn {\n\t\t$id: schemaId,\n\t\t...schema,\n\t};\n}\n\nexport function createConfigContractSchemaArtifacts(): ConfigContractSchemaArtifacts {\n\treturn {\n\t\tmcp: withSchemaId(\n\t\t\tzod.toJSONSchema(mcpConfigSchema, { target: 'draft-07' }),\n\t\t\tmcpPortalConfigSchemaIds.mcp,\n\t\t),\n\t\tmcpPortal: withSchemaId(\n\t\t\tzod.toJSONSchema(mcpPortalConfigSchema, { target: 'draft-07' }),\n\t\t\tmcpPortalConfigSchemaIds.mcpPortal,\n\t\t),\n\t};\n}\n"],"mappings":";;;;;AAIA,MAAM,sBACL;AAED,SAAS,iBAAiB,MAAc,QAAwB;CAC/D,MAAM,SAAS,KAAK,MAAM,GAAG,OAAO;CAIpC,OAAO,QAHM,OAAO,MAAM,KAAK,CAAC,OAGZ,WADL,SADY,OAAO,YAAY,KACJ;;AAI3C,SAAS,iBAAiB,UAAkB,MAAc,OAA2B;CACpF,OAAO,CACN,oBAAoB,SAAS,IAAI,iBAAiB,MAAM,MAAM,OAAO,CAAC,IACtE,oBAAoB,MAAM,MAAM,CAChC,CAAC,KAAK,IAAI;;AAGZ,eAAsB,mBAAmB,UAAoC;CAC5E,MAAM,YAAY,MAAM,SAAS,UAAU,OAAO;CAClD,MAAM,cAA4B,EAAE;CACpC,MAAM,eAAe,oBAAoB,WAAW,aAAa;EAChE,oBAAoB;EACpB,kBAAkB;EAClB,CAAC;CAEF,IAAI,YAAY,SAAS,GAAG;EAC3B,MAAM,kBAAkB,YAAY;EACpC,IAAI,oBAAoB,KAAA,GACvB,MAAM,IAAI,MAAM,iBAAiB,UAAU,WAAW,gBAAgB,CAAC;;CAIzE,OAAO;;;;AC9BR,MAAa,kBAAwC,EAAE,WACtD,EAAE,MAAM;CACP,EAAE,QAAQ;CACV,EAAE,QAAQ,CAAC,QAAQ;CACnB,EAAE,SAAS;CACX,EAAE,MAAM;CACR,EAAE,MAAM,gBAAgB;CACxB;CACA,CAAC,CACF;AAED,MAAa,mBAA0C,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB;AAE5F,SAAgB,aAAa,OAAqC;CACjE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAgB,iBAAiB,OAAgB,OAA2B;CAC3E,IAAI,CAAC,aAAa,MAAM,EACvB,MAAM,IAAI,MAAM,GAAG,MAAM,yBAAyB;CAGnD,OAAO,iBAAiB,MAAM,MAAM;;;;AC3BrC,MAAa,oBAAoB,EAAE,mBAAmB,UAAU,CAC/D,EACE,OAAO;CACP,QAAQ,EAAE,QAAQ,cAAc;CAChC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE;CACvB,CAAC,CACD,QAAQ,EACV,EACE,OAAO;CACP,QAAQ,EAAE,QAAQ,YAAY;CAC9B,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE;CACtB,CAAC,CACD,QAAQ,CACV,CAAC;;;ACVF,MAAM,6BAA6B,EACjC,OAAO,EACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU,EACrC,CAAC,CACD,QAAQ;AAEV,MAAM,gCAAgC,EACpC,OAAO;CACP,MAAM,EAAE,QAAQ,kBAAkB;CAClC,KAAK,EAAE,QAAQ,CAAC,KAAK;CACrB,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC;CAC5D,CAAC,CACD,QAAQ;AAEV,MAAM,qBAAqB,EACzB,OAAO;CACP,MAAM,EAAE,QAAQ,MAAM;CACtB,KAAK,EAAE,QAAQ,CAAC,KAAK;CACrB,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC;CAC5D,CAAC,CACD,QAAQ;AAEV,MAAM,uBAAuB,EAC3B,OAAO;CACP,MAAM,EAAE,QAAQ,QAAQ;CACxB,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;CACrC,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACjC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC;CACxD,CAAC,CACD,QAAQ;AAEV,MAAa,oBAAoB,EAC/B,OAAO;CACP,MAAM,EAAE,QAAQ,MAAM;CACtB,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC5B,WAAW,2BAA2B,QAAQ,EAAE,CAAC;CACjD,WAAW,EAAE,mBAAmB,QAAQ;EACvC;EACA;EACA;EACA,CAAC;CACF,CAAC,CACD,QAAQ;AAEV,MAAa,kBAAkB,EAC7B,OAAO;CACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACrC,eAAe,EAAE,QAAQ,EAAE;CAC3B,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC;CACrE,CAAC,CACD,QAAQ;AAqBV,eAAsB,cAAc,YAAwC;CAC3E,OAAO,gBAAgB,MAAM,MAAM,mBAAmB,WAAW,CAAC;;AAGnE,SAAgB,6BAA6B,QAAmD;CAC/F,OAAO,OAAO,OAAO,OAAO,UAAU,CAAC,KAAK,aAAa;EACxD,MAAM,YAAY,SAAS;EAC3B,IAAI,UAAU,SAAS,SAAS;GAC/B,MAAM,mBAOF;IACH,MAAM,UAAU;IAChB,SAAS,UAAU;IACnB,KAAK,UAAU;IACf,WAAW,SAAS;IACpB,WAAW,UAAU;IACrB;GACD,IAAI,UAAU,QAAQ,KAAA,GACrB,iBAAiB,MAAM,UAAU;GAElC,OAAO;;EAGR,OAAO;GACN,SAAS,UAAU;GACnB,WAAW,SAAS;GACpB,WAAW,UAAU;GACrB,KAAK,UAAU;GACf;GACA;;;;AClGH,SAAS,gBACR,WACA,WACA,UACU;CACV,OAAO,UAAU,MACf,aAAa,SAAS,cAAc,aAAa,SAAS,aAAa,SACxE;;AAGF,SAAS,6BACR,SACA,MACU;CACV,OACC,QAAQ,SAAS,qBAAqB,mCACtC,QAAQ,SAAS,4BAA4B,SAAS,KAAK,UAAU,IACrE,KAAK,aAAa,iBAAiB,QACnC,KAAK,YAAY,oBAAoB;;AAIvC,SAAgB,8BACf,SACA,MACU;CACV,IAAI,gBAAgB,QAAQ,SAAS,2BAA2B,KAAK,WAAW,KAAK,SAAS,EAC7F,OAAO;CAER,IAAI,QAAQ,SAAS,qBAAqB,2BACzC,OAAO;CAER,IACC,gBAAgB,QAAQ,SAAS,gBAAgB,KAAK,WAAW,KAAK,SAAS,IAC/E,gBAAgB,QAAQ,SAAS,YAAY,KAAK,WAAW,KAAK,SAAS,EAE3E,OAAO;CAER,OAAO,CAAC,6BAA6B,SAAS,KAAK;;;;AC9CpD,MAAa,yBAAyB,EACpC,OAAO;CACP,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC5B,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC3B,CAAC,CACD,QAAQ;AAIV,MAAa,6BAA6B,EACxC,OAAO;CACP,2BAA2B,EAAE,MAAM,uBAAuB,CAAC,QAAQ,EAAE,CAAC;CACtE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC,QAAQ,EAAE,CAAC;CAC3D,kBAAkB,EAChB,KAAK,CAAC,iCAAiC,0BAA0B,CAAC,CAClE,QAAQ,gCAAgC;CAC1C,6BAA6B,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;CACnE,YAAY,EAAE,MAAM,uBAAuB,CAAC,QAAQ,EAAE,CAAC;CACvD,CAAC,CACD,QAAQ;AAIV,MAAa,mCAAmC,EAC9C,OAAO;CACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACrC,mBAAmB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU;CACxD,yBAAyB,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU;CAC3F,wBAAwB,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU;CAC1F,SAAS,EACP,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,MAAM,EAAE,CAAC,CAC/C,QAAQ,CACR,UAAU;CACZ,eAAe,EACb,OAAO;EACP,SAAS,EAAE,SAAS,CAAC,QAAQ,KAAK;EAClC,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,GAAG;EACtD,CAAC,CACD,QAAQ,CACR,UAAU;CACZ,OAAO,EACL,OAAO,EACP,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,IAAO,EACzD,CAAC,CACD,QAAQ,CACR,UAAU;CACZ,UAAU,2BAA2B,UAAU;CAC/C,CAAC,CACD,QAAQ;AAIV,MAAa,iCAAiC,EAC5C,OAAO;CACP,mBAAmB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;CAC7C,yBAAyB,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;CAChF,wBAAwB,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;CAC/E,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ;CACpD,eAAe,EACb,OAAO;EACP,SAAS,EAAE,SAAS;EACpB,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;EAC1C,CAAC,CACD,QAAQ;CACV,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ;CACvE,UAAU;CACV,CAAC,CACD,QAAQ;AAIV,MAAM,8BAA8B,EAClC,OAAO;CACP,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE;CACvB,QAAQ;CACR,CAAC,CACD,QAAQ;AAEV,MAAa,wBAAwB,EACnC,OAAO;CACP,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,YAAY;CAC5C,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,MAAO,CAAC,QAAQ,MAAO;CACzD,cAAc;CACd,CAAC,CACD,QAAQ;AAIV,MAAa,6BAA6B,EACxC,OAAO;CACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,SAAS,kBAAkB,UAAU;CACrC,CAAC,CACD,QAAQ;AAIV,MAAa,wBAAwB,EACnC,OAAO;CACP,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACrC,eAAe,EAAE,QAAQ,EAAE;CAC3B,QAAQ;CACR,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,2BAA2B,CAAC,QAAQ,EAAE,CAAC;CAC3E,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,iCAAiC;CACvE,CAAC,CACD,QAAQ,CACR,aAAa,QAAQ,YAAY;CACjC,IAAI,OAAO,KAAK,OAAO,SAAS,CAAC,WAAW,GAC3C,QAAQ,SAAS;EAChB,MAAM,EAAE,aAAa;EACrB,SAAS;EACT,MAAM,CAAC,WAAW;EAClB,CAAC;EAEF;AAIH,MAAa,sCAAsC,EACjD,OAAO;CACP,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC5B,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACrC,CAAC,CACD,QAAQ;AAIV,MAAM,iBAA2C;CAChD,UAAU,2BAA2B,MAAM,EAAE,CAAC;CAC9C,OAAO,EAAE,cAAc,KAAQ;CAC/B,mBAAmB,EAAE;CACrB,yBAAyB,EAAE;CAC3B,wBAAwB,EAAE;CAC1B,SAAS,EAAE,SAAS,OAAO;CAC3B,eAAe;EAAE,SAAS;EAAM,eAAe;EAAI;CACnD;AAMD,eAAsB,oBAAoB,YAA8C;CACvF,OAAO,sBAAsB,MAAM,MAAM,mBAAmB,WAAW,CAAC;;AAGzE,SAAS,aACR,MACA,UAC2B;CAC3B,OAAO,+BAA+B,MAAM;EAC3C,UAAU,SAAS,YAAY,KAAK;EACpC,OAAO,SAAS,SAAS,KAAK;EAC9B,mBAAmB,SAAS,qBAAqB,KAAK;EACtD,yBAAyB,SAAS,2BAA2B,KAAK;EAClE,wBAAwB,SAAS,0BAA0B,KAAK;EAChE,SAAS,SAAS,WAAW,KAAK;EAClC,eAAe,SAAS,iBAAiB,KAAK;EAC9C,CAAC;;AAGH,SAAS,iCACR,QACA,aACA,OAC2B;CAC3B,MAAM,UAAU,OAAO,SAAS;CAChC,IAAI,YAAY,KAAA,GACf,MAAM,IAAI,MAAM,wBAAwB,YAAY,GAAG;CAExD,IAAI,MAAM,MAAM,SAAS,YAAY,EACpC,MAAM,IAAI,MAAM,kCAAkC,CAAC,GAAG,MAAM,OAAO,YAAY,CAAC,KAAK,OAAO,GAAG;CAShG,OAAO,aALN,QAAQ,YAAY,KAAA,IACjB,iBACA,iCAAiC,QAAQ,QAAQ,SAAS,EAC1D,OAAO,CAAC,GAAG,MAAM,OAAO,YAAY,EACpC,CAAC,EAC8B,QAAQ;;AAG5C,SAAgB,wBACf,QACA,aAC2B;CAC3B,OAAO,iCAAiC,QAAQ,aAAa,EAAE,OAAO,EAAE,EAAE,CAAC;;AAG5E,SAAgB,kCAAkC,QAA6B;CAC9E,IAAI,OAAO,WAAW,eACrB,OAAO,MAAM,OAAO,KAAK;CAE1B,OAAO,OAAO;;;;ACjMf,MAAa,gCAAgC;CAC5C,KAAK;CACL,WAAW;CACX;AAED,MAAa,2BAA2B;CACvC,KAAK;CACL,WAAW;CACX;AAED,MAAa,6BAA6B;CACzC,sBAAsB;CACtB,4BAA4B;CAC5B;AAOD,SAAS,aAAa,QAAiC,UAA2C;CACjG,OAAO;EACN,KAAK;EACL,GAAG;EACH;;AAGF,SAAgB,sCAAqE;CACpF,OAAO;EACN,KAAK,aACJ,IAAI,aAAa,iBAAiB,EAAE,QAAQ,YAAY,CAAC,EACzD,yBAAyB,IACzB;EACD,WAAW,aACV,IAAI,aAAa,uBAAuB,EAAE,QAAQ,YAAY,CAAC,EAC/D,yBAAyB,UACzB;EACD"}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@agent-vm/config-contracts",
+  "version": "0.0.59",
+  "description": "Shared agent-vm JSONC config schemas and TypeScript contracts.",
+  "homepage": "https://github.com/ShravanSunder/agent-vm#readme",
+  "bugs": {
+    "url": "https://github.com/ShravanSunder/agent-vm/issues"
+  },
+  "license": "MIT",
+  "author": "Shravan Sunder <ShravanSunder@users.noreply.github.com>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ShravanSunder/agent-vm.git",
+    "directory": "packages/config-contracts"
+  },
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "jsonc-parser": "^3.3.1",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "vitest": "^4.1.5"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run --root ../../ --config vitest.config.ts packages/config-contracts/src"
+  }
+}