@agent-vm/mcp-portal 0.0.69 → 0.0.71

package/dist/{typescript-artifact-BqU8okQy.js → zod-schema-loader-yNekKNpm.js}

@@ -1,5 +1,4 @@
 import { z } from "zod";
-import { createHash } from "node:crypto";
 //#region src/json-schema.ts
 const jsonValueSchema = z.lazy(() => z.union([
 	z.string(),
@@ -10,11 +9,11 @@ const jsonValueSchema = z.lazy(() => z.union([
 	jsonObjectSchema
 ]));
 const jsonObjectSchema = z.record(z.string(), jsonValueSchema);
-function isJsonObject(value) {
+function isJsonObject$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function assertJsonObject(value, label) {
-	if (!isJsonObject(value)) throw new Error(`${label} must be a JSON object.`);
+	if (!isJsonObject$1(value)) throw new Error(`${label} must be a JSON object.`);
 	return jsonObjectSchema.parse(value);
 }
 //#endregion
@@ -100,61 +99,92 @@ function decodeToolRef(toolRef) {
 	}
 }
 //#endregion
-//#region src/tool-vm/typescript-artifact.ts
-function toIdentifierPart(value) {
-	const words = value.split(/[^A-Za-z0-9]+/).filter(Boolean);
-	if (words.length === 0) return "tool";
-	return words.map((word) => word.slice(0, 1).toUpperCase() + word.slice(1)).join("");
+//#region src/zod-schema-loader.ts
+const unsupportedFeatures = new Set([
+	"contains",
+	"dependentSchemas",
+	"else",
+	"if",
+	"not",
+	"then",
+	"unevaluatedProperties",
+	"uniqueItems"
+]);
+function isJsonObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function shortToolRefHash(toolRef) {
-	return createHash("sha256").update(toolRef).digest("hex").slice(0, 8);
+function findUnsupportedFeature(value, path = []) {
+	if (Array.isArray(value)) {
+		for (const [index, childValue] of value.entries()) {
+			const childUnsupported = findUnsupportedFeature(childValue, [...path, index]);
+			if (childUnsupported) return childUnsupported;
+		}
+		return null;
+	}
+	if (!isJsonObject(value)) return null;
+	for (const [key, childValue] of Object.entries(value)) {
+		if (unsupportedFeatures.has(key)) return {
+			feature: key,
+			path: [...path, key]
+		};
+		const childUnsupported = findUnsupportedFeature(childValue, [...path, key]);
+		if (childUnsupported) return childUnsupported;
+	}
+	return null;
 }
-function toToolConstantName(tool) {
-	const identifier = `${toIdentifierPart(tool.namespace)}${toIdentifierPart(tool.toolName)}${shortToolRefHash(tool.toolRef)}Tool`;
-	return identifier.slice(0, 1).toLowerCase() + identifier.slice(1);
+function unavailableError(feature, path) {
+	return {
+		feature,
+		kind: "schema_validation_unavailable",
+		message: `JSON Schema feature "${feature}" is not supported by the portal validator.`,
+		path
+	};
 }
-function generateTypescriptCatalogArtifact(input) {
-	const catalogEntries = input.tools.map((tool) => portalToolRecordSchema.parse(tool)).toSorted((left, right) => {
-		const leftRef = encodeToolRef({
-			namespace: left.namespace,
-			toolName: left.toolName
-		});
-		const rightRef = encodeToolRef({
-			namespace: right.namespace,
-			toolName: right.toolName
-		});
-		return leftRef.localeCompare(rightRef);
-	}).map((tool) => Object.assign({}, tool, { toolRef: encodeToolRef({
-		namespace: tool.namespace,
-		toolName: tool.toolName
-	}) }));
-	const constants = catalogEntries.map((tool) => {
-		return `export const ${toToolConstantName(tool)} = requireCatalogTool(${JSON.stringify(tool.toolRef)});`;
-	}).join("\n");
-	return [
-		"// Generated by agent-vm-mcp-portal. JSON Schema is canonical; Zod is derived for runtime validation.",
-		"import * as z from 'zod';",
-		"",
-		`export const portalCatalog = ${JSON.stringify({ tools: catalogEntries }, null, "	")} as const;`,
-		"",
-		constants,
-		"",
-		"function requireCatalogTool(toolRef: string): (typeof portalCatalog.tools)[number] {",
-		"	const tool = portalCatalog.tools.find((catalogTool) => catalogTool.toolRef === toolRef);",
-		"	if (!tool) {",
-		"		throw new Error(`Unknown MCP portal toolRef: ${toolRef}`);",
-		"	}",
-		"	return tool;",
-		"}",
-		"",
-		"export function createInputValidator(toolRef: string): z.ZodType {",
-		"	const tool = requireCatalogTool(toolRef);",
-		"	return z.fromJSONSchema(tool.inputSchema);",
-		"}",
-		""
-	].join("\n");
+function toValidationIssue(issue) {
+	return {
+		code: issue.code,
+		message: issue.message,
+		path: issue.path.map((pathPart) => typeof pathPart === "symbol" ? String(pathPart) : pathPart)
+	};
+}
+function buildZodValidatorFromJsonSchema(jsonSchema) {
+	const unsupported = findUnsupportedFeature(jsonSchema);
+	if (unsupported) return {
+		error: unavailableError(unsupported.feature, unsupported.path),
+		ok: false
+	};
+	try {
+		const zodSchema = z.fromJSONSchema(jsonSchema);
+		return {
+			ok: true,
+			validate(value) {
+				const parsed = zodSchema.safeParse(value);
+				if (parsed.success) return {
+					ok: true,
+					value: parsed.data
+				};
+				return {
+					error: {
+						kind: "input_validation",
+						issues: parsed.error.issues.map((issue) => toValidationIssue(issue))
+					},
+					ok: false
+				};
+			}
+		};
+	} catch (error) {
+		return {
+			error: {
+				feature: "conversion_failed",
+				kind: "schema_validation_unavailable",
+				message: error instanceof Error ? error.message : String(error),
+				path: []
+			},
+			ok: false
+		};
+	}
 }
 //#endregion
-export { portalToolRecordSchema as a, isJsonObject as c, portalToolAnnotationsSchema as i, jsonObjectSchema as l, decodeToolRef as n, safeToolMetadataSchema as o, encodeToolRef as r, assertJsonObject as s, generateTypescriptCatalogArtifact as t, jsonValueSchema as u };
+export { portalToolRecordSchema as a, isJsonObject$1 as c, portalToolAnnotationsSchema as i, jsonObjectSchema as l, decodeToolRef as n, safeToolMetadataSchema as o, encodeToolRef as r, assertJsonObject as s, buildZodValidatorFromJsonSchema as t, jsonValueSchema as u };
 
-//# sourceMappingURL=typescript-artifact-BqU8okQy.js.map
+//# sourceMappingURL=zod-schema-loader-yNekKNpm.js.map

package/dist/zod-schema-loader-yNekKNpm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zod-schema-loader-yNekKNpm.js","names":["isJsonObject"],"sources":["../src/json-schema.ts","../src/catalog-types.ts","../src/tool-ref.ts","../src/zod-schema-loader.ts"],"sourcesContent":["import { z } from 'zod';\n\nexport type JsonPrimitive = boolean | null | number | string;\nexport type JsonArray = JsonValue[];\nexport type JsonObject = { [key: string]: JsonValue };\nexport type JsonValue = JsonArray | JsonObject | JsonPrimitive;\n\nexport const jsonValueSchema: z.ZodType<JsonValue> = z.lazy(() =>\n\tz.union([\n\t\tz.string(),\n\t\tz.number().finite(),\n\t\tz.boolean(),\n\t\tz.null(),\n\t\tz.array(jsonValueSchema),\n\t\tjsonObjectSchema,\n\t]),\n);\n\nexport const jsonObjectSchema: z.ZodType<JsonObject> = z.record(z.string(), jsonValueSchema);\n\nexport function isJsonObject(value: unknown): value is JsonObject {\n\treturn typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nexport function assertJsonObject(value: unknown, label: string): JsonObject {\n\tif (!isJsonObject(value)) {\n\t\tthrow new Error(`${label} must be a JSON object.`);\n\t}\n\n\treturn jsonObjectSchema.parse(value);\n}\n","import { z } from 'zod';\n\nimport { jsonObjectSchema, type JsonObject, type JsonValue } from './json-schema.js';\n\nconst forbiddenMetadataKeys = new Set([\n\t'agentid',\n\t'authprofile',\n\t'bindingid',\n\t'runid',\n\t'sessionid',\n]);\n\nfunction findForbiddenMetadataKey(value: JsonObject): string | null {\n\tconst stack: JsonValue[] = [value];\n\n\twhile (stack.length > 0) {\n\t\tconst current = stack.pop();\n\t\tif (!current) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (Array.isArray(current)) {\n\t\t\tstack.push(...current);\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (typeof current !== 'object' || current === null) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tfor (const [key, childValue] of Object.entries(current)) {\n\t\t\tif (forbiddenMetadataKeys.has(key.toLowerCase())) {\n\t\t\t\treturn key;\n\t\t\t}\n\t\t\tif (typeof childValue === 'object' && childValue !== null) {\n\t\t\t\tstack.push(childValue);\n\t\t\t}\n\t\t}\n\t}\n\n\treturn null;\n}\n\nexport const portalToolAnnotationsSchema = z\n\t.object({\n\t\tdestructiveHint: z.boolean().optional(),\n\t\tidempotentHint: z.boolean().optional(),\n\t\topenWorldHint: z.boolean().optional(),\n\t\treadOnlyHint: z.boolean().optional(),\n\t\ttitle: z.string().optional(),\n\t})\n\t.catchall(jsonObjectSchema.or(z.string()).or(z.number()).or(z.boolean()).or(z.null()))\n\t.optional();\n\nexport const safeToolMetadataSchema = jsonObjectSchema\n\t.optional()\n\t.superRefine((metadata, context) => {\n\t\tif (!metadata) {\n\t\t\treturn;\n\t\t}\n\n\t\tconst forbiddenKey = findForbiddenMetadataKey(metadata);\n\t\tif (forbiddenKey) {\n\t\t\tcontext.addIssue({\n\t\t\t\tcode: 'custom',\n\t\t\t\tmessage: `metadata contains forbidden key \"${forbiddenKey}\"`,\n\t\t\t});\n\t\t}\n\t});\n\nexport const portalToolRecordSchema = z\n\t.object({\n\t\tannotations: portalToolAnnotationsSchema,\n\t\tdescription: z.string().optional(),\n\t\tinputSchema: jsonObjectSchema,\n\t\tmetadata: safeToolMetadataSchema,\n\t\tnamespace: z.string().min(1),\n\t\toutputSchema: jsonObjectSchema.optional(),\n\t\ttitle: z.string().optional(),\n\t\ttoolName: z.string().min(1),\n\t})\n\t.strict();\n\nexport type PortalToolRecord = z.infer<typeof portalToolRecordSchema>;\nexport type PortalToolAnnotations = z.infer<typeof portalToolAnnotationsSchema>;\n","import { z } from 'zod';\n\nexport interface ToolIdentity {\n\treadonly namespace: string;\n\treadonly toolName: string;\n}\n\nconst toolIdentitySchema = z\n\t.object({\n\t\tnamespace: z.string().min(1),\n\t\ttoolName: z.string().min(1),\n\t})\n\t.strict();\nconst toolRefSchema = z.string().startsWith('mcp:').brand<'ToolRef'>();\n\nexport type ToolRef = z.infer<typeof toolRefSchema>;\n\nfunction decodeToolRefSegment(segment: string): string {\n\tif (!/^[A-Za-z0-9_-]+$/.test(segment)) {\n\t\tthrow new Error('Invalid MCP toolRef.');\n\t}\n\n\tconst decoded = Buffer.from(segment, 'base64url').toString('utf-8');\n\tconst canonicalSegment = Buffer.from(decoded, 'utf-8').toString('base64url');\n\tif (canonicalSegment !== segment) {\n\t\tthrow new Error('Invalid MCP toolRef.');\n\t}\n\n\treturn decoded;\n}\n\nexport function encodeToolRef(identity: ToolIdentity): ToolRef {\n\tconst parsed = toolIdentitySchema.parse(identity);\n\tconst encodedNamespace = Buffer.from(parsed.namespace, 'utf-8').toString('base64url');\n\tconst encodedToolName = Buffer.from(parsed.toolName, 'utf-8').toString('base64url');\n\n\treturn toolRefSchema.parse(`mcp:${encodedNamespace}:${encodedToolName}`);\n}\n\nexport function decodeToolRef(toolRef: string | ToolRef): ToolIdentity {\n\tconst [scheme, encodedNamespace, encodedToolName, ...extraParts] = toolRef.split(':');\n\tif (scheme !== 'mcp' || !encodedNamespace || !encodedToolName || extraParts.length > 0) {\n\t\tthrow new Error('Invalid MCP toolRef.');\n\t}\n\n\ttry {\n\t\treturn toolIdentitySchema.parse({\n\t\t\tnamespace: decodeToolRefSegment(encodedNamespace),\n\t\t\ttoolName: decodeToolRefSegment(encodedToolName),\n\t\t});\n\t} catch {\n\t\tthrow new Error('Invalid MCP toolRef.');\n\t}\n}\n","import { z } from 'zod';\n\nimport type { JsonObject, JsonValue } from './json-schema.js';\n\nexport interface InputValidationIssue {\n\treadonly code: string;\n\treadonly message: string;\n\treadonly path: readonly (number | string)[];\n}\n\nexport interface InputValidationError {\n\treadonly kind: 'input_validation';\n\treadonly issues: readonly InputValidationIssue[];\n}\n\nexport interface SchemaValidationUnavailableError {\n\treadonly feature: string;\n\treadonly kind: 'schema_validation_unavailable';\n\treadonly message: string;\n\treadonly path: readonly (number | string)[];\n}\n\nexport type PortalValidationResult =\n\t| { readonly ok: true; readonly value: unknown }\n\t| { readonly error: InputValidationError; readonly ok: false };\n\nexport type BuiltZodValidator =\n\t| {\n\t\t\treadonly ok: true;\n\t\t\treadonly validate: (value: unknown) => PortalValidationResult;\n\t  }\n\t| {\n\t\t\treadonly error: SchemaValidationUnavailableError;\n\t\t\treadonly ok: false;\n\t  };\n\ninterface UnsupportedFeature {\n\treadonly feature: string;\n\treadonly path: readonly (number | string)[];\n}\n\nconst unsupportedFeatures = new Set([\n\t'contains',\n\t'dependentSchemas',\n\t'else',\n\t'if',\n\t'not',\n\t'then',\n\t'unevaluatedProperties',\n\t'uniqueItems',\n]);\n\nfunction isJsonObject(value: JsonValue): value is JsonObject {\n\treturn typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction findUnsupportedFeature(\n\tvalue: JsonValue,\n\tpath: readonly (number | string)[] = [],\n): UnsupportedFeature | null {\n\tif (Array.isArray(value)) {\n\t\tfor (const [index, childValue] of value.entries()) {\n\t\t\tconst childUnsupported = findUnsupportedFeature(childValue, [...path, index]);\n\t\t\tif (childUnsupported) {\n\t\t\t\treturn childUnsupported;\n\t\t\t}\n\t\t}\n\t\treturn null;\n\t}\n\n\tif (!isJsonObject(value)) {\n\t\treturn null;\n\t}\n\n\tfor (const [key, childValue] of Object.entries(value)) {\n\t\tif (unsupportedFeatures.has(key)) {\n\t\t\treturn { feature: key, path: [...path, key] };\n\t\t}\n\t\tconst childUnsupported = findUnsupportedFeature(childValue, [...path, key]);\n\t\tif (childUnsupported) {\n\t\t\treturn childUnsupported;\n\t\t}\n\t}\n\n\treturn null;\n}\n\nfunction unavailableError(\n\tfeature: string,\n\tpath: readonly (number | string)[],\n): SchemaValidationUnavailableError {\n\treturn {\n\t\tfeature,\n\t\tkind: 'schema_validation_unavailable',\n\t\tmessage: `JSON Schema feature \"${feature}\" is not supported by the portal validator.`,\n\t\tpath,\n\t};\n}\n\nfunction toValidationIssue(issue: z.core.$ZodIssue): InputValidationIssue {\n\treturn {\n\t\tcode: issue.code,\n\t\tmessage: issue.message,\n\t\tpath: issue.path.map((pathPart) =>\n\t\t\ttypeof pathPart === 'symbol' ? String(pathPart) : pathPart,\n\t\t),\n\t};\n}\n\nexport function buildZodValidatorFromJsonSchema(jsonSchema: JsonObject): BuiltZodValidator {\n\tconst unsupported = findUnsupportedFeature(jsonSchema);\n\tif (unsupported) {\n\t\treturn {\n\t\t\terror: unavailableError(unsupported.feature, unsupported.path),\n\t\t\tok: false,\n\t\t};\n\t}\n\n\ttry {\n\t\tconst zodSchema = z.fromJSONSchema(jsonSchema);\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tvalidate(value: unknown): PortalValidationResult {\n\t\t\t\tconst parsed = zodSchema.safeParse(value);\n\t\t\t\tif (parsed.success) {\n\t\t\t\t\treturn { ok: true, value: parsed.data };\n\t\t\t\t}\n\n\t\t\t\treturn {\n\t\t\t\t\terror: {\n\t\t\t\t\t\tkind: 'input_validation',\n\t\t\t\t\t\tissues: parsed.error.issues.map((issue) => toValidationIssue(issue)),\n\t\t\t\t\t},\n\t\t\t\t\tok: false,\n\t\t\t\t};\n\t\t\t},\n\t\t};\n\t} catch (error) {\n\t\treturn {\n\t\t\terror: {\n\t\t\t\tfeature: 'conversion_failed',\n\t\t\t\tkind: 'schema_validation_unavailable',\n\t\t\t\tmessage: error instanceof Error ? error.message : String(error),\n\t\t\t\tpath: [],\n\t\t\t},\n\t\t\tok: false,\n\t\t};\n\t}\n}\n"],"mappings":";;AAOA,MAAa,kBAAwC,EAAE,WACtD,EAAE,MAAM;CACP,EAAE,QAAQ;CACV,EAAE,QAAQ,CAAC,QAAQ;CACnB,EAAE,SAAS;CACX,EAAE,MAAM;CACR,EAAE,MAAM,gBAAgB;CACxB;CACA,CAAC,CACF;AAED,MAAa,mBAA0C,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB;AAE5F,SAAgBA,eAAa,OAAqC;CACjE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAgB,iBAAiB,OAAgB,OAA2B;CAC3E,IAAI,CAACA,eAAa,MAAM,EACvB,MAAM,IAAI,MAAM,GAAG,MAAM,yBAAyB;CAGnD,OAAO,iBAAiB,MAAM,MAAM;;;;ACzBrC,MAAM,wBAAwB,IAAI,IAAI;CACrC;CACA;CACA;CACA;CACA;CACA,CAAC;AAEF,SAAS,yBAAyB,OAAkC;CACnE,MAAM,QAAqB,CAAC,MAAM;CAElC,OAAO,MAAM,SAAS,GAAG;EACxB,MAAM,UAAU,MAAM,KAAK;EAC3B,IAAI,CAAC,SACJ;EAGD,IAAI,MAAM,QAAQ,QAAQ,EAAE;GAC3B,MAAM,KAAK,GAAG,QAAQ;GACtB;;EAGD,IAAI,OAAO,YAAY,YAAY,YAAY,MAC9C;EAGD,KAAK,MAAM,CAAC,KAAK,eAAe,OAAO,QAAQ,QAAQ,EAAE;GACxD,IAAI,sBAAsB,IAAI,IAAI,aAAa,CAAC,EAC/C,OAAO;GAER,IAAI,OAAO,eAAe,YAAY,eAAe,MACpD,MAAM,KAAK,WAAW;;;CAKzB,OAAO;;AAGR,MAAa,8BAA8B,EACzC,OAAO;CACP,iBAAiB,EAAE,SAAS,CAAC,UAAU;CACvC,gBAAgB,EAAE,SAAS,CAAC,UAAU;CACtC,eAAe,EAAE,SAAS,CAAC,UAAU;CACrC,cAAc,EAAE,SAAS,CAAC,UAAU;CACpC,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,CAAC,CACD,SAAS,iBAAiB,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CACrF,UAAU;AAEZ,MAAa,yBAAyB,iBACpC,UAAU,CACV,aAAa,UAAU,YAAY;CACnC,IAAI,CAAC,UACJ;CAGD,MAAM,eAAe,yBAAyB,SAAS;CACvD,IAAI,cACH,QAAQ,SAAS;EAChB,MAAM;EACN,SAAS,oCAAoC,aAAa;EAC1D,CAAC;EAEF;AAEH,MAAa,yBAAyB,EACpC,OAAO;CACP,aAAa;CACb,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC,aAAa;CACb,UAAU;CACV,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC5B,cAAc,iBAAiB,UAAU;CACzC,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC3B,CAAC,CACD,QAAQ;;;AC1EV,MAAM,qBAAqB,EACzB,OAAO;CACP,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC5B,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC3B,CAAC,CACD,QAAQ;AACV,MAAM,gBAAgB,EAAE,QAAQ,CAAC,WAAW,OAAO,CAAC,OAAkB;AAItE,SAAS,qBAAqB,SAAyB;CACtD,IAAI,CAAC,mBAAmB,KAAK,QAAQ,EACpC,MAAM,IAAI,MAAM,uBAAuB;CAGxC,MAAM,UAAU,OAAO,KAAK,SAAS,YAAY,CAAC,SAAS,QAAQ;CAEnE,IADyB,OAAO,KAAK,SAAS,QAAQ,CAAC,SAAS,YAC5C,KAAK,SACxB,MAAM,IAAI,MAAM,uBAAuB;CAGxC,OAAO;;AAGR,SAAgB,cAAc,UAAiC;CAC9D,MAAM,SAAS,mBAAmB,MAAM,SAAS;CACjD,MAAM,mBAAmB,OAAO,KAAK,OAAO,WAAW,QAAQ,CAAC,SAAS,YAAY;CACrF,MAAM,kBAAkB,OAAO,KAAK,OAAO,UAAU,QAAQ,CAAC,SAAS,YAAY;CAEnF,OAAO,cAAc,MAAM,OAAO,iBAAiB,GAAG,kBAAkB;;AAGzE,SAAgB,cAAc,SAAyC;CACtE,MAAM,CAAC,QAAQ,kBAAkB,iBAAiB,GAAG,cAAc,QAAQ,MAAM,IAAI;CACrF,IAAI,WAAW,SAAS,CAAC,oBAAoB,CAAC,mBAAmB,WAAW,SAAS,GACpF,MAAM,IAAI,MAAM,uBAAuB;CAGxC,IAAI;EACH,OAAO,mBAAmB,MAAM;GAC/B,WAAW,qBAAqB,iBAAiB;GACjD,UAAU,qBAAqB,gBAAgB;GAC/C,CAAC;SACK;EACP,MAAM,IAAI,MAAM,uBAAuB;;;;;ACVzC,MAAM,sBAAsB,IAAI,IAAI;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,CAAC;AAEF,SAAS,aAAa,OAAuC;CAC5D,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;AAG5E,SAAS,uBACR,OACA,OAAqC,EAAE,EACX;CAC5B,IAAI,MAAM,QAAQ,MAAM,EAAE;EACzB,KAAK,MAAM,CAAC,OAAO,eAAe,MAAM,SAAS,EAAE;GAClD,MAAM,mBAAmB,uBAAuB,YAAY,CAAC,GAAG,MAAM,MAAM,CAAC;GAC7E,IAAI,kBACH,OAAO;;EAGT,OAAO;;CAGR,IAAI,CAAC,aAAa,MAAM,EACvB,OAAO;CAGR,KAAK,MAAM,CAAC,KAAK,eAAe,OAAO,QAAQ,MAAM,EAAE;EACtD,IAAI,oBAAoB,IAAI,IAAI,EAC/B,OAAO;GAAE,SAAS;GAAK,MAAM,CAAC,GAAG,MAAM,IAAI;GAAE;EAE9C,MAAM,mBAAmB,uBAAuB,YAAY,CAAC,GAAG,MAAM,IAAI,CAAC;EAC3E,IAAI,kBACH,OAAO;;CAIT,OAAO;;AAGR,SAAS,iBACR,SACA,MACmC;CACnC,OAAO;EACN;EACA,MAAM;EACN,SAAS,wBAAwB,QAAQ;EACzC;EACA;;AAGF,SAAS,kBAAkB,OAA+C;CACzE,OAAO;EACN,MAAM,MAAM;EACZ,SAAS,MAAM;EACf,MAAM,MAAM,KAAK,KAAK,aACrB,OAAO,aAAa,WAAW,OAAO,SAAS,GAAG,SAClD;EACD;;AAGF,SAAgB,gCAAgC,YAA2C;CAC1F,MAAM,cAAc,uBAAuB,WAAW;CACtD,IAAI,aACH,OAAO;EACN,OAAO,iBAAiB,YAAY,SAAS,YAAY,KAAK;EAC9D,IAAI;EACJ;CAGF,IAAI;EACH,MAAM,YAAY,EAAE,eAAe,WAAW;EAE9C,OAAO;GACN,IAAI;GACJ,SAAS,OAAwC;IAChD,MAAM,SAAS,UAAU,UAAU,MAAM;IACzC,IAAI,OAAO,SACV,OAAO;KAAE,IAAI;KAAM,OAAO,OAAO;KAAM;IAGxC,OAAO;KACN,OAAO;MACN,MAAM;MACN,QAAQ,OAAO,MAAM,OAAO,KAAK,UAAU,kBAAkB,MAAM,CAAC;MACpE;KACD,IAAI;KACJ;;GAEF;UACO,OAAO;EACf,OAAO;GACN,OAAO;IACN,SAAS;IACT,MAAM;IACN,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;IAC/D,MAAM,EAAE;IACR;GACD,IAAI;GACJ"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-vm/mcp-portal",
-  "version": "0.0.69",
+  "version": "0.0.71",
   "description": "Agent-scoped MCP Portal server and TypeScript helpers for composable upstream MCP tools.",
   "homepage": "https://github.com/ShravanSunder/agent-vm#readme",
   "bugs": {
@@ -14,8 +14,7 @@
     "directory": "packages/mcp-portal"
   },
   "bin": {
-    "agent-vm-mcp-portal": "./dist/bin/agent-vm-mcp-portal.js",
-    "agent-vm-mcp-portal-server": "./dist/bin/portal-server.js"
+    "mcp-portal": "./dist/bin/mcp-portal.js"
   },
   "files": [
     "dist"
@@ -28,17 +27,33 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
     },
-    "./tool-vm": {
-      "types": "./dist/tool-vm/index.d.ts",
-      "import": "./dist/tool-vm/index.js"
+    "./core": {
+      "types": "./dist/core/index.d.ts",
+      "import": "./dist/core/index.js"
     },
-    "./auth/hmac-token": {
-      "types": "./dist/auth/hmac-token.d.ts",
-      "import": "./dist/auth/hmac-token.js"
+    "./mcp-proxy": {
+      "types": "./dist/mcp-proxy/index.d.ts",
+      "import": "./dist/mcp-proxy/index.js"
     },
-    "./auth/hmac-env": {
-      "types": "./dist/auth/hmac-env.d.ts",
-      "import": "./dist/auth/hmac-env.js"
+    "./cli": {
+      "types": "./dist/cli/index.d.ts",
+      "import": "./dist/cli/index.js"
+    },
+    "./portal-config": {
+      "types": "./dist/portal-config/index.d.ts",
+      "import": "./dist/portal-config/index.js"
+    },
+    "./portal-auth/hmac-token": {
+      "types": "./dist/portal-auth/hmac-token.d.ts",
+      "import": "./dist/portal-auth/hmac-token.js"
+    },
+    "./portal-auth/hmac-env": {
+      "types": "./dist/portal-auth/hmac-env.d.ts",
+      "import": "./dist/portal-auth/hmac-env.js"
+    },
+    "./portal-auth/agent-bearer-token": {
+      "types": "./dist/portal-auth/agent-bearer-token.d.ts",
+      "import": "./dist/portal-auth/agent-bearer-token.js"
     },
     "./testing/fake-upstream-mcp-server": {
       "types": "./dist/testing/fake-upstream-mcp-server.d.ts",
@@ -49,11 +64,13 @@
     "access": "public"
   },
   "dependencies": {
+    "@hono/mcp": "^0.3.0",
     "@hono/node-server": "^2.0.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "hono": "^4.12.18",
     "zod": "^4.4.3",
-    "@agent-vm/config-contracts": "0.0.69"
+    "@agent-vm/config-contracts": "0.0.71",
+    "@agent-vm/secret-management": "0.0.71"
   },
   "devDependencies": {
     "vitest": "^4.1.5"

package/dist/bin/agent-vm-mcp-portal.d.ts

@@ -1,10 +0,0 @@
-import { n as PortalToolRecord } from "../catalog-types--gUGFPpN.js";
-
-//#region src/bin/agent-vm-mcp-portal.d.ts
-interface PortalCatalogFile {
-  readonly tools: readonly PortalToolRecord[];
-}
-declare function runAgentVmMcpPortal(args: readonly string[]): Promise<number>;
-//#endregion
-export { PortalCatalogFile, runAgentVmMcpPortal };
-//# sourceMappingURL=agent-vm-mcp-portal.d.ts.map

package/dist/bin/agent-vm-mcp-portal.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-vm-mcp-portal.d.ts","names":[],"sources":["../../src/bin/agent-vm-mcp-portal.ts"],"mappings":";;;UAgBiB,iBAAA;EAAA,SACP,KAAA,WAAgB,gBAAA;AAAA;AAAA,iBAyBJ,mBAAA,CAAoB,IAAA,sBAA0B,OAAA"}

package/dist/bin/agent-vm-mcp-portal.js

@@ -1,56 +0,0 @@
-#!/usr/bin/env node
-import { a as portalToolRecordSchema, t as generateTypescriptCatalogArtifact } from "../typescript-artifact-BqU8okQy.js";
-import { z } from "zod";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-//#region src/bin/agent-vm-mcp-portal.ts
-const catalogFileSchema = z.object({ tools: z.array(portalToolRecordSchema) }).strict();
-async function readCatalogFile(catalogPath) {
-	const rawCatalog = await readFile(catalogPath, "utf-8");
-	const parsedJson = JSON.parse(rawCatalog);
-	return catalogFileSchema.parse(parsedJson);
-}
-function parseOutputDirectory(args) {
-	const outputFlagIndex = args.indexOf("--out");
-	if (outputFlagIndex === -1) return null;
-	return args[outputFlagIndex + 1] ?? null;
-}
-function printUsage() {
-	process.stderr.write("Usage: agent-vm-mcp-portal validate <catalog.json>\n");
-	process.stderr.write("Usage: agent-vm-mcp-portal generate-helper <catalog.json> --out <directory>\n");
-}
-async function runAgentVmMcpPortal(args) {
-	const [command, catalogPath, ...restArgs] = args;
-	if (!command || !catalogPath) {
-		printUsage();
-		return 1;
-	}
-	try {
-		const catalog = await readCatalogFile(catalogPath);
-		switch (command) {
-			case "validate": return 0;
-			case "generate-helper": {
-				const outputDirectory = parseOutputDirectory(restArgs);
-				if (!outputDirectory) {
-					printUsage();
-					return 1;
-				}
-				await mkdir(outputDirectory, { recursive: true });
-				await writeFile(join(outputDirectory, "catalog.json"), JSON.stringify(catalog, null, "	"));
-				await writeFile(join(outputDirectory, "catalog.ts"), generateTypescriptCatalogArtifact(catalog));
-				return 0;
-			}
-			default:
-				printUsage();
-				return 1;
-		}
-	} catch (error) {
-		process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
-		return 1;
-	}
-}
-if (process.argv[1]?.endsWith("agent-vm-mcp-portal.js")) process.exitCode = await runAgentVmMcpPortal(process.argv.slice(2));
-//#endregion
-export { runAgentVmMcpPortal };
-
-//# sourceMappingURL=agent-vm-mcp-portal.js.map

package/dist/bin/agent-vm-mcp-portal.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-vm-mcp-portal.js","names":[],"sources":["../../src/bin/agent-vm-mcp-portal.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport { mkdir, readFile, writeFile } from 'node:fs/promises';\nimport { join } from 'node:path';\n\nimport { z } from 'zod';\n\nimport { portalToolRecordSchema, type PortalToolRecord } from '../catalog-types.js';\nimport { generateTypescriptCatalogArtifact } from '../tool-vm/typescript-artifact.js';\n\nconst catalogFileSchema = z\n\t.object({\n\t\ttools: z.array(portalToolRecordSchema),\n\t})\n\t.strict();\n\nexport interface PortalCatalogFile {\n\treadonly tools: readonly PortalToolRecord[];\n}\n\nasync function readCatalogFile(catalogPath: string): Promise<PortalCatalogFile> {\n\tconst rawCatalog = await readFile(catalogPath, 'utf-8');\n\tconst parsedJson = JSON.parse(rawCatalog) as unknown;\n\treturn catalogFileSchema.parse(parsedJson);\n}\n\nfunction parseOutputDirectory(args: readonly string[]): string | null {\n\tconst outputFlagIndex = args.indexOf('--out');\n\tif (outputFlagIndex === -1) {\n\t\treturn null;\n\t}\n\n\treturn args[outputFlagIndex + 1] ?? null;\n}\n\nfunction printUsage(): void {\n\tprocess.stderr.write('Usage: agent-vm-mcp-portal validate <catalog.json>\\n');\n\tprocess.stderr.write(\n\t\t'Usage: agent-vm-mcp-portal generate-helper <catalog.json> --out <directory>\\n',\n\t);\n}\n\nexport async function runAgentVmMcpPortal(args: readonly string[]): Promise<number> {\n\tconst [command, catalogPath, ...restArgs] = args;\n\tif (!command || !catalogPath) {\n\t\tprintUsage();\n\t\treturn 1;\n\t}\n\n\ttry {\n\t\tconst catalog = await readCatalogFile(catalogPath);\n\t\tswitch (command) {\n\t\t\tcase 'validate':\n\t\t\t\treturn 0;\n\t\t\tcase 'generate-helper': {\n\t\t\t\tconst outputDirectory = parseOutputDirectory(restArgs);\n\t\t\t\tif (!outputDirectory) {\n\t\t\t\t\tprintUsage();\n\t\t\t\t\treturn 1;\n\t\t\t\t}\n\n\t\t\t\tawait mkdir(outputDirectory, { recursive: true });\n\t\t\t\tawait writeFile(join(outputDirectory, 'catalog.json'), JSON.stringify(catalog, null, '\\t'));\n\t\t\t\tawait writeFile(\n\t\t\t\t\tjoin(outputDirectory, 'catalog.ts'),\n\t\t\t\t\tgenerateTypescriptCatalogArtifact(catalog),\n\t\t\t\t);\n\t\t\t\treturn 0;\n\t\t\t}\n\t\t\tdefault:\n\t\t\t\tprintUsage();\n\t\t\t\treturn 1;\n\t\t}\n\t} catch (error) {\n\t\tprocess.stderr.write(`${error instanceof Error ? error.message : String(error)}\\n`);\n\t\treturn 1;\n\t}\n}\n\nif (process.argv[1]?.endsWith('agent-vm-mcp-portal.js')) {\n\tprocess.exitCode = await runAgentVmMcpPortal(process.argv.slice(2));\n}\n"],"mappings":";;;;;;AAUA,MAAM,oBAAoB,EACxB,OAAO,EACP,OAAO,EAAE,MAAM,uBAAuB,EACtC,CAAC,CACD,QAAQ;AAMV,eAAe,gBAAgB,aAAiD;CAC/E,MAAM,aAAa,MAAM,SAAS,aAAa,QAAQ;CACvD,MAAM,aAAa,KAAK,MAAM,WAAW;CACzC,OAAO,kBAAkB,MAAM,WAAW;;AAG3C,SAAS,qBAAqB,MAAwC;CACrE,MAAM,kBAAkB,KAAK,QAAQ,QAAQ;CAC7C,IAAI,oBAAoB,IACvB,OAAO;CAGR,OAAO,KAAK,kBAAkB,MAAM;;AAGrC,SAAS,aAAmB;CAC3B,QAAQ,OAAO,MAAM,uDAAuD;CAC5E,QAAQ,OAAO,MACd,gFACA;;AAGF,eAAsB,oBAAoB,MAA0C;CACnF,MAAM,CAAC,SAAS,aAAa,GAAG,YAAY;CAC5C,IAAI,CAAC,WAAW,CAAC,aAAa;EAC7B,YAAY;EACZ,OAAO;;CAGR,IAAI;EACH,MAAM,UAAU,MAAM,gBAAgB,YAAY;EAClD,QAAQ,SAAR;GACC,KAAK,YACJ,OAAO;GACR,KAAK,mBAAmB;IACvB,MAAM,kBAAkB,qBAAqB,SAAS;IACtD,IAAI,CAAC,iBAAiB;KACrB,YAAY;KACZ,OAAO;;IAGR,MAAM,MAAM,iBAAiB,EAAE,WAAW,MAAM,CAAC;IACjD,MAAM,UAAU,KAAK,iBAAiB,eAAe,EAAE,KAAK,UAAU,SAAS,MAAM,IAAK,CAAC;IAC3F,MAAM,UACL,KAAK,iBAAiB,aAAa,EACnC,kCAAkC,QAAQ,CAC1C;IACD,OAAO;;GAER;IACC,YAAY;IACZ,OAAO;;UAED,OAAO;EACf,QAAQ,OAAO,MAAM,GAAG,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC,IAAI;EACnF,OAAO;;;AAIT,IAAI,QAAQ,KAAK,IAAI,SAAS,yBAAyB,EACtD,QAAQ,WAAW,MAAM,oBAAoB,QAAQ,KAAK,MAAM,EAAE,CAAC"}

package/dist/bin/portal-server.d.ts

@@ -1,55 +0,0 @@
-import { McpPortalAgentConfig, SecretValue } from "@agent-vm/config-contracts";
-import { serve } from "@hono/node-server";
-
-//#region src/bin/portal-server.d.ts
-type PortalServeFunction = typeof serve;
-type PortalServerLogEvent = {
-  readonly agentId: string;
-  readonly conservativeCallCount: number;
-  readonly event: 'conservative_approval_fallback';
-  readonly level: 'warn';
-  readonly primaryReason: string;
-  readonly strictCallCount: number;
-  readonly toolRefs: readonly string[];
-} | {
-  readonly event: 'server_error';
-  readonly level: 'error';
-  readonly message: string;
-  readonly stack?: string;
-};
-interface PortalServerLogger {
-  readonly log: (event: PortalServerLogEvent) => void;
-}
-interface PortalServerCliArgs {
-  readonly agentOverrides: readonly string[];
-  readonly configDir: string;
-  readonly port?: number;
-}
-interface StartPortalServerProps {
-  readonly args: PortalServerCliArgs;
-  readonly env: Readonly<Record<string, string | undefined>>;
-  readonly logger?: PortalServerLogger;
-  readonly resolveSecret?: (secret: SecretValue) => Promise<string>;
-  readonly serveFn?: PortalServeFunction;
-}
-declare function parsePortalServerCliArgs(argv: readonly string[]): PortalServerCliArgs;
-declare function applyAgentOverrides(agents: Readonly<Record<string, McpPortalAgentConfig>>, overrides: readonly string[]): Readonly<Record<string, McpPortalAgentConfig>>;
-interface DeferredPort {
-  readonly promise: Promise<number>;
-  readonly reject: (error: Error) => void;
-  readonly resolve: (port: number) => void;
-}
-declare function handlePortalServerError(props: {
-  readonly error: Error;
-  readonly hasListened: boolean;
-  readonly listeningPort: DeferredPort;
-  readonly logger: PortalServerLogger;
-}): void;
-declare function startPortalServer(props: StartPortalServerProps): Promise<{
-  readonly close: () => Promise<void>;
-  readonly port: number;
-}>;
-declare function isPortalServerEntrypoint(importMetaUrl: string, argvEntryPath: string | undefined, realpathFn?: (targetPath: string) => Promise<string>): Promise<boolean>;
-//#endregion
-export { DeferredPort, PortalServerCliArgs, PortalServerLogEvent, PortalServerLogger, StartPortalServerProps, applyAgentOverrides, handlePortalServerError, isPortalServerEntrypoint, parsePortalServerCliArgs, startPortalServer };
-//# sourceMappingURL=portal-server.d.ts.map

package/dist/bin/portal-server.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"portal-server.d.ts","names":[],"sources":["../../src/bin/portal-server.ts"],"mappings":";;;;KAqCK,mBAAA,UAA6B,KAAA;AAAA,KAEtB,oBAAA;EAAA,SAEA,OAAA;EAAA,SACA,qBAAA;EAAA,SACA,KAAA;EAAA,SACA,KAAA;EAAA,SACA,aAAA;EAAA,SACA,eAAA;EAAA,SACA,QAAA;AAAA;EAAA,SAGA,KAAA;EAAA,SACA,KAAA;EAAA,SACA,OAAA;EAAA,SACA,KAAA;AAAA;AAAA,UAGK,kBAAA;EAAA,SACP,GAAA,GAAM,KAAA,EAAO,oBAAA;AAAA;AAAA,UAGN,mBAAA;EAAA,SACP,cAAA;EAAA,SACA,SAAA;EAAA,SACA,IAAA;AAAA;AAAA,UAGO,sBAAA;EAAA,SACP,IAAA,EAAM,mBAAA;EAAA,SACN,GAAA,EAAK,QAAA,CAAS,MAAA;EAAA,SACd,MAAA,GAAS,kBAAA;EAAA,SACT,aAAA,IAAiB,MAAA,EAAQ,WAAA,KAAgB,OAAA;EAAA,SACzC,OAAA,GAAU,mBAAA;AAAA;AAAA,iBAoBJ,wBAAA,CAAyB,IAAA,sBAA0B,mBAAA;AAAA,iBAuBnD,mBAAA,CACf,MAAA,EAAQ,QAAA,CAAS,MAAA,SAAe,oBAAA,IAChC,SAAA,sBACE,QAAA,CAAS,MAAA,SAAe,oBAAA;AAAA,UAsBV,YAAA;EAAA,SACP,OAAA,EAAS,OAAA;EAAA,SACT,MAAA,GAAS,KAAA,EAAO,KAAA;EAAA,SAChB,OAAA,GAAU,IAAA;AAAA;AAAA,iBAmCJ,uBAAA,CAAwB,KAAA;EAAA,SAC9B,KAAA,EAAO,KAAA;EAAA,SACP,WAAA;EAAA,SACA,aAAA,EAAe,YAAA;EAAA,SACf,MAAA,EAAQ,kBAAA;AAAA;AAAA,iBAiHI,iBAAA,CACrB,KAAA,EAAO,sBAAA,GACL,OAAA;EAAA,SAAmB,KAAA,QAAa,OAAA;EAAA,SAAwB,IAAA;AAAA;AAAA,iBAiHrC,wBAAA,CACrB,aAAA,UACA,aAAA,sBACA,UAAA,IAAa,UAAA,aAAuB,OAAA,WAClC,OAAA"}