@aventara/core 1.0.0-rc.0 → 1.0.0-rc.1

package/dist/compiler/field-validator.compiler.js

@@ -0,0 +1,238 @@
+import { avzCheckOf, } from "../avz/avz-check.registry.js";
+import { FIELD_CHECK_SUBJECTS, } from "../runtime/field-check.evaluator.js";
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function own(record, key) {
+    return Object.hasOwn(record, key) ? record[key] : undefined;
+}
+function scalarOf(field) {
+    const type = field.type;
+    return typeof type?.scalar === "string" ? type.scalar : undefined;
+}
+function subjectOf(field) {
+    const scalar = scalarOf(field);
+    return scalar === undefined ? undefined : own(FIELD_CHECK_SUBJECTS, scalar);
+}
+function describeField(field) {
+    const scalar = scalarOf(field) ?? "enum";
+    const noun = `${scalar}${field.list === true ? " list" : ""} field`;
+    return `${/^[aeiou]/.test(scalar) ? "an" : "a"} ${noun}`;
+}
+function describeCheck(check) {
+    switch (check.check) {
+        case "less_than":
+            return check.inclusive ? "AvZ.lte" : "AvZ.lt";
+        case "greater_than":
+            return check.inclusive ? "AvZ.gte" : "AvZ.gt";
+        case "multiple_of":
+            return "AvZ.multipleOf";
+        case "max_length":
+            return check.list === true ? "AvZ.maxItems" : "AvZ.maxLength";
+        case "min_length":
+            return check.list === true ? "AvZ.minItems" : "AvZ.minLength";
+        case "length_equals":
+            return "AvZ.length";
+        case "string_format":
+            return `a string format check (${check.format})`;
+        case "max_size":
+            return "AvZ.maxSize";
+        case "min_size":
+            return "AvZ.minSize";
+        case "size_equals":
+            return "AvZ.size";
+    }
+}
+function boundFor(value, subject, multiple) {
+    switch (subject) {
+        case "number":
+            return typeof value === "number"
+                ? { value }
+                : { fault: "an int or float field's bound is a number" };
+        case "decimal":
+            return value instanceof Date
+                ? { fault: "a decimal field's bound is a number or a bigint" }
+                : { value: String(value) };
+        case "bigint":
+            return typeof value === "bigint" ||
+                (typeof value === "number" && Number.isSafeInteger(value))
+                ? { value: String(value) }
+                : { fault: "a bigint field's bound is a bigint" };
+        case "datetime":
+            return multiple
+                ? { fault: "a datetime takes bounds, not multiples" }
+                : value instanceof Date
+                    ? { value: value.toISOString() }
+                    : { fault: "a datetime field's bound is a Date" };
+        default:
+            return {
+                fault: "bounds apply to number, bigint, decimal and datetime fields",
+            };
+    }
+}
+function compileCheck(check, field) {
+    const subject = subjectOf(field);
+    switch (check.check) {
+        case "less_than":
+        case "greater_than":
+        case "multiple_of": {
+            const written = boundFor(check.value, subject, check.check === "multiple_of");
+            if ("fault" in written) {
+                return written;
+            }
+            return {
+                check: check.check === "multiple_of"
+                    ? { check: "multiple_of", value: written.value }
+                    : {
+                        check: check.check,
+                        value: written.value,
+                        inclusive: check.inclusive,
+                    },
+            };
+        }
+        case "max_length":
+        case "min_length":
+            if (check.list === true) {
+                return field.list === true
+                    ? { check }
+                    : {
+                        fault: "AvZ.minItems and AvZ.maxItems check a list's length; the field is not a list",
+                    };
+            }
+            return subject === "string"
+                ? { check }
+                : { fault: "length checks apply to string fields" };
+        case "length_equals":
+        case "string_format":
+            return subject === "string"
+                ? { check }
+                : { fault: "string checks apply to string fields" };
+        case "max_size":
+        case "min_size":
+        case "size_equals":
+            return subject === "bytes"
+                ? { check }
+                : { fault: "size checks apply to bytes fields" };
+    }
+}
+function label(resource, field) {
+    return `${resource}.${field}`;
+}
+export function checkLayerValidators(resources, layer, tree, diagnostics) {
+    if (!isRecord(tree)) {
+        return;
+    }
+    for (const [resourceName, entry] of Object.entries(tree)) {
+        const resource = own(resources, resourceName);
+        if (resource === undefined || !isRecord(entry) || !isRecord(entry.fields)) {
+            continue;
+        }
+        for (const [fieldName, fieldEntry] of Object.entries(entry.fields)) {
+            const field = own(resource.fields, fieldName);
+            if (field === undefined ||
+                !isRecord(fieldEntry) ||
+                !isRecord(fieldEntry.pipelines) ||
+                !Object.hasOwn(fieldEntry.pipelines, "validators")) {
+                continue;
+            }
+            const path = `${layer}.resources.${resourceName}.fields.${fieldName}.pipelines.validators`;
+            const refuse = (at, message) => diagnostics.push({
+                code: "COMPILER_INVALID_VALIDATOR",
+                path: at,
+                message,
+            });
+            if (field.kind === "relation") {
+                refuse(path, `relation field "${label(resourceName, fieldName)}" takes write guards only; validators check a scalar field's value`);
+                continue;
+            }
+            if (scalarOf(field) === "json") {
+                refuse(path, `field "${label(resourceName, fieldName)}" is a Json field: Json fields carry their checks in definition.json (AvZ.string().check(AvZ.maxLength(80)), …)`);
+                continue;
+            }
+            const validators = fieldEntry.pipelines.validators;
+            if (!Array.isArray(validators)) {
+                continue;
+            }
+            for (const [index, value] of validators.entries()) {
+                const at = `${path}[${index}]`;
+                const check = avzCheckOf(value);
+                if (check === undefined) {
+                    refuse(at, `field "${label(resourceName, fieldName)}": a validator must be a check built with AvZ from "@aventara/core/avz" (AvZ.maxLength(80), AvZ.email(), …); a Zod check or any other value is not accepted`);
+                    continue;
+                }
+                const compiled = compileCheck(check, field);
+                if ("fault" in compiled) {
+                    refuse(at, `${describeCheck(check)} does not fit field "${label(resourceName, fieldName)}", ${describeField(field)}: ${compiled.fault}`);
+                }
+            }
+        }
+    }
+}
+export function compileValidatorTable(resources, tree) {
+    const table = {};
+    for (const [resourceName, pipelines] of Object.entries(tree.resources)) {
+        const resource = own(resources, resourceName);
+        if (resource === undefined) {
+            continue;
+        }
+        for (const [fieldName, field] of Object.entries(resource.fields)) {
+            const stages = own(pipelines.fields, fieldName);
+            if (stages === undefined ||
+                field.kind !== "scalar" ||
+                scalarOf(field) === "json" ||
+                stages.validators.length === 0) {
+                continue;
+            }
+            const checks = stages.validators.flatMap((value) => {
+                const check = avzCheckOf(value);
+                const compiled = check === undefined ? undefined : compileCheck(check, field);
+                return compiled !== undefined && "check" in compiled
+                    ? [compiled.check]
+                    : [];
+            });
+            if (checks.length > 0) {
+                table[resourceName] ??= {};
+                table[resourceName][fieldName] = {
+                    checks,
+                    subject: subjectOf(field),
+                    list: field.list === true,
+                };
+            }
+        }
+    }
+    return table;
+}
+export function applyValidators(resources, table) {
+    for (const [resourceName, fields] of Object.entries(table)) {
+        const resource = own(resources, resourceName);
+        for (const [fieldName, compiled] of Object.entries(fields)) {
+            const field = resource === undefined ? undefined : own(resource.fields, fieldName);
+            if (field !== undefined && field.kind === "scalar") {
+                field.validators = compiled.checks.map((check) => ({ ...check }));
+            }
+        }
+    }
+}
+const tables = new WeakMap();
+export function bindFieldValidators(contract, table) {
+    tables.set(contract, table);
+}
+const shaped = new WeakMap();
+function hasShapedField(contract) {
+    let found = shaped.get(contract);
+    if (found === undefined) {
+        found = Object.values(contract.resources).some((resource) => Object.values(resource.fields).some((field) => field.kind === "scalar" && field.json !== undefined));
+        shaped.set(contract, found);
+    }
+    return found;
+}
+export function hasFieldValidators(contract) {
+    const table = tables.get(contract);
+    return ((table !== undefined && Object.keys(table).length > 0) ||
+        hasShapedField(contract));
+}
+const NO_FIELDS = Object.freeze({});
+export function validatedFieldsOf(contract, resource) {
+    const table = tables.get(contract);
+    return (table === undefined ? undefined : own(table, resource)) ?? NO_FIELDS;
+}

package/dist/config/any-framework-config.d.ts

@@ -1,19 +1,26 @@
-/** A `fields` block whose resource and field names are both unconstrained. */
-export type AnyFieldsBlock = Readonly<Record<string, Readonly<Record<string, unknown>> | undefined>>;
-/** The widest scope overlay: a `fields` block, and anything else. */
-export type AnyScopeConfig = {
+/**
+ * A `resources` block whose Resource and field names are both unconstrained:
+ * each Resource entry may carry a `fields` record of any names.
+ */
+export type AvConfigResourcesAny = Readonly<Record<string, {
     readonly [key: string]: unknown;
-    readonly fields?: AnyFieldsBlock;
+    readonly fields?: Readonly<Record<string, unknown>> | undefined;
+} | undefined>>;
+/** The widest layer overlay: a `resources` block, and anything else. */
+export type AvConfigLayerAny = {
+    readonly [key: string | symbol]: unknown;
+    readonly resources?: AvConfigResourcesAny;
 };
 /**
- * The widest configuration type: every resource admits every field name. It
- * is the default `Cfg` of `FrameworkConfig`, `Framework` and
+ * The widest configuration type: every Resource admits every field name. It
+ * is the default `Cfg` of `AvConfig`, `AvFramework` and
  * `createFramework`; pass your own configuration's type instead to get field
  * names checked.
  */
-export type AnyFrameworkConfig = {
-    readonly [key: string]: unknown;
-    readonly fields?: AnyFieldsBlock;
-    readonly application?: AnyScopeConfig;
-    readonly client?: AnyScopeConfig;
+export type AvConfigAny = {
+    readonly [key: string | symbol]: unknown;
+    readonly resources?: AvConfigResourcesAny;
+    readonly application?: AvConfigLayerAny;
+    readonly client?: AvConfigLayerAny;
+    readonly agent?: AvConfigLayerAny;
 };

package/dist/config/config-diagnostic.d.ts

@@ -1,8 +1,15 @@
-/** Codes of {@link ConfigDiagnostic}. */
-export type ConfigDiagnosticCode = "CONFIG_REQUIRED" | "CONFIG_UNKNOWN_PROPERTY" | "CONFIG_INVALID_TYPE" | "CONFIG_INVALID_VALUE";
+/** Codes of {@link AvConfigDiagnostic}. */
+export type AvConfigDiagnosticCode = "CONFIG_REQUIRED" | "CONFIG_UNKNOWN_PROPERTY" | "CONFIG_INVALID_TYPE" | "CONFIG_INVALID_VALUE"
+/** An rc.0 key that moved in rc.1; the message names where it lives now. */
+ | "CONFIG_MOVED_PROPERTY"
+/**
+ * A key only the root may hold, written in `application`, `client` or `agent`: a field's
+ * `definition` is the root's, and an overlay only chooses its visibility.
+ */
+ | "CONFIG_FORBIDDEN_IN_OVERLAY";
 /** One problem found in a configuration, at its path. */
-export type ConfigDiagnostic = {
-    readonly code: ConfigDiagnosticCode;
+export type AvConfigDiagnostic = {
+    readonly code: AvConfigDiagnosticCode;
     readonly path: string;
     readonly message: string;
 };

package/dist/config/config-layer.d.ts

@@ -1,12 +1,21 @@
 /**
  * One layer of the configuration: `root` is the configuration's own top level
  * and compiles to the Core Contract; `application` and `client` are overlays
- * on top of it and compile to the Application and Client Contracts.
+ * on top of it and compile to the Application and Client Contracts; `agent`
+ * narrows the layer it extends and compiles to the Agent Contract.
  */
-export type ConfigLayer = "root" | "application" | "client";
+export type AvConfigLayerName = "root" | "application" | "client" | "agent";
 /**
- * The layers a request can come from: `application` (in-process calls) or
- * `client` (remote calls). Each sees the root configuration plus its own
- * overlay.
+ * The layers a request can come from: `application` (in-process calls),
+ * `client` (remote calls) or `agent` (calls an AI agent makes over MCP). Each
+ * sees the root configuration plus its own layer, and `agent` the layer it
+ * extends between the two.
  */
-export type RequestOrigin = Exclude<ConfigLayer, "root">;
+export type AvRequestOrigin = Exclude<AvConfigLayerName, "root">;
+/**
+ * The layer the `agent` layer starts from (its `extends`): its final view is
+ * the agent's parent, and its pipelines run before the agent's.
+ */
+export type AvConfigAgentParent = Exclude<AvConfigLayerName, "agent">;
+/** The origins whose requests carry a protocol identity: remote callers. */
+export type RemoteRequestOrigin = Exclude<AvRequestOrigin, "application">;

package/dist/config/config.resolver.d.ts

@@ -1,38 +1,81 @@
-import type { Adapter } from "../adapters/adapter.interface.js";
-import type { AdapterModel } from "../adapters/adapter-model.js";
-import type { TransactionCapability } from "../contracts/transaction-capability.js";
-import type { FrameworkDiagnosticsSink } from "../runtime/diagnostics-reporter.js";
-import type { FrameworkMisuseSink } from "../runtime/misuse-reporter.js";
-import type { FrameworkBehaviorsConfig } from "./framework-behaviors-config.js";
-import type { FrameworkConfig, FrameworkLimitsConfig } from "./framework-config.js";
-import type { FrameworkFieldsConfig } from "./framework-fields-config.js";
-import type { FrameworkRestrictionsConfig } from "./framework-restrictions-config.js";
-import type { ResolvedPipelineConfig } from "./pipeline-config.js";
-/** One resolved layer of the configuration: root, application or client. */
-export type ResolvedFrameworkScopeConfig<M extends AdapterModel = AdapterModel> = {
-    readonly fields: FrameworkFieldsConfig<M> | undefined;
-    /** The behaviors configuration, with Resource and field keys as plain strings. */
-    readonly behaviors: FrameworkBehaviorsConfig | undefined;
-    readonly restrictions: FrameworkRestrictionsConfig<M> | undefined;
-    readonly limits: FrameworkLimitsConfig | undefined;
-    readonly pipelines: ResolvedPipelineConfig;
-    readonly transactions: TransactionCapability | undefined;
+import type { AvAdapter } from "../adapters/adapter.interface.js";
+import type { AvAdapterModel } from "../adapters/adapter-model.js";
+import type { AvTransactionCapability } from "../contracts/transaction-capability.js";
+import type { AvDiagnosticsSink } from "../runtime/diagnostics-reporter.js";
+import type { AvMisuseSink } from "../runtime/misuse-reporter.js";
+import type { AvConfigAgentParent } from "./config-layer.js";
+import { type ResolvedComputeConfig } from "./field-compute.resolver.js";
+import type { AvConfig, AvConfigLimits } from "./framework-config.js";
+import type { AvConfigFieldDefinition } from "./framework-field-definition.js";
+import { type ResolvedPipelineTree } from "./pipeline-tree.resolver.js";
+/** The root's field definitions, by Resource and field name. */
+export type ResolvedFieldDefinitions = Readonly<Record<string, Readonly<Record<string, AvConfigFieldDefinition>>>>;
+/** One resolved layer of the configuration: root, application, client or agent. */
+export type ResolvedFrameworkLayerConfig = {
+    /** The compute stages that run for this layer's operations, chained root first. */
+    readonly compute: ResolvedComputeConfig;
+    /**
+     * Whether this layer's exemptions hide (`true`, the root's default) or grant
+     * (`false`); `undefined` for an overlay that states none, which keeps the
+     * root's view.
+     */
+    readonly exposed: boolean | undefined;
+    /** This layer's own `exemptions`, as authored; the compiler checks every name. */
+    readonly exemptions: unknown;
+    readonly limits: AvConfigLimits | undefined;
+    /**
+     * Every stage that runs for this layer's operations, level by level: the root's
+     * registrations, then the overlay's, at each level.
+     */
+    readonly pipelines: ResolvedPipelineTree;
+    readonly transactionsStyle: AvTransactionCapability | undefined;
+};
+/**
+ * The MCP endpoint a Framework serves (`mcp` resolved): its mount path in
+ * canonical form, and the authorization its callers present, when it has one.
+ */
+export type AvMcpEndpoint = {
+    /** The mount path in its canonical form, as `framework.api` is. */
+    readonly path: string;
+    readonly authorization?: {
+        readonly servers: readonly string[];
+        readonly verify: (token: string) => unknown | null | Promise<unknown | null>;
+    };
+};
+/** The agent layer resolved: a layer, and the layer it extends. */
+export type ResolvedAgentLayerConfig = ResolvedFrameworkLayerConfig & {
+    /** The layer whose final view the agent narrows (`extends`; `"client"` when left out). */
+    readonly parent: AvConfigAgentParent;
+    /** Whether the configuration states `agent` or `mcp`. */
+    readonly stated: boolean;
 };
 /** A configuration after defaults and overlays are resolved, before compilation. */
-export type ResolvedFrameworkConfig<M extends AdapterModel = AdapterModel> = {
+export type ResolvedFrameworkConfig<M extends AvAdapterModel = AvAdapterModel> = {
     /**
-     * The mount path in its canonical form: `""` at the root, otherwise
-     * `/seg(/seg)*`.
+     * The protocol's mount path (`api`) in its canonical form: `""` at the
+     * root, otherwise `/seg(/seg)*`.
      */
-    readonly entrypoint: string;
-    readonly adapter: Adapter<M>;
+    readonly api: string;
+    /** The MCP endpoint, when `mcp` turns it on. */
+    readonly mcp: AvMcpEndpoint | undefined;
+    readonly adapter: AvAdapter<M>;
     /** The diagnostics sink, from the root configuration only. */
-    readonly diagnostics: FrameworkDiagnosticsSink | undefined;
+    readonly diagnostics: AvDiagnosticsSink | undefined;
     /** The misuse sink, from the root configuration only. */
-    readonly misuse: FrameworkMisuseSink | undefined;
-    readonly root: ResolvedFrameworkScopeConfig<M>;
-    readonly application: ResolvedFrameworkScopeConfig<M>;
-    readonly client: ResolvedFrameworkScopeConfig<M>;
+    readonly misuse: AvMisuseSink | undefined;
+    /** Every field definition, from the root only; the same for all three layers. */
+    readonly definitions: ResolvedFieldDefinitions;
+    /** Each layer's `resources` tree as authored: the compiler checks its names. */
+    readonly trees: {
+        readonly root: unknown;
+        readonly application: unknown;
+        readonly client: unknown;
+        readonly agent: unknown;
+    };
+    readonly root: ResolvedFrameworkLayerConfig;
+    readonly application: ResolvedFrameworkLayerConfig;
+    readonly client: ResolvedFrameworkLayerConfig;
+    readonly agent: ResolvedAgentLayerConfig;
 };
-/** Resolve root, application, and client configuration without compiling Contracts. */
-export declare function resolveFrameworkConfig<M extends AdapterModel>(config: FrameworkConfig<M>): ResolvedFrameworkConfig<M>;
+/** Resolve every layer of the configuration without compiling Contracts. */
+export declare function resolveFrameworkConfig<M extends AvAdapterModel>(config: AvConfig<M>): ResolvedFrameworkConfig<M>;

package/dist/config/config.resolver.js

@@ -1,6 +1,8 @@
-import { FrameworkConstructionError } from "../framework/framework-construction.error.js";
-import { entrypointRefusalDiagnostic } from "./config.validator.js";
+import { AvConstructionError } from "../framework/framework-construction.error.js";
+import { mountPathRefusalDiagnostic } from "./config.validator.js";
 import { normalizeEntrypoint } from "./entrypoint.normalizer.js";
+import { chainCompute, computeOfLayer, } from "./field-compute.resolver.js";
+import { resolvePipelineTree, } from "./pipeline-tree.resolver.js";
 const hasOwn = (value, key) => Object.hasOwn(value, key);
 function isPlainRecord(value) {
     if (value === null || typeof value !== "object" || Array.isArray(value)) {
@@ -39,7 +41,7 @@ function resolveRecord(root, scoped) {
     }
     return result;
 }
-function resolveProperty(root, scoped, key) {
+function resolveOverride(root, scoped, key) {
     if (scoped === undefined || !hasOwn(scoped, key)) {
         return cloneConfigValue(root[key]);
     }
@@ -49,63 +51,125 @@ function resolveProperty(root, scoped, key) {
         ? resolveRecord(rootValue, scopedValue)
         : cloneConfigValue(scopedValue);
 }
-function resolvePipelines(root, scoped) {
+function resolveLayer(root, rootCompute, overlay, scoped) {
     return {
-        guards: [...(root?.guards ?? []), ...(scoped?.guards ?? [])],
-        pipes: [...(root?.pipes ?? []), ...(scoped?.pipes ?? [])],
-        hooks: {
-            before: [
-                ...(root?.hooks?.before ?? []),
-                ...(scoped?.hooks?.before ?? []),
-            ],
-            after: [...(root?.hooks?.after ?? []), ...(scoped?.hooks?.after ?? [])],
-        },
-        interceptors: [
-            ...(root?.interceptors ?? []),
-            ...(scoped?.interceptors ?? []),
-        ],
-        filters: [...(root?.filters ?? []), ...(scoped?.filters ?? [])],
+        compute: scoped === undefined
+            ? rootCompute
+            : chainCompute(rootCompute, computeOfLayer(scoped.resources)),
+        exposed: overlay
+            ? scoped?.exposed
+            : (root.exposed ?? true),
+        exemptions: overlay ? scoped?.exemptions : root.exemptions,
+        limits: resolveOverride(root, scoped, "limits"),
+        transactionsStyle: resolveOverride(root, scoped, "transactionsStyle"),
+        pipelines: scoped === undefined
+            ? resolvePipelineTree([root])
+            : resolvePipelineTree([root, scoped]),
     };
 }
-function resolveScope(root, scoped) {
+function resolveAgentLayer(root, parentName, parentOverlay, parent, agent, stated) {
+    const effective = {
+        limits: parent.limits,
+        transactionsStyle: parent.transactionsStyle,
+    };
+    const chain = [root];
+    if (parentName !== "root" && parentOverlay !== undefined) {
+        chain.push(parentOverlay);
+    }
+    if (agent !== undefined) {
+        chain.push(agent);
+    }
     return {
-        fields: resolveProperty(root, scoped, "fields"),
-        behaviors: resolveProperty(root, scoped, "behaviors"),
-        restrictions: resolveProperty(root, scoped, "restrictions"),
-        limits: resolveProperty(root, scoped, "limits"),
-        transactions: resolveProperty(root, scoped, "transactions"),
-        pipelines: resolvePipelines(root.pipelines, scoped?.pipelines),
+        parent: parentName,
+        stated,
+        compute: agent === undefined
+            ? parent.compute
+            : chainCompute(parent.compute, computeOfLayer(agent.resources)),
+        exposed: agent?.exposed,
+        exemptions: agent?.exemptions,
+        limits: resolveOverride(effective, agent, "limits"),
+        transactionsStyle: resolveOverride(effective, agent, "transactionsStyle"),
+        pipelines: resolvePipelineTree(chain),
     };
 }
-function resolveEntrypoint(entrypoint) {
-    const normalized = normalizeEntrypoint(entrypoint);
+function definitionsOf(resources) {
+    const result = {};
+    if (!isPlainRecord(resources)) {
+        return result;
+    }
+    for (const [resourceName, resource] of Object.entries(resources)) {
+        if (!isPlainRecord(resource) || !isPlainRecord(resource.fields)) {
+            continue;
+        }
+        for (const [fieldName, field] of Object.entries(resource.fields)) {
+            if (!isPlainRecord(field) || field.definition === undefined) {
+                continue;
+            }
+            result[resourceName] ??= {};
+            result[resourceName][fieldName] =
+                field.definition;
+        }
+    }
+    return result;
+}
+function resolveMountPath(value, path) {
+    const normalized = normalizeEntrypoint(value);
     if (!normalized.ok) {
-        throw new FrameworkConstructionError("configuration", [
-            entrypointRefusalDiagnostic(normalized.message),
+        throw new AvConstructionError("configuration", [
+            mountPathRefusalDiagnostic(path, normalized.message),
         ]);
     }
     return normalized.path;
 }
+function resolveMcp(mcp) {
+    if (mcp === undefined) {
+        return undefined;
+    }
+    if (typeof mcp === "string") {
+        return Object.freeze({ path: resolveMountPath(mcp, "mcp") });
+    }
+    const path = resolveMountPath(mcp.path, "mcp.path");
+    const authorization = mcp.authorization;
+    return Object.freeze(authorization === undefined
+        ? { path }
+        : {
+            path,
+            authorization: Object.freeze({
+                servers: Object.freeze([...authorization.servers]),
+                verify: authorization.verify,
+            }),
+        });
+}
 export function resolveFrameworkConfig(config) {
-    const root = {
-        ...(hasOwn(config, "fields") ? { fields: config.fields } : {}),
-        ...(hasOwn(config, "behaviors") ? { behaviors: config.behaviors } : {}),
-        ...(hasOwn(config, "restrictions")
-            ? { restrictions: config.restrictions }
-            : {}),
-        ...(hasOwn(config, "limits") ? { limits: config.limits } : {}),
-        ...(hasOwn(config, "pipelines") ? { pipelines: config.pipelines } : {}),
-        ...(hasOwn(config, "transactions")
-            ? { transactions: config.transactions }
-            : {}),
+    const root = config;
+    const application = config.application;
+    const client = config.client;
+    const agent = config.agent;
+    const rootCompute = computeOfLayer(root.resources);
+    const layers = {
+        root: resolveLayer(root, rootCompute, false),
+        application: resolveLayer(root, rootCompute, true, application),
+        client: resolveLayer(root, rootCompute, true, client),
     };
+    const parent = agent?.extends ?? "client";
     return {
-        entrypoint: resolveEntrypoint(config.entrypoint),
+        api: resolveMountPath(config.api, "api"),
+        mcp: resolveMcp(config.mcp),
         adapter: config.adapter,
         diagnostics: config.diagnostics,
         misuse: config.misuse,
-        root: resolveScope(root),
-        application: resolveScope(root, config.application),
-        client: resolveScope(root, config.client),
+        definitions: definitionsOf(root.resources),
+        trees: {
+            root: root.resources,
+            application: application?.resources,
+            client: client?.resources,
+            agent: agent?.resources,
+        },
+        ...layers,
+        agent: resolveAgentLayer(root, parent, parent === "application"
+            ? application
+            : parent === "client"
+                ? client
+                : undefined, layers[parent], agent, agent !== undefined || config.mcp !== undefined),
     };
 }

package/dist/config/config.validator.d.ts

@@ -1,12 +1,12 @@
-import type { ConfigDiagnostic } from "./config-diagnostic.js";
+import type { AvConfigDiagnostic } from "./config-diagnostic.js";
 /**
- * The refusal of an entrypoint whose mount path is not canonical, from the
- * normalizer's message: it names the defect and the rule — never the value, which may
- * carry credentials.
+ * The refusal of a mount path (`api`, `mcp`, `mcp.path`) that is not canonical,
+ * from the normalizer's message: it names the defect and the rule — never the
+ * value, which may carry credentials.
  */
-export declare function entrypointRefusalDiagnostic(message: string): ConfigDiagnostic;
+export declare function mountPathRefusalDiagnostic(path: string, message: string): AvConfigDiagnostic;
 /**
  * Checks the structure of a configuration object and reports each problem as
- * a {@link ConfigDiagnostic}.
+ * a {@link AvConfigDiagnostic}.
  */
-export declare function validateFrameworkConfig(value: unknown): readonly ConfigDiagnostic[];
+export declare function validateFrameworkConfig(value: unknown): readonly AvConfigDiagnostic[];