@aventara/core 1.0.0-rc.0 → 1.0.0-rc.10

package/dist/config/computed-fields.js

@@ -0,0 +1,73 @@
+import { emitFrameworkWarning } from "../runtime/framework-warning.emitter.js";
+import { computeOfLayer } from "./field-compute.resolver.js";
+function layerComputedFields(resources) {
+    const result = {};
+    const compute = computeOfLayer(resources);
+    for (const resource of Object.keys(compute).sort()) {
+        const fields = compute[resource] ?? {};
+        const create = Object.keys(fields)
+            .filter((field) => fields[field]?.create !== undefined)
+            .sort();
+        const update = Object.keys(fields)
+            .filter((field) => fields[field]?.update !== undefined)
+            .sort();
+        if (create.length === 0 && update.length === 0) {
+            continue;
+        }
+        result[resource] = {
+            ...(create.length === 0 ? {} : { create }),
+            ...(update.length === 0 ? {} : { update }),
+        };
+    }
+    return result;
+}
+export function computedFieldsOf(source) {
+    return {
+        agent: layerComputedFields(source.trees.agent),
+        agentExtends: source.agentExtends,
+        application: layerComputedFields(source.trees.application),
+        client: layerComputedFields(source.trees.client),
+        root: layerComputedFields(source.trees.root),
+    };
+}
+const LAYERS = ["root", "application", "client", "agent"];
+const PHASES = ["create", "update"];
+function missingFrom(left, right) {
+    const missing = [];
+    for (const layer of LAYERS) {
+        for (const [resource, phases] of Object.entries(left[layer])) {
+            for (const phase of PHASES) {
+                for (const field of phases[phase] ?? []) {
+                    if (!right[layer][resource]?.[phase]?.includes(field)) {
+                        missing.push(`${layer} ${resource}.${field} (${phase})`);
+                    }
+                }
+            }
+        }
+    }
+    return missing;
+}
+export function computedFieldsDrift(generated, configured) {
+    const drift = [
+        ...missingFrom(configured, generated).map((entry) => `computed in the configuration, not in the types: ${entry}`),
+        ...missingFrom(generated, configured).map((entry) => `computed in the types, not in the configuration: ${entry}`),
+    ];
+    if (generated.agentExtends !== configured.agentExtends) {
+        drift.push(`the agent layer extends "${configured.agentExtends}", the types say "${generated.agentExtends}"`);
+    }
+    return drift;
+}
+export const STALE_GENERATED_TYPES_WARNING = "AVENTARA_STALE_GENERATED_TYPES";
+export function warnOnStaleComputedFields(generated, configured) {
+    if (generated === undefined) {
+        return;
+    }
+    const drift = computedFieldsDrift(generated, configured);
+    if (drift.length === 0) {
+        return;
+    }
+    const message = `generated types are stale: run aventara:prepare. The computed fields the pre-compute stages are typed with differ from the configuration's:\n${drift
+        .map((line) => `  - ${line}`)
+        .join("\n")}`;
+    emitFrameworkWarning(message, STALE_GENERATED_TYPES_WARNING);
+}

package/dist/config/config-diagnostic.d.ts

@@ -1,8 +1,15 @@
-/** Codes of {@link ConfigDiagnostic}. */
-export type ConfigDiagnosticCode = "CONFIG_REQUIRED" | "CONFIG_UNKNOWN_PROPERTY" | "CONFIG_INVALID_TYPE" | "CONFIG_INVALID_VALUE";
+/** Codes of {@link AvConfigDiagnostic}. */
+export type AvConfigDiagnosticCode = "CONFIG_REQUIRED" | "CONFIG_UNKNOWN_PROPERTY" | "CONFIG_INVALID_TYPE" | "CONFIG_INVALID_VALUE"
+/** An rc.0 key that moved in rc.1; the message names where it lives now. */
+ | "CONFIG_MOVED_PROPERTY"
+/**
+ * A key only the root may hold, written in `application`, `client` or `agent`: a field's
+ * `definition` is the root's, and an overlay only chooses its visibility.
+ */
+ | "CONFIG_FORBIDDEN_IN_OVERLAY";
 /** One problem found in a configuration, at its path. */
-export type ConfigDiagnostic = {
-    readonly code: ConfigDiagnosticCode;
+export type AvConfigDiagnostic = {
+    readonly code: AvConfigDiagnosticCode;
     readonly path: string;
     readonly message: string;
 };

package/dist/config/config-diagnostic.guidance.d.ts

@@ -0,0 +1,6 @@
+import type { ErrorCodeDescription } from "../runtime/error-guidance.js";
+import type { AvConfigDiagnosticCode } from "./config-diagnostic.js";
+/** Meaning, cause and fix of every configuration diagnostic code. */
+export declare const CONFIG_DIAGNOSTIC_GUIDANCE: {
+    readonly [C in AvConfigDiagnosticCode]: ErrorCodeDescription;
+};

package/dist/config/config-diagnostic.guidance.js

@@ -0,0 +1,32 @@
+export const CONFIG_DIAGNOSTIC_GUIDANCE = {
+    CONFIG_REQUIRED: {
+        message: "A required configuration key is missing.",
+        cause: "A key that must be present is absent: api, adapter, or an overlay's exposed when the overlay sets exemptions, or policy.engine or policy.principal when policy is set.",
+        fix: "Add the key at the diagnostic's path.",
+    },
+    CONFIG_UNKNOWN_PROPERTY: {
+        message: "Unknown configuration key.",
+        cause: "A key the configuration does not define at that place: a typo, or a key written at the wrong level of the tree. `policy` and `prebuilt` are root-only keys; in an overlay they read as unknown.",
+        fix: 'Remove it, or move it where it belongs (the configuration reference\'s "Where a key can go").',
+    },
+    CONFIG_INVALID_TYPE: {
+        message: "A configuration key has the wrong type.",
+        cause: "A value of the wrong type, or a key set to an explicit undefined.",
+        fix: "Give the value the type the reference states; leave a key out rather than setting it to undefined.",
+    },
+    CONFIG_INVALID_VALUE: {
+        message: "A configuration value is not allowed.",
+        cause: "A malformed api or mcp path, a negative limit, an unknown transactionsStyle, a format that is not a named zod format, forceTransaction under an effective transactionsStyle \"none\", an after check on any action but update, or a policy engine's governed, paths or afterChecks naming a Resource, field or path the Core Contract does not have, or its unheld naming a Resource the data source's model does not have (the message names the Resource or the rule).",
+        fix: "Use a value the message allows.",
+    },
+    CONFIG_MOVED_PROPERTY: {
+        message: "A configuration key moved in rc.1.",
+        cause: "Configuration written for 1.0.0-rc.0: restrictions, entrypoint, fields, behaviors, transactions or pipelines.before/after.",
+        fix: "Move it where the message says: restrictions to exposed + exemptions, entrypoint to api, fields to `resources.<R>.fields.<f>.definition`, transactions to transactionsStyle, before/after to pipelines.hooks.",
+    },
+    CONFIG_FORBIDDEN_IN_OVERLAY: {
+        message: "A root-only key is written in an overlay.",
+        cause: "A field definition in application, client or agent.",
+        fix: "Define the field once at the root (`resources.<R>.fields.<f>.definition`); an overlay only chooses its visibility.",
+    },
+};

package/dist/config/config-layer.d.ts

@@ -1,12 +1,21 @@
 /**
  * One layer of the configuration: `root` is the configuration's own top level
  * and compiles to the Core Contract; `application` and `client` are overlays
- * on top of it and compile to the Application and Client Contracts.
+ * on top of it and compile to the Application and Client Contracts; `agent`
+ * narrows the layer it extends and compiles to the Agent Contract.
  */
-export type ConfigLayer = "root" | "application" | "client";
+export type AvConfigLayerName = "root" | "application" | "client" | "agent";
 /**
- * The layers a request can come from: `application` (in-process calls) or
- * `client` (remote calls). Each sees the root configuration plus its own
- * overlay.
+ * The layers a request can come from: `application` (in-process calls),
+ * `client` (remote calls) or `agent` (calls an AI agent makes over MCP). Each
+ * sees the root configuration plus its own layer, and `agent` the layer it
+ * extends between the two.
  */
-export type RequestOrigin = Exclude<ConfigLayer, "root">;
+export type AvRequestOrigin = Exclude<AvConfigLayerName, "root">;
+/**
+ * The layer the `agent` layer starts from (its `extends`): its final view is
+ * the agent's parent, and its pipelines run before the agent's.
+ */
+export type AvConfigAgentParent = Exclude<AvConfigLayerName, "agent">;
+/** The origins whose requests carry a protocol identity: remote callers. */
+export type RemoteRequestOrigin = Exclude<AvRequestOrigin, "application">;

package/dist/config/config.resolver.d.ts

@@ -1,38 +1,105 @@
-import type { Adapter } from "../adapters/adapter.interface.js";
-import type { AdapterModel } from "../adapters/adapter-model.js";
-import type { TransactionCapability } from "../contracts/transaction-capability.js";
-import type { FrameworkDiagnosticsSink } from "../runtime/diagnostics-reporter.js";
-import type { FrameworkMisuseSink } from "../runtime/misuse-reporter.js";
-import type { FrameworkBehaviorsConfig } from "./framework-behaviors-config.js";
-import type { FrameworkConfig, FrameworkLimitsConfig } from "./framework-config.js";
-import type { FrameworkFieldsConfig } from "./framework-fields-config.js";
-import type { FrameworkRestrictionsConfig } from "./framework-restrictions-config.js";
-import type { ResolvedPipelineConfig } from "./pipeline-config.js";
-/** One resolved layer of the configuration: root, application or client. */
-export type ResolvedFrameworkScopeConfig<M extends AdapterModel = AdapterModel> = {
-    readonly fields: FrameworkFieldsConfig<M> | undefined;
-    /** The behaviors configuration, with Resource and field keys as plain strings. */
-    readonly behaviors: FrameworkBehaviorsConfig | undefined;
-    readonly restrictions: FrameworkRestrictionsConfig<M> | undefined;
-    readonly limits: FrameworkLimitsConfig | undefined;
-    readonly pipelines: ResolvedPipelineConfig;
-    readonly transactions: TransactionCapability | undefined;
+import type { AvAdapter } from "../adapters/adapter.interface.js";
+import type { AvAdapterModel } from "../adapters/adapter-model.js";
+import type { AvContractClientAccess } from "../contracts/contract-access.js";
+import type { AvTransactionCapability } from "../contracts/transaction-capability.js";
+import type { AvPolicyEngine } from "../policy/policy-engine.js";
+import type { AvDiagnosticsSink } from "../runtime/diagnostics-reporter.js";
+import type { AvMisuseSink } from "../runtime/misuse-reporter.js";
+import type { AvConfigAgentParent } from "./config-layer.js";
+import { type ResolvedComputeConfig } from "./field-compute.resolver.js";
+import type { AvConfig, AvConfigLimits } from "./framework-config.js";
+import type { AvConfigFieldDefinition } from "./framework-field-definition.js";
+import { type ResolvedPipelineTree } from "./pipeline-tree.resolver.js";
+/** The root's `policy`, its engine's passive lists read once. */
+export type ResolvedPolicyConfig = {
+    /** Where the engine was configured, for the startup diagnostics' paths. */
+    readonly at: "policy.engine" | "access.policy";
+    readonly engine: AvPolicyEngine;
+    readonly principal: NonNullable<AvConfig["policy"]>["principal"];
+    /** The governed fields and relations, by Resource. */
+    readonly governed: Readonly<Record<string, readonly string[]>>;
+    /** The rule paths, by rule name, each a list of segments. */
+    readonly paths: Readonly<Record<string, readonly (readonly string[])[]>>;
+    /** The writes whose grants carry an `after` condition, by Resource. */
+    readonly afterChecks: Readonly<Record<string, readonly string[]>>;
+    /** The Resources the rules read in conditions and decide no read of. */
+    readonly unheld: readonly string[];
+};
+/** The root's field definitions, by Resource and field name. */
+export type ResolvedFieldDefinitions = Readonly<Record<string, Readonly<Record<string, AvConfigFieldDefinition>>>>;
+/** One resolved layer of the configuration: root, application, client or agent. */
+export type ResolvedFrameworkLayerConfig = {
+    /** The compute stages that run for this layer's operations, chained root first. */
+    readonly compute: ResolvedComputeConfig;
+    /**
+     * Whether this layer's exemptions hide (`true`, the root's default) or grant
+     * (`false`); `undefined` for an overlay that states none, which keeps the
+     * root's view.
+     */
+    readonly exposed: boolean | undefined;
+    /** This layer's own `exemptions`, as authored; the compiler checks every name. */
+    readonly exemptions: unknown;
+    readonly limits: AvConfigLimits | undefined;
+    /**
+     * Every stage that runs for this layer's operations, level by level: the root's
+     * registrations, then the overlay's, at each level.
+     */
+    readonly pipelines: ResolvedPipelineTree;
+    readonly transactionsStyle: AvTransactionCapability | undefined;
+};
+/**
+ * The MCP endpoint a Framework serves (`mcp` resolved): its mount path in
+ * canonical form, and the authorization its callers present, when it has one.
+ */
+export type AvMcpEndpoint = {
+    /** The mount path in its canonical form, as `framework.api` is. */
+    readonly path: string;
+    readonly authorization?: {
+        readonly servers: readonly string[];
+        readonly verify: (token: string) => unknown | null | Promise<unknown | null>;
+    };
+};
+/** The agent layer resolved: a layer, and the layer it extends. */
+export type ResolvedAgentLayerConfig = ResolvedFrameworkLayerConfig & {
+    /** The layer whose final view the agent narrows (`extends`; `"client"` when left out). */
+    readonly parent: AvConfigAgentParent;
+    /** Whether the configuration states `agent` or `mcp`. */
+    readonly stated: boolean;
 };
 /** A configuration after defaults and overlays are resolved, before compilation. */
-export type ResolvedFrameworkConfig<M extends AdapterModel = AdapterModel> = {
+export type ResolvedFrameworkConfig<M extends AvAdapterModel = AvAdapterModel> = {
     /**
-     * The mount path in its canonical form: `""` at the root, otherwise
-     * `/seg(/seg)*`.
+     * The protocol's mount path (`api`) in its canonical form: `""` at the
+     * root, otherwise `/seg(/seg)*`.
      */
-    readonly entrypoint: string;
-    readonly adapter: Adapter<M>;
+    readonly api: string;
+    /** The MCP endpoint, when `mcp` turns it on. */
+    readonly mcp: AvMcpEndpoint | undefined;
+    readonly adapter: AvAdapter<M>;
     /** The diagnostics sink, from the root configuration only. */
-    readonly diagnostics: FrameworkDiagnosticsSink | undefined;
+    readonly diagnostics: AvDiagnosticsSink | undefined;
     /** The misuse sink, from the root configuration only. */
-    readonly misuse: FrameworkMisuseSink | undefined;
-    readonly root: ResolvedFrameworkScopeConfig<M>;
-    readonly application: ResolvedFrameworkScopeConfig<M>;
-    readonly client: ResolvedFrameworkScopeConfig<M>;
+    readonly misuse: AvMisuseSink | undefined;
+    /** The policy, from the root configuration only; absent, nothing is checked. */
+    readonly policy: ResolvedPolicyConfig | undefined;
+    /**
+     * The ClientContract's `access` section: present exactly when `access` is
+     * configured, with `url` and `verbs` when its provider has `client`.
+     */
+    readonly access: AvContractClientAccess | undefined;
+    /** Every field definition, from the root only; the same for all three layers. */
+    readonly definitions: ResolvedFieldDefinitions;
+    /** Each layer's `resources` tree as authored: the compiler checks its names. */
+    readonly trees: {
+        readonly root: unknown;
+        readonly application: unknown;
+        readonly client: unknown;
+        readonly agent: unknown;
+    };
+    readonly root: ResolvedFrameworkLayerConfig;
+    readonly application: ResolvedFrameworkLayerConfig;
+    readonly client: ResolvedFrameworkLayerConfig;
+    readonly agent: ResolvedAgentLayerConfig;
 };
-/** Resolve root, application, and client configuration without compiling Contracts. */
-export declare function resolveFrameworkConfig<M extends AdapterModel>(config: FrameworkConfig<M>): ResolvedFrameworkConfig<M>;
+/** Resolve every layer of the configuration without compiling Contracts. */
+export declare function resolveFrameworkConfig<M extends AvAdapterModel>(config: AvConfig<M>): ResolvedFrameworkConfig<M>;

package/dist/config/config.resolver.js

@@ -1,6 +1,9 @@
-import { FrameworkConstructionError } from "../framework/framework-construction.error.js";
-import { entrypointRefusalDiagnostic } from "./config.validator.js";
+import { AvConstructionError } from "../framework/framework-construction.error.js";
+import { ACCESS_VERB_NAMES, providerVerb, } from "../policy/access-verb.table.js";
+import { mountPathRefusalDiagnostic } from "./config.validator.js";
 import { normalizeEntrypoint } from "./entrypoint.normalizer.js";
+import { chainCompute, computeOfLayer, } from "./field-compute.resolver.js";
+import { resolvePipelineTree, } from "./pipeline-tree.resolver.js";
 const hasOwn = (value, key) => Object.hasOwn(value, key);
 function isPlainRecord(value) {
     if (value === null || typeof value !== "object" || Array.isArray(value)) {
@@ -39,7 +42,7 @@ function resolveRecord(root, scoped) {
     }
     return result;
 }
-function resolveProperty(root, scoped, key) {
+function resolveOverride(root, scoped, key) {
     if (scoped === undefined || !hasOwn(scoped, key)) {
         return cloneConfigValue(root[key]);
     }
@@ -49,63 +52,189 @@ function resolveProperty(root, scoped, key) {
         ? resolveRecord(rootValue, scopedValue)
         : cloneConfigValue(scopedValue);
 }
-function resolvePipelines(root, scoped) {
+function resolveLayer(root, rootCompute, overlay, scoped) {
     return {
-        guards: [...(root?.guards ?? []), ...(scoped?.guards ?? [])],
-        pipes: [...(root?.pipes ?? []), ...(scoped?.pipes ?? [])],
-        hooks: {
-            before: [
-                ...(root?.hooks?.before ?? []),
-                ...(scoped?.hooks?.before ?? []),
-            ],
-            after: [...(root?.hooks?.after ?? []), ...(scoped?.hooks?.after ?? [])],
-        },
-        interceptors: [
-            ...(root?.interceptors ?? []),
-            ...(scoped?.interceptors ?? []),
-        ],
-        filters: [...(root?.filters ?? []), ...(scoped?.filters ?? [])],
+        compute: scoped === undefined
+            ? rootCompute
+            : chainCompute(rootCompute, computeOfLayer(scoped.resources)),
+        exposed: overlay
+            ? scoped?.exposed
+            : (root.exposed ?? true),
+        exemptions: overlay ? scoped?.exemptions : root.exemptions,
+        limits: resolveOverride(root, scoped, "limits"),
+        transactionsStyle: resolveOverride(root, scoped, "transactionsStyle"),
+        pipelines: scoped === undefined
+            ? resolvePipelineTree([root])
+            : resolvePipelineTree([root, scoped]),
     };
 }
-function resolveScope(root, scoped) {
+function resolveAgentLayer(root, parentName, parentOverlay, parent, agent, stated) {
+    const effective = {
+        limits: parent.limits,
+        transactionsStyle: parent.transactionsStyle,
+    };
+    const chain = [root];
+    if (parentName !== "root" && parentOverlay !== undefined) {
+        chain.push(parentOverlay);
+    }
+    if (agent !== undefined) {
+        chain.push(agent);
+    }
     return {
-        fields: resolveProperty(root, scoped, "fields"),
-        behaviors: resolveProperty(root, scoped, "behaviors"),
-        restrictions: resolveProperty(root, scoped, "restrictions"),
-        limits: resolveProperty(root, scoped, "limits"),
-        transactions: resolveProperty(root, scoped, "transactions"),
-        pipelines: resolvePipelines(root.pipelines, scoped?.pipelines),
+        parent: parentName,
+        stated,
+        compute: agent === undefined
+            ? parent.compute
+            : chainCompute(parent.compute, computeOfLayer(agent.resources)),
+        exposed: agent?.exposed,
+        exemptions: agent?.exemptions,
+        limits: resolveOverride(effective, agent, "limits"),
+        transactionsStyle: resolveOverride(effective, agent, "transactionsStyle"),
+        pipelines: resolvePipelineTree(chain),
     };
 }
-function resolveEntrypoint(entrypoint) {
-    const normalized = normalizeEntrypoint(entrypoint);
+function definitionsOf(resources) {
+    const result = {};
+    if (!isPlainRecord(resources)) {
+        return result;
+    }
+    for (const [resourceName, resource] of Object.entries(resources)) {
+        if (!isPlainRecord(resource) || !isPlainRecord(resource.fields)) {
+            continue;
+        }
+        for (const [fieldName, field] of Object.entries(resource.fields)) {
+            if (!isPlainRecord(field) || field.definition === undefined) {
+                continue;
+            }
+            result[resourceName] ??= {};
+            result[resourceName][fieldName] =
+                field.definition;
+        }
+    }
+    return result;
+}
+function resolveMountPath(value, path) {
+    const normalized = normalizeEntrypoint(value);
     if (!normalized.ok) {
-        throw new FrameworkConstructionError("configuration", [
-            entrypointRefusalDiagnostic(normalized.message),
+        throw new AvConstructionError("configuration", [
+            mountPathRefusalDiagnostic(path, normalized.message),
         ]);
     }
     return normalized.path;
 }
+function resolveMcp(mcp) {
+    if (mcp === undefined) {
+        return undefined;
+    }
+    if (typeof mcp === "string") {
+        return Object.freeze({ path: resolveMountPath(mcp, "mcp") });
+    }
+    const path = resolveMountPath(mcp.path, "mcp.path");
+    const authorization = mcp.authorization;
+    return Object.freeze(authorization === undefined
+        ? { path }
+        : {
+            path,
+            authorization: Object.freeze({
+                servers: Object.freeze([...authorization.servers]),
+                verify: authorization.verify,
+            }),
+        });
+}
+function frozenLists(value) {
+    if (!isPlainRecord(value)) {
+        return Object.freeze({});
+    }
+    return Object.freeze(Object.fromEntries(Object.entries(value).map(([key, names]) => [
+        key,
+        Object.freeze([...names]),
+    ])));
+}
+function frozenPathLists(value) {
+    if (!isPlainRecord(value)) {
+        return Object.freeze({});
+    }
+    return Object.freeze(Object.fromEntries(Object.entries(value).map(([key, paths]) => [
+        key,
+        Object.freeze(paths.map((path) => Object.freeze([...path]))),
+    ])));
+}
+const accessPrincipal = ({ $state, }) => $state.me ?? null;
+function resolveAccessSection(access) {
+    if (access === undefined) {
+        return undefined;
+    }
+    const client = access.client;
+    if (client === undefined) {
+        return {};
+    }
+    const verbs = {};
+    for (const name of ACCESS_VERB_NAMES) {
+        const verb = providerVerb(client.verbs, name);
+        if (verb !== undefined) {
+            const { method, path, args, result } = verb;
+            verbs[name] = {
+                method,
+                path,
+                ...(args === undefined ? {} : { args: args }),
+                result: result,
+            };
+        }
+    }
+    return {
+        url: client.url,
+        verbs: verbs,
+    };
+}
+function resolvePolicy(configured, access) {
+    const policy = access === undefined
+        ? configured
+        : { engine: access.policy, principal: accessPrincipal };
+    if (policy === undefined) {
+        return undefined;
+    }
+    return Object.freeze({
+        at: access === undefined ? "policy.engine" : "access.policy",
+        engine: policy.engine,
+        principal: policy.principal,
+        governed: frozenLists(policy.engine.governed),
+        paths: frozenPathLists(policy.engine.paths),
+        afterChecks: frozenLists(policy.engine.afterChecks),
+        unheld: Object.freeze(Array.isArray(policy.engine.unheld) ? [...policy.engine.unheld] : []),
+    });
+}
 export function resolveFrameworkConfig(config) {
-    const root = {
-        ...(hasOwn(config, "fields") ? { fields: config.fields } : {}),
-        ...(hasOwn(config, "behaviors") ? { behaviors: config.behaviors } : {}),
-        ...(hasOwn(config, "restrictions")
-            ? { restrictions: config.restrictions }
-            : {}),
-        ...(hasOwn(config, "limits") ? { limits: config.limits } : {}),
-        ...(hasOwn(config, "pipelines") ? { pipelines: config.pipelines } : {}),
-        ...(hasOwn(config, "transactions")
-            ? { transactions: config.transactions }
-            : {}),
+    const root = config;
+    const application = config.application;
+    const client = config.client;
+    const agent = config.agent;
+    const rootCompute = computeOfLayer(root.resources);
+    const layers = {
+        root: resolveLayer(root, rootCompute, false),
+        application: resolveLayer(root, rootCompute, true, application),
+        client: resolveLayer(root, rootCompute, true, client),
     };
+    const parent = agent?.extends ?? "client";
     return {
-        entrypoint: resolveEntrypoint(config.entrypoint),
+        api: resolveMountPath(config.api, "api"),
+        mcp: resolveMcp(config.mcp),
         adapter: config.adapter,
         diagnostics: config.diagnostics,
         misuse: config.misuse,
-        root: resolveScope(root),
-        application: resolveScope(root, config.application),
-        client: resolveScope(root, config.client),
+        policy: resolvePolicy(config.policy, config.access),
+        access: resolveAccessSection(config.access),
+        definitions: definitionsOf(root.resources),
+        trees: {
+            root: root.resources,
+            application: application?.resources,
+            client: client?.resources,
+            agent: agent?.resources,
+        },
+        ...layers,
+        agent: resolveAgentLayer(root, parent, parent === "application"
+            ? application
+            : parent === "client"
+                ? client
+                : undefined, layers[parent], agent, agent !== undefined || config.mcp !== undefined),
     };
 }

package/dist/config/config.validator.d.ts

@@ -1,12 +1,12 @@
-import type { ConfigDiagnostic } from "./config-diagnostic.js";
+import type { AvConfigDiagnostic } from "./config-diagnostic.js";
 /**
- * The refusal of an entrypoint whose mount path is not canonical, from the
- * normalizer's message: it names the defect and the rule — never the value, which may
- * carry credentials.
+ * The refusal of a mount path (`api`, `mcp`, `mcp.path`) that is not canonical,
+ * from the normalizer's message: it names the defect and the rule — never the
+ * value, which may carry credentials.
  */
-export declare function entrypointRefusalDiagnostic(message: string): ConfigDiagnostic;
+export declare function mountPathRefusalDiagnostic(path: string, message: string): AvConfigDiagnostic;
 /**
  * Checks the structure of a configuration object and reports each problem as
- * a {@link ConfigDiagnostic}.
+ * a {@link AvConfigDiagnostic}.
  */
-export declare function validateFrameworkConfig(value: unknown): readonly ConfigDiagnostic[];
+export declare function validateFrameworkConfig(value: unknown): readonly AvConfigDiagnostic[];