@decionis/mcp 0.4.0 → 0.6.0

package/distribution/schema/Mcp.json

@@ -0,0 +1,120 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
+  "title": "Agent Plugins MCP Configuration",
+  "description": "Machine-readable schema for mcp.json in Agent Plugins 1.0.0. The Agent Plugins specification defines additional semantic and operational requirements.",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "const": "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
+      "description": "Canonical identifier of the MCP configuration schema for the Agent Plugins version targeted by this document."
+    },
+    "mcpServers": {
+      "type": "object",
+      "additionalProperties": {
+        "$ref": "#/$defs/server"
+      }
+    }
+  },
+  "required": ["$schema", "mcpServers"],
+  "additionalProperties": false,
+  "$defs": {
+    "server": {
+      "title": "MCP server",
+      "oneOf": [
+        {
+          "$ref": "#/$defs/stdioServer"
+        },
+        {
+          "$ref": "#/$defs/streamableHttpServer"
+        },
+        {
+          "$ref": "#/$defs/sseServer"
+        }
+      ]
+    },
+    "stdioServer": {
+      "title": "stdio MCP server",
+      "type": "object",
+      "properties": {
+        "type": {
+          "const": "stdio"
+        },
+        "command": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Executable token. Resolution rules are defined by the Agent Plugins specification."
+        },
+        "args": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "env": {
+          "type": "object",
+          "propertyNames": {
+            "not": {
+              "enum": ["PLUGIN_ROOT", "PLUGIN_DATA"]
+            }
+          },
+          "additionalProperties": {
+            "type": "string"
+          }
+        },
+        "cwd": {
+          "type": "string",
+          "pattern": "^(?:\\./|\\$\\{PLUGIN_ROOT\\}(?:/|$)|\\$\\{PLUGIN_DATA\\}(?:/|$))",
+          "description": "Plugin-relative, PLUGIN_ROOT-rooted, or PLUGIN_DATA-rooted working directory. Filesystem containment is validated separately."
+        }
+      },
+      "required": ["type", "command"],
+      "additionalProperties": false
+    },
+    "streamableHttpServer": {
+      "title": "Streamable HTTP MCP server",
+      "type": "object",
+      "properties": {
+        "type": {
+          "const": "streamable-http"
+        },
+        "url": {
+          "type": "string",
+          "minLength": 1,
+          "description": "MCP endpoint URL. URL semantics are defined by the Agent Plugins specification."
+        },
+        "headers": {
+          "$ref": "#/$defs/headers"
+        }
+      },
+      "required": ["type", "url"],
+      "additionalProperties": false
+    },
+    "sseServer": {
+      "title": "Legacy HTTP+SSE MCP server",
+      "type": "object",
+      "properties": {
+        "type": {
+          "const": "sse"
+        },
+        "url": {
+          "type": "string",
+          "minLength": 1,
+          "description": "MCP endpoint URL. URL semantics are defined by the Agent Plugins specification."
+        },
+        "headers": {
+          "$ref": "#/$defs/headers"
+        }
+      },
+      "required": ["type", "url"],
+      "additionalProperties": false
+    },
+    "headers": {
+      "title": "HTTP headers",
+      "type": "object",
+      "additionalProperties": {
+        "type": "string"
+      }
+    }
+  }
+}

package/distribution/schema/Plugin.json

@@ -0,0 +1,65 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+  "title": "Agent Plugins Manifest",
+  "description": "Machine-readable schema for plugin.json in Agent Plugins 1.0.0. The Agent Plugins specification defines additional semantic and operational requirements.",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "const": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+      "description": "Canonical identifier of the plugin manifest schema for the Agent Plugins version targeted by this document."
+    },
+    "name": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64,
+      "pattern": "^(?!.*(?:--|\\.\\.))[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$",
+      "description": "Human-readable plugin name."
+    },
+    "version": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "author": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "email": {
+          "type": "string"
+        },
+        "url": {
+          "type": "string"
+        }
+      },
+      "additionalProperties": false
+    },
+    "homepage": {
+      "type": "string"
+    },
+    "repository": {
+      "type": "string"
+    },
+    "license": {
+      "type": "string"
+    },
+    "keywords": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "extensions": {
+      "type": "object",
+      "description": "Client-specific manifest data keyed by reverse-domain extension namespace. Agent Plugins assigns no semantics to namespace object contents.",
+      "additionalProperties": {
+        "type": "object"
+      }
+    }
+  },
+  "required": ["$schema", "name"],
+  "additionalProperties": false
+}

package/distribution/schema/Source.md

@@ -0,0 +1,36 @@
+Agent Plugins 1.0.0 validation schemas, retrieved 8 October 2026.
+
+- `Plugin.json` from <https://agent-plugins.org/schemas/1.0.0/plugin.schema.json>;
+  SHA-256 `0a4aad95ce337878ad38802ebf0daa3fde76abe3f65400c86bcbb1ec0b3ab883`.
+- `Mcp.json` from <https://agent-plugins.org/schemas/1.0.0/mcp.schema.json>;
+  SHA-256 `6539175bfcdf43085855183e86da40ea94b166547a72b47ae9a0a390516d3acb`.
+
+These machine-readable format schemas are retained for deterministic offline
+package validation. Semantic OpenAI review, consent and publication checks are
+separate. Update the schemas and recorded hashes together after a reviewed
+provider format change.
+
+OpenAI listing text limits checked 9 October 2026 against the
+[submission field reference](https://developers.openai.com/plugins/deploy/submission#listing-metadata).
+`PolicyChatgptFormat` additionally checks the listing name, subtitle, description,
+developer name, capability labels and starter prompts. The portable schema alone
+accepts OpenAI extension metadata that exceeds these submission limits. These
+checks do not establish publisher access, live OAuth qualification or review readiness.
+
+Microsoft formats retained 8 October 2026:
+
+- `CopilotPlugin.json` from <https://developer.microsoft.com/json-schemas/copilot/plugin/v2.4/schema.json>;
+  SHA-256 `a9b7b1e10d1c1292ca4a64d4c5495ccf3355fcb76b12a94984c597e8974123ee`.
+- `CopilotAgent.json` from <https://developer.microsoft.com/json-schemas/copilot/declarative-agent/v1.6/schema.json>;
+  SHA-256 `08bca0093ef26ae53a8aa41b1568d4ddcf2134ba3b31db3412d1fcf029bd3c40`.
+- `CopilotApp.json` from <https://developer.microsoft.com/json-schemas/teams/v1.25/MicrosoftTeams.schema.json>;
+  SHA-256 `a5915b255f54abb46308aee83d909d0fc7a5172969101b321e66fe8327b3cbd8`.
+
+Hashes describe the retained, repository-formatted bytes. Microsoft labels these
+schemas draft-04 while also using newer keywords such as `$defs`, `const` and
+`if`/`then`. `PolicyCopilotFormat` removes only the dialect declaration in memory
+and validates all retained constraints with Ajv's draft-07 implementation. No
+external schema resolution or provider login occurs during package generation.
+The app template is checked with an in-memory fixture UUID that is never emitted.
+Configured app bundles require the operator's actual app and OAuth configuration
+IDs. A schema-valid sample is not a registered or certified Microsoft app.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@decionis/mcp",
-  "version": "0.4.0",
-  "description": "Local MCP policy checks with Decionis policy packs and Presence human verification, plus native Codex, Copilot, and Claude execution hooks.",
+  "version": "0.6.0",
+  "description": "Local Decionis execution checks and hooks, with opt-in delegated PolicyAgent authoring and independent workspace review.",
   "license": "Apache-2.0",
   "type": "module",
   "mcpName": "com.decionis/mcp",
@@ -46,7 +46,8 @@
     "hooks",
     "commands",
     ".claude-plugin",
-    "README.md"
+    "README.md",
+    "distribution"
   ],
   "engines": {
     "node": ">=20"
@@ -54,6 +55,25 @@
   "publishConfig": {
     "access": "public"
   },
+  "dependencies": {
+    "ajv": "^8.20.0",
+    "ajv-formats": "^3.0.1",
+    "fast-json-stringify": "^7.0.1",
+    "fastify": "^5.12.5"
+  },
+  "devDependencies": {
+    "@types/node": "^20.11.30",
+    "@typescript-eslint/eslint-plugin": "^8.71.0",
+    "@typescript-eslint/parser": "^8.71.0",
+    "tsup": "^8.0.2",
+    "tsx": "^4.23.15",
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.8",
+    "@decionis/shared": "0.0.0",
+    "@decionis/verify": "0.5.0",
+    "@decionis/protocol": "0.0.0",
+    "@decionis/sdk": "0.3.0"
+  },
   "scripts": {
     "dev": "tsx src/index.ts",
     "agent-hook": "tsx src/AgentHookCli.ts",
@@ -66,25 +86,8 @@
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "lint": "eslint .",
     "format": "prettier --check . --ignore-path ../../.prettierignore",
-    "format:fix": "prettier --write . --ignore-path ../../.prettierignore"
-  },
-  "dependencies": {
-    "ajv": "^8.17.1",
-    "ajv-formats": "^3.0.1",
-    "fast-json-stringify": "^7.0.1",
-    "fastify": "^5.10.0"
-  },
-  "devDependencies": {
-    "@decionis/protocol": "workspace:*",
-    "@decionis/sdk": "workspace:*",
-    "@decionis/shared": "workspace:*",
-    "@decionis/verify": "workspace:*",
-    "@types/node": "^20.11.30",
-    "@typescript-eslint/eslint-plugin": "^8.44.0",
-    "@typescript-eslint/parser": "^8.44.0",
-    "tsup": "^8.0.2",
-    "tsx": "^4.19.2",
-    "typescript": "^5.6.3",
-    "vitest": "^2.1.8"
+    "format:fix": "prettier --write . --ignore-path ../../.prettierignore",
+    "package:policyagent": "tsx --conditions=development scripts/PackagePolicyAgent.ts",
+    "qualify:policyagent": "tsx --conditions=development scripts/QualifyPolicyAgent.ts"
   }
-}
+}