mdkg 0.1.1 → 0.1.3

package/dist/commands/work.js

@@ -0,0 +1,397 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runWorkContractNewCommand = runWorkContractNewCommand;
+exports.runWorkOrderNewCommand = runWorkOrderNewCommand;
+exports.runWorkOrderUpdateCommand = runWorkOrderUpdateCommand;
+exports.runWorkReceiptNewCommand = runWorkReceiptNewCommand;
+exports.runWorkReceiptUpdateCommand = runWorkReceiptUpdateCommand;
+exports.runWorkArtifactAddCommand = runWorkArtifactAddCommand;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const config_1 = require("../core/config");
+const frontmatter_1 = require("../graph/frontmatter");
+const indexer_1 = require("../graph/indexer");
+const index_cache_1 = require("../graph/index_cache");
+const reindex_1 = require("../graph/reindex");
+const agent_file_types_1 = require("../graph/agent_file_types");
+const loader_1 = require("../templates/loader");
+const date_1 = require("../util/date");
+const errors_1 = require("../util/errors");
+const id_1 = require("../util/id");
+const qid_1 = require("../util/qid");
+const atomic_1 = require("../util/atomic");
+const lock_1 = require("../util/lock");
+const event_support_1 = require("./event_support");
+const archive_1 = require("./archive");
+const PRICING_MODELS = new Set(["free", "included", "quoted", "fixed", "metered", "subscription"]);
+const ORDER_STATUSES = new Set(["submitted", "accepted", "running", "completed", "cancelled", "failed"]);
+const RECEIPT_STATUSES = new Set(["recorded", "verified", "rejected", "superseded"]);
+const OUTCOMES = new Set(["success", "partial", "failure"]);
+function parseCsvList(raw) {
+    if (!raw) {
+        return [];
+    }
+    return raw
+        .split(",")
+        .map((value) => value.trim())
+        .filter(Boolean);
+}
+function normalizeWorkspace(value) {
+    if (!value) {
+        return "root";
+    }
+    const normalized = value.toLowerCase();
+    if (normalized === "all") {
+        throw new errors_1.UsageError("--ws all is not valid for work commands");
+    }
+    return normalized;
+}
+function normalizePortableId(value, flag) {
+    const normalized = value.toLowerCase();
+    if (!(0, id_1.isPortableId)(normalized)) {
+        throw new errors_1.UsageError(`${flag} must be a lowercase portable id`);
+    }
+    return normalized;
+}
+function normalizeEnum(value, flag, allowed) {
+    const normalized = value.toLowerCase();
+    if (!allowed.has(normalized)) {
+        throw new errors_1.UsageError(`${flag} must be one of ${Array.from(allowed).join(", ")}`);
+    }
+    return normalized;
+}
+function slugifyTitle(title) {
+    const slug = title
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .replace(/-+/g, "-");
+    return slug || "work";
+}
+function toPosixPath(value) {
+    return value.split(path_1.default.sep).join("/");
+}
+function appendUnique(existing, additions) {
+    const next = [...existing];
+    const seen = new Set(existing);
+    for (const addition of additions) {
+        if (!seen.has(addition)) {
+            next.push(addition);
+            seen.add(addition);
+        }
+    }
+    return next;
+}
+function toStringList(value) {
+    return Array.isArray(value) ? value.map(String) : [];
+}
+function maybeReindex(root, config) {
+    if (!config.index.auto_reindex) {
+        return;
+    }
+    (0, reindex_1.writeDerivedIndexes)(root, config, (0, indexer_1.buildIndex)(root, config, { tolerant: config.index.tolerant }));
+}
+function findNodeById(index, ws, id, type) {
+    const node = index.nodes[`${ws}:${id}`];
+    if (!node) {
+        return undefined;
+    }
+    if (type && node.type !== type) {
+        return undefined;
+    }
+    return node;
+}
+function requireNodeById(index, ws, id, type, label) {
+    const node = findNodeById(index, ws, id, type);
+    if (!node) {
+        throw new errors_1.NotFoundError(`${label} not found: ${id}`);
+    }
+    return node;
+}
+function nodeReceipt(root, node) {
+    return {
+        workspace: node.ws,
+        id: node.id,
+        qid: node.qid,
+        path: node.path,
+        type: node.type,
+        title: node.title,
+    };
+}
+function writeFrontmatterFile(filePath, frontmatter, body) {
+    const lines = (0, frontmatter_1.formatFrontmatter)(frontmatter, frontmatter_1.DEFAULT_FRONTMATTER_KEY_ORDER);
+    const content = ["---", ...lines, "---", body.trimStart()].join("\n");
+    (0, atomic_1.atomicWriteFile)(filePath, content.endsWith("\n") ? content : `${content}\n`);
+}
+function createAgentWorkflowNode(options) {
+    const config = (0, config_1.loadConfig)(options.root);
+    const ws = normalizeWorkspace(options.ws);
+    const workspace = config.workspaces[ws];
+    if (!workspace) {
+        throw new errors_1.NotFoundError(`workspace not found: ${ws}`);
+    }
+    const id = normalizePortableId(options.id, "--id");
+    const { index } = (0, index_cache_1.loadIndex)({ root: options.root, config });
+    if (index.nodes[`${ws}:${id}`]) {
+        throw new errors_1.UsageError(`node already exists: ${ws}:${id}`);
+    }
+    const today = (0, date_1.formatDate)(options.now ?? new Date());
+    const slug = slugifyTitle(options.title);
+    const filePath = path_1.default.resolve(options.root, workspace.path, workspace.mdkg_dir, "work", `${id}-${slug}`, agent_file_types_1.AGENT_FILE_BASENAMES[options.type]);
+    const template = (0, loader_1.loadTemplate)(options.root, config, options.type);
+    const content = (0, loader_1.renderTemplate)(template, {
+        id,
+        type: options.type,
+        title: options.title,
+        created: today,
+        updated: today,
+        ...options.overrides,
+    });
+    try {
+        (0, atomic_1.writeFileExclusive)(filePath, content);
+    }
+    catch (err) {
+        const code = typeof err === "object" && err !== null && "code" in err ? String(err.code) : "";
+        if (code === "EEXIST") {
+            throw new errors_1.UsageError(`node already exists: ${path_1.default.relative(options.root, filePath)}`);
+        }
+        throw err;
+    }
+    maybeReindex(options.root, config);
+    (0, event_support_1.appendAutomaticEvent)({
+        root: options.root,
+        ws,
+        kind: "WORK_NODE_CREATED",
+        status: "ok",
+        refs: [id],
+        notes: `${options.type} semantic mirror created via mdkg work`,
+        now: options.now,
+    });
+    return {
+        workspace: ws,
+        id,
+        qid: `${ws}:${id}`,
+        path: toPosixPath(path_1.default.relative(options.root, filePath)),
+        type: options.type,
+        title: options.title,
+    };
+}
+function resolveWorkNode(index, idOrQid, ws, allowedTypes, label) {
+    const resolved = (0, qid_1.resolveQid)(index, idOrQid, ws);
+    if (resolved.status !== "ok") {
+        throw new errors_1.NotFoundError((0, qid_1.formatResolveError)(label, idOrQid, resolved, ws));
+    }
+    const node = index.nodes[resolved.qid];
+    if (!node || !allowedTypes.has(node.type)) {
+        throw new errors_1.NotFoundError(`${label} not found: ${idOrQid}`);
+    }
+    if (node.source?.imported) {
+        throw new errors_1.UsageError(`cannot mutate read-only imported node ${node.qid}; update the source workspace for bundle import ${node.source.import_alias}`);
+    }
+    return node;
+}
+function loadMutableAgentNode(root, idOrQid, wsRaw, type) {
+    const config = (0, config_1.loadConfig)(root);
+    const ws = normalizeWorkspace(wsRaw);
+    const { index } = (0, index_cache_1.loadIndex)({ root, config });
+    const node = resolveWorkNode(index, idOrQid, ws, new Set([type]), type);
+    const filePath = path_1.default.resolve(root, node.path);
+    const parsed = (0, frontmatter_1.parseFrontmatter)(fs_1.default.readFileSync(filePath, "utf8"), filePath);
+    return { config, node, filePath, frontmatter: { ...parsed.frontmatter }, body: parsed.body };
+}
+function printReceipt(action, receipt, json) {
+    if (json) {
+        console.log(JSON.stringify({ action, node: receipt }, null, 2));
+        return;
+    }
+    console.log(`work ${action}: ${receipt.qid} (${receipt.path})`);
+}
+function runWorkContractNewCommandLocked(options) {
+    const config = (0, config_1.loadConfig)(options.root);
+    const ws = normalizeWorkspace(options.ws);
+    const { index } = (0, index_cache_1.loadIndex)({ root: options.root, config });
+    const agentId = normalizePortableId(options.agentId, "--agent-id");
+    const relates = findNodeById(index, ws, agentId, "spec") ? [agentId] : [];
+    const receipt = createAgentWorkflowNode({
+        root: options.root,
+        ws,
+        type: "work",
+        title: options.title,
+        id: options.id,
+        now: options.now,
+        overrides: {
+            agent_id: agentId,
+            kind: options.kind.toLowerCase(),
+            pricing_model: normalizeEnum(options.pricingModel ?? "quoted", "--pricing-model", PRICING_MODELS),
+            required_capabilities: parseCsvList(options.requiredCapabilities),
+            inputs: parseCsvList(options.inputs),
+            outputs: parseCsvList(options.outputs),
+            receipt_required: true,
+            relates,
+        },
+    });
+    printReceipt("contract created", receipt, options.json);
+}
+function runWorkOrderNewCommandLocked(options) {
+    const config = (0, config_1.loadConfig)(options.root);
+    const ws = normalizeWorkspace(options.ws);
+    const { index } = (0, index_cache_1.loadIndex)({ root: options.root, config });
+    const workId = normalizePortableId(options.workId, "--work-id");
+    const workNode = requireNodeById(index, ws, workId, "work", "work contract");
+    const workVersion = String(workNode.attributes.version ?? "0.1.0");
+    const receipt = createAgentWorkflowNode({
+        root: options.root,
+        ws,
+        type: "work_order",
+        title: options.title,
+        id: options.id,
+        now: options.now,
+        overrides: {
+            work_id: workId,
+            work_version: workVersion,
+            requester: options.requester,
+            order_status: "submitted",
+            request_ref: options.requestRef ?? "request.redacted",
+            input_refs: parseCsvList(options.inputRefs),
+            requested_outputs: parseCsvList(options.requestedOutputs),
+            constraint_refs: parseCsvList(options.constraintRefs),
+            artifact_policy: "commit_sidecar_and_zip",
+            relates: [workId],
+        },
+    });
+    printReceipt("order created", receipt, options.json);
+}
+function runWorkOrderUpdateCommandLocked(options) {
+    const loaded = loadMutableAgentNode(options.root, options.id, options.ws, "work_order");
+    if (options.status) {
+        loaded.frontmatter.order_status = normalizeEnum(options.status, "--status", ORDER_STATUSES);
+    }
+    loaded.frontmatter.input_refs = appendUnique(toStringList(loaded.frontmatter.input_refs), parseCsvList(options.addInputRefs));
+    loaded.frontmatter.artifacts = appendUnique(toStringList(loaded.frontmatter.artifacts), parseCsvList(options.addArtifacts));
+    loaded.frontmatter.updated = (0, date_1.formatDate)(options.now ?? new Date());
+    writeFrontmatterFile(loaded.filePath, loaded.frontmatter, loaded.body);
+    maybeReindex(options.root, loaded.config);
+    printReceipt("order updated", nodeReceipt(options.root, loaded.node), options.json);
+}
+function runWorkReceiptNewCommandLocked(options) {
+    const config = (0, config_1.loadConfig)(options.root);
+    const ws = normalizeWorkspace(options.ws);
+    const { index } = (0, index_cache_1.loadIndex)({ root: options.root, config });
+    const workOrderId = normalizePortableId(options.workOrderId, "--work-order-id");
+    requireNodeById(index, ws, workOrderId, "work_order", "work order");
+    const receipt = createAgentWorkflowNode({
+        root: options.root,
+        ws,
+        type: "receipt",
+        title: options.title,
+        id: options.id,
+        now: options.now,
+        overrides: {
+            work_order_id: workOrderId,
+            receipt_status: normalizeEnum(options.receiptStatus ?? "recorded", "--receipt-status", RECEIPT_STATUSES),
+            outcome: normalizeEnum(options.outcome, "--outcome", OUTCOMES),
+            cost_ref: options.costRef ?? "cost.redacted",
+            artifacts: parseCsvList(options.artifacts),
+            proof_refs: parseCsvList(options.proofRefs),
+            attestation_refs: parseCsvList(options.attestationRefs),
+            input_hashes: parseCsvList(options.inputHashes),
+            output_hashes: parseCsvList(options.outputHashes),
+            relates: [workOrderId],
+        },
+    });
+    printReceipt("receipt created", receipt, options.json);
+}
+function runWorkReceiptUpdateCommandLocked(options) {
+    const loaded = loadMutableAgentNode(options.root, options.id, options.ws, "receipt");
+    if (options.receiptStatus) {
+        loaded.frontmatter.receipt_status = normalizeEnum(options.receiptStatus, "--receipt-status", RECEIPT_STATUSES);
+    }
+    loaded.frontmatter.artifacts = appendUnique(toStringList(loaded.frontmatter.artifacts), parseCsvList(options.addArtifacts));
+    loaded.frontmatter.proof_refs = appendUnique(toStringList(loaded.frontmatter.proof_refs), parseCsvList(options.addProofRefs));
+    loaded.frontmatter.attestation_refs = appendUnique(toStringList(loaded.frontmatter.attestation_refs), parseCsvList(options.addAttestationRefs));
+    loaded.frontmatter.updated = (0, date_1.formatDate)(options.now ?? new Date());
+    writeFrontmatterFile(loaded.filePath, loaded.frontmatter, loaded.body);
+    maybeReindex(options.root, loaded.config);
+    printReceipt("receipt updated", nodeReceipt(options.root, loaded.node), options.json);
+}
+function runWorkArtifactAddCommandLocked(options) {
+    const config = (0, config_1.loadConfig)(options.root);
+    const ws = normalizeWorkspace(options.ws);
+    const { index } = (0, index_cache_1.loadIndex)({ root: options.root, config });
+    const target = resolveWorkNode(index, options.targetId, ws, new Set(["work_order", "receipt"]), "work order or receipt");
+    const archiveLogs = [];
+    const originalLog = console.log;
+    console.log = (...args) => {
+        archiveLogs.push(args.map(String).join(" "));
+    };
+    let archivePayload = {};
+    try {
+        (0, archive_1.runArchiveAddCommand)({
+            root: options.root,
+            ws: target.ws,
+            file: options.file,
+            id: options.id,
+            kind: options.kind ?? (target.type === "work_order" ? "source" : "artifact"),
+            relates: target.id,
+            json: true,
+            now: options.now,
+        });
+        archivePayload = JSON.parse(archiveLogs.join("\n"));
+    }
+    finally {
+        console.log = originalLog;
+    }
+    const archiveUri = archivePayload.archive?.archive_uri;
+    if (!archiveUri) {
+        throw new Error("archive add did not return an archive URI");
+    }
+    const loaded = loadMutableAgentNode(options.root, target.qid, target.ws, target.type);
+    const archiveKind = (options.kind ?? (target.type === "work_order" ? "source" : "artifact")).toLowerCase();
+    if (target.type === "work_order" && archiveKind === "source") {
+        loaded.frontmatter.input_refs = appendUnique(toStringList(loaded.frontmatter.input_refs), [archiveUri]);
+    }
+    else {
+        loaded.frontmatter.artifacts = appendUnique(toStringList(loaded.frontmatter.artifacts), [archiveUri]);
+    }
+    if (archivePayload.archive?.id) {
+        loaded.frontmatter.relates = appendUnique(toStringList(loaded.frontmatter.relates), [archivePayload.archive.id]);
+    }
+    loaded.frontmatter.updated = (0, date_1.formatDate)(options.now ?? new Date());
+    writeFrontmatterFile(loaded.filePath, loaded.frontmatter, loaded.body);
+    maybeReindex(options.root, loaded.config);
+    if (options.json) {
+        console.log(JSON.stringify({
+            action: "artifact_registered",
+            target: nodeReceipt(options.root, target),
+            archive: archivePayload.archive,
+        }, null, 2));
+        return;
+    }
+    console.log(`work artifact registered: ${target.qid} -> ${archiveUri}`);
+}
+function withWorkLock(root, fn) {
+    const config = (0, config_1.loadConfig)(root);
+    return (0, lock_1.withMutationLock)(root, config.index.lock_timeout_ms, fn);
+}
+function runWorkContractNewCommand(options) {
+    return withWorkLock(options.root, () => runWorkContractNewCommandLocked(options));
+}
+function runWorkOrderNewCommand(options) {
+    return withWorkLock(options.root, () => runWorkOrderNewCommandLocked(options));
+}
+function runWorkOrderUpdateCommand(options) {
+    return withWorkLock(options.root, () => runWorkOrderUpdateCommandLocked(options));
+}
+function runWorkReceiptNewCommand(options) {
+    return withWorkLock(options.root, () => runWorkReceiptNewCommandLocked(options));
+}
+function runWorkReceiptUpdateCommand(options) {
+    return withWorkLock(options.root, () => runWorkReceiptUpdateCommandLocked(options));
+}
+function runWorkArtifactAddCommand(options) {
+    return withWorkLock(options.root, () => runWorkArtifactAddCommandLocked(options));
+}

package/dist/commands/workspace.js

@@ -21,6 +21,7 @@ function workspaceReceipt(alias, workspace) {
         path: workspace.path,
         enabled: workspace.enabled,
         mdkg_dir: workspace.mdkg_dir,
+        visibility: workspace.visibility ?? "private",
     };
 }
 function printWorkspaceMutationReceipt(action, workspace, json) {
@@ -90,6 +91,7 @@ function runWorkspaceListCommand(options) {
                     path: ws.path,
                     enabled: ws.enabled,
                     mdkg_dir: ws.mdkg_dir,
+                    visibility: ws.visibility,
                 };
             }),
         }, null, 2));
@@ -102,13 +104,21 @@ function runWorkspaceListCommand(options) {
     for (const alias of aliases) {
         const ws = config.workspaces[alias];
         const status = ws.enabled ? "enabled" : "disabled";
-        console.log(`${alias} | ${status} | ${ws.path} | ${ws.mdkg_dir}`);
+        console.log(`${alias} | ${status} | ${ws.visibility} | ${ws.path} | ${ws.mdkg_dir}`);
     }
 }
+function normalizeVisibility(value) {
+    const normalized = (value ?? "private").toLowerCase();
+    if (normalized === "private" || normalized === "internal" || normalized === "public") {
+        return normalized;
+    }
+    throw new errors_1.UsageError("--visibility must be private, internal, or public");
+}
 function runWorkspaceAddCommand(options) {
     const alias = normalizeAlias(options.alias);
     const workspacePath = normalizeCommandWorkspacePath(options.workspacePath, "workspace path");
     const mdkgDir = normalizeCommandWorkspacePath(options.mdkgDir ?? ".mdkg", "workspace mdkg dir");
+    const visibility = normalizeVisibility(options.visibility);
     if ((0, workspace_path_1.isRootWorkspacePath)(workspacePath)) {
         throw new errors_1.UsageError('workspace path must not be "." for non-root workspaces');
     }
@@ -133,7 +143,7 @@ function runWorkspaceAddCommand(options) {
             throw new errors_1.UsageError(`workspace document root already registered by ${existingAlias}`);
         }
     }
-    const workspace = { path: workspacePath, enabled: true, mdkg_dir: mdkgDir };
+    const workspace = { path: workspacePath, enabled: true, mdkg_dir: mdkgDir, visibility };
     workspaces[alias] = workspace;
     raw.workspaces = workspaces;
     writeRawConfig(configPath, raw);

package/dist/core/config.js

@@ -20,6 +20,12 @@ const PACK_EDGE_KEYS = new Set([
     "next",
 ]);
 const NEXT_WORK_STRATEGIES = new Set(["chain_then_priority"]);
+const WORKSPACE_VISIBILITY_VALUES = new Set(["private", "internal", "public"]);
+const BUNDLE_PROFILE_VALUES = new Set(["private", "public"]);
+const INDEX_BACKEND_VALUES = new Set(["json", "sqlite"]);
+const DEFAULT_ARCHIVE_LARGE_CACHE_WARNING_BYTES = 26214400;
+const DEFAULT_SQLITE_COMMIT_WARNING_BYTES = 52428800;
+const DEFAULT_LOCK_TIMEOUT_MS = 10000;
 function isObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -166,6 +172,18 @@ function validateWorkspaceAlias(alias, errors) {
         errors.push(`workspaces.${alias} alias must be lowercase and use [a-z0-9_]`);
     }
 }
+function validateBundleImportAlias(alias, workspaces, errors) {
+    if (alias === "all") {
+        errors.push("bundle_imports.all alias is reserved");
+        return;
+    }
+    if (alias !== alias.toLowerCase() || !WORKSPACE_ALIAS_RE.test(alias)) {
+        errors.push(`bundle_imports.${alias} alias must be lowercase and use [a-z0-9_]`);
+    }
+    if (workspaces[alias]) {
+        errors.push(`bundle_imports.${alias} must not collide with workspaces.${alias}`);
+    }
+}
 function requireContainedPath(value, path, errors) {
     const raw = requireString(value, path, errors);
     if (!raw) {
@@ -188,16 +206,58 @@ function validateConfigSchema(raw) {
     const schema_version = requireNumber(raw.schema_version, "schema_version", errors);
     const tool = requireString(raw.tool, "tool", errors);
     const root_required = requireBoolean(raw.root_required, "root_required", errors);
+    const archiveRaw = raw.archive === undefined
+        ? { large_cache_warning_bytes: DEFAULT_ARCHIVE_LARGE_CACHE_WARNING_BYTES }
+        : requireObject(raw.archive, "archive", errors);
     const indexRaw = requireObject(raw.index, "index", errors);
+    const capabilitiesRaw = raw.capabilities === undefined
+        ? { cache_path: ".mdkg/index/capabilities.json" }
+        : requireObject(raw.capabilities, "capabilities", errors);
+    const bundlesRaw = raw.bundles === undefined
+        ? { output_dir: ".mdkg/bundles", default_profile: "private" }
+        : requireObject(raw.bundles, "bundles", errors);
+    const bundleImportsRaw = raw.bundle_imports === undefined
+        ? {}
+        : requireObject(raw.bundle_imports, "bundle_imports", errors);
     const packRaw = requireObject(raw.pack, "pack", errors);
     const templatesRaw = requireObject(raw.templates, "templates", errors);
     const workRaw = requireObject(raw.work, "work", errors);
     const workspacesRaw = requireObject(raw.workspaces, "workspaces", errors);
+    const archive = archiveRaw
+        ? {
+            large_cache_warning_bytes: archiveRaw.large_cache_warning_bytes === undefined
+                ? DEFAULT_ARCHIVE_LARGE_CACHE_WARNING_BYTES
+                : requireNonNegativeInteger(archiveRaw.large_cache_warning_bytes, "archive.large_cache_warning_bytes", errors),
+        }
+        : undefined;
     const index = indexRaw
         ? {
             auto_reindex: requireBoolean(indexRaw.auto_reindex, "index.auto_reindex", errors),
             tolerant: requireBoolean(indexRaw.tolerant, "index.tolerant", errors),
+            backend: indexRaw.backend === undefined
+                ? "json"
+                : requireStringInSet(indexRaw.backend, "index.backend", INDEX_BACKEND_VALUES, errors),
             global_index_path: requireContainedPath(indexRaw.global_index_path, "index.global_index_path", errors),
+            sqlite_path: indexRaw.sqlite_path === undefined
+                ? ".mdkg/index/mdkg.sqlite"
+                : requireContainedPath(indexRaw.sqlite_path, "index.sqlite_path", errors),
+            sqlite_commit_warning_bytes: indexRaw.sqlite_commit_warning_bytes === undefined
+                ? DEFAULT_SQLITE_COMMIT_WARNING_BYTES
+                : requireNonNegativeInteger(indexRaw.sqlite_commit_warning_bytes, "index.sqlite_commit_warning_bytes", errors),
+            lock_timeout_ms: indexRaw.lock_timeout_ms === undefined
+                ? DEFAULT_LOCK_TIMEOUT_MS
+                : requirePositiveInteger(indexRaw.lock_timeout_ms, "index.lock_timeout_ms", errors),
+        }
+        : undefined;
+    const capabilities = capabilitiesRaw
+        ? {
+            cache_path: requireContainedPath(capabilitiesRaw.cache_path, "capabilities.cache_path", errors),
+        }
+        : undefined;
+    const bundles = bundlesRaw
+        ? {
+            output_dir: requireContainedPath(bundlesRaw.output_dir, "bundles.output_dir", errors),
+            default_profile: requireStringInSet(bundlesRaw.default_profile, "bundles.default_profile", BUNDLE_PROFILE_VALUES, errors),
         }
         : undefined;
     const packLimitsRaw = packRaw ? requireObject(packRaw.limits, "pack.limits", errors) : undefined;
@@ -268,7 +328,10 @@ function validateConfigSchema(raw) {
             const wsPath = requireString(ws.path, `workspaces.${alias}.path`, errors);
             const wsEnabled = requireBoolean(ws.enabled, `workspaces.${alias}.enabled`, errors);
             const wsMdkgDir = requireString(ws.mdkg_dir, `workspaces.${alias}.mdkg_dir`, errors);
-            if (wsPath && wsEnabled !== undefined && wsMdkgDir) {
+            const wsVisibility = ws.visibility === undefined
+                ? "private"
+                : requireStringInSet(ws.visibility, `workspaces.${alias}.visibility`, WORKSPACE_VISIBILITY_VALUES, errors);
+            if (wsPath && wsEnabled !== undefined && wsMdkgDir && wsVisibility) {
                 let normalizedPath;
                 let normalizedMdkgDir;
                 try {
@@ -303,6 +366,7 @@ function validateConfigSchema(raw) {
                     path: normalizedPath,
                     enabled: wsEnabled,
                     mdkg_dir: normalizedMdkgDir,
+                    visibility: wsVisibility,
                 };
             }
         }
@@ -325,6 +389,52 @@ function validateConfigSchema(raw) {
             errors.push('workspaces.root.mdkg_dir must be ".mdkg"');
         }
     }
+    const bundle_imports = {};
+    if (bundleImportsRaw) {
+        for (const [alias, entry] of Object.entries(bundleImportsRaw)) {
+            validateBundleImportAlias(alias, workspaces, errors);
+            const rawImport = requireObject(entry, `bundle_imports.${alias}`, errors);
+            if (!rawImport) {
+                continue;
+            }
+            const importPath = requireContainedPath(rawImport.path, `bundle_imports.${alias}.path`, errors);
+            const enabled = rawImport.enabled === undefined
+                ? true
+                : requireBoolean(rawImport.enabled, `bundle_imports.${alias}.enabled`, errors);
+            const visibility = rawImport.visibility === undefined
+                ? "private"
+                : requireStringInSet(rawImport.visibility, `bundle_imports.${alias}.visibility`, WORKSPACE_VISIBILITY_VALUES, errors);
+            const expectedProfile = rawImport.expected_profile === undefined
+                ? "private"
+                : requireStringInSet(rawImport.expected_profile, `bundle_imports.${alias}.expected_profile`, BUNDLE_PROFILE_VALUES, errors);
+            const sourcePath = rawImport.source_path === undefined
+                ? undefined
+                : requireContainedPath(rawImport.source_path, `bundle_imports.${alias}.source_path`, errors);
+            const sourceRepo = rawImport.source_repo === undefined
+                ? undefined
+                : requireString(rawImport.source_repo, `bundle_imports.${alias}.source_repo`, errors);
+            const maxStaleSeconds = rawImport.max_stale_seconds === undefined
+                ? undefined
+                : requirePositiveInteger(rawImport.max_stale_seconds, `bundle_imports.${alias}.max_stale_seconds`, errors);
+            if (visibility !== undefined &&
+                expectedProfile !== undefined &&
+                visibility !== "private" &&
+                expectedProfile !== "public") {
+                errors.push(`bundle_imports.${alias}.expected_profile must be public when visibility is ${visibility}`);
+            }
+            if (importPath && enabled !== undefined && visibility && expectedProfile) {
+                bundle_imports[alias] = {
+                    path: importPath,
+                    enabled,
+                    visibility: visibility,
+                    expected_profile: expectedProfile,
+                    ...(sourcePath ? { source_path: sourcePath } : {}),
+                    ...(sourceRepo ? { source_repo: sourceRepo } : {}),
+                    ...(maxStaleSeconds !== undefined ? { max_stale_seconds: maxStaleSeconds } : {}),
+                };
+            }
+        }
+    }
     if (errors.length > 0) {
         throw new Error(`config validation failed:\n${errors.join("\n")}`);
     }
@@ -332,7 +442,11 @@ function validateConfigSchema(raw) {
         schema_version: schema_version,
         tool: tool,
         root_required: root_required,
+        archive: archive,
         index: index,
+        capabilities: capabilities,
+        bundles: bundles,
+        bundle_imports,
         pack: pack,
         templates: templates,
         work: work,