"use strict";

const { AGENT_KINDS, CAPABILITY_STATUS } = require("../constants.cjs");

/** @type {import("../types.cjs").CapabilityDefinition[]} */
const VAULT_CAPABILITIES = [
  {
    id: "vault.host.get",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Get host metadata from the vault.",
    policy: {
      write: false,
      sensitiveRead: true,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: true,
      bypassesChatCancel: true,
    },
    surfaces: {
      cli: { command: ["vault", "host", "get"] },
      global: { rpcMethod: "vault/host/get" },
      public: { rpcMethod: "public/vault/host/get", mcpTool: "host_get" },
    },
  },
  {
    id: "vault.host.list",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "List saved hosts in the vault (metadata only — no passwords or keys).",
    policy: {
      write: false,
      sensitiveRead: true,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: true,
      bypassesChatCancel: true,
    },
    surfaces: {
      global: { rpcMethod: "vault/hosts/list" },
      public: { rpcMethod: "public/vault/hosts/list", mcpTool: "vault_hosts_list" },
    },
  },
  {
    id: "vault.host.open",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description:
      "Open a vault host by creating a new terminal tab and starting the connection. Returns the new sessionId so you can run terminal/SFTP tools against it. Use vault_hosts_list first when you only know the label or hostname.",
    // Sidebar Catty is scoped to already-open terminals/workspaces and must not
    // expand that scope mid-turn. Keep host_open for MCP / CLI / global agent.
    agentKinds: [AGENT_KINDS.GLOBAL],
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      cli: { command: ["vault", "host", "open"] },
      global: { rpcMethod: "vault/hosts/open" },
      public: { rpcMethod: "public/vault/hosts/open", mcpTool: "host_open" },
    },
  },
  {
    id: "vault.hosts.create",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Create vault hosts from structured host objects. Use when the user wants to add/create a host (Vault → Hosts). NOT for Vault → Notes sidebar documentation.",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      global: { rpcMethod: "vault/hosts/create" },
      public: { rpcMethod: "public/vault/hosts/create", mcpTool: "vault_hosts_create" },
    },
  },
  {
    id: "vault.host.update",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Update selected fields on an existing vault host. Use vault_hosts_list first to resolve the hostId.",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      global: { rpcMethod: "vault/hosts/update" },
      public: { rpcMethod: "public/vault/hosts/update", mcpTool: "vault_hosts_update" },
    },
  },
  {
    id: "vault.host.delete",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Delete a saved vault host by id. Use vault_hosts_list first to resolve the hostId.",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      global: { rpcMethod: "vault/hosts/delete" },
      public: { rpcMethod: "public/vault/hosts/delete", mcpTool: "vault_hosts_delete" },
    },
  },
  {
    id: "vault.host.import",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Parse known host export file formats (PuTTY, MobaXterm, CSV, SecureCRT, ssh_config) into vault hosts. For arbitrary unstructured text, map to host objects and use vault_hosts_create instead.",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      global: { rpcMethod: "vault/hosts/import" },
      public: { rpcMethod: "public/vault/hosts/import", mcpTool: "vault_hosts_import" },
    },
  },
  {
    id: "vault.host.notes.get",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Read host metadata notes attached to a saved host (Host Details panel — not Vault sidebar Notes).",
    policy: {
      write: false,
      sensitiveRead: true,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: true,
      bypassesChatCancel: true,
    },
    surfaces: {
      cli: { command: ["vault", "host-notes", "get"] },
      global: { rpcMethod: "vault/host/notes/get" },
      public: { rpcMethod: "public/vault/hostNotes/get", mcpTool: "host_notes_get" },
    },
  },
  {
    id: "vault.host.notes.set",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Update host metadata notes on a saved host (Host Details panel — not Vault sidebar Notes).",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      cli: { command: ["vault", "host-notes", "set"] },
      global: { rpcMethod: "vault/host/notes/set" },
      public: { rpcMethod: "public/vault/hostNotes/set", mcpTool: "host_notes_set" },
    },
  },
  {
    id: "vault.note.list",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "List notes in Vault → Notes (markdown notes visible in the vault sidebar).",
    policy: {
      write: false,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: true,
      bypassesChatCancel: true,
    },
    surfaces: {
      global: { rpcMethod: "vault/notes/list" },
      public: { rpcMethod: "public/vault/notes/list", mcpTool: "vault_notes_list" },
    },
  },
  {
    id: "vault.note.get",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Read or search a Vault → Notes entry by exact id, at most 6000 characters per call. Content is only the returned range, not necessarily the whole note. Follow nextOffset with expectedUpdatedAt until null for a complete read; query searches only return matching excerpts. Read every range without query before summarizing the whole note or replacing its content; never treat unread text as absent. For long notes, retain section summaries rather than repeatedly loading all ranges. If the note changed, restart.",
    policy: {
      write: false,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: true,
      bypassesChatCancel: true,
    },
    surfaces: {
      global: { rpcMethod: "vault/notes/get" },
      public: { rpcMethod: "public/vault/notes/get", mcpTool: "vault_notes_get" },
    },
  },
  {
    id: "vault.note.create",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Create a note in Vault → Notes sidebar (markdown documentation). NOT for adding SSH hosts — use vault_hosts_create for that.",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      global: { rpcMethod: "vault/notes/create" },
      public: { rpcMethod: "public/vault/notes/create", mcpTool: "vault_notes_create" },
    },
  },
  {
    id: "vault.note.update",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Update an existing Vault → Notes entry by id.",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      global: { rpcMethod: "vault/notes/update" },
      public: { rpcMethod: "public/vault/notes/update", mcpTool: "vault_notes_update" },
    },
  },
  {
    id: "vault.note.delete",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Delete a Vault → Notes entry by id.",
    policy: { write: true, sensitiveRead: false, longRunning: false, requiresChatSession: false, bypassesObserverBlock: false, bypassesApproval: false, bypassesChatCancel: false },
    surfaces: {
      global: { rpcMethod: "vault/notes/delete" },
      public: { rpcMethod: "public/vault/notes/delete", mcpTool: "vault_notes_delete" },
    },
  },
  {
    id: "vault.identity.list",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "List reusable vault identities without passwords, private keys, or passphrases.",
    policy: { write: false, sensitiveRead: true, longRunning: false, requiresChatSession: false, bypassesObserverBlock: false, bypassesApproval: true, bypassesChatCancel: true },
    surfaces: {
      global: { rpcMethod: "vault/identities/list" },
      public: { rpcMethod: "public/vault/identities/list", mcpTool: "vault_identities_list" },
    },
  },
  {
    id: "vault.proxyProfile.list",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "List reusable proxy profiles without credentials.",
    policy: { write: false, sensitiveRead: true, longRunning: false, requiresChatSession: false, bypassesObserverBlock: false, bypassesApproval: true, bypassesChatCancel: true },
    surfaces: {
      global: { rpcMethod: "vault/proxyProfiles/list" },
      public: { rpcMethod: "public/vault/proxyProfiles/list", mcpTool: "vault_proxy_profiles_list" },
    },
  },
  ...[
    ["vault.group.list", "List vault groups and their safe default settings.", "list", "vault_groups_list", false],
    ["vault.group.create", "Create a vault group with optional default connection settings.", "create", "vault_groups_create", true],
    ["vault.group.update", "Update or rename a vault group and its default connection settings.", "update", "vault_groups_update", true],
    ["vault.group.delete", "Delete a vault group, moving its hosts to the root unless deleteHosts is true.", "delete", "vault_groups_delete", true],
  ].map(([id, description, action, mcpTool, write]) => ({
    id,
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description,
    policy: { write, sensitiveRead: false, longRunning: false, requiresChatSession: false, bypassesObserverBlock: false, bypassesApproval: !write, bypassesChatCancel: !write },
    surfaces: {
      global: { rpcMethod: `vault/groups/${action}` },
      public: { rpcMethod: `public/vault/groups/${action}`, mcpTool },
    },
  })),
  {
    id: "vault.snippets.list",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "List code snippets stored in the vault.",
    policy: {
      write: false,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: true,
      bypassesChatCancel: true,
    },
    surfaces: {
      cli: { command: ["snippets", "list"] },
      global: { rpcMethod: "vault/snippets/list" },
      public: { rpcMethod: "public/vault/snippets/list", mcpTool: "snippets_list" },
    },
  },
  {
    id: "vault.snippets.get",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Get a single code snippet from the vault.",
    policy: {
      write: false,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: true,
      bypassesChatCancel: true,
    },
    surfaces: {
      cli: { command: ["snippets", "get"] },
      global: { rpcMethod: "vault/snippets/get" },
      public: { rpcMethod: "public/vault/snippets/get", mcpTool: "snippets_get" },
    },
  },
  {
    id: "vault.snippets.run",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Run a vault snippet or automation script in a terminal session. Text snippets paste shell commands; scripts (kind=script) run via the nct JavaScript runtime.",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: true,
      requiresChatSession: true,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      cli: { command: ["snippets", "run"] },
      global: { rpcMethod: "vault/snippets/run" },
      public: { rpcMethod: "public/vault/snippets/run", mcpTool: "snippets_run" },
    },
  },
  {
    id: "vault.snippets.create",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Create a vault snippet or automation script (set kind=script for nct automation).",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      cli: { command: ["snippets", "create"] },
      global: { rpcMethod: "vault/snippets/create" },
      public: { rpcMethod: "public/vault/snippets/create", mcpTool: "snippets_create" },
    },
  },
  {
    id: "vault.snippets.update",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Update an existing vault snippet or automation script by id.",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      cli: { command: ["snippets", "update"] },
      global: { rpcMethod: "vault/snippets/update" },
      public: { rpcMethod: "public/vault/snippets/update", mcpTool: "snippets_update" },
    },
  },
  {
    id: "vault.snippets.delete",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Delete a vault snippet or automation script by id.",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      cli: { command: ["snippets", "delete"] },
      global: { rpcMethod: "vault/snippets/delete" },
      public: { rpcMethod: "public/vault/snippets/delete", mcpTool: "snippets_delete" },
    },
  },
  {
    id: "vault.scripts.list",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "List automation scripts (kind=script) in the vault.",
    policy: {
      write: false,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: true,
      bypassesChatCancel: true,
    },
    surfaces: {
      cli: { command: ["scripts", "list"] },
      global: { rpcMethod: "vault/scripts/list" },
      public: { rpcMethod: "public/vault/scripts/list", mcpTool: "scripts_list" },
    },
  },
  {
    id: "vault.scripts.get",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Get a single automation script including JavaScript source.",
    policy: {
      write: false,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: true,
      bypassesChatCancel: true,
    },
    surfaces: {
      cli: { command: ["scripts", "get"] },
      global: { rpcMethod: "vault/scripts/get" },
      public: { rpcMethod: "public/vault/scripts/get", mcpTool: "scripts_get" },
    },
  },
  {
    id: "vault.scripts.create",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Create an automation script using the nct JavaScript API. Call scripts_reference first when authoring nct automation.",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      cli: { command: ["scripts", "create"] },
      global: { rpcMethod: "vault/scripts/create" },
      public: { rpcMethod: "public/vault/scripts/create", mcpTool: "scripts_create" },
    },
  },
  {
    id: "vault.scripts.update",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Update an automation script by id (partial fields).",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      cli: { command: ["scripts", "update"] },
      global: { rpcMethod: "vault/scripts/update" },
      public: { rpcMethod: "public/vault/scripts/update", mcpTool: "scripts_update" },
    },
  },
  {
    id: "vault.scripts.delete",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Delete an automation script and remove host connect bindings.",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      cli: { command: ["scripts", "delete"] },
      global: { rpcMethod: "vault/scripts/delete" },
      public: { rpcMethod: "public/vault/scripts/delete", mcpTool: "scripts_delete" },
    },
  },
  {
    id: "vault.scripts.run",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Run an automation script in a terminal session via the nct runtime. Set wait=true to block until completion.",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: true,
      requiresChatSession: true,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      cli: { command: ["scripts", "run"] },
      global: { rpcMethod: "vault/scripts/run" },
      public: { rpcMethod: "public/vault/scripts/run", mcpTool: "scripts_run" },
    },
  },
  {
    id: "vault.scripts.reference",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Return Netcatty automation script syntax: nct API, triggers, host targeting, and source wrapping rules.",
    policy: {
      write: false,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: true,
      bypassesChatCancel: true,
    },
    surfaces: {
      cli: { command: ["scripts", "reference"] },
      global: { rpcMethod: "vault/scripts/reference" },
      public: { rpcMethod: "public/vault/scripts/reference", mcpTool: "scripts_reference" },
    },
  },
  {
    id: "vault.scripts.runs.list",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "List automation script runs (optionally filter by sessionId).",
    policy: {
      write: false,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: true,
      bypassesChatCancel: true,
    },
    surfaces: {
      cli: { command: ["scripts", "runs", "list"] },
      global: { rpcMethod: "vault/scripts/runs/list" },
      public: { rpcMethod: "public/vault/scripts/runs/list", mcpTool: "scripts_runs_list" },
    },
  },
  {
    id: "vault.scripts.run.stop",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Stop a running automation script by runId.",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: true,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      cli: { command: ["scripts", "run", "stop"] },
      global: { rpcMethod: "vault/scripts/run/stop" },
      public: { rpcMethod: "public/vault/scripts/run/stop", mcpTool: "scripts_run_stop" },
    },
  },
  {
    id: "vault.scripts.run.pause",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Pause a running automation script by runId.",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: true,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      cli: { command: ["scripts", "run", "pause"] },
      global: { rpcMethod: "vault/scripts/run/pause" },
      public: { rpcMethod: "public/vault/scripts/run/pause", mcpTool: "scripts_run_pause" },
    },
  },
  {
    id: "vault.scripts.run.resume",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Resume a paused automation script by runId.",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: true,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      cli: { command: ["scripts", "run", "resume"] },
      global: { rpcMethod: "vault/scripts/run/resume" },
      public: { rpcMethod: "public/vault/scripts/run/resume", mcpTool: "scripts_run_resume" },
    },
  },
  {
    id: "vault.scripts.targets.set",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Set host IDs, dynamic group paths, or targetsAllHosts for an automation script. onConnect host IDs sync host connect queues.",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      cli: { command: ["scripts", "targets", "set"] },
      global: { rpcMethod: "vault/scripts/targets/set" },
      public: { rpcMethod: "public/vault/scripts/targets/set", mcpTool: "scripts_targets_set" },
    },
  },
  {
    id: "vault.host.connectScripts.list",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "List resolved onConnect automation scripts for a host (global, dynamic group, then host queue).",
    policy: {
      write: false,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: true,
      bypassesChatCancel: true,
    },
    surfaces: {
      cli: { command: ["vault", "host", "connect-scripts", "list"] },
      global: { rpcMethod: "vault/host/connectScripts/list" },
      public: { rpcMethod: "public/vault/hostConnectScripts/list", mcpTool: "host_connect_scripts_list" },
    },
  },
  {
    id: "vault.host.connectScripts.set",
    domain: "vault",
    status: CAPABILITY_STATUS.IMPLEMENTED,
    description: "Set ordered onConnect script IDs for a host (host-specific queue; globals run separately).",
    policy: {
      write: true,
      sensitiveRead: false,
      longRunning: false,
      requiresChatSession: false,
      bypassesObserverBlock: false,
      bypassesApproval: false,
      bypassesChatCancel: false,
    },
    surfaces: {
      cli: { command: ["vault", "host", "connect-scripts", "set"] },
      global: { rpcMethod: "vault/host/connectScripts/set" },
      public: { rpcMethod: "public/vault/hostConnectScripts/set", mcpTool: "host_connect_scripts_set" },
    },
  },
];

module.exports = { VAULT_CAPABILITIES };