{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "mnote://skills/mnote-vault/env.schema.json",
  "title": "mnote-vault agent env contract",
  "description": "Skill 只声明变量契约；真实 secret 写在本机 ~/.config/mnote/**（0600），禁止写入 SKILL.md / git。",
  "type": "object",
  "additionalProperties": false,
  "properties": {
    "MNOTE_VAULT_TOKEN_FILE": {
      "type": "string",
      "secret": true,
      "description": "Capability token 文件路径（mnv1.* 单行）。优先于默认 default.token。",
      "default": "~/.config/mnote/vault-tokens/default.token",
      "examples": [
        "~/.config/mnote/vault-tokens/mnote-e2e.token",
        "~/.config/mnote/vault-tokens/liaibo.token"
      ]
    },
    "MNOTE_VAULT_TOKEN": {
      "type": "string",
      "secret": true,
      "description": "内联 mnv1.* token；与 FILE 二选一，进程 env 优先于文件。",
      "optional": true
    },
    "MNOTE_AI_VAULT_ACTOR": {
      "type": "string",
      "description": "AI 密码本 actor；多 agent 共享读密策略时默认 mnote-e2e。",
      "default": "mnote-e2e"
    },
    "MNOTE_VAULT_WORKSPACE": {
      "type": "string",
      "description": "覆盖 vault workspace 根目录（可选）。",
      "optional": true
    },
    "MNOTE_VAULT_SESSION_TTL_HOURS": {
      "type": "string",
      "description": "外站 login session 默认 TTL 小时。",
      "default": "168",
      "optional": true
    },
    "MNOTE_VAULT_SOCK": {
      "type": "string",
      "description": "可选 mnote-vaultd UDS 路径。",
      "optional": true
    },
    "MNOTE_WEB_PAT": {
      "type": "string",
      "secret": true,
      "description": "Web PAT（mnpat1.*）。用于笔记 API，不是 vault resolve。可与 vault 变量同写 agent-env。",
      "optional": true
    },
    "MNOTE_API_TOKEN": {
      "type": "string",
      "secret": true,
      "description": "MNOTE_WEB_PAT 的别名。",
      "optional": true
    },
    "MNOTE_WEB_BASE_URL": {
      "type": "string",
      "description": "mnote-web 基址（仅笔记 API 需要）。",
      "default": "http://127.0.0.1:3000",
      "optional": true
    }
  },
  "notes": [
    "业务上游 API Key / 站点密码：只存密码箱条目，运行时 mnote-vault resolve --field apikey|password|token。",
    "禁止把 secret 写进 skills/** 或仓库。",
    "一主体一 token 文件：~/.config/mnote/vault-tokens/<subject>.token",
    "Agent 启动可 source ~/.config/mnote/agent-env/<agent>.env"
  ]
}