LibraryItem

One item of the organisation’s Belai library that is not an agent or a crew: a skill (an Agent Skills SKILL.md), prompt, command, process, MCP server, repo, budget set, provider set, bash rewrite table, hook bundle or launch configuration. The body is the item exactly as the library stores it, and the item’s name is the one the body carries; the library holds one live item of a name per type, and neither the type nor the name can change under a metadata.name. The server checks the body with the library’s own validator, the one the console and the Belai CLI use. Every apply that changes it saves a new version; deleting the document hides the item and keeps its versions. An item nobody declared is exported under its name.

apiVersion	vulnetix.com/v1
kind	LibraryItem
Group	AI libraries
Status	Served. The config engine plans and applies it.
Objects per tenant	many, keyed by metadata.name
Token and role	An owner or admin session, or a vmt_ config management token with the owner or admin role that lists LibraryItem in its kinds. See Management tokens.
Terraform resource	vulnetix_library_item, imported by name (see Terraform and OpenTofu)
CLI	vulnetix config apply, CLI v3.168.0 and later.
Pinned schema	v1.15.0/LibraryItem.schema.json
Newest schema	latest/LibraryItem.schema.json
First released in	v1.6.0
Print the built-in copy	vulnetix config schema LibraryItem

Minimal

Only the fields the kind requires. From examples/LibraryItem/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/LibraryItem.schema.json
apiVersion: vulnetix.com/v1
kind: LibraryItem
metadata:
  name: pdf-tools
spec:
  type: skill
  body: |
    ---
    name: pdf-tools
    description: Read, split and merge PDF files.
    ---
    Use the pdf tools on the path the user gives.

HCL (resource vulnetix_library_item)

# Only the arguments the kind requires. From config-schemas examples/LibraryItem/minimal.yaml.

resource "vulnetix_library_item" "pdf_tools" {
  name = "pdf-tools"
  body = "---\nname: pdf-tools\ndescription: Read, split and merge PDF files.\n---\nUse the pdf tools on the path the user gives.\n"
  type = "skill"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/LibraryItem.schema.json
apiVersion: vulnetix.com/v1
kind: LibraryItem
metadata:
  name: pdf-tools
spec:
  type: skill
  body: |
    ---
    name: pdf-tools
    description: Read, split and merge PDF files.
    ---
    Use the pdf tools on the path the user gives.
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/LibraryItem/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/LibraryItem.schema.json
apiVersion: vulnetix.com/v1
kind: LibraryItem
metadata:
  name: install-guard
  labels:
    team: platform
spec:
  type: hook
  body: |
    {
      "name": "install-guard",
      "description": "Checks package installs before they run",
      "hooks": {
        "PreToolUse": [
          {"matcher": "Bash", "hooks": [{"type": "command", "command": "bash scripts/guard.sh", "timeout": 30}]}
        ]
      }
    }
  files:
    - path: scripts/guard.sh
      body: |
        #!/usr/bin/env bash
        exec vulnetix agent hook
    - path: scripts/allow.txt
      file: hooks/install-guard/allow.txt
---
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/LibraryItem.schema.json
apiVersion: vulnetix.com/v1
kind: LibraryItem
metadata:
  name: triage-prompt
spec:
  type: prompt
  file: prompts/triage.md

HCL (resource vulnetix_library_item)

# Every argument the kind supports. From config-schemas examples/LibraryItem/advanced.yaml.

resource "vulnetix_library_item" "install_guard" {
  name = "install-guard"
  body = "{\n  \"name\": \"install-guard\",\n  \"description\": \"Checks package installs before they run\",\n  \"hooks\": {\n    \"PreToolUse\": [\n      {\"matcher\": \"Bash\", \"hooks\": [{\"type\": \"command\", \"command\": \"bash scripts/guard.sh\", \"timeout\": 30}]}\n    ]\n  }\n}\n"
  files = [
    {
      body = "#!/usr/bin/env bash\nexec vulnetix agent hook\n"
      path = "scripts/guard.sh"
    },
    {
      file = "hooks/install-guard/allow.txt"
      path = "scripts/allow.txt"
    },
  ]
  type = "hook"
  labels = {
    team = "platform"
  }
}

resource "vulnetix_library_item" "triage_prompt" {
  name = "triage-prompt"
  file = "prompts/triage.md"
  type = "prompt"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/LibraryItem.schema.json
apiVersion: vulnetix.com/v1
kind: LibraryItem
metadata:
  name: install-guard
  labels:
    team: platform
spec:
  type: hook
  body: |
    {
      "name": "install-guard",
      "description": "Checks package installs before they run",
      "hooks": {
        "PreToolUse": [
          {"matcher": "Bash", "hooks": [{"type": "command", "command": "bash scripts/guard.sh", "timeout": 30}]}
        ]
      }
    }
  files:
    - path: scripts/guard.sh
      body: |
        #!/usr/bin/env bash
        exec vulnetix agent hook
    - path: scripts/allow.txt
      file: hooks/install-guard/allow.txt
---
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/LibraryItem.schema.json
apiVersion: vulnetix.com/v1
kind: LibraryItem
metadata:
  name: triage-prompt
spec:
  type: prompt
  file: prompts/triage.md
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Description
apiVersion	string	yes		exactly vulnetix.com/v1	The document format version. Every kind in this release is vulnetix.com/v1.
kind	string	yes		exactly LibraryItem	Always LibraryItem.
metadata	object	yes		no other keys
metadata.name	string	yes		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
metadata.org	string	no		format uuid	The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
metadata.labels	object	no		map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$	Free key/value labels. Stored with the object, never interpreted by the server.
metadata.annotations	object	no		map of string to string (length 0 to 4096)	Free key/value notes for people and tools, such as a ticket link.
spec	object	yes		no other keys
spec.type	string	yes		skill, prompt, command, process, mcp, repo, budget, provider, rewrite, hook, launch	skill, prompt and command are markdown with front matter; the others are JSON documents in the library’s format for that type.
spec.body	string	no		length 1 to 262144	The item: markdown for skill, prompt and command, JSON for the rest. The library’s size limit for the type applies.
spec.file	string	no		length 1 to 1024	A file holding the item, the same as body.
spec.files	array of object	no		0 to 32 items	The scripts a hook bundle runs, written beside its hooks.json. Only a hook carries files: at most 32, each a relative path of safe segments (not hooks.json) and UTF-8 text of up to 256 KiB.
spec.files[].path	string	yes		length 1 to 1024	Where the file is written, relative to the agent: one line, no .. segment, naming a file.
spec.files[].body	string	no		length 1 to 262144	The file’s contents.
spec.files[].file	string	no		length 1 to 1024	A file holding the contents, the same as body.

Rules

Conditions the schema enforces beyond each field’s own type. vulnetix config validate and the engine’s plan report a document that breaks one.

On	Rule
spec	When type is not hook: files is not allowed.
spec	Exactly one of body or file is set.
spec.files[]	Exactly one of body or file is set.

Applying this kind

• Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
• Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
• Status. Applied, Unchanged or Deleted, with no other status fields. The phases the engine reports are explained under status phases.

How apply treats it

• Every type is checked by the one library validator that the console, the Belai handlers and the engine share.
• The item’s type and name, read from its body, cannot change under a metadata.name.
• Only a hook carries files.
• Apply saves a new version. A version object written by an apply that does not commit is removed.
• Delete hides the item.

Terraform and OpenTofu

The resource is vulnetix_library_item in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_library_item.

Import an object that already exists by its name:

# Import an existing LibraryItem by its name (metadata.name).
terraform import vulnetix_library_item.pdf_tools pdf-tools

Install, authentication and how state is read: Terraform and OpenTofu.

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.