@guuey/config 0.1.0 → 0.1.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guuey/config",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Open-source schemas + loaders for the three guuey config files: agent.json (declarative agent definition), guuey.json (hosted-deploy overlay), and the helper types around them. Consumed by @guuey/cli, the guuey backend, and devs writing their own agent or MCP server.",
   "license": "MIT",
   "type": "module",

package/dist/agent-loader.d.ts

@@ -1,65 +0,0 @@
-import { AgentJsonV1 } from './agent.js';
-/**
- * Walk up from `startDir` (default: `process.cwd()`) looking for an
- * `agent.json`. Returns the absolute path to the first match, or
- * `null` if no file is found within `maxDepth` levels.
- *
- * Stops at the filesystem root regardless of `maxDepth`. Never throws —
- * a missing file is a valid result ("this repo is code-mode only"),
- * not an error.
- */
-export declare function findAgentJson(startDir?: string, maxDepth?: number): string | null;
-/**
- * Error thrown when an `agent.json` fails to load — missing file,
- * malformed JSON, schema validation failure, or an unresolvable
- * `systemPrompt.file` reference. Wraps the underlying cause
- * (`SyntaxError` / `ZodError` / filesystem error) on `.cause`.
- */
-export declare class AgentJsonLoadError extends Error {
-    readonly path: string;
-    constructor(message: string, path: string, options?: {
-        cause?: unknown;
-    });
-}
-/**
- * The inlined, ready-to-snapshot form of `agent.json`. Identical
- * shape to {@link AgentJsonV1} EXCEPT `systemPrompt` is always
- * `string | undefined` — file references are resolved and inlined
- * during load. The pod runtime never reads the filesystem; it sees
- * only this resolved shape.
- *
- * `undefined` system prompt means "fall through to the platform
- * default" (see `GUUEY_DEFAULT_SYSTEM_PROMPT` in `./system-prompt`).
- */
-export type ResolvedAgentJson = Omit<AgentJsonV1, 'systemPrompt'> & {
-    systemPrompt?: string;
-};
-/**
- * Read `agent.json` at `path`, parse JSON, validate against v1, and
- * inline any `systemPrompt.file` reference (resolved relative to the
- * `agent.json` directory). Returns the fully-resolved snapshot.
- *
- * Throws {@link AgentJsonLoadError} if:
- *   - the file does not exist,
- *   - the file is not valid JSON,
- *   - the document fails schema validation (cause = `ZodError`),
- *   - `systemPrompt.file` points outside the project directory or
- *     does not exist on disk.
- */
-export declare function loadAgentJson(path: string): ResolvedAgentJson;
-/**
- * Non-throwing variant of {@link loadAgentJson}. Returns a
- * discriminated result mirroring `z.safeParse` for ergonomics in CLI
- * surfaces that render the error inline.
- */
-export type SafeLoadAgentResult = {
-    success: true;
-    data: ResolvedAgentJson;
-} | {
-    success: false;
-    error: AgentJsonLoadError;
-};
-export declare function safeLoadAgentJson(path: string): SafeLoadAgentResult;
-export { AGENT_JSON_FILENAME, AgentJsonV1, parseAgentJson, safeParseAgentJson, DEFAULT_AGENT_MCP_SERVERS, } from './agent.js';
-export type { AgentJsonMcpServer, AgentJsonRuntime, AgentJsonSystemPrompt, AgentJsonToolGates, } from './agent.js';
-//# sourceMappingURL=agent-loader.d.ts.map

package/dist/agent-loader.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-loader.d.ts","sourceRoot":"","sources":["../src/agent-loader.ts"],"names":[],"mappings":"AAoBA,OAAO,EAEL,WAAW,EAEZ,MAAM,YAAY,CAAC;AAUpB;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,GAAE,MAAsB,EAChC,QAAQ,GAAE,MAA+B,GACxC,MAAM,GAAG,IAAI,CAUf;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAKzE;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CA8C7D;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAC1C;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAElD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,CASnE;AAoDD,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,YAAY,CAAC"}

package/dist/agent-loader.js

@@ -1,155 +0,0 @@
-/**
- * Node-only filesystem helpers for `agent.json`.
- *
- * Pure-parse helpers (`parseAgentJson` / `safeParseAgentJson`) live in
- * `./agent.ts` and are safe to import from non-Node contexts. This
- * module adds the file-resolution layer: reading `agent.json` off
- * disk, inlining `systemPrompt.file` references, and producing the
- * snapshot the deploy upload + pod boot both read.
- *
- * Intended callers:
- *
- * - `guuey` CLI: `guuey deploy --config agent.json` reads the file,
- *   inlines the system prompt, and POSTs the resulting snapshot to
- *   the control plane as the no-tarball declarative deploy body.
- * - Guuey control-plane services that re-validate the submitted
- *   snapshot server-side before persisting to AgentDeployment.
- * - Stock nocode-runtime pod: reads the snapshot back at boot.
- */
-import { existsSync, readFileSync } from 'node:fs';
-import { dirname, isAbsolute, join, resolve } from 'node:path';
-import { AGENT_JSON_FILENAME, parseAgentJson, } from './agent.js';
-/**
- * How many parent directories `findAgentJson` will walk by default.
- * Internal — the public-facing constant of the same name on
- * `./loader.ts` is the one re-exported on the package barrel; the
- * two values are kept in sync intentionally.
- */
-const DEFAULT_FIND_MAX_DEPTH = 8;
-/**
- * Walk up from `startDir` (default: `process.cwd()`) looking for an
- * `agent.json`. Returns the absolute path to the first match, or
- * `null` if no file is found within `maxDepth` levels.
- *
- * Stops at the filesystem root regardless of `maxDepth`. Never throws —
- * a missing file is a valid result ("this repo is code-mode only"),
- * not an error.
- */
-export function findAgentJson(startDir = process.cwd(), maxDepth = DEFAULT_FIND_MAX_DEPTH) {
-    let dir = resolve(startDir);
-    for (let i = 0; i <= maxDepth; i++) {
-        const candidate = join(dir, AGENT_JSON_FILENAME);
-        if (existsSync(candidate))
-            return candidate;
-        const parent = dirname(dir);
-        if (parent === dir)
-            return null;
-        dir = parent;
-    }
-    return null;
-}
-/**
- * Error thrown when an `agent.json` fails to load — missing file,
- * malformed JSON, schema validation failure, or an unresolvable
- * `systemPrompt.file` reference. Wraps the underlying cause
- * (`SyntaxError` / `ZodError` / filesystem error) on `.cause`.
- */
-export class AgentJsonLoadError extends Error {
-    path;
-    constructor(message, path, options) {
-        super(message, options);
-        this.name = 'AgentJsonLoadError';
-        this.path = path;
-    }
-}
-/**
- * Read `agent.json` at `path`, parse JSON, validate against v1, and
- * inline any `systemPrompt.file` reference (resolved relative to the
- * `agent.json` directory). Returns the fully-resolved snapshot.
- *
- * Throws {@link AgentJsonLoadError} if:
- *   - the file does not exist,
- *   - the file is not valid JSON,
- *   - the document fails schema validation (cause = `ZodError`),
- *   - `systemPrompt.file` points outside the project directory or
- *     does not exist on disk.
- */
-export function loadAgentJson(path) {
-    if (!existsSync(path)) {
-        throw new AgentJsonLoadError(`agent.json not found at ${path}`, path);
-    }
-    let raw;
-    try {
-        raw = readFileSync(path, 'utf-8');
-    }
-    catch (cause) {
-        throw new AgentJsonLoadError(`Failed to read agent.json at ${path}`, path, { cause });
-    }
-    let decoded;
-    try {
-        decoded = JSON.parse(raw);
-    }
-    catch (cause) {
-        throw new AgentJsonLoadError(`agent.json at ${path} is not valid JSON`, path, { cause });
-    }
-    let parsed;
-    try {
-        parsed = parseAgentJson(decoded);
-    }
-    catch (cause) {
-        throw new AgentJsonLoadError(`agent.json at ${path} failed schema validation`, path, { cause });
-    }
-    const baseDir = dirname(path);
-    const resolvedPrompt = resolveSystemPrompt(parsed, baseDir, path);
-    const out = { ...parsed, systemPrompt: resolvedPrompt };
-    if (resolvedPrompt === undefined) {
-        delete out.systemPrompt;
-    }
-    return out;
-}
-export function safeLoadAgentJson(path) {
-    try {
-        return { success: true, data: loadAgentJson(path) };
-    }
-    catch (error) {
-        if (error instanceof AgentJsonLoadError) {
-            return { success: false, error };
-        }
-        throw error;
-    }
-}
-/**
- * Resolve the `systemPrompt` field on a parsed `agent.json`. Returns
- * `undefined` when the field is absent (caller falls through to the
- * platform default). Inlines `{ file }` references relative to
- * `baseDir`; rejects absolute paths and parent-directory escapes so
- * the snapshot can't pull arbitrary host files into the deploy.
- */
-function resolveSystemPrompt(doc, baseDir, agentJsonPath) {
-    const sp = doc.systemPrompt;
-    if (sp === undefined)
-        return undefined;
-    if (typeof sp === 'string')
-        return sp;
-    const relPath = sp.file;
-    if (isAbsolute(relPath)) {
-        throw new AgentJsonLoadError(`systemPrompt.file "${relPath}" must be a relative path, not absolute`, agentJsonPath);
-    }
-    const resolved = resolve(baseDir, relPath);
-    const baseResolved = resolve(baseDir);
-    if (!resolved.startsWith(baseResolved + '/') && resolved !== baseResolved) {
-        throw new AgentJsonLoadError(`systemPrompt.file "${relPath}" resolves outside the project directory`, agentJsonPath);
-    }
-    if (!existsSync(resolved)) {
-        throw new AgentJsonLoadError(`systemPrompt.file "${relPath}" does not exist (looked at ${resolved})`, agentJsonPath);
-    }
-    try {
-        return readFileSync(resolved, 'utf-8').trim();
-    }
-    catch (cause) {
-        throw new AgentJsonLoadError(`Failed to read systemPrompt.file "${relPath}"`, agentJsonPath, { cause });
-    }
-}
-// Re-export pure schema + types from the same subpath so Node callers
-// can do one import.
-export { AGENT_JSON_FILENAME, AgentJsonV1, parseAgentJson, safeParseAgentJson, DEFAULT_AGENT_MCP_SERVERS, } from './agent.js';

package/dist/mcp-proxy.d.ts

@@ -1,123 +0,0 @@
-/**
- * `mcpProxies` — Guuey hosted overlay shape for managed MCP relays.
- *
- * Relocated 2026-04-21 from `@ggui-ai/protocol/types/mcp-proxy.ts` as
- * part of the OSS split §8.2 classification fix. These types describe
- * a GUUEY HOSTING CONCEPT (a managed proxy that relays MCP calls with
- * upstream OAuth linking), not a vendor-neutral protocol shape, and
- * therefore belong in the closed `@guuey/config`
- * package alongside the rest of `guuey.json`.
- *
- * ## The classification decision
- *
- * `mcpProxies` is the declaration block a developer adds to
- * `guuey.json` to tell Guuey hosting: *"on behalf of this project,
- * relay these external MCP providers, using this OAuth linking
- * config, exposing these discovered servers."* That is
- * platform-layer plumbing — Guuey runs the relay, handles the
- * credential storage, dispatches the discovery — and it does not
- * describe anything an OSS-only `ggui` deployment emits or consumes.
- *
- * Per §8.2: the OSS `ggui` server does NOT read `guuey.json`.
- * Consumers that need overlay values (the closed `guuey` CLI,
- * Guuey-hosted Lambdas, the Guuey-internal control-plane UI) are
- * the only call sites allowed to import from this package. Open
- * packages that historically read `mcpProxies` (`@ggui-ai/server`'s
- * Claude-passthrough feature) retain their feature code but inline
- * the minimal structural shape they actually use — it stays a
- * Guuey-platform plumbing path, not a protocol contract.
- *
- * ## Scope of this module
- *
- * - {@link McpProxyLinkingConfig} — upstream OAuth config for
- *   proxies that relay calls on behalf of an external account
- *   (e.g. Claude.ai). Keys surface in the Guuey control plane's
- *   credential-linking UI.
- * - {@link McpProxyConfig} — a single proxy's discovery + proxy
- *   URL pattern + optional server filter + optional linking block.
- * - {@link McpProxiesConfig} — the top-level record keyed by
- *   proxy id (`claude_ai`, `guuey`, future `omo`...). Exactly the
- *   shape `guuey.json#mcpProxies` carries.
- *
- * ## Vendor-neutral constants stay in `@ggui-ai/protocol`
- *
- * Claude.ai-specific constants and discovery-response wire types
- * (`CLAUDE_AI_*`, `DiscoveredMcpServer`, `ClaudeAiDiscoveryResponse`)
- * remain in `@ggui-ai/protocol/types/mcp-proxy.ts` — those describe
- * Anthropic's public API, not Guuey-overlay config.
- *
- * ## Strictness
- *
- * Zod validation matches the rest of `guuey.json`: strict objects,
- * non-empty strings, URL validation on linking endpoints. Unknown
- * keys on nested objects fail parse (prevents silent drift toward
- * a "what else can we stuff into guuey.json" shape).
- */
-import { z } from 'zod';
-/**
- * OAuth linking config for proxies that relay on behalf of an
- * external account. Omit for proxies where Guuey session auth is
- * the only identity needed (e.g. a Guuey-native proxy).
- */
-declare const McpProxyLinkingSchema: z.ZodObject<{
-    authUrl: z.ZodURL;
-    tokenUrl: z.ZodURL;
-    scopes: z.ZodArray<z.ZodString>;
-    clientId: z.ZodOptional<z.ZodString>;
-    manualRedirectUrl: z.ZodOptional<z.ZodURL>;
-}, z.core.$strict>;
-/**
- * Configuration for a single MCP proxy in `guuey.json#mcpProxies`.
- *
- * `discovery` + `proxy` are both URL-valued, but `proxy` is a URL
- * PATTERN (contains `{server_id}` which is substituted at call
- * time). Both are validated as URLs — `{server_id}` is accepted
- * by URL parsers as opaque path segment.
- */
-declare const McpProxyConfigSchema: z.ZodObject<{
-    discovery: z.ZodURL;
-    proxy: z.ZodURL;
-    linking: z.ZodOptional<z.ZodObject<{
-        authUrl: z.ZodURL;
-        tokenUrl: z.ZodURL;
-        scopes: z.ZodArray<z.ZodString>;
-        clientId: z.ZodOptional<z.ZodString>;
-        manualRedirectUrl: z.ZodOptional<z.ZodURL>;
-    }, z.core.$strict>>;
-    servers: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strict>;
-/**
- * The `mcpProxies` section of `guuey.json`. Keys are proxy
- * identifiers (`claude_ai`, `guuey`, future `omo`, …).
- *
- * Record shape intentionally — new proxy ids are additive; a fixed
- * literal union here would force a schema change every time a new
- * hosted-relay integration lands.
- */
-export declare const McpProxiesSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
-    discovery: z.ZodURL;
-    proxy: z.ZodURL;
-    linking: z.ZodOptional<z.ZodObject<{
-        authUrl: z.ZodURL;
-        tokenUrl: z.ZodURL;
-        scopes: z.ZodArray<z.ZodString>;
-        clientId: z.ZodOptional<z.ZodString>;
-        manualRedirectUrl: z.ZodOptional<z.ZodURL>;
-    }, z.core.$strict>>;
-    servers: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strict>>;
-/** Linking block type derived from the zod schema. */
-export type McpProxyLinkingConfig = z.infer<typeof McpProxyLinkingSchema>;
-/** Single-proxy config type derived from the zod schema. */
-export type McpProxyConfig = z.infer<typeof McpProxyConfigSchema>;
-/** Full `mcpProxies` overlay type derived from the zod schema. */
-export type McpProxiesConfig = z.infer<typeof McpProxiesSchema>;
-/**
- * Parse a raw JSON value into a validated {@link McpProxiesConfig}.
- * Throws a `ZodError` on invalid input.
- */
-export declare function parseMcpProxies(raw: unknown): McpProxiesConfig;
-/** Safe-parse variant — see {@link parseMcpProxies}. */
-export declare function safeParseMcpProxies(raw: unknown): ReturnType<typeof McpProxiesSchema.safeParse>;
-export {};
-//# sourceMappingURL=mcp-proxy.d.ts.map

package/dist/mcp-proxy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-proxy.d.ts","sourceRoot":"","sources":["../src/mcp-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,QAAA,MAAM,qBAAqB;;;;;;kBAuBzB,CAAC;AAEH;;;;;;;GAOG;AACH,QAAA,MAAM,oBAAoB;;;;;;;;;;;kBAmBxB,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;mBAG5B,CAAC;AAEF,sDAAsD;AACtD,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,4DAA4D;AAC5D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,kEAAkE;AAClE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAE9D;AAED,wDAAwD;AACxD,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,OAAO,GACX,UAAU,CAAC,OAAO,gBAAgB,CAAC,SAAS,CAAC,CAE/C"}

package/dist/mcp-proxy.js

@@ -1,133 +0,0 @@
-/**
- * `mcpProxies` — Guuey hosted overlay shape for managed MCP relays.
- *
- * Relocated 2026-04-21 from `@ggui-ai/protocol/types/mcp-proxy.ts` as
- * part of the OSS split §8.2 classification fix. These types describe
- * a GUUEY HOSTING CONCEPT (a managed proxy that relays MCP calls with
- * upstream OAuth linking), not a vendor-neutral protocol shape, and
- * therefore belong in the closed `@guuey/config`
- * package alongside the rest of `guuey.json`.
- *
- * ## The classification decision
- *
- * `mcpProxies` is the declaration block a developer adds to
- * `guuey.json` to tell Guuey hosting: *"on behalf of this project,
- * relay these external MCP providers, using this OAuth linking
- * config, exposing these discovered servers."* That is
- * platform-layer plumbing — Guuey runs the relay, handles the
- * credential storage, dispatches the discovery — and it does not
- * describe anything an OSS-only `ggui` deployment emits or consumes.
- *
- * Per §8.2: the OSS `ggui` server does NOT read `guuey.json`.
- * Consumers that need overlay values (the closed `guuey` CLI,
- * Guuey-hosted Lambdas, the Guuey-internal control-plane UI) are
- * the only call sites allowed to import from this package. Open
- * packages that historically read `mcpProxies` (`@ggui-ai/server`'s
- * Claude-passthrough feature) retain their feature code but inline
- * the minimal structural shape they actually use — it stays a
- * Guuey-platform plumbing path, not a protocol contract.
- *
- * ## Scope of this module
- *
- * - {@link McpProxyLinkingConfig} — upstream OAuth config for
- *   proxies that relay calls on behalf of an external account
- *   (e.g. Claude.ai). Keys surface in the Guuey control plane's
- *   credential-linking UI.
- * - {@link McpProxyConfig} — a single proxy's discovery + proxy
- *   URL pattern + optional server filter + optional linking block.
- * - {@link McpProxiesConfig} — the top-level record keyed by
- *   proxy id (`claude_ai`, `guuey`, future `omo`...). Exactly the
- *   shape `guuey.json#mcpProxies` carries.
- *
- * ## Vendor-neutral constants stay in `@ggui-ai/protocol`
- *
- * Claude.ai-specific constants and discovery-response wire types
- * (`CLAUDE_AI_*`, `DiscoveredMcpServer`, `ClaudeAiDiscoveryResponse`)
- * remain in `@ggui-ai/protocol/types/mcp-proxy.ts` — those describe
- * Anthropic's public API, not Guuey-overlay config.
- *
- * ## Strictness
- *
- * Zod validation matches the rest of `guuey.json`: strict objects,
- * non-empty strings, URL validation on linking endpoints. Unknown
- * keys on nested objects fail parse (prevents silent drift toward
- * a "what else can we stuff into guuey.json" shape).
- */
-import { z } from 'zod';
-/**
- * OAuth linking config for proxies that relay on behalf of an
- * external account. Omit for proxies where Guuey session auth is
- * the only identity needed (e.g. a Guuey-native proxy).
- */
-const McpProxyLinkingSchema = z.strictObject({
-    /** OAuth authorize endpoint. */
-    authUrl: z.url(),
-    /** OAuth token endpoint. */
-    tokenUrl: z.url(),
-    /**
-     * OAuth scopes to request. Empty array means "use the upstream's
-     * default scope set"; it does NOT mean "no scopes at all."
-     */
-    scopes: z.array(z.string().min(1)),
-    /**
-     * OAuth client_id to use. When omitted, the proxy uses a
-     * well-known public client_id (e.g. Claude Code's registered
-     * client for Claude.ai).
-     */
-    clientId: z.string().min(1).optional(),
-    /**
-     * Manual redirect URL for environments without a localhost
-     * callback. The upstream AS redirects here and renders the
-     * authorization code for the user to copy-paste. Used by
-     * production web flows.
-     */
-    manualRedirectUrl: z.url().optional(),
-});
-/**
- * Configuration for a single MCP proxy in `guuey.json#mcpProxies`.
- *
- * `discovery` + `proxy` are both URL-valued, but `proxy` is a URL
- * PATTERN (contains `{server_id}` which is substituted at call
- * time). Both are validated as URLs — `{server_id}` is accepted
- * by URL parsers as opaque path segment.
- */
-const McpProxyConfigSchema = z.strictObject({
-    /** Discovery URL — fetches available MCP servers for this proxy. */
-    discovery: z.url(),
-    /**
-     * Proxy URL pattern — `{server_id}` is substituted with the
-     * discovered server id at relay time. Validated as URL; the
-     * placeholder survives URL parsing as an opaque path segment.
-     */
-    proxy: z.url(),
-    /**
-     * OAuth linking config for upstream account linking. Omit for
-     * Guuey-native proxies where the session token is sufficient.
-     */
-    linking: McpProxyLinkingSchema.optional(),
-    /**
-     * Filter which discovered servers to expose, matched by display
-     * name. When omitted, all discovered servers are exposed.
-     */
-    servers: z.array(z.string().min(1)).optional(),
-});
-/**
- * The `mcpProxies` section of `guuey.json`. Keys are proxy
- * identifiers (`claude_ai`, `guuey`, future `omo`, …).
- *
- * Record shape intentionally — new proxy ids are additive; a fixed
- * literal union here would force a schema change every time a new
- * hosted-relay integration lands.
- */
-export const McpProxiesSchema = z.record(z.string().min(1), McpProxyConfigSchema);
-/**
- * Parse a raw JSON value into a validated {@link McpProxiesConfig}.
- * Throws a `ZodError` on invalid input.
- */
-export function parseMcpProxies(raw) {
-    return McpProxiesSchema.parse(raw);
-}
-/** Safe-parse variant — see {@link parseMcpProxies}. */
-export function safeParseMcpProxies(raw) {
-    return McpProxiesSchema.safeParse(raw);
-}

package/dist/mcp-servers.d.ts

@@ -1,173 +0,0 @@
-/**
- * `mcpServers` — Guuey hosted overlay shape for relayed MCP server
- * declarations.
- *
- * Relocated 2026-04-21 from `@ggui-ai/protocol/types/credential.ts`
- * as part of the OSS split §8.2 classification fix (mirror of the
- * 2026-04-21 `mcp-proxy` split). The `McpServerAuthConfig` type
- * previously lived in the open protocol package with a docstring
- * that said "Auth config in guuey.json mcpServers entries" — an
- * overlay-shape type in an open package, exactly the pattern the
- * mcp-proxy split closed.
- *
- * ## The classification decision
- *
- * `mcpServers` is the declaration block a developer adds to
- * `guuey.json` to tell Guuey hosting: *"for this project, relay
- * these HTTP MCP servers through the Guuey bridge, authenticating
- * each via the credential stored under this `serviceId`."* That is
- * platform-layer plumbing — the Guuey bridge registers the
- * declaration with the Guuey-hosted WebSocket gateway, and the
- * Guuey mcp-proxy Lambda resolves `auth.serviceId` against the
- * platform's UserCredential store. An OSS-only `ggui serve`
- * deployment has no analog for `auth.serviceId` because there is no
- * Guuey credential store.
- *
- * Per §8.2: the OSS `ggui` server does NOT read `guuey.json`.
- * Consumers that need this overlay value (the closed `guuey` CLI's
- * `guuey dev` command, the closed `@guuey/bridge` package, Guuey-
- * hosted Lambdas) are the only call sites allowed to import from
- * this package. Open packages that historically read
- * `McpServerAuthConfig` (`@ggui-ai/server`'s auth-relay code) now
- * inline the minimal structural shape they actually use.
- *
- * ## Scope of this module
- *
- * - {@link CredentialInjection} + {@link CredentialInjectionConfig}
- *   — runtime injection-mode descriptors, used here as
- *   `McpServerAuth.injection` and also exported from
- *   `@ggui-ai/protocol/types/credential.ts` for cloud-side runtime
- *   consumers. The overlap is intentional and minor (10 lines of
- *   literal-union type) — duplicating inline keeps this private
- *   package dep-minimal (zod-only). If the two ever drift, the
- *   consolidation fix is to add `@ggui-ai/protocol` as a workspace
- *   dep here; today the duplication is cheaper than that cross-
- *   boundary edge.
- * - {@link McpServerAuthConfig} — auth block on a single
- *   `mcpServers` entry. `serviceId` references the Guuey
- *   credential store; `preInject` + `injection` tune how the relay
- *   writes the placeholder.
- * - {@link McpServerEntryConfig} — a single mcpServers entry
- *   (`{ url, auth? }`). `url` is the HTTP MCP server endpoint.
- * - {@link McpServersConfig} — the top-level record keyed by MCP
- *   server name (`gmail`, `calendar`, future `slack`, …). Exactly
- *   the shape `guuey.json#mcpServers` carries.
- *
- * ## Strictness
- *
- * Zod validation matches the rest of `guuey.json`: strict objects,
- * non-empty strings, URL validation on `url`. Unknown keys on
- * nested objects fail parse (prevents silent drift toward a "what
- * else can we stuff into guuey.json" shape).
- */
-import { z } from 'zod';
-/**
- * Injection mode — how the Guuey mcp-proxy splices the resolved
- * credential into the outbound HTTP request to the upstream MCP
- * server. Duplicated minor from
- * `@ggui-ai/protocol/types/credential.ts#CredentialInjection`; see
- * module docstring for the duplication rationale.
- */
-declare const CredentialInjectionSchema: z.ZodEnum<{
-    bearer_header: "bearer_header";
-    api_key_header: "api_key_header";
-    query_param: "query_param";
-    custom_header: "custom_header";
-}>;
-/** Full injection config — `mode` + per-mode tunables. */
-declare const CredentialInjectionConfigSchema: z.ZodObject<{
-    mode: z.ZodEnum<{
-        bearer_header: "bearer_header";
-        api_key_header: "api_key_header";
-        query_param: "query_param";
-        custom_header: "custom_header";
-    }>;
-    headerName: z.ZodOptional<z.ZodString>;
-    paramName: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>;
-/**
- * Auth block on a single `mcpServers` entry. All fields are
- * optional at the block level — a server without `auth` is relayed
- * without credential injection (public MCP endpoint).
- */
-declare const McpServerAuthSchema: z.ZodObject<{
-    serviceId: z.ZodString;
-    preInject: z.ZodOptional<z.ZodBoolean>;
-    injection: z.ZodOptional<z.ZodObject<{
-        mode: z.ZodEnum<{
-            bearer_header: "bearer_header";
-            api_key_header: "api_key_header";
-            query_param: "query_param";
-            custom_header: "custom_header";
-        }>;
-        headerName: z.ZodOptional<z.ZodString>;
-        paramName: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>>;
-    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strict>;
-/**
- * A single `mcpServers` entry. `url` is the HTTP MCP server
- * endpoint; `auth` scopes the credential injection.
- */
-declare const McpServerEntrySchema: z.ZodObject<{
-    url: z.ZodURL;
-    auth: z.ZodOptional<z.ZodObject<{
-        serviceId: z.ZodString;
-        preInject: z.ZodOptional<z.ZodBoolean>;
-        injection: z.ZodOptional<z.ZodObject<{
-            mode: z.ZodEnum<{
-                bearer_header: "bearer_header";
-                api_key_header: "api_key_header";
-                query_param: "query_param";
-                custom_header: "custom_header";
-            }>;
-            headerName: z.ZodOptional<z.ZodString>;
-            paramName: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>>;
-        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
-/**
- * The `mcpServers` section of `guuey.json`. Keys are MCP server
- * display names (`gmail`, `calendar`, future `slack`, …) —
- * arbitrary strings, by design. New servers are additive; a fixed
- * literal union would force a schema change every time a new MCP
- * server integration lands.
- */
-export declare const McpServersSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
-    url: z.ZodURL;
-    auth: z.ZodOptional<z.ZodObject<{
-        serviceId: z.ZodString;
-        preInject: z.ZodOptional<z.ZodBoolean>;
-        injection: z.ZodOptional<z.ZodObject<{
-            mode: z.ZodEnum<{
-                bearer_header: "bearer_header";
-                api_key_header: "api_key_header";
-                query_param: "query_param";
-                custom_header: "custom_header";
-            }>;
-            headerName: z.ZodOptional<z.ZodString>;
-            paramName: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>>;
-        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    }, z.core.$strict>>;
-}, z.core.$strict>>;
-/** Runtime injection-mode descriptor type. */
-export type CredentialInjection = z.infer<typeof CredentialInjectionSchema>;
-/** Injection-config block type. */
-export type CredentialInjectionConfig = z.infer<typeof CredentialInjectionConfigSchema>;
-/** Auth-block type on an `mcpServers` entry. */
-export type McpServerAuthConfig = z.infer<typeof McpServerAuthSchema>;
-/** Single-entry type inside the `mcpServers` record. */
-export type McpServerEntryConfig = z.infer<typeof McpServerEntrySchema>;
-/** Full `mcpServers` overlay type derived from the zod schema. */
-export type McpServersConfig = z.infer<typeof McpServersSchema>;
-/**
- * Parse a raw JSON value into a validated {@link McpServersConfig}.
- * Throws a `ZodError` on invalid input.
- */
-export declare function parseMcpServers(raw: unknown): McpServersConfig;
-/** Safe-parse variant — see {@link parseMcpServers}. */
-export declare function safeParseMcpServers(raw: unknown): ReturnType<typeof McpServersSchema.safeParse>;
-export {};
-//# sourceMappingURL=mcp-servers.d.ts.map

package/dist/mcp-servers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-servers.d.ts","sourceRoot":"","sources":["../src/mcp-servers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,QAAA,MAAM,yBAAyB;;;;;EAK7B,CAAC;AAEH,0DAA0D;AAC1D,QAAA,MAAM,+BAA+B;;;;;;;;;kBAMnC,CAAC;AAEH;;;;GAIG;AACH,QAAA,MAAM,mBAAmB;;;;;;;;;;;;;;kBA4BvB,CAAC;AAEH;;;GAGG;AACH,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;kBAKxB,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;mBAG5B,CAAC;AAEF,8CAA8C;AAC9C,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,mCAAmC;AACnC,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AAEF,gDAAgD;AAChD,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,wDAAwD;AACxD,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,kEAAkE;AAClE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAE9D;AAED,wDAAwD;AACxD,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,OAAO,GACX,UAAU,CAAC,OAAO,gBAAgB,CAAC,SAAS,CAAC,CAE/C"}

package/dist/mcp-servers.js

@@ -1,147 +0,0 @@
-/**
- * `mcpServers` — Guuey hosted overlay shape for relayed MCP server
- * declarations.
- *
- * Relocated 2026-04-21 from `@ggui-ai/protocol/types/credential.ts`
- * as part of the OSS split §8.2 classification fix (mirror of the
- * 2026-04-21 `mcp-proxy` split). The `McpServerAuthConfig` type
- * previously lived in the open protocol package with a docstring
- * that said "Auth config in guuey.json mcpServers entries" — an
- * overlay-shape type in an open package, exactly the pattern the
- * mcp-proxy split closed.
- *
- * ## The classification decision
- *
- * `mcpServers` is the declaration block a developer adds to
- * `guuey.json` to tell Guuey hosting: *"for this project, relay
- * these HTTP MCP servers through the Guuey bridge, authenticating
- * each via the credential stored under this `serviceId`."* That is
- * platform-layer plumbing — the Guuey bridge registers the
- * declaration with the Guuey-hosted WebSocket gateway, and the
- * Guuey mcp-proxy Lambda resolves `auth.serviceId` against the
- * platform's UserCredential store. An OSS-only `ggui serve`
- * deployment has no analog for `auth.serviceId` because there is no
- * Guuey credential store.
- *
- * Per §8.2: the OSS `ggui` server does NOT read `guuey.json`.
- * Consumers that need this overlay value (the closed `guuey` CLI's
- * `guuey dev` command, the closed `@guuey/bridge` package, Guuey-
- * hosted Lambdas) are the only call sites allowed to import from
- * this package. Open packages that historically read
- * `McpServerAuthConfig` (`@ggui-ai/server`'s auth-relay code) now
- * inline the minimal structural shape they actually use.
- *
- * ## Scope of this module
- *
- * - {@link CredentialInjection} + {@link CredentialInjectionConfig}
- *   — runtime injection-mode descriptors, used here as
- *   `McpServerAuth.injection` and also exported from
- *   `@ggui-ai/protocol/types/credential.ts` for cloud-side runtime
- *   consumers. The overlap is intentional and minor (10 lines of
- *   literal-union type) — duplicating inline keeps this private
- *   package dep-minimal (zod-only). If the two ever drift, the
- *   consolidation fix is to add `@ggui-ai/protocol` as a workspace
- *   dep here; today the duplication is cheaper than that cross-
- *   boundary edge.
- * - {@link McpServerAuthConfig} — auth block on a single
- *   `mcpServers` entry. `serviceId` references the Guuey
- *   credential store; `preInject` + `injection` tune how the relay
- *   writes the placeholder.
- * - {@link McpServerEntryConfig} — a single mcpServers entry
- *   (`{ url, auth? }`). `url` is the HTTP MCP server endpoint.
- * - {@link McpServersConfig} — the top-level record keyed by MCP
- *   server name (`gmail`, `calendar`, future `slack`, …). Exactly
- *   the shape `guuey.json#mcpServers` carries.
- *
- * ## Strictness
- *
- * Zod validation matches the rest of `guuey.json`: strict objects,
- * non-empty strings, URL validation on `url`. Unknown keys on
- * nested objects fail parse (prevents silent drift toward a "what
- * else can we stuff into guuey.json" shape).
- */
-import { z } from 'zod';
-/**
- * Injection mode — how the Guuey mcp-proxy splices the resolved
- * credential into the outbound HTTP request to the upstream MCP
- * server. Duplicated minor from
- * `@ggui-ai/protocol/types/credential.ts#CredentialInjection`; see
- * module docstring for the duplication rationale.
- */
-const CredentialInjectionSchema = z.enum([
-    'bearer_header',
-    'api_key_header',
-    'query_param',
-    'custom_header',
-]);
-/** Full injection config — `mode` + per-mode tunables. */
-const CredentialInjectionConfigSchema = z.strictObject({
-    mode: CredentialInjectionSchema,
-    /** Header name for `api_key_header` / `custom_header`. Default: `X-API-Key`. */
-    headerName: z.string().min(1).optional(),
-    /** Query param name for `query_param`. Default: `api_key`. */
-    paramName: z.string().min(1).optional(),
-});
-/**
- * Auth block on a single `mcpServers` entry. All fields are
- * optional at the block level — a server without `auth` is relayed
- * without credential injection (public MCP endpoint).
- */
-const McpServerAuthSchema = z.strictObject({
-    /**
-     * Service ID referenced against the Guuey platform's
-     * UserCredential store. This is a Guuey-platform concept — an
-     * OSS-only deployment has no equivalent lookup.
-     */
-    serviceId: z.string().min(1),
-    /**
-     * Pre-inject placeholder before the first upstream request
-     * (skips the 401 → consent → retry dance for cases where the
-     * user has already linked the credential). Default: `false`.
-     */
-    preInject: z.boolean().optional(),
-    /**
-     * Override the injection mode. Falls back to the
-     * `McpServiceConfig` table entry keyed by `serviceId`, which
-     * defaults to `bearer_header`.
-     */
-    injection: CredentialInjectionConfigSchema.optional(),
-    /**
-     * Optional OAuth scope hint forwarded to the hosted bridge at
-     * connect time. The platform consumes this when minting tokens
-     * against the upstream MCP server. Preserved here (2026-04-21)
-     * for wire-compat with `@guuey/bridge`'s existing inline shape,
-     * which flows `auth.scopes` through the bridge WebSocket config
-     * message.
-     */
-    scopes: z.array(z.string().min(1)).optional(),
-});
-/**
- * A single `mcpServers` entry. `url` is the HTTP MCP server
- * endpoint; `auth` scopes the credential injection.
- */
-const McpServerEntrySchema = z.strictObject({
-    /** HTTP MCP server endpoint. */
-    url: z.url(),
-    /** Optional auth block — omit for public endpoints. */
-    auth: McpServerAuthSchema.optional(),
-});
-/**
- * The `mcpServers` section of `guuey.json`. Keys are MCP server
- * display names (`gmail`, `calendar`, future `slack`, …) —
- * arbitrary strings, by design. New servers are additive; a fixed
- * literal union would force a schema change every time a new MCP
- * server integration lands.
- */
-export const McpServersSchema = z.record(z.string().min(1), McpServerEntrySchema);
-/**
- * Parse a raw JSON value into a validated {@link McpServersConfig}.
- * Throws a `ZodError` on invalid input.
- */
-export function parseMcpServers(raw) {
-    return McpServersSchema.parse(raw);
-}
-/** Safe-parse variant — see {@link parseMcpServers}. */
-export function safeParseMcpServers(raw) {
-    return McpServersSchema.safeParse(raw);
-}