@guuey/config 0.7.2 → 0.8.0

package/dist/app.d.ts

@@ -9,6 +9,44 @@
  * (agent or mcp-server) is what's deployable; this section is presentation.
  */
 import { z } from 'zod';
+/**
+ * End-user auth modes an app record accepts — mirrors the platform's
+ * `USER_AUTH_MODES` (`@guuey-private/types` `security/user-auth-mode.ts`),
+ * which this published package cannot import; the backend pins the two
+ * lists equal (`handlers/reconcile.test.ts`).
+ */
+export declare const APP_USER_AUTH_MODES: readonly ["anonymous", "native_pool", "byo"];
+export type AppUserAuthMode = (typeof APP_USER_AUTH_MODES)[number];
+/**
+ * `guuey.json#app.access` — the app record's ACCESS POLICY, declared in the
+ * manifest so `guuey agent apply` (agents-as-code, guuey#190) converges it
+ * alongside the agent definition. Field names ARE the platform API's
+ * (`PUT /v1/apps/:id` / the reconcile `config` block): no translation.
+ *
+ * PUT-per-field semantics: a field that is absent is left untouched by a
+ * reconcile (never reset). `userAuthConfig: null` is the explicit "clear the
+ * issuer binding". The hosted `GuueyApp` row remains the only enforcement
+ * source — this block is the DECLARATION reconcile makes it agree with;
+ * the pod ignores it.
+ *
+ * Tier is deliberately absent (admin plane, never CI); slug/customDomain/
+ * listing stay declared-not-converged (they have their own ceremonies).
+ */
+export declare const AppAccessV1: z.ZodObject<{
+    userAuthMode: z.ZodOptional<z.ZodEnum<{
+        anonymous: "anonymous";
+        native_pool: "native_pool";
+        byo: "byo";
+    }>>;
+    userAuthConfig: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        issuerUrl: z.ZodString;
+        audience: z.ZodString;
+    }, z.core.$strict>>>;
+    allowedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    guestAccess: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+}, z.core.$strict>;
+/** Static TypeScript type for `app.access`. */
+export type GuueyAppAccess = z.infer<typeof AppAccessV1>;
 /**
  * The app section schema. All fields optional in v1 — a project may carry
  * the bare minimum at first and grow the listing as it publishes.
@@ -20,6 +58,19 @@ export declare const AppSectionV1: z.ZodObject<{
     iconUrl: z.ZodOptional<z.ZodURL>;
     tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
     customDomain: z.ZodOptional<z.ZodString>;
+    access: z.ZodOptional<z.ZodObject<{
+        userAuthMode: z.ZodOptional<z.ZodEnum<{
+            anonymous: "anonymous";
+            native_pool: "native_pool";
+            byo: "byo";
+        }>>;
+        userAuthConfig: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            issuerUrl: z.ZodString;
+            audience: z.ZodString;
+        }, z.core.$strict>>>;
+        allowedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        guestAccess: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 /** Static TypeScript type for the app section. */
 export type GuueyApp = z.infer<typeof AppSectionV1>;

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA0CxB;;;GAGG;AACH,eAAO,MAAM,YAAY;;;;;;;kBAOvB,CAAC;AAEH,kDAAkD;AAClD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA0CxB;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,8CAA+C,CAAC;AAChF,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;kBAWtB,CAAC;AAEH,+CAA+C;AAC/C,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEzD;;;GAGG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;kBASvB,CAAC;AAEH,kDAAkD;AAClD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC"}

package/dist/app.js

@@ -40,6 +40,40 @@ const CustomDomainSchema = z
     .min(4)
     .max(253)
     .regex(/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i, 'must be a valid fully-qualified domain name');
+/**
+ * End-user auth modes an app record accepts — mirrors the platform's
+ * `USER_AUTH_MODES` (`@guuey-private/types` `security/user-auth-mode.ts`),
+ * which this published package cannot import; the backend pins the two
+ * lists equal (`handlers/reconcile.test.ts`).
+ */
+export const APP_USER_AUTH_MODES = ['anonymous', 'native_pool', 'byo'];
+/**
+ * `guuey.json#app.access` — the app record's ACCESS POLICY, declared in the
+ * manifest so `guuey agent apply` (agents-as-code, guuey#190) converges it
+ * alongside the agent definition. Field names ARE the platform API's
+ * (`PUT /v1/apps/:id` / the reconcile `config` block): no translation.
+ *
+ * PUT-per-field semantics: a field that is absent is left untouched by a
+ * reconcile (never reset). `userAuthConfig: null` is the explicit "clear the
+ * issuer binding". The hosted `GuueyApp` row remains the only enforcement
+ * source — this block is the DECLARATION reconcile makes it agree with;
+ * the pod ignores it.
+ *
+ * Tier is deliberately absent (admin plane, never CI); slug/customDomain/
+ * listing stay declared-not-converged (they have their own ceremonies).
+ */
+export const AppAccessV1 = z.strictObject({
+    userAuthMode: z.enum(APP_USER_AUTH_MODES).optional(),
+    userAuthConfig: z
+        .strictObject({
+        issuerUrl: z.string().min(1),
+        audience: z.string().min(1),
+    })
+        .nullable()
+        .optional(),
+    allowedDomains: z.array(z.string().min(1)).optional(),
+    guestAccess: z.boolean().nullable().optional(),
+});
 /**
  * The app section schema. All fields optional in v1 — a project may carry
  * the bare minimum at first and grow the listing as it publishes.
@@ -51,4 +85,6 @@ export const AppSectionV1 = z.strictObject({
     iconUrl: z.url().optional(),
     tags: z.array(TagSchema).max(10).optional(),
     customDomain: CustomDomainSchema.optional(),
+    /** Access policy converged by `guuey agent apply` — see {@link AppAccessV1}. */
+    access: AppAccessV1.optional(),
 });

package/dist/schema.d.ts

@@ -164,6 +164,19 @@ export declare const GuueyJsonV1: z.ZodObject<{
         iconUrl: z.ZodOptional<z.ZodURL>;
         tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
         customDomain: z.ZodOptional<z.ZodString>;
+        access: z.ZodOptional<z.ZodObject<{
+            userAuthMode: z.ZodOptional<z.ZodEnum<{
+                anonymous: "anonymous";
+                native_pool: "native_pool";
+                byo: "byo";
+            }>>;
+            userAuthConfig: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+                issuerUrl: z.ZodString;
+                audience: z.ZodString;
+            }, z.core.$strict>>>;
+            allowedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            guestAccess: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
     ggui: z.ZodOptional<z.ZodObject<{
         appId: z.ZodOptional<z.ZodString>;

package/dist/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAEjE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmDtB,CAAC;AAEH,kDAAkD;AAClD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAG3D,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;AAEvD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,CAExD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,GACX,UAAU,CAAC,OAAO,WAAW,CAAC,SAAS,CAAC,CAE1C"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAEjE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmDtB,CAAC;AAEH,kDAAkD;AAClD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAG3D,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;AAEvD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,CAExD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,GACX,UAAU,CAAC,OAAO,WAAW,CAAC,SAAS,CAAC,CAE1C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guuey/config",
-  "version": "0.7.2",
+  "version": "0.8.0",
   "description": "Open-source schemas + loaders for the three guuey config files: agent.json (declarative agent definition), guuey.json (hosted-deploy overlay), and the helper types around them. Consumed by @guuey/cli, the guuey backend, and devs writing their own agent or MCP server.",
   "license": "MIT",
   "type": "module",