@guuey/config 0.7.2 → 0.8.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/dist/agent.d.ts +23 -25
  2. package/dist/agent.d.ts.map +1 -1
  3. package/dist/agent.js +41 -46
  4. package/dist/app.d.ts +51 -0
  5. package/dist/app.d.ts.map +1 -1
  6. package/dist/app.js +36 -0
  7. package/dist/schema.d.ts +17 -4
  8. package/dist/schema.d.ts.map +1 -1
  9. package/package.json +1 -1
package/dist/agent.d.ts CHANGED
@@ -66,8 +66,12 @@ export type ProfileAccess = z.infer<typeof ProfileAccessSchema>;
66
66
  * Discriminated union on `kind` — one slot per hosting mode:
67
67
  * - `colocated` — guuey-managed HTTP child inside the agent pod
68
68
  * - `hosted` — guuey-hosted registry MCP (Starter+)
69
- * - `proxied` — 3rd-party SaaS via mcp-proxy credential broker (v2)
70
- * - `external` — builder-hosted, reached by URL (plain or federated)
69
+ * - `external` — reached by URL: builder-hosted (plain / federated /
70
+ * caller-forwarded) or third-party OAuth (`credential: 'oauth'`)
71
+ *
72
+ * (`kind: 'proxied'` — the pre-registration placeholder the mcp-proxy broker
73
+ * once reserved — is gone: `credential: 'oauth'` on an `external` entry IS
74
+ * that arm, guuey#178 D1.)
71
75
  */
72
76
  declare const McpServerSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
73
77
  kind: z.ZodLiteral<"colocated">;
@@ -78,9 +82,6 @@ declare const McpServerSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
78
82
  server: z.ZodOptional<z.ZodString>;
79
83
  source: z.ZodOptional<z.ZodString>;
80
84
  devPort: z.ZodOptional<z.ZodNumber>;
81
- }, z.core.$strict>, z.ZodObject<{
82
- kind: z.ZodLiteral<"proxied">;
83
- connection: z.ZodString;
84
85
  }, z.core.$strict>, z.ZodObject<{
85
86
  kind: z.ZodLiteral<"external">;
86
87
  url: z.ZodURL;
@@ -89,7 +90,10 @@ declare const McpServerSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
89
90
  sse: "sse";
90
91
  }>>;
91
92
  federate: z.ZodOptional<z.ZodBoolean>;
92
- credential: z.ZodOptional<z.ZodLiteral<"caller">>;
93
+ credential: z.ZodOptional<z.ZodEnum<{
94
+ caller: "caller";
95
+ oauth: "oauth";
96
+ }>>;
93
97
  headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
94
98
  devPort: z.ZodOptional<z.ZodNumber>;
95
99
  mcpResourceUrl: z.ZodOptional<z.ZodURL>;
@@ -112,9 +116,6 @@ export declare const McpServerEntrySchema: z.ZodUnion<readonly [z.ZodDiscriminat
112
116
  server: z.ZodOptional<z.ZodString>;
113
117
  source: z.ZodOptional<z.ZodString>;
114
118
  devPort: z.ZodOptional<z.ZodNumber>;
115
- }, z.core.$strict>, z.ZodObject<{
116
- kind: z.ZodLiteral<"proxied">;
117
- connection: z.ZodString;
118
119
  }, z.core.$strict>, z.ZodObject<{
119
120
  kind: z.ZodLiteral<"external">;
120
121
  url: z.ZodURL;
@@ -123,7 +124,10 @@ export declare const McpServerEntrySchema: z.ZodUnion<readonly [z.ZodDiscriminat
123
124
  sse: "sse";
124
125
  }>>;
125
126
  federate: z.ZodOptional<z.ZodBoolean>;
126
- credential: z.ZodOptional<z.ZodLiteral<"caller">>;
127
+ credential: z.ZodOptional<z.ZodEnum<{
128
+ caller: "caller";
129
+ oauth: "oauth";
130
+ }>>;
127
131
  headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
128
132
  devPort: z.ZodOptional<z.ZodNumber>;
129
133
  mcpResourceUrl: z.ZodOptional<z.ZodURL>;
@@ -251,9 +255,6 @@ export declare const McpServersSection: z.ZodRecord<z.ZodString, z.ZodUnion<read
251
255
  server: z.ZodOptional<z.ZodString>;
252
256
  source: z.ZodOptional<z.ZodString>;
253
257
  devPort: z.ZodOptional<z.ZodNumber>;
254
- }, z.core.$strict>, z.ZodObject<{
255
- kind: z.ZodLiteral<"proxied">;
256
- connection: z.ZodString;
257
258
  }, z.core.$strict>, z.ZodObject<{
258
259
  kind: z.ZodLiteral<"external">;
259
260
  url: z.ZodURL;
@@ -262,7 +263,10 @@ export declare const McpServersSection: z.ZodRecord<z.ZodString, z.ZodUnion<read
262
263
  sse: "sse";
263
264
  }>>;
264
265
  federate: z.ZodOptional<z.ZodBoolean>;
265
- credential: z.ZodOptional<z.ZodLiteral<"caller">>;
266
+ credential: z.ZodOptional<z.ZodEnum<{
267
+ caller: "caller";
268
+ oauth: "oauth";
269
+ }>>;
266
270
  headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
267
271
  devPort: z.ZodOptional<z.ZodNumber>;
268
272
  mcpResourceUrl: z.ZodOptional<z.ZodURL>;
@@ -300,9 +304,6 @@ export declare const AgentSectionV1: z.ZodObject<{
300
304
  server: z.ZodOptional<z.ZodString>;
301
305
  source: z.ZodOptional<z.ZodString>;
302
306
  devPort: z.ZodOptional<z.ZodNumber>;
303
- }, z.core.$strict>, z.ZodObject<{
304
- kind: z.ZodLiteral<"proxied">;
305
- connection: z.ZodString;
306
307
  }, z.core.$strict>, z.ZodObject<{
307
308
  kind: z.ZodLiteral<"external">;
308
309
  url: z.ZodURL;
@@ -311,7 +312,10 @@ export declare const AgentSectionV1: z.ZodObject<{
311
312
  sse: "sse";
312
313
  }>>;
313
314
  federate: z.ZodOptional<z.ZodBoolean>;
314
- credential: z.ZodOptional<z.ZodLiteral<"caller">>;
315
+ credential: z.ZodOptional<z.ZodEnum<{
316
+ caller: "caller";
317
+ oauth: "oauth";
318
+ }>>;
315
319
  headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
316
320
  devPort: z.ZodOptional<z.ZodNumber>;
317
321
  mcpResourceUrl: z.ZodOptional<z.ZodURL>;
@@ -409,12 +413,6 @@ export declare function validateNoLiteralSecrets(agent: GuueyAgent | undefined):
409
413
  * violation messages (empty = clean).
410
414
  */
411
415
  export declare function validateColocatedServerNames(agent: GuueyAgent | undefined): string[];
412
- /**
413
- * Validate that no `agent.mcpServers` entry uses `kind: 'proxied'`. Returns a
414
- * list of human-readable violation messages (empty = clean), one per proxied
415
- * entry, naming the server so the builder knows which ref to change.
416
- */
417
- export declare function validateNoProxiedServers(agent: GuueyAgent | undefined): string[];
418
416
  /**
419
417
  * The reserved colocated key the auto-injected memory MCP is booted + spliced
420
418
  * under (memmcp). NEVER builder-declarable — the memory child's own server
@@ -441,7 +439,7 @@ export declare const RESERVED_MCP_SERVER_NAMES: readonly string[];
441
439
  * reserved, not just one hosting mode; a builder must not shadow it as
442
440
  * `colocated`, `external`, or anything else). Returns a list of human-readable
443
441
  * violation messages (empty = clean), one per reserved entry. Mirrors
444
- * {@link validateNoProxiedServers}'s shape.
442
+ * {@link validateColocatedServerNames}'s shape.
445
443
  */
446
444
  export declare function validateReservedServerNames(agent: GuueyAgent | undefined): string[];
447
445
  /** One parsed `tools.allowlist` / `tools.denylist` entry. */
package/dist/agent.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,6EAKnB,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAS/D;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;EAAiC,CAAC;AAClE,uEAAuE;AACvE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AA+GhE;;;;;;;;GAQG;AACH,QAAA,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAKnB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;mDAA+C,CAAC;AACjF,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,KAAK,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,QAAA,MAAM,eAAe;;;kBAGnB,CAAC;AAEH;;;;;;;;GAQG;AACH,QAAA,MAAM,mBAAmB;;;kBAGvB,CAAC;AAcH;;;;GAIG;AACH,QAAA,MAAM,kBAAkB;;oBAGtB,CAAC;AAEH;;;;;;GAMG;AACH,QAAA,MAAM,oBAAoB;;;kBAGxB,CAAC;AAEH;;;;;;;;;;GAUG;AACH,QAAA,MAAM,YAAY;;;;;;;;;kBAKhB,CAAC;AA8BH;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IAAE,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,GAAG,KAAK,CAAC,CAAA;CAAE,GAAG,SAAS,GAAG,OAAO,CAGxG;AAED;;;;;GAKG;AACH;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;oDAAoD,CAAC;AAEnF,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA4FzB,CAAC;AAEH,kEAAkE;AAClE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAExD,oCAAoC;AACpC,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAElE,4BAA4B;AAC5B,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAElE,iCAAiC;AACjC,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEpE,kDAAkD;AAClD,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAExE,4BAA4B;AAC5B,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEtE,0BAA0B;AAC1B,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAuE5D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,UAAU,GAAG,SAAS,GAC5B,MAAM,EAAE,CAiCV;AAeD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,UAAU,GAAG,SAAS,GAC5B,MAAM,EAAE,CAaV;AAaD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,UAAU,GAAG,SAAS,GAC5B,MAAM,EAAE,CAaV;AAgBD;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,iBAAiB,CAAC;AAE1D;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,kBAAkB,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAGtD,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,UAAU,GAAG,SAAS,GAC5B,MAAM,EAAE,CAaV;AAgBD,6DAA6D;AAC7D,MAAM,MAAM,aAAa;AACvB,oDAAoD;AAClD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACvD,iDAAiD;GAC/C;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACxC,wFAAwF;GACtF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AASnC;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAmBjF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,EAAE,CAK3E;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,EAAE,CAoBzE;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAEzE,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,GACvC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAOrC;AAED,kJAAkJ;AAClJ,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,kBAAkB,GAAG,SAAS,GACtC,KAAK,CAAC,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAItC"}
1
+ {"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,6EAKnB,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAS/D;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;EAAiC,CAAC;AAClE,uEAAuE;AACvE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAyIhE;;;;;;;;;;;;GAYG;AACH,QAAA,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAInB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;mDAA+C,CAAC;AACjF,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,KAAK,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,QAAA,MAAM,eAAe;;;kBAGnB,CAAC;AAEH;;;;;;;;GAQG;AACH,QAAA,MAAM,mBAAmB;;;kBAGvB,CAAC;AAcH;;;;GAIG;AACH,QAAA,MAAM,kBAAkB;;oBAGtB,CAAC;AAEH;;;;;;GAMG;AACH,QAAA,MAAM,oBAAoB;;;kBAGxB,CAAC;AAEH;;;;;;;;;;GAUG;AACH,QAAA,MAAM,YAAY;;;;;;;;;kBAKhB,CAAC;AA8BH;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IAAE,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,GAAG,KAAK,CAAC,CAAA;CAAE,GAAG,SAAS,GAAG,OAAO,CAGxG;AAED;;;;;GAKG;AACH;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;oDAAoD,CAAC;AAEnF,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA4FzB,CAAC;AAEH,kEAAkE;AAClE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAExD,oCAAoC;AACpC,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAElE,4BAA4B;AAC5B,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAElE,iCAAiC;AACjC,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEpE,kDAAkD;AAClD,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAExE,4BAA4B;AAC5B,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEtE,0BAA0B;AAC1B,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAuE5D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,UAAU,GAAG,SAAS,GAC5B,MAAM,EAAE,CAiCV;AAeD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,UAAU,GAAG,SAAS,GAC5B,MAAM,EAAE,CAaV;AAgBD;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,iBAAiB,CAAC;AAE1D;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,kBAAkB,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAGtD,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,UAAU,GAAG,SAAS,GAC5B,MAAM,EAAE,CAaV;AAgBD,6DAA6D;AAC7D,MAAM,MAAM,aAAa;AACvB,oDAAoD;AAClD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACvD,iDAAiD;GAC/C;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACxC,wFAAwF;GACtF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AASnC;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAmBjF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,EAAE,CAK3E;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,EAAE,CAoBzE;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAEzE,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,GACvC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAOrC;AAED,kJAAkJ;AAClJ,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,kBAAkB,GAAG,SAAS,GACtC,KAAK,CAAC,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAItC"}
package/dist/agent.js CHANGED
@@ -107,21 +107,18 @@ const HostedMcp = z
107
107
  message: 'hosted MCP needs `server`and/or`source`',
108
108
  });
109
109
  /**
110
- * `kind: 'proxied'` — a 3rd-party SaaS MCP reached through the mcp-proxy
111
- * credential broker (Case C). Schema is present now; runtime support lands v2.
112
- */
113
- const ProxiedMcp = z.strictObject({
114
- kind: z.literal('proxied'),
115
- /** mcp-proxy connection id (not yet available — rides with the mcp-proxy credential broker). */
116
- connection: z.string().min(1),
117
- });
118
- /**
119
- * `kind: 'external'` — builder-hosted MCP at an arbitrary URL.
110
+ * `kind: 'external'` — any MCP reached by URL: builder-hosted, or a
111
+ * third-party SaaS server (Linear, Notion, GitHub, …).
120
112
  *
113
+ * One map, three credential sources + one forward (guuey#178 D1):
121
114
  * - `transport` defaults to `'http'` (StreamableHTTP).
115
+ * - static `headers` (values may use `${env.NAME}`) — API-key servers.
122
116
  * - `federate: true` makes guuey mint a per-invoke JWT with `aud = url` that
123
- * the builder's MCP validates against the guuey JWKS. Omit for plain URL +
124
- * optional static `headers`.
117
+ * the builder's MCP validates against the guuey JWKS.
118
+ * - `credential: 'oauth'` — the server's users sign in with the server's OWN
119
+ * OAuth authorization server; guuey brokers the dance and the token
120
+ * (see the field doc). URL + `credential: 'oauth'` is the whole
121
+ * declaration — nothing is builder-registered; discovery does the rest.
125
122
  * - `credential: 'caller'` forwards the invoke's own byo-verified bearer as
126
123
  * this server's per-turn credential (guuey#179) — see the field doc.
127
124
  */
@@ -149,8 +146,23 @@ const ExternalMcp = z
149
146
  * which app receives its token); FIRST-PARTY USE ONLY for now — gate this
150
147
  * (URL allowlist or console warning) before opening it to arbitrary
151
148
  * builders. Mutually exclusive with `federate: true`.
149
+ *
150
+ * `'oauth'` — the FOURTH mode (guuey#178): the server is a third-party
151
+ * MCP whose end users must sign in with the server's own OAuth
152
+ * authorization server (RFC 9728 / 8414 discovery, PKCE, RFC 8707
153
+ * resource). guuey runs the dance ONCE per (user, server) from a
154
+ * consent card in the chat, seals the token in the platform's
155
+ * credential broker, and the agent's calls to this server go through
156
+ * the broker's gateway (`https://mcp.<apex>/brokered/<appId>/<name>/`),
157
+ * which injects the user's token per call — the agent pod never holds
158
+ * the third-party token. The deploy-controller lowers this entry by
159
+ * setting {@link mcpResourceUrl} to that route while `url` keeps the
160
+ * upstream. Deploy-only: `guuey dev` has no lowered snapshot. Mutually
161
+ * exclusive with `federate: true` (the broker route IS the federation
162
+ * target) and with a declared `authorization` header (the broker
163
+ * injects the only Authorization this server ever sees).
152
164
  */
153
- credential: z.literal('caller').optional(),
165
+ credential: z.enum(['caller', 'oauth']).optional(),
154
166
  /** Static headers forwarded on every request. Values may use `${env.NAME}` placeholders. */
155
167
  headers: HeadersSchema.optional(),
156
168
  /** Local dev-loop port (`guuey dev`) this MCP is served on for name→localhost URL resolution. */
@@ -170,6 +182,13 @@ const ExternalMcp = z
170
182
  })
171
183
  .refine((v) => !(v.credential === 'caller' && v.federate === true), {
172
184
  message: "credential: 'caller' cannot be combined with federate: true — the forwarded caller bearer IS the credential; a minted federation token would shadow it",
185
+ })
186
+ .refine((v) => !(v.credential === 'oauth' && v.federate === true), {
187
+ message: "credential: 'oauth' cannot be combined with federate: true — the brokered gateway route IS this server's federation target; the pod mints for it automatically",
188
+ })
189
+ .refine((v) => !(v.credential === 'oauth' &&
190
+ Object.keys(v.headers ?? {}).some((h) => h.toLowerCase() === 'authorization')), {
191
+ message: "credential: 'oauth' cannot be combined with an `authorization` header — the credential broker injects the user's OAuth token as the only Authorization this server sees",
173
192
  });
174
193
  /**
175
194
  * A single MCP server entry inside `agent.mcpServers`.
@@ -177,13 +196,16 @@ const ExternalMcp = z
177
196
  * Discriminated union on `kind` — one slot per hosting mode:
178
197
  * - `colocated` — guuey-managed HTTP child inside the agent pod
179
198
  * - `hosted` — guuey-hosted registry MCP (Starter+)
180
- * - `proxied` — 3rd-party SaaS via mcp-proxy credential broker (v2)
181
- * - `external` — builder-hosted, reached by URL (plain or federated)
199
+ * - `external` — reached by URL: builder-hosted (plain / federated /
200
+ * caller-forwarded) or third-party OAuth (`credential: 'oauth'`)
201
+ *
202
+ * (`kind: 'proxied'` — the pre-registration placeholder the mcp-proxy broker
203
+ * once reserved — is gone: `credential: 'oauth'` on an `external` entry IS
204
+ * that arm, guuey#178 D1.)
182
205
  */
183
206
  const McpServerSchema = z.discriminatedUnion('kind', [
184
207
  ColocatedMcp,
185
208
  HostedMcp,
186
- ProxiedMcp,
187
209
  ExternalMcp,
188
210
  ]);
189
211
  /**
@@ -383,8 +405,8 @@ export const AgentSectionV1 = z.strictObject({
383
405
  * (valid only under the `ggui` key):
384
406
  * - `'colocated'` — guuey-managed HTTP child inside the agent pod
385
407
  * - `'hosted'` — guuey-hosted registry MCP (Starter+)
386
- * - `'proxied'` — 3rd-party SaaS via mcp-proxy (v2)
387
- * - `'external'` — builder-hosted URL (plain or federated)
408
+ * - `'external'` — reached by URL (plain / federated / caller-forwarded /
409
+ * third-party OAuth via `credential: 'oauth'`)
388
410
  */
389
411
  mcpServers: z
390
412
  .record(z.string().min(1), McpServerEntrySchema)
@@ -564,33 +586,6 @@ export function validateColocatedServerNames(agent) {
564
586
  }
565
587
  return violations;
566
588
  }
567
- // ── No-proxied-servers validation (deploy-time contract enforcement) ────────
568
- //
569
- // `kind: 'proxied'` keeps its schema arm (the documented mcp-proxy
570
- // credential-broker deferral — wires when the 2nd stored-creds customer signs
571
- // up) but has NO runtime support today: a pod that booted one would silently
572
- // miss those tools. `validateNoProxiedServers` is the synchronous deploy-time
573
- // pre-flight (mirrors `validateColocatedServerNames`'s shape) that rejects it
574
- // with a fast, actionable error. The deploy-controller's
575
- // `resolveMcpServersInSnapshot` carries the authoritative backstop throw for
576
- // code deploys, which never pass through this validator.
577
- /**
578
- * Validate that no `agent.mcpServers` entry uses `kind: 'proxied'`. Returns a
579
- * list of human-readable violation messages (empty = clean), one per proxied
580
- * entry, naming the server so the builder knows which ref to change.
581
- */
582
- export function validateNoProxiedServers(agent) {
583
- const violations = [];
584
- const servers = agent?.mcpServers;
585
- if (!servers)
586
- return violations;
587
- for (const [name, server] of declaredServerEntries(servers)) {
588
- if (server.kind === 'proxied') {
589
- violations.push(`MCP server "${name}": kind 'proxied' (the mcp-proxy credential broker) is not yet supported — use 'external', 'hosted', or 'colocated'.`);
590
- }
591
- }
592
- return violations;
593
- }
594
589
  // ── Reserved platform MCP server names (deploy-time reservation) ────────────
595
590
  //
596
591
  // Some `mcpServers` map keys are OWNED by the platform: the runtime splices a
@@ -633,7 +628,7 @@ export const RESERVED_MCP_SERVER_NAMES = [
633
628
  * reserved, not just one hosting mode; a builder must not shadow it as
634
629
  * `colocated`, `external`, or anything else). Returns a list of human-readable
635
630
  * violation messages (empty = clean), one per reserved entry. Mirrors
636
- * {@link validateNoProxiedServers}'s shape.
631
+ * {@link validateColocatedServerNames}'s shape.
637
632
  */
638
633
  export function validateReservedServerNames(agent) {
639
634
  const violations = [];
package/dist/app.d.ts CHANGED
@@ -9,6 +9,44 @@
9
9
  * (agent or mcp-server) is what's deployable; this section is presentation.
10
10
  */
11
11
  import { z } from 'zod';
12
+ /**
13
+ * End-user auth modes an app record accepts — mirrors the platform's
14
+ * `USER_AUTH_MODES` (`@guuey-private/types` `security/user-auth-mode.ts`),
15
+ * which this published package cannot import; the backend pins the two
16
+ * lists equal (`handlers/reconcile.test.ts`).
17
+ */
18
+ export declare const APP_USER_AUTH_MODES: readonly ["anonymous", "native_pool", "byo"];
19
+ export type AppUserAuthMode = (typeof APP_USER_AUTH_MODES)[number];
20
+ /**
21
+ * `guuey.json#app.access` — the app record's ACCESS POLICY, declared in the
22
+ * manifest so `guuey agent apply` (agents-as-code, guuey#190) converges it
23
+ * alongside the agent definition. Field names ARE the platform API's
24
+ * (`PUT /v1/apps/:id` / the reconcile `config` block): no translation.
25
+ *
26
+ * PUT-per-field semantics: a field that is absent is left untouched by a
27
+ * reconcile (never reset). `userAuthConfig: null` is the explicit "clear the
28
+ * issuer binding". The hosted `GuueyApp` row remains the only enforcement
29
+ * source — this block is the DECLARATION reconcile makes it agree with;
30
+ * the pod ignores it.
31
+ *
32
+ * Tier is deliberately absent (admin plane, never CI); slug/customDomain/
33
+ * listing stay declared-not-converged (they have their own ceremonies).
34
+ */
35
+ export declare const AppAccessV1: z.ZodObject<{
36
+ userAuthMode: z.ZodOptional<z.ZodEnum<{
37
+ anonymous: "anonymous";
38
+ native_pool: "native_pool";
39
+ byo: "byo";
40
+ }>>;
41
+ userAuthConfig: z.ZodOptional<z.ZodNullable<z.ZodObject<{
42
+ issuerUrl: z.ZodString;
43
+ audience: z.ZodString;
44
+ }, z.core.$strict>>>;
45
+ allowedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
46
+ guestAccess: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
47
+ }, z.core.$strict>;
48
+ /** Static TypeScript type for `app.access`. */
49
+ export type GuueyAppAccess = z.infer<typeof AppAccessV1>;
12
50
  /**
13
51
  * The app section schema. All fields optional in v1 — a project may carry
14
52
  * the bare minimum at first and grow the listing as it publishes.
@@ -20,6 +58,19 @@ export declare const AppSectionV1: z.ZodObject<{
20
58
  iconUrl: z.ZodOptional<z.ZodURL>;
21
59
  tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
22
60
  customDomain: z.ZodOptional<z.ZodString>;
61
+ access: z.ZodOptional<z.ZodObject<{
62
+ userAuthMode: z.ZodOptional<z.ZodEnum<{
63
+ anonymous: "anonymous";
64
+ native_pool: "native_pool";
65
+ byo: "byo";
66
+ }>>;
67
+ userAuthConfig: z.ZodOptional<z.ZodNullable<z.ZodObject<{
68
+ issuerUrl: z.ZodString;
69
+ audience: z.ZodString;
70
+ }, z.core.$strict>>>;
71
+ allowedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
72
+ guestAccess: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
73
+ }, z.core.$strict>>;
23
74
  }, z.core.$strict>;
24
75
  /** Static TypeScript type for the app section. */
25
76
  export type GuueyApp = z.infer<typeof AppSectionV1>;
package/dist/app.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA0CxB;;;GAGG;AACH,eAAO,MAAM,YAAY;;;;;;;kBAOvB,CAAC;AAEH,kDAAkD;AAClD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC"}
1
+ {"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA0CxB;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,8CAA+C,CAAC;AAChF,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;kBAWtB,CAAC;AAEH,+CAA+C;AAC/C,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEzD;;;GAGG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;kBASvB,CAAC;AAEH,kDAAkD;AAClD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC"}
package/dist/app.js CHANGED
@@ -40,6 +40,40 @@ const CustomDomainSchema = z
40
40
  .min(4)
41
41
  .max(253)
42
42
  .regex(/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i, 'must be a valid fully-qualified domain name');
43
+ /**
44
+ * End-user auth modes an app record accepts — mirrors the platform's
45
+ * `USER_AUTH_MODES` (`@guuey-private/types` `security/user-auth-mode.ts`),
46
+ * which this published package cannot import; the backend pins the two
47
+ * lists equal (`handlers/reconcile.test.ts`).
48
+ */
49
+ export const APP_USER_AUTH_MODES = ['anonymous', 'native_pool', 'byo'];
50
+ /**
51
+ * `guuey.json#app.access` — the app record's ACCESS POLICY, declared in the
52
+ * manifest so `guuey agent apply` (agents-as-code, guuey#190) converges it
53
+ * alongside the agent definition. Field names ARE the platform API's
54
+ * (`PUT /v1/apps/:id` / the reconcile `config` block): no translation.
55
+ *
56
+ * PUT-per-field semantics: a field that is absent is left untouched by a
57
+ * reconcile (never reset). `userAuthConfig: null` is the explicit "clear the
58
+ * issuer binding". The hosted `GuueyApp` row remains the only enforcement
59
+ * source — this block is the DECLARATION reconcile makes it agree with;
60
+ * the pod ignores it.
61
+ *
62
+ * Tier is deliberately absent (admin plane, never CI); slug/customDomain/
63
+ * listing stay declared-not-converged (they have their own ceremonies).
64
+ */
65
+ export const AppAccessV1 = z.strictObject({
66
+ userAuthMode: z.enum(APP_USER_AUTH_MODES).optional(),
67
+ userAuthConfig: z
68
+ .strictObject({
69
+ issuerUrl: z.string().min(1),
70
+ audience: z.string().min(1),
71
+ })
72
+ .nullable()
73
+ .optional(),
74
+ allowedDomains: z.array(z.string().min(1)).optional(),
75
+ guestAccess: z.boolean().nullable().optional(),
76
+ });
43
77
  /**
44
78
  * The app section schema. All fields optional in v1 — a project may carry
45
79
  * the bare minimum at first and grow the listing as it publishes.
@@ -51,4 +85,6 @@ export const AppSectionV1 = z.strictObject({
51
85
  iconUrl: z.url().optional(),
52
86
  tags: z.array(TagSchema).max(10).optional(),
53
87
  customDomain: CustomDomainSchema.optional(),
88
+ /** Access policy converged by `guuey agent apply` — see {@link AppAccessV1}. */
89
+ access: AppAccessV1.optional(),
54
90
  });
package/dist/schema.d.ts CHANGED
@@ -86,9 +86,6 @@ export declare const GuueyJsonV1: z.ZodObject<{
86
86
  server: z.ZodOptional<z.ZodString>;
87
87
  source: z.ZodOptional<z.ZodString>;
88
88
  devPort: z.ZodOptional<z.ZodNumber>;
89
- }, z.core.$strict>, z.ZodObject<{
90
- kind: z.ZodLiteral<"proxied">;
91
- connection: z.ZodString;
92
89
  }, z.core.$strict>, z.ZodObject<{
93
90
  kind: z.ZodLiteral<"external">;
94
91
  url: z.ZodURL;
@@ -97,7 +94,10 @@ export declare const GuueyJsonV1: z.ZodObject<{
97
94
  sse: "sse";
98
95
  }>>;
99
96
  federate: z.ZodOptional<z.ZodBoolean>;
100
- credential: z.ZodOptional<z.ZodLiteral<"caller">>;
97
+ credential: z.ZodOptional<z.ZodEnum<{
98
+ caller: "caller";
99
+ oauth: "oauth";
100
+ }>>;
101
101
  headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
102
102
  devPort: z.ZodOptional<z.ZodNumber>;
103
103
  mcpResourceUrl: z.ZodOptional<z.ZodURL>;
@@ -164,6 +164,19 @@ export declare const GuueyJsonV1: z.ZodObject<{
164
164
  iconUrl: z.ZodOptional<z.ZodURL>;
165
165
  tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
166
166
  customDomain: z.ZodOptional<z.ZodString>;
167
+ access: z.ZodOptional<z.ZodObject<{
168
+ userAuthMode: z.ZodOptional<z.ZodEnum<{
169
+ anonymous: "anonymous";
170
+ native_pool: "native_pool";
171
+ byo: "byo";
172
+ }>>;
173
+ userAuthConfig: z.ZodOptional<z.ZodNullable<z.ZodObject<{
174
+ issuerUrl: z.ZodString;
175
+ audience: z.ZodString;
176
+ }, z.core.$strict>>>;
177
+ allowedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
178
+ guestAccess: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
179
+ }, z.core.$strict>>;
167
180
  }, z.core.$strict>>;
168
181
  ggui: z.ZodOptional<z.ZodObject<{
169
182
  appId: z.ZodOptional<z.ZodString>;
package/dist/schema.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAEjE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmDtB,CAAC;AAEH,kDAAkD;AAClD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAG3D,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;AAEvD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,CAExD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,GACX,UAAU,CAAC,OAAO,WAAW,CAAC,SAAS,CAAC,CAE1C"}
1
+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAEjE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmDtB,CAAC;AAEH,kDAAkD;AAClD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAG3D,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;AAEvD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,CAExD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,GACX,UAAU,CAAC,OAAO,WAAW,CAAC,SAAS,CAAC,CAE1C"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@guuey/config",
3
- "version": "0.7.2",
3
+ "version": "0.8.1",
4
4
  "description": "Open-source schemas + loaders for the three guuey config files: agent.json (declarative agent definition), guuey.json (hosted-deploy overlay), and the helper types around them. Consumed by @guuey/cli, the guuey backend, and devs writing their own agent or MCP server.",
5
5
  "license": "MIT",
6
6
  "type": "module",