@karmaniverous/jeeves-server-core 0.4.0 → 0.5.0

package/dist/src/schema.d.ts

@@ -1,135 +1,19 @@
 import { z } from 'zod';
+import type { authModeSchema } from './configAuthSchema.js';
+import { brandingSchema } from './configFeatureSchemas.js';
+export { authModeSchema, authSchema, emailAuthSchema, eventConfigSchema, googleAuthSchema, insiderEntrySchema, isScopeName, keyEntrySchema, scopesObjectSchema, scopesSchema, } from './configAuthSchema.js';
+export type { LoggingConfig } from './configFeatureSchemas.js';
+export { brandingSchema, loggingConfigSchema, oauthProviderSchema, oauthSchema, themeOverridesSchema, } from './configFeatureSchemas.js';
 /** Config properties deprecated in v3.6.0 (now resolved via core services). */
 export declare const DEPRECATED_CONFIG_PROPS: readonly ["host", "runnerUrl", "watcherUrl", "metaUrl"];
-/** Supported authentication methods */
-export declare const authModeSchema: z.ZodEnum<{
-    keys: "keys";
-    google: "google";
-    email: "email";
-}>;
-/** Google OAuth configuration */
-export declare const googleAuthSchema: z.ZodObject<{
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-}, z.core.$strip>;
-/** Email (magic link) authentication configuration */
-export declare const emailAuthSchema: z.ZodObject<{
-    smtpUrl: z.ZodString;
-    fromAddress: z.ZodEmail;
-}, z.core.$strip>;
-/** Auth configuration */
-export declare const authSchema: z.ZodObject<{
-    modes: z.ZodArray<z.ZodEnum<{
-        keys: "keys";
-        google: "google";
-        email: "email";
-    }>>;
-    google: z.ZodOptional<z.ZodObject<{
-        clientId: z.ZodString;
-        clientSecret: z.ZodString;
-    }, z.core.$strip>>;
-    sessionSecret: z.ZodOptional<z.ZodString>;
-    email: z.ZodOptional<z.ZodObject<{
-        smtpUrl: z.ZodString;
-        fromAddress: z.ZodEmail;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-/** Event webhook configuration */
-export declare const eventConfigSchema: z.ZodObject<{
-    schema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-    cmd: z.ZodString;
-    map: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    timeoutMs: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strip>;
-/**
- * Scopes configuration — controls which paths a user/key can access.
- *
- * Three forms:
- * - `string` — single allow pattern (e.g. '/d/*')
- * - `string[]` — array of allow patterns (shorthand for \{ allow: [...] \})
- * - `\{ allow?: string[], deny?: string[] \}` — explicit allow/deny rules
- *
- * Semantics:
- * - Path must match at least one allow rule AND NOT match any deny rule
- * - Omitting `allow` = implicit ['/*'] (allow everything)
- * - Omitting `deny` = no exclusions
- * - Omitting scopes entirely = unrestricted access
- */
-export declare const scopesObjectSchema: z.ZodObject<{
-    allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip>;
-export declare const scopesSchema: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
-    allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip>]>;
-/** Insider entry (identity + scopes + optional persisted seed) */
-export declare const insiderEntrySchema: z.ZodObject<{
-    scopes: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
-        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    }, z.core.$strip>]>>;
-    allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    seed: z.ZodOptional<z.ZodString>;
-    keyCreatedAt: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-/** Key entry — plain string (seed, no scopes) or object with key + optional scopes */
-export declare const keyEntrySchema: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
-    key: z.ZodString;
-    scopes: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
-        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    }, z.core.$strip>]>>;
-    allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip>]>;
-/** Check if a string is a named scope identifier (not a path glob). */
-export declare function isScopeName(v: string): boolean;
-/** Logging configuration. Not hot-reloadable — changes require service restart. */
-export declare const loggingConfigSchema: z.ZodObject<{
-    level: z.ZodOptional<z.ZodString>;
-    file: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-/** Inferred logging config type. */
-export type LoggingConfig = z.infer<typeof loggingConfigSchema>;
-/** OAuth provider configuration */
-export declare const oauthProviderSchema: z.ZodObject<{
-    authUrl: z.ZodPipe<z.ZodString, z.ZodURL>;
-    tokenUrl: z.ZodPipe<z.ZodString, z.ZodURL>;
-    pkce: z.ZodDefault<z.ZodBoolean>;
-    defaultScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
-}, z.core.$strip>;
-/** OAuth configuration */
-export declare const oauthSchema: z.ZodObject<{
-    credentialDir: z.ZodString;
-    providers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
-        authUrl: z.ZodPipe<z.ZodString, z.ZodURL>;
-        tokenUrl: z.ZodPipe<z.ZodString, z.ZodURL>;
-        pkce: z.ZodDefault<z.ZodBoolean>;
-        defaultScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    }, z.core.$strip>>>;
-}, z.core.$strip>;
-/** Theme overrides for light and dark modes */
-export declare const themeOverridesSchema: z.ZodRecord<z.ZodString, z.ZodString>;
-/** Instance branding configuration */
-export declare const brandingSchema: z.ZodObject<{
-    name: z.ZodDefault<z.ZodString>;
-    emoji: z.ZodDefault<z.ZodString>;
-    theme: z.ZodOptional<z.ZodObject<{
-        light: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        dark: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    }, z.core.$strip>>;
-    emailTemplate: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
 /** Top-level Jeeves Server configuration */
 export declare const jeevesConfigSchema: z.ZodObject<{
     port: z.ZodDefault<z.ZodNumber>;
     chromePath: z.ZodString;
     auth: z.ZodObject<{
         modes: z.ZodArray<z.ZodEnum<{
-            keys: "keys";
             google: "google";
+            keys: "keys";
             email: "email";
         }>>;
         google: z.ZodOptional<z.ZodObject<{
@@ -141,6 +25,7 @@ export declare const jeevesConfigSchema: z.ZodObject<{
             smtpUrl: z.ZodString;
             fromAddress: z.ZodEmail;
         }, z.core.$strip>>;
+        accessContact: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     scopes: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -182,6 +67,19 @@ export declare const jeevesConfigSchema: z.ZodObject<{
         servers: z.ZodOptional<z.ZodArray<z.ZodURL>>;
     }, z.core.$strip>>;
     diagramCachePath: z.ZodOptional<z.ZodString>;
+    exportCachePath: z.ZodOptional<z.ZodString>;
+    printStyles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        css: z.ZodString;
+        page: z.ZodOptional<z.ZodObject<{
+            format: z.ZodOptional<z.ZodString>;
+            width: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            height: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            margin: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        headerTemplate: z.ZodOptional<z.ZodString>;
+        footerTemplate: z.ZodOptional<z.ZodString>;
+        assets: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
     outsiderPolicy: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodObject<{
         allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
         deny: z.ZodOptional<z.ZodArray<z.ZodString>>;

package/dist/src/schema.js

@@ -1,5 +1,10 @@
 import { SERVER_PORT } from '@karmaniverous/jeeves';
 import { z } from 'zod';
+import { authSchema, scopesSchema, eventConfigSchema, keyEntrySchema, insiderEntrySchema, scopesObjectSchema, getScopeRefs } from './configAuthSchema.js';
+export { authModeSchema, emailAuthSchema, googleAuthSchema, isScopeName } from './configAuthSchema.js';
+import { brandingSchema, oauthSchema, loggingConfigSchema } from './configFeatureSchemas.js';
+export { oauthProviderSchema, themeOverridesSchema } from './configFeatureSchemas.js';
+import { absolutePathSchema, printStylesSchema } from './configPrintStyles.js';
 
 /** Config properties deprecated in v3.6.0 (now resolved via core services). */
 const DEPRECATED_CONFIG_PROPS = [
@@ -8,151 +13,6 @@ const DEPRECATED_CONFIG_PROPS = [
     'watcherUrl',
     'metaUrl',
 ];
-/** Supported authentication methods */
-const authModeSchema = z.enum(['google', 'keys', 'email']);
-/** Google OAuth configuration */
-const googleAuthSchema = z.object({
-    clientId: z.string().min(1),
-    clientSecret: z.string().min(1),
-});
-/** Email (magic link) authentication configuration */
-const emailAuthSchema = z.object({
-    /** SMTP connection string (e.g. smtps://user:pass\@smtp.example.com:465) */
-    smtpUrl: z.string().min(1),
-    /** Sender email address for magic link emails */
-    fromAddress: z.email(),
-});
-/** Auth configuration */
-const authSchema = z.object({
-    /** Active authentication methods. Order determines priority. */
-    modes: z
-        .array(authModeSchema)
-        .min(1, { message: 'At least one auth mode is required' }),
-    /** Google OAuth config. Required if modes includes "google". */
-    google: googleAuthSchema.optional(),
-    /** Session cookie signing secret. Required if modes includes "google". */
-    sessionSecret: z.string().min(1).optional(),
-    /** Email (magic link) auth config. Required if modes includes "email". */
-    email: emailAuthSchema.optional(),
-});
-/** Event webhook configuration */
-const eventConfigSchema = z.object({
-    schema: z.record(z.string(), z.unknown()),
-    cmd: z.string(),
-    map: z.record(z.string(), z.unknown()).optional(),
-    timeoutMs: z.number().positive().optional(),
-});
-/**
- * Scopes configuration — controls which paths a user/key can access.
- *
- * Three forms:
- * - `string` — single allow pattern (e.g. '/d/*')
- * - `string[]` — array of allow patterns (shorthand for \{ allow: [...] \})
- * - `\{ allow?: string[], deny?: string[] \}` — explicit allow/deny rules
- *
- * Semantics:
- * - Path must match at least one allow rule AND NOT match any deny rule
- * - Omitting `allow` = implicit ['/*'] (allow everything)
- * - Omitting `deny` = no exclusions
- * - Omitting scopes entirely = unrestricted access
- */
-const scopesObjectSchema = z.object({
-    allow: z.array(z.string()).optional(),
-    deny: z.array(z.string()).optional(),
-});
-const scopesSchema = z.union([
-    z.string(),
-    z.array(z.string()),
-    scopesObjectSchema,
-]);
-/** Insider entry (identity + scopes + optional persisted seed) */
-const insiderEntrySchema = z.object({
-    scopes: scopesSchema.optional(),
-    /** Extra allow patterns merged on top of named scope references */
-    allow: z.array(z.string()).optional(),
-    /** Extra deny patterns merged on top of named scope references */
-    deny: z.array(z.string()).optional(),
-    /** Auto-generated insider seed, persisted in config.json */
-    seed: z.string().min(1).optional(),
-    /** ISO timestamp of when the seed was created */
-    keyCreatedAt: z.string().optional(),
-});
-/** Key entry — plain string (seed, no scopes) or object with key + optional scopes */
-const keyEntrySchema = z.union([
-    z.string().min(1),
-    z.object({
-        key: z.string().min(1),
-        scopes: scopesSchema.optional(),
-        /** Extra allow patterns merged on top of named scope references */
-        allow: z.array(z.string()).optional(),
-        /** Extra deny patterns merged on top of named scope references */
-        deny: z.array(z.string()).optional(),
-    }),
-]);
-/** Check if a string is a named scope identifier (not a path glob). */
-function isScopeName(v) {
-    return /^[A-Za-z0-9_-]+$/.test(v);
-}
-/** Helper: collect named scope references from a scopes field value.
- *
- * Backward-compat note: `scopes` has historically accepted path globs like "/**" or ["/a","/b"].
- * We only treat values as *named scope references* if they look like identifiers
- * (e.g. "restricted", "no-vc") rather than path globs.
- */
-function getScopeRefs(scopes) {
-    if (typeof scopes === 'string')
-        return isScopeName(scopes) ? [scopes] : [];
-    if (Array.isArray(scopes) && scopes.length > 0) {
-        const strs = scopes.filter((v) => typeof v === 'string');
-        if (strs.length !== scopes.length)
-            return [];
-        return strs.filter((v) => isScopeName(v));
-    }
-    return [];
-}
-/** Logging configuration. Not hot-reloadable — changes require service restart. */
-const loggingConfigSchema = z.object({
-    /** Log level. */
-    level: z
-        .string()
-        .optional()
-        .describe('Logging level (trace, debug, info, warn, error, fatal).'),
-    /** Log file path. */
-    file: z
-        .string()
-        .optional()
-        .describe('Path to log file (logs to stdout if omitted).'),
-});
-/** OAuth provider configuration */
-const oauthProviderSchema = z.object({
-    authUrl: z.string().pipe(z.url()),
-    tokenUrl: z.string().pipe(z.url()),
-    pkce: z.boolean().default(false),
-    defaultScopes: z.array(z.string()).default([]),
-});
-/** OAuth configuration */
-const oauthSchema = z.object({
-    credentialDir: z.string(),
-    providers: z.record(z.string(), oauthProviderSchema).default({}),
-});
-/** Theme overrides for light and dark modes */
-const themeOverridesSchema = z.record(z.string(), z.string());
-/** Instance branding configuration */
-const brandingSchema = z.object({
-    /** Instance display name (used in page title, navbar, emails) */
-    name: z.string().default('Jeeves Server'),
-    /** Instance emoji (used as home icon in navbar) */
-    emoji: z.string().default('🎩'),
-    /** CSS variable overrides grouped by theme mode */
-    theme: z
-        .object({
-        light: themeOverridesSchema.optional(),
-        dark: themeOverridesSchema.optional(),
-    })
-        .optional(),
-    /** Handlebars template for magic link emails. Supports \{\{magicLink\}\}, \{\{branding.name\}\}, \{\{branding.emoji\}\} */
-    emailTemplate: z.string().optional(),
-});
 /** Top-level Jeeves Server configuration */
 const jeevesConfigSchema = z
     .object({
@@ -197,6 +57,16 @@ const jeevesConfigSchema = z
      * Defaults to `.diagram-cache` in the server working directory.
      */
     diagramCachePath: z.string().optional(),
+    /**
+     * Directory for cached PDF/DOCX exports. Defaults to `.export-cache` in
+     * the server working directory. Read at startup.
+     */
+    exportCachePath: z.string().optional(),
+    /**
+     * Named PDF print styles (#316): absolute paths to a stylesheet and
+     * optional header/footer templates and assets directory, read on use.
+     */
+    printStyles: printStylesSchema.optional(),
     /**
      * Global outsider policy — constrains which paths are eligible for outsider sharing.
      * Uses the same allow/deny model as insider scopes.
@@ -228,13 +98,7 @@ const jeevesConfigSchema = z
     /** Instance branding (name, emoji, theme overrides, email template) */
     branding: brandingSchema.optional(),
     /** Absolute path to the durable event queue JSONL file. Cursor file is derived as eventQueue + '.cursor'. */
-    eventQueue: z
-        .string()
-        .min(1)
-        .refine((p) => p.startsWith('/') ||
-        /^[A-Za-z]:[\\/]/.test(p) ||
-        p.startsWith('\\\\'), { message: 'eventQueue must be an absolute path' })
-        .optional(),
+    eventQueue: absolutePathSchema('eventQueue').optional(),
     /** Maximum number of event queue entries processed concurrently. Defaults to 3. */
     eventQueueConcurrency: z.number().int().positive().default(3),
     /** Public base URL (e.g. https://jeeves.johngalt.id). When set, API responses include full public URLs. */
@@ -352,4 +216,4 @@ const DEFAULT_BRANDING = {
     emoji: '🎩',
 };
 
-export { DEFAULT_BRANDING, DEPRECATED_CONFIG_PROPS, authModeSchema, authSchema, brandingSchema, emailAuthSchema, eventConfigSchema, googleAuthSchema, insiderEntrySchema, isScopeName, jeevesConfigSchema, keyEntrySchema, loggingConfigSchema, oauthProviderSchema, oauthSchema, scopesObjectSchema, scopesSchema, themeOverridesSchema };
+export { DEFAULT_BRANDING, DEPRECATED_CONFIG_PROPS, authSchema, brandingSchema, eventConfigSchema, insiderEntrySchema, jeevesConfigSchema, keyEntrySchema, loggingConfigSchema, oauthSchema, scopesObjectSchema, scopesSchema };

package/dist/src/types.d.ts

@@ -78,6 +78,8 @@ export type FileMutationAction = 'edit-block' | 'delete-block' | 'insert-block'
 export interface RotateKeyResponse {
     ok: boolean;
     keyCreatedAt: string;
+    /** What stopped working: the insider key and the insider's outsider links. */
+    invalidates: ('insiderKey' | 'outsiderLinks')[];
 }
 /** GET /api/auth/status response. */
 export interface AuthStatusResponse {