@qoniai/qoni 0.9.0 → 0.9.2

package/docs/genauth-management.md

@@ -0,0 +1,285 @@
+---
+title: GenAuth 管理 SDK
+description: 初始化 SDK，管理用户、用户组、组织、角色、权限、应用和自定义字段。
+status: draft
+sdkCandidate: contracts/genauth-management.json
+lastReviewed: 2026-10-12
+pageClass: qoni-sdk-management
+---
+
+## 初始化
+
+```ts
+import { Qoni } from '@qoniai/qoni'
+
+const qoni = new Qoni({
+  accessKey: process.env.QONI_ACCESS_KEY!,
+  secretKey: process.env.QONI_SECRET_KEY!,
+})
+```
+
+使用绑定目标 GenAuth 用户池的 Qoni 访问密钥，在服务端调用。
+
+| 参数 | 类型 | 必填 | 说明 |
+| --- | --- | --- | --- |
+| `accessKey` | `string` | 是 | Qoni 访问密钥 |
+| `secretKey` | `string` | 是 | Qoni 访问密钥 Secret |
+| `host` | `string` | 否 | 私有部署的 Qoni 服务地址 |
+| `genauthHost` | `string` | 否 | 指定 GenAuth 服务地址 |
+| `timeoutMs` | `number` | 否 | 请求超时，单位毫秒，默认 `30000` |
+| `fetch` | `typeof fetch` | 否 | 自定义 HTTP transport |
+
+## 用户管理
+
+```ts
+const { data: user } = await qoni.genauth.users.create({
+  username: 'sdk-example-user',
+  name: 'Example user',
+})
+
+const { data: userDetails } = await qoni.genauth.users.get({ userId: user.userId })
+await qoni.genauth.users.update({ userId: user.userId, nickname: 'Alice' })
+const { data: userBatch } = await qoni.genauth.users.getBatch({ userIds: [user.userId] })
+```
+
+| 方法 | 功能 | 主要参数 | `data` |
+| --- | --- | --- | --- |
+| `users.create` | 创建用户 | username / email / phone；name、password 等可选 | 用户对象 |
+| `users.get` | 读取用户 | userId | 用户对象 |
+| `users.getBatch` | 批量读取用户 | userIds: string[] | 用户数组 |
+| `users.update` | 更新用户 | userId 与需要更新的字段 | 更新后的用户 |
+| `users.createBatch` | 批量创建用户 | list: 用户参数数组 | 用户数组 |
+| `users.deleteBatch` | 批量删除用户 | userIds: string[] | 删除结果 |
+
+创建时至少设置用户名、邮箱或手机号。删除在职用户前，先按业务流程通过 `users.resign({ userId })` 设置离职状态。
+
+## 用户查询与分页
+
+```ts
+const { data: userPage } = await qoni.genauth.users.list({
+  page: 1,
+  limit: 20,
+  keywords: 'alice',
+  options: { fuzzySearchOn: ['username', 'email'] },
+})
+console.log(userPage.list, userPage.totalCount)
+
+for await (const item of qoni.genauth.users.iterate({ limit: 50 })) {
+  console.log(item.userId)
+}
+```
+
+| 方法 | 功能 | 主要参数 | `data` |
+| --- | --- | --- | --- |
+| `users.list` | 分页查询用户 | page、limit、keywords、options | { list, totalCount } |
+| `users.iterate` | 逐个遍历用户 | page 默认 1，limit 默认 50、范围 1–50 | `AsyncIterable<User>` |
+
+`page` 从 1 开始。`keywords` 用于关键字筛选，`options.fuzzySearchOn` 指定匹配字段。无需筛选时省略这两个参数。`iterate` 中使用 `break` 停止遍历。
+
+## 用户组
+
+```ts
+const { data: group } = await qoni.genauth.groups.create({
+  code: 'engineering',
+  name: 'Engineering',
+})
+await qoni.genauth.groups.addMembers({ code: group.code, userIds: [user.userId] })
+const { data: groupPage } = await qoni.genauth.groups.list({ page: 1, limit: 20 })
+```
+
+| 方法 | 功能 | 主要参数 | `data` |
+| --- | --- | --- | --- |
+| `groups.create` | 创建用户组 | code、name | 用户组对象 |
+| `groups.get` | 读取用户组 | code | 用户组对象 |
+| `groups.list` | 查询用户组 | page、limit | { list, totalCount } |
+| `groups.update` | 更新用户组 | code 与更新字段 | 用户组对象 |
+| `groups.addMembers` | 添加成员 | code、userIds | 操作结果 |
+
+## 组织与部门
+
+```ts
+await qoni.genauth.organizations.create({
+  organizationCode: 'company',
+  organizationName: 'Example company',
+})
+const { data: department } = await qoni.genauth.departments.create({
+  organizationCode: 'company',
+  parentDepartmentId: 'root',
+  name: 'Engineering',
+  code: 'engineering',
+})
+await qoni.genauth.departments.addMembers({
+  organizationCode: 'company',
+  departmentId: department.departmentId,
+  userIds: [user.userId],
+})
+```
+
+| 方法 | 功能 | 主要参数 | `data` |
+| --- | --- | --- | --- |
+| `organizations.create` | 创建组织 | organizationCode、organizationName | 组织对象 |
+| `organizations.get` | 读取组织 | organizationCode | 组织对象 |
+| `organizations.list` | 查询组织 | page、limit | 组织列表 |
+| `organizations.update` | 更新组织 | organizationCode 与更新字段 | 组织对象 |
+| `departments.create` | 创建部门 | organizationCode、parentDepartmentId、name | 部门对象 |
+| `departments.get` | 读取部门 | organizationCode、departmentId 或 departmentCode | 部门对象 |
+| `departments.update` | 更新部门 | organizationCode、departmentId 与更新字段 | 部门对象 |
+| `departments.addMembers` | 添加部门成员 | organizationCode、departmentId、userIds | 操作结果 |
+
+根部门的 `parentDepartmentId` 使用 `root`；其他部门使用实际父部门 ID。
+
+## 角色、资源与授权
+
+```ts
+await qoni.genauth.namespaces.create({ code: 'project', name: 'Project' })
+await qoni.genauth.roles.create({ namespace: 'project', code: 'reader', name: 'Reader' })
+await qoni.genauth.roles.assign({
+  namespace: 'project',
+  code: 'reader',
+  targets: [{ targetType: 'USER', targetIdentifier: user.userId }],
+})
+await qoni.genauth.resources.create({
+  namespace: 'project', code: 'documents', type: 'API',
+  apiIdentifier: '/documents',
+  actions: [{ name: 'documents:read', description: 'Read documents' }],
+})
+await qoni.genauth.permissions.authorize({
+  namespace: 'project',
+  list: [{
+    targetType: 'ROLE', targetIdentifiers: ['reader'],
+    resources: [{ code: 'documents:*', resourceType: 'API', actions: ['documents:read'] }],
+  }],
+})
+const { data: permission } = await qoni.genauth.permissions.isAllowed({
+  namespace: 'project', userId: user.userId,
+  resource: 'documents:123', action: 'documents:read',
+})
+console.log(permission.allowed)
+```
+
+| 方法 | 功能 | 主要参数 | `data` |
+| --- | --- | --- | --- |
+| `namespaces.create` | 创建权限空间 | code、name | 权限空间对象 |
+| `roles.create` | 创建角色 | namespace、code、name | 角色对象 |
+| `roles.list` | 查询角色 | namespace、page、limit | { list, totalCount } |
+| `roles.assign` | 分配角色 | namespace、code、targets | 操作结果 |
+| `resources.create` | 定义资源及动作 | namespace、code、type、actions；API 资源使用 apiIdentifier | 资源对象 |
+| `permissions.authorize` | 授予资源权限 | namespace、list | 操作结果 |
+| `permissions.isAllowed` | 判断用户权限 | namespace、userId、resource、action | { allowed } |
+
+角色、资源和授权使用同一 `namespace`。创建资源用 `type`，授权资源项用 `resourceType`。
+
+## 应用管理
+
+```ts
+const { data: application } = await qoni.genauth.applications.create({
+  appName: 'Example app',
+  appIdentifier: 'example-app',
+  appType: 'web',
+  defaultProtocol: 'oidc',
+  redirectUris: ['https://app.example.com/callback'],
+})
+const { data: appDetails } = await qoni.genauth.applications.get({ appId: application.appId })
+const { data: appPage } = await qoni.genauth.applications.list({ page: 1, limit: 20 })
+```
+
+| 方法 | 功能 | 主要参数 | `data` |
+| --- | --- | --- | --- |
+| `applications.create` | 创建应用 | appName；自建应用传 appIdentifier，可设置 appType、defaultProtocol、redirectUris | 应用创建结果 |
+| `applications.get` | 读取应用配置 | appId | 应用对象 |
+| `applications.list` | 分页查询应用 | page、limit、keywords | 应用列表 |
+| `applications.update` | 更新应用配置 | appId 与更新字段 | 应用对象 |
+| `applications.delete` | 删除应用 | appId | 操作结果 |
+
+## 自定义字段
+
+```ts
+await qoni.genauth.customFields.set({
+  list: [{ targetType: 'USER', key: 'costCenter', label: 'Cost center', dataType: 'STRING' }],
+})
+await qoni.genauth.customFields.setData({
+  targetType: 'USER', targetIdentifier: user.userId,
+  list: [{ key: 'costCenter', value: 'engineering' }],
+})
+const { data: fieldValues } = await qoni.genauth.customFields.getData({
+  targetType: 'USER', targetIdentifier: user.userId,
+})
+```
+
+| 方法 | 功能 | 主要参数 | `data` |
+| --- | --- | --- | --- |
+| `customFields.list` | 查询字段定义 | targetType，默认 USER | 字段定义列表 |
+| `customFields.set` | 创建或更新字段定义 | list: { targetType, key, label, dataType }[] | 操作结果 |
+| `customFields.setData` | 设置对象字段值 | targetType、targetIdentifier、list | 操作结果 |
+| `customFields.getData` | 读取对象字段值 | targetType、targetIdentifier | 字段数据 |
+
+先定义字段，再写入字段值。已有字段的 `dataType` 不能修改；角色字段需要传所属 `namespace`。
+
+## 其他管理功能
+
+| 入口 | 功能 |
+| --- | --- |
+| `tenants` | 租户与租户成员 |
+| `identityProviders` | 外部身份源与连接配置 |
+| `dataPermissions / policies` | 数据资源、策略及数据授权 |
+| `auditLogs / sessions` | 管理审计与用户会话 |
+| `security / whitelist / riskLists` | MFA、安全设置及访问名单 |
+| `webhooks / events` | Webhook 配置与事件 |
+| `sync / pipelines` | 账号同步及认证流程 |
+| `accessKeys` | 访问密钥管理 |
+| `positions / dynamicGroups` | 岗位与动态用户组 |
+| `devices / deviceRules` | 设备及设备规则 |
+| `publicAccounts / invitations` | 公共账号及邀请 |
+| `approvals / ldap` | 审批与 LDAP 配置 |
+| `metadata / email / billing` | 元数据、邮件及计费配置 |
+
+以上入口均位于 `qoni.genauth` 下。具体方法、参数与返回类型见 [管理方法参考](./genauth-management-api)。
+
+## 返回值与请求取消
+
+```ts
+const controller = new AbortController()
+const { data: rolePage, meta } = await qoni.genauth.roles.list(
+  { namespace: 'project', page: 1, limit: 20 },
+  { signal: controller.signal },
+)
+console.log(rolePage.list, meta.requestId)
+```
+
+方法返回 `Promise<QoniResponse<T>>`：`data` 为业务结果，`meta.requestId` 为请求标识。第二参数传 `{ signal }`，调用 `controller.abort()` 取消请求。`users.iterate` 返回 `AsyncIterable`。
+
+## 使用已有管理 Token
+
+```ts
+const { data: roleList } = await qoni.genauth.roles.list({
+  namespace: 'project',
+  adminToken: process.env.GENAUTH_MANAGEMENT_TOKEN!,
+  userPoolId: process.env.GENAUTH_USER_POOL_ID!,
+})
+```
+
+`adminToken` 与 `userPoolId` 必须同时传入。显式传入的 Token 过期后由调用方更新。
+
+## 错误处理
+
+```ts
+import { QoniError } from '@qoniai/qoni'
+
+try {
+  await qoni.genauth.users.get({ userId: '<user-id>' })
+} catch (error) {
+  if (error instanceof QoniError) {
+    console.error(error.code, error.message, error.requestId)
+  }
+  throw error
+}
+```
+
+| 错误 | 处理方式 |
+| --- | --- |
+| `QoniValidationError` | 检查必填参数与字段类型 |
+| `401` / `403` | 检查凭据、用户池绑定及管理权限 |
+| `404` | 检查对象 ID 与所属用户池 |
+| `409` | 处理对象状态冲突或标识重复 |
+| `QoniTimeoutError` | 重试写操作前先查询原操作结果 |
+| 其他 `QoniError` | 查看 `code`、`message`、`requestId`、`body` |

package/docs/ordinary-task-profile.md

@@ -0,0 +1,18 @@
+# Ordinary Task Profile / 本轮普通资料
+
+Request `user.profile:read` and optionally `user.profile:write` in the original delegation, alongside the WebAgent scopes. They remain in the original GenAuth grant; they are not added to the WebAgent product token. The original Task source and current consent/key/field permissions jointly gate every operation.
+
+```ts
+const profile = await qoni.doAnything.profile.read({runId, token, fields: ["name", "address"]});
+// Render profile.data.values only in the current user's authorized UI; do not log it.
+// Only an explicitly authorised original source can save these ordinary fields.
+await qoni.doAnything.profile.update({runId, token, values: {name: "Alice", address: "Road 1"}});
+```
+
+The main task can use `profile_fill` to reuse existing values and ask for only missing fields through the existing form. Skip/cancel writes nothing. Without save permission, answers are used in the current turn only. An unknown update is never automatically retried; read again to reconcile. A new request token cannot expand the Task's original source. A project admin credential cannot borrow another person's delegation.
+
+姓名/地址等资料从原 Task 本人读取。缺失字段使用现有普通表单；跳过不保存。没有保存授权时只供本次使用。读写同时核原 grant 与当前同意、key 和字段权限，新令牌不能扩大旧 Task。提交结果未知时先重新读取，不自动重放。
+
+Supported builtins: name, nickname, country, province, city, address, streetAddress, postalCode, company. `customData.<key>` supports visible/editable, nonencrypted primitive STRING/NUMBER/BOOLEAN definitions in the existing UDF store. Custom definitions with validation rules and other UDF types remain unavailable in this ordinary adapter. External custom user databases remain unavailable because they cannot share the GA SQL transaction.
+
+Passwords, identity documents, payment fields, credentials, identity tokens and encrypted/desensitised custom fields are excluded. Email/phone changes retain their existing verification flow. Native Console save-only sources have no profile delegation and cannot be upgraded by this API. 本批不包含敏感代填或邮箱业务。

package/docs/quickstart-v5-contract.md

@@ -0,0 +1,39 @@
+# Quickstart v5 候选合同
+
+这些接口从 0.9.2 起随 npm 包发布，需要配套后端；发布不代表完整业务验收，个人 Agent 编排在生产环境尚未开通。
+
+## Personal Agent 创建与绑定
+
+`genauth.agents.create({displayName, description?, channels: {email}, idempotencyKey?})` 的 `channels.email` 是用户选择的邮箱本地名。返回的 `id`、`email` 仅来自后端已确认的 ready/bound 回执，SDK 不生成地址或补造 ready。旧 `{displayName, idempotencyKey, mailboxLocalPart?}` 方法仍返回 provisioning 回执。
+
+新 overload 只发一次 create。后端明确受理、返回合法 provisioningId 且状态为 creating/mail_pending 时，最多进行 20 次只读观察；120 秒总预算从初次 create 前开始，包含该请求及所有等待和观察。每次观察最多 5 秒，受剩余总预算限制，并通过 AbortSignal 取消实际传输。错误或响应未知后不会继续观察或重发 create。
+
+失败的 `PersonalAgentCreateError` 保留原错误的 code/status/body/requestId/cause、`retryable: false` 和原 `idempotencyKey`；如果可确认，也保留 provisioningId。调用方可显式执行 `genauth.agents.get(error.recovery)`，按原 key 只读追溯。get 的 provisioningId/agentId/idempotencyKey 三种 selector 恰选一个，原 key 回查要求 `readOnly: true`。
+
+自动 key 只保障当前调用能报告其请求身份。App 要跨进程或硬崩溃恢复，须在调用前持久保存显式 key；SDK 不建隐式文件或仅靠内存恢复，也不以 displayName 推测原请求。
+
+`genauth.agents.bindUser({agentId, userAccessToken, relation: 'owner'})` 将当前用户 token 发给后端识别本人，验证真实 bound 回执并返回 bindingId/userId。创建、绑定均不授予任务、邮箱或其他业务权限。既有 `agents.bind({provisioningId, accessToken})` 保持兼容。
+
+## Formal Agent 委托
+
+默认 mode 为 silent，也可显式指定 silent 或 interactive；其他 JavaScript mode 在本地拒绝。formal agentId 必须是 UUID，不能同时使用旧 agent/agentKey 标签。silent 保留明确的目标 userId 要求；interactive 在签名前剔除 user/userId，由真实登录授权决定身份，deprecated 类型兼容不代表采用这些字段。
+
+`scopes: ['*']` 仅接受 formal Agent 的默认或显式 silent，不能混入具体 scopes 或 products（包括空数组），不能用于旧标签或 interactive。SDK 原样发送单个星号；后端根据当前 App/凭据、capability、绑定与已有效同意等实际权限有界求交，SDK 不本地展开、缓存授权或扩大权限。要核实实际授予的具体 scopes，应调用 `genauth.introspectDelegationToken({token})`。
+
+首次缺少有效授权依据仍可能返回 `needs_authorization`。HTTP 200 内的业务 403 与原 code/body 保持失败；SDK 不自动切换 interactive、续签、重试或替用户同意。显式 interactive 仍需用户完成真实授权，再按正式 complete 接口兑换。
+
+## Track 与附件兼容
+
+Track 使用实际 `/track/tracks` 合同，保留终态 `done`、409 `task_in_progress` 及真实回执；不自动重跑。未实现的 Track 流式/交互、历史快照及旧 `doAnything.readArtifacts()` 在本地抛出 `QoniUnsupportedError`，不发 HTTP。附件读取沿实际 blob 接口及既有所有者校验。
+
+## 本地验证边界
+
+`pnpm test` 验证既有 mock、包导出和 Task 回归。Quickstart 新增回归可单独执行：
+
+```sh
+pnpm exec vitest run --coverage=false tests/agent-provisioning.test.ts tests/personal-agent-page.test.ts tests/formal-delegation.test.ts tests/formal-agent-silent.test.ts tests/delegation-normalizer-r3.test.ts tests/formal-agent-wildcard.test.ts tests/composed-intersections.test.ts tests/profile.test.ts tests/structured-forms.test.ts tests/structured-forms-r2.test.ts tests/task-mail.test.ts tests/w11-acceptance.test.ts
+pnpm typecheck
+pnpm build
+```
+
+这些测试使用 mock 与独立 loopback，不读取真实凭据。它们不证明 GA wildcard 真实签发、邮箱供应商、完整网页业务或 Enterprise namespace/citeSources 记忆接线已通过；这些仍须分别验收。

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@qoniai/qoni",
-  "version": "0.9.0",
-  "description": "Unified Node.js SDK for Qoni Agent delegation, GUMem memory, and WebAgent automation.",
+  "version": "0.9.2",
+  "description": "Unified Node.js SDK for Qoni Agent delegation, GenAuth management, GUMem memory, and WebAgent automation.",
   "homepage": "https://github.com/QONIAI/qoni-sdk-node#readme",
   "bugs": {
     "url": "https://github.com/QONIAI/qoni-sdk-node/issues"
@@ -19,7 +19,10 @@
     "sdk",
     "delegation",
     "gumem",
-    "webagent"
+    "webagent",
+    "genauth",
+    "authing",
+    "management"
   ],
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
@@ -45,20 +48,27 @@
     "check:brand": "node scripts/check-brand.mjs",
     "gen:event-types": "node scripts/gen-event-types.mjs",
     "typecheck": "tsc --noEmit",
-    "test": "pnpm build && pnpm check:brand && pnpm test:mock && pnpm test:package",
-    "test:mock": "vitest run --coverage=false tests/qoni.test.ts tests/semantic-surface.test.ts tests/open-source-readiness.test.ts tests/complete-coverage.test.ts tests/event-catalog.test.ts tests/interactions.test.ts tests/contract-surface.test.ts tests/sse-abort.test.ts tests/do-anything-evidence.test.ts tests/query-matrix.test.ts tests/live-evidence.test.ts tests/site-login-settle-track.test.ts tests/abstract-interactions.test.ts",
+    "test": "pnpm build && pnpm check:brand && pnpm test:mock && pnpm test:package && pnpm test:task",
+    "test:mock": "vitest run --coverage=false tests/qoni.test.ts tests/semantic-surface.test.ts tests/open-source-readiness.test.ts tests/complete-coverage.test.ts tests/event-catalog.test.ts tests/interactions.test.ts tests/contract-surface.test.ts tests/sse-abort.test.ts tests/do-anything-evidence.test.ts tests/query-matrix.test.ts tests/live-evidence.test.ts tests/site-login-settle-track.test.ts tests/abstract-interactions.test.ts tests/genauth-management.test.ts tests/genauth-communication.test.ts tests/genauth-hosted-login.test.ts tests/personal-agent-page.test.ts tests/agent-provisioning.test.ts tests/formal-agent-silent.test.ts tests/formal-agent-wildcard.test.ts tests/delegation-normalizer-r3.test.ts tests/gray-track-contract.test.ts tests/current-task-login.test.ts tests/memory-context.test.ts tests/memory-submit-outcome.test.ts tests/task-scopes.test.ts",
     "test:e2e": "QONI_LIVE_E2E=1 vitest run --coverage=false --fileParallelism=false --maxWorkers=1 --testTimeout=120000 tests/live-e2e/*.test.ts",
     "test:e2e:do-anything": "QONI_LIVE_E2E=1 vitest run --coverage=false --fileParallelism=false --maxWorkers=1 --testTimeout=120000 tests/live-e2e/do-anything.test.ts",
     "test:e2e:do-anything:release": "QONI_LIVE_E2E=1 QONI_LIVE_ALLOW_ENV_CONSTRAINTS=0 vitest run --coverage=false --fileParallelism=false --maxWorkers=1 --testTimeout=120000 tests/live-e2e/do-anything.test.ts",
     "test:e2e:matrix": "QONI_LIVE_E2E=1 QONI_QUERY_MATRIX=1 QONI_LIVE_ALLOW_ENV_CONSTRAINTS=0 vitest run --coverage=false --fileParallelism=false --maxWorkers=1 tests/live-e2e/query-matrix.test.ts",
     "test:e2e:release": "QONI_LIVE_E2E=1 QONI_LIVE_REQUIRE_ALL=1 QONI_LIVE_ALLOW_ENV_CONSTRAINTS=0 vitest run --coverage=false --fileParallelism=false --maxWorkers=1 --testTimeout=120000 tests/live-e2e/*.test.ts",
     "test:package": "vitest run --coverage=false tests/package-surface.test.ts",
-    "test:ci": "pnpm test:mock && pnpm test:package",
+    "test:ci": "pnpm test:mock && pnpm test:package && pnpm test:task",
     "smoke:auth-gum": "pnpm build && node scripts/qoni-auth-gum-smoke.mjs --mock",
     "smoke:auth-gum:live": "pnpm build && QONI_SMOKE_MODE=live node scripts/qoni-auth-gum-smoke.mjs --live",
     "pack:dry-run": "pnpm build && pnpm pack --dry-run",
     "prepack": "pnpm build",
-    "prepare": "tsup"
+    "prepare": "tsup",
+    "gen:genauth-management": "node scripts/gen-genauth-management.mjs",
+    "test:e2e:genauth": "QONI_LIVE_E2E=1 vitest run --coverage=false --fileParallelism=false --maxWorkers=1 --testTimeout=30000 tests/live-e2e/genauth-management.test.ts",
+    "gen:genauth-communication": "node scripts/gen-genauth-communication.mjs",
+    "check:genauth-communication": "node scripts/gen-genauth-communication.mjs --check",
+    "test:e2e:communication": "QONI_LIVE_E2E=1 vitest run --coverage=false --fileParallelism=false --maxWorkers=1 --testTimeout=30000 tests/live-e2e/genauth-communication.test.ts",
+    "check:genauth-communication-examples": "node scripts/check-genauth-communication-examples.mjs",
+    "test:task": "vitest run --coverage=false tests/task-client.test.ts tests/task-client-http.test.ts tests/task-client-types.test.ts"
   },
   "publishConfig": {
     "access": "public"