@checkcourt/sdk 0.0.0-stage → 0.3.1

package/dist/generated/spec-hash.d.ts

@@ -0,0 +1 @@
+export declare const OPENAPI_SPEC_SHA256 = "19b06dbaaf58a088e75aa53fb54d4b9ab3b3f847371cb4a3dcd90125a34fe262";

package/dist/generated/spec-hash.js

@@ -0,0 +1,2 @@
+// Generated by scripts/generate.mjs from the CheckCourt OpenAPI spec. Do not edit.
+export const OPENAPI_SPEC_SHA256 = "19b06dbaaf58a088e75aa53fb54d4b9ab3b3f847371cb4a3dcd90125a34fe262";

package/dist/iframe.d.ts

@@ -0,0 +1,68 @@
+export declare const CONTEXT_PARAM = "context";
+export declare const CHANNEL_PARAM = "channel";
+export declare const IFRAME_MIN_HEIGHT = 80;
+export declare const IFRAME_MAX_HEIGHT = 2000;
+export declare const MAX_TOAST_LENGTH = 200;
+/** Top-level areas `navigate()` may target; anything else is dropped by CheckCourt. */
+export declare const NAVIGABLE_SECTIONS: readonly ["dashboard", "booking", "my-bookings", "club", "team", "trainer", "fees", "arbeitsstunden", "settings", "admin"];
+/** CSS variables CheckCourt sends with every theme message. */
+export declare const THEME_TOKEN_NAMES: readonly ["--background", "--foreground", "--card", "--card-foreground", "--muted", "--muted-foreground", "--primary", "--primary-foreground", "--secondary", "--secondary-foreground", "--accent", "--accent-foreground", "--destructive", "--border", "--input", "--ring", "--radius"];
+export type ThemeTokenName = (typeof THEME_TOKEN_NAMES)[number];
+export type FrameMessage = {
+    type: "checkcourt:resize";
+    channel: string;
+    height: number;
+} | {
+    type: "checkcourt:toast";
+    channel: string;
+    kind: "success" | "error";
+    message: string;
+} | {
+    type: "checkcourt:navigate";
+    channel: string;
+    path: string;
+};
+export interface ThemeMessage {
+    type: "checkcourt:theme";
+    channel: string;
+    mode: "light" | "dark";
+    tokens: Partial<Record<ThemeTokenName, string>>;
+}
+export interface Theme {
+    mode: "light" | "dark";
+    tokens: Partial<Record<ThemeTokenName, string>>;
+}
+export declare function resizeMessage(channel: string, height: number): FrameMessage;
+export declare function toastMessage(channel: string, kind: "success" | "error", message: string): FrameMessage;
+export declare function navigateMessage(channel: string, path: string): FrameMessage;
+/** Mirrors CheckCourt's check: same-site path into one of the club areas, query and hash allowed. */
+export declare function isNavigablePath(path: string): boolean;
+export declare function isThemeMessage(data: unknown, channel: string): data is ThemeMessage;
+/** Sets the tokens as CSS variables on `<html>`, toggles the `dark` class and `color-scheme`. */
+export declare function applyTheme(theme: Theme, root?: HTMLElement): void;
+export interface ConnectOptions {
+    /** Keep the frame as tall as the document via ResizeObserver. Default true. */
+    autoResize?: boolean;
+    /** Apply every theme CheckCourt sends with `applyTheme`. Default true. */
+    applyTheme?: boolean;
+    /** For tests; defaults to `window`. */
+    window?: Window;
+}
+export interface ExtensionFrame {
+    /** The context token from the URL. Send it to your backend and verify it there, never trust it in the browser. */
+    readonly context: string | null;
+    readonly channel: string;
+    /** The latest theme, once CheckCourt has sent one. */
+    readonly theme: Theme | null;
+    resize(height?: number): void;
+    toast(kind: "success" | "error", message: string): void;
+    navigate(path: string): void;
+    /** Called for the current theme (if known) and every change. Returns an unsubscribe function. */
+    onTheme(callback: (theme: Theme) => void): () => void;
+    disconnect(): void;
+}
+/**
+ * Connects an iframe extension to CheckCourt: reads `context` and `channel` from the URL and
+ * sends messages with the channel nonce. Throws when the page was not opened by CheckCourt.
+ */
+export declare function connectExtensionFrame(options?: ConnectOptions): ExtensionFrame;

package/dist/iframe.js

@@ -0,0 +1,171 @@
+export const CONTEXT_PARAM = "context";
+export const CHANNEL_PARAM = "channel";
+export const IFRAME_MIN_HEIGHT = 80;
+export const IFRAME_MAX_HEIGHT = 2000;
+export const MAX_TOAST_LENGTH = 200;
+/** Top-level areas `navigate()` may target; anything else is dropped by CheckCourt. */
+export const NAVIGABLE_SECTIONS = [
+    "dashboard",
+    "booking",
+    "my-bookings",
+    "club",
+    "team",
+    "trainer",
+    "fees",
+    "arbeitsstunden",
+    "settings",
+    "admin",
+];
+/** CSS variables CheckCourt sends with every theme message. */
+export const THEME_TOKEN_NAMES = [
+    "--background",
+    "--foreground",
+    "--card",
+    "--card-foreground",
+    "--muted",
+    "--muted-foreground",
+    "--primary",
+    "--primary-foreground",
+    "--secondary",
+    "--secondary-foreground",
+    "--accent",
+    "--accent-foreground",
+    "--destructive",
+    "--border",
+    "--input",
+    "--ring",
+    "--radius",
+];
+export function resizeMessage(channel, height) {
+    return { type: "checkcourt:resize", channel, height: Math.max(0, Math.ceil(height)) };
+}
+export function toastMessage(channel, kind, message) {
+    const trimmed = message.trim();
+    if (trimmed.length === 0 || trimmed.length > MAX_TOAST_LENGTH) {
+        throw new RangeError(`Toast message must be 1 to ${MAX_TOAST_LENGTH} characters`);
+    }
+    return { type: "checkcourt:toast", channel, kind, message: trimmed };
+}
+export function navigateMessage(channel, path) {
+    if (!isNavigablePath(path)) {
+        throw new RangeError(`Path must start with /${NAVIGABLE_SECTIONS.join(", /")}: ${path}`);
+    }
+    return { type: "checkcourt:navigate", channel, path };
+}
+/** Mirrors CheckCourt's check: same-site path into one of the club areas, query and hash allowed. */
+export function isNavigablePath(path) {
+    if (typeof path !== "string" || path.length > 500 || !path.startsWith("/") || path.startsWith("//"))
+        return false;
+    if (/[\\\u0000-\u001f\u007f]/.test(path))
+        return false;
+    let url;
+    try {
+        url = new URL(path, "https://checkcourt.invalid");
+    }
+    catch {
+        return false;
+    }
+    if (url.origin !== "https://checkcourt.invalid")
+        return false;
+    const section = url.pathname.split("/")[1] ?? "";
+    return NAVIGABLE_SECTIONS.includes(section);
+}
+export function isThemeMessage(data, channel) {
+    const msg = data;
+    return (!!msg &&
+        typeof msg === "object" &&
+        msg.type === "checkcourt:theme" &&
+        msg.channel === channel &&
+        (msg.mode === "light" || msg.mode === "dark") &&
+        !!msg.tokens &&
+        typeof msg.tokens === "object");
+}
+/** Sets the tokens as CSS variables on `<html>`, toggles the `dark` class and `color-scheme`. */
+export function applyTheme(theme, root = document.documentElement) {
+    for (const name of THEME_TOKEN_NAMES) {
+        const value = theme.tokens[name];
+        if (typeof value === "string" && value)
+            root.style.setProperty(name, value);
+    }
+    root.classList.toggle("dark", theme.mode === "dark");
+    root.style.colorScheme = theme.mode;
+}
+/**
+ * Connects an iframe extension to CheckCourt: reads `context` and `channel` from the URL and
+ * sends messages with the channel nonce. Throws when the page was not opened by CheckCourt.
+ */
+export function connectExtensionFrame(options = {}) {
+    const win = options.window ?? window;
+    const params = new URLSearchParams(win.location.search);
+    const channel = params.get(CHANNEL_PARAM);
+    if (!channel)
+        throw new Error(`Missing ?${CHANNEL_PARAM}= parameter: this page must be opened by CheckCourt`);
+    const context = params.get(CONTEXT_PARAM);
+    const doc = win.document;
+    // The sandbox gives the frame an opaque origin, so no narrower target origin can match.
+    const post = (message) => win.parent.postMessage(message, "*");
+    let theme = null;
+    const listeners = new Set();
+    const onMessage = (event) => {
+        if (event.source !== win.parent || !isThemeMessage(event.data, channel))
+            return;
+        theme = { mode: event.data.mode, tokens: event.data.tokens };
+        if (options.applyTheme !== false)
+            applyTheme(theme, doc.documentElement);
+        for (const listener of listeners)
+            listener(theme);
+    };
+    win.addEventListener("message", onMessage);
+    let lastHeight = -1;
+    const measure = () => Math.ceil(doc.documentElement.scrollHeight);
+    const resize = (height = measure()) => {
+        const rounded = Math.ceil(height);
+        if (rounded === lastHeight)
+            return;
+        lastHeight = rounded;
+        post(resizeMessage(channel, rounded));
+    };
+    let observer = null;
+    let timer;
+    let connected = true;
+    const autoResize = () => {
+        if (connected)
+            resize();
+    };
+    if (options.autoResize !== false) {
+        // No requestAnimationFrame: browsers skip it in off-screen cross-origin frames, so the height would never arrive.
+        if (typeof ResizeObserver !== "undefined") {
+            observer = new ResizeObserver(autoResize);
+            observer.observe(doc.documentElement);
+        }
+        resize();
+        queueMicrotask(autoResize);
+        timer = win.setTimeout(autoResize, 0);
+        win.addEventListener("load", autoResize);
+    }
+    return {
+        context,
+        channel,
+        get theme() {
+            return theme;
+        },
+        resize,
+        toast: (kind, message) => post(toastMessage(channel, kind, message)),
+        navigate: (path) => post(navigateMessage(channel, path)),
+        onTheme(callback) {
+            listeners.add(callback);
+            if (theme)
+                callback(theme);
+            return () => listeners.delete(callback);
+        },
+        disconnect() {
+            connected = false;
+            win.removeEventListener("message", onMessage);
+            win.removeEventListener("load", autoResize);
+            observer?.disconnect();
+            if (timer !== undefined)
+                win.clearTimeout(timer);
+            listeners.clear();
+        },
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+export { createCheckCourtClient, unwrap, retryAfterMs, TENANT_HEADER } from "./client.js";
+export type { CheckCourtClient, CheckCourtClientOptions, RetryOptions } from "./client.js";
+export { apiKeyAuth, installationAuth, userAuth } from "./auth.js";
+export { getInstallation, getMe, type AppInstallation, type Me } from "./installation.js";
+export type { AuthContext, AuthStrategy, InstallationAuth, StoredUserTokens, UserAuth } from "./auth.js";
+export * from "./errors.js";
+export * from "./oauth.js";
+export * from "./webhooks.js";
+export * from "./extensions.js";
+export * from "./manifest.js";
+export type { paths, components, operations } from "./generated/schema.js";
+export { OPENAPI_SPEC_SHA256 } from "./generated/spec-hash.js";

package/dist/index.js

@@ -0,0 +1,9 @@
+export { createCheckCourtClient, unwrap, retryAfterMs, TENANT_HEADER } from "./client.js";
+export { apiKeyAuth, installationAuth, userAuth } from "./auth.js";
+export { getInstallation, getMe } from "./installation.js";
+export * from "./errors.js";
+export * from "./oauth.js";
+export * from "./webhooks.js";
+export * from "./extensions.js";
+export * from "./manifest.js";
+export { OPENAPI_SPEC_SHA256 } from "./generated/spec-hash.js";

package/dist/installation.d.ts

@@ -0,0 +1,15 @@
+import { type CheckCourtClient } from "./client.js";
+import type { components } from "./generated/schema.js";
+export type AppInstallation = components["schemas"]["AppInstallation"];
+/**
+ * `GET /api/v1/app/installation`: the calling club app's own installation with the club's
+ * settings. Only with an installation token (`cca_`); read it after `app.installed`,
+ * `app.upgraded` and `app.settings_updated`, whose payloads carry ids only.
+ */
+export declare function getInstallation(client: CheckCourtClient): Promise<AppInstallation>;
+export type Me = components["schemas"]["Me"];
+/**
+ * `GET /api/v1/me`: who connected the member app. Only with a member token (`ccu_`). `user_id` is a
+ * pseudonym stable for your app and different for every other app; it carries no name or email.
+ */
+export declare function getMe(client: CheckCourtClient): Promise<Me>;

package/dist/installation.js

@@ -0,0 +1,16 @@
+import { unwrap } from "./client.js";
+/**
+ * `GET /api/v1/app/installation`: the calling club app's own installation with the club's
+ * settings. Only with an installation token (`cca_`); read it after `app.installed`,
+ * `app.upgraded` and `app.settings_updated`, whose payloads carry ids only.
+ */
+export async function getInstallation(client) {
+    return unwrap(client.GET("/app/installation"));
+}
+/**
+ * `GET /api/v1/me`: who connected the member app. Only with a member token (`ccu_`). `user_id` is a
+ * pseudonym stable for your app and different for every other app; it carries no name or email.
+ */
+export async function getMe(client) {
+    return unwrap(client.GET("/me"));
+}

package/dist/internal/base-url.d.ts

@@ -0,0 +1,3 @@
+export declare const DEFAULT_BASE_URL = "https://app.checkcourt.de";
+/** Accepts the origin with or without a trailing `/api/v1`, so CLI-style URLs work too. */
+export declare function normalizeBaseUrl(baseUrl: string | undefined): string;

package/dist/internal/base-url.js

@@ -0,0 +1,5 @@
+export const DEFAULT_BASE_URL = "https://app.checkcourt.de";
+/** Accepts the origin with or without a trailing `/api/v1`, so CLI-style URLs work too. */
+export function normalizeBaseUrl(baseUrl) {
+    return (baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "").replace(/\/api\/v1$/, "");
+}

package/dist/internal/encoding.d.ts

@@ -0,0 +1,8 @@
+export declare function utf8(input: string): Uint8Array<ArrayBuffer>;
+export declare function decodeUtf8(input: Uint8Array): string;
+export declare function toBytes(input: string | Uint8Array | ArrayBuffer): Uint8Array<ArrayBuffer>;
+export declare function base64UrlEncode(bytes: Uint8Array): string;
+export declare function base64UrlDecode(input: string): Uint8Array<ArrayBuffer> | null;
+export declare function hexEncode(bytes: Uint8Array): string;
+export declare function hexDecode(input: string): Uint8Array<ArrayBuffer> | null;
+export declare function randomBytes(length: number): Uint8Array<ArrayBuffer>;

package/dist/internal/encoding.js

@@ -0,0 +1,55 @@
+const encoder = new TextEncoder();
+const decoder = new TextDecoder("utf-8", { fatal: true });
+export function utf8(input) {
+    return encoder.encode(input);
+}
+export function decodeUtf8(input) {
+    return decoder.decode(input);
+}
+export function toBytes(input) {
+    if (typeof input === "string")
+        return utf8(input);
+    if (input instanceof ArrayBuffer)
+        return new Uint8Array(input);
+    return new Uint8Array(input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength));
+}
+export function base64UrlEncode(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export function base64UrlDecode(input) {
+    if (!/^[A-Za-z0-9_-]*$/.test(input) || input.length % 4 === 1)
+        return null;
+    const padded = input.replace(/-/g, "+").replace(/_/g, "/") + "===".slice((input.length + 3) % 4);
+    try {
+        const binary = atob(padded);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++)
+            bytes[i] = binary.charCodeAt(i);
+        return bytes;
+    }
+    catch {
+        return null;
+    }
+}
+export function hexEncode(bytes) {
+    let out = "";
+    for (const byte of bytes)
+        out += byte.toString(16).padStart(2, "0");
+    return out;
+}
+export function hexDecode(input) {
+    if (input.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(input))
+        return null;
+    const bytes = new Uint8Array(input.length / 2);
+    for (let i = 0; i < bytes.length; i++)
+        bytes[i] = parseInt(input.slice(i * 2, i * 2 + 2), 16);
+    return bytes;
+}
+export function randomBytes(length) {
+    const bytes = new Uint8Array(length);
+    crypto.getRandomValues(bytes);
+    return bytes;
+}

package/dist/internal/hmac.d.ts

@@ -0,0 +1,4 @@
+export declare function hmacSha256(secret: string, data: Uint8Array<ArrayBuffer>): Promise<Uint8Array<ArrayBuffer>>;
+/** WebCrypto's verify compares in constant time. */
+export declare function hmacSha256Verify(secret: string, data: Uint8Array<ArrayBuffer>, signature: Uint8Array<ArrayBuffer>): Promise<boolean>;
+export declare function sha256(data: Uint8Array<ArrayBuffer>): Promise<Uint8Array<ArrayBuffer>>;

package/dist/internal/hmac.js

@@ -0,0 +1,17 @@
+import { utf8 } from "./encoding.js";
+async function importKey(secret) {
+    return crypto.subtle.importKey("raw", utf8(secret), { name: "HMAC", hash: "SHA-256" }, false, [
+        "sign",
+        "verify",
+    ]);
+}
+export async function hmacSha256(secret, data) {
+    return new Uint8Array(await crypto.subtle.sign("HMAC", await importKey(secret), data));
+}
+/** WebCrypto's verify compares in constant time. */
+export async function hmacSha256Verify(secret, data, signature) {
+    return crypto.subtle.verify("HMAC", await importKey(secret), signature, data);
+}
+export async function sha256(data) {
+    return new Uint8Array(await crypto.subtle.digest("SHA-256", data));
+}

package/dist/manifest.d.ts

@@ -0,0 +1,119 @@
+import type { SubscribableEventType } from "./events.js";
+export declare const MANIFEST_VERSION = 1;
+export declare const INSTALL_TARGETS: readonly ["tenant", "user"];
+export type InstallTarget = (typeof INSTALL_TARGETS)[number];
+export declare const USER_LINKING_MODES: readonly ["none", "optional", "required"];
+export type UserLinking = (typeof USER_LINKING_MODES)[number];
+export declare const EXTENSION_KINDS: readonly ["declarative", "iframe"];
+export type ExtensionKind = (typeof EXTENSION_KINDS)[number];
+/** Where each point is shown and how it may render. */
+export declare const EXTENSION_POINTS: {
+    readonly "app.settings": {
+        readonly targets: readonly ["tenant"];
+        readonly kinds: readonly ["declarative", "iframe"];
+    };
+    readonly "booking.detail.panel": {
+        readonly targets: readonly ["tenant", "user"];
+        readonly kinds: readonly ["declarative", "iframe"];
+    };
+    readonly "member.profile.section": {
+        readonly targets: readonly ["tenant", "user"];
+        readonly kinds: readonly ["declarative", "iframe"];
+    };
+    readonly "dashboard.widget": {
+        readonly targets: readonly ["tenant", "user"];
+        readonly kinds: readonly ["declarative"];
+    };
+    readonly "booking.action": {
+        readonly targets: readonly ["tenant", "user"];
+        readonly kinds: readonly ["declarative"];
+    };
+    readonly "kiosk.tile": {
+        readonly targets: readonly ["tenant"];
+        readonly kinds: readonly ["declarative"];
+    };
+};
+export type ExtensionPoint = keyof typeof EXTENSION_POINTS;
+/** Scope the installation needs (in `tenantScopes` or `userScopes`) before the point hands it a subject id. */
+export declare const EXTENSION_POINT_SCOPE: {
+    readonly "app.settings": null;
+    readonly "booking.detail.panel": "bookings:read";
+    readonly "booking.action": "bookings:read";
+    readonly "member.profile.section": "members:read";
+    readonly "dashboard.widget": null;
+    readonly "kiosk.tile": null;
+};
+/** Every scope an app may request. Role, app, webhook, key, billing and AVV management are reserved for people. */
+export declare const GRANTABLE_SCOPES: readonly ["courts:read", "courts:read_confidential", "courts:write", "bookings:read", "bookings:read_confidential", "bookings:write", "bookings:cancel", "bookings:edit", "bookings:export", "members:read", "members:read_confidential", "members:invite", "members:write", "members:delete", "teams:read", "teams:write", "policies:read", "policies:read_confidential", "policies:write", "categories:read", "categories:write", "invites:read", "invites:write", "settings:read", "settings:read_confidential", "settings:write", "guest_fees:read", "guest_fees:write", "audit:read", "announcements:read", "announcements:write", "events:read", "events:write", "posts:read", "posts:write", "posts:moderate", "court_layout:read", "court_layout:write", "work_hours:read", "work_hours:write", "work_hours:manage", "compliance:read", "kiosk:manage", "trainer_blocks:write", "analytics:read", "embeds:manage", "webhooks:read"];
+export type GrantableScope = (typeof GRANTABLE_SCOPES)[number];
+type ExtensionOf<P extends ExtensionPoint> = {
+    point: P;
+    kind: (typeof EXTENSION_POINTS)[P]["kinds"][number];
+    /** https; http://localhost is accepted outside production. */
+    url: string;
+} & (P extends "booking.action" ? {
+    label: string;
+} : {
+    label?: string;
+});
+/** One entry of `extensions`; `kind` and `label` are checked per point at compile time. */
+export type ManifestExtension = {
+    [P in ExtensionPoint]: ExtensionOf<P>;
+}[ExtensionPoint];
+interface SettingsPropertyBase {
+    /** 1 to 80 characters. */
+    title: string;
+    /** Up to 300 characters. */
+    description?: string;
+}
+export type SettingsProperty = (SettingsPropertyBase & {
+    type: "string";
+    /** Rendered as a select. Excludes `maxLength`. */
+    enum?: readonly string[];
+    default?: string;
+    maxLength?: number;
+}) | (SettingsPropertyBase & {
+    type: "number";
+    default?: number;
+    minimum?: number;
+    maximum?: number;
+}) | (SettingsPropertyBase & {
+    type: "boolean";
+    default?: boolean;
+});
+/** The JSON-Schema subset CheckCourt renders as the settings form (at most 30 properties). */
+export interface SettingsSchema {
+    type: "object";
+    /** Keys match `^[a-zA-Z][a-zA-Z0-9_]{0,39}$`. */
+    properties: Record<string, SettingsProperty>;
+    required?: readonly string[];
+    additionalProperties?: false;
+}
+export interface DataProcessing {
+    /** At least one, e.g. "Buchungsdaten". */
+    categories: readonly string[];
+    /** Up to 500 characters. */
+    purpose: string;
+    storageLocation: "EU" | "non-EU";
+    avvRequired: boolean;
+}
+export interface Manifest {
+    manifestVersion?: typeof MANIFEST_VERSION;
+    installTargets: readonly InstallTarget[];
+    /** Lets a club installation link member accounts via OAuth. Only with `tenant`. */
+    userLinking?: UserLinking;
+    tenantScopes?: readonly GrantableScope[];
+    userScopes?: readonly GrantableScope[];
+    /** Lifecycle events (`app.*`) arrive without being listed. */
+    events?: readonly SubscribableEventType[];
+    /** At most 20. */
+    extensions?: readonly ManifestExtension[];
+    settingsSchema?: SettingsSchema;
+    dataProcessing: DataProcessing;
+}
+/**
+ * Identity function that gives editor completion and compile-time checks for a manifest.
+ * CheckCourt validates the rest on upload (scope and event pairing, URL rules, lengths).
+ */
+export declare function defineManifest<const M extends Manifest>(manifest: M): M;
+export {};

package/dist/manifest.js

@@ -0,0 +1,79 @@
+export const MANIFEST_VERSION = 1;
+export const INSTALL_TARGETS = ["tenant", "user"];
+export const USER_LINKING_MODES = ["none", "optional", "required"];
+export const EXTENSION_KINDS = ["declarative", "iframe"];
+/** Where each point is shown and how it may render. */
+export const EXTENSION_POINTS = {
+    "app.settings": { targets: ["tenant"], kinds: ["declarative", "iframe"] },
+    "booking.detail.panel": { targets: ["tenant", "user"], kinds: ["declarative", "iframe"] },
+    "member.profile.section": { targets: ["tenant", "user"], kinds: ["declarative", "iframe"] },
+    "dashboard.widget": { targets: ["tenant", "user"], kinds: ["declarative"] },
+    "booking.action": { targets: ["tenant", "user"], kinds: ["declarative"] },
+    "kiosk.tile": { targets: ["tenant"], kinds: ["declarative"] },
+};
+/** Scope the installation needs (in `tenantScopes` or `userScopes`) before the point hands it a subject id. */
+export const EXTENSION_POINT_SCOPE = {
+    "app.settings": null,
+    "booking.detail.panel": "bookings:read",
+    "booking.action": "bookings:read",
+    "member.profile.section": "members:read",
+    "dashboard.widget": null,
+    "kiosk.tile": null,
+};
+/** Every scope an app may request. Role, app, webhook, key, billing and AVV management are reserved for people. */
+export const GRANTABLE_SCOPES = [
+    "courts:read",
+    "courts:read_confidential",
+    "courts:write",
+    "bookings:read",
+    "bookings:read_confidential",
+    "bookings:write",
+    "bookings:cancel",
+    "bookings:edit",
+    "bookings:export",
+    "members:read",
+    "members:read_confidential",
+    "members:invite",
+    "members:write",
+    "members:delete",
+    "teams:read",
+    "teams:write",
+    "policies:read",
+    "policies:read_confidential",
+    "policies:write",
+    "categories:read",
+    "categories:write",
+    "invites:read",
+    "invites:write",
+    "settings:read",
+    "settings:read_confidential",
+    "settings:write",
+    "guest_fees:read",
+    "guest_fees:write",
+    "audit:read",
+    "announcements:read",
+    "announcements:write",
+    "events:read",
+    "events:write",
+    "posts:read",
+    "posts:write",
+    "posts:moderate",
+    "court_layout:read",
+    "court_layout:write",
+    "work_hours:read",
+    "work_hours:write",
+    "work_hours:manage",
+    "compliance:read",
+    "kiosk:manage",
+    "trainer_blocks:write",
+    "analytics:read",
+    "embeds:manage",
+    "webhooks:read",
+];
+/**
+ * Identity function that gives editor completion and compile-time checks for a manifest.
+ * CheckCourt validates the rest on upload (scope and event pairing, URL rules, lengths).
+ */
+export function defineManifest(manifest) {
+    return manifest;
+}