@eide/foir-cli 0.9.0 → 0.10.1

package/dist/cli.js

@@ -468,7 +468,7 @@ import { OperationsService as OperationsService2 } from "@eide/foir-proto-ts/ope
 import { HooksService as HooksService2 } from "@eide/foir-proto-ts/hooks/v1/hooks_pb";
 import { NotificationsService as NotificationsService2 } from "@eide/foir-proto-ts/notifications/v1/notifications_pb";
 import { SchedulesService as SchedulesService2 } from "@eide/foir-proto-ts/schedules/v1/schedules_pb";
-import { IntegrationsService as IntegrationsService2 } from "@eide/foir-proto-ts/integrations/v1/integrations_pb";
+import { AppsService as AppsService2 } from "@eide/foir-proto-ts/apps/v1/apps_service_pb";
 
 // src/lib/rpc/identity.ts
 import { create } from "@bufbuild/protobuf";
@@ -1145,125 +1145,111 @@ function createIdentityMethods(client) {
   };
 }
 
-// src/lib/rpc/integrations.ts
+// src/lib/rpc/apps.ts
 import { create as create2 } from "@bufbuild/protobuf";
 import {
-  ListIntegrationsRequestSchema,
-  ListExtensionsRequestSchema,
-  CredentialStrategy,
-  ExtensionTarget
-} from "@eide/foir-proto-ts/integrations/v1/integrations_pb";
-function createIntegrationsMethods(client) {
+  ListAppsRequestSchema,
+  GetAppRequestSchema,
+  InstallAppRequestSchema,
+  ConfirmInstallAppRequestSchema,
+  UpdateAppRequestSchema,
+  ConfirmUpdateAppRequestSchema,
+  UninstallAppRequestSchema,
+  SetAppMappingRequestSchema,
+  ValidateManifestRequestSchema,
+  TriggerOperationRequestSchema
+} from "@eide/foir-proto-ts/apps/v1/apps_service_pb";
+function createAppsMethods(client) {
   return {
-    async listIntegrations(projectId) {
-      const resp = await client.listIntegrations(
-        create2(ListIntegrationsRequestSchema, { projectId })
+    async listApps(tenantId, projectId) {
+      const resp = await client.listApps(
+        create2(ListAppsRequestSchema, { tenantId, projectId })
       );
-      return resp.integrations.map((s) => s.config).filter((c) => c !== void 0);
+      return resp.apps;
     },
-    async listExtensions(projectId) {
-      const resp = await client.listExtensions(
-        create2(ListExtensionsRequestSchema, { projectId })
+    async getApp(tenantId, projectId, name) {
+      const resp = await client.getApp(
+        create2(GetAppRequestSchema, { tenantId, projectId, name })
       );
-      return resp.extensions;
-    }
-  };
-}
-var STRATEGY_FROM_PROTO = {
-  [CredentialStrategy.UNSPECIFIED]: "none",
-  [CredentialStrategy.OAUTH]: "oauth",
-  [CredentialStrategy.API_KEY]: "api_key",
-  [CredentialStrategy.SHARED_SECRET]: "shared_secret",
-  [CredentialStrategy.SSH_KEY]: "ssh_key",
-  [CredentialStrategy.NONE]: "none",
-  [CredentialStrategy.MANAGED]: "managed"
-};
-var TARGET_FROM_PROTO = {
-  [ExtensionTarget.UNSPECIFIED]: "record",
-  [ExtensionTarget.RECORD]: "record",
-  [ExtensionTarget.MODEL_LIST]: "model-list"
-};
-var STRATEGY_STRING_MAP = {
-  CREDENTIAL_STRATEGY_UNSPECIFIED: "none",
-  CREDENTIAL_STRATEGY_OAUTH: "oauth",
-  CREDENTIAL_STRATEGY_API_KEY: "api_key",
-  CREDENTIAL_STRATEGY_SHARED_SECRET: "shared_secret",
-  CREDENTIAL_STRATEGY_SSH_KEY: "ssh_key",
-  CREDENTIAL_STRATEGY_NONE: "none",
-  CREDENTIAL_STRATEGY_MANAGED: "managed"
-};
-function resolveStrategy(raw) {
-  if (typeof raw === "number") {
-    return STRATEGY_FROM_PROTO[raw] ?? "none";
-  }
-  if (typeof raw === "string") {
-    return STRATEGY_STRING_MAP[raw] ?? raw.toLowerCase().replace("credential_strategy_", "");
-  }
-  return "none";
-}
-function integrationConfigToInput(cfg) {
-  const sync = {};
-  for (const [k, v] of Object.entries(cfg.sync)) {
-    sync[k] = syncMappingFromProto(v);
-  }
-  const out = {
-    middleware: { url: cfg.middleware?.url ?? "" },
-    credentials: {
-      strategy: resolveStrategy(cfg.credentials?.strategy)
+      return resp.app ?? null;
     },
-    sync
-  };
-  out.enabled = cfg.enabled !== false;
-  if (cfg.settings && Object.keys(cfg.settings).length > 0) {
-    out.settings = cfg.settings;
-  }
-  if (cfg.metadata && Object.keys(cfg.metadata).length > 0) {
-    out.metadata = cfg.metadata;
-  }
-  return out;
-}
-function syncMappingFromProto(m) {
-  const out = {
-    model: m.model,
-    naturalKey: m.naturalKey,
-    fields: { ...m.fields }
-  };
-  if (m.modelSeed) {
-    const seed = { fields: {} };
-    for (const [fk, fv] of Object.entries(m.modelSeed.fields)) {
-      seed.fields[fk] = {
-        type: fv.type,
-        ...fv.required ? { required: true } : {},
-        ...fv.naturalKey ? { naturalKey: true } : {},
-        ...fv.label ? { label: fv.label } : {},
-        ...fv.helpText ? { helpText: fv.helpText } : {},
-        ...fv.config && Object.keys(fv.config).length > 0 ? { config: fv.config } : {}
-      };
+    async installApp(tenantId, projectId, manifestUrl) {
+      return client.installApp(
+        create2(InstallAppRequestSchema, { tenantId, projectId, manifestUrl })
+      );
+    },
+    async confirmInstallApp(params) {
+      const resp = await client.confirmInstallApp(
+        create2(ConfirmInstallAppRequestSchema, {
+          installTicket: params.installTicket,
+          sourceMappings: params.sourceMappings ?? {},
+          sinkMappings: params.sinkMappings ?? {},
+          settings: params.settings,
+          placementFieldChoices: params.placementFieldChoices ?? {}
+        })
+      );
+      return resp.app;
+    },
+    async updateApp(tenantId, projectId, name) {
+      return client.updateApp(
+        create2(UpdateAppRequestSchema, { tenantId, projectId, name })
+      );
+    },
+    async confirmUpdateApp(tenantId, projectId, name, newManifestHash) {
+      const resp = await client.confirmUpdateApp(
+        create2(ConfirmUpdateAppRequestSchema, {
+          tenantId,
+          projectId,
+          name,
+          newManifestHash
+        })
+      );
+      return resp.app;
+    },
+    async uninstallApp(tenantId, projectId, name, force = false) {
+      return client.uninstallApp(
+        create2(UninstallAppRequestSchema, { tenantId, projectId, name, force })
+      );
+    },
+    async setAppMapping(params) {
+      const resp = await client.setAppMapping(
+        create2(SetAppMappingRequestSchema, {
+          tenantId: params.tenantId,
+          projectId: params.projectId,
+          name: params.name,
+          sourceMappings: params.sourceMappings ?? {},
+          sinkMappings: params.sinkMappings ?? {},
+          placementFieldChoices: params.placementFieldChoices ?? {}
+        })
+      );
+      return resp.app;
+    },
+    async validateManifestUrl(manifestUrl) {
+      return client.validateManifest(
+        create2(ValidateManifestRequestSchema, {
+          source: { case: "manifestUrl", value: manifestUrl }
+        })
+      );
+    },
+    async validateManifestJson(manifestJson) {
+      return client.validateManifest(
+        create2(ValidateManifestRequestSchema, {
+          source: { case: "manifestJson", value: manifestJson }
+        })
+      );
+    },
+    async triggerOperation(tenantId, projectId, operationKey, input) {
+      const resp = await client.triggerOperation(
+        create2(TriggerOperationRequestSchema, {
+          tenantId,
+          projectId,
+          operationKey,
+          input
+        })
+      );
+      return resp.executionId;
     }
-    out.modelSeed = seed;
-  }
-  return out;
-}
-function extensionConfigToInput(cfg) {
-  const out = {
-    url: cfg.url,
-    placements: cfg.placements.map((p) => {
-      const placement = {
-        target: TARGET_FROM_PROTO[p.target] ?? "record",
-        model: p.model,
-        tab: p.tab,
-        title: p.title
-      };
-      if (p.hints && Object.keys(p.hints).length > 0) {
-        placement.hints = p.hints;
-      }
-      return placement;
-    })
   };
-  if (cfg.metadata && Object.keys(cfg.metadata).length > 0) {
-    out.metadata = cfg.metadata;
-  }
-  return out;
 }
 
 // src/lib/rpc/models.ts
@@ -3219,9 +3205,7 @@ function createCronSchedulesMethods(client) {
           cron: params.cron,
           timezone: params.timezone,
           operationKey: params.operationKey,
-          configId: params.configId,
-          targetType: params.targetType,
-          targetConfig: params.targetConfig
+          configId: params.configId
         })
       );
       return resp.schedule ?? null;
@@ -3326,9 +3310,7 @@ async function createPlatformClient(options) {
     cronSchedules: createCronSchedulesMethods(
       createRpcClient(SchedulesService2, transport)
     ),
-    integrations: createIntegrationsMethods(
-      createRpcClient(IntegrationsService2, transport)
-    )
+    apps: createAppsMethods(createRpcClient(AppsService2, transport))
   };
 }
 function createPlatformClientWithHeaders(apiUrl, headers) {
@@ -3364,9 +3346,7 @@ function createPlatformClientWithHeaders(apiUrl, headers) {
     cronSchedules: createCronSchedulesMethods(
       createRpcClient(SchedulesService2, transport)
     ),
-    integrations: createIntegrationsMethods(
-      createRpcClient(IntegrationsService2, transport)
-    )
+    apps: createAppsMethods(createRpcClient(AppsService2, transport))
   };
 }
 async function getStorageAuth(options) {
@@ -3648,6 +3628,9 @@ function success(message, data) {
   }
   console.log(chalk2.green(`\u2713 ${interpolated}`));
 }
+function warn(message) {
+  console.log(chalk2.yellow(`\u26A0 ${message}`));
+}
 
 // src/commands/whoami.ts
 function registerWhoamiCommand(program2, globalOpts) {
@@ -4890,7 +4873,8 @@ async function reconcileConfig(client, configId, manifest, options = {}) {
     authProviders: zeroCounts(),
     placementsUpdated: false,
     profileSchemaUpdated: false,
-    apiKeys: []
+    apiKeys: [],
+    apps: zeroCounts()
   };
   const operationBaseUrl = manifest.operationBaseUrl ?? "";
   await reconcileModels(client, configId, manifest.models ?? [], summary);
@@ -4908,6 +4892,13 @@ async function reconcileConfig(client, configId, manifest, options = {}) {
     summary,
     options.rotateKeys ?? false
   );
+  await reconcileApps(
+    client,
+    options.tenantId,
+    options.projectId,
+    manifest.apps ?? {},
+    summary
+  );
   return summary;
 }
 async function reconcileModels(client, configId, models, summary) {
@@ -5309,274 +5300,110 @@ async function reconcileApiKeys(client, configKey, apiKeys, summary, rotateKeys)
     }
   }
 }
-
-// src/lib/validate-integrations.ts
-import { fromJson as fromJson3 } from "@bufbuild/protobuf";
-import { pathToString } from "@bufbuild/protobuf/reflect";
-import { createValidator } from "@bufbuild/protovalidate";
-import {
-  IntegrationConfigSchema,
-  ExtensionConfigSchema
-} from "@eide/foir-proto-ts/integrations/v1/integrations_pb";
-var IntegrationValidationError = class extends Error {
-  errors;
-  constructor(errors) {
-    super(
-      `foir.config.ts failed validation:
-${errors.map((e) => `  - ${e}`).join("\n")}`
+async function reconcileApps(client, tenantId, projectId, apps, summary) {
+  const entries = Object.entries(apps);
+  if (entries.length === 0) return;
+  if (!tenantId || !projectId) {
+    console.warn(
+      "Warning: apps declared in foir.config.ts but tenant/project context not supplied; skipping apps reconcile."
     );
-    this.name = "IntegrationValidationError";
-    this.errors = errors;
-  }
-};
-var validator = createValidator();
-function validateIntegrationsAndExtensions(manifest) {
-  const errors = [];
-  const warnings = [];
-  const modelsByKey = /* @__PURE__ */ new Map();
-  for (const model of manifest.models ?? []) {
-    modelsByKey.set(model.key, model);
+    return;
   }
-  if (manifest.integrations) {
-    for (const [name, integration] of Object.entries(manifest.integrations)) {
-      validateIntegration(name, integration, modelsByKey, errors, warnings);
+  const existingList = await client.apps.listApps(tenantId, projectId);
+  const existingByName = new Map(existingList.map((a) => [a.name, a]));
+  for (const [name, input] of entries) {
+    const existing = existingByName.get(name);
+    if (!existing) {
+      await installApp(client, tenantId, projectId, name, input);
+      summary.apps.created += 1;
+      continue;
     }
-  }
-  if (manifest.extensions) {
-    for (const [name, extension] of Object.entries(manifest.extensions)) {
-      validateExtension(name, extension, modelsByKey, errors);
+    if (existing.manifestUrl !== input.source) {
+      console.warn(
+        `Warning: app "${name}" installed from ${existing.manifestUrl} but config declares ${input.source}; skipping. Uninstall explicitly (\`foir apps uninstall ${name}\`) and re-push to change sources.`
+      );
+      continue;
     }
-  }
-  return { errors, warnings };
-}
-function assertValid(result) {
-  if (result.errors.length > 0) {
-    throw new IntegrationValidationError(result.errors);
-  }
-}
-function validateIntegration(name, integration, modelsByKey, errors, warnings) {
-  const prefix = `integration '${name}'`;
-  const protoJson = toIntegrationProtoJson(name, integration);
-  const structuralErrors = runProtoValidation(
-    prefix,
-    protoJson,
-    (json) => fromJson3(IntegrationConfigSchema, json, { ignoreUnknownFields: true })
-  );
-  errors.push(...structuralErrors);
-  const sync = integration.sync ?? {};
-  for (const [sourceType, mapping] of Object.entries(sync)) {
-    validateSyncMapping(
-      `${prefix} sync.${sourceType}`,
-      mapping,
+    await client.apps.setAppMapping({
+      tenantId,
+      projectId,
       name,
-      modelsByKey,
-      errors,
-      warnings
-    );
+      sourceMappings: toSourceMappings(input.mappings?.sources ?? {}),
+      sinkMappings: toSinkMappings(input.mappings?.sinks ?? {}),
+      placementFieldChoices: toPlacementFieldChoices(
+        input.mappings?.placementFields ?? {}
+      )
+    });
+    summary.apps.updated += 1;
   }
 }
-function validateSyncMapping(prefix, mapping, integrationName, modelsByKey, errors, warnings) {
-  const model = mapping.model ? modelsByKey.get(mapping.model) : void 0;
-  const seed = mapping.modelSeed;
-  if (!mapping.model) {
-    return;
-  }
-  if (!model && !seed) {
-    errors.push(
-      `${prefix}: missing model '${mapping.model}' referenced by integration '${integrationName}' \u2014 declare it under models or provide a modelSeed`
-    );
-    return;
-  }
-  const fieldKeys = model ? new Set((model.fields ?? []).map((f) => f.key)) : new Set(Object.keys(seed?.fields ?? {}));
-  if (mapping.naturalKey && !fieldKeys.has(mapping.naturalKey)) {
-    errors.push(
-      `${prefix}: naturalKey '${mapping.naturalKey}' does not exist on ${model ? `model '${mapping.model}'` : `modelSeed for '${mapping.model}'`}`
+async function installApp(client, tenantId, projectId, name, input) {
+  const installResp = await client.apps.installApp(
+    tenantId,
+    projectId,
+    input.source
+  );
+  const previewName = installResp.preview?.manifest?.name ?? name;
+  if (previewName !== name) {
+    throw new Error(
+      `apps.${name}: manifest declares name "${previewName}"; config key must match the manifest name.`
     );
   }
-  const fields = mapping.fields ?? {};
-  for (const [sourceField, foirField] of Object.entries(fields)) {
-    if (!foirField) continue;
-    if (!fieldKeys.has(foirField)) {
-      errors.push(
-        `${prefix}: field mapping '${sourceField} -> ${foirField}' references field '${foirField}' which does not exist on ${model ? `model '${mapping.model}'` : `modelSeed for '${mapping.model}'`}`
-      );
-    }
-  }
-  if (seed && model) {
-    detectSeedDrift(prefix, seed, model, warnings);
+  const missing = [];
+  for (const needed of installResp.preview?.sourceTypesToMap ?? []) {
+    if (!(input.mappings?.sources ?? {})[needed]) missing.push(`source ${needed}`);
   }
-}
-function detectSeedDrift(prefix, seed, model, warnings) {
-  const modelFieldTypes = /* @__PURE__ */ new Map();
-  for (const field of model.fields ?? []) {
-    modelFieldTypes.set(field.key, field.type);
+  for (const needed of installResp.preview?.sinkContractsToMap ?? []) {
+    if (!(input.mappings?.sinks ?? {})[needed]) missing.push(`sink ${needed}`);
   }
-  for (const [key, field] of Object.entries(seed.fields ?? {})) {
-    const modelType = modelFieldTypes.get(key);
-    if (!modelType) {
-      warnings.push(
-        `${prefix}: modelSeed.fields.${key} is not present on existing model \u2014 modelSeed is ignored on subsequent pushes`
-      );
-    } else if (field.type && modelType !== field.type) {
-      warnings.push(
-        `${prefix}: modelSeed.fields.${key}.type '${field.type}' disagrees with existing model field type '${modelType}' \u2014 modelSeed is ignored on subsequent pushes`
-      );
+  for (const needed of installResp.preview?.placementsRequiringFieldChoice ?? []) {
+    if (!(input.mappings?.placementFields ?? {})[needed]) {
+      missing.push(`placement-field ${needed}`);
     }
   }
-}
-function validateExtension(name, extension, modelsByKey, errors) {
-  const prefix = `extension '${name}'`;
-  const protoJson = toExtensionProtoJson(name, extension);
-  const structuralErrors = runProtoValidation(
-    prefix,
-    protoJson,
-    (json) => fromJson3(ExtensionConfigSchema, json, { ignoreUnknownFields: true })
-  );
-  errors.push(...structuralErrors);
-  const placements = extension.placements ?? [];
-  placements.forEach((placement, index) => {
-    if (placement.model && !modelsByKey.has(placement.model)) {
-      errors.push(
-        `${prefix} placements[${index}]: missing model '${placement.model}' referenced by extension '${name}'`
-      );
-    }
-  });
-}
-function runProtoValidation(prefix, json, decode) {
-  let message;
-  try {
-    message = decode(json);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return [`${prefix}: cannot decode as proto \u2014 ${msg}`];
-  }
-  const result = runValidate(message);
-  if (result.kind === "valid") return [];
-  if (result.kind === "error") {
-    return [`${prefix}: validator error \u2014 ${result.error.message}`];
-  }
-  return result.violations.map((v) => `${prefix}: ${formatViolation(v)}`);
-}
-function runValidate(message) {
-  if (!message || typeof message !== "object") {
-    return { kind: "error", error: new Error("message is not an object") };
-  }
-  const anyMsg = message;
-  let schema;
-  if (anyMsg.$typeName === "integrations.v1.IntegrationConfig") {
-    schema = IntegrationConfigSchema;
-  } else if (anyMsg.$typeName === "integrations.v1.ExtensionConfig") {
-    schema = ExtensionConfigSchema;
-  } else {
-    return { kind: "error", error: new Error(`unknown message type ${anyMsg.$typeName ?? "?"}`) };
-  }
-  const result = validator.validate(
-    // Both schema/message casts are safe because we picked schema by $typeName.
-    schema,
-    message
-  );
-  if (result.kind === "valid") return { kind: "valid" };
-  if (result.kind === "error") return { kind: "error", error: result.error };
-  return { kind: "invalid", violations: result.violations };
-}
-function formatViolation(v) {
-  let path3 = "";
-  try {
-    path3 = pathToString(v.field);
-  } catch {
-    path3 = "";
+  if (missing.length > 0) {
+    throw new Error(
+      `apps.${name}: missing mappings in foir.config.ts: ${missing.join(", ")}`
+    );
   }
-  const message = v.message ?? "";
-  return path3 ? `${path3}: ${message}` : message;
+  await client.apps.confirmInstallApp({
+    installTicket: installResp.installTicket,
+    sourceMappings: toSourceMappings(input.mappings?.sources ?? {}),
+    sinkMappings: toSinkMappings(input.mappings?.sinks ?? {}),
+    settings: input.settings,
+    placementFieldChoices: toPlacementFieldChoices(
+      input.mappings?.placementFields ?? {}
+    )
+  });
 }
-function compact(obj) {
+function toSourceMappings(input) {
   const out = {};
-  for (const [k, v] of Object.entries(obj)) {
-    if (v !== void 0) out[k] = v;
+  for (const [k, v] of Object.entries(input)) {
+    out[k] = {
+      toModel: v.toModel,
+      naturalKey: v.naturalKey,
+      fields: v.fields
+    };
   }
   return out;
 }
-function toIntegrationProtoJson(name, integration) {
-  return compact({
-    name,
-    enabled: integration.enabled ?? true,
-    middleware: integration.middleware ? { url: integration.middleware.url ?? "" } : void 0,
-    credentials: {
-      strategy: integration.credentials?.strategy ? credentialStrategyToProto(integration.credentials.strategy) : "CREDENTIAL_STRATEGY_UNSPECIFIED"
-    },
-    sync: integration.sync ? Object.fromEntries(
-      Object.entries(integration.sync).map(([k, v]) => [k, syncMappingToProto(v)])
-    ) : {},
-    settings: integration.settings,
-    metadata: integration.metadata
-  });
-}
-function syncMappingToProto(mapping) {
-  return compact({
-    model: mapping.model ?? "",
-    naturalKey: mapping.naturalKey ?? "",
-    fields: mapping.fields ?? {},
-    modelSeed: mapping.modelSeed ? {
-      fields: Object.fromEntries(
-        Object.entries(mapping.modelSeed.fields ?? {}).map(([k, v]) => [
-          k,
-          compact({
-            type: v.type ?? "",
-            required: v.required ?? false,
-            naturalKey: v.naturalKey ?? false,
-            label: v.label,
-            helpText: v.helpText,
-            config: v.config
-          })
-        ])
-      )
-    } : void 0
-  });
-}
-function credentialStrategyToProto(strategy) {
-  switch (strategy) {
-    case "oauth":
-      return "CREDENTIAL_STRATEGY_OAUTH";
-    case "api_key":
-      return "CREDENTIAL_STRATEGY_API_KEY";
-    case "shared_secret":
-      return "CREDENTIAL_STRATEGY_SHARED_SECRET";
-    case "ssh_key":
-      return "CREDENTIAL_STRATEGY_SSH_KEY";
-    case "none":
-      return "CREDENTIAL_STRATEGY_NONE";
-    case "managed":
-      return "CREDENTIAL_STRATEGY_MANAGED";
-    default:
-      return "CREDENTIAL_STRATEGY_UNSPECIFIED";
+function toSinkMappings(input) {
+  const out = {};
+  for (const [k, v] of Object.entries(input)) {
+    out[k] = {
+      toModel: v.toModel,
+      naturalKey: v.naturalKey,
+      fields: v.fields
+    };
   }
+  return out;
 }
-function toExtensionProtoJson(name, extension) {
-  const placements = (extension.placements ?? []).map(
-    (p) => compact({
-      target: extensionTargetToProto(p.target),
-      model: p.model ?? "",
-      tab: p.tab ?? "",
-      title: p.title ?? "",
-      hints: p.hints
-    })
-  );
-  return compact({
-    name,
-    url: extension.url ?? "",
-    placements,
-    metadata: extension.metadata
-  });
-}
-function extensionTargetToProto(target) {
-  switch (target) {
-    case "record":
-      return "EXTENSION_TARGET_RECORD";
-    case "model-list":
-      return "EXTENSION_TARGET_MODEL_LIST";
-    default:
-      return "EXTENSION_TARGET_UNSPECIFIED";
+function toPlacementFieldChoices(input) {
+  const out = {};
+  for (const [k, v] of Object.entries(input)) {
+    out[k] = { model: v.model, field: v.field };
   }
+  return out;
 }
 
 // src/commands/push.ts
@@ -5660,12 +5487,9 @@ function registerPushCommand(program2, globalOpts) {
             'Config must have at least "key" and "name" fields.'
           );
         }
-        const validation = validateIntegrationsAndExtensions(config2);
-        for (const warning of validation.warnings) {
-          console.log(chalk6.yellow(`\u26A0 ${warning}`));
-        }
-        assertValid(validation);
-        const client = await createPlatformClient(globalOpts());
+        const gOpts = globalOpts();
+        const client = await createPlatformClient(gOpts);
+        const resolved = await resolveProjectContext(gOpts);
         console.log(
           chalk6.dim(`Pushing config "${config2.key}" to platform...`)
         );
@@ -5681,7 +5505,9 @@ function registerPushCommand(program2, globalOpts) {
         const configId = applyResult.id;
         console.log(chalk6.dim("Reconciling resources..."));
         const summary = await reconcileConfig(client, configId, config2, {
-          rotateKeys: opts.rotateKeys ?? false
+          rotateKeys: opts.rotateKeys ?? false,
+          tenantId: resolved?.project.tenantId,
+          projectId: resolved?.project.id
         });
         console.log();
         console.log(chalk6.green("\u2713 Config applied successfully"));
@@ -5787,28 +5613,20 @@ function registerPullCommand(program2, globalOpts) {
           );
         }
         const resolved = await resolveProjectContext(globalOpts());
-        let integrations;
-        let extensions;
+        let apps;
         if (resolved) {
           const projectId = resolved.project.id;
-          const protoIntegrations = await client.integrations.listIntegrations(projectId);
-          if (protoIntegrations.length > 0) {
-            integrations = {};
-            for (const cfg of protoIntegrations) {
-              integrations[cfg.name] = integrationConfigToInput(cfg);
-            }
-          }
-          const protoExtensions = await client.integrations.listExtensions(projectId);
-          if (protoExtensions.length > 0) {
-            extensions = {};
-            for (const cfg of protoExtensions) {
-              extensions[cfg.name] = extensionConfigToInput(cfg);
+          const tenantId = resolved.project.tenantId;
+          const installedApps = await client.apps.listApps(tenantId, projectId);
+          if (installedApps.length > 0) {
+            apps = {};
+            for (const a of installedApps) {
+              apps[a.name] = appToInput(a);
             }
           }
         }
         const configDataNoInteg = { ...configData };
-        delete configDataNoInteg.integrations;
-        delete configDataNoInteg.extensions;
+        delete configDataNoInteg.apps;
         const manifest = {
           key: config2.key,
           name: config2.name,
@@ -5817,8 +5635,7 @@ function registerPullCommand(program2, globalOpts) {
           ...config2.description ? { description: config2.description } : {},
           ...config2.connectionDomain ? { operationBaseUrl: config2.connectionDomain } : {},
           ...configDataNoInteg,
-          ...integrations ? { integrations } : {},
-          ...extensions ? { extensions } : {}
+          ...apps ? { apps } : {}
         };
         delete manifest.force;
         const jsonContent = JSON.stringify(manifest, null, 2);
@@ -5865,11 +5682,8 @@ export default defineConfig(${jsonContent});
         if (schedules.length > 0) parts.push(`${schedules.length} schedule(s)`);
         if (authProviders.length > 0) parts.push(`${authProviders.length} auth provider(s)`);
         if (configData.customerProfileSchema) parts.push("customer profile schema");
-        if (integrations && Object.keys(integrations).length > 0) {
-          parts.push(`${Object.keys(integrations).length} integration(s)`);
-        }
-        if (extensions && Object.keys(extensions).length > 0) {
-          parts.push(`${Object.keys(extensions).length} extension(s)`);
+        if (apps) {
+          parts.push(`${Object.keys(apps).length} app(s)`);
         }
         if (parts.length > 0) {
           console.log(chalk7.dim(`  Contains: ${parts.join(", ")}`));
@@ -5878,6 +5692,25 @@ export default defineConfig(${jsonContent});
     )
   );
 }
+function appToInput(a) {
+  const mappingsBlob = a.mappings ?? {};
+  const out = { source: a.manifestUrl };
+  const settingsObj = a.settings;
+  if (settingsObj && Object.keys(settingsObj).length > 0) {
+    out.settings = settingsObj;
+  }
+  const sources = mappingsBlob.sources;
+  const sinks = mappingsBlob.sinks;
+  const placementFields = mappingsBlob.placement_fields;
+  if (sources && Object.keys(sources).length > 0 || sinks && Object.keys(sinks).length > 0 || placementFields && Object.keys(placementFields).length > 0) {
+    out.mappings = {
+      ...sources ? { sources } : {},
+      ...sinks ? { sinks } : {},
+      ...placementFields ? { placementFields } : {}
+    };
+  }
+  return out;
+}
 
 // src/commands/remove.ts
 import chalk8 from "chalk";
@@ -8185,7 +8018,7 @@ function registerNotificationsCommands(program2, globalOpts) {
 
 // src/commands/configs.ts
 function registerConfigsCommands(program2, globalOpts) {
-  const configs = program2.command("configs").description("Manage configs (integrations, extensions, webhooks)");
+  const configs = program2.command("configs").description("Manage configs (apps, webhooks)");
   configs.command("list").description("List configs").option("--type <type>", "Filter by config type").option("--enabled", "Only enabled configs").option("--limit <n>", "Max results", "50").action(
     withErrorHandler(globalOpts, async (cmdOpts) => {
       const opts = globalOpts();
@@ -8253,6 +8086,260 @@ function registerConfigsCommands(program2, globalOpts) {
   );
 }
 
+// src/commands/apps.ts
+function registerAppsCommands(program2, globalOpts) {
+  const apps = program2.command("apps").description("Install and manage apps");
+  apps.command("list").description("List installed apps").action(
+    withErrorHandler(globalOpts, async () => {
+      const opts = globalOpts();
+      const resolved = await requireProject(opts);
+      const client = await createPlatformClient(opts);
+      const apps2 = await client.apps.listApps(
+        resolved.project.tenantId,
+        resolved.project.id
+      );
+      formatList(apps2, opts, {
+        columns: [
+          { key: "name", header: "Name", width: 24 },
+          {
+            key: "manifest",
+            header: "Version",
+            width: 10,
+            format: (v) => v?.version ?? ""
+          },
+          { key: "manifestUrl", header: "Manifest URL", width: 40 },
+          {
+            key: "installedAt",
+            header: "Installed",
+            width: 12,
+            format: (v) => {
+              const ts = v;
+              if (!ts?.seconds) return "";
+              return new Date(Number(ts.seconds) * 1e3).toLocaleDateString();
+            }
+          }
+        ]
+      });
+    })
+  );
+  apps.command("get <name>").description("Get an installed app by name").action(
+    withErrorHandler(globalOpts, async (name) => {
+      const opts = globalOpts();
+      const resolved = await requireProject(opts);
+      const client = await createPlatformClient(opts);
+      const app = await client.apps.getApp(
+        resolved.project.tenantId,
+        resolved.project.id,
+        name
+      );
+      if (!app) throw new Error(`App "${name}" not installed.`);
+      formatOutput(app, opts);
+    })
+  );
+  apps.command("install <manifestUrl>").description("Install an app from a manifest URL").option(
+    "--source-map <json>",
+    `Inline source-type mappings as JSON, e.g. '{"product":{"toModel":"product","naturalKey":"handle","fields":{"title":"title"}}}'`
+  ).option(
+    "--sink-map <json>",
+    "Inline sink-contract mappings as JSON"
+  ).option(
+    "--field-map <json>",
+    "Inline placement field choices as JSON, keyed by placement key"
+  ).action(
+    withErrorHandler(
+      globalOpts,
+      async (manifestUrl, cmdOpts) => {
+        const opts = globalOpts();
+        const resolved = await requireProject(opts);
+        const client = await createPlatformClient(opts);
+        const installResp = await client.apps.installApp(
+          resolved.project.tenantId,
+          resolved.project.id,
+          manifestUrl
+        );
+        if (!opts.json && !opts.quiet) {
+          const preview = installResp.preview;
+          console.error(
+            `preview: ${preview?.operationsToCreate.length ?? 0} ops, ${preview?.hooksToCreate.length ?? 0} hooks, ${preview?.placementsToCreate.length ?? 0} placements`
+          );
+          const sourcesNeeded = preview?.sourceTypesToMap ?? [];
+          const sinksNeeded = preview?.sinkContractsToMap ?? [];
+          const fieldsNeeded = preview?.placementsRequiringFieldChoice ?? [];
+          if (sourcesNeeded.length) {
+            console.error(
+              `source mappings required for: ${sourcesNeeded.join(", ")}`
+            );
+          }
+          if (sinksNeeded.length) {
+            console.error(
+              `sink mappings required for: ${sinksNeeded.join(", ")}`
+            );
+          }
+          if (fieldsNeeded.length) {
+            console.error(
+              `placement field choices required for: ${fieldsNeeded.join(", ")}`
+            );
+          }
+        }
+        const sourceMappings = parseJsonOpt(cmdOpts.sourceMap, "source-map");
+        const sinkMappings = parseJsonOpt(cmdOpts.sinkMap, "sink-map");
+        const placementFieldChoices = parseJsonOpt(
+          cmdOpts.fieldMap,
+          "field-map"
+        );
+        const app = await client.apps.confirmInstallApp({
+          installTicket: installResp.installTicket,
+          sourceMappings,
+          sinkMappings,
+          placementFieldChoices
+        });
+        if (opts.json) {
+          formatOutput(app, opts);
+        } else {
+          success(`Installed ${app?.name ?? ""}`);
+        }
+      }
+    )
+  );
+  apps.command("update <name>").description("Check for updates and apply if no rejected changes").option("--dry-run", "Show the diff without applying").action(
+    withErrorHandler(
+      globalOpts,
+      async (name, cmdOpts) => {
+        const opts = globalOpts();
+        const resolved = await requireProject(opts);
+        const client = await createPlatformClient(opts);
+        const updateResp = await client.apps.updateApp(
+          resolved.project.tenantId,
+          resolved.project.id,
+          name
+        );
+        if (updateResp.noChanges) {
+          if (!opts.quiet) success("no changes");
+          return;
+        }
+        if (!opts.json && !opts.quiet) {
+          for (const change of updateResp.changes) {
+            const classLabel = classToLabel(change.class);
+            console.error(`[${classLabel}] ${change.path}: ${change.description}`);
+          }
+        }
+        const hasRejected = updateResp.changes.some((c) => c.class === 3);
+        if (hasRejected) {
+          throw new Error(
+            "update rejected: one or more changes require admin resolution; see diff above"
+          );
+        }
+        if (cmdOpts.dryRun) return;
+        const app = await client.apps.confirmUpdateApp(
+          resolved.project.tenantId,
+          resolved.project.id,
+          name,
+          updateResp.newManifestHash
+        );
+        if (opts.json) {
+          formatOutput(app, opts);
+        } else {
+          success(`Updated ${name}`);
+        }
+      }
+    )
+  );
+  apps.command("uninstall <name>").description("Uninstall an app (runs __uninstall if declared)").option("--force", "Skip middleware __uninstall call; remove platform state regardless").action(
+    withErrorHandler(
+      globalOpts,
+      async (name, cmdOpts) => {
+        const opts = globalOpts();
+        const resolved = await requireProject(opts);
+        const client = await createPlatformClient(opts);
+        const resp = await client.apps.uninstallApp(
+          resolved.project.tenantId,
+          resolved.project.id,
+          name,
+          !!cmdOpts.force
+        );
+        if (!opts.quiet) {
+          if (resp.forced) warn(`force-uninstalled ${name} (external resources may be orphaned)`);
+          else success(`uninstalled ${name}`);
+        }
+      }
+    )
+  );
+  apps.command("trigger <appName> <operationKey>").description(
+    "Trigger an operation on an installed app. operationKey is the bare manifest key (the namespaced form is built for you)."
+  ).option("-d, --data <json>", "Input data as JSON").action(
+    withErrorHandler(
+      globalOpts,
+      async (appName, operationKey, cmdOpts) => {
+        const opts = globalOpts();
+        const resolved = await requireProject(opts);
+        const client = await createPlatformClient(opts);
+        const stored = operationKey.includes("/") ? operationKey : `${appName}/${operationKey}`;
+        const input = cmdOpts.data ? JSON.parse(String(cmdOpts.data)) : void 0;
+        const executionId = await client.apps.triggerOperation(
+          resolved.project.tenantId,
+          resolved.project.id,
+          stored,
+          input
+        );
+        if (opts.json) {
+          formatOutput({ executionId }, opts);
+        } else {
+          success(`triggered ${stored}`, { executionId });
+        }
+      }
+    )
+  );
+  apps.command("validate <manifestUrl>").description("Dry-run a manifest URL against the validator; prints any issues").action(
+    withErrorHandler(globalOpts, async (manifestUrl) => {
+      const opts = globalOpts();
+      const client = await createPlatformClient(opts);
+      const resp = await client.apps.validateManifestUrl(manifestUrl);
+      if (opts.json) {
+        formatOutput(resp, opts);
+        return;
+      }
+      if (resp.ok) {
+        success("manifest validates cleanly");
+        return;
+      }
+      for (const iss of resp.issues) {
+        const sev = iss.severity === 1 ? "error" : "warning";
+        console.error(`[${sev}] ${iss.path}: ${iss.message}`);
+      }
+      throw new Error(`manifest has ${resp.issues.length} issue(s)`);
+    })
+  );
+}
+async function requireProject(opts) {
+  const resolved = await resolveProjectContext(opts);
+  if (!resolved) {
+    throw new Error(
+      "No project selected. Run `foir select-project` or set FOIR_PROJECT."
+    );
+  }
+  return resolved;
+}
+function parseJsonOpt(value, flag) {
+  if (!value) return void 0;
+  try {
+    return JSON.parse(String(value));
+  } catch (err) {
+    throw new Error(`--${flag} is not valid JSON: ${err.message}`);
+  }
+}
+function classToLabel(n) {
+  switch (n) {
+    case 1:
+      return "safe";
+    case 2:
+      return "confirm";
+    case 3:
+      return "REJECTED";
+    default:
+      return "?";
+  }
+}
+
 // src/cli.ts
 var __filename = fileURLToPath(import.meta.url);
 var __dirname = dirname4(__filename);
@@ -8301,4 +8388,5 @@ registerFilesCommands(program, getGlobalOpts);
 registerNotesCommands(program, getGlobalOpts);
 registerNotificationsCommands(program, getGlobalOpts);
 registerConfigsCommands(program, getGlobalOpts);
+registerAppsCommands(program, getGlobalOpts);
 program.parse();

package/dist/lib/config-helpers.d.ts

@@ -211,57 +211,46 @@ interface ApplyConfigApiKeyInput {
     /** Restrict file uploads to specific MIME types (e.g. ["image/*", "video/*"]). */
     allowedFileTypes?: string[];
 }
-type CredentialStrategy = 'oauth' | 'api_key' | 'shared_secret' | 'ssh_key' | 'none' | 'managed';
-interface IntegrationMiddlewareInput {
-    /** Full https URL of the middleware handling this integration. */
-    url: string;
-}
-interface IntegrationCredentialsInput {
-    strategy: CredentialStrategy;
-}
-interface ModelSeedFieldInput {
-    type: string;
-    required?: boolean;
-    naturalKey?: boolean;
-    label?: string;
-    helpText?: string;
-    config?: Record<string, unknown>;
-}
-interface ModelSeedInput {
-    fields: Record<string, ModelSeedFieldInput>;
-}
-interface IntegrationSyncMappingInput {
-    /** foir model key this source type writes into. */
-    model: string;
-    /** foir field holding the upstream natural key. UPSERTs are keyed on this. */
+/**
+ * Source-type mapping entry for an app install. Maps a manifest-declared
+ * source type onto a project model. See docs/platform/apps.md §Mapping step.
+ */
+interface AppSourceMappingInput {
+    toModel: string;
     naturalKey: string;
-    /** Explicit source field -> foir field mapping. */
     fields: Record<string, string>;
-    /** Optional one-time bootstrap schema if the target model is missing. */
-    modelSeed?: ModelSeedInput;
 }
-interface IntegrationInput {
-    enabled?: boolean;
-    middleware: IntegrationMiddlewareInput;
-    credentials: IntegrationCredentialsInput;
-    /** Source type -> sync mapping. Optional when field mapping is managed via the admin UI. */
-    sync?: Record<string, IntegrationSyncMappingInput>;
-    /** Opaque middleware-specific settings — not validated by the CLI. */
-    settings?: Record<string, unknown>;
-    metadata?: Record<string, unknown>;
+/**
+ * Sink-contract mapping entry for an app install.
+ */
+interface AppSinkMappingInput {
+    toModel: string;
+    naturalKey: string;
+    fields: Record<string, string>;
 }
-type ExtensionTarget = 'record' | 'model-list';
-interface ExtensionPlacementInput {
-    target: ExtensionTarget;
+/**
+ * Placement field choice for TARGET_FIELD placements with
+ * field_selected_at_install=true. Keyed by placement.key.
+ */
+interface AppPlacementFieldChoiceInput {
     model: string;
-    tab: string;
-    title: string;
-    hints?: Record<string, unknown>;
+    field: string;
 }
-interface ExtensionInput {
-    url: string;
-    placements: ExtensionPlacementInput[];
-    metadata?: Record<string, unknown>;
+/**
+ * Per-project app installation declared in foir.config.ts under apps.<name>.
+ * Platform state is reconciled against this at `foir push` time; the
+ * manifest is fetched from `source` each push.
+ */
+interface AppInput {
+    /** https URL to the manifest JSON. */
+    source: string;
+    /** Opaque settings forwarded to the app's middleware. */
+    settings?: Record<string, unknown>;
+    mappings?: {
+        sources?: Record<string, AppSourceMappingInput>;
+        sinks?: Record<string, AppSinkMappingInput>;
+        placementFields?: Record<string, AppPlacementFieldChoiceInput>;
+    };
 }
 interface ApplyConfigInput {
     key: string;
@@ -278,16 +267,12 @@ interface ApplyConfigInput {
     authProviders?: ApplyConfigAuthProviderInput[];
     placements?: ApplyConfigPlacementInput[];
     apiKeys?: ApplyConfigApiKeyInput[];
-    /** Per-project integration declarations, keyed by integration name. */
-    integrations?: Record<string, IntegrationInput>;
-    /** Per-project extension declarations, keyed by extension name. */
-    extensions?: Record<string, ExtensionInput>;
+    /** Per-project app declarations, keyed by app name. */
+    apps?: Record<string, AppInput>;
     [key: string]: unknown;
 }
 /** Define a complete config manifest. */
 declare function defineConfig(config: ApplyConfigInput): ApplyConfigInput;
-/** @deprecated Use `defineConfig` instead. */
-declare const defineExtension: typeof defineConfig;
 /** Define a model with type-safe field definitions. */
 declare function defineModel(model: ApplyConfigModelInput): ApplyConfigModelInput;
 /** Define a field with type safety. */
@@ -306,9 +291,5 @@ declare function defineAuthProvider(provider: ApplyConfigAuthProviderInput): App
 declare function defineHook(hook: ApplyConfigHookInput): ApplyConfigHookInput;
 /** Define an editor placement (sidebar or main-editor tab). */
 declare function definePlacement(placement: ApplyConfigPlacementInput): ApplyConfigPlacementInput;
-/** Define an integration declaration. */
-declare function defineIntegration(integration: IntegrationInput): IntegrationInput;
-/** Define an extension declaration. */
-declare function defineExtensionDeclaration(extension: ExtensionInput): ExtensionInput;
 
-export { type ApplyConfigApiKeyInput, type ApplyConfigAuthProviderInput, type ApplyConfigHookInput, type ApplyConfigInput, type ApplyConfigModelInput, type ApplyConfigOperationInput, type ApplyConfigPlacementInput, type ApplyConfigScheduleInput, type ApplyConfigSegmentInput, type CredentialStrategy, type ExpressionPrecondition, type ExtensionInput, type ExtensionPlacementInput, type ExtensionTarget, type FieldDefinitionInput, type IntegrationCredentialsInput, type IntegrationInput, type IntegrationMiddlewareInput, type IntegrationSyncMappingInput, type ModelSeedFieldInput, type ModelSeedInput, type Precondition, type QuotaRule, type SegmentPrecondition, type SelectFieldConfig, type SelectFieldDefinitionInput, defineAuthProvider, defineConfig, defineExtension, defineExtensionDeclaration, defineField, defineHook, defineIntegration, defineModel, defineOperation, definePlacement, defineSchedule, defineSegment, defineSelectField };
+export { type AppInput, type AppPlacementFieldChoiceInput, type AppSinkMappingInput, type AppSourceMappingInput, type ApplyConfigApiKeyInput, type ApplyConfigAuthProviderInput, type ApplyConfigHookInput, type ApplyConfigInput, type ApplyConfigModelInput, type ApplyConfigOperationInput, type ApplyConfigPlacementInput, type ApplyConfigScheduleInput, type ApplyConfigSegmentInput, type ExpressionPrecondition, type FieldDefinitionInput, type Precondition, type QuotaRule, type SegmentPrecondition, type SelectFieldConfig, type SelectFieldDefinitionInput, defineAuthProvider, defineConfig, defineField, defineHook, defineModel, defineOperation, definePlacement, defineSchedule, defineSegment, defineSelectField };

package/dist/lib/config-helpers.js

@@ -2,7 +2,6 @@
 function defineConfig(config) {
   return config;
 }
-var defineExtension = defineConfig;
 function defineModel(model) {
   return model;
 }
@@ -30,20 +29,11 @@ function defineHook(hook) {
 function definePlacement(placement) {
   return placement;
 }
-function defineIntegration(integration) {
-  return integration;
-}
-function defineExtensionDeclaration(extension) {
-  return extension;
-}
 export {
   defineAuthProvider,
   defineConfig,
-  defineExtension,
-  defineExtensionDeclaration,
   defineField,
   defineHook,
-  defineIntegration,
   defineModel,
   defineOperation,
   definePlacement,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eide/foir-cli",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "description": "Universal platform CLI for Foir platform",
   "type": "module",
   "publishConfig": {
@@ -50,7 +50,7 @@
     "@bufbuild/protovalidate": "^1.1.1",
     "@connectrpc/connect": "^2.0.0",
     "@connectrpc/connect-node": "^2.0.0",
-    "@eide/foir-proto-ts": "^0.17.0",
+    "@eide/foir-proto-ts": "^0.23.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "dotenv": "^16.4.5",