@fragno-dev/backoffice-api 0.0.0-stage → 0.0.0

package/dist/v0/apps.d.ts

@@ -0,0 +1,417 @@
+import { BackofficePermissionRequirement } from "./shared/permissions.js";
+import { z } from "zod";
+//#region src/v0/apps.d.ts
+/** App permission declarations and grants are sets; duplicate entries are malformed input. */
+declare const appPermissionsSchema: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+/** App identity is global; an installation refers to the same registry ID. */
+declare const backofficeAppLookupInputSchema: z.ZodLazy<z.ZodObject<{
+  appId: z.ZodString;
+}, z.core.$strict>>;
+type BackofficeAppLookupInput = z.infer<typeof backofficeAppLookupInputSchema>;
+/** Addresses outlive the registration's other fields, so a slug never changes once chosen. */
+declare const appSlugSchema: z.ZodLazy<z.ZodString>;
+/** One operation an app serves on its own server, called through the app's integration connection. */
+declare const appActionSchema: z.ZodLazy<z.ZodObject<{
+  id: z.ZodString;
+  label: z.ZodString;
+  description: z.ZodString;
+  inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+  outputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strict>>;
+type AppAction = z.infer<typeof appActionSchema>;
+/**
+ * What an app lets Backoffice call. Each installation approves one revision of it; with
+ * `changeApproval: "automatic"`, later revisions apply to every installation without approval.
+ */
+declare const appActionsDeclarationSchema: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+  kind: z.ZodLiteral<"none">;
+}, z.core.$strict>, z.ZodObject<{
+  kind: z.ZodLiteral<"endpoint">;
+  endpointUrl: z.ZodURL;
+  changeApproval: z.ZodEnum<{
+    installation: "installation";
+    automatic: "automatic";
+  }>;
+  actions: z.ZodArray<z.ZodLazy<z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
+    description: z.ZodString;
+    inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    outputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+  }, z.core.$strict>>>;
+}, z.core.$strict>], "kind">>;
+type AppActionsDeclaration = z.infer<typeof appActionsDeclarationSchema>;
+/** Backoffice-specific registration data; OAuth metadata remains authoritative in Auth. */
+declare const backofficeAppSchema: z.ZodLazy<z.ZodObject<{
+  id: z.ZodString;
+  slug: z.ZodLazy<z.ZodString>;
+  oauthClientId: z.ZodString;
+  requestedPermissions: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+  actions: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"none">;
+  }, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"endpoint">;
+    endpointUrl: z.ZodURL;
+    changeApproval: z.ZodEnum<{
+      installation: "installation";
+      automatic: "automatic";
+    }>;
+    actions: z.ZodArray<z.ZodLazy<z.ZodObject<{
+      id: z.ZodString;
+      label: z.ZodString;
+      description: z.ZodString;
+      inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+      outputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strict>>>;
+  }, z.core.$strict>], "kind">>;
+  actionsRevision: z.ZodLazy<z.ZodNumber>;
+  createdAt: z.ZodISODateTime;
+}, z.core.$strict>>;
+type BackofficeApp = z.infer<typeof backofficeAppSchema>;
+/**
+ * The owner's resources an installation may act on: everything the owner has, or some of the
+ * projects it owns. Project lists are sets; they are normalized so equal selections compare equal
+ * regardless of order.
+ */
+declare const appInstallationResourceScopeSchema: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+  kind: z.ZodLiteral<"owner">;
+}, z.core.$strict>, z.ZodObject<{
+  kind: z.ZodLiteral<"projects">;
+  projectIds: z.ZodPipe<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>, z.ZodArray<z.ZodString>>;
+}, z.core.$strict>], "kind">>;
+type AppInstallationResourceScope = z.infer<typeof appInstallationResourceScopeSchema>;
+/** What an owner approves: permissions, and the resources they apply to. */
+declare const appInstallationAccessSchema: z.ZodLazy<z.ZodObject<{
+  grantedPermissions: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+  resourceScope: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"owner">;
+  }, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"projects">;
+    projectIds: z.ZodPipe<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>, z.ZodArray<z.ZodString>>;
+  }, z.core.$strict>], "kind">>;
+}, z.core.$strict>>;
+/** An app-side tenant, such as a Bookkeeping organization, claimed by the app's server. */
+declare const appInstallationExternalAccountSchema: z.ZodLazy<z.ZodObject<{
+  id: z.ZodString;
+  label: z.ZodString;
+}, z.core.$strict>>;
+type AppInstallationExternalAccount = z.infer<typeof appInstallationExternalAccountSchema>;
+/** Access changes are explicit control-plane operations and cannot change the owner. */
+declare const backofficeAppInstallationAccessInputSchema: z.ZodLazy<z.ZodObject<{
+  appId: z.ZodString;
+  grantedPermissions: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+  resourceScope: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"owner">;
+  }, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"projects">;
+    projectIds: z.ZodPipe<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>, z.ZodArray<z.ZodString>>;
+  }, z.core.$strict>], "kind">>;
+}, z.core.$strict>>;
+type BackofficeAppInstallationAccessInput = z.infer<typeof backofficeAppInstallationAccessInputSchema>;
+/** Installing approves access and, at the reviewed revision, the app's declared actions. */
+declare const backofficeAppInstallInputSchema: z.ZodLazy<z.ZodObject<{
+  appId: z.ZodString;
+  grantedPermissions: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+  resourceScope: z.ZodDefault<z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"owner">;
+  }, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"projects">;
+    projectIds: z.ZodPipe<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>, z.ZodArray<z.ZodString>>;
+  }, z.core.$strict>], "kind">>>;
+  actionsRevision: z.ZodLazy<z.ZodNumber>;
+}, z.core.$strict>>;
+type BackofficeAppInstallInput = z.output<typeof backofficeAppInstallInputSchema>;
+/** Approval names the reviewed revision, so a declaration changed since review is never approved. */
+declare const backofficeAppInstallationActionsApprovalInputSchema: z.ZodLazy<z.ZodObject<{
+  appId: z.ZodString;
+  actionsRevision: z.ZodLazy<z.ZodNumber>;
+}, z.core.$strict>>;
+type BackofficeAppInstallationActionsApprovalInput = z.infer<typeof backofficeAppInstallationActionsApprovalInputSchema>;
+/** Cursors remain bound to the owner even when each object has its own database. */
+declare const backofficeAppInstallationPageInputSchema: z.ZodLazy<z.ZodObject<{
+  pageSize: z.ZodNumber;
+  cursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>>;
+type BackofficeAppInstallationPageInput = z.infer<typeof backofficeAppInstallationPageInputSchema>;
+/**
+ * Installation authority belongs to its owner, an organization or a person, not to the installing
+ * user: an organization's installation outlives the administrator who approved it.
+ */
+declare const backofficeAppInstallationSchema: z.ZodLazy<z.ZodObject<{
+  id: z.ZodString;
+  appId: z.ZodString;
+  owner: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"org">;
+    orgId: z.ZodString;
+  }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"user">;
+    userId: z.ZodString;
+  }, z.core.$strict>>], "kind">>;
+  grantedPermissions: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+  resourceScope: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"owner">;
+  }, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"projects">;
+    projectIds: z.ZodPipe<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>, z.ZodArray<z.ZodString>>;
+  }, z.core.$strict>], "kind">>;
+  externalAccount: z.ZodNullable<z.ZodLazy<z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
+  }, z.core.$strict>>>;
+  installedByUserId: z.ZodString;
+  status: z.ZodEnum<{
+    active: "active";
+    uninstalled: "uninstalled";
+  }>;
+  activation: z.ZodNumber;
+  approvedActionsRevision: z.ZodNumber;
+  createdAt: z.ZodISODateTime;
+  updatedAt: z.ZodISODateTime;
+}, z.core.$strict>>;
+type BackofficeAppInstallation = z.infer<typeof backofficeAppInstallationSchema>;
+/** Reinstallation preserves the transaction-resolved installation identity. */
+declare const backofficeAppInstallationMutationResultSchema: z.ZodLazy<z.ZodObject<{
+  installationId: z.ZodString;
+  changed: z.ZodBoolean;
+}, z.core.$strict>>;
+type BackofficeAppInstallationMutationResult = z.infer<typeof backofficeAppInstallationMutationResultSchema>;
+/** An owner's installation history includes uninstalled records. */
+declare const backofficeAppInstallationPageSchema: z.ZodLazy<z.ZodObject<{
+  installations: z.ZodArray<z.ZodLazy<z.ZodObject<{
+    id: z.ZodString;
+    appId: z.ZodString;
+    owner: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodLazy<z.ZodObject<{
+      kind: z.ZodLiteral<"org">;
+      orgId: z.ZodString;
+    }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+      kind: z.ZodLiteral<"user">;
+      userId: z.ZodString;
+    }, z.core.$strict>>], "kind">>;
+    grantedPermissions: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+    resourceScope: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+      kind: z.ZodLiteral<"owner">;
+    }, z.core.$strict>, z.ZodObject<{
+      kind: z.ZodLiteral<"projects">;
+      projectIds: z.ZodPipe<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>, z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>], "kind">>;
+    externalAccount: z.ZodNullable<z.ZodLazy<z.ZodObject<{
+      id: z.ZodString;
+      label: z.ZodString;
+    }, z.core.$strict>>>;
+    installedByUserId: z.ZodString;
+    status: z.ZodEnum<{
+      active: "active";
+      uninstalled: "uninstalled";
+    }>;
+    activation: z.ZodNumber;
+    approvedActionsRevision: z.ZodNumber;
+    createdAt: z.ZodISODateTime;
+    updatedAt: z.ZodISODateTime;
+  }, z.core.$strict>>>;
+  nextCursor: z.ZodNullable<z.ZodString>;
+  hasNextPage: z.ZodBoolean;
+}, z.core.$strict>>;
+type BackofficeAppInstallationPage = z.infer<typeof backofficeAppInstallationPageSchema>;
+/**
+ * App operations manage the installations of the scoped owner, an organization or the calling
+ * user's personal scope, as the calling user.
+ */
+declare const appsOperations: {
+  "apps.get": {
+    description: string;
+    permissions: {
+      readonly namespace: "apps";
+      readonly permission: "read";
+    }[];
+    input: z.ZodLazy<z.ZodObject<{
+      appId: z.ZodString;
+    }, z.core.$strict>>;
+    output: z.ZodLazy<z.ZodNullable<z.ZodLazy<z.ZodObject<{
+      id: z.ZodString;
+      slug: z.ZodLazy<z.ZodString>;
+      oauthClientId: z.ZodString;
+      requestedPermissions: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+      actions: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"none">;
+      }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"endpoint">;
+        endpointUrl: z.ZodURL;
+        changeApproval: z.ZodEnum<{
+          installation: "installation";
+          automatic: "automatic";
+        }>;
+        actions: z.ZodArray<z.ZodLazy<z.ZodObject<{
+          id: z.ZodString;
+          label: z.ZodString;
+          description: z.ZodString;
+          inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+          outputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        }, z.core.$strict>>>;
+      }, z.core.$strict>], "kind">>;
+      actionsRevision: z.ZodLazy<z.ZodNumber>;
+      createdAt: z.ZodISODateTime;
+    }, z.core.$strict>>>>;
+  };
+  "apps.install": {
+    description: string;
+    permissions: {
+      readonly namespace: "apps";
+      readonly permission: "manage";
+    }[];
+    input: z.ZodLazy<z.ZodObject<{
+      appId: z.ZodString;
+      grantedPermissions: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+      resourceScope: z.ZodDefault<z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"owner">;
+      }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"projects">;
+        projectIds: z.ZodPipe<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>, z.ZodArray<z.ZodString>>;
+      }, z.core.$strict>], "kind">>>;
+      actionsRevision: z.ZodLazy<z.ZodNumber>;
+    }, z.core.$strict>>;
+    output: z.ZodLazy<z.ZodObject<{
+      installationId: z.ZodString;
+      changed: z.ZodBoolean;
+    }, z.core.$strict>>;
+  };
+  "apps.installations.get": {
+    description: string;
+    permissions: {
+      readonly namespace: "apps";
+      readonly permission: "read";
+    }[];
+    input: z.ZodLazy<z.ZodObject<{
+      appId: z.ZodString;
+    }, z.core.$strict>>;
+    output: z.ZodLazy<z.ZodNullable<z.ZodLazy<z.ZodObject<{
+      id: z.ZodString;
+      appId: z.ZodString;
+      owner: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"org">;
+        orgId: z.ZodString;
+      }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"user">;
+        userId: z.ZodString;
+      }, z.core.$strict>>], "kind">>;
+      grantedPermissions: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+      resourceScope: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"owner">;
+      }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"projects">;
+        projectIds: z.ZodPipe<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>, z.ZodArray<z.ZodString>>;
+      }, z.core.$strict>], "kind">>;
+      externalAccount: z.ZodNullable<z.ZodLazy<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+      }, z.core.$strict>>>;
+      installedByUserId: z.ZodString;
+      status: z.ZodEnum<{
+        active: "active";
+        uninstalled: "uninstalled";
+      }>;
+      activation: z.ZodNumber;
+      approvedActionsRevision: z.ZodNumber;
+      createdAt: z.ZodISODateTime;
+      updatedAt: z.ZodISODateTime;
+    }, z.core.$strict>>>>;
+  };
+  "apps.installations.list": {
+    description: string;
+    permissions: {
+      readonly namespace: "apps";
+      readonly permission: "read";
+    }[];
+    input: z.ZodLazy<z.ZodObject<{
+      pageSize: z.ZodDefault<z.ZodNumber>;
+      cursor: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strict>>;
+    output: z.ZodLazy<z.ZodObject<{
+      installations: z.ZodArray<z.ZodLazy<z.ZodObject<{
+        id: z.ZodString;
+        appId: z.ZodString;
+        owner: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodLazy<z.ZodObject<{
+          kind: z.ZodLiteral<"org">;
+          orgId: z.ZodString;
+        }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+          kind: z.ZodLiteral<"user">;
+          userId: z.ZodString;
+        }, z.core.$strict>>], "kind">>;
+        grantedPermissions: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+        resourceScope: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+          kind: z.ZodLiteral<"owner">;
+        }, z.core.$strict>, z.ZodObject<{
+          kind: z.ZodLiteral<"projects">;
+          projectIds: z.ZodPipe<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>, z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>], "kind">>;
+        externalAccount: z.ZodNullable<z.ZodLazy<z.ZodObject<{
+          id: z.ZodString;
+          label: z.ZodString;
+        }, z.core.$strict>>>;
+        installedByUserId: z.ZodString;
+        status: z.ZodEnum<{
+          active: "active";
+          uninstalled: "uninstalled";
+        }>;
+        activation: z.ZodNumber;
+        approvedActionsRevision: z.ZodNumber;
+        createdAt: z.ZodISODateTime;
+        updatedAt: z.ZodISODateTime;
+      }, z.core.$strict>>>;
+      nextCursor: z.ZodNullable<z.ZodString>;
+      hasNextPage: z.ZodBoolean;
+    }, z.core.$strict>>;
+  };
+  "apps.installations.update": {
+    description: string;
+    permissions: {
+      readonly namespace: "apps";
+      readonly permission: "manage";
+    }[];
+    input: z.ZodLazy<z.ZodObject<{
+      appId: z.ZodString;
+      grantedPermissions: z.ZodLazy<z.ZodArray<z.ZodType<BackofficePermissionRequirement, unknown, z.core.$ZodTypeInternals<BackofficePermissionRequirement, unknown>>>>;
+      resourceScope: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"owner">;
+      }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"projects">;
+        projectIds: z.ZodPipe<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>, z.ZodArray<z.ZodString>>;
+      }, z.core.$strict>], "kind">>;
+    }, z.core.$strict>>;
+    output: z.ZodLazy<z.ZodObject<{
+      installationId: z.ZodString;
+      changed: z.ZodBoolean;
+    }, z.core.$strict>>;
+  };
+  "apps.installations.approveActions": {
+    description: string;
+    permissions: {
+      readonly namespace: "apps";
+      readonly permission: "manage";
+    }[];
+    input: z.ZodLazy<z.ZodObject<{
+      appId: z.ZodString;
+      actionsRevision: z.ZodLazy<z.ZodNumber>;
+    }, z.core.$strict>>;
+    output: z.ZodLazy<z.ZodObject<{
+      installationId: z.ZodString;
+      changed: z.ZodBoolean;
+    }, z.core.$strict>>;
+  };
+  "apps.uninstall": {
+    description: string;
+    permissions: {
+      readonly namespace: "apps";
+      readonly permission: "manage";
+    }[];
+    input: z.ZodLazy<z.ZodObject<{
+      appId: z.ZodString;
+    }, z.core.$strict>>;
+    output: z.ZodLazy<z.ZodObject<{
+      installationId: z.ZodString;
+      changed: z.ZodBoolean;
+    }, z.core.$strict>>;
+  };
+};
+//#endregion
+export { AppAction, AppActionsDeclaration, AppInstallationExternalAccount, AppInstallationResourceScope, BackofficeApp, BackofficeAppInstallInput, BackofficeAppInstallation, BackofficeAppInstallationAccessInput, BackofficeAppInstallationActionsApprovalInput, BackofficeAppInstallationMutationResult, BackofficeAppInstallationPage, BackofficeAppInstallationPageInput, BackofficeAppLookupInput, appActionSchema, appActionsDeclarationSchema, appInstallationAccessSchema, appInstallationExternalAccountSchema, appPermissionsSchema, appSlugSchema, appsOperations, backofficeAppInstallInputSchema, backofficeAppInstallationAccessInputSchema, backofficeAppInstallationActionsApprovalInputSchema, backofficeAppInstallationMutationResultSchema, backofficeAppInstallationPageInputSchema, backofficeAppInstallationPageSchema, backofficeAppInstallationSchema, backofficeAppLookupInputSchema, backofficeAppSchema };
+//# sourceMappingURL=apps.d.ts.map

package/dist/v0/apps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps.d.ts","names":[],"sources":["../../src/v0/apps.ts"],"mappings":";;;;cAQa,sBAAoB,EAAA,QAAA,EAAA,SAAA,EAAA,QAApB,0CAAoB,EAAA,KAAA,kBAAA;;cAYpB,gCAA8B,EAAA,QAAA,EAAA;;;KAG/B,2BAA2B,EAAE,aAAa;;cAGzC,eAAa,EAAA,QAAA,EAAA;;cAgBb,iBAAe,EAAA,QAAA,EAAA;;;;;;;KAqBhB,YAAY,EAAE,aAAa;;;;;cAM1B,6BAA2B,EAAA,QAAA,EAAA,uBAAA,EAAA;;;;;;;;;;;;;;;;;KAgC5B,wBAAwB,EAAE,aAAa;;cAOtC,qBAAmB,EAAA,QAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;KAapB,gBAAgB,EAAE,aAAa;;;;;;cAOrC,oCAAkC,EAAA,QAAA,EAAA,uBAAA,EAAA;;;;;;KAiB5B,+BAA+B,EAAE,aAAa;;cAG7C,6BAA2B,EAAA,QAAA,EAAA;qDAA3B;;;;;;;;;cAQA,sCAAoC,EAAA,QAAA,EAAA;;;;KAMrC,iCAAiC,EAAE,aAAa;;cAG/C,4CAA0C,EAAA,QAAA,EAAA;;;;;;;;;;KAK3C,uCAAuC,EAAE,aAC5C;;cAII,iCAA+B,EAAA,QAAA,EAAA;;;;;;;;;;;KAQhC,4BAA4B,EAAE,cAAc;;cAG3C,qDAAmD,EAAA,QAAA,EAAA;;;;KAOpD,gDAAgD,EAAE,aACrD;;cAII,0CAAwC,EAAA,QAAA,EAAA;;;;KAMzC,qCAAqC,EAAE,aAC1C;;;;;cAOI,iCAA+B,EAAA,QAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA0BhC,4BAA4B,EAAE,aAAa;;cAG1C,+CAA6C,EAAA,QAAA,EAAA;;;;KAQ9C,0CAA0C,EAAE,aAC/C;;cAII,qCAAmC,EAAA,QAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KASpC,gCAAgC,EAAE,aAAa;;;;;cAM9C"}

package/dist/v0/apps.js

@@ -0,0 +1,163 @@
+import { BACKOFFICE_PERMISSION, backofficePermissionRequirementSchema } from "./shared/permissions.js";
+import { backofficeRootOwnerSchema } from "./shared/scope.js";
+import { z } from "zod";
+//#region src/v0/apps.ts
+/** App permission declarations and grants are sets; duplicate entries are malformed input. */
+const appPermissionsSchema = z.lazy(() => z.array(backofficePermissionRequirementSchema).refine((permissions) => new Set(permissions.map(({ namespace, permission }) => `${namespace}.${permission}`)).size === permissions.length, "Backoffice app permissions must not contain duplicates."));
+/** App identity is global; an installation refers to the same registry ID. */
+const backofficeAppLookupInputSchema = z.lazy(() => z.strictObject({ appId: z.string().min(1).max(191) }));
+/** Addresses outlive the registration's other fields, so a slug never changes once chosen. */
+const appSlugSchema = z.lazy(() => z.string().max(63).regex(/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/, "App slugs are lowercase words separated by '-', e.g. bookkeeping.").describe("Unique, permanent name for the app; its integration connection is app#<slug>, e.g. app#bookkeeping."));
+const LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set([
+	"127.0.0.1",
+	"localhost",
+	"[::1]"
+]);
+/** One operation an app serves on its own server, called through the app's integration connection. */
+const appActionSchema = z.lazy(() => z.strictObject({
+	id: z.string().max(100).regex(/^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/, "App action IDs are lowercase words separated by '.', '-', or '_', e.g. invoices.list."),
+	label: z.string().trim().min(1).max(100),
+	description: z.string().trim().min(1).max(1e3),
+	inputSchema: z.record(z.string(), z.unknown()).describe("JSON Schema (2020-12 or draft-07) for the action's object input."),
+	outputSchema: z.record(z.string(), z.unknown()).describe("JSON Schema (2020-12 or draft-07) for the action's result.")
+})).meta({ id: "AppAction" });
+/**
+* What an app lets Backoffice call. Each installation approves one revision of it; with
+* `changeApproval: "automatic"`, later revisions apply to every installation without approval.
+*/
+const appActionsDeclarationSchema = z.lazy(() => z.discriminatedUnion("kind", [z.strictObject({ kind: z.literal("none") }), z.strictObject({
+	kind: z.literal("endpoint"),
+	endpointUrl: z.url({ protocol: /^https?$/ }).refine((url) => url.startsWith("https:") || LOOPBACK_HOSTNAMES.has(new URL(url).hostname), "App action endpoints use HTTPS; plain HTTP is allowed only on loopback for development.").describe("Receives each signed action request as a POST; the request token's audience is this URL."),
+	changeApproval: z.enum(["installation", "automatic"]).describe("installation: each installation approves a changed declaration before new or changed actions run. automatic: changes apply immediately; only administrators register apps, so reserve it for apps they operate."),
+	actions: z.array(appActionSchema).min(1).max(100).refine((actions) => new Set(actions.map(({ id }) => id)).size === actions.length, "App action IDs must be unique.")
+})])).meta({ id: "AppActionsDeclaration" });
+const appActionsRevisionSchema = z.lazy(() => z.number().int().positive().describe("Increments whenever the app's action declaration changes."));
+/** Backoffice-specific registration data; OAuth metadata remains authoritative in Auth. */
+const backofficeAppSchema = z.lazy(() => z.strictObject({
+	id: z.string().min(1),
+	slug: appSlugSchema,
+	oauthClientId: z.string().min(1),
+	requestedPermissions: appPermissionsSchema,
+	actions: appActionsDeclarationSchema,
+	actionsRevision: appActionsRevisionSchema,
+	createdAt: z.iso.datetime()
+})).meta({ id: "BackofficeApp" });
+/**
+* The owner's resources an installation may act on: everything the owner has, or some of the
+* projects it owns. Project lists are sets; they are normalized so equal selections compare equal
+* regardless of order.
+*/
+const appInstallationResourceScopeSchema = z.lazy(() => z.discriminatedUnion("kind", [z.strictObject({ kind: z.literal("owner") }), z.strictObject({
+	kind: z.literal("projects"),
+	projectIds: z.array(z.string().trim().min(1).max(191)).min(1).max(100).transform((projectIds) => [...new Set(projectIds)].sort()).pipe(z.array(z.string()))
+})])).meta({ id: "AppInstallationResourceScope" });
+/** What an owner approves: permissions, and the resources they apply to. */
+const appInstallationAccessSchema = z.lazy(() => z.strictObject({
+	grantedPermissions: appPermissionsSchema,
+	resourceScope: appInstallationResourceScopeSchema
+}));
+/** An app-side tenant, such as a Bookkeeping organization, claimed by the app's server. */
+const appInstallationExternalAccountSchema = z.lazy(() => z.strictObject({
+	id: z.string().trim().min(1).max(191),
+	label: z.string().trim().min(1).max(191)
+}));
+/** Access changes are explicit control-plane operations and cannot change the owner. */
+const backofficeAppInstallationAccessInputSchema = z.lazy(() => backofficeAppLookupInputSchema._zod.innerType.extend(appInstallationAccessSchema._zod.innerType.shape));
+/** Installing approves access and, at the reviewed revision, the app's declared actions. */
+const backofficeAppInstallInputSchema = z.lazy(() => backofficeAppInstallationAccessInputSchema._zod.innerType.extend({
+	resourceScope: appInstallationResourceScopeSchema.default({ kind: "owner" }),
+	actionsRevision: appActionsRevisionSchema.describe("The actionsRevision reviewed with apps.get; installation fails if the declaration changed since.")
+}));
+/** Approval names the reviewed revision, so a declaration changed since review is never approved. */
+const backofficeAppInstallationActionsApprovalInputSchema = z.lazy(() => backofficeAppLookupInputSchema._zod.innerType.extend({ actionsRevision: appActionsRevisionSchema.describe("The actionsRevision reviewed with apps.get; approval fails if the declaration changed since.") }));
+/** Cursors remain bound to the owner even when each object has its own database. */
+const backofficeAppInstallationPageInputSchema = z.lazy(() => z.strictObject({
+	pageSize: z.number().int().min(1).max(100),
+	cursor: z.string().min(1).nullable()
+}));
+/**
+* Installation authority belongs to its owner, an organization or a person, not to the installing
+* user: an organization's installation outlives the administrator who approved it.
+*/
+const backofficeAppInstallationSchema = z.lazy(() => z.strictObject({
+	id: z.string().min(1),
+	appId: z.string().min(1),
+	owner: backofficeRootOwnerSchema,
+	grantedPermissions: appPermissionsSchema,
+	resourceScope: appInstallationResourceScopeSchema,
+	/** Null until the app's server claims the installation for one of its own tenants. */
+	externalAccount: appInstallationExternalAccountSchema.nullable(),
+	installedByUserId: z.string().min(1),
+	status: z.enum(["active", "uninstalled"]),
+	/** Increments on reinstallation; app credentials are bound to the activation that issued them. */
+	activation: z.number().int().positive(),
+	approvedActionsRevision: z.number().int().nonnegative().describe("The app's actionsRevision this installation approved; 0 when it approved no declaration."),
+	createdAt: z.iso.datetime(),
+	updatedAt: z.iso.datetime()
+})).meta({ id: "BackofficeAppInstallation" });
+/** Reinstallation preserves the transaction-resolved installation identity. */
+const backofficeAppInstallationMutationResultSchema = z.lazy(() => z.strictObject({
+	installationId: z.string().min(1),
+	changed: z.boolean()
+})).meta({ id: "BackofficeAppInstallationMutationResult" });
+/** An owner's installation history includes uninstalled records. */
+const backofficeAppInstallationPageSchema = z.lazy(() => z.strictObject({
+	installations: z.array(backofficeAppInstallationSchema),
+	nextCursor: z.string().nullable(),
+	hasNextPage: z.boolean()
+})).meta({ id: "BackofficeAppInstallationPage" });
+/**
+* App operations manage the installations of the scoped owner, an organization or the calling
+* user's personal scope, as the calling user.
+*/
+const appsOperations = {
+	"apps.get": {
+		description: "Review a registered app's requested permissions and declared actions before approving an installation.",
+		permissions: [BACKOFFICE_PERMISSION.apps.read],
+		input: backofficeAppLookupInputSchema,
+		output: z.lazy(() => backofficeAppSchema.nullable())
+	},
+	"apps.install": {
+		description: "Approve an app installation in the selected organization or personal scope, limited to explicit permissions and resources, and approve the app's declared actions at the reviewed revision. Installer identity comes from the authenticated user.",
+		permissions: [BACKOFFICE_PERMISSION.apps.manage],
+		input: backofficeAppInstallInputSchema,
+		output: backofficeAppInstallationMutationResultSchema
+	},
+	"apps.installations.get": {
+		description: "Inspect one app installation in the selected organization or personal scope, including approved grants.",
+		permissions: [BACKOFFICE_PERMISSION.apps.read],
+		input: backofficeAppLookupInputSchema,
+		output: z.lazy(() => backofficeAppInstallationSchema.nullable())
+	},
+	"apps.installations.list": {
+		description: "List the selected organization's or personal scope's active and uninstalled apps using cursor pagination. Does not expose other owners or OAuth credentials.",
+		permissions: [BACKOFFICE_PERMISSION.apps.read],
+		input: z.lazy(() => backofficeAppInstallationPageInputSchema._zod.innerType.extend({
+			pageSize: backofficeAppInstallationPageInputSchema._zod.innerType.shape.pageSize.default(25),
+			cursor: backofficeAppInstallationPageInputSchema._zod.innerType.shape.cursor.default(null)
+		})),
+		output: backofficeAppInstallationPageSchema
+	},
+	"apps.installations.update": {
+		description: "Replace an active installation's approved permissions and resources. Takes effect immediately, including for issued app credentials. Does not change installer attribution.",
+		permissions: [BACKOFFICE_PERMISSION.apps.manage],
+		input: backofficeAppInstallationAccessInputSchema,
+		output: backofficeAppInstallationMutationResultSchema
+	},
+	"apps.installations.approveActions": {
+		description: "Approve an app's current action declaration for the selected owner's installation, so its new and changed actions run. Only needed when the app's changeApproval is installation.",
+		permissions: [BACKOFFICE_PERMISSION.apps.manage],
+		input: backofficeAppInstallationActionsApprovalInputSchema,
+		output: backofficeAppInstallationMutationResultSchema
+	},
+	"apps.uninstall": {
+		description: "Uninstall an app in the selected organization or personal scope, clearing approved grants and its linked account while retaining installation identity. Immediately invalidates app credentials. Does not revoke personal OAuth consent.",
+		permissions: [BACKOFFICE_PERMISSION.apps.manage],
+		input: backofficeAppLookupInputSchema,
+		output: backofficeAppInstallationMutationResultSchema
+	}
+};
+//#endregion
+export { appActionSchema, appActionsDeclarationSchema, appInstallationAccessSchema, appInstallationExternalAccountSchema, appPermissionsSchema, appSlugSchema, appsOperations, backofficeAppInstallInputSchema, backofficeAppInstallationAccessInputSchema, backofficeAppInstallationActionsApprovalInputSchema, backofficeAppInstallationMutationResultSchema, backofficeAppInstallationPageInputSchema, backofficeAppInstallationPageSchema, backofficeAppInstallationSchema, backofficeAppLookupInputSchema, backofficeAppSchema };
+
+//# sourceMappingURL=apps.js.map

package/dist/v0/apps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps.js","names":[],"sources":["../../src/v0/apps.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport type { BackofficeApiOperation } from \"../api\";\nimport { BACKOFFICE_PERMISSION } from \"./shared/permissions\";\nimport { backofficePermissionRequirementSchema } from \"./shared/permissions\";\nimport { backofficeRootOwnerSchema } from \"./shared/scope\";\n\n/** App permission declarations and grants are sets; duplicate entries are malformed input. */\nexport const appPermissionsSchema = z.lazy(() =>\n  z\n    .array(backofficePermissionRequirementSchema)\n    .refine(\n      (permissions) =>\n        new Set(permissions.map(({ namespace, permission }) => `${namespace}.${permission}`))\n          .size === permissions.length,\n      \"Backoffice app permissions must not contain duplicates.\",\n    ),\n);\n\n/** App identity is global; an installation refers to the same registry ID. */\nexport const backofficeAppLookupInputSchema = z.lazy(() =>\n  z.strictObject({ appId: z.string().min(1).max(191) }),\n);\nexport type BackofficeAppLookupInput = z.infer<typeof backofficeAppLookupInputSchema>;\n\n/** Addresses outlive the registration's other fields, so a slug never changes once chosen. */\nexport const appSlugSchema = z.lazy(() =>\n  z\n    .string()\n    .max(63)\n    .regex(\n      /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/,\n      \"App slugs are lowercase words separated by '-', e.g. bookkeeping.\",\n    )\n    .describe(\n      \"Unique, permanent name for the app; its integration connection is app#<slug>, e.g. app#bookkeeping.\",\n    ),\n);\n\nconst LOOPBACK_HOSTNAMES = new Set([\"127.0.0.1\", \"localhost\", \"[::1]\"]);\n\n/** One operation an app serves on its own server, called through the app's integration connection. */\nexport const appActionSchema = z\n  .lazy(() =>\n    z.strictObject({\n      id: z\n        .string()\n        .max(100)\n        .regex(\n          /^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/,\n          \"App action IDs are lowercase words separated by '.', '-', or '_', e.g. invoices.list.\",\n        ),\n      label: z.string().trim().min(1).max(100),\n      description: z.string().trim().min(1).max(1000),\n      inputSchema: z\n        .record(z.string(), z.unknown())\n        .describe(\"JSON Schema (2020-12 or draft-07) for the action's object input.\"),\n      outputSchema: z\n        .record(z.string(), z.unknown())\n        .describe(\"JSON Schema (2020-12 or draft-07) for the action's result.\"),\n    }),\n  )\n  .meta({ id: \"AppAction\" });\nexport type AppAction = z.infer<typeof appActionSchema>;\n\n/**\n * What an app lets Backoffice call. Each installation approves one revision of it; with\n * `changeApproval: \"automatic\"`, later revisions apply to every installation without approval.\n */\nexport const appActionsDeclarationSchema = z\n  .lazy(() =>\n    z.discriminatedUnion(\"kind\", [\n      z.strictObject({ kind: z.literal(\"none\") }),\n      z.strictObject({\n        kind: z.literal(\"endpoint\"),\n        endpointUrl: z\n          .url({ protocol: /^https?$/ })\n          .refine(\n            (url) => url.startsWith(\"https:\") || LOOPBACK_HOSTNAMES.has(new URL(url).hostname),\n            \"App action endpoints use HTTPS; plain HTTP is allowed only on loopback for development.\",\n          )\n          .describe(\n            \"Receives each signed action request as a POST; the request token's audience is this URL.\",\n          ),\n        changeApproval: z\n          .enum([\"installation\", \"automatic\"])\n          .describe(\n            \"installation: each installation approves a changed declaration before new or changed actions run. automatic: changes apply immediately; only administrators register apps, so reserve it for apps they operate.\",\n          ),\n        actions: z\n          .array(appActionSchema)\n          .min(1)\n          .max(100)\n          .refine(\n            (actions) => new Set(actions.map(({ id }) => id)).size === actions.length,\n            \"App action IDs must be unique.\",\n          ),\n      }),\n    ]),\n  )\n  .meta({ id: \"AppActionsDeclaration\" });\nexport type AppActionsDeclaration = z.infer<typeof appActionsDeclarationSchema>;\n\nconst appActionsRevisionSchema = z.lazy(() =>\n  z.number().int().positive().describe(\"Increments whenever the app's action declaration changes.\"),\n);\n\n/** Backoffice-specific registration data; OAuth metadata remains authoritative in Auth. */\nexport const backofficeAppSchema = z\n  .lazy(() =>\n    z.strictObject({\n      id: z.string().min(1),\n      slug: appSlugSchema,\n      oauthClientId: z.string().min(1),\n      requestedPermissions: appPermissionsSchema,\n      actions: appActionsDeclarationSchema,\n      actionsRevision: appActionsRevisionSchema,\n      createdAt: z.iso.datetime(),\n    }),\n  )\n  .meta({ id: \"BackofficeApp\" });\nexport type BackofficeApp = z.infer<typeof backofficeAppSchema>;\n\n/**\n * The owner's resources an installation may act on: everything the owner has, or some of the\n * projects it owns. Project lists are sets; they are normalized so equal selections compare equal\n * regardless of order.\n */\nconst appInstallationResourceScopeSchema = z\n  .lazy(() =>\n    z.discriminatedUnion(\"kind\", [\n      z.strictObject({ kind: z.literal(\"owner\") }),\n      z.strictObject({\n        kind: z.literal(\"projects\"),\n        // Piping into an array schema keeps the normalized form describable as JSON Schema.\n        projectIds: z\n          .array(z.string().trim().min(1).max(191))\n          .min(1)\n          .max(100)\n          .transform((projectIds) => [...new Set(projectIds)].sort())\n          .pipe(z.array(z.string())),\n      }),\n    ]),\n  )\n  .meta({ id: \"AppInstallationResourceScope\" });\nexport type AppInstallationResourceScope = z.infer<typeof appInstallationResourceScopeSchema>;\n\n/** What an owner approves: permissions, and the resources they apply to. */\nexport const appInstallationAccessSchema = z.lazy(() =>\n  z.strictObject({\n    grantedPermissions: appPermissionsSchema,\n    resourceScope: appInstallationResourceScopeSchema,\n  }),\n);\n\n/** An app-side tenant, such as a Bookkeeping organization, claimed by the app's server. */\nexport const appInstallationExternalAccountSchema = z.lazy(() =>\n  z.strictObject({\n    id: z.string().trim().min(1).max(191),\n    label: z.string().trim().min(1).max(191),\n  }),\n);\nexport type AppInstallationExternalAccount = z.infer<typeof appInstallationExternalAccountSchema>;\n\n/** Access changes are explicit control-plane operations and cannot change the owner. */\nexport const backofficeAppInstallationAccessInputSchema = z.lazy(() =>\n  backofficeAppLookupInputSchema._zod.innerType.extend(\n    appInstallationAccessSchema._zod.innerType.shape,\n  ),\n);\nexport type BackofficeAppInstallationAccessInput = z.infer<\n  typeof backofficeAppInstallationAccessInputSchema\n>;\n\n/** Installing approves access and, at the reviewed revision, the app's declared actions. */\nexport const backofficeAppInstallInputSchema = z.lazy(() =>\n  backofficeAppInstallationAccessInputSchema._zod.innerType.extend({\n    resourceScope: appInstallationResourceScopeSchema.default({ kind: \"owner\" }),\n    actionsRevision: appActionsRevisionSchema.describe(\n      \"The actionsRevision reviewed with apps.get; installation fails if the declaration changed since.\",\n    ),\n  }),\n);\nexport type BackofficeAppInstallInput = z.output<typeof backofficeAppInstallInputSchema>;\n\n/** Approval names the reviewed revision, so a declaration changed since review is never approved. */\nexport const backofficeAppInstallationActionsApprovalInputSchema = z.lazy(() =>\n  backofficeAppLookupInputSchema._zod.innerType.extend({\n    actionsRevision: appActionsRevisionSchema.describe(\n      \"The actionsRevision reviewed with apps.get; approval fails if the declaration changed since.\",\n    ),\n  }),\n);\nexport type BackofficeAppInstallationActionsApprovalInput = z.infer<\n  typeof backofficeAppInstallationActionsApprovalInputSchema\n>;\n\n/** Cursors remain bound to the owner even when each object has its own database. */\nexport const backofficeAppInstallationPageInputSchema = z.lazy(() =>\n  z.strictObject({\n    pageSize: z.number().int().min(1).max(100),\n    cursor: z.string().min(1).nullable(),\n  }),\n);\nexport type BackofficeAppInstallationPageInput = z.infer<\n  typeof backofficeAppInstallationPageInputSchema\n>;\n\n/**\n * Installation authority belongs to its owner, an organization or a person, not to the installing\n * user: an organization's installation outlives the administrator who approved it.\n */\nexport const backofficeAppInstallationSchema = z\n  .lazy(() =>\n    z.strictObject({\n      id: z.string().min(1),\n      appId: z.string().min(1),\n      owner: backofficeRootOwnerSchema,\n      grantedPermissions: appPermissionsSchema,\n      resourceScope: appInstallationResourceScopeSchema,\n      /** Null until the app's server claims the installation for one of its own tenants. */\n      externalAccount: appInstallationExternalAccountSchema.nullable(),\n      installedByUserId: z.string().min(1),\n      status: z.enum([\"active\", \"uninstalled\"]),\n      /** Increments on reinstallation; app credentials are bound to the activation that issued them. */\n      activation: z.number().int().positive(),\n      approvedActionsRevision: z\n        .number()\n        .int()\n        .nonnegative()\n        .describe(\n          \"The app's actionsRevision this installation approved; 0 when it approved no declaration.\",\n        ),\n      createdAt: z.iso.datetime(),\n      updatedAt: z.iso.datetime(),\n    }),\n  )\n  .meta({ id: \"BackofficeAppInstallation\" });\nexport type BackofficeAppInstallation = z.infer<typeof backofficeAppInstallationSchema>;\n\n/** Reinstallation preserves the transaction-resolved installation identity. */\nexport const backofficeAppInstallationMutationResultSchema = z\n  .lazy(() =>\n    z.strictObject({\n      installationId: z.string().min(1),\n      changed: z.boolean(),\n    }),\n  )\n  .meta({ id: \"BackofficeAppInstallationMutationResult\" });\nexport type BackofficeAppInstallationMutationResult = z.infer<\n  typeof backofficeAppInstallationMutationResultSchema\n>;\n\n/** An owner's installation history includes uninstalled records. */\nexport const backofficeAppInstallationPageSchema = z\n  .lazy(() =>\n    z.strictObject({\n      installations: z.array(backofficeAppInstallationSchema),\n      nextCursor: z.string().nullable(),\n      hasNextPage: z.boolean(),\n    }),\n  )\n  .meta({ id: \"BackofficeAppInstallationPage\" });\nexport type BackofficeAppInstallationPage = z.infer<typeof backofficeAppInstallationPageSchema>;\n\n/**\n * App operations manage the installations of the scoped owner, an organization or the calling\n * user's personal scope, as the calling user.\n */\nexport const appsOperations = {\n  \"apps.get\": {\n    description:\n      \"Review a registered app's requested permissions and declared actions before approving an installation.\",\n    permissions: [BACKOFFICE_PERMISSION.apps.read],\n    input: backofficeAppLookupInputSchema,\n    output: z.lazy(() => backofficeAppSchema.nullable()),\n  },\n  \"apps.install\": {\n    description:\n      \"Approve an app installation in the selected organization or personal scope, limited to explicit permissions and resources, and approve the app's declared actions at the reviewed revision. Installer identity comes from the authenticated user.\",\n    permissions: [BACKOFFICE_PERMISSION.apps.manage],\n    input: backofficeAppInstallInputSchema,\n    output: backofficeAppInstallationMutationResultSchema,\n  },\n  \"apps.installations.get\": {\n    description:\n      \"Inspect one app installation in the selected organization or personal scope, including approved grants.\",\n    permissions: [BACKOFFICE_PERMISSION.apps.read],\n    input: backofficeAppLookupInputSchema,\n    output: z.lazy(() => backofficeAppInstallationSchema.nullable()),\n  },\n  \"apps.installations.list\": {\n    description:\n      \"List the selected organization's or personal scope's active and uninstalled apps using cursor pagination. Does not expose other owners or OAuth credentials.\",\n    permissions: [BACKOFFICE_PERMISSION.apps.read],\n    input: z.lazy(() =>\n      backofficeAppInstallationPageInputSchema._zod.innerType.extend({\n        pageSize:\n          backofficeAppInstallationPageInputSchema._zod.innerType.shape.pageSize.default(25),\n        cursor: backofficeAppInstallationPageInputSchema._zod.innerType.shape.cursor.default(null),\n      }),\n    ),\n    output: backofficeAppInstallationPageSchema,\n  },\n  \"apps.installations.update\": {\n    description:\n      \"Replace an active installation's approved permissions and resources. Takes effect immediately, including for issued app credentials. Does not change installer attribution.\",\n    permissions: [BACKOFFICE_PERMISSION.apps.manage],\n    input: backofficeAppInstallationAccessInputSchema,\n    output: backofficeAppInstallationMutationResultSchema,\n  },\n  \"apps.installations.approveActions\": {\n    description:\n      \"Approve an app's current action declaration for the selected owner's installation, so its new and changed actions run. Only needed when the app's changeApproval is installation.\",\n    permissions: [BACKOFFICE_PERMISSION.apps.manage],\n    input: backofficeAppInstallationActionsApprovalInputSchema,\n    output: backofficeAppInstallationMutationResultSchema,\n  },\n  \"apps.uninstall\": {\n    description:\n      \"Uninstall an app in the selected organization or personal scope, clearing approved grants and its linked account while retaining installation identity. Immediately invalidates app credentials. Does not revoke personal OAuth consent.\",\n    permissions: [BACKOFFICE_PERMISSION.apps.manage],\n    input: backofficeAppLookupInputSchema,\n    output: backofficeAppInstallationMutationResultSchema,\n  },\n} satisfies Record<string, BackofficeApiOperation>;\n"],"mappings":";;;;;AAQA,MAAa,uBAAuB,EAAE,WACpC,EACG,MAAM,qCAAqC,CAAC,CAC5C,QACE,gBACC,IAAI,IAAI,YAAY,KAAK,EAAE,WAAW,iBAAiB,GAAG,UAAU,GAAG,YAAY,CAAC,CAAC,CAClF,SAAS,YAAY,QAC1B,yDACF,CACJ;;AAGA,MAAa,iCAAiC,EAAE,WAC9C,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CACtD;;AAIA,MAAa,gBAAgB,EAAE,WAC7B,EACG,OAAO,CAAC,CACR,IAAI,EAAE,CAAC,CACP,MACC,mCACA,mEACF,CAAC,CACA,SACC,qGACF,CACJ;AAEA,MAAM,qCAAqB,IAAI,IAAI;CAAC;CAAa;CAAa;AAAO,CAAC;;AAGtE,MAAa,kBAAkB,EAC5B,WACC,EAAE,aAAa;CACb,IAAI,EACD,OAAO,CAAC,CACR,IAAI,GAAG,CAAC,CACR,MACC,uCACA,uFACF;CACF,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACvC,aAAa,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAI;CAC9C,aAAa,EACV,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAC/B,SAAS,kEAAkE;CAC9E,cAAc,EACX,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAC/B,SAAS,4DAA4D;AAC1E,CAAC,CACH,CAAC,CACA,KAAK,EAAE,IAAI,YAAY,CAAC;;;;;AAO3B,MAAa,8BAA8B,EACxC,WACC,EAAE,mBAAmB,QAAQ,CAC3B,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,CAAC,GAC1C,EAAE,aAAa;CACb,MAAM,EAAE,QAAQ,UAAU;CAC1B,aAAa,EACV,IAAI,EAAE,UAAU,WAAW,CAAC,CAAC,CAC7B,QACE,QAAQ,IAAI,WAAW,QAAQ,KAAK,mBAAmB,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,QAAQ,GACjF,yFACF,CAAC,CACA,SACC,0FACF;CACF,gBAAgB,EACb,KAAK,CAAC,gBAAgB,WAAW,CAAC,CAAC,CACnC,SACC,iNACF;CACF,SAAS,EACN,MAAM,eAAe,CAAC,CACtB,IAAI,CAAC,CAAC,CACN,IAAI,GAAG,CAAC,CACR,QACE,YAAY,IAAI,IAAI,QAAQ,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,QAAQ,QACnE,gCACF;AACJ,CAAC,CACH,CAAC,CACH,CAAC,CACA,KAAK,EAAE,IAAI,wBAAwB,CAAC;AAGvC,MAAM,2BAA2B,EAAE,WACjC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,2DAA2D,CAClG;;AAGA,MAAa,sBAAsB,EAChC,WACC,EAAE,aAAa;CACb,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACpB,MAAM;CACN,eAAe,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC/B,sBAAsB;CACtB,SAAS;CACT,iBAAiB;CACjB,WAAW,EAAE,IAAI,SAAS;AAC5B,CAAC,CACH,CAAC,CACA,KAAK,EAAE,IAAI,gBAAgB,CAAC;;;;;;AAQ/B,MAAM,qCAAqC,EACxC,WACC,EAAE,mBAAmB,QAAQ,CAC3B,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,OAAO,EAAE,CAAC,GAC3C,EAAE,aAAa;CACb,MAAM,EAAE,QAAQ,UAAU;CAE1B,YAAY,EACT,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CACxC,IAAI,CAAC,CAAC,CACN,IAAI,GAAG,CAAC,CACR,WAAW,eAAe,CAAC,GAAG,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAC1D,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC7B,CAAC,CACH,CAAC,CACH,CAAC,CACA,KAAK,EAAE,IAAI,+BAA+B,CAAC;;AAI9C,MAAa,8BAA8B,EAAE,WAC3C,EAAE,aAAa;CACb,oBAAoB;CACpB,eAAe;AACjB,CAAC,CACH;;AAGA,MAAa,uCAAuC,EAAE,WACpD,EAAE,aAAa;CACb,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACpC,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACzC,CAAC,CACH;;AAIA,MAAa,6CAA6C,EAAE,WAC1D,+BAA+B,KAAK,UAAU,OAC5C,4BAA4B,KAAK,UAAU,KAC7C,CACF;;AAMA,MAAa,kCAAkC,EAAE,WAC/C,2CAA2C,KAAK,UAAU,OAAO;CAC/D,eAAe,mCAAmC,QAAQ,EAAE,MAAM,QAAQ,CAAC;CAC3E,iBAAiB,yBAAyB,SACxC,kGACF;AACF,CAAC,CACH;;AAIA,MAAa,sDAAsD,EAAE,WACnE,+BAA+B,KAAK,UAAU,OAAO,EACnD,iBAAiB,yBAAyB,SACxC,8FACF,EACF,CAAC,CACH;;AAMA,MAAa,2CAA2C,EAAE,WACxD,EAAE,aAAa;CACb,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACzC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;AACrC,CAAC,CACH;;;;;AASA,MAAa,kCAAkC,EAC5C,WACC,EAAE,aAAa;CACb,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACpB,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,OAAO;CACP,oBAAoB;CACpB,eAAe;;CAEf,iBAAiB,qCAAqC,SAAS;CAC/D,mBAAmB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACnC,QAAQ,EAAE,KAAK,CAAC,UAAU,aAAa,CAAC;;CAExC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACtC,yBAAyB,EACtB,OAAO,CAAC,CACR,IAAI,CAAC,CACL,YAAY,CAAC,CACb,SACC,0FACF;CACF,WAAW,EAAE,IAAI,SAAS;CAC1B,WAAW,EAAE,IAAI,SAAS;AAC5B,CAAC,CACH,CAAC,CACA,KAAK,EAAE,IAAI,4BAA4B,CAAC;;AAI3C,MAAa,gDAAgD,EAC1D,WACC,EAAE,aAAa;CACb,gBAAgB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAChC,SAAS,EAAE,QAAQ;AACrB,CAAC,CACH,CAAC,CACA,KAAK,EAAE,IAAI,0CAA0C,CAAC;;AAMzD,MAAa,sCAAsC,EAChD,WACC,EAAE,aAAa;CACb,eAAe,EAAE,MAAM,+BAA+B;CACtD,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,aAAa,EAAE,QAAQ;AACzB,CAAC,CACH,CAAC,CACA,KAAK,EAAE,IAAI,gCAAgC,CAAC;;;;;AAO/C,MAAa,iBAAiB;CAC5B,YAAY;EACV,aACE;EACF,aAAa,CAAC,sBAAsB,KAAK,IAAI;EAC7C,OAAO;EACP,QAAQ,EAAE,WAAW,oBAAoB,SAAS,CAAC;CACrD;CACA,gBAAgB;EACd,aACE;EACF,aAAa,CAAC,sBAAsB,KAAK,MAAM;EAC/C,OAAO;EACP,QAAQ;CACV;CACA,0BAA0B;EACxB,aACE;EACF,aAAa,CAAC,sBAAsB,KAAK,IAAI;EAC7C,OAAO;EACP,QAAQ,EAAE,WAAW,gCAAgC,SAAS,CAAC;CACjE;CACA,2BAA2B;EACzB,aACE;EACF,aAAa,CAAC,sBAAsB,KAAK,IAAI;EAC7C,OAAO,EAAE,WACP,yCAAyC,KAAK,UAAU,OAAO;GAC7D,UACE,yCAAyC,KAAK,UAAU,MAAM,SAAS,QAAQ,EAAE;GACnF,QAAQ,yCAAyC,KAAK,UAAU,MAAM,OAAO,QAAQ,IAAI;EAC3F,CAAC,CACH;EACA,QAAQ;CACV;CACA,6BAA6B;EAC3B,aACE;EACF,aAAa,CAAC,sBAAsB,KAAK,MAAM;EAC/C,OAAO;EACP,QAAQ;CACV;CACA,qCAAqC;EACnC,aACE;EACF,aAAa,CAAC,sBAAsB,KAAK,MAAM;EAC/C,OAAO;EACP,QAAQ;CACV;CACA,kBAAkB;EAChB,aACE;EACF,aAAa,CAAC,sBAAsB,KAAK,MAAM;EAC/C,OAAO;EACP,QAAQ;CACV;AACF"}