@ingram-cloud/sdk 1.7.0 → 1.8.0

package/dist/client.js

@@ -709,5 +709,11 @@ export class IngramCloud {
                 delete: (pid, tid, opts) => this.empty("DELETE", `/organization/projects/${enc(pid)}/tokens/${enc(tid)}`, opts),
             },
         },
+        /** Third-party apps linked through the authorization server. */
+        apps: {
+            list: (query, opts) => this.page("/organization/apps", query, opts),
+            /** Disconnect: revokes every token the app holds. */
+            delete: (id, opts) => this.empty("DELETE", `/organization/apps/${enc(id)}`, opts),
+        },
     };
 }

package/dist/zod/projects.js

@@ -26,6 +26,27 @@ export const ProjectOut = z
 })
     .meta({ id: "ProjectOut" });
 export const ProjectListOut = pageOut(ProjectOut, "ProjectListOut");
+/**
+ * A third-party app linked to the organization through the authorization
+ * server (`GET /oauth/authorize` with no `resource`): one per `(organization,
+ * client_id)`, owning the project it runs in. Disconnecting revokes every
+ * token the app holds.
+ */
+export const AppInstallOut = z
+    .object({
+    id: z.string(),
+    organization: z.string(),
+    /** The app's Client ID Metadata Document URL. */
+    client_id: z.string(),
+    client_name: z.string(),
+    project: z.string(),
+    /** The scopes the app's tokens carry, space-separated. */
+    scope: z.string(),
+    created_at: z.string(),
+    revoked_at: z.string().nullable(),
+})
+    .meta({ id: "AppInstallOut" });
+export const AppInstallListOut = pageOut(AppInstallOut, "AppInstallListOut");
 /**
  * The secret minted when an org mints a project (tenant-admin) token. Shape
  * matches `mintToken`'s return; the `tenant` module owns the canonical

package/dist/zod/tenant.js

@@ -263,17 +263,27 @@ export const ProviderIn = z
  *  `authorize_url`. */
 export const AuthorizeRequestOut = z
     .object({
+    /** `connector`: an MCP host connecting to a deployment (the tenant's page
+     *  completes it naming a smith). `app`: a third-party app linking an
+     *  organization (the console completes it with an organization token; the
+     *  grant's subject is the app's project in that organization). */
+    kind: z.enum(["connector", "app"]),
+    client_id: z.string(),
     client_name: z.string(),
+    /** The scopes the client asked for, space-separated (`app` only). */
+    scope: z.string(),
     target_name: z.string(),
+    /** '' on an `app` request until it is completed. */
     tenant: z.string(),
     resource: z.string(),
     deployment_id: z.string(),
 })
     .meta({ id: "AuthorizeRequestOut" });
-/** Complete the delegated grant: the tenant asserts (server-to-server) which
- *  smith the end-user authorized. */
+/** Complete the delegated grant server-to-server. A `connector` request names
+ *  the smith the end-user authorized; an `app` request carries nothing — the
+ *  organization is the token's. */
 export const AuthorizeCompleteIn = z
-    .object({ smith_id: z.string() })
+    .object({ smith_id: z.string().nullish() })
     .meta({ id: "AuthorizeCompleteIn" });
 /** Where the tenant 302s the browser after completing or declining. */
 export const AuthorizeRedirectOut = z

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@ingram-cloud/sdk",
-	"version": "1.7.0",
+	"version": "1.8.0",
 	"description": "Typed wire contract + management-plane client for the Ingram Cloud API: Zod schemas to validate request/response bodies, TypeScript types for the JSON you read back, SSE/webhook event types, and a typed REST client.",
 	"keywords": [
 		"api",

package/ts/client.ts

@@ -56,6 +56,7 @@ import type {
 	ICOrgUsage,
 	ICOrgUsageSeries,
 	ICProject,
+	ICAppInstall,
 	ICProvider,
 	ICRecallHit,
 	ICRun,
@@ -1690,5 +1691,14 @@ export class IngramCloud {
 					),
 			},
 		},
+
+		/** Third-party apps linked through the authorization server. */
+		apps: {
+			list: (query?: PageOpts, opts?: RequestOptions) =>
+				this.page<ICAppInstall>("/organization/apps", query, opts),
+			/** Disconnect: revokes every token the app holds. */
+			delete: (id: string, opts?: RequestOptions) =>
+				this.empty("DELETE", `/organization/apps/${enc(id)}`, opts),
+		},
 	};
 }

package/ts/responses.ts

@@ -84,7 +84,7 @@ export type {
 	ICUsageBreakdown,
 	ICUsageEvent,
 } from "./zod/observability.js";
-export type { ICProject } from "./zod/projects.js";
+export type { ICProject, ICAppInstall } from "./zod/projects.js";
 export type { ICActor } from "./zod/_actor.js";
 export type {
 	ICRun,

package/ts/zod/projects.ts

@@ -29,6 +29,29 @@ export const ProjectOut = z
 
 export const ProjectListOut = pageOut(ProjectOut, "ProjectListOut");
 
+/**
+ * A third-party app linked to the organization through the authorization
+ * server (`GET /oauth/authorize` with no `resource`): one per `(organization,
+ * client_id)`, owning the project it runs in. Disconnecting revokes every
+ * token the app holds.
+ */
+export const AppInstallOut = z
+	.object({
+		id: z.string(),
+		organization: z.string(),
+		/** The app's Client ID Metadata Document URL. */
+		client_id: z.string(),
+		client_name: z.string(),
+		project: z.string(),
+		/** The scopes the app's tokens carry, space-separated. */
+		scope: z.string(),
+		created_at: z.string(),
+		revoked_at: z.string().nullable(),
+	})
+	.meta({ id: "AppInstallOut" });
+
+export const AppInstallListOut = pageOut(AppInstallOut, "AppInstallListOut");
+
 /**
  * The secret minted when an org mints a project (tenant-admin) token. Shape
  * matches `mintToken`'s return; the `tenant` module owns the canonical
@@ -66,3 +89,5 @@ export const ProjectTokenIn = z
 // ── Inferred consumer-facing type ────────────────────────────────────────────
 
 export type ICProject = z.infer<typeof ProjectOut>;
+
+export type ICAppInstall = z.infer<typeof AppInstallOut>;

package/ts/zod/tenant.ts

@@ -305,18 +305,28 @@ export const ProviderIn = z
  *  `authorize_url`. */
 export const AuthorizeRequestOut = z
 	.object({
+		/** `connector`: an MCP host connecting to a deployment (the tenant's page
+		 *  completes it naming a smith). `app`: a third-party app linking an
+		 *  organization (the console completes it with an organization token; the
+		 *  grant's subject is the app's project in that organization). */
+		kind: z.enum(["connector", "app"]),
+		client_id: z.string(),
 		client_name: z.string(),
+		/** The scopes the client asked for, space-separated (`app` only). */
+		scope: z.string(),
 		target_name: z.string(),
+		/** '' on an `app` request until it is completed. */
 		tenant: z.string(),
 		resource: z.string(),
 		deployment_id: z.string(),
 	})
 	.meta({ id: "AuthorizeRequestOut" });
 
-/** Complete the delegated grant: the tenant asserts (server-to-server) which
- *  smith the end-user authorized. */
+/** Complete the delegated grant server-to-server. A `connector` request names
+ *  the smith the end-user authorized; an `app` request carries nothing — the
+ *  organization is the token's. */
 export const AuthorizeCompleteIn = z
-	.object({ smith_id: z.string() })
+	.object({ smith_id: z.string().nullish() })
 	.meta({ id: "AuthorizeCompleteIn" });
 
 /** Where the tenant 302s the browser after completing or declining. */