@valentinkolb/cloud 0.3.1 → 0.5.0

package/src/api/me.ts

@@ -10,17 +10,34 @@ import { auth, jsonResponse, rateLimit, requiresAuth, respond, v, type AuthConte
 import { ok } from "@valentinkolb/stdlib";
 import {
   ChangePasswordSchema,
+  AccountActivityListResponseSchema,
   CreateAccountRequestSchema,
+  CreateUserApiKeyResponseSchema,
+  CreateUserApiKeySchema,
+  CreateWebAuthnPasskeySchema,
   ErrorResponseSchema,
+  ListWebAuthnPasskeysResponseSchema,
   MessageResponseSchema,
+  ServiceAccountCredentialSchema,
   UpdateProfileSchema,
   UserSchema,
+  WebAuthnPasskeySchema,
 } from "../contracts";
 import {
   accountLifecycle,
   accountsAppService as accountsService,
+  audit,
+  serviceAccountCredentials,
+  webauthn,
 } from "../services";
 
+const toAccountsActor = (user: AuthContext["Variables"]["user"]) => ({
+  userId: user.id,
+  uid: user.uid,
+  roles: user.roles,
+  provider: user.provider,
+});
+
 const ExtendAccountResponseSchema = z.object({
   message: z.string(),
   newExpiry: z.string().datetime().optional(),
@@ -31,10 +48,42 @@ const AccountRequestResponseSchema = z.object({
   message: z.string(),
 });
 
+const ListApiKeysResponseSchema = z.object({
+  items: z.array(ServiceAccountCredentialSchema),
+});
+
+const AccountActivityQuerySchema = z.object({
+  days: z.coerce.number().int().pipe(z.union([z.literal(7), z.literal(30), z.literal(90)])).optional().default(30),
+});
+
 const app = new Hono<AuthContext>()
   .use(rateLimit())
   .use(auth.requireRole("authenticated"))
 
+  .get(
+    "/activity",
+    describeRoute({
+      tags: ["Me"],
+      summary: "List current user account activity",
+      description: "List safe self-service audit activity for the authenticated account.",
+      ...requiresAuth,
+      responses: {
+        200: jsonResponse(AccountActivityListResponseSchema, "Account activity"),
+        401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+      },
+    }),
+    v("query", AccountActivityQuerySchema),
+    async (c) =>
+      respond(c, async () => {
+        const page = await audit.listSelfServiceActivity({
+          userId: c.get("user").id,
+          days: c.req.valid("query").days,
+          pagination: { page: 1, perPage: 50 },
+        });
+        return ok({ items: page.items });
+      }),
+  )
+
   .get(
     "/",
     describeRoute({
@@ -67,15 +116,162 @@ const app = new Hono<AuthContext>()
     async (c) =>
       respond(c, async () => {
         const user = c.get("user");
-        const token = c.get("sessionToken");
         const data = c.req.valid("json");
-        const ipaSession = user.provider === "ipa" ? await auth.session.getIpaSession(token) : null;
-        const result = await accountsService.user.update({ ipaSession, id: user.id, data });
+        const result = await accountsService.user.update({ actor: toAccountsActor(user), id: user.id, data });
         if (!result.ok) return result;
         return ok({ message: "Profile updated." });
       }),
   )
 
+  .get(
+    "/passkeys",
+    describeRoute({
+      tags: ["Me"],
+      summary: "List current user passkeys",
+      description: "List WebAuthn passkeys registered to the authenticated account.",
+      ...requiresAuth,
+      responses: {
+        200: jsonResponse(ListWebAuthnPasskeysResponseSchema, "Passkeys"),
+        401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+      },
+    }),
+    async (c) =>
+      respond(c, async () => {
+        const items = await webauthn.listForUser({ userId: c.get("user").id });
+        return ok({ items });
+      }),
+  )
+
+  .post(
+    "/passkeys/registration/start",
+    describeRoute({
+      tags: ["Me"],
+      summary: "Start passkey registration",
+      description: "Create WebAuthn registration options for the authenticated account.",
+      ...requiresAuth,
+      responses: {
+        200: jsonResponse(z.unknown(), "Passkey registration options"),
+        401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+      },
+    }),
+    async (c) => respond(c, webauthn.beginRegistration({ user: c.get("user") })),
+  )
+
+  .post(
+    "/passkeys/registration/verify",
+    describeRoute({
+      tags: ["Me"],
+      summary: "Verify passkey registration",
+      description: "Verify a WebAuthn registration response and store the passkey public credential.",
+      ...requiresAuth,
+      responses: {
+        201: jsonResponse(WebAuthnPasskeySchema, "Passkey created"),
+        400: jsonResponse(ErrorResponseSchema, "Passkey registration failed"),
+        401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+      },
+    }),
+    v("json", CreateWebAuthnPasskeySchema),
+    async (c) =>
+      respond(c, () => {
+        const data = c.req.valid("json");
+        return webauthn.finishRegistration({
+          user: c.get("user"),
+          name: data.name,
+          response: data.response as never,
+        });
+      }, 201),
+  )
+
+  .delete(
+    "/passkeys/:id",
+    describeRoute({
+      tags: ["Me"],
+      summary: "Delete current user passkey",
+      description: "Delete a WebAuthn passkey registered to the authenticated account.",
+      ...requiresAuth,
+      responses: {
+        200: jsonResponse(MessageResponseSchema, "Passkey deleted"),
+        401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+        404: jsonResponse(ErrorResponseSchema, "Passkey not found"),
+      },
+    }),
+    async (c) =>
+      respond(c, async () => {
+        const result = await webauthn.deleteForUser({ user: c.get("user"), id: c.req.param("id") });
+        if (!result.ok) return result;
+        return ok({ message: "Passkey deleted." });
+      }),
+  )
+
+  .post(
+    "/api-keys",
+    describeRoute({
+      tags: ["Me"],
+      summary: "Create current user API key",
+      description: "Create a user-bound API key for the authenticated account. The raw token is returned once.",
+      ...requiresAuth,
+      responses: {
+        201: jsonResponse(CreateUserApiKeyResponseSchema, "API key created"),
+        400: jsonResponse(ErrorResponseSchema, "Failed to create API key"),
+        401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+      },
+    }),
+    v("json", CreateUserApiKeySchema),
+    async (c) =>
+      respond(c, async () => {
+        const user = c.get("user");
+        const data = c.req.valid("json");
+        return serviceAccountCredentials.createUserApiToken({
+          user,
+          name: data.name,
+          expiresAt: data.expiresAt ?? null,
+        });
+      }, 201),
+  )
+
+  .get(
+    "/api-keys",
+    describeRoute({
+      tags: ["Me"],
+      summary: "List current user API keys",
+      description: "List active user-bound API keys owned by the authenticated account.",
+      ...requiresAuth,
+      responses: {
+        200: jsonResponse(ListApiKeysResponseSchema, "API keys"),
+        401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+      },
+    }),
+    async (c) =>
+      respond(c, async () => {
+        const items = await serviceAccountCredentials.listForDelegatedUser({ userId: c.get("user").id });
+        return ok({ items });
+      }),
+  )
+
+  .delete(
+    "/api-keys/:id",
+    describeRoute({
+      tags: ["Me"],
+      summary: "Revoke current user API key",
+      description: "Revoke an API key owned by the authenticated account.",
+      ...requiresAuth,
+      responses: {
+        200: jsonResponse(MessageResponseSchema, "API key revoked"),
+        401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+        404: jsonResponse(ErrorResponseSchema, "API key not found"),
+      },
+    }),
+    async (c) =>
+      respond(c, async () => {
+        const result = await serviceAccountCredentials.revokeForDelegatedUser({
+          credentialId: c.req.param("id"),
+          user: c.get("user"),
+        });
+        if (!result.ok) return result;
+        return ok({ message: "API key revoked." });
+      }),
+  )
+
   .post(
     "/password",
     describeRoute({
@@ -118,10 +314,8 @@ const app = new Hono<AuthContext>()
     async (c) =>
       respond(c, async () => {
         const user = c.get("user");
-        const token = c.get("sessionToken");
-        const ipaSession = user.provider === "ipa" ? await auth.session.getIpaSession(token) : null;
-        const result = await accountLifecycle.extendCurrentUserAccount({ user, ipaSession });
-        return ok(result);
+        const result = await accountLifecycle.extendCurrentUserAccount({ user });
+        return result;
       }),
   )
 
@@ -142,12 +336,7 @@ const app = new Hono<AuthContext>()
     async (c) =>
       respond(c, async () => {
         const user = c.get("user");
-        if (user.profile !== "guest") {
-          return { ok: false, error: "Only guest accounts can be self-deleted.", status: 403 };
-        }
-        const token = c.get("sessionToken");
-        const ipaSession = user.provider === "ipa" ? await auth.session.getIpaSession(token) : null;
-        const result = await accountsService.user.removeSelf({ user, ipaSession });
+        const result = await accountsService.user.removeSelf({ user });
         if (!result.ok) return result;
         await auth.session.delete(c);
         return ok({ message: "Account deleted." });
@@ -197,7 +386,7 @@ const app = new Hono<AuthContext>()
         if (!pending) {
           return { ok: false, error: "No pending request", status: 404 };
         }
-        const result = await accountsService.accountRequest.withdraw({ id: pending.id, userId: user.id });
+        const result = await accountsService.accountRequest.withdraw({ id: pending.id, actor: toAccountsActor(user) });
         if (!result.ok) return result;
         return ok({ message: "Request withdrawn" });
       }),

package/src/api/search/schemas.ts

@@ -37,6 +37,7 @@ export const SearchResponseSchema = z.object({
   query: z.string(),
   count: z.number().int().nonnegative(),
   items: z.array(SearchItemSchema),
+  unsupportedTags: z.array(z.string()).optional(),
 });
 
 export type SearchItem = z.infer<typeof SearchItemSchema>;

package/src/api/search.ts

@@ -8,11 +8,18 @@ import { SearchItemSchema, SearchQuerySchema, SearchResponseSchema, type SearchI
 
 const log = logger("search");
 
+/**
+ * Maximum items returned to the client after merging across providers.
+ * The frontend has no further limit — this caps the rendered list.
+ */
+const GLOBAL_RESULT_LIMIT = 30;
+
 type HttpSearchProvider = {
   appId: string;
   appName: string;
   appIcon: string;
   endpoint: string;
+  tags: string[];
 };
 
 /**
@@ -28,6 +35,7 @@ const getSearchProviders = async (): Promise<HttpSearchProvider[]> => {
       appName: e.name,
       appIcon: e.icon,
       endpoint: e.search!.endpoint,
+      tags: [...e.search!.tags],
     }));
 };
 
@@ -50,26 +58,69 @@ export const createSearchRoutes = () =>
           200: jsonResponse(SearchResponseSchema, "Merged search results"),
           400: jsonResponse(ErrorResponseSchema, "Invalid query"),
           401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+          403: jsonResponse(ErrorResponseSchema, "User-backed actor required"),
         },
       }),
       v("query", SearchQuerySchema),
       async (c) => {
+        if (!c.get("user")) {
+          return c.json({ message: "Global search requires a user-backed actor", code: "FORBIDDEN" }, 403);
+        }
+
         const query = c.req.valid("query");
         const providers = await getSearchProviders();
+        const cookie = c.req.raw.headers.get("Cookie") ?? "";
+        const authorization = c.req.raw.headers.get("Authorization");
+
+        // Pre-filter providers by tag overlap. With no tags, every provider
+        // runs (text-only search). With tags, only providers that own at least
+        // one requested tag participate — saves fanout to apps that can't
+        // contribute. Tags the user typed that no provider declares are
+        // returned to the client so it can render a helpful empty state.
+        const knownTags = new Set(providers.flatMap((p) => p.tags));
+        const unsupportedTags = query.tag.filter((t) => !knownTags.has(t));
+        const active =
+          query.tag.length === 0
+            ? providers
+            : providers.filter((p) => p.tags.some((t) => query.tag.includes(t)));
+
+        if (query.tag.length > 0 && active.length === 0) {
+          return c.json({
+            query: query.q,
+            count: 0,
+            items: [],
+            unsupportedTags,
+          });
+        }
+
+        // Single-provider queries get a larger sample for better local
+        // ranking — the global slice below still caps the response. Capped
+        // at GLOBAL_RESULT_LIMIT so a single app can saturate the response
+        // but no more.
+        const effectiveProviderLimit =
+          active.length === 1
+            ? Math.min(GLOBAL_RESULT_LIMIT, query.provider_limit * 3)
+            : query.provider_limit;
 
         const settled = await Promise.allSettled(
-          providers.map(async (provider) => {
+          active.map(async (provider) => {
+            // Scope tags to those this provider declared. Apps no longer need
+            // their own gate — the framework guarantees they only see tags
+            // they understand.
+            const scopedTags = query.tag.filter((t) => provider.tags.includes(t));
+
             const res = await fetch(provider.endpoint, {
               method: "POST",
               headers: {
                 "Content-Type": "application/json",
-                // Forward the session cookie for auth on the app's internal search endpoint
-                Cookie: c.req.raw.headers.get("Cookie") ?? "",
+                // Forward the authenticated user context to app search providers.
+                Cookie: cookie,
+                ...(authorization ? { Authorization: authorization } : {}),
               },
               body: JSON.stringify({
                 query: query.q,
-                tags: query.tag,
-                limit: query.provider_limit,
+                tags: scopedTags,
+                limit: effectiveProviderLimit,
               }),
             });
 
@@ -106,7 +157,7 @@ export const createSearchRoutes = () =>
           if (result.status === "fulfilled") return result.value;
 
           log.warn("Search provider failed", {
-            appId: providers[index]?.appId ?? "unknown",
+            appId: active[index]?.appId ?? "unknown",
             tags: query.tag,
             error: result.reason instanceof Error ? result.reason.message : String(result.reason),
           });
@@ -119,10 +170,13 @@ export const createSearchRoutes = () =>
           return a.title.localeCompare(b.title);
         });
 
+        const sliced = items.slice(0, GLOBAL_RESULT_LIMIT);
+
         return c.json({
           query: query.q,
-          count: items.length,
-          items,
+          count: sliced.length,
+          items: sliced,
+          ...(unsupportedTags.length > 0 ? { unsupportedTags } : {}),
         });
       },
     );

package/src/config/ssr.ts

@@ -7,6 +7,7 @@ import { createSSRHandler } from "@valentinkolb/ssr/hono";
 import { env } from "./env";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { themeBootstrapScript } from "../shared/theme";
 
 /** Cache-busting version stamp — changes on every server start / rebuild. */
 const v = Date.now();
@@ -37,15 +38,7 @@ export const { config, plugin, html } = createConfig<PageOptions>({
     <link rel="icon" href="/branding/favicon">
     <link rel="stylesheet" href="/public/build.css?v=${v}">
     <link rel="stylesheet" href="/public/katex.css?v=${v}">
-    <script>
-      (function() {
-        var el = document.documentElement;
-        if (!el.hasAttribute('data-theme-fixed')) {
-          var theme = document.cookie.match(/theme=([^;]+)/)?.[1] || 'light';
-          el.classList.add(theme);
-        }
-      })();
-    </script>
+    <script>${themeBootstrapScript}</script>
   </head>
   <body>
     ${body}

package/src/contracts/announcements.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, test } from "bun:test";
+import {
+  ANNOUNCEMENTS_COOKIE,
+  mergeAnnouncementCookieState,
+  parseAnnouncementCookieHeader,
+  parseAnnouncementCookieValue,
+  serializeAnnouncementCookieState,
+} from "./announcements";
+
+describe("announcement cookie state", () => {
+  test("returns defaults for empty or malformed cookies", () => {
+    expect(parseAnnouncementCookieValue(null)).toEqual({ seenAnnouncementVersion: 0, dismissedBannerVersions: [] });
+    expect(parseAnnouncementCookieValue("%7Bbad")).toEqual({ seenAnnouncementVersion: 0, dismissedBannerVersions: [] });
+    expect(parseAnnouncementCookieHeader("theme=dark")).toEqual({ seenAnnouncementVersion: 0, dismissedBannerVersions: [] });
+  });
+
+  test("parses state from a cookie header", () => {
+    const value = serializeAnnouncementCookieState({
+      seenAnnouncementVersion: 12,
+      dismissedBannerVersions: [3, 2, 3],
+    });
+
+    expect(parseAnnouncementCookieHeader(`theme=dark; ${ANNOUNCEMENTS_COOKIE}=${value}; other=1`)).toEqual({
+      seenAnnouncementVersion: 12,
+      dismissedBannerVersions: [3, 2],
+    });
+  });
+
+  test("merges state monotonically", () => {
+    expect(
+      mergeAnnouncementCookieState(
+        { seenAnnouncementVersion: 10, dismissedBannerVersions: [4] },
+        { seenAnnouncementVersion: 8, dismissedBannerVersions: [5, 4] },
+      ),
+    ).toEqual({ seenAnnouncementVersion: 10, dismissedBannerVersions: [5, 4] });
+  });
+});

package/src/contracts/announcements.ts

@@ -0,0 +1,121 @@
+import { z } from "zod";
+
+export const ANNOUNCEMENTS_COOKIE = "cloud_announcements";
+export const ANNOUNCEMENTS_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
+export const MAX_DISMISSED_BANNER_VERSIONS = 50;
+
+export const AnnouncementKindSchema = z.enum(["announcement", "banner"]);
+export type AnnouncementKind = z.infer<typeof AnnouncementKindSchema>;
+
+export const AnnouncementToneSchema = z.enum(["info", "success", "warning", "danger"]);
+export type AnnouncementTone = z.infer<typeof AnnouncementToneSchema>;
+
+export const AnnouncementCookieStateSchema = z.object({
+  seenAnnouncementVersion: z.number().int().nonnegative().default(0),
+  dismissedBannerVersions: z.array(z.number().int().positive()).default([]),
+});
+export type AnnouncementCookieState = z.infer<typeof AnnouncementCookieStateSchema>;
+
+export const DEFAULT_ANNOUNCEMENT_COOKIE_STATE: AnnouncementCookieState = {
+  seenAnnouncementVersion: 0,
+  dismissedBannerVersions: [],
+};
+
+export const AnnouncementEntrySchema = z.object({
+  id: z.uuid(),
+  version: z.number().int().positive(),
+  kind: AnnouncementKindSchema,
+  title: z.string(),
+  body: z.string(),
+  tone: AnnouncementToneSchema,
+  publishedAt: z.string().datetime(),
+  expiresAt: z.string().datetime().nullable(),
+  createdAt: z.string().datetime(),
+  updatedAt: z.string().datetime(),
+  createdBy: z.uuid().nullable(),
+  updatedBy: z.uuid().nullable(),
+});
+export type AnnouncementEntry = z.infer<typeof AnnouncementEntrySchema>;
+
+export const AnnouncementDisplayEntrySchema = AnnouncementEntrySchema.omit({ body: true }).extend({
+  bodyHtml: z.string(),
+});
+export type AnnouncementDisplayEntry = z.infer<typeof AnnouncementDisplayEntrySchema>;
+
+const DatetimeInputSchema = z.string().datetime();
+const NullableDatetimeInputSchema = z.string().datetime().nullable();
+
+export const CreateAnnouncementSchema = z.object({
+  kind: AnnouncementKindSchema,
+  title: z.string().trim().min(1).max(180),
+  body: z.string().trim().min(1).max(20_000),
+  tone: AnnouncementToneSchema.default("info"),
+  publishedAt: DatetimeInputSchema.optional(),
+  expiresAt: NullableDatetimeInputSchema.optional(),
+});
+export type CreateAnnouncement = z.infer<typeof CreateAnnouncementSchema>;
+
+export const UpdateAnnouncementSchema = z
+  .object({
+    kind: AnnouncementKindSchema.optional(),
+    title: z.string().trim().min(1).max(180).optional(),
+    body: z.string().trim().min(1).max(20_000).optional(),
+    tone: AnnouncementToneSchema.optional(),
+    publishedAt: DatetimeInputSchema.optional(),
+    expiresAt: NullableDatetimeInputSchema.optional(),
+  })
+  .refine((value) => Object.keys(value).length > 0, "Provide at least one field to update.");
+export type UpdateAnnouncement = z.infer<typeof UpdateAnnouncementSchema>;
+
+export const AnnouncementListResponseSchema = z.object({
+  items: z.array(AnnouncementEntrySchema),
+});
+export type AnnouncementListResponse = z.infer<typeof AnnouncementListResponseSchema>;
+
+export const ActiveAnnouncementsResponseSchema = z.object({
+  banners: z.array(AnnouncementDisplayEntrySchema),
+  announcements: z.array(AnnouncementDisplayEntrySchema),
+  latestAnnouncementVersion: z.number().int().nonnegative(),
+});
+export type ActiveAnnouncementsResponse = z.infer<typeof ActiveAnnouncementsResponseSchema>;
+
+const normalizeCookieState = (value: unknown): AnnouncementCookieState => {
+  const parsed = AnnouncementCookieStateSchema.safeParse(value);
+  if (!parsed.success) return DEFAULT_ANNOUNCEMENT_COOKIE_STATE;
+  const dismissed = [...new Set(parsed.data.dismissedBannerVersions)]
+    .filter((version) => Number.isInteger(version) && version > 0)
+    .sort((a, b) => b - a)
+    .slice(0, MAX_DISMISSED_BANNER_VERSIONS);
+
+  return {
+    seenAnnouncementVersion: Math.max(0, parsed.data.seenAnnouncementVersion),
+    dismissedBannerVersions: dismissed,
+  };
+};
+
+export const parseAnnouncementCookieValue = (value: string | null | undefined): AnnouncementCookieState => {
+  if (!value) return DEFAULT_ANNOUNCEMENT_COOKIE_STATE;
+  try {
+    return normalizeCookieState(JSON.parse(decodeURIComponent(value)));
+  } catch {
+    return DEFAULT_ANNOUNCEMENT_COOKIE_STATE;
+  }
+};
+
+export const parseAnnouncementCookieHeader = (cookieHeader: string | null | undefined): AnnouncementCookieState => {
+  if (!cookieHeader) return DEFAULT_ANNOUNCEMENT_COOKIE_STATE;
+  const match = cookieHeader.match(new RegExp(`(?:^|;\\s*)${ANNOUNCEMENTS_COOKIE}=([^;]+)`));
+  return parseAnnouncementCookieValue(match?.[1]);
+};
+
+export const serializeAnnouncementCookieState = (state: AnnouncementCookieState): string =>
+  encodeURIComponent(JSON.stringify(normalizeCookieState(state)));
+
+export const mergeAnnouncementCookieState = (
+  current: AnnouncementCookieState,
+  patch: Partial<AnnouncementCookieState>,
+): AnnouncementCookieState =>
+  normalizeCookieState({
+    seenAnnouncementVersion: Math.max(current.seenAnnouncementVersion, patch.seenAnnouncementVersion ?? 0),
+    dismissedBannerVersions: [...current.dismissedBannerVersions, ...(patch.dismissedBannerVersions ?? [])],
+  });

package/src/contracts/app.ts

@@ -43,6 +43,10 @@ export type AppMeta = {
    * silently skip rendering for the current user.
    */
   widgets?: WidgetEndpoint[];
+  /** Setting keys declared by this app. Used by admin tooling to protect active app-owned settings. */
+  settingKeys?: readonly string[];
+  /** Gateway-relative URL where this app's OpenAPI JSON is served, or undefined. */
+  openapi?: string;
 };
 
 export type WidgetEndpoint = {

package/src/contracts/index.ts

@@ -1,5 +1,6 @@
+export * from "./announcements";
 export * from "./app";
-export * from "./shared";
-export * from "./registry";
 export * from "./profile";
+export * from "./registry";
+export * from "./shared";
 export * from "./widgets";

package/src/contracts/registry.ts

@@ -47,4 +47,8 @@ export type AppRegistryEntry = {
   search?: AppRegistrySearch;
   legalLinks?: AppRegistryLegalLink[];
   widgets?: AppRegistryWidget[];
+  /** Setting keys declared by this app. Used by admin tooling to avoid treating live app-owned settings as legacy. */
+  settingKeys?: readonly string[];
+  /** Gateway-relative URL where this app serves its OpenAPI JSON spec. */
+  openapi?: string;
 };