@veltrixsecops/app-sdk 2.0.0 → 2.2.0

package/README.md

@@ -92,6 +92,48 @@ Two rules for app pages:
 - Only import third-party client libraries if you accept them being compiled into your
   bundle; keep pages lean.
 
+### UI components
+
+Build page bodies from the platform's design-system kit instead of hand-rolling raw
+HTML. Import from `@veltrixsecops/app-sdk/ui`:
+
+```tsx
+import { Button, Card, CardHeader, CardBody, Tabs, DataTable } from '@veltrixsecops/app-sdk/ui'
+
+function Configs() {
+  return (
+    <Card>
+      <CardHeader actions={<Button variant="primary">New</Button>}>Configurations</CardHeader>
+      <CardBody>
+        <Tabs
+          tabs={[
+            { key: 'indexes', label: 'Indexes', content: <p>…</p> },
+            { key: 'roles', label: 'Roles', content: <p>…</p> },
+          ]}
+        />
+      </CardBody>
+    </Card>
+  )
+}
+```
+
+These render in the platform design system and pick up the tenant theme (light/dark) and
+your app's branding automatically via the platform's CSS-token bridge — no styling needed.
+The bundler shims `@veltrixsecops/app-sdk/ui` to the host's real components, so they share
+the single host React instance.
+
+Available components: `Button`, `Input`, `Textarea`, `Checkbox`, `Select`, `Card` (+
+`CardHeader`/`CardBody`/`CardFooter`), `Badge`, `Tooltip`, `EmptyState`, `Skeleton` (+
+`SkeletonText`/`SkeletonCard`), `DataTable`, `StatsCard`, `FormDialog`, `FormField`, `Tabs`,
+`Spinner`. Hooks: `useToast`, `useConfirmDialog`. All prop types are exported alongside the
+components.
+
+`useToast` / `useConfirmDialog` are backed by providers the platform mounts around every app
+page, so they work with no extra wiring inside Veltrix. Every export is usable outside the
+platform too (local dev, tests): components render a minimal, unstyled, accessible fallback,
+`useToast` logs to the console, and `useConfirmDialog().confirm()` resolves to `false`
+(fails closed) — so nothing crashes, it just runs without platform theming.
+
 ## Branding
 
 Declare your vendor identity in the manifest and the platform applies it in defined
@@ -147,6 +189,7 @@ conventionalPaths('indexes').handlers.deploy // 'config-types/indexes/deploy'
 | `@veltrixsecops/app-sdk/pipeline` | `defineValidator`, `defineDeployer`, `defineRollbackHandler`, `defineHealthChecker`, `defineDriftDetector` |
 | `@veltrixsecops/app-sdk/hooks` | React hooks for app client pages (requires `react`) |
 | `@veltrixsecops/app-sdk/client` | Browser client contract: `authFetch`, `getHostRuntime`, `AppClientModule` |
+| `@veltrixsecops/app-sdk/ui` | Platform design-system components + hooks for app client pages (requires `react`; renders richly inside the platform, degrades to a minimal accessible fallback outside it) |
 
 ## Building an app
 

package/dist/chunk-MMWEXHPU.js

@@ -0,0 +1,90 @@
+// src/client/inventory.ts
+var INVENTORY_API = "/api/components";
+async function inventoryError(res) {
+  const text = await res.text().catch(() => "");
+  if (text) {
+    try {
+      const body = JSON.parse(text);
+      const message = body?.error ?? body?.message;
+      if (message) return new Error(message);
+    } catch {
+    }
+    return new Error(text);
+  }
+  return new Error(`HTTP ${res.status}`);
+}
+function toInventoryItem(raw) {
+  return {
+    id: String(raw.id),
+    hostname: raw.hostname ?? "",
+    port: raw.port ?? void 0,
+    type: Array.isArray(raw.type) ? raw.type : void 0,
+    domains: Array.isArray(raw.domains) ? raw.domains : [],
+    ipRanges: Array.isArray(raw.ipRanges) ? raw.ipRanges : [],
+    tags: Array.isArray(raw.tags) ? raw.tags.map((tag) => ({ id: String(tag.id), name: String(tag.name) })) : [],
+    connectivityProviderId: raw.connectivityProviderId ?? null
+  };
+}
+async function listInventory() {
+  const res = await authFetch(INVENTORY_API);
+  if (!res.ok) throw await inventoryError(res);
+  const data = await res.json();
+  return Array.isArray(data) ? data.map(toInventoryItem) : [];
+}
+async function addInventoryItem(input) {
+  const res = await authFetch(INVENTORY_API, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(input)
+  });
+  if (!res.ok) throw await inventoryError(res);
+  return toInventoryItem(await res.json());
+}
+async function updateInventoryItem(id, input) {
+  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {
+    method: "PUT",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(input)
+  });
+  if (!res.ok) throw await inventoryError(res);
+  return toInventoryItem(await res.json());
+}
+async function removeInventoryItem(id) {
+  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {
+    method: "DELETE"
+  });
+  if (!res.ok && res.status !== 204) throw await inventoryError(res);
+}
+
+// src/client/index.ts
+var HOST_RUNTIME_GLOBAL = "__VELTRIX_APP_RUNTIME__";
+function getHostRuntime() {
+  const runtime = globalThis[HOST_RUNTIME_GLOBAL];
+  return runtime ?? null;
+}
+function requireHostRuntime() {
+  const runtime = getHostRuntime();
+  if (!runtime) {
+    throw new Error(
+      `Veltrix host runtime not found \u2014 app client bundles only run inside the Veltrix platform (missing globalThis.${HOST_RUNTIME_GLOBAL})`
+    );
+  }
+  return runtime;
+}
+function authFetch(input, init) {
+  const runtime = getHostRuntime();
+  if (runtime) return runtime.authFetch(input, init);
+  return fetch(input, init);
+}
+
+export {
+  listInventory,
+  addInventoryItem,
+  updateInventoryItem,
+  removeInventoryItem,
+  HOST_RUNTIME_GLOBAL,
+  getHostRuntime,
+  requireHostRuntime,
+  authFetch
+};
+//# sourceMappingURL=chunk-MMWEXHPU.js.map

package/dist/chunk-MMWEXHPU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client/inventory.ts","../src/client/index.ts"],"sourcesContent":["// ========================================================================\n// Inventory — the deployment targets an app can deploy configuration to.\n//\n// \"Inventory\" is the app-facing name for the platform's *components*: the\n// servers (hostname/port), domains, and IP/CIDR ranges a customer has\n// registered as deploy targets. These helpers are a typed, convenient\n// surface over the platform's components API (/api/components), enriched\n// with `domains` and `ipRanges`.\n//\n// Framework-free (no React) — safe to import from any client code. Every\n// call goes through the same `authFetch` the '/client' subpath exports, so\n// requests carry the platform's Authorization header. Non-2xx responses are\n// surfaced as thrown Errors carrying the platform's error text.\n// ========================================================================\n\nimport type { InventoryItem, InventoryItemInput } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's components (inventory) API. */\nconst INVENTORY_API = '/api/components'\n\n/**\n * Loosely-typed shape of a raw component as returned by the platform, before\n * it is normalized down to the {@link InventoryItem} surface.\n */\ninterface RawInventoryItem {\n  id: string\n  hostname?: string\n  port?: string\n  type?: string[]\n  domains?: string[]\n  ipRanges?: string[]\n  tags?: Array<{ id: string; name: string }>\n  connectivityProviderId?: string | null\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function inventoryError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/** Normalize a raw platform component into the typed InventoryItem surface. */\nfunction toInventoryItem(raw: RawInventoryItem): InventoryItem {\n  return {\n    id: String(raw.id),\n    hostname: raw.hostname ?? '',\n    port: raw.port ?? undefined,\n    type: Array.isArray(raw.type) ? raw.type : undefined,\n    domains: Array.isArray(raw.domains) ? raw.domains : [],\n    ipRanges: Array.isArray(raw.ipRanges) ? raw.ipRanges : [],\n    tags: Array.isArray(raw.tags)\n      ? raw.tags.map((tag) => ({ id: String(tag.id), name: String(tag.name) }))\n      : [],\n    connectivityProviderId: raw.connectivityProviderId ?? null,\n  }\n}\n\n/** List the customer's inventory (deployment targets). GET /api/components */\nexport async function listInventory(): Promise<InventoryItem[]> {\n  const res = await authFetch(INVENTORY_API)\n  if (!res.ok) throw await inventoryError(res)\n  const data = (await res.json()) as RawInventoryItem[]\n  return Array.isArray(data) ? data.map(toInventoryItem) : []\n}\n\n/** Add a new inventory item (deployment target). POST /api/components */\nexport async function addInventoryItem(input: InventoryItemInput): Promise<InventoryItem> {\n  const res = await authFetch(INVENTORY_API, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(input),\n  })\n  if (!res.ok) throw await inventoryError(res)\n  return toInventoryItem((await res.json()) as RawInventoryItem)\n}\n\n/** Update an existing inventory item. PUT /api/components/:id */\nexport async function updateInventoryItem(\n  id: string,\n  input: InventoryItemInput,\n): Promise<InventoryItem> {\n  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(input),\n  })\n  if (!res.ok) throw await inventoryError(res)\n  return toInventoryItem((await res.json()) as RawInventoryItem)\n}\n\n/** Remove an inventory item. DELETE /api/components/:id */\nexport async function removeInventoryItem(id: string): Promise<void> {\n  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {\n    method: 'DELETE',\n  })\n  // 204 No Content is the platform's success response for delete.\n  if (!res.ok && res.status !== 204) throw await inventoryError(res)\n}\n","// ========================================================================\n// Client runtime contract — how app client bundles talk to the host.\n//\n// App client code is packaged as a hermetic ESM bundle in which `react`,\n// `react-dom`, `react/jsx-runtime`, and every `@veltrixsecops/app-sdk`\n// subpath are compile-time shims that read the host-provided runtime from\n// `globalThis.__VELTRIX_APP_RUNTIME__`. The platform installs that global\n// (with ITS React instance, the shared AppContext, and an authenticated\n// fetch) before dynamically importing any app bundle, so app components\n// render inside the host React tree with working hooks and context.\n//\n// App authors: import from '@veltrixsecops/app-sdk/client' (and /hooks) —\n// never bundle your own copy of react. Use `authFetch` for calls to your\n// app's server routes (/api/apps/<app-id>/...): plain fetch() lacks the\n// platform's Authorization header and will receive 401s.\n// ========================================================================\n\nimport type { ComponentType, Context, LazyExoticComponent } from 'react'\nimport type { AppContextValue } from '../hooks/use-app-context'\n\nexport type { AppBrandingDeclaration } from '../types/manifest'\n\n// Inventory — typed helpers over the platform's components API (deployment\n// targets: servers, domains, IP/CIDR ranges). Framework-free; they use the\n// `authFetch` exported below internally.\nexport {\n  listInventory,\n  addInventoryItem,\n  updateInventoryItem,\n  removeInventoryItem,\n} from './inventory'\nexport type { InventoryItem, InventoryItemInput } from '../types/platform'\n\n/** Name of the global the platform installs before loading app bundles. */\nexport const HOST_RUNTIME_GLOBAL = '__VELTRIX_APP_RUNTIME__'\n\n/**\n * The runtime surface the platform exposes to app client bundles.\n * The react/reactDom/jsxRuntime members are the host's own module objects —\n * app bundles are compiled with shims that re-export them, guaranteeing a\n * single React instance per page.\n */\nexport interface VeltrixHostRuntime {\n  /** The host's `react` module object. */\n  react: unknown\n  /** The host's `react-dom` module object. */\n  reactDom: unknown\n  /** The host's `react-dom/client` module object. */\n  reactDomClient?: unknown\n  /** The host's `react/jsx-runtime` module object. */\n  jsxRuntime: unknown\n  /** Shared app context — the host wraps app pages in its Provider. */\n  AppContext: Context<AppContextValue | null>\n  /** fetch() with the platform's Authorization header attached. */\n  authFetch: (input: string, init?: RequestInit) => Promise<Response>\n  /**\n   * The SDK surface app bundles receive for `@veltrixsecops/app-sdk`,\n   * `.../hooks`, and `.../client` imports (useAppContext, AppContext,\n   * usePipelineStatus, authFetch, getHostRuntime, ...).\n   */\n  sdk: Record<string, unknown>\n  /**\n   * The platform's design-system components and hooks, host-owned so they\n   * share the single host React instance. Keyed by the exact component/hook\n   * names re-exported from `@veltrixsecops/app-sdk/ui` (Button, Input, Card,\n   * DataTable, useToast, ...). Present only inside the platform.\n   */\n  ui?: Record<string, unknown>\n}\n\n/** Read the host runtime, or null outside the platform (tests, storybook). */\nexport function getHostRuntime(): VeltrixHostRuntime | null {\n  const runtime = (globalThis as Record<string, unknown>)[HOST_RUNTIME_GLOBAL]\n  return (runtime as VeltrixHostRuntime) ?? null\n}\n\n/** Read the host runtime, throwing a diagnosable error when absent. */\nexport function requireHostRuntime(): VeltrixHostRuntime {\n  const runtime = getHostRuntime()\n  if (!runtime) {\n    throw new Error(\n      'Veltrix host runtime not found — app client bundles only run inside the ' +\n        `Veltrix platform (missing globalThis.${HOST_RUNTIME_GLOBAL})`,\n    )\n  }\n  return runtime\n}\n\n/**\n * fetch() that carries the platform's Authorization header. Required for an\n * app page to call its own server routes (/api/apps/<app-id>/...), which are\n * bearer-token protected. Falls back to plain fetch outside the platform.\n */\nexport function authFetch(input: string, init?: RequestInit): Promise<Response> {\n  const runtime = getHostRuntime()\n  if (runtime) return runtime.authFetch(input, init)\n  return fetch(input, init)\n}\n\n/** A sidebar entry contributed by the app's client entry module. */\nexport interface AppSidebarItem {\n  path: string\n  label: string\n  icon?: string\n}\n\n/**\n * Shape of the default export of an app's `client/index.tsx`.\n * `pages` keys must match `manifest.client.pages[].component`.\n */\nexport interface AppClientModule {\n  id: string\n  pages: Record<string, ComponentType | LazyExoticComponent<ComponentType>>\n  sidebarItems?: AppSidebarItem[]\n}\n"],"mappings":";AAmBA,IAAM,gBAAgB;AAkBtB,eAAe,eAAe,KAA+B;AAC3D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAGA,SAAS,gBAAgB,KAAsC;AAC7D,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,UAAU,IAAI,YAAY;AAAA,IAC1B,MAAM,IAAI,QAAQ;AAAA,IAClB,MAAM,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAO;AAAA,IAC3C,SAAS,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,UAAU,CAAC;AAAA,IACrD,UAAU,MAAM,QAAQ,IAAI,QAAQ,IAAI,IAAI,WAAW,CAAC;AAAA,IACxD,MAAM,MAAM,QAAQ,IAAI,IAAI,IACxB,IAAI,KAAK,IAAI,CAAC,SAAS,EAAE,IAAI,OAAO,IAAI,EAAE,GAAG,MAAM,OAAO,IAAI,IAAI,EAAE,EAAE,IACtE,CAAC;AAAA,IACL,wBAAwB,IAAI,0BAA0B;AAAA,EACxD;AACF;AAGA,eAAsB,gBAA0C;AAC9D,QAAM,MAAM,MAAM,UAAU,aAAa;AACzC,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,IAAI,eAAe,IAAI,CAAC;AAC5D;AAGA,eAAsB,iBAAiB,OAAmD;AACxF,QAAM,MAAM,MAAM,UAAU,eAAe;AAAA,IACzC,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,KAAK;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,SAAO,gBAAiB,MAAM,IAAI,KAAK,CAAsB;AAC/D;AAGA,eAAsB,oBACpB,IACA,OACwB;AACxB,QAAM,MAAM,MAAM,UAAU,GAAG,aAAa,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IACxE,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,KAAK;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,SAAO,gBAAiB,MAAM,IAAI,KAAK,CAAsB;AAC/D;AAGA,eAAsB,oBAAoB,IAA2B;AACnE,QAAM,MAAM,MAAM,UAAU,GAAG,aAAa,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IACxE,QAAQ;AAAA,EACV,CAAC;AAED,MAAI,CAAC,IAAI,MAAM,IAAI,WAAW,IAAK,OAAM,MAAM,eAAe,GAAG;AACnE;;;AC1EO,IAAM,sBAAsB;AAqC5B,SAAS,iBAA4C;AAC1D,QAAM,UAAW,WAAuC,mBAAmB;AAC3E,SAAQ,WAAkC;AAC5C;AAGO,SAAS,qBAAyC;AACvD,QAAM,UAAU,eAAe;AAC/B,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR,qHAC0C,mBAAmB;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,UAAU,OAAe,MAAuC;AAC9E,QAAM,UAAU,eAAe;AAC/B,MAAI,QAAS,QAAO,QAAQ,UAAU,OAAO,IAAI;AACjD,SAAO,MAAM,OAAO,IAAI;AAC1B;","names":[]}

package/dist/client/index.cjs

@@ -21,11 +21,75 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var client_exports = {};
 __export(client_exports, {
   HOST_RUNTIME_GLOBAL: () => HOST_RUNTIME_GLOBAL,
+  addInventoryItem: () => addInventoryItem,
   authFetch: () => authFetch,
   getHostRuntime: () => getHostRuntime,
-  requireHostRuntime: () => requireHostRuntime
+  listInventory: () => listInventory,
+  removeInventoryItem: () => removeInventoryItem,
+  requireHostRuntime: () => requireHostRuntime,
+  updateInventoryItem: () => updateInventoryItem
 });
 module.exports = __toCommonJS(client_exports);
+
+// src/client/inventory.ts
+var INVENTORY_API = "/api/components";
+async function inventoryError(res) {
+  const text = await res.text().catch(() => "");
+  if (text) {
+    try {
+      const body = JSON.parse(text);
+      const message = body?.error ?? body?.message;
+      if (message) return new Error(message);
+    } catch {
+    }
+    return new Error(text);
+  }
+  return new Error(`HTTP ${res.status}`);
+}
+function toInventoryItem(raw) {
+  return {
+    id: String(raw.id),
+    hostname: raw.hostname ?? "",
+    port: raw.port ?? void 0,
+    type: Array.isArray(raw.type) ? raw.type : void 0,
+    domains: Array.isArray(raw.domains) ? raw.domains : [],
+    ipRanges: Array.isArray(raw.ipRanges) ? raw.ipRanges : [],
+    tags: Array.isArray(raw.tags) ? raw.tags.map((tag) => ({ id: String(tag.id), name: String(tag.name) })) : [],
+    connectivityProviderId: raw.connectivityProviderId ?? null
+  };
+}
+async function listInventory() {
+  const res = await authFetch(INVENTORY_API);
+  if (!res.ok) throw await inventoryError(res);
+  const data = await res.json();
+  return Array.isArray(data) ? data.map(toInventoryItem) : [];
+}
+async function addInventoryItem(input) {
+  const res = await authFetch(INVENTORY_API, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(input)
+  });
+  if (!res.ok) throw await inventoryError(res);
+  return toInventoryItem(await res.json());
+}
+async function updateInventoryItem(id, input) {
+  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {
+    method: "PUT",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(input)
+  });
+  if (!res.ok) throw await inventoryError(res);
+  return toInventoryItem(await res.json());
+}
+async function removeInventoryItem(id) {
+  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {
+    method: "DELETE"
+  });
+  if (!res.ok && res.status !== 204) throw await inventoryError(res);
+}
+
+// src/client/index.ts
 var HOST_RUNTIME_GLOBAL = "__VELTRIX_APP_RUNTIME__";
 function getHostRuntime() {
   const runtime = globalThis[HOST_RUNTIME_GLOBAL];
@@ -48,8 +112,12 @@ function authFetch(input, init) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   HOST_RUNTIME_GLOBAL,
+  addInventoryItem,
   authFetch,
   getHostRuntime,
-  requireHostRuntime
+  listInventory,
+  removeInventoryItem,
+  requireHostRuntime,
+  updateInventoryItem
 });
 //# sourceMappingURL=index.cjs.map

package/dist/client/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/client/index.ts"],"sourcesContent":["// ========================================================================\n// Client runtime contract — how app client bundles talk to the host.\n//\n// App client code is packaged as a hermetic ESM bundle in which `react`,\n// `react-dom`, `react/jsx-runtime`, and every `@veltrixsecops/app-sdk`\n// subpath are compile-time shims that read the host-provided runtime from\n// `globalThis.__VELTRIX_APP_RUNTIME__`. The platform installs that global\n// (with ITS React instance, the shared AppContext, and an authenticated\n// fetch) before dynamically importing any app bundle, so app components\n// render inside the host React tree with working hooks and context.\n//\n// App authors: import from '@veltrixsecops/app-sdk/client' (and /hooks) —\n// never bundle your own copy of react. Use `authFetch` for calls to your\n// app's server routes (/api/apps/<app-id>/...): plain fetch() lacks the\n// platform's Authorization header and will receive 401s.\n// ========================================================================\n\nimport type { ComponentType, Context, LazyExoticComponent } from 'react'\nimport type { AppContextValue } from '../hooks/use-app-context'\n\nexport type { AppBrandingDeclaration } from '../types/manifest'\n\n/** Name of the global the platform installs before loading app bundles. */\nexport const HOST_RUNTIME_GLOBAL = '__VELTRIX_APP_RUNTIME__'\n\n/**\n * The runtime surface the platform exposes to app client bundles.\n * The react/reactDom/jsxRuntime members are the host's own module objects —\n * app bundles are compiled with shims that re-export them, guaranteeing a\n * single React instance per page.\n */\nexport interface VeltrixHostRuntime {\n  /** The host's `react` module object. */\n  react: unknown\n  /** The host's `react-dom` module object. */\n  reactDom: unknown\n  /** The host's `react-dom/client` module object. */\n  reactDomClient?: unknown\n  /** The host's `react/jsx-runtime` module object. */\n  jsxRuntime: unknown\n  /** Shared app context — the host wraps app pages in its Provider. */\n  AppContext: Context<AppContextValue | null>\n  /** fetch() with the platform's Authorization header attached. */\n  authFetch: (input: string, init?: RequestInit) => Promise<Response>\n  /**\n   * The SDK surface app bundles receive for `@veltrixsecops/app-sdk`,\n   * `.../hooks`, and `.../client` imports (useAppContext, AppContext,\n   * usePipelineStatus, authFetch, getHostRuntime, ...).\n   */\n  sdk: Record<string, unknown>\n}\n\n/** Read the host runtime, or null outside the platform (tests, storybook). */\nexport function getHostRuntime(): VeltrixHostRuntime | null {\n  const runtime = (globalThis as Record<string, unknown>)[HOST_RUNTIME_GLOBAL]\n  return (runtime as VeltrixHostRuntime) ?? null\n}\n\n/** Read the host runtime, throwing a diagnosable error when absent. */\nexport function requireHostRuntime(): VeltrixHostRuntime {\n  const runtime = getHostRuntime()\n  if (!runtime) {\n    throw new Error(\n      'Veltrix host runtime not found — app client bundles only run inside the ' +\n        `Veltrix platform (missing globalThis.${HOST_RUNTIME_GLOBAL})`,\n    )\n  }\n  return runtime\n}\n\n/**\n * fetch() that carries the platform's Authorization header. Required for an\n * app page to call its own server routes (/api/apps/<app-id>/...), which are\n * bearer-token protected. Falls back to plain fetch outside the platform.\n */\nexport function authFetch(input: string, init?: RequestInit): Promise<Response> {\n  const runtime = getHostRuntime()\n  if (runtime) return runtime.authFetch(input, init)\n  return fetch(input, init)\n}\n\n/** A sidebar entry contributed by the app's client entry module. */\nexport interface AppSidebarItem {\n  path: string\n  label: string\n  icon?: string\n}\n\n/**\n * Shape of the default export of an app's `client/index.tsx`.\n * `pages` keys must match `manifest.client.pages[].component`.\n */\nexport interface AppClientModule {\n  id: string\n  pages: Record<string, ComponentType | LazyExoticComponent<ComponentType>>\n  sidebarItems?: AppSidebarItem[]\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuBO,IAAM,sBAAsB;AA8B5B,SAAS,iBAA4C;AAC1D,QAAM,UAAW,WAAuC,mBAAmB;AAC3E,SAAQ,WAAkC;AAC5C;AAGO,SAAS,qBAAyC;AACvD,QAAM,UAAU,eAAe;AAC/B,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR,qHAC0C,mBAAmB;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,UAAU,OAAe,MAAuC;AAC9E,QAAM,UAAU,eAAe;AAC/B,MAAI,QAAS,QAAO,QAAQ,UAAU,OAAO,IAAI;AACjD,SAAO,MAAM,OAAO,IAAI;AAC1B;","names":[]}
+{"version":3,"sources":["../../src/client/index.ts","../../src/client/inventory.ts"],"sourcesContent":["// ========================================================================\n// Client runtime contract — how app client bundles talk to the host.\n//\n// App client code is packaged as a hermetic ESM bundle in which `react`,\n// `react-dom`, `react/jsx-runtime`, and every `@veltrixsecops/app-sdk`\n// subpath are compile-time shims that read the host-provided runtime from\n// `globalThis.__VELTRIX_APP_RUNTIME__`. The platform installs that global\n// (with ITS React instance, the shared AppContext, and an authenticated\n// fetch) before dynamically importing any app bundle, so app components\n// render inside the host React tree with working hooks and context.\n//\n// App authors: import from '@veltrixsecops/app-sdk/client' (and /hooks) —\n// never bundle your own copy of react. Use `authFetch` for calls to your\n// app's server routes (/api/apps/<app-id>/...): plain fetch() lacks the\n// platform's Authorization header and will receive 401s.\n// ========================================================================\n\nimport type { ComponentType, Context, LazyExoticComponent } from 'react'\nimport type { AppContextValue } from '../hooks/use-app-context'\n\nexport type { AppBrandingDeclaration } from '../types/manifest'\n\n// Inventory — typed helpers over the platform's components API (deployment\n// targets: servers, domains, IP/CIDR ranges). Framework-free; they use the\n// `authFetch` exported below internally.\nexport {\n  listInventory,\n  addInventoryItem,\n  updateInventoryItem,\n  removeInventoryItem,\n} from './inventory'\nexport type { InventoryItem, InventoryItemInput } from '../types/platform'\n\n/** Name of the global the platform installs before loading app bundles. */\nexport const HOST_RUNTIME_GLOBAL = '__VELTRIX_APP_RUNTIME__'\n\n/**\n * The runtime surface the platform exposes to app client bundles.\n * The react/reactDom/jsxRuntime members are the host's own module objects —\n * app bundles are compiled with shims that re-export them, guaranteeing a\n * single React instance per page.\n */\nexport interface VeltrixHostRuntime {\n  /** The host's `react` module object. */\n  react: unknown\n  /** The host's `react-dom` module object. */\n  reactDom: unknown\n  /** The host's `react-dom/client` module object. */\n  reactDomClient?: unknown\n  /** The host's `react/jsx-runtime` module object. */\n  jsxRuntime: unknown\n  /** Shared app context — the host wraps app pages in its Provider. */\n  AppContext: Context<AppContextValue | null>\n  /** fetch() with the platform's Authorization header attached. */\n  authFetch: (input: string, init?: RequestInit) => Promise<Response>\n  /**\n   * The SDK surface app bundles receive for `@veltrixsecops/app-sdk`,\n   * `.../hooks`, and `.../client` imports (useAppContext, AppContext,\n   * usePipelineStatus, authFetch, getHostRuntime, ...).\n   */\n  sdk: Record<string, unknown>\n  /**\n   * The platform's design-system components and hooks, host-owned so they\n   * share the single host React instance. Keyed by the exact component/hook\n   * names re-exported from `@veltrixsecops/app-sdk/ui` (Button, Input, Card,\n   * DataTable, useToast, ...). Present only inside the platform.\n   */\n  ui?: Record<string, unknown>\n}\n\n/** Read the host runtime, or null outside the platform (tests, storybook). */\nexport function getHostRuntime(): VeltrixHostRuntime | null {\n  const runtime = (globalThis as Record<string, unknown>)[HOST_RUNTIME_GLOBAL]\n  return (runtime as VeltrixHostRuntime) ?? null\n}\n\n/** Read the host runtime, throwing a diagnosable error when absent. */\nexport function requireHostRuntime(): VeltrixHostRuntime {\n  const runtime = getHostRuntime()\n  if (!runtime) {\n    throw new Error(\n      'Veltrix host runtime not found — app client bundles only run inside the ' +\n        `Veltrix platform (missing globalThis.${HOST_RUNTIME_GLOBAL})`,\n    )\n  }\n  return runtime\n}\n\n/**\n * fetch() that carries the platform's Authorization header. Required for an\n * app page to call its own server routes (/api/apps/<app-id>/...), which are\n * bearer-token protected. Falls back to plain fetch outside the platform.\n */\nexport function authFetch(input: string, init?: RequestInit): Promise<Response> {\n  const runtime = getHostRuntime()\n  if (runtime) return runtime.authFetch(input, init)\n  return fetch(input, init)\n}\n\n/** A sidebar entry contributed by the app's client entry module. */\nexport interface AppSidebarItem {\n  path: string\n  label: string\n  icon?: string\n}\n\n/**\n * Shape of the default export of an app's `client/index.tsx`.\n * `pages` keys must match `manifest.client.pages[].component`.\n */\nexport interface AppClientModule {\n  id: string\n  pages: Record<string, ComponentType | LazyExoticComponent<ComponentType>>\n  sidebarItems?: AppSidebarItem[]\n}\n","// ========================================================================\n// Inventory — the deployment targets an app can deploy configuration to.\n//\n// \"Inventory\" is the app-facing name for the platform's *components*: the\n// servers (hostname/port), domains, and IP/CIDR ranges a customer has\n// registered as deploy targets. These helpers are a typed, convenient\n// surface over the platform's components API (/api/components), enriched\n// with `domains` and `ipRanges`.\n//\n// Framework-free (no React) — safe to import from any client code. Every\n// call goes through the same `authFetch` the '/client' subpath exports, so\n// requests carry the platform's Authorization header. Non-2xx responses are\n// surfaced as thrown Errors carrying the platform's error text.\n// ========================================================================\n\nimport type { InventoryItem, InventoryItemInput } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's components (inventory) API. */\nconst INVENTORY_API = '/api/components'\n\n/**\n * Loosely-typed shape of a raw component as returned by the platform, before\n * it is normalized down to the {@link InventoryItem} surface.\n */\ninterface RawInventoryItem {\n  id: string\n  hostname?: string\n  port?: string\n  type?: string[]\n  domains?: string[]\n  ipRanges?: string[]\n  tags?: Array<{ id: string; name: string }>\n  connectivityProviderId?: string | null\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function inventoryError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/** Normalize a raw platform component into the typed InventoryItem surface. */\nfunction toInventoryItem(raw: RawInventoryItem): InventoryItem {\n  return {\n    id: String(raw.id),\n    hostname: raw.hostname ?? '',\n    port: raw.port ?? undefined,\n    type: Array.isArray(raw.type) ? raw.type : undefined,\n    domains: Array.isArray(raw.domains) ? raw.domains : [],\n    ipRanges: Array.isArray(raw.ipRanges) ? raw.ipRanges : [],\n    tags: Array.isArray(raw.tags)\n      ? raw.tags.map((tag) => ({ id: String(tag.id), name: String(tag.name) }))\n      : [],\n    connectivityProviderId: raw.connectivityProviderId ?? null,\n  }\n}\n\n/** List the customer's inventory (deployment targets). GET /api/components */\nexport async function listInventory(): Promise<InventoryItem[]> {\n  const res = await authFetch(INVENTORY_API)\n  if (!res.ok) throw await inventoryError(res)\n  const data = (await res.json()) as RawInventoryItem[]\n  return Array.isArray(data) ? data.map(toInventoryItem) : []\n}\n\n/** Add a new inventory item (deployment target). POST /api/components */\nexport async function addInventoryItem(input: InventoryItemInput): Promise<InventoryItem> {\n  const res = await authFetch(INVENTORY_API, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(input),\n  })\n  if (!res.ok) throw await inventoryError(res)\n  return toInventoryItem((await res.json()) as RawInventoryItem)\n}\n\n/** Update an existing inventory item. PUT /api/components/:id */\nexport async function updateInventoryItem(\n  id: string,\n  input: InventoryItemInput,\n): Promise<InventoryItem> {\n  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(input),\n  })\n  if (!res.ok) throw await inventoryError(res)\n  return toInventoryItem((await res.json()) as RawInventoryItem)\n}\n\n/** Remove an inventory item. DELETE /api/components/:id */\nexport async function removeInventoryItem(id: string): Promise<void> {\n  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {\n    method: 'DELETE',\n  })\n  // 204 No Content is the platform's success response for delete.\n  if (!res.ok && res.status !== 204) throw await inventoryError(res)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACmBA,IAAM,gBAAgB;AAkBtB,eAAe,eAAe,KAA+B;AAC3D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAGA,SAAS,gBAAgB,KAAsC;AAC7D,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,UAAU,IAAI,YAAY;AAAA,IAC1B,MAAM,IAAI,QAAQ;AAAA,IAClB,MAAM,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAO;AAAA,IAC3C,SAAS,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,UAAU,CAAC;AAAA,IACrD,UAAU,MAAM,QAAQ,IAAI,QAAQ,IAAI,IAAI,WAAW,CAAC;AAAA,IACxD,MAAM,MAAM,QAAQ,IAAI,IAAI,IACxB,IAAI,KAAK,IAAI,CAAC,SAAS,EAAE,IAAI,OAAO,IAAI,EAAE,GAAG,MAAM,OAAO,IAAI,IAAI,EAAE,EAAE,IACtE,CAAC;AAAA,IACL,wBAAwB,IAAI,0BAA0B;AAAA,EACxD;AACF;AAGA,eAAsB,gBAA0C;AAC9D,QAAM,MAAM,MAAM,UAAU,aAAa;AACzC,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,IAAI,eAAe,IAAI,CAAC;AAC5D;AAGA,eAAsB,iBAAiB,OAAmD;AACxF,QAAM,MAAM,MAAM,UAAU,eAAe;AAAA,IACzC,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,KAAK;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,SAAO,gBAAiB,MAAM,IAAI,KAAK,CAAsB;AAC/D;AAGA,eAAsB,oBACpB,IACA,OACwB;AACxB,QAAM,MAAM,MAAM,UAAU,GAAG,aAAa,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IACxE,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,KAAK;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,SAAO,gBAAiB,MAAM,IAAI,KAAK,CAAsB;AAC/D;AAGA,eAAsB,oBAAoB,IAA2B;AACnE,QAAM,MAAM,MAAM,UAAU,GAAG,aAAa,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IACxE,QAAQ;AAAA,EACV,CAAC;AAED,MAAI,CAAC,IAAI,MAAM,IAAI,WAAW,IAAK,OAAM,MAAM,eAAe,GAAG;AACnE;;;AD1EO,IAAM,sBAAsB;AAqC5B,SAAS,iBAA4C;AAC1D,QAAM,UAAW,WAAuC,mBAAmB;AAC3E,SAAQ,WAAkC;AAC5C;AAGO,SAAS,qBAAyC;AACvD,QAAM,UAAU,eAAe;AAC/B,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR,qHAC0C,mBAAmB;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,UAAU,OAAe,MAAuC;AAC9E,QAAM,UAAU,eAAe;AAC/B,MAAI,QAAS,QAAO,QAAQ,UAAU,OAAO,IAAI;AACjD,SAAO,MAAM,OAAO,IAAI;AAC1B;","names":[]}

package/dist/client/index.d.cts

@@ -1,6 +1,15 @@
 import { ComponentType, LazyExoticComponent, Context } from 'react';
-import { A as AppContextValue } from '../use-app-context-CQq7ZaXo.cjs';
-export { a as AppBrandingDeclaration } from '../use-app-context-CQq7ZaXo.cjs';
+import { y as InventoryItemInput, I as InventoryItem, b as AppContextValue } from '../use-app-context-Dh1S28Cv.cjs';
+export { A as AppBrandingDeclaration } from '../use-app-context-Dh1S28Cv.cjs';
+
+/** List the customer's inventory (deployment targets). GET /api/components */
+declare function listInventory(): Promise<InventoryItem[]>;
+/** Add a new inventory item (deployment target). POST /api/components */
+declare function addInventoryItem(input: InventoryItemInput): Promise<InventoryItem>;
+/** Update an existing inventory item. PUT /api/components/:id */
+declare function updateInventoryItem(id: string, input: InventoryItemInput): Promise<InventoryItem>;
+/** Remove an inventory item. DELETE /api/components/:id */
+declare function removeInventoryItem(id: string): Promise<void>;
 
 /** Name of the global the platform installs before loading app bundles. */
 declare const HOST_RUNTIME_GLOBAL = "__VELTRIX_APP_RUNTIME__";
@@ -29,6 +38,13 @@ interface VeltrixHostRuntime {
      * usePipelineStatus, authFetch, getHostRuntime, ...).
      */
     sdk: Record<string, unknown>;
+    /**
+     * The platform's design-system components and hooks, host-owned so they
+     * share the single host React instance. Keyed by the exact component/hook
+     * names re-exported from `@veltrixsecops/app-sdk/ui` (Button, Input, Card,
+     * DataTable, useToast, ...). Present only inside the platform.
+     */
+    ui?: Record<string, unknown>;
 }
 /** Read the host runtime, or null outside the platform (tests, storybook). */
 declare function getHostRuntime(): VeltrixHostRuntime | null;
@@ -56,4 +72,4 @@ interface AppClientModule {
     sidebarItems?: AppSidebarItem[];
 }
 
-export { type AppClientModule, type AppSidebarItem, HOST_RUNTIME_GLOBAL, type VeltrixHostRuntime, authFetch, getHostRuntime, requireHostRuntime };
+export { type AppClientModule, type AppSidebarItem, HOST_RUNTIME_GLOBAL, InventoryItem, InventoryItemInput, type VeltrixHostRuntime, addInventoryItem, authFetch, getHostRuntime, listInventory, removeInventoryItem, requireHostRuntime, updateInventoryItem };

package/dist/client/index.d.ts

@@ -1,6 +1,15 @@
 import { ComponentType, LazyExoticComponent, Context } from 'react';
-import { A as AppContextValue } from '../use-app-context-CQq7ZaXo.js';
-export { a as AppBrandingDeclaration } from '../use-app-context-CQq7ZaXo.js';
+import { y as InventoryItemInput, I as InventoryItem, b as AppContextValue } from '../use-app-context-Dh1S28Cv.js';
+export { A as AppBrandingDeclaration } from '../use-app-context-Dh1S28Cv.js';
+
+/** List the customer's inventory (deployment targets). GET /api/components */
+declare function listInventory(): Promise<InventoryItem[]>;
+/** Add a new inventory item (deployment target). POST /api/components */
+declare function addInventoryItem(input: InventoryItemInput): Promise<InventoryItem>;
+/** Update an existing inventory item. PUT /api/components/:id */
+declare function updateInventoryItem(id: string, input: InventoryItemInput): Promise<InventoryItem>;
+/** Remove an inventory item. DELETE /api/components/:id */
+declare function removeInventoryItem(id: string): Promise<void>;
 
 /** Name of the global the platform installs before loading app bundles. */
 declare const HOST_RUNTIME_GLOBAL = "__VELTRIX_APP_RUNTIME__";
@@ -29,6 +38,13 @@ interface VeltrixHostRuntime {
      * usePipelineStatus, authFetch, getHostRuntime, ...).
      */
     sdk: Record<string, unknown>;
+    /**
+     * The platform's design-system components and hooks, host-owned so they
+     * share the single host React instance. Keyed by the exact component/hook
+     * names re-exported from `@veltrixsecops/app-sdk/ui` (Button, Input, Card,
+     * DataTable, useToast, ...). Present only inside the platform.
+     */
+    ui?: Record<string, unknown>;
 }
 /** Read the host runtime, or null outside the platform (tests, storybook). */
 declare function getHostRuntime(): VeltrixHostRuntime | null;
@@ -56,4 +72,4 @@ interface AppClientModule {
     sidebarItems?: AppSidebarItem[];
 }
 
-export { type AppClientModule, type AppSidebarItem, HOST_RUNTIME_GLOBAL, type VeltrixHostRuntime, authFetch, getHostRuntime, requireHostRuntime };
+export { type AppClientModule, type AppSidebarItem, HOST_RUNTIME_GLOBAL, InventoryItem, InventoryItemInput, type VeltrixHostRuntime, addInventoryItem, authFetch, getHostRuntime, listInventory, removeInventoryItem, requireHostRuntime, updateInventoryItem };

package/dist/client/index.js

@@ -1,13 +1,21 @@
 import {
   HOST_RUNTIME_GLOBAL,
+  addInventoryItem,
   authFetch,
   getHostRuntime,
-  requireHostRuntime
-} from "../chunk-PJN3ATPH.js";
+  listInventory,
+  removeInventoryItem,
+  requireHostRuntime,
+  updateInventoryItem
+} from "../chunk-MMWEXHPU.js";
 export {
   HOST_RUNTIME_GLOBAL,
+  addInventoryItem,
   authFetch,
   getHostRuntime,
-  requireHostRuntime
+  listInventory,
+  removeInventoryItem,
+  requireHostRuntime,
+  updateInventoryItem
 };
 //# sourceMappingURL=index.js.map

package/dist/hooks/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/hooks/index.ts","../../src/hooks/use-app-context.ts","../../src/hooks/use-pipeline-status.ts","../../src/client/index.ts","../../src/hooks/use-app-branding.ts"],"sourcesContent":["export { useAppContext, AppContext, type AppContextValue } from './use-app-context'\nexport { usePipelineStatus, type PipelineStatusData } from './use-pipeline-status'\nexport { useAppBranding } from './use-app-branding'\n","// ========================================================================\n// React hooks for app developers\n// These provide access to platform data and pipeline state\n// ========================================================================\n\nimport { createContext, useContext, type Context } from 'react'\nimport type { Component, Credential, Tag, User, Customer } from '../types/platform'\nimport type { AppBrandingDeclaration } from '../types/manifest'\n\nexport interface AppContextValue {\n  appId: string\n  customerId: string\n  user: User | null\n  customer: Customer | null\n\n  // Platform data accessors\n  getComponents: () => Promise<Component[]>\n  getCredentials: () => Promise<Credential[]>\n  getTags: () => Promise<Tag[]>\n\n  // App settings\n  settings: Record<string, unknown>\n\n  /** The app's manifest branding, resolved by the platform (null when unset). */\n  branding?: AppBrandingDeclaration | null\n}\n\n// Anchor the context on the host runtime when running inside the platform,\n// so a bundle that inlined its own SDK copy still shares the host's context\n// (two createContext objects never match, even with identical shapes).\nconst hostContext = (\n  (globalThis as Record<string, unknown>).__VELTRIX_APP_RUNTIME__ as\n    | { AppContext?: Context<AppContextValue | null> }\n    | undefined\n)?.AppContext\n\nexport const AppContext: Context<AppContextValue | null> =\n  hostContext ?? createContext<AppContextValue | null>(null)\n\n/**\n * Access the app context in any app component.\n *\n * @example\n * ```tsx\n * import { useAppContext } from '@veltrixsecops/app-sdk/hooks'\n *\n * function MyComponent() {\n *   const { appId, settings, getComponents } = useAppContext()\n *   // ...\n * }\n * ```\n */\nexport function useAppContext(): AppContextValue {\n  const ctx = useContext(AppContext)\n  if (!ctx) {\n    throw new Error('useAppContext must be used within an AppContextProvider')\n  }\n  return ctx\n}\n","import { useState, useEffect, useCallback } from 'react'\nimport { authFetch } from '../client'\n\nexport interface PipelineStatusData {\n  pendingApprovals: number\n  activeDeployments: number\n  failedDeployments: number\n  unresolvedDrifts: number\n  recentDeployments: Array<{\n    id: string\n    canvasName: string\n    environment: string\n    status: string\n    startedAt: string\n    completedAt?: string\n  }>\n}\n\n/**\n * Hook to access pipeline status for the current app/customer.\n *\n * @example\n * ```tsx\n * import { usePipelineStatus } from '@veltrixsecops/app-sdk/hooks'\n *\n * function Dashboard() {\n *   const { data, isLoading } = usePipelineStatus('my-app')\n *   if (isLoading) return <Spinner />\n *   return <div>{data.activeDeployments} active deployments</div>\n * }\n * ```\n */\nexport function usePipelineStatus(appId: string) {\n  const [data, setData] = useState<PipelineStatusData | null>(null)\n  const [isLoading, setIsLoading] = useState(true)\n  const [error, setError] = useState<Error | null>(null)\n\n  const refresh = useCallback(async () => {\n    try {\n      setIsLoading(true)\n      // Platform APIs are bearer-token protected — plain fetch would 401\n      const response = await authFetch(`/api/pipeline/summary?appId=${appId}`)\n      if (!response.ok) throw new Error(`Failed to fetch pipeline status`)\n      const result = await response.json()\n      setData(result)\n      setError(null)\n    } catch (err) {\n      setError(err instanceof Error ? err : new Error('Unknown error'))\n    } finally {\n      setIsLoading(false)\n    }\n  }, [appId])\n\n  useEffect(() => {\n    refresh()\n  }, [refresh])\n\n  return { data, isLoading, error, refresh }\n}\n","// ========================================================================\n// Client runtime contract — how app client bundles talk to the host.\n//\n// App client code is packaged as a hermetic ESM bundle in which `react`,\n// `react-dom`, `react/jsx-runtime`, and every `@veltrixsecops/app-sdk`\n// subpath are compile-time shims that read the host-provided runtime from\n// `globalThis.__VELTRIX_APP_RUNTIME__`. The platform installs that global\n// (with ITS React instance, the shared AppContext, and an authenticated\n// fetch) before dynamically importing any app bundle, so app components\n// render inside the host React tree with working hooks and context.\n//\n// App authors: import from '@veltrixsecops/app-sdk/client' (and /hooks) —\n// never bundle your own copy of react. Use `authFetch` for calls to your\n// app's server routes (/api/apps/<app-id>/...): plain fetch() lacks the\n// platform's Authorization header and will receive 401s.\n// ========================================================================\n\nimport type { ComponentType, Context, LazyExoticComponent } from 'react'\nimport type { AppContextValue } from '../hooks/use-app-context'\n\nexport type { AppBrandingDeclaration } from '../types/manifest'\n\n/** Name of the global the platform installs before loading app bundles. */\nexport const HOST_RUNTIME_GLOBAL = '__VELTRIX_APP_RUNTIME__'\n\n/**\n * The runtime surface the platform exposes to app client bundles.\n * The react/reactDom/jsxRuntime members are the host's own module objects —\n * app bundles are compiled with shims that re-export them, guaranteeing a\n * single React instance per page.\n */\nexport interface VeltrixHostRuntime {\n  /** The host's `react` module object. */\n  react: unknown\n  /** The host's `react-dom` module object. */\n  reactDom: unknown\n  /** The host's `react-dom/client` module object. */\n  reactDomClient?: unknown\n  /** The host's `react/jsx-runtime` module object. */\n  jsxRuntime: unknown\n  /** Shared app context — the host wraps app pages in its Provider. */\n  AppContext: Context<AppContextValue | null>\n  /** fetch() with the platform's Authorization header attached. */\n  authFetch: (input: string, init?: RequestInit) => Promise<Response>\n  /**\n   * The SDK surface app bundles receive for `@veltrixsecops/app-sdk`,\n   * `.../hooks`, and `.../client` imports (useAppContext, AppContext,\n   * usePipelineStatus, authFetch, getHostRuntime, ...).\n   */\n  sdk: Record<string, unknown>\n}\n\n/** Read the host runtime, or null outside the platform (tests, storybook). */\nexport function getHostRuntime(): VeltrixHostRuntime | null {\n  const runtime = (globalThis as Record<string, unknown>)[HOST_RUNTIME_GLOBAL]\n  return (runtime as VeltrixHostRuntime) ?? null\n}\n\n/** Read the host runtime, throwing a diagnosable error when absent. */\nexport function requireHostRuntime(): VeltrixHostRuntime {\n  const runtime = getHostRuntime()\n  if (!runtime) {\n    throw new Error(\n      'Veltrix host runtime not found — app client bundles only run inside the ' +\n        `Veltrix platform (missing globalThis.${HOST_RUNTIME_GLOBAL})`,\n    )\n  }\n  return runtime\n}\n\n/**\n * fetch() that carries the platform's Authorization header. Required for an\n * app page to call its own server routes (/api/apps/<app-id>/...), which are\n * bearer-token protected. Falls back to plain fetch outside the platform.\n */\nexport function authFetch(input: string, init?: RequestInit): Promise<Response> {\n  const runtime = getHostRuntime()\n  if (runtime) return runtime.authFetch(input, init)\n  return fetch(input, init)\n}\n\n/** A sidebar entry contributed by the app's client entry module. */\nexport interface AppSidebarItem {\n  path: string\n  label: string\n  icon?: string\n}\n\n/**\n * Shape of the default export of an app's `client/index.tsx`.\n * `pages` keys must match `manifest.client.pages[].component`.\n */\nexport interface AppClientModule {\n  id: string\n  pages: Record<string, ComponentType | LazyExoticComponent<ComponentType>>\n  sidebarItems?: AppSidebarItem[]\n}\n","import { useAppContext } from './use-app-context'\nimport type { AppBrandingDeclaration } from '../types/manifest'\n\n/**\n * The app's brand identity as declared in manifest.yaml `branding`.\n *\n * The platform already applies it in the defined slots (the app navbar and\n * the scoped CSS variables --veltrix-app-primary / --veltrix-app-accent on\n * the app page container). Use this hook only when a page needs the values\n * programmatically — prefer the CSS variables for styling:\n *\n * @example\n * ```tsx\n * <span style={{ color: 'var(--veltrix-app-primary)' }}>12 detections</span>\n * ```\n */\nexport function useAppBranding(): AppBrandingDeclaration | null {\n  return useAppContext().branding ?? null\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACKA,mBAAwD;AAyBxD,IAAM,cACH,WAAuC,yBAGvC;AAEI,IAAM,aACX,mBAAe,4BAAsC,IAAI;AAepD,SAAS,gBAAiC;AAC/C,QAAM,UAAM,yBAAW,UAAU;AACjC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,SAAO;AACT;;;AC1DA,IAAAA,gBAAiD;;;ACuB1C,IAAM,sBAAsB;AA8B5B,SAAS,iBAA4C;AAC1D,QAAM,UAAW,WAAuC,mBAAmB;AAC3E,SAAQ,WAAkC;AAC5C;AAmBO,SAAS,UAAU,OAAe,MAAuC;AAC9E,QAAM,UAAU,eAAe;AAC/B,MAAI,QAAS,QAAO,QAAQ,UAAU,OAAO,IAAI;AACjD,SAAO,MAAM,OAAO,IAAI;AAC1B;;;AD/CO,SAAS,kBAAkB,OAAe;AAC/C,QAAM,CAAC,MAAM,OAAO,QAAI,wBAAoC,IAAI;AAChE,QAAM,CAAC,WAAW,YAAY,QAAI,wBAAS,IAAI;AAC/C,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAuB,IAAI;AAErD,QAAM,cAAU,2BAAY,YAAY;AACtC,QAAI;AACF,mBAAa,IAAI;AAEjB,YAAM,WAAW,MAAM,UAAU,+BAA+B,KAAK,EAAE;AACvE,UAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,iCAAiC;AACnE,YAAM,SAAS,MAAM,SAAS,KAAK;AACnC,cAAQ,MAAM;AACd,eAAS,IAAI;AAAA,IACf,SAAS,KAAK;AACZ,eAAS,eAAe,QAAQ,MAAM,IAAI,MAAM,eAAe,CAAC;AAAA,IAClE,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,KAAK,CAAC;AAEV,+BAAU,MAAM;AACd,YAAQ;AAAA,EACV,GAAG,CAAC,OAAO,CAAC;AAEZ,SAAO,EAAE,MAAM,WAAW,OAAO,QAAQ;AAC3C;;;AE1CO,SAAS,iBAAgD;AAC9D,SAAO,cAAc,EAAE,YAAY;AACrC;","names":["import_react"]}
+{"version":3,"sources":["../../src/hooks/index.ts","../../src/hooks/use-app-context.ts","../../src/hooks/use-pipeline-status.ts","../../src/client/index.ts","../../src/hooks/use-app-branding.ts"],"sourcesContent":["export { useAppContext, AppContext, type AppContextValue } from './use-app-context'\nexport { usePipelineStatus, type PipelineStatusData } from './use-pipeline-status'\nexport { useAppBranding } from './use-app-branding'\n","// ========================================================================\n// React hooks for app developers\n// These provide access to platform data and pipeline state\n// ========================================================================\n\nimport { createContext, useContext, type Context } from 'react'\nimport type { Component, Credential, Tag, User, Customer } from '../types/platform'\nimport type { AppBrandingDeclaration } from '../types/manifest'\n\nexport interface AppContextValue {\n  appId: string\n  customerId: string\n  user: User | null\n  customer: Customer | null\n\n  // Platform data accessors\n  getComponents: () => Promise<Component[]>\n  getCredentials: () => Promise<Credential[]>\n  getTags: () => Promise<Tag[]>\n\n  // App settings\n  settings: Record<string, unknown>\n\n  /** The app's manifest branding, resolved by the platform (null when unset). */\n  branding?: AppBrandingDeclaration | null\n}\n\n// Anchor the context on the host runtime when running inside the platform,\n// so a bundle that inlined its own SDK copy still shares the host's context\n// (two createContext objects never match, even with identical shapes).\nconst hostContext = (\n  (globalThis as Record<string, unknown>).__VELTRIX_APP_RUNTIME__ as\n    | { AppContext?: Context<AppContextValue | null> }\n    | undefined\n)?.AppContext\n\nexport const AppContext: Context<AppContextValue | null> =\n  hostContext ?? createContext<AppContextValue | null>(null)\n\n/**\n * Access the app context in any app component.\n *\n * @example\n * ```tsx\n * import { useAppContext } from '@veltrixsecops/app-sdk/hooks'\n *\n * function MyComponent() {\n *   const { appId, settings, getComponents } = useAppContext()\n *   // ...\n * }\n * ```\n */\nexport function useAppContext(): AppContextValue {\n  const ctx = useContext(AppContext)\n  if (!ctx) {\n    throw new Error('useAppContext must be used within an AppContextProvider')\n  }\n  return ctx\n}\n","import { useState, useEffect, useCallback } from 'react'\nimport { authFetch } from '../client'\n\nexport interface PipelineStatusData {\n  pendingApprovals: number\n  activeDeployments: number\n  failedDeployments: number\n  unresolvedDrifts: number\n  recentDeployments: Array<{\n    id: string\n    canvasName: string\n    environment: string\n    status: string\n    startedAt: string\n    completedAt?: string\n  }>\n}\n\n/**\n * Hook to access pipeline status for the current app/customer.\n *\n * @example\n * ```tsx\n * import { usePipelineStatus } from '@veltrixsecops/app-sdk/hooks'\n *\n * function Dashboard() {\n *   const { data, isLoading } = usePipelineStatus('my-app')\n *   if (isLoading) return <Spinner />\n *   return <div>{data.activeDeployments} active deployments</div>\n * }\n * ```\n */\nexport function usePipelineStatus(appId: string) {\n  const [data, setData] = useState<PipelineStatusData | null>(null)\n  const [isLoading, setIsLoading] = useState(true)\n  const [error, setError] = useState<Error | null>(null)\n\n  const refresh = useCallback(async () => {\n    try {\n      setIsLoading(true)\n      // Platform APIs are bearer-token protected — plain fetch would 401\n      const response = await authFetch(`/api/pipeline/summary?appId=${appId}`)\n      if (!response.ok) throw new Error(`Failed to fetch pipeline status`)\n      const result = await response.json()\n      setData(result)\n      setError(null)\n    } catch (err) {\n      setError(err instanceof Error ? err : new Error('Unknown error'))\n    } finally {\n      setIsLoading(false)\n    }\n  }, [appId])\n\n  useEffect(() => {\n    refresh()\n  }, [refresh])\n\n  return { data, isLoading, error, refresh }\n}\n","// ========================================================================\n// Client runtime contract — how app client bundles talk to the host.\n//\n// App client code is packaged as a hermetic ESM bundle in which `react`,\n// `react-dom`, `react/jsx-runtime`, and every `@veltrixsecops/app-sdk`\n// subpath are compile-time shims that read the host-provided runtime from\n// `globalThis.__VELTRIX_APP_RUNTIME__`. The platform installs that global\n// (with ITS React instance, the shared AppContext, and an authenticated\n// fetch) before dynamically importing any app bundle, so app components\n// render inside the host React tree with working hooks and context.\n//\n// App authors: import from '@veltrixsecops/app-sdk/client' (and /hooks) —\n// never bundle your own copy of react. Use `authFetch` for calls to your\n// app's server routes (/api/apps/<app-id>/...): plain fetch() lacks the\n// platform's Authorization header and will receive 401s.\n// ========================================================================\n\nimport type { ComponentType, Context, LazyExoticComponent } from 'react'\nimport type { AppContextValue } from '../hooks/use-app-context'\n\nexport type { AppBrandingDeclaration } from '../types/manifest'\n\n// Inventory — typed helpers over the platform's components API (deployment\n// targets: servers, domains, IP/CIDR ranges). Framework-free; they use the\n// `authFetch` exported below internally.\nexport {\n  listInventory,\n  addInventoryItem,\n  updateInventoryItem,\n  removeInventoryItem,\n} from './inventory'\nexport type { InventoryItem, InventoryItemInput } from '../types/platform'\n\n/** Name of the global the platform installs before loading app bundles. */\nexport const HOST_RUNTIME_GLOBAL = '__VELTRIX_APP_RUNTIME__'\n\n/**\n * The runtime surface the platform exposes to app client bundles.\n * The react/reactDom/jsxRuntime members are the host's own module objects —\n * app bundles are compiled with shims that re-export them, guaranteeing a\n * single React instance per page.\n */\nexport interface VeltrixHostRuntime {\n  /** The host's `react` module object. */\n  react: unknown\n  /** The host's `react-dom` module object. */\n  reactDom: unknown\n  /** The host's `react-dom/client` module object. */\n  reactDomClient?: unknown\n  /** The host's `react/jsx-runtime` module object. */\n  jsxRuntime: unknown\n  /** Shared app context — the host wraps app pages in its Provider. */\n  AppContext: Context<AppContextValue | null>\n  /** fetch() with the platform's Authorization header attached. */\n  authFetch: (input: string, init?: RequestInit) => Promise<Response>\n  /**\n   * The SDK surface app bundles receive for `@veltrixsecops/app-sdk`,\n   * `.../hooks`, and `.../client` imports (useAppContext, AppContext,\n   * usePipelineStatus, authFetch, getHostRuntime, ...).\n   */\n  sdk: Record<string, unknown>\n  /**\n   * The platform's design-system components and hooks, host-owned so they\n   * share the single host React instance. Keyed by the exact component/hook\n   * names re-exported from `@veltrixsecops/app-sdk/ui` (Button, Input, Card,\n   * DataTable, useToast, ...). Present only inside the platform.\n   */\n  ui?: Record<string, unknown>\n}\n\n/** Read the host runtime, or null outside the platform (tests, storybook). */\nexport function getHostRuntime(): VeltrixHostRuntime | null {\n  const runtime = (globalThis as Record<string, unknown>)[HOST_RUNTIME_GLOBAL]\n  return (runtime as VeltrixHostRuntime) ?? null\n}\n\n/** Read the host runtime, throwing a diagnosable error when absent. */\nexport function requireHostRuntime(): VeltrixHostRuntime {\n  const runtime = getHostRuntime()\n  if (!runtime) {\n    throw new Error(\n      'Veltrix host runtime not found — app client bundles only run inside the ' +\n        `Veltrix platform (missing globalThis.${HOST_RUNTIME_GLOBAL})`,\n    )\n  }\n  return runtime\n}\n\n/**\n * fetch() that carries the platform's Authorization header. Required for an\n * app page to call its own server routes (/api/apps/<app-id>/...), which are\n * bearer-token protected. Falls back to plain fetch outside the platform.\n */\nexport function authFetch(input: string, init?: RequestInit): Promise<Response> {\n  const runtime = getHostRuntime()\n  if (runtime) return runtime.authFetch(input, init)\n  return fetch(input, init)\n}\n\n/** A sidebar entry contributed by the app's client entry module. */\nexport interface AppSidebarItem {\n  path: string\n  label: string\n  icon?: string\n}\n\n/**\n * Shape of the default export of an app's `client/index.tsx`.\n * `pages` keys must match `manifest.client.pages[].component`.\n */\nexport interface AppClientModule {\n  id: string\n  pages: Record<string, ComponentType | LazyExoticComponent<ComponentType>>\n  sidebarItems?: AppSidebarItem[]\n}\n","import { useAppContext } from './use-app-context'\nimport type { AppBrandingDeclaration } from '../types/manifest'\n\n/**\n * The app's brand identity as declared in manifest.yaml `branding`.\n *\n * The platform already applies it in the defined slots (the app navbar and\n * the scoped CSS variables --veltrix-app-primary / --veltrix-app-accent on\n * the app page container). Use this hook only when a page needs the values\n * programmatically — prefer the CSS variables for styling:\n *\n * @example\n * ```tsx\n * <span style={{ color: 'var(--veltrix-app-primary)' }}>12 detections</span>\n * ```\n */\nexport function useAppBranding(): AppBrandingDeclaration | null {\n  return useAppContext().branding ?? null\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACKA,mBAAwD;AAyBxD,IAAM,cACH,WAAuC,yBAGvC;AAEI,IAAM,aACX,mBAAe,4BAAsC,IAAI;AAepD,SAAS,gBAAiC;AAC/C,QAAM,UAAM,yBAAW,UAAU;AACjC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,SAAO;AACT;;;AC1DA,IAAAA,gBAAiD;;;ACkC1C,IAAM,sBAAsB;AAqC5B,SAAS,iBAA4C;AAC1D,QAAM,UAAW,WAAuC,mBAAmB;AAC3E,SAAQ,WAAkC;AAC5C;AAmBO,SAAS,UAAU,OAAe,MAAuC;AAC9E,QAAM,UAAU,eAAe;AAC/B,MAAI,QAAS,QAAO,QAAQ,UAAU,OAAO,IAAI;AACjD,SAAO,MAAM,OAAO,IAAI;AAC1B;;;ADjEO,SAAS,kBAAkB,OAAe;AAC/C,QAAM,CAAC,MAAM,OAAO,QAAI,wBAAoC,IAAI;AAChE,QAAM,CAAC,WAAW,YAAY,QAAI,wBAAS,IAAI;AAC/C,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAuB,IAAI;AAErD,QAAM,cAAU,2BAAY,YAAY;AACtC,QAAI;AACF,mBAAa,IAAI;AAEjB,YAAM,WAAW,MAAM,UAAU,+BAA+B,KAAK,EAAE;AACvE,UAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,iCAAiC;AACnE,YAAM,SAAS,MAAM,SAAS,KAAK;AACnC,cAAQ,MAAM;AACd,eAAS,IAAI;AAAA,IACf,SAAS,KAAK;AACZ,eAAS,eAAe,QAAQ,MAAM,IAAI,MAAM,eAAe,CAAC;AAAA,IAClE,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,KAAK,CAAC;AAEV,+BAAU,MAAM;AACd,YAAQ;AAAA,EACV,GAAG,CAAC,OAAO,CAAC;AAEZ,SAAO,EAAE,MAAM,WAAW,OAAO,QAAQ;AAC3C;;;AE1CO,SAAS,iBAAgD;AAC9D,SAAO,cAAc,EAAE,YAAY;AACrC;","names":["import_react"]}

package/dist/hooks/index.d.cts

@@ -1,5 +1,5 @@
-import { a as AppBrandingDeclaration } from '../use-app-context-CQq7ZaXo.cjs';
-export { b as AppContext, A as AppContextValue, u as useAppContext } from '../use-app-context-CQq7ZaXo.cjs';
+import { A as AppBrandingDeclaration } from '../use-app-context-Dh1S28Cv.cjs';
+export { a as AppContext, b as AppContextValue, u as useAppContext } from '../use-app-context-Dh1S28Cv.cjs';
 export { P as PipelineStatusData, u as usePipelineStatus } from '../use-pipeline-status-CCSQ9Neh.cjs';
 import 'react';
 

package/dist/hooks/index.d.ts

@@ -1,5 +1,5 @@
-import { a as AppBrandingDeclaration } from '../use-app-context-CQq7ZaXo.js';
-export { b as AppContext, A as AppContextValue, u as useAppContext } from '../use-app-context-CQq7ZaXo.js';
+import { A as AppBrandingDeclaration } from '../use-app-context-Dh1S28Cv.js';
+export { a as AppContext, b as AppContextValue, u as useAppContext } from '../use-app-context-Dh1S28Cv.js';
 export { P as PipelineStatusData, u as usePipelineStatus } from '../use-pipeline-status-CCSQ9Neh.js';
 import 'react';
 

package/dist/hooks/index.js

@@ -1,6 +1,6 @@
 import {
   authFetch
-} from "../chunk-PJN3ATPH.js";
+} from "../chunk-MMWEXHPU.js";
 
 // src/hooks/use-app-context.ts
 import { createContext, useContext } from "react";

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/pipeline/define-validator.ts","../src/pipeline/define-deployer.ts","../src/pipeline/define-rollback-handler.ts","../src/pipeline/define-health-checker.ts","../src/pipeline/define-drift-detector.ts","../src/types/manifest.ts","../src/structure.ts"],"sourcesContent":["// ========================================================================\n// @veltrixsecops/app-sdk\n//\n// The official SDK for building Veltrix Security-as-Code apps.\n//\n// This root entry is REACT-FREE and safe to load in a bare Node process.\n// Pipeline handlers execute inside the platform's sandbox runner — a child\n// process with a scrubbed environment and no React — so the contract they\n// import must never pull in a UI dependency. (Before 2.0 this entry\n// re-exported the React hooks, which made `require('@veltrixsecops/app-sdk')`\n// load React.) The platform can therefore import HANDLER_NAMES and the\n// handler contracts directly, instead of mirroring them server-side.\n//\n// Usage:\n//   import type { PipelineContext, DeployContext } from '@veltrixsecops/app-sdk'\n//   import { HANDLER_NAMES, conventionalPaths } from '@veltrixsecops/app-sdk'\n//   import { defineValidator, defineDeployer } from '@veltrixsecops/app-sdk/pipeline'\n//   import { useAppContext, usePipelineStatus } from '@veltrixsecops/app-sdk/hooks'   // React\n//   import { authFetch } from '@veltrixsecops/app-sdk/client'                          // browser\n// ========================================================================\n\n// Pipeline handler helpers (React-free)\nexport {\n  defineValidator,\n  defineDeployer,\n  defineRollbackHandler,\n  defineHealthChecker,\n  defineDriftDetector,\n} from './pipeline'\n\n// NOTE: React hooks are NOT re-exported here. Import them from\n// '@veltrixsecops/app-sdk/hooks'; browser client helpers live in\n// '@veltrixsecops/app-sdk/client'. Keeping them off the root is what makes\n// this entry loadable in the sandbox runner's bare Node child process.\n\n// Pipeline types\nexport type {\n  PipelineContext,\n  DeployContext,\n  RollbackContext,\n  HealthCheckContext,\n  DriftContext,\n  ValidationResult,\n  ValidationError,\n  ValidationWarning,\n  DeployResult,\n  RollbackResult,\n  HealthCheckResult,\n  HealthCheck,\n  DriftResult,\n  DriftDiff,\n  ConfigStatus,\n  ComponentConfigStatus,\n  CanvasSnapshot,\n  CanvasSectionSnapshot,\n  DeploymentStrategy,\n  EnvironmentRef,\n  UserRef,\n  ComponentRef,\n  CredentialRef,\n  ConnectivityRef,\n  ConnectivityProviderRef,\n  PlatformDataApi,\n  DeploymentSummary,\n  ValidateHandler,\n  DeployHandler,\n  RollbackHandler,\n  HealthCheckHandler,\n  DriftDetectHandler,\n  GetStatusHandler,\n} from './types/pipeline'\n\n// Platform types\nexport type {\n  Component,\n  Credential,\n  Connectivity,\n  Tag,\n  User,\n  Customer,\n  PlatformDatabaseClient,\n  AppHookContext,\n  AppRouteContext,\n} from './types/platform'\n\n// App UI & navigation contract\nexport { APP_PAGE_LAYOUTS, APP_PAGE_NAV } from './types/manifest'\nexport type { AppPageLayout, AppPageNav, AppPagePermission } from './types/manifest'\n\n// Manifest types\nexport type {\n  AppManifest,\n  AppBrandingDeclaration,\n  AppConfigurationTypeManifest,\n  AppPermissionDeclaration,\n  AppPageDeclaration,\n  AppSettingDeclaration,\n  AppSource,\n  AppStatusType,\n  AppInstallationStatus,\n  AppListItem,\n  AppDetail,\n  AppInstallationDetail,\n} from './types/manifest'\n\n// Canonical app layout\nexport { APP_LAYOUT, HANDLER_NAMES, conventionalPaths } from './structure'\nexport type { HandlerName } from './structure'\n\n// Hooks types\nexport type { AppContextValue, PipelineStatusData } from './hooks'\n","import type { PipelineContext, ValidationResult } from '../types/pipeline'\n\n/**\n * Define a validation handler for a configuration type.\n *\n * @example\n * ```ts\n * import { defineValidator } from '@veltrixsecops/app-sdk/pipeline'\n *\n * export default defineValidator(async (ctx) => {\n *   const errors = []\n *   const name = ctx.canvas.sections[0]?.fields['name']\n *   if (!name) {\n *     errors.push({ field: 'name', message: 'Name is required', code: 'REQUIRED' })\n *   }\n *   return { valid: errors.length === 0, errors, warnings: [] }\n * })\n * ```\n */\nexport function defineValidator(\n  handler: (ctx: PipelineContext) => Promise<ValidationResult>,\n): (ctx: PipelineContext) => Promise<ValidationResult> {\n  return handler\n}\n","import type { DeployContext, DeployResult } from '../types/pipeline'\n\n/**\n * Define a deploy handler for a configuration type.\n *\n * @example\n * ```ts\n * import { defineDeployer } from '@veltrixsecops/app-sdk/pipeline'\n *\n * export default defineDeployer(async (ctx) => {\n *   const { component, credential, connectivity, canvas } = ctx\n *   // Push configuration to the tool\n *   return { success: true, message: 'Deployed', rollbackData: previousState }\n * })\n * ```\n */\nexport function defineDeployer(\n  handler: (ctx: DeployContext) => Promise<DeployResult>,\n): (ctx: DeployContext) => Promise<DeployResult> {\n  return handler\n}\n","import type { RollbackContext, RollbackResult } from '../types/pipeline'\n\n/**\n * Define a rollback handler for a configuration type.\n */\nexport function defineRollbackHandler(\n  handler: (ctx: RollbackContext) => Promise<RollbackResult>,\n): (ctx: RollbackContext) => Promise<RollbackResult> {\n  return handler\n}\n","import type { HealthCheckContext, HealthCheckResult } from '../types/pipeline'\n\n/**\n * Define a health check handler for a configuration type.\n */\nexport function defineHealthChecker(\n  handler: (ctx: HealthCheckContext) => Promise<HealthCheckResult>,\n): (ctx: HealthCheckContext) => Promise<HealthCheckResult> {\n  return handler\n}\n","import type { DriftContext, DriftResult } from '../types/pipeline'\n\n/**\n * Define a drift detection handler for a configuration type.\n */\nexport function defineDriftDetector(\n  handler: (ctx: DriftContext) => Promise<DriftResult>,\n): (ctx: DriftContext) => Promise<DriftResult> {\n  return handler\n}\n","// ========================================================================\n// App manifest types\n//\n// Self-contained copy of the platform's manifest contract so the SDK can\n// be published and consumed outside the platform monorepo. The platform\n// keeps its own copy in shared/types/app.ts — changes to the manifest\n// contract must be applied to both files.\n// ========================================================================\n\nexport type AppSource = 'BUILT_IN' | 'MARKETPLACE' | 'CUSTOM'\nexport type AppStatusType = 'AVAILABLE' | 'DEPRECATED' | 'REMOVED'\nexport type AppInstallationStatus =\n  | 'INSTALLING'\n  | 'INSTALLED'\n  | 'ENABLED'\n  | 'DISABLED'\n  | 'FAILED'\n  | 'UNINSTALLING'\n\n// --- Manifest Types (parsed from manifest.yaml) ---\n\nexport interface AppManifest {\n  id: string\n  name: string\n  version: string\n  vendor: string\n  description: string\n  category: string\n  license?: string\n  homepage?: string\n  icon?: string\n  logo?: string\n\n  platform: {\n    minVersion: string\n  }\n\n  permissions: {\n    platform: string[] // Platform permissions the app needs\n    app: AppPermissionDeclaration[] // Permissions the app exposes\n  }\n\n  database?: {\n    migrations: string\n    tablePrefix: string\n  }\n\n  pipeline: {\n    configurationTypes: AppConfigurationTypeManifest[]\n    pipelineEvents?: string[]\n  }\n\n  server: {\n    entry: string\n    routes?: {\n      prefix: string\n    }\n  }\n\n  client?: {\n    entry: string\n    pages?: AppPageDeclaration[]\n  }\n\n  /**\n   * Vendor brand identity, applied by the platform in defined slots only —\n   * the app navbar (logo, accent) and scoped CSS variables. The platform,\n   * not the app, decides where brand color appears, so one vendor's palette\n   * never overwhelms the product shell.\n   */\n  branding?: AppBrandingDeclaration\n\n  hooks?: {\n    onInstall?: string\n    onUninstall?: string\n    onEnable?: string\n    onDisable?: string\n    onUpgrade?: string\n  }\n\n  events?: string[] // Platform events this app subscribes to\n\n  settings?: AppSettingDeclaration[]\n}\n\n/**\n * App brand identity. The platform renders it in a per-app navbar above the\n * app's pages and exposes the colors to app pages as scoped CSS variables\n * (--veltrix-app-primary, --veltrix-app-accent).\n */\nexport interface AppBrandingDeclaration {\n  /** Brand accent color as #RGB or #RRGGBB hex (e.g. CrowdStrike red). */\n  primaryColor?: string\n  /** Optional secondary color as #RGB or #RRGGBB hex. */\n  accentColor?: string\n  /**\n   * Vendor logo shown in the app navbar. Repo-relative .svg (preferred) or\n   * .png, at most 128 KB; rendered at 28px height, so use a wide/landscape\n   * mark with transparent background.\n   */\n  logo?: string\n  /** Optional logo variant for dark backgrounds; same constraints as logo. */\n  logoDark?: string\n}\n\nexport interface AppConfigurationTypeManifest {\n  id: string\n  name: string\n  description?: string\n  canvasTemplate: string // Path to canvas template YAML\n  defaultConfig?: string // Path to default config YAML\n\n  handlers: {\n    validate: string\n    deploy: string\n    rollback: string\n    healthCheck: string\n    driftDetect?: string | null\n    getStatus: string\n  }\n\n  targets: {\n    componentTypes: string[]\n    requiresCredential: boolean\n    requiresConnectivity: boolean\n  }\n}\n\nexport interface AppPermissionDeclaration {\n  resource: string\n  actions: string[]\n  description?: string\n}\n\n// --- App UI & navigation contract ---\n//\n// The platform owns the chrome: breadcrumb, app header, navigation, permission\n// gating, error boundary and loading states are rendered identically for every\n// app. Apps own the page body and compose it from @veltrixsecops/ui.\n// Predictable shell, flexible body.\n\n/**\n * How the platform frames an app page.\n * - `standard`   — page header + padded content area (default; use for most pages)\n * - `full-bleed` — content area with no padding/toolbar (custom canvases, maps)\n * - `canvas`     — Configuration Canvas chrome (section rail + save/validate bar)\n */\nexport type AppPageLayout = 'standard' | 'full-bleed' | 'canvas'\nexport const APP_PAGE_LAYOUTS = ['standard', 'full-bleed', 'canvas'] as const\n\n/**\n * Where the page surfaces in navigation.\n * - `sidebar` — an entry beneath the app in the sidebar\n * - `tab`     — a tab within its `parent` page\n * - `hidden`  — routable but not linked (details/drill-down pages)\n */\nexport type AppPageNav = 'sidebar' | 'tab' | 'hidden'\nexport const APP_PAGE_NAV = ['sidebar', 'tab', 'hidden'] as const\n\n/** An app-scoped permission (declared in `permissions.app`) required to see a page. */\nexport interface AppPagePermission {\n  resource: string\n  action: string\n}\n\nexport interface AppPageDeclaration {\n  /** Route beneath the app, e.g. `/indexes` → `/apps/<app-id>/indexes` */\n  path: string\n  /** Exported component name from the app's client entry */\n  component: string\n  label: string\n  description?: string\n  /** Icon name from the platform icon set; falls back to the app icon */\n  icon?: string\n  /** @deprecated use `nav: 'sidebar' | 'hidden'` — kept for backward compatibility */\n  sidebar?: boolean\n  /** Navigation placement. Defaults to `sidebar` when `sidebar: true`, else `hidden`. */\n  nav?: AppPageNav\n  /** Parent page `path` — required for `nav: 'tab'`, optional nesting for sidebar entries */\n  parent?: string\n  /** Optional sidebar section label, for apps with many pages */\n  group?: string\n  /** Deterministic ordering within its group/parent (ascending; ties break on label) */\n  order?: number\n  /** Layout preset the platform renders around the page body */\n  layout?: AppPageLayout\n  /** Hide the page (and its nav entry) unless the user holds this app permission */\n  requiresPermission?: AppPagePermission\n}\n\nexport interface AppSettingDeclaration {\n  key: string\n  type: 'string' | 'number' | 'boolean' | 'select'\n  label: string\n  description?: string\n  default?: string | number | boolean\n  required?: boolean\n  options?: Array<{ label: string; value: string }>\n}\n\n// --- API Response Types ---\n\nexport interface AppListItem {\n  id: string\n  appId: string\n  name: string\n  version: string\n  vendor: string\n  description: string\n  category: string\n  icon?: string\n  logo?: string\n  source: AppSource\n  isDefault: boolean\n  status: AppStatusType\n  installed?: boolean\n  enabled?: boolean\n}\n\nexport interface AppDetail extends AppListItem {\n  license?: string\n  homepage?: string\n  repository?: string\n  configurationTypes: Array<{\n    id: string\n    name: string\n    description?: string\n    componentTypes: string[]\n  }>\n  permissions: AppPermissionDeclaration[]\n  settings: AppSettingDeclaration[]\n}\n\nexport interface AppInstallationDetail {\n  id: string\n  appId: string\n  customerId: string\n  version: string\n  enabled: boolean\n  installedBy: string\n  installedAt: string\n  settings: Record<string, unknown>\n  status: AppInstallationStatus\n  app: AppListItem\n}\n","// ========================================================================\n// Canonical app layout\n//\n// Every Veltrix app follows one predictable folder structure so apps are\n// easy to set up, review, and load. The `veltrix` CLI scaffolds it,\n// `veltrix validate` (and repo CI) warn on deviations, and the platform's\n// app engine resolves manifest references against it.\n// ========================================================================\n\n/** Canonical locations inside an app directory. */\nexport const APP_LAYOUT = {\n  /** The app contract. Always at the app root. */\n  manifest: 'manifest.yaml',\n  /**\n   * The unit of extension: config-types/<configTypeId>/ colocates everything\n   * for one configuration type — canvas.yaml, defaults.yaml, the six pipeline\n   * handlers (extensionless in the manifest), and __tests__/.\n   */\n  configTypesDir: 'config-types',\n  /** Canvas form schema filename inside a config-type folder. */\n  canvasFile: 'canvas.yaml',\n  /** Default field values filename inside a config-type folder. */\n  defaultsFile: 'defaults.yaml',\n  /** Lifecycle hooks (camelCase): hooks/onInstall, hooks/onUninstall, ... */\n  hooksDir: 'hooks',\n  /** Shared app code used by multiple handlers (API clients, parsers). */\n  libDir: 'lib',\n  /** SQL migrations (requires manifest `database.tablePrefix`). */\n  migrationsDir: 'migrations',\n  /** Fastify route module receiving (fastify, AppRouteContext). */\n  serverEntry: 'server/index',\n  /** Client entry registering pages/sidebar items (optional). */\n  clientEntry: 'client/index',\n  /** Icons and logos (optional). */\n  assetsDir: 'assets',\n  /** Tests live next to the code they cover: handlers/<id>/__tests__/ */\n  testsDirName: '__tests__',\n} as const\n\n/** The six pipeline handler names, in lifecycle order. */\nexport const HANDLER_NAMES = [\n  'validate',\n  'deploy',\n  'rollback',\n  'healthCheck',\n  'driftDetect',\n  'getStatus',\n] as const\n\nexport type HandlerName = (typeof HANDLER_NAMES)[number]\n\n/**\n * Conventional manifest paths for one configuration type — handy when\n * generating or checking a manifest programmatically.\n *\n * @example\n * conventionalPaths('indexes').handlers.deploy // 'config-types/indexes/deploy'\n */\nexport function conventionalPaths(configTypeId: string): {\n  canvasTemplate: string\n  defaultConfig: string\n  handlers: Record<HandlerName, string>\n} {\n  const base = `${APP_LAYOUT.configTypesDir}/${configTypeId}`\n  const handlers = {} as Record<HandlerName, string>\n  for (const name of HANDLER_NAMES) {\n    handlers[name] = `${base}/${name}`\n  }\n  return {\n    canvasTemplate: `${base}/${APP_LAYOUT.canvasFile}`,\n    defaultConfig: `${base}/${APP_LAYOUT.defaultsFile}`,\n    handlers,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACmBO,SAAS,gBACd,SACqD;AACrD,SAAO;AACT;;;ACPO,SAAS,eACd,SAC+C;AAC/C,SAAO;AACT;;;ACfO,SAAS,sBACd,SACmD;AACnD,SAAO;AACT;;;ACJO,SAAS,oBACd,SACyD;AACzD,SAAO;AACT;;;ACJO,SAAS,oBACd,SAC6C;AAC7C,SAAO;AACT;;;AC2IO,IAAM,mBAAmB,CAAC,YAAY,cAAc,QAAQ;AAS5D,IAAM,eAAe,CAAC,WAAW,OAAO,QAAQ;;;ACnJhD,IAAM,aAAa;AAAA;AAAA,EAExB,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMV,gBAAgB;AAAA;AAAA,EAEhB,YAAY;AAAA;AAAA,EAEZ,cAAc;AAAA;AAAA,EAEd,UAAU;AAAA;AAAA,EAEV,QAAQ;AAAA;AAAA,EAER,eAAe;AAAA;AAAA,EAEf,aAAa;AAAA;AAAA,EAEb,aAAa;AAAA;AAAA,EAEb,WAAW;AAAA;AAAA,EAEX,cAAc;AAChB;AAGO,IAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAWO,SAAS,kBAAkB,cAIhC;AACA,QAAM,OAAO,GAAG,WAAW,cAAc,IAAI,YAAY;AACzD,QAAM,WAAW,CAAC;AAClB,aAAW,QAAQ,eAAe;AAChC,aAAS,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI;AAAA,EAClC;AACA,SAAO;AAAA,IACL,gBAAgB,GAAG,IAAI,IAAI,WAAW,UAAU;AAAA,IAChD,eAAe,GAAG,IAAI,IAAI,WAAW,YAAY;AAAA,IACjD;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/pipeline/define-validator.ts","../src/pipeline/define-deployer.ts","../src/pipeline/define-rollback-handler.ts","../src/pipeline/define-health-checker.ts","../src/pipeline/define-drift-detector.ts","../src/types/manifest.ts","../src/structure.ts"],"sourcesContent":["// ========================================================================\n// @veltrixsecops/app-sdk\n//\n// The official SDK for building Veltrix Security-as-Code apps.\n//\n// This root entry is REACT-FREE and safe to load in a bare Node process.\n// Pipeline handlers execute inside the platform's sandbox runner — a child\n// process with a scrubbed environment and no React — so the contract they\n// import must never pull in a UI dependency. (Before 2.0 this entry\n// re-exported the React hooks, which made `require('@veltrixsecops/app-sdk')`\n// load React.) The platform can therefore import HANDLER_NAMES and the\n// handler contracts directly, instead of mirroring them server-side.\n//\n// Usage:\n//   import type { PipelineContext, DeployContext } from '@veltrixsecops/app-sdk'\n//   import { HANDLER_NAMES, conventionalPaths } from '@veltrixsecops/app-sdk'\n//   import { defineValidator, defineDeployer } from '@veltrixsecops/app-sdk/pipeline'\n//   import { useAppContext, usePipelineStatus } from '@veltrixsecops/app-sdk/hooks'   // React\n//   import { authFetch } from '@veltrixsecops/app-sdk/client'                          // browser\n// ========================================================================\n\n// Pipeline handler helpers (React-free)\nexport {\n  defineValidator,\n  defineDeployer,\n  defineRollbackHandler,\n  defineHealthChecker,\n  defineDriftDetector,\n} from './pipeline'\n\n// NOTE: React hooks are NOT re-exported here. Import them from\n// '@veltrixsecops/app-sdk/hooks'; browser client helpers live in\n// '@veltrixsecops/app-sdk/client'. Keeping them off the root is what makes\n// this entry loadable in the sandbox runner's bare Node child process.\n\n// Pipeline types\nexport type {\n  PipelineContext,\n  DeployContext,\n  RollbackContext,\n  HealthCheckContext,\n  DriftContext,\n  ValidationResult,\n  ValidationError,\n  ValidationWarning,\n  DeployResult,\n  RollbackResult,\n  HealthCheckResult,\n  HealthCheck,\n  DriftResult,\n  DriftDiff,\n  ConfigStatus,\n  ComponentConfigStatus,\n  CanvasSnapshot,\n  CanvasSectionSnapshot,\n  DeploymentStrategy,\n  EnvironmentRef,\n  UserRef,\n  ComponentRef,\n  CredentialRef,\n  ConnectivityRef,\n  ConnectivityProviderRef,\n  PlatformDataApi,\n  DeploymentSummary,\n  ValidateHandler,\n  DeployHandler,\n  RollbackHandler,\n  HealthCheckHandler,\n  DriftDetectHandler,\n  GetStatusHandler,\n} from './types/pipeline'\n\n// Platform types\nexport type {\n  Component,\n  InventoryItem,\n  InventoryItemInput,\n  Credential,\n  Connectivity,\n  Tag,\n  User,\n  Customer,\n  PlatformDatabaseClient,\n  AppHookContext,\n  AppRouteContext,\n} from './types/platform'\n\n// App UI & navigation contract\nexport { APP_PAGE_LAYOUTS, APP_PAGE_NAV } from './types/manifest'\nexport type { AppPageLayout, AppPageNav, AppPagePermission } from './types/manifest'\n\n// Manifest types\nexport type {\n  AppManifest,\n  AppBrandingDeclaration,\n  AppConfigurationTypeManifest,\n  AppPermissionDeclaration,\n  AppPageDeclaration,\n  AppSettingDeclaration,\n  AppSource,\n  AppStatusType,\n  AppInstallationStatus,\n  AppListItem,\n  AppDetail,\n  AppInstallationDetail,\n} from './types/manifest'\n\n// Canonical app layout\nexport { APP_LAYOUT, HANDLER_NAMES, conventionalPaths } from './structure'\nexport type { HandlerName } from './structure'\n\n// Hooks types\nexport type { AppContextValue, PipelineStatusData } from './hooks'\n","import type { PipelineContext, ValidationResult } from '../types/pipeline'\n\n/**\n * Define a validation handler for a configuration type.\n *\n * @example\n * ```ts\n * import { defineValidator } from '@veltrixsecops/app-sdk/pipeline'\n *\n * export default defineValidator(async (ctx) => {\n *   const errors = []\n *   const name = ctx.canvas.sections[0]?.fields['name']\n *   if (!name) {\n *     errors.push({ field: 'name', message: 'Name is required', code: 'REQUIRED' })\n *   }\n *   return { valid: errors.length === 0, errors, warnings: [] }\n * })\n * ```\n */\nexport function defineValidator(\n  handler: (ctx: PipelineContext) => Promise<ValidationResult>,\n): (ctx: PipelineContext) => Promise<ValidationResult> {\n  return handler\n}\n","import type { DeployContext, DeployResult } from '../types/pipeline'\n\n/**\n * Define a deploy handler for a configuration type.\n *\n * @example\n * ```ts\n * import { defineDeployer } from '@veltrixsecops/app-sdk/pipeline'\n *\n * export default defineDeployer(async (ctx) => {\n *   const { component, credential, connectivity, canvas } = ctx\n *   // Push configuration to the tool\n *   return { success: true, message: 'Deployed', rollbackData: previousState }\n * })\n * ```\n */\nexport function defineDeployer(\n  handler: (ctx: DeployContext) => Promise<DeployResult>,\n): (ctx: DeployContext) => Promise<DeployResult> {\n  return handler\n}\n","import type { RollbackContext, RollbackResult } from '../types/pipeline'\n\n/**\n * Define a rollback handler for a configuration type.\n */\nexport function defineRollbackHandler(\n  handler: (ctx: RollbackContext) => Promise<RollbackResult>,\n): (ctx: RollbackContext) => Promise<RollbackResult> {\n  return handler\n}\n","import type { HealthCheckContext, HealthCheckResult } from '../types/pipeline'\n\n/**\n * Define a health check handler for a configuration type.\n */\nexport function defineHealthChecker(\n  handler: (ctx: HealthCheckContext) => Promise<HealthCheckResult>,\n): (ctx: HealthCheckContext) => Promise<HealthCheckResult> {\n  return handler\n}\n","import type { DriftContext, DriftResult } from '../types/pipeline'\n\n/**\n * Define a drift detection handler for a configuration type.\n */\nexport function defineDriftDetector(\n  handler: (ctx: DriftContext) => Promise<DriftResult>,\n): (ctx: DriftContext) => Promise<DriftResult> {\n  return handler\n}\n","// ========================================================================\n// App manifest types\n//\n// Self-contained copy of the platform's manifest contract so the SDK can\n// be published and consumed outside the platform monorepo. The platform\n// keeps its own copy in shared/types/app.ts — changes to the manifest\n// contract must be applied to both files.\n// ========================================================================\n\nexport type AppSource = 'BUILT_IN' | 'MARKETPLACE' | 'CUSTOM'\nexport type AppStatusType = 'AVAILABLE' | 'DEPRECATED' | 'REMOVED'\nexport type AppInstallationStatus =\n  | 'INSTALLING'\n  | 'INSTALLED'\n  | 'ENABLED'\n  | 'DISABLED'\n  | 'FAILED'\n  | 'UNINSTALLING'\n\n// --- Manifest Types (parsed from manifest.yaml) ---\n\nexport interface AppManifest {\n  id: string\n  name: string\n  version: string\n  vendor: string\n  description: string\n  category: string\n  license?: string\n  homepage?: string\n  icon?: string\n  logo?: string\n\n  platform: {\n    minVersion: string\n  }\n\n  permissions: {\n    platform: string[] // Platform permissions the app needs\n    app: AppPermissionDeclaration[] // Permissions the app exposes\n  }\n\n  database?: {\n    migrations: string\n    tablePrefix: string\n  }\n\n  pipeline: {\n    configurationTypes: AppConfigurationTypeManifest[]\n    pipelineEvents?: string[]\n  }\n\n  server: {\n    entry: string\n    routes?: {\n      prefix: string\n    }\n  }\n\n  client?: {\n    entry: string\n    pages?: AppPageDeclaration[]\n    /**\n     * How the platform lays out this app's navigation (its client pages and\n     * one entry per configuration type):\n     *   - 'tabs' (default): a horizontal tab strip — best for a few items.\n     *   - 'sidebar': an embedded left rail, grouped into Pages and\n     *     Configurations — scales to many configuration types without the\n     *     tab strip overflowing.\n     */\n    navLayout?: 'tabs' | 'sidebar'\n  }\n\n  /**\n   * Vendor brand identity, applied by the platform in defined slots only —\n   * the app navbar (logo, accent) and scoped CSS variables. The platform,\n   * not the app, decides where brand color appears, so one vendor's palette\n   * never overwhelms the product shell.\n   */\n  branding?: AppBrandingDeclaration\n\n  hooks?: {\n    onInstall?: string\n    onUninstall?: string\n    onEnable?: string\n    onDisable?: string\n    onUpgrade?: string\n  }\n\n  events?: string[] // Platform events this app subscribes to\n\n  settings?: AppSettingDeclaration[]\n}\n\n/**\n * App brand identity. The platform renders it in a per-app navbar above the\n * app's pages and exposes the colors to app pages as scoped CSS variables\n * (--veltrix-app-primary, --veltrix-app-accent).\n */\nexport interface AppBrandingDeclaration {\n  /** Brand accent color as #RGB or #RRGGBB hex (e.g. CrowdStrike red). */\n  primaryColor?: string\n  /** Optional secondary color as #RGB or #RRGGBB hex. */\n  accentColor?: string\n  /**\n   * Vendor logo shown in the app navbar. Repo-relative .svg (preferred) or\n   * .png, at most 128 KB; rendered at 28px height, so use a wide/landscape\n   * mark with transparent background.\n   */\n  logo?: string\n  /** Optional logo variant for dark backgrounds; same constraints as logo. */\n  logoDark?: string\n}\n\nexport interface AppConfigurationTypeManifest {\n  id: string\n  name: string\n  description?: string\n  canvasTemplate: string // Path to canvas template YAML\n  defaultConfig?: string // Path to default config YAML\n\n  handlers: {\n    validate: string\n    deploy: string\n    rollback: string\n    healthCheck: string\n    driftDetect?: string | null\n    getStatus: string\n  }\n\n  targets: {\n    componentTypes: string[]\n    requiresCredential: boolean\n    requiresConnectivity: boolean\n  }\n}\n\nexport interface AppPermissionDeclaration {\n  resource: string\n  actions: string[]\n  description?: string\n}\n\n// --- App UI & navigation contract ---\n//\n// The platform owns the chrome: breadcrumb, app header, navigation, permission\n// gating, error boundary and loading states are rendered identically for every\n// app. Apps own the page body and compose it from @veltrixsecops/ui.\n// Predictable shell, flexible body.\n\n/**\n * How the platform frames an app page.\n * - `standard`   — page header + padded content area (default; use for most pages)\n * - `full-bleed` — content area with no padding/toolbar (custom canvases, maps)\n * - `canvas`     — Configuration Canvas chrome (section rail + save/validate bar)\n */\nexport type AppPageLayout = 'standard' | 'full-bleed' | 'canvas'\nexport const APP_PAGE_LAYOUTS = ['standard', 'full-bleed', 'canvas'] as const\n\n/**\n * Where the page surfaces in navigation.\n * - `sidebar` — an entry beneath the app in the sidebar\n * - `tab`     — a tab within its `parent` page\n * - `hidden`  — routable but not linked (details/drill-down pages)\n */\nexport type AppPageNav = 'sidebar' | 'tab' | 'hidden'\nexport const APP_PAGE_NAV = ['sidebar', 'tab', 'hidden'] as const\n\n/** An app-scoped permission (declared in `permissions.app`) required to see a page. */\nexport interface AppPagePermission {\n  resource: string\n  action: string\n}\n\nexport interface AppPageDeclaration {\n  /** Route beneath the app, e.g. `/indexes` → `/apps/<app-id>/indexes` */\n  path: string\n  /** Exported component name from the app's client entry */\n  component: string\n  label: string\n  description?: string\n  /** Icon name from the platform icon set; falls back to the app icon */\n  icon?: string\n  /** @deprecated use `nav: 'sidebar' | 'hidden'` — kept for backward compatibility */\n  sidebar?: boolean\n  /** Navigation placement. Defaults to `sidebar` when `sidebar: true`, else `hidden`. */\n  nav?: AppPageNav\n  /** Parent page `path` — required for `nav: 'tab'`, optional nesting for sidebar entries */\n  parent?: string\n  /** Optional sidebar section label, for apps with many pages */\n  group?: string\n  /** Deterministic ordering within its group/parent (ascending; ties break on label) */\n  order?: number\n  /** Layout preset the platform renders around the page body */\n  layout?: AppPageLayout\n  /** Hide the page (and its nav entry) unless the user holds this app permission */\n  requiresPermission?: AppPagePermission\n}\n\nexport interface AppSettingDeclaration {\n  key: string\n  type: 'string' | 'number' | 'boolean' | 'select'\n  label: string\n  description?: string\n  default?: string | number | boolean\n  required?: boolean\n  options?: Array<{ label: string; value: string }>\n}\n\n// --- API Response Types ---\n\nexport interface AppListItem {\n  id: string\n  appId: string\n  name: string\n  version: string\n  vendor: string\n  description: string\n  category: string\n  icon?: string\n  logo?: string\n  source: AppSource\n  isDefault: boolean\n  status: AppStatusType\n  installed?: boolean\n  enabled?: boolean\n}\n\nexport interface AppDetail extends AppListItem {\n  license?: string\n  homepage?: string\n  repository?: string\n  configurationTypes: Array<{\n    id: string\n    name: string\n    description?: string\n    componentTypes: string[]\n  }>\n  permissions: AppPermissionDeclaration[]\n  settings: AppSettingDeclaration[]\n}\n\nexport interface AppInstallationDetail {\n  id: string\n  appId: string\n  customerId: string\n  version: string\n  enabled: boolean\n  installedBy: string\n  installedAt: string\n  settings: Record<string, unknown>\n  status: AppInstallationStatus\n  app: AppListItem\n}\n","// ========================================================================\n// Canonical app layout\n//\n// Every Veltrix app follows one predictable folder structure so apps are\n// easy to set up, review, and load. The `veltrix` CLI scaffolds it,\n// `veltrix validate` (and repo CI) warn on deviations, and the platform's\n// app engine resolves manifest references against it.\n// ========================================================================\n\n/** Canonical locations inside an app directory. */\nexport const APP_LAYOUT = {\n  /** The app contract. Always at the app root. */\n  manifest: 'manifest.yaml',\n  /**\n   * The unit of extension: config-types/<configTypeId>/ colocates everything\n   * for one configuration type — canvas.yaml, defaults.yaml, the six pipeline\n   * handlers (extensionless in the manifest), and __tests__/.\n   */\n  configTypesDir: 'config-types',\n  /** Canvas form schema filename inside a config-type folder. */\n  canvasFile: 'canvas.yaml',\n  /** Default field values filename inside a config-type folder. */\n  defaultsFile: 'defaults.yaml',\n  /** Lifecycle hooks (camelCase): hooks/onInstall, hooks/onUninstall, ... */\n  hooksDir: 'hooks',\n  /** Shared app code used by multiple handlers (API clients, parsers). */\n  libDir: 'lib',\n  /** SQL migrations (requires manifest `database.tablePrefix`). */\n  migrationsDir: 'migrations',\n  /** Fastify route module receiving (fastify, AppRouteContext). */\n  serverEntry: 'server/index',\n  /** Client entry registering pages/sidebar items (optional). */\n  clientEntry: 'client/index',\n  /** Icons and logos (optional). */\n  assetsDir: 'assets',\n  /** Tests live next to the code they cover: handlers/<id>/__tests__/ */\n  testsDirName: '__tests__',\n} as const\n\n/** The six pipeline handler names, in lifecycle order. */\nexport const HANDLER_NAMES = [\n  'validate',\n  'deploy',\n  'rollback',\n  'healthCheck',\n  'driftDetect',\n  'getStatus',\n] as const\n\nexport type HandlerName = (typeof HANDLER_NAMES)[number]\n\n/**\n * Conventional manifest paths for one configuration type — handy when\n * generating or checking a manifest programmatically.\n *\n * @example\n * conventionalPaths('indexes').handlers.deploy // 'config-types/indexes/deploy'\n */\nexport function conventionalPaths(configTypeId: string): {\n  canvasTemplate: string\n  defaultConfig: string\n  handlers: Record<HandlerName, string>\n} {\n  const base = `${APP_LAYOUT.configTypesDir}/${configTypeId}`\n  const handlers = {} as Record<HandlerName, string>\n  for (const name of HANDLER_NAMES) {\n    handlers[name] = `${base}/${name}`\n  }\n  return {\n    canvasTemplate: `${base}/${APP_LAYOUT.canvasFile}`,\n    defaultConfig: `${base}/${APP_LAYOUT.defaultsFile}`,\n    handlers,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACmBO,SAAS,gBACd,SACqD;AACrD,SAAO;AACT;;;ACPO,SAAS,eACd,SAC+C;AAC/C,SAAO;AACT;;;ACfO,SAAS,sBACd,SACmD;AACnD,SAAO;AACT;;;ACJO,SAAS,oBACd,SACyD;AACzD,SAAO;AACT;;;ACJO,SAAS,oBACd,SAC6C;AAC7C,SAAO;AACT;;;ACoJO,IAAM,mBAAmB,CAAC,YAAY,cAAc,QAAQ;AAS5D,IAAM,eAAe,CAAC,WAAW,OAAO,QAAQ;;;AC5JhD,IAAM,aAAa;AAAA;AAAA,EAExB,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMV,gBAAgB;AAAA;AAAA,EAEhB,YAAY;AAAA;AAAA,EAEZ,cAAc;AAAA;AAAA,EAEd,UAAU;AAAA;AAAA,EAEV,QAAQ;AAAA;AAAA,EAER,eAAe;AAAA;AAAA,EAEf,aAAa;AAAA;AAAA,EAEb,aAAa;AAAA;AAAA,EAEb,WAAW;AAAA;AAAA,EAEX,cAAc;AAChB;AAGO,IAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAWO,SAAS,kBAAkB,cAIhC;AACA,QAAM,OAAO,GAAG,WAAW,cAAc,IAAI,YAAY;AACzD,QAAM,WAAW,CAAC;AAClB,aAAW,QAAQ,eAAe;AAChC,aAAS,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI;AAAA,EAClC;AACA,SAAO;AAAA,IACL,gBAAgB,GAAG,IAAI,IAAI,WAAW,UAAU;AAAA,IAChD,eAAe,GAAG,IAAI,IAAI,WAAW,YAAY;AAAA,IACjD;AAAA,EACF;AACF;","names":[]}

package/dist/index.d.cts

@@ -1,5 +1,5 @@
 export { C as CanvasSectionSnapshot, a as CanvasSnapshot, b as ComponentConfigStatus, c as ComponentRef, d as ConfigStatus, e as ConnectivityProviderRef, f as ConnectivityRef, g as CredentialRef, D as DeployContext, h as DeployHandler, i as DeployResult, j as DeploymentStrategy, k as DeploymentSummary, l as DriftContext, m as DriftDetectHandler, n as DriftDiff, o as DriftResult, E as EnvironmentRef, G as GetStatusHandler, H as HealthCheck, p as HealthCheckContext, q as HealthCheckHandler, r as HealthCheckResult, P as PipelineContext, s as PlatformDataApi, R as RollbackContext, t as RollbackHandler, u as RollbackResult, U as UserRef, V as ValidateHandler, v as ValidationError, w as ValidationResult, x as ValidationWarning, y as defineDeployer, z as defineDriftDetector, A as defineHealthChecker, B as defineRollbackHandler, F as defineValidator } from './index-CKeIf4Jx.cjs';
-export { c as APP_PAGE_LAYOUTS, d as APP_PAGE_NAV, a as AppBrandingDeclaration, e as AppConfigurationTypeManifest, A as AppContextValue, f as AppDetail, g as AppHookContext, h as AppInstallationDetail, i as AppInstallationStatus, j as AppListItem, k as AppManifest, l as AppPageDeclaration, m as AppPageLayout, n as AppPageNav, o as AppPagePermission, p as AppPermissionDeclaration, q as AppRouteContext, r as AppSettingDeclaration, s as AppSource, t as AppStatusType, C as Component, v as Connectivity, w as Credential, x as Customer, P as PlatformDatabaseClient, T as Tag, U as User } from './use-app-context-CQq7ZaXo.cjs';
+export { c as APP_PAGE_LAYOUTS, d as APP_PAGE_NAV, A as AppBrandingDeclaration, e as AppConfigurationTypeManifest, b as AppContextValue, f as AppDetail, g as AppHookContext, h as AppInstallationDetail, i as AppInstallationStatus, j as AppListItem, k as AppManifest, l as AppPageDeclaration, m as AppPageLayout, n as AppPageNav, o as AppPagePermission, p as AppPermissionDeclaration, q as AppRouteContext, r as AppSettingDeclaration, s as AppSource, t as AppStatusType, C as Component, v as Connectivity, w as Credential, x as Customer, I as InventoryItem, y as InventoryItemInput, P as PlatformDatabaseClient, T as Tag, U as User } from './use-app-context-Dh1S28Cv.cjs';
 export { P as PipelineStatusData } from './use-pipeline-status-CCSQ9Neh.cjs';
 import 'react';
 

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { C as CanvasSectionSnapshot, a as CanvasSnapshot, b as ComponentConfigStatus, c as ComponentRef, d as ConfigStatus, e as ConnectivityProviderRef, f as ConnectivityRef, g as CredentialRef, D as DeployContext, h as DeployHandler, i as DeployResult, j as DeploymentStrategy, k as DeploymentSummary, l as DriftContext, m as DriftDetectHandler, n as DriftDiff, o as DriftResult, E as EnvironmentRef, G as GetStatusHandler, H as HealthCheck, p as HealthCheckContext, q as HealthCheckHandler, r as HealthCheckResult, P as PipelineContext, s as PlatformDataApi, R as RollbackContext, t as RollbackHandler, u as RollbackResult, U as UserRef, V as ValidateHandler, v as ValidationError, w as ValidationResult, x as ValidationWarning, y as defineDeployer, z as defineDriftDetector, A as defineHealthChecker, B as defineRollbackHandler, F as defineValidator } from './index-CKeIf4Jx.js';
-export { c as APP_PAGE_LAYOUTS, d as APP_PAGE_NAV, a as AppBrandingDeclaration, e as AppConfigurationTypeManifest, A as AppContextValue, f as AppDetail, g as AppHookContext, h as AppInstallationDetail, i as AppInstallationStatus, j as AppListItem, k as AppManifest, l as AppPageDeclaration, m as AppPageLayout, n as AppPageNav, o as AppPagePermission, p as AppPermissionDeclaration, q as AppRouteContext, r as AppSettingDeclaration, s as AppSource, t as AppStatusType, C as Component, v as Connectivity, w as Credential, x as Customer, P as PlatformDatabaseClient, T as Tag, U as User } from './use-app-context-CQq7ZaXo.js';
+export { c as APP_PAGE_LAYOUTS, d as APP_PAGE_NAV, A as AppBrandingDeclaration, e as AppConfigurationTypeManifest, b as AppContextValue, f as AppDetail, g as AppHookContext, h as AppInstallationDetail, i as AppInstallationStatus, j as AppListItem, k as AppManifest, l as AppPageDeclaration, m as AppPageLayout, n as AppPageNav, o as AppPagePermission, p as AppPermissionDeclaration, q as AppRouteContext, r as AppSettingDeclaration, s as AppSource, t as AppStatusType, C as Component, v as Connectivity, w as Credential, x as Customer, I as InventoryItem, y as InventoryItemInput, P as PlatformDatabaseClient, T as Tag, U as User } from './use-app-context-Dh1S28Cv.js';
 export { P as PipelineStatusData } from './use-pipeline-status-CCSQ9Neh.js';
 import 'react';