@veltrixsecops/app-sdk 2.5.0 → 3.0.0

package/dist/{chunk-EVCWQYQY.js → chunk-NY6C4REE.js}

@@ -22,7 +22,8 @@ function toInventoryItem(raw) {
     domains: Array.isArray(raw.domains) ? raw.domains : [],
     ipRanges: Array.isArray(raw.ipRanges) ? raw.ipRanges : [],
     tags: Array.isArray(raw.tags) ? raw.tags.map((tag) => ({ id: String(tag.id), name: String(tag.name) })) : [],
-    connectivityProviderId: raw.connectivityProviderId ?? null
+    connectivityProviderId: raw.connectivityProviderId ?? null,
+    credentialId: raw.credentialId ?? null
   };
 }
 async function resolveTool(name) {
@@ -63,10 +64,9 @@ async function removeInventoryItem(id) {
   if (!res.ok && res.status !== 204) throw await inventoryError(res);
 }
 
-// src/client/access-servers.ts
-var ACCESS_SERVERS_API = "/api/access-servers";
+// src/client/connectivity.ts
 var CONNECTIVITY_PROVIDERS_API = "/api/connectivity-providers";
-async function accessServerError(res) {
+async function providerError(res) {
   const text = await res.text().catch(() => "");
   if (text) {
     try {
@@ -79,52 +79,9 @@ async function accessServerError(res) {
   }
   return new Error(`HTTP ${res.status}`);
 }
-function toAccessServer(raw) {
-  return {
-    id: String(raw.id),
-    name: raw.name ?? "",
-    endpoint: raw.endpoint ?? "",
-    type: raw.type ?? void 0,
-    region: raw.region ?? null,
-    status: raw.status ?? void 0,
-    description: raw.description ?? null,
-    connectivityProviderId: raw.connectivityProviderId ?? null,
-    connectivityProvider: raw.connectivityProvider ? { id: String(raw.connectivityProvider.id), name: String(raw.connectivityProvider.name) } : null
-  };
-}
-async function listAccessServers() {
-  const res = await authFetch(ACCESS_SERVERS_API);
-  if (!res.ok) throw await accessServerError(res);
-  const data = await res.json();
-  return Array.isArray(data) ? data.map(toAccessServer) : [];
-}
-async function addAccessServer(input) {
-  const res = await authFetch(ACCESS_SERVERS_API, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(input)
-  });
-  if (!res.ok) throw await accessServerError(res);
-  return toAccessServer(await res.json());
-}
-async function updateAccessServer(id, input) {
-  const res = await authFetch(`${ACCESS_SERVERS_API}/${encodeURIComponent(id)}`, {
-    method: "PUT",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(input)
-  });
-  if (!res.ok) throw await accessServerError(res);
-  return toAccessServer(await res.json());
-}
-async function removeAccessServer(id) {
-  const res = await authFetch(`${ACCESS_SERVERS_API}/${encodeURIComponent(id)}`, {
-    method: "DELETE"
-  });
-  if (!res.ok && res.status !== 204) throw await accessServerError(res);
-}
 async function listConnectivityProviders() {
   const res = await authFetch(CONNECTIVITY_PROVIDERS_API);
-  if (!res.ok) throw await accessServerError(res);
+  if (!res.ok) throw await providerError(res);
   const body = await res.json();
   const providers = Array.isArray(body) ? body : Array.isArray(body?.data) ? body.data : [];
   return providers.map((provider) => ({
@@ -151,12 +108,15 @@ async function credentialError(res) {
   return new Error(`HTTP ${res.status}`);
 }
 function toCredentialSummary(raw) {
-  const hasSecret = Boolean(raw.apiToken && raw.apiToken.length > 0 || raw.password && raw.password.length > 0);
+  const hasSecret = Boolean(
+    raw.hasApiToken || raw.hasPassword || raw.apiToken && raw.apiToken.length > 0 || raw.password && raw.password.length > 0
+  );
   return {
     id: String(raw.id),
     name: raw.name ?? "",
     username: raw.username ?? "",
     type: raw.type ?? null,
+    endpoint: raw.endpoint ?? null,
     toolId: raw.toolId ?? "",
     hasSecret
   };
@@ -178,6 +138,7 @@ async function createCredential(input) {
       password: input.password ?? "",
       apiToken: input.apiToken,
       type: input.type,
+      endpoint: input.endpoint,
       toolId: input.toolId,
       tagIds: input.tagIds ?? []
     })
@@ -193,6 +154,7 @@ async function updateCredential(id, input) {
   if (input.password !== void 0) body.password = input.password;
   if (input.apiToken !== void 0) body.apiToken = input.apiToken;
   if (input.type !== void 0) body.type = input.type;
+  if (input.endpoint !== void 0) body.endpoint = input.endpoint;
   if (input.tagIds !== void 0) body.tagIds = input.tagIds;
   const res = await authFetch(`${CREDENTIALS_API}/${encodeURIComponent(id)}`, {
     method: "PUT",
@@ -237,10 +199,6 @@ export {
   addInventoryItem,
   updateInventoryItem,
   removeInventoryItem,
-  listAccessServers,
-  addAccessServer,
-  updateAccessServer,
-  removeAccessServer,
   listConnectivityProviders,
   listCredentials,
   createCredential,
@@ -251,4 +209,4 @@ export {
   requireHostRuntime,
   authFetch
 };
-//# sourceMappingURL=chunk-EVCWQYQY.js.map
+//# sourceMappingURL=chunk-NY6C4REE.js.map

package/dist/chunk-NY6C4REE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client/inventory.ts","../src/client/connectivity.ts","../src/client/credentials.ts","../src/client/index.ts"],"sourcesContent":["// ========================================================================\n// Inventory — the deployment targets an app can deploy configuration to.\n//\n// \"Inventory\" is the app-facing name for the platform's *components*: the\n// servers (hostname/port), domains, and IP/CIDR ranges a customer has\n// registered as deploy targets. These helpers are a typed, convenient\n// surface over the platform's components API (/api/components), enriched\n// with `domains` and `ipRanges`.\n//\n// Framework-free (no React) — safe to import from any client code. Every\n// call goes through the same `authFetch` the '/client' subpath exports, so\n// requests carry the platform's Authorization header. Non-2xx responses are\n// surfaced as thrown Errors carrying the platform's error text.\n// ========================================================================\n\nimport type { InventoryItem, InventoryItemInput } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's components (inventory) API. */\nconst INVENTORY_API = '/api/components'\n\n/**\n * Loosely-typed shape of a raw component as returned by the platform, before\n * it is normalized down to the {@link InventoryItem} surface.\n */\ninterface RawInventoryItem {\n  id: string\n  hostname?: string\n  port?: string\n  type?: string[]\n  domains?: string[]\n  ipRanges?: string[]\n  tags?: Array<{ id: string; name: string }>\n  connectivityProviderId?: string | null\n  credentialId?: string | null\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function inventoryError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/** Normalize a raw platform component into the typed InventoryItem surface. */\nfunction toInventoryItem(raw: RawInventoryItem): InventoryItem {\n  return {\n    id: String(raw.id),\n    hostname: raw.hostname ?? '',\n    port: raw.port ?? undefined,\n    type: Array.isArray(raw.type) ? raw.type : undefined,\n    domains: Array.isArray(raw.domains) ? raw.domains : [],\n    ipRanges: Array.isArray(raw.ipRanges) ? raw.ipRanges : [],\n    tags: Array.isArray(raw.tags)\n      ? raw.tags.map((tag) => ({ id: String(tag.id), name: String(tag.name) }))\n      : [],\n    connectivityProviderId: raw.connectivityProviderId ?? null,\n    credentialId: raw.credentialId ?? null,\n  }\n}\n\n/**\n * A platform Tool. Each installed app is upserted as a Tool keyed by its\n * manifest `name`, and inventory items (components) belong to a tool.\n */\nexport interface Tool {\n  id: string\n  name: string\n  vendor?: string\n}\n\n/**\n * Resolve the platform Tool for an app by its manifest name (the platform\n * upserts `Tool.name === app name`). The tool id is required by the platform\n * when creating an inventory item, so call this once and pass the id as\n * `toolId` to {@link addInventoryItem}. Returns null when no tool matches.\n *\n * GET /api/tools (the endpoint is paginated — `{ data, pagination }` — or a\n * bare array; both are handled).\n */\nexport async function resolveTool(name: string): Promise<Tool | null> {\n  const res = await authFetch('/api/tools')\n  if (!res.ok) throw await inventoryError(res)\n  const body = (await res.json()) as unknown\n  const tools: Tool[] = Array.isArray(body)\n    ? (body as Tool[])\n    : Array.isArray((body as { data?: unknown })?.data)\n      ? ((body as { data: Tool[] }).data)\n      : []\n  return tools.find((tool) => tool.name === name) ?? null\n}\n\n/** List the customer's inventory (deployment targets). GET /api/components */\nexport async function listInventory(): Promise<InventoryItem[]> {\n  const res = await authFetch(INVENTORY_API)\n  if (!res.ok) throw await inventoryError(res)\n  const data = (await res.json()) as RawInventoryItem[]\n  return Array.isArray(data) ? data.map(toInventoryItem) : []\n}\n\n/** Add a new inventory item (deployment target). POST /api/components */\nexport async function addInventoryItem(input: InventoryItemInput): Promise<InventoryItem> {\n  const res = await authFetch(INVENTORY_API, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(input),\n  })\n  if (!res.ok) throw await inventoryError(res)\n  return toInventoryItem((await res.json()) as RawInventoryItem)\n}\n\n/** Update an existing inventory item. PUT /api/components/:id */\nexport async function updateInventoryItem(\n  id: string,\n  input: InventoryItemInput,\n): Promise<InventoryItem> {\n  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(input),\n  })\n  if (!res.ok) throw await inventoryError(res)\n  return toInventoryItem((await res.json()) as RawInventoryItem)\n}\n\n/** Remove an inventory item. DELETE /api/components/:id */\nexport async function removeInventoryItem(id: string): Promise<void> {\n  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {\n    method: 'DELETE',\n  })\n  // 204 No Content is the platform's success response for delete.\n  if (!res.ok && res.status !== 204) throw await inventoryError(res)\n}\n","// ========================================================================\n// Connectivity providers — the customer's ZTNA providers (Tailscale,\n// WireGuard, ZeroTier, …), platform-managed under Settings → Connectivity.\n//\n// A thin reader over the platform's connectivity-providers API\n// (/api/connectivity-providers), used to populate the ZTNA link picker when\n// creating or editing an Access Server (a component). Framework-free — every\n// call goes through the same `authFetch` the '/client' subpath exports.\n// ========================================================================\n\nimport type { ConnectivityProviderRef } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's connectivity-providers API. */\nconst CONNECTIVITY_PROVIDERS_API = '/api/connectivity-providers'\n\ninterface RawConnectivityProvider {\n  id: string\n  name?: string\n  providerType?: string\n  status?: string\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function providerError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/**\n * List the customer's ZTNA connectivity providers, used to populate the Access\n * Server link picker. GET /api/connectivity-providers (the endpoint may return\n * a bare array or a paginated `{ data, ... }` shape — both are handled).\n */\nexport async function listConnectivityProviders(): Promise<ConnectivityProviderRef[]> {\n  const res = await authFetch(CONNECTIVITY_PROVIDERS_API)\n  if (!res.ok) throw await providerError(res)\n  const body = (await res.json()) as unknown\n  const providers: RawConnectivityProvider[] = Array.isArray(body)\n    ? (body as RawConnectivityProvider[])\n    : Array.isArray((body as { data?: unknown })?.data)\n      ? ((body as { data: RawConnectivityProvider[] }).data)\n      : []\n  return providers.map((provider) => ({\n    id: String(provider.id),\n    name: provider.name ?? '',\n    providerType: provider.providerType ?? undefined,\n    status: provider.status ?? undefined,\n  }))\n}\n","// ========================================================================\n// Credentials — how an app authenticates to a server (\"connection\").\n//\n// A \"connection\" pairs a server (a platform *component* — see inventory.ts)\n// with a *credential*: the account and write-only secret used to reach that\n// server. These helpers are a typed surface over the platform's credentials\n// API (POST /api/credentials, GET /api/tools/:toolId/credentials, PUT/DELETE\n// /api/credentials/:id).\n//\n// Framework-free (no React). Every call goes through the same `authFetch` the\n// '/client' subpath exports, so requests carry the platform's Authorization\n// header. Non-2xx responses are surfaced as thrown Errors carrying the\n// platform's error text.\n//\n// SECURITY: `listCredentials` returns a REDACTED {@link CredentialSummary} —\n// secret material (password / apiToken / certificate) is dropped before it\n// reaches app code, so secrets are never held in memory or logged. Only whether\n// a secret exists is surfaced (`hasSecret`). Secrets are write-only: they can be\n// set via create/update, never read back.\n// ========================================================================\n\nimport type { CredentialInput, CredentialSummary } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's credentials API. */\nconst CREDENTIALS_API = '/api/credentials'\n\n/**\n * Loosely-typed shape of a raw credential as returned by the platform, before\n * it is redacted down to the {@link CredentialSummary} surface. The secret\n * fields (`password` / `apiToken` / `certificate`) are read here only to derive\n * `hasSecret` — they are never carried into app-visible data.\n */\ninterface RawCredential {\n  id: string\n  name?: string\n  username?: string\n  type?: string | null\n  endpoint?: string | null\n  toolId?: string\n  // The platform redacts secrets from credential responses and surfaces only\n  // whether each is set via these flags. Older platforms may still send the\n  // secret fields instead — both shapes are handled below.\n  hasPassword?: boolean\n  hasApiToken?: boolean\n  hasCertificate?: boolean\n  password?: string | null\n  apiToken?: string | null\n  certificate?: string | null\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function credentialError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/**\n * Redact a raw platform credential down to the app-visible summary, dropping\n * every secret field and surfacing only whether a secret is stored.\n */\nfunction toCredentialSummary(raw: RawCredential): CredentialSummary {\n  // Prefer the redacted has* flags; fall back to the presence of the secret\n  // fields themselves for older platforms that still return them.\n  const hasSecret = Boolean(\n    raw.hasApiToken ||\n      raw.hasPassword ||\n      (raw.apiToken && raw.apiToken.length > 0) ||\n      (raw.password && raw.password.length > 0),\n  )\n  return {\n    id: String(raw.id),\n    name: raw.name ?? '',\n    username: raw.username ?? '',\n    type: raw.type ?? null,\n    endpoint: raw.endpoint ?? null,\n    toolId: raw.toolId ?? '',\n    hasSecret,\n  }\n}\n\n/**\n * List the redacted credentials registered for a tool. GET\n * /api/tools/:toolId/credentials. Secrets are stripped before return — see the\n * module's SECURITY note. Returns an empty array when the tool has none.\n */\nexport async function listCredentials(toolId: string): Promise<CredentialSummary[]> {\n  const res = await authFetch(`/api/tools/${encodeURIComponent(toolId)}/credentials`)\n  if (!res.ok) throw await credentialError(res)\n  const data = (await res.json()) as unknown\n  const rows: RawCredential[] = Array.isArray(data)\n    ? (data as RawCredential[])\n    : Array.isArray((data as { data?: unknown })?.data)\n      ? ((data as { data: RawCredential[] }).data)\n      : []\n  return rows.map(toCredentialSummary)\n}\n\n/**\n * Create a credential. POST /api/credentials. The platform requires `name`,\n * `username`, `password`, `toolId`, and `tagIds` — this helper defaults\n * `tagIds` to `[]` and `password` to `''` (valid for token-only auth, where the\n * secret travels in `apiToken`). Returns the new credential's id.\n */\nexport async function createCredential(input: CredentialInput): Promise<{ id: string }> {\n  const res = await authFetch(CREDENTIALS_API, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      name: input.name,\n      username: input.username,\n      password: input.password ?? '',\n      apiToken: input.apiToken,\n      type: input.type,\n      endpoint: input.endpoint,\n      toolId: input.toolId,\n      tagIds: input.tagIds ?? [],\n    }),\n  })\n  if (!res.ok) throw await credentialError(res)\n  const body = (await res.json()) as { id?: string }\n  return { id: String(body.id) }\n}\n\n/**\n * Update a credential. PUT /api/credentials/:id. Only the fields you pass are\n * changed; omit `password`/`apiToken` to leave the stored secret untouched.\n */\nexport async function updateCredential(\n  id: string,\n  input: Partial<CredentialInput>,\n): Promise<{ id: string }> {\n  const body: Record<string, unknown> = {}\n  if (input.name !== undefined) body.name = input.name\n  if (input.username !== undefined) body.username = input.username\n  if (input.password !== undefined) body.password = input.password\n  if (input.apiToken !== undefined) body.apiToken = input.apiToken\n  if (input.type !== undefined) body.type = input.type\n  if (input.endpoint !== undefined) body.endpoint = input.endpoint\n  if (input.tagIds !== undefined) body.tagIds = input.tagIds\n  const res = await authFetch(`${CREDENTIALS_API}/${encodeURIComponent(id)}`, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(body),\n  })\n  if (!res.ok) throw await credentialError(res)\n  const result = (await res.json().catch(() => ({}))) as { id?: string }\n  return { id: result.id ? String(result.id) : id }\n}\n\n/** Remove a credential. DELETE /api/credentials/:id. */\nexport async function removeCredential(id: string): Promise<void> {\n  const res = await authFetch(`${CREDENTIALS_API}/${encodeURIComponent(id)}`, {\n    method: 'DELETE',\n  })\n  // 204 No Content is the platform's success response for delete.\n  if (!res.ok && res.status !== 204) throw await credentialError(res)\n}\n","// ========================================================================\n// Client runtime contract — how app client bundles talk to the host.\n//\n// App client code is packaged as a hermetic ESM bundle in which `react`,\n// `react-dom`, `react/jsx-runtime`, and every `@veltrixsecops/app-sdk`\n// subpath are compile-time shims that read the host-provided runtime from\n// `globalThis.__VELTRIX_APP_RUNTIME__`. The platform installs that global\n// (with ITS React instance, the shared AppContext, and an authenticated\n// fetch) before dynamically importing any app bundle, so app components\n// render inside the host React tree with working hooks and context.\n//\n// App authors: import from '@veltrixsecops/app-sdk/client' (and /hooks) —\n// never bundle your own copy of react. Use `authFetch` for calls to your\n// app's server routes (/api/apps/<app-id>/...): plain fetch() lacks the\n// platform's Authorization header and will receive 401s.\n// ========================================================================\n\nimport type { ComponentType, Context, LazyExoticComponent } from 'react'\nimport type { AppContextValue } from '../hooks/use-app-context'\n\nexport type { AppBrandingDeclaration } from '../types/manifest'\n\n// Inventory — typed helpers over the platform's components API (deployment\n// targets: servers, domains, IP/CIDR ranges). Framework-free; they use the\n// `authFetch` exported below internally.\nexport {\n  listInventory,\n  addInventoryItem,\n  updateInventoryItem,\n  removeInventoryItem,\n  resolveTool,\n} from './inventory'\nexport type { Tool } from './inventory'\nexport type { InventoryItem, InventoryItemInput } from '../types/platform'\n\n// Connectivity providers — reader over the customer's ZTNA providers, used to\n// populate the Access Server link picker. Framework-free; uses `authFetch`.\nexport { listConnectivityProviders } from './connectivity'\nexport type { ConnectivityProviderRef } from '../types/platform'\n\n// Credentials — typed helpers over the platform's credentials API. Paired with\n// a server (component) these form a \"connection\". Secrets are write-only:\n// `listCredentials` returns redacted summaries only. Framework-free; they use\n// the `authFetch` exported below internally.\nexport {\n  listCredentials,\n  createCredential,\n  updateCredential,\n  removeCredential,\n} from './credentials'\nexport type { Credential, CredentialSummary, CredentialInput } from '../types/platform'\n\n/** Name of the global the platform installs before loading app bundles. */\nexport const HOST_RUNTIME_GLOBAL = '__VELTRIX_APP_RUNTIME__'\n\n/**\n * The runtime surface the platform exposes to app client bundles.\n * The react/reactDom/jsxRuntime members are the host's own module objects —\n * app bundles are compiled with shims that re-export them, guaranteeing a\n * single React instance per page.\n */\nexport interface VeltrixHostRuntime {\n  /** The host's `react` module object. */\n  react: unknown\n  /** The host's `react-dom` module object. */\n  reactDom: unknown\n  /** The host's `react-dom/client` module object. */\n  reactDomClient?: unknown\n  /** The host's `react/jsx-runtime` module object. */\n  jsxRuntime: unknown\n  /** Shared app context — the host wraps app pages in its Provider. */\n  AppContext: Context<AppContextValue | null>\n  /** fetch() with the platform's Authorization header attached. */\n  authFetch: (input: string, init?: RequestInit) => Promise<Response>\n  /**\n   * The SDK surface app bundles receive for `@veltrixsecops/app-sdk`,\n   * `.../hooks`, and `.../client` imports (useAppContext, AppContext,\n   * usePipelineStatus, authFetch, getHostRuntime, ...).\n   */\n  sdk: Record<string, unknown>\n  /**\n   * The platform's design-system components and hooks, host-owned so they\n   * share the single host React instance. Keyed by the exact component/hook\n   * names re-exported from `@veltrixsecops/app-sdk/ui` (Button, Input, Card,\n   * DataTable, useToast, ...). Present only inside the platform.\n   */\n  ui?: Record<string, unknown>\n}\n\n/** Read the host runtime, or null outside the platform (tests, storybook). */\nexport function getHostRuntime(): VeltrixHostRuntime | null {\n  const runtime = (globalThis as Record<string, unknown>)[HOST_RUNTIME_GLOBAL]\n  return (runtime as VeltrixHostRuntime) ?? null\n}\n\n/** Read the host runtime, throwing a diagnosable error when absent. */\nexport function requireHostRuntime(): VeltrixHostRuntime {\n  const runtime = getHostRuntime()\n  if (!runtime) {\n    throw new Error(\n      'Veltrix host runtime not found — app client bundles only run inside the ' +\n        `Veltrix platform (missing globalThis.${HOST_RUNTIME_GLOBAL})`,\n    )\n  }\n  return runtime\n}\n\n/**\n * fetch() that carries the platform's Authorization header. Required for an\n * app page to call its own server routes (/api/apps/<app-id>/...), which are\n * bearer-token protected. Falls back to plain fetch outside the platform.\n */\nexport function authFetch(input: string, init?: RequestInit): Promise<Response> {\n  const runtime = getHostRuntime()\n  if (runtime) return runtime.authFetch(input, init)\n  return fetch(input, init)\n}\n\n/** A sidebar entry contributed by the app's client entry module. */\nexport interface AppSidebarItem {\n  path: string\n  label: string\n  icon?: string\n}\n\n/**\n * Shape of the default export of an app's `client/index.tsx`.\n * `pages` keys must match `manifest.client.pages[].component`.\n */\nexport interface AppClientModule {\n  id: string\n  pages: Record<string, ComponentType | LazyExoticComponent<ComponentType>>\n  sidebarItems?: AppSidebarItem[]\n}\n"],"mappings":";AAmBA,IAAM,gBAAgB;AAmBtB,eAAe,eAAe,KAA+B;AAC3D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAGA,SAAS,gBAAgB,KAAsC;AAC7D,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,UAAU,IAAI,YAAY;AAAA,IAC1B,MAAM,IAAI,QAAQ;AAAA,IAClB,MAAM,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAO;AAAA,IAC3C,SAAS,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,UAAU,CAAC;AAAA,IACrD,UAAU,MAAM,QAAQ,IAAI,QAAQ,IAAI,IAAI,WAAW,CAAC;AAAA,IACxD,MAAM,MAAM,QAAQ,IAAI,IAAI,IACxB,IAAI,KAAK,IAAI,CAAC,SAAS,EAAE,IAAI,OAAO,IAAI,EAAE,GAAG,MAAM,OAAO,IAAI,IAAI,EAAE,EAAE,IACtE,CAAC;AAAA,IACL,wBAAwB,IAAI,0BAA0B;AAAA,IACtD,cAAc,IAAI,gBAAgB;AAAA,EACpC;AACF;AAqBA,eAAsB,YAAY,MAAoC;AACpE,QAAM,MAAM,MAAM,UAAU,YAAY;AACxC,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,QAAgB,MAAM,QAAQ,IAAI,IACnC,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAA0B,OAC5B,CAAC;AACP,SAAO,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK;AACrD;AAGA,eAAsB,gBAA0C;AAC9D,QAAM,MAAM,MAAM,UAAU,aAAa;AACzC,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,IAAI,eAAe,IAAI,CAAC;AAC5D;AAGA,eAAsB,iBAAiB,OAAmD;AACxF,QAAM,MAAM,MAAM,UAAU,eAAe;AAAA,IACzC,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,KAAK;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,SAAO,gBAAiB,MAAM,IAAI,KAAK,CAAsB;AAC/D;AAGA,eAAsB,oBACpB,IACA,OACwB;AACxB,QAAM,MAAM,MAAM,UAAU,GAAG,aAAa,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IACxE,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,KAAK;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,SAAO,gBAAiB,MAAM,IAAI,KAAK,CAAsB;AAC/D;AAGA,eAAsB,oBAAoB,IAA2B;AACnE,QAAM,MAAM,MAAM,UAAU,GAAG,aAAa,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IACxE,QAAQ;AAAA,EACV,CAAC;AAED,MAAI,CAAC,IAAI,MAAM,IAAI,WAAW,IAAK,OAAM,MAAM,eAAe,GAAG;AACnE;;;AC/HA,IAAM,6BAA6B;AAUnC,eAAe,cAAc,KAA+B;AAC1D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAOA,eAAsB,4BAAgE;AACpF,QAAM,MAAM,MAAM,UAAU,0BAA0B;AACtD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,cAAc,GAAG;AAC1C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,YAAuC,MAAM,QAAQ,IAAI,IAC1D,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAA6C,OAC/C,CAAC;AACP,SAAO,UAAU,IAAI,CAAC,cAAc;AAAA,IAClC,IAAI,OAAO,SAAS,EAAE;AAAA,IACtB,MAAM,SAAS,QAAQ;AAAA,IACvB,cAAc,SAAS,gBAAgB;AAAA,IACvC,QAAQ,SAAS,UAAU;AAAA,EAC7B,EAAE;AACJ;;;AClCA,IAAM,kBAAkB;AA2BxB,eAAe,gBAAgB,KAA+B;AAC5D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAMA,SAAS,oBAAoB,KAAuC;AAGlE,QAAM,YAAY;AAAA,IAChB,IAAI,eACF,IAAI,eACH,IAAI,YAAY,IAAI,SAAS,SAAS,KACtC,IAAI,YAAY,IAAI,SAAS,SAAS;AAAA,EAC3C;AACA,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,MAAM,IAAI,QAAQ;AAAA,IAClB,UAAU,IAAI,YAAY;AAAA,IAC1B,MAAM,IAAI,QAAQ;AAAA,IAClB,UAAU,IAAI,YAAY;AAAA,IAC1B,QAAQ,IAAI,UAAU;AAAA,IACtB;AAAA,EACF;AACF;AAOA,eAAsB,gBAAgB,QAA8C;AAClF,QAAM,MAAM,MAAM,UAAU,cAAc,mBAAmB,MAAM,CAAC,cAAc;AAClF,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,gBAAgB,GAAG;AAC5C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,OAAwB,MAAM,QAAQ,IAAI,IAC3C,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAAmC,OACrC,CAAC;AACP,SAAO,KAAK,IAAI,mBAAmB;AACrC;AAQA,eAAsB,iBAAiB,OAAiD;AACtF,QAAM,MAAM,MAAM,UAAU,iBAAiB;AAAA,IAC3C,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU;AAAA,MACnB,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,UAAU,MAAM,YAAY;AAAA,MAC5B,UAAU,MAAM;AAAA,MAChB,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,QAAQ,MAAM;AAAA,MACd,QAAQ,MAAM,UAAU,CAAC;AAAA,IAC3B,CAAC;AAAA,EACH,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,gBAAgB,GAAG;AAC5C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,EAAE,IAAI,OAAO,KAAK,EAAE,EAAE;AAC/B;AAMA,eAAsB,iBACpB,IACA,OACyB;AACzB,QAAM,OAAgC,CAAC;AACvC,MAAI,MAAM,SAAS,OAAW,MAAK,OAAO,MAAM;AAChD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,SAAS,OAAW,MAAK,OAAO,MAAM;AAChD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,WAAW,OAAW,MAAK,SAAS,MAAM;AACpD,QAAM,MAAM,MAAM,UAAU,GAAG,eAAe,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IAC1E,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,gBAAgB,GAAG;AAC5C,QAAM,SAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,SAAO,EAAE,IAAI,OAAO,KAAK,OAAO,OAAO,EAAE,IAAI,GAAG;AAClD;AAGA,eAAsB,iBAAiB,IAA2B;AAChE,QAAM,MAAM,MAAM,UAAU,GAAG,eAAe,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IAC1E,QAAQ;AAAA,EACV,CAAC;AAED,MAAI,CAAC,IAAI,MAAM,IAAI,WAAW,IAAK,OAAM,MAAM,gBAAgB,GAAG;AACpE;;;AClHO,IAAM,sBAAsB;AAqC5B,SAAS,iBAA4C;AAC1D,QAAM,UAAW,WAAuC,mBAAmB;AAC3E,SAAQ,WAAkC;AAC5C;AAGO,SAAS,qBAAyC;AACvD,QAAM,UAAU,eAAe;AAC/B,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR,qHAC0C,mBAAmB;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,UAAU,OAAe,MAAuC;AAC9E,QAAM,UAAU,eAAe;AAC/B,MAAI,QAAS,QAAO,QAAQ,UAAU,OAAO,IAAI;AACjD,SAAO,MAAM,OAAO,IAAI;AAC1B;","names":[]}

package/dist/client/index.cjs

@@ -21,21 +21,17 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var client_exports = {};
 __export(client_exports, {
   HOST_RUNTIME_GLOBAL: () => HOST_RUNTIME_GLOBAL,
-  addAccessServer: () => addAccessServer,
   addInventoryItem: () => addInventoryItem,
   authFetch: () => authFetch,
   createCredential: () => createCredential,
   getHostRuntime: () => getHostRuntime,
-  listAccessServers: () => listAccessServers,
   listConnectivityProviders: () => listConnectivityProviders,
   listCredentials: () => listCredentials,
   listInventory: () => listInventory,
-  removeAccessServer: () => removeAccessServer,
   removeCredential: () => removeCredential,
   removeInventoryItem: () => removeInventoryItem,
   requireHostRuntime: () => requireHostRuntime,
   resolveTool: () => resolveTool,
-  updateAccessServer: () => updateAccessServer,
   updateCredential: () => updateCredential,
   updateInventoryItem: () => updateInventoryItem
 });
@@ -65,7 +61,8 @@ function toInventoryItem(raw) {
     domains: Array.isArray(raw.domains) ? raw.domains : [],
     ipRanges: Array.isArray(raw.ipRanges) ? raw.ipRanges : [],
     tags: Array.isArray(raw.tags) ? raw.tags.map((tag) => ({ id: String(tag.id), name: String(tag.name) })) : [],
-    connectivityProviderId: raw.connectivityProviderId ?? null
+    connectivityProviderId: raw.connectivityProviderId ?? null,
+    credentialId: raw.credentialId ?? null
   };
 }
 async function resolveTool(name) {
@@ -106,10 +103,9 @@ async function removeInventoryItem(id) {
   if (!res.ok && res.status !== 204) throw await inventoryError(res);
 }
 
-// src/client/access-servers.ts
-var ACCESS_SERVERS_API = "/api/access-servers";
+// src/client/connectivity.ts
 var CONNECTIVITY_PROVIDERS_API = "/api/connectivity-providers";
-async function accessServerError(res) {
+async function providerError(res) {
   const text = await res.text().catch(() => "");
   if (text) {
     try {
@@ -122,52 +118,9 @@ async function accessServerError(res) {
   }
   return new Error(`HTTP ${res.status}`);
 }
-function toAccessServer(raw) {
-  return {
-    id: String(raw.id),
-    name: raw.name ?? "",
-    endpoint: raw.endpoint ?? "",
-    type: raw.type ?? void 0,
-    region: raw.region ?? null,
-    status: raw.status ?? void 0,
-    description: raw.description ?? null,
-    connectivityProviderId: raw.connectivityProviderId ?? null,
-    connectivityProvider: raw.connectivityProvider ? { id: String(raw.connectivityProvider.id), name: String(raw.connectivityProvider.name) } : null
-  };
-}
-async function listAccessServers() {
-  const res = await authFetch(ACCESS_SERVERS_API);
-  if (!res.ok) throw await accessServerError(res);
-  const data = await res.json();
-  return Array.isArray(data) ? data.map(toAccessServer) : [];
-}
-async function addAccessServer(input) {
-  const res = await authFetch(ACCESS_SERVERS_API, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(input)
-  });
-  if (!res.ok) throw await accessServerError(res);
-  return toAccessServer(await res.json());
-}
-async function updateAccessServer(id, input) {
-  const res = await authFetch(`${ACCESS_SERVERS_API}/${encodeURIComponent(id)}`, {
-    method: "PUT",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(input)
-  });
-  if (!res.ok) throw await accessServerError(res);
-  return toAccessServer(await res.json());
-}
-async function removeAccessServer(id) {
-  const res = await authFetch(`${ACCESS_SERVERS_API}/${encodeURIComponent(id)}`, {
-    method: "DELETE"
-  });
-  if (!res.ok && res.status !== 204) throw await accessServerError(res);
-}
 async function listConnectivityProviders() {
   const res = await authFetch(CONNECTIVITY_PROVIDERS_API);
-  if (!res.ok) throw await accessServerError(res);
+  if (!res.ok) throw await providerError(res);
   const body = await res.json();
   const providers = Array.isArray(body) ? body : Array.isArray(body?.data) ? body.data : [];
   return providers.map((provider) => ({
@@ -194,12 +147,15 @@ async function credentialError(res) {
   return new Error(`HTTP ${res.status}`);
 }
 function toCredentialSummary(raw) {
-  const hasSecret = Boolean(raw.apiToken && raw.apiToken.length > 0 || raw.password && raw.password.length > 0);
+  const hasSecret = Boolean(
+    raw.hasApiToken || raw.hasPassword || raw.apiToken && raw.apiToken.length > 0 || raw.password && raw.password.length > 0
+  );
   return {
     id: String(raw.id),
     name: raw.name ?? "",
     username: raw.username ?? "",
     type: raw.type ?? null,
+    endpoint: raw.endpoint ?? null,
     toolId: raw.toolId ?? "",
     hasSecret
   };
@@ -221,6 +177,7 @@ async function createCredential(input) {
       password: input.password ?? "",
       apiToken: input.apiToken,
       type: input.type,
+      endpoint: input.endpoint,
       toolId: input.toolId,
       tagIds: input.tagIds ?? []
     })
@@ -236,6 +193,7 @@ async function updateCredential(id, input) {
   if (input.password !== void 0) body.password = input.password;
   if (input.apiToken !== void 0) body.apiToken = input.apiToken;
   if (input.type !== void 0) body.type = input.type;
+  if (input.endpoint !== void 0) body.endpoint = input.endpoint;
   if (input.tagIds !== void 0) body.tagIds = input.tagIds;
   const res = await authFetch(`${CREDENTIALS_API}/${encodeURIComponent(id)}`, {
     method: "PUT",
@@ -276,21 +234,17 @@ function authFetch(input, init) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   HOST_RUNTIME_GLOBAL,
-  addAccessServer,
   addInventoryItem,
   authFetch,
   createCredential,
   getHostRuntime,
-  listAccessServers,
   listConnectivityProviders,
   listCredentials,
   listInventory,
-  removeAccessServer,
   removeCredential,
   removeInventoryItem,
   requireHostRuntime,
   resolveTool,
-  updateAccessServer,
   updateCredential,
   updateInventoryItem
 });

package/dist/client/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/client/index.ts","../../src/client/inventory.ts","../../src/client/access-servers.ts","../../src/client/credentials.ts"],"sourcesContent":["// ========================================================================\n// Client runtime contract — how app client bundles talk to the host.\n//\n// App client code is packaged as a hermetic ESM bundle in which `react`,\n// `react-dom`, `react/jsx-runtime`, and every `@veltrixsecops/app-sdk`\n// subpath are compile-time shims that read the host-provided runtime from\n// `globalThis.__VELTRIX_APP_RUNTIME__`. The platform installs that global\n// (with ITS React instance, the shared AppContext, and an authenticated\n// fetch) before dynamically importing any app bundle, so app components\n// render inside the host React tree with working hooks and context.\n//\n// App authors: import from '@veltrixsecops/app-sdk/client' (and /hooks) —\n// never bundle your own copy of react. Use `authFetch` for calls to your\n// app's server routes (/api/apps/<app-id>/...): plain fetch() lacks the\n// platform's Authorization header and will receive 401s.\n// ========================================================================\n\nimport type { ComponentType, Context, LazyExoticComponent } from 'react'\nimport type { AppContextValue } from '../hooks/use-app-context'\n\nexport type { AppBrandingDeclaration } from '../types/manifest'\n\n// Inventory — typed helpers over the platform's components API (deployment\n// targets: servers, domains, IP/CIDR ranges). Framework-free; they use the\n// `authFetch` exported below internally.\nexport {\n  listInventory,\n  addInventoryItem,\n  updateInventoryItem,\n  removeInventoryItem,\n  resolveTool,\n} from './inventory'\nexport type { Tool } from './inventory'\nexport type { InventoryItem, InventoryItemInput } from '../types/platform'\n\n// Access Servers — typed helpers over the platform's access-servers API (ZTNA\n// gateways) plus a reader over connectivity providers for the link picker.\n// Framework-free; they use the `authFetch` exported below internally.\nexport {\n  listAccessServers,\n  addAccessServer,\n  updateAccessServer,\n  removeAccessServer,\n  listConnectivityProviders,\n} from './access-servers'\nexport type { AccessServer, AccessServerInput, ConnectivityProviderRef } from '../types/platform'\n\n// Credentials — typed helpers over the platform's credentials API. Paired with\n// a server (component) these form a \"connection\". Secrets are write-only:\n// `listCredentials` returns redacted summaries only. Framework-free; they use\n// the `authFetch` exported below internally.\nexport {\n  listCredentials,\n  createCredential,\n  updateCredential,\n  removeCredential,\n} from './credentials'\nexport type { Credential, CredentialSummary, CredentialInput } from '../types/platform'\n\n/** Name of the global the platform installs before loading app bundles. */\nexport const HOST_RUNTIME_GLOBAL = '__VELTRIX_APP_RUNTIME__'\n\n/**\n * The runtime surface the platform exposes to app client bundles.\n * The react/reactDom/jsxRuntime members are the host's own module objects —\n * app bundles are compiled with shims that re-export them, guaranteeing a\n * single React instance per page.\n */\nexport interface VeltrixHostRuntime {\n  /** The host's `react` module object. */\n  react: unknown\n  /** The host's `react-dom` module object. */\n  reactDom: unknown\n  /** The host's `react-dom/client` module object. */\n  reactDomClient?: unknown\n  /** The host's `react/jsx-runtime` module object. */\n  jsxRuntime: unknown\n  /** Shared app context — the host wraps app pages in its Provider. */\n  AppContext: Context<AppContextValue | null>\n  /** fetch() with the platform's Authorization header attached. */\n  authFetch: (input: string, init?: RequestInit) => Promise<Response>\n  /**\n   * The SDK surface app bundles receive for `@veltrixsecops/app-sdk`,\n   * `.../hooks`, and `.../client` imports (useAppContext, AppContext,\n   * usePipelineStatus, authFetch, getHostRuntime, ...).\n   */\n  sdk: Record<string, unknown>\n  /**\n   * The platform's design-system components and hooks, host-owned so they\n   * share the single host React instance. Keyed by the exact component/hook\n   * names re-exported from `@veltrixsecops/app-sdk/ui` (Button, Input, Card,\n   * DataTable, useToast, ...). Present only inside the platform.\n   */\n  ui?: Record<string, unknown>\n}\n\n/** Read the host runtime, or null outside the platform (tests, storybook). */\nexport function getHostRuntime(): VeltrixHostRuntime | null {\n  const runtime = (globalThis as Record<string, unknown>)[HOST_RUNTIME_GLOBAL]\n  return (runtime as VeltrixHostRuntime) ?? null\n}\n\n/** Read the host runtime, throwing a diagnosable error when absent. */\nexport function requireHostRuntime(): VeltrixHostRuntime {\n  const runtime = getHostRuntime()\n  if (!runtime) {\n    throw new Error(\n      'Veltrix host runtime not found — app client bundles only run inside the ' +\n        `Veltrix platform (missing globalThis.${HOST_RUNTIME_GLOBAL})`,\n    )\n  }\n  return runtime\n}\n\n/**\n * fetch() that carries the platform's Authorization header. Required for an\n * app page to call its own server routes (/api/apps/<app-id>/...), which are\n * bearer-token protected. Falls back to plain fetch outside the platform.\n */\nexport function authFetch(input: string, init?: RequestInit): Promise<Response> {\n  const runtime = getHostRuntime()\n  if (runtime) return runtime.authFetch(input, init)\n  return fetch(input, init)\n}\n\n/** A sidebar entry contributed by the app's client entry module. */\nexport interface AppSidebarItem {\n  path: string\n  label: string\n  icon?: string\n}\n\n/**\n * Shape of the default export of an app's `client/index.tsx`.\n * `pages` keys must match `manifest.client.pages[].component`.\n */\nexport interface AppClientModule {\n  id: string\n  pages: Record<string, ComponentType | LazyExoticComponent<ComponentType>>\n  sidebarItems?: AppSidebarItem[]\n}\n","// ========================================================================\n// Inventory — the deployment targets an app can deploy configuration to.\n//\n// \"Inventory\" is the app-facing name for the platform's *components*: the\n// servers (hostname/port), domains, and IP/CIDR ranges a customer has\n// registered as deploy targets. These helpers are a typed, convenient\n// surface over the platform's components API (/api/components), enriched\n// with `domains` and `ipRanges`.\n//\n// Framework-free (no React) — safe to import from any client code. Every\n// call goes through the same `authFetch` the '/client' subpath exports, so\n// requests carry the platform's Authorization header. Non-2xx responses are\n// surfaced as thrown Errors carrying the platform's error text.\n// ========================================================================\n\nimport type { InventoryItem, InventoryItemInput } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's components (inventory) API. */\nconst INVENTORY_API = '/api/components'\n\n/**\n * Loosely-typed shape of a raw component as returned by the platform, before\n * it is normalized down to the {@link InventoryItem} surface.\n */\ninterface RawInventoryItem {\n  id: string\n  hostname?: string\n  port?: string\n  type?: string[]\n  domains?: string[]\n  ipRanges?: string[]\n  tags?: Array<{ id: string; name: string }>\n  connectivityProviderId?: string | null\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function inventoryError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/** Normalize a raw platform component into the typed InventoryItem surface. */\nfunction toInventoryItem(raw: RawInventoryItem): InventoryItem {\n  return {\n    id: String(raw.id),\n    hostname: raw.hostname ?? '',\n    port: raw.port ?? undefined,\n    type: Array.isArray(raw.type) ? raw.type : undefined,\n    domains: Array.isArray(raw.domains) ? raw.domains : [],\n    ipRanges: Array.isArray(raw.ipRanges) ? raw.ipRanges : [],\n    tags: Array.isArray(raw.tags)\n      ? raw.tags.map((tag) => ({ id: String(tag.id), name: String(tag.name) }))\n      : [],\n    connectivityProviderId: raw.connectivityProviderId ?? null,\n  }\n}\n\n/**\n * A platform Tool. Each installed app is upserted as a Tool keyed by its\n * manifest `name`, and inventory items (components) belong to a tool.\n */\nexport interface Tool {\n  id: string\n  name: string\n  vendor?: string\n}\n\n/**\n * Resolve the platform Tool for an app by its manifest name (the platform\n * upserts `Tool.name === app name`). The tool id is required by the platform\n * when creating an inventory item, so call this once and pass the id as\n * `toolId` to {@link addInventoryItem}. Returns null when no tool matches.\n *\n * GET /api/tools (the endpoint is paginated — `{ data, pagination }` — or a\n * bare array; both are handled).\n */\nexport async function resolveTool(name: string): Promise<Tool | null> {\n  const res = await authFetch('/api/tools')\n  if (!res.ok) throw await inventoryError(res)\n  const body = (await res.json()) as unknown\n  const tools: Tool[] = Array.isArray(body)\n    ? (body as Tool[])\n    : Array.isArray((body as { data?: unknown })?.data)\n      ? ((body as { data: Tool[] }).data)\n      : []\n  return tools.find((tool) => tool.name === name) ?? null\n}\n\n/** List the customer's inventory (deployment targets). GET /api/components */\nexport async function listInventory(): Promise<InventoryItem[]> {\n  const res = await authFetch(INVENTORY_API)\n  if (!res.ok) throw await inventoryError(res)\n  const data = (await res.json()) as RawInventoryItem[]\n  return Array.isArray(data) ? data.map(toInventoryItem) : []\n}\n\n/** Add a new inventory item (deployment target). POST /api/components */\nexport async function addInventoryItem(input: InventoryItemInput): Promise<InventoryItem> {\n  const res = await authFetch(INVENTORY_API, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(input),\n  })\n  if (!res.ok) throw await inventoryError(res)\n  return toInventoryItem((await res.json()) as RawInventoryItem)\n}\n\n/** Update an existing inventory item. PUT /api/components/:id */\nexport async function updateInventoryItem(\n  id: string,\n  input: InventoryItemInput,\n): Promise<InventoryItem> {\n  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(input),\n  })\n  if (!res.ok) throw await inventoryError(res)\n  return toInventoryItem((await res.json()) as RawInventoryItem)\n}\n\n/** Remove an inventory item. DELETE /api/components/:id */\nexport async function removeInventoryItem(id: string): Promise<void> {\n  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {\n    method: 'DELETE',\n  })\n  // 204 No Content is the platform's success response for delete.\n  if (!res.ok && res.status !== 204) throw await inventoryError(res)\n}\n","// ========================================================================\n// Access Servers — the Zero-Trust Access (ZTNA) gateways an app manages.\n//\n// Each Access Server is a ZTNA gateway (name + endpoint) a customer has\n// registered, optionally linked to one of their connectivity providers. These\n// helpers are a typed, convenient surface over the platform's access-servers\n// API (/api/access-servers), plus a thin reader over the connectivity\n// providers API (/api/connectivity-providers) used to populate the ZTNA link\n// picker.\n//\n// Framework-free (no React) — safe to import from any client code. Every call\n// goes through the same `authFetch` the '/client' subpath exports, so requests\n// carry the platform's Authorization header. Non-2xx responses are surfaced as\n// thrown Errors carrying the platform's error text.\n// ========================================================================\n\nimport type {\n  AccessServer,\n  AccessServerInput,\n  ConnectivityProviderRef,\n} from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's access-servers API. */\nconst ACCESS_SERVERS_API = '/api/access-servers'\n/** Base route for the platform's connectivity-providers API (ZTNA picker). */\nconst CONNECTIVITY_PROVIDERS_API = '/api/connectivity-providers'\n\n/**\n * Loosely-typed shape of a raw access server as returned by the platform,\n * before it is normalized down to the {@link AccessServer} surface.\n */\ninterface RawAccessServer {\n  id: string\n  name?: string\n  endpoint?: string\n  type?: string\n  region?: string | null\n  status?: string\n  description?: string | null\n  connectivityProviderId?: string | null\n  connectivityProvider?: { id: string; name: string } | null\n}\n\n/**\n * Loosely-typed shape of a raw connectivity provider as returned by the\n * platform, before it is normalized to the {@link ConnectivityProviderRef}\n * picker surface.\n */\ninterface RawConnectivityProvider {\n  id: string\n  name?: string\n  providerType?: string\n  status?: string\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function accessServerError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/** Normalize a raw platform access server into the typed AccessServer surface. */\nfunction toAccessServer(raw: RawAccessServer): AccessServer {\n  return {\n    id: String(raw.id),\n    name: raw.name ?? '',\n    endpoint: raw.endpoint ?? '',\n    type: raw.type ?? undefined,\n    region: raw.region ?? null,\n    status: raw.status ?? undefined,\n    description: raw.description ?? null,\n    connectivityProviderId: raw.connectivityProviderId ?? null,\n    connectivityProvider: raw.connectivityProvider\n      ? { id: String(raw.connectivityProvider.id), name: String(raw.connectivityProvider.name) }\n      : null,\n  }\n}\n\n/** List the customer's access servers (ZTNA gateways). GET /api/access-servers */\nexport async function listAccessServers(): Promise<AccessServer[]> {\n  const res = await authFetch(ACCESS_SERVERS_API)\n  if (!res.ok) throw await accessServerError(res)\n  const data = (await res.json()) as RawAccessServer[]\n  return Array.isArray(data) ? data.map(toAccessServer) : []\n}\n\n/** Add a new access server (ZTNA gateway). POST /api/access-servers */\nexport async function addAccessServer(input: AccessServerInput): Promise<AccessServer> {\n  const res = await authFetch(ACCESS_SERVERS_API, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(input),\n  })\n  if (!res.ok) throw await accessServerError(res)\n  return toAccessServer((await res.json()) as RawAccessServer)\n}\n\n/** Update an existing access server. PUT /api/access-servers/:id */\nexport async function updateAccessServer(\n  id: string,\n  input: AccessServerInput,\n): Promise<AccessServer> {\n  const res = await authFetch(`${ACCESS_SERVERS_API}/${encodeURIComponent(id)}`, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(input),\n  })\n  if (!res.ok) throw await accessServerError(res)\n  return toAccessServer((await res.json()) as RawAccessServer)\n}\n\n/** Remove an access server. DELETE /api/access-servers/:id */\nexport async function removeAccessServer(id: string): Promise<void> {\n  const res = await authFetch(`${ACCESS_SERVERS_API}/${encodeURIComponent(id)}`, {\n    method: 'DELETE',\n  })\n  // 204 No Content is the platform's success response for delete.\n  if (!res.ok && res.status !== 204) throw await accessServerError(res)\n}\n\n/**\n * List the customer's ZTNA connectivity providers, used to populate the Access\n * Server link picker. GET /api/connectivity-providers (the endpoint may return\n * a bare array or a paginated `{ data, ... }` shape — both are handled).\n */\nexport async function listConnectivityProviders(): Promise<ConnectivityProviderRef[]> {\n  const res = await authFetch(CONNECTIVITY_PROVIDERS_API)\n  if (!res.ok) throw await accessServerError(res)\n  const body = (await res.json()) as unknown\n  const providers: RawConnectivityProvider[] = Array.isArray(body)\n    ? (body as RawConnectivityProvider[])\n    : Array.isArray((body as { data?: unknown })?.data)\n      ? ((body as { data: RawConnectivityProvider[] }).data)\n      : []\n  return providers.map((provider) => ({\n    id: String(provider.id),\n    name: provider.name ?? '',\n    providerType: provider.providerType ?? undefined,\n    status: provider.status ?? undefined,\n  }))\n}\n","// ========================================================================\n// Credentials — how an app authenticates to a server (\"connection\").\n//\n// A \"connection\" pairs a server (a platform *component* — see inventory.ts)\n// with a *credential*: the account and write-only secret used to reach that\n// server. These helpers are a typed surface over the platform's credentials\n// API (POST /api/credentials, GET /api/tools/:toolId/credentials, PUT/DELETE\n// /api/credentials/:id).\n//\n// Framework-free (no React). Every call goes through the same `authFetch` the\n// '/client' subpath exports, so requests carry the platform's Authorization\n// header. Non-2xx responses are surfaced as thrown Errors carrying the\n// platform's error text.\n//\n// SECURITY: `listCredentials` returns a REDACTED {@link CredentialSummary} —\n// secret material (password / apiToken / certificate) is dropped before it\n// reaches app code, so secrets are never held in memory or logged. Only whether\n// a secret exists is surfaced (`hasSecret`). Secrets are write-only: they can be\n// set via create/update, never read back.\n// ========================================================================\n\nimport type { CredentialInput, CredentialSummary } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's credentials API. */\nconst CREDENTIALS_API = '/api/credentials'\n\n/**\n * Loosely-typed shape of a raw credential as returned by the platform, before\n * it is redacted down to the {@link CredentialSummary} surface. The secret\n * fields (`password` / `apiToken` / `certificate`) are read here only to derive\n * `hasSecret` — they are never carried into app-visible data.\n */\ninterface RawCredential {\n  id: string\n  name?: string\n  username?: string\n  type?: string | null\n  toolId?: string\n  password?: string | null\n  apiToken?: string | null\n  certificate?: string | null\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function credentialError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/**\n * Redact a raw platform credential down to the app-visible summary, dropping\n * every secret field and surfacing only whether a secret is stored.\n */\nfunction toCredentialSummary(raw: RawCredential): CredentialSummary {\n  const hasSecret = Boolean((raw.apiToken && raw.apiToken.length > 0) || (raw.password && raw.password.length > 0))\n  return {\n    id: String(raw.id),\n    name: raw.name ?? '',\n    username: raw.username ?? '',\n    type: raw.type ?? null,\n    toolId: raw.toolId ?? '',\n    hasSecret,\n  }\n}\n\n/**\n * List the redacted credentials registered for a tool. GET\n * /api/tools/:toolId/credentials. Secrets are stripped before return — see the\n * module's SECURITY note. Returns an empty array when the tool has none.\n */\nexport async function listCredentials(toolId: string): Promise<CredentialSummary[]> {\n  const res = await authFetch(`/api/tools/${encodeURIComponent(toolId)}/credentials`)\n  if (!res.ok) throw await credentialError(res)\n  const data = (await res.json()) as unknown\n  const rows: RawCredential[] = Array.isArray(data)\n    ? (data as RawCredential[])\n    : Array.isArray((data as { data?: unknown })?.data)\n      ? ((data as { data: RawCredential[] }).data)\n      : []\n  return rows.map(toCredentialSummary)\n}\n\n/**\n * Create a credential. POST /api/credentials. The platform requires `name`,\n * `username`, `password`, `toolId`, and `tagIds` — this helper defaults\n * `tagIds` to `[]` and `password` to `''` (valid for token-only auth, where the\n * secret travels in `apiToken`). Returns the new credential's id.\n */\nexport async function createCredential(input: CredentialInput): Promise<{ id: string }> {\n  const res = await authFetch(CREDENTIALS_API, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      name: input.name,\n      username: input.username,\n      password: input.password ?? '',\n      apiToken: input.apiToken,\n      type: input.type,\n      toolId: input.toolId,\n      tagIds: input.tagIds ?? [],\n    }),\n  })\n  if (!res.ok) throw await credentialError(res)\n  const body = (await res.json()) as { id?: string }\n  return { id: String(body.id) }\n}\n\n/**\n * Update a credential. PUT /api/credentials/:id. Only the fields you pass are\n * changed; omit `password`/`apiToken` to leave the stored secret untouched.\n */\nexport async function updateCredential(\n  id: string,\n  input: Partial<CredentialInput>,\n): Promise<{ id: string }> {\n  const body: Record<string, unknown> = {}\n  if (input.name !== undefined) body.name = input.name\n  if (input.username !== undefined) body.username = input.username\n  if (input.password !== undefined) body.password = input.password\n  if (input.apiToken !== undefined) body.apiToken = input.apiToken\n  if (input.type !== undefined) body.type = input.type\n  if (input.tagIds !== undefined) body.tagIds = input.tagIds\n  const res = await authFetch(`${CREDENTIALS_API}/${encodeURIComponent(id)}`, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(body),\n  })\n  if (!res.ok) throw await credentialError(res)\n  const result = (await res.json().catch(() => ({}))) as { id?: string }\n  return { id: result.id ? String(result.id) : id }\n}\n\n/** Remove a credential. DELETE /api/credentials/:id. */\nexport async function removeCredential(id: string): Promise<void> {\n  const res = await authFetch(`${CREDENTIALS_API}/${encodeURIComponent(id)}`, {\n    method: 'DELETE',\n  })\n  // 204 No Content is the platform's success response for delete.\n  if (!res.ok && res.status !== 204) throw await credentialError(res)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACmBA,IAAM,gBAAgB;AAkBtB,eAAe,eAAe,KAA+B;AAC3D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAGA,SAAS,gBAAgB,KAAsC;AAC7D,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,UAAU,IAAI,YAAY;AAAA,IAC1B,MAAM,IAAI,QAAQ;AAAA,IAClB,MAAM,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAO;AAAA,IAC3C,SAAS,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,UAAU,CAAC;AAAA,IACrD,UAAU,MAAM,QAAQ,IAAI,QAAQ,IAAI,IAAI,WAAW,CAAC;AAAA,IACxD,MAAM,MAAM,QAAQ,IAAI,IAAI,IACxB,IAAI,KAAK,IAAI,CAAC,SAAS,EAAE,IAAI,OAAO,IAAI,EAAE,GAAG,MAAM,OAAO,IAAI,IAAI,EAAE,EAAE,IACtE,CAAC;AAAA,IACL,wBAAwB,IAAI,0BAA0B;AAAA,EACxD;AACF;AAqBA,eAAsB,YAAY,MAAoC;AACpE,QAAM,MAAM,MAAM,UAAU,YAAY;AACxC,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,QAAgB,MAAM,QAAQ,IAAI,IACnC,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAA0B,OAC5B,CAAC;AACP,SAAO,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK;AACrD;AAGA,eAAsB,gBAA0C;AAC9D,QAAM,MAAM,MAAM,UAAU,aAAa;AACzC,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,IAAI,eAAe,IAAI,CAAC;AAC5D;AAGA,eAAsB,iBAAiB,OAAmD;AACxF,QAAM,MAAM,MAAM,UAAU,eAAe;AAAA,IACzC,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,KAAK;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,SAAO,gBAAiB,MAAM,IAAI,KAAK,CAAsB;AAC/D;AAGA,eAAsB,oBACpB,IACA,OACwB;AACxB,QAAM,MAAM,MAAM,UAAU,GAAG,aAAa,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IACxE,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,KAAK;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,SAAO,gBAAiB,MAAM,IAAI,KAAK,CAAsB;AAC/D;AAGA,eAAsB,oBAAoB,IAA2B;AACnE,QAAM,MAAM,MAAM,UAAU,GAAG,aAAa,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IACxE,QAAQ;AAAA,EACV,CAAC;AAED,MAAI,CAAC,IAAI,MAAM,IAAI,WAAW,IAAK,OAAM,MAAM,eAAe,GAAG;AACnE;;;ACnHA,IAAM,qBAAqB;AAE3B,IAAM,6BAA6B;AA+BnC,eAAe,kBAAkB,KAA+B;AAC9D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAGA,SAAS,eAAe,KAAoC;AAC1D,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,MAAM,IAAI,QAAQ;AAAA,IAClB,UAAU,IAAI,YAAY;AAAA,IAC1B,MAAM,IAAI,QAAQ;AAAA,IAClB,QAAQ,IAAI,UAAU;AAAA,IACtB,QAAQ,IAAI,UAAU;AAAA,IACtB,aAAa,IAAI,eAAe;AAAA,IAChC,wBAAwB,IAAI,0BAA0B;AAAA,IACtD,sBAAsB,IAAI,uBACtB,EAAE,IAAI,OAAO,IAAI,qBAAqB,EAAE,GAAG,MAAM,OAAO,IAAI,qBAAqB,IAAI,EAAE,IACvF;AAAA,EACN;AACF;AAGA,eAAsB,oBAA6C;AACjE,QAAM,MAAM,MAAM,UAAU,kBAAkB;AAC9C,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,kBAAkB,GAAG;AAC9C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,IAAI,cAAc,IAAI,CAAC;AAC3D;AAGA,eAAsB,gBAAgB,OAAiD;AACrF,QAAM,MAAM,MAAM,UAAU,oBAAoB;AAAA,IAC9C,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,KAAK;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,kBAAkB,GAAG;AAC9C,SAAO,eAAgB,MAAM,IAAI,KAAK,CAAqB;AAC7D;AAGA,eAAsB,mBACpB,IACA,OACuB;AACvB,QAAM,MAAM,MAAM,UAAU,GAAG,kBAAkB,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IAC7E,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,KAAK;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,kBAAkB,GAAG;AAC9C,SAAO,eAAgB,MAAM,IAAI,KAAK,CAAqB;AAC7D;AAGA,eAAsB,mBAAmB,IAA2B;AAClE,QAAM,MAAM,MAAM,UAAU,GAAG,kBAAkB,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IAC7E,QAAQ;AAAA,EACV,CAAC;AAED,MAAI,CAAC,IAAI,MAAM,IAAI,WAAW,IAAK,OAAM,MAAM,kBAAkB,GAAG;AACtE;AAOA,eAAsB,4BAAgE;AACpF,QAAM,MAAM,MAAM,UAAU,0BAA0B;AACtD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,kBAAkB,GAAG;AAC9C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,YAAuC,MAAM,QAAQ,IAAI,IAC1D,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAA6C,OAC/C,CAAC;AACP,SAAO,UAAU,IAAI,CAAC,cAAc;AAAA,IAClC,IAAI,OAAO,SAAS,EAAE;AAAA,IACtB,MAAM,SAAS,QAAQ;AAAA,IACvB,cAAc,SAAS,gBAAgB;AAAA,IACvC,QAAQ,SAAS,UAAU;AAAA,EAC7B,EAAE;AACJ;;;AC9HA,IAAM,kBAAkB;AAoBxB,eAAe,gBAAgB,KAA+B;AAC5D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAMA,SAAS,oBAAoB,KAAuC;AAClE,QAAM,YAAY,QAAS,IAAI,YAAY,IAAI,SAAS,SAAS,KAAO,IAAI,YAAY,IAAI,SAAS,SAAS,CAAE;AAChH,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,MAAM,IAAI,QAAQ;AAAA,IAClB,UAAU,IAAI,YAAY;AAAA,IAC1B,MAAM,IAAI,QAAQ;AAAA,IAClB,QAAQ,IAAI,UAAU;AAAA,IACtB;AAAA,EACF;AACF;AAOA,eAAsB,gBAAgB,QAA8C;AAClF,QAAM,MAAM,MAAM,UAAU,cAAc,mBAAmB,MAAM,CAAC,cAAc;AAClF,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,gBAAgB,GAAG;AAC5C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,OAAwB,MAAM,QAAQ,IAAI,IAC3C,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAAmC,OACrC,CAAC;AACP,SAAO,KAAK,IAAI,mBAAmB;AACrC;AAQA,eAAsB,iBAAiB,OAAiD;AACtF,QAAM,MAAM,MAAM,UAAU,iBAAiB;AAAA,IAC3C,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU;AAAA,MACnB,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,UAAU,MAAM,YAAY;AAAA,MAC5B,UAAU,MAAM;AAAA,MAChB,MAAM,MAAM;AAAA,MACZ,QAAQ,MAAM;AAAA,MACd,QAAQ,MAAM,UAAU,CAAC;AAAA,IAC3B,CAAC;AAAA,EACH,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,gBAAgB,GAAG;AAC5C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,EAAE,IAAI,OAAO,KAAK,EAAE,EAAE;AAC/B;AAMA,eAAsB,iBACpB,IACA,OACyB;AACzB,QAAM,OAAgC,CAAC;AACvC,MAAI,MAAM,SAAS,OAAW,MAAK,OAAO,MAAM;AAChD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,SAAS,OAAW,MAAK,OAAO,MAAM;AAChD,MAAI,MAAM,WAAW,OAAW,MAAK,SAAS,MAAM;AACpD,QAAM,MAAM,MAAM,UAAU,GAAG,eAAe,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IAC1E,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,gBAAgB,GAAG;AAC5C,QAAM,SAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,SAAO,EAAE,IAAI,OAAO,KAAK,OAAO,OAAO,EAAE,IAAI,GAAG;AAClD;AAGA,eAAsB,iBAAiB,IAA2B;AAChE,QAAM,MAAM,MAAM,UAAU,GAAG,eAAe,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IAC1E,QAAQ;AAAA,EACV,CAAC;AAED,MAAI,CAAC,IAAI,MAAM,IAAI,WAAW,IAAK,OAAM,MAAM,gBAAgB,GAAG;AACpE;;;AH1FO,IAAM,sBAAsB;AAqC5B,SAAS,iBAA4C;AAC1D,QAAM,UAAW,WAAuC,mBAAmB;AAC3E,SAAQ,WAAkC;AAC5C;AAGO,SAAS,qBAAyC;AACvD,QAAM,UAAU,eAAe;AAC/B,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR,qHAC0C,mBAAmB;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,UAAU,OAAe,MAAuC;AAC9E,QAAM,UAAU,eAAe;AAC/B,MAAI,QAAS,QAAO,QAAQ,UAAU,OAAO,IAAI;AACjD,SAAO,MAAM,OAAO,IAAI;AAC1B;","names":[]}
+{"version":3,"sources":["../../src/client/index.ts","../../src/client/inventory.ts","../../src/client/connectivity.ts","../../src/client/credentials.ts"],"sourcesContent":["// ========================================================================\n// Client runtime contract — how app client bundles talk to the host.\n//\n// App client code is packaged as a hermetic ESM bundle in which `react`,\n// `react-dom`, `react/jsx-runtime`, and every `@veltrixsecops/app-sdk`\n// subpath are compile-time shims that read the host-provided runtime from\n// `globalThis.__VELTRIX_APP_RUNTIME__`. The platform installs that global\n// (with ITS React instance, the shared AppContext, and an authenticated\n// fetch) before dynamically importing any app bundle, so app components\n// render inside the host React tree with working hooks and context.\n//\n// App authors: import from '@veltrixsecops/app-sdk/client' (and /hooks) —\n// never bundle your own copy of react. Use `authFetch` for calls to your\n// app's server routes (/api/apps/<app-id>/...): plain fetch() lacks the\n// platform's Authorization header and will receive 401s.\n// ========================================================================\n\nimport type { ComponentType, Context, LazyExoticComponent } from 'react'\nimport type { AppContextValue } from '../hooks/use-app-context'\n\nexport type { AppBrandingDeclaration } from '../types/manifest'\n\n// Inventory — typed helpers over the platform's components API (deployment\n// targets: servers, domains, IP/CIDR ranges). Framework-free; they use the\n// `authFetch` exported below internally.\nexport {\n  listInventory,\n  addInventoryItem,\n  updateInventoryItem,\n  removeInventoryItem,\n  resolveTool,\n} from './inventory'\nexport type { Tool } from './inventory'\nexport type { InventoryItem, InventoryItemInput } from '../types/platform'\n\n// Connectivity providers — reader over the customer's ZTNA providers, used to\n// populate the Access Server link picker. Framework-free; uses `authFetch`.\nexport { listConnectivityProviders } from './connectivity'\nexport type { ConnectivityProviderRef } from '../types/platform'\n\n// Credentials — typed helpers over the platform's credentials API. Paired with\n// a server (component) these form a \"connection\". Secrets are write-only:\n// `listCredentials` returns redacted summaries only. Framework-free; they use\n// the `authFetch` exported below internally.\nexport {\n  listCredentials,\n  createCredential,\n  updateCredential,\n  removeCredential,\n} from './credentials'\nexport type { Credential, CredentialSummary, CredentialInput } from '../types/platform'\n\n/** Name of the global the platform installs before loading app bundles. */\nexport const HOST_RUNTIME_GLOBAL = '__VELTRIX_APP_RUNTIME__'\n\n/**\n * The runtime surface the platform exposes to app client bundles.\n * The react/reactDom/jsxRuntime members are the host's own module objects —\n * app bundles are compiled with shims that re-export them, guaranteeing a\n * single React instance per page.\n */\nexport interface VeltrixHostRuntime {\n  /** The host's `react` module object. */\n  react: unknown\n  /** The host's `react-dom` module object. */\n  reactDom: unknown\n  /** The host's `react-dom/client` module object. */\n  reactDomClient?: unknown\n  /** The host's `react/jsx-runtime` module object. */\n  jsxRuntime: unknown\n  /** Shared app context — the host wraps app pages in its Provider. */\n  AppContext: Context<AppContextValue | null>\n  /** fetch() with the platform's Authorization header attached. */\n  authFetch: (input: string, init?: RequestInit) => Promise<Response>\n  /**\n   * The SDK surface app bundles receive for `@veltrixsecops/app-sdk`,\n   * `.../hooks`, and `.../client` imports (useAppContext, AppContext,\n   * usePipelineStatus, authFetch, getHostRuntime, ...).\n   */\n  sdk: Record<string, unknown>\n  /**\n   * The platform's design-system components and hooks, host-owned so they\n   * share the single host React instance. Keyed by the exact component/hook\n   * names re-exported from `@veltrixsecops/app-sdk/ui` (Button, Input, Card,\n   * DataTable, useToast, ...). Present only inside the platform.\n   */\n  ui?: Record<string, unknown>\n}\n\n/** Read the host runtime, or null outside the platform (tests, storybook). */\nexport function getHostRuntime(): VeltrixHostRuntime | null {\n  const runtime = (globalThis as Record<string, unknown>)[HOST_RUNTIME_GLOBAL]\n  return (runtime as VeltrixHostRuntime) ?? null\n}\n\n/** Read the host runtime, throwing a diagnosable error when absent. */\nexport function requireHostRuntime(): VeltrixHostRuntime {\n  const runtime = getHostRuntime()\n  if (!runtime) {\n    throw new Error(\n      'Veltrix host runtime not found — app client bundles only run inside the ' +\n        `Veltrix platform (missing globalThis.${HOST_RUNTIME_GLOBAL})`,\n    )\n  }\n  return runtime\n}\n\n/**\n * fetch() that carries the platform's Authorization header. Required for an\n * app page to call its own server routes (/api/apps/<app-id>/...), which are\n * bearer-token protected. Falls back to plain fetch outside the platform.\n */\nexport function authFetch(input: string, init?: RequestInit): Promise<Response> {\n  const runtime = getHostRuntime()\n  if (runtime) return runtime.authFetch(input, init)\n  return fetch(input, init)\n}\n\n/** A sidebar entry contributed by the app's client entry module. */\nexport interface AppSidebarItem {\n  path: string\n  label: string\n  icon?: string\n}\n\n/**\n * Shape of the default export of an app's `client/index.tsx`.\n * `pages` keys must match `manifest.client.pages[].component`.\n */\nexport interface AppClientModule {\n  id: string\n  pages: Record<string, ComponentType | LazyExoticComponent<ComponentType>>\n  sidebarItems?: AppSidebarItem[]\n}\n","// ========================================================================\n// Inventory — the deployment targets an app can deploy configuration to.\n//\n// \"Inventory\" is the app-facing name for the platform's *components*: the\n// servers (hostname/port), domains, and IP/CIDR ranges a customer has\n// registered as deploy targets. These helpers are a typed, convenient\n// surface over the platform's components API (/api/components), enriched\n// with `domains` and `ipRanges`.\n//\n// Framework-free (no React) — safe to import from any client code. Every\n// call goes through the same `authFetch` the '/client' subpath exports, so\n// requests carry the platform's Authorization header. Non-2xx responses are\n// surfaced as thrown Errors carrying the platform's error text.\n// ========================================================================\n\nimport type { InventoryItem, InventoryItemInput } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's components (inventory) API. */\nconst INVENTORY_API = '/api/components'\n\n/**\n * Loosely-typed shape of a raw component as returned by the platform, before\n * it is normalized down to the {@link InventoryItem} surface.\n */\ninterface RawInventoryItem {\n  id: string\n  hostname?: string\n  port?: string\n  type?: string[]\n  domains?: string[]\n  ipRanges?: string[]\n  tags?: Array<{ id: string; name: string }>\n  connectivityProviderId?: string | null\n  credentialId?: string | null\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function inventoryError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/** Normalize a raw platform component into the typed InventoryItem surface. */\nfunction toInventoryItem(raw: RawInventoryItem): InventoryItem {\n  return {\n    id: String(raw.id),\n    hostname: raw.hostname ?? '',\n    port: raw.port ?? undefined,\n    type: Array.isArray(raw.type) ? raw.type : undefined,\n    domains: Array.isArray(raw.domains) ? raw.domains : [],\n    ipRanges: Array.isArray(raw.ipRanges) ? raw.ipRanges : [],\n    tags: Array.isArray(raw.tags)\n      ? raw.tags.map((tag) => ({ id: String(tag.id), name: String(tag.name) }))\n      : [],\n    connectivityProviderId: raw.connectivityProviderId ?? null,\n    credentialId: raw.credentialId ?? null,\n  }\n}\n\n/**\n * A platform Tool. Each installed app is upserted as a Tool keyed by its\n * manifest `name`, and inventory items (components) belong to a tool.\n */\nexport interface Tool {\n  id: string\n  name: string\n  vendor?: string\n}\n\n/**\n * Resolve the platform Tool for an app by its manifest name (the platform\n * upserts `Tool.name === app name`). The tool id is required by the platform\n * when creating an inventory item, so call this once and pass the id as\n * `toolId` to {@link addInventoryItem}. Returns null when no tool matches.\n *\n * GET /api/tools (the endpoint is paginated — `{ data, pagination }` — or a\n * bare array; both are handled).\n */\nexport async function resolveTool(name: string): Promise<Tool | null> {\n  const res = await authFetch('/api/tools')\n  if (!res.ok) throw await inventoryError(res)\n  const body = (await res.json()) as unknown\n  const tools: Tool[] = Array.isArray(body)\n    ? (body as Tool[])\n    : Array.isArray((body as { data?: unknown })?.data)\n      ? ((body as { data: Tool[] }).data)\n      : []\n  return tools.find((tool) => tool.name === name) ?? null\n}\n\n/** List the customer's inventory (deployment targets). GET /api/components */\nexport async function listInventory(): Promise<InventoryItem[]> {\n  const res = await authFetch(INVENTORY_API)\n  if (!res.ok) throw await inventoryError(res)\n  const data = (await res.json()) as RawInventoryItem[]\n  return Array.isArray(data) ? data.map(toInventoryItem) : []\n}\n\n/** Add a new inventory item (deployment target). POST /api/components */\nexport async function addInventoryItem(input: InventoryItemInput): Promise<InventoryItem> {\n  const res = await authFetch(INVENTORY_API, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(input),\n  })\n  if (!res.ok) throw await inventoryError(res)\n  return toInventoryItem((await res.json()) as RawInventoryItem)\n}\n\n/** Update an existing inventory item. PUT /api/components/:id */\nexport async function updateInventoryItem(\n  id: string,\n  input: InventoryItemInput,\n): Promise<InventoryItem> {\n  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(input),\n  })\n  if (!res.ok) throw await inventoryError(res)\n  return toInventoryItem((await res.json()) as RawInventoryItem)\n}\n\n/** Remove an inventory item. DELETE /api/components/:id */\nexport async function removeInventoryItem(id: string): Promise<void> {\n  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {\n    method: 'DELETE',\n  })\n  // 204 No Content is the platform's success response for delete.\n  if (!res.ok && res.status !== 204) throw await inventoryError(res)\n}\n","// ========================================================================\n// Connectivity providers — the customer's ZTNA providers (Tailscale,\n// WireGuard, ZeroTier, …), platform-managed under Settings → Connectivity.\n//\n// A thin reader over the platform's connectivity-providers API\n// (/api/connectivity-providers), used to populate the ZTNA link picker when\n// creating or editing an Access Server (a component). Framework-free — every\n// call goes through the same `authFetch` the '/client' subpath exports.\n// ========================================================================\n\nimport type { ConnectivityProviderRef } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's connectivity-providers API. */\nconst CONNECTIVITY_PROVIDERS_API = '/api/connectivity-providers'\n\ninterface RawConnectivityProvider {\n  id: string\n  name?: string\n  providerType?: string\n  status?: string\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function providerError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/**\n * List the customer's ZTNA connectivity providers, used to populate the Access\n * Server link picker. GET /api/connectivity-providers (the endpoint may return\n * a bare array or a paginated `{ data, ... }` shape — both are handled).\n */\nexport async function listConnectivityProviders(): Promise<ConnectivityProviderRef[]> {\n  const res = await authFetch(CONNECTIVITY_PROVIDERS_API)\n  if (!res.ok) throw await providerError(res)\n  const body = (await res.json()) as unknown\n  const providers: RawConnectivityProvider[] = Array.isArray(body)\n    ? (body as RawConnectivityProvider[])\n    : Array.isArray((body as { data?: unknown })?.data)\n      ? ((body as { data: RawConnectivityProvider[] }).data)\n      : []\n  return providers.map((provider) => ({\n    id: String(provider.id),\n    name: provider.name ?? '',\n    providerType: provider.providerType ?? undefined,\n    status: provider.status ?? undefined,\n  }))\n}\n","// ========================================================================\n// Credentials — how an app authenticates to a server (\"connection\").\n//\n// A \"connection\" pairs a server (a platform *component* — see inventory.ts)\n// with a *credential*: the account and write-only secret used to reach that\n// server. These helpers are a typed surface over the platform's credentials\n// API (POST /api/credentials, GET /api/tools/:toolId/credentials, PUT/DELETE\n// /api/credentials/:id).\n//\n// Framework-free (no React). Every call goes through the same `authFetch` the\n// '/client' subpath exports, so requests carry the platform's Authorization\n// header. Non-2xx responses are surfaced as thrown Errors carrying the\n// platform's error text.\n//\n// SECURITY: `listCredentials` returns a REDACTED {@link CredentialSummary} —\n// secret material (password / apiToken / certificate) is dropped before it\n// reaches app code, so secrets are never held in memory or logged. Only whether\n// a secret exists is surfaced (`hasSecret`). Secrets are write-only: they can be\n// set via create/update, never read back.\n// ========================================================================\n\nimport type { CredentialInput, CredentialSummary } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's credentials API. */\nconst CREDENTIALS_API = '/api/credentials'\n\n/**\n * Loosely-typed shape of a raw credential as returned by the platform, before\n * it is redacted down to the {@link CredentialSummary} surface. The secret\n * fields (`password` / `apiToken` / `certificate`) are read here only to derive\n * `hasSecret` — they are never carried into app-visible data.\n */\ninterface RawCredential {\n  id: string\n  name?: string\n  username?: string\n  type?: string | null\n  endpoint?: string | null\n  toolId?: string\n  // The platform redacts secrets from credential responses and surfaces only\n  // whether each is set via these flags. Older platforms may still send the\n  // secret fields instead — both shapes are handled below.\n  hasPassword?: boolean\n  hasApiToken?: boolean\n  hasCertificate?: boolean\n  password?: string | null\n  apiToken?: string | null\n  certificate?: string | null\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function credentialError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/**\n * Redact a raw platform credential down to the app-visible summary, dropping\n * every secret field and surfacing only whether a secret is stored.\n */\nfunction toCredentialSummary(raw: RawCredential): CredentialSummary {\n  // Prefer the redacted has* flags; fall back to the presence of the secret\n  // fields themselves for older platforms that still return them.\n  const hasSecret = Boolean(\n    raw.hasApiToken ||\n      raw.hasPassword ||\n      (raw.apiToken && raw.apiToken.length > 0) ||\n      (raw.password && raw.password.length > 0),\n  )\n  return {\n    id: String(raw.id),\n    name: raw.name ?? '',\n    username: raw.username ?? '',\n    type: raw.type ?? null,\n    endpoint: raw.endpoint ?? null,\n    toolId: raw.toolId ?? '',\n    hasSecret,\n  }\n}\n\n/**\n * List the redacted credentials registered for a tool. GET\n * /api/tools/:toolId/credentials. Secrets are stripped before return — see the\n * module's SECURITY note. Returns an empty array when the tool has none.\n */\nexport async function listCredentials(toolId: string): Promise<CredentialSummary[]> {\n  const res = await authFetch(`/api/tools/${encodeURIComponent(toolId)}/credentials`)\n  if (!res.ok) throw await credentialError(res)\n  const data = (await res.json()) as unknown\n  const rows: RawCredential[] = Array.isArray(data)\n    ? (data as RawCredential[])\n    : Array.isArray((data as { data?: unknown })?.data)\n      ? ((data as { data: RawCredential[] }).data)\n      : []\n  return rows.map(toCredentialSummary)\n}\n\n/**\n * Create a credential. POST /api/credentials. The platform requires `name`,\n * `username`, `password`, `toolId`, and `tagIds` — this helper defaults\n * `tagIds` to `[]` and `password` to `''` (valid for token-only auth, where the\n * secret travels in `apiToken`). Returns the new credential's id.\n */\nexport async function createCredential(input: CredentialInput): Promise<{ id: string }> {\n  const res = await authFetch(CREDENTIALS_API, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      name: input.name,\n      username: input.username,\n      password: input.password ?? '',\n      apiToken: input.apiToken,\n      type: input.type,\n      endpoint: input.endpoint,\n      toolId: input.toolId,\n      tagIds: input.tagIds ?? [],\n    }),\n  })\n  if (!res.ok) throw await credentialError(res)\n  const body = (await res.json()) as { id?: string }\n  return { id: String(body.id) }\n}\n\n/**\n * Update a credential. PUT /api/credentials/:id. Only the fields you pass are\n * changed; omit `password`/`apiToken` to leave the stored secret untouched.\n */\nexport async function updateCredential(\n  id: string,\n  input: Partial<CredentialInput>,\n): Promise<{ id: string }> {\n  const body: Record<string, unknown> = {}\n  if (input.name !== undefined) body.name = input.name\n  if (input.username !== undefined) body.username = input.username\n  if (input.password !== undefined) body.password = input.password\n  if (input.apiToken !== undefined) body.apiToken = input.apiToken\n  if (input.type !== undefined) body.type = input.type\n  if (input.endpoint !== undefined) body.endpoint = input.endpoint\n  if (input.tagIds !== undefined) body.tagIds = input.tagIds\n  const res = await authFetch(`${CREDENTIALS_API}/${encodeURIComponent(id)}`, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(body),\n  })\n  if (!res.ok) throw await credentialError(res)\n  const result = (await res.json().catch(() => ({}))) as { id?: string }\n  return { id: result.id ? String(result.id) : id }\n}\n\n/** Remove a credential. DELETE /api/credentials/:id. */\nexport async function removeCredential(id: string): Promise<void> {\n  const res = await authFetch(`${CREDENTIALS_API}/${encodeURIComponent(id)}`, {\n    method: 'DELETE',\n  })\n  // 204 No Content is the platform's success response for delete.\n  if (!res.ok && res.status !== 204) throw await credentialError(res)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACmBA,IAAM,gBAAgB;AAmBtB,eAAe,eAAe,KAA+B;AAC3D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAGA,SAAS,gBAAgB,KAAsC;AAC7D,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,UAAU,IAAI,YAAY;AAAA,IAC1B,MAAM,IAAI,QAAQ;AAAA,IAClB,MAAM,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAO;AAAA,IAC3C,SAAS,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,UAAU,CAAC;AAAA,IACrD,UAAU,MAAM,QAAQ,IAAI,QAAQ,IAAI,IAAI,WAAW,CAAC;AAAA,IACxD,MAAM,MAAM,QAAQ,IAAI,IAAI,IACxB,IAAI,KAAK,IAAI,CAAC,SAAS,EAAE,IAAI,OAAO,IAAI,EAAE,GAAG,MAAM,OAAO,IAAI,IAAI,EAAE,EAAE,IACtE,CAAC;AAAA,IACL,wBAAwB,IAAI,0BAA0B;AAAA,IACtD,cAAc,IAAI,gBAAgB;AAAA,EACpC;AACF;AAqBA,eAAsB,YAAY,MAAoC;AACpE,QAAM,MAAM,MAAM,UAAU,YAAY;AACxC,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,QAAgB,MAAM,QAAQ,IAAI,IACnC,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAA0B,OAC5B,CAAC;AACP,SAAO,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK;AACrD;AAGA,eAAsB,gBAA0C;AAC9D,QAAM,MAAM,MAAM,UAAU,aAAa;AACzC,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,IAAI,eAAe,IAAI,CAAC;AAC5D;AAGA,eAAsB,iBAAiB,OAAmD;AACxF,QAAM,MAAM,MAAM,UAAU,eAAe;AAAA,IACzC,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,KAAK;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,SAAO,gBAAiB,MAAM,IAAI,KAAK,CAAsB;AAC/D;AAGA,eAAsB,oBACpB,IACA,OACwB;AACxB,QAAM,MAAM,MAAM,UAAU,GAAG,aAAa,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IACxE,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,KAAK;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,SAAO,gBAAiB,MAAM,IAAI,KAAK,CAAsB;AAC/D;AAGA,eAAsB,oBAAoB,IAA2B;AACnE,QAAM,MAAM,MAAM,UAAU,GAAG,aAAa,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IACxE,QAAQ;AAAA,EACV,CAAC;AAED,MAAI,CAAC,IAAI,MAAM,IAAI,WAAW,IAAK,OAAM,MAAM,eAAe,GAAG;AACnE;;;AC/HA,IAAM,6BAA6B;AAUnC,eAAe,cAAc,KAA+B;AAC1D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAOA,eAAsB,4BAAgE;AACpF,QAAM,MAAM,MAAM,UAAU,0BAA0B;AACtD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,cAAc,GAAG;AAC1C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,YAAuC,MAAM,QAAQ,IAAI,IAC1D,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAA6C,OAC/C,CAAC;AACP,SAAO,UAAU,IAAI,CAAC,cAAc;AAAA,IAClC,IAAI,OAAO,SAAS,EAAE;AAAA,IACtB,MAAM,SAAS,QAAQ;AAAA,IACvB,cAAc,SAAS,gBAAgB;AAAA,IACvC,QAAQ,SAAS,UAAU;AAAA,EAC7B,EAAE;AACJ;;;AClCA,IAAM,kBAAkB;AA2BxB,eAAe,gBAAgB,KAA+B;AAC5D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAMA,SAAS,oBAAoB,KAAuC;AAGlE,QAAM,YAAY;AAAA,IAChB,IAAI,eACF,IAAI,eACH,IAAI,YAAY,IAAI,SAAS,SAAS,KACtC,IAAI,YAAY,IAAI,SAAS,SAAS;AAAA,EAC3C;AACA,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,MAAM,IAAI,QAAQ;AAAA,IAClB,UAAU,IAAI,YAAY;AAAA,IAC1B,MAAM,IAAI,QAAQ;AAAA,IAClB,UAAU,IAAI,YAAY;AAAA,IAC1B,QAAQ,IAAI,UAAU;AAAA,IACtB;AAAA,EACF;AACF;AAOA,eAAsB,gBAAgB,QAA8C;AAClF,QAAM,MAAM,MAAM,UAAU,cAAc,mBAAmB,MAAM,CAAC,cAAc;AAClF,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,gBAAgB,GAAG;AAC5C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,OAAwB,MAAM,QAAQ,IAAI,IAC3C,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAAmC,OACrC,CAAC;AACP,SAAO,KAAK,IAAI,mBAAmB;AACrC;AAQA,eAAsB,iBAAiB,OAAiD;AACtF,QAAM,MAAM,MAAM,UAAU,iBAAiB;AAAA,IAC3C,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU;AAAA,MACnB,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,UAAU,MAAM,YAAY;AAAA,MAC5B,UAAU,MAAM;AAAA,MAChB,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,QAAQ,MAAM;AAAA,MACd,QAAQ,MAAM,UAAU,CAAC;AAAA,IAC3B,CAAC;AAAA,EACH,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,gBAAgB,GAAG;AAC5C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,EAAE,IAAI,OAAO,KAAK,EAAE,EAAE;AAC/B;AAMA,eAAsB,iBACpB,IACA,OACyB;AACzB,QAAM,OAAgC,CAAC;AACvC,MAAI,MAAM,SAAS,OAAW,MAAK,OAAO,MAAM;AAChD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,SAAS,OAAW,MAAK,OAAO,MAAM;AAChD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,WAAW,OAAW,MAAK,SAAS,MAAM;AACpD,QAAM,MAAM,MAAM,UAAU,GAAG,eAAe,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IAC1E,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,gBAAgB,GAAG;AAC5C,QAAM,SAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,SAAO,EAAE,IAAI,OAAO,KAAK,OAAO,OAAO,EAAE,IAAI,GAAG;AAClD;AAGA,eAAsB,iBAAiB,IAA2B;AAChE,QAAM,MAAM,MAAM,UAAU,GAAG,eAAe,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IAC1E,QAAQ;AAAA,EACV,CAAC;AAED,MAAI,CAAC,IAAI,MAAM,IAAI,WAAW,IAAK,OAAM,MAAM,gBAAgB,GAAG;AACpE;;;AHlHO,IAAM,sBAAsB;AAqC5B,SAAS,iBAA4C;AAC1D,QAAM,UAAW,WAAuC,mBAAmB;AAC3E,SAAQ,WAAkC;AAC5C;AAGO,SAAS,qBAAyC;AACvD,QAAM,UAAU,eAAe;AAC/B,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR,qHAC0C,mBAAmB;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,UAAU,OAAe,MAAuC;AAC9E,QAAM,UAAU,eAAe;AAC/B,MAAI,QAAS,QAAO,QAAQ,UAAU,OAAO,IAAI;AACjD,SAAO,MAAM,OAAO,IAAI;AAC1B;","names":[]}

package/dist/client/index.d.cts

@@ -1,6 +1,6 @@
 import { ComponentType, LazyExoticComponent, Context } from 'react';
-import { F as InventoryItemInput, I as InventoryItem, f as AccessServerInput, e as AccessServer, y as ConnectivityProviderRef, B as CredentialInput, D as CredentialSummary, b as AppContextValue } from '../use-app-context-CEUSdc_c.cjs';
-export { A as AppBrandingDeclaration, z as Credential } from '../use-app-context-CEUSdc_c.cjs';
+import { D as InventoryItemInput, I as InventoryItem, w as ConnectivityProviderRef, y as CredentialInput, z as CredentialSummary, b as AppContextValue } from '../use-app-context-hBtYClFu.cjs';
+export { A as AppBrandingDeclaration, x as Credential } from '../use-app-context-hBtYClFu.cjs';
 
 /**
  * A platform Tool. Each installed app is upserted as a Tool keyed by its
@@ -30,14 +30,6 @@ declare function updateInventoryItem(id: string, input: InventoryItemInput): Pro
 /** Remove an inventory item. DELETE /api/components/:id */
 declare function removeInventoryItem(id: string): Promise<void>;
 
-/** List the customer's access servers (ZTNA gateways). GET /api/access-servers */
-declare function listAccessServers(): Promise<AccessServer[]>;
-/** Add a new access server (ZTNA gateway). POST /api/access-servers */
-declare function addAccessServer(input: AccessServerInput): Promise<AccessServer>;
-/** Update an existing access server. PUT /api/access-servers/:id */
-declare function updateAccessServer(id: string, input: AccessServerInput): Promise<AccessServer>;
-/** Remove an access server. DELETE /api/access-servers/:id */
-declare function removeAccessServer(id: string): Promise<void>;
 /**
  * List the customer's ZTNA connectivity providers, used to populate the Access
  * Server link picker. GET /api/connectivity-providers (the endpoint may return
@@ -131,4 +123,4 @@ interface AppClientModule {
     sidebarItems?: AppSidebarItem[];
 }
 
-export { AccessServer, AccessServerInput, type AppClientModule, type AppSidebarItem, ConnectivityProviderRef, CredentialInput, CredentialSummary, HOST_RUNTIME_GLOBAL, InventoryItem, InventoryItemInput, type Tool, type VeltrixHostRuntime, addAccessServer, addInventoryItem, authFetch, createCredential, getHostRuntime, listAccessServers, listConnectivityProviders, listCredentials, listInventory, removeAccessServer, removeCredential, removeInventoryItem, requireHostRuntime, resolveTool, updateAccessServer, updateCredential, updateInventoryItem };
+export { type AppClientModule, type AppSidebarItem, ConnectivityProviderRef, CredentialInput, CredentialSummary, HOST_RUNTIME_GLOBAL, InventoryItem, InventoryItemInput, type Tool, type VeltrixHostRuntime, addInventoryItem, authFetch, createCredential, getHostRuntime, listConnectivityProviders, listCredentials, listInventory, removeCredential, removeInventoryItem, requireHostRuntime, resolveTool, updateCredential, updateInventoryItem };

package/dist/client/index.d.ts

@@ -1,6 +1,6 @@
 import { ComponentType, LazyExoticComponent, Context } from 'react';
-import { F as InventoryItemInput, I as InventoryItem, f as AccessServerInput, e as AccessServer, y as ConnectivityProviderRef, B as CredentialInput, D as CredentialSummary, b as AppContextValue } from '../use-app-context-CEUSdc_c.js';
-export { A as AppBrandingDeclaration, z as Credential } from '../use-app-context-CEUSdc_c.js';
+import { D as InventoryItemInput, I as InventoryItem, w as ConnectivityProviderRef, y as CredentialInput, z as CredentialSummary, b as AppContextValue } from '../use-app-context-hBtYClFu.js';
+export { A as AppBrandingDeclaration, x as Credential } from '../use-app-context-hBtYClFu.js';
 
 /**
  * A platform Tool. Each installed app is upserted as a Tool keyed by its
@@ -30,14 +30,6 @@ declare function updateInventoryItem(id: string, input: InventoryItemInput): Pro
 /** Remove an inventory item. DELETE /api/components/:id */
 declare function removeInventoryItem(id: string): Promise<void>;
 
-/** List the customer's access servers (ZTNA gateways). GET /api/access-servers */
-declare function listAccessServers(): Promise<AccessServer[]>;
-/** Add a new access server (ZTNA gateway). POST /api/access-servers */
-declare function addAccessServer(input: AccessServerInput): Promise<AccessServer>;
-/** Update an existing access server. PUT /api/access-servers/:id */
-declare function updateAccessServer(id: string, input: AccessServerInput): Promise<AccessServer>;
-/** Remove an access server. DELETE /api/access-servers/:id */
-declare function removeAccessServer(id: string): Promise<void>;
 /**
  * List the customer's ZTNA connectivity providers, used to populate the Access
  * Server link picker. GET /api/connectivity-providers (the endpoint may return
@@ -131,4 +123,4 @@ interface AppClientModule {
     sidebarItems?: AppSidebarItem[];
 }
 
-export { AccessServer, AccessServerInput, type AppClientModule, type AppSidebarItem, ConnectivityProviderRef, CredentialInput, CredentialSummary, HOST_RUNTIME_GLOBAL, InventoryItem, InventoryItemInput, type Tool, type VeltrixHostRuntime, addAccessServer, addInventoryItem, authFetch, createCredential, getHostRuntime, listAccessServers, listConnectivityProviders, listCredentials, listInventory, removeAccessServer, removeCredential, removeInventoryItem, requireHostRuntime, resolveTool, updateAccessServer, updateCredential, updateInventoryItem };
+export { type AppClientModule, type AppSidebarItem, ConnectivityProviderRef, CredentialInput, CredentialSummary, HOST_RUNTIME_GLOBAL, InventoryItem, InventoryItemInput, type Tool, type VeltrixHostRuntime, addInventoryItem, authFetch, createCredential, getHostRuntime, listConnectivityProviders, listCredentials, listInventory, removeCredential, removeInventoryItem, requireHostRuntime, resolveTool, updateCredential, updateInventoryItem };

package/dist/client/index.js

@@ -1,40 +1,32 @@
 import {
   HOST_RUNTIME_GLOBAL,
-  addAccessServer,
   addInventoryItem,
   authFetch,
   createCredential,
   getHostRuntime,
-  listAccessServers,
   listConnectivityProviders,
   listCredentials,
   listInventory,
-  removeAccessServer,
   removeCredential,
   removeInventoryItem,
   requireHostRuntime,
   resolveTool,
-  updateAccessServer,
   updateCredential,
   updateInventoryItem
-} from "../chunk-EVCWQYQY.js";
+} from "../chunk-NY6C4REE.js";
 export {
   HOST_RUNTIME_GLOBAL,
-  addAccessServer,
   addInventoryItem,
   authFetch,
   createCredential,
   getHostRuntime,
-  listAccessServers,
   listConnectivityProviders,
   listCredentials,
   listInventory,
-  removeAccessServer,
   removeCredential,
   removeInventoryItem,
   requireHostRuntime,
   resolveTool,
-  updateAccessServer,
   updateCredential,
   updateInventoryItem
 };