@veltrixsecops/app-sdk 3.1.0 → 3.2.0

package/dist/{chunk-6KUTYJW5.js → chunk-EOOEHZGC.js}

@@ -234,4 +234,4 @@ export {
   requireHostRuntime,
   authFetch
 };
-//# sourceMappingURL=chunk-6KUTYJW5.js.map
+//# sourceMappingURL=chunk-EOOEHZGC.js.map

package/dist/{chunk-6KUTYJW5.js.map → chunk-EOOEHZGC.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/client/inventory.ts","../src/client/connectivity.ts","../src/client/environments.ts","../src/client/credentials.ts","../src/client/index.ts"],"sourcesContent":["// ========================================================================\n// Inventory — the deployment targets an app can deploy configuration to.\n//\n// \"Inventory\" is the app-facing name for the platform's *components*: the\n// servers (hostname/port), domains, and IP/CIDR ranges a customer has\n// registered as deploy targets. These helpers are a typed, convenient\n// surface over the platform's components API (/api/components), enriched\n// with `domains` and `ipRanges`.\n//\n// Framework-free (no React) — safe to import from any client code. Every\n// call goes through the same `authFetch` the '/client' subpath exports, so\n// requests carry the platform's Authorization header. Non-2xx responses are\n// surfaced as thrown Errors carrying the platform's error text.\n// ========================================================================\n\nimport type { InventoryItem, InventoryItemInput } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's components (inventory) API. */\nconst INVENTORY_API = '/api/components'\n\n/**\n * Loosely-typed shape of a raw component as returned by the platform, before\n * it is normalized down to the {@link InventoryItem} surface.\n */\ninterface RawInventoryItem {\n  id: string\n  hostname?: string\n  port?: string\n  type?: string[]\n  domains?: string[]\n  ipRanges?: string[]\n  tags?: Array<{ id: string; name: string }>\n  connectivityProviderId?: string | null\n  credentialId?: string | null\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function inventoryError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/** Normalize a raw platform component into the typed InventoryItem surface. */\nfunction toInventoryItem(raw: RawInventoryItem): InventoryItem {\n  return {\n    id: String(raw.id),\n    hostname: raw.hostname ?? '',\n    port: raw.port ?? undefined,\n    type: Array.isArray(raw.type) ? raw.type : undefined,\n    domains: Array.isArray(raw.domains) ? raw.domains : [],\n    ipRanges: Array.isArray(raw.ipRanges) ? raw.ipRanges : [],\n    tags: Array.isArray(raw.tags)\n      ? raw.tags.map((tag) => ({ id: String(tag.id), name: String(tag.name) }))\n      : [],\n    connectivityProviderId: raw.connectivityProviderId ?? null,\n    credentialId: raw.credentialId ?? null,\n  }\n}\n\n/**\n * A platform Tool. Each installed app is upserted as a Tool keyed by its\n * manifest `name`, and inventory items (components) belong to a tool.\n */\nexport interface Tool {\n  id: string\n  name: string\n  vendor?: string\n}\n\n/**\n * Resolve the platform Tool for an app by its manifest name (the platform\n * upserts `Tool.name === app name`). The tool id is required by the platform\n * when creating an inventory item, so call this once and pass the id as\n * `toolId` to {@link addInventoryItem}. Returns null when no tool matches.\n *\n * GET /api/tools (the endpoint is paginated — `{ data, pagination }` — or a\n * bare array; both are handled).\n */\nexport async function resolveTool(name: string): Promise<Tool | null> {\n  const res = await authFetch('/api/tools')\n  if (!res.ok) throw await inventoryError(res)\n  const body = (await res.json()) as unknown\n  const tools: Tool[] = Array.isArray(body)\n    ? (body as Tool[])\n    : Array.isArray((body as { data?: unknown })?.data)\n      ? ((body as { data: Tool[] }).data)\n      : []\n  return tools.find((tool) => tool.name === name) ?? null\n}\n\n/** List the customer's inventory (deployment targets). GET /api/components */\nexport async function listInventory(): Promise<InventoryItem[]> {\n  const res = await authFetch(INVENTORY_API)\n  if (!res.ok) throw await inventoryError(res)\n  const data = (await res.json()) as RawInventoryItem[]\n  return Array.isArray(data) ? data.map(toInventoryItem) : []\n}\n\n/** Add a new inventory item (deployment target). POST /api/components */\nexport async function addInventoryItem(input: InventoryItemInput): Promise<InventoryItem> {\n  const res = await authFetch(INVENTORY_API, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(input),\n  })\n  if (!res.ok) throw await inventoryError(res)\n  return toInventoryItem((await res.json()) as RawInventoryItem)\n}\n\n/** Update an existing inventory item. PUT /api/components/:id */\nexport async function updateInventoryItem(\n  id: string,\n  input: InventoryItemInput,\n): Promise<InventoryItem> {\n  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(input),\n  })\n  if (!res.ok) throw await inventoryError(res)\n  return toInventoryItem((await res.json()) as RawInventoryItem)\n}\n\n/** Remove an inventory item. DELETE /api/components/:id */\nexport async function removeInventoryItem(id: string): Promise<void> {\n  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {\n    method: 'DELETE',\n  })\n  // 204 No Content is the platform's success response for delete.\n  if (!res.ok && res.status !== 204) throw await inventoryError(res)\n}\n","// ========================================================================\n// Connectivity providers — the customer's ZTNA providers (Tailscale,\n// WireGuard, ZeroTier, …), platform-managed under Settings → Connectivity.\n//\n// A thin reader over the platform's connectivity-providers API\n// (/api/connectivity-providers), used to populate the ZTNA link picker when\n// creating or editing an Access Server (a component). Framework-free — every\n// call goes through the same `authFetch` the '/client' subpath exports.\n// ========================================================================\n\nimport type { ConnectivityProviderRef } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's connectivity-providers API. */\nconst CONNECTIVITY_PROVIDERS_API = '/api/connectivity-providers'\n\ninterface RawConnectivityProvider {\n  id: string\n  name?: string\n  providerType?: string\n  status?: string\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function providerError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/**\n * List the customer's ZTNA connectivity providers, used to populate the Access\n * Server link picker. GET /api/connectivity-providers (the endpoint may return\n * a bare array or a paginated `{ data, ... }` shape — both are handled).\n */\nexport async function listConnectivityProviders(): Promise<ConnectivityProviderRef[]> {\n  const res = await authFetch(CONNECTIVITY_PROVIDERS_API)\n  if (!res.ok) throw await providerError(res)\n  const body = (await res.json()) as unknown\n  const providers: RawConnectivityProvider[] = Array.isArray(body)\n    ? (body as RawConnectivityProvider[])\n    : Array.isArray((body as { data?: unknown })?.data)\n      ? ((body as { data: RawConnectivityProvider[] }).data)\n      : []\n  return providers.map((provider) => ({\n    id: String(provider.id),\n    name: provider.name ?? '',\n    providerType: provider.providerType ?? undefined,\n    status: provider.status ?? undefined,\n  }))\n}\n","// ========================================================================\n// Environments — the deployment scopes that determine where a configuration is\n// pushed. Environments are the customer's platform tags (dev/staging/prod, …);\n// a Connection (credential) or Access Server (component) is tied to one by\n// carrying the environment id in its `tagIds`.\n//\n// A thin reader over the platform's environments API (/api/environments), used\n// to populate the Environment picker on the Connections and Access Servers\n// pages. Framework-free — every call goes through the same `authFetch` the\n// '/client' subpath exports.\n// ========================================================================\n\nimport type { EnvironmentRef } from '../types/pipeline'\nimport { authFetch } from './index'\n\n/** Base route for the platform's environments API. */\nconst ENVIRONMENTS_API = '/api/environments'\n\ninterface RawEnvironment {\n  id: string\n  name?: string\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function environmentError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/**\n * List the customer's environments (deployment scopes). GET /api/environments\n * (the endpoint may return a bare array or a paginated `{ data, ... }` shape —\n * both are handled). Use the returned id as a `tagIds` entry to tie a Connection\n * or Access Server to that environment.\n */\nexport async function listEnvironments(): Promise<EnvironmentRef[]> {\n  const res = await authFetch(ENVIRONMENTS_API)\n  if (!res.ok) throw await environmentError(res)\n  const body = (await res.json()) as unknown\n  const rows: RawEnvironment[] = Array.isArray(body)\n    ? (body as RawEnvironment[])\n    : Array.isArray((body as { data?: unknown })?.data)\n      ? ((body as { data: RawEnvironment[] }).data)\n      : []\n  return rows.map((env) => ({ id: String(env.id), name: env.name ?? '' }))\n}\n","// ========================================================================\n// Credentials — how an app authenticates to a server (\"connection\").\n//\n// A \"connection\" pairs a server (a platform *component* — see inventory.ts)\n// with a *credential*: the account and write-only secret used to reach that\n// server. These helpers are a typed surface over the platform's credentials\n// API (POST /api/credentials, GET /api/tools/:toolId/credentials, PUT/DELETE\n// /api/credentials/:id).\n//\n// Framework-free (no React). Every call goes through the same `authFetch` the\n// '/client' subpath exports, so requests carry the platform's Authorization\n// header. Non-2xx responses are surfaced as thrown Errors carrying the\n// platform's error text.\n//\n// SECURITY: `listCredentials` returns a REDACTED {@link CredentialSummary} —\n// secret material (password / apiToken / certificate) is dropped before it\n// reaches app code, so secrets are never held in memory or logged. Only whether\n// a secret exists is surfaced (`hasSecret`). Secrets are write-only: they can be\n// set via create/update, never read back.\n// ========================================================================\n\nimport type { CredentialInput, CredentialSummary } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's credentials API. */\nconst CREDENTIALS_API = '/api/credentials'\n\n/**\n * Loosely-typed shape of a raw credential as returned by the platform, before\n * it is redacted down to the {@link CredentialSummary} surface. The secret\n * fields (`password` / `apiToken` / `certificate`) are read here only to derive\n * `hasSecret` — they are never carried into app-visible data.\n */\ninterface RawCredential {\n  id: string\n  name?: string\n  username?: string\n  type?: string | null\n  endpoint?: string | null\n  toolId?: string\n  // The platform redacts secrets from credential responses and surfaces only\n  // whether each is set via these flags. Older platforms may still send the\n  // secret fields instead — both shapes are handled below.\n  hasPassword?: boolean\n  hasApiToken?: boolean\n  hasCertificate?: boolean\n  password?: string | null\n  apiToken?: string | null\n  certificate?: string | null\n  tags?: Array<{ id: string; name: string }>\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function credentialError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/**\n * Redact a raw platform credential down to the app-visible summary, dropping\n * every secret field and surfacing only whether a secret is stored.\n */\nfunction toCredentialSummary(raw: RawCredential): CredentialSummary {\n  // Prefer the redacted has* flags; fall back to the presence of the secret\n  // fields themselves for older platforms that still return them.\n  const hasSecret = Boolean(\n    raw.hasApiToken ||\n      raw.hasPassword ||\n      (raw.apiToken && raw.apiToken.length > 0) ||\n      (raw.password && raw.password.length > 0),\n  )\n  return {\n    id: String(raw.id),\n    name: raw.name ?? '',\n    username: raw.username ?? '',\n    type: raw.type ?? null,\n    endpoint: raw.endpoint ?? null,\n    toolId: raw.toolId ?? '',\n    hasSecret,\n    tags: Array.isArray(raw.tags)\n      ? raw.tags.map((t) => ({ id: String(t.id), name: String(t.name) }))\n      : [],\n  }\n}\n\n/**\n * List the redacted credentials registered for a tool. GET\n * /api/tools/:toolId/credentials. Secrets are stripped before return — see the\n * module's SECURITY note. Returns an empty array when the tool has none.\n */\nexport async function listCredentials(toolId: string): Promise<CredentialSummary[]> {\n  const res = await authFetch(`/api/tools/${encodeURIComponent(toolId)}/credentials`)\n  if (!res.ok) throw await credentialError(res)\n  const data = (await res.json()) as unknown\n  const rows: RawCredential[] = Array.isArray(data)\n    ? (data as RawCredential[])\n    : Array.isArray((data as { data?: unknown })?.data)\n      ? ((data as { data: RawCredential[] }).data)\n      : []\n  return rows.map(toCredentialSummary)\n}\n\n/**\n * Create a credential. POST /api/credentials. The platform requires `name`,\n * `username`, `password`, `toolId`, and `tagIds` — this helper defaults\n * `tagIds` to `[]` and `password` to `''` (valid for token-only auth, where the\n * secret travels in `apiToken`). Returns the new credential's id.\n */\nexport async function createCredential(input: CredentialInput): Promise<{ id: string }> {\n  const res = await authFetch(CREDENTIALS_API, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      name: input.name,\n      username: input.username,\n      password: input.password ?? '',\n      apiToken: input.apiToken,\n      type: input.type,\n      endpoint: input.endpoint,\n      toolId: input.toolId,\n      tagIds: input.tagIds ?? [],\n    }),\n  })\n  if (!res.ok) throw await credentialError(res)\n  const body = (await res.json()) as { id?: string }\n  return { id: String(body.id) }\n}\n\n/**\n * Update a credential. PUT /api/credentials/:id. Only the fields you pass are\n * changed; omit `password`/`apiToken` to leave the stored secret untouched.\n */\nexport async function updateCredential(\n  id: string,\n  input: Partial<CredentialInput>,\n): Promise<{ id: string }> {\n  const body: Record<string, unknown> = {}\n  if (input.name !== undefined) body.name = input.name\n  if (input.username !== undefined) body.username = input.username\n  if (input.password !== undefined) body.password = input.password\n  if (input.apiToken !== undefined) body.apiToken = input.apiToken\n  if (input.type !== undefined) body.type = input.type\n  if (input.endpoint !== undefined) body.endpoint = input.endpoint\n  if (input.tagIds !== undefined) body.tagIds = input.tagIds\n  const res = await authFetch(`${CREDENTIALS_API}/${encodeURIComponent(id)}`, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(body),\n  })\n  if (!res.ok) throw await credentialError(res)\n  const result = (await res.json().catch(() => ({}))) as { id?: string }\n  return { id: result.id ? String(result.id) : id }\n}\n\n/** Remove a credential. DELETE /api/credentials/:id. */\nexport async function removeCredential(id: string): Promise<void> {\n  const res = await authFetch(`${CREDENTIALS_API}/${encodeURIComponent(id)}`, {\n    method: 'DELETE',\n  })\n  // 204 No Content is the platform's success response for delete.\n  if (!res.ok && res.status !== 204) throw await credentialError(res)\n}\n","// ========================================================================\n// Client runtime contract — how app client bundles talk to the host.\n//\n// App client code is packaged as a hermetic ESM bundle in which `react`,\n// `react-dom`, `react/jsx-runtime`, and every `@veltrixsecops/app-sdk`\n// subpath are compile-time shims that read the host-provided runtime from\n// `globalThis.__VELTRIX_APP_RUNTIME__`. The platform installs that global\n// (with ITS React instance, the shared AppContext, and an authenticated\n// fetch) before dynamically importing any app bundle, so app components\n// render inside the host React tree with working hooks and context.\n//\n// App authors: import from '@veltrixsecops/app-sdk/client' (and /hooks) —\n// never bundle your own copy of react. Use `authFetch` for calls to your\n// app's server routes (/api/apps/<app-id>/...): plain fetch() lacks the\n// platform's Authorization header and will receive 401s.\n// ========================================================================\n\nimport type { ComponentType, Context, LazyExoticComponent } from 'react'\nimport type { AppContextValue } from '../hooks/use-app-context'\n\nexport type { AppBrandingDeclaration } from '../types/manifest'\n\n// Inventory — typed helpers over the platform's components API (deployment\n// targets: servers, domains, IP/CIDR ranges). Framework-free; they use the\n// `authFetch` exported below internally.\nexport {\n  listInventory,\n  addInventoryItem,\n  updateInventoryItem,\n  removeInventoryItem,\n  resolveTool,\n} from './inventory'\nexport type { Tool } from './inventory'\nexport type { InventoryItem, InventoryItemInput } from '../types/platform'\n\n// Connectivity providers — reader over the customer's ZTNA providers, used to\n// populate the Access Server link picker. Framework-free; uses `authFetch`.\nexport { listConnectivityProviders } from './connectivity'\nexport type { ConnectivityProviderRef } from '../types/platform'\n\n// Environments — reader over the customer's deployment scopes, used to populate\n// the Environment picker on Connections + Access Servers. Framework-free.\nexport { listEnvironments } from './environments'\nexport type { EnvironmentRef } from '../types/pipeline'\n\n// Credentials — typed helpers over the platform's credentials API. Paired with\n// a server (component) these form a \"connection\". Secrets are write-only:\n// `listCredentials` returns redacted summaries only. Framework-free; they use\n// the `authFetch` exported below internally.\nexport {\n  listCredentials,\n  createCredential,\n  updateCredential,\n  removeCredential,\n} from './credentials'\nexport type { Credential, CredentialSummary, CredentialInput } from '../types/platform'\n\n/** Name of the global the platform installs before loading app bundles. */\nexport const HOST_RUNTIME_GLOBAL = '__VELTRIX_APP_RUNTIME__'\n\n/**\n * The runtime surface the platform exposes to app client bundles.\n * The react/reactDom/jsxRuntime members are the host's own module objects —\n * app bundles are compiled with shims that re-export them, guaranteeing a\n * single React instance per page.\n */\nexport interface VeltrixHostRuntime {\n  /** The host's `react` module object. */\n  react: unknown\n  /** The host's `react-dom` module object. */\n  reactDom: unknown\n  /** The host's `react-dom/client` module object. */\n  reactDomClient?: unknown\n  /** The host's `react/jsx-runtime` module object. */\n  jsxRuntime: unknown\n  /** Shared app context — the host wraps app pages in its Provider. */\n  AppContext: Context<AppContextValue | null>\n  /** fetch() with the platform's Authorization header attached. */\n  authFetch: (input: string, init?: RequestInit) => Promise<Response>\n  /**\n   * The SDK surface app bundles receive for `@veltrixsecops/app-sdk`,\n   * `.../hooks`, and `.../client` imports (useAppContext, AppContext,\n   * usePipelineStatus, authFetch, getHostRuntime, ...).\n   */\n  sdk: Record<string, unknown>\n  /**\n   * The platform's design-system components and hooks, host-owned so they\n   * share the single host React instance. Keyed by the exact component/hook\n   * names re-exported from `@veltrixsecops/app-sdk/ui` (Button, Input, Card,\n   * DataTable, useToast, ...). Present only inside the platform.\n   */\n  ui?: Record<string, unknown>\n}\n\n/** Read the host runtime, or null outside the platform (tests, storybook). */\nexport function getHostRuntime(): VeltrixHostRuntime | null {\n  const runtime = (globalThis as Record<string, unknown>)[HOST_RUNTIME_GLOBAL]\n  return (runtime as VeltrixHostRuntime) ?? null\n}\n\n/** Read the host runtime, throwing a diagnosable error when absent. */\nexport function requireHostRuntime(): VeltrixHostRuntime {\n  const runtime = getHostRuntime()\n  if (!runtime) {\n    throw new Error(\n      'Veltrix host runtime not found — app client bundles only run inside the ' +\n        `Veltrix platform (missing globalThis.${HOST_RUNTIME_GLOBAL})`,\n    )\n  }\n  return runtime\n}\n\n/**\n * fetch() that carries the platform's Authorization header. Required for an\n * app page to call its own server routes (/api/apps/<app-id>/...), which are\n * bearer-token protected. Falls back to plain fetch outside the platform.\n */\nexport function authFetch(input: string, init?: RequestInit): Promise<Response> {\n  const runtime = getHostRuntime()\n  if (runtime) return runtime.authFetch(input, init)\n  return fetch(input, init)\n}\n\n/** A sidebar entry contributed by the app's client entry module. */\nexport interface AppSidebarItem {\n  path: string\n  label: string\n  icon?: string\n}\n\n/**\n * Shape of the default export of an app's `client/index.tsx`.\n * `pages` keys must match `manifest.client.pages[].component`.\n */\nexport interface AppClientModule {\n  id: string\n  pages: Record<string, ComponentType | LazyExoticComponent<ComponentType>>\n  sidebarItems?: AppSidebarItem[]\n}\n"],"mappings":";AAmBA,IAAM,gBAAgB;AAmBtB,eAAe,eAAe,KAA+B;AAC3D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAGA,SAAS,gBAAgB,KAAsC;AAC7D,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,UAAU,IAAI,YAAY;AAAA,IAC1B,MAAM,IAAI,QAAQ;AAAA,IAClB,MAAM,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAO;AAAA,IAC3C,SAAS,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,UAAU,CAAC;AAAA,IACrD,UAAU,MAAM,QAAQ,IAAI,QAAQ,IAAI,IAAI,WAAW,CAAC;AAAA,IACxD,MAAM,MAAM,QAAQ,IAAI,IAAI,IACxB,IAAI,KAAK,IAAI,CAAC,SAAS,EAAE,IAAI,OAAO,IAAI,EAAE,GAAG,MAAM,OAAO,IAAI,IAAI,EAAE,EAAE,IACtE,CAAC;AAAA,IACL,wBAAwB,IAAI,0BAA0B;AAAA,IACtD,cAAc,IAAI,gBAAgB;AAAA,EACpC;AACF;AAqBA,eAAsB,YAAY,MAAoC;AACpE,QAAM,MAAM,MAAM,UAAU,YAAY;AACxC,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,QAAgB,MAAM,QAAQ,IAAI,IACnC,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAA0B,OAC5B,CAAC;AACP,SAAO,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK;AACrD;AAGA,eAAsB,gBAA0C;AAC9D,QAAM,MAAM,MAAM,UAAU,aAAa;AACzC,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,IAAI,eAAe,IAAI,CAAC;AAC5D;AAGA,eAAsB,iBAAiB,OAAmD;AACxF,QAAM,MAAM,MAAM,UAAU,eAAe;AAAA,IACzC,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,KAAK;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,SAAO,gBAAiB,MAAM,IAAI,KAAK,CAAsB;AAC/D;AAGA,eAAsB,oBACpB,IACA,OACwB;AACxB,QAAM,MAAM,MAAM,UAAU,GAAG,aAAa,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IACxE,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,KAAK;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,SAAO,gBAAiB,MAAM,IAAI,KAAK,CAAsB;AAC/D;AAGA,eAAsB,oBAAoB,IAA2B;AACnE,QAAM,MAAM,MAAM,UAAU,GAAG,aAAa,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IACxE,QAAQ;AAAA,EACV,CAAC;AAED,MAAI,CAAC,IAAI,MAAM,IAAI,WAAW,IAAK,OAAM,MAAM,eAAe,GAAG;AACnE;;;AC/HA,IAAM,6BAA6B;AAUnC,eAAe,cAAc,KAA+B;AAC1D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAOA,eAAsB,4BAAgE;AACpF,QAAM,MAAM,MAAM,UAAU,0BAA0B;AACtD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,cAAc,GAAG;AAC1C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,YAAuC,MAAM,QAAQ,IAAI,IAC1D,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAA6C,OAC/C,CAAC;AACP,SAAO,UAAU,IAAI,CAAC,cAAc;AAAA,IAClC,IAAI,OAAO,SAAS,EAAE;AAAA,IACtB,MAAM,SAAS,QAAQ;AAAA,IACvB,cAAc,SAAS,gBAAgB;AAAA,IACvC,QAAQ,SAAS,UAAU;AAAA,EAC7B,EAAE;AACJ;;;AC3CA,IAAM,mBAAmB;AAQzB,eAAe,iBAAiB,KAA+B;AAC7D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAQA,eAAsB,mBAA8C;AAClE,QAAM,MAAM,MAAM,UAAU,gBAAgB;AAC5C,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,iBAAiB,GAAG;AAC7C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,OAAyB,MAAM,QAAQ,IAAI,IAC5C,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAAoC,OACtC,CAAC;AACP,SAAO,KAAK,IAAI,CAAC,SAAS,EAAE,IAAI,OAAO,IAAI,EAAE,GAAG,MAAM,IAAI,QAAQ,GAAG,EAAE;AACzE;;;AC9BA,IAAM,kBAAkB;AA4BxB,eAAe,gBAAgB,KAA+B;AAC5D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAMA,SAAS,oBAAoB,KAAuC;AAGlE,QAAM,YAAY;AAAA,IAChB,IAAI,eACF,IAAI,eACH,IAAI,YAAY,IAAI,SAAS,SAAS,KACtC,IAAI,YAAY,IAAI,SAAS,SAAS;AAAA,EAC3C;AACA,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,MAAM,IAAI,QAAQ;AAAA,IAClB,UAAU,IAAI,YAAY;AAAA,IAC1B,MAAM,IAAI,QAAQ;AAAA,IAClB,UAAU,IAAI,YAAY;AAAA,IAC1B,QAAQ,IAAI,UAAU;AAAA,IACtB;AAAA,IACA,MAAM,MAAM,QAAQ,IAAI,IAAI,IACxB,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,IAAI,OAAO,EAAE,EAAE,GAAG,MAAM,OAAO,EAAE,IAAI,EAAE,EAAE,IAChE,CAAC;AAAA,EACP;AACF;AAOA,eAAsB,gBAAgB,QAA8C;AAClF,QAAM,MAAM,MAAM,UAAU,cAAc,mBAAmB,MAAM,CAAC,cAAc;AAClF,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,gBAAgB,GAAG;AAC5C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,OAAwB,MAAM,QAAQ,IAAI,IAC3C,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAAmC,OACrC,CAAC;AACP,SAAO,KAAK,IAAI,mBAAmB;AACrC;AAQA,eAAsB,iBAAiB,OAAiD;AACtF,QAAM,MAAM,MAAM,UAAU,iBAAiB;AAAA,IAC3C,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU;AAAA,MACnB,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,UAAU,MAAM,YAAY;AAAA,MAC5B,UAAU,MAAM;AAAA,MAChB,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,QAAQ,MAAM;AAAA,MACd,QAAQ,MAAM,UAAU,CAAC;AAAA,IAC3B,CAAC;AAAA,EACH,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,gBAAgB,GAAG;AAC5C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,EAAE,IAAI,OAAO,KAAK,EAAE,EAAE;AAC/B;AAMA,eAAsB,iBACpB,IACA,OACyB;AACzB,QAAM,OAAgC,CAAC;AACvC,MAAI,MAAM,SAAS,OAAW,MAAK,OAAO,MAAM;AAChD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,SAAS,OAAW,MAAK,OAAO,MAAM;AAChD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,WAAW,OAAW,MAAK,SAAS,MAAM;AACpD,QAAM,MAAM,MAAM,UAAU,GAAG,eAAe,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IAC1E,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,gBAAgB,GAAG;AAC5C,QAAM,SAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,SAAO,EAAE,IAAI,OAAO,KAAK,OAAO,OAAO,EAAE,IAAI,GAAG;AAClD;AAGA,eAAsB,iBAAiB,IAA2B;AAChE,QAAM,MAAM,MAAM,UAAU,GAAG,eAAe,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IAC1E,QAAQ;AAAA,EACV,CAAC;AAED,MAAI,CAAC,IAAI,MAAM,IAAI,WAAW,IAAK,OAAM,MAAM,gBAAgB,GAAG;AACpE;;;ACjHO,IAAM,sBAAsB;AAqC5B,SAAS,iBAA4C;AAC1D,QAAM,UAAW,WAAuC,mBAAmB;AAC3E,SAAQ,WAAkC;AAC5C;AAGO,SAAS,qBAAyC;AACvD,QAAM,UAAU,eAAe;AAC/B,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR,qHAC0C,mBAAmB;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,UAAU,OAAe,MAAuC;AAC9E,QAAM,UAAU,eAAe;AAC/B,MAAI,QAAS,QAAO,QAAQ,UAAU,OAAO,IAAI;AACjD,SAAO,MAAM,OAAO,IAAI;AAC1B;","names":[]}
+{"version":3,"sources":["../src/client/inventory.ts","../src/client/connectivity.ts","../src/client/environments.ts","../src/client/credentials.ts","../src/client/index.ts"],"sourcesContent":["// ========================================================================\n// Inventory — the deployment targets an app can deploy configuration to.\n//\n// \"Inventory\" is the app-facing name for the platform's *components*: the\n// servers (hostname/port), domains, and IP/CIDR ranges a customer has\n// registered as deploy targets. These helpers are a typed, convenient\n// surface over the platform's components API (/api/components), enriched\n// with `domains` and `ipRanges`.\n//\n// Framework-free (no React) — safe to import from any client code. Every\n// call goes through the same `authFetch` the '/client' subpath exports, so\n// requests carry the platform's Authorization header. Non-2xx responses are\n// surfaced as thrown Errors carrying the platform's error text.\n// ========================================================================\n\nimport type { InventoryItem, InventoryItemInput } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's components (inventory) API. */\nconst INVENTORY_API = '/api/components'\n\n/**\n * Loosely-typed shape of a raw component as returned by the platform, before\n * it is normalized down to the {@link InventoryItem} surface.\n */\ninterface RawInventoryItem {\n  id: string\n  hostname?: string\n  port?: string\n  type?: string[]\n  domains?: string[]\n  ipRanges?: string[]\n  tags?: Array<{ id: string; name: string }>\n  connectivityProviderId?: string | null\n  credentialId?: string | null\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function inventoryError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/** Normalize a raw platform component into the typed InventoryItem surface. */\nfunction toInventoryItem(raw: RawInventoryItem): InventoryItem {\n  return {\n    id: String(raw.id),\n    hostname: raw.hostname ?? '',\n    port: raw.port ?? undefined,\n    type: Array.isArray(raw.type) ? raw.type : undefined,\n    domains: Array.isArray(raw.domains) ? raw.domains : [],\n    ipRanges: Array.isArray(raw.ipRanges) ? raw.ipRanges : [],\n    tags: Array.isArray(raw.tags)\n      ? raw.tags.map((tag) => ({ id: String(tag.id), name: String(tag.name) }))\n      : [],\n    connectivityProviderId: raw.connectivityProviderId ?? null,\n    credentialId: raw.credentialId ?? null,\n  }\n}\n\n/**\n * A platform Tool. Each installed app is upserted as a Tool keyed by its\n * manifest `name`, and inventory items (components) belong to a tool.\n */\nexport interface Tool {\n  id: string\n  name: string\n  vendor?: string\n}\n\n/**\n * Resolve the platform Tool for an app by its manifest name (the platform\n * upserts `Tool.name === app name`). The tool id is required by the platform\n * when creating an inventory item, so call this once and pass the id as\n * `toolId` to {@link addInventoryItem}. Returns null when no tool matches.\n *\n * GET /api/tools (the endpoint is paginated — `{ data, pagination }` — or a\n * bare array; both are handled).\n */\nexport async function resolveTool(name: string): Promise<Tool | null> {\n  const res = await authFetch('/api/tools')\n  if (!res.ok) throw await inventoryError(res)\n  const body = (await res.json()) as unknown\n  const tools: Tool[] = Array.isArray(body)\n    ? (body as Tool[])\n    : Array.isArray((body as { data?: unknown })?.data)\n      ? ((body as { data: Tool[] }).data)\n      : []\n  return tools.find((tool) => tool.name === name) ?? null\n}\n\n/** List the customer's inventory (deployment targets). GET /api/components */\nexport async function listInventory(): Promise<InventoryItem[]> {\n  const res = await authFetch(INVENTORY_API)\n  if (!res.ok) throw await inventoryError(res)\n  const data = (await res.json()) as RawInventoryItem[]\n  return Array.isArray(data) ? data.map(toInventoryItem) : []\n}\n\n/** Add a new inventory item (deployment target). POST /api/components */\nexport async function addInventoryItem(input: InventoryItemInput): Promise<InventoryItem> {\n  const res = await authFetch(INVENTORY_API, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(input),\n  })\n  if (!res.ok) throw await inventoryError(res)\n  return toInventoryItem((await res.json()) as RawInventoryItem)\n}\n\n/** Update an existing inventory item. PUT /api/components/:id */\nexport async function updateInventoryItem(\n  id: string,\n  input: InventoryItemInput,\n): Promise<InventoryItem> {\n  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(input),\n  })\n  if (!res.ok) throw await inventoryError(res)\n  return toInventoryItem((await res.json()) as RawInventoryItem)\n}\n\n/** Remove an inventory item. DELETE /api/components/:id */\nexport async function removeInventoryItem(id: string): Promise<void> {\n  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {\n    method: 'DELETE',\n  })\n  // 204 No Content is the platform's success response for delete.\n  if (!res.ok && res.status !== 204) throw await inventoryError(res)\n}\n","// ========================================================================\n// Connectivity providers — the customer's ZTNA providers (Tailscale,\n// WireGuard, ZeroTier, …), platform-managed under Settings → Connectivity.\n//\n// A thin reader over the platform's connectivity-providers API\n// (/api/connectivity-providers), used to populate the ZTNA link picker when\n// creating or editing an Access Server (a component). Framework-free — every\n// call goes through the same `authFetch` the '/client' subpath exports.\n// ========================================================================\n\nimport type { ConnectivityProviderRef } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's connectivity-providers API. */\nconst CONNECTIVITY_PROVIDERS_API = '/api/connectivity-providers'\n\ninterface RawConnectivityProvider {\n  id: string\n  name?: string\n  providerType?: string\n  status?: string\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function providerError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/**\n * List the customer's ZTNA connectivity providers, used to populate the Access\n * Server link picker. GET /api/connectivity-providers (the endpoint may return\n * a bare array or a paginated `{ data, ... }` shape — both are handled).\n */\nexport async function listConnectivityProviders(): Promise<ConnectivityProviderRef[]> {\n  const res = await authFetch(CONNECTIVITY_PROVIDERS_API)\n  if (!res.ok) throw await providerError(res)\n  const body = (await res.json()) as unknown\n  const providers: RawConnectivityProvider[] = Array.isArray(body)\n    ? (body as RawConnectivityProvider[])\n    : Array.isArray((body as { data?: unknown })?.data)\n      ? ((body as { data: RawConnectivityProvider[] }).data)\n      : []\n  return providers.map((provider) => ({\n    id: String(provider.id),\n    name: provider.name ?? '',\n    providerType: provider.providerType ?? undefined,\n    status: provider.status ?? undefined,\n  }))\n}\n","// ========================================================================\n// Environments — the deployment scopes that determine where a configuration is\n// pushed. Environments are the customer's platform tags (dev/staging/prod, …);\n// a Connection (credential) or Access Server (component) is tied to one by\n// carrying the environment id in its `tagIds`.\n//\n// A thin reader over the platform's environments API (/api/environments), used\n// to populate the Environment picker on the Connections and Access Servers\n// pages. Framework-free — every call goes through the same `authFetch` the\n// '/client' subpath exports.\n// ========================================================================\n\nimport type { EnvironmentRef } from '../types/pipeline'\nimport { authFetch } from './index'\n\n/** Base route for the platform's environments API. */\nconst ENVIRONMENTS_API = '/api/environments'\n\ninterface RawEnvironment {\n  id: string\n  name?: string\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function environmentError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/**\n * List the customer's environments (deployment scopes). GET /api/environments\n * (the endpoint may return a bare array or a paginated `{ data, ... }` shape —\n * both are handled). Use the returned id as a `tagIds` entry to tie a Connection\n * or Access Server to that environment.\n */\nexport async function listEnvironments(): Promise<EnvironmentRef[]> {\n  const res = await authFetch(ENVIRONMENTS_API)\n  if (!res.ok) throw await environmentError(res)\n  const body = (await res.json()) as unknown\n  const rows: RawEnvironment[] = Array.isArray(body)\n    ? (body as RawEnvironment[])\n    : Array.isArray((body as { data?: unknown })?.data)\n      ? ((body as { data: RawEnvironment[] }).data)\n      : []\n  return rows.map((env) => ({ id: String(env.id), name: env.name ?? '' }))\n}\n","// ========================================================================\n// Credentials — how an app authenticates to a server (\"connection\").\n//\n// A \"connection\" pairs a server (a platform *component* — see inventory.ts)\n// with a *credential*: the account and write-only secret used to reach that\n// server. These helpers are a typed surface over the platform's credentials\n// API (POST /api/credentials, GET /api/tools/:toolId/credentials, PUT/DELETE\n// /api/credentials/:id).\n//\n// Framework-free (no React). Every call goes through the same `authFetch` the\n// '/client' subpath exports, so requests carry the platform's Authorization\n// header. Non-2xx responses are surfaced as thrown Errors carrying the\n// platform's error text.\n//\n// SECURITY: `listCredentials` returns a REDACTED {@link CredentialSummary} —\n// secret material (password / apiToken / certificate) is dropped before it\n// reaches app code, so secrets are never held in memory or logged. Only whether\n// a secret exists is surfaced (`hasSecret`). Secrets are write-only: they can be\n// set via create/update, never read back.\n// ========================================================================\n\nimport type { CredentialInput, CredentialSummary } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's credentials API. */\nconst CREDENTIALS_API = '/api/credentials'\n\n/**\n * Loosely-typed shape of a raw credential as returned by the platform, before\n * it is redacted down to the {@link CredentialSummary} surface. The secret\n * fields (`password` / `apiToken` / `certificate`) are read here only to derive\n * `hasSecret` — they are never carried into app-visible data.\n */\ninterface RawCredential {\n  id: string\n  name?: string\n  username?: string\n  type?: string | null\n  endpoint?: string | null\n  toolId?: string\n  // The platform redacts secrets from credential responses and surfaces only\n  // whether each is set via these flags. Older platforms may still send the\n  // secret fields instead — both shapes are handled below.\n  hasPassword?: boolean\n  hasApiToken?: boolean\n  hasCertificate?: boolean\n  password?: string | null\n  apiToken?: string | null\n  certificate?: string | null\n  tags?: Array<{ id: string; name: string }>\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function credentialError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/**\n * Redact a raw platform credential down to the app-visible summary, dropping\n * every secret field and surfacing only whether a secret is stored.\n */\nfunction toCredentialSummary(raw: RawCredential): CredentialSummary {\n  // Prefer the redacted has* flags; fall back to the presence of the secret\n  // fields themselves for older platforms that still return them.\n  const hasSecret = Boolean(\n    raw.hasApiToken ||\n      raw.hasPassword ||\n      (raw.apiToken && raw.apiToken.length > 0) ||\n      (raw.password && raw.password.length > 0),\n  )\n  return {\n    id: String(raw.id),\n    name: raw.name ?? '',\n    username: raw.username ?? '',\n    type: raw.type ?? null,\n    endpoint: raw.endpoint ?? null,\n    toolId: raw.toolId ?? '',\n    hasSecret,\n    tags: Array.isArray(raw.tags)\n      ? raw.tags.map((t) => ({ id: String(t.id), name: String(t.name) }))\n      : [],\n  }\n}\n\n/**\n * List the redacted credentials registered for a tool. GET\n * /api/tools/:toolId/credentials. Secrets are stripped before return — see the\n * module's SECURITY note. Returns an empty array when the tool has none.\n */\nexport async function listCredentials(toolId: string): Promise<CredentialSummary[]> {\n  const res = await authFetch(`/api/tools/${encodeURIComponent(toolId)}/credentials`)\n  if (!res.ok) throw await credentialError(res)\n  const data = (await res.json()) as unknown\n  const rows: RawCredential[] = Array.isArray(data)\n    ? (data as RawCredential[])\n    : Array.isArray((data as { data?: unknown })?.data)\n      ? ((data as { data: RawCredential[] }).data)\n      : []\n  return rows.map(toCredentialSummary)\n}\n\n/**\n * Create a credential. POST /api/credentials. The platform requires `name`,\n * `username`, `password`, `toolId`, and `tagIds` — this helper defaults\n * `tagIds` to `[]` and `password` to `''` (valid for token-only auth, where the\n * secret travels in `apiToken`). Returns the new credential's id.\n */\nexport async function createCredential(input: CredentialInput): Promise<{ id: string }> {\n  const res = await authFetch(CREDENTIALS_API, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      name: input.name,\n      username: input.username,\n      password: input.password ?? '',\n      apiToken: input.apiToken,\n      type: input.type,\n      endpoint: input.endpoint,\n      toolId: input.toolId,\n      tagIds: input.tagIds ?? [],\n    }),\n  })\n  if (!res.ok) throw await credentialError(res)\n  const body = (await res.json()) as { id?: string }\n  return { id: String(body.id) }\n}\n\n/**\n * Update a credential. PUT /api/credentials/:id. Only the fields you pass are\n * changed; omit `password`/`apiToken` to leave the stored secret untouched.\n */\nexport async function updateCredential(\n  id: string,\n  input: Partial<CredentialInput>,\n): Promise<{ id: string }> {\n  const body: Record<string, unknown> = {}\n  if (input.name !== undefined) body.name = input.name\n  if (input.username !== undefined) body.username = input.username\n  if (input.password !== undefined) body.password = input.password\n  if (input.apiToken !== undefined) body.apiToken = input.apiToken\n  if (input.type !== undefined) body.type = input.type\n  if (input.endpoint !== undefined) body.endpoint = input.endpoint\n  if (input.tagIds !== undefined) body.tagIds = input.tagIds\n  const res = await authFetch(`${CREDENTIALS_API}/${encodeURIComponent(id)}`, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(body),\n  })\n  if (!res.ok) throw await credentialError(res)\n  const result = (await res.json().catch(() => ({}))) as { id?: string }\n  return { id: result.id ? String(result.id) : id }\n}\n\n/** Remove a credential. DELETE /api/credentials/:id. */\nexport async function removeCredential(id: string): Promise<void> {\n  const res = await authFetch(`${CREDENTIALS_API}/${encodeURIComponent(id)}`, {\n    method: 'DELETE',\n  })\n  // 204 No Content is the platform's success response for delete.\n  if (!res.ok && res.status !== 204) throw await credentialError(res)\n}\n","// ========================================================================\n// Client runtime contract — how app client bundles talk to the host.\n//\n// App client code is packaged as a hermetic ESM bundle in which `react`,\n// `react-dom`, `react/jsx-runtime`, and every `@veltrixsecops/app-sdk`\n// subpath are compile-time shims that read the host-provided runtime from\n// `globalThis.__VELTRIX_APP_RUNTIME__`. The platform installs that global\n// (with ITS React instance, the shared AppContext, and an authenticated\n// fetch) before dynamically importing any app bundle, so app components\n// render inside the host React tree with working hooks and context.\n//\n// App authors: import from '@veltrixsecops/app-sdk/client' (and /hooks) —\n// never bundle your own copy of react. Use `authFetch` for calls to your\n// app's server routes (/api/apps/<app-id>/...): plain fetch() lacks the\n// platform's Authorization header and will receive 401s.\n// ========================================================================\n\nimport type { ComponentType, Context, LazyExoticComponent } from 'react'\nimport type { AppContextValue } from '../hooks/use-app-context'\nimport type { AppPermissionsApi } from '../types/platform'\n\nexport type { AppBrandingDeclaration } from '../types/manifest'\nexport type { AppPermissionsApi, PermissionEntry, PermissionCheckOptions } from '../types/platform'\n\n// Inventory — typed helpers over the platform's components API (deployment\n// targets: servers, domains, IP/CIDR ranges). Framework-free; they use the\n// `authFetch` exported below internally.\nexport {\n  listInventory,\n  addInventoryItem,\n  updateInventoryItem,\n  removeInventoryItem,\n  resolveTool,\n} from './inventory'\nexport type { Tool } from './inventory'\nexport type { InventoryItem, InventoryItemInput } from '../types/platform'\n\n// Connectivity providers — reader over the customer's ZTNA providers, used to\n// populate the Access Server link picker. Framework-free; uses `authFetch`.\nexport { listConnectivityProviders } from './connectivity'\nexport type { ConnectivityProviderRef } from '../types/platform'\n\n// Environments — reader over the customer's deployment scopes, used to populate\n// the Environment picker on Connections + Access Servers. Framework-free.\nexport { listEnvironments } from './environments'\nexport type { EnvironmentRef } from '../types/pipeline'\n\n// Credentials — typed helpers over the platform's credentials API. Paired with\n// a server (component) these form a \"connection\". Secrets are write-only:\n// `listCredentials` returns redacted summaries only. Framework-free; they use\n// the `authFetch` exported below internally.\nexport {\n  listCredentials,\n  createCredential,\n  updateCredential,\n  removeCredential,\n} from './credentials'\nexport type { Credential, CredentialSummary, CredentialInput } from '../types/platform'\n\n/** Name of the global the platform installs before loading app bundles. */\nexport const HOST_RUNTIME_GLOBAL = '__VELTRIX_APP_RUNTIME__'\n\n/**\n * The runtime surface the platform exposes to app client bundles.\n * The react/reactDom/jsxRuntime members are the host's own module objects —\n * app bundles are compiled with shims that re-export them, guaranteeing a\n * single React instance per page.\n */\nexport interface VeltrixHostRuntime {\n  /** The host's `react` module object. */\n  react: unknown\n  /** The host's `react-dom` module object. */\n  reactDom: unknown\n  /** The host's `react-dom/client` module object. */\n  reactDomClient?: unknown\n  /** The host's `react/jsx-runtime` module object. */\n  jsxRuntime: unknown\n  /** Shared app context — the host wraps app pages in its Provider. */\n  AppContext: Context<AppContextValue | null>\n  /** fetch() with the platform's Authorization header attached. */\n  authFetch: (input: string, init?: RequestInit) => Promise<Response>\n  /**\n   * The SDK surface app bundles receive for `@veltrixsecops/app-sdk`,\n   * `.../hooks`, and `.../client` imports (useAppContext, AppContext,\n   * usePipelineStatus, authFetch, getHostRuntime, ...).\n   */\n  sdk: Record<string, unknown>\n  /**\n   * The platform's design-system components and hooks, host-owned so they\n   * share the single host React instance. Keyed by the exact component/hook\n   * names re-exported from `@veltrixsecops/app-sdk/ui` (Button, Input, Card,\n   * DataTable, useToast, ...). Present only inside the platform.\n   */\n  ui?: Record<string, unknown>\n  /**\n   * Platform-scoped permission checks (RBAC/IdP hardening, Wave C4) —\n   * `opts.appId` is NOT defaulted here (omit for a platform-scoped check).\n   * App page code should prefer `usePermissions()`\n   * (`@veltrixsecops/app-sdk/hooks`), which defaults `opts.appId` to the\n   * app's own id. Optional for compatibility with a host that hasn't\n   * deployed this surface yet.\n   */\n  permissions?: AppPermissionsApi\n}\n\n/** Read the host runtime, or null outside the platform (tests, storybook). */\nexport function getHostRuntime(): VeltrixHostRuntime | null {\n  const runtime = (globalThis as Record<string, unknown>)[HOST_RUNTIME_GLOBAL]\n  return (runtime as VeltrixHostRuntime) ?? null\n}\n\n/** Read the host runtime, throwing a diagnosable error when absent. */\nexport function requireHostRuntime(): VeltrixHostRuntime {\n  const runtime = getHostRuntime()\n  if (!runtime) {\n    throw new Error(\n      'Veltrix host runtime not found — app client bundles only run inside the ' +\n        `Veltrix platform (missing globalThis.${HOST_RUNTIME_GLOBAL})`,\n    )\n  }\n  return runtime\n}\n\n/**\n * fetch() that carries the platform's Authorization header. Required for an\n * app page to call its own server routes (/api/apps/<app-id>/...), which are\n * bearer-token protected. Falls back to plain fetch outside the platform.\n */\nexport function authFetch(input: string, init?: RequestInit): Promise<Response> {\n  const runtime = getHostRuntime()\n  if (runtime) return runtime.authFetch(input, init)\n  return fetch(input, init)\n}\n\n/** A sidebar entry contributed by the app's client entry module. */\nexport interface AppSidebarItem {\n  path: string\n  label: string\n  icon?: string\n}\n\n/**\n * Shape of the default export of an app's `client/index.tsx`.\n * `pages` keys must match `manifest.client.pages[].component`.\n */\nexport interface AppClientModule {\n  id: string\n  pages: Record<string, ComponentType | LazyExoticComponent<ComponentType>>\n  sidebarItems?: AppSidebarItem[]\n}\n"],"mappings":";AAmBA,IAAM,gBAAgB;AAmBtB,eAAe,eAAe,KAA+B;AAC3D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAGA,SAAS,gBAAgB,KAAsC;AAC7D,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,UAAU,IAAI,YAAY;AAAA,IAC1B,MAAM,IAAI,QAAQ;AAAA,IAClB,MAAM,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAO;AAAA,IAC3C,SAAS,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,UAAU,CAAC;AAAA,IACrD,UAAU,MAAM,QAAQ,IAAI,QAAQ,IAAI,IAAI,WAAW,CAAC;AAAA,IACxD,MAAM,MAAM,QAAQ,IAAI,IAAI,IACxB,IAAI,KAAK,IAAI,CAAC,SAAS,EAAE,IAAI,OAAO,IAAI,EAAE,GAAG,MAAM,OAAO,IAAI,IAAI,EAAE,EAAE,IACtE,CAAC;AAAA,IACL,wBAAwB,IAAI,0BAA0B;AAAA,IACtD,cAAc,IAAI,gBAAgB;AAAA,EACpC;AACF;AAqBA,eAAsB,YAAY,MAAoC;AACpE,QAAM,MAAM,MAAM,UAAU,YAAY;AACxC,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,QAAgB,MAAM,QAAQ,IAAI,IACnC,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAA0B,OAC5B,CAAC;AACP,SAAO,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK;AACrD;AAGA,eAAsB,gBAA0C;AAC9D,QAAM,MAAM,MAAM,UAAU,aAAa;AACzC,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,IAAI,eAAe,IAAI,CAAC;AAC5D;AAGA,eAAsB,iBAAiB,OAAmD;AACxF,QAAM,MAAM,MAAM,UAAU,eAAe;AAAA,IACzC,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,KAAK;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,SAAO,gBAAiB,MAAM,IAAI,KAAK,CAAsB;AAC/D;AAGA,eAAsB,oBACpB,IACA,OACwB;AACxB,QAAM,MAAM,MAAM,UAAU,GAAG,aAAa,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IACxE,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,KAAK;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,SAAO,gBAAiB,MAAM,IAAI,KAAK,CAAsB;AAC/D;AAGA,eAAsB,oBAAoB,IAA2B;AACnE,QAAM,MAAM,MAAM,UAAU,GAAG,aAAa,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IACxE,QAAQ;AAAA,EACV,CAAC;AAED,MAAI,CAAC,IAAI,MAAM,IAAI,WAAW,IAAK,OAAM,MAAM,eAAe,GAAG;AACnE;;;AC/HA,IAAM,6BAA6B;AAUnC,eAAe,cAAc,KAA+B;AAC1D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAOA,eAAsB,4BAAgE;AACpF,QAAM,MAAM,MAAM,UAAU,0BAA0B;AACtD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,cAAc,GAAG;AAC1C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,YAAuC,MAAM,QAAQ,IAAI,IAC1D,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAA6C,OAC/C,CAAC;AACP,SAAO,UAAU,IAAI,CAAC,cAAc;AAAA,IAClC,IAAI,OAAO,SAAS,EAAE;AAAA,IACtB,MAAM,SAAS,QAAQ;AAAA,IACvB,cAAc,SAAS,gBAAgB;AAAA,IACvC,QAAQ,SAAS,UAAU;AAAA,EAC7B,EAAE;AACJ;;;AC3CA,IAAM,mBAAmB;AAQzB,eAAe,iBAAiB,KAA+B;AAC7D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAQA,eAAsB,mBAA8C;AAClE,QAAM,MAAM,MAAM,UAAU,gBAAgB;AAC5C,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,iBAAiB,GAAG;AAC7C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,OAAyB,MAAM,QAAQ,IAAI,IAC5C,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAAoC,OACtC,CAAC;AACP,SAAO,KAAK,IAAI,CAAC,SAAS,EAAE,IAAI,OAAO,IAAI,EAAE,GAAG,MAAM,IAAI,QAAQ,GAAG,EAAE;AACzE;;;AC9BA,IAAM,kBAAkB;AA4BxB,eAAe,gBAAgB,KAA+B;AAC5D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAMA,SAAS,oBAAoB,KAAuC;AAGlE,QAAM,YAAY;AAAA,IAChB,IAAI,eACF,IAAI,eACH,IAAI,YAAY,IAAI,SAAS,SAAS,KACtC,IAAI,YAAY,IAAI,SAAS,SAAS;AAAA,EAC3C;AACA,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,MAAM,IAAI,QAAQ;AAAA,IAClB,UAAU,IAAI,YAAY;AAAA,IAC1B,MAAM,IAAI,QAAQ;AAAA,IAClB,UAAU,IAAI,YAAY;AAAA,IAC1B,QAAQ,IAAI,UAAU;AAAA,IACtB;AAAA,IACA,MAAM,MAAM,QAAQ,IAAI,IAAI,IACxB,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,IAAI,OAAO,EAAE,EAAE,GAAG,MAAM,OAAO,EAAE,IAAI,EAAE,EAAE,IAChE,CAAC;AAAA,EACP;AACF;AAOA,eAAsB,gBAAgB,QAA8C;AAClF,QAAM,MAAM,MAAM,UAAU,cAAc,mBAAmB,MAAM,CAAC,cAAc;AAClF,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,gBAAgB,GAAG;AAC5C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,OAAwB,MAAM,QAAQ,IAAI,IAC3C,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAAmC,OACrC,CAAC;AACP,SAAO,KAAK,IAAI,mBAAmB;AACrC;AAQA,eAAsB,iBAAiB,OAAiD;AACtF,QAAM,MAAM,MAAM,UAAU,iBAAiB;AAAA,IAC3C,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU;AAAA,MACnB,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,UAAU,MAAM,YAAY;AAAA,MAC5B,UAAU,MAAM;AAAA,MAChB,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,QAAQ,MAAM;AAAA,MACd,QAAQ,MAAM,UAAU,CAAC;AAAA,IAC3B,CAAC;AAAA,EACH,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,gBAAgB,GAAG;AAC5C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,EAAE,IAAI,OAAO,KAAK,EAAE,EAAE;AAC/B;AAMA,eAAsB,iBACpB,IACA,OACyB;AACzB,QAAM,OAAgC,CAAC;AACvC,MAAI,MAAM,SAAS,OAAW,MAAK,OAAO,MAAM;AAChD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,SAAS,OAAW,MAAK,OAAO,MAAM;AAChD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,WAAW,OAAW,MAAK,SAAS,MAAM;AACpD,QAAM,MAAM,MAAM,UAAU,GAAG,eAAe,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IAC1E,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,gBAAgB,GAAG;AAC5C,QAAM,SAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,SAAO,EAAE,IAAI,OAAO,KAAK,OAAO,OAAO,EAAE,IAAI,GAAG;AAClD;AAGA,eAAsB,iBAAiB,IAA2B;AAChE,QAAM,MAAM,MAAM,UAAU,GAAG,eAAe,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IAC1E,QAAQ;AAAA,EACV,CAAC;AAED,MAAI,CAAC,IAAI,MAAM,IAAI,WAAW,IAAK,OAAM,MAAM,gBAAgB,GAAG;AACpE;;;AC/GO,IAAM,sBAAsB;AA8C5B,SAAS,iBAA4C;AAC1D,QAAM,UAAW,WAAuC,mBAAmB;AAC3E,SAAQ,WAAkC;AAC5C;AAGO,SAAS,qBAAyC;AACvD,QAAM,UAAU,eAAe;AAC/B,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR,qHAC0C,mBAAmB;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,UAAU,OAAe,MAAuC;AAC9E,QAAM,UAAU,eAAe;AAC/B,MAAI,QAAS,QAAO,QAAQ,UAAU,OAAO,IAAI;AACjD,SAAO,MAAM,OAAO,IAAI;AAC1B;","names":[]}

package/dist/client/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/client/index.ts","../../src/client/inventory.ts","../../src/client/connectivity.ts","../../src/client/environments.ts","../../src/client/credentials.ts"],"sourcesContent":["// ========================================================================\n// Client runtime contract — how app client bundles talk to the host.\n//\n// App client code is packaged as a hermetic ESM bundle in which `react`,\n// `react-dom`, `react/jsx-runtime`, and every `@veltrixsecops/app-sdk`\n// subpath are compile-time shims that read the host-provided runtime from\n// `globalThis.__VELTRIX_APP_RUNTIME__`. The platform installs that global\n// (with ITS React instance, the shared AppContext, and an authenticated\n// fetch) before dynamically importing any app bundle, so app components\n// render inside the host React tree with working hooks and context.\n//\n// App authors: import from '@veltrixsecops/app-sdk/client' (and /hooks) —\n// never bundle your own copy of react. Use `authFetch` for calls to your\n// app's server routes (/api/apps/<app-id>/...): plain fetch() lacks the\n// platform's Authorization header and will receive 401s.\n// ========================================================================\n\nimport type { ComponentType, Context, LazyExoticComponent } from 'react'\nimport type { AppContextValue } from '../hooks/use-app-context'\n\nexport type { AppBrandingDeclaration } from '../types/manifest'\n\n// Inventory — typed helpers over the platform's components API (deployment\n// targets: servers, domains, IP/CIDR ranges). Framework-free; they use the\n// `authFetch` exported below internally.\nexport {\n  listInventory,\n  addInventoryItem,\n  updateInventoryItem,\n  removeInventoryItem,\n  resolveTool,\n} from './inventory'\nexport type { Tool } from './inventory'\nexport type { InventoryItem, InventoryItemInput } from '../types/platform'\n\n// Connectivity providers — reader over the customer's ZTNA providers, used to\n// populate the Access Server link picker. Framework-free; uses `authFetch`.\nexport { listConnectivityProviders } from './connectivity'\nexport type { ConnectivityProviderRef } from '../types/platform'\n\n// Environments — reader over the customer's deployment scopes, used to populate\n// the Environment picker on Connections + Access Servers. Framework-free.\nexport { listEnvironments } from './environments'\nexport type { EnvironmentRef } from '../types/pipeline'\n\n// Credentials — typed helpers over the platform's credentials API. Paired with\n// a server (component) these form a \"connection\". Secrets are write-only:\n// `listCredentials` returns redacted summaries only. Framework-free; they use\n// the `authFetch` exported below internally.\nexport {\n  listCredentials,\n  createCredential,\n  updateCredential,\n  removeCredential,\n} from './credentials'\nexport type { Credential, CredentialSummary, CredentialInput } from '../types/platform'\n\n/** Name of the global the platform installs before loading app bundles. */\nexport const HOST_RUNTIME_GLOBAL = '__VELTRIX_APP_RUNTIME__'\n\n/**\n * The runtime surface the platform exposes to app client bundles.\n * The react/reactDom/jsxRuntime members are the host's own module objects —\n * app bundles are compiled with shims that re-export them, guaranteeing a\n * single React instance per page.\n */\nexport interface VeltrixHostRuntime {\n  /** The host's `react` module object. */\n  react: unknown\n  /** The host's `react-dom` module object. */\n  reactDom: unknown\n  /** The host's `react-dom/client` module object. */\n  reactDomClient?: unknown\n  /** The host's `react/jsx-runtime` module object. */\n  jsxRuntime: unknown\n  /** Shared app context — the host wraps app pages in its Provider. */\n  AppContext: Context<AppContextValue | null>\n  /** fetch() with the platform's Authorization header attached. */\n  authFetch: (input: string, init?: RequestInit) => Promise<Response>\n  /**\n   * The SDK surface app bundles receive for `@veltrixsecops/app-sdk`,\n   * `.../hooks`, and `.../client` imports (useAppContext, AppContext,\n   * usePipelineStatus, authFetch, getHostRuntime, ...).\n   */\n  sdk: Record<string, unknown>\n  /**\n   * The platform's design-system components and hooks, host-owned so they\n   * share the single host React instance. Keyed by the exact component/hook\n   * names re-exported from `@veltrixsecops/app-sdk/ui` (Button, Input, Card,\n   * DataTable, useToast, ...). Present only inside the platform.\n   */\n  ui?: Record<string, unknown>\n}\n\n/** Read the host runtime, or null outside the platform (tests, storybook). */\nexport function getHostRuntime(): VeltrixHostRuntime | null {\n  const runtime = (globalThis as Record<string, unknown>)[HOST_RUNTIME_GLOBAL]\n  return (runtime as VeltrixHostRuntime) ?? null\n}\n\n/** Read the host runtime, throwing a diagnosable error when absent. */\nexport function requireHostRuntime(): VeltrixHostRuntime {\n  const runtime = getHostRuntime()\n  if (!runtime) {\n    throw new Error(\n      'Veltrix host runtime not found — app client bundles only run inside the ' +\n        `Veltrix platform (missing globalThis.${HOST_RUNTIME_GLOBAL})`,\n    )\n  }\n  return runtime\n}\n\n/**\n * fetch() that carries the platform's Authorization header. Required for an\n * app page to call its own server routes (/api/apps/<app-id>/...), which are\n * bearer-token protected. Falls back to plain fetch outside the platform.\n */\nexport function authFetch(input: string, init?: RequestInit): Promise<Response> {\n  const runtime = getHostRuntime()\n  if (runtime) return runtime.authFetch(input, init)\n  return fetch(input, init)\n}\n\n/** A sidebar entry contributed by the app's client entry module. */\nexport interface AppSidebarItem {\n  path: string\n  label: string\n  icon?: string\n}\n\n/**\n * Shape of the default export of an app's `client/index.tsx`.\n * `pages` keys must match `manifest.client.pages[].component`.\n */\nexport interface AppClientModule {\n  id: string\n  pages: Record<string, ComponentType | LazyExoticComponent<ComponentType>>\n  sidebarItems?: AppSidebarItem[]\n}\n","// ========================================================================\n// Inventory — the deployment targets an app can deploy configuration to.\n//\n// \"Inventory\" is the app-facing name for the platform's *components*: the\n// servers (hostname/port), domains, and IP/CIDR ranges a customer has\n// registered as deploy targets. These helpers are a typed, convenient\n// surface over the platform's components API (/api/components), enriched\n// with `domains` and `ipRanges`.\n//\n// Framework-free (no React) — safe to import from any client code. Every\n// call goes through the same `authFetch` the '/client' subpath exports, so\n// requests carry the platform's Authorization header. Non-2xx responses are\n// surfaced as thrown Errors carrying the platform's error text.\n// ========================================================================\n\nimport type { InventoryItem, InventoryItemInput } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's components (inventory) API. */\nconst INVENTORY_API = '/api/components'\n\n/**\n * Loosely-typed shape of a raw component as returned by the platform, before\n * it is normalized down to the {@link InventoryItem} surface.\n */\ninterface RawInventoryItem {\n  id: string\n  hostname?: string\n  port?: string\n  type?: string[]\n  domains?: string[]\n  ipRanges?: string[]\n  tags?: Array<{ id: string; name: string }>\n  connectivityProviderId?: string | null\n  credentialId?: string | null\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function inventoryError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/** Normalize a raw platform component into the typed InventoryItem surface. */\nfunction toInventoryItem(raw: RawInventoryItem): InventoryItem {\n  return {\n    id: String(raw.id),\n    hostname: raw.hostname ?? '',\n    port: raw.port ?? undefined,\n    type: Array.isArray(raw.type) ? raw.type : undefined,\n    domains: Array.isArray(raw.domains) ? raw.domains : [],\n    ipRanges: Array.isArray(raw.ipRanges) ? raw.ipRanges : [],\n    tags: Array.isArray(raw.tags)\n      ? raw.tags.map((tag) => ({ id: String(tag.id), name: String(tag.name) }))\n      : [],\n    connectivityProviderId: raw.connectivityProviderId ?? null,\n    credentialId: raw.credentialId ?? null,\n  }\n}\n\n/**\n * A platform Tool. Each installed app is upserted as a Tool keyed by its\n * manifest `name`, and inventory items (components) belong to a tool.\n */\nexport interface Tool {\n  id: string\n  name: string\n  vendor?: string\n}\n\n/**\n * Resolve the platform Tool for an app by its manifest name (the platform\n * upserts `Tool.name === app name`). The tool id is required by the platform\n * when creating an inventory item, so call this once and pass the id as\n * `toolId` to {@link addInventoryItem}. Returns null when no tool matches.\n *\n * GET /api/tools (the endpoint is paginated — `{ data, pagination }` — or a\n * bare array; both are handled).\n */\nexport async function resolveTool(name: string): Promise<Tool | null> {\n  const res = await authFetch('/api/tools')\n  if (!res.ok) throw await inventoryError(res)\n  const body = (await res.json()) as unknown\n  const tools: Tool[] = Array.isArray(body)\n    ? (body as Tool[])\n    : Array.isArray((body as { data?: unknown })?.data)\n      ? ((body as { data: Tool[] }).data)\n      : []\n  return tools.find((tool) => tool.name === name) ?? null\n}\n\n/** List the customer's inventory (deployment targets). GET /api/components */\nexport async function listInventory(): Promise<InventoryItem[]> {\n  const res = await authFetch(INVENTORY_API)\n  if (!res.ok) throw await inventoryError(res)\n  const data = (await res.json()) as RawInventoryItem[]\n  return Array.isArray(data) ? data.map(toInventoryItem) : []\n}\n\n/** Add a new inventory item (deployment target). POST /api/components */\nexport async function addInventoryItem(input: InventoryItemInput): Promise<InventoryItem> {\n  const res = await authFetch(INVENTORY_API, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(input),\n  })\n  if (!res.ok) throw await inventoryError(res)\n  return toInventoryItem((await res.json()) as RawInventoryItem)\n}\n\n/** Update an existing inventory item. PUT /api/components/:id */\nexport async function updateInventoryItem(\n  id: string,\n  input: InventoryItemInput,\n): Promise<InventoryItem> {\n  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(input),\n  })\n  if (!res.ok) throw await inventoryError(res)\n  return toInventoryItem((await res.json()) as RawInventoryItem)\n}\n\n/** Remove an inventory item. DELETE /api/components/:id */\nexport async function removeInventoryItem(id: string): Promise<void> {\n  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {\n    method: 'DELETE',\n  })\n  // 204 No Content is the platform's success response for delete.\n  if (!res.ok && res.status !== 204) throw await inventoryError(res)\n}\n","// ========================================================================\n// Connectivity providers — the customer's ZTNA providers (Tailscale,\n// WireGuard, ZeroTier, …), platform-managed under Settings → Connectivity.\n//\n// A thin reader over the platform's connectivity-providers API\n// (/api/connectivity-providers), used to populate the ZTNA link picker when\n// creating or editing an Access Server (a component). Framework-free — every\n// call goes through the same `authFetch` the '/client' subpath exports.\n// ========================================================================\n\nimport type { ConnectivityProviderRef } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's connectivity-providers API. */\nconst CONNECTIVITY_PROVIDERS_API = '/api/connectivity-providers'\n\ninterface RawConnectivityProvider {\n  id: string\n  name?: string\n  providerType?: string\n  status?: string\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function providerError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/**\n * List the customer's ZTNA connectivity providers, used to populate the Access\n * Server link picker. GET /api/connectivity-providers (the endpoint may return\n * a bare array or a paginated `{ data, ... }` shape — both are handled).\n */\nexport async function listConnectivityProviders(): Promise<ConnectivityProviderRef[]> {\n  const res = await authFetch(CONNECTIVITY_PROVIDERS_API)\n  if (!res.ok) throw await providerError(res)\n  const body = (await res.json()) as unknown\n  const providers: RawConnectivityProvider[] = Array.isArray(body)\n    ? (body as RawConnectivityProvider[])\n    : Array.isArray((body as { data?: unknown })?.data)\n      ? ((body as { data: RawConnectivityProvider[] }).data)\n      : []\n  return providers.map((provider) => ({\n    id: String(provider.id),\n    name: provider.name ?? '',\n    providerType: provider.providerType ?? undefined,\n    status: provider.status ?? undefined,\n  }))\n}\n","// ========================================================================\n// Environments — the deployment scopes that determine where a configuration is\n// pushed. Environments are the customer's platform tags (dev/staging/prod, …);\n// a Connection (credential) or Access Server (component) is tied to one by\n// carrying the environment id in its `tagIds`.\n//\n// A thin reader over the platform's environments API (/api/environments), used\n// to populate the Environment picker on the Connections and Access Servers\n// pages. Framework-free — every call goes through the same `authFetch` the\n// '/client' subpath exports.\n// ========================================================================\n\nimport type { EnvironmentRef } from '../types/pipeline'\nimport { authFetch } from './index'\n\n/** Base route for the platform's environments API. */\nconst ENVIRONMENTS_API = '/api/environments'\n\ninterface RawEnvironment {\n  id: string\n  name?: string\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function environmentError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/**\n * List the customer's environments (deployment scopes). GET /api/environments\n * (the endpoint may return a bare array or a paginated `{ data, ... }` shape —\n * both are handled). Use the returned id as a `tagIds` entry to tie a Connection\n * or Access Server to that environment.\n */\nexport async function listEnvironments(): Promise<EnvironmentRef[]> {\n  const res = await authFetch(ENVIRONMENTS_API)\n  if (!res.ok) throw await environmentError(res)\n  const body = (await res.json()) as unknown\n  const rows: RawEnvironment[] = Array.isArray(body)\n    ? (body as RawEnvironment[])\n    : Array.isArray((body as { data?: unknown })?.data)\n      ? ((body as { data: RawEnvironment[] }).data)\n      : []\n  return rows.map((env) => ({ id: String(env.id), name: env.name ?? '' }))\n}\n","// ========================================================================\n// Credentials — how an app authenticates to a server (\"connection\").\n//\n// A \"connection\" pairs a server (a platform *component* — see inventory.ts)\n// with a *credential*: the account and write-only secret used to reach that\n// server. These helpers are a typed surface over the platform's credentials\n// API (POST /api/credentials, GET /api/tools/:toolId/credentials, PUT/DELETE\n// /api/credentials/:id).\n//\n// Framework-free (no React). Every call goes through the same `authFetch` the\n// '/client' subpath exports, so requests carry the platform's Authorization\n// header. Non-2xx responses are surfaced as thrown Errors carrying the\n// platform's error text.\n//\n// SECURITY: `listCredentials` returns a REDACTED {@link CredentialSummary} —\n// secret material (password / apiToken / certificate) is dropped before it\n// reaches app code, so secrets are never held in memory or logged. Only whether\n// a secret exists is surfaced (`hasSecret`). Secrets are write-only: they can be\n// set via create/update, never read back.\n// ========================================================================\n\nimport type { CredentialInput, CredentialSummary } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's credentials API. */\nconst CREDENTIALS_API = '/api/credentials'\n\n/**\n * Loosely-typed shape of a raw credential as returned by the platform, before\n * it is redacted down to the {@link CredentialSummary} surface. The secret\n * fields (`password` / `apiToken` / `certificate`) are read here only to derive\n * `hasSecret` — they are never carried into app-visible data.\n */\ninterface RawCredential {\n  id: string\n  name?: string\n  username?: string\n  type?: string | null\n  endpoint?: string | null\n  toolId?: string\n  // The platform redacts secrets from credential responses and surfaces only\n  // whether each is set via these flags. Older platforms may still send the\n  // secret fields instead — both shapes are handled below.\n  hasPassword?: boolean\n  hasApiToken?: boolean\n  hasCertificate?: boolean\n  password?: string | null\n  apiToken?: string | null\n  certificate?: string | null\n  tags?: Array<{ id: string; name: string }>\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function credentialError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/**\n * Redact a raw platform credential down to the app-visible summary, dropping\n * every secret field and surfacing only whether a secret is stored.\n */\nfunction toCredentialSummary(raw: RawCredential): CredentialSummary {\n  // Prefer the redacted has* flags; fall back to the presence of the secret\n  // fields themselves for older platforms that still return them.\n  const hasSecret = Boolean(\n    raw.hasApiToken ||\n      raw.hasPassword ||\n      (raw.apiToken && raw.apiToken.length > 0) ||\n      (raw.password && raw.password.length > 0),\n  )\n  return {\n    id: String(raw.id),\n    name: raw.name ?? '',\n    username: raw.username ?? '',\n    type: raw.type ?? null,\n    endpoint: raw.endpoint ?? null,\n    toolId: raw.toolId ?? '',\n    hasSecret,\n    tags: Array.isArray(raw.tags)\n      ? raw.tags.map((t) => ({ id: String(t.id), name: String(t.name) }))\n      : [],\n  }\n}\n\n/**\n * List the redacted credentials registered for a tool. GET\n * /api/tools/:toolId/credentials. Secrets are stripped before return — see the\n * module's SECURITY note. Returns an empty array when the tool has none.\n */\nexport async function listCredentials(toolId: string): Promise<CredentialSummary[]> {\n  const res = await authFetch(`/api/tools/${encodeURIComponent(toolId)}/credentials`)\n  if (!res.ok) throw await credentialError(res)\n  const data = (await res.json()) as unknown\n  const rows: RawCredential[] = Array.isArray(data)\n    ? (data as RawCredential[])\n    : Array.isArray((data as { data?: unknown })?.data)\n      ? ((data as { data: RawCredential[] }).data)\n      : []\n  return rows.map(toCredentialSummary)\n}\n\n/**\n * Create a credential. POST /api/credentials. The platform requires `name`,\n * `username`, `password`, `toolId`, and `tagIds` — this helper defaults\n * `tagIds` to `[]` and `password` to `''` (valid for token-only auth, where the\n * secret travels in `apiToken`). Returns the new credential's id.\n */\nexport async function createCredential(input: CredentialInput): Promise<{ id: string }> {\n  const res = await authFetch(CREDENTIALS_API, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      name: input.name,\n      username: input.username,\n      password: input.password ?? '',\n      apiToken: input.apiToken,\n      type: input.type,\n      endpoint: input.endpoint,\n      toolId: input.toolId,\n      tagIds: input.tagIds ?? [],\n    }),\n  })\n  if (!res.ok) throw await credentialError(res)\n  const body = (await res.json()) as { id?: string }\n  return { id: String(body.id) }\n}\n\n/**\n * Update a credential. PUT /api/credentials/:id. Only the fields you pass are\n * changed; omit `password`/`apiToken` to leave the stored secret untouched.\n */\nexport async function updateCredential(\n  id: string,\n  input: Partial<CredentialInput>,\n): Promise<{ id: string }> {\n  const body: Record<string, unknown> = {}\n  if (input.name !== undefined) body.name = input.name\n  if (input.username !== undefined) body.username = input.username\n  if (input.password !== undefined) body.password = input.password\n  if (input.apiToken !== undefined) body.apiToken = input.apiToken\n  if (input.type !== undefined) body.type = input.type\n  if (input.endpoint !== undefined) body.endpoint = input.endpoint\n  if (input.tagIds !== undefined) body.tagIds = input.tagIds\n  const res = await authFetch(`${CREDENTIALS_API}/${encodeURIComponent(id)}`, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(body),\n  })\n  if (!res.ok) throw await credentialError(res)\n  const result = (await res.json().catch(() => ({}))) as { id?: string }\n  return { id: result.id ? String(result.id) : id }\n}\n\n/** Remove a credential. DELETE /api/credentials/:id. */\nexport async function removeCredential(id: string): Promise<void> {\n  const res = await authFetch(`${CREDENTIALS_API}/${encodeURIComponent(id)}`, {\n    method: 'DELETE',\n  })\n  // 204 No Content is the platform's success response for delete.\n  if (!res.ok && res.status !== 204) throw await credentialError(res)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACmBA,IAAM,gBAAgB;AAmBtB,eAAe,eAAe,KAA+B;AAC3D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAGA,SAAS,gBAAgB,KAAsC;AAC7D,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,UAAU,IAAI,YAAY;AAAA,IAC1B,MAAM,IAAI,QAAQ;AAAA,IAClB,MAAM,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAO;AAAA,IAC3C,SAAS,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,UAAU,CAAC;AAAA,IACrD,UAAU,MAAM,QAAQ,IAAI,QAAQ,IAAI,IAAI,WAAW,CAAC;AAAA,IACxD,MAAM,MAAM,QAAQ,IAAI,IAAI,IACxB,IAAI,KAAK,IAAI,CAAC,SAAS,EAAE,IAAI,OAAO,IAAI,EAAE,GAAG,MAAM,OAAO,IAAI,IAAI,EAAE,EAAE,IACtE,CAAC;AAAA,IACL,wBAAwB,IAAI,0BAA0B;AAAA,IACtD,cAAc,IAAI,gBAAgB;AAAA,EACpC;AACF;AAqBA,eAAsB,YAAY,MAAoC;AACpE,QAAM,MAAM,MAAM,UAAU,YAAY;AACxC,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,QAAgB,MAAM,QAAQ,IAAI,IACnC,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAA0B,OAC5B,CAAC;AACP,SAAO,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK;AACrD;AAGA,eAAsB,gBAA0C;AAC9D,QAAM,MAAM,MAAM,UAAU,aAAa;AACzC,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,IAAI,eAAe,IAAI,CAAC;AAC5D;AAGA,eAAsB,iBAAiB,OAAmD;AACxF,QAAM,MAAM,MAAM,UAAU,eAAe;AAAA,IACzC,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,KAAK;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,SAAO,gBAAiB,MAAM,IAAI,KAAK,CAAsB;AAC/D;AAGA,eAAsB,oBACpB,IACA,OACwB;AACxB,QAAM,MAAM,MAAM,UAAU,GAAG,aAAa,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IACxE,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,KAAK;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,SAAO,gBAAiB,MAAM,IAAI,KAAK,CAAsB;AAC/D;AAGA,eAAsB,oBAAoB,IAA2B;AACnE,QAAM,MAAM,MAAM,UAAU,GAAG,aAAa,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IACxE,QAAQ;AAAA,EACV,CAAC;AAED,MAAI,CAAC,IAAI,MAAM,IAAI,WAAW,IAAK,OAAM,MAAM,eAAe,GAAG;AACnE;;;AC/HA,IAAM,6BAA6B;AAUnC,eAAe,cAAc,KAA+B;AAC1D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAOA,eAAsB,4BAAgE;AACpF,QAAM,MAAM,MAAM,UAAU,0BAA0B;AACtD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,cAAc,GAAG;AAC1C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,YAAuC,MAAM,QAAQ,IAAI,IAC1D,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAA6C,OAC/C,CAAC;AACP,SAAO,UAAU,IAAI,CAAC,cAAc;AAAA,IAClC,IAAI,OAAO,SAAS,EAAE;AAAA,IACtB,MAAM,SAAS,QAAQ;AAAA,IACvB,cAAc,SAAS,gBAAgB;AAAA,IACvC,QAAQ,SAAS,UAAU;AAAA,EAC7B,EAAE;AACJ;;;AC3CA,IAAM,mBAAmB;AAQzB,eAAe,iBAAiB,KAA+B;AAC7D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAQA,eAAsB,mBAA8C;AAClE,QAAM,MAAM,MAAM,UAAU,gBAAgB;AAC5C,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,iBAAiB,GAAG;AAC7C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,OAAyB,MAAM,QAAQ,IAAI,IAC5C,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAAoC,OACtC,CAAC;AACP,SAAO,KAAK,IAAI,CAAC,SAAS,EAAE,IAAI,OAAO,IAAI,EAAE,GAAG,MAAM,IAAI,QAAQ,GAAG,EAAE;AACzE;;;AC9BA,IAAM,kBAAkB;AA4BxB,eAAe,gBAAgB,KAA+B;AAC5D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAMA,SAAS,oBAAoB,KAAuC;AAGlE,QAAM,YAAY;AAAA,IAChB,IAAI,eACF,IAAI,eACH,IAAI,YAAY,IAAI,SAAS,SAAS,KACtC,IAAI,YAAY,IAAI,SAAS,SAAS;AAAA,EAC3C;AACA,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,MAAM,IAAI,QAAQ;AAAA,IAClB,UAAU,IAAI,YAAY;AAAA,IAC1B,MAAM,IAAI,QAAQ;AAAA,IAClB,UAAU,IAAI,YAAY;AAAA,IAC1B,QAAQ,IAAI,UAAU;AAAA,IACtB;AAAA,IACA,MAAM,MAAM,QAAQ,IAAI,IAAI,IACxB,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,IAAI,OAAO,EAAE,EAAE,GAAG,MAAM,OAAO,EAAE,IAAI,EAAE,EAAE,IAChE,CAAC;AAAA,EACP;AACF;AAOA,eAAsB,gBAAgB,QAA8C;AAClF,QAAM,MAAM,MAAM,UAAU,cAAc,mBAAmB,MAAM,CAAC,cAAc;AAClF,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,gBAAgB,GAAG;AAC5C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,OAAwB,MAAM,QAAQ,IAAI,IAC3C,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAAmC,OACrC,CAAC;AACP,SAAO,KAAK,IAAI,mBAAmB;AACrC;AAQA,eAAsB,iBAAiB,OAAiD;AACtF,QAAM,MAAM,MAAM,UAAU,iBAAiB;AAAA,IAC3C,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU;AAAA,MACnB,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,UAAU,MAAM,YAAY;AAAA,MAC5B,UAAU,MAAM;AAAA,MAChB,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,QAAQ,MAAM;AAAA,MACd,QAAQ,MAAM,UAAU,CAAC;AAAA,IAC3B,CAAC;AAAA,EACH,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,gBAAgB,GAAG;AAC5C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,EAAE,IAAI,OAAO,KAAK,EAAE,EAAE;AAC/B;AAMA,eAAsB,iBACpB,IACA,OACyB;AACzB,QAAM,OAAgC,CAAC;AACvC,MAAI,MAAM,SAAS,OAAW,MAAK,OAAO,MAAM;AAChD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,SAAS,OAAW,MAAK,OAAO,MAAM;AAChD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,WAAW,OAAW,MAAK,SAAS,MAAM;AACpD,QAAM,MAAM,MAAM,UAAU,GAAG,eAAe,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IAC1E,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,gBAAgB,GAAG;AAC5C,QAAM,SAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,SAAO,EAAE,IAAI,OAAO,KAAK,OAAO,OAAO,EAAE,IAAI,GAAG;AAClD;AAGA,eAAsB,iBAAiB,IAA2B;AAChE,QAAM,MAAM,MAAM,UAAU,GAAG,eAAe,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IAC1E,QAAQ;AAAA,EACV,CAAC;AAED,MAAI,CAAC,IAAI,MAAM,IAAI,WAAW,IAAK,OAAM,MAAM,gBAAgB,GAAG;AACpE;;;AJjHO,IAAM,sBAAsB;AAqC5B,SAAS,iBAA4C;AAC1D,QAAM,UAAW,WAAuC,mBAAmB;AAC3E,SAAQ,WAAkC;AAC5C;AAGO,SAAS,qBAAyC;AACvD,QAAM,UAAU,eAAe;AAC/B,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR,qHAC0C,mBAAmB;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,UAAU,OAAe,MAAuC;AAC9E,QAAM,UAAU,eAAe;AAC/B,MAAI,QAAS,QAAO,QAAQ,UAAU,OAAO,IAAI;AACjD,SAAO,MAAM,OAAO,IAAI;AAC1B;","names":[]}
+{"version":3,"sources":["../../src/client/index.ts","../../src/client/inventory.ts","../../src/client/connectivity.ts","../../src/client/environments.ts","../../src/client/credentials.ts"],"sourcesContent":["// ========================================================================\n// Client runtime contract — how app client bundles talk to the host.\n//\n// App client code is packaged as a hermetic ESM bundle in which `react`,\n// `react-dom`, `react/jsx-runtime`, and every `@veltrixsecops/app-sdk`\n// subpath are compile-time shims that read the host-provided runtime from\n// `globalThis.__VELTRIX_APP_RUNTIME__`. The platform installs that global\n// (with ITS React instance, the shared AppContext, and an authenticated\n// fetch) before dynamically importing any app bundle, so app components\n// render inside the host React tree with working hooks and context.\n//\n// App authors: import from '@veltrixsecops/app-sdk/client' (and /hooks) —\n// never bundle your own copy of react. Use `authFetch` for calls to your\n// app's server routes (/api/apps/<app-id>/...): plain fetch() lacks the\n// platform's Authorization header and will receive 401s.\n// ========================================================================\n\nimport type { ComponentType, Context, LazyExoticComponent } from 'react'\nimport type { AppContextValue } from '../hooks/use-app-context'\nimport type { AppPermissionsApi } from '../types/platform'\n\nexport type { AppBrandingDeclaration } from '../types/manifest'\nexport type { AppPermissionsApi, PermissionEntry, PermissionCheckOptions } from '../types/platform'\n\n// Inventory — typed helpers over the platform's components API (deployment\n// targets: servers, domains, IP/CIDR ranges). Framework-free; they use the\n// `authFetch` exported below internally.\nexport {\n  listInventory,\n  addInventoryItem,\n  updateInventoryItem,\n  removeInventoryItem,\n  resolveTool,\n} from './inventory'\nexport type { Tool } from './inventory'\nexport type { InventoryItem, InventoryItemInput } from '../types/platform'\n\n// Connectivity providers — reader over the customer's ZTNA providers, used to\n// populate the Access Server link picker. Framework-free; uses `authFetch`.\nexport { listConnectivityProviders } from './connectivity'\nexport type { ConnectivityProviderRef } from '../types/platform'\n\n// Environments — reader over the customer's deployment scopes, used to populate\n// the Environment picker on Connections + Access Servers. Framework-free.\nexport { listEnvironments } from './environments'\nexport type { EnvironmentRef } from '../types/pipeline'\n\n// Credentials — typed helpers over the platform's credentials API. Paired with\n// a server (component) these form a \"connection\". Secrets are write-only:\n// `listCredentials` returns redacted summaries only. Framework-free; they use\n// the `authFetch` exported below internally.\nexport {\n  listCredentials,\n  createCredential,\n  updateCredential,\n  removeCredential,\n} from './credentials'\nexport type { Credential, CredentialSummary, CredentialInput } from '../types/platform'\n\n/** Name of the global the platform installs before loading app bundles. */\nexport const HOST_RUNTIME_GLOBAL = '__VELTRIX_APP_RUNTIME__'\n\n/**\n * The runtime surface the platform exposes to app client bundles.\n * The react/reactDom/jsxRuntime members are the host's own module objects —\n * app bundles are compiled with shims that re-export them, guaranteeing a\n * single React instance per page.\n */\nexport interface VeltrixHostRuntime {\n  /** The host's `react` module object. */\n  react: unknown\n  /** The host's `react-dom` module object. */\n  reactDom: unknown\n  /** The host's `react-dom/client` module object. */\n  reactDomClient?: unknown\n  /** The host's `react/jsx-runtime` module object. */\n  jsxRuntime: unknown\n  /** Shared app context — the host wraps app pages in its Provider. */\n  AppContext: Context<AppContextValue | null>\n  /** fetch() with the platform's Authorization header attached. */\n  authFetch: (input: string, init?: RequestInit) => Promise<Response>\n  /**\n   * The SDK surface app bundles receive for `@veltrixsecops/app-sdk`,\n   * `.../hooks`, and `.../client` imports (useAppContext, AppContext,\n   * usePipelineStatus, authFetch, getHostRuntime, ...).\n   */\n  sdk: Record<string, unknown>\n  /**\n   * The platform's design-system components and hooks, host-owned so they\n   * share the single host React instance. Keyed by the exact component/hook\n   * names re-exported from `@veltrixsecops/app-sdk/ui` (Button, Input, Card,\n   * DataTable, useToast, ...). Present only inside the platform.\n   */\n  ui?: Record<string, unknown>\n  /**\n   * Platform-scoped permission checks (RBAC/IdP hardening, Wave C4) —\n   * `opts.appId` is NOT defaulted here (omit for a platform-scoped check).\n   * App page code should prefer `usePermissions()`\n   * (`@veltrixsecops/app-sdk/hooks`), which defaults `opts.appId` to the\n   * app's own id. Optional for compatibility with a host that hasn't\n   * deployed this surface yet.\n   */\n  permissions?: AppPermissionsApi\n}\n\n/** Read the host runtime, or null outside the platform (tests, storybook). */\nexport function getHostRuntime(): VeltrixHostRuntime | null {\n  const runtime = (globalThis as Record<string, unknown>)[HOST_RUNTIME_GLOBAL]\n  return (runtime as VeltrixHostRuntime) ?? null\n}\n\n/** Read the host runtime, throwing a diagnosable error when absent. */\nexport function requireHostRuntime(): VeltrixHostRuntime {\n  const runtime = getHostRuntime()\n  if (!runtime) {\n    throw new Error(\n      'Veltrix host runtime not found — app client bundles only run inside the ' +\n        `Veltrix platform (missing globalThis.${HOST_RUNTIME_GLOBAL})`,\n    )\n  }\n  return runtime\n}\n\n/**\n * fetch() that carries the platform's Authorization header. Required for an\n * app page to call its own server routes (/api/apps/<app-id>/...), which are\n * bearer-token protected. Falls back to plain fetch outside the platform.\n */\nexport function authFetch(input: string, init?: RequestInit): Promise<Response> {\n  const runtime = getHostRuntime()\n  if (runtime) return runtime.authFetch(input, init)\n  return fetch(input, init)\n}\n\n/** A sidebar entry contributed by the app's client entry module. */\nexport interface AppSidebarItem {\n  path: string\n  label: string\n  icon?: string\n}\n\n/**\n * Shape of the default export of an app's `client/index.tsx`.\n * `pages` keys must match `manifest.client.pages[].component`.\n */\nexport interface AppClientModule {\n  id: string\n  pages: Record<string, ComponentType | LazyExoticComponent<ComponentType>>\n  sidebarItems?: AppSidebarItem[]\n}\n","// ========================================================================\n// Inventory — the deployment targets an app can deploy configuration to.\n//\n// \"Inventory\" is the app-facing name for the platform's *components*: the\n// servers (hostname/port), domains, and IP/CIDR ranges a customer has\n// registered as deploy targets. These helpers are a typed, convenient\n// surface over the platform's components API (/api/components), enriched\n// with `domains` and `ipRanges`.\n//\n// Framework-free (no React) — safe to import from any client code. Every\n// call goes through the same `authFetch` the '/client' subpath exports, so\n// requests carry the platform's Authorization header. Non-2xx responses are\n// surfaced as thrown Errors carrying the platform's error text.\n// ========================================================================\n\nimport type { InventoryItem, InventoryItemInput } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's components (inventory) API. */\nconst INVENTORY_API = '/api/components'\n\n/**\n * Loosely-typed shape of a raw component as returned by the platform, before\n * it is normalized down to the {@link InventoryItem} surface.\n */\ninterface RawInventoryItem {\n  id: string\n  hostname?: string\n  port?: string\n  type?: string[]\n  domains?: string[]\n  ipRanges?: string[]\n  tags?: Array<{ id: string; name: string }>\n  connectivityProviderId?: string | null\n  credentialId?: string | null\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function inventoryError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/** Normalize a raw platform component into the typed InventoryItem surface. */\nfunction toInventoryItem(raw: RawInventoryItem): InventoryItem {\n  return {\n    id: String(raw.id),\n    hostname: raw.hostname ?? '',\n    port: raw.port ?? undefined,\n    type: Array.isArray(raw.type) ? raw.type : undefined,\n    domains: Array.isArray(raw.domains) ? raw.domains : [],\n    ipRanges: Array.isArray(raw.ipRanges) ? raw.ipRanges : [],\n    tags: Array.isArray(raw.tags)\n      ? raw.tags.map((tag) => ({ id: String(tag.id), name: String(tag.name) }))\n      : [],\n    connectivityProviderId: raw.connectivityProviderId ?? null,\n    credentialId: raw.credentialId ?? null,\n  }\n}\n\n/**\n * A platform Tool. Each installed app is upserted as a Tool keyed by its\n * manifest `name`, and inventory items (components) belong to a tool.\n */\nexport interface Tool {\n  id: string\n  name: string\n  vendor?: string\n}\n\n/**\n * Resolve the platform Tool for an app by its manifest name (the platform\n * upserts `Tool.name === app name`). The tool id is required by the platform\n * when creating an inventory item, so call this once and pass the id as\n * `toolId` to {@link addInventoryItem}. Returns null when no tool matches.\n *\n * GET /api/tools (the endpoint is paginated — `{ data, pagination }` — or a\n * bare array; both are handled).\n */\nexport async function resolveTool(name: string): Promise<Tool | null> {\n  const res = await authFetch('/api/tools')\n  if (!res.ok) throw await inventoryError(res)\n  const body = (await res.json()) as unknown\n  const tools: Tool[] = Array.isArray(body)\n    ? (body as Tool[])\n    : Array.isArray((body as { data?: unknown })?.data)\n      ? ((body as { data: Tool[] }).data)\n      : []\n  return tools.find((tool) => tool.name === name) ?? null\n}\n\n/** List the customer's inventory (deployment targets). GET /api/components */\nexport async function listInventory(): Promise<InventoryItem[]> {\n  const res = await authFetch(INVENTORY_API)\n  if (!res.ok) throw await inventoryError(res)\n  const data = (await res.json()) as RawInventoryItem[]\n  return Array.isArray(data) ? data.map(toInventoryItem) : []\n}\n\n/** Add a new inventory item (deployment target). POST /api/components */\nexport async function addInventoryItem(input: InventoryItemInput): Promise<InventoryItem> {\n  const res = await authFetch(INVENTORY_API, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(input),\n  })\n  if (!res.ok) throw await inventoryError(res)\n  return toInventoryItem((await res.json()) as RawInventoryItem)\n}\n\n/** Update an existing inventory item. PUT /api/components/:id */\nexport async function updateInventoryItem(\n  id: string,\n  input: InventoryItemInput,\n): Promise<InventoryItem> {\n  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(input),\n  })\n  if (!res.ok) throw await inventoryError(res)\n  return toInventoryItem((await res.json()) as RawInventoryItem)\n}\n\n/** Remove an inventory item. DELETE /api/components/:id */\nexport async function removeInventoryItem(id: string): Promise<void> {\n  const res = await authFetch(`${INVENTORY_API}/${encodeURIComponent(id)}`, {\n    method: 'DELETE',\n  })\n  // 204 No Content is the platform's success response for delete.\n  if (!res.ok && res.status !== 204) throw await inventoryError(res)\n}\n","// ========================================================================\n// Connectivity providers — the customer's ZTNA providers (Tailscale,\n// WireGuard, ZeroTier, …), platform-managed under Settings → Connectivity.\n//\n// A thin reader over the platform's connectivity-providers API\n// (/api/connectivity-providers), used to populate the ZTNA link picker when\n// creating or editing an Access Server (a component). Framework-free — every\n// call goes through the same `authFetch` the '/client' subpath exports.\n// ========================================================================\n\nimport type { ConnectivityProviderRef } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's connectivity-providers API. */\nconst CONNECTIVITY_PROVIDERS_API = '/api/connectivity-providers'\n\ninterface RawConnectivityProvider {\n  id: string\n  name?: string\n  providerType?: string\n  status?: string\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function providerError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/**\n * List the customer's ZTNA connectivity providers, used to populate the Access\n * Server link picker. GET /api/connectivity-providers (the endpoint may return\n * a bare array or a paginated `{ data, ... }` shape — both are handled).\n */\nexport async function listConnectivityProviders(): Promise<ConnectivityProviderRef[]> {\n  const res = await authFetch(CONNECTIVITY_PROVIDERS_API)\n  if (!res.ok) throw await providerError(res)\n  const body = (await res.json()) as unknown\n  const providers: RawConnectivityProvider[] = Array.isArray(body)\n    ? (body as RawConnectivityProvider[])\n    : Array.isArray((body as { data?: unknown })?.data)\n      ? ((body as { data: RawConnectivityProvider[] }).data)\n      : []\n  return providers.map((provider) => ({\n    id: String(provider.id),\n    name: provider.name ?? '',\n    providerType: provider.providerType ?? undefined,\n    status: provider.status ?? undefined,\n  }))\n}\n","// ========================================================================\n// Environments — the deployment scopes that determine where a configuration is\n// pushed. Environments are the customer's platform tags (dev/staging/prod, …);\n// a Connection (credential) or Access Server (component) is tied to one by\n// carrying the environment id in its `tagIds`.\n//\n// A thin reader over the platform's environments API (/api/environments), used\n// to populate the Environment picker on the Connections and Access Servers\n// pages. Framework-free — every call goes through the same `authFetch` the\n// '/client' subpath exports.\n// ========================================================================\n\nimport type { EnvironmentRef } from '../types/pipeline'\nimport { authFetch } from './index'\n\n/** Base route for the platform's environments API. */\nconst ENVIRONMENTS_API = '/api/environments'\n\ninterface RawEnvironment {\n  id: string\n  name?: string\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function environmentError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/**\n * List the customer's environments (deployment scopes). GET /api/environments\n * (the endpoint may return a bare array or a paginated `{ data, ... }` shape —\n * both are handled). Use the returned id as a `tagIds` entry to tie a Connection\n * or Access Server to that environment.\n */\nexport async function listEnvironments(): Promise<EnvironmentRef[]> {\n  const res = await authFetch(ENVIRONMENTS_API)\n  if (!res.ok) throw await environmentError(res)\n  const body = (await res.json()) as unknown\n  const rows: RawEnvironment[] = Array.isArray(body)\n    ? (body as RawEnvironment[])\n    : Array.isArray((body as { data?: unknown })?.data)\n      ? ((body as { data: RawEnvironment[] }).data)\n      : []\n  return rows.map((env) => ({ id: String(env.id), name: env.name ?? '' }))\n}\n","// ========================================================================\n// Credentials — how an app authenticates to a server (\"connection\").\n//\n// A \"connection\" pairs a server (a platform *component* — see inventory.ts)\n// with a *credential*: the account and write-only secret used to reach that\n// server. These helpers are a typed surface over the platform's credentials\n// API (POST /api/credentials, GET /api/tools/:toolId/credentials, PUT/DELETE\n// /api/credentials/:id).\n//\n// Framework-free (no React). Every call goes through the same `authFetch` the\n// '/client' subpath exports, so requests carry the platform's Authorization\n// header. Non-2xx responses are surfaced as thrown Errors carrying the\n// platform's error text.\n//\n// SECURITY: `listCredentials` returns a REDACTED {@link CredentialSummary} —\n// secret material (password / apiToken / certificate) is dropped before it\n// reaches app code, so secrets are never held in memory or logged. Only whether\n// a secret exists is surfaced (`hasSecret`). Secrets are write-only: they can be\n// set via create/update, never read back.\n// ========================================================================\n\nimport type { CredentialInput, CredentialSummary } from '../types/platform'\nimport { authFetch } from './index'\n\n/** Base route for the platform's credentials API. */\nconst CREDENTIALS_API = '/api/credentials'\n\n/**\n * Loosely-typed shape of a raw credential as returned by the platform, before\n * it is redacted down to the {@link CredentialSummary} surface. The secret\n * fields (`password` / `apiToken` / `certificate`) are read here only to derive\n * `hasSecret` — they are never carried into app-visible data.\n */\ninterface RawCredential {\n  id: string\n  name?: string\n  username?: string\n  type?: string | null\n  endpoint?: string | null\n  toolId?: string\n  // The platform redacts secrets from credential responses and surfaces only\n  // whether each is set via these flags. Older platforms may still send the\n  // secret fields instead — both shapes are handled below.\n  hasPassword?: boolean\n  hasApiToken?: boolean\n  hasCertificate?: boolean\n  password?: string | null\n  apiToken?: string | null\n  certificate?: string | null\n  tags?: Array<{ id: string; name: string }>\n}\n\n/** Build an Error from a non-2xx response, preferring the platform's message. */\nasync function credentialError(res: Response): Promise<Error> {\n  const text = await res.text().catch(() => '')\n  if (text) {\n    try {\n      const body = JSON.parse(text) as { error?: string; message?: string }\n      const message = body?.error ?? body?.message\n      if (message) return new Error(message)\n    } catch {\n      // Body was not JSON — fall through and use the raw text.\n    }\n    return new Error(text)\n  }\n  return new Error(`HTTP ${res.status}`)\n}\n\n/**\n * Redact a raw platform credential down to the app-visible summary, dropping\n * every secret field and surfacing only whether a secret is stored.\n */\nfunction toCredentialSummary(raw: RawCredential): CredentialSummary {\n  // Prefer the redacted has* flags; fall back to the presence of the secret\n  // fields themselves for older platforms that still return them.\n  const hasSecret = Boolean(\n    raw.hasApiToken ||\n      raw.hasPassword ||\n      (raw.apiToken && raw.apiToken.length > 0) ||\n      (raw.password && raw.password.length > 0),\n  )\n  return {\n    id: String(raw.id),\n    name: raw.name ?? '',\n    username: raw.username ?? '',\n    type: raw.type ?? null,\n    endpoint: raw.endpoint ?? null,\n    toolId: raw.toolId ?? '',\n    hasSecret,\n    tags: Array.isArray(raw.tags)\n      ? raw.tags.map((t) => ({ id: String(t.id), name: String(t.name) }))\n      : [],\n  }\n}\n\n/**\n * List the redacted credentials registered for a tool. GET\n * /api/tools/:toolId/credentials. Secrets are stripped before return — see the\n * module's SECURITY note. Returns an empty array when the tool has none.\n */\nexport async function listCredentials(toolId: string): Promise<CredentialSummary[]> {\n  const res = await authFetch(`/api/tools/${encodeURIComponent(toolId)}/credentials`)\n  if (!res.ok) throw await credentialError(res)\n  const data = (await res.json()) as unknown\n  const rows: RawCredential[] = Array.isArray(data)\n    ? (data as RawCredential[])\n    : Array.isArray((data as { data?: unknown })?.data)\n      ? ((data as { data: RawCredential[] }).data)\n      : []\n  return rows.map(toCredentialSummary)\n}\n\n/**\n * Create a credential. POST /api/credentials. The platform requires `name`,\n * `username`, `password`, `toolId`, and `tagIds` — this helper defaults\n * `tagIds` to `[]` and `password` to `''` (valid for token-only auth, where the\n * secret travels in `apiToken`). Returns the new credential's id.\n */\nexport async function createCredential(input: CredentialInput): Promise<{ id: string }> {\n  const res = await authFetch(CREDENTIALS_API, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      name: input.name,\n      username: input.username,\n      password: input.password ?? '',\n      apiToken: input.apiToken,\n      type: input.type,\n      endpoint: input.endpoint,\n      toolId: input.toolId,\n      tagIds: input.tagIds ?? [],\n    }),\n  })\n  if (!res.ok) throw await credentialError(res)\n  const body = (await res.json()) as { id?: string }\n  return { id: String(body.id) }\n}\n\n/**\n * Update a credential. PUT /api/credentials/:id. Only the fields you pass are\n * changed; omit `password`/`apiToken` to leave the stored secret untouched.\n */\nexport async function updateCredential(\n  id: string,\n  input: Partial<CredentialInput>,\n): Promise<{ id: string }> {\n  const body: Record<string, unknown> = {}\n  if (input.name !== undefined) body.name = input.name\n  if (input.username !== undefined) body.username = input.username\n  if (input.password !== undefined) body.password = input.password\n  if (input.apiToken !== undefined) body.apiToken = input.apiToken\n  if (input.type !== undefined) body.type = input.type\n  if (input.endpoint !== undefined) body.endpoint = input.endpoint\n  if (input.tagIds !== undefined) body.tagIds = input.tagIds\n  const res = await authFetch(`${CREDENTIALS_API}/${encodeURIComponent(id)}`, {\n    method: 'PUT',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(body),\n  })\n  if (!res.ok) throw await credentialError(res)\n  const result = (await res.json().catch(() => ({}))) as { id?: string }\n  return { id: result.id ? String(result.id) : id }\n}\n\n/** Remove a credential. DELETE /api/credentials/:id. */\nexport async function removeCredential(id: string): Promise<void> {\n  const res = await authFetch(`${CREDENTIALS_API}/${encodeURIComponent(id)}`, {\n    method: 'DELETE',\n  })\n  // 204 No Content is the platform's success response for delete.\n  if (!res.ok && res.status !== 204) throw await credentialError(res)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACmBA,IAAM,gBAAgB;AAmBtB,eAAe,eAAe,KAA+B;AAC3D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAGA,SAAS,gBAAgB,KAAsC;AAC7D,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,UAAU,IAAI,YAAY;AAAA,IAC1B,MAAM,IAAI,QAAQ;AAAA,IAClB,MAAM,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAO;AAAA,IAC3C,SAAS,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,UAAU,CAAC;AAAA,IACrD,UAAU,MAAM,QAAQ,IAAI,QAAQ,IAAI,IAAI,WAAW,CAAC;AAAA,IACxD,MAAM,MAAM,QAAQ,IAAI,IAAI,IACxB,IAAI,KAAK,IAAI,CAAC,SAAS,EAAE,IAAI,OAAO,IAAI,EAAE,GAAG,MAAM,OAAO,IAAI,IAAI,EAAE,EAAE,IACtE,CAAC;AAAA,IACL,wBAAwB,IAAI,0BAA0B;AAAA,IACtD,cAAc,IAAI,gBAAgB;AAAA,EACpC;AACF;AAqBA,eAAsB,YAAY,MAAoC;AACpE,QAAM,MAAM,MAAM,UAAU,YAAY;AACxC,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,QAAgB,MAAM,QAAQ,IAAI,IACnC,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAA0B,OAC5B,CAAC;AACP,SAAO,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK;AACrD;AAGA,eAAsB,gBAA0C;AAC9D,QAAM,MAAM,MAAM,UAAU,aAAa;AACzC,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,IAAI,eAAe,IAAI,CAAC;AAC5D;AAGA,eAAsB,iBAAiB,OAAmD;AACxF,QAAM,MAAM,MAAM,UAAU,eAAe;AAAA,IACzC,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,KAAK;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,SAAO,gBAAiB,MAAM,IAAI,KAAK,CAAsB;AAC/D;AAGA,eAAsB,oBACpB,IACA,OACwB;AACxB,QAAM,MAAM,MAAM,UAAU,GAAG,aAAa,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IACxE,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,KAAK;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,SAAO,gBAAiB,MAAM,IAAI,KAAK,CAAsB;AAC/D;AAGA,eAAsB,oBAAoB,IAA2B;AACnE,QAAM,MAAM,MAAM,UAAU,GAAG,aAAa,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IACxE,QAAQ;AAAA,EACV,CAAC;AAED,MAAI,CAAC,IAAI,MAAM,IAAI,WAAW,IAAK,OAAM,MAAM,eAAe,GAAG;AACnE;;;AC/HA,IAAM,6BAA6B;AAUnC,eAAe,cAAc,KAA+B;AAC1D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAOA,eAAsB,4BAAgE;AACpF,QAAM,MAAM,MAAM,UAAU,0BAA0B;AACtD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,cAAc,GAAG;AAC1C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,YAAuC,MAAM,QAAQ,IAAI,IAC1D,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAA6C,OAC/C,CAAC;AACP,SAAO,UAAU,IAAI,CAAC,cAAc;AAAA,IAClC,IAAI,OAAO,SAAS,EAAE;AAAA,IACtB,MAAM,SAAS,QAAQ;AAAA,IACvB,cAAc,SAAS,gBAAgB;AAAA,IACvC,QAAQ,SAAS,UAAU;AAAA,EAC7B,EAAE;AACJ;;;AC3CA,IAAM,mBAAmB;AAQzB,eAAe,iBAAiB,KAA+B;AAC7D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAQA,eAAsB,mBAA8C;AAClE,QAAM,MAAM,MAAM,UAAU,gBAAgB;AAC5C,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,iBAAiB,GAAG;AAC7C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,OAAyB,MAAM,QAAQ,IAAI,IAC5C,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAAoC,OACtC,CAAC;AACP,SAAO,KAAK,IAAI,CAAC,SAAS,EAAE,IAAI,OAAO,IAAI,EAAE,GAAG,MAAM,IAAI,QAAQ,GAAG,EAAE;AACzE;;;AC9BA,IAAM,kBAAkB;AA4BxB,eAAe,gBAAgB,KAA+B;AAC5D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,MAAM;AACR,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,YAAM,UAAU,MAAM,SAAS,MAAM;AACrC,UAAI,QAAS,QAAO,IAAI,MAAM,OAAO;AAAA,IACvC,QAAQ;AAAA,IAER;AACA,WAAO,IAAI,MAAM,IAAI;AAAA,EACvB;AACA,SAAO,IAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;AACvC;AAMA,SAAS,oBAAoB,KAAuC;AAGlE,QAAM,YAAY;AAAA,IAChB,IAAI,eACF,IAAI,eACH,IAAI,YAAY,IAAI,SAAS,SAAS,KACtC,IAAI,YAAY,IAAI,SAAS,SAAS;AAAA,EAC3C;AACA,SAAO;AAAA,IACL,IAAI,OAAO,IAAI,EAAE;AAAA,IACjB,MAAM,IAAI,QAAQ;AAAA,IAClB,UAAU,IAAI,YAAY;AAAA,IAC1B,MAAM,IAAI,QAAQ;AAAA,IAClB,UAAU,IAAI,YAAY;AAAA,IAC1B,QAAQ,IAAI,UAAU;AAAA,IACtB;AAAA,IACA,MAAM,MAAM,QAAQ,IAAI,IAAI,IACxB,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,IAAI,OAAO,EAAE,EAAE,GAAG,MAAM,OAAO,EAAE,IAAI,EAAE,EAAE,IAChE,CAAC;AAAA,EACP;AACF;AAOA,eAAsB,gBAAgB,QAA8C;AAClF,QAAM,MAAM,MAAM,UAAU,cAAc,mBAAmB,MAAM,CAAC,cAAc;AAClF,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,gBAAgB,GAAG;AAC5C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAM,OAAwB,MAAM,QAAQ,IAAI,IAC3C,OACD,MAAM,QAAS,MAA6B,IAAI,IAC5C,KAAmC,OACrC,CAAC;AACP,SAAO,KAAK,IAAI,mBAAmB;AACrC;AAQA,eAAsB,iBAAiB,OAAiD;AACtF,QAAM,MAAM,MAAM,UAAU,iBAAiB;AAAA,IAC3C,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU;AAAA,MACnB,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,UAAU,MAAM,YAAY;AAAA,MAC5B,UAAU,MAAM;AAAA,MAChB,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,QAAQ,MAAM;AAAA,MACd,QAAQ,MAAM,UAAU,CAAC;AAAA,IAC3B,CAAC;AAAA,EACH,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,gBAAgB,GAAG;AAC5C,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,EAAE,IAAI,OAAO,KAAK,EAAE,EAAE;AAC/B;AAMA,eAAsB,iBACpB,IACA,OACyB;AACzB,QAAM,OAAgC,CAAC;AACvC,MAAI,MAAM,SAAS,OAAW,MAAK,OAAO,MAAM;AAChD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,SAAS,OAAW,MAAK,OAAO,MAAM;AAChD,MAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AACxD,MAAI,MAAM,WAAW,OAAW,MAAK,SAAS,MAAM;AACpD,QAAM,MAAM,MAAM,UAAU,GAAG,eAAe,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IAC1E,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,gBAAgB,GAAG;AAC5C,QAAM,SAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,SAAO,EAAE,IAAI,OAAO,KAAK,OAAO,OAAO,EAAE,IAAI,GAAG;AAClD;AAGA,eAAsB,iBAAiB,IAA2B;AAChE,QAAM,MAAM,MAAM,UAAU,GAAG,eAAe,IAAI,mBAAmB,EAAE,CAAC,IAAI;AAAA,IAC1E,QAAQ;AAAA,EACV,CAAC;AAED,MAAI,CAAC,IAAI,MAAM,IAAI,WAAW,IAAK,OAAM,MAAM,gBAAgB,GAAG;AACpE;;;AJ/GO,IAAM,sBAAsB;AA8C5B,SAAS,iBAA4C;AAC1D,QAAM,UAAW,WAAuC,mBAAmB;AAC3E,SAAQ,WAAkC;AAC5C;AAGO,SAAS,qBAAyC;AACvD,QAAM,UAAU,eAAe;AAC/B,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR,qHAC0C,mBAAmB;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,UAAU,OAAe,MAAuC;AAC9E,QAAM,UAAU,eAAe;AAC/B,MAAI,QAAS,QAAO,QAAQ,UAAU,OAAO,IAAI;AACjD,SAAO,MAAM,OAAO,IAAI;AAC1B;","names":[]}

package/dist/client/index.d.cts

@@ -1,6 +1,6 @@
 import { ComponentType, LazyExoticComponent, Context } from 'react';
-import { D as InventoryItemInput, I as InventoryItem, w as ConnectivityProviderRef, y as CredentialInput, z as CredentialSummary, b as AppContextValue } from '../use-app-context-SEU1tyZd.cjs';
-export { A as AppBrandingDeclaration, x as Credential } from '../use-app-context-SEU1tyZd.cjs';
+import { B as InventoryItemInput, I as InventoryItem, v as ConnectivityProviderRef, x as CredentialInput, y as CredentialSummary, d as AppContextValue, p as AppPermissionsApi } from '../use-app-context-OQlcmq7t.cjs';
+export { b as AppBrandingDeclaration, w as Credential, P as PermissionCheckOptions, D as PermissionEntry } from '../use-app-context-OQlcmq7t.cjs';
 import { E as EnvironmentRef } from '../pipeline-A-gSsPRR.cjs';
 
 /**
@@ -105,6 +105,15 @@ interface VeltrixHostRuntime {
      * DataTable, useToast, ...). Present only inside the platform.
      */
     ui?: Record<string, unknown>;
+    /**
+     * Platform-scoped permission checks (RBAC/IdP hardening, Wave C4) —
+     * `opts.appId` is NOT defaulted here (omit for a platform-scoped check).
+     * App page code should prefer `usePermissions()`
+     * (`@veltrixsecops/app-sdk/hooks`), which defaults `opts.appId` to the
+     * app's own id. Optional for compatibility with a host that hasn't
+     * deployed this surface yet.
+     */
+    permissions?: AppPermissionsApi;
 }
 /** Read the host runtime, or null outside the platform (tests, storybook). */
 declare function getHostRuntime(): VeltrixHostRuntime | null;
@@ -132,4 +141,4 @@ interface AppClientModule {
     sidebarItems?: AppSidebarItem[];
 }
 
-export { type AppClientModule, type AppSidebarItem, ConnectivityProviderRef, CredentialInput, CredentialSummary, EnvironmentRef, HOST_RUNTIME_GLOBAL, InventoryItem, InventoryItemInput, type Tool, type VeltrixHostRuntime, addInventoryItem, authFetch, createCredential, getHostRuntime, listConnectivityProviders, listCredentials, listEnvironments, listInventory, removeCredential, removeInventoryItem, requireHostRuntime, resolveTool, updateCredential, updateInventoryItem };
+export { type AppClientModule, AppPermissionsApi, type AppSidebarItem, ConnectivityProviderRef, CredentialInput, CredentialSummary, EnvironmentRef, HOST_RUNTIME_GLOBAL, InventoryItem, InventoryItemInput, type Tool, type VeltrixHostRuntime, addInventoryItem, authFetch, createCredential, getHostRuntime, listConnectivityProviders, listCredentials, listEnvironments, listInventory, removeCredential, removeInventoryItem, requireHostRuntime, resolveTool, updateCredential, updateInventoryItem };

package/dist/client/index.d.ts

@@ -1,6 +1,6 @@
 import { ComponentType, LazyExoticComponent, Context } from 'react';
-import { D as InventoryItemInput, I as InventoryItem, w as ConnectivityProviderRef, y as CredentialInput, z as CredentialSummary, b as AppContextValue } from '../use-app-context-SEU1tyZd.js';
-export { A as AppBrandingDeclaration, x as Credential } from '../use-app-context-SEU1tyZd.js';
+import { B as InventoryItemInput, I as InventoryItem, v as ConnectivityProviderRef, x as CredentialInput, y as CredentialSummary, d as AppContextValue, p as AppPermissionsApi } from '../use-app-context-OQlcmq7t.js';
+export { b as AppBrandingDeclaration, w as Credential, P as PermissionCheckOptions, D as PermissionEntry } from '../use-app-context-OQlcmq7t.js';
 import { E as EnvironmentRef } from '../pipeline-A-gSsPRR.js';
 
 /**
@@ -105,6 +105,15 @@ interface VeltrixHostRuntime {
      * DataTable, useToast, ...). Present only inside the platform.
      */
     ui?: Record<string, unknown>;
+    /**
+     * Platform-scoped permission checks (RBAC/IdP hardening, Wave C4) —
+     * `opts.appId` is NOT defaulted here (omit for a platform-scoped check).
+     * App page code should prefer `usePermissions()`
+     * (`@veltrixsecops/app-sdk/hooks`), which defaults `opts.appId` to the
+     * app's own id. Optional for compatibility with a host that hasn't
+     * deployed this surface yet.
+     */
+    permissions?: AppPermissionsApi;
 }
 /** Read the host runtime, or null outside the platform (tests, storybook). */
 declare function getHostRuntime(): VeltrixHostRuntime | null;
@@ -132,4 +141,4 @@ interface AppClientModule {
     sidebarItems?: AppSidebarItem[];
 }
 
-export { type AppClientModule, type AppSidebarItem, ConnectivityProviderRef, CredentialInput, CredentialSummary, EnvironmentRef, HOST_RUNTIME_GLOBAL, InventoryItem, InventoryItemInput, type Tool, type VeltrixHostRuntime, addInventoryItem, authFetch, createCredential, getHostRuntime, listConnectivityProviders, listCredentials, listEnvironments, listInventory, removeCredential, removeInventoryItem, requireHostRuntime, resolveTool, updateCredential, updateInventoryItem };
+export { type AppClientModule, AppPermissionsApi, type AppSidebarItem, ConnectivityProviderRef, CredentialInput, CredentialSummary, EnvironmentRef, HOST_RUNTIME_GLOBAL, InventoryItem, InventoryItemInput, type Tool, type VeltrixHostRuntime, addInventoryItem, authFetch, createCredential, getHostRuntime, listConnectivityProviders, listCredentials, listEnvironments, listInventory, removeCredential, removeInventoryItem, requireHostRuntime, resolveTool, updateCredential, updateInventoryItem };

package/dist/client/index.js

@@ -14,7 +14,7 @@ import {
   resolveTool,
   updateCredential,
   updateInventoryItem
-} from "../chunk-6KUTYJW5.js";
+} from "../chunk-EOOEHZGC.js";
 export {
   HOST_RUNTIME_GLOBAL,
   addInventoryItem,

package/dist/hooks/index.cjs

@@ -23,6 +23,7 @@ __export(hooks_exports, {
   AppContext: () => AppContext,
   useAppBranding: () => useAppBranding,
   useAppContext: () => useAppContext,
+  usePermissions: () => usePermissions,
   usePipelineStatus: () => usePipelineStatus
 });
 module.exports = __toCommonJS(hooks_exports);
@@ -83,11 +84,17 @@ function usePipelineStatus(appId) {
 function useAppBranding() {
   return useAppContext().branding ?? null;
 }
+
+// src/hooks/use-permissions.ts
+function usePermissions() {
+  return useAppContext().permissions;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AppContext,
   useAppBranding,
   useAppContext,
+  usePermissions,
   usePipelineStatus
 });
 //# sourceMappingURL=index.cjs.map

package/dist/hooks/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/hooks/index.ts","../../src/hooks/use-app-context.ts","../../src/hooks/use-pipeline-status.ts","../../src/client/index.ts","../../src/hooks/use-app-branding.ts"],"sourcesContent":["export { useAppContext, AppContext, type AppContextValue } from './use-app-context'\nexport { usePipelineStatus, type PipelineStatusData } from './use-pipeline-status'\nexport { useAppBranding } from './use-app-branding'\n","// ========================================================================\n// React hooks for app developers\n// These provide access to platform data and pipeline state\n// ========================================================================\n\nimport { createContext, useContext, type Context } from 'react'\nimport type { Component, Credential, Tag, User, Customer } from '../types/platform'\nimport type { AppBrandingDeclaration } from '../types/manifest'\n\nexport interface AppContextValue {\n  appId: string\n  customerId: string\n  user: User | null\n  customer: Customer | null\n\n  // Platform data accessors\n  getComponents: () => Promise<Component[]>\n  getCredentials: () => Promise<Credential[]>\n  getTags: () => Promise<Tag[]>\n\n  // App settings\n  settings: Record<string, unknown>\n\n  /** The app's manifest branding, resolved by the platform (null when unset). */\n  branding?: AppBrandingDeclaration | null\n}\n\n// Anchor the context on the host runtime when running inside the platform,\n// so a bundle that inlined its own SDK copy still shares the host's context\n// (two createContext objects never match, even with identical shapes).\nconst hostContext = (\n  (globalThis as Record<string, unknown>).__VELTRIX_APP_RUNTIME__ as\n    | { AppContext?: Context<AppContextValue | null> }\n    | undefined\n)?.AppContext\n\nexport const AppContext: Context<AppContextValue | null> =\n  hostContext ?? createContext<AppContextValue | null>(null)\n\n/**\n * Access the app context in any app component.\n *\n * @example\n * ```tsx\n * import { useAppContext } from '@veltrixsecops/app-sdk/hooks'\n *\n * function MyComponent() {\n *   const { appId, settings, getComponents } = useAppContext()\n *   // ...\n * }\n * ```\n */\nexport function useAppContext(): AppContextValue {\n  const ctx = useContext(AppContext)\n  if (!ctx) {\n    throw new Error('useAppContext must be used within an AppContextProvider')\n  }\n  return ctx\n}\n","import { useState, useEffect, useCallback } from 'react'\nimport { authFetch } from '../client'\n\nexport interface PipelineStatusData {\n  pendingApprovals: number\n  activeDeployments: number\n  failedDeployments: number\n  unresolvedDrifts: number\n  recentDeployments: Array<{\n    id: string\n    canvasName: string\n    environment: string\n    status: string\n    startedAt: string\n    completedAt?: string\n  }>\n}\n\n/**\n * Hook to access pipeline status for the current app/customer.\n *\n * @example\n * ```tsx\n * import { usePipelineStatus } from '@veltrixsecops/app-sdk/hooks'\n *\n * function Dashboard() {\n *   const { data, isLoading } = usePipelineStatus('my-app')\n *   if (isLoading) return <Spinner />\n *   return <div>{data.activeDeployments} active deployments</div>\n * }\n * ```\n */\nexport function usePipelineStatus(appId: string) {\n  const [data, setData] = useState<PipelineStatusData | null>(null)\n  const [isLoading, setIsLoading] = useState(true)\n  const [error, setError] = useState<Error | null>(null)\n\n  const refresh = useCallback(async () => {\n    try {\n      setIsLoading(true)\n      // Platform APIs are bearer-token protected — plain fetch would 401\n      const response = await authFetch(`/api/pipeline/summary?appId=${appId}`)\n      if (!response.ok) throw new Error(`Failed to fetch pipeline status`)\n      const result = await response.json()\n      setData(result)\n      setError(null)\n    } catch (err) {\n      setError(err instanceof Error ? err : new Error('Unknown error'))\n    } finally {\n      setIsLoading(false)\n    }\n  }, [appId])\n\n  useEffect(() => {\n    refresh()\n  }, [refresh])\n\n  return { data, isLoading, error, refresh }\n}\n","// ========================================================================\n// Client runtime contract — how app client bundles talk to the host.\n//\n// App client code is packaged as a hermetic ESM bundle in which `react`,\n// `react-dom`, `react/jsx-runtime`, and every `@veltrixsecops/app-sdk`\n// subpath are compile-time shims that read the host-provided runtime from\n// `globalThis.__VELTRIX_APP_RUNTIME__`. The platform installs that global\n// (with ITS React instance, the shared AppContext, and an authenticated\n// fetch) before dynamically importing any app bundle, so app components\n// render inside the host React tree with working hooks and context.\n//\n// App authors: import from '@veltrixsecops/app-sdk/client' (and /hooks) —\n// never bundle your own copy of react. Use `authFetch` for calls to your\n// app's server routes (/api/apps/<app-id>/...): plain fetch() lacks the\n// platform's Authorization header and will receive 401s.\n// ========================================================================\n\nimport type { ComponentType, Context, LazyExoticComponent } from 'react'\nimport type { AppContextValue } from '../hooks/use-app-context'\n\nexport type { AppBrandingDeclaration } from '../types/manifest'\n\n// Inventory — typed helpers over the platform's components API (deployment\n// targets: servers, domains, IP/CIDR ranges). Framework-free; they use the\n// `authFetch` exported below internally.\nexport {\n  listInventory,\n  addInventoryItem,\n  updateInventoryItem,\n  removeInventoryItem,\n  resolveTool,\n} from './inventory'\nexport type { Tool } from './inventory'\nexport type { InventoryItem, InventoryItemInput } from '../types/platform'\n\n// Connectivity providers — reader over the customer's ZTNA providers, used to\n// populate the Access Server link picker. Framework-free; uses `authFetch`.\nexport { listConnectivityProviders } from './connectivity'\nexport type { ConnectivityProviderRef } from '../types/platform'\n\n// Environments — reader over the customer's deployment scopes, used to populate\n// the Environment picker on Connections + Access Servers. Framework-free.\nexport { listEnvironments } from './environments'\nexport type { EnvironmentRef } from '../types/pipeline'\n\n// Credentials — typed helpers over the platform's credentials API. Paired with\n// a server (component) these form a \"connection\". Secrets are write-only:\n// `listCredentials` returns redacted summaries only. Framework-free; they use\n// the `authFetch` exported below internally.\nexport {\n  listCredentials,\n  createCredential,\n  updateCredential,\n  removeCredential,\n} from './credentials'\nexport type { Credential, CredentialSummary, CredentialInput } from '../types/platform'\n\n/** Name of the global the platform installs before loading app bundles. */\nexport const HOST_RUNTIME_GLOBAL = '__VELTRIX_APP_RUNTIME__'\n\n/**\n * The runtime surface the platform exposes to app client bundles.\n * The react/reactDom/jsxRuntime members are the host's own module objects —\n * app bundles are compiled with shims that re-export them, guaranteeing a\n * single React instance per page.\n */\nexport interface VeltrixHostRuntime {\n  /** The host's `react` module object. */\n  react: unknown\n  /** The host's `react-dom` module object. */\n  reactDom: unknown\n  /** The host's `react-dom/client` module object. */\n  reactDomClient?: unknown\n  /** The host's `react/jsx-runtime` module object. */\n  jsxRuntime: unknown\n  /** Shared app context — the host wraps app pages in its Provider. */\n  AppContext: Context<AppContextValue | null>\n  /** fetch() with the platform's Authorization header attached. */\n  authFetch: (input: string, init?: RequestInit) => Promise<Response>\n  /**\n   * The SDK surface app bundles receive for `@veltrixsecops/app-sdk`,\n   * `.../hooks`, and `.../client` imports (useAppContext, AppContext,\n   * usePipelineStatus, authFetch, getHostRuntime, ...).\n   */\n  sdk: Record<string, unknown>\n  /**\n   * The platform's design-system components and hooks, host-owned so they\n   * share the single host React instance. Keyed by the exact component/hook\n   * names re-exported from `@veltrixsecops/app-sdk/ui` (Button, Input, Card,\n   * DataTable, useToast, ...). Present only inside the platform.\n   */\n  ui?: Record<string, unknown>\n}\n\n/** Read the host runtime, or null outside the platform (tests, storybook). */\nexport function getHostRuntime(): VeltrixHostRuntime | null {\n  const runtime = (globalThis as Record<string, unknown>)[HOST_RUNTIME_GLOBAL]\n  return (runtime as VeltrixHostRuntime) ?? null\n}\n\n/** Read the host runtime, throwing a diagnosable error when absent. */\nexport function requireHostRuntime(): VeltrixHostRuntime {\n  const runtime = getHostRuntime()\n  if (!runtime) {\n    throw new Error(\n      'Veltrix host runtime not found — app client bundles only run inside the ' +\n        `Veltrix platform (missing globalThis.${HOST_RUNTIME_GLOBAL})`,\n    )\n  }\n  return runtime\n}\n\n/**\n * fetch() that carries the platform's Authorization header. Required for an\n * app page to call its own server routes (/api/apps/<app-id>/...), which are\n * bearer-token protected. Falls back to plain fetch outside the platform.\n */\nexport function authFetch(input: string, init?: RequestInit): Promise<Response> {\n  const runtime = getHostRuntime()\n  if (runtime) return runtime.authFetch(input, init)\n  return fetch(input, init)\n}\n\n/** A sidebar entry contributed by the app's client entry module. */\nexport interface AppSidebarItem {\n  path: string\n  label: string\n  icon?: string\n}\n\n/**\n * Shape of the default export of an app's `client/index.tsx`.\n * `pages` keys must match `manifest.client.pages[].component`.\n */\nexport interface AppClientModule {\n  id: string\n  pages: Record<string, ComponentType | LazyExoticComponent<ComponentType>>\n  sidebarItems?: AppSidebarItem[]\n}\n","import { useAppContext } from './use-app-context'\nimport type { AppBrandingDeclaration } from '../types/manifest'\n\n/**\n * The app's brand identity as declared in manifest.yaml `branding`.\n *\n * The platform already applies it in the defined slots (the app navbar and\n * the scoped CSS variables --veltrix-app-primary / --veltrix-app-accent on\n * the app page container). Use this hook only when a page needs the values\n * programmatically — prefer the CSS variables for styling:\n *\n * @example\n * ```tsx\n * <span style={{ color: 'var(--veltrix-app-primary)' }}>12 detections</span>\n * ```\n */\nexport function useAppBranding(): AppBrandingDeclaration | null {\n  return useAppContext().branding ?? null\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACKA,mBAAwD;AAyBxD,IAAM,cACH,WAAuC,yBAGvC;AAEI,IAAM,aACX,mBAAe,4BAAsC,IAAI;AAepD,SAAS,gBAAiC;AAC/C,QAAM,UAAM,yBAAW,UAAU;AACjC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,SAAO;AACT;;;AC1DA,IAAAA,gBAAiD;;;AC0D1C,IAAM,sBAAsB;AAqC5B,SAAS,iBAA4C;AAC1D,QAAM,UAAW,WAAuC,mBAAmB;AAC3E,SAAQ,WAAkC;AAC5C;AAmBO,SAAS,UAAU,OAAe,MAAuC;AAC9E,QAAM,UAAU,eAAe;AAC/B,MAAI,QAAS,QAAO,QAAQ,UAAU,OAAO,IAAI;AACjD,SAAO,MAAM,OAAO,IAAI;AAC1B;;;ADzFO,SAAS,kBAAkB,OAAe;AAC/C,QAAM,CAAC,MAAM,OAAO,QAAI,wBAAoC,IAAI;AAChE,QAAM,CAAC,WAAW,YAAY,QAAI,wBAAS,IAAI;AAC/C,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAuB,IAAI;AAErD,QAAM,cAAU,2BAAY,YAAY;AACtC,QAAI;AACF,mBAAa,IAAI;AAEjB,YAAM,WAAW,MAAM,UAAU,+BAA+B,KAAK,EAAE;AACvE,UAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,iCAAiC;AACnE,YAAM,SAAS,MAAM,SAAS,KAAK;AACnC,cAAQ,MAAM;AACd,eAAS,IAAI;AAAA,IACf,SAAS,KAAK;AACZ,eAAS,eAAe,QAAQ,MAAM,IAAI,MAAM,eAAe,CAAC;AAAA,IAClE,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,KAAK,CAAC;AAEV,+BAAU,MAAM;AACd,YAAQ;AAAA,EACV,GAAG,CAAC,OAAO,CAAC;AAEZ,SAAO,EAAE,MAAM,WAAW,OAAO,QAAQ;AAC3C;;;AE1CO,SAAS,iBAAgD;AAC9D,SAAO,cAAc,EAAE,YAAY;AACrC;","names":["import_react"]}
+{"version":3,"sources":["../../src/hooks/index.ts","../../src/hooks/use-app-context.ts","../../src/hooks/use-pipeline-status.ts","../../src/client/index.ts","../../src/hooks/use-app-branding.ts","../../src/hooks/use-permissions.ts"],"sourcesContent":["export { useAppContext, AppContext, type AppContextValue } from './use-app-context'\nexport { usePipelineStatus, type PipelineStatusData } from './use-pipeline-status'\nexport { useAppBranding } from './use-app-branding'\nexport { usePermissions } from './use-permissions'\n","// ========================================================================\n// React hooks for app developers\n// These provide access to platform data and pipeline state\n// ========================================================================\n\nimport { createContext, useContext, type Context } from 'react'\nimport type { Component, Credential, Tag, User, Customer, AppPermissionsApi } from '../types/platform'\nimport type { AppBrandingDeclaration } from '../types/manifest'\n\nexport interface AppContextValue {\n  appId: string\n  customerId: string\n  user: User | null\n  customer: Customer | null\n\n  // Platform data accessors\n  getComponents: () => Promise<Component[]>\n  getCredentials: () => Promise<Credential[]>\n  getTags: () => Promise<Tag[]>\n\n  // App settings\n  settings: Record<string, unknown>\n\n  /** The app's manifest branding, resolved by the platform (null when unset). */\n  branding?: AppBrandingDeclaration | null\n\n  /**\n   * Permission checks for THIS app (RBAC/IdP hardening, Wave C4). `has()`\n   * without an explicit `opts.appId` checks the app's OWN declared\n   * resources by default. Prefer the `usePermissions()` hook\n   * (`@veltrixsecops/app-sdk/hooks`) over reaching into this directly.\n   */\n  permissions: AppPermissionsApi\n}\n\n// Anchor the context on the host runtime when running inside the platform,\n// so a bundle that inlined its own SDK copy still shares the host's context\n// (two createContext objects never match, even with identical shapes).\nconst hostContext = (\n  (globalThis as Record<string, unknown>).__VELTRIX_APP_RUNTIME__ as\n    | { AppContext?: Context<AppContextValue | null> }\n    | undefined\n)?.AppContext\n\nexport const AppContext: Context<AppContextValue | null> =\n  hostContext ?? createContext<AppContextValue | null>(null)\n\n/**\n * Access the app context in any app component.\n *\n * @example\n * ```tsx\n * import { useAppContext } from '@veltrixsecops/app-sdk/hooks'\n *\n * function MyComponent() {\n *   const { appId, settings, getComponents } = useAppContext()\n *   // ...\n * }\n * ```\n */\nexport function useAppContext(): AppContextValue {\n  const ctx = useContext(AppContext)\n  if (!ctx) {\n    throw new Error('useAppContext must be used within an AppContextProvider')\n  }\n  return ctx\n}\n","import { useState, useEffect, useCallback } from 'react'\nimport { authFetch } from '../client'\n\nexport interface PipelineStatusData {\n  pendingApprovals: number\n  activeDeployments: number\n  failedDeployments: number\n  unresolvedDrifts: number\n  recentDeployments: Array<{\n    id: string\n    canvasName: string\n    environment: string\n    status: string\n    startedAt: string\n    completedAt?: string\n  }>\n}\n\n/**\n * Hook to access pipeline status for the current app/customer.\n *\n * @example\n * ```tsx\n * import { usePipelineStatus } from '@veltrixsecops/app-sdk/hooks'\n *\n * function Dashboard() {\n *   const { data, isLoading } = usePipelineStatus('my-app')\n *   if (isLoading) return <Spinner />\n *   return <div>{data.activeDeployments} active deployments</div>\n * }\n * ```\n */\nexport function usePipelineStatus(appId: string) {\n  const [data, setData] = useState<PipelineStatusData | null>(null)\n  const [isLoading, setIsLoading] = useState(true)\n  const [error, setError] = useState<Error | null>(null)\n\n  const refresh = useCallback(async () => {\n    try {\n      setIsLoading(true)\n      // Platform APIs are bearer-token protected — plain fetch would 401\n      const response = await authFetch(`/api/pipeline/summary?appId=${appId}`)\n      if (!response.ok) throw new Error(`Failed to fetch pipeline status`)\n      const result = await response.json()\n      setData(result)\n      setError(null)\n    } catch (err) {\n      setError(err instanceof Error ? err : new Error('Unknown error'))\n    } finally {\n      setIsLoading(false)\n    }\n  }, [appId])\n\n  useEffect(() => {\n    refresh()\n  }, [refresh])\n\n  return { data, isLoading, error, refresh }\n}\n","// ========================================================================\n// Client runtime contract — how app client bundles talk to the host.\n//\n// App client code is packaged as a hermetic ESM bundle in which `react`,\n// `react-dom`, `react/jsx-runtime`, and every `@veltrixsecops/app-sdk`\n// subpath are compile-time shims that read the host-provided runtime from\n// `globalThis.__VELTRIX_APP_RUNTIME__`. The platform installs that global\n// (with ITS React instance, the shared AppContext, and an authenticated\n// fetch) before dynamically importing any app bundle, so app components\n// render inside the host React tree with working hooks and context.\n//\n// App authors: import from '@veltrixsecops/app-sdk/client' (and /hooks) —\n// never bundle your own copy of react. Use `authFetch` for calls to your\n// app's server routes (/api/apps/<app-id>/...): plain fetch() lacks the\n// platform's Authorization header and will receive 401s.\n// ========================================================================\n\nimport type { ComponentType, Context, LazyExoticComponent } from 'react'\nimport type { AppContextValue } from '../hooks/use-app-context'\nimport type { AppPermissionsApi } from '../types/platform'\n\nexport type { AppBrandingDeclaration } from '../types/manifest'\nexport type { AppPermissionsApi, PermissionEntry, PermissionCheckOptions } from '../types/platform'\n\n// Inventory — typed helpers over the platform's components API (deployment\n// targets: servers, domains, IP/CIDR ranges). Framework-free; they use the\n// `authFetch` exported below internally.\nexport {\n  listInventory,\n  addInventoryItem,\n  updateInventoryItem,\n  removeInventoryItem,\n  resolveTool,\n} from './inventory'\nexport type { Tool } from './inventory'\nexport type { InventoryItem, InventoryItemInput } from '../types/platform'\n\n// Connectivity providers — reader over the customer's ZTNA providers, used to\n// populate the Access Server link picker. Framework-free; uses `authFetch`.\nexport { listConnectivityProviders } from './connectivity'\nexport type { ConnectivityProviderRef } from '../types/platform'\n\n// Environments — reader over the customer's deployment scopes, used to populate\n// the Environment picker on Connections + Access Servers. Framework-free.\nexport { listEnvironments } from './environments'\nexport type { EnvironmentRef } from '../types/pipeline'\n\n// Credentials — typed helpers over the platform's credentials API. Paired with\n// a server (component) these form a \"connection\". Secrets are write-only:\n// `listCredentials` returns redacted summaries only. Framework-free; they use\n// the `authFetch` exported below internally.\nexport {\n  listCredentials,\n  createCredential,\n  updateCredential,\n  removeCredential,\n} from './credentials'\nexport type { Credential, CredentialSummary, CredentialInput } from '../types/platform'\n\n/** Name of the global the platform installs before loading app bundles. */\nexport const HOST_RUNTIME_GLOBAL = '__VELTRIX_APP_RUNTIME__'\n\n/**\n * The runtime surface the platform exposes to app client bundles.\n * The react/reactDom/jsxRuntime members are the host's own module objects —\n * app bundles are compiled with shims that re-export them, guaranteeing a\n * single React instance per page.\n */\nexport interface VeltrixHostRuntime {\n  /** The host's `react` module object. */\n  react: unknown\n  /** The host's `react-dom` module object. */\n  reactDom: unknown\n  /** The host's `react-dom/client` module object. */\n  reactDomClient?: unknown\n  /** The host's `react/jsx-runtime` module object. */\n  jsxRuntime: unknown\n  /** Shared app context — the host wraps app pages in its Provider. */\n  AppContext: Context<AppContextValue | null>\n  /** fetch() with the platform's Authorization header attached. */\n  authFetch: (input: string, init?: RequestInit) => Promise<Response>\n  /**\n   * The SDK surface app bundles receive for `@veltrixsecops/app-sdk`,\n   * `.../hooks`, and `.../client` imports (useAppContext, AppContext,\n   * usePipelineStatus, authFetch, getHostRuntime, ...).\n   */\n  sdk: Record<string, unknown>\n  /**\n   * The platform's design-system components and hooks, host-owned so they\n   * share the single host React instance. Keyed by the exact component/hook\n   * names re-exported from `@veltrixsecops/app-sdk/ui` (Button, Input, Card,\n   * DataTable, useToast, ...). Present only inside the platform.\n   */\n  ui?: Record<string, unknown>\n  /**\n   * Platform-scoped permission checks (RBAC/IdP hardening, Wave C4) —\n   * `opts.appId` is NOT defaulted here (omit for a platform-scoped check).\n   * App page code should prefer `usePermissions()`\n   * (`@veltrixsecops/app-sdk/hooks`), which defaults `opts.appId` to the\n   * app's own id. Optional for compatibility with a host that hasn't\n   * deployed this surface yet.\n   */\n  permissions?: AppPermissionsApi\n}\n\n/** Read the host runtime, or null outside the platform (tests, storybook). */\nexport function getHostRuntime(): VeltrixHostRuntime | null {\n  const runtime = (globalThis as Record<string, unknown>)[HOST_RUNTIME_GLOBAL]\n  return (runtime as VeltrixHostRuntime) ?? null\n}\n\n/** Read the host runtime, throwing a diagnosable error when absent. */\nexport function requireHostRuntime(): VeltrixHostRuntime {\n  const runtime = getHostRuntime()\n  if (!runtime) {\n    throw new Error(\n      'Veltrix host runtime not found — app client bundles only run inside the ' +\n        `Veltrix platform (missing globalThis.${HOST_RUNTIME_GLOBAL})`,\n    )\n  }\n  return runtime\n}\n\n/**\n * fetch() that carries the platform's Authorization header. Required for an\n * app page to call its own server routes (/api/apps/<app-id>/...), which are\n * bearer-token protected. Falls back to plain fetch outside the platform.\n */\nexport function authFetch(input: string, init?: RequestInit): Promise<Response> {\n  const runtime = getHostRuntime()\n  if (runtime) return runtime.authFetch(input, init)\n  return fetch(input, init)\n}\n\n/** A sidebar entry contributed by the app's client entry module. */\nexport interface AppSidebarItem {\n  path: string\n  label: string\n  icon?: string\n}\n\n/**\n * Shape of the default export of an app's `client/index.tsx`.\n * `pages` keys must match `manifest.client.pages[].component`.\n */\nexport interface AppClientModule {\n  id: string\n  pages: Record<string, ComponentType | LazyExoticComponent<ComponentType>>\n  sidebarItems?: AppSidebarItem[]\n}\n","import { useAppContext } from './use-app-context'\nimport type { AppBrandingDeclaration } from '../types/manifest'\n\n/**\n * The app's brand identity as declared in manifest.yaml `branding`.\n *\n * The platform already applies it in the defined slots (the app navbar and\n * the scoped CSS variables --veltrix-app-primary / --veltrix-app-accent on\n * the app page container). Use this hook only when a page needs the values\n * programmatically — prefer the CSS variables for styling:\n *\n * @example\n * ```tsx\n * <span style={{ color: 'var(--veltrix-app-primary)' }}>12 detections</span>\n * ```\n */\nexport function useAppBranding(): AppBrandingDeclaration | null {\n  return useAppContext().branding ?? null\n}\n","import { useAppContext } from './use-app-context'\nimport type { AppPermissionsApi } from '../types/platform'\n\n/**\n * Permission checks for THIS app (RBAC/IdP hardening, Wave C4). `has()`\n * without an explicit `opts.appId` checks the app's own declared resources\n * by default — pass `{ appId: null }` for a platform resource, or another\n * app's id to check a different app.\n *\n * @example\n * ```tsx\n * import { usePermissions } from '@veltrixsecops/app-sdk/hooks'\n *\n * function IndexesPage() {\n *   const { has } = usePermissions()\n *   if (!has('indexes', 'write')) {\n *     return <p>You don't have permission to edit indexes.</p>\n *   }\n *   // ...\n * }\n * ```\n */\nexport function usePermissions(): AppPermissionsApi {\n  return useAppContext().permissions\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACKA,mBAAwD;AAiCxD,IAAM,cACH,WAAuC,yBAGvC;AAEI,IAAM,aACX,mBAAe,4BAAsC,IAAI;AAepD,SAAS,gBAAiC;AAC/C,QAAM,UAAM,yBAAW,UAAU;AACjC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,SAAO;AACT;;;AClEA,IAAAA,gBAAiD;;;AC4D1C,IAAM,sBAAsB;AA8C5B,SAAS,iBAA4C;AAC1D,QAAM,UAAW,WAAuC,mBAAmB;AAC3E,SAAQ,WAAkC;AAC5C;AAmBO,SAAS,UAAU,OAAe,MAAuC;AAC9E,QAAM,UAAU,eAAe;AAC/B,MAAI,QAAS,QAAO,QAAQ,UAAU,OAAO,IAAI;AACjD,SAAO,MAAM,OAAO,IAAI;AAC1B;;;ADpGO,SAAS,kBAAkB,OAAe;AAC/C,QAAM,CAAC,MAAM,OAAO,QAAI,wBAAoC,IAAI;AAChE,QAAM,CAAC,WAAW,YAAY,QAAI,wBAAS,IAAI;AAC/C,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAuB,IAAI;AAErD,QAAM,cAAU,2BAAY,YAAY;AACtC,QAAI;AACF,mBAAa,IAAI;AAEjB,YAAM,WAAW,MAAM,UAAU,+BAA+B,KAAK,EAAE;AACvE,UAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,iCAAiC;AACnE,YAAM,SAAS,MAAM,SAAS,KAAK;AACnC,cAAQ,MAAM;AACd,eAAS,IAAI;AAAA,IACf,SAAS,KAAK;AACZ,eAAS,eAAe,QAAQ,MAAM,IAAI,MAAM,eAAe,CAAC;AAAA,IAClE,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,KAAK,CAAC;AAEV,+BAAU,MAAM;AACd,YAAQ;AAAA,EACV,GAAG,CAAC,OAAO,CAAC;AAEZ,SAAO,EAAE,MAAM,WAAW,OAAO,QAAQ;AAC3C;;;AE1CO,SAAS,iBAAgD;AAC9D,SAAO,cAAc,EAAE,YAAY;AACrC;;;ACIO,SAAS,iBAAoC;AAClD,SAAO,cAAc,EAAE;AACzB;","names":["import_react"]}

package/dist/hooks/index.d.cts

@@ -1,5 +1,5 @@
-import { A as AppBrandingDeclaration } from '../use-app-context-SEU1tyZd.cjs';
-export { a as AppContext, b as AppContextValue, u as useAppContext } from '../use-app-context-SEU1tyZd.cjs';
+import { b as AppBrandingDeclaration, p as AppPermissionsApi } from '../use-app-context-OQlcmq7t.cjs';
+export { F as AppContext, d as AppContextValue, G as useAppContext } from '../use-app-context-OQlcmq7t.cjs';
 export { P as PipelineStatusData, u as usePipelineStatus } from '../use-pipeline-status-CCSQ9Neh.cjs';
 import 'react';
 
@@ -18,4 +18,25 @@ import 'react';
  */
 declare function useAppBranding(): AppBrandingDeclaration | null;
 
-export { useAppBranding };
+/**
+ * Permission checks for THIS app (RBAC/IdP hardening, Wave C4). `has()`
+ * without an explicit `opts.appId` checks the app's own declared resources
+ * by default — pass `{ appId: null }` for a platform resource, or another
+ * app's id to check a different app.
+ *
+ * @example
+ * ```tsx
+ * import { usePermissions } from '@veltrixsecops/app-sdk/hooks'
+ *
+ * function IndexesPage() {
+ *   const { has } = usePermissions()
+ *   if (!has('indexes', 'write')) {
+ *     return <p>You don't have permission to edit indexes.</p>
+ *   }
+ *   // ...
+ * }
+ * ```
+ */
+declare function usePermissions(): AppPermissionsApi;
+
+export { useAppBranding, usePermissions };

package/dist/hooks/index.d.ts

@@ -1,5 +1,5 @@
-import { A as AppBrandingDeclaration } from '../use-app-context-SEU1tyZd.js';
-export { a as AppContext, b as AppContextValue, u as useAppContext } from '../use-app-context-SEU1tyZd.js';
+import { b as AppBrandingDeclaration, p as AppPermissionsApi } from '../use-app-context-OQlcmq7t.js';
+export { F as AppContext, d as AppContextValue, G as useAppContext } from '../use-app-context-OQlcmq7t.js';
 export { P as PipelineStatusData, u as usePipelineStatus } from '../use-pipeline-status-CCSQ9Neh.js';
 import 'react';
 
@@ -18,4 +18,25 @@ import 'react';
  */
 declare function useAppBranding(): AppBrandingDeclaration | null;
 
-export { useAppBranding };
+/**
+ * Permission checks for THIS app (RBAC/IdP hardening, Wave C4). `has()`
+ * without an explicit `opts.appId` checks the app's own declared resources
+ * by default — pass `{ appId: null }` for a platform resource, or another
+ * app's id to check a different app.
+ *
+ * @example
+ * ```tsx
+ * import { usePermissions } from '@veltrixsecops/app-sdk/hooks'
+ *
+ * function IndexesPage() {
+ *   const { has } = usePermissions()
+ *   if (!has('indexes', 'write')) {
+ *     return <p>You don't have permission to edit indexes.</p>
+ *   }
+ *   // ...
+ * }
+ * ```
+ */
+declare function usePermissions(): AppPermissionsApi;
+
+export { useAppBranding, usePermissions };

package/dist/hooks/index.js

@@ -1,6 +1,6 @@
 import {
   authFetch
-} from "../chunk-6KUTYJW5.js";
+} from "../chunk-EOOEHZGC.js";
 
 // src/hooks/use-app-context.ts
 import { createContext, useContext } from "react";
@@ -44,10 +44,16 @@ function usePipelineStatus(appId) {
 function useAppBranding() {
   return useAppContext().branding ?? null;
 }
+
+// src/hooks/use-permissions.ts
+function usePermissions() {
+  return useAppContext().permissions;
+}
 export {
   AppContext,
   useAppBranding,
   useAppContext,
+  usePermissions,
   usePipelineStatus
 };
 //# sourceMappingURL=index.js.map