@vertesia/common 1.5.0-dev.20260804.124748Z → 1.5.0-dev.20260806.125520Z

package/src/api-schemas/registry.ts

@@ -109,9 +109,11 @@ import {
     AgentRunTypeSchema,
     AgentToolApprovalClassSchema,
     AgentToolDefinitionSchema,
+    AppApiKeyCollectionParamsSchema,
     AppBuildProgressSchema,
     AppBuildProgressStatusSchema,
     AppBuildTriggerSchema,
+    AppDeleteSummarySchema,
     AppDevelopmentTaskDetailsSchema,
     AppDevelopmentTaskListSchema,
     AppDevelopmentTaskSchema,
@@ -155,6 +157,7 @@ import {
     EventRefSchema,
     Extract_AppVersionGitRefType_branch_tag_commitSchema,
     InCodeTypeRefSchema,
+    McpApiKeyCredentialSchema,
     OAuthClientCredentialsMapSchema,
     OAuthClientCredentialsSchema,
     RunKindSchema,
@@ -178,6 +181,7 @@ import {
     AppSourceConfigSchema,
     AppUIConfigSchema,
     MCPToolAnnotationsSchema,
+    McpApiKeyStatusSchema,
     McpOAuthConnectResponseSchema,
     McpOAuthDisconnectResponseSchema,
     McpOAuthTokenRequestSchema,
@@ -186,6 +190,7 @@ import {
     OAuthAuthStatusArraySchema,
     OAuthAuthStatusSchema,
     OAuthMetadataResponseSchema,
+    SetMcpApiKeyRequestSchema,
     ToolCollectionObjectSchema,
 } from './apps.js';
 import {
@@ -1585,17 +1590,21 @@ const EVENT_DELIVERY_SCHEMAS = {
     EventOutboxStatus: EventSchemas.EventOutboxStatusSchema,
     EventDeliverySortField: EventSchemas.EventDeliverySortFieldSchema,
     WebhookEventDeliveryTarget: EventSchemas.WebhookEventDeliveryTargetSchema,
+    AppEventDeliveryTarget: EventSchemas.AppEventDeliveryTargetSchema,
     WorkflowEventDeliveryTarget: EventSchemas.WorkflowEventDeliveryTargetSchema,
     EventDeliveryQueueFailureSummary: EventSchemas.EventDeliveryQueueFailureSummarySchema,
     EventOutboxQueueSummary: EventSchemas.EventOutboxQueueSummarySchema,
     EventDeliveryQueueSortField: EventSchemas.EventDeliveryQueueSortFieldSchema,
     AgentEventDeliveryTarget: EventSchemas.AgentEventDeliveryTargetSchema,
     WebhookEventDeliveryTargetInput: EventSchemas.WebhookEventDeliveryTargetInputSchema,
+    AppEventDeliveryTargetInput: EventSchemas.AppEventDeliveryTargetInputSchema,
     WorkflowEventDeliveryTargetInput: EventSchemas.WorkflowEventDeliveryTargetInputSchema,
     SemanticEvaluator: EventSchemas.SemanticEvaluatorSchema,
     SemanticEvaluationRecord: EventSchemas.SemanticEvaluationRecordSchema,
     EventDeliveryQueueSubscriptionSummary: EventSchemas.EventDeliveryQueueSubscriptionSummarySchema,
     EventDeliveryQueueSummaryPayload: EventSchemas.EventDeliveryQueueSummaryPayloadSchema,
+    CancelEventDeliveryIntentsPayload: EventSchemas.CancelEventDeliveryIntentsPayloadSchema,
+    CancelEventDeliveryIntentsResponse: EventSchemas.CancelEventDeliveryIntentsResponseSchema,
     EventSemanticCondition: EventSchemas.EventSemanticConditionSchema,
     EventDeliveryIntentSummary: EventSchemas.EventDeliveryIntentSummarySchema,
     EventDeliveryQueueSummaryResponse: EventSchemas.EventDeliveryQueueSummaryResponseSchema,
@@ -1806,6 +1815,10 @@ const REMOTE_MCP_SCHEMAS = {
     McpOAuthConnectResponse: McpOAuthConnectResponseSchema,
     OAuthAuthorizeResponse: OAuthAuthorizeResponseSchema,
     OAuthAuthStatusArray: OAuthAuthStatusArraySchema,
+    // The static-key alternative to that handshake: the key itself is write-only, so only the
+    // setter payload and the configured/hint projection are published.
+    SetMcpApiKeyRequest: SetMcpApiKeyRequestSchema,
+    McpApiKeyStatus: McpApiKeyStatusSchema,
 } as const satisfies Record<string, z.ZodType>;
 
 const AUDIT_TRAIL_SCHEMAS = {
@@ -1919,6 +1932,7 @@ const APP_LIFECYCLE_SCHEMAS = {
     RunType: RunTypeSchema,
     AppBuildProgressStatus: AppBuildProgressStatusSchema,
     DeleteAppVersionResponse: DeleteAppVersionResponseSchema,
+    AppDeleteSummary: AppDeleteSummarySchema,
     AppRepoBranch: AppRepoBranchSchema,
     AppRepoDocumentCommit: AppRepoDocumentCommitSchema,
     AppVersionGitSource: AppVersionGitSourceSchema,
@@ -1928,6 +1942,8 @@ const APP_LIFECYCLE_SCHEMAS = {
     AppDevelopmentTaskList: AppDevelopmentTaskListSchema,
     OAuthClientCredentialsMap: OAuthClientCredentialsMapSchema,
     AppOAuthCollectionParams: AppOAuthCollectionParamsSchema,
+    McpApiKeyCredential: McpApiKeyCredentialSchema,
+    AppApiKeyCollectionParams: AppApiKeyCollectionParamsSchema,
     AppInspectionIssue: AppInspectionIssueSchema,
     AppScaffoldProgress: AppScaffoldProgressSchema,
     AppRepoTree: AppRepoTreeSchema,
@@ -2077,6 +2093,7 @@ const STS_SCHEMAS = {
     ServiceAccountTokenRequest: StsSchemas.ServiceAccountTokenRequestSchema,
     IssueTokenRequest: StsSchemas.IssueTokenRequestSchema,
     IssueTokenResponse: StsSchemas.IssueTokenResponseSchema,
+    IssueTokenForbiddenResponse: StsSchemas.IssueTokenForbiddenResponseSchema,
     IssueTokenUnavailableResponse: StsSchemas.IssueTokenUnavailableResponseSchema,
 } as const satisfies Record<string, z.ZodType>;
 
@@ -2224,6 +2241,7 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'AgentTokenRequest',
     'ServiceAccountTokenRequest',
     'IssueTokenResponse',
+    'IssueTokenForbiddenResponse',
     'IssueTokenUnavailableResponse',
     'ApiKeyListQuery',
     // These payloads previously referenced closed generated utility components. They now own their
@@ -2371,6 +2389,7 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'AppUIConfig',
     'AppUINavItem',
     'MCPOAuthConfig',
+    'MCPApiKeyConfig',
     'MCPToolCollectionObject',
     'VertesiaSDKToolCollectionObject',
     // File, task, content-type and command components. Every one is published closed
@@ -2662,6 +2681,8 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'ListWorkflowRunsResponse',
     'EventDeliveryQueueSubscriptionSummary',
     'EventDeliveryQueueSummaryPayload',
+    'CancelEventDeliveryIntentsPayload',
+    'CancelEventDeliveryIntentsResponse',
     'ContentObjectExportStatusResponse',
     'TimerTask',
     'SignalTask',
@@ -2929,6 +2950,8 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'McpOAuthDisconnectResponse',
     'McpOAuthConnectResponse',
     'OAuthAuthorizeResponse',
+    'SetMcpApiKeyRequest',
+    'McpApiKeyStatus',
     'AuditMeter',
     'AuditAggregationDimensionMap',
     'AuditAggregationRow',
@@ -2982,6 +3005,7 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'AppInstallationProviderBinding',
     'AppInstallationOAuthBinding',
     'OAuthClientCredentials',
+    'McpApiKeyCredential',
     'AppInspectionCapabilityReport',
     'AppRepoTreeEntry',
     'AppRepoRef',
@@ -2990,6 +3014,7 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'InCodeTypeRef',
     'StoredTypeRef',
     'DeleteAppVersionResponse',
+    'AppDeleteSummary',
     'AppRepoBranch',
     'AppRepoDocumentCommit',
     'AppVersionGitSource',

package/src/api-schemas/store.contract.test.ts

@@ -131,6 +131,27 @@ describe.skipIf(!publishedDocument)('gate — generated artifact = canonical com
     });
 });
 
+describe('content object response classification', () => {
+    it('accepts the current sensitivity and compartments fields', () => {
+        const result = validateApiResponse('ContentObjectApiResponse', {
+            id: 'content-object-id',
+            name: 'Classified document',
+            updated_by: 'user-id',
+            created_by: 'user-id',
+            created_at: '2026-08-06T09:00:00.000Z',
+            updated_at: '2026-08-06T09:00:00.000Z',
+            location: '/',
+            status: 'completed',
+            properties: {},
+            revision: { root: 'content-object-id', head: true },
+            sensitivity: 3,
+            compartments: ['legal'],
+        });
+
+        expect(result).toMatchObject({ valid: true });
+    });
+});
+
 /**
  * Bodies that probe where the two validators could disagree.
  *

package/src/api-schemas/sts.contract.test.ts

@@ -4,6 +4,7 @@ import type {
     AgentTokenRequest,
     ApiKeyTokenRequest,
     EnvironmentTokenRequest,
+    IssueTokenForbiddenResponse,
     IssueTokenRequest,
     IssueTokenResponse,
     ProjectTokenRequest,
@@ -16,6 +17,7 @@ import type {
     AgentTokenRequestSchema,
     ApiKeyTokenRequestSchema,
     EnvironmentTokenRequestSchema,
+    IssueTokenForbiddenResponseSchema,
     IssueTokenRequestSchema,
     IssueTokenResponseSchema,
     ProjectTokenRequestSchema,
@@ -38,6 +40,7 @@ describe('STS canonical contracts', () => {
         assertType<Equals<ServiceAccountTokenRequest, z.infer<typeof ServiceAccountTokenRequestSchema>>>(true);
         assertType<Equals<IssueTokenRequest, z.infer<typeof IssueTokenRequestSchema>>>(true);
         assertType<Equals<IssueTokenResponse, z.infer<typeof IssueTokenResponseSchema>>>(true);
+        assertType<Equals<IssueTokenForbiddenResponse, z.infer<typeof IssueTokenForbiddenResponseSchema>>>(true);
         expect(true).toBe(true);
     });
 
@@ -60,9 +63,38 @@ describe('STS canonical contracts', () => {
         expect(validateApiRequest('IssueTokenRequest', { type: 'project', account_id: 'acc_1' }).valid).toBe(false);
     });
 
-    it('checks both documented response shapes', () => {
+    it('checks every documented response shape and forbidden error-code literal', () => {
         expect(validateApiResponse('IssueTokenResponse', { token: 'signed', token_type: 'Bearer' }).valid).toBe(true);
         expect(validateApiResponse('IssueTokenResponse', { token: 'signed', token_type: 'bearer' }).valid).toBe(false);
+        for (const errorCode of [
+            'requested_scope_unavailable',
+            'no_accessible_account',
+            'restricted_environment',
+            'token_issuance_forbidden',
+        ]) {
+            expect(
+                validateApiResponse('IssueTokenForbiddenResponse', {
+                    error: 'Forbidden',
+                    message: 'The requested scope is unavailable',
+                    errorCode,
+                }).valid,
+            ).toBe(true);
+        }
+        expect(
+            validateApiResponse('IssueTokenForbiddenResponse', {
+                error: 'Forbidden',
+                message: 'No',
+                errorCode: 'resource_not_found',
+            }).valid,
+        ).toBe(false);
+        expect(
+            validateApiResponse('IssueTokenForbiddenResponse', {
+                error: 'Forbidden',
+                message: 'No',
+                errorCode: 'requested_scope_unavailable',
+                project_id: 'secret',
+            }).valid,
+        ).toBe(false);
         expect(
             validateApiResponse('IssueTokenUnavailableResponse', {
                 error: 'Service Unavailable',

package/src/api-schemas/sts.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { ISSUE_TOKEN_FORBIDDEN_ERROR_CODES } from '../sts-errors.js';
 import { SystemRolesSchema } from './apikey.js';
 
 const ALGORITHM_DESCRIPTION = 'Signing algorithm - defaults to ES256. Use RS256 for Azure AD compatibility.';
@@ -105,6 +106,18 @@ export const IssueTokenResponseSchema = z
     })
     .meta({ id: 'IssueTokenResponse' });
 
+export const IssueTokenForbiddenResponseSchema = z
+    .strictObject({
+        error: z.string(),
+        message: z.string(),
+        errorCode: z.enum(ISSUE_TOKEN_FORBIDDEN_ERROR_CODES),
+    })
+    .meta({
+        id: 'IssueTokenForbiddenResponse',
+        description:
+            'A safe, machine-readable denial response. Requested resources are intentionally not identified or confirmed.',
+    });
+
 export const IssueTokenUnavailableResponseSchema = z
     .strictObject({ error: z.string(), message: z.string() })
     .meta({ id: 'IssueTokenUnavailableResponse' });

package/src/apps.test.ts

@@ -1,4 +1,9 @@
 import { describe, expect, it } from 'vitest';
+import {
+    AppEventHookPayloadSchema,
+    AppEventSubscriptionDefinitionSchema,
+    AppPackageHooksSchema,
+} from './api-schemas/app-runtime.js';
 import { APP_ARTIFACT_TYPES, APP_CAPABILITIES, APP_PACKAGE_SCOPES, effectiveAppAccessControl } from './apps.js';
 
 describe('app capability contracts', () => {
@@ -6,6 +11,83 @@ describe('app capability contracts', () => {
         expect(APP_CAPABILITIES).toContain('views');
         expect(APP_PACKAGE_SCOPES).toContain('views');
         expect(APP_ARTIFACT_TYPES).toContain('view');
+        expect(APP_ARTIFACT_TYPES).toContain('hook');
+        expect(APP_ARTIFACT_TYPES).toContain('subscription');
+    });
+
+    it('exposes app hooks as a package query scope', () => {
+        expect(APP_PACKAGE_SCOPES).toContain('hooks');
+        expect(APP_PACKAGE_SCOPES).toContain('subscriptions');
+    });
+
+    it('accepts app-owned subscriptions without a deployment-specific target', () => {
+        expect(
+            AppEventSubscriptionDefinitionSchema.parse({
+                id: 'content-updated',
+                name: 'Content updated',
+                hook: 'content-updated',
+                filter: { action: ['update'], resource_type: ['content_object'] },
+                run_as_role: 'automation',
+            }),
+        ).toEqual({
+            id: 'content-updated',
+            name: 'Content updated',
+            hook: 'content-updated',
+            filter: { action: ['update'], resource_type: ['content_object'] },
+            run_as_role: 'automation',
+        });
+    });
+
+    it('validates the canonical app event-hook envelope', () => {
+        const payload = {
+            event: {
+                event_id: 'event-1',
+                root_event_id: 'event-1',
+                hop_count: 0,
+                event_category: 'content',
+                action: 'update',
+                resource_type: 'content_object',
+                resource_id: 'object-1',
+                account_id: 'account-1',
+                project_id: 'project-1',
+                tenant_id: 'account-1_project-1',
+                timestamp: '2026-08-05T10:00:00.000Z',
+                source: 'zeno-server',
+                details: { changed: ['title'] },
+            },
+            delivery: {
+                id: 'delivery-1',
+                subscription_id: 'subscription-1',
+                attempt: 1,
+            },
+        };
+
+        expect(AppEventHookPayloadSchema.parse(payload)).toEqual(payload);
+        expect(() => AppEventHookPayloadSchema.parse({ event: payload.event })).toThrow();
+    });
+
+    it('accepts lifecycle and event hook package metadata', () => {
+        expect(
+            AppPackageHooksSchema.parse({
+                install: '/api/hooks/install',
+                events: [
+                    {
+                        name: 'content-updated',
+                        path: '/api/hooks/content-updated',
+                        description: 'Processes updated content.',
+                    },
+                ],
+            }),
+        ).toEqual({
+            install: '/api/hooks/install',
+            events: [
+                {
+                    name: 'content-updated',
+                    path: '/api/hooks/content-updated',
+                    description: 'Processes updated content.',
+                },
+            ],
+        });
     });
 });
 

package/src/apps.ts

@@ -2,9 +2,11 @@ import type { z } from 'zod';
 import type {
     AgentToolApprovalClassSchema,
     AgentToolDefinitionSchema,
+    AppApiKeyCollectionParamsSchema,
     AppBuildProgressSchema,
     AppBuildProgressStatusSchema,
     AppBuildTriggerSchema,
+    AppDeleteSummarySchema,
     AppDevelopmentTaskDetailsSchema,
     AppDevelopmentTaskListSchema,
     AppDevelopmentTaskSchema,
@@ -40,6 +42,7 @@ import type {
     AppVersionTargetSchema,
     AppVersionUrlsSchema,
     DeleteAppVersionResponseSchema,
+    McpApiKeyCredentialSchema,
     OAuthClientCredentialsSchema,
     StartAppBuildRequestSchema,
     StartAppBuildResponseSchema,
@@ -51,11 +54,16 @@ import type {
     ValidateUrlResponseSchema,
 } from './api-schemas/app-lifecycle.js';
 import type {
+    AppEventHookDeliverySchema,
+    AppEventHookPayloadSchema,
+    AppEventSubscriptionDefinitionSchema,
     AppInstallationListEntrySchema,
     AppInstallationSchema,
     AppInstallationWithManifestSchema,
     AppManifestDataSchema,
     AppManifestSchema,
+    AppPackageEventHookSchema,
+    AppPackageHooksSchema,
     AppPackageSchema,
     AppWidgetInfoSchema,
     CompositeAppCardOverridesSchema,
@@ -86,9 +94,11 @@ import type {
     AppManifestSourceSchema,
     AppSourceConfigSchema,
     AppUIConfigSchema,
+    MCPApiKeyConfigSchema,
     MCPOAuthConfigSchema,
     MCPToolAnnotationsSchema,
     MCPToolCollectionObjectSchema,
+    McpApiKeyStatusSchema,
     McpOAuthConnectResponseSchema,
     McpOAuthDisconnectResponseSchema,
     McpOAuthTokenRequestSchema,
@@ -96,6 +106,7 @@ import type {
     OAuthAuthorizeResponseSchema,
     OAuthAuthStatusSchema,
     OAuthMetadataResponseSchema,
+    SetMcpApiKeyRequestSchema,
     ToolCollectionAuthTypeSchema,
     ToolCollectionObjectSchema,
     VertesiaSDKToolCollectionObjectSchema,
@@ -162,6 +173,9 @@ export type ToolCollectionType = 'mcp' | 'vertesia_sdk';
 
 export type MCPOAuthConfig = z.infer<typeof MCPOAuthConfigSchema>;
 
+/** Install-time provisioning blueprint for an `auth: 'api_key'` MCP collection. Never holds the key. */
+export type MCPApiKeyConfig = z.infer<typeof MCPApiKeyConfigSchema>;
+
 export type MCPToolCollectionObject = z.infer<typeof MCPToolCollectionObjectSchema>;
 
 export type VertesiaSDKToolCollectionObject = z.infer<typeof VertesiaSDKToolCollectionObjectSchema>;
@@ -296,6 +310,8 @@ export const APP_ARTIFACT_TYPES = [
     'dashboard',
     'activity',
     'tool',
+    'hook',
+    'subscription',
 ] as const;
 
 export type AppArtifactType = (typeof APP_ARTIFACT_TYPES)[number];
@@ -304,7 +320,7 @@ export type AppArtifactType = (typeof APP_ARTIFACT_TYPES)[number];
  * A single platform artifact the App Solution Architect requires the build to create.
  * `id` is the app-owned in-code id the implementation must register and reference
  * (e.g. `app:<name>:main:extract-item` for interactions/agents, `app:<name>:<type>` for
- * types, `app:<name>:<process>` for processes).
+ * types, `app:<name>:<process>` for processes, and `app:<name>:<local-id>` for hooks/subscriptions).
  */
 /**
  * Build progress for one artifact, maintained by the developer agent as a living checklist:
@@ -337,10 +353,10 @@ export interface AppPlannedArtifact {
 
 /**
  * Structured result the App Solution Architect emits alongside its prose artifacts — the
- * machine-readable contract for the build. The implementation MUST create and successfully
- * exercise every required artifact before building a deployable version. Persisted into the app repo as
- * {@link APP_CAPABILITY_MANIFEST_PATH} so it survives across runs and the version-build
- * capability gate can verify against it deterministically. If the builder finds the plan
+ * machine-readable contract for the build. The implementation MUST register every required artifact
+ * before building a candidate, then successfully exercise it after that candidate is installed and
+ * version-pinned. Persisted into the app repo as {@link APP_CAPABILITY_MANIFEST_PATH} so it survives
+ * across runs and the package-registration gate can verify it deterministically. If the builder finds the plan
  * wrong or insufficient, the orchestrator relaunches the architect to revise the manifest;
  * the gate always checks against the latest committed copy.
  */
@@ -600,10 +616,17 @@ export const APP_PACKAGE_SCOPES = [
     'settings',
     'widgets',
     'activities',
+    'hooks',
+    'subscriptions',
     'all',
 ] as const;
 
 export type AppPackageScope = (typeof APP_PACKAGE_SCOPES)[number];
+export type AppPackageEventHook = z.infer<typeof AppPackageEventHookSchema>;
+export type AppPackageHooks = z.infer<typeof AppPackageHooksSchema>;
+export type AppEventHookDelivery = z.infer<typeof AppEventHookDeliverySchema>;
+export type AppEventHookPayload = z.infer<typeof AppEventHookPayloadSchema>;
+export type AppEventSubscriptionDefinition = z.infer<typeof AppEventSubscriptionDefinitionSchema>;
 export type AppPackage = z.infer<typeof AppPackageSchema>;
 
 /**
@@ -663,6 +686,12 @@ export interface OrphanedAppInstallation extends Omit<AppInstallation, 'manifest
 export type OAuthClientCredentials = z.infer<typeof OAuthClientCredentialsSchema>;
 
 export type AppOAuthCollectionParams = z.infer<typeof AppOAuthCollectionParamsSchema>;
+
+/** One installer-supplied MCP API key. */
+export type McpApiKeyCredential = z.infer<typeof McpApiKeyCredentialSchema>;
+
+/** Installer-supplied MCP API keys, keyed by collection id. */
+export type AppApiKeyCollectionParams = z.infer<typeof AppApiKeyCollectionParamsSchema>;
 export type AppOAuthProviderParams = z.infer<typeof AppOAuthProviderParamsSchema>;
 
 export type AppInstallationPayload = z.infer<typeof AppInstallationPayloadSchema>;
@@ -697,6 +726,15 @@ export interface McpOAuthCollectionRef {
     collection_id: string;
 }
 
+/**
+ * Payload for storing the static bearer token of an `auth: 'api_key'` MCP collection.
+ * The key is write-only — it is never echoed back by any endpoint.
+ */
+export type SetMcpApiKeyRequest = z.infer<typeof SetMcpApiKeyRequestSchema>;
+
+/** Whether an `auth: 'api_key'` MCP collection has a key stored, plus a display-only hint. */
+export type McpApiKeyStatus = z.infer<typeof McpApiKeyStatusSchema>;
+
 export type McpOAuthTokenRequest = z.infer<typeof McpOAuthTokenRequestSchema>;
 
 export type McpOAuthTokenResponse = z.infer<typeof McpOAuthTokenResponseSchema>;
@@ -873,15 +911,11 @@ export type ValidateUrlResponse = z.infer<typeof ValidateUrlResponseSchema>;
  * Result of DELETE /api/v1/apps/:id. With `?confirm=true` the cascade runs and
  * `deleted: true` is set; without it the endpoint returns a dry-run summary so
  * the UI can show what would be removed.
+ *
+ * Inferred from the published component rather than hand-written: the endpoint
+ * had been declaring `CountResult`, so response validation reported a missing
+ * `count` and every field here as unexpected — and in local development, where
+ * the check fails closed, that surfaced as a 500 raised AFTER the app was
+ * already deleted. Deriving the type is what keeps the two from drifting again.
  */
-export interface AppDeleteSummary {
-    confirmed: boolean;
-    app_id: string;
-    app_name: string;
-    versions: number;
-    installations: number;
-    storage_prefix: string;
-    git_repo_url?: string;
-    deleted: boolean;
-    warnings: string[];
-}
+export type AppDeleteSummary = z.infer<typeof AppDeleteSummarySchema>;

package/src/index.ts

@@ -75,6 +75,7 @@ export type {
     ZenoBulkContentObjectExportSplitShardRequest,
     ZenoBulkContentObjectExportSplitShardResponse,
 } from './store/store.js';
+export * from './sts-errors.js';
 export * from './sts-token-types.js';
 export * from './tenant.js';
 export * from './tool-execution.js';

package/src/platform-event-validation.test.ts

@@ -63,6 +63,32 @@ describe('event subscription input validation', () => {
         expect(result.errors.join(' ')).toContain('timeout_ms');
     });
 
+    it('accepts a fully resolved app hook target', () => {
+        const result = getCreateEventSubscriptionValidationResult(
+            validCreate({
+                target: {
+                    type: 'app',
+                    app_id: 'content-app',
+                    installation_id: 'installation-1',
+                    hook: 'content-updated',
+                    url: 'https://gateway.example/apps/content-app/api/hooks/content-updated',
+                },
+            }),
+        );
+        expect(result.valid).toBe(true);
+    });
+
+    it('requires app hook identity and URL fields', () => {
+        const result = getCreateEventSubscriptionValidationResult(
+            validCreate({ target: { type: 'app', app_id: '', installation_id: '', hook: '', url: '' } }),
+        );
+        expect(result.valid).toBe(false);
+        expect(result.errors.join(' ')).toContain('app_id');
+        expect(result.errors.join(' ')).toContain('installation_id');
+        expect(result.errors.join(' ')).toContain('hook');
+        expect(result.errors.join(' ')).toContain('url');
+    });
+
     it('requires endpoint for workflow targets', () => {
         const result = getCreateEventSubscriptionValidationResult(
             validCreate({ target: { type: 'workflow' } as never }),

package/src/platform-event-validation.ts

@@ -163,8 +163,8 @@ function validateTarget(target: unknown, errors: string[]): void {
         return;
     }
     const type = target.type;
-    if (type !== 'workflow' && type !== 'webhook' && type !== 'agent' && type !== 'process') {
-        errors.push('target.type must be one of workflow, webhook, agent, process');
+    if (type !== 'workflow' && type !== 'webhook' && type !== 'app' && type !== 'agent' && type !== 'process') {
+        errors.push('target.type must be one of workflow, webhook, app, agent, process');
         return;
     }
     const t = target as EventDeliveryTargetInput;
@@ -204,6 +204,19 @@ function validateTarget(target: unknown, errors: string[]): void {
             }
             break;
         }
+        case 'app': {
+            for (const field of ['app_id', 'installation_id', 'hook', 'url'] as const) {
+                if (typeof t[field] !== 'string' || t[field].length === 0) {
+                    errors.push(`app target requires a non-empty "${field}"`);
+                }
+            }
+            if (t.timeout_ms !== undefined) {
+                if (!Number.isInteger(t.timeout_ms) || t.timeout_ms <= 0 || t.timeout_ms > MAX_WEBHOOK_TIMEOUT_MS) {
+                    errors.push(`app target.timeout_ms must be an integer between 1 and ${MAX_WEBHOOK_TIMEOUT_MS}`);
+                }
+            }
+            break;
+        }
         case 'process':
             if ((typeof t.process_ref !== 'string' || t.process_ref.length === 0) && !isRecord(t.process_definition)) {
                 errors.push('process target requires "process_ref" or an inline "process_definition"');