@volter/supercode-teams 0.2.163 → 0.2.164

package/README.md

@@ -46,10 +46,10 @@ a kind another product serves on the same machine. `title.set` needs `control` o
 `observe` on a `root:/path` reads it (stat, list, read, search); `files` also changes it.
 
 A workplace can open one pane or one folder for someone who is not a member of the team. A
-server started with `--delegated-issuer ORIGIN` (the Worker's `DELEGATED_ISSUER`) trusts short-lived
-tokens that issuer signs. `--delegated-issuers ORIGIN,ORIGIN` (the Worker's
-`DELEGATED_ISSUERS`) adds an explicit list of trusted origins; the legacy singular setting
-remains supported. Keys are cached separately per origin, and each token must match a
+server trusts only admin-consented [app installations](../../docs/guides/teams-apps.md) with
+`delegation.surfaces` or `delegation.sessions` for that team. Register the exact issuer origin
+on the app; install the needed module separately. Operator issuer allowlists grant no access.
+Keys are cached separately per origin, and each token must match a
 publication or session binding for that exact issuer. Staging never opens a production
 binding or publication. Tokens use Ed25519 (keys at `ORIGIN/.well-known/jwks.json`, audience this server's
 public origin), each naming a pane (`pane:<key>`) or a folder (`root:/path`) on one machine of one

package/bin/workspace/args.mjs

@@ -10,8 +10,8 @@ const VALUES = new Set([
   'source', 'cursor', 'limit', 'tail', 'before', 'after', 'revision', 'role',
   'out', 'ttl', 'type', 'name', 'visibility', 'backfill', 'format', 'to',
   'grant', 'binding', 'caps', 'fidelity', 'cwd', 'root', 'workspace-from', 'since', 'until', 'session',
-  'on', 'timeout', 'plan', 'tmux-socket', 'volter-issuer', 'delegated-issuer', 'delegated-issuers', 'workplace', 'organization', 'key', 'room',
-  'conversation', 'rh2', 'scope', 'agent',
+  'on', 'timeout', 'plan', 'tmux-socket', 'volter-issuer', 'workplace', 'organization', 'key', 'room',
+  'conversation', 'rh2', 'scope', 'agent', 'body-file',
 ]);
 
 export function parseArgs(argv) {

package/bin/workspace.mjs

@@ -57,6 +57,7 @@ export async function workspaceMain(argv = process.argv.slice(2), env = process.
   const team = client.team(context.team_id);
   const command = { flags, rest, output, client, context, team, explicitContext, home, contextName: selected, env, dependencies };
   if (teamsPrefix && ['list', 'create'].includes(verb)) return teamsCommand(verb, sub, command);
+  if (verb === 'apps' || verb === 'app-installations') return appsCommand(verb,sub,{...command,output:value=>output(flags.json?value:redactAppSecrets(value))});
   if (verb === 'sessions') return sessionsCommand(sub, command);
   if (verb === 'members') return membersCommand(sub, command);
   if (verb === 'groups') return groupsCommand(sub, command);
@@ -69,6 +70,27 @@ export async function workspaceMain(argv = process.argv.slice(2), env = process.
   usage(`unsupported workspace command ${verb}`);
 }
 
+function redactAppSecrets(value) {
+  if(!value||typeof value!=='object')return value;
+  if(Array.isArray(value))return value.map(redactAppSecrets);
+  return Object.fromEntries(Object.entries(value).filter(([key])=>!['secret','webhook_secret','code','token'].includes(key)).map(([key,item])=>[key,redactAppSecrets(item)]));
+}
+
+async function appsCommand(verb,sub,{flags,rest,output,team}) {
+  only(flags,['json','help','context','body_file']);
+  const body=()=>{if(!flags.body_file)usage('--body-file is required (use - for stdin)');return JSON.parse(readFileSync(flags.body_file==='-'?0:flags.body_file,'utf8'));};
+  if(verb==='apps') {
+    if(sub==='catalogue'||sub==='list'){requireArgs(rest,0,0,'teams apps catalogue|list');return output(await team.apps[sub]());}
+    if(sub==='get'||sub==='rotate-secret'){requireArgs(rest,1,1,'teams apps get|rotate-secret APP');return output(await team.apps[sub==='get'?'get':'rotateSecret'](rest[0]));}
+    if(sub==='register'){requireArgs(rest,0,0,'teams apps register --body-file FILE');return output(await team.apps.register(body()));}
+    if(sub==='install'){requireArgs(rest,1,1,'teams apps install APP --body-file FILE');return output(await team.apps.install(rest[0],body()));}
+  } else {
+    if(sub==='list'){requireArgs(rest,0,0,'teams app-installations list');return output(await team.appInstallations.list());}
+    if(['get','uninstall','delegate'].includes(sub)){requireArgs(rest,1,1,'teams app-installations get|uninstall|delegate INSTALLATION');return output(await team.appInstallations[sub](rest[0],...(sub==='delegate'?[body()]:[])));}
+  }
+  usage('teams apps catalogue|list|get|register|install|rotate-secret; app-installations list|get|uninstall|delegate');
+}
+
 async function teamsCommand(verb, sub, { flags, rest, output, client }) {
   if (verb === 'list') { only(flags, ['json', 'help', 'context', 'cursor', 'limit']); requireArgs(rest, 0, 0, 'teams list'); return output(await client.teams({ cursor: flags.cursor, limit: positiveInteger(flags.limit, 50, 'limit') })); }
   const names = [sub, ...rest].filter(value => value !== undefined);
@@ -120,7 +142,7 @@ async function serverCommand({ flags, sub, rest, home, output }) {
   // The Node host's store is node:sqlite (Node 22.5+); only this verb loads it, so every client
   // verb runs on the Node 20 the package declares.
   const { createTeamsServer } = await import('../server/index.mjs');
-  const server = createTeamsServer({ dataDir: flags.data_dir ?? resolve(home, 'teams', 'server'), listen: hostPort(flags.listen ?? '127.0.0.1:7331'), publicOrigin: flags.public_origin ?? null, identityIssuer: flags.volter_issuer ?? null, delegatedIssuer: flags.delegated_issuer ?? null, delegatedIssuers: flags.delegated_issuers?.split(',').map(origin => origin.trim()) ?? [], ...(flags.init_team ? { initTeam: flags.init_team } : {}) });
+  const server = createTeamsServer({ dataDir: flags.data_dir ?? resolve(home, 'teams', 'server'), listen: hostPort(flags.listen ?? '127.0.0.1:7331'), publicOrigin: flags.public_origin ?? null, ...(flags.init_team ? { initTeam: flags.init_team } : {}) });
   output(await server.start());
   await new Promise(resolveStop => { const stop = async () => { await server.close(); resolveStop(); }; process.once('SIGINT', stop); process.once('SIGTERM', stop); });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.163",
+  "version": "0.2.164",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",

package/server/event-routes.mjs

@@ -1,3 +1,4 @@
+import { appAuthentication } from '@volter/teams/server/apps';
 import { createHash } from 'node:crypto';
 import { validateListQuery } from '../contracts/index.mjs';
 import { cursorHash, cursorToken } from './catalog.mjs';
@@ -82,6 +83,7 @@ export async function sessionNames(api, teamId, descriptor) {
 }
 
 async function readForEvent(api, auth, ref, tail) {
+  if(!auth.bound&&!await appAuthentication(api,auth))throw Object.assign(new Error('app authorization changed'),{status:401});
   const nextCursorToken = cursorToken();
   const snapshot = await api.store.readSessionSnapshot({
     ...sessionArgs(api, auth, ref), tail,
@@ -121,6 +123,7 @@ export async function handleSessionEvents({ api, req, res, auth, id, url, reques
   const stream = openStream(api, req, res, auth, requestId, fail);
   if (after === null) stream.write({ type: 'snapshot', cursor: initial.event_cursor, revision: initial.revision, data: initial });
   const enqueue = streamQueue(stream, async () => {
+    if(!auth.bound&&!await appAuthentication(api,auth))fail(401,'authentication_required','app authorization changed');
     // This worker operation reads current credential, membership, groups and every constituent ACL together.
     await api.store.authorizedSession(sessionArgs(api, auth, sessionId));
     const replay = await api.store.query('SELECT revision,kind FROM journal WHERE team_id=? AND session_id=? AND revision>? ORDER BY revision', [auth.team_id, sessionId, delivered]);
@@ -153,6 +156,7 @@ async function catalogWindow(api, auth, query) {
     { kind: 'query', sql: 'SELECT s.*,v.descriptor_json,v.sort_at FROM sessions s LEFT JOIN session_versions v ON v.team_id=s.team_id AND v.session_id=s.id AND v.revision=s.revision WHERE s.team_id=? ORDER BY v.sort_at DESC,s.id ASC', params: [auth.team_id] },
     { kind: 'query', sql: 'SELECT * FROM session_grants WHERE team_id=?', params: [auth.team_id] },
   ]);
+  if(!auth.bound&&!await appAuthentication(api,auth))throw Object.assign(new Error('app authorization changed'),{status:401});
   const now = api.clock.nowMs();
   if (!membership?.active || !credential || credential.revoked_at != null || credential.expires_at != null && credential.expires_at <= now) throw Object.assign(new Error('authorization changed'), { status: 401 });
   const byId = new Map(rows.map(row => [row.id, row]));

package/server/harness-routes.mjs

@@ -1,3 +1,4 @@
+import { installedIssuer } from '@volter/teams/server/apps';
 // The harness's routes on a Teams server (company RFC 0008 §6): the session catalog,
 // search, reads, access and correlations; exports, continuations, effects and the
 // attachment relay; sync rules; OTLP ingest, captures and uploads. The neutral handler
@@ -424,7 +425,7 @@ async function viewBindingRoute(api,req,res,auth,ref,requestId){
   if(session.custodian_id!==auth.principal_id)fail(403,'forbidden',"only the session's owner binds it to a view");
   const body=await parseJson(req);exact(body,['issuer','room','conversation']);
   if(typeof body.room!=='string'||!body.room||typeof body.conversation!=='string'||!body.conversation)fail(400,'invalid_request','room and conversation are required');
-  if(!api.delegatedIssuers.includes(body.issuer))fail(400,'invalid_request',`this server accepts views signed by ${api.delegatedIssuers.join(', ')||'no workplace'}`);
+  if(!await installedIssuer(api,body.issuer,'delegation.sessions',auth.team_id))fail(400,'invalid_request','this issuer is not an installed session integration');
   const key=[auth.team_id,session.id,body.issuer,body.room,body.conversation];
   await api.store.transaction(req.method==='POST'
     ?[{sql:'INSERT OR IGNORE INTO session_view_bindings(team_id,session_id,issuer,room,conversation,bound_by,created_at) VALUES (?,?,?,?,?,?,?)',params:[...key,auth.principal_id,api.clock.nowMs()]}]

package/server/index.mjs

@@ -16,12 +16,12 @@ import { createTeamsApi, bootstrapServer, maintain, normalizePublicOrigin, produ
 
 function atomicJson(path,value){const tmp=`${path}.${process.pid}.${randomBytes(12).toString('hex')}.tmp`;let fd;try{fd=openSync(tmp,'wx',0o600);writeFileSync(fd,JSON.stringify(value,null,2)+'\n');closeSync(fd);fd=undefined;renameSync(tmp,path);chmodSync(path,0o600);}catch(error){if(fd!==undefined)closeSync(fd);try{unlinkSync(tmp);}catch{}throw error;}}
 
-export function createTeamsServer({dataDir,listen={host:'127.0.0.1',port:7331},publicOrigin=null,identityIssuer=null,delegatedIssuer=null,delegatedIssuers=[],clock=productionClock,ids=productionIds,initTeam,uploadLimitBytes=256*1024*1024}={}) {
+export function createTeamsServer({dataDir,listen={host:'127.0.0.1',port:7331},publicOrigin=null,clock=productionClock,ids=productionIds,initTeam,uploadLimitBytes=256*1024*1024}={}) {
   if(!dataDir) throw new TypeError('dataDir is required');
   const loopback=['127.0.0.1','::1','localhost'].includes(listen.host??'127.0.0.1');
   publicOrigin=normalizePublicOrigin(publicOrigin);
   if(!loopback&&!publicOrigin?.startsWith('https:'))throw new TypeError('non-loopback Teams servers require an HTTPS publicOrigin');
-  const api=createTeamsApi({clock,ids,publicOrigin,identityIssuer,identityOrganizations:identityIssuer?identityOrganizationsFromEnv(process.env):null,delegatedIssuer,delegatedIssuers,uploadLimitBytes});
+  const api=createTeamsApi({clock,ids,publicOrigin,identityOrganizations:identityOrganizationsFromEnv(process.env),uploadLimitBytes});
   // The harness's own routes on this server (harness-routes.mjs); the handler owns the neutral ones.
   api.attach({harnessRoutes});
   const events=api.events;
@@ -43,6 +43,7 @@ export function createTeamsServer({dataDir,listen={host:'127.0.0.1',port:7331},p
         if(!existsSync(credentialPath)&&existsSync(pendingPath)){const pending=JSON.parse(readFileSync(pendingPath,'utf8'));if(pending.server_id!==serverId)throw new Error('bootstrap credential recovery does not match server identity');renameSync(pendingPath,credentialPath);chmodSync(credentialPath,0o600);}
       }
       api.attach({serverId});
+      if(existsSync(credentialPath))api.appRootSecret=JSON.parse(readFileSync(credentialPath,'utf8')).token;
       const maintenance=async()=>{
         let next=60000;
         try{

package/server/store-core.mjs

@@ -28,10 +28,15 @@ export function createStoreHandlers({ all, get, run, tx }) {
     // session its owner bound to that Room and Conversation; it holds no credential and is no member.
     let membership=null;
     if(bound){
+      if(!get(`SELECT 1 FROM app_installations i JOIN apps a ON a.id=i.app_id JOIN memberships m ON m.team_id=i.team_id AND m.principal_id=i.principal_id JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id WHERE i.team_id=? AND a.issuer=? AND i.state='active' AND a.state='active' AND m.active=1 AND installer.active=1 AND installer.role IN ('owner','admin') AND EXISTS (SELECT 1 FROM json_each(i.actions_json) WHERE value='delegation.sessions')`,[teamId,bound.issuer]))domainError(401,'authentication_required','integration was uninstalled');
       if(!(bound.expiresAt>now))domainError(401,'authentication_required','authentication required');
     }else{
       const credential=get("SELECT id FROM credentials WHERE id=? AND principal_id=? AND kind IN ('user','service') AND (team_id IS NULL OR team_id=?) AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at>?)",[credentialId,principalId,teamId,now]);
       membership=get('SELECT role FROM memberships WHERE team_id=? AND principal_id=? AND active=1',[teamId,principalId]);
+      const identity=get(`SELECT i.state,a.state app_state,m.active,m.role FROM identity_app_credentials c JOIN app_installations i ON i.id=c.installation_id JOIN apps a ON a.id=i.app_id JOIN memberships m ON m.team_id=i.team_id AND m.principal_id=i.installer_id WHERE c.credential_id=?`,[credentialId]);
+      if(identity&&(identity.state!=='active'||identity.app_state!=='active'||!identity.active||!['owner','admin'].includes(identity.role)))domainError(401,'authentication_required','identity integration revoked');
+      const app=get('SELECT ac.*,i.state,a.state app_state,installer.active,installer.role FROM app_credentials ac JOIN app_installations i ON i.id=ac.installation_id JOIN apps a ON a.id=i.app_id JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id WHERE ac.credential_id=?',[credentialId]);
+      if(app){if(app.state!=='active'||app.app_state!=='active'||!app.active||!['owner','admin'].includes(app.role)||!JSON.parse(app.actions_json).includes('sessions.read'))domainError(403,'forbidden','app session read authorization changed');const revoked=get(`WITH RECURSIVE lineage(id,parent_id) AS (SELECT credential_id,parent_id FROM app_credentials WHERE credential_id=? UNION ALL SELECT ac.credential_id,ac.parent_id FROM app_credentials ac JOIN lineage l ON ac.credential_id=l.parent_id) SELECT 1 FROM lineage l JOIN credentials c ON c.id=l.id WHERE c.revoked_at IS NOT NULL OR c.expires_at<=? LIMIT 1`,[credentialId,now]);if(revoked)domainError(401,'authentication_required','parent credential revoked');}
       if(!credential||!membership)domainError(401,'authentication_required','authentication required');
     }
     if(typeof ref!=='string'||ref.length<8)domainError(404,'not_found','not found');

package/worker/index.mjs

@@ -5,11 +5,10 @@
 // Configuration (wrangler.toml [vars] and secrets):
 //   PUBLIC_ORIGIN                      the https origin the Worker is served at
 //   INIT_TEAM                          the first team's name (used once, at bootstrap)
-//   VOLTER_ISSUER                      optional: an identity service members may sign in with (https://id.volter.ai)
+// Identity and delegation issuers are registered apps installed by team admins through the public doors.
 //   VOLTER_ORG_CLIENT_ID, VOLTER_ORG_CLIENT_SECRET, VOLTER_TEAM_ORGS
-//                                      optional: this server's product credential at VOLTER_ISSUER, and the teams whose
+//                                      optional: this server's product credential at the organization's identity issuer, and the teams whose
 //                                      organization there admits its members with no invitation (`team=slug,…`)
-//   DELEGATED_ISSUER                   optional: a workplace (RH2) whose delegated tokens open one pane or folder at /view
 //   SUPERCODE_TEAMS_BOOTSTRAP_TOKEN    secret: the owner's first credential, minted with
 //                                      `supercode teams server token`
 import { DurableObject } from 'cloudflare:workers';
@@ -81,7 +80,7 @@ export class TeamsServer extends DurableObject {
       console.log(`storage: database_bytes=${ctx.storage.sql.databaseSize}`);
       const db = durableSql(ctx.storage);
       migrate({ exec: db.exec, tx: db.tx, version: () => ctx.storage.kv.get('schema_version') ?? 0, setVersion: (n) => ctx.storage.kv.put('schema_version', n) });
-      this.api = createTeamsApi({ publicOrigin: normalizePublicOrigin(env.PUBLIC_ORIGIN), identityIssuer: env.VOLTER_ISSUER || null, identityOrganizations: identityOrganizationsFromEnv(env), delegatedIssuer: env.DELEGATED_ISSUER || null, delegatedIssuers: env.DELEGATED_ISSUERS ? env.DELEGATED_ISSUERS.split(',').map(origin => origin.trim()) : [] });
+      this.api = createTeamsApi({ publicOrigin: normalizePublicOrigin(env.PUBLIC_ORIGIN), appRootSecret: env.SUPERCODE_TEAMS_BOOTSTRAP_TOKEN || null, identityOrganizations: identityOrganizationsFromEnv(env) });
       this.api.storageUsage = () => {
         const sql = ctx.storage.sql;
         let freeBytes = null;

package/worker/wrangler.toml

@@ -4,24 +4,14 @@
 #     --var PUBLIC_ORIGIN:https://<worker>.<account>.workers.dev --var INIT_TEAM:<first team>
 # The token printed above is the owner's first credential (`supercode teams login <origin> --token-stdin`).
 #
-# Origin and identity variables are retained with keep_vars. The explicit delegated
-# allowlist below is versioned and installed by deploy-teams CI.
-#   PUBLIC_ORIGIN     the https origin the Worker is served at (required)
-#   INIT_TEAM         the first team's name, used once at bootstrap
-#   VOLTER_ISSUER     optional: members sign in with Volter (supercode teams login --volter); the issuer
-#                     must have this origin registered as a resource
-#   DELEGATED_ISSUER  optional: a workplace (RH2) whose delegated tokens open published panes and folders and
-#                     bound sessions; its keys are at <issuer>/.well-known/jwks.json
-#   DELEGATED_ISSUERS comma-separated exact origins, additive with legacy DELEGATED_ISSUER
+# Identity and delegated access are admin-consented app installations, never operator allowlists.
+# PUBLIC_ORIGIN and INIT_TEAM supply the listener and bootstrap team.
 name = "supercode-teams"
 main = "index.mjs"
 compatibility_date = "2026-09-01"
 compatibility_flags = ["nodejs_compat"]
 keep_vars = true
 
-[vars]
-DELEGATED_ISSUERS = "https://pilot.runhuman.com,https://rh2-staging.voltertest.xyz"
-
 # Workers Logs: the Worker's log lines (viewer-error, session-view refused, maintain) kept and searchable after the fact.
 [observability]
 enabled = true

package/workspace-client.d.ts

@@ -36,9 +36,24 @@ export declare class TeamsClient {
   capabilities(options?:RequestOptions):Promise<Capabilities>;
   teams(query?:{limit?:number;cursor?:string},options?:RequestOptions):Promise<ServerPage<Team>>;
   createTeam(body:{name:string},options?:RequestOptions):Promise<Result<Team>>;
+  redeemAppCode(body:{app_id:string;app_secret:string;code:string;redirect_url:string},options?:RequestOptions):Promise<AppCodeExchange>;
   team(id:string):TeamClient;
 }
+export interface TeamsApp {
+  id:string; team_id:string; principal_id:string; name:string; description:string;
+  actions:string[]; event_kinds:string[]; redirect_urls:string[]; webhook_url:string|null;
+  issuer:string|null; state:'active'|'retired'; created_at:number;
+}
+export type RegisterTeamsApp=Pick<TeamsApp,'name'|'actions'|'redirect_urls'> & Partial<Pick<TeamsApp,'description'|'event_kinds'|'webhook_url'|'issuer'>>;
+export interface AppInstallation {
+  id:string; app_id:string; team_id:string; principal_id:string; installer_id:string;
+  actions:string[]; state:'active'|'uninstalled'; created_at:number; uninstalled_at:number|null;
+}
+export interface AppToken { token:string; kind:'service'; expires_at:number; actions:string[]; subject:string; act:string[] }
+export interface AppCodeExchange { version:1; installation:AppInstallation; credential:AppToken; webhook_secret:string }
 export interface TeamClient {
+  apps:{catalogue(options?:RequestOptions):Promise<Result<{actions:string[];event_kinds:string[]}>>;list(options?:RequestOptions):Promise<Page<TeamsApp>>;get(id:string,options?:RequestOptions):Promise<Result<TeamsApp>>;register(body:RegisterTeamsApp,options?:RequestOptions):Promise<Result<TeamsApp & {secret?:string}>>;rotateSecret(id:string,options?:RequestOptions):Promise<Result<{id:string;secret?:string}>>;install(id:string,body:{redirect_url:string;state:string;actions?:string[]},options?:RequestOptions):Promise<Result<{installation:AppInstallation;code?:string;state:string;redirect_url:string;expires_at:number}>>};
+  appInstallations:{list(options?:RequestOptions):Promise<Page<AppInstallation>>;get(id:string,options?:RequestOptions):Promise<Result<AppInstallation>>;uninstall(id:string,options?:RequestOptions):Promise<null>;delegate(id:string,body:{actions:string[];actor:string;expires_in_ms?:number},options?:RequestOptions):Promise<Result<AppToken|null>>};
   sessions:{list(query?:ListQuery,options?:RequestOptions):Promise<Page<Descriptor>>;search(query:SearchQuery,options?:RequestOptions):Promise<SearchPage>;watch(query?:ListQuery,options?:StreamOptions):AsyncIterable<Event>;get(id:string):SessionClient};
   members:{list(query?:Record<string,unknown>,options?:RequestOptions):Promise<Page<Membership>>;update(id:string,body:{role:Membership['role']},options?:RequestOptions):Promise<Result<Membership>>;remove(id:string,options?:RequestOptions):Promise<null>};
   groups:{list(query?:Record<string,unknown>,options?:RequestOptions):Promise<Page<Group>>;create(body:{name:string},options?:RequestOptions):Promise<Result<Group>>;remove(id:string,options?:RequestOptions):Promise<null>;addMember(groupId:string,memberId:string,options?:RequestOptions):Promise<null>;removeMember(groupId:string,memberId:string,options?:RequestOptions):Promise<null>};

package/workspace-client.mjs

@@ -12,6 +12,7 @@ export class TeamsClient {
     throw last;
   }
   me(options){return this.request('GET','/api/v1/me',options);} capabilities(options){return this.request('GET','/api/v1/capabilities',options);} team(id){return new TeamClient(this,id);}
+  redeemAppCode(body,options){return this.request('POST','/api/v1/apps/token',{...options,body});}
   teams(queryValue={},options){return this.request('GET','/api/v1/teams'+query(queryValue),options);}
   createTeam(body,options){return this.request('POST','/api/v1/teams',{...options,body});}
 }
@@ -28,6 +29,18 @@ class TeamClient {
     const patch = (path, body, options) => root.request('PATCH', base + path, { ...options, body });
     const remove = (path, options) => root.request('DELETE', base + path, options);
     const resource = (path, id) => `${path}/${segment(id)}`;
+    this.apps = {
+      catalogue: o => get('/apps/catalogue', o),
+      list: o => get('/apps', o), get: (id, o) => get(resource('/apps', id), o),
+      register: (body, o) => post('/apps', body, o),
+      rotateSecret: (id, o) => post(resource('/apps', id) + '/secret', {}, o),
+      install: (id, body, o) => post(resource('/apps', id) + '/installations', body, o),
+    };
+    this.appInstallations = {
+      list: o => get('/app-installations', o), get: (id, o) => get(resource('/app-installations', id), o),
+      uninstall: (id, o) => remove(resource('/app-installations', id), o),
+      delegate: (id, body, o) => post(resource('/app-installations', id) + '/delegations', body, o),
+    };
     this.sessions = {
       list: (q = {}, o) => get('/sessions' + query(q), o),
       search: (q, o) => get('/sessions/search' + query(q), o),