@voyant-travel/apps 0.1.0

package/dist/consent.test.js

@@ -0,0 +1,80 @@
+import { describe, expect, it } from "vitest";
+import { computeAppConsent } from "./consent.js";
+const catalog = {
+    resources: [
+        {
+            id: "bookings",
+            unitId: "bookings",
+            resource: "bookings",
+            label: "Bookings",
+            description: "Bookings",
+            wildcard: "allow",
+            actions: [{ action: "read", label: "Read", description: "Read" }],
+        },
+        {
+            id: "invoices",
+            unitId: "finance",
+            resource: "invoices",
+            label: "Invoices",
+            description: "Invoices",
+            wildcard: "allow",
+            actions: [{ action: "read", label: "Read", description: "Read" }],
+        },
+    ],
+    presets: [
+        {
+            id: "remote-safe",
+            kind: "api-token-grant",
+            audience: "staff",
+            label: "Remote safe",
+            description: "Remote app grants",
+            grants: ["bookings:read"],
+        },
+    ],
+};
+function release(requestedScopes, optionalScopes) {
+    return {
+        id: "release_1",
+        appId: "app_1",
+        releaseVersion: "1.0.0",
+        manifestSchemaVersion: "voyant.app-manifest.v1",
+        manifestDigest: "digest",
+        manifestSnapshot: {},
+        normalizedRecord: {
+            schemaVersion: "voyant.app-release.normalized.v1",
+            releaseVersion: "1.0.0",
+            digest: "digest",
+            requestedScopes,
+            optionalScopes,
+            adminPages: [],
+            slotExtensions: [],
+            webhooks: [],
+            customFields: [],
+        },
+        apiCompatibility: { min: "2026-01-01", max: "2026-12-31" },
+        defaultLocale: "en-US",
+        supportedLocales: ["en-US"],
+        state: "available",
+        createdBy: "user_1",
+        createdAt: new Date(),
+    };
+}
+describe("app OAuth consent computation", () => {
+    it("grants only scopes present in the catalog, remote-safe, and operator-granted", () => {
+        const consent = computeAppConsent({
+            release: release(["bookings:read"], ["invoices:read"]),
+            accessCatalog: catalog,
+            operatorGrantedScopes: ["bookings:read", "invoices:read"],
+            grantedOptionalScopes: ["invoices:read"],
+        });
+        expect(consent.grantedScopes).toEqual(["bookings:read"]);
+        expect(consent.deniedOptionalScopes).toEqual(["invoices:read"]);
+    });
+    it("rejects required scopes that are absent, unsafe, or not operator-granted", () => {
+        expect(() => computeAppConsent({
+            release: release(["invoices:read"], []),
+            accessCatalog: catalog,
+            operatorGrantedScopes: ["invoices:read"],
+        })).toThrow("Required app scopes are not grantable");
+    });
+});

package/dist/contracts.d.ts

@@ -0,0 +1,263 @@
+import { z } from "zod";
+export declare const APP_MANIFEST_SCHEMA_VERSION: "voyant.app-manifest.v1";
+export declare const APP_ADMIN_EXTENSION_SLOTS: readonly ["dashboard.header", "dashboard.after-kpis", "dashboard.footer", "booking.details.header", "booking.details.after-summary", "invoice.details.header", "invoice.details.after-summary", "workspace.header.actions"];
+export declare const manifestDisallowedKeySchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+export declare const appOwnedCustomFieldDeclarationSchema: z.ZodObject<{
+    entityType: z.ZodString;
+    key: z.ZodString;
+    label: z.ZodString;
+    fieldType: z.ZodEnum<{
+        boolean: "boolean";
+        text: "text";
+        date: "date";
+        monetary: "monetary";
+        json: "json";
+        varchar: "varchar";
+        double: "double";
+        enum: "enum";
+        set: "set";
+        address: "address";
+        phone: "phone";
+    }>;
+    isRequired: z.ZodDefault<z.ZodBoolean>;
+    isSearchable: z.ZodDefault<z.ZodBoolean>;
+    isExportable: z.ZodDefault<z.ZodBoolean>;
+    isInvoiceable: z.ZodDefault<z.ZodBoolean>;
+    options: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
+        label: z.ZodString;
+        value: z.ZodString;
+    }, z.core.$strip>>>>;
+    logicalNamespace: z.ZodOptional<z.ZodString>;
+    dataClassification: z.ZodDefault<z.ZodEnum<{
+        public: "public";
+        internal: "internal";
+        confidential: "confidential";
+        restricted: "restricted";
+        personal: "personal";
+        financial: "financial";
+    }>>;
+}, z.core.$strict>;
+export declare const appManifestSchema: z.ZodPipe<z.ZodRecord<z.ZodString, z.ZodUnknown>, z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"voyant.app-manifest.v1">;
+    releaseVersion: z.ZodString;
+    apiCompatibility: z.ZodObject<{
+        min: z.ZodString;
+        max: z.ZodString;
+    }, z.core.$strict>;
+    scopes: z.ZodObject<{
+        requested: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        optional: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>;
+    admin: z.ZodDefault<z.ZodObject<{
+        pages: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            key: z.ZodString;
+            titleKey: z.ZodString;
+            path: z.ZodString;
+            entryUrl: z.ZodString;
+        }, z.core.$strict>>>;
+        slotExtensions: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            key: z.ZodString;
+            titleKey: z.ZodString;
+            version: z.ZodString;
+            extensionApi: z.ZodString;
+            entryUrl: z.ZodString;
+            slots: z.ZodArray<z.ZodEnum<{
+                "dashboard.header": "dashboard.header";
+                "dashboard.after-kpis": "dashboard.after-kpis";
+                "dashboard.footer": "dashboard.footer";
+                "booking.details.header": "booking.details.header";
+                "booking.details.after-summary": "booking.details.after-summary";
+                "invoice.details.header": "invoice.details.header";
+                "invoice.details.after-summary": "invoice.details.after-summary";
+                "workspace.header.actions": "workspace.header.actions";
+            }>>;
+            config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
+    webhooks: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        eventType: z.ZodString;
+        eventVersion: z.ZodString;
+        endpointUrl: z.ZodString;
+    }, z.core.$strict>>>;
+    customFields: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        entityType: z.ZodString;
+        key: z.ZodString;
+        label: z.ZodString;
+        fieldType: z.ZodEnum<{
+            boolean: "boolean";
+            text: "text";
+            date: "date";
+            monetary: "monetary";
+            json: "json";
+            varchar: "varchar";
+            double: "double";
+            enum: "enum";
+            set: "set";
+            address: "address";
+            phone: "phone";
+        }>;
+        isRequired: z.ZodDefault<z.ZodBoolean>;
+        isSearchable: z.ZodDefault<z.ZodBoolean>;
+        isExportable: z.ZodDefault<z.ZodBoolean>;
+        isInvoiceable: z.ZodDefault<z.ZodBoolean>;
+        options: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
+            label: z.ZodString;
+            value: z.ZodString;
+        }, z.core.$strip>>>>;
+        logicalNamespace: z.ZodOptional<z.ZodString>;
+        dataClassification: z.ZodDefault<z.ZodEnum<{
+            public: "public";
+            internal: "internal";
+            confidential: "confidential";
+            restricted: "restricted";
+            personal: "personal";
+            financial: "financial";
+        }>>;
+    }, z.core.$strict>>>;
+    locales: z.ZodObject<{
+        default: z.ZodString;
+        supported: z.ZodArray<z.ZodString>;
+        host: z.ZodRecord<z.ZodString, z.ZodObject<{
+            name: z.ZodString;
+            summary: z.ZodString;
+            navigation: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+            extensions: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+            setup: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    urls: z.ZodObject<{
+        setup: z.ZodOptional<z.ZodString>;
+        health: z.ZodString;
+        launch: z.ZodString;
+        privacy: z.ZodString;
+        support: z.ZodString;
+    }, z.core.$strict>;
+    data: z.ZodObject<{
+        classifications: z.ZodArray<z.ZodEnum<{
+            public: "public";
+            internal: "internal";
+            confidential: "confidential";
+            restricted: "restricted";
+            personal: "personal";
+            financial: "financial";
+        }>>;
+        retention: z.ZodString;
+        storesSecrets: z.ZodDefault<z.ZodLiteral<false>>;
+    }, z.core.$strict>;
+}, z.core.$strict>>;
+export declare const createCustomAppRegistrationSchema: z.ZodObject<{
+    ownerId: z.ZodString;
+    displayName: z.ZodString;
+    slug: z.ZodString;
+    redirectUris: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    createdBy: z.ZodString;
+}, z.core.$strict>;
+export declare const releaseManifestUploadSchema: z.ZodObject<{
+    manifest: z.ZodUnknown;
+    createdBy: z.ZodString;
+    provenance: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strict>;
+export declare const releaseManifestFetchSchema: z.ZodObject<{
+    manifestUrl: z.ZodString;
+    createdBy: z.ZodString;
+}, z.core.$strict>;
+export declare const appListQuerySchema: z.ZodObject<{
+    ownerId: z.ZodOptional<z.ZodString>;
+    distribution: z.ZodOptional<z.ZodEnum<{
+        custom: "custom";
+        marketplace: "marketplace";
+    }>>;
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    offset: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
+export declare const appWebhookReplaySchema: z.ZodObject<{
+    deliveryId: z.ZodString;
+    actorId: z.ZodString;
+    signingKeyId: z.ZodString;
+    signingSecret: z.ZodString;
+}, z.core.$strict>;
+export declare const appOAuthAuthorizeQuerySchema: z.ZodObject<{
+    response_type: z.ZodLiteral<"code">;
+    client_id: z.ZodString;
+    release_id: z.ZodString;
+    redirect_uri: z.ZodString;
+    state: z.ZodString;
+    code_challenge: z.ZodString;
+    code_challenge_method: z.ZodLiteral<"S256">;
+    actor_id: z.ZodString;
+    operator_scopes: z.ZodDefault<z.ZodString>;
+    optional_scopes: z.ZodDefault<z.ZodString>;
+}, z.core.$strict>;
+export declare const appOAuthTokenSchema: z.ZodPipe<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    grant_type: z.ZodLiteral<"authorization_code">;
+    code: z.ZodString;
+    redirect_uri: z.ZodString;
+    code_verifier: z.ZodString;
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    grant_type: z.ZodLiteral<"refresh_token">;
+    refresh_token: z.ZodString;
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    grant_type: z.ZodLiteral<"urn:voyant:params:oauth:grant-type:actor-token-exchange">;
+    installation_id: z.ZodString;
+    viewer_id: z.ZodString;
+    viewer_scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    contextual_scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "grant_type">, z.ZodTransform<{
+    client_secret: string | undefined;
+    grant_type: "authorization_code";
+    code: string;
+    redirect_uri: string;
+    code_verifier: string;
+    client_id: string;
+} | {
+    client_secret: string | undefined;
+    grant_type: "refresh_token";
+    refresh_token: string;
+    client_id: string;
+} | {
+    client_secret: string | undefined;
+    grant_type: "urn:voyant:params:oauth:grant-type:actor-token-exchange";
+    installation_id: string;
+    viewer_id: string;
+    viewer_scopes: string[];
+    client_id: string;
+    contextual_scopes?: string[] | undefined;
+}, {
+    grant_type: "authorization_code";
+    code: string;
+    redirect_uri: string;
+    code_verifier: string;
+    client_id: string;
+    client_secret?: string | undefined;
+} | {
+    grant_type: "refresh_token";
+    refresh_token: string;
+    client_id: string;
+    client_secret?: string | undefined;
+} | {
+    grant_type: "urn:voyant:params:oauth:grant-type:actor-token-exchange";
+    installation_id: string;
+    viewer_id: string;
+    viewer_scopes: string[];
+    client_id: string;
+    contextual_scopes?: string[] | undefined;
+    client_secret?: string | undefined;
+}>>;
+export declare const appCredentialRevocationSchema: z.ZodObject<{
+    installationId: z.ZodString;
+    actorId: z.ZodString;
+}, z.core.$strict>;
+export type AppManifest = z.infer<typeof appManifestSchema>;
+export type CreateCustomAppRegistrationInput = z.infer<typeof createCustomAppRegistrationSchema>;
+export type ReleaseManifestUploadInput = z.infer<typeof releaseManifestUploadSchema>;
+export type ReleaseManifestFetchInput = z.infer<typeof releaseManifestFetchSchema>;
+export type AppListQuery = z.infer<typeof appListQuerySchema>;
+export type AppWebhookReplayInput = z.infer<typeof appWebhookReplaySchema>;
+export type AppOAuthAuthorizeQuery = z.infer<typeof appOAuthAuthorizeQuerySchema>;
+export type AppOAuthTokenInput = z.infer<typeof appOAuthTokenSchema>;

package/dist/contracts.js

@@ -0,0 +1,273 @@
+import { customFieldDefinitionInputSchema } from "@voyant-travel/custom-fields/contracts";
+import { assertOutboundWebhookEndpointUrl } from "@voyant-travel/webhook-delivery";
+import { z } from "zod";
+export const APP_MANIFEST_SCHEMA_VERSION = "voyant.app-manifest.v1";
+export const APP_ADMIN_EXTENSION_SLOTS = [
+    "dashboard.header",
+    "dashboard.after-kpis",
+    "dashboard.footer",
+    "booking.details.header",
+    "booking.details.after-summary",
+    "invoice.details.header",
+    "invoice.details.after-summary",
+    "workspace.header.actions",
+];
+const disallowedManifestKeys = {
+    schemas: "Database schemas are deployment-package authority and cannot appear in app manifests.",
+    migrations: "Database migrations are deployment-package authority and cannot appear in app manifests.",
+    hostRoutes: "Host routes cannot be declared by remote app manifests.",
+    routes: "Host routes cannot be declared by remote app manifests.",
+    runtimeFactories: "Runtime factories cannot be declared by remote app manifests.",
+    subscribers: "Subscribers cannot be declared by remote app manifests.",
+    providers: "Infrastructure providers cannot be declared by remote app manifests.",
+    scripts: "Package or lifecycle scripts are forbidden in app release manifests.",
+    dependencies: "Dependency declarations are forbidden in app release manifests.",
+    optionalDependencies: "Dependency declarations are forbidden in app release manifests.",
+    peerDependencies: "Dependency declarations are forbidden in app release manifests.",
+    bundledDependencies: "Dependency declarations are forbidden in app release manifests.",
+    binaries: "Binary declarations are forbidden in app release manifests.",
+    bin: "Binary declarations are forbidden in app release manifests.",
+    exports: "Executable package exports are forbidden in app release manifests.",
+    files: "Undeclared file inventories are forbidden in app release manifests.",
+};
+export const manifestDisallowedKeySchema = z
+    .record(z.string(), z.unknown())
+    .superRefine((value, context) => {
+    for (const [key, message] of Object.entries(disallowedManifestKeys)) {
+        if (Object.hasOwn(value, key)) {
+            context.addIssue({
+                code: "custom",
+                path: [key],
+                message,
+            });
+        }
+    }
+});
+const semverLikeSchema = z.string().trim().min(1).max(64);
+const scopeSchema = z
+    .string()
+    .trim()
+    .regex(/^[a-z][a-z0-9-]*:[a-z][a-z0-9-]*$/);
+const localeSchema = z.string().trim().min(2).max(35);
+const httpsUrlSchema = z
+    .string()
+    .url()
+    .refine((value) => new URL(value).protocol === "https:", {
+    message: "URL must use https.",
+});
+const webhookEndpointUrlSchema = httpsUrlSchema.refine((value) => {
+    try {
+        assertOutboundWebhookEndpointUrl(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}, { message: "Webhook endpoint URL must be HTTPS and must not target local or private hosts." });
+const extensionSlotSchema = z.enum(APP_ADMIN_EXTENSION_SLOTS);
+const dataClassificationSchema = z.enum([
+    "public",
+    "internal",
+    "confidential",
+    "restricted",
+    "personal",
+    "financial",
+]);
+const localizedHostMetadataSchema = z
+    .object({
+    name: z.string().trim().min(1).max(80),
+    summary: z.string().trim().min(1).max(280),
+    navigation: z.record(z.string(), z.string().trim().min(1).max(80)).default({}),
+    extensions: z.record(z.string(), z.string().trim().min(1).max(80)).default({}),
+    setup: z.record(z.string(), z.string().trim().min(1).max(80)).default({}),
+})
+    .strict();
+const adminPageSchema = z
+    .object({
+    key: z.string().trim().min(1).max(80),
+    titleKey: z.string().trim().min(1).max(120),
+    path: z
+        .string()
+        .trim()
+        .regex(/^\/[a-z0-9-_/]*$/),
+    entryUrl: httpsUrlSchema,
+})
+    .strict();
+const slotExtensionSchema = z
+    .object({
+    key: z.string().trim().min(1).max(80),
+    titleKey: z.string().trim().min(1).max(120),
+    version: semverLikeSchema,
+    extensionApi: semverLikeSchema,
+    entryUrl: httpsUrlSchema,
+    slots: z.array(extensionSlotSchema).min(1),
+    config: z.record(z.string(), z.unknown()).optional(),
+})
+    .strict();
+const webhookSubscriptionSchema = z
+    .object({
+    eventType: z.string().trim().min(1).max(160),
+    eventVersion: semverLikeSchema,
+    endpointUrl: webhookEndpointUrlSchema,
+})
+    .strict();
+export const appOwnedCustomFieldDeclarationSchema = customFieldDefinitionInputSchema
+    .extend({
+    logicalNamespace: z
+        .string()
+        .trim()
+        .regex(/^[a-z][a-z0-9-]*$/)
+        .optional(),
+    dataClassification: dataClassificationSchema.default("internal"),
+})
+    .strict();
+export const appManifestSchema = manifestDisallowedKeySchema.pipe(z
+    .object({
+    schemaVersion: z.literal(APP_MANIFEST_SCHEMA_VERSION),
+    releaseVersion: semverLikeSchema,
+    apiCompatibility: z.object({ min: semverLikeSchema, max: semverLikeSchema }).strict(),
+    scopes: z
+        .object({
+        requested: z.array(scopeSchema).default([]),
+        optional: z.array(scopeSchema).default([]),
+    })
+        .strict(),
+    admin: z
+        .object({
+        pages: z.array(adminPageSchema).default([]),
+        slotExtensions: z.array(slotExtensionSchema).default([]),
+    })
+        .strict()
+        .default({ pages: [], slotExtensions: [] }),
+    webhooks: z.array(webhookSubscriptionSchema).default([]),
+    customFields: z.array(appOwnedCustomFieldDeclarationSchema).default([]),
+    locales: z
+        .object({
+        default: localeSchema,
+        supported: z.array(localeSchema).min(1),
+        host: z.record(localeSchema, localizedHostMetadataSchema),
+    })
+        .strict(),
+    urls: z
+        .object({
+        setup: httpsUrlSchema.optional(),
+        health: httpsUrlSchema,
+        launch: httpsUrlSchema,
+        privacy: httpsUrlSchema,
+        support: httpsUrlSchema,
+    })
+        .strict(),
+    data: z
+        .object({
+        classifications: z.array(dataClassificationSchema).min(1),
+        retention: z.string().trim().min(1).max(280),
+        storesSecrets: z.literal(false).default(false),
+    })
+        .strict(),
+})
+    .strict()
+    .superRefine((manifest, context) => {
+    if (!manifest.locales.supported.includes(manifest.locales.default)) {
+        context.addIssue({
+            code: "custom",
+            path: ["locales", "default"],
+            message: "The default locale must be present in supported locales.",
+        });
+    }
+    if (!manifest.locales.host[manifest.locales.default]) {
+        context.addIssue({
+            code: "custom",
+            path: ["locales", "host", manifest.locales.default],
+            message: "Host-rendered metadata is required for the default locale.",
+        });
+    }
+}));
+export const createCustomAppRegistrationSchema = z
+    .object({
+    ownerId: z.string().trim().min(1).max(160),
+    displayName: z.string().trim().min(1).max(120),
+    slug: z
+        .string()
+        .trim()
+        .regex(/^[a-z0-9][a-z0-9-]{0,78}[a-z0-9]$/),
+    redirectUris: z.array(httpsUrlSchema).default([]),
+    createdBy: z.string().trim().min(1).max(160),
+})
+    .strict();
+export const releaseManifestUploadSchema = z
+    .object({
+    manifest: z.unknown(),
+    createdBy: z.string().trim().min(1).max(160),
+    provenance: z.record(z.string(), z.unknown()).default({ source: "admin-upload" }),
+})
+    .strict();
+export const releaseManifestFetchSchema = z
+    .object({
+    manifestUrl: httpsUrlSchema,
+    createdBy: z.string().trim().min(1).max(160),
+})
+    .strict();
+export const appListQuerySchema = z.object({
+    ownerId: z.string().trim().min(1).optional(),
+    distribution: z.enum(["custom", "marketplace"]).optional(),
+    limit: z.coerce.number().int().positive().max(100).default(25),
+    offset: z.coerce.number().int().nonnegative().default(0),
+});
+export const appWebhookReplaySchema = z
+    .object({
+    deliveryId: z.string().trim().min(1),
+    actorId: z.string().trim().min(1).max(160),
+    signingKeyId: z.string().trim().min(1).max(160),
+    signingSecret: z.string().min(32),
+})
+    .strict();
+export const appOAuthAuthorizeQuerySchema = z
+    .object({
+    response_type: z.literal("code"),
+    client_id: z.string().trim().min(1),
+    release_id: z.string().trim().min(1),
+    redirect_uri: z.string().url(),
+    state: z.string().trim().min(1),
+    code_challenge: z.string().trim().min(1),
+    code_challenge_method: z.literal("S256"),
+    actor_id: z.string().trim().min(1),
+    operator_scopes: z.string().trim().default(""),
+    optional_scopes: z.string().trim().default(""),
+})
+    .strict();
+export const appOAuthTokenSchema = z
+    .discriminatedUnion("grant_type", [
+    z.object({
+        grant_type: z.literal("authorization_code"),
+        code: z.string().trim().min(1),
+        redirect_uri: z.string().url(),
+        code_verifier: z.string().trim().min(43).max(128),
+        client_id: z.string().trim().min(1),
+        client_secret: z.string().trim().optional(),
+    }),
+    z.object({
+        grant_type: z.literal("refresh_token"),
+        refresh_token: z.string().trim().min(1),
+        client_id: z.string().trim().min(1),
+        client_secret: z.string().trim().optional(),
+    }),
+    z.object({
+        grant_type: z.literal("urn:voyant:params:oauth:grant-type:actor-token-exchange"),
+        installation_id: z.string().trim().min(1),
+        viewer_id: z.string().trim().min(1),
+        viewer_scopes: z.array(scopeSchema).default([]),
+        contextual_scopes: z.array(scopeSchema).optional(),
+        client_id: z.string().trim().min(1),
+        client_secret: z.string().trim().optional(),
+    }),
+])
+    .transform((input) => ({
+    ...input,
+    client_secret: input.client_secret?.trim() || undefined,
+}));
+export const appCredentialRevocationSchema = z
+    .object({
+    installationId: z.string().trim().min(1),
+    actorId: z.string().trim().min(1),
+})
+    .strict();

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+export * from "./access-boundary.js";
+export * from "./compiler.js";
+export * from "./consent.js";
+export * from "./contracts.js";
+export * from "./ingestion.js";
+export * from "./installation-service.js";
+export * from "./oauth-crypto.js";
+export * from "./oauth-service.js";
+export { createAppsAdminRoutes } from "./routes.js";
+export { appAccessCredentialStatusEnum, appAccessCredentials, appAccessTokenModeEnum, appAuditEventKindEnum, appAuditEvents, appCredentialKindEnum, appCredentials, appDistributionEnum, appExtensionInstallations, appGrantStatusEnum, appGrants, appInstallationRegistrationStatusEnum, appInstallationSettings, appInstallationStatusEnum, appInstallations, appInstallationUpdatePolicyEnum, appLifecycleStateEnum, appOAuthAuthorizationCodes, appOAuthRefreshTokens, appRedirectUris, appReleaseArtifactStateEnum, appReleaseArtifacts, appReleaseLocalizations, appReleaseStateEnum, appReleases, appSecretReferences, apps, appWebhookSubscriptionStatusEnum, appWebhookSubscriptions, } from "./schema.js";
+export { createAppsService } from "./service.js";
+export type { AppWebhookDeliveryOptions } from "./webhook-delivery.js";
+export { createAppWebhookDeliveryStore, createAppWebhookEventQueue, enqueueAppWebhookEvent, listAppWebhookHealth, replayAppWebhookDelivery, } from "./webhook-delivery.js";

package/dist/index.js

@@ -0,0 +1,12 @@
+export * from "./access-boundary.js";
+export * from "./compiler.js";
+export * from "./consent.js";
+export * from "./contracts.js";
+export * from "./ingestion.js";
+export * from "./installation-service.js";
+export * from "./oauth-crypto.js";
+export * from "./oauth-service.js";
+export { createAppsAdminRoutes } from "./routes.js";
+export { appAccessCredentialStatusEnum, appAccessCredentials, appAccessTokenModeEnum, appAuditEventKindEnum, appAuditEvents, appCredentialKindEnum, appCredentials, appDistributionEnum, appExtensionInstallations, appGrantStatusEnum, appGrants, appInstallationRegistrationStatusEnum, appInstallationSettings, appInstallationStatusEnum, appInstallations, appInstallationUpdatePolicyEnum, appLifecycleStateEnum, appOAuthAuthorizationCodes, appOAuthRefreshTokens, appRedirectUris, appReleaseArtifactStateEnum, appReleaseArtifacts, appReleaseLocalizations, appReleaseStateEnum, appReleases, appSecretReferences, apps, appWebhookSubscriptionStatusEnum, appWebhookSubscriptions, } from "./schema.js";
+export { createAppsService } from "./service.js";
+export { createAppWebhookDeliveryStore, createAppWebhookEventQueue, enqueueAppWebhookEvent, listAppWebhookHealth, replayAppWebhookDelivery, } from "./webhook-delivery.js";

package/dist/ingestion.d.ts

@@ -0,0 +1,15 @@
+export interface ManifestFetchOptions {
+    fetch?: typeof fetch;
+    maxBytes?: number;
+    maxRedirects?: number;
+    timeoutMs?: number;
+    allowedContentTypes?: readonly string[];
+    resolveHost?: (hostname: string) => Promise<readonly string[]>;
+}
+export interface FetchedManifest {
+    url: string;
+    contentType: string;
+    body: unknown;
+    bytes: number;
+}
+export declare function fetchProtectedManifest(inputUrl: string, options?: ManifestFetchOptions): Promise<FetchedManifest>;