aimeat 1.26.0 → 1.27.0

package/dist/src/generated/api-types.d.ts

@@ -617,6 +617,137 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/app-grants/authorize": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Start an app-grant authorization (OAuth-like, PKCE)
+         * @description Entry point of the H-2 app-grant flow. A user-published app (running on the isolated
+         *     app origin `*.apps.<apex>`) sends the owner's browser here to request scoped access to
+         *     the owner's data. On valid params the node stores a short-lived pending request and
+         *     **302-redirects** to the trusted apex consent page (`/v1/app-grant?req=...`) where the
+         *     owner approves. `code_challenge_method` must be `S256`; `redirect_uri` must be on the
+         *     app origin (never the apex); `scope` must be drawn from the grantable scope set.
+         */
+        get: operations["appGrantAuthorize"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/app-grants/request/{requestId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Read a pending app-grant request (for the consent page)
+         * @description Returns the requesting app and the exact scopes (with descriptions) for the consent UI to render. Unguessable id; no auth.
+         */
+        get: operations["appGrantRequest"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/app-grants/authorize-consent": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Approve an app-grant request (owner)
+         * @description The owner, authenticated on the apex SPA, approves a pending request. The node mints a
+         *     single-use authorization code and returns the app's `redirect_url` (carrying the code +
+         *     state) for the browser to navigate back to the app.
+         */
+        post: operations["appGrantConsent"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/app-grants/token": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Exchange an app-grant code or refresh token for a scoped app token
+         * @description Called by the app from its own origin (CORS `*`). With `grant_type=authorization_code`
+         *     (+ PKCE `code_verifier`) the node creates the persistent grant and returns a short-lived
+         *     **scoped** access JWT (role `app`, the granted scopes, an `app_grant` claim) + a rotating
+         *     refresh token — never the owner's session. With `grant_type=refresh_token` it rotates the
+         *     refresh token and re-mints the access JWT. A revoked grant yields `401`.
+         */
+        post: operations["appGrantToken"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/app-grants": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the apps the owner has granted access to
+         * @description Returns active (non-revoked) app grants with their scopes, origin, and last-used time.
+         */
+        get: operations["listAppGrants"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/app-grants/{grantId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Revoke an app's grant
+         * @description Marks the grant revoked and drops its refresh token — the app can no longer refresh (its short access token expires shortly after).
+         */
+        delete: operations["revokeAppGrant"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/auth/token/exchange": {
         parameters: {
             query?: never;
@@ -3797,6 +3928,62 @@ export interface paths {
         patch: operations["updateSubdomainSite"];
         trace?: never;
     };
+    "/v1/apps/{owner}/{filename}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Download or render a published app
+         * @description Returns the app's HTML. Default (no `mode`) responds with `Content-Disposition: attachment`
+         *     (programmatic download — never executed as a page). `mode=inline` returns runnable HTML.
+         *
+         *     **H-2 app origin:** when the app origin is provisioned (`AIMEAT_APP_ORIGIN_ENABLED`), an
+         *     `mode=inline` request arriving on the **apex** origin is **301-redirected** to the isolated
+         *     app origin (`https://<sub>.apps.<apex>/` or `https://apps.<apex>/<owner>/<file>`), so runnable
+         *     app HTML is never served same-origin as the authenticated SPA. Access-code/paid apps and the
+         *     raw download form are unaffected.
+         */
+        get: operations["getAppFile"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/apps/{owner}/{filename}/screenshot": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Owner name (bare handle; a legacy owner@node segment is tolerated). */
+                owner: string;
+                /** @description App filename. */
+                filename: string;
+            };
+            cookie?: never;
+        };
+        /**
+         * Serve an app's screenshot image
+         * @description Returns the stored screenshot for the app, or 404 if none. No auth.
+         */
+        get: operations["getAppScreenshot"];
+        put?: never;
+        /**
+         * Set or replace an app's screenshot without re-publishing
+         * @description Stores a base64-encoded image as the app's screenshot. The app's owner may set their own; a node operator may set any app's, so the screenshot worker can backfill defaults for apps that have none. Idempotent (overwrites any existing screenshot). Max 2 MB.
+         */
+        post: operations["setAppScreenshot"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/apps/backup": {
         parameters: {
             query?: never;
@@ -4514,6 +4701,53 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/ghii/login/google": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Begin Google sign-in (social login)
+         * @description Starts the Google OIDC sign-in flow and redirects the browser to Google's
+         *     consent screen. Available only when the node has Google sign-in configured
+         *     (`AIMEAT_GOOGLE_OAUTH_ENABLED=true` + client credentials); otherwise returns 503.
+         *     This is a browser-navigation endpoint, not an API call.
+         */
+        get: operations["ghiiLoginGoogleStart"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/ghii/login/google/callback": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Google sign-in OIDC redirect callback
+         * @description Google redirects the browser here with `code` and `state` after consent. The node
+         *     exchanges the code, maps the Google identity to a GHII (linking to an existing account
+         *     when Google's verified email matches a locally-verified account, otherwise creating a
+         *     new account), establishes an owner session (httpOnly refresh cookie + access token),
+         *     and redirects back to the SPA. On any failure it redirects to `/?auth_error=<CODE>`.
+         */
+        get: operations["ghiiLoginGoogleCallback"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/catalogue/directory": {
         parameters: {
             query?: never;
@@ -14118,6 +14352,123 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    appGrantAuthorize: {
+        parameters: {
+            query: {
+                /** @description "owner/filename" */
+                app: string;
+                response_type: "code";
+                redirect_uri: string;
+                /** @description Space/comma-separated grantable scopes */
+                scope: string;
+                state?: string;
+                code_challenge: string;
+                code_challenge_method: "S256";
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Redirect to the apex consent page */
+            302: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            400: components["responses"]["BadRequest"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    appGrantRequest: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                requestId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    appGrantConsent: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    request_id: string;
+                };
+            };
+        };
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            401: components["responses"]["Unauthorized"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    appGrantToken: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @enum {string} */
+                    grant_type: "authorization_code" | "refresh_token";
+                    code?: string;
+                    code_verifier?: string;
+                    redirect_uri?: string;
+                    refresh_token?: string;
+                };
+            };
+        };
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+        };
+    };
+    listAppGrants: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+        };
+    };
+    revokeAppGrant: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                grantId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: components["responses"]["AimeatSuccess"];
+            404: components["responses"]["NotFound"];
+        };
+    };
     exchangeAccessToken: {
         parameters: {
             query?: never;
@@ -19150,6 +19501,113 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    getAppFile: {
+        parameters: {
+            query?: {
+                mode?: "inline";
+                version?: number;
+                /** @description Access code for protected apps */
+                code?: string;
+            };
+            header?: never;
+            path: {
+                owner: string;
+                filename: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description App HTML (inline or attachment) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Redirect to the isolated app origin (H-2 */
+            301: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    getAppScreenshot: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Owner name (bare handle; a legacy owner@node segment is tolerated). */
+                owner: string;
+                /** @description App filename. */
+                filename: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Screenshot image bytes */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "image/png": string;
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    setAppScreenshot: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Owner name (bare handle; a legacy owner@node segment is tolerated). */
+                owner: string;
+                /** @description App filename. */
+                filename: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Base64-encoded image data (PNG or JPEG). */
+                    screenshot: string;
+                    /** @default image/png */
+                    screenshot_mime_type?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Screenshot stored */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": Record<string, never>;
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            /** @description Screenshot exceeds the 2 MB limit */
+            413: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     exportAppsBackup: {
         parameters: {
             query?: never;
@@ -20555,6 +21013,77 @@ export interface operations {
             429: components["responses"]["RateLimited"];
         };
     };
+    ghiiLoginGoogleStart: {
+        parameters: {
+            query?: {
+                /**
+                 * @description Same-site absolute path to return to after a successful login (must start
+                 *     with `/`). Defaults to `/`. Other values are ignored for safety.
+                 */
+                redirect?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Redirect to the Google authorization endpoint */
+            302: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Google sign-in is not available on this node */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"] & {
+                        error?: {
+                            /** @example FEATURE_DISABLED */
+                            code?: unknown;
+                        };
+                    };
+                };
+            };
+        };
+    };
+    ghiiLoginGoogleCallback: {
+        parameters: {
+            query: {
+                /** @description Authorization code from Google */
+                code: string;
+                /** @description Opaque state value issued at the start of the flow */
+                state: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /**
+             * @description Redirect back to the SPA on success (refresh cookie set), or to
+             *     `/?auth_error=<CODE>` on failure.
+             */
+            302: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Google sign-in is not available on this node */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     searchDirectory: {
         parameters: {
             query?: {