Variable: AppCatalogue

const AppCatalogue: z.ZodObject<{
  items: z.ZodArray<z.ZodObject<{
     installs: z.ZodArray<z.ZodObject<{
        aliases: z.ZodArray<z.ZodString>;
        appName: z.ZodString;
        autoUpgrade: z.ZodEnum<{
           compatible: "compatible";
           off: "off";
        }>;
        circuit: z.ZodObject<{
           defaults: z.ZodObject<..., ...>;
           failures: z.ZodNumber;
           settings: z.ZodObject<..., ...>;
           since: z.ZodNullable<...>;
           state: z.ZodEnum<...>;
        }, z.core.$strip>;
        config: z.ZodRecord<z.ZodString, z.ZodUnknown>;
        createdAt: z.ZodCoercedDate<unknown>;
        enabled: z.ZodBoolean;
        hosts: z.ZodArray<z.ZodString>;
        id: z.ZodGUID;
        missingSecrets: z.ZodArray<z.ZodString>;
        name: z.ZodString;
        pendingChange: z.ZodNullable<z.ZodObject<{
           approvalSettings: ...;
           comment: ...;
           config: ...;
           decidedAt: ...;
           decidedBy: ...;
           decision: ...;
           decisionComment: ...;
           enabled: ...;
           handlesAdded: ...;
           hosts: ...;
           hostsAdded: ...;
           id: ...;
           installId: ...;
           installName: ...;
           installUpdatedAt: ...;
           needsAdded: ...;
           newInstall: ...;
           origin: ...;
           requestedAt: ...;
           requestedBy: ...;
           tenantId: ...;
           versionId: ...;
        }, z.core.$strip>>;
        requiredSecrets: z.ZodArray<z.ZodString>;
        storedSecrets: z.ZodArray<z.ZodString>;
        tenantId: z.ZodGUID;
        updateAvailable: z.ZodBoolean;
        updatedAt: z.ZodCoercedDate<unknown>;
        upgrade: z.ZodNullable<z.ZodObject<{
           actions: ...;
           changeId: ...;
           handlesAdded: ...;
           hostsAdded: ...;
           issues: ...;
           missingSecrets: ...;
           needsAdded: ...;
           rollback: ...;
           target: ...;
           waitingFor: ...;
        }, z.core.$strip>>;
        upgradedFromVersionId: z.ZodNullable<z.ZodGUID>;
        version: z.ZodObject<{
           actions: z.ZodArray<...>;
           capabilities: z.ZodArray<...>;
           category: z.ZodOptional<...>;
           configSchema: z.ZodRecord<..., ...>;
           createdAt: z.ZodCoercedDate<...>;
           description: z.ZodOptional<...>;
           docsUrl: z.ZodOptional<...>;
           documentsFromConfig: z.ZodOptional<...>;
           handles: z.ZodObject<..., ...>;
           hosts: z.ZodArray<...>;
           hostsFromConfig: z.ZodArray<...>;
           id: z.ZodGUID;
           memoryMiB: z.ZodNumber;
           name: z.ZodString;
           needs: z.ZodArray<...>;
           platformSource: z.ZodNullable<...>;
           pricingNote: z.ZodOptional<...>;
           provenance: z.ZodNullable<...>;
           publishedAt: z.ZodNullable<...>;
           publisher: z.ZodEnum<...>;
           review: z.ZodNullable<...>;
           secrets: z.ZodArray<...>;
           secretsFromConfig: z.ZodOptional<...>;
           sha256: z.ZodString;
           sizeBytes: z.ZodNumber;
           status: z.ZodEnum<...>;
           title: z.ZodOptional<...>;
           vendor: z.ZodOptional<...>;
           version: z.ZodString;
        }, z.core.$strip>;
        versionId: z.ZodGUID;
        webhookUrl: z.ZodNullable<z.ZodURL>;
     }, z.core.$strip>>;
     latest: z.ZodObject<{
        actions: z.ZodArray<z.ZodObject<{
           callbackTimeoutSeconds: z.ZodOptional<...>;
           description: z.ZodOptional<...>;
           idempotent: z.ZodBoolean;
           inputSchema: z.ZodRecord<..., ...>;
           mappable: z.ZodOptional<...>;
           name: z.ZodString;
           outputFromInput: z.ZodOptional<...>;
           outputSchema: z.ZodRecord<..., ...>;
           retry: z.ZodOptional<...>;
           timeoutMs: z.ZodNumber;
        }, z.core.$strip>>;
        capabilities: z.ZodArray<z.ZodString>;
        category: z.ZodOptional<z.ZodString>;
        configSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
        createdAt: z.ZodCoercedDate<unknown>;
        description: z.ZodOptional<z.ZodString>;
        docsUrl: z.ZodOptional<z.ZodString>;
        documentsFromConfig: z.ZodOptional<z.ZodString>;
        handles: z.ZodObject<{
           handoff: z.ZodOptional<z.ZodBoolean>;
           webhook: z.ZodDefault<z.ZodBoolean>;
           webhookExternalId: z.ZodOptional<z.ZodUnion<...>>;
           webhookExternalIdFromConfig: z.ZodOptional<z.ZodString>;
        }, z.core.$strip>;
        hosts: z.ZodArray<z.ZodString>;
        hostsFromConfig: z.ZodArray<z.ZodString>;
        id: z.ZodGUID;
        memoryMiB: z.ZodNumber;
        name: z.ZodString;
        needs: z.ZodArray<z.ZodEnum<{
           documents: "documents";
        }>>;
        platformSource: z.ZodNullable<z.ZodEnum<{
           operator: "operator";
           release: "release";
        }>>;
        pricingNote: z.ZodOptional<z.ZodString>;
        provenance: z.ZodNullable<z.ZodObject<{
           kind: z.ZodEnum<...>;
           recordedBy: z.ZodString;
           signedAt: z.ZodNullable<...>;
           signer: z.ZodNullable<...>;
           source: z.ZodObject<..., ...>;
           transparencyLogIndex: z.ZodNullable<...>;
           trusted: z.ZodBoolean;
           trustedSigner: z.ZodNullable<...>;
           verifiedAt: z.ZodCoercedDate<...>;
        }, z.core.$strip>>;
        publishedAt: z.ZodNullable<z.ZodCoercedDate<unknown>>;
        publisher: z.ZodEnum<{
           platform: "platform";
           tenant: "tenant";
        }>;
        review: z.ZodNullable<z.ZodObject<{
           comment: z.ZodNullable<...>;
           decidedAt: z.ZodNullable<...>;
           decidedBy: z.ZodNullable<...>;
           id: z.ZodGUID;
           requestedAt: z.ZodCoercedDate<...>;
           requestedBy: z.ZodString;
           status: z.ZodEnum<...>;
           tenantId: z.ZodGUID;
           versionId: z.ZodGUID;
        }, z.core.$strip>>;
        secrets: z.ZodArray<z.ZodObject<{
           description: z.ZodOptional<...>;
           name: z.ZodString;
           requiredWhen: z.ZodOptional<...>;
        }, z.core.$strip>>;
        secretsFromConfig: z.ZodOptional<z.ZodString>;
        sha256: z.ZodString;
        sizeBytes: z.ZodNumber;
        status: z.ZodEnum<{
           published: "published";
           uploaded: "uploaded";
           withdrawn: "withdrawn";
        }>;
        title: z.ZodOptional<z.ZodString>;
        vendor: z.ZodOptional<z.ZodString>;
        version: z.ZodString;
     }, z.core.$strip>;
     name: z.ZodString;
     publisher: z.ZodEnum<{
        platform: "platform";
        tenant: "tenant";
     }>;
     versions: z.ZodNumber;
  }, z.core.$strip>>;
  signatures: z.ZodEnum<{
     off: "off";
     optional: "optional";
     required: "required";
  }>;
}, z.core.$strip>;

GET /apps: the catalogue, with the deployment's signature mode (APP_SIGNATURES), which says whether an upload is signed: off takes no provenance, optional verifies a bundle attached to it, required publishes and installs a tenant's version only once a signer the operator trusts signed it.