interface AppManifest {
  schemaVersion: '1.0'
  appId: string                    // 3-64 chars, ^[a-z][a-z0-9_.-]{2,63}$
  name: string                     // 1-64 chars
  description: string              // 1-200 chars
  longDescription?: string         // max 5000 chars, markdown
  version: string                  // semver
  developer: {
    name: string
    email: string
    url?: string
  }
  iconUrl?: string
  homepageUrl?: string
  privacyPolicyUrl?: string
  scopes: AppScope[]               // At least one required
  events?: AppEventType[]
  webhookUrl?: string              // Required if events is non-empty
  commands?: AppCommand[]
  uiSurfaces?: AppUISurface[]
  rateLimit?: AppRateLimitConfig
  redirectUrl?: string
  categories?: string[]
}

interface AppCommand {
  name: string           // ^[a-z][a-z0-9_-]{0,31}$
  description: string
  arguments?: AppCommandArgument[]
}

interface AppCommandArgument {
  name: string
  description: string
  type: 'string' | 'number' | 'boolean' | 'user' | 'channel'
  required?: boolean
  default?: string | number | boolean
}

interface RegisteredApp {
  id: string
  manifest: AppManifest
  status: 'pending_review' | 'approved' | 'rejected' | 'suspended'
  clientSecret: string
  registeredBy: string
  registeredAt: string
  updatedAt: string
  rejectionReason?: string
}

interface AppInstallation {
  id: string
  appId: string
  workspaceId: string
  grantedScopes: AppScope[]
  status: 'installed' | 'disabled' | 'uninstalled'
  installedBy: string
  installedAt: string
  updatedAt: string
}

interface AppToken {
  id: string
  token: string
  type: 'access_token' | 'refresh_token'
  appId: string
  installationId: string
  scopes: AppScope[]
  expiresAt: string
  issuedAt: string
  revoked: boolean
  revokedAt?: string
}

interface AppEventPayload {
  deliveryId: string
  event: AppEventType
  timestamp: string
  appId: string
  installationId: string
  data: Record<string, unknown>
}

interface AppSandboxContext {
  appId: string
  installationId: string
  workspaceId: string
  scopes: AppScope[]
  rateLimitRemaining: number
  rateLimitReset: string
}

interface TokenConfig {
  accessTokenTTL: number   // Default: 3600 (1 hour)
  refreshTokenTTL: number  // Default: 2592000 (30 days)
}

interface EventDeliveryConfig {
  maxRetries: number            // Default: 5
  initialRetryDelayMs: number   // Default: 1000
  maxRetryDelayMs: number       // Default: 300000 (5 min)
  backoffMultiplier: number     // Default: 2
  deliveryTimeoutMs: number     // Default: 30000 (30 sec)
}

interface AppRateLimitResult {
  allowed: boolean
  remaining: number
  limit: number
  reset: number       // Unix timestamp in seconds
  retryAfter: number  // Seconds to wait (0 if allowed)
}

interface AppRateLimitConfig {
  requestsPerMinute: number
  burstAllowance?: number
  scopeOverrides?: Record<string, { requestsPerMinute: number }>
}

// Default: 60 req/min, 10 burst
const DEFAULT_APP_RATE_LIMIT: AppRateLimitConfig = {
  requestsPerMinute: 60,
  burstAllowance: 10,
}