- Remove ApplicationNpmClaimService, NpmClaimTokenDTO, NPM_CLAIM JWT type,
and all claim-related mutations/methods across server, SDK, and frontend
- Add provenanceRepositoryUrl, isProvenanceVerified, provenanceVerifiedAt
fields to ApplicationRegistrationEntity with core migration
- Create ApplicationNpmRegistrationService with email-based ownership
verification and lightweight npm provenance attestation fetching
- Add registerNpmPackage GraphQL mutation with workspace auth guards
- Enforce twenty-app- prefix for all npm package names in validation
and marketplace search filtering
- Create .github/actions/publish-twenty-app composite action for
building and publishing apps with --provenance
- Scaffold publish.yml GitHub workflow in create-twenty-app
- Add app:register CLI command and public operation in SDK
- Update frontend empty state to show app:register instructions
- Enrich MarketplaceCatalogSyncService to fetch and store provenance
metadata during npm app discovery
- Add unit tests for registration service and package name validation
Made-with: Cursor
Félix Malfait
d4ce4414e2