@voyant-travel/apps 0.1.0

package/dist/schema.js

@@ -0,0 +1,342 @@
+import { typeId } from "@voyant-travel/db/lib/typeid-column";
+import { sql } from "drizzle-orm";
+import { boolean, check, index, integer, jsonb, pgEnum, pgTable, text, timestamp, uniqueIndex, } from "drizzle-orm/pg-core";
+export const appDistributionEnum = pgEnum("app_distribution", ["custom", "marketplace"]);
+export const appLifecycleStateEnum = pgEnum("app_lifecycle_state", [
+    "active",
+    "suspended",
+    "deleted",
+]);
+export const appCredentialKindEnum = pgEnum("app_credential_kind", ["client_secret", "signing_key"]);
+export const appReleaseStateEnum = pgEnum("app_release_state", ["available", "suspended", "yanked"]);
+export const appReleaseArtifactStateEnum = pgEnum("app_release_artifact_state", [
+    "available",
+    "unavailable",
+]);
+export const appInstallationStatusEnum = pgEnum("app_installation_status", [
+    "pending",
+    "authorizing",
+    "active",
+    "paused",
+    "degraded",
+    "revoked",
+    "uninstalled",
+]);
+export const appInstallationUpdatePolicyEnum = pgEnum("app_installation_update_policy", [
+    "manual",
+    "compatible",
+    "patch",
+    "pinned",
+]);
+export const appGrantStatusEnum = pgEnum("app_grant_status", [
+    "requested",
+    "granted",
+    "optional",
+    "revoked",
+]);
+export const appAccessCredentialStatusEnum = pgEnum("app_access_credential_status", [
+    "active",
+    "inactive",
+    "revoked",
+]);
+export const appAccessTokenModeEnum = pgEnum("app_access_token_mode", ["offline", "online"]);
+export const appInstallationRegistrationStatusEnum = pgEnum("app_installation_registration_status", ["active", "inactive"]);
+export const appWebhookSubscriptionStatusEnum = pgEnum("app_webhook_subscription_status", [
+    "active",
+    "inactive",
+    "failed",
+]);
+export const appAuditEventKindEnum = pgEnum("app_audit_event_kind", [
+    "lifecycle",
+    "grant",
+    "consent",
+    "credential",
+    "token",
+    "reconciliation",
+    "purge",
+]);
+export const apps = pgTable("apps", {
+    id: typeId("apps"),
+    platformNamespace: text("platform_namespace").notNull(),
+    distribution: appDistributionEnum("distribution").notNull(),
+    ownerId: text("owner_id").notNull(),
+    displayName: text("display_name").notNull(),
+    slug: text("slug").notNull(),
+    lifecycleState: appLifecycleStateEnum("lifecycle_state").notNull().default("active"),
+    createdBy: text("created_by").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+}, (table) => [
+    uniqueIndex("uidx_apps_platform_namespace").on(table.platformNamespace),
+    index("idx_apps_owner").on(table.ownerId, table.distribution, table.lifecycleState),
+    // agent-quality: raw-sql reviewed -- owner: apps; identifier is a Drizzle-owned column and the literal prefix is static.
+    check("apps_platform_namespace_reserved", sql `${table.platformNamespace} LIKE 'app--%'`),
+]);
+export const appRedirectUris = pgTable("app_redirect_uris", {
+    id: typeId("app_redirect_uris"),
+    appId: text("app_id")
+        .notNull()
+        .references(() => apps.id, { onDelete: "cascade" }),
+    redirectUri: text("redirect_uri").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+}, (table) => [
+    index("idx_app_redirect_uris_app").on(table.appId),
+    uniqueIndex("uidx_app_redirect_uris_exact").on(table.appId, table.redirectUri),
+]);
+export const appCredentials = pgTable("app_credentials", {
+    id: typeId("app_credentials"),
+    appId: text("app_id")
+        .notNull()
+        .references(() => apps.id, { onDelete: "cascade" }),
+    kind: appCredentialKindEnum("kind").notNull(),
+    generation: integer("generation").notNull(),
+    kmsKeyRef: text("kms_key_ref").notNull(),
+    publicKeyRef: text("public_key_ref"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    retiredAt: timestamp("retired_at", { withTimezone: true }),
+}, (table) => [
+    index("idx_app_credentials_app").on(table.appId, table.kind),
+    uniqueIndex("uidx_app_credentials_generation").on(table.appId, table.kind, table.generation),
+]);
+export const appReleases = pgTable("app_releases", {
+    id: typeId("app_releases"),
+    appId: text("app_id")
+        .notNull()
+        .references(() => apps.id, { onDelete: "cascade" }),
+    releaseVersion: text("release_version").notNull(),
+    manifestSchemaVersion: text("manifest_schema_version").notNull(),
+    manifestDigest: text("manifest_digest").notNull(),
+    manifestSnapshot: jsonb("manifest_snapshot").$type().notNull(),
+    normalizedRecord: jsonb("normalized_record").$type().notNull(),
+    apiCompatibility: jsonb("api_compatibility").$type().notNull(),
+    defaultLocale: text("default_locale").notNull(),
+    supportedLocales: jsonb("supported_locales").$type().notNull(),
+    state: appReleaseStateEnum("state").notNull().default("available"),
+    createdBy: text("created_by").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+}, (table) => [
+    index("idx_app_releases_app").on(table.appId, table.createdAt),
+    uniqueIndex("uidx_app_releases_digest").on(table.appId, table.manifestDigest),
+    uniqueIndex("uidx_app_releases_version").on(table.appId, table.releaseVersion),
+]);
+export const appReleaseArtifacts = pgTable("app_release_artifacts", {
+    id: typeId("app_release_artifacts"),
+    releaseId: text("release_id")
+        .notNull()
+        .references(() => appReleases.id, { onDelete: "cascade" }),
+    digest: text("digest").notNull(),
+    signature: text("signature"),
+    provenance: jsonb("provenance").$type().notNull(),
+    registryCoordinates: jsonb("registry_coordinates").$type(),
+    assetInventory: jsonb("asset_inventory").$type().notNull(),
+    state: appReleaseArtifactStateEnum("state").notNull().default("available"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+}, (table) => [
+    index("idx_app_release_artifacts_release").on(table.releaseId),
+    uniqueIndex("uidx_app_release_artifacts_digest").on(table.releaseId, table.digest),
+]);
+export const appReleaseLocalizations = pgTable("app_release_localizations", {
+    id: typeId("app_release_localizations"),
+    releaseId: text("release_id")
+        .notNull()
+        .references(() => appReleases.id, { onDelete: "cascade" }),
+    locale: text("locale").notNull(),
+    surface: text("surface").notNull(),
+    messageKey: text("message_key").notNull(),
+    text: text("text").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+}, (table) => [
+    index("idx_app_release_localizations_release").on(table.releaseId, table.locale),
+    uniqueIndex("uidx_app_release_localizations_key").on(table.releaseId, table.locale, table.surface, table.messageKey),
+]);
+export const appInstallations = pgTable("app_installations", {
+    id: typeId("app_installations"),
+    appId: text("app_id")
+        .notNull()
+        .references(() => apps.id, { onDelete: "cascade" }),
+    deploymentId: text("deployment_id").notNull(),
+    releaseId: text("release_id")
+        .notNull()
+        .references(() => appReleases.id, { onDelete: "restrict" }),
+    status: appInstallationStatusEnum("status").notNull().default("pending"),
+    namespace: text("namespace").notNull(),
+    installedBy: text("installed_by").notNull(),
+    credentialGeneration: integer("credential_generation").notNull().default(0),
+    updatePolicy: appInstallationUpdatePolicyEnum("update_policy").notNull().default("compatible"),
+    lastCompatibleReleaseCheckAt: timestamp("last_compatible_release_check_at", {
+        withTimezone: true,
+    }),
+    pendingReleaseId: text("pending_release_id"),
+    pendingReason: text("pending_reason"),
+    installedAt: timestamp("installed_at", { withTimezone: true }).notNull().defaultNow(),
+    authorizedAt: timestamp("authorized_at", { withTimezone: true }),
+    activatedAt: timestamp("activated_at", { withTimezone: true }),
+    pausedAt: timestamp("paused_at", { withTimezone: true }),
+    degradedAt: timestamp("degraded_at", { withTimezone: true }),
+    revokedAt: timestamp("revoked_at", { withTimezone: true }),
+    uninstalledAt: timestamp("uninstalled_at", { withTimezone: true }),
+    purgedAt: timestamp("purged_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+}, (table) => [
+    index("idx_app_installations_app").on(table.appId, table.status),
+    index("idx_app_installations_deployment").on(table.deploymentId, table.status),
+    uniqueIndex("uidx_app_installations_deployment_app").on(table.deploymentId, table.appId),
+    // agent-quality: raw-sql reviewed -- owner: apps; identifier is a Drizzle-owned column and the literal prefix is static.
+    check("app_installations_namespace_reserved", sql `${table.namespace} LIKE 'app--%'`),
+]);
+export const appGrants = pgTable("app_grants", {
+    id: typeId("app_grants"),
+    installationId: text("installation_id")
+        .notNull()
+        .references(() => appInstallations.id, { onDelete: "cascade" }),
+    scope: text("scope").notNull(),
+    status: appGrantStatusEnum("status").notNull(),
+    optional: boolean("optional").notNull().default(false),
+    requestedAt: timestamp("requested_at", { withTimezone: true }).notNull().defaultNow(),
+    grantedAt: timestamp("granted_at", { withTimezone: true }),
+    revokedAt: timestamp("revoked_at", { withTimezone: true }),
+}, (table) => [
+    index("idx_app_grants_installation").on(table.installationId, table.status),
+    uniqueIndex("uidx_app_grants_scope").on(table.installationId, table.scope),
+]);
+export const appAccessCredentials = pgTable("app_access_credentials", {
+    id: typeId("app_access_credentials"),
+    installationId: text("installation_id")
+        .notNull()
+        .references(() => appInstallations.id, { onDelete: "cascade" }),
+    generation: integer("generation").notNull(),
+    tokenMode: appAccessTokenModeEnum("token_mode").notNull().default("offline"),
+    credentialHash: text("credential_hash").notNull(),
+    encryptedMetadata: jsonb("encrypted_metadata").$type().notNull(),
+    status: appAccessCredentialStatusEnum("status").notNull().default("active"),
+    actorId: text("actor_id"),
+    viewerId: text("viewer_id"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }),
+    deactivatedAt: timestamp("deactivated_at", { withTimezone: true }),
+}, (table) => [
+    index("idx_app_access_credentials_installation").on(table.installationId, table.status),
+    index("idx_app_access_credentials_generation").on(table.installationId, table.tokenMode, table.generation),
+]);
+export const appOAuthAuthorizationCodes = pgTable("app_oauth_authorization_codes", {
+    id: typeId("app_oauth_authorization_codes"),
+    appId: text("app_id")
+        .notNull()
+        .references(() => apps.id, { onDelete: "cascade" }),
+    installationId: text("installation_id")
+        .notNull()
+        .references(() => appInstallations.id, { onDelete: "cascade" }),
+    releaseId: text("release_id")
+        .notNull()
+        .references(() => appReleases.id, { onDelete: "cascade" }),
+    deploymentId: text("deployment_id").notNull(),
+    codeHash: text("code_hash").notNull(),
+    stateHash: text("state_hash").notNull(),
+    redirectUri: text("redirect_uri").notNull(),
+    codeChallenge: text("code_challenge").notNull(),
+    codeChallengeMethod: text("code_challenge_method").notNull(),
+    requestedScopes: jsonb("requested_scopes").$type().notNull(),
+    grantedScopes: jsonb("granted_scopes").$type().notNull(),
+    deniedOptionalScopes: jsonb("denied_optional_scopes").$type().notNull(),
+    actorId: text("actor_id").notNull(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    consumedAt: timestamp("consumed_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+}, (table) => [
+    uniqueIndex("uidx_app_oauth_codes_hash").on(table.codeHash),
+    index("idx_app_oauth_codes_installation").on(table.installationId, table.expiresAt),
+]);
+export const appOAuthRefreshTokens = pgTable("app_oauth_refresh_tokens", {
+    id: typeId("app_oauth_refresh_tokens"),
+    installationId: text("installation_id")
+        .notNull()
+        .references(() => appInstallations.id, { onDelete: "cascade" }),
+    tokenHash: text("token_hash").notNull(),
+    generation: integer("generation").notNull(),
+    status: appAccessCredentialStatusEnum("status").notNull().default("active"),
+    rotatedFromId: text("rotated_from_id"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }),
+    revokedAt: timestamp("revoked_at", { withTimezone: true }),
+}, (table) => [
+    uniqueIndex("uidx_app_oauth_refresh_tokens_hash").on(table.tokenHash),
+    index("idx_app_oauth_refresh_tokens_installation").on(table.installationId, table.status),
+]);
+export const appInstallationSettings = pgTable("app_installation_settings", {
+    id: typeId("app_installation_settings"),
+    installationId: text("installation_id")
+        .notNull()
+        .references(() => appInstallations.id, { onDelete: "cascade" }),
+    settings: jsonb("settings").$type().notNull(),
+    schemaDigest: text("schema_digest").notNull(),
+    updatedBy: text("updated_by").notNull(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+}, (table) => [uniqueIndex("uidx_app_installation_settings_installation").on(table.installationId)]);
+export const appSecretReferences = pgTable("app_secret_references", {
+    id: typeId("app_secret_references"),
+    installationId: text("installation_id")
+        .notNull()
+        .references(() => appInstallations.id, { onDelete: "cascade" }),
+    key: text("key").notNull(),
+    secretRef: text("secret_ref").notNull(),
+    createdBy: text("created_by").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    revokedAt: timestamp("revoked_at", { withTimezone: true }),
+}, (table) => [uniqueIndex("uidx_app_secret_references_key").on(table.installationId, table.key)]);
+export const appExtensionInstallations = pgTable("app_extension_installations", {
+    id: typeId("app_extension_installations"),
+    installationId: text("installation_id")
+        .notNull()
+        .references(() => appInstallations.id, { onDelete: "cascade" }),
+    releaseId: text("release_id")
+        .notNull()
+        .references(() => appReleases.id, { onDelete: "cascade" }),
+    extensionKey: text("extension_key").notNull(),
+    descriptor: jsonb("descriptor").$type().notNull(),
+    status: appInstallationRegistrationStatusEnum("status").notNull().default("active"),
+    installedAt: timestamp("installed_at", { withTimezone: true }).notNull().defaultNow(),
+    deactivatedAt: timestamp("deactivated_at", { withTimezone: true }),
+}, (table) => [
+    index("idx_app_extension_installations_installation").on(table.installationId, table.status),
+    uniqueIndex("uidx_app_extension_installations_key").on(table.installationId, table.extensionKey),
+]);
+export const appWebhookSubscriptions = pgTable("app_webhook_subscriptions", {
+    id: typeId("app_webhook_subscriptions"),
+    installationId: text("installation_id")
+        .notNull()
+        .references(() => appInstallations.id, { onDelete: "cascade" }),
+    releaseId: text("release_id")
+        .notNull()
+        .references(() => appReleases.id, { onDelete: "cascade" }),
+    eventType: text("event_type").notNull(),
+    eventVersion: text("event_version").notNull(),
+    endpointUrl: text("endpoint_url").notNull(),
+    status: appWebhookSubscriptionStatusEnum("status").notNull().default("active"),
+    externalSubscriptionId: text("external_subscription_id"),
+    signingKeyId: text("signing_key_id"),
+    lastDeliveryAt: timestamp("last_delivery_at", { withTimezone: true }),
+    failureCount: integer("failure_count").notNull().default(0),
+    pausedAt: timestamp("paused_at", { withTimezone: true }),
+    installedAt: timestamp("installed_at", { withTimezone: true }).notNull().defaultNow(),
+    deactivatedAt: timestamp("deactivated_at", { withTimezone: true }),
+}, (table) => [
+    index("idx_app_webhook_subscriptions_installation").on(table.installationId, table.status),
+    uniqueIndex("uidx_app_webhook_subscriptions_event").on(table.installationId, table.eventType, table.eventVersion, table.endpointUrl),
+]);
+export const appAuditEvents = pgTable("app_audit_events", {
+    id: typeId("app_audit_events"),
+    installationId: text("installation_id").references(() => appInstallations.id, {
+        onDelete: "set null",
+    }),
+    appId: text("app_id").notNull(),
+    deploymentId: text("deployment_id").notNull(),
+    actorId: text("actor_id").notNull(),
+    kind: appAuditEventKindEnum("kind").notNull(),
+    action: text("action").notNull(),
+    details: jsonb("details").$type().notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+}, (table) => [
+    index("idx_app_audit_events_installation").on(table.installationId, table.createdAt),
+    index("idx_app_audit_events_app").on(table.appId, table.deploymentId, table.createdAt),
+]);

package/dist/service.d.ts

@@ -0,0 +1,95 @@
+import type { PostgresJsDatabase } from "drizzle-orm/postgres-js";
+import { type CompileAppManifestOptions } from "./compiler.js";
+import type { AppListQuery, CreateCustomAppRegistrationInput, ReleaseManifestFetchInput, ReleaseManifestUploadInput } from "./contracts.js";
+import { type ManifestFetchOptions } from "./ingestion.js";
+export interface AppsServiceOptions extends CompileAppManifestOptions {
+    fetch?: ManifestFetchOptions["fetch"];
+    resolveHost?: ManifestFetchOptions["resolveHost"];
+}
+export declare function createAppsService(options?: AppsServiceOptions): {
+    createCustomApp: (db: PostgresJsDatabase, input: CreateCustomAppRegistrationInput) => Promise<{
+        id: string;
+        platformNamespace: string;
+        distribution: "custom" | "marketplace";
+        ownerId: string;
+        displayName: string;
+        slug: string;
+        lifecycleState: "active" | "suspended" | "deleted";
+        createdBy: string;
+        createdAt: Date;
+        updatedAt: Date;
+    }>;
+    list: (db: PostgresJsDatabase, query: AppListQuery) => Promise<{
+        data: {
+            id: string;
+            platformNamespace: string;
+            distribution: "custom" | "marketplace";
+            ownerId: string;
+            displayName: string;
+            slug: string;
+            lifecycleState: "active" | "suspended" | "deleted";
+            createdBy: string;
+            createdAt: Date;
+            updatedAt: Date;
+        }[];
+        total: number;
+        limit: number;
+        offset: number;
+    }>;
+    get: (db: PostgresJsDatabase, appId: string) => Promise<{
+        id: string;
+        platformNamespace: string;
+        distribution: "custom" | "marketplace";
+        ownerId: string;
+        displayName: string;
+        slug: string;
+        lifecycleState: "active" | "suspended" | "deleted";
+        createdBy: string;
+        createdAt: Date;
+        updatedAt: Date;
+    } | null>;
+    releaseFromUpload: (db: PostgresJsDatabase, appId: string, input: ReleaseManifestUploadInput) => Promise<{
+        release: {
+            appId: string;
+            id: string;
+            createdBy: string;
+            createdAt: Date;
+            releaseVersion: string;
+            manifestSchemaVersion: string;
+            manifestDigest: string;
+            manifestSnapshot: Record<string, unknown>;
+            normalizedRecord: Record<string, unknown>;
+            apiCompatibility: {
+                min: string;
+                max: string;
+            };
+            defaultLocale: string;
+            supportedLocales: string[];
+            state: "suspended" | "available" | "yanked";
+        };
+        created: boolean;
+        digest: string;
+    }>;
+    releaseFromFetch: (db: PostgresJsDatabase, appId: string, input: ReleaseManifestFetchInput) => Promise<{
+        release: {
+            appId: string;
+            id: string;
+            createdBy: string;
+            createdAt: Date;
+            releaseVersion: string;
+            manifestSchemaVersion: string;
+            manifestDigest: string;
+            manifestSnapshot: Record<string, unknown>;
+            normalizedRecord: Record<string, unknown>;
+            apiCompatibility: {
+                min: string;
+                max: string;
+            };
+            defaultLocale: string;
+            supportedLocales: string[];
+            state: "suspended" | "available" | "yanked";
+        };
+        created: boolean;
+        digest: string;
+    }>;
+};

package/dist/service.js

@@ -0,0 +1,172 @@
+import { randomBytes } from "node:crypto";
+import { ApiHttpError } from "@voyant-travel/hono";
+import { and, eq, sql } from "drizzle-orm";
+import { compileAppManifest } from "./compiler.js";
+import { fetchProtectedManifest } from "./ingestion.js";
+import { appRedirectUris, appReleaseArtifacts, appReleaseLocalizations, appReleases, apps, } from "./schema.js";
+export function createAppsService(options = {}) {
+    async function createCustomApp(db, input) {
+        return db.transaction(async (tx) => {
+            const app = await insertRegistrationWithNamespace(tx, input);
+            if (input.redirectUris.length > 0) {
+                await tx
+                    .insert(appRedirectUris)
+                    .values(input.redirectUris.map((redirectUri) => ({
+                    appId: app.id,
+                    redirectUri,
+                })))
+                    .returning({ id: appRedirectUris.id });
+            }
+            return app;
+        });
+    }
+    async function list(db, query) {
+        const where = and(query.ownerId ? eq(apps.ownerId, query.ownerId) : undefined, query.distribution ? eq(apps.distribution, query.distribution) : undefined);
+        const [data, count] = await Promise.all([
+            db
+                .select()
+                .from(apps)
+                .where(where)
+                .limit(query.limit)
+                .offset(query.offset)
+                .orderBy(apps.createdAt),
+            db.select({ count: sql `count(*)::int` }).from(apps).where(where),
+        ]);
+        return { data, total: count[0]?.count ?? 0, limit: query.limit, offset: query.offset };
+    }
+    async function get(db, appId) {
+        const [row] = await db.select().from(apps).where(eq(apps.id, appId)).limit(1);
+        return row ?? null;
+    }
+    async function releaseFromUpload(db, appId, input) {
+        const compiled = compileAppManifest(input.manifest, options);
+        return createRelease(db, appId, {
+            createdBy: input.createdBy,
+            compiled,
+            artifactProvenance: input.provenance,
+        });
+    }
+    async function releaseFromFetch(db, appId, input) {
+        const fetched = await fetchProtectedManifest(input.manifestUrl, {
+            fetch: options.fetch,
+            resolveHost: options.resolveHost,
+        });
+        const compiled = compileAppManifest(fetched.body, options);
+        return createRelease(db, appId, {
+            createdBy: input.createdBy,
+            compiled,
+            artifactProvenance: {
+                source: "https-manifest",
+                url: fetched.url,
+                contentType: fetched.contentType,
+                bytes: fetched.bytes,
+            },
+        });
+    }
+    return { createCustomApp, list, get, releaseFromUpload, releaseFromFetch };
+}
+async function insertRegistrationWithNamespace(db, input) {
+    for (let attempt = 0; attempt < 8; attempt += 1) {
+        const [row] = await db
+            .insert(apps)
+            .values({
+            ownerId: input.ownerId,
+            displayName: input.displayName,
+            slug: input.slug,
+            createdBy: input.createdBy,
+            distribution: "custom",
+            platformNamespace: `app--${randomBytes(10).toString("hex")}`,
+        })
+            .onConflictDoNothing({ target: apps.platformNamespace })
+            .returning();
+        if (row)
+            return row;
+    }
+    throw new ApiHttpError("Could not assign a unique app namespace", {
+        status: 500,
+        code: "app_namespace_assignment_failed",
+    });
+}
+async function createRelease(db, appId, input) {
+    return db.transaction(async (tx) => {
+        const existingApp = await selectAppForUpdate(tx, appId);
+        if (!existingApp) {
+            throw new ApiHttpError("App registration not found", { status: 404, code: "app_not_found" });
+        }
+        const releaseVersion = input.compiled.manifest.releaseVersion;
+        const versionRow = await selectReleaseByVersion(tx, appId, releaseVersion);
+        if (versionRow &&
+            versionRow.releaseVersion === releaseVersion &&
+            versionRow.manifestDigest !== input.compiled.digest) {
+            throw new ApiHttpError(`Release version ${releaseVersion} already exists with different content; releases are immutable, publish a new version instead`, { status: 409, code: "app_release_version_conflict" });
+        }
+        const manifestSnapshot = JSON.parse(input.compiled.canonicalJson);
+        const normalizedRecord = JSON.parse(JSON.stringify(input.compiled.normalizedRelease));
+        const [created] = await tx
+            .insert(appReleases)
+            .values({
+            appId,
+            releaseVersion: input.compiled.manifest.releaseVersion,
+            manifestSchemaVersion: input.compiled.manifest.schemaVersion,
+            manifestDigest: input.compiled.digest,
+            manifestSnapshot,
+            normalizedRecord,
+            apiCompatibility: input.compiled.manifest.apiCompatibility,
+            defaultLocale: input.compiled.manifest.locales.default,
+            supportedLocales: [...input.compiled.normalizedRelease.supportedLocales],
+            createdBy: input.createdBy,
+        })
+            .onConflictDoNothing({ target: [appReleases.appId, appReleases.manifestDigest] })
+            .returning();
+        const release = created ?? (await selectReleaseByDigest(tx, appId, input.compiled.digest));
+        if (!release) {
+            throw new ApiHttpError("Could not resolve app release", {
+                status: 500,
+                code: "app_release_create_failed",
+            });
+        }
+        if (created) {
+            await tx
+                .insert(appReleaseArtifacts)
+                .values({
+                releaseId: created.id,
+                digest: input.compiled.digest,
+                signature: null,
+                provenance: input.artifactProvenance,
+                registryCoordinates: null,
+                assetInventory: { files: [] },
+            })
+                .returning({ id: appReleaseArtifacts.id });
+            if (input.compiled.normalizedRelease.localizations.length > 0) {
+                await tx
+                    .insert(appReleaseLocalizations)
+                    .values(input.compiled.normalizedRelease.localizations.map((localization) => ({
+                    releaseId: created.id,
+                    ...localization,
+                })))
+                    .returning({ id: appReleaseLocalizations.id });
+            }
+        }
+        return { release, created: Boolean(created), digest: input.compiled.digest };
+    });
+}
+async function selectAppForUpdate(db, appId) {
+    const [row] = await db.select().from(apps).where(eq(apps.id, appId)).for("update").limit(1);
+    return row ?? null;
+}
+async function selectReleaseByVersion(db, appId, version) {
+    const [row] = await db
+        .select()
+        .from(appReleases)
+        .where(and(eq(appReleases.appId, appId), eq(appReleases.releaseVersion, version)))
+        .limit(1);
+    return row ?? null;
+}
+async function selectReleaseByDigest(db, appId, digest) {
+    const [row] = await db
+        .select()
+        .from(appReleases)
+        .where(and(eq(appReleases.appId, appId), eq(appReleases.manifestDigest, digest)))
+        .limit(1);
+    return row ?? null;
+}

package/dist/service.test.d.ts

@@ -0,0 +1 @@
+export {};