@voyant-travel/apps 0.1.0

package/dist/webhook-delivery.js

@@ -0,0 +1,262 @@
+import { isExternalWebhookPayloadSchema } from "@voyant-travel/core/project";
+import { newId } from "@voyant-travel/db/lib/typeid";
+import { infraWebhookDeliveriesTable, infraWebhookDeliverySelectSchema, } from "@voyant-travel/db/schema/infra";
+import { createAppWebhookDeliveryEnvelope, createSelectedExternalWebhookQueue, hashWebhookPayload, isAppWebhookDeliveryEnvelope, webhookBodyExcerpt, } from "@voyant-travel/webhook-delivery";
+import { and, asc, eq, isNull, lte, or, sql } from "drizzle-orm";
+import { audit } from "./installation-reconciliation.js";
+import { appInstallations, appWebhookSubscriptions } from "./schema.js";
+export function createAppWebhookDeliveryStore(db, options) {
+    const threshold = options.terminalFailureThreshold ?? 5;
+    const now = options.now ?? (() => new Date());
+    return {
+        async listActiveSubscriptions(eventName) {
+            const rows = await selectSubscriptionRows(db, eventName);
+            return Promise.all(rows.map((row) => toWebhookSubscription(row, options.resolveSigningKey)));
+        },
+        async getSubscription(id) {
+            const rows = await selectSubscriptionRows(db, undefined, id);
+            const row = rows[0];
+            return row ? toWebhookSubscription(row, options.resolveSigningKey) : null;
+        },
+        async enqueueAttempt(input) {
+            const existing = await db
+                .select()
+                .from(infraWebhookDeliveriesTable)
+                .where(and(eq(infraWebhookDeliveriesTable.idempotencyKey, input.idempotencyKey), eq(infraWebhookDeliveriesTable.attemptNumber, input.attemptNumber)))
+                .limit(1);
+            if (existing[0]) {
+                return { attempt: infraWebhookDeliverySelectSchema.parse(existing[0]), created: false };
+            }
+            const [row] = await db.insert(infraWebhookDeliveriesTable).values(pending(input)).returning();
+            if (!row)
+                throw new Error("App webhook attempt insert returned no row");
+            return { attempt: infraWebhookDeliverySelectSchema.parse(row), created: true };
+        },
+        async listReadyAttemptIds(at, staleBefore, limit) {
+            const rows = await db
+                .select({ id: infraWebhookDeliveriesTable.id })
+                .from(infraWebhookDeliveriesTable)
+                .where(and(eq(infraWebhookDeliveriesTable.sourceModule, "apps"), or(and(eq(infraWebhookDeliveriesTable.status, "pending"), or(isNull(infraWebhookDeliveriesTable.scheduledFor), lte(infraWebhookDeliveriesTable.scheduledFor, at))), and(eq(infraWebhookDeliveriesTable.status, "in_flight"), lte(infraWebhookDeliveriesTable.startedAt, staleBefore)))))
+                .orderBy(asc(infraWebhookDeliveriesTable.scheduledFor), asc(infraWebhookDeliveriesTable.id))
+                .limit(limit);
+            return rows.map(({ id }) => id);
+        },
+        async claimAttempt(id, at, staleBefore) {
+            const rows = await db
+                .update(infraWebhookDeliveriesTable)
+                .set({ status: "in_flight", startedAt: at, updatedAt: at })
+                .where(and(eq(infraWebhookDeliveriesTable.id, id), eq(infraWebhookDeliveriesTable.sourceModule, "apps"), or(eq(infraWebhookDeliveriesTable.status, "pending"), and(eq(infraWebhookDeliveriesTable.status, "in_flight"), lte(infraWebhookDeliveriesTable.startedAt, staleBefore)))))
+                .returning();
+            return rows[0] ? infraWebhookDeliverySelectSchema.parse(rows[0]) : null;
+        },
+        async completeAttempt(input) {
+            const [row] = await db
+                .update(infraWebhookDeliveriesTable)
+                .set({ ...input, updatedAt: input.finishedAt })
+                .where(eq(infraWebhookDeliveriesTable.id, input.id))
+                .returning();
+            if (!row)
+                throw new Error(`Webhook attempt ${input.id} was not in flight`);
+            return infraWebhookDeliverySelectSchema.parse(row);
+        },
+        async completeAndEnqueueRetry(completion, retry) {
+            return db.transaction(async (tx) => {
+                const completed = await createAppWebhookDeliveryStore(tx, options).completeAttempt(completion);
+                const enqueued = await createAppWebhookDeliveryStore(tx, options).enqueueAttempt(retry);
+                return { completed, retry: enqueued.attempt };
+            });
+        },
+        async recordSubscriptionOutcome(subscriptionId, succeeded, at) {
+            const patch = succeeded
+                ? { lastDeliveryAt: at, failureCount: 0, signingKeyId: null, updatedAt: at }
+                : {
+                    lastDeliveryAt: at,
+                    // agent-quality: raw-sql reviewed -- owner: apps; Drizzle supplies the column identifier and no caller-controlled SQL is interpolated.
+                    failureCount: sql `${appWebhookSubscriptions.failureCount} + 1`,
+                    updatedAt: at,
+                };
+            const [subscription] = await db
+                .update(appWebhookSubscriptions)
+                .set(patch)
+                .where(eq(appWebhookSubscriptions.id, subscriptionId))
+                .returning();
+            if (!succeeded && subscription && subscription.failureCount >= threshold) {
+                const [installation] = await db
+                    .update(appInstallations)
+                    .set({ status: "degraded", degradedAt: now(), updatedAt: now() })
+                    .where(and(eq(appInstallations.id, subscription.installationId), eq(appInstallations.status, "active")))
+                    .returning();
+                await db
+                    .update(appWebhookSubscriptions)
+                    .set({ status: "failed", pausedAt: now(), deactivatedAt: now() })
+                    .where(eq(appWebhookSubscriptions.id, subscriptionId));
+                if (installation) {
+                    await audit(db, installation, "system", "reconciliation", "webhooks.degraded", {
+                        subscriptionId,
+                        failureCount: subscription.failureCount,
+                    });
+                }
+            }
+        },
+    };
+}
+export function createAppWebhookEventQueue(db, options) {
+    return createSelectedExternalWebhookQueue({
+        contracts: options.contracts,
+        store: createAppWebhookDeliveryStore(db, options),
+        now: options.now,
+    });
+}
+export async function enqueueAppWebhookEvent(db, event, options) {
+    return createAppWebhookEventQueue(db, options).enqueue(event);
+}
+export async function listAppWebhookHealth(db, installationId) {
+    const subscriptions = await db
+        .select()
+        .from(appWebhookSubscriptions)
+        .where(eq(appWebhookSubscriptions.installationId, installationId))
+        .orderBy(appWebhookSubscriptions.eventType, appWebhookSubscriptions.eventVersion);
+    return { data: subscriptions };
+}
+export async function replayAppWebhookDelivery(db, input) {
+    return db.transaction(async (tx) => {
+        const [original] = await tx
+            .select()
+            .from(infraWebhookDeliveriesTable)
+            .where(eq(infraWebhookDeliveriesTable.id, input.deliveryId))
+            .limit(1);
+        if (!original || !isAppWebhookDeliveryEnvelope(original.requestPayload)) {
+            throw new Error("Replay requires a retained app webhook delivery.");
+        }
+        const [installation] = await tx
+            .select()
+            .from(appInstallations)
+            .where(eq(appInstallations.id, original.requestPayload.installationId))
+            .limit(1);
+        if (installation?.status !== "active") {
+            throw new Error("Replay requires an active app installation.");
+        }
+        const parsedOriginal = infraWebhookDeliverySelectSchema.parse(original);
+        const replayed = replayInput(parsedOriginal, original.requestPayload);
+        const store = createAppWebhookDeliveryStore(tx, {
+            resolveSigningKey: async () => input.signingKey,
+        });
+        const enqueued = await store.enqueueAttempt(replayed);
+        await audit(tx, installation, input.actorId, "reconciliation", "webhooks.replay", {
+            originalDeliveryId: original.id,
+            replayDeliveryId: enqueued.attempt.id,
+        });
+        return enqueued.attempt;
+    });
+}
+async function selectSubscriptionRows(db, eventName, subscriptionId) {
+    return db
+        .select({
+        id: appWebhookSubscriptions.id,
+        installationId: appWebhookSubscriptions.installationId,
+        appId: appInstallations.appId,
+        eventVersion: appWebhookSubscriptions.eventVersion,
+        endpointUrl: appWebhookSubscriptions.endpointUrl,
+    })
+        .from(appWebhookSubscriptions)
+        .innerJoin(appInstallations, eq(appInstallations.id, appWebhookSubscriptions.installationId))
+        .where(and(eventName ? eq(appWebhookSubscriptions.eventType, eventName) : undefined, subscriptionId ? eq(appWebhookSubscriptions.id, subscriptionId) : undefined, eq(appWebhookSubscriptions.status, "active"), eq(appInstallations.status, "active")));
+}
+async function toWebhookSubscription(row, resolveSigningKey) {
+    const key = await resolveSigningKey({ appId: row.appId, installationId: row.installationId });
+    return {
+        id: row.id,
+        url: row.endpointUrl,
+        secret: key.secret,
+        keyId: key.id,
+        headers: null,
+        maxRetries: 5,
+        active: true,
+        app: {
+            installationId: row.installationId,
+            appId: row.appId,
+            eventVersion: row.eventVersion,
+        },
+    };
+}
+function pending(input) {
+    return {
+        id: input.id ?? newId("webhook_deliveries"),
+        sourceModule: input.sourceModule,
+        sourceEvent: input.sourceEvent,
+        sourceEntityModule: input.sourceEntityModule,
+        sourceEntityId: input.sourceEntityId,
+        subscriptionId: input.subscriptionId,
+        targetUrl: input.targetUrl,
+        targetKind: "app",
+        targetRef: input.subscriptionId,
+        requestMethod: input.requestMethod,
+        requestHeaders: input.requestHeaders,
+        requestBodyHash: input.requestBodyHash,
+        requestBodyExcerpt: input.requestBodyExcerpt,
+        requestPayload: objectRecord(input.requestPayload),
+        deliveryContract: objectRecord(input.deliveryContract),
+        attemptNumber: input.attemptNumber,
+        parentDeliveryId: input.parentDeliveryId,
+        idempotencyKey: input.idempotencyKey,
+        status: "pending",
+        scheduledFor: input.scheduledFor,
+        startedAt: null,
+    };
+}
+function replayInput(original, envelope) {
+    const contract = parseDeliveryContract(original.deliveryContract);
+    const deliveryId = newId("webhook_deliveries");
+    const replay = createAppWebhookDeliveryEnvelope({
+        deliveryId,
+        installationId: envelope.installationId,
+        appId: envelope.appId,
+        event: {
+            name: envelope.event.type,
+            data: envelope.payload,
+            emittedAt: envelope.event.occurredAt,
+            metadata: envelope.metadata,
+        },
+        contract,
+        deliveredAt: new Date(),
+        attemptNumber: 1,
+        maxRetries: envelope.attempt.maxRetries,
+        idempotencyKey: `app-webhook-replay:${original.id}:${deliveryId}`,
+        originalDeliveryId: original.id,
+    });
+    const body = JSON.stringify(replay);
+    return {
+        id: deliveryId,
+        sourceModule: "apps",
+        sourceEvent: envelope.event.type,
+        sourceEntityModule: envelope.subject.module,
+        sourceEntityId: envelope.subject.id,
+        subscriptionId: original.subscriptionId ?? "",
+        targetUrl: original.targetUrl,
+        requestMethod: "POST",
+        requestHeaders: original.requestHeaders ?? {},
+        requestBodyHash: hashWebhookPayload(body),
+        requestBodyExcerpt: webhookBodyExcerpt(body),
+        requestPayload: replay,
+        deliveryContract: contract,
+        attemptNumber: 1,
+        parentDeliveryId: original.id,
+        idempotencyKey: replay.attempt.idempotencyKey,
+        scheduledFor: new Date(),
+    };
+}
+function objectRecord(value) {
+    return Object.fromEntries(Object.entries(value));
+}
+function parseDeliveryContract(value) {
+    if (value &&
+        typeof value === "object" &&
+        !Array.isArray(value) &&
+        typeof value.eventId === "string" &&
+        typeof value.eventType === "string" &&
+        typeof value.eventVersion === "string" &&
+        isExternalWebhookPayloadSchema(value.payloadSchema)) {
+        return value;
+    }
+    throw new Error("Replay requires a delivery contract snapshot.");
+}

package/migrations/20260717000100_app_registry_foundation.sql

@@ -0,0 +1,87 @@
+CREATE TYPE "public"."app_distribution" AS ENUM('custom', 'marketplace');--> statement-breakpoint
+CREATE TYPE "public"."app_lifecycle_state" AS ENUM('active', 'suspended', 'deleted');--> statement-breakpoint
+CREATE TYPE "public"."app_credential_kind" AS ENUM('client_secret', 'signing_key');--> statement-breakpoint
+CREATE TYPE "public"."app_release_state" AS ENUM('available', 'suspended', 'yanked');--> statement-breakpoint
+CREATE TYPE "public"."app_release_artifact_state" AS ENUM('available', 'unavailable');--> statement-breakpoint
+CREATE TABLE "apps" (
+  "id" text PRIMARY KEY NOT NULL,
+  "platform_namespace" text NOT NULL,
+  "distribution" "app_distribution" NOT NULL,
+  "owner_id" text NOT NULL,
+  "display_name" text NOT NULL,
+  "slug" text NOT NULL,
+  "lifecycle_state" "app_lifecycle_state" DEFAULT 'active' NOT NULL,
+  "created_by" text NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+  CONSTRAINT "apps_platform_namespace_reserved" CHECK ("apps"."platform_namespace" LIKE 'app--%')
+);--> statement-breakpoint
+CREATE TABLE "app_redirect_uris" (
+  "id" text PRIMARY KEY NOT NULL,
+  "app_id" text NOT NULL,
+  "redirect_uri" text NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL
+);--> statement-breakpoint
+CREATE TABLE "app_credentials" (
+  "id" text PRIMARY KEY NOT NULL,
+  "app_id" text NOT NULL,
+  "kind" "app_credential_kind" NOT NULL,
+  "generation" integer NOT NULL,
+  "kms_key_ref" text NOT NULL,
+  "public_key_ref" text,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "retired_at" timestamp with time zone
+);--> statement-breakpoint
+CREATE TABLE "app_releases" (
+  "id" text PRIMARY KEY NOT NULL,
+  "app_id" text NOT NULL,
+  "release_version" text NOT NULL,
+  "manifest_schema_version" text NOT NULL,
+  "manifest_digest" text NOT NULL,
+  "manifest_snapshot" jsonb NOT NULL,
+  "normalized_record" jsonb NOT NULL,
+  "api_compatibility" jsonb NOT NULL,
+  "default_locale" text NOT NULL,
+  "supported_locales" jsonb NOT NULL,
+  "state" "app_release_state" DEFAULT 'available' NOT NULL,
+  "created_by" text NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL
+);--> statement-breakpoint
+CREATE TABLE "app_release_artifacts" (
+  "id" text PRIMARY KEY NOT NULL,
+  "release_id" text NOT NULL,
+  "digest" text NOT NULL,
+  "signature" text,
+  "provenance" jsonb NOT NULL,
+  "registry_coordinates" jsonb,
+  "asset_inventory" jsonb NOT NULL,
+  "state" "app_release_artifact_state" DEFAULT 'available' NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL
+);--> statement-breakpoint
+CREATE TABLE "app_release_localizations" (
+  "id" text PRIMARY KEY NOT NULL,
+  "release_id" text NOT NULL,
+  "locale" text NOT NULL,
+  "surface" text NOT NULL,
+  "message_key" text NOT NULL,
+  "text" text NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL
+);--> statement-breakpoint
+ALTER TABLE "app_redirect_uris" ADD CONSTRAINT "app_redirect_uris_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_credentials" ADD CONSTRAINT "app_credentials_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_releases" ADD CONSTRAINT "app_releases_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_release_artifacts" ADD CONSTRAINT "app_release_artifacts_release_id_app_releases_id_fk" FOREIGN KEY ("release_id") REFERENCES "public"."app_releases"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_release_localizations" ADD CONSTRAINT "app_release_localizations_release_id_app_releases_id_fk" FOREIGN KEY ("release_id") REFERENCES "public"."app_releases"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "uidx_apps_platform_namespace" ON "apps" USING btree ("platform_namespace");--> statement-breakpoint
+CREATE INDEX "idx_apps_owner" ON "apps" USING btree ("owner_id","distribution","lifecycle_state");--> statement-breakpoint
+CREATE INDEX "idx_app_redirect_uris_app" ON "app_redirect_uris" USING btree ("app_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "uidx_app_redirect_uris_exact" ON "app_redirect_uris" USING btree ("app_id","redirect_uri");--> statement-breakpoint
+CREATE INDEX "idx_app_credentials_app" ON "app_credentials" USING btree ("app_id","kind");--> statement-breakpoint
+CREATE UNIQUE INDEX "uidx_app_credentials_generation" ON "app_credentials" USING btree ("app_id","kind","generation");--> statement-breakpoint
+CREATE INDEX "idx_app_releases_app" ON "app_releases" USING btree ("app_id","created_at");--> statement-breakpoint
+CREATE UNIQUE INDEX "uidx_app_releases_digest" ON "app_releases" USING btree ("app_id","manifest_digest");--> statement-breakpoint
+CREATE UNIQUE INDEX "uidx_app_releases_version" ON "app_releases" USING btree ("app_id","release_version");--> statement-breakpoint
+CREATE INDEX "idx_app_release_artifacts_release" ON "app_release_artifacts" USING btree ("release_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "uidx_app_release_artifacts_digest" ON "app_release_artifacts" USING btree ("release_id","digest");--> statement-breakpoint
+CREATE INDEX "idx_app_release_localizations_release" ON "app_release_localizations" USING btree ("release_id","locale");--> statement-breakpoint
+CREATE UNIQUE INDEX "uidx_app_release_localizations_key" ON "app_release_localizations" USING btree ("release_id","locale","surface","message_key");

package/migrations/20260717111938_breezy_karma.sql

@@ -0,0 +1,136 @@
+CREATE TYPE "public"."app_access_credential_status" AS ENUM('active', 'inactive', 'revoked');--> statement-breakpoint
+CREATE TYPE "public"."app_audit_event_kind" AS ENUM('lifecycle', 'grant', 'credential', 'reconciliation', 'purge');--> statement-breakpoint
+CREATE TYPE "public"."app_grant_status" AS ENUM('requested', 'granted', 'optional', 'revoked');--> statement-breakpoint
+CREATE TYPE "public"."app_installation_registration_status" AS ENUM('active', 'inactive');--> statement-breakpoint
+CREATE TYPE "public"."app_installation_status" AS ENUM('pending', 'authorizing', 'active', 'paused', 'degraded', 'revoked', 'uninstalled');--> statement-breakpoint
+CREATE TYPE "public"."app_installation_update_policy" AS ENUM('manual', 'compatible', 'patch', 'pinned');--> statement-breakpoint
+CREATE TYPE "public"."app_webhook_subscription_status" AS ENUM('active', 'inactive', 'failed');--> statement-breakpoint
+CREATE TABLE "app_installations" (
+	"id" text PRIMARY KEY NOT NULL,
+	"app_id" text NOT NULL,
+	"deployment_id" text NOT NULL,
+	"release_id" text NOT NULL,
+	"status" "app_installation_status" DEFAULT 'pending' NOT NULL,
+	"namespace" text NOT NULL,
+	"installed_by" text NOT NULL,
+	"update_policy" "app_installation_update_policy" DEFAULT 'compatible' NOT NULL,
+	"last_compatible_release_check_at" timestamp with time zone,
+	"pending_release_id" text,
+	"pending_reason" text,
+	"installed_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"authorized_at" timestamp with time zone,
+	"activated_at" timestamp with time zone,
+	"paused_at" timestamp with time zone,
+	"degraded_at" timestamp with time zone,
+	"revoked_at" timestamp with time zone,
+	"uninstalled_at" timestamp with time zone,
+	"purged_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "app_installations_namespace_reserved" CHECK ("app_installations"."namespace" LIKE 'app--%')
+);
+--> statement-breakpoint
+CREATE TABLE "app_grants" (
+	"id" text PRIMARY KEY NOT NULL,
+	"installation_id" text NOT NULL,
+	"scope" text NOT NULL,
+	"status" "app_grant_status" NOT NULL,
+	"optional" boolean DEFAULT false NOT NULL,
+	"requested_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"granted_at" timestamp with time zone,
+	"revoked_at" timestamp with time zone
+);
+--> statement-breakpoint
+CREATE TABLE "app_access_credentials" (
+	"id" text PRIMARY KEY NOT NULL,
+	"installation_id" text NOT NULL,
+	"generation" integer NOT NULL,
+	"credential_hash" text NOT NULL,
+	"encrypted_metadata" jsonb NOT NULL,
+	"status" "app_access_credential_status" DEFAULT 'active' NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"expires_at" timestamp with time zone,
+	"deactivated_at" timestamp with time zone
+);
+--> statement-breakpoint
+CREATE TABLE "app_installation_settings" (
+	"id" text PRIMARY KEY NOT NULL,
+	"installation_id" text NOT NULL,
+	"settings" jsonb NOT NULL,
+	"schema_digest" text NOT NULL,
+	"updated_by" text NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "app_secret_references" (
+	"id" text PRIMARY KEY NOT NULL,
+	"installation_id" text NOT NULL,
+	"key" text NOT NULL,
+	"secret_ref" text NOT NULL,
+	"created_by" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"revoked_at" timestamp with time zone
+);
+--> statement-breakpoint
+CREATE TABLE "app_extension_installations" (
+	"id" text PRIMARY KEY NOT NULL,
+	"installation_id" text NOT NULL,
+	"release_id" text NOT NULL,
+	"extension_key" text NOT NULL,
+	"descriptor" jsonb NOT NULL,
+	"status" "app_installation_registration_status" DEFAULT 'active' NOT NULL,
+	"installed_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"deactivated_at" timestamp with time zone
+);
+--> statement-breakpoint
+CREATE TABLE "app_webhook_subscriptions" (
+	"id" text PRIMARY KEY NOT NULL,
+	"installation_id" text NOT NULL,
+	"release_id" text NOT NULL,
+	"event_type" text NOT NULL,
+	"event_version" text NOT NULL,
+	"endpoint_url" text NOT NULL,
+	"status" "app_webhook_subscription_status" DEFAULT 'active' NOT NULL,
+	"external_subscription_id" text,
+	"installed_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"deactivated_at" timestamp with time zone
+);
+--> statement-breakpoint
+CREATE TABLE "app_audit_events" (
+	"id" text PRIMARY KEY NOT NULL,
+	"installation_id" text,
+	"app_id" text NOT NULL,
+	"deployment_id" text NOT NULL,
+	"actor_id" text NOT NULL,
+	"kind" "app_audit_event_kind" NOT NULL,
+	"action" text NOT NULL,
+	"details" jsonb NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "app_installations" ADD CONSTRAINT "app_installations_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_installations" ADD CONSTRAINT "app_installations_release_id_app_releases_id_fk" FOREIGN KEY ("release_id") REFERENCES "public"."app_releases"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_grants" ADD CONSTRAINT "app_grants_installation_id_app_installations_id_fk" FOREIGN KEY ("installation_id") REFERENCES "public"."app_installations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_access_credentials" ADD CONSTRAINT "app_access_credentials_installation_id_app_installations_id_fk" FOREIGN KEY ("installation_id") REFERENCES "public"."app_installations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_installation_settings" ADD CONSTRAINT "app_installation_settings_installation_id_app_installations_id_fk" FOREIGN KEY ("installation_id") REFERENCES "public"."app_installations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_secret_references" ADD CONSTRAINT "app_secret_references_installation_id_app_installations_id_fk" FOREIGN KEY ("installation_id") REFERENCES "public"."app_installations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_extension_installations" ADD CONSTRAINT "app_extension_installations_installation_id_app_installations_id_fk" FOREIGN KEY ("installation_id") REFERENCES "public"."app_installations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_extension_installations" ADD CONSTRAINT "app_extension_installations_release_id_app_releases_id_fk" FOREIGN KEY ("release_id") REFERENCES "public"."app_releases"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_webhook_subscriptions" ADD CONSTRAINT "app_webhook_subscriptions_installation_id_app_installations_id_fk" FOREIGN KEY ("installation_id") REFERENCES "public"."app_installations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_webhook_subscriptions" ADD CONSTRAINT "app_webhook_subscriptions_release_id_app_releases_id_fk" FOREIGN KEY ("release_id") REFERENCES "public"."app_releases"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_audit_events" ADD CONSTRAINT "app_audit_events_installation_id_app_installations_id_fk" FOREIGN KEY ("installation_id") REFERENCES "public"."app_installations"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "idx_app_installations_app" ON "app_installations" USING btree ("app_id","status");--> statement-breakpoint
+CREATE INDEX "idx_app_installations_deployment" ON "app_installations" USING btree ("deployment_id","status");--> statement-breakpoint
+CREATE UNIQUE INDEX "uidx_app_installations_deployment_app" ON "app_installations" USING btree ("deployment_id","app_id");--> statement-breakpoint
+CREATE INDEX "idx_app_grants_installation" ON "app_grants" USING btree ("installation_id","status");--> statement-breakpoint
+CREATE UNIQUE INDEX "uidx_app_grants_scope" ON "app_grants" USING btree ("installation_id","scope");--> statement-breakpoint
+CREATE INDEX "idx_app_access_credentials_installation" ON "app_access_credentials" USING btree ("installation_id","status");--> statement-breakpoint
+CREATE UNIQUE INDEX "uidx_app_access_credentials_generation" ON "app_access_credentials" USING btree ("installation_id","generation");--> statement-breakpoint
+CREATE UNIQUE INDEX "uidx_app_installation_settings_installation" ON "app_installation_settings" USING btree ("installation_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "uidx_app_secret_references_key" ON "app_secret_references" USING btree ("installation_id","key");--> statement-breakpoint
+CREATE INDEX "idx_app_extension_installations_installation" ON "app_extension_installations" USING btree ("installation_id","status");--> statement-breakpoint
+CREATE UNIQUE INDEX "uidx_app_extension_installations_key" ON "app_extension_installations" USING btree ("installation_id","extension_key");--> statement-breakpoint
+CREATE INDEX "idx_app_webhook_subscriptions_installation" ON "app_webhook_subscriptions" USING btree ("installation_id","status");--> statement-breakpoint
+CREATE UNIQUE INDEX "uidx_app_webhook_subscriptions_event" ON "app_webhook_subscriptions" USING btree ("installation_id","event_type","event_version","endpoint_url");--> statement-breakpoint
+CREATE INDEX "idx_app_audit_events_installation" ON "app_audit_events" USING btree ("installation_id","created_at");--> statement-breakpoint
+CREATE INDEX "idx_app_audit_events_app" ON "app_audit_events" USING btree ("app_id","deployment_id","created_at");

package/migrations/20260717123000_app_webhook_delivery_health.sql

@@ -0,0 +1,4 @@
+ALTER TABLE "app_webhook_subscriptions" ADD COLUMN "signing_key_id" text;--> statement-breakpoint
+ALTER TABLE "app_webhook_subscriptions" ADD COLUMN "last_delivery_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "app_webhook_subscriptions" ADD COLUMN "failure_count" integer DEFAULT 0 NOT NULL;--> statement-breakpoint
+ALTER TABLE "app_webhook_subscriptions" ADD COLUMN "paused_at" timestamp with time zone;

package/migrations/20260717143000_app_oauth_authorization.sql

@@ -0,0 +1,47 @@
+ALTER TYPE "public"."app_audit_event_kind" ADD VALUE IF NOT EXISTS 'consent';--> statement-breakpoint
+ALTER TYPE "public"."app_audit_event_kind" ADD VALUE IF NOT EXISTS 'token';--> statement-breakpoint
+CREATE TYPE "public"."app_access_token_mode" AS ENUM('offline', 'online');--> statement-breakpoint
+ALTER TABLE "app_installations" ADD COLUMN "credential_generation" integer DEFAULT 0 NOT NULL;--> statement-breakpoint
+ALTER TABLE "app_access_credentials" ADD COLUMN "token_mode" "app_access_token_mode" DEFAULT 'offline' NOT NULL;--> statement-breakpoint
+ALTER TABLE "app_access_credentials" ADD COLUMN "actor_id" text;--> statement-breakpoint
+ALTER TABLE "app_access_credentials" ADD COLUMN "viewer_id" text;--> statement-breakpoint
+DROP INDEX "public"."uidx_app_access_credentials_generation";--> statement-breakpoint
+CREATE INDEX "idx_app_access_credentials_generation" ON "app_access_credentials" USING btree ("installation_id","token_mode","generation");--> statement-breakpoint
+CREATE TABLE "app_oauth_authorization_codes" (
+	"id" text PRIMARY KEY NOT NULL,
+	"app_id" text NOT NULL,
+	"installation_id" text NOT NULL,
+	"release_id" text NOT NULL,
+	"deployment_id" text NOT NULL,
+	"code_hash" text NOT NULL,
+	"state_hash" text NOT NULL,
+	"redirect_uri" text NOT NULL,
+	"code_challenge" text NOT NULL,
+	"code_challenge_method" text NOT NULL,
+	"requested_scopes" jsonb NOT NULL,
+	"granted_scopes" jsonb NOT NULL,
+	"denied_optional_scopes" jsonb NOT NULL,
+	"actor_id" text NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"consumed_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);--> statement-breakpoint
+CREATE TABLE "app_oauth_refresh_tokens" (
+	"id" text PRIMARY KEY NOT NULL,
+	"installation_id" text NOT NULL,
+	"token_hash" text NOT NULL,
+	"generation" integer NOT NULL,
+	"status" "app_access_credential_status" DEFAULT 'active' NOT NULL,
+	"rotated_from_id" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"expires_at" timestamp with time zone,
+	"revoked_at" timestamp with time zone
+);--> statement-breakpoint
+ALTER TABLE "app_oauth_authorization_codes" ADD CONSTRAINT "app_oauth_authorization_codes_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_oauth_authorization_codes" ADD CONSTRAINT "app_oauth_authorization_codes_installation_id_app_installations_id_fk" FOREIGN KEY ("installation_id") REFERENCES "public"."app_installations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_oauth_authorization_codes" ADD CONSTRAINT "app_oauth_authorization_codes_release_id_app_releases_id_fk" FOREIGN KEY ("release_id") REFERENCES "public"."app_releases"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_oauth_refresh_tokens" ADD CONSTRAINT "app_oauth_refresh_tokens_installation_id_app_installations_id_fk" FOREIGN KEY ("installation_id") REFERENCES "public"."app_installations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "uidx_app_oauth_codes_hash" ON "app_oauth_authorization_codes" USING btree ("code_hash");--> statement-breakpoint
+CREATE INDEX "idx_app_oauth_codes_installation" ON "app_oauth_authorization_codes" USING btree ("installation_id","expires_at");--> statement-breakpoint
+CREATE UNIQUE INDEX "uidx_app_oauth_refresh_tokens_hash" ON "app_oauth_refresh_tokens" USING btree ("token_hash");--> statement-breakpoint
+CREATE INDEX "idx_app_oauth_refresh_tokens_installation" ON "app_oauth_refresh_tokens" USING btree ("installation_id","status");

package/migrations/meta/_journal.json

@@ -0,0 +1,34 @@
+{
+  "version": "7",
+  "dialect": "postgresql",
+  "entries": [
+    {
+      "idx": 0,
+      "version": "7",
+      "when": 1784250060000,
+      "tag": "20260717000100_app_registry_foundation",
+      "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "7",
+      "when": 1784287178252,
+      "tag": "20260717111938_breezy_karma",
+      "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "7",
+      "when": 1784291400000,
+      "tag": "20260717123000_app_webhook_delivery_health",
+      "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "7",
+      "when": 1784298600000,
+      "tag": "20260717143000_app_oauth_authorization",
+      "breakpoints": true
+    }
+  ]
+}