@voyant-travel/apps 0.1.0

package/dist/installation-state.js

@@ -0,0 +1,17 @@
+import { ApiHttpError } from "@voyant-travel/hono";
+export function planLifecycleTransition(current, allowedFrom, to, action) {
+    if (current === to)
+        return { outcome: "unchanged", status: current };
+    if (!allowedFrom.includes(current))
+        throw invalidTransition(current, action);
+    return { outcome: "updated", from: current, to };
+}
+export function canInstallOver(status) {
+    return status === "uninstalled" || status === "revoked";
+}
+export function invalidTransition(from, action) {
+    return new ApiHttpError(`Cannot ${action} app installation from ${from}`, {
+        status: 409,
+        code: "app_installation_invalid_transition",
+    });
+}

package/dist/installation-state.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/installation-state.test.js

@@ -0,0 +1,38 @@
+import { describe, expect, it } from "vitest";
+import { canInstallOver, planLifecycleTransition } from "./installation-state.js";
+describe("app installation lifecycle state", () => {
+    it("treats repeated pause, resume, and uninstall actions as idempotent", () => {
+        expect(planLifecycleTransition("paused", ["active", "degraded"], "paused", "pause")).toEqual({
+            outcome: "unchanged",
+            status: "paused",
+        });
+        expect(planLifecycleTransition("active", ["paused"], "active", "resume")).toEqual({
+            outcome: "unchanged",
+            status: "active",
+        });
+        expect(planLifecycleTransition("uninstalled", ["active", "paused", "degraded"], "uninstalled", "uninstall")).toEqual({ outcome: "unchanged", status: "uninstalled" });
+    });
+    it("allows the expected active, paused, resumed, and uninstalled path", () => {
+        expect(planLifecycleTransition("active", ["active", "degraded"], "paused", "pause")).toEqual({
+            outcome: "updated",
+            from: "active",
+            to: "paused",
+        });
+        expect(planLifecycleTransition("paused", ["paused"], "active", "resume")).toEqual({
+            outcome: "updated",
+            from: "paused",
+            to: "active",
+        });
+        expect(planLifecycleTransition("active", ["active", "paused", "degraded"], "uninstalled", "uninstall")).toEqual({ outcome: "updated", from: "active", to: "uninstalled" });
+    });
+    it("rejects invalid lifecycle transitions", () => {
+        expect(() => planLifecycleTransition("pending", ["active", "degraded"], "paused", "pause")).toThrow("Cannot pause app installation from pending");
+        expect(() => planLifecycleTransition("revoked", ["paused"], "active", "resume")).toThrow("Cannot resume app installation from revoked");
+    });
+    it("only reinstalls over terminal retained rows", () => {
+        expect(canInstallOver("uninstalled")).toBe(true);
+        expect(canInstallOver("revoked")).toBe(true);
+        expect(canInstallOver("active")).toBe(false);
+        expect(canInstallOver("paused")).toBe(false);
+    });
+});

package/dist/oauth-crypto.d.ts

@@ -0,0 +1,8 @@
+export declare const APP_ACCESS_TOKEN_PREFIX = "vapp_";
+export declare const APP_REFRESH_TOKEN_PREFIX = "vappr_";
+export declare const APP_AUTH_CODE_PREFIX = "vappc_";
+export declare function randomToken(prefix: string, bytes?: number): string;
+export declare function sha256Hex(value: string): string;
+export declare function sha256Base64Url(value: string): string;
+export declare function constantTimeEqual(left: string, right: string): boolean;
+export declare function verifyPkceS256(verifier: string, challenge: string): boolean;

package/dist/oauth-crypto.js

@@ -0,0 +1,23 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+export const APP_ACCESS_TOKEN_PREFIX = "vapp_";
+export const APP_REFRESH_TOKEN_PREFIX = "vappr_";
+export const APP_AUTH_CODE_PREFIX = "vappc_";
+export function randomToken(prefix, bytes = 32) {
+    return `${prefix}${randomBytes(bytes).toString("base64url")}`;
+}
+export function sha256Hex(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+export function sha256Base64Url(value) {
+    return createHash("sha256").update(value).digest("base64url");
+}
+export function constantTimeEqual(left, right) {
+    const leftHash = Buffer.from(sha256Hex(left), "hex");
+    const rightHash = Buffer.from(sha256Hex(right), "hex");
+    return timingSafeEqual(leftHash, rightHash);
+}
+export function verifyPkceS256(verifier, challenge) {
+    if (!/^[A-Za-z0-9._~-]{43,128}$/.test(verifier))
+        return false;
+    return constantTimeEqual(sha256Base64Url(verifier), challenge);
+}

package/dist/oauth-crypto.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/oauth-crypto.test.js

@@ -0,0 +1,11 @@
+import { describe, expect, it } from "vitest";
+import { sha256Base64Url, verifyPkceS256 } from "./oauth-crypto.js";
+describe("app OAuth PKCE", () => {
+    it("accepts only S256 challenges derived from the verifier", () => {
+        const verifier = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ_0123456789-1234567890";
+        const challenge = sha256Base64Url(verifier);
+        expect(verifyPkceS256(verifier, challenge)).toBe(true);
+        expect(verifyPkceS256(`${verifier}x`, challenge)).toBe(false);
+        expect(verifyPkceS256("too-short", challenge)).toBe(false);
+    });
+});

package/dist/oauth-service.d.ts

@@ -0,0 +1,65 @@
+import type { VoyantAuthContext } from "@voyant-travel/core";
+import type { AccessCatalog } from "@voyant-travel/types/api-keys";
+import type { PostgresJsDatabase } from "drizzle-orm/postgres-js";
+export interface AppOAuthServiceOptions {
+    accessCatalog: AccessCatalog;
+    deploymentId: string;
+    now?: () => Date;
+}
+export interface AuthorizeAppInput {
+    appId: string;
+    releaseId: string;
+    redirectUri: string;
+    state: string;
+    codeChallenge: string;
+    codeChallengeMethod: "S256";
+    actorId: string;
+    operatorGrantedScopes: readonly string[];
+    grantedOptionalScopes?: readonly string[];
+}
+export interface TokenCodeInput {
+    grantType: "authorization_code";
+    code: string;
+    redirectUri: string;
+    codeVerifier: string;
+    clientId: string;
+    clientSecret?: string;
+}
+export interface RefreshTokenInput {
+    grantType: "refresh_token";
+    refreshToken: string;
+    clientId: string;
+    clientSecret?: string;
+}
+export interface TokenExchangeInput {
+    grantType: "urn:voyant:params:oauth:grant-type:actor-token-exchange";
+    installationId: string;
+    viewerId: string;
+    viewerScopes: readonly string[];
+    contextualScopes?: readonly string[];
+    clientId: string;
+    clientSecret?: string;
+}
+export type AppTokenInput = TokenCodeInput | RefreshTokenInput | TokenExchangeInput;
+export declare function createAppOAuthService(options: AppOAuthServiceOptions): {
+    authorize: (db: PostgresJsDatabase, input: AuthorizeAppInput) => Promise<{
+        code: string;
+        state: string;
+        redirectUri: string;
+        expiresAt: Date;
+    }>;
+    token: (db: PostgresJsDatabase, input: AppTokenInput) => Promise<{
+        refreshToken?: string | undefined;
+        accessToken: string;
+        tokenType: "Bearer";
+        expiresIn: number;
+        scope: string;
+        tokenMode: "offline" | "online";
+    }>;
+    resolveAccessToken: (db: PostgresJsDatabase, rawToken: string) => Promise<VoyantAuthContext | null>;
+    revokeInstallationCredentials: (db: PostgresJsDatabase, installationId: string, actorId: string) => Promise<{
+        installationId: string;
+        generation: number;
+    }>;
+};
+export declare function intersectAppTokenScopes(...sets: readonly (readonly string[])[]): string[];

package/dist/oauth-service.js

@@ -0,0 +1,381 @@
+import { ApiHttpError } from "@voyant-travel/hono";
+import { and, eq } from "drizzle-orm";
+import { computeAppConsent } from "./consent.js";
+import { APP_ACCESS_TOKEN_PREFIX, APP_AUTH_CODE_PREFIX, APP_REFRESH_TOKEN_PREFIX, constantTimeEqual, randomToken, sha256Hex, verifyPkceS256, } from "./oauth-crypto.js";
+import { appAccessCredentials, appAuditEvents, appCredentials, appGrants, appInstallations, appOAuthAuthorizationCodes, appOAuthRefreshTokens, appRedirectUris, appReleases, apps, } from "./schema.js";
+const CODE_TTL_MS = 5 * 60 * 1000;
+const OFFLINE_ACCESS_TTL_MS = 60 * 60 * 1000;
+const ONLINE_ACCESS_TTL_MS = 10 * 60 * 1000;
+const REFRESH_TTL_MS = 90 * 24 * 60 * 60 * 1000;
+export function createAppOAuthService(options) {
+    const now = () => options.now?.() ?? new Date();
+    async function authorize(db, input) {
+        assertState(input.state);
+        if (input.codeChallengeMethod !== "S256") {
+            throw oauthError("invalid_request", "PKCE S256 is required");
+        }
+        const release = await requireRelease(db, input.appId, input.releaseId);
+        await requireExactRedirectUri(db, input.appId, input.redirectUri);
+        const consent = computeAppConsent({
+            release,
+            accessCatalog: options.accessCatalog,
+            operatorGrantedScopes: input.operatorGrantedScopes,
+            grantedOptionalScopes: input.grantedOptionalScopes,
+        });
+        const installation = await ensureAuthorizedInstallation(db, {
+            appId: input.appId,
+            releaseId: input.releaseId,
+            deploymentId: options.deploymentId,
+            actorId: input.actorId,
+            grantedScopes: consent.grantedScopes,
+            deniedOptionalScopes: consent.deniedOptionalScopes,
+        });
+        const code = randomToken(APP_AUTH_CODE_PREFIX);
+        const expiresAt = new Date(now().getTime() + CODE_TTL_MS);
+        await db.insert(appOAuthAuthorizationCodes).values({
+            appId: input.appId,
+            installationId: installation.id,
+            releaseId: input.releaseId,
+            deploymentId: options.deploymentId,
+            codeHash: sha256Hex(code),
+            stateHash: sha256Hex(input.state),
+            redirectUri: input.redirectUri,
+            codeChallenge: input.codeChallenge,
+            codeChallengeMethod: input.codeChallengeMethod,
+            requestedScopes: [...consent.requiredScopes, ...consent.optionalScopes].sort(),
+            grantedScopes: consent.grantedScopes,
+            deniedOptionalScopes: consent.deniedOptionalScopes,
+            actorId: input.actorId,
+            expiresAt,
+        });
+        await audit(db, installation, input.actorId, "consent", "oauth.consent.recorded", {
+            grantedScopes: consent.grantedScopes,
+            deniedOptionalScopes: consent.deniedOptionalScopes,
+        });
+        return { code, state: input.state, redirectUri: input.redirectUri, expiresAt };
+    }
+    async function token(db, input) {
+        await authenticateClient(db, input.clientId, input.clientSecret);
+        if (input.grantType === "authorization_code")
+            return exchangeCode(db, input);
+        if (input.grantType === "refresh_token")
+            return refresh(db, input);
+        return exchangeActorToken(db, input);
+    }
+    async function resolveAccessToken(db, rawToken) {
+        if (!rawToken.startsWith(APP_ACCESS_TOKEN_PREFIX))
+            return null;
+        const [credential] = await db
+            .select()
+            .from(appAccessCredentials)
+            .where(and(eq(appAccessCredentials.credentialHash, sha256Hex(rawToken)), eq(appAccessCredentials.status, "active")))
+            .limit(1);
+        if (!credential || (credential.expiresAt && credential.expiresAt <= now()))
+            return null;
+        const installation = await selectInstallation(db, credential.installationId);
+        if (!installation || !isInstallationUsable(installation, credential.generation))
+            return null;
+        const scopes = await grantedScopes(db, installation.id);
+        return {
+            callerType: "app",
+            actor: "staff",
+            audience: "staff",
+            appId: installation.appId,
+            appInstallationId: installation.id,
+            appReleaseId: installation.releaseId,
+            appCredentialGeneration: credential.generation,
+            appTokenMode: credential.tokenMode,
+            appViewerId: credential.viewerId ?? undefined,
+            scopes,
+        };
+    }
+    async function revokeInstallationCredentials(db, installationId, actorId) {
+        return db.transaction(async (tx) => {
+            const installation = await requireInstallation(tx, installationId);
+            const generation = installation.credentialGeneration + 1;
+            await tx
+                .update(appInstallations)
+                .set({ credentialGeneration: generation, updatedAt: now() })
+                .where(eq(appInstallations.id, installation.id));
+            await tx
+                .update(appAccessCredentials)
+                .set({ status: "revoked", deactivatedAt: now() })
+                .where(eq(appAccessCredentials.installationId, installation.id));
+            await tx
+                .update(appOAuthRefreshTokens)
+                .set({ status: "revoked", revokedAt: now() })
+                .where(eq(appOAuthRefreshTokens.installationId, installation.id));
+            await audit(tx, installation, actorId, "credential", "credential.revoked", { generation });
+            return { installationId: installation.id, generation };
+        });
+    }
+    return { authorize, token, resolveAccessToken, revokeInstallationCredentials };
+    async function exchangeCode(db, input) {
+        return db.transaction(async (tx) => {
+            const codeHash = sha256Hex(input.code);
+            const [code] = await tx
+                .select()
+                .from(appOAuthAuthorizationCodes)
+                .where(eq(appOAuthAuthorizationCodes.codeHash, codeHash))
+                .for("update")
+                .limit(1);
+            if (!code || code.consumedAt || code.expiresAt <= now()) {
+                throw oauthError("invalid_grant", "Authorization code is invalid, expired, or consumed");
+            }
+            if (code.appId !== input.clientId || code.redirectUri !== input.redirectUri) {
+                throw oauthError("invalid_grant", "Authorization code was issued to different client data");
+            }
+            if (!verifyPkceS256(input.codeVerifier, code.codeChallenge)) {
+                throw oauthError("invalid_grant", "PKCE verifier does not match the authorization code");
+            }
+            await tx
+                .update(appOAuthAuthorizationCodes)
+                .set({ consumedAt: now() })
+                .where(eq(appOAuthAuthorizationCodes.id, code.id));
+            const installation = await requireInstallation(tx, code.installationId);
+            assertActiveInstallation(installation);
+            const tokens = await mintTokens(tx, installation, code.actorId, null, code.grantedScopes);
+            await audit(tx, installation, code.actorId, "token", "oauth.code.exchanged", {});
+            return tokens;
+        });
+    }
+    async function refresh(db, input) {
+        return db.transaction(async (tx) => {
+            const [tokenRow] = await tx
+                .select()
+                .from(appOAuthRefreshTokens)
+                .where(eq(appOAuthRefreshTokens.tokenHash, sha256Hex(input.refreshToken)))
+                .for("update")
+                .limit(1);
+            if (tokenRow?.status !== "active" || isExpired(tokenRow.expiresAt)) {
+                throw oauthError("invalid_grant", "Refresh token is invalid");
+            }
+            const installation = await requireInstallation(tx, tokenRow.installationId);
+            assertTokenClient(installation, input.clientId);
+            assertActiveInstallation(installation);
+            if (installation.credentialGeneration !== tokenRow.generation) {
+                throw oauthError("invalid_grant", "Refresh token generation was revoked");
+            }
+            await tx
+                .update(appOAuthRefreshTokens)
+                .set({ status: "inactive", revokedAt: now() })
+                .where(eq(appOAuthRefreshTokens.id, tokenRow.id));
+            const tokens = await mintTokens(tx, installation, "app", null, await grantedScopes(tx, installation.id), {
+                rotatedFromId: tokenRow.id,
+            });
+            await audit(tx, installation, "app", "token", "oauth.refresh.rotated", {
+                generation: installation.credentialGeneration,
+            });
+            return tokens;
+        });
+    }
+    async function exchangeActorToken(db, input) {
+        const installation = await requireInstallation(db, input.installationId);
+        assertTokenClient(installation, input.clientId);
+        assertActiveInstallation(installation);
+        const grants = await grantedScopes(db, installation.id);
+        const contextual = input.contextualScopes ?? grants;
+        const scopes = intersectAppTokenScopes(grants, input.viewerScopes, contextual);
+        const accessToken = randomToken(APP_ACCESS_TOKEN_PREFIX);
+        const expiresAt = new Date(now().getTime() + ONLINE_ACCESS_TTL_MS);
+        await db.insert(appAccessCredentials).values({
+            installationId: installation.id,
+            generation: installation.credentialGeneration,
+            tokenMode: "online",
+            credentialHash: sha256Hex(accessToken),
+            encryptedMetadata: { scopeCount: scopes.length },
+            status: "active",
+            actorId: input.viewerId,
+            viewerId: input.viewerId,
+            expiresAt,
+        });
+        await audit(db, installation, input.viewerId, "token", "oauth.actor_token.exchanged", {
+            grantedScopes: scopes,
+        });
+        return tokenResponse(accessToken, null, expiresAt, scopes, "online");
+    }
+    async function mintTokens(db, installation, actorId, viewerId, scopes, refreshOptions = {}) {
+        const accessToken = randomToken(APP_ACCESS_TOKEN_PREFIX);
+        const refreshToken = randomToken(APP_REFRESH_TOKEN_PREFIX);
+        const accessExpiresAt = new Date(now().getTime() + OFFLINE_ACCESS_TTL_MS);
+        const refreshExpiresAt = new Date(now().getTime() + REFRESH_TTL_MS);
+        const generation = installation.credentialGeneration;
+        await db.insert(appAccessCredentials).values({
+            installationId: installation.id,
+            generation,
+            tokenMode: "offline",
+            credentialHash: sha256Hex(accessToken),
+            encryptedMetadata: { scopeCount: scopes.length },
+            status: "active",
+            actorId,
+            viewerId,
+            expiresAt: accessExpiresAt,
+        });
+        await db.insert(appOAuthRefreshTokens).values({
+            installationId: installation.id,
+            tokenHash: sha256Hex(refreshToken),
+            generation,
+            rotatedFromId: refreshOptions.rotatedFromId,
+            expiresAt: refreshExpiresAt,
+        });
+        return tokenResponse(accessToken, refreshToken, accessExpiresAt, scopes, "offline");
+    }
+    function isExpired(expiresAt) {
+        return Boolean(expiresAt && expiresAt <= now());
+    }
+}
+function tokenResponse(accessToken, refreshToken, expiresAt, scopes, tokenMode) {
+    return {
+        accessToken,
+        tokenType: "Bearer",
+        expiresIn: Math.max(0, Math.floor((expiresAt.getTime() - Date.now()) / 1000)),
+        scope: scopes.join(" "),
+        tokenMode,
+        ...(refreshToken ? { refreshToken } : {}),
+    };
+}
+async function authenticateClient(db, appId, clientSecret) {
+    const [secret] = await db
+        .select()
+        .from(appCredentials)
+        .where(and(eq(appCredentials.appId, appId), eq(appCredentials.kind, "client_secret")))
+        .limit(1);
+    if (!secret)
+        return;
+    if (!clientSecret || !secret.kmsKeyRef.startsWith("sha256:")) {
+        throw oauthError("invalid_client", "Client authentication failed", 401);
+    }
+    const expected = secret.kmsKeyRef.slice("sha256:".length);
+    if (!constantTimeEqual(sha256Hex(clientSecret), expected)) {
+        throw oauthError("invalid_client", "Client authentication failed", 401);
+    }
+}
+async function requireRelease(db, appId, releaseId) {
+    const [release] = await db
+        .select()
+        .from(appReleases)
+        .where(and(eq(appReleases.id, releaseId), eq(appReleases.appId, appId)))
+        .limit(1);
+    if (!release)
+        throw oauthError("invalid_request", "App release not found", 404);
+    return release;
+}
+async function requireExactRedirectUri(db, appId, redirectUri) {
+    const [row] = await db
+        .select()
+        .from(appRedirectUris)
+        .where(and(eq(appRedirectUris.appId, appId), eq(appRedirectUris.redirectUri, redirectUri)))
+        .limit(1);
+    if (!row)
+        throw oauthError("invalid_request", "Redirect URI is not registered for this app");
+}
+async function ensureAuthorizedInstallation(db, input) {
+    return db.transaction(async (tx) => {
+        const [app] = await tx.select().from(apps).where(eq(apps.id, input.appId)).limit(1);
+        if (!app)
+            throw oauthError("invalid_request", "App registration not found", 404);
+        const [existing] = await tx
+            .select()
+            .from(appInstallations)
+            .where(and(eq(appInstallations.deploymentId, input.deploymentId), eq(appInstallations.appId, input.appId)))
+            .limit(1);
+        const installation = existing ??
+            (await tx
+                .insert(appInstallations)
+                .values({
+                appId: input.appId,
+                deploymentId: input.deploymentId,
+                releaseId: input.releaseId,
+                status: "active",
+                namespace: app.platformNamespace,
+                installedBy: input.actorId,
+                authorizedAt: new Date(),
+                activatedAt: new Date(),
+            })
+                .returning())[0];
+        if (!installation)
+            throw oauthError("server_error", "Could not create installation", 500);
+        for (const scope of input.grantedScopes) {
+            await tx
+                .insert(appGrants)
+                .values({
+                installationId: installation.id,
+                scope,
+                status: "granted",
+                optional: false,
+                grantedAt: new Date(),
+            })
+                .onConflictDoUpdate({
+                target: [appGrants.installationId, appGrants.scope],
+                set: { status: "granted", grantedAt: new Date(), revokedAt: null },
+            });
+        }
+        for (const scope of input.deniedOptionalScopes) {
+            await tx
+                .insert(appGrants)
+                .values({ installationId: installation.id, scope, status: "optional", optional: true })
+                .onConflictDoUpdate({
+                target: [appGrants.installationId, appGrants.scope],
+                set: { status: "optional", optional: true },
+            });
+        }
+        return installation;
+    });
+}
+async function requireInstallation(db, installationId) {
+    const installation = await selectInstallation(db, installationId);
+    if (!installation)
+        throw oauthError("invalid_grant", "App installation not found", 404);
+    return installation;
+}
+async function selectInstallation(db, installationId) {
+    const [installation] = await db
+        .select()
+        .from(appInstallations)
+        .where(eq(appInstallations.id, installationId))
+        .limit(1);
+    return installation ?? null;
+}
+async function grantedScopes(db, installationId) {
+    const rows = await db
+        .select({ scope: appGrants.scope })
+        .from(appGrants)
+        .where(and(eq(appGrants.installationId, installationId), eq(appGrants.status, "granted")))
+        .orderBy(appGrants.scope);
+    return rows.map((row) => row.scope);
+}
+function assertActiveInstallation(installation) {
+    if (installation.status !== "active") {
+        throw oauthError("invalid_grant", "App installation is not active");
+    }
+}
+function isInstallationUsable(installation, generation) {
+    return installation?.status === "active" && installation.credentialGeneration === generation;
+}
+function assertTokenClient(installation, clientId) {
+    if (installation.appId !== clientId) {
+        throw oauthError("invalid_grant", "Token belongs to a different app");
+    }
+}
+export function intersectAppTokenScopes(...sets) {
+    const [first = [], ...rest] = sets;
+    return first.filter((scope) => rest.every((set) => set.includes(scope))).sort();
+}
+function assertState(state) {
+    if (!state.trim())
+        throw oauthError("invalid_request", "OAuth state is required");
+}
+function oauthError(error, description, status = 400) {
+    return new ApiHttpError(description, { status, code: error });
+}
+async function audit(db, installation, actorId, kind, action, details) {
+    await db.insert(appAuditEvents).values({
+        installationId: installation.id,
+        appId: installation.appId,
+        deploymentId: installation.deploymentId,
+        actorId,
+        kind,
+        action,
+        details,
+    });
+}

package/dist/oauth-service.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/oauth-service.test.js

@@ -0,0 +1,8 @@
+import { describe, expect, it } from "vitest";
+import { intersectAppTokenScopes } from "./oauth-service.js";
+describe("app OAuth online token scope intersection", () => {
+    it("never exceeds either app grants, viewer grants, or contextual restrictions", () => {
+        expect(intersectAppTokenScopes(["bookings:read", "invoices:read"], ["bookings:read", "customers:read"], ["bookings:read", "invoices:read"])).toEqual(["bookings:read"]);
+        expect(intersectAppTokenScopes(["bookings:read"], ["bookings:read", "invoices:read"], ["bookings:read", "invoices:read"])).toEqual(["bookings:read"]);
+    });
+});

package/dist/routes.d.ts

@@ -0,0 +1,17 @@
+import type { AccessCatalog } from "@voyant-travel/types/api-keys";
+import type { PostgresJsDatabase } from "drizzle-orm/postgres-js";
+import { Hono } from "hono";
+import { type AppsServiceOptions } from "./service.js";
+type Env = {
+    Variables: {
+        db: PostgresJsDatabase;
+    };
+};
+export interface AppsAdminRouteOptions extends AppsServiceOptions {
+    oauth?: {
+        accessCatalog: AccessCatalog;
+        deploymentId: string;
+    };
+}
+export declare function createAppsAdminRoutes(options?: AppsAdminRouteOptions): Hono<Env, import("hono/types").BlankSchema, "/">;
+export {};