@voyant-travel/apps 0.2.0 → 0.3.0

package/dist/access-boundary.d.ts

@@ -0,0 +1,29 @@
+import type { PostgresJsDatabase } from "drizzle-orm/postgres-js";
+export interface AppInstallationAccessInput {
+    installationId: string;
+    requiredScopes?: readonly string[];
+}
+export declare function assertActiveAppInstallationAccess(db: PostgresJsDatabase, input: AppInstallationAccessInput): Promise<{
+    id: string;
+    appId: string;
+    deploymentId: string;
+    releaseId: string;
+    status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
+    namespace: string;
+    installedBy: string;
+    credentialGeneration: number;
+    updatePolicy: "manual" | "compatible" | "patch" | "pinned";
+    lastCompatibleReleaseCheckAt: Date | null;
+    pendingReleaseId: string | null;
+    pendingReason: string | null;
+    installedAt: Date;
+    authorizedAt: Date | null;
+    activatedAt: Date | null;
+    pausedAt: Date | null;
+    degradedAt: Date | null;
+    revokedAt: Date | null;
+    uninstalledAt: Date | null;
+    purgedAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+}>;

package/dist/access-boundary.js

@@ -0,0 +1,33 @@
+import { ApiHttpError } from "@voyant-travel/hono";
+import { and, eq } from "drizzle-orm";
+import { appGrants, appInstallations } from "./schema.js";
+export async function assertActiveAppInstallationAccess(db, input) {
+    const [installation] = await db
+        .select()
+        .from(appInstallations)
+        .where(eq(appInstallations.id, input.installationId))
+        .limit(1);
+    if (installation?.status !== "active") {
+        throw new ApiHttpError("App installation is not active", {
+            status: 403,
+            code: "app_installation_not_active",
+        });
+    }
+    const required = new Set(input.requiredScopes ?? []);
+    if (required.size === 0)
+        return installation;
+    const grants = await db
+        .select({ scope: appGrants.scope })
+        .from(appGrants)
+        .where(and(eq(appGrants.installationId, installation.id), eq(appGrants.status, "granted")));
+    for (const grant of grants)
+        required.delete(grant.scope);
+    if (required.size > 0) {
+        throw new ApiHttpError("App installation is missing required scopes", {
+            status: 403,
+            code: "app_installation_scope_missing",
+            details: { scopes: [...required].sort() },
+        });
+    }
+    return installation;
+}

package/dist/consent.d.ts

@@ -0,0 +1,15 @@
+import type { AccessCatalog } from "@voyant-travel/types/api-keys";
+import type { AppRelease } from "./schema.js";
+export interface ConsentComputationInput {
+    release: AppRelease;
+    accessCatalog: AccessCatalog;
+    operatorGrantedScopes: readonly string[];
+    grantedOptionalScopes?: readonly string[];
+}
+export interface ComputedConsent {
+    requiredScopes: string[];
+    optionalScopes: string[];
+    grantedScopes: string[];
+    deniedOptionalScopes: string[];
+}
+export declare function computeAppConsent(input: ConsentComputationInput): ComputedConsent;

package/dist/consent.js

@@ -0,0 +1,50 @@
+import { ApiHttpError } from "@voyant-travel/hono";
+export function computeAppConsent(input) {
+    const normalized = parseReleaseScopes(input.release.normalizedRecord);
+    const remoteSafe = remoteSafeScopes(input.accessCatalog);
+    const operatorGranted = new Set(input.operatorGrantedScopes);
+    const optionalGrantRequest = new Set(input.grantedOptionalScopes ?? []);
+    const requiredScopes = normalized.requestedScopes.filter((scope) => canGrantScope(scope, remoteSafe, operatorGranted));
+    const missingRequired = normalized.requestedScopes.filter((scope) => !requiredScopes.includes(scope));
+    if (missingRequired.length > 0) {
+        throw new ApiHttpError("Required app scopes are not grantable for remote apps", {
+            status: 403,
+            code: "app_required_scope_not_grantable",
+            details: { scopes: missingRequired },
+        });
+    }
+    const optionalScopes = normalized.optionalScopes.filter((scope) => canGrantScope(scope, remoteSafe, operatorGranted));
+    const grantedOptional = optionalScopes.filter((scope) => optionalGrantRequest.has(scope));
+    const deniedOptionalScopes = normalized.optionalScopes.filter((scope) => !grantedOptional.includes(scope));
+    const grantedScopes = Array.from(new Set([...requiredScopes, ...grantedOptional])).sort();
+    return {
+        requiredScopes: requiredScopes.sort(),
+        optionalScopes: optionalScopes.sort(),
+        grantedScopes,
+        deniedOptionalScopes: deniedOptionalScopes.sort(),
+    };
+}
+function canGrantScope(scope, remoteSafe, operatorGranted) {
+    return remoteSafe.has(scope) && operatorGranted.has(scope);
+}
+function remoteSafeScopes(catalog) {
+    const catalogScopes = new Set(catalog.resources.flatMap((resource) => resource.actions.map((action) => `${resource.resource}:${action.action}`)));
+    const presetScopes = catalog.presets
+        .filter((preset) => preset.kind === "api-token-grant" && Boolean(preset.audience))
+        .flatMap((preset) => preset.grants);
+    return new Set(presetScopes.filter((scope) => catalogScopes.has(scope)));
+}
+function parseReleaseScopes(value) {
+    if (!value || typeof value !== "object")
+        return { requestedScopes: [], optionalScopes: [] };
+    const record = value;
+    return {
+        requestedScopes: stringArray(record.requestedScopes),
+        optionalScopes: stringArray(record.optionalScopes),
+    };
+}
+function stringArray(value) {
+    return Array.isArray(value)
+        ? Array.from(new Set(value.filter((item) => typeof item === "string"))).sort()
+        : [];
+}

package/dist/consent.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/consent.test.js

@@ -0,0 +1,80 @@
+import { describe, expect, it } from "vitest";
+import { computeAppConsent } from "./consent.js";
+const catalog = {
+    resources: [
+        {
+            id: "bookings",
+            unitId: "bookings",
+            resource: "bookings",
+            label: "Bookings",
+            description: "Bookings",
+            wildcard: "allow",
+            actions: [{ action: "read", label: "Read", description: "Read" }],
+        },
+        {
+            id: "invoices",
+            unitId: "finance",
+            resource: "invoices",
+            label: "Invoices",
+            description: "Invoices",
+            wildcard: "allow",
+            actions: [{ action: "read", label: "Read", description: "Read" }],
+        },
+    ],
+    presets: [
+        {
+            id: "remote-safe",
+            kind: "api-token-grant",
+            audience: "staff",
+            label: "Remote safe",
+            description: "Remote app grants",
+            grants: ["bookings:read"],
+        },
+    ],
+};
+function release(requestedScopes, optionalScopes) {
+    return {
+        id: "release_1",
+        appId: "app_1",
+        releaseVersion: "1.0.0",
+        manifestSchemaVersion: "voyant.app-manifest.v1",
+        manifestDigest: "digest",
+        manifestSnapshot: {},
+        normalizedRecord: {
+            schemaVersion: "voyant.app-release.normalized.v1",
+            releaseVersion: "1.0.0",
+            digest: "digest",
+            requestedScopes,
+            optionalScopes,
+            adminPages: [],
+            slotExtensions: [],
+            webhooks: [],
+            customFields: [],
+        },
+        apiCompatibility: { min: "2026-01-01", max: "2026-12-31" },
+        defaultLocale: "en-US",
+        supportedLocales: ["en-US"],
+        state: "available",
+        createdBy: "user_1",
+        createdAt: new Date(),
+    };
+}
+describe("app OAuth consent computation", () => {
+    it("grants only scopes present in the catalog, remote-safe, and operator-granted", () => {
+        const consent = computeAppConsent({
+            release: release(["bookings:read"], ["invoices:read"]),
+            accessCatalog: catalog,
+            operatorGrantedScopes: ["bookings:read", "invoices:read"],
+            grantedOptionalScopes: ["invoices:read"],
+        });
+        expect(consent.grantedScopes).toEqual(["bookings:read"]);
+        expect(consent.deniedOptionalScopes).toEqual(["invoices:read"]);
+    });
+    it("rejects required scopes that are absent, unsafe, or not operator-granted", () => {
+        expect(() => computeAppConsent({
+            release: release(["invoices:read"], []),
+            accessCatalog: catalog,
+            operatorGrantedScopes: ["invoices:read"],
+        })).toThrow("Required app scopes are not grantable");
+    });
+});

package/dist/contracts.d.ts

@@ -176,9 +176,88 @@ export declare const appWebhookReplaySchema: z.ZodObject<{
     signingKeyId: z.ZodString;
     signingSecret: z.ZodString;
 }, z.core.$strict>;
+export declare const appOAuthAuthorizeQuerySchema: z.ZodObject<{
+    response_type: z.ZodLiteral<"code">;
+    client_id: z.ZodString;
+    release_id: z.ZodString;
+    redirect_uri: z.ZodString;
+    state: z.ZodString;
+    code_challenge: z.ZodString;
+    code_challenge_method: z.ZodLiteral<"S256">;
+    actor_id: z.ZodString;
+    operator_scopes: z.ZodDefault<z.ZodString>;
+    optional_scopes: z.ZodDefault<z.ZodString>;
+}, z.core.$strict>;
+export declare const appOAuthTokenSchema: z.ZodPipe<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    grant_type: z.ZodLiteral<"authorization_code">;
+    code: z.ZodString;
+    redirect_uri: z.ZodString;
+    code_verifier: z.ZodString;
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    grant_type: z.ZodLiteral<"refresh_token">;
+    refresh_token: z.ZodString;
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    grant_type: z.ZodLiteral<"urn:voyant:params:oauth:grant-type:actor-token-exchange">;
+    installation_id: z.ZodString;
+    viewer_id: z.ZodString;
+    viewer_scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    contextual_scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "grant_type">, z.ZodTransform<{
+    client_secret: string | undefined;
+    grant_type: "authorization_code";
+    code: string;
+    redirect_uri: string;
+    code_verifier: string;
+    client_id: string;
+} | {
+    client_secret: string | undefined;
+    grant_type: "refresh_token";
+    refresh_token: string;
+    client_id: string;
+} | {
+    client_secret: string | undefined;
+    grant_type: "urn:voyant:params:oauth:grant-type:actor-token-exchange";
+    installation_id: string;
+    viewer_id: string;
+    viewer_scopes: string[];
+    client_id: string;
+    contextual_scopes?: string[] | undefined;
+}, {
+    grant_type: "authorization_code";
+    code: string;
+    redirect_uri: string;
+    code_verifier: string;
+    client_id: string;
+    client_secret?: string | undefined;
+} | {
+    grant_type: "refresh_token";
+    refresh_token: string;
+    client_id: string;
+    client_secret?: string | undefined;
+} | {
+    grant_type: "urn:voyant:params:oauth:grant-type:actor-token-exchange";
+    installation_id: string;
+    viewer_id: string;
+    viewer_scopes: string[];
+    client_id: string;
+    contextual_scopes?: string[] | undefined;
+    client_secret?: string | undefined;
+}>>;
+export declare const appCredentialRevocationSchema: z.ZodObject<{
+    installationId: z.ZodString;
+    actorId: z.ZodString;
+}, z.core.$strict>;
 export type AppManifest = z.infer<typeof appManifestSchema>;
 export type CreateCustomAppRegistrationInput = z.infer<typeof createCustomAppRegistrationSchema>;
 export type ReleaseManifestUploadInput = z.infer<typeof releaseManifestUploadSchema>;
 export type ReleaseManifestFetchInput = z.infer<typeof releaseManifestFetchSchema>;
 export type AppListQuery = z.infer<typeof appListQuerySchema>;
 export type AppWebhookReplayInput = z.infer<typeof appWebhookReplaySchema>;
+export type AppOAuthAuthorizeQuery = z.infer<typeof appOAuthAuthorizeQuerySchema>;
+export type AppOAuthTokenInput = z.infer<typeof appOAuthTokenSchema>;

package/dist/contracts.js

@@ -221,3 +221,53 @@ export const appWebhookReplaySchema = z
     signingSecret: z.string().min(32),
 })
     .strict();
+export const appOAuthAuthorizeQuerySchema = z
+    .object({
+    response_type: z.literal("code"),
+    client_id: z.string().trim().min(1),
+    release_id: z.string().trim().min(1),
+    redirect_uri: z.string().url(),
+    state: z.string().trim().min(1),
+    code_challenge: z.string().trim().min(1),
+    code_challenge_method: z.literal("S256"),
+    actor_id: z.string().trim().min(1),
+    operator_scopes: z.string().trim().default(""),
+    optional_scopes: z.string().trim().default(""),
+})
+    .strict();
+export const appOAuthTokenSchema = z
+    .discriminatedUnion("grant_type", [
+    z.object({
+        grant_type: z.literal("authorization_code"),
+        code: z.string().trim().min(1),
+        redirect_uri: z.string().url(),
+        code_verifier: z.string().trim().min(43).max(128),
+        client_id: z.string().trim().min(1),
+        client_secret: z.string().trim().optional(),
+    }),
+    z.object({
+        grant_type: z.literal("refresh_token"),
+        refresh_token: z.string().trim().min(1),
+        client_id: z.string().trim().min(1),
+        client_secret: z.string().trim().optional(),
+    }),
+    z.object({
+        grant_type: z.literal("urn:voyant:params:oauth:grant-type:actor-token-exchange"),
+        installation_id: z.string().trim().min(1),
+        viewer_id: z.string().trim().min(1),
+        viewer_scopes: z.array(scopeSchema).default([]),
+        contextual_scopes: z.array(scopeSchema).optional(),
+        client_id: z.string().trim().min(1),
+        client_secret: z.string().trim().optional(),
+    }),
+])
+    .transform((input) => ({
+    ...input,
+    client_secret: input.client_secret?.trim() || undefined,
+}));
+export const appCredentialRevocationSchema = z
+    .object({
+    installationId: z.string().trim().min(1),
+    actorId: z.string().trim().min(1),
+})
+    .strict();

package/dist/index.d.ts

@@ -1,9 +1,13 @@
+export * from "./access-boundary.js";
 export * from "./compiler.js";
+export * from "./consent.js";
 export * from "./contracts.js";
 export * from "./ingestion.js";
 export * from "./installation-service.js";
+export * from "./oauth-crypto.js";
+export * from "./oauth-service.js";
 export { createAppsAdminRoutes } from "./routes.js";
-export { appAccessCredentialStatusEnum, appAccessCredentials, appAuditEventKindEnum, appAuditEvents, appCredentialKindEnum, appCredentials, appDistributionEnum, appExtensionInstallations, appGrantStatusEnum, appGrants, appInstallationRegistrationStatusEnum, appInstallationSettings, appInstallationStatusEnum, appInstallations, appInstallationUpdatePolicyEnum, appLifecycleStateEnum, appRedirectUris, appReleaseArtifactStateEnum, appReleaseArtifacts, appReleaseLocalizations, appReleaseStateEnum, appReleases, appSecretReferences, apps, appWebhookSubscriptionStatusEnum, appWebhookSubscriptions, } from "./schema.js";
+export { appAccessCredentialStatusEnum, appAccessCredentials, appAccessTokenModeEnum, appAuditEventKindEnum, appAuditEvents, appCredentialKindEnum, appCredentials, appDistributionEnum, appExtensionInstallations, appGrantStatusEnum, appGrants, appInstallationRegistrationStatusEnum, appInstallationSettings, appInstallationStatusEnum, appInstallations, appInstallationUpdatePolicyEnum, appLifecycleStateEnum, appOAuthAuthorizationCodes, appOAuthRefreshTokens, appRedirectUris, appReleaseArtifactStateEnum, appReleaseArtifacts, appReleaseLocalizations, appReleaseStateEnum, appReleases, appSecretReferences, apps, appWebhookSubscriptionStatusEnum, appWebhookSubscriptions, } from "./schema.js";
 export { createAppsService } from "./service.js";
 export type { AppWebhookDeliveryOptions } from "./webhook-delivery.js";
 export { createAppWebhookDeliveryStore, createAppWebhookEventQueue, enqueueAppWebhookEvent, listAppWebhookHealth, replayAppWebhookDelivery, } from "./webhook-delivery.js";

package/dist/index.js

@@ -1,8 +1,12 @@
+export * from "./access-boundary.js";
 export * from "./compiler.js";
+export * from "./consent.js";
 export * from "./contracts.js";
 export * from "./ingestion.js";
 export * from "./installation-service.js";
+export * from "./oauth-crypto.js";
+export * from "./oauth-service.js";
 export { createAppsAdminRoutes } from "./routes.js";
-export { appAccessCredentialStatusEnum, appAccessCredentials, appAuditEventKindEnum, appAuditEvents, appCredentialKindEnum, appCredentials, appDistributionEnum, appExtensionInstallations, appGrantStatusEnum, appGrants, appInstallationRegistrationStatusEnum, appInstallationSettings, appInstallationStatusEnum, appInstallations, appInstallationUpdatePolicyEnum, appLifecycleStateEnum, appRedirectUris, appReleaseArtifactStateEnum, appReleaseArtifacts, appReleaseLocalizations, appReleaseStateEnum, appReleases, appSecretReferences, apps, appWebhookSubscriptionStatusEnum, appWebhookSubscriptions, } from "./schema.js";
+export { appAccessCredentialStatusEnum, appAccessCredentials, appAccessTokenModeEnum, appAuditEventKindEnum, appAuditEvents, appCredentialKindEnum, appCredentials, appDistributionEnum, appExtensionInstallations, appGrantStatusEnum, appGrants, appInstallationRegistrationStatusEnum, appInstallationSettings, appInstallationStatusEnum, appInstallations, appInstallationUpdatePolicyEnum, appLifecycleStateEnum, appOAuthAuthorizationCodes, appOAuthRefreshTokens, appRedirectUris, appReleaseArtifactStateEnum, appReleaseArtifacts, appReleaseLocalizations, appReleaseStateEnum, appReleases, appSecretReferences, apps, appWebhookSubscriptionStatusEnum, appWebhookSubscriptions, } from "./schema.js";
 export { createAppsService } from "./service.js";
 export { createAppWebhookDeliveryStore, createAppWebhookEventQueue, enqueueAppWebhookEvent, listAppWebhookHealth, replayAppWebhookDelivery, } from "./webhook-delivery.js";

package/dist/installation-reconciliation.d.ts

@@ -14,5 +14,5 @@ export declare function deactivateRuntimeState(db: PostgresJsDatabase, installat
 export declare function deactivateResolvedRegistrations(db: PostgresJsDatabase, installation: AppInstallation): Promise<void>;
 export declare function markAppDefinitionsInactive(db: PostgresJsDatabase, installation: AppInstallation, actorId: string): Promise<void>;
 export declare function countInstallationRows(db: PostgresJsDatabase, table: typeof appGrants | typeof appAccessCredentials | typeof appExtensionInstallations | typeof appWebhookSubscriptions, installationId: string): Promise<number>;
-export declare function audit(db: PostgresJsDatabase, installation: AppInstallation, actorId: string, kind: "lifecycle" | "grant" | "credential" | "reconciliation" | "purge", action: string, details: Record<string, unknown>): Promise<void>;
+export declare function audit(db: PostgresJsDatabase, installation: AppInstallation, actorId: string, kind: "lifecycle" | "grant" | "consent" | "credential" | "token" | "reconciliation" | "purge", action: string, details: Record<string, unknown>): Promise<void>;
 export {};

package/dist/installation-reconciliation.js

@@ -1,7 +1,7 @@
 import { createAppCustomFieldDefinitionOwner, customFieldDefinitions, } from "@voyant-travel/custom-fields";
 import { ApiHttpError } from "@voyant-travel/hono";
 import { and, eq, sql } from "drizzle-orm";
-import { appAccessCredentials, appAuditEvents, appExtensionInstallations, appGrants, appWebhookSubscriptions, } from "./schema.js";
+import { appAccessCredentials, appAuditEvents, appExtensionInstallations, appGrants, appOAuthRefreshTokens, appWebhookSubscriptions, } from "./schema.js";
 export async function reconcileRelease(db, installation, release, actorId, action, options) {
     const normalized = parseNormalizedRelease(release.normalizedRecord);
     await reconcileCustomFields(db, installation, release, normalized, actorId, options);
@@ -78,6 +78,10 @@ export async function deactivateRuntimeState(db, installation) {
         .update(appAccessCredentials)
         .set({ status: "inactive", deactivatedAt: now })
         .where(eq(appAccessCredentials.installationId, installation.id));
+    await db
+        .update(appOAuthRefreshTokens)
+        .set({ status: "revoked", revokedAt: now })
+        .where(eq(appOAuthRefreshTokens.installationId, installation.id));
     await deactivateResolvedRegistrations(db, installation);
 }
 export async function deactivateResolvedRegistrations(db, installation) {

package/dist/installation-service.d.ts

@@ -58,6 +58,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;
@@ -76,15 +77,16 @@ export declare function createAppInstallationService(options?: AppInstallationSe
         outcome: "unchanged";
     } | {
         installation: {
-            status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             id: string;
             createdAt: Date;
             updatedAt: Date;
             appId: string;
             releaseId: string;
             deploymentId: string;
+            status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;
@@ -109,6 +111,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;
@@ -135,6 +138,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;
@@ -162,6 +166,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;
@@ -187,6 +192,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;
@@ -213,6 +219,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;
@@ -238,6 +245,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;
@@ -264,6 +272,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;
@@ -289,6 +298,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;
@@ -315,6 +325,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;

package/dist/installation-service.js

@@ -1,5 +1,5 @@
 import { ApiHttpError } from "@voyant-travel/hono";
-import { and, eq } from "drizzle-orm";
+import { and, eq, sql } from "drizzle-orm";
 import { audit, countInstallationRows, deactivateResolvedRegistrations, deactivateRuntimeState, markAppDefinitionsInactive, newlyRequiredScopes, reconcileGrants, reconcileRelease, rotateCredential, } from "./installation-reconciliation.js";
 import { canInstallOver, invalidTransition, planLifecycleTransition } from "./installation-state.js";
 import { appAccessCredentials, appExtensionInstallations, appGrants, appInstallations, appReleases, apps, appWebhookSubscriptions, } from "./schema.js";
@@ -295,14 +295,29 @@ function lifecyclePatch(to, now) {
     const base = { status: to, updatedAt: now };
     if (to === "active")
         return { ...base, activatedAt: now };
-    if (to === "paused")
-        return { ...base, pausedAt: now };
+    if (to === "paused") {
+        return {
+            ...base,
+            pausedAt: now,
+            credentialGeneration: sql `${appInstallations.credentialGeneration} + 1`,
+        };
+    }
     if (to === "degraded")
         return { ...base, degradedAt: now };
-    if (to === "revoked")
-        return { ...base, revokedAt: now };
-    if (to === "uninstalled")
-        return { ...base, uninstalledAt: now };
+    if (to === "revoked") {
+        return {
+            ...base,
+            revokedAt: now,
+            credentialGeneration: sql `${appInstallations.credentialGeneration} + 1`,
+        };
+    }
+    if (to === "uninstalled") {
+        return {
+            ...base,
+            uninstalledAt: now,
+            credentialGeneration: sql `${appInstallations.credentialGeneration} + 1`,
+        };
+    }
     return base;
 }
 function writeFailed() {

package/dist/oauth-crypto.d.ts

@@ -0,0 +1,8 @@
+export declare const APP_ACCESS_TOKEN_PREFIX = "vapp_";
+export declare const APP_REFRESH_TOKEN_PREFIX = "vappr_";
+export declare const APP_AUTH_CODE_PREFIX = "vappc_";
+export declare function randomToken(prefix: string, bytes?: number): string;
+export declare function sha256Hex(value: string): string;
+export declare function sha256Base64Url(value: string): string;
+export declare function constantTimeEqual(left: string, right: string): boolean;
+export declare function verifyPkceS256(verifier: string, challenge: string): boolean;

package/dist/oauth-crypto.js

@@ -0,0 +1,23 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+export const APP_ACCESS_TOKEN_PREFIX = "vapp_";
+export const APP_REFRESH_TOKEN_PREFIX = "vappr_";
+export const APP_AUTH_CODE_PREFIX = "vappc_";
+export function randomToken(prefix, bytes = 32) {
+    return `${prefix}${randomBytes(bytes).toString("base64url")}`;
+}
+export function sha256Hex(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+export function sha256Base64Url(value) {
+    return createHash("sha256").update(value).digest("base64url");
+}
+export function constantTimeEqual(left, right) {
+    const leftHash = Buffer.from(sha256Hex(left), "hex");
+    const rightHash = Buffer.from(sha256Hex(right), "hex");
+    return timingSafeEqual(leftHash, rightHash);
+}
+export function verifyPkceS256(verifier, challenge) {
+    if (!/^[A-Za-z0-9._~-]{43,128}$/.test(verifier))
+        return false;
+    return constantTimeEqual(sha256Base64Url(verifier), challenge);
+}

package/dist/oauth-crypto.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/oauth-crypto.test.js

@@ -0,0 +1,11 @@
+import { describe, expect, it } from "vitest";
+import { sha256Base64Url, verifyPkceS256 } from "./oauth-crypto.js";
+describe("app OAuth PKCE", () => {
+    it("accepts only S256 challenges derived from the verifier", () => {
+        const verifier = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ_0123456789-1234567890";
+        const challenge = sha256Base64Url(verifier);
+        expect(verifyPkceS256(verifier, challenge)).toBe(true);
+        expect(verifyPkceS256(`${verifier}x`, challenge)).toBe(false);
+        expect(verifyPkceS256("too-short", challenge)).toBe(false);
+    });
+});