@voyant-travel/apps 0.2.0 → 0.4.0

package/dist/app-api-service.js

@@ -0,0 +1,244 @@
+import { createAppCustomFieldDefinitionOwner, createCustomFieldsService, } from "@voyant-travel/custom-fields";
+import { ApiHttpError } from "@voyant-travel/hono";
+import { and, asc, eq, sql } from "drizzle-orm";
+import { assertActiveAppInstallationAccess } from "./access-boundary.js";
+import { APP_API_VERSION } from "./app-api-contracts.js";
+import { appAuditEvents, appGrants, appReleases, appWebhookSubscriptions } from "./schema.js";
+const DEFAULT_RATE_LIMIT = { installationLimit: 120, appLimit: 600, windowMs: 60_000 };
+const REMOTE_APP_NAMESPACE = /^\$app(?::[a-z][a-z0-9-]*)?$/;
+const PHYSICAL_APP_NAMESPACE = /^app--/;
+const buckets = new Map();
+export function createAppApiService(options = {}) {
+    const now = () => options.now?.() ?? new Date();
+    const customFields = options.customFieldTargets &&
+        createCustomFieldsService(options.customFieldTargets, options.customFieldValueLifecycles ?? [], options.customFieldValueOperations ?? []);
+    async function introspect(db, context) {
+        const access = await requireAccess(db, context, ["app-installation:read"]);
+        const grants = await db
+            .select({
+            scope: appGrants.scope,
+            status: appGrants.status,
+            optional: appGrants.optional,
+        })
+            .from(appGrants)
+            .where(eq(appGrants.installationId, context.installationId))
+            .orderBy(appGrants.scope);
+        return {
+            data: {
+                installation: {
+                    id: access.installation.id,
+                    appId: access.installation.appId,
+                    status: access.installation.status,
+                    namespace: access.installation.namespace,
+                    deploymentId: access.installation.deploymentId,
+                },
+                release: {
+                    id: access.release.id,
+                    version: access.release.releaseVersion,
+                    apiCompatibility: access.release.apiCompatibility,
+                },
+                grants,
+            },
+        };
+    }
+    async function listEntities(db, context, entity, query) {
+        await requireAccess(db, context, [`${entity}:read`]);
+        const reader = options.entityReaders?.[entity];
+        if (!reader)
+            throw notSupported(`Entity "${entity}" is not supported by the App API.`);
+        return { data: await reader.list(db, query) };
+    }
+    async function listFinanceDocuments(db, context, query) {
+        await requireAccess(db, context, ["finance-documents:read"]);
+        if (!options.finance)
+            throw notSupported("Finance App API runtime is not configured.");
+        return { data: await options.finance.listDocuments(db, query) };
+    }
+    async function executeFinanceAction(db, context, input) {
+        await requireAccess(db, context, [`finance-actions:${input.action}`]);
+        if (!options.finance)
+            throw notSupported("Finance App API runtime is not configured.");
+        if (!input.approvalId) {
+            throw new ApiHttpError("Finance action requires action-ledger approval.", {
+                status: 403,
+                code: "app_api_finance_approval_required",
+            });
+        }
+        return { data: await options.finance.executeAction(db, input) };
+    }
+    async function listCustomFieldDefinitions(db, context, query) {
+        const access = await requireAccess(db, context, ["custom-field-definitions:read"]);
+        return customFieldsRequired().listForOwner(db, owner(access), query);
+    }
+    async function createCustomFieldDefinition(db, context, namespace, input) {
+        assertAppNamespaceAlias(namespace);
+        const access = await requireAccess(db, context, ["custom-field-definitions:write"]);
+        return { data: await customFieldsRequired().createForOwner(db, owner(access), input) };
+    }
+    async function updateCustomFieldDefinition(db, context, id, namespace, input) {
+        assertAppNamespaceAlias(namespace);
+        const access = await requireAccess(db, context, ["custom-field-definitions:write"]);
+        const data = await customFieldsRequired().updateForOwner(db, owner(access), id, input);
+        if (!data)
+            throw notFound("Custom-field definition not found.");
+        return { data };
+    }
+    async function listCustomFieldValues(db, context, query) {
+        await requireAccess(db, context, [`custom-field-values:${query.entityType ?? "read"}`]);
+        const access = await requireAccess(db, context, ["custom-field-values:read"]);
+        return customFieldsRequired().values.listForOwner(db, owner(access), query);
+    }
+    async function upsertCustomFieldValue(db, context, definitionId, input) {
+        await requireAccess(db, context, [
+            "custom-field-values:write",
+            `custom-field-values:${input.entityType}`,
+        ]);
+        const access = await requireAccess(db, context, []);
+        return {
+            data: await customFieldsRequired().values.upsertForOwner(db, owner(access), definitionId, input),
+        };
+    }
+    async function listWebhookHealth(db, context) {
+        await requireAccess(db, context, ["webhooks:read"]);
+        const data = await db
+            .select()
+            .from(appWebhookSubscriptions)
+            .where(eq(appWebhookSubscriptions.installationId, context.installationId))
+            .orderBy(asc(appWebhookSubscriptions.eventType));
+        return { data };
+    }
+    async function listAuditHistory(db, context, query) {
+        await requireAccess(db, context, ["app-audit:read"]);
+        const where = and(eq(appAuditEvents.appId, context.appId), eq(appAuditEvents.installationId, context.installationId));
+        const [data, count] = await Promise.all([
+            db.select().from(appAuditEvents).where(where).limit(query.limit).offset(query.offset),
+            db.select({ count: sql `count(*)::int` }).from(appAuditEvents).where(where),
+        ]);
+        return { data, total: count[0]?.count ?? 0, limit: query.limit, offset: query.offset };
+    }
+    return {
+        introspect,
+        listEntities,
+        listFinanceDocuments,
+        executeFinanceAction,
+        listCustomFieldDefinitions,
+        createCustomFieldDefinition,
+        updateCustomFieldDefinition,
+        listCustomFieldValues,
+        upsertCustomFieldValue,
+        listWebhookHealth,
+        listAuditHistory,
+        requireAccess,
+        enforceRateLimit,
+    };
+    async function requireAccess(db, context, requiredScopes) {
+        enforceRateLimit(context);
+        // The token's own scopes are the authority: for online tokens this is the
+        // narrowed viewer/context intersection minted at exchange, so an endpoint
+        // must not be reachable just because the installation was granted its
+        // scope. The installation-grant check below stays as defense in depth.
+        const tokenScopes = new Set(context.scopes);
+        const missingFromToken = requiredScopes.filter((scope) => !tokenScopes.has(scope));
+        if (missingFromToken.length > 0) {
+            throw new ApiHttpError("App token is missing required scopes", {
+                status: 403,
+                code: "app_api_token_scope_missing",
+                details: { scopes: [...missingFromToken].sort() },
+            });
+        }
+        const installation = await assertActiveAppInstallationAccess(db, {
+            installationId: context.installationId,
+            requiredScopes,
+        });
+        if (installation.appId !== context.appId || installation.releaseId !== context.releaseId) {
+            throw new ApiHttpError("App token does not match the active installation.", {
+                status: 403,
+                code: "app_api_token_installation_mismatch",
+            });
+        }
+        const [release] = await db
+            .select()
+            .from(appReleases)
+            .where(eq(appReleases.id, installation.releaseId))
+            .limit(1);
+        if (!release)
+            throw notFound("Installed app release not found.");
+        assertCompatibleVersion(context.apiVersion ?? APP_API_VERSION, release.apiCompatibility);
+        return { installation, release };
+    }
+    function enforceRateLimit(context) {
+        const policy = options.rateLimit ?? DEFAULT_RATE_LIMIT;
+        hit(`installation:${context.installationId}`, policy.installationLimit, policy.windowMs);
+        hit(`app:${context.appId}`, policy.appLimit, policy.windowMs);
+    }
+    function hit(key, limit, windowMs) {
+        const timestamp = now().getTime();
+        const bucket = buckets.get(key);
+        if (!bucket || bucket.resetAt <= timestamp) {
+            buckets.set(key, { count: 1, resetAt: timestamp + windowMs });
+            return;
+        }
+        if (bucket.count >= limit) {
+            throw new ApiHttpError("App API rate limit exceeded.", {
+                status: 429,
+                code: "app_api_rate_limited",
+                details: { key, resetAt: new Date(bucket.resetAt).toISOString() },
+            });
+        }
+        bucket.count += 1;
+    }
+    function owner(access) {
+        return createAppCustomFieldDefinitionOwner({
+            appId: access.installation.appId,
+            namespace: access.installation.namespace,
+        });
+    }
+    function customFieldsRequired() {
+        if (!customFields)
+            throw notSupported("Custom fields App API runtime is not configured.");
+        return customFields;
+    }
+}
+export function assertAppNamespaceAlias(namespace) {
+    if (!namespace || namespace === "$app")
+        return;
+    if (PHYSICAL_APP_NAMESPACE.test(namespace) || !REMOTE_APP_NAMESPACE.test(namespace)) {
+        throw new ApiHttpError("App APIs accept only the server-resolved $app namespace alias.", {
+            status: 400,
+            code: "app_api_invalid_custom_field_namespace",
+        });
+    }
+}
+export function assertCompatibleVersion(requested, range) {
+    if (requested < range.min || requested > range.max) {
+        throw new ApiHttpError("Requested App API version is outside the installed release range.", {
+            status: 426,
+            code: "app_api_version_out_of_range",
+            details: { requested, supported: range },
+        });
+    }
+}
+export async function withAppApiDeadline(promise, timeoutMs = 5_000) {
+    let timeout;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise((_, reject) => {
+                timeout = setTimeout(() => reject(new ApiHttpError("App API request deadline exceeded.", {
+                    status: 504,
+                    code: "app_api_deadline_exceeded",
+                })), timeoutMs);
+            }),
+        ]);
+    }
+    finally {
+        if (timeout)
+            clearTimeout(timeout);
+    }
+}
+function notSupported(message) {
+    return new ApiHttpError(message, { status: 501, code: "app_api_not_configured" });
+}
+function notFound(message) {
+    return new ApiHttpError(message, { status: 404, code: "not_found" });
+}

package/dist/app-api-service.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/app-api-service.test.js

@@ -0,0 +1,109 @@
+import { ApiHttpError } from "@voyant-travel/hono";
+import { describe, expect, it, vi } from "vitest";
+import { assertAppNamespaceAlias, assertCompatibleVersion, createAppApiService, } from "./app-api-service.js";
+import { appGrants, appInstallations, appReleases } from "./schema.js";
+function postgresStub(implementation) {
+    const db = Object.create(null);
+    Object.assign(db, implementation);
+    return db;
+}
+function createAccessDb(options) {
+    const installation = {
+        id: "inst_1",
+        appId: "app_1",
+        deploymentId: "dep_1",
+        releaseId: "rel_1",
+        status: options.status ?? "active",
+        namespace: "app--one",
+    };
+    const release = {
+        id: "rel_1",
+        appId: "app_1",
+        releaseVersion: "1.0.0",
+        apiCompatibility: options.releaseRange ?? { min: "2026-07-01", max: "2026-12-31" },
+    };
+    return postgresStub({
+        select: () => ({
+            from: (table) => ({
+                where: () => {
+                    const rows = () => {
+                        if (table === appInstallations)
+                            return [installation];
+                        if (table === appReleases)
+                            return [release];
+                        if (table === appGrants)
+                            return (options.scopes ?? []).map((scope) => ({ scope }));
+                        return [];
+                    };
+                    return {
+                        // biome-ignore lint/suspicious/noThenProperty: test stub models Drizzle's awaitable query builder -- owner: apps.
+                        then: (resolve) => Promise.resolve(rows()).then(resolve),
+                        orderBy: async () => rows(),
+                        limit: async () => rows(),
+                    };
+                },
+            }),
+        }),
+    });
+}
+const context = {
+    appId: "app_1",
+    installationId: "inst_1",
+    releaseId: "rel_1",
+    tokenMode: "offline",
+    scopes: [],
+    apiVersion: "2026-07-01",
+};
+describe("App API service boundary", () => {
+    it("rejects direct service calls when the installation is inactive", async () => {
+        const service = createAppApiService();
+        await expect(service.requireAccess(createAccessDb({ status: "paused", scopes: ["app-installation:read"] }), { ...context, scopes: ["app-installation:read"] }, ["app-installation:read"])).rejects.toMatchObject({ status: 403, code: "app_installation_not_active" });
+    });
+    it("rejects when the installation grant is missing even if the token carries the scope", async () => {
+        const service = createAppApiService();
+        await expect(service.requireAccess(createAccessDb({ scopes: [] }), { ...context, scopes: ["app-installation:read"] }, ["app-installation:read"])).rejects.toMatchObject({ status: 403, code: "app_installation_scope_missing" });
+    });
+    it("rejects when a narrowed online token lacks the scope the installation was granted", async () => {
+        const service = createAppApiService();
+        await expect(service.requireAccess(createAccessDb({ scopes: ["app-installation:read", "finance-documents:read"] }), { ...context, tokenMode: "online", scopes: ["app-installation:read"] }, ["finance-documents:read"])).rejects.toMatchObject({ status: 403, code: "app_api_token_scope_missing" });
+    });
+    it("fails closed when the requested API version is outside the installed release range", async () => {
+        const service = createAppApiService();
+        await expect(service.requireAccess(createAccessDb({
+            scopes: ["app-installation:read"],
+            releaseRange: { min: "2026-08-01", max: "2026-12-31" },
+        }), { ...context, scopes: ["app-installation:read"] }, ["app-installation:read"])).rejects.toMatchObject({ status: 426, code: "app_api_version_out_of_range" });
+    });
+    it("requires action-ledger approval for finance actions even when OAuth scope is granted", async () => {
+        const executeAction = vi.fn();
+        const service = createAppApiService({
+            finance: { listDocuments: vi.fn(), executeAction },
+        });
+        await expect(service.executeFinanceAction(createAccessDb({ scopes: ["finance-actions:issue"] }), { ...context, scopes: ["finance-actions:issue"] }, {
+            action: "issue",
+            idempotencyKey: "idem_1",
+            payload: {},
+        })).rejects.toMatchObject({ status: 403, code: "app_api_finance_approval_required" });
+        expect(executeAction).not.toHaveBeenCalled();
+    });
+    it("isolates rate limits per installation", async () => {
+        const service = createAppApiService({
+            rateLimit: { installationLimit: 1, appLimit: 10, windowMs: 60_000 },
+        });
+        const rateContext = { ...context, appId: "rate_app", installationId: "rate_inst_1" };
+        service.enforceRateLimit(rateContext);
+        expect(() => service.enforceRateLimit(rateContext)).toThrow(ApiHttpError);
+        expect(() => service.enforceRateLimit({ ...rateContext, installationId: "rate_inst_2" })).not.toThrow();
+    });
+    it("accepts only the $app custom-field namespace alias from request data", () => {
+        expect(() => assertAppNamespaceAlias(undefined)).not.toThrow();
+        expect(() => assertAppNamespaceAlias("$app")).not.toThrow();
+        expect(() => assertAppNamespaceAlias("$app:sync")).not.toThrow();
+        expect(() => assertAppNamespaceAlias("app--foreign")).toThrow(ApiHttpError);
+        expect(() => assertAppNamespaceAlias("custom")).toThrow(ApiHttpError);
+    });
+    it("compares App API compatibility ranges inclusively", () => {
+        expect(() => assertCompatibleVersion("2026-07-01", { min: "2026-07-01", max: "2026-12-31" })).not.toThrow();
+        expect(() => assertCompatibleVersion("2027-01-01", { min: "2026-07-01", max: "2026-12-31" })).toThrow(ApiHttpError);
+    });
+});

package/dist/consent.d.ts

@@ -0,0 +1,15 @@
+import type { AccessCatalog } from "@voyant-travel/types/api-keys";
+import type { AppRelease } from "./schema.js";
+export interface ConsentComputationInput {
+    release: AppRelease;
+    accessCatalog: AccessCatalog;
+    operatorGrantedScopes: readonly string[];
+    grantedOptionalScopes?: readonly string[];
+}
+export interface ComputedConsent {
+    requiredScopes: string[];
+    optionalScopes: string[];
+    grantedScopes: string[];
+    deniedOptionalScopes: string[];
+}
+export declare function computeAppConsent(input: ConsentComputationInput): ComputedConsent;

package/dist/consent.js

@@ -0,0 +1,65 @@
+import { ApiHttpError } from "@voyant-travel/hono";
+export function computeAppConsent(input) {
+    const normalized = parseReleaseScopes(input.release.normalizedRecord);
+    const remoteSafe = remoteSafeScopes(input.accessCatalog);
+    const operatorGranted = new Set(input.operatorGrantedScopes);
+    const optionalGrantRequest = new Set(input.grantedOptionalScopes ?? []);
+    const requiredScopes = normalized.requestedScopes.filter((scope) => canGrantScope(scope, remoteSafe, operatorGranted));
+    const missingRequired = normalized.requestedScopes.filter((scope) => !requiredScopes.includes(scope));
+    if (missingRequired.length > 0) {
+        throw new ApiHttpError("Required app scopes are not grantable for remote apps", {
+            status: 403,
+            code: "app_required_scope_not_grantable",
+            details: { scopes: missingRequired },
+        });
+    }
+    const optionalScopes = normalized.optionalScopes.filter((scope) => canGrantScope(scope, remoteSafe, operatorGranted));
+    const grantedOptional = optionalScopes.filter((scope) => optionalGrantRequest.has(scope));
+    const deniedOptionalScopes = normalized.optionalScopes.filter((scope) => !grantedOptional.includes(scope));
+    const grantedScopes = Array.from(new Set([...requiredScopes, ...grantedOptional])).sort();
+    return {
+        requiredScopes: requiredScopes.sort(),
+        optionalScopes: optionalScopes.sort(),
+        grantedScopes,
+        deniedOptionalScopes: deniedOptionalScopes.sort(),
+    };
+}
+function canGrantScope(scope, remoteSafe, operatorGranted) {
+    return remoteSafe.has(scope) && operatorGranted.has(scope);
+}
+function remoteSafeScopes(catalog) {
+    const catalogScopes = new Set(catalog.resources.flatMap((resource) => resource.actions.map((action) => `${resource.resource}:${action.action}`)));
+    const remoteSafe = new Set();
+    // A scope is remote-safe when its owning resource is flagged remoteSafe, or
+    // when the specific action is. This is the authority for App API scopes;
+    // audience presets remain supported for operator-declared grant bundles.
+    for (const resource of catalog.resources) {
+        for (const action of resource.actions) {
+            if (resource.remoteSafe || action.remoteSafe) {
+                remoteSafe.add(`${resource.resource}:${action.action}`);
+            }
+        }
+    }
+    const presetScopes = catalog.presets
+        .filter((preset) => preset.kind === "api-token-grant" && Boolean(preset.audience))
+        .flatMap((preset) => preset.grants);
+    for (const scope of presetScopes) {
+        if (catalogScopes.has(scope))
+            remoteSafe.add(scope);
+    }
+    return remoteSafe;
+}
+function parseReleaseScopes(value) {
+    if (!value || typeof value !== "object")
+        return { requestedScopes: [], optionalScopes: [] };
+    const record = value;
+    return {
+        requestedScopes: stringArray(record.requestedScopes),
+        optionalScopes: stringArray(record.optionalScopes),
+    };
+}
+function stringArray(value) {
+    return Array.isArray(value)
+        ? Array.from(new Set(value.filter((item) => typeof item === "string"))).sort()
+        : [];
+}

package/dist/consent.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/consent.test.js

@@ -0,0 +1,104 @@
+import { describe, expect, it } from "vitest";
+import { computeAppConsent } from "./consent.js";
+const catalog = {
+    resources: [
+        {
+            id: "bookings",
+            unitId: "bookings",
+            resource: "bookings",
+            label: "Bookings",
+            description: "Bookings",
+            wildcard: "allow",
+            actions: [{ action: "read", label: "Read", description: "Read" }],
+        },
+        {
+            id: "invoices",
+            unitId: "finance",
+            resource: "invoices",
+            label: "Invoices",
+            description: "Invoices",
+            wildcard: "allow",
+            actions: [{ action: "read", label: "Read", description: "Read" }],
+        },
+    ],
+    presets: [
+        {
+            id: "remote-safe",
+            kind: "api-token-grant",
+            audience: "staff",
+            label: "Remote safe",
+            description: "Remote app grants",
+            grants: ["bookings:read"],
+        },
+    ],
+};
+function release(requestedScopes, optionalScopes) {
+    return {
+        id: "release_1",
+        appId: "app_1",
+        releaseVersion: "1.0.0",
+        manifestSchemaVersion: "voyant.app-manifest.v1",
+        manifestDigest: "digest",
+        manifestSnapshot: {},
+        normalizedRecord: {
+            schemaVersion: "voyant.app-release.normalized.v1",
+            releaseVersion: "1.0.0",
+            digest: "digest",
+            requestedScopes,
+            optionalScopes,
+            adminPages: [],
+            slotExtensions: [],
+            webhooks: [],
+            customFields: [],
+        },
+        apiCompatibility: { min: "2026-01-01", max: "2026-12-31" },
+        defaultLocale: "en-US",
+        supportedLocales: ["en-US"],
+        state: "available",
+        createdBy: "user_1",
+        createdAt: new Date(),
+    };
+}
+describe("app OAuth consent computation", () => {
+    it("grants only scopes present in the catalog, remote-safe, and operator-granted", () => {
+        const consent = computeAppConsent({
+            release: release(["bookings:read"], ["invoices:read"]),
+            accessCatalog: catalog,
+            operatorGrantedScopes: ["bookings:read", "invoices:read"],
+            grantedOptionalScopes: ["invoices:read"],
+        });
+        expect(consent.grantedScopes).toEqual(["bookings:read"]);
+        expect(consent.deniedOptionalScopes).toEqual(["invoices:read"]);
+    });
+    it("rejects required scopes that are absent, unsafe, or not operator-granted", () => {
+        expect(() => computeAppConsent({
+            release: release(["invoices:read"], []),
+            accessCatalog: catalog,
+            operatorGrantedScopes: ["invoices:read"],
+        })).toThrow("Required app scopes are not grantable");
+    });
+    it("grants App API scopes marked remoteSafe on the resource without a matching preset", () => {
+        const withRemoteSafe = {
+            ...catalog,
+            resources: [
+                ...catalog.resources,
+                {
+                    id: "app-installation",
+                    unitId: "apps",
+                    resource: "app-installation",
+                    label: "App installation",
+                    description: "Self",
+                    wildcard: "explicit-resource",
+                    remoteSafe: true,
+                    actions: [{ action: "read", label: "Read", description: "Read" }],
+                },
+            ],
+        };
+        const consent = computeAppConsent({
+            release: release(["app-installation:read"], []),
+            accessCatalog: withRemoteSafe,
+            operatorGrantedScopes: ["app-installation:read"],
+        });
+        expect(consent.grantedScopes).toEqual(["app-installation:read"]);
+    });
+});

package/dist/contracts.d.ts

@@ -29,8 +29,8 @@ export declare const appOwnedCustomFieldDeclarationSchema: z.ZodObject<{
     }, z.core.$strip>>>>;
     logicalNamespace: z.ZodOptional<z.ZodString>;
     dataClassification: z.ZodDefault<z.ZodEnum<{
-        public: "public";
         internal: "internal";
+        public: "public";
         confidential: "confidential";
         restricted: "restricted";
         personal: "personal";
@@ -106,8 +106,8 @@ export declare const appManifestSchema: z.ZodPipe<z.ZodRecord<z.ZodString, z.Zod
         }, z.core.$strip>>>>;
         logicalNamespace: z.ZodOptional<z.ZodString>;
         dataClassification: z.ZodDefault<z.ZodEnum<{
-            public: "public";
             internal: "internal";
+            public: "public";
             confidential: "confidential";
             restricted: "restricted";
             personal: "personal";
@@ -134,8 +134,8 @@ export declare const appManifestSchema: z.ZodPipe<z.ZodRecord<z.ZodString, z.Zod
     }, z.core.$strict>;
     data: z.ZodObject<{
         classifications: z.ZodArray<z.ZodEnum<{
-            public: "public";
             internal: "internal";
+            public: "public";
             confidential: "confidential";
             restricted: "restricted";
             personal: "personal";
@@ -176,9 +176,88 @@ export declare const appWebhookReplaySchema: z.ZodObject<{
     signingKeyId: z.ZodString;
     signingSecret: z.ZodString;
 }, z.core.$strict>;
+export declare const appOAuthAuthorizeQuerySchema: z.ZodObject<{
+    response_type: z.ZodLiteral<"code">;
+    client_id: z.ZodString;
+    release_id: z.ZodString;
+    redirect_uri: z.ZodString;
+    state: z.ZodString;
+    code_challenge: z.ZodString;
+    code_challenge_method: z.ZodLiteral<"S256">;
+    actor_id: z.ZodString;
+    operator_scopes: z.ZodDefault<z.ZodString>;
+    optional_scopes: z.ZodDefault<z.ZodString>;
+}, z.core.$strict>;
+export declare const appOAuthTokenSchema: z.ZodPipe<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    grant_type: z.ZodLiteral<"authorization_code">;
+    code: z.ZodString;
+    redirect_uri: z.ZodString;
+    code_verifier: z.ZodString;
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    grant_type: z.ZodLiteral<"refresh_token">;
+    refresh_token: z.ZodString;
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    grant_type: z.ZodLiteral<"urn:voyant:params:oauth:grant-type:actor-token-exchange">;
+    installation_id: z.ZodString;
+    viewer_id: z.ZodString;
+    viewer_scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    contextual_scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "grant_type">, z.ZodTransform<{
+    client_secret: string | undefined;
+    grant_type: "authorization_code";
+    code: string;
+    redirect_uri: string;
+    code_verifier: string;
+    client_id: string;
+} | {
+    client_secret: string | undefined;
+    grant_type: "refresh_token";
+    refresh_token: string;
+    client_id: string;
+} | {
+    client_secret: string | undefined;
+    grant_type: "urn:voyant:params:oauth:grant-type:actor-token-exchange";
+    installation_id: string;
+    viewer_id: string;
+    viewer_scopes: string[];
+    client_id: string;
+    contextual_scopes?: string[] | undefined;
+}, {
+    grant_type: "authorization_code";
+    code: string;
+    redirect_uri: string;
+    code_verifier: string;
+    client_id: string;
+    client_secret?: string | undefined;
+} | {
+    grant_type: "refresh_token";
+    refresh_token: string;
+    client_id: string;
+    client_secret?: string | undefined;
+} | {
+    grant_type: "urn:voyant:params:oauth:grant-type:actor-token-exchange";
+    installation_id: string;
+    viewer_id: string;
+    viewer_scopes: string[];
+    client_id: string;
+    contextual_scopes?: string[] | undefined;
+    client_secret?: string | undefined;
+}>>;
+export declare const appCredentialRevocationSchema: z.ZodObject<{
+    installationId: z.ZodString;
+    actorId: z.ZodString;
+}, z.core.$strict>;
 export type AppManifest = z.infer<typeof appManifestSchema>;
 export type CreateCustomAppRegistrationInput = z.infer<typeof createCustomAppRegistrationSchema>;
 export type ReleaseManifestUploadInput = z.infer<typeof releaseManifestUploadSchema>;
 export type ReleaseManifestFetchInput = z.infer<typeof releaseManifestFetchSchema>;
 export type AppListQuery = z.infer<typeof appListQuerySchema>;
 export type AppWebhookReplayInput = z.infer<typeof appWebhookReplaySchema>;
+export type AppOAuthAuthorizeQuery = z.infer<typeof appOAuthAuthorizeQuerySchema>;
+export type AppOAuthTokenInput = z.infer<typeof appOAuthTokenSchema>;