@voyant-travel/apps 0.2.0 → 0.4.0

package/dist/schema.d.ts

@@ -7,9 +7,10 @@ export declare const appInstallationStatusEnum: import("drizzle-orm/pg-core").Pg
 export declare const appInstallationUpdatePolicyEnum: import("drizzle-orm/pg-core").PgEnum<["manual", "compatible", "patch", "pinned"]>;
 export declare const appGrantStatusEnum: import("drizzle-orm/pg-core").PgEnum<["requested", "granted", "optional", "revoked"]>;
 export declare const appAccessCredentialStatusEnum: import("drizzle-orm/pg-core").PgEnum<["active", "inactive", "revoked"]>;
+export declare const appAccessTokenModeEnum: import("drizzle-orm/pg-core").PgEnum<["offline", "online"]>;
 export declare const appInstallationRegistrationStatusEnum: import("drizzle-orm/pg-core").PgEnum<["active", "inactive"]>;
 export declare const appWebhookSubscriptionStatusEnum: import("drizzle-orm/pg-core").PgEnum<["active", "inactive", "failed"]>;
-export declare const appAuditEventKindEnum: import("drizzle-orm/pg-core").PgEnum<["lifecycle", "grant", "credential", "reconciliation", "purge"]>;
+export declare const appAuditEventKindEnum: import("drizzle-orm/pg-core").PgEnum<["lifecycle", "grant", "consent", "credential", "token", "reconciliation", "purge"]>;
 export declare const apps: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "apps";
     schema: undefined;
@@ -1062,6 +1063,23 @@ export declare const appInstallations: import("drizzle-orm/pg-core").PgTableWith
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        credentialGeneration: import("drizzle-orm/pg-core").PgColumn<{
+            name: "credential_generation";
+            tableName: "app_installations";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         updatePolicy: import("drizzle-orm/pg-core").PgColumn<{
             name: "update_policy";
             tableName: "app_installations";
@@ -1363,7 +1381,7 @@ export declare const appGrants: import("drizzle-orm/pg-core").PgTableWithColumns
             tableName: "app_grants";
             dataType: "string";
             columnType: "PgEnumColumn";
-            data: "optional" | "requested" | "revoked" | "granted";
+            data: "revoked" | "requested" | "granted" | "optional";
             driverParam: string;
             notNull: true;
             hasDefault: false;
@@ -1501,6 +1519,23 @@ export declare const appAccessCredentials: import("drizzle-orm/pg-core").PgTable
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        tokenMode: import("drizzle-orm/pg-core").PgColumn<{
+            name: "token_mode";
+            tableName: "app_access_credentials";
+            dataType: "string";
+            columnType: "PgEnumColumn";
+            data: "offline" | "online";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["offline", "online"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         credentialHash: import("drizzle-orm/pg-core").PgColumn<{
             name: "credential_hash";
             tableName: "app_access_credentials";
@@ -1554,6 +1589,40 @@ export declare const appAccessCredentials: import("drizzle-orm/pg-core").PgTable
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        actorId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "actor_id";
+            tableName: "app_access_credentials";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        viewerId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "viewer_id";
+            tableName: "app_access_credentials";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         createdAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "created_at";
             tableName: "app_access_credentials";
@@ -1608,6 +1677,468 @@ export declare const appAccessCredentials: import("drizzle-orm/pg-core").PgTable
     };
     dialect: "pg";
 }>;
+export declare const appOAuthAuthorizationCodes: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "app_oauth_authorization_codes";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: string;
+            tableName: "app_oauth_authorization_codes";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: true;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        appId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "app_id";
+            tableName: "app_oauth_authorization_codes";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        installationId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "installation_id";
+            tableName: "app_oauth_authorization_codes";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        releaseId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "release_id";
+            tableName: "app_oauth_authorization_codes";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        deploymentId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "deployment_id";
+            tableName: "app_oauth_authorization_codes";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        codeHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "code_hash";
+            tableName: "app_oauth_authorization_codes";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        stateHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "state_hash";
+            tableName: "app_oauth_authorization_codes";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        redirectUri: import("drizzle-orm/pg-core").PgColumn<{
+            name: "redirect_uri";
+            tableName: "app_oauth_authorization_codes";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        codeChallenge: import("drizzle-orm/pg-core").PgColumn<{
+            name: "code_challenge";
+            tableName: "app_oauth_authorization_codes";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        codeChallengeMethod: import("drizzle-orm/pg-core").PgColumn<{
+            name: "code_challenge_method";
+            tableName: "app_oauth_authorization_codes";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        requestedScopes: import("drizzle-orm/pg-core").PgColumn<{
+            name: "requested_scopes";
+            tableName: "app_oauth_authorization_codes";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: string[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: string[];
+        }>;
+        grantedScopes: import("drizzle-orm/pg-core").PgColumn<{
+            name: "granted_scopes";
+            tableName: "app_oauth_authorization_codes";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: string[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: string[];
+        }>;
+        deniedOptionalScopes: import("drizzle-orm/pg-core").PgColumn<{
+            name: "denied_optional_scopes";
+            tableName: "app_oauth_authorization_codes";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: string[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: string[];
+        }>;
+        actorId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "actor_id";
+            tableName: "app_oauth_authorization_codes";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at";
+            tableName: "app_oauth_authorization_codes";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        consumedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "consumed_at";
+            tableName: "app_oauth_authorization_codes";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "app_oauth_authorization_codes";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export declare const appOAuthRefreshTokens: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "app_oauth_refresh_tokens";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: string;
+            tableName: "app_oauth_refresh_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: true;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        installationId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "installation_id";
+            tableName: "app_oauth_refresh_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        tokenHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "token_hash";
+            tableName: "app_oauth_refresh_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        generation: import("drizzle-orm/pg-core").PgColumn<{
+            name: "generation";
+            tableName: "app_oauth_refresh_tokens";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        status: import("drizzle-orm/pg-core").PgColumn<{
+            name: "status";
+            tableName: "app_oauth_refresh_tokens";
+            dataType: "string";
+            columnType: "PgEnumColumn";
+            data: "active" | "revoked" | "inactive";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["active", "inactive", "revoked"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        rotatedFromId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "rotated_from_id";
+            tableName: "app_oauth_refresh_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "app_oauth_refresh_tokens";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at";
+            tableName: "app_oauth_refresh_tokens";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        revokedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "revoked_at";
+            tableName: "app_oauth_refresh_tokens";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
 export declare const appInstallationSettings: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "app_installation_settings";
     schema: undefined;
@@ -2329,14 +2860,14 @@ export declare const appAuditEvents: import("drizzle-orm/pg-core").PgTableWithCo
             tableName: "app_audit_events";
             dataType: "string";
             columnType: "PgEnumColumn";
-            data: "lifecycle" | "grant" | "credential" | "reconciliation" | "purge";
+            data: "lifecycle" | "grant" | "consent" | "credential" | "token" | "reconciliation" | "purge";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["lifecycle", "grant", "credential", "reconciliation", "purge"];
+            enumValues: ["lifecycle", "grant", "consent", "credential", "token", "reconciliation", "purge"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
@@ -2403,3 +2934,4 @@ export type AppRelease = typeof appReleases.$inferSelect;
 export type NewAppRelease = typeof appReleases.$inferInsert;
 export type AppInstallation = typeof appInstallations.$inferSelect;
 export type NewAppInstallation = typeof appInstallations.$inferInsert;
+export type AppAccessCredential = typeof appAccessCredentials.$inferSelect;

package/dist/schema.js

@@ -39,6 +39,7 @@ export const appAccessCredentialStatusEnum = pgEnum("app_access_credential_statu
     "inactive",
     "revoked",
 ]);
+export const appAccessTokenModeEnum = pgEnum("app_access_token_mode", ["offline", "online"]);
 export const appInstallationRegistrationStatusEnum = pgEnum("app_installation_registration_status", ["active", "inactive"]);
 export const appWebhookSubscriptionStatusEnum = pgEnum("app_webhook_subscription_status", [
     "active",
@@ -48,7 +49,9 @@ export const appWebhookSubscriptionStatusEnum = pgEnum("app_webhook_subscription
 export const appAuditEventKindEnum = pgEnum("app_audit_event_kind", [
     "lifecycle",
     "grant",
+    "consent",
     "credential",
+    "token",
     "reconciliation",
     "purge",
 ]);
@@ -158,6 +161,7 @@ export const appInstallations = pgTable("app_installations", {
     status: appInstallationStatusEnum("status").notNull().default("pending"),
     namespace: text("namespace").notNull(),
     installedBy: text("installed_by").notNull(),
+    credentialGeneration: integer("credential_generation").notNull().default(0),
     updatePolicy: appInstallationUpdatePolicyEnum("update_policy").notNull().default("compatible"),
     lastCompatibleReleaseCheckAt: timestamp("last_compatible_release_check_at", {
         withTimezone: true,
@@ -202,15 +206,62 @@ export const appAccessCredentials = pgTable("app_access_credentials", {
         .notNull()
         .references(() => appInstallations.id, { onDelete: "cascade" }),
     generation: integer("generation").notNull(),
+    tokenMode: appAccessTokenModeEnum("token_mode").notNull().default("offline"),
     credentialHash: text("credential_hash").notNull(),
     encryptedMetadata: jsonb("encrypted_metadata").$type().notNull(),
     status: appAccessCredentialStatusEnum("status").notNull().default("active"),
+    actorId: text("actor_id"),
+    viewerId: text("viewer_id"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     expiresAt: timestamp("expires_at", { withTimezone: true }),
     deactivatedAt: timestamp("deactivated_at", { withTimezone: true }),
 }, (table) => [
     index("idx_app_access_credentials_installation").on(table.installationId, table.status),
-    uniqueIndex("uidx_app_access_credentials_generation").on(table.installationId, table.generation),
+    index("idx_app_access_credentials_generation").on(table.installationId, table.tokenMode, table.generation),
+]);
+export const appOAuthAuthorizationCodes = pgTable("app_oauth_authorization_codes", {
+    id: typeId("app_oauth_authorization_codes"),
+    appId: text("app_id")
+        .notNull()
+        .references(() => apps.id, { onDelete: "cascade" }),
+    installationId: text("installation_id")
+        .notNull()
+        .references(() => appInstallations.id, { onDelete: "cascade" }),
+    releaseId: text("release_id")
+        .notNull()
+        .references(() => appReleases.id, { onDelete: "cascade" }),
+    deploymentId: text("deployment_id").notNull(),
+    codeHash: text("code_hash").notNull(),
+    stateHash: text("state_hash").notNull(),
+    redirectUri: text("redirect_uri").notNull(),
+    codeChallenge: text("code_challenge").notNull(),
+    codeChallengeMethod: text("code_challenge_method").notNull(),
+    requestedScopes: jsonb("requested_scopes").$type().notNull(),
+    grantedScopes: jsonb("granted_scopes").$type().notNull(),
+    deniedOptionalScopes: jsonb("denied_optional_scopes").$type().notNull(),
+    actorId: text("actor_id").notNull(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    consumedAt: timestamp("consumed_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+}, (table) => [
+    uniqueIndex("uidx_app_oauth_codes_hash").on(table.codeHash),
+    index("idx_app_oauth_codes_installation").on(table.installationId, table.expiresAt),
+]);
+export const appOAuthRefreshTokens = pgTable("app_oauth_refresh_tokens", {
+    id: typeId("app_oauth_refresh_tokens"),
+    installationId: text("installation_id")
+        .notNull()
+        .references(() => appInstallations.id, { onDelete: "cascade" }),
+    tokenHash: text("token_hash").notNull(),
+    generation: integer("generation").notNull(),
+    status: appAccessCredentialStatusEnum("status").notNull().default("active"),
+    rotatedFromId: text("rotated_from_id"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }),
+    revokedAt: timestamp("revoked_at", { withTimezone: true }),
+}, (table) => [
+    uniqueIndex("uidx_app_oauth_refresh_tokens_hash").on(table.tokenHash),
+    index("idx_app_oauth_refresh_tokens_installation").on(table.installationId, table.status),
 ]);
 export const appInstallationSettings = pgTable("app_installation_settings", {
     id: typeId("app_installation_settings"),