@voyant-travel/apps 0.2.0 → 0.4.0

package/dist/service.d.ts

@@ -8,14 +8,14 @@ export interface AppsServiceOptions extends CompileAppManifestOptions {
 }
 export declare function createAppsService(options?: AppsServiceOptions): {
     createCustomApp: (db: PostgresJsDatabase, input: CreateCustomAppRegistrationInput) => Promise<{
+        id: string;
+        platformNamespace: string;
+        distribution: "custom" | "marketplace";
         ownerId: string;
         displayName: string;
         slug: string;
-        createdBy: string;
-        distribution: "custom" | "marketplace";
-        id: string;
-        platformNamespace: string;
         lifecycleState: "active" | "suspended" | "deleted";
+        createdBy: string;
         createdAt: Date;
         updatedAt: Date;
     }>;
@@ -50,19 +50,19 @@ export declare function createAppsService(options?: AppsServiceOptions): {
     } | null>;
     releaseFromUpload: (db: PostgresJsDatabase, appId: string, input: ReleaseManifestUploadInput) => Promise<{
         release: {
-            releaseVersion: string;
-            apiCompatibility: {
-                min: string;
-                max: string;
-            };
-            createdBy: string;
             id: string;
+            createdBy: string;
             createdAt: Date;
             appId: string;
+            releaseVersion: string;
             manifestSchemaVersion: string;
             manifestDigest: string;
             manifestSnapshot: Record<string, unknown>;
             normalizedRecord: Record<string, unknown>;
+            apiCompatibility: {
+                min: string;
+                max: string;
+            };
             defaultLocale: string;
             supportedLocales: string[];
             state: "suspended" | "available" | "yanked";
@@ -72,19 +72,19 @@ export declare function createAppsService(options?: AppsServiceOptions): {
     }>;
     releaseFromFetch: (db: PostgresJsDatabase, appId: string, input: ReleaseManifestFetchInput) => Promise<{
         release: {
-            releaseVersion: string;
-            apiCompatibility: {
-                min: string;
-                max: string;
-            };
-            createdBy: string;
             id: string;
+            createdBy: string;
             createdAt: Date;
             appId: string;
+            releaseVersion: string;
             manifestSchemaVersion: string;
             manifestDigest: string;
             manifestSnapshot: Record<string, unknown>;
             normalizedRecord: Record<string, unknown>;
+            apiCompatibility: {
+                min: string;
+                max: string;
+            };
             defaultLocale: string;
             supportedLocales: string[];
             state: "suspended" | "available" | "yanked";

package/dist/voyant.js

@@ -1,4 +1,5 @@
-import { defineModule } from "@voyant-travel/core/project";
+import { defineModule, requirePort } from "@voyant-travel/core/project";
+import { customFieldValueLifecycleRuntimePort, customFieldValueOperationsRuntimePort, } from "@voyant-travel/core/runtime-port";
 const appInstallationLifecyclePayloadSchema = {
     type: "object",
     additionalProperties: false,
@@ -13,6 +14,16 @@ export const appsVoyantModule = defineModule({
     id: "@voyant-travel/apps",
     packageName: "@voyant-travel/apps",
     localId: "apps",
+    runtimePorts: [
+        requirePort(customFieldValueLifecycleRuntimePort, {
+            optional: true,
+            cardinality: "many",
+        }),
+        requirePort(customFieldValueOperationsRuntimePort, {
+            optional: true,
+            cardinality: "many",
+        }),
+    ],
     api: [
         {
             id: "@voyant-travel/apps#api.admin",
@@ -82,6 +93,81 @@ export const appsVoyantModule = defineModule({
     ],
     access: {
         resources: [
+            {
+                id: "@voyant-travel/apps#access.app-installation",
+                resource: "app-installation",
+                label: "App installation",
+                description: "Read the calling app installation and grant state.",
+                remoteSafe: true,
+                actions: [{ action: "read", label: "Read installation", description: "Read self." }],
+            },
+            {
+                id: "@voyant-travel/apps#access.custom-field-definitions",
+                resource: "custom-field-definitions",
+                label: "Own custom-field definitions",
+                description: "Read and write custom-field definitions owned by the app.",
+                remoteSafe: true,
+                actions: ["read", "write"],
+                wildcard: "explicit-resource",
+            },
+            {
+                id: "@voyant-travel/apps#access.custom-field-values",
+                resource: "custom-field-values",
+                label: "Own custom-field values",
+                description: "Read and write app-owned custom-field values by target.",
+                remoteSafe: true,
+                actions: ["read", "write", "booking", "person", "organization", "invoice"],
+                wildcard: "explicit-resource",
+            },
+            {
+                id: "@voyant-travel/apps#access.webhooks",
+                resource: "webhooks",
+                label: "App webhooks",
+                description: "Read webhook health and request replay.",
+                remoteSafe: true,
+                actions: [
+                    "read",
+                    { action: "replay", label: "Replay webhooks", description: "Replay deliveries." },
+                ],
+            },
+            {
+                id: "@voyant-travel/apps#access.app-audit",
+                resource: "app-audit",
+                label: "App audit history",
+                description: "Read audit history owned by the app.",
+                remoteSafe: true,
+                actions: ["read"],
+            },
+            {
+                id: "@voyant-travel/apps#access.online-token",
+                resource: "online-token",
+                label: "Online token exchange",
+                description: "Exchange admin session context for online app access.",
+                remoteSafe: true,
+                actions: [{ action: "exchange", wildcard: "explicit" }],
+            },
+            {
+                id: "@voyant-travel/apps#access.finance-documents",
+                resource: "finance-documents",
+                label: "Finance documents",
+                description: "Read finance documents visible to remote accounting apps.",
+                remoteSafe: true,
+                actions: ["read"],
+                wildcard: "explicit-resource",
+            },
+            {
+                id: "@voyant-travel/apps#access.finance-actions",
+                resource: "finance-actions",
+                label: "Finance actions",
+                description: "Request approved finance document actions.",
+                remoteSafe: true,
+                actions: [
+                    { action: "issue", sensitive: true, wildcard: "explicit" },
+                    { action: "retry", sensitive: true, wildcard: "explicit" },
+                    { action: "reconcile", sensitive: true, wildcard: "explicit" },
+                ],
+                wildcard: "explicit-resource",
+            },
             {
                 id: "@voyant-travel/apps#access.apps",
                 resource: "apps",

package/migrations/20260717143000_app_oauth_authorization.sql

@@ -0,0 +1,47 @@
+ALTER TYPE "public"."app_audit_event_kind" ADD VALUE IF NOT EXISTS 'consent';--> statement-breakpoint
+ALTER TYPE "public"."app_audit_event_kind" ADD VALUE IF NOT EXISTS 'token';--> statement-breakpoint
+CREATE TYPE "public"."app_access_token_mode" AS ENUM('offline', 'online');--> statement-breakpoint
+ALTER TABLE "app_installations" ADD COLUMN "credential_generation" integer DEFAULT 0 NOT NULL;--> statement-breakpoint
+ALTER TABLE "app_access_credentials" ADD COLUMN "token_mode" "app_access_token_mode" DEFAULT 'offline' NOT NULL;--> statement-breakpoint
+ALTER TABLE "app_access_credentials" ADD COLUMN "actor_id" text;--> statement-breakpoint
+ALTER TABLE "app_access_credentials" ADD COLUMN "viewer_id" text;--> statement-breakpoint
+DROP INDEX "public"."uidx_app_access_credentials_generation";--> statement-breakpoint
+CREATE INDEX "idx_app_access_credentials_generation" ON "app_access_credentials" USING btree ("installation_id","token_mode","generation");--> statement-breakpoint
+CREATE TABLE "app_oauth_authorization_codes" (
+	"id" text PRIMARY KEY NOT NULL,
+	"app_id" text NOT NULL,
+	"installation_id" text NOT NULL,
+	"release_id" text NOT NULL,
+	"deployment_id" text NOT NULL,
+	"code_hash" text NOT NULL,
+	"state_hash" text NOT NULL,
+	"redirect_uri" text NOT NULL,
+	"code_challenge" text NOT NULL,
+	"code_challenge_method" text NOT NULL,
+	"requested_scopes" jsonb NOT NULL,
+	"granted_scopes" jsonb NOT NULL,
+	"denied_optional_scopes" jsonb NOT NULL,
+	"actor_id" text NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"consumed_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);--> statement-breakpoint
+CREATE TABLE "app_oauth_refresh_tokens" (
+	"id" text PRIMARY KEY NOT NULL,
+	"installation_id" text NOT NULL,
+	"token_hash" text NOT NULL,
+	"generation" integer NOT NULL,
+	"status" "app_access_credential_status" DEFAULT 'active' NOT NULL,
+	"rotated_from_id" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"expires_at" timestamp with time zone,
+	"revoked_at" timestamp with time zone
+);--> statement-breakpoint
+ALTER TABLE "app_oauth_authorization_codes" ADD CONSTRAINT "app_oauth_authorization_codes_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_oauth_authorization_codes" ADD CONSTRAINT "app_oauth_authorization_codes_installation_id_app_installations_id_fk" FOREIGN KEY ("installation_id") REFERENCES "public"."app_installations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_oauth_authorization_codes" ADD CONSTRAINT "app_oauth_authorization_codes_release_id_app_releases_id_fk" FOREIGN KEY ("release_id") REFERENCES "public"."app_releases"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_oauth_refresh_tokens" ADD CONSTRAINT "app_oauth_refresh_tokens_installation_id_app_installations_id_fk" FOREIGN KEY ("installation_id") REFERENCES "public"."app_installations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "uidx_app_oauth_codes_hash" ON "app_oauth_authorization_codes" USING btree ("code_hash");--> statement-breakpoint
+CREATE INDEX "idx_app_oauth_codes_installation" ON "app_oauth_authorization_codes" USING btree ("installation_id","expires_at");--> statement-breakpoint
+CREATE UNIQUE INDEX "uidx_app_oauth_refresh_tokens_hash" ON "app_oauth_refresh_tokens" USING btree ("token_hash");--> statement-breakpoint
+CREATE INDEX "idx_app_oauth_refresh_tokens_installation" ON "app_oauth_refresh_tokens" USING btree ("installation_id","status");

package/migrations/meta/_journal.json

@@ -22,6 +22,13 @@
       "when": 1784291400000,
       "tag": "20260717123000_app_webhook_delivery_health",
       "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "7",
+      "when": 1784298600000,
+      "tag": "20260717143000_app_oauth_authorization",
+      "breakpoints": true
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyant-travel/apps",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "license": "Apache-2.0",
   "type": "module",
   "exports": {
@@ -9,6 +9,26 @@
       "import": "./dist/index.js",
       "default": "./dist/index.js"
     },
+    "./access-boundary": {
+      "types": "./dist/access-boundary.d.ts",
+      "import": "./dist/access-boundary.js",
+      "default": "./dist/access-boundary.js"
+    },
+    "./app-api-contracts": {
+      "types": "./dist/app-api-contracts.d.ts",
+      "import": "./dist/app-api-contracts.js",
+      "default": "./dist/app-api-contracts.js"
+    },
+    "./app-api-routes": {
+      "types": "./dist/app-api-routes.d.ts",
+      "import": "./dist/app-api-routes.js",
+      "default": "./dist/app-api-routes.js"
+    },
+    "./app-api-service": {
+      "types": "./dist/app-api-service.d.ts",
+      "import": "./dist/app-api-service.js",
+      "default": "./dist/app-api-service.js"
+    },
     "./api-runtime": {
       "types": "./dist/api-runtime.d.ts",
       "import": "./dist/api-runtime.js",
@@ -24,6 +44,11 @@
       "import": "./dist/contracts.js",
       "default": "./dist/contracts.js"
     },
+    "./consent": {
+      "types": "./dist/consent.d.ts",
+      "import": "./dist/consent.js",
+      "default": "./dist/consent.js"
+    },
     "./ingestion": {
       "types": "./dist/ingestion.d.ts",
       "import": "./dist/ingestion.js",
@@ -34,6 +59,16 @@
       "import": "./dist/installation-service.js",
       "default": "./dist/installation-service.js"
     },
+    "./oauth-crypto": {
+      "types": "./dist/oauth-crypto.d.ts",
+      "import": "./dist/oauth-crypto.js",
+      "default": "./dist/oauth-crypto.js"
+    },
+    "./oauth-service": {
+      "types": "./dist/oauth-service.d.ts",
+      "import": "./dist/oauth-service.js",
+      "default": "./dist/oauth-service.js"
+    },
     "./routes": {
       "types": "./dist/routes.d.ts",
       "import": "./dist/routes.js",
@@ -62,11 +97,12 @@
     "zod": "^4.4.3",
     "@voyant-travel/admin": "^0.126.2",
     "@voyant-travel/admin-extension-sdk": "^0.1.1",
-    "@voyant-travel/core": "^0.125.0",
+    "@voyant-travel/core": "^0.125.2",
     "@voyant-travel/custom-fields": "^0.2.1",
     "@voyant-travel/db": "^0.114.10",
-    "@voyant-travel/webhook-delivery": "^0.4.0",
-    "@voyant-travel/hono": "^0.128.1"
+    "@voyant-travel/hono": "^0.128.3",
+    "@voyant-travel/types": "^0.109.4",
+    "@voyant-travel/webhook-delivery": "^0.4.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.2",