@voyant-travel/apps 0.3.0 → 0.4.0

package/dist/app-api-service.js

@@ -0,0 +1,244 @@
+import { createAppCustomFieldDefinitionOwner, createCustomFieldsService, } from "@voyant-travel/custom-fields";
+import { ApiHttpError } from "@voyant-travel/hono";
+import { and, asc, eq, sql } from "drizzle-orm";
+import { assertActiveAppInstallationAccess } from "./access-boundary.js";
+import { APP_API_VERSION } from "./app-api-contracts.js";
+import { appAuditEvents, appGrants, appReleases, appWebhookSubscriptions } from "./schema.js";
+const DEFAULT_RATE_LIMIT = { installationLimit: 120, appLimit: 600, windowMs: 60_000 };
+const REMOTE_APP_NAMESPACE = /^\$app(?::[a-z][a-z0-9-]*)?$/;
+const PHYSICAL_APP_NAMESPACE = /^app--/;
+const buckets = new Map();
+export function createAppApiService(options = {}) {
+    const now = () => options.now?.() ?? new Date();
+    const customFields = options.customFieldTargets &&
+        createCustomFieldsService(options.customFieldTargets, options.customFieldValueLifecycles ?? [], options.customFieldValueOperations ?? []);
+    async function introspect(db, context) {
+        const access = await requireAccess(db, context, ["app-installation:read"]);
+        const grants = await db
+            .select({
+            scope: appGrants.scope,
+            status: appGrants.status,
+            optional: appGrants.optional,
+        })
+            .from(appGrants)
+            .where(eq(appGrants.installationId, context.installationId))
+            .orderBy(appGrants.scope);
+        return {
+            data: {
+                installation: {
+                    id: access.installation.id,
+                    appId: access.installation.appId,
+                    status: access.installation.status,
+                    namespace: access.installation.namespace,
+                    deploymentId: access.installation.deploymentId,
+                },
+                release: {
+                    id: access.release.id,
+                    version: access.release.releaseVersion,
+                    apiCompatibility: access.release.apiCompatibility,
+                },
+                grants,
+            },
+        };
+    }
+    async function listEntities(db, context, entity, query) {
+        await requireAccess(db, context, [`${entity}:read`]);
+        const reader = options.entityReaders?.[entity];
+        if (!reader)
+            throw notSupported(`Entity "${entity}" is not supported by the App API.`);
+        return { data: await reader.list(db, query) };
+    }
+    async function listFinanceDocuments(db, context, query) {
+        await requireAccess(db, context, ["finance-documents:read"]);
+        if (!options.finance)
+            throw notSupported("Finance App API runtime is not configured.");
+        return { data: await options.finance.listDocuments(db, query) };
+    }
+    async function executeFinanceAction(db, context, input) {
+        await requireAccess(db, context, [`finance-actions:${input.action}`]);
+        if (!options.finance)
+            throw notSupported("Finance App API runtime is not configured.");
+        if (!input.approvalId) {
+            throw new ApiHttpError("Finance action requires action-ledger approval.", {
+                status: 403,
+                code: "app_api_finance_approval_required",
+            });
+        }
+        return { data: await options.finance.executeAction(db, input) };
+    }
+    async function listCustomFieldDefinitions(db, context, query) {
+        const access = await requireAccess(db, context, ["custom-field-definitions:read"]);
+        return customFieldsRequired().listForOwner(db, owner(access), query);
+    }
+    async function createCustomFieldDefinition(db, context, namespace, input) {
+        assertAppNamespaceAlias(namespace);
+        const access = await requireAccess(db, context, ["custom-field-definitions:write"]);
+        return { data: await customFieldsRequired().createForOwner(db, owner(access), input) };
+    }
+    async function updateCustomFieldDefinition(db, context, id, namespace, input) {
+        assertAppNamespaceAlias(namespace);
+        const access = await requireAccess(db, context, ["custom-field-definitions:write"]);
+        const data = await customFieldsRequired().updateForOwner(db, owner(access), id, input);
+        if (!data)
+            throw notFound("Custom-field definition not found.");
+        return { data };
+    }
+    async function listCustomFieldValues(db, context, query) {
+        await requireAccess(db, context, [`custom-field-values:${query.entityType ?? "read"}`]);
+        const access = await requireAccess(db, context, ["custom-field-values:read"]);
+        return customFieldsRequired().values.listForOwner(db, owner(access), query);
+    }
+    async function upsertCustomFieldValue(db, context, definitionId, input) {
+        await requireAccess(db, context, [
+            "custom-field-values:write",
+            `custom-field-values:${input.entityType}`,
+        ]);
+        const access = await requireAccess(db, context, []);
+        return {
+            data: await customFieldsRequired().values.upsertForOwner(db, owner(access), definitionId, input),
+        };
+    }
+    async function listWebhookHealth(db, context) {
+        await requireAccess(db, context, ["webhooks:read"]);
+        const data = await db
+            .select()
+            .from(appWebhookSubscriptions)
+            .where(eq(appWebhookSubscriptions.installationId, context.installationId))
+            .orderBy(asc(appWebhookSubscriptions.eventType));
+        return { data };
+    }
+    async function listAuditHistory(db, context, query) {
+        await requireAccess(db, context, ["app-audit:read"]);
+        const where = and(eq(appAuditEvents.appId, context.appId), eq(appAuditEvents.installationId, context.installationId));
+        const [data, count] = await Promise.all([
+            db.select().from(appAuditEvents).where(where).limit(query.limit).offset(query.offset),
+            db.select({ count: sql `count(*)::int` }).from(appAuditEvents).where(where),
+        ]);
+        return { data, total: count[0]?.count ?? 0, limit: query.limit, offset: query.offset };
+    }
+    return {
+        introspect,
+        listEntities,
+        listFinanceDocuments,
+        executeFinanceAction,
+        listCustomFieldDefinitions,
+        createCustomFieldDefinition,
+        updateCustomFieldDefinition,
+        listCustomFieldValues,
+        upsertCustomFieldValue,
+        listWebhookHealth,
+        listAuditHistory,
+        requireAccess,
+        enforceRateLimit,
+    };
+    async function requireAccess(db, context, requiredScopes) {
+        enforceRateLimit(context);
+        // The token's own scopes are the authority: for online tokens this is the
+        // narrowed viewer/context intersection minted at exchange, so an endpoint
+        // must not be reachable just because the installation was granted its
+        // scope. The installation-grant check below stays as defense in depth.
+        const tokenScopes = new Set(context.scopes);
+        const missingFromToken = requiredScopes.filter((scope) => !tokenScopes.has(scope));
+        if (missingFromToken.length > 0) {
+            throw new ApiHttpError("App token is missing required scopes", {
+                status: 403,
+                code: "app_api_token_scope_missing",
+                details: { scopes: [...missingFromToken].sort() },
+            });
+        }
+        const installation = await assertActiveAppInstallationAccess(db, {
+            installationId: context.installationId,
+            requiredScopes,
+        });
+        if (installation.appId !== context.appId || installation.releaseId !== context.releaseId) {
+            throw new ApiHttpError("App token does not match the active installation.", {
+                status: 403,
+                code: "app_api_token_installation_mismatch",
+            });
+        }
+        const [release] = await db
+            .select()
+            .from(appReleases)
+            .where(eq(appReleases.id, installation.releaseId))
+            .limit(1);
+        if (!release)
+            throw notFound("Installed app release not found.");
+        assertCompatibleVersion(context.apiVersion ?? APP_API_VERSION, release.apiCompatibility);
+        return { installation, release };
+    }
+    function enforceRateLimit(context) {
+        const policy = options.rateLimit ?? DEFAULT_RATE_LIMIT;
+        hit(`installation:${context.installationId}`, policy.installationLimit, policy.windowMs);
+        hit(`app:${context.appId}`, policy.appLimit, policy.windowMs);
+    }
+    function hit(key, limit, windowMs) {
+        const timestamp = now().getTime();
+        const bucket = buckets.get(key);
+        if (!bucket || bucket.resetAt <= timestamp) {
+            buckets.set(key, { count: 1, resetAt: timestamp + windowMs });
+            return;
+        }
+        if (bucket.count >= limit) {
+            throw new ApiHttpError("App API rate limit exceeded.", {
+                status: 429,
+                code: "app_api_rate_limited",
+                details: { key, resetAt: new Date(bucket.resetAt).toISOString() },
+            });
+        }
+        bucket.count += 1;
+    }
+    function owner(access) {
+        return createAppCustomFieldDefinitionOwner({
+            appId: access.installation.appId,
+            namespace: access.installation.namespace,
+        });
+    }
+    function customFieldsRequired() {
+        if (!customFields)
+            throw notSupported("Custom fields App API runtime is not configured.");
+        return customFields;
+    }
+}
+export function assertAppNamespaceAlias(namespace) {
+    if (!namespace || namespace === "$app")
+        return;
+    if (PHYSICAL_APP_NAMESPACE.test(namespace) || !REMOTE_APP_NAMESPACE.test(namespace)) {
+        throw new ApiHttpError("App APIs accept only the server-resolved $app namespace alias.", {
+            status: 400,
+            code: "app_api_invalid_custom_field_namespace",
+        });
+    }
+}
+export function assertCompatibleVersion(requested, range) {
+    if (requested < range.min || requested > range.max) {
+        throw new ApiHttpError("Requested App API version is outside the installed release range.", {
+            status: 426,
+            code: "app_api_version_out_of_range",
+            details: { requested, supported: range },
+        });
+    }
+}
+export async function withAppApiDeadline(promise, timeoutMs = 5_000) {
+    let timeout;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise((_, reject) => {
+                timeout = setTimeout(() => reject(new ApiHttpError("App API request deadline exceeded.", {
+                    status: 504,
+                    code: "app_api_deadline_exceeded",
+                })), timeoutMs);
+            }),
+        ]);
+    }
+    finally {
+        if (timeout)
+            clearTimeout(timeout);
+    }
+}
+function notSupported(message) {
+    return new ApiHttpError(message, { status: 501, code: "app_api_not_configured" });
+}
+function notFound(message) {
+    return new ApiHttpError(message, { status: 404, code: "not_found" });
+}

package/dist/app-api-service.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/app-api-service.test.js

@@ -0,0 +1,109 @@
+import { ApiHttpError } from "@voyant-travel/hono";
+import { describe, expect, it, vi } from "vitest";
+import { assertAppNamespaceAlias, assertCompatibleVersion, createAppApiService, } from "./app-api-service.js";
+import { appGrants, appInstallations, appReleases } from "./schema.js";
+function postgresStub(implementation) {
+    const db = Object.create(null);
+    Object.assign(db, implementation);
+    return db;
+}
+function createAccessDb(options) {
+    const installation = {
+        id: "inst_1",
+        appId: "app_1",
+        deploymentId: "dep_1",
+        releaseId: "rel_1",
+        status: options.status ?? "active",
+        namespace: "app--one",
+    };
+    const release = {
+        id: "rel_1",
+        appId: "app_1",
+        releaseVersion: "1.0.0",
+        apiCompatibility: options.releaseRange ?? { min: "2026-07-01", max: "2026-12-31" },
+    };
+    return postgresStub({
+        select: () => ({
+            from: (table) => ({
+                where: () => {
+                    const rows = () => {
+                        if (table === appInstallations)
+                            return [installation];
+                        if (table === appReleases)
+                            return [release];
+                        if (table === appGrants)
+                            return (options.scopes ?? []).map((scope) => ({ scope }));
+                        return [];
+                    };
+                    return {
+                        // biome-ignore lint/suspicious/noThenProperty: test stub models Drizzle's awaitable query builder -- owner: apps.
+                        then: (resolve) => Promise.resolve(rows()).then(resolve),
+                        orderBy: async () => rows(),
+                        limit: async () => rows(),
+                    };
+                },
+            }),
+        }),
+    });
+}
+const context = {
+    appId: "app_1",
+    installationId: "inst_1",
+    releaseId: "rel_1",
+    tokenMode: "offline",
+    scopes: [],
+    apiVersion: "2026-07-01",
+};
+describe("App API service boundary", () => {
+    it("rejects direct service calls when the installation is inactive", async () => {
+        const service = createAppApiService();
+        await expect(service.requireAccess(createAccessDb({ status: "paused", scopes: ["app-installation:read"] }), { ...context, scopes: ["app-installation:read"] }, ["app-installation:read"])).rejects.toMatchObject({ status: 403, code: "app_installation_not_active" });
+    });
+    it("rejects when the installation grant is missing even if the token carries the scope", async () => {
+        const service = createAppApiService();
+        await expect(service.requireAccess(createAccessDb({ scopes: [] }), { ...context, scopes: ["app-installation:read"] }, ["app-installation:read"])).rejects.toMatchObject({ status: 403, code: "app_installation_scope_missing" });
+    });
+    it("rejects when a narrowed online token lacks the scope the installation was granted", async () => {
+        const service = createAppApiService();
+        await expect(service.requireAccess(createAccessDb({ scopes: ["app-installation:read", "finance-documents:read"] }), { ...context, tokenMode: "online", scopes: ["app-installation:read"] }, ["finance-documents:read"])).rejects.toMatchObject({ status: 403, code: "app_api_token_scope_missing" });
+    });
+    it("fails closed when the requested API version is outside the installed release range", async () => {
+        const service = createAppApiService();
+        await expect(service.requireAccess(createAccessDb({
+            scopes: ["app-installation:read"],
+            releaseRange: { min: "2026-08-01", max: "2026-12-31" },
+        }), { ...context, scopes: ["app-installation:read"] }, ["app-installation:read"])).rejects.toMatchObject({ status: 426, code: "app_api_version_out_of_range" });
+    });
+    it("requires action-ledger approval for finance actions even when OAuth scope is granted", async () => {
+        const executeAction = vi.fn();
+        const service = createAppApiService({
+            finance: { listDocuments: vi.fn(), executeAction },
+        });
+        await expect(service.executeFinanceAction(createAccessDb({ scopes: ["finance-actions:issue"] }), { ...context, scopes: ["finance-actions:issue"] }, {
+            action: "issue",
+            idempotencyKey: "idem_1",
+            payload: {},
+        })).rejects.toMatchObject({ status: 403, code: "app_api_finance_approval_required" });
+        expect(executeAction).not.toHaveBeenCalled();
+    });
+    it("isolates rate limits per installation", async () => {
+        const service = createAppApiService({
+            rateLimit: { installationLimit: 1, appLimit: 10, windowMs: 60_000 },
+        });
+        const rateContext = { ...context, appId: "rate_app", installationId: "rate_inst_1" };
+        service.enforceRateLimit(rateContext);
+        expect(() => service.enforceRateLimit(rateContext)).toThrow(ApiHttpError);
+        expect(() => service.enforceRateLimit({ ...rateContext, installationId: "rate_inst_2" })).not.toThrow();
+    });
+    it("accepts only the $app custom-field namespace alias from request data", () => {
+        expect(() => assertAppNamespaceAlias(undefined)).not.toThrow();
+        expect(() => assertAppNamespaceAlias("$app")).not.toThrow();
+        expect(() => assertAppNamespaceAlias("$app:sync")).not.toThrow();
+        expect(() => assertAppNamespaceAlias("app--foreign")).toThrow(ApiHttpError);
+        expect(() => assertAppNamespaceAlias("custom")).toThrow(ApiHttpError);
+    });
+    it("compares App API compatibility ranges inclusively", () => {
+        expect(() => assertCompatibleVersion("2026-07-01", { min: "2026-07-01", max: "2026-12-31" })).not.toThrow();
+        expect(() => assertCompatibleVersion("2027-01-01", { min: "2026-07-01", max: "2026-12-31" })).toThrow(ApiHttpError);
+    });
+});

package/dist/consent.js

@@ -29,10 +29,25 @@ function canGrantScope(scope, remoteSafe, operatorGranted) {
 }
 function remoteSafeScopes(catalog) {
     const catalogScopes = new Set(catalog.resources.flatMap((resource) => resource.actions.map((action) => `${resource.resource}:${action.action}`)));
+    const remoteSafe = new Set();
+    // A scope is remote-safe when its owning resource is flagged remoteSafe, or
+    // when the specific action is. This is the authority for App API scopes;
+    // audience presets remain supported for operator-declared grant bundles.
+    for (const resource of catalog.resources) {
+        for (const action of resource.actions) {
+            if (resource.remoteSafe || action.remoteSafe) {
+                remoteSafe.add(`${resource.resource}:${action.action}`);
+            }
+        }
+    }
     const presetScopes = catalog.presets
         .filter((preset) => preset.kind === "api-token-grant" && Boolean(preset.audience))
         .flatMap((preset) => preset.grants);
-    return new Set(presetScopes.filter((scope) => catalogScopes.has(scope)));
+    for (const scope of presetScopes) {
+        if (catalogScopes.has(scope))
+            remoteSafe.add(scope);
+    }
+    return remoteSafe;
 }
 function parseReleaseScopes(value) {
     if (!value || typeof value !== "object")

package/dist/consent.test.js

@@ -77,4 +77,28 @@ describe("app OAuth consent computation", () => {
             operatorGrantedScopes: ["invoices:read"],
         })).toThrow("Required app scopes are not grantable");
     });
+    it("grants App API scopes marked remoteSafe on the resource without a matching preset", () => {
+        const withRemoteSafe = {
+            ...catalog,
+            resources: [
+                ...catalog.resources,
+                {
+                    id: "app-installation",
+                    unitId: "apps",
+                    resource: "app-installation",
+                    label: "App installation",
+                    description: "Self",
+                    wildcard: "explicit-resource",
+                    remoteSafe: true,
+                    actions: [{ action: "read", label: "Read", description: "Read" }],
+                },
+            ],
+        };
+        const consent = computeAppConsent({
+            release: release(["app-installation:read"], []),
+            accessCatalog: withRemoteSafe,
+            operatorGrantedScopes: ["app-installation:read"],
+        });
+        expect(consent.grantedScopes).toEqual(["app-installation:read"]);
+    });
 });

package/dist/contracts.d.ts

@@ -29,8 +29,8 @@ export declare const appOwnedCustomFieldDeclarationSchema: z.ZodObject<{
     }, z.core.$strip>>>>;
     logicalNamespace: z.ZodOptional<z.ZodString>;
     dataClassification: z.ZodDefault<z.ZodEnum<{
-        public: "public";
         internal: "internal";
+        public: "public";
         confidential: "confidential";
         restricted: "restricted";
         personal: "personal";
@@ -106,8 +106,8 @@ export declare const appManifestSchema: z.ZodPipe<z.ZodRecord<z.ZodString, z.Zod
         }, z.core.$strip>>>>;
         logicalNamespace: z.ZodOptional<z.ZodString>;
         dataClassification: z.ZodDefault<z.ZodEnum<{
-            public: "public";
             internal: "internal";
+            public: "public";
             confidential: "confidential";
             restricted: "restricted";
             personal: "personal";
@@ -134,8 +134,8 @@ export declare const appManifestSchema: z.ZodPipe<z.ZodRecord<z.ZodString, z.Zod
     }, z.core.$strict>;
     data: z.ZodObject<{
         classifications: z.ZodArray<z.ZodEnum<{
-            public: "public";
             internal: "internal";
+            public: "public";
             confidential: "confidential";
             restricted: "restricted";
             personal: "personal";

package/dist/index.d.ts

@@ -1,4 +1,7 @@
 export * from "./access-boundary.js";
+export * from "./app-api-contracts.js";
+export * from "./app-api-routes.js";
+export * from "./app-api-service.js";
 export * from "./compiler.js";
 export * from "./consent.js";
 export * from "./contracts.js";

package/dist/index.js

@@ -1,4 +1,7 @@
 export * from "./access-boundary.js";
+export * from "./app-api-contracts.js";
+export * from "./app-api-routes.js";
+export * from "./app-api-service.js";
 export * from "./compiler.js";
 export * from "./consent.js";
 export * from "./contracts.js";

package/dist/installation-service.d.ts

@@ -100,7 +100,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             uninstalledAt: Date | null;
             purgedAt: Date | null;
         };
-        outcome: "created" | "reinstalled";
+        outcome: "reinstalled" | "created";
     }>;
     upgrade: (db: PostgresJsDatabase, input: UpgradeAppInput) => Promise<{
         installation: {

package/dist/voyant.js

@@ -1,4 +1,5 @@
-import { defineModule } from "@voyant-travel/core/project";
+import { defineModule, requirePort } from "@voyant-travel/core/project";
+import { customFieldValueLifecycleRuntimePort, customFieldValueOperationsRuntimePort, } from "@voyant-travel/core/runtime-port";
 const appInstallationLifecyclePayloadSchema = {
     type: "object",
     additionalProperties: false,
@@ -13,6 +14,16 @@ export const appsVoyantModule = defineModule({
     id: "@voyant-travel/apps",
     packageName: "@voyant-travel/apps",
     localId: "apps",
+    runtimePorts: [
+        requirePort(customFieldValueLifecycleRuntimePort, {
+            optional: true,
+            cardinality: "many",
+        }),
+        requirePort(customFieldValueOperationsRuntimePort, {
+            optional: true,
+            cardinality: "many",
+        }),
+    ],
     api: [
         {
             id: "@voyant-travel/apps#api.admin",
@@ -82,6 +93,81 @@ export const appsVoyantModule = defineModule({
     ],
     access: {
         resources: [
+            {
+                id: "@voyant-travel/apps#access.app-installation",
+                resource: "app-installation",
+                label: "App installation",
+                description: "Read the calling app installation and grant state.",
+                remoteSafe: true,
+                actions: [{ action: "read", label: "Read installation", description: "Read self." }],
+            },
+            {
+                id: "@voyant-travel/apps#access.custom-field-definitions",
+                resource: "custom-field-definitions",
+                label: "Own custom-field definitions",
+                description: "Read and write custom-field definitions owned by the app.",
+                remoteSafe: true,
+                actions: ["read", "write"],
+                wildcard: "explicit-resource",
+            },
+            {
+                id: "@voyant-travel/apps#access.custom-field-values",
+                resource: "custom-field-values",
+                label: "Own custom-field values",
+                description: "Read and write app-owned custom-field values by target.",
+                remoteSafe: true,
+                actions: ["read", "write", "booking", "person", "organization", "invoice"],
+                wildcard: "explicit-resource",
+            },
+            {
+                id: "@voyant-travel/apps#access.webhooks",
+                resource: "webhooks",
+                label: "App webhooks",
+                description: "Read webhook health and request replay.",
+                remoteSafe: true,
+                actions: [
+                    "read",
+                    { action: "replay", label: "Replay webhooks", description: "Replay deliveries." },
+                ],
+            },
+            {
+                id: "@voyant-travel/apps#access.app-audit",
+                resource: "app-audit",
+                label: "App audit history",
+                description: "Read audit history owned by the app.",
+                remoteSafe: true,
+                actions: ["read"],
+            },
+            {
+                id: "@voyant-travel/apps#access.online-token",
+                resource: "online-token",
+                label: "Online token exchange",
+                description: "Exchange admin session context for online app access.",
+                remoteSafe: true,
+                actions: [{ action: "exchange", wildcard: "explicit" }],
+            },
+            {
+                id: "@voyant-travel/apps#access.finance-documents",
+                resource: "finance-documents",
+                label: "Finance documents",
+                description: "Read finance documents visible to remote accounting apps.",
+                remoteSafe: true,
+                actions: ["read"],
+                wildcard: "explicit-resource",
+            },
+            {
+                id: "@voyant-travel/apps#access.finance-actions",
+                resource: "finance-actions",
+                label: "Finance actions",
+                description: "Request approved finance document actions.",
+                remoteSafe: true,
+                actions: [
+                    { action: "issue", sensitive: true, wildcard: "explicit" },
+                    { action: "retry", sensitive: true, wildcard: "explicit" },
+                    { action: "reconcile", sensitive: true, wildcard: "explicit" },
+                ],
+                wildcard: "explicit-resource",
+            },
             {
                 id: "@voyant-travel/apps#access.apps",
                 resource: "apps",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyant-travel/apps",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "license": "Apache-2.0",
   "type": "module",
   "exports": {
@@ -14,6 +14,21 @@
       "import": "./dist/access-boundary.js",
       "default": "./dist/access-boundary.js"
     },
+    "./app-api-contracts": {
+      "types": "./dist/app-api-contracts.d.ts",
+      "import": "./dist/app-api-contracts.js",
+      "default": "./dist/app-api-contracts.js"
+    },
+    "./app-api-routes": {
+      "types": "./dist/app-api-routes.d.ts",
+      "import": "./dist/app-api-routes.js",
+      "default": "./dist/app-api-routes.js"
+    },
+    "./app-api-service": {
+      "types": "./dist/app-api-service.d.ts",
+      "import": "./dist/app-api-service.js",
+      "default": "./dist/app-api-service.js"
+    },
     "./api-runtime": {
       "types": "./dist/api-runtime.d.ts",
       "import": "./dist/api-runtime.js",
@@ -81,13 +96,13 @@
     "hono": "^4.12.27",
     "zod": "^4.4.3",
     "@voyant-travel/admin": "^0.126.2",
-    "@voyant-travel/core": "^0.125.1",
     "@voyant-travel/admin-extension-sdk": "^0.1.1",
+    "@voyant-travel/core": "^0.125.2",
     "@voyant-travel/custom-fields": "^0.2.1",
     "@voyant-travel/db": "^0.114.10",
-    "@voyant-travel/types": "^0.109.3",
-    "@voyant-travel/webhook-delivery": "^0.4.0",
-    "@voyant-travel/hono": "^0.128.2"
+    "@voyant-travel/hono": "^0.128.3",
+    "@voyant-travel/types": "^0.109.4",
+    "@voyant-travel/webhook-delivery": "^0.4.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.2",