@voyant-travel/apps 0.3.0 → 0.5.0

package/dist/voyant.js

@@ -1,4 +1,5 @@
-import { defineModule } from "@voyant-travel/core/project";
+import { defineModule, requirePort } from "@voyant-travel/core/project";
+import { customFieldValueLifecycleRuntimePort, customFieldValueOperationsRuntimePort, } from "@voyant-travel/core/runtime-port";
 const appInstallationLifecyclePayloadSchema = {
     type: "object",
     additionalProperties: false,
@@ -13,6 +14,16 @@ export const appsVoyantModule = defineModule({
     id: "@voyant-travel/apps",
     packageName: "@voyant-travel/apps",
     localId: "apps",
+    runtimePorts: [
+        requirePort(customFieldValueLifecycleRuntimePort, {
+            optional: true,
+            cardinality: "many",
+        }),
+        requirePort(customFieldValueOperationsRuntimePort, {
+            optional: true,
+            cardinality: "many",
+        }),
+    ],
     api: [
         {
             id: "@voyant-travel/apps#api.admin",
@@ -82,6 +93,81 @@ export const appsVoyantModule = defineModule({
     ],
     access: {
         resources: [
+            {
+                id: "@voyant-travel/apps#access.app-installation",
+                resource: "app-installation",
+                label: "App installation",
+                description: "Read the calling app installation and grant state.",
+                remoteSafe: true,
+                actions: [{ action: "read", label: "Read installation", description: "Read self." }],
+            },
+            {
+                id: "@voyant-travel/apps#access.custom-field-definitions",
+                resource: "custom-field-definitions",
+                label: "Own custom-field definitions",
+                description: "Read and write custom-field definitions owned by the app.",
+                remoteSafe: true,
+                actions: ["read", "write"],
+                wildcard: "explicit-resource",
+            },
+            {
+                id: "@voyant-travel/apps#access.custom-field-values",
+                resource: "custom-field-values",
+                label: "Own custom-field values",
+                description: "Read and write app-owned custom-field values by target.",
+                remoteSafe: true,
+                actions: ["read", "write", "booking", "person", "organization", "invoice"],
+                wildcard: "explicit-resource",
+            },
+            {
+                id: "@voyant-travel/apps#access.webhooks",
+                resource: "webhooks",
+                label: "App webhooks",
+                description: "Read webhook health and request replay.",
+                remoteSafe: true,
+                actions: [
+                    "read",
+                    { action: "replay", label: "Replay webhooks", description: "Replay deliveries." },
+                ],
+            },
+            {
+                id: "@voyant-travel/apps#access.app-audit",
+                resource: "app-audit",
+                label: "App audit history",
+                description: "Read audit history owned by the app.",
+                remoteSafe: true,
+                actions: ["read"],
+            },
+            {
+                id: "@voyant-travel/apps#access.online-token",
+                resource: "online-token",
+                label: "Online token exchange",
+                description: "Exchange admin session context for online app access.",
+                remoteSafe: true,
+                actions: [{ action: "exchange", wildcard: "explicit" }],
+            },
+            {
+                id: "@voyant-travel/apps#access.finance-documents",
+                resource: "finance-documents",
+                label: "Finance documents",
+                description: "Read finance documents visible to remote accounting apps.",
+                remoteSafe: true,
+                actions: ["read"],
+                wildcard: "explicit-resource",
+            },
+            {
+                id: "@voyant-travel/apps#access.finance-actions",
+                resource: "finance-actions",
+                label: "Finance actions",
+                description: "Request approved finance document actions.",
+                remoteSafe: true,
+                actions: [
+                    { action: "issue", sensitive: true, wildcard: "explicit" },
+                    { action: "retry", sensitive: true, wildcard: "explicit" },
+                    { action: "reconcile", sensitive: true, wildcard: "explicit" },
+                ],
+                wildcard: "explicit-resource",
+            },
             {
                 id: "@voyant-travel/apps#access.apps",
                 resource: "apps",

package/migrations/20260717150000_app_session_tokens.sql

@@ -0,0 +1,18 @@
+CREATE TABLE "app_session_tokens" (
+	"id" text PRIMARY KEY NOT NULL,
+	"installation_id" text NOT NULL,
+	"app_id" text NOT NULL,
+	"deployment_id" text NOT NULL,
+	"jti" text NOT NULL,
+	"viewer_id" text NOT NULL,
+	"entity_type" text,
+	"entity_id" text,
+	"slot" text,
+	"issued_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"consumed_at" timestamp with time zone,
+	"consumed_by_actor_id" text
+);--> statement-breakpoint
+ALTER TABLE "app_session_tokens" ADD CONSTRAINT "app_session_tokens_installation_id_app_installations_id_fk" FOREIGN KEY ("installation_id") REFERENCES "public"."app_installations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "uidx_app_session_tokens_jti" ON "app_session_tokens" USING btree ("jti");--> statement-breakpoint
+CREATE INDEX "idx_app_session_tokens_installation" ON "app_session_tokens" USING btree ("installation_id","expires_at");

package/migrations/meta/_journal.json

@@ -29,6 +29,13 @@
       "when": 1784298600000,
       "tag": "20260717143000_app_oauth_authorization",
       "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "7",
+      "when": 1784300400000,
+      "tag": "20260717150000_app_session_tokens",
+      "breakpoints": true
     }
   ]
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyant-travel/apps",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "license": "Apache-2.0",
   "type": "module",
   "exports": {
@@ -14,6 +14,21 @@
       "import": "./dist/access-boundary.js",
       "default": "./dist/access-boundary.js"
     },
+    "./app-api-contracts": {
+      "types": "./dist/app-api-contracts.d.ts",
+      "import": "./dist/app-api-contracts.js",
+      "default": "./dist/app-api-contracts.js"
+    },
+    "./app-api-routes": {
+      "types": "./dist/app-api-routes.d.ts",
+      "import": "./dist/app-api-routes.js",
+      "default": "./dist/app-api-routes.js"
+    },
+    "./app-api-service": {
+      "types": "./dist/app-api-service.d.ts",
+      "import": "./dist/app-api-service.js",
+      "default": "./dist/app-api-service.js"
+    },
     "./api-runtime": {
       "types": "./dist/api-runtime.d.ts",
       "import": "./dist/api-runtime.js",
@@ -34,11 +49,21 @@
       "import": "./dist/consent.js",
       "default": "./dist/consent.js"
     },
+    "./extension-resolution": {
+      "types": "./dist/extension-resolution.d.ts",
+      "import": "./dist/extension-resolution.js",
+      "default": "./dist/extension-resolution.js"
+    },
     "./ingestion": {
       "types": "./dist/ingestion.d.ts",
       "import": "./dist/ingestion.js",
       "default": "./dist/ingestion.js"
     },
+    "./locale-resolution": {
+      "types": "./dist/locale-resolution.d.ts",
+      "import": "./dist/locale-resolution.js",
+      "default": "./dist/locale-resolution.js"
+    },
     "./installation-service": {
       "types": "./dist/installation-service.d.ts",
       "import": "./dist/installation-service.js",
@@ -69,6 +94,16 @@
       "import": "./dist/service.js",
       "default": "./dist/service.js"
     },
+    "./session-token": {
+      "types": "./dist/session-token.d.ts",
+      "import": "./dist/session-token.js",
+      "default": "./dist/session-token.js"
+    },
+    "./session-token-service": {
+      "types": "./dist/session-token-service.d.ts",
+      "import": "./dist/session-token-service.js",
+      "default": "./dist/session-token-service.js"
+    },
     "./voyant": {
       "types": "./dist/voyant.d.ts",
       "import": "./dist/voyant.js",
@@ -80,14 +115,14 @@
     "drizzle-orm": "^0.45.2",
     "hono": "^4.12.27",
     "zod": "^4.4.3",
-    "@voyant-travel/admin": "^0.126.2",
-    "@voyant-travel/core": "^0.125.1",
-    "@voyant-travel/admin-extension-sdk": "^0.1.1",
+    "@voyant-travel/admin": "^0.127.0",
+    "@voyant-travel/admin-extension-sdk": "^0.2.0",
+    "@voyant-travel/core": "^0.125.2",
     "@voyant-travel/custom-fields": "^0.2.1",
     "@voyant-travel/db": "^0.114.10",
-    "@voyant-travel/types": "^0.109.3",
-    "@voyant-travel/webhook-delivery": "^0.4.0",
-    "@voyant-travel/hono": "^0.128.2"
+    "@voyant-travel/hono": "^0.128.3",
+    "@voyant-travel/types": "^0.109.4",
+    "@voyant-travel/webhook-delivery": "^0.4.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.2",