@voyant-travel/apps 0.4.0 → 0.6.0

package/dist/routes.js

@@ -1,16 +1,33 @@
-import { parseJsonBody, parseQuery, RequestValidationError } from "@voyant-travel/hono";
+import { parseJsonBody, parseQuery, RequestValidationError, requireUserId, } from "@voyant-travel/hono";
 import { Hono } from "hono";
 import { z } from "zod";
-import { appCredentialRevocationSchema, appListQuerySchema, appOAuthAuthorizeQuerySchema, appOAuthTokenSchema, appWebhookReplaySchema, createCustomAppRegistrationSchema, releaseManifestFetchSchema, releaseManifestUploadSchema, } from "./contracts.js";
+import { activateInstallationBodySchema, appCredentialRevocationSchema, appInstallationAuditQuerySchema, appInstallationListQuerySchema, appListQuerySchema, appOAuthAuthorizeQuerySchema, appOAuthTokenSchema, appSessionTokenExchangeSchema, appSessionTokenIssueSchema, appWebhookReplaySchema, createCustomAppRegistrationSchema, installAppSchema, lifecycleActionBodySchema, releaseManifestFetchSchema, releaseManifestUploadSchema, } from "./contracts.js";
+import { listAppReleases, listInstallationAudit, listInstallationSummaries, loadInstallationDetail, } from "./installation-read-model.js";
+import { createAppInstallationService } from "./installation-service.js";
 import { createAppOAuthService } from "./oauth-service.js";
 import { createAppsService } from "./service.js";
+import { createAppSessionTokenService } from "./session-token-service.js";
 import { listAppWebhookHealth, replayAppWebhookDelivery } from "./webhook-delivery.js";
 const appIdParamSchema = z.object({ appId: z.string().min(1) });
 const installationIdParamSchema = z.object({ installationId: z.string().min(1) });
 export function createAppsAdminRoutes(options = {}) {
     const routes = new Hono();
     const service = createAppsService(options);
+    const installations = createAppInstallationService({
+        deploymentId: options.oauth?.deploymentId ?? options.deploymentId,
+        platformApiVersion: options.platformApiVersion,
+        eventBus: options.eventBus,
+        customFields: options.customFields,
+    });
     const oauth = options.oauth ? createAppOAuthService(options.oauth) : null;
+    const sessionTokens = oauth && options.oauth && options.sessionToken
+        ? createAppSessionTokenService({
+            secret: options.sessionToken.secret,
+            ttlSeconds: options.sessionToken.ttlSeconds,
+            deploymentId: options.oauth.deploymentId,
+            oauth,
+        })
+        : null;
     routes.get("/", async (c) => {
         const query = parseQuery(c, appListQuerySchema);
         return c.json(await service.list(c.get("db"), query), 200);
@@ -81,11 +98,127 @@ export function createAppsAdminRoutes(options = {}) {
         const result = await oauth.revokeInstallationCredentials(c.get("db"), body.installationId, body.actorId);
         return c.json(result, 200);
     });
+    // Staff-authenticated: the admin host requests a short-lived session token for
+    // the current viewer + entity/slot context. The viewer is taken from the
+    // authenticated session, never from the frame.
+    routes.post("/installations/:installationId/session-token", async (c) => {
+        if (!sessionTokens)
+            return c.json({ error: "App session tokens are not configured" }, 501);
+        const { installationId } = parseInstallationParams(c.req.param());
+        const viewerId = requireUserId(c);
+        const body = await parseJsonBody(c, appSessionTokenIssueSchema);
+        const issued = await sessionTokens.issue(c.get("db"), {
+            installationId,
+            viewerId,
+            entity: body.entity ?? null,
+            slot: body.slot ?? null,
+        });
+        return c.json({ data: issued }, 201);
+    });
+    // App-backend-facing: exchange a presented session token for online actor
+    // access. Client-authenticated; bounded by viewer ∩ app grants.
+    routes.post("/oauth/session-token/exchange", async (c) => {
+        if (!sessionTokens)
+            return c.json({ error: "App session tokens are not configured" }, 501);
+        const body = await parseJsonBody(c, appSessionTokenExchangeSchema);
+        const token = await sessionTokens.exchange(c.get("db"), {
+            token: body.session_token,
+            clientId: body.client_id,
+            clientSecret: body.client_secret,
+            viewerScopes: body.viewer_scopes,
+            contextualScopes: body.contextual_scopes,
+        });
+        return c.json(token, 200);
+    });
+    routes.post("/install", async (c) => {
+        const body = await parseJsonBody(c, installAppSchema);
+        // The deployment id is a runtime value (not known at graph-composition
+        // time), so resolve it per request: explicit body → runtime env →
+        // construction option. Without this the standard runtime mounts these
+        // routes with no deployment id and every install 400s (app_deployment_required).
+        const deploymentId = body.deploymentId ?? c.env?.VOYANT_CLOUD_DEPLOYMENT_ID?.trim() ?? options.deploymentId;
+        const result = await installations.install(c.get("db"), {
+            appId: body.appId,
+            releaseId: body.releaseId,
+            actorId: body.actorId,
+            grantedOptionalScopes: body.grantedOptionalScopes,
+            updatePolicy: body.updatePolicy,
+            deploymentId,
+        });
+        return c.json({ data: result }, 201);
+    });
+    routes.get("/installations", async (c) => {
+        const query = parseQuery(c, appInstallationListQuerySchema);
+        return c.json(await listInstallationSummaries(c.get("db"), query), 200);
+    });
+    routes.get("/installations/:installationId", async (c) => {
+        const { installationId } = parseInstallationParams(c.req.param());
+        const detail = await loadInstallationDetail(c.get("db"), installationId, {
+            platformApiVersion: options.platformApiVersion,
+        });
+        return detail
+            ? c.json({ data: detail }, 200)
+            : c.json({ error: "App installation not found" }, 404);
+    });
+    routes.get("/installations/:installationId/audit", async (c) => {
+        const { installationId } = parseInstallationParams(c.req.param());
+        const query = parseQuery(c, appInstallationAuditQuerySchema);
+        const data = await listInstallationAudit(c.get("db"), installationId, query.limit);
+        return c.json({ data }, 200);
+    });
+    routes.post("/installations/:installationId/pause", async (c) => {
+        const { installationId } = parseInstallationParams(c.req.param());
+        const body = await parseJsonBody(c, lifecycleActionBodySchema);
+        const result = await installations.pause(c.get("db"), { installationId, actorId: body.actorId });
+        return c.json({ data: result }, 200);
+    });
+    routes.post("/installations/:installationId/resume", async (c) => {
+        const { installationId } = parseInstallationParams(c.req.param());
+        const body = await parseJsonBody(c, lifecycleActionBodySchema);
+        const result = await installations.resume(c.get("db"), {
+            installationId,
+            actorId: body.actorId,
+        });
+        return c.json({ data: result }, 200);
+    });
+    routes.post("/installations/:installationId/uninstall", async (c) => {
+        const { installationId } = parseInstallationParams(c.req.param());
+        const body = await parseJsonBody(c, lifecycleActionBodySchema);
+        const result = await installations.uninstall(c.get("db"), {
+            installationId,
+            actorId: body.actorId,
+        });
+        return c.json({ data: result }, 200);
+    });
+    routes.post("/installations/:installationId/activate", async (c) => {
+        const { installationId } = parseInstallationParams(c.req.param());
+        const body = await parseJsonBody(c, activateInstallationBodySchema);
+        const result = await installations.upgrade(c.get("db"), {
+            installationId,
+            releaseId: body.releaseId,
+            actorId: body.actorId,
+        });
+        return c.json({ data: result }, 200);
+    });
+    routes.post("/installations/:installationId/purge-preview", async (c) => {
+        const { installationId } = parseInstallationParams(c.req.param());
+        const body = await parseJsonBody(c, lifecycleActionBodySchema);
+        const result = await installations.purgePreview(c.get("db"), {
+            installationId,
+            actorId: body.actorId,
+        });
+        return c.json({ data: result }, 200);
+    });
     routes.get("/:appId", async (c) => {
         const { appId } = parseParams(c.req.param());
         const app = await service.get(c.get("db"), appId);
         return app ? c.json({ data: app }, 200) : c.json({ error: "App not found" }, 404);
     });
+    routes.get("/:appId/releases", async (c) => {
+        const { appId } = parseParams(c.req.param());
+        const data = await listAppReleases(c.get("db"), appId);
+        return c.json({ data }, 200);
+    });
     routes.post("/:appId/releases", async (c) => {
         const { appId } = parseParams(c.req.param());
         const body = await parseJsonBody(c, releaseManifestUploadSchema);

package/dist/schema.d.ts

@@ -2928,6 +2928,241 @@ export declare const appAuditEvents: import("drizzle-orm/pg-core").PgTableWithCo
     };
     dialect: "pg";
 }>;
+/**
+ * Issued admin session tokens for iframe extensions. Each row is the durable
+ * record of one short-lived, single-use session token: it makes issuance and
+ * exchange auditable and provides the replay guard — a token's `jti` may be
+ * consumed at most once (unique index + a conditional update on `consumedAt`).
+ * The token bytes are never stored; only the signed claim identity.
+ */
+export declare const appSessionTokens: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "app_session_tokens";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: string;
+            tableName: "app_session_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: true;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        installationId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "installation_id";
+            tableName: "app_session_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        appId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "app_id";
+            tableName: "app_session_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        deploymentId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "deployment_id";
+            tableName: "app_session_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        jti: import("drizzle-orm/pg-core").PgColumn<{
+            name: "jti";
+            tableName: "app_session_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        viewerId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "viewer_id";
+            tableName: "app_session_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        entityType: import("drizzle-orm/pg-core").PgColumn<{
+            name: "entity_type";
+            tableName: "app_session_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        entityId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "entity_id";
+            tableName: "app_session_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        slot: import("drizzle-orm/pg-core").PgColumn<{
+            name: "slot";
+            tableName: "app_session_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        issuedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "issued_at";
+            tableName: "app_session_tokens";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at";
+            tableName: "app_session_tokens";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        consumedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "consumed_at";
+            tableName: "app_session_tokens";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        consumedByActorId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "consumed_by_actor_id";
+            tableName: "app_session_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
 export type AppRegistration = typeof apps.$inferSelect;
 export type NewAppRegistration = typeof apps.$inferInsert;
 export type AppRelease = typeof appReleases.$inferSelect;
@@ -2935,3 +3170,5 @@ export type NewAppRelease = typeof appReleases.$inferInsert;
 export type AppInstallation = typeof appInstallations.$inferSelect;
 export type NewAppInstallation = typeof appInstallations.$inferInsert;
 export type AppAccessCredential = typeof appAccessCredentials.$inferSelect;
+export type AppSessionTokenRow = typeof appSessionTokens.$inferSelect;
+export type NewAppSessionTokenRow = typeof appSessionTokens.$inferInsert;

package/dist/schema.js

@@ -340,3 +340,30 @@ export const appAuditEvents = pgTable("app_audit_events", {
     index("idx_app_audit_events_installation").on(table.installationId, table.createdAt),
     index("idx_app_audit_events_app").on(table.appId, table.deploymentId, table.createdAt),
 ]);
+/**
+ * Issued admin session tokens for iframe extensions. Each row is the durable
+ * record of one short-lived, single-use session token: it makes issuance and
+ * exchange auditable and provides the replay guard — a token's `jti` may be
+ * consumed at most once (unique index + a conditional update on `consumedAt`).
+ * The token bytes are never stored; only the signed claim identity.
+ */
+export const appSessionTokens = pgTable("app_session_tokens", {
+    id: typeId("app_session_tokens"),
+    installationId: text("installation_id")
+        .notNull()
+        .references(() => appInstallations.id, { onDelete: "cascade" }),
+    appId: text("app_id").notNull(),
+    deploymentId: text("deployment_id").notNull(),
+    jti: text("jti").notNull(),
+    viewerId: text("viewer_id").notNull(),
+    entityType: text("entity_type"),
+    entityId: text("entity_id"),
+    slot: text("slot"),
+    issuedAt: timestamp("issued_at", { withTimezone: true }).notNull().defaultNow(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    consumedAt: timestamp("consumed_at", { withTimezone: true }),
+    consumedByActorId: text("consumed_by_actor_id"),
+}, (table) => [
+    uniqueIndex("uidx_app_session_tokens_jti").on(table.jti),
+    index("idx_app_session_tokens_installation").on(table.installationId, table.expiresAt),
+]);

package/dist/session-token-service.d.ts

@@ -0,0 +1,47 @@
+import type { PostgresJsDatabase } from "drizzle-orm/postgres-js";
+import type { createAppOAuthService } from "./oauth-service.js";
+import { type AppSessionTokenEntity } from "./session-token.js";
+type AppOAuthService = ReturnType<typeof createAppOAuthService>;
+export interface AppSessionTokenServiceOptions {
+    /** Root secret; the signing key is HKDF-derived from it under a private context. */
+    secret: string;
+    /** The deployment audience the tokens are bound to. */
+    deploymentId: string;
+    /** OAuth service supplying the online actor-token-exchange primitive. */
+    oauth: AppOAuthService;
+    ttlSeconds?: number;
+    now?: () => Date;
+}
+export interface IssueAppSessionTokenInput {
+    installationId: string;
+    viewerId: string;
+    entity?: AppSessionTokenEntity | null;
+    slot?: string | null;
+}
+export interface IssuedAppSessionToken {
+    token: string;
+    tokenId: string;
+    expiresAtMs: number;
+}
+export interface ExchangeAppSessionTokenInput {
+    token: string;
+    /** Authenticating app client; must match the token audience (confused-deputy guard). */
+    clientId: string;
+    clientSecret?: string;
+    /** The viewer's current effective scopes; the online token is bounded by these. */
+    viewerScopes: readonly string[];
+    /** Optional further contextual narrowing (defaults to the app grants). */
+    contextualScopes?: readonly string[];
+}
+export declare function createAppSessionTokenService(options: AppSessionTokenServiceOptions): {
+    issue: (db: PostgresJsDatabase, input: IssueAppSessionTokenInput) => Promise<IssuedAppSessionToken>;
+    exchange: (db: PostgresJsDatabase, input: ExchangeAppSessionTokenInput) => Promise<{
+        refreshToken?: string | undefined;
+        accessToken: string;
+        tokenType: "Bearer";
+        expiresIn: number;
+        scope: string;
+        tokenMode: "offline" | "online";
+    }>;
+};
+export {};

package/dist/session-token-service.js

@@ -0,0 +1,127 @@
+/**
+ * Issuance, replay guard, and backend exchange for admin session tokens.
+ *
+ * The crypto lives in `session-token.ts`; this module binds it to the
+ * installation aggregate:
+ * - {@link issueAppSessionToken} mints a token for an active installation and
+ *   records the `jti` so it can be consumed exactly once.
+ * - {@link exchangeAppSessionToken} verifies a token an app backend presents,
+ *   consumes its `jti` (rejecting replay), and swaps it for online actor access
+ *   via the existing OAuth actor-token-exchange primitive — bounded by the
+ *   intersection of the app's grants and the viewer's scopes.
+ *
+ * Both paths write `app_audit_events` so issuance and exchange are auditable.
+ */
+import { ApiHttpError } from "@voyant-travel/hono";
+import { and, eq, isNull } from "drizzle-orm";
+import { appAuditEvents, appInstallations, appSessionTokens, } from "./schema.js";
+import { signAppSessionToken, verifyAppSessionToken, } from "./session-token.js";
+export function createAppSessionTokenService(options) {
+    const now = () => options.now?.() ?? new Date();
+    async function issue(db, input) {
+        const installation = await requireActiveInstallation(db, input.installationId);
+        const context = {
+            appId: installation.appId,
+            installationId: installation.id,
+            deploymentId: installation.deploymentId,
+            viewerId: input.viewerId,
+            entity: input.entity ?? null,
+            slot: input.slot ?? null,
+        };
+        const signed = signAppSessionToken(context, options.secret, {
+            now,
+            ttlSeconds: options.ttlSeconds,
+        });
+        await db.insert(appSessionTokens).values({
+            installationId: installation.id,
+            appId: installation.appId,
+            deploymentId: installation.deploymentId,
+            jti: signed.claims.jti,
+            viewerId: input.viewerId,
+            entityType: signed.claims.entity?.type ?? null,
+            entityId: signed.claims.entity?.id ?? null,
+            slot: signed.claims.slot,
+            expiresAt: new Date(signed.claims.exp * 1000),
+        });
+        await audit(db, installation, input.viewerId, "session-token.issued", {
+            jti: signed.claims.jti,
+            slot: signed.claims.slot,
+            entityType: signed.claims.entity?.type ?? null,
+        });
+        return { token: signed.token, tokenId: signed.claims.jti, expiresAtMs: signed.expiresAtMs };
+    }
+    async function exchange(db, input) {
+        const verified = verifyAppSessionToken(input.token, options.secret, {
+            deploymentId: options.deploymentId,
+            audience: input.clientId,
+            now,
+        });
+        if (!verified.ok) {
+            throw new ApiHttpError("Session token rejected", {
+                status: 401,
+                code: `app_session_token_${verified.reason}`,
+            });
+        }
+        const { claims } = verified;
+        // Single-use: consume the jti atomically. A row that is missing or already
+        // consumed is a replay and is refused before any credential is minted.
+        const consumed = await db
+            .update(appSessionTokens)
+            .set({ consumedAt: now(), consumedByActorId: claims.sub })
+            .where(and(eq(appSessionTokens.jti, claims.jti), isNull(appSessionTokens.consumedAt)))
+            .returning({ id: appSessionTokens.id });
+        if (consumed.length === 0) {
+            throw new ApiHttpError("Session token has already been used", {
+                status: 401,
+                code: "app_session_token_replayed",
+            });
+        }
+        const installation = await requireActiveInstallation(db, claims.installationId);
+        const tokens = await options.oauth.token(db, {
+            grantType: "urn:voyant:params:oauth:grant-type:actor-token-exchange",
+            installationId: installation.id,
+            viewerId: claims.sub,
+            viewerScopes: input.viewerScopes,
+            contextualScopes: input.contextualScopes,
+            clientId: input.clientId,
+            clientSecret: input.clientSecret,
+        });
+        await audit(db, installation, claims.sub, "session-token.exchanged", {
+            jti: claims.jti,
+            slot: claims.slot,
+        });
+        return tokens;
+    }
+    return { issue, exchange };
+}
+async function requireActiveInstallation(db, installationId) {
+    const [installation] = await db
+        .select()
+        .from(appInstallations)
+        .where(eq(appInstallations.id, installationId))
+        .limit(1);
+    if (!installation) {
+        throw new ApiHttpError("App installation not found", {
+            status: 404,
+            code: "app_installation_not_found",
+        });
+    }
+    if (installation.status !== "active") {
+        throw new ApiHttpError("App installation is not active", {
+            status: 403,
+            code: "app_installation_not_active",
+        });
+    }
+    return installation;
+}
+async function audit(db, installation, actorId, action, details) {
+    await db.insert(appAuditEvents).values({
+        installationId: installation.id,
+        appId: installation.appId,
+        deploymentId: installation.deploymentId,
+        actorId,
+        kind: "token",
+        action,
+        details,
+    });
+}