@voyant-travel/apps 0.9.1 → 0.10.1

package/dist/api-runtime.js

@@ -5,7 +5,7 @@ import { financeAppApiRuntimePort } from "@voyant-travel/finance-contracts/app-a
 import { createAppsAppApiRoutes } from "./app-api-routes.js";
 import { createAppOAuthService } from "./oauth-service.js";
 import { createAppsAdminRoutes } from "./routes.js";
-import { appsManagedAuthRuntimePort } from "./runtime-port.js";
+import { appsManagedAuthRuntimePort, appsManagedMarketplaceRuntimePort, } from "./runtime-port.js";
 export const createAppsApiModule = defineGraphRuntimeFactory(async ({ getPort, getPorts, graph, hasPort }) => {
     const customFieldTargets = createCustomFieldTargetRegistry(graph.customFieldTargets ?? []);
     const customFieldValueLifecycles = await getPorts(customFieldValueLifecycleRuntimePort);
@@ -16,6 +16,15 @@ export const createAppsApiModule = defineGraphRuntimeFactory(async ({ getPort, g
     const managedAuth = hasPort(appsManagedAuthRuntimePort)
         ? await getPort(appsManagedAuthRuntimePort)
         : undefined;
+    const managedMarketplace = hasPort(appsManagedMarketplaceRuntimePort)
+        ? await getPort(appsManagedMarketplaceRuntimePort)
+        : undefined;
+    if (managedAuth &&
+        managedMarketplace &&
+        managedAuth.runtimeAudience !== managedMarketplace.deploymentId) {
+        throw new TypeError("apps.managed-auth runtimeAudience must match apps.managed-marketplace deploymentId.");
+    }
+    const deploymentId = managedAuth?.runtimeAudience ?? managedMarketplace?.deploymentId;
     const oauthOptions = managedAuth
         ? {
             accessCatalog: graph.accessCatalog,
@@ -29,6 +38,10 @@ export const createAppsApiModule = defineGraphRuntimeFactory(async ({ getPort, g
         module: { name: "apps" },
         adminRoutes: createAppsAdminRoutes({
             eventCatalog: graph.eventCatalog,
+            ...(deploymentId ? { deploymentId } : {}),
+            ...(managedMarketplace
+                ? { managedMarketplace: managedMarketplace.acquisitionResolver }
+                : {}),
             ...(oauthOptions ? { oauth: oauthOptions } : {}),
             ...(managedAuth
                 ? {

package/dist/api-runtime.test.js

@@ -1,6 +1,7 @@
-import { describe, expect, it } from "vitest";
+import { Hono } from "hono";
+import { describe, expect, it, vi } from "vitest";
 import { createAppsApiModule } from "./api-runtime.js";
-import { appsManagedAuthRuntimePort } from "./runtime-port.js";
+import { appsManagedAuthRuntimePort, appsManagedMarketplaceRuntimePort } from "./runtime-port.js";
 const graph = {
     providerSelections: {},
     customFieldTargets: [],
@@ -10,18 +11,25 @@ const graph = {
     references: [],
     setupSteps: [],
 };
-function context(managedAuth) {
+function context(managedAuth, managedMarketplace) {
     return {
         unitId: "@voyant-travel/apps",
         projectConfig: {},
         getUnitProjectConfig: () => undefined,
         api: [],
         graph,
-        runtimePorts: managedAuth ? { [appsManagedAuthRuntimePort.id]: managedAuth } : {},
-        hasPort: (port) => port.id === appsManagedAuthRuntimePort.id && managedAuth !== undefined,
+        runtimePorts: {
+            ...(managedAuth ? { [appsManagedAuthRuntimePort.id]: managedAuth } : {}),
+            ...(managedMarketplace ? { [appsManagedMarketplaceRuntimePort.id]: managedMarketplace } : {}),
+        },
+        hasPort: (port) => (port.id === appsManagedAuthRuntimePort.id && managedAuth !== undefined) ||
+            (port.id === appsManagedMarketplaceRuntimePort.id && managedMarketplace !== undefined),
         getPort: async (port) => {
             if (port.id === appsManagedAuthRuntimePort.id && managedAuth)
                 return managedAuth;
+            if (port.id === appsManagedMarketplaceRuntimePort.id && managedMarketplace) {
+                return managedMarketplace;
+            }
             throw new Error(`missing ${port.id}`);
         },
         getPorts: async () => [],
@@ -55,4 +63,63 @@ describe("createAppsApiModule", () => {
             token: "test-token",
         })).resolves.toBeNull();
     });
+    it("composes managed acquisition independently from OAuth authority", async () => {
+        const module = await createAppsApiModule(context(undefined, {
+            deploymentId: "deployment-marketplace-1",
+            acquisitionResolver: {
+                resolveAcquisitionIntent: async () => null,
+                createSetupHandoff: async () => ({
+                    redirectUrl: "https://app.example.com/setup?code=opaque",
+                }),
+                notifyInstallationLifecycle: async () => undefined,
+            },
+        }));
+        expect(module.adminRoutes).toBeDefined();
+        expect(module.clientAuthenticated).toBeUndefined();
+        if (!module.adminRoutes)
+            throw new Error("apps admin routes are required");
+        const transaction = vi.fn(async () => {
+            throw new Error("installation transaction reached");
+        });
+        const app = new Hono();
+        app.onError((error, c) => c.json({ error: error.message }, 500));
+        app.use("*", async (c, next) => {
+            c.set("db", { transaction });
+            await next();
+        });
+        app.route("/", module.adminRoutes);
+        const response = await app.request("/install", {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+                appId: "app-1",
+                releaseId: "release-1",
+                actorId: "actor-1",
+            }),
+        });
+        expect(response.status).toBe(500);
+        await expect(response.json()).resolves.toEqual({
+            error: "installation transaction reached",
+        });
+        expect(transaction).toHaveBeenCalledOnce();
+    });
+    it("rejects conflicting managed deployment identities", async () => {
+        await expect(createAppsApiModule(context({
+            runtimeAudience: "deployment-auth-1",
+            installationAuthority: {
+                workloadEnvironmentId: "workload-environment-1",
+                resolveInstallationContract: async () => ({ contractGeneration: 1 }),
+            },
+            sessionTokenSigningSecret: "s".repeat(32),
+        }, {
+            deploymentId: "deployment-marketplace-2",
+            acquisitionResolver: {
+                resolveAcquisitionIntent: async () => null,
+                createSetupHandoff: async () => ({
+                    redirectUrl: "https://app.example.com/setup?code=opaque",
+                }),
+                notifyInstallationLifecycle: async () => undefined,
+            },
+        }))).rejects.toThrow(/must match/);
+    });
 });

package/dist/compiler.test.js

@@ -10,6 +10,17 @@ describe("app manifest compiler", () => {
         });
         expect(parsed.data.storesSecrets).toBe(true);
     });
+    it("admits an explicit HTTPS managed lifecycle endpoint", () => {
+        const parsed = appManifestSchema.parse({
+            ...validManifest,
+            urls: { ...validManifest.urls, lifecycle: "https://app.example.com/lifecycle" },
+        });
+        expect(parsed.urls.lifecycle).toBe("https://app.example.com/lifecycle");
+        expect(() => appManifestSchema.parse({
+            ...validManifest,
+            urls: { ...validManifest.urls, lifecycle: "http://app.example.com/lifecycle" },
+        })).toThrow(/https/i);
+    });
     it("accepts a closed v1 manifest and produces a stable digest", () => {
         const first = compileAppManifest(validManifest);
         const second = compileAppManifest({

package/dist/contracts.d.ts

@@ -127,6 +127,7 @@ export declare const appManifestSchema: z.ZodPipe<z.ZodRecord<z.ZodString, z.Zod
     }, z.core.$strict>;
     urls: z.ZodObject<{
         setup: z.ZodOptional<z.ZodString>;
+        lifecycle: z.ZodOptional<z.ZodString>;
         health: z.ZodString;
         launch: z.ZodString;
         privacy: z.ZodString;
@@ -220,6 +221,7 @@ export declare const appOAuthAuthorizeQuerySchema: z.ZodObject<{
     release_id: z.ZodString;
     redirect_uri: z.ZodString;
     state: z.ZodString;
+    nonce: z.ZodOptional<z.ZodString>;
     code_challenge: z.ZodString;
     code_challenge_method: z.ZodLiteral<"S256">;
     actor_id: z.ZodOptional<z.ZodString>;

package/dist/contracts.js

@@ -151,6 +151,7 @@ export const appManifestSchema = manifestDisallowedKeySchema.pipe(z
     urls: z
         .object({
         setup: httpsUrlSchema.optional(),
+        lifecycle: httpsUrlSchema.optional(),
         health: httpsUrlSchema,
         launch: httpsUrlSchema,
         privacy: httpsUrlSchema,
@@ -269,6 +270,8 @@ export const appOAuthAuthorizeQuerySchema = z
     release_id: z.string().trim().min(1),
     redirect_uri: z.string().url(),
     state: z.string().trim().min(1),
+    /** Optional app-generated ceremony binding echoed to the redirect URI. */
+    nonce: z.string().trim().min(43).max(128).optional(),
     code_challenge: z.string().trim().min(1),
     code_challenge_method: z.literal("S256"),
     /** Deprecated input; the route derives the actor from the staff session. */

package/dist/index.d.ts

@@ -10,6 +10,7 @@ export * from "./ingestion.js";
 export * from "./installation-read-model.js";
 export * from "./installation-service.js";
 export * from "./locale-resolution.js";
+export * from "./marketplace-acquisition.js";
 export * from "./oauth-crypto.js";
 export * from "./oauth-service.js";
 export { createAppsAdminRoutes } from "./routes.js";

package/dist/index.js

@@ -10,6 +10,7 @@ export * from "./ingestion.js";
 export * from "./installation-read-model.js";
 export * from "./installation-service.js";
 export * from "./locale-resolution.js";
+export * from "./marketplace-acquisition.js";
 export * from "./oauth-crypto.js";
 export * from "./oauth-service.js";
 export { createAppsAdminRoutes } from "./routes.js";

package/dist/installation-routes.test.js

@@ -1,7 +1,9 @@
 import { handleApiError } from "@voyant-travel/hono";
+import { eq } from "drizzle-orm";
 import { Hono } from "hono";
-import { beforeAll, beforeEach, describe, expect, it } from "vitest";
+import { beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
 import { createAppsAdminRoutes } from "./routes.js";
+import { apps } from "./schema.js";
 import { createAppsService } from "./service.js";
 import { validManifest } from "./test-fixtures.js";
 const DB_AVAILABLE = !!process.env.TEST_DATABASE_URL;
@@ -158,4 +160,36 @@ describe.skipIf(!DB_AVAILABLE)("apps installation admin routes", () => {
         expect(body.data.installation.status).toBe("active");
         expect(body.data.outcome).toBe("created");
     });
+    it("notifies managed authority after a Marketplace uninstall", async () => {
+        const { appId, releaseV1 } = await seedAppWithReleases();
+        await db.update(apps).set({ distribution: "marketplace" }).where(eq(apps.id, appId));
+        const notifyInstallationLifecycle = vi.fn(async () => undefined);
+        const managedApp = new Hono();
+        managedApp.onError((err, c) => handleApiError(err, c));
+        managedApp.use("*", async (c, next) => {
+            c.set("db", db);
+            await next();
+        });
+        managedApp.route("/", createAppsAdminRoutes({
+            deploymentId: DEPLOYMENT_ID,
+            managedMarketplace: {
+                resolveAcquisitionIntent: async () => null,
+                createSetupHandoff: async () => ({
+                    redirectUrl: "https://app.example.com/setup?code=opaque",
+                }),
+                notifyInstallationLifecycle,
+            },
+        }));
+        const installed = await managedApp.request("/install", json({ appId, releaseId: releaseV1.id, actorId: "actor_1" }));
+        const installationId = (await installed.json())
+            .data.installation.id;
+        const response = await managedApp.request(`/installations/${installationId}/uninstall`, json({ actorId: "actor_1" }));
+        expect(response.status).toBe(200);
+        expect(notifyInstallationLifecycle).toHaveBeenCalledWith({
+            event: "uninstalled",
+            installationId,
+            appId,
+            releaseId: releaseV1.id,
+        });
+    });
 });

package/dist/installation-service.d.ts

@@ -106,7 +106,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             uninstalledAt: Date | null;
             purgedAt: Date | null;
         };
-        outcome: "reinstalled" | "created";
+        outcome: "created" | "reinstalled";
     }>;
     upgrade: (db: PostgresJsDatabase, input: UpgradeAppInput) => Promise<{
         installation: {

package/dist/marketplace-acquisition.d.ts

@@ -0,0 +1,93 @@
+import type { PostgresJsDatabase } from "drizzle-orm/postgres-js";
+import { z } from "zod";
+import { type CompileAppManifestOptions } from "./compiler.js";
+/**
+ * Provider-neutral, host-verified input to the deployment-local app registry.
+ * A managed host adapts its private catalog model to this closed contract only
+ * after it has authenticated the deployment and verified artifact provenance.
+ */
+export declare const hostVerifiedMarketplaceAcquisitionSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"voyant.runtime-marketplace-acquisition.v1">;
+    acquisitionId: z.ZodString;
+    app: z.ZodObject<{
+        id: z.ZodString;
+        ownerId: z.ZodString;
+        displayName: z.ZodString;
+        slug: z.ZodString;
+        redirectUris: z.ZodArray<z.ZodString>;
+        oauthClient: z.ZodObject<{
+            method: z.ZodLiteral<"client_secret_post">;
+            secretSha256: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    release: z.ZodObject<{
+        id: z.ZodString;
+        manifest: z.ZodUnknown;
+        digest: z.ZodString;
+        signature: z.ZodOptional<z.ZodString>;
+        provenance: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        assetInventory: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type HostVerifiedMarketplaceAcquisition = z.infer<typeof hostVerifiedMarketplaceAcquisitionSchema>;
+export declare const resolveMarketplaceInstallIntentSchema: z.ZodObject<{
+    intent: z.ZodString;
+}, z.core.$strict>;
+export declare const marketplaceInstallIntentResultSchema: z.ZodObject<{
+    data: z.ZodObject<{
+        appId: z.ZodString;
+        releaseId: z.ZodString;
+        acquisitionId: z.ZodString;
+        created: z.ZodBoolean;
+    }, z.core.$strict>;
+}, z.core.$strip>;
+export declare const marketplaceSetupHandoffResultSchema: z.ZodObject<{
+    data: z.ZodObject<{
+        redirectUrl: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strip>;
+export declare const MARKETPLACE_SETUP_ASSERTION_TYPE: "voyant-marketplace-setup+jwt";
+/** Claims signed by the managed host and verified by the remote app backend. */
+export declare const marketplaceSetupAssertionClaimsSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"voyant.marketplace-setup-assertion.v1">;
+    iss: z.ZodString;
+    aud: z.ZodString;
+    sub: z.ZodString;
+    jti: z.ZodString;
+    iat: z.ZodNumber;
+    exp: z.ZodNumber;
+    installationId: z.ZodString;
+    appId: z.ZodString;
+    releaseId: z.ZodString;
+    authorizationUrl: z.ZodString;
+    tokenUrl: z.ZodString;
+    redirectUri: z.ZodString;
+}, z.core.$strict>;
+export type MarketplaceSetupAssertionClaims = z.infer<typeof marketplaceSetupAssertionClaimsSchema>;
+export interface MarketplaceInstallIntentResult {
+    appId: string;
+    releaseId: string;
+    acquisitionId: string;
+    created: boolean;
+}
+export interface MarketplaceAcquisitionServiceOptions extends CompileAppManifestOptions {
+    resolveAcquisitionIntent(input: {
+        intent: string;
+    }): Promise<HostVerifiedMarketplaceAcquisition | null>;
+    createSetupHandoff(input: {
+        installationId: string;
+        appId: string;
+        releaseId: string;
+    }): Promise<{
+        redirectUrl: string;
+    }>;
+}
+export declare function createMarketplaceAcquisitionService(options: MarketplaceAcquisitionServiceOptions): {
+    resolveAndAcquire(db: PostgresJsDatabase, input: {
+        intent: string;
+        actorId: string;
+    }): Promise<MarketplaceInstallIntentResult>;
+    createSetupHandoff(db: PostgresJsDatabase, installationId: string): Promise<{
+        redirectUrl: string;
+    }>;
+};