@voyant-travel/apps 0.8.0 → 0.9.1

package/dist/access-boundary.d.ts

@@ -7,6 +7,8 @@ export declare function assertActiveAppInstallationAccess(db: PostgresJsDatabase
     id: string;
     appId: string;
     deploymentId: string;
+    workloadEnvironmentId: string | null;
+    contractGeneration: number | null;
     releaseId: string;
     status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
     namespace: string;

package/dist/api-runtime.js

@@ -20,6 +20,7 @@ export const createAppsApiModule = defineGraphRuntimeFactory(async ({ getPort, g
         ? {
             accessCatalog: graph.accessCatalog,
             deploymentId: managedAuth.runtimeAudience,
+            managedInstallation: managedAuth.installationAuthority,
             clientAuthentication: "required",
         }
         : undefined;
@@ -33,6 +34,7 @@ export const createAppsApiModule = defineGraphRuntimeFactory(async ({ getPort, g
                 ? {
                     sessionToken: {
                         secret: managedAuth.sessionTokenSigningSecret,
+                        managedInstallation: managedAuth.installationAuthority,
                         ...(managedAuth.sessionTokenTtlSeconds === undefined
                             ? {}
                             : { ttlSeconds: managedAuth.sessionTokenTtlSeconds }),

package/dist/api-runtime.test.js

@@ -36,6 +36,10 @@ describe("createAppsApiModule", () => {
     it("composes OAuth, session exchange, and token resolution from the host port", async () => {
         const module = await createAppsApiModule(context({
             runtimeAudience: "deployment-1",
+            installationAuthority: {
+                workloadEnvironmentId: "workload-environment-1",
+                resolveInstallationContract: async () => ({ contractGeneration: 1 }),
+            },
             sessionTokenSigningSecret: "s".repeat(32),
             sessionTokenTtlSeconds: 180,
         }));

package/dist/app-api-service.d.ts

@@ -1259,6 +1259,8 @@ export declare function createAppApiService(options?: AppApiServiceOptions): {
             id: string;
             appId: string;
             deploymentId: string;
+            workloadEnvironmentId: string | null;
+            contractGeneration: number | null;
             releaseId: string;
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;

package/dist/compiler.test.js

@@ -3,6 +3,13 @@ import { compileAppManifest } from "./compiler.js";
 import { appManifestSchema } from "./contracts.js";
 import { validManifest } from "./test-fixtures.js";
 describe("app manifest compiler", () => {
+    it("accepts truthful disclosure of publisher-custodied encrypted secrets", () => {
+        const parsed = appManifestSchema.parse({
+            ...validManifest,
+            data: { ...validManifest.data, storesSecrets: true },
+        });
+        expect(parsed.data.storesSecrets).toBe(true);
+    });
     it("accepts a closed v1 manifest and produces a stable digest", () => {
         const first = compileAppManifest(validManifest);
         const second = compileAppManifest({

package/dist/contracts.d.ts

@@ -142,7 +142,7 @@ export declare const appManifestSchema: z.ZodPipe<z.ZodRecord<z.ZodString, z.Zod
             financial: "financial";
         }>>;
         retention: z.ZodString;
-        storesSecrets: z.ZodDefault<z.ZodLiteral<false>>;
+        storesSecrets: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strict>;
 }, z.core.$strict>>;
 export declare const createCustomAppRegistrationSchema: z.ZodObject<{

package/dist/contracts.js

@@ -161,7 +161,7 @@ export const appManifestSchema = manifestDisallowedKeySchema.pipe(z
         .object({
         classifications: z.array(dataClassificationSchema).min(1),
         retention: z.string().trim().min(1).max(280),
-        storesSecrets: z.literal(false).default(false),
+        storesSecrets: z.boolean().default(false),
     })
         .strict(),
 })

package/dist/installation-service.d.ts

@@ -1,6 +1,7 @@
 import type { EventBus } from "@voyant-travel/core/events";
 import type { createCustomFieldsService } from "@voyant-travel/custom-fields";
 import type { PostgresJsDatabase } from "drizzle-orm/postgres-js";
+import type { ManagedAppInstallationAuthority } from "./runtime-port.js";
 import { type AppInstallation } from "./schema.js";
 export type AppInstallationStatus = AppInstallation["status"];
 export type AppInstallationUpdatePolicy = AppInstallation["updatePolicy"];
@@ -15,6 +16,7 @@ export interface AppInstallationServiceOptions {
     customFields?: CustomFieldsService;
     platformApiVersion?: string;
     deploymentId?: string;
+    managedInstallation?: ManagedAppInstallationAuthority;
 }
 export interface InstallAppInput {
     appId: string;
@@ -52,9 +54,13 @@ export declare function createAppInstallationService(options?: AppInstallationSe
     install: (db: PostgresJsDatabase, input: InstallAppInput) => Promise<{
         installation: {
             id: string;
+            createdAt: Date;
+            updatedAt: Date;
             appId: string;
-            deploymentId: string;
             releaseId: string;
+            deploymentId: string;
+            workloadEnvironmentId: string | null;
+            contractGeneration: number | null;
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
@@ -71,8 +77,6 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             revokedAt: Date | null;
             uninstalledAt: Date | null;
             purgedAt: Date | null;
-            createdAt: Date;
-            updatedAt: Date;
         };
         outcome: "unchanged";
     } | {
@@ -83,6 +87,8 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             appId: string;
             releaseId: string;
             deploymentId: string;
+            workloadEnvironmentId: string | null;
+            contractGeneration: number | null;
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
@@ -107,6 +113,8 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             id: string;
             appId: string;
             deploymentId: string;
+            workloadEnvironmentId: string | null;
+            contractGeneration: number | null;
             releaseId: string;
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
@@ -134,6 +142,8 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             id: string;
             appId: string;
             deploymentId: string;
+            workloadEnvironmentId: string | null;
+            contractGeneration: number | null;
             releaseId: string;
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
@@ -162,6 +172,8 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             id: string;
             appId: string;
             deploymentId: string;
+            workloadEnvironmentId: string | null;
+            contractGeneration: number | null;
             releaseId: string;
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
@@ -188,6 +200,8 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             id: string;
             appId: string;
             deploymentId: string;
+            workloadEnvironmentId: string | null;
+            contractGeneration: number | null;
             releaseId: string;
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
@@ -215,6 +229,8 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             id: string;
             appId: string;
             deploymentId: string;
+            workloadEnvironmentId: string | null;
+            contractGeneration: number | null;
             releaseId: string;
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
@@ -241,6 +257,8 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             id: string;
             appId: string;
             deploymentId: string;
+            workloadEnvironmentId: string | null;
+            contractGeneration: number | null;
             releaseId: string;
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
@@ -268,6 +286,8 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             id: string;
             appId: string;
             deploymentId: string;
+            workloadEnvironmentId: string | null;
+            contractGeneration: number | null;
             releaseId: string;
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
@@ -294,6 +314,8 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             id: string;
             appId: string;
             deploymentId: string;
+            workloadEnvironmentId: string | null;
+            contractGeneration: number | null;
             releaseId: string;
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
@@ -321,6 +343,8 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             id: string;
             appId: string;
             deploymentId: string;
+            workloadEnvironmentId: string | null;
+            contractGeneration: number | null;
             releaseId: string;
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;

package/dist/installation-service.js

@@ -23,10 +23,14 @@ export function createAppInstallationService(options = {}) {
         const resolvedDeploymentId = deploymentId(input);
         return db.transaction(async (tx) => {
             const release = await requireReleaseForApp(tx, input.appId, input.releaseId);
+            const managedBinding = await resolveManagedBinding(options.managedInstallation, input.appId, input.releaseId);
             assertReleaseAvailable(release);
             assertApiCompatible(release, options.platformApiVersion);
             const app = await requireApp(tx, input.appId);
-            const existing = await selectInstallationByDeploymentApp(tx, resolvedDeploymentId, input.appId, true);
+            const selected = await selectInstallationForApp(tx, resolvedDeploymentId, input.appId, managedBinding, true);
+            const existing = selected
+                ? await reconcileManagedInstallationBinding(tx, selected, resolvedDeploymentId, managedBinding)
+                : null;
             if (existing && !canInstallOver(existing.status)) {
                 if (existing.releaseId !== input.releaseId) {
                     throw invalidTransition(existing.status, "install_different_release");
@@ -36,7 +40,7 @@ export function createAppInstallationService(options = {}) {
             }
             const installation = existing
                 ? await reactivateInstallation(tx, existing, release, input)
-                : await createInstallation(tx, app, release, resolvedDeploymentId, input);
+                : await createInstallation(tx, app, release, resolvedDeploymentId, input, managedBinding);
             await reconcileRelease(tx, installation, release, input.actorId, "install", options);
             await reconcileGrants(tx, installation, release, input.actorId, input.grantedOptionalScopes);
             if (input.credential) {
@@ -192,13 +196,15 @@ export function createAppInstallationService(options = {}) {
         });
     }
 }
-async function createInstallation(db, app, release, deploymentId, input) {
+async function createInstallation(db, app, release, deploymentId, input, managedBinding) {
     const now = new Date();
     const [row] = await db
         .insert(appInstallations)
         .values({
         appId: app.id,
         deploymentId,
+        workloadEnvironmentId: managedBinding?.workloadEnvironmentId,
+        contractGeneration: managedBinding?.contractGeneration,
         releaseId: release.id,
         status: "active",
         namespace: app.platformNamespace,
@@ -272,6 +278,69 @@ async function selectInstallationByDeploymentApp(db, deploymentId, appId, lock)
     const [row] = lock ? await query.for("update").limit(1) : await query.limit(1);
     return row ?? null;
 }
+async function selectInstallationForApp(db, deploymentId, appId, managedBinding, lock) {
+    if (!managedBinding) {
+        return selectInstallationByDeploymentApp(db, deploymentId, appId, lock);
+    }
+    const query = db
+        .select()
+        .from(appInstallations)
+        .where(and(eq(appInstallations.workloadEnvironmentId, managedBinding.workloadEnvironmentId), eq(appInstallations.appId, appId)));
+    const [row] = lock ? await query.for("update").limit(1) : await query.limit(1);
+    return row ?? null;
+}
+async function reconcileManagedInstallationBinding(db, installation, deploymentId, managedBinding) {
+    if (!managedBinding)
+        return installation;
+    if (installation.workloadEnvironmentId !== managedBinding.workloadEnvironmentId ||
+        installation.contractGeneration === null) {
+        throw new ApiHttpError("Managed app installation binding does not match this runtime", {
+            status: 409,
+            code: "app_managed_installation_binding_mismatch",
+        });
+    }
+    if (installation.contractGeneration > managedBinding.contractGeneration) {
+        throw new ApiHttpError("Managed app contract generation is stale", {
+            status: 409,
+            code: "app_managed_contract_generation_stale",
+        });
+    }
+    if (installation.contractGeneration === managedBinding.contractGeneration &&
+        installation.deploymentId === deploymentId) {
+        return installation;
+    }
+    const generationAdvanced = installation.contractGeneration < managedBinding.contractGeneration;
+    const [updated] = await db
+        .update(appInstallations)
+        .set({
+        deploymentId,
+        contractGeneration: managedBinding.contractGeneration,
+        credentialGeneration: generationAdvanced
+            ? sql `${appInstallations.credentialGeneration} + 1`
+            : installation.credentialGeneration,
+        updatedAt: new Date(),
+    })
+        .where(eq(appInstallations.id, installation.id))
+        .returning();
+    return updated ?? installation;
+}
+async function resolveManagedBinding(authority, appId, releaseId) {
+    if (!authority)
+        return undefined;
+    const contract = await authority.resolveInstallationContract({ appId, releaseId });
+    if (!contract ||
+        !Number.isSafeInteger(contract.contractGeneration) ||
+        contract.contractGeneration <= 0) {
+        throw new ApiHttpError("Managed app installation contract is unavailable", {
+            status: 409,
+            code: "app_managed_installation_contract_unavailable",
+        });
+    }
+    return {
+        workloadEnvironmentId: authority.workloadEnvironmentId,
+        contractGeneration: contract.contractGeneration,
+    };
+}
 function assertReleaseAvailable(release) {
     if (release.state !== "available") {
         throw new ApiHttpError("App release is not available", {

package/dist/oauth-installation.d.ts

@@ -0,0 +1,101 @@
+import type { PostgresJsDatabase } from "drizzle-orm/postgres-js";
+import type { ManagedAppInstallationAuthority, ManagedAppInstallationBinding } from "./runtime-port.js";
+import { type AppInstallation } from "./schema.js";
+export declare function ensureAuthorizedInstallation(db: PostgresJsDatabase, input: {
+    appId: string;
+    releaseId: string;
+    deploymentId: string;
+    actorId: string;
+    grantedScopes: readonly string[];
+    deniedOptionalScopes: readonly string[];
+    managedBinding?: ManagedAppInstallationBinding;
+}): Promise<{
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    appId: string;
+    releaseId: string;
+    deploymentId: string;
+    workloadEnvironmentId: string | null;
+    contractGeneration: number | null;
+    status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
+    namespace: string;
+    installedBy: string;
+    credentialGeneration: number;
+    updatePolicy: "manual" | "compatible" | "patch" | "pinned";
+    lastCompatibleReleaseCheckAt: Date | null;
+    pendingReleaseId: string | null;
+    pendingReason: string | null;
+    installedAt: Date;
+    authorizedAt: Date | null;
+    activatedAt: Date | null;
+    pausedAt: Date | null;
+    degradedAt: Date | null;
+    revokedAt: Date | null;
+    uninstalledAt: Date | null;
+    purgedAt: Date | null;
+}>;
+export declare function requireInstallation(db: PostgresJsDatabase, installationId: string): Promise<{
+    id: string;
+    appId: string;
+    deploymentId: string;
+    workloadEnvironmentId: string | null;
+    contractGeneration: number | null;
+    releaseId: string;
+    status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
+    namespace: string;
+    installedBy: string;
+    credentialGeneration: number;
+    updatePolicy: "manual" | "compatible" | "patch" | "pinned";
+    lastCompatibleReleaseCheckAt: Date | null;
+    pendingReleaseId: string | null;
+    pendingReason: string | null;
+    installedAt: Date;
+    authorizedAt: Date | null;
+    activatedAt: Date | null;
+    pausedAt: Date | null;
+    degradedAt: Date | null;
+    revokedAt: Date | null;
+    uninstalledAt: Date | null;
+    purgedAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+}>;
+export declare function selectInstallation(db: PostgresJsDatabase, installationId: string): Promise<{
+    id: string;
+    appId: string;
+    deploymentId: string;
+    workloadEnvironmentId: string | null;
+    contractGeneration: number | null;
+    releaseId: string;
+    status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
+    namespace: string;
+    installedBy: string;
+    credentialGeneration: number;
+    updatePolicy: "manual" | "compatible" | "patch" | "pinned";
+    lastCompatibleReleaseCheckAt: Date | null;
+    pendingReleaseId: string | null;
+    pendingReason: string | null;
+    installedAt: Date;
+    authorizedAt: Date | null;
+    activatedAt: Date | null;
+    pausedAt: Date | null;
+    degradedAt: Date | null;
+    revokedAt: Date | null;
+    uninstalledAt: Date | null;
+    purgedAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+} | null>;
+export declare function grantedScopes(db: PostgresJsDatabase, installationId: string): Promise<string[]>;
+export declare function assertActiveInstallation(installation: AppInstallation): void;
+export declare function isInstallationUsable(installation: AppInstallation | null, generation: number): boolean;
+export declare function assertTokenClient(installation: AppInstallation, clientId: string): void;
+type PersistedManagedBinding = {
+    workloadEnvironmentId: string | null;
+    contractGeneration: number | null;
+};
+export declare function assertManagedInstallationAuthority(authority: ManagedAppInstallationAuthority | undefined): void;
+export declare function managedBindingMatches(persisted: PersistedManagedBinding, expected: ManagedAppInstallationBinding | undefined): boolean;
+export declare function assertManagedBinding(persisted: PersistedManagedBinding, expected: ManagedAppInstallationBinding | undefined): void;
+export {};

package/dist/oauth-installation.js

@@ -0,0 +1,143 @@
+import { ApiHttpError } from "@voyant-travel/hono";
+import { and, eq, sql } from "drizzle-orm";
+import { appGrants, appInstallations, apps } from "./schema.js";
+export async function ensureAuthorizedInstallation(db, input) {
+    return db.transaction(async (tx) => {
+        const [app] = await tx.select().from(apps).where(eq(apps.id, input.appId)).limit(1);
+        if (!app)
+            throw oauthError("invalid_request", "App registration not found", 404);
+        const [existing] = await tx
+            .select()
+            .from(appInstallations)
+            .where(input.managedBinding
+            ? and(eq(appInstallations.workloadEnvironmentId, input.managedBinding.workloadEnvironmentId), eq(appInstallations.appId, input.appId))
+            : and(eq(appInstallations.deploymentId, input.deploymentId), eq(appInstallations.appId, input.appId)))
+            .limit(1);
+        let installation = existing ??
+            (await tx
+                .insert(appInstallations)
+                .values({
+                appId: input.appId,
+                deploymentId: input.deploymentId,
+                workloadEnvironmentId: input.managedBinding?.workloadEnvironmentId,
+                contractGeneration: input.managedBinding?.contractGeneration,
+                releaseId: input.releaseId,
+                status: "active",
+                namespace: app.platformNamespace,
+                installedBy: input.actorId,
+                authorizedAt: new Date(),
+                activatedAt: new Date(),
+            })
+                .returning())[0];
+        if (!installation)
+            throw oauthError("server_error", "Could not create installation", 500);
+        if (existing && input.managedBinding) {
+            if (existing.contractGeneration === null) {
+                throw oauthError("invalid_grant", "Managed installation is missing its workload-environment binding");
+            }
+            if (existing.contractGeneration > input.managedBinding.contractGeneration) {
+                throw oauthError("invalid_grant", "Managed app contract generation is stale");
+            }
+            if (existing.contractGeneration < input.managedBinding.contractGeneration ||
+                existing.deploymentId !== input.deploymentId) {
+                const generationAdvanced = existing.contractGeneration < input.managedBinding.contractGeneration;
+                const [updated] = await tx
+                    .update(appInstallations)
+                    .set({
+                    deploymentId: input.deploymentId,
+                    contractGeneration: input.managedBinding.contractGeneration,
+                    // agent-quality: raw-sql reviewed -- owner: apps; atomically invalidates the prior credential generation.
+                    credentialGeneration: generationAdvanced
+                        ? sql `${appInstallations.credentialGeneration} + 1`
+                        : existing.credentialGeneration,
+                    updatedAt: new Date(),
+                })
+                    .where(eq(appInstallations.id, existing.id))
+                    .returning();
+                installation = updated ?? existing;
+            }
+        }
+        for (const scope of input.grantedScopes) {
+            await tx
+                .insert(appGrants)
+                .values({
+                installationId: installation.id,
+                scope,
+                status: "granted",
+                optional: false,
+                grantedAt: new Date(),
+            })
+                .onConflictDoUpdate({
+                target: [appGrants.installationId, appGrants.scope],
+                set: { status: "granted", grantedAt: new Date(), revokedAt: null },
+            });
+        }
+        for (const scope of input.deniedOptionalScopes) {
+            await tx
+                .insert(appGrants)
+                .values({ installationId: installation.id, scope, status: "optional", optional: true })
+                .onConflictDoUpdate({
+                target: [appGrants.installationId, appGrants.scope],
+                set: { status: "optional", optional: true },
+            });
+        }
+        return installation;
+    });
+}
+export async function requireInstallation(db, installationId) {
+    const installation = await selectInstallation(db, installationId);
+    if (!installation)
+        throw oauthError("invalid_grant", "App installation not found", 404);
+    return installation;
+}
+export async function selectInstallation(db, installationId) {
+    const [installation] = await db
+        .select()
+        .from(appInstallations)
+        .where(eq(appInstallations.id, installationId))
+        .limit(1);
+    return installation ?? null;
+}
+export async function grantedScopes(db, installationId) {
+    const rows = await db
+        .select({ scope: appGrants.scope })
+        .from(appGrants)
+        .where(and(eq(appGrants.installationId, installationId), eq(appGrants.status, "granted")))
+        .orderBy(appGrants.scope);
+    return rows.map((row) => row.scope);
+}
+export function assertActiveInstallation(installation) {
+    if (installation.status !== "active") {
+        throw oauthError("invalid_grant", "App installation is not active");
+    }
+}
+export function isInstallationUsable(installation, generation) {
+    return installation?.status === "active" && installation.credentialGeneration === generation;
+}
+export function assertTokenClient(installation, clientId) {
+    if (installation.appId !== clientId) {
+        throw oauthError("invalid_grant", "Token belongs to a different app");
+    }
+}
+export function assertManagedInstallationAuthority(authority) {
+    if (!authority)
+        return;
+    if (!authority.workloadEnvironmentId.trim() ||
+        typeof authority.resolveInstallationContract !== "function") {
+        throw new TypeError("Managed app installation authority is invalid");
+    }
+}
+export function managedBindingMatches(persisted, expected) {
+    if (!expected)
+        return true;
+    return (persisted.workloadEnvironmentId === expected.workloadEnvironmentId &&
+        persisted.contractGeneration === expected.contractGeneration);
+}
+export function assertManagedBinding(persisted, expected) {
+    if (!managedBindingMatches(persisted, expected)) {
+        throw oauthError("invalid_grant", "App credential belongs to a different workload environment or contract generation");
+    }
+}
+function oauthError(error, description, status = 400) {
+    return new ApiHttpError(description, { status, code: error });
+}

package/dist/oauth-service.d.ts

@@ -1,9 +1,12 @@
 import type { VoyantAppContextConstraint, VoyantAuthContext } from "@voyant-travel/core";
 import type { AccessCatalog } from "@voyant-travel/types/api-keys";
 import type { PostgresJsDatabase } from "drizzle-orm/postgres-js";
+import type { ManagedAppInstallationAuthority } from "./runtime-port.js";
 export interface AppOAuthServiceOptions {
     accessCatalog: AccessCatalog;
     deploymentId: string;
+    /** Stable host identity required only for managed workload environments. */
+    managedInstallation?: ManagedAppInstallationAuthority;
     /** Managed confidential runtimes fail closed unless a client secret is registered. */
     clientAuthentication?: "optional" | "required";
     now?: () => Date;