@voyant-travel/apps 0.8.0 → 0.9.1

package/dist/schema.d.ts

@@ -995,6 +995,40 @@ export declare const appInstallations: import("drizzle-orm/pg-core").PgTableWith
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        workloadEnvironmentId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "workload_environment_id";
+            tableName: "app_installations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        contractGeneration: import("drizzle-orm/pg-core").PgColumn<{
+            name: "contract_generation";
+            tableName: "app_installations";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         releaseId: import("drizzle-orm/pg-core").PgColumn<{
             name: "release_id";
             tableName: "app_installations";
@@ -1519,6 +1553,40 @@ export declare const appAccessCredentials: import("drizzle-orm/pg-core").PgTable
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        workloadEnvironmentId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "workload_environment_id";
+            tableName: "app_access_credentials";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        contractGeneration: import("drizzle-orm/pg-core").PgColumn<{
+            name: "contract_generation";
+            tableName: "app_access_credentials";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         tokenMode: import("drizzle-orm/pg-core").PgColumn<{
             name: "token_mode";
             tableName: "app_access_credentials";
@@ -1766,6 +1834,40 @@ export declare const appOAuthAuthorizationCodes: import("drizzle-orm/pg-core").P
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        workloadEnvironmentId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "workload_environment_id";
+            tableName: "app_oauth_authorization_codes";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        contractGeneration: import("drizzle-orm/pg-core").PgColumn<{
+            name: "contract_generation";
+            tableName: "app_oauth_authorization_codes";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         codeHash: import("drizzle-orm/pg-core").PgColumn<{
             name: "code_hash";
             tableName: "app_oauth_authorization_codes";
@@ -2051,6 +2153,40 @@ export declare const appOAuthRefreshTokens: import("drizzle-orm/pg-core").PgTabl
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        workloadEnvironmentId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "workload_environment_id";
+            tableName: "app_oauth_refresh_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        contractGeneration: import("drizzle-orm/pg-core").PgColumn<{
+            name: "contract_generation";
+            tableName: "app_oauth_refresh_tokens";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         status: import("drizzle-orm/pg-core").PgColumn<{
             name: "status";
             tableName: "app_oauth_refresh_tokens";
@@ -3007,6 +3143,40 @@ export declare const appSessionTokens: import("drizzle-orm/pg-core").PgTableWith
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        workloadEnvironmentId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "workload_environment_id";
+            tableName: "app_session_tokens";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        contractGeneration: import("drizzle-orm/pg-core").PgColumn<{
+            name: "contract_generation";
+            tableName: "app_session_tokens";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         jti: import("drizzle-orm/pg-core").PgColumn<{
             name: "jti";
             tableName: "app_session_tokens";

package/dist/schema.js

@@ -155,6 +155,8 @@ export const appInstallations = pgTable("app_installations", {
         .notNull()
         .references(() => apps.id, { onDelete: "cascade" }),
     deploymentId: text("deployment_id").notNull(),
+    workloadEnvironmentId: text("workload_environment_id"),
+    contractGeneration: integer("contract_generation"),
     releaseId: text("release_id")
         .notNull()
         .references(() => appReleases.id, { onDelete: "restrict" }),
@@ -182,6 +184,10 @@ export const appInstallations = pgTable("app_installations", {
     index("idx_app_installations_app").on(table.appId, table.status),
     index("idx_app_installations_deployment").on(table.deploymentId, table.status),
     uniqueIndex("uidx_app_installations_deployment_app").on(table.deploymentId, table.appId),
+    uniqueIndex("uidx_app_installations_workload_environment_app")
+        .on(table.workloadEnvironmentId, table.appId)
+        .where(sql `${table.workloadEnvironmentId} IS NOT NULL`),
+    check("app_installations_managed_binding_complete", sql `(${table.workloadEnvironmentId} IS NULL AND ${table.contractGeneration} IS NULL) OR (${table.workloadEnvironmentId} IS NOT NULL AND ${table.contractGeneration} > 0)`),
     // agent-quality: raw-sql reviewed -- owner: apps; identifier is a Drizzle-owned column and the literal prefix is static.
     check("app_installations_namespace_reserved", sql `${table.namespace} LIKE 'app--%'`),
 ]);
@@ -206,6 +212,8 @@ export const appAccessCredentials = pgTable("app_access_credentials", {
         .notNull()
         .references(() => appInstallations.id, { onDelete: "cascade" }),
     generation: integer("generation").notNull(),
+    workloadEnvironmentId: text("workload_environment_id"),
+    contractGeneration: integer("contract_generation"),
     tokenMode: appAccessTokenModeEnum("token_mode").notNull().default("offline"),
     credentialHash: text("credential_hash").notNull(),
     encryptedMetadata: jsonb("encrypted_metadata").$type().notNull(),
@@ -218,6 +226,7 @@ export const appAccessCredentials = pgTable("app_access_credentials", {
 }, (table) => [
     index("idx_app_access_credentials_installation").on(table.installationId, table.status),
     index("idx_app_access_credentials_generation").on(table.installationId, table.tokenMode, table.generation),
+    check("app_access_credentials_managed_binding_complete", sql `(${table.workloadEnvironmentId} IS NULL AND ${table.contractGeneration} IS NULL) OR (${table.workloadEnvironmentId} IS NOT NULL AND ${table.contractGeneration} > 0)`),
 ]);
 export const appOAuthAuthorizationCodes = pgTable("app_oauth_authorization_codes", {
     id: typeId("app_oauth_authorization_codes"),
@@ -231,6 +240,8 @@ export const appOAuthAuthorizationCodes = pgTable("app_oauth_authorization_codes
         .notNull()
         .references(() => appReleases.id, { onDelete: "cascade" }),
     deploymentId: text("deployment_id").notNull(),
+    workloadEnvironmentId: text("workload_environment_id"),
+    contractGeneration: integer("contract_generation"),
     codeHash: text("code_hash").notNull(),
     stateHash: text("state_hash").notNull(),
     redirectUri: text("redirect_uri").notNull(),
@@ -246,6 +257,7 @@ export const appOAuthAuthorizationCodes = pgTable("app_oauth_authorization_codes
 }, (table) => [
     uniqueIndex("uidx_app_oauth_codes_hash").on(table.codeHash),
     index("idx_app_oauth_codes_installation").on(table.installationId, table.expiresAt),
+    check("app_oauth_codes_managed_binding_complete", sql `(${table.workloadEnvironmentId} IS NULL AND ${table.contractGeneration} IS NULL) OR (${table.workloadEnvironmentId} IS NOT NULL AND ${table.contractGeneration} > 0)`),
 ]);
 export const appOAuthRefreshTokens = pgTable("app_oauth_refresh_tokens", {
     id: typeId("app_oauth_refresh_tokens"),
@@ -254,6 +266,8 @@ export const appOAuthRefreshTokens = pgTable("app_oauth_refresh_tokens", {
         .references(() => appInstallations.id, { onDelete: "cascade" }),
     tokenHash: text("token_hash").notNull(),
     generation: integer("generation").notNull(),
+    workloadEnvironmentId: text("workload_environment_id"),
+    contractGeneration: integer("contract_generation"),
     status: appAccessCredentialStatusEnum("status").notNull().default("active"),
     rotatedFromId: text("rotated_from_id"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
@@ -262,6 +276,7 @@ export const appOAuthRefreshTokens = pgTable("app_oauth_refresh_tokens", {
 }, (table) => [
     uniqueIndex("uidx_app_oauth_refresh_tokens_hash").on(table.tokenHash),
     index("idx_app_oauth_refresh_tokens_installation").on(table.installationId, table.status),
+    check("app_oauth_refresh_tokens_managed_binding_complete", sql `(${table.workloadEnvironmentId} IS NULL AND ${table.contractGeneration} IS NULL) OR (${table.workloadEnvironmentId} IS NOT NULL AND ${table.contractGeneration} > 0)`),
 ]);
 export const appInstallationSettings = pgTable("app_installation_settings", {
     id: typeId("app_installation_settings"),
@@ -354,6 +369,8 @@ export const appSessionTokens = pgTable("app_session_tokens", {
         .references(() => appInstallations.id, { onDelete: "cascade" }),
     appId: text("app_id").notNull(),
     deploymentId: text("deployment_id").notNull(),
+    workloadEnvironmentId: text("workload_environment_id"),
+    contractGeneration: integer("contract_generation"),
     jti: text("jti").notNull(),
     viewerId: text("viewer_id").notNull(),
     entityType: text("entity_type"),
@@ -366,4 +383,5 @@ export const appSessionTokens = pgTable("app_session_tokens", {
 }, (table) => [
     uniqueIndex("uidx_app_session_tokens_jti").on(table.jti),
     index("idx_app_session_tokens_installation").on(table.installationId, table.expiresAt),
+    check("app_session_tokens_managed_binding_complete", sql `(${table.workloadEnvironmentId} IS NULL AND ${table.contractGeneration} IS NULL) OR (${table.workloadEnvironmentId} IS NOT NULL AND ${table.contractGeneration} > 0)`),
 ]);

package/dist/session-token-service.d.ts

@@ -1,5 +1,6 @@
 import type { PostgresJsDatabase } from "drizzle-orm/postgres-js";
 import type { createAppOAuthService } from "./oauth-service.js";
+import type { ManagedAppInstallationAuthority } from "./runtime-port.js";
 import { type AppSessionTokenEntity } from "./session-token.js";
 type AppOAuthService = ReturnType<typeof createAppOAuthService>;
 export interface AppSessionTokenServiceOptions {
@@ -7,6 +8,7 @@ export interface AppSessionTokenServiceOptions {
     secret: string;
     /** The deployment audience the tokens are bound to. */
     deploymentId: string;
+    managedInstallation?: ManagedAppInstallationAuthority;
     /** OAuth service supplying the online actor-token-exchange primitive. */
     oauth: AppOAuthService;
     ttlSeconds?: number;

package/dist/session-token-service.js

@@ -20,10 +20,13 @@ export function createAppSessionTokenService(options) {
     const now = () => options.now?.() ?? new Date();
     async function issue(db, input) {
         const installation = await requireActiveInstallation(db, input.installationId);
+        const managedBinding = await resolveManagedBinding(options.managedInstallation, installation.appId, installation.releaseId);
+        assertManagedBinding(installation, managedBinding);
         const context = {
             appId: installation.appId,
             installationId: installation.id,
             deploymentId: installation.deploymentId,
+            ...(managedBinding ?? {}),
             viewerId: input.viewerId,
             viewerScopes: input.viewerScopes ?? [],
             entity: input.entity ?? null,
@@ -37,6 +40,8 @@ export function createAppSessionTokenService(options) {
             installationId: installation.id,
             appId: installation.appId,
             deploymentId: installation.deploymentId,
+            workloadEnvironmentId: managedBinding?.workloadEnvironmentId,
+            contractGeneration: managedBinding?.contractGeneration,
             jti: signed.claims.jti,
             viewerId: input.viewerId,
             entityType: signed.claims.entity?.type ?? null,
@@ -53,7 +58,7 @@ export function createAppSessionTokenService(options) {
     }
     async function exchange(db, input) {
         const verified = verifyAppSessionToken(input.token, options.secret, {
-            deploymentId: options.deploymentId,
+            deploymentId: options.managedInstallation ? undefined : options.deploymentId,
             audience: input.clientId,
             now,
         });
@@ -66,7 +71,11 @@ export function createAppSessionTokenService(options) {
         const { claims } = verified;
         return db.transaction(async (tx) => {
             const installation = await requireActiveInstallation(tx, claims.installationId);
-            if (installation.appId !== claims.aud || installation.deploymentId !== claims.deploymentId) {
+            const managedBinding = await resolveManagedBinding(options.managedInstallation, installation.appId, installation.releaseId);
+            if (installation.appId !== claims.aud ||
+                (!managedBinding && installation.deploymentId !== claims.deploymentId) ||
+                !managedBindingMatches(installation, managedBinding) ||
+                !managedBindingMatches(claims, managedBinding)) {
                 throw new ApiHttpError("Session token installation context changed", {
                     status: 401,
                     code: "app_session_token_installation_mismatch",
@@ -88,7 +97,12 @@ export function createAppSessionTokenService(options) {
             const consumed = await tx
                 .update(appSessionTokens)
                 .set({ consumedAt: now(), consumedByActorId: claims.sub })
-                .where(and(eq(appSessionTokens.jti, claims.jti), eq(appSessionTokens.installationId, installation.id), eq(appSessionTokens.appId, claims.aud), eq(appSessionTokens.deploymentId, claims.deploymentId), eq(appSessionTokens.viewerId, claims.sub), isNull(appSessionTokens.consumedAt), gt(appSessionTokens.expiresAt, now())))
+                .where(and(eq(appSessionTokens.jti, claims.jti), eq(appSessionTokens.installationId, installation.id), eq(appSessionTokens.appId, claims.aud), eq(appSessionTokens.deploymentId, claims.deploymentId), ...(managedBinding
+                ? [
+                    eq(appSessionTokens.workloadEnvironmentId, managedBinding.workloadEnvironmentId),
+                    eq(appSessionTokens.contractGeneration, managedBinding.contractGeneration),
+                ]
+                : []), eq(appSessionTokens.viewerId, claims.sub), isNull(appSessionTokens.consumedAt), gt(appSessionTokens.expiresAt, now())))
                 .returning({ id: appSessionTokens.id });
             if (consumed.length === 0) {
                 throw new ApiHttpError("Session token has already been used", {
@@ -107,6 +121,37 @@ export function createAppSessionTokenService(options) {
     }
     return { issue, exchange };
 }
+async function resolveManagedBinding(authority, appId, releaseId) {
+    if (!authority)
+        return undefined;
+    const contract = await authority.resolveInstallationContract({ appId, releaseId });
+    if (!contract ||
+        !Number.isSafeInteger(contract.contractGeneration) ||
+        contract.contractGeneration <= 0) {
+        throw new ApiHttpError("Managed app installation contract is unavailable", {
+            status: 401,
+            code: "app_session_token_contract_unavailable",
+        });
+    }
+    return {
+        workloadEnvironmentId: authority.workloadEnvironmentId,
+        contractGeneration: contract.contractGeneration,
+    };
+}
+function managedBindingMatches(persisted, expected) {
+    if (!expected)
+        return true;
+    return (persisted.workloadEnvironmentId === expected.workloadEnvironmentId &&
+        persisted.contractGeneration === expected.contractGeneration);
+}
+function assertManagedBinding(persisted, expected) {
+    if (!managedBindingMatches(persisted, expected)) {
+        throw new ApiHttpError("App installation belongs to a different managed environment", {
+            status: 401,
+            code: "app_session_token_installation_mismatch",
+        });
+    }
+}
 function intersectRequestedScopes(trustedViewerScopes, requestedScopes) {
     const trusted = new Set(trustedViewerScopes);
     return Array.from(new Set(requestedScopes.filter((scope) => trusted.has(scope)))).sort();

package/dist/session-token-service.test.js

@@ -2,7 +2,7 @@ import { ApiHttpError } from "@voyant-travel/hono";
 import { describe, expect, it, vi } from "vitest";
 import { appOAuthTokenSchema } from "./contracts.js";
 import { createAppSessionTokenService } from "./session-token-service.js";
-function trackedDatabaseStub() {
+function trackedDatabaseStub(installationOverrides = {}) {
     const installation = {
         id: "inst_1",
         appId: "app_1",
@@ -10,6 +10,7 @@ function trackedDatabaseStub() {
         deploymentId: "dep_1",
         status: "active",
         namespace: "app--one",
+        ...installationOverrides,
     };
     const consume = vi.fn().mockResolvedValue([{ id: "session_1" }]);
     const db = {
@@ -154,4 +155,33 @@ describe("app session token service", () => {
         await expect(service.exchange(db, input)).resolves.toEqual({ accessToken: "online" });
         expect(consume).toHaveBeenCalledOnce();
     });
+    it("keeps a managed session exchange valid across deployment rollouts", async () => {
+        const token = vi.fn().mockResolvedValue({ accessToken: "online" });
+        const installationAuthority = {
+            workloadEnvironmentId: "workload_environment_1",
+            resolveInstallationContract: async () => ({ contractGeneration: 7 }),
+        };
+        const { db } = trackedDatabaseStub({
+            workloadEnvironmentId: "workload_environment_1",
+            contractGeneration: 7,
+        });
+        const issued = await createAppSessionTokenService({
+            secret: "test-deployment-session-secret-value-000000000000",
+            deploymentId: "deployment_revision_1",
+            managedInstallation: installationAuthority,
+            oauth: { token },
+            now: () => new Date("2026-07-18T09:00:00.000Z"),
+        }).issue(db, { installationId: "inst_1", viewerId: "viewer_1" });
+        await expect(createAppSessionTokenService({
+            secret: "test-deployment-session-secret-value-000000000000",
+            deploymentId: "deployment_revision_2",
+            managedInstallation: installationAuthority,
+            oauth: { token },
+            now: () => new Date("2026-07-18T09:00:01.000Z"),
+        }).exchange(db, {
+            token: issued.token,
+            clientId: "app_1",
+            viewerScopes: [],
+        })).resolves.toEqual({ accessToken: "online" });
+    });
 });

package/dist/session-token.d.ts

@@ -19,6 +19,8 @@ export interface AppSessionTokenContext {
     appId: string;
     installationId: string;
     deploymentId: string;
+    workloadEnvironmentId?: string;
+    contractGeneration?: number;
     /** The admin viewer the token acts on behalf of. */
     viewerId: string;
     /** Host-authenticated viewer permissions captured at issuance. */
@@ -35,6 +37,8 @@ export interface AppSessionTokenClaims {
     sub: string;
     installationId: string;
     deploymentId: string;
+    workloadEnvironmentId?: string;
+    contractGeneration?: number;
     entity: AppSessionTokenEntity | null;
     slot: string | null;
     /** Host-authenticated viewer permissions; never supplied by the app backend. */
@@ -67,6 +71,9 @@ export interface VerifyAppSessionTokenExpectations {
     audience?: string;
     /** Reject unless `deploymentId` equals this deployment. */
     deploymentId?: string;
+    /** Managed workload-environment and contract binding; both are required together. */
+    workloadEnvironmentId?: string;
+    contractGeneration?: number;
     now?: () => Date;
 }
 export type AppSessionTokenVerifyResult = {
@@ -76,7 +83,7 @@ export type AppSessionTokenVerifyResult = {
     ok: false;
     reason: AppSessionTokenRejectReason;
 };
-export type AppSessionTokenRejectReason = "malformed" | "bad_signature" | "expired" | "wrong_issuer" | "audience_mismatch" | "deployment_mismatch";
+export type AppSessionTokenRejectReason = "malformed" | "bad_signature" | "expired" | "wrong_issuer" | "audience_mismatch" | "deployment_mismatch" | "workload_environment_mismatch" | "contract_generation_mismatch";
 /**
  * Verify a session token's signature, issuer, expiry, and (when supplied)
  * audience and deployment binding. Returns the decoded claims on success or a

package/dist/session-token.test.js

@@ -10,6 +10,11 @@ const context = {
     entity: { type: "booking", id: "book_1" },
     slot: "booking.details.header",
 };
+const managedContext = {
+    ...context,
+    workloadEnvironmentId: "workload_environment_1",
+    contractGeneration: 3,
+};
 const at = (iso) => () => new Date(iso);
 describe("app session token", () => {
     it("round-trips claims, binds context, and carries a unique id", () => {
@@ -65,6 +70,47 @@ describe("app session token", () => {
         });
         expect(result).toEqual({ ok: false, reason: "deployment_mismatch" });
     });
+    it("uses the stable workload environment rather than deployment revision in managed mode", () => {
+        const signed = signAppSessionToken({ ...managedContext, deploymentId: "deployment_revision_1" }, secret, { now: at("2026-07-17T10:00:00Z") });
+        const result = verifyAppSessionToken(signed.token, secret, {
+            audience: "app_1",
+            workloadEnvironmentId: "workload_environment_1",
+            contractGeneration: 3,
+            now: at("2026-07-17T10:01:00Z"),
+        });
+        expect(result.ok).toBe(true);
+    });
+    it("fails closed across managed workload environments and stale contract generations", () => {
+        const signed = signAppSessionToken(managedContext, secret, {
+            now: at("2026-07-17T10:00:00Z"),
+        });
+        expect(verifyAppSessionToken(signed.token, secret, {
+            workloadEnvironmentId: "workload_environment_other",
+            contractGeneration: 3,
+            now: at("2026-07-17T10:01:00Z"),
+        })).toEqual({ ok: false, reason: "workload_environment_mismatch" });
+        expect(verifyAppSessionToken(signed.token, secret, {
+            workloadEnvironmentId: "workload_environment_1",
+            contractGeneration: 4,
+            now: at("2026-07-17T10:01:00Z"),
+        })).toEqual({ ok: false, reason: "contract_generation_mismatch" });
+    });
+    it("supports independent app contract generations in one workload environment", () => {
+        const first = signAppSessionToken({ ...managedContext, appId: "app_1", contractGeneration: 2 }, secret, { now: at("2026-07-17T10:00:00Z") });
+        const second = signAppSessionToken({ ...managedContext, appId: "app_2", contractGeneration: 9 }, secret, { now: at("2026-07-17T10:00:00Z") });
+        expect(verifyAppSessionToken(first.token, secret, {
+            audience: "app_1",
+            workloadEnvironmentId: "workload_environment_1",
+            contractGeneration: 2,
+            now: at("2026-07-17T10:01:00Z"),
+        }).ok).toBe(true);
+        expect(verifyAppSessionToken(second.token, secret, {
+            audience: "app_2",
+            workloadEnvironmentId: "workload_environment_1",
+            contractGeneration: 9,
+            now: at("2026-07-17T10:01:00Z"),
+        }).ok).toBe(true);
+    });
     it("rejects a tampered signature", () => {
         const signed = signAppSessionToken(context, secret, { now: at("2026-07-17T10:00:00Z") });
         const tampered = `${signed.token.slice(0, -2)}xy`;

package/migrations/20260718205748_managed_installation_binding.sql

@@ -0,0 +1,16 @@
+ALTER TABLE "app_installations" ADD COLUMN "workload_environment_id" text;--> statement-breakpoint
+ALTER TABLE "app_installations" ADD COLUMN "contract_generation" integer;--> statement-breakpoint
+ALTER TABLE "app_access_credentials" ADD COLUMN "workload_environment_id" text;--> statement-breakpoint
+ALTER TABLE "app_access_credentials" ADD COLUMN "contract_generation" integer;--> statement-breakpoint
+ALTER TABLE "app_oauth_authorization_codes" ADD COLUMN "workload_environment_id" text;--> statement-breakpoint
+ALTER TABLE "app_oauth_authorization_codes" ADD COLUMN "contract_generation" integer;--> statement-breakpoint
+ALTER TABLE "app_oauth_refresh_tokens" ADD COLUMN "workload_environment_id" text;--> statement-breakpoint
+ALTER TABLE "app_oauth_refresh_tokens" ADD COLUMN "contract_generation" integer;--> statement-breakpoint
+ALTER TABLE "app_session_tokens" ADD COLUMN "workload_environment_id" text;--> statement-breakpoint
+ALTER TABLE "app_session_tokens" ADD COLUMN "contract_generation" integer;--> statement-breakpoint
+ALTER TABLE "app_installations" ADD CONSTRAINT "app_installations_managed_binding_complete" CHECK (("workload_environment_id" IS NULL AND "contract_generation" IS NULL) OR ("workload_environment_id" IS NOT NULL AND "contract_generation" > 0));--> statement-breakpoint
+ALTER TABLE "app_access_credentials" ADD CONSTRAINT "app_access_credentials_managed_binding_complete" CHECK (("workload_environment_id" IS NULL AND "contract_generation" IS NULL) OR ("workload_environment_id" IS NOT NULL AND "contract_generation" > 0));--> statement-breakpoint
+ALTER TABLE "app_oauth_authorization_codes" ADD CONSTRAINT "app_oauth_codes_managed_binding_complete" CHECK (("workload_environment_id" IS NULL AND "contract_generation" IS NULL) OR ("workload_environment_id" IS NOT NULL AND "contract_generation" > 0));--> statement-breakpoint
+ALTER TABLE "app_oauth_refresh_tokens" ADD CONSTRAINT "app_oauth_refresh_tokens_managed_binding_complete" CHECK (("workload_environment_id" IS NULL AND "contract_generation" IS NULL) OR ("workload_environment_id" IS NOT NULL AND "contract_generation" > 0));--> statement-breakpoint
+ALTER TABLE "app_session_tokens" ADD CONSTRAINT "app_session_tokens_managed_binding_complete" CHECK (("workload_environment_id" IS NULL AND "contract_generation" IS NULL) OR ("workload_environment_id" IS NOT NULL AND "contract_generation" > 0));--> statement-breakpoint
+CREATE UNIQUE INDEX "uidx_app_installations_workload_environment_app" ON "app_installations" USING btree ("workload_environment_id","app_id") WHERE "workload_environment_id" IS NOT NULL;

package/migrations/meta/_journal.json

@@ -36,6 +36,13 @@
       "when": 1784300400000,
       "tag": "20260717150000_app_session_tokens",
       "breakpoints": true
+    },
+    {
+      "idx": 5,
+      "version": "7",
+      "when": 1784397468000,
+      "tag": "20260718205748_managed_installation_binding",
+      "breakpoints": true
     }
   ]
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyant-travel/apps",
-  "version": "0.8.0",
+  "version": "0.9.1",
   "license": "Apache-2.0",
   "type": "module",
   "exports": {
@@ -128,13 +128,13 @@
     "zod": "^4.4.3",
     "@voyant-travel/admin": "^0.127.0",
     "@voyant-travel/admin-extension-sdk": "^0.2.0",
-    "@voyant-travel/core": "^0.127.0",
-    "@voyant-travel/custom-fields": "^0.2.4",
+    "@voyant-travel/core": "^0.128.0",
+    "@voyant-travel/custom-fields": "^0.2.5",
     "@voyant-travel/finance-contracts": "^0.107.0",
-    "@voyant-travel/db": "^0.114.13",
-    "@voyant-travel/hono": "^0.129.0",
+    "@voyant-travel/db": "^0.114.14",
+    "@voyant-travel/hono": "^0.130.0",
     "@voyant-travel/types": "^0.109.4",
-    "@voyant-travel/webhook-delivery": "^0.4.2"
+    "@voyant-travel/webhook-delivery": "^0.4.3"
   },
   "devDependencies": {
     "@types/node": "^25.5.2",