@noodleseed/one 0.136.0 → 0.138.0

package/node_modules/@noodle-borg/{service → observability}/dist/request-event-metrics.js

@@ -10,8 +10,11 @@ function hourBucket(iso) {
     return `${iso.slice(0, 13)}:00:00.000Z`;
 }
 export function aggregateRequestEvents(events) {
-    const usage = events.filter((e) => e.kind === 'usage');
-    const discovery = events.length - usage.length;
+    // Assistant lifecycle records share the durable tenant stream but have their own aggregate. Keep
+    // the long-standing MCP metrics contract stable rather than counting one user turn as an MCP call.
+    const mcpEvents = events.filter((event) => event.method !== 'assistant');
+    const usage = mcpEvents.filter((event) => event.kind === 'usage');
+    const discovery = mcpEvents.length - usage.length;
     const durations = usage.map((e) => e.durationMs).sort((a, b) => a - b);
     let ok = 0;
     let toolErrors = 0;

package/node_modules/@noodle-borg/observability/dist/request-events-postgres.js

@@ -51,6 +51,10 @@ export async function ensureRequestEventSchema(pool) {
     await pool.query(`
     CREATE INDEX IF NOT EXISTS request_events_tenant_time_idx
       ON request_events (org_slug, app_slug, environment, seq DESC)
+  `);
+    await pool.query(`
+    CREATE INDEX IF NOT EXISTS request_events_tenant_method_time_idx
+      ON request_events (org_slug, app_slug, environment, method, seq DESC)
   `);
     await pool.query(`
     CREATE INDEX IF NOT EXISTS request_events_session_idx
@@ -128,6 +132,8 @@ export class PostgresRequestEventStore {
             add('app_slug', filter.app);
         if (filter.env !== undefined)
             add('environment', filter.env);
+        if (filter.method !== undefined)
+            add('method', filter.method);
         if (filter.outcome !== undefined)
             add('outcome', filter.outcome);
         if (filter.toolName !== undefined)

package/node_modules/@noodle-borg/observability/dist/request-events.js

@@ -41,6 +41,8 @@ function matches(event, filter) {
         return false;
     if (filter.env !== undefined && event.env !== filter.env)
         return false;
+    if (filter.method !== undefined && event.method !== filter.method)
+        return false;
     if (filter.outcome !== undefined && event.outcome !== filter.outcome)
         return false;
     if (filter.toolName !== undefined && event.toolName !== filter.toolName)

package/node_modules/@noodle-borg/service/dist/assistant-bindings.js

@@ -3,7 +3,7 @@ import { missingSecretErrors, missingVariableErrors } from './registry-helpers.j
 import { serverAuthSecretBindings } from './server-auth-bindings.js';
 const VARIABLE = /\$\{env\.([A-Za-z0-9_]+)\}/g;
 export function assistantSecretBindings(assistant) {
-    return assistant
+    return assistant?.model.kind === 'openai-compatible'
         ? [
             {
                 connectorId: 'server.assistant',
@@ -17,6 +17,8 @@ export function assistantSecretBindings(assistant) {
 export function assistantVariableBindings(assistant) {
     if (!assistant)
         return [];
+    if (assistant.model.kind !== 'openai-compatible')
+        return [];
     const names = new Set();
     for (const value of [assistant.model.baseUrl, assistant.model.model]) {
         for (const match of value.matchAll(VARIABLE)) {

package/node_modules/@noodle-borg/service/dist/developer-mcp/control-plane-adapter.js

@@ -1,7 +1,6 @@
-import { mcpSubdomainEndpointOptions } from '@noodle-borg/control-plane/portable';
+import { mcpSubdomainEndpointOptions, rollbackDeploymentOperation, } from '@noodle-borg/control-plane/portable';
 import { DeveloperControlPlaneError, } from '@noodle-borg/developer-mcp';
-import { rollbackDeploymentOperation } from '../operations/rollback-deployment.js';
-import { aggregateRequestEvents } from '../request-event-metrics.js';
+import { aggregateRequestEvents } from '@noodle-borg/observability';
 import { inspectCompiledServiceDeployment, inspectServiceDeployment } from './inspection.js';
 const METRICS_SCAN_LIMIT = 50_000;
 const WINDOWS_MS = {
@@ -261,6 +260,7 @@ function mapDeployment(deployment) {
         serverName: deployment.serverName,
         createdAt: deployment.createdAt,
         accessMode: deployment.accessMode,
+        ...(deployment.ownerSubject !== undefined ? { ownerSubject: deployment.ownerSubject } : {}),
         ...(deployment.endpointUrl !== undefined ? { endpointUrl: deployment.endpointUrl } : {}),
     };
 }

package/node_modules/@noodle-borg/service/dist/developer-mcp/inspection.js

@@ -1,4 +1,4 @@
-import { tenantMcpUrl } from '../registry-helpers.js';
+import { tenantMcpUrl } from '@noodle-borg/module';
 export async function inspectServiceDeployment(registry, tenant, baseUrl, endpointOptions = {}) {
     const status = await registry.getStatus(tenant, baseUrl, undefined, endpointOptions);
     if (status === undefined)
@@ -109,6 +109,7 @@ export function inspectCompiledServiceDeployment(deployment, artifact, baseUrl,
                 ? {}
                 : { createdByEmail: deployment.createdByEmail }),
             accessMode: deployment.accessMode,
+            ...(deployment.ownerSubject !== undefined ? { ownerSubject: deployment.ownerSubject } : {}),
         },
         health: { state: 'ready', missingSecrets: [] },
         surface,

package/node_modules/@noodle-borg/service/dist/registry-access.js

@@ -1,12 +1,13 @@
 import { assertUniqueActiveCustomerAuthAudienceBindings, CustomerAuthAudienceConflictError, } from './customer-auth-audience-binding.js';
+import { deploymentOwnerSubject } from './registry-helpers.js';
 import { activeRecord, activeRecordVersion } from './registry-state.js';
 import { tenantDeploymentKey, tryServedTargetFor } from './registry-targets.js';
 /** Registry-facing access transition with customer audience ownership preflight and atomic translation. */
-export async function updateRegistryAccess(state, tenant, nextAccessMode, serverVersion, loadServed, customerVerifierFactory, hasCustomerAuthConflict) {
-    if (nextAccessMode === 'customers') {
-        const record = serverVersion === undefined
+export async function updateRegistryAccess(state, tenant, options, loadServed, customerVerifierFactory, hasCustomerAuthConflict) {
+    if (options.accessMode === 'customers') {
+        const record = options.serverVersion === undefined
             ? await activeRecord(state, tenant)
-            : await activeRecordVersion(state, tenant, serverVersion);
+            : await activeRecordVersion(state, tenant, options.serverVersion);
         const served = record === undefined ? undefined : await loadServed(record.deploymentId);
         const auth = served?.served.artifact.server.auth;
         if (record !== undefined &&
@@ -16,7 +17,7 @@ export async function updateRegistryAccess(state, tenant, nextAccessMode, server
         }
     }
     try {
-        return await updateActiveAccess(state, tenant, nextAccessMode, serverVersion, loadServed, customerVerifierFactory);
+        return await updateActiveAccess(state, tenant, options, loadServed, customerVerifierFactory);
     }
     catch (error) {
         if (error instanceof CustomerAuthAudienceConflictError) {
@@ -34,14 +35,19 @@ export function manifestUsesUserRoot(manifest) {
  * access mode supplies the optimistic guard; in-memory state is reconciled only after the store accepts
  * the compare-and-set.
  */
-export async function updateActiveAccess(state, tenant, nextAccessMode, serverVersion, loadServed, customerVerifierFactory) {
-    const record = serverVersion === undefined
+export async function updateActiveAccess(state, tenant, options, loadServed, customerVerifierFactory) {
+    const record = options.serverVersion === undefined
         ? await activeRecord(state, tenant)
-        : await activeRecordVersion(state, tenant, serverVersion);
+        : await activeRecordVersion(state, tenant, options.serverVersion);
     if (record === undefined)
         return noActiveDeployment();
+    const nextAccessMode = options.accessMode;
     const previousAccessMode = record.accessMode ?? 'owner-only';
-    const served = previousAccessMode !== nextAccessMode || nextAccessMode === 'customers'
+    const previousOwnerSubject = deploymentOwnerSubject(record);
+    const nextOwnerSubject = options.ownerSubject ?? previousOwnerSubject;
+    const accessChanged = previousAccessMode !== nextAccessMode;
+    const ownerChanged = previousOwnerSubject !== nextOwnerSubject;
+    const served = accessChanged || ownerChanged || nextAccessMode === 'customers'
         ? await loadServed(record.deploymentId)
         : undefined;
     const serverAuth = served?.served.artifact.server.auth;
@@ -53,20 +59,33 @@ export async function updateActiveAccess(state, tenant, nextAccessMode, serverVe
             message: 'Customer access requires server authentication.',
         };
     }
-    if (previousAccessMode === nextAccessMode) {
+    if (!accessChanged && !ownerChanged) {
         const committed = state.store === undefined
-            ? commitInMemoryAccessUpdate(state, tenant, record, nextAccessMode, serverAuth)
-            : await state.store.updateActiveAccess(tenant, record.deploymentId, nextAccessMode, {
+            ? commitInMemoryAccessUpdate(state, tenant, record, {
+                accessMode: nextAccessMode,
                 expectedAccessMode: record.accessMode,
+                expectedOwnerSubject: previousOwnerSubject,
+                ...(serverAuth !== undefined ? { serverAuth } : {}),
+            })
+            : await state.store.updateActiveAccess(tenant, record.deploymentId, {
+                accessMode: nextAccessMode,
+                expectedAccessMode: record.accessMode,
+                expectedOwnerSubject: previousOwnerSubject,
                 ...(serverAuth !== undefined ? { serverAuth } : {}),
             });
         if (committed === undefined)
             return accessUpdateConflict();
         reconcileCommittedAccess(state, tenant, committed);
-        return { ok: true, changed: false, previousAccessMode, record: committed };
+        return {
+            ok: true,
+            changed: false,
+            accessChanged: false,
+            ownerChanged: false,
+            previousAccessMode,
+            ...(previousOwnerSubject !== undefined ? { previousOwnerSubject } : {}),
+            record: committed,
+        };
     }
-    if (served === undefined)
-        return accessUpdateConflict();
     if (nextAccessMode === 'public' && manifestUsesUserRoot(record.manifest)) {
         return {
             ok: false,
@@ -75,7 +94,7 @@ export async function updateActiveAccess(state, tenant, nextAccessMode, serverVe
             message: 'Public access cannot reference the user context.',
         };
     }
-    if (nextAccessMode === 'owner-only' && record.createdBySubject === undefined) {
+    if (nextAccessMode === 'owner-only' && nextOwnerSubject === undefined) {
         return {
             ok: false,
             status: 409,
@@ -83,27 +102,51 @@ export async function updateActiveAccess(state, tenant, nextAccessMode, serverVe
             message: 'Owner-only access requires a recorded deployer identity.',
         };
     }
+    if (served === undefined)
+        return accessUpdateConflict();
     const updated = {
         ...record,
         accessMode: nextAccessMode,
+        ...(ownerChanged && nextOwnerSubject !== undefined ? { ownerSubject: nextOwnerSubject } : {}),
         ...(nextAccessMode === 'customers' && serverAuth !== undefined ? { serverAuth } : {}),
     };
     const target = tryServedTargetFor(updated, served.served, customerVerifierFactory);
     if (target === undefined)
         return accessUpdateConflict();
     const committed = state.store === undefined
-        ? commitInMemoryAccessUpdate(state, tenant, record, nextAccessMode, serverAuth)
-        : await state.store.updateActiveAccess(tenant, record.deploymentId, nextAccessMode, {
+        ? commitInMemoryAccessUpdate(state, tenant, record, {
+            accessMode: nextAccessMode,
+            ...(ownerChanged && nextOwnerSubject !== undefined
+                ? { ownerSubject: nextOwnerSubject }
+                : {}),
+            expectedAccessMode: record.accessMode,
+            expectedOwnerSubject: previousOwnerSubject,
+            ...(serverAuth !== undefined ? { serverAuth } : {}),
+        })
+        : await state.store.updateActiveAccess(tenant, record.deploymentId, {
+            accessMode: nextAccessMode,
+            ...(ownerChanged && nextOwnerSubject !== undefined
+                ? { ownerSubject: nextOwnerSubject }
+                : {}),
             expectedAccessMode: record.accessMode,
+            expectedOwnerSubject: previousOwnerSubject,
             ...(serverAuth !== undefined ? { serverAuth } : {}),
         });
     if (committed === undefined)
         return accessUpdateConflict();
     reconcileCommittedAccess(state, tenant, committed);
     state.servers.set(committed.deploymentId, target);
-    return { ok: true, changed: true, previousAccessMode, record: committed };
+    return {
+        ok: true,
+        changed: true,
+        accessChanged,
+        ownerChanged,
+        previousAccessMode,
+        ...(previousOwnerSubject !== undefined ? { previousOwnerSubject } : {}),
+        record: committed,
+    };
 }
-function commitInMemoryAccessUpdate(state, tenant, observed, nextAccessMode, serverAuth) {
+function commitInMemoryAccessUpdate(state, tenant, observed, input) {
     const current = state.records.get(observed.deploymentId);
     if (current === undefined ||
         !current.active ||
@@ -111,16 +154,22 @@ function commitInMemoryAccessUpdate(state, tenant, observed, nextAccessMode, ser
         current.orgSlug !== tenant.org ||
         current.appSlug !== tenant.app ||
         current.environment !== tenant.env ||
-        current.accessMode !== observed.accessMode) {
+        current.accessMode !== input.expectedAccessMode ||
+        deploymentOwnerSubject(current) !== input.expectedOwnerSubject) {
         return undefined;
     }
-    if ((current.accessMode ?? 'owner-only') === nextAccessMode && nextAccessMode !== 'customers') {
+    if ((current.accessMode ?? 'owner-only') === input.accessMode &&
+        (input.ownerSubject === undefined || deploymentOwnerSubject(current) === input.ownerSubject) &&
+        input.accessMode !== 'customers') {
         return current;
     }
     const committed = {
         ...current,
-        accessMode: nextAccessMode,
-        ...(nextAccessMode === 'customers' && serverAuth !== undefined ? { serverAuth } : {}),
+        accessMode: input.accessMode,
+        ...(input.ownerSubject !== undefined ? { ownerSubject: input.ownerSubject } : {}),
+        ...(input.accessMode === 'customers' && input.serverAuth !== undefined
+            ? { serverAuth: input.serverAuth }
+            : {}),
     };
     const proposed = new Map(state.records).set(committed.deploymentId, committed);
     assertUniqueActiveCustomerAuthAudienceBindings([...proposed.values()]);

package/node_modules/@noodle-borg/service/dist/registry-deploy-transaction.js

@@ -1,5 +1,5 @@
 import { normalizeServerVersion } from '@noodle-borg/module';
-import { deployAccessRequiresActor, deployerRequiredError, emptyMembershipSourcesError, membershipSourcesRequireOrgMembersError, missingCapabilityErrors, serverAuthRequiredError, } from './registry-helpers.js';
+import { deployAccessRequiresActor, deployerRequiredError, deploymentOwnerSubject, emptyMembershipSourcesError, membershipSourcesRequireOrgMembersError, missingCapabilityErrors, serverAuthRequiredError, } from './registry-helpers.js';
 import { idempotentDeploymentId, mintDeploymentId } from './registry-targets.js';
 export async function preflightRegistryDeploy(input) {
     const { actor, accessMode, orgMembershipSources } = input.options;
@@ -56,6 +56,7 @@ export async function resolveDeployAttempt(input) {
             },
         };
     }
+    const ownerSubject = deploymentOwnerSubject(existing);
     return {
         deploymentId,
         replay: {
@@ -64,6 +65,7 @@ export async function resolveDeployAttempt(input) {
             deploymentVersion: existing.deploymentVersion,
             ...(existing.serverVersion !== undefined ? { serverVersion: existing.serverVersion } : {}),
             ...(existing.accessMode !== undefined ? { accessMode: existing.accessMode } : {}),
+            ...(ownerSubject !== undefined ? { ownerSubject } : {}),
             replayed: true,
         },
     };
@@ -82,7 +84,8 @@ function sameIdempotentDeploy(record, tenant, manifest, options) {
         record.deploymentSource === options.deploymentSource &&
         sameJson(record.hostedAssets, options.hostedAssets) &&
         sameJson(record.orgMembershipSources, options.orgMembershipSources) &&
-        (options.accessMode !== 'owner-only' || record.createdBySubject === options.actor?.subject));
+        (options.accessMode !== 'owner-only' ||
+            deploymentOwnerSubject(record) === (options.ownerSubject ?? options.actor?.subject)));
 }
 function sameJson(left, right) {
     return JSON.stringify(left) === JSON.stringify(right);

package/node_modules/@noodle-borg/service/dist/registry-helpers.d.ts

@@ -3,26 +3,22 @@ import type { SecretBinding } from '@noodle-borg/connector-defs';
 import type { OrgMembershipSource } from '@noodle-borg/module';
 import type { AccessMode } from '@noodle-borg/transport-http';
 import type { DeployError } from './registry.js';
-import type { TenantRef } from './store.js';
+import type { DeployRecord } from './store.js';
 /**
  * Provenance of an env's current active deployment — the inherit source for GHD-3 run-deploy
- * access-mode resolution (ADR 0132 Decision 4). The owner subject/email let an inherited `owner-only`
- * run deploy preserve the PREVIOUS human owner instead of rebinding the app to the automation subject.
+ * access-mode resolution (ADR 0132 Decision 4). The owner subject lets an inherited `owner-only` run deploy
+ * preserve the PREVIOUS human owner instead of rebinding the app to the automation subject.
  */
 export type ActiveDeployProvenance = {
     readonly accessMode: AccessMode | undefined;
     readonly orgMembershipSources: readonly OrgMembershipSource[] | undefined;
     readonly ownerSubject: string | undefined;
-    readonly ownerEmail: string | undefined;
 } | undefined;
+/** Resolve the durable owner binding while keeping legacy creator-only records readable. */
+export declare function deploymentOwnerSubject(record: DeployRecord): string | undefined;
 export declare function missingCapabilityErrors(required: readonly CapabilityName[], available: readonly CapabilityName[]): readonly DeployError[];
 export declare function missingSecretErrors(bindings: readonly SecretBinding[], secrets: Readonly<Record<string, string>>): DeployError[];
 export declare function missingVariableErrors(bindings: readonly string[], variables: Readonly<Record<string, string>>): DeployError[];
-export interface EndpointUrlOptions {
-    readonly publicBaseDomain?: string;
-    readonly mcpSubdomain?: string;
-}
-export declare function tenantMcpUrl(base: string, tenant: TenantRef, serverVersion?: string, options?: EndpointUrlOptions): string;
 export declare function deployAccessRequiresActor(accessMode: AccessMode): boolean;
 /** An identity access mode was requested without an authenticated deployer. */
 export declare function deployerRequiredError(accessMode: AccessMode): {

package/node_modules/@noodle-borg/service/dist/registry-helpers.js

@@ -1,4 +1,7 @@
-import { formatPublicMcpUrl, serverVersionPathSegment } from '@noodle-borg/module';
+/** Resolve the durable owner binding while keeping legacy creator-only records readable. */
+export function deploymentOwnerSubject(record) {
+    return record.ownerSubject ?? record.createdBySubject;
+}
 export function missingCapabilityErrors(required, available) {
     const enabled = new Set(available);
     return required
@@ -41,23 +44,6 @@ export function missingVariableErrors(bindings, variables) {
     }
     return errors;
 }
-export function tenantMcpUrl(base, tenant, serverVersion, options = {}) {
-    if (options.publicBaseDomain !== undefined) {
-        if (options.mcpSubdomain === undefined) {
-            throw new Error('MCP subdomain is required to format a public endpoint URL');
-        }
-        return formatPublicMcpUrl(options.publicBaseDomain, {
-            mcpSubdomain: options.mcpSubdomain,
-            app: tenant.app,
-            env: tenant.env,
-            ...(serverVersion !== undefined ? { serverVersion } : {}),
-        });
-    }
-    const versionPath = serverVersion !== undefined ? `/${serverVersionPathSegment(serverVersion)}` : '';
-    return tenant.env === 'prod'
-        ? `${base}/o/${tenant.org}/${tenant.app}${versionPath}/mcp`
-        : `${base}/o/${tenant.org}/${tenant.app}/${tenant.env}${versionPath}/mcp`;
-}
 export function deployAccessRequiresActor(accessMode) {
     return accessMode !== 'public' && accessMode !== 'mixed';
 }

package/node_modules/@noodle-borg/service/dist/registry-rollback.js

@@ -1,4 +1,4 @@
-import { missingCapabilityErrors } from './registry-helpers.js';
+import { deploymentOwnerSubject, missingCapabilityErrors } from './registry-helpers.js';
 import { activateInMemory } from './registry-state.js';
 import { recordMatchesTenant, servedTargetFor, tenantDeploymentKey, tenantKey, tryServedTargetFor, } from './registry-targets.js';
 /**
@@ -101,6 +101,7 @@ export async function rollbackDeployment(state, ref, deploymentId, compilePersis
     state.servers.set(active.deploymentId, servedTargetFor(active, built.served, customerVerifierFactory));
     state.activeTenants.set(tenantDeploymentKey(ref, active.serverVersion), active.deploymentId);
     state.activeTenants.delete(tenantKey(ref));
+    const ownerSubject = deploymentOwnerSubject(active);
     return {
         ok: true,
         deploymentId: active.deploymentId,
@@ -108,6 +109,7 @@ export async function rollbackDeployment(state, ref, deploymentId, compilePersis
         ...(previous !== undefined ? { previousDeploymentId: previous.deploymentId } : {}),
         alreadyActive: activation.alreadyActive,
         accessMode: active.accessMode ?? 'owner-only',
+        ...(ownerSubject !== undefined ? { ownerSubject } : {}),
         ...(previous?.accessMode !== undefined ? { previousAccessMode: previous.accessMode } : {}),
         serverName: active.serverName,
         createdAt: active.createdAt,

package/node_modules/@noodle-borg/service/dist/registry-status.js

@@ -1,4 +1,5 @@
-import { missingSecretNames, tenantMcpUrl } from './registry-helpers.js';
+import { tenantMcpUrl } from '@noodle-borg/module';
+import { deploymentOwnerSubject, missingSecretNames } from './registry-helpers.js';
 /** Project one compiled deployment into the control-plane status contract. */
 export function deploymentStatusFor(ref, record, built, baseUrl, endpointOptions) {
     const missingSecrets = built.ok ? [] : missingSecretNames(built.errors);
@@ -6,6 +7,7 @@ export function deploymentStatusFor(ref, record, built, baseUrl, endpointOptions
         record.accessMode === 'customers' &&
         built.served.artifact.server.auth === undefined;
     const unhealthy = missingCustomerAuth || (!built.ok && missingSecrets.length === 0);
+    const ownerSubject = deploymentOwnerSubject(record);
     return {
         target: ref,
         deployment: {
@@ -16,6 +18,7 @@ export function deploymentStatusFor(ref, record, built, baseUrl, endpointOptions
             serverName: record.serverName,
             createdAt: record.createdAt,
             ...(record.createdByEmail !== undefined ? { createdByEmail: record.createdByEmail } : {}),
+            ...(ownerSubject !== undefined ? { ownerSubject } : {}),
             accessMode: record.accessMode ?? 'owner-only',
             ...(record.deploymentLock !== undefined
                 ? {

package/node_modules/@noodle-borg/service/dist/registry-targets.js

@@ -1,6 +1,7 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { parseAppPackageSnapshot } from './app-package-snapshot.js';
 import { hasExactCustomerAuthProjection } from './customer-auth-audience-binding.js';
+import { deploymentOwnerSubject } from './registry-helpers.js';
 /**
  * Build the front-door {@link ServedTarget} for a persisted record: its access mode plus the credential the
  * front-door checks. Legacy alpha records without an identity access mode are not served.
@@ -18,6 +19,7 @@ export function servedTargetFor(record, served, customerVerifierFactory) {
         throw new MissingCustomerAuthError(record.deploymentId);
     }
     const boundServed = bindAppPackageSnapshot(served, record.appPackageSnapshot);
+    const ownerSubject = deploymentOwnerSubject(record);
     return {
         served: boundServed,
         deploymentId: record.deploymentId,
@@ -28,9 +30,7 @@ export function servedTargetFor(record, served, customerVerifierFactory) {
         ...(accessMode === 'org-members' && record.orgMembershipSources !== undefined
             ? { orgMembershipSources: record.orgMembershipSources }
             : {}),
-        ...(accessMode === 'owner-only' && record.createdBySubject !== undefined
-            ? { ownerSubject: record.createdBySubject }
-            : {}),
+        ...(accessMode === 'owner-only' && ownerSubject !== undefined ? { ownerSubject } : {}),
         ...(customerAuth !== undefined
             ? customerTargetFields(customerAuth, customerVerifierFactory)
             : {}),
@@ -55,7 +55,7 @@ export function tryServedTargetFor(record, served, customerVerifierFactory) {
     }
 }
 export function servedTargetMatchesRecord(target, record) {
-    const expectedOwner = record.accessMode === 'owner-only' ? record.createdBySubject : undefined;
+    const expectedOwner = record.accessMode === 'owner-only' ? deploymentOwnerSubject(record) : undefined;
     const expectedMembership = record.accessMode === 'org-members' ? record.orgMembershipSources : undefined;
     return (target.deploymentId === record.deploymentId &&
         target.accessMode === record.accessMode &&

package/node_modules/@noodle-borg/service/dist/registry-types.d.ts

@@ -22,6 +22,8 @@ export interface DeployOptions {
     readonly connectors?: string | undefined;
     readonly actor?: ControlPlaneIdentity | undefined;
     readonly accessMode?: AccessMode | undefined;
+    /** Effective OAuth subject for an owner-only deployment, distinct from the deploy actor. */
+    readonly ownerSubject?: string | undefined;
     readonly orgMembershipSources?: readonly OrgMembershipSource[] | undefined;
     readonly hostedAssets?: readonly HostedPackagedAsset[] | undefined;
     readonly serverVersion?: string | undefined;
@@ -46,6 +48,7 @@ export type DeployResult = {
     readonly deploymentVersion: number;
     readonly serverVersion?: string;
     readonly accessMode?: AccessMode;
+    readonly ownerSubject?: string;
     readonly replayed?: boolean;
 } | {
     readonly ok: false;
@@ -69,27 +72,14 @@ export type RunDeployResult = DeployResult | {
     readonly deploymentVersion: number;
     readonly serverVersion?: string;
 };
-export type RollbackResult = {
-    readonly ok: true;
-    readonly deploymentId: string;
-    readonly serverVersion?: string;
-    readonly previousDeploymentId?: string;
-    readonly alreadyActive: boolean;
-    readonly accessMode: AccessMode;
-    readonly previousAccessMode?: AccessMode;
-    readonly serverName: string;
-    readonly createdAt: string;
-} | {
-    readonly ok: false;
-    readonly status: 404 | 409;
-    readonly code?: 'deployment_locked';
-    readonly error: string;
-};
 export type AccessUpdateFailureCode = 'no_active_deployment' | 'server_auth_required' | 'customer_auth_audience_conflict' | 'public_user_context_conflict' | 'owner_identity_required' | 'access_update_conflict';
 export type AccessUpdateResult = {
     readonly ok: true;
     readonly changed: boolean;
+    readonly accessChanged: boolean;
+    readonly ownerChanged: boolean;
     readonly previousAccessMode: AccessMode;
+    readonly previousOwnerSubject?: string;
     readonly record: DeployRecord;
 } | {
     readonly ok: false;
@@ -97,6 +87,11 @@ export type AccessUpdateResult = {
     readonly code: AccessUpdateFailureCode;
     readonly message: string;
 };
+export interface AccessUpdateOptions {
+    readonly accessMode: AccessMode;
+    readonly ownerSubject?: string | undefined;
+    readonly serverVersion?: string | undefined;
+}
 export interface ServerRegistryOptions {
     /** Pure renderer injection used for deployment-bound package construction and failure testing. */
     readonly renderAppPackage?: AppPackageRenderer;

package/node_modules/@noodle-borg/service/dist/registry.d.ts

@@ -1,14 +1,17 @@
 import type { CapabilityName } from '@noodle-borg/capabilities';
 import type { CatalogConnector, LocalAssetOptions, PackagedAsset } from '@noodle-borg/compiler';
+import type { RollbackResult } from '@noodle-borg/control-plane/portable';
 import { type KnowledgeDeployHooks, type KnowledgeSearchPortFactory } from '@noodle-borg/knowledge-operations/portable';
 import type { PlatformIdentityRecoveryPlan } from '@noodle-borg/module';
+import { type EndpointUrlOptions } from '@noodle-borg/module';
 import type { Connector, SecretBox } from '@noodle-borg/runtime';
-import type { AccessMode, ServedTarget } from '@noodle-borg/transport-http';
-import { type ActiveDeployProvenance, type EndpointUrlOptions } from './registry-helpers.js';
-import type { AccessUpdateResult, DeployOptions, DeployPreflightResult, RecoverResult, RollbackResult, RunDeployResult, ServerRegistryOptions } from './registry-types.js';
+import type { ServedTarget } from '@noodle-borg/transport-http';
+import { type ActiveDeployProvenance } from './registry-helpers.js';
+import type { AccessUpdateOptions, AccessUpdateResult, DeployOptions, DeployPreflightResult, RecoverResult, RunDeployResult, ServerRegistryOptions } from './registry-types.js';
 import { type AppArchiveResult, type AppRestoreResult, type AppSummary, type ArtifactStore, type ConfigStore, type CustomerAuthRestoreProjection, type DeploymentListFilter, type DeploymentLock, type DeploymentLockUpdateResult, type DeploymentStatus, type DeploymentSummary, type DeployRecord, type EnvSummary, type ProductionEnvironmentChange, type TenantRef } from './store.js';
+export type { RollbackResult } from '@noodle-borg/control-plane/portable';
 export type { DeploymentPackage } from './registry-package.js';
-export type { AccessUpdateFailureCode, AccessUpdateResult, DeployError, DeployOptions, DeployPreflightResult, DeployResult, RecoverResult, RollbackResult, ServerRegistryOptions, } from './registry-types.js';
+export type { AccessUpdateFailureCode, AccessUpdateOptions, AccessUpdateResult, DeployError, DeployOptions, DeployPreflightResult, DeployResult, RecoverResult, ServerRegistryOptions, } from './registry-types.js';
 export declare class ServerRegistry {
     #private;
     constructor(store?: ArtifactStore, _secretBox?: SecretBox, configStore?: ConfigStore, options?: ServerRegistryOptions);
@@ -54,7 +57,7 @@ export declare class ServerRegistry {
     reconcilePlatformAccountReset(input: PlatformIdentityRecoveryPlan): void;
     customerAuthRestoreProjections(deploymentIds: readonly string[]): Promise<readonly CustomerAuthRestoreProjection[]>;
     getStatus(ref: TenantRef, baseUrl: string, serverVersion?: string, endpointOptions?: EndpointUrlOptions): Promise<DeploymentStatus | undefined>;
-    updateAccess(ref: TenantRef, accessMode: AccessMode, serverVersion?: string): Promise<AccessUpdateResult>;
+    updateAccess(ref: TenantRef, options: AccessUpdateOptions): Promise<AccessUpdateResult>;
     setDeploymentLock(ref: TenantRef, serverVersion: string, expectedDeploymentId: string, deploymentLock: DeploymentLock | undefined): Promise<DeploymentLockUpdateResult>;
     rollback(ref: TenantRef, deploymentId: string): Promise<RollbackResult>;
     get configStore(): ConfigStore;

package/node_modules/@noodle-borg/service/dist/registry.js

@@ -7,7 +7,7 @@ import { defaultActiveRecord } from './deployment-versioning.js';
 import { updateRegistryAccess } from './registry-access.js';
 import { compileRegistryTarget } from './registry-compile.js';
 import { preflightRegistryDeploy, resolveDeployAttempt } from './registry-deploy-transaction.js';
-import { missingCapabilityErrors, } from './registry-helpers.js';
+import { deploymentOwnerSubject, missingCapabilityErrors, } from './registry-helpers.js';
 import { registryDeploymentPackage, renderDeploymentPackageSnapshot } from './registry-package.js';
 import { recoverRegistryRecords } from './registry-recover.js';
 import { rollbackDeployment, rollbackWithMappedErrors } from './registry-rollback.js';
@@ -130,6 +130,7 @@ export class ServerRegistry {
         const version = Date.now();
         const built = preflight.bindDeployment(deploymentId);
         const serverAuth = built.artifact.server.auth;
+        const ownerSubject = accessMode === 'owner-only' ? (options.ownerSubject ?? actor?.subject) : undefined;
         const record = {
             schemaVersion: 1,
             deploymentId,
@@ -142,6 +143,7 @@ export class ServerRegistry {
             serverName: built.artifact.server.name,
             createdAt: new Date().toISOString(),
             ...(actor ? { createdBySubject: actor.subject, createdByEmail: actor.email } : {}),
+            ...(ownerSubject !== undefined ? { ownerSubject } : {}),
             ...(deploymentSource !== undefined ? { deploymentSource } : {}),
             ...(accessMode !== undefined ? { accessMode } : {}),
             ...(orgMembershipSources !== undefined ? { orgMembershipSources } : {}),
@@ -219,12 +221,14 @@ export class ServerRegistry {
         this.#servers.set(deploymentId, servedTargetFor(active, built, this.#customerVerifierFactory));
         this.#activeTenants.set(tenantDeploymentKey(safeTenant, safeServerVersion), deploymentId);
         this.#activeTenants.delete(tenantKey(safeTenant));
+        const activeOwnerSubject = deploymentOwnerSubject(active);
         return {
             ok: true,
             deploymentId,
             deploymentVersion: version,
             ...(safeServerVersion !== undefined ? { serverVersion: safeServerVersion } : {}),
             ...(accessMode !== undefined ? { accessMode } : {}),
+            ...(activeOwnerSubject !== undefined ? { ownerSubject: activeOwnerSubject } : {}),
         };
     }
     /** Read-only deploy validation used by the CLI before config writes, asset upload, or persistence. */
@@ -338,8 +342,7 @@ export class ServerRegistry {
         return {
             accessMode: record.accessMode,
             orgMembershipSources: record.orgMembershipSources,
-            ownerSubject: record.createdBySubject,
-            ownerEmail: record.createdByEmail,
+            ownerSubject: deploymentOwnerSubject(record),
         };
     }
     async getActiveByTenantVersion(ref, serverVersion) {
@@ -415,9 +418,9 @@ export class ServerRegistry {
         const built = await this.#compilePersistedRecord(record);
         return deploymentStatusFor(safe, record, built, baseUrl, endpointOptions);
     }
-    async updateAccess(ref, accessMode, serverVersion) {
+    async updateAccess(ref, options) {
         const safe = validateTenantRef(ref);
-        return updateRegistryAccess(this.#stateView(), safe, accessMode, serverVersion, (deploymentId) => this.get(deploymentId), this.#customerVerifierFactory, (record, auth) => this.#hasCustomerAuthAudienceConflict(record, auth));
+        return updateRegistryAccess(this.#stateView(), safe, options, (deploymentId) => this.get(deploymentId), this.#customerVerifierFactory, (record, auth) => this.#hasCustomerAuthAudienceConflict(record, auth));
     }
     async setDeploymentLock(ref, serverVersion, expectedDeploymentId, deploymentLock) {
         return setRegistryDeploymentLock(this.#stateView(), validateTenantRef(ref), serverVersion, expectedDeploymentId, deploymentLock);