@noodleseed/one 0.136.0 → 0.138.0

package/node_modules/@noodle-borg/service/dist/routes/control-plane.js

@@ -8,11 +8,12 @@ import { baseFromRequest, readDeployBody, sendForbidden, sendJson, sendUnauthori
 import { endpointUrlOptionsForOrg } from '../mcp-public-routing.js';
 import { ensurePersonalWorkspace } from '../personal-workspace.js';
 import { manifestUsesUserRoot } from '../registry-access.js';
-import { tenantMcpUrl } from '../registry-helpers.js';
 import { isIdentityAccessMode } from './access-mode.js';
 import { validateDeployIdempotency } from './deploy-idempotency.js';
 import { provisionPublicEmbed } from './deploy-public-embed.js';
 import { respondDeploymentActivationError } from './deployment-activation-response.js';
+import { tenantMcpUrl } from './endpoint-enrichment.js';
+import { canManageMembers } from './org-admin.js';
 export { handleConfigValues } from './config-values.js';
 export async function handleDeploy(req, res, registry, options, maxBody, tenant, gate, controlPlane, audit) {
     // GHD-3: a GitHub run deploys with a run-scoped token on x-noodle-run-token — NOT a control-plane
@@ -66,6 +67,7 @@ export async function handleDeploy(req, res, registry, options, maxBody, tenant,
     let declaredAccessMode;
     let orgMembershipSources;
     let deploymentSource;
+    let requestedOwnerSubject, ownerSubject;
     let serverVersion;
     try {
         const raw = JSON.parse(body.text);
@@ -88,6 +90,7 @@ export async function handleDeploy(req, res, registry, options, maxBody, tenant,
         orgMembershipSources = parsed.data.orgMembershipSources;
         hostedAssets = parsed.data.hostedAssets;
         deploymentSource = parsed.data.deploymentSource;
+        requestedOwnerSubject = parsed.data.ownerSubject;
         serverVersion =
             parsed.data.serverVersion === undefined
                 ? '1'
@@ -96,6 +99,18 @@ export async function handleDeploy(req, res, registry, options, maxBody, tenant,
     catch (error) {
         return sendJson(res, 400, { error: `invalid deploy request: ${error.message}` });
     }
+    if (isRunDeploy && requestedOwnerSubject !== undefined) {
+        return sendJson(res, 400, {
+            error: 'automated deploys cannot select an explicit deployment owner',
+            code: 'owner_subject_not_allowed_for_automation',
+        });
+    }
+    if (!isRunDeploy) {
+        const selection = await authorizeDeploymentOwnerSelection(res, controlPlane, tenant.org, accessMode, identity, requestedOwnerSubject);
+        if (!selection.ok)
+            return;
+        ownerSubject = selection.ownerSubject;
+    }
     // GHD-3 trusted-phase auth (ADR 0132 Decision 3/4): a run deploy is authorized entirely by its
     // run token plus the access mode resolved here — the control-plane identity was skipped above.
     // Every rejection carries a machine-readable `code` so `noodle github runs <id>` can name the
@@ -119,9 +134,6 @@ export async function handleDeploy(req, res, registry, options, maxBody, tenant,
             ...(provenance?.ownerSubject === undefined
                 ? {}
                 : { previousOwnerSubject: provenance.ownerSubject }),
-            ...(provenance?.ownerEmail === undefined
-                ? {}
-                : { previousOwnerEmail: provenance.ownerEmail }),
         });
         if (automation.kind === 'denied') {
             return sendJson(res, automation.status, {
@@ -145,6 +157,7 @@ export async function handleDeploy(req, res, registry, options, maxBody, tenant,
             accessMode = automation.accessMode;
             orgMembershipSources ??= provenance?.orgMembershipSources;
             identity = automation.actor;
+            ownerSubject = automation.ownerSubject;
             automationId = automation.automationId;
         }
         else {
@@ -154,6 +167,12 @@ export async function handleDeploy(req, res, registry, options, maxBody, tenant,
             });
         }
     }
+    if (isRunDeploy && accessMode === 'owner-only' && ownerSubject === undefined) {
+        return sendJson(res, 400, {
+            error: 'owner-only automation requires an existing human owner to preserve',
+            code: 'owner_only_unsupported_for_automation',
+        });
+    }
     // Identity access modes bind the data plane to verified identity, so the deployer must be authenticated.
     // (Localhost dev runs the gate open; such deploys are rejected for lack of an owner/audit actor.)
     if (isIdentityAccessMode(accessMode) && !identity) {
@@ -238,6 +257,7 @@ export async function handleDeploy(req, res, registry, options, maxBody, tenant,
             connectors,
             actor: identity || undefined,
             accessMode,
+            ownerSubject,
             ...(orgMembershipSources !== undefined ? { orgMembershipSources } : {}),
             hostedAssets,
             serverVersion,
@@ -339,6 +359,7 @@ export async function handleDeploy(req, res, registry, options, maxBody, tenant,
         ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
         details: {
             accessMode: result.accessMode ?? accessMode,
+            ...(ownerSubject !== undefined ? { ownerSubject } : {}),
             serverVersion: result.serverVersion,
             hasConnectors: connectors !== undefined,
         },
@@ -388,6 +409,7 @@ export async function handleDeploy(req, res, registry, options, maxBody, tenant,
         deploymentId: result.deploymentId,
         serverVersion: result.serverVersion,
         accessMode: result.accessMode,
+        ...(result.ownerSubject !== undefined ? { ownerSubject: result.ownerSubject } : {}),
         url: tenantMcpUrl(base, tenant, result.serverVersion, endpointOptions),
         defaultUrl: tenantMcpUrl(base, tenant, undefined, endpointOptions),
         ...(embedId !== undefined ? { embedId } : {}),
@@ -398,6 +420,29 @@ function normalizeParsedServerVersion(value) {
         throw new Error('"serverVersion" must be a version string');
     return normalizeServerVersion(value);
 }
+export async function authorizeDeploymentOwnerSelection(res, controlPlane, org, accessMode, identity, requestedOwnerSubject) {
+    if (accessMode !== 'owner-only')
+        return { ok: true };
+    if (identity === undefined) {
+        sendJson(res, 401, {
+            error: 'owner-only deployments require an authenticated deployer',
+            code: 'deployer_identity_required',
+        });
+        return { ok: false };
+    }
+    if (requestedOwnerSubject === undefined || requestedOwnerSubject === identity.subject) {
+        return { ok: true, ownerSubject: identity.subject };
+    }
+    if (identity.developerGrantId !== undefined ||
+        !(await canManageMembers(controlPlane, org, identity))) {
+        sendJson(res, 403, {
+            error: 'Selecting a different deployment owner requires organization owner access.',
+            code: 'deployment_owner_authorization_required',
+        });
+        return { ok: false };
+    }
+    return { ok: true, ownerSubject: requestedOwnerSubject };
+}
 export async function handleWhoami(req, res, gate, controlPlane, options = {}) {
     // Identity introspection names no org or environment, so no grant context can describe it.
     const identity = await authorizeControlPlane(req, res, gate, {

package/node_modules/@noodle-borg/service/dist/routes/deploy-preflight.js

@@ -3,7 +3,7 @@ import { deployPreflightRequestSchema, formatWireError } from '@noodle-borg/wire
 import { readDeployBody, sendJson } from '../http-util.js';
 import { manifestUsesUserRoot } from '../registry-access.js';
 import { isIdentityAccessMode } from './access-mode.js';
-import { authorizeTenantControl, developerGrantRouteAccess } from './control-plane.js';
+import { authorizeDeploymentOwnerSelection, authorizeTenantControl, developerGrantRouteAccess, } from './control-plane.js';
 /**
  * Read-only first-deploy readiness. It intentionally does not verify uploaded asset bytes:
  * the CLI calls this before it requests upload targets or sends any bytes.
@@ -49,6 +49,9 @@ export async function handleDeployPreflight(req, res, registry, options, maxBody
             error: `${accessMode} deployments require an authenticated deployer`,
         });
     }
+    const ownerSelection = await authorizeDeploymentOwnerSelection(res, controlPlane, tenant.org, accessMode, identity, parsed.ownerSubject);
+    if (!ownerSelection.ok)
+        return;
     if (accessMode === 'public' && manifestUsesUserRoot(parsed.manifest)) {
         return sendJson(res, 400, {
             code: 'public_user_context_conflict',
@@ -71,6 +74,7 @@ export async function handleDeployPreflight(req, res, registry, options, maxBody
             ...(parsed.connectors !== undefined ? { connectors: parsed.connectors } : {}),
             actor: identity,
             accessMode,
+            ownerSubject: ownerSelection.ownerSubject,
             ...(parsed.orgMembershipSources !== undefined
                 ? { orgMembershipSources: parsed.orgMembershipSources }
                 : {}),
@@ -99,6 +103,9 @@ export async function handleDeployPreflight(req, res, registry, options, maxBody
             ready,
             appState,
             environmentState,
+            ...(ownerSelection.ownerSubject !== undefined
+                ? { ownerSubject: ownerSelection.ownerSubject }
+                : {}),
             errorCount: errors.length,
             codes,
             missingSecretCount: missingSecrets.length,
@@ -108,6 +115,9 @@ export async function handleDeployPreflight(req, res, registry, options, maxBody
     return sendJson(res, 200, {
         ok: true,
         ready,
+        ...(ownerSelection.ownerSubject !== undefined
+            ? { ownerSubject: ownerSelection.ownerSubject }
+            : {}),
         target: {
             ...tenant,
             appState,

package/node_modules/@noodle-borg/service/dist/routes/endpoint-enrichment.js

@@ -1,4 +1,5 @@
-import { tenantMcpUrl } from '../registry-helpers.js';
+import { tenantMcpUrl } from '@noodle-borg/module';
+export { tenantMcpUrl };
 /** Stamp `endpointUrl` onto one deployment summary. */
 export function withEndpointUrl(summary, base, options = {}) {
     return {

package/node_modules/@noodle-borg/service/dist/routes/paths.js

@@ -204,6 +204,10 @@ export function parseTenantSessionPath(pathname) {
         sessionId: decodeSegment(match, 4),
     }));
 }
+/** `GET .../assistant/usage` — scalar-only embedded assistant engagement and model usage. */
+export function parseTenantAssistantUsagePath(pathname) {
+    return matchPath(pathname, /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/envs\/([^/]+)\/assistant\/usage$/, tenantRef);
+}
 /** Match `/v1/orgs/{org}/apps/{app}/github/connection` (GHD-1 repository connection, GET/POST/DELETE). */
 export function parseGithubConnectionPath(pathname) {
     return matchPath(pathname, /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/github\/connection$/, appRef);

package/node_modules/@noodle-borg/service/dist/routes/rollback.js

@@ -1,6 +1,6 @@
+import { rollbackDeploymentOperation } from '@noodle-borg/control-plane/portable';
 import { baseFromRequest, readJsonBody, sendForbidden, sendJson } from '../http-util.js';
 import { endpointUrlOptionsForOrg } from '../mcp-public-routing.js';
-import { rollbackDeploymentOperation } from '../operations/rollback-deployment.js';
 import { authorizeTenantControl, developerGrantRouteAccess } from './control-plane.js';
 export async function handleRollback(req, res, registry, gate, controlPlane, audit, maxBody, tenant, options) {
     const identity = await authorizeTenantControl(req, res, gate, controlPlane, tenant.org, developerGrantRouteAccess(options.developerGrantStore, 'deployments:rollback'));

package/node_modules/@noodle-borg/service/dist/service.js

@@ -253,6 +253,12 @@ export function createServiceHandler(registry, options = {}) {
             ...(options.assistantModelFetch !== undefined
                 ? { modelFetch: options.assistantModelFetch }
                 : {}),
+            ...(options.managedAssistantModelResolver !== undefined
+                ? { managedModelResolver: options.managedAssistantModelResolver }
+                : {}),
+            ...(options.captureRequestEvent !== undefined
+                ? { captureRequestEvent: options.captureRequestEvent }
+                : {}),
             ...(options.clock !== undefined ? { clock: options.clock } : {}),
             logger,
             applySecurityHeaders,

package/node_modules/@noodle-borg/service/dist/store/in-memory.d.ts

@@ -1,5 +1,5 @@
 import type { AccessMode } from '@noodle-borg/transport-http';
-import type { AppArchiveResult, AppRestorePrecondition, AppRestoreResult, AppSummary, ArtifactStore, DeploymentActivationResult, DeploymentListFilter, DeploymentLock, DeploymentLockUpdateResult, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from '../store.js';
+import type { ActiveAccessUpdateInput, AppArchiveResult, AppRestorePrecondition, AppRestoreResult, AppSummary, ArtifactStore, DeploymentActivationResult, DeploymentListFilter, DeploymentLock, DeploymentLockUpdateResult, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from '../store.js';
 /** In-memory store: keeps records in a Map. Used by tests and as an explicit, non-persistent option. */
 export declare class InMemoryArtifactStore implements ArtifactStore {
     #private;
@@ -16,10 +16,7 @@ export declare class InMemoryArtifactStore implements ArtifactStore {
     }, _options?: {
         readonly automationId?: string;
     }): Promise<DeploymentActivationResult | undefined>;
-    updateActiveAccess(ref: TenantRef, deploymentId: string, accessMode: AccessMode, precondition: {
-        readonly expectedAccessMode: AccessMode | undefined;
-        readonly serverAuth?: TenantAuthConfig;
-    }): Promise<DeployRecord | undefined>;
+    updateActiveAccess(ref: TenantRef, deploymentId: string, input: ActiveAccessUpdateInput): Promise<DeployRecord | undefined>;
     listDeployments(filter: DeploymentListFilter): Promise<readonly DeploymentSummary[]>;
     getAppArchivedAt(org: string, app: string): Promise<string | undefined>;
     archiveApp(org: string, app: string, at: string): Promise<AppArchiveResult | undefined>;

package/node_modules/@noodle-borg/service/dist/store/in-memory.js

@@ -3,7 +3,7 @@ import { assertSameAppPackageSnapshot, sanitizeDeployRecordAppPackageSnapshot, }
 import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, } from '../customer-auth-audience-binding.js';
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from '../deployment-lock.js';
 import { defaultActiveRecord, sameDeploymentScope, sameTenantRecord, } from '../deployment-versioning.js';
-import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
+import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
 import { validateSlug, validateTenantRef } from './validate.js';
 /** In-memory store: keeps records in a Map. Used by tests and as an explicit, non-persistent option. */
 export class InMemoryArtifactStore {
@@ -14,6 +14,8 @@ export class InMemoryArtifactStore {
         if (existing !== undefined)
             assertSameAppPackageSnapshot(existing, record);
         record = sanitizeDeployRecordAppPackageSnapshot(record);
+        if (existing !== undefined)
+            record = preserveDeploymentOwnerState(existing, record);
         validateTenantRef({ org: record.orgSlug, app: record.appSlug, env: record.environment });
         if (!assertDeploymentAppendUnlocked([...this.#records.values()], record))
             return;
@@ -117,29 +119,15 @@ export class InMemoryArtifactStore {
             }
         }
     }
-    async updateActiveAccess(ref, deploymentId, accessMode, precondition) {
+    async updateActiveAccess(ref, deploymentId, input) {
         const safe = validateTenantRef(ref);
         const record = this.#records.get(deploymentId);
-        if (record === undefined ||
-            !record.active ||
-            record.archivedAt !== undefined ||
-            !sameTenantRecord(record, safe) ||
-            record.accessMode !== precondition.expectedAccessMode) {
-            return Promise.resolve(undefined);
-        }
-        if ((record.accessMode ?? 'owner-only') === accessMode && accessMode !== 'customers') {
-            return Promise.resolve(record);
-        }
-        const updated = {
-            ...record,
-            accessMode,
-            ...(accessMode === 'customers' && precondition.serverAuth !== undefined
-                ? { serverAuth: precondition.serverAuth }
-                : {}),
-        };
-        const proposed = new Map(this.#records).set(record.deploymentId, updated);
+        const updated = resolveActiveAccessUpdate(record, safe, input);
+        if (updated === undefined || updated === record)
+            return Promise.resolve(updated);
+        const proposed = new Map(this.#records).set(updated.deploymentId, updated);
         assertUniqueActiveCustomerAuthAudienceBindings([...proposed.values()]);
-        this.#records.set(record.deploymentId, updated);
+        this.#records.set(updated.deploymentId, updated);
         return Promise.resolve(updated);
     }
     listDeployments(filter) {

package/node_modules/@noodle-borg/service/dist/store/json-file.d.ts

@@ -1,5 +1,5 @@
 import type { AccessMode } from '@noodle-borg/transport-http';
-import type { AppArchiveResult, AppRestorePrecondition, AppRestoreResult, AppSummary, ArtifactStore, DeploymentActivationResult, DeploymentListFilter, DeploymentLock, DeploymentLockUpdateResult, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from '../store.js';
+import type { ActiveAccessUpdateInput, AppArchiveResult, AppRestorePrecondition, AppRestoreResult, AppSummary, ArtifactStore, DeploymentActivationResult, DeploymentListFilter, DeploymentLock, DeploymentLockUpdateResult, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from '../store.js';
 /**
  * JSON-file store: one file per deployment at `<dataDir>/deployments/<deploymentId>.json`, written atomically
  * (write a temp file, then `rename` over the target — no partial file is ever read). `deploymentId` is a
@@ -15,10 +15,7 @@ export declare class JsonFileArtifactStore implements ArtifactStore {
     getActiveByTenantVersion(ref: TenantRef, serverVersion: string): Promise<DeployRecord | undefined>;
     setDeploymentLock(ref: TenantRef, serverVersion: string, expectedDeploymentId: string, deploymentLock: DeploymentLock | undefined): Promise<DeploymentLockUpdateResult>;
     findActiveCustomerAuthAudienceConflict(ref: TenantRef, auth: TenantAuthConfig): Promise<TenantRef | undefined>;
-    updateActiveAccess(ref: TenantRef, deploymentId: string, accessMode: AccessMode, precondition: {
-        readonly expectedAccessMode: AccessMode | undefined;
-        readonly serverAuth?: TenantAuthConfig;
-    }): Promise<DeployRecord | undefined>;
+    updateActiveAccess(ref: TenantRef, deploymentId: string, input: ActiveAccessUpdateInput): Promise<DeployRecord | undefined>;
     activateDeployment(ref: TenantRef, deploymentId: string, precondition?: {
         readonly expectedAccessMode: AccessMode | undefined;
         readonly serverAuth?: TenantAuthConfig;

package/node_modules/@noodle-borg/service/dist/store/json-file.js

@@ -6,7 +6,7 @@ import { assertSameAppPackageSnapshot, sanitizeDeployRecordAppPackageSnapshot, }
 import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, } from '../customer-auth-audience-binding.js';
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from '../deployment-lock.js';
 import { defaultActiveRecord, sameDeploymentScope, sameTenantRecord, } from '../deployment-versioning.js';
-import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
+import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
 import { DEPLOYMENT_ID_PATTERN, validateSlug, validateTenantRef } from './validate.js';
 /**
  * JSON-file store: one file per deployment at `<dataDir>/deployments/<deploymentId>.json`, written atomically
@@ -38,6 +38,8 @@ export class JsonFileArtifactStore {
         if (existing !== undefined)
             assertSameAppPackageSnapshot(existing, record);
         record = sanitizeDeployRecordAppPackageSnapshot(record);
+        if (existing !== undefined)
+            record = preserveDeploymentOwnerState(existing, record);
         if (!assertDeploymentAppendUnlocked(records, record))
             return;
         const proposed = new Map(records.map((item) => [item.deploymentId, item]));
@@ -104,28 +106,14 @@ export class JsonFileArtifactStore {
     async findActiveCustomerAuthAudienceConflict(ref, auth) {
         return findActiveCustomerAuthAudienceConflict(await this.loadAll(), validateTenantRef(ref), auth);
     }
-    async updateActiveAccess(ref, deploymentId, accessMode, precondition) {
+    async updateActiveAccess(ref, deploymentId, input) {
         const safe = validateTenantRef(ref);
         return this.#serializeLifecycle(async () => {
             const record = await this.get(deploymentId);
-            if (record === undefined ||
-                !record.active ||
-                record.archivedAt !== undefined ||
-                !sameTenantRecord(record, safe) ||
-                record.accessMode !== precondition.expectedAccessMode) {
-                return undefined;
-            }
-            if ((record.accessMode ?? 'owner-only') === accessMode && accessMode !== 'customers') {
-                return record;
-            }
-            const updated = {
-                ...record,
-                accessMode,
-                ...(accessMode === 'customers' && precondition.serverAuth !== undefined
-                    ? { serverAuth: precondition.serverAuth }
-                    : {}),
-            };
-            const proposed = new Map((await this.loadAll()).map((item) => [item.deploymentId, item])).set(record.deploymentId, updated);
+            const updated = resolveActiveAccessUpdate(record, safe, input);
+            if (updated === undefined || updated === record)
+                return updated;
+            const proposed = new Map((await this.loadAll()).map((item) => [item.deploymentId, item])).set(updated.deploymentId, updated);
             assertUniqueActiveCustomerAuthAudienceBindings([...proposed.values()]);
             await this.#writeRecord(updated);
             return updated;

package/node_modules/@noodle-borg/service/dist/store/records.js

@@ -1,6 +1,16 @@
+/**
+ * Pure record-level helpers shared by every {@link ArtifactStore} backend: the canonical
+ * deployment-summary mapping, list filtering, app archive/restore planning (ADR 0117), and the
+ * `apps` resource aggregation (`summarizeApps`). No I/O here — backends apply the plans to their
+ * own persistence and feed their own raw records/anchors through these pure functions so every
+ * backend groups, ranks, and sorts identically.
+ */
+import { sameTenantRecord } from '../deployment-versioning.js';
+import { deploymentOwnerSubject } from '../registry-helpers.js';
 import { validateSlug } from './validate.js';
 /** The canonical, secret-free list projection of a {@link DeployRecord}. */
 export function deploymentSummary(record) {
+    const ownerSubject = deploymentOwnerSubject(record);
     return {
         deploymentId: record.deploymentId,
         orgSlug: record.orgSlug,
@@ -11,6 +21,7 @@ export function deploymentSummary(record) {
         serverName: record.serverName,
         createdAt: record.createdAt,
         ...(record.createdByEmail !== undefined ? { createdByEmail: record.createdByEmail } : {}),
+        ...(ownerSubject !== undefined ? { ownerSubject } : {}),
         ...(record.deploymentSource !== undefined ? { deploymentSource: record.deploymentSource } : {}),
         accessMode: record.accessMode ?? 'owner-only',
         ...(record.deploymentLock !== undefined
@@ -95,6 +106,34 @@ export function withoutArchiveStamp(record) {
     const { archivedAt: _cleared, ...rest } = record;
     return rest;
 }
+export function preserveDeploymentOwnerState(existing, candidate) {
+    const { ownerSubject: _candidateOwnerSubject, ...deployFields } = candidate;
+    return {
+        ...deployFields,
+        ...(existing.ownerSubject !== undefined ? { ownerSubject: existing.ownerSubject } : {}),
+    };
+}
+export function resolveActiveAccessUpdate(record, ref, input) {
+    if (record === undefined ||
+        !record.active ||
+        record.archivedAt !== undefined ||
+        !sameTenantRecord(record, ref) ||
+        record.accessMode !== input.expectedAccessMode ||
+        deploymentOwnerSubject(record) !== input.expectedOwnerSubject)
+        return undefined;
+    if ((record.accessMode ?? 'owner-only') === input.accessMode &&
+        (input.ownerSubject === undefined || deploymentOwnerSubject(record) === input.ownerSubject) &&
+        input.accessMode !== 'customers')
+        return record;
+    return {
+        ...record,
+        accessMode: input.accessMode,
+        ...(input.ownerSubject !== undefined ? { ownerSubject: input.ownerSubject } : {}),
+        ...(input.accessMode === 'customers' && input.serverAuth !== undefined
+            ? { serverAuth: input.serverAuth }
+            : {}),
+    };
+}
 const ENVIRONMENT_RANK = { prod: 0, staging: 1, dev: 2 };
 function environmentRank(environment) {
     return ENVIRONMENT_RANK[environment] ?? 3;

package/node_modules/@noodle-borg/service/dist/store.d.ts

@@ -47,6 +47,8 @@ export interface DeployRecord {
     readonly createdAt: string;
     readonly createdBySubject?: string;
     readonly createdByEmail?: string;
+    /** OAuth subject authorized by owner-only access; absent legacy records fall back to the creator. */
+    readonly ownerSubject?: string;
     /** Informational deploy origin. Absent on records written before source tracking. */
     readonly deploymentSource?: DeploymentSource;
     /**
@@ -142,6 +144,7 @@ export interface DeploymentSummary {
     readonly serverName: string;
     readonly createdAt: string;
     readonly createdByEmail?: string;
+    readonly ownerSubject?: string;
     readonly deploymentSource?: DeploymentSource;
     readonly accessMode: AccessMode;
     readonly deploymentLock?: DeploymentLockMetadata;
@@ -236,6 +239,7 @@ export interface DeploymentStatus {
         readonly serverName: string;
         readonly createdAt: string;
         readonly createdByEmail?: string;
+        readonly ownerSubject?: string;
         readonly accessMode: AccessMode;
         readonly deploymentLock?: DeploymentLockMetadata;
     };
@@ -252,6 +256,16 @@ export interface DeploymentActivationResult {
     readonly previousActive?: DeployRecord;
     readonly alreadyActive: boolean;
 }
+/** One atomic access/owner compare-and-set over the active deployment's observed state. */
+export interface ActiveAccessUpdateInput {
+    readonly accessMode: AccessMode;
+    /** Desired owner mutation. Omission preserves the current effective owner; clearing is unsupported. */
+    readonly ownerSubject?: string;
+    readonly expectedAccessMode: AccessMode | undefined;
+    readonly expectedOwnerSubject: string | undefined;
+    /** Compiler-authoritative projection persisted atomically when enabling customer access. */
+    readonly serverAuth?: TenantAuthConfig;
+}
 export type DeploymentLockUpdateResult = {
     readonly ok: true;
     readonly record: DeployRecord;
@@ -263,9 +277,10 @@ export type DeploymentLockUpdateResult = {
 export interface ControlPlaneStore extends OrganizationStore {
 }
 /**
- * Durable storage for deployed-server records. `append` writes (or replaces) one server's record;
- * `loadAll` returns every current record for restart recovery. Historical records are retained so a
- * tenant environment can reactivate an earlier deployment without changing the tenant-facing URL.
+ * Durable storage for deployed-server records. `append` writes (or replaces) one server's immutable deploy
+ * inputs while preserving owner state changed through {@link updateActiveAccess}; `loadAll` returns every
+ * current record for restart recovery. Historical records are retained so a tenant environment can reactivate
+ * an earlier deployment without changing the tenant-facing URL.
  */
 export interface ArtifactStore {
     append(record: DeployRecord): Promise<void>;
@@ -294,14 +309,10 @@ export interface ArtifactStore {
         readonly automationId?: string;
     }): Promise<DeploymentActivationResult | undefined>;
     /**
-     * Compare and set the active record's access mode. The precondition is the raw persisted value:
-     * legacy `undefined` remains distinguishable from an explicitly stored `owner-only`.
+     * Compare and set the active record's access mode and effective owner. The access precondition is the raw
+     * persisted value; the owner precondition resolves legacy records through creator provenance.
      */
-    updateActiveAccess(ref: TenantRef, deploymentId: string, accessMode: AccessMode, precondition: {
-        readonly expectedAccessMode: AccessMode | undefined;
-        /** Compiler-authoritative projection persisted atomically when enabling customer access. */
-        readonly serverAuth?: TenantAuthConfig;
-    }): Promise<DeployRecord | undefined>;
+    updateActiveAccess(ref: TenantRef, deploymentId: string, input: ActiveAccessUpdateInput): Promise<DeployRecord | undefined>;
     listDeployments(filter: DeploymentListFilter): Promise<readonly DeploymentSummary[]>;
     /**
      * App soft delete (ADR 0117). `getAppArchivedAt` reports the app's archived stamp (defined iff the

package/node_modules/@noodle-borg/service/package.json

@@ -20,6 +20,10 @@
     "./main": {
       "types": "./dist/main.d.ts",
       "import": "./dist/main.js"
+    },
+    "./oauth-google": {
+      "types": "./dist/oauth/google.d.ts",
+      "import": "./dist/oauth/google.js"
     }
   },
   "bin": {
@@ -35,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.81.0",
+    "@noodle-borg/agent-kit": "0.82.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",