@noodleseed/one 0.137.0 → 0.138.0

package/node_modules/@noodle-borg/service/dist/routes/deploy-preflight.js

@@ -3,7 +3,7 @@ import { deployPreflightRequestSchema, formatWireError } from '@noodle-borg/wire
 import { readDeployBody, sendJson } from '../http-util.js';
 import { manifestUsesUserRoot } from '../registry-access.js';
 import { isIdentityAccessMode } from './access-mode.js';
-import { authorizeTenantControl, developerGrantRouteAccess } from './control-plane.js';
+import { authorizeDeploymentOwnerSelection, authorizeTenantControl, developerGrantRouteAccess, } from './control-plane.js';
 /**
  * Read-only first-deploy readiness. It intentionally does not verify uploaded asset bytes:
  * the CLI calls this before it requests upload targets or sends any bytes.
@@ -49,6 +49,9 @@ export async function handleDeployPreflight(req, res, registry, options, maxBody
             error: `${accessMode} deployments require an authenticated deployer`,
         });
     }
+    const ownerSelection = await authorizeDeploymentOwnerSelection(res, controlPlane, tenant.org, accessMode, identity, parsed.ownerSubject);
+    if (!ownerSelection.ok)
+        return;
     if (accessMode === 'public' && manifestUsesUserRoot(parsed.manifest)) {
         return sendJson(res, 400, {
             code: 'public_user_context_conflict',
@@ -71,6 +74,7 @@ export async function handleDeployPreflight(req, res, registry, options, maxBody
             ...(parsed.connectors !== undefined ? { connectors: parsed.connectors } : {}),
             actor: identity,
             accessMode,
+            ownerSubject: ownerSelection.ownerSubject,
             ...(parsed.orgMembershipSources !== undefined
                 ? { orgMembershipSources: parsed.orgMembershipSources }
                 : {}),
@@ -99,6 +103,9 @@ export async function handleDeployPreflight(req, res, registry, options, maxBody
             ready,
             appState,
             environmentState,
+            ...(ownerSelection.ownerSubject !== undefined
+                ? { ownerSubject: ownerSelection.ownerSubject }
+                : {}),
             errorCount: errors.length,
             codes,
             missingSecretCount: missingSecrets.length,
@@ -108,6 +115,9 @@ export async function handleDeployPreflight(req, res, registry, options, maxBody
     return sendJson(res, 200, {
         ok: true,
         ready,
+        ...(ownerSelection.ownerSubject !== undefined
+            ? { ownerSubject: ownerSelection.ownerSubject }
+            : {}),
         target: {
             ...tenant,
             appState,

package/node_modules/@noodle-borg/service/dist/routes/endpoint-enrichment.js

@@ -1,4 +1,5 @@
-import { tenantMcpUrl } from '../registry-helpers.js';
+import { tenantMcpUrl } from '@noodle-borg/module';
+export { tenantMcpUrl };
 /** Stamp `endpointUrl` onto one deployment summary. */
 export function withEndpointUrl(summary, base, options = {}) {
     return {

package/node_modules/@noodle-borg/service/dist/routes/paths.js

@@ -204,6 +204,10 @@ export function parseTenantSessionPath(pathname) {
         sessionId: decodeSegment(match, 4),
     }));
 }
+/** `GET .../assistant/usage` — scalar-only embedded assistant engagement and model usage. */
+export function parseTenantAssistantUsagePath(pathname) {
+    return matchPath(pathname, /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/envs\/([^/]+)\/assistant\/usage$/, tenantRef);
+}
 /** Match `/v1/orgs/{org}/apps/{app}/github/connection` (GHD-1 repository connection, GET/POST/DELETE). */
 export function parseGithubConnectionPath(pathname) {
     return matchPath(pathname, /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/github\/connection$/, appRef);

package/node_modules/@noodle-borg/service/dist/routes/rollback.js

@@ -1,6 +1,6 @@
+import { rollbackDeploymentOperation } from '@noodle-borg/control-plane/portable';
 import { baseFromRequest, readJsonBody, sendForbidden, sendJson } from '../http-util.js';
 import { endpointUrlOptionsForOrg } from '../mcp-public-routing.js';
-import { rollbackDeploymentOperation } from '../operations/rollback-deployment.js';
 import { authorizeTenantControl, developerGrantRouteAccess } from './control-plane.js';
 export async function handleRollback(req, res, registry, gate, controlPlane, audit, maxBody, tenant, options) {
     const identity = await authorizeTenantControl(req, res, gate, controlPlane, tenant.org, developerGrantRouteAccess(options.developerGrantStore, 'deployments:rollback'));

package/node_modules/@noodle-borg/service/dist/service.js

@@ -253,6 +253,12 @@ export function createServiceHandler(registry, options = {}) {
             ...(options.assistantModelFetch !== undefined
                 ? { modelFetch: options.assistantModelFetch }
                 : {}),
+            ...(options.managedAssistantModelResolver !== undefined
+                ? { managedModelResolver: options.managedAssistantModelResolver }
+                : {}),
+            ...(options.captureRequestEvent !== undefined
+                ? { captureRequestEvent: options.captureRequestEvent }
+                : {}),
             ...(options.clock !== undefined ? { clock: options.clock } : {}),
             logger,
             applySecurityHeaders,

package/node_modules/@noodle-borg/service/dist/store/in-memory.d.ts

@@ -1,5 +1,5 @@
 import type { AccessMode } from '@noodle-borg/transport-http';
-import type { AppArchiveResult, AppRestorePrecondition, AppRestoreResult, AppSummary, ArtifactStore, DeploymentActivationResult, DeploymentListFilter, DeploymentLock, DeploymentLockUpdateResult, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from '../store.js';
+import type { ActiveAccessUpdateInput, AppArchiveResult, AppRestorePrecondition, AppRestoreResult, AppSummary, ArtifactStore, DeploymentActivationResult, DeploymentListFilter, DeploymentLock, DeploymentLockUpdateResult, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from '../store.js';
 /** In-memory store: keeps records in a Map. Used by tests and as an explicit, non-persistent option. */
 export declare class InMemoryArtifactStore implements ArtifactStore {
     #private;
@@ -16,10 +16,7 @@ export declare class InMemoryArtifactStore implements ArtifactStore {
     }, _options?: {
         readonly automationId?: string;
     }): Promise<DeploymentActivationResult | undefined>;
-    updateActiveAccess(ref: TenantRef, deploymentId: string, accessMode: AccessMode, precondition: {
-        readonly expectedAccessMode: AccessMode | undefined;
-        readonly serverAuth?: TenantAuthConfig;
-    }): Promise<DeployRecord | undefined>;
+    updateActiveAccess(ref: TenantRef, deploymentId: string, input: ActiveAccessUpdateInput): Promise<DeployRecord | undefined>;
     listDeployments(filter: DeploymentListFilter): Promise<readonly DeploymentSummary[]>;
     getAppArchivedAt(org: string, app: string): Promise<string | undefined>;
     archiveApp(org: string, app: string, at: string): Promise<AppArchiveResult | undefined>;

package/node_modules/@noodle-borg/service/dist/store/in-memory.js

@@ -3,7 +3,7 @@ import { assertSameAppPackageSnapshot, sanitizeDeployRecordAppPackageSnapshot, }
 import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, } from '../customer-auth-audience-binding.js';
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from '../deployment-lock.js';
 import { defaultActiveRecord, sameDeploymentScope, sameTenantRecord, } from '../deployment-versioning.js';
-import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
+import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
 import { validateSlug, validateTenantRef } from './validate.js';
 /** In-memory store: keeps records in a Map. Used by tests and as an explicit, non-persistent option. */
 export class InMemoryArtifactStore {
@@ -14,6 +14,8 @@ export class InMemoryArtifactStore {
         if (existing !== undefined)
             assertSameAppPackageSnapshot(existing, record);
         record = sanitizeDeployRecordAppPackageSnapshot(record);
+        if (existing !== undefined)
+            record = preserveDeploymentOwnerState(existing, record);
         validateTenantRef({ org: record.orgSlug, app: record.appSlug, env: record.environment });
         if (!assertDeploymentAppendUnlocked([...this.#records.values()], record))
             return;
@@ -117,29 +119,15 @@ export class InMemoryArtifactStore {
             }
         }
     }
-    async updateActiveAccess(ref, deploymentId, accessMode, precondition) {
+    async updateActiveAccess(ref, deploymentId, input) {
         const safe = validateTenantRef(ref);
         const record = this.#records.get(deploymentId);
-        if (record === undefined ||
-            !record.active ||
-            record.archivedAt !== undefined ||
-            !sameTenantRecord(record, safe) ||
-            record.accessMode !== precondition.expectedAccessMode) {
-            return Promise.resolve(undefined);
-        }
-        if ((record.accessMode ?? 'owner-only') === accessMode && accessMode !== 'customers') {
-            return Promise.resolve(record);
-        }
-        const updated = {
-            ...record,
-            accessMode,
-            ...(accessMode === 'customers' && precondition.serverAuth !== undefined
-                ? { serverAuth: precondition.serverAuth }
-                : {}),
-        };
-        const proposed = new Map(this.#records).set(record.deploymentId, updated);
+        const updated = resolveActiveAccessUpdate(record, safe, input);
+        if (updated === undefined || updated === record)
+            return Promise.resolve(updated);
+        const proposed = new Map(this.#records).set(updated.deploymentId, updated);
         assertUniqueActiveCustomerAuthAudienceBindings([...proposed.values()]);
-        this.#records.set(record.deploymentId, updated);
+        this.#records.set(updated.deploymentId, updated);
         return Promise.resolve(updated);
     }
     listDeployments(filter) {

package/node_modules/@noodle-borg/service/dist/store/json-file.d.ts

@@ -1,5 +1,5 @@
 import type { AccessMode } from '@noodle-borg/transport-http';
-import type { AppArchiveResult, AppRestorePrecondition, AppRestoreResult, AppSummary, ArtifactStore, DeploymentActivationResult, DeploymentListFilter, DeploymentLock, DeploymentLockUpdateResult, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from '../store.js';
+import type { ActiveAccessUpdateInput, AppArchiveResult, AppRestorePrecondition, AppRestoreResult, AppSummary, ArtifactStore, DeploymentActivationResult, DeploymentListFilter, DeploymentLock, DeploymentLockUpdateResult, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from '../store.js';
 /**
  * JSON-file store: one file per deployment at `<dataDir>/deployments/<deploymentId>.json`, written atomically
  * (write a temp file, then `rename` over the target — no partial file is ever read). `deploymentId` is a
@@ -15,10 +15,7 @@ export declare class JsonFileArtifactStore implements ArtifactStore {
     getActiveByTenantVersion(ref: TenantRef, serverVersion: string): Promise<DeployRecord | undefined>;
     setDeploymentLock(ref: TenantRef, serverVersion: string, expectedDeploymentId: string, deploymentLock: DeploymentLock | undefined): Promise<DeploymentLockUpdateResult>;
     findActiveCustomerAuthAudienceConflict(ref: TenantRef, auth: TenantAuthConfig): Promise<TenantRef | undefined>;
-    updateActiveAccess(ref: TenantRef, deploymentId: string, accessMode: AccessMode, precondition: {
-        readonly expectedAccessMode: AccessMode | undefined;
-        readonly serverAuth?: TenantAuthConfig;
-    }): Promise<DeployRecord | undefined>;
+    updateActiveAccess(ref: TenantRef, deploymentId: string, input: ActiveAccessUpdateInput): Promise<DeployRecord | undefined>;
     activateDeployment(ref: TenantRef, deploymentId: string, precondition?: {
         readonly expectedAccessMode: AccessMode | undefined;
         readonly serverAuth?: TenantAuthConfig;

package/node_modules/@noodle-borg/service/dist/store/json-file.js

@@ -6,7 +6,7 @@ import { assertSameAppPackageSnapshot, sanitizeDeployRecordAppPackageSnapshot, }
 import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, } from '../customer-auth-audience-binding.js';
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from '../deployment-lock.js';
 import { defaultActiveRecord, sameDeploymentScope, sameTenantRecord, } from '../deployment-versioning.js';
-import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
+import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
 import { DEPLOYMENT_ID_PATTERN, validateSlug, validateTenantRef } from './validate.js';
 /**
  * JSON-file store: one file per deployment at `<dataDir>/deployments/<deploymentId>.json`, written atomically
@@ -38,6 +38,8 @@ export class JsonFileArtifactStore {
         if (existing !== undefined)
             assertSameAppPackageSnapshot(existing, record);
         record = sanitizeDeployRecordAppPackageSnapshot(record);
+        if (existing !== undefined)
+            record = preserveDeploymentOwnerState(existing, record);
         if (!assertDeploymentAppendUnlocked(records, record))
             return;
         const proposed = new Map(records.map((item) => [item.deploymentId, item]));
@@ -104,28 +106,14 @@ export class JsonFileArtifactStore {
     async findActiveCustomerAuthAudienceConflict(ref, auth) {
         return findActiveCustomerAuthAudienceConflict(await this.loadAll(), validateTenantRef(ref), auth);
     }
-    async updateActiveAccess(ref, deploymentId, accessMode, precondition) {
+    async updateActiveAccess(ref, deploymentId, input) {
         const safe = validateTenantRef(ref);
         return this.#serializeLifecycle(async () => {
             const record = await this.get(deploymentId);
-            if (record === undefined ||
-                !record.active ||
-                record.archivedAt !== undefined ||
-                !sameTenantRecord(record, safe) ||
-                record.accessMode !== precondition.expectedAccessMode) {
-                return undefined;
-            }
-            if ((record.accessMode ?? 'owner-only') === accessMode && accessMode !== 'customers') {
-                return record;
-            }
-            const updated = {
-                ...record,
-                accessMode,
-                ...(accessMode === 'customers' && precondition.serverAuth !== undefined
-                    ? { serverAuth: precondition.serverAuth }
-                    : {}),
-            };
-            const proposed = new Map((await this.loadAll()).map((item) => [item.deploymentId, item])).set(record.deploymentId, updated);
+            const updated = resolveActiveAccessUpdate(record, safe, input);
+            if (updated === undefined || updated === record)
+                return updated;
+            const proposed = new Map((await this.loadAll()).map((item) => [item.deploymentId, item])).set(updated.deploymentId, updated);
             assertUniqueActiveCustomerAuthAudienceBindings([...proposed.values()]);
             await this.#writeRecord(updated);
             return updated;

package/node_modules/@noodle-borg/service/dist/store/records.js

@@ -1,6 +1,16 @@
+/**
+ * Pure record-level helpers shared by every {@link ArtifactStore} backend: the canonical
+ * deployment-summary mapping, list filtering, app archive/restore planning (ADR 0117), and the
+ * `apps` resource aggregation (`summarizeApps`). No I/O here — backends apply the plans to their
+ * own persistence and feed their own raw records/anchors through these pure functions so every
+ * backend groups, ranks, and sorts identically.
+ */
+import { sameTenantRecord } from '../deployment-versioning.js';
+import { deploymentOwnerSubject } from '../registry-helpers.js';
 import { validateSlug } from './validate.js';
 /** The canonical, secret-free list projection of a {@link DeployRecord}. */
 export function deploymentSummary(record) {
+    const ownerSubject = deploymentOwnerSubject(record);
     return {
         deploymentId: record.deploymentId,
         orgSlug: record.orgSlug,
@@ -11,6 +21,7 @@ export function deploymentSummary(record) {
         serverName: record.serverName,
         createdAt: record.createdAt,
         ...(record.createdByEmail !== undefined ? { createdByEmail: record.createdByEmail } : {}),
+        ...(ownerSubject !== undefined ? { ownerSubject } : {}),
         ...(record.deploymentSource !== undefined ? { deploymentSource: record.deploymentSource } : {}),
         accessMode: record.accessMode ?? 'owner-only',
         ...(record.deploymentLock !== undefined
@@ -95,6 +106,34 @@ export function withoutArchiveStamp(record) {
     const { archivedAt: _cleared, ...rest } = record;
     return rest;
 }
+export function preserveDeploymentOwnerState(existing, candidate) {
+    const { ownerSubject: _candidateOwnerSubject, ...deployFields } = candidate;
+    return {
+        ...deployFields,
+        ...(existing.ownerSubject !== undefined ? { ownerSubject: existing.ownerSubject } : {}),
+    };
+}
+export function resolveActiveAccessUpdate(record, ref, input) {
+    if (record === undefined ||
+        !record.active ||
+        record.archivedAt !== undefined ||
+        !sameTenantRecord(record, ref) ||
+        record.accessMode !== input.expectedAccessMode ||
+        deploymentOwnerSubject(record) !== input.expectedOwnerSubject)
+        return undefined;
+    if ((record.accessMode ?? 'owner-only') === input.accessMode &&
+        (input.ownerSubject === undefined || deploymentOwnerSubject(record) === input.ownerSubject) &&
+        input.accessMode !== 'customers')
+        return record;
+    return {
+        ...record,
+        accessMode: input.accessMode,
+        ...(input.ownerSubject !== undefined ? { ownerSubject: input.ownerSubject } : {}),
+        ...(input.accessMode === 'customers' && input.serverAuth !== undefined
+            ? { serverAuth: input.serverAuth }
+            : {}),
+    };
+}
 const ENVIRONMENT_RANK = { prod: 0, staging: 1, dev: 2 };
 function environmentRank(environment) {
     return ENVIRONMENT_RANK[environment] ?? 3;

package/node_modules/@noodle-borg/service/dist/store.d.ts

@@ -47,6 +47,8 @@ export interface DeployRecord {
     readonly createdAt: string;
     readonly createdBySubject?: string;
     readonly createdByEmail?: string;
+    /** OAuth subject authorized by owner-only access; absent legacy records fall back to the creator. */
+    readonly ownerSubject?: string;
     /** Informational deploy origin. Absent on records written before source tracking. */
     readonly deploymentSource?: DeploymentSource;
     /**
@@ -142,6 +144,7 @@ export interface DeploymentSummary {
     readonly serverName: string;
     readonly createdAt: string;
     readonly createdByEmail?: string;
+    readonly ownerSubject?: string;
     readonly deploymentSource?: DeploymentSource;
     readonly accessMode: AccessMode;
     readonly deploymentLock?: DeploymentLockMetadata;
@@ -236,6 +239,7 @@ export interface DeploymentStatus {
         readonly serverName: string;
         readonly createdAt: string;
         readonly createdByEmail?: string;
+        readonly ownerSubject?: string;
         readonly accessMode: AccessMode;
         readonly deploymentLock?: DeploymentLockMetadata;
     };
@@ -252,6 +256,16 @@ export interface DeploymentActivationResult {
     readonly previousActive?: DeployRecord;
     readonly alreadyActive: boolean;
 }
+/** One atomic access/owner compare-and-set over the active deployment's observed state. */
+export interface ActiveAccessUpdateInput {
+    readonly accessMode: AccessMode;
+    /** Desired owner mutation. Omission preserves the current effective owner; clearing is unsupported. */
+    readonly ownerSubject?: string;
+    readonly expectedAccessMode: AccessMode | undefined;
+    readonly expectedOwnerSubject: string | undefined;
+    /** Compiler-authoritative projection persisted atomically when enabling customer access. */
+    readonly serverAuth?: TenantAuthConfig;
+}
 export type DeploymentLockUpdateResult = {
     readonly ok: true;
     readonly record: DeployRecord;
@@ -263,9 +277,10 @@ export type DeploymentLockUpdateResult = {
 export interface ControlPlaneStore extends OrganizationStore {
 }
 /**
- * Durable storage for deployed-server records. `append` writes (or replaces) one server's record;
- * `loadAll` returns every current record for restart recovery. Historical records are retained so a
- * tenant environment can reactivate an earlier deployment without changing the tenant-facing URL.
+ * Durable storage for deployed-server records. `append` writes (or replaces) one server's immutable deploy
+ * inputs while preserving owner state changed through {@link updateActiveAccess}; `loadAll` returns every
+ * current record for restart recovery. Historical records are retained so a tenant environment can reactivate
+ * an earlier deployment without changing the tenant-facing URL.
  */
 export interface ArtifactStore {
     append(record: DeployRecord): Promise<void>;
@@ -294,14 +309,10 @@ export interface ArtifactStore {
         readonly automationId?: string;
     }): Promise<DeploymentActivationResult | undefined>;
     /**
-     * Compare and set the active record's access mode. The precondition is the raw persisted value:
-     * legacy `undefined` remains distinguishable from an explicitly stored `owner-only`.
+     * Compare and set the active record's access mode and effective owner. The access precondition is the raw
+     * persisted value; the owner precondition resolves legacy records through creator provenance.
      */
-    updateActiveAccess(ref: TenantRef, deploymentId: string, accessMode: AccessMode, precondition: {
-        readonly expectedAccessMode: AccessMode | undefined;
-        /** Compiler-authoritative projection persisted atomically when enabling customer access. */
-        readonly serverAuth?: TenantAuthConfig;
-    }): Promise<DeployRecord | undefined>;
+    updateActiveAccess(ref: TenantRef, deploymentId: string, input: ActiveAccessUpdateInput): Promise<DeployRecord | undefined>;
     listDeployments(filter: DeploymentListFilter): Promise<readonly DeploymentSummary[]>;
     /**
      * App soft delete (ADR 0117). `getAppArchivedAt` reports the app's archived stamp (defined iff the

package/node_modules/@noodle-borg/service/package.json

@@ -20,6 +20,10 @@
     "./main": {
       "types": "./dist/main.d.ts",
       "import": "./dist/main.js"
+    },
+    "./oauth-google": {
+      "types": "./dist/oauth/google.d.ts",
+      "import": "./dist/oauth/google.js"
     }
   },
   "bin": {
@@ -35,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.81.0",
+    "@noodle-borg/agent-kit": "0.82.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/node_modules/@noodle-borg/wire-contracts/dist/control-plane.d.ts

@@ -1,5 +1,7 @@
 /** Strict service-output contracts for control-plane reads and mutations (ADR 0128). */
 import { z } from 'zod';
+/** Exact OAuth subject bound by an operator to an owner-only deployment. */
+export declare const deploymentOwnerSubjectSchema: z.ZodString;
 export declare const accessUpdateRequestSchema: z.ZodObject<{
     accessMode: z.ZodEnum<{
         "owner-only": "owner-only";
@@ -9,8 +11,118 @@ export declare const accessUpdateRequestSchema: z.ZodObject<{
         mixed: "mixed";
         customers: "customers";
     }>;
+    ownerSubject: z.ZodOptional<z.ZodString>;
     serverVersion: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
+export declare const accessUpdateResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    target: z.ZodObject<{
+        org: z.ZodString;
+        app: z.ZodString;
+        env: z.ZodString;
+    }, z.core.$strict>;
+    deployment: z.ZodObject<{
+        deploymentId: z.ZodString;
+        serverVersion: z.ZodOptional<z.ZodString>;
+        accessMode: z.ZodEnum<{
+            "owner-only": "owner-only";
+            "org-members": "org-members";
+            authenticated: "authenticated";
+            public: "public";
+            mixed: "mixed";
+            customers: "customers";
+        }>;
+        ownerSubject: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    previousAccessMode: z.ZodEnum<{
+        "owner-only": "owner-only";
+        "org-members": "org-members";
+        authenticated: "authenticated";
+        public: "public";
+        mixed: "mixed";
+        customers: "customers";
+    }>;
+    previousOwnerSubject: z.ZodOptional<z.ZodString>;
+    accessChanged: z.ZodBoolean;
+    ownerChanged: z.ZodBoolean;
+    changed: z.ZodBoolean;
+}, z.core.$strict>;
+export type AccessUpdateResponse = z.output<typeof accessUpdateResponseSchema>;
+/**
+ * Additive client reader for the access mutation response. Older services emitted only the aggregate
+ * `changed` bit, so the mode component is derived from the authoritative previous/current modes while an
+ * unobservable owner component remains omitted. Modern component bits retain the strict cross-field check.
+ */
+export declare const accessUpdateClientResponseSchema: z.ZodPipe<z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    target: z.ZodObject<{
+        org: z.ZodString;
+        app: z.ZodString;
+        env: z.ZodString;
+    }, z.core.$strip>;
+    deployment: z.ZodObject<{
+        deploymentId: z.ZodString;
+        serverVersion: z.ZodOptional<z.ZodString>;
+        accessMode: z.ZodEnum<{
+            "owner-only": "owner-only";
+            "org-members": "org-members";
+            authenticated: "authenticated";
+            public: "public";
+            mixed: "mixed";
+            customers: "customers";
+        }>;
+        ownerSubject: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    previousAccessMode: z.ZodEnum<{
+        "owner-only": "owner-only";
+        "org-members": "org-members";
+        authenticated: "authenticated";
+        public: "public";
+        mixed: "mixed";
+        customers: "customers";
+    }>;
+    previousOwnerSubject: z.ZodOptional<z.ZodString>;
+    accessChanged: z.ZodOptional<z.ZodBoolean>;
+    ownerChanged: z.ZodOptional<z.ZodBoolean>;
+    changed: z.ZodBoolean;
+}, z.core.$strip>, z.ZodTransform<{
+    accessChanged: boolean;
+    ok: true;
+    target: {
+        org: string;
+        app: string;
+        env: string;
+    };
+    deployment: {
+        deploymentId: string;
+        accessMode: "owner-only" | "org-members" | "authenticated" | "public" | "mixed" | "customers";
+        serverVersion?: string | undefined;
+        ownerSubject?: string | undefined;
+    };
+    previousAccessMode: "owner-only" | "org-members" | "authenticated" | "public" | "mixed" | "customers";
+    changed: boolean;
+    previousOwnerSubject?: string | undefined;
+    ownerChanged?: boolean | undefined;
+}, {
+    ok: true;
+    target: {
+        org: string;
+        app: string;
+        env: string;
+    };
+    deployment: {
+        deploymentId: string;
+        accessMode: "owner-only" | "org-members" | "authenticated" | "public" | "mixed" | "customers";
+        serverVersion?: string | undefined;
+        ownerSubject?: string | undefined;
+    };
+    previousAccessMode: "owner-only" | "org-members" | "authenticated" | "public" | "mixed" | "customers";
+    changed: boolean;
+    previousOwnerSubject?: string | undefined;
+    accessChanged?: boolean | undefined;
+    ownerChanged?: boolean | undefined;
+}>>;
+export type AccessUpdateClientResponse = z.output<typeof accessUpdateClientResponseSchema>;
 export declare const deploymentLockRequestSchema: z.ZodObject<{
     serverVersion: z.ZodString;
     expectedDeploymentId: z.ZodString;
@@ -27,6 +139,7 @@ export declare const DeploymentSummarySchema: z.ZodObject<{
     serverName: z.ZodString;
     createdAt: z.ZodString;
     createdByEmail: z.ZodOptional<z.ZodString>;
+    ownerSubject: z.ZodOptional<z.ZodString>;
     deploymentSource: z.ZodOptional<z.ZodString>;
     accessMode: z.ZodEnum<{
         "owner-only": "owner-only";
@@ -66,6 +179,7 @@ export declare const AppSummarySchema: z.ZodObject<{
         serverName: z.ZodString;
         createdAt: z.ZodString;
         createdByEmail: z.ZodOptional<z.ZodString>;
+        ownerSubject: z.ZodOptional<z.ZodString>;
         deploymentSource: z.ZodOptional<z.ZodString>;
         accessMode: z.ZodEnum<{
             "owner-only": "owner-only";
@@ -107,6 +221,7 @@ export declare const AppsListResponseSchema: z.ZodObject<{
                 serverName: z.ZodString;
                 createdAt: z.ZodString;
                 createdByEmail: z.ZodOptional<z.ZodString>;
+                ownerSubject: z.ZodOptional<z.ZodString>;
                 deploymentSource: z.ZodOptional<z.ZodString>;
                 accessMode: z.ZodEnum<{
                     "owner-only": "owner-only";
@@ -150,6 +265,7 @@ export declare const AppResponseSchema: z.ZodObject<{
             serverName: z.ZodString;
             createdAt: z.ZodString;
             createdByEmail: z.ZodOptional<z.ZodString>;
+            ownerSubject: z.ZodOptional<z.ZodString>;
             deploymentSource: z.ZodOptional<z.ZodString>;
             accessMode: z.ZodEnum<{
                 "owner-only": "owner-only";
@@ -190,6 +306,7 @@ export declare const EnvSummarySchema: z.ZodObject<{
         serverName: z.ZodString;
         createdAt: z.ZodString;
         createdByEmail: z.ZodOptional<z.ZodString>;
+        ownerSubject: z.ZodOptional<z.ZodString>;
         deploymentSource: z.ZodOptional<z.ZodString>;
         accessMode: z.ZodEnum<{
             "owner-only": "owner-only";
@@ -233,6 +350,7 @@ export declare const EnvsListResponseSchema: z.ZodObject<{
                 serverName: z.ZodString;
                 createdAt: z.ZodString;
                 createdByEmail: z.ZodOptional<z.ZodString>;
+                ownerSubject: z.ZodOptional<z.ZodString>;
                 deploymentSource: z.ZodOptional<z.ZodString>;
                 accessMode: z.ZodEnum<{
                     "owner-only": "owner-only";
@@ -277,6 +395,7 @@ export declare const EnvResponseSchema: z.ZodObject<{
             serverName: z.ZodString;
             createdAt: z.ZodString;
             createdByEmail: z.ZodOptional<z.ZodString>;
+            ownerSubject: z.ZodOptional<z.ZodString>;
             deploymentSource: z.ZodOptional<z.ZodString>;
             accessMode: z.ZodEnum<{
                 "owner-only": "owner-only";
@@ -358,6 +477,7 @@ export declare const DeploymentResponseSchema: z.ZodObject<{
         serverName: z.ZodString;
         createdAt: z.ZodString;
         createdByEmail: z.ZodOptional<z.ZodString>;
+        ownerSubject: z.ZodOptional<z.ZodString>;
         deploymentSource: z.ZodOptional<z.ZodString>;
         accessMode: z.ZodEnum<{
             "owner-only": "owner-only";