@noodleseed/one 0.161.2 → 0.163.0

package/node_modules/@noodle-borg/service/dist/native-record-connector.js

@@ -0,0 +1,206 @@
+import { admitPublicRecord } from '@noodle-borg/admission-limits/portable';
+import { RECORD_CONNECTOR_ID, RECORD_CONNECTOR_VERSION, RECORD_OPERATION_SIGNATURES, validateJsonSchema, } from '@noodle-borg/compiler';
+import { ConnectorInvocationError } from '@noodle-borg/runtime';
+import { creationPayload } from './business-information/collection-controls.js';
+import { businessGrantAllows, idempotencyDigest, requestFingerprint, } from './business-information/model.js';
+import { NativeStorageLimitError } from './business-information/native-storage-budget.js';
+import { CursorValidationError, PayloadValidationError, } from './business-information/validation.js';
+import { recordToWire } from './routes/business-information-wire.js';
+/** Platform composition supplies storage; an authored declaration alone grants no installed authority. */
+export function createDeploymentNativeRecordConnector(input, dependencies) {
+    if (!input.artifact.server.managedCollections?.some((collection) => collection.source.authority === 'native'))
+        return undefined;
+    return new NativeRecordConnector(input, dependencies);
+}
+class NativeRecordConnector {
+    input;
+    dependencies;
+    id = RECORD_CONNECTOR_ID;
+    version = RECORD_CONNECTOR_VERSION;
+    constructor(input, dependencies) {
+        this.input = input;
+        this.dependencies = dependencies;
+    }
+    signature(operation) {
+        return RECORD_OPERATION_SIGNATURES[operation];
+    }
+    executionBoundMs(operation) {
+        return this.signature(operation)?.type === 'action' ? 10_000 : undefined;
+    }
+    async invoke(call) {
+        const signature = this.signature(call.operation);
+        if (signature === undefined || validateJsonSchema(signature.input, call.args).length > 0)
+            return fail(call, 400, 'Invalid native record operation arguments.');
+        if (signature.type === 'action' && !/^[a-f0-9]{64}$/.test(call.execution?.id ?? ''))
+            return fail(call, 503, 'A trusted execution identity is required before a native record write.');
+        const installations = (await this.dependencies.store.listInstallations(this.input.tenant.org)).filter((installation) => installation.scope.app === this.input.tenant.app &&
+            installation.scope.env === this.input.tenant.env);
+        if (installations.length !== 1)
+            return fail(call, 503, 'Native record installation is unavailable.');
+        const installation = installations[0];
+        if (installation === undefined)
+            return fail(call, 503, 'Native record installation is unavailable.');
+        const collection = installation.definition.collections.find((entry) => entry.key === call.args.collection);
+        const authored = this.input.artifact.server.managedCollections?.find((entry) => entry.name === call.args.collection);
+        if (collection === undefined ||
+            authored === undefined ||
+            !installation.managedCollections.includes(collection.key))
+            return fail(call, 404, 'Native collection is not enabled for this application.');
+        if (collection.authority.authority !== 'native' || authored.source.authority !== 'native')
+            return fail(call, 405, 'External reference collections do not accept native record operations.');
+        if (collection.schemaDigest.replace(/^sha256:/, '') !==
+            authored.schemaDigest.replace(/^sha256:/, ''))
+            return fail(call, 409, 'Collection definition changed; activate the current application before continuing.');
+        const publicInput = call.operation === 'submit_record';
+        if (!publicInput)
+            await this.authorize(call, installation);
+        try {
+            return await this.execute(call, installation, collection, publicInput);
+        }
+        catch (error) {
+            if (error instanceof CursorValidationError)
+                return fail(call, 400, 'Invalid or stale record cursor; restart the query.');
+            if (error instanceof NativeStorageLimitError)
+                return fail(call, 409, error.message);
+            if (error instanceof PayloadValidationError)
+                return fail(call, 400, 'Record fields do not match the declared collection permissions and schema.');
+            throw error;
+        }
+    }
+    async authorize(call, installation) {
+        if (call.caller?.identityKind !== 'platform')
+            return fail(call, 403, 'A live business grant is required for staff record operations.');
+        const permission = call.operation === 'create_record'
+            ? 'records:create'
+            : call.operation === 'update_record'
+                ? 'records:update'
+                : call.operation === 'delete_record'
+                    ? 'records:delete'
+                    : 'records:read';
+        const grant = await this.dependencies.store.getGrant(installation.scope, call.caller.subject);
+        if (!businessGrantAllows(grant, permission))
+            return fail(call, 403, 'A live business grant is required for this record operation.');
+    }
+    async execute(call, installation, collection, publicInput) {
+        const store = this.dependencies.store;
+        const scope = installation.scope;
+        const actorSubject = call.caller?.subject ?? 'anonymous';
+        if (call.operation === 'submit_record' || call.operation === 'create_record') {
+            // Validate before receipt probing/admission, and preserve the admitted payload as the replay fingerprint.
+            creationPayload(collection, call.args.payload, publicInput);
+            const payload = call.args.payload;
+            const key = call.execution?.id;
+            if (key === undefined)
+                return fail(call, 503, 'A trusted execution identity is required.');
+            const request = {
+                scope,
+                collectionKey: collection.key,
+                idempotencyKey: key,
+                payload,
+                ...(publicInput ? { publicInput: true } : {}),
+                origin: { kind: 'mcp', reference: 'native-tool' },
+                actorSubject,
+            };
+            const completed = await store.probeRequest(request);
+            if (completed.disposition === 'conflict')
+                return fail(call, 409, 'This execution identity was already used with different record content.');
+            if (completed.disposition === 'replayed') {
+                call.reportOutcome?.({ outcome: 'completed', reference: completed.record.id });
+                return publicInput
+                    ? receipt(completed.record)
+                    : { ok: true, record: recordToWire(completed.record) };
+            }
+            if (publicInput) {
+                if (!installation.intakeActive || this.dependencies.publicIntakeEnabled === false)
+                    return fail(call, 503, 'Public record intake is paused.');
+                if (call.publicAdmission === undefined || !call.publicAdmission.network)
+                    return fail(call, 503, 'Trusted network admission context is required for public record writes.');
+                const quota = await admitPublicRecord({
+                    counters: this.dependencies.counters,
+                    surfaceId: installation.publicId,
+                    attempt: {
+                        key: `solution-intake:logical:${installation.publicId}:${idempotencyDigest(key)}`,
+                        fingerprint: requestFingerprint(request),
+                    },
+                    buckets: call.publicAdmission,
+                    now: this.dependencies.now?.() ?? new Date(),
+                });
+                if (!quota.allowed)
+                    return fail(call, quota.reason === 'quota_exceeded'
+                        ? 429
+                        : quota.reason === 'idempotency_conflict'
+                            ? 409
+                            : 503, quota.reason === 'quota_exceeded'
+                        ? 'Public record admission limit exceeded.'
+                        : 'Public record admission is unavailable.');
+            }
+            else
+                await this.authorize(call, installation);
+            if (call.signal?.aborted)
+                return fail(call, 503, 'Native record write was cancelled before dispatch.');
+            const created = await store.createRequest(request);
+            if (created.disposition === 'conflict')
+                return fail(call, 409, 'Record creation conflicts with the original execution.');
+            if (created.disposition === 'paused')
+                return fail(call, 503, 'Public record intake is paused.');
+            call.reportOutcome?.({ outcome: 'completed', reference: created.record.id });
+            return publicInput
+                ? receipt(created.record)
+                : { ok: true, record: recordToWire(created.record) };
+        }
+        if (call.operation === 'list_records') {
+            const result = await store.listRequests({
+                scope,
+                collectionKey: collection.key,
+                ...(call.args.cursor === undefined ? {} : { cursor: String(call.args.cursor) }),
+                ...(call.args.limit === undefined ? {} : { limit: Number(call.args.limit) }),
+            });
+            return {
+                ok: true,
+                records: result.records.map(recordToWire),
+                ...(result.nextCursor === undefined ? {} : { nextCursor: result.nextCursor }),
+            };
+        }
+        const id = String(call.args.id);
+        if (call.operation === 'get_record') {
+            const record = await store.getRequest(scope, collection.key, id);
+            if (record === undefined)
+                return fail(call, 404, 'Native record was not found.');
+            return { ok: true, record: recordToWire(record) };
+        }
+        await this.authorize(call, installation);
+        const mutation = {
+            scope,
+            collectionKey: collection.key,
+            id,
+            expectedRevision: Number(call.args.expectedRevision),
+            actorSubject,
+        };
+        if (call.signal?.aborted)
+            return fail(call, 503, 'Native record write was cancelled before dispatch.');
+        const result = call.operation === 'delete_record'
+            ? await store.deleteRequest({ ...mutation, reason: 'customer_request' })
+            : await store.mutateRequest({
+                ...mutation,
+                operation: {
+                    kind: 'update',
+                    payload: call.args.patch,
+                    ...(call.args.unset === undefined ? {} : { unset: call.args.unset }),
+                },
+            });
+        if (!result.ok)
+            return fail(call, result.reason === 'not_found' ? 404 : result.reason === 'conflict' ? 409 : 422, 'Native record operation was not applied; inspect the current record and revision.');
+        call.reportOutcome?.({ outcome: 'completed', reference: result.record.id });
+        return call.operation === 'delete_record'
+            ? receipt(result.record)
+            : { ok: true, record: recordToWire(result.record) };
+    }
+}
+function receipt(record) {
+    return { ok: true, recordId: record.id, revision: record.revision };
+}
+function fail(call, status, message) {
+    call.reportOutcome?.({ outcome: 'rejected' });
+    throw new ConnectorInvocationError(message, { status, retryable: false });
+}
+//# sourceMappingURL=native-record-connector.js.map

package/node_modules/@noodle-borg/service/dist/oauth/store.d.ts

@@ -169,9 +169,11 @@ export interface DelegatedCredentialLookup {
 export interface OAuthStore extends DeviceAuthorizationStore {
     /** Dynamic client registration (RFC 7591): persist + read the SDK-generated client info. */
     getClient(clientId: string): Promise<OAuthClientInformationFull | undefined>;
+    /** Durable server-owned purpose; absent registration is distinct from a known dynamic client. */
+    getClientPurpose(clientId: string): Promise<'console' | 'portal' | 'dynamic' | undefined>;
     putClient(client: OAuthClientInformationFull): Promise<OAuthClientInformationFull>;
     /** Atomically reserves or reconciles a server-owned client without taking over a DCR registration. */
-    putFirstPartyClient(owner: 'console', client: OAuthClientInformationFull): Promise<OAuthClientInformationFull>;
+    putFirstPartyClient(owner: 'console' | 'portal', client: OAuthClientInformationFull): Promise<OAuthClientInformationFull>;
     /** Pending authorization (single-use). A provider mismatch leaves the record live for its real callback. */
     createPendingAuthorization(record: PendingAuthorizationRecord): Promise<void>;
     consumePendingAuthorization(state: string, expectedUpstreamProvider: PendingAuthorizationCallbackKind): Promise<PendingAuthorizationRecord | undefined>;
@@ -219,8 +221,9 @@ export interface OAuthStore extends DeviceAuthorizationStore {
 export declare class InMemoryOAuthStore implements OAuthStore {
     #private;
     getClient(clientId: string): Promise<OAuthClientInformationFull | undefined>;
+    getClientPurpose(clientId: string): Promise<'console' | 'portal' | 'dynamic' | undefined>;
     putClient(client: OAuthClientInformationFull): Promise<OAuthClientInformationFull>;
-    putFirstPartyClient(owner: 'console', client: OAuthClientInformationFull): Promise<OAuthClientInformationFull>;
+    putFirstPartyClient(owner: 'console' | 'portal', client: OAuthClientInformationFull): Promise<OAuthClientInformationFull>;
     createPendingAuthorization(record: PendingAuthorizationRecord): Promise<void>;
     consumePendingAuthorization(state: string, expectedUpstreamProvider: PendingAuthorizationRecord['upstreamProvider']): Promise<PendingAuthorizationRecord | undefined>;
     createAuthorizationCode(record: AuthorizationCodeRecord): Promise<void>;

package/node_modules/@noodle-borg/service/dist/operation-evidence.js

@@ -0,0 +1,89 @@
+import { createHmac, randomUUID } from 'node:crypto';
+import { canonicalJson } from '@noodle-borg/compiler';
+/** Generic execution evidence adapter. It stores no application input and cannot dispatch or replay work. */
+export function createOperationEvidencePort(options) {
+    if (options.identityKey.length < 32 || !/^[A-Za-z0-9_-]{16,128}$/.test(options.epoch))
+        throw new Error('Invalid operation evidence configuration');
+    const hash = (value) => createHmac('sha256', options.identityKey).update(canonicalJson(value)).digest('hex');
+    const now = () => options.now?.() ?? Date.now();
+    return {
+        async begin(intent) {
+            const startedAt = now();
+            const bound = options.executionBoundMs(intent);
+            const days = await options.historyDays();
+            if (!Number.isSafeInteger(bound) ||
+                bound === undefined ||
+                bound < 1 ||
+                !Number.isInteger(days) ||
+                days < 1 ||
+                days > 365 ||
+                bound >= days * 86_400_000 ||
+                !(await options.authorize(intent)))
+                throw new Error('Operation evidence authority unavailable');
+            const connectionId = intent.operation.credentialBinding?.connectionId;
+            const generation = connectionId === undefined ? undefined : options.connectionGeneration(connectionId);
+            if (connectionId !== undefined && generation === undefined)
+                throw new Error('Original connected account unavailable');
+            const record = {
+                scope: options.scope,
+                id: intent.id,
+                lease: randomUUID(),
+                epoch: options.epoch,
+                deploymentId: options.deploymentId,
+                tool: intent.tool,
+                connector: intent.operation.connectorId,
+                operation: intent.operation.operation,
+                ...(connectionId === undefined ? {} : { connectionId }),
+                ...(generation === undefined ? {} : { generation }),
+                actorDigest: hash(intent.caller ?? null),
+                intentDigest: hash({
+                    scope: options.scope,
+                    deploymentId: options.deploymentId,
+                    epoch: options.epoch,
+                    operation: intent.operation,
+                    input: intent.arguments,
+                    caller: intent.caller ?? null,
+                    revision: intent.executionRevision ?? null,
+                    generation: generation ?? null,
+                }),
+                startedAt,
+                executionDeadline: startedAt + bound,
+                historyExpiresAt: startedAt + days * 86_400_000,
+                outcome: 'dispatching',
+            };
+            if (!(await options.store.claim(record)))
+                return undefined;
+            return {
+                async finish(evidence) {
+                    const completionDays = await options.historyDays();
+                    if (!Number.isInteger(completionDays) || completionDays < 1 || completionDays > 365)
+                        throw new Error('Operation history policy unavailable');
+                    if (!(await options.store.finish(options.scope, record.id, record.lease, record.epoch, evidence, now(), completionDays)))
+                        throw new Error('Operation evidence claim expired');
+                },
+            };
+        },
+    };
+}
+/** Store adapters use the same narrow transition; late results cannot replace an expired/terminal claim. */
+export function completeOperationEvidence(record, lease, epoch, evidence, now, historyDays) {
+    if (record.lease !== lease ||
+        record.epoch !== epoch ||
+        record.outcome !== 'dispatching' ||
+        record.executionDeadline <= now)
+        return undefined;
+    return {
+        ...record,
+        outcome: evidence.outcome,
+        completedAt: now,
+        historyExpiresAt: now +
+            (historyDays === undefined
+                ? record.historyExpiresAt - record.startedAt
+                : historyDays * 86_400_000),
+        ...(evidence.reference === undefined ? {} : { reference: evidence.reference }),
+    };
+}
+export function operationEvidenceKey(scope, id) {
+    return JSON.stringify([scope.org, scope.app, scope.env, scope.installationId, id]);
+}
+//# sourceMappingURL=operation-evidence.js.map

package/node_modules/@noodle-borg/service/dist/recovery-quarantine.js

@@ -0,0 +1,49 @@
+import { createServer } from 'node:http';
+import { applySecurityHeaders, sendJson } from '@noodle-borg/transport-http';
+import { resolveBuildInfo, serviceInfoPayload } from './build-info.js';
+import { ServerRegistry } from './registry.js';
+import { closeHttpServer, listenHttpServer } from './service-resource-cleanup.js';
+export function resolveRecoveryMode(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === 'quarantined' || value === 'reopened')
+        return value;
+    throw new Error('Invalid recovery mode; expected quarantined or reopened');
+}
+/** Deliberately no authorization/store lookup, artifact serving or application dispatch. */
+export function createRecoveryQuarantineHandler(options) {
+    const build = options.buildInfo ?? resolveBuildInfo();
+    return (req, res) => {
+        applySecurityHeaders(res, options.tls ?? {});
+        res.setHeader('cache-control', 'no-store');
+        const path = new URL(req.url ?? '/', 'http://localhost').pathname;
+        if (req.method === 'GET') {
+            if (path === '/healthz')
+                return sendJson(res, 200, { status: 'ok' });
+            if (path === '/readyz')
+                return sendJson(res, 503, { status: 'quarantined' });
+            if (path === '/v1/service/info')
+                return sendJson(res, 200, serviceInfoPayload(build, false));
+        }
+        sendJson(res, 503, {
+            error: 'This service is quarantined for recovery.',
+            code: 'recovery_quarantined',
+        });
+    };
+}
+/** No restored store is constructed or borrowed; even startup migrations/workers remain stopped. */
+export async function serveRecoveryQuarantine(options) {
+    const host = options.host ?? '127.0.0.1';
+    const http = createServer(createRecoveryQuarantineHandler(options));
+    await listenHttpServer(http, options.port ?? 8787, host);
+    const { port } = http.address();
+    return {
+        http,
+        port,
+        url: `http://${host.includes(':') ? `[${host}]` : host}:${port}`,
+        // The existing programmatic return contract gets an empty local registry, never restored authority.
+        registry: new ServerRegistry(),
+        close: () => closeHttpServer(http),
+    };
+}
+//# sourceMappingURL=recovery-quarantine.js.map

package/node_modules/@noodle-borg/service/dist/registry-compile.js

@@ -1,7 +1,7 @@
 import { publicSurfaceDelegatedAuthErrors } from '@noodle-borg/assistant-gateway/portable';
-import { compile, InMemoryCatalog, } from '@noodle-borg/compiler';
+import { compile, InMemoryCatalog, RECORD_CONNECTOR_ID, } from '@noodle-borg/compiler';
 import { compileConnectors, delegatedTokenExchangeIdentityErrors, } from '@noodle-borg/connector-defs';
-import { InMemoryConnectorRegistry, resolveManagedOrigins, } from '@noodle-borg/runtime';
+import { InMemoryConnectorRegistry, resolveManagedOrigins, resolveVariableEnvironment, } from '@noodle-borg/runtime';
 import { AppPackageSnapshotError, createAppPackageSnapshot, } from './app-package-snapshot.js';
 import { missingServerConfigErrors } from './assistant-bindings.js';
 import { ManagedConfigBroker } from './credential-broker.js';
@@ -20,6 +20,17 @@ export async function compileRegistryTarget(context, input) {
         const cc = compileConnectors(connectors);
         if (!cc.ok)
             return { ok: false, errors: cc.errors };
+        if (cc.catalog.some((entry) => entry.id === RECORD_CONNECTOR_ID))
+            return {
+                ok: false,
+                errors: [
+                    {
+                        code: 'reserved_connector',
+                        path: 'connectors',
+                        message: 'The native record connector is platform-owned and cannot be supplied by an application.',
+                    },
+                ],
+            };
         catalogConnectors = cc.catalog;
         httpConnectors = cc.connectors;
         secretBindings = cc.secretBindings;
@@ -49,25 +60,54 @@ export async function compileRegistryTarget(context, input) {
     const projectionErrors = compiled.ok
         ? publicSurfaceDelegatedAuthErrors(compiled.artifact, secretBindings)
         : [];
-    const [resolvedSecrets, resolvedVariables] = await Promise.all([
-        context.configStore.resolveConfigValues('secret', scope),
-        context.configStore.resolveConfigValues('variable', scope),
-    ]);
+    const resolvedSecrets = await context.configStore.resolveConfigValues('secret', scope);
+    const resolvedVariables = await context.configStore.resolveConfigValues('variable', scope);
+    const businessVariables = new Set(compiled.ok
+        ? compiled.artifact.server.variables
+            ?.filter((declaration) => declaration.portal !== undefined)
+            .map((declaration) => declaration.name)
+        : []);
     const connectorConfigErrors = [
         ...missingSecretErrors(secretBindings, resolvedSecrets),
-        ...missingVariableErrors(variableBindings, resolvedVariables),
+        ...missingVariableErrors(variableBindings.filter((name) => !businessVariables.has(name)), resolvedVariables),
     ];
     if (!compiled.ok) {
         return { ok: false, errors: [...connectorConfigErrors, ...compiled.errors] };
     }
-    const missingServerConfig = missingServerConfigErrors(compiled.artifact, resolvedSecrets, resolvedVariables);
+    const missingServerConfig = missingServerConfigErrors(compiled.artifact, resolvedSecrets, resolvedVariables).filter((error) => error.code !== 'missing_variable' ||
+        !businessVariables.has(error.path.replace(/^variables\./, '')));
     const errors = [
         ...identityErrors,
         ...projectionErrors,
         ...connectorConfigErrors,
         ...missingServerConfig,
     ];
-    const originResolution = resolveManagedOrigins(compiled.artifact, resolvedVariables);
+    const settings = resolveVariableEnvironment(compiled.artifact.server.variables ?? [], resolvedVariables);
+    if (!settings.ok)
+        errors.push({ ...settings.error, path: 'server.variables' });
+    if (settings.ok && deploymentId === undefined && settings.missing.length > 0) {
+        const previous = await context.activeArtifact();
+        if (previous !== undefined) {
+            const previouslyMissing = resolveVariableEnvironment(previous.server.variables ?? [], resolvedVariables);
+            for (const declaration of compiled.artifact.server.variables ?? []) {
+                if (!settings.missing.includes(declaration.name))
+                    continue;
+                const old = previous.server.variables?.find((entry) => entry.name === declaration.name);
+                if (declaration.requiredFor.some((tool) => previous.tools.some((entry) => entry.name === tool) &&
+                    !(previouslyMissing.ok &&
+                        previouslyMissing.missing.includes(declaration.name) &&
+                        old?.requiredFor.includes(tool))))
+                    errors.push({
+                        code: 'configuration_required',
+                        path: `variables.${declaration.name}`,
+                        message: 'Configure the new requirement before updating an existing capability.',
+                    });
+            }
+        }
+    }
+    const originResolution = resolveManagedOrigins(compiled.artifact, resolvedVariables, {
+        allowUnconfiguredPortal: true,
+    });
     if (!originResolution.ok) {
         const missingVariables = new Set(errors.filter((error) => error.code === 'missing_variable').map((error) => error.path));
         errors.push(...originResolution.errors
@@ -92,7 +132,8 @@ export async function compileRegistryTarget(context, input) {
     if (errors.length > 0 || !originResolution.ok) {
         return { ok: false, errors, compiledArtifact: compiled.artifact };
     }
-    const artifact = originResolution.artifact;
+    // Keep declarations reusable; serving binds live operator settings once for each request.
+    const artifact = compiled.artifact;
     const localAuthority = context.delegatedExchange === undefined &&
         secretBindings.some((binding) => binding.authKind === 'delegatedTokenExchange')
         ? await context.localDevtoolsDelegatedExchange?.resolve()
@@ -138,18 +179,26 @@ export async function compileRegistryTarget(context, input) {
             }),
         });
         const stateConnector = createDeploymentStateConnector(artifact.server.state, boundDeploymentId, context.stateHandleStoreFactory);
+        const nativeRecords = context.nativeRecords?.({
+            tenant,
+            artifact,
+            ...(boundDeploymentId === undefined ? {} : { deploymentId: boundDeploymentId }),
+        });
         return {
             artifact,
             deps: {
                 connectors: new InMemoryConnectorRegistry([
                     ...context.platformConnectors,
+                    ...(nativeRecords === undefined ? [] : [nativeRecords]),
                     ...(stateConnector !== undefined ? [stateConnector] : []),
                     ...httpConnectors,
                 ]),
                 broker,
                 tenantId: `${tenant.org}/${tenant.app}/${tenant.env}`,
                 ...(boundDeploymentId !== undefined ? { deploymentId: boundDeploymentId } : {}),
-                env: () => context.configStore.resolveConfigValues('variable', scope),
+                env: () => context.configStore.transactConfig === undefined
+                    ? context.configStore.resolveConfigValues('variable', scope)
+                    : context.configStore.transactConfig(scope.org, (transaction) => transaction.resolveConfigValues('variable', scope)),
                 ...(context.policyGate !== undefined ? { policy: context.policyGate } : {}),
                 ...(context.knowledgeSearch !== undefined && (artifact.server.knowledge?.length ?? 0) > 0
                     ? {

package/node_modules/@noodle-borg/service/dist/registry-deploy-transaction.js

@@ -1,6 +1,24 @@
 import { normalizeServerVersion } from '@noodle-borg/module';
 import { deployAccessRequiresActor, deployerRequiredError, deploymentOwnerSubject, emptyMembershipSourcesError, membershipSourcesRequireOrgMembersError, missingCapabilityErrors, serverAuthRequiredError, } from './registry-helpers.js';
 import { idempotentDeploymentId, mintDeploymentId } from './registry-targets.js';
+/** Serialize candidate validation/activation with hierarchical configuration writers. */
+export async function withDeploymentConfiguration(config, org, work) {
+    if (!config.transactConfig)
+        return work();
+    let result;
+    try {
+        return await config.transactConfig(org, async () => {
+            result = await work();
+            return result;
+        });
+    }
+    catch (error) {
+        // A nested activation rejection has rolled back; preserve its already mapped public diagnostic.
+        if (result?.ok === false)
+            return result;
+        throw error;
+    }
+}
 export async function preflightRegistryDeploy(input) {
     const { actor, accessMode, orgMembershipSources } = input.options;
     if (input.options.serverVersion !== undefined) {

package/node_modules/@noodle-borg/service/dist/registry-rollback.js

@@ -1,3 +1,4 @@
+import { withDeploymentConfiguration } from './registry-deploy-transaction.js';
 import { deploymentOwnerSubject, missingCapabilityErrors } from './registry-helpers.js';
 import { activateInMemory } from './registry-state.js';
 import { recordMatchesTenant, servedTargetFor, tenantDeploymentKey, tenantKey, tryServedTargetFor, } from './registry-targets.js';
@@ -7,7 +8,7 @@ import { recordMatchesTenant, servedTargetFor, tenantDeploymentKey, tenantKey, t
  */
 export async function rollbackWithMappedErrors(input) {
     try {
-        const result = await input.run();
+        const result = await withDeploymentConfiguration(input.configStore, input.org, input.run);
         if (result.ok)
             await input.pairKnowledge();
         return result;

package/node_modules/@noodle-borg/service/dist/registry-state.d.ts

@@ -57,7 +57,7 @@ export declare function registryArchiveApp(state: RegistryStateView, org: string
 export declare function registryRestoreApp(state: RegistryStateView, org: string, app: string, compileRecord: CompileCustomerAuthRecord): Promise<AppRestoreResult | undefined>;
 /** Compile exact private auth snapshots for a later atomic bulk-restore precondition. */
 export declare function registryCustomerAuthRestoreProjections(state: RegistryStateView, deploymentIds: readonly string[], compileRecord: CompileCustomerAuthRecord): Promise<readonly CustomerAuthRestoreProjection[]>;
-export declare function registrySweepArchived(state: RegistryStateView, before: string): Promise<readonly DeployRecord[]>;
+export declare function registrySweepArchived(state: RegistryStateView, before: string, onPurge?: (org: string, app: string, at: string, retired?: boolean) => Promise<void>): Promise<readonly DeployRecord[]>;
 /** The `apps` resource, store-first with a no-store fallback over the registry's own record cache. */
 export declare function registryListApps(state: RegistryStateView, org: string, opts: {
     readonly includeArchived?: boolean;

package/node_modules/@noodle-borg/service/dist/registry-state.js

@@ -9,7 +9,7 @@ import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAu
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from './deployment-lock.js';
 import { defaultActiveRecord } from './deployment-versioning.js';
 import { recordMatchesTenant, tenantDeploymentKey, tenantKey } from './registry-targets.js';
-import { appArchivedAt, deploymentSummary, paginateAppSummaries, planAppArchive, planAppRestore, resolveProductionEnvironment, summarizeApps, summarizeEnvs, withoutArchiveStamp, } from './store/records.js';
+import { appArchivedAt, deploymentSummary, paginateAppSummaries, planAppArchive, planAppRestore, planArchivedAppSweep, resolveProductionEnvironment, summarizeApps, summarizeEnvs, withoutArchiveStamp, } from './store/records.js';
 import { validateSlug, validateTenantRef } from './store/validate.js';
 export function reconcilePlatformAccountResetRegistryCache(state, input) {
     for (const app of input.apps) {
@@ -269,13 +269,13 @@ function deactivateScope(records, candidate) {
         }
     }
 }
-export async function registrySweepArchived(state, before) {
+export async function registrySweepArchived(state, before, onPurge) {
     let deleted;
     if (state.store !== undefined) {
         deleted = await state.store.sweepArchived(before);
     }
     else {
-        deleted = [...state.records.values()].filter((record) => record.archivedAt !== undefined && record.archivedAt < before);
+        deleted = planArchivedAppSweep([...state.records.values()], before);
     }
     const ids = new Set(deleted.map((record) => record.deploymentId));
     for (const id of ids) {
@@ -283,6 +283,9 @@ export async function registrySweepArchived(state, before) {
         state.servers.delete(id);
     }
     purgeActiveTenantEntries(state, ids);
+    const apps = new Map(deleted.map((record) => [`${record.orgSlug}/${record.appSlug}`, record]));
+    for (const app of apps.values())
+        await onPurge?.(app.orgSlug, app.appSlug, new Date().toISOString(), true);
     return deleted;
 }
 /** The `apps` resource, store-first with a no-store fallback over the registry's own record cache. */

package/node_modules/@noodle-borg/service/dist/registry-targets.js

@@ -1,7 +1,34 @@
 import { createHash, randomUUID } from 'node:crypto';
+import { RECORD_CONNECTOR_ID } from '@noodle-borg/compiler';
 import { parseAppPackageSnapshot } from './app-package-snapshot.js';
 import { hasExactCustomerAuthProjection } from './customer-auth-audience-binding.js';
 import { deploymentOwnerSubject } from './registry-helpers.js';
+import { validateTenantRef } from './store.js';
+/** Replace only the platform record port; unrelated compiled runtime ports retain their authority. */
+export function rebindNativeRecords(target, record, factory) {
+    const native = factory?.({
+        tenant: recordTenant(record),
+        artifact: target.served.artifact,
+        deploymentId: record.deploymentId,
+    });
+    const previous = target.served.deps.connectors;
+    return {
+        ...target,
+        served: {
+            ...target.served,
+            deps: {
+                ...target.served.deps,
+                connectors: {
+                    resolve: (ref) => ref.connectorId === RECORD_CONNECTOR_ID
+                        ? native?.version === ref.connectorVersion
+                            ? native
+                            : undefined
+                        : previous.resolve(ref),
+                },
+            },
+        },
+    };
+}
 /**
  * Build the front-door {@link ServedTarget} for a persisted record: its access mode plus the credential the
  * front-door checks. Legacy alpha records without an identity access mode are not served.
@@ -163,4 +190,26 @@ function deploymentSlug(name) {
         .replace(/[^a-z0-9]+/g, '-')
         .replace(/^-+|-+$/g, '') || 'server');
 }
+/** Immutable source projection shared by registry installation consumers. */
+export async function deploymentSourceFor(state, tenant, deploymentId) {
+    const safeTenant = validateTenantRef(tenant);
+    const record = state.store
+        ? await state.store.get(deploymentId)
+        : state.records.get(deploymentId);
+    if (record === undefined ||
+        record.archivedAt !== undefined ||
+        record.orgSlug !== safeTenant.org ||
+        record.appSlug !== safeTenant.app ||
+        record.environment !== safeTenant.env)
+        return undefined;
+    return {
+        manifest: record.manifest,
+        ...(record.connectors === undefined ? {} : { connectors: record.connectors }),
+        ...(record.hostedAssets === undefined
+            ? {}
+            : { hostedAssets: structuredClone(record.hostedAssets) }),
+        ...(record.accessMode === undefined ? {} : { accessMode: record.accessMode }),
+        ...(record.serverVersion === undefined ? {} : { serverVersion: record.serverVersion }),
+    };
+}
 //# sourceMappingURL=registry-targets.js.map