@noodleseed/one 0.161.2 → 0.163.0

package/node_modules/@noodle-borg/service/dist/routes/control-plane.js

@@ -1,17 +1,13 @@
-import { cspFaultsInManifest } from '@noodle-borg/compiler';
 import { ensurePersonalWorkspace } from '@noodle-borg/control-plane/portable';
 import { DEVELOPER_ASSISTANT_PATH, DEVELOPER_CLI_PATH, } from '@noodle-borg/developer-mcp';
 import { normalizeServerVersion } from '@noodle-borg/module';
-import { noopLogger, readDeployBody, sendJson } from '@noodle-borg/transport-http';
+import { readDeployBody, sendJson } from '@noodle-borg/transport-http';
 import { deployRequestSchema, formatWireError, WhoamiIdentityResponseSchema, } from '@noodle-borg/wire-contracts';
 import { authorizeDeveloperGrant, } from '../auth/developer-grant-guard.js';
+import { executeAuthorizedDeployment } from '../deployment-execution.js';
 import { baseFromRequest, sendForbidden, sendUnauthorized } from '../http-util.js';
 import { endpointUrlOptionsForOrg } from '../mcp-public-routing.js';
-import { manifestUsesUserRoot } from '../registry-access.js';
-import { isIdentityAccessMode } from './access-mode.js';
 import { validateDeployIdempotency } from './deploy-idempotency.js';
-import { provisionPublicEmbed } from './deploy-public-embed.js';
-import { respondDeploymentActivationError } from './deployment-activation-response.js';
 import { tenantMcpUrl } from './endpoint-enrichment.js';
 import { canManageMembers } from './org-admin.js';
 export async function handleDeploy(req, res, registry, options, maxBody, tenant, gate, controlPlane, audit) {
@@ -172,235 +168,25 @@ export async function handleDeploy(req, res, registry, options, maxBody, tenant,
             code: 'owner_only_unsupported_for_automation',
         });
     }
-    // Identity access modes bind the data plane to verified identity, so the deployer must be authenticated.
-    // (Localhost dev runs the gate open; such deploys are rejected for lack of an owner/audit actor.)
-    if (isIdentityAccessMode(accessMode) && !identity) {
-        return sendJson(res, 401, {
-            error: `${accessMode} deployments require an authenticated deployer`,
-        });
-    }
-    if (accessMode === 'public' && manifestUsesUserRoot(manifest)) {
-        return sendJson(res, 400, {
-            error: 'public access mode cannot reference ${user}; use mixed for optional identity',
-        });
-    }
-    // Widget CSP gate (deploy-only): a CSP origin the host renderer will silently drop breaks the widget
-    // for end users, so the deploy is refused here. The compiler surfaces the same faults as non-blocking
-    // warnings, so `noodle dev`/`validate` still render the widget locally — only shipping is gated.
-    const [cspFault] = cspFaultsInManifest(manifest);
-    if (cspFault !== undefined) {
-        return sendJson(res, 400, {
-            error: `widget "${cspFault.widget}" CSP ${cspFault.list} origin "${cspFault.value}" is not an ` +
-                `absolute https:// origin and would be dropped by the host renderer` +
-                (cspFault.suggestion !== undefined ? `; use "${cspFault.suggestion}"` : ''),
-        });
-    }
-    if ((await controlPlane.getOrg(tenant.org)) === undefined) {
-        await audit.emit({
-            eventType: 'deploy.rejected',
-            org: tenant.org,
-            app: tenant.app,
-            env: tenant.env,
-            decision: 'deny',
-            status: 404,
-            reasonCode: 'organization_not_found',
-            ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
-            ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
-        });
-        return sendJson(res, 404, {
-            code: 'organization_not_found',
-            error: 'organization must be created before deploy',
-        });
-    }
-    const logger = options.logger ?? noopLogger;
-    if (hostedAssets !== undefined && hostedAssets.length > 0) {
-        if (options.assetStore === undefined) {
-            await audit.emit({
-                eventType: 'asset.rejected',
-                org: tenant.org,
-                app: tenant.app,
-                env: tenant.env,
-                decision: 'deny',
-                status: 400,
-                reasonCode: 'asset_store_not_configured',
-                ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
-                ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
-                details: { assetCount: hostedAssets.length },
-            });
-            return sendJson(res, 400, { error: 'hosted assets are not configured for this service' });
-        }
-        const verified = await options.assetStore.verifyUploadedAssets({
-            scope: tenant,
-            assets: hostedAssets,
-        });
-        if (!verified.ok) {
-            await audit.emit({
-                eventType: 'asset.rejected',
-                org: tenant.org,
-                app: tenant.app,
-                env: tenant.env,
-                decision: 'deny',
-                status: 400,
-                reasonCode: 'asset_verification_failed',
-                ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
-                ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
-                details: { assetCount: hostedAssets.length },
-            });
-            return sendJson(res, 400, { error: verified.error });
-        }
-        hostedAssets = verified.assets;
-    }
-    let result;
-    try {
-        result = await registry.deploy(tenant, manifest, {
-            connectors,
-            actor: identity || undefined,
-            accessMode,
-            ownerSubject,
-            ...(orgMembershipSources !== undefined ? { orgMembershipSources } : {}),
-            hostedAssets,
-            serverVersion,
-            deploymentSource: automationId === undefined ? (deploymentSource ?? 'api') : 'github',
-            ...(idempotency.key !== undefined ? { idempotencyKey: idempotency.key } : {}),
-            ...(automationId === undefined ? {} : { automationId }),
-        });
-    }
-    catch (error) {
-        const handled = await respondDeploymentActivationError(res, error, {
-            audit,
-            eventType: 'deploy.rejected',
-            org: tenant.org,
-            app: tenant.app,
-            env: tenant.env,
-            ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
-            ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
-        });
-        if (handled)
-            return;
-        throw error;
-    }
-    if (!result.ok) {
-        if ('conflict' in result) {
-            if (result.code === 'deployment_locked') {
-                await audit.emit({
-                    eventType: 'deploy.rejected',
-                    org: tenant.org,
-                    app: tenant.app,
-                    env: tenant.env,
-                    decision: 'deny',
-                    status: 409,
-                    reasonCode: result.code,
-                    ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
-                    ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
-                    details: { serverVersion },
-                });
-            }
-            return sendJson(res, 409, {
-                ok: false,
-                code: result.code,
-                error: result.message,
-            });
-        }
-        if ('superseded' in result) {
-            if (automationId !== undefined) {
-                await options.deploymentAutomation
-                    ?.recordSuperseded?.({ automationId, target: tenant })
-                    .catch(() => undefined);
-            }
-            return sendJson(res, 409, {
-                ok: false,
-                code: 'run_superseded',
-                error: 'a newer GitHub deploy run exists for this app/env; this run was not activated',
-                deploymentId: result.deploymentId,
-                ...(result.serverVersion !== undefined ? { serverVersion: result.serverVersion } : {}),
-            });
-        }
-        // Codes are safe enum strings; never a path-with-value. No secret name or value is logged.
-        const codes = result.errors.map((error) => error.code).join(',');
-        logger.warn('deploy.rejected', {
-            status: 400,
-            errorCount: result.errors.length,
-            codes,
-        });
-        // Durable audit: a rejected deploy is a governance event. Safe fields only — no manifest body.
-        await audit.emit({
-            eventType: 'deploy.rejected',
-            org: tenant.org,
-            app: tenant.app,
-            env: tenant.env,
-            decision: 'deny',
-            status: 400,
-            reasonCode: 'compile_failed',
-            ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
-            ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
-            details: { errorCount: result.errors.length, codes },
-        });
-        return sendJson(res, 400, { ok: false, errors: result.errors });
-    }
-    // Counts only — never secret names or values.
-    logger.info('deploy.ok', {
-        deploymentId: result.deploymentId,
-        serverVersion: result.serverVersion,
-        org: tenant.org,
-        app: tenant.app,
-        env: tenant.env,
-        hasConnectors: connectors !== undefined,
-    });
-    await audit.emit({
-        eventType: 'deploy.accepted',
-        org: tenant.org,
-        app: tenant.app,
-        env: tenant.env,
-        decision: 'allow',
-        status: 201,
-        ...(result.deploymentId !== undefined ? { deploymentId: result.deploymentId } : {}),
-        ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
-        ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
-        details: {
-            accessMode: result.accessMode ?? accessMode,
-            deploymentSource: automationId === undefined ? (deploymentSource ?? 'api') : 'github',
-            ...(ownerSubject !== undefined ? { ownerSubject } : {}),
-            serverVersion: result.serverVersion,
-            hasConnectors: connectors !== undefined,
-        },
-    });
-    // Tenant-safe developer-facing log (M3, ADR 0101): a safe deploy-lifecycle record the developer can read
-    // via `noodle logs`. Only scalar metadata, no manifest/secret/payload material.
-    await options.userAppLogStore?.emit({
-        level: 'info',
-        message: 'deployment live',
-        org: tenant.org,
-        app: tenant.app,
-        env: tenant.env,
-        ...(result.deploymentId !== undefined ? { deploymentId: result.deploymentId } : {}),
-        details: { accessMode: result.accessMode ?? accessMode, serverVersion: result.serverVersion },
-    });
-    if (result.ok && hostedAssets !== undefined && hostedAssets.length > 0) {
-        await audit.emit({
-            eventType: 'asset.activation.accepted',
-            org: tenant.org,
-            app: tenant.app,
-            env: tenant.env,
-            decision: 'allow',
-            status: 201,
-            deploymentId: result.deploymentId,
-            ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
-            ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
-            details: {
-                assetCount: hostedAssets.length,
-                totalBytes: hostedAssets.reduce((sum, asset) => sum + asset.byteLength, 0),
-            },
-        });
-        await options.assetStore?.recordReachability({
-            scope: tenant,
-            deploymentId: result.deploymentId,
-            deploymentVersion: result.deploymentVersion,
-            assets: hostedAssets,
-        });
-    }
+    const executed = await executeAuthorizedDeployment({
+        tenant,
+        manifest,
+        connectors,
+        hostedAssets,
+        accessMode,
+        identity,
+        ownerSubject,
+        orgMembershipSources,
+        deploymentSource,
+        serverVersion,
+        idempotencyKey: idempotency.key,
+        automationId,
+    }, { registry, options, controlPlane, audit });
+    if (!executed.ok)
+        return sendJson(res, executed.status, executed.body);
+    const { result, embedId } = executed;
     const base = options.publicBaseUrl ?? baseFromRequest(req, options.tls ?? {});
     const endpointOptions = await endpointUrlOptionsForOrg(options, controlPlane, tenant.org);
-    const embedId = await provisionPublicEmbed(registry, options, tenant, result.deploymentId);
     return sendJson(res, 201, {
         ok: true,
         org: tenant.org,

package/node_modules/@noodle-borg/service/dist/routes/deployment-activation-response.js

@@ -2,11 +2,18 @@ import { DeploymentActivationError } from '@noodle-borg/module';
 import { sendJson } from '@noodle-borg/transport-http';
 /** Translate provider-neutral activation failures without exposing commercial account details. */
 export async function respondDeploymentActivationError(res, error, context) {
-    if (!(error instanceof DeploymentActivationError))
+    const rejected = await deploymentActivationRejection(error, context);
+    if (rejected === undefined)
         return false;
+    sendJson(res, rejected.status, rejected.body);
+    return true;
+}
+export async function deploymentActivationRejection(error, context) {
+    if (!(error instanceof DeploymentActivationError))
+        return undefined;
     const response = deploymentActivationResponse(error.code);
     if (response === undefined)
-        return false;
+        return undefined;
     await context.audit.emit({
         eventType: context.eventType,
         org: context.org,
@@ -18,8 +25,10 @@ export async function respondDeploymentActivationError(res, error, context) {
         ...(context.actorSubject !== undefined ? { actorSubject: context.actorSubject } : {}),
         ...(context.actorEmail !== undefined ? { actorEmail: context.actorEmail } : {}),
     });
-    sendJson(res, response.status, { ok: false, code: error.code, error: response.message });
-    return true;
+    return {
+        status: response.status,
+        body: { ok: false, code: error.code, error: response.message },
+    };
 }
 function deploymentActivationResponse(code) {
     if (code === 'production_app_limit_exceeded') {

package/node_modules/@noodle-borg/service/dist/service-resource-cleanup.js

@@ -4,6 +4,12 @@ export async function closeServiceResources(input) {
         clearInterval(input.welcomeEmailTimer);
     if (input.feedbackOperationsTimer !== undefined)
         clearInterval(input.feedbackOperationsTimer);
+    if (input.businessInformationTimer !== undefined)
+        clearInterval(input.businessInformationTimer);
+    input.stopBusinessInformationSweep?.();
+    if (input.businessInformationSourceTimer !== undefined) {
+        clearInterval(input.businessInformationSourceTimer);
+    }
     clearInterval(input.alertTimer);
     const errors = [];
     const moduleHost = input.moduleHost;

package/node_modules/@noodle-borg/service/dist/service.js

@@ -1,13 +1,17 @@
+import { InMemoryDailyCounterStore } from '@noodle-borg/admission-limits/portable';
 import { InMemoryAssistantAppearanceSettingsStore, InMemoryAssistantStore, } from '@noodle-borg/assistant-gateway/portable';
 import { allowAllGate, InMemoryControlPlaneStore } from '@noodle-borg/control-plane/portable';
 import { dispatchKnowledgeRequest } from '@noodle-borg/knowledge-operations/portable';
 import { OPENAI_APPS_CHALLENGE_PATH } from '@noodle-borg/module';
 import { applySecurityHeaders, createMcpRouter, enforceHttps, noopLogger, sendJson, } from '@noodle-borg/transport-http';
 import { AnonymousConsumerLimiter, createAdmissionGate } from './admission.js';
+import { ApplicationActivity } from './application-activity.js';
+import { createApplicationServingRuntime } from './application-runtime-target.js';
 import { createArchivePreflight } from './archive-preflight.js';
 import { ArchiveSweeper, resolveArchiveRetentionDays } from './archive-sweeper.js';
 import { serveLocalAsset } from './assets.js';
 import { resolveBuildInfo, serviceInfoPayload } from './build-info.js';
+import { createBusinessInformationRuntime, resolvePrivateInstallationDefinition, } from './business-information-runtime.js';
 import { serviceCapabilityReport } from './capabilities.js';
 import { rejectIncompatibleCli } from './client-compatibility.js';
 import { createDataPlaneMembershipAuthorizer } from './data-plane-membership.js';
@@ -21,6 +25,7 @@ import { createServiceModuleProviders } from './modules/host.js';
 import { dispatchModuleRoutes } from './modules/route-dispatch.js';
 import { isAuthServerPath } from './oauth/paths.js';
 import { createIntentTargetResolver, createObservabilityDispatcher, createObservabilityStores, } from './observability-runtime.js';
+import { createRecoveryQuarantineHandler, resolveRecoveryMode } from './recovery-quarantine.js';
 import { handleAccessUpdate } from './routes/access.js';
 import { dispatchAlertRoutes } from './routes/alerts-dispatch.js';
 import { handleAppPurgeReconciliationRoute, } from './routes/app-purge-reconciliation.js';
@@ -28,6 +33,7 @@ import { handleAppArchive, handleAppRestore } from './routes/archive.js';
 import { handleAssetPreflight } from './routes/asset-control-plane.js';
 import { dispatchAssistantRoutes } from './routes/assistant-dispatch.js';
 import { dispatchAuthDiscoveryRoute } from './routes/auth-discovery.js';
+import { dispatchBusinessInformationRoutes } from './routes/business-information-dispatch.js';
 import { dispatchConfigValueRequest } from './routes/config-values-dispatch.js';
 import { authorizeTenantControl, handleDeploymentStatus, handleWhoami, } from './routes/control-plane.js';
 import { dispatchCredentialAuthRoutes } from './routes/credential-auth-dispatch.js';
@@ -44,13 +50,14 @@ import { dispatchResourceReads } from './routes/resource-read-dispatch.js';
 import { handleRollback } from './routes/rollback.js';
 import { createServicePrincipalDispatcher } from './routes/service-principals-dispatch.js';
 import { servicePrincipalDataPlaneHooks } from './service-principal-data-plane.js';
-import { BUILTIN_STATE_CATALOG_CONNECTOR } from './state-catalog.js';
 import { InMemoryAlertRuleStore } from './store/alert-rules.js';
 import { StdoutAuditSink } from './store/audit.js';
 const DEFAULT_MAX_BODY = 1 << 20;
 const DEFAULT_MAX_DEPLOY_BODY = 32 * 1024 * 1024;
 /** The combined service listener: tenant-scoped deploy management plus the multi-tenant MCP router. */
 export function createServiceHandler(registry, options = {}) {
+    if (resolveRecoveryMode(options.recoveryMode) === 'quarantined')
+        return createRecoveryQuarantineHandler(options);
     const logger = options.logger ?? noopLogger;
     const tls = options.tls ?? {};
     const buildInfo = options.buildInfo ?? resolveBuildInfo();
@@ -62,14 +69,19 @@ export function createServiceHandler(registry, options = {}) {
     const assistantStore = options.assistantStore ?? new InMemoryAssistantStore();
     const assistantAppearance = options.assistantAppearance ?? new InMemoryAssistantAppearanceSettingsStore();
     const anonymousLimiter = new AnonymousConsumerLimiter();
-    registry.setPlatformConnectors({ catalog: [BUILTIN_STATE_CATALOG_CONNECTOR], connectors: [] });
+    const publicCounters = options.admissionCounters ?? new InMemoryDailyCounterStore();
+    const { businessInformationStore, businessInformationSourceStore, sourceCoordinator } = createBusinessInformationRuntime(registry, options, publicCounters);
     const moduleProviders = createServiceModuleProviders({
         options,
         auditMirror: new StdoutAuditSink(logger),
         admissionGate: createAdmissionGate(anonymousLimiter, { emit: (event) => activeAudit.emit(event) }, options.admissionGate),
     });
     const moduleHost = moduleProviders.host;
-    const providerOptions = moduleProviders.options;
+    businessInformationStore?.configurePrincipalAuthority(moduleHost.platformHumanIdentity);
+    const providerOptions = {
+        ...moduleProviders.options,
+        ...(businessInformationStore ? { businessInformationStore } : {}),
+    };
     const verifyOwnerToken = moduleProviders.verifyOwnerToken;
     const capabilityReport = serviceCapabilityReport(moduleHost);
     registry.setServiceCapabilities(capabilityReport.capabilities);
@@ -77,8 +89,16 @@ export function createServiceHandler(registry, options = {}) {
     activeAudit = audit;
     const { publicTenantRouting } = mcp.mcpRoutingOptions(options, controlPlane);
     const resolveEndpointOptions = (org) => mcp.endpointUrlOptionsForOrg(options, controlPlane, org);
+    const activity = options.operationEvidence === undefined
+        ? undefined
+        : new ApplicationActivity({
+            ...options.operationEvidence,
+            allowance: async (org, request) => moduleHost.resolveActivityHistoryAllowance?.(org, request),
+        });
     const withIntentMode = createIntentTargetResolver(intentSettings, intentPreviewOrgs);
-    const router = createMcpRouter(async (id) => withIntentMode(await registry.getServing(id)), {
+    const { activateInstallation, resolveRuntimeTarget, businessOnboarding } = createApplicationServingRuntime(registry, providerOptions, controlPlane, audit, activity);
+    const runtimeTarget = async (target) => target === undefined ? undefined : resolveRuntimeTarget(target);
+    const router = createMcpRouter(async (id) => withIntentMode(await runtimeTarget(await registry.getServing(id))), {
         logger,
         tls,
         protocolMode: options.mcpProtocolMode ?? 'dual',
@@ -108,9 +128,9 @@ export function createServiceHandler(registry, options = {}) {
             }),
         admissionGate: moduleHost.admissionGate,
         ...(publicTenantRouting !== undefined ? { publicTenantRouting } : {}),
-        tenantLookup: async (ref) => withIntentMode(ref.serverVersion === undefined
+        tenantLookup: async (ref) => withIntentMode(await runtimeTarget(ref.serverVersion === undefined
             ? await registry.getActiveByTenant(ref)
-            : await registry.getActiveByTenantVersion(ref, ref.serverVersion), ref),
+            : await registry.getActiveByTenantVersion(ref, ref.serverVersion)), ref),
         tenantPreflight: createArchivePreflight(registry),
     });
     const maxBody = options.maxBodyBytes ?? DEFAULT_MAX_BODY;
@@ -256,8 +276,56 @@ export function createServiceHandler(registry, options = {}) {
         }
         if (servicePrincipalDispatcher?.(req, res, url))
             return;
+        if (businessInformationStore !== undefined &&
+            options.businessInformationEnabled !== false &&
+            dispatchBusinessInformationRoutes(req, res, url, {
+                store: businessInformationStore,
+                ...(businessOnboarding ? { businessOnboarding } : {}),
+                activateInstallation,
+                ...(activity === undefined ? {} : { activity }),
+                ...(options.connectionRuntime === undefined
+                    ? {}
+                    : {
+                        connections: options.connectionRuntime.connections,
+                        resolveConnectionTargets: options.connectionRuntime.resolveConnectionTargets,
+                    }),
+                configStore,
+                registry,
+                resolveEndpointBase: (request) => options.publicBaseUrl ?? baseFromRequest(request, tls),
+                resolveEndpointUrlOptions: resolveEndpointOptions,
+                ...(options.publicEmbeds === undefined ? {} : { publicEmbeds: options.publicEmbeds }),
+                admissionCounters: publicCounters,
+                ...(options.admissionEnvelope === undefined
+                    ? {}
+                    : { admissionEnvelope: options.admissionEnvelope }),
+                ...(options.managedAssistantModelResolver === undefined
+                    ? {}
+                    : { managedModelResolver: options.managedAssistantModelResolver }),
+                gate,
+                controlPlane,
+                maxBody,
+                publicCounters,
+                audit: activeAudit,
+                trustProxy: tls.trustProxy === true,
+                publicIntakeEnabled: options.businessInformationPublicIntakeEnabled !== false,
+                resolvePrivateDefinition: (selector) => resolvePrivateInstallationDefinition(registry, selector),
+                ...(businessInformationSourceStore === undefined
+                    ? {}
+                    : { sourceStore: businessInformationSourceStore }),
+                ...(sourceCoordinator === undefined
+                    ? {}
+                    : { runSourceIngestion: async () => void (await sourceCoordinator.runOne()) }),
+                ...(options.clock === undefined ? {} : { now: options.clock }),
+                logger,
+                tls,
+                applySecurityHeaders,
+                enforceHttps,
+            })) {
+            return;
+        }
         if (dispatchAssistantRoutes(req, res, url, {
             registry,
+            resolveRuntimeTarget,
             store: assistantStore,
             appearance: assistantAppearance,
             ...(options.publicEmbeds !== undefined ? { publicEmbeds: options.publicEmbeds } : {}),
@@ -398,6 +466,9 @@ export function createServiceHandler(registry, options = {}) {
             controlPlane,
             configStore,
             registry,
+            ...(businessInformationStore === undefined
+                ? {}
+                : { installations: businessInformationStore }),
             maxBody,
             audit,
             ...(options.developerGrantStore !== undefined

package/node_modules/@noodle-borg/service/dist/solution-installation-activation.js

@@ -0,0 +1,149 @@
+import { sha256Canonical } from '@noodle-borg/app-package';
+import { ApplicationSettings, installationSettingsTarget } from './application-settings.js';
+import { privateDefinitionFromDeployment } from './business-information/definition-resolver.js';
+import { managedSolutionManifest } from './business-information/managed-solution-executable.js';
+import { BUSINESS_SETUP_MESSAGE, BusinessOnboarding } from './business-onboarding.js';
+import { executeAuthorizedDeployment, } from './deployment-execution.js';
+/** Called after installation authorization, and by the managed-runtime refresh boundary. Never copies configuration. */
+export async function activateSolutionInstallation(input, dependencies) {
+    const { installation, actor } = input;
+    if (dependencies.options.businessOnboarding !== undefined &&
+        (!dependencies.businessInformationStore ||
+            !(await new BusinessOnboarding(dependencies.options.businessOnboarding, dependencies.controlPlane, dependencies.businessInformationStore).ready(installation)))) {
+        return reject(409, 'business_setup_required', BUSINESS_SETUP_MESSAGE);
+    }
+    const tenant = {
+        org: installation.scope.org,
+        app: installation.scope.app,
+        env: installation.scope.env,
+    };
+    const store = dependencies.businessInformationStore;
+    const stored = (await store?.getInstallation(installation.scope)) ?? installation;
+    const generation = await dependencies.registry.getAppGeneration(tenant.org, tenant.app);
+    if ((await dependencies.registry.getAppArchivedAt(tenant.org, tenant.app)) !== undefined ||
+        (stored.applicationGeneration !== 'pending' &&
+            (generation === undefined ||
+                (stored.applicationGeneration !== undefined &&
+                    stored.applicationGeneration !== generation)))) {
+        return reject(409, 'installation_application_unavailable', 'Restore the original application before activation. Retained records remain accessible.');
+    }
+    if (store &&
+        stored.applicationGeneration !== 'pending' &&
+        !(await store.bindApplication(installation.scope, generation ?? ''))) {
+        return reject(409, 'installation_application_unavailable', 'The retained installation requires application ownership recovery before activation.');
+    }
+    const bind = async (deploymentId) => {
+        const currentGeneration = await dependencies.registry.getAppGeneration(tenant.org, tenant.app);
+        if (store &&
+            (!currentGeneration || !(await store.bindApplication(installation.scope, currentGeneration))))
+            return reject(409, 'installation_application_unavailable', 'Application activation was interrupted; retained records remain accessible.');
+        if ((installation.definition.variables?.length ?? 0) > 0)
+            await new ApplicationSettings(dependencies.registry.configStore).initialize(installationSettingsTarget(installation));
+        return { ok: true, deploymentId };
+    };
+    const source = await executableSource(installation, dependencies.registry);
+    if (!source.ok)
+        return source;
+    const current = await dependencies.registry.getActiveByTenant(tenant);
+    const declarations = current?.served.artifact.server.variables ?? installation.definition.variables ?? [];
+    if (declarations.length > 0)
+        await new ApplicationSettings(dependencies.registry.configStore).initialize({
+            ...installationSettingsTarget(installation),
+            declarations,
+        });
+    const accessMode = current?.accessMode ?? source.value.accessMode;
+    const ownerSubject = accessMode === 'owner-only'
+        ? (current?.ownerSubject ?? installation.createdBySubject)
+        : undefined;
+    const currentSource = current?.deploymentId === undefined
+        ? undefined
+        : await dependencies.registry.getDeploymentSource(tenant, current.deploymentId);
+    if (current?.deploymentId !== undefined &&
+        currentSource !== undefined &&
+        currentSource.manifest === source.value.manifest &&
+        currentSource.connectors === source.value.connectors &&
+        JSON.stringify(currentSource.hostedAssets) === JSON.stringify(source.value.hostedAssets)) {
+        return bind(current.deploymentId);
+    }
+    const key = sha256Canonical({
+        scope: installation.scope,
+        definition: installation.definition.reference,
+        executable: source.value,
+        accessMode,
+        ownerSubject: ownerSubject ?? null,
+        orgMembershipSources: current?.orgMembershipSources ?? null,
+        predecessor: current?.deploymentId ?? null,
+    });
+    const deployed = await executeAuthorizedDeployment({
+        ...source.value,
+        tenant,
+        identity: actor,
+        accessMode,
+        ...(ownerSubject === undefined ? {} : { ownerSubject }),
+        ...(current?.orgMembershipSources === undefined
+            ? {}
+            : { orgMembershipSources: current.orgMembershipSources }),
+        deploymentSource: 'api',
+        idempotencyKey: key,
+    }, dependencies);
+    if (!deployed.ok)
+        return {
+            ok: false,
+            status: deployed.status,
+            code: typeof deployed.body.code === 'string'
+                ? deployed.body.code
+                : 'installation_activation_failed',
+            message: 'The installation is saved, but its application could not be activated. Retry installation after resolving the deployment requirement.',
+        };
+    return bind(deployed.result.deploymentId);
+}
+async function executableSource(installation, registry) {
+    const reference = installation.definition.reference;
+    if (reference.kind === 'managed') {
+        return {
+            ok: true,
+            value: {
+                manifest: JSON.stringify(managedSolutionManifest(installation.definition)),
+                accessMode: 'public',
+                serverVersion: '1',
+            },
+        };
+    }
+    if (reference.kind !== 'private')
+        return reject(409, 'definition_unavailable', 'This historical definition has no executable application.');
+    if (reference.publisherOrg !== installation.scope.org)
+        return reject(403, 'definition_forbidden', 'Private definitions must belong to the installation organization.');
+    const sourceScope = { org: reference.publisherOrg, app: reference.app, env: reference.env };
+    const source = await registry.getDeploymentSource(sourceScope, reference.deploymentId);
+    if (source === undefined)
+        return reject(409, 'definition_unavailable', 'The immutable source deployment is unavailable or archived.');
+    const target = await registry.get(reference.deploymentId);
+    if (target === undefined)
+        return reject(409, 'definition_unavailable', 'The immutable source deployment cannot be loaded.');
+    const verified = privateDefinitionFromDeployment({
+        publisherOrg: reference.publisherOrg,
+        app: reference.app,
+        environment: reference.env,
+        deploymentId: reference.deploymentId,
+    }, {
+        ...sourceScope,
+        environment: sourceScope.env,
+        deploymentId: reference.deploymentId,
+        artifact: target.served.artifact,
+    });
+    if (verified.reference.digest !== reference.digest)
+        return reject(409, 'definition_changed', 'The installation definition does not match its immutable source deployment.');
+    return {
+        ok: true,
+        value: {
+            ...source,
+            accessMode: source.accessMode ?? 'public',
+            serverVersion: source.serverVersion ?? '1',
+            assetSourceScope: sourceScope,
+        },
+    };
+}
+function reject(status, code, message) {
+    return { ok: false, status, code, message };
+}
+//# sourceMappingURL=solution-installation-activation.js.map