@noodleseed/one 0.162.0 → 0.163.0

package/node_modules/@noodle-borg/service/dist/operation-evidence.js

@@ -0,0 +1,89 @@
+import { createHmac, randomUUID } from 'node:crypto';
+import { canonicalJson } from '@noodle-borg/compiler';
+/** Generic execution evidence adapter. It stores no application input and cannot dispatch or replay work. */
+export function createOperationEvidencePort(options) {
+    if (options.identityKey.length < 32 || !/^[A-Za-z0-9_-]{16,128}$/.test(options.epoch))
+        throw new Error('Invalid operation evidence configuration');
+    const hash = (value) => createHmac('sha256', options.identityKey).update(canonicalJson(value)).digest('hex');
+    const now = () => options.now?.() ?? Date.now();
+    return {
+        async begin(intent) {
+            const startedAt = now();
+            const bound = options.executionBoundMs(intent);
+            const days = await options.historyDays();
+            if (!Number.isSafeInteger(bound) ||
+                bound === undefined ||
+                bound < 1 ||
+                !Number.isInteger(days) ||
+                days < 1 ||
+                days > 365 ||
+                bound >= days * 86_400_000 ||
+                !(await options.authorize(intent)))
+                throw new Error('Operation evidence authority unavailable');
+            const connectionId = intent.operation.credentialBinding?.connectionId;
+            const generation = connectionId === undefined ? undefined : options.connectionGeneration(connectionId);
+            if (connectionId !== undefined && generation === undefined)
+                throw new Error('Original connected account unavailable');
+            const record = {
+                scope: options.scope,
+                id: intent.id,
+                lease: randomUUID(),
+                epoch: options.epoch,
+                deploymentId: options.deploymentId,
+                tool: intent.tool,
+                connector: intent.operation.connectorId,
+                operation: intent.operation.operation,
+                ...(connectionId === undefined ? {} : { connectionId }),
+                ...(generation === undefined ? {} : { generation }),
+                actorDigest: hash(intent.caller ?? null),
+                intentDigest: hash({
+                    scope: options.scope,
+                    deploymentId: options.deploymentId,
+                    epoch: options.epoch,
+                    operation: intent.operation,
+                    input: intent.arguments,
+                    caller: intent.caller ?? null,
+                    revision: intent.executionRevision ?? null,
+                    generation: generation ?? null,
+                }),
+                startedAt,
+                executionDeadline: startedAt + bound,
+                historyExpiresAt: startedAt + days * 86_400_000,
+                outcome: 'dispatching',
+            };
+            if (!(await options.store.claim(record)))
+                return undefined;
+            return {
+                async finish(evidence) {
+                    const completionDays = await options.historyDays();
+                    if (!Number.isInteger(completionDays) || completionDays < 1 || completionDays > 365)
+                        throw new Error('Operation history policy unavailable');
+                    if (!(await options.store.finish(options.scope, record.id, record.lease, record.epoch, evidence, now(), completionDays)))
+                        throw new Error('Operation evidence claim expired');
+                },
+            };
+        },
+    };
+}
+/** Store adapters use the same narrow transition; late results cannot replace an expired/terminal claim. */
+export function completeOperationEvidence(record, lease, epoch, evidence, now, historyDays) {
+    if (record.lease !== lease ||
+        record.epoch !== epoch ||
+        record.outcome !== 'dispatching' ||
+        record.executionDeadline <= now)
+        return undefined;
+    return {
+        ...record,
+        outcome: evidence.outcome,
+        completedAt: now,
+        historyExpiresAt: now +
+            (historyDays === undefined
+                ? record.historyExpiresAt - record.startedAt
+                : historyDays * 86_400_000),
+        ...(evidence.reference === undefined ? {} : { reference: evidence.reference }),
+    };
+}
+export function operationEvidenceKey(scope, id) {
+    return JSON.stringify([scope.org, scope.app, scope.env, scope.installationId, id]);
+}
+//# sourceMappingURL=operation-evidence.js.map

package/node_modules/@noodle-borg/service/dist/recovery-quarantine.js

@@ -0,0 +1,49 @@
+import { createServer } from 'node:http';
+import { applySecurityHeaders, sendJson } from '@noodle-borg/transport-http';
+import { resolveBuildInfo, serviceInfoPayload } from './build-info.js';
+import { ServerRegistry } from './registry.js';
+import { closeHttpServer, listenHttpServer } from './service-resource-cleanup.js';
+export function resolveRecoveryMode(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === 'quarantined' || value === 'reopened')
+        return value;
+    throw new Error('Invalid recovery mode; expected quarantined or reopened');
+}
+/** Deliberately no authorization/store lookup, artifact serving or application dispatch. */
+export function createRecoveryQuarantineHandler(options) {
+    const build = options.buildInfo ?? resolveBuildInfo();
+    return (req, res) => {
+        applySecurityHeaders(res, options.tls ?? {});
+        res.setHeader('cache-control', 'no-store');
+        const path = new URL(req.url ?? '/', 'http://localhost').pathname;
+        if (req.method === 'GET') {
+            if (path === '/healthz')
+                return sendJson(res, 200, { status: 'ok' });
+            if (path === '/readyz')
+                return sendJson(res, 503, { status: 'quarantined' });
+            if (path === '/v1/service/info')
+                return sendJson(res, 200, serviceInfoPayload(build, false));
+        }
+        sendJson(res, 503, {
+            error: 'This service is quarantined for recovery.',
+            code: 'recovery_quarantined',
+        });
+    };
+}
+/** No restored store is constructed or borrowed; even startup migrations/workers remain stopped. */
+export async function serveRecoveryQuarantine(options) {
+    const host = options.host ?? '127.0.0.1';
+    const http = createServer(createRecoveryQuarantineHandler(options));
+    await listenHttpServer(http, options.port ?? 8787, host);
+    const { port } = http.address();
+    return {
+        http,
+        port,
+        url: `http://${host.includes(':') ? `[${host}]` : host}:${port}`,
+        // The existing programmatic return contract gets an empty local registry, never restored authority.
+        registry: new ServerRegistry(),
+        close: () => closeHttpServer(http),
+    };
+}
+//# sourceMappingURL=recovery-quarantine.js.map

package/node_modules/@noodle-borg/service/dist/registry-compile.js

@@ -1,7 +1,7 @@
 import { publicSurfaceDelegatedAuthErrors } from '@noodle-borg/assistant-gateway/portable';
-import { compile, InMemoryCatalog, } from '@noodle-borg/compiler';
+import { compile, InMemoryCatalog, RECORD_CONNECTOR_ID, } from '@noodle-borg/compiler';
 import { compileConnectors, delegatedTokenExchangeIdentityErrors, } from '@noodle-borg/connector-defs';
-import { InMemoryConnectorRegistry, resolveManagedOrigins, } from '@noodle-borg/runtime';
+import { InMemoryConnectorRegistry, resolveManagedOrigins, resolveVariableEnvironment, } from '@noodle-borg/runtime';
 import { AppPackageSnapshotError, createAppPackageSnapshot, } from './app-package-snapshot.js';
 import { missingServerConfigErrors } from './assistant-bindings.js';
 import { ManagedConfigBroker } from './credential-broker.js';
@@ -20,6 +20,17 @@ export async function compileRegistryTarget(context, input) {
         const cc = compileConnectors(connectors);
         if (!cc.ok)
             return { ok: false, errors: cc.errors };
+        if (cc.catalog.some((entry) => entry.id === RECORD_CONNECTOR_ID))
+            return {
+                ok: false,
+                errors: [
+                    {
+                        code: 'reserved_connector',
+                        path: 'connectors',
+                        message: 'The native record connector is platform-owned and cannot be supplied by an application.',
+                    },
+                ],
+            };
         catalogConnectors = cc.catalog;
         httpConnectors = cc.connectors;
         secretBindings = cc.secretBindings;
@@ -49,25 +60,54 @@ export async function compileRegistryTarget(context, input) {
     const projectionErrors = compiled.ok
         ? publicSurfaceDelegatedAuthErrors(compiled.artifact, secretBindings)
         : [];
-    const [resolvedSecrets, resolvedVariables] = await Promise.all([
-        context.configStore.resolveConfigValues('secret', scope),
-        context.configStore.resolveConfigValues('variable', scope),
-    ]);
+    const resolvedSecrets = await context.configStore.resolveConfigValues('secret', scope);
+    const resolvedVariables = await context.configStore.resolveConfigValues('variable', scope);
+    const businessVariables = new Set(compiled.ok
+        ? compiled.artifact.server.variables
+            ?.filter((declaration) => declaration.portal !== undefined)
+            .map((declaration) => declaration.name)
+        : []);
     const connectorConfigErrors = [
         ...missingSecretErrors(secretBindings, resolvedSecrets),
-        ...missingVariableErrors(variableBindings, resolvedVariables),
+        ...missingVariableErrors(variableBindings.filter((name) => !businessVariables.has(name)), resolvedVariables),
     ];
     if (!compiled.ok) {
         return { ok: false, errors: [...connectorConfigErrors, ...compiled.errors] };
     }
-    const missingServerConfig = missingServerConfigErrors(compiled.artifact, resolvedSecrets, resolvedVariables);
+    const missingServerConfig = missingServerConfigErrors(compiled.artifact, resolvedSecrets, resolvedVariables).filter((error) => error.code !== 'missing_variable' ||
+        !businessVariables.has(error.path.replace(/^variables\./, '')));
     const errors = [
         ...identityErrors,
         ...projectionErrors,
         ...connectorConfigErrors,
         ...missingServerConfig,
     ];
-    const originResolution = resolveManagedOrigins(compiled.artifact, resolvedVariables);
+    const settings = resolveVariableEnvironment(compiled.artifact.server.variables ?? [], resolvedVariables);
+    if (!settings.ok)
+        errors.push({ ...settings.error, path: 'server.variables' });
+    if (settings.ok && deploymentId === undefined && settings.missing.length > 0) {
+        const previous = await context.activeArtifact();
+        if (previous !== undefined) {
+            const previouslyMissing = resolveVariableEnvironment(previous.server.variables ?? [], resolvedVariables);
+            for (const declaration of compiled.artifact.server.variables ?? []) {
+                if (!settings.missing.includes(declaration.name))
+                    continue;
+                const old = previous.server.variables?.find((entry) => entry.name === declaration.name);
+                if (declaration.requiredFor.some((tool) => previous.tools.some((entry) => entry.name === tool) &&
+                    !(previouslyMissing.ok &&
+                        previouslyMissing.missing.includes(declaration.name) &&
+                        old?.requiredFor.includes(tool))))
+                    errors.push({
+                        code: 'configuration_required',
+                        path: `variables.${declaration.name}`,
+                        message: 'Configure the new requirement before updating an existing capability.',
+                    });
+            }
+        }
+    }
+    const originResolution = resolveManagedOrigins(compiled.artifact, resolvedVariables, {
+        allowUnconfiguredPortal: true,
+    });
     if (!originResolution.ok) {
         const missingVariables = new Set(errors.filter((error) => error.code === 'missing_variable').map((error) => error.path));
         errors.push(...originResolution.errors
@@ -92,7 +132,8 @@ export async function compileRegistryTarget(context, input) {
     if (errors.length > 0 || !originResolution.ok) {
         return { ok: false, errors, compiledArtifact: compiled.artifact };
     }
-    const artifact = originResolution.artifact;
+    // Keep declarations reusable; serving binds live operator settings once for each request.
+    const artifact = compiled.artifact;
     const localAuthority = context.delegatedExchange === undefined &&
         secretBindings.some((binding) => binding.authKind === 'delegatedTokenExchange')
         ? await context.localDevtoolsDelegatedExchange?.resolve()
@@ -138,18 +179,26 @@ export async function compileRegistryTarget(context, input) {
             }),
         });
         const stateConnector = createDeploymentStateConnector(artifact.server.state, boundDeploymentId, context.stateHandleStoreFactory);
+        const nativeRecords = context.nativeRecords?.({
+            tenant,
+            artifact,
+            ...(boundDeploymentId === undefined ? {} : { deploymentId: boundDeploymentId }),
+        });
         return {
             artifact,
             deps: {
                 connectors: new InMemoryConnectorRegistry([
                     ...context.platformConnectors,
+                    ...(nativeRecords === undefined ? [] : [nativeRecords]),
                     ...(stateConnector !== undefined ? [stateConnector] : []),
                     ...httpConnectors,
                 ]),
                 broker,
                 tenantId: `${tenant.org}/${tenant.app}/${tenant.env}`,
                 ...(boundDeploymentId !== undefined ? { deploymentId: boundDeploymentId } : {}),
-                env: () => context.configStore.resolveConfigValues('variable', scope),
+                env: () => context.configStore.transactConfig === undefined
+                    ? context.configStore.resolveConfigValues('variable', scope)
+                    : context.configStore.transactConfig(scope.org, (transaction) => transaction.resolveConfigValues('variable', scope)),
                 ...(context.policyGate !== undefined ? { policy: context.policyGate } : {}),
                 ...(context.knowledgeSearch !== undefined && (artifact.server.knowledge?.length ?? 0) > 0
                     ? {

package/node_modules/@noodle-borg/service/dist/registry-deploy-transaction.js

@@ -1,6 +1,24 @@
 import { normalizeServerVersion } from '@noodle-borg/module';
 import { deployAccessRequiresActor, deployerRequiredError, deploymentOwnerSubject, emptyMembershipSourcesError, membershipSourcesRequireOrgMembersError, missingCapabilityErrors, serverAuthRequiredError, } from './registry-helpers.js';
 import { idempotentDeploymentId, mintDeploymentId } from './registry-targets.js';
+/** Serialize candidate validation/activation with hierarchical configuration writers. */
+export async function withDeploymentConfiguration(config, org, work) {
+    if (!config.transactConfig)
+        return work();
+    let result;
+    try {
+        return await config.transactConfig(org, async () => {
+            result = await work();
+            return result;
+        });
+    }
+    catch (error) {
+        // A nested activation rejection has rolled back; preserve its already mapped public diagnostic.
+        if (result?.ok === false)
+            return result;
+        throw error;
+    }
+}
 export async function preflightRegistryDeploy(input) {
     const { actor, accessMode, orgMembershipSources } = input.options;
     if (input.options.serverVersion !== undefined) {

package/node_modules/@noodle-borg/service/dist/registry-rollback.js

@@ -1,3 +1,4 @@
+import { withDeploymentConfiguration } from './registry-deploy-transaction.js';
 import { deploymentOwnerSubject, missingCapabilityErrors } from './registry-helpers.js';
 import { activateInMemory } from './registry-state.js';
 import { recordMatchesTenant, servedTargetFor, tenantDeploymentKey, tenantKey, tryServedTargetFor, } from './registry-targets.js';
@@ -7,7 +8,7 @@ import { recordMatchesTenant, servedTargetFor, tenantDeploymentKey, tenantKey, t
  */
 export async function rollbackWithMappedErrors(input) {
     try {
-        const result = await input.run();
+        const result = await withDeploymentConfiguration(input.configStore, input.org, input.run);
         if (result.ok)
             await input.pairKnowledge();
         return result;

package/node_modules/@noodle-borg/service/dist/registry-state.d.ts

@@ -57,7 +57,7 @@ export declare function registryArchiveApp(state: RegistryStateView, org: string
 export declare function registryRestoreApp(state: RegistryStateView, org: string, app: string, compileRecord: CompileCustomerAuthRecord): Promise<AppRestoreResult | undefined>;
 /** Compile exact private auth snapshots for a later atomic bulk-restore precondition. */
 export declare function registryCustomerAuthRestoreProjections(state: RegistryStateView, deploymentIds: readonly string[], compileRecord: CompileCustomerAuthRecord): Promise<readonly CustomerAuthRestoreProjection[]>;
-export declare function registrySweepArchived(state: RegistryStateView, before: string): Promise<readonly DeployRecord[]>;
+export declare function registrySweepArchived(state: RegistryStateView, before: string, onPurge?: (org: string, app: string, at: string, retired?: boolean) => Promise<void>): Promise<readonly DeployRecord[]>;
 /** The `apps` resource, store-first with a no-store fallback over the registry's own record cache. */
 export declare function registryListApps(state: RegistryStateView, org: string, opts: {
     readonly includeArchived?: boolean;

package/node_modules/@noodle-borg/service/dist/registry-state.js

@@ -9,7 +9,7 @@ import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAu
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from './deployment-lock.js';
 import { defaultActiveRecord } from './deployment-versioning.js';
 import { recordMatchesTenant, tenantDeploymentKey, tenantKey } from './registry-targets.js';
-import { appArchivedAt, deploymentSummary, paginateAppSummaries, planAppArchive, planAppRestore, resolveProductionEnvironment, summarizeApps, summarizeEnvs, withoutArchiveStamp, } from './store/records.js';
+import { appArchivedAt, deploymentSummary, paginateAppSummaries, planAppArchive, planAppRestore, planArchivedAppSweep, resolveProductionEnvironment, summarizeApps, summarizeEnvs, withoutArchiveStamp, } from './store/records.js';
 import { validateSlug, validateTenantRef } from './store/validate.js';
 export function reconcilePlatformAccountResetRegistryCache(state, input) {
     for (const app of input.apps) {
@@ -269,13 +269,13 @@ function deactivateScope(records, candidate) {
         }
     }
 }
-export async function registrySweepArchived(state, before) {
+export async function registrySweepArchived(state, before, onPurge) {
     let deleted;
     if (state.store !== undefined) {
         deleted = await state.store.sweepArchived(before);
     }
     else {
-        deleted = [...state.records.values()].filter((record) => record.archivedAt !== undefined && record.archivedAt < before);
+        deleted = planArchivedAppSweep([...state.records.values()], before);
     }
     const ids = new Set(deleted.map((record) => record.deploymentId));
     for (const id of ids) {
@@ -283,6 +283,9 @@ export async function registrySweepArchived(state, before) {
         state.servers.delete(id);
     }
     purgeActiveTenantEntries(state, ids);
+    const apps = new Map(deleted.map((record) => [`${record.orgSlug}/${record.appSlug}`, record]));
+    for (const app of apps.values())
+        await onPurge?.(app.orgSlug, app.appSlug, new Date().toISOString(), true);
     return deleted;
 }
 /** The `apps` resource, store-first with a no-store fallback over the registry's own record cache. */

package/node_modules/@noodle-borg/service/dist/registry-targets.js

@@ -1,7 +1,34 @@
 import { createHash, randomUUID } from 'node:crypto';
+import { RECORD_CONNECTOR_ID } from '@noodle-borg/compiler';
 import { parseAppPackageSnapshot } from './app-package-snapshot.js';
 import { hasExactCustomerAuthProjection } from './customer-auth-audience-binding.js';
 import { deploymentOwnerSubject } from './registry-helpers.js';
+import { validateTenantRef } from './store.js';
+/** Replace only the platform record port; unrelated compiled runtime ports retain their authority. */
+export function rebindNativeRecords(target, record, factory) {
+    const native = factory?.({
+        tenant: recordTenant(record),
+        artifact: target.served.artifact,
+        deploymentId: record.deploymentId,
+    });
+    const previous = target.served.deps.connectors;
+    return {
+        ...target,
+        served: {
+            ...target.served,
+            deps: {
+                ...target.served.deps,
+                connectors: {
+                    resolve: (ref) => ref.connectorId === RECORD_CONNECTOR_ID
+                        ? native?.version === ref.connectorVersion
+                            ? native
+                            : undefined
+                        : previous.resolve(ref),
+                },
+            },
+        },
+    };
+}
 /**
  * Build the front-door {@link ServedTarget} for a persisted record: its access mode plus the credential the
  * front-door checks. Legacy alpha records without an identity access mode are not served.
@@ -163,4 +190,26 @@ function deploymentSlug(name) {
         .replace(/[^a-z0-9]+/g, '-')
         .replace(/^-+|-+$/g, '') || 'server');
 }
+/** Immutable source projection shared by registry installation consumers. */
+export async function deploymentSourceFor(state, tenant, deploymentId) {
+    const safeTenant = validateTenantRef(tenant);
+    const record = state.store
+        ? await state.store.get(deploymentId)
+        : state.records.get(deploymentId);
+    if (record === undefined ||
+        record.archivedAt !== undefined ||
+        record.orgSlug !== safeTenant.org ||
+        record.appSlug !== safeTenant.app ||
+        record.environment !== safeTenant.env)
+        return undefined;
+    return {
+        manifest: record.manifest,
+        ...(record.connectors === undefined ? {} : { connectors: record.connectors }),
+        ...(record.hostedAssets === undefined
+            ? {}
+            : { hostedAssets: structuredClone(record.hostedAssets) }),
+        ...(record.accessMode === undefined ? {} : { accessMode: record.accessMode }),
+        ...(record.serverVersion === undefined ? {} : { serverVersion: record.serverVersion }),
+    };
+}
 //# sourceMappingURL=registry-targets.js.map

package/node_modules/@noodle-borg/service/dist/registry-types.d.ts

@@ -10,6 +10,7 @@ import type { DelegatedExchangeOptions } from './delegated-token-exchange.js';
 import type { ExternalCredentialExchangeRuntimeOptions } from './external-credential-exchange.js';
 import type { GoogleWorkloadIdentityRuntimeOptions } from './google-workload-identity.js';
 import type { LocalDevtoolsDelegatedExchangeRuntime } from './local-devtools-delegated-exchange.js';
+import type { NativeRecordConnectorFactory } from './native-record-connector.js';
 import type { OAuthStore } from './oauth/store.js';
 import type { StateHandleStoreFactory } from './state-connector-factory.js';
 import type { DeployRecord, SecretEnvelope, TenantAuthConfig } from './store.js';
@@ -93,6 +94,7 @@ export interface AccessUpdateOptions {
     readonly serverVersion?: string | undefined;
 }
 export interface ServerRegistryOptions {
+    readonly nativeRecords?: NativeRecordConnectorFactory;
     /** Pure renderer injection used for deployment-bound package construction and failure testing. */
     readonly renderAppPackage?: AppPackageRenderer;
     readonly customerVerifierFactory?: (auth: TenantAuthConfig) => OwnerTokenVerifier;

package/node_modules/@noodle-borg/service/dist/registry.d.ts

@@ -1,11 +1,12 @@
 import type { CapabilityName } from '@noodle-borg/capabilities';
-import type { CatalogConnector, LocalAssetOptions, PackagedAsset } from '@noodle-borg/compiler';
+import type { CatalogConnector, HostedPackagedAsset, LocalAssetOptions, PackagedAsset } from '@noodle-borg/compiler';
 import type { RollbackResult } from '@noodle-borg/control-plane/portable';
 import { type KnowledgeDeployHooks, type KnowledgeSearchPortFactory } from '@noodle-borg/knowledge-operations/portable';
 import type { PlatformIdentityRecoveryPlan } from '@noodle-borg/module';
 import { type EndpointUrlOptions } from '@noodle-borg/module';
 import type { Connector, SecretBox } from '@noodle-borg/runtime';
 import type { ServedTarget } from '@noodle-borg/transport-http';
+import type { NativeRecordConnectorFactory } from './native-record-connector.js';
 import { type ActiveDeployProvenance } from './registry-helpers.js';
 import type { AccessUpdateOptions, AccessUpdateResult, DeployOptions, DeployPreflightResult, RecoverResult, RunDeployResult, ServerRegistryOptions } from './registry-types.js';
 import { type AppArchiveResult, type AppRestoreResult, type AppSummary, type ArtifactStore, type ConfigStore, type CustomerAuthRestoreProjection, type DeploymentListFilter, type DeploymentLock, type DeploymentLockUpdateResult, type DeploymentStatus, type DeploymentSummary, type DeployRecord, type EnvSummary, type ProductionEnvironmentChange, type TenantRef } from './store.js';
@@ -18,8 +19,9 @@ export declare class ServerRegistry {
     setServiceCapabilities(capabilities: readonly CapabilityName[]): void;
     supportsTransactionalModuleDeploymentActivation(): boolean;
     setPlatformConnectors(input: {
-        readonly catalog: readonly CatalogConnector[];
-        readonly connectors: readonly Connector[];
+        readonly catalog?: readonly CatalogConnector[];
+        readonly connectors?: readonly Connector[];
+        readonly nativeRecords?: NativeRecordConnectorFactory;
     }): void;
     setLocalAssetOptions(options: LocalAssetOptions): void;
     getLocalAsset(pathname: string): PackagedAsset | undefined;
@@ -35,6 +37,7 @@ export declare class ServerRegistry {
     getActiveByTenantVersion(ref: TenantRef, serverVersion: string): Promise<ServedTarget | undefined>;
     listDeployments(filter: DeploymentListFilter): Promise<readonly DeploymentSummary[]>;
     getAppArchivedAt(org: string, app: string): Promise<string | undefined>;
+    setApplicationLifecycleObserver(observer: (org: string, app: string, at: string, retired?: boolean) => Promise<void>): void;
     archiveApp(org: string, app: string, at: string): Promise<AppArchiveResult | undefined>;
     restoreApp(org: string, app: string): Promise<AppRestoreResult | undefined>;
     sweepArchived(before: string): Promise<readonly DeployRecord[]>;
@@ -45,12 +48,21 @@ export declare class ServerRegistry {
         readonly apps: readonly AppSummary[];
         readonly truncated: boolean;
     }>;
+    getAppGeneration(org: string, app: string): Promise<string | undefined>;
     getApp(org: string, app: string): Promise<AppSummary | undefined>;
     listEnvironments(org: string, app: string, opts?: {
         includeArchived?: boolean;
     }): Promise<readonly EnvSummary[]>;
     getEnvironment(org: string, app: string, env: string): Promise<EnvSummary | undefined>;
     setProductionEnvironment(org: string, app: string, env: string): Promise<ProductionEnvironmentChange | undefined>;
+    /** Immutable executable bytes for a same-tenant installation; never includes configuration or credentials. */
+    getDeploymentSource(tenant: TenantRef, deploymentId: string): Promise<{
+        serverVersion?: string;
+        accessMode?: import("@noodle-borg/module").AccessMode;
+        hostedAssets?: readonly HostedPackagedAsset[];
+        connectors?: string;
+        manifest: string;
+    } | undefined>;
     getDeployment(org: string, deploymentId: string): Promise<DeploymentSummary | undefined>;
     /** Store-first historical package read; never recompiles or rerenders deployment bytes. */
     getDeploymentPackage(org: string, deploymentId: string): Promise<import("./registry-package.js").DeploymentPackage | undefined>;