@noodleseed/one 0.162.0 → 0.164.0

package/node_modules/@noodle-borg/service/dist/routes/config-values.js

@@ -1,10 +1,12 @@
 import { DEVELOPER_CLI_PATH } from '@noodle-borg/developer-mcp';
 import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
 import { configValueSetRequestSchema, EffectiveConfigResponseSchema, formatWireError, RevealSecretResponseSchema, } from '@noodle-borg/wire-contracts';
+import { ApplicationSettings, SettingsError } from '../application-settings.js';
+import { resolveSettingsTargets } from '../application-settings-targets.js';
 import { projectEffectiveConfig, } from '../config-value-projection.js';
 import { sendForbidden } from '../http-util.js';
 import { authorizeControlPlane } from './control-plane.js';
-export async function handleConfigValues(req, res, gate, controlPlane, configStore, registry, maxBody, ref, audit, developerGrants) {
+export async function handleConfigValues(req, res, gate, controlPlane, configStore, registry, maxBody, ref, audit, developerGrants, installations) {
     const identity = await authorizeControlPlane(req, res, gate, {
         requireIdentity: true,
         ...developerConfigAccess(developerGrants, controlPlane, ref, req.method),
@@ -51,14 +53,17 @@ export async function handleConfigValues(req, res, gate, controlPlane, configSto
             return sendJson(res, 400, { error: formatWireError(parsed.error) });
         }
         try {
-            const value = await configStore.setConfigValue({
+            const input = {
                 kind: ref.kind,
                 scope: ref.scope,
                 name: ref.name,
                 value: parsed.data.value,
                 ...(identity !== undefined ? { updatedBySubject: identity.subject } : {}),
                 ...(identity?.email !== undefined ? { updatedByEmail: identity.email } : {}),
-            });
+            };
+            const value = ref.kind === 'secret'
+                ? await configStore.setConfigValue(input)
+                : await new ApplicationSettings(configStore).writeTechnical(() => resolveSettingsTargets(registry, ref.scope, installations), input);
             // Durable audit: config name + scope + actor only — the value is NEVER recorded.
             await emitConfigAudit(audit, `config.${ref.kind}.set`, ref, identity);
             return sendJson(res, 200, { ok: true, value });
@@ -68,7 +73,24 @@ export async function handleConfigValues(req, res, gate, controlPlane, configSto
         }
     }
     if (req.method === 'DELETE' && ref.name !== undefined) {
-        await configStore.deleteConfigValue(ref.kind, ref.scope, ref.name);
+        try {
+            if (ref.kind === 'secret')
+                await configStore.deleteConfigValue(ref.kind, ref.scope, ref.name);
+            else
+                await new ApplicationSettings(configStore).writeTechnical(() => resolveSettingsTargets(registry, ref.scope, installations), {
+                    kind: ref.kind,
+                    scope: ref.scope,
+                    name: ref.name,
+                });
+        }
+        catch (error) {
+            if (!(error instanceof SettingsError))
+                throw error;
+            return sendJson(res, error.code === 'settings_unavailable' ? 503 : 400, {
+                code: error.code,
+                error: error.message,
+            });
+        }
         await emitConfigAudit(audit, `config.${ref.kind}.deleted`, ref, identity);
         res.writeHead(204);
         res.end();

package/node_modules/@noodle-borg/service/dist/routes/control-plane.js

@@ -1,17 +1,13 @@
-import { cspFaultsInManifest } from '@noodle-borg/compiler';
 import { ensurePersonalWorkspace } from '@noodle-borg/control-plane/portable';
 import { DEVELOPER_ASSISTANT_PATH, DEVELOPER_CLI_PATH, } from '@noodle-borg/developer-mcp';
 import { normalizeServerVersion } from '@noodle-borg/module';
-import { noopLogger, readDeployBody, sendJson } from '@noodle-borg/transport-http';
+import { readDeployBody, sendJson } from '@noodle-borg/transport-http';
 import { deployRequestSchema, formatWireError, WhoamiIdentityResponseSchema, } from '@noodle-borg/wire-contracts';
 import { authorizeDeveloperGrant, } from '../auth/developer-grant-guard.js';
+import { executeAuthorizedDeployment } from '../deployment-execution.js';
 import { baseFromRequest, sendForbidden, sendUnauthorized } from '../http-util.js';
 import { endpointUrlOptionsForOrg } from '../mcp-public-routing.js';
-import { manifestUsesUserRoot } from '../registry-access.js';
-import { isIdentityAccessMode } from './access-mode.js';
 import { validateDeployIdempotency } from './deploy-idempotency.js';
-import { provisionPublicEmbed } from './deploy-public-embed.js';
-import { respondDeploymentActivationError } from './deployment-activation-response.js';
 import { tenantMcpUrl } from './endpoint-enrichment.js';
 import { canManageMembers } from './org-admin.js';
 export async function handleDeploy(req, res, registry, options, maxBody, tenant, gate, controlPlane, audit) {
@@ -172,235 +168,25 @@ export async function handleDeploy(req, res, registry, options, maxBody, tenant,
             code: 'owner_only_unsupported_for_automation',
         });
     }
-    // Identity access modes bind the data plane to verified identity, so the deployer must be authenticated.
-    // (Localhost dev runs the gate open; such deploys are rejected for lack of an owner/audit actor.)
-    if (isIdentityAccessMode(accessMode) && !identity) {
-        return sendJson(res, 401, {
-            error: `${accessMode} deployments require an authenticated deployer`,
-        });
-    }
-    if (accessMode === 'public' && manifestUsesUserRoot(manifest)) {
-        return sendJson(res, 400, {
-            error: 'public access mode cannot reference ${user}; use mixed for optional identity',
-        });
-    }
-    // Widget CSP gate (deploy-only): a CSP origin the host renderer will silently drop breaks the widget
-    // for end users, so the deploy is refused here. The compiler surfaces the same faults as non-blocking
-    // warnings, so `noodle dev`/`validate` still render the widget locally — only shipping is gated.
-    const [cspFault] = cspFaultsInManifest(manifest);
-    if (cspFault !== undefined) {
-        return sendJson(res, 400, {
-            error: `widget "${cspFault.widget}" CSP ${cspFault.list} origin "${cspFault.value}" is not an ` +
-                `absolute https:// origin and would be dropped by the host renderer` +
-                (cspFault.suggestion !== undefined ? `; use "${cspFault.suggestion}"` : ''),
-        });
-    }
-    if ((await controlPlane.getOrg(tenant.org)) === undefined) {
-        await audit.emit({
-            eventType: 'deploy.rejected',
-            org: tenant.org,
-            app: tenant.app,
-            env: tenant.env,
-            decision: 'deny',
-            status: 404,
-            reasonCode: 'organization_not_found',
-            ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
-            ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
-        });
-        return sendJson(res, 404, {
-            code: 'organization_not_found',
-            error: 'organization must be created before deploy',
-        });
-    }
-    const logger = options.logger ?? noopLogger;
-    if (hostedAssets !== undefined && hostedAssets.length > 0) {
-        if (options.assetStore === undefined) {
-            await audit.emit({
-                eventType: 'asset.rejected',
-                org: tenant.org,
-                app: tenant.app,
-                env: tenant.env,
-                decision: 'deny',
-                status: 400,
-                reasonCode: 'asset_store_not_configured',
-                ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
-                ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
-                details: { assetCount: hostedAssets.length },
-            });
-            return sendJson(res, 400, { error: 'hosted assets are not configured for this service' });
-        }
-        const verified = await options.assetStore.verifyUploadedAssets({
-            scope: tenant,
-            assets: hostedAssets,
-        });
-        if (!verified.ok) {
-            await audit.emit({
-                eventType: 'asset.rejected',
-                org: tenant.org,
-                app: tenant.app,
-                env: tenant.env,
-                decision: 'deny',
-                status: 400,
-                reasonCode: 'asset_verification_failed',
-                ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
-                ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
-                details: { assetCount: hostedAssets.length },
-            });
-            return sendJson(res, 400, { error: verified.error });
-        }
-        hostedAssets = verified.assets;
-    }
-    let result;
-    try {
-        result = await registry.deploy(tenant, manifest, {
-            connectors,
-            actor: identity || undefined,
-            accessMode,
-            ownerSubject,
-            ...(orgMembershipSources !== undefined ? { orgMembershipSources } : {}),
-            hostedAssets,
-            serverVersion,
-            deploymentSource: automationId === undefined ? (deploymentSource ?? 'api') : 'github',
-            ...(idempotency.key !== undefined ? { idempotencyKey: idempotency.key } : {}),
-            ...(automationId === undefined ? {} : { automationId }),
-        });
-    }
-    catch (error) {
-        const handled = await respondDeploymentActivationError(res, error, {
-            audit,
-            eventType: 'deploy.rejected',
-            org: tenant.org,
-            app: tenant.app,
-            env: tenant.env,
-            ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
-            ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
-        });
-        if (handled)
-            return;
-        throw error;
-    }
-    if (!result.ok) {
-        if ('conflict' in result) {
-            if (result.code === 'deployment_locked') {
-                await audit.emit({
-                    eventType: 'deploy.rejected',
-                    org: tenant.org,
-                    app: tenant.app,
-                    env: tenant.env,
-                    decision: 'deny',
-                    status: 409,
-                    reasonCode: result.code,
-                    ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
-                    ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
-                    details: { serverVersion },
-                });
-            }
-            return sendJson(res, 409, {
-                ok: false,
-                code: result.code,
-                error: result.message,
-            });
-        }
-        if ('superseded' in result) {
-            if (automationId !== undefined) {
-                await options.deploymentAutomation
-                    ?.recordSuperseded?.({ automationId, target: tenant })
-                    .catch(() => undefined);
-            }
-            return sendJson(res, 409, {
-                ok: false,
-                code: 'run_superseded',
-                error: 'a newer GitHub deploy run exists for this app/env; this run was not activated',
-                deploymentId: result.deploymentId,
-                ...(result.serverVersion !== undefined ? { serverVersion: result.serverVersion } : {}),
-            });
-        }
-        // Codes are safe enum strings; never a path-with-value. No secret name or value is logged.
-        const codes = result.errors.map((error) => error.code).join(',');
-        logger.warn('deploy.rejected', {
-            status: 400,
-            errorCount: result.errors.length,
-            codes,
-        });
-        // Durable audit: a rejected deploy is a governance event. Safe fields only — no manifest body.
-        await audit.emit({
-            eventType: 'deploy.rejected',
-            org: tenant.org,
-            app: tenant.app,
-            env: tenant.env,
-            decision: 'deny',
-            status: 400,
-            reasonCode: 'compile_failed',
-            ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
-            ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
-            details: { errorCount: result.errors.length, codes },
-        });
-        return sendJson(res, 400, { ok: false, errors: result.errors });
-    }
-    // Counts only — never secret names or values.
-    logger.info('deploy.ok', {
-        deploymentId: result.deploymentId,
-        serverVersion: result.serverVersion,
-        org: tenant.org,
-        app: tenant.app,
-        env: tenant.env,
-        hasConnectors: connectors !== undefined,
-    });
-    await audit.emit({
-        eventType: 'deploy.accepted',
-        org: tenant.org,
-        app: tenant.app,
-        env: tenant.env,
-        decision: 'allow',
-        status: 201,
-        ...(result.deploymentId !== undefined ? { deploymentId: result.deploymentId } : {}),
-        ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
-        ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
-        details: {
-            accessMode: result.accessMode ?? accessMode,
-            deploymentSource: automationId === undefined ? (deploymentSource ?? 'api') : 'github',
-            ...(ownerSubject !== undefined ? { ownerSubject } : {}),
-            serverVersion: result.serverVersion,
-            hasConnectors: connectors !== undefined,
-        },
-    });
-    // Tenant-safe developer-facing log (M3, ADR 0101): a safe deploy-lifecycle record the developer can read
-    // via `noodle logs`. Only scalar metadata, no manifest/secret/payload material.
-    await options.userAppLogStore?.emit({
-        level: 'info',
-        message: 'deployment live',
-        org: tenant.org,
-        app: tenant.app,
-        env: tenant.env,
-        ...(result.deploymentId !== undefined ? { deploymentId: result.deploymentId } : {}),
-        details: { accessMode: result.accessMode ?? accessMode, serverVersion: result.serverVersion },
-    });
-    if (result.ok && hostedAssets !== undefined && hostedAssets.length > 0) {
-        await audit.emit({
-            eventType: 'asset.activation.accepted',
-            org: tenant.org,
-            app: tenant.app,
-            env: tenant.env,
-            decision: 'allow',
-            status: 201,
-            deploymentId: result.deploymentId,
-            ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
-            ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
-            details: {
-                assetCount: hostedAssets.length,
-                totalBytes: hostedAssets.reduce((sum, asset) => sum + asset.byteLength, 0),
-            },
-        });
-        await options.assetStore?.recordReachability({
-            scope: tenant,
-            deploymentId: result.deploymentId,
-            deploymentVersion: result.deploymentVersion,
-            assets: hostedAssets,
-        });
-    }
+    const executed = await executeAuthorizedDeployment({
+        tenant,
+        manifest,
+        connectors,
+        hostedAssets,
+        accessMode,
+        identity,
+        ownerSubject,
+        orgMembershipSources,
+        deploymentSource,
+        serverVersion,
+        idempotencyKey: idempotency.key,
+        automationId,
+    }, { registry, options, controlPlane, audit });
+    if (!executed.ok)
+        return sendJson(res, executed.status, executed.body);
+    const { result, embedId } = executed;
     const base = options.publicBaseUrl ?? baseFromRequest(req, options.tls ?? {});
     const endpointOptions = await endpointUrlOptionsForOrg(options, controlPlane, tenant.org);
-    const embedId = await provisionPublicEmbed(registry, options, tenant, result.deploymentId);
     return sendJson(res, 201, {
         ok: true,
         org: tenant.org,
@@ -470,7 +256,20 @@ export async function handleWhoami(req, res, gate, controlPlane, options = {}, s
     const orgs = identity.superAdmin
         ? await controlPlane.listOrgs()
         : await controlPlane.listOrgsForSubject(identity.subject);
-    return sendJson(res, 200, { ok: true, identity, orgs });
+    return sendJson(res, 200, {
+        ok: true,
+        identity: {
+            subject: identity.subject,
+            email: identity.email,
+            identityIssuer: identity.identityIssuer,
+            givenName: identity.givenName,
+            superAdmin: identity.superAdmin,
+            developerGrantId: identity.developerGrantId,
+            oauthClientId: identity.oauthClientId,
+            authTime: identity.authTime,
+        },
+        orgs,
+    });
 }
 export async function authorizeTenantControl(req, res, gate, controlPlane, org, developerAccess) {
     const identity = await authorizeControlPlane(req, res, gate, {

package/node_modules/@noodle-borg/service/dist/routes/deployment-activation-response.js

@@ -2,11 +2,18 @@ import { DeploymentActivationError } from '@noodle-borg/module';
 import { sendJson } from '@noodle-borg/transport-http';
 /** Translate provider-neutral activation failures without exposing commercial account details. */
 export async function respondDeploymentActivationError(res, error, context) {
-    if (!(error instanceof DeploymentActivationError))
+    const rejected = await deploymentActivationRejection(error, context);
+    if (rejected === undefined)
         return false;
+    sendJson(res, rejected.status, rejected.body);
+    return true;
+}
+export async function deploymentActivationRejection(error, context) {
+    if (!(error instanceof DeploymentActivationError))
+        return undefined;
     const response = deploymentActivationResponse(error.code);
     if (response === undefined)
-        return false;
+        return undefined;
     await context.audit.emit({
         eventType: context.eventType,
         org: context.org,
@@ -18,8 +25,10 @@ export async function respondDeploymentActivationError(res, error, context) {
         ...(context.actorSubject !== undefined ? { actorSubject: context.actorSubject } : {}),
         ...(context.actorEmail !== undefined ? { actorEmail: context.actorEmail } : {}),
     });
-    sendJson(res, response.status, { ok: false, code: error.code, error: response.message });
-    return true;
+    return {
+        status: response.status,
+        body: { ok: false, code: error.code, error: response.message },
+    };
 }
 function deploymentActivationResponse(code) {
     if (code === 'production_app_limit_exceeded') {

package/node_modules/@noodle-borg/service/dist/service-resource-cleanup.js

@@ -6,6 +6,10 @@ export async function closeServiceResources(input) {
         clearInterval(input.feedbackOperationsTimer);
     if (input.businessInformationTimer !== undefined)
         clearInterval(input.businessInformationTimer);
+    input.stopBusinessInformationSweep?.();
+    if (input.businessInformationSourceTimer !== undefined) {
+        clearInterval(input.businessInformationSourceTimer);
+    }
     clearInterval(input.alertTimer);
     const errors = [];
     const moduleHost = input.moduleHost;

package/node_modules/@noodle-borg/service/dist/service.js

@@ -5,11 +5,13 @@ import { dispatchKnowledgeRequest } from '@noodle-borg/knowledge-operations/port
 import { OPENAI_APPS_CHALLENGE_PATH } from '@noodle-borg/module';
 import { applySecurityHeaders, createMcpRouter, enforceHttps, noopLogger, sendJson, } from '@noodle-borg/transport-http';
 import { AnonymousConsumerLimiter, createAdmissionGate } from './admission.js';
+import { ApplicationActivity } from './application-activity.js';
+import { createApplicationServingRuntime } from './application-runtime-target.js';
 import { createArchivePreflight } from './archive-preflight.js';
 import { ArchiveSweeper, resolveArchiveRetentionDays } from './archive-sweeper.js';
 import { serveLocalAsset } from './assets.js';
 import { resolveBuildInfo, serviceInfoPayload } from './build-info.js';
-import { InMemoryBusinessInformationStore } from './business-information/portable.js';
+import { createBusinessInformationRuntime, resolvePrivateInstallationDefinition, } from './business-information-runtime.js';
 import { serviceCapabilityReport } from './capabilities.js';
 import { rejectIncompatibleCli } from './client-compatibility.js';
 import { createDataPlaneMembershipAuthorizer } from './data-plane-membership.js';
@@ -23,6 +25,7 @@ import { createServiceModuleProviders } from './modules/host.js';
 import { dispatchModuleRoutes } from './modules/route-dispatch.js';
 import { isAuthServerPath } from './oauth/paths.js';
 import { createIntentTargetResolver, createObservabilityDispatcher, createObservabilityStores, } from './observability-runtime.js';
+import { createRecoveryQuarantineHandler, resolveRecoveryMode } from './recovery-quarantine.js';
 import { handleAccessUpdate } from './routes/access.js';
 import { dispatchAlertRoutes } from './routes/alerts-dispatch.js';
 import { handleAppPurgeReconciliationRoute, } from './routes/app-purge-reconciliation.js';
@@ -47,13 +50,14 @@ import { dispatchResourceReads } from './routes/resource-read-dispatch.js';
 import { handleRollback } from './routes/rollback.js';
 import { createServicePrincipalDispatcher } from './routes/service-principals-dispatch.js';
 import { servicePrincipalDataPlaneHooks } from './service-principal-data-plane.js';
-import { BUILTIN_STATE_CATALOG_CONNECTOR } from './state-catalog.js';
 import { InMemoryAlertRuleStore } from './store/alert-rules.js';
 import { StdoutAuditSink } from './store/audit.js';
 const DEFAULT_MAX_BODY = 1 << 20;
 const DEFAULT_MAX_DEPLOY_BODY = 32 * 1024 * 1024;
 /** The combined service listener: tenant-scoped deploy management plus the multi-tenant MCP router. */
 export function createServiceHandler(registry, options = {}) {
+    if (resolveRecoveryMode(options.recoveryMode) === 'quarantined')
+        return createRecoveryQuarantineHandler(options);
     const logger = options.logger ?? noopLogger;
     const tls = options.tls ?? {};
     const buildInfo = options.buildInfo ?? resolveBuildInfo();
@@ -66,18 +70,18 @@ export function createServiceHandler(registry, options = {}) {
     const assistantAppearance = options.assistantAppearance ?? new InMemoryAssistantAppearanceSettingsStore();
     const anonymousLimiter = new AnonymousConsumerLimiter();
     const publicCounters = options.admissionCounters ?? new InMemoryDailyCounterStore();
-    const businessInformationStore = options.businessInformationStore ??
-        (options.businessInformationEnabled === false
-            ? undefined
-            : new InMemoryBusinessInformationStore());
-    registry.setPlatformConnectors({ catalog: [BUILTIN_STATE_CATALOG_CONNECTOR], connectors: [] });
+    const { businessInformationStore, businessInformationSourceStore, sourceCoordinator } = createBusinessInformationRuntime(registry, options, publicCounters);
     const moduleProviders = createServiceModuleProviders({
         options,
         auditMirror: new StdoutAuditSink(logger),
         admissionGate: createAdmissionGate(anonymousLimiter, { emit: (event) => activeAudit.emit(event) }, options.admissionGate),
     });
     const moduleHost = moduleProviders.host;
-    const providerOptions = moduleProviders.options;
+    businessInformationStore?.configurePrincipalAuthority(moduleHost.platformHumanIdentity);
+    const providerOptions = {
+        ...moduleProviders.options,
+        ...(businessInformationStore ? { businessInformationStore } : {}),
+    };
     const verifyOwnerToken = moduleProviders.verifyOwnerToken;
     const capabilityReport = serviceCapabilityReport(moduleHost);
     registry.setServiceCapabilities(capabilityReport.capabilities);
@@ -85,8 +89,16 @@ export function createServiceHandler(registry, options = {}) {
     activeAudit = audit;
     const { publicTenantRouting } = mcp.mcpRoutingOptions(options, controlPlane);
     const resolveEndpointOptions = (org) => mcp.endpointUrlOptionsForOrg(options, controlPlane, org);
+    const activity = options.operationEvidence === undefined
+        ? undefined
+        : new ApplicationActivity({
+            ...options.operationEvidence,
+            allowance: async (org, request) => moduleHost.resolveActivityHistoryAllowance?.(org, request),
+        });
     const withIntentMode = createIntentTargetResolver(intentSettings, intentPreviewOrgs);
-    const router = createMcpRouter(async (id) => withIntentMode(await registry.getServing(id)), {
+    const { activateInstallation, resolveRuntimeTarget, businessOnboarding } = createApplicationServingRuntime(registry, providerOptions, controlPlane, audit, activity);
+    const runtimeTarget = async (target) => target === undefined ? undefined : resolveRuntimeTarget(target);
+    const router = createMcpRouter(async (id) => withIntentMode(await runtimeTarget(await registry.getServing(id))), {
         logger,
         tls,
         protocolMode: options.mcpProtocolMode ?? 'dual',
@@ -116,9 +128,9 @@ export function createServiceHandler(registry, options = {}) {
             }),
         admissionGate: moduleHost.admissionGate,
         ...(publicTenantRouting !== undefined ? { publicTenantRouting } : {}),
-        tenantLookup: async (ref) => withIntentMode(ref.serverVersion === undefined
+        tenantLookup: async (ref) => withIntentMode(await runtimeTarget(ref.serverVersion === undefined
             ? await registry.getActiveByTenant(ref)
-            : await registry.getActiveByTenantVersion(ref, ref.serverVersion), ref),
+            : await registry.getActiveByTenantVersion(ref, ref.serverVersion)), ref),
         tenantPreflight: createArchivePreflight(registry),
     });
     const maxBody = options.maxBodyBytes ?? DEFAULT_MAX_BODY;
@@ -268,11 +280,41 @@ export function createServiceHandler(registry, options = {}) {
             options.businessInformationEnabled !== false &&
             dispatchBusinessInformationRoutes(req, res, url, {
                 store: businessInformationStore,
+                ...(businessOnboarding ? { businessOnboarding } : {}),
+                activateInstallation,
+                ...(activity === undefined ? {} : { activity }),
+                ...(options.connectionRuntime === undefined
+                    ? {}
+                    : {
+                        connections: options.connectionRuntime.connections,
+                        resolveConnectionTargets: options.connectionRuntime.resolveConnectionTargets,
+                    }),
+                configStore,
+                registry,
+                resolveEndpointBase: (request) => options.publicBaseUrl ?? baseFromRequest(request, tls),
+                resolveEndpointUrlOptions: resolveEndpointOptions,
+                ...(options.publicEmbeds === undefined ? {} : { publicEmbeds: options.publicEmbeds }),
+                admissionCounters: publicCounters,
+                ...(options.admissionEnvelope === undefined
+                    ? {}
+                    : { admissionEnvelope: options.admissionEnvelope }),
+                ...(options.managedAssistantModelResolver === undefined
+                    ? {}
+                    : { managedModelResolver: options.managedAssistantModelResolver }),
                 gate,
                 controlPlane,
                 maxBody,
                 publicCounters,
+                audit: activeAudit,
                 trustProxy: tls.trustProxy === true,
+                publicIntakeEnabled: options.businessInformationPublicIntakeEnabled !== false,
+                resolvePrivateDefinition: (selector) => resolvePrivateInstallationDefinition(registry, selector),
+                ...(businessInformationSourceStore === undefined
+                    ? {}
+                    : { sourceStore: businessInformationSourceStore }),
+                ...(sourceCoordinator === undefined
+                    ? {}
+                    : { runSourceIngestion: async () => void (await sourceCoordinator.runOne()) }),
                 ...(options.clock === undefined ? {} : { now: options.clock }),
                 logger,
                 tls,
@@ -283,6 +325,7 @@ export function createServiceHandler(registry, options = {}) {
         }
         if (dispatchAssistantRoutes(req, res, url, {
             registry,
+            resolveRuntimeTarget,
             store: assistantStore,
             appearance: assistantAppearance,
             ...(options.publicEmbeds !== undefined ? { publicEmbeds: options.publicEmbeds } : {}),
@@ -423,6 +466,9 @@ export function createServiceHandler(registry, options = {}) {
             controlPlane,
             configStore,
             registry,
+            ...(businessInformationStore === undefined
+                ? {}
+                : { installations: businessInformationStore }),
             maxBody,
             audit,
             ...(options.developerGrantStore !== undefined