@noodleseed/one 0.164.0 → 0.166.0

package/node_modules/@noodle-borg/service/dist/business-information/managed-solution-executable.js

@@ -10,6 +10,16 @@ export function managedSolutionManifest(definition) {
     const collection = definition.collections.find((entry) => entry.key === blueprint.collection);
     if (collection === undefined)
         throw new Error('Managed solution executable collection is missing');
+    const recordInput = collectionToPublicWire(collection).recordSchema;
+    const inputSchema = 'followUpContact' in blueprint
+        ? {
+            ...recordInput,
+            required: [
+                ...(Array.isArray(recordInput.required) ? recordInput.required : []),
+                'contact_email',
+            ],
+        }
+        : recordInput;
     return {
         manifestVersion: '2',
         server: {
@@ -46,7 +56,7 @@ export function managedSolutionManifest(definition) {
                 name: blueprint.tool,
                 title: blueprint.title,
                 description: blueprint.description,
-                inputSchema: collectionToPublicWire(collection).recordSchema,
+                inputSchema,
                 outputSchema: RECORD_OPERATION_SIGNATURES.submit_record?.output,
                 annotations: {
                     confirm: true,

package/node_modules/@noodle-borg/service/dist/business-information/model.js

@@ -47,13 +47,13 @@ export function businessGrantAllows(grant, permission) {
         grant.revokedAt === undefined &&
         permissionsForBusinessRole(grant.role).includes(permission));
 }
-export function normalizeInstallationInput(input) {
+export function normalizeInstallationInput(input, resolveManaged = builtInDefinition) {
     const scope = { ...validateScope(input.scope) };
     if ((input.profileKey === undefined) === (input.definition === undefined)) {
         throw new Error('installation requires exactly one managed profile or private definition');
     }
     const definition = input.definition ??
-        builtInDefinition(input.profileKey);
+        resolveManaged(input.profileKey);
     validateDefinition(definition);
     const managedCollections = [...new Set(input.managedCollections)].sort();
     for (const collectionKey of managedCollections) {

package/node_modules/@noodle-borg/service/dist/business-information/portable.js

@@ -1,6 +1,6 @@
 export * from './collection-controls.js';
 export * from './contracts.js';
-export * from './definition-resolver.js';
+export { privateDefinitionFromDeployment, } from './definition-resolver.js';
 export * from './in-memory-store.js';
 export * from './legacy-request-migration.js';
 export * from './managed-releases.js';

package/node_modules/@noodle-borg/service/dist/business-information/profiles.js

@@ -1,4 +1,5 @@
 import { createHash } from 'node:crypto';
+import { validateJsonSchema as validateSchema } from '@noodle-borg/compiler';
 import { managedSolutionBlueprint, managedSolutionVariables, } from './managed-solution-blueprints.js';
 import { PayloadValidationError, validateManagedPayload, validateScalar } from './validation.js';
 const requestSchema = (required, properties) => ({
@@ -73,6 +74,12 @@ export const BUILT_IN_SOLUTION_PROFILE_RELEASES = {
         { key: 'travel', version: 1, label: 'Travel', collections: [travelV1] },
         { key: 'travel', version: 2, label: 'Travel', collections: [travelV2] },
         { key: 'travel', version: 3, label: 'Travel', collections: [lightweightCollection(travelV2)] },
+        {
+            key: 'travel',
+            version: 4,
+            label: 'Travel',
+            collections: [followUpCollection(lightweightCollection(travelV2))],
+        },
     ],
     b2b_saas: [{ key: 'b2b_saas', version: 1, label: 'B2B SaaS', collections: [service] }],
     ecommerce: [
@@ -92,6 +99,12 @@ export const BUILT_IN_SOLUTION_PROFILE_RELEASES = {
             label: 'Restaurant',
             collections: [lightweightCollection(restaurant)],
         },
+        {
+            key: 'restaurant',
+            version: 3,
+            label: 'Restaurant',
+            collections: [followUpCollection(lightweightCollection(restaurant))],
+        },
     ],
 };
 export const BUILT_IN_SOLUTION_PROFILES = {
@@ -189,7 +202,7 @@ function collectionDefinition(profile) {
                 management: profile.management,
                 publicFields: profile.publicFields ?? [],
                 editableFields: Object.keys(profile.schema.properties),
-                fields: { status: { label: 'Status' } },
+                fields: { status: { label: 'Status' }, ...profile.fields },
                 filterFields: ['status'],
                 sortFields: ['status'],
             }),
@@ -213,6 +226,26 @@ function lightweightCollection(previous) {
         publicFields: Object.keys(previous.schema.properties),
     };
 }
+/** Optional storage preserves historical records; the new application tool asks for a reply route. */
+function followUpCollection(previous) {
+    return {
+        ...previous,
+        ...collection(previous.key, previous.labels, {
+            ...previous.schema,
+            properties: {
+                ...previous.schema.properties,
+                contact_email: { type: 'string', format: 'email', minLength: 3, maxLength: 254 },
+            },
+        }, previous.schemaVersion + 1),
+        publicFields: [...(previous.publicFields ?? []), 'contact_email'],
+        fields: {
+            contact_email: {
+                label: 'Reply email',
+                help: 'The address provided by the guest for staff follow-up. This address has not been verified.',
+            },
+        },
+    };
+}
 function validateJsonSchema(schema, payload) {
     for (const required of schema.required) {
         if (!(required in payload)) {
@@ -236,6 +269,9 @@ function validateJsonSchema(schema, payload) {
         if (property.enum !== undefined && !property.enum.includes(value)) {
             throw new PayloadValidationError('invalid_json', `managed payload field "${key}" has an unsupported value`);
         }
+        if (property.format !== undefined && validateSchema(property, value).length > 0) {
+            throw new PayloadValidationError('invalid_json', `managed payload field "${key}" has an invalid format`);
+        }
     }
 }
 function stableJson(value) {

package/node_modules/@noodle-borg/service/dist/credential-binding-index.js

@@ -27,7 +27,10 @@ export function buildCredentialBindingIndex(artifact) {
             return [];
         return source.scan.resolved ? [source.scan] : [];
     });
-    const operationRefs = [...fulfilments.flatMap(resolvedOperationRefs), ...sourceRefs];
+    const operationRefs = nestedReferences([
+        ...fulfilments.flatMap(resolvedOperationRefs),
+        ...sourceRefs,
+    ]);
     for (const ref of operationRefs) {
         const credentialBinding = ref.credentialBinding;
         if (credentialBinding === undefined)
@@ -67,4 +70,19 @@ export function buildCredentialBindingIndex(artifact) {
         googleWorkloadIdentity: [...googleWorkloadIdentity.values()],
     };
 }
+function nestedReferences(roots) {
+    const output = [];
+    const queue = roots.map((ref) => ({ ref, depth: 0 }));
+    for (let index = 0; index < queue.length; index += 1) {
+        const entry = queue[index];
+        if (!entry)
+            continue;
+        if (entry.depth > 32 || queue.length > 65536)
+            throw new Error('Invalid compiled connector dependency graph');
+        output.push(entry.ref);
+        for (const child of entry.ref.calls ?? [])
+            queue.push({ ref: child, depth: entry.depth + 1 });
+    }
+    return output;
+}
 //# sourceMappingURL=credential-binding-index.js.map

package/node_modules/@noodle-borg/service/dist/customer-auth-audience-binding.js

@@ -1,3 +1,12 @@
+import { usesCustomerAuthentication } from '@noodle-borg/module';
+/** Match durable ownership, including an omitted stored projection when compilation declares auth. */
+export function requiresCustomerAuthProjection(record, compiledAuth) {
+    return usesCustomerAuthentication({
+        schemaVersion: record.schemaVersion,
+        accessMode: record.accessMode,
+        hasServerAuth: record.serverAuth != null || compiledAuth !== undefined,
+    });
+}
 /** Safe lifecycle error; tenant identities and configured values never enter its public message. */
 export class CustomerAuthAudienceConflictError extends Error {
     code = 'customer_auth_audience_conflict';
@@ -51,7 +60,7 @@ export function isTenantAuthConfig(value) {
 }
 /** Customer-serving records must exactly project the compiler-authoritative auth declaration. */
 export function hasExactCustomerAuthProjection(record, compiledAuth) {
-    if (record.accessMode !== 'customers')
+    if (!requiresCustomerAuthProjection(record, compiledAuth))
         return true;
     if (compiledAuth === undefined || !isTenantAuthConfig(record.serverAuth))
         return false;
@@ -65,7 +74,7 @@ export function hasExactCustomerAuthProjection(record, compiledAuth) {
 }
 /** Require an exact compiler-authenticated snapshot before clearing customer app archive stamps. */
 export function assertCustomerAuthRestorePrecondition(records, precondition) {
-    const candidates = records.filter((record) => record.active && record.accessMode === 'customers');
+    const candidates = records.filter((record) => record.active && requiresCustomerAuthProjection(record));
     const projections = precondition?.customerAuthProjections ?? [];
     if (candidates.length !== projections.length) {
         throw new CustomerAuthAudienceProjectionError();
@@ -107,7 +116,7 @@ export function findActiveCustomerAuthAudienceConflict(records, tenant, auth) {
     for (const record of records) {
         if (!record.active ||
             record.archivedAt !== undefined ||
-            record.accessMode !== 'customers' ||
+            !requiresCustomerAuthProjection(record) ||
             sameTenant(record, tenant)) {
             continue;
         }
@@ -124,7 +133,9 @@ export function findActiveCustomerAuthAudienceConflict(records, tenant, auth) {
 export function assertUniqueActiveCustomerAuthAudienceBindings(records) {
     const owners = new Map();
     for (const record of records) {
-        if (!record.active || record.archivedAt !== undefined || record.accessMode !== 'customers') {
+        if (!record.active ||
+            record.archivedAt !== undefined ||
+            !requiresCustomerAuthProjection(record)) {
             continue;
         }
         if (!isTenantAuthConfig(record.serverAuth)) {
@@ -143,7 +154,7 @@ export function assertUniqueActiveCustomerAuthAudienceBindings(records) {
 }
 /** Shared registry guard with an optimized durable-store path and an in-memory fallback. */
 export async function hasActiveCustomerAuthAudienceConflict(store, records, record, auth) {
-    if (record.accessMode !== 'customers' || auth === undefined || auth.kind === 'bridge')
+    if (!requiresCustomerAuthProjection(record, auth) || auth === undefined || auth.kind === 'bridge')
         return false;
     const tenant = { org: record.orgSlug, app: record.appSlug, env: record.environment };
     const conflict = store?.findActiveCustomerAuthAudienceConflict !== undefined

package/node_modules/@noodle-borg/service/dist/deployment-authentication.js

@@ -0,0 +1,19 @@
+import { usesCustomerAuthentication } from '@noodle-borg/module';
+import { deploymentRecordVersionError } from './deployment-record-version.js';
+/** Read the effective authentication authority only when this runtime understands the record. */
+export function deploymentAuthenticationFor(record) {
+    if (deploymentRecordVersionError(record) !== undefined || record.accessMode === undefined) {
+        return undefined;
+    }
+    if (record.accessMode === 'public')
+        return 'none';
+    if (usesCustomerAuthentication({
+        schemaVersion: record.schemaVersion,
+        accessMode: record.accessMode,
+        hasServerAuth: record.serverAuth !== undefined,
+    })) {
+        return 'customer';
+    }
+    return 'platform';
+}
+//# sourceMappingURL=deployment-authentication.js.map

package/node_modules/@noodle-borg/service/dist/deployment-execution.js

@@ -266,7 +266,7 @@ export async function executeAuthorizedDeployment(input, dependencies) {
             assets: hostedAssets,
         });
     }
-    const embedId = await provisionPublicEmbed(registry, options, tenant, result.deploymentId);
+    const embedId = await provisionPublicEmbed(registry, options, tenant, result.deploymentId, input.allowRevokedEmbedReplacement);
     return { ok: true, result, ...(embedId === undefined ? {} : { embedId }) };
 }
 function reject(status, body) {

package/node_modules/@noodle-borg/service/dist/deployment-record-version.js

@@ -0,0 +1,31 @@
+import { sameDeploymentScope } from './deployment-versioning.js';
+const VERSION_ERROR = {
+    code: 'unsupported_deployment_record_version',
+    path: 'schemaVersion',
+    message: 'Deployment record version is not supported by this runtime.',
+};
+export class UnsupportedDeploymentRecordVersionError extends Error {
+    code = VERSION_ERROR.code;
+    constructor() {
+        super(VERSION_ERROR.message);
+        this.name = 'UnsupportedDeploymentRecordVersionError';
+    }
+}
+/** R0 understands newer ownership records but must never serve their authentication semantics. */
+export function deploymentRecordVersionError(record) {
+    return record.schemaVersion === 1 ? undefined : VERSION_ERROR;
+}
+/** A stale writer cannot replace or deactivate a newer policy, even after registry preflight. */
+export function assertDeploymentAppendVersion(records, candidate) {
+    if (records.some((record) => record.schemaVersion > candidate.schemaVersion &&
+        (record.deploymentId === candidate.deploymentId ||
+            (candidate.active &&
+                record.active &&
+                record.archivedAt === undefined &&
+                sameDeploymentScope(record, candidate)))))
+        throw new UnsupportedDeploymentRecordVersionError();
+}
+export function unsupportedDeploymentRecordFailure() {
+    return { ok: false, errors: [VERSION_ERROR] };
+}
+//# sourceMappingURL=deployment-record-version.js.map

package/node_modules/@noodle-borg/service/dist/developer-mcp/inspection.js

@@ -8,7 +8,21 @@ export async function inspectServiceDeployment(registry, tenant, baseUrl, endpoi
     return {
         ok: true,
         target: status.target,
-        deployment: status.deployment,
+        // Keep the Developer MCP port projection explicit as status gains additive operator fields.
+        deployment: {
+            deploymentId: status.deployment.deploymentId,
+            endpointUrl: status.deployment.endpointUrl,
+            active: status.deployment.active,
+            serverName: status.deployment.serverName,
+            createdAt: status.deployment.createdAt,
+            ...(status.deployment.createdByEmail === undefined
+                ? {}
+                : { createdByEmail: status.deployment.createdByEmail }),
+            accessMode: status.deployment.accessMode,
+            ...(status.deployment.ownerSubject === undefined
+                ? {}
+                : { ownerSubject: status.deployment.ownerSubject }),
+        },
         health: {
             state: status.health.state,
             missingSecrets: status.config.missingSecrets,

package/node_modules/@noodle-borg/service/dist/operation-coordination.js

@@ -0,0 +1,185 @@
+import { createHash, createHmac, randomUUID } from 'node:crypto';
+import { canonicalJson } from '@noodle-borg/compiler';
+/** The same opaque resource identity is used by ordinary dispatch and reviewed custody migrations. */
+export function deriveOperationCoordinationResource(input) {
+    if (typeof input.identityKey !== 'string' ||
+        input.identityKey.length < 32 ||
+        !/^[A-Za-z0-9_-]{1,128}$/.test(input.connectionId) ||
+        !/^[A-Za-z0-9_-]{1,80}$/.test(input.namespace) ||
+        typeof input.key !== 'string' ||
+        input.key.length < 1 ||
+        input.key.length > 2048 ||
+        ![input.scope.org, input.scope.app, input.scope.env, input.scope.installationId].every((value) => typeof value === 'string' && value.length > 0 && value.length <= 256))
+        throw new Error('Invalid coordination resource authority');
+    return createHmac('sha256', input.identityKey)
+        .update(canonicalJson({
+        scope: input.scope,
+        connectionId: input.connectionId,
+        namespace: input.namespace,
+        key: input.key,
+    }))
+        .digest('hex');
+}
+/** No business payloads, provider-specific logic, automatic retries or time-based unlocks. */
+export function createOperationCoordinationPort(options) {
+    if (options.identityKey.length < 32 || !/^[A-Za-z0-9_-]{16,128}$/.test(options.epoch))
+        throw new Error('Invalid coordination authority configuration');
+    const now = () => options.now?.() ?? Date.now();
+    const authority = async (intent, generation) => {
+        const current = options.connectionGeneration(intent.connectionId);
+        if (!current ||
+            (generation !== undefined && current !== generation) ||
+            !(await options.authorize()))
+            throw new Error('Original operation authority unavailable');
+        return current;
+    };
+    return {
+        async acquire(intent) {
+            validateIntent(intent);
+            const generation = await authority(intent);
+            // Deliberately excludes deployment, connection generation and execution epoch: replacing an
+            // artifact or reconnecting cannot bypass a held resource. Tenant/app/environment remain isolated.
+            const resource = deriveOperationCoordinationResource({
+                scope: options.scope,
+                connectionId: intent.connectionId,
+                namespace: intent.namespace,
+                key: intent.key,
+                identityKey: options.identityKey,
+            });
+            const startedAt = now();
+            const record = {
+                scope: options.scope,
+                resource,
+                token: randomUUID(),
+                epoch: options.epoch,
+                generation,
+                reference: intent.reference,
+                operationDigest: createHash('sha256').update(intent.id).digest('hex'),
+                startedAt,
+                deadline: startedAt + intent.executionBoundMs,
+                state: 'executing',
+            };
+            const claimed = await options.store.claim(record);
+            const previous = claimed.previous;
+            const recoverable = !claimed.acquired &&
+                previous !== undefined &&
+                previous.generation === generation &&
+                previous.epoch === options.epoch &&
+                (previous.state === 'unknown' || previous.deadline <= startedAt);
+            let resolved = false;
+            let finished = false;
+            return {
+                acquired: claimed.acquired,
+                ...(recoverable
+                    ? {
+                        previous: {
+                            reference: previous.reference,
+                            operationDigest: previous.operationDigest,
+                        },
+                    }
+                    : {}),
+                async finish(evidence) {
+                    if (!claimed.acquired || finished)
+                        return;
+                    finished = true;
+                    // No expiry authorizes a retry. Only proven completion or proof of no dispatched effect
+                    // releases custody; an outer success message without explicit evidence remains unknown.
+                    if (evidence.outcome === 'completed' || evidence.outcome === 'rejected') {
+                        await options.store.release(resource, record.token, evidence.outcome);
+                    }
+                    else
+                        await options.store.markUnknown(resource, record.token);
+                },
+                async resolvePrevious() {
+                    if (!recoverable || !previous || resolved)
+                        throw new Error('Prior operation cannot be resolved');
+                    await authority(intent, generation);
+                    if (now() > record.deadline)
+                        throw new Error('Recovery execution expired');
+                    if (!(await options.store.release(resource, previous.token, 'source_verified')))
+                        throw new Error('Prior operation changed before resolution');
+                    resolved = true;
+                },
+            };
+        },
+    };
+}
+function validateIntent(intent) {
+    if (!/^[a-f0-9]{64}$/.test(intent.id) ||
+        !/^[A-Za-z0-9_-]{1,128}$/.test(intent.connectionId) ||
+        !/^[A-Za-z0-9_-]{1,80}$/.test(intent.namespace) ||
+        typeof intent.key !== 'string' ||
+        intent.key.length < 1 ||
+        intent.key.length > 2048 ||
+        typeof intent.reference !== 'string' ||
+        !/^[A-Za-z0-9._:@/-]{1,256}$/.test(intent.reference) ||
+        intent.reference.includes('://') ||
+        !Number.isSafeInteger(intent.executionBoundMs) ||
+        intent.executionBoundMs < 1 ||
+        intent.executionBoundMs > 120000)
+        throw new Error('Invalid coordination intent');
+}
+/** Explicit local/test composition; hosted production supplies the PostgreSQL implementation. */
+export class InMemoryOperationCoordinationStore {
+    now;
+    records = new Map();
+    receipts = [];
+    constructor(now = Date.now) {
+        this.now = now;
+    }
+    async claim(record) {
+        const previous = this.records.get(record.resource);
+        if (previous && canonicalJson(previous.scope) !== canonicalJson(record.scope))
+            throw new Error('Coordination scope mismatch');
+        if (previous)
+            return { acquired: false, previous: structuredClone(previous) };
+        this.records.set(record.resource, structuredClone(record));
+        return { acquired: true };
+    }
+    async markUnknown(resource, token) {
+        const record = this.records.get(resource);
+        if (record?.token === token)
+            this.records.set(resource, { ...record, state: 'unknown' });
+    }
+    async release(resource, token, resolution) {
+        if (!['completed', 'rejected', 'source_verified'].includes(resolution))
+            throw new Error('Invalid coordination resolution');
+        const record = this.records.get(resource);
+        if (!record || record.token !== token)
+            return false;
+        if (resolution === 'source_verified')
+            this.receipts.push({ record: structuredClone(record), resolution, resolvedAt: this.now() });
+        return this.records.delete(resource);
+    }
+    async list(scope, limit = 100, beforeResource) {
+        if (!Number.isSafeInteger(limit) ||
+            limit < 1 ||
+            limit > 100 ||
+            (beforeResource !== undefined && !/^[a-f0-9]{64}$/.test(beforeResource)))
+            throw new Error('Invalid coordination paging');
+        return [...this.records.values()]
+            .filter((record) => canonicalJson(record.scope) === canonicalJson(scope) &&
+            (!beforeResource || record.resource > beforeResource))
+            .sort((a, b) => a.resource.localeCompare(b.resource))
+            .slice(0, limit)
+            .map((record) => structuredClone(record));
+    }
+    async resolve(scope, resource, token, review) {
+        if (![review.reviewer, review.reason].every((value) => typeof value === 'string' && value.trim().length > 0 && value.length <= 256))
+            throw new Error('Invalid coordination review');
+        const record = this.records.get(resource);
+        if (!record ||
+            record.token !== token ||
+            canonicalJson(record.scope) !== canonicalJson(scope) ||
+            (record.state === 'executing' && record.deadline > this.now()))
+            return false;
+        this.receipts.push({
+            record: structuredClone(record),
+            resolution: 'reviewed',
+            ...review,
+            resolvedAt: this.now(),
+        });
+        return this.records.delete(resource);
+    }
+}
+//# sourceMappingURL=operation-coordination.js.map

package/node_modules/@noodle-borg/service/dist/operation-evidence.js

@@ -20,13 +20,14 @@ export function createOperationEvidencePort(options) {
                 bound >= days * 86_400_000 ||
                 !(await options.authorize(intent)))
                 throw new Error('Operation evidence authority unavailable');
-            const connectionId = intent.operation.credentialBinding?.connectionId;
+            const connectionId = intent.operation.credentialBinding?.connectionId ?? intent.connectionId;
             const generation = connectionId === undefined ? undefined : options.connectionGeneration(connectionId);
             if (connectionId !== undefined && generation === undefined)
                 throw new Error('Original connected account unavailable');
             const record = {
                 scope: options.scope,
                 id: intent.id,
+                ...(intent.parentId === undefined ? {} : { parentId: intent.parentId }),
                 lease: randomUUID(),
                 epoch: options.epoch,
                 deploymentId: options.deploymentId,
@@ -44,6 +45,7 @@ export function createOperationEvidencePort(options) {
                     input: intent.arguments,
                     caller: intent.caller ?? null,
                     revision: intent.executionRevision ?? null,
+                    parentId: intent.parentId ?? null,
                     generation: generation ?? null,
                 }),
                 startedAt,

package/node_modules/@noodle-borg/service/dist/registry-access.js

@@ -1,4 +1,5 @@
-import { assertUniqueActiveCustomerAuthAudienceBindings, CustomerAuthAudienceConflictError, } from './customer-auth-audience-binding.js';
+import { assertUniqueActiveCustomerAuthAudienceBindings, CustomerAuthAudienceConflictError, requiresCustomerAuthProjection, } from './customer-auth-audience-binding.js';
+import { deploymentRecordVersionError } from './deployment-record-version.js';
 import { deploymentOwnerSubject } from './registry-helpers.js';
 import { activeRecord, activeRecordVersion } from './registry-state.js';
 import { tenantDeploymentKey, tryServedTargetFor } from './registry-targets.js';
@@ -41,6 +42,15 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
         : await activeRecordVersion(state, tenant, options.serverVersion);
     if (record === undefined)
         return noActiveDeployment();
+    const versionError = deploymentRecordVersionError(record);
+    if (versionError !== undefined) {
+        return {
+            ok: false,
+            status: 409,
+            code: 'unsupported_deployment_record_version',
+            message: versionError.message,
+        };
+    }
     const nextAccessMode = options.accessMode;
     const previousAccessMode = record.accessMode ?? 'owner-only';
     const previousOwnerSubject = deploymentOwnerSubject(record);
@@ -64,12 +74,14 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
             ? commitInMemoryAccessUpdate(state, tenant, record, {
                 accessMode: nextAccessMode,
                 expectedAccessMode: record.accessMode,
+                expectedSchemaVersion: record.schemaVersion,
                 expectedOwnerSubject: previousOwnerSubject,
                 ...(serverAuth !== undefined ? { serverAuth } : {}),
             })
             : await state.store.updateActiveAccess(tenant, record.deploymentId, {
                 accessMode: nextAccessMode,
                 expectedAccessMode: record.accessMode,
+                expectedSchemaVersion: record.schemaVersion,
                 expectedOwnerSubject: previousOwnerSubject,
                 ...(serverAuth !== undefined ? { serverAuth } : {}),
             });
@@ -120,6 +132,7 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
                 ? { ownerSubject: nextOwnerSubject }
                 : {}),
             expectedAccessMode: record.accessMode,
+            expectedSchemaVersion: record.schemaVersion,
             expectedOwnerSubject: previousOwnerSubject,
             ...(serverAuth !== undefined ? { serverAuth } : {}),
         })
@@ -129,6 +142,7 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
                 ? { ownerSubject: nextOwnerSubject }
                 : {}),
             expectedAccessMode: record.accessMode,
+            expectedSchemaVersion: record.schemaVersion,
             expectedOwnerSubject: previousOwnerSubject,
             ...(serverAuth !== undefined ? { serverAuth } : {}),
         });
@@ -155,19 +169,20 @@ function commitInMemoryAccessUpdate(state, tenant, observed, input) {
         current.appSlug !== tenant.app ||
         current.environment !== tenant.env ||
         current.accessMode !== input.expectedAccessMode ||
+        current.schemaVersion !== (input.expectedSchemaVersion ?? 1) ||
         deploymentOwnerSubject(current) !== input.expectedOwnerSubject) {
         return undefined;
     }
     if ((current.accessMode ?? 'owner-only') === input.accessMode &&
         (input.ownerSubject === undefined || deploymentOwnerSubject(current) === input.ownerSubject) &&
-        input.accessMode !== 'customers') {
+        !requiresCustomerAuthProjection({ ...current, accessMode: input.accessMode }, input.serverAuth)) {
         return current;
     }
     const committed = {
         ...current,
         accessMode: input.accessMode,
         ...(input.ownerSubject !== undefined ? { ownerSubject: input.ownerSubject } : {}),
-        ...(input.accessMode === 'customers' && input.serverAuth !== undefined
+        ...(requiresCustomerAuthProjection({ ...current, accessMode: input.accessMode }, input.serverAuth) && input.serverAuth !== undefined
             ? { serverAuth: input.serverAuth }
             : {}),
     };

package/node_modules/@noodle-borg/service/dist/registry-compile.js

@@ -4,12 +4,24 @@ import { compileConnectors, delegatedTokenExchangeIdentityErrors, } from '@noodl
 import { InMemoryConnectorRegistry, resolveManagedOrigins, resolveVariableEnvironment, } from '@noodle-borg/runtime';
 import { AppPackageSnapshotError, createAppPackageSnapshot, } from './app-package-snapshot.js';
 import { missingServerConfigErrors } from './assistant-bindings.js';
+import { normalizePersistedConnectorsForCompile } from './connector-normalize.js';
 import { ManagedConfigBroker } from './credential-broker.js';
 import { deploymentCredentialBrokerOptions } from './credential-broker-options.js';
+import { deploymentRecordVersionError } from './deployment-record-version.js';
 import { normalizePersistedManifestForCompile } from './manifest-normalize.js';
-import { missingSecretErrors, missingVariableErrors } from './registry-helpers.js';
+import { missingCapabilityErrors, missingSecretErrors, missingVariableErrors, } from './registry-helpers.js';
+import { servedTargetFor } from './registry-targets.js';
 import { createDeploymentStateConnector, } from './state-connector-factory.js';
 import { resolveConfigScope, } from './store.js';
+/** Reject unsupported persisted semantics before constructing executable runtime dependencies. */
+export async function compilePersistedRegistryRecord(record, compileTarget) {
+    const versionError = deploymentRecordVersionError(record);
+    if (versionError !== undefined)
+        return { ok: false, errors: [versionError] };
+    return compileTarget({ org: record.orgSlug, app: record.appSlug, env: record.environment }, record.manifest, record.connectors === undefined
+        ? undefined
+        : normalizePersistedConnectorsForCompile(record.connectors), record.hostedAssets, false, record.deploymentId);
+}
 export async function compileRegistryTarget(context, input) {
     const { tenant, manifest, connectors, hostedAssets, deploymentId } = input;
     let catalogConnectors = [];
@@ -216,4 +228,33 @@ export async function compileRegistryTarget(context, input) {
         ...(appPackageSnapshot !== undefined ? { appPackageSnapshot } : {}),
     };
 }
+/** Load and validate persisted semantics before publishing an executable target to caches. */
+export async function loadPersistedRegistryTarget(source, context) {
+    const { state } = context;
+    const record = typeof source === 'string'
+        ? state.store
+            ? await state.store.get(source)
+            : state.records.get(source)
+        : source;
+    if (!record ||
+        record.archivedAt !== undefined ||
+        deploymentRecordVersionError(record) !== undefined)
+        return undefined;
+    const deploymentId = record.deploymentId;
+    const built = await context.compile(record);
+    if (!built.ok) {
+        throw new Error(`deployment ${deploymentId} failed to recompile (${built.errors.map((e) => e.code).join(',')})`);
+    }
+    const missingCapabilities = missingCapabilityErrors(built.served.artifact.requirements?.capabilities ?? [], context.capabilities);
+    if (missingCapabilities.length > 0) {
+        throw new Error(`deployment ${deploymentId} failed capability requirements (${missingCapabilities.map((e) => e.path).join(',')})`);
+    }
+    if (record.active &&
+        (await context.hasCustomerAuthConflict(record, built.served.artifact.server.auth)))
+        return undefined;
+    const target = servedTargetFor(record, built.served, context.customerVerifierFactory);
+    state.servers.set(deploymentId, target);
+    state.records.set(deploymentId, record);
+    return target;
+}
 //# sourceMappingURL=registry-compile.js.map