@noodleseed/one 0.164.0 → 0.166.0

package/node_modules/@noodle-borg/service/dist/routes/business-information.js

@@ -1,14 +1,15 @@
 import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
 import { BusinessGrantCreateRequestSchema, formatWireError, ManagedRecordCreateRequestSchema, ManagedRecordMutationRequestSchema, ManagedRecordStatusSchema, SolutionInstallationCreateRequestSchema, SolutionInstallationIntakeRequestSchema, } from '@noodle-borg/wire-contracts';
 import { admitBusinessMutation, admitBusinessTarget, authorizeBusinessApi, } from '../business-api-admission.js';
+import { resolveInstallDefinition } from '../business-information/definition-resolver.js';
 import { BUILT_IN_SOLUTION_PROFILES, businessGrantAllows, MANAGED_SOLUTION_PROFILE_KEYS, PayloadValidationError, validateCollectionEnabled, } from '../business-information/portable.js';
 import { sendForbidden } from '../http-util.js';
 import { loadExternalRecord, sendExternalRecordPage, sourceBindingKey, unsupportedExternalOperation, } from './business-information-external.js';
-import { resolveInstallDefinition, stableInstallationId, } from './business-information-installation.js';
+import { installationProjection, retryInstallationActivation, stableInstallationId, } from './business-information-installation.js';
 import { createNativeRecord } from './business-information-record-create.js';
 import { cursorRequest, sendNativeRecordActivity } from './business-information-record-reads.js';
 import { expectedRevision, mutationPermission, parseNativeRecordQuery, parseBusinessPaging as parsePaging, requestIdempotencyKey, } from './business-information-request.js';
-import { collectionToWire, externalRecordToWire, grantToWire, installationToWire, profileToWire, recordDetailToWire, recordToWire, } from './business-information-wire.js';
+import { collectionToWire, externalRecordToWire, grantToWire, profileToWire, recordDetailToWire, recordToWire, } from './business-information-wire.js';
 import { canManageMembers } from './org-admin.js';
 export function handleSolutionCatalog(req, res) {
     if (req.method !== 'GET') {
@@ -26,6 +27,8 @@ export async function handleSolutionInstallations(req, res, ref, deps) {
     const identity = await requireIdentity(req, res, deps);
     if (identity === false)
         return;
+    if (ref.action === 'activate')
+        return retryInstallationActivation(req, res, ref, identity, deps);
     if (req.method === 'POST' && ref.installationId === undefined) {
         if (!(await canManageMembers(deps.controlPlane, ref.org, identity))) {
             return sendForbidden(res, 'organization owner required');
@@ -96,7 +99,7 @@ export async function handleSolutionInstallations(req, res, ref, deps) {
         return sendJson(res, result.disposition === 'created' ? 201 : 200, {
             ok: true,
             data: {
-                installation: installationToWire(result.installation, grant.role),
+                installation: await installationProjection(result.installation, grant.role, identity, deps),
             },
         });
     }
@@ -114,7 +117,7 @@ export async function handleSolutionInstallations(req, res, ref, deps) {
         return sendJson(res, 200, {
             ok: true,
             data: {
-                installations: permitted.map(({ installation, role }) => installationToWire(installation, role)),
+                installations: await Promise.all(permitted.map(({ installation, role }) => installationProjection(installation, role, identity, deps))),
             },
         });
     }
@@ -125,7 +128,7 @@ export async function handleSolutionInstallations(req, res, ref, deps) {
         return sendJson(res, 200, {
             ok: true,
             data: {
-                installation: installationToWire(authorized.installation, authorized.grant.role),
+                installation: await installationProjection(authorized.installation, authorized.grant.role, identity, deps),
             },
         });
     }
@@ -149,7 +152,9 @@ export async function handleSolutionInstallations(req, res, ref, deps) {
             return mutationFailure(res, result);
         return sendJson(res, 200, {
             ok: true,
-            data: { installation: installationToWire(result.installation, authorized.grant.role) },
+            data: {
+                installation: await installationProjection(result.installation, authorized.grant.role, identity, deps),
+            },
         });
     }
     return methodNotAllowed(res);

package/node_modules/@noodle-borg/service/dist/routes/deploy-public-embed.js

@@ -9,7 +9,7 @@ import { publicSurfaceOf } from '@noodle-borg/assistant-gateway/portable';
  * Read from the just-activated artifact rather than the submitted manifest, so the id follows what the
  * runtime will actually serve — the same source minting and projection read.
  */
-export async function provisionPublicEmbed(registry, options, tenant, deploymentId) {
+export async function provisionPublicEmbed(registry, options, tenant, deploymentId, allowRevokedReplacement = true) {
     const embeds = options.publicEmbeds;
     if (embeds === undefined || deploymentId === undefined)
         return undefined;
@@ -18,7 +18,12 @@ export async function provisionPublicEmbed(registry, options, tenant, deployment
     if (surface === undefined)
         return undefined;
     try {
-        const record = await embeds.ensure({ ...tenant, surfaceMode: surface.mode, now: new Date() });
+        const record = await embeds.ensure({
+            ...tenant,
+            surfaceMode: surface.mode,
+            now: new Date(),
+            allowRevokedReplacement,
+        });
         return record.embedId;
     }
     catch {

package/node_modules/@noodle-borg/service/dist/service.js

@@ -96,7 +96,7 @@ export function createServiceHandler(registry, options = {}) {
             allowance: async (org, request) => moduleHost.resolveActivityHistoryAllowance?.(org, request),
         });
     const withIntentMode = createIntentTargetResolver(intentSettings, intentPreviewOrgs);
-    const { activateInstallation, resolveRuntimeTarget, businessOnboarding } = createApplicationServingRuntime(registry, providerOptions, controlPlane, audit, activity);
+    const { activateInstallation, readInstallationActivation, resolveRuntimeTarget, businessOnboarding, } = createApplicationServingRuntime(registry, providerOptions, controlPlane, audit, activity);
     const runtimeTarget = async (target) => target === undefined ? undefined : resolveRuntimeTarget(target);
     const router = createMcpRouter(async (id) => withIntentMode(await runtimeTarget(await registry.getServing(id))), {
         logger,
@@ -282,6 +282,7 @@ export function createServiceHandler(registry, options = {}) {
                 store: businessInformationStore,
                 ...(businessOnboarding ? { businessOnboarding } : {}),
                 activateInstallation,
+                readInstallationActivation,
                 ...(activity === undefined ? {} : { activity }),
                 ...(options.connectionRuntime === undefined
                     ? {}

package/node_modules/@noodle-borg/service/dist/solution-installation-activation.js

@@ -1,9 +1,44 @@
 import { sha256Canonical } from '@noodle-borg/app-package';
+import { publicSurfaceOf } from '@noodle-borg/assistant-gateway/portable';
 import { ApplicationSettings, installationSettingsTarget } from './application-settings.js';
 import { privateDefinitionFromDeployment } from './business-information/definition-resolver.js';
 import { managedSolutionManifest } from './business-information/managed-solution-executable.js';
 import { BUSINESS_SETUP_MESSAGE, BusinessOnboarding } from './business-onboarding.js';
 import { executeAuthorizedDeployment, } from './deployment-execution.js';
+import { provisionPublicEmbed } from './routes/deploy-public-embed.js';
+/** Deployment/binding readiness only; channel model, origin and connection checks remain separate. */
+export async function readSolutionInstallationActivation(installation, dependencies) {
+    try {
+        const { registry, businessInformationStore: store, options, controlPlane } = dependencies;
+        const stored = await store?.getInstallation(installation.scope);
+        if (!store || !stored)
+            return 'unavailable';
+        const { org, app } = stored.scope;
+        const generation = await registry.getAppGeneration(org, app);
+        if ((await registry.getAppArchivedAt(org, app)) !== undefined ||
+            (stored.applicationGeneration !== 'pending' &&
+                (!generation ||
+                    (stored.applicationGeneration !== undefined &&
+                        stored.applicationGeneration !== generation))) ||
+            (options.businessOnboarding !== undefined &&
+                !(await new BusinessOnboarding(options.businessOnboarding, controlPlane, store).ready(stored))))
+            return 'unavailable';
+        const target = await registry.getActiveByTenant(stored.scope);
+        if (!target || stored.applicationGeneration === 'pending')
+            return 'pending';
+        if (publicSurfaceOf(target.served.artifact.server.assistant)) {
+            if (!options.publicEmbeds)
+                return 'unavailable';
+            const embeds = await options.publicEmbeds.list(stored.scope, { includeRevoked: true });
+            if (!embeds.some((embed) => embed.revokedAt === undefined))
+                return embeds.length > 0 ? 'unavailable' : 'pending';
+        }
+        return 'ready';
+    }
+    catch {
+        return 'unavailable';
+    }
+}
 /** Called after installation authorization, and by the managed-runtime refresh boundary. Never copies configuration. */
 export async function activateSolutionInstallation(input, dependencies) {
     const { installation, actor } = input;
@@ -32,13 +67,32 @@ export async function activateSolutionInstallation(input, dependencies) {
         !(await store.bindApplication(installation.scope, generation ?? ''))) {
         return reject(409, 'installation_application_unavailable', 'The retained installation requires application ownership recovery before activation.');
     }
-    const bind = async (deploymentId) => {
+    const bind = async (deploymentId, reconcileEmbed) => {
         const currentGeneration = await dependencies.registry.getAppGeneration(tenant.org, tenant.app);
         if (store &&
             (!currentGeneration || !(await store.bindApplication(installation.scope, currentGeneration))))
             return reject(409, 'installation_application_unavailable', 'Application activation was interrupted; retained records remain accessible.');
         if ((installation.definition.variables?.length ?? 0) > 0)
             await new ApplicationSettings(dependencies.registry.configStore).initialize(installationSettingsTarget(installation));
+        const target = await dependencies.registry.get(deploymentId);
+        if (input.purpose !== 'runtime-refresh' &&
+            dependencies.options.publicEmbeds &&
+            publicSurfaceOf(target?.served.artifact.server.assistant)) {
+            try {
+                if (reconcileEmbed)
+                    await provisionPublicEmbed(dependencies.registry, dependencies.options, tenant, deploymentId, false);
+                const embeds = await dependencies.options.publicEmbeds.list(tenant, {
+                    includeRevoked: true,
+                });
+                if (!embeds.some((embed) => embed.revokedAt === undefined))
+                    return embeds.length > 0
+                        ? reject(409, 'installation_embed_revoked', 'The assistant was deliberately revoked. Use explicit channel recovery; activation does not replace revoked access.')
+                        : reject(503, 'installation_activation_incomplete', 'The installation is saved. Retry activation to finish assistant setup.');
+            }
+            catch {
+                return reject(503, 'installation_activation_incomplete', 'The installation is saved. Retry activation when assistant setup is available.');
+            }
+        }
         return { ok: true, deploymentId };
     };
     const source = await executableSource(installation, dependencies.registry);
@@ -63,7 +117,7 @@ export async function activateSolutionInstallation(input, dependencies) {
         currentSource.manifest === source.value.manifest &&
         currentSource.connectors === source.value.connectors &&
         JSON.stringify(currentSource.hostedAssets) === JSON.stringify(source.value.hostedAssets)) {
-        return bind(current.deploymentId);
+        return bind(current.deploymentId, true);
     }
     const key = sha256Canonical({
         scope: installation.scope,
@@ -84,6 +138,7 @@ export async function activateSolutionInstallation(input, dependencies) {
             ? {}
             : { orgMembershipSources: current.orgMembershipSources }),
         deploymentSource: 'api',
+        allowRevokedEmbedReplacement: false,
         idempotencyKey: key,
     }, dependencies);
     if (!deployed.ok)
@@ -95,7 +150,7 @@ export async function activateSolutionInstallation(input, dependencies) {
                 : 'installation_activation_failed',
             message: 'The installation is saved, but its application could not be activated. Retry installation after resolving the deployment requirement.',
         };
-    return bind(deployed.result.deploymentId);
+    return bind(deployed.result.deploymentId, false);
 }
 async function executableSource(installation, registry) {
     const reference = installation.definition.reference;

package/node_modules/@noodle-borg/service/dist/store/in-memory.d.ts

@@ -12,6 +12,7 @@ export declare class InMemoryArtifactStore implements ArtifactStore {
     findActiveCustomerAuthAudienceConflict(ref: TenantRef, auth: TenantAuthConfig): Promise<TenantRef | undefined>;
     activateDeployment(ref: TenantRef, deploymentId: string, precondition?: {
         readonly expectedAccessMode: AccessMode | undefined;
+        readonly expectedSchemaVersion?: number;
         readonly serverAuth?: TenantAuthConfig;
     }, _options?: {
         readonly automationId?: string;

package/node_modules/@noodle-borg/service/dist/store/in-memory.js

@@ -1,7 +1,8 @@
 import { normalizeServerVersion } from '@noodle-borg/module';
 import { assertSameAppPackageSnapshot, sanitizeDeployRecordAppPackageSnapshot, } from '../app-package-snapshot.js';
-import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, } from '../customer-auth-audience-binding.js';
+import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, requiresCustomerAuthProjection, } from '../customer-auth-audience-binding.js';
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from '../deployment-lock.js';
+import { assertDeploymentAppendVersion } from '../deployment-record-version.js';
 import { defaultActiveRecord, sameDeploymentScope, sameTenantRecord, } from '../deployment-versioning.js';
 import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, planArchivedAppSweep, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
 import { validateSlug, validateTenantRef } from './validate.js';
@@ -10,6 +11,7 @@ export class InMemoryArtifactStore {
     #records = new Map();
     #productionEnvironments = new Map();
     async append(record) {
+        assertDeploymentAppendVersion([...this.#records.values()], record);
         const existing = this.#records.get(record.deploymentId);
         if (existing !== undefined)
             assertSameAppPackageSnapshot(existing, record);
@@ -83,17 +85,22 @@ export class InMemoryArtifactStore {
         if (target === undefined || !sameTenantRecord(target, safe))
             return Promise.resolve(undefined);
         assertDeploymentActivationUnlocked([...this.#records.values()], target);
-        if (precondition !== undefined && target.accessMode !== precondition.expectedAccessMode) {
+        if (target.schemaVersion !== (precondition?.expectedSchemaVersion ?? 1) ||
+            (precondition !== undefined && target.accessMode !== precondition.expectedAccessMode)) {
             return Promise.resolve(undefined);
         }
         const previousActive = [...this.#records.values()]
             .filter((record) => record.active && sameDeploymentScope(record, target))
             .sort((a, b) => b.deploymentVersion - a.deploymentVersion)[0];
+        if (precondition === undefined && previousActive !== undefined) {
+            assertDeploymentAppendVersion([previousActive], { ...target, active: true });
+        }
         const alreadyActive = previousActive?.deploymentId === target.deploymentId;
         const activated = {
             ...target,
             active: true,
-            ...(target.accessMode === 'customers' && precondition?.serverAuth !== undefined
+            ...(requiresCustomerAuthProjection(target, precondition?.serverAuth) &&
+                precondition?.serverAuth !== undefined
                 ? { serverAuth: precondition.serverAuth }
                 : {}),
         };

package/node_modules/@noodle-borg/service/dist/store/json-file.d.ts

@@ -18,6 +18,7 @@ export declare class JsonFileArtifactStore implements ArtifactStore {
     updateActiveAccess(ref: TenantRef, deploymentId: string, input: ActiveAccessUpdateInput): Promise<DeployRecord | undefined>;
     activateDeployment(ref: TenantRef, deploymentId: string, precondition?: {
         readonly expectedAccessMode: AccessMode | undefined;
+        readonly expectedSchemaVersion?: number;
         readonly serverAuth?: TenantAuthConfig;
     }): Promise<DeploymentActivationResult | undefined>;
     loadAll(): Promise<readonly DeployRecord[]>;

package/node_modules/@noodle-borg/service/dist/store/json-file.js

@@ -3,8 +3,9 @@ import { mkdir, readdir, readFile, rename, rm, writeFile } from 'node:fs/promise
 import { join } from 'node:path';
 import { normalizeServerVersion } from '@noodle-borg/module';
 import { assertSameAppPackageSnapshot, sanitizeDeployRecordAppPackageSnapshot, } from '../app-package-snapshot.js';
-import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, } from '../customer-auth-audience-binding.js';
+import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, requiresCustomerAuthProjection, } from '../customer-auth-audience-binding.js';
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from '../deployment-lock.js';
+import { assertDeploymentAppendVersion } from '../deployment-record-version.js';
 import { defaultActiveRecord, sameDeploymentScope, sameTenantRecord, } from '../deployment-versioning.js';
 import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, planArchivedAppSweep, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
 import { DEPLOYMENT_ID_PATTERN, validateSlug, validateTenantRef } from './validate.js';
@@ -34,6 +35,7 @@ export class JsonFileArtifactStore {
             throw new Error(`invalid deploymentId for persistence: "${record.deploymentId}"`);
         }
         const records = await this.loadAll();
+        assertDeploymentAppendVersion(records, record);
         const existing = records.find((candidate) => candidate.deploymentId === record.deploymentId);
         if (existing !== undefined)
             assertSameAppPackageSnapshot(existing, record);
@@ -127,7 +129,8 @@ export class JsonFileArtifactStore {
             const target = await this.get(deploymentId);
             if (target === undefined || !sameTenantRecord(target, safe))
                 return undefined;
-            if (precondition !== undefined && target.accessMode !== precondition.expectedAccessMode) {
+            if (target.schemaVersion !== (precondition?.expectedSchemaVersion ?? 1) ||
+                (precondition !== undefined && target.accessMode !== precondition.expectedAccessMode)) {
                 return undefined;
             }
             const records = await this.loadAll();
@@ -135,11 +138,15 @@ export class JsonFileArtifactStore {
             const previousActive = records
                 .filter((record) => record.active && sameDeploymentScope(record, target))
                 .sort((a, b) => b.deploymentVersion - a.deploymentVersion)[0];
+            if (precondition === undefined && previousActive !== undefined) {
+                assertDeploymentAppendVersion([previousActive], { ...target, active: true });
+            }
             const alreadyActive = previousActive?.deploymentId === target.deploymentId;
             const activated = {
                 ...target,
                 active: true,
-                ...(target.accessMode === 'customers' && precondition?.serverAuth !== undefined
+                ...(requiresCustomerAuthProjection(target, precondition?.serverAuth) &&
+                    precondition?.serverAuth !== undefined
                     ? { serverAuth: precondition.serverAuth }
                     : {}),
             };

package/node_modules/@noodle-borg/service/dist/store/records.js

@@ -5,6 +5,7 @@
  * own persistence and feed their own raw records/anchors through these pure functions so every
  * backend groups, ranks, and sorts identically.
  */
+import { requiresCustomerAuthProjection } from '../customer-auth-audience-binding.js';
 import { sameTenantRecord } from '../deployment-versioning.js';
 import { deploymentOwnerSubject } from '../registry-helpers.js';
 import { validateSlug } from './validate.js';
@@ -139,17 +140,18 @@ export function resolveActiveAccessUpdate(record, ref, input) {
         record.archivedAt !== undefined ||
         !sameTenantRecord(record, ref) ||
         record.accessMode !== input.expectedAccessMode ||
+        record.schemaVersion !== (input.expectedSchemaVersion ?? 1) ||
         deploymentOwnerSubject(record) !== input.expectedOwnerSubject)
         return undefined;
     if ((record.accessMode ?? 'owner-only') === input.accessMode &&
         (input.ownerSubject === undefined || deploymentOwnerSubject(record) === input.ownerSubject) &&
-        input.accessMode !== 'customers')
+        !requiresCustomerAuthProjection({ ...record, accessMode: input.accessMode }, input.serverAuth))
         return record;
     return {
         ...record,
         accessMode: input.accessMode,
         ...(input.ownerSubject !== undefined ? { ownerSubject: input.ownerSubject } : {}),
-        ...(input.accessMode === 'customers' && input.serverAuth !== undefined
+        ...(requiresCustomerAuthProjection({ ...record, accessMode: input.accessMode }, input.serverAuth) && input.serverAuth !== undefined
             ? { serverAuth: input.serverAuth }
             : {}),
     };

package/node_modules/@noodle-borg/service/dist/store.d.ts

@@ -3,7 +3,7 @@ import type { OrganizationStore } from '@noodle-borg/control-plane/portable';
 import type { OrgMembershipSource } from '@noodle-borg/module';
 import type { SealedSecret } from '@noodle-borg/runtime';
 import type { AccessMode } from '@noodle-borg/transport-http';
-import type { DeploymentSource } from '@noodle-borg/wire-contracts';
+import type { DeploymentAuthentication, DeploymentSource } from '@noodle-borg/wire-contracts';
 import type { AppPackageSnapshotV1 } from './app-package-snapshot.js';
 import type { ProductionEnvironmentChange } from './store/environment-production.js';
 export type { ActiveMcpSubdomainClaim, ChangeMcpSubdomainInput, CreateOrgWithOwnerInput, McpSubdomainMutationResult, McpSubdomainSetting, OrgDomainRecord, OrgInvitationRecord, OrgMemberRecord, OrgOpenAIAppsChallengeRecord, OrgRecord, OrgRole, PersonalWorkspaceProvisionInput, PersonalWorkspaceProvisionResult, SignupAllowlistKind, SignupAllowlistRecord, WelcomeEmailRecord, } from '@noodle-borg/control-plane/portable';
@@ -241,6 +241,7 @@ export interface DeploymentStatus {
         readonly createdByEmail?: string;
         readonly ownerSubject?: string;
         readonly accessMode: AccessMode;
+        readonly authentication?: DeploymentAuthentication;
         readonly deploymentLock?: DeploymentLockMetadata;
     };
     readonly health: {
@@ -262,6 +263,8 @@ export interface ActiveAccessUpdateInput {
     /** Desired owner mutation. Omission preserves the current effective owner; clearing is unsupported. */
     readonly ownerSubject?: string;
     readonly expectedAccessMode: AccessMode | undefined;
+    /** Older callers omit this and are restricted to version-1 records. */
+    readonly expectedSchemaVersion?: number;
     readonly expectedOwnerSubject: string | undefined;
     /** Compiler-authoritative projection persisted atomically when enabling customer access. */
     readonly serverAuth?: TenantAuthConfig;
@@ -303,6 +306,7 @@ export interface ArtifactStore {
     findActiveCustomerAuthAudienceConflict?(ref: TenantRef, auth: TenantAuthConfig): Promise<TenantRef | undefined>;
     activateDeployment(ref: TenantRef, deploymentId: string, precondition?: {
         readonly expectedAccessMode: AccessMode | undefined;
+        readonly expectedSchemaVersion?: number;
         /** Compiler-authoritative projection persisted atomically when activating customer access. */
         readonly serverAuth?: TenantAuthConfig;
     }, options?: {

package/node_modules/@noodle-borg/service/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.101.0",
+    "@noodle-borg/agent-kit": "0.102.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/node_modules/@noodle-borg/wire-contracts/dist/business-information.d.ts

@@ -427,6 +427,18 @@ export declare const SolutionInstallationIntakeRequestSchema: z.ZodObject<{
     expectedRevision: z.ZodNumber;
 }, z.core.$strict>;
 export type SolutionInstallationIntakeRequest = z.infer<typeof SolutionInstallationIntakeRequestSchema>;
+export declare const SolutionInstallationActivateRequestSchema: z.ZodObject<{}, z.core.$strict>;
+export declare const SolutionInstallationActivationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    state: z.ZodLiteral<"pending">;
+    canRetry: z.ZodBoolean;
+}, z.core.$strict>, z.ZodObject<{
+    state: z.ZodEnum<{
+        unavailable: "unavailable";
+        ready: "ready";
+    }>;
+    canRetry: z.ZodLiteral<false>;
+}, z.core.$strict>], "state">;
+export type SolutionInstallationActivation = z.infer<typeof SolutionInstallationActivationSchema>;
 export declare const ResolvedManagedSolutionDefinitionSchema: z.ZodObject<{
     kind: z.ZodLiteral<"managed">;
     definitionId: z.ZodEnum<{
@@ -574,6 +586,16 @@ export declare const SolutionInstallationSchema: z.ZodObject<{
     profileId: z.ZodOptional<z.ZodEnum<{
         b2b_saas: "b2b_saas";
     }>>;
+    activation: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        state: z.ZodLiteral<"pending">;
+        canRetry: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        state: z.ZodEnum<{
+            unavailable: "unavailable";
+            ready: "ready";
+        }>;
+        canRetry: z.ZodLiteral<false>;
+    }, z.core.$strict>], "state">>;
     id: z.ZodString;
     organizationId: z.ZodString;
     appSlug: z.ZodString;
@@ -690,6 +712,16 @@ export declare const SolutionInstallationResponseSchema: z.ZodObject<{
             profileId: z.ZodOptional<z.ZodEnum<{
                 b2b_saas: "b2b_saas";
             }>>;
+            activation: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                state: z.ZodLiteral<"pending">;
+                canRetry: z.ZodBoolean;
+            }, z.core.$strict>, z.ZodObject<{
+                state: z.ZodEnum<{
+                    unavailable: "unavailable";
+                    ready: "ready";
+                }>;
+                canRetry: z.ZodLiteral<false>;
+            }, z.core.$strict>], "state">>;
             id: z.ZodString;
             organizationId: z.ZodString;
             appSlug: z.ZodString;
@@ -808,6 +840,16 @@ export declare const SolutionInstallationListResponseSchema: z.ZodObject<{
             profileId: z.ZodOptional<z.ZodEnum<{
                 b2b_saas: "b2b_saas";
             }>>;
+            activation: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                state: z.ZodLiteral<"pending">;
+                canRetry: z.ZodBoolean;
+            }, z.core.$strict>, z.ZodObject<{
+                state: z.ZodEnum<{
+                    unavailable: "unavailable";
+                    ready: "ready";
+                }>;
+                canRetry: z.ZodLiteral<false>;
+            }, z.core.$strict>], "state">>;
             id: z.ZodString;
             organizationId: z.ZodString;
             appSlug: z.ZodString;
@@ -1136,6 +1178,16 @@ export declare const BusinessInvitationAcceptResponseSchema: z.ZodObject<{
             profileId: z.ZodOptional<z.ZodEnum<{
                 b2b_saas: "b2b_saas";
             }>>;
+            activation: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                state: z.ZodLiteral<"pending">;
+                canRetry: z.ZodBoolean;
+            }, z.core.$strict>, z.ZodObject<{
+                state: z.ZodEnum<{
+                    unavailable: "unavailable";
+                    ready: "ready";
+                }>;
+                canRetry: z.ZodLiteral<false>;
+            }, z.core.$strict>], "state">>;
             id: z.ZodString;
             organizationId: z.ZodString;
             appSlug: z.ZodString;

package/node_modules/@noodle-borg/wire-contracts/dist/business-information.js

@@ -153,7 +153,13 @@ export const SolutionInstallationIntakeRequestSchema = z.strictObject({
     active: z.boolean(),
     expectedRevision: positiveRevision,
 });
+export const SolutionInstallationActivateRequestSchema = z.strictObject({});
+export const SolutionInstallationActivationSchema = z.discriminatedUnion('state', [
+    z.strictObject({ state: z.literal('pending'), canRetry: z.boolean() }),
+    z.strictObject({ state: z.enum(['ready', 'unavailable']), canRetry: z.literal(false) }),
+]);
 const installationShape = {
+    activation: SolutionInstallationActivationSchema.optional(),
     id,
     organizationId: id,
     appSlug: slug,

package/node_modules/@noodle-borg/wire-contracts/dist/control-plane.d.ts

@@ -1,5 +1,12 @@
 /** Strict service-output contracts for control-plane reads and mutations (ADR 0128). */
 import { z } from 'zod';
+/** Effective authority enforcing caller authentication for one deployment. */
+export declare const deploymentAuthenticationSchema: z.ZodEnum<{
+    customer: "customer";
+    none: "none";
+    platform: "platform";
+}>;
+export type DeploymentAuthentication = z.infer<typeof deploymentAuthenticationSchema>;
 /** Exact OAuth subject bound by an operator to an owner-only deployment. */
 export declare const deploymentOwnerSubjectSchema: z.ZodString;
 export declare const accessUpdateRequestSchema: z.ZodObject<{
@@ -32,6 +39,11 @@ export declare const accessUpdateResponseSchema: z.ZodObject<{
             mixed: "mixed";
             customers: "customers";
         }>;
+        authentication: z.ZodOptional<z.ZodEnum<{
+            customer: "customer";
+            none: "none";
+            platform: "platform";
+        }>>;
         ownerSubject: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
     previousAccessMode: z.ZodEnum<{
@@ -45,6 +57,7 @@ export declare const accessUpdateResponseSchema: z.ZodObject<{
     previousOwnerSubject: z.ZodOptional<z.ZodString>;
     accessChanged: z.ZodBoolean;
     ownerChanged: z.ZodBoolean;
+    policyChanged: z.ZodOptional<z.ZodBoolean>;
     changed: z.ZodBoolean;
 }, z.core.$strict>;
 export type AccessUpdateResponse = z.output<typeof accessUpdateResponseSchema>;
@@ -71,6 +84,11 @@ export declare const accessUpdateClientResponseSchema: z.ZodPipe<z.ZodObject<{
             mixed: "mixed";
             customers: "customers";
         }>;
+        authentication: z.ZodOptional<z.ZodEnum<{
+            customer: "customer";
+            none: "none";
+            platform: "platform";
+        }>>;
         ownerSubject: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     previousAccessMode: z.ZodEnum<{
@@ -84,6 +102,7 @@ export declare const accessUpdateClientResponseSchema: z.ZodPipe<z.ZodObject<{
     previousOwnerSubject: z.ZodOptional<z.ZodString>;
     accessChanged: z.ZodOptional<z.ZodBoolean>;
     ownerChanged: z.ZodOptional<z.ZodBoolean>;
+    policyChanged: z.ZodOptional<z.ZodBoolean>;
     changed: z.ZodBoolean;
 }, z.core.$strip>, z.ZodTransform<{
     accessChanged: boolean;
@@ -97,12 +116,14 @@ export declare const accessUpdateClientResponseSchema: z.ZodPipe<z.ZodObject<{
         deploymentId: string;
         accessMode: "owner-only" | "org-members" | "authenticated" | "public" | "mixed" | "customers";
         serverVersion?: string | undefined;
+        authentication?: "customer" | "none" | "platform" | undefined;
         ownerSubject?: string | undefined;
     };
     previousAccessMode: "owner-only" | "org-members" | "authenticated" | "public" | "mixed" | "customers";
     changed: boolean;
     previousOwnerSubject?: string | undefined;
     ownerChanged?: boolean | undefined;
+    policyChanged?: boolean | undefined;
 }, {
     ok: true;
     target: {
@@ -114,6 +135,7 @@ export declare const accessUpdateClientResponseSchema: z.ZodPipe<z.ZodObject<{
         deploymentId: string;
         accessMode: "owner-only" | "org-members" | "authenticated" | "public" | "mixed" | "customers";
         serverVersion?: string | undefined;
+        authentication?: "customer" | "none" | "platform" | undefined;
         ownerSubject?: string | undefined;
     };
     previousAccessMode: "owner-only" | "org-members" | "authenticated" | "public" | "mixed" | "customers";
@@ -121,6 +143,7 @@ export declare const accessUpdateClientResponseSchema: z.ZodPipe<z.ZodObject<{
     previousOwnerSubject?: string | undefined;
     accessChanged?: boolean | undefined;
     ownerChanged?: boolean | undefined;
+    policyChanged?: boolean | undefined;
 }>>;
 export type AccessUpdateClientResponse = z.output<typeof accessUpdateClientResponseSchema>;
 export declare const WhoamiIdentityResponseSchema: z.ZodObject<{