@noodleseed/one 0.165.0 → 0.166.0

package/dist/commands/deploy-status-ops.d.ts

@@ -1,3 +1,4 @@
+import { type DeploymentAuthentication } from '@noodle-borg/wire-contracts';
 import type { ConfigLocation } from '../config.js';
 import type { AccessMode } from '../deploy.js';
 import { type DetailCardOptions } from '../detail-card.js';
@@ -19,6 +20,7 @@ export interface StatusResponse {
         readonly createdAt: string;
         readonly createdByEmail?: string;
         readonly accessMode: AccessMode;
+        readonly authentication?: DeploymentAuthentication;
         readonly ownerSubject?: string;
         readonly deploymentLock?: {
             readonly lockedAt: string;

package/dist/commands/deploy-status-ops.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-status-ops.d.ts","sourceRoot":"","sources":["../../src/commands/deploy-status-ops.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AASnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,KAAK,iBAAiB,EAAoC,MAAM,mBAAmB,CAAC;AAC7F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAG5D,OAAO,EAA6B,KAAK,UAAU,EAA4B,MAAM,aAAa,CAAC;AAanG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACtF,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;QAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE;YACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;SACjC,CAAC;KACH,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CACvF;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQnD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,cAAc,EACpB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,iBAAiB,EACvB,GAAG,GAAE,MAAmB,GACvB,MAAM,CA2DR;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/C,OAAO,CAAC,UAAU,CAAC,CAOrB;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,MAAM,CAAC,CA2DjB;AAED,wBAAsB,WAAW,CAC/B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,EAAE,cAAc,EACpB,UAAU,CAAC,EAAE,UAAU,GACtB,OAAO,CAAC,MAAM,CAAC,CAuIjB;AAoCD,wBAAsB,SAAS,CAC7B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,MAAM,CAAC,CAsHjB"}
+{"version":3,"file":"deploy-status-ops.d.ts","sourceRoot":"","sources":["../../src/commands/deploy-status-ops.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AASnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,KAAK,iBAAiB,EAAoC,MAAM,mBAAmB,CAAC;AAC7F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAG5D,OAAO,EAA6B,KAAK,UAAU,EAA4B,MAAM,aAAa,CAAC;AAanG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACtF,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;QAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,wBAAwB,CAAC;QACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE;YACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;SACjC,CAAC;KACH,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CACvF;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQnD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,cAAc,EACpB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,iBAAiB,EACvB,GAAG,GAAE,MAAmB,GACvB,MAAM,CAoER;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/C,OAAO,CAAC,UAAU,CAAC,CAOrB;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,MAAM,CAAC,CA2DjB;AAED,wBAAsB,WAAW,CAC/B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,EAAE,cAAc,EACpB,UAAU,CAAC,EAAE,UAAU,GACtB,OAAO,CAAC,MAAM,CAAC,CAuIjB;AAoCD,wBAAsB,SAAS,CAC7B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,MAAM,CAAC,CAwHjB"}

package/dist/commands/deploy-status-ops.js

@@ -64,6 +64,15 @@ export function renderStatusCard(body, serviceUrl, opts, now = Date.now()) {
             tone: 'attention',
             note: accessModeNote(deployment.accessMode),
         },
+        ...(deployment.authentication !== undefined
+            ? [
+                {
+                    key: 'authentication',
+                    value: deployment.authentication,
+                    tone: 'dim',
+                },
+            ]
+            : []),
         ...(deployment.ownerSubject !== undefined
             ? [{ key: 'owner', value: deployment.ownerSubject, tone: 'dim' }]
             : []),
@@ -393,6 +402,8 @@ export async function runAccess(rest, env, home) {
         if (body.deployment.serverVersion !== undefined)
             console.log(`version: ${body.deployment.serverVersion}`);
         console.log(`access:  ${body.deployment.accessMode}`);
+        if (body.deployment.authentication !== undefined)
+            console.log(`auth:    ${body.deployment.authentication}`);
         if (body.deployment.ownerSubject !== undefined)
             console.log(`owner:   ${body.deployment.ownerSubject}`);
         return 0;

package/dist/commands/deploy-status-ops.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-status-ops.js","sourceRoot":"","sources":["../../src/commands/deploy-status-ops.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,EAChC,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AAErC;;;;;;GAMG;AACH,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEjG,OAAO,EAA0C,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE7F,OAAO,EAAE,iCAAiC,EAAE,MAAM,yCAAyC,CAAC;AAC5F,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAmB,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACnG,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAEL,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EACnB,cAAc,GACf,MAAM,aAAa,CAAC;AAwBrB,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,oCAAoC,CAAC;IACvE,IAAI,IAAI,KAAK,aAAa;QAAE,OAAO,uBAAuB,CAAC;IAC3D,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,sBAAsB,CAAC;IAC5D,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,0BAA0B,CAAC;IAC5D,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,kCAAkC,CAAC;IACjE,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,oCAAoC,CAAC;IAClE,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAoB,EACpB,UAAkB,EAClB,IAAuB,EACvB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACnC,MAAM,IAAI,GAAgB;QACxB;YACE,GAAG,EAAE,YAAY;YACjB,KAAK,EAAE,UAAU,CAAC,YAAY;YAC9B,GAAG,CAAC,UAAU,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,UAAU,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9F;QACD,UAAU,CAAC,MAAM;YACf,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE;YAC5D,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE;QACpD,UAAU,CAAC,cAAc,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE;YACjD,CAAC,CAAC;gBACE,GAAG,EAAE,MAAM;gBACX,KAAK,EAAE,QAAQ;gBACf,IAAI,EAAE,WAAW;gBACjB,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,aAAa,KAAK,SAAS;oBACvD,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC,cAAc,CAAC,aAAa,EAAE,EAAE;oBAC3D,CAAC,CAAC,EAAE,CAAC;aACR;QACL,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE;QAClD;YACE,GAAG,EAAE,QAAQ;YACb,KAAK,EAAE,UAAU,CAAC,UAAU;YAC5B,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC;SAC5C;QACD,GAAG,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS;YACvC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,EAAsB,CAAC;YACrF,CAAC,CAAC,EAAE,CAAC;QACP;YACE,GAAG,EAAE,UAAU;YACf,KAAK,EAAE,YAAY,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC;YAC9C,GAAG,CAAC,UAAU,CAAC,cAAc,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC,cAAc,EAAE,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;SACR;QACD;YACE,GAAG,EAAE,QAAQ;YACb,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;YACxB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;SACrD;QACD,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YACjB,CAAC,CAAC;gBACE;oBACE,GAAG,EAAE,SAAS;oBACd,KAAK,EAAE,WAAW,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACzD,IAAI,EAAE,KAAK;iBACQ;aACtB;YACH,CAAC,CAAC,EAAE,CAAC;QACP,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE;KACnD,CAAC;IACF,OAAO,gBAAgB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QAC9F,oBAAoB;QACpB,gBAAgB;QAChB,oBAAoB;KACrB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,QAAgD;IAEhD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAiB,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC;IAChG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,eAAe,CAAC,EAAE,CAAC;IAChF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAuB,EACvB,GAAsB,EACtB,IAAoB;IAEpB,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACvB,OAAO,eAAe,CAAC,QAAQ,EAAE,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,MAAM,aAAa,GAAG,6BAA6B,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7F,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,QAAQ,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC9C,WAAW,EAAE,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU;QAC9C,QAAQ,EAAE,IAAI,CAAC,SAAS;QACxB,GAAG;QACH,IAAI;KACL,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,eAAe,CACpB,QAAQ,EACR;YACE,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,4CAA4C;YACrD,KAAK,EAAE,qEAAqE;YAC5E,GAAG,EAAE,gCAAgC;YACrC,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,CAAC;SACZ,EACD,IAAI,CAAC,IAAI,CACV,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GACb,GAAG,QAAQ,CAAC,UAAU,YAAY,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;QAClE,SAAS,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS;QACvF,CAAC,aAAa,CAAC,KAAK,KAAK,SAAS;YAChC,CAAC,CAAC,YAAY,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC,CAAC;IAEV,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAiB,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC1E,WAAW,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YACvD,OAAO,CAAC,CAAC;QACX,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,QAAQ,CAAC;YACd,OAAO,EAAE,QAAQ;YACjB,UAAU;YACV,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAuB,EACvB,GAAsB,EACtB,IAAoB,EACpB,UAAuB;IAEvB,IAAI,YAAgC,CAAC;IACrC,IAAI,MAA0B,CAAC;IAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,UAAU;YAAE,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aACtC,IACH,GAAG,KAAK,OAAO;YACf,GAAG,KAAK,OAAO;YACf,GAAG,KAAK,OAAO;YACf,GAAG,KAAK,WAAW;YACnB,GAAG,KAAK,cAAc,EACtB,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACxB,IAAI,KAAK,KAAK,SAAS;gBAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;aAAM,IAAI,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAC1C,OAAO,eAAe,CACpB,UAAU,EACV;gBACE,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,2BAA2B,GAAG,EAAE;gBACzC,KAAK,EAAE,GAAG,GAAG,sCAAsC;gBACnD,GAAG,EAAE,6DAA6D;gBAClE,IAAI,EAAE,oEAAoE;gBAC1E,QAAQ,EAAE,CAAC;aACZ,EACD,IAAI,CAAC,IAAI,CACV,CAAC;QACJ,CAAC;aAAM,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YACpF,YAAY,GAAG,GAAG,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,OAAO,eAAe,CACpB,UAAU,EACV;YACE,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,mCAAmC;YAC5C,KAAK,EAAE,gCAAgC;YACvC,GAAG,EAAE,kDAAkD;YACvD,IAAI,EAAE,6DAA6D;YACnE,QAAQ,EAAE,CAAC;SACZ,EACD,IAAI,CAAC,IAAI,CACV,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC9C,WAAW,EAAE,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU;QAC9C,QAAQ,EAAE,IAAI,CAAC,SAAS;QACxB,GAAG;QACH,IAAI;KACL,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,eAAe,CACpB,UAAU,EACV;YACE,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,4CAA4C;YACrD,KAAK,EAAE,uEAAuE;YAC9E,GAAG,EAAE,gCAAgC;YACrC,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,CAAC;SACZ,EACD,IAAI,CAAC,IAAI,CACV,CAAC;IACJ,CAAC;IACD,MAAM,oBAAoB,GAAG,MAAM,iCAAiC,CAAC;QACnE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC,CAAC;IACH,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,eAAe,CAAC,UAAU,EAAE,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAgB5B,GAAG,QAAQ,CAAC,UAAU,YAAY,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YAChE,SAAS,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAC3F,QAAQ,CAAC,KAAK,EACd;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,YAAY;gBACZ,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5C,CAAC;SACH,CACF,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,WAAW,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YACvD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS;YAC3C,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,QAAQ,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS;YAC1C,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa;YAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACxE,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,eAAe,CACpB,UAAU,EACV,cAAc,CAAC,UAAU,EAAE,KAAK,EAAE,8BAA8B,MAAM,CAAC,GAAG,EAAE,CAAC,EAC7E,IAAI,CAAC,IAAI,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IACE,KAAK,YAAY,mBAAmB;QACpC,KAAK,CAAC,MAAM,KAAK,GAAG;QACpB,KAAK,CAAC,IAAI,KAAK,yBAAyB,EACxC,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,wEAAwE;YAC/E,GAAG,EAAE,6DAA6D;YAClE,IAAI,EAAE,wDAAwD;YAC9D,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,IAAI,CAAC,OAAO;SACvB,CAAC;IACJ,CAAC;IACD,IACE,KAAK,YAAY,mBAAmB;QACpC,KAAK,CAAC,MAAM,KAAK,GAAG;QACpB,KAAK,CAAC,IAAI,KAAK,6BAA6B,EAC5C,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,2DAA2D;YAClE,GAAG,EAAE,iFAAiF;YACtF,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,IAAI,CAAC,IAAI;SACpB,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAuB,EACvB,GAAsB,EACtB,IAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,WAAW,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,YAAgC,CAAC;IACrC,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YACnC,oBAAoB,GAAG,IAAI,CAAC;YAC5B,YAAY,GAAG,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,oBAAoB,IAAI,CAAC,4BAA4B,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1F,OAAO,eAAe,CACpB,QAAQ,EACR;YACE,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,mDAAmD;YAC5D,KAAK,EAAE,2EAA2E;YAClF,GAAG,EAAE,8EAA8E;YACnF,IAAI,EAAE,wDAAwD;YAC9D,QAAQ,EAAE,IAAI,CAAC,KAAK;SACrB,EACD,IAAI,CAAC,IAAI,CACV,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,eAAe,CACpB,QAAQ,EACR;YACE,IAAI,EAAE,aAAa;YACnB,OAAO,EACL,sFAAsF;YACxF,KAAK,EAAE,mDAAmD;YAC1D,GAAG,EAAE,6EAA6E;YAClF,IAAI,EAAE,8BAA8B;YACpC,QAAQ,EAAE,CAAC;SACZ,EACD,IAAI,CAAC,IAAI,CACV,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,KAAK,SAAS,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QACxD,OAAO,eAAe,CACpB,QAAQ,EACR;YACE,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,uDAAuD;YAChE,KAAK,EAAE,iBAAiB,IAAI,sCAAsC;YAClE,GAAG,EAAE,qDAAqD;YAC1D,IAAI,EAAE,wDAAwD;YAC9D,QAAQ,EAAE,IAAI,CAAC,KAAK;SACrB,EACD,IAAI,CAAC,IAAI,CACV,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,MAAM,aAAa,GAAG,6BAA6B,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7F,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,QAAQ,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC9C,WAAW,EAAE,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU;QAC9C,QAAQ,EAAE,IAAI,CAAC,SAAS;QACxB,GAAG;QACH,IAAI;KACL,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,eAAe,CACpB,QAAQ,EACR;YACE,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,4CAA4C;YACrD,KAAK,EAAE,4EAA4E;YACnF,GAAG,EAAE,gCAAgC;YACrC,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,CAAC;SACZ,EACD,IAAI,CAAC,IAAI,CACV,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,gCAAgC,CAAC,KAAK,CACjD,MAAM,WAAW,CACf,GAAG,QAAQ,CAAC,UAAU,YAAY,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YAChE,SAAS,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EACzF,QAAQ,CAAC,KAAK,EACd;YACE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,IAAI;gBAChB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,aAAa,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrF,CAAC;SACH,CACF,CACF,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,WAAW,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YACvD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,KAAK,SAAS;YAC7C,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS;YAC5C,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,eAAe,CAAC,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC"}
+{"version":3,"file":"deploy-status-ops.js","sourceRoot":"","sources":["../../src/commands/deploy-status-ops.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,EAEhC,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AAErC;;;;;;GAMG;AACH,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEjG,OAAO,EAA0C,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE7F,OAAO,EAAE,iCAAiC,EAAE,MAAM,yCAAyC,CAAC;AAC5F,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAmB,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACnG,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAEL,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EACnB,cAAc,GACf,MAAM,aAAa,CAAC;AAyBrB,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,oCAAoC,CAAC;IACvE,IAAI,IAAI,KAAK,aAAa;QAAE,OAAO,uBAAuB,CAAC;IAC3D,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,sBAAsB,CAAC;IAC5D,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,0BAA0B,CAAC;IAC5D,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,kCAAkC,CAAC;IACjE,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,oCAAoC,CAAC;IAClE,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAoB,EACpB,UAAkB,EAClB,IAAuB,EACvB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACnC,MAAM,IAAI,GAAgB;QACxB;YACE,GAAG,EAAE,YAAY;YACjB,KAAK,EAAE,UAAU,CAAC,YAAY;YAC9B,GAAG,CAAC,UAAU,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,UAAU,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9F;QACD,UAAU,CAAC,MAAM;YACf,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE;YAC5D,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE;QACpD,UAAU,CAAC,cAAc,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE;YACjD,CAAC,CAAC;gBACE,GAAG,EAAE,MAAM;gBACX,KAAK,EAAE,QAAQ;gBACf,IAAI,EAAE,WAAW;gBACjB,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,aAAa,KAAK,SAAS;oBACvD,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC,cAAc,CAAC,aAAa,EAAE,EAAE;oBAC3D,CAAC,CAAC,EAAE,CAAC;aACR;QACL,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE;QAClD;YACE,GAAG,EAAE,QAAQ;YACb,KAAK,EAAE,UAAU,CAAC,UAAU;YAC5B,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC;SAC5C;QACD,GAAG,CAAC,UAAU,CAAC,cAAc,KAAK,SAAS;YACzC,CAAC,CAAC;gBACE;oBACE,GAAG,EAAE,gBAAgB;oBACrB,KAAK,EAAE,UAAU,CAAC,cAAc;oBAChC,IAAI,EAAE,KAAK;iBACQ;aACtB;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS;YACvC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,EAAsB,CAAC;YACrF,CAAC,CAAC,EAAE,CAAC;QACP;YACE,GAAG,EAAE,UAAU;YACf,KAAK,EAAE,YAAY,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC;YAC9C,GAAG,CAAC,UAAU,CAAC,cAAc,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC,cAAc,EAAE,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;SACR;QACD;YACE,GAAG,EAAE,QAAQ;YACb,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;YACxB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;SACrD;QACD,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YACjB,CAAC,CAAC;gBACE;oBACE,GAAG,EAAE,SAAS;oBACd,KAAK,EAAE,WAAW,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACzD,IAAI,EAAE,KAAK;iBACQ;aACtB;YACH,CAAC,CAAC,EAAE,CAAC;QACP,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE;KACnD,CAAC;IACF,OAAO,gBAAgB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QAC9F,oBAAoB;QACpB,gBAAgB;QAChB,oBAAoB;KACrB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,QAAgD;IAEhD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAiB,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC;IAChG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,eAAe,CAAC,EAAE,CAAC;IAChF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAuB,EACvB,GAAsB,EACtB,IAAoB;IAEpB,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACvB,OAAO,eAAe,CAAC,QAAQ,EAAE,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,MAAM,aAAa,GAAG,6BAA6B,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7F,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,QAAQ,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC9C,WAAW,EAAE,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU;QAC9C,QAAQ,EAAE,IAAI,CAAC,SAAS;QACxB,GAAG;QACH,IAAI;KACL,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,eAAe,CACpB,QAAQ,EACR;YACE,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,4CAA4C;YACrD,KAAK,EAAE,qEAAqE;YAC5E,GAAG,EAAE,gCAAgC;YACrC,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,CAAC;SACZ,EACD,IAAI,CAAC,IAAI,CACV,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GACb,GAAG,QAAQ,CAAC,UAAU,YAAY,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;QAClE,SAAS,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS;QACvF,CAAC,aAAa,CAAC,KAAK,KAAK,SAAS;YAChC,CAAC,CAAC,YAAY,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC,CAAC;IAEV,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAiB,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC1E,WAAW,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YACvD,OAAO,CAAC,CAAC;QACX,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,QAAQ,CAAC;YACd,OAAO,EAAE,QAAQ;YACjB,UAAU;YACV,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAuB,EACvB,GAAsB,EACtB,IAAoB,EACpB,UAAuB;IAEvB,IAAI,YAAgC,CAAC;IACrC,IAAI,MAA0B,CAAC;IAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,UAAU;YAAE,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aACtC,IACH,GAAG,KAAK,OAAO;YACf,GAAG,KAAK,OAAO;YACf,GAAG,KAAK,OAAO;YACf,GAAG,KAAK,WAAW;YACnB,GAAG,KAAK,cAAc,EACtB,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACxB,IAAI,KAAK,KAAK,SAAS;gBAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;aAAM,IAAI,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAC1C,OAAO,eAAe,CACpB,UAAU,EACV;gBACE,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,2BAA2B,GAAG,EAAE;gBACzC,KAAK,EAAE,GAAG,GAAG,sCAAsC;gBACnD,GAAG,EAAE,6DAA6D;gBAClE,IAAI,EAAE,oEAAoE;gBAC1E,QAAQ,EAAE,CAAC;aACZ,EACD,IAAI,CAAC,IAAI,CACV,CAAC;QACJ,CAAC;aAAM,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YACpF,YAAY,GAAG,GAAG,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,OAAO,eAAe,CACpB,UAAU,EACV;YACE,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,mCAAmC;YAC5C,KAAK,EAAE,gCAAgC;YACvC,GAAG,EAAE,kDAAkD;YACvD,IAAI,EAAE,6DAA6D;YACnE,QAAQ,EAAE,CAAC;SACZ,EACD,IAAI,CAAC,IAAI,CACV,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC9C,WAAW,EAAE,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU;QAC9C,QAAQ,EAAE,IAAI,CAAC,SAAS;QACxB,GAAG;QACH,IAAI;KACL,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,eAAe,CACpB,UAAU,EACV;YACE,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,4CAA4C;YACrD,KAAK,EAAE,uEAAuE;YAC9E,GAAG,EAAE,gCAAgC;YACrC,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,CAAC;SACZ,EACD,IAAI,CAAC,IAAI,CACV,CAAC;IACJ,CAAC;IACD,MAAM,oBAAoB,GAAG,MAAM,iCAAiC,CAAC;QACnE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC,CAAC;IACH,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,eAAe,CAAC,UAAU,EAAE,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAgB5B,GAAG,QAAQ,CAAC,UAAU,YAAY,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YAChE,SAAS,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAC3F,QAAQ,CAAC,KAAK,EACd;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,YAAY;gBACZ,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5C,CAAC;SACH,CACF,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,WAAW,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YACvD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS;YAC3C,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,QAAQ,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS;YAC1C,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa;YAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACxE,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,eAAe,CACpB,UAAU,EACV,cAAc,CAAC,UAAU,EAAE,KAAK,EAAE,8BAA8B,MAAM,CAAC,GAAG,EAAE,CAAC,EAC7E,IAAI,CAAC,IAAI,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IACE,KAAK,YAAY,mBAAmB;QACpC,KAAK,CAAC,MAAM,KAAK,GAAG;QACpB,KAAK,CAAC,IAAI,KAAK,yBAAyB,EACxC,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,wEAAwE;YAC/E,GAAG,EAAE,6DAA6D;YAClE,IAAI,EAAE,wDAAwD;YAC9D,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,IAAI,CAAC,OAAO;SACvB,CAAC;IACJ,CAAC;IACD,IACE,KAAK,YAAY,mBAAmB;QACpC,KAAK,CAAC,MAAM,KAAK,GAAG;QACpB,KAAK,CAAC,IAAI,KAAK,6BAA6B,EAC5C,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,2DAA2D;YAClE,GAAG,EAAE,iFAAiF;YACtF,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,IAAI,CAAC,IAAI;SACpB,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAuB,EACvB,GAAsB,EACtB,IAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,WAAW,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,YAAgC,CAAC;IACrC,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YACnC,oBAAoB,GAAG,IAAI,CAAC;YAC5B,YAAY,GAAG,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,oBAAoB,IAAI,CAAC,4BAA4B,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1F,OAAO,eAAe,CACpB,QAAQ,EACR;YACE,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,mDAAmD;YAC5D,KAAK,EAAE,2EAA2E;YAClF,GAAG,EAAE,8EAA8E;YACnF,IAAI,EAAE,wDAAwD;YAC9D,QAAQ,EAAE,IAAI,CAAC,KAAK;SACrB,EACD,IAAI,CAAC,IAAI,CACV,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,eAAe,CACpB,QAAQ,EACR;YACE,IAAI,EAAE,aAAa;YACnB,OAAO,EACL,sFAAsF;YACxF,KAAK,EAAE,mDAAmD;YAC1D,GAAG,EAAE,6EAA6E;YAClF,IAAI,EAAE,8BAA8B;YACpC,QAAQ,EAAE,CAAC;SACZ,EACD,IAAI,CAAC,IAAI,CACV,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,KAAK,SAAS,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QACxD,OAAO,eAAe,CACpB,QAAQ,EACR;YACE,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,uDAAuD;YAChE,KAAK,EAAE,iBAAiB,IAAI,sCAAsC;YAClE,GAAG,EAAE,qDAAqD;YAC1D,IAAI,EAAE,wDAAwD;YAC9D,QAAQ,EAAE,IAAI,CAAC,KAAK;SACrB,EACD,IAAI,CAAC,IAAI,CACV,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,MAAM,aAAa,GAAG,6BAA6B,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7F,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC,QAAQ,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC9C,WAAW,EAAE,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU;QAC9C,QAAQ,EAAE,IAAI,CAAC,SAAS;QACxB,GAAG;QACH,IAAI;KACL,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,eAAe,CACpB,QAAQ,EACR;YACE,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,4CAA4C;YACrD,KAAK,EAAE,4EAA4E;YACnF,GAAG,EAAE,gCAAgC;YACrC,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,CAAC;SACZ,EACD,IAAI,CAAC,IAAI,CACV,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,gCAAgC,CAAC,KAAK,CACjD,MAAM,WAAW,CACf,GAAG,QAAQ,CAAC,UAAU,YAAY,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YAChE,SAAS,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EACzF,QAAQ,CAAC,KAAK,EACd;YACE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,IAAI;gBAChB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,aAAa,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrF,CAAC;SACH,CACF,CACF,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,WAAW,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YACvD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,KAAK,SAAS;YAC7C,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,KAAK,SAAS;YAC9C,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS;YAC5C,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,eAAe,CAAC,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC"}

package/node_modules/@noodle-borg/agent-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodle-borg/agent-kit",
-  "version": "0.101.0",
+  "version": "0.102.0",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {

package/node_modules/@noodle-borg/module/dist/customer-auth-access.d.ts

@@ -0,0 +1,7 @@
+import type { AccessMode } from './contract.js';
+export declare function usesCustomerAuthentication(input: {
+    readonly schemaVersion: number;
+    readonly accessMode: AccessMode | undefined;
+    readonly hasServerAuth: boolean;
+}): boolean;
+//# sourceMappingURL=customer-auth-access.d.ts.map

package/node_modules/@noodle-borg/module/dist/customer-auth-access.js

@@ -0,0 +1,6 @@
+export function usesCustomerAuthentication(input) {
+    if (input.accessMode === 'customers')
+        return true;
+    return input.accessMode === 'mixed' && input.schemaVersion === 2 && input.hasServerAuth;
+}
+//# sourceMappingURL=customer-auth-access.js.map

package/node_modules/@noodle-borg/module/dist/index.d.ts

@@ -1,5 +1,6 @@
 export * from './asset-store.js';
 export * from './contract.js';
+export * from './customer-auth-access.js';
 export * from './deployment-activation.js';
 export * from './deployment-automation.js';
 export * from './endpoint-url.js';

package/node_modules/@noodle-borg/module/dist/index.js

@@ -1,5 +1,6 @@
 export * from './asset-store.js';
 export * from './contract.js';
+export * from './customer-auth-access.js';
 export * from './deployment-activation.js';
 export * from './deployment-automation.js';
 export * from './endpoint-url.js';

package/node_modules/@noodle-borg/service/dist/customer-auth-audience-binding.js

@@ -1,3 +1,12 @@
+import { usesCustomerAuthentication } from '@noodle-borg/module';
+/** Match durable ownership, including an omitted stored projection when compilation declares auth. */
+export function requiresCustomerAuthProjection(record, compiledAuth) {
+    return usesCustomerAuthentication({
+        schemaVersion: record.schemaVersion,
+        accessMode: record.accessMode,
+        hasServerAuth: record.serverAuth != null || compiledAuth !== undefined,
+    });
+}
 /** Safe lifecycle error; tenant identities and configured values never enter its public message. */
 export class CustomerAuthAudienceConflictError extends Error {
     code = 'customer_auth_audience_conflict';
@@ -51,7 +60,7 @@ export function isTenantAuthConfig(value) {
 }
 /** Customer-serving records must exactly project the compiler-authoritative auth declaration. */
 export function hasExactCustomerAuthProjection(record, compiledAuth) {
-    if (record.accessMode !== 'customers')
+    if (!requiresCustomerAuthProjection(record, compiledAuth))
         return true;
     if (compiledAuth === undefined || !isTenantAuthConfig(record.serverAuth))
         return false;
@@ -65,7 +74,7 @@ export function hasExactCustomerAuthProjection(record, compiledAuth) {
 }
 /** Require an exact compiler-authenticated snapshot before clearing customer app archive stamps. */
 export function assertCustomerAuthRestorePrecondition(records, precondition) {
-    const candidates = records.filter((record) => record.active && record.accessMode === 'customers');
+    const candidates = records.filter((record) => record.active && requiresCustomerAuthProjection(record));
     const projections = precondition?.customerAuthProjections ?? [];
     if (candidates.length !== projections.length) {
         throw new CustomerAuthAudienceProjectionError();
@@ -107,7 +116,7 @@ export function findActiveCustomerAuthAudienceConflict(records, tenant, auth) {
     for (const record of records) {
         if (!record.active ||
             record.archivedAt !== undefined ||
-            record.accessMode !== 'customers' ||
+            !requiresCustomerAuthProjection(record) ||
             sameTenant(record, tenant)) {
             continue;
         }
@@ -124,7 +133,9 @@ export function findActiveCustomerAuthAudienceConflict(records, tenant, auth) {
 export function assertUniqueActiveCustomerAuthAudienceBindings(records) {
     const owners = new Map();
     for (const record of records) {
-        if (!record.active || record.archivedAt !== undefined || record.accessMode !== 'customers') {
+        if (!record.active ||
+            record.archivedAt !== undefined ||
+            !requiresCustomerAuthProjection(record)) {
             continue;
         }
         if (!isTenantAuthConfig(record.serverAuth)) {
@@ -143,7 +154,7 @@ export function assertUniqueActiveCustomerAuthAudienceBindings(records) {
 }
 /** Shared registry guard with an optimized durable-store path and an in-memory fallback. */
 export async function hasActiveCustomerAuthAudienceConflict(store, records, record, auth) {
-    if (record.accessMode !== 'customers' || auth === undefined || auth.kind === 'bridge')
+    if (!requiresCustomerAuthProjection(record, auth) || auth === undefined || auth.kind === 'bridge')
         return false;
     const tenant = { org: record.orgSlug, app: record.appSlug, env: record.environment };
     const conflict = store?.findActiveCustomerAuthAudienceConflict !== undefined

package/node_modules/@noodle-borg/service/dist/deployment-authentication.js

@@ -0,0 +1,19 @@
+import { usesCustomerAuthentication } from '@noodle-borg/module';
+import { deploymentRecordVersionError } from './deployment-record-version.js';
+/** Read the effective authentication authority only when this runtime understands the record. */
+export function deploymentAuthenticationFor(record) {
+    if (deploymentRecordVersionError(record) !== undefined || record.accessMode === undefined) {
+        return undefined;
+    }
+    if (record.accessMode === 'public')
+        return 'none';
+    if (usesCustomerAuthentication({
+        schemaVersion: record.schemaVersion,
+        accessMode: record.accessMode,
+        hasServerAuth: record.serverAuth !== undefined,
+    })) {
+        return 'customer';
+    }
+    return 'platform';
+}
+//# sourceMappingURL=deployment-authentication.js.map

package/node_modules/@noodle-borg/service/dist/deployment-record-version.js

@@ -0,0 +1,31 @@
+import { sameDeploymentScope } from './deployment-versioning.js';
+const VERSION_ERROR = {
+    code: 'unsupported_deployment_record_version',
+    path: 'schemaVersion',
+    message: 'Deployment record version is not supported by this runtime.',
+};
+export class UnsupportedDeploymentRecordVersionError extends Error {
+    code = VERSION_ERROR.code;
+    constructor() {
+        super(VERSION_ERROR.message);
+        this.name = 'UnsupportedDeploymentRecordVersionError';
+    }
+}
+/** R0 understands newer ownership records but must never serve their authentication semantics. */
+export function deploymentRecordVersionError(record) {
+    return record.schemaVersion === 1 ? undefined : VERSION_ERROR;
+}
+/** A stale writer cannot replace or deactivate a newer policy, even after registry preflight. */
+export function assertDeploymentAppendVersion(records, candidate) {
+    if (records.some((record) => record.schemaVersion > candidate.schemaVersion &&
+        (record.deploymentId === candidate.deploymentId ||
+            (candidate.active &&
+                record.active &&
+                record.archivedAt === undefined &&
+                sameDeploymentScope(record, candidate)))))
+        throw new UnsupportedDeploymentRecordVersionError();
+}
+export function unsupportedDeploymentRecordFailure() {
+    return { ok: false, errors: [VERSION_ERROR] };
+}
+//# sourceMappingURL=deployment-record-version.js.map

package/node_modules/@noodle-borg/service/dist/developer-mcp/inspection.js

@@ -8,7 +8,21 @@ export async function inspectServiceDeployment(registry, tenant, baseUrl, endpoi
     return {
         ok: true,
         target: status.target,
-        deployment: status.deployment,
+        // Keep the Developer MCP port projection explicit as status gains additive operator fields.
+        deployment: {
+            deploymentId: status.deployment.deploymentId,
+            endpointUrl: status.deployment.endpointUrl,
+            active: status.deployment.active,
+            serverName: status.deployment.serverName,
+            createdAt: status.deployment.createdAt,
+            ...(status.deployment.createdByEmail === undefined
+                ? {}
+                : { createdByEmail: status.deployment.createdByEmail }),
+            accessMode: status.deployment.accessMode,
+            ...(status.deployment.ownerSubject === undefined
+                ? {}
+                : { ownerSubject: status.deployment.ownerSubject }),
+        },
         health: {
             state: status.health.state,
             missingSecrets: status.config.missingSecrets,

package/node_modules/@noodle-borg/service/dist/registry-access.js

@@ -1,4 +1,5 @@
-import { assertUniqueActiveCustomerAuthAudienceBindings, CustomerAuthAudienceConflictError, } from './customer-auth-audience-binding.js';
+import { assertUniqueActiveCustomerAuthAudienceBindings, CustomerAuthAudienceConflictError, requiresCustomerAuthProjection, } from './customer-auth-audience-binding.js';
+import { deploymentRecordVersionError } from './deployment-record-version.js';
 import { deploymentOwnerSubject } from './registry-helpers.js';
 import { activeRecord, activeRecordVersion } from './registry-state.js';
 import { tenantDeploymentKey, tryServedTargetFor } from './registry-targets.js';
@@ -41,6 +42,15 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
         : await activeRecordVersion(state, tenant, options.serverVersion);
     if (record === undefined)
         return noActiveDeployment();
+    const versionError = deploymentRecordVersionError(record);
+    if (versionError !== undefined) {
+        return {
+            ok: false,
+            status: 409,
+            code: 'unsupported_deployment_record_version',
+            message: versionError.message,
+        };
+    }
     const nextAccessMode = options.accessMode;
     const previousAccessMode = record.accessMode ?? 'owner-only';
     const previousOwnerSubject = deploymentOwnerSubject(record);
@@ -64,12 +74,14 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
             ? commitInMemoryAccessUpdate(state, tenant, record, {
                 accessMode: nextAccessMode,
                 expectedAccessMode: record.accessMode,
+                expectedSchemaVersion: record.schemaVersion,
                 expectedOwnerSubject: previousOwnerSubject,
                 ...(serverAuth !== undefined ? { serverAuth } : {}),
             })
             : await state.store.updateActiveAccess(tenant, record.deploymentId, {
                 accessMode: nextAccessMode,
                 expectedAccessMode: record.accessMode,
+                expectedSchemaVersion: record.schemaVersion,
                 expectedOwnerSubject: previousOwnerSubject,
                 ...(serverAuth !== undefined ? { serverAuth } : {}),
             });
@@ -120,6 +132,7 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
                 ? { ownerSubject: nextOwnerSubject }
                 : {}),
             expectedAccessMode: record.accessMode,
+            expectedSchemaVersion: record.schemaVersion,
             expectedOwnerSubject: previousOwnerSubject,
             ...(serverAuth !== undefined ? { serverAuth } : {}),
         })
@@ -129,6 +142,7 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
                 ? { ownerSubject: nextOwnerSubject }
                 : {}),
             expectedAccessMode: record.accessMode,
+            expectedSchemaVersion: record.schemaVersion,
             expectedOwnerSubject: previousOwnerSubject,
             ...(serverAuth !== undefined ? { serverAuth } : {}),
         });
@@ -155,19 +169,20 @@ function commitInMemoryAccessUpdate(state, tenant, observed, input) {
         current.appSlug !== tenant.app ||
         current.environment !== tenant.env ||
         current.accessMode !== input.expectedAccessMode ||
+        current.schemaVersion !== (input.expectedSchemaVersion ?? 1) ||
         deploymentOwnerSubject(current) !== input.expectedOwnerSubject) {
         return undefined;
     }
     if ((current.accessMode ?? 'owner-only') === input.accessMode &&
         (input.ownerSubject === undefined || deploymentOwnerSubject(current) === input.ownerSubject) &&
-        input.accessMode !== 'customers') {
+        !requiresCustomerAuthProjection({ ...current, accessMode: input.accessMode }, input.serverAuth)) {
         return current;
     }
     const committed = {
         ...current,
         accessMode: input.accessMode,
         ...(input.ownerSubject !== undefined ? { ownerSubject: input.ownerSubject } : {}),
-        ...(input.accessMode === 'customers' && input.serverAuth !== undefined
+        ...(requiresCustomerAuthProjection({ ...current, accessMode: input.accessMode }, input.serverAuth) && input.serverAuth !== undefined
             ? { serverAuth: input.serverAuth }
             : {}),
     };

package/node_modules/@noodle-borg/service/dist/registry-compile.js

@@ -4,12 +4,24 @@ import { compileConnectors, delegatedTokenExchangeIdentityErrors, } from '@noodl
 import { InMemoryConnectorRegistry, resolveManagedOrigins, resolveVariableEnvironment, } from '@noodle-borg/runtime';
 import { AppPackageSnapshotError, createAppPackageSnapshot, } from './app-package-snapshot.js';
 import { missingServerConfigErrors } from './assistant-bindings.js';
+import { normalizePersistedConnectorsForCompile } from './connector-normalize.js';
 import { ManagedConfigBroker } from './credential-broker.js';
 import { deploymentCredentialBrokerOptions } from './credential-broker-options.js';
+import { deploymentRecordVersionError } from './deployment-record-version.js';
 import { normalizePersistedManifestForCompile } from './manifest-normalize.js';
-import { missingSecretErrors, missingVariableErrors } from './registry-helpers.js';
+import { missingCapabilityErrors, missingSecretErrors, missingVariableErrors, } from './registry-helpers.js';
+import { servedTargetFor } from './registry-targets.js';
 import { createDeploymentStateConnector, } from './state-connector-factory.js';
 import { resolveConfigScope, } from './store.js';
+/** Reject unsupported persisted semantics before constructing executable runtime dependencies. */
+export async function compilePersistedRegistryRecord(record, compileTarget) {
+    const versionError = deploymentRecordVersionError(record);
+    if (versionError !== undefined)
+        return { ok: false, errors: [versionError] };
+    return compileTarget({ org: record.orgSlug, app: record.appSlug, env: record.environment }, record.manifest, record.connectors === undefined
+        ? undefined
+        : normalizePersistedConnectorsForCompile(record.connectors), record.hostedAssets, false, record.deploymentId);
+}
 export async function compileRegistryTarget(context, input) {
     const { tenant, manifest, connectors, hostedAssets, deploymentId } = input;
     let catalogConnectors = [];
@@ -216,4 +228,33 @@ export async function compileRegistryTarget(context, input) {
         ...(appPackageSnapshot !== undefined ? { appPackageSnapshot } : {}),
     };
 }
+/** Load and validate persisted semantics before publishing an executable target to caches. */
+export async function loadPersistedRegistryTarget(source, context) {
+    const { state } = context;
+    const record = typeof source === 'string'
+        ? state.store
+            ? await state.store.get(source)
+            : state.records.get(source)
+        : source;
+    if (!record ||
+        record.archivedAt !== undefined ||
+        deploymentRecordVersionError(record) !== undefined)
+        return undefined;
+    const deploymentId = record.deploymentId;
+    const built = await context.compile(record);
+    if (!built.ok) {
+        throw new Error(`deployment ${deploymentId} failed to recompile (${built.errors.map((e) => e.code).join(',')})`);
+    }
+    const missingCapabilities = missingCapabilityErrors(built.served.artifact.requirements?.capabilities ?? [], context.capabilities);
+    if (missingCapabilities.length > 0) {
+        throw new Error(`deployment ${deploymentId} failed capability requirements (${missingCapabilities.map((e) => e.path).join(',')})`);
+    }
+    if (record.active &&
+        (await context.hasCustomerAuthConflict(record, built.served.artifact.server.auth)))
+        return undefined;
+    const target = servedTargetFor(record, built.served, context.customerVerifierFactory);
+    state.servers.set(deploymentId, target);
+    state.records.set(deploymentId, record);
+    return target;
+}
 //# sourceMappingURL=registry-compile.js.map

package/node_modules/@noodle-borg/service/dist/registry-deploy-transaction.js

@@ -1,5 +1,7 @@
 import { normalizeServerVersion } from '@noodle-borg/module';
+import { deploymentRecordVersionError } from './deployment-record-version.js';
 import { deployAccessRequiresActor, deployerRequiredError, deploymentOwnerSubject, emptyMembershipSourcesError, membershipSourcesRequireOrgMembersError, missingCapabilityErrors, serverAuthRequiredError, } from './registry-helpers.js';
+import { activeRecord, activeRecordVersion } from './registry-state.js';
 import { idempotentDeploymentId, mintDeploymentId } from './registry-targets.js';
 /** Serialize candidate validation/activation with hierarchical configuration writers. */
 export async function withDeploymentConfiguration(config, org, work) {
@@ -19,6 +21,15 @@ export async function withDeploymentConfiguration(config, org, work) {
         throw error;
     }
 }
+/** Validate the exact destination scope before compilation or publication side effects. */
+export async function deploymentWriteVersionError(state, tenant, serverVersion) {
+    const active = serverVersion === undefined
+        ? await activeRecord(state, tenant)
+        : await activeRecordVersion(state, tenant, serverVersion);
+    return active !== undefined && active.serverVersion === serverVersion
+        ? deploymentRecordVersionError(active)
+        : undefined;
+}
 export async function preflightRegistryDeploy(input) {
     const { actor, accessMode, orgMembershipSources } = input.options;
     if (input.options.serverVersion !== undefined) {
@@ -67,6 +78,10 @@ export async function resolveDeployAttempt(input) {
     const existing = (await input.store?.get(deploymentId)) ?? input.records.get(deploymentId);
     if (existing === undefined)
         return { deploymentId };
+    const versionError = deploymentRecordVersionError(existing);
+    if (versionError !== undefined) {
+        return { deploymentId, replay: { ok: false, errors: [versionError] } };
+    }
     if (!sameIdempotentDeploy(existing, input.tenant, input.manifest, input.options)) {
         return {
             deploymentId,

package/node_modules/@noodle-borg/service/dist/registry-rollback.js

@@ -75,10 +75,12 @@ export async function rollbackDeployment(state, ref, deploymentId, compilePersis
     const activation = state.store
         ? await state.store.activateDeployment(ref, deploymentId, {
             expectedAccessMode: target.accessMode,
+            expectedSchemaVersion: target.schemaVersion,
             ...(compiledAuth !== undefined ? { serverAuth: compiledAuth } : {}),
         })
         : activateInMemory(state.records, ref, deploymentId, {
             expectedAccessMode: target.accessMode,
+            expectedSchemaVersion: target.schemaVersion,
             ...(compiledAuth !== undefined ? { serverAuth: compiledAuth } : {}),
         });
     if (activation === undefined) {

package/node_modules/@noodle-borg/service/dist/registry-state.d.ts

@@ -36,6 +36,7 @@ export declare function persistDeployRecord(view: RegistryStateView, record: Dep
 /** No-store activation fallback (moved verbatim from `ServerRegistry.#activateInMemory`). */
 export declare function activateInMemory(records: Map<string, DeployRecord>, ref: TenantRef, deploymentId: string, precondition?: {
     readonly expectedAccessMode: DeployRecord['accessMode'];
+    readonly expectedSchemaVersion?: number;
     readonly serverAuth?: DeployRecord['serverAuth'];
 }): {
     readonly active: DeployRecord;

package/node_modules/@noodle-borg/service/dist/registry-state.js

@@ -5,8 +5,9 @@
  * durable store first, then reconcile the in-process caches so no instance keeps serving stale state.
  */
 import { normalizeServerVersion } from '@noodle-borg/module';
-import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, CustomerAuthAudienceProjectionError, hasExactCustomerAuthProjection, } from './customer-auth-audience-binding.js';
+import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, CustomerAuthAudienceProjectionError, hasExactCustomerAuthProjection, requiresCustomerAuthProjection, } from './customer-auth-audience-binding.js';
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from './deployment-lock.js';
+import { assertDeploymentAppendVersion } from './deployment-record-version.js';
 import { defaultActiveRecord } from './deployment-versioning.js';
 import { recordMatchesTenant, tenantDeploymentKey, tenantKey } from './registry-targets.js';
 import { appArchivedAt, deploymentSummary, paginateAppSummaries, planAppArchive, planAppRestore, planArchivedAppSweep, resolveProductionEnvironment, summarizeApps, summarizeEnvs, withoutArchiveStamp, } from './store/records.js';
@@ -34,6 +35,7 @@ export async function persistDeployRecord(view, record, tenant, activatesNow) {
         return persisted;
     }
     else {
+        assertDeploymentAppendVersion([...view.records.values()], record);
         if (!assertDeploymentAppendUnlocked([...view.records.values()], record)) {
             return view.records.get(record.deploymentId);
         }
@@ -66,18 +68,23 @@ export function activateInMemory(records, ref, deploymentId, precondition) {
     if (target === undefined || !recordMatchesTenant(target, ref))
         return undefined;
     assertDeploymentActivationUnlocked([...records.values()], target);
-    if (precondition !== undefined && target.accessMode !== precondition.expectedAccessMode) {
+    if (target.schemaVersion !== (precondition?.expectedSchemaVersion ?? 1) ||
+        (precondition !== undefined && target.accessMode !== precondition.expectedAccessMode)) {
         return undefined;
     }
     const previousActive = [...records.values()]
         .filter((record) => record.active && recordMatchesTenant(record, ref))
         .filter((record) => record.serverVersion === target.serverVersion)
         .sort((a, b) => b.deploymentVersion - a.deploymentVersion)[0];
+    if (precondition === undefined && previousActive !== undefined) {
+        assertDeploymentAppendVersion([previousActive], { ...target, active: true });
+    }
     const alreadyActive = previousActive?.deploymentId === deploymentId;
     const activated = {
         ...target,
         active: true,
-        ...(target.accessMode === 'customers' && precondition?.serverAuth !== undefined
+        ...(requiresCustomerAuthProjection(target, precondition?.serverAuth) &&
+            precondition?.serverAuth !== undefined
             ? { serverAuth: precondition.serverAuth }
             : {}),
     };
@@ -207,7 +214,7 @@ export async function registryRestoreApp(state, org, app, compileRecord) {
         return undefined;
     const projections = [];
     for (const record of plan.clear) {
-        if (!record.active || record.accessMode !== 'customers')
+        if (!record.active || !requiresCustomerAuthProjection(record))
             continue;
         const built = await compileRecord(record);
         const compiledAuth = built.ok ? built.served.artifact.server.auth : undefined;
@@ -243,7 +250,7 @@ export async function registryCustomerAuthRestoreProjections(state, deploymentId
         : state.store.get(deploymentId)));
     const projections = [];
     for (const record of records) {
-        if (record === undefined || !record.active || record.accessMode !== 'customers')
+        if (record === undefined || !record.active || !requiresCustomerAuthProjection(record))
             continue;
         const built = await compileRecord(record);
         const compiledAuth = built.ok ? built.served.artifact.server.auth : undefined;

package/node_modules/@noodle-borg/service/dist/registry-status.js

@@ -1,4 +1,5 @@
 import { tenantMcpUrl } from '@noodle-borg/module';
+import { deploymentAuthenticationFor } from './deployment-authentication.js';
 import { deploymentOwnerSubject, missingSecretNames } from './registry-helpers.js';
 /** Project one compiled deployment into the control-plane status contract. */
 export function deploymentStatusFor(ref, record, built, baseUrl, endpointOptions) {
@@ -8,6 +9,7 @@ export function deploymentStatusFor(ref, record, built, baseUrl, endpointOptions
         built.served.artifact.server.auth === undefined;
     const unhealthy = missingCustomerAuth || (!built.ok && missingSecrets.length === 0);
     const ownerSubject = deploymentOwnerSubject(record);
+    const authentication = deploymentAuthenticationFor(record);
     return {
         target: ref,
         deployment: {
@@ -20,6 +22,7 @@ export function deploymentStatusFor(ref, record, built, baseUrl, endpointOptions
             ...(record.createdByEmail !== undefined ? { createdByEmail: record.createdByEmail } : {}),
             ...(ownerSubject !== undefined ? { ownerSubject } : {}),
             accessMode: record.accessMode ?? 'owner-only',
+            ...(authentication !== undefined ? { authentication } : {}),
             ...(record.deploymentLock !== undefined
                 ? {
                     deploymentLock: {

package/node_modules/@noodle-borg/service/dist/registry-targets.js

@@ -2,6 +2,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { RECORD_CONNECTOR_ID } from '@noodle-borg/compiler';
 import { parseAppPackageSnapshot } from './app-package-snapshot.js';
 import { hasExactCustomerAuthProjection } from './customer-auth-audience-binding.js';
+import { deploymentRecordVersionError } from './deployment-record-version.js';
 import { deploymentOwnerSubject } from './registry-helpers.js';
 import { validateTenantRef } from './store.js';
 /** Replace only the platform record port; unrelated compiled runtime ports retain their authority. */
@@ -34,6 +35,9 @@ export function rebindNativeRecords(target, record, factory) {
  * front-door checks. Legacy alpha records without an identity access mode are not served.
  */
 export function servedTargetFor(record, served, customerVerifierFactory) {
+    const versionError = deploymentRecordVersionError(record);
+    if (versionError !== undefined)
+        throw new Error(versionError.code);
     const accessMode = record.accessMode;
     if (accessMode === undefined) {
         throw new Error(`deployment ${record.deploymentId} has unsupported legacy access mode`);
@@ -102,6 +106,10 @@ function bindAppPackageSnapshot(served, value) {
 export async function targetForPersistedRecord(record, state) {
     const cached = state.servers.get(record.deploymentId);
     state.records.set(record.deploymentId, record);
+    if (deploymentRecordVersionError(record) !== undefined) {
+        state.servers.delete(record.deploymentId);
+        return undefined;
+    }
     if (cached === undefined)
         return state.load?.();
     if (!hasExactCustomerAuthProjection(record, cached.served.artifact.server.auth)) {

package/node_modules/@noodle-borg/service/dist/registry-types.d.ts

@@ -73,7 +73,7 @@ export type RunDeployResult = DeployResult | {
     readonly deploymentVersion: number;
     readonly serverVersion?: string;
 };
-export type AccessUpdateFailureCode = 'no_active_deployment' | 'server_auth_required' | 'customer_auth_audience_conflict' | 'public_user_context_conflict' | 'owner_identity_required' | 'access_update_conflict';
+export type AccessUpdateFailureCode = 'unsupported_deployment_record_version' | 'no_active_deployment' | 'server_auth_required' | 'customer_auth_audience_conflict' | 'public_user_context_conflict' | 'owner_identity_required' | 'access_update_conflict';
 export type AccessUpdateResult = {
     readonly ok: true;
     readonly changed: boolean;

package/node_modules/@noodle-borg/service/dist/registry.js

@@ -1,19 +1,19 @@
 import { KnowledgePublicationError, withKnowledgePublication, } from '@noodle-borg/knowledge-operations/portable';
 import { DeploymentActivationError, normalizeServerVersion, } from '@noodle-borg/module';
-import { normalizePersistedConnectorsForCompile } from './connector-normalize.js';
 import { CustomerAuthAudienceConflictError, customerAuthAudienceConflictFailure, hasActiveCustomerAuthAudienceConflict, } from './customer-auth-audience-binding.js';
 import { DeploymentLockedError, deploymentLockedConflict, deploymentLockedPreflight, } from './deployment-lock.js';
+import { UnsupportedDeploymentRecordVersionError, unsupportedDeploymentRecordFailure, } from './deployment-record-version.js';
 import { defaultActiveRecord } from './deployment-versioning.js';
 import { updateRegistryAccess } from './registry-access.js';
-import { compileRegistryTarget } from './registry-compile.js';
-import { preflightRegistryDeploy, resolveDeployAttempt, withDeploymentConfiguration, } from './registry-deploy-transaction.js';
-import { deploymentOwnerSubject, missingCapabilityErrors, } from './registry-helpers.js';
+import { compilePersistedRegistryRecord, compileRegistryTarget, loadPersistedRegistryTarget, } from './registry-compile.js';
+import { deploymentWriteVersionError, preflightRegistryDeploy, resolveDeployAttempt, withDeploymentConfiguration, } from './registry-deploy-transaction.js';
+import { deploymentOwnerSubject } from './registry-helpers.js';
 import { registryDeploymentPackage, renderDeploymentPackageSnapshot } from './registry-package.js';
 import { recoverRegistryRecords } from './registry-recover.js';
 import { rollbackDeployment, rollbackWithMappedErrors } from './registry-rollback.js';
 import { activeRecord, activeRecordVersion, persistDeployRecord, reconcilePlatformAccountResetRegistryCache, registryAppArchivedAt, registryArchiveApp, registryCustomerAuthRestoreProjections, registryGetApp, registryGetDeployment, registryGetEnvironment, registryListApps, registryListEnvironments, registryRestoreApp, registrySetProductionEnvironment, registrySweepArchived, setRegistryDeploymentLock, } from './registry-state.js';
 import { deploymentStatusFor } from './registry-status.js';
-import { deploymentSourceFor, emptySecretEnvelope, rebindNativeRecords, recordTenant, servedTargetFor, targetForPersistedRecord, tenantDeploymentKey, tenantKey, } from './registry-targets.js';
+import { deploymentSourceFor, emptySecretEnvelope, rebindNativeRecords, servedTargetFor, targetForPersistedRecord, tenantDeploymentKey, tenantKey, } from './registry-targets.js';
 import { withBuiltinStateCatalog } from './state-catalog.js';
 import { deploymentSummary, matchesDeploymentFilter, validateDeploymentListFilter, } from './store/records.js';
 import { InMemoryConfigStore, validateTenantRef, } from './store.js';
@@ -119,6 +119,9 @@ export class ServerRegistry {
                 if (active?.deploymentLock !== undefined)
                     return deploymentLockedConflict();
             }
+            const versionError = await deploymentWriteVersionError(this.#stateView(), safeTenant, safeServerVersion);
+            if (versionError !== undefined)
+                return { ok: false, errors: [versionError] };
             const preflight = await preflightRegistryDeploy({
                 options,
                 serviceCapabilities: this.#serviceCapabilities,
@@ -186,6 +189,8 @@ export class ServerRegistry {
                 if (error instanceof CustomerAuthAudienceConflictError) {
                     return customerAuthAudienceConflictFailure();
                 }
+                if (error instanceof UnsupportedDeploymentRecordVersionError)
+                    return unsupportedDeploymentRecordFailure();
                 if (error instanceof DeploymentLockedError)
                     return deploymentLockedConflict();
                 throw error;
@@ -211,6 +216,8 @@ export class ServerRegistry {
                     if (error instanceof CustomerAuthAudienceConflictError) {
                         return customerAuthAudienceConflictFailure();
                     }
+                    if (error instanceof UnsupportedDeploymentRecordVersionError)
+                        return unsupportedDeploymentRecordFailure();
                     if (error instanceof DeploymentLockedError)
                         return deploymentLockedConflict();
                     throw error;
@@ -262,6 +269,9 @@ export class ServerRegistry {
             if (active?.deploymentLock !== undefined)
                 return deploymentLockedPreflight();
         }
+        const versionError = await deploymentWriteVersionError(this.#stateView(), safeTenant, safeServerVersion);
+        if (versionError !== undefined)
+            return { ok: false, errors: [versionError] };
         const result = await preflightRegistryDeploy({
             options,
             serviceCapabilities: this.#serviceCapabilities,
@@ -305,16 +315,20 @@ export class ServerRegistry {
         }, { tenant, manifest, connectors, hostedAssets, deploymentId, renderAppPackage });
     }
     #compilePersistedRecord(record) {
-        return this.#compileTarget(recordTenant(record), record.manifest, record.connectors === undefined
-            ? undefined
-            : normalizePersistedConnectorsForCompile(record.connectors), record.hostedAssets, false, record.deploymentId);
+        return compilePersistedRegistryRecord(record, this.#compileTarget.bind(this));
     }
     async get(deploymentId) {
         if (this.#records.get(deploymentId)?.archivedAt !== undefined)
             return undefined;
         const cached = this.#servers.get(deploymentId);
-        if (cached)
-            return cached;
+        if (cached) {
+            const record = this.#store
+                ? await this.#store.get(deploymentId)
+                : this.#records.get(deploymentId);
+            return record === undefined || record.archivedAt !== undefined
+                ? undefined
+                : this.#targetForPersistedRecord(record);
+        }
         const inflight = this.#inflight.get(deploymentId);
         if (inflight)
             return inflight;
@@ -495,32 +509,13 @@ export class ServerRegistry {
         });
     }
     async #loadAndCompile(source) {
-        const record = typeof source === 'string'
-            ? this.#store
-                ? await this.#store.get(source)
-                : this.#records.get(source)
-            : source;
-        if (!record)
-            return undefined;
-        const deploymentId = record.deploymentId;
-        if (record.archivedAt !== undefined)
-            return undefined;
-        const built = await this.#compilePersistedRecord(record);
-        if (!built.ok) {
-            throw new Error(`deployment ${deploymentId} failed to recompile (${built.errors.map((e) => e.code).join(',')})`);
-        }
-        const missingCapabilities = missingCapabilityErrors(built.served.artifact.requirements?.capabilities ?? [], this.#serviceCapabilities);
-        if (missingCapabilities.length > 0) {
-            throw new Error(`deployment ${deploymentId} failed capability requirements (${missingCapabilities.map((e) => e.path).join(',')})`);
-        }
-        if (record.active &&
-            (await this.#hasCustomerAuthAudienceConflict(record, built.served.artifact.server.auth))) {
-            return undefined;
-        }
-        const target = servedTargetFor(record, built.served, this.#customerVerifierFactory);
-        this.#servers.set(deploymentId, target);
-        this.#records.set(deploymentId, record);
-        return target;
+        return loadPersistedRegistryTarget(source, {
+            state: this.#stateView(),
+            compile: (record) => this.#compilePersistedRecord(record),
+            capabilities: this.#serviceCapabilities,
+            customerVerifierFactory: this.#customerVerifierFactory,
+            hasCustomerAuthConflict: (record, auth) => this.#hasCustomerAuthAudienceConflict(record, auth),
+        });
     }
     async #hasCustomerAuthAudienceConflict(record, auth) {
         return hasActiveCustomerAuthAudienceConflict(this.#store, this.#records, record, auth);

package/node_modules/@noodle-borg/service/dist/routes/access.js

@@ -1,6 +1,7 @@
 import { normalizeServerVersion } from '@noodle-borg/module';
 import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
 import { accessUpdateRequestSchema } from '@noodle-borg/wire-contracts';
+import { deploymentAuthenticationFor } from '../deployment-authentication.js';
 import { deploymentOwnerSubject } from '../registry-helpers.js';
 import { authorizeControlPlane } from './control-plane.js';
 import { canManageMembers } from './org-admin.js';
@@ -44,6 +45,7 @@ export async function handleAccessUpdate(req, res, registry, gate, controlPlane,
     }
     const accessMode = result.record.accessMode ?? 'owner-only';
     const ownerSubject = deploymentOwnerSubject(result.record);
+    const authentication = deploymentAuthenticationFor(result.record);
     await audit.emit({
         eventType: 'deployment.access.updated',
         org: tenant.org,
@@ -63,6 +65,7 @@ export async function handleAccessUpdate(req, res, registry, gate, controlPlane,
             ...(ownerSubject !== undefined ? { ownerSubject } : {}),
             accessChanged: result.accessChanged,
             ownerChanged: result.ownerChanged,
+            ...(authentication !== undefined ? { authentication, policyChanged: false } : {}),
             changed: result.changed,
         },
     });
@@ -75,6 +78,7 @@ export async function handleAccessUpdate(req, res, registry, gate, controlPlane,
                 ? { serverVersion: result.record.serverVersion }
                 : {}),
             accessMode,
+            ...(authentication !== undefined ? { authentication } : {}),
             ...(ownerSubject !== undefined ? { ownerSubject } : {}),
         },
         previousAccessMode: result.previousAccessMode,
@@ -83,6 +87,7 @@ export async function handleAccessUpdate(req, res, registry, gate, controlPlane,
             : {}),
         accessChanged: result.accessChanged,
         ownerChanged: result.ownerChanged,
+        ...(authentication !== undefined ? { policyChanged: false } : {}),
         changed: result.changed,
     });
 }

package/node_modules/@noodle-borg/service/dist/store/in-memory.d.ts

@@ -12,6 +12,7 @@ export declare class InMemoryArtifactStore implements ArtifactStore {
     findActiveCustomerAuthAudienceConflict(ref: TenantRef, auth: TenantAuthConfig): Promise<TenantRef | undefined>;
     activateDeployment(ref: TenantRef, deploymentId: string, precondition?: {
         readonly expectedAccessMode: AccessMode | undefined;
+        readonly expectedSchemaVersion?: number;
         readonly serverAuth?: TenantAuthConfig;
     }, _options?: {
         readonly automationId?: string;

package/node_modules/@noodle-borg/service/dist/store/in-memory.js

@@ -1,7 +1,8 @@
 import { normalizeServerVersion } from '@noodle-borg/module';
 import { assertSameAppPackageSnapshot, sanitizeDeployRecordAppPackageSnapshot, } from '../app-package-snapshot.js';
-import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, } from '../customer-auth-audience-binding.js';
+import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, requiresCustomerAuthProjection, } from '../customer-auth-audience-binding.js';
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from '../deployment-lock.js';
+import { assertDeploymentAppendVersion } from '../deployment-record-version.js';
 import { defaultActiveRecord, sameDeploymentScope, sameTenantRecord, } from '../deployment-versioning.js';
 import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, planArchivedAppSweep, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
 import { validateSlug, validateTenantRef } from './validate.js';
@@ -10,6 +11,7 @@ export class InMemoryArtifactStore {
     #records = new Map();
     #productionEnvironments = new Map();
     async append(record) {
+        assertDeploymentAppendVersion([...this.#records.values()], record);
         const existing = this.#records.get(record.deploymentId);
         if (existing !== undefined)
             assertSameAppPackageSnapshot(existing, record);
@@ -83,17 +85,22 @@ export class InMemoryArtifactStore {
         if (target === undefined || !sameTenantRecord(target, safe))
             return Promise.resolve(undefined);
         assertDeploymentActivationUnlocked([...this.#records.values()], target);
-        if (precondition !== undefined && target.accessMode !== precondition.expectedAccessMode) {
+        if (target.schemaVersion !== (precondition?.expectedSchemaVersion ?? 1) ||
+            (precondition !== undefined && target.accessMode !== precondition.expectedAccessMode)) {
             return Promise.resolve(undefined);
         }
         const previousActive = [...this.#records.values()]
             .filter((record) => record.active && sameDeploymentScope(record, target))
             .sort((a, b) => b.deploymentVersion - a.deploymentVersion)[0];
+        if (precondition === undefined && previousActive !== undefined) {
+            assertDeploymentAppendVersion([previousActive], { ...target, active: true });
+        }
         const alreadyActive = previousActive?.deploymentId === target.deploymentId;
         const activated = {
             ...target,
             active: true,
-            ...(target.accessMode === 'customers' && precondition?.serverAuth !== undefined
+            ...(requiresCustomerAuthProjection(target, precondition?.serverAuth) &&
+                precondition?.serverAuth !== undefined
                 ? { serverAuth: precondition.serverAuth }
                 : {}),
         };

package/node_modules/@noodle-borg/service/dist/store/json-file.d.ts

@@ -18,6 +18,7 @@ export declare class JsonFileArtifactStore implements ArtifactStore {
     updateActiveAccess(ref: TenantRef, deploymentId: string, input: ActiveAccessUpdateInput): Promise<DeployRecord | undefined>;
     activateDeployment(ref: TenantRef, deploymentId: string, precondition?: {
         readonly expectedAccessMode: AccessMode | undefined;
+        readonly expectedSchemaVersion?: number;
         readonly serverAuth?: TenantAuthConfig;
     }): Promise<DeploymentActivationResult | undefined>;
     loadAll(): Promise<readonly DeployRecord[]>;

package/node_modules/@noodle-borg/service/dist/store/json-file.js

@@ -3,8 +3,9 @@ import { mkdir, readdir, readFile, rename, rm, writeFile } from 'node:fs/promise
 import { join } from 'node:path';
 import { normalizeServerVersion } from '@noodle-borg/module';
 import { assertSameAppPackageSnapshot, sanitizeDeployRecordAppPackageSnapshot, } from '../app-package-snapshot.js';
-import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, } from '../customer-auth-audience-binding.js';
+import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, requiresCustomerAuthProjection, } from '../customer-auth-audience-binding.js';
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from '../deployment-lock.js';
+import { assertDeploymentAppendVersion } from '../deployment-record-version.js';
 import { defaultActiveRecord, sameDeploymentScope, sameTenantRecord, } from '../deployment-versioning.js';
 import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, planArchivedAppSweep, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
 import { DEPLOYMENT_ID_PATTERN, validateSlug, validateTenantRef } from './validate.js';
@@ -34,6 +35,7 @@ export class JsonFileArtifactStore {
             throw new Error(`invalid deploymentId for persistence: "${record.deploymentId}"`);
         }
         const records = await this.loadAll();
+        assertDeploymentAppendVersion(records, record);
         const existing = records.find((candidate) => candidate.deploymentId === record.deploymentId);
         if (existing !== undefined)
             assertSameAppPackageSnapshot(existing, record);
@@ -127,7 +129,8 @@ export class JsonFileArtifactStore {
             const target = await this.get(deploymentId);
             if (target === undefined || !sameTenantRecord(target, safe))
                 return undefined;
-            if (precondition !== undefined && target.accessMode !== precondition.expectedAccessMode) {
+            if (target.schemaVersion !== (precondition?.expectedSchemaVersion ?? 1) ||
+                (precondition !== undefined && target.accessMode !== precondition.expectedAccessMode)) {
                 return undefined;
             }
             const records = await this.loadAll();
@@ -135,11 +138,15 @@ export class JsonFileArtifactStore {
             const previousActive = records
                 .filter((record) => record.active && sameDeploymentScope(record, target))
                 .sort((a, b) => b.deploymentVersion - a.deploymentVersion)[0];
+            if (precondition === undefined && previousActive !== undefined) {
+                assertDeploymentAppendVersion([previousActive], { ...target, active: true });
+            }
             const alreadyActive = previousActive?.deploymentId === target.deploymentId;
             const activated = {
                 ...target,
                 active: true,
-                ...(target.accessMode === 'customers' && precondition?.serverAuth !== undefined
+                ...(requiresCustomerAuthProjection(target, precondition?.serverAuth) &&
+                    precondition?.serverAuth !== undefined
                     ? { serverAuth: precondition.serverAuth }
                     : {}),
             };

package/node_modules/@noodle-borg/service/dist/store/records.js

@@ -5,6 +5,7 @@
  * own persistence and feed their own raw records/anchors through these pure functions so every
  * backend groups, ranks, and sorts identically.
  */
+import { requiresCustomerAuthProjection } from '../customer-auth-audience-binding.js';
 import { sameTenantRecord } from '../deployment-versioning.js';
 import { deploymentOwnerSubject } from '../registry-helpers.js';
 import { validateSlug } from './validate.js';
@@ -139,17 +140,18 @@ export function resolveActiveAccessUpdate(record, ref, input) {
         record.archivedAt !== undefined ||
         !sameTenantRecord(record, ref) ||
         record.accessMode !== input.expectedAccessMode ||
+        record.schemaVersion !== (input.expectedSchemaVersion ?? 1) ||
         deploymentOwnerSubject(record) !== input.expectedOwnerSubject)
         return undefined;
     if ((record.accessMode ?? 'owner-only') === input.accessMode &&
         (input.ownerSubject === undefined || deploymentOwnerSubject(record) === input.ownerSubject) &&
-        input.accessMode !== 'customers')
+        !requiresCustomerAuthProjection({ ...record, accessMode: input.accessMode }, input.serverAuth))
         return record;
     return {
         ...record,
         accessMode: input.accessMode,
         ...(input.ownerSubject !== undefined ? { ownerSubject: input.ownerSubject } : {}),
-        ...(input.accessMode === 'customers' && input.serverAuth !== undefined
+        ...(requiresCustomerAuthProjection({ ...record, accessMode: input.accessMode }, input.serverAuth) && input.serverAuth !== undefined
             ? { serverAuth: input.serverAuth }
             : {}),
     };

package/node_modules/@noodle-borg/service/dist/store.d.ts

@@ -3,7 +3,7 @@ import type { OrganizationStore } from '@noodle-borg/control-plane/portable';
 import type { OrgMembershipSource } from '@noodle-borg/module';
 import type { SealedSecret } from '@noodle-borg/runtime';
 import type { AccessMode } from '@noodle-borg/transport-http';
-import type { DeploymentSource } from '@noodle-borg/wire-contracts';
+import type { DeploymentAuthentication, DeploymentSource } from '@noodle-borg/wire-contracts';
 import type { AppPackageSnapshotV1 } from './app-package-snapshot.js';
 import type { ProductionEnvironmentChange } from './store/environment-production.js';
 export type { ActiveMcpSubdomainClaim, ChangeMcpSubdomainInput, CreateOrgWithOwnerInput, McpSubdomainMutationResult, McpSubdomainSetting, OrgDomainRecord, OrgInvitationRecord, OrgMemberRecord, OrgOpenAIAppsChallengeRecord, OrgRecord, OrgRole, PersonalWorkspaceProvisionInput, PersonalWorkspaceProvisionResult, SignupAllowlistKind, SignupAllowlistRecord, WelcomeEmailRecord, } from '@noodle-borg/control-plane/portable';
@@ -241,6 +241,7 @@ export interface DeploymentStatus {
         readonly createdByEmail?: string;
         readonly ownerSubject?: string;
         readonly accessMode: AccessMode;
+        readonly authentication?: DeploymentAuthentication;
         readonly deploymentLock?: DeploymentLockMetadata;
     };
     readonly health: {
@@ -262,6 +263,8 @@ export interface ActiveAccessUpdateInput {
     /** Desired owner mutation. Omission preserves the current effective owner; clearing is unsupported. */
     readonly ownerSubject?: string;
     readonly expectedAccessMode: AccessMode | undefined;
+    /** Older callers omit this and are restricted to version-1 records. */
+    readonly expectedSchemaVersion?: number;
     readonly expectedOwnerSubject: string | undefined;
     /** Compiler-authoritative projection persisted atomically when enabling customer access. */
     readonly serverAuth?: TenantAuthConfig;
@@ -303,6 +306,7 @@ export interface ArtifactStore {
     findActiveCustomerAuthAudienceConflict?(ref: TenantRef, auth: TenantAuthConfig): Promise<TenantRef | undefined>;
     activateDeployment(ref: TenantRef, deploymentId: string, precondition?: {
         readonly expectedAccessMode: AccessMode | undefined;
+        readonly expectedSchemaVersion?: number;
         /** Compiler-authoritative projection persisted atomically when activating customer access. */
         readonly serverAuth?: TenantAuthConfig;
     }, options?: {

package/node_modules/@noodle-borg/service/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.101.0",
+    "@noodle-borg/agent-kit": "0.102.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/node_modules/@noodle-borg/wire-contracts/dist/control-plane.d.ts

@@ -1,5 +1,12 @@
 /** Strict service-output contracts for control-plane reads and mutations (ADR 0128). */
 import { z } from 'zod';
+/** Effective authority enforcing caller authentication for one deployment. */
+export declare const deploymentAuthenticationSchema: z.ZodEnum<{
+    customer: "customer";
+    none: "none";
+    platform: "platform";
+}>;
+export type DeploymentAuthentication = z.infer<typeof deploymentAuthenticationSchema>;
 /** Exact OAuth subject bound by an operator to an owner-only deployment. */
 export declare const deploymentOwnerSubjectSchema: z.ZodString;
 export declare const accessUpdateRequestSchema: z.ZodObject<{
@@ -32,6 +39,11 @@ export declare const accessUpdateResponseSchema: z.ZodObject<{
             mixed: "mixed";
             customers: "customers";
         }>;
+        authentication: z.ZodOptional<z.ZodEnum<{
+            customer: "customer";
+            none: "none";
+            platform: "platform";
+        }>>;
         ownerSubject: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
     previousAccessMode: z.ZodEnum<{
@@ -45,6 +57,7 @@ export declare const accessUpdateResponseSchema: z.ZodObject<{
     previousOwnerSubject: z.ZodOptional<z.ZodString>;
     accessChanged: z.ZodBoolean;
     ownerChanged: z.ZodBoolean;
+    policyChanged: z.ZodOptional<z.ZodBoolean>;
     changed: z.ZodBoolean;
 }, z.core.$strict>;
 export type AccessUpdateResponse = z.output<typeof accessUpdateResponseSchema>;
@@ -71,6 +84,11 @@ export declare const accessUpdateClientResponseSchema: z.ZodPipe<z.ZodObject<{
             mixed: "mixed";
             customers: "customers";
         }>;
+        authentication: z.ZodOptional<z.ZodEnum<{
+            customer: "customer";
+            none: "none";
+            platform: "platform";
+        }>>;
         ownerSubject: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     previousAccessMode: z.ZodEnum<{
@@ -84,6 +102,7 @@ export declare const accessUpdateClientResponseSchema: z.ZodPipe<z.ZodObject<{
     previousOwnerSubject: z.ZodOptional<z.ZodString>;
     accessChanged: z.ZodOptional<z.ZodBoolean>;
     ownerChanged: z.ZodOptional<z.ZodBoolean>;
+    policyChanged: z.ZodOptional<z.ZodBoolean>;
     changed: z.ZodBoolean;
 }, z.core.$strip>, z.ZodTransform<{
     accessChanged: boolean;
@@ -97,12 +116,14 @@ export declare const accessUpdateClientResponseSchema: z.ZodPipe<z.ZodObject<{
         deploymentId: string;
         accessMode: "owner-only" | "org-members" | "authenticated" | "public" | "mixed" | "customers";
         serverVersion?: string | undefined;
+        authentication?: "customer" | "none" | "platform" | undefined;
         ownerSubject?: string | undefined;
     };
     previousAccessMode: "owner-only" | "org-members" | "authenticated" | "public" | "mixed" | "customers";
     changed: boolean;
     previousOwnerSubject?: string | undefined;
     ownerChanged?: boolean | undefined;
+    policyChanged?: boolean | undefined;
 }, {
     ok: true;
     target: {
@@ -114,6 +135,7 @@ export declare const accessUpdateClientResponseSchema: z.ZodPipe<z.ZodObject<{
         deploymentId: string;
         accessMode: "owner-only" | "org-members" | "authenticated" | "public" | "mixed" | "customers";
         serverVersion?: string | undefined;
+        authentication?: "customer" | "none" | "platform" | undefined;
         ownerSubject?: string | undefined;
     };
     previousAccessMode: "owner-only" | "org-members" | "authenticated" | "public" | "mixed" | "customers";
@@ -121,6 +143,7 @@ export declare const accessUpdateClientResponseSchema: z.ZodPipe<z.ZodObject<{
     previousOwnerSubject?: string | undefined;
     accessChanged?: boolean | undefined;
     ownerChanged?: boolean | undefined;
+    policyChanged?: boolean | undefined;
 }>>;
 export type AccessUpdateClientResponse = z.output<typeof accessUpdateClientResponseSchema>;
 export declare const WhoamiIdentityResponseSchema: z.ZodObject<{

package/node_modules/@noodle-borg/wire-contracts/dist/control-plane.js

@@ -1,6 +1,8 @@
 /** Strict service-output contracts for control-plane reads and mutations (ADR 0128). */
 import { z } from 'zod';
 import { accessModeSchema } from './access-mode.js';
+/** Effective authority enforcing caller authentication for one deployment. */
+export const deploymentAuthenticationSchema = z.enum(['none', 'platform', 'customer']);
 function containsC0OrDel(value) {
     for (let index = 0; index < value.length; index += 1) {
         const codeUnit = value.charCodeAt(index);
@@ -46,6 +48,7 @@ export const accessUpdateResponseSchema = z
         deploymentId: z.string().min(1),
         serverVersion: z.string().min(1).optional(),
         accessMode: accessModeSchema,
+        authentication: deploymentAuthenticationSchema.optional(),
         ownerSubject: deploymentOwnerSubjectSchema.optional(),
     })
         .strict(),
@@ -53,6 +56,7 @@ export const accessUpdateResponseSchema = z
     previousOwnerSubject: deploymentOwnerSubjectSchema.optional(),
     accessChanged: z.boolean(),
     ownerChanged: z.boolean(),
+    policyChanged: z.boolean().optional(),
     changed: z.boolean(),
 })
     .strict()
@@ -65,11 +69,19 @@ export const accessUpdateResponseSchema = z
             message: 'owner-only access requires a current owner subject',
         });
     }
-    if (value.changed !== (value.accessChanged || value.ownerChanged)) {
+    if ((value.deployment.authentication === undefined) !== (value.policyChanged === undefined)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['policyChanged'],
+            message: 'authentication and policyChanged must be present together',
+        });
+    }
+    if (value.changed !==
+        (value.accessChanged || value.ownerChanged || (value.policyChanged ?? false))) {
         context.addIssue({
             code: 'custom',
             path: ['changed'],
-            message: 'changed must equal accessChanged || ownerChanged',
+            message: 'changed must equal accessChanged || ownerChanged || policyChanged',
         });
     }
 });
@@ -90,12 +102,14 @@ export const accessUpdateClientResponseSchema = z
         deploymentId: z.string().min(1),
         serverVersion: z.string().min(1).optional(),
         accessMode: accessModeSchema,
+        authentication: deploymentAuthenticationSchema.optional(),
         ownerSubject: deploymentOwnerSubjectSchema.optional(),
     }),
     previousAccessMode: accessModeSchema,
     previousOwnerSubject: deploymentOwnerSubjectSchema.optional(),
     accessChanged: z.boolean().optional(),
     ownerChanged: z.boolean().optional(),
+    policyChanged: z.boolean().optional(),
     changed: z.boolean(),
 })
     .superRefine((value, context) => {
@@ -107,6 +121,20 @@ export const accessUpdateClientResponseSchema = z
             message: 'accessChanged and ownerChanged must be present together',
         });
     }
+    if ((value.deployment.authentication === undefined) !== (value.policyChanged === undefined)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['policyChanged'],
+            message: 'authentication and policyChanged must be present together',
+        });
+    }
+    if (value.policyChanged !== undefined && !modernComponents) {
+        context.addIssue({
+            code: 'custom',
+            path: ['policyChanged'],
+            message: 'policyChanged requires accessChanged and ownerChanged',
+        });
+    }
     if (modernComponents &&
         value.deployment.accessMode === 'owner-only' &&
         value.deployment.ownerSubject === undefined) {
@@ -116,11 +144,13 @@ export const accessUpdateClientResponseSchema = z
             message: 'owner-only access requires a current owner subject',
         });
     }
-    if (modernComponents && value.changed !== (value.accessChanged || value.ownerChanged)) {
+    if (modernComponents &&
+        value.changed !==
+            (value.accessChanged || value.ownerChanged || (value.policyChanged ?? false))) {
         context.addIssue({
             code: 'custom',
             path: ['changed'],
-            message: 'changed must equal accessChanged || ownerChanged',
+            message: 'changed must equal accessChanged || ownerChanged || policyChanged',
         });
     }
 })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.165.0",
+  "version": "0.166.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",
@@ -235,7 +235,7 @@
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.101.0",
+    "@noodle-borg/agent-kit": "0.102.0",
     "@noodle-borg/app-audit": "0.0.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",