@noodleseed/one 0.165.0 → 0.167.0

package/node_modules/@noodle-borg/service/dist/registry-access.js

@@ -1,10 +1,12 @@
-import { assertUniqueActiveCustomerAuthAudienceBindings, CustomerAuthAudienceConflictError, } from './customer-auth-audience-binding.js';
+import { assertUniqueActiveCustomerAuthAudienceBindings, CustomerAuthAudienceConflictError, hasExactCustomerAuthProjection, } from './customer-auth-audience-binding.js';
+import { deploymentRecordVersionError } from './deployment-record-version.js';
 import { deploymentOwnerSubject } from './registry-helpers.js';
 import { activeRecord, activeRecordVersion } from './registry-state.js';
 import { tenantDeploymentKey, tryServedTargetFor } from './registry-targets.js';
+import { resolveActiveAccessUpdate } from './store/records.js';
 /** Registry-facing access transition with customer audience ownership preflight and atomic translation. */
 export async function updateRegistryAccess(state, tenant, options, loadServed, customerVerifierFactory, hasCustomerAuthConflict) {
-    if (options.accessMode === 'customers') {
+    if (options.accessMode === 'customers' || options.accessMode === 'mixed') {
         const record = options.serverVersion === undefined
             ? await activeRecord(state, tenant)
             : await activeRecordVersion(state, tenant, options.serverVersion);
@@ -12,7 +14,11 @@ export async function updateRegistryAccess(state, tenant, options, loadServed, c
         const auth = served?.served.artifact.server.auth;
         if (record !== undefined &&
             auth !== undefined &&
-            (await hasCustomerAuthConflict({ ...record, accessMode: 'customers' }, auth))) {
+            (await hasCustomerAuthConflict({
+                ...record,
+                accessMode: options.accessMode,
+                ...(options.accessMode === 'mixed' ? { schemaVersion: 2 } : {}),
+            }, auth))) {
             return customerAuthAudienceConflict();
         }
     }
@@ -41,17 +47,34 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
         : await activeRecordVersion(state, tenant, options.serverVersion);
     if (record === undefined)
         return noActiveDeployment();
+    const versionError = deploymentRecordVersionError(record);
+    if (versionError !== undefined) {
+        return {
+            ok: false,
+            status: 409,
+            code: 'unsupported_deployment_record_version',
+            message: versionError.message,
+        };
+    }
     const nextAccessMode = options.accessMode;
     const previousAccessMode = record.accessMode ?? 'owner-only';
     const previousOwnerSubject = deploymentOwnerSubject(record);
     const nextOwnerSubject = options.ownerSubject ?? previousOwnerSubject;
     const accessChanged = previousAccessMode !== nextAccessMode;
     const ownerChanged = previousOwnerSubject !== nextOwnerSubject;
-    const served = accessChanged || ownerChanged || nextAccessMode === 'customers'
+    const served = accessChanged || ownerChanged || nextAccessMode === 'customers' || nextAccessMode === 'mixed'
         ? await loadServed(record.deploymentId)
         : undefined;
     const serverAuth = served?.served.artifact.server.auth;
-    if (nextAccessMode === 'customers' && serverAuth === undefined) {
+    const schemaVersion = record.schemaVersion === 2 || (nextAccessMode === 'mixed' && serverAuth !== undefined) ? 2 : 1;
+    const policyChanged = schemaVersion !== record.schemaVersion;
+    if ((nextAccessMode === 'customers' && serverAuth === undefined) ||
+        !hasExactCustomerAuthProjection({
+            ...record,
+            schemaVersion,
+            accessMode: nextAccessMode,
+            ...(record.serverAuth === undefined && serverAuth !== undefined ? { serverAuth } : {}),
+        }, serverAuth)) {
         return {
             ok: false,
             status: 409,
@@ -59,17 +82,23 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
             message: 'Customer access requires server authentication.',
         };
     }
-    if (!accessChanged && !ownerChanged) {
+    if (!accessChanged && !ownerChanged && !policyChanged) {
         const committed = state.store === undefined
             ? commitInMemoryAccessUpdate(state, tenant, record, {
                 accessMode: nextAccessMode,
                 expectedAccessMode: record.accessMode,
+                ...(schemaVersion === 2 ? { schemaVersion: 2 } : {}),
+                expectedSchemaVersion: record.schemaVersion,
+                expectedManifest: record.manifest,
                 expectedOwnerSubject: previousOwnerSubject,
                 ...(serverAuth !== undefined ? { serverAuth } : {}),
             })
             : await state.store.updateActiveAccess(tenant, record.deploymentId, {
                 accessMode: nextAccessMode,
                 expectedAccessMode: record.accessMode,
+                ...(schemaVersion === 2 ? { schemaVersion: 2 } : {}),
+                expectedSchemaVersion: record.schemaVersion,
+                expectedManifest: record.manifest,
                 expectedOwnerSubject: previousOwnerSubject,
                 ...(serverAuth !== undefined ? { serverAuth } : {}),
             });
@@ -80,6 +109,7 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
             ok: true,
             changed: false,
             accessChanged: false,
+            policyChanged: false,
             ownerChanged: false,
             previousAccessMode,
             ...(previousOwnerSubject !== undefined ? { previousOwnerSubject } : {}),
@@ -107,8 +137,9 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
     const updated = {
         ...record,
         accessMode: nextAccessMode,
+        schemaVersion,
         ...(ownerChanged && nextOwnerSubject !== undefined ? { ownerSubject: nextOwnerSubject } : {}),
-        ...(nextAccessMode === 'customers' && serverAuth !== undefined ? { serverAuth } : {}),
+        ...(serverAuth !== undefined ? { serverAuth } : {}),
     };
     const target = tryServedTargetFor(updated, served.served, customerVerifierFactory);
     if (target === undefined)
@@ -120,6 +151,9 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
                 ? { ownerSubject: nextOwnerSubject }
                 : {}),
             expectedAccessMode: record.accessMode,
+            ...(schemaVersion === 2 ? { schemaVersion: 2 } : {}),
+            expectedSchemaVersion: record.schemaVersion,
+            expectedManifest: record.manifest,
             expectedOwnerSubject: previousOwnerSubject,
             ...(serverAuth !== undefined ? { serverAuth } : {}),
         })
@@ -129,6 +163,9 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
                 ? { ownerSubject: nextOwnerSubject }
                 : {}),
             expectedAccessMode: record.accessMode,
+            ...(schemaVersion === 2 ? { schemaVersion: 2 } : {}),
+            expectedSchemaVersion: record.schemaVersion,
+            expectedManifest: record.manifest,
             expectedOwnerSubject: previousOwnerSubject,
             ...(serverAuth !== undefined ? { serverAuth } : {}),
         });
@@ -140,6 +177,7 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
         ok: true,
         changed: true,
         accessChanged,
+        policyChanged,
         ownerChanged,
         previousAccessMode,
         ...(previousOwnerSubject !== undefined ? { previousOwnerSubject } : {}),
@@ -147,30 +185,9 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
     };
 }
 function commitInMemoryAccessUpdate(state, tenant, observed, input) {
-    const current = state.records.get(observed.deploymentId);
-    if (current === undefined ||
-        !current.active ||
-        current.archivedAt !== undefined ||
-        current.orgSlug !== tenant.org ||
-        current.appSlug !== tenant.app ||
-        current.environment !== tenant.env ||
-        current.accessMode !== input.expectedAccessMode ||
-        deploymentOwnerSubject(current) !== input.expectedOwnerSubject) {
+    const committed = resolveActiveAccessUpdate(state.records.get(observed.deploymentId), tenant, input);
+    if (committed === undefined)
         return undefined;
-    }
-    if ((current.accessMode ?? 'owner-only') === input.accessMode &&
-        (input.ownerSubject === undefined || deploymentOwnerSubject(current) === input.ownerSubject) &&
-        input.accessMode !== 'customers') {
-        return current;
-    }
-    const committed = {
-        ...current,
-        accessMode: input.accessMode,
-        ...(input.ownerSubject !== undefined ? { ownerSubject: input.ownerSubject } : {}),
-        ...(input.accessMode === 'customers' && input.serverAuth !== undefined
-            ? { serverAuth: input.serverAuth }
-            : {}),
-    };
     const proposed = new Map(state.records).set(committed.deploymentId, committed);
     assertUniqueActiveCustomerAuthAudienceBindings([...proposed.values()]);
     state.records.set(committed.deploymentId, committed);

package/node_modules/@noodle-borg/service/dist/registry-compile.js

@@ -4,12 +4,24 @@ import { compileConnectors, delegatedTokenExchangeIdentityErrors, } from '@noodl
 import { InMemoryConnectorRegistry, resolveManagedOrigins, resolveVariableEnvironment, } from '@noodle-borg/runtime';
 import { AppPackageSnapshotError, createAppPackageSnapshot, } from './app-package-snapshot.js';
 import { missingServerConfigErrors } from './assistant-bindings.js';
+import { normalizePersistedConnectorsForCompile } from './connector-normalize.js';
 import { ManagedConfigBroker } from './credential-broker.js';
 import { deploymentCredentialBrokerOptions } from './credential-broker-options.js';
+import { deploymentRecordVersionError } from './deployment-record-version.js';
 import { normalizePersistedManifestForCompile } from './manifest-normalize.js';
-import { missingSecretErrors, missingVariableErrors } from './registry-helpers.js';
+import { missingCapabilityErrors, missingSecretErrors, missingVariableErrors, } from './registry-helpers.js';
+import { servedTargetFor } from './registry-targets.js';
 import { createDeploymentStateConnector, } from './state-connector-factory.js';
 import { resolveConfigScope, } from './store.js';
+/** Reject unsupported persisted semantics before constructing executable runtime dependencies. */
+export async function compilePersistedRegistryRecord(record, compileTarget) {
+    const versionError = deploymentRecordVersionError(record);
+    if (versionError !== undefined)
+        return { ok: false, errors: [versionError] };
+    return compileTarget({ org: record.orgSlug, app: record.appSlug, env: record.environment }, record.manifest, record.connectors === undefined
+        ? undefined
+        : normalizePersistedConnectorsForCompile(record.connectors), record.hostedAssets, false, record.deploymentId);
+}
 export async function compileRegistryTarget(context, input) {
     const { tenant, manifest, connectors, hostedAssets, deploymentId } = input;
     let catalogConnectors = [];
@@ -216,4 +228,33 @@ export async function compileRegistryTarget(context, input) {
         ...(appPackageSnapshot !== undefined ? { appPackageSnapshot } : {}),
     };
 }
+/** Load and validate persisted semantics before publishing an executable target to caches. */
+export async function loadPersistedRegistryTarget(source, context) {
+    const { state } = context;
+    const record = typeof source === 'string'
+        ? state.store
+            ? await state.store.get(source)
+            : state.records.get(source)
+        : source;
+    if (!record ||
+        record.archivedAt !== undefined ||
+        deploymentRecordVersionError(record) !== undefined)
+        return undefined;
+    const deploymentId = record.deploymentId;
+    const built = await context.compile(record);
+    if (!built.ok) {
+        throw new Error(`deployment ${deploymentId} failed to recompile (${built.errors.map((e) => e.code).join(',')})`);
+    }
+    const missingCapabilities = missingCapabilityErrors(built.served.artifact.requirements?.capabilities ?? [], context.capabilities);
+    if (missingCapabilities.length > 0) {
+        throw new Error(`deployment ${deploymentId} failed capability requirements (${missingCapabilities.map((e) => e.path).join(',')})`);
+    }
+    if (record.active &&
+        (await context.hasCustomerAuthConflict(record, built.served.artifact.server.auth)))
+        return undefined;
+    const target = servedTargetFor(record, built.served, context.customerVerifierFactory);
+    state.servers.set(deploymentId, target);
+    state.records.set(deploymentId, record);
+    return target;
+}
 //# sourceMappingURL=registry-compile.js.map

package/node_modules/@noodle-borg/service/dist/registry-deploy-transaction.js

@@ -1,6 +1,10 @@
 import { normalizeServerVersion } from '@noodle-borg/module';
+import { deploymentAuthenticationFor } from './deployment-authentication.js';
+import { deploymentRecordVersionError } from './deployment-record-version.js';
+import { sameTenantRecord } from './deployment-versioning.js';
 import { deployAccessRequiresActor, deployerRequiredError, deploymentOwnerSubject, emptyMembershipSourcesError, membershipSourcesRequireOrgMembersError, missingCapabilityErrors, serverAuthRequiredError, } from './registry-helpers.js';
-import { idempotentDeploymentId, mintDeploymentId } from './registry-targets.js';
+import { activeRecordVersion } from './registry-state.js';
+import { emptySecretEnvelope, idempotentDeploymentId, mintDeploymentId, } from './registry-targets.js';
 /** Serialize candidate validation/activation with hierarchical configuration writers. */
 export async function withDeploymentConfiguration(config, org, work) {
     if (!config.transactConfig)
@@ -19,6 +23,11 @@ export async function withDeploymentConfiguration(config, org, work) {
         throw error;
     }
 }
+/** Validate the exact destination scope before compilation or publication side effects. */
+export async function deploymentWriteVersionError(state, tenant, serverVersion) {
+    const active = await activeDeploymentWriteScope(state, tenant, serverVersion);
+    return active === undefined ? undefined : deploymentRecordVersionError(active);
+}
 export async function preflightRegistryDeploy(input) {
     const { actor, accessMode, orgMembershipSources } = input.options;
     if (input.options.serverVersion !== undefined) {
@@ -32,6 +41,9 @@ export async function preflightRegistryDeploy(input) {
     const artifact = built.ok ? built.served.artifact : built.compiledArtifact;
     if (artifact !== undefined) {
         errors.push(...missingCapabilityErrors(artifact.requirements?.capabilities ?? [], input.serviceCapabilities));
+        if (accessMode === 'mixed' && artifact.server.auth !== undefined && actor === undefined) {
+            errors.push(...deployerRequiredError(accessMode).errors);
+        }
         if (accessMode === 'customers' && artifact.server.auth === undefined) {
             errors.push(...serverAuthRequiredError().errors);
         }
@@ -67,6 +79,10 @@ export async function resolveDeployAttempt(input) {
     const existing = (await input.store?.get(deploymentId)) ?? input.records.get(deploymentId);
     if (existing === undefined)
         return { deploymentId };
+    const versionError = deploymentRecordVersionError(existing);
+    if (versionError !== undefined) {
+        return { deploymentId, replay: { ok: false, errors: [versionError] } };
+    }
     if (!sameIdempotentDeploy(existing, input.tenant, input.manifest, input.options)) {
         return {
             deploymentId,
@@ -78,18 +94,23 @@ export async function resolveDeployAttempt(input) {
             },
         };
     }
-    const ownerSubject = deploymentOwnerSubject(existing);
     return {
         deploymentId,
-        replay: {
-            ok: true,
-            deploymentId: existing.deploymentId,
-            deploymentVersion: existing.deploymentVersion,
-            ...(existing.serverVersion !== undefined ? { serverVersion: existing.serverVersion } : {}),
-            ...(existing.accessMode !== undefined ? { accessMode: existing.accessMode } : {}),
-            ...(ownerSubject !== undefined ? { ownerSubject } : {}),
-            replayed: true,
-        },
+        replay: { ...deployedRecordResult(existing), replayed: true },
+    };
+}
+/** Deploy and retry responses report the committed operator policy, never the requested intent. */
+export function deployedRecordResult(record) {
+    const ownerSubject = deploymentOwnerSubject(record);
+    const authentication = deploymentAuthenticationFor(record);
+    return {
+        ok: true,
+        deploymentId: record.deploymentId,
+        deploymentVersion: record.deploymentVersion,
+        ...(record.serverVersion !== undefined ? { serverVersion: record.serverVersion } : {}),
+        ...(record.accessMode !== undefined ? { accessMode: record.accessMode } : {}),
+        ...(authentication !== undefined ? { authentication } : {}),
+        ...(ownerSubject !== undefined ? { ownerSubject } : {}),
     };
 }
 function sameIdempotentDeploy(record, tenant, manifest, options) {
@@ -102,14 +123,83 @@ function sameIdempotentDeploy(record, tenant, manifest, options) {
         record.serverVersion === serverVersion &&
         record.manifest === manifest &&
         record.connectors === options.connectors &&
-        record.accessMode === options.accessMode &&
+        (record.schemaVersion === 2 ||
+            (record.accessMode === options.accessMode &&
+                (options.accessMode !== 'owner-only' ||
+                    deploymentOwnerSubject(record) === (options.ownerSubject ?? options.actor?.subject)))) &&
         record.deploymentSource === options.deploymentSource &&
         sameJson(record.hostedAssets, options.hostedAssets) &&
-        sameJson(record.orgMembershipSources, options.orgMembershipSources) &&
-        (options.accessMode !== 'owner-only' ||
-            deploymentOwnerSubject(record) === (options.ownerSubject ?? options.actor?.subject)));
+        sameJson(record.orgMembershipSources, options.orgMembershipSources));
 }
 function sameJson(left, right) {
     return JSON.stringify(left) === JSON.stringify(right);
 }
+/** Writes target one exact scope; default routing deliberately prefers a versioned deployment. */
+async function activeDeploymentWriteScope(state, tenant, serverVersion) {
+    if (serverVersion !== undefined)
+        return activeRecordVersion(state, tenant, serverVersion);
+    // The existing store port has no unversioned point lookup. Read durable records, never a worker cache.
+    const records = state.store ? await state.store.loadAll() : [...state.records.values()];
+    return records
+        .filter((record) => record.active &&
+        record.archivedAt === undefined &&
+        record.serverVersion === undefined &&
+        sameTenantRecord(record, tenant))
+        .sort((a, b) => b.deploymentVersion - a.deploymentVersion)[0];
+}
+/** Existing dormant mixed declarations require an explicit operator adoption. */
+function mixedCustomerActivationError(previous, previousAuth, accessMode, auth) {
+    return previous?.schemaVersion === 1 &&
+        previous.accessMode === 'mixed' &&
+        previousAuth !== undefined &&
+        accessMode === 'mixed' &&
+        auth !== undefined
+        ? {
+            code: 'customer_auth_activation_required',
+            path: 'accessMode',
+            message: 'Activate customer authentication with noodle access set mixed before redeploying this existing mixed deployment.',
+        }
+        : undefined;
+}
+/** Bind replacement policy to the observed active revision before the atomic store write. */
+export async function replacementDeploymentPolicy(state, tenant, serverVersion, accessMode, auth, compile) {
+    const previous = await activeDeploymentWriteScope(state, tenant, serverVersion);
+    const previousBuilt = previous === undefined ? undefined : await compile(previous);
+    return {
+        previous,
+        schemaVersion: previous?.schemaVersion === 2 || (accessMode === 'mixed' && auth !== undefined) ? 2 : 1,
+        error: mixedCustomerActivationError(previous, previousBuilt?.ok ? previousBuilt.served.artifact.server.auth : previous?.serverAuth, accessMode, auth),
+    };
+}
+/** Construct one immutable deployment candidate from compiled source and resolved operator policy. */
+export function createRegistryDeployRecord(input) {
+    const { safeTenant, safeServerVersion, deploymentId, version, built, manifest, options, schemaVersion, appPackageSnapshot, } = input;
+    const { actor, accessMode, automationId, deploymentSource, orgMembershipSources, connectors, hostedAssets, } = options;
+    const serverAuth = built.artifact.server.auth;
+    const ownerSubject = accessMode === 'owner-only' ? (options.ownerSubject ?? actor?.subject) : undefined;
+    const record = {
+        schemaVersion,
+        deploymentId,
+        orgSlug: safeTenant.org,
+        appSlug: safeTenant.app,
+        environment: safeTenant.env,
+        ...(safeServerVersion !== undefined ? { serverVersion: safeServerVersion } : {}),
+        deploymentVersion: version,
+        active: automationId === undefined,
+        serverName: built.artifact.server.name,
+        createdAt: new Date().toISOString(),
+        ...(actor ? { createdBySubject: actor.subject, createdByEmail: actor.email } : {}),
+        ...(ownerSubject !== undefined ? { ownerSubject } : {}),
+        ...(deploymentSource !== undefined ? { deploymentSource } : {}),
+        ...(accessMode !== undefined ? { accessMode } : {}),
+        ...(orgMembershipSources !== undefined ? { orgMembershipSources } : {}),
+        ...(serverAuth !== undefined ? { serverAuth } : {}),
+        manifest,
+        ...(connectors !== undefined ? { connectors } : {}),
+        ...(hostedAssets !== undefined && hostedAssets.length > 0 ? { hostedAssets } : {}),
+        ...(appPackageSnapshot !== undefined ? { appPackageSnapshot } : {}),
+        secrets: emptySecretEnvelope(),
+    };
+    return record;
+}
 //# sourceMappingURL=registry-deploy-transaction.js.map

package/node_modules/@noodle-borg/service/dist/registry-rollback.js

@@ -1,3 +1,4 @@
+import { hasExactCustomerAuthProjection } from './customer-auth-audience-binding.js';
 import { withDeploymentConfiguration } from './registry-deploy-transaction.js';
 import { deploymentOwnerSubject, missingCapabilityErrors } from './registry-helpers.js';
 import { activateInMemory } from './registry-state.js';
@@ -52,9 +53,18 @@ export async function rollbackDeployment(state, ref, deploymentId, compilePersis
         };
     }
     const compiledAuth = built.served.artifact.server.auth;
+    if (target.serverAuth !== undefined && !hasExactCustomerAuthProjection(target, compiledAuth)) {
+        return {
+            ok: false,
+            status: 409,
+            error: 'deployment cannot be activated: server_auth_required',
+        };
+    }
     const projectedTarget = {
         ...target,
-        ...(target.accessMode === 'customers' && compiledAuth !== undefined
+        ...((target.accessMode === 'customers' ||
+            (target.schemaVersion === 2 && target.accessMode === 'mixed')) &&
+            compiledAuth !== undefined
             ? { serverAuth: compiledAuth }
             : {}),
     };
@@ -75,10 +85,14 @@ export async function rollbackDeployment(state, ref, deploymentId, compilePersis
     const activation = state.store
         ? await state.store.activateDeployment(ref, deploymentId, {
             expectedAccessMode: target.accessMode,
+            expectedSchemaVersion: target.schemaVersion,
+            expectedRevision: target,
             ...(compiledAuth !== undefined ? { serverAuth: compiledAuth } : {}),
         })
         : activateInMemory(state.records, ref, deploymentId, {
             expectedAccessMode: target.accessMode,
+            expectedSchemaVersion: target.schemaVersion,
+            expectedRevision: target,
             ...(compiledAuth !== undefined ? { serverAuth: compiledAuth } : {}),
         });
     if (activation === undefined) {

package/node_modules/@noodle-borg/service/dist/registry-state.d.ts

@@ -1,5 +1,5 @@
 import type { ServedTarget } from '@noodle-borg/transport-http';
-import type { AppArchiveResult, AppRestoreResult, AppSummary, ArtifactStore, CustomerAuthRestoreProjection, DeploymentLock, DeploymentLockUpdateResult, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from './store.js';
+import type { AppArchiveResult, AppRestoreResult, AppSummary, ArtifactStore, CustomerAuthRestoreProjection, DeploymentActivationPrecondition, DeploymentLock, DeploymentLockUpdateResult, DeploymentPolicyPrecondition, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from './store.js';
 export interface RegistryStateView {
     readonly store: ArtifactStore | undefined;
     readonly records: Map<string, DeployRecord>;
@@ -32,12 +32,9 @@ export declare function reconcilePlatformAccountResetRegistryCache(state: Regist
  * store owns deactivation; without one the caches are reconciled in-process so no instance serves a stale
  * active record.
  */
-export declare function persistDeployRecord(view: RegistryStateView, record: DeployRecord, tenant: TenantRef, activatesNow: boolean): Promise<DeployRecord>;
+export declare function persistDeployRecord(view: RegistryStateView, record: DeployRecord, tenant: TenantRef, activatesNow: boolean, precondition?: DeploymentPolicyPrecondition): Promise<DeployRecord>;
 /** No-store activation fallback (moved verbatim from `ServerRegistry.#activateInMemory`). */
-export declare function activateInMemory(records: Map<string, DeployRecord>, ref: TenantRef, deploymentId: string, precondition?: {
-    readonly expectedAccessMode: DeployRecord['accessMode'];
-    readonly serverAuth?: DeployRecord['serverAuth'];
-}): {
+export declare function activateInMemory(records: Map<string, DeployRecord>, ref: TenantRef, deploymentId: string, precondition?: DeploymentActivationPrecondition): {
     readonly active: DeployRecord;
     readonly previousActive?: DeployRecord;
     readonly alreadyActive: boolean;

package/node_modules/@noodle-borg/service/dist/registry-state.js

@@ -5,8 +5,10 @@
  * durable store first, then reconcile the in-process caches so no instance keeps serving stale state.
  */
 import { normalizeServerVersion } from '@noodle-borg/module';
-import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, CustomerAuthAudienceProjectionError, hasExactCustomerAuthProjection, } from './customer-auth-audience-binding.js';
+import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, CustomerAuthAudienceProjectionError, hasExactCustomerAuthProjection, requiresCustomerAuthProjection, } from './customer-auth-audience-binding.js';
+import { matchesDeploymentActivation } from './deployment-activation-precondition.js';
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from './deployment-lock.js';
+import { assertDeploymentAppendPolicy, assertDeploymentAppendVersion, } from './deployment-record-version.js';
 import { defaultActiveRecord } from './deployment-versioning.js';
 import { recordMatchesTenant, tenantDeploymentKey, tenantKey } from './registry-targets.js';
 import { appArchivedAt, deploymentSummary, paginateAppSummaries, planAppArchive, planAppRestore, planArchivedAppSweep, resolveProductionEnvironment, summarizeApps, summarizeEnvs, withoutArchiveStamp, } from './store/records.js';
@@ -26,14 +28,16 @@ export function reconcilePlatformAccountResetRegistryCache(state, input) {
  * store owns deactivation; without one the caches are reconciled in-process so no instance serves a stale
  * active record.
  */
-export async function persistDeployRecord(view, record, tenant, activatesNow) {
+export async function persistDeployRecord(view, record, tenant, activatesNow, precondition) {
     if (view.store) {
-        await view.store.append(record);
+        await view.store.append(record, precondition);
         const persisted = (await view.store.get(record.deploymentId)) ?? record;
         view.records.set(record.deploymentId, persisted);
         return persisted;
     }
     else {
+        assertDeploymentAppendVersion([...view.records.values()], record);
+        assertDeploymentAppendPolicy([...view.records.values()], record, precondition);
         if (!assertDeploymentAppendUnlocked([...view.records.values()], record)) {
             return view.records.get(record.deploymentId);
         }
@@ -66,18 +70,22 @@ export function activateInMemory(records, ref, deploymentId, precondition) {
     if (target === undefined || !recordMatchesTenant(target, ref))
         return undefined;
     assertDeploymentActivationUnlocked([...records.values()], target);
-    if (precondition !== undefined && target.accessMode !== precondition.expectedAccessMode) {
+    if (!matchesDeploymentActivation(target, precondition)) {
         return undefined;
     }
     const previousActive = [...records.values()]
         .filter((record) => record.active && recordMatchesTenant(record, ref))
         .filter((record) => record.serverVersion === target.serverVersion)
         .sort((a, b) => b.deploymentVersion - a.deploymentVersion)[0];
+    if (precondition === undefined && previousActive !== undefined) {
+        assertDeploymentAppendVersion([previousActive], { ...target, active: true });
+    }
     const alreadyActive = previousActive?.deploymentId === deploymentId;
     const activated = {
         ...target,
         active: true,
-        ...(target.accessMode === 'customers' && precondition?.serverAuth !== undefined
+        ...(requiresCustomerAuthProjection(target, precondition?.serverAuth) &&
+            precondition?.serverAuth !== undefined
             ? { serverAuth: precondition.serverAuth }
             : {}),
     };
@@ -207,7 +215,7 @@ export async function registryRestoreApp(state, org, app, compileRecord) {
         return undefined;
     const projections = [];
     for (const record of plan.clear) {
-        if (!record.active || record.accessMode !== 'customers')
+        if (!record.active || !requiresCustomerAuthProjection(record))
             continue;
         const built = await compileRecord(record);
         const compiledAuth = built.ok ? built.served.artifact.server.auth : undefined;
@@ -243,7 +251,7 @@ export async function registryCustomerAuthRestoreProjections(state, deploymentId
         : state.store.get(deploymentId)));
     const projections = [];
     for (const record of records) {
-        if (record === undefined || !record.active || record.accessMode !== 'customers')
+        if (record === undefined || !record.active || !requiresCustomerAuthProjection(record))
             continue;
         const built = await compileRecord(record);
         const compiledAuth = built.ok ? built.served.artifact.server.auth : undefined;

package/node_modules/@noodle-borg/service/dist/registry-status.js

@@ -1,13 +1,14 @@
 import { tenantMcpUrl } from '@noodle-borg/module';
+import { hasExactCustomerAuthProjection } from './customer-auth-audience-binding.js';
+import { deploymentAuthenticationFor } from './deployment-authentication.js';
 import { deploymentOwnerSubject, missingSecretNames } from './registry-helpers.js';
 /** Project one compiled deployment into the control-plane status contract. */
 export function deploymentStatusFor(ref, record, built, baseUrl, endpointOptions) {
     const missingSecrets = built.ok ? [] : missingSecretNames(built.errors);
-    const missingCustomerAuth = built.ok &&
-        record.accessMode === 'customers' &&
-        built.served.artifact.server.auth === undefined;
+    const missingCustomerAuth = built.ok && !hasExactCustomerAuthProjection(record, built.served.artifact.server.auth);
     const unhealthy = missingCustomerAuth || (!built.ok && missingSecrets.length === 0);
     const ownerSubject = deploymentOwnerSubject(record);
+    const authentication = deploymentAuthenticationFor(record, built.ok ? built.served.artifact.server.auth : undefined);
     return {
         target: ref,
         deployment: {
@@ -20,6 +21,7 @@ export function deploymentStatusFor(ref, record, built, baseUrl, endpointOptions
             ...(record.createdByEmail !== undefined ? { createdByEmail: record.createdByEmail } : {}),
             ...(ownerSubject !== undefined ? { ownerSubject } : {}),
             accessMode: record.accessMode ?? 'owner-only',
+            ...(authentication !== undefined ? { authentication } : {}),
             ...(record.deploymentLock !== undefined
                 ? {
                     deploymentLock: {