@noodleseed/one 0.165.0 → 0.167.0

package/node_modules/@noodle-borg/service/dist/registry-targets.js

@@ -1,9 +1,11 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { RECORD_CONNECTOR_ID } from '@noodle-borg/compiler';
 import { parseAppPackageSnapshot } from './app-package-snapshot.js';
-import { hasExactCustomerAuthProjection } from './customer-auth-audience-binding.js';
+import { hasExactCustomerAuthProjection, requiresCustomerAuthProjection, } from './customer-auth-audience-binding.js';
+import { deploymentRecordVersionError } from './deployment-record-version.js';
 import { deploymentOwnerSubject } from './registry-helpers.js';
 import { validateTenantRef } from './store.js';
+const targetPolicyVersions = new WeakMap();
 /** Replace only the platform record port; unrelated compiled runtime ports retain their authority. */
 export function rebindNativeRecords(target, record, factory) {
     const native = factory?.({
@@ -12,7 +14,7 @@ export function rebindNativeRecords(target, record, factory) {
         deploymentId: record.deploymentId,
     });
     const previous = target.served.deps.connectors;
-    return {
+    return rememberTargetPolicy(record, {
         ...target,
         served: {
             ...target.served,
@@ -27,19 +29,23 @@ export function rebindNativeRecords(target, record, factory) {
                 },
             },
         },
-    };
+    });
 }
 /**
  * Build the front-door {@link ServedTarget} for a persisted record: its access mode plus the credential the
  * front-door checks. Legacy alpha records without an identity access mode are not served.
  */
 export function servedTargetFor(record, served, customerVerifierFactory) {
+    const versionError = deploymentRecordVersionError(record);
+    if (versionError !== undefined)
+        throw new Error(versionError.code);
     const accessMode = record.accessMode;
     if (accessMode === undefined) {
         throw new Error(`deployment ${record.deploymentId} has unsupported legacy access mode`);
     }
-    const customerAuth = accessMode === 'customers' ? served.artifact.server.auth : undefined;
-    if (accessMode === 'customers' && customerAuth === undefined) {
+    const customerOwned = requiresCustomerAuthProjection(record, served.artifact.server.auth);
+    const customerAuth = customerOwned ? served.artifact.server.auth : undefined;
+    if (customerOwned && customerAuth === undefined) {
         throw new MissingCustomerAuthError(record.deploymentId);
     }
     if (!hasExactCustomerAuthProjection(record, customerAuth)) {
@@ -47,7 +53,7 @@ export function servedTargetFor(record, served, customerVerifierFactory) {
     }
     const boundServed = bindAppPackageSnapshot(served, record.appPackageSnapshot);
     const ownerSubject = deploymentOwnerSubject(record);
-    return {
+    return rememberTargetPolicy(record, {
         served: boundServed,
         deploymentId: record.deploymentId,
         accessMode,
@@ -58,10 +64,10 @@ export function servedTargetFor(record, served, customerVerifierFactory) {
             ? { orgMembershipSources: record.orgMembershipSources }
             : {}),
         ...(accessMode === 'owner-only' && ownerSubject !== undefined ? { ownerSubject } : {}),
-        ...(customerAuth !== undefined
+        authentication: customerAuth !== undefined
             ? customerTargetFields(customerAuth, customerVerifierFactory)
-            : {}),
-    };
+            : { kind: 'platform' },
+    });
 }
 class MissingCustomerAuthError extends Error {
     deploymentId;
@@ -86,6 +92,10 @@ function servedTargetMatchesRecord(target, record) {
     const expectedMembership = record.accessMode === 'org-members' ? record.orgMembershipSources : undefined;
     return (target.deploymentId === record.deploymentId &&
         target.accessMode === record.accessMode &&
+        target.authentication?.kind ===
+            (requiresCustomerAuthProjection(record, target.served.artifact.server.auth)
+                ? 'customer'
+                : 'platform') &&
         target.org === record.orgSlug &&
         target.app === record.appSlug &&
         target.environment === record.environment &&
@@ -101,7 +111,12 @@ function bindAppPackageSnapshot(served, value) {
 /** Reconcile one persisted record with its cached served target without trusting stale auth projections. */
 export async function targetForPersistedRecord(record, state) {
     const cached = state.servers.get(record.deploymentId);
+    const cachedSchemaVersion = cached === undefined ? undefined : targetPolicyVersions.get(cached);
     state.records.set(record.deploymentId, record);
+    if (deploymentRecordVersionError(record) !== undefined) {
+        state.servers.delete(record.deploymentId);
+        return undefined;
+    }
     if (cached === undefined)
         return state.load?.();
     if (!hasExactCustomerAuthProjection(record, cached.served.artifact.server.auth)) {
@@ -112,7 +127,7 @@ export async function targetForPersistedRecord(record, state) {
         (await state.hasCustomerAuthConflict(record, cached.served.artifact.server.auth))) {
         return undefined;
     }
-    if (servedTargetMatchesRecord(cached, record))
+    if (cachedSchemaVersion === record.schemaVersion && servedTargetMatchesRecord(cached, record))
         return cached;
     const reconciled = servedTargetFor(record, cached.served, state.customerVerifierFactory);
     state.servers.set(record.deploymentId, reconciled);
@@ -126,33 +141,29 @@ function sameStrings(left, right) {
             left.every((value, index) => value === right[index])));
 }
 function customerTargetFields(auth, customerVerifierFactory) {
-    if (auth.kind === 'bridge') {
-        return {
-            verifyToken: customerVerifierFactory?.(auth) ?? denyAllCustomerToken,
-        };
-    }
-    if (auth.kind === 'federatedOidc') {
-        const issuers = auth.issuers.map((issuer) => issuer.issuer);
-        return {
-            ...(issuers[0] === undefined ? {} : { authServerIssuer: issuers[0] }),
-            authServerIssuers: issuers,
-            verifyToken: customerVerifierFactory?.(auth) ?? denyAllCustomerToken,
-        };
-    }
     return {
-        authServerIssuer: auth.issuer,
-        verifyToken: customerVerifierFactory?.(auth) ?? denyAllCustomerToken,
+        kind: 'customer',
+        ...(auth.kind === 'bridge'
+            ? {}
+            : {
+                authorizationServers: auth.kind === 'federatedOidc'
+                    ? auth.issuers.map((issuer) => issuer.issuer)
+                    : [auth.issuer],
+            }),
+        ...(customerVerifierFactory === undefined
+            ? {}
+            : { verifyToken: customerVerifierFactory(auth) }),
     };
 }
-const denyAllCustomerToken = async () => null;
 export async function authorizationMetadataForTenant(registry, tenant) {
     const target = tenant.serverVersion === undefined
         ? await registry.getActiveByTenant(tenant)
         : await registry.getActiveByTenantVersion(tenant, tenant.serverVersion);
     if (target === undefined)
         return undefined;
-    const authorizationServers = target.authServerIssuers ??
-        (target.authServerIssuer === undefined ? undefined : [target.authServerIssuer]);
+    const authorizationServers = target.authentication?.kind === 'customer'
+        ? target.authentication.authorizationServers
+        : undefined;
     const requiredScopes = [
         ...new Set(target.served.artifact.tools.flatMap((tool) => tool.authorization?.requiredScopes ?? [])),
     ].sort();
@@ -212,4 +223,8 @@ export async function deploymentSourceFor(state, tenant, deploymentId) {
         ...(record.serverVersion === undefined ? {} : { serverVersion: record.serverVersion }),
     };
 }
+function rememberTargetPolicy(record, target) {
+    targetPolicyVersions.set(target, record.schemaVersion);
+    return target;
+}
 //# sourceMappingURL=registry-targets.js.map

package/node_modules/@noodle-borg/service/dist/registry-types.d.ts

@@ -4,7 +4,7 @@ import type { ControlPlaneIdentity } from '@noodle-borg/control-plane/portable';
 import type { OrgMembershipSource, PolicyGate } from '@noodle-borg/module';
 import type { Connector } from '@noodle-borg/runtime';
 import type { AccessMode, OwnerTokenVerifier } from '@noodle-borg/transport-http';
-import type { DeploymentSource } from '@noodle-borg/wire-contracts';
+import type { DeploymentAuthentication, DeploymentSource } from '@noodle-borg/wire-contracts';
 import type { AppPackageRenderer } from './app-package-snapshot.js';
 import type { DelegatedExchangeOptions } from './delegated-token-exchange.js';
 import type { ExternalCredentialExchangeRuntimeOptions } from './external-credential-exchange.js';
@@ -49,6 +49,7 @@ export type DeployResult = {
     readonly deploymentVersion: number;
     readonly serverVersion?: string;
     readonly accessMode?: AccessMode;
+    readonly authentication?: DeploymentAuthentication;
     readonly ownerSubject?: string;
     readonly replayed?: boolean;
 } | {
@@ -73,11 +74,12 @@ export type RunDeployResult = DeployResult | {
     readonly deploymentVersion: number;
     readonly serverVersion?: string;
 };
-export type AccessUpdateFailureCode = 'no_active_deployment' | 'server_auth_required' | 'customer_auth_audience_conflict' | 'public_user_context_conflict' | 'owner_identity_required' | 'access_update_conflict';
+export type AccessUpdateFailureCode = 'unsupported_deployment_record_version' | 'no_active_deployment' | 'server_auth_required' | 'customer_auth_audience_conflict' | 'public_user_context_conflict' | 'owner_identity_required' | 'access_update_conflict';
 export type AccessUpdateResult = {
     readonly ok: true;
     readonly changed: boolean;
     readonly accessChanged: boolean;
+    readonly policyChanged: boolean;
     readonly ownerChanged: boolean;
     readonly previousAccessMode: AccessMode;
     readonly previousOwnerSubject?: string;

package/node_modules/@noodle-borg/service/dist/registry.js

@@ -1,19 +1,19 @@
 import { KnowledgePublicationError, withKnowledgePublication, } from '@noodle-borg/knowledge-operations/portable';
 import { DeploymentActivationError, normalizeServerVersion, } from '@noodle-borg/module';
-import { normalizePersistedConnectorsForCompile } from './connector-normalize.js';
 import { CustomerAuthAudienceConflictError, customerAuthAudienceConflictFailure, hasActiveCustomerAuthAudienceConflict, } from './customer-auth-audience-binding.js';
 import { DeploymentLockedError, deploymentLockedConflict, deploymentLockedPreflight, } from './deployment-lock.js';
+import { DeploymentPolicyChangedError, UnsupportedDeploymentRecordVersionError, unsupportedDeploymentRecordFailure, } from './deployment-record-version.js';
 import { defaultActiveRecord } from './deployment-versioning.js';
 import { updateRegistryAccess } from './registry-access.js';
-import { compileRegistryTarget } from './registry-compile.js';
-import { preflightRegistryDeploy, resolveDeployAttempt, withDeploymentConfiguration, } from './registry-deploy-transaction.js';
-import { deploymentOwnerSubject, missingCapabilityErrors, } from './registry-helpers.js';
+import { compilePersistedRegistryRecord, compileRegistryTarget, loadPersistedRegistryTarget, } from './registry-compile.js';
+import { createRegistryDeployRecord, deployedRecordResult, deploymentWriteVersionError, preflightRegistryDeploy, replacementDeploymentPolicy, resolveDeployAttempt, withDeploymentConfiguration, } from './registry-deploy-transaction.js';
+import { deploymentOwnerSubject } from './registry-helpers.js';
 import { registryDeploymentPackage, renderDeploymentPackageSnapshot } from './registry-package.js';
 import { recoverRegistryRecords } from './registry-recover.js';
 import { rollbackDeployment, rollbackWithMappedErrors } from './registry-rollback.js';
 import { activeRecord, activeRecordVersion, persistDeployRecord, reconcilePlatformAccountResetRegistryCache, registryAppArchivedAt, registryArchiveApp, registryCustomerAuthRestoreProjections, registryGetApp, registryGetDeployment, registryGetEnvironment, registryListApps, registryListEnvironments, registryRestoreApp, registrySetProductionEnvironment, registrySweepArchived, setRegistryDeploymentLock, } from './registry-state.js';
 import { deploymentStatusFor } from './registry-status.js';
-import { deploymentSourceFor, emptySecretEnvelope, rebindNativeRecords, recordTenant, servedTargetFor, targetForPersistedRecord, tenantDeploymentKey, tenantKey, } from './registry-targets.js';
+import { deploymentSourceFor, rebindNativeRecords, servedTargetFor, targetForPersistedRecord, tenantDeploymentKey, tenantKey, } from './registry-targets.js';
 import { withBuiltinStateCatalog } from './state-catalog.js';
 import { deploymentSummary, matchesDeploymentFilter, validateDeploymentListFilter, } from './store/records.js';
 import { InMemoryConfigStore, validateTenantRef, } from './store.js';
@@ -109,8 +109,7 @@ export class ServerRegistry {
     }
     async deploy(tenant, manifest, options = {}) {
         return withDeploymentConfiguration(this.#configStore, tenant.org, async () => {
-            const { connectors, actor, accessMode, hostedAssets, serverVersion, deploymentSource, idempotencyKey, } = options;
-            const { orgMembershipSources } = options;
+            const { connectors, accessMode, hostedAssets, serverVersion, idempotencyKey } = options;
             const { automationId } = options;
             const safeTenant = validateTenantRef(tenant);
             const safeServerVersion = serverVersion !== undefined ? normalizeServerVersion(serverVersion) : undefined;
@@ -119,6 +118,9 @@ export class ServerRegistry {
                 if (active?.deploymentLock !== undefined)
                     return deploymentLockedConflict();
             }
+            const versionError = await deploymentWriteVersionError(this.#stateView(), safeTenant, safeServerVersion);
+            if (versionError !== undefined)
+                return { ok: false, errors: [versionError] };
             const preflight = await preflightRegistryDeploy({
                 options,
                 serviceCapabilities: this.#serviceCapabilities,
@@ -148,44 +150,43 @@ export class ServerRegistry {
             const version = Date.now();
             const built = preflight.bindDeployment(deploymentId);
             const serverAuth = built.artifact.server.auth;
-            const ownerSubject = accessMode === 'owner-only' ? (options.ownerSubject ?? actor?.subject) : undefined;
-            const record = {
-                schemaVersion: 1,
+            const policy = await replacementDeploymentPolicy(this.#stateView(), safeTenant, safeServerVersion, accessMode, serverAuth, (previous) => this.#compilePersistedRecord(previous));
+            if (policy.error !== undefined)
+                return { ok: false, errors: [policy.error] };
+            const record = createRegistryDeployRecord({
+                safeTenant,
+                safeServerVersion,
                 deploymentId,
-                orgSlug: safeTenant.org,
-                appSlug: safeTenant.app,
-                environment: safeTenant.env,
-                ...(safeServerVersion !== undefined ? { serverVersion: safeServerVersion } : {}),
-                deploymentVersion: version,
-                active: automationId === undefined,
-                serverName: built.artifact.server.name,
-                createdAt: new Date().toISOString(),
-                ...(actor ? { createdBySubject: actor.subject, createdByEmail: actor.email } : {}),
-                ...(ownerSubject !== undefined ? { ownerSubject } : {}),
-                ...(deploymentSource !== undefined ? { deploymentSource } : {}),
-                ...(accessMode !== undefined ? { accessMode } : {}),
-                ...(orgMembershipSources !== undefined ? { orgMembershipSources } : {}),
-                ...(serverAuth !== undefined ? { serverAuth } : {}),
+                version,
+                built,
                 manifest,
-                ...(connectors !== undefined ? { connectors } : {}),
-                ...(hostedAssets !== undefined && hostedAssets.length > 0 ? { hostedAssets } : {}),
-                ...(appPackageSnapshot !== undefined ? { appPackageSnapshot } : {}),
-                secrets: emptySecretEnvelope(),
-            };
+                options,
+                schemaVersion: policy.schemaVersion,
+                appPackageSnapshot,
+            });
             if (await this.#hasCustomerAuthAudienceConflict(record, serverAuth)) {
                 return customerAuthAudienceConflictFailure();
             }
             let active;
             try {
-                active = await withKnowledgePublication(this.#knowledgeHooks, safeTenant, deploymentId, built.artifact.server.knowledge, () => persistDeployRecord(this.#stateView(), record, safeTenant, automationId === undefined));
+                active = await withKnowledgePublication(this.#knowledgeHooks, safeTenant, deploymentId, built.artifact.server.knowledge, () => persistDeployRecord(this.#stateView(), record, safeTenant, automationId === undefined, {
+                    active: policy.previous ?? null,
+                }));
             }
             catch (error) {
+                if (error instanceof DeploymentPolicyChangedError)
+                    return {
+                        ok: false,
+                        errors: [{ code: error.code, path: 'accessMode', message: error.message }],
+                    };
                 if (error instanceof KnowledgePublicationError) {
                     return { ok: false, errors: error.errors };
                 }
                 if (error instanceof CustomerAuthAudienceConflictError) {
                     return customerAuthAudienceConflictFailure();
                 }
+                if (error instanceof UnsupportedDeploymentRecordVersionError)
+                    return unsupportedDeploymentRecordFailure();
                 if (error instanceof DeploymentLockedError)
                     return deploymentLockedConflict();
                 throw error;
@@ -193,7 +194,12 @@ export class ServerRegistry {
             if (automationId !== undefined) {
                 let activation;
                 try {
-                    activation = await this.#store?.activateDeployment(safeTenant, deploymentId, undefined, {
+                    activation = await this.#store?.activateDeployment(safeTenant, deploymentId, {
+                        expectedSchemaVersion: record.schemaVersion,
+                        expectedAccessMode: record.accessMode,
+                        expectedRevision: record,
+                        expectedActivePolicy: { active: policy.previous ?? null },
+                    }, {
                         automationId,
                     });
                 }
@@ -208,9 +214,16 @@ export class ServerRegistry {
                             ...(safeServerVersion !== undefined ? { serverVersion: safeServerVersion } : {}),
                         };
                     }
+                    if (error instanceof DeploymentPolicyChangedError)
+                        return {
+                            ok: false,
+                            errors: [{ code: error.code, path: 'accessMode', message: error.message }],
+                        };
                     if (error instanceof CustomerAuthAudienceConflictError) {
                         return customerAuthAudienceConflictFailure();
                     }
+                    if (error instanceof UnsupportedDeploymentRecordVersionError)
+                        return unsupportedDeploymentRecordFailure();
                     if (error instanceof DeploymentLockedError)
                         return deploymentLockedConflict();
                     throw error;
@@ -240,15 +253,7 @@ export class ServerRegistry {
             this.#servers.set(deploymentId, servedTargetFor(active, built, this.#customerVerifierFactory));
             this.#activeTenants.set(tenantDeploymentKey(safeTenant, safeServerVersion), deploymentId);
             this.#activeTenants.delete(tenantKey(safeTenant));
-            const activeOwnerSubject = deploymentOwnerSubject(active);
-            return {
-                ok: true,
-                deploymentId,
-                deploymentVersion: version,
-                ...(safeServerVersion !== undefined ? { serverVersion: safeServerVersion } : {}),
-                ...(accessMode !== undefined ? { accessMode } : {}),
-                ...(activeOwnerSubject !== undefined ? { ownerSubject: activeOwnerSubject } : {}),
-            };
+            return deployedRecordResult(active);
         });
     }
     /** Read-only deploy validation used by the CLI before config writes, asset upload, or persistence. */
@@ -262,12 +267,18 @@ export class ServerRegistry {
             if (active?.deploymentLock !== undefined)
                 return deploymentLockedPreflight();
         }
+        const versionError = await deploymentWriteVersionError(this.#stateView(), safeTenant, safeServerVersion);
+        if (versionError !== undefined)
+            return { ok: false, errors: [versionError] };
         const result = await preflightRegistryDeploy({
             options,
             serviceCapabilities: this.#serviceCapabilities,
             compile: () => this.#compileTarget(safeTenant, manifest, options.connectors, options.hostedAssets, true),
         });
-        return result.ok ? { ok: true } : result;
+        if (!result.ok)
+            return result;
+        const policy = await replacementDeploymentPolicy(this.#stateView(), safeTenant, safeServerVersion, options.accessMode, result.bindDeployment('preflight').artifact.server.auth, (previous) => this.#compilePersistedRecord(previous));
+        return policy.error === undefined ? { ok: true } : { ok: false, errors: [policy.error] };
     }
     async recover() {
         if (!this.#store)
@@ -305,16 +316,20 @@ export class ServerRegistry {
         }, { tenant, manifest, connectors, hostedAssets, deploymentId, renderAppPackage });
     }
     #compilePersistedRecord(record) {
-        return this.#compileTarget(recordTenant(record), record.manifest, record.connectors === undefined
-            ? undefined
-            : normalizePersistedConnectorsForCompile(record.connectors), record.hostedAssets, false, record.deploymentId);
+        return compilePersistedRegistryRecord(record, this.#compileTarget.bind(this));
     }
     async get(deploymentId) {
         if (this.#records.get(deploymentId)?.archivedAt !== undefined)
             return undefined;
         const cached = this.#servers.get(deploymentId);
-        if (cached)
-            return cached;
+        if (cached) {
+            const record = this.#store
+                ? await this.#store.get(deploymentId)
+                : this.#records.get(deploymentId);
+            return record === undefined || record.archivedAt !== undefined
+                ? undefined
+                : this.#targetForPersistedRecord(record);
+        }
         const inflight = this.#inflight.get(deploymentId);
         if (inflight)
             return inflight;
@@ -495,32 +510,13 @@ export class ServerRegistry {
         });
     }
     async #loadAndCompile(source) {
-        const record = typeof source === 'string'
-            ? this.#store
-                ? await this.#store.get(source)
-                : this.#records.get(source)
-            : source;
-        if (!record)
-            return undefined;
-        const deploymentId = record.deploymentId;
-        if (record.archivedAt !== undefined)
-            return undefined;
-        const built = await this.#compilePersistedRecord(record);
-        if (!built.ok) {
-            throw new Error(`deployment ${deploymentId} failed to recompile (${built.errors.map((e) => e.code).join(',')})`);
-        }
-        const missingCapabilities = missingCapabilityErrors(built.served.artifact.requirements?.capabilities ?? [], this.#serviceCapabilities);
-        if (missingCapabilities.length > 0) {
-            throw new Error(`deployment ${deploymentId} failed capability requirements (${missingCapabilities.map((e) => e.path).join(',')})`);
-        }
-        if (record.active &&
-            (await this.#hasCustomerAuthAudienceConflict(record, built.served.artifact.server.auth))) {
-            return undefined;
-        }
-        const target = servedTargetFor(record, built.served, this.#customerVerifierFactory);
-        this.#servers.set(deploymentId, target);
-        this.#records.set(deploymentId, record);
-        return target;
+        return loadPersistedRegistryTarget(source, {
+            state: this.#stateView(),
+            compile: (record) => this.#compilePersistedRecord(record),
+            capabilities: this.#serviceCapabilities,
+            customerVerifierFactory: this.#customerVerifierFactory,
+            hasCustomerAuthConflict: (record, auth) => this.#hasCustomerAuthAudienceConflict(record, auth),
+        });
     }
     async #hasCustomerAuthAudienceConflict(record, auth) {
         return hasActiveCustomerAuthAudienceConflict(this.#store, this.#records, record, auth);

package/node_modules/@noodle-borg/service/dist/routes/access.js

@@ -1,6 +1,7 @@
 import { normalizeServerVersion } from '@noodle-borg/module';
 import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
 import { accessUpdateRequestSchema } from '@noodle-borg/wire-contracts';
+import { deploymentAuthenticationFor } from '../deployment-authentication.js';
 import { deploymentOwnerSubject } from '../registry-helpers.js';
 import { authorizeControlPlane } from './control-plane.js';
 import { canManageMembers } from './org-admin.js';
@@ -44,6 +45,7 @@ export async function handleAccessUpdate(req, res, registry, gate, controlPlane,
     }
     const accessMode = result.record.accessMode ?? 'owner-only';
     const ownerSubject = deploymentOwnerSubject(result.record);
+    const authentication = deploymentAuthenticationFor(result.record);
     await audit.emit({
         eventType: 'deployment.access.updated',
         org: tenant.org,
@@ -63,6 +65,9 @@ export async function handleAccessUpdate(req, res, registry, gate, controlPlane,
             ...(ownerSubject !== undefined ? { ownerSubject } : {}),
             accessChanged: result.accessChanged,
             ownerChanged: result.ownerChanged,
+            ...(authentication !== undefined
+                ? { authentication, policyChanged: result.policyChanged }
+                : {}),
             changed: result.changed,
         },
     });
@@ -75,6 +80,7 @@ export async function handleAccessUpdate(req, res, registry, gate, controlPlane,
                 ? { serverVersion: result.record.serverVersion }
                 : {}),
             accessMode,
+            ...(authentication !== undefined ? { authentication } : {}),
             ...(ownerSubject !== undefined ? { ownerSubject } : {}),
         },
         previousAccessMode: result.previousAccessMode,
@@ -83,6 +89,7 @@ export async function handleAccessUpdate(req, res, registry, gate, controlPlane,
             : {}),
         accessChanged: result.accessChanged,
         ownerChanged: result.ownerChanged,
+        ...(authentication !== undefined ? { policyChanged: result.policyChanged } : {}),
         changed: result.changed,
     });
 }

package/node_modules/@noodle-borg/service/dist/routes/auth-doctor-live.js

@@ -19,7 +19,8 @@ export async function handleLiveAuthDoctor(req, res, registry, tenant, options)
         : await registry.getActiveByTenantVersion(tenant, serverVersion);
     if (target === undefined)
         return sendJson(res, 404, { ok: false, error: 'deployment not found' });
-    if (target.accessMode !== 'customers' || target.verifyToken === undefined) {
+    if (target.authentication?.kind !== 'customer' ||
+        target.authentication.verifyToken === undefined) {
         return sendJson(res, 409, {
             ok: false,
             error: 'live auth doctor requires a customers deployment with customer auth',
@@ -30,7 +31,7 @@ export async function handleLiveAuthDoctor(req, res, registry, tenant, options)
         return sendJson(res, 401, { ok: false, error: 'missing customer bearer token' });
     const endpointOptions = await options.resolveEndpointOptions?.(tenant.org);
     const resource = tenantMcpUrl(options.serviceBase, tenant, serverVersion, endpointOptions);
-    const verification = await target.verifyToken(token, resource).catch(() => null);
+    const verification = await target.authentication.verifyToken(token, resource).catch(() => null);
     if (verification === null || verification.caller.identityKind !== 'customer') {
         return sendJson(res, 401, { ok: false, error: 'customer token verification failed' });
     }

package/node_modules/@noodle-borg/service/dist/routes/control-plane.js

@@ -195,6 +195,7 @@ export async function handleDeploy(req, res, registry, options, maxBody, tenant,
         deploymentId: result.deploymentId,
         serverVersion: result.serverVersion,
         accessMode: result.accessMode,
+        ...(result.authentication !== undefined ? { authentication: result.authentication } : {}),
         ...(result.ownerSubject !== undefined ? { ownerSubject: result.ownerSubject } : {}),
         url: tenantMcpUrl(base, tenant, result.serverVersion, endpointOptions),
         defaultUrl: tenantMcpUrl(base, tenant, undefined, endpointOptions),

package/node_modules/@noodle-borg/service/dist/routes/deploy-preflight.js

@@ -2,8 +2,8 @@ import { randomUUID } from 'node:crypto';
 import { cspFaultsInManifest } from '@noodle-borg/compiler';
 import { readDeployBody, sendJson } from '@noodle-borg/transport-http';
 import { DEPLOY_PREFLIGHT_CHECK_TIMEOUT_MS, deployPreflightRequestSchema, formatWireError, } from '@noodle-borg/wire-contracts';
+import { isIdentityAccessMode } from '../deployment-access-mode.js';
 import { manifestUsesUserRoot } from '../registry-access.js';
-import { isIdentityAccessMode } from './access-mode.js';
 import { authorizeDeploymentOwnerSelection, authorizeTenantControl, developerGrantRouteAccess, } from './control-plane.js';
 // Per-process resource admission, not a tenant quota or distributed state authority.
 const activePreflights = new WeakSet();
@@ -91,7 +91,7 @@ export async function handleDeployPreflight(req, res, registry, options, maxBody
             });
         }
         const accessMode = parsed.accessMode ?? 'owner-only';
-        if (isIdentityAccessMode(accessMode) && identity === undefined) {
+        if (isIdentityAccessMode(accessMode, parsed.manifest) && identity === undefined) {
             return sendJson(res, 401, {
                 code: 'deployer_identity_required',
                 error: `${accessMode} deployments require an authenticated deployer`,

package/node_modules/@noodle-borg/service/dist/serve-resource-auth.js

@@ -44,7 +44,7 @@ export async function bridgeAuthForResource(registry, resource, allowedBaseDomai
         ? await registry.getActiveByTenant(tenant)
         : await registry.getActiveByTenantVersion(tenant, tenant.serverVersion);
     const auth = target?.served.artifact.server.auth;
-    if (auth?.kind !== 'bridge')
+    if (target?.authentication?.kind !== 'customer' || auth?.kind !== 'bridge')
         return undefined;
     const variables = await registry.configStore.resolveConfigValues('variable', resolveConfigScope(tenant));
     return resolveTenantBridgeAuthVariables(auth, variables);

package/node_modules/@noodle-borg/service/dist/store/in-memory.d.ts

@@ -1,19 +1,15 @@
-import type { AccessMode } from '@noodle-borg/transport-http';
-import type { ActiveAccessUpdateInput, AppArchiveResult, AppRestorePrecondition, AppRestoreResult, AppSummary, ArtifactStore, DeploymentActivationResult, DeploymentListFilter, DeploymentLock, DeploymentLockUpdateResult, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from '../store.js';
+import type { ActiveAccessUpdateInput, AppArchiveResult, AppRestorePrecondition, AppRestoreResult, AppSummary, ArtifactStore, DeploymentActivationPrecondition, DeploymentActivationResult, DeploymentListFilter, DeploymentLock, DeploymentLockUpdateResult, DeploymentPolicyPrecondition, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from '../store.js';
 /** In-memory store: keeps records in a Map. Used by tests and as an explicit, non-persistent option. */
 export declare class InMemoryArtifactStore implements ArtifactStore {
     #private;
-    append(record: DeployRecord): Promise<void>;
+    append(record: DeployRecord, precondition?: DeploymentPolicyPrecondition): Promise<void>;
     loadAll(): Promise<readonly DeployRecord[]>;
     get(deploymentId: string): Promise<DeployRecord | undefined>;
     getActiveByTenant(ref: TenantRef): Promise<DeployRecord | undefined>;
     getActiveByTenantVersion(ref: TenantRef, serverVersion: string): Promise<DeployRecord | undefined>;
     setDeploymentLock(ref: TenantRef, serverVersion: string, expectedDeploymentId: string, deploymentLock: DeploymentLock | undefined): Promise<DeploymentLockUpdateResult>;
     findActiveCustomerAuthAudienceConflict(ref: TenantRef, auth: TenantAuthConfig): Promise<TenantRef | undefined>;
-    activateDeployment(ref: TenantRef, deploymentId: string, precondition?: {
-        readonly expectedAccessMode: AccessMode | undefined;
-        readonly serverAuth?: TenantAuthConfig;
-    }, _options?: {
+    activateDeployment(ref: TenantRef, deploymentId: string, precondition?: DeploymentActivationPrecondition, _options?: {
         readonly automationId?: string;
     }): Promise<DeploymentActivationResult | undefined>;
     updateActiveAccess(ref: TenantRef, deploymentId: string, input: ActiveAccessUpdateInput): Promise<DeployRecord | undefined>;

package/node_modules/@noodle-borg/service/dist/store/in-memory.js

@@ -1,7 +1,9 @@
 import { normalizeServerVersion } from '@noodle-borg/module';
 import { assertSameAppPackageSnapshot, sanitizeDeployRecordAppPackageSnapshot, } from '../app-package-snapshot.js';
-import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, } from '../customer-auth-audience-binding.js';
+import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, requiresCustomerAuthProjection, } from '../customer-auth-audience-binding.js';
+import { matchesDeploymentActivation } from '../deployment-activation-precondition.js';
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from '../deployment-lock.js';
+import { assertDeploymentAppendPolicy, assertDeploymentAppendVersion, } from '../deployment-record-version.js';
 import { defaultActiveRecord, sameDeploymentScope, sameTenantRecord, } from '../deployment-versioning.js';
 import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, planArchivedAppSweep, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
 import { validateSlug, validateTenantRef } from './validate.js';
@@ -9,7 +11,9 @@ import { validateSlug, validateTenantRef } from './validate.js';
 export class InMemoryArtifactStore {
     #records = new Map();
     #productionEnvironments = new Map();
-    async append(record) {
+    async append(record, precondition) {
+        assertDeploymentAppendVersion([...this.#records.values()], record);
+        assertDeploymentAppendPolicy([...this.#records.values()], record, precondition);
         const existing = this.#records.get(record.deploymentId);
         if (existing !== undefined)
             assertSameAppPackageSnapshot(existing, record);
@@ -83,17 +87,22 @@ export class InMemoryArtifactStore {
         if (target === undefined || !sameTenantRecord(target, safe))
             return Promise.resolve(undefined);
         assertDeploymentActivationUnlocked([...this.#records.values()], target);
-        if (precondition !== undefined && target.accessMode !== precondition.expectedAccessMode) {
+        if (!matchesDeploymentActivation(target, precondition)) {
             return Promise.resolve(undefined);
         }
         const previousActive = [...this.#records.values()]
             .filter((record) => record.active && sameDeploymentScope(record, target))
             .sort((a, b) => b.deploymentVersion - a.deploymentVersion)[0];
+        if (precondition === undefined && previousActive !== undefined) {
+            assertDeploymentAppendVersion([previousActive], { ...target, active: true });
+        }
+        assertDeploymentAppendPolicy([...this.#records.values()], { ...target, active: true }, precondition?.expectedActivePolicy);
         const alreadyActive = previousActive?.deploymentId === target.deploymentId;
         const activated = {
             ...target,
             active: true,
-            ...(target.accessMode === 'customers' && precondition?.serverAuth !== undefined
+            ...(requiresCustomerAuthProjection(target, precondition?.serverAuth) &&
+                precondition?.serverAuth !== undefined
                 ? { serverAuth: precondition.serverAuth }
                 : {}),
         };

package/node_modules/@noodle-borg/service/dist/store/json-file.d.ts

@@ -1,5 +1,4 @@
-import type { AccessMode } from '@noodle-borg/transport-http';
-import type { ActiveAccessUpdateInput, AppArchiveResult, AppRestorePrecondition, AppRestoreResult, AppSummary, ArtifactStore, DeploymentActivationResult, DeploymentListFilter, DeploymentLock, DeploymentLockUpdateResult, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from '../store.js';
+import type { ActiveAccessUpdateInput, AppArchiveResult, AppRestorePrecondition, AppRestoreResult, AppSummary, ArtifactStore, DeploymentActivationPrecondition, DeploymentActivationResult, DeploymentListFilter, DeploymentLock, DeploymentLockUpdateResult, DeploymentPolicyPrecondition, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from '../store.js';
 /**
  * JSON-file store: one file per deployment at `<dataDir>/deployments/<deploymentId>.json`, written atomically
  * (write a temp file, then `rename` over the target — no partial file is ever read). `deploymentId` is a
@@ -9,17 +8,14 @@ import type { ActiveAccessUpdateInput, AppArchiveResult, AppRestorePrecondition,
 export declare class JsonFileArtifactStore implements ArtifactStore {
     #private;
     constructor(dataDir: string);
-    append(record: DeployRecord): Promise<void>;
+    append(record: DeployRecord, precondition?: DeploymentPolicyPrecondition): Promise<void>;
     get(deploymentId: string): Promise<DeployRecord | undefined>;
     getActiveByTenant(ref: TenantRef): Promise<DeployRecord | undefined>;
     getActiveByTenantVersion(ref: TenantRef, serverVersion: string): Promise<DeployRecord | undefined>;
     setDeploymentLock(ref: TenantRef, serverVersion: string, expectedDeploymentId: string, deploymentLock: DeploymentLock | undefined): Promise<DeploymentLockUpdateResult>;
     findActiveCustomerAuthAudienceConflict(ref: TenantRef, auth: TenantAuthConfig): Promise<TenantRef | undefined>;
     updateActiveAccess(ref: TenantRef, deploymentId: string, input: ActiveAccessUpdateInput): Promise<DeployRecord | undefined>;
-    activateDeployment(ref: TenantRef, deploymentId: string, precondition?: {
-        readonly expectedAccessMode: AccessMode | undefined;
-        readonly serverAuth?: TenantAuthConfig;
-    }): Promise<DeploymentActivationResult | undefined>;
+    activateDeployment(ref: TenantRef, deploymentId: string, precondition?: DeploymentActivationPrecondition): Promise<DeploymentActivationResult | undefined>;
     loadAll(): Promise<readonly DeployRecord[]>;
     listDeployments(filter: DeploymentListFilter): Promise<readonly DeploymentSummary[]>;
     getAppArchivedAt(org: string, app: string): Promise<string | undefined>;