@noodleseed/one 0.165.0 → 0.167.0

package/node_modules/@noodle-borg/service/dist/store/json-file.js

@@ -3,8 +3,10 @@ import { mkdir, readdir, readFile, rename, rm, writeFile } from 'node:fs/promise
 import { join } from 'node:path';
 import { normalizeServerVersion } from '@noodle-borg/module';
 import { assertSameAppPackageSnapshot, sanitizeDeployRecordAppPackageSnapshot, } from '../app-package-snapshot.js';
-import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, } from '../customer-auth-audience-binding.js';
+import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, requiresCustomerAuthProjection, } from '../customer-auth-audience-binding.js';
+import { matchesDeploymentActivation } from '../deployment-activation-precondition.js';
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from '../deployment-lock.js';
+import { assertDeploymentAppendPolicy, assertDeploymentAppendVersion, } from '../deployment-record-version.js';
 import { defaultActiveRecord, sameDeploymentScope, sameTenantRecord, } from '../deployment-versioning.js';
 import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, planArchivedAppSweep, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
 import { DEPLOYMENT_ID_PATTERN, validateSlug, validateTenantRef } from './validate.js';
@@ -22,10 +24,10 @@ export class JsonFileArtifactStore {
         this.#dir = join(dataDir, 'deployments');
         this.#environmentMetadataDir = join(dataDir, 'environment-metadata');
     }
-    append(record) {
-        return this.#serializeLifecycle(() => this.#appendUnlocked(record));
+    append(record, precondition) {
+        return this.#serializeLifecycle(() => this.#appendUnlocked(record, precondition));
     }
-    async #appendUnlocked(record) {
+    async #appendUnlocked(record, precondition) {
         // Defence in depth: `deploymentId` becomes a filename, so reject anything outside the minted shape
         // (`mintDeploymentId` only ever produces `[a-z0-9-]`). Guards this public class against a caller that
         // passes an untrusted id (no path traversal, no escaping the data dir).
@@ -34,6 +36,8 @@ export class JsonFileArtifactStore {
             throw new Error(`invalid deploymentId for persistence: "${record.deploymentId}"`);
         }
         const records = await this.loadAll();
+        assertDeploymentAppendVersion(records, record);
+        assertDeploymentAppendPolicy(records, record, precondition);
         const existing = records.find((candidate) => candidate.deploymentId === record.deploymentId);
         if (existing !== undefined)
             assertSameAppPackageSnapshot(existing, record);
@@ -127,7 +131,7 @@ export class JsonFileArtifactStore {
             const target = await this.get(deploymentId);
             if (target === undefined || !sameTenantRecord(target, safe))
                 return undefined;
-            if (precondition !== undefined && target.accessMode !== precondition.expectedAccessMode) {
+            if (!matchesDeploymentActivation(target, precondition)) {
                 return undefined;
             }
             const records = await this.loadAll();
@@ -135,11 +139,16 @@ export class JsonFileArtifactStore {
             const previousActive = records
                 .filter((record) => record.active && sameDeploymentScope(record, target))
                 .sort((a, b) => b.deploymentVersion - a.deploymentVersion)[0];
+            if (precondition === undefined && previousActive !== undefined) {
+                assertDeploymentAppendVersion([previousActive], { ...target, active: true });
+            }
+            assertDeploymentAppendPolicy(records, { ...target, active: true }, precondition?.expectedActivePolicy);
             const alreadyActive = previousActive?.deploymentId === target.deploymentId;
             const activated = {
                 ...target,
                 active: true,
-                ...(target.accessMode === 'customers' && precondition?.serverAuth !== undefined
+                ...(requiresCustomerAuthProjection(target, precondition?.serverAuth) &&
+                    precondition?.serverAuth !== undefined
                     ? { serverAuth: precondition.serverAuth }
                     : {}),
             };

package/node_modules/@noodle-borg/service/dist/store/records.js

@@ -5,6 +5,7 @@
  * own persistence and feed their own raw records/anchors through these pure functions so every
  * backend groups, ranks, and sorts identically.
  */
+import { requiresCustomerAuthProjection } from '../customer-auth-audience-binding.js';
 import { sameTenantRecord } from '../deployment-versioning.js';
 import { deploymentOwnerSubject } from '../registry-helpers.js';
 import { validateSlug } from './validate.js';
@@ -139,17 +140,29 @@ export function resolveActiveAccessUpdate(record, ref, input) {
         record.archivedAt !== undefined ||
         !sameTenantRecord(record, ref) ||
         record.accessMode !== input.expectedAccessMode ||
+        record.schemaVersion !== (input.expectedSchemaVersion ?? 1) ||
+        (input.expectedManifest !== undefined && record.manifest !== input.expectedManifest) ||
         deploymentOwnerSubject(record) !== input.expectedOwnerSubject)
         return undefined;
     if ((record.accessMode ?? 'owner-only') === input.accessMode &&
+        (input.schemaVersion === undefined || record.schemaVersion === input.schemaVersion) &&
         (input.ownerSubject === undefined || deploymentOwnerSubject(record) === input.ownerSubject) &&
-        input.accessMode !== 'customers')
+        !requiresCustomerAuthProjection({
+            ...record,
+            accessMode: input.accessMode,
+            schemaVersion: input.schemaVersion ?? record.schemaVersion,
+        }, input.serverAuth))
         return record;
     return {
         ...record,
         accessMode: input.accessMode,
+        schemaVersion: input.schemaVersion ?? record.schemaVersion,
         ...(input.ownerSubject !== undefined ? { ownerSubject: input.ownerSubject } : {}),
-        ...(input.accessMode === 'customers' && input.serverAuth !== undefined
+        ...(requiresCustomerAuthProjection({
+            ...record,
+            accessMode: input.accessMode,
+            schemaVersion: input.schemaVersion ?? record.schemaVersion,
+        }, input.serverAuth) && input.serverAuth !== undefined
             ? { serverAuth: input.serverAuth }
             : {}),
     };

package/node_modules/@noodle-borg/service/dist/store.d.ts

@@ -3,7 +3,7 @@ import type { OrganizationStore } from '@noodle-borg/control-plane/portable';
 import type { OrgMembershipSource } from '@noodle-borg/module';
 import type { SealedSecret } from '@noodle-borg/runtime';
 import type { AccessMode } from '@noodle-borg/transport-http';
-import type { DeploymentSource } from '@noodle-borg/wire-contracts';
+import type { DeploymentAuthentication, DeploymentSource } from '@noodle-borg/wire-contracts';
 import type { AppPackageSnapshotV1 } from './app-package-snapshot.js';
 import type { ProductionEnvironmentChange } from './store/environment-production.js';
 export type { ActiveMcpSubdomainClaim, ChangeMcpSubdomainInput, CreateOrgWithOwnerInput, McpSubdomainMutationResult, McpSubdomainSetting, OrgDomainRecord, OrgInvitationRecord, OrgMemberRecord, OrgOpenAIAppsChallengeRecord, OrgRecord, OrgRole, PersonalWorkspaceProvisionInput, PersonalWorkspaceProvisionResult, SignupAllowlistKind, SignupAllowlistRecord, WelcomeEmailRecord, } from '@noodle-borg/control-plane/portable';
@@ -33,7 +33,7 @@ export type SecretEnvelope = {
  * of the source strings, so the inputs + identity are a faithful, reproducible record.
  */
 export interface DeployRecord {
-    /** Record format version, for forward migration of the persisted shape. Current writers emit `1`. */
+    /** Record format version; customer mixed adoption writes 2, which remains sticky on new records. */
     readonly schemaVersion: number;
     readonly deploymentId: string;
     readonly orgSlug: string;
@@ -241,6 +241,7 @@ export interface DeploymentStatus {
         readonly createdByEmail?: string;
         readonly ownerSubject?: string;
         readonly accessMode: AccessMode;
+        readonly authentication?: DeploymentAuthentication;
         readonly deploymentLock?: DeploymentLockMetadata;
     };
     readonly health: {
@@ -257,11 +258,29 @@ export interface DeploymentActivationResult {
     readonly alreadyActive: boolean;
 }
 /** One atomic access/owner compare-and-set over the active deployment's observed state. */
+export interface DeploymentPolicyPrecondition {
+    readonly active: Pick<DeployRecord, 'deploymentId' | 'schemaVersion' | 'accessMode' | 'ownerSubject' | 'manifest' | 'serverAuth'> | null;
+}
+/** The source and authority validated before atomically activating this exact target revision. */
+export interface DeploymentActivationPrecondition {
+    readonly expectedAccessMode: AccessMode | undefined;
+    /** Older callers are restricted to schema-1 targets. */
+    readonly expectedSchemaVersion?: number;
+    readonly expectedRevision?: Pick<DeployRecord, 'manifest' | 'connectors' | 'hostedAssets' | 'serverAuth' | 'serverVersion' | 'ownerSubject' | 'createdBySubject' | 'orgMembershipSources' | 'archivedAt'>;
+    readonly expectedActivePolicy?: DeploymentPolicyPrecondition;
+    /** Compiler-authoritative projection, applied only after revision validation. */
+    readonly serverAuth?: TenantAuthConfig;
+}
 export interface ActiveAccessUpdateInput {
+    /** Internal policy adoption; callers cannot author a deployment schema version. */
+    readonly schemaVersion?: 2;
     readonly accessMode: AccessMode;
     /** Desired owner mutation. Omission preserves the current effective owner; clearing is unsupported. */
     readonly ownerSubject?: string;
     readonly expectedAccessMode: AccessMode | undefined;
+    /** Older callers omit this and are restricted to version-1 records. */
+    readonly expectedSchemaVersion?: number;
+    readonly expectedManifest?: string;
     readonly expectedOwnerSubject: string | undefined;
     /** Compiler-authoritative projection persisted atomically when enabling customer access. */
     readonly serverAuth?: TenantAuthConfig;
@@ -283,7 +302,7 @@ export interface ControlPlaneStore extends OrganizationStore {
  * an earlier deployment without changing the tenant-facing URL.
  */
 export interface ArtifactStore {
-    append(record: DeployRecord): Promise<void>;
+    append(record: DeployRecord, precondition?: DeploymentPolicyPrecondition): Promise<void>;
     loadAll(): Promise<readonly DeployRecord[]>;
     /**
      * Fetch one server's record by id, or `undefined` if absent. A point read used by lazy
@@ -301,11 +320,7 @@ export interface ArtifactStore {
      * bindings. Implementations may optimize this security lookup; registries fall back to `loadAll`.
      */
     findActiveCustomerAuthAudienceConflict?(ref: TenantRef, auth: TenantAuthConfig): Promise<TenantRef | undefined>;
-    activateDeployment(ref: TenantRef, deploymentId: string, precondition?: {
-        readonly expectedAccessMode: AccessMode | undefined;
-        /** Compiler-authoritative projection persisted atomically when activating customer access. */
-        readonly serverAuth?: TenantAuthConfig;
-    }, options?: {
+    activateDeployment(ref: TenantRef, deploymentId: string, precondition?: DeploymentActivationPrecondition, options?: {
         readonly automationId?: string;
     }): Promise<DeploymentActivationResult | undefined>;
     /**

package/node_modules/@noodle-borg/service/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.101.0",
+    "@noodle-borg/agent-kit": "0.102.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/node_modules/@noodle-borg/transport-http/dist/handler.d.ts

@@ -5,6 +5,7 @@ import { type TlsPosture } from './front-door.js';
 import { type Logger } from './logging.js';
 import { type PublicTenantRouting } from './routing.js';
 import type { HostedToolAuthorizationObserver } from './service-principal-authorization.js';
+import { type TargetAuthentication } from './target-authentication.js';
 import type { HostedToolDispatchHook } from './tool-dispatch.js';
 export type { AccessMode, AdmissionCategory, AdmissionContext, AdmissionDecision, AdmissionGate, DataPlaneAuthorizationResult, DataPlaneIdentityAuthorizer, OwnerTokenVerifier, TenantRouteRef, } from '@noodle-borg/module';
 export type { PublicTenantRouting } from './routing.js';
@@ -78,9 +79,7 @@ export interface ServedTarget {
     readonly app?: string;
     readonly environment?: string;
     readonly orgMembershipSources?: readonly OrgMembershipSource[];
-    readonly verifyToken?: OwnerTokenVerifier;
-    readonly authServerIssuer?: string;
-    readonly authServerIssuers?: readonly string[];
+    readonly authentication?: TargetAuthentication;
     readonly intentCaptureMode?: IntentCaptureMode;
 }
 export type ServerLookup = (deploymentId: string) => Promise<ServedTarget | undefined>;

package/node_modules/@noodle-borg/transport-http/dist/handler.js

@@ -4,6 +4,7 @@ import { noopLogger } from './logging.js';
 import { guard, logRequest, rpcError, sendJson } from './responses.js';
 import { resolveRoute } from './routing.js';
 import { serveRequest } from './serve-request.js';
+import { resolveTargetAuthentication } from './target-authentication.js';
 const DEFAULT_ENDPOINT = '/mcp';
 const DEFAULT_MAX_BODY = 1 << 20;
 /** Build the single-artifact raw-Node security front door. */
@@ -33,7 +34,7 @@ export function createMcpHttpHandler(target, options = {}) {
             app: undefined,
             environment: undefined,
             orgMembershipSources: undefined,
-            verifyOwnerToken: options.verifyOwnerToken,
+            authentication: resolveTargetAuthentication({}, options.verifyOwnerToken),
             authorizeDataPlaneIdentity: options.authorizeDataPlaneIdentity,
             admissionGate: options.admissionGate,
             captureRequestEvent: options.captureRequestEvent,
@@ -101,9 +102,7 @@ export function createMcpRouter(lookup, options = {}) {
                 ownerSubject: resolvedTarget.ownerSubject,
                 org: resolvedTarget.org,
                 orgMembershipSources: resolvedTarget.orgMembershipSources,
-                verifyOwnerToken: resolvedTarget.accessMode === 'customers'
-                    ? resolvedTarget.verifyToken
-                    : (resolvedTarget.verifyToken ?? options.verifyOwnerToken),
+                authentication: resolveTargetAuthentication(resolvedTarget, options.verifyOwnerToken),
                 authorizeDataPlaneIdentity: options.authorizeDataPlaneIdentity,
                 admissionGate: options.admissionGate,
                 captureRequestEvent: options.captureRequestEvent,

package/node_modules/@noodle-borg/transport-http/dist/identity-authorization.d.ts

@@ -1,12 +1,13 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import type { AccessMode, DataPlaneIdentityAuthorizer, OrgMembershipSource, OwnerTokenVerifier } from '@noodle-borg/module';
+import type { AccessMode, DataPlaneIdentityAuthorizer, OrgMembershipSource } from '@noodle-borg/module';
 import { type ProtocolRequestContext } from '@noodle-borg/protocol';
+import type { TargetAuthentication } from './target-authentication.js';
 export interface IdentityAuthorizationOptions {
     readonly accessMode: AccessMode | undefined;
     readonly ownerSubject: string | undefined;
     readonly org: string | undefined;
     readonly orgMembershipSources: readonly OrgMembershipSource[] | undefined;
-    readonly verifyOwnerToken: OwnerTokenVerifier | undefined;
+    readonly authentication: TargetAuthentication;
     readonly authorizeDataPlaneIdentity: DataPlaneIdentityAuthorizer | undefined;
     /** Whether to trust forwarded-proto when reconstructing the public resource/PRM URLs. */
     readonly trustProxy: boolean;

package/node_modules/@noodle-borg/transport-http/dist/identity-authorization.js

@@ -9,13 +9,13 @@ import { header } from './request-capture.js';
 export async function authorizeIdentityMode(req, res, auth) {
     const challenge = protectedResourceMetadataUrl(req, auth);
     const token = bearerToken(header(req, 'authorization'));
-    if (token === null || auth.verifyOwnerToken === undefined) {
+    if (token === null || auth.authentication.verifyToken === undefined) {
         sendUnauthorized(res, challenge);
         return { allow: false, reason: token === null ? 'missing_token' : 'verifier_unavailable' };
     }
-    const verification = await auth.verifyOwnerToken(token, canonicalResourceUrl(req, auth));
+    const verification = await auth.authentication.verifyToken(token, canonicalResourceUrl(req, auth));
     if (verification === null) {
-        sendUnauthorized(res, challenge);
+        sendUnauthorized(res, challenge, 'invalid_token');
         return { allow: false, reason: 'token_rejected' };
     }
     const { caller: identity } = verification;
@@ -76,27 +76,38 @@ export async function authorizeIdentityMode(req, res, auth) {
  */
 export async function authorizePublicServiceMode(req, auth) {
     const token = bearerToken(header(req, 'authorization'));
-    if (token === null || auth.verifyOwnerToken === undefined)
+    if (token === null || auth.authentication.verifyToken === undefined)
         return { allow: true };
-    const verification = await auth.verifyOwnerToken(token, canonicalResourceUrl(req, auth));
+    const verification = await auth.authentication.verifyToken(token, canonicalResourceUrl(req, auth));
     return verification?.caller.identityKind === 'service'
         ? { allow: true, caller: verification.caller }
         : { allow: true };
 }
 export async function authorizeMixedMode(req, res, auth) {
-    const token = bearerToken(header(req, 'authorization'));
-    if (token === null)
+    const authorization = header(req, 'authorization');
+    if (authorization === undefined)
         return { allow: true };
+    const token = bearerToken(authorization);
     const challenge = protectedResourceMetadataUrl(req, auth);
-    if (auth.verifyOwnerToken === undefined) {
+    if (token === null) {
+        sendUnauthorized(res, challenge, 'invalid_token');
+        return { allow: false, reason: 'token_rejected' };
+    }
+    if (auth.authentication.verifyToken === undefined) {
         sendUnauthorized(res, challenge);
         return { allow: false, reason: 'verifier_unavailable' };
     }
-    const verification = await auth.verifyOwnerToken(token, canonicalResourceUrl(req, auth));
+    const verification = await auth.authentication.verifyToken(token, canonicalResourceUrl(req, auth));
     if (verification === null) {
-        sendUnauthorized(res, challenge);
+        sendUnauthorized(res, challenge, 'invalid_token');
         return { allow: false, reason: 'token_rejected' };
     }
+    if (auth.authentication.kind === 'customer' &&
+        verification.caller.identityKind !== 'customer' &&
+        verification.caller.identityKind !== 'service') {
+        sendUnauthorized(res, challenge, 'invalid_token');
+        return { allow: false, reason: 'identity_not_customer' };
+    }
     return {
         allow: true,
         caller: verification.caller,
@@ -126,13 +137,13 @@ export function bearerToken(headerValue) {
  * `resourceMetadataUrl` is included so an MCP client can discover the authorization server (RFC 9728 /
  * the MCP authorization spec).
  */
-function sendUnauthorized(res, resourceMetadataUrl) {
+function sendUnauthorized(res, resourceMetadataUrl, error) {
     const challenge = resourceMetadataUrl !== undefined
         ? `Bearer realm="noodle", resource_metadata="${resourceMetadataUrl}"`
         : 'Bearer realm="noodle"';
     res.writeHead(401, {
         'content-type': 'application/json; charset=utf-8',
-        'www-authenticate': challenge,
+        'www-authenticate': error === undefined ? challenge : `${challenge}, error="${error}"`,
     });
     res.end(JSON.stringify(rpcError(JSON_RPC.INVALID_REQUEST, 'unauthorized')));
 }

package/node_modules/@noodle-borg/transport-http/dist/index.d.ts

@@ -8,6 +8,7 @@ export { sendJson } from './responses.js';
 export { type RunningServer, type ServeOptions, serveHttp } from './serve.js';
 export type { HostedToolAuthorizationObservation, HostedToolAuthorizationObserver, ServicePrincipalToolAuthorizationObservation, } from './service-principal-authorization.js';
 export { preflightServicePrincipalToolCall, sendServicePrincipalToolDenial, } from './service-principal-authorization.js';
+export type { TargetAuthentication } from './target-authentication.js';
 export type { HostedToolDispatchContext, HostedToolDispatchHook, } from './tool-dispatch.js';
 export { toWebRequest, writeWebResponse } from './web-bridge.js';
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/transport-http/dist/serve-request.js

@@ -49,6 +49,9 @@ export async function serveRequest(req, res, target, auth, routeId, maxBody, all
     // and the SDK transport is never constructed for it. A missing accessMode is reserved for loopback/local
     // dev targets and remains open.
     let protocolContext = {
+        ...(auth.accessMode === 'mixed' && auth.authentication.kind === 'customer'
+            ? { toolAuthentication: 'mixed-customer' }
+            : {}),
         ...(auth.oauthClientCredentialsReady ? { oauthClientCredentialsReady: true } : {}),
     };
     let subject;

package/node_modules/@noodle-borg/transport-http/dist/target-authentication.d.ts

@@ -0,0 +1,15 @@
+import type { AccessMode, OwnerTokenVerifier } from '@noodle-borg/module';
+/** Resolved identity authority. A missing customer verifier must never select platform defaults. */
+export type TargetAuthentication = {
+    readonly kind: 'platform';
+    readonly verifyToken?: OwnerTokenVerifier;
+} | {
+    readonly kind: 'customer';
+    readonly verifyToken?: OwnerTokenVerifier;
+    readonly authorizationServers?: readonly string[];
+};
+export declare function resolveTargetAuthentication(target: {
+    readonly accessMode?: AccessMode;
+    readonly authentication?: TargetAuthentication;
+}, platformVerifier?: OwnerTokenVerifier): TargetAuthentication;
+//# sourceMappingURL=target-authentication.d.ts.map

package/node_modules/@noodle-borg/transport-http/dist/target-authentication.js

@@ -0,0 +1,9 @@
+export function resolveTargetAuthentication(target, platformVerifier) {
+    if (target.authentication?.kind === 'customer')
+        return target.authentication;
+    if (target.accessMode === 'customers')
+        return { kind: 'customer' };
+    const verifyToken = target.authentication?.verifyToken ?? platformVerifier;
+    return { kind: 'platform', ...(verifyToken === undefined ? {} : { verifyToken }) };
+}
+//# sourceMappingURL=target-authentication.js.map

package/node_modules/@noodle-borg/wire-contracts/dist/control-plane.d.ts

@@ -1,5 +1,12 @@
 /** Strict service-output contracts for control-plane reads and mutations (ADR 0128). */
 import { z } from 'zod';
+/** Effective authority enforcing caller authentication for one deployment. */
+export declare const deploymentAuthenticationSchema: z.ZodEnum<{
+    customer: "customer";
+    none: "none";
+    platform: "platform";
+}>;
+export type DeploymentAuthentication = z.infer<typeof deploymentAuthenticationSchema>;
 /** Exact OAuth subject bound by an operator to an owner-only deployment. */
 export declare const deploymentOwnerSubjectSchema: z.ZodString;
 export declare const accessUpdateRequestSchema: z.ZodObject<{
@@ -32,6 +39,11 @@ export declare const accessUpdateResponseSchema: z.ZodObject<{
             mixed: "mixed";
             customers: "customers";
         }>;
+        authentication: z.ZodOptional<z.ZodEnum<{
+            customer: "customer";
+            none: "none";
+            platform: "platform";
+        }>>;
         ownerSubject: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
     previousAccessMode: z.ZodEnum<{
@@ -45,6 +57,7 @@ export declare const accessUpdateResponseSchema: z.ZodObject<{
     previousOwnerSubject: z.ZodOptional<z.ZodString>;
     accessChanged: z.ZodBoolean;
     ownerChanged: z.ZodBoolean;
+    policyChanged: z.ZodOptional<z.ZodBoolean>;
     changed: z.ZodBoolean;
 }, z.core.$strict>;
 export type AccessUpdateResponse = z.output<typeof accessUpdateResponseSchema>;
@@ -71,6 +84,11 @@ export declare const accessUpdateClientResponseSchema: z.ZodPipe<z.ZodObject<{
             mixed: "mixed";
             customers: "customers";
         }>;
+        authentication: z.ZodOptional<z.ZodEnum<{
+            customer: "customer";
+            none: "none";
+            platform: "platform";
+        }>>;
         ownerSubject: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     previousAccessMode: z.ZodEnum<{
@@ -84,6 +102,7 @@ export declare const accessUpdateClientResponseSchema: z.ZodPipe<z.ZodObject<{
     previousOwnerSubject: z.ZodOptional<z.ZodString>;
     accessChanged: z.ZodOptional<z.ZodBoolean>;
     ownerChanged: z.ZodOptional<z.ZodBoolean>;
+    policyChanged: z.ZodOptional<z.ZodBoolean>;
     changed: z.ZodBoolean;
 }, z.core.$strip>, z.ZodTransform<{
     accessChanged: boolean;
@@ -97,12 +116,14 @@ export declare const accessUpdateClientResponseSchema: z.ZodPipe<z.ZodObject<{
         deploymentId: string;
         accessMode: "owner-only" | "org-members" | "authenticated" | "public" | "mixed" | "customers";
         serverVersion?: string | undefined;
+        authentication?: "customer" | "none" | "platform" | undefined;
         ownerSubject?: string | undefined;
     };
     previousAccessMode: "owner-only" | "org-members" | "authenticated" | "public" | "mixed" | "customers";
     changed: boolean;
     previousOwnerSubject?: string | undefined;
     ownerChanged?: boolean | undefined;
+    policyChanged?: boolean | undefined;
 }, {
     ok: true;
     target: {
@@ -114,6 +135,7 @@ export declare const accessUpdateClientResponseSchema: z.ZodPipe<z.ZodObject<{
         deploymentId: string;
         accessMode: "owner-only" | "org-members" | "authenticated" | "public" | "mixed" | "customers";
         serverVersion?: string | undefined;
+        authentication?: "customer" | "none" | "platform" | undefined;
         ownerSubject?: string | undefined;
     };
     previousAccessMode: "owner-only" | "org-members" | "authenticated" | "public" | "mixed" | "customers";
@@ -121,6 +143,7 @@ export declare const accessUpdateClientResponseSchema: z.ZodPipe<z.ZodObject<{
     previousOwnerSubject?: string | undefined;
     accessChanged?: boolean | undefined;
     ownerChanged?: boolean | undefined;
+    policyChanged?: boolean | undefined;
 }>>;
 export type AccessUpdateClientResponse = z.output<typeof accessUpdateClientResponseSchema>;
 export declare const WhoamiIdentityResponseSchema: z.ZodObject<{

package/node_modules/@noodle-borg/wire-contracts/dist/control-plane.js

@@ -1,6 +1,8 @@
 /** Strict service-output contracts for control-plane reads and mutations (ADR 0128). */
 import { z } from 'zod';
 import { accessModeSchema } from './access-mode.js';
+/** Effective authority enforcing caller authentication for one deployment. */
+export const deploymentAuthenticationSchema = z.enum(['none', 'platform', 'customer']);
 function containsC0OrDel(value) {
     for (let index = 0; index < value.length; index += 1) {
         const codeUnit = value.charCodeAt(index);
@@ -46,6 +48,7 @@ export const accessUpdateResponseSchema = z
         deploymentId: z.string().min(1),
         serverVersion: z.string().min(1).optional(),
         accessMode: accessModeSchema,
+        authentication: deploymentAuthenticationSchema.optional(),
         ownerSubject: deploymentOwnerSubjectSchema.optional(),
     })
         .strict(),
@@ -53,6 +56,7 @@ export const accessUpdateResponseSchema = z
     previousOwnerSubject: deploymentOwnerSubjectSchema.optional(),
     accessChanged: z.boolean(),
     ownerChanged: z.boolean(),
+    policyChanged: z.boolean().optional(),
     changed: z.boolean(),
 })
     .strict()
@@ -65,11 +69,19 @@ export const accessUpdateResponseSchema = z
             message: 'owner-only access requires a current owner subject',
         });
     }
-    if (value.changed !== (value.accessChanged || value.ownerChanged)) {
+    if ((value.deployment.authentication === undefined) !== (value.policyChanged === undefined)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['policyChanged'],
+            message: 'authentication and policyChanged must be present together',
+        });
+    }
+    if (value.changed !==
+        (value.accessChanged || value.ownerChanged || (value.policyChanged ?? false))) {
         context.addIssue({
             code: 'custom',
             path: ['changed'],
-            message: 'changed must equal accessChanged || ownerChanged',
+            message: 'changed must equal accessChanged || ownerChanged || policyChanged',
         });
     }
 });
@@ -90,12 +102,14 @@ export const accessUpdateClientResponseSchema = z
         deploymentId: z.string().min(1),
         serverVersion: z.string().min(1).optional(),
         accessMode: accessModeSchema,
+        authentication: deploymentAuthenticationSchema.optional(),
         ownerSubject: deploymentOwnerSubjectSchema.optional(),
     }),
     previousAccessMode: accessModeSchema,
     previousOwnerSubject: deploymentOwnerSubjectSchema.optional(),
     accessChanged: z.boolean().optional(),
     ownerChanged: z.boolean().optional(),
+    policyChanged: z.boolean().optional(),
     changed: z.boolean(),
 })
     .superRefine((value, context) => {
@@ -107,6 +121,20 @@ export const accessUpdateClientResponseSchema = z
             message: 'accessChanged and ownerChanged must be present together',
         });
     }
+    if ((value.deployment.authentication === undefined) !== (value.policyChanged === undefined)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['policyChanged'],
+            message: 'authentication and policyChanged must be present together',
+        });
+    }
+    if (value.policyChanged !== undefined && !modernComponents) {
+        context.addIssue({
+            code: 'custom',
+            path: ['policyChanged'],
+            message: 'policyChanged requires accessChanged and ownerChanged',
+        });
+    }
     if (modernComponents &&
         value.deployment.accessMode === 'owner-only' &&
         value.deployment.ownerSubject === undefined) {
@@ -116,11 +144,13 @@ export const accessUpdateClientResponseSchema = z
             message: 'owner-only access requires a current owner subject',
         });
     }
-    if (modernComponents && value.changed !== (value.accessChanged || value.ownerChanged)) {
+    if (modernComponents &&
+        value.changed !==
+            (value.accessChanged || value.ownerChanged || (value.policyChanged ?? false))) {
         context.addIssue({
             code: 'custom',
             path: ['changed'],
-            message: 'changed must equal accessChanged || ownerChanged',
+            message: 'changed must equal accessChanged || ownerChanged || policyChanged',
         });
     }
 })

package/node_modules/@noodle-borg/wire-contracts/dist/index.d.ts

@@ -124,6 +124,11 @@ export declare const deploySuccessResponseSchema: z.ZodObject<{
         mixed: "mixed";
         customers: "customers";
     }>;
+    authentication: z.ZodOptional<z.ZodEnum<{
+        customer: "customer";
+        none: "none";
+        platform: "platform";
+    }>>;
     ownerSubject: z.ZodOptional<z.ZodString>;
     url: z.ZodString;
     defaultUrl: z.ZodString;
@@ -385,4 +390,5 @@ export * from './application-connections.js';
 export * from './application-onboarding.js';
 export * from './billing-catalog.js';
 export * from './operation-coordination.js';
+export { MIXED_CUSTOMER_AUTH_FEATURE_VERSION, type ServiceInfoClientResponse, type ServiceInfoResponse, serviceInfoClientResponseSchema, serviceInfoResponseSchema, } from './service-info.js';
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/wire-contracts/dist/index.js

@@ -9,7 +9,7 @@
  */
 import { z } from 'zod';
 import { accessModeSchema } from './access-mode.js';
-import { deploymentOwnerSubjectSchema } from './control-plane.js';
+import { deploymentAuthenticationSchema, deploymentOwnerSubjectSchema } from './control-plane.js';
 export * from './access-mode.js';
 export * from './app-purge-reconciliation.js';
 export * from './application-channels.js';
@@ -92,6 +92,8 @@ export const deploySuccessResponseSchema = z.object({
     deploymentId: z.string().min(1),
     serverVersion: z.string().min(1),
     accessMode: accessModeSchema,
+    /** Effective authority reported by capable services; absence means unknown on older services. */
+    authentication: deploymentAuthenticationSchema.optional(),
     ownerSubject: deploymentOwnerSubjectSchema.optional(),
     url: z.string().min(1),
     defaultUrl: z.string().min(1),
@@ -227,4 +229,5 @@ export * from './application-connections.js';
 export * from './application-onboarding.js';
 export * from './billing-catalog.js';
 export * from './operation-coordination.js';
+export { MIXED_CUSTOMER_AUTH_FEATURE_VERSION, serviceInfoClientResponseSchema, serviceInfoResponseSchema, } from './service-info.js';
 //# sourceMappingURL=index.js.map

package/node_modules/@noodle-borg/wire-contracts/dist/service-info.d.ts

@@ -0,0 +1,41 @@
+import { z } from 'zod';
+export declare const MIXED_CUSTOMER_AUTH_FEATURE_VERSION = 1;
+/** Strict producer contract for the enabled R1 service; no configured tenant data belongs here. */
+export declare const serviceInfoResponseSchema: z.ZodObject<{
+    developerPlugin: z.ZodOptional<z.ZodObject<{
+        mcpCapabilityVersion: z.ZodString;
+    }, z.core.$strict>>;
+    features: z.ZodObject<{
+        mixedCustomerAuth: z.ZodLiteral<1>;
+    }, z.core.$strict>;
+    ok: z.ZodLiteral<true>;
+    status: z.ZodLiteral<"ok">;
+    version: z.ZodString;
+    gitSha: z.ZodString;
+    buildTime: z.ZodString;
+    systemRelease: z.ZodOptional<z.ZodString>;
+    manifestChecksum: z.ZodOptional<z.ZodString>;
+    packageVersions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    compatiblePackageVersions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+}, z.core.$strict>;
+/** Older services may omit features; future fields are stripped at each structured metadata layer. */
+export declare const serviceInfoClientResponseSchema: z.ZodObject<{
+    developerPlugin: z.ZodOptional<z.ZodObject<{
+        mcpCapabilityVersion: z.ZodString;
+    }, z.core.$strip>>;
+    features: z.ZodOptional<z.ZodObject<{
+        mixedCustomerAuth: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+    ok: z.ZodLiteral<true>;
+    status: z.ZodLiteral<"ok">;
+    version: z.ZodString;
+    gitSha: z.ZodString;
+    buildTime: z.ZodString;
+    systemRelease: z.ZodOptional<z.ZodString>;
+    manifestChecksum: z.ZodOptional<z.ZodString>;
+    packageVersions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    compatiblePackageVersions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+}, z.core.$strip>;
+export type ServiceInfoResponse = z.infer<typeof serviceInfoResponseSchema>;
+export type ServiceInfoClientResponse = z.infer<typeof serviceInfoClientResponseSchema>;
+//# sourceMappingURL=service-info.d.ts.map