@noodleseed/one 0.166.0 → 0.168.0

package/node_modules/@noodle-borg/capabilities/dist/index.js

@@ -31,6 +31,13 @@ export const PRODUCT_FEATURES = [
         description: 'Direct or federated OIDC resource-server verification assigns customer identity at the trusted verifier boundary; Firebase and Microsoft remain built-in adapters.',
         hosts: { claude: 'supported', chatgpt: 'supported', embedded: 'supported' },
     },
+    {
+        id: 'mixed-customer-auth',
+        title: 'Mixed anonymous and customer access',
+        since: 'next',
+        description: 'Anonymous Help and protected customer tools share one MCP endpoint with direct or federated OIDC sign-in. Local Devtools supports optional sign-in; live host linking remains unverified.',
+        hosts: { claude: 'preview', chatgpt: 'preview', embedded: 'preview' },
+    },
     {
         id: 'explicit-context-provider',
         title: 'Explicit context-provider tool',

package/node_modules/@noodle-borg/cli-catalog/dist/catalog-data-local-authoring.js

@@ -104,6 +104,14 @@ export const CATALOG_LOCAL_AUTHORING = [
                 value: '<slug>',
                 summary: 'Environment slug for local target context.',
             },
+            {
+                ...OPTIONAL_FLAG,
+                name: 'access',
+                type: 'string',
+                value: '<mode>',
+                constraints: { choices: ['mixed', 'customers'] },
+                summary: 'Local access: customers requires sign-in; mixed allows anonymous tools and optional customer sign-in. Defaults to customers when auth is declared.',
+            },
             CONNECTORS_FLAG,
             {
                 ...OPTIONAL_FLAG,

package/node_modules/@noodle-borg/compiler/dist/app-package/compile.js

@@ -182,7 +182,15 @@ function compileAppPackageInternal(input, preflightComplete) {
         skill,
         surface,
         provenance: {
-            sourceManifestSha256: sha256Canonical(input.sourceManifest),
+            sourceManifestSha256: sha256Canonical({
+                ...input.sourceManifest,
+                tools: input.sourceManifest.tools.map((tool) => {
+                    if (tool.authorization?.discovery !== 'authorized')
+                        return tool;
+                    const { discovery: _discovery, ...authorization } = tool.authorization;
+                    return { ...tool, authorization };
+                }),
+            }),
             mcpSurfaceSha256: sha256Canonical(surface),
             compilerVersion: '1',
         },

package/node_modules/@noodle-borg/compiler/dist/artifact/catalog-emission.js

@@ -35,6 +35,9 @@ export function emitCatalogArtifactSurfaces({ manifest, catalog, structuralAmbie
             ...(s.tool.authorization
                 ? {
                     authorization: {
+                        ...(s.tool.authorization.discovery === 'public'
+                            ? { discovery: 'public' }
+                            : {}),
                         ...(s.tool.authorization.requiredScopes
                             ? {
                                 requiredScopes: canonicalizeAuthorizationValues(s.tool.authorization.requiredScopes),

package/node_modules/@noodle-borg/compiler/dist/artifact/types.d.ts

@@ -92,6 +92,8 @@ export interface ArtifactMeta {
     readonly [key: string]: unknown;
 }
 export interface ArtifactToolAuthorization {
+    /** Public descriptor discovery does not grant execution permission. */
+    readonly discovery?: 'public';
     /** Every scope must be present on the verified caller. */
     readonly requiredScopes?: readonly string[];
     /** At least one role must be present on the verified caller. */

package/node_modules/@noodle-borg/compiler/dist/artifact/version.d.ts

@@ -62,7 +62,8 @@
  * `0.20.0` (Nested operation authority): resolved operation references carry exact declared calls,
  * including independently validated credential bindings for sandboxed compute dependencies.
  */
-export declare const ARTIFACT_SCHEMA_VERSION = "0.20.0";
+/** `0.21.0`: protected tools may opt into public descriptor discovery without execution permission. */
+export declare const ARTIFACT_SCHEMA_VERSION = "0.21.0";
 /** mimeType for an MCP Apps UI resource (SEP-1865). Widgets are served under this profile. */
 export declare const MCP_APP_MIME_TYPE = "text/html;profile=mcp-app";
 //# sourceMappingURL=version.d.ts.map

package/node_modules/@noodle-borg/compiler/dist/artifact/version.js

@@ -62,7 +62,8 @@
  * `0.20.0` (Nested operation authority): resolved operation references carry exact declared calls,
  * including independently validated credential bindings for sandboxed compute dependencies.
  */
-export const ARTIFACT_SCHEMA_VERSION = '0.20.0';
+/** `0.21.0`: protected tools may opt into public descriptor discovery without execution permission. */
+export const ARTIFACT_SCHEMA_VERSION = '0.21.0';
 /** mimeType for an MCP Apps UI resource (SEP-1865). Widgets are served under this profile. */
 export const MCP_APP_MIME_TYPE = 'text/html;profile=mcp-app';
 //# sourceMappingURL=version.js.map

package/node_modules/@noodle-borg/compiler/dist/manifest/schema.d.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 type ToolAuthorizationManifest = {
+    readonly discovery?: 'authorized' | 'public' | undefined;
     readonly requiredScopes?: readonly string[] | undefined;
     readonly allowedRoles?: readonly string[] | undefined;
 };
@@ -504,6 +505,7 @@ export declare const manifestV1Schema: z.ZodObject<{
         title: z.ZodOptional<z.ZodString>;
         description: z.ZodString;
         authorization: z.ZodOptional<z.ZodType<ToolAuthorizationManifest, unknown, z.core.$ZodTypeInternals<ToolAuthorizationManifest, unknown>>>;
+        securitySchemes: z.ZodOptional<z.ZodNever>;
         inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
         outputSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -1164,6 +1166,7 @@ export declare const manifestV2Schema: z.ZodObject<{
         title: z.ZodOptional<z.ZodString>;
         description: z.ZodString;
         authorization: z.ZodOptional<z.ZodType<ToolAuthorizationManifest, unknown, z.core.$ZodTypeInternals<ToolAuthorizationManifest, unknown>>>;
+        securitySchemes: z.ZodOptional<z.ZodNever>;
         inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
         outputSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -1729,6 +1732,7 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         title: z.ZodOptional<z.ZodString>;
         description: z.ZodString;
         authorization: z.ZodOptional<z.ZodType<ToolAuthorizationManifest, unknown, z.core.$ZodTypeInternals<ToolAuthorizationManifest, unknown>>>;
+        securitySchemes: z.ZodOptional<z.ZodNever>;
         inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
         outputSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -2388,6 +2392,7 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         title: z.ZodOptional<z.ZodString>;
         description: z.ZodString;
         authorization: z.ZodOptional<z.ZodType<ToolAuthorizationManifest, unknown, z.core.$ZodTypeInternals<ToolAuthorizationManifest, unknown>>>;
+        securitySchemes: z.ZodOptional<z.ZodNever>;
         inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
         outputSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;

package/node_modules/@noodle-borg/compiler/dist/manifest/schema.js

@@ -70,25 +70,35 @@ const roleSchema = z
 const authorizationListSchema = (item) => z.array(item).min(1).max(MAX_TOOL_AUTHORIZATION_VALUES);
 const requiredScopesSchema = authorizationListSchema(scopeTokenSchema);
 const allowedRolesSchema = authorizationListSchema(roleSchema);
-const toolAuthorizationSchema = z.union([
+const toolAuthorizationSchema = z
+    .union([
     z
         .object({
+        discovery: z.enum(['authorized', 'public']).optional(),
         requiredScopes: requiredScopesSchema,
         allowedRoles: allowedRolesSchema.optional(),
     })
         .strict(),
     z
         .object({
+        discovery: z.enum(['authorized', 'public']).optional(),
         requiredScopes: requiredScopesSchema.optional(),
         allowedRoles: allowedRolesSchema,
     })
         .strict(),
-]);
+])
+    .overwrite((authorization) => {
+    if (authorization.discovery !== 'authorized')
+        return authorization;
+    const { discovery: _discovery, ...normalized } = authorization;
+    return normalized;
+});
 const toolSchema = z.object({
     name: nameSchema,
     title: z.string().trim().min(1).optional(),
     description: z.string().min(1),
     authorization: toolAuthorizationSchema.optional(),
+    securitySchemes: z.never().optional(),
     inputSchema: jsonSchemaSchema,
     outputSchema: jsonSchemaSchema.optional(),
     annotations: z.record(z.string(), z.unknown()).optional(),

package/node_modules/@noodle-borg/protocol/dist/handlers/tools.js

@@ -15,6 +15,9 @@ export function registerTools(server, artifact, deps, context) {
     server.setRequestHandler(ListToolsRequestSchema, async () => mapToolsList(artifact, context.caller, {
         knowledgeTools: await knowledgeToolsEnabled(artifact, deps),
         intentCapture: context.intentCapture?.enabled === true,
+        ...(context.toolAuthentication === undefined
+            ? {}
+            : { authentication: context.toolAuthentication }),
     }));
     server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
         const toolName = request.params.name;

package/node_modules/@noodle-borg/protocol/dist/index.d.ts

@@ -8,6 +8,7 @@ export { buildMcpServer, type ProtocolRequestContext, type ProtocolToolDispatchC
 export { handleStatelessHttp } from './stateless.js';
 export { evaluateToolAuthorization, filterAuthorizedTools, TOOL_AUTHORIZATION_DENIED, type ToolAuthorizationCaller, type ToolAuthorizationDecision, type ToolAuthorizationRuleClass, toolAuthorizationRuleClass, toolAuthorizationRuleFingerprint, } from './tool-authorization.js';
 export { toolRequiresConfirmation } from './tool-confirmation.js';
+export { filterDiscoverableTools, type ToolAuthenticationPolicy } from './tool-discovery.js';
 export { createDualEraMcpHandler, createPlatformDualEraMcpHandler, } from './v2/handler.js';
 export { LEGACY_MCP_PROTOCOL_VERSION, type McpProtocolEra, type McpProtocolMode, MODERN_MCP_PROTOCOL_VERSION, SERVED_MCP_PROTOCOL_VERSIONS, type ServedMcpProtocolVersion, } from './v2/versions.js';
 export { injectWidgetBridge } from './widget/inject.js';

package/node_modules/@noodle-borg/protocol/dist/index.js

@@ -7,6 +7,7 @@ export { buildMcpServer, } from './sdk-server.js';
 export { handleStatelessHttp } from './stateless.js';
 export { evaluateToolAuthorization, filterAuthorizedTools, TOOL_AUTHORIZATION_DENIED, toolAuthorizationRuleClass, toolAuthorizationRuleFingerprint, } from './tool-authorization.js';
 export { toolRequiresConfirmation } from './tool-confirmation.js';
+export { filterDiscoverableTools } from './tool-discovery.js';
 export { createDualEraMcpHandler, createPlatformDualEraMcpHandler, } from './v2/handler.js';
 export { LEGACY_MCP_PROTOCOL_VERSION, MODERN_MCP_PROTOCOL_VERSION, SERVED_MCP_PROTOCOL_VERSIONS, } from './v2/versions.js';
 export { injectWidgetBridge } from './widget/inject.js';

package/node_modules/@noodle-borg/protocol/dist/mapping.d.ts

@@ -1,6 +1,7 @@
 import type { ArtifactTool, RuntimeArtifact } from '@noodle-borg/compiler';
 import type { JsonRpcErrorObject } from './jsonrpc.js';
-import { type ToolAuthorizationCaller } from './tool-authorization.js';
+import type { ToolAuthorizationCaller } from './tool-authorization.js';
+import { type ToolAuthenticationPolicy, type ToolSecurityScheme } from './tool-discovery.js';
 import { type WidgetDomainProjection } from './widget/domain-projection.js';
 /**
  * Artifact → MCP wire mapping. The official `@modelcontextprotocol/sdk` owns JSON-RPC framing and
@@ -16,6 +17,7 @@ export interface ToolDescriptor {
     readonly inputSchema: Record<string, unknown>;
     readonly outputSchema?: Record<string, unknown>;
     readonly annotations?: Record<string, unknown>;
+    readonly securitySchemes?: readonly ToolSecurityScheme[];
     /** MCP `_meta` extension bag (e.g. MCP Apps `{ ui: { resourceUri } }` linking the tool to its widget). */
     readonly _meta?: Record<string, unknown>;
 }
@@ -44,6 +46,7 @@ export { mapExecutionError } from './execution-error-mapping.js';
 /** Map a resolved artifact tool to an MCP tool descriptor (carrying its `_meta` extension bag, if any). */
 export declare function mapTool(tool: ArtifactTool, options?: {
     readonly intentCapture?: boolean;
+    readonly authentication?: ToolAuthenticationPolicy;
 }): ToolDescriptor;
 /**
  * Map the artifact's tools to a `tools/list` result. App-only widget helpers remain discoverable here with
@@ -53,6 +56,7 @@ export declare function mapTool(tool: ArtifactTool, options?: {
 export declare function mapToolsList(artifact: RuntimeArtifact, caller?: ToolAuthorizationCaller, options?: {
     readonly knowledgeTools?: boolean;
     readonly intentCapture?: boolean;
+    readonly authentication?: ToolAuthenticationPolicy;
 }): ToolsListResult;
 /**
  * Map a successful tool output to a `tools/call` result. Structured (object) output is returned as

package/node_modules/@noodle-borg/protocol/dist/mapping.js

@@ -1,21 +1,27 @@
 import { splitResultMeta } from '@noodle-borg/runtime';
 import { artifactDeclaresContext, assertNoContextToolCollision, CONTEXT_TOOL_DESCRIPTOR, } from './context-tool.js';
 import { projectIntentCaptureInput } from './intent-capture.js';
-import { filterAuthorizedTools } from './tool-authorization.js';
+import { filterDiscoverableTools, toolSecuritySchemes, } from './tool-discovery.js';
 import { projectWidgetResourceMeta, } from './widget/domain-projection.js';
 import { injectWidgetBridge } from './widget/inject.js';
 export { mapExecutionError } from './execution-error-mapping.js';
 /** Map a resolved artifact tool to an MCP tool descriptor (carrying its `_meta` extension bag, if any). */
 export function mapTool(tool, options) {
-    return {
+    return withToolAuthentication({
         name: tool.name,
         ...(tool.title !== undefined ? { title: tool.title } : {}),
         description: tool.description,
         inputSchema: projectIntentCaptureInput(withPortableInteractionInput(tool), options?.intentCapture === true),
         ...(tool.outputSchema !== undefined ? { outputSchema: tool.outputSchema } : {}),
         ...(tool.annotations !== undefined ? { annotations: tool.annotations } : {}),
-        ...(tool._meta !== undefined ? { _meta: tool._meta } : {}),
-    };
+        ...(tool._meta === undefined ? {} : { _meta: tool._meta }),
+    }, tool, options?.authentication);
+}
+function withToolAuthentication(descriptor, tool, policy) {
+    if (policy !== 'mixed-customer')
+        return descriptor;
+    const securitySchemes = toolSecuritySchemes(tool);
+    return { ...descriptor, securitySchemes, _meta: { ...descriptor._meta, securitySchemes } };
 }
 const PORTABLE_INTERACTION_INPUT_SCHEMA = {
     type: 'object',
@@ -65,10 +71,12 @@ export function mapToolsList(artifact, caller, options) {
     assertNoContextToolCollision(artifact);
     return {
         tools: [
-            ...filterAuthorizedTools(artifact.tools, caller).map((tool) => mapTool(tool, options)),
-            ...(artifactDeclaresContext(artifact) ? [CONTEXT_TOOL_DESCRIPTOR] : []),
+            ...filterDiscoverableTools(artifact.tools, caller).map((tool) => mapTool(tool, options)),
+            ...(artifactDeclaresContext(artifact)
+                ? [withToolAuthentication(CONTEXT_TOOL_DESCRIPTOR, {}, options?.authentication)]
+                : []),
             ...(options?.knowledgeTools === true
-                ? knowledgeToolDescriptors(artifact, options?.intentCapture === true)
+                ? knowledgeToolDescriptors(artifact, options?.intentCapture === true).map((descriptor) => withToolAuthentication(descriptor, {}, options?.authentication))
                 : []),
         ],
     };

package/node_modules/@noodle-borg/protocol/dist/sdk-server.d.ts

@@ -18,6 +18,8 @@ export interface ServedArtifact {
     readonly appPackageSnapshot?: AppPackageSnapshotV1;
 }
 export interface ProtocolRequestContext {
+    /** Resolved endpoint policy used only to derive MCP discovery metadata. */
+    readonly toolAuthentication?: import('./tool-discovery.js').ToolAuthenticationPolicy;
     readonly caller?: CallerIdentity;
     /** Internal hosting attribution, never MCP payload metadata or caller-visible context. */
     readonly publicAdmission?: NonNullable<ExecuteDeps['publicAdmission']>;

package/node_modules/@noodle-borg/protocol/dist/tool-discovery.d.ts

@@ -0,0 +1,14 @@
+import type { ArtifactTool } from '@noodle-borg/compiler';
+import { type ToolAuthorizationCaller } from './tool-authorization.js';
+/** The hosting plane opts into schemes only for the resolved mixed customer policy. */
+export type ToolAuthenticationPolicy = 'mixed-customer';
+export type ToolSecurityScheme = {
+    readonly type: 'noauth';
+} | {
+    readonly type: 'oauth2';
+    readonly scopes: readonly string[];
+};
+/** Descriptor publication only; execution and non-MCP capability filters remain authorization-only. */
+export declare function filterDiscoverableTools(tools: readonly ArtifactTool[], caller: ToolAuthorizationCaller | undefined): readonly ArtifactTool[];
+export declare function toolSecuritySchemes(tool: Pick<ArtifactTool, 'authorization'>): readonly ToolSecurityScheme[];
+//# sourceMappingURL=tool-discovery.d.ts.map

package/node_modules/@noodle-borg/protocol/dist/tool-discovery.js

@@ -0,0 +1,12 @@
+import { evaluateToolAuthorization } from './tool-authorization.js';
+/** Descriptor publication only; execution and non-MCP capability filters remain authorization-only. */
+export function filterDiscoverableTools(tools, caller) {
+    return tools.filter((tool) => tool.authorization?.discovery === 'public' ||
+        evaluateToolAuthorization(tool.authorization, caller).allow);
+}
+export function toolSecuritySchemes(tool) {
+    return tool.authorization === undefined
+        ? [{ type: 'noauth' }]
+        : [{ type: 'oauth2', scopes: tool.authorization.requiredScopes ?? [] }];
+}
+//# sourceMappingURL=tool-discovery.js.map

package/node_modules/@noodle-borg/protocol/dist/v2/server.js

@@ -93,6 +93,9 @@ function registerV2Tools(server, artifact, deps, context, era) {
         const mapped = mapToolsList(artifact, context.caller, {
             knowledgeTools: await knowledgeToolsEnabled(artifact, deps),
             intentCapture: context.intentCapture?.enabled === true,
+            ...(context.toolAuthentication === undefined
+                ? {}
+                : { authentication: context.toolAuthentication }),
         });
         return (era === 'modern' ? shapeModernToolsList(mapped) : mapped);
     });

package/node_modules/@noodle-borg/service/dist/build-info.js

@@ -1,12 +1,14 @@
+import { MIXED_CUSTOMER_AUTH_FEATURE_VERSION, serviceInfoResponseSchema, } from '@noodle-borg/wire-contracts';
 export function serviceInfoPayload(buildInfo, developerMcp) {
-    return {
+    return serviceInfoResponseSchema.parse({
         ok: true,
         status: 'ok',
         ...buildInfo,
+        features: { mixedCustomerAuth: MIXED_CUSTOMER_AUTH_FEATURE_VERSION },
         ...(developerMcp
             ? { developerPlugin: { mcpCapabilityVersion: DEVELOPER_MCP_CAPABILITY_VERSION } }
             : {}),
-    };
+    });
 }
 export function cliCompatibilityError(buildInfo, cliVersion) {
     const supported = buildInfo.compatiblePackageVersions?.['@noodleseed/one'];

package/node_modules/@noodle-borg/service/dist/deployment-access-mode.js

@@ -0,0 +1,24 @@
+import { parse as parseYaml } from 'yaml';
+export function isIdentityAccessMode(accessMode, manifest) {
+    if (accessMode === 'mixed' && manifest !== undefined) {
+        try {
+            const parsed = parseYaml(manifest);
+            if (typeof parsed === 'object' && parsed !== null && 'server' in parsed) {
+                const server = parsed.server;
+                if (typeof server === 'object' &&
+                    server !== null &&
+                    'auth' in server &&
+                    server.auth != null)
+                    return true;
+            }
+        }
+        catch {
+            /* Compilation owns malformed manifest diagnostics. */
+        }
+    }
+    return (accessMode === 'owner-only' ||
+        accessMode === 'org-members' ||
+        accessMode === 'customers' ||
+        accessMode === 'authenticated');
+}
+//# sourceMappingURL=deployment-access-mode.js.map

package/node_modules/@noodle-borg/service/dist/deployment-activation-precondition.js

@@ -0,0 +1,27 @@
+import { isDeepStrictEqual } from 'node:util';
+/** Compare inside the lifecycle lock/transaction, before any projection or active-pointer writes. */
+export function matchesDeploymentActivation(target, precondition) {
+    if (target.schemaVersion !== (precondition?.expectedSchemaVersion ?? 1))
+        return false;
+    if (precondition === undefined)
+        return true;
+    if (target.accessMode !== precondition.expectedAccessMode)
+        return false;
+    const expected = precondition.expectedRevision;
+    if (expected === undefined)
+        return true;
+    // These are all persisted compile inputs plus the authority and lifecycle state used by the target.
+    // Active status may legitimately change on repeated activation; it is not an executable input.
+    return [
+        'manifest',
+        'connectors',
+        'hostedAssets',
+        'serverAuth',
+        'serverVersion',
+        'ownerSubject',
+        'createdBySubject',
+        'orgMembershipSources',
+        'archivedAt',
+    ].every((key) => isDeepStrictEqual(target[key], expected[key]));
+}
+//# sourceMappingURL=deployment-activation-precondition.js.map

package/node_modules/@noodle-borg/service/dist/deployment-authentication.js

@@ -1,7 +1,7 @@
 import { usesCustomerAuthentication } from '@noodle-borg/module';
 import { deploymentRecordVersionError } from './deployment-record-version.js';
 /** Read the effective authentication authority only when this runtime understands the record. */
-export function deploymentAuthenticationFor(record) {
+export function deploymentAuthenticationFor(record, compiledAuth) {
     if (deploymentRecordVersionError(record) !== undefined || record.accessMode === undefined) {
         return undefined;
     }
@@ -10,7 +10,7 @@ export function deploymentAuthenticationFor(record) {
     if (usesCustomerAuthentication({
         schemaVersion: record.schemaVersion,
         accessMode: record.accessMode,
-        hasServerAuth: record.serverAuth !== undefined,
+        hasServerAuth: record.serverAuth !== undefined || compiledAuth !== undefined,
     })) {
         return 'customer';
     }

package/node_modules/@noodle-borg/service/dist/deployment-execution.js

@@ -1,8 +1,8 @@
 import { cspFaultsInManifest } from '@noodle-borg/compiler';
 import { noopLogger } from '@noodle-borg/transport-http';
 import { BUSINESS_SETUP_MESSAGE, BusinessOnboarding } from './business-onboarding.js';
+import { isIdentityAccessMode } from './deployment-access-mode.js';
 import { manifestUsesUserRoot } from './registry-access.js';
-import { isIdentityAccessMode } from './routes/access-mode.js';
 import { provisionPublicEmbed } from './routes/deploy-public-embed.js';
 import { deploymentActivationRejection } from './routes/deployment-activation-response.js';
 /** Shared post-authorization deploy flow. Both API deploys and installations retain registry activation hooks. */
@@ -42,7 +42,7 @@ export async function executeAuthorizedDeployment(input, dependencies) {
     }
     // Identity access modes bind the data plane to verified identity, so the deployer must be authenticated.
     // (Localhost dev runs the gate open; such deploys are rejected for lack of an owner/audit actor.)
-    if (isIdentityAccessMode(accessMode) && !identity) {
+    if (isIdentityAccessMode(accessMode, manifest) && !identity) {
         return reject(401, {
             error: `${accessMode} deployments require an authenticated deployer`,
         });

package/node_modules/@noodle-borg/service/dist/deployment-record-version.js

@@ -11,9 +11,9 @@ export class UnsupportedDeploymentRecordVersionError extends Error {
         this.name = 'UnsupportedDeploymentRecordVersionError';
     }
 }
-/** R0 understands newer ownership records but must never serve their authentication semantics. */
+/** R1 serves the two understood policy versions; future policy remains unavailable. */
 export function deploymentRecordVersionError(record) {
-    return record.schemaVersion === 1 ? undefined : VERSION_ERROR;
+    return record.schemaVersion === 1 || record.schemaVersion === 2 ? undefined : VERSION_ERROR;
 }
 /** A stale writer cannot replace or deactivate a newer policy, even after registry preflight. */
 export function assertDeploymentAppendVersion(records, candidate) {
@@ -28,4 +28,28 @@ export function assertDeploymentAppendVersion(records, candidate) {
 export function unsupportedDeploymentRecordFailure() {
     return { ok: false, errors: [VERSION_ERROR] };
 }
+/** Reject a deployment compiled against an operator policy that has since changed. */
+export class DeploymentPolicyChangedError extends Error {
+    code = 'deployment_policy_changed';
+    constructor() {
+        super('The active deployment policy changed. Retry the deployment.');
+    }
+}
+export function assertDeploymentAppendPolicy(records, candidate, precondition) {
+    if (precondition === undefined)
+        return;
+    const current = records.find((record) => record.active && record.archivedAt === undefined && sameDeploymentScope(record, candidate));
+    const expected = precondition.active;
+    if (expected === null
+        ? current !== undefined
+        : current === undefined ||
+            current.deploymentId !== expected.deploymentId ||
+            current.schemaVersion !== expected.schemaVersion ||
+            current.accessMode !== expected.accessMode ||
+            current.ownerSubject !== expected.ownerSubject ||
+            current.manifest !== expected.manifest ||
+            JSON.stringify(current.serverAuth) !== JSON.stringify(expected.serverAuth)) {
+        throw new DeploymentPolicyChangedError();
+    }
+}
 //# sourceMappingURL=deployment-record-version.js.map

package/node_modules/@noodle-borg/service/dist/registry-access.js

@@ -1,11 +1,12 @@
-import { assertUniqueActiveCustomerAuthAudienceBindings, CustomerAuthAudienceConflictError, requiresCustomerAuthProjection, } from './customer-auth-audience-binding.js';
+import { assertUniqueActiveCustomerAuthAudienceBindings, CustomerAuthAudienceConflictError, hasExactCustomerAuthProjection, } from './customer-auth-audience-binding.js';
 import { deploymentRecordVersionError } from './deployment-record-version.js';
 import { deploymentOwnerSubject } from './registry-helpers.js';
 import { activeRecord, activeRecordVersion } from './registry-state.js';
 import { tenantDeploymentKey, tryServedTargetFor } from './registry-targets.js';
+import { resolveActiveAccessUpdate } from './store/records.js';
 /** Registry-facing access transition with customer audience ownership preflight and atomic translation. */
 export async function updateRegistryAccess(state, tenant, options, loadServed, customerVerifierFactory, hasCustomerAuthConflict) {
-    if (options.accessMode === 'customers') {
+    if (options.accessMode === 'customers' || options.accessMode === 'mixed') {
         const record = options.serverVersion === undefined
             ? await activeRecord(state, tenant)
             : await activeRecordVersion(state, tenant, options.serverVersion);
@@ -13,7 +14,11 @@ export async function updateRegistryAccess(state, tenant, options, loadServed, c
         const auth = served?.served.artifact.server.auth;
         if (record !== undefined &&
             auth !== undefined &&
-            (await hasCustomerAuthConflict({ ...record, accessMode: 'customers' }, auth))) {
+            (await hasCustomerAuthConflict({
+                ...record,
+                accessMode: options.accessMode,
+                ...(options.accessMode === 'mixed' ? { schemaVersion: 2 } : {}),
+            }, auth))) {
             return customerAuthAudienceConflict();
         }
     }
@@ -57,11 +62,19 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
     const nextOwnerSubject = options.ownerSubject ?? previousOwnerSubject;
     const accessChanged = previousAccessMode !== nextAccessMode;
     const ownerChanged = previousOwnerSubject !== nextOwnerSubject;
-    const served = accessChanged || ownerChanged || nextAccessMode === 'customers'
+    const served = accessChanged || ownerChanged || nextAccessMode === 'customers' || nextAccessMode === 'mixed'
         ? await loadServed(record.deploymentId)
         : undefined;
     const serverAuth = served?.served.artifact.server.auth;
-    if (nextAccessMode === 'customers' && serverAuth === undefined) {
+    const schemaVersion = record.schemaVersion === 2 || (nextAccessMode === 'mixed' && serverAuth !== undefined) ? 2 : 1;
+    const policyChanged = schemaVersion !== record.schemaVersion;
+    if ((nextAccessMode === 'customers' && serverAuth === undefined) ||
+        !hasExactCustomerAuthProjection({
+            ...record,
+            schemaVersion,
+            accessMode: nextAccessMode,
+            ...(record.serverAuth === undefined && serverAuth !== undefined ? { serverAuth } : {}),
+        }, serverAuth)) {
         return {
             ok: false,
             status: 409,
@@ -69,19 +82,23 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
             message: 'Customer access requires server authentication.',
         };
     }
-    if (!accessChanged && !ownerChanged) {
+    if (!accessChanged && !ownerChanged && !policyChanged) {
         const committed = state.store === undefined
             ? commitInMemoryAccessUpdate(state, tenant, record, {
                 accessMode: nextAccessMode,
                 expectedAccessMode: record.accessMode,
+                ...(schemaVersion === 2 ? { schemaVersion: 2 } : {}),
                 expectedSchemaVersion: record.schemaVersion,
+                expectedManifest: record.manifest,
                 expectedOwnerSubject: previousOwnerSubject,
                 ...(serverAuth !== undefined ? { serverAuth } : {}),
             })
             : await state.store.updateActiveAccess(tenant, record.deploymentId, {
                 accessMode: nextAccessMode,
                 expectedAccessMode: record.accessMode,
+                ...(schemaVersion === 2 ? { schemaVersion: 2 } : {}),
                 expectedSchemaVersion: record.schemaVersion,
+                expectedManifest: record.manifest,
                 expectedOwnerSubject: previousOwnerSubject,
                 ...(serverAuth !== undefined ? { serverAuth } : {}),
             });
@@ -92,6 +109,7 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
             ok: true,
             changed: false,
             accessChanged: false,
+            policyChanged: false,
             ownerChanged: false,
             previousAccessMode,
             ...(previousOwnerSubject !== undefined ? { previousOwnerSubject } : {}),
@@ -119,8 +137,9 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
     const updated = {
         ...record,
         accessMode: nextAccessMode,
+        schemaVersion,
         ...(ownerChanged && nextOwnerSubject !== undefined ? { ownerSubject: nextOwnerSubject } : {}),
-        ...(nextAccessMode === 'customers' && serverAuth !== undefined ? { serverAuth } : {}),
+        ...(serverAuth !== undefined ? { serverAuth } : {}),
     };
     const target = tryServedTargetFor(updated, served.served, customerVerifierFactory);
     if (target === undefined)
@@ -132,7 +151,9 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
                 ? { ownerSubject: nextOwnerSubject }
                 : {}),
             expectedAccessMode: record.accessMode,
+            ...(schemaVersion === 2 ? { schemaVersion: 2 } : {}),
             expectedSchemaVersion: record.schemaVersion,
+            expectedManifest: record.manifest,
             expectedOwnerSubject: previousOwnerSubject,
             ...(serverAuth !== undefined ? { serverAuth } : {}),
         })
@@ -142,7 +163,9 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
                 ? { ownerSubject: nextOwnerSubject }
                 : {}),
             expectedAccessMode: record.accessMode,
+            ...(schemaVersion === 2 ? { schemaVersion: 2 } : {}),
             expectedSchemaVersion: record.schemaVersion,
+            expectedManifest: record.manifest,
             expectedOwnerSubject: previousOwnerSubject,
             ...(serverAuth !== undefined ? { serverAuth } : {}),
         });
@@ -154,6 +177,7 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
         ok: true,
         changed: true,
         accessChanged,
+        policyChanged,
         ownerChanged,
         previousAccessMode,
         ...(previousOwnerSubject !== undefined ? { previousOwnerSubject } : {}),
@@ -161,31 +185,9 @@ export async function updateActiveAccess(state, tenant, options, loadServed, cus
     };
 }
 function commitInMemoryAccessUpdate(state, tenant, observed, input) {
-    const current = state.records.get(observed.deploymentId);
-    if (current === undefined ||
-        !current.active ||
-        current.archivedAt !== undefined ||
-        current.orgSlug !== tenant.org ||
-        current.appSlug !== tenant.app ||
-        current.environment !== tenant.env ||
-        current.accessMode !== input.expectedAccessMode ||
-        current.schemaVersion !== (input.expectedSchemaVersion ?? 1) ||
-        deploymentOwnerSubject(current) !== input.expectedOwnerSubject) {
+    const committed = resolveActiveAccessUpdate(state.records.get(observed.deploymentId), tenant, input);
+    if (committed === undefined)
         return undefined;
-    }
-    if ((current.accessMode ?? 'owner-only') === input.accessMode &&
-        (input.ownerSubject === undefined || deploymentOwnerSubject(current) === input.ownerSubject) &&
-        !requiresCustomerAuthProjection({ ...current, accessMode: input.accessMode }, input.serverAuth)) {
-        return current;
-    }
-    const committed = {
-        ...current,
-        accessMode: input.accessMode,
-        ...(input.ownerSubject !== undefined ? { ownerSubject: input.ownerSubject } : {}),
-        ...(requiresCustomerAuthProjection({ ...current, accessMode: input.accessMode }, input.serverAuth) && input.serverAuth !== undefined
-            ? { serverAuth: input.serverAuth }
-            : {}),
-    };
     const proposed = new Map(state.records).set(committed.deploymentId, committed);
     assertUniqueActiveCustomerAuthAudienceBindings([...proposed.values()]);
     state.records.set(committed.deploymentId, committed);