@noodleseed/one 0.166.0 → 0.168.0

package/node_modules/@noodle-borg/service/dist/registry-deploy-transaction.js

@@ -1,8 +1,10 @@
 import { normalizeServerVersion } from '@noodle-borg/module';
+import { deploymentAuthenticationFor } from './deployment-authentication.js';
 import { deploymentRecordVersionError } from './deployment-record-version.js';
+import { sameTenantRecord } from './deployment-versioning.js';
 import { deployAccessRequiresActor, deployerRequiredError, deploymentOwnerSubject, emptyMembershipSourcesError, membershipSourcesRequireOrgMembersError, missingCapabilityErrors, serverAuthRequiredError, } from './registry-helpers.js';
-import { activeRecord, activeRecordVersion } from './registry-state.js';
-import { idempotentDeploymentId, mintDeploymentId } from './registry-targets.js';
+import { activeRecordVersion } from './registry-state.js';
+import { emptySecretEnvelope, idempotentDeploymentId, mintDeploymentId, } from './registry-targets.js';
 /** Serialize candidate validation/activation with hierarchical configuration writers. */
 export async function withDeploymentConfiguration(config, org, work) {
     if (!config.transactConfig)
@@ -23,12 +25,8 @@ export async function withDeploymentConfiguration(config, org, work) {
 }
 /** Validate the exact destination scope before compilation or publication side effects. */
 export async function deploymentWriteVersionError(state, tenant, serverVersion) {
-    const active = serverVersion === undefined
-        ? await activeRecord(state, tenant)
-        : await activeRecordVersion(state, tenant, serverVersion);
-    return active !== undefined && active.serverVersion === serverVersion
-        ? deploymentRecordVersionError(active)
-        : undefined;
+    const active = await activeDeploymentWriteScope(state, tenant, serverVersion);
+    return active === undefined ? undefined : deploymentRecordVersionError(active);
 }
 export async function preflightRegistryDeploy(input) {
     const { actor, accessMode, orgMembershipSources } = input.options;
@@ -43,6 +41,9 @@ export async function preflightRegistryDeploy(input) {
     const artifact = built.ok ? built.served.artifact : built.compiledArtifact;
     if (artifact !== undefined) {
         errors.push(...missingCapabilityErrors(artifact.requirements?.capabilities ?? [], input.serviceCapabilities));
+        if (accessMode === 'mixed' && artifact.server.auth !== undefined && actor === undefined) {
+            errors.push(...deployerRequiredError(accessMode).errors);
+        }
         if (accessMode === 'customers' && artifact.server.auth === undefined) {
             errors.push(...serverAuthRequiredError().errors);
         }
@@ -93,18 +94,23 @@ export async function resolveDeployAttempt(input) {
             },
         };
     }
-    const ownerSubject = deploymentOwnerSubject(existing);
     return {
         deploymentId,
-        replay: {
-            ok: true,
-            deploymentId: existing.deploymentId,
-            deploymentVersion: existing.deploymentVersion,
-            ...(existing.serverVersion !== undefined ? { serverVersion: existing.serverVersion } : {}),
-            ...(existing.accessMode !== undefined ? { accessMode: existing.accessMode } : {}),
-            ...(ownerSubject !== undefined ? { ownerSubject } : {}),
-            replayed: true,
-        },
+        replay: { ...deployedRecordResult(existing), replayed: true },
+    };
+}
+/** Deploy and retry responses report the committed operator policy, never the requested intent. */
+export function deployedRecordResult(record) {
+    const ownerSubject = deploymentOwnerSubject(record);
+    const authentication = deploymentAuthenticationFor(record);
+    return {
+        ok: true,
+        deploymentId: record.deploymentId,
+        deploymentVersion: record.deploymentVersion,
+        ...(record.serverVersion !== undefined ? { serverVersion: record.serverVersion } : {}),
+        ...(record.accessMode !== undefined ? { accessMode: record.accessMode } : {}),
+        ...(authentication !== undefined ? { authentication } : {}),
+        ...(ownerSubject !== undefined ? { ownerSubject } : {}),
     };
 }
 function sameIdempotentDeploy(record, tenant, manifest, options) {
@@ -117,14 +123,83 @@ function sameIdempotentDeploy(record, tenant, manifest, options) {
         record.serverVersion === serverVersion &&
         record.manifest === manifest &&
         record.connectors === options.connectors &&
-        record.accessMode === options.accessMode &&
+        (record.schemaVersion === 2 ||
+            (record.accessMode === options.accessMode &&
+                (options.accessMode !== 'owner-only' ||
+                    deploymentOwnerSubject(record) === (options.ownerSubject ?? options.actor?.subject)))) &&
         record.deploymentSource === options.deploymentSource &&
         sameJson(record.hostedAssets, options.hostedAssets) &&
-        sameJson(record.orgMembershipSources, options.orgMembershipSources) &&
-        (options.accessMode !== 'owner-only' ||
-            deploymentOwnerSubject(record) === (options.ownerSubject ?? options.actor?.subject)));
+        sameJson(record.orgMembershipSources, options.orgMembershipSources));
 }
 function sameJson(left, right) {
     return JSON.stringify(left) === JSON.stringify(right);
 }
+/** Writes target one exact scope; default routing deliberately prefers a versioned deployment. */
+async function activeDeploymentWriteScope(state, tenant, serverVersion) {
+    if (serverVersion !== undefined)
+        return activeRecordVersion(state, tenant, serverVersion);
+    // The existing store port has no unversioned point lookup. Read durable records, never a worker cache.
+    const records = state.store ? await state.store.loadAll() : [...state.records.values()];
+    return records
+        .filter((record) => record.active &&
+        record.archivedAt === undefined &&
+        record.serverVersion === undefined &&
+        sameTenantRecord(record, tenant))
+        .sort((a, b) => b.deploymentVersion - a.deploymentVersion)[0];
+}
+/** Existing dormant mixed declarations require an explicit operator adoption. */
+function mixedCustomerActivationError(previous, previousAuth, accessMode, auth) {
+    return previous?.schemaVersion === 1 &&
+        previous.accessMode === 'mixed' &&
+        previousAuth !== undefined &&
+        accessMode === 'mixed' &&
+        auth !== undefined
+        ? {
+            code: 'customer_auth_activation_required',
+            path: 'accessMode',
+            message: 'Activate customer authentication with noodle access set mixed before redeploying this existing mixed deployment.',
+        }
+        : undefined;
+}
+/** Bind replacement policy to the observed active revision before the atomic store write. */
+export async function replacementDeploymentPolicy(state, tenant, serverVersion, accessMode, auth, compile) {
+    const previous = await activeDeploymentWriteScope(state, tenant, serverVersion);
+    const previousBuilt = previous === undefined ? undefined : await compile(previous);
+    return {
+        previous,
+        schemaVersion: previous?.schemaVersion === 2 || (accessMode === 'mixed' && auth !== undefined) ? 2 : 1,
+        error: mixedCustomerActivationError(previous, previousBuilt?.ok ? previousBuilt.served.artifact.server.auth : previous?.serverAuth, accessMode, auth),
+    };
+}
+/** Construct one immutable deployment candidate from compiled source and resolved operator policy. */
+export function createRegistryDeployRecord(input) {
+    const { safeTenant, safeServerVersion, deploymentId, version, built, manifest, options, schemaVersion, appPackageSnapshot, } = input;
+    const { actor, accessMode, automationId, deploymentSource, orgMembershipSources, connectors, hostedAssets, } = options;
+    const serverAuth = built.artifact.server.auth;
+    const ownerSubject = accessMode === 'owner-only' ? (options.ownerSubject ?? actor?.subject) : undefined;
+    const record = {
+        schemaVersion,
+        deploymentId,
+        orgSlug: safeTenant.org,
+        appSlug: safeTenant.app,
+        environment: safeTenant.env,
+        ...(safeServerVersion !== undefined ? { serverVersion: safeServerVersion } : {}),
+        deploymentVersion: version,
+        active: automationId === undefined,
+        serverName: built.artifact.server.name,
+        createdAt: new Date().toISOString(),
+        ...(actor ? { createdBySubject: actor.subject, createdByEmail: actor.email } : {}),
+        ...(ownerSubject !== undefined ? { ownerSubject } : {}),
+        ...(deploymentSource !== undefined ? { deploymentSource } : {}),
+        ...(accessMode !== undefined ? { accessMode } : {}),
+        ...(orgMembershipSources !== undefined ? { orgMembershipSources } : {}),
+        ...(serverAuth !== undefined ? { serverAuth } : {}),
+        manifest,
+        ...(connectors !== undefined ? { connectors } : {}),
+        ...(hostedAssets !== undefined && hostedAssets.length > 0 ? { hostedAssets } : {}),
+        ...(appPackageSnapshot !== undefined ? { appPackageSnapshot } : {}),
+        secrets: emptySecretEnvelope(),
+    };
+    return record;
+}
 //# sourceMappingURL=registry-deploy-transaction.js.map

package/node_modules/@noodle-borg/service/dist/registry-rollback.js

@@ -1,3 +1,4 @@
+import { hasExactCustomerAuthProjection } from './customer-auth-audience-binding.js';
 import { withDeploymentConfiguration } from './registry-deploy-transaction.js';
 import { deploymentOwnerSubject, missingCapabilityErrors } from './registry-helpers.js';
 import { activateInMemory } from './registry-state.js';
@@ -52,9 +53,18 @@ export async function rollbackDeployment(state, ref, deploymentId, compilePersis
         };
     }
     const compiledAuth = built.served.artifact.server.auth;
+    if (target.serverAuth !== undefined && !hasExactCustomerAuthProjection(target, compiledAuth)) {
+        return {
+            ok: false,
+            status: 409,
+            error: 'deployment cannot be activated: server_auth_required',
+        };
+    }
     const projectedTarget = {
         ...target,
-        ...(target.accessMode === 'customers' && compiledAuth !== undefined
+        ...((target.accessMode === 'customers' ||
+            (target.schemaVersion === 2 && target.accessMode === 'mixed')) &&
+            compiledAuth !== undefined
             ? { serverAuth: compiledAuth }
             : {}),
     };
@@ -76,11 +86,13 @@ export async function rollbackDeployment(state, ref, deploymentId, compilePersis
         ? await state.store.activateDeployment(ref, deploymentId, {
             expectedAccessMode: target.accessMode,
             expectedSchemaVersion: target.schemaVersion,
+            expectedRevision: target,
             ...(compiledAuth !== undefined ? { serverAuth: compiledAuth } : {}),
         })
         : activateInMemory(state.records, ref, deploymentId, {
             expectedAccessMode: target.accessMode,
             expectedSchemaVersion: target.schemaVersion,
+            expectedRevision: target,
             ...(compiledAuth !== undefined ? { serverAuth: compiledAuth } : {}),
         });
     if (activation === undefined) {

package/node_modules/@noodle-borg/service/dist/registry-state.d.ts

@@ -1,5 +1,5 @@
 import type { ServedTarget } from '@noodle-borg/transport-http';
-import type { AppArchiveResult, AppRestoreResult, AppSummary, ArtifactStore, CustomerAuthRestoreProjection, DeploymentLock, DeploymentLockUpdateResult, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from './store.js';
+import type { AppArchiveResult, AppRestoreResult, AppSummary, ArtifactStore, CustomerAuthRestoreProjection, DeploymentActivationPrecondition, DeploymentLock, DeploymentLockUpdateResult, DeploymentPolicyPrecondition, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from './store.js';
 export interface RegistryStateView {
     readonly store: ArtifactStore | undefined;
     readonly records: Map<string, DeployRecord>;
@@ -32,13 +32,9 @@ export declare function reconcilePlatformAccountResetRegistryCache(state: Regist
  * store owns deactivation; without one the caches are reconciled in-process so no instance serves a stale
  * active record.
  */
-export declare function persistDeployRecord(view: RegistryStateView, record: DeployRecord, tenant: TenantRef, activatesNow: boolean): Promise<DeployRecord>;
+export declare function persistDeployRecord(view: RegistryStateView, record: DeployRecord, tenant: TenantRef, activatesNow: boolean, precondition?: DeploymentPolicyPrecondition): Promise<DeployRecord>;
 /** No-store activation fallback (moved verbatim from `ServerRegistry.#activateInMemory`). */
-export declare function activateInMemory(records: Map<string, DeployRecord>, ref: TenantRef, deploymentId: string, precondition?: {
-    readonly expectedAccessMode: DeployRecord['accessMode'];
-    readonly expectedSchemaVersion?: number;
-    readonly serverAuth?: DeployRecord['serverAuth'];
-}): {
+export declare function activateInMemory(records: Map<string, DeployRecord>, ref: TenantRef, deploymentId: string, precondition?: DeploymentActivationPrecondition): {
     readonly active: DeployRecord;
     readonly previousActive?: DeployRecord;
     readonly alreadyActive: boolean;

package/node_modules/@noodle-borg/service/dist/registry-state.js

@@ -6,8 +6,9 @@
  */
 import { normalizeServerVersion } from '@noodle-borg/module';
 import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, CustomerAuthAudienceProjectionError, hasExactCustomerAuthProjection, requiresCustomerAuthProjection, } from './customer-auth-audience-binding.js';
+import { matchesDeploymentActivation } from './deployment-activation-precondition.js';
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from './deployment-lock.js';
-import { assertDeploymentAppendVersion } from './deployment-record-version.js';
+import { assertDeploymentAppendPolicy, assertDeploymentAppendVersion, } from './deployment-record-version.js';
 import { defaultActiveRecord } from './deployment-versioning.js';
 import { recordMatchesTenant, tenantDeploymentKey, tenantKey } from './registry-targets.js';
 import { appArchivedAt, deploymentSummary, paginateAppSummaries, planAppArchive, planAppRestore, planArchivedAppSweep, resolveProductionEnvironment, summarizeApps, summarizeEnvs, withoutArchiveStamp, } from './store/records.js';
@@ -27,15 +28,16 @@ export function reconcilePlatformAccountResetRegistryCache(state, input) {
  * store owns deactivation; without one the caches are reconciled in-process so no instance serves a stale
  * active record.
  */
-export async function persistDeployRecord(view, record, tenant, activatesNow) {
+export async function persistDeployRecord(view, record, tenant, activatesNow, precondition) {
     if (view.store) {
-        await view.store.append(record);
+        await view.store.append(record, precondition);
         const persisted = (await view.store.get(record.deploymentId)) ?? record;
         view.records.set(record.deploymentId, persisted);
         return persisted;
     }
     else {
         assertDeploymentAppendVersion([...view.records.values()], record);
+        assertDeploymentAppendPolicy([...view.records.values()], record, precondition);
         if (!assertDeploymentAppendUnlocked([...view.records.values()], record)) {
             return view.records.get(record.deploymentId);
         }
@@ -68,8 +70,7 @@ export function activateInMemory(records, ref, deploymentId, precondition) {
     if (target === undefined || !recordMatchesTenant(target, ref))
         return undefined;
     assertDeploymentActivationUnlocked([...records.values()], target);
-    if (target.schemaVersion !== (precondition?.expectedSchemaVersion ?? 1) ||
-        (precondition !== undefined && target.accessMode !== precondition.expectedAccessMode)) {
+    if (!matchesDeploymentActivation(target, precondition)) {
         return undefined;
     }
     const previousActive = [...records.values()]

package/node_modules/@noodle-borg/service/dist/registry-status.js

@@ -1,15 +1,14 @@
 import { tenantMcpUrl } from '@noodle-borg/module';
+import { hasExactCustomerAuthProjection } from './customer-auth-audience-binding.js';
 import { deploymentAuthenticationFor } from './deployment-authentication.js';
 import { deploymentOwnerSubject, missingSecretNames } from './registry-helpers.js';
 /** Project one compiled deployment into the control-plane status contract. */
 export function deploymentStatusFor(ref, record, built, baseUrl, endpointOptions) {
     const missingSecrets = built.ok ? [] : missingSecretNames(built.errors);
-    const missingCustomerAuth = built.ok &&
-        record.accessMode === 'customers' &&
-        built.served.artifact.server.auth === undefined;
+    const missingCustomerAuth = built.ok && !hasExactCustomerAuthProjection(record, built.served.artifact.server.auth);
     const unhealthy = missingCustomerAuth || (!built.ok && missingSecrets.length === 0);
     const ownerSubject = deploymentOwnerSubject(record);
-    const authentication = deploymentAuthenticationFor(record);
+    const authentication = deploymentAuthenticationFor(record, built.ok ? built.served.artifact.server.auth : undefined);
     return {
         target: ref,
         deployment: {

package/node_modules/@noodle-borg/service/dist/registry-targets.js

@@ -1,10 +1,11 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { RECORD_CONNECTOR_ID } from '@noodle-borg/compiler';
 import { parseAppPackageSnapshot } from './app-package-snapshot.js';
-import { hasExactCustomerAuthProjection } from './customer-auth-audience-binding.js';
+import { hasExactCustomerAuthProjection, requiresCustomerAuthProjection, } from './customer-auth-audience-binding.js';
 import { deploymentRecordVersionError } from './deployment-record-version.js';
 import { deploymentOwnerSubject } from './registry-helpers.js';
 import { validateTenantRef } from './store.js';
+const targetPolicyVersions = new WeakMap();
 /** Replace only the platform record port; unrelated compiled runtime ports retain their authority. */
 export function rebindNativeRecords(target, record, factory) {
     const native = factory?.({
@@ -13,7 +14,7 @@ export function rebindNativeRecords(target, record, factory) {
         deploymentId: record.deploymentId,
     });
     const previous = target.served.deps.connectors;
-    return {
+    return rememberTargetPolicy(record, {
         ...target,
         served: {
             ...target.served,
@@ -28,7 +29,7 @@ export function rebindNativeRecords(target, record, factory) {
                 },
             },
         },
-    };
+    });
 }
 /**
  * Build the front-door {@link ServedTarget} for a persisted record: its access mode plus the credential the
@@ -42,8 +43,9 @@ export function servedTargetFor(record, served, customerVerifierFactory) {
     if (accessMode === undefined) {
         throw new Error(`deployment ${record.deploymentId} has unsupported legacy access mode`);
     }
-    const customerAuth = accessMode === 'customers' ? served.artifact.server.auth : undefined;
-    if (accessMode === 'customers' && customerAuth === undefined) {
+    const customerOwned = requiresCustomerAuthProjection(record, served.artifact.server.auth);
+    const customerAuth = customerOwned ? served.artifact.server.auth : undefined;
+    if (customerOwned && customerAuth === undefined) {
         throw new MissingCustomerAuthError(record.deploymentId);
     }
     if (!hasExactCustomerAuthProjection(record, customerAuth)) {
@@ -51,7 +53,7 @@ export function servedTargetFor(record, served, customerVerifierFactory) {
     }
     const boundServed = bindAppPackageSnapshot(served, record.appPackageSnapshot);
     const ownerSubject = deploymentOwnerSubject(record);
-    return {
+    return rememberTargetPolicy(record, {
         served: boundServed,
         deploymentId: record.deploymentId,
         accessMode,
@@ -62,10 +64,10 @@ export function servedTargetFor(record, served, customerVerifierFactory) {
             ? { orgMembershipSources: record.orgMembershipSources }
             : {}),
         ...(accessMode === 'owner-only' && ownerSubject !== undefined ? { ownerSubject } : {}),
-        ...(customerAuth !== undefined
+        authentication: customerAuth !== undefined
             ? customerTargetFields(customerAuth, customerVerifierFactory)
-            : {}),
-    };
+            : { kind: 'platform' },
+    });
 }
 class MissingCustomerAuthError extends Error {
     deploymentId;
@@ -90,6 +92,10 @@ function servedTargetMatchesRecord(target, record) {
     const expectedMembership = record.accessMode === 'org-members' ? record.orgMembershipSources : undefined;
     return (target.deploymentId === record.deploymentId &&
         target.accessMode === record.accessMode &&
+        target.authentication?.kind ===
+            (requiresCustomerAuthProjection(record, target.served.artifact.server.auth)
+                ? 'customer'
+                : 'platform') &&
         target.org === record.orgSlug &&
         target.app === record.appSlug &&
         target.environment === record.environment &&
@@ -105,6 +111,7 @@ function bindAppPackageSnapshot(served, value) {
 /** Reconcile one persisted record with its cached served target without trusting stale auth projections. */
 export async function targetForPersistedRecord(record, state) {
     const cached = state.servers.get(record.deploymentId);
+    const cachedSchemaVersion = cached === undefined ? undefined : targetPolicyVersions.get(cached);
     state.records.set(record.deploymentId, record);
     if (deploymentRecordVersionError(record) !== undefined) {
         state.servers.delete(record.deploymentId);
@@ -120,7 +127,7 @@ export async function targetForPersistedRecord(record, state) {
         (await state.hasCustomerAuthConflict(record, cached.served.artifact.server.auth))) {
         return undefined;
     }
-    if (servedTargetMatchesRecord(cached, record))
+    if (cachedSchemaVersion === record.schemaVersion && servedTargetMatchesRecord(cached, record))
         return cached;
     const reconciled = servedTargetFor(record, cached.served, state.customerVerifierFactory);
     state.servers.set(record.deploymentId, reconciled);
@@ -134,33 +141,29 @@ function sameStrings(left, right) {
             left.every((value, index) => value === right[index])));
 }
 function customerTargetFields(auth, customerVerifierFactory) {
-    if (auth.kind === 'bridge') {
-        return {
-            verifyToken: customerVerifierFactory?.(auth) ?? denyAllCustomerToken,
-        };
-    }
-    if (auth.kind === 'federatedOidc') {
-        const issuers = auth.issuers.map((issuer) => issuer.issuer);
-        return {
-            ...(issuers[0] === undefined ? {} : { authServerIssuer: issuers[0] }),
-            authServerIssuers: issuers,
-            verifyToken: customerVerifierFactory?.(auth) ?? denyAllCustomerToken,
-        };
-    }
     return {
-        authServerIssuer: auth.issuer,
-        verifyToken: customerVerifierFactory?.(auth) ?? denyAllCustomerToken,
+        kind: 'customer',
+        ...(auth.kind === 'bridge'
+            ? {}
+            : {
+                authorizationServers: auth.kind === 'federatedOidc'
+                    ? auth.issuers.map((issuer) => issuer.issuer)
+                    : [auth.issuer],
+            }),
+        ...(customerVerifierFactory === undefined
+            ? {}
+            : { verifyToken: customerVerifierFactory(auth) }),
     };
 }
-const denyAllCustomerToken = async () => null;
 export async function authorizationMetadataForTenant(registry, tenant) {
     const target = tenant.serverVersion === undefined
         ? await registry.getActiveByTenant(tenant)
         : await registry.getActiveByTenantVersion(tenant, tenant.serverVersion);
     if (target === undefined)
         return undefined;
-    const authorizationServers = target.authServerIssuers ??
-        (target.authServerIssuer === undefined ? undefined : [target.authServerIssuer]);
+    const authorizationServers = target.authentication?.kind === 'customer'
+        ? target.authentication.authorizationServers
+        : undefined;
     const requiredScopes = [
         ...new Set(target.served.artifact.tools.flatMap((tool) => tool.authorization?.requiredScopes ?? [])),
     ].sort();
@@ -220,4 +223,8 @@ export async function deploymentSourceFor(state, tenant, deploymentId) {
         ...(record.serverVersion === undefined ? {} : { serverVersion: record.serverVersion }),
     };
 }
+function rememberTargetPolicy(record, target) {
+    targetPolicyVersions.set(target, record.schemaVersion);
+    return target;
+}
 //# sourceMappingURL=registry-targets.js.map

package/node_modules/@noodle-borg/service/dist/registry-types.d.ts

@@ -4,7 +4,7 @@ import type { ControlPlaneIdentity } from '@noodle-borg/control-plane/portable';
 import type { OrgMembershipSource, PolicyGate } from '@noodle-borg/module';
 import type { Connector } from '@noodle-borg/runtime';
 import type { AccessMode, OwnerTokenVerifier } from '@noodle-borg/transport-http';
-import type { DeploymentSource } from '@noodle-borg/wire-contracts';
+import type { DeploymentAuthentication, DeploymentSource } from '@noodle-borg/wire-contracts';
 import type { AppPackageRenderer } from './app-package-snapshot.js';
 import type { DelegatedExchangeOptions } from './delegated-token-exchange.js';
 import type { ExternalCredentialExchangeRuntimeOptions } from './external-credential-exchange.js';
@@ -49,6 +49,7 @@ export type DeployResult = {
     readonly deploymentVersion: number;
     readonly serverVersion?: string;
     readonly accessMode?: AccessMode;
+    readonly authentication?: DeploymentAuthentication;
     readonly ownerSubject?: string;
     readonly replayed?: boolean;
 } | {
@@ -78,6 +79,7 @@ export type AccessUpdateResult = {
     readonly ok: true;
     readonly changed: boolean;
     readonly accessChanged: boolean;
+    readonly policyChanged: boolean;
     readonly ownerChanged: boolean;
     readonly previousAccessMode: AccessMode;
     readonly previousOwnerSubject?: string;

package/node_modules/@noodle-borg/service/dist/registry.js

@@ -2,18 +2,18 @@ import { KnowledgePublicationError, withKnowledgePublication, } from '@noodle-bo
 import { DeploymentActivationError, normalizeServerVersion, } from '@noodle-borg/module';
 import { CustomerAuthAudienceConflictError, customerAuthAudienceConflictFailure, hasActiveCustomerAuthAudienceConflict, } from './customer-auth-audience-binding.js';
 import { DeploymentLockedError, deploymentLockedConflict, deploymentLockedPreflight, } from './deployment-lock.js';
-import { UnsupportedDeploymentRecordVersionError, unsupportedDeploymentRecordFailure, } from './deployment-record-version.js';
+import { DeploymentPolicyChangedError, UnsupportedDeploymentRecordVersionError, unsupportedDeploymentRecordFailure, } from './deployment-record-version.js';
 import { defaultActiveRecord } from './deployment-versioning.js';
 import { updateRegistryAccess } from './registry-access.js';
 import { compilePersistedRegistryRecord, compileRegistryTarget, loadPersistedRegistryTarget, } from './registry-compile.js';
-import { deploymentWriteVersionError, preflightRegistryDeploy, resolveDeployAttempt, withDeploymentConfiguration, } from './registry-deploy-transaction.js';
+import { createRegistryDeployRecord, deployedRecordResult, deploymentWriteVersionError, preflightRegistryDeploy, replacementDeploymentPolicy, resolveDeployAttempt, withDeploymentConfiguration, } from './registry-deploy-transaction.js';
 import { deploymentOwnerSubject } from './registry-helpers.js';
 import { registryDeploymentPackage, renderDeploymentPackageSnapshot } from './registry-package.js';
 import { recoverRegistryRecords } from './registry-recover.js';
 import { rollbackDeployment, rollbackWithMappedErrors } from './registry-rollback.js';
 import { activeRecord, activeRecordVersion, persistDeployRecord, reconcilePlatformAccountResetRegistryCache, registryAppArchivedAt, registryArchiveApp, registryCustomerAuthRestoreProjections, registryGetApp, registryGetDeployment, registryGetEnvironment, registryListApps, registryListEnvironments, registryRestoreApp, registrySetProductionEnvironment, registrySweepArchived, setRegistryDeploymentLock, } from './registry-state.js';
 import { deploymentStatusFor } from './registry-status.js';
-import { deploymentSourceFor, emptySecretEnvelope, rebindNativeRecords, servedTargetFor, targetForPersistedRecord, tenantDeploymentKey, tenantKey, } from './registry-targets.js';
+import { deploymentSourceFor, rebindNativeRecords, servedTargetFor, targetForPersistedRecord, tenantDeploymentKey, tenantKey, } from './registry-targets.js';
 import { withBuiltinStateCatalog } from './state-catalog.js';
 import { deploymentSummary, matchesDeploymentFilter, validateDeploymentListFilter, } from './store/records.js';
 import { InMemoryConfigStore, validateTenantRef, } from './store.js';
@@ -109,8 +109,7 @@ export class ServerRegistry {
     }
     async deploy(tenant, manifest, options = {}) {
         return withDeploymentConfiguration(this.#configStore, tenant.org, async () => {
-            const { connectors, actor, accessMode, hostedAssets, serverVersion, deploymentSource, idempotencyKey, } = options;
-            const { orgMembershipSources } = options;
+            const { connectors, accessMode, hostedAssets, serverVersion, idempotencyKey } = options;
             const { automationId } = options;
             const safeTenant = validateTenantRef(tenant);
             const safeServerVersion = serverVersion !== undefined ? normalizeServerVersion(serverVersion) : undefined;
@@ -151,38 +150,35 @@ export class ServerRegistry {
             const version = Date.now();
             const built = preflight.bindDeployment(deploymentId);
             const serverAuth = built.artifact.server.auth;
-            const ownerSubject = accessMode === 'owner-only' ? (options.ownerSubject ?? actor?.subject) : undefined;
-            const record = {
-                schemaVersion: 1,
+            const policy = await replacementDeploymentPolicy(this.#stateView(), safeTenant, safeServerVersion, accessMode, serverAuth, (previous) => this.#compilePersistedRecord(previous));
+            if (policy.error !== undefined)
+                return { ok: false, errors: [policy.error] };
+            const record = createRegistryDeployRecord({
+                safeTenant,
+                safeServerVersion,
                 deploymentId,
-                orgSlug: safeTenant.org,
-                appSlug: safeTenant.app,
-                environment: safeTenant.env,
-                ...(safeServerVersion !== undefined ? { serverVersion: safeServerVersion } : {}),
-                deploymentVersion: version,
-                active: automationId === undefined,
-                serverName: built.artifact.server.name,
-                createdAt: new Date().toISOString(),
-                ...(actor ? { createdBySubject: actor.subject, createdByEmail: actor.email } : {}),
-                ...(ownerSubject !== undefined ? { ownerSubject } : {}),
-                ...(deploymentSource !== undefined ? { deploymentSource } : {}),
-                ...(accessMode !== undefined ? { accessMode } : {}),
-                ...(orgMembershipSources !== undefined ? { orgMembershipSources } : {}),
-                ...(serverAuth !== undefined ? { serverAuth } : {}),
+                version,
+                built,
                 manifest,
-                ...(connectors !== undefined ? { connectors } : {}),
-                ...(hostedAssets !== undefined && hostedAssets.length > 0 ? { hostedAssets } : {}),
-                ...(appPackageSnapshot !== undefined ? { appPackageSnapshot } : {}),
-                secrets: emptySecretEnvelope(),
-            };
+                options,
+                schemaVersion: policy.schemaVersion,
+                appPackageSnapshot,
+            });
             if (await this.#hasCustomerAuthAudienceConflict(record, serverAuth)) {
                 return customerAuthAudienceConflictFailure();
             }
             let active;
             try {
-                active = await withKnowledgePublication(this.#knowledgeHooks, safeTenant, deploymentId, built.artifact.server.knowledge, () => persistDeployRecord(this.#stateView(), record, safeTenant, automationId === undefined));
+                active = await withKnowledgePublication(this.#knowledgeHooks, safeTenant, deploymentId, built.artifact.server.knowledge, () => persistDeployRecord(this.#stateView(), record, safeTenant, automationId === undefined, {
+                    active: policy.previous ?? null,
+                }));
             }
             catch (error) {
+                if (error instanceof DeploymentPolicyChangedError)
+                    return {
+                        ok: false,
+                        errors: [{ code: error.code, path: 'accessMode', message: error.message }],
+                    };
                 if (error instanceof KnowledgePublicationError) {
                     return { ok: false, errors: error.errors };
                 }
@@ -198,7 +194,12 @@ export class ServerRegistry {
             if (automationId !== undefined) {
                 let activation;
                 try {
-                    activation = await this.#store?.activateDeployment(safeTenant, deploymentId, undefined, {
+                    activation = await this.#store?.activateDeployment(safeTenant, deploymentId, {
+                        expectedSchemaVersion: record.schemaVersion,
+                        expectedAccessMode: record.accessMode,
+                        expectedRevision: record,
+                        expectedActivePolicy: { active: policy.previous ?? null },
+                    }, {
                         automationId,
                     });
                 }
@@ -213,6 +214,11 @@ export class ServerRegistry {
                             ...(safeServerVersion !== undefined ? { serverVersion: safeServerVersion } : {}),
                         };
                     }
+                    if (error instanceof DeploymentPolicyChangedError)
+                        return {
+                            ok: false,
+                            errors: [{ code: error.code, path: 'accessMode', message: error.message }],
+                        };
                     if (error instanceof CustomerAuthAudienceConflictError) {
                         return customerAuthAudienceConflictFailure();
                     }
@@ -247,15 +253,7 @@ export class ServerRegistry {
             this.#servers.set(deploymentId, servedTargetFor(active, built, this.#customerVerifierFactory));
             this.#activeTenants.set(tenantDeploymentKey(safeTenant, safeServerVersion), deploymentId);
             this.#activeTenants.delete(tenantKey(safeTenant));
-            const activeOwnerSubject = deploymentOwnerSubject(active);
-            return {
-                ok: true,
-                deploymentId,
-                deploymentVersion: version,
-                ...(safeServerVersion !== undefined ? { serverVersion: safeServerVersion } : {}),
-                ...(accessMode !== undefined ? { accessMode } : {}),
-                ...(activeOwnerSubject !== undefined ? { ownerSubject: activeOwnerSubject } : {}),
-            };
+            return deployedRecordResult(active);
         });
     }
     /** Read-only deploy validation used by the CLI before config writes, asset upload, or persistence. */
@@ -277,7 +275,10 @@ export class ServerRegistry {
             serviceCapabilities: this.#serviceCapabilities,
             compile: () => this.#compileTarget(safeTenant, manifest, options.connectors, options.hostedAssets, true),
         });
-        return result.ok ? { ok: true } : result;
+        if (!result.ok)
+            return result;
+        const policy = await replacementDeploymentPolicy(this.#stateView(), safeTenant, safeServerVersion, options.accessMode, result.bindDeployment('preflight').artifact.server.auth, (previous) => this.#compilePersistedRecord(previous));
+        return policy.error === undefined ? { ok: true } : { ok: false, errors: [policy.error] };
     }
     async recover() {
         if (!this.#store)

package/node_modules/@noodle-borg/service/dist/routes/access.js

@@ -65,7 +65,9 @@ export async function handleAccessUpdate(req, res, registry, gate, controlPlane,
             ...(ownerSubject !== undefined ? { ownerSubject } : {}),
             accessChanged: result.accessChanged,
             ownerChanged: result.ownerChanged,
-            ...(authentication !== undefined ? { authentication, policyChanged: false } : {}),
+            ...(authentication !== undefined
+                ? { authentication, policyChanged: result.policyChanged }
+                : {}),
             changed: result.changed,
         },
     });
@@ -87,7 +89,7 @@ export async function handleAccessUpdate(req, res, registry, gate, controlPlane,
             : {}),
         accessChanged: result.accessChanged,
         ownerChanged: result.ownerChanged,
-        ...(authentication !== undefined ? { policyChanged: false } : {}),
+        ...(authentication !== undefined ? { policyChanged: result.policyChanged } : {}),
         changed: result.changed,
     });
 }

package/node_modules/@noodle-borg/service/dist/routes/auth-doctor-live.js

@@ -19,7 +19,8 @@ export async function handleLiveAuthDoctor(req, res, registry, tenant, options)
         : await registry.getActiveByTenantVersion(tenant, serverVersion);
     if (target === undefined)
         return sendJson(res, 404, { ok: false, error: 'deployment not found' });
-    if (target.accessMode !== 'customers' || target.verifyToken === undefined) {
+    if (target.authentication?.kind !== 'customer' ||
+        target.authentication.verifyToken === undefined) {
         return sendJson(res, 409, {
             ok: false,
             error: 'live auth doctor requires a customers deployment with customer auth',
@@ -30,7 +31,7 @@ export async function handleLiveAuthDoctor(req, res, registry, tenant, options)
         return sendJson(res, 401, { ok: false, error: 'missing customer bearer token' });
     const endpointOptions = await options.resolveEndpointOptions?.(tenant.org);
     const resource = tenantMcpUrl(options.serviceBase, tenant, serverVersion, endpointOptions);
-    const verification = await target.verifyToken(token, resource).catch(() => null);
+    const verification = await target.authentication.verifyToken(token, resource).catch(() => null);
     if (verification === null || verification.caller.identityKind !== 'customer') {
         return sendJson(res, 401, { ok: false, error: 'customer token verification failed' });
     }