@noodleseed/one 0.168.0 → 0.169.0

package/node_modules/@noodle-borg/control-plane/dist/delete-deployment.js

@@ -0,0 +1,105 @@
+const ERRORS = {
+    deployment_not_found: 'Deployment not found.',
+    version_not_found: 'Version not found.',
+    active_deployment: 'Roll back to another deployment before deleting the live deployment, or delete the whole version.',
+    deployment_locked: 'Unlock this version before deleting it.',
+    app_archived: 'Restore the archived app before deleting its deployments.',
+    deployment_delete_conflict: 'The deployment history changed. Refresh and review it before deleting.',
+};
+/** One owner-authorized deletion path for every host; stores commit the exact selection atomically. */
+export async function deleteDeploymentOperation(deps, input) {
+    const { actor: identity, scope: route } = input;
+    const org = route.kind === 'version' ? route.target.org : route.org;
+    const member = identity.superAdmin
+        ? undefined
+        : await deps.controlPlane.getOrgMember({ org, subject: identity.subject });
+    if (identity.developerGrantId !== undefined ||
+        (!identity.superAdmin && member?.role !== 'owner')) {
+        return {
+            ok: false,
+            status: 403,
+            code: 'organization_owner_required',
+            error: 'Only an organization owner can delete deployments or versions.',
+        };
+    }
+    let target;
+    let selection;
+    if (route.kind === 'deployment') {
+        const record = await deps.registry.getDeployment(route.org, route.deploymentId);
+        if (!record)
+            return {
+                ok: false,
+                status: 404,
+                code: 'deployment_not_found',
+                error: ERRORS.deployment_not_found,
+            };
+        target = { org: record.orgSlug, app: record.appSlug, env: record.environment };
+        selection = { kind: 'deployment', deploymentId: route.deploymentId };
+    }
+    else {
+        if (!input.expectedDeploymentIds?.length)
+            return {
+                ok: false,
+                status: 400,
+                code: 'invalid_deletion_confirmation',
+                error: 'Invalid version deletion confirmation.',
+            };
+        target = route.target;
+        selection = {
+            kind: 'version',
+            expectedDeploymentIds: input.expectedDeploymentIds,
+            ...(route.serverVersion === undefined ? {} : { serverVersion: route.serverVersion }),
+        };
+    }
+    const result = await deps.registry.deleteDeployments(target, selection);
+    const status = result.ok
+        ? 200
+        : result.code === 'deployment_not_found' || result.code === 'version_not_found'
+            ? 404
+            : 409;
+    let auditRecorded = true;
+    try {
+        await deps.audit.emit({
+            eventType: result.ok
+                ? route.kind === 'version'
+                    ? 'deployment.version.deleted'
+                    : 'deployment.deleted'
+                : 'deployment.delete.rejected',
+            org: target.org,
+            app: target.app,
+            env: target.env,
+            ...(route.kind === 'deployment' ? { deploymentId: route.deploymentId } : {}),
+            actorSubject: identity.subject,
+            ...(identity.email === undefined ? {} : { actorEmail: identity.email }),
+            decision: result.ok ? 'allow' : 'deny',
+            status,
+            ...(!result.ok ? { reasonCode: result.code } : {}),
+            details: {
+                scope: route.kind,
+                ...(route.kind === 'version' ? { serverVersion: route.serverVersion ?? 'legacy' } : {}),
+                ...(result.ok ? { deletedDeployments: result.deleted.length } : {}),
+            },
+        });
+    }
+    catch {
+        // Deletion has already committed. An audit outage must not claim the records still exist.
+        auditRecorded = false;
+    }
+    if (!result.ok)
+        return {
+            ok: false,
+            status: status,
+            code: result.code,
+            error: ERRORS[result.code],
+        };
+    return {
+        ok: true,
+        view: {
+            ok: true,
+            target,
+            deletedDeploymentIds: result.deleted.map((record) => record.deploymentId),
+            auditRecorded,
+        },
+    };
+}
+//# sourceMappingURL=delete-deployment.js.map

package/node_modules/@noodle-borg/control-plane/dist/deployment-deletion-contracts.d.ts

@@ -0,0 +1,20 @@
+export type DeploymentDeleteSelection = {
+    readonly kind: 'deployment';
+    readonly deploymentId: string;
+} | {
+    readonly kind: 'version';
+    readonly serverVersion?: string;
+    readonly expectedDeploymentIds: readonly string[];
+};
+export type DeploymentDeleteResult<Record extends {
+    readonly deploymentId: string;
+} = {
+    readonly deploymentId: string;
+}> = {
+    readonly ok: true;
+    readonly deleted: readonly Record[];
+} | {
+    readonly ok: false;
+    readonly code: 'deployment_not_found' | 'version_not_found' | 'active_deployment' | 'deployment_locked' | 'app_archived' | 'deployment_delete_conflict';
+};
+//# sourceMappingURL=deployment-deletion-contracts.d.ts.map

package/node_modules/@noodle-borg/control-plane/dist/portable.d.ts

@@ -1,8 +1,10 @@
 export { type AppPurgeReconciliationActor, type AppPurgeReconciliationConflictCode, AppPurgeReconciliationError, type AppPurgeReconciliationOperator, } from './app-purge-reconciliation-port.js';
 export type { ActiveMcpSubdomainClaim, ChangeMcpSubdomainInput, ControlPlaneIdentity, CreateOrgWithOwnerInput, McpSubdomainMutationResult, McpSubdomainSetting, OrganizationStore, OrgDomainRecord, OrgInvitationRecord, OrgMemberRecord, OrgOpenAIAppsChallengeRecord, OrgRecord, OrgRole, PersonalWorkspaceProvisionInput, PersonalWorkspaceProvisionResult, SignupAllowlistKind, SignupAllowlistRecord, WelcomeEmailRecord, } from './contracts.js';
 export { PersonalWorkspaceOwnerMutationError } from './contracts.js';
+export { type DeploymentDeleteOperationResult, type DeploymentDeleteScope, type DeploymentDeletionDependencies, type DeploymentDeletionRegistry, deleteDeploymentOperation, } from './delete-deployment.js';
 export { allowAllGate, bearerToken, type ControlPlaneAuthResult, type DeployAuthGate, } from './deploy-auth.js';
 export { CompositeControlPlaneGate, type ControlPlaneSignupMode, GoogleControlPlaneGate, type GoogleControlPlaneGateOptions, type GoogleIdTokenVerifier, GoogleWorkloadControlPlaneGate, type GoogleWorkloadControlPlaneGateOptions, NoodleOAuthControlPlaneGate, type NoodleOAuthControlPlaneGateOptions, type SignupAuthorizer, } from './deploy-gates.js';
+export type { DeploymentDeleteResult, DeploymentDeleteSelection, } from './deployment-deletion-contracts.js';
 export { InMemoryControlPlaneStore } from './in-memory-control-plane-store.js';
 export { bindInMemoryOrganizationStore, type InMemoryOrganizationOperations, InMemoryOrganizationStore, } from './in-memory-organization-store.js';
 export { InMemoryMcpSubdomainClaimStore, McpSubdomainCooldownError, McpSubdomainIdempotencyConflictError, McpSubdomainOwnerRequiredError, type McpSubdomainRouteRef, McpSubdomainUnavailableError, mcpSubdomainEndpointOptions, type ResolvedMcpTenantRef, resolveMcpSubdomainTenant, } from './mcp-subdomain-claims.js';

package/node_modules/@noodle-borg/control-plane/dist/portable.js

@@ -1,5 +1,6 @@
 export { AppPurgeReconciliationError, } from './app-purge-reconciliation-port.js';
 export { PersonalWorkspaceOwnerMutationError } from './contracts.js';
+export { deleteDeploymentOperation, } from './delete-deployment.js';
 export { allowAllGate, bearerToken, } from './deploy-auth.js';
 export { CompositeControlPlaneGate, GoogleControlPlaneGate, GoogleWorkloadControlPlaneGate, NoodleOAuthControlPlaneGate, } from './deploy-gates.js';
 export { InMemoryControlPlaneStore } from './in-memory-control-plane-store.js';

package/node_modules/@noodle-borg/service/dist/deployment-deletion.js

@@ -0,0 +1,40 @@
+import { normalizeServerVersion } from '@noodle-borg/module';
+import { sameTenantRecord } from './deployment-versioning.js';
+import { validateTenantRef } from './store/validate.js';
+/** Shared, side-effect-free decision made inside each adapter's mutation boundary. */
+export function planDeploymentDeletion(records, ref, selection) {
+    const safe = validateTenantRef(ref);
+    const version = selection.kind === 'version' && selection.serverVersion !== undefined
+        ? normalizeServerVersion(selection.serverVersion)
+        : undefined;
+    const deleted = records.filter((record) => sameTenantRecord(record, safe) &&
+        (selection.kind === 'deployment'
+            ? record.deploymentId === selection.deploymentId
+            : record.serverVersion === version));
+    if (deleted.length === 0)
+        return {
+            ok: false,
+            code: selection.kind === 'deployment' ? 'deployment_not_found' : 'version_not_found',
+        };
+    if (records.some((record) => record.orgSlug === safe.org &&
+        record.appSlug === safe.app &&
+        record.archivedAt !== undefined)) {
+        return { ok: false, code: 'app_archived' };
+    }
+    if (selection.kind === 'deployment') {
+        if (deleted.some((record) => record.active))
+            return { ok: false, code: 'active_deployment' };
+    }
+    else {
+        if (deleted.some((record) => record.active && record.deploymentLock !== undefined))
+            return { ok: false, code: 'deployment_locked' };
+        const expected = new Set(selection.expectedDeploymentIds);
+        if (expected.size !== selection.expectedDeploymentIds.length ||
+            expected.size !== deleted.length ||
+            deleted.some((record) => !expected.has(record.deploymentId))) {
+            return { ok: false, code: 'deployment_delete_conflict' };
+        }
+    }
+    return { ok: true, deleted };
+}
+//# sourceMappingURL=deployment-deletion.js.map

package/node_modules/@noodle-borg/service/dist/registry-compile.js

@@ -9,6 +9,7 @@ import { ManagedConfigBroker } from './credential-broker.js';
 import { deploymentCredentialBrokerOptions } from './credential-broker-options.js';
 import { deploymentRecordVersionError } from './deployment-record-version.js';
 import { normalizePersistedManifestForCompile } from './manifest-normalize.js';
+import { registryRecordStillExists } from './registry-deletion.js';
 import { missingCapabilityErrors, missingSecretErrors, missingVariableErrors, } from './registry-helpers.js';
 import { servedTargetFor } from './registry-targets.js';
 import { createDeploymentStateConnector, } from './state-connector-factory.js';
@@ -252,6 +253,11 @@ export async function loadPersistedRegistryTarget(source, context) {
     if (record.active &&
         (await context.hasCustomerAuthConflict(record, built.served.artifact.server.auth)))
         return undefined;
+    const exists = state.store === undefined
+        ? state.records.has(deploymentId)
+        : await registryRecordStillExists(state, deploymentId);
+    if (!exists)
+        return undefined;
     const target = servedTargetFor(record, built.served, context.customerVerifierFactory);
     state.servers.set(deploymentId, target);
     state.records.set(deploymentId, record);

package/node_modules/@noodle-borg/service/dist/registry-deletion.js

@@ -0,0 +1,75 @@
+import { planDeploymentDeletion } from './deployment-deletion.js';
+import { targetForPersistedRecord } from './registry-targets.js';
+import { validateTenantRef } from './store/validate.js';
+export function evictDeletedDeployments(state, ids) {
+    for (const id of ids) {
+        state.records.delete(id);
+        state.servers.delete(id);
+    }
+    for (const [key, id] of state.activeTenants)
+        if (ids.has(id))
+            state.activeTenants.delete(key);
+}
+export async function deleteRegistryDeployments(state, ref, selection) {
+    const safe = validateTenantRef(ref);
+    const result = state.store === undefined
+        ? planDeploymentDeletion([...state.records.values()], safe, selection)
+        : await state.store.deleteDeployments(safe, selection);
+    if (result.ok)
+        evictDeletedDeployments(state, new Set(result.deleted.map((record) => record.deploymentId)));
+    return result;
+}
+/** Async compilation must rejoin authority before publishing a result into the disposable cache. */
+export async function registryRecordStillExists(state, deploymentId) {
+    const current = state.store === undefined
+        ? state.records.get(deploymentId)
+        : await state.store.get(deploymentId);
+    if (current !== undefined && current.archivedAt === undefined)
+        return true;
+    evictDeletedDeployments(state, new Set([deploymentId]));
+    return false;
+}
+/** Refresh warmed cache entries from authority and coalesce compilation on a cache miss. */
+export async function readRegistryTarget(state, deploymentId, inflight, targetForRecord, load) {
+    if (state.records.get(deploymentId)?.archivedAt !== undefined)
+        return undefined;
+    if (state.servers.has(deploymentId)) {
+        const record = state.store
+            ? await state.store.get(deploymentId)
+            : state.records.get(deploymentId);
+        if (record === undefined)
+            evictDeletedDeployments(state, new Set([deploymentId]));
+        return record === undefined || record.archivedAt !== undefined
+            ? undefined
+            : targetForRecord(record);
+    }
+    const pending = inflight.get(deploymentId);
+    if (pending)
+        return pending;
+    const promise = load(deploymentId).finally(() => {
+        inflight.delete(deploymentId);
+    });
+    inflight.set(deploymentId, promise);
+    return promise;
+}
+/** No-store records are authority, so stale reconciliation must never repopulate absent records. */
+export async function reconcileRegistryTarget(state, record, context) {
+    let loaded = false;
+    const target = await targetForPersistedRecord(record, {
+        ...context,
+        load: () => {
+            loaded = true;
+            return context.load();
+        },
+        records: state.records,
+        servers: state.servers,
+        recordStillPresent: () => state.store !== undefined || state.records.has(record.deploymentId),
+    });
+    // A cold load already checks store authority just before publication; warm reconciliation must too.
+    // No async presence snapshot in no-store mode: deletion and publication share one synchronous turn.
+    const exists = state.store === undefined
+        ? state.records.has(record.deploymentId)
+        : loaded || (await registryRecordStillExists(state, record.deploymentId));
+    return exists ? target : undefined;
+}
+//# sourceMappingURL=registry-deletion.js.map

package/node_modules/@noodle-borg/service/dist/registry-state.js

@@ -166,8 +166,10 @@ export async function setRegistryDeploymentLock(state, ref, serverVersion, expec
             state.records.set(result.record.deploymentId, result.record);
         return result;
     }
-    const active = await activeRecordVersion(state, safe, safeVersion);
-    if (active === undefined)
+    const observed = await activeRecordVersion(state, safe, safeVersion);
+    // The lookup yields; a concurrent deletion or pointer move must win before any cache write.
+    const active = observed === undefined ? undefined : state.records.get(observed.deploymentId);
+    if (active === undefined || !active.active || active.archivedAt !== undefined)
         return { ok: false, reason: 'no_active_deployment' };
     if (active.deploymentId !== expectedDeploymentId)
         return { ok: false, reason: 'conflict' };

package/node_modules/@noodle-borg/service/dist/registry-targets.js

@@ -110,6 +110,8 @@ function bindAppPackageSnapshot(served, value) {
 }
 /** Reconcile one persisted record with its cached served target without trusting stale auth projections. */
 export async function targetForPersistedRecord(record, state) {
+    if (state.recordStillPresent?.() === false)
+        return undefined;
     const cached = state.servers.get(record.deploymentId);
     const cachedSchemaVersion = cached === undefined ? undefined : targetPolicyVersions.get(cached);
     state.records.set(record.deploymentId, record);
@@ -127,6 +129,8 @@ export async function targetForPersistedRecord(record, state) {
         (await state.hasCustomerAuthConflict(record, cached.served.artifact.server.auth))) {
         return undefined;
     }
+    if (state.recordStillPresent?.() === false)
+        return undefined;
     if (cachedSchemaVersion === record.schemaVersion && servedTargetMatchesRecord(cached, record))
         return cached;
     const reconciled = servedTargetFor(record, cached.served, state.customerVerifierFactory);

package/node_modules/@noodle-borg/service/dist/registry.d.ts

@@ -9,6 +9,7 @@ import type { ServedTarget } from '@noodle-borg/transport-http';
 import type { NativeRecordConnectorFactory } from './native-record-connector.js';
 import { type ActiveDeployProvenance } from './registry-helpers.js';
 import type { AccessUpdateOptions, AccessUpdateResult, DeployOptions, DeployPreflightResult, RecoverResult, RunDeployResult, ServerRegistryOptions } from './registry-types.js';
+import type { DeploymentDeleteResult, DeploymentDeleteSelection } from './store.js';
 import { type AppArchiveResult, type AppRestoreResult, type AppSummary, type ArtifactStore, type ConfigStore, type CustomerAuthRestoreProjection, type DeploymentListFilter, type DeploymentLock, type DeploymentLockUpdateResult, type DeploymentStatus, type DeploymentSummary, type DeployRecord, type EnvSummary, type ProductionEnvironmentChange, type TenantRef } from './store.js';
 export type { RollbackResult } from '@noodle-borg/control-plane/portable';
 export type { DeploymentPackage } from './registry-package.js';
@@ -29,6 +30,7 @@ export declare class ServerRegistry {
     /** Read-only deploy validation used by the CLI before config writes, asset upload, or persistence. */
     preflightDeploy(tenant: TenantRef, manifest: string, options?: DeployOptions): Promise<DeployPreflightResult>;
     recover(): Promise<RecoverResult>;
+    deleteDeployments(ref: TenantRef, selection: DeploymentDeleteSelection): Promise<DeploymentDeleteResult>;
     get(deploymentId: string): Promise<ServedTarget | undefined>;
     /** Resolve a deployment-id data-plane route only while that exact record is actively serving. */
     getServing(deploymentId: string): Promise<ServedTarget | undefined>;

package/node_modules/@noodle-borg/service/dist/registry.js

@@ -6,6 +6,7 @@ import { DeploymentPolicyChangedError, UnsupportedDeploymentRecordVersionError,
 import { defaultActiveRecord } from './deployment-versioning.js';
 import { updateRegistryAccess } from './registry-access.js';
 import { compilePersistedRegistryRecord, compileRegistryTarget, loadPersistedRegistryTarget, } from './registry-compile.js';
+import { deleteRegistryDeployments, readRegistryTarget, reconcileRegistryTarget, } from './registry-deletion.js';
 import { createRegistryDeployRecord, deployedRecordResult, deploymentWriteVersionError, preflightRegistryDeploy, replacementDeploymentPolicy, resolveDeployAttempt, withDeploymentConfiguration, } from './registry-deploy-transaction.js';
 import { deploymentOwnerSubject } from './registry-helpers.js';
 import { registryDeploymentPackage, renderDeploymentPackageSnapshot } from './registry-package.js';
@@ -13,7 +14,7 @@ import { recoverRegistryRecords } from './registry-recover.js';
 import { rollbackDeployment, rollbackWithMappedErrors } from './registry-rollback.js';
 import { activeRecord, activeRecordVersion, persistDeployRecord, reconcilePlatformAccountResetRegistryCache, registryAppArchivedAt, registryArchiveApp, registryCustomerAuthRestoreProjections, registryGetApp, registryGetDeployment, registryGetEnvironment, registryListApps, registryListEnvironments, registryRestoreApp, registrySetProductionEnvironment, registrySweepArchived, setRegistryDeploymentLock, } from './registry-state.js';
 import { deploymentStatusFor } from './registry-status.js';
-import { deploymentSourceFor, rebindNativeRecords, servedTargetFor, targetForPersistedRecord, tenantDeploymentKey, tenantKey, } from './registry-targets.js';
+import { deploymentSourceFor, rebindNativeRecords, servedTargetFor, tenantDeploymentKey, tenantKey, } from './registry-targets.js';
 import { withBuiltinStateCatalog } from './state-catalog.js';
 import { deploymentSummary, matchesDeploymentFilter, validateDeploymentListFilter, } from './store/records.js';
 import { InMemoryConfigStore, validateTenantRef, } from './store.js';
@@ -318,26 +319,11 @@ export class ServerRegistry {
     #compilePersistedRecord(record) {
         return compilePersistedRegistryRecord(record, this.#compileTarget.bind(this));
     }
+    deleteDeployments(ref, selection) {
+        return deleteRegistryDeployments(this.#stateView(), ref, selection);
+    }
     async get(deploymentId) {
-        if (this.#records.get(deploymentId)?.archivedAt !== undefined)
-            return undefined;
-        const cached = this.#servers.get(deploymentId);
-        if (cached) {
-            const record = this.#store
-                ? await this.#store.get(deploymentId)
-                : this.#records.get(deploymentId);
-            return record === undefined || record.archivedAt !== undefined
-                ? undefined
-                : this.#targetForPersistedRecord(record);
-        }
-        const inflight = this.#inflight.get(deploymentId);
-        if (inflight)
-            return inflight;
-        const promise = this.#loadAndCompile(deploymentId).finally(() => {
-            this.#inflight.delete(deploymentId);
-        });
-        this.#inflight.set(deploymentId, promise);
-        return promise;
+        return readRegistryTarget(this.#stateView(), deploymentId, this.#inflight, (record) => this.#targetForPersistedRecord(record), (id) => this.#loadAndCompile(id));
     }
     /** Resolve a deployment-id data-plane route only while that exact record is actively serving. */
     async getServing(deploymentId) {
@@ -499,9 +485,7 @@ export class ServerRegistry {
         return this.#knowledgeSearch;
     }
     async #targetForPersistedRecord(record) {
-        return targetForPersistedRecord(record, {
-            records: this.#records,
-            servers: this.#servers,
+        return reconcileRegistryTarget(this.#stateView(), record, {
             ...(this.#customerVerifierFactory
                 ? { customerVerifierFactory: this.#customerVerifierFactory }
                 : {}),

package/node_modules/@noodle-borg/service/dist/routes/deploy-dispatch.js

@@ -2,9 +2,23 @@ import { applySecurityHeaders, enforceHttps, } from '@noodle-borg/transport-http
 import { respondRouteError } from '../http-util.js';
 import { handleDeploy } from './control-plane.js';
 import { handleDeployPreflight } from './deploy-preflight.js';
+import { handleDeploymentDelete, parseVersionDeletePath } from './deployment-delete.js';
 import { handleDeploymentLockUpdate } from './deployment-lock.js';
-import { parseTenantDeploymentLockPath, parseTenantDeployPath, parseTenantDeployPreflightPath, } from './paths.js';
+import { parseDeploymentItemPath, parseTenantDeploymentLockPath, parseTenantDeployPath, parseTenantDeployPreflightPath, } from './paths.js';
 export function dispatchDeployRoutes(req, res, url, deps) {
+    if (req.method === 'DELETE') {
+        const item = parseDeploymentItemPath(url.pathname);
+        const deletion = item
+            ? { kind: 'deployment', ...item }
+            : parseVersionDeletePath(url.pathname);
+        if (deletion) {
+            applySecurityHeaders(res, deps.tls);
+            if (enforceHttps(req, res, deps.tls))
+                return true;
+            handleDeploymentDelete(req, res, deletion, { ...deps, maxBody: deps.maxBody.control }).catch((error) => respondRouteError(deps.logger, res, 'deployment-delete.error', error));
+            return true;
+        }
+    }
     const deploymentLock = parseTenantDeploymentLockPath(url.pathname);
     if (req.method === 'PATCH' && deploymentLock !== undefined) {
         applySecurityHeaders(res, deps.tls);

package/node_modules/@noodle-borg/service/dist/routes/deployment-delete.js

@@ -0,0 +1,53 @@
+import { deleteDeploymentOperation, } from '@noodle-borg/control-plane/portable';
+import { normalizeServerVersion } from '@noodle-borg/module';
+import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
+import { deploymentDeleteResponseSchema, deploymentVersionDeleteRequestSchema, } from '@noodle-borg/wire-contracts';
+import { validateTenantRef } from '../store.js';
+import { authorizeControlPlane } from './control-plane.js';
+/** An exact numeric version, or the legacy unversioned scope; never semantic-version equivalence. */
+export function parseVersionDeletePath(pathname) {
+    const match = /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/envs\/([^/]+)\/versions\/([^/]+)$/.exec(pathname);
+    if (!match)
+        return undefined;
+    try {
+        const target = validateTenantRef({
+            org: decodeURIComponent(match[1]),
+            app: decodeURIComponent(match[2]),
+            env: decodeURIComponent(match[3]),
+        });
+        const version = decodeURIComponent(match[4]);
+        return {
+            kind: 'version',
+            org: target.org,
+            target,
+            ...(version === 'legacy' ? {} : { serverVersion: normalizeServerVersion(version) }),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function handleDeploymentDelete(req, res, route, deps) {
+    const identity = await authorizeControlPlane(req, res, deps.gate, { requireIdentity: true });
+    if (identity === false)
+        return;
+    let expectedDeploymentIds;
+    if (route.kind === 'version') {
+        const body = await readJsonBody(req, deps.maxBody);
+        if (!body.ok)
+            return sendJson(res, body.status, { error: body.error });
+        const parsed = deploymentVersionDeleteRequestSchema.safeParse(body.value);
+        if (!parsed.success)
+            return sendJson(res, 400, { error: 'Invalid version deletion confirmation.' });
+        expectedDeploymentIds = parsed.data.expectedDeploymentIds;
+    }
+    const result = await deleteDeploymentOperation(deps, {
+        actor: identity,
+        scope: route,
+        ...(expectedDeploymentIds === undefined ? {} : { expectedDeploymentIds }),
+    });
+    return result.ok
+        ? sendJson(res, 200, deploymentDeleteResponseSchema.parse(result.view))
+        : sendJson(res, result.status, { code: result.code, error: result.error });
+}
+//# sourceMappingURL=deployment-delete.js.map

package/node_modules/@noodle-borg/service/dist/store/in-memory.d.ts

@@ -1,7 +1,8 @@
-import type { ActiveAccessUpdateInput, AppArchiveResult, AppRestorePrecondition, AppRestoreResult, AppSummary, ArtifactStore, DeploymentActivationPrecondition, DeploymentActivationResult, DeploymentListFilter, DeploymentLock, DeploymentLockUpdateResult, DeploymentPolicyPrecondition, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from '../store.js';
+import type { ActiveAccessUpdateInput, AppArchiveResult, AppRestorePrecondition, AppRestoreResult, AppSummary, ArtifactStore, DeploymentActivationPrecondition, DeploymentActivationResult, DeploymentDeleteResult, DeploymentDeleteSelection, DeploymentListFilter, DeploymentLock, DeploymentLockUpdateResult, DeploymentPolicyPrecondition, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from '../store.js';
 /** In-memory store: keeps records in a Map. Used by tests and as an explicit, non-persistent option. */
 export declare class InMemoryArtifactStore implements ArtifactStore {
     #private;
+    deleteDeployments(ref: TenantRef, selection: DeploymentDeleteSelection): Promise<DeploymentDeleteResult>;
     append(record: DeployRecord, precondition?: DeploymentPolicyPrecondition): Promise<void>;
     loadAll(): Promise<readonly DeployRecord[]>;
     get(deploymentId: string): Promise<DeployRecord | undefined>;

package/node_modules/@noodle-borg/service/dist/store/in-memory.js

@@ -2,6 +2,7 @@ import { normalizeServerVersion } from '@noodle-borg/module';
 import { assertSameAppPackageSnapshot, sanitizeDeployRecordAppPackageSnapshot, } from '../app-package-snapshot.js';
 import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, requiresCustomerAuthProjection, } from '../customer-auth-audience-binding.js';
 import { matchesDeploymentActivation } from '../deployment-activation-precondition.js';
+import { planDeploymentDeletion } from '../deployment-deletion.js';
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from '../deployment-lock.js';
 import { assertDeploymentAppendPolicy, assertDeploymentAppendVersion, } from '../deployment-record-version.js';
 import { defaultActiveRecord, sameDeploymentScope, sameTenantRecord, } from '../deployment-versioning.js';
@@ -11,6 +12,13 @@ import { validateSlug, validateTenantRef } from './validate.js';
 export class InMemoryArtifactStore {
     #records = new Map();
     #productionEnvironments = new Map();
+    deleteDeployments(ref, selection) {
+        const result = planDeploymentDeletion([...this.#records.values()], ref, selection);
+        if (result.ok)
+            for (const record of result.deleted)
+                this.#records.delete(record.deploymentId);
+        return Promise.resolve(result);
+    }
     async append(record, precondition) {
         assertDeploymentAppendVersion([...this.#records.values()], record);
         assertDeploymentAppendPolicy([...this.#records.values()], record, precondition);

package/node_modules/@noodle-borg/service/dist/store/json-file-deletion.js

@@ -0,0 +1,64 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir, open, readFile, rename } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+import { DEPLOYMENT_ID_PATTERN } from './validate.js';
+const lifecycleTails = new Map();
+/** All adapters for one local directory join the same process-local lifecycle ordering. */
+export function serializeFileLifecycle(directory, operation) {
+    const key = resolve(directory);
+    const result = (lifecycleTails.get(key) ?? Promise.resolve()).then(operation, operation);
+    const tail = result.then(() => undefined, () => undefined);
+    lifecycleTails.set(key, tail);
+    void tail.then(() => {
+        if (lifecycleTails.get(key) === tail)
+            lifecycleTails.delete(key);
+    });
+    return result;
+}
+/** Fail closed on an unreadable deletion journal; missing means no deletions have committed. */
+export async function readDeletedDeploymentIds(directory) {
+    let text;
+    try {
+        text = await readFile(join(directory, 'deleted-deployments.json'), 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return new Set();
+        throw error;
+    }
+    const ids = JSON.parse(text);
+    if (!Array.isArray(ids) ||
+        ids.some((id) => typeof id !== 'string' || !DEPLOYMENT_ID_PATTERN.test(id))) {
+        throw new Error('Invalid deployment deletion journal');
+    }
+    return new Set(ids);
+}
+/** Rename is the logical commit; retained ID tombstones also reject retries that would resurrect records. */
+export async function commitDeletedDeploymentIds(directory, ids) {
+    const deleted = new Set(await readDeletedDeploymentIds(directory));
+    for (const id of ids)
+        deleted.add(id);
+    await mkdir(directory, { recursive: true });
+    const path = join(directory, 'deleted-deployments.json');
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    const file = await open(temporary, 'wx', 0o600);
+    try {
+        await file.writeFile(JSON.stringify([...deleted].sort()));
+        await file.sync();
+    }
+    finally {
+        await file.close();
+    }
+    await rename(temporary, path);
+    // Persist both the commit rename and the metadata directory before removing any deployment files.
+    for (const parent of [directory, dirname(directory)]) {
+        const handle = await open(parent, 'r');
+        try {
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+    }
+}
+//# sourceMappingURL=json-file-deletion.js.map

package/node_modules/@noodle-borg/service/dist/store/json-file.d.ts

@@ -1,4 +1,4 @@
-import type { ActiveAccessUpdateInput, AppArchiveResult, AppRestorePrecondition, AppRestoreResult, AppSummary, ArtifactStore, DeploymentActivationPrecondition, DeploymentActivationResult, DeploymentListFilter, DeploymentLock, DeploymentLockUpdateResult, DeploymentPolicyPrecondition, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from '../store.js';
+import type { ActiveAccessUpdateInput, AppArchiveResult, AppRestorePrecondition, AppRestoreResult, AppSummary, ArtifactStore, DeploymentActivationPrecondition, DeploymentActivationResult, DeploymentDeleteResult, DeploymentDeleteSelection, DeploymentListFilter, DeploymentLock, DeploymentLockUpdateResult, DeploymentPolicyPrecondition, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from '../store.js';
 /**
  * JSON-file store: one file per deployment at `<dataDir>/deployments/<deploymentId>.json`, written atomically
  * (write a temp file, then `rename` over the target — no partial file is ever read). `deploymentId` is a
@@ -8,6 +8,7 @@ import type { ActiveAccessUpdateInput, AppArchiveResult, AppRestorePrecondition,
 export declare class JsonFileArtifactStore implements ArtifactStore {
     #private;
     constructor(dataDir: string);
+    deleteDeployments(ref: TenantRef, selection: DeploymentDeleteSelection): Promise<DeploymentDeleteResult>;
     append(record: DeployRecord, precondition?: DeploymentPolicyPrecondition): Promise<void>;
     get(deploymentId: string): Promise<DeployRecord | undefined>;
     getActiveByTenant(ref: TenantRef): Promise<DeployRecord | undefined>;