@noodleseed/one 0.121.0 → 0.123.0

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-page.js

@@ -1,246 +1,37 @@
 import { renderOAuthPage } from './branding.js';
 const CAPABILITY_COPY = {
     'cloud:read': 'Read cloud apps, deployments, logs, analytics, and diagnostics',
-    'deployments:write': 'Build and deploy apps to the selected environments',
-    'deployments:rollback': 'Roll back deployments',
-    'config:write': 'Set and remove variables and secrets on the selected environments (never read a secret back)',
+    'deployments:write': 'Build and deploy apps',
+    'deployments:rollback': 'Roll back deployments when you are an organization owner',
+    'config:write': 'Set and remove variables and secrets (never read a secret back)',
 };
-const ENVIRONMENT_PRIORITY = {
-    dev: 0,
-    staging: 1,
-    prod: 3,
-};
-const DEVELOPER_GRANT_STYLES = `
-.ns-card{width:min(100%,46rem)}
-.ns-title{max-width:38rem;white-space:normal}
-.developer-context{grid-template-columns:repeat(3,minmax(0,1fr));gap:.75rem;margin-bottom:1.55rem}
-.developer-context>div{min-width:0}
-.developer-context .ns-dd{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
-.developer-grant{display:grid;gap:1.35rem}
-.developer-section{min-width:0;margin:0;padding:0;border:0}
-.developer-step{display:flex;align-items:center;gap:.6rem;margin:0 0 .3rem;color:var(--fg);font-size:.94rem;font-weight:650}
-.developer-step-number{display:grid;place-items:center;width:1.6rem;height:1.6rem;border:1px solid var(--border);border-radius:999px;color:var(--orange);font-size:.72rem}
-.developer-help{margin:0 0 .8rem;color:var(--muted);font-size:.8rem;line-height:1.5}
-.developer-org-list{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:.65rem}
-.developer-org-choice{position:relative;display:block;min-width:0;cursor:pointer}
-.developer-org-choice>input{position:absolute;width:1px;height:1px;opacity:0;pointer-events:none}
-.developer-org-card{display:flex;align-items:center;justify-content:space-between;gap:.85rem;min-height:4rem;padding:.85rem .95rem;border:1px solid var(--border);border-radius:.8rem;background:rgba(255,255,255,.025);transition:border-color .16s ease,background .16s ease,box-shadow .16s ease}
-.developer-org-choice:hover .developer-org-card{border-color:color-mix(in srgb,var(--border),var(--fg) 20%);background:rgba(255,255,255,.04)}
-.developer-org-choice>input:focus-visible+.developer-org-card{outline:2px solid var(--orange);outline-offset:2px}
-.developer-org-choice>input:checked+.developer-org-card{border-color:color-mix(in srgb,var(--orange) 70%,transparent);background:linear-gradient(135deg,color-mix(in srgb,var(--orange) 13%,transparent),rgba(255,255,255,.025));box-shadow:inset 0 0 0 1px color-mix(in srgb,var(--orange) 12%,transparent)}
-.developer-org-name{display:block;overflow:hidden;color:var(--fg);font-size:.88rem;font-weight:650;text-overflow:ellipsis;white-space:nowrap}
-.developer-org-access{display:block;margin-top:.18rem;color:var(--muted);font-size:.72rem}
-.developer-choice-mark{display:grid;flex:0 0 auto;place-items:center;width:1.1rem;height:1.1rem;border:1px solid var(--border);border-radius:999px;color:transparent;font-size:.65rem}
-.developer-org-choice>input:checked+.developer-org-card .developer-choice-mark{border-color:var(--orange);background:var(--orange);color:#130b07}
-.developer-environment-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:.6rem}
-.developer-environment{position:relative;display:block;min-width:0;cursor:pointer}
-.developer-environment>input{position:absolute;width:1px;height:1px;opacity:0;pointer-events:none}
-.developer-environment-card{display:flex;align-items:flex-start;gap:.65rem;min-height:4.1rem;padding:.8rem;border:1px solid var(--border);border-radius:.75rem;background:rgba(255,255,255,.025);transition:border-color .16s ease,background .16s ease}
-.developer-environment:hover .developer-environment-card{border-color:color-mix(in srgb,var(--border),var(--fg) 20%);background:rgba(255,255,255,.04)}
-.developer-environment>input:focus-visible+.developer-environment-card{outline:2px solid var(--orange);outline-offset:2px}
-.developer-environment>input:checked+.developer-environment-card{border-color:color-mix(in srgb,var(--orange) 70%,transparent);background:color-mix(in srgb,var(--orange) 10%,transparent)}
-.developer-checkbox{display:grid;flex:0 0 auto;place-items:center;width:1rem;height:1rem;margin-top:.08rem;border:1px solid var(--border);border-radius:.25rem;color:transparent;font-size:.68rem}
-.developer-environment>input:checked+.developer-environment-card .developer-checkbox{border-color:var(--orange);background:var(--orange);color:#130b07}
-.developer-environment-name{display:block;color:var(--fg);font-size:.84rem;font-weight:650}
-.developer-environment-note{display:block;margin-top:.2rem;color:var(--muted);font-size:.68rem;line-height:1.35}
-.developer-environment-note.is-production{color:#f1a273}
-.developer-capabilities{margin:.75rem 0 0;padding:.7rem .8rem;border:1px solid var(--border);border-radius:.7rem;background:rgba(0,0,0,.12);color:var(--muted);font-size:.75rem}
-.developer-capabilities summary{cursor:pointer;color:var(--fg);font-weight:600}
-.developer-capabilities ul{display:grid;gap:.35rem;margin:.6rem 0 0;padding-left:1.15rem;line-height:1.45}
-.developer-summary{padding:.85rem .95rem;border:1px solid var(--border);border-radius:.75rem;background:rgba(255,255,255,.025)}
-.developer-summary-label{margin:0 0 .24rem;color:var(--muted);font-size:.65rem;font-weight:700;letter-spacing:.12em;text-transform:uppercase}
-.developer-summary-copy{margin:0;color:var(--fg);font-size:.8rem;line-height:1.5}
-.developer-selection-error{margin:.45rem 0 0;color:#f1a273;font-size:.75rem}
-.developer-grant .ns-row{margin-top:0}
-.developer-grant .btn-primary:disabled{cursor:not-allowed;filter:none;opacity:.45}
-@media(max-width:680px){
-  .ns-card{padding:1.35rem}
-  .developer-context,.developer-org-list,.developer-environment-grid{grid-template-columns:1fr}
-  .developer-context{gap:.55rem}
-}
-`;
-const DEVELOPER_GRANT_SCRIPT = `<script>
-(function(){
-  var form=document.querySelector('[data-developer-grant]');
-  if(!form)return;
-  var choices=Array.from(form.querySelectorAll('[data-org-choice]'));
-  var panels=Array.from(form.querySelectorAll('[data-org-panel]'));
-  var authorize=form.querySelector('[data-authorize]');
-  var summary=form.querySelector('[data-selection-summary]');
-  var error=form.querySelector('[data-selection-error]');
-  var clientName=form.getAttribute('data-client-name')||'The developer plugin';
-  function activeIndex(){
-    var selected=choices.find(function(choice){return choice.checked;});
-    return selected ? Number(selected.getAttribute('data-org-choice')) : -1;
-  }
-  function activeEnvironments(){
-    var panel=panels[activeIndex()];
-    return panel ? Array.from(panel.querySelectorAll('input[name="environment"]:checked')).map(function(input){return input.value;}) : [];
-  }
-  function naturalList(values){
-    if(values.length<2)return values[0]||'';
-    if(values.length===2)return values[0]+' and '+values[1];
-    return values.slice(0,-1).join(', ')+', and '+values[values.length-1];
-  }
-  function update(){
-    var panel=panels[activeIndex()];
-    var environments=activeEnvironments();
-    var valid=panel!==undefined&&environments.length>0;
-    authorize.disabled=!valid;
-    error.hidden=valid;
-    if(valid){
-      summary.textContent=clientName+' can '+panel.getAttribute('data-capability-summary')+' in '+panel.getAttribute('data-org-name')+' for '+naturalList(environments)+'.';
-    }else{
-      summary.textContent='Select at least one environment to continue.';
-    }
-  }
-  choices.forEach(function(choice){
-    choice.addEventListener('change',function(){
-      var next=activeIndex();
-      panels.forEach(function(panel,index){
-        var active=index===next;
-        panel.hidden=!active;
-        var environments=Array.from(panel.querySelectorAll('input[name="environment"]'));
-        environments.forEach(function(environment){environment.checked=false;environment.disabled=!active;});
-        if(active){
-          var preferred=environments.find(function(environment){return environment.value==='dev';});
-          if(preferred)preferred.checked=true;
-        }
-      });
-      update();
-    });
-  });
-  form.addEventListener('change',function(event){
-    if(event.target&&event.target.matches('input[name="environment"]'))update();
-  });
-  form.addEventListener('submit',function(event){
-    var submitter=event.submitter;
-    if(submitter&&submitter.value==='deny')return;
-    if(activeEnvironments().length===0){event.preventDefault();update();}
-  });
-  update();
-})();
-</script>`;
 export function renderDeveloperGrantPage(input) {
-    const controls = input.choices.length === 0
-        ? '<div class="ns-alert"><p class="ns-note">No organizations are available for this account.</p></div>'
-        : renderControls(input);
-    const contentHtml = `<p class="ns-lede">Review and choose the exact access for <strong>${escapeHtml(input.clientName)}</strong>. You can select more than one environment.</p>
-    <dl class="ns-dl developer-context">
-      <div><dt class="ns-dt">Signed in as</dt><dd class="ns-dd" title="${escapeHtml(input.userEmail)}">${escapeHtml(input.userEmail)}</dd></div>
-      <div><dt class="ns-dt">Noodle Cloud</dt><dd class="ns-dd" title="${escapeHtml(input.resourceHost)}">${escapeHtml(input.resourceHost)}</dd></div>
-      <div><dt class="ns-dt">Redirects to</dt><dd class="ns-dd" title="${escapeHtml(input.redirectHost)}">${escapeHtml(input.redirectHost)}</dd></div>
+    const capabilities = input.capabilities
+        .map((capability) => `<li>${escapeHtml(CAPABILITY_COPY[capability])}</li>`)
+        .join('');
+    const contentHtml = `<p class="ns-lede"><strong>${escapeHtml(input.clientName)}</strong> wants to use your Noodle Seed developer access.</p>
+    <dl class="ns-dl">
+      <div><dt class="ns-dt">Signed in as</dt><dd class="ns-dd">${escapeHtml(input.userEmail)}</dd></div>
+      <div><dt class="ns-dt">Noodle Cloud</dt><dd class="ns-dd">${escapeHtml(input.resourceHost)}</dd></div>
+      <div><dt class="ns-dt">Redirects to</dt><dd class="ns-dd">${escapeHtml(input.redirectHost)}</dd></div>
     </dl>
-    <form method="post" action="${escapeHtml(input.grantAction)}" class="developer-grant" data-developer-grant data-client-name="${escapeHtml(input.clientName)}">
+    <p class="ns-note">This connection can operate in the organizations and environments you can currently access. Your access updates automatically when your membership or role changes.</p>
+    <ul>${capabilities}</ul>
+    <p class="ns-note">Only authorize if you recognize this application.</p>
+    <form method="post" action="${escapeHtml(input.grantAction)}">
       <input type="hidden" name="grant_token" value="${escapeHtml(input.grantToken)}" />
-      ${controls}
+      <div class="ns-row">
+        <button type="submit" name="decision" value="deny" class="btn btn-ghost">Deny</button>
+        <span class="btn-glow"><button type="submit" name="decision" value="approve" class="btn btn-primary">Authorize</button></span>
+      </div>
     </form>`;
     return renderOAuthPage({
         title: 'Authorize developer access — Noodle Seed',
         kicker: 'Developer access',
-        heading: 'Choose where this developer plugin can operate',
+        heading: 'Authorize Noodle Seed developer access',
         contentHtml,
-        additionalStyles: DEVELOPER_GRANT_STYLES,
-        ...(input.choices.length === 0 ? {} : { scriptHtml: DEVELOPER_GRANT_SCRIPT }),
-    });
-}
-function renderControls(input) {
-    const organizations = input.choices.map(renderOrganizationChoice).join('');
-    const panels = input.choices.map(renderEnvironmentPanel).join('');
-    const first = input.choices[0];
-    const initialEnvironment = first?.environments.includes('dev') ? 'dev' : first?.environments[0];
-    const initialSummary = first !== undefined && initialEnvironment !== undefined
-        ? `${input.clientName} can ${capabilitySummary(first.capabilities)} in ${first.displayName ?? first.org} for ${initialEnvironment}.`
-        : 'Select at least one environment to continue.';
-    return `<fieldset class="developer-section">
-      <legend class="developer-step"><span class="developer-step-number">1</span>Choose organization</legend>
-      <p class="developer-help">Only one organization can be authorized in this connection.</p>
-      <div class="developer-org-list">${organizations}</div>
-    </fieldset>
-    <div>${panels}</div>
-    <div class="developer-summary" aria-live="polite">
-      <p class="developer-summary-label">Access summary</p>
-      <p class="developer-summary-copy" data-selection-summary>${escapeHtml(initialSummary)}</p>
-      <p class="developer-selection-error" data-selection-error hidden>Select at least one environment to continue.</p>
-    </div>
-    <div class="ns-row">
-      <button type="submit" name="decision" value="deny" class="btn btn-ghost">Deny</button>
-      <span class="btn-glow"><button type="submit" name="decision" value="approve" class="btn btn-primary" data-authorize>Authorize access</button></span>
-    </div>`;
-}
-function renderOrganizationChoice(choice, index) {
-    const label = choice.displayName ?? choice.org;
-    const access = choice.capabilities.includes('deployments:rollback')
-        ? 'Owner access'
-        : 'Developer access';
-    return `<label class="developer-org-choice">
-      <input type="radio" name="org" value="${escapeHtml(choice.org)}" data-org-choice="${index}"${index === 0 ? ' checked' : ''} />
-      <span class="developer-org-card">
-        <span><span class="developer-org-name">${escapeHtml(label)}</span><span class="developer-org-access">${access}</span></span>
-        <span class="developer-choice-mark" aria-hidden="true">✓</span>
-      </span>
-    </label>`;
-}
-function renderEnvironmentPanel(choice, choiceIndex) {
-    const environments = orderedEnvironments(choice.environments)
-        .map((environment, environmentIndex) => renderEnvironment(environment, choiceIndex, environmentIndex, choiceIndex === 0))
-        .join('');
-    const capabilities = choice.capabilities
-        .map((capability) => `<li>${escapeHtml(CAPABILITY_COPY[capability])}</li>`)
-        .join('');
-    const label = choice.displayName ?? choice.org;
-    return `<section class="developer-section" data-org-panel="${choiceIndex}" data-org-name="${escapeHtml(label)}" data-capability-summary="${escapeHtml(capabilitySummary(choice.capabilities))}"${choiceIndex === 0 ? '' : ' hidden'}>
-      <h2 class="developer-step"><span class="developer-step-number">2</span>Choose environments</h2>
-      <p class="developer-help">Select every environment this plugin should be able to operate. Development is selected for you.</p>
-      <div class="developer-environment-grid">${environments}</div>
-      <details class="developer-capabilities">
-        <summary>What the plugin can do</summary>
-        <ul>${capabilities}</ul>
-      </details>
-    </section>`;
-}
-function renderEnvironment(environment, choiceIndex, environmentIndex, active) {
-    const id = `developer-environment-${choiceIndex}-${environmentIndex}`;
-    const selected = active && environment === 'dev';
-    const note = environmentNote(environment);
-    return `<label class="developer-environment" for="${id}">
-      <input id="${id}" type="checkbox" name="environment" value="${escapeHtml(environment)}"${selected ? ' checked' : ''}${active ? '' : ' disabled'} />
-      <span class="developer-environment-card">
-        <span class="developer-checkbox" aria-hidden="true">✓</span>
-        <span><span class="developer-environment-name">${escapeHtml(environment)}</span><span class="developer-environment-note${environment === 'prod' ? ' is-production' : ''}">${note}</span></span>
-      </span>
-    </label>`;
-}
-function orderedEnvironments(environments) {
-    return [...new Set(environments)].sort((left, right) => {
-        const leftPriority = ENVIRONMENT_PRIORITY[left] ?? 2;
-        const rightPriority = ENVIRONMENT_PRIORITY[right] ?? 2;
-        return leftPriority - rightPriority || left.localeCompare(right);
     });
 }
-function environmentNote(environment) {
-    if (environment === 'dev')
-        return 'Recommended';
-    if (environment === 'prod')
-        return 'Can affect live users';
-    return 'Optional';
-}
-function capabilitySummary(capabilities) {
-    const actions = [];
-    if (capabilities.includes('cloud:read'))
-        actions.push('read cloud state');
-    if (capabilities.includes('deployments:write'))
-        actions.push('build and deploy apps');
-    if (capabilities.includes('config:write'))
-        actions.push('set variables and secrets');
-    if (capabilities.includes('deployments:rollback'))
-        actions.push('roll back deployments');
-    if (actions.length === 0)
-        return 'use its assigned capabilities';
-    if (actions.length === 1)
-        return actions[0] ?? 'use its assigned capabilities';
-    return `${actions.slice(0, -1).join(', ')} and ${actions.at(-1)}`;
-}
 function escapeHtml(value) {
     return value
         .replace(/&/g, '&amp;')

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-page.js.map

@@ -1 +1 @@
-{"version":3,"file":"developer-grant-page.js","sourceRoot":"","sources":["../../src/oauth/developer-grant-page.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAahD,MAAM,eAAe,GAAkD;IACrE,YAAY,EAAE,gEAAgE;IAC9E,mBAAmB,EAAE,oDAAoD;IACzE,sBAAsB,EAAE,uBAAuB;IAC/C,cAAc,EACZ,8FAA8F;CACjG,CAAC;AAEF,MAAM,oBAAoB,GAAqC;IAC7D,GAAG,EAAE,CAAC;IACN,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgD9B,CAAC;AAEF,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6DrB,CAAC;AAEX,MAAM,UAAU,wBAAwB,CAAC,KAA8B;IACrE,MAAM,QAAQ,GACZ,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QACxB,CAAC,CAAC,qGAAqG;QACvG,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,WAAW,GAAG,qEAAqE,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;;yEAE9C,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;yEAC3D,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC;yEACjE,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC;;kCAExG,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,oEAAoE,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;uDACxG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;QAC3E,QAAQ;YACJ,CAAC;IACX,OAAO,eAAe,CAAC;QACrB,KAAK,EAAE,0CAA0C;QACjD,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,gDAAgD;QACzD,WAAW;QACX,gBAAgB,EAAE,sBAAsB;QACxC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAC;KAC9E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,KAA8B;IACpD,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,kBAAkB,GAAG,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAChG,MAAM,cAAc,GAClB,KAAK,KAAK,SAAS,IAAI,kBAAkB,KAAK,SAAS;QACrD,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,QAAQ,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,GAAG,QAAQ,kBAAkB,GAAG;QACpI,CAAC,CAAC,8CAA8C,CAAC;IACrD,OAAO;;;wCAG+B,aAAa;;WAE1C,MAAM;;;iEAGgD,UAAU,CAAC,cAAc,CAAC;;;;;;WAMhF,CAAC;AACZ,CAAC;AAED,SAAS,wBAAwB,CAAC,MAA4B,EAAE,KAAa;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QACjE,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,kBAAkB,CAAC;IACvB,OAAO;8CACqC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,sBAAsB,KAAK,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;;iDAE/E,UAAU,CAAC,KAAK,CAAC,6CAA6C,MAAM;;;aAGxG,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAAC,MAA4B,EAAE,WAAmB;IAC/E,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC;SAC1D,GAAG,CAAC,CAAC,WAAW,EAAE,gBAAgB,EAAE,EAAE,CACrC,iBAAiB,CAAC,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,KAAK,CAAC,CAAC,CACjF;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY;SACrC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;SAC1E,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC;IAC/C,OAAO,sDAAsD,WAAW,oBAAoB,UAAU,CAAC,KAAK,CAAC,8BAA8B,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;;;gDAGrL,YAAY;;;cAG9C,YAAY;;eAEX,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACxB,WAAmB,EACnB,WAAmB,EACnB,gBAAwB,EACxB,MAAe;IAEf,MAAM,EAAE,GAAG,yBAAyB,WAAW,IAAI,gBAAgB,EAAE,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,WAAW,KAAK,KAAK,CAAC;IACjD,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC1C,OAAO,6CAA6C,EAAE;mBACrC,EAAE,+CAA+C,UAAU,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW;;;yDAG5F,UAAU,CAAC,WAAW,CAAC,iDAAiD,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI;;aAE3K,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,YAA+B;IAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACrD,MAAM,YAAY,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,aAAa,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvD,OAAO,YAAY,GAAG,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,WAAmB;IAC1C,IAAI,WAAW,KAAK,KAAK;QAAE,OAAO,aAAa,CAAC;IAChD,IAAI,WAAW,KAAK,MAAM;QAAE,OAAO,uBAAuB,CAAC;IAC3D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,iBAAiB,CAAC,YAA4C;IACrE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC1E,IAAI,YAAY,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACtF,IAAI,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACrF,IAAI,YAAY,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACzF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,+BAA+B,CAAC;IACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,+BAA+B,CAAC;IAC/E,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"developer-grant-page.js","sourceRoot":"","sources":["../../src/oauth/developer-grant-page.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAYhD,MAAM,eAAe,GAAkD;IACrE,YAAY,EAAE,gEAAgE;IAC9E,mBAAmB,EAAE,uBAAuB;IAC5C,sBAAsB,EAAE,0DAA0D;IAClF,cAAc,EAAE,iEAAiE;CAClF,CAAC;AAEF,MAAM,UAAU,wBAAwB,CAAC,KAA8B;IACrE,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY;SACpC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,UAAU,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;SAC1E,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,MAAM,WAAW,GAAG,8BAA8B,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;;kEAEd,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;kEAC3B,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC;kEAC9B,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC;;;UAGtF,YAAY;;kCAEY,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;uDACR,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;;;;;YAKvE,CAAC;IACX,OAAO,eAAe,CAAC;QACrB,KAAK,EAAE,0CAA0C;QACjD,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,wCAAwC;QACjD,WAAW;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-store-postgres.d.ts

@@ -1,10 +1,11 @@
 import type { Pool } from 'pg';
-import { type CreateDeveloperAccessGrant, type DeveloperAccessGrant, type DeveloperGrantFactoryOptions, type DeveloperGrantStore } from './developer-grant.js';
+import { type ActiveDeveloperGrantLookup, type CreateDeveloperAccessGrant, type DeveloperAccessGrant, type DeveloperGrantFactoryOptions, type DeveloperGrantStore } from './developer-grant.js';
 export declare class PostgresDeveloperGrantStore implements DeveloperGrantStore {
     #private;
     constructor(pool: Pool, options?: DeveloperGrantFactoryOptions);
     initialize(): Promise<void>;
-    create(input: CreateDeveloperAccessGrant): Promise<DeveloperAccessGrant>;
+    getOrCreateActive(input: CreateDeveloperAccessGrant): Promise<DeveloperAccessGrant>;
+    getActive(input: ActiveDeveloperGrantLookup): Promise<DeveloperAccessGrant | undefined>;
     get(id: string): Promise<DeveloperAccessGrant | undefined>;
     revoke(id: string, at: string): Promise<DeveloperAccessGrant | undefined>;
 }

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-store-postgres.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"developer-grant-store-postgres.d.ts","sourceRoot":"","sources":["../../src/oauth/developer-grant-store-postgres.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAI/B,OAAO,EACL,KAAK,0BAA0B,EAE/B,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EACjC,KAAK,mBAAmB,EAGzB,MAAM,sBAAsB,CAAC;AAe9B,qBAAa,2BAA4B,YAAW,mBAAmB;;gBAIzD,IAAI,EAAE,IAAI,EAAE,OAAO,GAAE,4BAAiC;IAK5D,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B,MAAM,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA+BxE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAO1D,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;CAYhF"}
+{"version":3,"file":"developer-grant-store-postgres.d.ts","sourceRoot":"","sources":["../../src/oauth/developer-grant-store-postgres.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAI/B,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAE/B,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EACjC,KAAK,mBAAmB,EAGzB,MAAM,sBAAsB,CAAC;AAgB9B,qBAAa,2BAA4B,YAAW,mBAAmB;;gBAIzD,IAAI,EAAE,IAAI,EAAE,OAAO,GAAE,4BAAiC;IAK5D,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B,iBAAiB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyDnF,SAAS,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAqBvF,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAS1D,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;CAYhF"}

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-store-postgres.js

@@ -3,11 +3,12 @@ import { z } from 'zod';
 import { ensureDeveloperGrantSchema } from '../store/postgres-schema.js';
 import { createDeveloperAccessGrantRecord, normalizeDeveloperAccessGrant, normalizeDeveloperGrantTimestamp, } from './developer-grant.js';
 const developerGrantRowSchema = z.object({
+    grant_version: z.literal(2),
     id: z.string(),
     client_id: z.string(),
     subject: z.string(),
-    org_slug: z.string(),
-    environments: z.array(z.string()),
+    resource: z.string(),
+    access_model: z.literal('live_user'),
     capabilities: z.array(z.enum(DEVELOPER_CAPABILITIES)),
     created_at: z.coerce.date(),
     updated_at: z.coerce.date(),
@@ -24,38 +25,73 @@ export class PostgresDeveloperGrantStore {
     async initialize() {
         await ensureDeveloperGrantSchema(this.#pool);
     }
-    async create(input) {
+    async getOrCreateActive(input) {
         const grant = createDeveloperAccessGrantRecord(input, this.#options);
-        try {
-            const { rows } = await this.#pool.query(`INSERT INTO developer_access_grants
-           (id, client_id, subject, org_slug, environments, capabilities,
-            created_at, updated_at, expires_at, revoked_at)
-         VALUES ($1, $2, $3, $4, $5::jsonb, $6::jsonb, $7, $8, $9, $10)
-         RETURNING *`, [
-                grant.id,
-                grant.clientId,
-                grant.subject,
-                grant.org,
-                JSON.stringify(grant.environments),
-                JSON.stringify(grant.capabilities),
-                grant.createdAt,
-                grant.updatedAt,
-                grant.expiresAt ?? null,
-                grant.revokedAt ?? null,
-            ]);
+        const existing = await this.getActive({
+            clientId: grant.clientId,
+            subject: grant.subject,
+            resource: grant.resource,
+            at: grant.createdAt,
+        });
+        if (existing !== undefined)
+            return existing;
+        // The partial uniqueness constraint deliberately treats an unrevoked row as active. Retire an
+        // expired tuple before inserting its replacement so persistence matches the in-memory contract.
+        await this.#pool.query(`UPDATE developer_access_grants
+          SET revoked_at = $4::timestamptz,
+              updated_at = $4::timestamptz
+        WHERE grant_version = 2
+          AND access_model = 'live_user'
+          AND client_id = $1
+          AND subject = $2
+          AND resource = $3
+          AND revoked_at IS NULL
+          AND expires_at <= $4::timestamptz`, [grant.clientId, grant.subject, grant.resource, grant.createdAt]);
+        const { rows } = await this.#pool.query(`INSERT INTO developer_access_grants
+         (id, client_id, subject, org_slug, environments, capabilities,
+          created_at, updated_at, expires_at, revoked_at,
+          grant_version, resource, access_model)
+       VALUES ($1, $2, $3, NULL, NULL, $4::jsonb, $5, $6, $7, NULL, 2, $8, 'live_user')
+       ON CONFLICT DO NOTHING
+       RETURNING *`, [
+            grant.id,
+            grant.clientId,
+            grant.subject,
+            JSON.stringify(grant.capabilities),
+            grant.createdAt,
+            grant.updatedAt,
+            grant.expiresAt ?? null,
+            grant.resource,
+        ]);
+        if (rows[0] !== undefined)
             return grantFromRow(rows[0]);
-        }
-        catch (error) {
-            if (isUniqueViolation(error)) {
-                throw new Error(`developer grant "${grant.id}" already exists`, { cause: error });
-            }
-            throw error;
-        }
+        const raced = await this.getActive({
+            clientId: grant.clientId,
+            subject: grant.subject,
+            resource: grant.resource,
+            at: grant.createdAt,
+        });
+        if (raced !== undefined)
+            return raced;
+        throw new Error(`developer grant "${grant.id}" already exists`);
+    }
+    async getActive(input) {
+        const at = normalizeDeveloperGrantTimestamp('authorization time', input.at ?? new Date().toISOString());
+        const { rows } = await this.#pool.query(`SELECT * FROM developer_access_grants
+        WHERE grant_version = 2
+          AND access_model = 'live_user'
+          AND client_id = $1
+          AND subject = $2
+          AND resource = $3
+          AND revoked_at IS NULL
+          AND (expires_at IS NULL OR expires_at > $4::timestamptz)
+        ORDER BY created_at DESC
+        LIMIT 1`, [input.clientId, input.subject, input.resource, at]);
+        return rows[0] === undefined ? undefined : grantFromRow(rows[0]);
     }
     async get(id) {
-        const { rows } = await this.#pool.query('SELECT * FROM developer_access_grants WHERE id = $1', [
-            id,
-        ]);
+        const { rows } = await this.#pool.query(`SELECT * FROM developer_access_grants
+        WHERE id = $1 AND grant_version = 2 AND access_model = 'live_user'`, [id]);
         return rows[0] === undefined ? undefined : grantFromRow(rows[0]);
     }
     async revoke(id, at) {
@@ -63,7 +99,7 @@ export class PostgresDeveloperGrantStore {
         const { rows } = await this.#pool.query(`UPDATE developer_access_grants
        SET updated_at = CASE WHEN revoked_at IS NULL THEN $2::timestamptz ELSE updated_at END,
            revoked_at = COALESCE(revoked_at, $2::timestamptz)
-       WHERE id = $1
+       WHERE id = $1 AND grant_version = 2 AND access_model = 'live_user'
        RETURNING *`, [id, revokedAt]);
         return rows[0] === undefined ? undefined : grantFromRow(rows[0]);
     }
@@ -71,11 +107,12 @@ export class PostgresDeveloperGrantStore {
 function grantFromRow(value) {
     const row = developerGrantRowSchema.parse(value);
     return normalizeDeveloperAccessGrant({
+        version: 2,
         id: row.id,
         clientId: row.client_id,
         subject: row.subject,
-        org: row.org_slug,
-        environments: row.environments,
+        resource: row.resource,
+        accessModel: row.access_model,
         capabilities: row.capabilities,
         createdAt: row.created_at.toISOString(),
         updatedAt: row.updated_at.toISOString(),
@@ -83,7 +120,4 @@ function grantFromRow(value) {
         ...(row.revoked_at === null ? {} : { revokedAt: row.revoked_at.toISOString() }),
     });
 }
-function isUniqueViolation(error) {
-    return typeof error === 'object' && error !== null && 'code' in error && error.code === '23505';
-}
 //# sourceMappingURL=developer-grant-store-postgres.js.map

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant-store-postgres.js.map

@@ -1 +1 @@
-{"version":3,"file":"developer-grant-store-postgres.js","sourceRoot":"","sources":["../../src/oauth/developer-grant-store-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAEL,gCAAgC,EAIhC,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAE9B,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACtC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,OAAO,2BAA2B;IAC7B,KAAK,CAAO;IACZ,QAAQ,CAA+B;IAEhD,YAAY,IAAU,EAAE,UAAwC,EAAE;QAChE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAiC;QAC5C,MAAM,KAAK,GAAG,gCAAgC,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACrC;;;;qBAIa,EACb;gBACE,KAAK,CAAC,EAAE;gBACR,KAAK,CAAC,QAAQ;gBACd,KAAK,CAAC,OAAO;gBACb,KAAK,CAAC,GAAG;gBACT,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC;gBAClC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC;gBAClC,KAAK,CAAC,SAAS;gBACf,KAAK,CAAC,SAAS;gBACf,KAAK,CAAC,SAAS,IAAI,IAAI;gBACvB,KAAK,CAAC,SAAS,IAAI,IAAI;aACxB,CACF,CAAC;YACF,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,qDAAqD,EAAE;YAC7F,EAAE;SACH,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,EAAU;QACjC,MAAM,SAAS,GAAG,gCAAgC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACpE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACrC;;;;mBAIa,EACb,CAAC,EAAE,EAAE,SAAS,CAAC,CAChB,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;CACF;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,GAAG,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,6BAA6B,CAAC;QACnC,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,EAAE,GAAG,CAAC,QAAQ;QACjB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;QACvC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;QACvC,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/E,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;KAChF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;AAClG,CAAC"}
+{"version":3,"file":"developer-grant-store-postgres.js","sourceRoot":"","sources":["../../src/oauth/developer-grant-store-postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAGL,gCAAgC,EAIhC,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAE9B,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IACpC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACtC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,OAAO,2BAA2B;IAC7B,KAAK,CAAO;IACZ,QAAQ,CAA+B;IAEhD,YAAY,IAAU,EAAE,UAAwC,EAAE;QAChE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAiC;QACvD,MAAM,KAAK,GAAG,gCAAgC,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;YACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,EAAE,EAAE,KAAK,CAAC,SAAS;SACpB,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAE5C,8FAA8F;QAC9F,gGAAgG;QAChG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB;;;;;;;;;4CASsC,EACtC,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CACjE,CAAC;QAEF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACrC;;;;;;mBAMa,EACb;YACE,KAAK,CAAC,EAAE;YACR,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,OAAO;YACb,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC;YAClC,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,SAAS,IAAI,IAAI;YACvB,KAAK,CAAC,QAAQ;SACf,CACF,CAAC;QACF,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAExD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;YACjC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,EAAE,EAAE,KAAK,CAAC,SAAS;SACpB,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAiC;QAC/C,MAAM,EAAE,GAAG,gCAAgC,CACzC,oBAAoB,EACpB,KAAK,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CACrC,CAAC;QACF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACrC;;;;;;;;;gBASU,EACV,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CACpD,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACrC;2EACqE,EACrE,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,EAAU;QACjC,MAAM,SAAS,GAAG,gCAAgC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACpE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACrC;;;;mBAIa,EACb,CAAC,EAAE,EAAE,SAAS,CAAC,CAChB,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;CACF;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,GAAG,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,6BAA6B,CAAC;QACnC,OAAO,EAAE,CAAC;QACV,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;QACvC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;QACvC,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/E,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;KAChF,CAAC,CAAC;AACL,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant.d.ts

@@ -1,10 +1,13 @@
 import { type DeveloperCapability } from '@noodle-borg/developer-mcp';
+export declare const DEVELOPER_GRANT_VERSION: 2;
+export declare const DEVELOPER_GRANT_ACCESS_MODEL: "live_user";
 export interface DeveloperAccessGrant {
+    readonly version: typeof DEVELOPER_GRANT_VERSION;
     readonly id: string;
     readonly clientId: string;
     readonly subject: string;
-    readonly org: string;
-    readonly environments: readonly string[];
+    readonly resource: string;
+    readonly accessModel: typeof DEVELOPER_GRANT_ACCESS_MODEL;
     readonly capabilities: readonly DeveloperCapability[];
     readonly createdAt: string;
     readonly updatedAt: string;
@@ -14,19 +17,26 @@ export interface DeveloperAccessGrant {
 export interface CreateDeveloperAccessGrant {
     readonly clientId: string;
     readonly subject: string;
-    readonly org: string;
-    readonly environments: readonly string[];
+    readonly resource: string;
     readonly capabilities: readonly DeveloperCapability[];
     readonly expiresAt?: string;
 }
+export interface ActiveDeveloperGrantLookup {
+    readonly clientId: string;
+    readonly subject: string;
+    readonly resource: string;
+    readonly at?: string;
+}
 export interface DeveloperGrantStore {
-    create(input: CreateDeveloperAccessGrant): Promise<DeveloperAccessGrant>;
+    getOrCreateActive(input: CreateDeveloperAccessGrant): Promise<DeveloperAccessGrant>;
+    getActive(input: ActiveDeveloperGrantLookup): Promise<DeveloperAccessGrant | undefined>;
     get(id: string): Promise<DeveloperAccessGrant | undefined>;
     revoke(id: string, at: string): Promise<DeveloperAccessGrant | undefined>;
 }
 export interface ActiveDeveloperGrantInput {
     readonly subject: string;
     readonly clientId: string;
+    readonly resource: string;
     readonly at: string;
 }
 export interface DeveloperGrantFactoryOptions {
@@ -37,7 +47,8 @@ export type InMemoryDeveloperGrantStoreOptions = DeveloperGrantFactoryOptions;
 export declare class InMemoryDeveloperGrantStore implements DeveloperGrantStore {
     #private;
     constructor(options?: InMemoryDeveloperGrantStoreOptions);
-    create(input: CreateDeveloperAccessGrant): Promise<DeveloperAccessGrant>;
+    getOrCreateActive(input: CreateDeveloperAccessGrant): Promise<DeveloperAccessGrant>;
+    getActive(input: ActiveDeveloperGrantLookup): Promise<DeveloperAccessGrant | undefined>;
     get(id: string): Promise<DeveloperAccessGrant | undefined>;
     revoke(id: string, at: string): Promise<DeveloperAccessGrant | undefined>;
 }

package/node_modules/@noodle-borg/service/dist/oauth/developer-grant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"developer-grant.d.ts","sourceRoot":"","sources":["../../src/oauth/developer-grant.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,mBAAmB,EAAyB,MAAM,4BAA4B,CAAC;AAI7F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACzE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAC3D,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;CAC3E;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,kCAAkC,GAAG,4BAA4B,CAAC;AAE9E,qBAAa,2BAA4B,YAAW,mBAAmB;;gBAKzD,OAAO,GAAE,kCAAuC;IAKtD,MAAM,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC;IASxE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAK1D,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;CAahF;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,oBAAoB,EAC3B,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAQT;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,0BAA0B,EACjC,OAAO,GAAE,4BAAiC,GACzC,oBAAoB,CAgBtB;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,oBAAoB,GAAG,oBAAoB,CAkC/F;AAUD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAIrF"}
+{"version":3,"file":"developer-grant.d.ts","sourceRoot":"","sources":["../../src/oauth/developer-grant.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,mBAAmB,EAGzB,MAAM,4BAA4B,CAAC;AAEpC,eAAO,MAAM,uBAAuB,EAAG,CAAU,CAAC;AAClD,eAAO,MAAM,4BAA4B,EAAG,WAAoB,CAAC;AAEjE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,OAAO,uBAAuB,CAAC;IACjD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,OAAO,4BAA4B,CAAC;IAC1D,QAAQ,CAAC,YAAY,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,iBAAiB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACpF,SAAS,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IACxF,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAC3D,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;CAC3E;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,kCAAkC,GAAG,4BAA4B,CAAC;AAE9E,qBAAa,2BAA4B,YAAW,mBAAmB;;gBAKzD,OAAO,GAAE,kCAAuC;IAKtD,iBAAiB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAsBnF,SAAS,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAiBvF,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAK1D,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;CAahF;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,oBAAoB,EAC3B,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAWT;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,0BAA0B,EACjC,OAAO,GAAE,4BAAiC,GACzC,oBAAoB,CAkBtB;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,oBAAoB,GAAG,oBAAoB,CAuC/F;AA4CD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAIrF"}