@noodleseed/one 0.127.2 → 0.129.0

package/node_modules/@noodle-borg/oauth-client-registry/dist/client-registration-handler.d.ts

@@ -0,0 +1,18 @@
+import type { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients.js';
+import { type OAuthClientInformationFull } from '@modelcontextprotocol/sdk/shared/auth.js';
+import { type NormalizedOAuthRedirectClientMetadata } from '@noodle-borg/auth';
+import { type RequestHandler } from 'express';
+import { type Options as RateLimitOptions } from 'express-rate-limit';
+export type RegisteredOAuthClient = OAuthClientInformationFull & Omit<NormalizedOAuthRedirectClientMetadata, 'redirect_uris'> & {
+    readonly redirect_uris: string[];
+};
+export interface SafeClientRegistrationHandlerOptions {
+    readonly clientsStore: OAuthRegisteredClientsStore;
+    readonly clientSecretExpirySeconds?: number;
+    readonly rateLimit?: Partial<RateLimitOptions> | false;
+}
+/**
+ * Preserve the MCP SDK's DCR transport while retaining Noodle's normalized redirect-policy metadata.
+ */
+export declare function safeClientRegistrationHandler({ clientsStore, clientSecretExpirySeconds, rateLimit: rateLimitConfig, }: SafeClientRegistrationHandlerOptions): RequestHandler;
+//# sourceMappingURL=client-registration-handler.d.ts.map

package/node_modules/@noodle-borg/oauth-client-registry/dist/client-registration-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-registration-handler.d.ts","sourceRoot":"","sources":["../src/client-registration-handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAQpG,OAAO,EACL,KAAK,0BAA0B,EAGhC,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,KAAK,qCAAqC,EAI3C,MAAM,mBAAmB,CAAC;AAE3B,OAAgB,EAA4B,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAE,KAAK,OAAO,IAAI,gBAAgB,EAAa,MAAM,oBAAoB,CAAC;AAIjF,MAAM,MAAM,qBAAqB,GAAG,0BAA0B,GAC5D,IAAI,CAAC,qCAAqC,EAAE,eAAe,CAAC,GAAG;IAC7D,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;CAClC,CAAC;AAEJ,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,YAAY,EAAE,2BAA2B,CAAC;IACnD,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC;CACxD;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,YAAY,EACZ,yBAAgE,EAChE,SAAS,EAAE,eAAe,GAC3B,EAAE,oCAAoC,GAAG,cAAc,CAuEvD"}

package/node_modules/@noodle-borg/oauth-client-registry/dist/client-registration-handler.js

@@ -0,0 +1,130 @@
+import crypto from 'node:crypto';
+import { InvalidClientMetadataError, OAuthError, ServerError, TooManyRequestsError, } from '@modelcontextprotocol/sdk/server/auth/errors.js';
+import { allowedMethods } from '@modelcontextprotocol/sdk/server/auth/middleware/allowedMethods.js';
+import { OAuthClientInformationFullSchema, OAuthClientMetadataSchema, } from '@modelcontextprotocol/sdk/shared/auth.js';
+import { normalizeOAuthClientMetadata, OAuthRedirectPolicyError, } from '@noodle-borg/auth';
+import cors from 'cors';
+import express, {} from 'express';
+import { rateLimit } from 'express-rate-limit';
+const DEFAULT_CLIENT_SECRET_EXPIRY_SECONDS = 30 * 24 * 60 * 60;
+/**
+ * Preserve the MCP SDK's DCR transport while retaining Noodle's normalized redirect-policy metadata.
+ */
+export function safeClientRegistrationHandler({ clientsStore, clientSecretExpirySeconds = DEFAULT_CLIENT_SECRET_EXPIRY_SECONDS, rateLimit: rateLimitConfig, }) {
+    if (!clientsStore.registerClient) {
+        throw new Error('Client registration store does not support registering clients');
+    }
+    const registerClient = clientsStore.registerClient.bind(clientsStore);
+    const router = express.Router();
+    router.use(cors());
+    router.use(allowedMethods(['POST']));
+    router.use(express.json());
+    router.use(invalidJsonHandler);
+    if (rateLimitConfig !== false) {
+        router.use(rateLimit({
+            windowMs: 60 * 60 * 1000,
+            max: 20,
+            standardHeaders: true,
+            legacyHeaders: false,
+            message: new TooManyRequestsError('You have exceeded the rate limit for client registration requests').toResponseObject(),
+            ...rateLimitConfig,
+        }));
+    }
+    router.post('/', async (req, res) => {
+        res.setHeader('Cache-Control', 'no-store');
+        try {
+            const parseResult = OAuthClientMetadataSchema.safeParse(req.body);
+            if (!parseResult.success) {
+                throw new InvalidClientMetadataError(parseResult.error.message);
+            }
+            const submitted = requestObject(req.body);
+            const normalized = normalizeOAuthClientMetadata({
+                application_type: submitted.application_type,
+                redirect_uris: parseResult.data.redirect_uris,
+                token_endpoint_auth_method: submitted.token_endpoint_auth_method,
+                noodle_redirect_policy_version: submitted.noodle_redirect_policy_version,
+            });
+            const persistedPolicy = { ...normalized, redirect_uris: [...normalized.redirect_uris] };
+            const issuedAt = Math.floor(Date.now() / 1000);
+            const hasSecret = normalized.token_endpoint_auth_method === 'client_secret_post';
+            const credentials = hasSecret
+                ? {
+                    client_secret: crypto.randomBytes(32).toString('hex'),
+                    client_secret_expires_at: clientSecretExpirySeconds > 0 ? issuedAt + clientSecretExpirySeconds : 0,
+                }
+                : {};
+            const client = {
+                ...parseResult.data,
+                ...persistedPolicy,
+                ...credentials,
+                client_id: crypto.randomUUID(),
+                client_id_issued_at: issuedAt,
+            };
+            const stored = await registerClient(client);
+            res.status(201).json(validatedStoredClient(stored, persistedPolicy));
+        }
+        catch (error) {
+            const oauthError = registrationError(error);
+            const status = oauthError instanceof ServerError ? 500 : 400;
+            res.status(status).json(oauthError.toResponseObject());
+        }
+    });
+    return router;
+}
+const invalidJsonHandler = (error, _req, res, next) => {
+    if (!isInvalidJson(error)) {
+        next(error);
+        return;
+    }
+    res.setHeader('Cache-Control', 'no-store');
+    res
+        .status(400)
+        .json(new InvalidClientMetadataError('client metadata must be valid JSON').toResponseObject());
+};
+function isInvalidJson(error) {
+    if (!(error instanceof SyntaxError))
+        return false;
+    const parseError = error;
+    return parseError.status === 400 && parseError.type === 'entity.parse.failed';
+}
+function requestObject(value) {
+    return typeof value === 'object' && value !== null ? value : {};
+}
+function validatedStoredClient(value, normalized) {
+    const sdkRecord = OAuthClientInformationFullSchema.safeParse(value);
+    const stored = requestObject(value);
+    if (!sdkRecord.success ||
+        stored.application_type !== normalized.application_type ||
+        stored.token_endpoint_auth_method !== normalized.token_endpoint_auth_method ||
+        stored.noodle_redirect_policy_version !== normalized.noodle_redirect_policy_version ||
+        !sameRedirectUris(stored.redirect_uris, normalized.redirect_uris)) {
+        throw new ServerError('Internal Server Error');
+    }
+    return value;
+}
+function sameRedirectUris(actual, expected) {
+    return (Array.isArray(actual) &&
+        actual.length === expected.length &&
+        actual.every((value, index) => value === expected[index]));
+}
+function registrationError(error) {
+    if (error instanceof OAuthRedirectPolicyError) {
+        return new InvalidClientMetadataError(policyErrorDescription(error.reason));
+    }
+    if (error instanceof OAuthError)
+        return error;
+    return new ServerError('Internal Server Error');
+}
+function policyErrorDescription(reason) {
+    switch (reason) {
+        case 'invalid_application_type':
+            return 'application_type must be web or native';
+        case 'invalid_redirect_uris':
+            return 'redirect_uris must be a non-empty list of URI strings';
+        case 'unsafe_redirect_uri':
+            return 'redirect_uris must use HTTPS or a permitted loopback HTTP redirect without credentials or fragments';
+        case 'unsupported_token_endpoint_auth_method':
+            return 'token_endpoint_auth_method must be none or client_secret_post';
+    }
+}
+//# sourceMappingURL=client-registration-handler.js.map

package/node_modules/@noodle-borg/oauth-client-registry/dist/client-registration-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-registration-handler.js","sourceRoot":"","sources":["../src/client-registration-handler.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EACL,0BAA0B,EAC1B,UAAU,EACV,WAAW,EACX,oBAAoB,GACrB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,oEAAoE,CAAC;AACpG,OAAO,EAEL,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAEL,4BAA4B,EAC5B,wBAAwB,GAEzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAAO,EAAE,EAAiD,MAAM,SAAS,CAAC;AACjF,OAAO,EAAoC,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEjF,MAAM,oCAAoC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAa/D;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAC5C,YAAY,EACZ,yBAAyB,GAAG,oCAAoC,EAChE,SAAS,EAAE,eAAe,GACW;IACrC,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,cAAc,GAAG,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAE/B,IAAI,eAAe,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CACR,SAAS,CAAC;YACR,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;YACxB,GAAG,EAAE,EAAE;YACP,eAAe,EAAE,IAAI;YACrB,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,IAAI,oBAAoB,CAC/B,mEAAmE,CACpE,CAAC,gBAAgB,EAAE;YACpB,GAAG,eAAe;SACnB,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,yBAAyB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBACzB,MAAM,IAAI,0BAA0B,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,4BAA4B,CAAC;gBAC9C,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;gBAC5C,aAAa,EAAE,WAAW,CAAC,IAAI,CAAC,aAAa;gBAC7C,0BAA0B,EAAE,SAAS,CAAC,0BAA0B;gBAChE,8BAA8B,EAAE,SAAS,CAAC,8BAA8B;aACzE,CAAC,CAAC;YACH,MAAM,eAAe,GAAG,EAAE,GAAG,UAAU,EAAE,aAAa,EAAE,CAAC,GAAG,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACxF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,UAAU,CAAC,0BAA0B,KAAK,oBAAoB,CAAC;YACjF,MAAM,WAAW,GAAG,SAAS;gBAC3B,CAAC,CAAC;oBACE,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;oBACrD,wBAAwB,EACtB,yBAAyB,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC;iBAC3E;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,MAAM,GAA0B;gBACpC,GAAG,WAAW,CAAC,IAAI;gBACnB,GAAG,eAAe;gBAClB,GAAG,WAAW;gBACd,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE;gBAC9B,mBAAmB,EAAE,QAAQ;aAC9B,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,MAA+E,CAChF,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,UAAU,YAAY,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC7D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,kBAAkB,GAAwB,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACzE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,CAAC;QACZ,OAAO;IACT,CAAC;IACD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC3C,GAAG;SACA,MAAM,CAAC,GAAG,CAAC;SACX,IAAI,CAAC,IAAI,0BAA0B,CAAC,oCAAoC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;AACnG,CAAC,CAAC;AAEF,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,CAAC,KAAK,YAAY,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,UAAU,GAAG,KAA+D,CAAC;IACnF,OAAO,UAAU,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,KAAK,qBAAqB,CAAC;AAChF,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/F,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAc,EACd,UAAiD;IAEjD,MAAM,SAAS,GAAG,gCAAgC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,IACE,CAAC,SAAS,CAAC,OAAO;QAClB,MAAM,CAAC,gBAAgB,KAAK,UAAU,CAAC,gBAAgB;QACvD,MAAM,CAAC,0BAA0B,KAAK,UAAU,CAAC,0BAA0B;QAC3E,MAAM,CAAC,8BAA8B,KAAK,UAAU,CAAC,8BAA8B;QACnF,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,aAAa,CAAC,EACjE,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,uBAAuB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAA8B,CAAC;AACxC,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAe,EAAE,QAA2B;IACpE,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACrB,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QACjC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;QAC9C,OAAO,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,IAAI,WAAW,CAAC,uBAAuB,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAsC;IACpE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,0BAA0B;YAC7B,OAAO,wCAAwC,CAAC;QAClD,KAAK,uBAAuB;YAC1B,OAAO,uDAAuD,CAAC;QACjE,KAAK,qBAAqB;YACxB,OAAO,qGAAqG,CAAC;QAC/G,KAAK,wCAAwC;YAC3C,OAAO,+DAA+D,CAAC;IAC3E,CAAC;AACH,CAAC"}

package/node_modules/@noodle-borg/oauth-client-registry/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { type AuthorizationRedirectLogger, type AuthorizationRedirectScalarFields, type SafeAuthorizationHandlerOptions, safeAuthorizationHandler, } from './authorization-handler.js';
+export { type RegisteredOAuthClient, type SafeClientRegistrationHandlerOptions, safeClientRegistrationHandler, } from './client-registration-handler.js';
+export { type LegacyOAuthRedirectInventoryCommandOptions, runLegacyOAuthRedirectInventoryCommand, } from './legacy-inventory.js';
+export { type OAuthLegacyRedirectRollout, stageALegacyRedirectRollout, } from './legacy-redirect-rollout.js';
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/oauth-client-registry/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,iCAAiC,EACtC,KAAK,+BAA+B,EACpC,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,oCAAoC,EACzC,6BAA6B,GAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,KAAK,0CAA0C,EAC/C,sCAAsC,GACvC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,0BAA0B,EAC/B,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC"}

package/node_modules/@noodle-borg/oauth-client-registry/dist/index.js

@@ -0,0 +1,5 @@
+export { safeAuthorizationHandler, } from './authorization-handler.js';
+export { safeClientRegistrationHandler, } from './client-registration-handler.js';
+export { runLegacyOAuthRedirectInventoryCommand, } from './legacy-inventory.js';
+export { stageALegacyRedirectRollout, } from './legacy-redirect-rollout.js';
+//# sourceMappingURL=index.js.map

package/node_modules/@noodle-borg/oauth-client-registry/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAGL,6BAA6B,GAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAEL,sCAAsC,GACvC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC"}

package/node_modules/@noodle-borg/oauth-client-registry/dist/legacy-inventory.d.ts

@@ -0,0 +1,54 @@
+import { Pool } from 'pg';
+type InventoryFormat = 'json' | 'text';
+interface FingerprintedClassSummary {
+    count: number;
+    clientFingerprints: string[];
+}
+interface LegacyOAuthRedirectInventoryCounts {
+    readonly scannedClientCount: number;
+    readonly normalizedCount: number;
+    readonly legacyClasses: {
+        readonly safe_https: {
+            readonly count: number;
+        };
+        readonly safe_loopback_legacy: FingerprintedClassSummary;
+        readonly unsafe_legacy: FingerprintedClassSummary;
+        readonly malformed_legacy: FingerprintedClassSummary;
+    };
+}
+export interface LegacyOAuthRedirectInventorySummary {
+    readonly schemaVersion: 1;
+    readonly complete: true;
+    readonly scannedClientCount: number;
+    readonly normalizedCount: number;
+    readonly legacyClasses: {
+        readonly safe_https: {
+            readonly count: number;
+        };
+        readonly safe_loopback_legacy: FingerprintedClassSummary;
+        readonly unsafe_legacy: FingerprintedClassSummary;
+        readonly malformed_legacy: FingerprintedClassSummary;
+    };
+}
+interface WritableOutput {
+    write(value: string): unknown;
+}
+export interface LegacyOAuthRedirectInventoryCommandOptions {
+    readonly argv?: readonly string[];
+    readonly env?: Readonly<Record<string, string | undefined>>;
+    readonly stdout?: WritableOutput;
+    readonly stderr?: WritableOutput;
+    readonly poolFactory?: (databaseUrl: string) => Pool;
+}
+/** Loads the one-run correlation key without exposing its contents or location in errors. */
+export declare function readOAuthInventoryFingerprintKey(path: string): Promise<Buffer>;
+/** Produces a run-key-bound identifier that cannot be correlated after key rotation. */
+export declare function fingerprintOAuthClientId(clientId: string, key: Buffer): string;
+/** Reads one complete database snapshot and returns only private, incomplete inventory counts. */
+export declare function collectLegacyOAuthRedirectInventory(pool: Pool, fingerprintKey: Buffer): Promise<LegacyOAuthRedirectInventoryCounts>;
+/** Internal operator command entry point. It emits a summary only after scan, commit, and pool shutdown. */
+export declare function runLegacyOAuthRedirectInventoryCommand(options?: LegacyOAuthRedirectInventoryCommandOptions): Promise<number>;
+/** Serializes only the documented, privacy-bounded summary fields. */
+export declare function formatLegacyOAuthRedirectInventory(summary: LegacyOAuthRedirectInventorySummary, format: InventoryFormat): string;
+export {};
+//# sourceMappingURL=legacy-inventory.d.ts.map

package/node_modules/@noodle-borg/oauth-client-registry/dist/legacy-inventory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-inventory.d.ts","sourceRoot":"","sources":["../src/legacy-inventory.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,IAAI,EAAyC,MAAM,IAAI,CAAC;AAgCjE,KAAK,eAAe,GAAG,MAAM,GAAG,MAAM,CAAC;AAevC,UAAU,yBAAyB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE;QACtB,QAAQ,CAAC,UAAU,EAAE;YAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAChD,QAAQ,CAAC,oBAAoB,EAAE,yBAAyB,CAAC;QACzD,QAAQ,CAAC,aAAa,EAAE,yBAAyB,CAAC;QAClD,QAAQ,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;KACtD,CAAC;CACH;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE;QACtB,QAAQ,CAAC,UAAU,EAAE;YAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAChD,QAAQ,CAAC,oBAAoB,EAAE,yBAAyB,CAAC;QACzD,QAAQ,CAAC,aAAa,EAAE,yBAAyB,CAAC;QAClD,QAAQ,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;KACtD,CAAC;CACH;AAED,UAAU,cAAc;IACtB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,0CAA0C;IACzD,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;CACtD;AAED,6FAA6F;AAC7F,wBAAsB,gCAAgC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBpF;AAED,wFAAwF;AACxF,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAG9E;AAED,kGAAkG;AAClG,wBAAsB,mCAAmC,CACvD,IAAI,EAAE,IAAI,EACV,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,kCAAkC,CAAC,CAyC7C;AAED,4GAA4G;AAC5G,wBAAsB,sCAAsC,CAC1D,OAAO,GAAE,0CAA+C,GACvD,OAAO,CAAC,MAAM,CAAC,CA2BjB;AAED,sEAAsE;AACtE,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,mCAAmC,EAC5C,MAAM,EAAE,eAAe,GACtB,MAAM,CAoBR"}

package/node_modules/@noodle-borg/oauth-client-registry/dist/legacy-inventory.js

@@ -0,0 +1,256 @@
+import { createHmac } from 'node:crypto';
+import { constants, open } from 'node:fs/promises';
+import { isAbsolute } from 'node:path';
+import { classifyStoredOAuthRedirectPolicy, } from '@noodle-borg/auth';
+import { Pool } from 'pg';
+const INVENTORY_PAGE_SIZE = 100;
+const INVENTORY_APPLICATION_NAME = 'noodle-oauth-redirect-inventory';
+const FAILED_MESSAGE = 'OAuth redirect inventory failed; no summary was emitted.\n';
+const INVENTORY_PAGE_QUERY = `
+  SELECT client_id,
+         jsonb_build_object(
+           'present', client ? 'application_type',
+           'value', client -> 'application_type'
+         ) AS application_type,
+         jsonb_build_object(
+           'present', client ? 'redirect_uris',
+           'value', client -> 'redirect_uris'
+         ) AS redirect_uris,
+         jsonb_build_object(
+           'present', client ? 'token_endpoint_auth_method',
+           'value', client -> 'token_endpoint_auth_method'
+         ) AS token_endpoint_auth_method,
+         jsonb_build_object(
+           'present', client ? 'noodle_redirect_policy_version',
+           'value', client -> 'noodle_redirect_policy_version'
+         ) AS noodle_redirect_policy_version
+    FROM oauth_clients
+   WHERE ($1::text IS NULL OR client_id COLLATE "C" > $1::text COLLATE "C")
+   ORDER BY client_id COLLATE "C" ASC
+   LIMIT $2
+`;
+/** Loads the one-run correlation key without exposing its contents or location in errors. */
+export async function readOAuthInventoryFingerprintKey(path) {
+    if (!isAbsolute(path))
+        throw invalidFingerprintKey();
+    let handle;
+    try {
+        handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+        const stats = await handle.stat();
+        if (!stats.isFile() || (stats.mode & 0o7777) !== 0o600)
+            throw invalidFingerprintKey();
+        const boundedContent = Buffer.alloc(67);
+        const { bytesRead } = await handle.read(boundedContent, 0, boundedContent.length, 0);
+        const content = boundedContent.subarray(0, bytesRead);
+        const encoded = removeOneTerminalLineEnding(content);
+        if (encoded.length !== 64 || !/^[0-9a-fA-F]{64}$/.test(encoded.toString('ascii'))) {
+            throw invalidFingerprintKey();
+        }
+        const key = Buffer.from(encoded.toString('ascii'), 'hex');
+        if (key.length !== 32)
+            throw invalidFingerprintKey();
+        return key;
+    }
+    catch {
+        throw invalidFingerprintKey();
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+    }
+}
+/** Produces a run-key-bound identifier that cannot be correlated after key rotation. */
+export function fingerprintOAuthClientId(clientId, key) {
+    if (key.length !== 32)
+        throw invalidFingerprintKey();
+    return createHmac('sha256', key).update(clientId, 'utf8').digest('hex');
+}
+/** Reads one complete database snapshot and returns only private, incomplete inventory counts. */
+export async function collectLegacyOAuthRedirectInventory(pool, fingerprintKey) {
+    if (fingerprintKey.length !== 32)
+        throw invalidFingerprintKey();
+    const client = await pool.connect();
+    let released = false;
+    try {
+        await client.query('BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY');
+        const counts = mutableCounts();
+        let cursor = null;
+        for (;;) {
+            const page = await client.query(INVENTORY_PAGE_QUERY, [cursor, INVENTORY_PAGE_SIZE]);
+            if (page.rows.length > INVENTORY_PAGE_SIZE)
+                throw new Error('invalid inventory page');
+            for (const row of page.rows)
+                addRowToCounts(counts, row, fingerprintKey);
+            if (page.rows.length === 0)
+                break;
+            const nextCursor = page.rows.at(-1)?.client_id;
+            if (typeof nextCursor !== 'string' || nextCursor === cursor) {
+                throw new Error('invalid inventory cursor');
+            }
+            cursor = nextCursor;
+            if (page.rows.length < INVENTORY_PAGE_SIZE)
+                break;
+        }
+        await client.query('COMMIT');
+        return counts;
+    }
+    catch (error) {
+        let destroy = false;
+        try {
+            await client.query('ROLLBACK');
+        }
+        catch {
+            destroy = true;
+        }
+        client.release(destroy);
+        released = true;
+        throw error;
+    }
+    finally {
+        if (!released)
+            client.release();
+    }
+}
+/** Internal operator command entry point. It emits a summary only after scan, commit, and pool shutdown. */
+export async function runLegacyOAuthRedirectInventoryCommand(options = {}) {
+    const argv = options.argv ?? process.argv.slice(2);
+    const env = options.env ?? process.env;
+    const stdout = options.stdout ?? process.stdout;
+    const stderr = options.stderr ?? process.stderr;
+    let pool;
+    try {
+        const parsed = parseArguments(argv);
+        const databaseUrl = env.NOODLE_OAUTH_INVENTORY_DATABASE_URL;
+        if (databaseUrl === undefined || databaseUrl.length === 0)
+            throw new Error('missing database URL');
+        const fingerprintKey = await readOAuthInventoryFingerprintKey(parsed.fingerprintKeyFile);
+        const poolFactory = options.poolFactory ?? defaultPoolFactory;
+        pool = poolFactory(databaseUrl);
+        const counts = await collectLegacyOAuthRedirectInventory(pool, fingerprintKey);
+        await pool.end();
+        pool = undefined;
+        const summary = completeInventorySummary(counts);
+        const output = formatLegacyOAuthRedirectInventory(summary, parsed.format);
+        stdout.write(output);
+        return 0;
+    }
+    catch {
+        await pool?.end().catch(() => undefined);
+        stderr.write(FAILED_MESSAGE);
+        return 1;
+    }
+}
+/** Serializes only the documented, privacy-bounded summary fields. */
+export function formatLegacyOAuthRedirectInventory(summary, format) {
+    if (format === 'json')
+        return `${JSON.stringify(summary)}\n`;
+    const { legacyClasses } = summary;
+    return [
+        `schema_version: ${summary.schemaVersion}`,
+        `complete: ${summary.complete}`,
+        `scanned_client_count: ${summary.scannedClientCount}`,
+        `normalized_count: ${summary.normalizedCount}`,
+        `safe_https_count: ${legacyClasses.safe_https.count}`,
+        `safe_loopback_legacy_count: ${legacyClasses.safe_loopback_legacy.count}`,
+        ...fingerprintLines('safe_loopback_legacy', legacyClasses.safe_loopback_legacy.clientFingerprints),
+        `unsafe_legacy_count: ${legacyClasses.unsafe_legacy.count}`,
+        ...fingerprintLines('unsafe_legacy', legacyClasses.unsafe_legacy.clientFingerprints),
+        `malformed_legacy_count: ${legacyClasses.malformed_legacy.count}`,
+        ...fingerprintLines('malformed_legacy', legacyClasses.malformed_legacy.clientFingerprints),
+        '',
+    ].join('\n');
+}
+function defaultPoolFactory(databaseUrl) {
+    return new Pool({
+        connectionString: databaseUrl,
+        max: 1,
+        application_name: INVENTORY_APPLICATION_NAME,
+    });
+}
+function parseArguments(argv) {
+    const commandArguments = argv[0] === '--' ? argv.slice(1) : argv;
+    let fingerprintKeyFile;
+    let format = 'text';
+    let formatSeen = false;
+    for (let index = 0; index < commandArguments.length; index += 2) {
+        const flag = commandArguments[index];
+        const value = commandArguments[index + 1];
+        if (value === undefined)
+            throw new Error('invalid arguments');
+        if (flag === '--fingerprint-key-file' && fingerprintKeyFile === undefined) {
+            fingerprintKeyFile = value;
+            continue;
+        }
+        if (flag === '--format' && !formatSeen && (value === 'json' || value === 'text')) {
+            format = value;
+            formatSeen = true;
+            continue;
+        }
+        throw new Error('invalid arguments');
+    }
+    if (fingerprintKeyFile === undefined)
+        throw new Error('invalid arguments');
+    return { fingerprintKeyFile, format };
+}
+function removeOneTerminalLineEnding(content) {
+    if (content.at(-1) !== 0x0a)
+        return content;
+    const withoutLf = content.subarray(0, -1);
+    return withoutLf.at(-1) === 0x0d ? withoutLf.subarray(0, -1) : withoutLf;
+}
+function invalidFingerprintKey() {
+    return new Error('OAuth inventory fingerprint key is invalid');
+}
+function mutableCounts() {
+    return {
+        scannedClientCount: 0,
+        normalizedCount: 0,
+        legacyClasses: {
+            safe_https: { count: 0 },
+            safe_loopback_legacy: { count: 0, clientFingerprints: [] },
+            unsafe_legacy: { count: 0, clientFingerprints: [] },
+            malformed_legacy: { count: 0, clientFingerprints: [] },
+        },
+    };
+}
+function addRowToCounts(counts, row, fingerprintKey) {
+    if (typeof row.client_id !== 'string')
+        throw new Error('invalid inventory row');
+    const metadata = {};
+    addInventoryField(metadata, 'application_type', row.application_type);
+    addInventoryField(metadata, 'redirect_uris', row.redirect_uris);
+    addInventoryField(metadata, 'token_endpoint_auth_method', row.token_endpoint_auth_method);
+    addInventoryField(metadata, 'noodle_redirect_policy_version', row.noodle_redirect_policy_version);
+    const policyClass = classifyStoredOAuthRedirectPolicy(metadata);
+    counts.scannedClientCount += 1;
+    if (policyClass === 'normalized') {
+        counts.normalizedCount += 1;
+        return;
+    }
+    counts.legacyClasses[policyClass].count += 1;
+    if (policyClass !== 'safe_https') {
+        counts.legacyClasses[policyClass].clientFingerprints.push(fingerprintOAuthClientId(row.client_id, fingerprintKey));
+    }
+}
+function addInventoryField(metadata, field, envelope) {
+    if (typeof envelope !== 'object' ||
+        envelope === null ||
+        typeof envelope.present !== 'boolean' ||
+        !Object.hasOwn(envelope, 'value')) {
+        throw new Error('invalid inventory row');
+    }
+    if (envelope.present)
+        metadata[field] = envelope.value;
+}
+function completeInventorySummary(counts) {
+    return {
+        schemaVersion: 1,
+        complete: true,
+        scannedClientCount: counts.scannedClientCount,
+        normalizedCount: counts.normalizedCount,
+        legacyClasses: counts.legacyClasses,
+    };
+}
+function fingerprintLines(policyClass, fingerprints) {
+    return fingerprints.map((fingerprint) => `${policyClass}_fingerprint: ${fingerprint}`);
+}
+//# sourceMappingURL=legacy-inventory.js.map

package/node_modules/@noodle-borg/oauth-client-registry/dist/legacy-inventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-inventory.js","sourceRoot":"","sources":["../src/legacy-inventory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAmB,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EACL,iCAAiC,GAGlC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,IAAI,EAAyC,MAAM,IAAI,CAAC;AAEjE,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,0BAA0B,GAAG,iCAAiC,CAAC;AACrE,MAAM,cAAc,GAAG,4DAA4D,CAAC;AAEpF,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;;CAsB5B,CAAC;AA4DF,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,IAAY;IACjE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,qBAAqB,EAAE,CAAC;IAErD,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,KAAK;YAAE,MAAM,qBAAqB,EAAE,CAAC;QACtF,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACrF,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAClF,MAAM,qBAAqB,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,qBAAqB,EAAE,CAAC;QACrD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,qBAAqB,EAAE,CAAC;IAChC,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,GAAW;IACpE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,qBAAqB,EAAE,CAAC;IACrD,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,IAAU,EACV,cAAsB;IAEtB,IAAI,cAAc,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,qBAAqB,EAAE,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAC/B,IAAI,MAAM,GAAkB,IAAI,CAAC;QAEjC,SAAS,CAAC;YACR,MAAM,IAAI,GAA8B,MAAM,MAAM,CAAC,KAAK,CACxD,oBAAoB,EACpB,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAC9B,CAAC;YACF,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,mBAAmB;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YACtF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI;gBAAE,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YACzE,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM;YAElC,MAAM,UAAU,GAAuB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC;YACnE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9C,CAAC;YACD,MAAM,GAAG,UAAU,CAAC;YACpB,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,mBAAmB;gBAAE,MAAM;QACpD,CAAC;QAED,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxB,QAAQ,GAAG,IAAI,CAAC;QAChB,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,QAAQ;YAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED,4GAA4G;AAC5G,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,UAAsD,EAAE;IAExD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,IAAI,IAAsB,CAAC;IAE3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,WAAW,GAAG,GAAG,CAAC,mCAAmC,CAAC;QAC5D,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,MAAM,cAAc,GAAG,MAAM,gCAAgC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACzF,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC;QAC9D,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,mCAAmC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC/E,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QACjB,IAAI,GAAG,SAAS,CAAC;QACjB,MAAM,OAAO,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,kCAAkC,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC7B,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,kCAAkC,CAChD,OAA4C,EAC5C,MAAuB;IAEvB,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7D,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAClC,OAAO;QACL,mBAAmB,OAAO,CAAC,aAAa,EAAE;QAC1C,aAAa,OAAO,CAAC,QAAQ,EAAE;QAC/B,yBAAyB,OAAO,CAAC,kBAAkB,EAAE;QACrD,qBAAqB,OAAO,CAAC,eAAe,EAAE;QAC9C,qBAAqB,aAAa,CAAC,UAAU,CAAC,KAAK,EAAE;QACrD,+BAA+B,aAAa,CAAC,oBAAoB,CAAC,KAAK,EAAE;QACzE,GAAG,gBAAgB,CACjB,sBAAsB,EACtB,aAAa,CAAC,oBAAoB,CAAC,kBAAkB,CACtD;QACD,wBAAwB,aAAa,CAAC,aAAa,CAAC,KAAK,EAAE;QAC3D,GAAG,gBAAgB,CAAC,eAAe,EAAE,aAAa,CAAC,aAAa,CAAC,kBAAkB,CAAC;QACpF,2BAA2B,aAAa,CAAC,gBAAgB,CAAC,KAAK,EAAE;QACjE,GAAG,gBAAgB,CAAC,kBAAkB,EAAE,aAAa,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;QAC1F,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,WAAmB;IAC7C,OAAO,IAAI,IAAI,CAAC;QACd,gBAAgB,EAAE,WAAW;QAC7B,GAAG,EAAE,CAAC;QACN,gBAAgB,EAAE,0BAA0B;KAC7C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,IAAuB;IAI7C,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,IAAI,kBAAsC,CAAC;IAC3C,IAAI,MAAM,GAAoB,MAAM,CAAC;IACrC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,gBAAgB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC9D,IAAI,IAAI,KAAK,wBAAwB,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC1E,kBAAkB,GAAG,KAAK,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,CAAC,EAAE,CAAC;YACjF,MAAM,GAAG,KAAK,CAAC;YACf,UAAU,GAAG,IAAI,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,kBAAkB,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,2BAA2B,CAAC,OAAe;IAClD,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,aAAa;IAUpB,OAAO;QACL,kBAAkB,EAAE,CAAC;QACrB,eAAe,EAAE,CAAC;QAClB,aAAa,EAAE;YACb,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;YACxB,oBAAoB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,kBAAkB,EAAE,EAAE,EAAE;YAC1D,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,kBAAkB,EAAE,EAAE,EAAE;YACnD,gBAAgB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,kBAAkB,EAAE,EAAE,EAAE;SACvD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,MAAwC,EACxC,GAAiB,EACjB,cAAsB;IAEtB,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACtE,iBAAiB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IAChE,iBAAiB,CAAC,QAAQ,EAAE,4BAA4B,EAAE,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAC1F,iBAAiB,CAAC,QAAQ,EAAE,gCAAgC,EAAE,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAClG,MAAM,WAAW,GAAG,iCAAiC,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,CAAC,kBAAkB,IAAI,CAAC,CAAC;IAC/B,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QACjC,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAC7C,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QACjC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,kBAAkB,CAAC,IAAI,CACvD,wBAAwB,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,CAAC,CACxD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAqC,EACrC,KAAwC,EACxC,QAAgC;IAEhC,IACE,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,KAAK,IAAI;QACjB,OAAO,QAAQ,CAAC,OAAO,KAAK,SAAS;QACrC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,EACjC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO;QAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC;AACzD,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAA0C;IAE1C,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,IAAI;QACd,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,aAAa,EAAE,MAAM,CAAC,aAAa;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,WAA2C,EAC3C,YAA+B;IAE/B,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,GAAG,WAAW,iBAAiB,WAAW,EAAE,CAAC,CAAC;AACzF,CAAC"}

package/node_modules/@noodle-borg/oauth-client-registry/dist/legacy-redirect-rollout.d.ts

@@ -0,0 +1,7 @@
+export interface OAuthLegacyRedirectRollout {
+    readonly unsafeLegacyMode: 'observe' | 'deny';
+    readonly loopbackPortMode: 'observe' | 'exact';
+}
+/** Stage A is observation-only for client records created before redirect-policy normalization. */
+export declare const stageALegacyRedirectRollout: OAuthLegacyRedirectRollout;
+//# sourceMappingURL=legacy-redirect-rollout.d.ts.map

package/node_modules/@noodle-borg/oauth-client-registry/dist/legacy-redirect-rollout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-redirect-rollout.d.ts","sourceRoot":"","sources":["../src/legacy-redirect-rollout.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,GAAG,MAAM,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,EAAE,SAAS,GAAG,OAAO,CAAC;CAChD;AAED,mGAAmG;AACnG,eAAO,MAAM,2BAA2B,EAAE,0BAGzC,CAAC"}

package/node_modules/@noodle-borg/oauth-client-registry/dist/legacy-redirect-rollout.js

@@ -0,0 +1,6 @@
+/** Stage A is observation-only for client records created before redirect-policy normalization. */
+export const stageALegacyRedirectRollout = {
+    unsafeLegacyMode: 'observe',
+    loopbackPortMode: 'observe',
+};
+//# sourceMappingURL=legacy-redirect-rollout.js.map

package/node_modules/@noodle-borg/oauth-client-registry/dist/legacy-redirect-rollout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-redirect-rollout.js","sourceRoot":"","sources":["../src/legacy-redirect-rollout.ts"],"names":[],"mappings":"AAKA,mGAAmG;AACnG,MAAM,CAAC,MAAM,2BAA2B,GAA+B;IACrE,gBAAgB,EAAE,SAAS;IAC3B,gBAAgB,EAAE,SAAS;CAC5B,CAAC"}

package/node_modules/@noodle-borg/oauth-client-registry/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@noodle-borg/oauth-client-registry",
+  "version": "0.0.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@noodle-borg/auth": "0.0.0",
+    "cors": "^2.8.6"
+  },
+  "devDependencies": {
+    "@types/cors": "^2.8.19",
+    "@types/express": "^5.0.0",
+    "@types/node": "^24.13.1",
+    "@types/pg": "^8.20.0"
+  }
+}

package/node_modules/@noodle-borg/service/dist/assistant-delegated-projection.d.ts

@@ -0,0 +1,12 @@
+import type { ArtifactTool, RuntimeArtifact } from '@noodle-borg/compiler';
+import type { ConnectorCompileError, SecretBinding } from '@noodle-borg/connector-defs';
+/** Join keys for caller-derived bindings: `connectorId|operation`, `connectorId|*` for defaults. */
+export declare function delegatedAuthOperationKeys(bindings: readonly SecretBinding[]): ReadonlySet<string>;
+/** Whether any operation this tool fulfils through is bound to caller-derived connector auth. */
+export declare function toolTouchesDelegatedAuth(tool: Pick<ArtifactTool, 'fulfilment'>, keys: ReadonlySet<string>): boolean;
+/**
+ * Reject delegated-auth tools projected to `public` surfaces. A `mixed` surface deliberately
+ * projects them — reaching one raises the sign-in card — so only pure `public` is an error.
+ */
+export declare function publicSurfaceDelegatedAuthErrors(artifact: Pick<RuntimeArtifact, 'tools' | 'server'>, bindings: readonly SecretBinding[]): readonly ConnectorCompileError[];
+//# sourceMappingURL=assistant-delegated-projection.d.ts.map

package/node_modules/@noodle-borg/service/dist/assistant-delegated-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assistant-delegated-projection.d.ts","sourceRoot":"","sources":["../src/assistant-delegated-projection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,KAAK,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAqBxF,oGAAoG;AACpG,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,SAAS,aAAa,EAAE,GACjC,WAAW,CAAC,MAAM,CAAC,CAOrB;AAOD,iGAAiG;AACjG,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,EACtC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,GACxB,OAAO,CAMT;AAOD;;;GAGG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,EACnD,QAAQ,EAAE,SAAS,aAAa,EAAE,GACjC,SAAS,qBAAqB,EAAE,CAuBlC"}