@noodleseed/one 0.137.0 → 0.138.0

package/node_modules/@noodle-borg/wire-contracts/dist/control-plane.js

@@ -1,12 +1,133 @@
 /** Strict service-output contracts for control-plane reads and mutations (ADR 0128). */
 import { z } from 'zod';
 import { accessModeSchema } from './access-mode.js';
+function containsC0OrDel(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const codeUnit = value.charCodeAt(index);
+        if (codeUnit <= 0x1f || codeUnit === 0x7f)
+            return true;
+    }
+    return false;
+}
+/** Exact OAuth subject bound by an operator to an owner-only deployment. */
+export const deploymentOwnerSubjectSchema = z
+    .string()
+    .min(1)
+    .max(512)
+    .refine((value) => value.trim() === value && !containsC0OrDel(value), 'owner subject must not contain outer whitespace or C0/DEL control characters');
 export const accessUpdateRequestSchema = z
     .object({
     accessMode: accessModeSchema,
+    ownerSubject: deploymentOwnerSubjectSchema.optional(),
     serverVersion: z.string().min(1).optional(),
 })
-    .strict();
+    .strict()
+    .superRefine((value, context) => {
+    if (value.ownerSubject !== undefined && value.accessMode !== 'owner-only') {
+        context.addIssue({
+            code: 'custom',
+            path: ['ownerSubject'],
+            message: 'ownerSubject is valid only with owner-only access',
+        });
+    }
+});
+export const accessUpdateResponseSchema = z
+    .object({
+    ok: z.literal(true),
+    target: z
+        .object({
+        org: z.string().min(1),
+        app: z.string().min(1),
+        env: z.string().min(1),
+    })
+        .strict(),
+    deployment: z
+        .object({
+        deploymentId: z.string().min(1),
+        serverVersion: z.string().min(1).optional(),
+        accessMode: accessModeSchema,
+        ownerSubject: deploymentOwnerSubjectSchema.optional(),
+    })
+        .strict(),
+    previousAccessMode: accessModeSchema,
+    previousOwnerSubject: deploymentOwnerSubjectSchema.optional(),
+    accessChanged: z.boolean(),
+    ownerChanged: z.boolean(),
+    changed: z.boolean(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.deployment.accessMode === 'owner-only' &&
+        value.deployment.ownerSubject === undefined) {
+        context.addIssue({
+            code: 'custom',
+            path: ['deployment', 'ownerSubject'],
+            message: 'owner-only access requires a current owner subject',
+        });
+    }
+    if (value.changed !== (value.accessChanged || value.ownerChanged)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['changed'],
+            message: 'changed must equal accessChanged || ownerChanged',
+        });
+    }
+});
+/**
+ * Additive client reader for the access mutation response. Older services emitted only the aggregate
+ * `changed` bit, so the mode component is derived from the authoritative previous/current modes while an
+ * unobservable owner component remains omitted. Modern component bits retain the strict cross-field check.
+ */
+export const accessUpdateClientResponseSchema = z
+    .object({
+    ok: z.literal(true),
+    target: z.object({
+        org: z.string().min(1),
+        app: z.string().min(1),
+        env: z.string().min(1),
+    }),
+    deployment: z.object({
+        deploymentId: z.string().min(1),
+        serverVersion: z.string().min(1).optional(),
+        accessMode: accessModeSchema,
+        ownerSubject: deploymentOwnerSubjectSchema.optional(),
+    }),
+    previousAccessMode: accessModeSchema,
+    previousOwnerSubject: deploymentOwnerSubjectSchema.optional(),
+    accessChanged: z.boolean().optional(),
+    ownerChanged: z.boolean().optional(),
+    changed: z.boolean(),
+})
+    .superRefine((value, context) => {
+    const modernComponents = value.accessChanged !== undefined && value.ownerChanged !== undefined;
+    if ((value.accessChanged === undefined) !== (value.ownerChanged === undefined)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['accessChanged'],
+            message: 'accessChanged and ownerChanged must be present together',
+        });
+    }
+    if (modernComponents &&
+        value.deployment.accessMode === 'owner-only' &&
+        value.deployment.ownerSubject === undefined) {
+        context.addIssue({
+            code: 'custom',
+            path: ['deployment', 'ownerSubject'],
+            message: 'owner-only access requires a current owner subject',
+        });
+    }
+    if (modernComponents && value.changed !== (value.accessChanged || value.ownerChanged)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['changed'],
+            message: 'changed must equal accessChanged || ownerChanged',
+        });
+    }
+})
+    .transform((value) => ({
+    ...value,
+    accessChanged: value.accessChanged ?? value.previousAccessMode !== value.deployment.accessMode,
+}));
 export const deploymentLockRequestSchema = z
     .object({
     serverVersion: z.string().min(1),
@@ -32,6 +153,7 @@ export const DeploymentSummarySchema = z
     serverName: z.string(),
     createdAt: z.string(),
     createdByEmail: z.string().optional(),
+    ownerSubject: deploymentOwnerSubjectSchema.optional(),
     deploymentSource: z.string().optional(),
     accessMode: accessModeSchema,
     deploymentLock: DeploymentLockMetadataSchema.optional(),

package/node_modules/@noodle-borg/wire-contracts/dist/index.d.ts

@@ -80,6 +80,7 @@ export declare const deployRequestSchema: z.ZodObject<{
         mixed: "mixed";
         customers: "customers";
     }>>;
+    ownerSubject: z.ZodOptional<z.ZodString>;
     orgMembershipSources: z.ZodOptional<z.ZodArray<z.ZodEnum<{
         explicit: "explicit";
         domain: "domain";
@@ -115,6 +116,7 @@ export declare const deploySuccessResponseSchema: z.ZodObject<{
         mixed: "mixed";
         customers: "customers";
     }>;
+    ownerSubject: z.ZodOptional<z.ZodString>;
     url: z.ZodString;
     defaultUrl: z.ZodString;
     embedId: z.ZodOptional<z.ZodString>;
@@ -158,6 +160,7 @@ export declare const deployPreflightRequestSchema: z.ZodObject<{
         mixed: "mixed";
         customers: "customers";
     }>>;
+    ownerSubject: z.ZodOptional<z.ZodString>;
     orgMembershipSources: z.ZodOptional<z.ZodArray<z.ZodEnum<{
         explicit: "explicit";
         domain: "domain";
@@ -183,6 +186,7 @@ export type DeployTargetState = z.infer<typeof deployTargetStateSchema>;
 export declare const deployPreflightResponseSchema: z.ZodObject<{
     ok: z.ZodLiteral<true>;
     ready: z.ZodBoolean;
+    ownerSubject: z.ZodOptional<z.ZodString>;
     target: z.ZodObject<{
         org: z.ZodString;
         app: z.ZodString;

package/node_modules/@noodle-borg/wire-contracts/dist/index.js

@@ -9,6 +9,7 @@
  */
 import { z } from 'zod';
 import { accessModeSchema } from './access-mode.js';
+import { deploymentOwnerSubjectSchema } from './control-plane.js';
 export * from './access-mode.js';
 export * from './assistant.js';
 export * from './billing-operations.js';
@@ -50,14 +51,25 @@ export const hostedAssetSchema = z.object({
  */
 export const ORG_MEMBERSHIP_SOURCES = ['explicit', 'domain'];
 export const orgMembershipSourceSchema = z.enum(ORG_MEMBERSHIP_SOURCES);
-export const deployRequestSchema = z.object({
+export const deployRequestSchema = z
+    .object({
     manifest: z.string().min(1),
     connectors: z.string().min(1).optional(),
     hostedAssets: z.array(hostedAssetSchema).optional(),
     accessMode: accessModeSchema.optional(),
+    ownerSubject: deploymentOwnerSubjectSchema.optional(),
     orgMembershipSources: z.array(orgMembershipSourceSchema).min(1).optional(),
     serverVersion: z.string().min(1).optional(),
     deploymentSource: deploymentSourceSchema.optional(),
+})
+    .superRefine((value, context) => {
+    if (value.ownerSubject !== undefined && (value.accessMode ?? 'owner-only') !== 'owner-only') {
+        context.addIssue({
+            code: 'custom',
+            path: ['ownerSubject'],
+            message: 'ownerSubject is valid only with owner-only access',
+        });
+    }
 });
 /** Exact bytes both sides bind when deriving a retry-safe deploy key. */
 export function deployIdempotencyMaterial(target, requestBody) {
@@ -72,6 +84,7 @@ export const deploySuccessResponseSchema = z.object({
     deploymentId: z.string().min(1),
     serverVersion: z.string().min(1),
     accessMode: accessModeSchema,
+    ownerSubject: deploymentOwnerSubjectSchema.optional(),
     url: z.string().min(1),
     defaultUrl: z.string().min(1),
     /**
@@ -111,6 +124,7 @@ const deployPreflightErrorSchema = z.object({
 export const deployPreflightResponseSchema = z.object({
     ok: z.literal(true),
     ready: z.boolean(),
+    ownerSubject: deploymentOwnerSubjectSchema.optional(),
     target: z.object({
         org: z.string().min(1),
         app: z.string().min(1),

package/node_modules/@noodleseed/assistant/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/assistant",
-  "version": "1.22.0",
+  "version": "1.23.0",
   "description": "Embed the Noodle Seed customer-branded assistant in your web app with managed or framework-owned UI, a framework-neutral MCP App host, a DOM-free client, and a backend session helper. Authoring and deploying the server is @noodleseed/one.",
   "license": "Apache-2.0",
   "repository": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.137.0",
+  "version": "0.138.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",
@@ -236,7 +236,7 @@
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.81.0",
+    "@noodle-borg/agent-kit": "0.82.0",
     "@noodle-borg/app-audit": "0.0.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",