@noodleseed/one 0.140.0 → 0.141.0

package/node_modules/@noodle-borg/auth/dist/control-plane-token-exchange.js

@@ -0,0 +1,217 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { jwtVerify } from 'jose';
+/**
+ * The inbound half of the delegated token exchange (RFC 8693), serving exactly one first-party
+ * caller: the hosted assistant's control-plane connector. We implement the same target-endpoint
+ * contract we ask every customer token endpoint to implement (docs/spec/connectors.md, ADR 0152) —
+ * verify the platform-signed assertion, identify the user by `(customer_identity.issuer, sub)`,
+ * honour the 120s lifetime and single-use `jti`, and return a standard token response.
+ *
+ * The same issuer and signing key mint control-plane access tokens and exchange assertions, so
+ * **audience separation is the entire security boundary**: this exchange accepts only the dedicated
+ * exchange URN below and structurally refuses every resource audience (all of which are URLs) —
+ * including our own access tokens presented as subject tokens. The minted token is capability-scoped
+ * through the developer-grant machinery, so rollback/config-write can never be stored on it and
+ * every control-plane route re-checks live org membership per request.
+ *
+ * This module is the Express-free decision core; the hosted service wraps it in a thin HTTP adapter
+ * and supplies every policy port below (ADR 0218).
+ */
+export const CONTROL_PLANE_EXCHANGE_AUDIENCE = 'urn:noodleseed:control-plane:delegated-exchange';
+export const CONTROL_PLANE_EXCHANGE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:token-exchange';
+const SUBJECT_TOKEN_TYPE = 'urn:ietf:params:oauth:token-type:jwt';
+const ASSERTION_MAX_LIFETIME_SECONDS = 125; // 120s contract + clock tolerance
+const TOKEN_TTL_SECONDS = 600;
+const ASSISTANT_CLIENT_ISSUER_PREFIX = 'urn:noodleseed:assistant-client:';
+/** Local/test-only; production deployments need durable shared atomic replay storage. */
+export class InMemoryTokenExchangeJtiStore {
+    #seen = new Map();
+    async consume(jti, expiresAtMs, nowMs) {
+        for (const [key, expiry] of this.#seen) {
+            if (expiry <= nowMs)
+                this.#seen.delete(key);
+        }
+        if (this.#seen.has(jti))
+            return false;
+        this.#seen.set(jti, expiresAtMs);
+        return true;
+    }
+}
+export async function decideControlPlaneTokenExchange(request, deps) {
+    const refuse = async (status, error, description, reasonCode, tenant) => {
+        // Audit is tenant-scoped; refusals before a verified tenant claim have no tenant to charge.
+        if (tenant !== undefined) {
+            await deps.audit?.emit({
+                eventType: 'control_plane.token_exchange.refused',
+                org: tenant.org,
+                app: tenant.app,
+                env: tenant.env,
+                decision: 'deny',
+                status,
+                reasonCode,
+            });
+        }
+        return {
+            status,
+            body: { error, error_description: description },
+            ...(status === 401 ? { wwwAuthenticate: 'Basic realm="token"' } : {}),
+        };
+    };
+    const form = request.form;
+    if (!authenticateExchangeClient(request, deps.config)) {
+        return refuse(401, 'invalid_client', 'invalid client authentication', 'client_auth');
+    }
+    const subjectToken = oneString(form.subject_token);
+    if (subjectToken === undefined || form.subject_token_type !== SUBJECT_TOKEN_TYPE) {
+        return refuse(400, 'invalid_request', 'subject_token and subject_token_type=jwt are required', 'malformed_request');
+    }
+    // The audience form parameter, when present, must name the exchange URN exactly. Anything else —
+    // above all a resource URL — is a category error this exchange exists to refuse.
+    const audienceParam = form.audience;
+    if (audienceParam !== undefined && audienceParam !== CONTROL_PLANE_EXCHANGE_AUDIENCE) {
+        return refuse(400, 'invalid_target', 'unsupported exchange audience', 'audience');
+    }
+    let payload;
+    try {
+        const verified = await jwtVerify(subjectToken, await deps.verifierKey(), {
+            issuer: deps.issuer,
+            // Pinned to the URN: our own access tokens (resource-URL audiences) can never verify here.
+            audience: CONTROL_PLANE_EXCHANGE_AUDIENCE,
+            algorithms: ['RS256'],
+            clockTolerance: 5,
+        });
+        payload = verified.payload;
+    }
+    catch {
+        return refuse(400, 'invalid_grant', 'subject token is not a valid assertion', 'assertion');
+    }
+    const issuedAt = typeof payload.iat === 'number' ? payload.iat : undefined;
+    const expiresAt = typeof payload.exp === 'number' ? payload.exp : undefined;
+    if (issuedAt === undefined ||
+        expiresAt === undefined ||
+        expiresAt - issuedAt > ASSERTION_MAX_LIFETIME_SECONDS) {
+        return refuse(400, 'invalid_grant', 'assertion lifetime is invalid', 'assertion_lifetime');
+    }
+    const subject = typeof payload.sub === 'string' && payload.sub.length > 0 ? payload.sub : undefined;
+    const email = typeof payload.email === 'string' && payload.email.length > 0 ? payload.email : undefined;
+    const jti = typeof payload.jti === 'string' && payload.jti.length > 0 ? payload.jti : undefined;
+    const tenant = typeof payload.tenant === 'string' ? payload.tenant : undefined;
+    const customerIdentity = payload.customer_identity;
+    if (subject === undefined || jti === undefined || tenant === undefined) {
+        return refuse(400, 'invalid_grant', 'assertion claims are incomplete', 'assertion_claims');
+    }
+    // The control-plane gate refuses email-less identities; requiring it here fails earlier and clearer.
+    if (email === undefined) {
+        return refuse(400, 'invalid_grant', 'assertion carries no email', 'assertion_email');
+    }
+    // A route binding names a customer-endpoint exchange; its presence here means a misrouted
+    // connector, never this first-party exchange.
+    if (payload.route !== undefined) {
+        return refuse(400, 'invalid_grant', 'assertion carries a route binding', 'assertion_route');
+    }
+    if (!deps.config.allowedTenants.includes(tenant)) {
+        return refuse(400, 'invalid_grant', 'assertion tenant is not served here', 'tenant');
+    }
+    if (customerIdentity?.version !== 1 ||
+        typeof customerIdentity.issuer !== 'string' ||
+        !customerIdentity.issuer.startsWith(ASSISTANT_CLIENT_ISSUER_PREFIX)) {
+        return refuse(400, 'invalid_grant', 'assertion identity issuer is not supported', 'issuer');
+    }
+    const assistantClientId = customerIdentity.issuer.slice(ASSISTANT_CLIENT_ISSUER_PREFIX.length);
+    const [org = '', app = '', env = ''] = tenant.split('/');
+    const tenantRef = { org, app, env };
+    const liveClients = await deps.listAssistantClientIds(tenantRef);
+    if (!liveClients.includes(assistantClientId)) {
+        // Revoking the assistant client is the kill switch for this whole path.
+        return refuse(400, 'invalid_grant', 'assertion identity issuer is not live', 'issuer_liveness', tenantRef);
+    }
+    if (!(await deps.consumeJti(jti, expiresAt * 1000))) {
+        return refuse(400, 'invalid_grant', 'assertion was already used', 'jti_replay', tenantRef);
+    }
+    if ((await deps.resolveSubject(subject)) === undefined) {
+        return refuse(400, 'invalid_grant', 'subject has no active platform principal', 'subject', tenantRef);
+    }
+    const scopes = requestedScopes(form.scope, deps.capabilityCeiling);
+    if (scopes === undefined) {
+        return refuse(400, 'invalid_scope', 'requested scope is invalid', 'scope', tenantRef);
+    }
+    await deps.ensureWorkspace?.({ subject, email });
+    const resource = `${deps.issuer}${deps.resourcePath}`;
+    const grant = await deps.grants.getOrCreateActive({
+        clientId: deps.config.clientId,
+        subject,
+        resource,
+        capabilities: scopes,
+    });
+    const scope = scopes.join(' ');
+    const accessToken = await deps.issueAccessToken({
+        subject,
+        email,
+        resource,
+        scope,
+        developerGrantId: grant.id,
+        oauthClientId: deps.config.clientId,
+        ttlSeconds: TOKEN_TTL_SECONDS,
+    });
+    await deps.audit?.emit({
+        eventType: 'control_plane.token_exchange.issued',
+        org,
+        app,
+        env,
+        decision: 'allow',
+        status: 200,
+        actorSubject: subject,
+        details: { grantId: grant.id, clientId: deps.config.clientId, scope },
+    });
+    return {
+        status: 200,
+        body: {
+            access_token: accessToken,
+            token_type: 'Bearer',
+            expires_in: TOKEN_TTL_SECONDS,
+            scope,
+        },
+    };
+}
+/** Basic (default) or client_secret_post, compared timing-safe over digests. */
+function authenticateExchangeClient(request, config) {
+    const header = request.authorizationHeader;
+    let id;
+    let secret;
+    if (typeof header === 'string' && header.startsWith('Basic ')) {
+        const decoded = Buffer.from(header.slice('Basic '.length), 'base64').toString('utf8');
+        const split = decoded.indexOf(':');
+        if (split > 0) {
+            id = decodeURIComponent(decoded.slice(0, split));
+            secret = decodeURIComponent(decoded.slice(split + 1));
+        }
+    }
+    else {
+        id = oneString(request.form.client_id);
+        secret = oneString(request.form.client_secret);
+    }
+    if (id === undefined || secret === undefined)
+        return false;
+    return digestEquals(id, config.clientId) && digestEquals(secret, config.clientSecret);
+}
+function digestEquals(actual, expected) {
+    return timingSafeEqual(createHash('sha256').update(actual).digest(), createHash('sha256').update(expected).digest());
+}
+function oneString(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function requestedScopes(value, ceiling) {
+    if (value === undefined)
+        return [...ceiling].sort();
+    if (typeof value !== 'string' || value.length === 0)
+        return undefined;
+    const scopes = value.split(' ');
+    if (scopes.length > 16 ||
+        scopes.some((scope) => scope.length < 1 || scope.length > 128) ||
+        new Set(scopes).size !== scopes.length) {
+        return undefined;
+    }
+    const allowed = new Set(ceiling);
+    return scopes.every((scope) => allowed.has(scope)) ? [...scopes].sort() : undefined;
+}
+//# sourceMappingURL=control-plane-token-exchange.js.map

package/node_modules/@noodle-borg/auth/dist/index.d.ts

@@ -8,6 +8,7 @@
  * package stays Express-free.
  */
 export { type AuthorizationClaimMap, canonicalizeAuthorizationClaimValues, MAX_AUTHORIZATION_CLAIM_VALUES, MAX_ROLE_LENGTH, MAX_SCOPE_LENGTH, projectCustomerRoutingClaims, projectMappedAuthorizationClaim, projectNoodleRoles, projectStandardScopes, } from './claims.js';
+export { CONTROL_PLANE_EXCHANGE_AUDIENCE, CONTROL_PLANE_EXCHANGE_GRANT_TYPE, type ControlPlaneExchangeAuditEvent, type ControlPlaneExchangeConfig, type ControlPlaneExchangeDecision, type ControlPlaneExchangeDeps, type ControlPlaneExchangeRequest, type ControlPlaneExchangeTenantRef, decideControlPlaneTokenExchange, InMemoryTokenExchangeJtiStore, type TokenExchangeJtiStore, } from './control-plane-token-exchange.js';
 export { type DiscoveredIssuerMetadata, discoverIssuerMetadata, type IssuerMetadataCandidate, type IssuerMetadataKind, issuerMetadataCandidates, } from './discovery.js';
 export { type AccessTokenClaims, mintAccessToken } from './jwt-issuer.js';
 export { type BearerChallenge, canonicalScopes, McpOAuthClient, type McpOAuthClientOptions, type McpOAuthClientRegistration, type McpOAuthDiscovery, type McpOAuthPendingAuthorization, type McpOAuthTokens, parseBearerChallenge, } from './mcp-oauth-client.js';

package/node_modules/@noodle-borg/auth/dist/index.js

@@ -8,6 +8,7 @@
  * package stays Express-free.
  */
 export { canonicalizeAuthorizationClaimValues, MAX_AUTHORIZATION_CLAIM_VALUES, MAX_ROLE_LENGTH, MAX_SCOPE_LENGTH, projectCustomerRoutingClaims, projectMappedAuthorizationClaim, projectNoodleRoles, projectStandardScopes, } from './claims.js';
+export { CONTROL_PLANE_EXCHANGE_AUDIENCE, CONTROL_PLANE_EXCHANGE_GRANT_TYPE, decideControlPlaneTokenExchange, InMemoryTokenExchangeJtiStore, } from './control-plane-token-exchange.js';
 export { discoverIssuerMetadata, issuerMetadataCandidates, } from './discovery.js';
 export { mintAccessToken } from './jwt-issuer.js';
 export { canonicalScopes, McpOAuthClient, parseBearerChallenge, } from './mcp-oauth-client.js';

package/node_modules/@noodle-borg/authoring/dist/assistant.d.ts

@@ -67,6 +67,11 @@ export interface AssistantLabels {
     readonly sessionLoading?: string;
     readonly sessionReady?: string;
     readonly sessionError?: string;
+    readonly signInHeading?: string;
+    readonly signInBody?: string;
+    readonly signInAction?: string;
+    /** Renders a sign-up button on the sign-in card; leaving it unset renders none. */
+    readonly signUpAction?: string;
 }
 export interface AssistantUiOptions {
     readonly layout?: {

package/node_modules/@noodle-borg/compiler/dist/index.d.ts

@@ -1,5 +1,5 @@
 export type { AppPackageArtifactV1, AppPackageCapabilityRef, AppPackageSurface, CompiledAgentSkill, } from '@noodle-borg/app-package';
-export { APP_PACKAGE_V1_VALIDATION_LIMITS, appPackageArtifactV1Schema, canonicalJson, type SensitiveContentFinding, sensitiveContentFinding, sha256Canonical, } from '@noodle-borg/app-package';
+export { APP_PACKAGE_V1_VALIDATION_LIMITS, appPackageArtifactV1Schema, canonicalJson, type JsonSchemaValidationIssue, type SensitiveContentFinding, sensitiveContentFinding, sha256Canonical, validateJsonSchema, validateJsonSchemaWithDefaults, } from '@noodle-borg/app-package';
 export { type ParsedUri, type ParseUriResult, parseUriTemplate, type TemplateUri, } from '@noodle-borg/uri-template';
 export { compileAppPackage } from './app-package/compile.js';
 export { isSafeReadTool, requiresToolConfirmation } from './artifact/consent.js';
@@ -21,6 +21,5 @@ export { type ResolveSchemaResult, resolveSchemaUses, type SchemasMap, } from '.
 export { anonymousBehavior } from './manifest/website-projection.js';
 export { type SniffedImage, sniffImageBytes } from './mime-sniffing.js';
 export { manifestJsonSchema } from './schema-export.js';
-export { type JsonSchemaValidationIssue, validateJsonSchema, validateJsonSchemaWithDefaults, } from './schema-validation.js';
 export { MAX_COMPILED_WIDGET_HTML_BYTES, MAX_RAW_WIDGET_HTML_BYTES, MAX_TOTAL_WIDGET_HTML_BYTES, RECOMMENDED_COMPILED_WIDGET_HTML_BYTES, } from './widget-limits.js';
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/compiler/dist/index.js

@@ -1,4 +1,4 @@
-export { APP_PACKAGE_V1_VALIDATION_LIMITS, appPackageArtifactV1Schema, canonicalJson, sensitiveContentFinding, sha256Canonical, } from '@noodle-borg/app-package';
+export { APP_PACKAGE_V1_VALIDATION_LIMITS, appPackageArtifactV1Schema, canonicalJson, sensitiveContentFinding, sha256Canonical, validateJsonSchema, validateJsonSchemaWithDefaults, } from '@noodle-borg/app-package';
 export { parseUriTemplate, } from '@noodle-borg/uri-template';
 export { compileAppPackage } from './app-package/compile.js';
 export { isSafeReadTool, requiresToolConfirmation } from './artifact/consent.js';
@@ -18,6 +18,5 @@ export { resolveSchemaUses, } from './manifest/schema-refs.js';
 export { anonymousBehavior } from './manifest/website-projection.js';
 export { sniffImageBytes } from './mime-sniffing.js';
 export { manifestJsonSchema } from './schema-export.js';
-export { validateJsonSchema, validateJsonSchemaWithDefaults, } from './schema-validation.js';
 export { MAX_COMPILED_WIDGET_HTML_BYTES, MAX_RAW_WIDGET_HTML_BYTES, MAX_TOTAL_WIDGET_HTML_BYTES, RECOMMENDED_COMPILED_WIDGET_HTML_BYTES, } from './widget-limits.js';
 //# sourceMappingURL=index.js.map

package/node_modules/@noodle-borg/compiler/dist/manifest/schema.d.ts

@@ -239,6 +239,10 @@ export declare const manifestV1Schema: z.ZodObject<{
                 sessionLoading: z.ZodOptional<z.ZodString>;
                 sessionReady: z.ZodOptional<z.ZodString>;
                 sessionError: z.ZodOptional<z.ZodString>;
+                signInHeading: z.ZodOptional<z.ZodString>;
+                signInBody: z.ZodOptional<z.ZodString>;
+                signInAction: z.ZodOptional<z.ZodString>;
+                signUpAction: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>;
             presentation: z.ZodOptional<z.ZodObject<{
                 panel: z.ZodOptional<z.ZodObject<{
@@ -693,6 +697,10 @@ export declare const manifestV2Schema: z.ZodObject<{
                 sessionLoading: z.ZodOptional<z.ZodString>;
                 sessionReady: z.ZodOptional<z.ZodString>;
                 sessionError: z.ZodOptional<z.ZodString>;
+                signInHeading: z.ZodOptional<z.ZodString>;
+                signInBody: z.ZodOptional<z.ZodString>;
+                signInAction: z.ZodOptional<z.ZodString>;
+                signUpAction: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>;
             presentation: z.ZodOptional<z.ZodObject<{
                 panel: z.ZodOptional<z.ZodObject<{
@@ -1357,6 +1365,10 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 sessionLoading: z.ZodOptional<z.ZodString>;
                 sessionReady: z.ZodOptional<z.ZodString>;
                 sessionError: z.ZodOptional<z.ZodString>;
+                signInHeading: z.ZodOptional<z.ZodString>;
+                signInBody: z.ZodOptional<z.ZodString>;
+                signInAction: z.ZodOptional<z.ZodString>;
+                signUpAction: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>;
             presentation: z.ZodOptional<z.ZodObject<{
                 panel: z.ZodOptional<z.ZodObject<{
@@ -1810,6 +1822,10 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 sessionLoading: z.ZodOptional<z.ZodString>;
                 sessionReady: z.ZodOptional<z.ZodString>;
                 sessionError: z.ZodOptional<z.ZodString>;
+                signInHeading: z.ZodOptional<z.ZodString>;
+                signInBody: z.ZodOptional<z.ZodString>;
+                signInAction: z.ZodOptional<z.ZodString>;
+                signUpAction: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>;
             presentation: z.ZodOptional<z.ZodObject<{
                 panel: z.ZodOptional<z.ZodObject<{

package/node_modules/@noodle-borg/compiler/dist/manifest/schema.js

@@ -318,6 +318,10 @@ const assistantUiSchema = z
         sessionLoading: z.string().trim().min(1).max(120).optional(),
         sessionReady: z.string().trim().min(1).max(120).optional(),
         sessionError: z.string().trim().min(1).max(120).optional(),
+        signInHeading: z.string().trim().min(1).max(120).optional(),
+        signInBody: z.string().max(240).optional(),
+        signInAction: z.string().trim().min(1).max(80).optional(),
+        signUpAction: z.string().trim().min(1).max(80).optional(),
     })
         .strict()
         .optional(),
@@ -669,12 +673,25 @@ export const manifestV1Schema = z.object({
     connectors: z.record(nameSchema, connectorRefSchema).optional(),
     ...commonManifestFields,
 });
-export const manifestV2Schema = z.object({
+export const manifestV2Schema = z
+    .object({
     manifestVersion: z.literal('2'),
     server: serverV2Schema,
-    tools: z.array(toolV2Schema).min(1),
+    tools: z.array(toolV2Schema),
     connectors: z.record(nameSchema, connectorRefV2Schema).optional(),
     ...commonManifestFields,
+})
+    // A v2 server's callable surface may come entirely from generated knowledge capabilities
+    // (ADR 0217): a knowledge-only server is valid, an empty server is not. v1 keeps its
+    // authored-tool minimum — it has no server.knowledge to count.
+    .superRefine((manifest, ctx) => {
+    if (manifest.tools.length === 0 && (manifest.server.knowledge?.length ?? 0) === 0) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['tools'],
+            message: 'declare at least one tool or one server.knowledge component',
+        });
+    }
 });
 export const manifestSchema = z.discriminatedUnion('manifestVersion', [
     manifestV1Schema,

package/node_modules/@noodle-borg/compiler/package.json

@@ -28,8 +28,6 @@
     "@noodle-borg/uri-template": "0.0.0",
     "@noodle-borg/knowledge": "0.0.0",
     "@noodle-borg/capabilities": "0.0.0",
-    "ajv": "^8.20.0",
-    "ajv-formats": "^3.0.1",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "tailwindcss": "^4.3.1",

package/node_modules/@noodle-borg/compute/dist/code-connector.js

@@ -1,3 +1,4 @@
+import { ConnectorInvocationError, } from '@noodle-borg/runtime';
 import { ComputeError, DEFAULT_LIMITS, } from './engine.js';
 /**
  * A connector whose operations run tenant-authored JavaScript in a {@link ComputeEngine} sandbox — the
@@ -28,14 +29,56 @@ export class CodeConnector {
         if (!op)
             throw new Error(`connector "${this.id}" has no operation "${call.operation}"`);
         const instance = await this.#engine.instantiate(op.module);
+        let timings;
         try {
-            return await instance.invoke(call.args, op.limits ?? DEFAULT_LIMITS, op.calls ? computeHost(op.calls, call.host) : undefined);
+            const output = await instance.invoke(call.args, op.limits ?? DEFAULT_LIMITS, op.calls ? computeHost(op.calls, call.host) : undefined, (t) => {
+                timings = t;
+            });
+            // Queue wait and execution are recorded independently so burst head-of-line blocking is
+            // observable on successful calls too, not only on the ones that fail.
+            if (timings !== undefined) {
+                call.trace?.record({
+                    kind: 'connector',
+                    connectorId: this.id,
+                    connectorVersion: this.version,
+                    operation: call.operation,
+                    queueWaitMs: timings.queueWaitMs,
+                    executionMs: timings.executionMs,
+                });
+            }
+            return output;
+        }
+        catch (error) {
+            throw classifyInvocationFailure(error, timings);
         }
         finally {
             instance.dispose();
         }
     }
 }
+/**
+ * Re-throw sandbox time-budget failures as {@link ConnectorInvocationError} with a stable category,
+ * so the runtime surfaces `connector_error` with a `timeout`/`queue_timeout` reason and records the
+ * queue-wait and execution durations. A queue-expired call never started executing, so it is safely
+ * retryable. All other compute failures propagate unchanged.
+ */
+function classifyInvocationFailure(error, timings) {
+    if (!(error instanceof ComputeError))
+        return error;
+    if (error.code !== 'timeout' && error.code !== 'queue_timeout')
+        return error;
+    return new ConnectorInvocationError(error.message, {
+        category: error.code,
+        attempts: 1,
+        ...(error.code === 'queue_timeout' ? { retryable: true } : {}),
+        ...(timings === undefined
+            ? {}
+            : {
+                queueWaitMs: Math.round(timings.queueWaitMs),
+                executionMs: Math.round(timings.executionMs),
+            }),
+    });
+}
 function computeHost(calls, host) {
     return {
         callOperation(name, args) {