@noodleseed/one 0.141.0 → 0.141.1

package/node_modules/@noodle-borg/agent-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodle-borg/agent-kit",
-  "version": "0.84.1",
+  "version": "0.85.0",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {

package/node_modules/@noodle-borg/assistant-gateway/package.json

@@ -40,7 +40,7 @@
     "@noodle-borg/module": "0.0.0",
     "@noodle-borg/protocol": "0.0.0",
     "@noodle-borg/runtime": "0.0.0",
-    "@noodleseed/assistant": "1.24.0"
+    "@noodleseed/assistant": "1.25.0"
   },
   "devDependencies": {
     "@types/node": "^24.13.1",

package/node_modules/@noodle-borg/module/dist/platform-human-identity.d.ts

@@ -10,7 +10,13 @@ export interface UpstreamHumanIdentity {
 export declare function normalizePlatformIdentityEmail(value: string): string;
 export interface UpstreamAuthorizationOptions {
     readonly forceAuthentication?: boolean;
+    readonly screenHint?: 'sign-up' | 'sign-in';
 }
+export declare const FRESH_AUTH_SCOPE = "noodle:fresh-auth";
+export declare const SIGNUP_INTENT_SCOPE = "noodle:signup-intent";
+export declare function upstreamAuthorizationOptionsInput(scopes: readonly string[] | undefined, signupClient: boolean): {
+    readonly options?: UpstreamAuthorizationOptions;
+};
 export interface UpstreamHumanAuthentication extends UpstreamHumanIdentity {
     readonly locale?: string;
     readonly timeZone?: string;

package/node_modules/@noodle-borg/module/dist/platform-human-identity.js

@@ -6,6 +6,20 @@ export function normalizePlatformIdentityEmail(value) {
     }
     return normalized;
 }
+export const FRESH_AUTH_SCOPE = 'noodle:fresh-auth';
+export const SIGNUP_INTENT_SCOPE = 'noodle:signup-intent';
+export function upstreamAuthorizationOptionsInput(scopes, signupClient) {
+    const forceAuthentication = scopes?.includes(FRESH_AUTH_SCOPE) === true;
+    const signup = signupClient && scopes?.includes(SIGNUP_INTENT_SCOPE) === true;
+    if (!forceAuthentication && !signup)
+        return {};
+    return {
+        options: {
+            ...(forceAuthentication ? { forceAuthentication: true } : {}),
+            ...(signup ? { screenHint: 'sign-up' } : {}),
+        },
+    };
+}
 /** Stable cross-package identity failure used by private providers and public consumers alike. */
 export class PlatformIdentityError extends Error {
     code;

package/node_modules/@noodle-borg/runtime/dist/index.d.ts

@@ -18,6 +18,6 @@ export { AllowAllPolicy } from './policy/allow-all.js';
 export type { PolicyContext, PolicyDecision, PolicyGate } from './policy/types.js';
 export { type ConfirmationActionReview, type ConfirmationPreparationResult, type ConfirmationReview, type ConnectorFailureAttribution, type ElicitationRequest, type ElicitationResponse, type ExecutionError, type ExecutionErrorCode, type ExecutionResult, type InteractiveExecutionResult, isConfirmationRequired, isInputRequired, isInputRequiredForConfirmation, type PreparedOperationAction, type PreparedToolContinuation, type ToolContinuation, type ToolPreparationContinuation, } from './result.js';
 export { splitResultMeta } from './result-meta.js';
-export { assertNoSecretValue, assertSchemaValue, COMPLETE_STATE_OPERATION, createStateConnector, InMemoryStateHandleStore, PATCH_STATE_OPERATION, READ_STATE_OPERATION, STATE_CONNECTOR_ID, STATE_CONNECTOR_VERSION, STATE_OPERATION_SIGNATURES, StateConnector, type StateHandleRecord, type StateHandleStore, type StateInput, type StateMutationInput, type StatePatchInput, } from './state-handles.js';
+export { assertExpectedStateRevision, assertNoSecretValue, assertSchemaValue, assertStateHandleNotCompleted, COMPLETE_STATE_OPERATION, createMutableStateHandleRecord, createStateConnector, InMemoryStateHandleStore, type MutableStateHandleRecord, PATCH_STATE_OPERATION, READ_STATE_OPERATION, STATE_CONNECTOR_ID, STATE_CONNECTOR_VERSION, STATE_OPERATION_SIGNATURES, StateConnector, type StateHandleRecord, type StateHandleStore, type StateInput, type StateMutationInput, type StatePatchInput, stateHandleRecordForMutation, toPublicStateHandleRecord, } from './state-handles.js';
 export type { ToolDispatchContext, ToolDispatchDecision, ToolDispatchHook, } from './tool-dispatch.js';
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/runtime/dist/index.js

@@ -15,5 +15,5 @@ export { resolveManagedOrigins, } from './managed-origins.js';
 export { AllowAllPolicy } from './policy/allow-all.js';
 export { isConfirmationRequired, isInputRequired, isInputRequiredForConfirmation, } from './result.js';
 export { splitResultMeta } from './result-meta.js';
-export { assertNoSecretValue, assertSchemaValue, COMPLETE_STATE_OPERATION, createStateConnector, InMemoryStateHandleStore, PATCH_STATE_OPERATION, READ_STATE_OPERATION, STATE_CONNECTOR_ID, STATE_CONNECTOR_VERSION, STATE_OPERATION_SIGNATURES, StateConnector, } from './state-handles.js';
+export { assertExpectedStateRevision, assertNoSecretValue, assertSchemaValue, assertStateHandleNotCompleted, COMPLETE_STATE_OPERATION, createMutableStateHandleRecord, createStateConnector, InMemoryStateHandleStore, PATCH_STATE_OPERATION, READ_STATE_OPERATION, STATE_CONNECTOR_ID, STATE_CONNECTOR_VERSION, STATE_OPERATION_SIGNATURES, StateConnector, stateHandleRecordForMutation, toPublicStateHandleRecord, } from './state-handles.js';
 //# sourceMappingURL=index.js.map

package/node_modules/@noodle-borg/runtime/dist/state-handles.d.ts

@@ -14,6 +14,16 @@ export interface StateHandleRecord {
     readonly status: 'active' | 'completed' | 'expired';
     readonly expiresAt?: string;
 }
+export interface MutableStateHandleRecord {
+    handle: string;
+    key: string;
+    value: Record<string, unknown>;
+    revision: number;
+    status: 'active' | 'completed';
+    createdAt: number;
+    updatedAt: number;
+    expiresAt?: number;
+}
 export interface StateHandleStore {
     read(input: StateInput): Promise<StateHandleRecord> | StateHandleRecord;
     patch(input: StatePatchInput): Promise<StateHandleRecord> | StateHandleRecord;
@@ -46,6 +56,11 @@ export declare class StateConnector implements Connector {
     invoke(call: ConnectorCall): Promise<unknown>;
 }
 export declare function createStateConnector(state: ArtifactState | undefined): StateConnector | undefined;
+export declare function createMutableStateHandleRecord(handle: string, key: string, ttlSeconds: number | undefined, now: number): MutableStateHandleRecord;
+export declare function stateHandleRecordForMutation(record: MutableStateHandleRecord | undefined, handle: string, key: string, ttlSeconds: number | undefined, now: number): MutableStateHandleRecord;
+export declare function assertStateHandleNotCompleted(record: MutableStateHandleRecord): void;
+export declare function assertExpectedStateRevision(record: MutableStateHandleRecord, expectedRevision: number): void;
+export declare function toPublicStateHandleRecord(record: MutableStateHandleRecord, now: number): StateHandleRecord;
 export declare function assertNoSecretValue(value: unknown, path?: string): void;
 export declare function assertSchemaValue(schema: Record<string, unknown>, value: Record<string, unknown>): void;
 //# sourceMappingURL=state-handles.d.ts.map

package/node_modules/@noodle-borg/runtime/dist/state-handles.js

@@ -55,18 +55,20 @@ export class InMemoryStateHandleStore {
     read(input) {
         const def = this.#definition(input.handle);
         const key = this.#recordKey(def, input);
-        return this.#publicRecord(this.#records.get(key) ?? this.#emptyRecord(input.handle, input.key ?? 'default', def));
+        const now = this.#now().getTime();
+        return toPublicStateHandleRecord(this.#records.get(key) ??
+            createMutableStateHandleRecord(input.handle, input.key ?? 'default', def.ttlSeconds, now), now);
     }
     patch(input) {
         const def = this.#definition(input.handle);
         const key = this.#recordKey(def, input);
-        const current = this.#records.get(key) ?? this.#emptyRecord(input.handle, input.key ?? 'default', def);
-        assertActive(current, this.#now().getTime());
-        assertExpectedRevision(current, input.expectedRevision);
+        const now = this.#now().getTime();
+        const current = stateHandleRecordForMutation(this.#records.get(key), input.handle, input.key ?? 'default', def.ttlSeconds, now);
+        assertStateHandleNotCompleted(current);
+        assertExpectedStateRevision(current, input.expectedRevision);
         assertNoSecretValue(input.value);
         const value = { ...current.value, ...input.value };
         assertSchemaValue(def.schema, value);
-        const now = this.#now().getTime();
         const next = {
             ...current,
             value,
@@ -74,22 +76,23 @@ export class InMemoryStateHandleStore {
             updatedAt: now,
         };
         this.#records.set(key, next);
-        return this.#publicRecord(next);
+        return toPublicStateHandleRecord(next, now);
     }
     complete(input) {
         const def = this.#definition(input.handle);
         const key = this.#recordKey(def, input);
-        const current = this.#records.get(key) ?? this.#emptyRecord(input.handle, input.key ?? 'default', def);
-        assertActive(current, this.#now().getTime());
-        assertExpectedRevision(current, input.expectedRevision);
+        const now = this.#now().getTime();
+        const current = stateHandleRecordForMutation(this.#records.get(key), input.handle, input.key ?? 'default', def.ttlSeconds, now);
+        assertStateHandleNotCompleted(current);
+        assertExpectedStateRevision(current, input.expectedRevision);
         const next = {
             ...current,
             status: 'completed',
             revision: current.revision + 1,
-            updatedAt: this.#now().getTime(),
+            updatedAt: now,
         };
         this.#records.set(key, next);
-        return this.#publicRecord(next);
+        return toPublicStateHandleRecord(next, now);
     }
     #definition(handle) {
         const def = this.#state.handles[handle];
@@ -102,34 +105,6 @@ export class InMemoryStateHandleStore {
         const owner = def.scope === 'caller' ? (input.callerSubject ?? 'anonymous') : 'deployment';
         return `${input.handle}\u0000${owner}\u0000${userKey}`;
     }
-    #emptyRecord(handle, key, def) {
-        const now = this.#now().getTime();
-        return {
-            handle,
-            key,
-            value: {},
-            revision: 0,
-            status: 'active',
-            createdAt: now,
-            updatedAt: now,
-            ...(def.ttlSeconds !== undefined ? { expiresAt: now + def.ttlSeconds * 1000 } : {}),
-        };
-    }
-    #publicRecord(record) {
-        const status = record.expiresAt !== undefined && record.expiresAt <= this.#now().getTime()
-            ? 'expired'
-            : record.status;
-        return {
-            handle: record.handle,
-            key: record.key,
-            value: record.value,
-            revision: record.revision,
-            status,
-            ...(record.expiresAt !== undefined
-                ? { expiresAt: new Date(record.expiresAt).toISOString() }
-                : {}),
-        };
-    }
 }
 export class StateConnector {
     id = STATE_CONNECTOR_ID;
@@ -212,18 +187,53 @@ function objectArg(value, name) {
         throw new Error(`${name} must be an object`);
     return value;
 }
-function assertActive(record, now) {
+export function createMutableStateHandleRecord(handle, key, ttlSeconds, now) {
+    return {
+        handle,
+        key,
+        value: {},
+        revision: 0,
+        status: 'active',
+        createdAt: now,
+        updatedAt: now,
+        ...(ttlSeconds !== undefined ? { expiresAt: now + ttlSeconds * 1000 } : {}),
+    };
+}
+export function stateHandleRecordForMutation(record, handle, key, ttlSeconds, now) {
+    if (record === undefined)
+        return createMutableStateHandleRecord(handle, key, ttlSeconds, now);
+    if (!isExpired(record, now))
+        return record;
+    return {
+        ...createMutableStateHandleRecord(handle, key, ttlSeconds, now),
+        revision: record.revision + 1,
+    };
+}
+export function assertStateHandleNotCompleted(record) {
     if (record.status === 'completed')
         throw new Error('completed state handles are read-only');
-    if (record.expiresAt !== undefined && record.expiresAt <= now) {
-        throw new Error('expired state handles are read-only');
-    }
 }
-function assertExpectedRevision(record, expectedRevision) {
+function isExpired(record, now) {
+    return record.expiresAt !== undefined && record.expiresAt <= now;
+}
+export function assertExpectedStateRevision(record, expectedRevision) {
     if (record.revision !== expectedRevision) {
         throw new Error(`state revision conflict: expected ${expectedRevision}, got ${record.revision}`);
     }
 }
+export function toPublicStateHandleRecord(record, now) {
+    const expired = isExpired(record, now);
+    return {
+        handle: record.handle,
+        key: record.key,
+        value: record.value,
+        revision: record.revision + (expired ? 1 : 0),
+        status: expired ? 'expired' : record.status,
+        ...(record.expiresAt !== undefined
+            ? { expiresAt: new Date(record.expiresAt).toISOString() }
+            : {}),
+    };
+}
 const SECRET_LIKE_FIELD = /(secret|token|api[_-]?key|password|credential|authorization|cookie)/i;
 export function assertNoSecretValue(value, path = 'value') {
     if (Array.isArray(value)) {

package/node_modules/@noodle-borg/service/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.84.1",
+    "@noodle-borg/agent-kit": "0.85.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/node_modules/@noodleseed/assistant/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/assistant",
-  "version": "1.24.0",
+  "version": "1.25.0",
   "description": "Embed the Noodle Seed customer-branded assistant in your web app with managed or framework-owned UI, a framework-neutral MCP App host, a DOM-free client, and a backend session helper. Authoring and deploying the server is @noodleseed/one.",
   "license": "Apache-2.0",
   "repository": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.141.0",
+  "version": "0.141.1",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",
@@ -236,7 +236,7 @@
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.84.1",
+    "@noodle-borg/agent-kit": "0.85.0",
     "@noodle-borg/app-audit": "0.0.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",