@noodleseed/one 0.152.0 → 0.153.0

package/node_modules/@noodle-borg/transport-http/dist/identity-authorization.d.ts

@@ -0,0 +1,51 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { AccessMode, DataPlaneIdentityAuthorizer, OrgMembershipSource, OwnerTokenVerifier } from '@noodle-borg/module';
+import { type ProtocolRequestContext } from '@noodle-borg/protocol';
+export interface IdentityAuthorizationOptions {
+    readonly accessMode: AccessMode | undefined;
+    readonly ownerSubject: string | undefined;
+    readonly org: string | undefined;
+    readonly orgMembershipSources: readonly OrgMembershipSource[] | undefined;
+    readonly verifyOwnerToken: OwnerTokenVerifier | undefined;
+    readonly authorizeDataPlaneIdentity: DataPlaneIdentityAuthorizer | undefined;
+    /** Whether to trust forwarded-proto when reconstructing the public resource/PRM URLs. */
+    readonly trustProxy: boolean;
+    /** Public resource URL supplied by a trusted edge for MCP-subdomain routes. */
+    readonly publicResourceUrl?: string;
+}
+/**
+ * Bounded identity-denial taxonomy retained by request analytics (#1309). Derived structurally at
+ * this seam — the token verifier stays opaque — and never carries token material or claims.
+ */
+type IdentityDenialReason = 'missing_token' | 'verifier_unavailable' | 'token_rejected' | 'identity_not_customer' | 'owner_unconfigured' | 'owner_mismatch' | 'org_membership_denied';
+export type IdentityAuthResult = {
+    readonly allow: true;
+    readonly caller?: NonNullable<ProtocolRequestContext['caller']>;
+    readonly customerIssuer?: string;
+    readonly customerRouting?: Readonly<Record<string, string>>;
+    readonly subject?: string;
+} | {
+    readonly allow: false;
+    readonly reason: IdentityDenialReason;
+};
+/**
+ * Identity gate (OA-1/OA-3): require a verified token and authorize it against the deployment access mode.
+ * `allow: true` means the request may proceed, with caller and subject fields when available. `allow: false`
+ * means this function already wrote the denial response. Missing tokens and absent verifiers fail closed.
+ */
+export declare function authorizeIdentityMode(req: IncomingMessage, res: ServerResponse, auth: IdentityAuthorizationOptions): Promise<IdentityAuthResult>;
+/**
+ * Public endpoints stay anonymous unless a valid service-principal bearer is supplied. Invalid, human,
+ * and customer bearers retain the pre-existing public behavior and are ignored rather than challenged.
+ */
+export declare function authorizePublicServiceMode(req: IncomingMessage, auth: IdentityAuthorizationOptions): Promise<IdentityAuthResult>;
+export declare function authorizeMixedMode(req: IncomingMessage, res: ServerResponse, auth: IdentityAuthorizationOptions): Promise<IdentityAuthResult>;
+export declare function isIdentityMode(mode: AccessMode | undefined): boolean;
+/** The credential carried by one `Authorization` header value, or null when it is not a bearer. */
+export declare function bearerToken(headerValue: string | undefined): string | null;
+/** The canonical resource identifier (the tenant MCP URL) a token must be audience-bound to (RFC 8707). */
+export declare function canonicalResourceUrl(req: IncomingMessage, auth: Pick<IdentityAuthorizationOptions, 'trustProxy' | 'publicResourceUrl'>): string;
+/** The RFC 9728 protected-resource-metadata URL for this request (well-known prefix before the path). */
+export declare function protectedResourceMetadataUrl(req: IncomingMessage, auth: IdentityAuthorizationOptions): string;
+export {};
+//# sourceMappingURL=identity-authorization.d.ts.map

package/node_modules/@noodle-borg/transport-http/dist/identity-authorization.js

@@ -8,7 +8,7 @@ import { header } from './request-capture.js';
  */
 export async function authorizeIdentityMode(req, res, auth) {
     const challenge = protectedResourceMetadataUrl(req, auth);
-    const token = bearerToken(req);
+    const token = bearerToken(header(req, 'authorization'));
     if (token === null || auth.verifyOwnerToken === undefined) {
         sendUnauthorized(res, challenge);
         return { allow: false, reason: token === null ? 'missing_token' : 'verifier_unavailable' };
@@ -75,7 +75,7 @@ export async function authorizeIdentityMode(req, res, auth) {
  * and customer bearers retain the pre-existing public behavior and are ignored rather than challenged.
  */
 export async function authorizePublicServiceMode(req, auth) {
-    const token = bearerToken(req);
+    const token = bearerToken(header(req, 'authorization'));
     if (token === null || auth.verifyOwnerToken === undefined)
         return { allow: true };
     const verification = await auth.verifyOwnerToken(token, canonicalResourceUrl(req, auth));
@@ -84,7 +84,7 @@ export async function authorizePublicServiceMode(req, auth) {
         : { allow: true };
 }
 export async function authorizeMixedMode(req, res, auth) {
-    const token = bearerToken(req);
+    const token = bearerToken(header(req, 'authorization'));
     if (token === null)
         return { allow: true };
     const challenge = protectedResourceMetadataUrl(req, auth);
@@ -114,11 +114,11 @@ export function isIdentityMode(mode) {
         mode === 'authenticated' ||
         mode === 'customers');
 }
-function bearerToken(req) {
-    const auth = header(req, 'authorization');
-    if (!auth)
+/** The credential carried by one `Authorization` header value, or null when it is not a bearer. */
+export function bearerToken(headerValue) {
+    if (!headerValue)
         return null;
-    const match = /^Bearer\s+(.+)$/i.exec(auth);
+    const match = /^Bearer\s+(.+)$/i.exec(headerValue);
     return match?.[1] ?? null;
 }
 /**

package/node_modules/@noodle-borg/transport-http/dist/index.d.ts

@@ -1,8 +1,10 @@
 export { applySecurityHeaders, effectiveProto, enforceHttps, type TlsPosture, } from './front-door.js';
-export { type AccessMode, type AdmissionCategory, type AdmissionContext, type AdmissionDecision, type AdmissionGate, createMcpHttpHandler, createMcpRouter, type DataPlaneAuthorizationResult, type DataPlaneIdentityAuthorizer, type HttpHandlerOptions, type InvocationClientHint, type InvocationClientLocationHint, type InvocationContextResolutionInput, type InvocationContextResolver, type McpProtocolMode, type OriginPolicy, type OwnerTokenVerifier, type ServedTarget, type ServerLookup, type TenantPreflight, type TenantRouteRef, } from './handler.js';
+export { type AccessMode, type AdmissionCategory, type AdmissionContext, type AdmissionDecision, type AdmissionGate, createMcpHttpHandler, createMcpRouter, type DataPlaneAuthorizationResult, type DataPlaneIdentityAuthorizer, type HttpHandlerOptions, type InvocationClientHint, type InvocationClientLocationHint, type InvocationContextResolutionInput, type InvocationContextResolver, type OriginPolicy, type OwnerTokenVerifier, type ServedTarget, type ServerLookup, type TenantPreflight, type TenantRouteRef, } from './handler.js';
+export { bearerToken } from './identity-authorization.js';
 export { createLogger, type LogFields, type Logger, type LoggerOptions, type LogLevel, type LogSink, noopLogger, stderrSink, stdoutSink, } from './logging.js';
-export { type ModuleJsonBodyResult, readModuleJsonBody, sendModuleJson, } from './module-http.js';
 export { resolveTrustedPublicOrg, resolveTrustedTenantMcpResource, type TrustedPublicOrg, type TrustedPublicRef, type TrustedPublicRouting, type TrustedTenantMcpResource, trustedPublicMcpRef, trustedPublicOrgWellKnownRef, } from './public-routing.js';
+export { readBody, readDeployBody, readJsonBody } from './request-body.js';
+export { sendJson } from './responses.js';
 export { type RunningServer, type ServeOptions, serveHttp } from './serve.js';
 export type { HostedToolAuthorizationObservation, HostedToolAuthorizationObserver, ServicePrincipalToolAuthorizationObservation, } from './service-principal-authorization.js';
 export { preflightServicePrincipalToolCall, sendServicePrincipalToolDenial, } from './service-principal-authorization.js';

package/node_modules/@noodle-borg/transport-http/dist/index.js

@@ -1,8 +1,10 @@
 export { applySecurityHeaders, effectiveProto, enforceHttps, } from './front-door.js';
 export { createMcpHttpHandler, createMcpRouter, } from './handler.js';
+export { bearerToken } from './identity-authorization.js';
 export { createLogger, noopLogger, stderrSink, stdoutSink, } from './logging.js';
-export { readModuleJsonBody, sendModuleJson, } from './module-http.js';
 export { resolveTrustedPublicOrg, resolveTrustedTenantMcpResource, trustedPublicMcpRef, trustedPublicOrgWellKnownRef, } from './public-routing.js';
+export { readBody, readDeployBody, readJsonBody } from './request-body.js';
+export { sendJson } from './responses.js';
 export { serveHttp } from './serve.js';
 export { preflightServicePrincipalToolCall, sendServicePrincipalToolDenial, } from './service-principal-authorization.js';
 export { toWebRequest, writeWebResponse } from './web-bridge.js';

package/node_modules/@noodle-borg/transport-http/dist/request-body.d.ts

@@ -0,0 +1,29 @@
+import type { IncomingMessage } from 'node:http';
+export declare function readBody(req: IncomingMessage, max: number): Promise<{
+    ok: true;
+    text: string;
+} | {
+    ok: false;
+    receivedBytes: number;
+    maxBytes: number;
+}>;
+export declare function readDeployBody(req: IncomingMessage, max: number): Promise<{
+    ok: true;
+    text: string;
+    encoding: 'identity' | 'gzip';
+} | {
+    ok: false;
+    status: 400 | 413 | 415;
+    error: string;
+    receivedBytes?: number;
+    maxBytes?: number;
+}>;
+export declare function readJsonBody(req: IncomingMessage, max: number): Promise<{
+    ok: true;
+    value: unknown;
+} | {
+    ok: false;
+    status: 400 | 413;
+    error: string;
+}>;
+//# sourceMappingURL=request-body.d.ts.map

package/node_modules/@noodle-borg/transport-http/dist/request-body.js

@@ -0,0 +1,64 @@
+import { gunzipSync } from 'node:zlib';
+export async function readBody(req, max) {
+    const body = await readBodyBuffer(req, max);
+    return body.ok ? { ok: true, text: body.buffer.toString('utf8') } : body;
+}
+async function readBodyBuffer(req, max) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const buf = chunk;
+        size += buf.length;
+        if (size > max)
+            return { ok: false, receivedBytes: size, maxBytes: max };
+        chunks.push(buf);
+    }
+    return { ok: true, buffer: Buffer.concat(chunks) };
+}
+export async function readDeployBody(req, max) {
+    const encoding = (req.headers['content-encoding'] ?? 'identity').trim().toLowerCase();
+    if (encoding !== 'identity' && encoding !== 'gzip') {
+        return { ok: false, status: 415, error: `unsupported content encoding "${encoding}"` };
+    }
+    const body = await readBodyBuffer(req, max);
+    if (!body.ok) {
+        return {
+            ok: false,
+            status: 413,
+            error: `${encoding === 'gzip' ? 'compressed deploy' : 'deploy'} request exceeds the ${body.maxBytes} byte limit (received at least ${body.receivedBytes} bytes)`,
+            receivedBytes: body.receivedBytes,
+            maxBytes: body.maxBytes,
+        };
+    }
+    if (encoding === 'identity') {
+        return { ok: true, text: body.buffer.toString('utf8'), encoding };
+    }
+    try {
+        const expanded = gunzipSync(body.buffer, { maxOutputLength: max });
+        return { ok: true, text: expanded.toString('utf8'), encoding };
+    }
+    catch (error) {
+        const code = error instanceof Error && 'code' in error ? String(error.code) : '';
+        if (code === 'ERR_BUFFER_TOO_LARGE') {
+            return {
+                ok: false,
+                status: 413,
+                error: `expanded deploy request exceeds the ${max} byte limit`,
+                maxBytes: max,
+            };
+        }
+        return { ok: false, status: 400, error: 'invalid gzip deploy request' };
+    }
+}
+export async function readJsonBody(req, max) {
+    const body = await readBody(req, max);
+    if (!body.ok)
+        return { ok: false, status: 413, error: 'request body too large' };
+    try {
+        return { ok: true, value: JSON.parse(body.text) };
+    }
+    catch (error) {
+        return { ok: false, status: 400, error: `invalid JSON: ${error.message}` };
+    }
+}
+//# sourceMappingURL=request-body.js.map

package/node_modules/@noodle-borg/transport-http/dist/responses.d.ts

@@ -0,0 +1,28 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { AdmissionContext, AdmissionGate } from '@noodle-borg/module';
+import type { Logger } from './logging.js';
+/** Emit one `mcp.request` lifecycle line with safe scalar fields only. */
+export declare function logRequest(logger: Logger, routeId: string, req: IncomingMessage, res: ServerResponse, start: number): void;
+export declare function guard(res: ServerResponse, fn: Promise<void>): Promise<void>;
+export declare function sendJson(res: ServerResponse, status: number, body: unknown): void;
+/** A transport-level JSON-RPC error response with no id (per the Streamable HTTP spec). */
+export declare function rpcError(code: number, message: string): {
+    jsonrpc: '2.0';
+    id: null;
+    error: {
+        code: number;
+        message: string;
+    };
+};
+export declare function admissionRpcError(context: AdmissionContext, decision: Exclude<Awaited<ReturnType<AdmissionGate>>, {
+    allow: true;
+}>): {
+    jsonrpc: '2.0';
+    id: string | number | null;
+    error: {
+        code: number;
+        message: string;
+        data: Record<string, string | number>;
+    };
+};
+//# sourceMappingURL=responses.d.ts.map

package/node_modules/@noodle-borg/transport-http/dist/routing.d.ts

@@ -5,7 +5,7 @@ export interface PublicTenantRouting {
     readonly edgeToken: string;
     readonly resolveTenant: (ref: PublicMcpRouteRef) => Promise<TenantRouteRef | undefined>;
 }
-export type ParsedRoute = {
+type ParsedRoute = {
     readonly kind: 'tenant';
     readonly ref: TenantRouteRef;
     readonly logId: string;
@@ -23,7 +23,5 @@ export type RouteResolution = {
     readonly status: 403;
 };
 export declare function resolveRoute(req: IncomingMessage, pathname: string, publicTenantRouting: PublicTenantRouting | undefined): Promise<RouteResolution>;
-export declare function parseRoute(pathname: string): ParsedRoute | null;
-export declare function tenantLogId(ref: TenantRouteRef): string;
-export declare function safeDecode(value: string): string | null;
+export {};
 //# sourceMappingURL=routing.d.ts.map

package/node_modules/@noodle-borg/transport-http/dist/routing.js

@@ -27,7 +27,7 @@ export async function resolveRoute(req, pathname, publicTenantRouting) {
     }
     return { ok: true, route: parseRoute(pathname) };
 }
-export function parseRoute(pathname) {
+function parseRoute(pathname) {
     const tenant = parseLegacyTenantMcpPath(pathname);
     if (tenant !== undefined) {
         return { kind: 'tenant', ref: tenant, logId: tenantLogId(tenant) };
@@ -41,10 +41,10 @@ export function parseRoute(pathname) {
     }
     return null;
 }
-export function tenantLogId(ref) {
+function tenantLogId(ref) {
     return `${ref.org}/${ref.app}/${ref.env}${ref.serverVersion !== undefined ? `@${ref.serverVersion}` : ''}`;
 }
-export function safeDecode(value) {
+function safeDecode(value) {
     try {
         return decodeURIComponent(value);
     }

package/node_modules/@noodle-borg/transport-http/dist/serve-request.js

@@ -3,6 +3,7 @@ import { createDualEraMcpHandler, handleStatelessHttp, JSON_RPC, } from '@noodle
 import { admissionContexts, requestsInvocationContext } from './admission-context.js';
 import { authorizeIdentityMode, authorizeMixedMode, authorizePublicServiceMode, canonicalResourceUrl, isIdentityMode, } from './identity-authorization.js';
 import { invocationClientHint } from './invocation-client-hints.js';
+import { readBody } from './request-body.js';
 import { emitDeniedRequestEvent, emitIntentEvents, emitRequestEvent, header, } from './request-capture.js';
 import { admissionRpcError, rpcError, sendJson } from './responses.js';
 import { preflightServicePrincipalToolCall, sendServicePrincipalToolDenial, } from './service-principal-authorization.js';
@@ -284,21 +285,9 @@ function boundedReason(reason) {
         .slice(0, 32);
     return token.length === 0 ? 'denied' : token;
 }
-export function originAllowed(origin, allowed) {
+function originAllowed(origin, allowed) {
     if (allowed === undefined)
         return true;
     return typeof allowed === 'function' ? allowed(origin) : allowed.includes(origin);
 }
-export async function readBody(req, max) {
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of req) {
-        const buf = chunk;
-        size += buf.length;
-        if (size > max)
-            return { ok: false };
-        chunks.push(buf);
-    }
-    return { ok: true, text: Buffer.concat(chunks).toString('utf8') };
-}
 //# sourceMappingURL=serve-request.js.map

package/node_modules/@noodle-borg/transport-http/package.json

@@ -28,7 +28,6 @@
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/compiler": "0.0.0",
-    "@noodle-borg/connector-http": "0.0.0",
     "@noodle-borg/runtime": "0.0.0",
     "@types/node": "^24.13.1"
   }

package/node_modules/@noodleseed/assistant/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/assistant",
-  "version": "1.31.0",
+  "version": "1.32.0",
   "description": "Embed the Noodle Seed customer-branded assistant in your web app with managed or framework-owned UI, a framework-neutral MCP App host, a DOM-free client, and a backend session helper. Authoring and deploying the server is @noodleseed/one.",
   "license": "Apache-2.0",
   "repository": {
@@ -90,6 +90,7 @@
     "access": "public"
   },
   "scripts": {
+    "attw": "attw --pack . --format json",
     "build": "tsup",
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.152.0",
+  "version": "0.153.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",
@@ -236,7 +236,7 @@
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.91.0",
+    "@noodle-borg/agent-kit": "0.92.0",
     "@noodle-borg/app-audit": "0.0.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",

package/dist/commands/catalog-data-billing.d.ts

@@ -1,3 +0,0 @@
-/** Compatibility route; catalog ownership lives in `@noodle-borg/cli-catalog`. */
-export * from '@noodle-borg/cli-catalog/billing';
-//# sourceMappingURL=catalog-data-billing.d.ts.map

package/dist/commands/catalog-data-billing.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"catalog-data-billing.d.ts","sourceRoot":"","sources":["../../src/commands/catalog-data-billing.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,cAAc,kCAAkC,CAAC"}

package/dist/commands/catalog-data-billing.js

@@ -1,3 +0,0 @@
-/** Compatibility route; catalog ownership lives in `@noodle-borg/cli-catalog`. */
-export * from '@noodle-borg/cli-catalog/billing';
-//# sourceMappingURL=catalog-data-billing.js.map

package/dist/commands/catalog-data-billing.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"catalog-data-billing.js","sourceRoot":"","sources":["../../src/commands/catalog-data-billing.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,cAAc,kCAAkC,CAAC"}

package/dist/commands/catalog-data-policy.d.ts

@@ -1,3 +0,0 @@
-/** Compatibility route; catalog ownership lives in `@noodle-borg/cli-catalog`. */
-export * from '@noodle-borg/cli-catalog/policy';
-//# sourceMappingURL=catalog-data-policy.d.ts.map

package/dist/commands/catalog-data-policy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"catalog-data-policy.d.ts","sourceRoot":"","sources":["../../src/commands/catalog-data-policy.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,cAAc,iCAAiC,CAAC"}

package/dist/commands/catalog-data-policy.js

@@ -1,3 +0,0 @@
-/** Compatibility route; catalog ownership lives in `@noodle-borg/cli-catalog`. */
-export * from '@noodle-borg/cli-catalog/policy';
-//# sourceMappingURL=catalog-data-policy.js.map

package/dist/commands/catalog-data-policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"catalog-data-policy.js","sourceRoot":"","sources":["../../src/commands/catalog-data-policy.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,cAAc,iCAAiC,CAAC"}

package/node_modules/@noodle-borg/compiler/dist/artifact/catalog-emission.d.ts

@@ -1,50 +0,0 @@
-import type { ConnectorCatalog } from '../catalog/types.js';
-import { type StructuralAmbientContext } from '../context-compile.js';
-import type { CompileError } from '../errors.js';
-import { type DeclaredConnectorRef } from '../fulfilment-emit.js';
-import type { StructFulfilment } from '../fulfilment-structural.js';
-import type { Manifest } from '../manifest/schema.js';
-import type { ArtifactMeta, ArtifactPrompt, ArtifactResource, ArtifactTool, JsonSchema, RuntimeArtifact } from './types.js';
-/** A tool whose structural checks passed, paired with its parsed fulfilment + resolved schemas. */
-export interface StructuralTool {
-    readonly tool: Manifest['tools'][number];
-    readonly index: number;
-    readonly inputSchema: JsonSchema;
-    readonly outputSchema?: JsonSchema;
-    readonly fulfilment: StructFulfilment;
-}
-/** A resource whose structural checks passed, paired with its parsed fulfilment + URI classification. */
-export interface StructuralResource {
-    readonly resource: NonNullable<Manifest['resources']>[number];
-    readonly isTemplate: boolean;
-    readonly variables: readonly string[];
-    readonly fulfilment: StructFulfilment;
-}
-/** A prompt whose structural checks passed, paired with its parsed fulfilment. */
-export interface StructuralPrompt {
-    readonly prompt: NonNullable<Manifest['prompts']>[number];
-    readonly fulfilment: StructFulfilment;
-}
-interface CatalogArtifactEmissionInput {
-    readonly manifest: Manifest;
-    readonly catalog: ConnectorCatalog | undefined;
-    readonly structuralAmbientContext: StructuralAmbientContext | undefined;
-    readonly structuralTools: readonly StructuralTool[];
-    readonly structuralResources: readonly StructuralResource[];
-    readonly structuralPrompts: readonly StructuralPrompt[];
-    readonly toolUiMetaByName: ReadonlyMap<string, ArtifactMeta>;
-    readonly errors: CompileError[];
-}
-interface CatalogArtifactEmissionResult {
-    readonly artifactAmbientContext: NonNullable<NonNullable<RuntimeArtifact['server']['context']>['ambient']> | undefined;
-    readonly artifactTools: readonly ArtifactTool[];
-    readonly artifactResources: readonly ArtifactResource[];
-    readonly artifactPrompts: readonly ArtifactPrompt[];
-    readonly declared: Record<string, DeclaredConnectorRef>;
-    readonly customerEndpoints: RuntimeArtifact['customerEndpoints'];
-}
-/** Resolve connector references and emit catalog-dependent artifact surfaces. */
-export declare function emitCatalogArtifactSurfaces({ manifest, catalog, structuralAmbientContext, structuralTools, structuralResources, structuralPrompts, toolUiMetaByName, errors, }: CatalogArtifactEmissionInput): CatalogArtifactEmissionResult;
-export declare function isContextProvider(tool: object): boolean;
-export {};
-//# sourceMappingURL=catalog-emission.d.ts.map

package/node_modules/@noodle-borg/compiler/dist/context-compile.d.ts

@@ -1,17 +0,0 @@
-import type { ArtifactServer, JsonSchema } from './artifact/types.js';
-import type { ConnectorCatalog } from './catalog/types.js';
-import type { CustomerRoutingCollector } from './customer-routing.js';
-import type { CompileError } from './errors.js';
-import { type DeclaredConnectorRef } from './fulfilment-emit.js';
-import { type StructFulfilment } from './fulfilment-structural.js';
-import type { Manifest } from './manifest/schema.js';
-import { type SchemasMap } from './manifest/schema-refs.js';
-export interface StructuralAmbientContext {
-    readonly outputSchema: JsonSchema;
-    readonly fulfilment: StructFulfilment;
-}
-/** Parse the context provider and its output schema during catalog-independent compilation. */
-export declare function parseAmbientContext(manifest: Manifest, schemas: SchemasMap, errors: CompileError[]): StructuralAmbientContext | undefined;
-/** Resolve the provider against the connector catalog, enforcing its read-only contract. */
-export declare function emitAmbientContext(structural: StructuralAmbientContext | undefined, catalog: ConnectorCatalog | undefined, declared: Record<string, DeclaredConnectorRef>, usedAliases: Set<string>, errors: CompileError[], customerRouting?: CustomerRoutingCollector): NonNullable<NonNullable<ArtifactServer['context']>['ambient']> | undefined;
-//# sourceMappingURL=context-compile.d.ts.map

package/node_modules/@noodle-borg/transport-http/dist/module-http.d.ts

@@ -1,13 +0,0 @@
-import type { ServerResponse } from 'node:http';
-export type ModuleJsonBodyResult = {
-    readonly ok: true;
-    readonly value: unknown;
-} | {
-    readonly ok: false;
-    readonly status: 400 | 413;
-    readonly error: string;
-};
-/** Bounded JSON reader shared by trusted service modules without exposing service-owned helpers. */
-export declare function readModuleJsonBody(request: AsyncIterable<Uint8Array | string>, maxBytes: number): Promise<ModuleJsonBodyResult>;
-export declare function sendModuleJson(response: ServerResponse, status: number, value: unknown): void;
-//# sourceMappingURL=module-http.d.ts.map

package/node_modules/@noodle-borg/transport-http/dist/module-http.js

@@ -1,28 +0,0 @@
-/** Bounded JSON reader shared by trusted service modules without exposing service-owned helpers. */
-export async function readModuleJsonBody(request, maxBytes) {
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of request) {
-        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        size += bytes.byteLength;
-        if (size > maxBytes) {
-            return { ok: false, status: 413, error: 'request body too large' };
-        }
-        chunks.push(bytes);
-    }
-    try {
-        return { ok: true, value: JSON.parse(Buffer.concat(chunks).toString('utf8')) };
-    }
-    catch {
-        return { ok: false, status: 400, error: 'invalid JSON request body' };
-    }
-}
-export function sendModuleJson(response, status, value) {
-    const body = Buffer.from(JSON.stringify(value));
-    response.writeHead(status, {
-        'content-type': 'application/json; charset=utf-8',
-        'content-length': String(body.byteLength),
-    });
-    response.end(body);
-}
-//# sourceMappingURL=module-http.js.map