@noodleseed/one 0.152.0 → 0.154.0

package/node_modules/@noodle-borg/service/dist/routes/diagnostics.js

@@ -1,5 +1,6 @@
+import { sendJson } from '@noodle-borg/transport-http';
 import { inspectServiceDeployment } from '../developer-mcp/inspection.js';
-import { baseFromRequest, sendJson } from '../http-util.js';
+import { baseFromRequest } from '../http-util.js';
 import { endpointUrlOptionsForOrg } from '../mcp-public-routing.js';
 import { authorizeTenantControl, developerGrantRouteAccess } from './control-plane.js';
 export async function handleInspect(req, res, registry, gate, controlPlane, tenant, options) {

package/node_modules/@noodle-borg/service/dist/routes/environment-production.js

@@ -1,5 +1,6 @@
+import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
 import { ProductionEnvironmentRequestSchema, ProductionEnvironmentResponseSchema, } from '@noodle-borg/wire-contracts';
-import { readJsonBody, sendForbidden, sendJson } from '../http-util.js';
+import { sendForbidden } from '../http-util.js';
 import { sendContract } from './apps.js';
 import { authorizeControlPlane } from './control-plane.js';
 import { canManageMembers } from './org-admin.js';

package/node_modules/@noodle-borg/service/dist/routes/envs.js

@@ -1,5 +1,5 @@
+import { sendJson } from '@noodle-borg/transport-http';
 import { EnvResponseSchema, EnvsListResponseSchema } from '@noodle-borg/wire-contracts';
-import { sendJson } from '../http-util.js';
 import { sendContract } from './apps.js';
 import { authorizeTenantControl, developerGrantRouteAccess } from './control-plane.js';
 import { envWithEndpointUrl } from './endpoint-enrichment.js';

package/node_modules/@noodle-borg/service/dist/routes/google-workload-identity.js

@@ -1,4 +1,4 @@
-import { sendJson } from '../http-util.js';
+import { sendJson } from '@noodle-borg/transport-http';
 import { authorizeTenantControl } from './control-plane.js';
 export async function handleGoogleWorkloadIdentityDoctor(req, res, tenant, deps) {
     const identity = await authorizeTenantControl(req, res, deps.gate, deps.controlPlane, tenant.org);

package/node_modules/@noodle-borg/service/dist/routes/intent-capture.js

@@ -1,4 +1,5 @@
-import { readJsonBody, sendForbidden, sendJson } from '../http-util.js';
+import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
+import { sendForbidden } from '../http-util.js';
 import { authorizeControlPlane, authorizeTenantControl } from './control-plane.js';
 import { canManageMembers } from './org-admin.js';
 const RETENTION_DAYS = 14;

package/node_modules/@noodle-borg/service/dist/routes/logs.js

@@ -1,4 +1,5 @@
-import { normalizedTimestamps, sendJson } from '../http-util.js';
+import { sendJson } from '@noodle-borg/transport-http';
+import { normalizedTimestamps } from '../http-util.js';
 import { authorizeTenantControl, developerGrantRouteAccess } from './control-plane.js';
 /**
  * `GET /v1/orgs/{org}/apps/{app}/envs/{env}/logs` — the tenant-safe developer log surface (M3, ADR 0101).

package/node_modules/@noodle-borg/service/dist/routes/openai-apps-challenge.js

@@ -1,6 +1,5 @@
 import { OPENAI_APPS_CHALLENGE_PATH } from '@noodle-borg/module';
-import { applySecurityHeaders, enforceHttps } from '@noodle-borg/transport-http';
-import { sendJson } from '../http-util.js';
+import { applySecurityHeaders, enforceHttps, sendJson, } from '@noodle-borg/transport-http';
 import { trustedPublicOrgWellKnownFromRequest } from '../mcp-public-routing.js';
 export function handlePublicOpenAIAppsChallenge(req, res, options, tls, controlPlane) {
     applySecurityHeaders(res, tls);

package/node_modules/@noodle-borg/service/dist/routes/org-admin.js

@@ -1,7 +1,8 @@
 import { mcpSubdomainEndpointOptions } from '@noodle-borg/control-plane/portable';
 import { normalizePublicBaseDomain, OPENAI_APPS_CHALLENGE_PATH } from '@noodle-borg/module';
+import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
 import { OrgSummarySchema } from '@noodle-borg/wire-contracts';
-import { readJsonBody, sendForbidden, sendJson } from '../http-util.js';
+import { sendForbidden } from '../http-util.js';
 import { hashToken, randomToken } from '../oauth/tokens.js';
 import { validateOrgRole, } from '../store.js';
 import { authorizeControlPlane, authorizeTenantControl } from './control-plane.js';

package/node_modules/@noodle-borg/service/dist/routes/org-domains.js

@@ -1,4 +1,5 @@
-import { readJsonBody, sendForbidden, sendJson } from '../http-util.js';
+import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
+import { sendForbidden } from '../http-util.js';
 import { validateOrgMembershipDomain, } from '../store.js';
 import { authorizeControlPlane } from './control-plane.js';
 import { canManageMembers, canViewMembers, emitOrgAudit } from './org-admin.js';

package/node_modules/@noodle-borg/service/dist/routes/org-mcp-subdomain.js

@@ -1,7 +1,7 @@
 import { McpSubdomainCooldownError, McpSubdomainIdempotencyConflictError, McpSubdomainOwnerRequiredError, McpSubdomainUnavailableError, validateMcpSubdomain, } from '@noodle-borg/control-plane/portable';
 import { normalizePublicBaseDomain } from '@noodle-borg/module';
+import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
 import { McpSubdomainMutationRequestSchema, McpSubdomainMutationResponseSchema, McpSubdomainSettingResponseSchema, } from '@noodle-borg/wire-contracts';
-import { readJsonBody, sendJson } from '../http-util.js';
 import { emitAuditMirrors } from '../store/audit.js';
 import { authorizeControlPlane } from './control-plane.js';
 const IDEMPOTENCY_KEY = /^[A-Za-z0-9._:-]{8,256}$/;

package/node_modules/@noodle-borg/service/dist/routes/paths.js

@@ -1,6 +1,5 @@
 import { isAlertRuleId } from '../store/alert-rules.js';
 import { DEPLOYMENT_ID_PATTERN, validateDomain, validateSlug, validateTenantRef, } from '../store.js';
-export { configRouteRef, parseConfigPath, } from './config-values-paths.js';
 function matchPath(pathname, pattern, decode) {
     const match = pattern.exec(pathname);
     if (!match)
@@ -208,44 +207,6 @@ export function parseTenantSessionPath(pathname) {
 export function parseTenantAssistantUsagePath(pathname) {
     return matchPath(pathname, /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/envs\/([^/]+)\/assistant\/usage$/, tenantRef);
 }
-/** Match `/v1/orgs/{org}/apps/{app}/github/connection` (GHD-1 repository connection, GET/POST/DELETE). */
-export function parseGithubConnectionPath(pathname) {
-    return matchPath(pathname, /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/github\/connection$/, appRef);
-}
-/** Parse `/v1/orgs/{org}/apps/{app}/github/runs` (GHD-2, the deploy-runs read surface). */
-export function parseGithubRunsPath(pathname) {
-    return matchPath(pathname, /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/github\/runs$/, appRef);
-}
-/** Match the fixed path `/v1/github/install-url` (GHD-1). */
-export function isGithubInstallUrlPath(pathname) {
-    return pathname === '/v1/github/install-url';
-}
-/** Match the fixed path `/v1/github/installations/claim` (GHD-1). */
-export function isGithubInstallationClaimPath(pathname) {
-    return pathname === '/v1/github/installations/claim';
-}
-/** Parse `/v1/github/runs/{runId}/status` (GHD-C1, the trusted runner's transition report). */
-export function parseGithubRunStatusPath(pathname) {
-    const match = /^\/v1\/github\/runs\/([A-Za-z0-9_-]+)\/status$/.exec(pathname);
-    return match ? match[1] : undefined;
-}
-/** Parse `/v1/github/runs/{runId}/claim` (GHD-C3, Cloud Run builder credential claim). */
-export function parseGithubRunClaimPath(pathname) {
-    const match = /^\/v1\/github\/runs\/([A-Za-z0-9_-]+)\/claim$/.exec(pathname);
-    return match ? match[1] : undefined;
-}
-/** Match the fixed path `/v1/github/webhook` (GHD-2, the GitHub App's webhook receiver). */
-export function isGithubWebhookPath(pathname) {
-    return pathname === '/v1/github/webhook';
-}
-/** Match the fixed path `/v1/github/setup` (GHD-1.4, the GitHub App's configured Setup URL). */
-export function isGithubSetupPath(pathname) {
-    return pathname === '/v1/github/setup';
-}
-/** Match the fixed path `/v1/github/installations/pending` (GHD-1.4, the CLI's install poll target). */
-export function isGithubInstallationPendingPath(pathname) {
-    return pathname === '/v1/github/installations/pending';
-}
 export function parseTenantActionPath(pathname, action) {
     return matchPath(pathname, new RegExp(`^/v1/orgs/([^/]+)/apps/([^/]+)/envs/([^/]+)/${action}$`), tenantRef);
 }

package/node_modules/@noodle-borg/service/dist/routes/protected-resource-metadata.js

@@ -1,12 +1,12 @@
 import { protectedResourceMetadata } from '@noodle-borg/auth';
 import { parseLegacyTenantMcpPath } from '@noodle-borg/module';
-import { applySecurityHeaders, enforceHttps } from '@noodle-borg/transport-http';
+import { applySecurityHeaders, enforceHttps, sendJson, } from '@noodle-borg/transport-http';
 import { DEVELOPER_MCP_PATH, developerMcpScopes } from '../developer-mcp/mount.js';
-import { baseFromRequest, sendJson } from '../http-util.js';
+import { baseFromRequest } from '../http-util.js';
 import { trustedMcpResourceFromRequest } from '../mcp-public-routing.js';
 import { authorizationMetadataForTenant } from '../registry-targets.js';
 /** Well-known prefix for OAuth 2.0 Protected Resource Metadata (RFC 9728). */
-export const PROTECTED_RESOURCE_METADATA_PREFIX = '/.well-known/oauth-protected-resource';
+const PROTECTED_RESOURCE_METADATA_PREFIX = '/.well-known/oauth-protected-resource';
 export function dispatchProtectedResourceMetadata(req, res, url, registry, controlPlane, options, tls) {
     if (req.method !== 'GET' || !url.pathname.startsWith(PROTECTED_RESOURCE_METADATA_PREFIX)) {
         return false;

package/node_modules/@noodle-borg/service/dist/routes/rollback.js

@@ -1,5 +1,6 @@
 import { rollbackDeploymentOperation } from '@noodle-borg/control-plane/portable';
-import { baseFromRequest, readJsonBody, sendForbidden, sendJson } from '../http-util.js';
+import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
+import { baseFromRequest, sendForbidden } from '../http-util.js';
 import { endpointUrlOptionsForOrg } from '../mcp-public-routing.js';
 import { authorizeTenantControl, developerGrantRouteAccess } from './control-plane.js';
 export async function handleRollback(req, res, registry, gate, controlPlane, audit, maxBody, tenant, options) {

package/node_modules/@noodle-borg/service/dist/routes/service-principals-dispatch.js

@@ -1,5 +1,4 @@
-import { applySecurityHeaders, enforceHttps, } from '@noodle-borg/transport-http';
-import { sendJson } from '../http-util.js';
+import { applySecurityHeaders, enforceHttps, sendJson, } from '@noodle-borg/transport-http';
 import { parseServicePrincipalPath } from './service-principal-paths.js';
 import { handleServicePrincipalRequest } from './service-principals.js';
 /** Bind the shared security front door when the optional service-principal runtime is configured. */
@@ -16,7 +15,7 @@ export function createServicePrincipalDispatcher(registry, runtime, deps) {
     });
 }
 /** Dispatch the exact service-principal route family before generic MCP/tenant fallback. */
-export function dispatchServicePrincipalRoutes(req, res, url, deps) {
+function dispatchServicePrincipalRoutes(req, res, url, deps) {
     const path = parseServicePrincipalPath(url.pathname);
     if (path === undefined)
         return false;

package/node_modules/@noodle-borg/service/dist/routes/service-principals.js

@@ -1,4 +1,4 @@
-import { readJsonBody, sendJson } from '../http-util.js';
+import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
 import { createClientSecret, digestClientSecret } from '../oauth/service-principal-credentials.js';
 import { authorizeControlPlane } from './control-plane.js';
 import { createServicePrincipalCredentialSchema, createServicePrincipalGrantSchema, createServicePrincipalSchema, } from './service-principal-contracts.js';

package/node_modules/@noodle-borg/service/dist/service-config.d.ts

@@ -60,8 +60,8 @@ export interface ObservabilityConfig {
         readonly maxEventsPerExecution?: number;
     };
 }
-export declare const AGENCY_ORG_TEMPLATES: readonly ["small-business", "mid-market", "enterprise"];
-export type AgencyOrgTemplate = (typeof AGENCY_ORG_TEMPLATES)[number];
+declare const AGENCY_ORG_TEMPLATES: readonly ["small-business", "mid-market", "enterprise"];
+type AgencyOrgTemplate = (typeof AGENCY_ORG_TEMPLATES)[number];
 export type ServiceConfigSource = {
     readonly kind: 'none';
 } | {
@@ -92,4 +92,5 @@ export declare function resolveServiceConfigSource(input: {
     readonly ok: false;
     readonly error: string;
 };
+export {};
 //# sourceMappingURL=service-config.d.ts.map

package/node_modules/@noodle-borg/service/dist/service-config.js

@@ -2,7 +2,7 @@ import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { CAPABILITY_NAMES, isServiceProfileName, SERVICE_PROFILE_NAMES, } from '@noodle-borg/capabilities';
 import { parse as parseYaml } from 'yaml';
-export const AGENCY_ORG_TEMPLATES = ['small-business', 'mid-market', 'enterprise'];
+const AGENCY_ORG_TEMPLATES = ['small-business', 'mid-market', 'enterprise'];
 export function defineNoodleService(config) {
     return config;
 }

package/node_modules/@noodle-borg/service/dist/service.js

@@ -2,7 +2,7 @@ import { InMemoryAssistantAppearanceSettingsStore, InMemoryAssistantStore, } fro
 import { allowAllGate, InMemoryControlPlaneStore } from '@noodle-borg/control-plane/portable';
 import { dispatchKnowledgeRequest } from '@noodle-borg/knowledge-operations/portable';
 import { OPENAI_APPS_CHALLENGE_PATH } from '@noodle-borg/module';
-import { applySecurityHeaders, createMcpRouter, enforceHttps, noopLogger, } from '@noodle-borg/transport-http';
+import { applySecurityHeaders, createMcpRouter, enforceHttps, noopLogger, sendJson, } from '@noodle-borg/transport-http';
 import { AnonymousConsumerLimiter, createAdmissionGate } from './admission.js';
 import { createArchivePreflight } from './archive-preflight.js';
 import { ArchiveSweeper, resolveArchiveRetentionDays } from './archive-sweeper.js';
@@ -13,7 +13,7 @@ import { rejectIncompatibleCli } from './client-compatibility.js';
 import { createDataPlaneMembershipAuthorizer } from './data-plane-membership.js';
 import { DEVELOPER_MCP_PATH, handleDeveloperMcpRequest } from './developer-mcp/mount.js';
 import { createDeveloperMcpMountOptions } from './developer-mcp/service-options.js';
-import { baseFromRequest, respondRouteError, sendJson } from './http-util.js';
+import { baseFromRequest, respondRouteError } from './http-util.js';
 import { createMcpInvocationContextResolver } from './invocation-context.js';
 import { wireServiceKnowledge } from './knowledge-wiring.js';
 import * as mcp from './mcp-public-routing.js';
@@ -23,6 +23,7 @@ import { isAuthServerPath } from './oauth/paths.js';
 import { createIntentTargetResolver, createObservabilityDispatcher, createObservabilityStores, } from './observability-runtime.js';
 import { handleAccessUpdate } from './routes/access.js';
 import { dispatchAlertRoutes } from './routes/alerts-dispatch.js';
+import { handleAppPurgeReconciliationRoute, } from './routes/app-purge-reconciliation.js';
 import { handleAppArchive, handleAppRestore } from './routes/archive.js';
 import { handleAssetPreflight } from './routes/asset-control-plane.js';
 import { dispatchAssistantRoutes } from './routes/assistant-dispatch.js';
@@ -233,6 +234,26 @@ export function createServiceHandler(registry, options = {}) {
                 ...(advanced ? { modules: capabilityReport.modules } : {}),
             });
         }
+        const appPurgeReconciliationAction = url.pathname === '/v1/service/app-purge-reconciliation/preview'
+            ? 'preview'
+            : url.pathname === '/v1/service/app-purge-reconciliation/apply'
+                ? 'apply'
+                : undefined;
+        if (req.method === 'POST' && appPurgeReconciliationAction !== undefined) {
+            applySecurityHeaders(res, tls);
+            if (enforceHttps(req, res, tls))
+                return;
+            void handleAppPurgeReconciliationRoute(req, res, {
+                gate,
+                ...(options.appPurgeReconciliationOperator === undefined
+                    ? {}
+                    : { operator: options.appPurgeReconciliationOperator }),
+                releaseSha: buildInfo.gitSha,
+                maxBody,
+                ...(options.clock === undefined ? {} : { clock: options.clock }),
+            }, appPurgeReconciliationAction);
+            return;
+        }
         if (servicePrincipalDispatcher?.(req, res, url))
             return;
         if (dispatchAssistantRoutes(req, res, url, {
@@ -316,7 +337,12 @@ export function createServiceHandler(registry, options = {}) {
             applySecurityHeaders(res, tls);
             if (enforceHttps(req, res, tls))
                 return;
-            handleWhoami(req, res, gate, controlPlane, options).catch(() => {
+            const scopes = url.searchParams.getAll('scope');
+            if (scopes.length > 1 || (scopes.length === 1 && scopes[0] !== 'identity')) {
+                sendJson(res, 400, { error: 'invalid whoami scope' });
+                return;
+            }
+            handleWhoami(req, res, gate, controlPlane, options, scopes[0] === 'identity' ? 'identity' : undefined).catch(() => {
                 if (!res.headersSent)
                     sendJson(res, 500, { error: 'internal error' });
             });

package/node_modules/@noodle-borg/service/dist/store/alert-rules.js

@@ -34,7 +34,7 @@ export function isAlertRuleId(id) {
  * validation of the webhook URL (https-only, loopback carve-out, private-IP rejection) is the
  * route's job (`validateAlertWebhookUrl`); the store only rejects structurally broken values.
  */
-export function validateCreateAlertRuleInput(input) {
+function validateCreateAlertRuleInput(input) {
     const orgSlug = validateSlug('org', input.orgSlug);
     const appSlug = validateSlug('app', input.appSlug);
     const environment = validateSlug('env', input.environment);

package/node_modules/@noodle-borg/service/dist/store/audit.js

@@ -10,7 +10,7 @@ export { AUDIT_SCHEMA_VERSION, redactDetails } from '@noodle-borg/module';
  * to a marker, so a stray token-bearing object can never reach a stored row or a log line.
  */
 /** Build the canonical stored event from an input, stamping id, schema version, and timestamp. */
-export function toAuditEvent(input, id, createdAt) {
+function toAuditEvent(input, id, createdAt) {
     const details = redactDetails(input.details);
     return {
         id,

package/node_modules/@noodle-borg/service/dist/store/in-memory.js

@@ -3,7 +3,7 @@ import { assertSameAppPackageSnapshot, sanitizeDeployRecordAppPackageSnapshot, }
 import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, } from '../customer-auth-audience-binding.js';
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from '../deployment-lock.js';
 import { defaultActiveRecord, sameDeploymentScope, sameTenantRecord, } from '../deployment-versioning.js';
-import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
+import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, planArchivedAppSweep, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
 import { validateSlug, validateTenantRef } from './validate.js';
 /** In-memory store: keeps records in a Map. Used by tests and as an explicit, non-persistent option. */
 export class InMemoryArtifactStore {
@@ -165,13 +165,9 @@ export class InMemoryArtifactStore {
         return Promise.resolve(plan.result);
     }
     sweepArchived(before) {
-        const deleted = [];
-        for (const [id, record] of this.#records) {
-            if (record.archivedAt !== undefined && record.archivedAt < before) {
-                deleted.push(record);
-                this.#records.delete(id);
-            }
-        }
+        const deleted = planArchivedAppSweep([...this.#records.values()], before);
+        for (const record of deleted)
+            this.#records.delete(record.deploymentId);
         return Promise.resolve(deleted);
     }
     async listApps(org, opts = {}) {

package/node_modules/@noodle-borg/service/dist/store/json-file.js

@@ -6,7 +6,7 @@ import { assertSameAppPackageSnapshot, sanitizeDeployRecordAppPackageSnapshot, }
 import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, } from '../customer-auth-audience-binding.js';
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from '../deployment-lock.js';
 import { defaultActiveRecord, sameDeploymentScope, sameTenantRecord, } from '../deployment-versioning.js';
-import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
+import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, planArchivedAppSweep, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
 import { DEPLOYMENT_ID_PATTERN, validateSlug, validateTenantRef } from './validate.js';
 /**
  * JSON-file store: one file per deployment at `<dataDir>/deployments/<deploymentId>.json`, written atomically
@@ -228,8 +228,11 @@ export class JsonFileArtifactStore {
         await Promise.all(plan.clear.map((record) => this.#writeRecord(withoutArchiveStamp(record))));
         return plan.result;
     }
-    async sweepArchived(before) {
-        const deleted = (await this.loadAll()).filter((record) => record.archivedAt !== undefined && record.archivedAt < before);
+    sweepArchived(before) {
+        return this.#serializeLifecycle(() => this.#sweepArchivedUnlocked(before));
+    }
+    async #sweepArchivedUnlocked(before) {
+        const deleted = planArchivedAppSweep(await this.loadAll(), before);
         await Promise.all(deleted.map((record) => rm(join(this.#dir, `${record.deploymentId}.json`), { force: true })));
         return deleted;
     }

package/node_modules/@noodle-borg/service/dist/store/records.js

@@ -101,6 +101,26 @@ export function planAppRestore(records) {
     const clear = records.filter((record) => record.archivedAt !== undefined);
     return { result: { restoredDeployments: clear.length }, clear };
 }
+/** Plan a retention sweep: only delete an app when every deployment is archived before the cutoff. */
+export function planArchivedAppSweep(records, before) {
+    const apps = new Map();
+    for (const record of records) {
+        let byApp = apps.get(record.orgSlug);
+        if (byApp === undefined) {
+            byApp = new Map();
+            apps.set(record.orgSlug, byApp);
+        }
+        const bucket = byApp.get(record.appSlug);
+        if (bucket === undefined)
+            byApp.set(record.appSlug, [record]);
+        else
+            bucket.push(record);
+    }
+    return [...apps.values()].flatMap((byApp) => [...byApp.values()].flatMap((appRecords) => appRecords.length > 0 &&
+        appRecords.every((record) => record.archivedAt !== undefined && record.archivedAt < before)
+        ? appRecords
+        : []));
+}
 /** Strip the archive stamp from a record (exact-optional safe). */
 export function withoutArchiveStamp(record) {
     const { archivedAt: _cleared, ...rest } = record;
@@ -223,7 +243,7 @@ function compareAppSummaries(a, b) {
     return a.appSlug.localeCompare(b.appSlug);
 }
 /** Default + hard cap for a single `apps` list page (the route surfaces `truncated`, never drops silently). */
-export const DEFAULT_APPS_LIMIT = 200;
+const DEFAULT_APPS_LIMIT = 200;
 /** Cap an already-sorted {@link AppSummary} list at `limit` (default {@link DEFAULT_APPS_LIMIT}). */
 export function paginateAppSummaries(apps, limit) {
     const safeLimit = limit ?? DEFAULT_APPS_LIMIT;

package/node_modules/@noodle-borg/service/dist/store/validate.d.ts

@@ -1,5 +1,5 @@
 import type { ConfigScope, TenantRef } from '../store.js';
-export { DOMAIN_PATTERN, isSystemOwnedOrgSlug, OPENAI_APPS_CHALLENGE_MAX_LENGTH, SLUG_PATTERN, validateDomain, validateMcpSubdomain, validateOpenAIAppsChallenge, validateOrgMembershipDomain, validateOrgRole, validateSignupAllowlistKind, validateSlug, validateUserOwnedOrgSlug, } from '@noodle-borg/control-plane/portable';
+export { DOMAIN_PATTERN, SLUG_PATTERN, validateDomain, validateOrgMembershipDomain, validateOrgRole, validateSignupAllowlistKind, validateSlug, } from '@noodle-borg/control-plane/portable';
 /** Minted deployment id shape (`mintDeploymentId`): a slug plus a short hex suffix; safe as a filename. */
 export declare const DEPLOYMENT_ID_PATTERN: RegExp;
 export declare const CONFIG_NAME_PATTERN: RegExp;

package/node_modules/@noodle-borg/service/dist/store/validate.js

@@ -4,7 +4,7 @@
  * import cycle through the store aggregate.
  */
 import { validateSlug } from '@noodle-borg/control-plane/portable';
-export { DOMAIN_PATTERN, isSystemOwnedOrgSlug, OPENAI_APPS_CHALLENGE_MAX_LENGTH, SLUG_PATTERN, validateDomain, validateMcpSubdomain, validateOpenAIAppsChallenge, validateOrgMembershipDomain, validateOrgRole, validateSignupAllowlistKind, validateSlug, validateUserOwnedOrgSlug, } from '@noodle-borg/control-plane/portable';
+export { DOMAIN_PATTERN, SLUG_PATTERN, validateDomain, validateOrgMembershipDomain, validateOrgRole, validateSignupAllowlistKind, validateSlug, } from '@noodle-borg/control-plane/portable';
 /** Minted deployment id shape (`mintDeploymentId`): a slug plus a short hex suffix; safe as a filename. */
 export const DEPLOYMENT_ID_PATTERN = /^[a-z0-9-]+$/;
 export const CONFIG_NAME_PATTERN = /^[A-Za-z0-9_]+$/;

package/node_modules/@noodle-borg/service/dist/store.d.ts

@@ -11,7 +11,7 @@ export { type ConfigScope, type ConfigStore, type ConfigValueMetadata, InMemoryC
 export type { ProductionEnvironmentChange } from './store/environment-production.js';
 export { InMemoryArtifactStore } from './store/in-memory.js';
 export { JsonFileArtifactStore } from './store/json-file.js';
-export { CONFIG_NAME_PATTERN, DEPLOYMENT_ID_PATTERN, DOMAIN_PATTERN, OPENAI_APPS_CHALLENGE_MAX_LENGTH, SLUG_PATTERN, validateConfigName, validateConfigScope, validateDomain, validateMcpSubdomain, validateOpenAIAppsChallenge, validateOrgMembershipDomain, validateOrgRole, validatePositiveInteger, validateSignupAllowlistKind, validateSlug, validateTenantRef, validateUserOwnedOrgSlug, } from './store/validate.js';
+export { CONFIG_NAME_PATTERN, DEPLOYMENT_ID_PATTERN, DOMAIN_PATTERN, SLUG_PATTERN, validateConfigName, validateConfigScope, validateDomain, validateOrgMembershipDomain, validateOrgRole, validatePositiveInteger, validateSignupAllowlistKind, validateSlug, validateTenantRef, } from './store/validate.js';
 /**
  * Secret values at rest. The compiled runtime keeps plaintext tokens in memory (the broker), but the
  * *persisted* form is a tagged envelope. `aes-256-gcm` (Slice 26, ADR 0028) holds an AES-256-GCM
@@ -92,7 +92,7 @@ export interface TenantOidcAuthConfig {
     readonly claims?: TenantAuthClaimMap | undefined;
     readonly routing?: ArtifactCustomerAuthRouting | undefined;
 }
-export interface TenantFederatedOidcAuthConfig {
+interface TenantFederatedOidcAuthConfig {
     readonly kind: 'federatedOidc';
     readonly issuers: readonly {
         readonly issuer: string;
@@ -318,8 +318,9 @@ export interface ArtifactStore {
      * App soft delete (ADR 0117). `getAppArchivedAt` reports the app's archived stamp (defined iff the
      * app has records and every record is stamped). `archiveApp` stamps every record for the app (all
      * environments/versions); `restoreApp` clears the stamps; both resolve `undefined` for an app with
-     * no records. `sweepArchived` hard-deletes records archived strictly before `before` and returns
-     * them so the caller can reclaim associated config and emit audit events.
+     * no records. `sweepArchived` hard-deletes a complete app only when every one of its records is archived
+     * strictly before `before`, returning every record from each deleted app so the caller can reclaim
+     * associated config and emit audit events.
      */
     getAppArchivedAt(org: string, app: string): Promise<string | undefined>;
     archiveApp(org: string, app: string, at: string): Promise<AppArchiveResult | undefined>;

package/node_modules/@noodle-borg/service/dist/store.js

@@ -4,5 +4,5 @@ export { InMemoryConfigStore, resolveConfigScope, scopeChain, } from './store/co
 // surface.
 export { InMemoryArtifactStore } from './store/in-memory.js';
 export { JsonFileArtifactStore } from './store/json-file.js';
-export { CONFIG_NAME_PATTERN, DEPLOYMENT_ID_PATTERN, DOMAIN_PATTERN, OPENAI_APPS_CHALLENGE_MAX_LENGTH, SLUG_PATTERN, validateConfigName, validateConfigScope, validateDomain, validateMcpSubdomain, validateOpenAIAppsChallenge, validateOrgMembershipDomain, validateOrgRole, validatePositiveInteger, validateSignupAllowlistKind, validateSlug, validateTenantRef, validateUserOwnedOrgSlug, } from './store/validate.js';
+export { CONFIG_NAME_PATTERN, DEPLOYMENT_ID_PATTERN, DOMAIN_PATTERN, SLUG_PATTERN, validateConfigName, validateConfigScope, validateDomain, validateOrgMembershipDomain, validateOrgRole, validatePositiveInteger, validateSignupAllowlistKind, validateSlug, validateTenantRef, } from './store/validate.js';
 //# sourceMappingURL=store.js.map

package/node_modules/@noodle-borg/service/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.91.0",
+    "@noodle-borg/agent-kit": "0.93.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/node_modules/@noodle-borg/transport-http/dist/client-identity.js

@@ -38,7 +38,7 @@ const KNOWN_UA_FAMILIES = [
     [/mozilla|chrome|safari|firefox|edg/i, 'browser'],
 ];
 /** Bound a wire-supplied client identity scalar: printable, trimmed, and length-capped. */
-export function boundedClientScalar(value, max) {
+function boundedClientScalar(value, max) {
     if (value === undefined)
         return undefined;
     let cleaned = '';

package/node_modules/@noodle-borg/transport-http/dist/handler.d.ts

@@ -1,6 +1,6 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { AccessMode, AdmissionGate, DataPlaneIdentityAuthorizer, IntentCaptureMode, IntentEventInput, OrgMembershipSource, OwnerTokenVerifier, RequestEventInput, TenantRouteRef } from '@noodle-borg/module';
-import { type ConfirmationNonceLedger, type ProtocolRequestContext, type RequestStateManager, type ServedArtifact } from '@noodle-borg/protocol';
+import { type ConfirmationNonceLedger, type McpProtocolMode, type ProtocolRequestContext, type RequestStateManager, type ServedArtifact } from '@noodle-borg/protocol';
 import { type TlsPosture } from './front-door.js';
 import { type Logger } from './logging.js';
 import { type PublicTenantRouting } from './routing.js';
@@ -10,7 +10,6 @@ export type { AccessMode, AdmissionCategory, AdmissionContext, AdmissionDecision
 export type { PublicTenantRouting } from './routing.js';
 /** Origins allowed to call the endpoint: an explicit list, a predicate, or undefined (allow any). */
 export type OriginPolicy = readonly string[] | ((origin: string) => boolean);
-export type McpProtocolMode = 'dual' | 'legacy-only';
 /** Validated, bounded coordinates from one host request. Never identity or policy input. */
 export interface InvocationClientLocationHint {
     readonly latitude: number;

package/node_modules/@noodle-borg/transport-http/dist/identity-authorization.d.ts

@@ -0,0 +1,51 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { AccessMode, DataPlaneIdentityAuthorizer, OrgMembershipSource, OwnerTokenVerifier } from '@noodle-borg/module';
+import { type ProtocolRequestContext } from '@noodle-borg/protocol';
+export interface IdentityAuthorizationOptions {
+    readonly accessMode: AccessMode | undefined;
+    readonly ownerSubject: string | undefined;
+    readonly org: string | undefined;
+    readonly orgMembershipSources: readonly OrgMembershipSource[] | undefined;
+    readonly verifyOwnerToken: OwnerTokenVerifier | undefined;
+    readonly authorizeDataPlaneIdentity: DataPlaneIdentityAuthorizer | undefined;
+    /** Whether to trust forwarded-proto when reconstructing the public resource/PRM URLs. */
+    readonly trustProxy: boolean;
+    /** Public resource URL supplied by a trusted edge for MCP-subdomain routes. */
+    readonly publicResourceUrl?: string;
+}
+/**
+ * Bounded identity-denial taxonomy retained by request analytics (#1309). Derived structurally at
+ * this seam — the token verifier stays opaque — and never carries token material or claims.
+ */
+type IdentityDenialReason = 'missing_token' | 'verifier_unavailable' | 'token_rejected' | 'identity_not_customer' | 'owner_unconfigured' | 'owner_mismatch' | 'org_membership_denied';
+export type IdentityAuthResult = {
+    readonly allow: true;
+    readonly caller?: NonNullable<ProtocolRequestContext['caller']>;
+    readonly customerIssuer?: string;
+    readonly customerRouting?: Readonly<Record<string, string>>;
+    readonly subject?: string;
+} | {
+    readonly allow: false;
+    readonly reason: IdentityDenialReason;
+};
+/**
+ * Identity gate (OA-1/OA-3): require a verified token and authorize it against the deployment access mode.
+ * `allow: true` means the request may proceed, with caller and subject fields when available. `allow: false`
+ * means this function already wrote the denial response. Missing tokens and absent verifiers fail closed.
+ */
+export declare function authorizeIdentityMode(req: IncomingMessage, res: ServerResponse, auth: IdentityAuthorizationOptions): Promise<IdentityAuthResult>;
+/**
+ * Public endpoints stay anonymous unless a valid service-principal bearer is supplied. Invalid, human,
+ * and customer bearers retain the pre-existing public behavior and are ignored rather than challenged.
+ */
+export declare function authorizePublicServiceMode(req: IncomingMessage, auth: IdentityAuthorizationOptions): Promise<IdentityAuthResult>;
+export declare function authorizeMixedMode(req: IncomingMessage, res: ServerResponse, auth: IdentityAuthorizationOptions): Promise<IdentityAuthResult>;
+export declare function isIdentityMode(mode: AccessMode | undefined): boolean;
+/** The credential carried by one `Authorization` header value, or null when it is not a bearer. */
+export declare function bearerToken(headerValue: string | undefined): string | null;
+/** The canonical resource identifier (the tenant MCP URL) a token must be audience-bound to (RFC 8707). */
+export declare function canonicalResourceUrl(req: IncomingMessage, auth: Pick<IdentityAuthorizationOptions, 'trustProxy' | 'publicResourceUrl'>): string;
+/** The RFC 9728 protected-resource-metadata URL for this request (well-known prefix before the path). */
+export declare function protectedResourceMetadataUrl(req: IncomingMessage, auth: IdentityAuthorizationOptions): string;
+export {};
+//# sourceMappingURL=identity-authorization.d.ts.map

package/node_modules/@noodle-borg/transport-http/dist/identity-authorization.js

@@ -8,7 +8,7 @@ import { header } from './request-capture.js';
  */
 export async function authorizeIdentityMode(req, res, auth) {
     const challenge = protectedResourceMetadataUrl(req, auth);
-    const token = bearerToken(req);
+    const token = bearerToken(header(req, 'authorization'));
     if (token === null || auth.verifyOwnerToken === undefined) {
         sendUnauthorized(res, challenge);
         return { allow: false, reason: token === null ? 'missing_token' : 'verifier_unavailable' };
@@ -75,7 +75,7 @@ export async function authorizeIdentityMode(req, res, auth) {
  * and customer bearers retain the pre-existing public behavior and are ignored rather than challenged.
  */
 export async function authorizePublicServiceMode(req, auth) {
-    const token = bearerToken(req);
+    const token = bearerToken(header(req, 'authorization'));
     if (token === null || auth.verifyOwnerToken === undefined)
         return { allow: true };
     const verification = await auth.verifyOwnerToken(token, canonicalResourceUrl(req, auth));
@@ -84,7 +84,7 @@ export async function authorizePublicServiceMode(req, auth) {
         : { allow: true };
 }
 export async function authorizeMixedMode(req, res, auth) {
-    const token = bearerToken(req);
+    const token = bearerToken(header(req, 'authorization'));
     if (token === null)
         return { allow: true };
     const challenge = protectedResourceMetadataUrl(req, auth);
@@ -114,11 +114,11 @@ export function isIdentityMode(mode) {
         mode === 'authenticated' ||
         mode === 'customers');
 }
-function bearerToken(req) {
-    const auth = header(req, 'authorization');
-    if (!auth)
+/** The credential carried by one `Authorization` header value, or null when it is not a bearer. */
+export function bearerToken(headerValue) {
+    if (!headerValue)
         return null;
-    const match = /^Bearer\s+(.+)$/i.exec(auth);
+    const match = /^Bearer\s+(.+)$/i.exec(headerValue);
     return match?.[1] ?? null;
 }
 /**

package/node_modules/@noodle-borg/transport-http/dist/index.d.ts

@@ -1,8 +1,10 @@
 export { applySecurityHeaders, effectiveProto, enforceHttps, type TlsPosture, } from './front-door.js';
-export { type AccessMode, type AdmissionCategory, type AdmissionContext, type AdmissionDecision, type AdmissionGate, createMcpHttpHandler, createMcpRouter, type DataPlaneAuthorizationResult, type DataPlaneIdentityAuthorizer, type HttpHandlerOptions, type InvocationClientHint, type InvocationClientLocationHint, type InvocationContextResolutionInput, type InvocationContextResolver, type McpProtocolMode, type OriginPolicy, type OwnerTokenVerifier, type ServedTarget, type ServerLookup, type TenantPreflight, type TenantRouteRef, } from './handler.js';
+export { type AccessMode, type AdmissionCategory, type AdmissionContext, type AdmissionDecision, type AdmissionGate, createMcpHttpHandler, createMcpRouter, type DataPlaneAuthorizationResult, type DataPlaneIdentityAuthorizer, type HttpHandlerOptions, type InvocationClientHint, type InvocationClientLocationHint, type InvocationContextResolutionInput, type InvocationContextResolver, type OriginPolicy, type OwnerTokenVerifier, type ServedTarget, type ServerLookup, type TenantPreflight, type TenantRouteRef, } from './handler.js';
+export { bearerToken } from './identity-authorization.js';
 export { createLogger, type LogFields, type Logger, type LoggerOptions, type LogLevel, type LogSink, noopLogger, stderrSink, stdoutSink, } from './logging.js';
-export { type ModuleJsonBodyResult, readModuleJsonBody, sendModuleJson, } from './module-http.js';
 export { resolveTrustedPublicOrg, resolveTrustedTenantMcpResource, type TrustedPublicOrg, type TrustedPublicRef, type TrustedPublicRouting, type TrustedTenantMcpResource, trustedPublicMcpRef, trustedPublicOrgWellKnownRef, } from './public-routing.js';
+export { readBody, readDeployBody, readJsonBody } from './request-body.js';
+export { sendJson } from './responses.js';
 export { type RunningServer, type ServeOptions, serveHttp } from './serve.js';
 export type { HostedToolAuthorizationObservation, HostedToolAuthorizationObserver, ServicePrincipalToolAuthorizationObservation, } from './service-principal-authorization.js';
 export { preflightServicePrincipalToolCall, sendServicePrincipalToolDenial, } from './service-principal-authorization.js';