@noodleseed/one 0.153.0 → 0.154.0

package/node_modules/@noodle-borg/service/dist/service.js

@@ -23,6 +23,7 @@ import { isAuthServerPath } from './oauth/paths.js';
 import { createIntentTargetResolver, createObservabilityDispatcher, createObservabilityStores, } from './observability-runtime.js';
 import { handleAccessUpdate } from './routes/access.js';
 import { dispatchAlertRoutes } from './routes/alerts-dispatch.js';
+import { handleAppPurgeReconciliationRoute, } from './routes/app-purge-reconciliation.js';
 import { handleAppArchive, handleAppRestore } from './routes/archive.js';
 import { handleAssetPreflight } from './routes/asset-control-plane.js';
 import { dispatchAssistantRoutes } from './routes/assistant-dispatch.js';
@@ -233,6 +234,26 @@ export function createServiceHandler(registry, options = {}) {
                 ...(advanced ? { modules: capabilityReport.modules } : {}),
             });
         }
+        const appPurgeReconciliationAction = url.pathname === '/v1/service/app-purge-reconciliation/preview'
+            ? 'preview'
+            : url.pathname === '/v1/service/app-purge-reconciliation/apply'
+                ? 'apply'
+                : undefined;
+        if (req.method === 'POST' && appPurgeReconciliationAction !== undefined) {
+            applySecurityHeaders(res, tls);
+            if (enforceHttps(req, res, tls))
+                return;
+            void handleAppPurgeReconciliationRoute(req, res, {
+                gate,
+                ...(options.appPurgeReconciliationOperator === undefined
+                    ? {}
+                    : { operator: options.appPurgeReconciliationOperator }),
+                releaseSha: buildInfo.gitSha,
+                maxBody,
+                ...(options.clock === undefined ? {} : { clock: options.clock }),
+            }, appPurgeReconciliationAction);
+            return;
+        }
         if (servicePrincipalDispatcher?.(req, res, url))
             return;
         if (dispatchAssistantRoutes(req, res, url, {
@@ -316,7 +337,12 @@ export function createServiceHandler(registry, options = {}) {
             applySecurityHeaders(res, tls);
             if (enforceHttps(req, res, tls))
                 return;
-            handleWhoami(req, res, gate, controlPlane, options).catch(() => {
+            const scopes = url.searchParams.getAll('scope');
+            if (scopes.length > 1 || (scopes.length === 1 && scopes[0] !== 'identity')) {
+                sendJson(res, 400, { error: 'invalid whoami scope' });
+                return;
+            }
+            handleWhoami(req, res, gate, controlPlane, options, scopes[0] === 'identity' ? 'identity' : undefined).catch(() => {
                 if (!res.headersSent)
                     sendJson(res, 500, { error: 'internal error' });
             });

package/node_modules/@noodle-borg/service/dist/store/in-memory.js

@@ -3,7 +3,7 @@ import { assertSameAppPackageSnapshot, sanitizeDeployRecordAppPackageSnapshot, }
 import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, } from '../customer-auth-audience-binding.js';
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from '../deployment-lock.js';
 import { defaultActiveRecord, sameDeploymentScope, sameTenantRecord, } from '../deployment-versioning.js';
-import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
+import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, planArchivedAppSweep, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
 import { validateSlug, validateTenantRef } from './validate.js';
 /** In-memory store: keeps records in a Map. Used by tests and as an explicit, non-persistent option. */
 export class InMemoryArtifactStore {
@@ -165,13 +165,9 @@ export class InMemoryArtifactStore {
         return Promise.resolve(plan.result);
     }
     sweepArchived(before) {
-        const deleted = [];
-        for (const [id, record] of this.#records) {
-            if (record.archivedAt !== undefined && record.archivedAt < before) {
-                deleted.push(record);
-                this.#records.delete(id);
-            }
-        }
+        const deleted = planArchivedAppSweep([...this.#records.values()], before);
+        for (const record of deleted)
+            this.#records.delete(record.deploymentId);
         return Promise.resolve(deleted);
     }
     async listApps(org, opts = {}) {

package/node_modules/@noodle-borg/service/dist/store/json-file.js

@@ -6,7 +6,7 @@ import { assertSameAppPackageSnapshot, sanitizeDeployRecordAppPackageSnapshot, }
 import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, } from '../customer-auth-audience-binding.js';
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from '../deployment-lock.js';
 import { defaultActiveRecord, sameDeploymentScope, sameTenantRecord, } from '../deployment-versioning.js';
-import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
+import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, planArchivedAppSweep, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
 import { DEPLOYMENT_ID_PATTERN, validateSlug, validateTenantRef } from './validate.js';
 /**
  * JSON-file store: one file per deployment at `<dataDir>/deployments/<deploymentId>.json`, written atomically
@@ -228,8 +228,11 @@ export class JsonFileArtifactStore {
         await Promise.all(plan.clear.map((record) => this.#writeRecord(withoutArchiveStamp(record))));
         return plan.result;
     }
-    async sweepArchived(before) {
-        const deleted = (await this.loadAll()).filter((record) => record.archivedAt !== undefined && record.archivedAt < before);
+    sweepArchived(before) {
+        return this.#serializeLifecycle(() => this.#sweepArchivedUnlocked(before));
+    }
+    async #sweepArchivedUnlocked(before) {
+        const deleted = planArchivedAppSweep(await this.loadAll(), before);
         await Promise.all(deleted.map((record) => rm(join(this.#dir, `${record.deploymentId}.json`), { force: true })));
         return deleted;
     }

package/node_modules/@noodle-borg/service/dist/store/records.js

@@ -101,6 +101,26 @@ export function planAppRestore(records) {
     const clear = records.filter((record) => record.archivedAt !== undefined);
     return { result: { restoredDeployments: clear.length }, clear };
 }
+/** Plan a retention sweep: only delete an app when every deployment is archived before the cutoff. */
+export function planArchivedAppSweep(records, before) {
+    const apps = new Map();
+    for (const record of records) {
+        let byApp = apps.get(record.orgSlug);
+        if (byApp === undefined) {
+            byApp = new Map();
+            apps.set(record.orgSlug, byApp);
+        }
+        const bucket = byApp.get(record.appSlug);
+        if (bucket === undefined)
+            byApp.set(record.appSlug, [record]);
+        else
+            bucket.push(record);
+    }
+    return [...apps.values()].flatMap((byApp) => [...byApp.values()].flatMap((appRecords) => appRecords.length > 0 &&
+        appRecords.every((record) => record.archivedAt !== undefined && record.archivedAt < before)
+        ? appRecords
+        : []));
+}
 /** Strip the archive stamp from a record (exact-optional safe). */
 export function withoutArchiveStamp(record) {
     const { archivedAt: _cleared, ...rest } = record;

package/node_modules/@noodle-borg/service/dist/store.d.ts

@@ -318,8 +318,9 @@ export interface ArtifactStore {
      * App soft delete (ADR 0117). `getAppArchivedAt` reports the app's archived stamp (defined iff the
      * app has records and every record is stamped). `archiveApp` stamps every record for the app (all
      * environments/versions); `restoreApp` clears the stamps; both resolve `undefined` for an app with
-     * no records. `sweepArchived` hard-deletes records archived strictly before `before` and returns
-     * them so the caller can reclaim associated config and emit audit events.
+     * no records. `sweepArchived` hard-deletes a complete app only when every one of its records is archived
+     * strictly before `before`, returning every record from each deleted app so the caller can reclaim
+     * associated config and emit audit events.
      */
     getAppArchivedAt(org: string, app: string): Promise<string | undefined>;
     archiveApp(org: string, app: string, at: string): Promise<AppArchiveResult | undefined>;

package/node_modules/@noodle-borg/service/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.92.0",
+    "@noodle-borg/agent-kit": "0.93.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/node_modules/@noodle-borg/wire-contracts/dist/app-purge-reconciliation.d.ts

@@ -0,0 +1,177 @@
+import { z } from 'zod';
+export declare const APP_PURGE_RECONCILIATION_SCHEMA_VERSION: 1;
+export declare const APP_PURGE_RECONCILIATION_MAX_CANDIDATES = 100;
+export declare const APP_PURGE_RECONCILIATION_PREVIEW_TTL_MS: number;
+export declare const AppPurgeReconciliationEnvironmentSchema: z.ZodObject<{
+    name: z.ZodString;
+    isProduction: z.ZodBoolean;
+    createdAt: z.ZodISODateTime;
+}, z.core.$strict>;
+export type AppPurgeReconciliationEnvironmentV1 = z.infer<typeof AppPurgeReconciliationEnvironmentSchema>;
+export declare const AppPurgeReconciliationCandidateSchema: z.ZodObject<{
+    org: z.ZodString;
+    app: z.ZodString;
+    anchorCreatedAt: z.ZodISODateTime;
+    purgeAuditId: z.ZodString;
+    environments: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        isProduction: z.ZodBoolean;
+        createdAt: z.ZodISODateTime;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type AppPurgeReconciliationCandidateV1 = z.infer<typeof AppPurgeReconciliationCandidateSchema>;
+export declare const AppPurgeReconciliationPreviewRequestSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    limit: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type AppPurgeReconciliationPreviewRequestV1 = z.infer<typeof AppPurgeReconciliationPreviewRequestSchema>;
+export declare const AppPurgeReconciliationPreviewArtifactSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    releaseSha: z.ZodString;
+    createdAt: z.ZodISODateTime;
+    expiresAt: z.ZodISODateTime;
+    candidateCount: z.ZodNumber;
+    truncated: z.ZodBoolean;
+    candidates: z.ZodArray<z.ZodObject<{
+        org: z.ZodString;
+        app: z.ZodString;
+        anchorCreatedAt: z.ZodISODateTime;
+        purgeAuditId: z.ZodString;
+        environments: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            isProduction: z.ZodBoolean;
+            createdAt: z.ZodISODateTime;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    checksum: z.ZodString;
+}, z.core.$strict>;
+export type AppPurgeReconciliationPreviewArtifactV1 = z.infer<typeof AppPurgeReconciliationPreviewArtifactSchema>;
+type ReadonlyDeep<Value> = Value extends readonly (infer Item)[] ? readonly ReadonlyDeep<Item>[] : Value extends object ? {
+    readonly [Key in keyof Value]: ReadonlyDeep<Value[Key]>;
+} : Value;
+export type AppPurgeReconciliationUnsignedPreviewArtifactV1 = Omit<ReadonlyDeep<AppPurgeReconciliationPreviewArtifactV1>, 'checksum'>;
+export declare const AppPurgeReconciliationPreviewResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    artifact: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        releaseSha: z.ZodString;
+        createdAt: z.ZodISODateTime;
+        expiresAt: z.ZodISODateTime;
+        candidateCount: z.ZodNumber;
+        truncated: z.ZodBoolean;
+        candidates: z.ZodArray<z.ZodObject<{
+            org: z.ZodString;
+            app: z.ZodString;
+            anchorCreatedAt: z.ZodISODateTime;
+            purgeAuditId: z.ZodString;
+            environments: z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                isProduction: z.ZodBoolean;
+                createdAt: z.ZodISODateTime;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        checksum: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type AppPurgeReconciliationPreviewResponseV1 = z.infer<typeof AppPurgeReconciliationPreviewResponseSchema>;
+export declare const AppPurgeReconciliationApplyRequestSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    preview: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        releaseSha: z.ZodString;
+        createdAt: z.ZodISODateTime;
+        expiresAt: z.ZodISODateTime;
+        candidateCount: z.ZodNumber;
+        truncated: z.ZodBoolean;
+        candidates: z.ZodArray<z.ZodObject<{
+            org: z.ZodString;
+            app: z.ZodString;
+            anchorCreatedAt: z.ZodISODateTime;
+            purgeAuditId: z.ZodString;
+            environments: z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                isProduction: z.ZodBoolean;
+                createdAt: z.ZodISODateTime;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        checksum: z.ZodString;
+    }, z.core.$strict>;
+    releaseSha: z.ZodString;
+    approvalReference: z.ZodString;
+    recoveryCheckpoint: z.ZodString;
+    reason: z.ZodString;
+    idempotencyKey: z.ZodString;
+    confirmed: z.ZodLiteral<true>;
+}, z.core.$strict>;
+export type AppPurgeReconciliationApplyRequestV1 = z.infer<typeof AppPurgeReconciliationApplyRequestSchema>;
+export declare const AppPurgeReconciliationApplyResultSchema: z.ZodObject<{
+    operationId: z.ZodString;
+    previewChecksum: z.ZodString;
+    releaseSha: z.ZodString;
+    candidateCount: z.ZodNumber;
+    deletedCount: z.ZodNumber;
+    appliedAt: z.ZodISODateTime;
+}, z.core.$strict>;
+export type AppPurgeReconciliationApplyResultV1 = z.infer<typeof AppPurgeReconciliationApplyResultSchema>;
+export declare const AppPurgeReconciliationApplyResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    replayed: z.ZodBoolean;
+    result: z.ZodObject<{
+        operationId: z.ZodString;
+        previewChecksum: z.ZodString;
+        releaseSha: z.ZodString;
+        candidateCount: z.ZodNumber;
+        deletedCount: z.ZodNumber;
+        appliedAt: z.ZodISODateTime;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type AppPurgeReconciliationApplyResponseV1 = z.infer<typeof AppPurgeReconciliationApplyResponseSchema>;
+/** Client reader strips additive fields at every response layer while service output stays strict. */
+export declare const AppPurgeReconciliationClientResponseSchema: z.ZodUnion<readonly [z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    artifact: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        releaseSha: z.ZodString;
+        createdAt: z.ZodISODateTime;
+        expiresAt: z.ZodISODateTime;
+        candidateCount: z.ZodNumber;
+        truncated: z.ZodBoolean;
+        candidates: z.ZodArray<z.ZodObject<{
+            org: z.ZodString;
+            app: z.ZodString;
+            anchorCreatedAt: z.ZodISODateTime;
+            purgeAuditId: z.ZodString;
+            environments: z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                isProduction: z.ZodBoolean;
+                createdAt: z.ZodISODateTime;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        checksum: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    replayed: z.ZodBoolean;
+    result: z.ZodObject<{
+        operationId: z.ZodString;
+        previewChecksum: z.ZodString;
+        releaseSha: z.ZodString;
+        candidateCount: z.ZodNumber;
+        deletedCount: z.ZodNumber;
+        appliedAt: z.ZodISODateTime;
+    }, z.core.$strip>;
+}, z.core.$strip>]>;
+export type AppPurgeReconciliationClientResponseV1 = z.infer<typeof AppPurgeReconciliationClientResponseSchema>;
+export declare const AppPurgeReconciliationErrorCodeSchema: z.ZodEnum<{
+    app_purge_preview_expired: "app_purge_preview_expired";
+    app_purge_release_mismatch: "app_purge_release_mismatch";
+    app_purge_preview_mismatch: "app_purge_preview_mismatch";
+    app_purge_candidate_drift: "app_purge_candidate_drift";
+    app_purge_idempotency_conflict: "app_purge_idempotency_conflict";
+    app_purge_reconciliation_unavailable: "app_purge_reconciliation_unavailable";
+}>;
+export type AppPurgeReconciliationErrorCodeV1 = z.infer<typeof AppPurgeReconciliationErrorCodeSchema>;
+/** Exact unsigned bytes hashed for a preview checksum. */
+export declare function appPurgeReconciliationChecksumPayload(unsignedArtifact: AppPurgeReconciliationUnsignedPreviewArtifactV1): string;
+export {};
+//# sourceMappingURL=app-purge-reconciliation.d.ts.map

package/node_modules/@noodle-borg/wire-contracts/dist/app-purge-reconciliation.js

@@ -0,0 +1,189 @@
+import { z } from 'zod';
+const SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const slug = z.string().regex(SLUG_PATTERN);
+const timestamp = z.iso.datetime({ offset: true });
+const releaseSha = z.string().regex(/^[0-9a-f]{40}$/);
+const checksum = z.string().regex(/^sha256:[0-9a-f]{64}$/);
+export const APP_PURGE_RECONCILIATION_SCHEMA_VERSION = 1;
+export const APP_PURGE_RECONCILIATION_MAX_CANDIDATES = 100;
+export const APP_PURGE_RECONCILIATION_PREVIEW_TTL_MS = 15 * 60 * 1000;
+export const AppPurgeReconciliationEnvironmentSchema = z.strictObject({
+    name: slug,
+    isProduction: z.boolean(),
+    createdAt: timestamp,
+});
+export const AppPurgeReconciliationCandidateSchema = z.strictObject({
+    org: slug,
+    app: slug,
+    anchorCreatedAt: timestamp,
+    purgeAuditId: z.string().uuid(),
+    environments: z.array(AppPurgeReconciliationEnvironmentSchema),
+});
+export const AppPurgeReconciliationPreviewRequestSchema = z.strictObject({
+    schemaVersion: z.literal(APP_PURGE_RECONCILIATION_SCHEMA_VERSION),
+    limit: z.number().int().min(1).max(APP_PURGE_RECONCILIATION_MAX_CANDIDATES).optional(),
+});
+function checkArtifactInvariants(artifact, context) {
+    if (Date.parse(artifact.expiresAt) - Date.parse(artifact.createdAt) !==
+        APP_PURGE_RECONCILIATION_PREVIEW_TTL_MS) {
+        context.addIssue({
+            code: 'custom',
+            path: ['expiresAt'],
+            message: 'expiresAt must be exactly 15 minutes after createdAt',
+        });
+    }
+    if (artifact.candidateCount !== artifact.candidates.length) {
+        context.addIssue({
+            code: 'custom',
+            path: ['candidateCount'],
+            message: 'candidateCount must equal candidates.length',
+        });
+    }
+    if (artifact.candidateCount === 0 && artifact.truncated) {
+        context.addIssue({
+            code: 'custom',
+            path: ['truncated'],
+            message: 'a zero-candidate artifact cannot be truncated',
+        });
+    }
+    let previousCandidateKey;
+    for (const [candidateIndex, candidate] of artifact.candidates.entries()) {
+        const candidateKey = `${candidate.org}\u0000${candidate.app}`;
+        if (previousCandidateKey !== undefined && previousCandidateKey >= candidateKey) {
+            context.addIssue({
+                code: 'custom',
+                path: ['candidates', candidateIndex],
+                message: 'candidates must be unique and lexically ordered by org and app',
+            });
+        }
+        previousCandidateKey = candidateKey;
+        let previousEnvironmentName;
+        for (const [environmentIndex, environment] of candidate.environments.entries()) {
+            if (previousEnvironmentName !== undefined && previousEnvironmentName >= environment.name) {
+                context.addIssue({
+                    code: 'custom',
+                    path: ['candidates', candidateIndex, 'environments', environmentIndex],
+                    message: 'environments must be unique and lexically ordered by name',
+                });
+            }
+            previousEnvironmentName = environment.name;
+        }
+    }
+}
+const previewArtifactShape = {
+    schemaVersion: z.literal(APP_PURGE_RECONCILIATION_SCHEMA_VERSION),
+    releaseSha,
+    createdAt: timestamp,
+    expiresAt: timestamp,
+    candidateCount: z.number().int().min(0).max(APP_PURGE_RECONCILIATION_MAX_CANDIDATES),
+    truncated: z.boolean(),
+    candidates: z.array(AppPurgeReconciliationCandidateSchema),
+    checksum,
+};
+export const AppPurgeReconciliationPreviewArtifactSchema = z
+    .strictObject(previewArtifactShape)
+    .superRefine(checkArtifactInvariants);
+export const AppPurgeReconciliationPreviewResponseSchema = z.strictObject({
+    ok: z.literal(true),
+    artifact: AppPurgeReconciliationPreviewArtifactSchema,
+});
+export const AppPurgeReconciliationApplyRequestSchema = z.strictObject({
+    schemaVersion: z.literal(APP_PURGE_RECONCILIATION_SCHEMA_VERSION),
+    preview: AppPurgeReconciliationPreviewArtifactSchema,
+    releaseSha,
+    approvalReference: z.string().trim().min(1).max(256),
+    recoveryCheckpoint: z.string().trim().min(1).max(256),
+    reason: z.string().trim().min(1).max(500),
+    idempotencyKey: z.string().min(8).max(256),
+    confirmed: z.literal(true),
+});
+export const AppPurgeReconciliationApplyResultSchema = z.strictObject({
+    operationId: z.string().uuid(),
+    previewChecksum: checksum,
+    releaseSha,
+    candidateCount: z.number().int().min(0).max(APP_PURGE_RECONCILIATION_MAX_CANDIDATES),
+    deletedCount: z.number().int().min(0).max(APP_PURGE_RECONCILIATION_MAX_CANDIDATES),
+    appliedAt: timestamp,
+});
+export const AppPurgeReconciliationApplyResponseSchema = z.strictObject({
+    ok: z.literal(true),
+    replayed: z.boolean(),
+    result: AppPurgeReconciliationApplyResultSchema,
+});
+const ClientEnvironmentSchema = z.object({
+    name: slug,
+    isProduction: z.boolean(),
+    createdAt: timestamp,
+});
+const ClientCandidateSchema = z.object({
+    org: slug,
+    app: slug,
+    anchorCreatedAt: timestamp,
+    purgeAuditId: z.string().uuid(),
+    environments: z.array(ClientEnvironmentSchema),
+});
+const ClientPreviewArtifactSchema = z
+    .object({
+    schemaVersion: z.literal(APP_PURGE_RECONCILIATION_SCHEMA_VERSION),
+    releaseSha,
+    createdAt: timestamp,
+    expiresAt: timestamp,
+    candidateCount: z.number().int().min(0).max(APP_PURGE_RECONCILIATION_MAX_CANDIDATES),
+    truncated: z.boolean(),
+    candidates: z.array(ClientCandidateSchema),
+    checksum,
+})
+    .superRefine(checkArtifactInvariants);
+const ClientPreviewResponseSchema = z.object({
+    ok: z.literal(true),
+    artifact: ClientPreviewArtifactSchema,
+});
+const ClientApplyResultSchema = z.object({
+    operationId: z.string().uuid(),
+    previewChecksum: checksum,
+    releaseSha,
+    candidateCount: z.number().int().min(0).max(APP_PURGE_RECONCILIATION_MAX_CANDIDATES),
+    deletedCount: z.number().int().min(0).max(APP_PURGE_RECONCILIATION_MAX_CANDIDATES),
+    appliedAt: timestamp,
+});
+const ClientApplyResponseSchema = z.object({
+    ok: z.literal(true),
+    replayed: z.boolean(),
+    result: ClientApplyResultSchema,
+});
+/** Client reader strips additive fields at every response layer while service output stays strict. */
+export const AppPurgeReconciliationClientResponseSchema = z.union([
+    ClientPreviewResponseSchema,
+    ClientApplyResponseSchema,
+]);
+export const AppPurgeReconciliationErrorCodeSchema = z.enum([
+    'app_purge_preview_expired',
+    'app_purge_release_mismatch',
+    'app_purge_preview_mismatch',
+    'app_purge_candidate_drift',
+    'app_purge_idempotency_conflict',
+    'app_purge_reconciliation_unavailable',
+]);
+/** Exact unsigned bytes hashed for a preview checksum. */
+export function appPurgeReconciliationChecksumPayload(unsignedArtifact) {
+    return JSON.stringify({
+        schemaVersion: unsignedArtifact.schemaVersion,
+        releaseSha: unsignedArtifact.releaseSha,
+        createdAt: unsignedArtifact.createdAt,
+        expiresAt: unsignedArtifact.expiresAt,
+        candidateCount: unsignedArtifact.candidateCount,
+        truncated: unsignedArtifact.truncated,
+        candidates: unsignedArtifact.candidates.map((candidate) => ({
+            org: candidate.org,
+            app: candidate.app,
+            anchorCreatedAt: candidate.anchorCreatedAt,
+            purgeAuditId: candidate.purgeAuditId,
+            environments: candidate.environments.map((environment) => ({
+                name: environment.name,
+                isProduction: environment.isProduction,
+                createdAt: environment.createdAt,
+            })),
+        })),
+    });
+}
+//# sourceMappingURL=app-purge-reconciliation.js.map

package/node_modules/@noodle-borg/wire-contracts/dist/assistant.d.ts

@@ -204,11 +204,11 @@ export declare const assistantWireEventSchema: z.ZodUnion<readonly [z.ZodObject<
 }, z.core.$strip>, z.ZodObject<{
     event: z.ZodLiteral<string>;
     data: z.ZodObject<{
+        result: z.ZodJSONSchema;
         tool: z.ZodString;
         id: z.ZodString;
         resourceUri: z.ZodString;
         title: z.ZodOptional<z.ZodString>;
-        result: z.ZodJSONSchema;
         arguments: z.ZodOptional<z.ZodJSONSchema>;
         resourceMeta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         allowedOpenDomains: z.ZodOptional<z.ZodArray<z.ZodURL>>;