@noodleseed/one 0.153.0 → 0.155.0

package/node_modules/@noodle-borg/compiler/dist/manifest/schema.d.ts

@@ -1,5 +1,4 @@
 import { z } from 'zod';
-import type { PackagedAssetReference } from '../assets.js';
 type ToolAuthorizationManifest = {
     readonly requiredScopes?: readonly string[] | undefined;
     readonly allowedRoles?: readonly string[] | undefined;
@@ -381,6 +380,11 @@ export declare const manifestV1Schema: z.ZodObject<{
                 webmcp: z.ZodOptional<z.ZodObject<{
                     enabled: z.ZodOptional<z.ZodBoolean>;
                 }, z.core.$strict>>;
+                continuity: z.ZodOptional<z.ZodObject<{
+                    enabled: z.ZodOptional<z.ZodBoolean>;
+                    windowSeconds: z.ZodOptional<z.ZodNumber>;
+                    maxRestores: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>>;
             }, z.core.$strict>>>;
             sessionClaims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 exposeToModel: z.ZodOptional<z.ZodBoolean>;
@@ -395,18 +399,18 @@ export declare const manifestV1Schema: z.ZodObject<{
             surface: z.ZodOptional<z.ZodString>;
             surfaceDark: z.ZodOptional<z.ZodString>;
             logo: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             mark: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             avatar: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             theme: z.ZodOptional<z.ZodObject<{
@@ -864,6 +868,11 @@ export declare const manifestV2Schema: z.ZodObject<{
                 webmcp: z.ZodOptional<z.ZodObject<{
                     enabled: z.ZodOptional<z.ZodBoolean>;
                 }, z.core.$strict>>;
+                continuity: z.ZodOptional<z.ZodObject<{
+                    enabled: z.ZodOptional<z.ZodBoolean>;
+                    windowSeconds: z.ZodOptional<z.ZodNumber>;
+                    maxRestores: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>>;
             }, z.core.$strict>>>;
             sessionClaims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 exposeToModel: z.ZodOptional<z.ZodBoolean>;
@@ -878,18 +887,18 @@ export declare const manifestV2Schema: z.ZodObject<{
             surface: z.ZodOptional<z.ZodString>;
             surfaceDark: z.ZodOptional<z.ZodString>;
             logo: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             mark: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             avatar: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             theme: z.ZodOptional<z.ZodObject<{
@@ -1557,6 +1566,11 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 webmcp: z.ZodOptional<z.ZodObject<{
                     enabled: z.ZodOptional<z.ZodBoolean>;
                 }, z.core.$strict>>;
+                continuity: z.ZodOptional<z.ZodObject<{
+                    enabled: z.ZodOptional<z.ZodBoolean>;
+                    windowSeconds: z.ZodOptional<z.ZodNumber>;
+                    maxRestores: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>>;
             }, z.core.$strict>>>;
             sessionClaims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 exposeToModel: z.ZodOptional<z.ZodBoolean>;
@@ -1571,18 +1585,18 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             surface: z.ZodOptional<z.ZodString>;
             surfaceDark: z.ZodOptional<z.ZodString>;
             logo: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             mark: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             avatar: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             theme: z.ZodOptional<z.ZodObject<{
@@ -2039,6 +2053,11 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 webmcp: z.ZodOptional<z.ZodObject<{
                     enabled: z.ZodOptional<z.ZodBoolean>;
                 }, z.core.$strict>>;
+                continuity: z.ZodOptional<z.ZodObject<{
+                    enabled: z.ZodOptional<z.ZodBoolean>;
+                    windowSeconds: z.ZodOptional<z.ZodNumber>;
+                    maxRestores: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>>;
             }, z.core.$strict>>>;
             sessionClaims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 exposeToModel: z.ZodOptional<z.ZodBoolean>;
@@ -2053,18 +2072,18 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             surface: z.ZodOptional<z.ZodString>;
             surfaceDark: z.ZodOptional<z.ZodString>;
             logo: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             mark: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             avatar: z.ZodOptional<z.ZodObject<{
-                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>;
-                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<PackagedAssetReference, unknown, z.core.$ZodTypeInternals<PackagedAssetReference, unknown>>]>>;
+                uri: z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>;
+                darkUri: z.ZodOptional<z.ZodUnion<readonly [z.ZodURL, z.ZodType<import("../assets.js").PackagedAssetReference, unknown, z.core.$ZodTypeInternals<import("../assets.js").PackagedAssetReference, unknown>>]>>;
                 alt: z.ZodString;
             }, z.core.$strict>>;
             theme: z.ZodOptional<z.ZodObject<{

package/node_modules/@noodle-borg/compiler/dist/manifest/schema.js

@@ -3,6 +3,7 @@ import { z } from 'zod';
 import { MAX_COMPILED_WIDGET_HTML_BYTES, MAX_RAW_WIDGET_HTML_BYTES } from '../widget-limits.js';
 import { agentGuideSchema } from './agent-guide-schema.js';
 import { serverAuthSchema, serverAuthV2Schema } from './auth-schema.js';
+import { assistantOriginOrVariableSchema, httpsUrlSchema, managedVariableExpressionSchema, serverBrandingSchema, } from './branding-schema.js';
 import { NAME_PATTERN } from './naming.js';
 /**
  * Zod schema for Core v1 and v2 manifests (ADRs 0150 and 0157). V1 remains accepted unchanged;
@@ -133,82 +134,6 @@ const promptSchema = z.object({
     arguments: z.array(promptArgumentSchema).optional(),
     fulfilment: fulfilmentSchema,
 });
-const hexColorSchema = z.string().regex(/^#[0-9A-Fa-f]{6}$/, 'must be a 6-digit hex color');
-const httpsUrlSchema = z.url().regex(/^https:\/\//, 'must use https');
-const managedVariableExpressionPattern = /^\$\{env\.[A-Za-z0-9_]+\}$/;
-const managedVariableExpressionSchema = z
-    .string()
-    .regex(managedVariableExpressionPattern, 'must be an exact managed variable expression');
-// HTTP is allowed only for loopback development origins (mirrors the host-pattern loopback
-// exception used for connector/CSP origins); production embedding origins stay https-only.
-const assistantOriginOrVariablePattern = /^(?:\$\{env\.[A-Za-z0-9_]+\}|https:\/\/[^/?#@\\]+|http:\/\/(?:localhost|127\.0\.0\.1|\[::1\])(?::\d+)?)$/;
-function isCanonicalAssistantOrigin(value) {
-    try {
-        return new URL(value).origin === value;
-    }
-    catch {
-        return false;
-    }
-}
-const assistantOriginOrVariableSchema = z
-    .string()
-    .regex(assistantOriginOrVariablePattern, 'must be a canonical bare origin using https (http is allowed only for localhost/127.0.0.1/[::1] loopback development origins)')
-    .refine((value) => managedVariableExpressionPattern.test(value) || isCanonicalAssistantOrigin(value), 'must be a canonical bare origin');
-const packagedAssetSchema = z
-    .object({
-    kind: z.literal('asset'),
-    sourcePath: z.string().min(1),
-    logicalId: z.string().min(1),
-})
-    .strict();
-const brandAssetSchema = z
-    .object({
-    uri: z.union([httpsUrlSchema, packagedAssetSchema]),
-    darkUri: z.union([httpsUrlSchema, packagedAssetSchema]).optional(),
-    alt: z.string().trim().min(1),
-})
-    .strict();
-const brandThemeTokensSchema = z
-    .object({
-    surface: hexColorSchema.optional(),
-    surfaceRaised: hexColorSchema.optional(),
-    surfaceMuted: hexColorSchema.optional(),
-    text: hexColorSchema.optional(),
-    textMuted: hexColorSchema.optional(),
-    accent: hexColorSchema.optional(),
-    accentText: hexColorSchema.optional(),
-    link: hexColorSchema.optional(),
-    border: hexColorSchema.optional(),
-    borderStrong: hexColorSchema.optional(),
-    focus: hexColorSchema.optional(),
-    success: hexColorSchema.optional(),
-    warning: hexColorSchema.optional(),
-    danger: hexColorSchema.optional(),
-    code: hexColorSchema.optional(),
-})
-    .strict();
-const serverBrandingSchema = z
-    .object({
-    name: z.string().trim().min(1).optional(),
-    accent: hexColorSchema.optional(),
-    surface: hexColorSchema.optional(),
-    surfaceDark: hexColorSchema.optional(),
-    logo: brandAssetSchema.optional(),
-    mark: brandAssetSchema.optional(),
-    avatar: brandAssetSchema.optional(),
-    theme: z
-        .object({
-        light: brandThemeTokensSchema.optional(),
-        dark: brandThemeTokensSchema.optional(),
-    })
-        .strict()
-        .optional(),
-    radius: z.enum(['none', 'sm', 'md', 'lg']).optional(),
-    density: z.enum(['compact', 'comfortable']).optional(),
-    typography: z.enum(['system', 'serif', 'mono']).optional(),
-    colorScheme: z.enum(['auto', 'light', 'dark']).optional(),
-})
-    .strict();
 const assistantPresentationToneSchema = z.enum(['neutral', 'success', 'warning', 'danger']);
 const optionalStrictObject = (shape) => z.object(shape).strict().optional();
 const assistantPresentationSchema = z
@@ -357,6 +282,18 @@ const embeddedAssistantSchema = z
         // `assistantUiSchema.shape` — this is not renderer presentation, and a surface that
         // acquired it by a spread would be an accident rather than a decision.
         webmcp: optionalStrictObject({ enabled: z.boolean().optional() }),
+        // Anonymous cross-page display continuity (ADR 0223, clauses 11-16), declared per public
+        // or mixed surface. These bounds mirror the structural ceilings the gateway clamps to at
+        // runtime; the ADR is the single source, and this package cannot import the gateway
+        // because the dependency runs the other way. Refusing rather than clamping is deliberate:
+        // the gateway narrows an operator's value silently by design, but a developer who asks
+        // for more than the ceiling has made a mistake, and silence would hide it until someone
+        // measured the live behaviour.
+        continuity: optionalStrictObject({
+            enabled: z.boolean().optional(),
+            windowSeconds: z.number().int().min(0).max(600).optional(),
+            maxRestores: z.number().int().min(0).max(10).optional(),
+        }),
     })
         .strict())
         .min(1)
@@ -374,6 +311,17 @@ const embeddedAssistantSchema = z
     .strict()
     .superRefine((assistant, ctx) => {
     assistant.surfaces?.forEach((surface, index) => {
+        // The authenticated direction already reattaches through ADR 0223 clause 7, authorized by a
+        // backend-verified subject rather than by possession of a handle. A `continuity` block here
+        // would be a developer believing they configured something nothing reads, so refuse it rather
+        // than drop it silently.
+        if (surface.mode === 'authenticated' && surface.continuity !== undefined) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['surfaces', index, 'continuity'],
+                message: 'continuity belongs on a public or mixed website surface',
+            });
+        }
         if (surface.mode === 'authenticated')
             return;
         // A public surface fails closed: an omitted allowlist would otherwise read as "expose

package/node_modules/@noodle-borg/control-plane/dist/app-purge-reconciliation-port.d.ts

@@ -0,0 +1,25 @@
+import type { AppPurgeReconciliationApplyRequestV1, AppPurgeReconciliationApplyResponseV1, AppPurgeReconciliationErrorCodeV1, AppPurgeReconciliationPreviewArtifactV1 } from '@noodle-borg/wire-contracts';
+export interface AppPurgeReconciliationActor {
+    readonly subject: string;
+    readonly email?: string;
+}
+export interface AppPurgeReconciliationOperator {
+    preview(input: {
+        readonly releaseSha: string;
+        readonly limit: number;
+        readonly now: Date;
+    }): Promise<AppPurgeReconciliationPreviewArtifactV1>;
+    apply(input: {
+        readonly request: AppPurgeReconciliationApplyRequestV1;
+        readonly actor: AppPurgeReconciliationActor;
+        readonly currentReleaseSha: string;
+        readonly now: Date;
+    }): Promise<AppPurgeReconciliationApplyResponseV1>;
+}
+export type AppPurgeReconciliationConflictCode = Exclude<AppPurgeReconciliationErrorCodeV1, 'app_purge_reconciliation_unavailable'>;
+/** A checked operator conflict; query and transaction failures intentionally remain ordinary errors. */
+export declare class AppPurgeReconciliationError extends Error {
+    readonly code: AppPurgeReconciliationConflictCode;
+    constructor(code: AppPurgeReconciliationConflictCode, message: string);
+}
+//# sourceMappingURL=app-purge-reconciliation-port.d.ts.map

package/node_modules/@noodle-borg/control-plane/dist/app-purge-reconciliation-port.js

@@ -0,0 +1,10 @@
+/** A checked operator conflict; query and transaction failures intentionally remain ordinary errors. */
+export class AppPurgeReconciliationError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'AppPurgeReconciliationError';
+        this.code = code;
+    }
+}
+//# sourceMappingURL=app-purge-reconciliation-port.js.map

package/node_modules/@noodle-borg/control-plane/dist/portable.d.ts

@@ -1,3 +1,4 @@
+export { type AppPurgeReconciliationActor, type AppPurgeReconciliationConflictCode, AppPurgeReconciliationError, type AppPurgeReconciliationOperator, } from './app-purge-reconciliation-port.js';
 export type { ActiveMcpSubdomainClaim, ChangeMcpSubdomainInput, ControlPlaneIdentity, CreateOrgWithOwnerInput, McpSubdomainMutationResult, McpSubdomainSetting, OrganizationStore, OrgDomainRecord, OrgInvitationRecord, OrgMemberRecord, OrgOpenAIAppsChallengeRecord, OrgRecord, OrgRole, PersonalWorkspaceProvisionInput, PersonalWorkspaceProvisionResult, SignupAllowlistKind, SignupAllowlistRecord, WelcomeEmailRecord, } from './contracts.js';
 export { allowAllGate, bearerToken, type ControlPlaneAuthResult, type DeployAuthGate, } from './deploy-auth.js';
 export { CompositeControlPlaneGate, type ControlPlaneSignupMode, GoogleControlPlaneGate, type GoogleControlPlaneGateOptions, type GoogleIdTokenVerifier, GoogleWorkloadControlPlaneGate, type GoogleWorkloadControlPlaneGateOptions, NoodleOAuthControlPlaneGate, type NoodleOAuthControlPlaneGateOptions, type SignupAuthorizer, } from './deploy-gates.js';

package/node_modules/@noodle-borg/control-plane/dist/portable.js

@@ -1,3 +1,4 @@
+export { AppPurgeReconciliationError, } from './app-purge-reconciliation-port.js';
 export { allowAllGate, bearerToken, } from './deploy-auth.js';
 export { CompositeControlPlaneGate, GoogleControlPlaneGate, GoogleWorkloadControlPlaneGate, NoodleOAuthControlPlaneGate, } from './deploy-gates.js';
 export { InMemoryControlPlaneStore } from './in-memory-control-plane-store.js';

package/node_modules/@noodle-borg/control-plane/package.json

@@ -26,7 +26,9 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@noodle-borg/module": "0.0.0"
+    "@noodle-borg/module": "0.0.0",
+    "@noodle-borg/module-audit": "0.0.0",
+    "@noodle-borg/wire-contracts": "0.0.0"
   },
   "devDependencies": {
     "@types/node": "^24.13.1",

package/node_modules/@noodle-borg/service/dist/routes/app-purge-reconciliation.js

@@ -0,0 +1,72 @@
+import { AppPurgeReconciliationError, } from '@noodle-borg/control-plane/portable';
+import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
+import { APP_PURGE_RECONCILIATION_MAX_CANDIDATES, AppPurgeReconciliationApplyRequestSchema, AppPurgeReconciliationApplyResponseSchema, AppPurgeReconciliationPreviewRequestSchema, AppPurgeReconciliationPreviewResponseSchema, } from '@noodle-borg/wire-contracts';
+import { sendForbidden } from '../http-util.js';
+import { authorizeControlPlane } from './control-plane.js';
+const UNAVAILABLE = {
+    ok: false,
+    code: 'app_purge_reconciliation_unavailable',
+    error: 'app purge reconciliation is unavailable',
+};
+/** Super-admin-only, exact-set historical repair boundary from ADR 0225. */
+export async function handleAppPurgeReconciliationRoute(req, res, deps, action) {
+    const identity = await authorizeControlPlane(req, res, deps.gate, { requireIdentity: true });
+    if (identity === false)
+        return;
+    if (!identity.superAdmin)
+        return sendForbidden(res, 'super-admin required');
+    const url = new URL(req.url ?? '/', 'http://localhost');
+    if (url.search !== '') {
+        return sendJson(res, 400, { ok: false, error: 'query parameters are not supported' });
+    }
+    const contentType = req.headers['content-type']?.split(';', 1)[0]?.trim().toLowerCase();
+    if (contentType !== 'application/json') {
+        return sendJson(res, 415, { ok: false, error: 'content type must be application/json' });
+    }
+    const body = await readJsonBody(req, deps.maxBody);
+    if (!body.ok)
+        return sendJson(res, body.status, { ok: false, error: body.error });
+    const parsed = action === 'preview'
+        ? AppPurgeReconciliationPreviewRequestSchema.safeParse(body.value)
+        : AppPurgeReconciliationApplyRequestSchema.safeParse(body.value);
+    if (!parsed.success) {
+        return sendJson(res, 400, { ok: false, error: 'invalid app purge reconciliation request' });
+    }
+    if (deps.operator === undefined || !/^[0-9a-f]{40}$/.test(deps.releaseSha)) {
+        return sendJson(res, 503, UNAVAILABLE);
+    }
+    try {
+        const now = deps.clock?.() ?? new Date();
+        if (action === 'preview') {
+            const request = AppPurgeReconciliationPreviewRequestSchema.parse(parsed.data);
+            const artifact = await deps.operator.preview({
+                releaseSha: deps.releaseSha,
+                limit: request.limit ?? APP_PURGE_RECONCILIATION_MAX_CANDIDATES,
+                now,
+            });
+            return sendJson(res, 200, AppPurgeReconciliationPreviewResponseSchema.parse({ ok: true, artifact }));
+        }
+        const request = AppPurgeReconciliationApplyRequestSchema.parse(parsed.data);
+        const response = await deps.operator.apply({
+            request,
+            actor: {
+                subject: identity.subject,
+                ...(identity.email === undefined ? {} : { email: identity.email }),
+            },
+            currentReleaseSha: deps.releaseSha,
+            now,
+        });
+        return sendJson(res, 200, AppPurgeReconciliationApplyResponseSchema.parse(response));
+    }
+    catch (error) {
+        if (error instanceof AppPurgeReconciliationError) {
+            return sendJson(res, 409, {
+                ok: false,
+                code: error.code,
+                error: 'app purge reconciliation request conflicts with current state',
+            });
+        }
+        return sendJson(res, 503, UNAVAILABLE);
+    }
+}
+//# sourceMappingURL=app-purge-reconciliation.js.map

package/node_modules/@noodle-borg/service/dist/routes/control-plane.js

@@ -3,7 +3,7 @@ import { ensurePersonalWorkspace } from '@noodle-borg/control-plane/portable';
 import { DEVELOPER_ASSISTANT_PATH, DEVELOPER_CLI_PATH, } from '@noodle-borg/developer-mcp';
 import { normalizeServerVersion } from '@noodle-borg/module';
 import { noopLogger, readDeployBody, sendJson } from '@noodle-borg/transport-http';
-import { deployRequestSchema, formatWireError, } from '@noodle-borg/wire-contracts';
+import { deployRequestSchema, formatWireError, WhoamiIdentityResponseSchema, } from '@noodle-borg/wire-contracts';
 import { authorizeDeveloperGrant, } from '../auth/developer-grant-guard.js';
 import { baseFromRequest, sendForbidden, sendUnauthorized } from '../http-util.js';
 import { endpointUrlOptionsForOrg } from '../mcp-public-routing.js';
@@ -443,7 +443,7 @@ export async function authorizeDeploymentOwnerSelection(res, controlPlane, org,
     }
     return { ok: true, ownerSubject: requestedOwnerSubject };
 }
-export async function handleWhoami(req, res, gate, controlPlane, options = {}) {
+export async function handleWhoami(req, res, gate, controlPlane, options = {}, scope) {
     // Identity introspection names no org or environment, so no grant context can describe it.
     const identity = await authorizeControlPlane(req, res, gate, {
         requireIdentity: true,
@@ -451,6 +451,19 @@ export async function handleWhoami(req, res, gate, controlPlane, options = {}) {
     });
     if (identity === false)
         return;
+    if (scope === 'identity') {
+        const response = WhoamiIdentityResponseSchema.parse({
+            ok: true,
+            data: {
+                identity: {
+                    subject: identity.subject,
+                    email: identity.email,
+                    superAdmin: identity.superAdmin,
+                },
+            },
+        });
+        return sendJson(res, 200, response);
+    }
     if (!identity.superAdmin && options.controlPlaneSignupMode === 'public') {
         await ensurePersonalWorkspace(controlPlane, identity);
     }

package/node_modules/@noodle-borg/service/dist/service.js

@@ -23,6 +23,7 @@ import { isAuthServerPath } from './oauth/paths.js';
 import { createIntentTargetResolver, createObservabilityDispatcher, createObservabilityStores, } from './observability-runtime.js';
 import { handleAccessUpdate } from './routes/access.js';
 import { dispatchAlertRoutes } from './routes/alerts-dispatch.js';
+import { handleAppPurgeReconciliationRoute, } from './routes/app-purge-reconciliation.js';
 import { handleAppArchive, handleAppRestore } from './routes/archive.js';
 import { handleAssetPreflight } from './routes/asset-control-plane.js';
 import { dispatchAssistantRoutes } from './routes/assistant-dispatch.js';
@@ -233,6 +234,26 @@ export function createServiceHandler(registry, options = {}) {
                 ...(advanced ? { modules: capabilityReport.modules } : {}),
             });
         }
+        const appPurgeReconciliationAction = url.pathname === '/v1/service/app-purge-reconciliation/preview'
+            ? 'preview'
+            : url.pathname === '/v1/service/app-purge-reconciliation/apply'
+                ? 'apply'
+                : undefined;
+        if (req.method === 'POST' && appPurgeReconciliationAction !== undefined) {
+            applySecurityHeaders(res, tls);
+            if (enforceHttps(req, res, tls))
+                return;
+            void handleAppPurgeReconciliationRoute(req, res, {
+                gate,
+                ...(options.appPurgeReconciliationOperator === undefined
+                    ? {}
+                    : { operator: options.appPurgeReconciliationOperator }),
+                releaseSha: buildInfo.gitSha,
+                maxBody,
+                ...(options.clock === undefined ? {} : { clock: options.clock }),
+            }, appPurgeReconciliationAction);
+            return;
+        }
         if (servicePrincipalDispatcher?.(req, res, url))
             return;
         if (dispatchAssistantRoutes(req, res, url, {
@@ -316,7 +337,12 @@ export function createServiceHandler(registry, options = {}) {
             applySecurityHeaders(res, tls);
             if (enforceHttps(req, res, tls))
                 return;
-            handleWhoami(req, res, gate, controlPlane, options).catch(() => {
+            const scopes = url.searchParams.getAll('scope');
+            if (scopes.length > 1 || (scopes.length === 1 && scopes[0] !== 'identity')) {
+                sendJson(res, 400, { error: 'invalid whoami scope' });
+                return;
+            }
+            handleWhoami(req, res, gate, controlPlane, options, scopes[0] === 'identity' ? 'identity' : undefined).catch(() => {
                 if (!res.headersSent)
                     sendJson(res, 500, { error: 'internal error' });
             });

package/node_modules/@noodle-borg/service/dist/store/in-memory.js

@@ -3,7 +3,7 @@ import { assertSameAppPackageSnapshot, sanitizeDeployRecordAppPackageSnapshot, }
 import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, } from '../customer-auth-audience-binding.js';
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from '../deployment-lock.js';
 import { defaultActiveRecord, sameDeploymentScope, sameTenantRecord, } from '../deployment-versioning.js';
-import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
+import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, planArchivedAppSweep, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
 import { validateSlug, validateTenantRef } from './validate.js';
 /** In-memory store: keeps records in a Map. Used by tests and as an explicit, non-persistent option. */
 export class InMemoryArtifactStore {
@@ -165,13 +165,9 @@ export class InMemoryArtifactStore {
         return Promise.resolve(plan.result);
     }
     sweepArchived(before) {
-        const deleted = [];
-        for (const [id, record] of this.#records) {
-            if (record.archivedAt !== undefined && record.archivedAt < before) {
-                deleted.push(record);
-                this.#records.delete(id);
-            }
-        }
+        const deleted = planArchivedAppSweep([...this.#records.values()], before);
+        for (const record of deleted)
+            this.#records.delete(record.deploymentId);
         return Promise.resolve(deleted);
     }
     async listApps(org, opts = {}) {

package/node_modules/@noodle-borg/service/dist/store/json-file.js

@@ -6,7 +6,7 @@ import { assertSameAppPackageSnapshot, sanitizeDeployRecordAppPackageSnapshot, }
 import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, } from '../customer-auth-audience-binding.js';
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from '../deployment-lock.js';
 import { defaultActiveRecord, sameDeploymentScope, sameTenantRecord, } from '../deployment-versioning.js';
-import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
+import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, planArchivedAppSweep, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
 import { DEPLOYMENT_ID_PATTERN, validateSlug, validateTenantRef } from './validate.js';
 /**
  * JSON-file store: one file per deployment at `<dataDir>/deployments/<deploymentId>.json`, written atomically
@@ -228,8 +228,11 @@ export class JsonFileArtifactStore {
         await Promise.all(plan.clear.map((record) => this.#writeRecord(withoutArchiveStamp(record))));
         return plan.result;
     }
-    async sweepArchived(before) {
-        const deleted = (await this.loadAll()).filter((record) => record.archivedAt !== undefined && record.archivedAt < before);
+    sweepArchived(before) {
+        return this.#serializeLifecycle(() => this.#sweepArchivedUnlocked(before));
+    }
+    async #sweepArchivedUnlocked(before) {
+        const deleted = planArchivedAppSweep(await this.loadAll(), before);
         await Promise.all(deleted.map((record) => rm(join(this.#dir, `${record.deploymentId}.json`), { force: true })));
         return deleted;
     }

package/node_modules/@noodle-borg/service/dist/store/records.js

@@ -101,6 +101,26 @@ export function planAppRestore(records) {
     const clear = records.filter((record) => record.archivedAt !== undefined);
     return { result: { restoredDeployments: clear.length }, clear };
 }
+/** Plan a retention sweep: only delete an app when every deployment is archived before the cutoff. */
+export function planArchivedAppSweep(records, before) {
+    const apps = new Map();
+    for (const record of records) {
+        let byApp = apps.get(record.orgSlug);
+        if (byApp === undefined) {
+            byApp = new Map();
+            apps.set(record.orgSlug, byApp);
+        }
+        const bucket = byApp.get(record.appSlug);
+        if (bucket === undefined)
+            byApp.set(record.appSlug, [record]);
+        else
+            bucket.push(record);
+    }
+    return [...apps.values()].flatMap((byApp) => [...byApp.values()].flatMap((appRecords) => appRecords.length > 0 &&
+        appRecords.every((record) => record.archivedAt !== undefined && record.archivedAt < before)
+        ? appRecords
+        : []));
+}
 /** Strip the archive stamp from a record (exact-optional safe). */
 export function withoutArchiveStamp(record) {
     const { archivedAt: _cleared, ...rest } = record;

package/node_modules/@noodle-borg/service/dist/store.d.ts

@@ -318,8 +318,9 @@ export interface ArtifactStore {
      * App soft delete (ADR 0117). `getAppArchivedAt` reports the app's archived stamp (defined iff the
      * app has records and every record is stamped). `archiveApp` stamps every record for the app (all
      * environments/versions); `restoreApp` clears the stamps; both resolve `undefined` for an app with
-     * no records. `sweepArchived` hard-deletes records archived strictly before `before` and returns
-     * them so the caller can reclaim associated config and emit audit events.
+     * no records. `sweepArchived` hard-deletes a complete app only when every one of its records is archived
+     * strictly before `before`, returning every record from each deleted app so the caller can reclaim
+     * associated config and emit audit events.
      */
     getAppArchivedAt(org: string, app: string): Promise<string | undefined>;
     archiveApp(org: string, app: string, at: string): Promise<AppArchiveResult | undefined>;

package/node_modules/@noodle-borg/service/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.92.0",
+    "@noodle-borg/agent-kit": "0.93.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",