@noodleseed/one 0.155.0 → 0.156.0

package/node_modules/@noodle-borg/service/dist/routes/deploy-preflight.js

@@ -1,14 +1,24 @@
+import { randomUUID } from 'node:crypto';
 import { cspFaultsInManifest } from '@noodle-borg/compiler';
 import { readDeployBody, sendJson } from '@noodle-borg/transport-http';
-import { deployPreflightRequestSchema, formatWireError } from '@noodle-borg/wire-contracts';
+import { DEPLOY_PREFLIGHT_CHECK_TIMEOUT_MS, deployPreflightRequestSchema, formatWireError, } from '@noodle-borg/wire-contracts';
 import { manifestUsesUserRoot } from '../registry-access.js';
 import { isIdentityAccessMode } from './access-mode.js';
 import { authorizeDeploymentOwnerSelection, authorizeTenantControl, developerGrantRouteAccess, } from './control-plane.js';
+// Per-process resource admission, not a tenant quota or distributed state authority.
+const activePreflights = new WeakSet();
 /**
  * Read-only first-deploy readiness. It intentionally does not verify uploaded asset bytes:
  * the CLI calls this before it requests upload targets or sends any bytes.
  */
 export async function handleDeployPreflight(req, res, registry, options, maxBody, tenant, gate, controlPlane, audit) {
+    const startedAt = Date.now();
+    const suppliedId = req.headers['x-request-id'];
+    const requestId = typeof suppliedId === 'string' &&
+        /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i.test(suppliedId)
+        ? suppliedId
+        : randomUUID();
+    res.setHeader('x-request-id', requestId);
     const identity = await authorizeTenantControl(req, res, gate, controlPlane, tenant.org, developerGrantRouteAccess(options.developerGrantStore, 'deployments:write'));
     if (identity === false)
         return;
@@ -25,111 +35,198 @@ export async function handleDeployPreflight(req, res, registry, options, maxBody
             error: 'app is archived; restore it before deploying',
         });
     }
-    const body = await readDeployBody(req, maxBody);
-    if (!body.ok)
-        return sendJson(res, body.status, { error: body.error });
-    let parsed;
-    try {
-        const raw = JSON.parse(body.text);
-        const result = deployPreflightRequestSchema.safeParse(raw);
-        if (!result.success)
-            throw new Error(formatWireError(result.error));
-        parsed = result.data;
-    }
-    catch (error) {
-        return sendJson(res, 400, {
-            code: 'invalid_deploy_request',
-            error: `invalid deploy preflight request: ${error.message}`,
+    if (activePreflights.has(registry)) {
+        await audit.emit({
+            eventType: 'deploy.preflight.rejected',
+            ...tenant,
+            actorSubject: identity.subject,
+            decision: 'deny',
+            status: 503,
+            reasonCode: 'deploy_preflight_busy',
+            details: { requestId, phase: 'admission', elapsedMs: Date.now() - startedAt },
         });
-    }
-    const accessMode = parsed.accessMode ?? 'owner-only';
-    if (isIdentityAccessMode(accessMode) && identity === undefined) {
-        return sendJson(res, 401, {
-            code: 'deployer_identity_required',
-            error: `${accessMode} deployments require an authenticated deployer`,
+        res.setHeader('retry-after', '5');
+        return sendJson(res, 503, {
+            code: 'deploy_preflight_busy',
+            phase: 'admission',
+            error: 'This instance is already checking a deployment. Retry once after the indicated delay.',
         });
     }
-    const ownerSelection = await authorizeDeploymentOwnerSelection(res, controlPlane, tenant.org, accessMode, identity, parsed.ownerSubject);
-    if (!ownerSelection.ok)
-        return;
-    if (accessMode === 'public' && manifestUsesUserRoot(parsed.manifest)) {
-        return sendJson(res, 400, {
-            code: 'public_user_context_conflict',
-            error: 'public access mode cannot reference ${user}; use mixed for optional identity',
+    activePreflights.add(registry);
+    let clientDisconnected = false;
+    let deadlineExceeded = false;
+    let phase = 'body';
+    let timer;
+    const onClose = () => {
+        if (!res.writableFinished)
+            clientDisconnected = true;
+    };
+    res.once('close', onClose);
+    try {
+        await audit.emit({
+            eventType: 'deploy.preflight.started',
+            ...tenant,
+            actorSubject: identity.subject,
+            decision: 'allow',
+            details: { requestId, phase, elapsedMs: Date.now() - startedAt },
         });
-    }
-    const [cspFault] = cspFaultsInManifest(parsed.manifest);
-    if (cspFault !== undefined) {
-        return sendJson(res, 400, {
-            code: 'invalid_widget_csp',
-            error: `widget "${cspFault.widget}" CSP ${cspFault.list} origin "${cspFault.value}" is not an ` +
-                `absolute https:// origin and would be dropped by the host renderer` +
-                (cspFault.suggestion !== undefined ? `; use "${cspFault.suggestion}"` : ''),
+        const body = await readDeployBody(req, maxBody);
+        if (req.aborted || res.destroyed)
+            return;
+        if (!body.ok)
+            return sendJson(res, body.status, { error: body.error });
+        phase = 'validation';
+        let parsed;
+        try {
+            const raw = JSON.parse(body.text);
+            const result = deployPreflightRequestSchema.safeParse(raw);
+            if (!result.success)
+                throw new Error(formatWireError(result.error));
+            parsed = result.data;
+        }
+        catch (error) {
+            return sendJson(res, 400, {
+                code: 'invalid_deploy_request',
+                error: `invalid deploy preflight request: ${error.message}`,
+            });
+        }
+        const accessMode = parsed.accessMode ?? 'owner-only';
+        if (isIdentityAccessMode(accessMode) && identity === undefined) {
+            return sendJson(res, 401, {
+                code: 'deployer_identity_required',
+                error: `${accessMode} deployments require an authenticated deployer`,
+            });
+        }
+        const ownerSelection = await authorizeDeploymentOwnerSelection(res, controlPlane, tenant.org, accessMode, identity, parsed.ownerSubject);
+        if (!ownerSelection.ok)
+            return;
+        if (accessMode === 'public' && manifestUsesUserRoot(parsed.manifest)) {
+            return sendJson(res, 400, {
+                code: 'public_user_context_conflict',
+                error: 'public access mode cannot reference ${user}; use mixed for optional identity',
+            });
+        }
+        const [cspFault] = cspFaultsInManifest(parsed.manifest);
+        if (cspFault !== undefined) {
+            return sendJson(res, 400, {
+                code: 'invalid_widget_csp',
+                error: `widget "${cspFault.widget}" CSP ${cspFault.list} origin "${cspFault.value}" is not an ` +
+                    `absolute https:// origin and would be dropped by the host renderer` +
+                    (cspFault.suggestion !== undefined ? `; use "${cspFault.suggestion}"` : ''),
+            });
+        }
+        phase = 'checks';
+        timer = setTimeout(() => {
+            deadlineExceeded = true;
+            if (!res.headersSent && !res.destroyed)
+                sendJson(res, 504, {
+                    code: 'deploy_preflight_timeout',
+                    phase,
+                    error: `Preflight exceeded its ${DEPLOY_PREFLIGHT_CHECK_TIMEOUT_MS}ms checking budget. Publication did not start.`,
+                });
+        }, DEPLOY_PREFLIGHT_CHECK_TIMEOUT_MS);
+        const pending = [
+            registry.getApp(tenant.org, tenant.app),
+            registry.getEnvironment(tenant.org, tenant.app, tenant.env),
+            registry.preflightDeploy(tenant, parsed.manifest, {
+                ...(parsed.connectors !== undefined ? { connectors: parsed.connectors } : {}),
+                actor: identity,
+                accessMode,
+                ownerSubject: ownerSelection.ownerSubject,
+                ...(parsed.orgMembershipSources !== undefined
+                    ? { orgMembershipSources: parsed.orgMembershipSources }
+                    : {}),
+                ...(parsed.hostedAssets !== undefined ? { hostedAssets: parsed.hostedAssets } : {}),
+                ...(parsed.serverVersion !== undefined ? { serverVersion: parsed.serverVersion } : {}),
+                deploymentSource: parsed.deploymentSource ?? 'cli',
+            }),
+        ];
+        const checked = await Promise.all(pending)
+            .catch(async (error) => {
+            // Keep the resource slot until every already-started check settles, including after a timeout.
+            await Promise.allSettled(pending);
+            throw error;
+        })
+            .finally(() => clearTimeout(timer));
+        const [application, environment, preflight] = checked;
+        const errors = preflight.ok ? [] : preflight.errors;
+        const missingSecrets = configNames(errors, 'missing_secret', 'secrets.');
+        const missingVariables = configNames(errors, 'missing_variable', 'variables.');
+        const appState = application === undefined ? 'will-create' : 'existing';
+        const environmentState = environment === undefined ? 'will-create' : 'existing';
+        const ready = errors.length === 0;
+        const codes = [...new Set(errors.map((error) => error.code))].sort().join(',');
+        await audit.emit({
+            eventType: 'deploy.preflight.checked',
+            org: tenant.org,
+            app: tenant.app,
+            env: tenant.env,
+            decision: 'allow',
+            status: 200,
+            actorSubject: identity.subject,
+            ...(identity.email !== undefined ? { actorEmail: identity.email } : {}),
+            details: {
+                requestId,
+                phase,
+                elapsedMs: Date.now() - startedAt,
+                clientDisconnected,
+                deadlineExceeded,
+                ready,
+                appState,
+                environmentState,
+                ...(ownerSelection.ownerSubject !== undefined
+                    ? { ownerSubject: ownerSelection.ownerSubject }
+                    : {}),
+                errorCount: errors.length,
+                codes,
+                missingSecretCount: missingSecrets.length,
+                missingVariableCount: missingVariables.length,
+            },
         });
-    }
-    const [application, environment, preflight] = await Promise.all([
-        registry.getApp(tenant.org, tenant.app),
-        registry.getEnvironment(tenant.org, tenant.app, tenant.env),
-        registry.preflightDeploy(tenant, parsed.manifest, {
-            ...(parsed.connectors !== undefined ? { connectors: parsed.connectors } : {}),
-            actor: identity,
-            accessMode,
-            ownerSubject: ownerSelection.ownerSubject,
-            ...(parsed.orgMembershipSources !== undefined
-                ? { orgMembershipSources: parsed.orgMembershipSources }
-                : {}),
-            ...(parsed.hostedAssets !== undefined ? { hostedAssets: parsed.hostedAssets } : {}),
-            ...(parsed.serverVersion !== undefined ? { serverVersion: parsed.serverVersion } : {}),
-            deploymentSource: parsed.deploymentSource ?? 'cli',
-        }),
-    ]);
-    const errors = preflight.ok ? [] : preflight.errors;
-    const missingSecrets = configNames(errors, 'missing_secret', 'secrets.');
-    const missingVariables = configNames(errors, 'missing_variable', 'variables.');
-    const appState = application === undefined ? 'will-create' : 'existing';
-    const environmentState = environment === undefined ? 'will-create' : 'existing';
-    const ready = errors.length === 0;
-    const codes = [...new Set(errors.map((error) => error.code))].sort().join(',');
-    await audit.emit({
-        eventType: 'deploy.preflight.checked',
-        org: tenant.org,
-        app: tenant.app,
-        env: tenant.env,
-        decision: 'allow',
-        status: 200,
-        actorSubject: identity.subject,
-        ...(identity.email !== undefined ? { actorEmail: identity.email } : {}),
-        details: {
+        if (deadlineExceeded || clientDisconnected || res.destroyed)
+            return;
+        return sendJson(res, 200, {
+            ok: true,
             ready,
-            appState,
-            environmentState,
             ...(ownerSelection.ownerSubject !== undefined
                 ? { ownerSubject: ownerSelection.ownerSubject }
                 : {}),
-            errorCount: errors.length,
-            codes,
-            missingSecretCount: missingSecrets.length,
-            missingVariableCount: missingVariables.length,
-        },
-    });
-    return sendJson(res, 200, {
-        ok: true,
-        ready,
-        ...(ownerSelection.ownerSubject !== undefined
-            ? { ownerSubject: ownerSelection.ownerSubject }
-            : {}),
-        target: {
+            target: {
+                ...tenant,
+                appState,
+                environmentState,
+            },
+            config: {
+                ready: missingSecrets.length === 0 && missingVariables.length === 0,
+                missingSecrets,
+                missingVariables,
+            },
+            errors,
+        });
+    }
+    catch (error) {
+        await audit.emit({
+            eventType: 'deploy.preflight.failed',
             ...tenant,
-            appState,
-            environmentState,
-        },
-        config: {
-            ready: missingSecrets.length === 0 && missingVariables.length === 0,
-            missingSecrets,
-            missingVariables,
-        },
-        errors,
-    });
+            actorSubject: identity.subject,
+            decision: 'deny',
+            status: res.headersSent ? res.statusCode : 500,
+            reasonCode: 'preflight_failed',
+            details: {
+                requestId,
+                phase,
+                elapsedMs: Date.now() - startedAt,
+                clientDisconnected,
+                deadlineExceeded,
+            },
+        });
+        throw error;
+    }
+    finally {
+        clearTimeout(timer);
+        res.removeListener('close', onClose);
+        activePreflights.delete(registry);
+    }
 }
 function configNames(errors, code, prefix) {
     return [

package/node_modules/@noodle-borg/service/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.93.0",
+    "@noodle-borg/agent-kit": "0.94.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/node_modules/@noodle-borg/wire-contracts/dist/index.d.ts

@@ -137,6 +137,9 @@ export declare const deployErrorResponseSchema: z.ZodObject<{
     errors: z.ZodOptional<z.ZodUnknown>;
 }, z.core.$strip>;
 export type DeployErrorResponse = z.infer<typeof deployErrorResponseSchema>;
+/** Checking budget after upload/authorization; the client allows additional upload/response time. */
+export declare const DEPLOY_PREFLIGHT_CHECK_TIMEOUT_MS = 60000;
+export declare const DEPLOY_PREFLIGHT_CLIENT_TIMEOUT_MS = 75000;
 /**
  * `POST /v1/orgs/{org}/apps/{app}/envs/{env}/deploy/preflight` accepts the same
  * declarative input as deploy, but performs no deployment or asset upload.

package/node_modules/@noodle-borg/wire-contracts/dist/index.js

@@ -109,6 +109,9 @@ export const deployErrorResponseSchema = z.object({
     errors: z.unknown().optional(),
 });
 // ─── Deploy preflight ─────────────────────────────────────────────────────────────
+/** Checking budget after upload/authorization; the client allows additional upload/response time. */
+export const DEPLOY_PREFLIGHT_CHECK_TIMEOUT_MS = 60_000;
+export const DEPLOY_PREFLIGHT_CLIENT_TIMEOUT_MS = 75_000;
 /**
  * `POST /v1/orgs/{org}/apps/{app}/envs/{env}/deploy/preflight` accepts the same
  * declarative input as deploy, but performs no deployment or asset upload.

package/node_modules/@noodleseed/assistant/README.md

@@ -6,7 +6,8 @@ The package exports the canonical `<noodle-assistant>` managed Web Component, th
 `<noodle-app-view>` MCP App host from `@noodleseed/assistant/app-view`, a managed React wrapper and
 `NoodleAppView` adapter from `@noodleseed/assistant/react`, a renderer-free React hook from
 `@noodleseed/assistant/react/client`, a DOM-free client from `@noodleseed/assistant/client`, and the
-backend-only `createAssistantSession` helper from `@noodleseed/assistant/server`. The component inherits the
+backend-only `createAssistantSessionHandler` and lower-level `createAssistantSession` exchange from
+`@noodleseed/assistant/server`. The component inherits the
 deployed MCP server's brand kit while slots, methods, events, and semantic CSS variables let a SaaS developer
 integrate it without depending on internal DOM selectors. Light, dark, automatic host-page matching, and
 host-page inversion work without replacing conversation or App DOM.
@@ -193,32 +194,29 @@ noodle assistant clients create --name web --org acme --app support --env prod
 
 The command saves `{ clientId, clientSecret }` to a mode-`0600` file and prints its path, never the secret.
 Move those values to the customer backend's secret manager without printing or committing them. A framework
-route can exchange the current signed-in user like this:
+route can use the maintained same-origin handler. Generate the route, authentication adapter, mount and
+contract tests with `noodle assistant embed --framework nextjs --surface authenticated` in the existing
+application. Implement only `authenticateAssistantRequest` using its existing session and membership checks:
 
 ```ts
-import { createAssistantSession } from "@noodleseed/assistant/server";
-
-export async function POST(request: Request) {
-  const user = await requireCurrentUser(request);
-  const { context } = await request.json();
-  const session = await createAssistantSession({
-    serviceUrl: process.env.NOODLE_SERVICE_URL!,
-    clientId: process.env.NOODLE_ASSISTANT_CLIENT_ID!,
-    clientSecret: process.env.NOODLE_ASSISTANT_CLIENT_SECRET!,
-    origin: process.env.PUBLIC_APP_ORIGIN!,
-    user: {
-      id: user.id,
-      email: user.email,
-      roles: user.roles,
-      scopes: user.scopes,
-    },
-    context,
-    preferences: { locale: user.locale, timeZone: user.timeZone },
-  });
-  return Response.json(session);
-}
+import { createAssistantSessionHandler } from "@noodleseed/assistant/server";
+import { authenticateAssistantRequest } from "../../../../lib/noodle-assistant-auth";
+
+export const POST = createAssistantSessionHandler({
+  serviceUrl: process.env.NOODLE_SERVICE_URL,
+  clientId: process.env.NOODLE_ASSISTANT_CLIENT_ID,
+  clientSecret: process.env.NOODLE_ASSISTANT_CLIENT_SECRET,
+  origin: process.env.PUBLIC_APP_ORIGIN,
+  authenticate: authenticateAssistantRequest,
+});
 ```
 
+The handler owns exact-Origin and JSON checks, signed-out JSON 401, bounded context/body parsing, no-store
+responses, a 15-second deadline, and sanitized exchange failures without retries or redirects. Your adapter
+returns `AssistantSessionIdentity | null`; its `user`, claims, preferences and routing must be backend-verified.
+Keep stricter application CSRF middleware. Run the generated contract suite and your real identity/tenant
+acceptance tests; synthetic contract tests alone do not verify your login implementation.
+
 For a connector that uses `customerEndpoint("customer_api", ...)`, the authenticated backend may also pass
 `routing: { endpoints: { customer_api: account.clusterApiBaseUrl } }`. Resolve the URL from server-owned
 user/account membership after authentication; never accept it from the browser, page context, session

package/node_modules/@noodleseed/assistant/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/assistant",
-  "version": "1.33.0",
+  "version": "1.34.0",
   "description": "Embed the Noodle Seed customer-branded assistant in your web app with managed or framework-owned UI, a framework-neutral MCP App host, a DOM-free client, and a backend session helper. Authoring and deploying the server is @noodleseed/one.",
   "license": "Apache-2.0",
   "repository": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.155.0",
+  "version": "0.156.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",
@@ -205,7 +205,6 @@
     "shebang-command",
     "shebang-regex",
     "statuses",
-    "tailwindcss",
     "tldts",
     "tldts-core",
     "toidentifier",
@@ -236,7 +235,7 @@
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.93.0",
+    "@noodle-borg/agent-kit": "0.94.0",
     "@noodle-borg/app-audit": "0.0.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
@@ -285,7 +284,9 @@
     "zod-to-json-schema": "3.25.2"
   },
   "devDependencies": {
-    "@types/node": "24.13.1"
+    "@noodleseed/assistant": "@noodleseed/assistant@file:///home/runner/work/noodle-borg/noodle-borg/packages/assistant",
+    "@types/node": "24.13.1",
+    "next": "16.2.9"
   },
   "optionalDependencies": {}
 }

package/dist/saas-scaffold-template.d.ts

@@ -1,4 +0,0 @@
-import type { ProjectAgentTarget } from './project.js';
-/** Default SaaS starter: the portable Apps surface plus customer identity and verified context. */
-export declare function saasFiles(name: string, agentTargets: readonly ProjectAgentTarget[]): Record<string, string>;
-//# sourceMappingURL=saas-scaffold-template.d.ts.map

package/dist/saas-scaffold-template.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"saas-scaffold-template.d.ts","sourceRoot":"","sources":["../src/saas-scaffold-template.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGvD,mGAAmG;AACnG,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,SAAS,kBAAkB,EAAE,GAC1C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA6DxB"}

package/dist/saas-scaffold-template.js

@@ -1,56 +0,0 @@
-import { widgetFiles } from './widget-scaffold-template.js';
-/** Default SaaS starter: the portable Apps surface plus customer identity and verified context. */
-export function saasFiles(name, agentTargets) {
-    const files = widgetFiles(name, agentTargets);
-    const server = files['src/server.ts'];
-    const config = files['noodle.json'];
-    if (server === undefined || config === undefined)
-        throw new Error('SaaS template source is incomplete');
-    return {
-        ...files,
-        'noodle.json': config.replace('"template": "widget"', '"template": "saas"'),
-        'src/server.ts': server
-            .replace('  annotations,\n', '  annotations,\n  customerAuth,\n')
-            .replace("  instructions: 'Help users understand their workspace, update preferences, and plan a safe next step.',", `  instructions: 'Help users understand their workspace, update preferences, and plan a safe next step.',
-  // Replace these placeholders with the customer IdP values used by ChatGPT, Claude, and your app.
-  auth: customerAuth.federatedOidc({
-    issuers: [{
-      issuer: 'https://id.your-app.example.com',
-      audience: 'https://your-noodle-mcp.example.com/mcp',
-    }],
-  }),`)
-            .replace("description: 'List the current workspace items with concise status summaries.',", "description: 'List the current workspace items with concise status summaries.',\n    contextProvider: true,")
-            .replace("input: z.object({ status: z.enum(['all', 'active', 'done']).default('all').meta({ title: 'Status' }) }),", 'input: z.object({}),'),
-        'README.md': `${files['README.md'] ?? ''}
-
-## Customer identity and delegated APIs
-
-The default server uses standards-based federated OIDC so the same MCP endpoint works from remote MCP clients
-and any embedded assistant that you explicitly configure. Your application team owns the authorization server; Noodle verifies its tokens
-but does not add OAuth discovery or registration endpoints in front of it.
-
-For every direct or federated issuer, publish all of the following:
-
-- The path-inserted RFC 8414 metadata URL as direct, unauthenticated HTTP 200 JSON. For issuer
-  \`https://id.example.com/oauth\`, that URL is
-  \`https://id.example.com/.well-known/oauth-authorization-server/oauth\`.
-- HTTPS \`authorization_endpoint\`, \`token_endpoint\`, \`jwks_uri\`, and RFC 7591
-  \`registration_endpoint\` values in that metadata.
-- Authorization code and refresh-token grants, PKCE \`S256\`, and public clients by advertising
-  \`code_challenge_methods_supported: ["S256"]\` and
-  \`token_endpoint_auth_methods_supported: ["none"]\`.
-- RFC 8707 \`resource\` handling: validate the exact URL on authorize, code exchange, and refresh, then
-  map each approved MCP resource to the stable app/environment audience configured in \`customerAuth\`.
-- A public JWKS containing only public signing keys.
-
-Run \`noodle auth doctor src/server.ts\` before sharing the endpoint. The doctor is read-only: it verifies
-discovery, metadata, capabilities, and JWKS without registering a client.
-
-Verified OIDC callers are classified as customers by the runtime; never add a caller-controlled identity
-classification claim. For a customer-owned API, declare connector auth as \`delegatedTokenExchange\` and
-store its client credential with \`noodle secrets set\`. Use \`noodle auth doctor --live\` before release to
-exercise one credential exchange without invoking a business tool.
-`,
-    };
-}
-//# sourceMappingURL=saas-scaffold-template.js.map

package/dist/saas-scaffold-template.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"saas-scaffold-template.js","sourceRoot":"","sources":["../src/saas-scaffold-template.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,mGAAmG;AACnG,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,YAA2C;IAE3C,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;QAC9C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,OAAO;QACL,GAAG,KAAK;QACR,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;QAC3E,eAAe,EAAE,MAAM;aACpB,OAAO,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;aAChE,OAAO,CACN,0GAA0G,EAC1G;;;;;;;MAOF,CACC;aACA,OAAO,CACN,iFAAiF,EACjF,6GAA6G,CAC9G;aACA,OAAO,CACN,0GAA0G,EAC1G,sBAAsB,CACvB;QACH,WAAW,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6B3C;KACE,CAAC;AACJ,CAAC"}

package/node_modules/tailwindcss/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) Tailwind Labs, Inc.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/node_modules/tailwindcss/README.md

@@ -1,36 +0,0 @@
-<p align="center">
-  <a href="https://tailwindcss.com" target="_blank">
-    <picture>
-      <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/tailwindlabs/tailwindcss/HEAD/.github/logo-dark.svg">
-      <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/tailwindlabs/tailwindcss/HEAD/.github/logo-light.svg">
-      <img alt="Tailwind CSS" src="https://raw.githubusercontent.com/tailwindlabs/tailwindcss/HEAD/.github/logo-light.svg" width="350" height="70" style="max-width: 100%;">
-    </picture>
-  </a>
-</p>
-
-<p align="center">
-  A utility-first CSS framework for rapidly building custom user interfaces.
-</p>
-
-<p align="center">
-    <a href="https://github.com/tailwindlabs/tailwindcss/actions"><img src="https://img.shields.io/github/actions/workflow/status/tailwindlabs/tailwindcss/ci.yml?branch=main" alt="Build Status"></a>
-    <a href="https://www.npmjs.com/package/tailwindcss"><img src="https://img.shields.io/npm/dt/tailwindcss.svg" alt="Total Downloads"></a>
-    <a href="https://github.com/tailwindlabs/tailwindcss/releases"><img src="https://img.shields.io/npm/v/tailwindcss.svg" alt="Latest Release"></a>
-    <a href="https://github.com/tailwindlabs/tailwindcss/blob/main/LICENSE"><img src="https://img.shields.io/npm/l/tailwindcss.svg" alt="License"></a>
-</p>
-
----
-
-## Documentation
-
-For full documentation, visit [tailwindcss.com](https://tailwindcss.com).
-
-## Community
-
-For help, discussion about best practices, or feature ideas:
-
-[Discuss Tailwind CSS on GitHub](https://github.com/tailwindlabs/tailwindcss/discussions)
-
-## Contributing
-
-If you're interested in contributing to Tailwind CSS, please read our [contributing docs](https://github.com/tailwindlabs/tailwindcss/blob/main/.github/CONTRIBUTING.md) **before submitting a pull request**.

package/node_modules/tailwindcss/dist/chunk-5JIJA4QV.mjs

@@ -1 +0,0 @@
-function h(n){if(arguments.length===0)throw new TypeError("`CSS.escape` requires an argument.");let e=String(n),i=e.length,r=-1,t,s="",l=e.charCodeAt(0);if(i===1&&l===45)return"\\"+e;for(;++r<i;){if(t=e.charCodeAt(r),t===0){s+="\uFFFD";continue}if(t>=1&&t<=31||t===127||r===0&&t>=48&&t<=57||r===1&&t>=48&&t<=57&&l===45){s+="\\"+t.toString(16)+" ";continue}if(t>=128||t===45||t===95||t>=48&&t<=57||t>=65&&t<=90||t>=97&&t<=122){s+=e.charAt(r);continue}s+="\\"+e.charAt(r)}return s}function a(n){return n.replace(/\\([\dA-Fa-f]{1,6}[\t\n\f\r ]?|[\S\s])/g,e=>{if(e.length<=2)return e[1];let i=Number.parseInt(e.slice(1).trim(),16);return i===0||i>1114111||i>=55296&&i<=57343?"\uFFFD":String.fromCodePoint(i)})}var c=new Map([["--font",["--font-weight","--font-size"]],["--inset",["--inset-shadow","--inset-ring"]],["--text",["--text-color","--text-decoration-color","--text-decoration-thickness","--text-indent","--text-shadow","--text-underline-offset"]],["--grid-column",["--grid-column-start","--grid-column-end"]],["--grid-row",["--grid-row-start","--grid-row-end"]]]);function g(n,e){return(c.get(e)??[]).some(i=>n===i||n.startsWith(`${i}-`))}var p=class{constructor(e=new Map,i=new Set([])){this.values=e;this.keyframes=i}values;keyframes;prefix=null;get size(){return this.values.size}add(e,i,r=0,t){if(e.endsWith("-*")){if(i!=="initial")throw new Error(`Invalid theme value \`${i}\` for namespace \`${e}\``);e==="--*"?this.values.clear():this.clearNamespace(e.slice(0,-2),0)}if(r&4){let s=this.values.get(e);if(s&&!(s.options&4))return}i==="initial"?this.values.delete(e):this.values.set(e,{value:i,options:r,src:t})}keysInNamespaces(e){let i=[];for(let r of e){let t=`${r}-`;for(let s of this.values.keys())s.startsWith(t)&&s.indexOf("--",2)===-1&&(g(s,r)||i.push(s.slice(t.length)))}return i}get(e){for(let i of e){let r=this.values.get(i);if(r)return r.value}return null}hasDefault(e){return(this.getOptions(e)&4)===4}getOptions(e){return e=a(this.#i(e)),this.values.get(e)?.options??0}entries(){return this.prefix?Array.from(this.values,e=>(e[0]=this.prefixKey(e[0]),e)):this.values.entries()}prefixKey(e){return this.prefix?`--${this.prefix}-${e.slice(2)}`:e}#i(e){return this.prefix?`--${e.slice(3+this.prefix.length)}`:e}clearNamespace(e,i){let r=c.get(e)??[];e:for(let t of this.values.keys())if(t.startsWith(e)){if(i!==0&&(this.getOptions(t)&i)!==i)continue;for(let s of r)if(t.startsWith(s))continue e;this.values.delete(t)}}#e(e,i){for(let r of i){let t=e!==null?`${r}-${e}`:r;if(!this.values.has(t))if(e!==null&&e.includes(".")){if(t=`${r}-${e.replaceAll(".","_")}`,!this.values.has(t))continue}else continue;if(!g(t,r))return t}return null}#t(e){let i=this.values.get(e);if(!i)return null;let r=null;return i.options&2&&(r=i.value),`var(${h(this.prefixKey(e))}${r?`, ${r}`:""})`}markUsedVariable(e){let i=a(this.#i(e)),r=this.values.get(i);if(!r)return!1;let t=r.options&16;return r.options|=16,!t}resolve(e,i,r=0){let t=this.#e(e,i);if(!t)return null;let s=this.values.get(t);return(r|s.options)&1?s.value:this.#t(t)}resolveValue(e,i){let r=this.#e(e,i);return r?this.values.get(r).value:null}resolveWith(e,i,r=[]){let t=this.#e(e,i);if(!t)return null;let s={};for(let u of r){let f=`${t}${u}`,o=this.values.get(f);o&&(o.options&1?s[u]=o.value:s[u]=this.#t(f))}let l=this.values.get(t);return l.options&1?[l.value,s]:[this.#t(t),s]}namespace(e){let i=new Map,r=`${e}-`;for(let[t,s]of this.values)t===e?i.set(null,s.value):t.startsWith(`${r}-`)?i.set(t.slice(e.length),s.value):t.startsWith(r)&&i.set(t.slice(r.length),s.value);return i}addKeyframes(e){this.keyframes.add(e)}getKeyframes(){return Array.from(this.keyframes)}};export{h as a,a as b,p as c};