@noodleseed/one 0.159.0 → 0.160.0

package/node_modules/@noodle-borg/control-plane/dist/in-memory-control-plane-store.js

@@ -1,3 +1,4 @@
+import { PersonalWorkspaceOwnerMutationError } from './contracts.js';
 import { InMemoryOrganizationStore } from './in-memory-organization-store.js';
 import { personalOrgSlugSuffix } from './organization-helpers.js';
 import { validateUserOwnedOrgSlug } from './validation.js';
@@ -75,6 +76,18 @@ export class InMemoryControlPlaneStore extends InMemoryOrganizationStore {
             return org;
         });
     }
+    addOrgMember(input) {
+        this.#assertPersonalOwnerMutation(input.org, input.subject, input.role);
+        return super.addOrgMember(input);
+    }
+    removeOrgMember(input) {
+        this.#assertPersonalOwnerMutation(input.org, input.subject);
+        return super.removeOrgMember(input);
+    }
+    updateOrgMemberRole(input) {
+        this.#assertPersonalOwnerMutation(input.org, input.subject, input.role);
+        return super.updateOrgMemberRole(input);
+    }
     claimWelcomeEmail(input) {
         const nowMs = input.now.getTime();
         const record = [...this.#welcomeEmails.values()]
@@ -131,6 +144,11 @@ export class InMemoryControlPlaneStore extends InMemoryOrganizationStore {
             role: 'owner',
         });
     }
+    #assertPersonalOwnerMutation(org, subject, role) {
+        if (this.#personalWorkspaces.get(subject) === org && role !== 'owner') {
+            throw new PersonalWorkspaceOwnerMutationError();
+        }
+    }
     async #serialized(key, operation) {
         const prior = this.#queues.get(key) ?? Promise.resolve();
         let release;

package/node_modules/@noodle-borg/control-plane/dist/portable.d.ts

@@ -1,5 +1,6 @@
 export { type AppPurgeReconciliationActor, type AppPurgeReconciliationConflictCode, AppPurgeReconciliationError, type AppPurgeReconciliationOperator, } from './app-purge-reconciliation-port.js';
 export type { ActiveMcpSubdomainClaim, ChangeMcpSubdomainInput, ControlPlaneIdentity, CreateOrgWithOwnerInput, McpSubdomainMutationResult, McpSubdomainSetting, OrganizationStore, OrgDomainRecord, OrgInvitationRecord, OrgMemberRecord, OrgOpenAIAppsChallengeRecord, OrgRecord, OrgRole, PersonalWorkspaceProvisionInput, PersonalWorkspaceProvisionResult, SignupAllowlistKind, SignupAllowlistRecord, WelcomeEmailRecord, } from './contracts.js';
+export { PersonalWorkspaceOwnerMutationError } from './contracts.js';
 export { allowAllGate, bearerToken, type ControlPlaneAuthResult, type DeployAuthGate, } from './deploy-auth.js';
 export { CompositeControlPlaneGate, type ControlPlaneSignupMode, GoogleControlPlaneGate, type GoogleControlPlaneGateOptions, type GoogleIdTokenVerifier, GoogleWorkloadControlPlaneGate, type GoogleWorkloadControlPlaneGateOptions, NoodleOAuthControlPlaneGate, type NoodleOAuthControlPlaneGateOptions, type SignupAuthorizer, } from './deploy-gates.js';
 export { InMemoryControlPlaneStore } from './in-memory-control-plane-store.js';

package/node_modules/@noodle-borg/control-plane/dist/portable.js

@@ -1,4 +1,5 @@
 export { AppPurgeReconciliationError, } from './app-purge-reconciliation-port.js';
+export { PersonalWorkspaceOwnerMutationError } from './contracts.js';
 export { allowAllGate, bearerToken, } from './deploy-auth.js';
 export { CompositeControlPlaneGate, GoogleControlPlaneGate, GoogleWorkloadControlPlaneGate, NoodleOAuthControlPlaneGate, } from './deploy-gates.js';
 export { InMemoryControlPlaneStore } from './in-memory-control-plane-store.js';

package/node_modules/@noodle-borg/service/dist/routes/org-admin.js

@@ -1,4 +1,4 @@
-import { mcpSubdomainEndpointOptions } from '@noodle-borg/control-plane/portable';
+import { mcpSubdomainEndpointOptions, PersonalWorkspaceOwnerMutationError, } from '@noodle-borg/control-plane/portable';
 import { normalizePublicBaseDomain, OPENAI_APPS_CHALLENGE_PATH } from '@noodle-borg/module';
 import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
 import { OrgSummarySchema } from '@noodle-borg/wire-contracts';
@@ -142,7 +142,7 @@ export async function handleMembers(req, res, gate, controlPlane, maxBody, ref,
             return sendJson(res, 201, { ok: true, member });
         }
         catch (error) {
-            return sendJson(res, 400, { error: error.message });
+            return sendMemberMutationError(res, error);
         }
     }
     if (req.method === 'PATCH' && ref.subject !== undefined) {
@@ -177,7 +177,7 @@ export async function handleMembers(req, res, gate, controlPlane, maxBody, ref,
             return sendJson(res, 200, { ok: true, member });
         }
         catch (error) {
-            return sendJson(res, 400, { error: error.message });
+            return sendMemberMutationError(res, error);
         }
     }
     if (req.method === 'DELETE' && ref.subject !== undefined) {
@@ -186,18 +186,28 @@ export async function handleMembers(req, res, gate, controlPlane, maxBody, ref,
         if (await demotesLastOwner(controlPlane, ref.org, ref.subject, undefined)) {
             return sendJson(res, 409, { error: 'cannot remove the last owner' });
         }
-        const removed = await controlPlane.removeOrgMember({ org: ref.org, subject: ref.subject });
-        if (removed) {
-            await emitOrgAudit(audit, 'org.member.removed', ref.org, identity, 204, {
-                subject: ref.subject,
-            });
+        try {
+            const removed = await controlPlane.removeOrgMember({ org: ref.org, subject: ref.subject });
+            if (removed) {
+                await emitOrgAudit(audit, 'org.member.removed', ref.org, identity, 204, {
+                    subject: ref.subject,
+                });
+            }
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        catch (error) {
+            return sendMemberMutationError(res, error);
         }
-        res.writeHead(204);
-        res.end();
-        return;
     }
     return sendJson(res, 404, { error: 'not found' });
 }
+function sendMemberMutationError(res, error) {
+    sendJson(res, error instanceof PersonalWorkspaceOwnerMutationError ? 409 : 400, {
+        error: error.message,
+    });
+}
 export async function handleInvitations(req, res, gate, controlPlane, maxBody, ref, audit, url, invitationEmail = {}, now = () => new Date()) {
     const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
     if (identity === false)

package/node_modules/@noodle-borg/service/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.96.0",
+    "@noodle-borg/agent-kit": "0.97.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.159.0",
+  "version": "0.160.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",
@@ -235,7 +235,7 @@
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.96.0",
+    "@noodle-borg/agent-kit": "0.97.0",
     "@noodle-borg/app-audit": "0.0.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",