@noodleseed/one 0.159.0 → 0.161.0

package/node_modules/@noodle-borg/control-plane/dist/in-memory-control-plane-store.js

@@ -1,3 +1,4 @@
+import { PersonalWorkspaceOwnerMutationError } from './contracts.js';
 import { InMemoryOrganizationStore } from './in-memory-organization-store.js';
 import { personalOrgSlugSuffix } from './organization-helpers.js';
 import { validateUserOwnedOrgSlug } from './validation.js';
@@ -75,6 +76,18 @@ export class InMemoryControlPlaneStore extends InMemoryOrganizationStore {
             return org;
         });
     }
+    addOrgMember(input) {
+        this.#assertPersonalOwnerMutation(input.org, input.subject, input.role);
+        return super.addOrgMember(input);
+    }
+    removeOrgMember(input) {
+        this.#assertPersonalOwnerMutation(input.org, input.subject);
+        return super.removeOrgMember(input);
+    }
+    updateOrgMemberRole(input) {
+        this.#assertPersonalOwnerMutation(input.org, input.subject, input.role);
+        return super.updateOrgMemberRole(input);
+    }
     claimWelcomeEmail(input) {
         const nowMs = input.now.getTime();
         const record = [...this.#welcomeEmails.values()]
@@ -131,6 +144,11 @@ export class InMemoryControlPlaneStore extends InMemoryOrganizationStore {
             role: 'owner',
         });
     }
+    #assertPersonalOwnerMutation(org, subject, role) {
+        if (this.#personalWorkspaces.get(subject) === org && role !== 'owner') {
+            throw new PersonalWorkspaceOwnerMutationError();
+        }
+    }
     async #serialized(key, operation) {
         const prior = this.#queues.get(key) ?? Promise.resolve();
         let release;

package/node_modules/@noodle-borg/control-plane/dist/portable.d.ts

@@ -1,5 +1,6 @@
 export { type AppPurgeReconciliationActor, type AppPurgeReconciliationConflictCode, AppPurgeReconciliationError, type AppPurgeReconciliationOperator, } from './app-purge-reconciliation-port.js';
 export type { ActiveMcpSubdomainClaim, ChangeMcpSubdomainInput, ControlPlaneIdentity, CreateOrgWithOwnerInput, McpSubdomainMutationResult, McpSubdomainSetting, OrganizationStore, OrgDomainRecord, OrgInvitationRecord, OrgMemberRecord, OrgOpenAIAppsChallengeRecord, OrgRecord, OrgRole, PersonalWorkspaceProvisionInput, PersonalWorkspaceProvisionResult, SignupAllowlistKind, SignupAllowlistRecord, WelcomeEmailRecord, } from './contracts.js';
+export { PersonalWorkspaceOwnerMutationError } from './contracts.js';
 export { allowAllGate, bearerToken, type ControlPlaneAuthResult, type DeployAuthGate, } from './deploy-auth.js';
 export { CompositeControlPlaneGate, type ControlPlaneSignupMode, GoogleControlPlaneGate, type GoogleControlPlaneGateOptions, type GoogleIdTokenVerifier, GoogleWorkloadControlPlaneGate, type GoogleWorkloadControlPlaneGateOptions, NoodleOAuthControlPlaneGate, type NoodleOAuthControlPlaneGateOptions, type SignupAuthorizer, } from './deploy-gates.js';
 export { InMemoryControlPlaneStore } from './in-memory-control-plane-store.js';

package/node_modules/@noodle-borg/control-plane/dist/portable.js

@@ -1,4 +1,5 @@
 export { AppPurgeReconciliationError, } from './app-purge-reconciliation-port.js';
+export { PersonalWorkspaceOwnerMutationError } from './contracts.js';
 export { allowAllGate, bearerToken, } from './deploy-auth.js';
 export { CompositeControlPlaneGate, GoogleControlPlaneGate, GoogleWorkloadControlPlaneGate, NoodleOAuthControlPlaneGate, } from './deploy-gates.js';
 export { InMemoryControlPlaneStore } from './in-memory-control-plane-store.js';

package/node_modules/@noodle-borg/runtime/dist/managed-origins.d.ts

@@ -1,11 +1,16 @@
 import type { CompileError, RuntimeArtifact } from '@noodle-borg/compiler';
+interface ManagedOriginError extends CompileError {
+    readonly variableName: string;
+    readonly reason: 'missing' | 'invalid';
+}
 export type ManagedOriginResolutionResult = {
     readonly ok: true;
     readonly artifact: RuntimeArtifact;
 } | {
     readonly ok: false;
-    readonly errors: readonly CompileError[];
+    readonly errors: readonly ManagedOriginError[];
 };
 /** Bind operator-owned exact origins into every runtime authority and host projection. */
 export declare function resolveManagedOrigins(artifact: RuntimeArtifact, variables: Readonly<Record<string, string>>): ManagedOriginResolutionResult;
+export {};
 //# sourceMappingURL=managed-origins.d.ts.map

package/node_modules/@noodle-borg/runtime/dist/managed-origins.js

@@ -53,6 +53,8 @@ function resolveManagedOrigin(value, variables, path, allowLoopback, replacement
     if (resolved === undefined) {
         errors.push({
             code: 'invalid_shape',
+            variableName: match[1],
+            reason: 'missing',
             path,
             message: `managed origin variable "${match[1]}" is not configured`,
         });
@@ -61,6 +63,8 @@ function resolveManagedOrigin(value, variables, path, allowLoopback, replacement
     if (!isCanonicalOrigin(resolved, allowLoopback)) {
         errors.push({
             code: 'invalid_shape',
+            variableName: match[1],
+            reason: 'invalid',
             path,
             message: allowLoopback
                 ? `managed origin variable "${match[1]}" must resolve to a canonical bare HTTPS origin (loopback HTTP is allowed for development)`

package/node_modules/@noodle-borg/service/dist/registry-compile.js

@@ -45,14 +45,10 @@ export async function compileRegistryTarget(context, input) {
                 : { localDevtoolsCustomerIdentity: true }),
         })
         : [];
-    if (identityErrors.length > 0)
-        return { ok: false, errors: identityErrors };
     // A delegated-auth tool on a pure public surface inevitably fails; reject it while the author can fix it.
     const projectionErrors = compiled.ok
         ? publicSurfaceDelegatedAuthErrors(compiled.artifact, secretBindings)
         : [];
-    if (projectionErrors.length > 0)
-        return { ok: false, errors: projectionErrors };
     const [resolvedSecrets, resolvedVariables] = await Promise.all([
         context.configStore.resolveConfigValues('secret', scope),
         context.configStore.resolveConfigValues('variable', scope),
@@ -65,13 +61,20 @@ export async function compileRegistryTarget(context, input) {
         return { ok: false, errors: [...connectorConfigErrors, ...compiled.errors] };
     }
     const missingServerConfig = missingServerConfigErrors(compiled.artifact, resolvedSecrets, resolvedVariables);
-    const configErrors = [...connectorConfigErrors, ...missingServerConfig];
-    if (configErrors.length > 0)
-        return { ok: false, errors: configErrors };
+    const errors = [
+        ...identityErrors,
+        ...projectionErrors,
+        ...connectorConfigErrors,
+        ...missingServerConfig,
+    ];
     const originResolution = resolveManagedOrigins(compiled.artifact, resolvedVariables);
-    if (!originResolution.ok)
-        return { ok: false, errors: originResolution.errors };
-    const artifact = originResolution.artifact;
+    if (!originResolution.ok) {
+        const missingVariables = new Set(errors.filter((error) => error.code === 'missing_variable').map((error) => error.path));
+        errors.push(...originResolution.errors
+            // An unset binding is already actionable config, not an independent invalid-origin fault.
+            .filter((error) => error.reason !== 'missing' || !missingVariables.has(`variables.${error.variableName}`))
+            .map(({ code, path, message }) => ({ code, path, message })));
+    }
     let appPackageSnapshot;
     if (input.renderAppPackage && compiled.appPackage !== undefined) {
         try {
@@ -79,11 +82,17 @@ export async function compileRegistryTarget(context, input) {
         }
         catch (error) {
             if (error instanceof AppPackageSnapshotError) {
-                return { ok: false, errors: [error.deployError] };
+                errors.push(error.deployError);
+            }
+            else {
+                throw error;
             }
-            throw error;
         }
     }
+    if (errors.length > 0 || !originResolution.ok) {
+        return { ok: false, errors, compiledArtifact: compiled.artifact };
+    }
+    const artifact = originResolution.artifact;
     const localAuthority = context.delegatedExchange === undefined &&
         secretBindings.some((binding) => binding.authKind === 'delegatedTokenExchange')
         ? await context.localDevtoolsDelegatedExchange?.resolve()

package/node_modules/@noodle-borg/service/dist/registry-deploy-transaction.js

@@ -10,20 +10,24 @@ export async function preflightRegistryDeploy(input) {
         return deployerRequiredError(accessMode);
     }
     const built = await input.compile();
-    if (!built.ok)
-        return built;
-    const missingCapabilities = missingCapabilityErrors(built.served.artifact.requirements?.capabilities ?? [], input.serviceCapabilities);
-    if (missingCapabilities.length > 0)
-        return { ok: false, errors: missingCapabilities };
-    if (accessMode === 'customers' && built.served.artifact.server.auth === undefined) {
-        return serverAuthRequiredError();
+    const errors = built.ok ? [] : [...built.errors];
+    const artifact = built.ok ? built.served.artifact : built.compiledArtifact;
+    if (artifact !== undefined) {
+        errors.push(...missingCapabilityErrors(artifact.requirements?.capabilities ?? [], input.serviceCapabilities));
+        if (accessMode === 'customers' && artifact.server.auth === undefined) {
+            errors.push(...serverAuthRequiredError().errors);
+        }
     }
     if (orgMembershipSources !== undefined) {
         if (orgMembershipSources.length === 0)
-            return emptyMembershipSourcesError();
-        if (accessMode !== 'org-members')
-            return membershipSourcesRequireOrgMembersError();
+            errors.push(...emptyMembershipSourcesError().errors);
+        if (accessMode !== 'org-members') {
+            errors.push(...membershipSourcesRequireOrgMembersError().errors);
+        }
     }
+    // Only diagnostics cross the registry/API boundary; failed compilation cannot publish metadata.
+    if (!built.ok || errors.length > 0)
+        return { ok: false, errors };
     return {
         ok: true,
         serverName: built.served.artifact.server.name,

package/node_modules/@noodle-borg/service/dist/routes/deploy-preflight.js

@@ -100,17 +100,19 @@ export async function handleDeployPreflight(req, res, registry, options, maxBody
         const ownerSelection = await authorizeDeploymentOwnerSelection(res, controlPlane, tenant.org, accessMode, identity, parsed.ownerSubject);
         if (!ownerSelection.ok)
             return;
+        const requestErrors = [];
         if (accessMode === 'public' && manifestUsesUserRoot(parsed.manifest)) {
-            return sendJson(res, 400, {
+            requestErrors.push({
                 code: 'public_user_context_conflict',
-                error: 'public access mode cannot reference ${user}; use mixed for optional identity',
+                path: 'accessMode',
+                message: 'public access mode cannot reference ${user}; use mixed for optional identity',
             });
         }
-        const [cspFault] = cspFaultsInManifest(parsed.manifest);
-        if (cspFault !== undefined) {
-            return sendJson(res, 400, {
+        for (const cspFault of cspFaultsInManifest(parsed.manifest)) {
+            requestErrors.push({
                 code: 'invalid_widget_csp',
-                error: `widget "${cspFault.widget}" CSP ${cspFault.list} origin "${cspFault.value}" is not an ` +
+                path: `widgets.${cspFault.widgetIndex}.csp.${cspFault.list}.${cspFault.index}`,
+                message: `widget "${cspFault.widget}" CSP ${cspFault.list} origin "${cspFault.value}" is not an ` +
                     `absolute https:// origin and would be dropped by the host renderer` +
                     (cspFault.suggestion !== undefined ? `; use "${cspFault.suggestion}"` : ''),
             });
@@ -149,7 +151,7 @@ export async function handleDeployPreflight(req, res, registry, options, maxBody
         })
             .finally(() => clearTimeout(timer));
         const [application, environment, preflight] = checked;
-        const errors = preflight.ok ? [] : preflight.errors;
+        const errors = [...requestErrors, ...(preflight.ok ? [] : preflight.errors)];
         const missingSecrets = configNames(errors, 'missing_secret', 'secrets.');
         const missingVariables = configNames(errors, 'missing_variable', 'variables.');
         const appState = application === undefined ? 'will-create' : 'existing';

package/node_modules/@noodle-borg/service/dist/routes/org-admin.js

@@ -1,4 +1,4 @@
-import { mcpSubdomainEndpointOptions } from '@noodle-borg/control-plane/portable';
+import { mcpSubdomainEndpointOptions, PersonalWorkspaceOwnerMutationError, } from '@noodle-borg/control-plane/portable';
 import { normalizePublicBaseDomain, OPENAI_APPS_CHALLENGE_PATH } from '@noodle-borg/module';
 import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
 import { OrgSummarySchema } from '@noodle-borg/wire-contracts';
@@ -142,7 +142,7 @@ export async function handleMembers(req, res, gate, controlPlane, maxBody, ref,
             return sendJson(res, 201, { ok: true, member });
         }
         catch (error) {
-            return sendJson(res, 400, { error: error.message });
+            return sendMemberMutationError(res, error);
         }
     }
     if (req.method === 'PATCH' && ref.subject !== undefined) {
@@ -177,7 +177,7 @@ export async function handleMembers(req, res, gate, controlPlane, maxBody, ref,
             return sendJson(res, 200, { ok: true, member });
         }
         catch (error) {
-            return sendJson(res, 400, { error: error.message });
+            return sendMemberMutationError(res, error);
         }
     }
     if (req.method === 'DELETE' && ref.subject !== undefined) {
@@ -186,18 +186,28 @@ export async function handleMembers(req, res, gate, controlPlane, maxBody, ref,
         if (await demotesLastOwner(controlPlane, ref.org, ref.subject, undefined)) {
             return sendJson(res, 409, { error: 'cannot remove the last owner' });
         }
-        const removed = await controlPlane.removeOrgMember({ org: ref.org, subject: ref.subject });
-        if (removed) {
-            await emitOrgAudit(audit, 'org.member.removed', ref.org, identity, 204, {
-                subject: ref.subject,
-            });
+        try {
+            const removed = await controlPlane.removeOrgMember({ org: ref.org, subject: ref.subject });
+            if (removed) {
+                await emitOrgAudit(audit, 'org.member.removed', ref.org, identity, 204, {
+                    subject: ref.subject,
+                });
+            }
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        catch (error) {
+            return sendMemberMutationError(res, error);
         }
-        res.writeHead(204);
-        res.end();
-        return;
     }
     return sendJson(res, 404, { error: 'not found' });
 }
+function sendMemberMutationError(res, error) {
+    sendJson(res, error instanceof PersonalWorkspaceOwnerMutationError ? 409 : 400, {
+        error: error.message,
+    });
+}
 export async function handleInvitations(req, res, gate, controlPlane, maxBody, ref, audit, url, invitationEmail = {}, now = () => new Date()) {
     const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
     if (identity === false)

package/node_modules/@noodle-borg/service/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.96.0",
+    "@noodle-borg/agent-kit": "0.98.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.159.0",
+  "version": "0.161.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",
@@ -235,7 +235,7 @@
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.96.0",
+    "@noodle-borg/agent-kit": "0.98.0",
     "@noodle-borg/app-audit": "0.0.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",