@noodleseed/one 0.161.2 → 0.163.0

package/node_modules/@noodle-borg/service/dist/credential-binding-index.js

@@ -21,39 +21,44 @@ export function buildCredentialBindingIndex(artifact) {
             ? []
             : [artifact.server.context.ambient.fulfilment]),
     ];
-    for (const fulfilment of fulfilments) {
-        for (const ref of resolvedOperationRefs(fulfilment)) {
-            const credentialBinding = ref.credentialBinding;
-            if (credentialBinding === undefined)
-                continue;
-            const binding = artifact.connectorBindings?.[credentialBinding.bindingId];
-            if (binding === undefined ||
-                binding.connection.id !== credentialBinding.connectionId ||
-                binding.profile !== credentialBinding.profile ||
-                computeConnectionConfigRevision(binding.connection) !==
-                    credentialBinding.connectionConfigRevision) {
-                continue;
-            }
-            const descriptor = {
-                connectorId: ref.connectorId,
-                connectorVersion: ref.connectorVersion,
-                operation: ref.operation,
-                ...credentialBinding,
-            };
-            const key = MapServiceBroker.bindingKey(descriptor);
-            const source = structuredClone(binding.connection.source);
-            const allowed = {
-                descriptor,
-                source,
-                ...(ref.customerEndpoint === undefined ? {} : { customerEndpoint: ref.customerEndpoint }),
-            };
-            byKey.set(key, allowed);
-            if (source.kind === 'externalExchange') {
-                externalExchange.set(key, allowed);
-            }
-            if (source.kind === 'googleWorkloadIdentity') {
-                googleWorkloadIdentity.set(key, allowed);
-            }
+    const sourceRefs = (artifact.server.managedCollections ?? []).flatMap((collection) => {
+        const source = collection.source;
+        if (source?.authority !== 'external')
+            return [];
+        return source.scan.resolved ? [source.scan] : [];
+    });
+    const operationRefs = [...fulfilments.flatMap(resolvedOperationRefs), ...sourceRefs];
+    for (const ref of operationRefs) {
+        const credentialBinding = ref.credentialBinding;
+        if (credentialBinding === undefined)
+            continue;
+        const binding = artifact.connectorBindings?.[credentialBinding.bindingId];
+        if (binding === undefined ||
+            binding.connection.id !== credentialBinding.connectionId ||
+            binding.profile !== credentialBinding.profile ||
+            computeConnectionConfigRevision(binding.connection) !==
+                credentialBinding.connectionConfigRevision) {
+            continue;
+        }
+        const descriptor = {
+            connectorId: ref.connectorId,
+            connectorVersion: ref.connectorVersion,
+            operation: ref.operation,
+            ...credentialBinding,
+        };
+        const key = MapServiceBroker.bindingKey(descriptor);
+        const source = structuredClone(binding.connection.source);
+        const allowed = {
+            descriptor,
+            source,
+            ...(ref.customerEndpoint === undefined ? {} : { customerEndpoint: ref.customerEndpoint }),
+        };
+        byKey.set(key, allowed);
+        if (source.kind === 'externalExchange') {
+            externalExchange.set(key, allowed);
+        }
+        if (source.kind === 'googleWorkloadIdentity') {
+            googleWorkloadIdentity.set(key, allowed);
         }
     }
     return {

package/node_modules/@noodle-borg/service/dist/deployment-execution.js

@@ -0,0 +1,275 @@
+import { cspFaultsInManifest } from '@noodle-borg/compiler';
+import { noopLogger } from '@noodle-borg/transport-http';
+import { BUSINESS_SETUP_MESSAGE, BusinessOnboarding } from './business-onboarding.js';
+import { manifestUsesUserRoot } from './registry-access.js';
+import { isIdentityAccessMode } from './routes/access-mode.js';
+import { provisionPublicEmbed } from './routes/deploy-public-embed.js';
+import { deploymentActivationRejection } from './routes/deployment-activation-response.js';
+/** Shared post-authorization deploy flow. Both API deploys and installations retain registry activation hooks. */
+export async function executeAuthorizedDeployment(input, dependencies) {
+    const { tenant, manifest, connectors, accessMode, identity, ownerSubject, orgMembershipSources, deploymentSource, serverVersion, automationId, } = input;
+    let hostedAssets = input.hostedAssets;
+    const idempotency = { key: input.idempotencyKey };
+    const { registry, options, controlPlane, audit } = dependencies;
+    if (options.businessOnboarding && options.businessInformationStore) {
+        const onboarding = new BusinessOnboarding(options.businessOnboarding, controlPlane, options.businessInformationStore);
+        for (const installation of await options.businessInformationStore.listInstallations(tenant.org)) {
+            if (installation.scope.app === tenant.app &&
+                installation.scope.env === tenant.env &&
+                !(await onboarding.ready(installation)))
+                return reject(409, { code: 'business_setup_required', error: BUSINESS_SETUP_MESSAGE });
+        }
+    }
+    if (input.assetSourceScope !== undefined && input.assetSourceScope.org !== tenant.org)
+        return reject(403, {
+            code: 'asset_source_forbidden',
+            error: 'Asset source must belong to the authorized installation organization.',
+        });
+    const assetScope = input.assetSourceScope ?? tenant;
+    if ((await registry.getAppArchivedAt(tenant.org, tenant.app)) !== undefined) {
+        await audit.emit({
+            eventType: 'deploy.rejected',
+            ...tenant,
+            decision: 'deny',
+            status: 409,
+            reasonCode: 'app_archived',
+            ...(identity?.subject === undefined ? {} : { actorSubject: identity.subject }),
+        });
+        return reject(409, {
+            error: 'app is archived; restore it before deploying',
+            code: 'app_archived',
+        });
+    }
+    // Identity access modes bind the data plane to verified identity, so the deployer must be authenticated.
+    // (Localhost dev runs the gate open; such deploys are rejected for lack of an owner/audit actor.)
+    if (isIdentityAccessMode(accessMode) && !identity) {
+        return reject(401, {
+            error: `${accessMode} deployments require an authenticated deployer`,
+        });
+    }
+    if (accessMode === 'public' && manifestUsesUserRoot(manifest)) {
+        return reject(400, {
+            error: 'public access mode cannot reference ${user}; use mixed for optional identity',
+        });
+    }
+    // Widget CSP gate (deploy-only): a CSP origin the host renderer will silently drop breaks the widget
+    // for end users, so the deploy is refused here. The compiler surfaces the same faults as non-blocking
+    // warnings, so `noodle dev`/`validate` still render the widget locally — only shipping is gated.
+    const [cspFault] = cspFaultsInManifest(manifest);
+    if (cspFault !== undefined) {
+        return reject(400, {
+            error: `widget "${cspFault.widget}" CSP ${cspFault.list} origin "${cspFault.value}" is not an ` +
+                `absolute https:// origin and would be dropped by the host renderer` +
+                (cspFault.suggestion !== undefined ? `; use "${cspFault.suggestion}"` : ''),
+        });
+    }
+    if ((await controlPlane.getOrg(tenant.org)) === undefined) {
+        await audit.emit({
+            eventType: 'deploy.rejected',
+            org: tenant.org,
+            app: tenant.app,
+            env: tenant.env,
+            decision: 'deny',
+            status: 404,
+            reasonCode: 'organization_not_found',
+            ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
+            ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
+        });
+        return reject(404, {
+            code: 'organization_not_found',
+            error: 'organization must be created before deploy',
+        });
+    }
+    const logger = options.logger ?? noopLogger;
+    if (hostedAssets !== undefined && hostedAssets.length > 0) {
+        if (options.assetStore === undefined) {
+            await audit.emit({
+                eventType: 'asset.rejected',
+                org: tenant.org,
+                app: tenant.app,
+                env: tenant.env,
+                decision: 'deny',
+                status: 400,
+                reasonCode: 'asset_store_not_configured',
+                ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
+                ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
+                details: { assetCount: hostedAssets.length },
+            });
+            return reject(400, { error: 'hosted assets are not configured for this service' });
+        }
+        const verified = await options.assetStore.verifyUploadedAssets({
+            scope: assetScope,
+            assets: hostedAssets,
+        });
+        if (!verified.ok) {
+            await audit.emit({
+                eventType: 'asset.rejected',
+                org: tenant.org,
+                app: tenant.app,
+                env: tenant.env,
+                decision: 'deny',
+                status: 400,
+                reasonCode: 'asset_verification_failed',
+                ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
+                ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
+                details: { assetCount: hostedAssets.length },
+            });
+            return reject(400, { error: verified.error });
+        }
+        hostedAssets = verified.assets;
+    }
+    let result;
+    try {
+        result = await registry.deploy(tenant, manifest, {
+            connectors,
+            actor: identity || undefined,
+            accessMode,
+            ownerSubject,
+            ...(orgMembershipSources !== undefined ? { orgMembershipSources } : {}),
+            hostedAssets,
+            serverVersion,
+            deploymentSource: automationId === undefined ? (deploymentSource ?? 'api') : 'github',
+            ...(idempotency.key !== undefined ? { idempotencyKey: idempotency.key } : {}),
+            ...(automationId === undefined ? {} : { automationId }),
+        });
+    }
+    catch (error) {
+        const rejected = await deploymentActivationRejection(error, {
+            audit,
+            eventType: 'deploy.rejected',
+            org: tenant.org,
+            app: tenant.app,
+            env: tenant.env,
+            ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
+            ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
+        });
+        if (rejected !== undefined)
+            return reject(rejected.status, rejected.body);
+        throw error;
+    }
+    if (!result.ok) {
+        if ('conflict' in result) {
+            if (result.code === 'deployment_locked') {
+                await audit.emit({
+                    eventType: 'deploy.rejected',
+                    org: tenant.org,
+                    app: tenant.app,
+                    env: tenant.env,
+                    decision: 'deny',
+                    status: 409,
+                    reasonCode: result.code,
+                    ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
+                    ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
+                    details: { serverVersion },
+                });
+            }
+            return reject(409, {
+                ok: false,
+                code: result.code,
+                error: result.message,
+            });
+        }
+        if ('superseded' in result) {
+            if (automationId !== undefined) {
+                await options.deploymentAutomation
+                    ?.recordSuperseded?.({ automationId, target: tenant })
+                    .catch(() => undefined);
+            }
+            return reject(409, {
+                ok: false,
+                code: 'run_superseded',
+                error: 'a newer GitHub deploy run exists for this app/env; this run was not activated',
+                deploymentId: result.deploymentId,
+                ...(result.serverVersion !== undefined ? { serverVersion: result.serverVersion } : {}),
+            });
+        }
+        // Codes are safe enum strings; never a path-with-value. No secret name or value is logged.
+        const codes = result.errors.map((error) => error.code).join(',');
+        logger.warn('deploy.rejected', {
+            status: 400,
+            errorCount: result.errors.length,
+            codes,
+        });
+        // Durable audit: a rejected deploy is a governance event. Safe fields only — no manifest body.
+        await audit.emit({
+            eventType: 'deploy.rejected',
+            org: tenant.org,
+            app: tenant.app,
+            env: tenant.env,
+            decision: 'deny',
+            status: 400,
+            reasonCode: 'compile_failed',
+            ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
+            ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
+            details: { errorCount: result.errors.length, codes },
+        });
+        return reject(400, { ok: false, errors: result.errors });
+    }
+    // Counts only — never secret names or values.
+    logger.info('deploy.ok', {
+        deploymentId: result.deploymentId,
+        serverVersion: result.serverVersion,
+        org: tenant.org,
+        app: tenant.app,
+        env: tenant.env,
+        hasConnectors: connectors !== undefined,
+    });
+    await audit.emit({
+        eventType: 'deploy.accepted',
+        org: tenant.org,
+        app: tenant.app,
+        env: tenant.env,
+        decision: 'allow',
+        status: 201,
+        ...(result.deploymentId !== undefined ? { deploymentId: result.deploymentId } : {}),
+        ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
+        ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
+        details: {
+            accessMode: result.accessMode ?? accessMode,
+            deploymentSource: automationId === undefined ? (deploymentSource ?? 'api') : 'github',
+            ...(ownerSubject !== undefined ? { ownerSubject } : {}),
+            serverVersion: result.serverVersion,
+            hasConnectors: connectors !== undefined,
+        },
+    });
+    // Tenant-safe developer-facing log (M3, ADR 0101): a safe deploy-lifecycle record the developer can read
+    // via `noodle logs`. Only scalar metadata, no manifest/secret/payload material.
+    await options.userAppLogStore?.emit({
+        level: 'info',
+        message: 'deployment live',
+        org: tenant.org,
+        app: tenant.app,
+        env: tenant.env,
+        ...(result.deploymentId !== undefined ? { deploymentId: result.deploymentId } : {}),
+        details: { accessMode: result.accessMode ?? accessMode, serverVersion: result.serverVersion },
+    });
+    if (result.ok && hostedAssets !== undefined && hostedAssets.length > 0) {
+        await audit.emit({
+            eventType: 'asset.activation.accepted',
+            org: tenant.org,
+            app: tenant.app,
+            env: tenant.env,
+            decision: 'allow',
+            status: 201,
+            deploymentId: result.deploymentId,
+            ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
+            ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
+            details: {
+                assetCount: hostedAssets.length,
+                totalBytes: hostedAssets.reduce((sum, asset) => sum + asset.byteLength, 0),
+            },
+        });
+        await options.assetStore?.recordReachability({
+            scope: assetScope,
+            deploymentId: result.deploymentId,
+            deploymentVersion: result.deploymentVersion,
+            assets: hostedAssets,
+        });
+    }
+    const embedId = await provisionPublicEmbed(registry, options, tenant, result.deploymentId);
+    return { ok: true, result, ...(embedId === undefined ? {} : { embedId }) };
+}
+function reject(status, body) {
+    return { ok: false, status, body };
+}
+//# sourceMappingURL=deployment-execution.js.map

package/node_modules/@noodle-borg/service/dist/external-credential-binding-broker.js

@@ -1,3 +1,4 @@
+import { externalCredentialExchangeResponseSchema } from '@noodle-borg/external-credential-provider';
 import { CredentialUnavailableError, MapServiceBroker, } from '@noodle-borg/runtime';
 import { routeBoundCredentialKey } from './credential-route-key.js';
 import { exchangeExternalCredential, resolveExternalCredentialProviderConfig, } from './external-credential-exchange.js';
@@ -17,6 +18,23 @@ export class ExternalCredentialBindingBroker {
             request.deploymentId !== this.options.deployment) {
             throw new CredentialUnavailableError('credential_not_configured');
         }
+        if ('localProvider' in this.options) {
+            try {
+                const value = externalCredentialExchangeResponseSchema.parse(await this.options.localProvider.getCredential({
+                    tenantId: this.options.tenant,
+                    deploymentId: this.options.deployment,
+                    descriptor: allowed.descriptor,
+                    ...(request.expectedConnectionGeneration === undefined
+                        ? {}
+                        : { expectedConnectionGeneration: request.expectedConnectionGeneration }),
+                }));
+                return { token: value.access_token };
+            }
+            catch {
+                throw new CredentialUnavailableError('credential_exchange_failed');
+            }
+        }
+        const options = this.options;
         const pinOrVerify = resolveSubjectPinCallable(this.options.subjectPins);
         if (pinOrVerify === undefined) {
             throw new CredentialUnavailableError('credential_not_configured');
@@ -57,7 +75,7 @@ export class ExternalCredentialBindingBroker {
             let exchanged;
             try {
                 exchanged = await exchangeExternalCredential({
-                    options: this.options,
+                    options,
                     descriptor: allowed.descriptor,
                     config,
                     nowMs: this.now(),

package/node_modules/@noodle-borg/service/dist/external-credential-exchange.d.ts

@@ -69,7 +69,22 @@ export interface ExternalCredentialExchangeOptions {
     readonly dnsLookup?: DnsLookup;
     readonly timeoutSignal?: (timeoutMs: number) => AbortSignal;
 }
-export type ExternalCredentialExchangeRuntimeOptions = Pick<ExternalCredentialExchangeOptions, 'issuer' | 'signer' | 'providers' | 'subjectPins'>;
+/** In-process portable authority; the same compiled binding is still enforced by ManagedConfigBroker. */
+export interface LocalExternalCredentialProvider {
+    getCredential(input: {
+        readonly tenantId: string;
+        readonly deploymentId: string;
+        readonly descriptor: CredentialBindingDescriptor;
+        readonly expectedConnectionGeneration?: string;
+    }): Promise<ExternalCredentialExchangeResponse>;
+}
+export interface LocalExternalCredentialExchangeOptions {
+    readonly tenant: string;
+    readonly deployment: string;
+    readonly localProvider: LocalExternalCredentialProvider;
+}
+export type BoundExternalCredentialExchangeOptions = ExternalCredentialExchangeOptions | LocalExternalCredentialExchangeOptions;
+export type ExternalCredentialExchangeRuntimeOptions = Pick<ExternalCredentialExchangeOptions, 'issuer' | 'signer' | 'providers' | 'subjectPins'> | Pick<LocalExternalCredentialExchangeOptions, 'localProvider'>;
 export declare function resolveExternalCredentialProviderConfig(options: ExternalCredentialExchangeOptions, descriptor: CredentialBindingDescriptor): Promise<ExternalCredentialProviderConfig | undefined>;
 export declare function exchangeExternalCredential(input: {
     readonly options: ExternalCredentialExchangeOptions;

package/node_modules/@noodle-borg/service/dist/modules/host.js

@@ -13,6 +13,7 @@ export class ModuleHost {
     toolDispatch;
     deploymentActivation;
     organizationProvisioning;
+    resolveActivityHistoryAllowance;
     admissionGate;
     moduleCapabilities;
     moduleCapabilityDetails;
@@ -32,6 +33,7 @@ export class ModuleHost {
         this.toolDispatch = toolDispatchFor(modules, options.toolDispatch);
         this.deploymentActivation = collectDeploymentActivation(modules);
         this.organizationProvisioning = singleContribution(modules, 'organizationProvisioning');
+        this.resolveActivityHistoryAllowance = singleContribution(modules, 'resolveActivityHistoryAllowance');
         if (this.deploymentAutomation !== undefined &&
             !this.deploymentActivation.some((hook) => hook.phase === DEPLOYMENT_ACTIVATION_PHASE.AUTOMATION_FRESHNESS)) {
             throw new Error('deployment automation requires an automation-freshness activation hook');
@@ -125,7 +127,8 @@ function deriveModuleCapabilities(modules) {
             contributions.toolDispatch !== undefined ||
             contributions.deploymentActivation !== undefined ||
             contributions.organizationProvisioning !== undefined ||
-            contributions.deploymentAutomation !== undefined) {
+            contributions.deploymentAutomation !== undefined ||
+            contributions.resolveActivityHistoryAllowance !== undefined) {
             found.add('controls');
         }
         if (contributions.auditStore !== undefined ||

package/node_modules/@noodle-borg/service/dist/native-record-connector.d.ts

@@ -0,0 +1,20 @@
+import { type DailyCounterStore } from '@noodle-borg/admission-limits/portable';
+import { type RuntimeArtifact } from '@noodle-borg/compiler';
+import { type Connector } from '@noodle-borg/runtime';
+import type { BusinessInformationStore } from './business-information/contracts.js';
+import type { TenantRef } from './store.js';
+export interface NativeRecordConnectorInput {
+    readonly tenant: TenantRef;
+    readonly artifact: RuntimeArtifact;
+    readonly deploymentId?: string;
+}
+export interface NativeRecordConnectorDependencies {
+    readonly store: BusinessInformationStore;
+    readonly counters: DailyCounterStore;
+    readonly publicIntakeEnabled?: boolean;
+    readonly now?: () => Date;
+}
+export type NativeRecordConnectorFactory = (input: NativeRecordConnectorInput) => Connector | undefined;
+/** Platform composition supplies storage; an authored declaration alone grants no installed authority. */
+export declare function createDeploymentNativeRecordConnector(input: NativeRecordConnectorInput, dependencies: NativeRecordConnectorDependencies): Connector | undefined;
+//# sourceMappingURL=native-record-connector.d.ts.map