@noodleseed/one 0.162.0 → 0.163.0

package/node_modules/@noodle-borg/service/dist/business-information/source-ingestion-pagination.js

@@ -0,0 +1,54 @@
+import { scopeKey } from './pagination.js';
+import { sourceDigest, sourceInteger } from './source-ingestion-validation.js';
+import { CursorValidationError, validateScalar } from './validation.js';
+export function externalRecordPageLimit(value) {
+    return sourceInteger('external record page limit', value ?? 100, 1, 500);
+}
+export function encodeExternalRecordCursor(binding, lastIdentityDigest) {
+    const cursor = {
+        version: 1,
+        kind: 'external-records',
+        scope: scopeKey(binding.scope),
+        collectionKey: binding.collectionKey,
+        bindingId: binding.id,
+        bindingGeneration: binding.generation,
+        lastIdentityDigest: sourceDigest('source identity digest', lastIdentityDigest),
+    };
+    return Buffer.from(JSON.stringify(cursor), 'utf8').toString('base64url');
+}
+export function decodeExternalRecordCursor(value, binding) {
+    if (value === undefined)
+        return undefined;
+    try {
+        const decoded = JSON.parse(Buffer.from(validateScalar('cursor', value, 2_048), 'base64url').toString('utf8'));
+        if (!isExternalRecordCursor(decoded))
+            throw new CursorValidationError();
+        if (decoded.scope !== scopeKey(binding.scope) ||
+            decoded.collectionKey !== binding.collectionKey ||
+            decoded.bindingId !== binding.id ||
+            decoded.bindingGeneration !== binding.generation) {
+            throw new CursorValidationError('cursor does not belong to this source binding');
+        }
+        return decoded.lastIdentityDigest;
+    }
+    catch (error) {
+        if (error instanceof CursorValidationError)
+            throw error;
+        throw new CursorValidationError();
+    }
+}
+function isExternalRecordCursor(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return false;
+    const input = value;
+    return (input.version === 1 &&
+        input.kind === 'external-records' &&
+        typeof input.scope === 'string' &&
+        typeof input.collectionKey === 'string' &&
+        typeof input.bindingId === 'string' &&
+        Number.isSafeInteger(input.bindingGeneration) &&
+        (input.bindingGeneration ?? 0) > 0 &&
+        typeof input.lastIdentityDigest === 'string' &&
+        /^[a-f0-9]{64}$/.test(input.lastIdentityDigest));
+}
+//# sourceMappingURL=source-ingestion-pagination.js.map

package/node_modules/@noodle-borg/service/dist/business-information/source-ingestion-validation.js

@@ -0,0 +1,163 @@
+import { createHash, createHmac } from 'node:crypto';
+import { scopeKey } from './pagination.js';
+import { validateScalar, validateScope } from './validation.js';
+export function normalizeSourceBindingCreate(input) {
+    return {
+        scope: structuredClone(validateScope(input.scope)),
+        collectionKey: validateScalar('source collection key', input.collectionKey, 128),
+        id: validateScalar('source binding id', input.id, 128),
+        ...(input.bindingReference === undefined
+            ? {}
+            : {
+                bindingReference: validateScalar('source binding reference', input.bindingReference, 128),
+            }),
+        ...(input.configurationReference === undefined
+            ? {}
+            : {
+                configurationReference: validateScalar('source configuration reference', input.configurationReference, 128),
+            }),
+        ...(input.credentialIdentity === undefined
+            ? {}
+            : {
+                credentialIdentity: {
+                    ...(input.credentialIdentity.generation === undefined
+                        ? {}
+                        : {
+                            generation: validateScalar('source credential generation', input.credentialIdentity.generation, 128),
+                        }),
+                    ...(input.credentialIdentity.account === undefined
+                        ? {}
+                        : {
+                            account: validateScalar('source credential account', input.credentialIdentity.account, 128),
+                        }),
+                    ...(input.credentialIdentity.configuration === undefined
+                        ? {}
+                        : {
+                            configuration: validateScalar('source configuration generation', input.credentialIdentity.configuration, 128),
+                        }),
+                },
+            }),
+        generation: sourceInteger('source binding generation', input.generation, 1, Number.MAX_SAFE_INTEGER),
+        schemaVersion: sourceInteger('source schema version', input.schemaVersion, 1, 1_000_000),
+        schemaDigest: sourceDigest('source schema digest', input.schemaDigest),
+        queryFingerprint: sourceDigest('source query fingerprint', input.queryFingerprint),
+        scan: normalizeOperation(input.scan),
+        retentionDays: sourceRetentionDays(input.retentionDays),
+        pollIntervalMs: sourceInteger('source poll interval', input.pollIntervalMs, 5_000, 86_400_000),
+    };
+}
+export function sourceBindingCreateFrom(value) {
+    return {
+        scope: value.scope,
+        collectionKey: value.collectionKey,
+        id: value.id,
+        ...(value.bindingReference === undefined ? {} : { bindingReference: value.bindingReference }),
+        ...(value.configurationReference === undefined
+            ? {}
+            : { configurationReference: value.configurationReference }),
+        ...(value.credentialIdentity === undefined
+            ? {}
+            : { credentialIdentity: { ...value.credentialIdentity } }),
+        generation: value.generation,
+        schemaVersion: value.schemaVersion,
+        schemaDigest: value.schemaDigest,
+        queryFingerprint: value.queryFingerprint,
+        scan: value.scan,
+        retentionDays: value.retentionDays,
+        pollIntervalMs: value.pollIntervalMs,
+    };
+}
+export function sourceBindingFingerprint(value) {
+    return sourceJsonDigest(value);
+}
+export function sourceBindingValues(input) {
+    const scope = validateScope(input.scope);
+    return [
+        scope.org,
+        scope.app,
+        scope.env,
+        scope.installationId,
+        validateScalar('source collection key', input.collectionKey, 128),
+        validateScalar('source binding id', input.id, 128),
+    ];
+}
+export function sourceIdentityDigest(identityKey, binding, sourceId) {
+    return createHmac('sha256', identityKey)
+        .update(`${scopeKey(binding.scope)}\0${binding.collectionKey}\0${binding.id}\0${binding.bindingReference ?? binding.id}\0${sourceToken('source record id', sourceId)}`)
+        .digest('hex');
+}
+export function normalizeSourceSuppression(input) {
+    const reason = input.reason;
+    if (reason !== 'customer_request' && reason !== 'source_access_revoked') {
+        throw new Error('source suppression reason is invalid');
+    }
+    return {
+        scope: structuredClone(validateScope(input.scope)),
+        collectionKey: validateScalar('source collection key', input.collectionKey, 128),
+        id: validateScalar('source binding id', input.id, 128),
+        bindingGeneration: sourceInteger('source binding generation', input.bindingGeneration, 1, Number.MAX_SAFE_INTEGER),
+        sourceIdentityDigest: sourceDigest('source identity digest', input.sourceIdentityDigest),
+        reason,
+        erasedAt: sourceInstant('source suppression time', input.erasedAt),
+    };
+}
+export function sourceToken(label, value) {
+    const normalized = value.trim();
+    if (normalized.length === 0 || normalized.length > 4_096 || /[\0\r\n]/.test(normalized)) {
+        throw new Error(`${label} is invalid`);
+    }
+    return normalized;
+}
+export function sourceDigest(label, value) {
+    if (!/^[a-f0-9]{64}$/.test(value))
+        throw new Error(`${label} must be a SHA-256 hex digest`);
+    return value;
+}
+export function sourceOperationSignatureDigest(value) {
+    const match = /^(?:sha256v2:|sha256:)?([a-f0-9]{64})$/.exec(value);
+    if (match?.[1] === undefined)
+        throw new Error('source operation signature is invalid');
+    return match[1];
+}
+export function sourceJsonDigest(value) {
+    return createHash('sha256').update(stableJson(value)).digest('hex');
+}
+export function sourceInteger(label, value, minimum, maximum) {
+    if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+        throw new Error(`${label} is outside the supported range`);
+    }
+    return value;
+}
+export function sourceInstant(label, value) {
+    const milliseconds = value instanceof Date ? value.getTime() : Date.parse(value);
+    if (!Number.isFinite(milliseconds))
+        throw new Error(`${label} is invalid`);
+    return new Date(milliseconds).toISOString();
+}
+function normalizeOperation(value) {
+    return {
+        connector: validateScalar('source connector', value.connector, 128),
+        connectorVersion: validateScalar('source connector version', value.connectorVersion, 128),
+        operation: validateScalar('source operation', value.operation, 128),
+        signatureDigest: sourceDigest('source operation signature', value.signatureDigest),
+    };
+}
+function sourceRetentionDays(value) {
+    if (value !== 7 && value !== 30 && value !== 90) {
+        throw new Error('source retention days must be 7, 30, or 90');
+    }
+    return value;
+}
+function stableJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(',')}]`;
+    if (value !== null && typeof value === 'object') {
+        return `{${Object.entries(value)
+            .filter(([, entry]) => entry !== undefined)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`)
+            .join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
+//# sourceMappingURL=source-ingestion-validation.js.map

package/node_modules/@noodle-borg/service/dist/business-information/source-refresh-retention.js

@@ -0,0 +1,29 @@
+import { SOURCE_REFRESH_REPLAY_MS } from './source-custody-budget.js';
+export function terminalRefresh(state) {
+    return state === 'completed' || state === 'superseded';
+}
+export function refreshReplayExpiresAt(terminalAt) {
+    return new Date(Date.parse(terminalAt) + SOURCE_REFRESH_REPLAY_MS).toISOString();
+}
+export function pruneMemoryRefreshReceipts(requests, now, limit) {
+    const expired = [...requests.entries()]
+        .filter(([, row]) => terminalRefresh(row.state) &&
+        row.terminalAt !== undefined &&
+        Date.parse(row.terminalAt) + SOURCE_REFRESH_REPLAY_MS <= now.getTime())
+        .sort((left, right) => (left[1].terminalAt ?? '').localeCompare(right[1].terminalAt ?? ''))
+        .slice(0, limit);
+    for (const [key] of expired)
+        requests.delete(key);
+    return expired.length;
+}
+export async function prunePostgresRefreshReceipts(client, organizations, limit) {
+    if (limit === 0)
+        return 0;
+    const result = await client.query(`DELETE FROM business_source_refresh_requests WHERE ctid IN (
+    SELECT ctid FROM business_source_refresh_requests WHERE org_slug=ANY($1::text[])
+      AND state IN ('completed','superseded') AND terminal_at<=clock_timestamp()-($2 * interval '1 millisecond')
+    ORDER BY terminal_at LIMIT $3 FOR UPDATE SKIP LOCKED
+  )`, [organizations, SOURCE_REFRESH_REPLAY_MS, limit]);
+    return result.rowCount ?? 0;
+}
+//# sourceMappingURL=source-refresh-retention.js.map

package/node_modules/@noodle-borg/service/dist/business-information-runtime.js

@@ -0,0 +1,80 @@
+import { resolveApplicationRuntimeTarget } from './application-runtime-target.js';
+import { InMemoryBusinessInformationStore, InMemorySourceIngestionStore, privateDefinitionFromDeployment, RegistrySourceReadExecutor, SourceIngestionCoordinator, validateManagedPayload, } from './business-information/portable.js';
+import { fenceSourceStore } from './business-information/source-credential-fence.js';
+import { createDeploymentNativeRecordConnector } from './native-record-connector.js';
+import { sourceConfigurationAuthority } from './source-configuration-authority.js';
+/** Compose generic business information ports without introducing application-specific records. */
+export function createBusinessInformationRuntime(registry, options, publicCounters) {
+    const businessInformationStore = options.businessInformationStore ??
+        (options.businessInformationEnabled === false
+            ? undefined
+            : new InMemoryBusinessInformationStore());
+    if (businessInformationStore)
+        registry.setApplicationLifecycleObserver((org, app, at, retired) => businessInformationStore.pauseApplication(org, app, at, retired));
+    if (businessInformationStore instanceof InMemoryBusinessInformationStore) {
+        businessInformationStore.configureApplicationLifecycle(async (scope) => {
+            const generation = await registry.getAppGeneration(scope.org, scope.app);
+            if (!generation)
+                return undefined;
+            return {
+                generation,
+                active: (await registry.getAppArchivedAt(scope.org, scope.app)) === undefined &&
+                    (await registry.getActiveByTenant(scope)) !== undefined,
+            };
+        });
+    }
+    const sourceStore = options.businessInformationSourceStore ??
+        (businessInformationStore === undefined
+            ? undefined
+            : new InMemorySourceIngestionStore({
+                identityKey: 'local-business-source-identity-key-v1',
+                ...(options.clock === undefined ? {} : { now: options.clock }),
+            }));
+    const sourceAuthority = sourceConfigurationAuthority(() => registry, options.connectionRuntime?.sourceCredentials);
+    const businessInformationSourceStore = sourceStore
+        ? fenceSourceStore(sourceStore, sourceAuthority)
+        : undefined;
+    const businessInformationSourceExecutor = options.businessInformationSourceExecutor ??
+        (businessInformationStore === undefined
+            ? undefined
+            : new RegistrySourceReadExecutor(registry, businessInformationStore, (target) => resolveApplicationRuntimeTarget(target, undefined, options.connectionRuntime?.readGenerations), sourceAuthority));
+    const sourceCoordinator = businessInformationSourceStore === undefined || businessInformationSourceExecutor === undefined
+        ? undefined
+        : new SourceIngestionCoordinator({
+            store: businessInformationSourceStore,
+            executor: businessInformationSourceExecutor,
+            workerId: 'service-refresh',
+            validateRecord: (_binding, value) => validateManagedPayload(value),
+            ...(options.clock === undefined ? {} : { now: options.clock }),
+        });
+    registry.setPlatformConnectors({
+        ...(businessInformationStore === undefined
+            ? {}
+            : {
+                nativeRecords: (input) => createDeploymentNativeRecordConnector(input, {
+                    store: businessInformationStore,
+                    counters: publicCounters,
+                    publicIntakeEnabled: options.businessInformationPublicIntakeEnabled !== false,
+                    ...(options.clock === undefined ? {} : { now: options.clock }),
+                }),
+            }),
+    });
+    return { businessInformationStore, businessInformationSourceStore, sourceCoordinator };
+}
+/** Resolve immutable same-organization private definition bytes; publisher configuration stays private. */
+export async function resolvePrivateInstallationDefinition(registry, selector) {
+    const source = await registry.getDeploymentSource({ org: selector.publisherOrg, app: selector.app, env: selector.environment }, selector.deploymentId);
+    if (!source)
+        return undefined;
+    const target = await registry.get(selector.deploymentId);
+    if (!target)
+        return undefined;
+    return privateDefinitionFromDeployment(selector, {
+        deploymentId: selector.deploymentId,
+        org: selector.publisherOrg,
+        app: selector.app,
+        environment: selector.environment,
+        artifact: target.served.artifact,
+    });
+}
+//# sourceMappingURL=business-information-runtime.js.map

package/node_modules/@noodle-borg/service/dist/business-onboarding.js

@@ -0,0 +1,73 @@
+import { agreementDocumentDigest, OrganizationAgreementError, validateAgreementDocuments, } from '@noodle-borg/control-plane/portable';
+import { AgreementDocumentsSchema, } from '@noodle-borg/wire-contracts';
+export const BUSINESS_SETUP_MESSAGE = 'Complete the organization agreement and business notice in Portal before activating this application. Retained records remain accessible.';
+export class BusinessSetupError extends Error {
+    code = 'business_setup_required';
+    constructor() {
+        super(BUSINESS_SETUP_MESSAGE);
+    }
+}
+/** Portable hosts may inject their own approved catalog; Noodle-hosted composition always installs this policy. */
+export function parseBusinessOnboarding(serialized) {
+    if (serialized === undefined)
+        return {};
+    if (serialized.length > 16384)
+        throw new Error('Organization agreement catalog is too large');
+    return { documents: AgreementDocumentsSchema.parse(JSON.parse(serialized)) };
+}
+export class BusinessOnboarding {
+    organizations;
+    installations;
+    #documents;
+    constructor(options, organizations, installations) {
+        this.organizations = organizations;
+        this.installations = installations;
+        this.#documents = options.documents ? validateAgreementDocuments(options.documents) : undefined;
+    }
+    async status(org, subject) {
+        const canAccept = (await this.organizations.getOrgMember({ org, subject }))?.role === 'owner';
+        const documents = this.#documents;
+        if (!documents)
+            return { canAccept, accepted: false, required: null };
+        const documentDigest = agreementDocumentDigest(documents);
+        const acceptance = await this.organizations.getOrganizationAgreement(org, documents.version);
+        const accepted = acceptance?.documentDigest === documentDigest;
+        return {
+            canAccept,
+            accepted,
+            required: { ...structuredClone(documents), documentDigest },
+            ...(acceptance
+                ? {
+                    receipt: {
+                        version: acceptance.documents.version,
+                        documentDigest: acceptance.documentDigest,
+                        acceptedAt: acceptance.acceptedAt,
+                    },
+                }
+                : {}),
+        };
+    }
+    async accept(org, subject, input) {
+        const status = await this.status(org, subject);
+        if (!status.canAccept)
+            throw new OrganizationAgreementError('agreement_owner_required');
+        if (!status.required ||
+            status.required.version !== input.version ||
+            status.required.documentDigest !== input.documentDigest)
+            throw new OrganizationAgreementError('agreement_version_conflict');
+        const documents = this.#documents;
+        if (!documents)
+            throw new BusinessSetupError();
+        await this.organizations.acceptOrganizationAgreement({ org, actorSubject: subject, documents });
+        return this.status(org, subject);
+    }
+    async ready(installation) {
+        const documents = this.#documents;
+        if (!documents)
+            return false;
+        const receipt = await this.organizations.getOrganizationAgreement(installation.scope.org, documents.version);
+        return (receipt?.documentDigest === agreementDocumentDigest(documents) &&
+            (await this.installations.getBusinessNotice(installation.scope)) !== undefined);
+    }
+}
+//# sourceMappingURL=business-onboarding.js.map

package/node_modules/@noodle-borg/service/dist/connections/types.js

@@ -0,0 +1,8 @@
+export class ConnectionError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+    }
+}
+//# sourceMappingURL=types.js.map

package/node_modules/@noodle-borg/service/dist/credential-binding-index.js

@@ -21,39 +21,44 @@ export function buildCredentialBindingIndex(artifact) {
             ? []
             : [artifact.server.context.ambient.fulfilment]),
     ];
-    for (const fulfilment of fulfilments) {
-        for (const ref of resolvedOperationRefs(fulfilment)) {
-            const credentialBinding = ref.credentialBinding;
-            if (credentialBinding === undefined)
-                continue;
-            const binding = artifact.connectorBindings?.[credentialBinding.bindingId];
-            if (binding === undefined ||
-                binding.connection.id !== credentialBinding.connectionId ||
-                binding.profile !== credentialBinding.profile ||
-                computeConnectionConfigRevision(binding.connection) !==
-                    credentialBinding.connectionConfigRevision) {
-                continue;
-            }
-            const descriptor = {
-                connectorId: ref.connectorId,
-                connectorVersion: ref.connectorVersion,
-                operation: ref.operation,
-                ...credentialBinding,
-            };
-            const key = MapServiceBroker.bindingKey(descriptor);
-            const source = structuredClone(binding.connection.source);
-            const allowed = {
-                descriptor,
-                source,
-                ...(ref.customerEndpoint === undefined ? {} : { customerEndpoint: ref.customerEndpoint }),
-            };
-            byKey.set(key, allowed);
-            if (source.kind === 'externalExchange') {
-                externalExchange.set(key, allowed);
-            }
-            if (source.kind === 'googleWorkloadIdentity') {
-                googleWorkloadIdentity.set(key, allowed);
-            }
+    const sourceRefs = (artifact.server.managedCollections ?? []).flatMap((collection) => {
+        const source = collection.source;
+        if (source?.authority !== 'external')
+            return [];
+        return source.scan.resolved ? [source.scan] : [];
+    });
+    const operationRefs = [...fulfilments.flatMap(resolvedOperationRefs), ...sourceRefs];
+    for (const ref of operationRefs) {
+        const credentialBinding = ref.credentialBinding;
+        if (credentialBinding === undefined)
+            continue;
+        const binding = artifact.connectorBindings?.[credentialBinding.bindingId];
+        if (binding === undefined ||
+            binding.connection.id !== credentialBinding.connectionId ||
+            binding.profile !== credentialBinding.profile ||
+            computeConnectionConfigRevision(binding.connection) !==
+                credentialBinding.connectionConfigRevision) {
+            continue;
+        }
+        const descriptor = {
+            connectorId: ref.connectorId,
+            connectorVersion: ref.connectorVersion,
+            operation: ref.operation,
+            ...credentialBinding,
+        };
+        const key = MapServiceBroker.bindingKey(descriptor);
+        const source = structuredClone(binding.connection.source);
+        const allowed = {
+            descriptor,
+            source,
+            ...(ref.customerEndpoint === undefined ? {} : { customerEndpoint: ref.customerEndpoint }),
+        };
+        byKey.set(key, allowed);
+        if (source.kind === 'externalExchange') {
+            externalExchange.set(key, allowed);
+        }
+        if (source.kind === 'googleWorkloadIdentity') {
+            googleWorkloadIdentity.set(key, allowed);
         }
     }
     return {