@noodleseed/one 0.162.0 → 0.163.0

package/node_modules/@noodle-borg/service/dist/solution-installation-activation.js

@@ -0,0 +1,149 @@
+import { sha256Canonical } from '@noodle-borg/app-package';
+import { ApplicationSettings, installationSettingsTarget } from './application-settings.js';
+import { privateDefinitionFromDeployment } from './business-information/definition-resolver.js';
+import { managedSolutionManifest } from './business-information/managed-solution-executable.js';
+import { BUSINESS_SETUP_MESSAGE, BusinessOnboarding } from './business-onboarding.js';
+import { executeAuthorizedDeployment, } from './deployment-execution.js';
+/** Called after installation authorization, and by the managed-runtime refresh boundary. Never copies configuration. */
+export async function activateSolutionInstallation(input, dependencies) {
+    const { installation, actor } = input;
+    if (dependencies.options.businessOnboarding !== undefined &&
+        (!dependencies.businessInformationStore ||
+            !(await new BusinessOnboarding(dependencies.options.businessOnboarding, dependencies.controlPlane, dependencies.businessInformationStore).ready(installation)))) {
+        return reject(409, 'business_setup_required', BUSINESS_SETUP_MESSAGE);
+    }
+    const tenant = {
+        org: installation.scope.org,
+        app: installation.scope.app,
+        env: installation.scope.env,
+    };
+    const store = dependencies.businessInformationStore;
+    const stored = (await store?.getInstallation(installation.scope)) ?? installation;
+    const generation = await dependencies.registry.getAppGeneration(tenant.org, tenant.app);
+    if ((await dependencies.registry.getAppArchivedAt(tenant.org, tenant.app)) !== undefined ||
+        (stored.applicationGeneration !== 'pending' &&
+            (generation === undefined ||
+                (stored.applicationGeneration !== undefined &&
+                    stored.applicationGeneration !== generation)))) {
+        return reject(409, 'installation_application_unavailable', 'Restore the original application before activation. Retained records remain accessible.');
+    }
+    if (store &&
+        stored.applicationGeneration !== 'pending' &&
+        !(await store.bindApplication(installation.scope, generation ?? ''))) {
+        return reject(409, 'installation_application_unavailable', 'The retained installation requires application ownership recovery before activation.');
+    }
+    const bind = async (deploymentId) => {
+        const currentGeneration = await dependencies.registry.getAppGeneration(tenant.org, tenant.app);
+        if (store &&
+            (!currentGeneration || !(await store.bindApplication(installation.scope, currentGeneration))))
+            return reject(409, 'installation_application_unavailable', 'Application activation was interrupted; retained records remain accessible.');
+        if ((installation.definition.variables?.length ?? 0) > 0)
+            await new ApplicationSettings(dependencies.registry.configStore).initialize(installationSettingsTarget(installation));
+        return { ok: true, deploymentId };
+    };
+    const source = await executableSource(installation, dependencies.registry);
+    if (!source.ok)
+        return source;
+    const current = await dependencies.registry.getActiveByTenant(tenant);
+    const declarations = current?.served.artifact.server.variables ?? installation.definition.variables ?? [];
+    if (declarations.length > 0)
+        await new ApplicationSettings(dependencies.registry.configStore).initialize({
+            ...installationSettingsTarget(installation),
+            declarations,
+        });
+    const accessMode = current?.accessMode ?? source.value.accessMode;
+    const ownerSubject = accessMode === 'owner-only'
+        ? (current?.ownerSubject ?? installation.createdBySubject)
+        : undefined;
+    const currentSource = current?.deploymentId === undefined
+        ? undefined
+        : await dependencies.registry.getDeploymentSource(tenant, current.deploymentId);
+    if (current?.deploymentId !== undefined &&
+        currentSource !== undefined &&
+        currentSource.manifest === source.value.manifest &&
+        currentSource.connectors === source.value.connectors &&
+        JSON.stringify(currentSource.hostedAssets) === JSON.stringify(source.value.hostedAssets)) {
+        return bind(current.deploymentId);
+    }
+    const key = sha256Canonical({
+        scope: installation.scope,
+        definition: installation.definition.reference,
+        executable: source.value,
+        accessMode,
+        ownerSubject: ownerSubject ?? null,
+        orgMembershipSources: current?.orgMembershipSources ?? null,
+        predecessor: current?.deploymentId ?? null,
+    });
+    const deployed = await executeAuthorizedDeployment({
+        ...source.value,
+        tenant,
+        identity: actor,
+        accessMode,
+        ...(ownerSubject === undefined ? {} : { ownerSubject }),
+        ...(current?.orgMembershipSources === undefined
+            ? {}
+            : { orgMembershipSources: current.orgMembershipSources }),
+        deploymentSource: 'api',
+        idempotencyKey: key,
+    }, dependencies);
+    if (!deployed.ok)
+        return {
+            ok: false,
+            status: deployed.status,
+            code: typeof deployed.body.code === 'string'
+                ? deployed.body.code
+                : 'installation_activation_failed',
+            message: 'The installation is saved, but its application could not be activated. Retry installation after resolving the deployment requirement.',
+        };
+    return bind(deployed.result.deploymentId);
+}
+async function executableSource(installation, registry) {
+    const reference = installation.definition.reference;
+    if (reference.kind === 'managed') {
+        return {
+            ok: true,
+            value: {
+                manifest: JSON.stringify(managedSolutionManifest(installation.definition)),
+                accessMode: 'public',
+                serverVersion: '1',
+            },
+        };
+    }
+    if (reference.kind !== 'private')
+        return reject(409, 'definition_unavailable', 'This historical definition has no executable application.');
+    if (reference.publisherOrg !== installation.scope.org)
+        return reject(403, 'definition_forbidden', 'Private definitions must belong to the installation organization.');
+    const sourceScope = { org: reference.publisherOrg, app: reference.app, env: reference.env };
+    const source = await registry.getDeploymentSource(sourceScope, reference.deploymentId);
+    if (source === undefined)
+        return reject(409, 'definition_unavailable', 'The immutable source deployment is unavailable or archived.');
+    const target = await registry.get(reference.deploymentId);
+    if (target === undefined)
+        return reject(409, 'definition_unavailable', 'The immutable source deployment cannot be loaded.');
+    const verified = privateDefinitionFromDeployment({
+        publisherOrg: reference.publisherOrg,
+        app: reference.app,
+        environment: reference.env,
+        deploymentId: reference.deploymentId,
+    }, {
+        ...sourceScope,
+        environment: sourceScope.env,
+        deploymentId: reference.deploymentId,
+        artifact: target.served.artifact,
+    });
+    if (verified.reference.digest !== reference.digest)
+        return reject(409, 'definition_changed', 'The installation definition does not match its immutable source deployment.');
+    return {
+        ok: true,
+        value: {
+            ...source,
+            accessMode: source.accessMode ?? 'public',
+            serverVersion: source.serverVersion ?? '1',
+            assetSourceScope: sourceScope,
+        },
+    };
+}
+function reject(status, code, message) {
+    return { ok: false, status, code, message };
+}
+//# sourceMappingURL=solution-installation-activation.js.map

package/node_modules/@noodle-borg/service/dist/source-configuration-authority.js

@@ -0,0 +1,94 @@
+import { sha256Canonical } from '@noodle-borg/compiler';
+import { compileConnectors, connectorFileSchema, } from '@noodle-borg/connector-defs';
+import { parse as parseYaml } from 'yaml';
+import { SourceCredentialError, } from './business-information/source-credential-fence.js';
+import { normalizePersistedConnectorsForCompile } from './connector-normalize.js';
+import { buildCredentialBindingIndex } from './credential-binding-index.js';
+import { scopeChain } from './store/config-values.js';
+/** Capture only the source connector's declared dependencies; unrelated business settings do not invalidate it. */
+export function sourceConfigurationAuthority(getRegistry, credential) {
+    return {
+        async withCurrent(binding, work) {
+            const registry = getRegistry();
+            const target = await registry.getActiveByTenant(binding.scope);
+            const deployed = target?.deploymentId
+                ? await registry.getDeploymentSource(binding.scope, target.deploymentId)
+                : undefined;
+            if (!target || !deployed?.connectors || !registry.configStore.transactConfig)
+                throw new SourceCredentialError();
+            const file = connectorFileSchema.parse(parseYaml(normalizePersistedConnectorsForCompile(deployed.connectors)));
+            const selected = new Map();
+            const visit = (definition, name) => {
+                const operation = definition?.operations[name];
+                if (!definition || !operation)
+                    throw new SourceCredentialError();
+                const names = selected.get(definition) ?? new Set();
+                if (names.has(name))
+                    return;
+                names.add(name);
+                selected.set(definition, names);
+                if ('calls' in operation)
+                    for (const call of Object.values(operation.calls ?? {})) {
+                        const [id, child] = call.split('.');
+                        const matches = file.connectors.filter((item) => item.id === id);
+                        if (matches.length !== 1 || !child)
+                            throw new SourceCredentialError();
+                        visit(matches[0], child);
+                    }
+            };
+            visit(file.connectors.find((item) => item.id === binding.scan.connector && item.version === binding.scan.connectorVersion), binding.scan.operation);
+            const connectors = [...selected].map(([definition, names]) => ({
+                ...definition,
+                operations: Object.fromEntries(Object.entries(definition.operations).filter(([name]) => names.has(name))),
+            }));
+            const compiled = compileConnectors(JSON.stringify({ connectors }));
+            if (!compiled.ok)
+                throw new SourceCredentialError();
+            const variables = new Set(compiled.variableBindings);
+            const secrets = new Set(compiled.secretBindings.flatMap((item) => (item.secretRef ? [item.secretRef] : [])));
+            const account = [...buildCredentialBindingIndex(target.served.artifact).byKey.values()].find((item) => item.descriptor.connectionId === binding.bindingReference &&
+                item.descriptor.connectorId === binding.scan.connector &&
+                item.descriptor.operation === binding.scan.operation)?.source;
+            for (const match of JSON.stringify(account ?? {}).matchAll(/\$\{env\.([A-Za-z0-9_]+)\}/g))
+                if (match[1])
+                    variables.add(match[1]);
+            if (account?.kind === 'managedSecret')
+                secrets.add(account.secret);
+            if (account?.kind === 'clientCredentials')
+                secrets.add(account.clientSecret);
+            const defaults = target.served.artifact.server.variables?.filter((item) => variables.has(item.name)) ?? [];
+            return registry.configStore.transactConfig(binding.scope.org, async (transaction) => {
+                if ((await registry.getActiveByTenant(binding.scope))?.deploymentId !== target.deploymentId)
+                    throw new SourceCredentialError();
+                const effective = new Map();
+                for (const scope of scopeChain({ level: 'env', ...binding.scope }))
+                    for (const kind of ['variable', 'secret']) {
+                        for (const row of await transaction.listConfigValues(kind, scope)) {
+                            if (!(kind === 'variable' ? variables : secrets).has(row.name))
+                                continue;
+                            if (!row.generation)
+                                throw new SourceCredentialError();
+                            const key = `${kind}:${row.name}`;
+                            if (row.valueOrigin !== 'default' ||
+                                !effective.has(key) ||
+                                effective.get(key)?.valueOrigin === 'default')
+                                effective.set(key, row);
+                        }
+                    }
+                const configuration = sha256Canonical({
+                    connectors,
+                    account,
+                    defaults: defaults
+                        .filter((item) => !effective.has(`variable:${item.name}`))
+                        .map((item) => ({ name: item.name, default: item.default })),
+                    rows: [...effective]
+                        .sort(([a], [b]) => a.localeCompare(b))
+                        .map(([key, row]) => [key, row.scope, row.generation]),
+                });
+                const guarded = async (identity) => work({ ...identity, configuration });
+                return credential ? credential.withCurrent(binding, guarded) : work({ configuration });
+            });
+        },
+    };
+}
+//# sourceMappingURL=source-configuration-authority.js.map

package/node_modules/@noodle-borg/service/dist/state-catalog.js

@@ -1,3 +1,4 @@
+import { BUILTIN_RECORD_CATALOG_CONNECTOR } from '@noodle-borg/compiler';
 import { STATE_CONNECTOR_ID, STATE_CONNECTOR_VERSION, STATE_OPERATION_SIGNATURES, } from '@noodle-borg/runtime';
 export const BUILTIN_STATE_CATALOG_CONNECTOR = {
     id: STATE_CONNECTOR_ID,
@@ -6,10 +7,10 @@ export const BUILTIN_STATE_CATALOG_CONNECTOR = {
     operations: STATE_OPERATION_SIGNATURES,
 };
 export function withBuiltinStateCatalog(catalog) {
-    if (catalog.some((connector) => connector.id === BUILTIN_STATE_CATALOG_CONNECTOR.id &&
-        connector.version === BUILTIN_STATE_CATALOG_CONNECTOR.version)) {
-        return catalog;
-    }
-    return [BUILTIN_STATE_CATALOG_CONNECTOR, ...catalog];
+    const builtins = [BUILTIN_STATE_CATALOG_CONNECTOR, BUILTIN_RECORD_CATALOG_CONNECTOR];
+    return [
+        ...builtins,
+        ...catalog.filter((entry) => !builtins.some((builtin) => builtin.id === entry.id)),
+    ];
 }
 //# sourceMappingURL=state-catalog.js.map

package/node_modules/@noodle-borg/service/dist/store/config-values.d.ts

@@ -13,6 +13,8 @@ export type ConfigScope = {
     readonly env: string;
 };
 export interface ConfigValueMetadata {
+    /** Internal mutation identity; non-enumerable and excluded from operator wire projections. */
+    readonly generation?: string;
     readonly kind: ManagedConfigKind;
     readonly scope: ConfigScope;
     readonly name: string;
@@ -20,38 +22,61 @@ export interface ConfigValueMetadata {
     readonly updatedBySubject?: string;
     readonly updatedByEmail?: string;
     readonly value?: string;
+    readonly valueOrigin?: 'default';
+}
+export interface ConfigValueInput {
+    readonly kind: ManagedConfigKind;
+    readonly scope: ConfigScope;
+    readonly name: string;
+    readonly value: string;
+    readonly updatedBySubject?: string;
+    readonly updatedByEmail?: string;
+    readonly valueOrigin?: 'default';
 }
 export interface ConfigStore {
-    setConfigValue(input: {
-        readonly kind: ManagedConfigKind;
-        readonly scope: ConfigScope;
-        readonly name: string;
-        readonly value: string;
-        readonly updatedBySubject?: string;
-        readonly updatedByEmail?: string;
-    }): Promise<ConfigValueMetadata>;
+    setConfigValue(input: ConfigValueInput): Promise<ConfigValueMetadata>;
     deleteConfigValue(kind: ManagedConfigKind, scope: ConfigScope, name: string): Promise<boolean>;
     listConfigValues(kind: ManagedConfigKind, scope: ConfigScope): Promise<readonly ConfigValueMetadata[]>;
     resolveConfigValues(kind: ManagedConfigKind, scope: ConfigScope, name?: string): Promise<Record<string, string>>;
+    /** Atomic organization-scoped snapshot. Required for hosted business-setting mutations. */
+    transactConfig?<T>(org: string, work: (transaction: ConfigStore) => Promise<T>): Promise<T>;
 }
-export declare class InMemoryConfigStore implements ConfigStore {
+declare class MemoryConfigSnapshot implements ConfigStore {
     #private;
-    setConfigValue(input: {
-        readonly kind: ManagedConfigKind;
-        readonly scope: ConfigScope;
-        readonly name: string;
-        readonly value: string;
-        readonly updatedBySubject?: string;
-        readonly updatedByEmail?: string;
-    }): Promise<ConfigValueMetadata>;
+    get records(): Map<string, ConfigRecord>;
+    set records(value: Map<string, ConfigRecord>);
+    setConfigValue(input: ConfigValueInput): Promise<ConfigValueMetadata>;
     deleteConfigValue(kind: ManagedConfigKind, scope: ConfigScope, name: string): Promise<boolean>;
     listConfigValues(kind: ManagedConfigKind, scope: ConfigScope): Promise<readonly ConfigValueMetadata[]>;
     resolveConfigValues(kind: ManagedConfigKind, scope: ConfigScope, name?: string): Promise<Record<string, string>>;
 }
+/** Copy-on-commit isolates readers from partially applied batches; transactions serialize writers. */
+export declare class InMemoryConfigStore extends MemoryConfigSnapshot {
+    #private;
+    setConfigValue(input: ConfigValueInput): Promise<ConfigValueMetadata>;
+    deleteConfigValue(kind: ManagedConfigKind, scope: ConfigScope, name: string): Promise<boolean>;
+    transactConfig<T>(org: string, work: (transaction: ConfigStore) => Promise<T>): Promise<T>;
+}
+/** Prevent a transaction from reaching an organization outside its acquired lock. */
+export declare function scopeConfigTransaction(org: string, transaction: ConfigStore): ConfigStore;
 export declare function resolveConfigScope(input: {
     readonly org: string;
     readonly app?: string;
     readonly env?: string;
 }): ConfigScope;
 export declare function scopeChain(scope: ConfigScope): readonly ConfigScope[];
+interface ConfigRecord {
+    readonly generation: string;
+    readonly kind: ManagedConfigKind;
+    readonly scope: ConfigScope;
+    readonly name: string;
+    readonly value: string;
+    readonly updatedAt: string;
+    readonly updatedBySubject?: string;
+    readonly updatedByEmail?: string;
+    readonly valueOrigin?: 'default';
+}
+/** Explicit operator values outrank pinned publisher defaults at every hierarchy level. */
+export declare function effectiveConfigValues(rows: readonly Pick<ConfigValueMetadata, 'name' | 'value' | 'valueOrigin'>[]): Record<string, string>;
+export {};
 //# sourceMappingURL=config-values.d.ts.map

package/node_modules/@noodle-borg/service/dist/store/config-values.js

@@ -1,6 +1,16 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { randomUUID } from 'node:crypto';
 import { validateConfigName, validateConfigScope } from './validate.js';
-export class InMemoryConfigStore {
+const memoryTransactions = new AsyncLocalStorage();
+class MemoryConfigSnapshot {
     #records = new Map();
+    get records() {
+        const context = memoryTransactions.getStore();
+        return context?.active && context.owner === this ? context.snapshot.records : this.#records;
+    }
+    set records(value) {
+        this.#records = value;
+    }
     setConfigValue(input) {
         const scope = validateConfigScope(input.scope);
         const name = validateConfigName(input.name);
@@ -10,46 +20,108 @@ export class InMemoryConfigStore {
             name,
             value: input.value,
             updatedAt: new Date().toISOString(),
+            generation: randomUUID(),
             ...(input.updatedBySubject !== undefined ? { updatedBySubject: input.updatedBySubject } : {}),
             ...(input.updatedByEmail !== undefined ? { updatedByEmail: input.updatedByEmail } : {}),
+            ...(input.valueOrigin === undefined ? {} : { valueOrigin: input.valueOrigin }),
         };
-        this.#records.set(configKey(input.kind, scope, name), record);
+        this.records.set(configKey(input.kind, scope, name), record);
         return Promise.resolve(toMetadata(record));
     }
     deleteConfigValue(kind, scope, name) {
-        return Promise.resolve(this.#records.delete(configKey(kind, validateConfigScope(scope), validateConfigName(name))));
+        return Promise.resolve(this.records.delete(configKey(kind, validateConfigScope(scope), validateConfigName(name))));
     }
     listConfigValues(kind, scope) {
         const safe = validateConfigScope(scope);
-        return Promise.resolve([...this.#records.values()]
+        return Promise.resolve([...this.records.values()]
             .filter((record) => record.kind === kind && sameScope(record.scope, safe))
             .sort((a, b) => a.name.localeCompare(b.name))
             .map(toMetadata));
     }
     resolveConfigValues(kind, scope, name) {
         const safeName = name === undefined ? undefined : validateConfigName(name);
-        const chain = scopeChain(validateConfigScope(scope));
-        if (safeName !== undefined) {
-            for (let index = chain.length - 1; index >= 0; index -= 1) {
-                const current = chain[index];
-                const record = [...this.#records.values()].find((candidate) => candidate.kind === kind &&
-                    candidate.name === safeName &&
-                    sameScope(candidate.scope, current));
-                if (record !== undefined)
-                    return Promise.resolve({ [safeName]: record.value });
+        const rows = scopeChain(validateConfigScope(scope)).flatMap((current) => [...this.records.values()].filter((record) => record.kind === kind &&
+            sameScope(record.scope, current) &&
+            (safeName === undefined || record.name === safeName)));
+        return Promise.resolve(effectiveConfigValues(rows));
+    }
+}
+/** Copy-on-commit isolates readers from partially applied batches; transactions serialize writers. */
+export class InMemoryConfigStore extends MemoryConfigSnapshot {
+    #pending = Promise.resolve();
+    setConfigValue(input) {
+        return this.transactConfig(input.scope.org, (transaction) => transaction.setConfigValue(input));
+    }
+    deleteConfigValue(kind, scope, name) {
+        return this.transactConfig(scope.org, (transaction) => transaction.deleteConfigValue(kind, scope, name));
+    }
+    async transactConfig(org, work) {
+        validateConfigScope({ level: 'org', org });
+        const active = memoryTransactions.getStore();
+        if (active?.active && active.owner === this) {
+            try {
+                if (active.org !== org)
+                    throw new Error('configuration transaction organization mismatch');
+                return await work(scopeConfigTransaction(org, active.snapshot));
             }
-            return Promise.resolve({});
-        }
-        const out = {};
-        for (const current of chain) {
-            for (const record of this.#records.values()) {
-                if (record.kind === kind && sameScope(record.scope, current))
-                    out[record.name] = record.value;
+            catch (error) {
+                active.failure ??= { error };
+                throw error;
             }
         }
-        return Promise.resolve(out);
+        const previous = this.#pending;
+        let release = () => { };
+        this.#pending = new Promise((resolve) => {
+            release = resolve;
+        });
+        await previous;
+        const snapshot = new MemoryConfigSnapshot();
+        snapshot.records = new Map(this.records);
+        const context = {
+            owner: this,
+            snapshot,
+            org,
+            active: true,
+            failure: undefined,
+        };
+        try {
+            const result = await memoryTransactions.run(context, () => work(scopeConfigTransaction(org, snapshot)));
+            if (context.failure)
+                throw context.failure.error;
+            this.records = snapshot.records;
+            return result;
+        }
+        finally {
+            context.active = false;
+            release();
+        }
     }
 }
+/** Prevent a transaction from reaching an organization outside its acquired lock. */
+export function scopeConfigTransaction(org, transaction) {
+    const check = (scope) => {
+        if (scope.org !== org)
+            throw new Error('configuration transaction organization mismatch');
+    };
+    return {
+        setConfigValue(input) {
+            check(input.scope);
+            return transaction.setConfigValue(input);
+        },
+        deleteConfigValue(kind, scope, name) {
+            check(scope);
+            return transaction.deleteConfigValue(kind, scope, name);
+        },
+        listConfigValues(kind, scope) {
+            check(scope);
+            return transaction.listConfigValues(kind, scope);
+        },
+        resolveConfigValues(kind, scope, name) {
+            check(scope);
+            return transaction.resolveConfigValues(kind, scope, name);
+        },
+    };
+}
 export function resolveConfigScope(input) {
     if (input.env !== undefined) {
         if (input.app === undefined)
@@ -85,14 +157,41 @@ function sameScope(a, b) {
     return scopePath(a) === scopePath(b);
 }
 function toMetadata(record) {
-    return {
+    return Object.defineProperty({
         kind: record.kind,
         scope: record.scope,
         name: record.name,
         updatedAt: record.updatedAt,
-        ...(record.updatedBySubject !== undefined ? { updatedBySubject: record.updatedBySubject } : {}),
+        ...(record.updatedBySubject !== undefined
+            ? { updatedBySubject: record.updatedBySubject }
+            : {}),
         ...(record.updatedByEmail !== undefined ? { updatedByEmail: record.updatedByEmail } : {}),
         ...(record.kind === 'variable' ? { value: record.value } : {}),
-    };
+        ...(record.valueOrigin === undefined ? {} : { valueOrigin: record.valueOrigin }),
+    }, 'generation', { value: record.generation });
+}
+/** Explicit operator values outrank pinned publisher defaults at every hierarchy level. */
+export function effectiveConfigValues(rows) {
+    const defaults = {};
+    const explicit = {};
+    for (const row of rows) {
+        if (row.value === undefined)
+            continue;
+        if (row.valueOrigin === 'default')
+            Object.defineProperty(defaults, row.name, {
+                value: row.value,
+                enumerable: true,
+                configurable: true,
+                writable: true,
+            });
+        else
+            Object.defineProperty(explicit, row.name, {
+                value: row.value,
+                enumerable: true,
+                configurable: true,
+                writable: true,
+            });
+    }
+    return { ...defaults, ...explicit };
 }
 //# sourceMappingURL=config-values.js.map

package/node_modules/@noodle-borg/service/dist/store/in-memory.d.ts

@@ -29,6 +29,7 @@ export declare class InMemoryArtifactStore implements ArtifactStore {
         readonly apps: readonly AppSummary[];
         readonly truncated: boolean;
     }>;
+    getAppGeneration(org: string, app: string): Promise<string | undefined>;
     getApp(org: string, app: string): Promise<AppSummary | undefined>;
     listEnvironments(org: string, app: string, opts?: {
         readonly includeArchived?: boolean;

package/node_modules/@noodle-borg/service/dist/store/in-memory.js

@@ -178,6 +178,9 @@ export class InMemoryArtifactStore {
         });
         return paginateAppSummaries(summarized, opts.limit);
     }
+    async getAppGeneration(org, app) {
+        return (await this.getApp(org, app))?.createdAt;
+    }
     async getApp(org, app) {
         const safeOrg = validateSlug('org', org);
         const safeApp = validateSlug('app', app);

package/node_modules/@noodle-borg/service/dist/store/json-file.d.ts

@@ -33,6 +33,7 @@ export declare class JsonFileArtifactStore implements ArtifactStore {
         readonly apps: readonly AppSummary[];
         readonly truncated: boolean;
     }>;
+    getAppGeneration(org: string, app: string): Promise<string | undefined>;
     getApp(org: string, app: string): Promise<AppSummary | undefined>;
     listEnvironments(org: string, app: string, opts?: {
         readonly includeArchived?: boolean;

package/node_modules/@noodle-borg/service/dist/store/json-file.js

@@ -244,6 +244,9 @@ export class JsonFileArtifactStore {
         });
         return paginateAppSummaries(summarized, opts.limit);
     }
+    async getAppGeneration(org, app) {
+        return (await this.getApp(org, app))?.createdAt;
+    }
     async getApp(org, app) {
         const safeOrg = validateSlug('org', org);
         const safeApp = validateSlug('app', app);

package/node_modules/@noodle-borg/service/dist/store.d.ts

@@ -7,7 +7,7 @@ import type { DeploymentSource } from '@noodle-borg/wire-contracts';
 import type { AppPackageSnapshotV1 } from './app-package-snapshot.js';
 import type { ProductionEnvironmentChange } from './store/environment-production.js';
 export type { ActiveMcpSubdomainClaim, ChangeMcpSubdomainInput, CreateOrgWithOwnerInput, McpSubdomainMutationResult, McpSubdomainSetting, OrgDomainRecord, OrgInvitationRecord, OrgMemberRecord, OrgOpenAIAppsChallengeRecord, OrgRecord, OrgRole, PersonalWorkspaceProvisionInput, PersonalWorkspaceProvisionResult, SignupAllowlistKind, SignupAllowlistRecord, WelcomeEmailRecord, } from '@noodle-borg/control-plane/portable';
-export { type ConfigScope, type ConfigStore, type ConfigValueMetadata, InMemoryConfigStore, type ManagedConfigKind, resolveConfigScope, scopeChain, } from './store/config-values.js';
+export { type ConfigScope, type ConfigStore, type ConfigValueInput, type ConfigValueMetadata, InMemoryConfigStore, type ManagedConfigKind, resolveConfigScope, scopeChain, } from './store/config-values.js';
 export type { ProductionEnvironmentChange } from './store/environment-production.js';
 export { InMemoryArtifactStore } from './store/in-memory.js';
 export { JsonFileArtifactStore } from './store/json-file.js';
@@ -340,6 +340,8 @@ export interface ArtifactStore {
     }>;
     /** One app's {@link AppSummary}; `undefined` when the app has no records and no anchor. */
     getApp(org: string, app: string): Promise<AppSummary | undefined>;
+    /** Authoritative app incarnation identity, independent of display summaries. */
+    getAppGeneration(org: string, app: string): Promise<string | undefined>;
     /**
      * The `envs` resource: one {@link EnvSummary} per environment for `app`, production first and then
      * alphabetically (see {@link summarizeEnvs}). Archived envs are excluded unless `includeArchived`.

package/node_modules/@noodle-borg/service/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.99.1",
+    "@noodle-borg/agent-kit": "0.100.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",
@@ -53,9 +53,9 @@
     "@noodle-borg/knowledge": "0.0.0",
     "@noodle-borg/knowledge-operations": "0.0.0",
     "@noodle-borg/module": "0.0.0",
-    "@noodle-borg/observability": "0.0.0",
     "@noodle-borg/module-audit": "0.0.0",
     "@noodle-borg/oauth-client-registry": "0.0.0",
+    "@noodle-borg/observability": "0.0.0",
     "@noodle-borg/protocol": "0.0.0",
     "@noodle-borg/runtime": "0.0.0",
     "@noodle-borg/service-modules": "0.0.0",

package/node_modules/@noodle-borg/transport-http/dist/serve-request.js

@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto';
+import { trustedPublicAdmission } from '@noodle-borg/admission-limits/portable';
 import { createDualEraMcpHandler, handleStatelessHttp, JSON_RPC, } from '@noodle-borg/protocol';
 import { admissionContexts, requestsInvocationContext } from './admission-context.js';
 import { authorizeIdentityMode, authorizeMixedMode, authorizePublicServiceMode, canonicalResourceUrl, isIdentityMode, } from './identity-authorization.js';
@@ -219,9 +220,17 @@ export async function serveRequest(req, res, target, auth, routeId, maxBody, all
             protocolContext = { ...protocolContext, invocationContext };
         }
     }
+    const publicAdmission = trustedPublicAdmission({
+        scope: target.deps.tenantId,
+        sourceAddress: req.socket.remoteAddress,
+        ...(protocolContext.caller?.subject === undefined
+            ? {}
+            : { subject: protocolContext.caller.subject }),
+    });
     protocolContext = {
         ...protocolContext,
         ...(auth.intentCaptureMode === 'starter-v1' ? { intentCapture: { enabled: true } } : {}),
+        ...(publicAdmission === undefined ? {} : { publicAdmission }),
         ...(auth.deploymentId !== undefined ? { deploymentId: auth.deploymentId } : {}),
         ...(auth.requestState !== undefined ? { requestState: auth.requestState } : {}),
         ...(auth.confirmationNonceLedger !== undefined

package/node_modules/@noodle-borg/transport-http/package.json

@@ -22,6 +22,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
+    "@noodle-borg/admission-limits": "0.0.0",
     "@noodle-borg/module": "0.0.0",
     "@noodle-borg/protocol": "0.0.0"
   },