@noodleseed/one 0.162.0 → 0.164.0

package/node_modules/@noodle-borg/control-plane/dist/organization-agreements.js

@@ -0,0 +1,74 @@
+import { createHash } from 'node:crypto';
+import { validateSlug } from './validation.js';
+export class OrganizationAgreementError extends Error {
+    code;
+    constructor(code) {
+        super(code === 'agreement_owner_required'
+            ? 'Organization owner required to accept agreements.'
+            : 'Agreement version has a different immutable document identity.');
+        this.code = code;
+        this.name = 'OrganizationAgreementError';
+    }
+}
+export function validateAgreementDocuments(input) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,79}$/.test(input.version))
+        throw new Error('Invalid agreement version');
+    const document = (value) => {
+        if (typeof value.url !== 'string' ||
+            value.url.length > 2048 ||
+            !/^[a-f0-9]{64}$/.test(value.sha256))
+            throw new Error('Invalid agreement document');
+        const url = new URL(value.url);
+        if (url.protocol !== 'https:' || url.username || url.password || url.hash)
+            throw new Error('Invalid agreement document URL');
+        return { url: value.url, sha256: value.sha256 };
+    };
+    return {
+        version: input.version,
+        terms: document(input.terms),
+        privacy: document(input.privacy),
+        processing: document(input.processing),
+    };
+}
+export function agreementDocumentDigest(documents) {
+    return createHash('sha256')
+        .update(JSON.stringify(validateAgreementDocuments(documents)))
+        .digest('hex');
+}
+/** Synchronous commit boundary keeps membership recheck, catalog registration and receipt indivisible. */
+export class InMemoryOrganizationAgreements {
+    isOwner;
+    now;
+    #catalog = new Map();
+    #receipts = new Map();
+    constructor(isOwner, now) {
+        this.isOwner = isOwner;
+        this.now = now;
+    }
+    getOrganizationAgreement(org, version) {
+        const receipt = this.#receipts.get(JSON.stringify([validateSlug('org', org), version]));
+        return Promise.resolve(receipt ? structuredClone(receipt) : undefined);
+    }
+    async acceptOrganizationAgreement(input) {
+        const org = validateSlug('org', input.org);
+        if (!this.isOwner(org, input.actorSubject))
+            throw new OrganizationAgreementError('agreement_owner_required');
+        const documents = validateAgreementDocuments(input.documents);
+        const documentDigest = agreementDocumentDigest(documents);
+        const registered = this.#catalog.get(documents.version);
+        if (registered !== undefined && registered !== documentDigest)
+            throw new OrganizationAgreementError('agreement_version_conflict');
+        const key = JSON.stringify([org, documents.version]);
+        const receipt = this.#receipts.get(key) ?? {
+            org,
+            actorSubject: input.actorSubject,
+            documents,
+            documentDigest,
+            acceptedAt: this.now().toISOString(),
+        };
+        this.#catalog.set(documents.version, documentDigest);
+        this.#receipts.set(key, receipt);
+        return structuredClone(receipt);
+    }
+}
+//# sourceMappingURL=organization-agreements.js.map

package/node_modules/@noodle-borg/control-plane/dist/portable.d.ts

@@ -6,6 +6,7 @@ export { CompositeControlPlaneGate, type ControlPlaneSignupMode, GoogleControlPl
 export { InMemoryControlPlaneStore } from './in-memory-control-plane-store.js';
 export { bindInMemoryOrganizationStore, type InMemoryOrganizationOperations, InMemoryOrganizationStore, } from './in-memory-organization-store.js';
 export { InMemoryMcpSubdomainClaimStore, McpSubdomainCooldownError, McpSubdomainIdempotencyConflictError, McpSubdomainOwnerRequiredError, type McpSubdomainRouteRef, McpSubdomainUnavailableError, mcpSubdomainEndpointOptions, type ResolvedMcpTenantRef, resolveMcpSubdomainTenant, } from './mcp-subdomain-claims.js';
+export { type AcceptOrganizationAgreementInput, type AgreementDocument, type AgreementDocuments, agreementDocumentDigest, type OrganizationAgreementAcceptance, OrganizationAgreementError, type OrganizationAgreementStore, validateAgreementDocuments, } from './organization-agreements.js';
 export { domainFromEmail, domainKey, memberKey, normalizeSignupAllowlistValue, personalOrgSlug, personalOrgSlugSuffix, signupKey, } from './organization-helpers.js';
 export { ensurePersonalWorkspace } from './personal-workspace.js';
 export { type RollbackControlPlane, type RollbackOperationDependencies, type RollbackOperationInput, type RollbackOperationResult, type RollbackRegistry, rollbackDeploymentOperation, } from './rollback-deployment.js';

package/node_modules/@noodle-borg/control-plane/dist/portable.js

@@ -5,6 +5,7 @@ export { CompositeControlPlaneGate, GoogleControlPlaneGate, GoogleWorkloadContro
 export { InMemoryControlPlaneStore } from './in-memory-control-plane-store.js';
 export { bindInMemoryOrganizationStore, InMemoryOrganizationStore, } from './in-memory-organization-store.js';
 export { InMemoryMcpSubdomainClaimStore, McpSubdomainCooldownError, McpSubdomainIdempotencyConflictError, McpSubdomainOwnerRequiredError, McpSubdomainUnavailableError, mcpSubdomainEndpointOptions, resolveMcpSubdomainTenant, } from './mcp-subdomain-claims.js';
+export { agreementDocumentDigest, OrganizationAgreementError, validateAgreementDocuments, } from './organization-agreements.js';
 export { domainFromEmail, domainKey, memberKey, normalizeSignupAllowlistValue, personalOrgSlug, personalOrgSlugSuffix, signupKey, } from './organization-helpers.js';
 export { ensurePersonalWorkspace } from './personal-workspace.js';
 export { rollbackDeploymentOperation, } from './rollback-deployment.js';

package/node_modules/@noodle-borg/module/dist/contract.d.ts

@@ -53,6 +53,8 @@ export interface ControlPlaneAuthorizer {
     authorize(req: IncomingMessage): Promise<ControlPlaneAuthResult> | ControlPlaneAuthResult;
 }
 export interface ControlPlaneIdentity {
+    /** Server-produced provenance from the exact Google workload verifier; never request data. */
+    readonly authenticationKind?: 'google-workload';
     readonly subject: string;
     readonly email: string;
     readonly superAdmin: boolean;
@@ -181,7 +183,27 @@ export interface ModuleContributionsV1 {
     readonly readiness?: ReadinessProbe;
     readonly dispose?: ModuleDispose;
 }
+/** Verified current authority; absence must not synthesize a commercial tier. */
+export interface ActivityHistoryAllowance {
+    readonly maximumDays: number;
+    readonly defaultDays: number;
+    readonly revision: string;
+    /** Read-only scenarios; this is not evidence that a plan change is selected or scheduled. */
+    readonly preview?: {
+        readonly asOf: string;
+        readonly paidPeriodEnd: string;
+        readonly scenarios: readonly {
+            readonly id: string;
+            readonly label: string;
+            readonly maximumDays: number;
+        }[];
+    };
+}
+export type ResolveActivityHistoryAllowance = (org: string, options?: {
+    readonly includePreview: true;
+}) => Promise<ActivityHistoryAllowance | undefined>;
 export interface ModuleContributions extends ModuleContributionsV1 {
+    readonly resolveActivityHistoryAllowance?: ResolveActivityHistoryAllowance;
     readonly assetStore?: AssetStore;
     readonly deploymentAutomation?: DeploymentAutomationAuthorizer;
     readonly platformHumanIdentity?: PlatformHumanIdentityContribution;

package/node_modules/@noodle-borg/module/dist/platform-human-identity.d.ts

@@ -85,6 +85,8 @@ export interface PlatformHumanIdentityContribution {
         readonly oldTokenHash: string;
         readonly clientId: string;
     }) => Promise<'continue' | 'unknown' | 'suspended'>;
+    /** Check a business assignee under the caller's borrowed transaction and suspension lock. */
+    readonly assertActivePrincipal?: (transaction: ModuleSqlTransaction, subject: string) => Promise<void>;
     readonly continuityProbe?: () => void | Promise<void>;
 }
 //# sourceMappingURL=platform-human-identity.d.ts.map

package/node_modules/@noodle-borg/protocol/dist/request-deps.js

@@ -4,6 +4,7 @@ export function buildProtocolRequestDeps(artifact, deps, context) {
     return {
         ...deps,
         ...(context.caller !== undefined ? { caller: context.caller } : {}),
+        ...(context.publicAdmission === undefined ? {} : { publicAdmission: context.publicAdmission }),
         ...(context.customerIssuer !== undefined ? { customerIssuer: context.customerIssuer } : {}),
         ...(artifact.customerEndpoints === undefined
             ? {}

package/node_modules/@noodle-borg/protocol/dist/request-state.d.ts

@@ -1,6 +1,7 @@
 import { type ElicitationResponse, SecretBox } from '@noodle-borg/runtime';
 export type RequestStateMethod = 'tools/call' | 'resources/read' | 'prompts/get';
 export interface RequestStateBinding {
+    readonly executionRevision?: string;
     readonly deploymentId: string;
     readonly serverVersion: string;
     readonly method: RequestStateMethod;

package/node_modules/@noodle-borg/protocol/dist/request-state.js

@@ -140,7 +140,14 @@ function assertPayload(value, maxRounds) {
     }
 }
 function assertBinding(actual, expected) {
-    for (const key of ['deploymentId', 'serverVersion', 'method', 'target', 'principal']) {
+    for (const key of [
+        'deploymentId',
+        'serverVersion',
+        'method',
+        'target',
+        'principal',
+        'executionRevision',
+    ]) {
         if (actual[key] !== expected[key]) {
             throw new RequestStateError('request_state_binding_mismatch');
         }
@@ -158,7 +165,9 @@ function isBinding(value) {
             value.method === 'prompts/get') &&
         typeof value.target === 'string' &&
         typeof value.principal === 'string' &&
-        typeof value.argumentDigest === 'string');
+        typeof value.argumentDigest === 'string' &&
+        (value.executionRevision === undefined ||
+            (typeof value.executionRevision === 'string' && value.executionRevision.length <= 256)));
 }
 function isResponseMap(value) {
     return (isRecord(value) &&

package/node_modules/@noodle-borg/protocol/dist/sdk-server.d.ts

@@ -19,6 +19,8 @@ export interface ServedArtifact {
 }
 export interface ProtocolRequestContext {
     readonly caller?: CallerIdentity;
+    /** Internal hosting attribution, never MCP payload metadata or caller-visible context. */
+    readonly publicAdmission?: NonNullable<ExecuteDeps['publicAdmission']>;
     /** Origin-wide readiness for the complete OAuth client-credentials lifecycle. */
     readonly oauthClientCredentialsReady?: boolean;
     /** Request-host-specific widget metadata projection; never persisted into the served artifact. */

package/node_modules/@noodle-borg/protocol/dist/v2/input-required.js

@@ -2,7 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { fromJsonSchema, inputRequired, } from '@modelcontextprotocol/server';
 import { digestMcpArguments, RequestStateError, } from '../request-state.js';
 const REQUEST_STATE_TTL_MS = 5 * 60_000;
-export function toolRequestStateBinding(artifact, context, toolName, toolArguments) {
+export function toolRequestStateBinding(artifact, context, toolName, toolArguments, executionRevision) {
     return {
         deploymentId: context.deploymentId ?? `local:${artifact.server.name}`,
         serverVersion: artifact.server.version,
@@ -10,6 +10,7 @@ export function toolRequestStateBinding(artifact, context, toolName, toolArgumen
         target: toolName,
         principal: requestStatePrincipal(context),
         argumentDigest: digestMcpArguments(toolArguments),
+        ...(executionRevision === undefined ? {} : { executionRevision }),
     };
 }
 function requestStatePrincipal(context) {

package/node_modules/@noodle-borg/protocol/dist/v2/server.js

@@ -169,7 +169,7 @@ function registerV2Tools(server, artifact, deps, context, era) {
             : { arguments: captured.arguments, responses: {} };
         let toolArguments = interaction.arguments;
         const requestState = era === 'modern' ? ctx.mcpReq.requestState() : undefined;
-        const modernBinding = () => toolRequestStateBinding(artifact, context, toolName, interaction.arguments);
+        const modernBinding = () => toolRequestStateBinding(artifact, context, toolName, interaction.arguments, deps.executionBinding?.revision);
         const rejectRequestState = (error) => {
             const rejection = asRequestStateError(error);
             observe('mcp_error', { errorKind: rejection.reason });
@@ -229,6 +229,7 @@ function registerV2Tools(server, artifact, deps, context, era) {
         }
         const toolDeps = {
             ...deps,
+            ...(requestState === undefined ? {} : { invocationId: requestState.nonce }),
             signal: ctx.mcpReq.signal,
             ...(context.beforeToolDispatch === undefined
                 ? {}

package/node_modules/@noodle-borg/runtime/dist/ambient-context.js

@@ -1,5 +1,6 @@
+import { resolveVariableEnvironment } from './business-variables.js';
 import { canonicalizeContext } from './context-bounds.js';
-import { runFulfilment, validateAgainstSchema } from './execute.js';
+import { resolveEnv, runFulfilment, validateAgainstSchema } from './execute.js';
 import { splitResultMeta } from './result-meta.js';
 /**
  * Resolve the server's declared ambient context against the invocation's temporal/caller snapshot.
@@ -19,6 +20,9 @@ export async function executeAmbientContext(artifact, deps) {
     const ambient = artifact.server.context?.ambient;
     if (ambient === undefined)
         return { ok: true, output: undefined };
+    const variables = resolveVariableEnvironment(artifact.server.variables ?? [], await resolveEnv(deps));
+    if (!variables.ok)
+        return variables;
     const providerContext = deps.context === undefined
         ? undefined
         : {
@@ -27,6 +31,7 @@ export async function executeAmbientContext(artifact, deps) {
         };
     const providerDeps = {
         ...deps,
+        env: variables.env,
         ...(providerContext !== undefined ? { context: providerContext } : {}),
     };
     const result = await runFulfilment(ambient.fulfilment, {}, 'server.context.ambient', providerDeps);

package/node_modules/@noodle-borg/runtime/dist/broker/types.d.ts

@@ -56,6 +56,8 @@ export interface CredentialRequest {
     readonly bindingId?: string;
     readonly connectionId?: string;
     readonly connectionConfigRevision?: string;
+    /** Original operator account generation from trusted hosting state, never caller input. */
+    readonly expectedConnectionGeneration?: string;
     readonly profile?: string;
     readonly presentation?: CredentialProfile;
     readonly requiredScopes?: readonly string[];

package/node_modules/@noodle-borg/runtime/dist/business-variables.d.ts

@@ -0,0 +1,15 @@
+import { type ArtifactVariableDeclaration, type RuntimeArtifact } from '@noodle-borg/compiler';
+import type { ExecutionError } from './result.js';
+export type VariableEnvironmentResult = {
+    readonly ok: true;
+    readonly env: Record<string, unknown>;
+    readonly missing: readonly string[];
+} | {
+    readonly ok: false;
+    readonly error: ExecutionError;
+};
+/** Decode the authoritative string store once at an invocation boundary. No implicit coercion. */
+export declare function resolveVariableEnvironment(declarations: readonly ArtifactVariableDeclaration[], rawConfig: Readonly<Record<string, unknown>>, toolName?: string): VariableEnvironmentResult;
+/** A resumed intent cannot silently continue under changed effective business configuration. */
+export declare function validateVariableContinuation(artifact: RuntimeArtifact, previousEnv: Readonly<Record<string, unknown>>, current: VariableEnvironmentResult): ExecutionError | undefined;
+//# sourceMappingURL=business-variables.d.ts.map

package/node_modules/@noodle-borg/runtime/dist/business-variables.js

@@ -0,0 +1,75 @@
+import { canonicalJson, MAX_VARIABLE_VALUE_BYTES, validateJsonSchema, } from '@noodle-borg/compiler';
+/** Decode the authoritative string store once at an invocation boundary. No implicit coercion. */
+export function resolveVariableEnvironment(declarations, rawConfig, toolName) {
+    const env = { ...rawConfig };
+    const missing = [];
+    for (const declaration of declarations) {
+        const raw = Object.hasOwn(rawConfig, declaration.name)
+            ? rawConfig[declaration.name]
+            : undefined;
+        if (raw === undefined && !Object.hasOwn(declaration, 'default')) {
+            missing.push(declaration.name);
+            delete env[declaration.name];
+            continue;
+        }
+        let value;
+        try {
+            if (raw === undefined)
+                value = structuredClone(declaration.default);
+            else if (typeof raw === 'string') {
+                if (Buffer.byteLength(raw) > MAX_VARIABLE_VALUE_BYTES)
+                    return invalidVariable();
+                value = JSON.parse(raw);
+            }
+            else
+                value = structuredClone(raw);
+            if (Buffer.byteLength(canonicalJson(value)) > MAX_VARIABLE_VALUE_BYTES)
+                return invalidVariable();
+        }
+        catch {
+            return invalidVariable();
+        }
+        if (validateJsonSchema(declaration.valueSchema, value).length > 0)
+            return invalidVariable();
+        Object.defineProperty(env, declaration.name, {
+            value,
+            enumerable: true,
+            configurable: true,
+            writable: true,
+        });
+    }
+    if (toolName !== undefined &&
+        declarations.some((declaration) => missing.includes(declaration.name) && declaration.requiredFor.includes(toolName))) {
+        return {
+            ok: false,
+            error: {
+                code: 'configuration_required',
+                message: 'This capability needs business settings before it can run.',
+            },
+        };
+    }
+    return { ok: true, env, missing };
+}
+/** A resumed intent cannot silently continue under changed effective business configuration. */
+export function validateVariableContinuation(artifact, previousEnv, current) {
+    if (!current.ok)
+        return current.error;
+    const names = (artifact.server.variables ?? []).map((declaration) => declaration.name);
+    const project = (env) => Object.fromEntries(names.map((name) => [name, env[name]]));
+    if (canonicalJson(project(previousEnv)) !== canonicalJson(project(current.env)))
+        return {
+            code: 'configuration_changed',
+            message: 'Business settings changed. Prepare and confirm the action again.',
+        };
+    return undefined;
+}
+function invalidVariable() {
+    return {
+        ok: false,
+        error: {
+            code: 'configuration_invalid',
+            message: 'Business settings are unavailable or invalid.',
+        },
+    };
+}
+//# sourceMappingURL=business-variables.js.map

package/node_modules/@noodle-borg/runtime/dist/confirmation-continuation.js

@@ -1,4 +1,4 @@
-export function confirmationRequired(artifact, toolName, input, nextStepIndex, completedSteps, elicited, env, action) {
+export function confirmationRequired(artifact, toolName, input, nextStepIndex, completedSteps, elicited, env, action, executionRevision) {
     const reviewedAction = action === undefined
         ? undefined
         : {
@@ -43,6 +43,7 @@ export function confirmationRequired(artifact, toolName, input, nextStepIndex, c
         },
         continuation: {
             kind: 'prepared_confirmation',
+            ...(executionRevision === undefined ? {} : { executionRevision }),
             version: 1,
             artifact: artifactIdentity(artifact),
             toolName,

package/node_modules/@noodle-borg/runtime/dist/confirmation.js

@@ -1,3 +1,4 @@
+import { resolveVariableEnvironment, validateVariableContinuation } from './business-variables.js';
 import { analyzeEligibleActions, countTrailingEligibleOperations, isActionOperation, validateConfirmationFlow, } from './confirmation-analysis.js';
 import { artifactIdentity, confirmationRequired, sameArtifact, } from './confirmation-continuation.js';
 import { validatePreparedCustomerRoutes } from './confirmation-customer-routes.js';
@@ -21,6 +22,10 @@ export async function prepareToolForConfirmation(artifact, toolName, input, deps
     const tool = artifact.tools.find((candidate) => candidate.name === toolName);
     if (!tool)
         return failPreparation('unknown_tool', `no tool named "${toolName}"`);
+    const variables = resolveVariableEnvironment(artifact.server.variables ?? [], await resolveEnv(deps), toolName);
+    if (!variables.ok)
+        return { status: 'failed', error: variables.error };
+    deps = { ...deps, env: variables.env };
     const invocationDeps = withConnectorSnapshot(deps);
     const preflightError = preflightFulfilmentSignatures(tool.fulfilment, invocationDeps.connectors);
     if (preflightError)
@@ -41,7 +46,7 @@ export async function prepareToolForConfirmation(artifact, toolName, input, deps
         return confirmationRequired(artifact, toolName, input, 0, {}, {}, env, {
             prepared: prepared.action,
             review: prepared.review,
-        });
+        }, invocationDeps.executionBinding?.revision);
     }
     return runPreparation(artifact, toolName, tool.fulfilment, input, 0, {}, {}, env, invocationDeps);
 }
@@ -57,6 +62,12 @@ export async function resumeToolPreparation(artifact, continuation, response, de
     }
     if (response.action !== 'accept')
         return { status: 'stopped', action: response.action };
+    if ((artifact.server.variables?.length ?? 0) > 0) {
+        const variables = resolveVariableEnvironment(artifact.server.variables ?? [], await resolveEnv(deps), continuation.toolName);
+        const configurationError = validateVariableContinuation(artifact, continuation.env, variables);
+        if (configurationError)
+            return { status: 'failed', error: configurationError };
+    }
     const validated = validateElicitationContent(response.content ?? {}, continuation.pending.requestedSchema, `steps.${continuation.pending.id}`);
     if (!validated.ok)
         return { status: 'failed', error: validated.error };
@@ -94,6 +105,15 @@ export async function executePreparedTool(artifact, continuation, deps) {
     const tool = artifact.tools.find((candidate) => candidate.name === continuation.toolName);
     if (!tool)
         return failInteractive('invalid_continuation', 'continued tool is unavailable');
+    if (continuation.executionRevision !== deps.executionBinding?.revision) {
+        return failInteractive('configuration_changed', 'Application configuration or connection changed; request a new confirmation.');
+    }
+    if ((artifact.server.variables?.length ?? 0) > 0) {
+        const variables = resolveVariableEnvironment(artifact.server.variables ?? [], await resolveEnv(deps), continuation.toolName);
+        const configurationError = validateVariableContinuation(artifact, continuation.env, variables);
+        if (configurationError)
+            return { status: 'failed', error: configurationError };
+    }
     const inputError = validateAgainstSchema(continuation.input, tool.inputSchema, 'input', 'arg_invalid', 'tool input');
     if (inputError)
         return { status: 'failed', error: inputError };
@@ -194,7 +214,7 @@ async function runPreparation(artifact, toolName, flow, input, startIndex, steps
                 return confirmationRequired(artifact, toolName, input, index, steps, elicited, env, {
                     prepared: prepared.action,
                     review: prepared.review,
-                });
+                }, deps.executionBinding?.revision);
             }
             if (step.kind === 'map') {
                 steps[step.id] = evalExprMap(step.value, scope, `steps.${step.id}`);
@@ -229,7 +249,7 @@ async function runPreparation(artifact, toolName, flow, input, startIndex, steps
         if (actionAnalysis.flowHasActions && actionAnalysis.eligibleIndexes.length !== 1) {
             return failPreparation('invalid_confirmation_flow', 'confirmable conditional flows must resolve exactly one eligible action');
         }
-        return confirmationRequired(artifact, toolName, input, flow.steps.length, steps, elicited, env);
+        return confirmationRequired(artifact, toolName, input, flow.steps.length, steps, elicited, env, undefined, deps.executionBinding?.revision);
     }
     catch (error) {
         if (error instanceof ExpressionEvalError) {

package/node_modules/@noodle-borg/runtime/dist/connector/types.d.ts

@@ -1,6 +1,7 @@
 import type { CredentialProfile, OperationSignature, ResolvedOperationRef } from '@noodle-borg/compiler';
 import type { DownstreamCredential } from '../broker/types.js';
 import type { CustomerConnectorRoute } from '../customer-routing.js';
+import type { OperationEvidence } from '../operation-evidence.js';
 /** Verified caller claims that may be threaded into first-party connector operations. */
 export interface CallerIdentity {
     readonly subject: string;
@@ -78,10 +79,21 @@ export interface ConnectorCallHost {
 /** A single connector-operation invocation, fully resolved and credentialed by the runtime. */
 export interface ConnectorCall {
     readonly operation: string;
+    /** Runtime-generated, deployment/step-bound identity. Not a business input or recovery authority. */
+    readonly execution?: Readonly<{
+        readonly id: string;
+    }>;
+    /** Connector/application-classified evidence; never infer completion from a transport status alone. */
+    readonly reportOutcome?: (evidence: OperationEvidence) => void;
+    /** Trusted request attribution for native public writes; never an argument or expression value. */
+    readonly publicAdmission?: {
+        readonly network: string;
+        readonly visitor?: string;
+    };
     /** Evaluated, validated arguments. */
     readonly args: Readonly<Record<string, unknown>>;
     /** Managed variables resolved for the deployment scope. */
-    readonly env?: Readonly<Record<string, string>>;
+    readonly env?: Readonly<Record<string, unknown>>;
     /** Request-scoped cancellation; connectors should propagate it to outbound work. */
     readonly signal?: AbortSignal;
     /**
@@ -91,6 +103,8 @@ export interface ConnectorCall {
     readonly credential: DownstreamCredential;
     /** Binding-selected presentation; when present it overrides connector-level legacy auth config. */
     readonly credentialPresentation?: CredentialProfile;
+    /** Lazy deployment credential for an explicitly declared independent transport; called only after egress validation. */
+    readonly acquireTransportCredential?: () => Promise<DownstreamCredential>;
     /** Verified caller claims, when the access mode intentionally exposes them to execution. */
     readonly caller?: CallerIdentity;
     /** Full request-local route supplied only to the connector that needs it. */
@@ -114,6 +128,8 @@ export interface Connector {
     readonly version: string;
     /** The operation's signature, used for signature-drift verification and argument/output checks. */
     signature(operation: string): OperationSignature | undefined;
+    /** Maximum action execution duration owned by this connector; excludes confirmation/model time. */
+    executionBoundMs?(operation: string): number | undefined;
     /** Invoke the operation. May reject; the runtime normalizes the failure (no secret leakage). */
     invoke(call: ConnectorCall): Promise<unknown>;
 }

package/node_modules/@noodle-borg/runtime/dist/connector-snapshot.js

@@ -21,6 +21,7 @@ export function withConnectorSnapshot(deps) {
                 return undefined;
             }
             const signatures = new Map();
+            const executionBounds = new Map();
             const snapshot = {
                 id: connector.id,
                 version: connector.version,
@@ -32,6 +33,11 @@ export function withConnectorSnapshot(deps) {
                     }
                     return signatures.get(operation);
                 },
+                executionBoundMs(operation) {
+                    if (!executionBounds.has(operation))
+                        executionBounds.set(operation, connector.executionBoundMs?.(operation));
+                    return executionBounds.get(operation);
+                },
                 invoke(call) {
                     return connector.invoke(call);
                 },

package/node_modules/@noodle-borg/runtime/dist/execute.d.ts

@@ -4,6 +4,7 @@ import type { CallerIdentity, ConnectorRegistry, ExecutionTraceSink } from './co
 import type { FrozenCustomerRoutes } from './customer-routing.js';
 import { type EvalScope } from './eval/evaluate.js';
 import type { InvocationContext } from './invocation-context.js';
+import type { OperationEvidencePort } from './operation-evidence.js';
 import type { PolicyGate } from './policy/types.js';
 import type { ExecutionResult } from './result.js';
 import { type ToolDispatchHook } from './tool-dispatch.js';
@@ -19,17 +20,31 @@ export interface ExecuteDeps {
     readonly connectors: ConnectorRegistry;
     readonly broker: CredentialBroker;
     readonly policy?: PolicyGate;
-    readonly env?: Record<string, string> | (() => Promise<Record<string, string>>);
+    readonly env?: Record<string, unknown> | (() => Promise<Record<string, unknown>>);
     readonly caller?: CallerIdentity;
+    /** Transport-owned admission attribution; absent network means public native writes must refuse. */
+    readonly publicAdmission?: {
+        readonly network: string;
+        readonly visitor?: string;
+    };
     /** Verified customer IdP issuer, kept outside caller/expression scope for credential isolation. */
     readonly customerIssuer?: string;
     /** Request-local validated customer connector routes, kept separate from caller/expression scope. */
     readonly customerRoutes?: FrozenCustomerRoutes;
     readonly tenantId?: string;
     readonly deploymentId?: string;
+    /** Trusted adapter invocation/confirmation identity; never read from tool input or expression scope. */
+    readonly invocationId?: string;
+    readonly operationEvidence?: OperationEvidencePort;
+    /** Hosting snapshot: operator configuration and original connected-account generations. */
+    readonly executionBinding?: {
+        readonly revision: string;
+        readonly connections: Readonly<Record<string, string>>;
+    };
     /** Immutable facts resolved once for this invocation and exposed only through `${context...}`. */
     readonly context?: InvocationContext;
     readonly trace?: ExecutionTraceSink;
+    /** Host-owned cancellation; TimeoutError denotes a hard execution deadline. Never caller payload. */
     readonly signal?: AbortSignal;
     /** Deployment-bound knowledge search (ADR 0202); absent means no knowledge tools serve. */
     readonly knowledgeSearch?: KnowledgeSearchPort;
@@ -100,7 +115,7 @@ export declare function executePrompt(artifact: RuntimeArtifact, promptName: str
 /** @internal Shared with the ambient-context executor; not exported from the package barrel. */
 export declare function runFulfilment(fulfilment: ArtifactFulfilment, input: unknown, label: string, deps: ExecuteDeps, beforeDispatch?: ToolDispatchHook): Promise<ExecutionResult>;
 /** @internal Shared with the suspension-aware flow executor. */
-export declare function scopeFor(input: unknown, steps: Record<string, unknown>, env: Record<string, string>, deps: ExecuteDeps): EvalScope;
+export declare function scopeFor(input: unknown, steps: Record<string, unknown>, env: Record<string, unknown>, deps: ExecuteDeps): EvalScope;
 /** @internal Shared with the suspension-aware flow executor. */
-export declare function resolveEnv(deps: ExecuteDeps): Promise<Record<string, string>>;
+export declare function resolveEnv(deps: ExecuteDeps): Promise<Record<string, unknown>>;
 //# sourceMappingURL=execute.d.ts.map

package/node_modules/@noodle-borg/runtime/dist/execute.js

@@ -1,3 +1,4 @@
+import { resolveVariableEnvironment } from './business-variables.js';
 import { preflightFulfilmentSignatures } from './connector-snapshot.js';
 import { preflightFulfilmentCustomerRoutes } from './customer-routing.js';
 import { ExpressionEvalError, evaluateCondition } from './eval/evaluate.js';
@@ -25,7 +26,10 @@ export async function executeTool(artifact, toolName, input, deps) {
     const tool = artifact.tools.find((t) => t.name === toolName);
     if (!tool)
         return fail('unknown_tool', `no tool named "${toolName}"`);
-    return runFulfilment(tool.fulfilment, input, toolName, deps, deps.beforeDispatch);
+    const variables = resolveVariableEnvironment(artifact.server.variables ?? [], await resolveEnv(deps), toolName);
+    if (!variables.ok)
+        return variables;
+    return runFulfilment(tool.fulfilment, input, toolName, { ...deps, env: variables.env }, deps.beforeDispatch);
 }
 /**
  * Execute a resource read against a resolved artifact. `input` is the resource's variable scope — the
@@ -40,7 +44,10 @@ export async function executeResource(artifact, resourceName, input, deps) {
     const resource = artifact.resources?.find((r) => r.name === resourceName);
     if (!resource)
         return fail('unknown_resource', `no resource named "${resourceName}"`);
-    return runFulfilment(resource.fulfilment, input, resourceName, deps);
+    const variables = resolveVariableEnvironment(artifact.server.variables ?? [], await resolveEnv(deps));
+    if (!variables.ok)
+        return variables;
+    return runFulfilment(resource.fulfilment, input, resourceName, { ...deps, env: variables.env });
 }
 /**
  * Execute a prompt against a resolved artifact. `args` is the supplied prompt-arguments map (the
@@ -54,7 +61,10 @@ export async function executePrompt(artifact, promptName, args, deps) {
     const prompt = artifact.prompts?.find((p) => p.name === promptName);
     if (!prompt)
         return fail('unknown_prompt', `no prompt named "${promptName}"`);
-    return runFulfilment(prompt.fulfilment, args, promptName, deps);
+    const variables = resolveVariableEnvironment(artifact.server.variables ?? [], await resolveEnv(deps));
+    if (!variables.ok)
+        return variables;
+    return runFulfilment(prompt.fulfilment, args, promptName, { ...deps, env: variables.env });
 }
 /**
  * Run a normalized fulfilment (single operation or non-suspending flow) against an `input` scope. Shared

package/node_modules/@noodle-borg/runtime/dist/index.d.ts

@@ -3,6 +3,7 @@ export { MapServiceBroker } from './broker/map.js';
 export { type MasterKeyProvider, type SealedSecret, type SealedSecretV1, type SealedSecretV2, SecretBox, SecretDecryptError, type StaticMasterKey, staticMasterKeyProvider, type WrappingMasterKey, } from './broker/secret-box.js';
 export { StaticServiceBroker } from './broker/static.js';
 export { type CredentialBindingDescriptor, type CredentialBroker, type CredentialProbeRouteResolver, type CredentialRequest, CredentialUnavailableError, type CredentialUnavailableErrorOptions, type CredentialUnavailableReason, credentialBindingDescriptorFromRequest, credentialUnavailableErrorSnapshot, type DelegatedCredentialProbe, type DownstreamCredential, } from './broker/types.js';
+export { resolveVariableEnvironment, type VariableEnvironmentResult, validateVariableContinuation, } from './business-variables.js';
 export { executePreparedTool, prepareToolForConfirmation, resumeToolPreparation, } from './confirmation.js';
 export { sanitizeConnectorFailureDetails } from './connector/failure-details.js';
 export { InMemoryConnector, InMemoryConnectorRegistry, type InMemoryOperation, type OperationHandler, } from './connector/in-memory.js';
@@ -14,6 +15,7 @@ export { type ExecuteDeps, type ExecuteToolDeps, executePrompt, executeResource,
 export { executeToolInteractive, resumeTool } from './interactive.js';
 export type { InvocationContext, InvocationContextPreferenceSource, InvocationLocationContext, InvocationTemporalContext, } from './invocation-context.js';
 export { type ManagedOriginResolutionResult, resolveManagedOrigins, } from './managed-origins.js';
+export type { OperationEvidence, OperationEvidenceIntent, OperationEvidencePort, } from './operation-evidence.js';
 export { AllowAllPolicy } from './policy/allow-all.js';
 export type { PolicyContext, PolicyDecision, PolicyGate } from './policy/types.js';
 export { type ConfirmationActionReview, type ConfirmationPreparationResult, type ConfirmationReview, type ConnectorFailureAttribution, type ElicitationRequest, type ElicitationResponse, type ExecutionError, type ExecutionErrorCode, type ExecutionResult, type InteractiveExecutionResult, isConfirmationRequired, isInputRequired, isInputRequiredForConfirmation, type PreparedOperationAction, type PreparedToolContinuation, type ToolContinuation, type ToolPreparationContinuation, } from './result.js';

package/node_modules/@noodle-borg/runtime/dist/index.js

@@ -3,6 +3,7 @@ export { MapServiceBroker } from './broker/map.js';
 export { SecretBox, SecretDecryptError, staticMasterKeyProvider, } from './broker/secret-box.js';
 export { StaticServiceBroker } from './broker/static.js';
 export { CredentialUnavailableError, credentialBindingDescriptorFromRequest, credentialUnavailableErrorSnapshot, } from './broker/types.js';
+export { resolveVariableEnvironment, validateVariableContinuation, } from './business-variables.js';
 export { executePreparedTool, prepareToolForConfirmation, resumeToolPreparation, } from './confirmation.js';
 export { sanitizeConnectorFailureDetails } from './connector/failure-details.js';
 export { InMemoryConnector, InMemoryConnectorRegistry, } from './connector/in-memory.js';