@noodleseed/one 0.162.0 → 0.164.0

package/node_modules/@noodle-borg/service/dist/business-information/profiles.js

@@ -1,4 +1,5 @@
 import { createHash } from 'node:crypto';
+import { managedSolutionBlueprint, managedSolutionVariables, } from './managed-solution-blueprints.js';
 import { PayloadValidationError, validateManagedPayload, validateScalar } from './validation.js';
 const requestSchema = (required, properties) => ({
     $schema: 'https://json-schema.org/draft/2020-12/schema',
@@ -7,16 +8,16 @@ const requestSchema = (required, properties) => ({
     required,
     properties,
 });
-function collection(key, labels, schema) {
+function collection(key, labels, schema, schemaVersion = 1) {
     return {
         key,
-        schemaVersion: 1,
+        schemaVersion,
         schemaDigest: createHash('sha256').update(stableJson(schema)).digest('hex'),
         labels,
         schema,
     };
 }
-const travel = collection('travel_requests', { singular: 'Travel request', plural: 'Travel requests', navigation: 'Requests' }, requestSchema(['request_type', 'summary'], {
+const travelV1 = collection('travel_requests', { singular: 'Travel request', plural: 'Travel requests', navigation: 'Requests' }, requestSchema(['request_type', 'summary'], {
     request_type: {
         type: 'string',
         enum: ['service', 'cancellation', 'refund', 'recovery'],
@@ -26,6 +27,17 @@ const travel = collection('travel_requests', { singular: 'Travel request', plura
     booking_reference: { type: 'string', maxLength: 128 },
     traveler_reference: { type: 'string', maxLength: 128 },
 }));
+const travelV2 = collection('travel_requests', { singular: 'Travel request', plural: 'Travel requests', navigation: 'Requests' }, requestSchema(['request_type', 'summary'], {
+    request_type: {
+        type: 'string',
+        enum: ['service', 'cancellation', 'refund', 'recovery', 'information'],
+        maxLength: 32,
+    },
+    summary: { type: 'string', minLength: 1, maxLength: 2000 },
+    booking_reference: { type: 'string', maxLength: 128 },
+    traveler_reference: { type: 'string', maxLength: 128 },
+    priority: { type: 'string', enum: ['normal', 'urgent'], maxLength: 16 },
+}), 2);
 const service = collection('service_requests', { singular: 'Service request', plural: 'Service requests', navigation: 'Requests' }, requestSchema(['request_type', 'summary'], {
     request_type: {
         type: 'string',
@@ -56,18 +68,56 @@ const restaurant = collection('guest_requests', { singular: 'Guest request', plu
     location_reference: { type: 'string', maxLength: 128 },
     reservation_reference: { type: 'string', maxLength: 128 },
 }));
+export const BUILT_IN_SOLUTION_PROFILE_RELEASES = {
+    travel: [
+        { key: 'travel', version: 1, label: 'Travel', collections: [travelV1] },
+        { key: 'travel', version: 2, label: 'Travel', collections: [travelV2] },
+        { key: 'travel', version: 3, label: 'Travel', collections: [lightweightCollection(travelV2)] },
+    ],
+    b2b_saas: [{ key: 'b2b_saas', version: 1, label: 'B2B SaaS', collections: [service] }],
+    ecommerce: [
+        { key: 'ecommerce', version: 1, label: 'Ecommerce', collections: [ecommerce] },
+        {
+            key: 'ecommerce',
+            version: 2,
+            label: 'Ecommerce',
+            collections: [lightweightCollection(ecommerce)],
+        },
+    ],
+    restaurant: [
+        { key: 'restaurant', version: 1, label: 'Restaurant', collections: [restaurant] },
+        {
+            key: 'restaurant',
+            version: 2,
+            label: 'Restaurant',
+            collections: [lightweightCollection(restaurant)],
+        },
+    ],
+};
 export const BUILT_IN_SOLUTION_PROFILES = {
-    travel: { key: 'travel', version: 1, label: 'Travel', collections: [travel] },
+    travel: currentProfile('travel'),
     b2b_saas: { key: 'b2b_saas', version: 1, label: 'B2B SaaS', collections: [service] },
-    ecommerce: { key: 'ecommerce', version: 1, label: 'Ecommerce', collections: [ecommerce] },
-    restaurant: { key: 'restaurant', version: 1, label: 'Restaurant', collections: [restaurant] },
+    ecommerce: currentProfile('ecommerce'),
+    restaurant: currentProfile('restaurant'),
 };
+/** Public managed catalog. The legacy SaaS request profile remains readable but cannot be newly sold. */
+export const MANAGED_SOLUTION_PROFILE_KEYS = ['travel', 'ecommerce', 'restaurant'];
 export function builtInProfile(key) {
     const profile = BUILT_IN_SOLUTION_PROFILES[key];
     if (profile === undefined)
         throw new Error(`unknown built-in solution profile "${String(key)}"`);
     return profile;
 }
+export function builtInProfileAtRelease(key, release) {
+    const profile = BUILT_IN_SOLUTION_PROFILE_RELEASES[key].find((candidate) => candidate.version === release);
+    if (profile === undefined) {
+        throw new Error(`unsupported built-in solution profile release "${key}@${release}"`);
+    }
+    return profile;
+}
+export function isBuiltInProfileKey(value) {
+    return (value === 'travel' || value === 'b2b_saas' || value === 'ecommerce' || value === 'restaurant');
+}
 export function builtInCollection(profileKey, collectionKey) {
     const normalized = validateScalar('collection key', collectionKey, 64);
     const found = builtInProfile(profileKey).collections.find((candidate) => candidate.key === normalized);
@@ -82,6 +132,87 @@ export function validateProfilePayload(profileKey, collectionKey, value) {
     validateJsonSchema(collectionProfile.schema, payload);
     return payload;
 }
+export function builtInDefinition(key) {
+    return definitionFromProfile(builtInProfile(key));
+}
+export function builtInDefinitionAtRelease(key, release) {
+    return definitionFromProfile(builtInProfileAtRelease(key, release));
+}
+function definitionFromProfile(profile) {
+    const { key } = profile;
+    const blueprint = managedSolutionBlueprint(key, profile.version);
+    const variables = blueprint === undefined ? undefined : managedSolutionVariables();
+    const digest = createHash('sha256')
+        .update(stableJson({
+        key: profile.key,
+        version: profile.version,
+        collections: profile.collections,
+        ...(blueprint === undefined ? {} : { blueprint, variables }),
+    }))
+        .digest('hex');
+    return {
+        reference: key === 'b2b_saas'
+            ? { kind: 'legacy', definitionId: 'b2b_saas', release: profile.version, digest }
+            : {
+                kind: 'managed',
+                definitionId: key,
+                release: profile.version,
+                digest,
+            },
+        title: profile.label,
+        description: `Receive and operate ${profile.collections[0]?.labels.plural.toLowerCase() ?? 'business records'}.`,
+        collections: profile.collections.map(collectionDefinition),
+        ...(variables === undefined ? {} : { variables }),
+    };
+}
+function currentProfile(key) {
+    const releases = BUILT_IN_SOLUTION_PROFILE_RELEASES[key];
+    const profile = releases.at(-1);
+    if (profile === undefined)
+        throw new Error(`built-in solution profile "${key}" has no releases`);
+    return profile;
+}
+function collectionDefinition(profile) {
+    return {
+        key: profile.key,
+        title: profile.labels.plural,
+        singularTitle: profile.labels.singular,
+        description: `Managed ${profile.labels.plural.toLowerCase()} for this application.`,
+        schemaVersion: profile.schemaVersion,
+        schemaDigest: profile.schemaDigest,
+        recordSchema: structuredClone(profile.schema),
+        summaryFields: profile.schema.required.slice(0, 6),
+        authority: { authority: 'native' },
+        ...(profile.management === undefined
+            ? { behavior: { kind: 'request' } }
+            : {
+                management: profile.management,
+                publicFields: profile.publicFields ?? [],
+                editableFields: Object.keys(profile.schema.properties),
+                fields: { status: { label: 'Status' } },
+                filterFields: ['status'],
+                sortFields: ['status'],
+            }),
+    };
+}
+function lightweightCollection(previous) {
+    return {
+        ...collection(previous.key, previous.labels, {
+            ...previous.schema,
+            properties: {
+                ...previous.schema.properties,
+                status: {
+                    type: 'string',
+                    enum: ['new', 'in_progress', 'resolved', 'closed'],
+                    maxLength: 32,
+                    default: 'new',
+                },
+            },
+        }, previous.schemaVersion + 1),
+        management: { assignment: true, notes: true },
+        publicFields: Object.keys(previous.schema.properties),
+    };
+}
 function validateJsonSchema(schema, payload) {
     for (const required of schema.required) {
         if (!(required in payload)) {

package/node_modules/@noodle-borg/service/dist/business-information/reader-floor.js

@@ -0,0 +1,26 @@
+import { createHash } from 'node:crypto';
+import { assertManagedRollbackReaders } from './managed-releases.js';
+import { builtInDefinition, MANAGED_SOLUTION_PROFILE_KEYS } from './profiles.js';
+/** Proves the running release can read every managed schema identity ever accepted by the store. */
+export async function proveManagedReaderFloor(store) {
+    const inventory = await store.listAcceptedSchemaInventory();
+    for (const key of MANAGED_SOLUTION_PROFILE_KEYS) {
+        const definition = builtInDefinition(key);
+        if (definition.reference.kind !== 'managed') {
+            throw new Error(`managed definition resolver returned a non-managed profile for "${key}"`);
+        }
+        assertManagedRollbackReaders(key, definition.reference.release, inventory);
+    }
+    const canonical = [...inventory]
+        .map((identity) => JSON.stringify(identity))
+        .sort()
+        .join('\n');
+    return {
+        inventory: {
+            acceptedSchemaIdentities: inventory.length,
+            digest: `sha256:${createHash('sha256').update(canonical).digest('hex')}`,
+        },
+        readerTargets: MANAGED_SOLUTION_PROFILE_KEYS.length,
+    };
+}
+//# sourceMappingURL=reader-floor.js.map

package/node_modules/@noodle-borg/service/dist/business-information/source-credential-fence.js

@@ -0,0 +1,79 @@
+export class SourceCredentialError extends Error {
+    code = 'source_authorization_lost';
+    constructor() {
+        super('source_authorization_lost');
+    }
+}
+const fenced = new WeakMap();
+/** Every source consumer uses this same adapter; persisted portable bindings cannot silently fall back. */
+export function fenceSourceStore(store, authority) {
+    const prior = fenced.get(store);
+    if (prior?.authority === authority && prior !== undefined)
+        return store;
+    if (prior)
+        store = prior.raw;
+    const current = (binding, work) => (authority ? authority.withCurrent(binding, work) : work(undefined));
+    const guard = (binding, work) => current(binding, (identity) => {
+        if (identity?.generation !== binding.credentialIdentity?.generation ||
+            identity?.account !== binding.credentialIdentity?.account ||
+            identity?.configuration !== binding.credentialIdentity?.configuration)
+            throw new SourceCredentialError();
+        return work();
+    });
+    const captured = (binding, work) => current(binding, (identity) => {
+        if (!identity && binding.credentialIdentity)
+            throw new SourceCredentialError();
+        const { credentialIdentity: ignored, ...rest } = binding;
+        void ignored;
+        return work({ ...rest, ...(identity ? { credentialIdentity: identity } : {}) });
+    });
+    async function read(input, work) {
+        const binding = await store.getBinding(input);
+        return binding ? guard(binding, work) : work();
+    }
+    const result = {
+        createBinding: (input) => captured(input, (value) => store.createBinding(value)),
+        replaceBinding: async (input) => {
+            const previous = await store.getBinding(input);
+            if (previous?.credentialIdentity && !input.credentialIdentity)
+                input = { ...input, credentialIdentity: previous.credentialIdentity };
+            return captured(input, (value) => store.replaceBinding({
+                ...value,
+                expectedRevision: input.expectedRevision,
+                now: input.now,
+            }));
+        },
+        getBinding: (input) => store.getBinding(input),
+        setBindingState: (input) => store.setBindingState(input),
+        requestRefresh: (input) => read(input, () => store.requestRefresh(input)),
+        claimDue: async (input) => {
+            const lease = await store.claimDue(input);
+            if (!lease)
+                return undefined;
+            try {
+                return await guard(lease.binding, async () => lease);
+            }
+            catch (error) {
+                await store.failLease({
+                    lease,
+                    now: input.now,
+                    errorCode: 'source_authorization_lost',
+                    retryAt: new Date(input.now.getTime() + 30_000),
+                });
+                throw error;
+            }
+        },
+        commitPage: (input) => guard(input.lease.binding, () => store.commitPage(input)),
+        resetCheckpoint: (input) => store.resetCheckpoint(input),
+        failLease: (input) => store.failLease(input),
+        listExternalRecords: (input) => read(input, () => store.listExternalRecords(input)),
+        getExternalRecord: (input) => read(input, () => store.getExternalRecord(input)),
+        suppressExternalRecord: (input) => store.suppressExternalRecord(input),
+        listSuppressions: (input) => store.listSuppressions(input),
+        restoreSuppressions: (input) => store.restoreSuppressions(input),
+        purgeExpired: (input) => store.purgeExpired(input),
+    };
+    fenced.set(result, { raw: store, authority });
+    return result;
+}
+//# sourceMappingURL=source-credential-fence.js.map

package/node_modules/@noodle-borg/service/dist/business-information/source-custody-budget.js

@@ -0,0 +1,30 @@
+/** Engineering safeguards, independent of commercial plans and customer Activity retention. */
+export const SOURCE_ORG_CUSTODY_BYTES = 1024 ** 3;
+export const SOURCE_MAX_REPLICA_ROWS = 100_000;
+export const SOURCE_MAX_REFRESH_KEYS = 50_000;
+/** A conservative, validated upper bound for a row's non-payload representation. */
+export const SOURCE_METADATA_BYTES = 4096;
+export const SOURCE_REFRESH_REPLAY_MS = 30 * 86_400_000;
+export class SourceCapacityError extends Error {
+    code = 'source_capacity_exceeded';
+    constructor() {
+        super('Reference storage is full. Retained records remain available. Narrow the source or erase local records; refresh receipts recover capacity after their replay window.');
+        this.name = 'SourceCapacityError';
+    }
+}
+export function sourceDatasetCharge(retained, baseline, projected) {
+    return baseline === undefined
+        ? 2 * retained
+        : Math.max(retained, 2 * Math.max(baseline, projected));
+}
+export function sourceRowCost(kind, payloadBytes, live) {
+    return (SOURCE_METADATA_BYTES + payloadBytes + (kind === 'record' && live ? SOURCE_METADATA_BYTES : 0));
+}
+export function sourceJsonBytes(value) {
+    return Buffer.byteLength(JSON.stringify(value), 'utf8');
+}
+export function assertSourceMetadata(value) {
+    if (sourceJsonBytes(value) > SOURCE_METADATA_BYTES)
+        throw new Error('Source metadata exceeds its reserved representation');
+}
+//# sourceMappingURL=source-custody-budget.js.map

package/node_modules/@noodle-borg/service/dist/business-information/source-custody-memory.js

@@ -0,0 +1,122 @@
+import { assertSourceMetadata, SOURCE_MAX_REFRESH_KEYS, SOURCE_MAX_REPLICA_ROWS, SOURCE_METADATA_BYTES, SOURCE_ORG_CUSTODY_BYTES, SourceCapacityError, sourceDatasetCharge, sourceJsonBytes, sourceRowCost, } from './source-custody-budget.js';
+import { bindingKey } from './source-ingestion-memory-state.js';
+/** Development-only accounting; production maintains the same conservative counters in PostgreSQL. */
+export class SourceMemoryCapacity {
+    maximum;
+    #baselines = new Map();
+    constructor(maximum = SOURCE_ORG_CUSTODY_BYTES) {
+        this.maximum = maximum;
+    }
+    admit(before, after) {
+        const baselines = new Map(this.#baselines);
+        const previous = measure(before, this.#baselines);
+        const raw = measure(after, baselines);
+        for (const [key, { record }] of after.bindings) {
+            const old = before.bindings.get(key)?.record;
+            if (record.scanMode !== 'snapshot')
+                baselines.delete(key);
+            else if (old?.scanMode !== 'snapshot' || old.scanGeneration !== record.scanGeneration) {
+                baselines.set(key, raw.bindings.get(key)?.retained ?? 0);
+            }
+        }
+        for (const key of baselines.keys())
+            if (!after.bindings.has(key))
+                baselines.delete(key);
+        const next = measure(after, baselines);
+        for (const [org, bytes] of next.organizations) {
+            if (bytes > Math.max(this.maximum, previous.organizations.get(org) ?? 0))
+                throw new SourceCapacityError();
+        }
+        for (const [key, usage] of next.installations) {
+            const old = previous.installations.get(key);
+            if (usage.rows > Math.max(SOURCE_MAX_REPLICA_ROWS, old?.rows ?? 0) ||
+                usage.slots > Math.max(2 * SOURCE_MAX_REPLICA_ROWS, old?.slots ?? 0) ||
+                usage.refresh > Math.max(SOURCE_MAX_REFRESH_KEYS, old?.refresh ?? 0))
+                throw new SourceCapacityError();
+        }
+        this.#baselines = baselines;
+    }
+}
+function measure(state, baselines) {
+    const bindings = new Map();
+    const organizations = new Map();
+    const installations = new Map();
+    const installation = (key) => {
+        const scope = key.split('\0').slice(0, 4).join('\0');
+        let value = installations.get(scope);
+        if (value === undefined) {
+            value = { rows: 0, slots: 0, refresh: 0 };
+            installations.set(scope, value);
+        }
+        return value;
+    };
+    for (const [key, { record }] of state.bindings) {
+        const { scan, credentialIdentity, bindingReference, configurationReference, cursor, checkpoint, ...metadata } = record;
+        assertSourceMetadata(metadata);
+        const bytes = 2 * SOURCE_METADATA_BYTES +
+            sourceJsonBytes({
+                scan,
+                credentialIdentity,
+                bindingReference,
+                configurationReference,
+                cursor,
+                checkpoint,
+            });
+        bindings.set(key, { retained: bytes, projected: bytes });
+        installation(key);
+    }
+    for (const stored of state.records.values()) {
+        const record = stored.record;
+        const key = bindingKey({
+            scope: record.scope,
+            collectionKey: record.collectionKey,
+            id: record.source.bindingId,
+        });
+        const usage = required(bindings.get(key));
+        const { record: payload, source, ...metadata } = record;
+        assertSourceMetadata({
+            ...metadata,
+            source: { bindingId: source.bindingId, bindingGeneration: source.bindingGeneration },
+        });
+        const live = record.deletedAt === undefined;
+        const bytes = sourceRowCost('record', live ? sourceJsonBytes({ sourceId: source.id, version: source.version, record: payload }) : 0, live);
+        usage.retained += bytes;
+        usage.projected +=
+            live &&
+                state.bindings.get(key)?.record.scanMode === 'snapshot' &&
+                stored.lastSeenGeneration !== state.bindings.get(key)?.record.scanGeneration
+                ? SOURCE_METADATA_BYTES
+                : bytes;
+        const count = installation(key);
+        count.rows += 1;
+        count.slots += live ? 2 : 1;
+    }
+    for (const suppression of state.suppressions.values()) {
+        assertSourceMetadata(suppression);
+        const key = bindingKey(suppression);
+        const usage = required(bindings.get(key));
+        usage.retained += SOURCE_METADATA_BYTES;
+        usage.projected += SOURCE_METADATA_BYTES;
+        installation(key).slots += 1;
+    }
+    for (const [key, value] of bindings) {
+        const org = required(state.bindings.get(key)).record.scope.org;
+        organizations.set(org, (organizations.get(org) ?? SOURCE_METADATA_BYTES) +
+            sourceDatasetCharge(value.retained, baselines.get(key), value.projected));
+    }
+    for (const refresh of state.refresh.values()) {
+        assertSourceMetadata(refresh);
+        const org = refresh.bindingKey.split('\0')[0];
+        if (org === undefined)
+            throw new Error('Missing source receipt scope');
+        organizations.set(org, (organizations.get(org) ?? SOURCE_METADATA_BYTES) + SOURCE_METADATA_BYTES);
+        installation(refresh.bindingKey).refresh += 1;
+    }
+    return { bindings, organizations, installations };
+}
+function required(value) {
+    if (value === undefined)
+        throw new Error('Source custody scope is missing');
+    return value;
+}
+//# sourceMappingURL=source-custody-memory.js.map

package/node_modules/@noodle-borg/service/dist/business-information/source-executor.js

@@ -0,0 +1,191 @@
+import { sha256Canonical, } from '@noodle-borg/compiler';
+import { executeTool } from '@noodle-borg/runtime';
+import { privateDefinitionFromDeployment } from './definition-resolver.js';
+import { SourceCredentialError, } from './source-credential-fence.js';
+import { normalizeSourceFailureCode } from './source-ingestion-failures.js';
+import { sourceOperationSignatureDigest } from './source-ingestion-validation.js';
+const SOURCE_TOOL = '__collection_source_scan';
+/** Executes a private definition's read-only source operation through the normal governed runtime. */
+export class RegistrySourceReadExecutor {
+    sourceAuthority;
+    #registry;
+    #installations;
+    #resolveTarget;
+    constructor(registry, installations, resolveTarget, sourceAuthority) {
+        this.sourceAuthority = sourceAuthority;
+        this.#registry = registry;
+        this.#installations = installations;
+        this.#resolveTarget = resolveTarget;
+    }
+    async scan(input) {
+        const installation = await this.#installations.getInstallation(input.binding.scope);
+        if (installation?.definition.reference.kind !== 'private') {
+            throw sourceFailure('source_definition_unavailable');
+        }
+        if (!installation.intakeActive)
+            throw sourceFailure('source_application_paused');
+        if (!installation.managedCollections.includes(input.binding.collectionKey)) {
+            throw sourceFailure('source_operation_unavailable');
+        }
+        const reference = installation.definition.reference;
+        if (installation.scope.org !== reference.publisherOrg) {
+            throw sourceFailure('source_cross_org_binding_unavailable');
+        }
+        if ((await this.#registry.getAppArchivedAt(reference.publisherOrg, reference.app)) !== undefined) {
+            throw sourceFailure('source_app_archived');
+        }
+        // A private installation pins an immutable deployed artifact. A newer active deployment must not
+        // disable source reads for customers still installed on the earlier, non-archived revision.
+        const target = await this.#registry.get(reference.deploymentId);
+        if (target === undefined ||
+            target.org !== reference.publisherOrg ||
+            target.app !== reference.app ||
+            target.environment !== reference.env) {
+            throw sourceFailure('source_definition_unavailable');
+        }
+        const pinned = privateDefinitionFromDeployment({ ...reference, environment: reference.env }, {
+            ...target,
+            deploymentId: reference.deploymentId,
+            org: reference.publisherOrg,
+            app: reference.app,
+            environment: reference.env,
+            artifact: target.served.artifact,
+        });
+        if (pinned.reference.digest !== reference.digest) {
+            throw sourceFailure('source_definition_drift');
+        }
+        const collection = target.served.artifact.server.managedCollections?.find((candidate) => candidate.name === input.binding.collectionKey);
+        const source = collection?.source;
+        if (!collection ||
+            source === undefined ||
+            source.authority !== 'external' ||
+            !source.scan.resolved) {
+            throw sourceFailure('source_operation_unavailable');
+        }
+        assertExactOperation(source.scan, input.operation);
+        assertConfiguredCredentialBinding(source.scan, input.binding);
+        if (collection.schemaVersion !== input.binding.schemaVersion ||
+            collection.schemaDigest.replace(/^sha256:/, '') !== input.binding.schemaDigest) {
+            throw sourceFailure('source_schema_drift');
+        }
+        // The immutable publisher artifact grants operation intent only. All executable dependencies,
+        // operator values and credentials come from the currently activated installation tenant.
+        const scope = installation.scope;
+        const generation = await this.#registry.getAppGeneration(scope.org, scope.app);
+        if (generation === undefined || generation !== installation.applicationGeneration)
+            throw sourceFailure('source_installation_unavailable');
+        const current = await this.#registry.getActiveByTenant(scope);
+        const installed = current && (await this.#resolveTarget(current));
+        if (!installed ||
+            installed.org !== scope.org ||
+            installed.app !== scope.app ||
+            installed.environment !== scope.env ||
+            !installed.deploymentId ||
+            installed.deploymentId !== current?.deploymentId ||
+            installed.served.deps.tenantId !== `${scope.org}/${scope.app}/${scope.env}` ||
+            installed.served.deps.deploymentId !== installed.deploymentId) {
+            throw sourceFailure('source_installation_unavailable');
+        }
+        const installedCollection = installed.served.artifact.server.managedCollections?.find((candidate) => candidate.name === collection.name);
+        if (!installedCollection ||
+            sha256Canonical(installedCollection) !== sha256Canonical(collection)) {
+            throw sourceFailure('source_operation_drift');
+        }
+        // The live resolver pins this generation into broker acquisition. A revocation after this
+        // comparison is still rejected by the broker, without holding a database lock during I/O.
+        if (input.binding.credentialIdentity?.generation &&
+            (!input.binding.bindingReference ||
+                input.binding.credentialIdentity.generation !==
+                    installed.served.deps.executionBinding?.connections[input.binding.bindingReference]))
+            throw sourceFailure('source_authorization_lost');
+        const artifact = sourceArtifact(installed.served.artifact, source.scan, input.request);
+        const check = () => this.sourceAuthority?.withCurrent(input.binding, async (identity) => {
+            if (sha256Canonical(identity ?? null) !==
+                sha256Canonical(input.binding.credentialIdentity ?? null))
+                throw new SourceCredentialError();
+        });
+        await check();
+        const deps = installed.served.deps;
+        const result = await executeTool(artifact, SOURCE_TOOL, {}, {
+            ...deps,
+            broker: {
+                async getCredential(request) {
+                    const value = await deps.broker.getCredential(request);
+                    await check();
+                    return value;
+                },
+            },
+        });
+        if (!result.ok) {
+            const code = result.error.code === 'connector_error' && result.error.reason !== undefined
+                ? normalizeSourceFailureCode(result.error.reason)
+                : normalizeSourceFailureCode(result.error.code);
+            throw sourceFailure(code);
+        }
+        return result.output;
+    }
+}
+function assertConfiguredCredentialBinding(operation, binding) {
+    const credential = operation.credentialBinding;
+    if (credential === undefined ||
+        binding.bindingReference !== credential.connectionId ||
+        binding.configurationReference !== credential.connectionConfigRevision) {
+        throw sourceFailure('source_credential_binding_unavailable');
+    }
+}
+function sourceArtifact(artifact, operationRef, request) {
+    return {
+        ...artifact,
+        tools: [
+            {
+                name: SOURCE_TOOL,
+                description: 'Internal read-only collection source scan.',
+                inputSchema: {
+                    $schema: 'https://json-schema.org/draft/2020-12/schema',
+                    type: 'object',
+                    additionalProperties: false,
+                    properties: {},
+                },
+                fulfilment: {
+                    kind: 'operation',
+                    operationRef,
+                    args: literalMap(request),
+                },
+            },
+        ],
+    };
+}
+function literalMap(value) {
+    return Object.fromEntries(Object.entries(value)
+        .filter(([, item]) => item !== undefined)
+        .map(([key, item]) => [key, literal(item)]));
+}
+function literal(value) {
+    if (value === null ||
+        typeof value === 'string' ||
+        typeof value === 'number' ||
+        typeof value === 'boolean') {
+        return { kind: 'literal', value };
+    }
+    if (Array.isArray(value))
+        return { kind: 'array', items: value.map(literal) };
+    if (typeof value === 'object' && value !== null) {
+        return {
+            kind: 'object',
+            entries: Object.entries(value).map(([key, item]) => ({ key, value: literal(item) })),
+        };
+    }
+    throw sourceFailure('source_request_invalid');
+}
+function assertExactOperation(operation, expected) {
+    if (operation.connectorId !== expected.connector ||
+        operation.connectorVersion !== expected.connectorVersion ||
+        operation.operation !== expected.operation ||
+        sourceOperationSignatureDigest(operation.signatureHash) !== expected.signatureDigest) {
+        throw sourceFailure('source_operation_drift');
+    }
+}
+function sourceFailure(code) {
+    return Object.assign(new Error(code.replaceAll('_', ' ')), { code });
+}
+//# sourceMappingURL=source-executor.js.map

package/node_modules/@noodle-borg/service/dist/business-information/source-ingestion-contracts.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=source-ingestion-contracts.js.map