@noodleseed/one 0.162.0 → 0.164.0

package/node_modules/@noodle-borg/service/dist/deployment-execution.js

@@ -0,0 +1,275 @@
+import { cspFaultsInManifest } from '@noodle-borg/compiler';
+import { noopLogger } from '@noodle-borg/transport-http';
+import { BUSINESS_SETUP_MESSAGE, BusinessOnboarding } from './business-onboarding.js';
+import { manifestUsesUserRoot } from './registry-access.js';
+import { isIdentityAccessMode } from './routes/access-mode.js';
+import { provisionPublicEmbed } from './routes/deploy-public-embed.js';
+import { deploymentActivationRejection } from './routes/deployment-activation-response.js';
+/** Shared post-authorization deploy flow. Both API deploys and installations retain registry activation hooks. */
+export async function executeAuthorizedDeployment(input, dependencies) {
+    const { tenant, manifest, connectors, accessMode, identity, ownerSubject, orgMembershipSources, deploymentSource, serverVersion, automationId, } = input;
+    let hostedAssets = input.hostedAssets;
+    const idempotency = { key: input.idempotencyKey };
+    const { registry, options, controlPlane, audit } = dependencies;
+    if (options.businessOnboarding && options.businessInformationStore) {
+        const onboarding = new BusinessOnboarding(options.businessOnboarding, controlPlane, options.businessInformationStore);
+        for (const installation of await options.businessInformationStore.listInstallations(tenant.org)) {
+            if (installation.scope.app === tenant.app &&
+                installation.scope.env === tenant.env &&
+                !(await onboarding.ready(installation)))
+                return reject(409, { code: 'business_setup_required', error: BUSINESS_SETUP_MESSAGE });
+        }
+    }
+    if (input.assetSourceScope !== undefined && input.assetSourceScope.org !== tenant.org)
+        return reject(403, {
+            code: 'asset_source_forbidden',
+            error: 'Asset source must belong to the authorized installation organization.',
+        });
+    const assetScope = input.assetSourceScope ?? tenant;
+    if ((await registry.getAppArchivedAt(tenant.org, tenant.app)) !== undefined) {
+        await audit.emit({
+            eventType: 'deploy.rejected',
+            ...tenant,
+            decision: 'deny',
+            status: 409,
+            reasonCode: 'app_archived',
+            ...(identity?.subject === undefined ? {} : { actorSubject: identity.subject }),
+        });
+        return reject(409, {
+            error: 'app is archived; restore it before deploying',
+            code: 'app_archived',
+        });
+    }
+    // Identity access modes bind the data plane to verified identity, so the deployer must be authenticated.
+    // (Localhost dev runs the gate open; such deploys are rejected for lack of an owner/audit actor.)
+    if (isIdentityAccessMode(accessMode) && !identity) {
+        return reject(401, {
+            error: `${accessMode} deployments require an authenticated deployer`,
+        });
+    }
+    if (accessMode === 'public' && manifestUsesUserRoot(manifest)) {
+        return reject(400, {
+            error: 'public access mode cannot reference ${user}; use mixed for optional identity',
+        });
+    }
+    // Widget CSP gate (deploy-only): a CSP origin the host renderer will silently drop breaks the widget
+    // for end users, so the deploy is refused here. The compiler surfaces the same faults as non-blocking
+    // warnings, so `noodle dev`/`validate` still render the widget locally — only shipping is gated.
+    const [cspFault] = cspFaultsInManifest(manifest);
+    if (cspFault !== undefined) {
+        return reject(400, {
+            error: `widget "${cspFault.widget}" CSP ${cspFault.list} origin "${cspFault.value}" is not an ` +
+                `absolute https:// origin and would be dropped by the host renderer` +
+                (cspFault.suggestion !== undefined ? `; use "${cspFault.suggestion}"` : ''),
+        });
+    }
+    if ((await controlPlane.getOrg(tenant.org)) === undefined) {
+        await audit.emit({
+            eventType: 'deploy.rejected',
+            org: tenant.org,
+            app: tenant.app,
+            env: tenant.env,
+            decision: 'deny',
+            status: 404,
+            reasonCode: 'organization_not_found',
+            ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
+            ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
+        });
+        return reject(404, {
+            code: 'organization_not_found',
+            error: 'organization must be created before deploy',
+        });
+    }
+    const logger = options.logger ?? noopLogger;
+    if (hostedAssets !== undefined && hostedAssets.length > 0) {
+        if (options.assetStore === undefined) {
+            await audit.emit({
+                eventType: 'asset.rejected',
+                org: tenant.org,
+                app: tenant.app,
+                env: tenant.env,
+                decision: 'deny',
+                status: 400,
+                reasonCode: 'asset_store_not_configured',
+                ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
+                ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
+                details: { assetCount: hostedAssets.length },
+            });
+            return reject(400, { error: 'hosted assets are not configured for this service' });
+        }
+        const verified = await options.assetStore.verifyUploadedAssets({
+            scope: assetScope,
+            assets: hostedAssets,
+        });
+        if (!verified.ok) {
+            await audit.emit({
+                eventType: 'asset.rejected',
+                org: tenant.org,
+                app: tenant.app,
+                env: tenant.env,
+                decision: 'deny',
+                status: 400,
+                reasonCode: 'asset_verification_failed',
+                ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
+                ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
+                details: { assetCount: hostedAssets.length },
+            });
+            return reject(400, { error: verified.error });
+        }
+        hostedAssets = verified.assets;
+    }
+    let result;
+    try {
+        result = await registry.deploy(tenant, manifest, {
+            connectors,
+            actor: identity || undefined,
+            accessMode,
+            ownerSubject,
+            ...(orgMembershipSources !== undefined ? { orgMembershipSources } : {}),
+            hostedAssets,
+            serverVersion,
+            deploymentSource: automationId === undefined ? (deploymentSource ?? 'api') : 'github',
+            ...(idempotency.key !== undefined ? { idempotencyKey: idempotency.key } : {}),
+            ...(automationId === undefined ? {} : { automationId }),
+        });
+    }
+    catch (error) {
+        const rejected = await deploymentActivationRejection(error, {
+            audit,
+            eventType: 'deploy.rejected',
+            org: tenant.org,
+            app: tenant.app,
+            env: tenant.env,
+            ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
+            ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
+        });
+        if (rejected !== undefined)
+            return reject(rejected.status, rejected.body);
+        throw error;
+    }
+    if (!result.ok) {
+        if ('conflict' in result) {
+            if (result.code === 'deployment_locked') {
+                await audit.emit({
+                    eventType: 'deploy.rejected',
+                    org: tenant.org,
+                    app: tenant.app,
+                    env: tenant.env,
+                    decision: 'deny',
+                    status: 409,
+                    reasonCode: result.code,
+                    ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
+                    ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
+                    details: { serverVersion },
+                });
+            }
+            return reject(409, {
+                ok: false,
+                code: result.code,
+                error: result.message,
+            });
+        }
+        if ('superseded' in result) {
+            if (automationId !== undefined) {
+                await options.deploymentAutomation
+                    ?.recordSuperseded?.({ automationId, target: tenant })
+                    .catch(() => undefined);
+            }
+            return reject(409, {
+                ok: false,
+                code: 'run_superseded',
+                error: 'a newer GitHub deploy run exists for this app/env; this run was not activated',
+                deploymentId: result.deploymentId,
+                ...(result.serverVersion !== undefined ? { serverVersion: result.serverVersion } : {}),
+            });
+        }
+        // Codes are safe enum strings; never a path-with-value. No secret name or value is logged.
+        const codes = result.errors.map((error) => error.code).join(',');
+        logger.warn('deploy.rejected', {
+            status: 400,
+            errorCount: result.errors.length,
+            codes,
+        });
+        // Durable audit: a rejected deploy is a governance event. Safe fields only — no manifest body.
+        await audit.emit({
+            eventType: 'deploy.rejected',
+            org: tenant.org,
+            app: tenant.app,
+            env: tenant.env,
+            decision: 'deny',
+            status: 400,
+            reasonCode: 'compile_failed',
+            ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
+            ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
+            details: { errorCount: result.errors.length, codes },
+        });
+        return reject(400, { ok: false, errors: result.errors });
+    }
+    // Counts only — never secret names or values.
+    logger.info('deploy.ok', {
+        deploymentId: result.deploymentId,
+        serverVersion: result.serverVersion,
+        org: tenant.org,
+        app: tenant.app,
+        env: tenant.env,
+        hasConnectors: connectors !== undefined,
+    });
+    await audit.emit({
+        eventType: 'deploy.accepted',
+        org: tenant.org,
+        app: tenant.app,
+        env: tenant.env,
+        decision: 'allow',
+        status: 201,
+        ...(result.deploymentId !== undefined ? { deploymentId: result.deploymentId } : {}),
+        ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
+        ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
+        details: {
+            accessMode: result.accessMode ?? accessMode,
+            deploymentSource: automationId === undefined ? (deploymentSource ?? 'api') : 'github',
+            ...(ownerSubject !== undefined ? { ownerSubject } : {}),
+            serverVersion: result.serverVersion,
+            hasConnectors: connectors !== undefined,
+        },
+    });
+    // Tenant-safe developer-facing log (M3, ADR 0101): a safe deploy-lifecycle record the developer can read
+    // via `noodle logs`. Only scalar metadata, no manifest/secret/payload material.
+    await options.userAppLogStore?.emit({
+        level: 'info',
+        message: 'deployment live',
+        org: tenant.org,
+        app: tenant.app,
+        env: tenant.env,
+        ...(result.deploymentId !== undefined ? { deploymentId: result.deploymentId } : {}),
+        details: { accessMode: result.accessMode ?? accessMode, serverVersion: result.serverVersion },
+    });
+    if (result.ok && hostedAssets !== undefined && hostedAssets.length > 0) {
+        await audit.emit({
+            eventType: 'asset.activation.accepted',
+            org: tenant.org,
+            app: tenant.app,
+            env: tenant.env,
+            decision: 'allow',
+            status: 201,
+            deploymentId: result.deploymentId,
+            ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
+            ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
+            details: {
+                assetCount: hostedAssets.length,
+                totalBytes: hostedAssets.reduce((sum, asset) => sum + asset.byteLength, 0),
+            },
+        });
+        await options.assetStore?.recordReachability({
+            scope: assetScope,
+            deploymentId: result.deploymentId,
+            deploymentVersion: result.deploymentVersion,
+            assets: hostedAssets,
+        });
+    }
+    const embedId = await provisionPublicEmbed(registry, options, tenant, result.deploymentId);
+    return { ok: true, result, ...(embedId === undefined ? {} : { embedId }) };
+}
+function reject(status, body) {
+    return { ok: false, status, body };
+}
+//# sourceMappingURL=deployment-execution.js.map

package/node_modules/@noodle-borg/service/dist/external-credential-binding-broker.js

@@ -1,3 +1,4 @@
+import { externalCredentialExchangeResponseSchema } from '@noodle-borg/external-credential-provider';
 import { CredentialUnavailableError, MapServiceBroker, } from '@noodle-borg/runtime';
 import { routeBoundCredentialKey } from './credential-route-key.js';
 import { exchangeExternalCredential, resolveExternalCredentialProviderConfig, } from './external-credential-exchange.js';
@@ -17,6 +18,23 @@ export class ExternalCredentialBindingBroker {
             request.deploymentId !== this.options.deployment) {
             throw new CredentialUnavailableError('credential_not_configured');
         }
+        if ('localProvider' in this.options) {
+            try {
+                const value = externalCredentialExchangeResponseSchema.parse(await this.options.localProvider.getCredential({
+                    tenantId: this.options.tenant,
+                    deploymentId: this.options.deployment,
+                    descriptor: allowed.descriptor,
+                    ...(request.expectedConnectionGeneration === undefined
+                        ? {}
+                        : { expectedConnectionGeneration: request.expectedConnectionGeneration }),
+                }));
+                return { token: value.access_token };
+            }
+            catch {
+                throw new CredentialUnavailableError('credential_exchange_failed');
+            }
+        }
+        const options = this.options;
         const pinOrVerify = resolveSubjectPinCallable(this.options.subjectPins);
         if (pinOrVerify === undefined) {
             throw new CredentialUnavailableError('credential_not_configured');
@@ -57,7 +75,7 @@ export class ExternalCredentialBindingBroker {
             let exchanged;
             try {
                 exchanged = await exchangeExternalCredential({
-                    options: this.options,
+                    options,
                     descriptor: allowed.descriptor,
                     config,
                     nowMs: this.now(),

package/node_modules/@noodle-borg/service/dist/external-credential-exchange.d.ts

@@ -69,7 +69,22 @@ export interface ExternalCredentialExchangeOptions {
     readonly dnsLookup?: DnsLookup;
     readonly timeoutSignal?: (timeoutMs: number) => AbortSignal;
 }
-export type ExternalCredentialExchangeRuntimeOptions = Pick<ExternalCredentialExchangeOptions, 'issuer' | 'signer' | 'providers' | 'subjectPins'>;
+/** In-process portable authority; the same compiled binding is still enforced by ManagedConfigBroker. */
+export interface LocalExternalCredentialProvider {
+    getCredential(input: {
+        readonly tenantId: string;
+        readonly deploymentId: string;
+        readonly descriptor: CredentialBindingDescriptor;
+        readonly expectedConnectionGeneration?: string;
+    }): Promise<ExternalCredentialExchangeResponse>;
+}
+export interface LocalExternalCredentialExchangeOptions {
+    readonly tenant: string;
+    readonly deployment: string;
+    readonly localProvider: LocalExternalCredentialProvider;
+}
+export type BoundExternalCredentialExchangeOptions = ExternalCredentialExchangeOptions | LocalExternalCredentialExchangeOptions;
+export type ExternalCredentialExchangeRuntimeOptions = Pick<ExternalCredentialExchangeOptions, 'issuer' | 'signer' | 'providers' | 'subjectPins'> | Pick<LocalExternalCredentialExchangeOptions, 'localProvider'>;
 export declare function resolveExternalCredentialProviderConfig(options: ExternalCredentialExchangeOptions, descriptor: CredentialBindingDescriptor): Promise<ExternalCredentialProviderConfig | undefined>;
 export declare function exchangeExternalCredential(input: {
     readonly options: ExternalCredentialExchangeOptions;

package/node_modules/@noodle-borg/service/dist/modules/host.js

@@ -13,6 +13,7 @@ export class ModuleHost {
     toolDispatch;
     deploymentActivation;
     organizationProvisioning;
+    resolveActivityHistoryAllowance;
     admissionGate;
     moduleCapabilities;
     moduleCapabilityDetails;
@@ -32,6 +33,7 @@ export class ModuleHost {
         this.toolDispatch = toolDispatchFor(modules, options.toolDispatch);
         this.deploymentActivation = collectDeploymentActivation(modules);
         this.organizationProvisioning = singleContribution(modules, 'organizationProvisioning');
+        this.resolveActivityHistoryAllowance = singleContribution(modules, 'resolveActivityHistoryAllowance');
         if (this.deploymentAutomation !== undefined &&
             !this.deploymentActivation.some((hook) => hook.phase === DEPLOYMENT_ACTIVATION_PHASE.AUTOMATION_FRESHNESS)) {
             throw new Error('deployment automation requires an automation-freshness activation hook');
@@ -125,7 +127,8 @@ function deriveModuleCapabilities(modules) {
             contributions.toolDispatch !== undefined ||
             contributions.deploymentActivation !== undefined ||
             contributions.organizationProvisioning !== undefined ||
-            contributions.deploymentAutomation !== undefined) {
+            contributions.deploymentAutomation !== undefined ||
+            contributions.resolveActivityHistoryAllowance !== undefined) {
             found.add('controls');
         }
         if (contributions.auditStore !== undefined ||

package/node_modules/@noodle-borg/service/dist/native-record-connector.d.ts

@@ -0,0 +1,20 @@
+import { type DailyCounterStore } from '@noodle-borg/admission-limits/portable';
+import { type RuntimeArtifact } from '@noodle-borg/compiler';
+import { type Connector } from '@noodle-borg/runtime';
+import type { BusinessInformationStore } from './business-information/contracts.js';
+import type { TenantRef } from './store.js';
+export interface NativeRecordConnectorInput {
+    readonly tenant: TenantRef;
+    readonly artifact: RuntimeArtifact;
+    readonly deploymentId?: string;
+}
+export interface NativeRecordConnectorDependencies {
+    readonly store: BusinessInformationStore;
+    readonly counters: DailyCounterStore;
+    readonly publicIntakeEnabled?: boolean;
+    readonly now?: () => Date;
+}
+export type NativeRecordConnectorFactory = (input: NativeRecordConnectorInput) => Connector | undefined;
+/** Platform composition supplies storage; an authored declaration alone grants no installed authority. */
+export declare function createDeploymentNativeRecordConnector(input: NativeRecordConnectorInput, dependencies: NativeRecordConnectorDependencies): Connector | undefined;
+//# sourceMappingURL=native-record-connector.d.ts.map

package/node_modules/@noodle-borg/service/dist/native-record-connector.js

@@ -0,0 +1,206 @@
+import { admitPublicRecord } from '@noodle-borg/admission-limits/portable';
+import { RECORD_CONNECTOR_ID, RECORD_CONNECTOR_VERSION, RECORD_OPERATION_SIGNATURES, validateJsonSchema, } from '@noodle-borg/compiler';
+import { ConnectorInvocationError } from '@noodle-borg/runtime';
+import { creationPayload } from './business-information/collection-controls.js';
+import { businessGrantAllows, idempotencyDigest, requestFingerprint, } from './business-information/model.js';
+import { NativeStorageLimitError } from './business-information/native-storage-budget.js';
+import { CursorValidationError, PayloadValidationError, } from './business-information/validation.js';
+import { recordToWire } from './routes/business-information-wire.js';
+/** Platform composition supplies storage; an authored declaration alone grants no installed authority. */
+export function createDeploymentNativeRecordConnector(input, dependencies) {
+    if (!input.artifact.server.managedCollections?.some((collection) => collection.source.authority === 'native'))
+        return undefined;
+    return new NativeRecordConnector(input, dependencies);
+}
+class NativeRecordConnector {
+    input;
+    dependencies;
+    id = RECORD_CONNECTOR_ID;
+    version = RECORD_CONNECTOR_VERSION;
+    constructor(input, dependencies) {
+        this.input = input;
+        this.dependencies = dependencies;
+    }
+    signature(operation) {
+        return RECORD_OPERATION_SIGNATURES[operation];
+    }
+    executionBoundMs(operation) {
+        return this.signature(operation)?.type === 'action' ? 10_000 : undefined;
+    }
+    async invoke(call) {
+        const signature = this.signature(call.operation);
+        if (signature === undefined || validateJsonSchema(signature.input, call.args).length > 0)
+            return fail(call, 400, 'Invalid native record operation arguments.');
+        if (signature.type === 'action' && !/^[a-f0-9]{64}$/.test(call.execution?.id ?? ''))
+            return fail(call, 503, 'A trusted execution identity is required before a native record write.');
+        const installations = (await this.dependencies.store.listInstallations(this.input.tenant.org)).filter((installation) => installation.scope.app === this.input.tenant.app &&
+            installation.scope.env === this.input.tenant.env);
+        if (installations.length !== 1)
+            return fail(call, 503, 'Native record installation is unavailable.');
+        const installation = installations[0];
+        if (installation === undefined)
+            return fail(call, 503, 'Native record installation is unavailable.');
+        const collection = installation.definition.collections.find((entry) => entry.key === call.args.collection);
+        const authored = this.input.artifact.server.managedCollections?.find((entry) => entry.name === call.args.collection);
+        if (collection === undefined ||
+            authored === undefined ||
+            !installation.managedCollections.includes(collection.key))
+            return fail(call, 404, 'Native collection is not enabled for this application.');
+        if (collection.authority.authority !== 'native' || authored.source.authority !== 'native')
+            return fail(call, 405, 'External reference collections do not accept native record operations.');
+        if (collection.schemaDigest.replace(/^sha256:/, '') !==
+            authored.schemaDigest.replace(/^sha256:/, ''))
+            return fail(call, 409, 'Collection definition changed; activate the current application before continuing.');
+        const publicInput = call.operation === 'submit_record';
+        if (!publicInput)
+            await this.authorize(call, installation);
+        try {
+            return await this.execute(call, installation, collection, publicInput);
+        }
+        catch (error) {
+            if (error instanceof CursorValidationError)
+                return fail(call, 400, 'Invalid or stale record cursor; restart the query.');
+            if (error instanceof NativeStorageLimitError)
+                return fail(call, 409, error.message);
+            if (error instanceof PayloadValidationError)
+                return fail(call, 400, 'Record fields do not match the declared collection permissions and schema.');
+            throw error;
+        }
+    }
+    async authorize(call, installation) {
+        if (call.caller?.identityKind !== 'platform')
+            return fail(call, 403, 'A live business grant is required for staff record operations.');
+        const permission = call.operation === 'create_record'
+            ? 'records:create'
+            : call.operation === 'update_record'
+                ? 'records:update'
+                : call.operation === 'delete_record'
+                    ? 'records:delete'
+                    : 'records:read';
+        const grant = await this.dependencies.store.getGrant(installation.scope, call.caller.subject);
+        if (!businessGrantAllows(grant, permission))
+            return fail(call, 403, 'A live business grant is required for this record operation.');
+    }
+    async execute(call, installation, collection, publicInput) {
+        const store = this.dependencies.store;
+        const scope = installation.scope;
+        const actorSubject = call.caller?.subject ?? 'anonymous';
+        if (call.operation === 'submit_record' || call.operation === 'create_record') {
+            // Validate before receipt probing/admission, and preserve the admitted payload as the replay fingerprint.
+            creationPayload(collection, call.args.payload, publicInput);
+            const payload = call.args.payload;
+            const key = call.execution?.id;
+            if (key === undefined)
+                return fail(call, 503, 'A trusted execution identity is required.');
+            const request = {
+                scope,
+                collectionKey: collection.key,
+                idempotencyKey: key,
+                payload,
+                ...(publicInput ? { publicInput: true } : {}),
+                origin: { kind: 'mcp', reference: 'native-tool' },
+                actorSubject,
+            };
+            const completed = await store.probeRequest(request);
+            if (completed.disposition === 'conflict')
+                return fail(call, 409, 'This execution identity was already used with different record content.');
+            if (completed.disposition === 'replayed') {
+                call.reportOutcome?.({ outcome: 'completed', reference: completed.record.id });
+                return publicInput
+                    ? receipt(completed.record)
+                    : { ok: true, record: recordToWire(completed.record) };
+            }
+            if (publicInput) {
+                if (!installation.intakeActive || this.dependencies.publicIntakeEnabled === false)
+                    return fail(call, 503, 'Public record intake is paused.');
+                if (call.publicAdmission === undefined || !call.publicAdmission.network)
+                    return fail(call, 503, 'Trusted network admission context is required for public record writes.');
+                const quota = await admitPublicRecord({
+                    counters: this.dependencies.counters,
+                    surfaceId: installation.publicId,
+                    attempt: {
+                        key: `solution-intake:logical:${installation.publicId}:${idempotencyDigest(key)}`,
+                        fingerprint: requestFingerprint(request),
+                    },
+                    buckets: call.publicAdmission,
+                    now: this.dependencies.now?.() ?? new Date(),
+                });
+                if (!quota.allowed)
+                    return fail(call, quota.reason === 'quota_exceeded'
+                        ? 429
+                        : quota.reason === 'idempotency_conflict'
+                            ? 409
+                            : 503, quota.reason === 'quota_exceeded'
+                        ? 'Public record admission limit exceeded.'
+                        : 'Public record admission is unavailable.');
+            }
+            else
+                await this.authorize(call, installation);
+            if (call.signal?.aborted)
+                return fail(call, 503, 'Native record write was cancelled before dispatch.');
+            const created = await store.createRequest(request);
+            if (created.disposition === 'conflict')
+                return fail(call, 409, 'Record creation conflicts with the original execution.');
+            if (created.disposition === 'paused')
+                return fail(call, 503, 'Public record intake is paused.');
+            call.reportOutcome?.({ outcome: 'completed', reference: created.record.id });
+            return publicInput
+                ? receipt(created.record)
+                : { ok: true, record: recordToWire(created.record) };
+        }
+        if (call.operation === 'list_records') {
+            const result = await store.listRequests({
+                scope,
+                collectionKey: collection.key,
+                ...(call.args.cursor === undefined ? {} : { cursor: String(call.args.cursor) }),
+                ...(call.args.limit === undefined ? {} : { limit: Number(call.args.limit) }),
+            });
+            return {
+                ok: true,
+                records: result.records.map(recordToWire),
+                ...(result.nextCursor === undefined ? {} : { nextCursor: result.nextCursor }),
+            };
+        }
+        const id = String(call.args.id);
+        if (call.operation === 'get_record') {
+            const record = await store.getRequest(scope, collection.key, id);
+            if (record === undefined)
+                return fail(call, 404, 'Native record was not found.');
+            return { ok: true, record: recordToWire(record) };
+        }
+        await this.authorize(call, installation);
+        const mutation = {
+            scope,
+            collectionKey: collection.key,
+            id,
+            expectedRevision: Number(call.args.expectedRevision),
+            actorSubject,
+        };
+        if (call.signal?.aborted)
+            return fail(call, 503, 'Native record write was cancelled before dispatch.');
+        const result = call.operation === 'delete_record'
+            ? await store.deleteRequest({ ...mutation, reason: 'customer_request' })
+            : await store.mutateRequest({
+                ...mutation,
+                operation: {
+                    kind: 'update',
+                    payload: call.args.patch,
+                    ...(call.args.unset === undefined ? {} : { unset: call.args.unset }),
+                },
+            });
+        if (!result.ok)
+            return fail(call, result.reason === 'not_found' ? 404 : result.reason === 'conflict' ? 409 : 422, 'Native record operation was not applied; inspect the current record and revision.');
+        call.reportOutcome?.({ outcome: 'completed', reference: result.record.id });
+        return call.operation === 'delete_record'
+            ? receipt(result.record)
+            : { ok: true, record: recordToWire(result.record) };
+    }
+}
+function receipt(record) {
+    return { ok: true, recordId: record.id, revision: record.revision };
+}
+function fail(call, status, message) {
+    call.reportOutcome?.({ outcome: 'rejected' });
+    throw new ConnectorInvocationError(message, { status, retryable: false });
+}
+//# sourceMappingURL=native-record-connector.js.map

package/node_modules/@noodle-borg/service/dist/oauth/store.d.ts

@@ -169,6 +169,8 @@ export interface DelegatedCredentialLookup {
 export interface OAuthStore extends DeviceAuthorizationStore {
     /** Dynamic client registration (RFC 7591): persist + read the SDK-generated client info. */
     getClient(clientId: string): Promise<OAuthClientInformationFull | undefined>;
+    /** Durable server-owned purpose; absent registration is distinct from a known dynamic client. */
+    getClientPurpose(clientId: string): Promise<'console' | 'portal' | 'dynamic' | undefined>;
     putClient(client: OAuthClientInformationFull): Promise<OAuthClientInformationFull>;
     /** Atomically reserves or reconciles a server-owned client without taking over a DCR registration. */
     putFirstPartyClient(owner: 'console' | 'portal', client: OAuthClientInformationFull): Promise<OAuthClientInformationFull>;
@@ -219,6 +221,7 @@ export interface OAuthStore extends DeviceAuthorizationStore {
 export declare class InMemoryOAuthStore implements OAuthStore {
     #private;
     getClient(clientId: string): Promise<OAuthClientInformationFull | undefined>;
+    getClientPurpose(clientId: string): Promise<'console' | 'portal' | 'dynamic' | undefined>;
     putClient(client: OAuthClientInformationFull): Promise<OAuthClientInformationFull>;
     putFirstPartyClient(owner: 'console' | 'portal', client: OAuthClientInformationFull): Promise<OAuthClientInformationFull>;
     createPendingAuthorization(record: PendingAuthorizationRecord): Promise<void>;