@noodleseed/one 0.164.0 → 0.165.0

package/node_modules/@noodle-borg/service/dist/routes/business-information-staff.js

@@ -3,8 +3,9 @@ import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
 import { BusinessInvitationCreateRequestSchema, BusinessInvitationRevokeRequestSchema, formatWireError, } from '@noodle-borg/wire-contracts';
 import { hashToken } from '../oauth/tokens.js';
 import { requireIdentity, requireInstallationPermission, } from './business-information.js';
+import { installationProjection } from './business-information-installation.js';
 import { parseBusinessPaging } from './business-information-request.js';
-import { grantToWire, installationToWire, invitationToWire } from './business-information-wire.js';
+import { grantToWire, invitationToWire } from './business-information-wire.js';
 const HOUR_MS = 60 * 60 * 1_000;
 export async function handleMySolutionInstallations(req, res, deps) {
     if (req.method !== 'GET')
@@ -28,7 +29,7 @@ export async function handleMySolutionInstallations(req, res, deps) {
     sendJson(res, 200, {
         ok: true,
         data: {
-            installations: visible.map(({ installation, grant }) => installationToWire(installation, grant.role)),
+            installations: await Promise.all(visible.map(({ installation, grant }) => installationProjection(installation, grant.role, identity, deps))),
             ...(joined.length > limit && visible.at(-1) !== undefined
                 ? { nextCursor: encodeDiscoveryCursor(visible.at(-1)) }
                 : {}),
@@ -186,7 +187,7 @@ export async function handleBusinessInvitationAccept(req, res, rawToken, deps) {
     sendJson(res, 201, {
         ok: true,
         data: {
-            installation: installationToWire(installation, result.grant.role),
+            installation: await installationProjection(installation, result.grant.role, identity, deps),
             grant: grantToWire(result.grant),
         },
     });

package/node_modules/@noodle-borg/service/dist/routes/business-information.js

@@ -1,14 +1,15 @@
 import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
 import { BusinessGrantCreateRequestSchema, formatWireError, ManagedRecordCreateRequestSchema, ManagedRecordMutationRequestSchema, ManagedRecordStatusSchema, SolutionInstallationCreateRequestSchema, SolutionInstallationIntakeRequestSchema, } from '@noodle-borg/wire-contracts';
 import { admitBusinessMutation, admitBusinessTarget, authorizeBusinessApi, } from '../business-api-admission.js';
+import { resolveInstallDefinition } from '../business-information/definition-resolver.js';
 import { BUILT_IN_SOLUTION_PROFILES, businessGrantAllows, MANAGED_SOLUTION_PROFILE_KEYS, PayloadValidationError, validateCollectionEnabled, } from '../business-information/portable.js';
 import { sendForbidden } from '../http-util.js';
 import { loadExternalRecord, sendExternalRecordPage, sourceBindingKey, unsupportedExternalOperation, } from './business-information-external.js';
-import { resolveInstallDefinition, stableInstallationId, } from './business-information-installation.js';
+import { installationProjection, retryInstallationActivation, stableInstallationId, } from './business-information-installation.js';
 import { createNativeRecord } from './business-information-record-create.js';
 import { cursorRequest, sendNativeRecordActivity } from './business-information-record-reads.js';
 import { expectedRevision, mutationPermission, parseNativeRecordQuery, parseBusinessPaging as parsePaging, requestIdempotencyKey, } from './business-information-request.js';
-import { collectionToWire, externalRecordToWire, grantToWire, installationToWire, profileToWire, recordDetailToWire, recordToWire, } from './business-information-wire.js';
+import { collectionToWire, externalRecordToWire, grantToWire, profileToWire, recordDetailToWire, recordToWire, } from './business-information-wire.js';
 import { canManageMembers } from './org-admin.js';
 export function handleSolutionCatalog(req, res) {
     if (req.method !== 'GET') {
@@ -26,6 +27,8 @@ export async function handleSolutionInstallations(req, res, ref, deps) {
     const identity = await requireIdentity(req, res, deps);
     if (identity === false)
         return;
+    if (ref.action === 'activate')
+        return retryInstallationActivation(req, res, ref, identity, deps);
     if (req.method === 'POST' && ref.installationId === undefined) {
         if (!(await canManageMembers(deps.controlPlane, ref.org, identity))) {
             return sendForbidden(res, 'organization owner required');
@@ -96,7 +99,7 @@ export async function handleSolutionInstallations(req, res, ref, deps) {
         return sendJson(res, result.disposition === 'created' ? 201 : 200, {
             ok: true,
             data: {
-                installation: installationToWire(result.installation, grant.role),
+                installation: await installationProjection(result.installation, grant.role, identity, deps),
             },
         });
     }
@@ -114,7 +117,7 @@ export async function handleSolutionInstallations(req, res, ref, deps) {
         return sendJson(res, 200, {
             ok: true,
             data: {
-                installations: permitted.map(({ installation, role }) => installationToWire(installation, role)),
+                installations: await Promise.all(permitted.map(({ installation, role }) => installationProjection(installation, role, identity, deps))),
             },
         });
     }
@@ -125,7 +128,7 @@ export async function handleSolutionInstallations(req, res, ref, deps) {
         return sendJson(res, 200, {
             ok: true,
             data: {
-                installation: installationToWire(authorized.installation, authorized.grant.role),
+                installation: await installationProjection(authorized.installation, authorized.grant.role, identity, deps),
             },
         });
     }
@@ -149,7 +152,9 @@ export async function handleSolutionInstallations(req, res, ref, deps) {
             return mutationFailure(res, result);
         return sendJson(res, 200, {
             ok: true,
-            data: { installation: installationToWire(result.installation, authorized.grant.role) },
+            data: {
+                installation: await installationProjection(result.installation, authorized.grant.role, identity, deps),
+            },
         });
     }
     return methodNotAllowed(res);

package/node_modules/@noodle-borg/service/dist/routes/deploy-public-embed.js

@@ -9,7 +9,7 @@ import { publicSurfaceOf } from '@noodle-borg/assistant-gateway/portable';
  * Read from the just-activated artifact rather than the submitted manifest, so the id follows what the
  * runtime will actually serve — the same source minting and projection read.
  */
-export async function provisionPublicEmbed(registry, options, tenant, deploymentId) {
+export async function provisionPublicEmbed(registry, options, tenant, deploymentId, allowRevokedReplacement = true) {
     const embeds = options.publicEmbeds;
     if (embeds === undefined || deploymentId === undefined)
         return undefined;
@@ -18,7 +18,12 @@ export async function provisionPublicEmbed(registry, options, tenant, deployment
     if (surface === undefined)
         return undefined;
     try {
-        const record = await embeds.ensure({ ...tenant, surfaceMode: surface.mode, now: new Date() });
+        const record = await embeds.ensure({
+            ...tenant,
+            surfaceMode: surface.mode,
+            now: new Date(),
+            allowRevokedReplacement,
+        });
         return record.embedId;
     }
     catch {

package/node_modules/@noodle-borg/service/dist/service.js

@@ -96,7 +96,7 @@ export function createServiceHandler(registry, options = {}) {
             allowance: async (org, request) => moduleHost.resolveActivityHistoryAllowance?.(org, request),
         });
     const withIntentMode = createIntentTargetResolver(intentSettings, intentPreviewOrgs);
-    const { activateInstallation, resolveRuntimeTarget, businessOnboarding } = createApplicationServingRuntime(registry, providerOptions, controlPlane, audit, activity);
+    const { activateInstallation, readInstallationActivation, resolveRuntimeTarget, businessOnboarding, } = createApplicationServingRuntime(registry, providerOptions, controlPlane, audit, activity);
     const runtimeTarget = async (target) => target === undefined ? undefined : resolveRuntimeTarget(target);
     const router = createMcpRouter(async (id) => withIntentMode(await runtimeTarget(await registry.getServing(id))), {
         logger,
@@ -282,6 +282,7 @@ export function createServiceHandler(registry, options = {}) {
                 store: businessInformationStore,
                 ...(businessOnboarding ? { businessOnboarding } : {}),
                 activateInstallation,
+                readInstallationActivation,
                 ...(activity === undefined ? {} : { activity }),
                 ...(options.connectionRuntime === undefined
                     ? {}

package/node_modules/@noodle-borg/service/dist/solution-installation-activation.js

@@ -1,9 +1,44 @@
 import { sha256Canonical } from '@noodle-borg/app-package';
+import { publicSurfaceOf } from '@noodle-borg/assistant-gateway/portable';
 import { ApplicationSettings, installationSettingsTarget } from './application-settings.js';
 import { privateDefinitionFromDeployment } from './business-information/definition-resolver.js';
 import { managedSolutionManifest } from './business-information/managed-solution-executable.js';
 import { BUSINESS_SETUP_MESSAGE, BusinessOnboarding } from './business-onboarding.js';
 import { executeAuthorizedDeployment, } from './deployment-execution.js';
+import { provisionPublicEmbed } from './routes/deploy-public-embed.js';
+/** Deployment/binding readiness only; channel model, origin and connection checks remain separate. */
+export async function readSolutionInstallationActivation(installation, dependencies) {
+    try {
+        const { registry, businessInformationStore: store, options, controlPlane } = dependencies;
+        const stored = await store?.getInstallation(installation.scope);
+        if (!store || !stored)
+            return 'unavailable';
+        const { org, app } = stored.scope;
+        const generation = await registry.getAppGeneration(org, app);
+        if ((await registry.getAppArchivedAt(org, app)) !== undefined ||
+            (stored.applicationGeneration !== 'pending' &&
+                (!generation ||
+                    (stored.applicationGeneration !== undefined &&
+                        stored.applicationGeneration !== generation))) ||
+            (options.businessOnboarding !== undefined &&
+                !(await new BusinessOnboarding(options.businessOnboarding, controlPlane, store).ready(stored))))
+            return 'unavailable';
+        const target = await registry.getActiveByTenant(stored.scope);
+        if (!target || stored.applicationGeneration === 'pending')
+            return 'pending';
+        if (publicSurfaceOf(target.served.artifact.server.assistant)) {
+            if (!options.publicEmbeds)
+                return 'unavailable';
+            const embeds = await options.publicEmbeds.list(stored.scope, { includeRevoked: true });
+            if (!embeds.some((embed) => embed.revokedAt === undefined))
+                return embeds.length > 0 ? 'unavailable' : 'pending';
+        }
+        return 'ready';
+    }
+    catch {
+        return 'unavailable';
+    }
+}
 /** Called after installation authorization, and by the managed-runtime refresh boundary. Never copies configuration. */
 export async function activateSolutionInstallation(input, dependencies) {
     const { installation, actor } = input;
@@ -32,13 +67,32 @@ export async function activateSolutionInstallation(input, dependencies) {
         !(await store.bindApplication(installation.scope, generation ?? ''))) {
         return reject(409, 'installation_application_unavailable', 'The retained installation requires application ownership recovery before activation.');
     }
-    const bind = async (deploymentId) => {
+    const bind = async (deploymentId, reconcileEmbed) => {
         const currentGeneration = await dependencies.registry.getAppGeneration(tenant.org, tenant.app);
         if (store &&
             (!currentGeneration || !(await store.bindApplication(installation.scope, currentGeneration))))
             return reject(409, 'installation_application_unavailable', 'Application activation was interrupted; retained records remain accessible.');
         if ((installation.definition.variables?.length ?? 0) > 0)
             await new ApplicationSettings(dependencies.registry.configStore).initialize(installationSettingsTarget(installation));
+        const target = await dependencies.registry.get(deploymentId);
+        if (input.purpose !== 'runtime-refresh' &&
+            dependencies.options.publicEmbeds &&
+            publicSurfaceOf(target?.served.artifact.server.assistant)) {
+            try {
+                if (reconcileEmbed)
+                    await provisionPublicEmbed(dependencies.registry, dependencies.options, tenant, deploymentId, false);
+                const embeds = await dependencies.options.publicEmbeds.list(tenant, {
+                    includeRevoked: true,
+                });
+                if (!embeds.some((embed) => embed.revokedAt === undefined))
+                    return embeds.length > 0
+                        ? reject(409, 'installation_embed_revoked', 'The assistant was deliberately revoked. Use explicit channel recovery; activation does not replace revoked access.')
+                        : reject(503, 'installation_activation_incomplete', 'The installation is saved. Retry activation to finish assistant setup.');
+            }
+            catch {
+                return reject(503, 'installation_activation_incomplete', 'The installation is saved. Retry activation when assistant setup is available.');
+            }
+        }
         return { ok: true, deploymentId };
     };
     const source = await executableSource(installation, dependencies.registry);
@@ -63,7 +117,7 @@ export async function activateSolutionInstallation(input, dependencies) {
         currentSource.manifest === source.value.manifest &&
         currentSource.connectors === source.value.connectors &&
         JSON.stringify(currentSource.hostedAssets) === JSON.stringify(source.value.hostedAssets)) {
-        return bind(current.deploymentId);
+        return bind(current.deploymentId, true);
     }
     const key = sha256Canonical({
         scope: installation.scope,
@@ -84,6 +138,7 @@ export async function activateSolutionInstallation(input, dependencies) {
             ? {}
             : { orgMembershipSources: current.orgMembershipSources }),
         deploymentSource: 'api',
+        allowRevokedEmbedReplacement: false,
         idempotencyKey: key,
     }, dependencies);
     if (!deployed.ok)
@@ -95,7 +150,7 @@ export async function activateSolutionInstallation(input, dependencies) {
                 : 'installation_activation_failed',
             message: 'The installation is saved, but its application could not be activated. Retry installation after resolving the deployment requirement.',
         };
-    return bind(deployed.result.deploymentId);
+    return bind(deployed.result.deploymentId, false);
 }
 async function executableSource(installation, registry) {
     const reference = installation.definition.reference;

package/node_modules/@noodle-borg/wire-contracts/dist/business-information.d.ts

@@ -427,6 +427,18 @@ export declare const SolutionInstallationIntakeRequestSchema: z.ZodObject<{
     expectedRevision: z.ZodNumber;
 }, z.core.$strict>;
 export type SolutionInstallationIntakeRequest = z.infer<typeof SolutionInstallationIntakeRequestSchema>;
+export declare const SolutionInstallationActivateRequestSchema: z.ZodObject<{}, z.core.$strict>;
+export declare const SolutionInstallationActivationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    state: z.ZodLiteral<"pending">;
+    canRetry: z.ZodBoolean;
+}, z.core.$strict>, z.ZodObject<{
+    state: z.ZodEnum<{
+        unavailable: "unavailable";
+        ready: "ready";
+    }>;
+    canRetry: z.ZodLiteral<false>;
+}, z.core.$strict>], "state">;
+export type SolutionInstallationActivation = z.infer<typeof SolutionInstallationActivationSchema>;
 export declare const ResolvedManagedSolutionDefinitionSchema: z.ZodObject<{
     kind: z.ZodLiteral<"managed">;
     definitionId: z.ZodEnum<{
@@ -574,6 +586,16 @@ export declare const SolutionInstallationSchema: z.ZodObject<{
     profileId: z.ZodOptional<z.ZodEnum<{
         b2b_saas: "b2b_saas";
     }>>;
+    activation: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        state: z.ZodLiteral<"pending">;
+        canRetry: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        state: z.ZodEnum<{
+            unavailable: "unavailable";
+            ready: "ready";
+        }>;
+        canRetry: z.ZodLiteral<false>;
+    }, z.core.$strict>], "state">>;
     id: z.ZodString;
     organizationId: z.ZodString;
     appSlug: z.ZodString;
@@ -690,6 +712,16 @@ export declare const SolutionInstallationResponseSchema: z.ZodObject<{
             profileId: z.ZodOptional<z.ZodEnum<{
                 b2b_saas: "b2b_saas";
             }>>;
+            activation: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                state: z.ZodLiteral<"pending">;
+                canRetry: z.ZodBoolean;
+            }, z.core.$strict>, z.ZodObject<{
+                state: z.ZodEnum<{
+                    unavailable: "unavailable";
+                    ready: "ready";
+                }>;
+                canRetry: z.ZodLiteral<false>;
+            }, z.core.$strict>], "state">>;
             id: z.ZodString;
             organizationId: z.ZodString;
             appSlug: z.ZodString;
@@ -808,6 +840,16 @@ export declare const SolutionInstallationListResponseSchema: z.ZodObject<{
             profileId: z.ZodOptional<z.ZodEnum<{
                 b2b_saas: "b2b_saas";
             }>>;
+            activation: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                state: z.ZodLiteral<"pending">;
+                canRetry: z.ZodBoolean;
+            }, z.core.$strict>, z.ZodObject<{
+                state: z.ZodEnum<{
+                    unavailable: "unavailable";
+                    ready: "ready";
+                }>;
+                canRetry: z.ZodLiteral<false>;
+            }, z.core.$strict>], "state">>;
             id: z.ZodString;
             organizationId: z.ZodString;
             appSlug: z.ZodString;
@@ -1136,6 +1178,16 @@ export declare const BusinessInvitationAcceptResponseSchema: z.ZodObject<{
             profileId: z.ZodOptional<z.ZodEnum<{
                 b2b_saas: "b2b_saas";
             }>>;
+            activation: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                state: z.ZodLiteral<"pending">;
+                canRetry: z.ZodBoolean;
+            }, z.core.$strict>, z.ZodObject<{
+                state: z.ZodEnum<{
+                    unavailable: "unavailable";
+                    ready: "ready";
+                }>;
+                canRetry: z.ZodLiteral<false>;
+            }, z.core.$strict>], "state">>;
             id: z.ZodString;
             organizationId: z.ZodString;
             appSlug: z.ZodString;

package/node_modules/@noodle-borg/wire-contracts/dist/business-information.js

@@ -153,7 +153,13 @@ export const SolutionInstallationIntakeRequestSchema = z.strictObject({
     active: z.boolean(),
     expectedRevision: positiveRevision,
 });
+export const SolutionInstallationActivateRequestSchema = z.strictObject({});
+export const SolutionInstallationActivationSchema = z.discriminatedUnion('state', [
+    z.strictObject({ state: z.literal('pending'), canRetry: z.boolean() }),
+    z.strictObject({ state: z.enum(['ready', 'unavailable']), canRetry: z.literal(false) }),
+]);
 const installationShape = {
+    activation: SolutionInstallationActivationSchema.optional(),
     id,
     organizationId: id,
     appSlug: slug,

package/node_modules/@noodle-borg/wire-contracts/dist/index.d.ts

@@ -384,4 +384,5 @@ export * from './application-activity.js';
 export * from './application-connections.js';
 export * from './application-onboarding.js';
 export * from './billing-catalog.js';
+export * from './operation-coordination.js';
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/wire-contracts/dist/index.js

@@ -226,4 +226,5 @@ export * from './application-activity.js';
 export * from './application-connections.js';
 export * from './application-onboarding.js';
 export * from './billing-catalog.js';
+export * from './operation-coordination.js';
 //# sourceMappingURL=index.js.map

package/node_modules/@noodle-borg/wire-contracts/dist/operation-coordination.d.ts

@@ -0,0 +1,59 @@
+import { z } from 'zod';
+export declare const OperationCoordinationListRequestSchema: z.ZodObject<{
+    limit: z.ZodOptional<z.ZodNumber>;
+    beforeResource: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const OperationCoordinationResolveRequestSchema: z.ZodObject<{
+    resource: z.ZodString;
+    token: z.ZodUUID;
+    reason: z.ZodString;
+}, z.core.$strict>;
+export declare const OperationCoordinationListResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    data: z.ZodObject<{
+        records: z.ZodArray<z.ZodObject<{
+            resource: z.ZodString;
+            token: z.ZodUUID;
+            reference: z.ZodString;
+            operationDigest: z.ZodString;
+            startedAt: z.ZodISODateTime;
+            deadline: z.ZodISODateTime;
+            state: z.ZodEnum<{
+                unknown: "unknown";
+                executing: "executing";
+            }>;
+        }, z.core.$strict>>;
+        nextBeforeResource: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const OperationCoordinationListClientResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    data: z.ZodObject<{
+        records: z.ZodArray<z.ZodObject<{
+            resource: z.ZodString;
+            token: z.ZodUUID;
+            reference: z.ZodString;
+            operationDigest: z.ZodString;
+            startedAt: z.ZodISODateTime;
+            deadline: z.ZodISODateTime;
+            state: z.ZodEnum<{
+                unknown: "unknown";
+                executing: "executing";
+            }>;
+        }, z.core.$strip>>;
+        nextBeforeResource: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const OperationCoordinationResolveResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    data: z.ZodObject<{
+        resolved: z.ZodLiteral<true>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const OperationCoordinationResolveClientResponseSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    data: z.ZodObject<{
+        resolved: z.ZodLiteral<true>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+//# sourceMappingURL=operation-coordination.d.ts.map

package/node_modules/@noodle-borg/wire-contracts/dist/operation-coordination.js

@@ -0,0 +1,51 @@
+import { z } from 'zod';
+const ResourceSchema = z.string().regex(/^[a-f0-9]{64}$/);
+export const OperationCoordinationListRequestSchema = z.strictObject({
+    limit: z.number().int().min(1).max(100).optional(),
+    beforeResource: ResourceSchema.optional(),
+});
+export const OperationCoordinationResolveRequestSchema = z.strictObject({
+    resource: ResourceSchema,
+    token: z.uuid(),
+    reason: z
+        .string()
+        .trim()
+        .min(1)
+        .max(256)
+        .regex(/^[^\p{Cc}\p{Zl}\p{Zp}]*$/u),
+});
+const RecordSchema = z.strictObject({
+    resource: ResourceSchema,
+    token: z.uuid(),
+    reference: z
+        .string()
+        .regex(/^[A-Za-z0-9._:@/-]{1,256}$/)
+        .refine((value) => !value.includes('://')),
+    operationDigest: ResourceSchema,
+    startedAt: z.iso.datetime(),
+    deadline: z.iso.datetime(),
+    state: z.enum(['executing', 'unknown']),
+});
+export const OperationCoordinationListResponseSchema = z.strictObject({
+    ok: z.literal(true),
+    data: z.strictObject({
+        records: z.array(RecordSchema).max(100),
+        nextBeforeResource: ResourceSchema.optional(),
+    }),
+});
+export const OperationCoordinationListClientResponseSchema = z.object({
+    ok: z.literal(true),
+    data: z.object({
+        records: z.array(z.object(RecordSchema.shape)).max(100),
+        nextBeforeResource: ResourceSchema.optional(),
+    }),
+});
+export const OperationCoordinationResolveResponseSchema = z.strictObject({
+    ok: z.literal(true),
+    data: z.strictObject({ resolved: z.literal(true) }),
+});
+export const OperationCoordinationResolveClientResponseSchema = z.object({
+    ok: z.literal(true),
+    data: z.object({ resolved: z.literal(true) }),
+});
+//# sourceMappingURL=operation-coordination.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.164.0",
+  "version": "0.165.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",