@noodleseed/one 0.164.0 → 0.166.0

package/node_modules/@noodle-borg/connector-http/dist/http-connector.d.ts

@@ -49,6 +49,12 @@ export interface HttpOperationFake {
     readonly response?: unknown;
     readonly pages?: readonly unknown[];
 }
+/** Explicit application outcomes for selected provider rejections, never transport/auth failures. */
+export interface HttpStatusResponse {
+    readonly responseType?: 'json' | 'text' | 'empty';
+    readonly mapResponse: (body: unknown, args: Readonly<Record<string, unknown>>) => Record<string, unknown>;
+    readonly evidence?: (body: unknown) => OperationEvidence;
+}
 /**
  * A single HTTP operation. `GET`, `POST`, `PUT`, `PATCH`, and `DELETE` are supported. The `path` template is
  * filled from validated args
@@ -57,6 +63,7 @@ export interface HttpOperationFake {
  * declared output fields.
  */
 export interface HttpOperation {
+    readonly responses?: Readonly<Record<string, HttpStatusResponse>>;
     readonly evidence?: (json: unknown) => OperationEvidence;
     /** Compiler-derived requirement for mappings that consume the trusted operation identity. */
     readonly requiresExecution?: boolean;

package/node_modules/@noodle-borg/connector-http/dist/http-connector.js

@@ -1,7 +1,7 @@
 import { isCustomerEndpointRef, } from '@noodle-borg/compiler';
 import { ConnectorInvocationError, } from '@noodle-borg/runtime';
 import { customerRouteUnavailable, frozenCustomerEndpointRef, isWithinCustomerBase, resolveCustomerBase, sanitizedCustomerRouteError, } from './customer-route.js';
-import { fetchResponseWithResilience } from './http-response.js';
+import { fetchResponseWithResilience, } from './http-response.js';
 import { applyProjection } from './projection.js';
 import { requestPayload, setOwnedHeader } from './request-encoding.js';
 import { assertPublicResolution, needsGuard } from './ssrf.js';
@@ -32,6 +32,8 @@ export class HttpConnector {
         this.id = config.id;
         this.version = config.version;
         this.#config = config;
+        for (const operation of Object.values(config.operations))
+            validateStatusResponses(operation);
         const customerRouted = isCustomerEndpointRef(config.baseUrl);
         this.#customerBase = customerRouted ? frozenCustomerEndpointRef(config.baseUrl) : undefined;
         const origins = customerRouted
@@ -115,9 +117,23 @@ export class HttpConnector {
                 ...(call.signal === undefined ? {} : { signal: call.signal }),
                 ...(payload !== undefined ? { body: payload } : {}),
             };
-            const json = op.pagination === undefined
-                ? await this.#fetchJsonWithResilience(url, op, init)
-                : await this.#fetchPaginatedJson(op, call.args, base, init, customerBase, allowed);
+            const response = op.pagination === undefined
+                ? await this.#fetchResponseWithResilience(url, op, init)
+                : {
+                    status: 200,
+                    body: await this.#fetchPaginatedJson(op, call.args, base, init, customerBase, allowed),
+                };
+            const json = response.body;
+            const statusResponse = op.responses?.[String(response.status)];
+            if (statusResponse !== undefined) {
+                // Do not inherit a successful-response mapping or completion evidence for a provider rejection.
+                const output = this.#mapOutput({ ...op, mapResponse: statusResponse.mapResponse }, json, call.args);
+                const evidence = statusResponse.evidence?.(json) ?? { outcome: 'unknown' };
+                call.reportOutcome?.(evidence.outcome === 'rejected' || evidence.outcome === 'unknown'
+                    ? evidence
+                    : { outcome: 'unknown' });
+                return output;
+            }
             if (op.evidence)
                 call.reportOutcome?.(op.evidence(json));
             return this.#mapOutput(op, json, call.args);
@@ -218,7 +234,7 @@ export class HttpConnector {
         return this.#collectPaginatedJson(op, args, async (_pageIndex, query) => {
             const url = this.#buildUrl(op, args, base, query);
             await this.#validateUrl(url, customerBase, allowed);
-            return this.#fetchJsonWithResilience(url, op, init);
+            return (await this.#fetchResponseWithResilience(url, op, init)).body;
         });
     }
     #fakeJson(operation, op) {
@@ -301,7 +317,7 @@ export class HttpConnector {
         }
         return aggregate(pages, items, true, 'max_pages');
     }
-    #fetchJsonWithResilience(url, op, init) {
+    #fetchResponseWithResilience(url, op, init) {
         return fetchResponseWithResilience(url, op, init, {
             ...(this.#config.maxBytes === undefined ? {} : { maxBytes: this.#config.maxBytes }),
             ...(this.#config.timeoutMs === undefined ? {} : { timeoutMs: this.#config.timeoutMs }),
@@ -309,6 +325,18 @@ export class HttpConnector {
         });
     }
 }
+function validateStatusResponses(operation) {
+    if (operation.responses === undefined)
+        return;
+    if (operation.pagination !== undefined)
+        throw new Error('HTTP response status mappings cannot be combined with pagination');
+    for (const [status, response] of Object.entries(operation.responses)) {
+        if (!/^4\d\d$/u.test(status) || ['401', '403', '429'].includes(status))
+            throw new Error('HTTP response status must be an explicit 4xx other than 401, 403, or 429');
+        if (typeof response.mapResponse !== 'function')
+            throw new Error('HTTP response status requires an explicit response mapping');
+    }
+}
 function isManagedOrigin(url, resolved) {
     if (url.origin !== resolved || url.username !== '' || url.password !== '')
         return false;

package/node_modules/@noodle-borg/connector-http/dist/http-response.d.ts

@@ -17,12 +17,19 @@ export interface ResponseOperation {
         readonly retry?: HttpRetryPolicy;
     };
     readonly maxResponseBytes?: number;
+    readonly responses?: Readonly<Record<string, {
+        readonly responseType?: 'json' | 'text' | 'empty';
+    }>>;
+}
+export interface HttpResponse {
+    readonly status: number;
+    readonly body: unknown;
 }
 export interface ResponseFetchOptions {
     readonly maxBytes?: number;
     readonly timeoutMs?: number;
     readonly lookup?: DnsLookup;
 }
-export declare function fetchResponseWithResilience(url: URL, op: ResponseOperation, init: RequestInit, options: ResponseFetchOptions): Promise<unknown>;
+export declare function fetchResponseWithResilience(url: URL, op: ResponseOperation, init: RequestInit, options: ResponseFetchOptions): Promise<HttpResponse>;
 export {};
 //# sourceMappingURL=http-response.d.ts.map

package/node_modules/@noodle-borg/connector-http/dist/http-response.js

@@ -42,14 +42,23 @@ export async function fetchResponseWithResilience(url, op, init, options) {
                     retryable: false,
                 });
             }
-            if (op.responseType === 'text') {
-                return await readResponseText(response, max, attempt, retry !== undefined);
+            const declared = op.responses?.[String(response.status)];
+            const responseType = declared?.responseType ?? op.responseType;
+            const acceptedStatus = declared !== undefined;
+            if (responseType === 'text') {
+                return {
+                    status: response.status,
+                    body: await readResponseText(response, max, attempt, retry !== undefined, acceptedStatus),
+                };
             }
-            if (op.responseType === 'empty') {
-                await readResponseText(response, max, attempt, retry !== undefined);
-                return {};
+            if (responseType === 'empty') {
+                await readResponseText(response, max, attempt, retry !== undefined, acceptedStatus);
+                return { status: response.status, body: {} };
             }
-            return await readJsonResponse(response, max, attempt, retry !== undefined);
+            return {
+                status: response.status,
+                body: await readJsonResponse(response, max, attempt, retry !== undefined, acceptedStatus),
+            };
         }
         catch (error) {
             const normalized = normalizeAttemptError(error, attempt, retry, op.signature.type === 'read', signal.aborted);
@@ -112,8 +121,8 @@ async function readTextWithLimit(response, max) {
  * guards shared by JSON and text response modes. Non-2xx responses and oversized bodies raise a
  * `ConnectorInvocationError`; the raw decoded string is returned otherwise.
  */
-async function readResponseText(response, max, attempt, hasRetryPolicy) {
-    if (!response.ok) {
+async function readResponseText(response, max, attempt, hasRetryPolicy, acceptedStatus = false) {
+    if (!response.ok && !acceptedStatus) {
         const category = categoryForStatus(response.status);
         const retryAfterMs = response.status === 429 ? parseRetryAfterMs(response.headers.get('retry-after')) : undefined;
         throw new ConnectorInvocationError(`backend responded ${response.status}`, {
@@ -149,8 +158,8 @@ async function readResponseText(response, max, attempt, hasRetryPolicy) {
         throw error;
     }
 }
-async function readJsonResponse(response, max, attempt, hasRetryPolicy) {
-    const text = await readResponseText(response, max, attempt, hasRetryPolicy);
+async function readJsonResponse(response, max, attempt, hasRetryPolicy, acceptedStatus = false) {
+    const text = await readResponseText(response, max, attempt, hasRetryPolicy, acceptedStatus);
     try {
         return JSON.parse(text);
     }

package/node_modules/@noodle-borg/connector-http/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { type HttpAuthScheme, HttpConnector, type HttpConnectorConfig, type HttpOperation, type HttpOperationFake, type HttpOperationPagination, type HttpPaginationAggregate, type HttpPaginationStopReason, } from './http-connector.js';
+export { type HttpAuthScheme, HttpConnector, type HttpConnectorConfig, type HttpOperation, type HttpOperationFake, type HttpOperationPagination, type HttpPaginationAggregate, type HttpPaginationStopReason, type HttpStatusResponse, } from './http-connector.js';
 export * from './mcp/index.js';
 export type { HttpOperationProjection } from './projection.js';
 export type { GuardedFetchOptions } from './ssrf.js';

package/node_modules/@noodle-borg/module/dist/customer-auth-access.d.ts

@@ -0,0 +1,7 @@
+import type { AccessMode } from './contract.js';
+export declare function usesCustomerAuthentication(input: {
+    readonly schemaVersion: number;
+    readonly accessMode: AccessMode | undefined;
+    readonly hasServerAuth: boolean;
+}): boolean;
+//# sourceMappingURL=customer-auth-access.d.ts.map

package/node_modules/@noodle-borg/module/dist/customer-auth-access.js

@@ -0,0 +1,6 @@
+export function usesCustomerAuthentication(input) {
+    if (input.accessMode === 'customers')
+        return true;
+    return input.accessMode === 'mixed' && input.schemaVersion === 2 && input.hasServerAuth;
+}
+//# sourceMappingURL=customer-auth-access.js.map

package/node_modules/@noodle-borg/module/dist/index.d.ts

@@ -1,5 +1,6 @@
 export * from './asset-store.js';
 export * from './contract.js';
+export * from './customer-auth-access.js';
 export * from './deployment-activation.js';
 export * from './deployment-automation.js';
 export * from './endpoint-url.js';

package/node_modules/@noodle-borg/module/dist/index.js

@@ -1,5 +1,6 @@
 export * from './asset-store.js';
 export * from './contract.js';
+export * from './customer-auth-access.js';
 export * from './deployment-activation.js';
 export * from './deployment-automation.js';
 export * from './endpoint-url.js';

package/node_modules/@noodle-borg/runtime/dist/connector/types.d.ts

@@ -1,6 +1,7 @@
 import type { CredentialProfile, OperationSignature, ResolvedOperationRef } from '@noodle-borg/compiler';
 import type { DownstreamCredential } from '../broker/types.js';
 import type { CustomerConnectorRoute } from '../customer-routing.js';
+import type { OperationCoordinationDeclaration, OperationCoordinationSnapshot } from '../operation-coordination.js';
 import type { OperationEvidence } from '../operation-evidence.js';
 /** Verified caller claims that may be threaded into first-party connector operations. */
 export interface CallerIdentity {
@@ -74,7 +75,9 @@ export declare function connectorInvocationErrorMessage(value: unknown): string
  * drift checks, policy, broker credentials, connector invocation, redaction, and output validation.
  */
 export interface ConnectorCallHost {
-    callOperation(ref: ResolvedOperationRef, args: Readonly<Record<string, unknown>>, path: string): Promise<unknown>;
+    callOperation(ref: ResolvedOperationRef, args: Readonly<Record<string, unknown>>, path: string, 
+    /** Internal inherited execution deadline; never a sandbox-controlled value. */
+    parentSignal?: AbortSignal): Promise<unknown>;
 }
 /** A single connector-operation invocation, fully resolved and credentialed by the runtime. */
 export interface ConnectorCall {
@@ -85,6 +88,8 @@ export interface ConnectorCall {
     }>;
     /** Connector/application-classified evidence; never infer completion from a transport status alone. */
     readonly reportOutcome?: (evidence: OperationEvidence) => void;
+    readonly coordination?: OperationCoordinationSnapshot;
+    readonly resolveCoordination?: () => Promise<void>;
     /** Trusted request attribution for native public writes; never an argument or expression value. */
     readonly publicAdmission?: {
         readonly network: string;
@@ -130,6 +135,7 @@ export interface Connector {
     signature(operation: string): OperationSignature | undefined;
     /** Maximum action execution duration owned by this connector; excludes confirmation/model time. */
     executionBoundMs?(operation: string): number | undefined;
+    coordination?(operation: string): OperationCoordinationDeclaration | undefined;
     /** Invoke the operation. May reject; the runtime normalizes the failure (no secret leakage). */
     invoke(call: ConnectorCall): Promise<unknown>;
 }

package/node_modules/@noodle-borg/runtime/dist/connector-snapshot.js

@@ -22,6 +22,7 @@ export function withConnectorSnapshot(deps) {
             }
             const signatures = new Map();
             const executionBounds = new Map();
+            const coordinations = new Map();
             const snapshot = {
                 id: connector.id,
                 version: connector.version,
@@ -38,6 +39,13 @@ export function withConnectorSnapshot(deps) {
                         executionBounds.set(operation, connector.executionBoundMs?.(operation));
                     return executionBounds.get(operation);
                 },
+                coordination(operation) {
+                    if (!coordinations.has(operation)) {
+                        const live = connector.coordination?.(operation);
+                        coordinations.set(operation, live === undefined ? undefined : deepFreeze(structuredClone(live)));
+                    }
+                    return coordinations.get(operation);
+                },
                 invoke(call) {
                     return connector.invoke(call);
                 },

package/node_modules/@noodle-borg/runtime/dist/execute.d.ts

@@ -4,6 +4,7 @@ import type { CallerIdentity, ConnectorRegistry, ExecutionTraceSink } from './co
 import type { FrozenCustomerRoutes } from './customer-routing.js';
 import { type EvalScope } from './eval/evaluate.js';
 import type { InvocationContext } from './invocation-context.js';
+import type { OperationCoordinationPort } from './operation-coordination.js';
 import type { OperationEvidencePort } from './operation-evidence.js';
 import type { PolicyGate } from './policy/types.js';
 import type { ExecutionResult } from './result.js';
@@ -36,6 +37,7 @@ export interface ExecuteDeps {
     /** Trusted adapter invocation/confirmation identity; never read from tool input or expression scope. */
     readonly invocationId?: string;
     readonly operationEvidence?: OperationEvidencePort;
+    readonly operationCoordination?: OperationCoordinationPort;
     /** Hosting snapshot: operator configuration and original connected-account generations. */
     readonly executionBinding?: {
         readonly revision: string;

package/node_modules/@noodle-borg/runtime/dist/index.d.ts

@@ -15,6 +15,7 @@ export { type ExecuteDeps, type ExecuteToolDeps, executePrompt, executeResource,
 export { executeToolInteractive, resumeTool } from './interactive.js';
 export type { InvocationContext, InvocationContextPreferenceSource, InvocationLocationContext, InvocationTemporalContext, } from './invocation-context.js';
 export { type ManagedOriginResolutionResult, resolveManagedOrigins, } from './managed-origins.js';
+export type { OperationCoordinationDeclaration, OperationCoordinationIntent, OperationCoordinationLease, OperationCoordinationPort, OperationCoordinationSnapshot, } from './operation-coordination.js';
 export type { OperationEvidence, OperationEvidenceIntent, OperationEvidencePort, } from './operation-evidence.js';
 export { AllowAllPolicy } from './policy/allow-all.js';
 export type { PolicyContext, PolicyDecision, PolicyGate } from './policy/types.js';

package/node_modules/@noodle-borg/runtime/dist/nested-operation-host.js

@@ -0,0 +1,25 @@
+import { ConnectorInvocationError } from './connector/types.js';
+/** Bind only exact declared children, retaining the original host's execution/coordination identity. */
+export function nestedOperationHost(ref, host, parentSignal) {
+    const calls = ref.calls;
+    if (calls === undefined && parentSignal === undefined)
+        return host;
+    // Legacy artifacts retain their declaration contract while inheriting the parent's deadline.
+    return {
+        callOperation(target, args, path) {
+            const declared = calls?.find((child) => child.connectorId === target.connectorId &&
+                child.connectorVersion === target.connectorVersion &&
+                child.operation === target.operation &&
+                child.signatureHash === target.signatureHash);
+            if (calls !== undefined && declared === undefined)
+                throw new ConnectorInvocationError('Undeclared nested connector operation', {
+                    category: 'invalid_response',
+                    retryable: false,
+                });
+            // Invoke as a method on the original host: WeakMap custody frames and private symbol state
+            // must never migrate to this projection. Caller-supplied binding metadata has no authority.
+            return host.callOperation(declared ?? target, args, path, parentSignal);
+        },
+    };
+}
+//# sourceMappingURL=nested-operation-host.js.map

package/node_modules/@noodle-borg/runtime/dist/operation-coordination-execution.js

@@ -0,0 +1,50 @@
+import { evaluateValue } from './eval/evaluate.js';
+const frames = new WeakMap();
+/** Parent evidence is runtime-owned. Child receipts remain durable but are not duplicate business rows. */
+export function coordinatedParentId(host) {
+    return frames.get(host)?.at(-1)?.executionId;
+}
+/** Every nested action traverses this guard before credentials or provider I/O. */
+export function admitCoordinatedAction(host) {
+    const frame = frames.get(host)?.at(-1);
+    if (!frame)
+        return true;
+    if (!frame.lease.acquired || frame.writeStarted)
+        return false;
+    frame.writeStarted = true;
+    return true;
+}
+export async function beginOperationCoordination(input) {
+    if (!input.deps.operationCoordination ||
+        !input.executionBoundMs ||
+        frames.get(input.host)?.length)
+        throw new Error('Coordination authority unavailable');
+    const scope = { args: input.args, env: input.env, execution: { id: input.executionId } };
+    const key = evaluateValue(input.declaration.key, scope);
+    const reference = evaluateValue(input.declaration.reference, scope);
+    if (typeof key !== 'string' || typeof reference !== 'string')
+        throw new Error('Coordination identity invalid');
+    const lease = await input.deps.operationCoordination.acquire({
+        id: input.executionId,
+        connectionId: input.declaration.connectionId,
+        namespace: input.declaration.namespace,
+        key,
+        reference,
+        executionBoundMs: input.executionBoundMs,
+    });
+    const stack = frames.get(input.host) ?? [];
+    const frame = { lease, executionId: input.executionId, writeStarted: false };
+    stack.push(frame);
+    frames.set(input.host, stack);
+    return {
+        lease,
+        didAdmitAction: () => frame.writeStarted,
+        dispose() {
+            if (stack.at(-1) === frame)
+                stack.pop();
+            if (stack.length === 0)
+                frames.delete(input.host);
+        },
+    };
+}
+//# sourceMappingURL=operation-coordination-execution.js.map

package/node_modules/@noodle-borg/runtime/dist/operation-coordination.d.ts

@@ -0,0 +1,34 @@
+import type { ExprNode } from '@noodle-borg/compiler';
+import type { OperationEvidence } from './operation-evidence.js';
+/** Application-authored resource identity; values resolve before executing the guarded operation. */
+export interface OperationCoordinationDeclaration {
+    readonly connectionId: string;
+    readonly namespace: string;
+    readonly key: ExprNode;
+    readonly reference: ExprNode;
+}
+export interface OperationCoordinationIntent {
+    readonly id: string;
+    readonly connectionId: string;
+    readonly namespace: string;
+    readonly key: string;
+    readonly reference: string;
+    readonly executionBoundMs: number;
+}
+export interface OperationCoordinationSnapshot {
+    readonly acquired: boolean;
+    readonly previous?: {
+        readonly reference: string;
+        readonly operationDigest: string;
+    };
+}
+/** A token-bound lease: resolving a prior uncertain effect never admits a write in this invocation. */
+export interface OperationCoordinationLease extends OperationCoordinationSnapshot {
+    finish(evidence: OperationEvidence): Promise<void>;
+    resolvePrevious(): Promise<void>;
+}
+/** Production implementations share durable authority across service instances. */
+export interface OperationCoordinationPort {
+    acquire(intent: OperationCoordinationIntent): Promise<OperationCoordinationLease>;
+}
+//# sourceMappingURL=operation-coordination.d.ts.map

package/node_modules/@noodle-borg/runtime/dist/operation-evidence.d.ts

@@ -9,6 +9,10 @@ export interface OperationEvidence {
 }
 export interface OperationEvidenceIntent {
     readonly id: string;
+    /** Trusted coordinated-parent identity; never supplied by application arguments. */
+    readonly parentId?: string;
+    /** Coordination-selected connection for an outer compute action without a direct credential binding. */
+    readonly connectionId?: string;
     readonly tool: string;
     readonly operation: ResolvedOperationRef;
     readonly arguments: Readonly<Record<string, unknown>>;