@noodleseed/one 0.167.0 → 0.169.0

package/node_modules/@noodle-borg/service/dist/store/json-file-deletion.js

@@ -0,0 +1,64 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir, open, readFile, rename } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+import { DEPLOYMENT_ID_PATTERN } from './validate.js';
+const lifecycleTails = new Map();
+/** All adapters for one local directory join the same process-local lifecycle ordering. */
+export function serializeFileLifecycle(directory, operation) {
+    const key = resolve(directory);
+    const result = (lifecycleTails.get(key) ?? Promise.resolve()).then(operation, operation);
+    const tail = result.then(() => undefined, () => undefined);
+    lifecycleTails.set(key, tail);
+    void tail.then(() => {
+        if (lifecycleTails.get(key) === tail)
+            lifecycleTails.delete(key);
+    });
+    return result;
+}
+/** Fail closed on an unreadable deletion journal; missing means no deletions have committed. */
+export async function readDeletedDeploymentIds(directory) {
+    let text;
+    try {
+        text = await readFile(join(directory, 'deleted-deployments.json'), 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return new Set();
+        throw error;
+    }
+    const ids = JSON.parse(text);
+    if (!Array.isArray(ids) ||
+        ids.some((id) => typeof id !== 'string' || !DEPLOYMENT_ID_PATTERN.test(id))) {
+        throw new Error('Invalid deployment deletion journal');
+    }
+    return new Set(ids);
+}
+/** Rename is the logical commit; retained ID tombstones also reject retries that would resurrect records. */
+export async function commitDeletedDeploymentIds(directory, ids) {
+    const deleted = new Set(await readDeletedDeploymentIds(directory));
+    for (const id of ids)
+        deleted.add(id);
+    await mkdir(directory, { recursive: true });
+    const path = join(directory, 'deleted-deployments.json');
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    const file = await open(temporary, 'wx', 0o600);
+    try {
+        await file.writeFile(JSON.stringify([...deleted].sort()));
+        await file.sync();
+    }
+    finally {
+        await file.close();
+    }
+    await rename(temporary, path);
+    // Persist both the commit rename and the metadata directory before removing any deployment files.
+    for (const parent of [directory, dirname(directory)]) {
+        const handle = await open(parent, 'r');
+        try {
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+    }
+}
+//# sourceMappingURL=json-file-deletion.js.map

package/node_modules/@noodle-borg/service/dist/store/json-file.d.ts

@@ -1,4 +1,4 @@
-import type { ActiveAccessUpdateInput, AppArchiveResult, AppRestorePrecondition, AppRestoreResult, AppSummary, ArtifactStore, DeploymentActivationPrecondition, DeploymentActivationResult, DeploymentListFilter, DeploymentLock, DeploymentLockUpdateResult, DeploymentPolicyPrecondition, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from '../store.js';
+import type { ActiveAccessUpdateInput, AppArchiveResult, AppRestorePrecondition, AppRestoreResult, AppSummary, ArtifactStore, DeploymentActivationPrecondition, DeploymentActivationResult, DeploymentDeleteResult, DeploymentDeleteSelection, DeploymentListFilter, DeploymentLock, DeploymentLockUpdateResult, DeploymentPolicyPrecondition, DeploymentSummary, DeployRecord, EnvSummary, ProductionEnvironmentChange, TenantAuthConfig, TenantRef } from '../store.js';
 /**
  * JSON-file store: one file per deployment at `<dataDir>/deployments/<deploymentId>.json`, written atomically
  * (write a temp file, then `rename` over the target — no partial file is ever read). `deploymentId` is a
@@ -8,6 +8,7 @@ import type { ActiveAccessUpdateInput, AppArchiveResult, AppRestorePrecondition,
 export declare class JsonFileArtifactStore implements ArtifactStore {
     #private;
     constructor(dataDir: string);
+    deleteDeployments(ref: TenantRef, selection: DeploymentDeleteSelection): Promise<DeploymentDeleteResult>;
     append(record: DeployRecord, precondition?: DeploymentPolicyPrecondition): Promise<void>;
     get(deploymentId: string): Promise<DeployRecord | undefined>;
     getActiveByTenant(ref: TenantRef): Promise<DeployRecord | undefined>;

package/node_modules/@noodle-borg/service/dist/store/json-file.js

@@ -5,9 +5,11 @@ import { normalizeServerVersion } from '@noodle-borg/module';
 import { assertSameAppPackageSnapshot, sanitizeDeployRecordAppPackageSnapshot, } from '../app-package-snapshot.js';
 import { assertCustomerAuthRestorePrecondition, assertUniqueActiveCustomerAuthAudienceBindings, findActiveCustomerAuthAudienceConflict, requiresCustomerAuthProjection, } from '../customer-auth-audience-binding.js';
 import { matchesDeploymentActivation } from '../deployment-activation-precondition.js';
+import { planDeploymentDeletion } from '../deployment-deletion.js';
 import { assertDeploymentActivationUnlocked, assertDeploymentAppendUnlocked, } from '../deployment-lock.js';
 import { assertDeploymentAppendPolicy, assertDeploymentAppendVersion, } from '../deployment-record-version.js';
 import { defaultActiveRecord, sameDeploymentScope, sameTenantRecord, } from '../deployment-versioning.js';
+import { commitDeletedDeploymentIds, readDeletedDeploymentIds, serializeFileLifecycle, } from './json-file-deletion.js';
 import { appArchivedAt, deploymentSummary, matchesDeploymentFilter, paginateAppSummaries, planAppArchive, planAppRestore, planArchivedAppSweep, preserveDeploymentOwnerState, resolveActiveAccessUpdate, resolveProductionEnvironment, summarizeApps, summarizeEnvs, validateDeploymentListFilter, withoutArchiveStamp, } from './records.js';
 import { DEPLOYMENT_ID_PATTERN, validateSlug, validateTenantRef } from './validate.js';
 /**
@@ -19,11 +21,23 @@ import { DEPLOYMENT_ID_PATTERN, validateSlug, validateTenantRef } from './valida
 export class JsonFileArtifactStore {
     #dir;
     #environmentMetadataDir;
-    #lifecycleTail = Promise.resolve();
+    #deletionMetadataDir;
     constructor(dataDir) {
         this.#dir = join(dataDir, 'deployments');
+        this.#deletionMetadataDir = join(dataDir, 'deployment-metadata');
         this.#environmentMetadataDir = join(dataDir, 'environment-metadata');
     }
+    deleteDeployments(ref, selection) {
+        return this.#serializeLifecycle(async () => {
+            const result = planDeploymentDeletion(await this.loadAll(), ref, selection);
+            if (!result.ok)
+                return result;
+            await commitDeletedDeploymentIds(this.#deletionMetadataDir, result.deleted.map((record) => record.deploymentId));
+            // Logical deletion has committed. Failed physical cleanup remains hidden by the journal on restart.
+            await Promise.all(result.deleted.map((record) => rm(join(this.#dir, `${record.deploymentId}.json`), { force: true }).catch(() => undefined)));
+            return result;
+        });
+    }
     append(record, precondition) {
         return this.#serializeLifecycle(() => this.#appendUnlocked(record, precondition));
     }
@@ -35,6 +49,9 @@ export class JsonFileArtifactStore {
         if (!DEPLOYMENT_ID_PATTERN.test(record.deploymentId)) {
             throw new Error(`invalid deploymentId for persistence: "${record.deploymentId}"`);
         }
+        if ((await readDeletedDeploymentIds(this.#deletionMetadataDir)).has(record.deploymentId)) {
+            throw new Error('Deployment ID has been deleted');
+        }
         const records = await this.loadAll();
         assertDeploymentAppendVersion(records, record);
         assertDeploymentAppendPolicy(records, record, precondition);
@@ -63,6 +80,8 @@ export class JsonFileArtifactStore {
         // An invalid id can never be a file we wrote; treat as absent (also closes off any traversal).
         if (!DEPLOYMENT_ID_PATTERN.test(deploymentId))
             return undefined;
+        if ((await readDeletedDeploymentIds(this.#deletionMetadataDir)).has(deploymentId))
+            return undefined;
         try {
             const text = await readFile(join(this.#dir, `${deploymentId}.json`), 'utf8');
             return sanitizeDeployRecordAppPackageSnapshot(JSON.parse(text));
@@ -172,9 +191,7 @@ export class JsonFileArtifactStore {
         });
     }
     #serializeLifecycle(operation) {
-        const result = this.#lifecycleTail.then(() => operation(), () => operation());
-        this.#lifecycleTail = result.then(() => undefined, () => undefined);
-        return result;
+        return serializeFileLifecycle(this.#dir, operation);
     }
     async loadAll() {
         let names;
@@ -199,7 +216,8 @@ export class JsonFileArtifactStore {
                 // other servers recover. (Visibility of skipped files lands with structured logging, Slice 27.)
             }
         }
-        return records;
+        const deleted = await readDeletedDeploymentIds(this.#deletionMetadataDir);
+        return records.filter((record) => !deleted.has(record.deploymentId));
     }
     async listDeployments(filter) {
         const safe = validateDeploymentListFilter(filter);

package/node_modules/@noodle-borg/service/dist/store.d.ts

@@ -1,5 +1,6 @@
 import type { ArtifactCustomerAuthRouting, HostedPackagedAsset } from '@noodle-borg/compiler';
-import type { OrganizationStore } from '@noodle-borg/control-plane/portable';
+import type { DeploymentDeleteSelection, OrganizationStore, DeploymentDeleteResult as PortableDeploymentDeleteResult } from '@noodle-borg/control-plane/portable';
+export type { DeploymentDeleteSelection } from '@noodle-borg/control-plane/portable';
 import type { OrgMembershipSource } from '@noodle-borg/module';
 import type { SealedSecret } from '@noodle-borg/runtime';
 import type { AccessMode } from '@noodle-borg/transport-http';
@@ -76,6 +77,7 @@ export interface DeployRecord {
     /** Immutable rendered package bytes bound to this exact deployment, when the manifest has a guide. */
     readonly appPackageSnapshot?: AppPackageSnapshotV1;
 }
+export type DeploymentDeleteResult = PortableDeploymentDeleteResult<DeployRecord>;
 export interface DeploymentLockMetadata {
     /** ISO-8601 time the version pointer was locked. */
     readonly lockedAt: string;
@@ -302,6 +304,8 @@ export interface ControlPlaneStore extends OrganizationStore {
  * an earlier deployment without changing the tenant-facing URL.
  */
 export interface ArtifactStore {
+    /** Atomically remove exact deployment history or an inventory-guarded whole version. */
+    deleteDeployments(ref: TenantRef, selection: DeploymentDeleteSelection): Promise<DeploymentDeleteResult>;
     append(record: DeployRecord, precondition?: DeploymentPolicyPrecondition): Promise<void>;
     loadAll(): Promise<readonly DeployRecord[]>;
     /**

package/node_modules/@noodle-borg/service/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.102.0",
+    "@noodle-borg/agent-kit": "0.104.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/node_modules/@noodle-borg/wire-contracts/dist/deployment-deletion.d.ts

@@ -0,0 +1,29 @@
+import { z } from 'zod';
+/** Bind destructive version deletion to the complete inventory the operator confirmed. */
+export declare const deploymentVersionDeleteRequestSchema: z.ZodObject<{
+    expectedDeploymentIds: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export type DeploymentVersionDeleteRequest = z.infer<typeof deploymentVersionDeleteRequestSchema>;
+export declare const deploymentDeleteResponseSchema: z.ZodObject<{
+    target: z.ZodObject<{
+        org: z.ZodString;
+        app: z.ZodString;
+        env: z.ZodString;
+    }, z.core.$strict>;
+    ok: z.ZodLiteral<true>;
+    deletedDeploymentIds: z.ZodArray<z.ZodString>;
+    auditRecorded: z.ZodBoolean;
+}, z.core.$strict>;
+/** Additive response reader for clients that can outlive a service revision. */
+export declare const deploymentDeleteClientResponseSchema: z.ZodObject<{
+    target: z.ZodObject<{
+        org: z.ZodString;
+        app: z.ZodString;
+        env: z.ZodString;
+    }, z.core.$strip>;
+    ok: z.ZodLiteral<true>;
+    deletedDeploymentIds: z.ZodArray<z.ZodString>;
+    auditRecorded: z.ZodBoolean;
+}, z.core.$strip>;
+export type DeploymentDeleteResponse = z.infer<typeof deploymentDeleteResponseSchema>;
+//# sourceMappingURL=deployment-deletion.d.ts.map

package/node_modules/@noodle-borg/wire-contracts/dist/deployment-deletion.js

@@ -0,0 +1,33 @@
+import { z } from 'zod';
+const deploymentId = z
+    .string()
+    .min(1)
+    .max(256)
+    .regex(/^[a-z0-9-]+$/);
+const ids = z
+    .array(deploymentId)
+    .min(1)
+    .max(10000)
+    .refine((values) => new Set(values).size === values.length, 'deployment IDs must be unique');
+const target = {
+    org: z.string().min(1),
+    app: z.string().min(1),
+    env: z.string().min(1),
+};
+/** Bind destructive version deletion to the complete inventory the operator confirmed. */
+export const deploymentVersionDeleteRequestSchema = z.strictObject({ expectedDeploymentIds: ids });
+const result = {
+    ok: z.literal(true),
+    deletedDeploymentIds: ids,
+    auditRecorded: z.boolean(),
+};
+export const deploymentDeleteResponseSchema = z.strictObject({
+    ...result,
+    target: z.strictObject(target),
+});
+/** Additive response reader for clients that can outlive a service revision. */
+export const deploymentDeleteClientResponseSchema = z.object({
+    ...result,
+    target: z.object(target),
+});
+//# sourceMappingURL=deployment-deletion.js.map

package/node_modules/@noodle-borg/wire-contracts/dist/index.d.ts

@@ -389,6 +389,7 @@ export * from './application-activity.js';
 export * from './application-connections.js';
 export * from './application-onboarding.js';
 export * from './billing-catalog.js';
+export * from './deployment-deletion.js';
 export * from './operation-coordination.js';
 export { MIXED_CUSTOMER_AUTH_FEATURE_VERSION, type ServiceInfoClientResponse, type ServiceInfoResponse, serviceInfoClientResponseSchema, serviceInfoResponseSchema, } from './service-info.js';
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/wire-contracts/dist/index.js

@@ -228,6 +228,7 @@ export * from './application-activity.js';
 export * from './application-connections.js';
 export * from './application-onboarding.js';
 export * from './billing-catalog.js';
+export * from './deployment-deletion.js';
 export * from './operation-coordination.js';
 export { MIXED_CUSTOMER_AUTH_FEATURE_VERSION, serviceInfoClientResponseSchema, serviceInfoResponseSchema, } from './service-info.js';
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.167.0",
+  "version": "0.169.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",
@@ -235,7 +235,7 @@
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.102.0",
+    "@noodle-borg/agent-kit": "0.104.0",
     "@noodle-borg/app-audit": "0.0.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",