@noodleseed/one 0.172.1 → 0.173.0

package/node_modules/@noodle-borg/service/dist/routes/business-information-channels.js

@@ -64,6 +64,9 @@ export async function projectBusinessChannels(installation, canEdit, base, deps)
         revision: installation.revision,
         active: installation.intakeActive,
         canEdit,
+        ...(deps.pageOrigin
+            ? { businessPageUrl: `${deps.pageOrigin}/b/${installation.publicId}` }
+            : {}),
         ...(whatsapp
             ? {
                 whatsapp: {

package/node_modules/@noodle-borg/service/dist/routes/business-information-dispatch.js

@@ -1,17 +1,21 @@
 import { OrganizationAgreementError } from '@noodle-borg/control-plane/portable';
 import { sendJson } from '@noodle-borg/transport-http';
+import { parseApplicationDraftPath } from '../application-drafts/paths.js';
 import { BusinessNoticeError } from '../business-information/business-notice.js';
+import { parseBusinessPagePath } from '../business-information/business-page-paths.js';
 import { InstallationCapacityError } from '../business-information/installation-capacity.js';
 import { NativeStorageLimitError } from '../business-information/native-storage-budget.js';
 import { SourceCredentialError } from '../business-information/source-credential-fence.js';
 import { SourceCapacityError } from '../business-information/source-custody-budget.js';
 import { respondRouteError } from '../http-util.js';
+import { handleApplicationDraftRoute } from './application-drafts.js';
 import { handleBusinessGrants, handleManagedRecords, handleSolutionCatalog, handleSolutionInstallations, } from './business-information.js';
 import { handleApplicationActivity, } from './business-information-activity.js';
 import { handleBusinessChannels, } from './business-information-channels.js';
 import { handleApplicationConnectionCallback, handleApplicationConnections, } from './business-information-connections.js';
 import { handleBusinessNotice, handleOrganizationAgreement, } from './business-information-notice.js';
 import { handleSolutionInstallationOptions } from './business-information-onboarding.js';
+import { handleBusinessPage, handlePublicBusinessPage } from './business-information-pages.js';
 import { parsePublicSolutionIntakePath, parseSolutionInstallationPath, parseSolutionInvitationAcceptPath, } from './business-information-paths.js';
 import { handlePublicSolutionIntake } from './business-information-public.js';
 import { handleBusinessInformationReaderFloor } from './business-information-reader-floor.js';
@@ -19,6 +23,24 @@ import { handleBusinessSettings } from './business-information-settings.js';
 import { handleCollectionSource } from './business-information-source.js';
 import { handleBusinessInvitationAccept, handleBusinessInvitations, handleEligibleBusinessAssignees, handleMySolutionInstallations, } from './business-information-staff.js';
 export function dispatchBusinessInformationRoutes(req, res, url, deps) {
+    const pageRef = parseBusinessPagePath(url.pathname);
+    const publicPage = /^\/v1\/business-pages\/(sol_[a-f0-9]{32})$/.exec(url.pathname);
+    if (pageRef || publicPage) {
+        if (!deps.pageOrigin || !deps.pageServiceUrl || !deps.registry || !deps.resolveEndpointBase)
+            return run(req, res, deps, () => Promise.resolve(sendJson(res, 404, { error: 'not found' })));
+        const pageDeps = {
+            ...deps,
+            registry: deps.registry,
+            resolveEndpointBase: deps.resolveEndpointBase,
+        };
+        return run(req, res, deps, () => pageRef
+            ? handleBusinessPage(req, res, pageRef, pageDeps)
+            : handlePublicBusinessPage(req, res, publicPage[1], pageDeps));
+    }
+    if (deps.authoring && parseApplicationDraftPath(url.pathname)) {
+        const draftDeps = { ...deps, ...deps.authoring, maxBody: deps.maxDraftBody ?? deps.maxBody };
+        return run(req, res, deps, () => handleApplicationDraftRoute(req, res, url, draftDeps));
+    }
     const agreement = /^\/v1\/orgs\/([a-z0-9][a-z0-9-]{0,62})\/agreement$/.exec(url.pathname);
     if (agreement?.[1])
         return run(req, res, deps, () => handleOrganizationAgreement(req, res, agreement[1], deps));

package/node_modules/@noodle-borg/service/dist/routes/business-information-pages.js

@@ -0,0 +1,158 @@
+import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
+import { BusinessPagePublishRequestSchema, BusinessPageResponseSchema, BusinessPageSaveRequestSchema, PublicBusinessPageResponseSchema, } from '@noodle-borg/wire-contracts';
+import { BusinessPageError, } from '../business-information/business-page.js';
+import { businessPageMethods, } from '../business-information/business-page-paths.js';
+import { requireIdentity, requireInstallationPermission } from './business-information.js';
+import { projectBusinessChannels, } from './business-information-channels.js';
+/** Publication custody remains valid independently of temporary assistant availability. */
+async function pageContext(scope, deps) {
+    const installation = await deps.store.getInstallation(scope);
+    const generation = await deps.registry.getAppGeneration(scope.org, scope.app);
+    if (!installation ||
+        !generation ||
+        installation.applicationGeneration !== generation ||
+        (await deps.registry.getAppArchivedAt(scope.org, scope.app)) !== undefined ||
+        !deps.pageOrigin ||
+        !deps.pageServiceUrl ||
+        (deps.businessOnboarding && !(await deps.businessOnboarding.ready(installation))))
+        throw new BusinessPageError('business_page_not_ready');
+    const origin = new URL(deps.pageOrigin);
+    if (origin.origin !== deps.pageOrigin ||
+        !(origin.protocol === 'https:' ||
+            (origin.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(origin.hostname))))
+        throw new BusinessPageError('business_page_not_ready');
+    return { installation, origin: origin.origin, serviceUrl: deps.pageServiceUrl };
+}
+/** Only a current, explicitly configured public assistant can be attached to a hosted page. */
+async function pageReadiness(scope, deps) {
+    const { installation, origin, serviceUrl } = await pageContext(scope, deps);
+    if (!installation.intakeActive || deps.publicIntakeEnabled === false)
+        throw new BusinessPageError('business_page_not_ready');
+    const channels = await projectBusinessChannels(installation, false, serviceUrl, deps);
+    const assistant = channels.assistant;
+    if (assistant.status !== 'ready' ||
+        !assistant.origins.includes(origin) ||
+        !channels.deploymentId ||
+        !assistant.embedId ||
+        !assistant.serviceUrl ||
+        !assistant.scriptUrl)
+        throw new BusinessPageError('business_page_not_ready');
+    return {
+        deploymentId: channels.deploymentId,
+        assistant: {
+            embedId: assistant.embedId,
+            serviceUrl: assistant.serviceUrl,
+            scriptUrl: assistant.scriptUrl,
+        },
+    };
+}
+export async function handleBusinessPage(req, res, ref, deps) {
+    res.setHeader('cache-control', 'private, no-store');
+    if (!businessPageMethods(ref).includes(req.method ?? '')) {
+        res.setHeader('allow', businessPageMethods(ref).join(', '));
+        return sendJson(res, 405, { error: 'method not allowed' });
+    }
+    const identity = await requireIdentity(req, res, deps);
+    if (identity === false)
+        return;
+    const authorized = await requireInstallationPermission(res, ref, identity, 'installation:administer', deps);
+    if (!authorized)
+        return;
+    try {
+        let record = await deps.store.pages.get(authorized.scope);
+        if (req.method !== 'GET') {
+            const body = await readJsonBody(req, Math.min(deps.maxBody, 256 * 1024));
+            if (!body.ok)
+                return sendJson(res, body.status, { error: body.error });
+            let change;
+            if (ref.operation) {
+                const parsed = BusinessPagePublishRequestSchema.safeParse(body.value);
+                if (!parsed.success)
+                    return invalidPage(res);
+                change = { operation: ref.operation, ...parsed.data };
+            }
+            else {
+                const parsed = BusinessPageSaveRequestSchema.safeParse(body.value);
+                if (!parsed.success)
+                    return invalidPage(res);
+                change = { operation: 'save', ...parsed.data };
+            }
+            record = await deps.store.pages.update({ scope: authorized.scope, actorSubject: identity.subject, change }, () => pageReadiness(authorized.scope, deps));
+        }
+        return sendJson(res, 200, BusinessPageResponseSchema.parse({
+            ok: true,
+            data: {
+                revision: record?.revision ?? 0,
+                draft: record?.draft ?? null,
+                published: record?.published ?? null,
+                canEdit: true,
+            },
+        }));
+    }
+    catch (error) {
+        return pageFailure(res, error);
+    }
+}
+export async function handlePublicBusinessPage(req, res, publicId, deps) {
+    res.setHeader('cache-control', 'no-store');
+    res.setHeader('x-robots-tag', 'noindex');
+    if (req.method !== 'GET') {
+        res.setHeader('allow', 'GET');
+        return sendJson(res, 405, { error: 'method not allowed' });
+    }
+    try {
+        const installation = await deps.store.resolveInstallationByPublicId(publicId);
+        if (!installation)
+            return unavailablePage(res);
+        const record = await deps.store.pages.get(installation.scope);
+        if (!record?.published)
+            return unavailablePage(res);
+        await pageContext(installation.scope, deps);
+        const notice = await deps.store.getBusinessNotice(installation.scope);
+        if (notice?.revision !== record.published.noticeRevision)
+            return unavailablePage(res);
+        const ready = await pageReadiness(installation.scope, deps).catch((error) => {
+            if (error instanceof BusinessPageError)
+                return undefined;
+            throw error;
+        });
+        return sendJson(res, 200, PublicBusinessPageResponseSchema.parse({
+            ok: true,
+            data: {
+                publicId,
+                content: record.published.content,
+                notice: record.published.notice,
+                assistant: ready?.deploymentId === record.published.deploymentId ? ready.assistant : null,
+            },
+        }));
+    }
+    catch (error) {
+        if (error instanceof BusinessPageError)
+            return unavailablePage(res);
+        return pageFailure(res, error);
+    }
+}
+function unavailablePage(res) {
+    sendJson(res, 404, { code: 'page_unavailable', error: 'This page is not available.' });
+}
+function invalidPage(res) {
+    sendJson(res, 400, {
+        code: 'business_page_invalid',
+        error: 'Check the page content and revision.',
+    });
+}
+function pageFailure(res, error) {
+    if (error instanceof BusinessPageError) {
+        sendJson(res, error.code === 'business_page_forbidden' ? 403 : 409, {
+            code: error.code,
+            error: error.message,
+        });
+        return;
+    }
+    // Neither decrypted content nor provider/parser exceptions may escape via generic route logging.
+    sendJson(res, 503, {
+        code: 'page_unavailable',
+        error: 'The page service is temporarily unavailable.',
+    });
+}
+//# sourceMappingURL=business-information-pages.js.map

package/node_modules/@noodle-borg/service/dist/routes/service-probes.js

@@ -0,0 +1,31 @@
+import { applySecurityHeaders, sendJson } from '@noodle-borg/transport-http';
+import { serviceInfoPayload } from '../build-info.js';
+export function createServiceProbeDispatcher(deps) {
+    return (req, res, url) => {
+        if (req.method !== 'GET' || !['/healthz', '/readyz', '/v1/service/info'].includes(url.pathname))
+            return false;
+        handleServiceProbe(req, res, url, deps);
+        return true;
+    };
+}
+function handleServiceProbe(req, res, url, { tls, moduleHost, buildInfo, options, whatsapp }) {
+    // Liveness/readiness probes: un-gated and **not** HTTPS-enforced — Cloud Run's internal probe is plain
+    // HTTP, so enforcing HTTPS here would `426` the probe and the revision would never go healthy (ADR 0034).
+    // `/healthz` is a pure liveness 200 (no store touch); `/readyz` reflects the injected readiness probe.
+    if (req.method === 'GET' && (url.pathname === '/healthz' || url.pathname === '/readyz')) {
+        applySecurityHeaders(res, tls);
+        if (url.pathname === '/healthz')
+            return sendJson(res, 200, { status: 'ok' });
+        void Promise.resolve(moduleHost.ready())
+            .then((ready) => sendJson(res, ready ? 200 : 503, { status: ready ? 'ready' : 'unready' }))
+            .catch(() => sendJson(res, 503, { status: 'unready' }));
+        return;
+    }
+    // Deployed-version visibility (ADR 0080): un-gated, non-HTTPS-enforced like the probes so the
+    // post-deploy smoke can confirm exactly which commit is live. Non-sensitive fields only.
+    if (req.method === 'GET' && url.pathname === '/v1/service/info') {
+        applySecurityHeaders(res, tls);
+        return sendJson(res, 200, serviceInfoPayload(buildInfo, options.developerMcp === true, whatsapp !== undefined));
+    }
+}
+//# sourceMappingURL=service-probes.js.map

package/node_modules/@noodle-borg/service/dist/service.js

@@ -12,7 +12,7 @@ import { createArchivePreflight } from './archive-preflight.js';
 import { ArchiveSweeper, resolveArchiveRetentionDays } from './archive-sweeper.js';
 import { serveLocalAsset } from './assets.js';
 import { assistantRouteDependencies } from './assistant-composition.js';
-import { resolveBuildInfo, serviceInfoPayload } from './build-info.js';
+import { resolveBuildInfo } from './build-info.js';
 import { createBusinessInformationRuntime, resolvePrivateInstallationDefinition, } from './business-information-runtime.js';
 import { serviceCapabilityReport } from './capabilities.js';
 import { createWhatsAppRuntime } from './channels/composition.js';
@@ -52,6 +52,7 @@ import { dispatchProtectedResourceMetadata } from './routes/protected-resource-m
 import { dispatchResourceReads } from './routes/resource-read-dispatch.js';
 import { handleRollback } from './routes/rollback.js';
 import { createServicePrincipalDispatcher } from './routes/service-principals-dispatch.js';
+import { createServiceProbeDispatcher } from './routes/service-probes.js';
 import { dispatchWhatsAppRoutes } from './routes/whatsapp.js';
 import { servicePrincipalDataPlaneHooks } from './service-principal-data-plane.js';
 import { InMemoryAlertRuleStore } from './store/alert-rules.js';
@@ -201,20 +202,17 @@ export function createServiceHandler(registry, options = {}) {
         installations: businessInformationStore,
         activity,
     });
+    const dispatchProbe = createServiceProbeDispatcher({
+        tls,
+        moduleHost,
+        buildInfo,
+        options,
+        whatsapp,
+    });
     return (req, res) => {
         const url = new URL(req.url ?? '/', 'http://localhost');
-        // Liveness/readiness probes: un-gated and **not** HTTPS-enforced — Cloud Run's internal probe is plain
-        // HTTP, so enforcing HTTPS here would `426` the probe and the revision would never go healthy (ADR 0034).
-        // `/healthz` is a pure liveness 200 (no store touch); `/readyz` reflects the injected readiness probe.
-        if (req.method === 'GET' && (url.pathname === '/healthz' || url.pathname === '/readyz')) {
-            applySecurityHeaders(res, tls);
-            if (url.pathname === '/healthz')
-                return sendJson(res, 200, { status: 'ok' });
-            void Promise.resolve(moduleHost.ready())
-                .then((ready) => sendJson(res, ready ? 200 : 503, { status: ready ? 'ready' : 'unready' }))
-                .catch(() => sendJson(res, 503, { status: 'unready' }));
+        if (dispatchProbe(req, res, url))
             return;
-        }
         if (options.developerMcp === true && url.pathname === DEVELOPER_MCP_PATH) {
             const mount = createDeveloperMcpMountOptions({
                 registry,
@@ -228,12 +226,6 @@ export function createServiceHandler(registry, options = {}) {
             void handleDeveloperMcpRequest(req, res, mount).catch((error) => respondRouteError(logger, res, 'developer.mcp.failed', error));
             return;
         }
-        // Deployed-version visibility (ADR 0080): un-gated, non-HTTPS-enforced like the probes so the
-        // post-deploy smoke can confirm exactly which commit is live. Non-sensitive fields only.
-        if (req.method === 'GET' && url.pathname === '/v1/service/info') {
-            applySecurityHeaders(res, tls);
-            return sendJson(res, 200, serviceInfoPayload(buildInfo, options.developerMcp === true, whatsapp !== undefined));
-        }
         if (url.pathname.startsWith('/v1/') && rejectIncompatibleCli(req, res, buildInfo, tls))
             return;
         if (req.method === 'GET' || req.method === 'HEAD') {
@@ -305,6 +297,10 @@ export function createServiceHandler(registry, options = {}) {
         if (businessInformationStore !== undefined &&
             options.businessInformationEnabled !== false &&
             dispatchBusinessInformationRoutes(req, res, url, {
+                authoring: options.businessAuthoring,
+                pageOrigin: options.businessPageOrigin,
+                pageServiceUrl: options.publicBaseUrl,
+                maxDraftBody: maxDeployBody,
                 ...(whatsapp ? { readWhatsApp: whatsapp.projection.bind(whatsapp) } : {}),
                 store: businessInformationStore,
                 ...(businessOnboarding ? { businessOnboarding } : {}),

package/node_modules/@noodle-borg/service/dist/solution-installation-activation.js

@@ -95,7 +95,7 @@ export async function activateSolutionInstallation(input, dependencies) {
         }
         return { ok: true, deploymentId };
     };
-    const source = await executableSource(installation, dependencies.registry);
+    const source = await executableSource(installation, dependencies.registry, dependencies.options.businessPageOrigin);
     if (!source.ok)
         return source;
     const current = await dependencies.registry.getActiveByTenant(tenant);
@@ -152,13 +152,13 @@ export async function activateSolutionInstallation(input, dependencies) {
         };
     return bind(deployed.result.deploymentId, false);
 }
-async function executableSource(installation, registry) {
+async function executableSource(installation, registry, hostedPageOrigin) {
     const reference = installation.definition.reference;
     if (reference.kind === 'managed') {
         return {
             ok: true,
             value: {
-                manifest: JSON.stringify(managedSolutionManifest(installation.definition)),
+                manifest: JSON.stringify(managedSolutionManifest(installation.definition, hostedPageOrigin)),
                 accessMode: 'public',
                 serverVersion: '1',
             },

package/node_modules/@noodle-borg/wire-contracts/dist/application-channels.d.ts

@@ -3,6 +3,7 @@ export declare const ApplicationChannelsProjectionSchema: z.ZodObject<{
     revision: z.ZodNumber;
     active: z.ZodBoolean;
     canEdit: z.ZodBoolean;
+    businessPageUrl: z.ZodOptional<z.ZodURL>;
     deploymentId: z.ZodOptional<z.ZodString>;
     mcp: z.ZodObject<{
         status: z.ZodEnum<{
@@ -56,6 +57,7 @@ export declare const ApplicationChannelsResponseSchema: z.ZodObject<{
         revision: z.ZodNumber;
         active: z.ZodBoolean;
         canEdit: z.ZodBoolean;
+        businessPageUrl: z.ZodOptional<z.ZodURL>;
         deploymentId: z.ZodOptional<z.ZodString>;
         mcp: z.ZodObject<{
             status: z.ZodEnum<{
@@ -109,6 +111,7 @@ export declare const ApplicationChannelsClientResponseSchema: z.ZodObject<{
         revision: z.ZodNumber;
         active: z.ZodBoolean;
         canEdit: z.ZodBoolean;
+        businessPageUrl: z.ZodOptional<z.ZodURL>;
         deploymentId: z.ZodOptional<z.ZodString>;
         mcp: z.ZodObject<{
             status: z.ZodEnum<{

package/node_modules/@noodle-borg/wire-contracts/dist/application-channels.js

@@ -51,6 +51,7 @@ export const ApplicationChannelsProjectionSchema = z
     revision: z.number().int().positive(),
     active: z.boolean(),
     canEdit: z.boolean(),
+    businessPageUrl: httpUrl.optional(),
     deploymentId: z.string().min(1).max(256).optional(),
     mcp,
     assistant,