@noodleseed/one 0.173.0 → 0.175.0

package/node_modules/@noodle-borg/control-plane/dist/in-memory-control-plane-store.js

@@ -1,20 +1,29 @@
 import { PersonalWorkspaceOwnerMutationError } from './contracts.js';
+import { InMemoryAtomicState } from './in-memory-atomic-state.js';
 import { InMemoryOrganizationStore } from './in-memory-organization-store.js';
 import { personalOrgSlugSuffix } from './organization-helpers.js';
 import { validateUserOwnedOrgSlug } from './validation.js';
 /** Portable organization state. Commercial account provisioning is an optional module side effect. */
 export class InMemoryControlPlaneStore extends InMemoryOrganizationStore {
-    #welcomeEmails = new Map();
-    #personalWorkspaces = new Map();
-    #queues = new Map();
+    #welcomeEmails;
+    #personalWorkspaces;
     #now;
+    #transactions;
+    #personalWorkspaceCreated;
     constructor(options = {}) {
+        if (options.personalWorkspaceCreated && !options.transactions)
+            throw new Error('fresh workspace composition requires a shared memory transaction context');
         const now = options.now ?? (() => new Date());
-        super({ now });
+        const transactions = options.transactions ?? new InMemoryAtomicState();
+        super({ now, transactions });
         this.#now = now;
+        this.#transactions = transactions;
+        this.#personalWorkspaceCreated = options.personalWorkspaceCreated;
+        this.#welcomeEmails = transactions.map();
+        this.#personalWorkspaces = transactions.map();
     }
     provisionPersonalWorkspace(input) {
-        return this.#serialized(`personal:${input.subject}`, async () => {
+        return this.#transactions.run(async () => {
             const requestedSlug = validateUserOwnedOrgSlug(input.slug);
             const bound = this.#personalWorkspaces.get(input.subject);
             if (bound !== undefined) {
@@ -46,6 +55,7 @@ export class InMemoryControlPlaneStore extends InMemoryOrganizationStore {
             }
             const org = await this.createOrg({ slug: requestedSlug, displayName: input.displayName });
             await this.#ensureOwner(requestedSlug, input);
+            await this.#personalWorkspaceCreated?.({ org: requestedSlug, ownerSubject: input.subject });
             const createdAt = this.#now().toISOString();
             this.#welcomeEmails.set(input.subject, {
                 subject: input.subject,
@@ -60,7 +70,7 @@ export class InMemoryControlPlaneStore extends InMemoryOrganizationStore {
         });
     }
     createOrgWithOwner(input) {
-        return this.#serialized(`org:${input.slug}`, async () => {
+        return this.#transactions.run(async () => {
             const slug = validateUserOwnedOrgSlug(input.slug);
             const existing = await this.getOrg(slug);
             if (existing !== undefined) {
@@ -149,23 +159,5 @@ export class InMemoryControlPlaneStore extends InMemoryOrganizationStore {
             throw new PersonalWorkspaceOwnerMutationError();
         }
     }
-    async #serialized(key, operation) {
-        const prior = this.#queues.get(key) ?? Promise.resolve();
-        let release;
-        const next = new Promise((resolve) => {
-            release = resolve;
-        });
-        const chain = prior.then(() => next);
-        this.#queues.set(key, chain);
-        await prior;
-        try {
-            return await operation();
-        }
-        finally {
-            release();
-            if (this.#queues.get(key) === chain)
-                this.#queues.delete(key);
-        }
-    }
 }
 //# sourceMappingURL=in-memory-control-plane-store.js.map

package/node_modules/@noodle-borg/control-plane/dist/in-memory-organization-store.d.ts

@@ -1,6 +1,8 @@
 import type { ActiveMcpSubdomainClaim, ChangeMcpSubdomainInput, McpSubdomainMutationResult, McpSubdomainSetting, OrganizationStore, OrgDomainRecord, OrgInvitationRecord, OrgMemberRecord, OrgOpenAIAppsChallengeRecord, OrgRecord, OrgRole, SignupAllowlistKind, SignupAllowlistRecord } from './contracts.js';
-import { type AcceptOrganizationAgreementInput } from './organization-agreements.js';
+import type { InMemoryAtomicState } from './in-memory-atomic-state.js';
+import { type AcceptOrganizationAgreementInput, type OrganizationAgreementOwnerAuthority } from './organization-agreements.js';
 interface InMemoryOrganizationStoreOptions {
+    readonly transactions?: InMemoryAtomicState;
     readonly now?: () => Date;
     readonly orgs?: Map<string, OrgRecord>;
     readonly members?: Map<string, OrgMemberRecord>;
@@ -10,7 +12,7 @@ export declare class InMemoryOrganizationStore {
     #private;
     constructor(options?: InMemoryOrganizationStoreOptions);
     getOrganizationAgreement(org: string, version: string): Promise<import("./organization-agreements.js").OrganizationAgreementAcceptance | undefined>;
-    acceptOrganizationAgreement(input: AcceptOrganizationAgreementInput): Promise<import("./organization-agreements.js").OrganizationAgreementAcceptance>;
+    acceptOrganizationAgreement(input: AcceptOrganizationAgreementInput, authority?: OrganizationAgreementOwnerAuthority): Promise<import("./organization-agreements.js").OrganizationAgreementAcceptance>;
     hasOrg(org: string): boolean;
     isExactOwner(org: string, subject: string): boolean;
     ensureDefaultMcpSubdomain(org: string): ActiveMcpSubdomainClaim | undefined;

package/node_modules/@noodle-borg/control-plane/dist/in-memory-organization-store.js

@@ -15,17 +15,19 @@ export class InMemoryOrganizationStore {
     #now;
     #agreements;
     constructor(options = {}) {
+        if (options.transactions && (options.orgs || options.members))
+            throw new Error('atomic organization state cannot use externally mutable maps');
         this.#now = options.now ?? (() => new Date());
-        this.#orgs = options.orgs ?? new Map();
-        this.#members = options.members ?? new Map();
-        this.#mcpSubdomainClaims = new InMemoryMcpSubdomainClaimStore(this.#now);
-        this.#agreements = new InMemoryOrganizationAgreements((org, subject) => this.isExactOwner(org, subject), this.#now);
+        this.#orgs = options.orgs ?? options.transactions?.map() ?? new Map();
+        this.#members = options.members ?? options.transactions?.map() ?? new Map();
+        this.#mcpSubdomainClaims = new InMemoryMcpSubdomainClaimStore(this.#now, options.transactions);
+        this.#agreements = new InMemoryOrganizationAgreements((org, subject) => this.isExactOwner(org, subject), this.#now, options.transactions);
     }
     getOrganizationAgreement(org, version) {
         return this.#agreements.getOrganizationAgreement(org, version);
     }
-    acceptOrganizationAgreement(input) {
-        return this.#agreements.acceptOrganizationAgreement(input);
+    acceptOrganizationAgreement(input, authority) {
+        return this.#agreements.acceptOrganizationAgreement(input, authority);
     }
     hasOrg(org) {
         return this.#orgs.has(org);

package/node_modules/@noodle-borg/control-plane/dist/mcp-subdomain-claims.d.ts

@@ -1,4 +1,5 @@
 import type { ActiveMcpSubdomainClaim, ChangeMcpSubdomainInput, McpSubdomainMutationResult, McpSubdomainSetting, OrganizationStore } from './contracts.js';
+import type { InMemoryAtomicState } from './in-memory-atomic-state.js';
 export declare class McpSubdomainOwnerRequiredError extends Error {
     constructor();
 }
@@ -15,7 +16,7 @@ export declare class McpSubdomainCooldownError extends Error {
 /** In-memory parity for active claim reads and organization-creation defaults. */
 export declare class InMemoryMcpSubdomainClaimStore {
     #private;
-    constructor(now?: () => Date);
+    constructor(now?: () => Date, transactions?: InMemoryAtomicState);
     ensureDefaultMcpSubdomain(org: string): ActiveMcpSubdomainClaim | undefined;
     getActiveMcpSubdomain(org: string): Promise<ActiveMcpSubdomainClaim | undefined>;
     resolveActiveMcpSubdomain(mcpSubdomain: string): Promise<ActiveMcpSubdomainClaim | undefined>;

package/node_modules/@noodle-borg/control-plane/dist/mcp-subdomain-claims.js

@@ -29,15 +29,20 @@ export class McpSubdomainCooldownError extends Error {
 }
 /** In-memory parity for active claim reads and organization-creation defaults. */
 export class InMemoryMcpSubdomainClaimStore {
-    #activeByOrg = new Map();
-    #activeBySubdomain = new Map();
-    #claimedSubdomains = new Set();
-    #lastChangedAtByOrg = new Map();
-    #mutations = new Map();
+    #activeByOrg;
+    #activeBySubdomain;
+    #claimedSubdomains;
+    #lastChangedAtByOrg;
+    #mutations;
     #now;
     #mutationTail = Promise.resolve();
-    constructor(now = () => new Date()) {
+    constructor(now = () => new Date(), transactions) {
         this.#now = now;
+        this.#activeByOrg = transactions?.map() ?? new Map();
+        this.#activeBySubdomain = transactions?.map() ?? new Map();
+        this.#claimedSubdomains = transactions?.map() ?? new Map();
+        this.#lastChangedAtByOrg = transactions?.map() ?? new Map();
+        this.#mutations = transactions?.map() ?? new Map();
     }
     ensureDefaultMcpSubdomain(org) {
         const orgSlug = validateSlug('org', org);
@@ -57,7 +62,7 @@ export class InMemoryMcpSubdomainClaimStore {
         };
         this.#activeByOrg.set(orgSlug, record);
         this.#activeBySubdomain.set(mcpSubdomain, record);
-        this.#claimedSubdomains.add(mcpSubdomain);
+        this.#claimedSubdomains.set(mcpSubdomain, true);
         return record;
     }
     getActiveMcpSubdomain(org) {
@@ -127,7 +132,7 @@ export class InMemoryMcpSubdomainClaimStore {
             this.#activeBySubdomain.delete(current.mcpSubdomain);
             this.#activeByOrg.set(org, next);
             this.#activeBySubdomain.set(mcpSubdomain, next);
-            this.#claimedSubdomains.add(mcpSubdomain);
+            this.#claimedSubdomains.set(mcpSubdomain, true);
             this.#lastChangedAtByOrg.set(org, changedAt);
             const result = {
                 orgSlug: org,

package/node_modules/@noodle-borg/control-plane/dist/organization-agreements.d.ts

@@ -1,3 +1,4 @@
+import { InMemoryAtomicState } from './in-memory-atomic-state.js';
 export interface AgreementDocument {
     readonly url: string;
     readonly sha256: string;
@@ -25,7 +26,13 @@ export interface AcceptOrganizationAgreementInput {
 export interface OrganizationAgreementStore {
     getOrganizationAgreement(org: string, version: string): Promise<OrganizationAgreementAcceptance | undefined>;
     /** Repeats live exact-owner authorization atomically; equal acceptance preserves the first receipt. */
-    acceptOrganizationAgreement(input: AcceptOrganizationAgreementInput): Promise<OrganizationAgreementAcceptance>;
+    acceptOrganizationAgreement(input: AcceptOrganizationAgreementInput, authority?: OrganizationAgreementOwnerAuthority): Promise<OrganizationAgreementAcceptance>;
+}
+/** Trusted host policy, never request data. The selected owner authority must fence the local commit.
+ * Legacy may be selected only when no versioned authority exists, never after denial or an outage.
+ */
+export interface OrganizationAgreementOwnerAuthority {
+    run<T>(org: string, actor: string, commit: () => Promise<T>, legacy: () => Promise<T>): Promise<T>;
 }
 export declare class OrganizationAgreementError extends Error {
     readonly code: 'agreement_owner_required' | 'agreement_version_conflict';
@@ -33,13 +40,15 @@ export declare class OrganizationAgreementError extends Error {
 }
 export declare function validateAgreementDocuments(input: AgreementDocuments): AgreementDocuments;
 export declare function agreementDocumentDigest(documents: AgreementDocuments): string;
-/** Synchronous commit boundary keeps membership recheck, catalog registration and receipt indivisible. */
+/** Authority completion and receipt publication share the development-only transaction context. */
 export declare class InMemoryOrganizationAgreements implements OrganizationAgreementStore {
     #private;
     private readonly isOwner;
     private readonly now;
-    constructor(isOwner: (org: string, subject: string) => boolean, now: () => Date);
+    private readonly transactions;
+    constructor(isOwner: (org: string, subject: string) => boolean, now: () => Date, transactions?: InMemoryAtomicState);
     getOrganizationAgreement(org: string, version: string): Promise<OrganizationAgreementAcceptance | undefined>;
-    acceptOrganizationAgreement(input: AcceptOrganizationAgreementInput): Promise<OrganizationAgreementAcceptance>;
+    acceptOrganizationAgreement(input: AcceptOrganizationAgreementInput, authority?: OrganizationAgreementOwnerAuthority): Promise<OrganizationAgreementAcceptance>;
+    private commit;
 }
 //# sourceMappingURL=organization-agreements.d.ts.map

package/node_modules/@noodle-borg/control-plane/dist/organization-agreements.js

@@ -1,4 +1,5 @@
 import { createHash } from 'node:crypto';
+import { InMemoryAtomicState } from './in-memory-atomic-state.js';
 import { validateSlug } from './validation.js';
 export class OrganizationAgreementError extends Error {
     code;
@@ -35,24 +36,39 @@ export function agreementDocumentDigest(documents) {
         .update(JSON.stringify(validateAgreementDocuments(documents)))
         .digest('hex');
 }
-/** Synchronous commit boundary keeps membership recheck, catalog registration and receipt indivisible. */
+/** Authority completion and receipt publication share the development-only transaction context. */
 export class InMemoryOrganizationAgreements {
     isOwner;
     now;
-    #catalog = new Map();
-    #receipts = new Map();
-    constructor(isOwner, now) {
+    transactions;
+    #catalog;
+    #receipts;
+    constructor(isOwner, now, transactions = new InMemoryAtomicState()) {
         this.isOwner = isOwner;
         this.now = now;
+        this.transactions = transactions;
+        this.#catalog = transactions.map();
+        this.#receipts = transactions.map();
     }
     getOrganizationAgreement(org, version) {
         const receipt = this.#receipts.get(JSON.stringify([validateSlug('org', org), version]));
         return Promise.resolve(receipt ? structuredClone(receipt) : undefined);
     }
-    async acceptOrganizationAgreement(input) {
+    async acceptOrganizationAgreement(input, authority) {
         const org = validateSlug('org', input.org);
-        if (!this.isOwner(org, input.actorSubject))
-            throw new OrganizationAgreementError('agreement_owner_required');
+        const commit = () => Promise.resolve(this.commit({ ...input, org }));
+        const legacy = () => {
+            if (!this.isOwner(org, input.actorSubject))
+                throw new OrganizationAgreementError('agreement_owner_required');
+            return commit();
+        };
+        // Legacy check + publication is one synchronous operation; an enclosing context still stages maps.
+        return authority
+            ? this.transactions.run(() => authority.run(org, input.actorSubject, commit, legacy))
+            : legacy();
+    }
+    commit(input) {
+        const org = input.org;
         const documents = validateAgreementDocuments(input.documents);
         const documentDigest = agreementDocumentDigest(documents);
         const registered = this.#catalog.get(documents.version);

package/node_modules/@noodle-borg/control-plane/dist/portable.d.ts

@@ -5,10 +5,11 @@ export { type DeploymentDeleteOperationResult, type DeploymentDeleteScope, type
 export { allowAllGate, bearerToken, type ControlPlaneAuthResult, type DeployAuthGate, } from './deploy-auth.js';
 export { CompositeControlPlaneGate, type ControlPlaneSignupMode, GoogleControlPlaneGate, type GoogleControlPlaneGateOptions, type GoogleIdTokenVerifier, GoogleWorkloadControlPlaneGate, type GoogleWorkloadControlPlaneGateOptions, NoodleOAuthControlPlaneGate, type NoodleOAuthControlPlaneGateOptions, type SignupAuthorizer, } from './deploy-gates.js';
 export type { DeploymentDeleteResult, DeploymentDeleteSelection, } from './deployment-deletion-contracts.js';
+export { InMemoryAtomicState } from './in-memory-atomic-state.js';
 export { InMemoryControlPlaneStore } from './in-memory-control-plane-store.js';
 export { bindInMemoryOrganizationStore, type InMemoryOrganizationOperations, InMemoryOrganizationStore, } from './in-memory-organization-store.js';
 export { InMemoryMcpSubdomainClaimStore, McpSubdomainCooldownError, McpSubdomainIdempotencyConflictError, McpSubdomainOwnerRequiredError, type McpSubdomainRouteRef, McpSubdomainUnavailableError, mcpSubdomainEndpointOptions, type ResolvedMcpTenantRef, resolveMcpSubdomainTenant, } from './mcp-subdomain-claims.js';
-export { type AcceptOrganizationAgreementInput, type AgreementDocument, type AgreementDocuments, agreementDocumentDigest, type OrganizationAgreementAcceptance, OrganizationAgreementError, type OrganizationAgreementStore, validateAgreementDocuments, } from './organization-agreements.js';
+export { type AcceptOrganizationAgreementInput, type AgreementDocument, type AgreementDocuments, agreementDocumentDigest, type OrganizationAgreementAcceptance, OrganizationAgreementError, type OrganizationAgreementOwnerAuthority, type OrganizationAgreementStore, validateAgreementDocuments, } from './organization-agreements.js';
 export { domainFromEmail, domainKey, memberKey, normalizeSignupAllowlistValue, personalOrgSlug, personalOrgSlugSuffix, signupKey, } from './organization-helpers.js';
 export { ensurePersonalWorkspace } from './personal-workspace.js';
 export { type RollbackControlPlane, type RollbackOperationDependencies, type RollbackOperationInput, type RollbackOperationResult, type RollbackRegistry, rollbackDeploymentOperation, } from './rollback-deployment.js';

package/node_modules/@noodle-borg/control-plane/dist/portable.js

@@ -3,6 +3,7 @@ export { PersonalWorkspaceOwnerMutationError } from './contracts.js';
 export { deleteDeploymentOperation, } from './delete-deployment.js';
 export { allowAllGate, bearerToken, } from './deploy-auth.js';
 export { CompositeControlPlaneGate, GoogleControlPlaneGate, GoogleWorkloadControlPlaneGate, NoodleOAuthControlPlaneGate, } from './deploy-gates.js';
+export { InMemoryAtomicState } from './in-memory-atomic-state.js';
 export { InMemoryControlPlaneStore } from './in-memory-control-plane-store.js';
 export { bindInMemoryOrganizationStore, InMemoryOrganizationStore, } from './in-memory-organization-store.js';
 export { InMemoryMcpSubdomainClaimStore, McpSubdomainCooldownError, McpSubdomainIdempotencyConflictError, McpSubdomainOwnerRequiredError, McpSubdomainUnavailableError, mcpSubdomainEndpointOptions, resolveMcpSubdomainTenant, } from './mcp-subdomain-claims.js';

package/node_modules/@noodle-borg/module/dist/platform-human-identity.d.ts

@@ -85,8 +85,11 @@ export interface PlatformHumanIdentityContribution {
         readonly oldTokenHash: string;
         readonly clientId: string;
     }) => Promise<'continue' | 'unknown' | 'suspended'>;
-    /** Check a business assignee under the caller's borrowed transaction and suspension lock. */
-    readonly assertActivePrincipal?: (transaction: ModuleSqlTransaction, subject: string) => Promise<void>;
+    /** Check under the caller's transaction and suspension lock. Versioned workspaces require
+     * explicit known-principal evidence; retained legacy consumers may ignore the optional receipt. */
+    readonly assertActivePrincipal?: (transaction: ModuleSqlTransaction, subject: string) => Promise<void> | Promise<{
+        readonly known: boolean;
+    }>;
     readonly continuityProbe?: () => void | Promise<void>;
 }
 //# sourceMappingURL=platform-human-identity.d.ts.map

package/node_modules/@noodle-borg/runtime/dist/connector/types.d.ts

@@ -80,6 +80,21 @@ export interface ConnectorCallHost {
     /** Internal inherited execution deadline; never a sandbox-controlled value. */
     parentSignal?: AbortSignal): Promise<unknown>;
 }
+/**
+ * Trusted admission facts for native public writes (ADR 0240). Every field is transport- or
+ * adapter-derived: `network` from verified ingress, `messaging` as a binding-scoped participant digest
+ * computed only after webhook authentication, and `provenance` naming the channel a saved record came
+ * from. A write needs `network` or `messaging`; nothing here is ever read from tool input or expressions.
+ */
+export interface PublicAdmissionContext {
+    readonly network?: string;
+    readonly visitor?: string;
+    readonly messaging?: string;
+    readonly provenance?: {
+        readonly kind: 'messaging';
+        readonly channel: 'whatsapp';
+    };
+}
 /** A single connector-operation invocation, fully resolved and credentialed by the runtime. */
 export interface ConnectorCall {
     readonly capabilityBudget?: CapabilityBudget;
@@ -93,10 +108,7 @@ export interface ConnectorCall {
     readonly coordination?: OperationCoordinationSnapshot;
     readonly resolveCoordination?: () => Promise<void>;
     /** Trusted request attribution for native public writes; never an argument or expression value. */
-    readonly publicAdmission?: {
-        readonly network: string;
-        readonly visitor?: string;
-    };
+    readonly publicAdmission?: PublicAdmissionContext;
     /** Evaluated, validated arguments. */
     readonly args: Readonly<Record<string, unknown>>;
     /** Managed variables resolved for the deployment scope. */

package/node_modules/@noodle-borg/runtime/dist/execute.d.ts

@@ -1,7 +1,7 @@
 import type { ArtifactFulfilment, RuntimeArtifact } from '@noodle-borg/compiler';
 import { CapabilityBudget } from '@noodle-borg/managed-capabilities';
 import type { CredentialBroker } from './broker/types.js';
-import type { CallerIdentity, ConnectorRegistry, ExecutionTraceSink } from './connector/types.js';
+import type { CallerIdentity, ConnectorRegistry, ExecutionTraceSink, PublicAdmissionContext } from './connector/types.js';
 import type { FrozenCustomerRoutes } from './customer-routing.js';
 import { type EvalScope } from './eval/evaluate.js';
 import type { InvocationContext } from './invocation-context.js';
@@ -26,11 +26,8 @@ export interface ExecuteDeps {
     readonly policy?: PolicyGate;
     readonly env?: Record<string, unknown> | (() => Promise<Record<string, unknown>>);
     readonly caller?: CallerIdentity;
-    /** Transport-owned admission attribution; absent network means public native writes must refuse. */
-    readonly publicAdmission?: {
-        readonly network: string;
-        readonly visitor?: string;
-    };
+    /** Transport-owned admission attribution; without a network or messaging bucket public native writes refuse. */
+    readonly publicAdmission?: PublicAdmissionContext;
     /** Verified customer IdP issuer, kept outside caller/expression scope for credential isolation. */
     readonly customerIssuer?: string;
     /** Request-local validated customer connector routes, kept separate from caller/expression scope. */

package/node_modules/@noodle-borg/runtime/dist/index.d.ts

@@ -7,7 +7,7 @@ export { resolveVariableEnvironment, type VariableEnvironmentResult, validateVar
 export { executePreparedTool, prepareToolForConfirmation, resumeToolPreparation, } from './confirmation.js';
 export { sanitizeConnectorFailureDetails } from './connector/failure-details.js';
 export { InMemoryConnector, InMemoryConnectorRegistry, type InMemoryOperation, type OperationHandler, } from './connector/in-memory.js';
-export type { CallerIdentity, Connector, ConnectorCall, ConnectorCallHost, ConnectorFailureCategory, ConnectorRegistry, ConnectorTraceEvent, ExecutionTraceSink, } from './connector/types.js';
+export type { CallerIdentity, Connector, ConnectorCall, ConnectorCallHost, ConnectorFailureCategory, ConnectorRegistry, ConnectorTraceEvent, ExecutionTraceSink, PublicAdmissionContext, } from './connector/types.js';
 export { ConnectorInvocationError, connectorInvocationErrorMessage, isConnectorInvocationError, } from './connector/types.js';
 export { type CustomerConnectorRoute, type CustomerRouteBinding, type CustomerRouteRequirement, type FrozenCustomerRoute, type FrozenCustomerRoutes, freezeCustomerRoutes, resolveCustomerConnectorRoute, resolveCustomerRouteBinding, } from './customer-routing.js';
 export { type EvalScope, ExpressionEvalError, type ExpressionEvalErrorCode, evaluateCondition, evaluateValue, } from './eval/evaluate.js';