@noodleseed/one 0.58.0 → 0.60.0

package/node_modules/@noodle-borg/service/dist/routes/protected-resource-metadata.js

@@ -0,0 +1,51 @@
+import { protectedResourceMetadata } from '@noodle-borg/auth';
+import { parseLegacyTenantMcpPath } from '@noodle-borg/module';
+import { applySecurityHeaders, enforceHttps } from '@noodle-borg/transport-http';
+import { DEVELOPER_MCP_PATH, developerMcpScopes } from '../developer-mcp/mount.js';
+import { baseFromRequest, sendJson } from '../http-util.js';
+import { trustedMcpResourceFromRequest } from '../mcp-public-routing.js';
+import { authServerIssuersForTenant } from '../registry-targets.js';
+/** Well-known prefix for OAuth 2.0 Protected Resource Metadata (RFC 9728). */
+export const PROTECTED_RESOURCE_METADATA_PREFIX = '/.well-known/oauth-protected-resource';
+export function dispatchProtectedResourceMetadata(req, res, url, registry, options, tls) {
+    if (req.method !== 'GET' || !url.pathname.startsWith(PROTECTED_RESOURCE_METADATA_PREFIX)) {
+        return false;
+    }
+    applySecurityHeaders(res, tls);
+    if (enforceHttps(req, res, tls))
+        return true;
+    void Promise.resolve()
+        .then(async () => {
+        const trustedResource = trustedMcpResourceFromRequest(req, options);
+        if (trustedResource.status !== 'none' && !trustedResource.ok) {
+            return sendJson(res, trustedResource.status, {
+                error: trustedResource.status === 403 ? 'forbidden' : 'not found',
+            });
+        }
+        const base = options.publicBaseUrl ?? baseFromRequest(req, tls);
+        const resourcePath = url.pathname.slice(PROTECTED_RESOURCE_METADATA_PREFIX.length);
+        const tenant = trustedResource.status === 'ok'
+            ? trustedResource.tenant
+            : parseLegacyTenantMcpPath(resourcePath);
+        const authServerIssuers = (tenant !== undefined ? await authServerIssuersForTenant(registry, tenant) : undefined) ??
+            (options.authServerIssuer ? [options.authServerIssuer] : undefined);
+        const doc = {
+            ...protectedResourceMetadata({
+                resource: trustedResource.status === 'ok'
+                    ? trustedResource.resourceUrl
+                    : `${base}${resourcePath}`,
+                ...(authServerIssuers ? { authorizationServers: authServerIssuers } : {}),
+            }),
+            ...(options.developerMcp === true && resourcePath === DEVELOPER_MCP_PATH
+                ? { scopes_supported: developerMcpScopes() }
+                : {}),
+        };
+        return sendJson(res, 200, doc);
+    })
+        .catch(() => {
+        if (!res.headersSent)
+            sendJson(res, 500, { error: 'internal error' });
+    });
+    return true;
+}
+//# sourceMappingURL=protected-resource-metadata.js.map

package/node_modules/@noodle-borg/service/dist/routes/protected-resource-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protected-resource-metadata.js","sourceRoot":"","sources":["../../src/routes/protected-resource-metadata.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAmB,MAAM,6BAA6B,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAGzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kCAAkC,GAAG,uCAAuC,CAAC;AAE1F,MAAM,UAAU,iCAAiC,CAC/C,GAAoB,EACpB,GAAmB,EACnB,GAAQ,EACR,QAAwB,EACxB,OAAuB,EACvB,GAAe;IAEf,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,kCAAkC,CAAC,EAAE,CAAC;QACzF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,KAAK,OAAO,CAAC,OAAO,EAAE;SACnB,IAAI,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,eAAe,GAAG,6BAA6B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpE,IAAI,eAAe,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;YAC7D,OAAO,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC,MAAM,EAAE;gBAC3C,KAAK,EAAE,eAAe,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW;aAClE,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,kCAAkC,CAAC,MAAM,CAAC,CAAC;QACnF,MAAM,MAAM,GACV,eAAe,CAAC,MAAM,KAAK,IAAI;YAC7B,CAAC,CAAC,eAAe,CAAC,MAAM;YACxB,CAAC,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,iBAAiB,GACrB,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,0BAA0B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvF,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG;YACV,GAAG,yBAAyB,CAAC;gBAC3B,QAAQ,EACN,eAAe,CAAC,MAAM,KAAK,IAAI;oBAC7B,CAAC,CAAC,eAAe,CAAC,WAAW;oBAC7B,CAAC,CAAC,GAAG,IAAI,GAAG,YAAY,EAAE;gBAC9B,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1E,CAAC;YACF,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,kBAAkB;gBACtE,CAAC,CAAC,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,EAAE;QACV,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IACL,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@noodle-borg/service/dist/routes/resource-read-dispatch.d.ts

@@ -12,6 +12,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { TlsPosture } from '@noodle-borg/transport-http';
 import type { DeployAuthGate } from '../auth/deploy-gate.js';
+import type { DeveloperGrantStore } from '../oauth/developer-grant.js';
 import type { ServerRegistry } from '../registry.js';
 import type { ControlPlaneStore } from '../store.js';
 import type { EndpointUrlOptions, ResolveEndpointBase } from './endpoint-enrichment.js';
@@ -25,6 +26,7 @@ export interface ResourceReadDeps {
     readonly tls: TlsPosture;
     readonly resolveEndpointBase: ResolveEndpointBase;
     readonly endpointOptions?: EndpointUrlOptions;
+    readonly developerGrantStore: DeveloperGrantStore | undefined;
 }
 /**
  * Try the resource read routes; returns true when the request was handled (or a guard ended it).

package/node_modules/@noodle-borg/service/dist/routes/resource-read-dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-read-dispatch.d.ts","sourceRoot":"","sources":["../../src/routes/resource-read-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAUxF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;IACzC,QAAQ,CAAC,oBAAoB,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,KAAK,IAAI,CAAC;IAC9E,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC;IAC/F,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAChF,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC;CAC/C;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,gBAAgB,GACrB,OAAO,CA2GT"}
+{"version":3,"file":"resource-read-dispatch.d.ts","sourceRoot":"","sources":["../../src/routes/resource-read-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAUxF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;IACzC,QAAQ,CAAC,oBAAoB,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,KAAK,IAAI,CAAC;IAC9E,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC;IAC/F,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAChF,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC;IAC9C,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,GAAG,SAAS,CAAC;CAC/D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAiHT"}

package/node_modules/@noodle-borg/service/dist/routes/resource-read-dispatch.js

@@ -7,14 +7,14 @@ import { parseAppItemPath, parseAppsPath, parseDeploymentItemPath, parseEnvItemP
  * `orgRef` GET (org inspect) stays in `service.ts` beside its PATCH sibling, which shares the parse.
  */
 export function dispatchResourceReads(req, res, url, deps) {
-    const { registry, gate, controlPlane, applySecurityHeaders, enforceHttps, sendJson, tls, resolveEndpointBase, endpointOptions = {}, } = deps;
+    const { registry, gate, controlPlane, applySecurityHeaders, enforceHttps, sendJson, tls, resolveEndpointBase, endpointOptions = {}, developerGrantStore, } = deps;
     const endpointBase = resolveEndpointBase(req);
     const appsRef = parseAppsPath(url.pathname);
     if (appsRef !== undefined && req.method === 'GET') {
         applySecurityHeaders(res, tls);
         if (enforceHttps(req, res, tls))
             return true;
-        handleApps(req, res, registry, gate, controlPlane, appsRef, url, endpointBase, endpointOptions).catch(() => {
+        handleApps(req, res, registry, gate, controlPlane, appsRef, url, endpointBase, endpointOptions, developerGrantStore).catch(() => {
             if (!res.headersSent)
                 sendJson(res, 500, { error: 'internal error' });
         });
@@ -25,7 +25,7 @@ export function dispatchResourceReads(req, res, url, deps) {
         applySecurityHeaders(res, tls);
         if (enforceHttps(req, res, tls))
             return true;
-        handleApp(req, res, registry, gate, controlPlane, appItemRef, endpointBase, endpointOptions).catch(() => {
+        handleApp(req, res, registry, gate, controlPlane, appItemRef, endpointBase, endpointOptions, developerGrantStore).catch(() => {
             if (!res.headersSent)
                 sendJson(res, 500, { error: 'internal error' });
         });
@@ -36,7 +36,7 @@ export function dispatchResourceReads(req, res, url, deps) {
         applySecurityHeaders(res, tls);
         if (enforceHttps(req, res, tls))
             return true;
-        handleEnvs(req, res, registry, gate, controlPlane, envsRef, url, endpointBase, endpointOptions).catch(() => {
+        handleEnvs(req, res, registry, gate, controlPlane, envsRef, url, endpointBase, endpointOptions, developerGrantStore).catch(() => {
             if (!res.headersSent)
                 sendJson(res, 500, { error: 'internal error' });
         });
@@ -47,7 +47,7 @@ export function dispatchResourceReads(req, res, url, deps) {
         applySecurityHeaders(res, tls);
         if (enforceHttps(req, res, tls))
             return true;
-        handleEnv(req, res, registry, gate, controlPlane, envItemRef, endpointBase, endpointOptions).catch(() => {
+        handleEnv(req, res, registry, gate, controlPlane, envItemRef, endpointBase, endpointOptions, developerGrantStore).catch(() => {
             if (!res.headersSent)
                 sendJson(res, 500, { error: 'internal error' });
         });
@@ -58,7 +58,7 @@ export function dispatchResourceReads(req, res, url, deps) {
         applySecurityHeaders(res, tls);
         if (enforceHttps(req, res, tls))
             return true;
-        handleDeploymentItem(req, res, registry, gate, controlPlane, deploymentItemRef, endpointBase, endpointOptions).catch(() => {
+        handleDeploymentItem(req, res, registry, gate, controlPlane, deploymentItemRef, endpointBase, endpointOptions, developerGrantStore).catch(() => {
             if (!res.headersSent)
                 sendJson(res, 500, { error: 'internal error' });
         });

package/node_modules/@noodle-borg/service/dist/routes/resource-read-dispatch.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-read-dispatch.js","sourceRoot":"","sources":["../../src/routes/resource-read-dispatch.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,GACd,MAAM,YAAY,CAAC;AAcpB;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAoB,EACpB,GAAmB,EACnB,GAAQ,EACR,IAAsB;IAEtB,MAAM,EACJ,QAAQ,EACR,IAAI,EACJ,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,QAAQ,EACR,GAAG,EACH,mBAAmB,EACnB,eAAe,GAAG,EAAE,GACrB,GAAG,IAAI,CAAC;IACT,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAE9C,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAClD,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,UAAU,CACR,GAAG,EACH,GAAG,EACH,QAAQ,EACR,IAAI,EACJ,YAAY,EACZ,OAAO,EACP,GAAG,EACH,YAAY,EACZ,eAAe,CAChB,CAAC,KAAK,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACrD,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,SAAS,CACP,GAAG,EACH,GAAG,EACH,QAAQ,EACR,IAAI,EACJ,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,eAAe,CAChB,CAAC,KAAK,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAClD,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,UAAU,CACR,GAAG,EACH,GAAG,EACH,QAAQ,EACR,IAAI,EACJ,YAAY,EACZ,OAAO,EACP,GAAG,EACH,YAAY,EACZ,eAAe,CAChB,CAAC,KAAK,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACrD,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,SAAS,CACP,GAAG,EACH,GAAG,EACH,QAAQ,EACR,IAAI,EACJ,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,eAAe,CAChB,CAAC,KAAK,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,iBAAiB,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC5D,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,oBAAoB,CAClB,GAAG,EACH,GAAG,EACH,QAAQ,EACR,IAAI,EACJ,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,eAAe,CAChB,CAAC,KAAK,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"resource-read-dispatch.js","sourceRoot":"","sources":["../../src/routes/resource-read-dispatch.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,GACd,MAAM,YAAY,CAAC;AAepB;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAoB,EACpB,GAAmB,EACnB,GAAQ,EACR,IAAsB;IAEtB,MAAM,EACJ,QAAQ,EACR,IAAI,EACJ,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,QAAQ,EACR,GAAG,EACH,mBAAmB,EACnB,eAAe,GAAG,EAAE,EACpB,mBAAmB,GACpB,GAAG,IAAI,CAAC;IACT,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAE9C,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAClD,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,UAAU,CACR,GAAG,EACH,GAAG,EACH,QAAQ,EACR,IAAI,EACJ,YAAY,EACZ,OAAO,EACP,GAAG,EACH,YAAY,EACZ,eAAe,EACf,mBAAmB,CACpB,CAAC,KAAK,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACrD,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,SAAS,CACP,GAAG,EACH,GAAG,EACH,QAAQ,EACR,IAAI,EACJ,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,eAAe,EACf,mBAAmB,CACpB,CAAC,KAAK,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAClD,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,UAAU,CACR,GAAG,EACH,GAAG,EACH,QAAQ,EACR,IAAI,EACJ,YAAY,EACZ,OAAO,EACP,GAAG,EACH,YAAY,EACZ,eAAe,EACf,mBAAmB,CACpB,CAAC,KAAK,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACrD,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,SAAS,CACP,GAAG,EACH,GAAG,EACH,QAAQ,EACR,IAAI,EACJ,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,eAAe,EACf,mBAAmB,CACpB,CAAC,KAAK,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,iBAAiB,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC5D,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,oBAAoB,CAClB,GAAG,EACH,GAAG,EACH,QAAQ,EACR,IAAI,EACJ,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,mBAAmB,CACpB,CAAC,KAAK,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/node_modules/@noodle-borg/service/dist/routes/rollback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rollback.d.ts","sourceRoot":"","sources":["../../src/routes/rollback.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAKhE,wBAAsB,cAAc,CAClC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,IAAI,CAAC,CAoGf"}
+{"version":3,"file":"rollback.d.ts","sourceRoot":"","sources":["../../src/routes/rollback.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGhE,wBAAsB,cAAc,CAClC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,IAAI,CAAC,CAgDf"}

package/node_modules/@noodle-borg/service/dist/routes/rollback.js

@@ -1,32 +1,10 @@
 import { baseFromRequest, readJsonBody, sendForbidden, sendJson } from '../http-util.js';
-import { tenantMcpUrl } from '../registry-helpers.js';
-import { respondProductionAppAdmissionError } from './billing-production-app-response.js';
-import { authorizeControlPlane } from './control-plane.js';
-import { canManageMembers } from './org-admin.js';
+import { rollbackDeploymentOperation } from '../operations/rollback-deployment.js';
+import { authorizeTenantControl, developerGrantRouteAccess } from './control-plane.js';
 export async function handleRollback(req, res, registry, gate, controlPlane, audit, maxBody, tenant, options) {
-    const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
+    const identity = await authorizeTenantControl(req, res, gate, controlPlane, tenant.org, developerGrantRouteAccess(options.developerGrantStore, 'deployments:rollback', tenant.env));
     if (identity === false)
         return;
-    if (!(await canManageMembers(controlPlane, tenant.org, identity))) {
-        return sendForbidden(res, 'forbidden');
-    }
-    // Archived apps are soft-deleted (ADR 0117): activation changes are refused until restored.
-    const archivedAt = await registry.getAppArchivedAt(tenant.org, tenant.app);
-    if (archivedAt !== undefined) {
-        await audit.emit({
-            eventType: 'rollback.rejected',
-            org: tenant.org,
-            app: tenant.app,
-            env: tenant.env,
-            decision: 'deny',
-            status: 409,
-            reasonCode: 'app_archived',
-            actorSubject: identity.subject,
-            ...(identity.email !== undefined ? { actorEmail: identity.email } : {}),
-            details: { archivedAt },
-        });
-        return sendJson(res, 409, { error: 'app is archived; restore it before rolling back' });
-    }
     const body = await readJsonBody(req, maxBody);
     if (!body.ok)
         return sendJson(res, body.status, { error: body.error });
@@ -37,71 +15,32 @@ export async function handleRollback(req, res, registry, gate, controlPlane, aud
     if (parsed.reason !== undefined && typeof parsed.reason !== 'string') {
         return sendJson(res, 400, { error: '"reason" must be a string' });
     }
-    let result;
-    try {
-        result = await registry.rollback(tenant, parsed.deploymentId);
-    }
-    catch (error) {
-        const handled = await respondProductionAppAdmissionError(res, error, {
-            audit,
-            eventType: 'rollback.rejected',
-            org: tenant.org,
-            app: tenant.app,
-            env: tenant.env,
-            actorSubject: identity.subject,
-            ...(identity.email !== undefined ? { actorEmail: identity.email } : {}),
+    const reason = typeof parsed.reason === 'string' ? parsed.reason.trim() : undefined;
+    if (reason !== undefined && (reason.length === 0 || reason.length > 500)) {
+        return sendJson(res, 400, {
+            error: '"reason" must be a non-empty string of at most 500 characters',
         });
-        if (handled)
-            return;
-        throw error;
     }
-    if (!result.ok)
-        return sendJson(res, result.status, { ok: false, error: result.error });
     const base = options.publicBaseUrl ?? baseFromRequest(req, options.tls ?? {});
-    const endpointUrl = tenantMcpUrl(base, tenant, result.serverVersion, options.mcpPublicRouting?.publicBaseDomain !== undefined
-        ? { publicBaseDomain: options.mcpPublicRouting.publicBaseDomain }
-        : {});
-    await audit.emit({
-        eventType: 'deploy.rollback',
-        org: tenant.org,
-        app: tenant.app,
-        env: tenant.env,
-        deploymentId: result.deploymentId,
-        decision: 'allow',
-        status: 200,
-        actorSubject: identity.subject,
-        ...(identity.email !== undefined ? { actorEmail: identity.email } : {}),
-        details: {
-            ...(result.serverVersion !== undefined ? { serverVersion: result.serverVersion } : {}),
-            ...(result.previousDeploymentId !== undefined
-                ? { previousDeploymentId: result.previousDeploymentId }
-                : {}),
-            alreadyActive: result.alreadyActive,
-            accessMode: result.accessMode,
-            ...(result.previousAccessMode !== undefined
-                ? { previousAccessMode: result.previousAccessMode }
-                : {}),
-            ...(parsed.reason !== undefined ? { reason: parsed.reason } : {}),
-        },
-    });
-    return sendJson(res, 200, {
-        ok: true,
+    const result = await rollbackDeploymentOperation({ registry, controlPlane, audit }, {
+        actor: identity,
         target: tenant,
-        rollback: {
-            deploymentId: result.deploymentId,
-            ...(result.serverVersion !== undefined ? { serverVersion: result.serverVersion } : {}),
-            ...(result.previousDeploymentId !== undefined
-                ? { previousDeploymentId: result.previousDeploymentId }
-                : {}),
-            alreadyActive: result.alreadyActive,
-            endpointUrl,
-            accessMode: result.accessMode,
-            ...(result.previousAccessMode !== undefined
-                ? { previousAccessMode: result.previousAccessMode }
-                : {}),
-            serverName: result.serverName,
-            createdAt: result.createdAt,
-        },
+        deploymentId: parsed.deploymentId,
+        ...(reason !== undefined ? { reason } : {}),
+        publicBaseUrl: base,
+        ...(options.mcpPublicRouting?.publicBaseDomain !== undefined
+            ? { publicBaseDomain: options.mcpPublicRouting.publicBaseDomain }
+            : {}),
     });
+    if (!result.ok) {
+        if (result.status === 403)
+            return sendForbidden(res, result.code);
+        return sendJson(res, result.status, {
+            ok: false,
+            code: result.code,
+            error: result.message,
+        });
+    }
+    return sendJson(res, 200, { ok: true, ...result.view });
 }
 //# sourceMappingURL=rollback.js.map

package/node_modules/@noodle-borg/service/dist/routes/rollback.js.map

@@ -1 +1 @@
-{"version":3,"file":"rollback.js","sourceRoot":"","sources":["../../src/routes/rollback.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAGzF,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAGtD,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAoB,EACpB,GAAmB,EACnB,QAAwB,EACxB,IAAoB,EACpB,YAA+B,EAC/B,KAAgB,EAChB,OAAe,EACf,MAAiB,EACjB,OAAuB;IAEvB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IACD,4FAA4F;IAC5F,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,KAAK,CAAC,IAAI,CAAC;YACf,SAAS,EAAE,mBAAmB;YAC9B,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,GAAG;YACX,UAAU,EAAE,cAAc;YAC1B,YAAY,EAAE,QAAQ,CAAC,OAAO;YAC9B,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,EAAE,EAAE,UAAU,EAAE;SACxB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAqD,CAAC;IAC1E,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjF,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACrE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,MAAuD,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,MAAM,kCAAkC,CAAC,GAAG,EAAE,KAAK,EAAE;YACnE,KAAK;YACL,SAAS,EAAE,mBAAmB;YAC9B,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,YAAY,EAAE,QAAQ,CAAC,OAAO;YAC9B,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC,CAAC;QACH,IAAI,OAAO;YAAE,OAAO;QACpB,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,YAAY,CAC9B,IAAI,EACJ,MAAM,EACN,MAAM,CAAC,aAAa,EACpB,OAAO,CAAC,gBAAgB,EAAE,gBAAgB,KAAK,SAAS;QACtD,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,CAAC,gBAAgB,EAAE;QACjE,CAAC,CAAC,EAAE,CACP,CAAC;IACF,MAAM,KAAK,CAAC,IAAI,CAAC;QACf,SAAS,EAAE,iBAAiB;QAC5B,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,GAAG;QACX,YAAY,EAAE,QAAQ,CAAC,OAAO;QAC9B,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,EAAE;YACP,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,MAAM,CAAC,oBAAoB,KAAK,SAAS;gBAC3C,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE;gBACvD,CAAC,CAAC,EAAE,CAAC;YACP,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,GAAG,CAAC,MAAM,CAAC,kBAAkB,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE;gBACnD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE;KACF,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;QACxB,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,MAAM,CAAC,oBAAoB,KAAK,SAAS;gBAC3C,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE;gBACvD,CAAC,CAAC,EAAE,CAAC;YACP,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,WAAW;YACX,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,GAAG,CAAC,MAAM,CAAC,kBAAkB,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE;gBACnD,CAAC,CAAC,EAAE,CAAC;YACP,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"rollback.js","sourceRoot":"","sources":["../../src/routes/rollback.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACzF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAKnF,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAEvF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAoB,EACpB,GAAmB,EACnB,QAAwB,EACxB,IAAoB,EACpB,YAA+B,EAC/B,KAAgB,EAChB,OAAe,EACf,MAAiB,EACjB,OAAuB;IAEvB,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAC3C,GAAG,EACH,GAAG,EACH,IAAI,EACJ,YAAY,EACZ,MAAM,CAAC,GAAG,EACV,yBAAyB,CAAC,OAAO,CAAC,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,CAAC,GAAG,CAAC,CAC3F,CAAC;IACF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAqD,CAAC;IAC1E,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjF,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACrE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;QACzE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACxB,KAAK,EAAE,+DAA+D;SACvE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAC9C,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,EACjC;QACE,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,MAAM;QACd,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,aAAa,EAAE,IAAI;QACnB,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,gBAAgB,KAAK,SAAS;YAC1D,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,CAAC,gBAAgB,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;KACR,CACF,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAClE,OAAO,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE;YAClC,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1D,CAAC"}

package/node_modules/@noodle-borg/service/dist/serve-resource-auth.d.ts

@@ -0,0 +1,11 @@
+import type { SecretBox } from '@noodle-borg/runtime';
+import type { ServiceOptions } from './options.js';
+import type { ServerRegistry } from './registry.js';
+import { type SecretEnvelope, type TenantBridgeAuthConfig } from './store.js';
+export declare function isLoopbackHost(host: string): boolean;
+export declare function sealCustomerCredential(secretBox: SecretBox | undefined, credential: string): Promise<SecretEnvelope>;
+export declare function openCustomerCredential(secretBox: SecretBox | undefined, envelope: SecretEnvelope): Promise<string>;
+export declare function bridgeAuthForResource(registry: ServerRegistry, resource: string, allowedBaseDomains: readonly string[]): Promise<TenantBridgeAuthConfig | undefined>;
+export declare function managedSecretForResource(registry: ServerRegistry, resource: string, name: string, allowedBaseDomains: readonly string[]): Promise<string | undefined>;
+export declare function allowedMcpBaseDomains(options: ServiceOptions): readonly string[];
+//# sourceMappingURL=serve-resource-auth.d.ts.map

package/node_modules/@noodle-borg/service/dist/serve-resource-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve-resource-auth.d.ts","sourceRoot":"","sources":["../src/serve-resource-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAE5B,MAAM,YAAY,CAAC;AAMpB,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,SAAS,GAAG,SAAS,EAChC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,CAAC,CAKzB;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,SAAS,GAAG,SAAS,EAChC,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,MAAM,EAChB,kBAAkB,EAAE,SAAS,MAAM,EAAE,GACpC,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAc7C;AAED,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,kBAAkB,EAAE,SAAS,MAAM,EAAE,GACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQ7B;AAmBD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,cAAc,GAAG,SAAS,MAAM,EAAE,CAOhF"}

package/node_modules/@noodle-borg/service/dist/serve-resource-auth.js

@@ -0,0 +1,62 @@
+import { parseLegacyTenantMcpPath, parsePublicTenantMcpUrl } from '@noodle-borg/module';
+import { resolveTenantBridgeAuthVariables } from './managed-config-expressions.js';
+import { resolveConfigScope, } from './store.js';
+export function isLoopbackHost(host) {
+    return host === '127.0.0.1' || host === '::1' || host === 'localhost';
+}
+export async function sealCustomerCredential(secretBox, credential) {
+    if (secretBox !== undefined) {
+        return { enc: 'aes-256-gcm', sealed: await secretBox.seal(credential) };
+    }
+    return { enc: 'none', values: { token: credential } };
+}
+export async function openCustomerCredential(secretBox, envelope) {
+    if (envelope.enc === 'none') {
+        const token = envelope.values.token;
+        if (token === undefined)
+            throw new Error('delegated credential envelope missing token');
+        return token;
+    }
+    if (secretBox === undefined)
+        throw new Error('secret box is required for delegated credential');
+    return secretBox.open(envelope.sealed);
+}
+export async function bridgeAuthForResource(registry, resource, allowedBaseDomains) {
+    const tenant = tenantRefFromResource(resource, allowedBaseDomains);
+    if (tenant === undefined)
+        return undefined;
+    const target = tenant.serverVersion === undefined
+        ? await registry.getActiveByTenant(tenant)
+        : await registry.getActiveByTenantVersion(tenant, tenant.serverVersion);
+    const auth = target?.served.artifact.server.auth;
+    if (auth?.kind !== 'bridge')
+        return undefined;
+    const variables = await registry.configStore.resolveConfigValues('variable', resolveConfigScope(tenant));
+    return resolveTenantBridgeAuthVariables(auth, variables);
+}
+export async function managedSecretForResource(registry, resource, name, allowedBaseDomains) {
+    const tenant = tenantRefFromResource(resource, allowedBaseDomains);
+    if (tenant === undefined)
+        return undefined;
+    const secrets = await registry.configStore.resolveConfigValues('secret', resolveConfigScope(tenant));
+    return secrets[name];
+}
+function tenantRefFromResource(resource, allowedBaseDomains) {
+    let url;
+    try {
+        url = new URL(resource);
+    }
+    catch {
+        return undefined;
+    }
+    return ((allowedBaseDomains.length > 0
+        ? parsePublicTenantMcpUrl(resource, allowedBaseDomains)
+        : undefined) ?? parseLegacyTenantMcpPath(url.pathname));
+}
+export function allowedMcpBaseDomains(options) {
+    return (options.mcpPublicRouting?.allowedBaseDomains ??
+        (options.mcpPublicRouting?.publicBaseDomain !== undefined
+            ? [options.mcpPublicRouting.publicBaseDomain]
+            : []));
+}
+//# sourceMappingURL=serve-resource-auth.js.map

package/node_modules/@noodle-borg/service/dist/serve-resource-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve-resource-auth.js","sourceRoot":"","sources":["../src/serve-resource-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAExF,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AAGnF,OAAO,EACL,kBAAkB,GAInB,MAAM,YAAY,CAAC;AAMpB,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAgC,EAChC,UAAkB;IAElB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAgC,EAChC,QAAwB;IAExB,IAAI,QAAQ,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACxF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,SAAS,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAChG,OAAO,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAwB,EACxB,QAAgB,EAChB,kBAAqC;IAErC,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IACnE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,MAAM,GACV,MAAM,CAAC,aAAa,KAAK,SAAS;QAChC,CAAC,CAAC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC;QAC1C,CAAC,CAAC,MAAM,QAAQ,CAAC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;IACjD,IAAI,IAAI,EAAE,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,mBAAmB,CAC9D,UAAU,EACV,kBAAkB,CAAC,MAAM,CAAC,CAC3B,CAAC;IACF,OAAO,gCAAgC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAwB,EACxB,QAAgB,EAChB,IAAY,EACZ,kBAAqC;IAErC,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IACnE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,mBAAmB,CAC5D,QAAQ,EACR,kBAAkB,CAAC,MAAM,CAAC,CAC3B,CAAC;IACF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAAgB,EAChB,kBAAqC;IAErC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,CACL,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;QAC5B,CAAC,CAAC,uBAAuB,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QACvD,CAAC,CAAC,SAAS,CAAC,IAAI,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAuB;IAC3D,OAAO,CACL,OAAO,CAAC,gBAAgB,EAAE,kBAAkB;QAC5C,CAAC,OAAO,CAAC,gBAAgB,EAAE,gBAAgB,KAAK,SAAS;YACvD,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;YAC7C,CAAC,CAAC,EAAE,CAAC,CACR,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/service/dist/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAqDjG,OAAO,EAAE,KAAK,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AA0C9D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,4FAA4F;IAC5F,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,iGAAiG;AACjG,wBAAsB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,cAAc,CAAC,CAilB7F"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAqDjG,OAAO,EAAE,KAAK,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AA2C9D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,4FAA4F;IAC5F,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,iGAAiG;AACjG,wBAAsB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,cAAc,CAAC,CAgmB7F"}

package/node_modules/@noodle-borg/service/dist/serve.js

@@ -1,6 +1,5 @@
 import { createServer } from 'node:http';
 import { createJwtVerifier } from '@noodle-borg/auth';
-import { parseLegacyTenantMcpPath, parsePublicTenantMcpUrl, } from '@noodle-borg/module';
 import { SecretBox, staticMasterKeyProvider } from '@noodle-borg/runtime';
 import { noopLogger } from '@noodle-borg/transport-http';
 import { ALERT_EVALUATION_INTERVAL_MS, AlertEvaluator } from './alert-evaluator.js';
@@ -16,12 +15,13 @@ import { createCustomerVerifierFactory, createHostedCustomerVerifierFactory, } f
 import { geminiEnterpriseDefaultResourceForClient } from './gemini-enterprise-oauth.js';
 import { GITHUB_RUN_RECONCILE_INTERVAL_MS, GithubDeployRunReconciler, } from './github/deploy-run-reconciler.js';
 import { normalizeOAuthResource } from './http-util.js';
-import { resolveTenantBridgeAuthVariables } from './managed-config-expressions.js';
 import { ModuleHost } from './modules/host.js';
 import { loadModules } from './modules/loader.js';
+import { createDeveloperGrantAuthorizer, resolveDeveloperGrantStore, } from './oauth/developer-grant-bootstrap.js';
 import { assertPostgresStoreOwnership } from './persistence-options.js';
 import { InMemoryPolicyAssignmentStore } from './policy.js';
 import { ServerRegistry } from './registry.js';
+import { allowedMcpBaseDomains, bridgeAuthForResource, isLoopbackHost, managedSecretForResource, openCustomerCredential, sealCustomerCredential, } from './serve-resource-auth.js';
 import { createServiceHandler } from './service.js';
 import { resolveServiceConfigSource } from './service-config.js';
 import { closeHttpServer, closeServiceResources, listenHttpServer, } from './service-resource-cleanup.js';
@@ -37,7 +37,7 @@ import { RequestEventBuffer } from './store/request-event-buffer.js';
 import { InMemoryRequestEventStore } from './store/request-events.js';
 import { PostgresRequestEventStore } from './store/request-events-postgres.js';
 import { InMemoryUserAppLogStore } from './store/user-app-logs.js';
-import { InMemoryConfigStore, JsonFileArtifactStore, JsonFileGithubConnectionStore, JsonFileGithubDeployRunStore, resolveConfigScope, } from './store.js';
+import { InMemoryConfigStore, JsonFileArtifactStore, JsonFileGithubConnectionStore, JsonFileGithubDeployRunStore, } from './store.js';
 import { startWelcomeEmailWorker } from './welcome-email.js';
 /** Start the deploy service on its own `node:http` server (used by the `noodle-service` bin). */
 export async function serveService(options = {}) {
@@ -296,6 +296,7 @@ export async function serveService(options = {}) {
     let resolvedAuthServerIssuer = options.authServerIssuer;
     let registry;
     let oauthStore;
+    let developerGrantStore = options.developerGrantStore;
     let delegatedExchange;
     const allowedMcpDomains = allowedMcpBaseDomains(options);
     const rawCustomerVerifierFactory = createCustomerVerifierFactory({
@@ -318,6 +319,10 @@ export async function serveService(options = {}) {
             const { InMemoryOAuthStore } = await import('./oauth/store.js');
             oauthStore = new InMemoryOAuthStore();
         }
+        developerGrantStore = await resolveDeveloperGrantStore({
+            ...(pgPool === undefined ? {} : { pool: pgPool.pool }),
+            ...(developerGrantStore === undefined ? {} : { store: developerGrantStore }),
+        });
         const [{ NoodleOAuthProvider }, { createOAuthApp }] = await Promise.all([
             import('./oauth/provider.js'),
             import('./oauth/app.js'),
@@ -345,6 +350,11 @@ export async function serveService(options = {}) {
             },
             sealCustomerCredential: (credential) => sealCustomerCredential(secretBox, credential),
             signupAuthorizer: controlPlaneStore,
+            developerGrantAuthorizer: createDeveloperGrantAuthorizer({
+                controlPlane: controlPlaneStore,
+                grants: developerGrantStore,
+                registry: () => registry,
+            }),
             logger: options.logger ?? noopLogger,
             defaultResourceForClient: (client) => geminiEnterpriseDefaultResourceForClient(client, oauthIssuer),
             ...(options.oauth.allowedEmailDomain !== undefined
@@ -381,7 +391,11 @@ export async function serveService(options = {}) {
             const allowedEmailDomain = options.controlPlaneAllowedEmailDomain ?? options.oauth?.allowedEmailDomain;
             gates.push(new NoodleOAuthControlPlaneGate({
                 verifier: resolvedVerifyOwnerToken,
-                audience: normalizeOAuthResource(options.publicBaseUrl ?? resolvedAuthServerIssuer),
+                audience: [
+                    normalizeOAuthResource(options.publicBaseUrl ?? resolvedAuthServerIssuer),
+                    `${resolvedAuthServerIssuer}/developer/mcp`,
+                    `${resolvedAuthServerIssuer}/developer/cli`,
+                ],
                 admins: options.controlPlaneAdmins ?? [],
                 signupMode: options.controlPlaneSignupMode ?? 'restricted',
                 signupAuthorizer: controlPlaneStore,
@@ -500,6 +514,7 @@ export async function serveService(options = {}) {
         ...options,
         readinessProbe,
         controlPlaneStore,
+        ...(developerGrantStore !== undefined ? { developerGrantStore } : {}),
         ...(billingMigrationStore !== undefined ? { billingMigrationStore } : {}),
         ...(billingEnforcementProfileStore !== undefined ? { billingEnforcementProfileStore } : {}),
         ...(billingEnforcementActivationStore !== undefined
@@ -567,62 +582,4 @@ export async function serveService(options = {}) {
         },
     };
 }
-function isLoopbackHost(host) {
-    return host === '127.0.0.1' || host === '::1' || host === 'localhost';
-}
-async function sealCustomerCredential(secretBox, credential) {
-    if (secretBox !== undefined) {
-        return { enc: 'aes-256-gcm', sealed: await secretBox.seal(credential) };
-    }
-    return { enc: 'none', values: { token: credential } };
-}
-async function openCustomerCredential(secretBox, envelope) {
-    if (envelope.enc === 'none') {
-        const token = envelope.values.token;
-        if (token === undefined)
-            throw new Error('delegated credential envelope missing token');
-        return token;
-    }
-    if (secretBox === undefined)
-        throw new Error('secret box is required for delegated credential');
-    return secretBox.open(envelope.sealed);
-}
-async function bridgeAuthForResource(registry, resource, allowedBaseDomains) {
-    const tenant = tenantRefFromResource(resource, allowedBaseDomains);
-    if (tenant === undefined)
-        return undefined;
-    const target = tenant.serverVersion === undefined
-        ? await registry.getActiveByTenant(tenant)
-        : await registry.getActiveByTenantVersion(tenant, tenant.serverVersion);
-    const auth = target?.served.artifact.server.auth;
-    if (auth?.kind !== 'bridge')
-        return undefined;
-    const variables = await registry.configStore.resolveConfigValues('variable', resolveConfigScope(tenant));
-    return resolveTenantBridgeAuthVariables(auth, variables);
-}
-async function managedSecretForResource(registry, resource, name, allowedBaseDomains) {
-    const tenant = tenantRefFromResource(resource, allowedBaseDomains);
-    if (tenant === undefined)
-        return undefined;
-    const secrets = await registry.configStore.resolveConfigValues('secret', resolveConfigScope(tenant));
-    return secrets[name];
-}
-function tenantRefFromResource(resource, allowedBaseDomains) {
-    let url;
-    try {
-        url = new URL(resource);
-    }
-    catch {
-        return undefined;
-    }
-    return ((allowedBaseDomains.length > 0
-        ? parsePublicTenantMcpUrl(resource, allowedBaseDomains)
-        : undefined) ?? parseLegacyTenantMcpPath(url.pathname));
-}
-function allowedMcpBaseDomains(options) {
-    return (options.mcpPublicRouting?.allowedBaseDomains ??
-        (options.mcpPublicRouting?.publicBaseDomain !== undefined
-            ? [options.mcpPublicRouting.publicBaseDomain]
-            : []));
-}
 //# sourceMappingURL=serve.js.map