@noodleseed/one 0.8.0 → 0.11.0

package/node_modules/@noodle-borg/service/dist/routes/archive.js

@@ -0,0 +1,83 @@
+import { sendForbidden, sendJson } from '../http-util.js';
+import { authorizeControlPlane } from './control-plane.js';
+import { canManageMembers } from './org-admin.js';
+const DAY_MS = 24 * 60 * 60 * 1000;
+export async function handleAppArchive(req, res, registry, gate, controlPlane, audit, ref, options) {
+    const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
+    if (identity === false)
+        return;
+    if (!(await canManageMembers(controlPlane, ref.org, identity))) {
+        return sendForbidden(res, 'forbidden');
+    }
+    const at = (options.clock?.() ?? new Date()).toISOString();
+    const result = await registry.archiveApp(ref.org, ref.app, at);
+    if (result === undefined)
+        return sendJson(res, 404, { error: 'app not found' });
+    await audit.emit({
+        eventType: 'app.archived',
+        org: ref.org,
+        app: ref.app,
+        decision: 'allow',
+        status: 200,
+        actorSubject: identity.subject,
+        ...(identity.email !== undefined ? { actorEmail: identity.email } : {}),
+        details: {
+            archivedAt: result.archivedAt,
+            archivedDeployments: result.archivedDeployments,
+            alreadyArchived: result.alreadyArchived,
+        },
+    });
+    return sendJson(res, 200, {
+        ok: true,
+        target: { org: ref.org, app: ref.app },
+        archive: result,
+    });
+}
+export async function handleAppRestore(req, res, registry, gate, controlPlane, audit, ref, options, retentionDays) {
+    const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
+    if (identity === false)
+        return;
+    if (!(await canManageMembers(controlPlane, ref.org, identity))) {
+        return sendForbidden(res, 'forbidden');
+    }
+    const now = options.clock?.() ?? new Date();
+    const archivedAt = await registry.getAppArchivedAt(ref.org, ref.app);
+    // Deterministic on the window, not on sweeper timing (ADR 0117 §5): past-retention restores are
+    // 410 Gone even before the sweeper hard-deletes; after the sweep the app is a plain 404.
+    if (archivedAt !== undefined && now.getTime() - Date.parse(archivedAt) > retentionDays * DAY_MS) {
+        await audit.emit({
+            eventType: 'app.restore.rejected',
+            org: ref.org,
+            app: ref.app,
+            decision: 'deny',
+            status: 410,
+            reasonCode: 'retention_elapsed',
+            actorSubject: identity.subject,
+            ...(identity.email !== undefined ? { actorEmail: identity.email } : {}),
+            details: { archivedAt, retentionDays },
+        });
+        return sendJson(res, 410, {
+            error: 'archive retention window elapsed; the app is pending permanent deletion',
+        });
+    }
+    const result = await registry.restoreApp(ref.org, ref.app);
+    if (result === undefined)
+        return sendJson(res, 404, { error: 'app not found' });
+    const alreadyActive = result.restoredDeployments === 0;
+    await audit.emit({
+        eventType: 'app.restored',
+        org: ref.org,
+        app: ref.app,
+        decision: 'allow',
+        status: 200,
+        actorSubject: identity.subject,
+        ...(identity.email !== undefined ? { actorEmail: identity.email } : {}),
+        details: { restoredDeployments: result.restoredDeployments, alreadyActive },
+    });
+    return sendJson(res, 200, {
+        ok: true,
+        target: { org: ref.org, app: ref.app },
+        restore: { restoredDeployments: result.restoredDeployments, alreadyActive },
+    });
+}
+//# sourceMappingURL=archive.js.map

package/node_modules/@noodle-borg/service/dist/routes/archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive.js","sourceRoot":"","sources":["../../src/routes/archive.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAK1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGlD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAoB,EACpB,GAAmB,EACnB,QAAwB,EACxB,IAAoB,EACpB,YAA+B,EAC/B,KAAgB,EAChB,GAAgB,EAChB,OAAuB;IAEvB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC/D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;IAChF,MAAM,KAAK,CAAC,IAAI,CAAC;QACf,SAAS,EAAE,cAAc;QACzB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,GAAG;QACX,YAAY,EAAE,QAAQ,CAAC,OAAO;QAC9B,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,EAAE;YACP,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC;KACF,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;QACxB,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE;QACtC,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAoB,EACpB,GAAmB,EACnB,QAAwB,EACxB,IAAoB,EACpB,YAA+B,EAC/B,KAAgB,EAChB,GAAgB,EAChB,OAAuB,EACvB,aAAqB;IAErB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACrE,gGAAgG;IAChG,yFAAyF;IACzF,IAAI,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,aAAa,GAAG,MAAM,EAAE,CAAC;QAChG,MAAM,KAAK,CAAC,IAAI,CAAC;YACf,SAAS,EAAE,sBAAsB;YACjC,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,GAAG;YACX,UAAU,EAAE,mBAAmB;YAC/B,YAAY,EAAE,QAAQ,CAAC,OAAO;YAC9B,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE;SACvC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACxB,KAAK,EAAE,yEAAyE;SACjF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;IAChF,MAAM,aAAa,GAAG,MAAM,CAAC,mBAAmB,KAAK,CAAC,CAAC;IACvD,MAAM,KAAK,CAAC,IAAI,CAAC;QACf,SAAS,EAAE,cAAc;QACzB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,GAAG;QACX,YAAY,EAAE,QAAQ,CAAC,OAAO;QAC9B,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,EAAE,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE,aAAa,EAAE;KAC5E,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;QACxB,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE;QACtC,OAAO,EAAE,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE,aAAa,EAAE;KAC5E,CAAC,CAAC;AACL,CAAC"}

package/node_modules/@noodle-borg/service/dist/routes/control-plane.d.ts

@@ -3,31 +3,14 @@ import type { ControlPlaneIdentity, DeployAuthGate } from '../auth/deploy-gate.j
 import type { ServiceOptions } from '../options.js';
 import type { ServerRegistry } from '../registry.js';
 import type { AuditSink } from '../store/audit.js';
-import { type ConfigStore, type ControlPlaneStore, type TenantRef } from '../store.js';
+import type { ConfigStore, ControlPlaneStore, TenantRef } from '../store.js';
 import type { ConfigRouteRef } from './paths.js';
 export declare function handleDeploy(req: IncomingMessage, res: ServerResponse, registry: ServerRegistry, options: ServiceOptions, maxBody: number, tenant: TenantRef, gate: DeployAuthGate, controlPlane: ControlPlaneStore, audit: AuditSink): Promise<void>;
 export declare function handleWhoami(req: IncomingMessage, res: ServerResponse, gate: DeployAuthGate, controlPlane: ControlPlaneStore, options?: ServiceOptions): Promise<void>;
-export declare function handleOrgs(req: IncomingMessage, res: ServerResponse, gate: DeployAuthGate, controlPlane: ControlPlaneStore, maxBody: number): Promise<void>;
-export declare function handleMembers(req: IncomingMessage, res: ServerResponse, gate: DeployAuthGate, controlPlane: ControlPlaneStore, maxBody: number, ref: {
-    org: string;
-    subject?: string;
-}): Promise<void>;
-export declare function handleInvitations(req: IncomingMessage, res: ServerResponse, gate: DeployAuthGate, controlPlane: ControlPlaneStore, maxBody: number, ref: {
-    org: string;
-    token?: string;
-    action?: 'accept';
-}, now?: () => Date): Promise<void>;
 export declare function handleConfigValues(req: IncomingMessage, res: ServerResponse, gate: DeployAuthGate, controlPlane: ControlPlaneStore, configStore: ConfigStore, maxBody: number, ref: ConfigRouteRef, audit: AuditSink): Promise<void>;
 export declare function authorizeTenantControl(req: IncomingMessage, res: ServerResponse, gate: DeployAuthGate, controlPlane: ControlPlaneStore, org: string): Promise<ControlPlaneIdentity | false>;
-export declare function canManageMembers(store: ControlPlaneStore, org: string, identity: ControlPlaneIdentity): Promise<boolean>;
-export declare function handleDeploymentStatus(req: IncomingMessage, res: ServerResponse, registry: ServerRegistry, gate: DeployAuthGate, controlPlane: ControlPlaneStore, tenant: TenantRef, options: ServiceOptions): Promise<void>;
+export declare function handleDeploymentStatus(req: IncomingMessage, res: ServerResponse, registry: ServerRegistry, gate: DeployAuthGate, controlPlane: ControlPlaneStore, tenant: TenantRef, options: ServiceOptions, url?: URL): Promise<void>;
 export declare function handleAccessUpdate(req: IncomingMessage, res: ServerResponse, registry: ServerRegistry, gate: DeployAuthGate, controlPlane: ControlPlaneStore, maxBody: number, tenant: TenantRef): Promise<void>;
-export declare function handleDeployments(req: IncomingMessage, res: ServerResponse, registry: ServerRegistry, gate: DeployAuthGate, controlPlane: ControlPlaneStore, ref: {
-    org: string;
-}, url: URL): Promise<void>;
-export declare function handleAuditEvents(req: IncomingMessage, res: ServerResponse, gate: DeployAuthGate, controlPlane: ControlPlaneStore, audit: AuditSink, ref: {
-    org: string;
-}, url: URL): Promise<void>;
 export declare function authorizeControlPlane(req: IncomingMessage, res: ServerResponse, gate: DeployAuthGate, options: {
     requireIdentity: true;
 }): Promise<ControlPlaneIdentity | false>;

package/node_modules/@noodle-borg/service/dist/routes/control-plane.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../../src/routes/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAGjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAUnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EAEtB,KAAK,SAAS,EAEf,MAAM,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAIjD,wBAAsB,YAAY,CAChC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,IAAI,CAAC,CA8Mf;AA0BD,wBAAsB,YAAY,CAChC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACrC,OAAO,CAAC,IAAI,CAAC,CAmDf;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,QAAQ,CAAA;CAAE,EACvD,GAAG,GAAE,MAAM,IAAuB,GACjC,OAAO,CAAC,IAAI,CAAC,CAsDf;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,IAAI,CAAC,CAgDf;AAwBD,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,oBAAoB,GAAG,KAAK,CAAC,CAWvC;AAWD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAGlB;AA4BD,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACpB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,KAAK,EAAE,SAAS,EAChB,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACpB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA0Cf;AAkBD,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE;IAAE,eAAe,EAAE,IAAI,CAAA;CAAE,GACjC,OAAO,CAAC,oBAAoB,GAAG,KAAK,CAAC,CAAC;AACzC,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE;IAAE,eAAe,EAAE,KAAK,CAAA;CAAE,GAClC,OAAO,CAAC,oBAAoB,GAAG,SAAS,GAAG,KAAK,CAAC,CAAC"}
+{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../../src/routes/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAIjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AASnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAG7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,wBAAsB,YAAY,CAChC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,IAAI,CAAC,CAuOf;AAWD,wBAAsB,YAAY,CAChC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,IAAI,CAAC,CAgDf;AAwBD,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,oBAAoB,GAAG,KAAK,CAAC,CAWvC;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,cAAc,EACvB,GAAG,CAAC,EAAE,GAAG,GACR,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC,IAAI,CAAC,CAqCf;AAED,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE;IAAE,eAAe,EAAE,IAAI,CAAA;CAAE,GACjC,OAAO,CAAC,oBAAoB,GAAG,KAAK,CAAC,CAAC;AACzC,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE;IAAE,eAAe,EAAE,KAAK,CAAA;CAAE,GAClC,OAAO,CAAC,oBAAoB,GAAG,SAAS,GAAG,KAAK,CAAC,CAAC"}

package/node_modules/@noodle-borg/service/dist/routes/control-plane.js

@@ -1,10 +1,10 @@
+import { normalizeServerVersion } from '@noodle-borg/module';
 import { noopLogger } from '@noodle-borg/transport-http';
 import { baseFromRequest, readBody, readJsonBody, sendForbidden, sendJson, sendUnauthorized, } from '../http-util.js';
-import { hashToken, randomToken } from '../oauth/tokens.js';
 import { ensurePersonalWorkspace } from '../personal-workspace.js';
-import { validateOrgRole, } from '../store.js';
+import { tenantMcpUrl } from '../registry-helpers.js';
+import { isAccessMode, isIdentityAccessMode } from './access-mode.js';
 import { parseHostedAssets } from './assets.js';
-const ORG_INVITATION_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 export async function handleDeploy(req, res, registry, options, maxBody, tenant, gate, controlPlane, audit) {
     const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: false });
     if (identity === false)
@@ -17,6 +17,24 @@ export async function handleDeploy(req, res, registry, options, maxBody, tenant,
         if (!member)
             return sendForbidden(res, 'forbidden');
     }
+    // Archived apps are soft-deleted (ADR 0117): refuse new deploys so the all-records-archived
+    // invariant can't be broken sideways. Restore first, then deploy.
+    const appArchivedAt = await registry.getAppArchivedAt(tenant.org, tenant.app);
+    if (appArchivedAt !== undefined) {
+        await audit.emit({
+            eventType: 'deploy.rejected',
+            org: tenant.org,
+            app: tenant.app,
+            env: tenant.env,
+            decision: 'deny',
+            status: 409,
+            reasonCode: 'app_archived',
+            ...(identity?.subject !== undefined ? { actorSubject: identity.subject } : {}),
+            ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
+            details: { archivedAt: appArchivedAt },
+        });
+        return sendJson(res, 409, { error: 'app is archived; restore it before deploying' });
+    }
     const body = await readBody(req, maxBody);
     if (!body.ok)
         return sendJson(res, 413, { error: 'request body too large' });
@@ -24,6 +42,7 @@ export async function handleDeploy(req, res, registry, options, maxBody, tenant,
     let connectors;
     let hostedAssets;
     let accessMode = 'owner-only';
+    let serverVersion;
     try {
         const parsed = JSON.parse(body.text);
         if (typeof parsed.manifest !== 'string')
@@ -49,6 +68,8 @@ export async function handleDeploy(req, res, registry, options, maxBody, tenant,
         if (parsed.hostedAssets !== undefined) {
             hostedAssets = parseHostedAssets(parsed.hostedAssets);
         }
+        serverVersion =
+            parsed.serverVersion === undefined ? '1' : normalizeParsedServerVersion(parsed.serverVersion);
     }
     catch (error) {
         return sendJson(res, 400, { error: `invalid deploy request: ${error.message}` });
@@ -103,7 +124,7 @@ export async function handleDeploy(req, res, registry, options, maxBody, tenant,
         }
         hostedAssets = verified.assets;
     }
-    const result = await registry.deploy(tenant, manifest, connectors, identity || undefined, accessMode, hostedAssets);
+    const result = await registry.deploy(tenant, manifest, connectors, identity || undefined, accessMode, hostedAssets, serverVersion);
     if (!result.ok) {
         // Codes are safe enum strings; never a path-with-value. No secret name or value is logged.
         const codes = result.errors.map((error) => error.code).join(',');
@@ -130,6 +151,7 @@ export async function handleDeploy(req, res, registry, options, maxBody, tenant,
     // Counts only — never secret names or values.
     logger.info('deploy.ok', {
         deploymentId: result.deploymentId,
+        serverVersion: result.serverVersion,
         org: tenant.org,
         app: tenant.app,
         env: tenant.env,
@@ -147,6 +169,7 @@ export async function handleDeploy(req, res, registry, options, maxBody, tenant,
         ...(identity?.email !== undefined ? { actorEmail: identity.email } : {}),
         details: {
             accessMode: result.accessMode ?? accessMode,
+            serverVersion: result.serverVersion,
             hasConnectors: connectors !== undefined,
         },
     });
@@ -159,7 +182,7 @@ export async function handleDeploy(req, res, registry, options, maxBody, tenant,
         app: tenant.app,
         env: tenant.env,
         ...(result.deploymentId !== undefined ? { deploymentId: result.deploymentId } : {}),
-        details: { accessMode: result.accessMode ?? accessMode },
+        details: { accessMode: result.accessMode ?? accessMode, serverVersion: result.serverVersion },
     });
     if (result.ok && hostedAssets !== undefined && hostedAssets.length > 0) {
         await audit.emit({
@@ -185,31 +208,23 @@ export async function handleDeploy(req, res, registry, options, maxBody, tenant,
         });
     }
     const base = options.publicBaseUrl ?? baseFromRequest(req, options.tls ?? {});
+    const defaultUrl = tenantMcpUrl(base, tenant);
     return sendJson(res, 201, {
         ok: true,
         org: tenant.org,
         app: tenant.app,
         env: tenant.env,
         deploymentId: result.deploymentId,
+        serverVersion: result.serverVersion,
         accessMode: result.accessMode,
-        url: tenant.env === 'prod'
-            ? `${base}/o/${tenant.org}/${tenant.app}/mcp`
-            : `${base}/o/${tenant.org}/${tenant.app}/${tenant.env}/mcp`,
+        url: tenantMcpUrl(base, tenant, result.serverVersion),
+        defaultUrl,
     });
 }
-function isAccessMode(value) {
-    return (value === 'owner-only' ||
-        value === 'org-members' ||
-        value === 'public' ||
-        value === 'mixed' ||
-        value === 'customers' ||
-        value === 'authenticated');
-}
-function isIdentityAccessMode(accessMode) {
-    return (accessMode === 'owner-only' ||
-        accessMode === 'org-members' ||
-        accessMode === 'customers' ||
-        accessMode === 'authenticated');
+function normalizeParsedServerVersion(value) {
+    if (typeof value !== 'string')
+        throw new Error('"serverVersion" must be a version string');
+    return normalizeServerVersion(value);
 }
 function manifestUsesUserRoot(manifest) {
     return /\$\{\s*user(?:[.[]|\s*\})/.test(manifest);
@@ -226,154 +241,6 @@ export async function handleWhoami(req, res, gate, controlPlane, options = {}) {
         : await controlPlane.listOrgsForSubject(identity.subject);
     return sendJson(res, 200, { ok: true, identity, orgs });
 }
-export async function handleOrgs(req, res, gate, controlPlane, maxBody) {
-    const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
-    if (identity === false)
-        return;
-    if (req.method === 'GET') {
-        const orgs = identity.superAdmin
-            ? await controlPlane.listOrgs()
-            : await controlPlane.listOrgsForSubject(identity.subject);
-        return sendJson(res, 200, { ok: true, orgs });
-    }
-    if (!identity.superAdmin)
-        return sendForbidden(res, 'super-admin required');
-    const body = await readJsonBody(req, maxBody);
-    if (!body.ok)
-        return sendJson(res, body.status, { error: body.error });
-    const parsed = body.value;
-    if (typeof parsed.slug !== 'string')
-        return sendJson(res, 400, { error: '"slug" must be a string' });
-    if (parsed.displayName !== undefined && typeof parsed.displayName !== 'string') {
-        return sendJson(res, 400, { error: '"displayName" must be a string' });
-    }
-    try {
-        const org = await controlPlane.createOrg({
-            slug: parsed.slug,
-            ...(typeof parsed.displayName === 'string' ? { displayName: parsed.displayName } : {}),
-        });
-        return sendJson(res, 201, { ok: true, org });
-    }
-    catch (error) {
-        return sendJson(res, 400, { error: error.message });
-    }
-}
-export async function handleMembers(req, res, gate, controlPlane, maxBody, ref) {
-    const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
-    if (identity === false)
-        return;
-    if (req.method === 'GET' && ref.subject === undefined) {
-        if (!(await canViewMembers(controlPlane, ref.org, identity)))
-            return sendForbidden(res, 'forbidden');
-        try {
-            return sendJson(res, 200, { ok: true, members: await controlPlane.listOrgMembers(ref.org) });
-        }
-        catch (error) {
-            return sendJson(res, 400, { error: error.message });
-        }
-    }
-    if (req.method === 'POST' && ref.subject === undefined) {
-        if (!(await canManageMembers(controlPlane, ref.org, identity)))
-            return sendForbidden(res, 'forbidden');
-        const body = await readJsonBody(req, maxBody);
-        if (!body.ok)
-            return sendJson(res, body.status, { error: body.error });
-        const parsed = body.value;
-        if (typeof parsed.subject !== 'string') {
-            return sendJson(res, 400, { error: '"subject" must be a string' });
-        }
-        if (typeof parsed.email !== 'string') {
-            return sendJson(res, 400, { error: '"email" must be a string' });
-        }
-        let role;
-        try {
-            role = validateOrgRole(typeof parsed.role === 'string' ? parsed.role : 'developer');
-        }
-        catch (error) {
-            return sendJson(res, 400, { error: error.message });
-        }
-        try {
-            const member = await controlPlane.addOrgMember({
-                org: ref.org,
-                subject: parsed.subject,
-                email: parsed.email,
-                role,
-            });
-            return sendJson(res, 201, { ok: true, member });
-        }
-        catch (error) {
-            return sendJson(res, 400, { error: error.message });
-        }
-    }
-    if (req.method === 'DELETE' && ref.subject !== undefined) {
-        if (!(await canManageMembers(controlPlane, ref.org, identity)))
-            return sendForbidden(res, 'forbidden');
-        await controlPlane.removeOrgMember({ org: ref.org, subject: ref.subject });
-        res.writeHead(204);
-        res.end();
-        return;
-    }
-    return sendJson(res, 404, { error: 'not found' });
-}
-export async function handleInvitations(req, res, gate, controlPlane, maxBody, ref, now = () => new Date()) {
-    const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
-    if (identity === false)
-        return;
-    if (req.method === 'POST' && ref.token === undefined) {
-        if (!(await canManageMembers(controlPlane, ref.org, identity)))
-            return sendForbidden(res, 'forbidden');
-        const body = await readJsonBody(req, maxBody);
-        if (!body.ok)
-            return sendJson(res, body.status, { error: body.error });
-        const parsed = body.value;
-        if (typeof parsed.email !== 'string')
-            return sendJson(res, 400, { error: '"email" must be a string' });
-        let role;
-        try {
-            role = validateOrgRole(typeof parsed.role === 'string' ? parsed.role : 'developer');
-        }
-        catch (error) {
-            return sendJson(res, 400, { error: error.message });
-        }
-        const rawToken = randomToken();
-        const expiresAt = new Date(now().getTime() + ORG_INVITATION_TTL_MS);
-        const invitation = await controlPlane.createOrgInvitation({
-            org: ref.org,
-            email: parsed.email,
-            role,
-            tokenHash: hashToken(rawToken),
-            createdBySubject: identity.subject,
-            createdByEmail: identity.email,
-            expiresAt,
-        });
-        return sendJson(res, 201, {
-            ok: true,
-            invitation: publicInvitation(invitation),
-            acceptPath: invitationAcceptPath(ref.org, rawToken),
-        });
-    }
-    if (req.method === 'POST' && ref.token !== undefined && ref.action === 'accept') {
-        const tokenHash = hashToken(ref.token);
-        const invitation = await controlPlane.getOrgInvitation({ tokenHash });
-        if (invitation === undefined || invitation.orgSlug !== ref.org) {
-            return sendJson(res, 404, { error: 'not found' });
-        }
-        if (identity.email.toLowerCase() !== invitation.email) {
-            return sendForbidden(res, 'forbidden');
-        }
-        const consumed = await controlPlane.consumeOrgInvitation({ tokenHash });
-        if (consumed === undefined)
-            return sendJson(res, 404, { error: 'not found' });
-        const member = await controlPlane.addOrgMember({
-            org: consumed.orgSlug,
-            subject: identity.subject,
-            email: identity.email,
-            role: consumed.role,
-        });
-        return sendJson(res, 201, { ok: true, member });
-    }
-    return sendJson(res, 404, { error: 'not found' });
-}
 export async function handleConfigValues(req, res, gate, controlPlane, configStore, maxBody, ref, audit) {
     const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
     if (identity === false)
@@ -457,39 +324,17 @@ export async function authorizeTenantControl(req, res, gate, controlPlane, org)
     }
     return identity;
 }
-async function canViewMembers(store, org, identity) {
-    if (identity.superAdmin)
-        return true;
-    return (await store.getOrgMember({ org, subject: identity.subject })) !== undefined;
-}
-export async function canManageMembers(store, org, identity) {
-    if (identity.superAdmin)
-        return true;
-    return (await store.getOrgMember({ org, subject: identity.subject }))?.role === 'owner';
-}
-function publicInvitation(invitation) {
-    return {
-        orgSlug: invitation.orgSlug,
-        email: invitation.email,
-        role: invitation.role,
-        createdAt: invitation.createdAt,
-        expiresAt: invitation.expiresAt,
-        createdBySubject: invitation.createdBySubject,
-        ...(invitation.createdByEmail !== undefined
-            ? { createdByEmail: invitation.createdByEmail }
-            : {}),
-    };
-}
-function invitationAcceptPath(org, token) {
-    return `/v1/orgs/${encodeURIComponent(org)}/invitations/${encodeURIComponent(token)}/accept`;
-}
-export async function handleDeploymentStatus(req, res, registry, gate, controlPlane, tenant, options) {
+export async function handleDeploymentStatus(req, res, registry, gate, controlPlane, tenant, options, url) {
     const identity = await authorizeTenantControl(req, res, gate, controlPlane, tenant.org);
     if (identity === false)
         return;
     try {
         const base = options.publicBaseUrl ?? baseFromRequest(req, options.tls ?? {});
-        const status = await registry.getStatus(tenant, base);
+        const rawVersion = url?.searchParams.get('version') ?? undefined;
+        const serverVersion = rawVersion !== undefined && rawVersion !== ''
+            ? normalizeServerVersion(rawVersion)
+            : undefined;
+        const status = await registry.getStatus(tenant, base, serverVersion);
         if (status === undefined)
             return sendJson(res, 404, { error: 'no active deployment' });
         return sendJson(res, 200, { ok: true, ...status });
@@ -513,7 +358,15 @@ export async function handleAccessUpdate(req, res, registry, gate, controlPlane,
         return sendJson(res, 400, { error: message });
     }
     try {
-        const record = await registry.updateAccess(tenant, parsed.accessMode);
+        const serverVersion = parsed.serverVersion === undefined
+            ? undefined
+            : typeof parsed.serverVersion === 'string'
+                ? normalizeServerVersion(parsed.serverVersion)
+                : undefined;
+        if (parsed.serverVersion !== undefined && serverVersion === undefined) {
+            return sendJson(res, 400, { error: '"serverVersion" must be a version string' });
+        }
+        const record = await registry.updateAccess(tenant, parsed.accessMode, serverVersion);
         if (record === undefined)
             return sendJson(res, 404, { error: 'no active deployment' });
         return sendJson(res, 200, {
@@ -521,6 +374,7 @@ export async function handleAccessUpdate(req, res, registry, gate, controlPlane,
             target: tenant,
             deployment: {
                 deploymentId: record.deploymentId,
+                ...(record.serverVersion !== undefined ? { serverVersion: record.serverVersion } : {}),
                 accessMode: record.accessMode ?? 'owner-only',
             },
         });
@@ -529,89 +383,6 @@ export async function handleAccessUpdate(req, res, registry, gate, controlPlane,
         return sendJson(res, 400, { error: error.message });
     }
 }
-export async function handleDeployments(req, res, registry, gate, controlPlane, ref, url) {
-    const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
-    if (identity === false)
-        return;
-    if (!identity.superAdmin) {
-        const member = await controlPlane.isOrgMember({ org: ref.org, subject: identity.subject });
-        if (!member)
-            return sendForbidden(res, 'forbidden');
-    }
-    const app = url.searchParams.get('app') ?? undefined;
-    const env = url.searchParams.get('env') ?? undefined;
-    try {
-        const deployments = await registry.listDeployments({
-            org: ref.org,
-            ...(app !== undefined ? { app } : {}),
-            ...(env !== undefined ? { env } : {}),
-        });
-        return sendJson(res, 200, { ok: true, deployments });
-    }
-    catch (error) {
-        return sendJson(res, 400, { error: error.message });
-    }
-}
-export async function handleAuditEvents(req, res, gate, controlPlane, audit, ref, url) {
-    const identity = await authorizeTenantControl(req, res, gate, controlPlane, ref.org);
-    if (identity === false)
-        return;
-    if (!isAuditStore(audit)) {
-        return sendJson(res, 409, {
-            ok: false,
-            error: 'audit events require an audit store capability',
-        });
-    }
-    const limit = parseAuditLimit(url.searchParams.get('limit'));
-    if (limit === false)
-        return sendJson(res, 400, { error: '"limit" must be an integer from 1 to 100' });
-    try {
-        const app = optionalQuery(url, 'app');
-        const env = optionalQuery(url, 'env');
-        const eventType = optionalQuery(url, 'eventType');
-        const events = await audit.list({
-            org: ref.org,
-            ...(app !== undefined ? { app } : {}),
-            ...(env !== undefined ? { env } : {}),
-            ...(eventType !== undefined ? { eventType } : {}),
-            ...(limit !== undefined ? { limit } : {}),
-        });
-        await audit.emit({
-            eventType: 'audit.events.queried',
-            org: ref.org,
-            ...(app !== undefined ? { app } : {}),
-            ...(env !== undefined ? { env } : {}),
-            decision: 'allow',
-            status: 200,
-            actorSubject: identity.subject,
-            ...(identity.email !== undefined ? { actorEmail: identity.email } : {}),
-            details: {
-                ...(eventType !== undefined ? { eventType } : {}),
-                ...(limit !== undefined ? { limit } : {}),
-                resultCount: events.length,
-            },
-        });
-        return sendJson(res, 200, { ok: true, events });
-    }
-    catch (error) {
-        return sendJson(res, 400, { error: error.message });
-    }
-}
-function isAuditStore(audit) {
-    return 'list' in audit && typeof audit.list === 'function';
-}
-function optionalQuery(url, key) {
-    const value = url.searchParams.get(key);
-    return value === null || value.trim() === '' ? undefined : value;
-}
-function parseAuditLimit(value) {
-    if (value === null || value.trim() === '')
-        return undefined;
-    const parsed = Number(value);
-    if (!Number.isInteger(parsed) || parsed < 1 || parsed > 100)
-        return false;
-    return parsed;
-}
 export async function authorizeControlPlane(req, res, gate, options) {
     const auth = await gate.authorize(req);
     if (!auth.ok) {