@noodleseed/one 0.86.0 → 0.87.0

package/node_modules/@noodle-borg/transport-http/dist/identity-authorization.js

@@ -0,0 +1,133 @@
+import { JSON_RPC } from '@noodle-borg/protocol';
+import { effectiveProto } from './front-door.js';
+import { header } from './request-capture.js';
+/**
+ * Identity gate (OA-1/OA-3): require a verified token and authorize it against the deployment access mode.
+ * `allow: true` means the request may proceed, with caller and subject fields when available. `allow: false`
+ * means this function already wrote the denial response. Missing tokens and absent verifiers fail closed.
+ */
+export async function authorizeIdentityMode(req, res, auth) {
+    const challenge = protectedResourceMetadataUrl(req, auth);
+    const token = bearerToken(req);
+    if (token === null || auth.verifyOwnerToken === undefined) {
+        sendUnauthorized(res, challenge);
+        return { allow: false };
+    }
+    const identity = await auth.verifyOwnerToken(token, resourceUrl(req, auth));
+    if (identity === null) {
+        sendUnauthorized(res, challenge);
+        return { allow: false };
+    }
+    if (auth.accessMode === 'authenticated') {
+        return { allow: true, caller: identity };
+    }
+    if (auth.accessMode === 'customers') {
+        if (identity.identityKind !== 'customer') {
+            sendUnauthorized(res, challenge);
+            return { allow: false };
+        }
+        return { allow: true, caller: identity };
+    }
+    if (auth.accessMode === 'owner-only') {
+        if (auth.ownerSubject === undefined) {
+            sendUnauthorized(res, challenge);
+            return { allow: false };
+        }
+        if (identity.subject !== auth.ownerSubject) {
+            sendForbidden(res);
+            return { allow: false };
+        }
+        return { allow: true, caller: identity };
+    }
+    if (auth.accessMode === 'org-members') {
+        const membership = auth.org === undefined || auth.authorizeDataPlaneIdentity === undefined
+            ? undefined
+            : await auth.authorizeDataPlaneIdentity({
+                accessMode: auth.accessMode,
+                org: auth.org,
+                subject: identity.subject,
+                ...(identity.email !== undefined ? { email: identity.email } : {}),
+                ...(auth.orgMembershipSources !== undefined
+                    ? { membershipSources: auth.orgMembershipSources }
+                    : {}),
+            });
+        if (membership?.allowed !== true) {
+            sendForbidden(res);
+            return { allow: false };
+        }
+    }
+    return { allow: true, caller: identity };
+}
+export async function authorizeMixedMode(req, res, auth) {
+    const token = bearerToken(req);
+    if (token === null)
+        return { allow: true };
+    const challenge = protectedResourceMetadataUrl(req, auth);
+    if (auth.verifyOwnerToken === undefined) {
+        sendUnauthorized(res, challenge);
+        return { allow: false };
+    }
+    const identity = await auth.verifyOwnerToken(token, resourceUrl(req, auth));
+    if (identity === null) {
+        sendUnauthorized(res, challenge);
+        return { allow: false };
+    }
+    return { allow: true, caller: identity };
+}
+export function isIdentityMode(mode) {
+    return (mode === 'owner-only' ||
+        mode === 'org-members' ||
+        mode === 'authenticated' ||
+        mode === 'customers');
+}
+function bearerToken(req) {
+    const auth = header(req, 'authorization');
+    if (!auth)
+        return null;
+    const match = /^Bearer\s+(.+)$/i.exec(auth);
+    return match?.[1] ?? null;
+}
+/**
+ * A `401` with a bearer challenge and a transport-level JSON-RPC error body. For owner-only endpoints,
+ * `resourceMetadataUrl` is included so an MCP client can discover the authorization server (RFC 9728 /
+ * the MCP authorization spec).
+ */
+function sendUnauthorized(res, resourceMetadataUrl) {
+    const challenge = resourceMetadataUrl !== undefined
+        ? `Bearer realm="noodle", resource_metadata="${resourceMetadataUrl}"`
+        : 'Bearer realm="noodle"';
+    res.writeHead(401, {
+        'content-type': 'application/json; charset=utf-8',
+        'www-authenticate': challenge,
+    });
+    res.end(JSON.stringify(rpcError(JSON_RPC.INVALID_REQUEST, 'unauthorized')));
+}
+/** A `403` with a transport-level JSON-RPC error body (authenticated, but not authorized). */
+function sendForbidden(res) {
+    res.writeHead(403, { 'content-type': 'application/json; charset=utf-8' });
+    res.end(JSON.stringify(rpcError(JSON_RPC.INVALID_REQUEST, 'forbidden')));
+}
+/** The public origin + path for this request, honouring the trusted forwarded-proto when configured. */
+function requestUrl(req, trustProxy) {
+    const proto = effectiveProto(req, trustProxy);
+    const host = header(req, 'host') ?? 'localhost';
+    const pathname = new URL(req.url ?? '/', `${proto}://${host}`).pathname;
+    return { origin: `${proto}://${host}`, pathname };
+}
+/** The canonical resource identifier (the tenant MCP URL) a token must be audience-bound to (RFC 8707). */
+function resourceUrl(req, auth) {
+    if (auth.publicResourceUrl !== undefined)
+        return auth.publicResourceUrl;
+    const { origin, pathname } = requestUrl(req, auth.trustProxy);
+    return `${origin}${pathname}`;
+}
+/** The RFC 9728 protected-resource-metadata URL for this request (well-known prefix before the path). */
+export function protectedResourceMetadataUrl(req, auth) {
+    const resource = new URL(resourceUrl(req, auth));
+    return `${resource.origin}/.well-known/oauth-protected-resource${resource.pathname}`;
+}
+/** A transport-level JSON-RPC error response with no id (per the Streamable HTTP spec). */
+function rpcError(code, message) {
+    return { jsonrpc: '2.0', id: null, error: { code, message } };
+}
+//# sourceMappingURL=identity-authorization.js.map

package/node_modules/@noodle-borg/transport-http/dist/identity-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-authorization.js","sourceRoot":"","sources":["../src/identity-authorization.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,QAAQ,EAA+B,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAuB9C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAoB,EACpB,GAAmB,EACnB,IAAkC;IAElC,MAAM,SAAS,GAAG,4BAA4B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1D,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5E,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QACxC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,WAAW,EAAE,CAAC;QACpC,IAAI,QAAQ,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACzC,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpC,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3C,aAAa,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;QACtC,MAAM,UAAU,GACd,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,0BAA0B,KAAK,SAAS;YACrE,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,IAAI,CAAC,0BAA0B,CAAC;gBACpC,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,IAAI,CAAC,oBAAoB,KAAK,SAAS;oBACzC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,oBAAoB,EAAE;oBAClD,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;QACT,IAAI,UAAU,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YACjC,aAAa,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAoB,EACpB,GAAmB,EACnB,IAAkC;IAElC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,4BAA4B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1D,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxC,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5E,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAA4B;IACzD,OAAO,CACL,IAAI,KAAK,YAAY;QACrB,IAAI,KAAK,aAAa;QACtB,IAAI,KAAK,eAAe;QACxB,IAAI,KAAK,WAAW,CACrB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAoB;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAmB,EAAE,mBAA4B;IACzE,MAAM,SAAS,GACb,mBAAmB,KAAK,SAAS;QAC/B,CAAC,CAAC,6CAA6C,mBAAmB,GAAG;QACrE,CAAC,CAAC,uBAAuB,CAAC;IAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,iCAAiC;QACjD,kBAAkB,EAAE,SAAS;KAC9B,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,8FAA8F;AAC9F,SAAS,aAAa,CAAC,GAAmB;IACxC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;IAC1E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,wGAAwG;AACxG,SAAS,UAAU,CACjB,GAAoB,EACpB,UAAmB;IAEnB,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC;IACxE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,MAAM,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED,2GAA2G;AAC3G,SAAS,WAAW,CAAC,GAAoB,EAAE,IAAkC;IAC3E,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC;IACxE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9D,OAAO,GAAG,MAAM,GAAG,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,4BAA4B,CAC1C,GAAoB,EACpB,IAAkC;IAElC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACjD,OAAO,GAAG,QAAQ,CAAC,MAAM,wCAAwC,QAAQ,CAAC,QAAQ,EAAE,CAAC;AACvF,CAAC;AAED,2FAA2F;AAC3F,SAAS,QAAQ,CACf,IAAY,EACZ,OAAe;IAEf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AAChE,CAAC"}

package/node_modules/@noodle-borg/transport-http/dist/tool-authorization.d.ts

@@ -0,0 +1,25 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type ProtocolRequestContext, type ServedArtifact, type ToolAuthorizationDecision, type ToolAuthorizationRuleClass } from '@noodle-borg/protocol';
+import { type IdentityAuthorizationOptions } from './identity-authorization.js';
+export interface ToolAuthorizationObservation {
+    readonly toolName: string;
+    readonly decision: 'allow' | 'deny';
+    readonly reason: 'allowed' | Exclude<ToolAuthorizationDecision, {
+        allow: true;
+    }>['reason'];
+    readonly ruleClass: ToolAuthorizationRuleClass;
+    readonly ruleFingerprint: string;
+}
+interface ToolAuthorizationDenial {
+    readonly requestId: string | number | null;
+    readonly decision: Exclude<ToolAuthorizationDecision, {
+        allow: true;
+    }>;
+}
+export declare function preflightToolAuthorization(parsed: unknown, target: ServedArtifact, caller: ProtocolRequestContext['caller']): {
+    readonly observations: readonly ToolAuthorizationObservation[];
+    readonly denial?: ToolAuthorizationDenial;
+};
+export declare function sendToolAuthorizationDenial(req: IncomingMessage, res: ServerResponse, auth: IdentityAuthorizationOptions, denial: ToolAuthorizationDenial): void;
+export {};
+//# sourceMappingURL=tool-authorization.d.ts.map

package/node_modules/@noodle-borg/transport-http/dist/tool-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-authorization.d.ts","sourceRoot":"","sources":["../src/tool-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EAEnB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAGhC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,4BAA4B,EAElC,MAAM,6BAA6B,CAAC;AAGrC,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,yBAAyB,EAAE;QAAE,KAAK,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC3F,QAAQ,CAAC,SAAS,EAAE,0BAA0B,CAAC;IAC/C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,yBAAyB,EAAE;QAAE,KAAK,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;CACxE;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,GACvC;IACD,QAAQ,CAAC,YAAY,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,uBAAuB,CAAC;CAC3C,CA8BA;AAED,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,4BAA4B,EAClC,MAAM,EAAE,uBAAuB,GAC9B,IAAI,CAkBN"}

package/node_modules/@noodle-borg/transport-http/dist/tool-authorization.js

@@ -0,0 +1,64 @@
+import { evaluateToolAuthorization, TOOL_AUTHORIZATION_DENIED, toolAuthorizationRuleClass, toolAuthorizationRuleFingerprint, } from '@noodle-borg/protocol';
+import { protectedResourceMetadataUrl, } from './identity-authorization.js';
+import { rpcMethod, rpcTargetName, safeRpcId } from './request-capture.js';
+export function preflightToolAuthorization(parsed, target, caller) {
+    const items = Array.isArray(parsed) ? parsed : [parsed];
+    const observations = [];
+    let denial;
+    for (const item of items) {
+        const method = rpcMethod(item);
+        if (method !== 'tools/call')
+            continue;
+        const toolName = rpcTargetName(item, method);
+        if (toolName === undefined)
+            continue;
+        const tool = target.artifact.tools.find((candidate) => candidate.name === toolName);
+        if (tool === undefined)
+            continue;
+        const decision = evaluateToolAuthorization(tool.authorization, caller);
+        observations.push({
+            toolName,
+            decision: decision.allow ? 'allow' : 'deny',
+            reason: decision.allow ? 'allowed' : decision.reason,
+            ruleClass: toolAuthorizationRuleClass(tool.authorization),
+            ruleFingerprint: toolAuthorizationRuleFingerprint(tool.authorization),
+        });
+        if (!decision.allow && denial === undefined) {
+            denial = {
+                requestId: safeRpcId(item).requestId ?? null,
+                decision,
+            };
+        }
+    }
+    return {
+        observations,
+        ...(denial === undefined ? {} : { denial }),
+    };
+}
+export function sendToolAuthorizationDenial(req, res, auth, denial) {
+    const metadata = protectedResourceMetadataUrl(req, auth);
+    if (denial.decision.reason === 'authentication_required') {
+        res.setHeader('WWW-Authenticate', `Bearer realm="noodle", resource_metadata="${metadata}"`);
+        sendError(res, 401, denial.requestId, 'unauthorized', denial.decision.reason);
+        return;
+    }
+    if (denial.decision.reason === 'insufficient_scope') {
+        res.setHeader('WWW-Authenticate', `Bearer error="insufficient_scope", scope="${denial.decision.requiredScopes.join(' ')}", resource_metadata="${metadata}"`);
+        sendError(res, 403, denial.requestId, 'insufficient scope', denial.decision.reason);
+        return;
+    }
+    sendError(res, 403, denial.requestId, 'forbidden', denial.decision.reason);
+}
+function sendError(res, status, requestId, message, reason) {
+    res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
+    res.end(JSON.stringify({
+        jsonrpc: '2.0',
+        id: requestId,
+        error: {
+            code: TOOL_AUTHORIZATION_DENIED,
+            message,
+            data: { reason },
+        },
+    }));
+}
+//# sourceMappingURL=tool-authorization.js.map

package/node_modules/@noodle-borg/transport-http/dist/tool-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-authorization.js","sourceRoot":"","sources":["../src/tool-authorization.ts"],"names":[],"mappings":"AACA,OAAO,EACL,yBAAyB,EAGzB,yBAAyB,EAGzB,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAe3E,MAAM,UAAU,0BAA0B,CACxC,MAAe,EACf,MAAsB,EACtB,MAAwC;IAKxC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,YAAY,GAAmC,EAAE,CAAC;IACxD,IAAI,MAA2C,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,MAAM,KAAK,YAAY;YAAE,SAAS;QACtC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACpF,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACvE,YAAY,CAAC,IAAI,CAAC;YAChB,QAAQ;YACR,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YAC3C,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;YACpD,SAAS,EAAE,0BAA0B,CAAC,IAAI,CAAC,aAAa,CAAC;YACzD,eAAe,EAAE,gCAAgC,CAAC,IAAI,CAAC,aAAa,CAAC;SACtE,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,GAAG;gBACP,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI;gBAC5C,QAAQ;aACT,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,YAAY;QACZ,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,GAAoB,EACpB,GAAmB,EACnB,IAAkC,EAClC,MAA+B;IAE/B,MAAM,QAAQ,GAAG,4BAA4B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,yBAAyB,EAAE,CAAC;QACzD,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,6CAA6C,QAAQ,GAAG,CAAC,CAAC;QAC5F,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9E,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QACpD,GAAG,CAAC,SAAS,CACX,kBAAkB,EAClB,6CAA6C,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAC9E,GAAG,CACJ,yBAAyB,QAAQ,GAAG,CACtC,CAAC;QACF,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,oBAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,SAAS,CAChB,GAAmB,EACnB,MAAiB,EACjB,SAAiC,EACjC,OAAe,EACf,MAAqE;IAErE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;IAC7E,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,SAAS;QACb,KAAK,EAAE;YACL,IAAI,EAAE,yBAAyB;YAC/B,OAAO;YACP,IAAI,EAAE,EAAE,MAAM,EAAE;SACjB;KACF,CAAC,CACH,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.86.0",
+  "version": "0.87.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",