@noodleseed/one 0.95.2 → 0.96.0

package/node_modules/@noodle-borg/transport-http/dist/routing.d.ts

@@ -0,0 +1,28 @@
+import type { IncomingMessage } from 'node:http';
+import type { TenantRouteRef } from '@noodle-borg/module';
+export interface PublicTenantRouting {
+    readonly allowedBaseDomains: readonly string[];
+    readonly edgeToken: string;
+}
+export type ParsedRoute = {
+    readonly kind: 'tenant';
+    readonly ref: TenantRouteRef;
+    readonly logId: string;
+    readonly publicResourceUrl?: string;
+} | {
+    readonly kind: 'deployment';
+    readonly deploymentId: string;
+    readonly logId: string;
+};
+export type RouteResolution = {
+    readonly ok: true;
+    readonly route: ParsedRoute | null;
+} | {
+    readonly ok: false;
+    readonly status: 403;
+};
+export declare function resolveRoute(req: IncomingMessage, pathname: string, publicTenantRouting: PublicTenantRouting | undefined): RouteResolution;
+export declare function parseRoute(pathname: string): ParsedRoute | null;
+export declare function tenantLogId(ref: TenantRouteRef): string;
+export declare function safeDecode(value: string): string | null;
+//# sourceMappingURL=routing.d.ts.map

package/node_modules/@noodle-borg/transport-http/dist/routing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../src/routing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAO1D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,WAAW,GACnB;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAEjD,wBAAgB,YAAY,CAC1B,GAAG,EAAE,eAAe,EACpB,QAAQ,EAAE,MAAM,EAChB,mBAAmB,EAAE,mBAAmB,GAAG,SAAS,GACnD,eAAe,CAsBjB;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAY/D;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAEvD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMvD"}

package/node_modules/@noodle-borg/transport-http/dist/routing.js

@@ -0,0 +1,52 @@
+import { parseLegacyTenantMcpPath, parsePublicTenantMcpUrl } from '@noodle-borg/module';
+import { canonicalPublicResourceUrl, edgeTokenMatches } from './public-routing.js';
+import { header } from './request-capture.js';
+const SERVER_PATH = /^\/([^/]+)\/mcp$/;
+export function resolveRoute(req, pathname, publicTenantRouting) {
+    const forwardedHost = header(req, 'x-app-host');
+    if (forwardedHost !== undefined) {
+        if (publicTenantRouting === undefined ||
+            !edgeTokenMatches(header(req, 'x-noodle-edge-token'), publicTenantRouting.edgeToken)) {
+            return { ok: false, status: 403 };
+        }
+        const ref = parsePublicTenantMcpUrl(forwardedHost, publicTenantRouting.allowedBaseDomains);
+        if (ref === undefined)
+            return { ok: true, route: null };
+        return {
+            ok: true,
+            route: {
+                kind: 'tenant',
+                ref,
+                logId: tenantLogId(ref),
+                publicResourceUrl: canonicalPublicResourceUrl(forwardedHost),
+            },
+        };
+    }
+    return { ok: true, route: parseRoute(pathname) };
+}
+export function parseRoute(pathname) {
+    const tenant = parseLegacyTenantMcpPath(pathname);
+    if (tenant !== undefined) {
+        return { kind: 'tenant', ref: tenant, logId: tenantLogId(tenant) };
+    }
+    const deployment = SERVER_PATH.exec(pathname);
+    if (deployment) {
+        const deploymentId = safeDecode(deployment[1]);
+        if (deploymentId === null)
+            return null;
+        return { kind: 'deployment', deploymentId, logId: deploymentId };
+    }
+    return null;
+}
+export function tenantLogId(ref) {
+    return `${ref.org}/${ref.app}/${ref.env}${ref.serverVersion !== undefined ? `@${ref.serverVersion}` : ''}`;
+}
+export function safeDecode(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=routing.js.map

package/node_modules/@noodle-borg/transport-http/dist/routing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routing.js","sourceRoot":"","sources":["../src/routing.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAoBvC,MAAM,UAAU,YAAY,CAC1B,GAAoB,EACpB,QAAgB,EAChB,mBAAoD;IAEpD,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAChD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,IACE,mBAAmB,KAAK,SAAS;YACjC,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,EAAE,qBAAqB,CAAC,EAAE,mBAAmB,CAAC,SAAS,CAAC,EACpF,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACpC,CAAC;QACD,MAAM,GAAG,GAAG,uBAAuB,CAAC,aAAa,EAAE,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;QAC3F,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,GAAG;gBACH,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC;gBACvB,iBAAiB,EAAE,0BAA0B,CAAC,aAAa,CAAC;aAC7D;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;IACrE,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAW,CAAC,CAAC;QACzD,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAmB;IAC7C,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC7G,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/node_modules/@noodle-borg/transport-http/dist/serve-request.d.ts

@@ -0,0 +1,35 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { AdmissionGate, RequestEventInput, TenantRouteRef } from '@noodle-borg/module';
+import { type ConfirmationNonceLedger, type RequestStateManager, type ServedArtifact } from '@noodle-borg/protocol';
+import type { InvocationContextResolver, McpProtocolMode, OriginPolicy } from './handler.js';
+import { type IdentityAuthorizationOptions } from './identity-authorization.js';
+import type { Logger } from './logging.js';
+import { type HostedToolDispatchHook } from './tool-dispatch.js';
+/** Per-request authentication context for one resolved target. */
+export interface ServeAuth extends IdentityAuthorizationOptions {
+    readonly deploymentId: string | undefined;
+    readonly app: string | undefined;
+    readonly environment: string | undefined;
+    readonly admissionGate: AdmissionGate | undefined;
+    readonly captureRequestEvent: ((event: RequestEventInput) => void) | undefined;
+    readonly resolveInvocationContext: InvocationContextResolver | undefined;
+    readonly beforeToolDispatch: HostedToolDispatchHook | undefined;
+    readonly protocolMode: McpProtocolMode;
+    readonly requestState: RequestStateManager | undefined;
+    readonly confirmationNonceLedger: ConfirmationNonceLedger | undefined;
+    readonly logger: Logger;
+}
+/**
+ * The shared, stateless front-door (origin → method → auth → content-type → accept → body) for one resolved
+ * tenant. After the guards pass, the parsed JSON-RPC body is handed to the SDK transport, which writes
+ * the full response (including `202` for a notification). Path matching is done by the caller.
+ */
+export declare function serveRequest(req: IncomingMessage, res: ServerResponse, target: ServedArtifact, auth: ServeAuth, routeId: string, maxBody: number, allowed: OriginPolicy | undefined, tenant?: TenantRouteRef): Promise<void>;
+export declare function originAllowed(origin: string, allowed: OriginPolicy | undefined): boolean;
+export declare function readBody(req: IncomingMessage, max: number): Promise<{
+    ok: true;
+    text: string;
+} | {
+    ok: false;
+}>;
+//# sourceMappingURL=serve-request.d.ts.map

package/node_modules/@noodle-borg/transport-http/dist/serve-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve-request.d.ts","sourceRoot":"","sources":["../src/serve-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC5F,OAAO,EACL,KAAK,uBAAuB,EAM5B,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,yBAAyB,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC7F,OAAO,EAGL,KAAK,4BAA4B,EAElC,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAI3C,OAAO,EAAE,KAAK,sBAAsB,EAA0B,MAAM,oBAAoB,CAAC;AAGzF,kEAAkE;AAClE,MAAM,WAAW,SAAU,SAAQ,4BAA4B;IAC7D,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,mBAAmB,EAAE,CAAC,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC/E,QAAQ,CAAC,wBAAwB,EAAE,yBAAyB,GAAG,SAAS,CAAC;IACzE,QAAQ,CAAC,kBAAkB,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,uBAAuB,EAAE,uBAAuB,GAAG,SAAS,CAAC;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,YAAY,GAAG,SAAS,EACjC,MAAM,CAAC,EAAE,cAAc,GACtB,OAAO,CAAC,IAAI,CAAC,CAmKf;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,CAGxF;AAED,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,CAUrD"}

package/node_modules/@noodle-borg/transport-http/dist/serve-request.js

@@ -0,0 +1,190 @@
+import { createDualEraMcpHandler, handleStatelessHttp, JSON_RPC, } from '@noodle-borg/protocol';
+import { admissionContexts, requestsInvocationContext } from './admission-context.js';
+import { authorizeIdentityMode, authorizeMixedMode, isIdentityMode, } from './identity-authorization.js';
+import { emitRequestEvent, header } from './request-capture.js';
+import { admissionRpcError, rpcError, sendJson } from './responses.js';
+import { preflightToolAuthorization, sendToolAuthorizationDenial } from './tool-authorization.js';
+import { withHostedToolDispatch } from './tool-dispatch.js';
+import { toWebRequest, writeWebResponse } from './web-bridge.js';
+/**
+ * The shared, stateless front-door (origin → method → auth → content-type → accept → body) for one resolved
+ * tenant. After the guards pass, the parsed JSON-RPC body is handed to the SDK transport, which writes
+ * the full response (including `202` for a notification). Path matching is done by the caller.
+ */
+export async function serveRequest(req, res, target, auth, routeId, maxBody, allowed, tenant) {
+    const startedAt = Date.now();
+    const origin = header(req, 'origin');
+    if (origin !== undefined && !originAllowed(origin, allowed)) {
+        return sendJson(res, 403, rpcError(JSON_RPC.INVALID_REQUEST, 'origin not allowed'));
+    }
+    if (req.method !== 'POST') {
+        // No server-initiated SSE stream this phase: GET/DELETE/other are not allowed.
+        res.setHeader('Allow', 'POST');
+        return sendJson(res, 405, rpcError(JSON_RPC.INVALID_REQUEST, 'method not allowed'));
+    }
+    // Identity auth gate, before reading the body so an unauthenticated caller never has its payload buffered
+    // and the SDK transport is never constructed for it. A missing accessMode is reserved for loopback/local
+    // dev targets and remains open.
+    let protocolContext = {};
+    let subject;
+    if (isIdentityMode(auth.accessMode)) {
+        const authResult = await authorizeIdentityMode(req, res, auth);
+        if (!authResult.allow)
+            return;
+        if (authResult.caller !== undefined) {
+            protocolContext = {
+                caller: authResult.caller,
+                ...(authResult.customerIssuer === undefined
+                    ? {}
+                    : { customerIssuer: authResult.customerIssuer }),
+                ...(authResult.customerRouting === undefined
+                    ? {}
+                    : { customerRouting: authResult.customerRouting }),
+            };
+            subject = authResult.caller.subject;
+            res.setHeader('Cache-Control', 'private, no-store');
+        }
+        else if (authResult.subject !== undefined) {
+            subject = authResult.subject;
+        }
+    }
+    else if (auth.accessMode === 'mixed') {
+        const authResult = await authorizeMixedMode(req, res, auth);
+        if (!authResult.allow)
+            return;
+        if (authResult.caller !== undefined) {
+            protocolContext = {
+                caller: authResult.caller,
+                ...(authResult.customerIssuer === undefined
+                    ? {}
+                    : { customerIssuer: authResult.customerIssuer }),
+                ...(authResult.customerRouting === undefined
+                    ? {}
+                    : { customerRouting: authResult.customerRouting }),
+            };
+            subject = authResult.caller.subject;
+            res.setHeader('Cache-Control', 'private, no-store');
+        }
+    }
+    const body = await readBody(req, maxBody);
+    if (!body.ok)
+        return sendJson(res, 413, rpcError(JSON_RPC.INVALID_REQUEST, 'request body too large'));
+    let parsed;
+    try {
+        parsed = JSON.parse(body.text);
+    }
+    catch {
+        return sendJson(res, 400, rpcError(JSON_RPC.PARSE_ERROR, 'invalid JSON'));
+    }
+    const contexts = admissionContexts(parsed, {
+        routeId,
+        ...(subject !== undefined ? { subject } : {}),
+        ...(tenant !== undefined ? tenant : {}),
+        ...(auth.deploymentId !== undefined ? { deploymentId: auth.deploymentId } : {}),
+        ...(auth.accessMode !== undefined ? { accessMode: auth.accessMode } : {}),
+        ...(req.socket.remoteAddress !== undefined ? { remoteAddress: req.socket.remoteAddress } : {}),
+    });
+    for (const context of contexts) {
+        const decision = auth.admissionGate
+            ? await auth.admissionGate(context)
+            : { allow: true };
+        auth.logger.info('mcp.admission', {
+            routeId: context.routeId,
+            method: context.method,
+            category: context.category,
+            ...(context.name !== undefined ? { name: context.name } : {}),
+            ...(context.org !== undefined ? { org: context.org } : {}),
+            ...(context.app !== undefined ? { app: context.app } : {}),
+            ...(context.env !== undefined ? { env: context.env } : {}),
+            ...(context.serverVersion !== undefined ? { serverVersion: context.serverVersion } : {}),
+            ...(context.accessMode !== undefined ? { accessMode: context.accessMode } : {}),
+            decision: decision.allow ? 'allow' : 'deny',
+            ...(decision.reason !== undefined ? { reason: decision.reason } : {}),
+        });
+        if (!decision.allow) {
+            if (decision.retryAfterSeconds !== undefined) {
+                res.setHeader('Retry-After', String(decision.retryAfterSeconds));
+            }
+            return sendJson(res, decision.status ?? 403, admissionRpcError(context, decision));
+        }
+    }
+    const authorization = preflightToolAuthorization(parsed, target, protocolContext.caller);
+    for (const observation of authorization.observations) {
+        auth.logger.info('mcp.tool_authorization', {
+            toolName: observation.toolName,
+            decision: observation.decision,
+            reason: observation.reason,
+            ruleClass: observation.ruleClass,
+            ruleFingerprint: observation.ruleFingerprint,
+        });
+    }
+    if (authorization.denial !== undefined) {
+        sendToolAuthorizationDenial(req, res, auth, authorization.denial);
+        return;
+    }
+    if (auth.resolveInvocationContext !== undefined && requestsInvocationContext(parsed)) {
+        const invocationContext = await auth.resolveInvocationContext({
+            target,
+            ...(protocolContext.caller !== undefined ? { caller: protocolContext.caller } : {}),
+        });
+        if (invocationContext !== undefined) {
+            protocolContext = { ...protocolContext, invocationContext };
+        }
+    }
+    protocolContext = {
+        ...protocolContext,
+        ...(auth.deploymentId !== undefined ? { deploymentId: auth.deploymentId } : {}),
+        ...(auth.requestState !== undefined ? { requestState: auth.requestState } : {}),
+        ...(auth.confirmationNonceLedger !== undefined
+            ? { confirmationNonceLedger: auth.confirmationNonceLedger }
+            : {}),
+    };
+    protocolContext = withHostedToolDispatch(req, parsed, protocolContext, auth);
+    let observed;
+    if (auth.captureRequestEvent !== undefined) {
+        protocolContext = {
+            ...protocolContext,
+            observe: (observation) => {
+                observed = observation;
+            },
+        };
+    }
+    if (auth.protocolMode === 'legacy-only') {
+        await handleStatelessHttp(target, req, res, parsed, protocolContext);
+    }
+    else {
+        const handler = createDualEraMcpHandler(target, protocolContext);
+        try {
+            const response = await handler.fetch(toWebRequest(req, body.text), { parsedBody: parsed });
+            const frontDoorCacheControl = res.getHeader('cache-control');
+            if (frontDoorCacheControl !== undefined) {
+                response.headers.set('cache-control', Array.isArray(frontDoorCacheControl)
+                    ? frontDoorCacheControl.join(', ')
+                    : String(frontDoorCacheControl));
+            }
+            await writeWebResponse(res, response);
+        }
+        finally {
+            await handler.close();
+        }
+    }
+    emitRequestEvent({ req, res, target, auth, tenant, parsed, subject, observed, startedAt });
+}
+export function originAllowed(origin, allowed) {
+    if (allowed === undefined)
+        return true;
+    return typeof allowed === 'function' ? allowed(origin) : allowed.includes(origin);
+}
+export async function readBody(req, max) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const buf = chunk;
+        size += buf.length;
+        if (size > max)
+            return { ok: false };
+        chunks.push(buf);
+    }
+    return { ok: true, text: Buffer.concat(chunks).toString('utf8') };
+}
+//# sourceMappingURL=serve-request.js.map

package/node_modules/@noodle-borg/transport-http/dist/serve-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve-request.js","sourceRoot":"","sources":["../src/serve-request.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,GAKT,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAElB,cAAc,GACf,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAClG,OAAO,EAA+B,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAiBjE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAoB,EACpB,GAAmB,EACnB,MAAsB,EACtB,IAAe,EACf,OAAe,EACf,OAAe,EACf,OAAiC,EACjC,MAAuB;IAEvB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,+EAA+E;QAC/E,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,0GAA0G;IAC1G,yGAAyG;IACzG,gCAAgC;IAChC,IAAI,eAAe,GAA2B,EAAE,CAAC;IACjD,IAAI,OAA2B,CAAC;IAChC,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,KAAK;YAAE,OAAO;QAC9B,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,eAAe,GAAG;gBAChB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,GAAG,CAAC,UAAU,CAAC,cAAc,KAAK,SAAS;oBACzC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC;gBAClD,GAAG,CAAC,UAAU,CAAC,eAAe,KAAK,SAAS;oBAC1C,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,CAAC,eAAe,EAAE,CAAC;aACrD,CAAC;YACF,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QACtD,CAAC;aAAM,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAC/B,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,KAAK;YAAE,OAAO;QAC9B,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,eAAe,GAAG;gBAChB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,GAAG,CAAC,UAAU,CAAC,cAAc,KAAK,SAAS;oBACzC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC;gBAClD,GAAG,CAAC,UAAU,CAAC,eAAe,KAAK,SAAS;oBAC1C,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,CAAC,eAAe,EAAE,CAAC;aACrD,CAAC;YACF,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,EAAE;QACV,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAE1F,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,EAAE;QACzC,OAAO;QACP,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC,CAAC;IACH,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa;YACjC,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;YACnC,CAAC,CAAE,EAAE,KAAK,EAAE,IAAI,EAAY,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE;YAChC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YAC3C,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,QAAQ,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBAC7C,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IACzF,KAAK,MAAM,WAAW,IAAI,aAAa,CAAC,YAAY,EAAE,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACzC,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,eAAe,EAAE,WAAW,CAAC,eAAe;SAC7C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACvC,2BAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,wBAAwB,KAAK,SAAS,IAAI,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC;QACrF,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC;YAC5D,MAAM;YACN,GAAG,CAAC,eAAe,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpF,CAAC,CAAC;QACH,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,eAAe,GAAG,EAAE,GAAG,eAAe,EAAE,iBAAiB,EAAE,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,eAAe,GAAG;QAChB,GAAG,eAAe;QAClB,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,IAAI,CAAC,uBAAuB,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE,uBAAuB,EAAE,IAAI,CAAC,uBAAuB,EAAE;YAC3D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,eAAe,GAAG,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;IAE7E,IAAI,QAAyC,CAAC;IAC9C,IAAI,IAAI,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC3C,eAAe,GAAG;YAChB,GAAG,eAAe;YAClB,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE;gBACvB,QAAQ,GAAG,WAAW,CAAC;YACzB,CAAC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,KAAK,aAAa,EAAE,CAAC;QACxC,MAAM,mBAAmB,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3F,MAAM,qBAAqB,GAAG,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAC7D,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;gBACxC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAClB,eAAe,EACf,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC;oBAClC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;oBAClC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAClC,CAAC;YACJ,CAAC;YACD,MAAM,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACxC,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IACD,gBAAgB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,OAAiC;IAC7E,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAoB,EACpB,GAAW;IAEX,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAe,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC;QACnB,IAAI,IAAI,GAAG,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;AACpE,CAAC"}

package/node_modules/@noodle-borg/transport-http/dist/tool-dispatch.d.ts

@@ -22,6 +22,6 @@ interface HostedToolDispatchTarget {
     readonly deploymentId: string | undefined;
 }
 /** Attach hosted facts only after auth for the runtime's once-per-tool-call usage admission. */
-export declare function withHostedToolDispatch(req: IncomingMessage, context: ProtocolRequestContext, target: HostedToolDispatchTarget): ProtocolRequestContext;
+export declare function withHostedToolDispatch(req: IncomingMessage, parsed: unknown, context: ProtocolRequestContext, target: HostedToolDispatchTarget): ProtocolRequestContext;
 export {};
 //# sourceMappingURL=tool-dispatch.d.ts.map

package/node_modules/@noodle-borg/transport-http/dist/tool-dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-dispatch.d.ts","sourceRoot":"","sources":["../src/tool-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EACV,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACzB,MAAM,uBAAuB,CAAC;AAG/B,MAAM,WAAW,yBAA0B,SAAQ,2BAA2B;IAC5E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChE,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;CACH;AAED,MAAM,MAAM,sBAAsB,GAAG,CACnC,OAAO,EAAE,yBAAyB,KAC/B,UAAU,CAAC,wBAAwB,CAAC,CAAC;AAE1C,UAAU,wBAAwB;IAChC,QAAQ,CAAC,kBAAkB,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,gGAAgG;AAChG,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,sBAAsB,EAC/B,MAAM,EAAE,wBAAwB,GAC/B,sBAAsB,CAuBxB"}
+{"version":3,"file":"tool-dispatch.d.ts","sourceRoot":"","sources":["../src/tool-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EACV,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACzB,MAAM,uBAAuB,CAAC;AAG/B,MAAM,WAAW,yBAA0B,SAAQ,2BAA2B;IAC5E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChE,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;CACH;AAED,MAAM,MAAM,sBAAsB,GAAG,CACnC,OAAO,EAAE,yBAAyB,KAC/B,UAAU,CAAC,wBAAwB,CAAC,CAAC;AAE1C,UAAU,wBAAwB;IAChC,QAAQ,CAAC,kBAAkB,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,gGAAgG;AAChG,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,sBAAsB,EAC/B,MAAM,EAAE,wBAAwB,GAC/B,sBAAsB,CAuBxB"}

package/node_modules/@noodle-borg/transport-http/dist/tool-dispatch.js

@@ -1,6 +1,6 @@
 import { header } from './request-capture.js';
 /** Attach hosted facts only after auth for the runtime's once-per-tool-call usage admission. */
-export function withHostedToolDispatch(req, context, target) {
+export function withHostedToolDispatch(req, parsed, context, target) {
     const hook = target.beforeToolDispatch;
     if (hook === undefined ||
         target.org === undefined ||
@@ -15,16 +15,17 @@ export function withHostedToolDispatch(req, context, target) {
         environment: target.environment,
         deploymentId: target.deploymentId,
         ...(context.caller !== undefined ? { caller: context.caller } : {}),
-        client: dispatchClientContext(req),
+        client: dispatchClientContext(req, parsed),
     };
     return {
         ...context,
         beforeToolDispatch: (dispatch) => hook({ ...dispatchBase, ...dispatch }),
     };
 }
-function dispatchClientContext(req) {
-    const protocolVersion = header(req, 'mcp-protocol-version');
-    const sessionId = header(req, 'mcp-session-id');
+function dispatchClientContext(req, parsed) {
+    const modernVersion = modernProtocolVersion(parsed);
+    const protocolVersion = modernVersion ?? header(req, 'mcp-protocol-version');
+    const sessionId = modernVersion === undefined ? header(req, 'mcp-session-id') : undefined;
     const userAgent = header(req, 'user-agent');
     return {
         ...(protocolVersion !== undefined ? { protocolVersion } : {}),
@@ -32,4 +33,15 @@ function dispatchClientContext(req) {
         ...(userAgent !== undefined ? { userAgent } : {}),
     };
 }
+function modernProtocolVersion(value) {
+    const first = Array.isArray(value) ? value[0] : value;
+    if (!isRecord(first) || !isRecord(first.params) || !isRecord(first.params._meta)) {
+        return undefined;
+    }
+    const version = first.params._meta['io.modelcontextprotocol/protocolVersion'];
+    return typeof version === 'string' ? version : undefined;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
 //# sourceMappingURL=tool-dispatch.js.map

package/node_modules/@noodle-borg/transport-http/dist/tool-dispatch.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-dispatch.js","sourceRoot":"","sources":["../src/tool-dispatch.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AA4B9C,gGAAgG;AAChG,MAAM,UAAU,sBAAsB,CACpC,GAAoB,EACpB,OAA+B,EAC/B,MAAgC;IAEhC,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC;IACvC,IACE,IAAI,KAAK,SAAS;QAClB,MAAM,CAAC,GAAG,KAAK,SAAS;QACxB,MAAM,CAAC,GAAG,KAAK,SAAS;QACxB,MAAM,CAAC,WAAW,KAAK,SAAS;QAChC,MAAM,CAAC,YAAY,KAAK,SAAS,EACjC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,YAAY,GAAG;QACnB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,EAAE,qBAAqB,CAAC,GAAG,CAAC;KACnC,CAAC;IACF,OAAO;QACL,GAAG,OAAO;QACV,kBAAkB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAoB;IACjD,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC5C,OAAO;QACL,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"tool-dispatch.js","sourceRoot":"","sources":["../src/tool-dispatch.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AA4B9C,gGAAgG;AAChG,MAAM,UAAU,sBAAsB,CACpC,GAAoB,EACpB,MAAe,EACf,OAA+B,EAC/B,MAAgC;IAEhC,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC;IACvC,IACE,IAAI,KAAK,SAAS;QAClB,MAAM,CAAC,GAAG,KAAK,SAAS;QACxB,MAAM,CAAC,GAAG,KAAK,SAAS;QACxB,MAAM,CAAC,WAAW,KAAK,SAAS;QAChC,MAAM,CAAC,YAAY,KAAK,SAAS,EACjC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,YAAY,GAAG;QACnB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,EAAE,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC;KAC3C,CAAC;IACF,OAAO;QACL,GAAG,OAAO;QACV,kBAAkB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,GAAoB,EACpB,MAAe;IAEf,MAAM,aAAa,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,aAAa,IAAI,MAAM,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC5C,OAAO;QACL,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACtD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC9E,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/node_modules/@noodle-borg/transport-http/dist/web-bridge.d.ts

@@ -0,0 +1,9 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+/**
+ * Convert one already-admitted Node request to the web-standard request consumed by the MCP handler.
+ * The caller supplies the body it already bounded and parsed at the security front door.
+ */
+export declare function toWebRequest(req: IncomingMessage, bufferedBody?: Uint8Array | string): Request;
+/** Write a web-standard response back to Node without collapsing repeated Set-Cookie fields. */
+export declare function writeWebResponse(res: ServerResponse, response: Response): Promise<void>;
+//# sourceMappingURL=web-bridge.d.ts.map

package/node_modules/@noodle-borg/transport-http/dist/web-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-bridge.d.ts","sourceRoot":"","sources":["../src/web-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAyBjE;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,eAAe,EACpB,YAAY,GAAE,UAAU,GAAG,MAAyB,GACnD,OAAO,CAcT;AAED,gGAAgG;AAChG,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB7F"}

package/node_modules/@noodle-borg/transport-http/dist/web-bridge.js

@@ -0,0 +1,61 @@
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+function firstHeaderValue(value) {
+    const first = Array.isArray(value) ? value[0] : value;
+    return first?.split(',', 1)[0]?.trim();
+}
+function requestOrigin(req) {
+    const protocol = firstHeaderValue(req.headers['x-forwarded-proto']) ?? 'http';
+    const host = firstHeaderValue(req.headers.host) ?? 'localhost';
+    return `${protocol}://${host}`;
+}
+function requestHeaders(req) {
+    const headers = new Headers();
+    for (let index = 0; index < req.rawHeaders.length; index += 2) {
+        const name = req.rawHeaders[index];
+        const value = req.rawHeaders[index + 1];
+        if (name !== undefined && value !== undefined)
+            headers.append(name, value);
+    }
+    return headers;
+}
+/**
+ * Convert one already-admitted Node request to the web-standard request consumed by the MCP handler.
+ * The caller supplies the body it already bounded and parsed at the security front door.
+ */
+export function toWebRequest(req, bufferedBody = new Uint8Array()) {
+    const method = req.method ?? 'GET';
+    const canHaveBody = method !== 'GET' && method !== 'HEAD';
+    const bodyLength = typeof bufferedBody === 'string' ? bufferedBody.length : bufferedBody.byteLength;
+    return new Request(new URL(req.url ?? '/', requestOrigin(req)), {
+        method,
+        headers: requestHeaders(req),
+        ...(canHaveBody && bodyLength > 0
+            ? {
+                body: typeof bufferedBody === 'string' ? bufferedBody : new Uint8Array(bufferedBody),
+            }
+            : {}),
+    });
+}
+/** Write a web-standard response back to Node without collapsing repeated Set-Cookie fields. */
+export async function writeWebResponse(res, response) {
+    if (res.headersSent) {
+        throw new Error('cannot write web response: headers already sent');
+    }
+    res.statusCode = response.status;
+    if (response.statusText !== '')
+        res.statusMessage = response.statusText;
+    const cookies = response.headers.getSetCookie();
+    for (const [name, value] of response.headers) {
+        if (name.toLowerCase() !== 'set-cookie')
+            res.setHeader(name, value);
+    }
+    if (cookies.length > 0)
+        res.setHeader('set-cookie', cookies);
+    if (response.body === null) {
+        res.end();
+        return;
+    }
+    await pipeline(Readable.fromWeb(response.body), res);
+}
+//# sourceMappingURL=web-bridge.js.map

package/node_modules/@noodle-borg/transport-http/dist/web-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-bridge.js","sourceRoot":"","sources":["../src/web-bridge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,SAAS,gBAAgB,CAAC,KAA6C;IACrE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACtD,OAAO,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,aAAa,CAAC,GAAoB;IACzC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,IAAI,MAAM,CAAC;IAC9E,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC;IAC/D,OAAO,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB;IAC1C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAoB,EACpB,eAAoC,IAAI,UAAU,EAAE;IAEpD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACnC,MAAM,WAAW,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;IAC1D,MAAM,UAAU,GACd,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC;IACnF,OAAO,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE;QAC9D,MAAM;QACN,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC;QAC5B,GAAG,CAAC,WAAW,IAAI,UAAU,GAAG,CAAC;YAC/B,CAAC,CAAC;gBACE,IAAI,EAAE,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC;aACrF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;AACL,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAmB,EAAE,QAAkB;IAC5E,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,GAAG,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;IACjC,IAAI,QAAQ,CAAC,UAAU,KAAK,EAAE;QAAE,GAAG,CAAC,aAAa,GAAG,QAAQ,CAAC,UAAU,CAAC;IAExE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,YAAY;YAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAE7D,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.95.2",
+  "version": "0.96.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",
@@ -70,7 +70,10 @@
     "@jitl/quickjs-wasmfile-debug-sync",
     "@jitl/quickjs-wasmfile-release-asyncify",
     "@jitl/quickjs-wasmfile-release-sync",
+    "@modelcontextprotocol/client",
+    "@modelcontextprotocol/core",
     "@modelcontextprotocol/sdk",
+    "@modelcontextprotocol/server",
     "@noodle-borg/agent-kit",
     "@noodle-borg/auth",
     "@noodle-borg/authoring",
@@ -201,7 +204,8 @@
     "@jitl/quickjs-wasmfile-debug-sync": "0.32.0",
     "@jitl/quickjs-wasmfile-release-asyncify": "0.32.0",
     "@jitl/quickjs-wasmfile-release-sync": "0.32.0",
-    "@modelcontextprotocol/sdk": "1.29.0",
+    "@modelcontextprotocol/client": "2.0.0",
+    "@modelcontextprotocol/server": "2.0.0",
     "@noodle-borg/agent-kit": "0.0.0",
     "@noodle-borg/auth": "0.0.0",
     "@noodle-borg/authoring": "0.0.0",