@noodleseed/one 0.99.0 → 0.100.0

package/node_modules/@noodle-borg/transport-http/dist/service-principal-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-authorization.d.ts","sourceRoot":"","sources":["../src/service-principal-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EAGpB,MAAM,uBAAuB,CAAC;AAG/B,QAAA,MAAM,+BAA+B,uBAAuB,CAAC;AAC7D,QAAA,MAAM,qCAAqC,4BAA4B,CAAC;AAExE,MAAM,WAAW,4CAA4C;IAC3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,6BAA6B,CAAC;IAC3D,QAAQ,CAAC,SAAS,EAAE,OAAO,+BAA+B,CAAC;IAC3D,QAAQ,CAAC,eAAe,EAAE,OAAO,qCAAqC,CAAC;CACxE;AAED,MAAM,WAAW,kCACf,SAAQ,4CAA4C;IACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,MAAM,+BAA+B,GAAG,CAC5C,WAAW,EAAE,kCAAkC,KAC5C,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B,UAAU,0BAA0B;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE,6BAA6B,CAAC;CAChD;AAED,qGAAqG;AACrG,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,GACvC;IACD,QAAQ,CAAC,YAAY,EAAE,SAAS,4CAA4C,EAAE,CAAC;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,0BAA0B,CAAC;CAC9C,CA4BA;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,0BAA0B,GACjC,IAAI,CAaN"}

package/node_modules/@noodle-borg/transport-http/dist/service-principal-authorization.js

@@ -0,0 +1,51 @@
+import { TOOL_AUTHORIZATION_DENIED, toolRequiresConfirmation, } from '@noodle-borg/protocol';
+import { rpcMethod, rpcTargetName, safeRpcId } from './request-capture.js';
+const SERVICE_CONFIRMATION_RULE_CLASS = 'human_confirmation';
+const SERVICE_CONFIRMATION_RULE_FINGERPRINT = 'service-confirmation:v1';
+/** Deny service principals from entering a confirmation flow that requires a live human decision. */
+export function preflightServicePrincipalToolCall(parsed, target, caller) {
+    if (caller?.identityKind !== 'service')
+        return { observations: [] };
+    const items = Array.isArray(parsed) ? parsed : [parsed];
+    const observations = [];
+    let denial;
+    for (const item of items) {
+        const method = rpcMethod(item);
+        if (method !== 'tools/call')
+            continue;
+        const toolName = rpcTargetName(item, method);
+        if (toolName === undefined)
+            continue;
+        const tool = target.artifact.tools.find((candidate) => candidate.name === toolName);
+        if (tool === undefined)
+            continue;
+        const confirmationRequired = toolRequiresConfirmation(tool);
+        observations.push({
+            toolName,
+            decision: confirmationRequired ? 'deny' : 'allow',
+            reason: confirmationRequired ? 'human_confirmation_required' : 'allowed',
+            ruleClass: SERVICE_CONFIRMATION_RULE_CLASS,
+            ruleFingerprint: SERVICE_CONFIRMATION_RULE_FINGERPRINT,
+        });
+        if (confirmationRequired && denial === undefined) {
+            denial = {
+                requestId: safeRpcId(item).requestId ?? null,
+                reason: 'human_confirmation_required',
+            };
+        }
+    }
+    return { observations, ...(denial === undefined ? {} : { denial }) };
+}
+export function sendServicePrincipalToolDenial(res, denial) {
+    res.writeHead(403, { 'content-type': 'application/json; charset=utf-8' });
+    res.end(JSON.stringify({
+        jsonrpc: '2.0',
+        id: denial.requestId,
+        error: {
+            code: TOOL_AUTHORIZATION_DENIED,
+            message: 'human confirmation required',
+            data: { reason: denial.reason },
+        },
+    }));
+}
+//# sourceMappingURL=service-principal-authorization.js.map

package/node_modules/@noodle-borg/transport-http/dist/service-principal-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-authorization.js","sourceRoot":"","sources":["../src/service-principal-authorization.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAE3E,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAC7D,MAAM,qCAAqC,GAAG,yBAAyB,CAAC;AA4BxE,qGAAqG;AACrG,MAAM,UAAU,iCAAiC,CAC/C,MAAe,EACf,MAAsB,EACtB,MAAwC;IAKxC,IAAI,MAAM,EAAE,YAAY,KAAK,SAAS;QAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,YAAY,GAAmD,EAAE,CAAC;IACxE,IAAI,MAA8C,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,MAAM,KAAK,YAAY;YAAE,SAAS;QACtC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACpF,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAC5D,YAAY,CAAC,IAAI,CAAC;YAChB,QAAQ;YACR,QAAQ,EAAE,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YACjD,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,SAAS;YACxE,SAAS,EAAE,+BAA+B;YAC1C,eAAe,EAAE,qCAAqC;SACvD,CAAC,CAAC;QACH,IAAI,oBAAoB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACjD,MAAM,GAAG;gBACP,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI;gBAC5C,MAAM,EAAE,6BAA6B;aACtC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,GAAmB,EACnB,MAAkC;IAElC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;IAC1E,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,MAAM,CAAC,SAAS;QACpB,KAAK,EAAE;YACL,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,6BAA6B;YACtC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;SAChC;KACF,CAAC,CACH,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.99.0",
+  "version": "0.100.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",