@noodleseed/one 0.99.1 → 0.101.0

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-credentials.js

@@ -0,0 +1,119 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { importJWK } from 'jose';
+const MAX_PUBLIC_JWK_BYTES = 16 * 1024;
+const PRIVATE_JWK_MEMBERS = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'oth', 'k'];
+/** Generate the one-time 256-bit secret returned by the management API. */
+export function createClientSecret() {
+    return randomBytes(32).toString('base64url');
+}
+/** Hash a high-entropy client secret for durable storage. */
+export function digestClientSecret(secret) {
+    return createHash('sha256').update(secret, 'utf8').digest('base64url');
+}
+/** Compare a presented secret with one canonical SHA-256 digest in constant time. */
+export function secretDigestMatches(secret, expectedDigest) {
+    if (!/^[A-Za-z0-9_-]{43}$/.test(expectedDigest))
+        return false;
+    const expected = Buffer.from(expectedDigest, 'base64url');
+    const actual = Buffer.from(digestClientSecret(secret), 'base64url');
+    return (expected.length === 32 && actual.length === expected.length && timingSafeEqual(actual, expected));
+}
+/** Validate and import-check one public verification JWK before it reaches a store. */
+export async function validatePublicJwk(value, algorithm) {
+    if (algorithm !== 'RS256' && algorithm !== 'ES256') {
+        throw new Error('service-principal JWK algorithm must be RS256 or ES256');
+    }
+    if (!isRecord(value))
+        throw new Error('service-principal public JWK must be an object');
+    const serialized = serializeJwk(value);
+    if (Buffer.byteLength(serialized, 'utf8') > MAX_PUBLIC_JWK_BYTES) {
+        throw new Error('service-principal public JWK must be at most 16 KiB');
+    }
+    for (const member of PRIVATE_JWK_MEMBERS) {
+        if (Object.hasOwn(value, member)) {
+            throw new Error(`service-principal public JWK must not contain private member ${member}`);
+        }
+    }
+    validateCommonJwkMetadata(value, algorithm);
+    if (algorithm === 'RS256')
+        validateRsaJwk(value);
+    else
+        validateEcJwk(value);
+    try {
+        await importJWK(value, algorithm);
+    }
+    catch {
+        throw new Error(`service-principal ${algorithm} public JWK is malformed`);
+    }
+    return Object.freeze({
+        algorithm,
+        publicJwk: Object.freeze(structuredClone(value)),
+    });
+}
+function serializeJwk(value) {
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        throw new Error('service-principal public JWK must be JSON serializable');
+    }
+}
+function validateCommonJwkMetadata(jwk, algorithm) {
+    if (jwk.alg !== undefined && jwk.alg !== algorithm) {
+        throw new Error('service-principal JWK declared algorithm does not match its pinned algorithm');
+    }
+    if (jwk.use !== undefined && jwk.use !== 'sig') {
+        throw new Error('service-principal JWK use must be sig');
+    }
+    if (jwk.key_ops !== undefined &&
+        (!Array.isArray(jwk.key_ops) || jwk.key_ops.length !== 1 || jwk.key_ops[0] !== 'verify')) {
+        throw new Error('service-principal JWK key_ops must contain only verify');
+    }
+    if (jwk.kid !== undefined &&
+        (typeof jwk.kid !== 'string' || jwk.kid.length === 0 || jwk.kid.length > 200)) {
+        throw new Error('service-principal JWK kid must be between 1 and 200 characters');
+    }
+}
+function validateRsaJwk(jwk) {
+    if (jwk.kty !== 'RSA' || typeof jwk.n !== 'string' || typeof jwk.e !== 'string') {
+        throw new Error('RS256 requires an RSA public JWK');
+    }
+    const modulus = decodeCanonicalBase64url(jwk.n, 'RSA modulus');
+    const bits = modulusBitLength(modulus);
+    if (bits < 2048 || bits > 4096) {
+        throw new Error('RS256 RSA modulus must be between 2048 and 4096 bits');
+    }
+    decodeCanonicalBase64url(jwk.e, 'RSA exponent');
+}
+function validateEcJwk(jwk) {
+    if (jwk.kty !== 'EC' ||
+        jwk.crv !== 'P-256' ||
+        typeof jwk.x !== 'string' ||
+        typeof jwk.y !== 'string') {
+        throw new Error('ES256 requires a P-256 EC public JWK');
+    }
+    if (decodeCanonicalBase64url(jwk.x, 'EC x coordinate').length !== 32 ||
+        decodeCanonicalBase64url(jwk.y, 'EC y coordinate').length !== 32) {
+        throw new Error('ES256 requires 256-bit EC coordinates');
+    }
+}
+function decodeCanonicalBase64url(value, label) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value))
+        throw new Error(`${label} must be base64url`);
+    const decoded = Buffer.from(value, 'base64url');
+    if (decoded.length === 0 || decoded.toString('base64url') !== value) {
+        throw new Error(`${label} must be canonical base64url`);
+    }
+    return decoded;
+}
+function modulusBitLength(value) {
+    const firstNonZero = value.findIndex((byte) => byte !== 0);
+    if (firstNonZero === -1)
+        return 0;
+    const first = value[firstNonZero];
+    return (value.length - firstNonZero - 1) * 8 + (32 - Math.clz32(first));
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=service-principal-credentials.js.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-credentials.js","sourceRoot":"","sources":["../../src/oauth/service-principal-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AASjC,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAU,CAAC;AAEnF,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB;IAChC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACzE,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,cAAsB;IACxE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC;IACpE,OAAO,CACL,QAAQ,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CACjG,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAc,EACd,SAAiB;IAEjB,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACxF,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,oBAAoB,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACzC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,gEAAgE,MAAM,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,yBAAyB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,OAAO;QAAE,cAAc,CAAC,KAAK,CAAC,CAAC;;QAC5C,aAAa,CAAC,KAAK,CAAC,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qBAAqB,SAAS,0BAA0B,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS;QACT,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;KACjD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B;IAClD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,GAA4B,EAC5B,SAA2C;IAE3C,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IACE,GAAG,CAAC,OAAO,KAAK,SAAS;QACzB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,EACxF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IACE,GAAG,CAAC,GAAG,KAAK,SAAS;QACrB,CAAC,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,EAC7E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B;IAClD,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,wBAAwB,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B;IACjD,IACE,GAAG,CAAC,GAAG,KAAK,IAAI;QAChB,GAAG,CAAC,GAAG,KAAK,OAAO;QACnB,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;QACzB,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,EACzB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,IACE,wBAAwB,CAAC,GAAG,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,MAAM,KAAK,EAAE;QAChE,wBAAwB,CAAC,GAAG,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,MAAM,KAAK,EAAE,EAChE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa,EAAE,KAAa;IAC5D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;IAC3D,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAW,CAAC;IAC5C,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-guard.d.ts

@@ -0,0 +1,16 @@
+import type { TokenVerifier, VerifiedTokenEnvelope } from '@noodle-borg/auth';
+import type { OwnerTokenVerification, OwnerTokenVerifier } from '@noodle-borg/module';
+import type { ServicePrincipalStore } from './service-principal-store.js';
+export interface ResolvedServicePrincipalTarget {
+    readonly org: string;
+    readonly app: string;
+    readonly environment: string;
+}
+type ServiceCapableTokenVerifier = (token: string, resource: string) => Promise<VerifiedTokenEnvelope | OwnerTokenVerification | null>;
+/**
+ * Revalidate the private principal/grant/credential binding for every machine-authenticated data-plane
+ * request. The private binding is consumed here and never projected into the protocol caller context.
+ */
+export declare function guardServicePrincipalAccessTokenVerifier(verifier: TokenVerifier | ServiceCapableTokenVerifier, store: ServicePrincipalStore | undefined, resolveResource: (resource: string) => Promise<ResolvedServicePrincipalTarget | undefined>, now?: () => number): OwnerTokenVerifier;
+export {};
+//# sourceMappingURL=service-principal-guard.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-guard.d.ts","sourceRoot":"","sources":["../../src/oauth/service-principal-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACtF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAE1E,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,KAAK,2BAA2B,GAAG,CACjC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,qBAAqB,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;AAEpE;;;GAGG;AACH,wBAAgB,wCAAwC,CACtD,QAAQ,EAAE,aAAa,GAAG,2BAA2B,EACrD,KAAK,EAAE,qBAAqB,GAAG,SAAS,EACxC,eAAe,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,8BAA8B,GAAG,SAAS,CAAC,EAC1F,GAAG,GAAE,MAAM,MAAiB,GAC3B,kBAAkB,CAyBpB"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-guard.js

@@ -0,0 +1,34 @@
+/**
+ * Revalidate the private principal/grant/credential binding for every machine-authenticated data-plane
+ * request. The private binding is consumed here and never projected into the protocol caller context.
+ */
+export function guardServicePrincipalAccessTokenVerifier(verifier, store, resolveResource, now = Date.now) {
+    return async (token, resource) => {
+        const verification = await verifier(token, resource);
+        if (verification === null || verification.caller.identityKind !== 'service') {
+            return verification;
+        }
+        const binding = 'servicePrincipal' in verification ? verification.servicePrincipal : undefined;
+        if (binding === undefined || store === undefined)
+            return null;
+        try {
+            const target = await resolveResource(resource);
+            if (target === undefined)
+                return null;
+            const valid = await store.validateAccessBinding({
+                principalId: verification.caller.subject,
+                grantId: binding.grantId,
+                credentialId: binding.credentialId,
+                org: target.org,
+                app: target.app,
+                environment: target.environment,
+                now: now(),
+            });
+            return valid ? { caller: verification.caller } : null;
+        }
+        catch {
+            return null;
+        }
+    };
+}
+//# sourceMappingURL=service-principal-guard.js.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-guard.js","sourceRoot":"","sources":["../../src/oauth/service-principal-guard.ts"],"names":[],"mappings":"AAeA;;;GAGG;AACH,MAAM,UAAU,wCAAwC,CACtD,QAAqD,EACrD,KAAwC,EACxC,eAA0F,EAC1F,MAAoB,IAAI,CAAC,GAAG;IAE5B,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QAC/B,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5E,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,MAAM,OAAO,GAAG,kBAAkB,IAAI,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC;gBAC9C,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,OAAO;gBACxC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,GAAG,EAAE,GAAG,EAAE;aACX,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-resource.d.ts

@@ -0,0 +1,14 @@
+import { type TenantRouteRef } from '@noodle-borg/module';
+import type { ServerRegistry } from '../registry.js';
+export interface ServicePrincipalResourceRouting {
+    readonly legacyOrigin: string;
+    readonly allowedBaseDomains: readonly string[];
+}
+export interface ResolvedServicePrincipalResource {
+    readonly resource: string;
+    readonly tenant: TenantRouteRef;
+    readonly deploymentId?: string;
+}
+/** Resolve only a byte-exact canonical MCP resource that is actively served right now. */
+export declare function resolveServicePrincipalResource(resource: string, registry: ServerRegistry, routing: ServicePrincipalResourceRouting): Promise<ResolvedServicePrincipalResource | undefined>;
+//# sourceMappingURL=service-principal-resource.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-resource.d.ts","sourceRoot":"","sources":["../../src/oauth/service-principal-resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGrD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,0FAA0F;AAC1F,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,gCAAgC,GAAG,SAAS,CAAC,CAavD"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-resource.js

@@ -0,0 +1,53 @@
+import { formatTenantMcpUrl, parseLegacyTenantMcpPath, parsePublicTenantMcpUrl, } from '@noodle-borg/module';
+import { tenantMcpUrl } from '../registry-helpers.js';
+/** Resolve only a byte-exact canonical MCP resource that is actively served right now. */
+export async function resolveServicePrincipalResource(resource, registry, routing) {
+    const tenant = exactTenant(resource, routing);
+    if (tenant === undefined)
+        return undefined;
+    const target = tenant.serverVersion === undefined
+        ? await registry.getActiveByTenant(tenant)
+        : await registry.getActiveByTenantVersion(tenant, tenant.serverVersion);
+    if (target === undefined)
+        return undefined;
+    return {
+        resource,
+        tenant,
+        ...(target.deploymentId === undefined ? {} : { deploymentId: target.deploymentId }),
+    };
+}
+function exactTenant(resource, routing) {
+    let url;
+    try {
+        url = new URL(resource);
+    }
+    catch {
+        return undefined;
+    }
+    if (url.search !== '' || url.hash !== '')
+        return undefined;
+    const publicTenant = parsePublicTenantMcpUrl(resource, routing.allowedBaseDomains);
+    if (publicTenant !== undefined) {
+        const exact = routing.allowedBaseDomains.some((baseDomain) => formatTenantMcpUrl(baseDomain, publicTenant) === resource);
+        return exact ? publicTenant : undefined;
+    }
+    let legacyOrigin;
+    try {
+        legacyOrigin = new URL(routing.legacyOrigin);
+    }
+    catch {
+        return undefined;
+    }
+    if (legacyOrigin.pathname !== '/' ||
+        legacyOrigin.search !== '' ||
+        legacyOrigin.hash !== '' ||
+        url.origin !== legacyOrigin.origin) {
+        return undefined;
+    }
+    const legacyTenant = parseLegacyTenantMcpPath(url.pathname);
+    if (legacyTenant === undefined)
+        return undefined;
+    const canonical = tenantMcpUrl(legacyOrigin.origin, legacyTenant, legacyTenant.serverVersion);
+    return canonical === resource ? legacyTenant : undefined;
+}
+//# sourceMappingURL=service-principal-resource.js.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-resource.js","sourceRoot":"","sources":["../../src/oauth/service-principal-resource.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAatD,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,QAAgB,EAChB,QAAwB,EACxB,OAAwC;IAExC,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,MAAM,GACV,MAAM,CAAC,aAAa,KAAK,SAAS;QAChC,CAAC,CAAC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC;QAC1C,CAAC,CAAC,MAAM,QAAQ,CAAC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC5E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO;QACL,QAAQ;QACR,MAAM;QACN,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;KACpF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,QAAgB,EAChB,OAAwC;IAExC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAE3D,MAAM,YAAY,GAAG,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACnF,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAC3C,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,YAAY,CAAC,KAAK,QAAQ,CAC1E,CAAC;QACF,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,CAAC;IAED,IAAI,YAAiB,CAAC;IACtB,IAAI,CAAC;QACH,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,YAAY,CAAC,QAAQ,KAAK,GAAG;QAC7B,YAAY,CAAC,MAAM,KAAK,EAAE;QAC1B,YAAY,CAAC,IAAI,KAAK,EAAE;QACxB,GAAG,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAClC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,YAAY,GAAG,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,CAAC,aAAa,CAAC,CAAC;IAC9F,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-store-postgres-schema.d.ts

@@ -0,0 +1,4 @@
+import type { Pool } from 'pg';
+/** Additively installs the durable service-principal and assertion-replay tables. */
+export declare function ensureServicePrincipalSchema(pool: Pool): Promise<void>;
+//# sourceMappingURL=service-principal-store-postgres-schema.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-store-postgres-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-store-postgres-schema.d.ts","sourceRoot":"","sources":["../../src/oauth/service-principal-store-postgres-schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B,qFAAqF;AACrF,wBAAsB,4BAA4B,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CA+F5E"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-store-postgres-schema.js

@@ -0,0 +1,98 @@
+/** Additively installs the durable service-principal and assertion-replay tables. */
+export async function ensureServicePrincipalSchema(pool) {
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS oauth_service_principals (
+      principal_id       text PRIMARY KEY
+        CHECK (principal_id ~ '^spn_[0-9a-f-]{36}$'),
+      org_slug           text NOT NULL,
+      name               text NOT NULL CHECK (char_length(name) BETWEEN 1 AND 80),
+      status             text NOT NULL CHECK (status IN ('active', 'revoked')),
+      created_by_subject text NOT NULL,
+      created_at         timestamptz NOT NULL,
+      updated_at         timestamptz NOT NULL,
+      revoked_at         timestamptz,
+      revoked_by_subject text,
+      UNIQUE (principal_id, org_slug)
+    )
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS oauth_service_principal_grants (
+      grant_id           text PRIMARY KEY
+        CHECK (grant_id ~ '^spg_[0-9a-f-]{36}$'),
+      principal_id       text NOT NULL,
+      org_slug           text NOT NULL,
+      app_slug           text NOT NULL,
+      environment        text NOT NULL,
+      scopes             text[] NOT NULL CHECK (cardinality(scopes) <= 64),
+      status             text NOT NULL CHECK (status IN ('active', 'revoked')),
+      created_by_subject text NOT NULL,
+      created_at         timestamptz NOT NULL,
+      updated_at         timestamptz NOT NULL,
+      revoked_at         timestamptz,
+      revoked_by_subject text,
+      FOREIGN KEY (principal_id, org_slug)
+        REFERENCES oauth_service_principals (principal_id, org_slug)
+        ON DELETE RESTRICT
+    )
+  `);
+    await pool.query(`
+    CREATE UNIQUE INDEX IF NOT EXISTS oauth_service_principal_active_grant_target_uq
+      ON oauth_service_principal_grants (principal_id, app_slug, environment)
+      WHERE status = 'active'
+  `);
+    await pool.query(`
+    CREATE INDEX IF NOT EXISTS oauth_service_principal_grants_lookup_idx
+      ON oauth_service_principal_grants (principal_id, status)
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS oauth_service_principal_credentials (
+      credential_id      text PRIMARY KEY
+        CHECK (credential_id ~ '^spc_[0-9a-f-]{36}$'),
+      principal_id       text NOT NULL,
+      org_slug           text NOT NULL,
+      kind               text NOT NULL CHECK (kind IN ('public_jwk', 'client_secret')),
+      label              text NOT NULL CHECK (char_length(label) BETWEEN 1 AND 80),
+      algorithm          text CHECK (algorithm IN ('RS256', 'ES256')),
+      kid                text CHECK (kid IS NULL OR char_length(kid) BETWEEN 1 AND 200),
+      public_jwk         jsonb,
+      secret_digest      text,
+      status             text NOT NULL CHECK (status IN ('active', 'revoked')),
+      created_by_subject text NOT NULL,
+      created_at         timestamptz NOT NULL,
+      updated_at         timestamptz NOT NULL,
+      expires_at         timestamptz,
+      revoked_at         timestamptz,
+      revoked_by_subject text,
+      FOREIGN KEY (principal_id, org_slug)
+        REFERENCES oauth_service_principals (principal_id, org_slug)
+        ON DELETE RESTRICT,
+      CHECK (
+        (kind = 'public_jwk' AND algorithm IS NOT NULL AND public_jwk IS NOT NULL
+          AND secret_digest IS NULL)
+        OR
+        (kind = 'client_secret' AND algorithm IS NULL AND kid IS NULL
+          AND public_jwk IS NULL AND secret_digest IS NOT NULL)
+      )
+    )
+  `);
+    await pool.query(`
+    CREATE INDEX IF NOT EXISTS oauth_service_principal_active_credentials_idx
+      ON oauth_service_principal_credentials (principal_id, kind, expires_at)
+      WHERE status = 'active'
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS oauth_client_assertion_nonces (
+      credential_id text NOT NULL
+        REFERENCES oauth_service_principal_credentials (credential_id) ON DELETE CASCADE,
+      jti           text NOT NULL CHECK (char_length(jti) BETWEEN 1 AND 200),
+      expires_at    timestamptz NOT NULL,
+      created_at    timestamptz NOT NULL,
+      PRIMARY KEY (credential_id, jti)
+    )
+  `);
+    await pool.query(`
+    CREATE INDEX IF NOT EXISTS oauth_client_assertion_nonces_expiry_idx
+      ON oauth_client_assertion_nonces (expires_at)
+  `);
+}
+//# sourceMappingURL=service-principal-store-postgres-schema.js.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-store-postgres-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-store-postgres-schema.js","sourceRoot":"","sources":["../../src/oauth/service-principal-store-postgres-schema.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,IAAU;IAC3D,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;GAchB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;GAmBhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;GAIhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;GAGhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;GAIhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;GAShB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;GAGhB,CAAC,CAAC;AACL,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-store-postgres.d.ts

@@ -0,0 +1,22 @@
+import type { Pool } from 'pg';
+import { type ActiveServicePrincipalClient, type AssertionJtiInput, type CreateServicePrincipalGrantInput, type CreateServicePrincipalInput, type CreateStoredCredentialInput, type CredentialMutation, type GrantMutation, type PrincipalMutation, type PrincipalRef, type ServicePrincipalAccessBinding, type ServicePrincipalCredentialRecord, type ServicePrincipalGrantRecord, type ServicePrincipalRecord, type ServicePrincipalStore, type ServicePrincipalView } from './service-principal-store.js';
+/** Durable, organization-isolated service-principal lifecycle and assertion replay store. */
+export declare class PostgresServicePrincipalStore implements ServicePrincipalStore {
+    #private;
+    constructor(pool: Pool, options?: {
+        readonly now?: () => Date;
+    });
+    ensureSchema(): Promise<void>;
+    createPrincipal(input: CreateServicePrincipalInput): Promise<ServicePrincipalRecord>;
+    listPrincipals(org: string): Promise<readonly ServicePrincipalRecord[]>;
+    getPrincipal(input: PrincipalRef): Promise<ServicePrincipalView | undefined>;
+    revokePrincipal(input: PrincipalMutation): Promise<boolean>;
+    createGrant(input: CreateServicePrincipalGrantInput): Promise<ServicePrincipalGrantRecord>;
+    revokeGrant(input: GrantMutation): Promise<boolean>;
+    createCredential(input: CreateStoredCredentialInput): Promise<ServicePrincipalCredentialRecord>;
+    revokeCredential(input: CredentialMutation): Promise<boolean>;
+    loadActiveClient(clientId: string, now: number): Promise<ActiveServicePrincipalClient | undefined>;
+    validateAccessBinding(input: ServicePrincipalAccessBinding): Promise<boolean>;
+    consumeAssertionJti(input: AssertionJtiInput): Promise<boolean>;
+}
+//# sourceMappingURL=service-principal-store-postgres.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-store-postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-store-postgres.d.ts","sourceRoot":"","sources":["../../src/oauth/service-principal-store-postgres.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAC;AAG3C,OAAO,EACL,KAAK,4BAA4B,EAEjC,KAAK,iBAAiB,EACtB,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EAEvB,KAAK,aAAa,EAGlB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAEjB,KAAK,6BAA6B,EAClC,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EAK1B,MAAM,8BAA8B,CAAC;AAgDtC,6FAA6F;AAC7F,qBAAa,6BAA8B,YAAW,qBAAqB;;gBAI7D,IAAI,EAAE,IAAI,EAAE,OAAO,GAAE;QAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;KAAO;IAK7D,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B,eAAe,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAkBpF,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,sBAAsB,EAAE,CAAC;IAUvE,YAAY,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IA4B5E,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAgB3D,WAAW,CAAC,KAAK,EAAE,gCAAgC,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAyC1F,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBnD,gBAAgB,CACpB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,gCAAgC,CAAC;IA0DtC,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAoB7D,gBAAgB,CACpB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,4BAA4B,GAAG,SAAS,CAAC;IA0C9C,qBAAqB,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,OAAO,CAAC;IA0B7E,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;CAqCtE"}