noodleseed-cli 0.1.4

package/node_modules/@noodle-borg/connector-http/dist/http-connector.js

@@ -0,0 +1,138 @@
+import { createGuardedAgent, needsGuard } from './ssrf.js';
+const DEFAULT_TIMEOUT_MS = 10_000;
+const DEFAULT_MAX_BYTES = 1 << 20;
+/**
+ * A real outbound HTTP connector: it calls a backing JSON API and maps the response to the operation's
+ * output. Supports authenticated `GET`/`POST` across one or more declared hosts.
+ *
+ * **Security posture.** It enforces a static origin allowlist (a request can never resolve to an
+ * undeclared host), a request timeout, and a best-effort size cap, and it only ever sends the
+ * broker-minted credential (never an inbound token, never a manifest secret). For DNS-name hosts it
+ * additionally attaches an undici dispatcher that pins the resolved IP and rejects loopback/private/
+ * link-local/reserved addresses (incl. cloud metadata `169.254.169.254`), defeating DNS rebinding —
+ * the SSRF defenses required by
+ * [ADR 0008](../../../docs/decisions/0008-custom-connector-ssrf-dns-pinning.md) /
+ * [ADR 0026](../../../docs/decisions/0026-ssrf-egress-hardening-lib.md). Literal-IP hosts are allowed
+ * only via the explicit, auditable origin allowlist.
+ */
+export class HttpConnector {
+    id;
+    version;
+    #config;
+    #allowed;
+    #guardedDispatcher;
+    constructor(config) {
+        this.id = config.id;
+        this.version = config.version;
+        this.#config = config;
+        const origins = config.allowedOrigins ?? [config.baseUrl];
+        this.#allowed = new Set(origins.map((o) => new URL(o).origin));
+    }
+    /** Lazily build (and reuse) the SSRF-guarded dispatcher used for DNS-name hosts. */
+    #dispatcher() {
+        this.#guardedDispatcher ??= createGuardedAgent(this.#config.timeoutMs ?? DEFAULT_TIMEOUT_MS, this.#config.lookup);
+        return this.#guardedDispatcher;
+    }
+    signature(operation) {
+        return this.#config.operations[operation]?.signature;
+    }
+    async invoke(call) {
+        const op = this.#config.operations[call.operation];
+        if (!op)
+            throw new Error(`connector "${this.id}" has no operation "${call.operation}"`);
+        const base = op.baseUrl ?? this.#config.baseUrl;
+        const url = this.#buildUrl(op, call.args, base);
+        // Validate the *resolved* origin (never the declared base) so a path that escapes to another host
+        // is still rejected.
+        if (!this.#allowed.has(url.origin)) {
+            throw new Error(`request resolved to a disallowed origin "${url.origin}"`);
+        }
+        const method = op.method ?? 'GET';
+        const payload = method !== 'GET' && op.body !== undefined ? JSON.stringify(op.body(call.args)) : undefined;
+        const headers = {
+            accept: 'application/json',
+            'user-agent': 'noodle-borg/0.0',
+            ...this.#config.headers,
+            ...this.#authHeaders(op, call.credential),
+        };
+        if (payload !== undefined)
+            headers['content-type'] = 'application/json';
+        // For DNS-name hosts, route through the SSRF-guarded dispatcher (pins the resolved IP, rejects
+        // private/reserved ranges). Literal-IP hosts were already vetted by the origin allowlist above.
+        // `dispatcher` is an undici fetch option absent from the global `RequestInit` type, so the cast
+        // carries it at runtime without a type clash between undici and @types/node's bundled undici-types.
+        const init = {
+            method,
+            headers,
+            ...(payload !== undefined ? { body: payload } : {}),
+            signal: AbortSignal.timeout(this.#config.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+        };
+        const response = await fetch(url, needsGuard(url)
+            ? { ...init, dispatcher: this.#dispatcher() }
+            : init);
+        if (!response.ok)
+            throw new Error(`backend responded ${response.status}`);
+        const max = this.#config.maxBytes ?? DEFAULT_MAX_BYTES;
+        const declaredLength = Number(response.headers.get('content-length') ?? '0');
+        if (declaredLength > max)
+            throw new Error('response exceeds the size limit');
+        const text = await readTextWithLimit(response, max);
+        const json = JSON.parse(text);
+        return op.mapResponse ? op.mapResponse(json, call.args) : json;
+    }
+    /**
+     * Resolve auth headers by precedence: operation `auth` → connector `auth` → legacy `authHeader`.
+     * The secret only ever lands in a header value here — never a URL, query, log, or error.
+     */
+    #authHeaders(op, credential) {
+        const scheme = op.auth ?? this.#config.auth;
+        if (scheme) {
+            if (scheme.kind === 'bearer')
+                return { authorization: `Bearer ${credential.token}` };
+            return { [scheme.header.toLowerCase()]: credential.token };
+        }
+        return this.#config.authHeader ? this.#config.authHeader(credential) : {};
+    }
+    /** Build the request URL: substitute `{name}` path params and append `query` args. */
+    #buildUrl(op, args, base) {
+        const path = op.path.replace(/\{(\w+)\}/g, (_match, name) => encodeURIComponent(String(args[name])));
+        const url = new URL(path, base);
+        if (op.query) {
+            for (const name of op.query) {
+                const value = args[name];
+                if (value !== undefined)
+                    url.searchParams.set(name, String(value));
+            }
+        }
+        return url;
+    }
+}
+async function readTextWithLimit(response, max) {
+    if (!response.body)
+        return '';
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > max)
+                throw new Error('response exceeds the size limit');
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const buffer = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        buffer.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return new TextDecoder().decode(buffer);
+}
+//# sourceMappingURL=http-connector.js.map

package/node_modules/@noodle-borg/connector-http/dist/http-connector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-connector.js","sourceRoot":"","sources":["../src/http-connector.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,kBAAkB,EAAkB,UAAU,EAAE,MAAM,WAAW,CAAC;AAiE3E,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,CAAC;AAElC;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,aAAa;IACf,EAAE,CAAS;IACX,OAAO,CAAS;IAChB,OAAO,CAAsB;IAC7B,QAAQ,CAAsB;IACvC,kBAAkB,CAAc;IAEhC,YAAY,MAA2B;QACrC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,oFAAoF;IACpF,WAAW;QACT,IAAI,CAAC,kBAAkB,KAAK,kBAAkB,CAC5C,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,kBAAkB,EAC5C,IAAI,CAAC,OAAO,CAAC,MAAM,CACpB,CAAC;QACF,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED,SAAS,CAAC,SAAiB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAmB;QAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,EAAE,uBAAuB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QAExF,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChD,kGAAkG;QAClG,qBAAqB;QACrB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,4CAA4C,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,IAAI,KAAK,CAAC;QAClC,MAAM,OAAO,GACX,MAAM,KAAK,KAAK,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE7F,MAAM,OAAO,GAA2B;YACtC,MAAM,EAAE,kBAAkB;YAC1B,YAAY,EAAE,iBAAiB;YAC/B,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO;YACvB,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC;SAC1C,CAAC;QACF,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAExE,+FAA+F;QAC/F,gGAAgG;QAChG,gGAAgG;QAChG,oGAAoG;QACpG,MAAM,IAAI,GAAgB;YACxB,MAAM;YACN,OAAO;YACP,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;SAC1E,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,EACH,UAAU,CAAC,GAAG,CAAC;YACb,CAAC,CAAE,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,EAA6B;YACzE,CAAC,CAAC,IAAI,CACT,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAE1E,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC;QACvD,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;QAC7E,IAAI,cAAc,GAAG,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAE7E,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACpD,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,EAAiB,EAAE,UAAgC;QAC9D,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,aAAa,EAAE,UAAU,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;YACrF,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,CAAC;IAED,sFAAsF;IACtF,SAAS,CAAC,EAAiB,EAAE,IAAuC,EAAE,IAAY;QAChF,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE,CAClE,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CACvC,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzB,IAAI,KAAK,KAAK,SAAS;oBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,KAAK,UAAU,iBAAiB,CAAC,QAAkB,EAAE,GAAW;IAC9D,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAE9B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;YACzB,IAAI,IAAI,GAAG,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACnE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC"}

package/node_modules/@noodle-borg/connector-http/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { type HttpAuthScheme, HttpConnector, type HttpConnectorConfig, type HttpOperation, } from './http-connector.js';
+export { createGuardedAgent, type DnsLookup, isPublicUnicast, needsGuard, pinnedLookup, } from './ssrf.js';
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/connector-http/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,cAAc,EACnB,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,EAClB,KAAK,SAAS,EACd,eAAe,EACf,UAAU,EACV,YAAY,GACb,MAAM,WAAW,CAAC"}

package/node_modules/@noodle-borg/connector-http/dist/index.js

@@ -0,0 +1,3 @@
+export { HttpConnector, } from './http-connector.js';
+export { createGuardedAgent, isPublicUnicast, needsGuard, pinnedLookup, } from './ssrf.js';
+//# sourceMappingURL=index.js.map

package/node_modules/@noodle-borg/connector-http/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,aAAa,GAGd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,EAElB,eAAe,EACf,UAAU,EACV,YAAY,GACb,MAAM,WAAW,CAAC"}

package/node_modules/@noodle-borg/connector-http/dist/ssrf.d.ts

@@ -0,0 +1,45 @@
+import { Agent } from 'undici';
+/**
+ * SSRF egress guard for outbound connector traffic
+ * ([ADR 0008](../../../docs/decisions/0008-custom-connector-ssrf-dns-pinning.md),
+ * [ADR 0026](../../../docs/decisions/0026-ssrf-egress-hardening-lib.md)).
+ *
+ * Native `fetch` (undici) exposes no hook to validate the resolved IP before connecting, so we attach a
+ * custom undici `Agent` whose DNS `lookup` rejects any address that is not a **public unicast** address.
+ * Because the same lookup that validates is the one undici connects to (and TLS SNI stays the original
+ * hostname), this defeats DNS rebinding to loopback/private/link-local/reserved ranges — including the
+ * cloud-metadata address `169.254.169.254`.
+ *
+ * Literal-IP hosts are intentionally **not** guarded here: they carry no DNS step (no rebinding window)
+ * and are already vetted by the connector's static origin allowlist (ADR 0008 layer 1) — an explicit,
+ * auditable operator declaration.
+ *
+ * NOTE (spec drift vs ADR 0026): the ADR named `request-filtering-agent`, but that ships an
+ * `http(s).Agent` which native `fetch`/undici ignores. The fetch-compatible mechanism is an undici
+ * `Agent` with a custom `lookup`; `ipaddr.js` still does the address classification. ADR 0026 records
+ * this correction.
+ */
+interface ResolvedAddress {
+    readonly address: string;
+    readonly family: number;
+}
+type LookupCallback = (err: NodeJS.ErrnoException | null, address?: string | readonly ResolvedAddress[], family?: number) => void;
+/** A `dns.lookup`-compatible function (loosened so it is trivially injectable for tests). */
+export type DnsLookup = (hostname: string, options: Record<string, unknown>, callback: LookupCallback) => void;
+/**
+ * True for a public unicast address; false for loopback / private / link-local / CGNAT / multicast /
+ * reserved / unspecified / broadcast — and for anything unparseable (fail closed). `ipaddr.process`
+ * normalizes IPv4-mapped IPv6 (`::ffff:a.b.c.d`) to IPv4 so that bypass is covered.
+ */
+export declare function isPublicUnicast(ip: string): boolean;
+/**
+ * Wrap a base resolver so a hostname that resolves **only** to non-public addresses fails closed
+ * (anti-rebinding), and any non-public address is filtered out of the result set.
+ */
+export declare function pinnedLookup(base?: DnsLookup): DnsLookup;
+/** An undici `Agent` that pins+validates DNS resolutions for SSRF protection. */
+export declare function createGuardedAgent(connectTimeoutMs: number, base?: DnsLookup): Agent;
+/** Whether a URL needs the guarded dispatcher: DNS-name hosts yes, literal-IP hosts no. */
+export declare function needsGuard(url: URL): boolean;
+export {};
+//# sourceMappingURL=ssrf.d.ts.map

package/node_modules/@noodle-borg/connector-http/dist/ssrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.d.ts","sourceRoot":"","sources":["../src/ssrf.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAE/B;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,UAAU,eAAe;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,KAAK,cAAc,GAAG,CACpB,GAAG,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,EACjC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,eAAe,EAAE,EAC7C,MAAM,CAAC,EAAE,MAAM,KACZ,IAAI,CAAC;AAEV,6FAA6F;AAC7F,MAAM,MAAM,SAAS,GAAG,CACtB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,QAAQ,EAAE,cAAc,KACrB,IAAI,CAAC;AAIV;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAMnD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,SAAyB,GAAG,SAAS,CAqBvE;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS,GAAG,KAAK,CAIpF;AAED,2FAA2F;AAC3F,wBAAgB,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAI5C"}

package/node_modules/@noodle-borg/connector-http/dist/ssrf.js

@@ -0,0 +1,57 @@
+import { lookup as nodeLookup } from 'node:dns';
+import { isIP } from 'node:net';
+import ipaddr from 'ipaddr.js';
+import { Agent } from 'undici';
+const baseDnsLookup = nodeLookup;
+/**
+ * True for a public unicast address; false for loopback / private / link-local / CGNAT / multicast /
+ * reserved / unspecified / broadcast — and for anything unparseable (fail closed). `ipaddr.process`
+ * normalizes IPv4-mapped IPv6 (`::ffff:a.b.c.d`) to IPv4 so that bypass is covered.
+ */
+export function isPublicUnicast(ip) {
+    try {
+        return ipaddr.process(ip).range() === 'unicast';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Wrap a base resolver so a hostname that resolves **only** to non-public addresses fails closed
+ * (anti-rebinding), and any non-public address is filtered out of the result set.
+ */
+export function pinnedLookup(base = baseDnsLookup) {
+    return (hostname, options, callback) => {
+        base(hostname, { ...options, all: true }, (err, addresses) => {
+            if (err) {
+                callback(err);
+                return;
+            }
+            const all = Array.isArray(addresses) ? addresses : [];
+            const safe = all.filter((a) => isPublicUnicast(a.address));
+            const first = safe[0];
+            if (first === undefined) {
+                callback(new Error(`egress blocked: "${hostname}" resolved only to non-public addresses`));
+                return;
+            }
+            if (options.all === true) {
+                callback(null, safe);
+                return;
+            }
+            callback(null, first.address, first.family);
+        });
+    };
+}
+/** An undici `Agent` that pins+validates DNS resolutions for SSRF protection. */
+export function createGuardedAgent(connectTimeoutMs, base) {
+    const connect = { lookup: pinnedLookup(base), timeout: connectTimeoutMs };
+    // undici's `LookupFunction` typing is stricter than our structural `DnsLookup`; the shapes match.
+    return new Agent({ connect });
+}
+/** Whether a URL needs the guarded dispatcher: DNS-name hosts yes, literal-IP hosts no. */
+export function needsGuard(url) {
+    // `URL.hostname` keeps the brackets on IPv6 literals (e.g. `[::1]`); strip them before classifying.
+    const host = url.hostname.replace(/^\[|\]$/g, '');
+    return isIP(host) === 0;
+}
+//# sourceMappingURL=ssrf.js.map

package/node_modules/@noodle-borg/connector-http/dist/ssrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.js","sourceRoot":"","sources":["../src/ssrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,MAAM,MAAM,WAAW,CAAC;AAC/B,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAyC/B,MAAM,aAAa,GAAG,UAAkC,CAAC;AAEzD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,SAAS,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAkB,aAAa;IAC1D,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACrC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;YAC3D,IAAI,GAAG,EAAE,CAAC;gBACR,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAE,SAAwC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,QAAQ,CAAC,IAAI,KAAK,CAAC,oBAAoB,QAAQ,yCAAyC,CAAC,CAAC,CAAC;gBAC3F,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;gBACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,gBAAwB,EAAE,IAAgB;IAC3E,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC1E,kGAAkG;IAClG,OAAO,IAAI,KAAK,CAAC,EAAE,OAAO,EAA8B,CAAC,CAAC;AAC5D,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,UAAU,CAAC,GAAQ;IACjC,oGAAoG;IACpG,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC"}

package/node_modules/@noodle-borg/connector-http/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@noodle-borg/connector-http",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "dependencies": {
+    "@noodle-borg/compiler": "0.0.0",
+    "@noodle-borg/runtime": "0.0.0",
+    "ipaddr.js": "^2.4.0",
+    "undici": "^6.26.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0"
+  }
+}

package/node_modules/@noodle-borg/protocol/dist/adapter.d.ts

@@ -0,0 +1,73 @@
+import type { RuntimeArtifact } from '@noodle-borg/compiler';
+import type { ExecuteDeps } from '@noodle-borg/runtime';
+import type { JsonRpcErrorObject } from './jsonrpc.js';
+/**
+ * A protocol adapter translates one MCP protocol version's wire shapes to and from the
+ * version-agnostic execution plane. One adapter per supported version; the agreed version is chosen
+ * at `initialize` (see negotiate.ts). The execution plane never sees protocol concerns — adapters
+ * are pure translation. Version-specific behaviour (capability sets, content blocks, RC-only Apps/
+ * Tasks metadata) lives in the adapter, not the core (docs/decisions/0006-protocol-adapter-versioning.md).
+ */
+export interface ProtocolAdapter {
+    /** The MCP protocol version this adapter speaks, e.g. `"2025-11-25"`. */
+    readonly version: string;
+    /** Whether this version is stable or a not-yet-final release candidate. */
+    readonly status: 'stable' | 'rc';
+    initializeResult(artifact: RuntimeArtifact, params: InitializeParams): InitializeResult;
+    listTools(artifact: RuntimeArtifact): ToolsListResult;
+    callTool(artifact: RuntimeArtifact, params: ToolsCallParams, deps: ExecuteDeps): Promise<CallToolOutcome>;
+}
+/** A `tools/call` either yields a tool result (possibly `isError`) or a JSON-RPC protocol error. */
+export type CallToolOutcome = {
+    readonly result: ToolsCallResult;
+} | {
+    readonly error: JsonRpcErrorObject;
+};
+export interface InitializeParams {
+    readonly protocolVersion?: string;
+    readonly capabilities?: unknown;
+    readonly clientInfo?: unknown;
+}
+/** Server capabilities advertised at initialize. Phase 1 advertises only `tools`. */
+export interface ServerCapabilities {
+    readonly tools?: {
+        readonly listChanged?: boolean;
+    };
+}
+export interface ServerInfo {
+    readonly name: string;
+    readonly title?: string;
+    readonly version: string;
+}
+export interface InitializeResult {
+    readonly protocolVersion: string;
+    readonly capabilities: ServerCapabilities;
+    readonly serverInfo: ServerInfo;
+    readonly instructions?: string;
+}
+export interface ToolDescriptor {
+    readonly name: string;
+    readonly title?: string;
+    readonly description: string;
+    readonly inputSchema: Record<string, unknown>;
+    readonly outputSchema?: Record<string, unknown>;
+}
+export interface ToolsListResult {
+    readonly tools: readonly ToolDescriptor[];
+    readonly nextCursor?: string;
+}
+export interface ToolsCallParams {
+    readonly name: string;
+    readonly arguments?: Record<string, unknown>;
+}
+/** An MCP content block. Phase 1 emits only text blocks. */
+export interface TextContent {
+    readonly type: 'text';
+    readonly text: string;
+}
+export interface ToolsCallResult {
+    readonly content: readonly TextContent[];
+    readonly structuredContent?: unknown;
+    readonly isError: boolean;
+}
+//# sourceMappingURL=adapter.d.ts.map

package/node_modules/@noodle-borg/protocol/dist/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAC;IACjC,gBAAgB,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CAAC;IACxF,SAAS,CAAC,QAAQ,EAAE,eAAe,GAAG,eAAe,CAAC;IACtD,QAAQ,CACN,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,eAAe,CAAC,CAAC;CAC7B;AAED,oGAAoG;AACpG,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAI3C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACrD;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAID,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9C;AAED,4DAA4D;AAC5D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B"}

package/node_modules/@noodle-borg/protocol/dist/adapter.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=adapter.js.map

package/node_modules/@noodle-borg/protocol/dist/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":""}

package/node_modules/@noodle-borg/protocol/dist/adapters/mcp-2025-11-25.d.ts

@@ -0,0 +1,19 @@
+import type { RuntimeArtifact } from '@noodle-borg/compiler';
+import { type ExecuteDeps } from '@noodle-borg/runtime';
+import type { CallToolOutcome, InitializeParams, InitializeResult, ProtocolAdapter, ToolsCallParams, ToolsListResult } from '../adapter.js';
+/** The current stable MCP protocol version. */
+export declare const MCP_2025_11_25 = "2025-11-25";
+/**
+ * Adapter for the stable MCP `2025-11-25` protocol version. Implements the core tools surface
+ * (`initialize`, `tools/list`, `tools/call`); `resources`/`prompts`/`elicit`/Apps/Tasks are later
+ * slices. Wire shapes verified against the official `2025-11-25` specification
+ * (docs/references/mcp-source-notes.md).
+ */
+export declare class Mcp20251125Adapter implements ProtocolAdapter {
+    readonly version = "2025-11-25";
+    readonly status: "stable";
+    initializeResult(artifact: RuntimeArtifact, _params: InitializeParams): InitializeResult;
+    listTools(artifact: RuntimeArtifact): ToolsListResult;
+    callTool(artifact: RuntimeArtifact, params: ToolsCallParams, deps: ExecuteDeps): Promise<CallToolOutcome>;
+}
+//# sourceMappingURL=mcp-2025-11-25.d.ts.map

package/node_modules/@noodle-borg/protocol/dist/adapters/mcp-2025-11-25.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-2025-11-25.d.ts","sourceRoot":"","sources":["../../src/adapters/mcp-2025-11-25.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,KAAK,WAAW,EAAe,MAAM,sBAAsB,CAAC;AACrE,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EAEf,eAAe,EACf,eAAe,EAChB,MAAM,eAAe,CAAC;AAGvB,+CAA+C;AAC/C,eAAO,MAAM,cAAc,eAAe,CAAC;AAE3C;;;;;GAKG;AACH,qBAAa,kBAAmB,YAAW,eAAe;IACxD,QAAQ,CAAC,OAAO,gBAAkB;IAClC,QAAQ,CAAC,MAAM,EAAG,QAAQ,CAAU;IAEpC,gBAAgB,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,gBAAgB,GAAG,gBAAgB;IAaxF,SAAS,CAAC,QAAQ,EAAE,eAAe,GAAG,eAAe;IAI/C,QAAQ,CACZ,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,eAAe,CAAC;CAI5B"}

package/node_modules/@noodle-borg/protocol/dist/adapters/mcp-2025-11-25.js

@@ -0,0 +1,34 @@
+import { executeTool } from '@noodle-borg/runtime';
+import { mapExecutionError, mapToolOutput, mapToolsList } from '../mapping.js';
+/** The current stable MCP protocol version. */
+export const MCP_2025_11_25 = '2025-11-25';
+/**
+ * Adapter for the stable MCP `2025-11-25` protocol version. Implements the core tools surface
+ * (`initialize`, `tools/list`, `tools/call`); `resources`/`prompts`/`elicit`/Apps/Tasks are later
+ * slices. Wire shapes verified against the official `2025-11-25` specification
+ * (docs/references/mcp-source-notes.md).
+ */
+export class Mcp20251125Adapter {
+    version = MCP_2025_11_25;
+    status = 'stable';
+    initializeResult(artifact, _params) {
+        const serverInfo = {
+            name: artifact.server.name,
+            title: artifact.server.title,
+            version: artifact.server.version,
+        };
+        return {
+            protocolVersion: this.version,
+            capabilities: { tools: { listChanged: false } },
+            serverInfo,
+        };
+    }
+    listTools(artifact) {
+        return mapToolsList(artifact);
+    }
+    async callTool(artifact, params, deps) {
+        const result = await executeTool(artifact, params.name, params.arguments ?? {}, deps);
+        return result.ok ? { result: mapToolOutput(result.output) } : mapExecutionError(result.error);
+    }
+}
+//# sourceMappingURL=mcp-2025-11-25.js.map

package/node_modules/@noodle-borg/protocol/dist/adapters/mcp-2025-11-25.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-2025-11-25.js","sourceRoot":"","sources":["../../src/adapters/mcp-2025-11-25.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAUrE,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE/E,+CAA+C;AAC/C,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,OAAO,kBAAkB;IACpB,OAAO,GAAG,cAAc,CAAC;IACzB,MAAM,GAAG,QAAiB,CAAC;IAEpC,gBAAgB,CAAC,QAAyB,EAAE,OAAyB;QACnE,MAAM,UAAU,GAAe;YAC7B,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI;YAC1B,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK;YAC5B,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO;SACjC,CAAC;QACF,OAAO;YACL,eAAe,EAAE,IAAI,CAAC,OAAO;YAC7B,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;YAC/C,UAAU;SACX,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,QAAyB;QACjC,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,QAAyB,EACzB,MAAuB,EACvB,IAAiB;QAEjB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QACtF,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChG,CAAC;CACF"}

package/node_modules/@noodle-borg/protocol/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { JSON_RPC, type JsonRpcErrorObject } from './jsonrpc.js';
+export { type CallToolOutcome, type GetPromptResult, mapExecutionError, mapPromptMessages, mapPromptsList, mapResourceContents, mapResourcesList, mapResourceTemplatesList, mapTool, mapToolOutput, mapToolsList, type PromptMessage, type ReadResourceResult, type ResourceContent, type TextContent, type ToolDescriptor, type ToolsCallResult, type ToolsListResult, } from './mapping.js';
+export { buildMcpServer, type ServedArtifact } from './sdk-server.js';
+export { handleStatelessHttp } from './stateless.js';
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/protocol/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,OAAO,EACP,aAAa,EACb,YAAY,EACZ,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC"}

package/node_modules/@noodle-borg/protocol/dist/index.js

@@ -0,0 +1,5 @@
+export { JSON_RPC } from './jsonrpc.js';
+export { mapExecutionError, mapPromptMessages, mapPromptsList, mapResourceContents, mapResourcesList, mapResourceTemplatesList, mapTool, mapToolOutput, mapToolsList, } from './mapping.js';
+export { buildMcpServer } from './sdk-server.js';
+export { handleStatelessHttp } from './stateless.js';
+//# sourceMappingURL=index.js.map

package/node_modules/@noodle-borg/protocol/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA2B,MAAM,cAAc,CAAC;AACjE,OAAO,EAGL,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,OAAO,EACP,aAAa,EACb,YAAY,GAQb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAuB,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC"}

package/node_modules/@noodle-borg/protocol/dist/jsonrpc.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Standard JSON-RPC 2.0 error codes. The official `@modelcontextprotocol/sdk` owns the wire envelope;
+ * these constants remain for the two SDK-agnostic users: the artifact→wire {@link mapping} (which picks
+ * the channel for an execution error) and the HTTP front-door (which emits transport-level errors
+ * before a request ever reaches the SDK).
+ */
+export declare const JSON_RPC: {
+    readonly PARSE_ERROR: -32700;
+    readonly INVALID_REQUEST: -32600;
+    readonly METHOD_NOT_FOUND: -32601;
+    readonly INVALID_PARAMS: -32602;
+    readonly INTERNAL_ERROR: -32603;
+};
+export interface JsonRpcErrorObject {
+    readonly code: number;
+    readonly message: string;
+    readonly data?: unknown;
+}
+//# sourceMappingURL=jsonrpc.d.ts.map

package/node_modules/@noodle-borg/protocol/dist/jsonrpc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonrpc.d.ts","sourceRoot":"","sources":["../src/jsonrpc.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,QAAQ;;;;;;CAMX,CAAC;AAEX,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB"}

package/node_modules/@noodle-borg/protocol/dist/jsonrpc.js

@@ -0,0 +1,14 @@
+/**
+ * Standard JSON-RPC 2.0 error codes. The official `@modelcontextprotocol/sdk` owns the wire envelope;
+ * these constants remain for the two SDK-agnostic users: the artifact→wire {@link mapping} (which picks
+ * the channel for an execution error) and the HTTP front-door (which emits transport-level errors
+ * before a request ever reaches the SDK).
+ */
+export const JSON_RPC = {
+    PARSE_ERROR: -32700,
+    INVALID_REQUEST: -32600,
+    METHOD_NOT_FOUND: -32601,
+    INVALID_PARAMS: -32602,
+    INTERNAL_ERROR: -32603,
+};
+//# sourceMappingURL=jsonrpc.js.map

package/node_modules/@noodle-borg/protocol/dist/jsonrpc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonrpc.js","sourceRoot":"","sources":["../src/jsonrpc.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,WAAW,EAAE,CAAC,KAAK;IACnB,eAAe,EAAE,CAAC,KAAK;IACvB,gBAAgB,EAAE,CAAC,KAAK;IACxB,cAAc,EAAE,CAAC,KAAK;IACtB,cAAc,EAAE,CAAC,KAAK;CACd,CAAC"}