noodleseed-cli 0.1.4

package/node_modules/@noodle-borg/runtime/dist/policy/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/policy/types.ts"],"names":[],"mappings":""}

package/node_modules/@noodle-borg/runtime/dist/result.d.ts

@@ -0,0 +1,19 @@
+/** Why a tool call could not be fulfilled. Internal contract — the protocol adapter maps these to
+ * the MCP wire shape in a later slice. */
+export type ExecutionErrorCode = 'shape_only_artifact' | 'unknown_tool' | 'unknown_resource' | 'unknown_prompt' | 'unsupported_fulfilment' | 'connector_unavailable' | 'credential_unavailable' | 'signature_drift' | 'policy_denied' | 'policy_error' | 'arg_invalid' | 'expression_error' | 'connector_error' | 'output_invalid';
+/** A typed execution failure. `path` locates the offending field/expression when applicable and
+ * never carries a sensitive value. */
+export interface ExecutionError {
+    readonly code: ExecutionErrorCode;
+    readonly message: string;
+    readonly path?: string;
+}
+/** The result of executing a tool call: the operation output, or a typed error. */
+export type ExecutionResult = {
+    readonly ok: true;
+    readonly output: unknown;
+} | {
+    readonly ok: false;
+    readonly error: ExecutionError;
+};
+//# sourceMappingURL=result.d.ts.map

package/node_modules/@noodle-borg/runtime/dist/result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../src/result.ts"],"names":[],"mappings":"AAAA;0CAC0C;AAC1C,MAAM,MAAM,kBAAkB,GAC1B,qBAAqB,GACrB,cAAc,GACd,kBAAkB,GAClB,gBAAgB,GAChB,wBAAwB,GACxB,uBAAuB,GACvB,wBAAwB,GACxB,iBAAiB,GACjB,eAAe,GACf,cAAc,GACd,aAAa,GACb,kBAAkB,GAClB,iBAAiB,GACjB,gBAAgB,CAAC;AAErB;sCACsC;AACtC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,mFAAmF;AACnF,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC/C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;CAAE,CAAC"}

package/node_modules/@noodle-borg/runtime/dist/result.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=result.js.map

package/node_modules/@noodle-borg/runtime/dist/result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.js","sourceRoot":"","sources":["../src/result.ts"],"names":[],"mappings":""}

package/node_modules/@noodle-borg/runtime/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "@noodle-borg/runtime",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "dependencies": {
+    "@noodle-borg/compiler": "0.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0"
+  }
+}

package/node_modules/@noodle-borg/service/dist/auth/deploy-gate.d.ts

@@ -0,0 +1,48 @@
+import type { IncomingMessage } from 'node:http';
+/**
+ * Authorizes the deploy control plane. This is an **admin** boundary — who may publish a
+ * server — distinct from tenant MCP caller auth (Slice 24) and from end-user
+ * OAuth (Phase 3, [ADR 0018](../../../../docs/decisions/0018-thread-verified-end-user-identity.md)).
+ * See [ADR 0029](../../../../docs/decisions/0029-deploy-authentication.md).
+ */
+export interface ControlPlaneIdentity {
+    readonly subject: string;
+    readonly email: string;
+    readonly superAdmin: boolean;
+}
+export type ControlPlaneAuthResult = {
+    readonly ok: true;
+    readonly identity?: ControlPlaneIdentity;
+} | {
+    readonly ok: false;
+    readonly status: 401 | 403;
+    readonly message: string;
+};
+export interface DeployAuthGate {
+    /** Authorize a control-plane request before reading a sensitive request body. */
+    authorize(req: IncomingMessage): Promise<ControlPlaneAuthResult> | ControlPlaneAuthResult;
+}
+/** Extract a bearer token from the `Authorization` header (scheme case-insensitive), or `null`. */
+export declare function bearerToken(req: IncomingMessage): string | null;
+/** Constant-time equality over fixed-length SHA-256 digests, so neither value nor its length leaks. */
+export declare function constantTimeEqual(a: string, b: string): boolean;
+/** Allows every deploy — the localhost-dev default (safe only on a loopback bind). */
+export declare function allowAllGate(): DeployAuthGate;
+export interface GoogleIdTokenVerifier {
+    verify(token: string, audience: string): Promise<{
+        subject: string;
+        email: string;
+    }>;
+}
+export interface GoogleControlPlaneGateOptions {
+    readonly audience: string;
+    readonly admins: readonly string[];
+    readonly allowedEmailDomain?: string;
+    readonly verifier?: GoogleIdTokenVerifier;
+}
+export declare class GoogleControlPlaneGate implements DeployAuthGate {
+    #private;
+    constructor(options: GoogleControlPlaneGateOptions);
+    authorize(req: IncomingMessage): Promise<ControlPlaneAuthResult>;
+}
+//# sourceMappingURL=deploy-gate.d.ts.map

package/node_modules/@noodle-borg/service/dist/auth/deploy-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-gate.d.ts","sourceRoot":"","sources":["../../src/auth/deploy-gate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAGjD;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,SAAS,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;CAC3F;AAED,mGAAmG;AACnG,wBAAgB,WAAW,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAK/D;AAED,uGAAuG;AACvG,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAI/D;AAED,sFAAsF;AACtF,wBAAgB,YAAY,IAAI,cAAc,CAE7C;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtF;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,qBAAqB,CAAC;CAC3C;AAED,qBAAa,sBAAuB,YAAW,cAAc;;gBAM/C,OAAO,EAAE,6BAA6B;IAU5C,SAAS,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAsBvE"}

package/node_modules/@noodle-borg/service/dist/auth/deploy-gate.js

@@ -0,0 +1,79 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { OAuth2Client } from 'google-auth-library';
+/** Extract a bearer token from the `Authorization` header (scheme case-insensitive), or `null`. */
+export function bearerToken(req) {
+    const header = req.headers.authorization;
+    if (typeof header !== 'string')
+        return null;
+    const match = /^Bearer[ \t]+(.+)$/i.exec(header.trim());
+    return match?.[1]?.trim() ?? null;
+}
+/** Constant-time equality over fixed-length SHA-256 digests, so neither value nor its length leaks. */
+export function constantTimeEqual(a, b) {
+    const da = createHash('sha256').update(a).digest();
+    const db = createHash('sha256').update(b).digest();
+    return timingSafeEqual(da, db);
+}
+/** Allows every deploy — the localhost-dev default (safe only on a loopback bind). */
+export function allowAllGate() {
+    return { authorize: () => ({ ok: true }) };
+}
+export class GoogleControlPlaneGate {
+    #audience;
+    #admins;
+    #allowedEmailDomain;
+    #verifier;
+    constructor(options) {
+        if (options.audience.length === 0)
+            throw new Error('Google audience must be non-empty');
+        this.#audience = options.audience;
+        this.#admins = new Set(options.admins.map((value) => value.toLowerCase()));
+        this.#allowedEmailDomain = normalizeEmailDomain(options.allowedEmailDomain ?? '@noodleseed.com');
+        this.#verifier = options.verifier ?? new GoogleOAuthVerifier();
+    }
+    async authorize(req) {
+        const token = bearerToken(req);
+        if (token === null)
+            return { ok: false, status: 401, message: 'missing bearer token' };
+        let identity;
+        try {
+            identity = await this.#verifier.verify(token, this.#audience);
+        }
+        catch {
+            return { ok: false, status: 401, message: 'invalid bearer token' };
+        }
+        const email = identity.email.toLowerCase();
+        if (!email.endsWith(this.#allowedEmailDomain)) {
+            return { ok: false, status: 403, message: 'email domain is not allowed' };
+        }
+        return {
+            ok: true,
+            identity: {
+                subject: identity.subject,
+                email,
+                superAdmin: this.#admins.has(identity.subject.toLowerCase()) || this.#admins.has(email),
+            },
+        };
+    }
+}
+function normalizeEmailDomain(value) {
+    const domain = value.trim().toLowerCase();
+    if (domain.length === 0)
+        throw new Error('allowed email domain must be non-empty');
+    return domain.startsWith('@') ? domain : `@${domain}`;
+}
+class GoogleOAuthVerifier {
+    #client = new OAuth2Client();
+    async verify(token, audience) {
+        const ticket = await this.#client.verifyIdToken({ idToken: token, audience });
+        const payload = ticket.getPayload();
+        const subject = payload?.sub;
+        const email = payload?.email;
+        const emailVerified = payload?.email_verified;
+        if (typeof subject !== 'string' || typeof email !== 'string' || emailVerified !== true) {
+            throw new Error('Google token is missing a verified subject/email');
+        }
+        return { subject, email };
+    }
+}
+//# sourceMappingURL=deploy-gate.js.map

package/node_modules/@noodle-borg/service/dist/auth/deploy-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-gate.js","sourceRoot":"","sources":["../../src/auth/deploy-gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAuBnD,mGAAmG;AACnG,MAAM,UAAU,WAAW,CAAC,GAAoB;IAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACzC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACpC,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnD,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnD,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,YAAY;IAC1B,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC7C,CAAC;AAaD,MAAM,OAAO,sBAAsB;IACxB,SAAS,CAAS;IAClB,OAAO,CAAsB;IAC7B,mBAAmB,CAAS;IAC5B,SAAS,CAAwB;IAE1C,YAAY,OAAsC;QAChD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACxF,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,mBAAmB,GAAG,oBAAoB,CAC7C,OAAO,CAAC,kBAAkB,IAAI,iBAAiB,CAChD,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAoB;QAClC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;QACvF,IAAI,QAA4C,CAAC;QACjD,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;QACrE,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE;gBACR,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,KAAK;gBACL,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;aACxF;SACF,CAAC;IACJ,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,mBAAmB;IACd,OAAO,GAAG,IAAI,YAAY,EAAE,CAAC;IAEtC,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,QAAgB;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,OAAO,EAAE,GAAG,CAAC;QAC7B,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;QAC7B,MAAM,aAAa,GAAG,OAAO,EAAE,cAAc,CAAC;QAC9C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;CACF"}

package/node_modules/@noodle-borg/service/dist/index.d.ts

@@ -0,0 +1,7 @@
+export { allowAllGate, bearerToken, type ControlPlaneAuthResult, type ControlPlaneIdentity, constantTimeEqual, type DeployAuthGate, GoogleControlPlaneGate, type GoogleIdTokenVerifier, } from './auth/deploy-gate.js';
+export { type GcpKmsConfig, gcpKmsMasterKeyProvider, type KmsClient, } from './secret/kms-master-key.js';
+export { createServiceHandler, type DeployError, type DeployResult, type RecoverResult, type RunningService, ServerRegistry, type ServiceOptions, serveService, } from './service.js';
+export { type CloudSqlConfig, createPostgresPool, type PostgresPool, type PostgresPoolConfig, } from './store/cloudsql-pool.js';
+export { PostgresArtifactStore } from './store/postgres.js';
+export { type ArtifactStore, type ControlPlaneStore, DEPLOYMENT_ID_PATTERN, type DeploymentSummary, type DeployRecord, InMemoryArtifactStore, InMemoryControlPlaneStore, JsonFileArtifactStore, type OrgMemberRecord, type OrgRecord, type OrgRole, type SecretEnvelope, SLUG_PATTERN, type TenantRef, validateOrgRole, validateSlug, validateTenantRef, } from './store.js';
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/service/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,WAAW,EACX,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,iBAAiB,EACjB,KAAK,cAAc,EACnB,sBAAsB,EACtB,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,YAAY,EACjB,uBAAuB,EACvB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,oBAAoB,EACpB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,cAAc,EACd,KAAK,cAAc,EACnB,YAAY,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,cAAc,EACnB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,kBAAkB,GACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,qBAAqB,EACrB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,cAAc,EACnB,YAAY,EACZ,KAAK,SAAS,EACd,eAAe,EACf,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC"}

package/node_modules/@noodle-borg/service/dist/index.js

@@ -0,0 +1,7 @@
+export { allowAllGate, bearerToken, constantTimeEqual, GoogleControlPlaneGate, } from './auth/deploy-gate.js';
+export { gcpKmsMasterKeyProvider, } from './secret/kms-master-key.js';
+export { createServiceHandler, ServerRegistry, serveService, } from './service.js';
+export { createPostgresPool, } from './store/cloudsql-pool.js';
+export { PostgresArtifactStore } from './store/postgres.js';
+export { DEPLOYMENT_ID_PATTERN, InMemoryArtifactStore, InMemoryControlPlaneStore, JsonFileArtifactStore, SLUG_PATTERN, validateOrgRole, validateSlug, validateTenantRef, } from './store.js';
+//# sourceMappingURL=index.js.map

package/node_modules/@noodle-borg/service/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,WAAW,EAGX,iBAAiB,EAEjB,sBAAsB,GAEvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,uBAAuB,GAExB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,oBAAoB,EAKpB,cAAc,EAEd,YAAY,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,kBAAkB,GAGnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAGL,qBAAqB,EAGrB,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EAKrB,YAAY,EAEZ,eAAe,EACf,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC"}

package/node_modules/@noodle-borg/service/dist/main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=main.d.ts.map

package/node_modules/@noodle-borg/service/dist/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":""}

package/node_modules/@noodle-borg/service/dist/main.js

@@ -0,0 +1,171 @@
+#!/usr/bin/env node
+/**
+ * The Noodle deploy service: a single stateless process that accepts tenant-scoped deploys and serves each
+ * active app environment at `/o/{org}/{app}/mcp` or `/o/{org}/{app}/{env}/mcp`. Build the workspace, then run:
+ *
+ *   node packages/service/dist/main.js          # listens on http://127.0.0.1:8787
+ *
+ * Deploy a manifest with the `mrdn deploy` CLI, or POST one directly.
+ */
+import { createJwtVerifier, createStaticSigningKeyProvider } from '@noodle-borg/auth';
+import { createLogger } from '@noodle-borg/transport-http';
+import { GoogleOAuthAuthenticator } from './oauth/google.js';
+import { serveService } from './service.js';
+const LOG_LEVELS = ['debug', 'info', 'warn', 'error'];
+async function main() {
+    const port = Number(process.env.PORT ?? 8787);
+    const publicBaseUrl = process.env.PUBLIC_BASE_URL;
+    const host = process.env.HOST;
+    const googleClientId = process.env.NOODLE_GOOGLE_CLIENT_ID;
+    const controlPlaneAllowedEmailDomain = process.env.NOODLE_CONTROL_PLANE_ALLOWED_EMAIL_DOMAIN ?? '@noodleseed.com';
+    const controlPlaneAdmins = parseList(process.env.NOODLE_CONTROL_PLANE_ADMINS);
+    const dataDir = process.env.NOODLE_DATA_DIR;
+    const databaseUrl = process.env.DATABASE_URL;
+    const secretMasterKey = process.env.NOODLE_SECRET_MASTER_KEY;
+    // KEK custody (ADR 0037): a Cloud KMS cryptoKey resource name. Takes precedence over the static key — the
+    // KEK then never enters the process (KMS wraps a per-record data key).
+    const kmsKeyName = process.env.NOODLE_KMS_KEY;
+    // Cloud SQL (IAM DB auth) backend: a present INSTANCE_CONNECTION_NAME requires DB_USER + DB_NAME, else
+    // fail closed rather than silently fall back to in-memory on a cloud deploy that intended Postgres.
+    const instanceConnectionName = process.env.INSTANCE_CONNECTION_NAME;
+    let cloudSql;
+    if (instanceConnectionName !== undefined) {
+        const dbUser = process.env.DB_USER;
+        const dbName = process.env.DB_NAME;
+        if (!dbUser || !dbName) {
+            throw new Error('INSTANCE_CONNECTION_NAME requires DB_USER and DB_NAME (Cloud SQL IAM auth)');
+        }
+        const ipType = process.env.DB_IP_TYPE;
+        cloudSql = {
+            instanceConnectionName,
+            dbUser,
+            dbName,
+            ...(ipType === 'PRIVATE' || ipType === 'PUBLIC' ? { ipType } : {}),
+        };
+    }
+    const envLevel = process.env.NOODLE_LOG_LEVEL;
+    const level = LOG_LEVELS.includes(envLevel)
+        ? envLevel
+        : 'info';
+    const logger = createLogger({ level, base: { svc: 'noodle' } });
+    const trustProxy = process.env.NOODLE_TRUST_PROXY === '1' || process.env.NOODLE_TRUST_PROXY === 'true';
+    // Lazy recompile-on-first-request is the default (ADR 0036, multi-instance correctness). NOODLE_WARM_ALL
+    // opts into eager recompile-all-on-boot for a pinned single-instance / on-prem deploy.
+    const warmAll = process.env.NOODLE_WARM_ALL === '1' || process.env.NOODLE_WARM_ALL === 'true';
+    // Owner-only end-user auth. Two modes:
+    //  • Self-hosted authorization server (OA-2, ADR 0042): set NOODLE_OAUTH_ISSUER + the Google OAuth client
+    //    creds; the service runs the AS (DCR + PKCE, federating login to Google) and verifies owner-only tokens
+    //    in-process against its own signing key. A standards client (Claude.ai/ChatGPT) can then sign in.
+    //  • External issuer (OA-1): set NOODLE_OAUTH_ISSUER + NOODLE_OAUTH_JWKS_URI to validate tokens from an
+    //    issuer you operate elsewhere; the runtime is only the resource server.
+    // With neither, owner-only endpoints fail closed (no verifier).
+    const oauthIssuer = process.env.NOODLE_OAUTH_ISSUER;
+    const oauthJwksUri = process.env.NOODLE_OAUTH_JWKS_URI;
+    const oauthGoogleClientId = process.env.NOODLE_OAUTH_GOOGLE_CLIENT_ID;
+    const oauthGoogleSecret = process.env.NOODLE_OAUTH_GOOGLE_CLIENT_SECRET;
+    const oauthGoogleRedirect = process.env.NOODLE_OAUTH_GOOGLE_REDIRECT_URI;
+    const oauthSigningKey = process.env.NOODLE_OAUTH_SIGNING_KEY;
+    const oauthAllowedEmailDomain = process.env.NOODLE_OAUTH_ALLOWED_EMAIL_DOMAIN;
+    const selfHostAuthServer = Boolean(oauthIssuer && oauthGoogleClientId && oauthGoogleSecret && oauthGoogleRedirect);
+    // Self-hosted AS config (OA-2): serveService runs the AS and derives the verifier from the signing key.
+    const oauth = selfHostAuthServer
+        ? {
+            issuer: oauthIssuer,
+            signer: await createStaticSigningKeyProvider(oauthSigningKey ? { privateKeyPem: oauthSigningKey } : {}),
+            google: new GoogleOAuthAuthenticator({
+                clientId: oauthGoogleClientId,
+                clientSecret: oauthGoogleSecret,
+                redirectUri: oauthGoogleRedirect,
+            }),
+            ...(oauthAllowedEmailDomain ? { allowedEmailDomain: oauthAllowedEmailDomain } : {}),
+        }
+        : undefined;
+    // External-issuer verifier (OA-1 only): used when not self-hosting the AS.
+    const verifyOwnerToken = !selfHostAuthServer && oauthIssuer && oauthJwksUri
+        ? createJwtVerifier({ issuer: oauthIssuer, jwksUri: oauthJwksUri })
+        : undefined;
+    const running = await serveService({
+        port,
+        logger,
+        ...(host ? { host } : {}),
+        ...(publicBaseUrl ? { publicBaseUrl } : {}),
+        ...(googleClientId ? { googleClientId } : {}),
+        ...(googleClientId ? { controlPlaneAllowedEmailDomain } : {}),
+        ...(controlPlaneAdmins.length > 0 ? { controlPlaneAdmins } : {}),
+        ...(dataDir ? { dataDir } : {}),
+        ...(databaseUrl ? { databaseUrl } : {}),
+        ...(cloudSql ? { cloudSql } : {}),
+        ...(secretMasterKey ? { secretMasterKey } : {}),
+        ...(kmsKeyName ? { kmsKeyName } : {}),
+        ...(warmAll ? { warmAll: true } : {}),
+        ...(trustProxy ? { tls: { trustProxy: true } } : {}),
+        // Self-hosted AS: serveService derives authServerIssuer + the in-process verifier from `oauth`.
+        // External issuer: pass them explicitly.
+        ...(oauth ? { oauth } : oauthIssuer ? { authServerIssuer: oauthIssuer } : {}),
+        ...(verifyOwnerToken ? { verifyOwnerToken } : {}),
+    });
+    console.log(`Noodle deploy service listening at ${running.url}`);
+    console.log(googleClientId
+        ? 'Control auth: Google ID token required; org membership gates deploys'
+        : 'Control auth: OPEN (localhost dev only — set NOODLE_GOOGLE_CLIENT_ID before exposing)');
+    const persistence = cloudSql
+        ? `ON (Cloud SQL ${cloudSql.instanceConnectionName})`
+        : databaseUrl
+            ? 'ON (Postgres)'
+            : dataDir
+                ? `ON (data dir ${dataDir})`
+                : undefined;
+    const recoveryMode = warmAll ? 'eager warm-all' : 'lazy recompile';
+    const kekMode = kmsKeyName ? 'KMS-wrapped KEK' : 'static key';
+    console.log(persistence
+        ? `Persistence:  ${persistence} — deploys survive restart (${recoveryMode}), secrets sealed (${kekMode})`
+        : 'Persistence:  OFF (in-memory; deploys lost on restart — set DATABASE_URL or NOODLE_DATA_DIR)');
+    console.log(trustProxy
+        ? 'TLS posture:  proxy-terminated (trusting X-Forwarded-Proto; HTTPS enforced + HSTS)'
+        : 'TLS posture:  direct/dev (security headers only) — set NOODLE_TRUST_PROXY behind a TLS proxy');
+    console.log(oauth
+        ? `Owner auth:   self-hosted authorization server at ${oauthIssuer} (DCR + PKCE, Google login)`
+        : verifyOwnerToken
+            ? `Owner auth:   owner-only deploys validate tokens from external issuer ${oauthIssuer}`
+            : 'Owner auth:   OFF (owner-only deploys fail closed — set NOODLE_OAUTH_ISSUER + Google OAuth creds, or NOODLE_OAUTH_JWKS_URI)');
+    if (running.recovered) {
+        const { recovered, failed } = running.recovered;
+        console.log(`Recovered:    ${recovered} server(s)${failed.length ? `, ${failed.length} skipped (failed to recompile)` : ''}`);
+    }
+    console.log(`Deploy a manifest:  POST ${running.url}/v1/orgs/<org>/apps/<app>/envs/prod/deploy   body {"manifest":"<yaml>"}`);
+    console.log(`Tenant MCP routes are served at  ${running.url}/o/<org>/<app>/mcp`);
+    // Graceful drain (ADR 0034): on SIGTERM (Cloud Run sends it before stopping an instance) stop accepting
+    // new connections, let in-flight requests finish, close the DB pool, then exit. A bounded timer
+    // force-exits if the drain hangs so a stuck connection never blocks the rollout.
+    let draining = false;
+    const shutdown = async (signal) => {
+        if (draining)
+            return;
+        draining = true;
+        logger.info('shutdown', { signal });
+        const force = setTimeout(() => process.exit(1), 10_000);
+        force.unref();
+        try {
+            running.http.closeIdleConnections();
+            await running.close();
+        }
+        catch (error) {
+            logger.error('shutdown.error', { message: error.message });
+        }
+        clearTimeout(force);
+        process.exit(0);
+    };
+    process.once('SIGTERM', () => void shutdown('SIGTERM'));
+    process.once('SIGINT', () => void shutdown('SIGINT'));
+}
+main().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});
+function parseList(value) {
+    return (value ?? '')
+        .split(',')
+        .map((item) => item.trim())
+        .filter((item) => item.length > 0);
+}
+//# sourceMappingURL=main.js.map

package/node_modules/@noodle-borg/service/dist/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AACA;;;;;;;GAOG;AACH,OAAO,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAiB,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,MAAM,UAAU,GAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAE3E,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IAC9B,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAC3D,MAAM,8BAA8B,GAClC,OAAO,CAAC,GAAG,CAAC,yCAAyC,IAAI,iBAAiB,CAAC;IAC7E,MAAM,kBAAkB,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC7C,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IAC7D,0GAA0G;IAC1G,uEAAuE;IACvE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC9C,uGAAuG;IACvG,oGAAoG;IACpG,MAAM,sBAAsB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IACpE,IAAI,QAAoC,CAAC;IACzC,IAAI,sBAAsB,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QACnC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACtC,QAAQ,GAAG;YACT,sBAAsB;YACtB,MAAM;YACN,MAAM;YACN,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,MAAM,KAAK,GAAa,UAAU,CAAC,QAAQ,CAAC,QAAoB,CAAC;QAC/D,CAAC,CAAE,QAAqB;QACxB,CAAC,CAAC,MAAM,CAAC;IACX,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,UAAU,GACd,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,MAAM,CAAC;IACtF,yGAAyG;IACzG,uFAAuF;IACvF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,MAAM,CAAC;IAC9F,uCAAuC;IACvC,0GAA0G;IAC1G,4GAA4G;IAC5G,sGAAsG;IACtG,wGAAwG;IACxG,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACpD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACvD,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;IACtE,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC;IACxE,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC;IACzE,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IAC7D,MAAM,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC;IAC9E,MAAM,kBAAkB,GAAG,OAAO,CAChC,WAAW,IAAI,mBAAmB,IAAI,iBAAiB,IAAI,mBAAmB,CAC/E,CAAC;IACF,wGAAwG;IACxG,MAAM,KAAK,GAAG,kBAAkB;QAC9B,CAAC,CAAC;YACE,MAAM,EAAE,WAAqB;YAC7B,MAAM,EAAE,MAAM,8BAA8B,CAC1C,eAAe,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAC1D;YACD,MAAM,EAAE,IAAI,wBAAwB,CAAC;gBACnC,QAAQ,EAAE,mBAA6B;gBACvC,YAAY,EAAE,iBAA2B;gBACzC,WAAW,EAAE,mBAA6B;aAC3C,CAAC;YACF,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpF;QACH,CAAC,CAAC,SAAS,CAAC;IACd,2EAA2E;IAC3E,MAAM,gBAAgB,GACpB,CAAC,kBAAkB,IAAI,WAAW,IAAI,YAAY;QAChD,CAAC,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACnE,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC;QACjC,IAAI;QACJ,MAAM;QACN,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,8BAA8B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,gGAAgG;QAChG,yCAAyC;QACzC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,sCAAsC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CACT,cAAc;QACZ,CAAC,CAAC,sEAAsE;QACxE,CAAC,CAAC,uFAAuF,CAC5F,CAAC;IACF,MAAM,WAAW,GAAG,QAAQ;QAC1B,CAAC,CAAC,iBAAiB,QAAQ,CAAC,sBAAsB,GAAG;QACrD,CAAC,CAAC,WAAW;YACX,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,OAAO;gBACP,CAAC,CAAC,gBAAgB,OAAO,GAAG;gBAC5B,CAAC,CAAC,SAAS,CAAC;IAClB,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACnE,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC;IAC9D,OAAO,CAAC,GAAG,CACT,WAAW;QACT,CAAC,CAAC,iBAAiB,WAAW,+BAA+B,YAAY,sBAAsB,OAAO,GAAG;QACzG,CAAC,CAAC,8FAA8F,CACnG,CAAC;IACF,OAAO,CAAC,GAAG,CACT,UAAU;QACR,CAAC,CAAC,oFAAoF;QACtF,CAAC,CAAC,8FAA8F,CACnG,CAAC;IACF,OAAO,CAAC,GAAG,CACT,KAAK;QACH,CAAC,CAAC,qDAAqD,WAAW,6BAA6B;QAC/F,CAAC,CAAC,gBAAgB;YAChB,CAAC,CAAC,yEAAyE,WAAW,EAAE;YACxF,CAAC,CAAC,6HAA6H,CACpI,CAAC;IACF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;QAChD,OAAO,CAAC,GAAG,CACT,iBAAiB,SAAS,aAAa,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,gCAAgC,CAAC,CAAC,CAAC,EAAE,EAAE,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CACT,4BAA4B,OAAO,CAAC,GAAG,yEAAyE,CACjH,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,oCAAoC,OAAO,CAAC,GAAG,oBAAoB,CAAC,CAAC;IAEjF,wGAAwG;IACxG,gGAAgG;IAChG,iFAAiF;IACjF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACvD,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACxD,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YACpC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,KAAyB;IAC1C,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;SACjB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/app.d.ts

@@ -0,0 +1,14 @@
+import { type Express } from 'express';
+import type { NoodleOAuthProvider } from './provider.js';
+/**
+ * Build the minimal Express sub-app for the self-hosted authorization server (OA-2,
+ * [ADR 0042](../../../../docs/decisions/0042-self-hosted-oauth-authorization-server.md)). It composes the MCP
+ * SDK's **individual** handlers — `authorize`, `token`, `register` (DCR) — rather than the whole
+ * `mcpAuthRouter`, because that router's protected-resource metadata is single-resource and we keep OA-1's
+ * dynamic per-tenant PRM in the raw `node:http` front-door. Authorization-server metadata (RFC 8414) + JWKS +
+ * the Google callback + the consent endpoint are added here. The app is a `(req, res)` listener the
+ * front-door delegates to for {@link isAuthServerPath} paths.
+ */
+export declare function createOAuthApp(provider: NoodleOAuthProvider): Express;
+export { isAuthServerPath } from './paths.js';
+//# sourceMappingURL=app.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/oauth/app.ts"],"names":[],"mappings":"AAGA,OAAgB,EAAE,KAAK,OAAO,EAA+B,MAAM,SAAS,CAAC;AAC7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEzD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAgCrE;AAWD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/app.js

@@ -0,0 +1,48 @@
+import { authorizationHandler } from '@modelcontextprotocol/sdk/server/auth/handlers/authorize.js';
+import { clientRegistrationHandler } from '@modelcontextprotocol/sdk/server/auth/handlers/register.js';
+import { tokenHandler } from '@modelcontextprotocol/sdk/server/auth/handlers/token.js';
+import express, {} from 'express';
+/**
+ * Build the minimal Express sub-app for the self-hosted authorization server (OA-2,
+ * [ADR 0042](../../../../docs/decisions/0042-self-hosted-oauth-authorization-server.md)). It composes the MCP
+ * SDK's **individual** handlers — `authorize`, `token`, `register` (DCR) — rather than the whole
+ * `mcpAuthRouter`, because that router's protected-resource metadata is single-resource and we keep OA-1's
+ * dynamic per-tenant PRM in the raw `node:http` front-door. Authorization-server metadata (RFC 8414) + JWKS +
+ * the Google callback + the consent endpoint are added here. The app is a `(req, res)` listener the
+ * front-door delegates to for {@link isAuthServerPath} paths.
+ */
+export function createOAuthApp(provider) {
+    const app = express();
+    app.disable('x-powered-by');
+    app.use('/authorize', authorizationHandler({ provider }));
+    app.use('/token', tokenHandler({ provider }));
+    app.use('/register', clientRegistrationHandler({ clientsStore: provider.clientsStore }));
+    // RFC 8414 AS metadata + JWKS — fetched cross-origin by web MCP clients, so allow any origin.
+    app.get('/.well-known/oauth-authorization-server', allowCors, (_req, res) => {
+        res.json(provider.metadata());
+    });
+    app.get('/.well-known/jwks.json', allowCors, (_req, res) => {
+        void provider
+            .jwks()
+            .then((jwks) => res.json(jwks))
+            .catch(() => res.status(500).json({ error: 'server_error' }));
+    });
+    // Google federation callback + the mandatory consent decision (confused-deputy mitigation).
+    app.get('/oauth/google/callback', (req, res) => {
+        void provider.handleGoogleCallback(req, res).catch(() => failPlain(res));
+    });
+    app.post('/oauth/consent', express.urlencoded({ extended: false }), (req, res) => {
+        void provider.handleConsent(req, res).catch(() => failPlain(res));
+    });
+    return app;
+}
+function allowCors(_req, res, next) {
+    res.setHeader('Access-Control-Allow-Origin', '*');
+    next();
+}
+function failPlain(res) {
+    if (!res.headersSent)
+        res.status(500).type('text/plain').send('internal error');
+}
+export { isAuthServerPath } from './paths.js';
+//# sourceMappingURL=app.js.map

package/node_modules/@noodle-borg/service/dist/oauth/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/oauth/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,yBAAyB,EAAE,MAAM,4DAA4D,CAAC;AACvG,OAAO,EAAE,YAAY,EAAE,MAAM,yDAAyD,CAAC;AACvF,OAAO,OAAO,EAAE,EAA6C,MAAM,SAAS,CAAC;AAG7E;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAA6B;IAC1D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAE5B,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC1D,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC9C,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,yBAAyB,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAEzF,8FAA8F;IAC9F,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC7F,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC5E,KAAK,QAAQ;aACV,IAAI,EAAE;aACN,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAC9B,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,4FAA4F;IAC5F,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAChE,KAAK,QAAQ,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CACN,gBAAgB,EAChB,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvC,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9B,KAAK,QAAQ,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC,CACF,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,IAAa,EAAE,GAAa,EAAE,IAAgB;IAC/D,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC;AACT,CAAC;AAED,SAAS,SAAS,CAAC,GAAa;IAC9B,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAClF,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/consent.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The consent interstitial (OA-2, [ADR 0042]). **Required**, not optional: because the authorization server
+ * federates every dynamically-registered client through one static Google client, the MCP 2025-11-25 spec
+ * mandates explicit per-client user consent before issuing a code (confused-deputy mitigation). The page
+ * shows the requesting client and where the code will be sent, so the owner can refuse an unfamiliar app.
+ */
+export interface ConsentPageInput {
+    readonly clientName: string;
+    readonly resourceHost: string;
+    readonly redirectHost: string;
+    readonly userEmail: string;
+    /** Signed, short-lived token carrying the full authorization context (tamper-proof). */
+    readonly consentToken: string;
+    /** Where the Approve/Deny form POSTs (the AS consent endpoint). */
+    readonly consentAction: string;
+}
+export declare function renderConsentPage(input: ConsentPageInput): string;
+//# sourceMappingURL=consent.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/consent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.d.ts","sourceRoot":"","sources":["../../src/oauth/consent.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wFAAwF;IACxF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAWD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CA6CjE"}

package/node_modules/@noodle-borg/service/dist/oauth/consent.js

@@ -0,0 +1,55 @@
+function esc(value) {
+    return value
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+export function renderConsentPage(input) {
+    const client = esc(input.clientName);
+    const resource = esc(input.resourceHost);
+    const redirect = esc(input.redirectHost);
+    const email = esc(input.userEmail);
+    const token = esc(input.consentToken);
+    const action = esc(input.consentAction);
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>Authorize access</title>
+<style>
+  :root { color-scheme: light dark; }
+  body { font: 15px/1.5 system-ui, sans-serif; max-width: 30rem; margin: 4rem auto; padding: 0 1rem; }
+  .card { border: 1px solid #8884; border-radius: 12px; padding: 1.5rem; }
+  h1 { font-size: 1.15rem; margin: 0 0 1rem; }
+  dl { margin: 1rem 0; }
+  dt { color: #888; font-size: .8rem; }
+  dd { margin: 0 0 .75rem; font-weight: 600; word-break: break-all; }
+  .row { display: flex; gap: .75rem; margin-top: 1.5rem; }
+  button { flex: 1; padding: .6rem 1rem; border-radius: 8px; border: 1px solid #8884; font: inherit; cursor: pointer; }
+  button.approve { background: #1d9e75; color: #fff; border-color: #1d9e75; }
+</style>
+</head>
+<body>
+  <div class="card">
+    <h1>Authorize access to your server</h1>
+    <p>The application <strong>${client}</strong> is requesting access to your Noodle MCP server, acting as <strong>${email}</strong>.</p>
+    <dl>
+      <dt>MCP server</dt><dd>${resource}</dd>
+      <dt>Sign-in will redirect to</dt><dd>${redirect}</dd>
+    </dl>
+    <p>Only approve if you recognize this application.</p>
+    <form method="post" action="${action}">
+      <input type="hidden" name="consent_token" value="${token}" />
+      <div class="row">
+        <button type="submit" name="decision" value="deny">Deny</button>
+        <button type="submit" name="decision" value="approve" class="approve">Approve</button>
+      </div>
+    </form>
+  </div>
+</body>
+</html>`;
+}
+//# sourceMappingURL=consent.js.map

package/node_modules/@noodle-borg/service/dist/oauth/consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../src/oauth/consent.ts"],"names":[],"mappings":"AAiBA,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAuB;IACvD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACxC,OAAO;;;;;;;;;;;;;;;;;;;;;;iCAsBwB,MAAM,+EAA+E,KAAK;;+BAE5F,QAAQ;6CACM,QAAQ;;;kCAGnB,MAAM;yDACiB,KAAK;;;;;;;;QAQtD,CAAC;AACT,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/google.d.ts

@@ -0,0 +1,31 @@
+/** A verified upstream human identity from "Sign in with Google". */
+export interface GoogleIdentity {
+    readonly subject: string;
+    readonly email: string;
+}
+/**
+ * The Google-federation leg of the authorization server (OA-2,
+ * [ADR 0042](../../../../docs/decisions/0042-self-hosted-oauth-authorization-server.md)): the AS authenticates
+ * the human via Google, then issues its own Noodle tokens. Injectable so tests can supply a fake without a
+ * live Google round-trip; production uses {@link GoogleOAuthAuthenticator} (`google-auth-library`, the same
+ * library the control plane already uses — [ADR 0039]).
+ */
+export interface GoogleAuthenticator {
+    /** The "Sign in with Google" URL to redirect the user-agent to, carrying our `state` nonce. */
+    authorizationUrl(state: string): string;
+    /** Exchange Google's authorization `code` for the verified user identity (or throw on failure). */
+    exchange(code: string): Promise<GoogleIdentity>;
+}
+export interface GoogleOAuthConfig {
+    readonly clientId: string;
+    readonly clientSecret: string;
+    /** The AS's own Google callback URL (e.g. `https://borg.noodleseed.com/oauth/google/callback`). */
+    readonly redirectUri: string;
+}
+export declare class GoogleOAuthAuthenticator implements GoogleAuthenticator {
+    #private;
+    constructor(config: GoogleOAuthConfig);
+    authorizationUrl(state: string): string;
+    exchange(code: string): Promise<GoogleIdentity>;
+}
+//# sourceMappingURL=google.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/google.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../src/oauth/google.ts"],"names":[],"mappings":"AAEA,qEAAqE;AACrE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,+FAA+F;IAC/F,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACxC,mGAAmG;IACnG,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mGAAmG;IACnG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,qBAAa,wBAAyB,YAAW,mBAAmB;;gBAItD,MAAM,EAAE,iBAAiB;IASrC,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAWjC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;CActD"}