noodleseed-cli 0.1.4

package/node_modules/@noodle-borg/service/dist/service.d.ts

@@ -0,0 +1,221 @@
+import { type IncomingMessage, type Server, type ServerResponse } from 'node:http';
+import { type SigningKeyProvider } from '@noodle-borg/auth';
+import { SecretBox } from '@noodle-borg/runtime';
+import { type AccessMode, type Logger, type OwnerTokenVerifier, type ServedTarget, type TlsPosture } from '@noodle-borg/transport-http';
+import { type ControlPlaneIdentity, type DeployAuthGate, type GoogleIdTokenVerifier } from './auth/deploy-gate.js';
+import type { GoogleAuthenticator } from './oauth/google.js';
+import type { CloudSqlConfig } from './store/cloudsql-pool.js';
+import { type ArtifactStore, type ControlPlaneStore, type DeploymentSummary, type TenantRef } from './store.js';
+/** A deploy error from compiling either the connector catalog or the manifest. */
+export interface DeployError {
+    readonly code: string;
+    readonly path: string;
+    readonly message: string;
+}
+export type DeployResult = {
+    readonly ok: true;
+    readonly deploymentId: string;
+    readonly accessMode: AccessMode;
+    /** The once-shown caller key, present only for `caller-key` deployments (identity modes mint none). */
+    readonly callerKey?: string;
+    /**
+     * True when this deploy **reused** the prior active deployment's caller key instead of minting a new
+     * one (so `callerKey` is absent — the hash-only key was kept). Set only via the in-process
+     * `reuseCallerKey` path used by `mrdn dev`; the HTTP deploy route never reuses, so production
+     * keeps rotating the caller key on every redeploy.
+     */
+    readonly callerKeyReused?: boolean;
+} | {
+    readonly ok: false;
+    readonly errors: readonly DeployError[];
+};
+/** Outcome of {@link ServerRegistry.recover}: how many servers were rebuilt, and which records failed. */
+export interface RecoverResult {
+    readonly recovered: number;
+    readonly failed: ReadonlyArray<{
+        readonly deploymentId: string;
+        readonly errors: readonly DeployError[];
+    }>;
+}
+/**
+ * Holds deployed servers in memory and serves them by id. Each deploy compiles an optional declarative
+ * connector catalog and the manifest (against that catalog) to a resolved artifact, then registers the
+ * resolved {@link ServedArtifact} (artifact + execution deps). The wire is stateless: the transport
+ * builds a fresh SDK server per request.
+ *
+ * With an {@link ArtifactStore} (Slice 25, ADR 0027), each deploy is also persisted as its **inputs**
+ * (the compiled artifact's deps are live closures and are not serializable) so deploys survive a process
+ * bounce. Recovery is **lazy by default** (ADR 0036): {@link get} recompiles a server from the store on its
+ * first request (a cache miss), which makes any instance able to serve any deploy on a multi-instance
+ * platform. {@link recover} eagerly recompiles **all** persisted servers and is used only for the opt-in
+ * warm-all path (`serveService({ warmAll })`). Without a store, behaviour is exactly as before (in-memory
+ * only; deploys are lost on restart).
+ */
+export declare class ServerRegistry {
+    #private;
+    /**
+     * @param store optional durable store; when set, deploys are persisted and {@link recover} replays them.
+     * @param secretBox encrypts persisted secrets at rest (ADR 0028). **A file-backed `store` must be paired
+     *   with a `secretBox`** — without one, persisted secrets fall back to the interim cleartext `{enc:'none'}`
+     *   envelope. `serveService` enforces this (a `dataDir` fails closed without a master key); a caller that
+     *   constructs this directly is responsible for the same pairing.
+     */
+    constructor(store?: ArtifactStore, secretBox?: SecretBox);
+    deploy(tenant: TenantRef, manifest: string, connectors?: string, secrets?: Readonly<Record<string, string>>, actor?: ControlPlaneIdentity, accessMode?: AccessMode, 
+    /**
+     * When true and a prior active deployment exists for this tenant, reuse its caller-key **hash** instead
+     * of minting a new key (the plaintext is unrecoverable, so none is returned). Used by `mrdn dev`
+     * to keep the local key stable across hot-reloads; the HTTP deploy route never sets it, so production
+     * redeploys keep rotating the key.
+     */
+    reuseCallerKey?: boolean): Promise<DeployResult>;
+    /**
+     * Rebuild every persisted server into memory on startup. Each record is replayed through the same
+     * compile path as a fresh deploy, reusing its stored id and caller-key hash. A record that no longer
+     * compiles (e.g. source/catalog drift) is skipped and reported — the remaining servers still recover.
+     */
+    recover(): Promise<RecoverResult>;
+    /**
+     * Resolve a served server by id. A cache hit returns immediately. On a cache miss **with a durable
+     * store**, the record is point-read ({@link ArtifactStore.get}), recompiled through the shared
+     * {@link #compileTarget} path, cached, and returned — so **any instance can serve any deploy**, including
+     * one it never handled (multi-instance correctness, ADR 0036). A miss with no record resolves to
+     * `undefined` (→ `404`). A record that no longer compiles, or whose secret will not decrypt, **throws**
+     * (→ `500`) — failing only its own request, never the instance. Concurrent first-hits for the same id
+     * share one in-flight compile (single-flight).
+     */
+    get(deploymentId: string): Promise<ServedTarget | undefined>;
+    getActiveByTenant(ref: TenantRef): Promise<ServedTarget | undefined>;
+    listDeployments(filter: {
+        org: string;
+        app?: string;
+        env?: string;
+    }): Promise<readonly DeploymentSummary[]>;
+    rotateCallerKey(tenant: TenantRef): Promise<{
+        key: string;
+        deployment: DeploymentSummary;
+    } | undefined>;
+    verifyActiveCallerKey(tenant: TenantRef, token: string | null): Promise<boolean>;
+    get size(): number;
+}
+export interface ServiceOptions {
+    /** Public base URL used to build returned endpoint URLs. Defaults to the request's Host header. */
+    readonly publicBaseUrl?: string;
+    /** Maximum deploy request body size in bytes. Default 1 MiB. */
+    readonly maxBodyBytes?: number;
+    /** Gate for tenant deploy management. Defaults to {@link allowAllGate} (safe only on a loopback bind). */
+    readonly deployGate?: DeployAuthGate;
+    /** Store for org/member control-plane data. Default: in-memory, useful for localhost tests only. */
+    readonly controlPlaneStore?: ControlPlaneStore;
+    /** Structured logger for deploy + request lifecycle events. Default: a no-op logger. */
+    readonly logger?: Logger;
+    /**
+     * In-app HTTPS posture (Slice 28, ADR 0033). Applied to tenant deploy management and threaded to the
+     * tenant MCP router. Default: baseline security headers only, no enforcement.
+     */
+    readonly tls?: TlsPosture;
+    /**
+     * Readiness check for `GET /readyz` (Cloud Run / k8s startup + readiness probes): resolves `true` when
+     * the service can serve — e.g. the durable store is reachable. Default: always ready. `GET /healthz`
+     * (liveness) never calls this.
+     */
+    readonly readinessProbe?: () => Promise<boolean>;
+    /**
+     * Verify an owner access token for `owner-only` deployments (OA-1). Threaded to the MCP router's
+     * front-door. When absent, owner-only endpoints fail closed (`401`).
+     */
+    readonly verifyOwnerToken?: OwnerTokenVerifier;
+    /**
+     * The self-hosted authorization server issuer (OA-2) advertised in protected-resource metadata so an
+     * MCP client can discover where to authenticate. When unset, the metadata omits `authorization_servers`.
+     */
+    readonly authServerIssuer?: string;
+    /**
+     * The self-hosted authorization-server Express sub-app (OA-2). When set, the front-door delegates the AS
+     * paths ({@link isAuthServerPath}: `/authorize`, `/token`, `/register`, the AS metadata + JWKS, and the
+     * Google callback + consent routes) to it. Built by {@link serveService} from the `oauth` config.
+     */
+    readonly authServerApp?: (req: IncomingMessage, res: ServerResponse) => void;
+    /** Google OAuth client id advertised to the CLI for browser-based control-plane login. */
+    readonly controlPlaneGoogleClientId?: string;
+    /** Allowed Google Workspace / email domain advertised to the CLI and enforced by GoogleControlPlaneGate. */
+    readonly controlPlaneAllowedEmailDomain?: string;
+}
+/**
+ * The combined service listener: tenant-scoped deploy management plus the multi-tenant MCP router.
+ */
+export declare function createServiceHandler(registry: ServerRegistry, options?: ServiceOptions): (req: IncomingMessage, res: ServerResponse) => void;
+export interface RunningService {
+    readonly http: Server;
+    readonly url: string;
+    readonly port: number;
+    /**
+     * The in-process {@link ServerRegistry} backing this service. Exposed so an in-process host (e.g.
+     * `mrdn dev`) can register/hot-reload a single manifest directly via {@link ServerRegistry.deploy}
+     * instead of going over the HTTP deploy route.
+     */
+    readonly registry: ServerRegistry;
+    /** Recovery outcome when persistence is enabled (a `dataDir` was set); absent otherwise. */
+    readonly recovered?: RecoverResult;
+    close(): Promise<void>;
+}
+/** Start the deploy service on its own `node:http` server (used by the `noodle-service` bin). */
+export declare function serveService(options?: ServiceOptions & {
+    readonly port?: number;
+    readonly host?: string;
+    /** Google OAuth client id / OIDC audience for control-plane ID-token verification (MT-2). */
+    readonly googleClientId?: string;
+    /** Google subjects or emails allowed to manage orgs and memberships (MT-2). */
+    readonly controlPlaneAdmins?: readonly string[];
+    /** Injectable Google verifier for tests; production uses `google-auth-library`. */
+    readonly googleVerifier?: GoogleIdTokenVerifier;
+    /**
+     * Enable durable persistence + restart recovery under this data directory (Slice 25, ADR 0027).
+     * When unset (and no Postgres backend is configured), deploys are in-memory only and lost on restart.
+     */
+    readonly dataDir?: string;
+    /**
+     * Postgres connection string for the relational {@link ArtifactStore} backend (ADR 0035). When set
+     * (or `cloudSql` is set), Postgres is selected over the file/in-memory backends.
+     */
+    readonly databaseUrl?: string;
+    /**
+     * Cloud SQL connector target (GCP, IAM DB auth — ADR 0034/0035). Selects the Postgres backend.
+     */
+    readonly cloudSql?: CloudSqlConfig;
+    /**
+     * Base64-encoded 32-byte master key that encrypts persisted secrets at rest (Slice 26, ADR 0028).
+     * **Required whenever a durable store is enabled** (`dataDir`, `databaseUrl`, or `cloudSql`) unless
+     * `kmsKeyName` is set — the service refuses to boot without a master-key custodian (fail closed).
+     */
+    readonly secretMasterKey?: string;
+    /**
+     * Cloud KMS cryptoKey resource name for KEK custody (ADR 0037): the KEK never enters the process — KMS
+     * wraps a fresh per-record data key (v2 envelope encryption). **Takes precedence over `secretMasterKey`.**
+     * One of the two is required whenever a durable store is enabled. The `@google-cloud/kms` SDK is loaded
+     * lazily, only when this is set.
+     */
+    readonly kmsKeyName?: string;
+    /**
+     * Eagerly recompile every persisted server on boot and report failures, instead of the default lazy
+     * recompile-on-first-request (ADR 0036). For a single-instance / on-prem deploy that prefers fail-fast
+     * boot validation; leave off on a multi-instance platform (Cloud Run).
+     */
+    readonly warmAll?: boolean;
+    /**
+     * Enable the self-hosted OAuth authorization server (OA-2,
+     * [ADR 0042](../../../docs/decisions/0042-self-hosted-oauth-authorization-server.md)). When set, the AS
+     * routes are served (DCR + PKCE, federating login to Google), the issuer is advertised in
+     * protected-resource metadata, and owner-only tokens are verified in-process against the signing key.
+     * The OAuth state store is the shared Postgres store when persistence is on, else in-memory.
+     */
+    readonly oauth?: {
+        /** The AS issuer — its public origin (e.g. `https://borg.noodleseed.com`). HTTPS, no path/query. */
+        readonly issuer: string;
+        readonly signer: SigningKeyProvider;
+        readonly google: GoogleAuthenticator;
+        /** Restrict authorizing users to this email domain during alpha (e.g. `@noodleseed.com`). */
+        readonly allowedEmailDomain?: string;
+    };
+}): Promise<RunningService>;
+//# sourceMappingURL=service.d.ts.map

package/node_modules/@noodle-borg/service/dist/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,MAAM,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjG,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EAKL,SAAS,EAEV,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,UAAU,EAMf,KAAK,MAAM,EAGX,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,UAAU,EAEhB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,cAAc,EAEnB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAG7D,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EAMtB,KAAK,SAAS,EAIf,MAAM,YAAY,CAAC;AAOpB,kFAAkF;AAClF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,YAAY,GACpB;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,uGAAuG;IACvG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAA;CAAE,CAAC;AAEpE,0GAA0G;AAC1G,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;KACzC,CAAC,CAAC;CACJ;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,cAAc;;IASzB;;;;;;OAMG;gBACS,KAAK,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,SAAS;IAKlD,MAAM,CACV,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC1C,KAAK,CAAC,EAAE,oBAAoB,EAC5B,UAAU,GAAE,UAAyB;IACrC;;;;;OAKG;IACH,cAAc,UAAQ,GACrB,OAAO,CAAC,YAAY,CAAC;IAwHxB;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC;IAkFvC;;;;;;;;OAQG;IACG,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAa5D,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IASpE,eAAe,CAAC,MAAM,EAAE;QAC5B,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC;IAsBnC,eAAe,CACnB,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,iBAAiB,CAAA;KAAE,GAAG,SAAS,CAAC;IA2BhE,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IA8CtF,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AA+GD,MAAM,WAAW,cAAc;IAC7B,mGAAmG;IACnG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,gEAAgE;IAChE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,0GAA0G;IAC1G,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IACrC,oGAAoG;IACpG,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,wFAAwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;IAC7E,0FAA0F;IAC1F,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C,4GAA4G;IAC5G,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CAClD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,cAAc,EACxB,OAAO,GAAE,cAAmB,GAC3B,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAuIrD;AAsaD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,4FAA4F;IAC5F,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,iGAAiG;AACjG,wBAAsB,YAAY,CAChC,OAAO,GAAE,cAAc,GAAG;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,6FAA6F;IAC7F,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,mFAAmF;IACnF,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,oGAAoG;QACpG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;QACpC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;QACrC,6FAA6F;QAC7F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;KACtC,CAAC;CACE,GACL,OAAO,CAAC,cAAc,CAAC,CA+JzB"}