noodleseed-cli 0.1.4

package/node_modules/@noodle-borg/service/dist/store.d.ts

@@ -0,0 +1,192 @@
+import type { SealedSecret } from '@noodle-borg/runtime';
+import type { AccessMode } from '@noodle-borg/transport-http';
+/**
+ * Secret values at rest. The compiled runtime keeps plaintext tokens in memory (the broker), but the
+ * *persisted* form is a tagged envelope. `aes-256-gcm` (Slice 26, ADR 0028) holds an AES-256-GCM
+ * {@link SealedSecret} — the production form whenever persistence is enabled. `none` is the interim
+ * plaintext form (Slice 25): still read for backward compatibility and used by non-persistent in-memory
+ * stores, but a file-backed data dir always encrypts (the service fails closed without a master key).
+ */
+export type SecretEnvelope = {
+    readonly enc: 'none';
+    readonly values: Readonly<Record<string, string>>;
+} | {
+    readonly enc: 'aes-256-gcm';
+    readonly sealed: SealedSecret;
+};
+/**
+ * The durable record for one deployed server. The compiled artifact is **not** stored — its execution
+ * deps (connector registry, broker) are live JS closures and are not serializable — so restart recovery
+ * **replays** {@link ServerRegistry.deploy} from these inputs. `deploy` is a pure, deterministic compile
+ * of the source strings, so the inputs + identity are a faithful, reproducible record.
+ */
+export interface DeployRecord {
+    /** Record format version, for forward migration of the persisted shape. Current writers emit `1`. */
+    readonly schemaVersion: number;
+    readonly deploymentId: string;
+    readonly orgSlug: string;
+    readonly appSlug: string;
+    readonly environment: string;
+    readonly deploymentVersion: number;
+    readonly active: boolean;
+    readonly serverName: string;
+    /** ISO-8601 deploy timestamp. */
+    readonly createdAt: string;
+    readonly createdBySubject?: string;
+    readonly createdByEmail?: string;
+    /**
+     * How callers authenticate to this deployment's MCP endpoint. `caller-key` (default) uses the shared
+     * per-server bearer (ADR 0030); identity modes (`owner-only`, `org-members`) require verified end-user
+     * identity and mint no caller key. Absent on legacy records, read as `caller-key`.
+     */
+    readonly accessMode?: AccessMode;
+    /**
+     * Per-server caller-key **hash** only (ADR 0030); the plaintext key is shown once and never stored.
+     * Absent for identity-based deployments, which gate on verified identity instead.
+     */
+    readonly callerKeyHash?: string;
+    readonly manifest: string;
+    readonly connectors?: string;
+    readonly secrets: SecretEnvelope;
+}
+export interface TenantRef {
+    readonly org: string;
+    readonly app: string;
+    readonly env: string;
+}
+export interface DeploymentSummary {
+    readonly deploymentId: string;
+    readonly orgSlug: string;
+    readonly appSlug: string;
+    readonly environment: string;
+    readonly active: boolean;
+    readonly serverName: string;
+    readonly createdAt: string;
+    readonly createdByEmail?: string;
+    readonly accessMode: AccessMode;
+    readonly hasCallerKey: boolean;
+}
+export type OrgRole = 'owner' | 'developer';
+export interface OrgRecord {
+    readonly slug: string;
+    readonly displayName?: string;
+    readonly createdAt: string;
+}
+export interface OrgMemberRecord {
+    readonly orgSlug: string;
+    readonly subject: string;
+    readonly email: string;
+    readonly role: OrgRole;
+    readonly createdAt: string;
+}
+export interface ControlPlaneStore {
+    createOrg(input: {
+        slug: string;
+        displayName?: string;
+    }): Promise<OrgRecord>;
+    listOrgs(): Promise<readonly OrgRecord[]>;
+    listOrgsForSubject(subject: string): Promise<readonly OrgRecord[]>;
+    addOrgMember(input: {
+        org: string;
+        subject: string;
+        email: string;
+        role: OrgRole;
+    }): Promise<OrgMemberRecord>;
+    removeOrgMember(input: {
+        org: string;
+        subject: string;
+    }): Promise<boolean>;
+    listOrgMembers(org: string): Promise<readonly OrgMemberRecord[]>;
+    isOrgMember(input: {
+        org: string;
+        subject: string;
+    }): Promise<boolean>;
+}
+/**
+ * Durable storage for deployed-server records. `append` writes (or replaces) one server's record;
+ * `loadAll` returns every current record for restart recovery. Versioning/rollback is a reserved
+ * extension over this surface (ADR 0027), not yet built.
+ */
+export interface ArtifactStore {
+    append(record: DeployRecord): Promise<void>;
+    loadAll(): Promise<readonly DeployRecord[]>;
+    /**
+     * Fetch one server's record by id, or `undefined` if absent. A point read used by lazy
+     * recompile-on-cache-miss ([ADR 0036](../../../docs/decisions/0036-stateless-registry-lazy-recompile.md)),
+     * so any instance can serve a server it never deployed. Fail-soft: a corrupt/unreadable record reads as
+     * `undefined`, never throws.
+     */
+    get(deploymentId: string): Promise<DeployRecord | undefined>;
+    getActiveByTenant(ref: TenantRef): Promise<DeployRecord | undefined>;
+    listDeployments(filter: {
+        org: string;
+        app?: string;
+        env?: string;
+    }): Promise<readonly DeploymentSummary[]>;
+    updateActiveCallerKey(ref: TenantRef, keyHash: string): Promise<DeployRecord | undefined>;
+}
+/** In-memory store: keeps records in a Map. Used by tests and as an explicit, non-persistent option. */
+export declare class InMemoryArtifactStore implements ArtifactStore {
+    #private;
+    append(record: DeployRecord): Promise<void>;
+    loadAll(): Promise<readonly DeployRecord[]>;
+    get(deploymentId: string): Promise<DeployRecord | undefined>;
+    getActiveByTenant(ref: TenantRef): Promise<DeployRecord | undefined>;
+    listDeployments(filter: {
+        org: string;
+        app?: string;
+        env?: string;
+    }): Promise<readonly DeploymentSummary[]>;
+    updateActiveCallerKey(ref: TenantRef, keyHash: string): Promise<DeployRecord | undefined>;
+}
+export declare class InMemoryControlPlaneStore implements ControlPlaneStore {
+    #private;
+    createOrg(input: {
+        slug: string;
+        displayName?: string;
+    }): Promise<OrgRecord>;
+    listOrgs(): Promise<readonly OrgRecord[]>;
+    listOrgsForSubject(subject: string): Promise<readonly OrgRecord[]>;
+    addOrgMember(input: {
+        org: string;
+        subject: string;
+        email: string;
+        role: OrgRole;
+    }): Promise<OrgMemberRecord>;
+    removeOrgMember(input: {
+        org: string;
+        subject: string;
+    }): Promise<boolean>;
+    listOrgMembers(org: string): Promise<readonly OrgMemberRecord[]>;
+    isOrgMember(input: {
+        org: string;
+        subject: string;
+    }): Promise<boolean>;
+}
+/**
+ * JSON-file store: one file per deployment at `<dataDir>/deployments/<deploymentId>.json`, written atomically
+ * (write a temp file, then `rename` over the target — no partial file is ever read). `deploymentId` is a
+ * slug + random hex suffix (`mintDeploymentId`), so it is a safe, collision-free filename. No new
+ * dependency — `node:fs/promises` only.
+ */
+export declare class JsonFileArtifactStore implements ArtifactStore {
+    #private;
+    constructor(dataDir: string);
+    append(record: DeployRecord): Promise<void>;
+    get(deploymentId: string): Promise<DeployRecord | undefined>;
+    getActiveByTenant(ref: TenantRef): Promise<DeployRecord | undefined>;
+    loadAll(): Promise<readonly DeployRecord[]>;
+    listDeployments(filter: {
+        org: string;
+        app?: string;
+        env?: string;
+    }): Promise<readonly DeploymentSummary[]>;
+    updateActiveCallerKey(ref: TenantRef, keyHash: string): Promise<DeployRecord | undefined>;
+}
+/** Minted deployment id shape (`mintDeploymentId`): a slug plus a short hex suffix; safe as a filename. */
+export declare const DEPLOYMENT_ID_PATTERN: RegExp;
+export declare const SLUG_PATTERN: RegExp;
+export declare function validateSlug(kind: 'org' | 'app' | 'env', value: string): string;
+export declare function validateTenantRef(ref: TenantRef): TenantRef;
+export declare function validateOrgRole(role: string): OrgRole;
+//# sourceMappingURL=store.d.ts.map

package/node_modules/@noodle-borg/service/dist/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAAE,GAC3E;IAAE,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,qGAAqG;IACrG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,iCAAiC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;CAClC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC;AAE5C,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7E,QAAQ,IAAI,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1C,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IACnE,YAAY,CAAC,KAAK,EAAE;QAClB,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,OAAO,CAAC;KACf,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7B,eAAe,CAAC,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC;IACjE,WAAW,CAAC,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACxE;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO,IAAI,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IAC7D,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IACrE,eAAe,CAAC,MAAM,EAAE;QACtB,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAAC;IAC1C,qBAAqB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;CAC3F;AAED,wGAAwG;AACxG,qBAAa,qBAAsB,YAAW,aAAa;;IAGzD,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3C,OAAO,IAAI,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC;IAI3C,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAI5D,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAcpE,eAAe,CAAC,MAAM,EAAE;QACtB,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC;IAiBnC,qBAAqB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;CAOhG;AAED,qBAAa,yBAA0B,YAAW,iBAAiB;;IAIjE,SAAS,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAa5E,QAAQ,IAAI,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC;IAIzC,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC;IAa5D,YAAY,CAAC,KAAK,EAAE;QACxB,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,OAAO,CAAC;KACf,GAAG,OAAO,CAAC,eAAe,CAAC;IAc5B,eAAe,CAAC,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAM1E,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC;IAShE,WAAW,CAAC,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAKvE;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,YAAW,aAAa;;gBAG7C,OAAO,EAAE,MAAM;IAIrB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAe3C,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAY5D,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAapE,OAAO,IAAI,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC;IAsBjD,eAAe,CAAC,MAAM,EAAE;QACtB,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC;IAiBnC,qBAAqB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;CAOhG;AAED,2GAA2G;AAC3G,eAAO,MAAM,qBAAqB,QAAiB,CAAC;AACpD,eAAO,MAAM,YAAY,QAA2C,CAAC;AAIrE,wBAAgB,YAAY,CAAC,IAAI,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAO/E;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,SAAS,CAM3D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAKrD"}

package/node_modules/@noodle-borg/service/dist/store.js

@@ -0,0 +1,230 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir, readdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+/** In-memory store: keeps records in a Map. Used by tests and as an explicit, non-persistent option. */
+export class InMemoryArtifactStore {
+    #records = new Map();
+    append(record) {
+        this.#records.set(record.deploymentId, record);
+        return Promise.resolve();
+    }
+    loadAll() {
+        return Promise.resolve([...this.#records.values()]);
+    }
+    get(deploymentId) {
+        return Promise.resolve(this.#records.get(deploymentId));
+    }
+    getActiveByTenant(ref) {
+        return Promise.resolve([...this.#records.values()]
+            .filter((record) => record.active &&
+            record.orgSlug === ref.org &&
+            record.appSlug === ref.app &&
+            record.environment === ref.env)
+            .sort((a, b) => b.deploymentVersion - a.deploymentVersion)[0]);
+    }
+    listDeployments(filter) {
+        const org = validateSlug('org', filter.org);
+        const app = filter.app !== undefined ? validateSlug('app', filter.app) : undefined;
+        const env = filter.env !== undefined ? validateSlug('env', filter.env) : undefined;
+        return Promise.resolve([...this.#records.values()]
+            .filter((record) => record.orgSlug === org &&
+            (app === undefined || record.appSlug === app) &&
+            (env === undefined || record.environment === env))
+            .sort((a, b) => b.deploymentVersion - a.deploymentVersion)
+            .map(deploymentSummary));
+    }
+    async updateActiveCallerKey(ref, keyHash) {
+        const active = await this.getActiveByTenant(validateTenantRef(ref));
+        if (!active)
+            return undefined;
+        const next = { ...active, callerKeyHash: keyHash };
+        this.#records.set(next.deploymentId, next);
+        return next;
+    }
+}
+export class InMemoryControlPlaneStore {
+    #orgs = new Map();
+    #members = new Map();
+    createOrg(input) {
+        const slug = validateSlug('org', input.slug);
+        const existing = this.#orgs.get(slug);
+        if (existing)
+            return Promise.resolve(existing);
+        const org = {
+            slug,
+            ...(input.displayName !== undefined ? { displayName: input.displayName } : {}),
+            createdAt: new Date().toISOString(),
+        };
+        this.#orgs.set(slug, org);
+        return Promise.resolve(org);
+    }
+    listOrgs() {
+        return Promise.resolve([...this.#orgs.values()].sort((a, b) => a.slug.localeCompare(b.slug)));
+    }
+    listOrgsForSubject(subject) {
+        const slugs = new Set([...this.#members.values()]
+            .filter((member) => member.subject === subject)
+            .map((member) => member.orgSlug));
+        return Promise.resolve([...this.#orgs.values()]
+            .filter((org) => slugs.has(org.slug))
+            .sort((a, b) => a.slug.localeCompare(b.slug)));
+    }
+    async addOrgMember(input) {
+        const org = validateSlug('org', input.org);
+        await this.createOrg({ slug: org });
+        const member = {
+            orgSlug: org,
+            subject: input.subject,
+            email: input.email.toLowerCase(),
+            role: validateOrgRole(input.role),
+            createdAt: new Date().toISOString(),
+        };
+        this.#members.set(memberKey(org, input.subject), member);
+        return member;
+    }
+    removeOrgMember(input) {
+        return Promise.resolve(this.#members.delete(memberKey(validateSlug('org', input.org), input.subject)));
+    }
+    listOrgMembers(org) {
+        const safe = validateSlug('org', org);
+        return Promise.resolve([...this.#members.values()]
+            .filter((member) => member.orgSlug === safe)
+            .sort((a, b) => a.email.localeCompare(b.email)));
+    }
+    isOrgMember(input) {
+        return Promise.resolve(this.#members.has(memberKey(validateSlug('org', input.org), input.subject)));
+    }
+}
+/**
+ * JSON-file store: one file per deployment at `<dataDir>/deployments/<deploymentId>.json`, written atomically
+ * (write a temp file, then `rename` over the target — no partial file is ever read). `deploymentId` is a
+ * slug + random hex suffix (`mintDeploymentId`), so it is a safe, collision-free filename. No new
+ * dependency — `node:fs/promises` only.
+ */
+export class JsonFileArtifactStore {
+    #dir;
+    constructor(dataDir) {
+        this.#dir = join(dataDir, 'deployments');
+    }
+    async append(record) {
+        // Defence in depth: `deploymentId` becomes a filename, so reject anything outside the minted shape
+        // (`mintDeploymentId` only ever produces `[a-z0-9-]`). Guards this public class against a caller that
+        // passes an untrusted id (no path traversal, no escaping the data dir).
+        validateTenantRef({ org: record.orgSlug, app: record.appSlug, env: record.environment });
+        if (!DEPLOYMENT_ID_PATTERN.test(record.deploymentId)) {
+            throw new Error(`invalid deploymentId for persistence: "${record.deploymentId}"`);
+        }
+        await mkdir(this.#dir, { recursive: true });
+        const target = join(this.#dir, `${record.deploymentId}.json`);
+        const tmp = `${target}.${randomUUID()}.tmp`;
+        await writeFile(tmp, `${JSON.stringify(record, null, 2)}\n`, 'utf8');
+        await rename(tmp, target);
+    }
+    async get(deploymentId) {
+        // An invalid id can never be a file we wrote; treat as absent (also closes off any traversal).
+        if (!DEPLOYMENT_ID_PATTERN.test(deploymentId))
+            return undefined;
+        try {
+            const text = await readFile(join(this.#dir, `${deploymentId}.json`), 'utf8');
+            return JSON.parse(text);
+        }
+        catch {
+            // Fail-soft: ENOENT (no such server) or a corrupt/unreadable file both read as `undefined`.
+            return undefined;
+        }
+    }
+    async getActiveByTenant(ref) {
+        validateTenantRef(ref);
+        return (await this.loadAll())
+            .filter((record) => record.active &&
+            record.orgSlug === ref.org &&
+            record.appSlug === ref.app &&
+            record.environment === ref.env)
+            .sort((a, b) => b.deploymentVersion - a.deploymentVersion)[0];
+    }
+    async loadAll() {
+        let names;
+        try {
+            names = await readdir(this.#dir);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return [];
+            throw error;
+        }
+        const records = [];
+        for (const name of names) {
+            if (!name.endsWith('.json'))
+                continue; // skip in-flight *.tmp files
+            try {
+                const text = await readFile(join(this.#dir, name), 'utf8');
+                records.push(JSON.parse(text));
+            }
+            catch {
+                // Fail-soft: a corrupt/unreadable record file must NOT crash startup — skip it and let the
+                // other servers recover. (Visibility of skipped files lands with structured logging, Slice 27.)
+            }
+        }
+        return records;
+    }
+    listDeployments(filter) {
+        const org = validateSlug('org', filter.org);
+        const app = filter.app !== undefined ? validateSlug('app', filter.app) : undefined;
+        const env = filter.env !== undefined ? validateSlug('env', filter.env) : undefined;
+        return this.loadAll().then((records) => records
+            .filter((record) => record.orgSlug === org &&
+            (app === undefined || record.appSlug === app) &&
+            (env === undefined || record.environment === env))
+            .sort((a, b) => b.deploymentVersion - a.deploymentVersion)
+            .map(deploymentSummary));
+    }
+    async updateActiveCallerKey(ref, keyHash) {
+        const active = await this.getActiveByTenant(validateTenantRef(ref));
+        if (!active)
+            return undefined;
+        const next = { ...active, callerKeyHash: keyHash };
+        await this.append(next);
+        return next;
+    }
+}
+/** Minted deployment id shape (`mintDeploymentId`): a slug plus a short hex suffix; safe as a filename. */
+export const DEPLOYMENT_ID_PATTERN = /^[a-z0-9-]+$/;
+export const SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const RESERVED_SLUGS = new Set(['deploy', 'healthz', 'readyz', 'v1', 'o', 'mcp']);
+export function validateSlug(kind, value) {
+    if (!SLUG_PATTERN.test(value) || RESERVED_SLUGS.has(value)) {
+        throw new Error(`invalid ${kind} slug "${value}"; use lowercase letters, numbers, and hyphens only`);
+    }
+    return value;
+}
+export function validateTenantRef(ref) {
+    return {
+        org: validateSlug('org', ref.org),
+        app: validateSlug('app', ref.app),
+        env: validateSlug('env', ref.env),
+    };
+}
+export function validateOrgRole(role) {
+    if (role !== 'owner' && role !== 'developer') {
+        throw new Error(`invalid org role "${role}"`);
+    }
+    return role;
+}
+function deploymentSummary(record) {
+    return {
+        deploymentId: record.deploymentId,
+        orgSlug: record.orgSlug,
+        appSlug: record.appSlug,
+        environment: record.environment,
+        active: record.active,
+        serverName: record.serverName,
+        createdAt: record.createdAt,
+        ...(record.createdByEmail !== undefined ? { createdByEmail: record.createdByEmail } : {}),
+        accessMode: record.accessMode ?? 'caller-key',
+        hasCallerKey: record.callerKeyHash !== undefined,
+    };
+}
+function memberKey(org, subject) {
+    return `${org}/${subject}`;
+}
+//# sourceMappingURL=store.js.map

package/node_modules/@noodle-borg/service/dist/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA6HjC,wGAAwG;AACxG,MAAM,OAAO,qBAAqB;IACvB,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEpD,MAAM,CAAC,MAAoB;QACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO;QACL,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,GAAG,CAAC,YAAoB;QACtB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,iBAAiB,CAAC,GAAc;QAC9B,OAAO,OAAO,CAAC,OAAO,CACpB,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;aACxB,MAAM,CACL,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,MAAM;YACb,MAAM,CAAC,OAAO,KAAK,GAAG,CAAC,GAAG;YAC1B,MAAM,CAAC,OAAO,KAAK,GAAG,CAAC,GAAG;YAC1B,MAAM,CAAC,WAAW,KAAK,GAAG,CAAC,GAAG,CACjC;aACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAChE,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,MAIf;QACC,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,OAAO,OAAO,CAAC,OAAO,CACpB,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;aACxB,MAAM,CACL,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,OAAO,KAAK,GAAG;YACtB,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,GAAG,CAAC;YAC7C,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,GAAG,CAAC,CACpD;aACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,GAAG,CAAC,CAAC,iBAAiB,CAAC;aACzD,GAAG,CAAC,iBAAiB,CAAC,CAC1B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,GAAc,EAAE,OAAe;QACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,IAAI,GAAiB,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,MAAM,OAAO,yBAAyB;IAC3B,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IACrC,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEvD,SAAS,CAAC,KAA6C;QACrD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,QAAQ;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAc;YACrB,IAAI;YACJ,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1B,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,QAAQ;QACN,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IAED,kBAAkB,CAAC,OAAe;QAChC,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;aACxB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC;aAC9C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CACnC,CAAC;QACF,OAAO,OAAO,CAAC,OAAO,CACpB,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;aACrB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;aACpC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAChD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAKlB;QACC,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACpC,MAAM,MAAM,GAAoB;YAC9B,OAAO,EAAE,GAAG;YACZ,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE;YAChC,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC;YACjC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,eAAe,CAAC,KAAuC;QACrD,OAAO,OAAO,CAAC,OAAO,CACpB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAC/E,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,GAAW;QACxB,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC,OAAO,CACpB,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;aACxB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;aAC3C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAClD,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,KAAuC;QACjD,OAAO,OAAO,CAAC,OAAO,CACpB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAC5E,CAAC;IACJ,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,qBAAqB;IACvB,IAAI,CAAS;IAEtB,YAAY,OAAe;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAoB;QAC/B,mGAAmG;QACnG,sGAAsG;QACtG,wEAAwE;QACxE,iBAAiB,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,0CAA0C,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,YAAY,OAAO,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,UAAU,EAAE,MAAM,CAAC;QAC5C,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrE,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,YAAoB;QAC5B,+FAA+F;QAC/F,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,OAAO,SAAS,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,YAAY,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7E,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,4FAA4F;YAC5F,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,GAAc;QACpC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;aAC1B,MAAM,CACL,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,MAAM;YACb,MAAM,CAAC,OAAO,KAAK,GAAG,CAAC,GAAG;YAC1B,MAAM,CAAC,OAAO,KAAK,GAAG,CAAC,GAAG;YAC1B,MAAM,CAAC,WAAW,KAAK,GAAG,CAAC,GAAG,CACjC;aACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YAClE,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAmB,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAS,CAAC,6BAA6B;YACpE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;gBAC3D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,2FAA2F;gBAC3F,gGAAgG;YAClG,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,eAAe,CAAC,MAIf;QACC,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACrC,OAAO;aACJ,MAAM,CACL,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,OAAO,KAAK,GAAG;YACtB,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,GAAG,CAAC;YAC7C,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,GAAG,CAAC,CACpD;aACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,GAAG,CAAC,CAAC,iBAAiB,CAAC;aACzD,GAAG,CAAC,iBAAiB,CAAC,CAC1B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,GAAc,EAAE,OAAe;QACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,IAAI,GAAiB,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;QACjE,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,2GAA2G;AAC3G,MAAM,CAAC,MAAM,qBAAqB,GAAG,cAAc,CAAC;AACpD,MAAM,CAAC,MAAM,YAAY,GAAG,wCAAwC,CAAC;AAErE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;AAElF,MAAM,UAAU,YAAY,CAAC,IAA2B,EAAE,KAAa;IACrE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,UAAU,KAAK,qDAAqD,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAc;IAC9C,OAAO;QACL,GAAG,EAAE,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC;QACjC,GAAG,EAAE,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC;QACjC,GAAG,EAAE,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAoB;IAC7C,OAAO;QACL,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,YAAY;QAC7C,YAAY,EAAE,MAAM,CAAC,aAAa,KAAK,SAAS;KACjD,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,OAAe;IAC7C,OAAO,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;AAC7B,CAAC"}

package/node_modules/@noodle-borg/service/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@noodle-borg/service",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "noodle-service": "./dist/main.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "dependencies": {
+    "@google-cloud/cloud-sql-connector": "^1.11.1",
+    "@google-cloud/kms": "^5.5.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@noodle-borg/auth": "0.0.0",
+    "@noodle-borg/compiler": "0.0.0",
+    "@noodle-borg/connector-defs": "0.0.0",
+    "@noodle-borg/protocol": "0.0.0",
+    "@noodle-borg/runtime": "0.0.0",
+    "@noodle-borg/transport-http": "0.0.0",
+    "express": "^5.2.1",
+    "google-auth-library": "^10.6.2",
+    "jose": "^6.2.3",
+    "pg": "^8.21.0"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.0",
+    "@types/node": "^24.0.0",
+    "@types/pg": "^8.20.0"
+  }
+}

package/node_modules/@noodle-borg/transport-http/dist/caller-auth.d.ts

@@ -0,0 +1,15 @@
+import type { IncomingMessage } from 'node:http';
+/** The `WWW-Authenticate` challenge sent with a `401` from the MCP front-door. */
+export declare const CALLER_REALM = "Bearer realm=\"mrdn\"";
+/** Mint a fresh 256-bit caller key and its at-rest hash. The plaintext key is shown once, never stored. */
+export declare function mintCallerKey(): {
+    readonly key: string;
+    readonly hash: string;
+};
+/** SHA-256 hex of a caller key — what is persisted at rest (the plaintext is never persisted). */
+export declare function hashCallerKey(key: string): string;
+/** Extract a bearer token from the `Authorization` header (scheme case-insensitive), or `null`. */
+export declare function bearerToken(req: IncomingMessage): string | null;
+/** Constant-time check that a presented key hashes to the expected stored hash. */
+export declare function verifyCallerKey(presented: string | null, expectedHash: string): boolean;
+//# sourceMappingURL=caller-auth.d.ts.map

package/node_modules/@noodle-borg/transport-http/dist/caller-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-auth.d.ts","sourceRoot":"","sources":["../src/caller-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAajD,kFAAkF;AAClF,eAAO,MAAM,YAAY,0BAAwB,CAAC;AAElD,2GAA2G;AAC3G,wBAAgB,aAAa,IAAI;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAG/E;AAED,kGAAkG;AAClG,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,mGAAmG;AACnG,wBAAgB,WAAW,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAK/D;AAED,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAKvF"}

package/node_modules/@noodle-borg/transport-http/dist/caller-auth.js

@@ -0,0 +1,38 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+/**
+ * Caller authentication for tenant MCP routes
+ * ([ADR 0030](../../../docs/decisions/0030-per-server-caller-key.md)). A deploy mints a high-entropy
+ * key, returns it **once**, and stores only its hash; every MCP request must then present
+ * `Authorization: Bearer <key>`. This is a simple shared per-server secret — NOT end-user OAuth, which
+ * remains Phase 3 ([ADR 0018](../../../docs/decisions/0018-thread-verified-end-user-identity.md)) and
+ * composes on top of (does not conflict with) this gate.
+ */
+const KEY_PREFIX = 'nbk_';
+/** The `WWW-Authenticate` challenge sent with a `401` from the MCP front-door. */
+export const CALLER_REALM = 'Bearer realm="mrdn"';
+/** Mint a fresh 256-bit caller key and its at-rest hash. The plaintext key is shown once, never stored. */
+export function mintCallerKey() {
+    const key = `${KEY_PREFIX}${randomBytes(32).toString('base64url')}`;
+    return { key, hash: hashCallerKey(key) };
+}
+/** SHA-256 hex of a caller key — what is persisted at rest (the plaintext is never persisted). */
+export function hashCallerKey(key) {
+    return createHash('sha256').update(key).digest('hex');
+}
+/** Extract a bearer token from the `Authorization` header (scheme case-insensitive), or `null`. */
+export function bearerToken(req) {
+    const header = req.headers.authorization;
+    if (typeof header !== 'string')
+        return null;
+    const match = /^Bearer[ \t]+(.+)$/i.exec(header.trim());
+    return match?.[1]?.trim() ?? null;
+}
+/** Constant-time check that a presented key hashes to the expected stored hash. */
+export function verifyCallerKey(presented, expectedHash) {
+    if (presented === null)
+        return false;
+    const a = createHash('sha256').update(presented).digest();
+    const b = Buffer.from(expectedHash, 'hex');
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+//# sourceMappingURL=caller-auth.js.map

package/node_modules/@noodle-borg/transport-http/dist/caller-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-auth.js","sourceRoot":"","sources":["../src/caller-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGvE;;;;;;;GAOG;AAEH,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B,kFAAkF;AAClF,MAAM,CAAC,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAElD,2GAA2G;AAC3G,MAAM,UAAU,aAAa;IAC3B,MAAM,GAAG,GAAG,GAAG,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IACpE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,WAAW,CAAC,GAAoB;IAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACzC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACpC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,SAAwB,EAAE,YAAoB;IAC5E,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/node_modules/@noodle-borg/transport-http/dist/examples/serve-demo.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=serve-demo.d.ts.map

package/node_modules/@noodle-borg/transport-http/dist/examples/serve-demo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve-demo.d.ts","sourceRoot":"","sources":["../../src/examples/serve-demo.ts"],"names":[],"mappings":""}