noodleseed-cli 0.1.4

package/dist/deploy.js

@@ -0,0 +1,182 @@
+import { existsSync, mkdirSync, readFileSync, symlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, dirname, extname, join, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import ts from 'typescript';
+export const DEFAULT_SERVICE_URL = 'http://127.0.0.1:8787';
+const SECRET_ENV_PREFIX = 'NOODLE_SECRET_';
+/**
+ * Read a manifest file and POST it to a deploy service. Returns the deployed server's id + endpoint URL,
+ * or a structured failure (unreachable service, or a `4xx` with compile errors).
+ */
+export async function deploy(options) {
+    const service = (options.serviceUrl ?? DEFAULT_SERVICE_URL).replace(/\/+$/, '');
+    const org = slug(options.org ?? 'local');
+    const app = slug(options.app ?? basename(options.manifestPath, extname(options.manifestPath)));
+    const env = slug(options.env ?? 'prod');
+    const doFetch = options.fetchImpl ?? fetch;
+    let manifest;
+    let connectors;
+    let secrets;
+    try {
+        const input = await readDeployInput(options.manifestPath);
+        manifest = input.manifest;
+        // An explicit --connectors file overrides any catalog an authored server emits.
+        if (options.connectorsPath !== undefined) {
+            connectors = readFileSync(options.connectorsPath, 'utf8');
+        }
+        else if (input.connectors !== undefined) {
+            connectors = input.connectors;
+        }
+        secrets = loadSecrets(options.secretsPath, options.secretsEnv ?? process.env);
+    }
+    catch (error) {
+        return { ok: false, status: 0, message: `cannot read input file: ${error.message}` };
+    }
+    let res;
+    try {
+        res = await doFetch(`${service}/v1/orgs/${org}/apps/${app}/envs/${env}/deploy`, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                ...(options.authToken ? { authorization: `Bearer ${options.authToken}` } : {}),
+            },
+            body: JSON.stringify({
+                manifest,
+                ...(connectors !== undefined ? { connectors } : {}),
+                ...(secrets !== undefined ? { secrets } : {}),
+                ...(options.accessMode ? { accessMode: options.accessMode } : {}),
+            }),
+        });
+    }
+    catch (error) {
+        return {
+            ok: false,
+            status: 0,
+            message: `could not reach the deploy service at ${service}: ${error.message}`,
+        };
+    }
+    const body = (await res.json().catch(() => ({})));
+    if (res.status === 201 && body.ok && body.deploymentId && body.url) {
+        return {
+            ok: true,
+            deploymentId: body.deploymentId,
+            url: body.url,
+            accessMode: parseAccessMode(body.accessMode),
+            ...(body.callerKey !== undefined ? { callerKey: body.callerKey } : {}),
+        };
+    }
+    if (res.status === 401) {
+        return {
+            ok: false,
+            status: 401,
+            message: 'deploy unauthorized — set --auth-token or MRDN_AUTH_TOKEN',
+        };
+    }
+    return {
+        ok: false,
+        status: res.status,
+        message: body.error ?? `deploy failed (HTTP ${res.status})`,
+        ...(body.errors ? { errors: body.errors } : {}),
+    };
+}
+function parseAccessMode(value) {
+    return value === 'owner-only' || value === 'org-members' ? value : 'caller-key';
+}
+function slug(value) {
+    const out = value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '') || 'app';
+    return out;
+}
+/**
+ * Collect deploy-time secret *values* from a local `--secrets` JSON file and/or `NOODLE_SECRET_<NAME>`
+ * environment variables, with env overriding the file. Returns `undefined` when nothing is supplied, so
+ * the deploy body omits `secrets` entirely. Secret values never touch the catalog or manifest — they ride
+ * this side channel only. Throws on a malformed file (caught by `deploy` and surfaced without any value).
+ */
+export function loadSecrets(secretsPath, env) {
+    const out = {};
+    if (secretsPath !== undefined) {
+        const parsed = JSON.parse(readFileSync(secretsPath, 'utf8'));
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+            throw new Error('secrets file must be a JSON object of string values');
+        }
+        for (const [name, value] of Object.entries(parsed)) {
+            if (typeof value !== 'string')
+                throw new Error(`secret "${name}" must be a string`);
+            out[name] = value;
+        }
+    }
+    // Env overrides the file: NOODLE_SECRET_<NAME> binds the ref <NAME> verbatim.
+    for (const [key, value] of Object.entries(env)) {
+        if (key.startsWith(SECRET_ENV_PREFIX) && value !== undefined) {
+            out[key.slice(SECRET_ENV_PREFIX.length)] = value;
+        }
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+/**
+ * Read a deploy input into `{ manifest, connectors? }`. A `.yaml`/`.json` manifest is taken verbatim; an
+ * authored `.ts`/`.js` server is loaded and emits both its manifest and (if it has `.compute()` operations)
+ * a connector catalog, so authoring a compute server in TypeScript deploys in one command.
+ *
+ * Exported so `validate` reuses the exact same input-loading path as `deploy` (including the `server.ts`
+ * authoring leg), keeping author-time validation faithful to what a deploy would compile.
+ */
+export async function readDeployInput(path) {
+    const ext = extname(path);
+    if (ext === '.ts' || ext === '.mts') {
+        return loadAuthored(await transpileAuthoringFile(path));
+    }
+    if (ext === '.js' || ext === '.mjs') {
+        prepareAuthoringModuleDir(dirname(path));
+        return loadAuthored(path);
+    }
+    return { manifest: readFileSync(path, 'utf8') };
+}
+async function transpileAuthoringFile(path) {
+    const source = readFileSync(path, 'utf8');
+    const out = ts.transpileModule(source, {
+        compilerOptions: {
+            module: ts.ModuleKind.ES2022,
+            target: ts.ScriptTarget.ES2022,
+            moduleResolution: ts.ModuleResolutionKind.NodeNext,
+            esModuleInterop: true,
+        },
+        fileName: path,
+    });
+    const dir = join(tmpdir(), `noodle-authoring-${process.pid}`);
+    mkdirSync(dir, { recursive: true });
+    prepareAuthoringModuleDir(dir);
+    const compiled = join(dir, `${basename(path, extname(path))}-${Date.now()}.mjs`);
+    writeFileSync(compiled, out.outputText);
+    return compiled;
+}
+function prepareAuthoringModuleDir(dir) {
+    const modules = join(dir, 'node_modules');
+    if (!existsSync(modules))
+        symlinkSync(packageNodeModules(), modules, 'dir');
+}
+function packageNodeModules() {
+    return resolve(dirname(fileURLToPath(import.meta.url)), '..', 'node_modules');
+}
+async function loadAuthored(path) {
+    const mod = (await import(pathToFileURL(path).href));
+    const value = mod.default ?? mod.manifest;
+    if (isServerDefinition(value)) {
+        const manifest = JSON.stringify(await value.toManifest());
+        const catalog = value.toConnectorCatalog?.();
+        return { manifest, ...(catalog ? { connectors: JSON.stringify(catalog) } : {}) };
+    }
+    if (typeof value === 'object' && value !== null)
+        return { manifest: JSON.stringify(value) };
+    throw new Error('authoring module must export a server definition or manifest object');
+}
+function isServerDefinition(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        typeof value.toManifest === 'function');
+}
+//# sourceMappingURL=deploy.js.map

package/dist/deploy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy.js","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAyB3D,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAkB3C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAsB;IACjD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAE3C,IAAI,QAAgB,CAAC;IACrB,IAAI,UAA8B,CAAC;IACnC,IAAI,OAA2C,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC1B,gFAAgF;QAChF,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACzC,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAC5D,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC1C,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QAChC,CAAC;QACD,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,2BAA4B,KAAe,CAAC,OAAO,EAAE,EAAE,CAAC;IAClG,CAAC;IAED,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,OAAO,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,EAAE;YAC9E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/E;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,QAAQ;gBACR,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,yCAAyC,OAAO,KAAM,KAAe,CAAC,OAAO,EAAE;SACzF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAQ/C,CAAC;IAEF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACnE,OAAO;YACL,EAAE,EAAE,IAAI;YACR,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,2DAA2D;SACrE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,IAAI,CAAC,KAAK,IAAI,uBAAuB,GAAG,CAAC,MAAM,GAAG;QAC3D,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;AACJ,CAAC;AAID,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC;AAClF,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,MAAM,GAAG,GACP,KAAK;SACF,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,WAA+B,EAC/B,GAAsB;IAEtB,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAY,CAAC;QACxE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;YAC9E,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;YACpF,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7D,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC;QACnD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY;IAEZ,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACpC,OAAO,YAAY,CAAC,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACpC,yBAAyB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,IAAY;IAChD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE;QACrC,eAAe,EAAE;YACf,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM;YAC5B,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM;YAC9B,gBAAgB,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ;YAClD,eAAe,EAAE,IAAI;SACtB;QACD,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9D,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACjF,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IACxC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAW;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,WAAW,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAA8C,CAAC;IAClG,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC;IAC1C,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC7C,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5F,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IAIxC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAQ,KAAkC,CAAC,UAAU,KAAK,UAAU,CACrE,CAAC;AACJ,CAAC"}

package/dist/dev.d.ts

@@ -0,0 +1,50 @@
+export interface DevOptions {
+    readonly manifestPath: string;
+    readonly connectorsPath?: string;
+    readonly secretsPath?: string;
+    readonly org?: string;
+    readonly app?: string;
+    readonly env?: string;
+    /** Local port; default `0` (OS-assigned). */
+    readonly port?: number;
+    /** Source of `NOODLE_SECRET_*` values; defaults to `process.env`. */
+    readonly secretsEnv?: NodeJS.ProcessEnv;
+    /** Enable the readline "exercise a tool" prompt; defaults to whether stdin is a TTY. */
+    readonly interactive?: boolean;
+    /** Watch the input files and hot-reload on change; default `true`. Tests disable it and call `reload()`. */
+    readonly watch?: boolean;
+    /** Output sink; defaults to `console.log`. */
+    readonly log?: (message: string) => void;
+}
+export interface DevReloadResult {
+    readonly ok: boolean;
+    /** Tool names exposed after a successful reload. */
+    readonly toolNames?: readonly string[];
+    /** Compile errors when the reload failed (the prior good server keeps serving). */
+    readonly errors?: ReadonlyArray<{
+        code: string;
+        path: string;
+        message: string;
+        didYouMean?: string;
+    }>;
+}
+export interface DevHandle {
+    /** The tenant MCP URL the dev server serves. */
+    readonly url: string;
+    /** The caller key (stable across reloads); set once the first deploy succeeds. */
+    readonly callerKey: string | undefined;
+    /** The local service origin. */
+    readonly origin: string;
+    /** Recompile + re-serve the manifest, keeping the same caller key. */
+    reload(): Promise<DevReloadResult>;
+    /** Stop watching, close the prompt, and shut the local server down. */
+    close(): Promise<void>;
+}
+/**
+ * Boot the Noodle runtime **in-process** on loopback (auth-open, in-memory — no Postgres, no master key),
+ * serve a single manifest at a stable local MCP URL, and hot-reload it on file change while keeping the same
+ * caller key. The optional readline prompt exercises **this** dev server (a single in-process MCP call); it
+ * is not a general client. Designed for the author inner loop — `wrangler dev` for Noodle servers.
+ */
+export declare function dev(options: DevOptions): Promise<DevHandle>;
+//# sourceMappingURL=dev.d.ts.map

package/dist/dev.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev.d.ts","sourceRoot":"","sources":["../src/dev.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,4GAA4G;IAC5G,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,8CAA8C;IAC9C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1C;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,oDAAoD;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,mFAAmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;QAC9B,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,SAAS;IACxB,gDAAgD;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kFAAkF;IAClF,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,gCAAgC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,MAAM,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IACnC,uEAAuE;IACvE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAmED;;;;;GAKG;AACH,wBAAsB,GAAG,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA4KjE"}

package/dist/dev.js

@@ -0,0 +1,223 @@
+import { readFileSync, watch } from 'node:fs';
+import { basename, dirname, extname, resolve } from 'node:path';
+import { createInterface } from 'node:readline';
+import { serveService } from '@noodle-borg/service';
+import { loadSecrets, readDeployInput } from './deploy.js';
+const PROTOCOL = '2025-11-25';
+const ACCEPT = 'application/json, text/event-stream';
+/** A default app slug that prefers the containing directory when the file is a generic `manifest`/`server`. */
+function defaultApp(manifestPath) {
+    const base = basename(manifestPath, extname(manifestPath));
+    if (base === 'manifest' || base === 'server' || base === 'index') {
+        return basename(dirname(resolve(manifestPath)));
+    }
+    return base;
+}
+function slug(value) {
+    return (value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '') || 'app');
+}
+function buildMcpUrl(origin, org, app, env) {
+    return env === 'prod' ? `${origin}/o/${org}/${app}/mcp` : `${origin}/o/${org}/${app}/${env}/mcp`;
+}
+function parseBody(text) {
+    if (!text)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        for (const line of text.split(/\r?\n/)) {
+            const m = line.match(/^data:\s*(.*)$/);
+            if (m?.[1]) {
+                try {
+                    return JSON.parse(m[1]);
+                }
+                catch {
+                    /* keep scanning */
+                }
+            }
+        }
+        return undefined;
+    }
+}
+/** A single stateless MCP POST against the local dev endpoint (no init/session needed). */
+async function mcpCall(endpoint, callerKey, method, params) {
+    const res = await fetch(endpoint, {
+        method: 'POST',
+        headers: {
+            'content-type': 'application/json',
+            accept: ACCEPT,
+            'mcp-protocol-version': PROTOCOL,
+            ...(callerKey ? { authorization: `Bearer ${callerKey}` } : {}),
+        },
+        body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params }),
+    });
+    const text = await res.text();
+    return {
+        status: res.status,
+        body: parseBody(text),
+    };
+}
+/**
+ * Boot the Noodle runtime **in-process** on loopback (auth-open, in-memory — no Postgres, no master key),
+ * serve a single manifest at a stable local MCP URL, and hot-reload it on file change while keeping the same
+ * caller key. The optional readline prompt exercises **this** dev server (a single in-process MCP call); it
+ * is not a general client. Designed for the author inner loop — `wrangler dev` for Noodle servers.
+ */
+export async function dev(options) {
+    const log = options.log ?? ((m) => console.log(m));
+    const org = slug(options.org ?? 'local');
+    const app = slug(options.app ?? defaultApp(options.manifestPath));
+    const env = slug(options.env ?? 'dev');
+    const secretsEnv = options.secretsEnv ?? process.env;
+    const service = await serveService({
+        host: '127.0.0.1',
+        port: options.port ?? 0,
+    });
+    const url = buildMcpUrl(service.url, org, app, env);
+    let callerKey;
+    async function deployOnce() {
+        let manifest;
+        let connectors;
+        let secrets;
+        try {
+            const input = await readDeployInput(options.manifestPath);
+            manifest = input.manifest;
+            connectors =
+                options.connectorsPath !== undefined
+                    ? readFileSync(options.connectorsPath, 'utf8')
+                    : input.connectors;
+            secrets = loadSecrets(options.secretsPath, secretsEnv);
+        }
+        catch (error) {
+            return {
+                ok: false,
+                errors: [{ code: 'read_error', path: '', message: error.message }],
+            };
+        }
+        // reuseCallerKey: keep the same key across reloads (first deploy has no prior, so it mints).
+        const result = await service.registry.deploy({ org, app, env }, manifest, connectors, secrets, undefined, 'caller-key', true);
+        if (!result.ok) {
+            return {
+                ok: false,
+                errors: result.errors,
+            };
+        }
+        if (result.callerKey !== undefined)
+            callerKey = result.callerKey;
+        const list = await mcpCall(url, callerKey, 'tools/list', {});
+        const tools = list.body?.result?.tools ?? [];
+        return { ok: true, toolNames: tools.map((t) => t.name) };
+    }
+    function printErrors(errors) {
+        log(`  ✗ ${errors?.length ?? 0} error(s):`);
+        for (const e of errors ?? []) {
+            log(`    ${e.code}${e.path ? ` at ${e.path}` : ''}: ${e.message}`);
+            if (e.didYouMean !== undefined)
+                log(`      did you mean "${e.didYouMean}"?`);
+        }
+    }
+    // Initial deploy.
+    const first = await deployOnce();
+    log(`Noodle dev server listening at ${service.url}`);
+    log(`MCP endpoint:  ${url}`);
+    if (first.ok) {
+        if (callerKey !== undefined)
+            log(`Caller key:    ${callerKey}`);
+        log(`Tools:         ${(first.toolNames ?? []).join(', ') || '(none)'}`);
+    }
+    else {
+        printErrors(first.errors);
+    }
+    // Hot-reload on file change (debounced — fs.watch fires multiple events per save).
+    const watchers = [];
+    let timer;
+    async function reload() {
+        const r = await deployOnce();
+        if (r.ok)
+            log(`↻ reloaded — tools: ${(r.toolNames ?? []).join(', ') || '(none)'}`);
+        else {
+            log('↻ reload failed — keeping the last good server:');
+            printErrors(r.errors);
+        }
+        return r;
+    }
+    if (options.watch !== false) {
+        const files = [options.manifestPath, options.connectorsPath, options.secretsPath].filter((f) => typeof f === 'string');
+        for (const file of files) {
+            try {
+                watchers.push(watch(file, () => {
+                    if (timer)
+                        clearTimeout(timer);
+                    timer = setTimeout(() => {
+                        void reload();
+                    }, 120);
+                }));
+            }
+            catch {
+                /* a missing optional file is fine */
+            }
+        }
+        if (files.length > 0)
+            log(`Watching ${files.length} file(s) — edit and save to reload. Ctrl-C to stop.`);
+    }
+    // Interactive "exercise this dev server" prompt (TTY only; never a general client).
+    let rl;
+    if (options.interactive ?? Boolean(process.stdin.isTTY)) {
+        rl = createInterface({ input: process.stdin, output: process.stdout });
+        log('Type "<tool> <jsonArgs>" to call a tool, or an empty line to list tools.');
+        rl.on('line', (line) => {
+            const trimmed = line.trim();
+            void (async () => {
+                if (trimmed === '') {
+                    const r = await mcpCall(url, callerKey, 'tools/list', {});
+                    const tools = r.body?.result?.tools ?? [];
+                    log(`tools: ${tools.map((t) => t.name).join(', ') || '(none)'}`);
+                    return;
+                }
+                const sp = trimmed.indexOf(' ');
+                const name = sp === -1 ? trimmed : trimmed.slice(0, sp);
+                const argText = sp === -1 ? '{}' : trimmed.slice(sp + 1).trim() || '{}';
+                let args;
+                try {
+                    args = JSON.parse(argText);
+                }
+                catch (error) {
+                    log(`  invalid JSON arguments: ${error.message}`);
+                    return;
+                }
+                const r = await mcpCall(url, callerKey, 'tools/call', { name, arguments: args });
+                if (r.body?.error !== undefined)
+                    log(`  error: ${JSON.stringify(r.body.error)}`);
+                else {
+                    const result = r.body?.result;
+                    log(`  ${JSON.stringify(result?.structuredContent ?? result?.content ?? result, null, 2)}`);
+                }
+            })();
+        });
+        // Bridge a prompt Ctrl-C to a process SIGINT so the runner's shutdown path fires once.
+        rl.on('SIGINT', () => {
+            process.emit('SIGINT');
+        });
+    }
+    return {
+        url,
+        get callerKey() {
+            return callerKey;
+        },
+        origin: service.url,
+        reload,
+        close: async () => {
+            if (timer)
+                clearTimeout(timer);
+            for (const w of watchers)
+                w.close();
+            rl?.close();
+            await service.close();
+        },
+    };
+}
+//# sourceMappingURL=dev.js.map

package/dist/dev.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev.js","sourceRoot":"","sources":["../src/dev.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,YAAY,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,eAAe,EAAkB,MAAM,eAAe,CAAC;AAChE,OAAO,EAAuB,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,QAAQ,GAAG,YAAY,CAAC;AAC9B,MAAM,MAAM,GAAG,qCAAqC,CAAC;AA+CrD,+GAA+G;AAC/G,SAAS,UAAU,CAAC,YAAoB;IACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAC3D,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACjE,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,CACL,KAAK;SACF,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,KAAK,CACpC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,GAAW,EAAE,GAAW,EAAE,GAAW;IACxE,OAAO,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,MAAM,GAAG,IAAI,GAAG,IAAI,GAAG,MAAM,CAAC;AACnG,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACvC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACP,mBAAmB;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,OAAO,CACpB,QAAgB,EAChB,SAA6B,EAC7B,MAAc,EACd,MAA+B;IAE/B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,MAAM;YACd,sBAAsB,EAAE,QAAQ;YAChC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;KAChE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,SAAS,CAAC,IAAI,CAAsD;KAC3E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAmB;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC;IAErD,MAAM,OAAO,GAAmB,MAAM,YAAY,CAAC;QACjD,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC;KACxB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACpD,IAAI,SAA6B,CAAC;IAElC,KAAK,UAAU,UAAU;QACvB,IAAI,QAAgB,CAAC;QACrB,IAAI,UAA8B,CAAC;QACnC,IAAI,OAA2C,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC1D,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;YAC1B,UAAU;gBACR,OAAO,CAAC,cAAc,KAAK,SAAS;oBAClC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC;oBAC9C,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;YACvB,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC;aAC9E,CAAC;QACJ,CAAC;QAED,6FAA6F;QAC7F,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAC1C,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EACjB,QAAQ,EACR,UAAU,EACV,OAAO,EACP,SAAS,EACT,YAAY,EACZ,IAAI,CACL,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,MAAM,CAAC,MAKb;aACH,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;YAAE,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAEjE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,KAAK,GACR,IAAI,CAAC,IAAI,EAAE,MAA0D,EAAE,KAAK,IAAI,EAAE,CAAC;QACtF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IAC3D,CAAC;IAED,SAAS,WAAW,CAAC,MAAiC;QACpD,GAAG,CAAC,OAAO,MAAM,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;YAC7B,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;gBAAE,GAAG,CAAC,uBAAuB,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAED,kBAAkB;IAClB,MAAM,KAAK,GAAG,MAAM,UAAU,EAAE,CAAC;IACjC,GAAG,CAAC,kCAAkC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,GAAG,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QACb,IAAI,SAAS,KAAK,SAAS;YAAE,GAAG,CAAC,kBAAkB,SAAS,EAAE,CAAC,CAAC;QAChE,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC1E,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,mFAAmF;IACnF,MAAM,QAAQ,GAAgB,EAAE,CAAC;IACjC,IAAI,KAAiC,CAAC;IACtC,KAAK,UAAU,MAAM;QACnB,MAAM,CAAC,GAAG,MAAM,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,EAAE;YAAE,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;aAC9E,CAAC;YACJ,GAAG,CAAC,iDAAiD,CAAC,CAAC;YACvD,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,CACtF,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,QAAQ,CAAC,IAAI,CACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE;oBACf,IAAI,KAAK;wBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;oBAC/B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;wBACtB,KAAK,MAAM,EAAE,CAAC;oBAChB,CAAC,EAAE,GAAG,CAAC,CAAC;gBACV,CAAC,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,qCAAqC;YACvC,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAClB,GAAG,CAAC,YAAY,KAAK,CAAC,MAAM,qDAAqD,CAAC,CAAC;IACvF,CAAC;IAED,oFAAoF;IACpF,IAAI,EAAyB,CAAC;IAC9B,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACvE,GAAG,CAAC,0EAA0E,CAAC,CAAC;QAChF,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACrB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;oBACnB,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;oBAC1D,MAAM,KAAK,GACR,CAAC,CAAC,IAAI,EAAE,MAA0D,EAAE,KAAK,IAAI,EAAE,CAAC;oBACnF,GAAG,CAAC,UAAU,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;oBACjE,OAAO;gBACT,CAAC;gBACD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAChC,MAAM,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxD,MAAM,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;gBACxE,IAAI,IAA6B,CAAC;gBAClC,IAAI,CAAC;oBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;gBACxD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,GAAG,CAAC,6BAA8B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC7D,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,SAAS;oBAAE,GAAG,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;qBAC5E,CAAC;oBACJ,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAEV,CAAC;oBACd,GAAG,CACD,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,iBAAiB,IAAI,MAAM,EAAE,OAAO,IAAI,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CACvF,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,CAAC,CAAC;QACH,uFAAuF;QACvF,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACnB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,GAAG;QACH,IAAI,SAAS;YACX,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,MAAM;QACN,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,KAAK,MAAM,CAAC,IAAI,QAAQ;gBAAE,CAAC,CAAC,KAAK,EAAE,CAAC;YACpC,EAAE,EAAE,KAAK,EAAE,CAAC;YACZ,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { run } from './cli.js';
+export { appendServer, clearConfig, configPath, type MrdnConfig, maskToken, readConfig, readServers, resolveAuthToken, resolveServiceUrl, type SavedServer, serversPath, writeConfig, } from './config.js';
+export { DEFAULT_SERVICE_URL, type DeployOptions, type DeployOutcome, deploy } from './deploy.js';
+export { type DevHandle, type DevOptions, type DevReloadResult, dev } from './dev.js';
+export { type ValidateOptions, type ValidateOutcome, type ValidationIssue, validate, } from './validate.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EACL,YAAY,EACZ,WAAW,EACX,UAAU,EACV,KAAK,UAAU,EACf,SAAS,EACT,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,WAAW,EAChB,WAAW,EACX,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClG,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,UAAU,EAAE,KAAK,eAAe,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AACtF,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,QAAQ,GACT,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,6 @@
+export { run } from './cli.js';
+export { appendServer, clearConfig, configPath, maskToken, readConfig, readServers, resolveAuthToken, resolveServiceUrl, serversPath, writeConfig, } from './config.js';
+export { DEFAULT_SERVICE_URL, deploy } from './deploy.js';
+export { dev } from './dev.js';
+export { validate, } from './validate.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EACL,YAAY,EACZ,WAAW,EACX,UAAU,EAEV,SAAS,EACT,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EAEjB,WAAW,EACX,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAA0C,MAAM,EAAE,MAAM,aAAa,CAAC;AAClG,OAAO,EAAyD,GAAG,EAAE,MAAM,UAAU,CAAC;AACtF,OAAO,EAIL,QAAQ,GACT,MAAM,eAAe,CAAC"}

package/dist/validate.d.ts

@@ -0,0 +1,37 @@
+/**
+ * A single author-time validation problem. A structural superset of both the compiler's {@link CompileError}
+ * and the connector catalog's compile error, so manifest and connector failures print uniformly. The
+ * generation-friendly hints (`didYouMean`/`suggestions`/`docAnchor`) appear only when the underlying error
+ * offers them.
+ */
+export interface ValidationIssue {
+    readonly code: string;
+    readonly path: string;
+    readonly message: string;
+    readonly didYouMean?: string;
+    readonly suggestions?: readonly string[];
+    readonly docAnchor?: string;
+}
+export interface ValidateOptions {
+    readonly manifestPath: string;
+    /** Optional declarative connector-catalog file; when present, operation references are resolved against it. */
+    readonly connectorsPath?: string;
+}
+export type ValidateOutcome = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    /** Which stage rejected: reading the input, compiling connectors, or compiling the manifest. */
+    readonly stage: 'read' | 'connectors' | 'manifest';
+    readonly errors: readonly ValidationIssue[];
+};
+/**
+ * Compile a manifest (and optional connector catalog) **locally**, exactly as the deploy service does
+ * ({@link compile} with an {@link InMemoryCatalog} built from {@link compileConnectors}) — but without a
+ * running service, network, or secrets. Returns `ok` or the structured errors the deploy plane would emit,
+ * so an author gets instant, faithful feedback (schema shape, naming, expressions, and connector/operation
+ * reference resolution with `didYouMean`). Secret-value binding is a deploy-time concern and is not checked
+ * here. Pure: reads files and returns a result; never writes or exits.
+ */
+export declare function validate(options: ValidateOptions): Promise<ValidateOutcome>;
+//# sourceMappingURL=validate.d.ts.map

package/dist/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAUA;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,+GAA+G;IAC/G,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,gGAAgG;IAChG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,UAAU,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAC;CAC7C,CAAC;AAEN;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CA+BjF"}

package/dist/validate.js

@@ -0,0 +1,46 @@
+import { readFileSync } from 'node:fs';
+import { compile, InMemoryCatalog, } from '@noodle-borg/compiler';
+import { compileConnectors } from '@noodle-borg/connector-defs';
+import { readDeployInput } from './deploy.js';
+/**
+ * Compile a manifest (and optional connector catalog) **locally**, exactly as the deploy service does
+ * ({@link compile} with an {@link InMemoryCatalog} built from {@link compileConnectors}) — but without a
+ * running service, network, or secrets. Returns `ok` or the structured errors the deploy plane would emit,
+ * so an author gets instant, faithful feedback (schema shape, naming, expressions, and connector/operation
+ * reference resolution with `didYouMean`). Secret-value binding is a deploy-time concern and is not checked
+ * here. Pure: reads files and returns a result; never writes or exits.
+ */
+export async function validate(options) {
+    let manifest;
+    let connectors;
+    try {
+        const input = await readDeployInput(options.manifestPath);
+        manifest = input.manifest;
+        if (options.connectorsPath !== undefined) {
+            connectors = readFileSync(options.connectorsPath, 'utf8');
+        }
+        else if (input.connectors !== undefined) {
+            connectors = input.connectors;
+        }
+    }
+    catch (error) {
+        return {
+            ok: false,
+            stage: 'read',
+            errors: [{ code: 'read_error', path: '', message: error.message }],
+        };
+    }
+    let catalog = [];
+    if (connectors !== undefined && connectors.trim() !== '') {
+        const cc = compileConnectors(connectors);
+        if (!cc.ok)
+            return { ok: false, stage: 'connectors', errors: cc.errors };
+        catalog = cc.catalog;
+    }
+    const compiled = compile(manifest, { catalog: new InMemoryCatalog(catalog) });
+    if (!compiled.ok) {
+        return { ok: false, stage: 'manifest', errors: compiled.errors };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=validate.js.map

package/dist/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAGL,OAAO,EACP,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAgC9C;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAwB;IACrD,IAAI,QAAgB,CAAC;IACrB,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC1B,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACzC,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAC5D,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC1C,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC;SAC9E,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAuB,EAAE,CAAC;IACrC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACzD,MAAM,EAAE,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC,EAAE,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;QACzE,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAiC,EAAE,CAAC;IAC9F,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/node_modules/@noodle-borg/auth/dist/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `@noodle-borg/auth` — end-user OAuth primitives for the runtime as an OAuth resource server.
+ *
+ * OA-1 ships the resource-server half: a `jose`-based access-token verifier (ADR 0023) and the
+ * protected-resource-metadata helpers an MCP client uses for discovery. OA-2 ([ADR 0042]) adds the
+ * authorization-server's Express-free crypto core: signing-key custody + access-token minting. The
+ * Express-typed `OAuthServerProvider` shell and Google-federation routes live in `packages/service` so this
+ * package stays Express-free.
+ */
+export { type AccessTokenClaims, mintAccessToken } from './jwt-issuer.js';
+export { type ProtectedResourceMetadata, protectedResourceMetadata, protectedResourceMetadataUrl, } from './metadata.js';
+export { createStaticSigningKeyProvider, type SigningKey, type SigningKeyProvider, type StaticSigningKeyOptions, } from './signer.js';
+export { createJwtVerifier, type JwtVerifierConfig, type TokenVerifier, type VerifiedIdentity, } from './verify.js';
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/auth/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,KAAK,iBAAiB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EACL,KAAK,yBAAyB,EAC9B,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,8BAA8B,EAC9B,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC"}

package/node_modules/@noodle-borg/auth/dist/index.js

@@ -0,0 +1,14 @@
+/**
+ * `@noodle-borg/auth` — end-user OAuth primitives for the runtime as an OAuth resource server.
+ *
+ * OA-1 ships the resource-server half: a `jose`-based access-token verifier (ADR 0023) and the
+ * protected-resource-metadata helpers an MCP client uses for discovery. OA-2 ([ADR 0042]) adds the
+ * authorization-server's Express-free crypto core: signing-key custody + access-token minting. The
+ * Express-typed `OAuthServerProvider` shell and Google-federation routes live in `packages/service` so this
+ * package stays Express-free.
+ */
+export { mintAccessToken } from './jwt-issuer.js';
+export { protectedResourceMetadata, protectedResourceMetadataUrl, } from './metadata.js';
+export { createStaticSigningKeyProvider, } from './signer.js';
+export { createJwtVerifier, } from './verify.js';
+//# sourceMappingURL=index.js.map

package/node_modules/@noodle-borg/auth/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAA0B,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAEL,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,8BAA8B,GAI/B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,iBAAiB,GAIlB,MAAM,aAAa,CAAC"}