@noodleseed/one 0.16.0 → 0.17.0

package/node_modules/@noodle-borg/service/dist/routes/envs.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The `envs` resource read routes: `GET /v1/orgs/{org}/apps/{app}/envs` (list) and
+ * `GET /v1/orgs/{org}/apps/{app}/envs/{env}` (inspect). Membership-gated exactly like the `apps`
+ * routes (`authorizeTenantControl`); the response payload is `.parse()`d through the Zod contracts
+ * (`./contracts.js`) before it goes on the wire, so the shape can never drift from what's declared
+ * there. Contract-parse failures return 500 via `sendContract` (our bug, not the caller's); store
+ * lookups keep 400. No pagination — env counts per app are small.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { DeployAuthGate } from '../auth/deploy-gate.js';
+import type { ServerRegistry } from '../registry.js';
+import type { ControlPlaneStore } from '../store.js';
+export declare function handleEnvs(req: IncomingMessage, res: ServerResponse, registry: ServerRegistry, gate: DeployAuthGate, controlPlane: ControlPlaneStore, ref: {
+    org: string;
+    app: string;
+}, url: URL, endpointBase: string): Promise<void>;
+export declare function handleEnv(req: IncomingMessage, res: ServerResponse, registry: ServerRegistry, gate: DeployAuthGate, controlPlane: ControlPlaneStore, ref: {
+    org: string;
+    app: string;
+    env: string;
+}, endpointBase: string): Promise<void>;
+//# sourceMappingURL=envs.d.ts.map

package/node_modules/@noodle-borg/service/dist/routes/envs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envs.d.ts","sourceRoot":"","sources":["../../src/routes/envs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAMrD,wBAAsB,UAAU,CAC9B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACjC,GAAG,EAAE,GAAG,EACR,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED,wBAAsB,SAAS,CAC7B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAC9C,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAYf"}

package/node_modules/@noodle-borg/service/dist/routes/envs.js

@@ -0,0 +1,46 @@
+import { sendJson } from '../http-util.js';
+import { sendContract } from './apps.js';
+import { EnvResponseSchema, EnvsListResponseSchema } from './contracts.js';
+import { authorizeTenantControl } from './control-plane.js';
+import { envWithEndpointUrl } from './endpoint-enrichment.js';
+export async function handleEnvs(req, res, registry, gate, controlPlane, ref, url, endpointBase) {
+    const identity = await authorizeTenantControl(req, res, gate, controlPlane, ref.org);
+    if (identity === false)
+        return;
+    const includeArchived = url.searchParams.get('archived') === 'true';
+    let envs;
+    try {
+        // Distinguish "app has no envs yet" (200, empty list) from "app does not exist" (404) — the same
+        // way `handleApp` treats a missing `getApp` result as not-found.
+        const app = await registry.getApp(ref.org, ref.app);
+        if (app === undefined)
+            return sendJson(res, 404, { error: 'not found' });
+        envs = await registry.listEnvironments(ref.org, ref.app, {
+            ...(includeArchived ? { includeArchived: true } : {}),
+        });
+    }
+    catch (error) {
+        return sendJson(res, 400, { error: error.message });
+    }
+    return sendContract(res, () => EnvsListResponseSchema.parse({
+        ok: true,
+        data: { envs: envs.map((env) => envWithEndpointUrl(env, endpointBase)) },
+    }));
+}
+export async function handleEnv(req, res, registry, gate, controlPlane, ref, endpointBase) {
+    const identity = await authorizeTenantControl(req, res, gate, controlPlane, ref.org);
+    if (identity === false)
+        return;
+    let env;
+    try {
+        env = await registry.getEnvironment(ref.org, ref.app, ref.env);
+    }
+    catch (error) {
+        return sendJson(res, 400, { error: error.message });
+    }
+    if (env === undefined)
+        return sendJson(res, 404, { error: 'not found' });
+    const enriched = envWithEndpointUrl(env, endpointBase);
+    return sendContract(res, () => EnvResponseSchema.parse({ ok: true, data: enriched }));
+}
+//# sourceMappingURL=envs.js.map

package/node_modules/@noodle-borg/service/dist/routes/envs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envs.js","sourceRoot":"","sources":["../../src/routes/envs.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAG3C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAoB,EACpB,GAAmB,EACnB,QAAwB,EACxB,IAAoB,EACpB,YAA+B,EAC/B,GAAiC,EACjC,GAAQ,EACR,YAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACrF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,MAAM,eAAe,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC;IACpE,IAAI,IAA6D,CAAC;IAClE,IAAI,CAAC;QACH,iGAAiG;QACjG,iEAAiE;QACjE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACzE,IAAI,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE;YACvD,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAC5B,sBAAsB,CAAC,KAAK,CAAC;QAC3B,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,EAAE;KACzE,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAoB,EACpB,GAAmB,EACnB,QAAwB,EACxB,IAAoB,EACpB,YAA+B,EAC/B,GAA8C,EAC9C,YAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACrF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,IAAI,GAA0D,CAAC;IAC/D,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACvD,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AACxF,CAAC"}

package/node_modules/@noodle-borg/service/dist/routes/github-connection.d.ts

@@ -0,0 +1,29 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { DeployAuthGate } from '../auth/deploy-gate.js';
+import type { GitHubAppClient, GithubAppConfig } from '../github/app-client.js';
+import type { PendingGithubInstallationStore } from '../github/pending-installations.js';
+import type { AuditSink } from '../store/audit.js';
+import type { ControlPlaneStore, GithubConnectionStore } from '../store.js';
+export interface GithubConnectionRouteRef {
+    readonly org: string;
+    readonly app: string;
+}
+export declare function handleGithubConnection(req: IncomingMessage, res: ServerResponse, gate: DeployAuthGate, controlPlane: ControlPlaneStore, store: GithubConnectionStore, client: GitHubAppClient | undefined, githubApp: GithubAppConfig | undefined, maxBody: number, ref: GithubConnectionRouteRef, audit: AuditSink): Promise<void>;
+/**
+ * `GET /v1/github/install-url` — authenticated (any identity, membership is checked later at claim/connect
+ * time); `?org=`/`?app=` name the target. Returns GitHub's installations/new URL plus an HMAC-signed,
+ * 10-minute `state` nonce binding `{subject, org, app, issuedAt}` so a later `claim` can only be completed
+ * by the same caller for the same org/app. 409 when the GitHub App is not configured.
+ */
+export declare function handleGithubInstallUrl(req: IncomingMessage, res: ServerResponse, gate: DeployAuthGate, githubApp: GithubAppConfig | undefined, url: URL): Promise<void>;
+/**
+ * `POST /v1/github/installations/claim` — verifies the `state` nonce (signature, expiry, and that the
+ * caller is the same subject who requested it), then requires the caller to be an org OWNER of the
+ * nonce's bound org before returning the installation's repositories for the client to pick from. Any
+ * nonce problem (tampered, expired, foreign subject) is a 403 with no state change. The installationId
+ * is derived EXCLUSIVELY from the pending store entry GitHub's setup redirect landed for this state —
+ * never from the request body — so a caller can only ever enumerate the installation they themselves
+ * just installed, not an arbitrary tenant's (409 when the redirect hasn't landed).
+ */
+export declare function handleGithubInstallationClaim(req: IncomingMessage, res: ServerResponse, gate: DeployAuthGate, controlPlane: ControlPlaneStore, client: GitHubAppClient | undefined, githubApp: GithubAppConfig | undefined, pendingStore: PendingGithubInstallationStore, maxBody: number): Promise<void>;
+//# sourceMappingURL=github-connection.d.ts.map

package/node_modules/@noodle-borg/service/dist/routes/github-connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-connection.d.ts","sourceRoot":"","sources":["../../src/routes/github-connection.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAMhF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AAEzF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAM5E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,KAAK,EAAE,qBAAqB,EAC5B,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,SAAS,EAAE,eAAe,GAAG,SAAS,EACtC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,wBAAwB,EAC7B,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,IAAI,CAAC,CAOf;AA0ID;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,SAAS,EAAE,eAAe,GAAG,SAAS,EACtC,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,SAAS,EAAE,eAAe,GAAG,SAAS,EACtC,YAAY,EAAE,8BAA8B,EAC5C,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CA2Bf"}

package/node_modules/@noodle-borg/service/dist/routes/github-connection.js

@@ -0,0 +1,202 @@
+/**
+ * GHD-1 GitHub repository connection routes: `GET`/`POST`/`DELETE
+ * /v1/orgs/{org}/apps/{app}/github/connection`, plus the installation hand-off
+ * `GET /v1/github/install-url` and `POST /v1/github/installations/claim`. Membership rules mirror the
+ * org-admin routes exactly (`authorizeTenantControl` for member reads, `canManageMembers` for owner-only
+ * writes) — this file is the security review point for GHD-1.2. The server NEVER trusts caller-supplied
+ * repo metadata: `POST .../connection` always re-derives `ownerLogin`/`repoName`/`defaultBranch` from the
+ * {@link GitHubAppClient}, and no route here ever persists a token.
+ */
+import { randomUUID } from 'node:crypto';
+import { resolveGithubStateSecret, signInstallNonce, verifyInstallNonce, } from '../github/install-nonce.js';
+import { readJsonBody, sendForbidden, sendJson } from '../http-util.js';
+import { sendContract } from './apps.js';
+import { GithubConnectionResponseSchema, GithubInstallUrlResponseSchema } from './contracts.js';
+import { authorizeControlPlane, authorizeTenantControl } from './control-plane.js';
+import { canManageMembers } from './org-admin.js';
+export async function handleGithubConnection(req, res, gate, controlPlane, store, client, githubApp, maxBody, ref, audit) {
+    if (req.method === 'GET')
+        return handleGet(req, res, gate, controlPlane, store, ref);
+    if (req.method === 'POST') {
+        return handlePost(req, res, gate, controlPlane, store, client, githubApp, maxBody, ref, audit);
+    }
+    if (req.method === 'DELETE')
+        return handleDelete(req, res, gate, controlPlane, store, ref, audit);
+    return sendJson(res, 404, { error: 'not found' });
+}
+/** `GET .../github/connection` — org MEMBER read; 404 when no connection is enabled. */
+async function handleGet(req, res, gate, controlPlane, store, ref) {
+    const identity = await authorizeTenantControl(req, res, gate, controlPlane, ref.org);
+    if (identity === false)
+        return;
+    const record = await store.getRepoConnection(ref.org, ref.app);
+    if (record === undefined)
+        return sendJson(res, 404, { error: 'not found' });
+    return sendContract(res, () => GithubConnectionResponseSchema.parse({ ok: true, data: record }));
+}
+/**
+ * `POST .../github/connection` — org OWNER only. Verifies the installation exists AND the repository
+ * belongs to it via the {@link GitHubAppClient} before writing anything (a mismatch is a 400 with no
+ * state change); fills `ownerLogin`/`repoName`/`defaultBranch` from the client, never from the request
+ * body. Uniqueness conflicts (same app already connected to a different repo, or vice versa) are a 409.
+ */
+async function handlePost(req, res, gate, controlPlane, store, client, githubApp, maxBody, ref, audit) {
+    const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
+    if (identity === false)
+        return;
+    if (!(await canManageMembers(controlPlane, ref.org, identity)))
+        return sendForbidden(res, 'forbidden');
+    if (githubApp?.appSlug === undefined) {
+        return sendJson(res, 409, { error: 'the GitHub App is not configured for this service' });
+    }
+    if (client === undefined) {
+        return sendJson(res, 409, {
+            error: 'the GitHub App client is not configured for this service',
+        });
+    }
+    const body = await readJsonBody(req, maxBody);
+    if (!body.ok)
+        return sendJson(res, body.status, { error: body.error });
+    const parsed = body.value;
+    if (!isPositiveInteger(parsed.installationId)) {
+        return sendJson(res, 400, { error: '"installationId" must be a positive integer' });
+    }
+    if (!isPositiveInteger(parsed.githubRepositoryId)) {
+        return sendJson(res, 400, { error: '"githubRepositoryId" must be a positive integer' });
+    }
+    if (parsed.repoRoot !== undefined && typeof parsed.repoRoot !== 'string') {
+        return sendJson(res, 400, { error: '"repoRoot" must be a string' });
+    }
+    const installationId = parsed.installationId;
+    const githubRepositoryId = parsed.githubRepositoryId;
+    const repoRoot = typeof parsed.repoRoot === 'string' ? parsed.repoRoot : undefined;
+    const installation = await client.getInstallation(installationId);
+    if (installation === undefined) {
+        return sendJson(res, 400, { error: `installation ${installationId} not found` });
+    }
+    const repositories = await client.listInstallationRepositories(installationId);
+    const repository = repositories.find((candidate) => candidate.id === githubRepositoryId);
+    if (repository === undefined) {
+        return sendJson(res, 400, {
+            error: `repository ${githubRepositoryId} does not belong to installation ${installationId}`,
+        });
+    }
+    const result = await store.upsertRepoConnection({
+        githubRepositoryId,
+        installationId,
+        ownerLogin: installation.accountLogin,
+        repoName: repository.fullName,
+        defaultBranch: repository.defaultBranch,
+        ...(repoRoot !== undefined ? { repoRoot } : {}),
+        orgSlug: ref.org,
+        appSlug: ref.app,
+        createdBySubject: identity.subject,
+    });
+    if (!result.ok)
+        return sendJson(res, 409, { error: result.error.message });
+    await audit.emit({
+        eventType: 'github.connection.connected',
+        org: ref.org,
+        app: ref.app,
+        decision: 'allow',
+        status: 200,
+        actorSubject: identity.subject,
+        ...(identity.email !== undefined ? { actorEmail: identity.email } : {}),
+        details: { githubRepositoryId, installationId },
+    });
+    return sendContract(res, () => GithubConnectionResponseSchema.parse({ ok: true, data: result.record }));
+}
+/** `DELETE .../github/connection` — org OWNER only; idempotent disable. */
+async function handleDelete(req, res, gate, controlPlane, store, ref, audit) {
+    const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
+    if (identity === false)
+        return;
+    if (!(await canManageMembers(controlPlane, ref.org, identity)))
+        return sendForbidden(res, 'forbidden');
+    const disabled = await store.disableRepoConnection(ref.org, ref.app);
+    if (disabled) {
+        await audit.emit({
+            eventType: 'github.connection.disabled',
+            org: ref.org,
+            app: ref.app,
+            decision: 'allow',
+            status: 200,
+            actorSubject: identity.subject,
+            ...(identity.email !== undefined ? { actorEmail: identity.email } : {}),
+            details: {},
+        });
+    }
+    return sendJson(res, 200, { ok: true, data: { disabled } });
+}
+/**
+ * `GET /v1/github/install-url` — authenticated (any identity, membership is checked later at claim/connect
+ * time); `?org=`/`?app=` name the target. Returns GitHub's installations/new URL plus an HMAC-signed,
+ * 10-minute `state` nonce binding `{subject, org, app, issuedAt}` so a later `claim` can only be completed
+ * by the same caller for the same org/app. 409 when the GitHub App is not configured.
+ */
+export async function handleGithubInstallUrl(req, res, gate, githubApp, url) {
+    const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
+    if (identity === false)
+        return;
+    if (githubApp?.appSlug === undefined) {
+        return sendJson(res, 409, { error: 'the GitHub App is not configured for this service' });
+    }
+    const orgParam = url.searchParams.get('org');
+    const appParam = url.searchParams.get('app');
+    if (orgParam === null || appParam === null) {
+        return sendJson(res, 400, { error: '"org" and "app" query parameters are required' });
+    }
+    const secret = resolveGithubStateSecret(githubApp.webhookSecret);
+    const state = signInstallNonce({
+        nonceId: randomUUID(),
+        subject: identity.subject,
+        org: orgParam,
+        app: appParam,
+        issuedAt: Date.now(),
+    }, secret);
+    const installUrl = `https://github.com/apps/${encodeURIComponent(githubApp.appSlug)}/installations/new?state=${encodeURIComponent(state)}`;
+    return sendContract(res, () => GithubInstallUrlResponseSchema.parse({ ok: true, data: { installUrl, state } }));
+}
+/**
+ * `POST /v1/github/installations/claim` — verifies the `state` nonce (signature, expiry, and that the
+ * caller is the same subject who requested it), then requires the caller to be an org OWNER of the
+ * nonce's bound org before returning the installation's repositories for the client to pick from. Any
+ * nonce problem (tampered, expired, foreign subject) is a 403 with no state change. The installationId
+ * is derived EXCLUSIVELY from the pending store entry GitHub's setup redirect landed for this state —
+ * never from the request body — so a caller can only ever enumerate the installation they themselves
+ * just installed, not an arbitrary tenant's (409 when the redirect hasn't landed).
+ */
+export async function handleGithubInstallationClaim(req, res, gate, controlPlane, client, githubApp, pendingStore, maxBody) {
+    const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
+    if (identity === false)
+        return;
+    const body = await readJsonBody(req, maxBody);
+    if (!body.ok)
+        return sendJson(res, body.status, { error: body.error });
+    const parsed = body.value;
+    if (typeof parsed.state !== 'string')
+        return sendJson(res, 400, { error: '"state" must be a string' });
+    const secret = resolveGithubStateSecret(githubApp?.webhookSecret);
+    const verification = verifyInstallNonce(parsed.state, secret);
+    if (!verification.ok || verification.payload.subject !== identity.subject) {
+        return sendForbidden(res, 'invalid or expired state');
+    }
+    if (!(await canManageMembers(controlPlane, verification.payload.org, identity))) {
+        return sendForbidden(res, 'forbidden');
+    }
+    if (client === undefined) {
+        return sendJson(res, 409, {
+            error: 'the GitHub App client is not configured for this service',
+        });
+    }
+    const installationId = pendingStore.get(parsed.state);
+    if (installationId === undefined) {
+        return sendJson(res, 409, { error: 'the GitHub installation has not landed yet' });
+    }
+    const repositories = await client.listInstallationRepositories(installationId);
+    return sendJson(res, 200, { ok: true, data: { installationId, repositories } });
+}
+function isPositiveInteger(value) {
+    return typeof value === 'number' && Number.isInteger(value) && value > 0;
+}
+//# sourceMappingURL=github-connection.js.map

package/node_modules/@noodle-borg/service/dist/routes/github-connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-connection.js","sourceRoot":"","sources":["../../src/routes/github-connection.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAGxE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,8BAA8B,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAOlD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAoB,EACpB,GAAmB,EACnB,IAAoB,EACpB,YAA+B,EAC/B,KAA4B,EAC5B,MAAmC,EACnC,SAAsC,EACtC,OAAe,EACf,GAA6B,EAC7B,KAAgB;IAEhB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACrF,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAClG,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,SAAS,CACtB,GAAoB,EACpB,GAAmB,EACnB,IAAoB,EACpB,YAA+B,EAC/B,KAA4B,EAC5B,GAA6B;IAE7B,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACrF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC5E,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AACnG,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CACvB,GAAoB,EACpB,GAAmB,EACnB,IAAoB,EACpB,YAA+B,EAC/B,KAA4B,EAC5B,MAAmC,EACnC,SAAsC,EACtC,OAAe,EACf,GAA6B,EAC7B,KAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC5D,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACzC,IAAI,SAAS,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACxB,KAAK,EAAE,0DAA0D;SAClE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAInB,CAAC;IACF,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9C,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAClD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACzE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IAC7C,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;IACrD,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAEnF,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;IAClE,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,cAAc,YAAY,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,cAAc,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAAC;IACzF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACxB,KAAK,EAAE,cAAc,kBAAkB,oCAAoC,cAAc,EAAE;SAC5F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAAC;QAC9C,kBAAkB;QAClB,cAAc;QACd,UAAU,EAAE,YAAY,CAAC,YAAY;QACrC,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,GAAG,CAAC,GAAG;QAChB,OAAO,EAAE,GAAG,CAAC,GAAG;QAChB,gBAAgB,EAAE,QAAQ,CAAC,OAAO;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAE3E,MAAM,KAAK,CAAC,IAAI,CAAC;QACf,SAAS,EAAE,6BAA6B;QACxC,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,GAAG;QACX,YAAY,EAAE,QAAQ,CAAC,OAAO;QAC9B,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,EAAE,EAAE,kBAAkB,EAAE,cAAc,EAAE;KAChD,CAAC,CAAC;IACH,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAC5B,8BAA8B,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,YAAY,CACzB,GAAoB,EACpB,GAAmB,EACnB,IAAoB,EACpB,YAA+B,EAC/B,KAA4B,EAC5B,GAA6B,EAC7B,KAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC5D,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACrE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,CAAC,IAAI,CAAC;YACf,SAAS,EAAE,4BAA4B;YACvC,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,GAAG;YACX,YAAY,EAAE,QAAQ,CAAC,OAAO;YAC9B,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAoB,EACpB,GAAmB,EACnB,IAAoB,EACpB,SAAsC,EACtC,GAAQ;IAER,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,IAAI,SAAS,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,gBAAgB,CAC5B;QACE,OAAO,EAAE,UAAU,EAAE;QACrB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,EACD,MAAM,CACP,CAAC;IACF,MAAM,UAAU,GAAG,2BAA2B,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,4BAA4B,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3I,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAC5B,8BAA8B,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,CAChF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,GAAoB,EACpB,GAAmB,EACnB,IAAoB,EACpB,YAA+B,EAC/B,MAAmC,EACnC,SAAsC,EACtC,YAA4C,EAC5C,OAAe;IAEf,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAA4B,CAAC;IACjD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAClC,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,YAAY,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC1E,OAAO,aAAa,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACxB,KAAK,EAAE,0DAA0D;SAClE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,cAAc,CAAC,CAAC;IAC/E,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAC3E,CAAC"}

package/node_modules/@noodle-borg/service/dist/routes/github-dispatch.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Dispatch for the GHD-1 GitHub connection routes. Extracted the same way as
+ * `resource-read-dispatch.ts`/`analytics-dispatch.ts` so `service.ts` stays a thin composition root
+ * under the size gate.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { TlsPosture } from '@noodle-borg/transport-http';
+import type { DeployAuthGate } from '../auth/deploy-gate.js';
+import type { GitHubAppClient, GithubAppConfig } from '../github/app-client.js';
+import type { PendingGithubInstallationStore } from '../github/pending-installations.js';
+import type { AuditSink } from '../store/audit.js';
+import type { ControlPlaneStore, GithubConnectionStore } from '../store.js';
+export interface GithubDispatchDeps {
+    readonly gate: DeployAuthGate;
+    readonly controlPlane: ControlPlaneStore;
+    readonly githubConnectionStore: GithubConnectionStore;
+    readonly githubAppClient: GitHubAppClient | undefined;
+    readonly githubApp: GithubAppConfig | undefined;
+    readonly pendingGithubInstallationStore: PendingGithubInstallationStore;
+    readonly audit: AuditSink;
+    readonly maxBody: number;
+    readonly applySecurityHeaders: (res: ServerResponse, tls: TlsPosture) => void;
+    readonly enforceHttps: (req: IncomingMessage, res: ServerResponse, tls: TlsPosture) => boolean;
+    readonly sendJson: (res: ServerResponse, status: number, body: unknown) => void;
+    readonly tls: TlsPosture;
+}
+/** Try the GHD-1 GitHub routes; returns true when the request was handled (or a guard ended it). */
+export declare function dispatchGithubRoutes(req: IncomingMessage, res: ServerResponse, url: URL, deps: GithubDispatchDeps): boolean;
+//# sourceMappingURL=github-dispatch.d.ts.map

package/node_modules/@noodle-borg/service/dist/routes/github-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-dispatch.d.ts","sourceRoot":"","sources":["../../src/routes/github-dispatch.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAe5E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;IACzC,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;IACtD,QAAQ,CAAC,eAAe,EAAE,eAAe,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,8BAA8B,EAAE,8BAA8B,CAAC;IACxE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,oBAAoB,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,KAAK,IAAI,CAAC;IAC9E,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC;IAC/F,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAChF,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;CAC1B;AAED,oGAAoG;AACpG,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAiFT"}

package/node_modules/@noodle-borg/service/dist/routes/github-dispatch.js

@@ -0,0 +1,60 @@
+import { handleGithubConnection, handleGithubInstallationClaim, handleGithubInstallUrl, } from './github-connection.js';
+import { handleGithubInstallationPending, handleGithubSetup } from './github-setup.js';
+import { isGithubInstallationClaimPath, isGithubInstallationPendingPath, isGithubInstallUrlPath, isGithubSetupPath, parseGithubConnectionPath, } from './paths.js';
+/** Try the GHD-1 GitHub routes; returns true when the request was handled (or a guard ended it). */
+export function dispatchGithubRoutes(req, res, url, deps) {
+    const { applySecurityHeaders, enforceHttps, sendJson, tls } = deps;
+    const connectionRef = parseGithubConnectionPath(url.pathname);
+    if (connectionRef !== undefined &&
+        (req.method === 'GET' || req.method === 'POST' || req.method === 'DELETE')) {
+        applySecurityHeaders(res, tls);
+        if (enforceHttps(req, res, tls))
+            return true;
+        handleGithubConnection(req, res, deps.gate, deps.controlPlane, deps.githubConnectionStore, deps.githubAppClient, deps.githubApp, deps.maxBody, connectionRef, deps.audit).catch(() => {
+            if (!res.headersSent)
+                sendJson(res, 500, { error: 'internal error' });
+        });
+        return true;
+    }
+    if (isGithubInstallUrlPath(url.pathname) && req.method === 'GET') {
+        applySecurityHeaders(res, tls);
+        if (enforceHttps(req, res, tls))
+            return true;
+        handleGithubInstallUrl(req, res, deps.gate, deps.githubApp, url).catch(() => {
+            if (!res.headersSent)
+                sendJson(res, 500, { error: 'internal error' });
+        });
+        return true;
+    }
+    if (isGithubInstallationClaimPath(url.pathname) && req.method === 'POST') {
+        applySecurityHeaders(res, tls);
+        if (enforceHttps(req, res, tls))
+            return true;
+        handleGithubInstallationClaim(req, res, deps.gate, deps.controlPlane, deps.githubAppClient, deps.githubApp, deps.pendingGithubInstallationStore, deps.maxBody).catch(() => {
+            if (!res.headersSent)
+                sendJson(res, 500, { error: 'internal error' });
+        });
+        return true;
+    }
+    // GHD-1.4 CLI hand-off: the GitHub App's Setup URL landing + the CLI's install poll. See
+    // `github-setup.ts` for why these two small routes exist.
+    if (isGithubSetupPath(url.pathname) && req.method === 'GET') {
+        applySecurityHeaders(res, tls);
+        if (enforceHttps(req, res, tls))
+            return true;
+        handleGithubSetup(req, res, deps.pendingGithubInstallationStore, deps.githubApp, url);
+        return true;
+    }
+    if (isGithubInstallationPendingPath(url.pathname) && req.method === 'GET') {
+        applySecurityHeaders(res, tls);
+        if (enforceHttps(req, res, tls))
+            return true;
+        handleGithubInstallationPending(req, res, deps.gate, deps.controlPlane, deps.pendingGithubInstallationStore, deps.githubApp, url).catch(() => {
+            if (!res.headersSent)
+                sendJson(res, 500, { error: 'internal error' });
+        });
+        return true;
+    }
+    return false;
+}
+//# sourceMappingURL=github-dispatch.js.map

package/node_modules/@noodle-borg/service/dist/routes/github-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-dispatch.js","sourceRoot":"","sources":["../../src/routes/github-dispatch.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,+BAA+B,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,EAC/B,sBAAsB,EACtB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AAiBpB,oGAAoG;AACpG,MAAM,UAAU,oBAAoB,CAClC,GAAoB,EACpB,GAAmB,EACnB,GAAQ,EACR,IAAwB;IAExB,MAAM,EAAE,oBAAoB,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAEnE,MAAM,aAAa,GAAG,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9D,IACE,aAAa,KAAK,SAAS;QAC3B,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,EAC1E,CAAC;QACD,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,sBAAsB,CACpB,GAAG,EACH,GAAG,EACH,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,qBAAqB,EAC1B,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,OAAO,EACZ,aAAa,EACb,IAAI,CAAC,KAAK,CACX,CAAC,KAAK,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACjE,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YAC1E,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACzE,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,6BAA6B,CAC3B,GAAG,EACH,GAAG,EACH,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,8BAA8B,EACnC,IAAI,CAAC,OAAO,CACb,CAAC,KAAK,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yFAAyF;IACzF,0DAA0D;IAC1D,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC5D,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,8BAA8B,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,+BAA+B,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1E,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,+BAA+B,CAC7B,GAAG,EACH,GAAG,EACH,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,8BAA8B,EACnC,IAAI,CAAC,SAAS,EACd,GAAG,CACJ,CAAC,KAAK,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/node_modules/@noodle-borg/service/dist/routes/github-setup.d.ts

@@ -0,0 +1,28 @@
+/**
+ * GHD-1.4 CLI hand-off routes: `GET /v1/github/setup` lands GitHub's post-install browser redirect (the
+ * GitHub App's configured Setup URL — an operator-side, one-time App-settings field, not a code path) and
+ * `GET /v1/github/installations/pending` lets the polling CLI discover the installationId it stashed. See
+ * `../github/pending-installations.ts` for the storage rationale. Neither route touches the durable
+ * `GithubConnectionStore` — connecting still requires the owner-gated `POST .../github/connection`
+ * (`github-connection.ts`) once the CLI has picked a repository via `installations/claim`.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { DeployAuthGate } from '../auth/deploy-gate.js';
+import type { GithubAppConfig } from '../github/app-client.js';
+import type { PendingGithubInstallationStore } from '../github/pending-installations.js';
+import type { ControlPlaneStore } from '../store.js';
+/**
+ * `GET /v1/github/setup?installation_id=...&state=...` — the GitHub App's Setup URL. Unauthenticated by
+ * necessity: GitHub's redirect is a bare browser GET with no bearer token, so the signed `state` nonce is
+ * the only protection. A tampered/expired/malformed state or a missing/non-numeric `installation_id` is
+ * rejected before anything is stored — no partial/garbage pending entry is ever written.
+ */
+export declare function handleGithubSetup(_req: IncomingMessage, res: ServerResponse, pendingStore: PendingGithubInstallationStore, githubApp: GithubAppConfig | undefined, url: URL): void;
+/**
+ * `GET /v1/github/installations/pending?state=...` — the CLI's poll target. Requires the same signed-in
+ * subject who requested `install-url` (nonce subject match, mirroring `installations/claim`) and org
+ * membership on the nonce's bound org; 404 until the setup redirect has landed, 200 with
+ * `{installationId}` after.
+ */
+export declare function handleGithubInstallationPending(req: IncomingMessage, res: ServerResponse, gate: DeployAuthGate, controlPlane: ControlPlaneStore, pendingStore: PendingGithubInstallationStore, githubApp: GithubAppConfig | undefined, url: URL): Promise<void>;
+//# sourceMappingURL=github-setup.d.ts.map

package/node_modules/@noodle-borg/service/dist/routes/github-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-setup.d.ts","sourceRoot":"","sources":["../../src/routes/github-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AAEzF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAuBrD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,EACrB,GAAG,EAAE,cAAc,EACnB,YAAY,EAAE,8BAA8B,EAC5C,SAAS,EAAE,eAAe,GAAG,SAAS,EACtC,GAAG,EAAE,GAAG,GACP,IAAI,CAeN;AAED;;;;;GAKG;AACH,wBAAsB,+BAA+B,CACnD,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,YAAY,EAAE,8BAA8B,EAC5C,SAAS,EAAE,eAAe,GAAG,SAAS,EACtC,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA8Bf"}

package/node_modules/@noodle-borg/service/dist/routes/github-setup.js

@@ -0,0 +1,80 @@
+import { resolveGithubStateSecret, verifyInstallNonce } from '../github/install-nonce.js';
+import { sendForbidden, sendJson } from '../http-util.js';
+import { authorizeControlPlane } from './control-plane.js';
+const SETUP_OK_HTML = '<!doctype html><html><head><meta charset="utf-8"><title>Noodle Seed</title></head>' +
+    '<body style="font-family:system-ui,sans-serif;padding:2rem"><p>GitHub installation received. ' +
+    'You can return to your terminal.</p></body></html>';
+const SETUP_ERROR_HTML = '<!doctype html><html><head><meta charset="utf-8"><title>Noodle Seed</title></head>' +
+    '<body style="font-family:system-ui,sans-serif;padding:2rem"><p>This installation link is invalid or ' +
+    'has expired. Return to your terminal and run <code>noodle github connect</code> again.</p></body></html>';
+function sendHtml(res, status, html) {
+    res.writeHead(status, { 'content-type': 'text/html; charset=utf-8' });
+    res.end(html);
+}
+function parsePositiveInt(value) {
+    if (value === null)
+        return undefined;
+    const n = Number(value);
+    return Number.isInteger(n) && n > 0 ? n : undefined;
+}
+/**
+ * `GET /v1/github/setup?installation_id=...&state=...` — the GitHub App's Setup URL. Unauthenticated by
+ * necessity: GitHub's redirect is a bare browser GET with no bearer token, so the signed `state` nonce is
+ * the only protection. A tampered/expired/malformed state or a missing/non-numeric `installation_id` is
+ * rejected before anything is stored — no partial/garbage pending entry is ever written.
+ */
+export function handleGithubSetup(_req, res, pendingStore, githubApp, url) {
+    const state = url.searchParams.get('state');
+    const installationId = parsePositiveInt(url.searchParams.get('installation_id'));
+    if (state === null || installationId === undefined) {
+        sendHtml(res, 400, SETUP_ERROR_HTML);
+        return;
+    }
+    const secret = resolveGithubStateSecret(githubApp?.webhookSecret);
+    const verification = verifyInstallNonce(state, secret);
+    if (!verification.ok) {
+        sendHtml(res, 400, SETUP_ERROR_HTML);
+        return;
+    }
+    pendingStore.put(state, installationId);
+    sendHtml(res, 200, SETUP_OK_HTML);
+}
+/**
+ * `GET /v1/github/installations/pending?state=...` — the CLI's poll target. Requires the same signed-in
+ * subject who requested `install-url` (nonce subject match, mirroring `installations/claim`) and org
+ * membership on the nonce's bound org; 404 until the setup redirect has landed, 200 with
+ * `{installationId}` after.
+ */
+export async function handleGithubInstallationPending(req, res, gate, controlPlane, pendingStore, githubApp, url) {
+    const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
+    if (identity === false)
+        return;
+    const state = url.searchParams.get('state');
+    if (state === null) {
+        sendJson(res, 400, { error: '"state" query parameter is required' });
+        return;
+    }
+    const secret = resolveGithubStateSecret(githubApp?.webhookSecret);
+    const verification = verifyInstallNonce(state, secret);
+    if (!verification.ok || verification.payload.subject !== identity.subject) {
+        sendForbidden(res, 'invalid or expired state');
+        return;
+    }
+    if (!identity.superAdmin) {
+        const member = await controlPlane.isOrgMember({
+            org: verification.payload.org,
+            subject: identity.subject,
+        });
+        if (!member) {
+            sendForbidden(res, 'forbidden');
+            return;
+        }
+    }
+    const installationId = pendingStore.get(state);
+    if (installationId === undefined) {
+        sendJson(res, 404, { error: 'installation not landed yet' });
+        return;
+    }
+    sendJson(res, 200, { ok: true, data: { installationId } });
+}
+//# sourceMappingURL=github-setup.js.map

package/node_modules/@noodle-borg/service/dist/routes/github-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-setup.js","sourceRoot":"","sources":["../../src/routes/github-setup.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAE1F,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,MAAM,aAAa,GACjB,oFAAoF;IACpF,+FAA+F;IAC/F,oDAAoD,CAAC;AACvD,MAAM,gBAAgB,GACpB,oFAAoF;IACpF,sGAAsG;IACtG,0GAA0G,CAAC;AAE7G,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAY;IACjE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACtE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAoB;IAC5C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAqB,EACrB,GAAmB,EACnB,YAA4C,EAC5C,SAAsC,EACtC,GAAQ;IAER,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACjF,IAAI,KAAK,KAAK,IAAI,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACnD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IACD,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,GAAoB,EACpB,GAAmB,EACnB,IAAoB,EACpB,YAA+B,EAC/B,YAA4C,EAC5C,SAAsC,EACtC,GAAQ;IAER,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,YAAY,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC1E,aAAa,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC;YAC5C,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG;YAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;AAC7D,CAAC"}

package/node_modules/@noodle-borg/service/dist/routes/org-admin.d.ts

@@ -14,6 +14,11 @@ export declare function handleOrgs(req: IncomingMessage, res: ServerResponse, ga
 export declare function handleOrgUpdate(req: IncomingMessage, res: ServerResponse, gate: DeployAuthGate, controlPlane: ControlPlaneStore, maxBody: number, ref: {
     org: string;
 }, audit: AuditSink): Promise<void>;
+/** `GET /v1/orgs/{org}` — org inspect. Membership-gated like the deployments/apps routes; 404 when
+ * the org does not exist (a super-admin can reach any slug, so this is the reachable 404 case). */
+export declare function handleOrgInspect(req: IncomingMessage, res: ServerResponse, gate: DeployAuthGate, controlPlane: ControlPlaneStore, ref: {
+    org: string;
+}): Promise<void>;
 export declare function handleMembers(req: IncomingMessage, res: ServerResponse, gate: DeployAuthGate, controlPlane: ControlPlaneStore, maxBody: number, ref: {
     org: string;
     subject?: string;

package/node_modules/@noodle-borg/service/dist/routes/org-admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org-admin.d.ts","sourceRoot":"","sources":["../../src/routes/org-admin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAGnF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EACL,KAAK,iBAAiB,EAEtB,KAAK,OAAO,EAEb,MAAM,aAAa,CAAC;AAOrB,wBAAsB,UAAU,CAC9B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAsCf;AAED,0GAA0G;AAC1G,wBAAsB,eAAe,CACnC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACpB,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,EACtC,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,IAAI,CAAC,CAkGf;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,QAAQ,CAAA;CAAE,EACvD,KAAK,EAAE,SAAS,EAChB,GAAG,CAAC,EAAE,GAAG,EACT,GAAG,GAAE,MAAM,IAAuB,GACjC,OAAO,CAAC,IAAI,CAAC,CAkGf;AAWD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAGlB;AAoBD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAErE,2FAA2F;AAC3F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC"}
+{"version":3,"file":"org-admin.d.ts","sourceRoot":"","sources":["../../src/routes/org-admin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAGnF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EACL,KAAK,iBAAiB,EAEtB,KAAK,OAAO,EAEb,MAAM,aAAa,CAAC;AAQrB,wBAAsB,UAAU,CAC9B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAsCf;AAED,0GAA0G;AAC1G,wBAAsB,eAAe,CACnC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACpB,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED;mGACmG;AACnG,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GACnB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,EACtC,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,IAAI,CAAC,CAkGf;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,QAAQ,CAAA;CAAE,EACvD,KAAK,EAAE,SAAS,EAChB,GAAG,CAAC,EAAE,GAAG,EACT,GAAG,GAAE,MAAM,IAAuB,GACjC,OAAO,CAAC,IAAI,CAAC,CAkGf;AAWD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAGlB;AAoBD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAErE,2FAA2F;AAC3F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC"}

package/node_modules/@noodle-borg/service/dist/routes/org-admin.js

@@ -1,7 +1,8 @@
 import { readJsonBody, sendForbidden, sendJson } from '../http-util.js';
 import { hashToken, randomToken } from '../oauth/tokens.js';
 import { validateOrgRole, } from '../store.js';
-import { authorizeControlPlane } from './control-plane.js';
+import { OrgSummarySchema } from './contracts.js';
+import { authorizeControlPlane, authorizeTenantControl } from './control-plane.js';
 const ORG_INVITATION_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 const MAX_ORG_DISPLAY_NAME_LENGTH = 200;
 export async function handleOrgs(req, res, gate, controlPlane, maxBody) {
@@ -74,6 +75,17 @@ export async function handleOrgUpdate(req, res, gate, controlPlane, maxBody, ref
         return sendJson(res, 400, { error: error.message });
     }
 }
+/** `GET /v1/orgs/{org}` — org inspect. Membership-gated like the deployments/apps routes; 404 when
+ * the org does not exist (a super-admin can reach any slug, so this is the reachable 404 case). */
+export async function handleOrgInspect(req, res, gate, controlPlane, ref) {
+    const identity = await authorizeTenantControl(req, res, gate, controlPlane, ref.org);
+    if (identity === false)
+        return;
+    const org = await controlPlane.getOrg(ref.org);
+    if (org === undefined)
+        return sendJson(res, 404, { error: 'not found' });
+    return sendJson(res, 200, { ok: true, data: OrgSummarySchema.parse(org) });
+}
 export async function handleMembers(req, res, gate, controlPlane, maxBody, ref, audit) {
     const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
     if (identity === false)