@noodleseed/one 0.16.0 → 0.18.0

package/node_modules/@noodle-borg/service/dist/github/install-nonce.d.ts

@@ -0,0 +1,23 @@
+export declare function resolveGithubStateSecret(webhookSecret: string | undefined): string;
+export interface InstallNoncePayload {
+    /**
+     * Random per-nonce id (the JWT `jti` idea). Without it two connect requests for the same
+     * subject/org/app in the same millisecond would sign to the SAME state and the first-write-wins
+     * pending store would conflate the two flows.
+     */
+    readonly nonceId: string;
+    readonly subject: string;
+    readonly org: string;
+    readonly app: string;
+    readonly issuedAt: number;
+}
+export declare function signInstallNonce(payload: InstallNoncePayload, secret: string): string;
+export type InstallNonceVerification = {
+    readonly ok: true;
+    readonly payload: InstallNoncePayload;
+} | {
+    readonly ok: false;
+    readonly reason: 'malformed' | 'tampered' | 'expired';
+};
+export declare function verifyInstallNonce(nonce: string, secret: string, now?: () => Date): InstallNonceVerification;
+//# sourceMappingURL=install-nonce.d.ts.map

package/node_modules/@noodle-borg/service/dist/github/install-nonce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-nonce.d.ts","sourceRoot":"","sources":["../../src/github/install-nonce.ts"],"names":[],"mappings":"AAiBA,wBAAgB,wBAAwB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAOlF;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAIrF;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,UAAU,GAAG,SAAS,CAAA;CAAE,CAAC;AAElF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,MAAM,IAAuB,GACjC,wBAAwB,CA4B1B"}

package/node_modules/@noodle-borg/service/dist/github/install-nonce.js

@@ -0,0 +1,57 @@
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+/**
+ * HMAC-signed `state` nonce for the GitHub App installation hand-off (`GET /v1/github/install-url` →
+ * GitHub's installations/new redirect → `POST /v1/github/installations/claim`). Binds the request to the
+ * subject who asked for it and the org/app it targets, with a short expiry — an attacker cannot forge or
+ * replay a claim without the signing secret.
+ */
+const NONCE_TTL_MS = 10 * 60 * 1000;
+// Dev/self-host fallback signing secret when no `githubApp.webhookSecret` is configured. Per-process, NOT
+// stable across instances — acceptable only because this whole feature is unwired from live GitHub in this
+// slice (no real installation ever reaches `claim` yet). Production must configure `webhookSecret` before
+// GHD-1 is exposed on a multi-instance deployment; see ADR 0111.
+const FALLBACK_SECRET = randomBytes(32).toString('hex');
+export function resolveGithubStateSecret(webhookSecret) {
+    if (webhookSecret !== undefined && webhookSecret.trim().length === 0) {
+        // A blank configured secret would silently make every state trivially forgeable — fail loudly
+        // instead of signing with ''. (Unconfigured is fine: the per-process random fallback applies.)
+        throw new Error('githubApp.webhookSecret must not be empty when configured');
+    }
+    return webhookSecret ?? FALLBACK_SECRET;
+}
+export function signInstallNonce(payload, secret) {
+    const encoded = Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url');
+    const signature = createHmac('sha256', secret).update(encoded).digest('hex');
+    return `${encoded}.${signature}`;
+}
+export function verifyInstallNonce(nonce, secret, now = () => new Date()) {
+    const parts = nonce.split('.');
+    if (parts.length !== 2)
+        return { ok: false, reason: 'malformed' };
+    const [encoded, signature] = parts;
+    const expected = createHmac('sha256', secret).update(encoded).digest('hex');
+    const expectedBuf = Buffer.from(expected, 'hex');
+    const signatureBuf = Buffer.from(signature, 'hex');
+    if (signatureBuf.length !== expectedBuf.length || !timingSafeEqual(signatureBuf, expectedBuf)) {
+        return { ok: false, reason: 'tampered' };
+    }
+    let payload;
+    try {
+        payload = JSON.parse(Buffer.from(encoded, 'base64url').toString('utf8'));
+    }
+    catch {
+        return { ok: false, reason: 'malformed' };
+    }
+    if (typeof payload.nonceId !== 'string' ||
+        payload.nonceId.length === 0 ||
+        typeof payload.subject !== 'string' ||
+        typeof payload.org !== 'string' ||
+        typeof payload.app !== 'string' ||
+        typeof payload.issuedAt !== 'number') {
+        return { ok: false, reason: 'malformed' };
+    }
+    if (now().getTime() - payload.issuedAt > NONCE_TTL_MS)
+        return { ok: false, reason: 'expired' };
+    return { ok: true, payload };
+}
+//# sourceMappingURL=install-nonce.js.map

package/node_modules/@noodle-borg/service/dist/github/install-nonce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-nonce.js","sourceRoot":"","sources":["../../src/github/install-nonce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE;;;;;GAKG;AAEH,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpC,0GAA0G;AAC1G,2GAA2G;AAC3G,0GAA0G;AAC1G,iEAAiE;AACjE,MAAM,eAAe,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAExD,MAAM,UAAU,wBAAwB,CAAC,aAAiC;IACxE,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrE,8FAA8F;QAC9F,+FAA+F;QAC/F,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,aAAa,IAAI,eAAe,CAAC;AAC1C,CAAC;AAeD,MAAM,UAAU,gBAAgB,CAAC,OAA4B,EAAE,MAAc;IAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7E,OAAO,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;AACnC,CAAC;AAMD,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,MAAc,EACd,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IAElC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAClE,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,KAAyB,CAAC;IACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,YAAY,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,OAA4B,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAwB,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,IACE,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;QACnC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAC5B,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;QACnC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,EACpC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,YAAY;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC"}

package/node_modules/@noodle-borg/service/dist/github/pending-installations.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Hand-off store for the CLI `noodle github connect` poll (GHD-1.4). GitHub's installation
+ * flow redirects the installer's BROWSER to the GitHub App's configured "Setup URL" once the install
+ * completes — a request the CLI process cannot receive directly (it has no public callback endpoint of
+ * its own). `GET /v1/github/setup` (`../routes/github-setup.ts`) IS that Setup URL: it lands the
+ * redirect, verifies the signed install-nonce `state` GitHub echoes back, and stashes the installationId
+ * here keyed by the raw state string. The CLI then polls `GET /v1/github/installations/pending?state=...`
+ * (same file) until the entry appears, then proceeds to `POST /v1/github/installations/claim`.
+ *
+ * Entries expire on the same 10-minute TTL as the nonce itself (`install-nonce.ts`) so a stale poll can
+ * never resurrect an old install correlation. The interface is async because a multi-instance
+ * deployment backs it with Postgres (`PostgresArtifactStore` implements it — GHD-2 closed the gap
+ * flagged in the GHD-1 review): the setup redirect and the CLI poll can land on different instances,
+ * so the hand-off must live in the shared store. The in-memory backend remains the single-instance
+ * dev/test default.
+ */
+/** Shared hand-off TTL — mirrors the install-nonce TTL so neither side outlives the other. */
+export declare const PENDING_GITHUB_INSTALLATION_TTL_MS: number;
+export interface PendingGithubInstallationStore {
+    /**
+     * Record that the setup redirect landed for `state`, carrying the installationId GitHub reported.
+     * FIRST write wins: a state can land exactly once — replays or a race against the legitimate
+     * redirect cannot overwrite the recorded installation (hardening: the repo-confirm step and the
+     * repo-in-installation re-verification already blunt a swapped id; this closes the race outright).
+     */
+    put(state: string, installationId: number): Promise<void>;
+    /** The installationId stashed for `state`, or `undefined` if it hasn't landed yet (or has expired). */
+    get(state: string): Promise<number | undefined>;
+}
+export declare class InMemoryPendingGithubInstallationStore implements PendingGithubInstallationStore {
+    #private;
+    constructor(options?: {
+        now?: () => Date;
+    });
+    put(state: string, installationId: number): Promise<void>;
+    get(state: string): Promise<number | undefined>;
+}
+//# sourceMappingURL=pending-installations.d.ts.map

package/node_modules/@noodle-borg/service/dist/github/pending-installations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-installations.d.ts","sourceRoot":"","sources":["../../src/github/pending-installations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,8FAA8F;AAC9F,eAAO,MAAM,kCAAkC,QAAiB,CAAC;AAOjE,MAAM,WAAW,8BAA8B;IAC7C;;;;;OAKG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,uGAAuG;IACvG,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACjD;AAED,qBAAa,sCAAuC,YAAW,8BAA8B;;gBAI/E,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;KAAO;IAIxC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzD,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAStD"}

package/node_modules/@noodle-borg/service/dist/github/pending-installations.js

@@ -0,0 +1,41 @@
+/**
+ * Hand-off store for the CLI `noodle github connect` poll (GHD-1.4). GitHub's installation
+ * flow redirects the installer's BROWSER to the GitHub App's configured "Setup URL" once the install
+ * completes — a request the CLI process cannot receive directly (it has no public callback endpoint of
+ * its own). `GET /v1/github/setup` (`../routes/github-setup.ts`) IS that Setup URL: it lands the
+ * redirect, verifies the signed install-nonce `state` GitHub echoes back, and stashes the installationId
+ * here keyed by the raw state string. The CLI then polls `GET /v1/github/installations/pending?state=...`
+ * (same file) until the entry appears, then proceeds to `POST /v1/github/installations/claim`.
+ *
+ * Entries expire on the same 10-minute TTL as the nonce itself (`install-nonce.ts`) so a stale poll can
+ * never resurrect an old install correlation. The interface is async because a multi-instance
+ * deployment backs it with Postgres (`PostgresArtifactStore` implements it — GHD-2 closed the gap
+ * flagged in the GHD-1 review): the setup redirect and the CLI poll can land on different instances,
+ * so the hand-off must live in the shared store. The in-memory backend remains the single-instance
+ * dev/test default.
+ */
+/** Shared hand-off TTL — mirrors the install-nonce TTL so neither side outlives the other. */
+export const PENDING_GITHUB_INSTALLATION_TTL_MS = 10 * 60 * 1000;
+export class InMemoryPendingGithubInstallationStore {
+    #entries = new Map();
+    #now;
+    constructor(options = {}) {
+        this.#now = options.now ?? (() => new Date());
+    }
+    async put(state, installationId) {
+        if (this.#entries.has(state))
+            return; // first write wins — see the interface doc
+        this.#entries.set(state, { installationId, createdAt: this.#now().getTime() });
+    }
+    async get(state) {
+        const entry = this.#entries.get(state);
+        if (entry === undefined)
+            return undefined;
+        if (this.#now().getTime() - entry.createdAt > PENDING_GITHUB_INSTALLATION_TTL_MS) {
+            this.#entries.delete(state);
+            return undefined;
+        }
+        return entry.installationId;
+    }
+}
+//# sourceMappingURL=pending-installations.js.map

package/node_modules/@noodle-borg/service/dist/github/pending-installations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-installations.js","sourceRoot":"","sources":["../../src/github/pending-installations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAmBjE,MAAM,OAAO,sCAAsC;IACxC,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC3C,IAAI,CAAa;IAE1B,YAAY,UAAgC,EAAE;QAC5C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,cAAsB;QAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,2CAA2C;QACjF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,kCAAkC,EAAE,CAAC;YACjF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,cAAc,CAAC;IAC9B,CAAC;CACF"}

package/node_modules/@noodle-borg/service/dist/index.d.ts

@@ -1,4 +1,6 @@
 export { ensureAuditSchema, PostgresAuditStore } from '@noodle-borg/module-audit';
+export { ALERT_EVALUATION_INTERVAL_MS, AlertEvaluator, type AlertEvaluatorOptions, observedMetricValue, } from './alert-evaluator.js';
+export { ALERT_WEBHOOK_SCHEMA_VERSION, type AlertWebhookDelivery, type AlertWebhookPayload, buildAlertWebhookPayload, type DeliverAlertWebhookOptions, deliverAlertWebhook, validateAlertWebhookUrl, type WebhookUrlPolicy, } from './alert-webhook.js';
 export { ARCHIVE_SWEEP_INTERVAL_MS, ArchiveSweeper, type ArchiveSweeperOptions, DEFAULT_ARCHIVE_RETENTION_DAYS, resolveArchiveRetentionDays, } from './archive-sweeper.js';
 export { type AssetAdapterKind, type AssetConfigInput, type AssetConfigResolution, type AssetQuotaOverride, createAssetStore, type ResolvedAssetConfig, resolveAssetConfig, } from './asset-config.js';
 export { type AssetStore, type AssetUploadPlan, type AssetUploadTarget, InMemoryAssetStore, type InMemoryAssetStoreOptions, } from './assets.js';
@@ -8,23 +10,35 @@ export { COMMERCIAL_PLAN_NAMES, type CommercialPlanCatalog, type CommercialPlanN
 export { type CustomerVerifierFactoryOptions, createCustomerVerifierFactory, createFirebaseIdTokenVerifier, } from './customer-verifier.js';
 export { ORG_DOMAIN_TXT_LABEL, type OrgDomainVerificationResult, type TxtResolver, verifyOrgDomainDns, } from './domain-verification.js';
 export { type EnsureFreeTierDefaultOptions, ensureFreeTierDefault, FREE_TIER_PLAN, FREE_TIER_POLICY_ID, } from './free-tier.js';
+export { type GitHubAppClient, type GithubAppConfig, type GithubInstallationRepository, type GithubInstallationSummary, InMemoryGitHubAppClient, } from './github/app-client.js';
+export { type InstallNoncePayload, type InstallNonceVerification, resolveGithubStateSecret, signInstallNonce, verifyInstallNonce, } from './github/install-nonce.js';
+export { InMemoryPendingGithubInstallationStore, type PendingGithubInstallationStore, } from './github/pending-installations.js';
 export type { ServiceOptions } from './options.js';
 export { createLocalPolicyAdmissionGate, type FixedWindowQuota, InMemoryPolicyAssignmentStore, LocalPolicyAdmissionGate, type PolicyAssignment, type PolicyAssignmentInput, type PolicyAssignmentStore, PolicyConflictError, type PolicyCounterStore, type PolicyDeleteInput, type PolicyDocument, type PolicyRate, type PolicyRule, type PolicyScope, type PolicyWindow, resolveEffectivePolicy, } from './policy.js';
 export { CachingPolicyAssignmentStore, type PolicyCacheOptions, } from './policy-cache.js';
 export { InMemoryPolicyCounterStore } from './policy-counters.js';
 export { type DeployError, type DeployResult, type RecoverResult, type RollbackResult, ServerRegistry, } from './registry.js';
 export { aggregateRequestEvents, type ClientMetrics, type MethodMetrics, type RequestMetrics, type SeriesBucket, type ToolMetrics, } from './request-event-metrics.js';
+export { AppResponseSchema, AppSummarySchema, AppsListResponseSchema, DeploymentResponseSchema, DeploymentSummarySchema, DeployRunSchema, EnvResponseSchema, EnvSummarySchema, EnvsListResponseSchema, GithubConnectionResponseSchema, GithubInstallUrlResponseSchema, GithubRunsListResponseSchema, OrgSummarySchema, RepoConnectionSchema, } from './routes/contracts.js';
 export { type GcpKmsConfig, gcpKmsMasterKeyProvider, type KmsClient, } from './secret/kms-master-key.js';
 export { type RunningService, serveService } from './serve.js';
 export { createServiceHandler } from './service.js';
 export { capabilitiesForConfig, defineNoodleService, expandServiceProfile, type NoodleServiceConfig, type ObservabilityConfig, type ObservabilityLogFormat, type ObservabilityLogLevel, type ObservabilityLogSink, parseNoodleServiceYaml, resolveServiceConfigSource, type ServiceConfigSource, } from './service-config.js';
+export { ALERT_METRICS, ALERT_WINDOWS_MINUTES, type AlertFiringState, type AlertMetric, type AlertRuleRecord, type AlertRuleStore, type AlertWindowMinutes, type CreateAlertRuleInput, DEFAULT_ALERT_COOLDOWN_MINUTES, InMemoryAlertRuleStore, MAX_ALERT_RULES_PER_ENV, } from './store/alert-rules.js';
+export { JsonFileAlertRuleStore } from './store/alert-rules-json-file.js';
 export { AUDIT_SCHEMA_VERSION, type AuditDecision, type AuditDetails, type AuditEvent, type AuditEventInput, type AuditFilter, type AuditSink, type AuditStore, InMemoryAuditStore, type InMemoryAuditStoreOptions, MultiSink, redactDetails, StdoutAuditSink, } from './store/audit.js';
 export { InMemoryControlPlaneStore } from './store/control-plane.js';
+export { InMemoryGithubConnectionStore } from './store/github-connections.js';
+export { JsonFileGithubConnectionStore } from './store/github-connections-json-file.js';
+export { canTransitionDeployRun, DEFAULT_DEPLOY_RUN_LIST_LIMIT, DEPLOY_RUN_TRANSITIONS, InMemoryGithubDeployRunStore, } from './store/github-runs.js';
+export { JsonFileGithubDeployRunStore } from './store/github-runs-json-file.js';
+export { PostgresPendingGithubInstallationStore } from './store/pending-installations-postgres.js';
 export { PostgresArtifactStore, type PostgresStoreOptions } from './store/postgres.js';
+export { ensureAlertRuleSchema, PostgresAlertRuleStore, } from './store/postgres-alerts.js';
 export { ensureStateHandleSchema, PostgresStateHandleStore, type PostgresStateHandleStoreOptions, } from './store/postgres-state-handles.js';
 export { RequestEventBuffer } from './store/request-event-buffer.js';
 export { InMemoryRequestEventStore } from './store/request-events.js';
 export { ensureRequestEventSchema, PostgresRequestEventStore, } from './store/request-events-postgres.js';
 export { InMemoryUserAppLogStore, type InMemoryUserAppLogStoreOptions, type UserAppLogEvent, type UserAppLogFilter, type UserAppLogInput, type UserAppLogLevel, type UserAppLogSink, type UserAppLogStore, } from './store/user-app-logs.js';
-export { type AppArchiveResult, type AppRestoreResult, type ArtifactStore, CONFIG_NAME_PATTERN, type ConfigScope, type ConfigStore, type ConfigValueMetadata, type ControlPlaneStore, DEPLOYMENT_ID_PATTERN, type DeploymentListFilter, type DeploymentSummary, type DeployRecord, DOMAIN_PATTERN, InMemoryArtifactStore, InMemoryConfigStore, JsonFileArtifactStore, type ManagedConfigKind, type OrgDomainRecord, type OrgInvitationRecord, type OrgMemberRecord, type OrgRecord, type OrgRole, resolveConfigScope, type SecretEnvelope, type SignupAllowlistKind, type SignupAllowlistRecord, SLUG_PATTERN, scopeChain, type TenantAuthConfig, type TenantRef, validateConfigName, validateConfigScope, validateDomain, validateOrgRole, validateSignupAllowlistKind, validateSlug, validateTenantRef, } from './store.js';
+export { type AppArchiveResult, type AppRestoreResult, type AppSummary, type ArtifactStore, type CancelQueuedDeployRunsFilter, CONFIG_NAME_PATTERN, type ConfigScope, type ConfigStore, type ConfigValueMetadata, type ControlPlaneStore, type CreateDeployRunDuplicateReason, type CreateDeployRunInput, type CreateDeployRunResult, DEPLOYMENT_ID_PATTERN, type DeploymentListFilter, type DeploymentSummary, type DeployRecord, type DeployRunRecord, type DeployRunSourceEvent, type DeployRunStatus, DOMAIN_PATTERN, type EnvSummary, type GithubConnectionStore, type GithubDeployRunStore, InMemoryArtifactStore, InMemoryConfigStore, JsonFileArtifactStore, type ListDeployRunsResult, type ManagedConfigKind, type OrgDomainRecord, type OrgInvitationRecord, type OrgMemberRecord, type OrgRecord, type OrgRole, type RepoConnectionConflict, type RepoConnectionConflictReason, type RepoConnectionRecord, resolveConfigScope, type SecretEnvelope, type SignupAllowlistKind, type SignupAllowlistRecord, SLUG_PATTERN, scopeChain, type TenantAuthConfig, type TenantRef, type UpsertRepoConnectionInput, type UpsertRepoConnectionResult, validateConfigName, validateConfigScope, validateDomain, validateOrgRole, validatePositiveInteger, validateSignupAllowlistKind, validateSlug, validateTenantRef, } from './store.js';
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/service/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,KAAK,qBAAqB,EAC1B,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,iBAAiB,EACjB,KAAK,cAAc,EACnB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,KAAK,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,8BAA8B,EACnC,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,WAAW,EAChB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,4BAA4B,EACjC,qBAAqB,EACrB,cAAc,EACd,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EACL,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,6BAA6B,EAC7B,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,EAC5B,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,KAAK,YAAY,EACjB,uBAAuB,EACvB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,SAAS,EACT,aAAa,EACb,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,+BAA+B,GACrC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,EACnC,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,cAAc,EACd,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,YAAY,EACZ,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,2BAA2B,EAC3B,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,KAAK,qBAAqB,EAC1B,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,KAAK,qBAAqB,EAC1B,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,iBAAiB,EACjB,KAAK,cAAc,EACnB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,KAAK,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,8BAA8B,EACnC,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,WAAW,EAChB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,4BAA4B,EACjC,qBAAqB,EACrB,cAAc,EACd,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,EAC9B,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sCAAsC,EACtC,KAAK,8BAA8B,GACpC,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EACL,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,6BAA6B,EAC7B,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,EAC5B,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,8BAA8B,EAC9B,8BAA8B,EAC9B,4BAA4B,EAC5B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,YAAY,EACjB,uBAAuB,EACvB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,8BAA8B,EAC9B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EACL,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,SAAS,EACT,aAAa,EACb,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,EAAE,sCAAsC,EAAE,MAAM,2CAA2C,CAAC;AACnG,OAAO,EAAE,qBAAqB,EAAE,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,+BAA+B,GACrC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,EACnC,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,4BAA4B,EACjC,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,8BAA8B,EACnC,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,cAAc,EACd,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,YAAY,EACZ,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,uBAAuB,EACvB,2BAA2B,EAC3B,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC"}

package/node_modules/@noodle-borg/service/dist/index.js

@@ -1,4 +1,6 @@
 export { ensureAuditSchema, PostgresAuditStore } from '@noodle-borg/module-audit';
+export { ALERT_EVALUATION_INTERVAL_MS, AlertEvaluator, observedMetricValue, } from './alert-evaluator.js';
+export { ALERT_WEBHOOK_SCHEMA_VERSION, buildAlertWebhookPayload, deliverAlertWebhook, validateAlertWebhookUrl, } from './alert-webhook.js';
 export { ARCHIVE_SWEEP_INTERVAL_MS, ArchiveSweeper, DEFAULT_ARCHIVE_RETENTION_DAYS, resolveArchiveRetentionDays, } from './archive-sweeper.js';
 export { createAssetStore, resolveAssetConfig, } from './asset-config.js';
 export { InMemoryAssetStore, } from './assets.js';
@@ -8,22 +10,34 @@ export { COMMERCIAL_PLAN_NAMES, commercialPlanPolicyId, DEFAULT_COMMERCIAL_PLAN_
 export { createCustomerVerifierFactory, createFirebaseIdTokenVerifier, } from './customer-verifier.js';
 export { ORG_DOMAIN_TXT_LABEL, verifyOrgDomainDns, } from './domain-verification.js';
 export { ensureFreeTierDefault, FREE_TIER_PLAN, FREE_TIER_POLICY_ID, } from './free-tier.js';
+export { InMemoryGitHubAppClient, } from './github/app-client.js';
+export { resolveGithubStateSecret, signInstallNonce, verifyInstallNonce, } from './github/install-nonce.js';
+export { InMemoryPendingGithubInstallationStore, } from './github/pending-installations.js';
 export { createLocalPolicyAdmissionGate, InMemoryPolicyAssignmentStore, LocalPolicyAdmissionGate, PolicyConflictError, resolveEffectivePolicy, } from './policy.js';
 export { CachingPolicyAssignmentStore, } from './policy-cache.js';
 export { InMemoryPolicyCounterStore } from './policy-counters.js';
 export { ServerRegistry, } from './registry.js';
 export { aggregateRequestEvents, } from './request-event-metrics.js';
+export { AppResponseSchema, AppSummarySchema, AppsListResponseSchema, DeploymentResponseSchema, DeploymentSummarySchema, DeployRunSchema, EnvResponseSchema, EnvSummarySchema, EnvsListResponseSchema, GithubConnectionResponseSchema, GithubInstallUrlResponseSchema, GithubRunsListResponseSchema, OrgSummarySchema, RepoConnectionSchema, } from './routes/contracts.js';
 export { gcpKmsMasterKeyProvider, } from './secret/kms-master-key.js';
 export { serveService } from './serve.js';
 export { createServiceHandler } from './service.js';
 export { capabilitiesForConfig, defineNoodleService, expandServiceProfile, parseNoodleServiceYaml, resolveServiceConfigSource, } from './service-config.js';
+export { ALERT_METRICS, ALERT_WINDOWS_MINUTES, DEFAULT_ALERT_COOLDOWN_MINUTES, InMemoryAlertRuleStore, MAX_ALERT_RULES_PER_ENV, } from './store/alert-rules.js';
+export { JsonFileAlertRuleStore } from './store/alert-rules-json-file.js';
 export { AUDIT_SCHEMA_VERSION, InMemoryAuditStore, MultiSink, redactDetails, StdoutAuditSink, } from './store/audit.js';
 export { InMemoryControlPlaneStore } from './store/control-plane.js';
+export { InMemoryGithubConnectionStore } from './store/github-connections.js';
+export { JsonFileGithubConnectionStore } from './store/github-connections-json-file.js';
+export { canTransitionDeployRun, DEFAULT_DEPLOY_RUN_LIST_LIMIT, DEPLOY_RUN_TRANSITIONS, InMemoryGithubDeployRunStore, } from './store/github-runs.js';
+export { JsonFileGithubDeployRunStore } from './store/github-runs-json-file.js';
+export { PostgresPendingGithubInstallationStore } from './store/pending-installations-postgres.js';
 export { PostgresArtifactStore } from './store/postgres.js';
+export { ensureAlertRuleSchema, PostgresAlertRuleStore, } from './store/postgres-alerts.js';
 export { ensureStateHandleSchema, PostgresStateHandleStore, } from './store/postgres-state-handles.js';
 export { RequestEventBuffer } from './store/request-event-buffer.js';
 export { InMemoryRequestEventStore } from './store/request-events.js';
 export { ensureRequestEventSchema, PostgresRequestEventStore, } from './store/request-events-postgres.js';
 export { InMemoryUserAppLogStore, } from './store/user-app-logs.js';
-export { CONFIG_NAME_PATTERN, DEPLOYMENT_ID_PATTERN, DOMAIN_PATTERN, InMemoryArtifactStore, InMemoryConfigStore, JsonFileArtifactStore, resolveConfigScope, SLUG_PATTERN, scopeChain, validateConfigName, validateConfigScope, validateDomain, validateOrgRole, validateSignupAllowlistKind, validateSlug, validateTenantRef, } from './store.js';
+export { CONFIG_NAME_PATTERN, DEPLOYMENT_ID_PATTERN, DOMAIN_PATTERN, InMemoryArtifactStore, InMemoryConfigStore, JsonFileArtifactStore, resolveConfigScope, SLUG_PATTERN, scopeChain, validateConfigName, validateConfigScope, validateDomain, validateOrgRole, validatePositiveInteger, validateSignupAllowlistKind, validateSlug, validateTenantRef, } from './store.js';
 //# sourceMappingURL=index.js.map

package/node_modules/@noodle-borg/service/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EACL,yBAAyB,EACzB,cAAc,EAEd,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAKL,gBAAgB,EAEhB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAIL,kBAAkB,GAEnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,WAAW,EAGX,iBAAiB,EAEjB,sBAAsB,EAEtB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAkB,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EACL,qBAAqB,EAGrB,sBAAsB,EACtB,+BAA+B,EAC/B,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,EAGpB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,qBAAqB,EACrB,cAAc,EACd,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,8BAA8B,EAE9B,6BAA6B,EAC7B,wBAAwB,EAIxB,mBAAmB,EAQnB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,GAE7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAKL,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,GAMvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAEL,uBAAuB,GAExB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAuB,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EAMpB,sBAAsB,EACtB,0BAA0B,GAE3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EAQpB,kBAAkB,EAElB,SAAS,EACT,aAAa,EACb,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAA6B,MAAM,qBAAqB,CAAC;AACvF,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GAEzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,uBAAuB,GAQxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAIL,mBAAmB,EAKnB,qBAAqB,EAIrB,cAAc,EACd,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EAOrB,kBAAkB,EAIlB,YAAY,EACZ,UAAU,EAGV,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,2BAA2B,EAC3B,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EACL,4BAA4B,EAC5B,cAAc,EAEd,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,4BAA4B,EAG5B,wBAAwB,EAExB,mBAAmB,EACnB,uBAAuB,GAExB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,yBAAyB,EACzB,cAAc,EAEd,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAKL,gBAAgB,EAEhB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAIL,kBAAkB,GAEnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,WAAW,EAGX,iBAAiB,EAEjB,sBAAsB,EAEtB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAkB,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EACL,qBAAqB,EAGrB,sBAAsB,EACtB,+BAA+B,EAC/B,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,EAGpB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,qBAAqB,EACrB,cAAc,EACd,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAKL,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAGL,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sCAAsC,GAEvC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,8BAA8B,EAE9B,6BAA6B,EAC7B,wBAAwB,EAIxB,mBAAmB,EAQnB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,GAE7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAKL,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,GAMvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,8BAA8B,EAC9B,8BAA8B,EAC9B,4BAA4B,EAC5B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,uBAAuB,GAExB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAuB,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EAMpB,sBAAsB,EACtB,0BAA0B,GAE3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,aAAa,EACb,qBAAqB,EAOrB,8BAA8B,EAC9B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EACL,oBAAoB,EAQpB,kBAAkB,EAElB,SAAS,EACT,aAAa,EACb,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,EAAE,sCAAsC,EAAE,MAAM,2CAA2C,CAAC;AACnG,OAAO,EAAE,qBAAqB,EAA6B,MAAM,qBAAqB,CAAC;AACvF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GAEzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,uBAAuB,GAQxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAML,mBAAmB,EAQnB,qBAAqB,EAOrB,cAAc,EAId,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EAWrB,kBAAkB,EAIlB,YAAY,EACZ,UAAU,EAKV,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,uBAAuB,EACvB,2BAA2B,EAC3B,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC"}

package/node_modules/@noodle-borg/service/dist/options.d.ts

@@ -6,11 +6,14 @@ import type { AssetStore } from './assets.js';
 import type { ControlPlaneSignupMode, DeployAuthGate } from './auth/deploy-gate.js';
 import type { BuildInfo } from './build-info.js';
 import type { CommercialPlanCatalog } from './commercial-plans.js';
+import type { GitHubAppClient, GithubAppConfig } from './github/app-client.js';
+import type { PendingGithubInstallationStore } from './github/pending-installations.js';
 import type { LoadedServiceModule } from './modules/host.js';
 import type { PolicyAssignmentStore, PolicyCounterStore } from './policy.js';
+import type { AlertRuleStore } from './store/alert-rules.js';
 import type { AuditSink } from './store/audit.js';
 import type { UserAppLogStore } from './store/user-app-logs.js';
-import type { ConfigStore, ControlPlaneStore } from './store.js';
+import type { ConfigStore, ControlPlaneStore, GithubConnectionStore, GithubDeployRunStore } from './store.js';
 export interface ServiceOptions {
     /** Public base URL used to build returned endpoint URLs. Defaults to the request's Host header. */
     readonly publicBaseUrl?: string;
@@ -107,6 +110,19 @@ export interface ServiceOptions {
      * tiered by-plan retention is a later stage). Default 30.
      */
     readonly requestEventRetentionDays?: number;
+    /**
+     * Analytics alert-rule store (E2, ADR 0130). Backs the tenant `alerts` CRUD/test routes and the
+     * periodic evaluator. Default: in-memory in the handler; `serveService` selects Postgres when
+     * persistence is configured, else a `dataDir` JSON-file store, else in-memory (mirrors the
+     * request-event store selection).
+     */
+    readonly alertRuleStore?: AlertRuleStore;
+    /**
+     * Dev/test-only carve-out allowing `http://localhost` / `http://127.0.0.1` / `[::1]` alert
+     * webhook targets (mirrors `customerVerifierAllowInsecureLocalhost`). Production leaves this
+     * unset: webhooks are https-only and delivery is SSRF-guarded (DNS-pinned public unicast).
+     */
+    readonly alertWebhookAllowLoopback?: boolean;
     /**
      * The self-hosted authorization server issuer (OA-2) advertised in protected-resource metadata so an
      * MCP client can discover where to authenticate. When unset, the metadata omits `authorization_servers`.
@@ -135,5 +151,35 @@ export interface ServiceOptions {
     readonly deniedSignupSubjects?: readonly string[];
     /** Boot-initialized service modules. Dynamic loading is owned by serveService, never request handlers. */
     readonly loadedModules?: readonly LoadedServiceModule[];
+    /**
+     * GHD-1 repository-connection store (ADR 0111). Default: in-memory, useful for localhost tests only —
+     * `serveService` defaults to Postgres when persistence is enabled, else a `dataDir`-backed JSON-file
+     * store, else in-memory (mirrors `controlPlaneStore`/`configStore`).
+     */
+    readonly githubConnectionStore?: GithubConnectionStore;
+    /**
+     * GHD-2 deploy-run store (ADR 0111 §6): webhook-accepted runs, replay-safe. Same backend-selection
+     * rule as `githubConnectionStore`.
+     */
+    readonly githubDeployRunStore?: GithubDeployRunStore;
+    /**
+     * Non-secret Noodle Seed GitHub App identity (ADR 0111). Everything is optional — the whole GHD-1
+     * connection feature is off (install-url 409s) when absent. Long-lived credentials
+     * (`privateKeyPem`/`webhookSecret`) are read from the credential broker/secret manager by the caller,
+     * never stored in code, config files, or tests.
+     */
+    readonly githubApp?: GithubAppConfig;
+    /**
+     * The GitHub App port (GHD-1): look up an installation and list its repositories. No live
+     * implementation ships in this slice — tests and local/dev use `InMemoryGitHubAppClient`; a JWT/
+     * installation-token-backed client is wired in a later slice once `githubApp`'s credentials are live.
+     */
+    readonly githubAppClient?: GitHubAppClient;
+    /**
+     * GHD-1.4 CLI hand-off store: the installationId a landed GitHub App Setup URL redirect produced,
+     * keyed by the signed install-nonce `state`. In-memory single-flight state, not a durable record — see
+     * `github/pending-installations.ts`. Default: fresh in-memory store per `serveService` call.
+     */
+    readonly pendingGithubInstallationStore?: PendingGithubInstallationStore;
 }
 //# sourceMappingURL=options.d.ts.map

package/node_modules/@noodle-borg/service/dist/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,KAAK,EACV,aAAa,EACb,MAAM,EACN,kBAAkB,EAClB,UAAU,EACX,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEjE,MAAM,WAAW,cAAc;IAC7B,mGAAmG;IACnG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,gEAAgE;IAChE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,0GAA0G;IAC1G,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IACrC,oGAAoG;IACpG,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,kGAAkG;IAClG,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,kGAAkG;IAClG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,yGAAyG;IACzG,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,wFAAwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,sCAAsC,CAAC,EAAE,OAAO,CAAC;IAC1D;;;OAGG;IACH,QAAQ,CAAC,4BAA4B,CAAC,EAAE,aAAa,CAAC;IACtD,yFAAyF;IACzF,QAAQ,CAAC,+BAA+B,CAAC,EAAE,MAAM,CAAC;IAClD,qFAAqF;IACrF,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,4FAA4F;IAC5F,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IAC7C,uFAAuF;IACvF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,uEAAuE;IACvE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,iGAAiG;IACjG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAClE;;;OAGG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;IAC7E;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;IAC9E,0FAA0F;IAC1F,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C,4GAA4G;IAC5G,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACjD,sGAAsG;IACtG,QAAQ,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACzD,6FAA6F;IAC7F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,4GAA4G;IAC5G,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,0GAA0G;IAC1G,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACzD"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,KAAK,EACV,aAAa,EACb,MAAM,EACN,kBAAkB,EAClB,UAAU,EACX,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,cAAc;IAC7B,mGAAmG;IACnG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,gEAAgE;IAChE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,0GAA0G;IAC1G,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IACrC,oGAAoG;IACpG,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,kGAAkG;IAClG,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,kGAAkG;IAClG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,yGAAyG;IACzG,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,wFAAwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,sCAAsC,CAAC,EAAE,OAAO,CAAC;IAC1D;;;OAGG;IACH,QAAQ,CAAC,4BAA4B,CAAC,EAAE,aAAa,CAAC;IACtD,yFAAyF;IACzF,QAAQ,CAAC,+BAA+B,CAAC,EAAE,MAAM,CAAC;IAClD,qFAAqF;IACrF,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,4FAA4F;IAC5F,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IAC7C,uFAAuF;IACvF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,uEAAuE;IACvE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,iGAAiG;IACjG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAClE;;;OAGG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;IAC7E;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;IAC9E,0FAA0F;IAC1F,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C,4GAA4G;IAC5G,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACjD,sGAAsG;IACtG,QAAQ,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACzD,6FAA6F;IAC7F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,4GAA4G;IAC5G,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,0GAA0G;IAC1G,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC;CAC1E"}

package/node_modules/@noodle-borg/service/dist/registry-state.d.ts

@@ -1,11 +1,5 @@
-/**
- * Registry state operations that work over the {@link ServerRegistry}'s private maps: the no-store
- * in-memory activation fallback and the app archive/restore/sweep cache reconciliation (ADR 0117).
- * The registry passes a {@link RegistryStateView} of its private fields; store-backed calls hit the
- * durable store first, then reconcile the in-process caches so no instance keeps serving stale state.
- */
 import type { ServedTarget } from '@noodle-borg/transport-http';
-import type { AppArchiveResult, AppRestoreResult, ArtifactStore, DeployRecord, TenantRef } from './store.js';
+import type { AppArchiveResult, AppRestoreResult, AppSummary, ArtifactStore, DeploymentSummary, DeployRecord, EnvSummary, TenantRef } from './store.js';
 export interface RegistryStateView {
     readonly store: ArtifactStore | undefined;
     readonly records: Map<string, DeployRecord>;
@@ -18,8 +12,35 @@ export declare function activateInMemory(records: Map<string, DeployRecord>, ref
     readonly previousActive?: DeployRecord;
     readonly alreadyActive: boolean;
 } | undefined;
+/**
+ * The active deploy record for a tenant, store-first then over the in-process cache (moved verbatim
+ * from `ServerRegistry.#activeRecord`). Store hits reconcile the caches so no instance serves stale
+ * state; the no-store path falls back to the newest matching record.
+ */
+export declare function activeRecord(state: RegistryStateView, ref: TenantRef): Promise<DeployRecord | undefined>;
+/** {@link activeRecord} pinned to one server version (moved verbatim from `#activeRecordVersion`). */
+export declare function activeRecordVersion(state: RegistryStateView, ref: TenantRef, serverVersion: string): Promise<DeployRecord | undefined>;
 export declare function registryAppArchivedAt(state: RegistryStateView, org: string, app: string): Promise<string | undefined>;
 export declare function registryArchiveApp(state: RegistryStateView, org: string, app: string, at: string): Promise<AppArchiveResult | undefined>;
 export declare function registryRestoreApp(state: RegistryStateView, org: string, app: string): Promise<AppRestoreResult | undefined>;
 export declare function registrySweepArchived(state: RegistryStateView, before: string): Promise<readonly DeployRecord[]>;
+/** The `apps` resource, store-first with a no-store fallback over the registry's own record cache. */
+export declare function registryListApps(state: RegistryStateView, org: string, opts: {
+    readonly includeArchived?: boolean;
+    readonly limit?: number;
+}): Promise<{
+    readonly apps: readonly AppSummary[];
+    readonly truncated: boolean;
+}>;
+export declare function registryGetApp(state: RegistryStateView, org: string, app: string): Promise<AppSummary | undefined>;
+/** The `envs` resource, store-first with a no-store fallback over the registry's own record cache. */
+export declare function registryListEnvironments(state: RegistryStateView, org: string, app: string, opts: {
+    readonly includeArchived?: boolean;
+}): Promise<readonly EnvSummary[]>;
+export declare function registryGetEnvironment(state: RegistryStateView, org: string, app: string, env: string): Promise<EnvSummary | undefined>;
+/**
+ * One deployment by id, scoped to `org`, store-first with a no-store fallback over the registry's own
+ * record cache. `undefined` both for an unknown id and for an id that belongs to a different org.
+ */
+export declare function registryGetDeployment(state: RegistryStateView, org: string, deploymentId: string): Promise<DeploymentSummary | undefined>;
 //# sourceMappingURL=registry-state.d.ts.map

package/node_modules/@noodle-borg/service/dist/registry-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry-state.d.ts","sourceRoot":"","sources":["../src/registry-state.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAShE,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,SAAS,EACV,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC5C,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,EAClC,GAAG,EAAE,SAAS,EACd,YAAY,EAAE,MAAM,GAElB;IACE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,YAAY,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC,GACD,SAAS,CAyBZ;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAK7B;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAYvC;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAYvC;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAgBlC"}
+{"version":3,"file":"registry-state.d.ts","sourceRoot":"","sources":["../src/registry-state.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAchE,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,SAAS,EACV,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC5C,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7C;AAED,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,EAClC,GAAG,EAAE,SAAS,EACd,YAAY,EAAE,MAAM,GAElB;IACE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,YAAY,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC,GACD,SAAS,CAyBZ;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAenC;AAED,sGAAsG;AACtG,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,SAAS,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAwBnC;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAK7B;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAYvC;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAYvC;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAgBlC;AAED,sGAAsG;AACtG,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACpE,OAAO,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC,CAQhF;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAOjC;AAED,sGAAsG;AACtG,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3C,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAUhC;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAYjC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAMxC"}

package/node_modules/@noodle-borg/service/dist/registry-state.js

@@ -1,5 +1,13 @@
-import { recordMatchesTenant } from './registry-targets.js';
-import { appArchivedAt, planAppArchive, planAppRestore, withoutArchiveStamp, } from './store/records.js';
+/**
+ * Registry state operations that work over the {@link ServerRegistry}'s private maps: the no-store
+ * in-memory activation fallback and the app archive/restore/sweep cache reconciliation (ADR 0117).
+ * The registry passes a {@link RegistryStateView} of its private fields; store-backed calls hit the
+ * durable store first, then reconcile the in-process caches so no instance keeps serving stale state.
+ */
+import { normalizeServerVersion } from '@noodle-borg/module';
+import { defaultActiveRecord } from './deployment-versioning.js';
+import { recordMatchesTenant, tenantDeploymentKey, tenantKey } from './registry-targets.js';
+import { appArchivedAt, deploymentSummary, paginateAppSummaries, planAppArchive, planAppRestore, summarizeApps, summarizeEnvs, withoutArchiveStamp, } from './store/records.js';
 import { validateSlug } from './store/validate.js';
 /** No-store activation fallback (moved verbatim from `ServerRegistry.#activateInMemory`). */
 export function activateInMemory(records, ref, deploymentId) {
@@ -27,6 +35,52 @@ export function activateInMemory(records, ref, deploymentId) {
         alreadyActive,
     };
 }
+/**
+ * The active deploy record for a tenant, store-first then over the in-process cache (moved verbatim
+ * from `ServerRegistry.#activeRecord`). Store hits reconcile the caches so no instance serves stale
+ * state; the no-store path falls back to the newest matching record.
+ */
+export async function activeRecord(state, ref) {
+    if (state.store) {
+        const record = await state.store.getActiveByTenant(ref);
+        if (record !== undefined) {
+            state.records.set(record.deploymentId, record);
+            state.activeTenants.set(tenantDeploymentKey(ref, record.serverVersion), record.deploymentId);
+        }
+        return record;
+    }
+    const cachedId = state.activeTenants.get(tenantKey(ref));
+    if (cachedId !== undefined) {
+        const cached = state.records.get(cachedId);
+        if (cached !== undefined && cached.archivedAt === undefined)
+            return cached;
+    }
+    return defaultActiveRecord([...state.records.values()], ref);
+}
+/** {@link activeRecord} pinned to one server version (moved verbatim from `#activeRecordVersion`). */
+export async function activeRecordVersion(state, ref, serverVersion) {
+    const safeServerVersion = normalizeServerVersion(serverVersion);
+    if (state.store) {
+        const record = await state.store.getActiveByTenantVersion(ref, safeServerVersion);
+        if (record !== undefined) {
+            state.records.set(record.deploymentId, record);
+            state.activeTenants.set(tenantDeploymentKey(ref, safeServerVersion), record.deploymentId);
+        }
+        return record;
+    }
+    const cachedId = state.activeTenants.get(tenantDeploymentKey(ref, safeServerVersion));
+    if (cachedId !== undefined) {
+        const cached = state.records.get(cachedId);
+        if (cached !== undefined && cached.archivedAt === undefined)
+            return cached;
+    }
+    return [...state.records.values()]
+        .filter((record) => record.active &&
+        record.archivedAt === undefined &&
+        recordMatchesTenant(record, ref) &&
+        record.serverVersion === safeServerVersion)
+        .sort((a, b) => b.deploymentVersion - a.deploymentVersion)[0];
+}
 export function registryAppArchivedAt(state, org, app) {
     const safeOrg = validateSlug('org', org);
     const safeApp = validateSlug('app', app);
@@ -80,8 +134,67 @@ export async function registrySweepArchived(state, before) {
     purgeActiveTenantEntries(state, ids);
     return deleted;
 }
+/** The `apps` resource, store-first with a no-store fallback over the registry's own record cache. */
+export function registryListApps(state, org, opts) {
+    const safeOrg = validateSlug('org', org);
+    if (state.store !== undefined)
+        return state.store.listApps(safeOrg, opts);
+    const records = appRecordsFromMap(state.records, safeOrg).map(deploymentSummary);
+    const summarized = summarizeApps(safeOrg, records, [], {
+        includeArchived: opts.includeArchived ?? false,
+    });
+    return Promise.resolve(paginateAppSummaries(summarized, opts.limit));
+}
+export function registryGetApp(state, org, app) {
+    const safeOrg = validateSlug('org', org);
+    const safeApp = validateSlug('app', app);
+    if (state.store !== undefined)
+        return state.store.getApp(safeOrg, safeApp);
+    const records = appRecordsFromMap(state.records, safeOrg, safeApp).map(deploymentSummary);
+    if (records.length === 0)
+        return Promise.resolve(undefined);
+    return Promise.resolve(summarizeApps(safeOrg, records, [], { includeArchived: true })[0]);
+}
+/** The `envs` resource, store-first with a no-store fallback over the registry's own record cache. */
+export function registryListEnvironments(state, org, app, opts) {
+    const safeOrg = validateSlug('org', org);
+    const safeApp = validateSlug('app', app);
+    if (state.store !== undefined)
+        return state.store.listEnvironments(safeOrg, safeApp, opts);
+    const records = appRecordsFromMap(state.records, safeOrg, safeApp).map(deploymentSummary);
+    return Promise.resolve(summarizeEnvs(safeOrg, safeApp, records, [], {
+        includeArchived: opts.includeArchived ?? false,
+    }));
+}
+export function registryGetEnvironment(state, org, app, env) {
+    const safeOrg = validateSlug('org', org);
+    const safeApp = validateSlug('app', app);
+    const safeEnv = validateSlug('env', env);
+    if (state.store !== undefined)
+        return state.store.getEnvironment(safeOrg, safeApp, safeEnv);
+    const records = appRecordsFromMap(state.records, safeOrg, safeApp)
+        .filter((record) => record.environment === safeEnv)
+        .map(deploymentSummary);
+    if (records.length === 0)
+        return Promise.resolve(undefined);
+    return Promise.resolve(summarizeEnvs(safeOrg, safeApp, records, [], { includeArchived: true })[0]);
+}
+/**
+ * One deployment by id, scoped to `org`, store-first with a no-store fallback over the registry's own
+ * record cache. `undefined` both for an unknown id and for an id that belongs to a different org.
+ */
+export function registryGetDeployment(state, org, deploymentId) {
+    const safeOrg = validateSlug('org', org);
+    if (state.store !== undefined)
+        return state.store.getDeployment(safeOrg, deploymentId);
+    const record = state.records.get(deploymentId);
+    if (record === undefined || record.orgSlug !== safeOrg)
+        return Promise.resolve(undefined);
+    return Promise.resolve(deploymentSummary(record));
+}
+/** Every record for `org`, optionally narrowed to one `app` (omit to scan the whole org). */
 function appRecordsFromMap(records, org, app) {
-    return [...records.values()].filter((record) => record.orgSlug === org && record.appSlug === app);
+    return [...records.values()].filter((record) => record.orgSlug === org && (app === undefined || record.appSlug === app));
 }
 /**
  * Stamp cached records and drop the app's active-tenant pointers so this instance stops serving