@noodleseed/one 0.16.0 → 0.18.0

package/node_modules/@noodle-borg/service/dist/routes/alerts.js

@@ -0,0 +1,204 @@
+import { buildAlertWebhookPayload, deliverAlertWebhook, validateAlertWebhookUrl, } from '../alert-webhook.js';
+import { readJsonBody, sendForbidden, sendJson } from '../http-util.js';
+import { ALERT_METRICS, ALERT_WINDOWS_MINUTES, MAX_ALERT_RULES_PER_ENV, } from '../store/alert-rules.js';
+import { sendContract } from './apps.js';
+import { AlertRuleResponseSchema, AlertRulesListResponseSchema } from './contracts.js';
+import { authorizeControlPlane, authorizeTenantControl } from './control-plane.js';
+import { canManageMembers } from './org-admin.js';
+/** Redact a webhook URL to its origin — path/query (where tokens live) never leave the service. */
+export function redactWebhookUrl(url) {
+    try {
+        return `${new URL(url).origin}/…`;
+    }
+    catch {
+        return '<redacted>';
+    }
+}
+/** The redacted public view of a rule; the only shape routes may serialize. */
+function publicAlertRule(record) {
+    return {
+        id: record.id,
+        ...(record.name !== undefined ? { name: record.name } : {}),
+        metric: record.metric,
+        threshold: record.threshold,
+        windowMinutes: record.windowMinutes,
+        comparison: record.comparison,
+        webhook: redactWebhookUrl(record.webhookUrl),
+        enabled: record.enabled,
+        cooldownMinutes: record.cooldownMinutes,
+        breaching: record.breaching,
+        ...(record.lastObserved !== undefined ? { lastObserved: record.lastObserved } : {}),
+        ...(record.lastFiredAt !== undefined ? { lastFiredAt: record.lastFiredAt } : {}),
+        createdAt: record.createdAt,
+        updatedAt: record.updatedAt,
+    };
+}
+/** `GET` (member) / `POST` (owner) on the alert-rule collection. */
+export async function handleAlertRules(req, res, ref, deps) {
+    if (req.method === 'GET') {
+        const identity = await authorizeTenantControl(req, res, deps.gate, deps.controlPlane, ref.org);
+        if (identity === false)
+            return;
+        const rules = await deps.store.listAlertRules(ref);
+        return sendContract(res, () => AlertRulesListResponseSchema.parse({ ok: true, data: { rules: rules.map(publicAlertRule) } }));
+    }
+    if (req.method === 'POST')
+        return handleCreate(req, res, ref, deps);
+    return sendJson(res, 404, { error: 'not found' });
+}
+async function handleCreate(req, res, ref, deps) {
+    const identity = await authorizeOwner(req, res, ref, deps);
+    if (identity === undefined)
+        return;
+    const body = await readJsonBody(req, deps.maxBody);
+    if (!body.ok)
+        return sendJson(res, body.status, { error: body.error });
+    const parsed = body.value;
+    if (typeof parsed.metric !== 'string' ||
+        !ALERT_METRICS.includes(parsed.metric)) {
+        return sendJson(res, 400, {
+            error: `"metric" must be one of ${ALERT_METRICS.join(', ')}`,
+        });
+    }
+    if (typeof parsed.threshold !== 'number' ||
+        !Number.isFinite(parsed.threshold) ||
+        parsed.threshold < 0) {
+        return sendJson(res, 400, { error: '"threshold" must be a finite number >= 0' });
+    }
+    if (typeof parsed.windowMinutes !== 'number' ||
+        !ALERT_WINDOWS_MINUTES.includes(parsed.windowMinutes)) {
+        return sendJson(res, 400, {
+            error: `"windowMinutes" must be one of ${ALERT_WINDOWS_MINUTES.join(', ')}`,
+        });
+    }
+    if (parsed.name !== undefined &&
+        (typeof parsed.name !== 'string' || parsed.name.length === 0 || parsed.name.length > 100)) {
+        return sendJson(res, 400, { error: '"name" must be a string of 1-100 characters' });
+    }
+    if (parsed.cooldownMinutes !== undefined &&
+        (typeof parsed.cooldownMinutes !== 'number' ||
+            !Number.isInteger(parsed.cooldownMinutes) ||
+            parsed.cooldownMinutes < 1 ||
+            parsed.cooldownMinutes > 24 * 60)) {
+        return sendJson(res, 400, { error: '"cooldownMinutes" must be an integer from 1 to 1440' });
+    }
+    if (parsed.enabled !== undefined && typeof parsed.enabled !== 'boolean') {
+        return sendJson(res, 400, { error: '"enabled" must be a boolean' });
+    }
+    if (typeof parsed.webhookUrl !== 'string') {
+        return sendJson(res, 400, { error: '"webhookUrl" must be a string' });
+    }
+    const webhook = validateAlertWebhookUrl(parsed.webhookUrl, {
+        allowLoopback: deps.allowLoopbackWebhooks,
+    });
+    if (!webhook.ok)
+        return sendJson(res, 400, { error: webhook.error });
+    // Soft abuse cap, checked read-then-write: two concurrent owner creates can overshoot by a
+    // request or two, which is acceptable for a bound whose only job is preventing webhook floods —
+    // a hard transactional cap is not worth a table lock here (unlike the GHD-1 uniqueness rules).
+    const existing = await deps.store.listAlertRules(ref);
+    if (existing.length >= MAX_ALERT_RULES_PER_ENV) {
+        return sendJson(res, 409, {
+            error: `alert rule limit reached (${MAX_ALERT_RULES_PER_ENV} per environment); remove one first`,
+        });
+    }
+    const record = await deps.store.createAlertRule({
+        orgSlug: ref.org,
+        appSlug: ref.app,
+        environment: ref.env,
+        ...(parsed.name !== undefined ? { name: parsed.name } : {}),
+        metric: parsed.metric,
+        threshold: parsed.threshold,
+        windowMinutes: parsed.windowMinutes,
+        webhookUrl: parsed.webhookUrl,
+        ...(parsed.enabled !== undefined ? { enabled: parsed.enabled } : {}),
+        ...(parsed.cooldownMinutes !== undefined ? { cooldownMinutes: parsed.cooldownMinutes } : {}),
+        createdBySubject: identity.subject,
+    });
+    // Audit details are scalar-only and NEVER include the webhook URL or its host.
+    await deps.audit.emit({
+        eventType: 'alert.rule.created',
+        org: ref.org,
+        app: ref.app,
+        env: ref.env,
+        decision: 'allow',
+        status: 200,
+        actorSubject: identity.subject,
+        ...(identity.email !== undefined ? { actorEmail: identity.email } : {}),
+        details: {
+            ruleId: record.id,
+            metric: record.metric,
+            threshold: record.threshold,
+            windowMinutes: record.windowMinutes,
+        },
+    });
+    return sendContract(res, () => AlertRuleResponseSchema.parse({ ok: true, data: publicAlertRule(record) }));
+}
+/** `DELETE .../alerts/{id}` — org OWNER only; 404 when the rule is not in this tenant scope. */
+export async function handleAlertRuleDelete(req, res, ref, id, deps) {
+    const identity = await authorizeOwner(req, res, ref, deps);
+    if (identity === undefined)
+        return;
+    const deleted = await deps.store.deleteAlertRule(ref, id);
+    if (!deleted)
+        return sendJson(res, 404, { error: 'not found' });
+    await deps.audit.emit({
+        eventType: 'alert.rule.deleted',
+        org: ref.org,
+        app: ref.app,
+        env: ref.env,
+        decision: 'allow',
+        status: 200,
+        actorSubject: identity.subject,
+        ...(identity.email !== undefined ? { actorEmail: identity.email } : {}),
+        details: { ruleId: id },
+    });
+    return sendJson(res, 200, { ok: true, data: { deleted: true } });
+}
+/**
+ * `POST .../alerts/{id}/test` — org OWNER only: sends a synthetic `event: "test"` payload through
+ * the exact guarded delivery path a real breach uses. The response carries only the closed-code
+ * delivery outcome; a failed delivery is still a 200 (the route worked, the endpoint did not).
+ */
+export async function handleAlertRuleTest(req, res, ref, id, deps) {
+    const identity = await authorizeOwner(req, res, ref, deps);
+    if (identity === undefined)
+        return;
+    const rule = await deps.store.getAlertRule(ref, id);
+    if (rule === undefined)
+        return sendJson(res, 404, { error: 'not found' });
+    const firedAt = (deps.clock?.() ?? new Date()).toISOString();
+    const payload = buildAlertWebhookPayload(rule, 'test', rule.lastObserved ?? 0, firedAt);
+    const delivery = await deliverAlertWebhook(rule.webhookUrl, payload, {
+        allowLoopback: deps.allowLoopbackWebhooks,
+    });
+    await deps.audit.emit({
+        eventType: 'alert.rule.test_fired',
+        org: ref.org,
+        app: ref.app,
+        env: ref.env,
+        decision: 'allow',
+        status: 200,
+        actorSubject: identity.subject,
+        ...(identity.email !== undefined ? { actorEmail: identity.email } : {}),
+        details: {
+            ruleId: rule.id,
+            delivered: delivery.delivered,
+            ...(delivery.status !== undefined ? { httpStatus: delivery.status } : {}),
+            ...(delivery.reason !== undefined ? { reason: delivery.reason } : {}),
+        },
+    });
+    return sendJson(res, 200, { ok: true, data: { delivery } });
+}
+/** Owner gate shared by every alert mutation (mirrors the GHD-1 write posture). */
+async function authorizeOwner(req, res, ref, deps) {
+    const identity = await authorizeControlPlane(req, res, deps.gate, { requireIdentity: true });
+    if (identity === false)
+        return undefined;
+    if (!(await canManageMembers(deps.controlPlane, ref.org, identity))) {
+        sendForbidden(res, 'forbidden');
+        return undefined;
+    }
+    return identity;
+}
+//# sourceMappingURL=alerts.js.map

package/node_modules/@noodle-borg/service/dist/routes/alerts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alerts.js","sourceRoot":"","sources":["../../src/routes/alerts.ts"],"names":[],"mappings":"AACA,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACL,aAAa,EACb,qBAAqB,EAKrB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAyBlD,mGAAmG;AACnG,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,CAAC;IACtB,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,eAAe,CAAC,MAAuB;IAC9C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC;QAC5C,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAoB,EACpB,GAAmB,EACnB,GAAc,EACd,IAAoB;IAEpB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/F,IAAI,QAAQ,KAAK,KAAK;YAAE,OAAO;QAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnD,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAC5B,4BAA4B,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC,CAC9F,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACpE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,GAAoB,EACpB,GAAmB,EACnB,GAAc,EACd,IAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO;IACnC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAQnB,CAAC;IACF,IACE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,CAAE,aAAmC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAC7D,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACxB,KAAK,EAAE,2BAA2B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IACD,IACE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;QAClC,MAAM,CAAC,SAAS,GAAG,CAAC,EACpB,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IACE,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;QACxC,CAAE,qBAA2C,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAC5E,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACxB,KAAK,EAAE,kCAAkC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC5E,CAAC,CAAC;IACL,CAAC;IACD,IACE,MAAM,CAAC,IAAI,KAAK,SAAS;QACzB,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,EACzF,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,IACE,MAAM,CAAC,eAAe,KAAK,SAAS;QACpC,CAAC,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ;YACzC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC;YACzC,MAAM,CAAC,eAAe,GAAG,CAAC;YAC1B,MAAM,CAAC,eAAe,GAAG,EAAE,GAAG,EAAE,CAAC,EACnC,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qDAAqD,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACxE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,UAAU,EAAE;QACzD,aAAa,EAAE,IAAI,CAAC,qBAAqB;KAC1C,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAErE,2FAA2F;IAC3F,gGAAgG;IAChG,+FAA+F;IAC/F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,MAAM,IAAI,uBAAuB,EAAE,CAAC;QAC/C,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACxB,KAAK,EAAE,6BAA6B,uBAAuB,qCAAqC;SACjG,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;QAC9C,OAAO,EAAE,GAAG,CAAC,GAAG;QAChB,OAAO,EAAE,GAAG,CAAC,GAAG;QAChB,WAAW,EAAE,GAAG,CAAC,GAAG;QACpB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM,EAAE,MAAM,CAAC,MAAqB;QACpC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa,EAAE,MAAM,CAAC,aAAmC;QACzD,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,gBAAgB,EAAE,QAAQ,CAAC,OAAO;KACnC,CAAC,CAAC;IACH,+EAA+E;IAC/E,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QACpB,SAAS,EAAE,oBAAoB;QAC/B,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,GAAG;QACX,YAAY,EAAE,QAAQ,CAAC,OAAO;QAC9B,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,EAAE;YACP,MAAM,EAAE,MAAM,CAAC,EAAE;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;SACpC;KACF,CAAC,CAAC;IACH,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAC5B,uBAAuB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAoB,EACpB,GAAmB,EACnB,GAAc,EACd,EAAU,EACV,IAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO;IACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAChE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QACpB,SAAS,EAAE,oBAAoB;QAC/B,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,GAAG;QACX,YAAY,EAAE,QAAQ,CAAC,OAAO;QAC9B,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;KACxB,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAoB,EACpB,GAAmB,EACnB,GAAc,EACd,EAAU,EACV,IAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO;IACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7D,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IACxF,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE;QACnE,aAAa,EAAE,IAAI,CAAC,qBAAqB;KAC1C,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QACpB,SAAS,EAAE,uBAAuB;QAClC,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,GAAG;QACX,YAAY,EAAE,QAAQ,CAAC,OAAO;QAC9B,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,EAAE;YACP,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE;KACF,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,cAAc,CAC3B,GAAoB,EACpB,GAAmB,EACnB,GAAc,EACd,IAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7F,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QACpE,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAChC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/node_modules/@noodle-borg/service/dist/routes/analytics-dispatch.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Dispatch for the tenant analytics READ surface (metrics, events, session detail). Extracted
+ * verbatim from `service.ts` (which stays a thin composition root under the size gate), keeping the
+ * file's uniform parse → security headers → https guard → handler → catch-500 shape plus the
+ * 409 "requires a configured event store" precondition each analytics route shares.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { RequestEventStore } from '@noodle-borg/module';
+import type { TlsPosture } from '@noodle-borg/transport-http';
+import type { DeployAuthGate } from '../auth/deploy-gate.js';
+import type { ControlPlaneStore } from '../store.js';
+export interface AnalyticsDispatchDeps {
+    readonly gate: DeployAuthGate;
+    readonly controlPlane: ControlPlaneStore;
+    readonly requestEventStore: RequestEventStore | undefined;
+    readonly applySecurityHeaders: (res: ServerResponse, tls: TlsPosture) => void;
+    readonly enforceHttps: (req: IncomingMessage, res: ServerResponse, tls: TlsPosture) => boolean;
+    readonly sendJson: (res: ServerResponse, status: number, body: unknown) => void;
+    readonly tls: TlsPosture;
+}
+/** Try the analytics read routes; returns true when the request was handled (or a guard ended it). */
+export declare function dispatchAnalyticsReads(req: IncomingMessage, res: ServerResponse, url: URL, deps: AnalyticsDispatchDeps): boolean;
+//# sourceMappingURL=analytics-dispatch.d.ts.map

package/node_modules/@noodle-borg/service/dist/routes/analytics-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analytics-dispatch.d.ts","sourceRoot":"","sources":["../../src/routes/analytics-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIrD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;IACzC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAC1D,QAAQ,CAAC,oBAAoB,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,KAAK,IAAI,CAAC;IAC9E,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC;IAC/F,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAChF,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;CAC1B;AAED,sGAAsG;AACtG,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CA+DT"}

package/node_modules/@noodle-borg/service/dist/routes/analytics-dispatch.js

@@ -0,0 +1,53 @@
+import { handleTenantEvents, handleTenantMetrics, handleTenantSession } from './analytics.js';
+import { parseTenantEventsPath, parseTenantMetricsPath, parseTenantSessionPath } from './paths.js';
+/** Try the analytics read routes; returns true when the request was handled (or a guard ended it). */
+export function dispatchAnalyticsReads(req, res, url, deps) {
+    const { gate, controlPlane, requestEventStore, applySecurityHeaders, enforceHttps, sendJson, tls, } = deps;
+    const metricsRef = parseTenantMetricsPath(url.pathname);
+    if (metricsRef !== undefined && req.method === 'GET') {
+        applySecurityHeaders(res, tls);
+        if (enforceHttps(req, res, tls))
+            return true;
+        if (requestEventStore === undefined) {
+            sendJson(res, 409, { ok: false, error: 'metrics require a configured event store' });
+            return true;
+        }
+        handleTenantMetrics(req, res, gate, controlPlane, requestEventStore, metricsRef, url).catch(() => {
+            if (!res.headersSent)
+                sendJson(res, 500, { error: 'internal error' });
+        });
+        return true;
+    }
+    const eventsRef = parseTenantEventsPath(url.pathname);
+    if (eventsRef !== undefined && req.method === 'GET') {
+        applySecurityHeaders(res, tls);
+        if (enforceHttps(req, res, tls))
+            return true;
+        if (requestEventStore === undefined) {
+            sendJson(res, 409, { ok: false, error: 'events require a configured event store' });
+            return true;
+        }
+        handleTenantEvents(req, res, gate, controlPlane, requestEventStore, eventsRef, url).catch(() => {
+            if (!res.headersSent)
+                sendJson(res, 500, { error: 'internal error' });
+        });
+        return true;
+    }
+    const sessionRef = parseTenantSessionPath(url.pathname);
+    if (sessionRef !== undefined && req.method === 'GET') {
+        applySecurityHeaders(res, tls);
+        if (enforceHttps(req, res, tls))
+            return true;
+        if (requestEventStore === undefined) {
+            sendJson(res, 409, { ok: false, error: 'sessions require a configured event store' });
+            return true;
+        }
+        handleTenantSession(req, res, gate, controlPlane, requestEventStore, sessionRef.ref, sessionRef.sessionId).catch(() => {
+            if (!res.headersSent)
+                sendJson(res, 500, { error: 'internal error' });
+        });
+        return true;
+    }
+    return false;
+}
+//# sourceMappingURL=analytics-dispatch.js.map

package/node_modules/@noodle-borg/service/dist/routes/analytics-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analytics-dispatch.js","sourceRoot":"","sources":["../../src/routes/analytics-dispatch.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC9F,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAYnG,sGAAsG;AACtG,MAAM,UAAU,sBAAsB,CACpC,GAAoB,EACpB,GAAmB,EACnB,GAAQ,EACR,IAA2B;IAE3B,MAAM,EACJ,IAAI,EACJ,YAAY,EACZ,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,QAAQ,EACR,GAAG,GACJ,GAAG,IAAI,CAAC;IAET,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACrD,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC,CAAC;YACrF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CACzF,GAAG,EAAE;YACH,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACpD,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YACpF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,iBAAiB,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,KAAK,CACvF,GAAG,EAAE;YACH,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACrD,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC,CAAC;YACtF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,mBAAmB,CACjB,GAAG,EACH,GAAG,EACH,IAAI,EACJ,YAAY,EACZ,iBAAiB,EACjB,UAAU,CAAC,GAAG,EACd,UAAU,CAAC,SAAS,CACrB,CAAC,KAAK,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/node_modules/@noodle-borg/service/dist/routes/apps.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The `apps` resource read routes: `GET /v1/orgs/{org}/apps` (list) and `GET /v1/orgs/{org}/apps/{app}`
+ * (inspect). Membership-gated exactly like the deployments/org routes (`authorizeTenantControl`); the
+ * response payload is `.parse()`d through the Zod contracts (`./contracts.js`) before it goes on the
+ * wire, so the shape can never drift from what's declared there. Contract-parse failures are OUR bug,
+ * not the caller's: they return 500 (visible to 5xx alerting), while store/lookup failures stay 400.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { DeployAuthGate } from '../auth/deploy-gate.js';
+import type { ServerRegistry } from '../registry.js';
+import type { ControlPlaneStore } from '../store.js';
+export declare function handleApps(req: IncomingMessage, res: ServerResponse, registry: ServerRegistry, gate: DeployAuthGate, controlPlane: ControlPlaneStore, ref: {
+    org: string;
+}, url: URL, endpointBase: string): Promise<void>;
+export declare function handleApp(req: IncomingMessage, res: ServerResponse, registry: ServerRegistry, gate: DeployAuthGate, controlPlane: ControlPlaneStore, ref: {
+    org: string;
+    app: string;
+}, endpointBase: string): Promise<void>;
+/**
+ * Send a contract-parsed body; a parse throw means the SERVICE broke its own wire contract
+ * (e.g. an aggregation bug), so report 500 — never blame the client with a 400.
+ */
+export declare function sendContract(res: ServerResponse, build: () => unknown): void;
+//# sourceMappingURL=apps.d.ts.map

package/node_modules/@noodle-borg/service/dist/routes/apps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps.d.ts","sourceRoot":"","sources":["../../src/routes/apps.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAOrD,wBAAsB,UAAU,CAC9B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACpB,GAAG,EAAE,GAAG,EACR,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED,wBAAsB,SAAS,CAC7B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACjC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAYf;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,OAAO,GAAG,IAAI,CAS5E"}

package/node_modules/@noodle-borg/service/dist/routes/apps.js

@@ -0,0 +1,72 @@
+import { sendJson } from '../http-util.js';
+import { AppResponseSchema, AppsListResponseSchema } from './contracts.js';
+import { authorizeTenantControl } from './control-plane.js';
+import { appWithEndpointUrl } from './endpoint-enrichment.js';
+const MAX_APPS_LIMIT = 500;
+export async function handleApps(req, res, registry, gate, controlPlane, ref, url, endpointBase) {
+    const identity = await authorizeTenantControl(req, res, gate, controlPlane, ref.org);
+    if (identity === false)
+        return;
+    const includeArchived = url.searchParams.get('archived') === 'true';
+    const limit = parseAppsLimit(url.searchParams.get('limit'));
+    if (limit === false) {
+        return sendJson(res, 400, { error: `"limit" must be an integer from 1 to ${MAX_APPS_LIMIT}` });
+    }
+    let result;
+    try {
+        result = await registry.listApps(ref.org, {
+            ...(includeArchived ? { includeArchived: true } : {}),
+            ...(limit !== undefined ? { limit } : {}),
+        });
+    }
+    catch (error) {
+        return sendJson(res, 400, { error: error.message });
+    }
+    return sendContract(res, () => AppsListResponseSchema.parse({
+        ok: true,
+        data: {
+            ...result,
+            apps: result.apps.map((app) => appWithEndpointUrl(app, endpointBase)),
+        },
+    }));
+}
+export async function handleApp(req, res, registry, gate, controlPlane, ref, endpointBase) {
+    const identity = await authorizeTenantControl(req, res, gate, controlPlane, ref.org);
+    if (identity === false)
+        return;
+    let app;
+    try {
+        app = await registry.getApp(ref.org, ref.app);
+    }
+    catch (error) {
+        return sendJson(res, 400, { error: error.message });
+    }
+    if (app === undefined)
+        return sendJson(res, 404, { error: 'not found' });
+    const enriched = appWithEndpointUrl(app, endpointBase);
+    return sendContract(res, () => AppResponseSchema.parse({ ok: true, data: enriched }));
+}
+/**
+ * Send a contract-parsed body; a parse throw means the SERVICE broke its own wire contract
+ * (e.g. an aggregation bug), so report 500 — never blame the client with a 400.
+ */
+export function sendContract(res, build) {
+    let body;
+    try {
+        body = build();
+    }
+    catch {
+        sendJson(res, 500, { error: 'internal error' });
+        return;
+    }
+    sendJson(res, 200, body);
+}
+function parseAppsLimit(value) {
+    if (value === null || value.trim() === '')
+        return undefined;
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 1 || parsed > MAX_APPS_LIMIT)
+        return false;
+    return parsed;
+}
+//# sourceMappingURL=apps.js.map

package/node_modules/@noodle-borg/service/dist/routes/apps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps.js","sourceRoot":"","sources":["../../src/routes/apps.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAG3C,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAoB,EACpB,GAAmB,EACnB,QAAwB,EACxB,IAAoB,EACpB,YAA+B,EAC/B,GAAoB,EACpB,GAAQ,EACR,YAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACrF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,MAAM,eAAe,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC;IACpE,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wCAAwC,cAAc,EAAE,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,MAAuD,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE;YACxC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAC5B,sBAAsB,CAAC,KAAK,CAAC;QAC3B,EAAE,EAAE,IAAI;QACR,IAAI,EAAE;YACJ,GAAG,MAAM;YACT,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;SACtE;KACF,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAoB,EACpB,GAAmB,EACnB,QAAwB,EACxB,IAAoB,EACpB,YAA+B,EAC/B,GAAiC,EACjC,YAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACrF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,IAAI,GAAkD,CAAC;IACvD,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACvD,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAmB,EAAE,KAAoB;IACpE,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,KAAK,EAAE,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,cAAc,CAAC,KAAoB;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,cAAc;QAAE,OAAO,KAAK,CAAC;IACrF,OAAO,MAAM,CAAC;AAChB,CAAC"}