@noodleseed/one 0.16.0 → 0.18.0

package/node_modules/@noodle-borg/service/dist/routes/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../src/routes/contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,YAAY,GAAG;IACnB,YAAY;IACZ,aAAa;IACb,QAAQ;IACR,OAAO;IACP,WAAW;IACX,eAAe;CACP,CAAC;AAEX,yDAAyD;AACzD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,4FAA4F;AAC5F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,kDAAkD;AAClD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,MAAM,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,wDAAwD;AACxD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAC/B,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;KACvB,CAAC;SACD,MAAM,EAAE;CACZ,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,IAAI,EAAE,gBAAgB;CACvB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,kDAAkD;AAClD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAChD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,iHAAiH;AACjH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;KAChC,CAAC;SACD,MAAM,EAAE;CACZ,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,uFAAuF;AACvF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,IAAI,EAAE,gBAAgB;CACvB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,mGAAmG;AACnG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,IAAI,EAAE,uBAAuB;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,qGAAqG;AACrG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,uFAAuF;AACvF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,IAAI,EAAE,oBAAoB;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,4FAA4F;AAC5F,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;QACb,QAAQ;QACR,UAAU;QACV,WAAW;QACX,UAAU;QACV,QAAQ;QACR,UAAU;QACV,YAAY;KACb,CAAC;IACF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,0EAA0E;AAC1E,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;QAC9B,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;KACvB,CAAC;SACD,MAAM,EAAE;CACZ,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,2DAA2D;AAC3D,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;KAClB,CAAC;SACD,MAAM,EAAE;CACZ,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,iFAAiF;AACjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,IAAI,EAAE,eAAe;CACtB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,gFAAgF;AAChF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;CAC7D,CAAC;KACD,MAAM,EAAE,CAAC"}

package/node_modules/@noodle-borg/service/dist/routes/deployments.d.ts

@@ -10,7 +10,18 @@ import type { AuditSink } from '../store/audit.js';
 import type { ControlPlaneStore } from '../store.js';
 export declare function handleDeployments(req: IncomingMessage, res: ServerResponse, registry: ServerRegistry, gate: DeployAuthGate, controlPlane: ControlPlaneStore, ref: {
     org: string;
-}, url: URL): Promise<void>;
+}, url: URL, endpointBase: string): Promise<void>;
+/**
+ * The single-deployment item route: `GET /v1/orgs/{org}/deployments/{deploymentId}` (deployment
+ * inspect). Membership-gated exactly like the `apps`/`envs` item routes (`authorizeTenantControl`); a
+ * deployment that exists but belongs to a different org 404s identically to an unknown id — cross-org
+ * existence must never leak. Archived deployments ARE returned (with `archivedAt` set): inspecting
+ * history, including an archived deployment, is the point of this lookup.
+ */
+export declare function handleDeploymentItem(req: IncomingMessage, res: ServerResponse, registry: ServerRegistry, gate: DeployAuthGate, controlPlane: ControlPlaneStore, ref: {
+    org: string;
+    deploymentId: string;
+}, endpointBase: string): Promise<void>;
 export declare function handleAuditEvents(req: IncomingMessage, res: ServerResponse, gate: DeployAuthGate, controlPlane: ControlPlaneStore, audit: AuditSink, ref: {
     org: string;
 }, url: URL): Promise<void>;

package/node_modules/@noodle-borg/service/dist/routes/deployments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deployments.d.ts","sourceRoot":"","sources":["../../src/routes/deployments.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGrD,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACpB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,KAAK,EAAE,SAAS,EAChB,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACpB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA0Cf"}
+{"version":3,"file":"deployments.d.ts","sourceRoot":"","sources":["../../src/routes/deployments.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAMrD,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACpB,GAAG,EAAE,GAAG,EACR,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,EAC1C,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,KAAK,EAAE,SAAS,EAChB,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACpB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA0Cf"}

package/node_modules/@noodle-borg/service/dist/routes/deployments.js

@@ -1,6 +1,9 @@
 import { sendForbidden, sendJson } from '../http-util.js';
+import { sendContract } from './apps.js';
+import { DeploymentResponseSchema } from './contracts.js';
 import { authorizeControlPlane, authorizeTenantControl } from './control-plane.js';
-export async function handleDeployments(req, res, registry, gate, controlPlane, ref, url) {
+import { withEndpointUrl } from './endpoint-enrichment.js';
+export async function handleDeployments(req, res, registry, gate, controlPlane, ref, url, endpointBase) {
     const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
     if (identity === false)
         return;
@@ -19,11 +22,37 @@ export async function handleDeployments(req, res, registry, gate, controlPlane,
             ...(env !== undefined ? { env } : {}),
             ...(includeArchived ? { includeArchived: true } : {}),
         });
-        return sendJson(res, 200, { ok: true, deployments });
+        return sendJson(res, 200, {
+            ok: true,
+            deployments: deployments.map((record) => withEndpointUrl(record, endpointBase)),
+        });
+    }
+    catch (error) {
+        return sendJson(res, 400, { error: error.message });
+    }
+}
+/**
+ * The single-deployment item route: `GET /v1/orgs/{org}/deployments/{deploymentId}` (deployment
+ * inspect). Membership-gated exactly like the `apps`/`envs` item routes (`authorizeTenantControl`); a
+ * deployment that exists but belongs to a different org 404s identically to an unknown id — cross-org
+ * existence must never leak. Archived deployments ARE returned (with `archivedAt` set): inspecting
+ * history, including an archived deployment, is the point of this lookup.
+ */
+export async function handleDeploymentItem(req, res, registry, gate, controlPlane, ref, endpointBase) {
+    const identity = await authorizeTenantControl(req, res, gate, controlPlane, ref.org);
+    if (identity === false)
+        return;
+    let deployment;
+    try {
+        deployment = await registry.getDeployment(ref.org, ref.deploymentId);
     }
     catch (error) {
         return sendJson(res, 400, { error: error.message });
     }
+    if (deployment === undefined)
+        return sendJson(res, 404, { error: 'unknown deployment' });
+    const enriched = withEndpointUrl(deployment, endpointBase);
+    return sendContract(res, () => DeploymentResponseSchema.parse({ ok: true, data: enriched }));
 }
 export async function handleAuditEvents(req, res, gate, controlPlane, audit, ref, url) {
     const identity = await authorizeTenantControl(req, res, gate, controlPlane, ref.org);

package/node_modules/@noodle-borg/service/dist/routes/deployments.js.map

@@ -1 +1 @@
-{"version":3,"file":"deployments.js","sourceRoot":"","sources":["../../src/routes/deployments.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAI1D,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAEnF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAoB,EACpB,GAAmB,EACnB,QAAwB,EACxB,IAAoB,EACpB,YAA+B,EAC/B,GAAoB,EACpB,GAAQ;IAER,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,MAAM;YAAE,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;IACrD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;IACrD,MAAM,eAAe,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC;YACjD,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAoB,EACpB,GAAmB,EACnB,IAAoB,EACpB,YAA+B,EAC/B,KAAgB,EAChB,GAAoB,EACpB,GAAQ;IAER,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACrF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACxB,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,gDAAgD;SACxD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7D,IAAI,KAAK,KAAK,KAAK;QACjB,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC,CAAC;IACnF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC;YAC9B,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC;YACf,SAAS,EAAE,sBAAsB;YACjC,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,GAAG;YACX,YAAY,EAAE,QAAQ,CAAC,OAAO;YAC9B,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,EAAE;gBACP,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,WAAW,EAAE,MAAM,CAAC,MAAM;aAC3B;SACF,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAgB;IACpC,OAAO,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CAAC,GAAQ,EAAE,GAAW;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACnE,CAAC;AAED,SAAS,eAAe,CAAC,KAAoB;IAC3C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IAC1E,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"deployments.js","sourceRoot":"","sources":["../../src/routes/deployments.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAI1D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE3D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAoB,EACpB,GAAmB,EACnB,QAAwB,EACxB,IAAoB,EACpB,YAA+B,EAC/B,GAAoB,EACpB,GAAQ,EACR,YAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,MAAM;YAAE,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;IACrD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;IACrD,MAAM,eAAe,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC;YACjD,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACxB,EAAE,EAAE,IAAI;YACR,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;SAChF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAoB,EACpB,GAAmB,EACnB,QAAwB,EACxB,IAAoB,EACpB,YAA+B,EAC/B,GAA0C,EAC1C,YAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACrF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,IAAI,UAAgE,CAAC;IACrE,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC3D,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAoB,EACpB,GAAmB,EACnB,IAAoB,EACpB,YAA+B,EAC/B,KAAgB,EAChB,GAAoB,EACpB,GAAQ;IAER,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACrF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACxB,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,gDAAgD;SACxD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7D,IAAI,KAAK,KAAK,KAAK;QACjB,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC,CAAC;IACnF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC;YAC9B,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC;YACf,SAAS,EAAE,sBAAsB;YACjC,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,GAAG;YACX,YAAY,EAAE,QAAQ,CAAC,OAAO;YAC9B,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,EAAE;gBACP,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,WAAW,EAAE,MAAM,CAAC,MAAM;aAC3B;SACF,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAgB;IACpC,OAAO,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CAAC,GAAQ,EAAE,GAAW;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACnE,CAAC;AAED,SAAS,eAAe,CAAC,KAAoB;IAC3C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IAC1E,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/node_modules/@noodle-borg/service/dist/routes/endpoint-enrichment.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Route-layer endpoint enrichment for the resource read surface (CodeRabbit finding, 2026-07-05):
+ * `DeploymentSummary.endpointUrl` is derived from the REQUEST's public base (it is a wire concern,
+ * not stored state — the same deployment answers on whatever host the service is reached through),
+ * so the store/aggregation layers stay base-agnostic and the routes stamp the URL on the way out.
+ * Used by the apps/envs facing deployments and the deployments collection/item responses, keeping
+ * the whole resource family consistent with what `deploy`/`status` already report.
+ */
+import type { IncomingMessage } from 'node:http';
+import type { AppSummary, DeploymentSummary, EnvSummary } from '../store.js';
+/** Per-request endpoint base: explicit `publicBaseUrl` wins, else the request's own origin. */
+export type ResolveEndpointBase = (req: IncomingMessage) => string;
+/** Stamp `endpointUrl` onto one deployment summary. */
+export declare function withEndpointUrl(summary: DeploymentSummary, base: string): DeploymentSummary;
+export declare function appWithEndpointUrl(app: AppSummary, base: string): AppSummary;
+export declare function envWithEndpointUrl(env: EnvSummary, base: string): EnvSummary;
+//# sourceMappingURL=endpoint-enrichment.d.ts.map

package/node_modules/@noodle-borg/service/dist/routes/endpoint-enrichment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-enrichment.d.ts","sourceRoot":"","sources":["../../src/routes/endpoint-enrichment.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE7E,+FAA+F;AAC/F,MAAM,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,MAAM,CAAC;AAEnE,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAS3F;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CAE5E;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CAE5E"}

package/node_modules/@noodle-borg/service/dist/routes/endpoint-enrichment.js

@@ -0,0 +1,15 @@
+import { tenantMcpUrl } from '../registry-helpers.js';
+/** Stamp `endpointUrl` onto one deployment summary. */
+export function withEndpointUrl(summary, base) {
+    return {
+        ...summary,
+        endpointUrl: tenantMcpUrl(base, { org: summary.orgSlug, app: summary.appSlug, env: summary.environment }, summary.serverVersion),
+    };
+}
+export function appWithEndpointUrl(app, base) {
+    return app.latest === undefined ? app : { ...app, latest: withEndpointUrl(app.latest, base) };
+}
+export function envWithEndpointUrl(env, base) {
+    return env.latest === undefined ? env : { ...env, latest: withEndpointUrl(env.latest, base) };
+}
+//# sourceMappingURL=endpoint-enrichment.js.map

package/node_modules/@noodle-borg/service/dist/routes/endpoint-enrichment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-enrichment.js","sourceRoot":"","sources":["../../src/routes/endpoint-enrichment.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAMtD,uDAAuD;AACvD,MAAM,UAAU,eAAe,CAAC,OAA0B,EAAE,IAAY;IACtE,OAAO;QACL,GAAG,OAAO;QACV,WAAW,EAAE,YAAY,CACvB,IAAI,EACJ,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,EACxE,OAAO,CAAC,aAAa,CACtB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAe,EAAE,IAAY;IAC9D,OAAO,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;AAChG,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAe,EAAE,IAAY;IAC9D,OAAO,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;AAChG,CAAC"}

package/node_modules/@noodle-borg/service/dist/routes/envs.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The `envs` resource read routes: `GET /v1/orgs/{org}/apps/{app}/envs` (list) and
+ * `GET /v1/orgs/{org}/apps/{app}/envs/{env}` (inspect). Membership-gated exactly like the `apps`
+ * routes (`authorizeTenantControl`); the response payload is `.parse()`d through the Zod contracts
+ * (`./contracts.js`) before it goes on the wire, so the shape can never drift from what's declared
+ * there. Contract-parse failures return 500 via `sendContract` (our bug, not the caller's); store
+ * lookups keep 400. No pagination — env counts per app are small.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { DeployAuthGate } from '../auth/deploy-gate.js';
+import type { ServerRegistry } from '../registry.js';
+import type { ControlPlaneStore } from '../store.js';
+export declare function handleEnvs(req: IncomingMessage, res: ServerResponse, registry: ServerRegistry, gate: DeployAuthGate, controlPlane: ControlPlaneStore, ref: {
+    org: string;
+    app: string;
+}, url: URL, endpointBase: string): Promise<void>;
+export declare function handleEnv(req: IncomingMessage, res: ServerResponse, registry: ServerRegistry, gate: DeployAuthGate, controlPlane: ControlPlaneStore, ref: {
+    org: string;
+    app: string;
+    env: string;
+}, endpointBase: string): Promise<void>;
+//# sourceMappingURL=envs.d.ts.map

package/node_modules/@noodle-borg/service/dist/routes/envs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envs.d.ts","sourceRoot":"","sources":["../../src/routes/envs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAMrD,wBAAsB,UAAU,CAC9B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACjC,GAAG,EAAE,GAAG,EACR,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED,wBAAsB,SAAS,CAC7B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAC9C,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAYf"}

package/node_modules/@noodle-borg/service/dist/routes/envs.js

@@ -0,0 +1,46 @@
+import { sendJson } from '../http-util.js';
+import { sendContract } from './apps.js';
+import { EnvResponseSchema, EnvsListResponseSchema } from './contracts.js';
+import { authorizeTenantControl } from './control-plane.js';
+import { envWithEndpointUrl } from './endpoint-enrichment.js';
+export async function handleEnvs(req, res, registry, gate, controlPlane, ref, url, endpointBase) {
+    const identity = await authorizeTenantControl(req, res, gate, controlPlane, ref.org);
+    if (identity === false)
+        return;
+    const includeArchived = url.searchParams.get('archived') === 'true';
+    let envs;
+    try {
+        // Distinguish "app has no envs yet" (200, empty list) from "app does not exist" (404) — the same
+        // way `handleApp` treats a missing `getApp` result as not-found.
+        const app = await registry.getApp(ref.org, ref.app);
+        if (app === undefined)
+            return sendJson(res, 404, { error: 'not found' });
+        envs = await registry.listEnvironments(ref.org, ref.app, {
+            ...(includeArchived ? { includeArchived: true } : {}),
+        });
+    }
+    catch (error) {
+        return sendJson(res, 400, { error: error.message });
+    }
+    return sendContract(res, () => EnvsListResponseSchema.parse({
+        ok: true,
+        data: { envs: envs.map((env) => envWithEndpointUrl(env, endpointBase)) },
+    }));
+}
+export async function handleEnv(req, res, registry, gate, controlPlane, ref, endpointBase) {
+    const identity = await authorizeTenantControl(req, res, gate, controlPlane, ref.org);
+    if (identity === false)
+        return;
+    let env;
+    try {
+        env = await registry.getEnvironment(ref.org, ref.app, ref.env);
+    }
+    catch (error) {
+        return sendJson(res, 400, { error: error.message });
+    }
+    if (env === undefined)
+        return sendJson(res, 404, { error: 'not found' });
+    const enriched = envWithEndpointUrl(env, endpointBase);
+    return sendContract(res, () => EnvResponseSchema.parse({ ok: true, data: enriched }));
+}
+//# sourceMappingURL=envs.js.map

package/node_modules/@noodle-borg/service/dist/routes/envs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envs.js","sourceRoot":"","sources":["../../src/routes/envs.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAG3C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAoB,EACpB,GAAmB,EACnB,QAAwB,EACxB,IAAoB,EACpB,YAA+B,EAC/B,GAAiC,EACjC,GAAQ,EACR,YAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACrF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,MAAM,eAAe,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC;IACpE,IAAI,IAA6D,CAAC;IAClE,IAAI,CAAC;QACH,iGAAiG;QACjG,iEAAiE;QACjE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACzE,IAAI,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE;YACvD,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAC5B,sBAAsB,CAAC,KAAK,CAAC;QAC3B,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,EAAE;KACzE,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAoB,EACpB,GAAmB,EACnB,QAAwB,EACxB,IAAoB,EACpB,YAA+B,EAC/B,GAA8C,EAC9C,YAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACrF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,IAAI,GAA0D,CAAC;IAC/D,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACvD,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AACxF,CAAC"}

package/node_modules/@noodle-borg/service/dist/routes/github-connection.d.ts

@@ -0,0 +1,29 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { DeployAuthGate } from '../auth/deploy-gate.js';
+import type { GitHubAppClient, GithubAppConfig } from '../github/app-client.js';
+import type { PendingGithubInstallationStore } from '../github/pending-installations.js';
+import type { AuditSink } from '../store/audit.js';
+import type { ControlPlaneStore, GithubConnectionStore } from '../store.js';
+export interface GithubConnectionRouteRef {
+    readonly org: string;
+    readonly app: string;
+}
+export declare function handleGithubConnection(req: IncomingMessage, res: ServerResponse, gate: DeployAuthGate, controlPlane: ControlPlaneStore, store: GithubConnectionStore, client: GitHubAppClient | undefined, githubApp: GithubAppConfig | undefined, maxBody: number, ref: GithubConnectionRouteRef, audit: AuditSink): Promise<void>;
+/**
+ * `GET /v1/github/install-url` — authenticated (any identity, membership is checked later at claim/connect
+ * time); `?org=`/`?app=` name the target. Returns GitHub's installations/new URL plus an HMAC-signed,
+ * 10-minute `state` nonce binding `{subject, org, app, issuedAt}` so a later `claim` can only be completed
+ * by the same caller for the same org/app. 409 when the GitHub App is not configured.
+ */
+export declare function handleGithubInstallUrl(req: IncomingMessage, res: ServerResponse, gate: DeployAuthGate, githubApp: GithubAppConfig | undefined, url: URL): Promise<void>;
+/**
+ * `POST /v1/github/installations/claim` — verifies the `state` nonce (signature, expiry, and that the
+ * caller is the same subject who requested it), then requires the caller to be an org OWNER of the
+ * nonce's bound org before returning the installation's repositories for the client to pick from. Any
+ * nonce problem (tampered, expired, foreign subject) is a 403 with no state change. The installationId
+ * is derived EXCLUSIVELY from the pending store entry GitHub's setup redirect landed for this state —
+ * never from the request body — so a caller can only ever enumerate the installation they themselves
+ * just installed, not an arbitrary tenant's (409 when the redirect hasn't landed).
+ */
+export declare function handleGithubInstallationClaim(req: IncomingMessage, res: ServerResponse, gate: DeployAuthGate, controlPlane: ControlPlaneStore, client: GitHubAppClient | undefined, githubApp: GithubAppConfig | undefined, pendingStore: PendingGithubInstallationStore, maxBody: number): Promise<void>;
+//# sourceMappingURL=github-connection.d.ts.map

package/node_modules/@noodle-borg/service/dist/routes/github-connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-connection.d.ts","sourceRoot":"","sources":["../../src/routes/github-connection.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAMhF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AAEzF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAM5E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,KAAK,EAAE,qBAAqB,EAC5B,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,SAAS,EAAE,eAAe,GAAG,SAAS,EACtC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,wBAAwB,EAC7B,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,IAAI,CAAC,CAOf;AA0ID;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,SAAS,EAAE,eAAe,GAAG,SAAS,EACtC,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,SAAS,EAAE,eAAe,GAAG,SAAS,EACtC,YAAY,EAAE,8BAA8B,EAC5C,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CA2Bf"}

package/node_modules/@noodle-borg/service/dist/routes/github-connection.js

@@ -0,0 +1,202 @@
+/**
+ * GHD-1 GitHub repository connection routes: `GET`/`POST`/`DELETE
+ * /v1/orgs/{org}/apps/{app}/github/connection`, plus the installation hand-off
+ * `GET /v1/github/install-url` and `POST /v1/github/installations/claim`. Membership rules mirror the
+ * org-admin routes exactly (`authorizeTenantControl` for member reads, `canManageMembers` for owner-only
+ * writes) — this file is the security review point for GHD-1.2. The server NEVER trusts caller-supplied
+ * repo metadata: `POST .../connection` always re-derives `ownerLogin`/`repoName`/`defaultBranch` from the
+ * {@link GitHubAppClient}, and no route here ever persists a token.
+ */
+import { randomUUID } from 'node:crypto';
+import { resolveGithubStateSecret, signInstallNonce, verifyInstallNonce, } from '../github/install-nonce.js';
+import { readJsonBody, sendForbidden, sendJson } from '../http-util.js';
+import { sendContract } from './apps.js';
+import { GithubConnectionResponseSchema, GithubInstallUrlResponseSchema } from './contracts.js';
+import { authorizeControlPlane, authorizeTenantControl } from './control-plane.js';
+import { canManageMembers } from './org-admin.js';
+export async function handleGithubConnection(req, res, gate, controlPlane, store, client, githubApp, maxBody, ref, audit) {
+    if (req.method === 'GET')
+        return handleGet(req, res, gate, controlPlane, store, ref);
+    if (req.method === 'POST') {
+        return handlePost(req, res, gate, controlPlane, store, client, githubApp, maxBody, ref, audit);
+    }
+    if (req.method === 'DELETE')
+        return handleDelete(req, res, gate, controlPlane, store, ref, audit);
+    return sendJson(res, 404, { error: 'not found' });
+}
+/** `GET .../github/connection` — org MEMBER read; 404 when no connection is enabled. */
+async function handleGet(req, res, gate, controlPlane, store, ref) {
+    const identity = await authorizeTenantControl(req, res, gate, controlPlane, ref.org);
+    if (identity === false)
+        return;
+    const record = await store.getRepoConnection(ref.org, ref.app);
+    if (record === undefined)
+        return sendJson(res, 404, { error: 'not found' });
+    return sendContract(res, () => GithubConnectionResponseSchema.parse({ ok: true, data: record }));
+}
+/**
+ * `POST .../github/connection` — org OWNER only. Verifies the installation exists AND the repository
+ * belongs to it via the {@link GitHubAppClient} before writing anything (a mismatch is a 400 with no
+ * state change); fills `ownerLogin`/`repoName`/`defaultBranch` from the client, never from the request
+ * body. Uniqueness conflicts (same app already connected to a different repo, or vice versa) are a 409.
+ */
+async function handlePost(req, res, gate, controlPlane, store, client, githubApp, maxBody, ref, audit) {
+    const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
+    if (identity === false)
+        return;
+    if (!(await canManageMembers(controlPlane, ref.org, identity)))
+        return sendForbidden(res, 'forbidden');
+    if (githubApp?.appSlug === undefined) {
+        return sendJson(res, 409, { error: 'the GitHub App is not configured for this service' });
+    }
+    if (client === undefined) {
+        return sendJson(res, 409, {
+            error: 'the GitHub App client is not configured for this service',
+        });
+    }
+    const body = await readJsonBody(req, maxBody);
+    if (!body.ok)
+        return sendJson(res, body.status, { error: body.error });
+    const parsed = body.value;
+    if (!isPositiveInteger(parsed.installationId)) {
+        return sendJson(res, 400, { error: '"installationId" must be a positive integer' });
+    }
+    if (!isPositiveInteger(parsed.githubRepositoryId)) {
+        return sendJson(res, 400, { error: '"githubRepositoryId" must be a positive integer' });
+    }
+    if (parsed.repoRoot !== undefined && typeof parsed.repoRoot !== 'string') {
+        return sendJson(res, 400, { error: '"repoRoot" must be a string' });
+    }
+    const installationId = parsed.installationId;
+    const githubRepositoryId = parsed.githubRepositoryId;
+    const repoRoot = typeof parsed.repoRoot === 'string' ? parsed.repoRoot : undefined;
+    const installation = await client.getInstallation(installationId);
+    if (installation === undefined) {
+        return sendJson(res, 400, { error: `installation ${installationId} not found` });
+    }
+    const repositories = await client.listInstallationRepositories(installationId);
+    const repository = repositories.find((candidate) => candidate.id === githubRepositoryId);
+    if (repository === undefined) {
+        return sendJson(res, 400, {
+            error: `repository ${githubRepositoryId} does not belong to installation ${installationId}`,
+        });
+    }
+    const result = await store.upsertRepoConnection({
+        githubRepositoryId,
+        installationId,
+        ownerLogin: installation.accountLogin,
+        repoName: repository.fullName,
+        defaultBranch: repository.defaultBranch,
+        ...(repoRoot !== undefined ? { repoRoot } : {}),
+        orgSlug: ref.org,
+        appSlug: ref.app,
+        createdBySubject: identity.subject,
+    });
+    if (!result.ok)
+        return sendJson(res, 409, { error: result.error.message });
+    await audit.emit({
+        eventType: 'github.connection.connected',
+        org: ref.org,
+        app: ref.app,
+        decision: 'allow',
+        status: 200,
+        actorSubject: identity.subject,
+        ...(identity.email !== undefined ? { actorEmail: identity.email } : {}),
+        details: { githubRepositoryId, installationId },
+    });
+    return sendContract(res, () => GithubConnectionResponseSchema.parse({ ok: true, data: result.record }));
+}
+/** `DELETE .../github/connection` — org OWNER only; idempotent disable. */
+async function handleDelete(req, res, gate, controlPlane, store, ref, audit) {
+    const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
+    if (identity === false)
+        return;
+    if (!(await canManageMembers(controlPlane, ref.org, identity)))
+        return sendForbidden(res, 'forbidden');
+    const disabled = await store.disableRepoConnection(ref.org, ref.app);
+    if (disabled) {
+        await audit.emit({
+            eventType: 'github.connection.disabled',
+            org: ref.org,
+            app: ref.app,
+            decision: 'allow',
+            status: 200,
+            actorSubject: identity.subject,
+            ...(identity.email !== undefined ? { actorEmail: identity.email } : {}),
+            details: {},
+        });
+    }
+    return sendJson(res, 200, { ok: true, data: { disabled } });
+}
+/**
+ * `GET /v1/github/install-url` — authenticated (any identity, membership is checked later at claim/connect
+ * time); `?org=`/`?app=` name the target. Returns GitHub's installations/new URL plus an HMAC-signed,
+ * 10-minute `state` nonce binding `{subject, org, app, issuedAt}` so a later `claim` can only be completed
+ * by the same caller for the same org/app. 409 when the GitHub App is not configured.
+ */
+export async function handleGithubInstallUrl(req, res, gate, githubApp, url) {
+    const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
+    if (identity === false)
+        return;
+    if (githubApp?.appSlug === undefined) {
+        return sendJson(res, 409, { error: 'the GitHub App is not configured for this service' });
+    }
+    const orgParam = url.searchParams.get('org');
+    const appParam = url.searchParams.get('app');
+    if (orgParam === null || appParam === null) {
+        return sendJson(res, 400, { error: '"org" and "app" query parameters are required' });
+    }
+    const secret = resolveGithubStateSecret(githubApp.webhookSecret);
+    const state = signInstallNonce({
+        nonceId: randomUUID(),
+        subject: identity.subject,
+        org: orgParam,
+        app: appParam,
+        issuedAt: Date.now(),
+    }, secret);
+    const installUrl = `https://github.com/apps/${encodeURIComponent(githubApp.appSlug)}/installations/new?state=${encodeURIComponent(state)}`;
+    return sendContract(res, () => GithubInstallUrlResponseSchema.parse({ ok: true, data: { installUrl, state } }));
+}
+/**
+ * `POST /v1/github/installations/claim` — verifies the `state` nonce (signature, expiry, and that the
+ * caller is the same subject who requested it), then requires the caller to be an org OWNER of the
+ * nonce's bound org before returning the installation's repositories for the client to pick from. Any
+ * nonce problem (tampered, expired, foreign subject) is a 403 with no state change. The installationId
+ * is derived EXCLUSIVELY from the pending store entry GitHub's setup redirect landed for this state —
+ * never from the request body — so a caller can only ever enumerate the installation they themselves
+ * just installed, not an arbitrary tenant's (409 when the redirect hasn't landed).
+ */
+export async function handleGithubInstallationClaim(req, res, gate, controlPlane, client, githubApp, pendingStore, maxBody) {
+    const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
+    if (identity === false)
+        return;
+    const body = await readJsonBody(req, maxBody);
+    if (!body.ok)
+        return sendJson(res, body.status, { error: body.error });
+    const parsed = body.value;
+    if (typeof parsed.state !== 'string')
+        return sendJson(res, 400, { error: '"state" must be a string' });
+    const secret = resolveGithubStateSecret(githubApp?.webhookSecret);
+    const verification = verifyInstallNonce(parsed.state, secret);
+    if (!verification.ok || verification.payload.subject !== identity.subject) {
+        return sendForbidden(res, 'invalid or expired state');
+    }
+    if (!(await canManageMembers(controlPlane, verification.payload.org, identity))) {
+        return sendForbidden(res, 'forbidden');
+    }
+    if (client === undefined) {
+        return sendJson(res, 409, {
+            error: 'the GitHub App client is not configured for this service',
+        });
+    }
+    const installationId = await pendingStore.get(parsed.state);
+    if (installationId === undefined) {
+        return sendJson(res, 409, { error: 'the GitHub installation has not landed yet' });
+    }
+    const repositories = await client.listInstallationRepositories(installationId);
+    return sendJson(res, 200, { ok: true, data: { installationId, repositories } });
+}
+function isPositiveInteger(value) {
+    return typeof value === 'number' && Number.isInteger(value) && value > 0;
+}
+//# sourceMappingURL=github-connection.js.map

package/node_modules/@noodle-borg/service/dist/routes/github-connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-connection.js","sourceRoot":"","sources":["../../src/routes/github-connection.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAGxE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,8BAA8B,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAOlD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAoB,EACpB,GAAmB,EACnB,IAAoB,EACpB,YAA+B,EAC/B,KAA4B,EAC5B,MAAmC,EACnC,SAAsC,EACtC,OAAe,EACf,GAA6B,EAC7B,KAAgB;IAEhB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACrF,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAClG,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,SAAS,CACtB,GAAoB,EACpB,GAAmB,EACnB,IAAoB,EACpB,YAA+B,EAC/B,KAA4B,EAC5B,GAA6B;IAE7B,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACrF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC5E,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AACnG,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CACvB,GAAoB,EACpB,GAAmB,EACnB,IAAoB,EACpB,YAA+B,EAC/B,KAA4B,EAC5B,MAAmC,EACnC,SAAsC,EACtC,OAAe,EACf,GAA6B,EAC7B,KAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC5D,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACzC,IAAI,SAAS,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACxB,KAAK,EAAE,0DAA0D;SAClE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAInB,CAAC;IACF,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9C,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAClD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACzE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IAC7C,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;IACrD,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAEnF,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;IAClE,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,cAAc,YAAY,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,cAAc,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAAC;IACzF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACxB,KAAK,EAAE,cAAc,kBAAkB,oCAAoC,cAAc,EAAE;SAC5F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAAC;QAC9C,kBAAkB;QAClB,cAAc;QACd,UAAU,EAAE,YAAY,CAAC,YAAY;QACrC,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,GAAG,CAAC,GAAG;QAChB,OAAO,EAAE,GAAG,CAAC,GAAG;QAChB,gBAAgB,EAAE,QAAQ,CAAC,OAAO;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAE3E,MAAM,KAAK,CAAC,IAAI,CAAC;QACf,SAAS,EAAE,6BAA6B;QACxC,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,GAAG;QACX,YAAY,EAAE,QAAQ,CAAC,OAAO;QAC9B,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,EAAE,EAAE,kBAAkB,EAAE,cAAc,EAAE;KAChD,CAAC,CAAC;IACH,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAC5B,8BAA8B,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,YAAY,CACzB,GAAoB,EACpB,GAAmB,EACnB,IAAoB,EACpB,YAA+B,EAC/B,KAA4B,EAC5B,GAA6B,EAC7B,KAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC5D,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACrE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,CAAC,IAAI,CAAC;YACf,SAAS,EAAE,4BAA4B;YACvC,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,GAAG;YACX,YAAY,EAAE,QAAQ,CAAC,OAAO;YAC9B,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAoB,EACpB,GAAmB,EACnB,IAAoB,EACpB,SAAsC,EACtC,GAAQ;IAER,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,IAAI,SAAS,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,gBAAgB,CAC5B;QACE,OAAO,EAAE,UAAU,EAAE;QACrB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,EACD,MAAM,CACP,CAAC;IACF,MAAM,UAAU,GAAG,2BAA2B,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,4BAA4B,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3I,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAC5B,8BAA8B,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,CAChF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,GAAoB,EACpB,GAAmB,EACnB,IAAoB,EACpB,YAA+B,EAC/B,MAAmC,EACnC,SAAsC,EACtC,YAA4C,EAC5C,OAAe;IAEf,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAA4B,CAAC;IACjD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAClC,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,YAAY,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC1E,OAAO,aAAa,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACxB,KAAK,EAAE,0DAA0D;SAClE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,cAAc,CAAC,CAAC;IAC/E,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAC3E,CAAC"}

package/node_modules/@noodle-borg/service/dist/routes/github-dispatch.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Dispatch for the GHD-1 GitHub connection routes. Extracted the same way as
+ * `resource-read-dispatch.ts`/`analytics-dispatch.ts` so `service.ts` stays a thin composition root
+ * under the size gate.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { TlsPosture } from '@noodle-borg/transport-http';
+import type { DeployAuthGate } from '../auth/deploy-gate.js';
+import type { GitHubAppClient, GithubAppConfig } from '../github/app-client.js';
+import type { PendingGithubInstallationStore } from '../github/pending-installations.js';
+import type { AuditSink } from '../store/audit.js';
+import type { ControlPlaneStore, GithubConnectionStore, GithubDeployRunStore } from '../store.js';
+export interface GithubDispatchDeps {
+    readonly gate: DeployAuthGate;
+    readonly controlPlane: ControlPlaneStore;
+    readonly githubConnectionStore: GithubConnectionStore;
+    readonly githubDeployRunStore: GithubDeployRunStore;
+    readonly githubAppClient: GitHubAppClient | undefined;
+    readonly githubApp: GithubAppConfig | undefined;
+    readonly pendingGithubInstallationStore: PendingGithubInstallationStore;
+    readonly audit: AuditSink;
+    readonly maxBody: number;
+    readonly applySecurityHeaders: (res: ServerResponse, tls: TlsPosture) => void;
+    readonly enforceHttps: (req: IncomingMessage, res: ServerResponse, tls: TlsPosture) => boolean;
+    readonly sendJson: (res: ServerResponse, status: number, body: unknown) => void;
+    readonly tls: TlsPosture;
+}
+/** Try the GHD-1 GitHub routes; returns true when the request was handled (or a guard ended it). */
+export declare function dispatchGithubRoutes(req: IncomingMessage, res: ServerResponse, url: URL, deps: GithubDispatchDeps): boolean;
+//# sourceMappingURL=github-dispatch.d.ts.map

package/node_modules/@noodle-borg/service/dist/routes/github-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-dispatch.d.ts","sourceRoot":"","sources":["../../src/routes/github-dispatch.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAmBlG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;IACzC,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;IACtD,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;IACpD,QAAQ,CAAC,eAAe,EAAE,eAAe,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,8BAA8B,EAAE,8BAA8B,CAAC;IACxE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,oBAAoB,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,KAAK,IAAI,CAAC;IAC9E,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC;IAC/F,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAChF,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;CAC1B;AAED,oGAAoG;AACpG,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAyHT"}