@noodleseed/one 0.16.0 → 0.18.0

package/node_modules/@noodle-borg/service/dist/routes/github-dispatch.js

@@ -0,0 +1,95 @@
+import { handleGithubConnection, handleGithubInstallationClaim, handleGithubInstallUrl, } from './github-connection.js';
+import { handleGithubRunsList } from './github-runs.js';
+import { handleGithubInstallationPending, handleGithubSetup } from './github-setup.js';
+import { handleGithubWebhook } from './github-webhook.js';
+import { isGithubInstallationClaimPath, isGithubInstallationPendingPath, isGithubInstallUrlPath, isGithubSetupPath, isGithubWebhookPath, parseGithubConnectionPath, parseGithubRunsPath, } from './paths.js';
+/** Try the GHD-1 GitHub routes; returns true when the request was handled (or a guard ended it). */
+export function dispatchGithubRoutes(req, res, url, deps) {
+    const { applySecurityHeaders, enforceHttps, sendJson, tls } = deps;
+    const connectionRef = parseGithubConnectionPath(url.pathname);
+    if (connectionRef !== undefined &&
+        (req.method === 'GET' || req.method === 'POST' || req.method === 'DELETE')) {
+        applySecurityHeaders(res, tls);
+        if (enforceHttps(req, res, tls))
+            return true;
+        handleGithubConnection(req, res, deps.gate, deps.controlPlane, deps.githubConnectionStore, deps.githubAppClient, deps.githubApp, deps.maxBody, connectionRef, deps.audit).catch(() => {
+            if (!res.headersSent)
+                sendJson(res, 500, { error: 'internal error' });
+        });
+        return true;
+    }
+    if (isGithubInstallUrlPath(url.pathname) && req.method === 'GET') {
+        applySecurityHeaders(res, tls);
+        if (enforceHttps(req, res, tls))
+            return true;
+        handleGithubInstallUrl(req, res, deps.gate, deps.githubApp, url).catch(() => {
+            if (!res.headersSent)
+                sendJson(res, 500, { error: 'internal error' });
+        });
+        return true;
+    }
+    if (isGithubInstallationClaimPath(url.pathname) && req.method === 'POST') {
+        applySecurityHeaders(res, tls);
+        if (enforceHttps(req, res, tls))
+            return true;
+        handleGithubInstallationClaim(req, res, deps.gate, deps.controlPlane, deps.githubAppClient, deps.githubApp, deps.pendingGithubInstallationStore, deps.maxBody).catch(() => {
+            if (!res.headersSent)
+                sendJson(res, 500, { error: 'internal error' });
+        });
+        return true;
+    }
+    // GHD-2 deploy-runs read surface: org-member list behind `noodle github runs` + the console feed.
+    const runsRef = parseGithubRunsPath(url.pathname);
+    if (runsRef !== undefined && req.method === 'GET') {
+        applySecurityHeaders(res, tls);
+        if (enforceHttps(req, res, tls))
+            return true;
+        handleGithubRunsList(req, res, deps.gate, deps.controlPlane, deps.githubDeployRunStore, runsRef, url).catch(() => {
+            if (!res.headersSent)
+                sendJson(res, 500, { error: 'internal error' });
+        });
+        return true;
+    }
+    // GHD-2 webhook intake (ADR 0111 §6): signature-gated, unauthenticated by necessity. The handler
+    // owns the full defense stack — see `github-webhook.ts`.
+    if (isGithubWebhookPath(url.pathname) && req.method === 'POST') {
+        applySecurityHeaders(res, tls);
+        if (enforceHttps(req, res, tls))
+            return true;
+        handleGithubWebhook(req, res, {
+            connectionStore: deps.githubConnectionStore,
+            runStore: deps.githubDeployRunStore,
+            webhookSecret: deps.githubApp?.webhookSecret,
+            audit: deps.audit,
+            maxBody: deps.maxBody,
+        }).catch(() => {
+            if (!res.headersSent)
+                sendJson(res, 500, { error: 'internal error' });
+        });
+        return true;
+    }
+    // GHD-1.4 CLI hand-off: the GitHub App's Setup URL landing + the CLI's install poll. See
+    // `github-setup.ts` for why these two small routes exist.
+    if (isGithubSetupPath(url.pathname) && req.method === 'GET') {
+        applySecurityHeaders(res, tls);
+        if (enforceHttps(req, res, tls))
+            return true;
+        handleGithubSetup(req, res, deps.pendingGithubInstallationStore, deps.githubApp, url).catch(() => {
+            if (!res.headersSent)
+                sendJson(res, 500, { error: 'internal error' });
+        });
+        return true;
+    }
+    if (isGithubInstallationPendingPath(url.pathname) && req.method === 'GET') {
+        applySecurityHeaders(res, tls);
+        if (enforceHttps(req, res, tls))
+            return true;
+        handleGithubInstallationPending(req, res, deps.gate, deps.controlPlane, deps.pendingGithubInstallationStore, deps.githubApp, url).catch(() => {
+            if (!res.headersSent)
+                sendJson(res, 500, { error: 'internal error' });
+        });
+        return true;
+    }
+    return false;
+}
+//# sourceMappingURL=github-dispatch.js.map

package/node_modules/@noodle-borg/service/dist/routes/github-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-dispatch.js","sourceRoot":"","sources":["../../src/routes/github-dispatch.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,+BAA+B,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,EAC/B,sBAAsB,EACtB,iBAAiB,EACjB,mBAAmB,EACnB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAkBpB,oGAAoG;AACpG,MAAM,UAAU,oBAAoB,CAClC,GAAoB,EACpB,GAAmB,EACnB,GAAQ,EACR,IAAwB;IAExB,MAAM,EAAE,oBAAoB,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAEnE,MAAM,aAAa,GAAG,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9D,IACE,aAAa,KAAK,SAAS;QAC3B,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,EAC1E,CAAC;QACD,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,sBAAsB,CACpB,GAAG,EACH,GAAG,EACH,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,qBAAqB,EAC1B,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,OAAO,EACZ,aAAa,EACb,IAAI,CAAC,KAAK,CACX,CAAC,KAAK,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACjE,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YAC1E,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACzE,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,6BAA6B,CAC3B,GAAG,EACH,GAAG,EACH,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,8BAA8B,EACnC,IAAI,CAAC,OAAO,CACb,CAAC,KAAK,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kGAAkG;IAClG,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAClD,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,oBAAoB,CAClB,GAAG,EACH,GAAG,EACH,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,oBAAoB,EACzB,OAAO,EACP,GAAG,CACJ,CAAC,KAAK,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iGAAiG;IACjG,yDAAyD;IACzD,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/D,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE;YAC5B,eAAe,EAAE,IAAI,CAAC,qBAAqB;YAC3C,QAAQ,EAAE,IAAI,CAAC,oBAAoB;YACnC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa;YAC5C,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yFAAyF;IACzF,0DAA0D;IAC1D,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC5D,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,8BAA8B,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,KAAK,CACzF,GAAG,EAAE;YACH,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,+BAA+B,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1E,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,+BAA+B,CAC7B,GAAG,EACH,GAAG,EACH,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,8BAA8B,EACnC,IAAI,CAAC,SAAS,EACd,GAAG,CACJ,CAAC,KAAK,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/node_modules/@noodle-borg/service/dist/routes/github-runs.d.ts

@@ -0,0 +1,8 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { DeployAuthGate } from '../auth/deploy-gate.js';
+import type { ControlPlaneStore, GithubDeployRunStore } from '../store.js';
+export declare function handleGithubRunsList(req: IncomingMessage, res: ServerResponse, gate: DeployAuthGate, controlPlane: ControlPlaneStore, runStore: GithubDeployRunStore, ref: {
+    readonly org: string;
+    readonly app: string;
+}, url: URL): Promise<void>;
+//# sourceMappingURL=github-runs.d.ts.map

package/node_modules/@noodle-borg/service/dist/routes/github-runs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-runs.d.ts","sourceRoot":"","sources":["../../src/routes/github-runs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAc3E,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,QAAQ,EAAE,oBAAoB,EAC9B,GAAG,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACnD,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CAyBf"}

package/node_modules/@noodle-borg/service/dist/routes/github-runs.js

@@ -0,0 +1,33 @@
+import { sendJson } from '../http-util.js';
+import { sendContract } from './apps.js';
+import { GithubRunsListResponseSchema } from './contracts.js';
+import { authorizeTenantControl } from './control-plane.js';
+/**
+ * `GET /v1/orgs/{org}/apps/{app}/github/runs` (GHD-2): the deploy-runs read surface behind
+ * `noodle github runs` and the console feed. Org MEMBER read (mirrors the connection GET — runs are
+ * operational visibility, not an owner-only control). Newest-first with the store's explicit cap +
+ * `truncated` flag; `?limit=` tightens it (1..200).
+ */
+const MAX_LIST_LIMIT = 200;
+export async function handleGithubRunsList(req, res, gate, controlPlane, runStore, ref, url) {
+    const identity = await authorizeTenantControl(req, res, gate, controlPlane, ref.org);
+    if (identity === false)
+        return;
+    const limitParam = url.searchParams.get('limit');
+    let limit;
+    if (limitParam !== null) {
+        const parsed = Number(limitParam);
+        if (!Number.isInteger(parsed) || parsed < 1 || parsed > MAX_LIST_LIMIT) {
+            return sendJson(res, 400, {
+                error: `"limit" must be an integer between 1 and ${MAX_LIST_LIMIT}`,
+            });
+        }
+        limit = parsed;
+    }
+    const result = await runStore.listDeployRuns(ref.org, ref.app, limit !== undefined ? { limit } : {});
+    return sendContract(res, () => GithubRunsListResponseSchema.parse({
+        ok: true,
+        data: { runs: result.runs, truncated: result.truncated },
+    }));
+}
+//# sourceMappingURL=github-runs.js.map

package/node_modules/@noodle-borg/service/dist/routes/github-runs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-runs.js","sourceRoot":"","sources":["../../src/routes/github-runs.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE5D;;;;;GAKG;AAEH,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAoB,EACpB,GAAmB,EACnB,IAAoB,EACpB,YAA+B,EAC/B,QAA8B,EAC9B,GAAmD,EACnD,GAAQ;IAER,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACrF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,KAAyB,CAAC;IAC9B,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,cAAc,EAAE,CAAC;YACvE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACxB,KAAK,EAAE,4CAA4C,cAAc,EAAE;aACpE,CAAC,CAAC;QACL,CAAC;QACD,KAAK,GAAG,MAAM,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAC1C,GAAG,CAAC,GAAG,EACP,GAAG,CAAC,GAAG,EACP,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CACrC,CAAC;IACF,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAC5B,4BAA4B,CAAC,KAAK,CAAC;QACjC,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;KACzD,CAAC,CACH,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/service/dist/routes/github-setup.d.ts

@@ -0,0 +1,28 @@
+/**
+ * GHD-1.4 CLI hand-off routes: `GET /v1/github/setup` lands GitHub's post-install browser redirect (the
+ * GitHub App's configured Setup URL — an operator-side, one-time App-settings field, not a code path) and
+ * `GET /v1/github/installations/pending` lets the polling CLI discover the installationId it stashed. See
+ * `../github/pending-installations.ts` for the storage rationale. Neither route touches the durable
+ * `GithubConnectionStore` — connecting still requires the owner-gated `POST .../github/connection`
+ * (`github-connection.ts`) once the CLI has picked a repository via `installations/claim`.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { DeployAuthGate } from '../auth/deploy-gate.js';
+import type { GithubAppConfig } from '../github/app-client.js';
+import type { PendingGithubInstallationStore } from '../github/pending-installations.js';
+import type { ControlPlaneStore } from '../store.js';
+/**
+ * `GET /v1/github/setup?installation_id=...&state=...` — the GitHub App's Setup URL. Unauthenticated by
+ * necessity: GitHub's redirect is a bare browser GET with no bearer token, so the signed `state` nonce is
+ * the only protection. A tampered/expired/malformed state or a missing/non-numeric `installation_id` is
+ * rejected before anything is stored — no partial/garbage pending entry is ever written.
+ */
+export declare function handleGithubSetup(_req: IncomingMessage, res: ServerResponse, pendingStore: PendingGithubInstallationStore, githubApp: GithubAppConfig | undefined, url: URL): Promise<void>;
+/**
+ * `GET /v1/github/installations/pending?state=...` — the CLI's poll target. Requires the same signed-in
+ * subject who requested `install-url` (nonce subject match, mirroring `installations/claim`) and org
+ * membership on the nonce's bound org; 404 until the setup redirect has landed, 200 with
+ * `{installationId}` after.
+ */
+export declare function handleGithubInstallationPending(req: IncomingMessage, res: ServerResponse, gate: DeployAuthGate, controlPlane: ControlPlaneStore, pendingStore: PendingGithubInstallationStore, githubApp: GithubAppConfig | undefined, url: URL): Promise<void>;
+//# sourceMappingURL=github-setup.d.ts.map

package/node_modules/@noodle-borg/service/dist/routes/github-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-setup.d.ts","sourceRoot":"","sources":["../../src/routes/github-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AAEzF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAuBrD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,eAAe,EACrB,GAAG,EAAE,cAAc,EACnB,YAAY,EAAE,8BAA8B,EAC5C,SAAS,EAAE,eAAe,GAAG,SAAS,EACtC,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;;;;GAKG;AACH,wBAAsB,+BAA+B,CACnD,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,EACpB,YAAY,EAAE,iBAAiB,EAC/B,YAAY,EAAE,8BAA8B,EAC5C,SAAS,EAAE,eAAe,GAAG,SAAS,EACtC,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA8Bf"}

package/node_modules/@noodle-borg/service/dist/routes/github-setup.js

@@ -0,0 +1,80 @@
+import { resolveGithubStateSecret, verifyInstallNonce } from '../github/install-nonce.js';
+import { sendForbidden, sendJson } from '../http-util.js';
+import { authorizeControlPlane } from './control-plane.js';
+const SETUP_OK_HTML = '<!doctype html><html><head><meta charset="utf-8"><title>Noodle Seed</title></head>' +
+    '<body style="font-family:system-ui,sans-serif;padding:2rem"><p>GitHub installation received. ' +
+    'You can return to your terminal.</p></body></html>';
+const SETUP_ERROR_HTML = '<!doctype html><html><head><meta charset="utf-8"><title>Noodle Seed</title></head>' +
+    '<body style="font-family:system-ui,sans-serif;padding:2rem"><p>This installation link is invalid or ' +
+    'has expired. Return to your terminal and run <code>noodle github connect</code> again.</p></body></html>';
+function sendHtml(res, status, html) {
+    res.writeHead(status, { 'content-type': 'text/html; charset=utf-8' });
+    res.end(html);
+}
+function parsePositiveInt(value) {
+    if (value === null)
+        return undefined;
+    const n = Number(value);
+    return Number.isInteger(n) && n > 0 ? n : undefined;
+}
+/**
+ * `GET /v1/github/setup?installation_id=...&state=...` — the GitHub App's Setup URL. Unauthenticated by
+ * necessity: GitHub's redirect is a bare browser GET with no bearer token, so the signed `state` nonce is
+ * the only protection. A tampered/expired/malformed state or a missing/non-numeric `installation_id` is
+ * rejected before anything is stored — no partial/garbage pending entry is ever written.
+ */
+export async function handleGithubSetup(_req, res, pendingStore, githubApp, url) {
+    const state = url.searchParams.get('state');
+    const installationId = parsePositiveInt(url.searchParams.get('installation_id'));
+    if (state === null || installationId === undefined) {
+        sendHtml(res, 400, SETUP_ERROR_HTML);
+        return;
+    }
+    const secret = resolveGithubStateSecret(githubApp?.webhookSecret);
+    const verification = verifyInstallNonce(state, secret);
+    if (!verification.ok) {
+        sendHtml(res, 400, SETUP_ERROR_HTML);
+        return;
+    }
+    await pendingStore.put(state, installationId);
+    sendHtml(res, 200, SETUP_OK_HTML);
+}
+/**
+ * `GET /v1/github/installations/pending?state=...` — the CLI's poll target. Requires the same signed-in
+ * subject who requested `install-url` (nonce subject match, mirroring `installations/claim`) and org
+ * membership on the nonce's bound org; 404 until the setup redirect has landed, 200 with
+ * `{installationId}` after.
+ */
+export async function handleGithubInstallationPending(req, res, gate, controlPlane, pendingStore, githubApp, url) {
+    const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
+    if (identity === false)
+        return;
+    const state = url.searchParams.get('state');
+    if (state === null) {
+        sendJson(res, 400, { error: '"state" query parameter is required' });
+        return;
+    }
+    const secret = resolveGithubStateSecret(githubApp?.webhookSecret);
+    const verification = verifyInstallNonce(state, secret);
+    if (!verification.ok || verification.payload.subject !== identity.subject) {
+        sendForbidden(res, 'invalid or expired state');
+        return;
+    }
+    if (!identity.superAdmin) {
+        const member = await controlPlane.isOrgMember({
+            org: verification.payload.org,
+            subject: identity.subject,
+        });
+        if (!member) {
+            sendForbidden(res, 'forbidden');
+            return;
+        }
+    }
+    const installationId = await pendingStore.get(state);
+    if (installationId === undefined) {
+        sendJson(res, 404, { error: 'installation not landed yet' });
+        return;
+    }
+    sendJson(res, 200, { ok: true, data: { installationId } });
+}
+//# sourceMappingURL=github-setup.js.map

package/node_modules/@noodle-borg/service/dist/routes/github-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-setup.js","sourceRoot":"","sources":["../../src/routes/github-setup.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAE1F,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,MAAM,aAAa,GACjB,oFAAoF;IACpF,+FAA+F;IAC/F,oDAAoD,CAAC;AACvD,MAAM,gBAAgB,GACpB,oFAAoF;IACpF,sGAAsG;IACtG,0GAA0G,CAAC;AAE7G,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAY;IACjE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACtE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAoB;IAC5C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAqB,EACrB,GAAmB,EACnB,YAA4C,EAC5C,SAAsC,EACtC,GAAQ;IAER,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACjF,IAAI,KAAK,KAAK,IAAI,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACnD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IACD,MAAM,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC9C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,GAAoB,EACpB,GAAmB,EACnB,IAAoB,EACpB,YAA+B,EAC/B,YAA4C,EAC5C,SAAsC,EACtC,GAAQ;IAER,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,YAAY,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC1E,aAAa,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC;YAC5C,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG;YAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;AAC7D,CAAC"}

package/node_modules/@noodle-borg/service/dist/routes/github-webhook.d.ts

@@ -0,0 +1,29 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { AuditSink } from '../store/audit.js';
+import type { GithubConnectionStore, GithubDeployRunStore } from '../store.js';
+/**
+ * `POST /v1/github/webhook` (GHD-2, ADR 0111 §6) — the GitHub App's webhook receiver. Unauthenticated
+ * by necessity (GitHub is the caller), so the defense layers run strictly in order: the HMAC-SHA256
+ * signature is verified over the RAW body bytes before any header semantics or JSON parsing; then
+ * headers, then payload shape, then the connection binding (repository AND installation must match),
+ * and only then the idempotent run mutation (the store's delivery-id/target dedupe is the replay
+ * defense — see `GithubDeployRunStore`). Every response to GitHub is intentionally terse: no payload
+ * echo, no secret material, no verification oracle beyond the HTTP status.
+ *
+ * PR-B scope: runs are RECORDED (queued / queued+blocked), superseded, and canceled — never built.
+ * The build worker that walks queued runs forward is GHD-3, and it must skip runs carrying a
+ * `blockedReason`.
+ */
+export interface GithubWebhookDeps {
+    readonly connectionStore: GithubConnectionStore;
+    readonly runStore: GithubDeployRunStore;
+    readonly webhookSecret: string | undefined;
+    readonly audit: AuditSink;
+    readonly maxBody: number;
+    /** Injectable run-id mint for deterministic tests. Default: `run-` + 12 hex chars. */
+    readonly newRunId?: () => string;
+}
+/** Timing-safe check of GitHub's `X-Hub-Signature-256: sha256=<hex>` over the raw body bytes. */
+export declare function verifyWebhookSignature(rawBody: Buffer, signatureHeader: string | undefined, secret: string): boolean;
+export declare function handleGithubWebhook(req: IncomingMessage, res: ServerResponse, deps: GithubWebhookDeps): Promise<void>;
+//# sourceMappingURL=github-webhook.d.ts.map

package/node_modules/@noodle-borg/service/dist/routes/github-webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-webhook.d.ts","sourceRoot":"","sources":["../../src/routes/github-webhook.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAEV,qBAAqB,EACrB,oBAAoB,EAErB,MAAM,aAAa,CAAC;AAErB;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,eAAe,EAAE,qBAAqB,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;CAClC;AAID,iGAAiG;AACjG,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,MAAM,EAAE,MAAM,GACb,OAAO,CAST;AAgVD,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC,CAoDf"}