@noodleseed/one 0.17.0 → 0.18.0

package/node_modules/@noodle-borg/service/dist/alert-evaluator.js

@@ -0,0 +1,158 @@
+import { noopLogger } from '@noodle-borg/transport-http';
+import { buildAlertWebhookPayload, deliverAlertWebhook, } from './alert-webhook.js';
+import { aggregateRequestEvents } from './request-event-metrics.js';
+/**
+ * Periodic alert-rule evaluator (E2, ADR 0130), modeled on `ArchiveSweeper`: a throttled
+ * `maybeSweep()` (boot + a `serveService` interval timer) drives `sweepNow()`, which evaluates
+ * every ENABLED rule against its own window of the tenant's request-event stream using the same
+ * `aggregateRequestEvents` the metrics route serves — one aggregation, no duplicate math.
+ *
+ * EDGE-TRIGGERED: a rule fires on the non-breaching → breaching transition, and re-fires while
+ * still breaching only after `cooldownMinutes` since the last fire. Delivery is a single attempt;
+ * a failed delivery still stamps `lastFiredAt` so the sweep never becomes a retry loop (retries/
+ * backoff are an explicit E3 deferral). Firing state persists so edge-triggering survives restarts.
+ *
+ * Logging is closed-vocabulary + rule id + HTTP status only — the webhook URL is sensitive and
+ * never appears in any log line.
+ *
+ * Instance scope: the sweep is per-instance (in-flight-guarded and throttled locally). On a
+ * multi-instance deployment two instances can each fire the same breach once before the shared
+ * firing state persists — a duplicate notification, never lost/corrupted state. A cross-instance
+ * atomic fire claim is an explicit E3 deferral (ADR 0130).
+ */
+export const ALERT_EVALUATION_INTERVAL_MS = 60_000;
+/** Same bounded read as the metrics route (`METRICS_SCAN_LIMIT`). */
+const EVAL_SCAN_LIMIT = 50_000;
+/** The observed value a rule compares against its threshold, per metric. */
+export function observedMetricValue(metric, metrics) {
+    switch (metric) {
+        case 'error_share':
+            return metrics.errors.errorRate;
+        case 'error_count':
+            return metrics.errors.toolErrors + metrics.errors.mcpErrors;
+        case 'calls':
+            return metrics.totals.requests;
+        case 'p95_ms':
+            return metrics.latency.p95Ms;
+    }
+}
+export class AlertEvaluator {
+    #alertRules;
+    #requestEvents;
+    #allowLoopback;
+    #deliver;
+    #clock;
+    #logger;
+    #intervalMs;
+    #lastSweepStartedAt;
+    #sweepInFlight = false;
+    constructor(options) {
+        this.#alertRules = options.alertRules;
+        this.#requestEvents = options.requestEvents;
+        this.#allowLoopback = options.allowLoopbackWebhooks === true;
+        this.#deliver =
+            options.deliver ??
+                ((url, payload, deliverOptions) => deliverAlertWebhook(url, payload, deliverOptions));
+        this.#clock = options.clock ?? (() => new Date());
+        this.#logger = options.logger ?? noopLogger;
+        this.#intervalMs = options.intervalMs ?? ALERT_EVALUATION_INTERVAL_MS;
+    }
+    /**
+     * Throttled, fire-and-forget sweep (the serve-time interval calls this): never throws, and
+     * never overlaps — a sweep that outlives the interval (slow store/webhook timeouts) must not
+     * race a second sweep into double-delivering the same breach before state persists.
+     */
+    maybeSweep() {
+        if (this.#sweepInFlight)
+            return;
+        const now = this.#clock().getTime();
+        if (this.#lastSweepStartedAt !== undefined &&
+            now - this.#lastSweepStartedAt < this.#intervalMs) {
+            return;
+        }
+        this.#lastSweepStartedAt = now;
+        this.#sweepInFlight = true;
+        void this.sweepNow()
+            .catch((error) => {
+            this.#logger.warn('alert.sweep.failed', {
+                message: error instanceof Error ? error.message : String(error),
+            });
+        })
+            .finally(() => {
+            this.#sweepInFlight = false;
+        });
+    }
+    async sweepNow() {
+        const rules = await this.#alertRules.listEnabledAlertRules();
+        let fired = 0;
+        for (const rule of rules) {
+            try {
+                if (await this.#evaluateRule(rule))
+                    fired += 1;
+            }
+            catch (error) {
+                // One bad rule (store fault, throwing delivery seam) must not starve the others. Store
+                // errors never carry the webhook URL; delivery outcomes are closed codes by construction.
+                this.#logger.warn('alert.evaluate.failed', {
+                    ruleId: rule.id,
+                    message: error instanceof Error ? error.name : 'unknown',
+                });
+            }
+        }
+        return { evaluated: rules.length, fired };
+    }
+    async #evaluateRule(rule) {
+        const now = this.#clock();
+        const since = new Date(now.getTime() - rule.windowMinutes * 60_000).toISOString();
+        const events = await this.#requestEvents.list({
+            org: rule.orgSlug,
+            app: rule.appSlug,
+            env: rule.environment,
+            since,
+            limit: EVAL_SCAN_LIMIT,
+        });
+        const observed = observedMetricValue(rule.metric, aggregateRequestEvents(events));
+        const breaching = observed >= rule.threshold;
+        const transition = breaching && !rule.breaching;
+        const cooldownElapsed = rule.lastFiredAt === undefined ||
+            now.getTime() - Date.parse(rule.lastFiredAt) >= rule.cooldownMinutes * 60_000;
+        const shouldFire = transition || (breaching && rule.breaching && cooldownElapsed);
+        if (shouldFire) {
+            const firedAt = now.toISOString();
+            const payload = buildAlertWebhookPayload(rule, 'breach', observed, firedAt);
+            const outcome = await this.#deliver(rule.webhookUrl, payload, {
+                allowLoopback: this.#allowLoopback,
+            });
+            if (outcome.delivered) {
+                this.#logger.info('alert.webhook.delivered', {
+                    ruleId: rule.id,
+                    status: outcome.status ?? 0,
+                });
+            }
+            else {
+                this.#logger.warn('alert.webhook.failed', {
+                    ruleId: rule.id,
+                    reason: outcome.reason ?? 'unknown',
+                    ...(outcome.status !== undefined ? { status: outcome.status } : {}),
+                });
+            }
+            // Stamp the fire regardless of delivery outcome: a single attempt, never a retry loop (E3).
+            await this.#alertRules.updateAlertFiringState(rule.id, {
+                breaching: true,
+                lastObserved: observed,
+                lastFiredAt: firedAt,
+            });
+            return true;
+        }
+        if (breaching !== rule.breaching) {
+            // Recovery (or a breach the fire path above already covers): persist the edge so the next
+            // crossing is a fresh transition. `lastFiredAt` is preserved by omission.
+            await this.#alertRules.updateAlertFiringState(rule.id, {
+                breaching,
+                lastObserved: observed,
+            });
+        }
+        return false;
+    }
+}
+//# sourceMappingURL=alert-evaluator.js.map

package/node_modules/@noodle-borg/service/dist/alert-evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alert-evaluator.js","sourceRoot":"","sources":["../src/alert-evaluator.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAGL,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAuB,MAAM,4BAA4B,CAAC;AAGzF;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AACnD,qEAAqE;AACrE,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CAAC,MAAmB,EAAE,OAAuB;IAC9E,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,aAAa;YAChB,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QAClC,KAAK,aAAa;YAChB,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QAC9D,KAAK,OAAO;YACV,OAAO,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjC,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;IACjC,CAAC;AACH,CAAC;AAoBD,MAAM,OAAO,cAAc;IAChB,WAAW,CAAiB;IAC5B,cAAc,CAAoB;IAClC,cAAc,CAAU;IACxB,QAAQ,CAAgD;IACxD,MAAM,CAAa;IACnB,OAAO,CAAS;IAChB,WAAW,CAAS;IAC7B,mBAAmB,CAAqB;IACxC,cAAc,GAAG,KAAK,CAAC;IAEvB,YAAY,OAA8B;QACxC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,qBAAqB,KAAK,IAAI,CAAC;QAC7D,IAAI,CAAC,QAAQ;YACX,OAAO,CAAC,OAAO;gBACf,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,IAAI,4BAA4B,CAAC;IACxE,CAAC;IAED;;;;OAIG;IACH,UAAU;QACR,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;QACpC,IACE,IAAI,CAAC,mBAAmB,KAAK,SAAS;YACtC,GAAG,GAAG,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,WAAW,EACjD,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,mBAAmB,GAAG,GAAG,CAAC;QAC/B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,KAAK,IAAI,CAAC,QAAQ,EAAE;aACjB,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE;gBACtC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAChE,CAAC,CAAC;QACL,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;QAC9B,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,EAAE,CAAC;QAC7D,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;oBAAE,KAAK,IAAI,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,uFAAuF;gBACvF,0FAA0F;gBAC1F,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,uBAAuB,EAAE;oBACzC,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;iBACzD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAqB;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;YAC5C,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,GAAG,EAAE,IAAI,CAAC,WAAW;YACrB,KAAK;YACL,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC;QAE7C,MAAM,UAAU,GAAG,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAChD,MAAM,eAAe,GACnB,IAAI,CAAC,WAAW,KAAK,SAAS;YAC9B,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC;QAChF,MAAM,UAAU,GAAG,UAAU,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,CAAC;QAElF,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC5E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE;gBAC5D,aAAa,EAAE,IAAI,CAAC,cAAc;aACnC,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,yBAAyB,EAAE;oBAC3C,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC;iBAC5B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE;oBACxC,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,SAAS;oBACnC,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpE,CAAC,CAAC;YACL,CAAC;YACD,4FAA4F;YAC5F,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE;gBACrD,SAAS,EAAE,IAAI;gBACf,YAAY,EAAE,QAAQ;gBACtB,WAAW,EAAE,OAAO;aACrB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACjC,0FAA0F;YAC1F,0EAA0E;YAC1E,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE;gBACrD,SAAS;gBACT,YAAY,EAAE,QAAQ;aACvB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/node_modules/@noodle-borg/service/dist/alert-webhook.d.ts

@@ -0,0 +1,72 @@
+import { type DnsLookup } from '@noodle-borg/connector-http';
+import type { AlertMetric, AlertRuleRecord } from './store/alert-rules.js';
+/**
+ * Alert webhook delivery (E2, ADR 0130): a single POST attempt with a bounded timeout through the
+ * shared SSRF guard (`guardedFetch` pins DNS resolutions to public unicast addresses — the same
+ * anti-rebinding layer the HTTP connector uses). No retries, no backoff queue (deferred to E3).
+ *
+ * The webhook URL is SENSITIVE (it may embed capability tokens). Nothing this module returns or
+ * throws carries the URL, its host, or an upstream error message: outcomes are closed-vocabulary
+ * reason codes plus the HTTP status, safe to log verbatim.
+ */
+export declare const ALERT_WEBHOOK_SCHEMA_VERSION = 1;
+export interface AlertWebhookPayload {
+    readonly schemaVersion: typeof ALERT_WEBHOOK_SCHEMA_VERSION;
+    readonly event: 'breach' | 'test';
+    readonly org: string;
+    readonly app: string;
+    readonly env: string;
+    readonly rule: {
+        readonly id: string;
+        readonly name?: string;
+        readonly metric: AlertMetric;
+        readonly threshold: number;
+        readonly windowMinutes: number;
+        readonly comparison: '>=';
+    };
+    readonly observed: number;
+    readonly firedAt: string;
+}
+export declare function buildAlertWebhookPayload(rule: AlertRuleRecord, event: 'breach' | 'test', observed: number, firedAt: string): AlertWebhookPayload;
+/** Closed-vocabulary outcome — safe to log and to return to callers (never carries the URL). */
+export interface AlertWebhookDelivery {
+    readonly delivered: boolean;
+    readonly status?: number;
+    readonly reason?: 'invalid_url' | 'egress_blocked' | 'timeout' | 'network_error' | 'http_error';
+}
+export interface WebhookUrlPolicy {
+    /**
+     * Development/test-only carve-out: allow `http://localhost`, `http://127.0.0.1`, and `[::1]`
+     * targets (mirrors `customerVerifierAllowInsecureLocalhost`). Off in production: webhooks are
+     * https-only and literal private/reserved IPs are rejected outright.
+     */
+    readonly allowLoopback: boolean;
+}
+export type WebhookUrlValidation = {
+    ok: true;
+    url: URL;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Policy validation for a webhook URL, applied at rule create/test time AND re-applied on every
+ * delivery (defense in depth for stored rules). Error messages are generic policy text — they
+ * never echo the URL, host, or credentials back.
+ */
+export declare function validateAlertWebhookUrl(raw: string, policy: WebhookUrlPolicy): WebhookUrlValidation;
+export interface DeliverAlertWebhookOptions {
+    readonly allowLoopback?: boolean;
+    /** Whole-attempt bound. Default 10s. */
+    readonly timeoutMs?: number;
+    /** Injectable DNS resolver for SSRF tests (threaded into the guarded agent). */
+    readonly lookup?: DnsLookup;
+}
+/**
+ * Single-attempt webhook POST. Loopback targets (dev carve-out) use the plain platform fetch —
+ * the pinned lookup would reject loopback resolutions by design; everything else goes through
+ * {@link guardedFetch}. Redirects are not followed (a redirect could re-point the request at an
+ * unguarded literal-IP target); a 3xx reports as an ordinary non-2xx outcome.
+ */
+export declare function deliverAlertWebhook(rawUrl: string, payload: AlertWebhookPayload, options?: DeliverAlertWebhookOptions): Promise<AlertWebhookDelivery>;
+//# sourceMappingURL=alert-webhook.d.ts.map

package/node_modules/@noodle-borg/service/dist/alert-webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alert-webhook.d.ts","sourceRoot":"","sources":["../src/alert-webhook.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,SAAS,EAAiC,MAAM,6BAA6B,CAAC;AAC5F,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE3E;;;;;;;;GAQG;AAEH,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAI9C,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,aAAa,EAAE,OAAO,4BAA4B,CAAC;IAC5D,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;QAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,QAAQ,GAAG,MAAM,EACxB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,mBAAmB,CAkBrB;AAED,gGAAgG;AAChG,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,gBAAgB,GAAG,SAAS,GAAG,eAAe,GAAG,YAAY,CAAC;CACjG;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzF;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,gBAAgB,GACvB,oBAAoB,CAmCtB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,wCAAwC;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,mBAAmB,EAC5B,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,oBAAoB,CAAC,CAkC/B"}

package/node_modules/@noodle-borg/service/dist/alert-webhook.js

@@ -0,0 +1,138 @@
+import { isIP } from 'node:net';
+import { guardedFetch, isPublicUnicast } from '@noodle-borg/connector-http';
+/**
+ * Alert webhook delivery (E2, ADR 0130): a single POST attempt with a bounded timeout through the
+ * shared SSRF guard (`guardedFetch` pins DNS resolutions to public unicast addresses — the same
+ * anti-rebinding layer the HTTP connector uses). No retries, no backoff queue (deferred to E3).
+ *
+ * The webhook URL is SENSITIVE (it may embed capability tokens). Nothing this module returns or
+ * throws carries the URL, its host, or an upstream error message: outcomes are closed-vocabulary
+ * reason codes plus the HTTP status, safe to log verbatim.
+ */
+export const ALERT_WEBHOOK_SCHEMA_VERSION = 1;
+const DEFAULT_TIMEOUT_MS = 10_000;
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1']);
+export function buildAlertWebhookPayload(rule, event, observed, firedAt) {
+    return {
+        schemaVersion: ALERT_WEBHOOK_SCHEMA_VERSION,
+        event,
+        org: rule.orgSlug,
+        app: rule.appSlug,
+        env: rule.environment,
+        rule: {
+            id: rule.id,
+            ...(rule.name !== undefined ? { name: rule.name } : {}),
+            metric: rule.metric,
+            threshold: rule.threshold,
+            windowMinutes: rule.windowMinutes,
+            comparison: rule.comparison,
+        },
+        observed,
+        firedAt,
+    };
+}
+/**
+ * Policy validation for a webhook URL, applied at rule create/test time AND re-applied on every
+ * delivery (defense in depth for stored rules). Error messages are generic policy text — they
+ * never echo the URL, host, or credentials back.
+ */
+export function validateAlertWebhookUrl(raw, policy) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return { ok: false, error: '"webhookUrl" must be a valid absolute URL' };
+    }
+    if (url.username !== '' || url.password !== '') {
+        return { ok: false, error: '"webhookUrl" must not embed credentials' };
+    }
+    const host = url.hostname.replace(/^\[|\]$/g, '');
+    const loopback = LOOPBACK_HOSTS.has(host);
+    if (url.protocol === 'http:') {
+        if (loopback && policy.allowLoopback)
+            return { ok: true, url };
+        return {
+            ok: false,
+            error: '"webhookUrl" must use https (plain http is allowed only for loopback targets outside production)',
+        };
+    }
+    if (url.protocol !== 'https:') {
+        return { ok: false, error: '"webhookUrl" must use https' };
+    }
+    if (loopback) {
+        return policy.allowLoopback
+            ? { ok: true, url }
+            : { ok: false, error: '"webhookUrl" must not target a loopback address' };
+    }
+    // Literal IPs carry no DNS step for the delivery-time guard to pin, so they are policy-checked
+    // here: only public unicast addresses are accepted (blocks 10/8, 172.16/12, 192.168/16,
+    // link-local incl. the cloud metadata address, and other reserved ranges).
+    if (isIP(host) !== 0 && !isPublicUnicast(host)) {
+        return { ok: false, error: '"webhookUrl" must not target a private or reserved IP address' };
+    }
+    return { ok: true, url };
+}
+/**
+ * Single-attempt webhook POST. Loopback targets (dev carve-out) use the plain platform fetch —
+ * the pinned lookup would reject loopback resolutions by design; everything else goes through
+ * {@link guardedFetch}. Redirects are not followed (a redirect could re-point the request at an
+ * unguarded literal-IP target); a 3xx reports as an ordinary non-2xx outcome.
+ */
+export async function deliverAlertWebhook(rawUrl, payload, options = {}) {
+    const validated = validateAlertWebhookUrl(rawUrl, {
+        allowLoopback: options.allowLoopback === true,
+    });
+    if (!validated.ok)
+        return { delivered: false, reason: 'invalid_url' };
+    const init = {
+        method: 'POST',
+        headers: {
+            'content-type': 'application/json; charset=utf-8',
+            'user-agent': 'noodleseed-alerts/1',
+        },
+        body: JSON.stringify(payload),
+        redirect: 'manual',
+        signal: AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+    };
+    const host = validated.url.hostname.replace(/^\[|\]$/g, '');
+    try {
+        const response = LOOPBACK_HOSTS.has(host)
+            ? await fetch(validated.url, init)
+            : await guardedFetch(validated.url, init, {
+                ...(options.timeoutMs !== undefined ? { connectTimeoutMs: options.timeoutMs } : {}),
+                ...(options.lookup !== undefined ? { lookup: options.lookup } : {}),
+            });
+        // Drain/cancel the body — the response content is untrusted and unbounded; only the status matters.
+        try {
+            await response.body?.cancel();
+        }
+        catch {
+            // ignore: some bodies are already consumed/closed
+        }
+        if (response.ok)
+            return { delivered: true, status: response.status };
+        return { delivered: false, status: response.status, reason: 'http_error' };
+    }
+    catch (error) {
+        return { delivered: false, reason: classifyDeliveryError(error) };
+    }
+}
+/** Map a fetch failure to a closed reason code — upstream messages may embed the URL/host. */
+function classifyDeliveryError(error) {
+    if (error instanceof Error) {
+        if (error.name === 'TimeoutError' || error.name === 'AbortError')
+            return 'timeout';
+        if (error.message.startsWith('egress blocked:'))
+            return 'egress_blocked';
+        const cause = error.cause;
+        if (cause instanceof Error && cause.message.startsWith('egress blocked:')) {
+            return 'egress_blocked';
+        }
+        if (cause instanceof Error && (cause.name === 'TimeoutError' || cause.name === 'AbortError')) {
+            return 'timeout';
+        }
+    }
+    return 'network_error';
+}
+//# sourceMappingURL=alert-webhook.js.map

package/node_modules/@noodle-borg/service/dist/alert-webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alert-webhook.js","sourceRoot":"","sources":["../src/alert-webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAkB,YAAY,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAG5F;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAC9C,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AAoBlE,MAAM,UAAU,wBAAwB,CACtC,IAAqB,EACrB,KAAwB,EACxB,QAAgB,EAChB,OAAe;IAEf,OAAO;QACL,aAAa,EAAE,4BAA4B;QAC3C,KAAK;QACL,GAAG,EAAE,IAAI,CAAC,OAAO;QACjB,GAAG,EAAE,IAAI,CAAC,OAAO;QACjB,GAAG,EAAE,IAAI,CAAC,WAAW;QACrB,IAAI,EAAE;YACJ,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B;QACD,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC;AAoBD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAW,EACX,MAAwB;IAExB,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7B,IAAI,QAAQ,IAAI,MAAM,CAAC,aAAa;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAC/D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,kGAAkG;SACrG,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,aAAa;YACzB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;YACnB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;IAC9E,CAAC;IACD,+FAA+F;IAC/F,wFAAwF;IACxF,2EAA2E;IAC3E,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+DAA+D,EAAE,CAAC;IAC/F,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC;AAUD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,OAA4B,EAC5B,UAAsC,EAAE;IAExC,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE;QAChD,aAAa,EAAE,OAAO,CAAC,aAAa,KAAK,IAAI;KAC9C,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACtE,MAAM,IAAI,GAAgB;QACxB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,iCAAiC;YACjD,YAAY,EAAE,qBAAqB;SACpC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;KACrE,CAAC;IACF,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;YACvC,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC;YAClC,CAAC,CAAC,MAAM,YAAY,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE;gBACtC,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE,CAAC,CAAC;QACP,oGAAoG;QACpG,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;QACD,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;IACpE,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC;QACnF,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC;YAAE,OAAO,gBAAgB,CAAC;QACzE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC1B,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC1E,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK,YAAY,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;YAC7F,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/node_modules/@noodle-borg/service/dist/github/pending-installations.d.ts

@@ -1,5 +1,5 @@
 /**
- * Minimal in-memory hand-off for the CLI `noodle github connect` poll (GHD-1.4). GitHub's installation
+ * Hand-off store for the CLI `noodle github connect` poll (GHD-1.4). GitHub's installation
  * flow redirects the installer's BROWSER to the GitHub App's configured "Setup URL" once the install
  * completes — a request the CLI process cannot receive directly (it has no public callback endpoint of
  * its own). `GET /v1/github/setup` (`../routes/github-setup.ts`) IS that Setup URL: it lands the
@@ -8,10 +8,14 @@
  * (same file) until the entry appears, then proceeds to `POST /v1/github/installations/claim`.
  *
  * Entries expire on the same 10-minute TTL as the nonce itself (`install-nonce.ts`) so a stale poll can
- * never resurrect an old install correlation. Deliberately NOT the durable `GithubConnectionStore` — this
- * is single-flight hand-off state, not a persisted record; a multi-instance deployment needs a shared
- * backing (e.g. Postgres/Redis) before this feature is exposed there (see ADR 0111).
+ * never resurrect an old install correlation. The interface is async because a multi-instance
+ * deployment backs it with Postgres (`PostgresArtifactStore` implements it — GHD-2 closed the gap
+ * flagged in the GHD-1 review): the setup redirect and the CLI poll can land on different instances,
+ * so the hand-off must live in the shared store. The in-memory backend remains the single-instance
+ * dev/test default.
  */
+/** Shared hand-off TTL — mirrors the install-nonce TTL so neither side outlives the other. */
+export declare const PENDING_GITHUB_INSTALLATION_TTL_MS: number;
 export interface PendingGithubInstallationStore {
     /**
      * Record that the setup redirect landed for `state`, carrying the installationId GitHub reported.
@@ -19,13 +23,16 @@ export interface PendingGithubInstallationStore {
      * redirect cannot overwrite the recorded installation (hardening: the repo-confirm step and the
      * repo-in-installation re-verification already blunt a swapped id; this closes the race outright).
      */
-    put(state: string, installationId: number): void;
+    put(state: string, installationId: number): Promise<void>;
     /** The installationId stashed for `state`, or `undefined` if it hasn't landed yet (or has expired). */
-    get(state: string): number | undefined;
+    get(state: string): Promise<number | undefined>;
 }
 export declare class InMemoryPendingGithubInstallationStore implements PendingGithubInstallationStore {
     #private;
-    put(state: string, installationId: number): void;
-    get(state: string): number | undefined;
+    constructor(options?: {
+        now?: () => Date;
+    });
+    put(state: string, installationId: number): Promise<void>;
+    get(state: string): Promise<number | undefined>;
 }
 //# sourceMappingURL=pending-installations.d.ts.map

package/node_modules/@noodle-borg/service/dist/github/pending-installations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pending-installations.d.ts","sourceRoot":"","sources":["../../src/github/pending-installations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,MAAM,WAAW,8BAA8B;IAC7C;;;;;OAKG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACjD,uGAAuG;IACvG,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,qBAAa,sCAAuC,YAAW,8BAA8B;;IAG3F,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI;IAKhD,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CASvC"}
+{"version":3,"file":"pending-installations.d.ts","sourceRoot":"","sources":["../../src/github/pending-installations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,8FAA8F;AAC9F,eAAO,MAAM,kCAAkC,QAAiB,CAAC;AAOjE,MAAM,WAAW,8BAA8B;IAC7C;;;;;OAKG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,uGAAuG;IACvG,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACjD;AAED,qBAAa,sCAAuC,YAAW,8BAA8B;;gBAI/E,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;KAAO;IAIxC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzD,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAStD"}

package/node_modules/@noodle-borg/service/dist/github/pending-installations.js

@@ -1,5 +1,5 @@
 /**
- * Minimal in-memory hand-off for the CLI `noodle github connect` poll (GHD-1.4). GitHub's installation
+ * Hand-off store for the CLI `noodle github connect` poll (GHD-1.4). GitHub's installation
  * flow redirects the installer's BROWSER to the GitHub App's configured "Setup URL" once the install
  * completes — a request the CLI process cannot receive directly (it has no public callback endpoint of
  * its own). `GET /v1/github/setup` (`../routes/github-setup.ts`) IS that Setup URL: it lands the
@@ -8,23 +8,30 @@
  * (same file) until the entry appears, then proceeds to `POST /v1/github/installations/claim`.
  *
  * Entries expire on the same 10-minute TTL as the nonce itself (`install-nonce.ts`) so a stale poll can
- * never resurrect an old install correlation. Deliberately NOT the durable `GithubConnectionStore` — this
- * is single-flight hand-off state, not a persisted record; a multi-instance deployment needs a shared
- * backing (e.g. Postgres/Redis) before this feature is exposed there (see ADR 0111).
+ * never resurrect an old install correlation. The interface is async because a multi-instance
+ * deployment backs it with Postgres (`PostgresArtifactStore` implements it — GHD-2 closed the gap
+ * flagged in the GHD-1 review): the setup redirect and the CLI poll can land on different instances,
+ * so the hand-off must live in the shared store. The in-memory backend remains the single-instance
+ * dev/test default.
  */
-const PENDING_TTL_MS = 10 * 60 * 1000;
+/** Shared hand-off TTL — mirrors the install-nonce TTL so neither side outlives the other. */
+export const PENDING_GITHUB_INSTALLATION_TTL_MS = 10 * 60 * 1000;
 export class InMemoryPendingGithubInstallationStore {
     #entries = new Map();
-    put(state, installationId) {
+    #now;
+    constructor(options = {}) {
+        this.#now = options.now ?? (() => new Date());
+    }
+    async put(state, installationId) {
         if (this.#entries.has(state))
             return; // first write wins — see the interface doc
-        this.#entries.set(state, { installationId, createdAt: Date.now() });
+        this.#entries.set(state, { installationId, createdAt: this.#now().getTime() });
     }
-    get(state) {
+    async get(state) {
         const entry = this.#entries.get(state);
         if (entry === undefined)
             return undefined;
-        if (Date.now() - entry.createdAt > PENDING_TTL_MS) {
+        if (this.#now().getTime() - entry.createdAt > PENDING_GITHUB_INSTALLATION_TTL_MS) {
             this.#entries.delete(state);
             return undefined;
         }

package/node_modules/@noodle-borg/service/dist/github/pending-installations.js.map

@@ -1 +1 @@
-{"version":3,"file":"pending-installations.js","sourceRoot":"","sources":["../../src/github/pending-installations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAmBtC,MAAM,OAAO,sCAAsC;IACxC,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEpD,GAAG,CAAC,KAAa,EAAE,cAAsB;QACvC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,2CAA2C;QACjF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,GAAG,CAAC,KAAa;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,cAAc,EAAE,CAAC;YAClD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,cAAc,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"pending-installations.js","sourceRoot":"","sources":["../../src/github/pending-installations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAmBjE,MAAM,OAAO,sCAAsC;IACxC,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC3C,IAAI,CAAa;IAE1B,YAAY,UAAgC,EAAE;QAC5C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,cAAsB;QAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,2CAA2C;QACjF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,kCAAkC,EAAE,CAAC;YACjF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,cAAc,CAAC;IAC9B,CAAC;CACF"}

package/node_modules/@noodle-borg/service/dist/index.d.ts

@@ -1,4 +1,6 @@
 export { ensureAuditSchema, PostgresAuditStore } from '@noodle-borg/module-audit';
+export { ALERT_EVALUATION_INTERVAL_MS, AlertEvaluator, type AlertEvaluatorOptions, observedMetricValue, } from './alert-evaluator.js';
+export { ALERT_WEBHOOK_SCHEMA_VERSION, type AlertWebhookDelivery, type AlertWebhookPayload, buildAlertWebhookPayload, type DeliverAlertWebhookOptions, deliverAlertWebhook, validateAlertWebhookUrl, type WebhookUrlPolicy, } from './alert-webhook.js';
 export { ARCHIVE_SWEEP_INTERVAL_MS, ArchiveSweeper, type ArchiveSweeperOptions, DEFAULT_ARCHIVE_RETENTION_DAYS, resolveArchiveRetentionDays, } from './archive-sweeper.js';
 export { type AssetAdapterKind, type AssetConfigInput, type AssetConfigResolution, type AssetQuotaOverride, createAssetStore, type ResolvedAssetConfig, resolveAssetConfig, } from './asset-config.js';
 export { type AssetStore, type AssetUploadPlan, type AssetUploadTarget, InMemoryAssetStore, type InMemoryAssetStoreOptions, } from './assets.js';
@@ -17,20 +19,26 @@ export { CachingPolicyAssignmentStore, type PolicyCacheOptions, } from './policy
 export { InMemoryPolicyCounterStore } from './policy-counters.js';
 export { type DeployError, type DeployResult, type RecoverResult, type RollbackResult, ServerRegistry, } from './registry.js';
 export { aggregateRequestEvents, type ClientMetrics, type MethodMetrics, type RequestMetrics, type SeriesBucket, type ToolMetrics, } from './request-event-metrics.js';
-export { AppResponseSchema, AppSummarySchema, AppsListResponseSchema, DeploymentResponseSchema, DeploymentSummarySchema, EnvResponseSchema, EnvSummarySchema, EnvsListResponseSchema, GithubConnectionResponseSchema, GithubInstallUrlResponseSchema, OrgSummarySchema, RepoConnectionSchema, } from './routes/contracts.js';
+export { AppResponseSchema, AppSummarySchema, AppsListResponseSchema, DeploymentResponseSchema, DeploymentSummarySchema, DeployRunSchema, EnvResponseSchema, EnvSummarySchema, EnvsListResponseSchema, GithubConnectionResponseSchema, GithubInstallUrlResponseSchema, GithubRunsListResponseSchema, OrgSummarySchema, RepoConnectionSchema, } from './routes/contracts.js';
 export { type GcpKmsConfig, gcpKmsMasterKeyProvider, type KmsClient, } from './secret/kms-master-key.js';
 export { type RunningService, serveService } from './serve.js';
 export { createServiceHandler } from './service.js';
 export { capabilitiesForConfig, defineNoodleService, expandServiceProfile, type NoodleServiceConfig, type ObservabilityConfig, type ObservabilityLogFormat, type ObservabilityLogLevel, type ObservabilityLogSink, parseNoodleServiceYaml, resolveServiceConfigSource, type ServiceConfigSource, } from './service-config.js';
+export { ALERT_METRICS, ALERT_WINDOWS_MINUTES, type AlertFiringState, type AlertMetric, type AlertRuleRecord, type AlertRuleStore, type AlertWindowMinutes, type CreateAlertRuleInput, DEFAULT_ALERT_COOLDOWN_MINUTES, InMemoryAlertRuleStore, MAX_ALERT_RULES_PER_ENV, } from './store/alert-rules.js';
+export { JsonFileAlertRuleStore } from './store/alert-rules-json-file.js';
 export { AUDIT_SCHEMA_VERSION, type AuditDecision, type AuditDetails, type AuditEvent, type AuditEventInput, type AuditFilter, type AuditSink, type AuditStore, InMemoryAuditStore, type InMemoryAuditStoreOptions, MultiSink, redactDetails, StdoutAuditSink, } from './store/audit.js';
 export { InMemoryControlPlaneStore } from './store/control-plane.js';
 export { InMemoryGithubConnectionStore } from './store/github-connections.js';
 export { JsonFileGithubConnectionStore } from './store/github-connections-json-file.js';
+export { canTransitionDeployRun, DEFAULT_DEPLOY_RUN_LIST_LIMIT, DEPLOY_RUN_TRANSITIONS, InMemoryGithubDeployRunStore, } from './store/github-runs.js';
+export { JsonFileGithubDeployRunStore } from './store/github-runs-json-file.js';
+export { PostgresPendingGithubInstallationStore } from './store/pending-installations-postgres.js';
 export { PostgresArtifactStore, type PostgresStoreOptions } from './store/postgres.js';
+export { ensureAlertRuleSchema, PostgresAlertRuleStore, } from './store/postgres-alerts.js';
 export { ensureStateHandleSchema, PostgresStateHandleStore, type PostgresStateHandleStoreOptions, } from './store/postgres-state-handles.js';
 export { RequestEventBuffer } from './store/request-event-buffer.js';
 export { InMemoryRequestEventStore } from './store/request-events.js';
 export { ensureRequestEventSchema, PostgresRequestEventStore, } from './store/request-events-postgres.js';
 export { InMemoryUserAppLogStore, type InMemoryUserAppLogStoreOptions, type UserAppLogEvent, type UserAppLogFilter, type UserAppLogInput, type UserAppLogLevel, type UserAppLogSink, type UserAppLogStore, } from './store/user-app-logs.js';
-export { type AppArchiveResult, type AppRestoreResult, type AppSummary, type ArtifactStore, CONFIG_NAME_PATTERN, type ConfigScope, type ConfigStore, type ConfigValueMetadata, type ControlPlaneStore, DEPLOYMENT_ID_PATTERN, type DeploymentListFilter, type DeploymentSummary, type DeployRecord, DOMAIN_PATTERN, type EnvSummary, type GithubConnectionStore, InMemoryArtifactStore, InMemoryConfigStore, JsonFileArtifactStore, type ManagedConfigKind, type OrgDomainRecord, type OrgInvitationRecord, type OrgMemberRecord, type OrgRecord, type OrgRole, type RepoConnectionConflict, type RepoConnectionConflictReason, type RepoConnectionRecord, resolveConfigScope, type SecretEnvelope, type SignupAllowlistKind, type SignupAllowlistRecord, SLUG_PATTERN, scopeChain, type TenantAuthConfig, type TenantRef, type UpsertRepoConnectionInput, type UpsertRepoConnectionResult, validateConfigName, validateConfigScope, validateDomain, validateOrgRole, validatePositiveInteger, validateSignupAllowlistKind, validateSlug, validateTenantRef, } from './store.js';
+export { type AppArchiveResult, type AppRestoreResult, type AppSummary, type ArtifactStore, type CancelQueuedDeployRunsFilter, CONFIG_NAME_PATTERN, type ConfigScope, type ConfigStore, type ConfigValueMetadata, type ControlPlaneStore, type CreateDeployRunDuplicateReason, type CreateDeployRunInput, type CreateDeployRunResult, DEPLOYMENT_ID_PATTERN, type DeploymentListFilter, type DeploymentSummary, type DeployRecord, type DeployRunRecord, type DeployRunSourceEvent, type DeployRunStatus, DOMAIN_PATTERN, type EnvSummary, type GithubConnectionStore, type GithubDeployRunStore, InMemoryArtifactStore, InMemoryConfigStore, JsonFileArtifactStore, type ListDeployRunsResult, type ManagedConfigKind, type OrgDomainRecord, type OrgInvitationRecord, type OrgMemberRecord, type OrgRecord, type OrgRole, type RepoConnectionConflict, type RepoConnectionConflictReason, type RepoConnectionRecord, resolveConfigScope, type SecretEnvelope, type SignupAllowlistKind, type SignupAllowlistRecord, SLUG_PATTERN, scopeChain, type TenantAuthConfig, type TenantRef, type UpsertRepoConnectionInput, type UpsertRepoConnectionResult, validateConfigName, validateConfigScope, validateDomain, validateOrgRole, validatePositiveInteger, validateSignupAllowlistKind, validateSlug, validateTenantRef, } from './store.js';
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/service/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,KAAK,qBAAqB,EAC1B,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,iBAAiB,EACjB,KAAK,cAAc,EACnB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,KAAK,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,8BAA8B,EACnC,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,WAAW,EAChB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,4BAA4B,EACjC,qBAAqB,EACrB,cAAc,EACd,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,EAC9B,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sCAAsC,EACtC,KAAK,8BAA8B,GACpC,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EACL,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,6BAA6B,EAC7B,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,EAC5B,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,8BAA8B,EAC9B,8BAA8B,EAC9B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,YAAY,EACjB,uBAAuB,EACvB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,SAAS,EACT,aAAa,EACb,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,+BAA+B,GACrC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,EACnC,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,cAAc,EACd,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,YAAY,EACZ,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,uBAAuB,EACvB,2BAA2B,EAC3B,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,KAAK,qBAAqB,EAC1B,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,KAAK,qBAAqB,EAC1B,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,iBAAiB,EACjB,KAAK,cAAc,EACnB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,KAAK,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,8BAA8B,EACnC,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,WAAW,EAChB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,4BAA4B,EACjC,qBAAqB,EACrB,cAAc,EACd,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,EAC9B,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sCAAsC,EACtC,KAAK,8BAA8B,GACpC,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EACL,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,6BAA6B,EAC7B,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,EAC5B,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,8BAA8B,EAC9B,8BAA8B,EAC9B,4BAA4B,EAC5B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,YAAY,EACjB,uBAAuB,EACvB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,8BAA8B,EAC9B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EACL,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,SAAS,EACT,aAAa,EACb,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,EAAE,sCAAsC,EAAE,MAAM,2CAA2C,CAAC;AACnG,OAAO,EAAE,qBAAqB,EAAE,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,+BAA+B,GACrC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,EACnC,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,4BAA4B,EACjC,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,8BAA8B,EACnC,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,cAAc,EACd,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,YAAY,EACZ,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,uBAAuB,EACvB,2BAA2B,EAC3B,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC"}

package/node_modules/@noodle-borg/service/dist/index.js

@@ -1,4 +1,6 @@
 export { ensureAuditSchema, PostgresAuditStore } from '@noodle-borg/module-audit';
+export { ALERT_EVALUATION_INTERVAL_MS, AlertEvaluator, observedMetricValue, } from './alert-evaluator.js';
+export { ALERT_WEBHOOK_SCHEMA_VERSION, buildAlertWebhookPayload, deliverAlertWebhook, validateAlertWebhookUrl, } from './alert-webhook.js';
 export { ARCHIVE_SWEEP_INTERVAL_MS, ArchiveSweeper, DEFAULT_ARCHIVE_RETENTION_DAYS, resolveArchiveRetentionDays, } from './archive-sweeper.js';
 export { createAssetStore, resolveAssetConfig, } from './asset-config.js';
 export { InMemoryAssetStore, } from './assets.js';
@@ -16,16 +18,22 @@ export { CachingPolicyAssignmentStore, } from './policy-cache.js';
 export { InMemoryPolicyCounterStore } from './policy-counters.js';
 export { ServerRegistry, } from './registry.js';
 export { aggregateRequestEvents, } from './request-event-metrics.js';
-export { AppResponseSchema, AppSummarySchema, AppsListResponseSchema, DeploymentResponseSchema, DeploymentSummarySchema, EnvResponseSchema, EnvSummarySchema, EnvsListResponseSchema, GithubConnectionResponseSchema, GithubInstallUrlResponseSchema, OrgSummarySchema, RepoConnectionSchema, } from './routes/contracts.js';
+export { AppResponseSchema, AppSummarySchema, AppsListResponseSchema, DeploymentResponseSchema, DeploymentSummarySchema, DeployRunSchema, EnvResponseSchema, EnvSummarySchema, EnvsListResponseSchema, GithubConnectionResponseSchema, GithubInstallUrlResponseSchema, GithubRunsListResponseSchema, OrgSummarySchema, RepoConnectionSchema, } from './routes/contracts.js';
 export { gcpKmsMasterKeyProvider, } from './secret/kms-master-key.js';
 export { serveService } from './serve.js';
 export { createServiceHandler } from './service.js';
 export { capabilitiesForConfig, defineNoodleService, expandServiceProfile, parseNoodleServiceYaml, resolveServiceConfigSource, } from './service-config.js';
+export { ALERT_METRICS, ALERT_WINDOWS_MINUTES, DEFAULT_ALERT_COOLDOWN_MINUTES, InMemoryAlertRuleStore, MAX_ALERT_RULES_PER_ENV, } from './store/alert-rules.js';
+export { JsonFileAlertRuleStore } from './store/alert-rules-json-file.js';
 export { AUDIT_SCHEMA_VERSION, InMemoryAuditStore, MultiSink, redactDetails, StdoutAuditSink, } from './store/audit.js';
 export { InMemoryControlPlaneStore } from './store/control-plane.js';
 export { InMemoryGithubConnectionStore } from './store/github-connections.js';
 export { JsonFileGithubConnectionStore } from './store/github-connections-json-file.js';
+export { canTransitionDeployRun, DEFAULT_DEPLOY_RUN_LIST_LIMIT, DEPLOY_RUN_TRANSITIONS, InMemoryGithubDeployRunStore, } from './store/github-runs.js';
+export { JsonFileGithubDeployRunStore } from './store/github-runs-json-file.js';
+export { PostgresPendingGithubInstallationStore } from './store/pending-installations-postgres.js';
 export { PostgresArtifactStore } from './store/postgres.js';
+export { ensureAlertRuleSchema, PostgresAlertRuleStore, } from './store/postgres-alerts.js';
 export { ensureStateHandleSchema, PostgresStateHandleStore, } from './store/postgres-state-handles.js';
 export { RequestEventBuffer } from './store/request-event-buffer.js';
 export { InMemoryRequestEventStore } from './store/request-events.js';

package/node_modules/@noodle-borg/service/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EACL,yBAAyB,EACzB,cAAc,EAEd,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAKL,gBAAgB,EAEhB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAIL,kBAAkB,GAEnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,WAAW,EAGX,iBAAiB,EAEjB,sBAAsB,EAEtB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAkB,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EACL,qBAAqB,EAGrB,sBAAsB,EACtB,+BAA+B,EAC/B,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,EAGpB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,qBAAqB,EACrB,cAAc,EACd,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAKL,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAGL,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sCAAsC,GAEvC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,8BAA8B,EAE9B,6BAA6B,EAC7B,wBAAwB,EAIxB,mBAAmB,EAQnB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,GAE7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAKL,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,GAMvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,8BAA8B,EAC9B,8BAA8B,EAC9B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,uBAAuB,GAExB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAuB,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EAMpB,sBAAsB,EACtB,0BAA0B,GAE3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EAQpB,kBAAkB,EAElB,SAAS,EACT,aAAa,EACb,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAA6B,MAAM,qBAAqB,CAAC;AACvF,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GAEzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,uBAAuB,GAQxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAKL,mBAAmB,EAKnB,qBAAqB,EAIrB,cAAc,EAGd,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EAUrB,kBAAkB,EAIlB,YAAY,EACZ,UAAU,EAKV,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,uBAAuB,EACvB,2BAA2B,EAC3B,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EACL,4BAA4B,EAC5B,cAAc,EAEd,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,4BAA4B,EAG5B,wBAAwB,EAExB,mBAAmB,EACnB,uBAAuB,GAExB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,yBAAyB,EACzB,cAAc,EAEd,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAKL,gBAAgB,EAEhB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAIL,kBAAkB,GAEnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,WAAW,EAGX,iBAAiB,EAEjB,sBAAsB,EAEtB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAkB,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EACL,qBAAqB,EAGrB,sBAAsB,EACtB,+BAA+B,EAC/B,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,EAGpB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,qBAAqB,EACrB,cAAc,EACd,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAKL,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAGL,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sCAAsC,GAEvC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,8BAA8B,EAE9B,6BAA6B,EAC7B,wBAAwB,EAIxB,mBAAmB,EAQnB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,GAE7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAKL,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,GAMvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,8BAA8B,EAC9B,8BAA8B,EAC9B,4BAA4B,EAC5B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,uBAAuB,GAExB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAuB,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EAMpB,sBAAsB,EACtB,0BAA0B,GAE3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,aAAa,EACb,qBAAqB,EAOrB,8BAA8B,EAC9B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EACL,oBAAoB,EAQpB,kBAAkB,EAElB,SAAS,EACT,aAAa,EACb,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,EAAE,sCAAsC,EAAE,MAAM,2CAA2C,CAAC;AACnG,OAAO,EAAE,qBAAqB,EAA6B,MAAM,qBAAqB,CAAC;AACvF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GAEzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,uBAAuB,GAQxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAML,mBAAmB,EAQnB,qBAAqB,EAOrB,cAAc,EAId,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EAWrB,kBAAkB,EAIlB,YAAY,EACZ,UAAU,EAKV,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,uBAAuB,EACvB,2BAA2B,EAC3B,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC"}