@noodleseed/one 0.17.0 → 0.18.1

package/node_modules/@noodle-borg/service/dist/alert-webhook.js

@@ -0,0 +1,138 @@
+import { isIP } from 'node:net';
+import { guardedFetch, isPublicUnicast } from '@noodle-borg/connector-http';
+/**
+ * Alert webhook delivery (E2, ADR 0130): a single POST attempt with a bounded timeout through the
+ * shared SSRF guard (`guardedFetch` pins DNS resolutions to public unicast addresses — the same
+ * anti-rebinding layer the HTTP connector uses). No retries, no backoff queue (deferred to E3).
+ *
+ * The webhook URL is SENSITIVE (it may embed capability tokens). Nothing this module returns or
+ * throws carries the URL, its host, or an upstream error message: outcomes are closed-vocabulary
+ * reason codes plus the HTTP status, safe to log verbatim.
+ */
+export const ALERT_WEBHOOK_SCHEMA_VERSION = 1;
+const DEFAULT_TIMEOUT_MS = 10_000;
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1']);
+export function buildAlertWebhookPayload(rule, event, observed, firedAt) {
+    return {
+        schemaVersion: ALERT_WEBHOOK_SCHEMA_VERSION,
+        event,
+        org: rule.orgSlug,
+        app: rule.appSlug,
+        env: rule.environment,
+        rule: {
+            id: rule.id,
+            ...(rule.name !== undefined ? { name: rule.name } : {}),
+            metric: rule.metric,
+            threshold: rule.threshold,
+            windowMinutes: rule.windowMinutes,
+            comparison: rule.comparison,
+        },
+        observed,
+        firedAt,
+    };
+}
+/**
+ * Policy validation for a webhook URL, applied at rule create/test time AND re-applied on every
+ * delivery (defense in depth for stored rules). Error messages are generic policy text — they
+ * never echo the URL, host, or credentials back.
+ */
+export function validateAlertWebhookUrl(raw, policy) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return { ok: false, error: '"webhookUrl" must be a valid absolute URL' };
+    }
+    if (url.username !== '' || url.password !== '') {
+        return { ok: false, error: '"webhookUrl" must not embed credentials' };
+    }
+    const host = url.hostname.replace(/^\[|\]$/g, '');
+    const loopback = LOOPBACK_HOSTS.has(host);
+    if (url.protocol === 'http:') {
+        if (loopback && policy.allowLoopback)
+            return { ok: true, url };
+        return {
+            ok: false,
+            error: '"webhookUrl" must use https (plain http is allowed only for loopback targets outside production)',
+        };
+    }
+    if (url.protocol !== 'https:') {
+        return { ok: false, error: '"webhookUrl" must use https' };
+    }
+    if (loopback) {
+        return policy.allowLoopback
+            ? { ok: true, url }
+            : { ok: false, error: '"webhookUrl" must not target a loopback address' };
+    }
+    // Literal IPs carry no DNS step for the delivery-time guard to pin, so they are policy-checked
+    // here: only public unicast addresses are accepted (blocks 10/8, 172.16/12, 192.168/16,
+    // link-local incl. the cloud metadata address, and other reserved ranges).
+    if (isIP(host) !== 0 && !isPublicUnicast(host)) {
+        return { ok: false, error: '"webhookUrl" must not target a private or reserved IP address' };
+    }
+    return { ok: true, url };
+}
+/**
+ * Single-attempt webhook POST. Loopback targets (dev carve-out) use the plain platform fetch —
+ * the pinned lookup would reject loopback resolutions by design; everything else goes through
+ * {@link guardedFetch}. Redirects are not followed (a redirect could re-point the request at an
+ * unguarded literal-IP target); a 3xx reports as an ordinary non-2xx outcome.
+ */
+export async function deliverAlertWebhook(rawUrl, payload, options = {}) {
+    const validated = validateAlertWebhookUrl(rawUrl, {
+        allowLoopback: options.allowLoopback === true,
+    });
+    if (!validated.ok)
+        return { delivered: false, reason: 'invalid_url' };
+    const init = {
+        method: 'POST',
+        headers: {
+            'content-type': 'application/json; charset=utf-8',
+            'user-agent': 'noodleseed-alerts/1',
+        },
+        body: JSON.stringify(payload),
+        redirect: 'manual',
+        signal: AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+    };
+    const host = validated.url.hostname.replace(/^\[|\]$/g, '');
+    try {
+        const response = LOOPBACK_HOSTS.has(host)
+            ? await fetch(validated.url, init)
+            : await guardedFetch(validated.url, init, {
+                ...(options.timeoutMs !== undefined ? { connectTimeoutMs: options.timeoutMs } : {}),
+                ...(options.lookup !== undefined ? { lookup: options.lookup } : {}),
+            });
+        // Drain/cancel the body — the response content is untrusted and unbounded; only the status matters.
+        try {
+            await response.body?.cancel();
+        }
+        catch {
+            // ignore: some bodies are already consumed/closed
+        }
+        if (response.ok)
+            return { delivered: true, status: response.status };
+        return { delivered: false, status: response.status, reason: 'http_error' };
+    }
+    catch (error) {
+        return { delivered: false, reason: classifyDeliveryError(error) };
+    }
+}
+/** Map a fetch failure to a closed reason code — upstream messages may embed the URL/host. */
+function classifyDeliveryError(error) {
+    if (error instanceof Error) {
+        if (error.name === 'TimeoutError' || error.name === 'AbortError')
+            return 'timeout';
+        if (error.message.startsWith('egress blocked:'))
+            return 'egress_blocked';
+        const cause = error.cause;
+        if (cause instanceof Error && cause.message.startsWith('egress blocked:')) {
+            return 'egress_blocked';
+        }
+        if (cause instanceof Error && (cause.name === 'TimeoutError' || cause.name === 'AbortError')) {
+            return 'timeout';
+        }
+    }
+    return 'network_error';
+}
+//# sourceMappingURL=alert-webhook.js.map

package/node_modules/@noodle-borg/service/dist/alert-webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alert-webhook.js","sourceRoot":"","sources":["../src/alert-webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAkB,YAAY,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAG5F;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAC9C,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AAoBlE,MAAM,UAAU,wBAAwB,CACtC,IAAqB,EACrB,KAAwB,EACxB,QAAgB,EAChB,OAAe;IAEf,OAAO;QACL,aAAa,EAAE,4BAA4B;QAC3C,KAAK;QACL,GAAG,EAAE,IAAI,CAAC,OAAO;QACjB,GAAG,EAAE,IAAI,CAAC,OAAO;QACjB,GAAG,EAAE,IAAI,CAAC,WAAW;QACrB,IAAI,EAAE;YACJ,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B;QACD,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC;AAoBD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAW,EACX,MAAwB;IAExB,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7B,IAAI,QAAQ,IAAI,MAAM,CAAC,aAAa;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAC/D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,kGAAkG;SACrG,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,aAAa;YACzB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;YACnB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;IAC9E,CAAC;IACD,+FAA+F;IAC/F,wFAAwF;IACxF,2EAA2E;IAC3E,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+DAA+D,EAAE,CAAC;IAC/F,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC;AAUD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,OAA4B,EAC5B,UAAsC,EAAE;IAExC,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE;QAChD,aAAa,EAAE,OAAO,CAAC,aAAa,KAAK,IAAI;KAC9C,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACtE,MAAM,IAAI,GAAgB;QACxB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,iCAAiC;YACjD,YAAY,EAAE,qBAAqB;SACpC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;KACrE,CAAC;IACF,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;YACvC,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC;YAClC,CAAC,CAAC,MAAM,YAAY,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE;gBACtC,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE,CAAC,CAAC;QACP,oGAAoG;QACpG,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;QACD,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;IACpE,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC;QACnF,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC;YAAE,OAAO,gBAAgB,CAAC;QACzE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC1B,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC1E,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK,YAAY,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;YAC7F,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/node_modules/@noodle-borg/service/dist/github/pending-installations.d.ts

@@ -1,5 +1,5 @@
 /**
- * Minimal in-memory hand-off for the CLI `noodle github connect` poll (GHD-1.4). GitHub's installation
+ * Hand-off store for the CLI `noodle github connect` poll (GHD-1.4). GitHub's installation
  * flow redirects the installer's BROWSER to the GitHub App's configured "Setup URL" once the install
  * completes — a request the CLI process cannot receive directly (it has no public callback endpoint of
  * its own). `GET /v1/github/setup` (`../routes/github-setup.ts`) IS that Setup URL: it lands the
@@ -8,10 +8,14 @@
  * (same file) until the entry appears, then proceeds to `POST /v1/github/installations/claim`.
  *
  * Entries expire on the same 10-minute TTL as the nonce itself (`install-nonce.ts`) so a stale poll can
- * never resurrect an old install correlation. Deliberately NOT the durable `GithubConnectionStore` — this
- * is single-flight hand-off state, not a persisted record; a multi-instance deployment needs a shared
- * backing (e.g. Postgres/Redis) before this feature is exposed there (see ADR 0111).
+ * never resurrect an old install correlation. The interface is async because a multi-instance
+ * deployment backs it with Postgres (`PostgresArtifactStore` implements it — GHD-2 closed the gap
+ * flagged in the GHD-1 review): the setup redirect and the CLI poll can land on different instances,
+ * so the hand-off must live in the shared store. The in-memory backend remains the single-instance
+ * dev/test default.
  */
+/** Shared hand-off TTL — mirrors the install-nonce TTL so neither side outlives the other. */
+export declare const PENDING_GITHUB_INSTALLATION_TTL_MS: number;
 export interface PendingGithubInstallationStore {
     /**
      * Record that the setup redirect landed for `state`, carrying the installationId GitHub reported.
@@ -19,13 +23,16 @@ export interface PendingGithubInstallationStore {
      * redirect cannot overwrite the recorded installation (hardening: the repo-confirm step and the
      * repo-in-installation re-verification already blunt a swapped id; this closes the race outright).
      */
-    put(state: string, installationId: number): void;
+    put(state: string, installationId: number): Promise<void>;
     /** The installationId stashed for `state`, or `undefined` if it hasn't landed yet (or has expired). */
-    get(state: string): number | undefined;
+    get(state: string): Promise<number | undefined>;
 }
 export declare class InMemoryPendingGithubInstallationStore implements PendingGithubInstallationStore {
     #private;
-    put(state: string, installationId: number): void;
-    get(state: string): number | undefined;
+    constructor(options?: {
+        now?: () => Date;
+    });
+    put(state: string, installationId: number): Promise<void>;
+    get(state: string): Promise<number | undefined>;
 }
 //# sourceMappingURL=pending-installations.d.ts.map

package/node_modules/@noodle-borg/service/dist/github/pending-installations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pending-installations.d.ts","sourceRoot":"","sources":["../../src/github/pending-installations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,MAAM,WAAW,8BAA8B;IAC7C;;;;;OAKG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACjD,uGAAuG;IACvG,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,qBAAa,sCAAuC,YAAW,8BAA8B;;IAG3F,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI;IAKhD,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CASvC"}
+{"version":3,"file":"pending-installations.d.ts","sourceRoot":"","sources":["../../src/github/pending-installations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,8FAA8F;AAC9F,eAAO,MAAM,kCAAkC,QAAiB,CAAC;AAOjE,MAAM,WAAW,8BAA8B;IAC7C;;;;;OAKG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,uGAAuG;IACvG,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACjD;AAED,qBAAa,sCAAuC,YAAW,8BAA8B;;gBAI/E,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;KAAO;IAIxC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzD,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAStD"}

package/node_modules/@noodle-borg/service/dist/github/pending-installations.js

@@ -1,5 +1,5 @@
 /**
- * Minimal in-memory hand-off for the CLI `noodle github connect` poll (GHD-1.4). GitHub's installation
+ * Hand-off store for the CLI `noodle github connect` poll (GHD-1.4). GitHub's installation
  * flow redirects the installer's BROWSER to the GitHub App's configured "Setup URL" once the install
  * completes — a request the CLI process cannot receive directly (it has no public callback endpoint of
  * its own). `GET /v1/github/setup` (`../routes/github-setup.ts`) IS that Setup URL: it lands the
@@ -8,23 +8,30 @@
  * (same file) until the entry appears, then proceeds to `POST /v1/github/installations/claim`.
  *
  * Entries expire on the same 10-minute TTL as the nonce itself (`install-nonce.ts`) so a stale poll can
- * never resurrect an old install correlation. Deliberately NOT the durable `GithubConnectionStore` — this
- * is single-flight hand-off state, not a persisted record; a multi-instance deployment needs a shared
- * backing (e.g. Postgres/Redis) before this feature is exposed there (see ADR 0111).
+ * never resurrect an old install correlation. The interface is async because a multi-instance
+ * deployment backs it with Postgres (`PostgresArtifactStore` implements it — GHD-2 closed the gap
+ * flagged in the GHD-1 review): the setup redirect and the CLI poll can land on different instances,
+ * so the hand-off must live in the shared store. The in-memory backend remains the single-instance
+ * dev/test default.
  */
-const PENDING_TTL_MS = 10 * 60 * 1000;
+/** Shared hand-off TTL — mirrors the install-nonce TTL so neither side outlives the other. */
+export const PENDING_GITHUB_INSTALLATION_TTL_MS = 10 * 60 * 1000;
 export class InMemoryPendingGithubInstallationStore {
     #entries = new Map();
-    put(state, installationId) {
+    #now;
+    constructor(options = {}) {
+        this.#now = options.now ?? (() => new Date());
+    }
+    async put(state, installationId) {
         if (this.#entries.has(state))
             return; // first write wins — see the interface doc
-        this.#entries.set(state, { installationId, createdAt: Date.now() });
+        this.#entries.set(state, { installationId, createdAt: this.#now().getTime() });
     }
-    get(state) {
+    async get(state) {
         const entry = this.#entries.get(state);
         if (entry === undefined)
             return undefined;
-        if (Date.now() - entry.createdAt > PENDING_TTL_MS) {
+        if (this.#now().getTime() - entry.createdAt > PENDING_GITHUB_INSTALLATION_TTL_MS) {
             this.#entries.delete(state);
             return undefined;
         }

package/node_modules/@noodle-borg/service/dist/github/pending-installations.js.map

@@ -1 +1 @@
-{"version":3,"file":"pending-installations.js","sourceRoot":"","sources":["../../src/github/pending-installations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAmBtC,MAAM,OAAO,sCAAsC;IACxC,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEpD,GAAG,CAAC,KAAa,EAAE,cAAsB;QACvC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,2CAA2C;QACjF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,GAAG,CAAC,KAAa;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,cAAc,EAAE,CAAC;YAClD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,cAAc,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"pending-installations.js","sourceRoot":"","sources":["../../src/github/pending-installations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAmBjE,MAAM,OAAO,sCAAsC;IACxC,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC3C,IAAI,CAAa;IAE1B,YAAY,UAAgC,EAAE;QAC5C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,cAAsB;QAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,2CAA2C;QACjF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,kCAAkC,EAAE,CAAC;YACjF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,cAAc,CAAC;IAC9B,CAAC;CACF"}

package/node_modules/@noodle-borg/service/dist/index.d.ts

@@ -1,4 +1,6 @@
 export { ensureAuditSchema, PostgresAuditStore } from '@noodle-borg/module-audit';
+export { ALERT_EVALUATION_INTERVAL_MS, AlertEvaluator, type AlertEvaluatorOptions, observedMetricValue, } from './alert-evaluator.js';
+export { ALERT_WEBHOOK_SCHEMA_VERSION, type AlertWebhookDelivery, type AlertWebhookPayload, buildAlertWebhookPayload, type DeliverAlertWebhookOptions, deliverAlertWebhook, validateAlertWebhookUrl, type WebhookUrlPolicy, } from './alert-webhook.js';
 export { ARCHIVE_SWEEP_INTERVAL_MS, ArchiveSweeper, type ArchiveSweeperOptions, DEFAULT_ARCHIVE_RETENTION_DAYS, resolveArchiveRetentionDays, } from './archive-sweeper.js';
 export { type AssetAdapterKind, type AssetConfigInput, type AssetConfigResolution, type AssetQuotaOverride, createAssetStore, type ResolvedAssetConfig, resolveAssetConfig, } from './asset-config.js';
 export { type AssetStore, type AssetUploadPlan, type AssetUploadTarget, InMemoryAssetStore, type InMemoryAssetStoreOptions, } from './assets.js';
@@ -17,20 +19,26 @@ export { CachingPolicyAssignmentStore, type PolicyCacheOptions, } from './policy
 export { InMemoryPolicyCounterStore } from './policy-counters.js';
 export { type DeployError, type DeployResult, type RecoverResult, type RollbackResult, ServerRegistry, } from './registry.js';
 export { aggregateRequestEvents, type ClientMetrics, type MethodMetrics, type RequestMetrics, type SeriesBucket, type ToolMetrics, } from './request-event-metrics.js';
-export { AppResponseSchema, AppSummarySchema, AppsListResponseSchema, DeploymentResponseSchema, DeploymentSummarySchema, EnvResponseSchema, EnvSummarySchema, EnvsListResponseSchema, GithubConnectionResponseSchema, GithubInstallUrlResponseSchema, OrgSummarySchema, RepoConnectionSchema, } from './routes/contracts.js';
+export { AppResponseSchema, AppSummarySchema, AppsListResponseSchema, DeploymentResponseSchema, DeploymentSummarySchema, DeployRunSchema, EnvResponseSchema, EnvSummarySchema, EnvsListResponseSchema, GithubConnectionResponseSchema, GithubInstallUrlResponseSchema, GithubRunsListResponseSchema, OrgSummarySchema, RepoConnectionSchema, } from './routes/contracts.js';
 export { type GcpKmsConfig, gcpKmsMasterKeyProvider, type KmsClient, } from './secret/kms-master-key.js';
 export { type RunningService, serveService } from './serve.js';
 export { createServiceHandler } from './service.js';
 export { capabilitiesForConfig, defineNoodleService, expandServiceProfile, type NoodleServiceConfig, type ObservabilityConfig, type ObservabilityLogFormat, type ObservabilityLogLevel, type ObservabilityLogSink, parseNoodleServiceYaml, resolveServiceConfigSource, type ServiceConfigSource, } from './service-config.js';
+export { ALERT_METRICS, ALERT_WINDOWS_MINUTES, type AlertFiringState, type AlertMetric, type AlertRuleRecord, type AlertRuleStore, type AlertWindowMinutes, type CreateAlertRuleInput, DEFAULT_ALERT_COOLDOWN_MINUTES, InMemoryAlertRuleStore, MAX_ALERT_RULES_PER_ENV, } from './store/alert-rules.js';
+export { JsonFileAlertRuleStore } from './store/alert-rules-json-file.js';
 export { AUDIT_SCHEMA_VERSION, type AuditDecision, type AuditDetails, type AuditEvent, type AuditEventInput, type AuditFilter, type AuditSink, type AuditStore, InMemoryAuditStore, type InMemoryAuditStoreOptions, MultiSink, redactDetails, StdoutAuditSink, } from './store/audit.js';
 export { InMemoryControlPlaneStore } from './store/control-plane.js';
 export { InMemoryGithubConnectionStore } from './store/github-connections.js';
 export { JsonFileGithubConnectionStore } from './store/github-connections-json-file.js';
+export { canTransitionDeployRun, DEFAULT_DEPLOY_RUN_LIST_LIMIT, DEPLOY_RUN_TRANSITIONS, InMemoryGithubDeployRunStore, } from './store/github-runs.js';
+export { JsonFileGithubDeployRunStore } from './store/github-runs-json-file.js';
+export { PostgresPendingGithubInstallationStore } from './store/pending-installations-postgres.js';
 export { PostgresArtifactStore, type PostgresStoreOptions } from './store/postgres.js';
+export { ensureAlertRuleSchema, PostgresAlertRuleStore, } from './store/postgres-alerts.js';
 export { ensureStateHandleSchema, PostgresStateHandleStore, type PostgresStateHandleStoreOptions, } from './store/postgres-state-handles.js';
 export { RequestEventBuffer } from './store/request-event-buffer.js';
 export { InMemoryRequestEventStore } from './store/request-events.js';
 export { ensureRequestEventSchema, PostgresRequestEventStore, } from './store/request-events-postgres.js';
 export { InMemoryUserAppLogStore, type InMemoryUserAppLogStoreOptions, type UserAppLogEvent, type UserAppLogFilter, type UserAppLogInput, type UserAppLogLevel, type UserAppLogSink, type UserAppLogStore, } from './store/user-app-logs.js';
-export { type AppArchiveResult, type AppRestoreResult, type AppSummary, type ArtifactStore, CONFIG_NAME_PATTERN, type ConfigScope, type ConfigStore, type ConfigValueMetadata, type ControlPlaneStore, DEPLOYMENT_ID_PATTERN, type DeploymentListFilter, type DeploymentSummary, type DeployRecord, DOMAIN_PATTERN, type EnvSummary, type GithubConnectionStore, InMemoryArtifactStore, InMemoryConfigStore, JsonFileArtifactStore, type ManagedConfigKind, type OrgDomainRecord, type OrgInvitationRecord, type OrgMemberRecord, type OrgRecord, type OrgRole, type RepoConnectionConflict, type RepoConnectionConflictReason, type RepoConnectionRecord, resolveConfigScope, type SecretEnvelope, type SignupAllowlistKind, type SignupAllowlistRecord, SLUG_PATTERN, scopeChain, type TenantAuthConfig, type TenantRef, type UpsertRepoConnectionInput, type UpsertRepoConnectionResult, validateConfigName, validateConfigScope, validateDomain, validateOrgRole, validatePositiveInteger, validateSignupAllowlistKind, validateSlug, validateTenantRef, } from './store.js';
+export { type AppArchiveResult, type AppRestoreResult, type AppSummary, type ArtifactStore, type CancelQueuedDeployRunsFilter, CONFIG_NAME_PATTERN, type ConfigScope, type ConfigStore, type ConfigValueMetadata, type ControlPlaneStore, type CreateDeployRunDuplicateReason, type CreateDeployRunInput, type CreateDeployRunResult, DEPLOYMENT_ID_PATTERN, type DeploymentListFilter, type DeploymentSummary, type DeployRecord, type DeployRunRecord, type DeployRunSourceEvent, type DeployRunStatus, DOMAIN_PATTERN, type EnvSummary, type GithubConnectionStore, type GithubDeployRunStore, InMemoryArtifactStore, InMemoryConfigStore, JsonFileArtifactStore, type ListDeployRunsResult, type ManagedConfigKind, type OrgDomainRecord, type OrgInvitationRecord, type OrgMemberRecord, type OrgRecord, type OrgRole, type RepoConnectionConflict, type RepoConnectionConflictReason, type RepoConnectionRecord, resolveConfigScope, type SecretEnvelope, type SignupAllowlistKind, type SignupAllowlistRecord, SLUG_PATTERN, scopeChain, type TenantAuthConfig, type TenantRef, type UpsertRepoConnectionInput, type UpsertRepoConnectionResult, validateConfigName, validateConfigScope, validateDomain, validateOrgRole, validatePositiveInteger, validateSignupAllowlistKind, validateSlug, validateTenantRef, } from './store.js';
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/service/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,KAAK,qBAAqB,EAC1B,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,iBAAiB,EACjB,KAAK,cAAc,EACnB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,KAAK,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,8BAA8B,EACnC,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,WAAW,EAChB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,4BAA4B,EACjC,qBAAqB,EACrB,cAAc,EACd,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,EAC9B,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sCAAsC,EACtC,KAAK,8BAA8B,GACpC,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EACL,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,6BAA6B,EAC7B,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,EAC5B,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,8BAA8B,EAC9B,8BAA8B,EAC9B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,YAAY,EACjB,uBAAuB,EACvB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,SAAS,EACT,aAAa,EACb,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,+BAA+B,GACrC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,EACnC,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,cAAc,EACd,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,YAAY,EACZ,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,uBAAuB,EACvB,2BAA2B,EAC3B,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,KAAK,qBAAqB,EAC1B,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,KAAK,qBAAqB,EAC1B,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,iBAAiB,EACjB,KAAK,cAAc,EACnB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,KAAK,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,8BAA8B,EACnC,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,WAAW,EAChB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,4BAA4B,EACjC,qBAAqB,EACrB,cAAc,EACd,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,EAC9B,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sCAAsC,EACtC,KAAK,8BAA8B,GACpC,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EACL,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,6BAA6B,EAC7B,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,EAC5B,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,8BAA8B,EAC9B,8BAA8B,EAC9B,4BAA4B,EAC5B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,YAAY,EACjB,uBAAuB,EACvB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,8BAA8B,EAC9B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EACL,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,SAAS,EACT,aAAa,EACb,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,EAAE,sCAAsC,EAAE,MAAM,2CAA2C,CAAC;AACnG,OAAO,EAAE,qBAAqB,EAAE,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,+BAA+B,GACrC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,EACnC,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,4BAA4B,EACjC,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,8BAA8B,EACnC,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,cAAc,EACd,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,YAAY,EACZ,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,uBAAuB,EACvB,2BAA2B,EAC3B,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC"}

package/node_modules/@noodle-borg/service/dist/index.js

@@ -1,4 +1,6 @@
 export { ensureAuditSchema, PostgresAuditStore } from '@noodle-borg/module-audit';
+export { ALERT_EVALUATION_INTERVAL_MS, AlertEvaluator, observedMetricValue, } from './alert-evaluator.js';
+export { ALERT_WEBHOOK_SCHEMA_VERSION, buildAlertWebhookPayload, deliverAlertWebhook, validateAlertWebhookUrl, } from './alert-webhook.js';
 export { ARCHIVE_SWEEP_INTERVAL_MS, ArchiveSweeper, DEFAULT_ARCHIVE_RETENTION_DAYS, resolveArchiveRetentionDays, } from './archive-sweeper.js';
 export { createAssetStore, resolveAssetConfig, } from './asset-config.js';
 export { InMemoryAssetStore, } from './assets.js';
@@ -16,16 +18,22 @@ export { CachingPolicyAssignmentStore, } from './policy-cache.js';
 export { InMemoryPolicyCounterStore } from './policy-counters.js';
 export { ServerRegistry, } from './registry.js';
 export { aggregateRequestEvents, } from './request-event-metrics.js';
-export { AppResponseSchema, AppSummarySchema, AppsListResponseSchema, DeploymentResponseSchema, DeploymentSummarySchema, EnvResponseSchema, EnvSummarySchema, EnvsListResponseSchema, GithubConnectionResponseSchema, GithubInstallUrlResponseSchema, OrgSummarySchema, RepoConnectionSchema, } from './routes/contracts.js';
+export { AppResponseSchema, AppSummarySchema, AppsListResponseSchema, DeploymentResponseSchema, DeploymentSummarySchema, DeployRunSchema, EnvResponseSchema, EnvSummarySchema, EnvsListResponseSchema, GithubConnectionResponseSchema, GithubInstallUrlResponseSchema, GithubRunsListResponseSchema, OrgSummarySchema, RepoConnectionSchema, } from './routes/contracts.js';
 export { gcpKmsMasterKeyProvider, } from './secret/kms-master-key.js';
 export { serveService } from './serve.js';
 export { createServiceHandler } from './service.js';
 export { capabilitiesForConfig, defineNoodleService, expandServiceProfile, parseNoodleServiceYaml, resolveServiceConfigSource, } from './service-config.js';
+export { ALERT_METRICS, ALERT_WINDOWS_MINUTES, DEFAULT_ALERT_COOLDOWN_MINUTES, InMemoryAlertRuleStore, MAX_ALERT_RULES_PER_ENV, } from './store/alert-rules.js';
+export { JsonFileAlertRuleStore } from './store/alert-rules-json-file.js';
 export { AUDIT_SCHEMA_VERSION, InMemoryAuditStore, MultiSink, redactDetails, StdoutAuditSink, } from './store/audit.js';
 export { InMemoryControlPlaneStore } from './store/control-plane.js';
 export { InMemoryGithubConnectionStore } from './store/github-connections.js';
 export { JsonFileGithubConnectionStore } from './store/github-connections-json-file.js';
+export { canTransitionDeployRun, DEFAULT_DEPLOY_RUN_LIST_LIMIT, DEPLOY_RUN_TRANSITIONS, InMemoryGithubDeployRunStore, } from './store/github-runs.js';
+export { JsonFileGithubDeployRunStore } from './store/github-runs-json-file.js';
+export { PostgresPendingGithubInstallationStore } from './store/pending-installations-postgres.js';
 export { PostgresArtifactStore } from './store/postgres.js';
+export { ensureAlertRuleSchema, PostgresAlertRuleStore, } from './store/postgres-alerts.js';
 export { ensureStateHandleSchema, PostgresStateHandleStore, } from './store/postgres-state-handles.js';
 export { RequestEventBuffer } from './store/request-event-buffer.js';
 export { InMemoryRequestEventStore } from './store/request-events.js';

package/node_modules/@noodle-borg/service/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EACL,yBAAyB,EACzB,cAAc,EAEd,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAKL,gBAAgB,EAEhB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAIL,kBAAkB,GAEnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,WAAW,EAGX,iBAAiB,EAEjB,sBAAsB,EAEtB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAkB,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EACL,qBAAqB,EAGrB,sBAAsB,EACtB,+BAA+B,EAC/B,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,EAGpB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,qBAAqB,EACrB,cAAc,EACd,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAKL,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAGL,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sCAAsC,GAEvC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,8BAA8B,EAE9B,6BAA6B,EAC7B,wBAAwB,EAIxB,mBAAmB,EAQnB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,GAE7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAKL,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,GAMvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,8BAA8B,EAC9B,8BAA8B,EAC9B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,uBAAuB,GAExB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAuB,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EAMpB,sBAAsB,EACtB,0BAA0B,GAE3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EAQpB,kBAAkB,EAElB,SAAS,EACT,aAAa,EACb,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAA6B,MAAM,qBAAqB,CAAC;AACvF,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GAEzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,uBAAuB,GAQxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAKL,mBAAmB,EAKnB,qBAAqB,EAIrB,cAAc,EAGd,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EAUrB,kBAAkB,EAIlB,YAAY,EACZ,UAAU,EAKV,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,uBAAuB,EACvB,2BAA2B,EAC3B,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EACL,4BAA4B,EAC5B,cAAc,EAEd,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,4BAA4B,EAG5B,wBAAwB,EAExB,mBAAmB,EACnB,uBAAuB,GAExB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,yBAAyB,EACzB,cAAc,EAEd,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAKL,gBAAgB,EAEhB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAIL,kBAAkB,GAEnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,WAAW,EAGX,iBAAiB,EAEjB,sBAAsB,EAEtB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAkB,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EACL,qBAAqB,EAGrB,sBAAsB,EACtB,+BAA+B,EAC/B,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,EAGpB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,qBAAqB,EACrB,cAAc,EACd,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAKL,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAGL,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sCAAsC,GAEvC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,8BAA8B,EAE9B,6BAA6B,EAC7B,wBAAwB,EAIxB,mBAAmB,EAQnB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,GAE7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAKL,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,GAMvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACtB,8BAA8B,EAC9B,8BAA8B,EAC9B,4BAA4B,EAC5B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,uBAAuB,GAExB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAuB,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EAMpB,sBAAsB,EACtB,0BAA0B,GAE3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,aAAa,EACb,qBAAqB,EAOrB,8BAA8B,EAC9B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EACL,oBAAoB,EAQpB,kBAAkB,EAElB,SAAS,EACT,aAAa,EACb,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,EAAE,sCAAsC,EAAE,MAAM,2CAA2C,CAAC;AACnG,OAAO,EAAE,qBAAqB,EAA6B,MAAM,qBAAqB,CAAC;AACvF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GAEzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,uBAAuB,GAQxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAML,mBAAmB,EAQnB,qBAAqB,EAOrB,cAAc,EAId,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EAWrB,kBAAkB,EAIlB,YAAY,EACZ,UAAU,EAKV,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,uBAAuB,EACvB,2BAA2B,EAC3B,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC"}

package/node_modules/@noodle-borg/service/dist/options.d.ts

@@ -10,9 +10,10 @@ import type { GitHubAppClient, GithubAppConfig } from './github/app-client.js';
 import type { PendingGithubInstallationStore } from './github/pending-installations.js';
 import type { LoadedServiceModule } from './modules/host.js';
 import type { PolicyAssignmentStore, PolicyCounterStore } from './policy.js';
+import type { AlertRuleStore } from './store/alert-rules.js';
 import type { AuditSink } from './store/audit.js';
 import type { UserAppLogStore } from './store/user-app-logs.js';
-import type { ConfigStore, ControlPlaneStore, GithubConnectionStore } from './store.js';
+import type { ConfigStore, ControlPlaneStore, GithubConnectionStore, GithubDeployRunStore } from './store.js';
 export interface ServiceOptions {
     /** Public base URL used to build returned endpoint URLs. Defaults to the request's Host header. */
     readonly publicBaseUrl?: string;
@@ -109,6 +110,19 @@ export interface ServiceOptions {
      * tiered by-plan retention is a later stage). Default 30.
      */
     readonly requestEventRetentionDays?: number;
+    /**
+     * Analytics alert-rule store (E2, ADR 0130). Backs the tenant `alerts` CRUD/test routes and the
+     * periodic evaluator. Default: in-memory in the handler; `serveService` selects Postgres when
+     * persistence is configured, else a `dataDir` JSON-file store, else in-memory (mirrors the
+     * request-event store selection).
+     */
+    readonly alertRuleStore?: AlertRuleStore;
+    /**
+     * Dev/test-only carve-out allowing `http://localhost` / `http://127.0.0.1` / `[::1]` alert
+     * webhook targets (mirrors `customerVerifierAllowInsecureLocalhost`). Production leaves this
+     * unset: webhooks are https-only and delivery is SSRF-guarded (DNS-pinned public unicast).
+     */
+    readonly alertWebhookAllowLoopback?: boolean;
     /**
      * The self-hosted authorization server issuer (OA-2) advertised in protected-resource metadata so an
      * MCP client can discover where to authenticate. When unset, the metadata omits `authorization_servers`.
@@ -143,6 +157,11 @@ export interface ServiceOptions {
      * store, else in-memory (mirrors `controlPlaneStore`/`configStore`).
      */
     readonly githubConnectionStore?: GithubConnectionStore;
+    /**
+     * GHD-2 deploy-run store (ADR 0111 §6): webhook-accepted runs, replay-safe. Same backend-selection
+     * rule as `githubConnectionStore`.
+     */
+    readonly githubDeployRunStore?: GithubDeployRunStore;
     /**
      * Non-secret Noodle Seed GitHub App identity (ADR 0111). Everything is optional — the whole GHD-1
      * connection feature is off (install-url 409s) when absent. Long-lived credentials

package/node_modules/@noodle-borg/service/dist/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,KAAK,EACV,aAAa,EACb,MAAM,EACN,kBAAkB,EAClB,UAAU,EACX,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAExF,MAAM,WAAW,cAAc;IAC7B,mGAAmG;IACnG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,gEAAgE;IAChE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,0GAA0G;IAC1G,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IACrC,oGAAoG;IACpG,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,kGAAkG;IAClG,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,kGAAkG;IAClG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,yGAAyG;IACzG,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,wFAAwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,sCAAsC,CAAC,EAAE,OAAO,CAAC;IAC1D;;;OAGG;IACH,QAAQ,CAAC,4BAA4B,CAAC,EAAE,aAAa,CAAC;IACtD,yFAAyF;IACzF,QAAQ,CAAC,+BAA+B,CAAC,EAAE,MAAM,CAAC;IAClD,qFAAqF;IACrF,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,4FAA4F;IAC5F,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IAC7C,uFAAuF;IACvF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,uEAAuE;IACvE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,iGAAiG;IACjG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAClE;;;OAGG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;IAC7E;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;IAC9E,0FAA0F;IAC1F,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C,4GAA4G;IAC5G,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACjD,sGAAsG;IACtG,QAAQ,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACzD,6FAA6F;IAC7F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,4GAA4G;IAC5G,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,0GAA0G;IAC1G,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC;CAC1E"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,KAAK,EACV,aAAa,EACb,MAAM,EACN,kBAAkB,EAClB,UAAU,EACX,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,cAAc;IAC7B,mGAAmG;IACnG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,gEAAgE;IAChE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,0GAA0G;IAC1G,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IACrC,oGAAoG;IACpG,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,kGAAkG;IAClG,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,kGAAkG;IAClG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,yGAAyG;IACzG,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,wFAAwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,sCAAsC,CAAC,EAAE,OAAO,CAAC;IAC1D;;;OAGG;IACH,QAAQ,CAAC,4BAA4B,CAAC,EAAE,aAAa,CAAC;IACtD,yFAAyF;IACzF,QAAQ,CAAC,+BAA+B,CAAC,EAAE,MAAM,CAAC;IAClD,qFAAqF;IACrF,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,4FAA4F;IAC5F,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IAC7C,uFAAuF;IACvF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,uEAAuE;IACvE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,iGAAiG;IACjG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAClE;;;OAGG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;IAC7E;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;IAC9E,0FAA0F;IAC1F,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C,4GAA4G;IAC5G,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACjD,sGAAsG;IACtG,QAAQ,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACzD,6FAA6F;IAC7F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,4GAA4G;IAC5G,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,0GAA0G;IAC1G,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC;CAC1E"}

package/node_modules/@noodle-borg/service/dist/routes/alerts-dispatch.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Dispatch for the analytics alerting routes (E2, ADR 0130), extracted the same way as
+ * `analytics-dispatch.ts`/`github-dispatch.ts` so `service.ts` stays a thin composition root
+ * under the size gate. The three path shapes are mutually exclusive by regex (the item pattern's
+ * final `[^/]+$` can never match the `/test` suffix), so dispatch order carries no behavior.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { TlsPosture } from '@noodle-borg/transport-http';
+import type { DeployAuthGate } from '../auth/deploy-gate.js';
+import type { AlertRuleStore } from '../store/alert-rules.js';
+import type { AuditSink } from '../store/audit.js';
+import type { ControlPlaneStore } from '../store.js';
+export interface AlertsDispatchDeps {
+    readonly gate: DeployAuthGate;
+    readonly controlPlane: ControlPlaneStore;
+    readonly alertRuleStore: AlertRuleStore;
+    readonly audit: AuditSink;
+    readonly maxBody: number;
+    readonly allowLoopbackWebhooks: boolean;
+    readonly applySecurityHeaders: (res: ServerResponse, tls: TlsPosture) => void;
+    readonly enforceHttps: (req: IncomingMessage, res: ServerResponse, tls: TlsPosture) => boolean;
+    readonly sendJson: (res: ServerResponse, status: number, body: unknown) => void;
+    readonly tls: TlsPosture;
+    readonly clock?: () => Date;
+}
+/** Try the alerting routes; returns true when the request was handled (or a guard ended it). */
+export declare function dispatchAlertRoutes(req: IncomingMessage, res: ServerResponse, url: URL, deps: AlertsDispatchDeps): boolean;
+//# sourceMappingURL=alerts-dispatch.d.ts.map

package/node_modules/@noodle-borg/service/dist/routes/alerts-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alerts-dispatch.d.ts","sourceRoot":"","sources":["../../src/routes/alerts-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAQrD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,oBAAoB,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,KAAK,IAAI,CAAC;IAC9E,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC;IAC/F,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAChF,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED,gGAAgG;AAChG,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,kBAAkB,GACvB,OAAO,CA2CT"}

package/node_modules/@noodle-borg/service/dist/routes/alerts-dispatch.js

@@ -0,0 +1,50 @@
+import { handleAlertRuleDelete, handleAlertRules, handleAlertRuleTest } from './alerts.js';
+import { parseTenantAlertItemPath, parseTenantAlertsPath, parseTenantAlertTestPath, } from './paths.js';
+/** Try the alerting routes; returns true when the request was handled (or a guard ended it). */
+export function dispatchAlertRoutes(req, res, url, deps) {
+    const { applySecurityHeaders, enforceHttps, sendJson, tls } = deps;
+    const routeDeps = {
+        gate: deps.gate,
+        controlPlane: deps.controlPlane,
+        store: deps.alertRuleStore,
+        audit: deps.audit,
+        maxBody: deps.maxBody,
+        allowLoopbackWebhooks: deps.allowLoopbackWebhooks,
+        ...(deps.clock !== undefined ? { clock: deps.clock } : {}),
+    };
+    const collectionRef = parseTenantAlertsPath(url.pathname);
+    if (collectionRef !== undefined && (req.method === 'GET' || req.method === 'POST')) {
+        applySecurityHeaders(res, tls);
+        if (enforceHttps(req, res, tls))
+            return true;
+        handleAlertRules(req, res, collectionRef, routeDeps).catch(() => {
+            if (!res.headersSent)
+                sendJson(res, 500, { error: 'internal error' });
+        });
+        return true;
+    }
+    const testRef = parseTenantAlertTestPath(url.pathname);
+    if (testRef !== undefined && req.method === 'POST') {
+        applySecurityHeaders(res, tls);
+        if (enforceHttps(req, res, tls))
+            return true;
+        handleAlertRuleTest(req, res, testRef.ref, testRef.id, routeDeps).catch(() => {
+            if (!res.headersSent)
+                sendJson(res, 500, { error: 'internal error' });
+        });
+        return true;
+    }
+    const itemRef = parseTenantAlertItemPath(url.pathname);
+    if (itemRef !== undefined && req.method === 'DELETE') {
+        applySecurityHeaders(res, tls);
+        if (enforceHttps(req, res, tls))
+            return true;
+        handleAlertRuleDelete(req, res, itemRef.ref, itemRef.id, routeDeps).catch(() => {
+            if (!res.headersSent)
+                sendJson(res, 500, { error: 'internal error' });
+        });
+        return true;
+    }
+    return false;
+}
+//# sourceMappingURL=alerts-dispatch.js.map

package/node_modules/@noodle-borg/service/dist/routes/alerts-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alerts-dispatch.js","sourceRoot":"","sources":["../../src/routes/alerts-dispatch.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AAgBpB,gGAAgG;AAChG,MAAM,UAAU,mBAAmB,CACjC,GAAoB,EACpB,GAAmB,EACnB,GAAQ,EACR,IAAwB;IAExB,MAAM,EAAE,oBAAoB,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACnE,MAAM,SAAS,GAAG;QAChB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,KAAK,EAAE,IAAI,CAAC,cAAc;QAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;IAEF,MAAM,aAAa,GAAG,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;QACnF,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YAC9D,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACnD,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YAC3E,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACrD,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YAC7E,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/node_modules/@noodle-borg/service/dist/routes/alerts.d.ts

@@ -0,0 +1,39 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { DeployAuthGate } from '../auth/deploy-gate.js';
+import { type AlertRuleStore } from '../store/alert-rules.js';
+import type { AuditSink } from '../store/audit.js';
+import type { ControlPlaneStore, TenantRef } from '../store.js';
+/**
+ * Analytics alerting routes (E2, ADR 0130): `GET`/`POST .../alerts`, `DELETE .../alerts/{id}`,
+ * and `POST .../alerts/{id}/test`. Reads are org-MEMBER gated (`authorizeTenantControl`, like the
+ * neighbouring analytics reads); mutations and test-fires are org-OWNER gated (`canManageMembers`,
+ * like the GHD-1 connection writes) and emit audit events with scalar details only.
+ *
+ * The webhook URL enters once through `POST` (validated by `validateAlertWebhookUrl`) and never
+ * leaves again: responses serialize rules through {@link publicAlertRule} and the strict Zod
+ * contract has no field that could carry it.
+ */
+export interface AlertRouteDeps {
+    readonly gate: DeployAuthGate;
+    readonly controlPlane: ControlPlaneStore;
+    readonly store: AlertRuleStore;
+    readonly audit: AuditSink;
+    readonly maxBody: number;
+    /** Dev/test-only loopback webhook carve-out (`alertWebhookAllowLoopback`). */
+    readonly allowLoopbackWebhooks: boolean;
+    /** Injectable clock for deterministic test-fire timestamps. */
+    readonly clock?: () => Date;
+}
+/** Redact a webhook URL to its origin — path/query (where tokens live) never leave the service. */
+export declare function redactWebhookUrl(url: string): string;
+/** `GET` (member) / `POST` (owner) on the alert-rule collection. */
+export declare function handleAlertRules(req: IncomingMessage, res: ServerResponse, ref: TenantRef, deps: AlertRouteDeps): Promise<void>;
+/** `DELETE .../alerts/{id}` — org OWNER only; 404 when the rule is not in this tenant scope. */
+export declare function handleAlertRuleDelete(req: IncomingMessage, res: ServerResponse, ref: TenantRef, id: string, deps: AlertRouteDeps): Promise<void>;
+/**
+ * `POST .../alerts/{id}/test` — org OWNER only: sends a synthetic `event: "test"` payload through
+ * the exact guarded delivery path a real breach uses. The response carries only the closed-code
+ * delivery outcome; a failed delivery is still a 200 (the route worked, the endpoint did not).
+ */
+export declare function handleAlertRuleTest(req: IncomingMessage, res: ServerResponse, ref: TenantRef, id: string, deps: AlertRouteDeps): Promise<void>;
+//# sourceMappingURL=alerts.d.ts.map

package/node_modules/@noodle-borg/service/dist/routes/alerts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alerts.d.ts","sourceRoot":"","sources":["../../src/routes/alerts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAMjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,EAKL,KAAK,cAAc,EAGpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAMhE;;;;;;;;;GASG;AAEH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED,mGAAmG;AACnG,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMpD;AAsBD,oEAAoE;AACpE,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,IAAI,CAAC,CAWf;AAmHD,gGAAgG;AAChG,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,SAAS,EACd,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,SAAS,EACd,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,IAAI,CAAC,CA2Bf"}