@noodleseed/one 0.22.0 → 0.24.0

package/node_modules/@noodle-borg/service/dist/github/cloud-run-job-executor.d.ts

@@ -0,0 +1,45 @@
+import type { DeployRunDispatchInput, DeployRunExecutor } from './deploy-run-executor.js';
+export interface CloudRunJobsRunRequest {
+    readonly name: string;
+    readonly body: {
+        readonly overrides: {
+            readonly containerOverrides: readonly [
+                {
+                    readonly env: readonly {
+                        readonly name: string;
+                        readonly value: string;
+                    }[];
+                }
+            ];
+            readonly taskCount: number;
+            readonly timeout: string;
+        };
+    };
+}
+export interface CloudRunJobsRunClient {
+    runJob(request: CloudRunJobsRunRequest): Promise<void>;
+}
+export interface CloudRunJobExecutorOptions {
+    readonly project: string;
+    readonly region: string;
+    readonly job: string;
+    readonly environment: string;
+    readonly taskTimeoutSeconds?: number;
+    readonly client?: CloudRunJobsRunClient;
+}
+/**
+ * Production GHD-C3 executor: launches exactly one Cloud Run Job execution for a deploy run.
+ * It passes only routing metadata through execution overrides. The builder claims all sensitive
+ * credentials from the service after startup, authenticated as its runtime service account.
+ */
+export declare class CloudRunJobExecutor implements DeployRunExecutor {
+    #private;
+    constructor(options: CloudRunJobExecutorOptions);
+    dispatch(input: DeployRunDispatchInput): Promise<void>;
+}
+export declare function cloudRunJobName(options: {
+    readonly project: string;
+    readonly region: string;
+    readonly job: string;
+}): string;
+//# sourceMappingURL=cloud-run-job-executor.d.ts.map

package/node_modules/@noodle-borg/service/dist/github/cloud-run-job-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-run-job-executor.d.ts","sourceRoot":"","sources":["../../src/github/cloud-run-job-executor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE1F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,SAAS,EAAE;YAClB,QAAQ,CAAC,kBAAkB,EAAE,SAAS;gBACpC;oBACE,QAAQ,CAAC,GAAG,EAAE,SAAS;wBAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;wBAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;qBAAE,EAAE,CAAC;iBAC5E;aACF,CAAC;YACF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;YAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;SAC1B,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,iBAAiB;;gBAM/C,OAAO,EAAE,0BAA0B;IAOzC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;CAuB7D;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAET"}

package/node_modules/@noodle-borg/service/dist/github/cloud-run-job-executor.js

@@ -0,0 +1,60 @@
+import { GoogleAuth } from 'google-auth-library';
+/**
+ * Production GHD-C3 executor: launches exactly one Cloud Run Job execution for a deploy run.
+ * It passes only routing metadata through execution overrides. The builder claims all sensitive
+ * credentials from the service after startup, authenticated as its runtime service account.
+ */
+export class CloudRunJobExecutor {
+    #name;
+    #environment;
+    #taskTimeoutSeconds;
+    #client;
+    constructor(options) {
+        this.#name = cloudRunJobName(options);
+        this.#environment = options.environment;
+        this.#taskTimeoutSeconds = options.taskTimeoutSeconds ?? 180;
+        this.#client = options.client ?? new GoogleCloudRunJobsRunClient();
+    }
+    async dispatch(input) {
+        const body = {
+            overrides: {
+                containerOverrides: [
+                    {
+                        env: [
+                            { name: 'NOODLE_GHD_RUN_ID', value: input.run.runId },
+                            { name: 'NOODLE_GHD_SERVICE_BASE_URL', value: input.serviceBaseUrl },
+                            { name: 'NOODLE_GHD_ENVIRONMENT', value: this.#environment },
+                        ],
+                    },
+                ],
+                taskCount: 1,
+                timeout: `${this.#taskTimeoutSeconds}s`,
+            },
+        };
+        try {
+            await this.#client.runJob({ name: this.#name, body });
+        }
+        catch {
+            // Fire-and-forget contract: dispatch launch failures must not make webhook delivery fail.
+            // The sweeper/reconciler owns retry/failover behavior.
+        }
+    }
+}
+export function cloudRunJobName(options) {
+    return `projects/${options.project}/locations/${options.region}/jobs/${options.job}`;
+}
+class GoogleCloudRunJobsRunClient {
+    #auth = new GoogleAuth({
+        scopes: ['https://www.googleapis.com/auth/cloud-platform'],
+    });
+    async runJob(request) {
+        const client = await this.#auth.getClient();
+        const url = `https://run.googleapis.com/v2/${request.name}:run`;
+        await client.request({
+            url,
+            method: 'POST',
+            data: request.body,
+        });
+    }
+}
+//# sourceMappingURL=cloud-run-job-executor.js.map

package/node_modules/@noodle-borg/service/dist/github/cloud-run-job-executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-run-job-executor.js","sourceRoot":"","sources":["../../src/github/cloud-run-job-executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AA+BjD;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IACrB,KAAK,CAAS;IACd,YAAY,CAAS;IACrB,mBAAmB,CAAS;IAC5B,OAAO,CAAwB;IAExC,YAAY,OAAmC;QAC7C,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,IAAI,GAAG,CAAC;QAC7D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,2BAA2B,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAA6B;QAC1C,MAAM,IAAI,GAAmC;YAC3C,SAAS,EAAE;gBACT,kBAAkB,EAAE;oBAClB;wBACE,GAAG,EAAE;4BACH,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE;4BACrD,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE;4BACpE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE;yBAC7D;qBACF;iBACF;gBACD,SAAS,EAAE,CAAC;gBACZ,OAAO,EAAE,GAAG,IAAI,CAAC,mBAAmB,GAAG;aACxC;SACF,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,0FAA0F;YAC1F,uDAAuD;QACzD,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,eAAe,CAAC,OAI/B;IACC,OAAO,YAAY,OAAO,CAAC,OAAO,cAAc,OAAO,CAAC,MAAM,SAAS,OAAO,CAAC,GAAG,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,2BAA2B;IACtB,KAAK,GAAG,IAAI,UAAU,CAAC;QAC9B,MAAM,EAAE,CAAC,gDAAgD,CAAC;KAC3D,CAAC,CAAC;IAEH,KAAK,CAAC,MAAM,CAAC,OAA+B;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,iCAAiC,OAAO,CAAC,IAAI,MAAM,CAAC;QAChE,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG;YACH,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;IACL,CAAC;CACF"}

package/node_modules/@noodle-borg/service/dist/github/deploy-pipeline.d.ts

@@ -0,0 +1,64 @@
+import type { PreparedPackagedAsset } from '@noodle-borg/compiler';
+import type { DeployRunRecord } from '../store.js';
+/**
+ * The environment-agnostic untrusted-compile → trusted-deploy pipeline (GHD-3, ADR 0132 Decision 6).
+ * Every executor — LocalProcess (C2), CloudRunJob (C3), the E2E harness — shares THIS orchestration;
+ * only the injected `compile` (how source becomes a manifest) and `httpFetch` (the wire) differ.
+ *
+ * The trust split is structural: `compile` runs untrusted source and is NEVER handed the run token or
+ * any privileged credential — it only reads files and returns data. Only after it succeeds does the
+ * pipeline use the run-scoped token to preflight/upload assets and POST the deploy.
+ *
+ * Debuggability is the organizing principle (the founder directive): the pipeline walks the run
+ * `building → deploying → deployed`, and EVERY failure path reports `failed` with a pre-redacted
+ * `errorSummary` that names the stage, the reason, and (via the route's own message) the fix — the
+ * exact text `noodle github runs <id>` surfaces. Status reporting is best-effort: a dropped status
+ * report is observability loss, never a reason to fail a deploy that otherwise succeeded.
+ */
+/**
+ * One asset the worker must upload: its preflight metadata plus the bytes to PUT. `prepared` is the
+ * wire shape (no `absolutePath` — that stays in the sandbox; only the compile step reads bytes from it).
+ */
+export interface PipelineAsset {
+    readonly prepared: Omit<PreparedPackagedAsset, 'absolutePath'>;
+    readonly bytes: Uint8Array;
+}
+/** What the untrusted compile stage produces — everything the trusted deploy needs, nothing more. */
+export interface CompiledDeployInput {
+    readonly manifest: string;
+    readonly connectors?: string;
+    readonly serverVersion?: string;
+    /** Declared access mode from committed `noodle.json`; the deploy route resolves inherit → declared. */
+    readonly declaredAccessMode?: string;
+    readonly assets?: readonly PipelineAsset[];
+}
+export type CompileStageResult = {
+    readonly ok: true;
+    readonly input: CompiledDeployInput;
+} | {
+    readonly ok: false;
+    readonly errorSummary: string;
+};
+export type DeployStage = 'compile' | 'preflight' | 'upload' | 'deploy';
+export type DeployPipelineOutcome = {
+    readonly status: 'deployed';
+    readonly deploymentId: string;
+} | {
+    readonly status: 'superseded';
+} | {
+    readonly status: 'failed';
+    readonly stage: DeployStage;
+    readonly errorSummary: string;
+};
+export interface DeployPipelineDeps {
+    readonly run: DeployRunRecord;
+    /** Run-scoped credential for the status + preflight + deploy calls (never handed to `compile`). */
+    readonly runToken: string;
+    readonly serviceBaseUrl: string;
+    /** Untrusted compile — reads source, returns data; MUST NOT receive the run token. */
+    readonly compile: (run: DeployRunRecord) => Promise<CompileStageResult>;
+    /** Injected so tests use a fake and executors use global `fetch`. */
+    readonly httpFetch: typeof fetch;
+}
+export declare function runDeployPipeline(deps: DeployPipelineDeps): Promise<DeployPipelineOutcome>;
+//# sourceMappingURL=deploy-pipeline.d.ts.map

package/node_modules/@noodle-borg/service/dist/github/deploy-pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-pipeline.d.ts","sourceRoot":"","sources":["../../src/github/deploy-pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAuB,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;;;;;;;;;;;GAcG;AAEH;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,qGAAqG;AACrG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,uGAAuG;IACvG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CAC5C;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExE,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;IAC9B,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,sFAAsF;IACtF,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACxE,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,OAAO,KAAK,CAAC;CAClC;AA0BD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA0HhG"}

package/node_modules/@noodle-borg/service/dist/github/deploy-pipeline.js

@@ -0,0 +1,121 @@
+const trimTrailingSlash = (url) => url.replace(/\/+$/, '');
+/** Build a redacted one-line summary from a route's own (secret-free) `{ error, code }` body. */
+async function summarizeHttpFailure(stage, res) {
+    let code;
+    let message;
+    try {
+        const body = (await res.json());
+        if (typeof body.code === 'string')
+            code = body.code;
+        if (typeof body.error === 'string')
+            message = body.error;
+    }
+    catch {
+        // A non-JSON error body carries no structured reason; the status code still localizes the failure.
+    }
+    return {
+        summary: `${stage} failed (HTTP ${res.status}${code !== undefined ? `, ${code}` : ''})${message !== undefined ? `: ${message}` : ''}`,
+        ...(code !== undefined ? { code } : {}),
+    };
+}
+export async function runDeployPipeline(deps) {
+    const { run, runToken, compile, httpFetch } = deps;
+    const baseUrl = trimTrailingSlash(deps.serviceBaseUrl);
+    const statusUrl = `${baseUrl}/v1/github/runs/${encodeURIComponent(run.runId)}/status`;
+    const tenantBase = `${baseUrl}/v1/orgs/${encodeURIComponent(run.orgSlug)}/apps/${encodeURIComponent(run.appSlug)}/envs/${encodeURIComponent(run.envName)}`;
+    const report = async (to, patch) => {
+        try {
+            await httpFetch(statusUrl, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json', authorization: `Bearer ${runToken}` },
+                body: JSON.stringify({ to, ...patch }),
+            });
+        }
+        catch {
+            // Best-effort: a failed status report is observability loss, not a deploy failure.
+        }
+    };
+    const fail = async (stage, errorSummary) => {
+        await report('failed', { errorSummary });
+        return { status: 'failed', stage, errorSummary };
+    };
+    let stage = 'compile';
+    try {
+        await report('building');
+        const compiled = await compile(run);
+        if (!compiled.ok)
+            return await fail('compile', compiled.errorSummary);
+        await report('deploying');
+        let hostedAssets;
+        const assets = compiled.input.assets ?? [];
+        if (assets.length > 0) {
+            stage = 'preflight';
+            const preflightRes = await httpFetch(`${tenantBase}/assets/preflight`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json', 'x-noodle-run-token': runToken },
+                body: JSON.stringify({ assets: assets.map((asset) => asset.prepared) }),
+            });
+            if (!preflightRes.ok) {
+                const failure = await summarizeHttpFailure('asset preflight', preflightRes);
+                return await fail('preflight', failure.summary);
+            }
+            const plan = (await preflightRes.json());
+            stage = 'upload';
+            for (const upload of plan.uploads ?? []) {
+                const asset = assets.find((candidate) => candidate.prepared.logicalId === upload.logicalId);
+                if (asset === undefined) {
+                    return await fail('upload', `upload: preflight planned an unknown asset "${upload.logicalId}"`);
+                }
+                const putRes = await httpFetch(upload.uploadUrl, {
+                    method: upload.method,
+                    headers: upload.headers,
+                    body: asset.bytes,
+                });
+                if (!putRes.ok) {
+                    return await fail('upload', `upload: asset "${upload.logicalId}" PUT failed (HTTP ${putRes.status})`);
+                }
+            }
+            hostedAssets = plan.assets;
+        }
+        stage = 'deploy';
+        const deployRes = await httpFetch(`${tenantBase}/deploy`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', 'x-noodle-run-token': runToken },
+            body: JSON.stringify({
+                manifest: compiled.input.manifest,
+                ...(compiled.input.connectors !== undefined
+                    ? { connectors: compiled.input.connectors }
+                    : {}),
+                ...(compiled.input.serverVersion !== undefined
+                    ? { serverVersion: compiled.input.serverVersion }
+                    : {}),
+                ...(compiled.input.declaredAccessMode !== undefined
+                    ? { accessMode: compiled.input.declaredAccessMode }
+                    : {}),
+                ...(hostedAssets !== undefined ? { hostedAssets } : {}),
+            }),
+        });
+        if (!deployRes.ok) {
+            const failure = await summarizeHttpFailure('deploy', deployRes);
+            if (failure.code === 'run_superseded') {
+                await report('superseded');
+                return { status: 'superseded' };
+            }
+            return await fail('deploy', failure.summary);
+        }
+        const deployed = (await deployRes.json());
+        if (typeof deployed.deploymentId !== 'string') {
+            return await fail('deploy', 'deploy: service returned no deploymentId');
+        }
+        await report('deployed', { deploymentId: deployed.deploymentId });
+        return { status: 'deployed', deploymentId: deployed.deploymentId };
+    }
+    catch (error) {
+        // An unexpected throw (network fault, etc.) still lands the run in `failed` with a redacted,
+        // stage-tagged summary — never a silent hang. Only the error's name is included; never a message
+        // that could carry a URL, token, or body.
+        const name = error instanceof Error ? error.name : 'Error';
+        return await fail(stage, `${stage}: unexpected error (${name})`);
+    }
+}
+//# sourceMappingURL=deploy-pipeline.js.map

package/node_modules/@noodle-borg/service/dist/github/deploy-pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-pipeline.js","sourceRoot":"","sources":["../../src/github/deploy-pipeline.ts"],"names":[],"mappings":"AA4DA,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE3E,iGAAiG;AACjG,KAAK,UAAU,oBAAoB,CACjC,KAAa,EACb,GAAa;IAEb,IAAI,IAAwB,CAAC;IAC7B,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwC,CAAC;QACvE,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACpD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,mGAAmG;IACrG,CAAC;IACD,OAAO;QACL,OAAO,EAAE,GAAG,KAAK,iBAAiB,GAAG,CAAC,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAClF,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAC3C,EAAE;QACF,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAwB;IAC9D,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,GAAG,OAAO,mBAAmB,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;IACtF,MAAM,UAAU,GAAG,GAAG,OAAO,YAAY,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,kBAAkB,CACjG,GAAG,CAAC,OAAO,CACZ,SAAS,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;IAE5C,MAAM,MAAM,GAAG,KAAK,EAClB,EAAmE,EACnE,KAA0E,EAC3D,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,SAAS,EAAE;gBACzB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,QAAQ,EAAE,EAAE;gBACpF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC;aACvC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,mFAAmF;QACrF,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,EAAE,KAAkB,EAAE,YAAoB,EAAkC,EAAE;QAC9F,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QACzC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACnD,CAAC,CAAC;IAEF,IAAI,KAAK,GAAgB,SAAS,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,MAAM,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;QAEtE,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAE1B,IAAI,YAAwD,CAAC;QAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;QAC3C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,KAAK,GAAG,WAAW,CAAC;YACpB,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,GAAG,UAAU,mBAAmB,EAAE;gBACrE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,QAAQ,EAAE;gBAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;aACxE,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;gBACrB,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAC5E,OAAO,MAAM,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAQtC,CAAC;YACF,KAAK,GAAG,QAAQ,CAAC;YACjB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC5F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,OAAO,MAAM,IAAI,CACf,QAAQ,EACR,+CAA+C,MAAM,CAAC,SAAS,GAAG,CACnE,CAAC;gBACJ,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE;oBAC/C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,IAAI,EAAE,KAAK,CAAC,KAAK;iBAClB,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,OAAO,MAAM,IAAI,CACf,QAAQ,EACR,kBAAkB,MAAM,CAAC,SAAS,sBAAsB,MAAM,CAAC,MAAM,GAAG,CACzE,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7B,CAAC;QAED,KAAK,GAAG,QAAQ,CAAC;QACjB,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,GAAG,UAAU,SAAS,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,QAAQ,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ;gBACjC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;oBACzC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE;oBAC3C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS;oBAC5C,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa,EAAE;oBACjD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS;oBACjD,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,kBAAkB,EAAE;oBACnD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAChE,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACtC,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;gBAC3B,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YAClC,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAA+B,CAAC;QACxE,IAAI,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,MAAM,IAAI,CAAC,QAAQ,EAAE,0CAA0C,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,CAAC,UAAU,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,6FAA6F;QAC7F,iGAAiG;QACjG,0CAA0C;QAC1C,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3D,OAAO,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,KAAK,uBAAuB,IAAI,GAAG,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}

package/node_modules/@noodle-borg/service/dist/github/deploy-run-executor.d.ts

@@ -0,0 +1,33 @@
+import type { DeployRunRecord } from '../store.js';
+/**
+ * The isolation seam for GHD-3 (ADR 0132 Decision 6). The dispatcher hands an accepted, non-blocked
+ * run to an executor; the executor runs the untrusted-compile → trusted-deploy pipeline somewhere
+ * isolated and reports progress back through `POST /v1/github/runs/{runId}/status` using the
+ * `runToken`. The executor is the ONLY thing that varies by environment:
+ *
+ * - `CloudRunJobExecutor` (C3, production) — triggers one Cloud Run Job execution per run.
+ * - `LocalProcessExecutor` (C2, dev/self-host/E2E) — runs the pipeline as a local child process.
+ * - {@link FakeDeployRunExecutor} (tests) — records dispatches, runs nothing.
+ *
+ * `dispatch` is fire-and-forget from the caller's view (the webhook must answer GitHub immediately);
+ * it resolves once the execution is *launched*, not *finished*. It must never throw into the request
+ * path — an executor that can't launch records the failure out-of-band and the sweeper retries.
+ */
+export interface DeployRunDispatchInput {
+    readonly run: DeployRunRecord;
+    /** Run-scoped credential the executor uses to report status + deploy (never the sandbox's). */
+    readonly runToken: string;
+    /** Base URL the executor calls back to (the status/deploy routes). */
+    readonly serviceBaseUrl: string;
+}
+export interface DeployRunExecutor {
+    dispatch(input: DeployRunDispatchInput): Promise<void>;
+}
+/** Test double: captures every dispatch, launches nothing. */
+export declare class FakeDeployRunExecutor implements DeployRunExecutor {
+    #private;
+    readonly dispatches: DeployRunDispatchInput[];
+    constructor(onDispatch?: (input: DeployRunDispatchInput) => void | Promise<void>);
+    dispatch(input: DeployRunDispatchInput): Promise<void>;
+}
+//# sourceMappingURL=deploy-run-executor.d.ts.map

package/node_modules/@noodle-borg/service/dist/github/deploy-run-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-run-executor.d.ts","sourceRoot":"","sources":["../../src/github/deploy-run-executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;IAC9B,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED,8DAA8D;AAC9D,qBAAa,qBAAsB,YAAW,iBAAiB;;IAC7D,QAAQ,CAAC,UAAU,EAAE,sBAAsB,EAAE,CAAM;gBAIvC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1E,QAAQ,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;CAI7D"}

package/node_modules/@noodle-borg/service/dist/github/deploy-run-executor.js

@@ -0,0 +1,14 @@
+/** Test double: captures every dispatch, launches nothing. */
+export class FakeDeployRunExecutor {
+    dispatches = [];
+    /** Optional hook so a test can assert the token/base or simulate a launch failure. */
+    #onDispatch;
+    constructor(onDispatch) {
+        this.#onDispatch = onDispatch;
+    }
+    async dispatch(input) {
+        this.dispatches.push(input);
+        await this.#onDispatch?.(input);
+    }
+}
+//# sourceMappingURL=deploy-run-executor.js.map

package/node_modules/@noodle-borg/service/dist/github/deploy-run-executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-run-executor.js","sourceRoot":"","sources":["../../src/github/deploy-run-executor.ts"],"names":[],"mappings":"AA4BA,8DAA8D;AAC9D,MAAM,OAAO,qBAAqB;IACvB,UAAU,GAA6B,EAAE,CAAC;IACnD,sFAAsF;IAC7E,WAAW,CAAwE;IAE5F,YAAY,UAAoE;QAC9E,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAA6B;QAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;CACF"}

package/node_modules/@noodle-borg/service/dist/github/deploy-run-reconciler.d.ts

@@ -0,0 +1,36 @@
+import { type Logger } from '@noodle-borg/transport-http';
+import type { GithubConnectionStore, GithubDeployRunStore } from '../store.js';
+import type { DeployRunExecutor } from './deploy-run-executor.js';
+export declare const GITHUB_RUN_RECONCILE_INTERVAL_MS = 60000;
+export declare const GITHUB_RUN_TIMEOUT_MS = 180000;
+export declare const GITHUB_RUN_QUEUED_REDISPATCH_GRACE_MS = 30000;
+export interface GithubDeployRunReconcilerOptions {
+    readonly runStore: GithubDeployRunStore;
+    readonly connectionStore: GithubConnectionStore;
+    readonly executor: DeployRunExecutor;
+    readonly webhookSecret: string;
+    readonly serviceBaseUrl: string;
+    readonly clock?: () => Date;
+    readonly logger?: Logger;
+    readonly intervalMs?: number;
+    readonly runTimeoutMs?: number;
+    readonly queuedRedispatchGraceMs?: number;
+    readonly limitPerConnection?: number;
+}
+export interface GithubDeployRunReconcileResult {
+    readonly connections: number;
+    readonly inspected: number;
+    readonly dispatched: number;
+    readonly failed: number;
+}
+/**
+ * Idempotent GitHub deploy-run reconciler. Webhook dispatch is intentionally fire-and-forget; this
+ * loop is the recovery path for missed Cloud Run Job launches and abandoned in-flight runs.
+ */
+export declare class GithubDeployRunReconciler {
+    #private;
+    constructor(options: GithubDeployRunReconcilerOptions);
+    maybeSweep(): void;
+    sweepNow(): Promise<GithubDeployRunReconcileResult>;
+}
+//# sourceMappingURL=deploy-run-reconciler.d.ts.map

package/node_modules/@noodle-borg/service/dist/github/deploy-run-reconciler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-run-reconciler.d.ts","sourceRoot":"","sources":["../../src/github/deploy-run-reconciler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAc,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAmB,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAIlE,eAAO,MAAM,gCAAgC,QAAS,CAAC;AACvD,eAAO,MAAM,qBAAqB,SAAU,CAAC;AAC7C,eAAO,MAAM,qCAAqC,QAAS,CAAC;AAE5D,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,qBAAqB,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,qBAAa,yBAAyB;;gBAexB,OAAO,EAAE,gCAAgC;IAerD,UAAU,IAAI,IAAI;IAcZ,QAAQ,IAAI,OAAO,CAAC,8BAA8B,CAAC;CA6D1D"}

package/node_modules/@noodle-borg/service/dist/github/deploy-run-reconciler.js

@@ -0,0 +1,107 @@
+import { noopLogger } from '@noodle-borg/transport-http';
+import { resolveGithubStateSecret } from './install-nonce.js';
+import { signRunToken } from './run-token.js';
+export const GITHUB_RUN_RECONCILE_INTERVAL_MS = 60_000;
+export const GITHUB_RUN_TIMEOUT_MS = 180_000;
+export const GITHUB_RUN_QUEUED_REDISPATCH_GRACE_MS = 30_000;
+/**
+ * Idempotent GitHub deploy-run reconciler. Webhook dispatch is intentionally fire-and-forget; this
+ * loop is the recovery path for missed Cloud Run Job launches and abandoned in-flight runs.
+ */
+export class GithubDeployRunReconciler {
+    #runStore;
+    #connectionStore;
+    #executor;
+    #webhookSecret;
+    #serviceBaseUrl;
+    #clock;
+    #logger;
+    #intervalMs;
+    #runTimeoutMs;
+    #queuedRedispatchGraceMs;
+    #limitPerConnection;
+    #lastSweepStartedAt = Number.NEGATIVE_INFINITY;
+    #inFlight = false;
+    constructor(options) {
+        this.#runStore = options.runStore;
+        this.#connectionStore = options.connectionStore;
+        this.#executor = options.executor;
+        this.#webhookSecret = resolveGithubStateSecret(options.webhookSecret);
+        this.#serviceBaseUrl = options.serviceBaseUrl.replace(/\/+$/, '');
+        this.#clock = options.clock ?? (() => new Date());
+        this.#logger = options.logger ?? noopLogger;
+        this.#intervalMs = options.intervalMs ?? GITHUB_RUN_RECONCILE_INTERVAL_MS;
+        this.#runTimeoutMs = options.runTimeoutMs ?? GITHUB_RUN_TIMEOUT_MS;
+        this.#queuedRedispatchGraceMs =
+            options.queuedRedispatchGraceMs ?? GITHUB_RUN_QUEUED_REDISPATCH_GRACE_MS;
+        this.#limitPerConnection = options.limitPerConnection ?? 50;
+    }
+    maybeSweep() {
+        const now = this.#clock().getTime();
+        if (this.#inFlight || now - this.#lastSweepStartedAt < this.#intervalMs)
+            return;
+        this.#lastSweepStartedAt = now;
+        this.#inFlight = true;
+        void this.sweepNow()
+            .catch(() => {
+            this.#logger.warn('github.run.reconcile_failed', { status: 500 });
+        })
+            .finally(() => {
+            this.#inFlight = false;
+        });
+    }
+    async sweepNow() {
+        const now = this.#clock();
+        const connections = await this.#connectionStore.listRepoConnections();
+        let inspected = 0;
+        let dispatched = 0;
+        let failed = 0;
+        for (const connection of connections) {
+            const result = await this.#runStore.listDeployRuns(connection.orgSlug, connection.appSlug, {
+                limit: this.#limitPerConnection,
+            });
+            for (const run of result.runs) {
+                if (run.githubRepositoryId !== connection.githubRepositoryId)
+                    continue;
+                inspected += 1;
+                if (run.blockedReason !== undefined)
+                    continue;
+                if (run.status === 'queued') {
+                    if (!this.#isOlderThan(run.createdAt, now, this.#queuedRedispatchGraceMs))
+                        continue;
+                    await this.#dispatch(run);
+                    dispatched += 1;
+                    continue;
+                }
+                if ((run.status === 'building' || run.status === 'deploying') &&
+                    this.#isOlderThan(run.startedAt ?? run.createdAt, now, this.#runTimeoutMs)) {
+                    const transition = await this.#runStore.transitionDeployRun(run.orgSlug, run.runId, 'failed', {
+                        errorSummary: `github build worker timed out after ${Math.round(this.#runTimeoutMs / 1000)}s`,
+                    });
+                    if (transition.ok)
+                        failed += 1;
+                }
+            }
+        }
+        return { connections: connections.length, inspected, dispatched, failed };
+    }
+    async #dispatch(run) {
+        const runToken = signRunToken({
+            runId: run.runId,
+            org: run.orgSlug,
+            app: run.appSlug,
+            env: run.envName,
+            issuedAt: this.#clock().getTime(),
+        }, this.#webhookSecret);
+        await this.#executor
+            .dispatch({ run, runToken, serviceBaseUrl: this.#serviceBaseUrl })
+            .catch(() => {
+            this.#logger.warn('github.run.dispatch_failed', { status: 200, runId: run.runId });
+        });
+    }
+    #isOlderThan(iso, now, thresholdMs) {
+        const started = Date.parse(iso);
+        return Number.isFinite(started) && now.getTime() - started >= thresholdMs;
+    }
+}
+//# sourceMappingURL=deploy-run-reconciler.js.map

package/node_modules/@noodle-borg/service/dist/github/deploy-run-reconciler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-run-reconciler.js","sourceRoot":"","sources":["../../src/github/deploy-run-reconciler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAGtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC;AACvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAC7C,MAAM,CAAC,MAAM,qCAAqC,GAAG,MAAM,CAAC;AAuB5D;;;GAGG;AACH,MAAM,OAAO,yBAAyB;IAC3B,SAAS,CAAuB;IAChC,gBAAgB,CAAwB;IACxC,SAAS,CAAoB;IAC7B,cAAc,CAAS;IACvB,eAAe,CAAS;IACxB,MAAM,CAAa;IACnB,OAAO,CAAS;IAChB,WAAW,CAAS;IACpB,aAAa,CAAS;IACtB,wBAAwB,CAAS;IACjC,mBAAmB,CAAS;IACrC,mBAAmB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC/C,SAAS,GAAG,KAAK,CAAC;IAElB,YAAY,OAAyC;QACnD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;QAChD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,cAAc,GAAG,wBAAwB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACtE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,IAAI,gCAAgC,CAAC;QAC1E,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;QACnE,IAAI,CAAC,wBAAwB;YAC3B,OAAO,CAAC,uBAAuB,IAAI,qCAAqC,CAAC;QAC3E,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC9D,CAAC;IAED,UAAU;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG,GAAG,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,WAAW;YAAE,OAAO;QAChF,IAAI,CAAC,mBAAmB,GAAG,GAAG,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,KAAK,IAAI,CAAC,QAAQ,EAAE;aACjB,KAAK,CAAC,GAAG,EAAE;YACV,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACzB,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,CAAC;QACtE,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE;gBACzF,KAAK,EAAE,IAAI,CAAC,mBAAmB;aAChC,CAAC,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC9B,IAAI,GAAG,CAAC,kBAAkB,KAAK,UAAU,CAAC,kBAAkB;oBAAE,SAAS;gBACvE,SAAS,IAAI,CAAC,CAAC;gBACf,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS;oBAAE,SAAS;gBAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC5B,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,wBAAwB,CAAC;wBAAE,SAAS;oBACpF,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBAC1B,UAAU,IAAI,CAAC,CAAC;oBAChB,SAAS;gBACX,CAAC;gBACD,IACE,CAAC,GAAG,CAAC,MAAM,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC;oBACzD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,EAC1E,CAAC;oBACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,mBAAmB,CACzD,GAAG,CAAC,OAAO,EACX,GAAG,CAAC,KAAK,EACT,QAAQ,EACR;wBACE,YAAY,EAAE,uCAAuC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG;qBAC9F,CACF,CAAC;oBACF,IAAI,UAAU,CAAC,EAAE;wBAAE,MAAM,IAAI,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAoB;QAClC,MAAM,QAAQ,GAAG,YAAY,CAC3B;YACE,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,GAAG,EAAE,GAAG,CAAC,OAAO;YAChB,GAAG,EAAE,GAAG,CAAC,OAAO;YAChB,GAAG,EAAE,GAAG,CAAC,OAAO;YAChB,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;SAClC,EACD,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,MAAM,IAAI,CAAC,SAAS;aACjB,QAAQ,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC;aACjE,KAAK,CAAC,GAAG,EAAE;YACV,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;IACP,CAAC;IAED,YAAY,CAAC,GAAW,EAAE,GAAS,EAAE,WAAmB;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,IAAI,WAAW,CAAC;IAC5E,CAAC;CACF"}

package/node_modules/@noodle-borg/service/dist/github/fast-lane-classifier.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Fast-lane eligibility classifier (GHD-3, ADR 0132 Decision 2). A canonical Noodle app imports only
+ * the SDK and local files — nothing to install — so its git deploy is structurally *seconds*. This
+ * gate enforces exactly that BEFORE any user source executes: a repo whose `package.json` declares
+ * third-party dependencies is rejected up front with a structured reason, never compiled. The slow
+ * lane (frozen installs) is a later, separate decision behind the same executor seam.
+ *
+ * Pure over the parsed `package.json` (no fs, no network) so it runs identically in the untrusted
+ * sandbox and in unit tests.
+ */
+/** SDK package names an app may depend on without leaving the fast lane. */
+export declare const FAST_LANE_ALLOWED_DEPENDENCIES: ReadonlySet<string>;
+export type FastLaneClassification = {
+    readonly eligible: true;
+} | {
+    readonly eligible: false;
+    readonly reason: 'unsupported_dependencies';
+    readonly unsupported: readonly string[];
+};
+interface PackageJsonShape {
+    readonly dependencies?: Readonly<Record<string, unknown>>;
+    readonly devDependencies?: Readonly<Record<string, unknown>>;
+}
+/**
+ * Classify a repo from its parsed `package.json` (or `undefined` when the repo has none — a bare
+ * `server.ts` app is fast-lane eligible). Any dependency or devDependency outside the SDK allowlist
+ * makes the repo slow-lane (unsupported in the MVP): the offending names are returned so the failure
+ * can name them.
+ */
+export declare function classifyFastLane(pkg: PackageJsonShape | undefined): FastLaneClassification;
+/**
+ * Parse a raw `package.json` string, then classify. Malformed JSON is treated as "no package.json"
+ * (fast-lane eligible) — the compile step will surface any real problem — rather than failing the
+ * run on a formatting quirk. Callers that need strict parsing should classify the parsed object.
+ */
+export declare function classifyFastLaneFromRaw(raw: string | undefined): FastLaneClassification;
+export {};
+//# sourceMappingURL=fast-lane-classifier.d.ts.map

package/node_modules/@noodle-borg/service/dist/github/fast-lane-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fast-lane-classifier.d.ts","sourceRoot":"","sources":["../../src/github/fast-lane-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,4EAA4E;AAC5E,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CAM7D,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,GAC3B;IACE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC,CAAC;AAEN,UAAU,gBAAgB;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9D;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,SAAS,GAAG,sBAAsB,CAe1F;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,sBAAsB,CAOvF"}

package/node_modules/@noodle-borg/service/dist/github/fast-lane-classifier.js

@@ -0,0 +1,60 @@
+/**
+ * Fast-lane eligibility classifier (GHD-3, ADR 0132 Decision 2). A canonical Noodle app imports only
+ * the SDK and local files — nothing to install — so its git deploy is structurally *seconds*. This
+ * gate enforces exactly that BEFORE any user source executes: a repo whose `package.json` declares
+ * third-party dependencies is rejected up front with a structured reason, never compiled. The slow
+ * lane (frozen installs) is a later, separate decision behind the same executor seam.
+ *
+ * Pure over the parsed `package.json` (no fs, no network) so it runs identically in the untrusted
+ * sandbox and in unit tests.
+ */
+/** SDK package names an app may depend on without leaving the fast lane. */
+export const FAST_LANE_ALLOWED_DEPENDENCIES = new Set([
+    '@noodleseed/one',
+    // The widget runtime the SDK's React surface compiles against — provisioned in the builder image,
+    // never installed from a lockfile.
+    'react',
+    'react-dom',
+]);
+/**
+ * Classify a repo from its parsed `package.json` (or `undefined` when the repo has none — a bare
+ * `server.ts` app is fast-lane eligible). Any dependency or devDependency outside the SDK allowlist
+ * makes the repo slow-lane (unsupported in the MVP): the offending names are returned so the failure
+ * can name them.
+ */
+export function classifyFastLane(pkg) {
+    if (pkg === undefined)
+        return { eligible: true };
+    const names = new Set();
+    for (const record of [pkg.dependencies, pkg.devDependencies]) {
+        if (record === undefined)
+            continue;
+        for (const name of Object.keys(record)) {
+            if (!FAST_LANE_ALLOWED_DEPENDENCIES.has(name))
+                names.add(name);
+        }
+    }
+    if (names.size === 0)
+        return { eligible: true };
+    return {
+        eligible: false,
+        reason: 'unsupported_dependencies',
+        unsupported: [...names].sort(),
+    };
+}
+/**
+ * Parse a raw `package.json` string, then classify. Malformed JSON is treated as "no package.json"
+ * (fast-lane eligible) — the compile step will surface any real problem — rather than failing the
+ * run on a formatting quirk. Callers that need strict parsing should classify the parsed object.
+ */
+export function classifyFastLaneFromRaw(raw) {
+    if (raw === undefined)
+        return { eligible: true };
+    try {
+        return classifyFastLane(JSON.parse(raw));
+    }
+    catch {
+        return { eligible: true };
+    }
+}
+//# sourceMappingURL=fast-lane-classifier.js.map

package/node_modules/@noodle-borg/service/dist/github/fast-lane-classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fast-lane-classifier.js","sourceRoot":"","sources":["../../src/github/fast-lane-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC;IACzE,iBAAiB;IACjB,kGAAkG;IAClG,mCAAmC;IACnC,OAAO;IACP,WAAW;CACZ,CAAC,CAAC;AAeH;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAiC;IAChE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QAC7D,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAChD,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,0BAA0B;QAClC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE;KAC/B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAuB;IAC7D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC"}