@noodleseed/one 0.23.0 → 0.24.0

package/node_modules/@noodle-borg/service/dist/github/deploy-run-reconciler.js

@@ -0,0 +1,107 @@
+import { noopLogger } from '@noodle-borg/transport-http';
+import { resolveGithubStateSecret } from './install-nonce.js';
+import { signRunToken } from './run-token.js';
+export const GITHUB_RUN_RECONCILE_INTERVAL_MS = 60_000;
+export const GITHUB_RUN_TIMEOUT_MS = 180_000;
+export const GITHUB_RUN_QUEUED_REDISPATCH_GRACE_MS = 30_000;
+/**
+ * Idempotent GitHub deploy-run reconciler. Webhook dispatch is intentionally fire-and-forget; this
+ * loop is the recovery path for missed Cloud Run Job launches and abandoned in-flight runs.
+ */
+export class GithubDeployRunReconciler {
+    #runStore;
+    #connectionStore;
+    #executor;
+    #webhookSecret;
+    #serviceBaseUrl;
+    #clock;
+    #logger;
+    #intervalMs;
+    #runTimeoutMs;
+    #queuedRedispatchGraceMs;
+    #limitPerConnection;
+    #lastSweepStartedAt = Number.NEGATIVE_INFINITY;
+    #inFlight = false;
+    constructor(options) {
+        this.#runStore = options.runStore;
+        this.#connectionStore = options.connectionStore;
+        this.#executor = options.executor;
+        this.#webhookSecret = resolveGithubStateSecret(options.webhookSecret);
+        this.#serviceBaseUrl = options.serviceBaseUrl.replace(/\/+$/, '');
+        this.#clock = options.clock ?? (() => new Date());
+        this.#logger = options.logger ?? noopLogger;
+        this.#intervalMs = options.intervalMs ?? GITHUB_RUN_RECONCILE_INTERVAL_MS;
+        this.#runTimeoutMs = options.runTimeoutMs ?? GITHUB_RUN_TIMEOUT_MS;
+        this.#queuedRedispatchGraceMs =
+            options.queuedRedispatchGraceMs ?? GITHUB_RUN_QUEUED_REDISPATCH_GRACE_MS;
+        this.#limitPerConnection = options.limitPerConnection ?? 50;
+    }
+    maybeSweep() {
+        const now = this.#clock().getTime();
+        if (this.#inFlight || now - this.#lastSweepStartedAt < this.#intervalMs)
+            return;
+        this.#lastSweepStartedAt = now;
+        this.#inFlight = true;
+        void this.sweepNow()
+            .catch(() => {
+            this.#logger.warn('github.run.reconcile_failed', { status: 500 });
+        })
+            .finally(() => {
+            this.#inFlight = false;
+        });
+    }
+    async sweepNow() {
+        const now = this.#clock();
+        const connections = await this.#connectionStore.listRepoConnections();
+        let inspected = 0;
+        let dispatched = 0;
+        let failed = 0;
+        for (const connection of connections) {
+            const result = await this.#runStore.listDeployRuns(connection.orgSlug, connection.appSlug, {
+                limit: this.#limitPerConnection,
+            });
+            for (const run of result.runs) {
+                if (run.githubRepositoryId !== connection.githubRepositoryId)
+                    continue;
+                inspected += 1;
+                if (run.blockedReason !== undefined)
+                    continue;
+                if (run.status === 'queued') {
+                    if (!this.#isOlderThan(run.createdAt, now, this.#queuedRedispatchGraceMs))
+                        continue;
+                    await this.#dispatch(run);
+                    dispatched += 1;
+                    continue;
+                }
+                if ((run.status === 'building' || run.status === 'deploying') &&
+                    this.#isOlderThan(run.startedAt ?? run.createdAt, now, this.#runTimeoutMs)) {
+                    const transition = await this.#runStore.transitionDeployRun(run.orgSlug, run.runId, 'failed', {
+                        errorSummary: `github build worker timed out after ${Math.round(this.#runTimeoutMs / 1000)}s`,
+                    });
+                    if (transition.ok)
+                        failed += 1;
+                }
+            }
+        }
+        return { connections: connections.length, inspected, dispatched, failed };
+    }
+    async #dispatch(run) {
+        const runToken = signRunToken({
+            runId: run.runId,
+            org: run.orgSlug,
+            app: run.appSlug,
+            env: run.envName,
+            issuedAt: this.#clock().getTime(),
+        }, this.#webhookSecret);
+        await this.#executor
+            .dispatch({ run, runToken, serviceBaseUrl: this.#serviceBaseUrl })
+            .catch(() => {
+            this.#logger.warn('github.run.dispatch_failed', { status: 200, runId: run.runId });
+        });
+    }
+    #isOlderThan(iso, now, thresholdMs) {
+        const started = Date.parse(iso);
+        return Number.isFinite(started) && now.getTime() - started >= thresholdMs;
+    }
+}
+//# sourceMappingURL=deploy-run-reconciler.js.map

package/node_modules/@noodle-borg/service/dist/github/deploy-run-reconciler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-run-reconciler.js","sourceRoot":"","sources":["../../src/github/deploy-run-reconciler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAGtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC;AACvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAC7C,MAAM,CAAC,MAAM,qCAAqC,GAAG,MAAM,CAAC;AAuB5D;;;GAGG;AACH,MAAM,OAAO,yBAAyB;IAC3B,SAAS,CAAuB;IAChC,gBAAgB,CAAwB;IACxC,SAAS,CAAoB;IAC7B,cAAc,CAAS;IACvB,eAAe,CAAS;IACxB,MAAM,CAAa;IACnB,OAAO,CAAS;IAChB,WAAW,CAAS;IACpB,aAAa,CAAS;IACtB,wBAAwB,CAAS;IACjC,mBAAmB,CAAS;IACrC,mBAAmB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC/C,SAAS,GAAG,KAAK,CAAC;IAElB,YAAY,OAAyC;QACnD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;QAChD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,cAAc,GAAG,wBAAwB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACtE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,IAAI,gCAAgC,CAAC;QAC1E,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;QACnE,IAAI,CAAC,wBAAwB;YAC3B,OAAO,CAAC,uBAAuB,IAAI,qCAAqC,CAAC;QAC3E,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC9D,CAAC;IAED,UAAU;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG,GAAG,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,WAAW;YAAE,OAAO;QAChF,IAAI,CAAC,mBAAmB,GAAG,GAAG,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,KAAK,IAAI,CAAC,QAAQ,EAAE;aACjB,KAAK,CAAC,GAAG,EAAE;YACV,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACzB,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,CAAC;QACtE,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE;gBACzF,KAAK,EAAE,IAAI,CAAC,mBAAmB;aAChC,CAAC,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC9B,IAAI,GAAG,CAAC,kBAAkB,KAAK,UAAU,CAAC,kBAAkB;oBAAE,SAAS;gBACvE,SAAS,IAAI,CAAC,CAAC;gBACf,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS;oBAAE,SAAS;gBAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC5B,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,wBAAwB,CAAC;wBAAE,SAAS;oBACpF,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBAC1B,UAAU,IAAI,CAAC,CAAC;oBAChB,SAAS;gBACX,CAAC;gBACD,IACE,CAAC,GAAG,CAAC,MAAM,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC;oBACzD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,EAC1E,CAAC;oBACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,mBAAmB,CACzD,GAAG,CAAC,OAAO,EACX,GAAG,CAAC,KAAK,EACT,QAAQ,EACR;wBACE,YAAY,EAAE,uCAAuC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG;qBAC9F,CACF,CAAC;oBACF,IAAI,UAAU,CAAC,EAAE;wBAAE,MAAM,IAAI,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAoB;QAClC,MAAM,QAAQ,GAAG,YAAY,CAC3B;YACE,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,GAAG,EAAE,GAAG,CAAC,OAAO;YAChB,GAAG,EAAE,GAAG,CAAC,OAAO;YAChB,GAAG,EAAE,GAAG,CAAC,OAAO;YAChB,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;SAClC,EACD,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,MAAM,IAAI,CAAC,SAAS;aACjB,QAAQ,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC;aACjE,KAAK,CAAC,GAAG,EAAE;YACV,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;IACP,CAAC;IAED,YAAY,CAAC,GAAW,EAAE,GAAS,EAAE,WAAmB;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,IAAI,WAAW,CAAC;IAC5E,CAAC;CACF"}

package/node_modules/@noodle-borg/service/dist/github/fast-lane-classifier.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Fast-lane eligibility classifier (GHD-3, ADR 0132 Decision 2). A canonical Noodle app imports only
+ * the SDK and local files — nothing to install — so its git deploy is structurally *seconds*. This
+ * gate enforces exactly that BEFORE any user source executes: a repo whose `package.json` declares
+ * third-party dependencies is rejected up front with a structured reason, never compiled. The slow
+ * lane (frozen installs) is a later, separate decision behind the same executor seam.
+ *
+ * Pure over the parsed `package.json` (no fs, no network) so it runs identically in the untrusted
+ * sandbox and in unit tests.
+ */
+/** SDK package names an app may depend on without leaving the fast lane. */
+export declare const FAST_LANE_ALLOWED_DEPENDENCIES: ReadonlySet<string>;
+export type FastLaneClassification = {
+    readonly eligible: true;
+} | {
+    readonly eligible: false;
+    readonly reason: 'unsupported_dependencies';
+    readonly unsupported: readonly string[];
+};
+interface PackageJsonShape {
+    readonly dependencies?: Readonly<Record<string, unknown>>;
+    readonly devDependencies?: Readonly<Record<string, unknown>>;
+}
+/**
+ * Classify a repo from its parsed `package.json` (or `undefined` when the repo has none — a bare
+ * `server.ts` app is fast-lane eligible). Any dependency or devDependency outside the SDK allowlist
+ * makes the repo slow-lane (unsupported in the MVP): the offending names are returned so the failure
+ * can name them.
+ */
+export declare function classifyFastLane(pkg: PackageJsonShape | undefined): FastLaneClassification;
+/**
+ * Parse a raw `package.json` string, then classify. Malformed JSON is treated as "no package.json"
+ * (fast-lane eligible) — the compile step will surface any real problem — rather than failing the
+ * run on a formatting quirk. Callers that need strict parsing should classify the parsed object.
+ */
+export declare function classifyFastLaneFromRaw(raw: string | undefined): FastLaneClassification;
+export {};
+//# sourceMappingURL=fast-lane-classifier.d.ts.map

package/node_modules/@noodle-borg/service/dist/github/fast-lane-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fast-lane-classifier.d.ts","sourceRoot":"","sources":["../../src/github/fast-lane-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,4EAA4E;AAC5E,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,CAM7D,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,GAC3B;IACE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC,CAAC;AAEN,UAAU,gBAAgB;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9D;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,SAAS,GAAG,sBAAsB,CAe1F;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,sBAAsB,CAOvF"}

package/node_modules/@noodle-borg/service/dist/github/fast-lane-classifier.js

@@ -0,0 +1,60 @@
+/**
+ * Fast-lane eligibility classifier (GHD-3, ADR 0132 Decision 2). A canonical Noodle app imports only
+ * the SDK and local files — nothing to install — so its git deploy is structurally *seconds*. This
+ * gate enforces exactly that BEFORE any user source executes: a repo whose `package.json` declares
+ * third-party dependencies is rejected up front with a structured reason, never compiled. The slow
+ * lane (frozen installs) is a later, separate decision behind the same executor seam.
+ *
+ * Pure over the parsed `package.json` (no fs, no network) so it runs identically in the untrusted
+ * sandbox and in unit tests.
+ */
+/** SDK package names an app may depend on without leaving the fast lane. */
+export const FAST_LANE_ALLOWED_DEPENDENCIES = new Set([
+    '@noodleseed/one',
+    // The widget runtime the SDK's React surface compiles against — provisioned in the builder image,
+    // never installed from a lockfile.
+    'react',
+    'react-dom',
+]);
+/**
+ * Classify a repo from its parsed `package.json` (or `undefined` when the repo has none — a bare
+ * `server.ts` app is fast-lane eligible). Any dependency or devDependency outside the SDK allowlist
+ * makes the repo slow-lane (unsupported in the MVP): the offending names are returned so the failure
+ * can name them.
+ */
+export function classifyFastLane(pkg) {
+    if (pkg === undefined)
+        return { eligible: true };
+    const names = new Set();
+    for (const record of [pkg.dependencies, pkg.devDependencies]) {
+        if (record === undefined)
+            continue;
+        for (const name of Object.keys(record)) {
+            if (!FAST_LANE_ALLOWED_DEPENDENCIES.has(name))
+                names.add(name);
+        }
+    }
+    if (names.size === 0)
+        return { eligible: true };
+    return {
+        eligible: false,
+        reason: 'unsupported_dependencies',
+        unsupported: [...names].sort(),
+    };
+}
+/**
+ * Parse a raw `package.json` string, then classify. Malformed JSON is treated as "no package.json"
+ * (fast-lane eligible) — the compile step will surface any real problem — rather than failing the
+ * run on a formatting quirk. Callers that need strict parsing should classify the parsed object.
+ */
+export function classifyFastLaneFromRaw(raw) {
+    if (raw === undefined)
+        return { eligible: true };
+    try {
+        return classifyFastLane(JSON.parse(raw));
+    }
+    catch {
+        return { eligible: true };
+    }
+}
+//# sourceMappingURL=fast-lane-classifier.js.map

package/node_modules/@noodle-borg/service/dist/github/fast-lane-classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fast-lane-classifier.js","sourceRoot":"","sources":["../../src/github/fast-lane-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC;IACzE,iBAAiB;IACjB,kGAAkG;IAClG,mCAAmC;IACnC,OAAO;IACP,WAAW;CACZ,CAAC,CAAC;AAeH;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAiC;IAChE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QAC7D,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAChD,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,0BAA0B;QAClC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE;KAC/B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAuB;IAC7D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/node_modules/@noodle-borg/service/dist/github/local-compile.d.ts

@@ -0,0 +1,24 @@
+import type { CompileStageResult } from './deploy-pipeline.js';
+/**
+ * The untrusted compile stage for the local/self-host build worker (GHD-3, ADR 0132 Decision 2/5).
+ * It reads a checked-out source directory and returns manifest data — it is NEVER handed the run token
+ * (the pipeline enforces that seam). The manifest emission itself is injected as {@link ManifestExporter}
+ * so the executor can run the real `noodle export manifest` subprocess while unit tests supply a
+ * manifest directly (no binary, no child process). Debuggability: the default exporter runs the exact
+ * command a human debugs with — `noodle export manifest` in the repo.
+ *
+ * Order matters for the fast-lane guarantee: the dependency gate runs BEFORE any source executes, so a
+ * repo with third-party deps is rejected up front with a named reason, never compiled.
+ */
+export type ManifestExporter = (input: {
+    readonly sourceDir: string;
+    readonly entrypoint: string;
+}) => Promise<{
+    readonly manifest: string;
+    readonly connectors?: string;
+}>;
+export interface LocalCompileOptions {
+    readonly exportManifest: ManifestExporter;
+}
+export declare function createLocalCompile(options: LocalCompileOptions): (sourceDir: string) => Promise<CompileStageResult>;
+//# sourceMappingURL=local-compile.d.ts.map

package/node_modules/@noodle-borg/service/dist/github/local-compile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-compile.d.ts","sourceRoot":"","sources":["../../src/github/local-compile.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAiB,MAAM,sBAAsB,CAAC;AAG9E;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,KAAK,OAAO,CAAC;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE3E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC;CAC3C;AA2CD,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,mBAAmB,GAC3B,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAC,CA8DpD"}

package/node_modules/@noodle-borg/service/dist/github/local-compile.js

@@ -0,0 +1,98 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { manifestSchema, prepareLocalAssets } from '@noodle-borg/compiler';
+import { classifyFastLane } from './fast-lane-classifier.js';
+async function readJsonFile(path) {
+    try {
+        return JSON.parse(await readFile(path, 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+function truncate(text, max = 240) {
+    return text.length > max ? `${text.slice(0, max)}…` : text;
+}
+/**
+ * Resolve the manifest's local hosted assets (widget bundles, images) to upload-ready pairs: the wire
+ * metadata (absolutePath stripped) plus the bytes. Reuses the compiler's `prepareLocalAssets` so the
+ * git build worker and the CLI deploy path share one asset contract.
+ */
+async function prepareAssetsForUpload(manifest, rootDir) {
+    let raw;
+    try {
+        raw = JSON.parse(manifest);
+    }
+    catch {
+        return [];
+    }
+    const parsed = manifestSchema.safeParse(raw);
+    if (!parsed.success)
+        return [];
+    const prepared = prepareLocalAssets(parsed.data, { rootDir });
+    if (prepared.errors.length > 0) {
+        throw new Error(prepared.errors.map((error) => error.message).join('; '));
+    }
+    const assets = [];
+    for (const asset of prepared.assets) {
+        const { absolutePath, ...wire } = asset;
+        assets.push({ prepared: wire, bytes: new Uint8Array(await readFile(absolutePath)) });
+    }
+    return assets;
+}
+export function createLocalCompile(options) {
+    return async (sourceDir) => {
+        // 1. Fast-lane dependency gate — reject third-party deps BEFORE running any source.
+        const pkg = await readJsonFile(join(sourceDir, 'package.json'));
+        const classification = classifyFastLane(pkg);
+        if (!classification.eligible) {
+            const noun = classification.unsupported.length === 1 ? 'dependency' : 'dependencies';
+            const list = classification.unsupported.map((name) => `"${name}"`).join(', ');
+            return {
+                ok: false,
+                errorSummary: `compile: unsupported ${noun} ${list} — the git build worker compiles Noodle-native source only (SDK + local files); deploy with the CLI instead`,
+            };
+        }
+        // 2. Entrypoint + declared access mode from committed noodle.json (the "declared" inherit source).
+        const noodleJson = await readJsonFile(join(sourceDir, 'noodle.json'));
+        const entrypoint = typeof noodleJson?.entrypoint === 'string' ? noodleJson.entrypoint : 'server.ts';
+        const declaredAccessMode = typeof noodleJson?.accessMode === 'string' ? noodleJson.accessMode : undefined;
+        // 3. Compile the manifest (untrusted — this runs the app's source).
+        let exported;
+        try {
+            exported = await options.exportManifest({
+                sourceDir,
+                entrypoint: join(sourceDir, entrypoint),
+            });
+        }
+        catch (error) {
+            const name = error instanceof Error ? error.name : 'Error';
+            const message = error instanceof Error ? error.message : '';
+            return {
+                ok: false,
+                errorSummary: `compile: ${entrypoint} failed to compile (${name})${message !== '' ? `: ${truncate(message)}` : ''}`,
+            };
+        }
+        // 4. Prepare local hosted assets for the pipeline to upload.
+        let assets;
+        try {
+            assets = await prepareAssetsForUpload(exported.manifest, sourceDir);
+        }
+        catch (error) {
+            return {
+                ok: false,
+                errorSummary: `compile: hosted asset preparation failed: ${error instanceof Error ? truncate(error.message) : 'unknown error'}`,
+            };
+        }
+        return {
+            ok: true,
+            input: {
+                manifest: exported.manifest,
+                ...(exported.connectors !== undefined ? { connectors: exported.connectors } : {}),
+                ...(declaredAccessMode !== undefined ? { declaredAccessMode } : {}),
+                ...(assets.length > 0 ? { assets } : {}),
+            },
+        };
+    };
+}
+//# sourceMappingURL=local-compile.js.map

package/node_modules/@noodle-borg/service/dist/github/local-compile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-compile.js","sourceRoot":"","sources":["../../src/github/local-compile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAuB7D,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,GAAG,GAAG,GAAG;IACvC,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,sBAAsB,CACnC,QAAgB,EAChB,OAAe;IAEf,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAA4B;IAE5B,OAAO,KAAK,EAAE,SAAS,EAAE,EAAE;QACzB,oFAAoF;QACpF,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;QAChE,MAAM,cAAc,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,cAAc,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC;YACrF,MAAM,IAAI,GAAG,cAAc,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9E,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,YAAY,EAAE,wBAAwB,IAAI,IAAI,IAAI,6GAA6G;aAChK,CAAC;QACJ,CAAC;QAED,mGAAmG;QACnG,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;QACtE,MAAM,UAAU,GACd,OAAO,UAAU,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;QACnF,MAAM,kBAAkB,GACtB,OAAO,UAAU,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QAEjF,oEAAoE;QACpE,IAAI,QAA+C,CAAC;QACpD,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC;gBACtC,SAAS;gBACT,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC;aACxC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,YAAY,EAAE,YAAY,UAAU,uBAAuB,IAAI,IAC7D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAC9C,EAAE;aACH,CAAC;QACJ,CAAC;QAED,6DAA6D;QAC7D,IAAI,MAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,YAAY,EAAE,6CACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,eACrD,EAAE;aACH,CAAC;QACJ,CAAC;QAED,OAAO;YACL,EAAE,EAAE,IAAI;YACR,KAAK,EAAE;gBACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,GAAG,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjF,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/service/dist/github/local-process-executor.d.ts

@@ -0,0 +1,39 @@
+import type { DeployRunRecord } from '../store.js';
+import type { DeployRunDispatchInput, DeployRunExecutor } from './deploy-run-executor.js';
+import { type ManifestExporter } from './local-compile.js';
+/** A checked-out working copy of the run's source, plus an optional cleanup for its temp storage. */
+export interface RepoCheckout {
+    readonly sourceDir: string;
+    readonly cleanup?: () => Promise<void>;
+}
+export interface LocalProcessExecutorDeps {
+    /**
+     * Fetch the run's source into a local directory — a git clone at `commitSha` in prod/self-host, a
+     * fixture directory in tests. This is the deferred credential-broker/git seam; it lives here so the
+     * rest of the pipeline never sees an installation token.
+     */
+    readonly checkout: (run: DeployRunRecord) => Promise<RepoCheckout>;
+    /** How the untrusted source becomes a manifest — the real adapter runs `noodle export manifest`. */
+    readonly exportManifest: ManifestExporter;
+    /** Injected so tests use a fake and prod uses global `fetch`. */
+    readonly httpFetch?: typeof fetch;
+}
+/**
+ * The C2 / self-host / E2E executor (GHD-3, ADR 0132 Decision 6): runs the untrusted-compile →
+ * trusted-deploy pipeline as a local async task. `checkout` (fetch source) and `exportManifest`
+ * (source → manifest) are the only environment-specific seams, and both are folded into the pipeline's
+ * untrusted `compile` closure — so a checkout OR compile failure lands the run at `failed` with a
+ * compile-stage `errorSummary`, never a hang.
+ *
+ * `dispatch` is fire-and-forget: it launches the task and resolves immediately (the webhook must answer
+ * GitHub at once) and never throws into the caller. `settled()` lets tests and graceful shutdown await
+ * the launched work.
+ */
+export declare class LocalProcessExecutor implements DeployRunExecutor {
+    #private;
+    constructor(deps: LocalProcessExecutorDeps);
+    dispatch(input: DeployRunDispatchInput): Promise<void>;
+    /** Await every launched pipeline — for tests and graceful shutdown. */
+    settled(): Promise<void>;
+}
+//# sourceMappingURL=local-process-executor.d.ts.map

package/node_modules/@noodle-borg/service/dist/github/local-process-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-process-executor.d.ts","sourceRoot":"","sources":["../../src/github/local-process-executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGnD,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE/E,qGAAqG;AACrG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IACnE,oGAAoG;IACpG,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CACnC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,oBAAqB,YAAW,iBAAiB;;gBAMhD,IAAI,EAAE,wBAAwB;IAM1C,QAAQ,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtD,uEAAuE;IACjE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAiC/B"}

package/node_modules/@noodle-borg/service/dist/github/local-process-executor.js

@@ -0,0 +1,67 @@
+import { runDeployPipeline } from './deploy-pipeline.js';
+import { createLocalCompile } from './local-compile.js';
+/**
+ * The C2 / self-host / E2E executor (GHD-3, ADR 0132 Decision 6): runs the untrusted-compile →
+ * trusted-deploy pipeline as a local async task. `checkout` (fetch source) and `exportManifest`
+ * (source → manifest) are the only environment-specific seams, and both are folded into the pipeline's
+ * untrusted `compile` closure — so a checkout OR compile failure lands the run at `failed` with a
+ * compile-stage `errorSummary`, never a hang.
+ *
+ * `dispatch` is fire-and-forget: it launches the task and resolves immediately (the webhook must answer
+ * GitHub at once) and never throws into the caller. `settled()` lets tests and graceful shutdown await
+ * the launched work.
+ */
+export class LocalProcessExecutor {
+    #checkout;
+    #localCompile;
+    #httpFetch;
+    #inflight = new Set();
+    constructor(deps) {
+        this.#checkout = deps.checkout;
+        this.#localCompile = createLocalCompile({ exportManifest: deps.exportManifest });
+        this.#httpFetch = deps.httpFetch ?? fetch;
+    }
+    dispatch(input) {
+        const task = this.#run(input);
+        this.#inflight.add(task);
+        void task.finally(() => this.#inflight.delete(task));
+        // Fire-and-forget: resolve once launched, never await the pipeline here.
+        return Promise.resolve();
+    }
+    /** Await every launched pipeline — for tests and graceful shutdown. */
+    async settled() {
+        await Promise.all([...this.#inflight]);
+    }
+    async #run(input) {
+        const compile = async (run) => {
+            let checkout;
+            try {
+                checkout = await this.#checkout(run);
+            }
+            catch (error) {
+                const name = error instanceof Error ? error.name : 'Error';
+                return {
+                    ok: false,
+                    errorSummary: `compile: could not fetch source at ${run.commitSha.slice(0, 7)} (${name})`,
+                };
+            }
+            try {
+                return await this.#localCompile(checkout.sourceDir);
+            }
+            finally {
+                // Best-effort: a cleanup failure (temp-dir hiccup) must never overwrite a successful
+                // compile result — a `finally` throw would discard the returned manifest and fail the run.
+                await checkout.cleanup?.().catch(() => undefined);
+            }
+        };
+        // The pipeline reports every transition + failure over the wire; it does not throw.
+        await runDeployPipeline({
+            run: input.run,
+            runToken: input.runToken,
+            serviceBaseUrl: input.serviceBaseUrl,
+            compile,
+            httpFetch: this.#httpFetch,
+        });
+    }
+}
+//# sourceMappingURL=local-process-executor.js.map

package/node_modules/@noodle-borg/service/dist/github/local-process-executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-process-executor.js","sourceRoot":"","sources":["../../src/github/local-process-executor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EAAE,kBAAkB,EAAyB,MAAM,oBAAoB,CAAC;AAqB/E;;;;;;;;;;GAUG;AACH,MAAM,OAAO,oBAAoB;IACtB,SAAS,CAAuC;IAChD,aAAa,CAAqD;IAClE,UAAU,CAAe;IACzB,SAAS,GAAG,IAAI,GAAG,EAAiB,CAAC;IAE9C,YAAY,IAA8B;QACxC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,aAAa,GAAG,kBAAkB,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC5C,CAAC;IAED,QAAQ,CAAC,KAA6B;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,yEAAyE;QACzE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAA6B;QACtC,MAAM,OAAO,GAAG,KAAK,EAAE,GAAoB,EAA+B,EAAE;YAC1E,IAAI,QAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;gBAC3D,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,YAAY,EAAE,sCAAsC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,GAAG;iBAC1F,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACtD,CAAC;oBAAS,CAAC;gBACT,qFAAqF;gBACrF,2FAA2F;gBAC3F,MAAM,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACpD,CAAC;QACH,CAAC,CAAC;QACF,oFAAoF;QACpF,MAAM,iBAAiB,CAAC;YACtB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,UAAU;SAC3B,CAAC,CAAC;IACL,CAAC;CACF"}

package/node_modules/@noodle-borg/service/dist/github/run-access-mode.d.ts

@@ -0,0 +1,18 @@
+import type { AccessMode } from '@noodle-borg/transport-http';
+export declare function isAccessMode(value: unknown): value is AccessMode;
+export type ResolveRunAccessModeResult = {
+    readonly ok: true;
+    readonly accessMode: AccessMode;
+    readonly source: 'previous' | 'declared';
+} | {
+    readonly ok: false;
+    readonly reason: 'access_mode_required';
+};
+export interface ResolveRunAccessModeInput {
+    /** Access mode of the env's current active deployment, if any (the inherit source). */
+    readonly previousActiveAccessMode?: AccessMode | undefined;
+    /** Access mode declared in committed `noodle.json` or the connection record, if any. */
+    readonly declaredAccessMode?: string | undefined;
+}
+export declare function resolveRunAccessMode(input: ResolveRunAccessModeInput): ResolveRunAccessModeResult;
+//# sourceMappingURL=run-access-mode.d.ts.map

package/node_modules/@noodle-borg/service/dist/github/run-access-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-access-mode.d.ts","sourceRoot":"","sources":["../../src/github/run-access-mode.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAuB9D,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAEhE;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAAA;CAAE,GAChG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAEpE,MAAM,WAAW,yBAAyB;IACxC,uFAAuF;IACvF,QAAQ,CAAC,wBAAwB,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC3D,wFAAwF;IACxF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClD;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,0BAA0B,CAQjG"}

package/node_modules/@noodle-borg/service/dist/github/run-access-mode.js

@@ -0,0 +1,32 @@
+/**
+ * Access-mode resolution for GitHub-run deploys (GHD-3, ADR 0132 Decision 4). Human CLI deploys
+ * default to `owner-only`, bound to the actor's subject — but a GitHub run deploys as automation, so
+ * defaulting there would lock the human owner out of their own endpoint. The resolution is therefore
+ * explicit, never guessed:
+ *
+ *   1. inherit the previous active deployment's access mode for this env, when one exists;
+ *   2. else an `accessMode` explicitly committed in `noodle.json` (or the connection record);
+ *   3. else FAIL structured (`access_mode_required`) — a first-ever git deploy with no declared mode
+ *      must not silently become owner-only.
+ *
+ * Pure over its inputs so the executor can resolve it before touching the deploy route.
+ */
+const ACCESS_MODES = new Set([
+    'owner-only',
+    'org-members',
+    'authenticated',
+    'customers',
+]);
+export function isAccessMode(value) {
+    return typeof value === 'string' && ACCESS_MODES.has(value);
+}
+export function resolveRunAccessMode(input) {
+    if (input.previousActiveAccessMode !== undefined) {
+        return { ok: true, accessMode: input.previousActiveAccessMode, source: 'previous' };
+    }
+    if (isAccessMode(input.declaredAccessMode)) {
+        return { ok: true, accessMode: input.declaredAccessMode, source: 'declared' };
+    }
+    return { ok: false, reason: 'access_mode_required' };
+}
+//# sourceMappingURL=run-access-mode.js.map

package/node_modules/@noodle-borg/service/dist/github/run-access-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-access-mode.js","sourceRoot":"","sources":["../../src/github/run-access-mode.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AAEH,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC;IAChD,YAAY;IACZ,aAAa;IACb,eAAe;IACf,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAaD,MAAM,UAAU,oBAAoB,CAAC,KAAgC;IACnE,IAAI,KAAK,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,wBAAwB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACtF,CAAC;IACD,IAAI,YAAY,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;AACvD,CAAC"}

package/node_modules/@noodle-borg/service/dist/github/run-token.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Run-scoped deploy credential (GHD-3, ADR 0132 Decision 3). Minted by the service when dispatching
+ * a deploy run; carried only by the TRUSTED runner phase — never by the sandboxed process that
+ * executes user source. It authorizes exactly three route surfaces for one `{runId, org, app, env}`:
+ * the run's own status transitions, asset preflight/upload for that tuple, and the final deploy
+ * POST. Verification is route-scoped on those handlers only — this is deliberately NOT a
+ * `DeployAuthGate`, so the token is meaningless on every other route.
+ *
+ * Same HMAC envelope discipline as `install-nonce.ts`: base64url(JSON payload) + hex HMAC-SHA256,
+ * timing-safe compare, hard expiry. Signing secret: `githubApp.webhookSecret` (the one secret the
+ * GHD feature already requires), via the same blank-rejecting resolver.
+ */
+/** Build cap (2 min, ADR 0132 Decision 2) + dispatch/report slack. */
+export declare const RUN_TOKEN_TTL_MS: number;
+export interface RunTokenPayload {
+    readonly runId: string;
+    readonly org: string;
+    readonly app: string;
+    readonly env: string;
+    readonly issuedAt: number;
+}
+export declare function signRunToken(payload: RunTokenPayload, secret: string): string;
+export type RunTokenVerification = {
+    readonly ok: true;
+    readonly payload: RunTokenPayload;
+} | {
+    readonly ok: false;
+    readonly reason: 'malformed' | 'tampered' | 'expired';
+};
+export declare function verifyRunToken(token: string, secret: string, now?: () => Date): RunTokenVerification;
+/**
+ * Route-scope check: does a verified token authorize THIS `{org, app, env}` tuple? Handlers must
+ * call this after `verifyRunToken` — a valid token for another app must read as forbidden, not as a
+ * different identity.
+ */
+export declare function runTokenAuthorizes(payload: RunTokenPayload, target: {
+    readonly org: string;
+    readonly app: string;
+    readonly env: string;
+}): boolean;
+//# sourceMappingURL=run-token.d.ts.map

package/node_modules/@noodle-borg/service/dist/github/run-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-token.d.ts","sourceRoot":"","sources":["../../src/github/run-token.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AAEH,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,QAAgB,CAAC;AAE9C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAI7E;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,UAAU,GAAG,SAAS,CAAA;CAAE,CAAC;AAElF,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,MAAM,IAAuB,GACjC,oBAAoB,CA6BtB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC3E,OAAO,CAET"}