@noodleseed/one 0.23.0 → 0.24.0

package/node_modules/@noodle-borg/service/dist/github/builder-runner.js

@@ -0,0 +1,192 @@
+import { spawn } from 'node:child_process';
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { GoogleAuth } from 'google-auth-library';
+import { runDeployPipeline } from './deploy-pipeline.js';
+import { createLocalCompile } from './local-compile.js';
+const SAFE_ENV_KEYS = new Set(['PATH', 'HOME', 'TMPDIR', 'npm_config_cache', 'NPM_CONFIG_CACHE']);
+export function sanitizeBuilderChildEnv(env) {
+    const clean = {
+        CI: '1',
+        NOODLE_DISABLE_UPDATE_CHECK: '1',
+    };
+    for (const key of SAFE_ENV_KEYS) {
+        const value = env[key];
+        if (value !== undefined && value.length > 0)
+            clean[key] = value;
+    }
+    return clean;
+}
+export async function runCloudRunBuilder(options = {}) {
+    const env = options.env ?? process.env;
+    const stdout = options.stdout ?? process.stdout;
+    const stderr = options.stderr ?? process.stderr;
+    if (env.NOODLE_BUILDER_SELF_TEST === '1') {
+        stdout.write('builder self-test ok\n');
+        return;
+    }
+    const runId = requiredEnv(env, 'NOODLE_GHD_RUN_ID');
+    const serviceBaseUrl = trimTrailingSlash(requiredEnv(env, 'NOODLE_GHD_SERVICE_BASE_URL'));
+    const claim = await claimBuilderRun({
+        runId,
+        serviceBaseUrl,
+        audience: env.NOODLE_GHD_ID_TOKEN_AUDIENCE ?? serviceBaseUrl,
+        httpFetch: options.httpFetch ?? fetch,
+    });
+    const workDir = await mkdtemp(join(tmpdir(), 'noodle-ghd-builder-'));
+    try {
+        const sourceDir = await fetchSource({
+            claim,
+            workDir,
+            httpFetch: options.httpFetch ?? fetch,
+            spawnProcess: options.spawnProcess ?? spawn,
+        });
+        const localCompile = createLocalCompile({
+            exportManifest: createCliManifestExporter({
+                env,
+                spawnProcess: options.spawnProcess ?? spawn,
+                stderr,
+            }),
+        });
+        await runDeployPipeline({
+            run: claim.run,
+            runToken: claim.runToken,
+            serviceBaseUrl,
+            compile: () => localCompile(sourceDir),
+            httpFetch: options.httpFetch ?? fetch,
+        });
+    }
+    finally {
+        await rm(workDir, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+async function claimBuilderRun(input) {
+    const claimUrl = `${input.serviceBaseUrl}/v1/github/runs/${encodeURIComponent(input.runId)}/claim`;
+    if (input.serviceBaseUrl.startsWith('http://127.0.0.1') ||
+        input.serviceBaseUrl.startsWith('http://localhost')) {
+        const res = await input.httpFetch(claimUrl, { method: 'POST' });
+        return parseClaimResponse(res);
+    }
+    const auth = new GoogleAuth();
+    const client = await auth.getIdTokenClient(input.audience);
+    const res = await client.request({ url: claimUrl, method: 'POST' });
+    return parseClaimBody(res.data);
+}
+async function parseClaimResponse(res) {
+    const body = await res.json().catch(() => undefined);
+    if (!res.ok)
+        throw new Error(`builder claim failed (HTTP ${res.status})`);
+    return parseClaimBody(body);
+}
+function parseClaimBody(body) {
+    const data = asRecord(body)?.data;
+    const record = asRecord(data);
+    const runRecord = asRecord(record?.run);
+    if (record === undefined ||
+        typeof record.runToken !== 'string' ||
+        runRecord === undefined ||
+        typeof record.repoFullName !== 'string' ||
+        typeof record.commitSha !== 'string' ||
+        typeof record.githubInstallationToken !== 'string') {
+        throw new Error('builder claim response was malformed');
+    }
+    return {
+        runToken: record.runToken,
+        run: runRecord,
+        repoFullName: record.repoFullName,
+        ...(typeof record.repoRoot === 'string' && record.repoRoot.length > 0
+            ? { repoRoot: record.repoRoot }
+            : {}),
+        commitSha: record.commitSha,
+        githubInstallationToken: record.githubInstallationToken,
+        ...(typeof record.githubInstallationTokenExpiresAt === 'string'
+            ? { githubInstallationTokenExpiresAt: record.githubInstallationTokenExpiresAt }
+            : {}),
+    };
+}
+async function fetchSource(input) {
+    const archiveUrl = `https://api.github.com/repos/${input.claim.repoFullName}/tarball/${input.claim.commitSha}`;
+    const res = await input.httpFetch(archiveUrl, {
+        headers: {
+            accept: 'application/vnd.github+json',
+            authorization: `Bearer ${input.claim.githubInstallationToken}`,
+            'user-agent': 'noodle-seed-builder',
+            'x-github-api-version': '2022-11-28',
+        },
+    });
+    if (!res.ok)
+        throw new Error(`source fetch failed (HTTP ${res.status})`);
+    const archive = join(input.workDir, 'source.tar.gz');
+    await writeFile(archive, new Uint8Array(await res.arrayBuffer()));
+    const checkout = join(input.workDir, 'repo');
+    await mkdir(checkout, { recursive: true });
+    await runProcess(input.spawnProcess, 'tar', ['-xzf', archive, '--strip-components=1', '-C', checkout], { env: {} });
+    return input.claim.repoRoot !== undefined ? resolve(checkout, input.claim.repoRoot) : checkout;
+}
+function createCliManifestExporter(input) {
+    const cliBin = input.env.NOODLE_BUILDER_CLI_BIN ?? '/app/cli/dist/bin.js';
+    return async ({ entrypoint }) => {
+        const dir = await mkdtemp(join(tmpdir(), 'noodle-ghd-export-'));
+        const manifestPath = join(dir, 'manifest.json');
+        const connectorsPath = join(dir, 'connectors.json');
+        try {
+            const result = await runProcess(input.spawnProcess, process.execPath, [
+                cliBin,
+                'export',
+                'manifest',
+                entrypoint,
+                '--output',
+                manifestPath,
+                '--connectors-output',
+                connectorsPath,
+            ], { env: sanitizeBuilderChildEnv(input.env) });
+            if (result.stderr.length > 0)
+                input.stderr.write(result.stderr);
+            const manifest = await readFile(manifestPath, 'utf8');
+            const connectors = await readFile(connectorsPath, 'utf8').catch(() => undefined);
+            return {
+                manifest,
+                ...(connectors !== undefined && connectors.trim() !== '' ? { connectors } : {}),
+            };
+        }
+        finally {
+            await rm(dir, { recursive: true, force: true }).catch(() => undefined);
+        }
+    };
+}
+async function runProcess(spawnProcess, command, args, options) {
+    return new Promise((resolvePromise, reject) => {
+        const child = spawnProcess(command, [...args], {
+            ...options,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        const stdout = [];
+        const stderr = [];
+        child.stdout?.on('data', (chunk) => stdout.push(Buffer.from(chunk)));
+        child.stderr?.on('data', (chunk) => stderr.push(Buffer.from(chunk)));
+        child.on('error', reject);
+        child.on('close', (code) => {
+            const out = Buffer.concat(stdout).toString('utf8');
+            const err = Buffer.concat(stderr).toString('utf8');
+            if (code === 0)
+                return resolvePromise({ stdout: out, stderr: err });
+            reject(new Error(`${command} exited ${code ?? 'without a status'}${err ? `: ${err}` : ''}`));
+        });
+    });
+}
+function requiredEnv(env, name) {
+    const value = env[name];
+    if (value === undefined || value.trim() === '')
+        throw new Error(`${name} is required`);
+    return value;
+}
+function trimTrailingSlash(value) {
+    return value.replace(/\/+$/, '');
+}
+function asRecord(value) {
+    return typeof value === 'object' && value !== null
+        ? value
+        : undefined;
+}
+//# sourceMappingURL=builder-runner.js.map

package/node_modules/@noodle-borg/service/dist/github/builder-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder-runner.js","sourceRoot":"","sources":["../../src/github/builder-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAyB,MAAM,oBAAoB,CAAC;AAoB/E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAElG,MAAM,UAAU,uBAAuB,CAAC,GAAsB;IAC5D,MAAM,KAAK,GAA2B;QACpC,EAAE,EAAE,GAAG;QACP,2BAA2B,EAAE,GAAG;KACjC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAgC,EAAE;IACzE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,IAAI,GAAG,CAAC,wBAAwB,KAAK,GAAG,EAAE,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,iBAAiB,CAAC,WAAW,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC;QAClC,KAAK;QACL,cAAc;QACd,QAAQ,EAAE,GAAG,CAAC,4BAA4B,IAAI,cAAc;QAC5D,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK;KACtC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC;YAClC,KAAK;YACL,OAAO;YACP,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK;YACrC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,KAAK;SAC5C,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,kBAAkB,CAAC;YACtC,cAAc,EAAE,yBAAyB,CAAC;gBACxC,GAAG;gBACH,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,KAAK;gBAC3C,MAAM;aACP,CAAC;SACH,CAAC,CAAC;QACH,MAAM,iBAAiB,CAAC;YACtB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc;YACd,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;YACtC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK;SACtC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAK9B;IACC,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,cAAc,mBAAmB,kBAAkB,CAC3E,KAAK,CAAC,KAAK,CACZ,QAAQ,CAAC;IACV,IACE,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,kBAAkB,CAAC;QACnD,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,kBAAkB,CAAC,EACnD,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7E,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,GAAa;IAC7C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1E,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,cAAc,CAAC,IAAa;IACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxC,IACE,MAAM,KAAK,SAAS;QACpB,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACnC,SAAS,KAAK,SAAS;QACvB,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;QACvC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,OAAO,MAAM,CAAC,uBAAuB,KAAK,QAAQ,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,EAAE,SAAuC;QAC5C,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,GAAG,CAAC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YACnE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;YAC/B,CAAC,CAAC,EAAE,CAAC;QACP,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,GAAG,CAAC,OAAO,MAAM,CAAC,gCAAgC,KAAK,QAAQ;YAC7D,CAAC,CAAC,EAAE,gCAAgC,EAAE,MAAM,CAAC,gCAAgC,EAAE;YAC/E,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAK1B;IACC,MAAM,UAAU,GAAG,gCAAgC,KAAK,CAAC,KAAK,CAAC,YAAY,YAAY,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;IAC/G,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE;QAC5C,OAAO,EAAE;YACP,MAAM,EAAE,6BAA6B;YACrC,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,CAAC,uBAAuB,EAAE;YAC9D,YAAY,EAAE,qBAAqB;YACnC,sBAAsB,EAAE,YAAY;SACrC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACrD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,UAAU,CACd,KAAK,CAAC,YAAY,EAClB,KAAK,EACL,CAAC,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,CAAC,EACzD,EAAE,GAAG,EAAE,EAAE,EAAE,CACZ,CAAC;IACF,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACjG,CAAC;AAED,SAAS,yBAAyB,CAAC,KAIlC;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,sBAAsB,IAAI,sBAAsB,CAAC;IAC1E,OAAO,KAAK,EAAE,EAAE,UAAU,EAAE,EAAgC,EAAE;QAC5D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAChD,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,KAAK,CAAC,YAAY,EAClB,OAAO,CAAC,QAAQ,EAChB;gBACE,MAAM;gBACN,QAAQ;gBACR,UAAU;gBACV,UAAU;gBACV,UAAU;gBACV,YAAY;gBACZ,qBAAqB;gBACrB,cAAc;aACf,EACD,EAAE,GAAG,EAAE,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAC5C,CAAC;YACF,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAChE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACtD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACjF,OAAO;gBACL,QAAQ;gBACR,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChF,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,YAA0B,EAC1B,OAAe,EACf,IAAuB,EACvB,OAAqB;IAErB,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YAC7C,GAAG,OAAO;YACV,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACpE,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,OAAO,WAAW,IAAI,IAAI,kBAAkB,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,GAAsB,EAAE,IAAY;IACvD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAChD,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC"}

package/node_modules/@noodle-borg/service/dist/github/cloud-run-job-executor.d.ts

@@ -0,0 +1,45 @@
+import type { DeployRunDispatchInput, DeployRunExecutor } from './deploy-run-executor.js';
+export interface CloudRunJobsRunRequest {
+    readonly name: string;
+    readonly body: {
+        readonly overrides: {
+            readonly containerOverrides: readonly [
+                {
+                    readonly env: readonly {
+                        readonly name: string;
+                        readonly value: string;
+                    }[];
+                }
+            ];
+            readonly taskCount: number;
+            readonly timeout: string;
+        };
+    };
+}
+export interface CloudRunJobsRunClient {
+    runJob(request: CloudRunJobsRunRequest): Promise<void>;
+}
+export interface CloudRunJobExecutorOptions {
+    readonly project: string;
+    readonly region: string;
+    readonly job: string;
+    readonly environment: string;
+    readonly taskTimeoutSeconds?: number;
+    readonly client?: CloudRunJobsRunClient;
+}
+/**
+ * Production GHD-C3 executor: launches exactly one Cloud Run Job execution for a deploy run.
+ * It passes only routing metadata through execution overrides. The builder claims all sensitive
+ * credentials from the service after startup, authenticated as its runtime service account.
+ */
+export declare class CloudRunJobExecutor implements DeployRunExecutor {
+    #private;
+    constructor(options: CloudRunJobExecutorOptions);
+    dispatch(input: DeployRunDispatchInput): Promise<void>;
+}
+export declare function cloudRunJobName(options: {
+    readonly project: string;
+    readonly region: string;
+    readonly job: string;
+}): string;
+//# sourceMappingURL=cloud-run-job-executor.d.ts.map

package/node_modules/@noodle-borg/service/dist/github/cloud-run-job-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-run-job-executor.d.ts","sourceRoot":"","sources":["../../src/github/cloud-run-job-executor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE1F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,SAAS,EAAE;YAClB,QAAQ,CAAC,kBAAkB,EAAE,SAAS;gBACpC;oBACE,QAAQ,CAAC,GAAG,EAAE,SAAS;wBAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;wBAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;qBAAE,EAAE,CAAC;iBAC5E;aACF,CAAC;YACF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;YAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;SAC1B,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,iBAAiB;;gBAM/C,OAAO,EAAE,0BAA0B;IAOzC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;CAuB7D;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAET"}

package/node_modules/@noodle-borg/service/dist/github/cloud-run-job-executor.js

@@ -0,0 +1,60 @@
+import { GoogleAuth } from 'google-auth-library';
+/**
+ * Production GHD-C3 executor: launches exactly one Cloud Run Job execution for a deploy run.
+ * It passes only routing metadata through execution overrides. The builder claims all sensitive
+ * credentials from the service after startup, authenticated as its runtime service account.
+ */
+export class CloudRunJobExecutor {
+    #name;
+    #environment;
+    #taskTimeoutSeconds;
+    #client;
+    constructor(options) {
+        this.#name = cloudRunJobName(options);
+        this.#environment = options.environment;
+        this.#taskTimeoutSeconds = options.taskTimeoutSeconds ?? 180;
+        this.#client = options.client ?? new GoogleCloudRunJobsRunClient();
+    }
+    async dispatch(input) {
+        const body = {
+            overrides: {
+                containerOverrides: [
+                    {
+                        env: [
+                            { name: 'NOODLE_GHD_RUN_ID', value: input.run.runId },
+                            { name: 'NOODLE_GHD_SERVICE_BASE_URL', value: input.serviceBaseUrl },
+                            { name: 'NOODLE_GHD_ENVIRONMENT', value: this.#environment },
+                        ],
+                    },
+                ],
+                taskCount: 1,
+                timeout: `${this.#taskTimeoutSeconds}s`,
+            },
+        };
+        try {
+            await this.#client.runJob({ name: this.#name, body });
+        }
+        catch {
+            // Fire-and-forget contract: dispatch launch failures must not make webhook delivery fail.
+            // The sweeper/reconciler owns retry/failover behavior.
+        }
+    }
+}
+export function cloudRunJobName(options) {
+    return `projects/${options.project}/locations/${options.region}/jobs/${options.job}`;
+}
+class GoogleCloudRunJobsRunClient {
+    #auth = new GoogleAuth({
+        scopes: ['https://www.googleapis.com/auth/cloud-platform'],
+    });
+    async runJob(request) {
+        const client = await this.#auth.getClient();
+        const url = `https://run.googleapis.com/v2/${request.name}:run`;
+        await client.request({
+            url,
+            method: 'POST',
+            data: request.body,
+        });
+    }
+}
+//# sourceMappingURL=cloud-run-job-executor.js.map

package/node_modules/@noodle-borg/service/dist/github/cloud-run-job-executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-run-job-executor.js","sourceRoot":"","sources":["../../src/github/cloud-run-job-executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AA+BjD;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IACrB,KAAK,CAAS;IACd,YAAY,CAAS;IACrB,mBAAmB,CAAS;IAC5B,OAAO,CAAwB;IAExC,YAAY,OAAmC;QAC7C,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,IAAI,GAAG,CAAC;QAC7D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,2BAA2B,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAA6B;QAC1C,MAAM,IAAI,GAAmC;YAC3C,SAAS,EAAE;gBACT,kBAAkB,EAAE;oBAClB;wBACE,GAAG,EAAE;4BACH,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE;4BACrD,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE;4BACpE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE;yBAC7D;qBACF;iBACF;gBACD,SAAS,EAAE,CAAC;gBACZ,OAAO,EAAE,GAAG,IAAI,CAAC,mBAAmB,GAAG;aACxC;SACF,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,0FAA0F;YAC1F,uDAAuD;QACzD,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,eAAe,CAAC,OAI/B;IACC,OAAO,YAAY,OAAO,CAAC,OAAO,cAAc,OAAO,CAAC,MAAM,SAAS,OAAO,CAAC,GAAG,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,2BAA2B;IACtB,KAAK,GAAG,IAAI,UAAU,CAAC;QAC9B,MAAM,EAAE,CAAC,gDAAgD,CAAC;KAC3D,CAAC,CAAC;IAEH,KAAK,CAAC,MAAM,CAAC,OAA+B;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,iCAAiC,OAAO,CAAC,IAAI,MAAM,CAAC;QAChE,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG;YACH,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;IACL,CAAC;CACF"}

package/node_modules/@noodle-borg/service/dist/github/deploy-pipeline.d.ts

@@ -0,0 +1,64 @@
+import type { PreparedPackagedAsset } from '@noodle-borg/compiler';
+import type { DeployRunRecord } from '../store.js';
+/**
+ * The environment-agnostic untrusted-compile → trusted-deploy pipeline (GHD-3, ADR 0132 Decision 6).
+ * Every executor — LocalProcess (C2), CloudRunJob (C3), the E2E harness — shares THIS orchestration;
+ * only the injected `compile` (how source becomes a manifest) and `httpFetch` (the wire) differ.
+ *
+ * The trust split is structural: `compile` runs untrusted source and is NEVER handed the run token or
+ * any privileged credential — it only reads files and returns data. Only after it succeeds does the
+ * pipeline use the run-scoped token to preflight/upload assets and POST the deploy.
+ *
+ * Debuggability is the organizing principle (the founder directive): the pipeline walks the run
+ * `building → deploying → deployed`, and EVERY failure path reports `failed` with a pre-redacted
+ * `errorSummary` that names the stage, the reason, and (via the route's own message) the fix — the
+ * exact text `noodle github runs <id>` surfaces. Status reporting is best-effort: a dropped status
+ * report is observability loss, never a reason to fail a deploy that otherwise succeeded.
+ */
+/**
+ * One asset the worker must upload: its preflight metadata plus the bytes to PUT. `prepared` is the
+ * wire shape (no `absolutePath` — that stays in the sandbox; only the compile step reads bytes from it).
+ */
+export interface PipelineAsset {
+    readonly prepared: Omit<PreparedPackagedAsset, 'absolutePath'>;
+    readonly bytes: Uint8Array;
+}
+/** What the untrusted compile stage produces — everything the trusted deploy needs, nothing more. */
+export interface CompiledDeployInput {
+    readonly manifest: string;
+    readonly connectors?: string;
+    readonly serverVersion?: string;
+    /** Declared access mode from committed `noodle.json`; the deploy route resolves inherit → declared. */
+    readonly declaredAccessMode?: string;
+    readonly assets?: readonly PipelineAsset[];
+}
+export type CompileStageResult = {
+    readonly ok: true;
+    readonly input: CompiledDeployInput;
+} | {
+    readonly ok: false;
+    readonly errorSummary: string;
+};
+export type DeployStage = 'compile' | 'preflight' | 'upload' | 'deploy';
+export type DeployPipelineOutcome = {
+    readonly status: 'deployed';
+    readonly deploymentId: string;
+} | {
+    readonly status: 'superseded';
+} | {
+    readonly status: 'failed';
+    readonly stage: DeployStage;
+    readonly errorSummary: string;
+};
+export interface DeployPipelineDeps {
+    readonly run: DeployRunRecord;
+    /** Run-scoped credential for the status + preflight + deploy calls (never handed to `compile`). */
+    readonly runToken: string;
+    readonly serviceBaseUrl: string;
+    /** Untrusted compile — reads source, returns data; MUST NOT receive the run token. */
+    readonly compile: (run: DeployRunRecord) => Promise<CompileStageResult>;
+    /** Injected so tests use a fake and executors use global `fetch`. */
+    readonly httpFetch: typeof fetch;
+}
+export declare function runDeployPipeline(deps: DeployPipelineDeps): Promise<DeployPipelineOutcome>;
+//# sourceMappingURL=deploy-pipeline.d.ts.map

package/node_modules/@noodle-borg/service/dist/github/deploy-pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-pipeline.d.ts","sourceRoot":"","sources":["../../src/github/deploy-pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAuB,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;;;;;;;;;;;GAcG;AAEH;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,qGAAqG;AACrG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,uGAAuG;IACvG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CAC5C;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExE,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;IAC9B,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,sFAAsF;IACtF,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACxE,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,OAAO,KAAK,CAAC;CAClC;AA0BD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA0HhG"}

package/node_modules/@noodle-borg/service/dist/github/deploy-pipeline.js

@@ -0,0 +1,121 @@
+const trimTrailingSlash = (url) => url.replace(/\/+$/, '');
+/** Build a redacted one-line summary from a route's own (secret-free) `{ error, code }` body. */
+async function summarizeHttpFailure(stage, res) {
+    let code;
+    let message;
+    try {
+        const body = (await res.json());
+        if (typeof body.code === 'string')
+            code = body.code;
+        if (typeof body.error === 'string')
+            message = body.error;
+    }
+    catch {
+        // A non-JSON error body carries no structured reason; the status code still localizes the failure.
+    }
+    return {
+        summary: `${stage} failed (HTTP ${res.status}${code !== undefined ? `, ${code}` : ''})${message !== undefined ? `: ${message}` : ''}`,
+        ...(code !== undefined ? { code } : {}),
+    };
+}
+export async function runDeployPipeline(deps) {
+    const { run, runToken, compile, httpFetch } = deps;
+    const baseUrl = trimTrailingSlash(deps.serviceBaseUrl);
+    const statusUrl = `${baseUrl}/v1/github/runs/${encodeURIComponent(run.runId)}/status`;
+    const tenantBase = `${baseUrl}/v1/orgs/${encodeURIComponent(run.orgSlug)}/apps/${encodeURIComponent(run.appSlug)}/envs/${encodeURIComponent(run.envName)}`;
+    const report = async (to, patch) => {
+        try {
+            await httpFetch(statusUrl, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json', authorization: `Bearer ${runToken}` },
+                body: JSON.stringify({ to, ...patch }),
+            });
+        }
+        catch {
+            // Best-effort: a failed status report is observability loss, not a deploy failure.
+        }
+    };
+    const fail = async (stage, errorSummary) => {
+        await report('failed', { errorSummary });
+        return { status: 'failed', stage, errorSummary };
+    };
+    let stage = 'compile';
+    try {
+        await report('building');
+        const compiled = await compile(run);
+        if (!compiled.ok)
+            return await fail('compile', compiled.errorSummary);
+        await report('deploying');
+        let hostedAssets;
+        const assets = compiled.input.assets ?? [];
+        if (assets.length > 0) {
+            stage = 'preflight';
+            const preflightRes = await httpFetch(`${tenantBase}/assets/preflight`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json', 'x-noodle-run-token': runToken },
+                body: JSON.stringify({ assets: assets.map((asset) => asset.prepared) }),
+            });
+            if (!preflightRes.ok) {
+                const failure = await summarizeHttpFailure('asset preflight', preflightRes);
+                return await fail('preflight', failure.summary);
+            }
+            const plan = (await preflightRes.json());
+            stage = 'upload';
+            for (const upload of plan.uploads ?? []) {
+                const asset = assets.find((candidate) => candidate.prepared.logicalId === upload.logicalId);
+                if (asset === undefined) {
+                    return await fail('upload', `upload: preflight planned an unknown asset "${upload.logicalId}"`);
+                }
+                const putRes = await httpFetch(upload.uploadUrl, {
+                    method: upload.method,
+                    headers: upload.headers,
+                    body: asset.bytes,
+                });
+                if (!putRes.ok) {
+                    return await fail('upload', `upload: asset "${upload.logicalId}" PUT failed (HTTP ${putRes.status})`);
+                }
+            }
+            hostedAssets = plan.assets;
+        }
+        stage = 'deploy';
+        const deployRes = await httpFetch(`${tenantBase}/deploy`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', 'x-noodle-run-token': runToken },
+            body: JSON.stringify({
+                manifest: compiled.input.manifest,
+                ...(compiled.input.connectors !== undefined
+                    ? { connectors: compiled.input.connectors }
+                    : {}),
+                ...(compiled.input.serverVersion !== undefined
+                    ? { serverVersion: compiled.input.serverVersion }
+                    : {}),
+                ...(compiled.input.declaredAccessMode !== undefined
+                    ? { accessMode: compiled.input.declaredAccessMode }
+                    : {}),
+                ...(hostedAssets !== undefined ? { hostedAssets } : {}),
+            }),
+        });
+        if (!deployRes.ok) {
+            const failure = await summarizeHttpFailure('deploy', deployRes);
+            if (failure.code === 'run_superseded') {
+                await report('superseded');
+                return { status: 'superseded' };
+            }
+            return await fail('deploy', failure.summary);
+        }
+        const deployed = (await deployRes.json());
+        if (typeof deployed.deploymentId !== 'string') {
+            return await fail('deploy', 'deploy: service returned no deploymentId');
+        }
+        await report('deployed', { deploymentId: deployed.deploymentId });
+        return { status: 'deployed', deploymentId: deployed.deploymentId };
+    }
+    catch (error) {
+        // An unexpected throw (network fault, etc.) still lands the run in `failed` with a redacted,
+        // stage-tagged summary — never a silent hang. Only the error's name is included; never a message
+        // that could carry a URL, token, or body.
+        const name = error instanceof Error ? error.name : 'Error';
+        return await fail(stage, `${stage}: unexpected error (${name})`);
+    }
+}
+//# sourceMappingURL=deploy-pipeline.js.map

package/node_modules/@noodle-borg/service/dist/github/deploy-pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-pipeline.js","sourceRoot":"","sources":["../../src/github/deploy-pipeline.ts"],"names":[],"mappings":"AA4DA,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE3E,iGAAiG;AACjG,KAAK,UAAU,oBAAoB,CACjC,KAAa,EACb,GAAa;IAEb,IAAI,IAAwB,CAAC;IAC7B,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwC,CAAC;QACvE,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACpD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,mGAAmG;IACrG,CAAC;IACD,OAAO;QACL,OAAO,EAAE,GAAG,KAAK,iBAAiB,GAAG,CAAC,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAClF,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAC3C,EAAE;QACF,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAwB;IAC9D,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,GAAG,OAAO,mBAAmB,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;IACtF,MAAM,UAAU,GAAG,GAAG,OAAO,YAAY,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,kBAAkB,CACjG,GAAG,CAAC,OAAO,CACZ,SAAS,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;IAE5C,MAAM,MAAM,GAAG,KAAK,EAClB,EAAmE,EACnE,KAA0E,EAC3D,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,SAAS,EAAE;gBACzB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,QAAQ,EAAE,EAAE;gBACpF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC;aACvC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,mFAAmF;QACrF,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,EAAE,KAAkB,EAAE,YAAoB,EAAkC,EAAE;QAC9F,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QACzC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACnD,CAAC,CAAC;IAEF,IAAI,KAAK,GAAgB,SAAS,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,MAAM,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;QAEtE,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAE1B,IAAI,YAAwD,CAAC;QAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;QAC3C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,KAAK,GAAG,WAAW,CAAC;YACpB,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,GAAG,UAAU,mBAAmB,EAAE;gBACrE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,QAAQ,EAAE;gBAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;aACxE,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;gBACrB,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAC5E,OAAO,MAAM,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAQtC,CAAC;YACF,KAAK,GAAG,QAAQ,CAAC;YACjB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC5F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,OAAO,MAAM,IAAI,CACf,QAAQ,EACR,+CAA+C,MAAM,CAAC,SAAS,GAAG,CACnE,CAAC;gBACJ,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE;oBAC/C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,IAAI,EAAE,KAAK,CAAC,KAAK;iBAClB,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,OAAO,MAAM,IAAI,CACf,QAAQ,EACR,kBAAkB,MAAM,CAAC,SAAS,sBAAsB,MAAM,CAAC,MAAM,GAAG,CACzE,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7B,CAAC;QAED,KAAK,GAAG,QAAQ,CAAC;QACjB,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,GAAG,UAAU,SAAS,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,QAAQ,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ;gBACjC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;oBACzC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE;oBAC3C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS;oBAC5C,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa,EAAE;oBACjD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS;oBACjD,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,kBAAkB,EAAE;oBACnD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAChE,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACtC,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;gBAC3B,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YAClC,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAA+B,CAAC;QACxE,IAAI,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,MAAM,IAAI,CAAC,QAAQ,EAAE,0CAA0C,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,CAAC,UAAU,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,6FAA6F;QAC7F,iGAAiG;QACjG,0CAA0C;QAC1C,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3D,OAAO,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,KAAK,uBAAuB,IAAI,GAAG,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}

package/node_modules/@noodle-borg/service/dist/github/deploy-run-executor.d.ts

@@ -0,0 +1,33 @@
+import type { DeployRunRecord } from '../store.js';
+/**
+ * The isolation seam for GHD-3 (ADR 0132 Decision 6). The dispatcher hands an accepted, non-blocked
+ * run to an executor; the executor runs the untrusted-compile → trusted-deploy pipeline somewhere
+ * isolated and reports progress back through `POST /v1/github/runs/{runId}/status` using the
+ * `runToken`. The executor is the ONLY thing that varies by environment:
+ *
+ * - `CloudRunJobExecutor` (C3, production) — triggers one Cloud Run Job execution per run.
+ * - `LocalProcessExecutor` (C2, dev/self-host/E2E) — runs the pipeline as a local child process.
+ * - {@link FakeDeployRunExecutor} (tests) — records dispatches, runs nothing.
+ *
+ * `dispatch` is fire-and-forget from the caller's view (the webhook must answer GitHub immediately);
+ * it resolves once the execution is *launched*, not *finished*. It must never throw into the request
+ * path — an executor that can't launch records the failure out-of-band and the sweeper retries.
+ */
+export interface DeployRunDispatchInput {
+    readonly run: DeployRunRecord;
+    /** Run-scoped credential the executor uses to report status + deploy (never the sandbox's). */
+    readonly runToken: string;
+    /** Base URL the executor calls back to (the status/deploy routes). */
+    readonly serviceBaseUrl: string;
+}
+export interface DeployRunExecutor {
+    dispatch(input: DeployRunDispatchInput): Promise<void>;
+}
+/** Test double: captures every dispatch, launches nothing. */
+export declare class FakeDeployRunExecutor implements DeployRunExecutor {
+    #private;
+    readonly dispatches: DeployRunDispatchInput[];
+    constructor(onDispatch?: (input: DeployRunDispatchInput) => void | Promise<void>);
+    dispatch(input: DeployRunDispatchInput): Promise<void>;
+}
+//# sourceMappingURL=deploy-run-executor.d.ts.map

package/node_modules/@noodle-borg/service/dist/github/deploy-run-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-run-executor.d.ts","sourceRoot":"","sources":["../../src/github/deploy-run-executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;IAC9B,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED,8DAA8D;AAC9D,qBAAa,qBAAsB,YAAW,iBAAiB;;IAC7D,QAAQ,CAAC,UAAU,EAAE,sBAAsB,EAAE,CAAM;gBAIvC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1E,QAAQ,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;CAI7D"}

package/node_modules/@noodle-borg/service/dist/github/deploy-run-executor.js

@@ -0,0 +1,14 @@
+/** Test double: captures every dispatch, launches nothing. */
+export class FakeDeployRunExecutor {
+    dispatches = [];
+    /** Optional hook so a test can assert the token/base or simulate a launch failure. */
+    #onDispatch;
+    constructor(onDispatch) {
+        this.#onDispatch = onDispatch;
+    }
+    async dispatch(input) {
+        this.dispatches.push(input);
+        await this.#onDispatch?.(input);
+    }
+}
+//# sourceMappingURL=deploy-run-executor.js.map

package/node_modules/@noodle-borg/service/dist/github/deploy-run-executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-run-executor.js","sourceRoot":"","sources":["../../src/github/deploy-run-executor.ts"],"names":[],"mappings":"AA4BA,8DAA8D;AAC9D,MAAM,OAAO,qBAAqB;IACvB,UAAU,GAA6B,EAAE,CAAC;IACnD,sFAAsF;IAC7E,WAAW,CAAwE;IAE5F,YAAY,UAAoE;QAC9E,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAA6B;QAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;CACF"}

package/node_modules/@noodle-borg/service/dist/github/deploy-run-reconciler.d.ts

@@ -0,0 +1,36 @@
+import { type Logger } from '@noodle-borg/transport-http';
+import type { GithubConnectionStore, GithubDeployRunStore } from '../store.js';
+import type { DeployRunExecutor } from './deploy-run-executor.js';
+export declare const GITHUB_RUN_RECONCILE_INTERVAL_MS = 60000;
+export declare const GITHUB_RUN_TIMEOUT_MS = 180000;
+export declare const GITHUB_RUN_QUEUED_REDISPATCH_GRACE_MS = 30000;
+export interface GithubDeployRunReconcilerOptions {
+    readonly runStore: GithubDeployRunStore;
+    readonly connectionStore: GithubConnectionStore;
+    readonly executor: DeployRunExecutor;
+    readonly webhookSecret: string;
+    readonly serviceBaseUrl: string;
+    readonly clock?: () => Date;
+    readonly logger?: Logger;
+    readonly intervalMs?: number;
+    readonly runTimeoutMs?: number;
+    readonly queuedRedispatchGraceMs?: number;
+    readonly limitPerConnection?: number;
+}
+export interface GithubDeployRunReconcileResult {
+    readonly connections: number;
+    readonly inspected: number;
+    readonly dispatched: number;
+    readonly failed: number;
+}
+/**
+ * Idempotent GitHub deploy-run reconciler. Webhook dispatch is intentionally fire-and-forget; this
+ * loop is the recovery path for missed Cloud Run Job launches and abandoned in-flight runs.
+ */
+export declare class GithubDeployRunReconciler {
+    #private;
+    constructor(options: GithubDeployRunReconcilerOptions);
+    maybeSweep(): void;
+    sweepNow(): Promise<GithubDeployRunReconcileResult>;
+}
+//# sourceMappingURL=deploy-run-reconciler.d.ts.map

package/node_modules/@noodle-borg/service/dist/github/deploy-run-reconciler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-run-reconciler.d.ts","sourceRoot":"","sources":["../../src/github/deploy-run-reconciler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAc,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAmB,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAIlE,eAAO,MAAM,gCAAgC,QAAS,CAAC;AACvD,eAAO,MAAM,qBAAqB,SAAU,CAAC;AAC7C,eAAO,MAAM,qCAAqC,QAAS,CAAC;AAE5D,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,qBAAqB,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,qBAAa,yBAAyB;;gBAexB,OAAO,EAAE,gCAAgC;IAerD,UAAU,IAAI,IAAI;IAcZ,QAAQ,IAAI,OAAO,CAAC,8BAA8B,CAAC;CA6D1D"}