@noodleseed/one 0.96.3 → 0.98.0

package/node_modules/@noodle-borg/service/dist/routes/linear-feedback-webhook.js

@@ -0,0 +1,141 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { z } from 'zod';
+import { readRawBody, sendJson } from '../http-util.js';
+const MAX_WEBHOOK_AGE_MS = 60_000;
+const LinearWebhookSchema = z
+    .object({
+    action: z.string().min(1).max(50),
+    type: z.enum(['Issue', 'Attachment']),
+    webhookTimestamp: z.number().int().positive(),
+    data: z
+        .object({
+        id: z.string().min(1).optional(),
+        issueId: z.string().min(1).optional(),
+        state: z.object({ id: z.string().min(1) }).optional(),
+    })
+        .catchall(z.unknown()),
+    updatedFrom: z.object({ stateId: z.string().optional() }).catchall(z.unknown()).optional(),
+})
+    .catchall(z.unknown());
+export async function handleLinearFeedbackWebhook(req, res, deps) {
+    const body = await readRawBody(req, deps.maxBody);
+    if (!body.ok) {
+        sendJson(res, 413, { error: 'request body too large' });
+        return;
+    }
+    const signature = singleHeader(req.headers['linear-signature']);
+    if (!verifyLinearSignature(body.buffer, signature, deps.webhookSecret)) {
+        sendJson(res, 401, { error: 'invalid webhook' });
+        return;
+    }
+    let parsedJson;
+    try {
+        parsedJson = JSON.parse(body.buffer.toString('utf8'));
+    }
+    catch {
+        sendJson(res, 400, { error: 'malformed payload' });
+        return;
+    }
+    const envelope = LinearWebhookSchema.safeParse(parsedJson);
+    if (!envelope.success) {
+        sendJson(res, 400, { error: 'malformed payload' });
+        return;
+    }
+    if (Math.abs(deps.clock().getTime() - envelope.data.webhookTimestamp) > MAX_WEBHOOK_AGE_MS) {
+        sendJson(res, 401, { error: 'invalid webhook' });
+        return;
+    }
+    const deliveryId = singleHeader(req.headers['linear-delivery']);
+    if (deliveryId === undefined || deliveryId.length > 200) {
+        sendJson(res, 400, { error: 'missing delivery id' });
+        return;
+    }
+    const issueId = envelope.data.type === 'Issue' ? envelope.data.data.id : envelope.data.data.issueId;
+    if (issueId === undefined) {
+        sendJson(res, 400, { error: 'malformed payload' });
+        return;
+    }
+    const issue = await deps.client.getIssue(issueId);
+    if (issue === undefined ||
+        issue.teamId !== deps.teamId ||
+        !issue.labels.some((label) => label.toLowerCase() === 'feedback')) {
+        sendJson(res, 200, { ok: true, data: { outcome: 'ignored' } });
+        return;
+    }
+    const githubIssue = githubIssueReferenceFromAttachments(issue.attachments, deps.githubRepository);
+    const enteredInProgress = envelope.data.type === 'Issue' &&
+        envelope.data.action === 'update' &&
+        envelope.data.data.state?.id === deps.inProgressStatusId &&
+        envelope.data.updatedFrom?.stateId !== undefined &&
+        envelope.data.updatedFrom?.stateId !== deps.inProgressStatusId;
+    const result = await deps.store.applyLinearEvent({
+        deliveryId,
+        eventCreatedAt: new Date(envelope.data.webhookTimestamp).toISOString(),
+        enteredInProgress,
+        ...(githubIssue !== undefined ? { githubIssueNumber: githubIssue.number } : {}),
+        issue: {
+            id: issue.id,
+            identifier: issue.identifier,
+            url: issue.url,
+            title: issue.title,
+            description: issue.description,
+            status: issue.status,
+            ...(issue.assigneeName !== undefined ? { assigneeName: issue.assigneeName } : {}),
+            labels: issue.labels,
+        },
+    });
+    if (result.bindingConflict) {
+        sendJson(res, 200, { ok: true, data: { outcome: 'binding_conflict' } });
+        return;
+    }
+    sendJson(res, 200, {
+        ok: true,
+        data: {
+            outcome: result.duplicate ? 'duplicate' : 'accepted',
+            slackEnqueued: result.slackEnqueued,
+            emailEnqueued: result.emailEnqueued,
+        },
+    });
+}
+export function verifyLinearSignature(body, signature, secret) {
+    if (signature === undefined || !/^[0-9a-f]{64}$/i.test(signature))
+        return false;
+    const expected = createHmac('sha256', secret).update(body).digest();
+    const received = Buffer.from(signature, 'hex');
+    return received.length === expected.length && timingSafeEqual(received, expected);
+}
+function githubIssueReferenceFromAttachments(attachments, repository) {
+    for (const value of attachments) {
+        let url;
+        try {
+            url = new URL(value);
+        }
+        catch {
+            continue;
+        }
+        const segments = url.pathname.split('/').filter(Boolean);
+        if (url.protocol !== 'https:' ||
+            url.hostname.toLowerCase() !== 'github.com' ||
+            url.search !== '' ||
+            url.hash !== '' ||
+            segments.length !== 4 ||
+            segments[0]?.toLowerCase() !== repository.owner.toLowerCase() ||
+            segments[1]?.toLowerCase() !== repository.repo.toLowerCase() ||
+            segments[2]?.toLowerCase() !== 'issues' ||
+            !/^[1-9]\d*$/.test(segments[3] ?? '')) {
+            continue;
+        }
+        const issueNumber = Number(segments[3]);
+        if (Number.isSafeInteger(issueNumber)) {
+            return {
+                number: issueNumber,
+                url: `https://github.com/${repository.owner}/${repository.repo}/issues/${issueNumber}`,
+            };
+        }
+    }
+    return undefined;
+}
+function singleHeader(value) {
+    return typeof value === 'string' ? value : undefined;
+}
+//# sourceMappingURL=linear-feedback-webhook.js.map

package/node_modules/@noodle-borg/service/dist/routes/linear-feedback-webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linear-feedback-webhook.js","sourceRoot":"","sources":["../../src/routes/linear-feedback-webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAGxD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACrC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7C,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;KACtD,CAAC;SACD,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3F,CAAC;KACD,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAazB,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,GAAoB,EACpB,GAAmB,EACnB,IAA+B;IAE/B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACvE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IAED,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,kBAAkB,EAAE,CAAC;QAC3F,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAChE,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACxD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GACX,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;IACtF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClD,IACE,KAAK,KAAK,SAAS;QACnB,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAC5B,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,EACjE,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,MAAM,WAAW,GAAG,mCAAmC,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAClG,MAAM,iBAAiB,GACrB,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO;QAC9B,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ;QACjC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,IAAI,CAAC,kBAAkB;QACxD,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,KAAK,SAAS;QAChD,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC,kBAAkB,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAC/C,UAAU;QACV,cAAc,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE;QACtE,iBAAiB;QACjB,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,KAAK,EAAE;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB;KACF,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;QACjB,EAAE,EAAE,IAAI;QACR,IAAI,EAAE;YACJ,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU;YACpD,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,aAAa,EAAE,MAAM,CAAC,aAAa;SACpC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,IAAY,EACZ,SAA6B,EAC7B,MAAc;IAEd,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC/C,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,mCAAmC,CAC1C,WAA8B,EAC9B,UAAoC;IAEpC,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzD,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,YAAY;YAC3C,GAAG,CAAC,MAAM,KAAK,EAAE;YACjB,GAAG,CAAC,IAAI,KAAK,EAAE;YACf,QAAQ,CAAC,MAAM,KAAK,CAAC;YACrB,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE;YAC7D,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE;YAC5D,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,QAAQ;YACvC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EACrC,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,GAAG,EAAE,sBAAsB,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,WAAW,WAAW,EAAE;aACvF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,KAA6C;IACjE,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC"}

package/node_modules/@noodle-borg/service/dist/routes/slack-feedback-actions.d.ts

@@ -0,0 +1,13 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { FeedbackOperationsStore } from '../store/feedback-operations.js';
+export interface SlackFeedbackActionsDeps {
+    readonly store: FeedbackOperationsStore;
+    readonly signingSecret: string;
+    readonly workspaceId: string;
+    readonly channelId: string;
+    readonly maxBody: number;
+    readonly clock: () => Date;
+}
+export declare function handleSlackFeedbackActions(req: IncomingMessage, res: ServerResponse, deps: SlackFeedbackActionsDeps): Promise<void>;
+export declare function verifySlackSignature(raw: Buffer, timestamp: string, signature: string | undefined, secret: string): boolean;
+//# sourceMappingURL=slack-feedback-actions.d.ts.map

package/node_modules/@noodle-borg/service/dist/routes/slack-feedback-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-feedback-actions.d.ts","sourceRoot":"","sources":["../../src/routes/slack-feedback-actions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAIjE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAoB/E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;CAC5B;AAED,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,IAAI,CAAC,CA+Df;AAED,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,MAAM,GACb,OAAO,CAKT"}

package/node_modules/@noodle-borg/service/dist/routes/slack-feedback-actions.js

@@ -0,0 +1,99 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { z } from 'zod';
+import { assertSlackResponseUrl } from '../feedback-operations/slack-client.js';
+import { readRawBody, sendJson } from '../http-util.js';
+const MAX_REQUEST_AGE_SECONDS = 5 * 60;
+const SlackActionSchema = z.object({
+    type: z.literal('block_actions'),
+    team: z.object({ id: z.string().min(1) }),
+    channel: z.object({ id: z.string().min(1) }),
+    message: z.object({ ts: z.string().min(1) }),
+    user: z.object({ id: z.string().min(1) }),
+    response_url: z.url(),
+    actions: z
+        .array(z.object({
+        action_id: z.literal('feedback_start_work'),
+        value: z.string().min(1),
+    }))
+        .length(1),
+});
+export async function handleSlackFeedbackActions(req, res, deps) {
+    const raw = await readRawBody(req, deps.maxBody);
+    if (!raw.ok) {
+        sendJson(res, 413, { error: 'request body too large' });
+        return;
+    }
+    const timestamp = singleHeader(req.headers['x-slack-request-timestamp']);
+    const signature = singleHeader(req.headers['x-slack-signature']);
+    if (timestamp === undefined ||
+        !verifySlackSignature(raw.buffer, timestamp, signature, deps.signingSecret) ||
+        !freshTimestamp(timestamp, deps.clock())) {
+        sendJson(res, 401, { error: 'invalid request' });
+        return;
+    }
+    const form = new URLSearchParams(raw.buffer.toString('utf8'));
+    const payloadValue = form.get('payload');
+    let payloadJson;
+    try {
+        payloadJson = payloadValue === null ? undefined : JSON.parse(payloadValue);
+    }
+    catch {
+        payloadJson = undefined;
+    }
+    const parsed = SlackActionSchema.safeParse(payloadJson);
+    if (!parsed.success) {
+        sendJson(res, 400, { error: 'malformed action' });
+        return;
+    }
+    const action = parsed.data;
+    if (action.team.id !== deps.workspaceId || action.channel.id !== deps.channelId) {
+        sendJson(res, 403, { error: 'action not allowed' });
+        return;
+    }
+    const record = await deps.store.getBySlackMessage(action.channel.id, action.message.ts);
+    const linearIssueId = action.actions[0]?.value;
+    if (record === undefined ||
+        linearIssueId === undefined ||
+        record.linearIssueId !== linearIssueId ||
+        !record.trustedReporter ||
+        record.reporterEmail === undefined ||
+        record.acceptedAt !== undefined ||
+        record.emailSentAt !== undefined ||
+        (record.linearStatus?.type !== 'backlog' && record.linearStatus?.type !== 'unstarted')) {
+        sendJson(res, 403, { error: 'action not allowed' });
+        return;
+    }
+    try {
+        assertSlackResponseUrl(action.response_url);
+    }
+    catch {
+        sendJson(res, 403, { error: 'action not allowed' });
+        return;
+    }
+    await deps.store.enqueueStartWork({
+        actionKey: `${action.team.id}/${action.channel.id}/${action.message.ts}/${linearIssueId}/in-progress`,
+        linearIssueId,
+        slackUserId: action.user.id,
+        responseUrl: action.response_url,
+        createdAt: deps.clock().toISOString(),
+    });
+    sendJson(res, 200, { response_type: 'ephemeral', text: 'Starting work in Linear…' });
+}
+export function verifySlackSignature(raw, timestamp, signature, secret) {
+    if (signature === undefined || !/^v0=[0-9a-f]{64}$/i.test(signature))
+        return false;
+    const expected = createHmac('sha256', secret).update(`v0:${timestamp}:`).update(raw).digest();
+    const received = Buffer.from(signature.slice(3), 'hex');
+    return received.length === expected.length && timingSafeEqual(received, expected);
+}
+function freshTimestamp(value, now) {
+    if (!/^\d{10,13}$/.test(value))
+        return false;
+    const seconds = Number(value);
+    return (Number.isSafeInteger(seconds) &&
+        Math.abs(Math.floor(now.getTime() / 1000) - seconds) <= MAX_REQUEST_AGE_SECONDS);
+}
+function singleHeader(value) {
+    return typeof value === 'string' ? value : undefined;
+}
+//# sourceMappingURL=slack-feedback-actions.js.map

package/node_modules/@noodle-borg/service/dist/routes/slack-feedback-actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-feedback-actions.js","sourceRoot":"","sources":["../../src/routes/slack-feedback-actions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAGxD,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,CAAC;AACvC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE;IACrB,OAAO,EAAE,CAAC;SACP,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;QAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACzB,CAAC,CACH;SACA,MAAM,CAAC,CAAC,CAAC;CACb,CAAC,CAAC;AAWH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,GAAoB,EACpB,GAAmB,EACnB,IAA8B;IAE9B,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACjE,IACE,SAAS,KAAK,SAAS;QACvB,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC;QAC3E,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,EACxC,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,WAAoB,CAAC;IACzB,IAAI,CAAC;QACH,WAAW,GAAG,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAa,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,SAAS,CAAC;IAC1B,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3B,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QAChF,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxF,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;IAC/C,IACE,MAAM,KAAK,SAAS;QACpB,aAAa,KAAK,SAAS;QAC3B,MAAM,CAAC,aAAa,KAAK,aAAa;QACtC,CAAC,MAAM,CAAC,eAAe;QACvB,MAAM,CAAC,aAAa,KAAK,SAAS;QAClC,MAAM,CAAC,UAAU,KAAK,SAAS;QAC/B,MAAM,CAAC,WAAW,KAAK,SAAS;QAChC,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,EAAE,IAAI,KAAK,WAAW,CAAC,EACtF,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAChC,SAAS,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,aAAa,cAAc;QACrG,aAAa;QACb,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;QAC3B,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,SAAiB,EACjB,SAA6B,EAC7B,MAAc;IAEd,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACnF,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9F,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACxD,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,GAAS;IAC9C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,CACL,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,uBAAuB,CAChF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAA6C;IACjE,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC"}

package/node_modules/@noodle-borg/service/dist/serve-options.d.ts

@@ -8,9 +8,22 @@ import type { GoogleAuthenticator } from './oauth/google.js';
 import type { WorkOSPlatformAuthenticationMethod } from './oauth/workos.js';
 import type { ServiceOptions } from './options.js';
 import type { CloudSqlConfig } from './store/cloudsql-pool.js';
+import type { TenantBridgeAuthConfig } from './store.js';
 export type ServeServiceOptions = ServiceOptions & {
     readonly port?: number;
     readonly host?: string;
+    /**
+     * Loopback-only `noodle dev` seam: verify Firebase ID tokens directly instead of requiring a hosted
+     * Noodle bridge token. The service rejects this option on every non-loopback bind.
+     */
+    readonly localDevtoolsDirectFirebaseAuth?: boolean;
+    /**
+     * Loopback-only `noodle dev` seam: verify Microsoft ID tokens directly instead of requiring a hosted
+     * Noodle bridge token. The service rejects this option on every non-loopback bind.
+     */
+    readonly localDevtoolsDirectMicrosoftAuth?: boolean;
+    /** Resolve managed bridge variables for the single local app before direct token verification. */
+    readonly localDevtoolsResolveBridgeAuth?: (auth: TenantBridgeAuthConfig, resource: string) => Promise<TenantBridgeAuthConfig>;
     /** Google OAuth client id / OIDC audience for control-plane ID-token verification (MT-2). */
     readonly googleClientId?: string;
     /**

package/node_modules/@noodle-borg/service/dist/serve-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve-options.d.ts","sourceRoot":"","sources":["../src/serve-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,mCAAmC,CAAC;AAClG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG/D,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG;IACjD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,6FAA6F;IAC7F,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvD,oFAAoF;IACpF,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpD,yGAAyG;IACzG,QAAQ,CAAC,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAChD,6GAA6G;IAC7G,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,8FAA8F;IAC9F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACzD,mFAAmF;IACnF,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IACnC,gGAAgG;IAChG,QAAQ,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACzD,oGAAoG;IACpG,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,wCAAwC,CAAC;IAC/E;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,qGAAqG;QACrG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;QACpC,yGAAyG;QACzG,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;QACtC,kGAAkG;QAClG,QAAQ,CAAC,MAAM,CAAC,EAAE;YAChB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;YAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YACxB,4FAA4F;YAC5F,QAAQ,CAAC,4BAA4B,CAAC,EAAE,SAAS,kCAAkC,EAAE,CAAC;SACvF,CAAC;QACF,2FAA2F;QAC3F,QAAQ,CAAC,aAAa,CAAC,EAAE;YACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;SAC9B,CAAC;QACF,6FAA6F;QAC7F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;QACrC,8FAA8F;QAC9F,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAC3C,sGAAsG;QACtG,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;KAC/C,CAAC;IACF,qFAAqF;IACrF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,6FAA6F;IAC7F,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnD,sCAAsC;IACtC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,uCAAuC;IACvC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,wGAAwG;IACxG,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,wGAAwG;IACxG,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,yFAAyF;IACzF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,2FAA2F;IAC3F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;CACtD,CAAC"}
+{"version":3,"file":"serve-options.d.ts","sourceRoot":"","sources":["../src/serve-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,mCAAmC,CAAC;AAClG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAiB,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAExE,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG;IACjD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,+BAA+B,CAAC,EAAE,OAAO,CAAC;IACnD;;;OAGG;IACH,QAAQ,CAAC,gCAAgC,CAAC,EAAE,OAAO,CAAC;IACpD,kGAAkG;IAClG,QAAQ,CAAC,8BAA8B,CAAC,EAAE,CACxC,IAAI,EAAE,sBAAsB,EAC5B,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrC,6FAA6F;IAC7F,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvD,oFAAoF;IACpF,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpD,yGAAyG;IACzG,QAAQ,CAAC,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAChD,6GAA6G;IAC7G,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,8FAA8F;IAC9F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACzD,mFAAmF;IACnF,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IACnC,gGAAgG;IAChG,QAAQ,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACzD,oGAAoG;IACpG,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,wCAAwC,CAAC;IAC/E;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,qGAAqG;QACrG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;QACpC,yGAAyG;QACzG,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;QACtC,kGAAkG;QAClG,QAAQ,CAAC,MAAM,CAAC,EAAE;YAChB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;YAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YACxB,4FAA4F;YAC5F,QAAQ,CAAC,4BAA4B,CAAC,EAAE,SAAS,kCAAkC,EAAE,CAAC;SACvF,CAAC;QACF,2FAA2F;QAC3F,QAAQ,CAAC,aAAa,CAAC,EAAE;YACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;SAC9B,CAAC;QACF,6FAA6F;QAC7F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;QACrC,8FAA8F;QAC9F,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAC3C,sGAAsG;QACtG,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;KAC/C,CAAC;IACF,qFAAqF;IACrF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,6FAA6F;IAC7F,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnD,sCAAsC;IACtC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,uCAAuC;IACvC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,wGAAwG;IACxG,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,wGAAwG;IACxG,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,yFAAyF;IACzF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,2FAA2F;IAC3F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;CACtD,CAAC"}

package/node_modules/@noodle-borg/service/dist/serve.d.ts

@@ -1,4 +1,5 @@
 import { type Server } from 'node:http';
+import { type LocalDevtoolsDelegatedCredentialSink } from './local-devtools-delegated-credentials.js';
 import { type RecoverResult, ServerRegistry } from './registry.js';
 import type { ServeServiceOptions } from './serve-options.js';
 export interface RunningService {
@@ -13,6 +14,8 @@ export interface RunningService {
     readonly registry: ServerRegistry;
     /** Recovery outcome when persistence is enabled (a `dataDir` was set); absent otherwise. */
     readonly recovered?: RecoverResult;
+    /** Loopback/in-process only. Present solely for direct Firebase/Microsoft Devtools auth. */
+    readonly localDevtoolsDelegatedCredentials?: LocalDevtoolsDelegatedCredentialSink;
     close(): Promise<void>;
 }
 /** Start the deploy service on its own `node:http` server (used by the `noodle-service` bin). */

package/node_modules/@noodle-borg/service/dist/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAsDtD,OAAO,EAAE,KAAK,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAwC9D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,4FAA4F;IAC5F,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,iGAAiG;AACjG,wBAAsB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,cAAc,CAAC,CAqmB7F"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAyCtD,OAAO,EAEL,KAAK,oCAAoC,EAC1C,MAAM,2CAA2C,CAAC;AAkBnD,OAAO,EAAE,KAAK,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAyC9D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,4FAA4F;IAC5F,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC,4FAA4F;IAC5F,QAAQ,CAAC,iCAAiC,CAAC,EAAE,oCAAoC,CAAC;IAClF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,iGAAiG;AACjG,wBAAsB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,cAAc,CAAC,CA4pB7F"}

package/node_modules/@noodle-borg/service/dist/serve.js

@@ -11,10 +11,12 @@ import { parseBillingUsageHmacKey } from './billing/usage-identity.js';
 import { resolveBuildInfo } from './build-info.js';
 import { createDefaultControlPlaneGate } from './control-plane-auth-bootstrap.js';
 import { warnCustomerAuthAudienceQuarantine } from './customer-auth-audience-quarantine.js';
-import { createHostedCustomerVerifierFactory } from './customer-verifier.js';
+import { createHostedCustomerVerifierFactory, createLocalDevtoolsCustomerVerifierFactory, } from './customer-verifier.js';
+import { startConfiguredFeedbackOperationsWorker } from './feedback-operations/bootstrap.js';
 import { GITHUB_RUN_RECONCILE_INTERVAL_MS, GithubDeployRunReconciler, } from './github/deploy-run-reconciler.js';
 import { PostgresGoogleWorkloadIdentityStore } from './google-workload-identity-postgres.js';
 import { InMemoryGoogleWorkloadIdentityStore } from './google-workload-identity-store.js';
+import { createLocalDevtoolsDelegatedCredentialSource, } from './local-devtools-delegated-credentials.js';
 import { ensureMcpConfirmationNonceSchema, PostgresMcpConfirmationNonceLedger, } from './mcp-confirmation-nonce-postgres.js';
 import { createHostedMcpRequestStateManager } from './mcp-protocol-runtime.js';
 import { ModuleHost } from './modules/host.js';
@@ -37,6 +39,7 @@ import { InMemoryControlPlaneStore } from './store/control-plane.js';
 import { PostgresPendingGithubInstallationStore } from './store/pending-installations-postgres.js';
 import { PostgresAlertRuleStore } from './store/postgres-alerts.js';
 import { PostgresAssistantStore } from './store/postgres-assistant.js';
+import { PostgresFeedbackOperationsStore } from './store/postgres-feedback-operations.js';
 import { PostgresStateHandleStore } from './store/postgres-state-handles.js';
 import { RequestEventBuffer } from './store/request-event-buffer.js';
 import { InMemoryRequestEventStore } from './store/request-events.js';
@@ -53,7 +56,19 @@ export async function serveService(options = {}) {
     });
     if (!serviceConfigSource.ok)
         throw new Error(serviceConfigSource.error);
+    if (options.feedbackOperationsConfig !== undefined &&
+        (options.linearFeedbackClient === undefined ||
+            options.slackFeedbackClient === undefined ||
+            options.feedbackReporterEmailSender === undefined)) {
+        throw new Error('feedback operations require Linear, Slack, and reporter email providers together');
+    }
     const host = options.host ?? '127.0.0.1';
+    if (options.localDevtoolsDirectFirebaseAuth === true && !isLoopbackHost(host)) {
+        throw new Error('local Devtools Firebase verification requires a loopback service bind');
+    }
+    if (options.localDevtoolsDirectMicrosoftAuth === true && !isLoopbackHost(host)) {
+        throw new Error('local Devtools Microsoft verification requires a loopback service bind');
+    }
     let gate = options.deployGate;
     const durableStoreRequested = options.dataDir !== undefined ||
         options.databaseUrl !== undefined ||
@@ -121,6 +136,7 @@ export async function serveService(options = {}) {
     let githubConnectionStore = options.githubConnectionStore;
     let githubDeployRunStore = options.githubDeployRunStore;
     let pendingGithubInstallationStore = options.pendingGithubInstallationStore;
+    let feedbackOperations = options.feedbackOperations;
     let pgPool;
     let platformIdentityStore = options.platformIdentityStore;
     let googleWorkloadIdentity = options.googleWorkloadIdentity;
@@ -180,6 +196,11 @@ export async function serveService(options = {}) {
         githubDeployRunStore = githubDeployRunStore ?? postgres;
         pendingGithubInstallationStore =
             pendingGithubInstallationStore ?? new PostgresPendingGithubInstallationStore(pgPool.pool);
+        if (options.feedbackOperationsConfig !== undefined && feedbackOperations === undefined) {
+            const postgresFeedback = new PostgresFeedbackOperationsStore(pgPool.pool);
+            await postgresFeedback.ensureSchema();
+            feedbackOperations = postgresFeedback;
+        }
     }
     else if (options.dataDir !== undefined) {
         store = new JsonFileArtifactStore(options.dataDir);
@@ -189,6 +210,9 @@ export async function serveService(options = {}) {
         githubDeployRunStore =
             githubDeployRunStore ?? new JsonFileGithubDeployRunStore(options.dataDir);
     }
+    if (options.feedbackOperationsConfig !== undefined && feedbackOperations === undefined) {
+        throw new Error('feedback operations require PostgreSQL in the live service bootstrap');
+    }
     platformAuth = await resolvePlatformAuthServiceBootstrap({
         ...(pgPool === undefined ? {} : { pool: pgPool.pool }),
         releaseSha: buildInfo.gitSha,
@@ -266,6 +290,10 @@ export async function serveService(options = {}) {
             ...(options.clock !== undefined ? { clock: options.clock } : {}),
         });
     }
+    const feedbackOperationsTimer = startConfiguredFeedbackOperationsWorker({
+        options,
+        store: feedbackOperations,
+    });
     let githubRunReconcileTimer;
     if (githubConnectionStore !== undefined &&
         githubDeployRunStore !== undefined &&
@@ -351,6 +379,12 @@ export async function serveService(options = {}) {
         registry: () => registry,
     });
     const { authServerApp, verifyOwnerToken: resolvedVerifyOwnerToken, authServerIssuer: resolvedAuthServerIssuer, oauthStore, developerGrantStore, delegatedExchange, rawCustomerVerifierFactory, } = oauthBootstrap;
+    const localDevtoolsDelegatedCredentialSource = oauthStore === undefined &&
+        (options.localDevtoolsDirectFirebaseAuth === true ||
+            options.localDevtoolsDirectMicrosoftAuth === true)
+        ? createLocalDevtoolsDelegatedCredentialSource()
+        : undefined;
+    const delegatedCredentialStore = oauthStore ?? localDevtoolsDelegatedCredentialSource?.store;
     if (googleWorkloadIdentity === undefined && options.oauth !== undefined) {
         googleWorkloadIdentity = {
             issuer: options.oauth.issuer,
@@ -382,11 +416,22 @@ export async function serveService(options = {}) {
         await controlPlaneStore.createOrg({ slug: 'local', displayName: 'Local' });
     }
     registry = new ServerRegistry(store, secretBox, configStore, {
-        customerVerifierFactory: createHostedCustomerVerifierFactory(rawCustomerVerifierFactory, resolvedVerifyOwnerToken),
+        customerVerifierFactory: options.localDevtoolsDirectFirebaseAuth === true ||
+            options.localDevtoolsDirectMicrosoftAuth === true
+            ? createLocalDevtoolsCustomerVerifierFactory(rawCustomerVerifierFactory, {
+                allowedProviders: [
+                    ...(options.localDevtoolsDirectFirebaseAuth === true ? ['firebase'] : []),
+                    ...(options.localDevtoolsDirectMicrosoftAuth === true ? ['microsoft'] : []),
+                ],
+                ...(options.localDevtoolsResolveBridgeAuth === undefined
+                    ? {}
+                    : { resolveBridgeAuth: options.localDevtoolsResolveBridgeAuth }),
+            })
+            : createHostedCustomerVerifierFactory(rawCustomerVerifierFactory, resolvedVerifyOwnerToken),
         ...(moduleHost.policyGate !== undefined ? { policyGate: moduleHost.policyGate } : {}),
-        ...(oauthStore !== undefined
+        ...(delegatedCredentialStore !== undefined
             ? {
-                delegatedCredentialStore: oauthStore,
+                delegatedCredentialStore,
                 sealCustomerCredential: (credential) => sealCustomerCredential(secretBox, credential),
                 openCustomerCredential: (credential) => openCustomerCredential(secretBox, credential),
             }
@@ -439,6 +484,7 @@ export async function serveService(options = {}) {
             ? {}
             : { billingStripeOverageSettlementTimer }),
         ...(welcomeEmailTimer === undefined ? {} : { welcomeEmailTimer }),
+        ...(feedbackOperationsTimer === undefined ? {} : { feedbackOperationsTimer }),
         ...(platformIdentityMaintenanceTimer === undefined
             ? {}
             : { platformIdentityMaintenanceTimer }),
@@ -530,6 +576,7 @@ export async function serveService(options = {}) {
         ...(githubConnectionStore !== undefined ? { githubConnectionStore } : {}),
         ...(githubDeployRunStore !== undefined ? { githubDeployRunStore } : {}),
         ...(pendingGithubInstallationStore !== undefined ? { pendingGithubInstallationStore } : {}),
+        ...(feedbackOperations !== undefined ? { feedbackOperations } : {}),
         buildInfo,
         ...(assetStore !== undefined ? { assetStore } : {}),
         ...(assetPublicBaseUrl !== undefined ? { assetPublicBaseUrl } : {}),
@@ -543,8 +590,9 @@ export async function serveService(options = {}) {
     };
     let http;
     try {
-        http = createServer(createServiceHandler(registry, handlerOptions));
-        await listenHttpServer(http, options.port ?? 8787, host);
+        const listeningHttp = createServer(createServiceHandler(registry, handlerOptions));
+        http = listeningHttp;
+        await listenHttpServer(listeningHttp, options.port ?? 8787, host);
         billingMeterRuntime?.start();
         if (platformAuth.runtime !== undefined) {
             platformIdentityMaintenanceTimer = startPlatformIdentityMaintenanceWorker({
@@ -554,6 +602,24 @@ export async function serveService(options = {}) {
                 logger: options.logger ?? noopLogger,
             });
         }
+        const { port } = listeningHttp.address();
+        const urlHost = host.includes(':') ? `[${host}]` : host;
+        const serviceUrl = `http://${urlHost}:${port}`;
+        const localDevtoolsDelegatedCredentials = localDevtoolsDelegatedCredentialSource?.bind(serviceUrl);
+        return {
+            http: listeningHttp,
+            url: serviceUrl,
+            port,
+            registry,
+            ...(recovered ? { recovered } : {}),
+            ...(localDevtoolsDelegatedCredentials === undefined
+                ? {}
+                : { localDevtoolsDelegatedCredentials }),
+            close: async () => {
+                await closeHttpServer(listeningHttp);
+                await closeResources();
+            },
+        };
     }
     catch (error) {
         if (http?.listening)
@@ -561,17 +627,5 @@ export async function serveService(options = {}) {
         await closeResources();
         throw error;
     }
-    const { port } = http.address();
-    return {
-        http,
-        url: `http://${host}:${port}`,
-        port,
-        registry,
-        ...(recovered ? { recovered } : {}),
-        close: async () => {
-            await closeHttpServer(http);
-            await closeResources();
-        },
-    };
 }
 //# sourceMappingURL=serve.js.map