@agent-native/core 0.168.7 → 0.168.10

package/corpus/templates/factory/actions/create-factory.ts

@@ -0,0 +1,211 @@
+import { defineAction } from "@agent-native/core/action";
+import { buildDeepLink } from "@agent-native/core/server";
+import { and, eq } from "drizzle-orm";
+import { z } from "zod";
+
+import { getDb } from "../server/db/index.js";
+import {
+  factoryDefinitions,
+  factoryGraphVersions,
+  triageConfig,
+} from "../server/db/schema.js";
+import {
+  minimalFactoryGraph,
+  normalizeFactoryGraph,
+} from "../server/factory-graph/contracts.js";
+import {
+  resolveEnabledAutomations,
+  isFactoryIdConflict,
+  isFactorySlackChannelConflict,
+} from "../server/lib/factory-automation-plan.js";
+import {
+  assertUniqueSlackChannelForFactory,
+  factoryConfigRowId,
+  resolveUniqueFactoryId,
+} from "../server/lib/factory-scope.js";
+import {
+  requireWorkspaceMember,
+  workspaceMemberIdentityFromContext,
+} from "../server/lib/require-workspace-member.js";
+import {
+  ensureFactoryAutomations,
+  removeFactoryAutomationResources,
+  syncFactoryAutomationEnabledStates,
+} from "../server/plugins/factory-scheduler-job.js";
+import { stableId } from "../server/triage/ids.js";
+
+export default defineAction({
+  description:
+    "Create a new Factory with a minimal blueprint, optional observation settings, and seeded automations. Name is required; sources and automations are optional.",
+  schema: z.object({
+    name: z.string().trim().min(1).max(120),
+    description: z.string().trim().max(500).optional(),
+    slackChannelId: z.string().trim().max(128).optional(),
+    slackChannelName: z.string().trim().max(200).optional(),
+    observeSlack: z.boolean().optional(),
+    repository: z.string().trim().max(256).optional(),
+    observeGithub: z.boolean().optional(),
+    sentryOrgSlug: z.string().trim().max(200).optional(),
+    sentryProjectSlug: z.string().trim().max(200).optional(),
+    sentryEnvironment: z.string().trim().max(200).optional(),
+    observeSentry: z.boolean().optional(),
+  }),
+  http: { method: "POST" },
+  link: ({ result }) => ({
+    url: buildDeepLink({
+      app: "factory",
+      view: "factory",
+      params: { factoryId: result.factoryId },
+    }),
+    label: `Open ${result.name} in Factory`,
+  }),
+  run: async (input, context) => {
+    const { userEmail, orgId } = await requireWorkspaceMember(
+      workspaceMemberIdentityFromContext(context),
+    );
+    const db = getDb();
+    const description = input.description?.trim() ?? "";
+    const graph = normalizeFactoryGraph(
+      minimalFactoryGraph(input.name, description),
+    );
+    const now = new Date().toISOString();
+    const automationPlan = resolveEnabledAutomations({
+      observeSlack: input.observeSlack === true,
+      slackChannelId: input.slackChannelId,
+      observeGithub: input.observeGithub === true,
+      repository: input.repository,
+      observeSentry: input.observeSentry === true,
+      sentryOrgSlug: input.sentryOrgSlug,
+      sentryProjectSlug: input.sentryProjectSlug,
+    });
+
+    const MAX_FACTORY_CREATE_ATTEMPTS = 5;
+    let factoryId = "";
+    for (let attempt = 0; attempt < MAX_FACTORY_CREATE_ATTEMPTS; attempt++) {
+      factoryId = await resolveUniqueFactoryId(db, orgId, input.name);
+      const versionId = stableId("factory-graph", orgId, factoryId, "1");
+      try {
+        await db.transaction(async (tx) => {
+          await tx.insert(factoryDefinitions).values({
+            id: factoryId,
+            name: input.name,
+            description,
+            prompt: "",
+            graphVersion: 1,
+            graphJson: JSON.stringify(graph),
+            createdAt: now,
+            updatedAt: now,
+            ownerEmail: userEmail,
+            orgId,
+          });
+          await tx.insert(factoryGraphVersions).values({
+            id: versionId,
+            factoryId,
+            version: 1,
+            graphJson: JSON.stringify(graph),
+            source: "manual",
+            changeSummary: "Created from the new factory dialog.",
+            createdAt: now,
+            createdBy: userEmail,
+            ownerEmail: userEmail,
+            orgId,
+          });
+
+          if (automationPlan.hasConfig) {
+            const slackChannelId = input.slackChannelId?.trim() || null;
+            await assertUniqueSlackChannelForFactory(
+              tx as unknown as typeof db,
+              orgId,
+              factoryId,
+              slackChannelId,
+            );
+            await tx.insert(triageConfig).values({
+              id: factoryConfigRowId(orgId, factoryId),
+              factoryId,
+              slackWorkspace: "primary",
+              slackChannelId,
+              slackChannelName: input.slackChannelName?.trim() || null,
+              builderSlackUserId: null,
+              pollingEnabled: automationPlan.pollingEnabled ? 1 : 0,
+              githubPollingEnabled: automationPlan.githubPollingEnabled ? 1 : 0,
+              sentryPollingEnabled: automationPlan.sentryPollingEnabled ? 1 : 0,
+              sentryOrgSlug: input.sentryOrgSlug?.trim() || null,
+              sentryProjectSlug: input.sentryProjectSlug?.trim() || null,
+              sentryEnvironment: input.sentryEnvironment?.trim() || null,
+              repository: input.repository?.trim() || null,
+              automationFailureAlertsEnabled: 1,
+              automationFailureAlertEmail: null,
+              createdAt: now,
+              updatedAt: now,
+              ownerEmail: userEmail,
+              orgId,
+            });
+          }
+        });
+        break;
+      } catch (error) {
+        if (isFactorySlackChannelConflict(error)) {
+          throw new Error(
+            "That Slack channel is already used by another Factory in this workspace.",
+          );
+        }
+        if (
+          isFactoryIdConflict(error) &&
+          attempt < MAX_FACTORY_CREATE_ATTEMPTS - 1
+        ) {
+          continue;
+        }
+        throw error;
+      }
+    }
+    if (!factoryId) {
+      throw new Error("Could not allocate a unique factory id.");
+    }
+
+    try {
+      await ensureFactoryAutomations(userEmail, orgId, factoryId, {
+        enabledNames: automationPlan.enabledNames,
+      });
+      if (automationPlan.enabledNames.size > 0) {
+        await syncFactoryAutomationEnabledStates(userEmail, orgId, factoryId, [
+          ...automationPlan.enabledNames,
+        ]);
+      }
+    } catch (error) {
+      await removeFactoryAutomationResources(orgId, factoryId);
+      await db
+        .delete(triageConfig)
+        .where(
+          and(
+            eq(triageConfig.orgId, orgId),
+            eq(triageConfig.factoryId, factoryId),
+          ),
+        );
+      await db
+        .delete(factoryGraphVersions)
+        .where(
+          and(
+            eq(factoryGraphVersions.orgId, orgId),
+            eq(factoryGraphVersions.factoryId, factoryId),
+          ),
+        );
+      await db
+        .delete(factoryDefinitions)
+        .where(
+          and(
+            eq(factoryDefinitions.id, factoryId),
+            eq(factoryDefinitions.orgId, orgId),
+          ),
+        );
+      throw error;
+    }
+
+    return {
+      ok: true,
+      factoryId,
+      name: input.name,
+      graphVersion: 1,
+      enabledAutomations: [...automationPlan.enabledNames],
+    };
+  },
+});

package/corpus/templates/factory/actions/evaluate-triage-item.ts

@@ -11,6 +11,12 @@ import {
   triageItems,
   triageRules,
 } from "../server/db/schema.js";
+import { DEFAULT_FACTORY_ID } from "../server/factory-graph/store.js";
+import {
+  factoryIdSchema,
+  orgFactoryItemFilter,
+  orgFactoryRuleFilter,
+} from "../server/lib/factory-scope.js";
 import {
   requireWorkspaceMember,
   workspaceMemberIdentityFromContext,
@@ -25,9 +31,12 @@ import { evaluateStructuredGuards } from "../server/triage/guards.js";
 export default defineAction({
   description:
     "Triage one Factory item against enabled rules and append structured guard decisions. This records proposals only and never changes a provider.",
-  schema: z.object({ itemId: z.string().min(1) }),
+  schema: z.object({
+    factoryId: factoryIdSchema.default(DEFAULT_FACTORY_ID),
+    itemId: z.string().min(1),
+  }),
   http: { method: "POST" },
-  run: async ({ itemId }, context) => {
+  run: async ({ factoryId, itemId }, context) => {
     const { userEmail, orgId } = await requireWorkspaceMember(
       workspaceMemberIdentityFromContext(context),
     );
@@ -36,7 +45,12 @@ export default defineAction({
       await db
         .select()
         .from(triageItems)
-        .where(and(eq(triageItems.id, itemId), eq(triageItems.orgId, orgId)))
+        .where(
+          and(
+            eq(triageItems.id, itemId),
+            orgFactoryItemFilter(orgId, factoryId),
+          ),
+        )
         .limit(1)
     )[0];
     if (!item) throw new Error("Triage item not found");
@@ -44,7 +58,9 @@ export default defineAction({
     const rules = await db
       .select()
       .from(triageRules)
-      .where(and(eq(triageRules.orgId, orgId), eq(triageRules.enabled, 1)));
+      .where(
+        and(eq(triageRules.enabled, 1), orgFactoryRuleFilter(orgId, factoryId)),
+      );
     const metadata = parseMetadata(item.metadataJson);
     const evidence = {
       repository: item.repository ?? undefined,
@@ -77,6 +93,7 @@ export default defineAction({
         {
           action: "evaluate-triage-item",
           kind: "decision",
+          factoryId,
           status: "skipped",
           itemId,
           source: item.source,
@@ -116,6 +133,7 @@ export default defineAction({
         createdAt: now,
         ownerEmail: userEmail,
         orgId,
+        factoryId,
       };
     });
 
@@ -131,7 +149,12 @@ export default defineAction({
             : "shadow_decided",
           updatedAt: now,
         })
-        .where(and(eq(triageItems.id, itemId), eq(triageItems.orgId, orgId)));
+        .where(
+          and(
+            eq(triageItems.id, itemId),
+            orgFactoryItemFilter(orgId, factoryId),
+          ),
+        );
     });
 
     for (const decision of decisions) {
@@ -141,6 +164,7 @@ export default defineAction({
         {
           action: "evaluate-triage-item",
           kind: "decision",
+          factoryId,
           itemId,
           source: item.source,
           sourceUrl: item.sourceUrl,

package/corpus/templates/factory/actions/get-factory-graph.ts

@@ -28,7 +28,7 @@ export default defineAction({
     const row = await readFactoryDefinition(orgId, factoryId);
     const fallback = defaultFactoryDefinition();
     const graph = row ? parseFactoryGraph(row.graphJson) : fallback.graph;
-    const metrics = await readFactoryMetrics(orgId);
+    const metrics = await readFactoryMetrics(orgId, factoryId);
 
     const metricValues: Record<string, number> = {
       items: metrics.totalItems,

package/corpus/templates/factory/actions/get-slack-feedback-context.ts

@@ -3,7 +3,13 @@ import { and, eq } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb } from "../server/db/index.js";
-import { triageConfig, triageItems } from "../server/db/schema.js";
+import { triageItems } from "../server/db/schema.js";
+import { DEFAULT_FACTORY_ID } from "../server/factory-graph/store.js";
+import {
+  factoryIdSchema,
+  orgFactoryItemFilter,
+  readTriageConfigRow,
+} from "../server/lib/factory-scope.js";
 import {
   requireWorkspaceMember,
   workspaceMemberIdentityFromContext,
@@ -14,10 +20,13 @@ import { createSlackReader } from "../server/triage/slack-client.js";
 export default defineAction({
   description:
     "Read the bounded full Slack thread for one Factory feedback item. Use this before deciding whether a report is a clear bug; unreadable or truncated context is not a green light.",
-  schema: z.object({ itemId: z.string().min(1) }),
+  schema: z.object({
+    factoryId: factoryIdSchema.default(DEFAULT_FACTORY_ID),
+    itemId: z.string().min(1),
+  }),
   http: { method: "GET" },
   readOnly: true,
-  run: async ({ itemId }, context) => {
+  run: async ({ factoryId, itemId }, context) => {
     const { userEmail, orgId } = await requireWorkspaceMember(
       workspaceMemberIdentityFromContext(context),
     );
@@ -25,7 +34,12 @@ export default defineAction({
       await getDb()
         .select()
         .from(triageItems)
-        .where(and(eq(triageItems.id, itemId), eq(triageItems.orgId, orgId)))
+        .where(
+          and(
+            eq(triageItems.id, itemId),
+            orgFactoryItemFilter(orgId, factoryId),
+          ),
+        )
         .limit(1)
     )[0];
     if (!item) throw new Error("Factory item not found.");
@@ -33,13 +47,7 @@ export default defineAction({
       throw new Error("Factory item is not a readable Slack feedback item.");
     }
 
-    const config = (
-      await getDb()
-        .select({ slackWorkspace: triageConfig.slackWorkspace })
-        .from(triageConfig)
-        .where(and(eq(triageConfig.id, orgId), eq(triageConfig.orgId, orgId)))
-        .limit(1)
-    )[0];
+    const config = await readTriageConfigRow(getDb(), orgId, factoryId);
     const workspace =
       config?.slackWorkspace === "secondary" ? "secondary" : "primary";
     const slack = createSlackReader({ ownerEmail: userEmail, orgId });
@@ -66,6 +74,7 @@ export default defineAction({
           messageCount: messages.length,
         },
       },
+      factoryId,
     );
 
     return {

package/corpus/templates/factory/actions/get-triage-config.ts

@@ -1,10 +1,13 @@
 import { defineAction } from "@agent-native/core/action";
 import { getEmailReadiness } from "@agent-native/core/server";
-import { and, eq } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb } from "../server/db/index.js";
-import { triageConfig } from "../server/db/schema.js";
+import { DEFAULT_FACTORY_ID } from "../server/factory-graph/store.js";
+import {
+  factoryIdSchema,
+  readTriageConfigRow,
+} from "../server/lib/factory-scope.js";
 import {
   requireWorkspaceMember,
   workspaceMemberIdentityFromContext,
@@ -12,24 +15,21 @@ import {
 
 export default defineAction({
   description:
-    "Read Factory observation settings for the active workspace. Secret values are never returned.",
-  schema: z.object({}),
+    "Read Factory observation settings for the selected factory. Secret values are never returned.",
+  schema: z.object({
+    factoryId: factoryIdSchema.default(DEFAULT_FACTORY_ID),
+  }),
   http: { method: "GET" },
   readOnly: true,
-  run: async (_, context) => {
+  run: async ({ factoryId }, context) => {
     const { orgId } = await requireWorkspaceMember(
       workspaceMemberIdentityFromContext(context),
     );
     const emailReadiness = await getEmailReadiness();
-    const row = (
-      await getDb()
-        .select()
-        .from(triageConfig)
-        .where(and(eq(triageConfig.id, orgId), eq(triageConfig.orgId, orgId)))
-        .limit(1)
-    )[0];
+    const row = await readTriageConfigRow(getDb(), orgId, factoryId);
     if (!row) {
       return {
+        factoryId,
         slackWorkspace: "primary",
         slackChannelId: null,
         slackChannelName: null,
@@ -51,6 +51,7 @@ export default defineAction({
     }
     return {
       ...row,
+      factoryId,
       pollingEnabled: row.pollingEnabled === 1,
       githubPollingEnabled: row.githubPollingEnabled === 1,
       sentryPollingEnabled: row.sentryPollingEnabled === 1,

package/corpus/templates/factory/actions/get-triage-item.ts

@@ -9,6 +9,14 @@ import {
   triageItems,
   triageRuns,
 } from "../server/db/schema.js";
+import { DEFAULT_FACTORY_ID } from "../server/factory-graph/store.js";
+import {
+  factoryIdSchema,
+  orgFactoryDecisionFilter,
+  orgFactoryFeedbackFilter,
+  orgFactoryItemFilter,
+  orgFactoryRunFilter,
+} from "../server/lib/factory-scope.js";
 import {
   requireWorkspaceMember,
   workspaceMemberIdentityFromContext,
@@ -18,10 +26,13 @@ import { recordFactoryAudit } from "../server/triage/audit.js";
 export default defineAction({
   description:
     "Inspect one Factory item, including its append-only shadow decisions, feedback, and run reconciliation state.",
-  schema: z.object({ itemId: z.string().min(1) }),
+  schema: z.object({
+    factoryId: factoryIdSchema.default(DEFAULT_FACTORY_ID),
+    itemId: z.string().min(1),
+  }),
   http: { method: "GET" },
   readOnly: true,
-  run: async ({ itemId }, context) => {
+  run: async ({ factoryId, itemId }, context) => {
     const { userEmail, orgId } = await requireWorkspaceMember(
       workspaceMemberIdentityFromContext(context),
     );
@@ -30,7 +41,12 @@ export default defineAction({
       await db
         .select()
         .from(triageItems)
-        .where(and(eq(triageItems.id, itemId), eq(triageItems.orgId, orgId)))
+        .where(
+          and(
+            eq(triageItems.id, itemId),
+            orgFactoryItemFilter(orgId, factoryId),
+          ),
+        )
         .limit(1)
     )[0];
     if (!item) throw new Error("Triage item not found");
@@ -41,19 +57,24 @@ export default defineAction({
       .where(
         and(
           eq(triageDecisions.itemId, itemId),
-          eq(triageDecisions.orgId, orgId),
+          orgFactoryDecisionFilter(orgId, factoryId),
         ),
       )
       .orderBy(asc(triageDecisions.createdAt));
     const feedback = await db
       .select()
       .from(triageFeedback)
-      .where(eq(triageFeedback.orgId, orgId))
+      .where(orgFactoryFeedbackFilter(orgId, factoryId))
       .orderBy(asc(triageFeedback.createdAt));
     const runs = await db
       .select()
       .from(triageRuns)
-      .where(and(eq(triageRuns.itemId, itemId), eq(triageRuns.orgId, orgId)))
+      .where(
+        and(
+          eq(triageRuns.itemId, itemId),
+          orgFactoryRunFilter(orgId, factoryId),
+        ),
+      )
       .orderBy(asc(triageRuns.startedAt));
 
     const matchingFeedback = feedback.filter((entry) =>
@@ -76,6 +97,7 @@ export default defineAction({
           coverage: item.coverage,
         },
       },
+      factoryId,
     );
 
     return {

package/corpus/templates/factory/actions/govern-agent-native-pull-request.ts

@@ -6,10 +6,17 @@ import { resolveConnectorSecret } from "../server/connectors/credentials.js";
 import { getDb } from "../server/db/index.js";
 import {
   triageDecisions,
-  triageConfig,
   triageItems,
   triageRuns,
 } from "../server/db/schema.js";
+import { DEFAULT_FACTORY_ID } from "../server/factory-graph/store.js";
+import {
+  factoryIdSchema,
+  orgFactoryItemFilter,
+  orgFactoryRunFilter,
+  orgFactoryScopedItemWhere,
+  readTriageConfigRow,
+} from "../server/lib/factory-scope.js";
 import { requireFactoryAutomation } from "../server/lib/require-factory-automation.js";
 import {
   requireWorkspaceMember,
@@ -50,11 +57,12 @@ function requiredAiServicesEnv(
 async function hasVerifiedFactoryRun(input: {
   itemId: string | undefined;
   orgId: string;
+  factoryId: string;
   pullRequestBody: string | null;
   headRef: string;
 }): Promise<boolean> {
   const db = getDb();
-  const runConditions = [eq(triageRuns.orgId, input.orgId)];
+  const runConditions = [orgFactoryRunFilter(input.orgId, input.factoryId)];
   if (input.itemId) {
     runConditions.push(eq(triageRuns.itemId, input.itemId));
   }
@@ -91,7 +99,7 @@ async function hasVerifiedFactoryRun(input: {
   const items = await db
     .select({ id: triageItems.id, sourceUrl: triageItems.sourceUrl })
     .from(triageItems)
-    .where(eq(triageItems.orgId, input.orgId))
+    .where(orgFactoryItemFilter(input.orgId, input.factoryId))
     .orderBy(desc(triageItems.updatedAt))
     .limit(100);
   return items.some((item) => {
@@ -108,6 +116,7 @@ export default defineAction({
   description:
     "Govern one agent-native pull request after fetching bounded GitHub and ai-services evidence. Auto-approve only under the current review-prs membership, owner, evidence, and ultra-scary gates. Never auto-merge. Clips, Design, and Content feedback remains owner-managed while their verified PR-owner exceptions still apply.",
   schema: z.object({
+    factoryId: factoryIdSchema.default(DEFAULT_FACTORY_ID),
     repo: z.string().trim().min(1).max(256),
     pullRequestNumber: z.number().int().positive(),
     itemId: z.string().min(1).optional(),
@@ -118,6 +127,7 @@ export default defineAction({
   http: false,
   run: async (
     {
+      factoryId,
       repo,
       pullRequestNumber,
       itemId,
@@ -130,15 +140,16 @@ export default defineAction({
     const { userEmail, orgId } = await requireWorkspaceMember(
       workspaceMemberIdentityFromContext(context),
     );
-    await requireFactoryAutomation(context, { userEmail, orgId }, "governance");
+    await requireFactoryAutomation(
+      context,
+      { userEmail, orgId },
+      "governance",
+      factoryId,
+    );
     const repository = repositoryRef(repo);
     const configuredRepository = (
-      await getDb()
-        .select({ repository: triageConfig.repository })
-        .from(triageConfig)
-        .where(and(eq(triageConfig.id, orgId), eq(triageConfig.orgId, orgId)))
-        .limit(1)
-    )[0]?.repository;
+      await readTriageConfigRow(getDb(), orgId, factoryId)
+    )?.repository;
     if (!configuredRepository || configuredRepository.trim() !== repo.trim()) {
       throw new Error(
         "PR governance is restricted to the configured Factory repository.",
@@ -152,7 +163,7 @@ export default defineAction({
             pullRequestNumber: triageItems.pullRequestNumber,
           })
           .from(triageItems)
-          .where(and(eq(triageItems.id, itemId), eq(triageItems.orgId, orgId)))
+          .where(orgFactoryScopedItemWhere(itemId, orgId, factoryId))
           .limit(1)
       )[0];
       if (
@@ -178,7 +189,7 @@ export default defineAction({
             status: "pr_observed",
             updatedAt: new Date().toISOString(),
           })
-          .where(and(eq(triageItems.id, itemId), eq(triageItems.orgId, orgId)));
+          .where(orgFactoryScopedItemWhere(itemId, orgId, factoryId));
       }
       return {
         ok: true,
@@ -222,6 +233,7 @@ export default defineAction({
             "Skipped the pull request because it already has a current non-dismissed approval.",
           details: { repo, pullRequestNumber },
         },
+        factoryId,
       );
       if (itemId) {
         await getDb()
@@ -230,7 +242,7 @@ export default defineAction({
             status: "pr_observed",
             updatedAt: new Date().toISOString(),
           })
-          .where(and(eq(triageItems.id, itemId), eq(triageItems.orgId, orgId)));
+          .where(orgFactoryScopedItemWhere(itemId, orgId, factoryId));
       }
       return {
         ok: true,
@@ -267,6 +279,7 @@ export default defineAction({
     const factoryTriggered = await hasVerifiedFactoryRun({
       itemId,
       orgId,
+      factoryId,
       pullRequestBody: pullRequest.body,
       headRef: pullRequest.headRef,
     });
@@ -312,6 +325,7 @@ export default defineAction({
           guardResults: governance.guardResults,
         },
       },
+      factoryId,
     );
 
     if (itemId) {
@@ -319,7 +333,7 @@ export default defineAction({
         await getDb()
           .select()
           .from(triageItems)
-          .where(and(eq(triageItems.id, itemId), eq(triageItems.orgId, orgId)))
+          .where(orgFactoryScopedItemWhere(itemId, orgId, factoryId))
           .limit(1)
       )[0];
       if (!item) throw new Error("Factory item not found for PR governance.");
@@ -348,6 +362,7 @@ export default defineAction({
           createdAt: new Date().toISOString(),
           ownerEmail: userEmail,
           orgId,
+          factoryId,
         })
         .onConflictDoNothing();
     }
@@ -360,7 +375,7 @@ export default defineAction({
             status: governance.ownerOwnedArea ? "needs_manual" : "pr_observed",
             updatedAt: new Date().toISOString(),
           })
-          .where(and(eq(triageItems.id, itemId), eq(triageItems.orgId, orgId)));
+          .where(orgFactoryScopedItemWhere(itemId, orgId, factoryId));
       }
       return {
         ok: true,
@@ -381,7 +396,7 @@ export default defineAction({
             status: triageItems.status,
           })
           .from(triageItems)
-          .where(and(eq(triageItems.id, itemId), eq(triageItems.orgId, orgId)))
+          .where(orgFactoryScopedItemWhere(itemId, orgId, factoryId))
           .limit(1)
       )[0];
       if (!item) throw new Error("Factory item disappeared after PR approval.");
@@ -410,7 +425,7 @@ export default defineAction({
             status: "auto_approved",
             updatedAt: new Date().toISOString(),
           })
-          .where(and(eq(triageItems.id, itemId), eq(triageItems.orgId, orgId)));
+          .where(orgFactoryScopedItemWhere(itemId, orgId, factoryId));
       }
     } else {
       approvalUrl = (
@@ -437,6 +452,7 @@ export default defineAction({
           "Approved the pull request under the current review-prs policy.",
         details: { repo, pullRequestNumber, approvalUrl },
       },
+      factoryId,
     );
     return {
       ok: true,