@edgehero/pi-dispatch-receiver 1.1.0 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edgehero/pi-dispatch-receiver",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "type": "module",
   "description": "Webhook receiver for pi-dispatch: the always-on edge that verifies GitHub, GitLab, Forgejo and Azure DevOps deliveries and enqueues (at most) one job per event for the worker.",
   "keywords": [
@@ -45,7 +45,7 @@
   },
   "dependencies": {
     "@octokit/webhooks": "14.2.0",
-    "@edgehero/pi-dispatch": "^1.0.0",
+    "@edgehero/pi-dispatch": "^1.4.0",
     "bullmq": "5.80.4",
     "ioredis": "5.11.1"
   }

package/src/azure-members.mjs

@@ -88,7 +88,10 @@ export function makeResolveAzureAuthority({ orgUrl, token, fetchFn = fetch }) {
 		try {
 			return { body: await res.json(), continuation: continuation || null };
 		} catch (err) {
-			return { indeterminate: `azure lookup returned unparseable JSON: ${err?.message ?? "unknown"}` };
+			// A FIXED reason, never err.message: V8's JSON.parse errors quote the offending input,
+			// so a failed res.json() here would carry response-body bytes into a log line -- the
+			// no-pii-in-logs rule the github resolver states, applied to its elders (issue #231).
+			return { indeterminate: "azure lookup returned unparseable JSON" };
 		}
 	}
 

package/src/close.mjs

@@ -0,0 +1,34 @@
+/**
+ * The ONE derivation of "which close rule matches this delivery" (issue #231), shared by every
+ * forge's close route and by the GitHub arm's wants-authority predicate. Two copies of a gate
+ * decision is the shape filter.mjs's prAuthorOk comment warns against, and here the two callers are
+ * a NETWORK CALL apart: the receiver asks "does any rule want this close" before spending a
+ * permission lookup, and the filter asks it again to route -- if those two answers could drift, a
+ * delivery could cost a lookup it then drops, or worse, route a close the lookup never gated.
+ *
+ * Total and throw-free like predicate.mjs: rules are loader-validated shapes, the inputs are
+ * adversarial payload fields, and the receiver's gates must never throw on data.
+ */
+
+/**
+ * Find the first rule (file order, firstMatchingRule's convention) whose action set has this close
+ * word and whose `number` narrowing (when present) names this item. Returns:
+ *   { rule }                                  -- matched; the caller gates and enqueues
+ *   { reason: "close-number-not-matched" }    -- a close rule is armed but names a different item
+ *   { reason: "no-matching-close-trigger" }   -- nothing armed wants this close
+ * The two refusal tokens are distinct because they call for different operator responses: "your
+ * one-shot exists and this was a different item closing" and "nothing is armed" read nothing alike
+ * from a panel.
+ */
+export function findCloseRule(rules, closeWord, number) {
+	let numberSkipped = false;
+	for (const rule of rules ?? []) {
+		if (!rule.actions?.has(closeWord)) continue;
+		if (rule.number !== undefined && rule.number !== number) {
+			numberSkipped = true;
+			continue;
+		}
+		return { rule };
+	}
+	return { reason: numberSkipped ? "close-number-not-matched" : "no-matching-close-trigger" };
+}

package/src/config.mjs

@@ -32,7 +32,7 @@
 
 import { existsSync, readFileSync } from "node:fs";
 import { configError, loadGitHubAuth, positiveInt } from "@edgehero/pi-dispatch/config";
-import { FORGE_KINDS, parseTriggers } from "@edgehero/pi-dispatch/triggers";
+import { FORGE_KINDS, PR_CLOSE_ACTIONS, parseTriggers } from "@edgehero/pi-dispatch/triggers";
 
 // Cwd-relative, matching what `pi-dispatch init` scaffolds (and the admin's default): the receiver's
 // default must be the file init just told the operator it created, not a demo buried in the repo.
@@ -102,7 +102,13 @@ export function loadReceiverConfig(env = process.env, { readFile = readFileSync,
  * credential lying around is not a statement that this receiver terminates GitHub webhooks.
  */
 function decideServesGithub(env, githubGroup) {
-	const hasGithubTriggers = githubGroup.label.length > 0 || githubGroup.comment !== null || githubGroup.pullRequest.length > 0;
+	// The close groups count too (issue #231): a deployment whose ONLY github rule is a close trigger
+	// must still mount `/`, require WEBHOOK_SECRET and build auth, or the one-shot the operator armed
+	// can never fire -- and the receiver would report nothing, the silent no-op this file's header
+	// calls the worst outcome. Conversely a deployment whose last github one-shot is SPENT stops
+	// counting here at its next boot (the sentinel groups nowhere), which is deliberate: nothing is
+	// left to serve, and INT-TRIGGERS-FILE-CONTRACT states it.
+	const hasGithubTriggers = githubGroup.label.length > 0 || githubGroup.comment !== null || githubGroup.pullRequest.length > 0 || githubGroup.issue.length > 0 || githubGroup.prClose.length > 0;
 	// `loadGitHubAuth` has already refused a garbled value by the time we get here, so anything non-empty
 	// here is one of pat|gh|app -- a real choice, not a typo we would be reading as consent.
 	const explicitAuthSource = env.GITHUB_AUTH_SOURCE !== undefined && env.GITHUB_AUTH_SOURCE !== "";
@@ -228,7 +234,11 @@ function loadAzureConfig(env) {
  * `{ github: <group>, gitlab: <group>, knownFlows }` where each group is:
  *   - `label`:       ordered `{ index, predicate, flow, command, packages, image }` rules (first match wins in the filter).
  *   - `comment`:     the single `{ index, phrase, defaultFlow, command, packages, image }` (or null when no comment trigger is configured).
- *   - `pullRequest`: ordered `{ index, actions:Set, predicate, flow, command, packages, image }` rules.
+ *   - `pullRequest`: ordered `{ index, actions:Set, predicate, flow, command, packages, image }` rules (never a close-only rule).
+ *   - `issue`:       ordered `{ index, actions:Set, number?, once?, ... }` close rules (issue #231).
+ *   - `prClose`:     ordered close-only pull_request rules, same shape as `issue` -- split from
+ *                    `pullRequest` so the closer-gated route and the author-gated route can never read
+ *                    each other's rules (the loader's no-mixing refusal makes the split total).
  * and `knownFlows` is every webhook `run.flow`, so a comment's `<phrase> <flow>` override cannot summon an
  * unlisted flow. A rule carries EITHER `flow` or `command` (issue #189; the shared parser enforces the
  * exclusivity): a command rule's match dispatches a registered pi extension command in the container, so
@@ -283,13 +293,28 @@ function loadTriggers(env, readFile, fileExists) {
 		}
 		const group = groups[run.kind];
 		if (on.type === "label") {
-			group.label.push({ index, predicate: { any: on.any, all: on.all, none: on.none }, flow: run.flow, command: run.command, packages: run.packages, image: run.image, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, replicas: run.replicas, repository: run.repository });
+			group.label.push({ index, predicate: { any: on.any, all: on.all, none: on.none }, flow: run.flow, command: run.command, packages: run.packages, image: run.image, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, secrets: run.secrets, secretsProfile: run.secretsProfile, replicas: run.replicas, repository: run.repository });
 		} else if (on.type === "comment") {
-			group.comment = { index, phrase: on.phrase, defaultFlow: run.flow, command: run.command, packages: run.packages, image: run.image, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, replicas: run.replicas, repository: run.repository }; // parseTriggers guarantees at most one per forge
+			group.comment = { index, phrase: on.phrase, defaultFlow: run.flow, command: run.command, packages: run.packages, image: run.image, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, secrets: run.secrets, secretsProfile: run.secretsProfile, replicas: run.replicas, repository: run.repository }; // parseTriggers guarantees at most one per forge
 		} else if (on.type === "pull_request") {
-			// `reviewStates` is null rather than an empty Set when unnarrowed: the filter tests it for
-			// presence, and an empty Set would read as "no verdict matches" and silently refuse everything.
-			group.pullRequest.push({ index, actions: new Set(on.action), reviewStates: on.reviewState ? new Set(on.reviewState) : null, predicate: { any: on.any, all: on.all, none: on.none }, flow: run.flow, command: run.command, packages: run.packages, image: run.image, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, replicas: run.replicas });
+			// The close-only split (issue #231): a close rule routes through the close gate (the CLOSER's
+			// resolved authority) and every other PR rule through the author gate, so they live in separate
+			// groups and neither route ever re-derives the distinction -- the loader already refused any
+			// list mixing the close word with another action, which is what makes this split total. The
+			// split reads the SHARED close-word table, never a re-typed word.
+			const closeWord = PR_CLOSE_ACTIONS[run.kind];
+			if (closeWord !== undefined && on.action.includes(closeWord)) {
+				group.prClose.push({ index, actions: new Set(on.action), number: on.number, once: on.once, flow: run.flow, command: run.command, packages: run.packages, image: run.image, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, secrets: run.secrets, secretsProfile: run.secretsProfile, replicas: run.replicas });
+			} else {
+				// `reviewStates` is null rather than an empty Set when unnarrowed: the filter tests it for
+				// presence, and an empty Set would read as "no verdict matches" and silently refuse everything.
+				group.pullRequest.push({ index, actions: new Set(on.action), reviewStates: on.reviewState ? new Set(on.reviewState) : null, predicate: { any: on.any, all: on.all, none: on.none }, flow: run.flow, command: run.command, packages: run.packages, image: run.image, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, secrets: run.secrets, secretsProfile: run.secretsProfile, replicas: run.replicas });
+			}
+		} else if (on.type === "issue") {
+			// The close-trigger kind (issue #231). No predicate and no reviewStates by construction (the
+			// loader refused both), and `number`/`once` ride conditionally-present exactly as the loader
+			// normalized them -- the filter's close route reads them, nothing else does.
+			group.issue.push({ index, actions: new Set(on.action), number: on.number, once: on.once, flow: run.flow, command: run.command, packages: run.packages, image: run.image, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, secrets: run.secrets, secretsProfile: run.secretsProfile, replicas: run.replicas });
 		}
 	}
 
@@ -297,7 +322,7 @@ function loadTriggers(env, readFile, fileExists) {
 }
 
 function emptyGroup() {
-	return { label: [], comment: null, pullRequest: [] };
+	return { label: [], comment: null, pullRequest: [], issue: [], prClose: [] };
 }
 
 /** The triggers file path the receiver reads (env override or the cwd default matching what `pi-dispatch init` scaffolds). */

package/src/filter-azure.mjs

@@ -114,6 +114,11 @@ export function filterAzure(subset, triggers, knownFlows, selfId, authorized, de
 		// /job/event.json, and a worker-host path in an agent-readable file is the leak prepare-local's
 		// basename(folder) restraint already exists to prevent.
 		...(resolved.skillsDir !== undefined ? { skillsDir: resolved.skillsDir } : {}),
+		// REQ-TRIGGER-SECRETS. Conditional exactly like skillsDir above, so a trigger that binds no
+		// secret enqueues the job data it always has. The map holds REFERENCES, never values: the
+		// receiver has no resolver and reaches no vault -- the worker resolves them pre-spend.
+		...(resolved.secrets !== undefined ? { secrets: resolved.secrets } : {}),
+		...(resolved.secretsProfile !== undefined ? { secretsProfile: resolved.secretsProfile } : {}),
 		...(resolved.instructions !== undefined ? { instructions: resolved.instructions } : {}),
 		...(resolved.resume !== undefined ? { resume: resolved.resume } : {}),
 		// How many independent sandboxes race this flow (REQ-REPLICA-RUNS). At JOB level and conditional for the
@@ -181,6 +186,8 @@ function matchLabelRules(subset, triggers, labels, action) {
 		packages: rule.packages,
 		image: rule.image,
 		skillsDir: rule.skillsDir,
+		secrets: rule.secrets,
+		secretsProfile: rule.secretsProfile,
 		instructions: rule.instructions,
 		resume: rule.resume,
 		replicas: rule.replicas,
@@ -222,6 +229,8 @@ function routeComment(subset, triggers, knownFlows, targetType) {
 		packages: triggers.comment.packages,
 		image: triggers.comment.image,
 		skillsDir: triggers.comment.skillsDir,
+		secrets: triggers.comment.secrets,
+		secretsProfile: triggers.comment.secretsProfile,
 		instructions: triggers.comment.instructions,
 		resume: triggers.comment.resume,
 		replicas: triggers.comment.replicas,
@@ -252,6 +261,8 @@ function routePullRequest(subset, triggers, action) {
 			packages: rule.packages,
 			image: rule.image,
 			skillsDir: rule.skillsDir,
+			secrets: rule.secrets,
+			secretsProfile: rule.secretsProfile,
 			instructions: rule.instructions,
 			resume: rule.resume,
 			replicas: rule.replicas,

package/src/filter-forgejo.mjs

@@ -34,6 +34,7 @@
  */
 
 import { escapeRegExp, firstMatchingRule, labelSet, matchedLabel, matchesRule } from "./predicate.mjs";
+import { findCloseRule } from "./close.mjs";
 import { isRecognizedAction, mapAction } from "./forgejo-subset.mjs";
 
 const LABEL_ACTIONS = new Set(["opened", "labeled", "reopened"]);
@@ -84,6 +85,17 @@ export function filterForgejo(eventName, subset, triggers, knownFlows, selfId, a
 		if (action === null) return unactionable();
 		if (eventName === "issues" && LABEL_ACTIONS.has(action)) {
 			resolved = routeIssueLabel(subset, group);
+		} else if (eventName === "issues" && action === "closed") {
+			// The close trigger (issue #231). `group.issue` holds ONLY close rules (the loader admits no
+			// other issue kind), and this arm can never contend with the label one: `closed` is not in
+			// LABEL_ACTIONS and must not become so -- a close is a statement about an item, not a label move.
+			resolved = routeIssueClose(subset, group, authorized);
+		} else if (eventName === "pull_request" && raw === "closed") {
+			// The RAW word, for routePullRequest's reason below: the close vocabulary is the forge's own
+			// (PR_CLOSE_ACTIONS, which the loader validated the rule against). Checked BEFORE the PR_ACTIONS
+			// arm, though today they cannot overlap; `group.prClose` was split from `group.pullRequest` at
+			// load, so a close rule is unreachable from routePullRequest and vice versa.
+			resolved = routePullRequestClose(subset, group, authorized);
 		} else if (eventName === "pull_request" && PR_ACTIONS.has(action)) {
 			// The RAW word, not the mapped one. A trigger file names actions in the forge's own vocabulary
 			// (`label_updated`, `synchronized`) because that is what an operator reads in Forgejo's docs and
@@ -116,6 +128,11 @@ export function filterForgejo(eventName, subset, triggers, knownFlows, selfId, a
 		// /job/event.json, and a worker-host path in an agent-readable file is the leak prepare-local's
 		// basename(folder) restraint already exists to prevent.
 		...(resolved.skillsDir !== undefined ? { skillsDir: resolved.skillsDir } : {}),
+		// REQ-TRIGGER-SECRETS. Conditional exactly like skillsDir above, so a trigger that binds no
+		// secret enqueues the job data it always has. The map holds REFERENCES, never values: the
+		// receiver has no resolver and reaches no vault -- the worker resolves them pre-spend.
+		...(resolved.secrets !== undefined ? { secrets: resolved.secrets } : {}),
+		...(resolved.secretsProfile !== undefined ? { secretsProfile: resolved.secretsProfile } : {}),
 		...(resolved.instructions !== undefined ? { instructions: resolved.instructions } : {}),
 		...(resolved.resume !== undefined ? { resume: resolved.resume } : {}),
 		// How many independent sandboxes race this flow (REQ-REPLICA-RUNS). At JOB level and conditional for the
@@ -149,6 +166,8 @@ function routeIssueLabel(subset, triggers) {
 		packages: rule.packages, // the MATCHED rule's fields -- rules in one file may differ on them
 		image: rule.image,
 		skillsDir: rule.skillsDir,
+		secrets: rule.secrets,
+		secretsProfile: rule.secretsProfile,
 		instructions: rule.instructions,
 		resume: rule.resume,
 		replicas: rule.replicas,
@@ -195,6 +214,8 @@ function routeComment(subset, triggers, knownFlows) {
 		packages: triggers.comment.packages,
 		image: triggers.comment.image,
 		skillsDir: triggers.comment.skillsDir,
+		secrets: triggers.comment.secrets,
+		secretsProfile: triggers.comment.secretsProfile,
 		instructions: triggers.comment.instructions,
 		resume: triggers.comment.resume,
 		replicas: triggers.comment.replicas,
@@ -223,6 +244,8 @@ function routePullRequest(subset, triggers, action) {
 			packages: rule.packages,
 			image: rule.image,
 			skillsDir: rule.skillsDir,
+			secrets: rule.secrets,
+			secretsProfile: rule.secretsProfile,
 			instructions: rule.instructions,
 			resume: rule.resume,
 			replicas: rule.replicas,
@@ -239,3 +262,92 @@ function routePullRequest(subset, triggers, action) {
 	}
 	return { enqueue: false, reason: "no-matching-pr-trigger" };
 }
+
+/**
+ * Issue close path (issue #231). `findCloseRule` is the ONE derivation of "which close rule wants
+ * this delivery" (close.mjs), shared with the receiver's pre-lookup check -- two hand-rolled copies
+ * a network call apart is the drift that module's header warns against.
+ *
+ * The `closer-not-allowed` gate below is belt-and-braces and UNREACHABLE today: gate (2) in
+ * `filterForgejo` already refused every non-true verdict before routing, and on a webhook close
+ * delivery the SENDER is the closer, so the verdict that gate consumed is the closer's. It stays
+ * anyway, because this route's own contract is the closer's authority: if the global gate ever moves,
+ * or a resolver starts returning a shape it never has, a close must fail closed under its own token
+ * rather than route on a stale assumption about the caller.
+ */
+function routeIssueClose(subset, triggers, authorized) {
+	const number = subset.issue?.number;
+	// Integer or refuse, the github arms' rule: an UNNARROWED rule matches an undefined number, so a
+	// degenerate shape would otherwise enqueue a numberless target.
+	if (!Number.isInteger(number)) {
+		return { enqueue: false, reason: "missing-issue-number" };
+	}
+	// "closed" is PR_CLOSE_ACTIONS.forgejo -- the forge's own word, the one the loader validated the
+	// rule's action list against, exactly as routePullRequest matches raw vocabulary.
+	const found = findCloseRule(triggers.issue, "closed", number);
+	if (found.rule === undefined) {
+		return { enqueue: false, reason: found.reason };
+	}
+	if (authorized !== true) {
+		return { enqueue: false, reason: "closer-not-allowed" };
+	}
+	const rule = found.rule;
+	return {
+		enqueue: true,
+		...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
+		packages: rule.packages, // the MATCHED rule's fields -- rules in one file may differ on them
+		image: rule.image,
+		skillsDir: rule.skillsDir,
+		secrets: rule.secrets,
+		secretsProfile: rule.secretsProfile,
+		instructions: rule.instructions,
+		resume: rule.resume,
+		replicas: rule.replicas,
+		// `once: true` rides `matched` ONLY when armed (spreading false is a no-op), so the enqueue path
+		// can see a disarm is owed without re-reading the rule table -- and a plain close rule's matched
+		// record stays byte-identical to the other routes' shape.
+		matched: { index: rule.index, type: "issue", action: "closed", number, ...(rule.once === true && { once: true }) },
+		target: { type: "issue", number, title: subset.issue?.title, body: subset.issue?.body },
+	};
+}
+
+/** PR close path (issue #231). Same shape and same belt-and-braces closer gate as routeIssueClose. */
+function routePullRequestClose(subset, triggers, authorized) {
+	const pr = subset.pull_request;
+	// Object AND integer number, the github arm's rule: a shape without a usable number must refuse
+	// before any rule is consulted.
+	if (!pr || !Number.isInteger(pr.number)) {
+		return { enqueue: false, reason: "missing-pull-request" };
+	}
+	const found = findCloseRule(triggers.prClose, "closed", pr.number);
+	if (found.rule === undefined) {
+		return { enqueue: false, reason: found.reason };
+	}
+	if (authorized !== true) {
+		return { enqueue: false, reason: "closer-not-allowed" }; // unreachable behind gate (2) -- see routeIssueClose
+	}
+	const rule = found.rule;
+	return {
+		enqueue: true,
+		...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
+		packages: rule.packages,
+		image: rule.image,
+		skillsDir: rule.skillsDir,
+		secrets: rule.secrets,
+		secretsProfile: rule.secretsProfile,
+		instructions: rule.instructions,
+		resume: rule.resume,
+		replicas: rule.replicas,
+		// No `number` on a PR close's matched record -- parallel to routePullRequest's, where the item
+		// number is the target's business; the issue route carries it because the github design does.
+		matched: { index: rule.index, type: "pull_request", action: "closed", ...(rule.once === true && { once: true }) },
+		target: {
+			type: "pull_request",
+			number: pr.number,
+			title: pr.title,
+			body: pr.body,
+			head: pr.head,
+			base: pr.base,
+		},
+	};
+}

package/src/filter-gitlab.mjs

@@ -41,6 +41,7 @@
  */
 
 import { firstMatchingRule, labelSet, matchedLabel } from "./predicate.mjs";
+import { findCloseRule } from "./close.mjs";
 
 /**
 /** The merge-request actions a trigger may name, mirrored from the loader's gitlab vocabulary. */
@@ -75,9 +76,32 @@ export function filterGitLab(subset, triggers, knownFlows, selfId, authorized, d
 	const kind = subset.objectKind;
 	let resolved;
 	if (kind === "issue") {
-		resolved = routeLabel(subset, triggers, "issue");
+		if (subset.action === "close") {
+			// The close trigger (issue #231), tried FIRST -- and the label walk only as a FALLBACK -- because
+			// a real GitLab delivery can close and label in one call (a quick action comment, or the sidebar
+			// edited during close). One delivery, one job: when an armed close rule wants this close it fires
+			// and the label rule does NOT, so the two rule kinds cannot double-bill a single click.
+			resolved = routeIssueClose(subset, triggers, authorized);
+			if (!resolved.enqueue && resolved.reason !== "closer-not-allowed" && subset.labelChanges) {
+				// No close rule took it, and this close also MOVED labels (`changes.labels`, the exact field
+				// `addedLabels` reads for every non-open action). Label rules fired on such closes before close
+				// routing existed and must keep doing so byte-identically -- including on ANY close refusal, so
+				// a one-shot armed for a DIFFERENT item cannot eat a label trigger it was never about, and
+				// including the label walk's own refusal reasons when nothing matches. The `closer-not-allowed`
+				// exclusion is belt-and-braces with the route's own unreachable gate: a close a drifted
+				// resolver refused must stay refused, never demoted into a label job.
+				resolved = routeLabel(subset, triggers, "issue");
+			}
+		} else {
+			resolved = routeLabel(subset, triggers, "issue");
+		}
 	} else if (kind === "merge_request") {
-		resolved = routeMergeRequest(subset, triggers);
+		// An MR close routes over `group.prClose` ALONE (issue #231), with no label fallback: unlike the
+		// issue arm above, MR_ACTIONS never contained "close", so no MR rule ever fired on a close and
+		// there is nothing for a fallback to keep working. MR_ACTIONS stays untouched for the same reason
+		// in the other direction -- close rules can never reach routeMergeRequest, because the loader split
+		// them into `prClose` at group time, so the two rule kinds are mutually unreachable by construction.
+		resolved = subset.action === "close" ? routeMergeRequestClose(subset, triggers, authorized) : routeMergeRequest(subset, triggers);
 	} else if (kind === "note") {
 		resolved = routeNote(subset, triggers, knownFlows);
 	} else {
@@ -107,6 +131,11 @@ export function filterGitLab(subset, triggers, knownFlows, selfId, authorized, d
 		// /job/event.json, and a worker-host path in an agent-readable file is the leak prepare-local's
 		// basename(folder) restraint already exists to prevent.
 		...(resolved.skillsDir !== undefined ? { skillsDir: resolved.skillsDir } : {}),
+		// REQ-TRIGGER-SECRETS. Conditional exactly like skillsDir above, so a trigger that binds no
+		// secret enqueues the job data it always has. The map holds REFERENCES, never values: the
+		// receiver has no resolver and reaches no vault -- the worker resolves them pre-spend.
+		...(resolved.secrets !== undefined ? { secrets: resolved.secrets } : {}),
+		...(resolved.secretsProfile !== undefined ? { secretsProfile: resolved.secretsProfile } : {}),
 		...(resolved.instructions !== undefined ? { instructions: resolved.instructions } : {}),
 		// Conditional like packages/image, and for the same reason: an unflagged job's data must stay
 		// byte-identical to today's, so the key is absent rather than present-and-undefined.
@@ -147,6 +176,8 @@ function routeLabel(subset, triggers, targetType) {
 		packages: rule.packages,
 		image: rule.image,
 		skillsDir: rule.skillsDir,
+		secrets: rule.secrets,
+		secretsProfile: rule.secretsProfile,
 		instructions: rule.instructions,
 		resume: rule.resume,
 		replicas: rule.replicas,
@@ -208,6 +239,8 @@ function mrResult(subset, rule, matched) {
 		packages: rule.packages,
 		image: rule.image,
 		skillsDir: rule.skillsDir,
+		secrets: rule.secrets,
+		secretsProfile: rule.secretsProfile,
 		instructions: rule.instructions,
 		resume: rule.resume,
 		replicas: rule.replicas,
@@ -216,6 +249,86 @@ function mrResult(subset, rule, matched) {
 	};
 }
 
+/**
+ * Issue close path (issue #231). `findCloseRule` is the ONE derivation of "which close rule wants
+ * this delivery" (close.mjs), shared with the receiver's pre-lookup check -- two hand-rolled copies
+ * a network call apart is the drift that module's header warns against.
+ *
+ * The `closer-not-allowed` gate below is belt-and-braces and UNREACHABLE today: gate (2) in
+ * `filterGitLab` already refused every non-true verdict before routing, and on a webhook close
+ * delivery the ACTOR is the closer, so the verdict that gate consumed is the closer's. It stays
+ * anyway, because this route's own contract is the closer's authority: if the global gate ever
+ * moves, or a resolver starts returning a shape it never has, a close must fail closed under its own
+ * token rather than route on a stale assumption about the caller.
+ */
+function routeIssueClose(subset, triggers, authorized) {
+	const number = subset.target?.iid;
+	// Integer or refuse, the github arms' rule: an UNNARROWED rule matches an undefined number, so a
+	// degenerate shape would otherwise enqueue a numberless target. GitLab sends integer iids.
+	if (!Number.isInteger(number)) {
+		return { enqueue: false, reason: "missing-issue-number" };
+	}
+	// "close" is PR_CLOSE_ACTIONS.gitlab -- the forge's own word, the one the loader validated the
+	// rule's action list against. GitLab really does say "close", not "closed".
+	const found = findCloseRule(triggers?.issue, "close", number);
+	if (found.rule === undefined) {
+		return { enqueue: false, reason: found.reason };
+	}
+	if (authorized !== true) {
+		return { enqueue: false, reason: "closer-not-allowed" };
+	}
+	const rule = found.rule;
+	return {
+		enqueue: true,
+		...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
+		packages: rule.packages, // the MATCHED rule's fields -- rules in one file may differ on them
+		image: rule.image,
+		skillsDir: rule.skillsDir,
+		secrets: rule.secrets,
+		secretsProfile: rule.secretsProfile,
+		instructions: rule.instructions,
+		resume: rule.resume,
+		replicas: rule.replicas,
+		// `once: true` rides `matched` ONLY when armed (spreading false is a no-op), so the enqueue path
+		// can see a disarm is owed without re-reading the rule table -- and a plain close rule's matched
+		// record stays byte-identical to the other routes' shape.
+		matched: { index: rule.index, type: "issue", action: "close", number, ...(rule.once === true && { once: true }) },
+		target: buildTarget(subset, "issue"),
+	};
+}
+
+/** MR close path (issue #231). Same shape and same belt-and-braces closer gate as routeIssueClose. */
+function routeMergeRequestClose(subset, triggers, authorized) {
+	// The issue arm's integer guard, same reason.
+	if (!Number.isInteger(subset.target?.iid)) {
+		return { enqueue: false, reason: "missing-pull-request" };
+	}
+	const found = findCloseRule(triggers?.prClose, "close", subset.target?.iid);
+	if (found.rule === undefined) {
+		return { enqueue: false, reason: found.reason };
+	}
+	if (authorized !== true) {
+		return { enqueue: false, reason: "closer-not-allowed" }; // unreachable behind gate (2) -- see routeIssueClose
+	}
+	const rule = found.rule;
+	return {
+		enqueue: true,
+		...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
+		packages: rule.packages,
+		image: rule.image,
+		skillsDir: rule.skillsDir,
+		secrets: rule.secrets,
+		secretsProfile: rule.secretsProfile,
+		instructions: rule.instructions,
+		resume: rule.resume,
+		replicas: rule.replicas,
+		// No `number` on an MR close's matched record -- parallel to routeMergeRequest's, where the item
+		// number is the target's business; the issue route carries it because the github design does.
+		matched: { index: rule.index, type: "pull_request", action: "close", ...(rule.once === true && { once: true }) },
+		target: buildTarget(subset, "pull_request"),
+	};
+}
+
 /**
  * Note (comment) path. `noteable_type` states whether the comment is on an issue or a merge request --
  * GitHub infers the same thing from the presence of `issue.pull_request`. Routing it wrong would mint an
@@ -255,6 +368,8 @@ function routeNote(subset, triggers, knownFlows) {
 		packages: triggers.comment.packages,
 		image: triggers.comment.image,
 		skillsDir: triggers.comment.skillsDir,
+		secrets: triggers.comment.secrets,
+		secretsProfile: triggers.comment.secretsProfile,
 		instructions: triggers.comment.instructions,
 		resume: triggers.comment.resume,
 		replicas: triggers.comment.replicas,