@mastra/factory 0.0.0-aggregate-trace-20261015182851

package/dist/integrations/github/default-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-rules.js","names":[],"sources":["../../../src/integrations/github/default-rules.ts"],"sourcesContent":["import { hasRecordedVerdict } from '../../boards/review.js';\nimport { normalizedVerdictLine } from '../../review-verdict.js';\nimport { recordExplicitRuleOverrides } from '../../rules/event-rules.js';\nimport { isTerminalFactoryRuleStage } from '../../rules/types.js';\nimport type { FactoryGithubEventName, FactoryGithubRuleContext, FactoryRuleHandler } from '../../rules/types.js';\nimport { isFactoryApproveVerdict } from './stale-reviews.js';\n\nexport type GithubRuleOverrides = Partial<\n  Record<FactoryGithubEventName, FactoryRuleHandler<FactoryGithubRuleContext> | null | undefined>\n>;\nexport type GithubEventRules = Readonly<\n  Record<FactoryGithubEventName, FactoryRuleHandler<FactoryGithubRuleContext> | null>\n>;\n\nfunction trustedGithubActor(context: Pick<FactoryGithubRuleContext, 'actor'>): boolean {\n  return context.actor.type === 'github' && context.actor.trusted;\n}\n\nfunction githubActorLogin(context: Pick<FactoryGithubRuleContext, 'actor'>): string | undefined {\n  return context.actor.type === 'github' ? context.actor.login : undefined;\n}\n\nfunction retriageGithubIssue(context: FactoryGithubRuleContext) {\n  if (!context.item || context.item.source !== 'github-issue' || !context.item.url) return;\n  if (context.actor.type === 'github' && context.actor.factoryAuthored) return;\n  // The stage checks below use Work lane names; other boards opt in with their own rules.\n  if (context.board !== 'work') return;\n  // Re-triage would take over a card that is being built or reviewed.\n  const stage = context.item.stages?.length === 1 ? context.item.stages[0] : undefined;\n  if (stage === 'execute' || stage === 'review') return;\n  // A finished card has nothing left to triage; talk on a closed issue must not park a run on it.\n  if (isTerminalFactoryRuleStage(context.item.stages)) return;\n\n  const reason =\n    context.event === 'issueEdited'\n      ? context.issueChange?.title && context.issueChange.body\n        ? 'issue title and body edited'\n        : context.issueChange?.title\n          ? 'issue title edited'\n          : 'issue body edited'\n      : context.event === 'issueCommentDeleted'\n        ? 'comment deleted'\n        : context.event === 'issueCommentEdited'\n          ? 'comment edited'\n          : 'comment created';\n  return {\n    type: 'invokeSkill',\n    idempotencyKey: `${context.ingress.id}:factory-triage`,\n    role: 'triage',\n    skillName: 'factory-triage',\n    arguments: `Re-triage GitHub issue (${context.item.url}) after ${reason}.`,\n  } as const;\n}\n\nfunction createdAfterFactory(createdAt: string | undefined, factoryCreatedAt: string): boolean {\n  if (!createdAt) return false;\n  const sourceCreatedAt = Date.parse(createdAt);\n  const projectCreatedAt = Date.parse(factoryCreatedAt);\n  return Number.isFinite(sourceCreatedAt) && Number.isFinite(projectCreatedAt) && sourceCreatedAt > projectCreatedAt;\n}\n\n/**\n * Issue and pull request numbers repeat across repositories, so new cards are\n * keyed by repository. A card this repository already owns keeps its key —\n * including canonical `github-issue:N` / `github-pr:N` keys from before\n * scoping — but only when it is the same kind of source: pull request intake\n * runs with the authoring issue as `context.item`.\n */\nfunction githubSourceKey(\n  context: FactoryGithubRuleContext,\n  source: 'github-issue' | 'github-pr',\n  itemNumber: number,\n): string {\n  if (context.item?.source === source && context.item.sourceKey) return context.item.sourceKey;\n  return `github:${context.repository.id}:${source === 'github-issue' ? 'issue' : 'pull-request'}:${itemNumber}`;\n}\n\nfunction issueOpened(context: FactoryGithubRuleContext) {\n  if (!context.issue) return;\n  // Everything arrives on the routed board's initial phase (Work › Intake when\n  // no label route selects another board). Trust/timing stamps remain available\n  // to custom board rules.\n  return {\n    type: 'upsertLinkedWorkItem',\n    idempotencyKey: `${context.ingress.id}:issue-intake`,\n    board: context.intake?.board ?? 'work',\n    source: 'github-issue',\n    sourceKey: githubSourceKey(context, 'github-issue', context.issue.number),\n    title: context.issue.title,\n    url: context.issue.url,\n    stage: context.intake?.initialPhase ?? 'intake',\n    metadata: {\n      githubRepositoryId: context.repository.id,\n      githubIssueNumber: context.issue.number,\n      ...(context.issue.createdAt ? { sourceCreatedAt: context.issue.createdAt } : {}),\n      ...(githubActorLogin(context) ? { author: githubActorLogin(context) } : {}),\n      authorTrusted: trustedGithubActor(context),\n      autoStartCandidate:\n        trustedGithubActor(context) && createdAfterFactory(context.issue.createdAt, context.factory.createdAt),\n      assignees: context.issue.assignees ?? [],\n      labels: context.issue.labels ?? [],\n    },\n  } as const;\n}\n\nfunction issueClosed(context: FactoryGithubRuleContext) {\n  if (!context.item || context.item.source !== 'github-issue' || !context.issue) return;\n  // The card's board decides where a closed source sends it; boards that declare no\n  // `sourceClosed` mapping keep the card where it is, as do cards already finished.\n  const closure = context.boardClosure;\n  if (!context.board || !closure || closure.itemTerminal) return;\n  // Issue closure is a repository fact, not third-party input — no actor trust\n  // gate. `not_planned` (and `duplicate`) means abandoned, everything else is\n  // completed work.\n  const canceled = context.issue.stateReason === 'not_planned' || context.issue.stateReason === 'duplicate';\n  const target = canceled ? closure.canceled : closure.completed;\n  return {\n    type: 'transition',\n    idempotencyKey: `${context.ingress.id}:issue-closed`,\n    board: context.board,\n    stage: target.phase,\n    message: {\n      text:\n        `GitHub issue #${context.issue.number} was closed` +\n        `${context.issue.stateReason ? ` (${context.issue.stateReason})` : ''}; ` +\n        `this ${closure.boardTitle} card was moved to ${target.title}.`,\n    },\n  } as const;\n}\n\nfunction materializePullRequestIntake(\n  context: FactoryGithubRuleContext,\n  {\n    idempotencyKey,\n    autoStartCandidate,\n    stage = 'intake',\n  }: { idempotencyKey: string; autoStartCandidate: boolean; stage?: 'intake' | 'review' },\n) {\n  if (!context.pullRequest) return;\n  return {\n    type: 'upsertLinkedWorkItem',\n    idempotencyKey,\n    board: 'review',\n    source: 'github-pr',\n    sourceKey: githubSourceKey(context, 'github-pr', context.pullRequest.number),\n    title: context.pullRequest.title,\n    url: context.pullRequest.url,\n    stage,\n    metadata: {\n      githubRepositoryId: context.repository.id,\n      githubPullRequestNumber: context.pullRequest.number,\n      ...(context.pullRequest.createdAt ? { sourceCreatedAt: context.pullRequest.createdAt } : {}),\n      factoryAuthored: context.pullRequest.factoryAuthored,\n      authorTrusted: trustedGithubActor(context),\n      autoStartCandidate,\n      state: context.pullRequest.state,\n      draft: context.pullRequest.draft,\n      merged: context.pullRequest.merged,\n      assignees: context.pullRequest.assignees ?? [],\n      requestedReviewers: context.pullRequest.requestedReviewers ?? [],\n      labels: context.pullRequest.labels ?? [],\n      headBranch: context.pullRequest.headBranch,\n      baseBranch: context.pullRequest.baseBranch,\n      ...(context.pullRequest.author ? { author: context.pullRequest.author } : {}),\n    },\n  } as const;\n}\n\nfunction pullRequestOpened(context: FactoryGithubRuleContext) {\n  if (!context.pullRequest) return;\n  // Opening a pull request is evaluated once per card it concerns. This rule\n  // files the pull request's own Review card, which is the arrival — the\n  // evaluation carrying `pullRequestIntake` — so the authoring Work item's own\n  // evaluation only moves it out for review: Building means \"no pull request\n  // yet\", Review means one is open. The card rests there through every round of\n  // feedback — the builder is woken in place — until the merge closes it.\n  if (context.item && context.pullRequestIntake !== true) {\n    if (context.board !== 'work' || context.pullRequest.state !== 'open') return;\n    if (!context.item.stages.includes('execute')) return;\n    // Resolution can match a Work item by branch alone, so a fork's pull\n    // request must not be able to move it: same bar as auto-starting a review.\n    if (!trustedGithubActor(context) && !context.pullRequest.factoryAuthored) return;\n    return {\n      type: 'transition',\n      idempotencyKey: `${context.ingress.id}:out-for-review`,\n      board: 'work',\n      stage: 'review',\n    } as const;\n  }\n  // A GitHub App bot is never a collaborator, so Factory's own PRs score\n  // untrusted; their authorship is the trust signal.\n  const autoStartCandidate =\n    (trustedGithubActor(context) || context.pullRequest.factoryAuthored) &&\n    createdAfterFactory(context.pullRequest.createdAt, context.factory.createdAt);\n  return materializePullRequestIntake(context, {\n    idempotencyKey: `${context.ingress.id}:pull-request-intake`,\n    autoStartCandidate,\n  });\n}\n\nfunction pullRequestMerged(context: FactoryGithubRuleContext) {\n  if (!context.item || !context.pullRequest?.merged) return;\n  if (context.board === 'review') {\n    // The event is bound to the PR's own Review card: a merged PR is finished\n    // review work, so always move the card to Done. The message only reaches\n    // an active session (if any) — cards without one just move, instead of\n    // failing retries against a binding that never existed.\n    return {\n      type: 'transition',\n      idempotencyKey: `${context.ingress.id}:pull-request-merged`,\n      board: 'review',\n      stage: 'done',\n      message: {\n        text:\n          `Pull request #${context.pullRequest.number} merged; this Review card was moved to Done. ` +\n          'No further review is needed unless follow-up work was requested.',\n      },\n    } as const;\n  }\n  // Custom boards define their own lifecycle and cannot accept a transition\n  // targeting the built-in Work board. Let their custom rules handle the merge.\n  if (context.board !== 'work') return;\n  // Provenance bound the event to the originating Work item instead: the merge\n  // is what finishes the work, so it closes the Work card alongside its Review card —\n  // unless the card has since opened another pull request, which is still out.\n  const openPullRequestNumber = context.item.metadata?.openPullRequestNumber;\n  if (typeof openPullRequestNumber === 'number' && openPullRequestNumber !== context.pullRequest.number) {\n    return {\n      type: 'sendMessage',\n      idempotencyKey: `${context.ingress.id}:work-merged`,\n      role: 'work',\n      message:\n        `Pull request #${context.pullRequest.number} merged. Pull request #${openPullRequestNumber} is still open, ` +\n        'so this Work card stays in Review until it merges.',\n    } as const;\n  }\n  return {\n    type: 'transition',\n    idempotencyKey: `${context.ingress.id}:work-merged`,\n    board: 'work',\n    stage: 'done',\n    message: { text: `Pull request #${context.pullRequest.number} merged; this Work card was moved to Done.` },\n  } as const;\n}\n\nfunction addressReviewFeedback(context: FactoryGithubRuleContext) {\n  if (!context.item || !context.pullRequest || !context.review) return;\n  // Only the Work item that authored the PR can act on the feedback. Provenance\n  // binds the event there; a Review card seeing its own posted review must not\n  // react to it (that would loop the reviewer against itself).\n  if (context.board !== 'work') return;\n  // A closed or merged pull request has no branch left to push fixes to.\n  if (context.pullRequest.state !== 'open' || context.pullRequest.merged) return;\n  // `approved` needs no work, and `commented` (a review body with no verdict)\n  // is how a reviewer leaves notes without blocking — only a verdict that asks\n  // for changes should pull the author back in.\n  if (context.review.state.toLowerCase() !== 'changes_requested') return;\n  // The authoring thread is already subscribed to this PR (`gh pr create`\n  // subscribes automatically), so it can read the individual line comments\n  // from its own notification inbox — the message only has to wake it and\n  // point at the review.\n  return {\n    type: 'sendMessage',\n    idempotencyKey: `${context.ingress.id}:address-review-feedback`,\n    role: 'work',\n    priority: 'high',\n    message:\n      `Changes were requested on pull request #${context.pullRequest.number} (${context.review.url}). ` +\n      'Read the review comments on this PR, address the ones you agree with, and push the fixes to the PR branch. ' +\n      'Reply on GitHub to anything you are deliberately not changing, explaining why.',\n  } as const;\n}\n\n/**\n * A Factory approval does not clear a change request left by a different\n * Factory identity (an earlier reviewer token, say), so GitHub would keep the\n * pull request blocked. Ask the dispatcher to dismiss those superseded reviews.\n */\nfunction dismissStaleFactoryReviews(context: FactoryGithubRuleContext) {\n  const { pullRequest, review, repository } = context;\n  if (!pullRequest || !review || !review.author || !repository.installationId) return;\n  if (review.state.toLowerCase() !== 'approved' || !isFactoryApproveVerdict(review.body)) return;\n  if (!pullRequest.factoryAuthored || pullRequest.state !== 'open' || pullRequest.merged) return;\n  return {\n    type: 'dismissStaleReviews',\n    idempotencyKey: `${context.ingress.id}:dismiss-stale-reviews`,\n    installationId: repository.installationId,\n    repository: repository.fullName,\n    pullRequestNumber: pullRequest.number,\n    approvingReviewId: String(review.id),\n    approvingAuthor: review.author,\n  } as const;\n}\n\nfunction pullRequestReviewSubmitted(context: FactoryGithubRuleContext) {\n  return addressReviewFeedback(context) ?? dismissStaleFactoryReviews(context);\n}\n\n/**\n * Detects the `factory-review` handoff verdict in a comment body.\n *\n * GitHub forbids an app from reviewing a pull request it authored, so on\n * Factory-authored PRs the review skill falls back to posting its verdict as a\n * plain comment. That comment is the only signal the authoring agent gets, so\n * it has to be readable back out. The skill's handoff contract puts the verdict\n * on the first line (`Verdict: request changes`), so only that line is\n * inspected — a verdict quoted later in the findings must not count.\n */\nfunction requestsChangesVerdict(body: string | undefined): boolean {\n  // Tolerate the markdown the skill wraps the line in (`**Verdict: ...**`).\n  const normalized = normalizedVerdictLine(body);\n  if (!normalized) return false;\n  // Match the verdict exactly so negated phrasings (\"Verdict: do not request\n  // changes\") cannot wake the author.\n  return /^verdict: ?(request changes|changes requested)$/.test(normalized);\n}\n\nfunction addressPullRequestComment(context: FactoryGithubRuleContext) {\n  // A validated Factory mention is a review-entry request, not feedback for the\n  // authoring Work session. Invalid or unrecognized comments retain the normal\n  // feedback route below.\n  if (context.reviewCommand) return reReviewRequestedPullRequest(context);\n  if (!context.item || !context.pullRequest || !context.issueComment) return;\n  // Provenance binds the comment to the Work item that authored the PR — the\n  // only session that can act on it. A Review card must not react to comments\n  // on the PR it is reviewing.\n  if (context.board !== 'work') return;\n  if (context.pullRequest.state !== 'open' || context.pullRequest.merged) return;\n  // `factoryAuthored` is one bit for the whole Factory, so Factory's own\n  // comments are indistinguishable between roles — waking on all of them would\n  // let the Work agent's own progress comments wake itself in a loop. The one\n  // exception is the review verdict the Review run had to post as a comment\n  // because GitHub refused a self-review: that is the handoff, and it only ever\n  // asks for changes once per review, so it cannot sustain a loop.\n  if (\n    context.actor.type === 'github' &&\n    context.actor.factoryAuthored &&\n    !requestsChangesVerdict(context.issueComment.body)\n  ) {\n    return;\n  }\n  return {\n    type: 'sendMessage',\n    idempotencyKey: `${context.ingress.id}:address-pull-request-comment`,\n    role: 'work',\n    priority: 'high',\n    message:\n      `${context.issueComment.author ?? 'Someone'} commented on pull request #${context.pullRequest.number} ` +\n      `(${context.issueComment.url ?? context.pullRequest.url}). Read the comment, address it if you agree, and push ` +\n      'the fixes to the PR branch. Reply on GitHub to anything you are deliberately not changing, explaining why.',\n  } as const;\n}\n\nfunction pullRequestClosed(context: FactoryGithubRuleContext) {\n  if (!context.item || !context.pullRequest || context.pullRequest.merged) return;\n  if (context.board !== 'review') return;\n  // A PR closed without merging is abandoned review work: clear the card off\n  // the board instead of leaving it in Reviewing forever.\n  return {\n    type: 'transition',\n    idempotencyKey: `${context.ingress.id}:pull-request-closed`,\n    board: 'review',\n    stage: 'canceled',\n    message: {\n      text:\n        `Pull request #${context.pullRequest.number} was closed without merging; ` +\n        'this Review card was moved to Canceled.',\n    },\n  } as const;\n}\n\nfunction reReviewRequestedPullRequest(context: FactoryGithubRuleContext) {\n  // GitHub reviewer requests and Factory's exact mention command are both\n  // explicit requests to enter the same Review lifecycle.\n  const factoryReviewEntry = context.reviewRequest?.factoryReviewer || context.reviewCommand !== undefined;\n  if ((context.item && context.board !== 'review') || !factoryReviewEntry) return;\n  if (!context.pullRequest || context.pullRequest.state !== 'open' || context.pullRequest.merged) return;\n  // Trusted (write/admin) requesters only: creating or re-entering review checks\n  // out and executes PR code, the same bar pullRequestOpened applies to auto-review.\n  if (!trustedGithubActor(context)) return;\n  if (context.actor.type === 'github' && context.actor.factoryAuthored) return;\n  if (!context.item) {\n    // On this path the actor is the *requester*, so the materialized\n    // `authorTrusted` stamp records their trust (always true past the gate\n    // above), not the PR author's: a trusted maintainer requesting a Factory\n    // review vouches for the PR.\n    return materializePullRequestIntake(context, {\n      idempotencyKey: `${context.ingress.id}:pull-request-review-requested-intake`,\n      autoStartCandidate: true,\n      stage: 'review',\n    });\n  }\n  // Already in Reviewing with no verdict yet: a pass is pending or running.\n  // Once a verdict is recorded the card rests in Reviewing, so a fresh request\n  // re-enters the stage to start another pass.\n  const reviewing = context.item.stages.length === 1 && context.item.stages[0] === 'review';\n  if (reviewing && !hasRecordedVerdict(context.item)) return;\n  return {\n    type: 'transition',\n    idempotencyKey: `${context.ingress.id}:re-review-requested`,\n    board: 'review',\n    stage: 'review',\n    ...(reviewing ? { reenter: true } : {}),\n  } as const;\n}\n\nfunction reReviewUpdatedPullRequest(context: FactoryGithubRuleContext) {\n  if (!context.item || context.board !== 'review') return;\n  if (!context.pullRequest || context.pullRequest.state !== 'open' || context.pullRequest.merged) return;\n  // Intake has not started a review pass yet, so a push there is just more of\n  // the code the first pass will read. A push to a card sitting in Reviewing is\n  // different: it invalidates whatever that pass is reading, so re-enter the\n  // stage to supersede it. `reviewPullRequest` cancels the stale run and picks\n  // the right skill for the entry it sees.\n  if (context.item.stages.some(stage => stage === 'intake')) return;\n  // A fork's author controls its head branch, so an untrusted push must not be\n  // able to start review passes on demand; a maintainer can still request one.\n  if (!trustedGithubActor(context) && !context.pullRequest.factoryAuthored) return;\n  const alreadyReviewing = context.item.stages.some(stage => stage === 'review');\n  return {\n    type: 'transition',\n    idempotencyKey: `${context.ingress.id}:re-review-updated`,\n    board: 'review',\n    stage: 'review',\n    // Re-entry is the point when the card is already Reviewing: the stage's\n    // entry rule is what cancels the superseded pass and starts one on the code\n    // that just landed.\n    ...(alreadyReviewing ? { reenter: true } : {}),\n  } as const;\n}\n\nexport const defaultGithubRules = Object.freeze({\n  issueOpened: issueOpened,\n  issueEdited: retriageGithubIssue,\n  issueClosed: issueClosed,\n  issueCommentCreated: retriageGithubIssue,\n  issueCommentEdited: retriageGithubIssue,\n  issueCommentDeleted: retriageGithubIssue,\n  pullRequestOpened: pullRequestOpened,\n  pullRequestUpdated: reReviewUpdatedPullRequest,\n  pullRequestCommentCreated: addressPullRequestComment,\n  pullRequestReviewRequested: reReviewRequestedPullRequest,\n  pullRequestReviewSubmitted: pullRequestReviewSubmitted,\n  pullRequestMerged: pullRequestMerged,\n  pullRequestClosed: pullRequestClosed,\n} satisfies GithubEventRules);\n\nexport function resolveGithubRules(overrides?: GithubRuleOverrides): GithubEventRules {\n  if (overrides !== undefined && (overrides === null || typeof overrides !== 'object' || Array.isArray(overrides))) {\n    throw new Error('GitHub rules must be an object.');\n  }\n  const rules: Record<string, FactoryRuleHandler<FactoryGithubRuleContext> | null> = { ...defaultGithubRules };\n  for (const key of Reflect.ownKeys(overrides ?? {})) {\n    if (typeof key !== 'string' || !Object.hasOwn(defaultGithubRules, key)) {\n      throw new Error(`Unknown GitHub rule event: ${String(key)}.`);\n    }\n    const handler = overrides?.[key as FactoryGithubEventName];\n    if (handler !== undefined && handler !== null && typeof handler !== 'function') {\n      throw new Error(`GitHub rule ${key} must be a function, null, or undefined.`);\n    }\n    if (handler !== undefined) rules[key] = handler;\n  }\n  return recordExplicitRuleOverrides(Object.freeze(rules) as GithubEventRules, overrides);\n}\n"],"mappings":";;;;;;AAcA,SAAS,mBAAmB,SAA2D;CACrF,OAAO,QAAQ,MAAM,SAAS,YAAY,QAAQ,MAAM;AAC1D;AAEA,SAAS,iBAAiB,SAAsE;CAC9F,OAAO,QAAQ,MAAM,SAAS,WAAW,QAAQ,MAAM,QAAQ,KAAA;AACjE;AAEA,SAAS,oBAAoB,SAAmC;CAC9D,IAAI,CAAC,QAAQ,QAAQ,QAAQ,KAAK,WAAW,kBAAkB,CAAC,QAAQ,KAAK,KAAK;CAClF,IAAI,QAAQ,MAAM,SAAS,YAAY,QAAQ,MAAM,iBAAiB;CAEtE,IAAI,QAAQ,UAAU,QAAQ;CAE9B,MAAM,QAAQ,QAAQ,KAAK,QAAQ,WAAW,IAAI,QAAQ,KAAK,OAAO,KAAK,KAAA;CAC3E,IAAI,UAAU,aAAa,UAAU,UAAU;CAE/C,IAAI,2BAA2B,QAAQ,KAAK,MAAM,GAAG;CAErD,MAAM,SACJ,QAAQ,UAAU,gBACd,QAAQ,aAAa,SAAS,QAAQ,YAAY,OAChD,gCACA,QAAQ,aAAa,QACnB,uBACA,sBACJ,QAAQ,UAAU,wBAChB,oBACA,QAAQ,UAAU,uBAChB,mBACA;CACV,OAAO;EACL,MAAM;EACN,gBAAgB,GAAG,QAAQ,QAAQ,GAAG;EACtC,MAAM;EACN,WAAW;EACX,WAAW,2BAA2B,QAAQ,KAAK,IAAI,UAAU,OAAO;CAC1E;AACF;AAEA,SAAS,oBAAoB,WAA+B,kBAAmC;CAC7F,IAAI,CAAC,WAAW,OAAO;CACvB,MAAM,kBAAkB,KAAK,MAAM,SAAS;CAC5C,MAAM,mBAAmB,KAAK,MAAM,gBAAgB;CACpD,OAAO,OAAO,SAAS,eAAe,KAAK,OAAO,SAAS,gBAAgB,KAAK,kBAAkB;AACpG;;;;;;;;AASA,SAAS,gBACP,SACA,QACA,YACQ;CACR,IAAI,QAAQ,MAAM,WAAW,UAAU,QAAQ,KAAK,WAAW,OAAO,QAAQ,KAAK;CACnF,OAAO,UAAU,QAAQ,WAAW,GAAG,GAAG,WAAW,iBAAiB,UAAU,eAAe,GAAG;AACpG;AAEA,SAAS,YAAY,SAAmC;CACtD,IAAI,CAAC,QAAQ,OAAO;CAIpB,OAAO;EACL,MAAM;EACN,gBAAgB,GAAG,QAAQ,QAAQ,GAAG;EACtC,OAAO,QAAQ,QAAQ,SAAS;EAChC,QAAQ;EACR,WAAW,gBAAgB,SAAS,gBAAgB,QAAQ,MAAM,MAAM;EACxE,OAAO,QAAQ,MAAM;EACrB,KAAK,QAAQ,MAAM;EACnB,OAAO,QAAQ,QAAQ,gBAAgB;EACvC,UAAU;GACR,oBAAoB,QAAQ,WAAW;GACvC,mBAAmB,QAAQ,MAAM;GACjC,GAAI,QAAQ,MAAM,YAAY,EAAE,iBAAiB,QAAQ,MAAM,UAAU,IAAI,CAAC;GAC9E,GAAI,iBAAiB,OAAO,IAAI,EAAE,QAAQ,iBAAiB,OAAO,EAAE,IAAI,CAAC;GACzE,eAAe,mBAAmB,OAAO;GACzC,oBACE,mBAAmB,OAAO,KAAK,oBAAoB,QAAQ,MAAM,WAAW,QAAQ,QAAQ,SAAS;GACvG,WAAW,QAAQ,MAAM,aAAa,CAAC;GACvC,QAAQ,QAAQ,MAAM,UAAU,CAAC;EACnC;CACF;AACF;AAEA,SAAS,YAAY,SAAmC;CACtD,IAAI,CAAC,QAAQ,QAAQ,QAAQ,KAAK,WAAW,kBAAkB,CAAC,QAAQ,OAAO;CAG/E,MAAM,UAAU,QAAQ;CACxB,IAAI,CAAC,QAAQ,SAAS,CAAC,WAAW,QAAQ,cAAc;CAKxD,MAAM,SADW,QAAQ,MAAM,gBAAgB,iBAAiB,QAAQ,MAAM,gBAAgB,cACpE,QAAQ,WAAW,QAAQ;CACrD,OAAO;EACL,MAAM;EACN,gBAAgB,GAAG,QAAQ,QAAQ,GAAG;EACtC,OAAO,QAAQ;EACf,OAAO,OAAO;EACd,SAAS,EACP,MACE,iBAAiB,QAAQ,MAAM,OAAO,aACnC,QAAQ,MAAM,cAAc,KAAK,QAAQ,MAAM,YAAY,KAAK,GAAG,SAC9D,QAAQ,WAAW,qBAAqB,OAAO,MAAM,GACjE;CACF;AACF;AAEA,SAAS,6BACP,SACA,EACE,gBACA,oBACA,QAAQ,YAEV;CACA,IAAI,CAAC,QAAQ,aAAa;CAC1B,OAAO;EACL,MAAM;EACN;EACA,OAAO;EACP,QAAQ;EACR,WAAW,gBAAgB,SAAS,aAAa,QAAQ,YAAY,MAAM;EAC3E,OAAO,QAAQ,YAAY;EAC3B,KAAK,QAAQ,YAAY;EACzB;EACA,UAAU;GACR,oBAAoB,QAAQ,WAAW;GACvC,yBAAyB,QAAQ,YAAY;GAC7C,GAAI,QAAQ,YAAY,YAAY,EAAE,iBAAiB,QAAQ,YAAY,UAAU,IAAI,CAAC;GAC1F,iBAAiB,QAAQ,YAAY;GACrC,eAAe,mBAAmB,OAAO;GACzC;GACA,OAAO,QAAQ,YAAY;GAC3B,OAAO,QAAQ,YAAY;GAC3B,QAAQ,QAAQ,YAAY;GAC5B,WAAW,QAAQ,YAAY,aAAa,CAAC;GAC7C,oBAAoB,QAAQ,YAAY,sBAAsB,CAAC;GAC/D,QAAQ,QAAQ,YAAY,UAAU,CAAC;GACvC,YAAY,QAAQ,YAAY;GAChC,YAAY,QAAQ,YAAY;GAChC,GAAI,QAAQ,YAAY,SAAS,EAAE,QAAQ,QAAQ,YAAY,OAAO,IAAI,CAAC;EAC7E;CACF;AACF;AAEA,SAAS,kBAAkB,SAAmC;CAC5D,IAAI,CAAC,QAAQ,aAAa;CAO1B,IAAI,QAAQ,QAAQ,QAAQ,sBAAsB,MAAM;EACtD,IAAI,QAAQ,UAAU,UAAU,QAAQ,YAAY,UAAU,QAAQ;EACtE,IAAI,CAAC,QAAQ,KAAK,OAAO,SAAS,SAAS,GAAG;EAG9C,IAAI,CAAC,mBAAmB,OAAO,KAAK,CAAC,QAAQ,YAAY,iBAAiB;EAC1E,OAAO;GACL,MAAM;GACN,gBAAgB,GAAG,QAAQ,QAAQ,GAAG;GACtC,OAAO;GACP,OAAO;EACT;CACF;CAGA,MAAM,sBACH,mBAAmB,OAAO,KAAK,QAAQ,YAAY,oBACpD,oBAAoB,QAAQ,YAAY,WAAW,QAAQ,QAAQ,SAAS;CAC9E,OAAO,6BAA6B,SAAS;EAC3C,gBAAgB,GAAG,QAAQ,QAAQ,GAAG;EACtC;CACF,CAAC;AACH;AAEA,SAAS,kBAAkB,SAAmC;CAC5D,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,aAAa,QAAQ;CACnD,IAAI,QAAQ,UAAU,UAKpB,OAAO;EACL,MAAM;EACN,gBAAgB,GAAG,QAAQ,QAAQ,GAAG;EACtC,OAAO;EACP,OAAO;EACP,SAAS,EACP,MACE,iBAAiB,QAAQ,YAAY,OAAO,+GAEhD;CACF;CAIF,IAAI,QAAQ,UAAU,QAAQ;CAI9B,MAAM,wBAAwB,QAAQ,KAAK,UAAU;CACrD,IAAI,OAAO,0BAA0B,YAAY,0BAA0B,QAAQ,YAAY,QAC7F,OAAO;EACL,MAAM;EACN,gBAAgB,GAAG,QAAQ,QAAQ,GAAG;EACtC,MAAM;EACN,SACE,iBAAiB,QAAQ,YAAY,OAAO,yBAAyB,sBAAsB;CAE/F;CAEF,OAAO;EACL,MAAM;EACN,gBAAgB,GAAG,QAAQ,QAAQ,GAAG;EACtC,OAAO;EACP,OAAO;EACP,SAAS,EAAE,MAAM,iBAAiB,QAAQ,YAAY,OAAO,4CAA4C;CAC3G;AACF;AAEA,SAAS,sBAAsB,SAAmC;CAChE,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,eAAe,CAAC,QAAQ,QAAQ;CAI9D,IAAI,QAAQ,UAAU,QAAQ;CAE9B,IAAI,QAAQ,YAAY,UAAU,UAAU,QAAQ,YAAY,QAAQ;CAIxE,IAAI,QAAQ,OAAO,MAAM,YAAY,MAAM,qBAAqB;CAKhE,OAAO;EACL,MAAM;EACN,gBAAgB,GAAG,QAAQ,QAAQ,GAAG;EACtC,MAAM;EACN,UAAU;EACV,SACE,2CAA2C,QAAQ,YAAY,OAAO,IAAI,QAAQ,OAAO,IAAI;CAGjG;AACF;;;;;;AAOA,SAAS,2BAA2B,SAAmC;CACrE,MAAM,EAAE,aAAa,QAAQ,eAAe;CAC5C,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,WAAW,gBAAgB;CAC7E,IAAI,OAAO,MAAM,YAAY,MAAM,cAAc,CAAC,wBAAwB,OAAO,IAAI,GAAG;CACxF,IAAI,CAAC,YAAY,mBAAmB,YAAY,UAAU,UAAU,YAAY,QAAQ;CACxF,OAAO;EACL,MAAM;EACN,gBAAgB,GAAG,QAAQ,QAAQ,GAAG;EACtC,gBAAgB,WAAW;EAC3B,YAAY,WAAW;EACvB,mBAAmB,YAAY;EAC/B,mBAAmB,OAAO,OAAO,EAAE;EACnC,iBAAiB,OAAO;CAC1B;AACF;AAEA,SAAS,2BAA2B,SAAmC;CACrE,OAAO,sBAAsB,OAAO,KAAK,2BAA2B,OAAO;AAC7E;;;;;;;;;;;AAYA,SAAS,uBAAuB,MAAmC;CAEjE,MAAM,aAAa,sBAAsB,IAAI;CAC7C,IAAI,CAAC,YAAY,OAAO;CAGxB,OAAO,kDAAkD,KAAK,UAAU;AAC1E;AAEA,SAAS,0BAA0B,SAAmC;CAIpE,IAAI,QAAQ,eAAe,OAAO,6BAA6B,OAAO;CACtE,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,eAAe,CAAC,QAAQ,cAAc;CAIpE,IAAI,QAAQ,UAAU,QAAQ;CAC9B,IAAI,QAAQ,YAAY,UAAU,UAAU,QAAQ,YAAY,QAAQ;CAOxE,IACE,QAAQ,MAAM,SAAS,YACvB,QAAQ,MAAM,mBACd,CAAC,uBAAuB,QAAQ,aAAa,IAAI,GAEjD;CAEF,OAAO;EACL,MAAM;EACN,gBAAgB,GAAG,QAAQ,QAAQ,GAAG;EACtC,MAAM;EACN,UAAU;EACV,SACE,GAAG,QAAQ,aAAa,UAAU,UAAU,8BAA8B,QAAQ,YAAY,OAAO,IACjG,QAAQ,aAAa,OAAO,QAAQ,YAAY,IAAI;CAE5D;AACF;AAEA,SAAS,kBAAkB,SAAmC;CAC5D,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,eAAe,QAAQ,YAAY,QAAQ;CACzE,IAAI,QAAQ,UAAU,UAAU;CAGhC,OAAO;EACL,MAAM;EACN,gBAAgB,GAAG,QAAQ,QAAQ,GAAG;EACtC,OAAO;EACP,OAAO;EACP,SAAS,EACP,MACE,iBAAiB,QAAQ,YAAY,OAAO,sEAEhD;CACF;AACF;AAEA,SAAS,6BAA6B,SAAmC;CAGvE,MAAM,qBAAqB,QAAQ,eAAe,mBAAmB,QAAQ,kBAAkB,KAAA;CAC/F,IAAK,QAAQ,QAAQ,QAAQ,UAAU,YAAa,CAAC,oBAAoB;CACzE,IAAI,CAAC,QAAQ,eAAe,QAAQ,YAAY,UAAU,UAAU,QAAQ,YAAY,QAAQ;CAGhG,IAAI,CAAC,mBAAmB,OAAO,GAAG;CAClC,IAAI,QAAQ,MAAM,SAAS,YAAY,QAAQ,MAAM,iBAAiB;CACtE,IAAI,CAAC,QAAQ,MAKX,OAAO,6BAA6B,SAAS;EAC3C,gBAAgB,GAAG,QAAQ,QAAQ,GAAG;EACtC,oBAAoB;EACpB,OAAO;CACT,CAAC;CAKH,MAAM,YAAY,QAAQ,KAAK,OAAO,WAAW,KAAK,QAAQ,KAAK,OAAO,OAAO;CACjF,IAAI,aAAa,CAAC,mBAAmB,QAAQ,IAAI,GAAG;CACpD,OAAO;EACL,MAAM;EACN,gBAAgB,GAAG,QAAQ,QAAQ,GAAG;EACtC,OAAO;EACP,OAAO;EACP,GAAI,YAAY,EAAE,SAAS,KAAK,IAAI,CAAC;CACvC;AACF;AAEA,SAAS,2BAA2B,SAAmC;CACrE,IAAI,CAAC,QAAQ,QAAQ,QAAQ,UAAU,UAAU;CACjD,IAAI,CAAC,QAAQ,eAAe,QAAQ,YAAY,UAAU,UAAU,QAAQ,YAAY,QAAQ;CAMhG,IAAI,QAAQ,KAAK,OAAO,MAAK,UAAS,UAAU,QAAQ,GAAG;CAG3D,IAAI,CAAC,mBAAmB,OAAO,KAAK,CAAC,QAAQ,YAAY,iBAAiB;CAC1E,MAAM,mBAAmB,QAAQ,KAAK,OAAO,MAAK,UAAS,UAAU,QAAQ;CAC7E,OAAO;EACL,MAAM;EACN,gBAAgB,GAAG,QAAQ,QAAQ,GAAG;EACtC,OAAO;EACP,OAAO;EAIP,GAAI,mBAAmB,EAAE,SAAS,KAAK,IAAI,CAAC;CAC9C;AACF;AAEA,MAAa,qBAAqB,OAAO,OAAO;CACjC;CACb,aAAa;CACA;CACb,qBAAqB;CACrB,oBAAoB;CACpB,qBAAqB;CACF;CACnB,oBAAoB;CACpB,2BAA2B;CAC3B,4BAA4B;CACA;CACT;CACA;AACrB,CAA4B;AAE5B,SAAgB,mBAAmB,WAAmD;CACpF,IAAI,cAAc,KAAA,MAAc,cAAc,QAAQ,OAAO,cAAc,YAAY,MAAM,QAAQ,SAAS,IAC5G,MAAM,IAAI,MAAM,iCAAiC;CAEnD,MAAM,QAA6E,EAAE,GAAG,mBAAmB;CAC3G,KAAK,MAAM,OAAO,QAAQ,QAAQ,aAAa,CAAC,CAAC,GAAG;EAClD,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,OAAO,oBAAoB,GAAG,GACnE,MAAM,IAAI,MAAM,8BAA8B,OAAO,GAAG,EAAE,EAAE;EAE9D,MAAM,UAAU,YAAY;EAC5B,IAAI,YAAY,KAAA,KAAa,YAAY,QAAQ,OAAO,YAAY,YAClE,MAAM,IAAI,MAAM,eAAe,IAAI,yCAAyC;EAE9E,IAAI,YAAY,KAAA,GAAW,MAAM,OAAO;CAC1C;CACA,OAAO,4BAA4B,OAAO,OAAO,KAAK,GAAuB,SAAS;AACxF"}

package/dist/integrations/github/integration.d.ts

@@ -0,0 +1,270 @@
+/**
+ * `GithubIntegration` — the injectable GitHub App integration for the web
+ * factory.
+ *
+ * The deploy entry (`src/mastra/index.ts`) reads the `GITHUB_APP_*` env vars
+ * once, constructs an instance, and passes it to `MastraFactory` (the same
+ * dependency-injection pattern as the auth adapter and the sandbox machine).
+ * The factory seeds it into the runtime-config registry for the feature gate
+ * (`./config.ts`) and hands the instance to every consumer explicitly — route
+ * handlers receive it through `routes()`, the webhook fan-out and session
+ * subscription tools through their deps.
+ *
+ * The class owns:
+ *   - the GitHub App credentials (validated + PEM-normalized at construction),
+ *   - every GitHub API operation the web surface performs (Octokit factories,
+ *     token minting, installation/repo/issue/PR listings, OAuth exchange),
+ *   - the webhook secret used to verify GitHub webhook deliveries,
+ *   - its own HTTP surface: `routes()` returns the `/web/github/*` +
+ *     `/auth/github/*` Mastra `apiRoutes`.
+ *
+ * A custom integration (different app per tenant, custom Octokit config) can
+ * subclass this and override individual methods — everything downstream only
+ * talks to the instance.
+ */
+import type { RequestContext } from '@mastra/core/request-context';
+import type { ApiRoute } from '@mastra/core/server';
+import type { MastraWorker } from '@mastra/core/worker';
+import { Octokit } from '@octokit/rest';
+import type { Intake } from '../../capabilities/intake.js';
+import type { VersionControl } from '../../capabilities/version-control.js';
+import type { FactoryIntegration, IntegrationContext, IntegrationTools } from '../base.js';
+import type { GithubEventRules, GithubRuleOverrides } from './default-rules.js';
+import type { ReconcileIssueState, ReconcilePullRequestState } from './rules.js';
+import type { GithubSubscriptionStorage } from './subscriptions.js';
+/**
+ * Normalize a PEM private key supplied via env. Env tooling tends to mangle
+ * multi-line PEMs, so two single-line forms are supported:
+ *   - `\n`-escaped: literal `\n` sequences become real newlines
+ *   - fully flattened: newlines stripped entirely — the PEM is rebuilt by
+ *     re-wrapping the base64 body (Node's decoder rejects header/body/footer
+ *     on one line with `error:1E08010C:DECODER routines::unsupported`)
+ */
+export declare function normalizePrivateKey(raw: string): string;
+export interface UserInstallation {
+    installationId: number;
+    accountLogin: string | null;
+    accountType: string | null;
+}
+export interface RepoSummary {
+    id: number;
+    fullName: string;
+    name: string;
+    owner: string;
+    defaultBranch: string;
+    private: boolean;
+    installationId: number;
+}
+export interface GithubTriageCommentUpsertInput {
+    installationId: number;
+    repository: string;
+    issueNumber: number;
+    body: string;
+}
+export interface GithubTriageCommentUpsertResult {
+    action: 'created' | 'updated';
+    commentId: string;
+    url: string;
+}
+export type GithubRepositoryPermission = 'admin' | 'maintain' | 'write' | 'triage' | 'read' | 'none';
+export interface IssueSummary {
+    number: number;
+    title: string;
+    url: string;
+    author: string | null;
+    assignees: string[];
+    labels: string[];
+    comments: number;
+    createdAt: string;
+    updatedAt: string;
+}
+/** Page size for issue/PR listings; one GitHub API call per page. */
+export declare const LIST_PAGE_SIZE = 30;
+export interface IssuePage {
+    issues: IssueSummary[];
+    /** Next page number to request, or `null` when this was the last page. */
+    nextPage: number | null;
+}
+export interface ListRepoOpenIssuesOptions {
+    label?: string;
+}
+export interface GithubIntegrationConfig {
+    /** Replace an event handler, or disable it with null; omitted events keep defaults. */
+    rules?: GithubRuleOverrides;
+    /** GitHub App id (the numeric id, as a string). */
+    appId: string;
+    /**
+     * App private key (PEM). Multi-line, `\n`-escaped, and fully flattened
+     * single-line forms are all accepted (normalized at construction).
+     */
+    privateKey: string;
+    /** OAuth client id of the GitHub App. */
+    clientId: string;
+    /** OAuth client secret of the GitHub App. */
+    clientSecret: string;
+    /** App slug — the URL name used to build the install URL. */
+    slug: string;
+    /**
+     * Secret GitHub uses to sign webhook deliveries. Omitted → webhook
+     * signature verification rejects all deliveries. Also serves as the default
+     * replica-stable OAuth/install `state` secret (see `./config.ts`).
+     */
+    webhookSecret?: string;
+    /**
+     * Extra bot logins authorized to trigger author-gated PR notifications
+     * (reviews and comments). Merged over the built-in defaults, matched
+     * case-insensitively. Deployments running their own reviewer bots opt them
+     * in here; every other bot stays gated.
+     */
+    authorizedBots?: string[];
+}
+export declare class GithubIntegration implements FactoryIntegration {
+    #private;
+    /** Stable integration identifier (see `../factory-integration.ts`). */
+    readonly id = "github";
+    get rules(): GithubEventRules;
+    readonly intake: Intake;
+    readonly versionControl: VersionControl;
+    /**
+     * The OAuth/install flow round-trips a signed `state` through GitHub, so a
+     * multi-replica deploy needs a deployment-stable state secret.
+     */
+    readonly requiresStableStateSigner = true;
+    constructor(config: GithubIntegrationConfig);
+    /** App slug — the URL name used to build the install URL. */
+    get slug(): string;
+    /** Whether a GitHub login belongs to this integration's App. */
+    isFactoryCommentAuthor(login: string | null | undefined): boolean;
+    /** Extra bot logins authorized to trigger author-gated PR notifications. */
+    get authorizedBots(): readonly string[];
+    get genericStorage(): IntegrationContext['storage']['generic'];
+    get sourceControlStorage(): IntegrationContext['storage']['sourceControl'];
+    get integrationStorage(): GithubSubscriptionStorage;
+    /** Secret GitHub uses to sign webhook deliveries, when configured. */
+    get webhookSecret(): string | undefined;
+    /**
+     * Octokit authenticated as the GitHub App itself (app JWT). Used for
+     * app-level operations and to mint installation tokens.
+     */
+    getAppOctokit(): Octokit;
+    /**
+     * Octokit authenticated as a specific installation (installation access
+     * token). Used to list repos and to operate on a repo on the user's behalf.
+     */
+    getInstallationOctokit(installationId: number): Octokit;
+    /** Octokit authenticated as a user via their OAuth token (the identify step). */
+    getUserOctokit(userToken: string): Octokit;
+    /**
+     * Mint a short-lived installation access token. Returned token is used only
+     * server-side / inside the sandbox clone URL and never sent to the browser.
+     */
+    mintInstallationToken(installationId: number): Promise<string>;
+    /**
+     * List the installations the authenticated user can access, via their OAuth
+     * token (`GET /user/installations`).
+     */
+    listUserInstallations(userToken: string): Promise<UserInstallation[]>;
+    /**
+     * List repos accessible to an installation (paginated). Always reads
+     * GitHub directly, so `fresh` has nothing to bypass here.
+     */
+    listInstallationRepos(installationId: number, _options?: {
+        fresh?: boolean;
+    }): Promise<RepoSummary[]>;
+    /**
+     * The authenticated user's permission level on a repo, through the
+     * installation. `undefined` when the repo/user is not accessible.
+     */
+    getRepositoryCollaboratorPermission(installationId: number, repoFullName: string, username: string, signal?: AbortSignal): Promise<GithubRepositoryPermission | undefined>;
+    /**
+     * Fetch a single repo's metadata through an installation token and confirm
+     * the installation actually has access to it. Returns `null` when the repo
+     * is not accessible to the installation (so a client can't create a project
+     * for an arbitrary repo under an installation id it merely owns).
+     */
+    getInstallationRepo(installationId: number, repoFullName: string): Promise<RepoSummary | null>;
+    /** Add labels to an issue (deduplicated; no-op on empty/malformed input). */
+    addIssueLabels(installationId: number, repoFullName: string, issueNumber: number, labels: string[]): Promise<void>;
+    /** Remove one label from an issue. */
+    removeIssueLabel(installationId: number, repoFullName: string, issueNumber: number, label: string): Promise<void>;
+    /**
+     * List one page of a repo's open issues through an installation token. The
+     * issues API also returns pull requests, so those are filtered out (the
+     * filter can make a non-final page shorter than the page size — `nextPage`
+     * is derived from the raw response length, not the filtered one).
+     */
+    listRepoOpenIssues(installationId: number, repoFullName: string, page: number, options?: ListRepoOpenIssuesOptions): Promise<IssuePage>;
+    /**
+     * Build the GitHub App install URL. `state` is carried through the install
+     * flow and validated on callback.
+     */
+    buildInstallUrl(state: string): string;
+    /**
+     * Build the OAuth identify URL (authorize) used to confirm the user's
+     * identity and obtain a user token for listing their installations.
+     */
+    buildOAuthIdentifyUrl(state: string, redirectUri: string): string;
+    /** Exchange an OAuth `code` for a user access token. */
+    exchangeOAuthCode(code: string, redirectUri: string): Promise<string>;
+    /**
+     * The integration's HTTP surface: the `/web/github/*` + `/auth/github/*`
+     * Mastra `apiRoutes` (webhook handler, install/OAuth flow, project +
+     * worktree + session operations). The factory folds these into the server's
+     * `apiRoutes` when the feature is ready. Handlers operate on this instance.
+     */
+    routes(ctx: IntegrationContext): ApiRoute[];
+    /**
+     * Import a newly linked repository's open issues and pull requests onto
+     * the board. No-op until routes are mounted with rules configured.
+     */
+    ingestLinkedRepositoryBacklog(args: {
+        orgId: string;
+        projectRepositoryId: string;
+    }): Promise<void>;
+    /**
+     * Pull-request and issue sweeps share a worker and lease, but can be enabled
+     * and paced independently. The legacy combined controls remain the fallback.
+     */
+    workers(ctx: IntegrationContext): MastraWorker[];
+    /**
+     * Reads live PR state for the merge reconciler. Returns undefined when the PR
+     * cannot be resolved so a sweep never fabricates a merge.
+     */
+    fetchPullRequestState(input: {
+        installationId: number;
+        repository: string;
+        number: number;
+    }): Promise<ReconcilePullRequestState | undefined>;
+    /**
+     * Reads live issue state for the reconciler. Returns undefined when the
+     * issue cannot be resolved (missing, is actually a PR, API error) so a
+     * sweep never fabricates a close.
+     */
+    fetchIssueState(input: {
+        installationId: number;
+        repository: string;
+        number: number;
+    }): Promise<ReconcileIssueState | undefined>;
+    /**
+     * Lists a repository's open issues (pull requests excluded) so the issue
+     * sweep can mint cards for issues whose webhook never arrived.
+     */
+    listOpenIssueStates(input: {
+        installationId: number;
+        repository: string;
+    }): Promise<Array<ReconcileIssueState & {
+        number: number;
+    }>>;
+    /**
+     * Session-scoped agent tools for token refresh and PR subscriptions in
+     * sessions bound to a GitHub-backed project. Empty elsewhere.
+     */
+    upsertFactoryTriageComment(input: GithubTriageCommentUpsertInput): Promise<GithubTriageCommentUpsertResult>;
+    sessionTools({ requestContext }: {
+        requestContext: RequestContext;
+    }): IntegrationTools;
+    postToolObserver({ toolContext, requestContext, }: Parameters<NonNullable<FactoryIntegration['postToolObserver']>>[0]): Promise<void>;
+    /** Non-secret config snapshot for system diagnostics/startup logs. */
+    diagnostics(): Record<string, unknown>;
+}
+//# sourceMappingURL=integration.d.ts.map

package/dist/integrations/github/integration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/integration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAGV,MAAM,EAKP,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAKV,cAAc,EACf,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC3F,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAOhF,OAAO,KAAK,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAOjF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAMpE;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOvD;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,8BAA8B;IAC7C,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,0BAA0B,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;AAmBrG,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qEAAqE;AACrE,eAAO,MAAM,cAAc,KAAK,CAAC;AAKjC,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,uFAAuF;IACvF,KAAK,CAAC,EAAE,mBAAmB,CAAC;IAC5B,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAKD,qBAAa,iBAAkB,YAAW,kBAAkB;;IAC1D,uEAAuE;IACvE,QAAQ,CAAC,EAAE,YAAY;IAGvB,IAAI,KAAK,IAAI,gBAAgB,CAE5B;IACD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAoFrB;IACF,QAAQ,CAAC,cAAc,EAAE,cAAc,CAkFrC;IACF;;;OAGG;IACH,QAAQ,CAAC,yBAAyB,QAAQ;gBA0B9B,MAAM,EAAE,uBAAuB;IAmB3C,6DAA6D;IAC7D,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,gEAAgE;IAChE,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAIjE,4EAA4E;IAC5E,IAAI,cAAc,IAAI,SAAS,MAAM,EAAE,CAEtC;IAED,IAAI,cAAc,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAG7D;IAED,IAAI,oBAAoB,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAIzE;IAED,IAAI,kBAAkB,IAAI,yBAAyB,CAGlD;IA4BD,sEAAsE;IACtE,IAAI,aAAa,IAAI,MAAM,GAAG,SAAS,CAEtC;IAWD;;;OAGG;IACH,aAAa,IAAI,OAAO;IAIxB;;;OAGG;IACH,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO;IA0BvD,iFAAiF;IACjF,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAI1C;;;OAGG;IACG,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAMpE;;;OAGG;IACG,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAY3E;;;OAGG;IACG,qBAAqB,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAgB3G;;;OAGG;IACG,mCAAmC,CACvC,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC;IAsClD;;;;;OAKG;IACG,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IA+dpG,6EAA6E;IACvE,cAAc,CAClB,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EAAE,GACf,OAAO,CAAC,IAAI,CAAC;IAchB,sCAAsC;IAChC,gBAAgB,CACpB,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC;IAahB;;;;;OAKG;IACG,kBAAkB,CACtB,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,SAAS,CAAC;IA4BrB;;;OAGG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAMtC;;;OAGG;IACH,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM;IAQjE,wDAAwD;IAClD,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAwB3E;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,kBAAkB,GAAG,QAAQ,EAAE;IAsB3C;;;OAGG;IACG,6BAA6B,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxG;;;OAGG;IACH,OAAO,CAAC,GAAG,EAAE,kBAAkB,GAAG,YAAY,EAAE;IAuChD;;;OAGG;IACG,qBAAqB,CAAC,KAAK,EAAE;QACjC,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC;IA2BlD;;;;OAIG;IACG,eAAe,CAAC,KAAK,EAAE;QAC3B,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IA6B5C;;;OAGG;IACG,mBAAmB,CAAC,KAAK,EAAE;QAC/B,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,KAAK,CAAC,mBAAmB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAkC5D;;;OAGG;IACG,0BAA0B,CAAC,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,+BAA+B,CAAC;IAsCjH,YAAY,CAAC,EAAE,cAAc,EAAE,EAAE;QAAE,cAAc,EAAE,cAAc,CAAA;KAAE,GAAG,gBAAgB;IAIhF,gBAAgB,CAAC,EACrB,WAAW,EACX,cAAc,GACf,EAAE,UAAU,CAAC,WAAW,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAMrF,sEAAsE;IACtE,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAMvC"}