@mastra/factory 0.0.0-aggregate-trace-20261015182851

package/dist/integrations/github/integration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration.js","names":["#rules","#resolveIntakeDispatch","#listIntakeIssues","#getIntakeIssue","#createIntakeComment","#updateIntakeIssue","#sourceControlStorage","#listPullRequests","#getPullRequest","#createPullRequest","#updatePullRequest","#closePullRequest","#mergePullRequest","#listComments","#createComment","#updateComment","#deleteComment","#listReviews","#getReview","#createReview","#updateReview","#submitReview","#dismissReview","#deletePendingReview","#listReviewComments","#createReviewComment","#updateReviewComment","#deleteReviewComment","#listRequestedReviewers","#requestReviewers","#removeReviewers","#appId","#privateKey","#clientId","#clientSecret","#slug","#webhookSecret","#authorizedBots","#collaboratorPermissionCache","#collaboratorPermissionInFlight","#installationOctokits","#storage","#appAuth","#repositoryClient","#ingestFactoryEvent"],"sources":["../../../src/integrations/github/integration.ts"],"sourcesContent":["/**\n * `GithubIntegration` — the injectable GitHub App integration for the web\n * factory.\n *\n * The deploy entry (`src/mastra/index.ts`) reads the `GITHUB_APP_*` env vars\n * once, constructs an instance, and passes it to `MastraFactory` (the same\n * dependency-injection pattern as the auth adapter and the sandbox machine).\n * The factory seeds it into the runtime-config registry for the feature gate\n * (`./config.ts`) and hands the instance to every consumer explicitly — route\n * handlers receive it through `routes()`, the webhook fan-out and session\n * subscription tools through their deps.\n *\n * The class owns:\n *   - the GitHub App credentials (validated + PEM-normalized at construction),\n *   - every GitHub API operation the web surface performs (Octokit factories,\n *     token minting, installation/repo/issue/PR listings, OAuth exchange),\n *   - the webhook secret used to verify GitHub webhook deliveries,\n *   - its own HTTP surface: `routes()` returns the `/web/github/*` +\n *     `/auth/github/*` Mastra `apiRoutes`.\n *\n * A custom integration (different app per tenant, custom Octokit config) can\n * subclass this and override individual methods — everything downstream only\n * talks to the instance.\n */\n\nimport type { RequestContext } from '@mastra/core/request-context';\nimport type { ApiRoute } from '@mastra/core/server';\nimport type { MastraWorker } from '@mastra/core/worker';\nimport { createAppAuth } from '@octokit/auth-app';\nimport { Octokit } from '@octokit/rest';\n\nimport type { IntegrationConnection } from '../../capabilities/connection.js';\nimport type {\n  CreateIntakeCommentInput,\n  GetIntakeIssueInput,\n  Intake,\n  IntakeIssue,\n  IntakeIssueDetail,\n  ListIntakeIssuesInput,\n  UpdateIntakeIssueInput,\n} from '../../capabilities/intake.js';\nimport type {\n  PullRequest,\n  PullRequestComment,\n  Review,\n  ReviewComment,\n  VersionControl,\n} from '../../capabilities/version-control.js';\nimport type { FactoryIntegration, IntegrationContext, IntegrationTools } from '../base.js';\nimport type { GithubEventRules, GithubRuleOverrides } from './default-rules.js';\nimport { resolveGithubRules } from './default-rules.js';\nimport { attachGithubIssueReconciler } from './issue-reconciler.js';\nimport { GithubReconcileWorker } from './reconcile-worker.js';\nimport { reconcileInterval, reconciliationEnabled } from './reconciliation-config.js';\nimport { buildGithubRoutes, ingestLinkedRepositoryBacklog } from './routes.js';\nimport { attachGithubReconciler, attachGithubRules } from './rules.js';\nimport type { ReconcileIssueState, ReconcilePullRequestState } from './rules.js';\nimport {\n  createGithubSubscriptionTools,\n  parseCreatedPullRequest,\n  subscribeCurrentSessionToPullRequest,\n} from './session-subscriptions.js';\nimport { settleOrAbort } from './settle-or-abort.js';\nimport type { GithubSubscriptionStorage } from './subscriptions.js';\n\ntype InputOf<TMethod extends keyof VersionControl> = VersionControl[TMethod] extends (input: infer TInput) => unknown\n  ? TInput\n  : never;\n\n/**\n * Normalize a PEM private key supplied via env. Env tooling tends to mangle\n * multi-line PEMs, so two single-line forms are supported:\n *   - `\\n`-escaped: literal `\\n` sequences become real newlines\n *   - fully flattened: newlines stripped entirely — the PEM is rebuilt by\n *     re-wrapping the base64 body (Node's decoder rejects header/body/footer\n *     on one line with `error:1E08010C:DECODER routines::unsupported`)\n */\nexport function normalizePrivateKey(raw: string): string {\n  const key = raw.replace(/\\\\n/g, '\\n');\n  if (key.includes('\\n')) return key;\n  const flattened = key.trim().match(/^(-----BEGIN [A-Z0-9 ]+-----)\\s*(.+?)\\s*(-----END [A-Z0-9 ]+-----)$/);\n  if (!flattened) return key;\n  const body = flattened[2]!.replace(/\\s+/g, '');\n  return `${flattened[1]}\\n${body.match(/.{1,64}/g)!.join('\\n')}\\n${flattened[3]}\\n`;\n}\n\nexport interface UserInstallation {\n  installationId: number;\n  accountLogin: string | null;\n  accountType: string | null;\n}\n\nexport interface RepoSummary {\n  id: number;\n  fullName: string;\n  name: string;\n  owner: string;\n  defaultBranch: string;\n  private: boolean;\n  installationId: number;\n}\n\nexport interface GithubTriageCommentUpsertInput {\n  installationId: number;\n  repository: string;\n  issueNumber: number;\n  body: string;\n}\n\nexport interface GithubTriageCommentUpsertResult {\n  action: 'created' | 'updated';\n  commentId: string;\n  url: string;\n}\n\nexport type GithubRepositoryPermission = 'admin' | 'maintain' | 'write' | 'triage' | 'read' | 'none';\n\n/**\n * How long a collaborator permission lookup may be reused. The reconcile\n * sweep re-stamps every open card's author and webhook gating checks every\n * human sender, so one login can cost dozens of identical requests per cycle\n * against the installation's REST budget. Revoked access reads as trusted for\n * at most this long.\n */\nconst COLLABORATOR_PERMISSION_CACHE_TTL_MS = 30 * 60_000;\nconst COLLABORATOR_PERMISSION_CACHE_MAX_ENTRIES = 1000;\n/** Bound on the shared upstream lookup; callers race their own signal against it. */\nconst COLLABORATOR_PERMISSION_LOOKUP_TIMEOUT_MS = 10_000;\n/** Installations whose Octokit (and cached token) is kept; least recently used is evicted. */\nconst INSTALLATION_OCTOKIT_CACHE_MAX_ENTRIES = 1000;\n/** Missed-open issue discovery reads at most this many pages per repository per sweep. */\nconst OPEN_ISSUE_DISCOVERY_MAX_PAGES = 5;\nconst OPEN_ISSUE_DISCOVERY_PAGE_SIZE = 100;\n\nexport interface IssueSummary {\n  number: number;\n  title: string;\n  url: string;\n  author: string | null;\n  assignees: string[];\n  labels: string[];\n  comments: number;\n  createdAt: string;\n  updatedAt: string;\n}\n\n/** Page size for issue/PR listings; one GitHub API call per page. */\nexport const LIST_PAGE_SIZE = 30;\n\n/** Allow GitHub OAuth token exchanges enough time to complete during installation callbacks. */\nconst GITHUB_OAUTH_TOKEN_TIMEOUT_MS = 10_000;\n\nexport interface IssuePage {\n  issues: IssueSummary[];\n  /** Next page number to request, or `null` when this was the last page. */\n  nextPage: number | null;\n}\n\nexport interface ListRepoOpenIssuesOptions {\n  label?: string;\n}\n\nexport interface GithubIntegrationConfig {\n  /** Replace an event handler, or disable it with null; omitted events keep defaults. */\n  rules?: GithubRuleOverrides;\n  /** GitHub App id (the numeric id, as a string). */\n  appId: string;\n  /**\n   * App private key (PEM). Multi-line, `\\n`-escaped, and fully flattened\n   * single-line forms are all accepted (normalized at construction).\n   */\n  privateKey: string;\n  /** OAuth client id of the GitHub App. */\n  clientId: string;\n  /** OAuth client secret of the GitHub App. */\n  clientSecret: string;\n  /** App slug — the URL name used to build the install URL. */\n  slug: string;\n  /**\n   * Secret GitHub uses to sign webhook deliveries. Omitted → webhook\n   * signature verification rejects all deliveries. Also serves as the default\n   * replica-stable OAuth/install `state` secret (see `./config.ts`).\n   */\n  webhookSecret?: string;\n  /**\n   * Extra bot logins authorized to trigger author-gated PR notifications\n   * (reviews and comments). Merged over the built-in defaults, matched\n   * case-insensitively. Deployments running their own reviewer bots opt them\n   * in here; every other bot stays gated.\n   */\n  authorizedBots?: string[];\n}\n\n/** Human-readable names of the required config fields, for construction errors. */\nconst REQUIRED_FIELDS = ['appId', 'privateKey', 'clientId', 'clientSecret', 'slug'] as const;\n\nexport class GithubIntegration implements FactoryIntegration {\n  /** Stable integration identifier (see `../factory-integration.ts`). */\n  readonly id = 'github';\n  readonly #rules: GithubEventRules;\n\n  get rules(): GithubEventRules {\n    return this.#rules;\n  }\n  readonly intake: Intake = {\n    resolveIntakeDispatch: input => this.#resolveIntakeDispatch(input),\n    listSources: async ({ orgId }) => {\n      const installations = await this.sourceControlStorage.installations.list({ orgId });\n      const repositories = await Promise.all(\n        installations.map(installation =>\n          this.sourceControlStorage.repositories.list({ orgId, installationId: installation.id }),\n        ),\n      );\n      return repositories.flat().map(repository => ({\n        id: repository.id,\n        name: repository.slug,\n        type: 'repository',\n        metadata: { defaultBranch: repository.defaultBranch },\n      }));\n    },\n    listItems: async ({ orgId, sourceIds, cursor }) => {\n      const page = cursor ? Number.parseInt(cursor, 10) : 1;\n      const requestedPage = Number.isSafeInteger(page) && page > 0 ? page : 1;\n      const pages = await Promise.all(\n        sourceIds.map(async sourceId => {\n          const repository = await this.sourceControlStorage.repositories.get({ orgId, id: sourceId });\n          if (!repository) return { items: [], hasNextPage: false };\n          const installation = await this.sourceControlStorage.installations.get({\n            orgId,\n            id: repository.installationId,\n          });\n          if (!installation) return { items: [], hasNextPage: false };\n          const installationId = Number.parseInt(installation.externalId, 10);\n          if (!Number.isSafeInteger(installationId)) return { items: [], hasNextPage: false };\n          const [issues, pullRequests] = await Promise.all([\n            this.listRepoOpenIssues(installationId, repository.slug, requestedPage),\n            this.versionControl.listPullRequests({\n              connection: { type: 'app-installation', installationId },\n              sourceId: repository.slug,\n              includeDrafts: false,\n              cursor: String(requestedPage),\n            }),\n          ]);\n          return {\n            items: [\n              ...issues.issues.map(issue => ({\n                source: { type: 'issue', externalId: `${repository.externalId}:${issue.number}`, url: issue.url },\n                sourceId: repository.id,\n                title: issue.title,\n                status: 'open',\n                labels: issue.labels,\n                createdAt: issue.createdAt,\n                updatedAt: issue.updatedAt,\n                metadata: { repository: repository.slug, number: issue.number, author: issue.author },\n              })),\n              ...pullRequests.pullRequests.map(pullRequest => ({\n                source: {\n                  type: 'pull-request',\n                  externalId: `${repository.externalId}:${pullRequest.id}`,\n                  url: pullRequest.url,\n                },\n                sourceId: repository.id,\n                title: pullRequest.title,\n                status: 'open',\n                createdAt: pullRequest.createdAt,\n                updatedAt: pullRequest.updatedAt,\n                metadata: {\n                  repository: repository.slug,\n                  number: Number(pullRequest.id),\n                  author: pullRequest.author,\n                  baseBranch: pullRequest.baseBranch,\n                  headBranch: pullRequest.headBranch,\n                },\n              })),\n            ],\n            hasNextPage: issues.nextPage !== null || pullRequests.nextCursor !== null,\n          };\n        }),\n      );\n      return {\n        items: pages.flatMap(result => result.items),\n        nextCursor: pages.some(result => result.hasNextPage) ? String(requestedPage + 1) : null,\n      };\n    },\n    listIssues: input => this.#listIntakeIssues(input),\n    getIssue: input => this.#getIntakeIssue(input),\n    createComment: input => this.#createIntakeComment(input),\n    updateIssue: input => this.#updateIntakeIssue(input),\n  };\n  readonly versionControl: VersionControl = {\n    initialize: ({ storage }) => {\n      this.#sourceControlStorage = storage;\n    },\n    registerInstallation: ({ orgId, userId, installation }) =>\n      this.sourceControlStorage.installations.upsert({\n        orgId,\n        connectedByUserId: userId,\n        externalId: installation.externalId,\n        accountName: installation.accountName,\n        accountType: installation.accountType,\n        providerMetadata: installation.metadata,\n      }),\n    registerRepositories: ({ orgId, installationId, repositories }) =>\n      Promise.all(\n        repositories.map(repository =>\n          this.sourceControlStorage.repositories.upsert({\n            orgId,\n            input: {\n              installationId,\n              externalId: repository.externalId,\n              slug: repository.slug,\n              defaultBranch: repository.defaultBranch,\n              providerMetadata: repository.metadata,\n            },\n          }),\n        ),\n      ),\n    getRepositoryTarget: async ({ orgId, repositoryId }) => {\n      const repository = await this.sourceControlStorage.repositories.get({ orgId, id: repositoryId });\n      if (!repository) throw new Error('Version-control repository not found.');\n      const installation = await this.sourceControlStorage.installations.get({\n        orgId,\n        id: repository.installationId,\n      });\n      if (!installation) throw new Error('Version-control installation not found.');\n      const installationId = Number.parseInt(installation.externalId, 10);\n      if (!Number.isSafeInteger(installationId)) throw new Error('GitHub installation id is invalid.');\n      return {\n        connection: { type: 'app-installation', installationId },\n        sourceId: repository.slug,\n      };\n    },\n    getRepositoryAccess: async ({ orgId, repositoryId }) => {\n      const repository = await this.sourceControlStorage.repositories.get({ orgId, id: repositoryId });\n      if (!repository) throw new Error('Version-control repository not found.');\n      const installation = await this.sourceControlStorage.installations.get({\n        orgId,\n        id: repository.installationId,\n      });\n      if (!installation) throw new Error('Version-control installation not found.');\n      const installationId = Number.parseInt(installation.externalId, 10);\n      if (!Number.isSafeInteger(installationId)) throw new Error('GitHub installation id is invalid.');\n      return {\n        cloneUrl: `https://github.com/${repository.slug}.git`,\n        authorization: { scheme: 'bearer', token: await this.mintInstallationToken(installationId) },\n      };\n    },\n    listPullRequests: input => this.#listPullRequests(input),\n    getPullRequest: input => this.#getPullRequest(input),\n    createPullRequest: input => this.#createPullRequest(input),\n    updatePullRequest: input => this.#updatePullRequest(input),\n    closePullRequest: input => this.#closePullRequest(input),\n    mergePullRequest: input => this.#mergePullRequest(input),\n    listComments: input => this.#listComments(input),\n    createComment: input => this.#createComment(input),\n    updateComment: input => this.#updateComment(input),\n    deleteComment: input => this.#deleteComment(input),\n    listReviews: input => this.#listReviews(input),\n    getReview: input => this.#getReview(input),\n    createReview: input => this.#createReview(input),\n    updateReview: input => this.#updateReview(input),\n    submitReview: input => this.#submitReview(input),\n    dismissReview: input => this.#dismissReview(input),\n    deletePendingReview: input => this.#deletePendingReview(input),\n    listReviewComments: input => this.#listReviewComments(input),\n    createReviewComment: input => this.#createReviewComment(input),\n    updateReviewComment: input => this.#updateReviewComment(input),\n    deleteReviewComment: input => this.#deleteReviewComment(input),\n    listRequestedReviewers: input => this.#listRequestedReviewers(input),\n    requestReviewers: input => this.#requestReviewers(input),\n    removeRequestedReviewers: input => this.#removeReviewers(input),\n  };\n  /**\n   * The OAuth/install flow round-trips a signed `state` through GitHub, so a\n   * multi-replica deploy needs a deployment-stable state secret.\n   */\n  readonly requiresStableStateSigner = true;\n\n  readonly #appId: string;\n  readonly #privateKey: string;\n  readonly #clientId: string;\n  readonly #clientSecret: string;\n  readonly #slug: string;\n  readonly #webhookSecret: string | undefined;\n  readonly #authorizedBots: readonly string[];\n  #storage: IntegrationContext['storage'] | undefined;\n  #ingestFactoryEvent: ReturnType<typeof attachGithubRules>;\n  #sourceControlStorage: IntegrationContext['storage']['sourceControl'] | undefined;\n  /** `installationId:owner/repo:login` → cached collaborator permission (TTL-bounded). */\n  readonly #collaboratorPermissionCache = new Map<\n    string,\n    { permission: GithubRepositoryPermission; expiresAt: number }\n  >();\n  /** Same key → lookup already in flight, so overlapping callers share one request. */\n  readonly #collaboratorPermissionInFlight = new Map<string, Promise<GithubRepositoryPermission | undefined>>();\n  /**\n   * One Octokit per installation, so its auth instance keeps the installation\n   * token cached (auth-app refreshes it before expiry) instead of minting a new\n   * token on every call.\n   */\n  readonly #installationOctokits = new Map<number, Octokit>();\n\n  constructor(config: GithubIntegrationConfig) {\n    this.#rules = resolveGithubRules(config.rules);\n    const missing = REQUIRED_FIELDS.filter(field => !config[field]);\n    if (missing.length > 0) {\n      throw new Error(\n        `GithubIntegration: missing required config field(s): ${missing.join(', ')}. ` +\n          `Provide the full GitHub App credentials (appId, privateKey, clientId, clientSecret, slug) ` +\n          `or omit the integration to disable GitHub-backed repositories.`,\n      );\n    }\n    this.#appId = config.appId;\n    this.#privateKey = normalizePrivateKey(config.privateKey);\n    this.#clientId = config.clientId;\n    this.#clientSecret = config.clientSecret;\n    this.#slug = config.slug;\n    this.#webhookSecret = config.webhookSecret || undefined;\n    this.#authorizedBots = (config.authorizedBots ?? []).map(bot => bot.trim()).filter(Boolean);\n  }\n\n  /** App slug — the URL name used to build the install URL. */\n  get slug(): string {\n    return this.#slug;\n  }\n\n  /** Whether a GitHub login belongs to this integration's App. */\n  isFactoryCommentAuthor(login: string | null | undefined): boolean {\n    return typeof login === 'string' && login.toLowerCase() === `${this.#slug}[bot]`.toLowerCase();\n  }\n\n  /** Extra bot logins authorized to trigger author-gated PR notifications. */\n  get authorizedBots(): readonly string[] {\n    return this.#authorizedBots;\n  }\n\n  get genericStorage(): IntegrationContext['storage']['generic'] {\n    if (!this.#storage) throw new Error('GithubIntegration storage has not been initialized.');\n    return this.#storage.generic;\n  }\n\n  get sourceControlStorage(): IntegrationContext['storage']['sourceControl'] {\n    const storage = this.#sourceControlStorage ?? this.#storage?.sourceControl;\n    if (!storage) throw new Error('GithubIntegration source-control storage has not been initialized.');\n    return storage;\n  }\n\n  get integrationStorage(): GithubSubscriptionStorage {\n    if (!this.#storage) throw new Error('GithubIntegration storage has not been initialized.');\n    return this.#storage.generic as unknown as GithubSubscriptionStorage;\n  }\n\n  /** Resolve a stored GitHub locator without scanning installations or repositories. */\n  async #resolveIntakeDispatch({\n    orgId,\n    externalSource,\n  }: {\n    orgId: string;\n    externalSource: { type: string; externalId: string };\n  }): Promise<{ connection: IntegrationConnection; sourceId: string; issueId: string } | null> {\n    const target = parseGithubExternalTarget(externalSource.externalId);\n    if (!target) return null;\n    const repository = await this.sourceControlStorage.repositories.findByExternalId({\n      orgId,\n      externalId: target.repositoryId,\n    });\n    if (!repository) return null;\n    const installation = await this.sourceControlStorage.installations.get({ orgId, id: repository.installationId });\n    if (!installation) return null;\n    const installationId = Number.parseInt(installation.externalId, 10);\n    if (!Number.isSafeInteger(installationId)) return null;\n    return {\n      connection: { type: 'app-installation', installationId },\n      sourceId: repository.slug,\n      issueId: target.issueId,\n    };\n  }\n\n  /** Secret GitHub uses to sign webhook deliveries, when configured. */\n  get webhookSecret(): string | undefined {\n    return this.#webhookSecret;\n  }\n\n  #appAuth() {\n    return {\n      appId: this.#appId,\n      privateKey: this.#privateKey,\n      clientId: this.#clientId,\n      clientSecret: this.#clientSecret,\n    };\n  }\n\n  /**\n   * Octokit authenticated as the GitHub App itself (app JWT). Used for\n   * app-level operations and to mint installation tokens.\n   */\n  getAppOctokit(): Octokit {\n    return new Octokit({ authStrategy: createAppAuth, auth: this.#appAuth() });\n  }\n\n  /**\n   * Octokit authenticated as a specific installation (installation access\n   * token). Used to list repos and to operate on a repo on the user's behalf.\n   */\n  getInstallationOctokit(installationId: number): Octokit {\n    let octokit = this.#installationOctokits.get(installationId);\n    if (octokit) {\n      // Re-insert so Map order tracks recency for LRU eviction.\n      this.#installationOctokits.delete(installationId);\n    } else {\n      const created = new Octokit({ authStrategy: createAppAuth, auth: { ...this.#appAuth(), installationId } });\n      // auth-app keeps serving a cached token GitHub has revoked (it only retries\n      // 401s within 5 s of minting), so drop this client and mint fresh next call.\n      // Not on 403: GitHub also uses it for rate limits.\n      created.hook.error('request', error => {\n        if ('status' in error && error.status === 401 && this.#installationOctokits.get(installationId) === created) {\n          this.#installationOctokits.delete(installationId);\n        }\n        throw error;\n      });\n      octokit = created;\n      if (this.#installationOctokits.size >= INSTALLATION_OCTOKIT_CACHE_MAX_ENTRIES) {\n        const oldest = this.#installationOctokits.keys().next().value;\n        if (oldest !== undefined) this.#installationOctokits.delete(oldest);\n      }\n    }\n    this.#installationOctokits.set(installationId, octokit);\n    return octokit;\n  }\n\n  /** Octokit authenticated as a user via their OAuth token (the identify step). */\n  getUserOctokit(userToken: string): Octokit {\n    return new Octokit({ auth: userToken });\n  }\n\n  /**\n   * Mint a short-lived installation access token. Returned token is used only\n   * server-side / inside the sandbox clone URL and never sent to the browser.\n   */\n  async mintInstallationToken(installationId: number): Promise<string> {\n    const auth = createAppAuth(this.#appAuth());\n    const installationAuth = await auth({ type: 'installation', installationId });\n    return installationAuth.token;\n  }\n\n  /**\n   * List the installations the authenticated user can access, via their OAuth\n   * token (`GET /user/installations`).\n   */\n  async listUserInstallations(userToken: string): Promise<UserInstallation[]> {\n    const octokit = this.getUserOctokit(userToken);\n    const installations = await octokit.paginate(octokit.apps.listInstallationsForAuthenticatedUser, {\n      per_page: 100,\n    });\n    return installations.map(inst => ({\n      installationId: inst.id,\n      accountLogin: inst.account && 'login' in inst.account ? inst.account.login : null,\n      accountType: inst.account && 'type' in inst.account ? inst.account.type : null,\n    }));\n  }\n\n  /**\n   * List repos accessible to an installation (paginated). Always reads\n   * GitHub directly, so `fresh` has nothing to bypass here.\n   */\n  async listInstallationRepos(installationId: number, _options?: { fresh?: boolean }): Promise<RepoSummary[]> {\n    const octokit = this.getInstallationOctokit(installationId);\n    const repos = await octokit.paginate(octokit.apps.listReposAccessibleToInstallation, {\n      per_page: 100,\n    });\n    return repos.map(repo => ({\n      id: repo.id,\n      fullName: repo.full_name,\n      name: repo.name,\n      owner: repo.owner.login,\n      defaultBranch: repo.default_branch,\n      private: repo.private,\n      installationId,\n    }));\n  }\n\n  /**\n   * The authenticated user's permission level on a repo, through the\n   * installation. `undefined` when the repo/user is not accessible.\n   */\n  async getRepositoryCollaboratorPermission(\n    installationId: number,\n    repoFullName: string,\n    username: string,\n    signal?: AbortSignal,\n  ): Promise<GithubRepositoryPermission | undefined> {\n    const parts = splitRepoFullName(repoFullName);\n    if (!parts) return undefined;\n    const cacheKey = `${installationId}:${parts.owner}/${parts.repo}:${username.toLowerCase()}`;\n    const cached = this.#collaboratorPermissionCache.get(cacheKey);\n    if (cached && cached.expiresAt > Date.now()) return cached.permission;\n    this.#collaboratorPermissionCache.delete(cacheKey);\n    const inFlight = this.#collaboratorPermissionInFlight.get(cacheKey);\n    if (inFlight) return settleOrAbort(inFlight, signal, undefined);\n    const lookup = (async () => {\n      try {\n        const { data } = await this.getInstallationOctokit(installationId).repos.getCollaboratorPermissionLevel({\n          ...parts,\n          username,\n          request: { signal: AbortSignal.timeout(COLLABORATOR_PERMISSION_LOOKUP_TIMEOUT_MS) },\n        });\n        const permission = data.permission as GithubRepositoryPermission;\n        // Failures are not cached: a rate-limited or aborted lookup must retry\n        // on the next call rather than pin the login as unknown.\n        this.#collaboratorPermissionCache.set(cacheKey, {\n          permission,\n          expiresAt: Date.now() + COLLABORATOR_PERMISSION_CACHE_TTL_MS,\n        });\n        if (this.#collaboratorPermissionCache.size > COLLABORATOR_PERMISSION_CACHE_MAX_ENTRIES) {\n          const oldest = this.#collaboratorPermissionCache.keys().next().value;\n          if (oldest !== undefined) this.#collaboratorPermissionCache.delete(oldest);\n        }\n        return permission;\n      } catch {\n        return undefined;\n      } finally {\n        this.#collaboratorPermissionInFlight.delete(cacheKey);\n      }\n    })();\n    this.#collaboratorPermissionInFlight.set(cacheKey, lookup);\n    return settleOrAbort(lookup, signal, undefined);\n  }\n\n  /**\n   * Fetch a single repo's metadata through an installation token and confirm\n   * the installation actually has access to it. Returns `null` when the repo\n   * is not accessible to the installation (so a client can't create a project\n   * for an arbitrary repo under an installation id it merely owns).\n   */\n  async getInstallationRepo(installationId: number, repoFullName: string): Promise<RepoSummary | null> {\n    const parts = splitRepoFullName(repoFullName);\n    if (!parts) return null;\n    const octokit = this.getInstallationOctokit(installationId);\n    try {\n      const { data } = await octokit.repos.get(parts);\n      return {\n        id: data.id,\n        fullName: data.full_name,\n        name: data.name,\n        owner: data.owner.login,\n        defaultBranch: data.default_branch,\n        private: data.private,\n        installationId,\n      };\n    } catch {\n      return null;\n    }\n  }\n\n  async #listIntakeIssues(input: ListIntakeIssuesInput): Promise<{ issues: IntakeIssue[]; nextCursor: string | null }> {\n    const installationId = getGithubInstallationId(input.connection);\n    const repoFullName = getSingleSourceId(input.sourceIds, 'GitHub Intake requires exactly one repository source.');\n    const page = parsePositiveCursor(input.cursor);\n    const labels = normalizeLabels(input.labels);\n    const result = await this.listRepoOpenIssues(installationId, repoFullName, page, {\n      label: labels.length > 0 ? labels.join(',') : undefined,\n    });\n    return {\n      issues: result.issues.map(issue => ({\n        id: String(issue.number),\n        identifier: `#${issue.number}`,\n        title: issue.title,\n        url: issue.url,\n        author: issue.author,\n        state: 'open',\n        stateType: 'open',\n        priority: null,\n        assignee: issue.assignees[0] ?? null,\n        assignees: issue.assignees,\n        source: repoFullName,\n        labels: issue.labels,\n        commentCount: issue.comments,\n        createdAt: issue.createdAt,\n        updatedAt: issue.updatedAt,\n      })),\n      nextCursor: result.nextPage === null ? null : String(result.nextPage),\n    };\n  }\n\n  async #getIntakeIssue(input: GetIntakeIssueInput): Promise<IntakeIssueDetail | null> {\n    const installationId = getGithubInstallationId(input.connection);\n    const repoFullName = requireSourceId(input.sourceId, 'GitHub Intake requires a repository source.');\n    const parts = splitRepoFullName(repoFullName);\n    const issueNumber = parsePositiveInteger(input.issueId);\n    if (!parts || issueNumber === null) return null;\n    const octokit = this.getInstallationOctokit(installationId);\n    try {\n      const [{ data: issue }, comments] = await Promise.all([\n        octokit.issues.get({ owner: parts.owner, repo: parts.repo, issue_number: issueNumber }),\n        octokit.paginate(octokit.issues.listComments, {\n          owner: parts.owner,\n          repo: parts.repo,\n          issue_number: issueNumber,\n          per_page: 100,\n        }),\n      ]);\n      if (issue.pull_request) return null;\n      return {\n        id: String(issue.number),\n        identifier: `#${issue.number}`,\n        title: issue.title,\n        url: issue.html_url,\n        author: issue.user?.login ?? null,\n        state: issue.state,\n        stateType: issue.state,\n        priority: null,\n        assignee: issue.assignee?.login ?? null,\n        assignees: (issue.assignees ?? []).map(user => user.login).filter((login): login is string => Boolean(login)),\n        source: repoFullName,\n        labels: issue.labels.map(label => (typeof label === 'string' ? label : (label.name ?? ''))).filter(Boolean),\n        commentCount: issue.comments,\n        createdAt: issue.created_at,\n        updatedAt: issue.updated_at,\n        description: issue.body?.trim() ? issue.body : null,\n        comments: comments.map(comment => ({\n          author: comment.user?.login ?? null,\n          body: comment.body ?? '',\n          createdAt: comment.created_at,\n        })),\n      };\n    } catch (err) {\n      if (isNotFoundError(err)) return null;\n      throw err;\n    }\n  }\n\n  async #updateIntakeIssue(input: UpdateIntakeIssueInput): Promise<IntakeIssue | null> {\n    const installationId = getGithubInstallationId(input.connection);\n    const repoFullName = requireSourceId(input.sourceId, 'GitHub Intake requires a repository source.');\n    const parts = splitRepoFullName(repoFullName);\n    const issueNumber = parsePositiveInteger(input.issueId);\n    if (!parts || issueNumber === null) return null;\n    // GitHub has no custom workflow states; only open/closed. `byName` is a\n    // no-op with a warn log.\n    if (input.state.kind === 'byName') {\n      console.warn(`GitHub integration: updateIssue byName is not supported (name=${input.state.name}); ignoring.`);\n      return null;\n    }\n    const targetState: 'open' | 'closed' =\n      input.state.stateType === 'unstarted' || input.state.stateType === 'started' ? 'open' : 'closed';\n    const stateReason: 'completed' | 'not_planned' | null =\n      targetState === 'closed' ? (input.state.stateType === 'canceled' ? 'not_planned' : 'completed') : null;\n    const octokit = this.getInstallationOctokit(installationId);\n    try {\n      // Pre-flight: Factory does not close pull requests via `updateIssue`.\n      // PR merges/closes belong to the version-control pipeline.\n      const { data: current } = await octokit.issues.get({\n        owner: parts.owner,\n        repo: parts.repo,\n        issue_number: issueNumber,\n      });\n      if (current.pull_request) {\n        console.warn(\n          `GitHub integration: updateIssue rejected — target ${repoFullName}#${issueNumber} is a pull request.`,\n        );\n        return null;\n      }\n      const { data: issue } = await octokit.issues.update({\n        owner: parts.owner,\n        repo: parts.repo,\n        issue_number: issueNumber,\n        state: targetState,\n        ...(stateReason ? { state_reason: stateReason } : {}),\n      });\n      return {\n        id: String(issue.number),\n        identifier: `#${issue.number}`,\n        title: issue.title,\n        url: issue.html_url,\n        author: issue.user?.login ?? null,\n        state: issue.state,\n        stateType: issue.state,\n        priority: null,\n        assignee: issue.assignee?.login ?? null,\n        assignees: (issue.assignees ?? []).map(user => user.login).filter((login): login is string => Boolean(login)),\n        source: repoFullName,\n        labels: issue.labels.map(label => (typeof label === 'string' ? label : (label.name ?? ''))).filter(Boolean),\n        commentCount: issue.comments,\n        createdAt: issue.created_at,\n        updatedAt: issue.updated_at,\n      };\n    } catch (err) {\n      if (isNotFoundError(err)) return null;\n      throw err;\n    }\n  }\n\n  async #createIntakeComment(input: CreateIntakeCommentInput): Promise<{ id: string; url: string } | null> {\n    const installationId = getGithubInstallationId(input.connection);\n    const repoFullName = requireSourceId(input.sourceId, 'GitHub Intake requires a repository source.');\n    const parts = splitRepoFullName(repoFullName);\n    const issueNumber = parsePositiveInteger(input.issueId);\n    if (!parts || issueNumber === null) return null;\n    const octokit = this.getInstallationOctokit(installationId);\n    try {\n      const { data } = await octokit.issues.createComment({\n        owner: parts.owner,\n        repo: parts.repo,\n        issue_number: issueNumber,\n        body: input.body,\n      });\n      return { id: String(data.id), url: data.html_url };\n    } catch (err) {\n      if (isNotFoundError(err)) return null;\n      throw err;\n    }\n  }\n\n  #repositoryClient(connection: IntegrationConnection, sourceId: string) {\n    const installationId = getGithubInstallationId(connection);\n    const parts = splitRepoFullName(sourceId);\n    if (!parts) throw new Error('GitHub pull requests require an owner/repository source.');\n    return { octokit: this.getInstallationOctokit(installationId), parts };\n  }\n\n  async #listPullRequests(input: InputOf<'listPullRequests'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    const page = parsePositiveCursor(input.cursor);\n    const response = await octokit.pulls.list({\n      ...parts,\n      state: input.state ?? 'open',\n      per_page: LIST_PAGE_SIZE,\n      page,\n    });\n    const pullRequests = response.data\n      .filter(pr => input.includeDrafts !== false || !pr.draft)\n      .map(pr => parsePullRequest(pr));\n    return {\n      pullRequests,\n      nextCursor: response.data.length === LIST_PAGE_SIZE ? String(page + 1) : null,\n    };\n  }\n\n  async #getPullRequest(input: InputOf<'getPullRequest'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    const pullNumber = requirePullRequestNumber(input.pullRequestId);\n    try {\n      const { data } = await octokit.pulls.get({ ...parts, pull_number: pullNumber });\n      return parsePullRequest(data);\n    } catch (err) {\n      if (isNotFoundError(err)) return null;\n      throw err;\n    }\n  }\n\n  async #createPullRequest(input: InputOf<'createPullRequest'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    const { data } = await octokit.pulls.create({\n      ...parts,\n      title: input.title,\n      body: input.body,\n      base: input.baseBranch,\n      head: input.headBranch,\n      draft: input.draft,\n    });\n    return parsePullRequest(data);\n  }\n\n  async #updatePullRequest(input: InputOf<'updatePullRequest'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    const { data } = await octokit.pulls.update({\n      ...parts,\n      pull_number: requirePullRequestNumber(input.pullRequestId),\n      title: input.title,\n      body: input.body === null ? '' : input.body,\n      base: input.baseBranch,\n      state: input.state,\n    });\n    return parsePullRequest(data);\n  }\n\n  async #closePullRequest(input: InputOf<'closePullRequest'>) {\n    return this.#updatePullRequest({ ...input, state: 'closed' });\n  }\n\n  async #mergePullRequest(input: InputOf<'mergePullRequest'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    const { data } = await octokit.pulls.merge({\n      ...parts,\n      pull_number: requirePullRequestNumber(input.pullRequestId),\n      commit_title: input.commitTitle,\n      commit_message: input.commitMessage,\n      merge_method: input.method,\n    });\n    return { merged: data.merged, message: data.message, sha: data.sha ?? null };\n  }\n\n  async #listComments(input: InputOf<'listComments'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    const page = parsePositiveCursor(input.cursor);\n    const response = await octokit.issues.listComments({\n      ...parts,\n      issue_number: requirePullRequestNumber(input.pullRequestId),\n      per_page: LIST_PAGE_SIZE,\n      page,\n    });\n    return {\n      comments: response.data.map(comment => parsePullRequestComment(comment)),\n      nextCursor: response.data.length === LIST_PAGE_SIZE ? String(page + 1) : null,\n    };\n  }\n\n  async #createComment(input: InputOf<'createComment'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    const { data } = await octokit.issues.createComment({\n      ...parts,\n      issue_number: requirePullRequestNumber(input.pullRequestId),\n      body: input.body,\n    });\n    return parsePullRequestComment(data);\n  }\n\n  async #updateComment(input: InputOf<'updateComment'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    const { data } = await octokit.issues.updateComment({\n      ...parts,\n      comment_id: requirePositiveId(input.commentId, 'comment'),\n      body: input.body,\n    });\n    return parsePullRequestComment(data);\n  }\n\n  async #deleteComment(input: InputOf<'deleteComment'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    await octokit.issues.deleteComment({ ...parts, comment_id: requirePositiveId(input.commentId, 'comment') });\n  }\n\n  async #listReviews(input: InputOf<'listReviews'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    const page = parsePositiveCursor(input.cursor);\n    const response = await octokit.pulls.listReviews({\n      ...parts,\n      pull_number: requirePullRequestNumber(input.pullRequestId),\n      per_page: LIST_PAGE_SIZE,\n      page,\n    });\n    return {\n      reviews: response.data.map(review => parseReview(review)),\n      nextCursor: response.data.length === LIST_PAGE_SIZE ? String(page + 1) : null,\n    };\n  }\n\n  async #getReview(input: InputOf<'getReview'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    try {\n      const { data } = await octokit.pulls.getReview({\n        ...parts,\n        pull_number: requirePullRequestNumber(input.pullRequestId),\n        review_id: requirePositiveId(input.reviewId, 'review'),\n      });\n      return parseReview(data);\n    } catch (err) {\n      if (isNotFoundError(err)) return null;\n      throw err;\n    }\n  }\n\n  async #createReview(input: InputOf<'createReview'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    const { data } = await octokit.pulls.createReview({\n      ...parts,\n      pull_number: requirePullRequestNumber(input.pullRequestId),\n      body: input.body,\n      commit_id: input.commitId,\n      event: input.event ? reviewEventToGithub(input.event) : undefined,\n    });\n    return parseReview(data);\n  }\n\n  async #updateReview(input: InputOf<'updateReview'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    const { data } = await octokit.pulls.updateReview({\n      ...parts,\n      pull_number: requirePullRequestNumber(input.pullRequestId),\n      review_id: requirePositiveId(input.reviewId, 'review'),\n      body: input.body,\n    });\n    return parseReview(data);\n  }\n\n  async #submitReview(input: InputOf<'submitReview'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    const { data } = await octokit.pulls.submitReview({\n      ...parts,\n      pull_number: requirePullRequestNumber(input.pullRequestId),\n      review_id: requirePositiveId(input.reviewId, 'review'),\n      body: input.body,\n      event: reviewEventToGithub(input.event),\n    });\n    return parseReview(data);\n  }\n\n  async #dismissReview(input: InputOf<'dismissReview'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    const { data } = await octokit.pulls.dismissReview({\n      ...parts,\n      pull_number: requirePullRequestNumber(input.pullRequestId),\n      review_id: requirePositiveId(input.reviewId, 'review'),\n      message: input.message,\n    });\n    return parseReview(data);\n  }\n\n  async #deletePendingReview(input: InputOf<'deletePendingReview'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    await octokit.pulls.deletePendingReview({\n      ...parts,\n      pull_number: requirePullRequestNumber(input.pullRequestId),\n      review_id: requirePositiveId(input.reviewId, 'review'),\n    });\n  }\n\n  async #listReviewComments(input: InputOf<'listReviewComments'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    const page = parsePositiveCursor(input.cursor);\n    const response = await octokit.pulls.listReviewComments({\n      ...parts,\n      pull_number: requirePullRequestNumber(input.pullRequestId),\n      per_page: LIST_PAGE_SIZE,\n      page,\n    });\n    return {\n      comments: response.data.map(comment => parseReviewComment(comment)),\n      nextCursor: response.data.length === LIST_PAGE_SIZE ? String(page + 1) : null,\n    };\n  }\n\n  async #createReviewComment(input: InputOf<'createReviewComment'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    const pullNumber = requirePullRequestNumber(input.pullRequestId);\n    if (input.replyToId) {\n      const { data } = await octokit.pulls.createReplyForReviewComment({\n        ...parts,\n        pull_number: pullNumber,\n        comment_id: requirePositiveId(input.replyToId, 'review comment'),\n        body: input.body,\n      });\n      return parseReviewComment(data);\n    }\n    if (!input.commitId || !input.path || input.line === undefined || !input.side) {\n      throw new Error('A review comment requires commitId, path, line, and side unless it is a reply.');\n    }\n    if ((input.startLine === undefined) !== (input.startSide === undefined)) {\n      throw new Error('A multi-line review comment requires both startLine and startSide.');\n    }\n    const { data } = await octokit.pulls.createReviewComment({\n      ...parts,\n      pull_number: pullNumber,\n      body: input.body,\n      commit_id: input.commitId,\n      path: input.path,\n      line: input.line,\n      side: input.side.toUpperCase() as 'LEFT' | 'RIGHT',\n      start_line: input.startLine,\n      start_side: input.startSide?.toUpperCase() as 'LEFT' | 'RIGHT' | undefined,\n    });\n    return parseReviewComment(data);\n  }\n\n  async #updateReviewComment(input: InputOf<'updateReviewComment'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    const { data } = await octokit.pulls.updateReviewComment({\n      ...parts,\n      comment_id: requirePositiveId(input.commentId, 'review comment'),\n      body: input.body,\n    });\n    return parseReviewComment(data);\n  }\n\n  async #deleteReviewComment(input: InputOf<'deleteReviewComment'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    await octokit.pulls.deleteReviewComment({\n      ...parts,\n      comment_id: requirePositiveId(input.commentId, 'review comment'),\n    });\n  }\n\n  async #listRequestedReviewers(input: InputOf<'listRequestedReviewers'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    const { data } = await octokit.pulls.listRequestedReviewers({\n      ...parts,\n      pull_number: requirePullRequestNumber(input.pullRequestId),\n    });\n    return parseRequestedReviewers(data);\n  }\n\n  async #requestReviewers(input: InputOf<'requestReviewers'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    const { data } = await octokit.pulls.requestReviewers({\n      ...parts,\n      pull_number: requirePullRequestNumber(input.pullRequestId),\n      reviewers: input.users ?? [],\n      team_reviewers: input.teams ?? [],\n    });\n    return parseRequestedReviewers(data);\n  }\n\n  async #removeReviewers(input: InputOf<'removeRequestedReviewers'>) {\n    const { octokit, parts } = this.#repositoryClient(input.connection, input.sourceId);\n    const { data } = await octokit.pulls.removeRequestedReviewers({\n      ...parts,\n      pull_number: requirePullRequestNumber(input.pullRequestId),\n      reviewers: input.users ?? [],\n      team_reviewers: input.teams ?? [],\n    });\n    return parseRequestedReviewers(data);\n  }\n\n  /** Add labels to an issue (deduplicated; no-op on empty/malformed input). */\n  async addIssueLabels(\n    installationId: number,\n    repoFullName: string,\n    issueNumber: number,\n    labels: string[],\n  ): Promise<void> {\n    const parts = splitRepoFullName(repoFullName);\n    if (!parts) return;\n    const uniqueLabels = [...new Set(labels.map(label => label.trim()).filter(Boolean))];\n    if (uniqueLabels.length === 0) return;\n    const octokit = this.getInstallationOctokit(installationId);\n    await octokit.issues.addLabels({\n      owner: parts.owner,\n      repo: parts.repo,\n      issue_number: issueNumber,\n      labels: uniqueLabels,\n    });\n  }\n\n  /** Remove one label from an issue. */\n  async removeIssueLabel(\n    installationId: number,\n    repoFullName: string,\n    issueNumber: number,\n    label: string,\n  ): Promise<void> {\n    const parts = splitRepoFullName(repoFullName);\n    const labelName = label.trim();\n    if (!parts || !labelName) return;\n    const octokit = this.getInstallationOctokit(installationId);\n    await octokit.issues.removeLabel({\n      owner: parts.owner,\n      repo: parts.repo,\n      issue_number: issueNumber,\n      name: labelName,\n    });\n  }\n\n  /**\n   * List one page of a repo's open issues through an installation token. The\n   * issues API also returns pull requests, so those are filtered out (the\n   * filter can make a non-final page shorter than the page size — `nextPage`\n   * is derived from the raw response length, not the filtered one).\n   */\n  async listRepoOpenIssues(\n    installationId: number,\n    repoFullName: string,\n    page: number,\n    options: ListRepoOpenIssuesOptions = {},\n  ): Promise<IssuePage> {\n    const parts = splitRepoFullName(repoFullName);\n    if (!parts) return { issues: [], nextPage: null };\n    const octokit = this.getInstallationOctokit(installationId);\n    const response = await octokit.issues.listForRepo({\n      owner: parts.owner,\n      repo: parts.repo,\n      state: 'open',\n      labels: options.label,\n      per_page: LIST_PAGE_SIZE,\n      page,\n    });\n    const issues = response.data\n      .filter(issue => !issue.pull_request)\n      .map(issue => ({\n        number: issue.number,\n        title: issue.title,\n        url: issue.html_url,\n        author: issue.user?.login ?? null,\n        assignees: issue.assignees?.flatMap(assignee => (assignee.login ? [assignee.login] : [])) ?? [],\n        labels: issue.labels.map(label => (typeof label === 'string' ? label : (label.name ?? ''))).filter(Boolean),\n        comments: issue.comments,\n        createdAt: issue.created_at,\n        updatedAt: issue.updated_at,\n      }));\n    return { issues, nextPage: response.data.length === LIST_PAGE_SIZE ? page + 1 : null };\n  }\n\n  /**\n   * Build the GitHub App install URL. `state` is carried through the install\n   * flow and validated on callback.\n   */\n  buildInstallUrl(state: string): string {\n    const url = new URL(`https://github.com/apps/${this.#slug}/installations/new`);\n    url.searchParams.set('state', state);\n    return url.toString();\n  }\n\n  /**\n   * Build the OAuth identify URL (authorize) used to confirm the user's\n   * identity and obtain a user token for listing their installations.\n   */\n  buildOAuthIdentifyUrl(state: string, redirectUri: string): string {\n    const url = new URL('https://github.com/login/oauth/authorize');\n    url.searchParams.set('client_id', this.#clientId);\n    url.searchParams.set('redirect_uri', redirectUri);\n    url.searchParams.set('state', state);\n    return url.toString();\n  }\n\n  /** Exchange an OAuth `code` for a user access token. */\n  async exchangeOAuthCode(code: string, redirectUri: string): Promise<string> {\n    const res = await fetch('https://github.com/login/oauth/access_token', {\n      method: 'POST',\n      signal: AbortSignal.timeout(GITHUB_OAUTH_TOKEN_TIMEOUT_MS),\n      headers: { 'content-type': 'application/json', accept: 'application/json' },\n      body: JSON.stringify({\n        client_id: this.#clientId,\n        client_secret: this.#clientSecret,\n        code,\n        redirect_uri: redirectUri,\n      }),\n    });\n    if (!res.ok) {\n      throw new Error(`GitHub OAuth token exchange failed: ${res.status}`);\n    }\n    const data = (await res.json()) as { access_token?: string; error?: string; error_description?: string };\n    if (!data.access_token) {\n      throw new Error(\n        `GitHub OAuth token exchange returned no token: ${data.error_description ?? data.error ?? 'unknown'}`,\n      );\n    }\n    return data.access_token;\n  }\n\n  /**\n   * The integration's HTTP surface: the `/web/github/*` + `/auth/github/*`\n   * Mastra `apiRoutes` (webhook handler, install/OAuth flow, project +\n   * worktree + session operations). The factory folds these into the server's\n   * `apiRoutes` when the feature is ready. Handlers operate on this instance.\n   */\n  routes(ctx: IntegrationContext): ApiRoute[] {\n    this.#storage = ctx.storage;\n    const ingestFactoryEvent = attachGithubRules(this, ctx);\n    this.#ingestFactoryEvent = ingestFactoryEvent;\n    return buildGithubRoutes({\n      github: this,\n      auth: ctx.auth,\n      sandbox: ctx.sandbox,\n      ...(ctx.users ? { users: ctx.users } : {}),\n      storage: ctx.factoryStorage,\n      stateSigner: ctx.stateSigner,\n      baseUrl: ctx.baseUrl,\n      controller: ctx.controller,\n      memorySettings: ctx.storage.memorySettings,\n      emitAudit: ctx.hooks?.emitAudit,\n      projects: ctx.storage.projects,\n      ingestFactoryEvent,\n      sessionRetirement: ctx.sessionRetirement,\n      ...(ctx.workItems ? { workItems: ctx.workItems } : {}),\n    });\n  }\n\n  /**\n   * Import a newly linked repository's open issues and pull requests onto\n   * the board. No-op until routes are mounted with rules configured.\n   */\n  async ingestLinkedRepositoryBacklog(args: { orgId: string; projectRepositoryId: string }): Promise<void> {\n    await ingestLinkedRepositoryBacklog({ github: this, ...args, ingestFactoryEvent: this.#ingestFactoryEvent });\n  }\n\n  /**\n   * Pull-request and issue sweeps share a worker and lease, but can be enabled\n   * and paced independently. The legacy combined controls remain the fallback.\n   */\n  workers(ctx: IntegrationContext): MastraWorker[] {\n    const pullRequestEnabled = reconciliationEnabled(\n      process.env.MASTRACODE_GITHUB_PR_RECONCILE_ENABLED,\n      process.env.MASTRACODE_GITHUB_RECONCILE_ENABLED,\n    );\n    const issueEnabled = reconciliationEnabled(\n      process.env.MASTRACODE_GITHUB_ISSUE_RECONCILE_ENABLED,\n      process.env.MASTRACODE_GITHUB_RECONCILE_ENABLED,\n    );\n    if (!pullRequestEnabled && !issueEnabled) return [];\n\n    const reconcile = pullRequestEnabled\n      ? attachGithubReconciler(this, ctx, input => this.fetchPullRequestState(input))\n      : undefined;\n    const issues = issueEnabled\n      ? attachGithubIssueReconciler(\n          this,\n          ctx,\n          input => this.fetchIssueState(input),\n          input => this.listOpenIssueStates(input),\n        )\n      : undefined;\n    if (!reconcile && !issues) return [];\n\n    const legacyInterval = reconcileInterval(process.env.MASTRACODE_GITHUB_RECONCILE_INTERVAL_MS);\n    const intervalMs = reconcileInterval(process.env.MASTRACODE_GITHUB_PR_RECONCILE_INTERVAL_MS) ?? legacyInterval;\n    const issueIntervalMs =\n      reconcileInterval(process.env.MASTRACODE_GITHUB_ISSUE_RECONCILE_INTERVAL_MS) ?? legacyInterval;\n    return [\n      new GithubReconcileWorker({\n        ...(reconcile ? { reconcile } : {}),\n        ...(issues ? { reconcileIssues: issues } : {}),\n        sourceControl: ctx.storage.sourceControl,\n        ...(intervalMs ? { intervalMs } : {}),\n        ...(issueIntervalMs ? { issueIntervalMs } : {}),\n      }),\n    ];\n  }\n\n  /**\n   * Reads live PR state for the merge reconciler. Returns undefined when the PR\n   * cannot be resolved so a sweep never fabricates a merge.\n   */\n  async fetchPullRequestState(input: {\n    installationId: number;\n    repository: string;\n    number: number;\n  }): Promise<ReconcilePullRequestState | undefined> {\n    try {\n      const pullRequest = await this.#getPullRequest({\n        connection: { type: 'app-installation', installationId: input.installationId },\n        sourceId: input.repository,\n        pullRequestId: String(input.number),\n      });\n      if (!pullRequest) return undefined;\n      return {\n        title: pullRequest.title,\n        url: pullRequest.url,\n        state: pullRequest.state === 'closed' ? 'closed' : 'open',\n        draft: pullRequest.draft,\n        merged: pullRequest.merged,\n        assignees: pullRequest.assignees ?? [],\n        requestedReviewers: pullRequest.requestedReviewers ?? [],\n        labels: pullRequest.labels ?? [],\n        headBranch: pullRequest.headBranch,\n        baseBranch: pullRequest.baseBranch,\n        ...(pullRequest.author ? { author: pullRequest.author } : {}),\n        ...(pullRequest.createdAt ? { createdAt: pullRequest.createdAt } : {}),\n      };\n    } catch {\n      return undefined;\n    }\n  }\n\n  /**\n   * Reads live issue state for the reconciler. Returns undefined when the\n   * issue cannot be resolved (missing, is actually a PR, API error) so a\n   * sweep never fabricates a close.\n   */\n  async fetchIssueState(input: {\n    installationId: number;\n    repository: string;\n    number: number;\n  }): Promise<ReconcileIssueState | undefined> {\n    const parts = splitRepoFullName(input.repository);\n    if (!parts) return undefined;\n    try {\n      const octokit = this.getInstallationOctokit(input.installationId);\n      const { data: issue } = await octokit.issues.get({\n        owner: parts.owner,\n        repo: parts.repo,\n        issue_number: input.number,\n      });\n      if (issue.pull_request) return undefined;\n      return {\n        title: issue.title,\n        url: issue.html_url,\n        state: issue.state === 'closed' ? 'closed' : 'open',\n        ...(issue.state_reason ? { stateReason: issue.state_reason } : {}),\n        assignees: (issue.assignees ?? []).map(user => user.login).filter((login): login is string => Boolean(login)),\n        labels: (issue.labels ?? [])\n          .map(label => (typeof label === 'string' ? label : label.name))\n          .filter((name): name is string => Boolean(name)),\n        ...(issue.user?.login ? { author: issue.user.login } : {}),\n        createdAt: issue.created_at,\n        updatedAt: issue.updated_at,\n      };\n    } catch {\n      return undefined;\n    }\n  }\n\n  /**\n   * Lists a repository's open issues (pull requests excluded) so the issue\n   * sweep can mint cards for issues whose webhook never arrived.\n   */\n  async listOpenIssueStates(input: {\n    installationId: number;\n    repository: string;\n  }): Promise<Array<ReconcileIssueState & { number: number }>> {\n    const parts = splitRepoFullName(input.repository);\n    if (!parts) return [];\n    const octokit = this.getInstallationOctokit(input.installationId);\n    const issues: Array<ReconcileIssueState & { number: number }> = [];\n    for (let page = 1; page <= OPEN_ISSUE_DISCOVERY_MAX_PAGES; page += 1) {\n      const { data } = await octokit.issues.listForRepo({\n        owner: parts.owner,\n        repo: parts.repo,\n        state: 'open',\n        per_page: OPEN_ISSUE_DISCOVERY_PAGE_SIZE,\n        page,\n      });\n      for (const issue of data) {\n        if (issue.pull_request) continue;\n        issues.push({\n          number: issue.number,\n          title: issue.title,\n          url: issue.html_url,\n          state: 'open',\n          assignees: (issue.assignees ?? []).map(user => user.login).filter((login): login is string => Boolean(login)),\n          labels: (issue.labels ?? [])\n            .map(label => (typeof label === 'string' ? label : label.name))\n            .filter((name): name is string => Boolean(name)),\n          ...(issue.user?.login ? { author: issue.user.login } : {}),\n          createdAt: issue.created_at,\n          updatedAt: issue.updated_at,\n        });\n      }\n      if (data.length < OPEN_ISSUE_DISCOVERY_PAGE_SIZE) break;\n    }\n    return issues;\n  }\n\n  /**\n   * Session-scoped agent tools for token refresh and PR subscriptions in\n   * sessions bound to a GitHub-backed project. Empty elsewhere.\n   */\n  async upsertFactoryTriageComment(input: GithubTriageCommentUpsertInput): Promise<GithubTriageCommentUpsertResult> {\n    const parts = splitRepoFullName(input.repository);\n    if (!parts) throw new Error('GitHub triage comments require an owner/repository source.');\n    const octokit = this.getInstallationOctokit(input.installationId);\n    const comments = [] as Array<{\n      id: number;\n      body?: string | null;\n      user?: { login?: string } | null;\n      html_url: string;\n    }>;\n    for (let page = 1; ; page += 1) {\n      const response = await octokit.issues.listComments({\n        ...parts,\n        issue_number: input.issueNumber,\n        per_page: 100,\n        page,\n      });\n      comments.push(...response.data);\n      if (response.data.length < 100) break;\n    }\n    const existing = comments\n      .filter(\n        comment =>\n          comment.body?.includes('<!-- mastra-factory-triage -->') && this.isFactoryCommentAuthor(comment.user?.login),\n      )\n      .sort((left, right) => left.id - right.id)[0];\n    if (existing) {\n      const { data } = await octokit.issues.updateComment({ ...parts, comment_id: existing.id, body: input.body });\n      return { action: 'updated', commentId: String(data.id), url: data.html_url };\n    }\n    const { data } = await octokit.issues.createComment({\n      ...parts,\n      issue_number: input.issueNumber,\n      body: input.body,\n    });\n    return { action: 'created', commentId: String(data.id), url: data.html_url };\n  }\n\n  sessionTools({ requestContext }: { requestContext: RequestContext }): IntegrationTools {\n    return createGithubSubscriptionTools(requestContext, this);\n  }\n\n  async postToolObserver({\n    toolContext,\n    requestContext,\n  }: Parameters<NonNullable<FactoryIntegration['postToolObserver']>>[0]): Promise<void> {\n    const pullRequestUrl = parseCreatedPullRequest(toolContext);\n    if (!pullRequestUrl || !requestContext) return;\n    await subscribeCurrentSessionToPullRequest(requestContext, pullRequestUrl, 'auto-gh-pr-create', this);\n  }\n\n  /** Non-secret config snapshot for system diagnostics/startup logs. */\n  diagnostics(): Record<string, unknown> {\n    return {\n      slug: this.#slug,\n      webhookSecretConfigured: this.#webhookSecret !== undefined,\n    };\n  }\n}\n\ninterface GithubPullRequestData {\n  number: number;\n  title: string;\n  html_url: string;\n  user: { login?: string } | null;\n  assignees?: Array<{ login?: string }> | null;\n  requested_reviewers?: Array<{ login?: string }> | null;\n  labels?: Array<{ name?: string } | string> | null;\n  body?: string | null;\n  state: string;\n  draft?: boolean | null;\n  merged?: boolean;\n  merged_at?: string | null;\n  mergeable?: boolean | null;\n  base: { ref: string };\n  head: { ref: string; sha: string };\n  created_at: string;\n  updated_at: string;\n}\n\ninterface GithubCommentData {\n  id: number;\n  html_url: string;\n  user: { login?: string } | null;\n  body?: string | null;\n  created_at: string;\n  updated_at: string;\n}\n\ninterface GithubReviewData {\n  id: number;\n  html_url?: string;\n  user: { login?: string } | null;\n  body?: string | null;\n  state: string;\n  commit_id?: string | null;\n  submitted_at?: string | null;\n}\n\ninterface GithubReviewCommentData extends GithubCommentData {\n  path: string;\n  line?: number | null;\n  side?: string | null;\n  commit_id: string;\n  in_reply_to_id?: number | null;\n}\n\nfunction parsePullRequest(pr: GithubPullRequestData): PullRequest {\n  return {\n    id: String(pr.number),\n    title: pr.title,\n    url: pr.html_url,\n    author: pr.user?.login ?? null,\n    assignees: (pr.assignees ?? []).flatMap(assignee => (assignee.login ? [assignee.login] : [])),\n    requestedReviewers: (pr.requested_reviewers ?? []).flatMap(reviewer => (reviewer.login ? [reviewer.login] : [])),\n    labels: (pr.labels ?? []).flatMap(label => (typeof label === 'string' ? [label] : label.name ? [label.name] : [])),\n    body: pr.body?.trim() ? pr.body : null,\n    state: pr.state === 'closed' ? 'closed' : 'open',\n    draft: pr.draft ?? false,\n    merged: pr.merged ?? Boolean(pr.merged_at),\n    mergeable: typeof pr.mergeable === 'boolean' ? pr.mergeable : null,\n    baseBranch: pr.base.ref,\n    headBranch: pr.head.ref,\n    headSha: pr.head.sha,\n    createdAt: pr.created_at,\n    updatedAt: pr.updated_at,\n  };\n}\n\nfunction parsePullRequestComment(comment: GithubCommentData): PullRequestComment {\n  return {\n    id: String(comment.id),\n    url: comment.html_url,\n    author: comment.user?.login ?? null,\n    body: comment.body ?? '',\n    createdAt: comment.created_at,\n    updatedAt: comment.updated_at,\n  };\n}\n\nfunction parseReview(review: GithubReviewData): Review {\n  return {\n    id: String(review.id),\n    url: review.html_url ?? null,\n    author: review.user?.login ?? null,\n    body: review.body?.trim() ? review.body : null,\n    state: parseReviewState(review.state),\n    commitId: review.commit_id ?? null,\n    submittedAt: review.submitted_at ?? null,\n  };\n}\n\nfunction parseReviewComment(comment: GithubReviewCommentData): ReviewComment {\n  const parsed = parsePullRequestComment(comment);\n  const side = comment.side?.toLowerCase();\n  return {\n    ...parsed,\n    path: comment.path,\n    line: comment.line ?? null,\n    side: side === 'left' || side === 'right' ? side : null,\n    commitId: comment.commit_id,\n    replyToId: comment.in_reply_to_id ? String(comment.in_reply_to_id) : null,\n  };\n}\n\nfunction parseRequestedReviewers(data: {\n  users?: Array<{ login?: string }> | null;\n  teams?: Array<{ slug?: string }> | null;\n  requested_reviewers?: Array<{ login?: string }> | null;\n  requested_teams?: Array<{ slug?: string }> | null;\n}) {\n  return {\n    users: (data.users ?? data.requested_reviewers ?? []).flatMap(user => (user.login ? [user.login] : [])),\n    teams: (data.teams ?? data.requested_teams ?? []).flatMap(team => (team.slug ? [team.slug] : [])),\n  };\n}\n\nfunction parseReviewState(state: string): Review['state'] {\n  if (state === 'PENDING') return 'pending';\n  if (state === 'COMMENTED') return 'commented';\n  if (state === 'APPROVED') return 'approved';\n  if (state === 'CHANGES_REQUESTED') return 'changes-requested';\n  if (state === 'DISMISSED') return 'dismissed';\n  throw new Error(`Unsupported GitHub review state: ${state}`);\n}\n\nfunction reviewEventToGithub(event: Exclude<InputOf<'createReview'>['event'], undefined>) {\n  if (event === 'approve') return 'APPROVE' as const;\n  if (event === 'request-changes') return 'REQUEST_CHANGES' as const;\n  return 'COMMENT' as const;\n}\n\nfunction requirePullRequestNumber(value: string): number {\n  return requirePositiveId(value, 'pull request');\n}\n\nfunction requirePositiveId(value: string, resource: string): number {\n  const parsed = parsePositiveInteger(value);\n  if (parsed === null) throw new Error(`GitHub ${resource} id must be a positive integer.`);\n  return parsed;\n}\n\nfunction getGithubInstallationId(connection: IntegrationConnection): number {\n  if (connection.type !== 'app-installation') {\n    throw new Error('GitHub capabilities require an app-installation connection.');\n  }\n  return connection.installationId;\n}\n\nfunction getSingleSourceId(sourceIds: string[], message: string): string {\n  if (sourceIds.length !== 1) throw new Error(message);\n  return sourceIds[0]!;\n}\n\nfunction normalizeLabels(labels: string[] | undefined): string[] {\n  return [...new Set((labels ?? []).map(label => label.trim()).filter(Boolean))];\n}\n\nfunction requireSourceId(sourceId: string | undefined, message: string): string {\n  if (!sourceId) throw new Error(message);\n  return sourceId;\n}\n\nfunction parsePositiveCursor(cursor: string | undefined): number {\n  if (cursor === undefined) return 1;\n  const page = parsePositiveInteger(cursor);\n  if (page === null) throw new Error('GitHub cursor must be a positive page number.');\n  return page;\n}\n\nfunction parsePositiveInteger(value: string): number | null {\n  if (!/^\\d+$/.test(value)) return null;\n  const parsed = Number(value);\n  return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : null;\n}\n\nfunction isNotFoundError(error: unknown): boolean {\n  return typeof error === 'object' && error !== null && 'status' in error && error.status === 404;\n}\n\n/** Split an `owner/name` full name into its parts, or `null` when malformed. */\nfunction splitRepoFullName(repoFullName: string): { owner: string; repo: string } | null {\n  const slash = repoFullName.indexOf('/');\n  if (slash <= 0 || slash === repoFullName.length - 1) return null;\n  return { owner: repoFullName.slice(0, slash), repo: repoFullName.slice(slash + 1) };\n}\n\nfunction parseGithubExternalTarget(externalId: string): { repositoryId: string; issueId: string } | null {\n  const match = externalId.match(/^github:(\\d+):(?:issue|pull-request):(\\d+)$/) ?? externalId.match(/^(\\d+):(\\d+)$/);\n  if (!match?.[1] || !match[2]) return null;\n  const repositoryId = parsePositiveInteger(match[1]);\n  const issueId = parsePositiveInteger(match[2]);\n  return repositoryId && issueId ? { repositoryId: String(repositoryId), issueId: String(issueId) } : null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA6EA,SAAgB,oBAAoB,KAAqB;CACvD,MAAM,MAAM,IAAI,QAAQ,QAAQ,IAAI;CACpC,IAAI,IAAI,SAAS,IAAI,GAAG,OAAO;CAC/B,MAAM,YAAY,IAAI,KAAK,CAAC,CAAC,MAAM,qEAAqE;CACxG,IAAI,CAAC,WAAW,OAAO;CACvB,MAAM,OAAO,UAAU,EAAE,CAAE,QAAQ,QAAQ,EAAE;CAC7C,OAAO,GAAG,UAAU,GAAG,IAAI,KAAK,MAAM,UAAU,CAAC,CAAE,KAAK,IAAI,EAAE,IAAI,UAAU,GAAG;AACjF;;;;;;;;AAwCA,MAAM,uCAAuC,KAAK;AAClD,MAAM,4CAA4C;;AAElD,MAAM,4CAA4C;;AAElD,MAAM,yCAAyC;;AAE/C,MAAM,iCAAiC;AACvC,MAAM,iCAAiC;;AAevC,MAAa,iBAAiB;;AAG9B,MAAM,gCAAgC;;AA4CtC,MAAM,kBAAkB;CAAC;CAAS;CAAc;CAAY;CAAgB;AAAM;AAElF,IAAa,oBAAb,MAA6D;;CAE3D,KAAc;CACd;CAEA,IAAI,QAA0B;EAC5B,OAAO,KAAKA;CACd;CACA,SAA0B;EACxB,wBAAuB,UAAS,KAAKC,uBAAuB,KAAK;EACjE,aAAa,OAAO,EAAE,YAAY;GAChC,MAAM,gBAAgB,MAAM,KAAK,qBAAqB,cAAc,KAAK,EAAE,MAAM,CAAC;GAMlF,QAAO,MALoB,QAAQ,IACjC,cAAc,KAAI,iBAChB,KAAK,qBAAqB,aAAa,KAAK;IAAE;IAAO,gBAAgB,aAAa;GAAG,CAAC,CACxF,CACF,EAAA,CACoB,KAAK,CAAC,CAAC,KAAI,gBAAe;IAC5C,IAAI,WAAW;IACf,MAAM,WAAW;IACjB,MAAM;IACN,UAAU,EAAE,eAAe,WAAW,cAAc;GACtD,EAAE;EACJ;EACA,WAAW,OAAO,EAAE,OAAO,WAAW,aAAa;GACjD,MAAM,OAAO,SAAS,OAAO,SAAS,QAAQ,EAAE,IAAI;GACpD,MAAM,gBAAgB,OAAO,cAAc,IAAI,KAAK,OAAO,IAAI,OAAO;GACtE,MAAM,QAAQ,MAAM,QAAQ,IAC1B,UAAU,IAAI,OAAM,aAAY;IAC9B,MAAM,aAAa,MAAM,KAAK,qBAAqB,aAAa,IAAI;KAAE;KAAO,IAAI;IAAS,CAAC;IAC3F,IAAI,CAAC,YAAY,OAAO;KAAE,OAAO,CAAC;KAAG,aAAa;IAAM;IACxD,MAAM,eAAe,MAAM,KAAK,qBAAqB,cAAc,IAAI;KACrE;KACA,IAAI,WAAW;IACjB,CAAC;IACD,IAAI,CAAC,cAAc,OAAO;KAAE,OAAO,CAAC;KAAG,aAAa;IAAM;IAC1D,MAAM,iBAAiB,OAAO,SAAS,aAAa,YAAY,EAAE;IAClE,IAAI,CAAC,OAAO,cAAc,cAAc,GAAG,OAAO;KAAE,OAAO,CAAC;KAAG,aAAa;IAAM;IAClF,MAAM,CAAC,QAAQ,gBAAgB,MAAM,QAAQ,IAAI,CAC/C,KAAK,mBAAmB,gBAAgB,WAAW,MAAM,aAAa,GACtE,KAAK,eAAe,iBAAiB;KACnC,YAAY;MAAE,MAAM;MAAoB;KAAe;KACvD,UAAU,WAAW;KACrB,eAAe;KACf,QAAQ,OAAO,aAAa;IAC9B,CAAC,CACH,CAAC;IACD,OAAO;KACL,OAAO,CACL,GAAG,OAAO,OAAO,KAAI,WAAU;MAC7B,QAAQ;OAAE,MAAM;OAAS,YAAY,GAAG,WAAW,WAAW,GAAG,MAAM;OAAU,KAAK,MAAM;MAAI;MAChG,UAAU,WAAW;MACrB,OAAO,MAAM;MACb,QAAQ;MACR,QAAQ,MAAM;MACd,WAAW,MAAM;MACjB,WAAW,MAAM;MACjB,UAAU;OAAE,YAAY,WAAW;OAAM,QAAQ,MAAM;OAAQ,QAAQ,MAAM;MAAO;KACtF,EAAE,GACF,GAAG,aAAa,aAAa,KAAI,iBAAgB;MAC/C,QAAQ;OACN,MAAM;OACN,YAAY,GAAG,WAAW,WAAW,GAAG,YAAY;OACpD,KAAK,YAAY;MACnB;MACA,UAAU,WAAW;MACrB,OAAO,YAAY;MACnB,QAAQ;MACR,WAAW,YAAY;MACvB,WAAW,YAAY;MACvB,UAAU;OACR,YAAY,WAAW;OACvB,QAAQ,OAAO,YAAY,EAAE;OAC7B,QAAQ,YAAY;OACpB,YAAY,YAAY;OACxB,YAAY,YAAY;MAC1B;KACF,EAAE,CACJ;KACA,aAAa,OAAO,aAAa,QAAQ,aAAa,eAAe;IACvE;GACF,CAAC,CACH;GACA,OAAO;IACL,OAAO,MAAM,SAAQ,WAAU,OAAO,KAAK;IAC3C,YAAY,MAAM,MAAK,WAAU,OAAO,WAAW,IAAI,OAAO,gBAAgB,CAAC,IAAI;GACrF;EACF;EACA,aAAY,UAAS,KAAKC,kBAAkB,KAAK;EACjD,WAAU,UAAS,KAAKC,gBAAgB,KAAK;EAC7C,gBAAe,UAAS,KAAKC,qBAAqB,KAAK;EACvD,cAAa,UAAS,KAAKC,mBAAmB,KAAK;CACrD;CACA,iBAA0C;EACxC,aAAa,EAAE,cAAc;GAC3B,KAAKC,wBAAwB;EAC/B;EACA,uBAAuB,EAAE,OAAO,QAAQ,mBACtC,KAAK,qBAAqB,cAAc,OAAO;GAC7C;GACA,mBAAmB;GACnB,YAAY,aAAa;GACzB,aAAa,aAAa;GAC1B,aAAa,aAAa;GAC1B,kBAAkB,aAAa;EACjC,CAAC;EACH,uBAAuB,EAAE,OAAO,gBAAgB,mBAC9C,QAAQ,IACN,aAAa,KAAI,eACf,KAAK,qBAAqB,aAAa,OAAO;GAC5C;GACA,OAAO;IACL;IACA,YAAY,WAAW;IACvB,MAAM,WAAW;IACjB,eAAe,WAAW;IAC1B,kBAAkB,WAAW;GAC/B;EACF,CAAC,CACH,CACF;EACF,qBAAqB,OAAO,EAAE,OAAO,mBAAmB;GACtD,MAAM,aAAa,MAAM,KAAK,qBAAqB,aAAa,IAAI;IAAE;IAAO,IAAI;GAAa,CAAC;GAC/F,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,uCAAuC;GACxE,MAAM,eAAe,MAAM,KAAK,qBAAqB,cAAc,IAAI;IACrE;IACA,IAAI,WAAW;GACjB,CAAC;GACD,IAAI,CAAC,cAAc,MAAM,IAAI,MAAM,yCAAyC;GAC5E,MAAM,iBAAiB,OAAO,SAAS,aAAa,YAAY,EAAE;GAClE,IAAI,CAAC,OAAO,cAAc,cAAc,GAAG,MAAM,IAAI,MAAM,oCAAoC;GAC/F,OAAO;IACL,YAAY;KAAE,MAAM;KAAoB;IAAe;IACvD,UAAU,WAAW;GACvB;EACF;EACA,qBAAqB,OAAO,EAAE,OAAO,mBAAmB;GACtD,MAAM,aAAa,MAAM,KAAK,qBAAqB,aAAa,IAAI;IAAE;IAAO,IAAI;GAAa,CAAC;GAC/F,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,uCAAuC;GACxE,MAAM,eAAe,MAAM,KAAK,qBAAqB,cAAc,IAAI;IACrE;IACA,IAAI,WAAW;GACjB,CAAC;GACD,IAAI,CAAC,cAAc,MAAM,IAAI,MAAM,yCAAyC;GAC5E,MAAM,iBAAiB,OAAO,SAAS,aAAa,YAAY,EAAE;GAClE,IAAI,CAAC,OAAO,cAAc,cAAc,GAAG,MAAM,IAAI,MAAM,oCAAoC;GAC/F,OAAO;IACL,UAAU,sBAAsB,WAAW,KAAK;IAChD,eAAe;KAAE,QAAQ;KAAU,OAAO,MAAM,KAAK,sBAAsB,cAAc;IAAE;GAC7F;EACF;EACA,mBAAkB,UAAS,KAAKC,kBAAkB,KAAK;EACvD,iBAAgB,UAAS,KAAKC,gBAAgB,KAAK;EACnD,oBAAmB,UAAS,KAAKC,mBAAmB,KAAK;EACzD,oBAAmB,UAAS,KAAKC,mBAAmB,KAAK;EACzD,mBAAkB,UAAS,KAAKC,kBAAkB,KAAK;EACvD,mBAAkB,UAAS,KAAKC,kBAAkB,KAAK;EACvD,eAAc,UAAS,KAAKC,cAAc,KAAK;EAC/C,gBAAe,UAAS,KAAKC,eAAe,KAAK;EACjD,gBAAe,UAAS,KAAKC,eAAe,KAAK;EACjD,gBAAe,UAAS,KAAKC,eAAe,KAAK;EACjD,cAAa,UAAS,KAAKC,aAAa,KAAK;EAC7C,YAAW,UAAS,KAAKC,WAAW,KAAK;EACzC,eAAc,UAAS,KAAKC,cAAc,KAAK;EAC/C,eAAc,UAAS,KAAKC,cAAc,KAAK;EAC/C,eAAc,UAAS,KAAKC,cAAc,KAAK;EAC/C,gBAAe,UAAS,KAAKC,eAAe,KAAK;EACjD,sBAAqB,UAAS,KAAKC,qBAAqB,KAAK;EAC7D,qBAAoB,UAAS,KAAKC,oBAAoB,KAAK;EAC3D,sBAAqB,UAAS,KAAKC,qBAAqB,KAAK;EAC7D,sBAAqB,UAAS,KAAKC,qBAAqB,KAAK;EAC7D,sBAAqB,UAAS,KAAKC,qBAAqB,KAAK;EAC7D,yBAAwB,UAAS,KAAKC,wBAAwB,KAAK;EACnE,mBAAkB,UAAS,KAAKC,kBAAkB,KAAK;EACvD,2BAA0B,UAAS,KAAKC,iBAAiB,KAAK;CAChE;;;;;CAKA,4BAAqC;CAErC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;CAEA,+CAAwC,IAAI,IAG1C;;CAEF,kDAA2C,IAAI,IAA6D;;;;;;CAM5G,wCAAiC,IAAI,IAAqB;CAE1D,YAAY,QAAiC;EAC3C,KAAK9B,SAAS,mBAAmB,OAAO,KAAK;EAC7C,MAAM,UAAU,gBAAgB,QAAO,UAAS,CAAC,OAAO,MAAM;EAC9D,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,MACR,wDAAwD,QAAQ,KAAK,IAAI,EAAE,2JAG7E;EAEF,KAAK+B,SAAS,OAAO;EACrB,KAAKC,cAAc,oBAAoB,OAAO,UAAU;EACxD,KAAKC,YAAY,OAAO;EACxB,KAAKC,gBAAgB,OAAO;EAC5B,KAAKC,QAAQ,OAAO;EACpB,KAAKC,iBAAiB,OAAO,iBAAiB,KAAA;EAC9C,KAAKC,mBAAmB,OAAO,kBAAkB,CAAC,EAAA,CAAG,KAAI,QAAO,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO;CAC5F;;CAGA,IAAI,OAAe;EACjB,OAAO,KAAKF;CACd;;CAGA,uBAAuB,OAA2C;EAChE,OAAO,OAAO,UAAU,YAAY,MAAM,YAAY,MAAM,GAAG,KAAKA,MAAM,OAAO,YAAY;CAC/F;;CAGA,IAAI,iBAAoC;EACtC,OAAO,KAAKE;CACd;CAEA,IAAI,iBAA2D;EAC7D,IAAI,CAAC,KAAKI,UAAU,MAAM,IAAI,MAAM,qDAAqD;EACzF,OAAO,KAAKA,SAAS;CACvB;CAEA,IAAI,uBAAuE;EACzE,MAAM,UAAU,KAAKnC,yBAAyB,KAAKmC,UAAU;EAC7D,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,oEAAoE;EAClG,OAAO;CACT;CAEA,IAAI,qBAAgD;EAClD,IAAI,CAAC,KAAKA,UAAU,MAAM,IAAI,MAAM,qDAAqD;EACzF,OAAO,KAAKA,SAAS;CACvB;;CAGA,MAAMxC,uBAAuB,EAC3B,OACA,kBAI2F;EAC3F,MAAM,SAAS,0BAA0B,eAAe,UAAU;EAClE,IAAI,CAAC,QAAQ,OAAO;EACpB,MAAM,aAAa,MAAM,KAAK,qBAAqB,aAAa,iBAAiB;GAC/E;GACA,YAAY,OAAO;EACrB,CAAC;EACD,IAAI,CAAC,YAAY,OAAO;EACxB,MAAM,eAAe,MAAM,KAAK,qBAAqB,cAAc,IAAI;GAAE;GAAO,IAAI,WAAW;EAAe,CAAC;EAC/G,IAAI,CAAC,cAAc,OAAO;EAC1B,MAAM,iBAAiB,OAAO,SAAS,aAAa,YAAY,EAAE;EAClE,IAAI,CAAC,OAAO,cAAc,cAAc,GAAG,OAAO;EAClD,OAAO;GACL,YAAY;IAAE,MAAM;IAAoB;GAAe;GACvD,UAAU,WAAW;GACrB,SAAS,OAAO;EAClB;CACF;;CAGA,IAAI,gBAAoC;EACtC,OAAO,KAAKmC;CACd;CAEA,WAAW;EACT,OAAO;GACL,OAAO,KAAKL;GACZ,YAAY,KAAKC;GACjB,UAAU,KAAKC;GACf,cAAc,KAAKC;EACrB;CACF;;;;;CAMA,gBAAyB;EACvB,OAAO,IAAI,QAAQ;GAAE,cAAc;GAAe,MAAM,KAAKQ,SAAS;EAAE,CAAC;CAC3E;;;;;CAMA,uBAAuB,gBAAiC;EACtD,IAAI,UAAU,KAAKF,sBAAsB,IAAI,cAAc;EAC3D,IAAI,SAEF,KAAKA,sBAAsB,OAAO,cAAc;OAC3C;GACL,MAAM,UAAU,IAAI,QAAQ;IAAE,cAAc;IAAe,MAAM;KAAE,GAAG,KAAKE,SAAS;KAAG;IAAe;GAAE,CAAC;GAIzG,QAAQ,KAAK,MAAM,YAAW,UAAS;IACrC,IAAI,YAAY,SAAS,MAAM,WAAW,OAAO,KAAKF,sBAAsB,IAAI,cAAc,MAAM,SAClG,KAAKA,sBAAsB,OAAO,cAAc;IAElD,MAAM;GACR,CAAC;GACD,UAAU;GACV,IAAI,KAAKA,sBAAsB,QAAQ,wCAAwC;IAC7E,MAAM,SAAS,KAAKA,sBAAsB,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,WAAW,KAAA,GAAW,KAAKA,sBAAsB,OAAO,MAAM;GACpE;EACF;EACA,KAAKA,sBAAsB,IAAI,gBAAgB,OAAO;EACtD,OAAO;CACT;;CAGA,eAAe,WAA4B;EACzC,OAAO,IAAI,QAAQ,EAAE,MAAM,UAAU,CAAC;CACxC;;;;;CAMA,MAAM,sBAAsB,gBAAyC;EAGnE,QAAO,MAFM,cAAc,KAAKE,SAAS,CACP,CAAC,CAAC;GAAE,MAAM;GAAgB;EAAe,CAAC,EAAA,CACpD;CAC1B;;;;;CAMA,MAAM,sBAAsB,WAAgD;EAC1E,MAAM,UAAU,KAAK,eAAe,SAAS;EAI7C,QAAO,MAHqB,QAAQ,SAAS,QAAQ,KAAK,uCAAuC,EAC/F,UAAU,IACZ,CAAC,EAAA,CACoB,KAAI,UAAS;GAChC,gBAAgB,KAAK;GACrB,cAAc,KAAK,WAAW,WAAW,KAAK,UAAU,KAAK,QAAQ,QAAQ;GAC7E,aAAa,KAAK,WAAW,UAAU,KAAK,UAAU,KAAK,QAAQ,OAAO;EAC5E,EAAE;CACJ;;;;;CAMA,MAAM,sBAAsB,gBAAwB,UAAwD;EAC1G,MAAM,UAAU,KAAK,uBAAuB,cAAc;EAI1D,QAAO,MAHa,QAAQ,SAAS,QAAQ,KAAK,mCAAmC,EACnF,UAAU,IACZ,CAAC,EAAA,CACY,KAAI,UAAS;GACxB,IAAI,KAAK;GACT,UAAU,KAAK;GACf,MAAM,KAAK;GACX,OAAO,KAAK,MAAM;GAClB,eAAe,KAAK;GACpB,SAAS,KAAK;GACd;EACF,EAAE;CACJ;;;;;CAMA,MAAM,oCACJ,gBACA,cACA,UACA,QACiD;EACjD,MAAM,QAAQ,kBAAkB,YAAY;EAC5C,IAAI,CAAC,OAAO,OAAO,KAAA;EACnB,MAAM,WAAW,GAAG,eAAe,GAAG,MAAM,MAAM,GAAG,MAAM,KAAK,GAAG,SAAS,YAAY;EACxF,MAAM,SAAS,KAAKJ,6BAA6B,IAAI,QAAQ;EAC7D,IAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GAAG,OAAO,OAAO;EAC3D,KAAKA,6BAA6B,OAAO,QAAQ;EACjD,MAAM,WAAW,KAAKC,gCAAgC,IAAI,QAAQ;EAClE,IAAI,UAAU,OAAO,cAAc,UAAU,QAAQ,KAAA,CAAS;EAC9D,MAAM,UAAU,YAAY;GAC1B,IAAI;IACF,MAAM,EAAE,SAAS,MAAM,KAAK,uBAAuB,cAAc,CAAC,CAAC,MAAM,+BAA+B;KACtG,GAAG;KACH;KACA,SAAS,EAAE,QAAQ,YAAY,QAAQ,yCAAyC,EAAE;IACpF,CAAC;IACD,MAAM,aAAa,KAAK;IAGxB,KAAKD,6BAA6B,IAAI,UAAU;KAC9C;KACA,WAAW,KAAK,IAAI,IAAI;IAC1B,CAAC;IACD,IAAI,KAAKA,6BAA6B,OAAO,2CAA2C;KACtF,MAAM,SAAS,KAAKA,6BAA6B,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;KAC/D,IAAI,WAAW,KAAA,GAAW,KAAKA,6BAA6B,OAAO,MAAM;IAC3E;IACA,OAAO;GACT,QAAQ;IACN;GACF,UAAU;IACR,KAAKC,gCAAgC,OAAO,QAAQ;GACtD;EACF,EAAA,CAAG;EACH,KAAKA,gCAAgC,IAAI,UAAU,MAAM;EACzD,OAAO,cAAc,QAAQ,QAAQ,KAAA,CAAS;CAChD;;;;;;;CAQA,MAAM,oBAAoB,gBAAwB,cAAmD;EACnG,MAAM,QAAQ,kBAAkB,YAAY;EAC5C,IAAI,CAAC,OAAO,OAAO;EACnB,MAAM,UAAU,KAAK,uBAAuB,cAAc;EAC1D,IAAI;GACF,MAAM,EAAE,SAAS,MAAM,QAAQ,MAAM,IAAI,KAAK;GAC9C,OAAO;IACL,IAAI,KAAK;IACT,UAAU,KAAK;IACf,MAAM,KAAK;IACX,OAAO,KAAK,MAAM;IAClB,eAAe,KAAK;IACpB,SAAS,KAAK;IACd;GACF;EACF,QAAQ;GACN,OAAO;EACT;CACF;CAEA,MAAMrC,kBAAkB,OAA6F;EACnH,MAAM,iBAAiB,wBAAwB,MAAM,UAAU;EAC/D,MAAM,eAAe,kBAAkB,MAAM,WAAW,uDAAuD;EAC/G,MAAM,OAAO,oBAAoB,MAAM,MAAM;EAC7C,MAAM,SAAS,gBAAgB,MAAM,MAAM;EAC3C,MAAM,SAAS,MAAM,KAAK,mBAAmB,gBAAgB,cAAc,MAAM,EAC/E,OAAO,OAAO,SAAS,IAAI,OAAO,KAAK,GAAG,IAAI,KAAA,EAChD,CAAC;EACD,OAAO;GACL,QAAQ,OAAO,OAAO,KAAI,WAAU;IAClC,IAAI,OAAO,MAAM,MAAM;IACvB,YAAY,IAAI,MAAM;IACtB,OAAO,MAAM;IACb,KAAK,MAAM;IACX,QAAQ,MAAM;IACd,OAAO;IACP,WAAW;IACX,UAAU;IACV,UAAU,MAAM,UAAU,MAAM;IAChC,WAAW,MAAM;IACjB,QAAQ;IACR,QAAQ,MAAM;IACd,cAAc,MAAM;IACpB,WAAW,MAAM;IACjB,WAAW,MAAM;GACnB,EAAE;GACF,YAAY,OAAO,aAAa,OAAO,OAAO,OAAO,OAAO,QAAQ;EACtE;CACF;CAEA,MAAMC,gBAAgB,OAA+D;EACnF,MAAM,iBAAiB,wBAAwB,MAAM,UAAU;EAC/D,MAAM,eAAe,gBAAgB,MAAM,UAAU,6CAA6C;EAClG,MAAM,QAAQ,kBAAkB,YAAY;EAC5C,MAAM,cAAc,qBAAqB,MAAM,OAAO;EACtD,IAAI,CAAC,SAAS,gBAAgB,MAAM,OAAO;EAC3C,MAAM,UAAU,KAAK,uBAAuB,cAAc;EAC1D,IAAI;GACF,MAAM,CAAC,EAAE,MAAM,SAAS,YAAY,MAAM,QAAQ,IAAI,CACpD,QAAQ,OAAO,IAAI;IAAE,OAAO,MAAM;IAAO,MAAM,MAAM;IAAM,cAAc;GAAY,CAAC,GACtF,QAAQ,SAAS,QAAQ,OAAO,cAAc;IAC5C,OAAO,MAAM;IACb,MAAM,MAAM;IACZ,cAAc;IACd,UAAU;GACZ,CAAC,CACH,CAAC;GACD,IAAI,MAAM,cAAc,OAAO;GAC/B,OAAO;IACL,IAAI,OAAO,MAAM,MAAM;IACvB,YAAY,IAAI,MAAM;IACtB,OAAO,MAAM;IACb,KAAK,MAAM;IACX,QAAQ,MAAM,MAAM,SAAS;IAC7B,OAAO,MAAM;IACb,WAAW,MAAM;IACjB,UAAU;IACV,UAAU,MAAM,UAAU,SAAS;IACnC,YAAY,MAAM,aAAa,CAAC,EAAA,CAAG,KAAI,SAAQ,KAAK,KAAK,CAAC,CAAC,QAAQ,UAA2B,QAAQ,KAAK,CAAC;IAC5G,QAAQ;IACR,QAAQ,MAAM,OAAO,KAAI,UAAU,OAAO,UAAU,WAAW,QAAS,MAAM,QAAQ,EAAI,CAAC,CAAC,OAAO,OAAO;IAC1G,cAAc,MAAM;IACpB,WAAW,MAAM;IACjB,WAAW,MAAM;IACjB,aAAa,MAAM,MAAM,KAAK,IAAI,MAAM,OAAO;IAC/C,UAAU,SAAS,KAAI,aAAY;KACjC,QAAQ,QAAQ,MAAM,SAAS;KAC/B,MAAM,QAAQ,QAAQ;KACtB,WAAW,QAAQ;IACrB,EAAE;GACJ;EACF,SAAS,KAAK;GACZ,IAAI,gBAAgB,GAAG,GAAG,OAAO;GACjC,MAAM;EACR;CACF;CAEA,MAAME,mBAAmB,OAA4D;EACnF,MAAM,iBAAiB,wBAAwB,MAAM,UAAU;EAC/D,MAAM,eAAe,gBAAgB,MAAM,UAAU,6CAA6C;EAClG,MAAM,QAAQ,kBAAkB,YAAY;EAC5C,MAAM,cAAc,qBAAqB,MAAM,OAAO;EACtD,IAAI,CAAC,SAAS,gBAAgB,MAAM,OAAO;EAG3C,IAAI,MAAM,MAAM,SAAS,UAAU;GACjC,QAAQ,KAAK,iEAAiE,MAAM,MAAM,KAAK,aAAa;GAC5G,OAAO;EACT;EACA,MAAM,cACJ,MAAM,MAAM,cAAc,eAAe,MAAM,MAAM,cAAc,YAAY,SAAS;EAC1F,MAAM,cACJ,gBAAgB,WAAY,MAAM,MAAM,cAAc,aAAa,gBAAgB,cAAe;EACpG,MAAM,UAAU,KAAK,uBAAuB,cAAc;EAC1D,IAAI;GAGF,MAAM,EAAE,MAAM,YAAY,MAAM,QAAQ,OAAO,IAAI;IACjD,OAAO,MAAM;IACb,MAAM,MAAM;IACZ,cAAc;GAChB,CAAC;GACD,IAAI,QAAQ,cAAc;IACxB,QAAQ,KACN,qDAAqD,aAAa,GAAG,YAAY,oBACnF;IACA,OAAO;GACT;GACA,MAAM,EAAE,MAAM,UAAU,MAAM,QAAQ,OAAO,OAAO;IAClD,OAAO,MAAM;IACb,MAAM,MAAM;IACZ,cAAc;IACd,OAAO;IACP,GAAI,cAAc,EAAE,cAAc,YAAY,IAAI,CAAC;GACrD,CAAC;GACD,OAAO;IACL,IAAI,OAAO,MAAM,MAAM;IACvB,YAAY,IAAI,MAAM;IACtB,OAAO,MAAM;IACb,KAAK,MAAM;IACX,QAAQ,MAAM,MAAM,SAAS;IAC7B,OAAO,MAAM;IACb,WAAW,MAAM;IACjB,UAAU;IACV,UAAU,MAAM,UAAU,SAAS;IACnC,YAAY,MAAM,aAAa,CAAC,EAAA,CAAG,KAAI,SAAQ,KAAK,KAAK,CAAC,CAAC,QAAQ,UAA2B,QAAQ,KAAK,CAAC;IAC5G,QAAQ;IACR,QAAQ,MAAM,OAAO,KAAI,UAAU,OAAO,UAAU,WAAW,QAAS,MAAM,QAAQ,EAAI,CAAC,CAAC,OAAO,OAAO;IAC1G,cAAc,MAAM;IACpB,WAAW,MAAM;IACjB,WAAW,MAAM;GACnB;EACF,SAAS,KAAK;GACZ,IAAI,gBAAgB,GAAG,GAAG,OAAO;GACjC,MAAM;EACR;CACF;CAEA,MAAMD,qBAAqB,OAA8E;EACvG,MAAM,iBAAiB,wBAAwB,MAAM,UAAU;EAE/D,MAAM,QAAQ,kBADO,gBAAgB,MAAM,UAAU,6CACV,CAAC;EAC5C,MAAM,cAAc,qBAAqB,MAAM,OAAO;EACtD,IAAI,CAAC,SAAS,gBAAgB,MAAM,OAAO;EAC3C,MAAM,UAAU,KAAK,uBAAuB,cAAc;EAC1D,IAAI;GACF,MAAM,EAAE,SAAS,MAAM,QAAQ,OAAO,cAAc;IAClD,OAAO,MAAM;IACb,MAAM,MAAM;IACZ,cAAc;IACd,MAAM,MAAM;GACd,CAAC;GACD,OAAO;IAAE,IAAI,OAAO,KAAK,EAAE;IAAG,KAAK,KAAK;GAAS;EACnD,SAAS,KAAK;GACZ,IAAI,gBAAgB,GAAG,GAAG,OAAO;GACjC,MAAM;EACR;CACF;CAEA,kBAAkB,YAAmC,UAAkB;EACrE,MAAM,iBAAiB,wBAAwB,UAAU;EACzD,MAAM,QAAQ,kBAAkB,QAAQ;EACxC,IAAI,CAAC,OAAO,MAAM,IAAI,MAAM,0DAA0D;EACtF,OAAO;GAAE,SAAS,KAAK,uBAAuB,cAAc;GAAG;EAAM;CACvE;CAEA,MAAMG,kBAAkB,OAAoC;EAC1D,MAAM,EAAE,SAAS,UAAU,KAAKoC,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,OAAO,oBAAoB,MAAM,MAAM;EAC7C,MAAM,WAAW,MAAM,QAAQ,MAAM,KAAK;GACxC,GAAG;GACH,OAAO,MAAM,SAAS;GACtB,UAAA;GACA;EACF,CAAC;EAID,OAAO;GACL,cAJmB,SAAS,KAC3B,QAAO,OAAM,MAAM,kBAAkB,SAAS,CAAC,GAAG,KAAK,CAAC,CACxD,KAAI,OAAM,iBAAiB,EAAE,CAEnB;GACX,YAAY,SAAS,KAAK,WAAA,KAA4B,OAAO,OAAO,CAAC,IAAI;EAC3E;CACF;CAEA,MAAMnC,gBAAgB,OAAkC;EACtD,MAAM,EAAE,SAAS,UAAU,KAAKmC,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,aAAa,yBAAyB,MAAM,aAAa;EAC/D,IAAI;GACF,MAAM,EAAE,SAAS,MAAM,QAAQ,MAAM,IAAI;IAAE,GAAG;IAAO,aAAa;GAAW,CAAC;GAC9E,OAAO,iBAAiB,IAAI;EAC9B,SAAS,KAAK;GACZ,IAAI,gBAAgB,GAAG,GAAG,OAAO;GACjC,MAAM;EACR;CACF;CAEA,MAAMlC,mBAAmB,OAAqC;EAC5D,MAAM,EAAE,SAAS,UAAU,KAAKkC,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,EAAE,SAAS,MAAM,QAAQ,MAAM,OAAO;GAC1C,GAAG;GACH,OAAO,MAAM;GACb,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,OAAO,MAAM;EACf,CAAC;EACD,OAAO,iBAAiB,IAAI;CAC9B;CAEA,MAAMjC,mBAAmB,OAAqC;EAC5D,MAAM,EAAE,SAAS,UAAU,KAAKiC,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,EAAE,SAAS,MAAM,QAAQ,MAAM,OAAO;GAC1C,GAAG;GACH,aAAa,yBAAyB,MAAM,aAAa;GACzD,OAAO,MAAM;GACb,MAAM,MAAM,SAAS,OAAO,KAAK,MAAM;GACvC,MAAM,MAAM;GACZ,OAAO,MAAM;EACf,CAAC;EACD,OAAO,iBAAiB,IAAI;CAC9B;CAEA,MAAMhC,kBAAkB,OAAoC;EAC1D,OAAO,KAAKD,mBAAmB;GAAE,GAAG;GAAO,OAAO;EAAS,CAAC;CAC9D;CAEA,MAAME,kBAAkB,OAAoC;EAC1D,MAAM,EAAE,SAAS,UAAU,KAAK+B,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,EAAE,SAAS,MAAM,QAAQ,MAAM,MAAM;GACzC,GAAG;GACH,aAAa,yBAAyB,MAAM,aAAa;GACzD,cAAc,MAAM;GACpB,gBAAgB,MAAM;GACtB,cAAc,MAAM;EACtB,CAAC;EACD,OAAO;GAAE,QAAQ,KAAK;GAAQ,SAAS,KAAK;GAAS,KAAK,KAAK,OAAO;EAAK;CAC7E;CAEA,MAAM9B,cAAc,OAAgC;EAClD,MAAM,EAAE,SAAS,UAAU,KAAK8B,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,OAAO,oBAAoB,MAAM,MAAM;EAC7C,MAAM,WAAW,MAAM,QAAQ,OAAO,aAAa;GACjD,GAAG;GACH,cAAc,yBAAyB,MAAM,aAAa;GAC1D,UAAA;GACA;EACF,CAAC;EACD,OAAO;GACL,UAAU,SAAS,KAAK,KAAI,YAAW,wBAAwB,OAAO,CAAC;GACvE,YAAY,SAAS,KAAK,WAAA,KAA4B,OAAO,OAAO,CAAC,IAAI;EAC3E;CACF;CAEA,MAAM7B,eAAe,OAAiC;EACpD,MAAM,EAAE,SAAS,UAAU,KAAK6B,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,EAAE,SAAS,MAAM,QAAQ,OAAO,cAAc;GAClD,GAAG;GACH,cAAc,yBAAyB,MAAM,aAAa;GAC1D,MAAM,MAAM;EACd,CAAC;EACD,OAAO,wBAAwB,IAAI;CACrC;CAEA,MAAM5B,eAAe,OAAiC;EACpD,MAAM,EAAE,SAAS,UAAU,KAAK4B,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,EAAE,SAAS,MAAM,QAAQ,OAAO,cAAc;GAClD,GAAG;GACH,YAAY,kBAAkB,MAAM,WAAW,SAAS;GACxD,MAAM,MAAM;EACd,CAAC;EACD,OAAO,wBAAwB,IAAI;CACrC;CAEA,MAAM3B,eAAe,OAAiC;EACpD,MAAM,EAAE,SAAS,UAAU,KAAK2B,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,QAAQ,OAAO,cAAc;GAAE,GAAG;GAAO,YAAY,kBAAkB,MAAM,WAAW,SAAS;EAAE,CAAC;CAC5G;CAEA,MAAM1B,aAAa,OAA+B;EAChD,MAAM,EAAE,SAAS,UAAU,KAAK0B,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,OAAO,oBAAoB,MAAM,MAAM;EAC7C,MAAM,WAAW,MAAM,QAAQ,MAAM,YAAY;GAC/C,GAAG;GACH,aAAa,yBAAyB,MAAM,aAAa;GACzD,UAAA;GACA;EACF,CAAC;EACD,OAAO;GACL,SAAS,SAAS,KAAK,KAAI,WAAU,YAAY,MAAM,CAAC;GACxD,YAAY,SAAS,KAAK,WAAA,KAA4B,OAAO,OAAO,CAAC,IAAI;EAC3E;CACF;CAEA,MAAMzB,WAAW,OAA6B;EAC5C,MAAM,EAAE,SAAS,UAAU,KAAKyB,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,IAAI;GACF,MAAM,EAAE,SAAS,MAAM,QAAQ,MAAM,UAAU;IAC7C,GAAG;IACH,aAAa,yBAAyB,MAAM,aAAa;IACzD,WAAW,kBAAkB,MAAM,UAAU,QAAQ;GACvD,CAAC;GACD,OAAO,YAAY,IAAI;EACzB,SAAS,KAAK;GACZ,IAAI,gBAAgB,GAAG,GAAG,OAAO;GACjC,MAAM;EACR;CACF;CAEA,MAAMxB,cAAc,OAAgC;EAClD,MAAM,EAAE,SAAS,UAAU,KAAKwB,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,EAAE,SAAS,MAAM,QAAQ,MAAM,aAAa;GAChD,GAAG;GACH,aAAa,yBAAyB,MAAM,aAAa;GACzD,MAAM,MAAM;GACZ,WAAW,MAAM;GACjB,OAAO,MAAM,QAAQ,oBAAoB,MAAM,KAAK,IAAI,KAAA;EAC1D,CAAC;EACD,OAAO,YAAY,IAAI;CACzB;CAEA,MAAMvB,cAAc,OAAgC;EAClD,MAAM,EAAE,SAAS,UAAU,KAAKuB,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,EAAE,SAAS,MAAM,QAAQ,MAAM,aAAa;GAChD,GAAG;GACH,aAAa,yBAAyB,MAAM,aAAa;GACzD,WAAW,kBAAkB,MAAM,UAAU,QAAQ;GACrD,MAAM,MAAM;EACd,CAAC;EACD,OAAO,YAAY,IAAI;CACzB;CAEA,MAAMtB,cAAc,OAAgC;EAClD,MAAM,EAAE,SAAS,UAAU,KAAKsB,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,EAAE,SAAS,MAAM,QAAQ,MAAM,aAAa;GAChD,GAAG;GACH,aAAa,yBAAyB,MAAM,aAAa;GACzD,WAAW,kBAAkB,MAAM,UAAU,QAAQ;GACrD,MAAM,MAAM;GACZ,OAAO,oBAAoB,MAAM,KAAK;EACxC,CAAC;EACD,OAAO,YAAY,IAAI;CACzB;CAEA,MAAMrB,eAAe,OAAiC;EACpD,MAAM,EAAE,SAAS,UAAU,KAAKqB,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,EAAE,SAAS,MAAM,QAAQ,MAAM,cAAc;GACjD,GAAG;GACH,aAAa,yBAAyB,MAAM,aAAa;GACzD,WAAW,kBAAkB,MAAM,UAAU,QAAQ;GACrD,SAAS,MAAM;EACjB,CAAC;EACD,OAAO,YAAY,IAAI;CACzB;CAEA,MAAMpB,qBAAqB,OAAuC;EAChE,MAAM,EAAE,SAAS,UAAU,KAAKoB,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,QAAQ,MAAM,oBAAoB;GACtC,GAAG;GACH,aAAa,yBAAyB,MAAM,aAAa;GACzD,WAAW,kBAAkB,MAAM,UAAU,QAAQ;EACvD,CAAC;CACH;CAEA,MAAMnB,oBAAoB,OAAsC;EAC9D,MAAM,EAAE,SAAS,UAAU,KAAKmB,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,OAAO,oBAAoB,MAAM,MAAM;EAC7C,MAAM,WAAW,MAAM,QAAQ,MAAM,mBAAmB;GACtD,GAAG;GACH,aAAa,yBAAyB,MAAM,aAAa;GACzD,UAAA;GACA;EACF,CAAC;EACD,OAAO;GACL,UAAU,SAAS,KAAK,KAAI,YAAW,mBAAmB,OAAO,CAAC;GAClE,YAAY,SAAS,KAAK,WAAA,KAA4B,OAAO,OAAO,CAAC,IAAI;EAC3E;CACF;CAEA,MAAMlB,qBAAqB,OAAuC;EAChE,MAAM,EAAE,SAAS,UAAU,KAAKkB,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,aAAa,yBAAyB,MAAM,aAAa;EAC/D,IAAI,MAAM,WAAW;GACnB,MAAM,EAAE,SAAS,MAAM,QAAQ,MAAM,4BAA4B;IAC/D,GAAG;IACH,aAAa;IACb,YAAY,kBAAkB,MAAM,WAAW,gBAAgB;IAC/D,MAAM,MAAM;GACd,CAAC;GACD,OAAO,mBAAmB,IAAI;EAChC;EACA,IAAI,CAAC,MAAM,YAAY,CAAC,MAAM,QAAQ,MAAM,SAAS,KAAA,KAAa,CAAC,MAAM,MACvE,MAAM,IAAI,MAAM,gFAAgF;EAElG,IAAK,MAAM,cAAc,KAAA,OAAgB,MAAM,cAAc,KAAA,IAC3D,MAAM,IAAI,MAAM,oEAAoE;EAEtF,MAAM,EAAE,SAAS,MAAM,QAAQ,MAAM,oBAAoB;GACvD,GAAG;GACH,aAAa;GACb,MAAM,MAAM;GACZ,WAAW,MAAM;GACjB,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,MAAM,MAAM,KAAK,YAAY;GAC7B,YAAY,MAAM;GAClB,YAAY,MAAM,WAAW,YAAY;EAC3C,CAAC;EACD,OAAO,mBAAmB,IAAI;CAChC;CAEA,MAAMjB,qBAAqB,OAAuC;EAChE,MAAM,EAAE,SAAS,UAAU,KAAKiB,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,EAAE,SAAS,MAAM,QAAQ,MAAM,oBAAoB;GACvD,GAAG;GACH,YAAY,kBAAkB,MAAM,WAAW,gBAAgB;GAC/D,MAAM,MAAM;EACd,CAAC;EACD,OAAO,mBAAmB,IAAI;CAChC;CAEA,MAAMhB,qBAAqB,OAAuC;EAChE,MAAM,EAAE,SAAS,UAAU,KAAKgB,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,QAAQ,MAAM,oBAAoB;GACtC,GAAG;GACH,YAAY,kBAAkB,MAAM,WAAW,gBAAgB;EACjE,CAAC;CACH;CAEA,MAAMf,wBAAwB,OAA0C;EACtE,MAAM,EAAE,SAAS,UAAU,KAAKe,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,EAAE,SAAS,MAAM,QAAQ,MAAM,uBAAuB;GAC1D,GAAG;GACH,aAAa,yBAAyB,MAAM,aAAa;EAC3D,CAAC;EACD,OAAO,wBAAwB,IAAI;CACrC;CAEA,MAAMd,kBAAkB,OAAoC;EAC1D,MAAM,EAAE,SAAS,UAAU,KAAKc,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,EAAE,SAAS,MAAM,QAAQ,MAAM,iBAAiB;GACpD,GAAG;GACH,aAAa,yBAAyB,MAAM,aAAa;GACzD,WAAW,MAAM,SAAS,CAAC;GAC3B,gBAAgB,MAAM,SAAS,CAAC;EAClC,CAAC;EACD,OAAO,wBAAwB,IAAI;CACrC;CAEA,MAAMb,iBAAiB,OAA4C;EACjE,MAAM,EAAE,SAAS,UAAU,KAAKa,kBAAkB,MAAM,YAAY,MAAM,QAAQ;EAClF,MAAM,EAAE,SAAS,MAAM,QAAQ,MAAM,yBAAyB;GAC5D,GAAG;GACH,aAAa,yBAAyB,MAAM,aAAa;GACzD,WAAW,MAAM,SAAS,CAAC;GAC3B,gBAAgB,MAAM,SAAS,CAAC;EAClC,CAAC;EACD,OAAO,wBAAwB,IAAI;CACrC;;CAGA,MAAM,eACJ,gBACA,cACA,aACA,QACe;EACf,MAAM,QAAQ,kBAAkB,YAAY;EAC5C,IAAI,CAAC,OAAO;EACZ,MAAM,eAAe,CAAC,GAAG,IAAI,IAAI,OAAO,KAAI,UAAS,MAAM,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC;EACnF,IAAI,aAAa,WAAW,GAAG;EAE/B,MADgB,KAAK,uBAAuB,cAChC,CAAC,CAAC,OAAO,UAAU;GAC7B,OAAO,MAAM;GACb,MAAM,MAAM;GACZ,cAAc;GACd,QAAQ;EACV,CAAC;CACH;;CAGA,MAAM,iBACJ,gBACA,cACA,aACA,OACe;EACf,MAAM,QAAQ,kBAAkB,YAAY;EAC5C,MAAM,YAAY,MAAM,KAAK;EAC7B,IAAI,CAAC,SAAS,CAAC,WAAW;EAE1B,MADgB,KAAK,uBAAuB,cAChC,CAAC,CAAC,OAAO,YAAY;GAC/B,OAAO,MAAM;GACb,MAAM,MAAM;GACZ,cAAc;GACd,MAAM;EACR,CAAC;CACH;;;;;;;CAQA,MAAM,mBACJ,gBACA,cACA,MACA,UAAqC,CAAC,GAClB;EACpB,MAAM,QAAQ,kBAAkB,YAAY;EAC5C,IAAI,CAAC,OAAO,OAAO;GAAE,QAAQ,CAAC;GAAG,UAAU;EAAK;EAEhD,MAAM,WAAW,MADD,KAAK,uBAAuB,cACf,CAAC,CAAC,OAAO,YAAY;GAChD,OAAO,MAAM;GACb,MAAM,MAAM;GACZ,OAAO;GACP,QAAQ,QAAQ;GAChB,UAAA;GACA;EACF,CAAC;EAcD,OAAO;GAAE,QAbM,SAAS,KACrB,QAAO,UAAS,CAAC,MAAM,YAAY,CAAC,CACpC,KAAI,WAAU;IACb,QAAQ,MAAM;IACd,OAAO,MAAM;IACb,KAAK,MAAM;IACX,QAAQ,MAAM,MAAM,SAAS;IAC7B,WAAW,MAAM,WAAW,SAAQ,aAAa,SAAS,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,CAAE,KAAK,CAAC;IAC9F,QAAQ,MAAM,OAAO,KAAI,UAAU,OAAO,UAAU,WAAW,QAAS,MAAM,QAAQ,EAAI,CAAC,CAAC,OAAO,OAAO;IAC1G,UAAU,MAAM;IAChB,WAAW,MAAM;IACjB,WAAW,MAAM;GACnB,EACY;GAAG,UAAU,SAAS,KAAK,WAAA,KAA4B,OAAO,IAAI;EAAK;CACvF;;;;;CAMA,gBAAgB,OAAuB;EACrC,MAAM,MAAM,IAAI,IAAI,2BAA2B,KAAKR,MAAM,mBAAmB;EAC7E,IAAI,aAAa,IAAI,SAAS,KAAK;EACnC,OAAO,IAAI,SAAS;CACtB;;;;;CAMA,sBAAsB,OAAe,aAA6B;EAChE,MAAM,MAAM,IAAI,IAAI,0CAA0C;EAC9D,IAAI,aAAa,IAAI,aAAa,KAAKF,SAAS;EAChD,IAAI,aAAa,IAAI,gBAAgB,WAAW;EAChD,IAAI,aAAa,IAAI,SAAS,KAAK;EACnC,OAAO,IAAI,SAAS;CACtB;;CAGA,MAAM,kBAAkB,MAAc,aAAsC;EAC1E,MAAM,MAAM,MAAM,MAAM,+CAA+C;GACrE,QAAQ;GACR,QAAQ,YAAY,QAAQ,6BAA6B;GACzD,SAAS;IAAE,gBAAgB;IAAoB,QAAQ;GAAmB;GAC1E,MAAM,KAAK,UAAU;IACnB,WAAW,KAAKA;IAChB,eAAe,KAAKC;IACpB;IACA,cAAc;GAChB,CAAC;EACH,CAAC;EACD,IAAI,CAAC,IAAI,IACP,MAAM,IAAI,MAAM,uCAAuC,IAAI,QAAQ;EAErE,MAAM,OAAQ,MAAM,IAAI,KAAK;EAC7B,IAAI,CAAC,KAAK,cACR,MAAM,IAAI,MACR,kDAAkD,KAAK,qBAAqB,KAAK,SAAS,WAC5F;EAEF,OAAO,KAAK;CACd;;;;;;;CAQA,OAAO,KAAqC;EAC1C,KAAKO,WAAW,IAAI;EACpB,MAAM,qBAAqB,kBAAkB,MAAM,GAAG;EACtD,KAAKG,sBAAsB;EAC3B,OAAO,kBAAkB;GACvB,QAAQ;GACR,MAAM,IAAI;GACV,SAAS,IAAI;GACb,GAAI,IAAI,QAAQ,EAAE,OAAO,IAAI,MAAM,IAAI,CAAC;GACxC,SAAS,IAAI;GACb,aAAa,IAAI;GACjB,SAAS,IAAI;GACb,YAAY,IAAI;GAChB,gBAAgB,IAAI,QAAQ;GAC5B,WAAW,IAAI,OAAO;GACtB,UAAU,IAAI,QAAQ;GACtB;GACA,mBAAmB,IAAI;GACvB,GAAI,IAAI,YAAY,EAAE,WAAW,IAAI,UAAU,IAAI,CAAC;EACtD,CAAC;CACH;;;;;CAMA,MAAM,8BAA8B,MAAqE;EACvG,MAAM,8BAA8B;GAAE,QAAQ;GAAM,GAAG;GAAM,oBAAoB,KAAKA;EAAoB,CAAC;CAC7G;;;;;CAMA,QAAQ,KAAyC;EAC/C,MAAM,qBAAqB,sBACzB,QAAQ,IAAI,wCACZ,QAAQ,IAAI,mCACd;EACA,MAAM,eAAe,sBACnB,QAAQ,IAAI,2CACZ,QAAQ,IAAI,mCACd;EACA,IAAI,CAAC,sBAAsB,CAAC,cAAc,OAAO,CAAC;EAElD,MAAM,YAAY,qBACd,uBAAuB,MAAM,MAAK,UAAS,KAAK,sBAAsB,KAAK,CAAC,IAC5E,KAAA;EACJ,MAAM,SAAS,eACX,4BACE,MACA,MACA,UAAS,KAAK,gBAAgB,KAAK,IACnC,UAAS,KAAK,oBAAoB,KAAK,CACzC,IACA,KAAA;EACJ,IAAI,CAAC,aAAa,CAAC,QAAQ,OAAO,CAAC;EAEnC,MAAM,iBAAiB,kBAAkB,QAAQ,IAAI,uCAAuC;EAC5F,MAAM,aAAa,kBAAkB,QAAQ,IAAI,0CAA0C,KAAK;EAChG,MAAM,kBACJ,kBAAkB,QAAQ,IAAI,6CAA6C,KAAK;EAClF,OAAO,CACL,IAAI,sBAAsB;GACxB,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;GACjC,GAAI,SAAS,EAAE,iBAAiB,OAAO,IAAI,CAAC;GAC5C,eAAe,IAAI,QAAQ;GAC3B,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;GACnC,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;EAC/C,CAAC,CACH;CACF;;;;;CAMA,MAAM,sBAAsB,OAIuB;EACjD,IAAI;GACF,MAAM,cAAc,MAAM,KAAKpC,gBAAgB;IAC7C,YAAY;KAAE,MAAM;KAAoB,gBAAgB,MAAM;IAAe;IAC7E,UAAU,MAAM;IAChB,eAAe,OAAO,MAAM,MAAM;GACpC,CAAC;GACD,IAAI,CAAC,aAAa,OAAO,KAAA;GACzB,OAAO;IACL,OAAO,YAAY;IACnB,KAAK,YAAY;IACjB,OAAO,YAAY,UAAU,WAAW,WAAW;IACnD,OAAO,YAAY;IACnB,QAAQ,YAAY;IACpB,WAAW,YAAY,aAAa,CAAC;IACrC,oBAAoB,YAAY,sBAAsB,CAAC;IACvD,QAAQ,YAAY,UAAU,CAAC;IAC/B,YAAY,YAAY;IACxB,YAAY,YAAY;IACxB,GAAI,YAAY,SAAS,EAAE,QAAQ,YAAY,OAAO,IAAI,CAAC;IAC3D,GAAI,YAAY,YAAY,EAAE,WAAW,YAAY,UAAU,IAAI,CAAC;GACtE;EACF,QAAQ;GACN;EACF;CACF;;;;;;CAOA,MAAM,gBAAgB,OAIuB;EAC3C,MAAM,QAAQ,kBAAkB,MAAM,UAAU;EAChD,IAAI,CAAC,OAAO,OAAO,KAAA;EACnB,IAAI;GAEF,MAAM,EAAE,MAAM,UAAU,MADR,KAAK,uBAAuB,MAAM,cACd,CAAC,CAAC,OAAO,IAAI;IAC/C,OAAO,MAAM;IACb,MAAM,MAAM;IACZ,cAAc,MAAM;GACtB,CAAC;GACD,IAAI,MAAM,cAAc,OAAO,KAAA;GAC/B,OAAO;IACL,OAAO,MAAM;IACb,KAAK,MAAM;IACX,OAAO,MAAM,UAAU,WAAW,WAAW;IAC7C,GAAI,MAAM,eAAe,EAAE,aAAa,MAAM,aAAa,IAAI,CAAC;IAChE,YAAY,MAAM,aAAa,CAAC,EAAA,CAAG,KAAI,SAAQ,KAAK,KAAK,CAAC,CAAC,QAAQ,UAA2B,QAAQ,KAAK,CAAC;IAC5G,SAAS,MAAM,UAAU,CAAC,EAAA,CACvB,KAAI,UAAU,OAAO,UAAU,WAAW,QAAQ,MAAM,IAAK,CAAC,CAC9D,QAAQ,SAAyB,QAAQ,IAAI,CAAC;IACjD,GAAI,MAAM,MAAM,QAAQ,EAAE,QAAQ,MAAM,KAAK,MAAM,IAAI,CAAC;IACxD,WAAW,MAAM;IACjB,WAAW,MAAM;GACnB;EACF,QAAQ;GACN;EACF;CACF;;;;;CAMA,MAAM,oBAAoB,OAGmC;EAC3D,MAAM,QAAQ,kBAAkB,MAAM,UAAU;EAChD,IAAI,CAAC,OAAO,OAAO,CAAC;EACpB,MAAM,UAAU,KAAK,uBAAuB,MAAM,cAAc;EAChE,MAAM,SAA0D,CAAC;EACjE,KAAK,IAAI,OAAO,GAAG,QAAQ,gCAAgC,QAAQ,GAAG;GACpE,MAAM,EAAE,SAAS,MAAM,QAAQ,OAAO,YAAY;IAChD,OAAO,MAAM;IACb,MAAM,MAAM;IACZ,OAAO;IACP,UAAU;IACV;GACF,CAAC;GACD,KAAK,MAAM,SAAS,MAAM;IACxB,IAAI,MAAM,cAAc;IACxB,OAAO,KAAK;KACV,QAAQ,MAAM;KACd,OAAO,MAAM;KACb,KAAK,MAAM;KACX,OAAO;KACP,YAAY,MAAM,aAAa,CAAC,EAAA,CAAG,KAAI,SAAQ,KAAK,KAAK,CAAC,CAAC,QAAQ,UAA2B,QAAQ,KAAK,CAAC;KAC5G,SAAS,MAAM,UAAU,CAAC,EAAA,CACvB,KAAI,UAAU,OAAO,UAAU,WAAW,QAAQ,MAAM,IAAK,CAAC,CAC9D,QAAQ,SAAyB,QAAQ,IAAI,CAAC;KACjD,GAAI,MAAM,MAAM,QAAQ,EAAE,QAAQ,MAAM,KAAK,MAAM,IAAI,CAAC;KACxD,WAAW,MAAM;KACjB,WAAW,MAAM;IACnB,CAAC;GACH;GACA,IAAI,KAAK,SAAS,gCAAgC;EACpD;EACA,OAAO;CACT;;;;;CAMA,MAAM,2BAA2B,OAAiF;EAChH,MAAM,QAAQ,kBAAkB,MAAM,UAAU;EAChD,IAAI,CAAC,OAAO,MAAM,IAAI,MAAM,4DAA4D;EACxF,MAAM,UAAU,KAAK,uBAAuB,MAAM,cAAc;EAChE,MAAM,WAAW,CAAC;EAMlB,KAAK,IAAI,OAAO,IAAK,QAAQ,GAAG;GAC9B,MAAM,WAAW,MAAM,QAAQ,OAAO,aAAa;IACjD,GAAG;IACH,cAAc,MAAM;IACpB,UAAU;IACV;GACF,CAAC;GACD,SAAS,KAAK,GAAG,SAAS,IAAI;GAC9B,IAAI,SAAS,KAAK,SAAS,KAAK;EAClC;EACA,MAAM,WAAW,SACd,QACC,YACE,QAAQ,MAAM,SAAS,gCAAgC,KAAK,KAAK,uBAAuB,QAAQ,MAAM,KAAK,CAC/G,CAAC,CACA,MAAM,MAAM,UAAU,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC;EAC7C,IAAI,UAAU;GACZ,MAAM,EAAE,SAAS,MAAM,QAAQ,OAAO,cAAc;IAAE,GAAG;IAAO,YAAY,SAAS;IAAI,MAAM,MAAM;GAAK,CAAC;GAC3G,OAAO;IAAE,QAAQ;IAAW,WAAW,OAAO,KAAK,EAAE;IAAG,KAAK,KAAK;GAAS;EAC7E;EACA,MAAM,EAAE,SAAS,MAAM,QAAQ,OAAO,cAAc;GAClD,GAAG;GACH,cAAc,MAAM;GACpB,MAAM,MAAM;EACd,CAAC;EACD,OAAO;GAAE,QAAQ;GAAW,WAAW,OAAO,KAAK,EAAE;GAAG,KAAK,KAAK;EAAS;CAC7E;CAEA,aAAa,EAAE,kBAAwE;EACrF,OAAO,8BAA8B,gBAAgB,IAAI;CAC3D;CAEA,MAAM,iBAAiB,EACrB,aACA,kBACoF;EACpF,MAAM,iBAAiB,wBAAwB,WAAW;EAC1D,IAAI,CAAC,kBAAkB,CAAC,gBAAgB;EACxC,MAAM,qCAAqC,gBAAgB,gBAAgB,qBAAqB,IAAI;CACtG;;CAGA,cAAuC;EACrC,OAAO;GACL,MAAM,KAAK2B;GACX,yBAAyB,KAAKC,mBAAmB,KAAA;EACnD;CACF;AACF;AAiDA,SAAS,iBAAiB,IAAwC;CAChE,OAAO;EACL,IAAI,OAAO,GAAG,MAAM;EACpB,OAAO,GAAG;EACV,KAAK,GAAG;EACR,QAAQ,GAAG,MAAM,SAAS;EAC1B,YAAY,GAAG,aAAa,CAAC,EAAA,CAAG,SAAQ,aAAa,SAAS,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,CAAE;EAC5F,qBAAqB,GAAG,uBAAuB,CAAC,EAAA,CAAG,SAAQ,aAAa,SAAS,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,CAAE;EAC/G,SAAS,GAAG,UAAU,CAAC,EAAA,CAAG,SAAQ,UAAU,OAAO,UAAU,WAAW,CAAC,KAAK,IAAI,MAAM,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,CAAE;EACjH,MAAM,GAAG,MAAM,KAAK,IAAI,GAAG,OAAO;EAClC,OAAO,GAAG,UAAU,WAAW,WAAW;EAC1C,OAAO,GAAG,SAAS;EACnB,QAAQ,GAAG,UAAU,QAAQ,GAAG,SAAS;EACzC,WAAW,OAAO,GAAG,cAAc,YAAY,GAAG,YAAY;EAC9D,YAAY,GAAG,KAAK;EACpB,YAAY,GAAG,KAAK;EACpB,SAAS,GAAG,KAAK;EACjB,WAAW,GAAG;EACd,WAAW,GAAG;CAChB;AACF;AAEA,SAAS,wBAAwB,SAAgD;CAC/E,OAAO;EACL,IAAI,OAAO,QAAQ,EAAE;EACrB,KAAK,QAAQ;EACb,QAAQ,QAAQ,MAAM,SAAS;EAC/B,MAAM,QAAQ,QAAQ;EACtB,WAAW,QAAQ;EACnB,WAAW,QAAQ;CACrB;AACF;AAEA,SAAS,YAAY,QAAkC;CACrD,OAAO;EACL,IAAI,OAAO,OAAO,EAAE;EACpB,KAAK,OAAO,YAAY;EACxB,QAAQ,OAAO,MAAM,SAAS;EAC9B,MAAM,OAAO,MAAM,KAAK,IAAI,OAAO,OAAO;EAC1C,OAAO,iBAAiB,OAAO,KAAK;EACpC,UAAU,OAAO,aAAa;EAC9B,aAAa,OAAO,gBAAgB;CACtC;AACF;AAEA,SAAS,mBAAmB,SAAiD;CAC3E,MAAM,SAAS,wBAAwB,OAAO;CAC9C,MAAM,OAAO,QAAQ,MAAM,YAAY;CACvC,OAAO;EACL,GAAG;EACH,MAAM,QAAQ;EACd,MAAM,QAAQ,QAAQ;EACtB,MAAM,SAAS,UAAU,SAAS,UAAU,OAAO;EACnD,UAAU,QAAQ;EAClB,WAAW,QAAQ,iBAAiB,OAAO,QAAQ,cAAc,IAAI;CACvE;AACF;AAEA,SAAS,wBAAwB,MAK9B;CACD,OAAO;EACL,QAAQ,KAAK,SAAS,KAAK,uBAAuB,CAAC,EAAA,CAAG,SAAQ,SAAS,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,CAAE;EACtG,QAAQ,KAAK,SAAS,KAAK,mBAAmB,CAAC,EAAA,CAAG,SAAQ,SAAS,KAAK,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAE;CAClG;AACF;AAEA,SAAS,iBAAiB,OAAgC;CACxD,IAAI,UAAU,WAAW,OAAO;CAChC,IAAI,UAAU,aAAa,OAAO;CAClC,IAAI,UAAU,YAAY,OAAO;CACjC,IAAI,UAAU,qBAAqB,OAAO;CAC1C,IAAI,UAAU,aAAa,OAAO;CAClC,MAAM,IAAI,MAAM,oCAAoC,OAAO;AAC7D;AAEA,SAAS,oBAAoB,OAA6D;CACxF,IAAI,UAAU,WAAW,OAAO;CAChC,IAAI,UAAU,mBAAmB,OAAO;CACxC,OAAO;AACT;AAEA,SAAS,yBAAyB,OAAuB;CACvD,OAAO,kBAAkB,OAAO,cAAc;AAChD;AAEA,SAAS,kBAAkB,OAAe,UAA0B;CAClE,MAAM,SAAS,qBAAqB,KAAK;CACzC,IAAI,WAAW,MAAM,MAAM,IAAI,MAAM,UAAU,SAAS,gCAAgC;CACxF,OAAO;AACT;AAEA,SAAS,wBAAwB,YAA2C;CAC1E,IAAI,WAAW,SAAS,oBACtB,MAAM,IAAI,MAAM,6DAA6D;CAE/E,OAAO,WAAW;AACpB;AAEA,SAAS,kBAAkB,WAAqB,SAAyB;CACvE,IAAI,UAAU,WAAW,GAAG,MAAM,IAAI,MAAM,OAAO;CACnD,OAAO,UAAU;AACnB;AAEA,SAAS,gBAAgB,QAAwC;CAC/D,OAAO,CAAC,GAAG,IAAI,KAAK,UAAU,CAAC,EAAA,CAAG,KAAI,UAAS,MAAM,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC;AAC/E;AAEA,SAAS,gBAAgB,UAA8B,SAAyB;CAC9E,IAAI,CAAC,UAAU,MAAM,IAAI,MAAM,OAAO;CACtC,OAAO;AACT;AAEA,SAAS,oBAAoB,QAAoC;CAC/D,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,MAAM,OAAO,qBAAqB,MAAM;CACxC,IAAI,SAAS,MAAM,MAAM,IAAI,MAAM,+CAA+C;CAClF,OAAO;AACT;AAEA,SAAS,qBAAqB,OAA8B;CAC1D,IAAI,CAAC,QAAQ,KAAK,KAAK,GAAG,OAAO;CACjC,MAAM,SAAS,OAAO,KAAK;CAC3B,OAAO,OAAO,cAAc,MAAM,KAAK,SAAS,IAAI,SAAS;AAC/D;AAEA,SAAS,gBAAgB,OAAyB;CAChD,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,YAAY,SAAS,MAAM,WAAW;AAC9F;;AAGA,SAAS,kBAAkB,cAA8D;CACvF,MAAM,QAAQ,aAAa,QAAQ,GAAG;CACtC,IAAI,SAAS,KAAK,UAAU,aAAa,SAAS,GAAG,OAAO;CAC5D,OAAO;EAAE,OAAO,aAAa,MAAM,GAAG,KAAK;EAAG,MAAM,aAAa,MAAM,QAAQ,CAAC;CAAE;AACpF;AAEA,SAAS,0BAA0B,YAAsE;CACvG,MAAM,QAAQ,WAAW,MAAM,6CAA6C,KAAK,WAAW,MAAM,eAAe;CACjH,IAAI,CAAC,QAAQ,MAAM,CAAC,MAAM,IAAI,OAAO;CACrC,MAAM,eAAe,qBAAqB,MAAM,EAAE;CAClD,MAAM,UAAU,qBAAqB,MAAM,EAAE;CAC7C,OAAO,gBAAgB,UAAU;EAAE,cAAc,OAAO,YAAY;EAAG,SAAS,OAAO,OAAO;CAAE,IAAI;AACtG"}

package/dist/integrations/github/issue-reconciler.d.ts

@@ -0,0 +1,28 @@
+import type { IntegrationContext } from '../base.js';
+import type { GithubIssueFetcher, GithubOpenIssueLister, GithubRulesIntegration, GithubRulesOptions, ReconcileRepository } from './rules.js';
+export interface GithubIssueReconcileSummary {
+    /** Repositories included in the sweep. */
+    repositories: number;
+    /** Issue cards whose live state was fetched. */
+    checked: number;
+    /** Open issues with metadata patches. */
+    updated: number;
+    /** Closed issues replayed through the rules ingress. */
+    closed: number;
+    /** Open issues whose changed labels were replayed through the rules ingress. */
+    relabeled: number;
+    /** Open issues with no Work card replayed as `opened` through the rules ingress. */
+    created: number;
+    /** Errors encountered during the sweep. */
+    failed: number;
+    /** Error samples with context. */
+    errors: Array<{
+        repository: string;
+        issueNumber?: number;
+        error: string;
+    }>;
+}
+export type GithubIssueReconciler = (repositories: ReconcileRepository[]) => Promise<GithubIssueReconcileSummary>;
+export declare function createGithubIssueReconciler(options: GithubRulesOptions, fetchIssue: GithubIssueFetcher, listOpenIssues?: GithubOpenIssueLister): GithubIssueReconciler;
+export declare function attachGithubIssueReconciler(github: GithubRulesIntegration, context: IntegrationContext, fetchIssue: GithubIssueFetcher, listOpenIssues?: GithubOpenIssueLister): GithubIssueReconciler | undefined;
+//# sourceMappingURL=issue-reconciler.d.ts.map

package/dist/integrations/github/issue-reconciler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue-reconciler.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/issue-reconciler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAYrD,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,2BAA2B;IAC1C,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,MAAM,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5E;AAED,MAAM,MAAM,qBAAqB,GAAG,CAAC,YAAY,EAAE,mBAAmB,EAAE,KAAK,OAAO,CAAC,2BAA2B,CAAC,CAAC;AAElH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,kBAAkB,EAC3B,UAAU,EAAE,kBAAkB,EAC9B,cAAc,CAAC,EAAE,qBAAqB,GACrC,qBAAqB,CAyKvB;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,kBAAkB,EAC3B,UAAU,EAAE,kBAAkB,EAC9B,cAAc,CAAC,EAAE,qBAAqB,GACrC,qBAAqB,GAAG,SAAS,CAKnC"}

package/dist/integrations/github/issue-reconciler.js

@@ -0,0 +1,138 @@
+import { workItemPhaseSemantics } from "../../boards/semantics.js";
+import "../../boards/index.js";
+import { GithubRules, githubRulesOptions, reconcilableIssueNumber, reconciledIssueClosedEvent, reconciledIssueOpenedEvent, reconciledIssueRelabeledEvent, sameStrings, sweepTrustLookup } from "./rules.js";
+//#region src/integrations/github/issue-reconciler.ts
+function createGithubIssueReconciler(options, fetchIssue, listOpenIssues) {
+	const rules = new GithubRules(options);
+	return async (repositories) => {
+		const summary = {
+			repositories: 0,
+			checked: 0,
+			updated: 0,
+			closed: 0,
+			relabeled: 0,
+			created: 0,
+			failed: 0,
+			errors: []
+		};
+		const recordFailure = (repository, error, issueNumber) => {
+			summary.failed += 1;
+			if (summary.errors.length < 5) summary.errors.push({
+				repository: repository.fullName,
+				...issueNumber === void 0 ? {} : { issueNumber },
+				error: error instanceof Error ? error.message : String(error)
+			});
+		};
+		for (const repository of repositories) {
+			summary.repositories += 1;
+			const authorTrust = sweepTrustLookup(options.github, repository);
+			try {
+				const projects = await options.sourceControl.projectRepositories.listByExternalRepository({
+					installationExternalId: String(repository.installationId),
+					repositoryExternalId: String(repository.id)
+				});
+				if (projects.length === 0) continue;
+				const itemsByNumber = /* @__PURE__ */ new Map();
+				const carded = /* @__PURE__ */ new Set();
+				for (const project of projects) {
+					const items = await options.storage.list({
+						orgId: project.orgId,
+						factoryProjectId: project.factoryProjectId
+					});
+					for (const item of items) {
+						const issueNumber = reconcilableIssueNumber(item, repository);
+						if (!issueNumber) continue;
+						carded.add(issueNumber);
+						if (workItemPhaseSemantics(options.boards, item)?.kind === "terminal") continue;
+						let list = itemsByNumber.get(issueNumber);
+						if (!list) {
+							list = [];
+							itemsByNumber.set(issueNumber, list);
+						}
+						list.push(item);
+					}
+				}
+				if (listOpenIssues) {
+					const linkedAt = Math.min(...projects.map((project) => project.projectRepository.createdAt.getTime()));
+					const openIssues = await listOpenIssues({
+						installationId: repository.installationId,
+						repository: repository.fullName
+					});
+					for (const issue of openIssues) {
+						if (carded.has(issue.number)) continue;
+						const createdAt = issue.createdAt ? Date.parse(issue.createdAt) : NaN;
+						if (!Number.isFinite(createdAt) || createdAt < linkedAt) continue;
+						try {
+							if ((await rules.ingest(reconciledIssueOpenedEvent(repository, issue.number, issue))).status === "committed") summary.created += 1;
+						} catch (error) {
+							recordFailure(repository, error, issue.number);
+						}
+					}
+				}
+				for (const [issueNumber, items] of itemsByNumber) try {
+					const state = await fetchIssue({
+						installationId: repository.installationId,
+						repository: repository.fullName,
+						number: issueNumber
+					});
+					if (!state) continue;
+					summary.checked += 1;
+					if (state.state === "closed") {
+						await rules.ingest(reconciledIssueClosedEvent(repository, issueNumber, state));
+						summary.closed += 1;
+						continue;
+					}
+					const desiredMetadata = {
+						githubRepositoryId: repository.id,
+						githubIssueNumber: issueNumber,
+						state: "open",
+						...state.author === void 0 ? {} : { author: state.author },
+						...state.assignees === void 0 ? {} : { assignees: state.assignees },
+						...state.labels === void 0 ? {} : { labels: state.labels }
+					};
+					let authorTrusted;
+					if (state.author !== void 0) try {
+						authorTrusted = await authorTrust(state.author);
+					} catch (error) {
+						recordFailure(repository, error, issueNumber);
+					}
+					if (state.labels !== void 0 && items.some((item) => Array.isArray(item.metadata?.labels) && !sameStrings(item.metadata.labels, state.labels))) {
+						await rules.ingest(reconciledIssueRelabeledEvent(repository, issueNumber, state));
+						summary.relabeled += 1;
+					}
+					for (const item of items) {
+						const current = item.metadata ?? {};
+						const trustStale = authorTrusted !== void 0 && current.authorTrusted !== authorTrusted;
+						if (!(trustStale || current.githubRepositoryId !== desiredMetadata.githubRepositoryId || current.githubIssueNumber !== desiredMetadata.githubIssueNumber || current.state !== desiredMetadata.state || state.author !== void 0 && current.author !== state.author || state.assignees !== void 0 && !sameStrings(current.assignees, state.assignees) || state.labels !== void 0 && !sameStrings(current.labels, state.labels))) continue;
+						await options.storage.update({
+							orgId: item.orgId,
+							id: item.id,
+							userId: "factory-rule-dispatcher",
+							patch: { metadata: {
+								...current,
+								...desiredMetadata,
+								...trustStale ? { authorTrusted } : {}
+							} }
+						});
+						summary.updated += 1;
+					}
+				} catch (error) {
+					recordFailure(repository, error, issueNumber);
+				}
+			} catch (error) {
+				recordFailure(repository, error);
+			}
+		}
+		return summary;
+	};
+}
+function attachGithubIssueReconciler(github, context, fetchIssue, listOpenIssues) {
+	if (!context.runtime) return void 0;
+	const options = githubRulesOptions(github, context);
+	if (!options) return void 0;
+	return createGithubIssueReconciler(options, fetchIssue, listOpenIssues);
+}
+//#endregion
+export { attachGithubIssueReconciler, createGithubIssueReconciler };
+
+//# sourceMappingURL=issue-reconciler.js.map

package/dist/integrations/github/issue-reconciler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue-reconciler.js","names":[],"sources":["../../../src/integrations/github/issue-reconciler.ts"],"sourcesContent":["import { workItemPhaseSemantics } from '../../boards/index.js';\nimport type { IntegrationContext } from '../base.js';\nimport {\n  githubRulesOptions,\n  reconcilableIssueNumber,\n  reconciledIssueClosedEvent,\n  reconciledIssueOpenedEvent,\n  reconciledIssueRelabeledEvent,\n  RECONCILE_ERROR_SAMPLE_LIMIT,\n  sameStrings,\n  sweepTrustLookup,\n  GithubRules,\n} from './rules.js';\nimport type {\n  GithubIssueFetcher,\n  GithubOpenIssueLister,\n  GithubRulesIntegration,\n  GithubRulesOptions,\n  ReconcileRepository,\n} from './rules.js';\n\nexport interface GithubIssueReconcileSummary {\n  /** Repositories included in the sweep. */\n  repositories: number;\n  /** Issue cards whose live state was fetched. */\n  checked: number;\n  /** Open issues with metadata patches. */\n  updated: number;\n  /** Closed issues replayed through the rules ingress. */\n  closed: number;\n  /** Open issues whose changed labels were replayed through the rules ingress. */\n  relabeled: number;\n  /** Open issues with no Work card replayed as `opened` through the rules ingress. */\n  created: number;\n  /** Errors encountered during the sweep. */\n  failed: number;\n  /** Error samples with context. */\n  errors: Array<{ repository: string; issueNumber?: number; error: string }>;\n}\n\nexport type GithubIssueReconciler = (repositories: ReconcileRepository[]) => Promise<GithubIssueReconcileSummary>;\n\nexport function createGithubIssueReconciler(\n  options: GithubRulesOptions,\n  fetchIssue: GithubIssueFetcher,\n  listOpenIssues?: GithubOpenIssueLister,\n): GithubIssueReconciler {\n  const rules = new GithubRules(options);\n  return async repositories => {\n    const summary: GithubIssueReconcileSummary = {\n      repositories: 0,\n      checked: 0,\n      updated: 0,\n      closed: 0,\n      relabeled: 0,\n      created: 0,\n      failed: 0,\n      errors: [],\n    };\n    const recordFailure = (repository: ReconcileRepository, error: unknown, issueNumber?: number) => {\n      summary.failed += 1;\n      if (summary.errors.length < RECONCILE_ERROR_SAMPLE_LIMIT) {\n        summary.errors.push({\n          repository: repository.fullName,\n          ...(issueNumber === undefined ? {} : { issueNumber }),\n          error: error instanceof Error ? error.message : String(error),\n        });\n      }\n    };\n\n    for (const repository of repositories) {\n      summary.repositories += 1;\n      const authorTrust = sweepTrustLookup(options.github, repository);\n\n      try {\n        const projects = await options.sourceControl.projectRepositories.listByExternalRepository({\n          installationExternalId: String(repository.installationId),\n          repositoryExternalId: String(repository.id),\n        });\n        if (projects.length === 0) continue;\n\n        // Collect issue cards: number -> items (skip terminal stages)\n        const itemsByNumber = new Map<number, import('../../storage/domains/work-items/base.js').WorkItemRow[]>();\n        // Every issue with any card, terminal included: a finished card must\n        // not be re-minted by missed-open discovery.\n        const carded = new Set<number>();\n\n        for (const project of projects) {\n          const items = await options.storage.list({\n            orgId: project.orgId,\n            factoryProjectId: project.factoryProjectId,\n          });\n          for (const item of items) {\n            const issueNumber = reconcilableIssueNumber(item, repository);\n            if (!issueNumber) continue;\n            carded.add(issueNumber);\n            if (workItemPhaseSemantics(options.boards, item)?.kind === 'terminal') continue;\n            let list = itemsByNumber.get(issueNumber);\n            if (!list) {\n              list = [];\n              itemsByNumber.set(issueNumber, list);\n            }\n            list.push(item);\n          }\n        }\n\n        // Missed-open discovery: an `opened` delivery that never reached the\n        // ingress leaves no card for the sweeps above to repair. Only issues\n        // filed after the repository was linked are replayed, so linking a\n        // repository never backfills its existing backlog.\n        if (listOpenIssues) {\n          const linkedAt = Math.min(...projects.map(project => project.projectRepository.createdAt.getTime()));\n          const openIssues = await listOpenIssues({\n            installationId: repository.installationId,\n            repository: repository.fullName,\n          });\n          for (const issue of openIssues) {\n            if (carded.has(issue.number)) continue;\n            const createdAt = issue.createdAt ? Date.parse(issue.createdAt) : Number.NaN;\n            if (!Number.isFinite(createdAt) || createdAt < linkedAt) continue;\n            try {\n              const result = await rules.ingest(reconciledIssueOpenedEvent(repository, issue.number, issue));\n              if (result.status === 'committed') summary.created += 1;\n            } catch (error) {\n              recordFailure(repository, error, issue.number);\n            }\n          }\n        }\n\n        // Fetch and reconcile each unique issue\n        for (const [issueNumber, items] of itemsByNumber) {\n          try {\n            const state = await fetchIssue({\n              installationId: repository.installationId,\n              repository: repository.fullName,\n              number: issueNumber,\n            });\n            if (!state) continue; // missing or PR-backed\n            summary.checked += 1;\n\n            // Close detection: replay through rules ingress\n            if (state.state === 'closed') {\n              await rules.ingest(reconciledIssueClosedEvent(repository, issueNumber, state));\n              summary.closed += 1;\n              continue; // card transitions, skip metadata patch\n            }\n\n            // Metadata sync for open issues\n            const desiredMetadata = {\n              githubRepositoryId: repository.id,\n              githubIssueNumber: issueNumber,\n              state: 'open' as const,\n              ...(state.author === undefined ? {} : { author: state.author }),\n              ...(state.assignees === undefined ? {} : { assignees: state.assignees }),\n              ...(state.labels === undefined ? {} : { labels: state.labels }),\n            };\n            // Re-stamped on every sweep so revoked write access reads untrusted\n            // within one cycle; a failed lookup keeps the last stamp and retries.\n            let authorTrusted: boolean | undefined;\n            if (state.author !== undefined) {\n              try {\n                authorTrusted = await authorTrust(state.author);\n              } catch (error) {\n                recordFailure(repository, error, issueNumber);\n              }\n            }\n\n            // Label drift decides where the card belongs, and the rule that owns\n            // that decision has to run again — mirrored from the `labeled` /\n            // `unlabeled` webhook, replayed here so a label Factory never saw a\n            // delivery for still re-places the card. Replayed before the\n            // metadata patch, so the ingress sees the drift it acts on.\n            if (\n              state.labels !== undefined &&\n              items.some(\n                item => Array.isArray(item.metadata?.labels) && !sameStrings(item.metadata.labels, state.labels),\n              )\n            ) {\n              await rules.ingest(reconciledIssueRelabeledEvent(repository, issueNumber, state));\n              summary.relabeled += 1;\n            }\n\n            for (const item of items) {\n              const current = item.metadata ?? {};\n              const trustStale = authorTrusted !== undefined && current.authorTrusted !== authorTrusted;\n              const metadataChanged =\n                trustStale ||\n                current.githubRepositoryId !== desiredMetadata.githubRepositoryId ||\n                current.githubIssueNumber !== desiredMetadata.githubIssueNumber ||\n                current.state !== desiredMetadata.state ||\n                (state.author !== undefined && current.author !== state.author) ||\n                (state.assignees !== undefined && !sameStrings(current.assignees, state.assignees)) ||\n                (state.labels !== undefined && !sameStrings(current.labels, state.labels));\n\n              if (!metadataChanged) continue;\n\n              await options.storage.update({\n                orgId: item.orgId,\n                id: item.id,\n                userId: 'factory-rule-dispatcher',\n                patch: { metadata: { ...current, ...desiredMetadata, ...(trustStale ? { authorTrusted } : {}) } },\n              });\n              summary.updated += 1;\n            }\n          } catch (error) {\n            recordFailure(repository, error, issueNumber);\n          }\n        }\n      } catch (error) {\n        recordFailure(repository, error);\n      }\n    }\n\n    return summary;\n  };\n}\n\nexport function attachGithubIssueReconciler(\n  github: GithubRulesIntegration,\n  context: IntegrationContext,\n  fetchIssue: GithubIssueFetcher,\n  listOpenIssues?: GithubOpenIssueLister,\n): GithubIssueReconciler | undefined {\n  if (!context.runtime) return undefined;\n  const options = githubRulesOptions(github, context);\n  if (!options) return undefined;\n  return createGithubIssueReconciler(options, fetchIssue, listOpenIssues);\n}\n"],"mappings":";;;;AA0CA,SAAgB,4BACd,SACA,YACA,gBACuB;CACvB,MAAM,QAAQ,IAAI,YAAY,OAAO;CACrC,OAAO,OAAM,iBAAgB;EAC3B,MAAM,UAAuC;GAC3C,cAAc;GACd,SAAS;GACT,SAAS;GACT,QAAQ;GACR,WAAW;GACX,SAAS;GACT,QAAQ;GACR,QAAQ,CAAC;EACX;EACA,MAAM,iBAAiB,YAAiC,OAAgB,gBAAyB;GAC/F,QAAQ,UAAU;GAClB,IAAI,QAAQ,OAAO,SAAA,GACjB,QAAQ,OAAO,KAAK;IAClB,YAAY,WAAW;IACvB,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;IACnD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC9D,CAAC;EAEL;EAEA,KAAK,MAAM,cAAc,cAAc;GACrC,QAAQ,gBAAgB;GACxB,MAAM,cAAc,iBAAiB,QAAQ,QAAQ,UAAU;GAE/D,IAAI;IACF,MAAM,WAAW,MAAM,QAAQ,cAAc,oBAAoB,yBAAyB;KACxF,wBAAwB,OAAO,WAAW,cAAc;KACxD,sBAAsB,OAAO,WAAW,EAAE;IAC5C,CAAC;IACD,IAAI,SAAS,WAAW,GAAG;IAG3B,MAAM,gCAAgB,IAAI,IAA8E;IAGxG,MAAM,yBAAS,IAAI,IAAY;IAE/B,KAAK,MAAM,WAAW,UAAU;KAC9B,MAAM,QAAQ,MAAM,QAAQ,QAAQ,KAAK;MACvC,OAAO,QAAQ;MACf,kBAAkB,QAAQ;KAC5B,CAAC;KACD,KAAK,MAAM,QAAQ,OAAO;MACxB,MAAM,cAAc,wBAAwB,MAAM,UAAU;MAC5D,IAAI,CAAC,aAAa;MAClB,OAAO,IAAI,WAAW;MACtB,IAAI,uBAAuB,QAAQ,QAAQ,IAAI,CAAC,EAAE,SAAS,YAAY;MACvE,IAAI,OAAO,cAAc,IAAI,WAAW;MACxC,IAAI,CAAC,MAAM;OACT,OAAO,CAAC;OACR,cAAc,IAAI,aAAa,IAAI;MACrC;MACA,KAAK,KAAK,IAAI;KAChB;IACF;IAMA,IAAI,gBAAgB;KAClB,MAAM,WAAW,KAAK,IAAI,GAAG,SAAS,KAAI,YAAW,QAAQ,kBAAkB,UAAU,QAAQ,CAAC,CAAC;KACnG,MAAM,aAAa,MAAM,eAAe;MACtC,gBAAgB,WAAW;MAC3B,YAAY,WAAW;KACzB,CAAC;KACD,KAAK,MAAM,SAAS,YAAY;MAC9B,IAAI,OAAO,IAAI,MAAM,MAAM,GAAG;MAC9B,MAAM,YAAY,MAAM,YAAY,KAAK,MAAM,MAAM,SAAS,IAAI;MAClE,IAAI,CAAC,OAAO,SAAS,SAAS,KAAK,YAAY,UAAU;MACzD,IAAI;OAEF,KAAI,MADiB,MAAM,OAAO,2BAA2B,YAAY,MAAM,QAAQ,KAAK,CAAC,EAAA,CAClF,WAAW,aAAa,QAAQ,WAAW;MACxD,SAAS,OAAO;OACd,cAAc,YAAY,OAAO,MAAM,MAAM;MAC/C;KACF;IACF;IAGA,KAAK,MAAM,CAAC,aAAa,UAAU,eACjC,IAAI;KACF,MAAM,QAAQ,MAAM,WAAW;MAC7B,gBAAgB,WAAW;MAC3B,YAAY,WAAW;MACvB,QAAQ;KACV,CAAC;KACD,IAAI,CAAC,OAAO;KACZ,QAAQ,WAAW;KAGnB,IAAI,MAAM,UAAU,UAAU;MAC5B,MAAM,MAAM,OAAO,2BAA2B,YAAY,aAAa,KAAK,CAAC;MAC7E,QAAQ,UAAU;MAClB;KACF;KAGA,MAAM,kBAAkB;MACtB,oBAAoB,WAAW;MAC/B,mBAAmB;MACnB,OAAO;MACP,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;MAC7D,GAAI,MAAM,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,MAAM,UAAU;MACtE,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;KAC/D;KAGA,IAAI;KACJ,IAAI,MAAM,WAAW,KAAA,GACnB,IAAI;MACF,gBAAgB,MAAM,YAAY,MAAM,MAAM;KAChD,SAAS,OAAO;MACd,cAAc,YAAY,OAAO,WAAW;KAC9C;KAQF,IACE,MAAM,WAAW,KAAA,KACjB,MAAM,MACJ,SAAQ,MAAM,QAAQ,KAAK,UAAU,MAAM,KAAK,CAAC,YAAY,KAAK,SAAS,QAAQ,MAAM,MAAM,CACjG,GACA;MACA,MAAM,MAAM,OAAO,8BAA8B,YAAY,aAAa,KAAK,CAAC;MAChF,QAAQ,aAAa;KACvB;KAEA,KAAK,MAAM,QAAQ,OAAO;MACxB,MAAM,UAAU,KAAK,YAAY,CAAC;MAClC,MAAM,aAAa,kBAAkB,KAAA,KAAa,QAAQ,kBAAkB;MAU5E,IAAI,EARF,cACA,QAAQ,uBAAuB,gBAAgB,sBAC/C,QAAQ,sBAAsB,gBAAgB,qBAC9C,QAAQ,UAAU,gBAAgB,SACjC,MAAM,WAAW,KAAA,KAAa,QAAQ,WAAW,MAAM,UACvD,MAAM,cAAc,KAAA,KAAa,CAAC,YAAY,QAAQ,WAAW,MAAM,SAAS,KAChF,MAAM,WAAW,KAAA,KAAa,CAAC,YAAY,QAAQ,QAAQ,MAAM,MAAM,IAEpD;MAEtB,MAAM,QAAQ,QAAQ,OAAO;OAC3B,OAAO,KAAK;OACZ,IAAI,KAAK;OACT,QAAQ;OACR,OAAO,EAAE,UAAU;QAAE,GAAG;QAAS,GAAG;QAAiB,GAAI,aAAa,EAAE,cAAc,IAAI,CAAC;OAAG,EAAE;MAClG,CAAC;MACD,QAAQ,WAAW;KACrB;IACF,SAAS,OAAO;KACd,cAAc,YAAY,OAAO,WAAW;IAC9C;GAEJ,SAAS,OAAO;IACd,cAAc,YAAY,KAAK;GACjC;EACF;EAEA,OAAO;CACT;AACF;AAEA,SAAgB,4BACd,QACA,SACA,YACA,gBACmC;CACnC,IAAI,CAAC,QAAQ,SAAS,OAAO,KAAA;CAC7B,MAAM,UAAU,mBAAmB,QAAQ,OAAO;CAClD,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,OAAO,4BAA4B,SAAS,YAAY,cAAc;AACxE"}

package/dist/integrations/github/pat.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Org-scoped GitHub Personal Access Token settings.
+ *
+ * GitHub App installation tokens are the wrong credential for the `gh` CLI —
+ * they hit "Resource not accessible by integration" on endpoints the CLI
+ * needs regardless of the minted permission set. When an org pastes a PAT in
+ * Settings, the sandbox `GH_TOKEN` injection sites and the
+ * `github_refresh_token` tool use it instead of a minted installation token.
+ * Tokens must be classic PATs whose account has access to the linked repos.
+ *
+ * Two kinds:
+ * - `default` — the worker token every sandbox gets.
+ * - `reviewer` — optional second token for review-board sessions, so PR
+ *   reviews come from a different account than the author. When it isn't
+ *   configured, review sessions fall back to the worker token.
+ *
+ * Both live in the generic `integration_settings` collection for the
+ * `github` integration under a sentinel user id (the settings are org-wide,
+ * but the schema keys settings per `(org, user)`). Tokens are never returned
+ * to the browser — the routes only report whether each is configured.
+ */
+import type { GithubSubscriptionStorage } from './subscriptions.js';
+export type GithubPatKind = 'default' | 'reviewer';
+/** The PAT to install for `kind`, or null. `reviewer` falls back to the
+ * worker token so review sessions still authenticate when no dedicated
+ * reviewer token is configured. Fail-soft: storage errors (e.g. integration
+ * storage not initialized in a partial test harness) read as "no PAT
+ * configured" so token minting still works. */
+export declare function getGithubPat(getStorage: () => GithubSubscriptionStorage, orgId: string, kind?: GithubPatKind): Promise<string | null>;
+/** Which tokens are configured, without fallback semantics — feeds the
+ * settings UI status badges. */
+export declare function getGithubPatStatus(getStorage: () => GithubSubscriptionStorage, orgId: string): Promise<{
+    configured: boolean;
+    reviewerConfigured: boolean;
+}>;
+export declare function setGithubPat(storage: GithubSubscriptionStorage, orgId: string, pat: string, kind?: GithubPatKind): Promise<void>;
+export declare function clearGithubPat(storage: GithubSubscriptionStorage, orgId: string, kind?: GithubPatKind): Promise<void>;
+//# sourceMappingURL=pat.d.ts.map

package/dist/integrations/github/pat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pat.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/pat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAKpE,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,UAAU,CAAC;AAanD;;;;+CAI+C;AAC/C,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,yBAAyB,EAC3C,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,aAAyB,GAC9B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CASxB;AAED;gCACgC;AAChC,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,yBAAyB,EAC3C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,kBAAkB,EAAE,OAAO,CAAA;CAAE,CAAC,CAU/D;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,yBAAyB,EAClC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,aAAyB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAGf;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,yBAAyB,EAClC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,aAAyB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAMf"}

package/dist/integrations/github/pat.js

@@ -0,0 +1,59 @@
+//#region src/integrations/github/pat.ts
+/** Sentinel `user_id` for the org-wide settings row. */
+const PAT_SETTINGS_USER_ID = "__github_org_settings__";
+const FIELD_FOR_KIND = {
+	default: "pat",
+	reviewer: "reviewerPat"
+};
+function asToken(value) {
+	return typeof value === "string" && value.length > 0 ? value : null;
+}
+/** The PAT to install for `kind`, or null. `reviewer` falls back to the
+* worker token so review sessions still authenticate when no dedicated
+* reviewer token is configured. Fail-soft: storage errors (e.g. integration
+* storage not initialized in a partial test harness) read as "no PAT
+* configured" so token minting still works. */
+async function getGithubPat(getStorage, orgId, kind = "default") {
+	try {
+		const settings = await getStorage().settings.get(orgId, PAT_SETTINGS_USER_ID);
+		if (!settings) return null;
+		if (kind === "reviewer") return asToken(settings.reviewerPat) ?? asToken(settings.pat);
+		return asToken(settings.pat);
+	} catch {
+		return null;
+	}
+}
+/** Which tokens are configured, without fallback semantics — feeds the
+* settings UI status badges. */
+async function getGithubPatStatus(getStorage, orgId) {
+	try {
+		const settings = await getStorage().settings.get(orgId, PAT_SETTINGS_USER_ID);
+		return {
+			configured: asToken(settings?.pat) !== null,
+			reviewerConfigured: asToken(settings?.reviewerPat) !== null
+		};
+	} catch {
+		return {
+			configured: false,
+			reviewerConfigured: false
+		};
+	}
+}
+async function setGithubPat(storage, orgId, pat, kind = "default") {
+	const existing = await storage.settings.get(orgId, PAT_SETTINGS_USER_ID) ?? {};
+	await storage.settings.save(orgId, PAT_SETTINGS_USER_ID, {
+		...existing,
+		[FIELD_FOR_KIND[kind]]: pat
+	});
+}
+async function clearGithubPat(storage, orgId, kind = "default") {
+	const existing = await storage.settings.get(orgId, PAT_SETTINGS_USER_ID);
+	const field = FIELD_FOR_KIND[kind];
+	if (!existing?.[field]) return;
+	const { [field]: _removed, ...rest } = existing;
+	await storage.settings.save(orgId, PAT_SETTINGS_USER_ID, rest);
+}
+//#endregion
+export { clearGithubPat, getGithubPat, getGithubPatStatus, setGithubPat };
+
+//# sourceMappingURL=pat.js.map

package/dist/integrations/github/pat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pat.js","names":[],"sources":["../../../src/integrations/github/pat.ts"],"sourcesContent":["/**\n * Org-scoped GitHub Personal Access Token settings.\n *\n * GitHub App installation tokens are the wrong credential for the `gh` CLI —\n * they hit \"Resource not accessible by integration\" on endpoints the CLI\n * needs regardless of the minted permission set. When an org pastes a PAT in\n * Settings, the sandbox `GH_TOKEN` injection sites and the\n * `github_refresh_token` tool use it instead of a minted installation token.\n * Tokens must be classic PATs whose account has access to the linked repos.\n *\n * Two kinds:\n * - `default` — the worker token every sandbox gets.\n * - `reviewer` — optional second token for review-board sessions, so PR\n *   reviews come from a different account than the author. When it isn't\n *   configured, review sessions fall back to the worker token.\n *\n * Both live in the generic `integration_settings` collection for the\n * `github` integration under a sentinel user id (the settings are org-wide,\n * but the schema keys settings per `(org, user)`). Tokens are never returned\n * to the browser — the routes only report whether each is configured.\n */\n\nimport type { GithubSubscriptionStorage } from './subscriptions.js';\n\n/** Sentinel `user_id` for the org-wide settings row. */\nconst PAT_SETTINGS_USER_ID = '__github_org_settings__';\n\nexport type GithubPatKind = 'default' | 'reviewer';\n\ntype GithubOrgSettings = { pat?: string; reviewerPat?: string };\n\nconst FIELD_FOR_KIND: Record<GithubPatKind, keyof GithubOrgSettings> = {\n  default: 'pat',\n  reviewer: 'reviewerPat',\n};\n\nfunction asToken(value: unknown): string | null {\n  return typeof value === 'string' && value.length > 0 ? value : null;\n}\n\n/** The PAT to install for `kind`, or null. `reviewer` falls back to the\n * worker token so review sessions still authenticate when no dedicated\n * reviewer token is configured. Fail-soft: storage errors (e.g. integration\n * storage not initialized in a partial test harness) read as \"no PAT\n * configured\" so token minting still works. */\nexport async function getGithubPat(\n  getStorage: () => GithubSubscriptionStorage,\n  orgId: string,\n  kind: GithubPatKind = 'default',\n): Promise<string | null> {\n  try {\n    const settings = (await getStorage().settings.get(orgId, PAT_SETTINGS_USER_ID)) as GithubOrgSettings | null;\n    if (!settings) return null;\n    if (kind === 'reviewer') return asToken(settings.reviewerPat) ?? asToken(settings.pat);\n    return asToken(settings.pat);\n  } catch {\n    return null;\n  }\n}\n\n/** Which tokens are configured, without fallback semantics — feeds the\n * settings UI status badges. */\nexport async function getGithubPatStatus(\n  getStorage: () => GithubSubscriptionStorage,\n  orgId: string,\n): Promise<{ configured: boolean; reviewerConfigured: boolean }> {\n  try {\n    const settings = (await getStorage().settings.get(orgId, PAT_SETTINGS_USER_ID)) as GithubOrgSettings | null;\n    return {\n      configured: asToken(settings?.pat) !== null,\n      reviewerConfigured: asToken(settings?.reviewerPat) !== null,\n    };\n  } catch {\n    return { configured: false, reviewerConfigured: false };\n  }\n}\n\nexport async function setGithubPat(\n  storage: GithubSubscriptionStorage,\n  orgId: string,\n  pat: string,\n  kind: GithubPatKind = 'default',\n): Promise<void> {\n  const existing = ((await storage.settings.get(orgId, PAT_SETTINGS_USER_ID)) ?? {}) as GithubOrgSettings;\n  await storage.settings.save(orgId, PAT_SETTINGS_USER_ID, { ...existing, [FIELD_FOR_KIND[kind]]: pat });\n}\n\nexport async function clearGithubPat(\n  storage: GithubSubscriptionStorage,\n  orgId: string,\n  kind: GithubPatKind = 'default',\n): Promise<void> {\n  const existing = (await storage.settings.get(orgId, PAT_SETTINGS_USER_ID)) as GithubOrgSettings | null;\n  const field = FIELD_FOR_KIND[kind];\n  if (!existing?.[field]) return;\n  const { [field]: _removed, ...rest } = existing;\n  await storage.settings.save(orgId, PAT_SETTINGS_USER_ID, rest);\n}\n"],"mappings":";;AAyBA,MAAM,uBAAuB;AAM7B,MAAM,iBAAiE;CACrE,SAAS;CACT,UAAU;AACZ;AAEA,SAAS,QAAQ,OAA+B;CAC9C,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;;;;;;AAOA,eAAsB,aACpB,YACA,OACA,OAAsB,WACE;CACxB,IAAI;EACF,MAAM,WAAY,MAAM,WAAW,CAAC,CAAC,SAAS,IAAI,OAAO,oBAAoB;EAC7E,IAAI,CAAC,UAAU,OAAO;EACtB,IAAI,SAAS,YAAY,OAAO,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,GAAG;EACrF,OAAO,QAAQ,SAAS,GAAG;CAC7B,QAAQ;EACN,OAAO;CACT;AACF;;;AAIA,eAAsB,mBACpB,YACA,OAC+D;CAC/D,IAAI;EACF,MAAM,WAAY,MAAM,WAAW,CAAC,CAAC,SAAS,IAAI,OAAO,oBAAoB;EAC7E,OAAO;GACL,YAAY,QAAQ,UAAU,GAAG,MAAM;GACvC,oBAAoB,QAAQ,UAAU,WAAW,MAAM;EACzD;CACF,QAAQ;EACN,OAAO;GAAE,YAAY;GAAO,oBAAoB;EAAM;CACxD;AACF;AAEA,eAAsB,aACpB,SACA,OACA,KACA,OAAsB,WACP;CACf,MAAM,WAAa,MAAM,QAAQ,SAAS,IAAI,OAAO,oBAAoB,KAAM,CAAC;CAChF,MAAM,QAAQ,SAAS,KAAK,OAAO,sBAAsB;EAAE,GAAG;GAAW,eAAe,QAAQ;CAAI,CAAC;AACvG;AAEA,eAAsB,eACpB,SACA,OACA,OAAsB,WACP;CACf,MAAM,WAAY,MAAM,QAAQ,SAAS,IAAI,OAAO,oBAAoB;CACxE,MAAM,QAAQ,eAAe;CAC7B,IAAI,CAAC,WAAW,QAAQ;CACxB,MAAM,GAAG,QAAQ,UAAU,GAAG,SAAS;CACvC,MAAM,QAAQ,SAAS,KAAK,OAAO,sBAAsB,IAAI;AAC/D"}

package/dist/integrations/github/provenance.d.ts

@@ -0,0 +1,34 @@
+import type { FactoryRuleJsonValue } from '../../rules/types.js';
+import type { IntegrationStorageHandle } from '../../storage/domains/integrations/base.js';
+import type { SourceControlStorageHandle } from '../../storage/domains/source-control/base.js';
+import type { FactoryRunBindingRecord, WorkItemRow, WorkItemsStorage } from '../../storage/domains/work-items/base.js';
+import type { GithubIntegration } from './integration.js';
+export interface RecordFactoryPullRequestProvenanceInput {
+    binding: FactoryRunBindingRecord;
+    item: WorkItemRow;
+    assistantMessageId: string;
+    toolCallId: string;
+    toolName: string;
+    toolInput: FactoryRuleJsonValue;
+    toolResult: FactoryRuleJsonValue;
+    status: 'success' | 'error';
+}
+export interface FactoryPullRequestProvenanceData {
+    kind: 'factory-pr-provenance';
+    bindingId: string;
+    workItemId: string;
+    factoryProjectId: string;
+    repositoryId: number;
+    pullRequestNumber: number;
+    pullRequestUrl: string;
+    assistantMessageId: string;
+    toolCallId: string;
+}
+export declare function resolveFactoryPullRequestParentWorkItemId(integrationStorage: IntegrationStorageHandle<Record<string, unknown>, Record<string, unknown>, FactoryPullRequestProvenanceData>, input: {
+    orgId: string;
+    factoryProjectId: string;
+    repositoryId: number;
+    pullRequestNumber: number;
+}): Promise<string | null>;
+export declare function recordFactoryPullRequestProvenance(github: GithubIntegration, sourceControl: SourceControlStorageHandle, integrationStorage: IntegrationStorageHandle<Record<string, unknown>, Record<string, unknown>, FactoryPullRequestProvenanceData>, workItems: WorkItemsStorage, input: RecordFactoryPullRequestProvenanceInput): Promise<void>;
+//# sourceMappingURL=provenance.d.ts.map

package/dist/integrations/github/provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/provenance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC/F,OAAO,KAAK,EAAE,uBAAuB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AACvH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAI1D,MAAM,WAAW,uCAAuC;IACtD,OAAO,EAAE,uBAAuB,CAAC;IACjC,IAAI,EAAE,WAAW,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,oBAAoB,CAAC;IAChC,UAAU,EAAE,oBAAoB,CAAC;IACjC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,gCAAgC;IAC/C,IAAI,EAAE,uBAAuB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,yCAAyC,CAC7D,kBAAkB,EAAE,wBAAwB,CAC1C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvB,gCAAgC,CACjC,EACD,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,GAClG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYxB;AAED,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,iBAAiB,EACzB,aAAa,EAAE,0BAA0B,EACzC,kBAAkB,EAAE,wBAAwB,CAC1C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvB,gCAAgC,CACjC,EACD,SAAS,EAAE,gBAAgB,EAC3B,KAAK,EAAE,uCAAuC,GAC7C,OAAO,CAAC,IAAI,CAAC,CA2Gf"}