@mastra/factory 0.0.0-aggregate-trace-20261015182851

package/dist/integrations/github/rules.js

@@ -0,0 +1,1021 @@
+import { assertFactoryDecisionTarget, validateFactoryRuleDecisions } from "../../rules/validation.js";
+import { boardEventHandlers, boardForWorkItem, eventBoardId, rulePhaseField, withBoardClosure, workItemPhaseSemantics } from "../../boards/semantics.js";
+import "../../boards/index.js";
+import { FACTORY_PULL_REQUEST_RECONCILIATION_KEY, WorkItemUpdateConflictError } from "../../storage/domains/work-items/base.js";
+import { cardLabels, moveCardToBoard } from "../../boards/relocate.js";
+import { selectEventRule } from "../../rules/event-rules.js";
+import { resolveIntakeLabelRoute } from "../../storage/domains/intake/base.js";
+import { recordPullRequestHead } from "../pull-request-head.js";
+import { changeRequestTargetKey } from "./subscriptions.js";
+import { createHash } from "crypto";
+//#region src/integrations/github/rules.ts
+const TRUSTED_PERMISSIONS = /* @__PURE__ */ new Set(["write", "admin"]);
+const RULE_TIMEOUT_MS = 5e3;
+const FACTORY_TRIAGE_COMMENT_MARKER = "<!-- mastra-factory-triage -->";
+async function withRuleTimeout(promise) {
+	let timeout;
+	try {
+		return await Promise.race([promise, new Promise((_, reject) => {
+			timeout = setTimeout(() => reject(/* @__PURE__ */ new Error("FACTORY_RULE_TIMEOUT")), RULE_TIMEOUT_MS);
+		})]);
+	} finally {
+		if (timeout) clearTimeout(timeout);
+	}
+}
+function object(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function timestamp(value) {
+	const parsed = typeof value === "string" ? Date.parse(value) : NaN;
+	return Number.isNaN(parsed) ? void 0 : parsed;
+}
+function string(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function number(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function boolean(value) {
+	return typeof value === "boolean" ? value : void 0;
+}
+function actorLogins(value) {
+	if (!Array.isArray(value)) return [];
+	return value.flatMap((actor) => {
+		const login = string(object(actor)?.login);
+		return login ? [login] : [];
+	});
+}
+function sameLabels(a, b) {
+	return a.length === b.length && a.every((label, index) => label === b[index]);
+}
+function labelNames(value) {
+	if (!Array.isArray(value)) return [];
+	return value.flatMap((label) => {
+		if (typeof label === "string") return label ? [label] : [];
+		const name = string(object(label)?.name);
+		return name ? [name] : [];
+	});
+}
+function parseFactoryReviewCommand(body, target) {
+	if (!body || !target) return void 0;
+	const firstLine = body.split("\n").map((line) => line.trim()).find((line) => line.length > 0)?.toLowerCase();
+	if (!firstLine) return void 0;
+	const mention = `@${target.toLowerCase().replace(/\[bot\]$/, "")}`;
+	if (firstLine === `${mention} review`) return {
+		command: "review",
+		target
+	};
+	if (firstLine === `${mention} re-review`) return {
+		command: "re-review",
+		target
+	};
+}
+function eventName(parsed) {
+	const action = string(parsed.payload.action);
+	if (parsed.event === "issues" && action === "opened") return "issueOpened";
+	if (parsed.event === "issues" && action === "edited") {
+		const changes = object(parsed.payload.changes);
+		return object(changes?.title) || object(changes?.body) ? "issueEdited" : void 0;
+	}
+	if (parsed.event === "issues" && action === "closed") return "issueClosed";
+	if (parsed.event === "issue_comment") {
+		if (object(object(parsed.payload.issue)?.pull_request)) return action === "created" ? "pullRequestCommentCreated" : void 0;
+		if (action === "created") return "issueCommentCreated";
+		if (action === "edited") return "issueCommentEdited";
+		if (action === "deleted") return "issueCommentDeleted";
+	}
+	if (parsed.event === "pull_request" && action === "opened") return "pullRequestOpened";
+	if (parsed.event === "pull_request" && action === "synchronize") return "pullRequestUpdated";
+	if (parsed.event === "pull_request" && action === "closed") return boolean(object(parsed.payload.pull_request)?.merged) ? "pullRequestMerged" : "pullRequestClosed";
+	if (parsed.event === "pull_request" && action === "review_requested") return "pullRequestReviewRequested";
+	if (parsed.event === "pull_request_review" && action === "submitted") return "pullRequestReviewSubmitted";
+}
+/**
+* Canonical source keys (`github-issue:N`, `github-pr:N`) do not identify a
+* repository, so a project linked to several repositories could bind repo A's
+* event to repo B's same-numbered card. The card's intake-stamped URL is
+* authoritative; the intake-stamped `githubRepositoryId` covers URL-less
+* cards. A card with neither signal cannot be attributed by number alone.
+*/
+const MAX_STALE_RULE_ATTEMPTS = 3;
+function cardBelongsToRepository(item, repositoryId, repositoryFullName) {
+	const url = item.externalSource?.url;
+	if (url) {
+		const match = /^https?:\/\/[^/]+\/(.+)\/(?:issues|pull)\/\d+(?:[/?#]|$)/.exec(url);
+		if (match && match[1] === repositoryFullName) return true;
+	}
+	return item.metadata?.githubRepositoryId === repositoryId;
+}
+function canonicalSourceKey(kind, itemNumber) {
+	return kind === "issue" ? `github-issue:${itemNumber}` : `github-pr:${itemNumber}`;
+}
+function legacySourceKey(repositoryId, kind, itemNumber) {
+	return `github:${repositoryId}:${kind}:${itemNumber}`;
+}
+function provenanceTarget(repositoryId, pullRequestNumber) {
+	return `factory-pr-provenance:${repositoryId}:${pullRequestNumber}`;
+}
+function workItemSource(item) {
+	if (!item.externalSource) return "manual";
+	return item.externalSource.type === "pull-request" ? "github-pr" : "github-issue";
+}
+function workItemSourceKey(item) {
+	return item.externalSource?.externalId ?? null;
+}
+async function trustedCollaborator(github, input) {
+	const permission = await github.getRepositoryCollaboratorPermission(input.installationId, input.repository, input.login);
+	return permission !== void 0 && TRUSTED_PERMISSIONS.has(permission);
+}
+function authorAwaitingTrust(item, repository) {
+	const metadata = item.metadata ?? {};
+	if (typeof metadata.author !== "string" || metadata.authorTrusted !== void 0) return void 0;
+	if ((reconcilablePullRequestNumber(item, repository) ?? reconcilableIssueNumber(item, repository)) === void 0) return void 0;
+	if (!item.externalSource?.url && /^github-(?:pr|issue):\d+$/.test(item.externalSource?.externalId ?? "") && metadata.githubRepositoryId !== repository.id) return void 0;
+	return metadata.author;
+}
+function sweepTrustLookup(github, repository) {
+	const cache = /* @__PURE__ */ new Map();
+	return async (login) => {
+		const cached = cache.get(login);
+		if (cached !== void 0) return cached;
+		const trusted = await trustedCollaborator(github, {
+			installationId: repository.installationId,
+			repository: repository.fullName,
+			login
+		});
+		cache.set(login, trusted);
+		return trusted;
+	};
+}
+async function githubActor(github, input) {
+	const trusted = await trustedCollaborator(github, input).catch(() => false);
+	return {
+		type: "github",
+		login: input.login,
+		trusted,
+		factoryAuthored: input.factoryAuthored
+	};
+}
+function pullRequestProvenance(data, factoryProjectId) {
+	if (!data || data.kind !== "factory-pr-provenance" || typeof data.workItemId !== "string") return null;
+	if (data.factoryProjectId !== factoryProjectId) return null;
+	return {
+		kind: "factory-pr-provenance",
+		workItemId: data.workItemId
+	};
+}
+/** Identity under which label-driven relocations are recorded. */
+const LABEL_ROUTE_USER_ID = "factory-rule-dispatcher";
+function issueLabelChange(parsed) {
+	const action = string(parsed.payload.action);
+	return parsed.event === "issues" && (action === "labeled" || action === "unlabeled");
+}
+/**
+* Whether a login is Factory itself. Prefers the resolved identity, which is
+* observed from Factory's own writes, and falls back to the configured slug.
+*/
+function isFactoryGithubLogin(github, login) {
+	if (github.identity?.known) return github.identity.matches(login);
+	const slug = github.slug?.trim();
+	if (!slug || !login) return false;
+	return login.toLowerCase() === `${slug.toLowerCase()}[bot]`;
+}
+var GithubRules = class {
+	options;
+	constructor(options) {
+		this.options = options;
+	}
+	/**
+	* Whether a login is Factory itself. Prefers the resolved identity, which is
+	* observed from Factory's own writes, and falls back to the configured slug.
+	* An unset slug must not silently answer "not Factory" — that is what
+	* disabled every self-loop guard.
+	*/
+	#isFactoryLogin(login) {
+		return isFactoryGithubLogin(this.options.github, login);
+	}
+	#factoryMentionTarget() {
+		const identity = this.options.github.identity;
+		if (identity?.known) return identity.login;
+		const slug = this.options.github.slug?.trim();
+		return slug ? `${slug.toLowerCase()}[bot]` : void 0;
+	}
+	/**
+	* Board an issue lands on: the one its labels select under the project's label routes, else the
+	* board the repository's intake source binding names. Only installed boards count. Undefined
+	* leaves built-in routing (Work) in charge.
+	*/
+	async #intakeTarget(project, repositoryName, labels) {
+		const intake = this.options.intake;
+		if (!intake) return void 0;
+		const { orgId, factoryProjectId } = project;
+		if (labels.length > 0) {
+			const route = resolveIntakeLabelRoute(await intake.listLabelRoutes({
+				orgId,
+				factoryProjectId,
+				integrationId: "github"
+			}), labels);
+			const board = route ? this.options.boards.get(route.board) : void 0;
+			if (board) return {
+				board: board.id,
+				initialPhase: board.initialPhase
+			};
+		}
+		const slug = repositoryName.toLowerCase();
+		const binding = (await intake.listBindings({
+			orgId,
+			integrationId: "github"
+		})).find((candidate) => candidate.factoryProjectId === factoryProjectId && (candidate.sourceId === project.projectRepository.repositoryId || candidate.sourceId.toLowerCase() === slug));
+		const board = binding?.board ? this.options.boards.get(binding.board) : void 0;
+		return board ? {
+			board: board.id,
+			initialPhase: board.initialPhase
+		} : void 0;
+	}
+	/**
+	* `labeled` / `unlabeled` are not rule events: the labels only decide which board the card belongs
+	* on, so the card is re-routed here and its label metadata refreshed. Cards a run owns, and
+	* finished cards, stay where they are.
+	*/
+	async #relocateLabeledIssue(parsed, repositoryId, repositoryName, project) {
+		const issue = object(parsed.payload.issue);
+		const issueNumber = issue?.pull_request === void 0 ? number(issue?.number) : void 0;
+		if (!issueNumber) return { status: "ignored" };
+		const found = await this.#relatedItem(project.orgId, project.factoryProjectId, repositoryId, repositoryName, issueNumber, void 0, void 0, null);
+		if (!found || found.externalSource?.type !== "issue") return { status: "ignored" };
+		const labels = labelNames(issue?.labels);
+		let item = found;
+		let changed = false;
+		if (!sameLabels(cardLabels(item), labels)) {
+			let updated;
+			try {
+				updated = await this.options.storage.update({
+					orgId: item.orgId,
+					id: item.id,
+					userId: LABEL_ROUTE_USER_ID,
+					patch: { metadata: {
+						...item.metadata ?? {},
+						labels
+					} },
+					expectedRevision: item.revision
+				});
+			} catch (error) {
+				if (!(error instanceof WorkItemUpdateConflictError)) throw error;
+				return { status: "ignored" };
+			}
+			if (!updated) return { status: "ignored" };
+			item = updated.item;
+			changed = true;
+		}
+		const target = await this.#intakeTarget(project, repositoryName, labels);
+		const outcome = await moveCardToBoard({
+			workItems: this.options.storage,
+			boardRegistry: this.options.boards,
+			userId: LABEL_ROUTE_USER_ID,
+			item,
+			targetBoard: target?.board ?? "work"
+		});
+		return { status: changed || outcome === "moved" ? "committed" : "ignored" };
+	}
+	async ingest(parsed) {
+		const event = eventName(parsed);
+		const labelChange = issueLabelChange(parsed);
+		const repository = object(parsed.payload.repository);
+		const installationId = number(object(parsed.payload.installation)?.id);
+		const repositoryId = number(repository?.id);
+		const repositoryName = string(repository?.full_name);
+		const login = string(object(parsed.payload.sender)?.login);
+		if (parsed.event === "push" && installationId && repositoryId) {
+			await this.#handOffPush(parsed, installationId, repositoryId);
+			return { status: "ignored" };
+		}
+		if (!event && !labelChange || !installationId || !repositoryId || !repositoryName || !login) return { status: "ignored" };
+		const projects = await this.options.sourceControl.projectRepositories.listByExternalRepository({
+			installationExternalId: String(installationId),
+			repositoryExternalId: String(repositoryId)
+		});
+		if (projects.length === 0) return { status: "ignored" };
+		const results = [];
+		for (const project of projects) results.push(event ? await this.#ingestProject(parsed, event, installationId, repositoryId, repositoryName, login, project) : await this.#relocateLabeledIssue(parsed, repositoryId, repositoryName, project));
+		if (results.some((result) => result.status === "committed")) return { status: "committed" };
+		if (results.some((result) => result.status === "replayed")) return { status: "replayed" };
+		return results[0] ?? { status: "ignored" };
+	}
+	/**
+	* A push is not a work-item event; it only reaches the environment build
+	* hand-off, once per project the repository is linked to. The hook decides
+	* whether the project builds on push.
+	*/
+	async #handOffPush(parsed, installationId, repositoryId) {
+		const onRepositoryPush = this.options.onRepositoryPush;
+		const ref = string(parsed.payload.ref);
+		const defaultBranch = string(object(parsed.payload.repository)?.default_branch);
+		if (!onRepositoryPush || !ref || !defaultBranch) return;
+		const projects = await this.options.sourceControl.projectRepositories.listByExternalRepository({
+			installationExternalId: String(installationId),
+			repositoryExternalId: String(repositoryId)
+		});
+		for (const project of projects) onRepositoryPush({
+			orgId: project.orgId,
+			factoryProjectId: project.factoryProjectId,
+			projectRepository: {
+				id: project.projectRepository.id,
+				inEnvironment: project.projectRepository.inEnvironment
+			},
+			ref,
+			defaultBranch
+		});
+	}
+	async #ingestProject(parsed, event, installationId, repositoryId, repositoryName, login, project) {
+		const factoryProject = await this.options.projects.get({
+			orgId: project.orgId,
+			id: project.factoryProjectId
+		});
+		if (!factoryProject) return { status: "missing" };
+		const issue = object(parsed.payload.issue);
+		const issueComment = object(parsed.payload.comment);
+		const changes = object(parsed.payload.changes);
+		const commentOnPullRequest = object(parsed.payload.issue)?.pull_request !== void 0;
+		const pullRequest = object(parsed.payload.pull_request) ?? (commentOnPullRequest ? issue : void 0);
+		const issueNumber = commentOnPullRequest ? void 0 : number(issue?.number);
+		const pullRequestNumber = number(pullRequest?.number);
+		const provenance = pullRequestNumber ? pullRequestProvenance((await this.options.integrationStorage.subscriptions.listByTarget(provenanceTarget(repositoryId, pullRequestNumber), { status: "active" })).find((subscription) => subscription.orgId === project.orgId && subscription.data?.factoryProjectId === project.factoryProjectId)?.data, project.factoryProjectId) : null;
+		const reviewRequested = event === "pullRequestReviewRequested";
+		const reviewCommand = event === "pullRequestCommentCreated" ? parseFactoryReviewCommand(string(issueComment?.body), this.#factoryMentionTarget()) : void 0;
+		const reviewEntryRequested = reviewRequested || reviewCommand !== void 0;
+		const senderIsResponder = reviewRequested || event === "pullRequestCommentCreated" || event === "pullRequestReviewSubmitted";
+		const reReviewEvent = reviewEntryRequested || event === "pullRequestUpdated";
+		const requestedReviewer = string(object(parsed.payload.requested_reviewer)?.login);
+		const pullRequestAuthor = string(object(pullRequest?.user)?.login);
+		const pullRequestFactoryAuthored = provenance !== null || this.#isFactoryLogin(pullRequestAuthor);
+		const resolvedItem = await this.#relatedItem(project.orgId, project.factoryProjectId, repositoryId, repositoryName, issueNumber, pullRequestNumber, string(object(pullRequest?.head)?.ref), reReviewEvent ? null : provenance, senderIsResponder && !reviewEntryRequested);
+		const relatedItem = reviewEntryRequested && resolvedItem?.externalSource?.type !== "pull-request" ? void 0 : resolvedItem;
+		const intake = issueNumber ? await this.#intakeTarget(project, repositoryName, labelNames(issue?.labels)) : void 0;
+		const actor = await githubActor(this.options.github, {
+			installationId,
+			repository: repositoryName,
+			login,
+			factoryAuthored: !senderIsResponder && provenance !== null || this.#isFactoryLogin(login)
+		});
+		if (actor.type === "github" && actor.factoryAuthored && (event === "issueCommentCreated" || event === "issueCommentEdited") && string(issueComment?.body)?.includes(FACTORY_TRIAGE_COMMENT_MARKER)) return { status: "ignored" };
+		const evaluate = async (item, ingressIdentity, pullRequestIntake = false, attempt = 1) => {
+			const context = {
+				tenant: {
+					orgId: project.orgId,
+					projectId: project.factoryProjectId
+				},
+				actor,
+				ingress: {
+					type: "github",
+					id: ingressIdentity
+				},
+				cause: `github.${event}`,
+				causalChain: [],
+				configVersion: this.options.configVersion,
+				...item ? {
+					item: {
+						id: item.id,
+						source: workItemSource(item),
+						sourceKey: workItemSourceKey(item),
+						parentWorkItemId: item.parentWorkItemId,
+						title: item.title,
+						url: item.externalSource?.url ?? null,
+						stages: item.stages,
+						acceptedAt: item.acceptedAt,
+						metadata: item.metadata
+					},
+					board: boardForWorkItem(item),
+					itemRevision: item.revision,
+					...withBoardClosure(this.options.boards, item),
+					...rulePhaseField(this.options.boards, item)
+				} : {},
+				...intake ? { intake } : {},
+				...pullRequestIntake ? { pullRequestIntake: true } : {},
+				event,
+				deliveryId: parsed.deliveryId,
+				factory: { createdAt: factoryProject.createdAt.toISOString() },
+				repository: {
+					id: repositoryId,
+					fullName: repositoryName,
+					installationId
+				},
+				...issueNumber && string(issue?.title) && string(issue?.html_url) ? { issue: {
+					number: issueNumber,
+					title: string(issue?.title),
+					url: string(issue?.html_url),
+					...string(issue?.created_at) ? { createdAt: string(issue?.created_at) } : {},
+					...string(issue?.updated_at) ? { updatedAt: string(issue?.updated_at) } : {},
+					assignees: actorLogins(issue?.assignees),
+					labels: labelNames(issue?.labels),
+					...string(issue?.state) === "closed" || string(issue?.state) === "open" ? { state: string(issue?.state) } : {},
+					...string(issue?.state_reason) ? { stateReason: string(issue?.state_reason) } : {}
+				} } : {},
+				...event === "issueEdited" ? { issueChange: {
+					title: Boolean(object(changes?.title)),
+					body: Boolean(object(changes?.body))
+				} } : {},
+				...number(issueComment?.id) ? { issueComment: {
+					id: number(issueComment?.id),
+					...string(issueComment?.body) ? { body: string(issueComment?.body) } : {},
+					...string(issueComment?.html_url) ? { url: string(issueComment?.html_url) } : {},
+					...string(object(issueComment?.user)?.login) ? { author: string(object(issueComment?.user)?.login) } : {},
+					...string(object(issueComment?.user)?.type) ? { authorType: string(object(issueComment?.user)?.type) } : {},
+					...string(issueComment?.created_at) ? { createdAt: string(issueComment?.created_at) } : {},
+					...string(issueComment?.updated_at) ? { updatedAt: string(issueComment?.updated_at) } : {}
+				} } : {},
+				...pullRequestNumber && string(pullRequest?.title) && string(pullRequest?.html_url) ? { pullRequest: {
+					number: pullRequestNumber,
+					title: string(pullRequest?.title),
+					url: string(pullRequest?.html_url),
+					...string(pullRequest?.created_at) ? { createdAt: string(pullRequest?.created_at) } : {},
+					state: string(pullRequest?.state) === "closed" ? "closed" : "open",
+					draft: boolean(pullRequest?.draft) ?? false,
+					merged: boolean(pullRequest?.merged) ?? false,
+					assignees: actorLogins(pullRequest?.assignees),
+					requestedReviewers: actorLogins(pullRequest?.requested_reviewers),
+					labels: labelNames(pullRequest?.labels),
+					...pullRequestAuthor ? { author: pullRequestAuthor } : {},
+					factoryAuthored: pullRequestFactoryAuthored,
+					headBranch: string(object(pullRequest?.head)?.ref) ?? "",
+					baseBranch: string(object(pullRequest?.base)?.ref) ?? ""
+				} } : {},
+				...reviewRequested && requestedReviewer ? { reviewRequest: {
+					reviewer: requestedReviewer,
+					factoryReviewer: this.#isFactoryLogin(requestedReviewer)
+				} } : {},
+				...reviewCommand ? { reviewCommand } : {},
+				...object(parsed.payload.review) ? { review: {
+					id: number(object(parsed.payload.review)?.id) ?? 0,
+					state: string(object(parsed.payload.review)?.state) ?? "unknown",
+					url: string(object(parsed.payload.review)?.html_url) ?? "",
+					...string(object(object(parsed.payload.review)?.user)?.login) ? { author: string(object(object(parsed.payload.review)?.user)?.login) } : {},
+					...string(object(parsed.payload.review)?.body) ? { body: string(object(parsed.payload.review)?.body) } : {}
+				} } : {}
+			};
+			const rule = selectEventRule(this.options.github.rules, boardEventHandlers(this.options.boards, eventBoardId(context), "github"), event);
+			let decision;
+			let decisions = [];
+			let outcome = { status: "accepted" };
+			try {
+				decision = rule ? await withRuleTimeout(Promise.resolve(rule(Object.freeze(context)))) : void 0;
+				if (decision?.type === "reject") outcome = {
+					status: "rejected",
+					code: decision.code,
+					reason: decision.reason
+				};
+				else if (decision) decisions = validateFactoryRuleDecisions([decision]).map((entry) => {
+					assertFactoryDecisionTarget(entry, this.options.boards, item ? boardForWorkItem(item) : void 0);
+					return { ...entry };
+				});
+			} catch (error) {
+				const timedOut = error instanceof Error && error.message === "FACTORY_RULE_TIMEOUT";
+				outcome = {
+					status: "rejected",
+					code: timedOut ? "timeout" : "rule_error",
+					reason: timedOut ? "Factory rule evaluation timed out." : error instanceof Error ? error.message.slice(0, 2e3) : "Factory GitHub rule failed."
+				};
+			}
+			const committed = await this.options.storage.commitRuleEvaluation({
+				orgId: project.orgId,
+				factoryProjectId: project.factoryProjectId,
+				workItemId: item?.id ?? null,
+				ingress: {
+					identity: ingressIdentity,
+					triggerType: `github.${event}`
+				},
+				configVersion: this.options.configVersion,
+				expectedRevision: item?.revision ?? null,
+				actor: { ...actor },
+				outcome,
+				decisions,
+				causalChain: [],
+				now: /* @__PURE__ */ new Date()
+			});
+			if (committed.status === "stale") {
+				if (attempt >= MAX_STALE_RULE_ATTEMPTS) throw new Error(`Factory GitHub rule evaluation for ${ingressIdentity} kept losing revision races.`);
+				const fresh = item ? await this.options.storage.get({
+					orgId: project.orgId,
+					id: item.id
+				}) : null;
+				if (item && !fresh) return { status: "missing" };
+				return evaluate(fresh ?? void 0, ingressIdentity, pullRequestIntake, attempt + 1);
+			}
+			return { status: committed.status };
+		};
+		const deliveryIdentity = `${installationId}:${parsed.deliveryId}`;
+		const pullRequestOpened = event === "pullRequestOpened";
+		const primary = await evaluate(relatedItem, deliveryIdentity, pullRequestOpened);
+		const linked = (event === "pullRequestMerged" || event === "pullRequestClosed") && relatedItem && pullRequestNumber ? await this.#linkedClosureItem(project.orgId, project.factoryProjectId, repositoryId, repositoryName, pullRequestNumber, relatedItem) : void 0;
+		const stampClosed = async (companionStatus) => {
+			if (!pullRequestNumber) return;
+			if (pullRequestOpened) {
+				const trusted = actor.type === "github" && actor.trusted || pullRequestFactoryAuthored;
+				const reviewCard = authoringItem && trusted ? await this.#linkedClosureItem(project.orgId, project.factoryProjectId, repositoryId, repositoryName, pullRequestNumber, authoringItem) : void 0;
+				const stillOpen = companionStatus === "replayed" ? reviewCard !== void 0 && reviewCard.metadata?.state !== "closed" : reviewCard?.metadata?.state !== "closed";
+				if (authoringItem && trusted && stillOpen) {
+					const head = authoringItem.metadata?.openPullRequestNumber !== pullRequestNumber ? {
+						pullRequestHeadSha: string(object(pullRequest?.head)?.sha)?.toLowerCase() ?? null,
+						pullRequestHeadAt: timestamp(pullRequest?.updated_at) ?? null
+					} : {};
+					await this.options.storage.update({
+						orgId: authoringItem.orgId,
+						id: authoringItem.id,
+						userId: "factory-rule-dispatcher",
+						patch: { metadata: {
+							openPullRequestNumber: pullRequestNumber,
+							...head
+						} }
+					});
+				}
+				return;
+			}
+			if (event !== "pullRequestMerged" && event !== "pullRequestClosed") return;
+			for (const card of [relatedItem, linked]) {
+				if (!card) continue;
+				if (card.externalSource?.type !== "pull-request") {
+					const recorded = card.metadata?.openPullRequestNumber;
+					const settled = {
+						...(typeof recorded !== "number" || recorded === pullRequestNumber) && event === "pullRequestMerged" && typeof card.metadata?.reviewVerdict === "string" ? { reviewVerdict: null } : {},
+						...recorded === pullRequestNumber ? { openPullRequestNumber: null } : {}
+					};
+					if (Object.keys(settled).length > 0) await this.options.storage.update({
+						orgId: card.orgId,
+						id: card.id,
+						userId: "factory-rule-dispatcher",
+						patch: { metadata: settled }
+					});
+					continue;
+				}
+				await this.options.storage.update({
+					orgId: card.orgId,
+					id: card.id,
+					userId: "factory-rule-dispatcher",
+					patch: { metadata: {
+						state: "closed",
+						merged: event === "pullRequestMerged"
+					} }
+				});
+			}
+		};
+		const authoringItem = linked === void 0 && pullRequestOpened && relatedItem !== void 0 && relatedItem.externalSource?.type !== "pull-request" ? relatedItem : void 0;
+		const stampHead = async () => {
+			const headSha = string(object(pullRequest?.head)?.sha)?.toLowerCase();
+			if (event !== "pullRequestUpdated" || !headSha || !pullRequestNumber) return;
+			const headAt = timestamp(pullRequest?.updated_at);
+			if (relatedItem?.externalSource?.type !== "pull-request") return;
+			const parent = await this.#linkedClosureItem(project.orgId, project.factoryProjectId, repositoryId, repositoryName, pullRequestNumber, relatedItem);
+			await recordPullRequestHead(this.options.storage, {
+				orgId: relatedItem.orgId,
+				id: relatedItem.id,
+				headSha,
+				headAt
+			});
+			if (parent) await recordPullRequestHead(this.options.storage, {
+				orgId: parent.orgId,
+				id: parent.id,
+				headSha,
+				headAt,
+				ownedPullRequestNumber: pullRequestNumber
+			});
+		};
+		if (linked === void 0 && authoringItem === void 0) {
+			await stampClosed();
+			await stampHead();
+			return primary;
+		}
+		const companion = linked ?? authoringItem;
+		const secondary = await evaluate(companion, `${deliveryIdentity}:${companion?.id ?? "pull-request"}`);
+		await stampClosed(secondary.status);
+		for (const status of ["committed", "replayed"]) if (primary.status === status || secondary.status === status) return { status };
+		return primary;
+	}
+	/**
+	* The other card a closed pull request concerns, joined through the Review
+	* card's `parentWorkItemId` — the link `upsertLinkedWorkItem` records when the
+	* pull request is opened, and therefore an exact join that needs no branch
+	* heuristics. Returns nothing when the pull request has only one card, which
+	* is every pull request Factory did not open from a work item's session.
+	*/
+	async #linkedClosureItem(orgId, projectId, repositoryId, repositoryFullName, pullRequestNumber, resolved) {
+		const items = await this.options.storage.list({
+			orgId,
+			factoryProjectId: projectId
+		});
+		const linked = resolved.externalSource?.type === "pull-request" ? items.find((item) => item.id === resolved.parentWorkItemId) : items.find((item) => item.parentWorkItemId === resolved.id && (item.externalSource?.externalId === canonicalSourceKey("pull-request", pullRequestNumber) || item.externalSource?.externalId === legacySourceKey(repositoryId, "pull-request", pullRequestNumber)) && cardBelongsToRepository(item, repositoryId, repositoryFullName));
+		return linked?.id === resolved.id ? void 0 : linked;
+	}
+	async #relatedItem(orgId, projectId, repositoryId, repositoryFullName, issueNumber, pullRequestNumber, pullRequestHeadBranch, provenance, preferAuthoringItem = false) {
+		const items = await this.options.storage.list({
+			orgId,
+			factoryProjectId: projectId
+		});
+		const resolved = this.#resolveItem(items, repositoryId, repositoryFullName, issueNumber, pullRequestNumber, pullRequestHeadBranch, provenance);
+		if (preferAuthoringItem && resolved?.externalSource?.type === "pull-request" && resolved.parentWorkItemId) return items.find((item) => item.id === resolved.parentWorkItemId) ?? resolved;
+		return resolved;
+	}
+	#resolveItem(items, repositoryId, repositoryFullName, issueNumber, pullRequestNumber, pullRequestHeadBranch, provenance) {
+		if (provenance) return items.find((item) => item.id === provenance.workItemId);
+		if (issueNumber) return items.find((item) => item.externalSource?.externalId === canonicalSourceKey("issue", issueNumber) && cardBelongsToRepository(item, repositoryId, repositoryFullName)) ?? items.find((item) => item.externalSource?.externalId === legacySourceKey(repositoryId, "issue", issueNumber));
+		if (pullRequestNumber) return items.find((item) => item.externalSource?.externalId === canonicalSourceKey("pull-request", pullRequestNumber) && cardBelongsToRepository(item, repositoryId, repositoryFullName)) ?? items.find((item) => item.externalSource?.externalId === legacySourceKey(repositoryId, "pull-request", pullRequestNumber)) ?? (pullRequestHeadBranch ? items.find((item) => item.externalSource?.type !== "pull-request" && Object.values(item.sessions).some((session) => session.branch === pullRequestHeadBranch)) : void 0);
+	}
+};
+const RECONCILE_ERROR_SAMPLE_LIMIT = 5;
+function sameStrings(left, right) {
+	if (right === void 0) return true;
+	if (!Array.isArray(left)) return false;
+	const leftValues = new Set(left.flatMap((value) => typeof value === "string" ? [value] : []));
+	const rightValues = new Set(right);
+	return leftValues.size === rightValues.size && [...leftValues].every((value) => rightValues.has(value));
+}
+/**
+* Extracts the PR number a work item tracks, but only when the item belongs
+* to the given repository. Card URLs pin the repository unambiguously; the
+* legacy source key embeds the repository id. Canonical keys (`github-pr:N`)
+* carry no repository, so they are only trusted when the item has no URL —
+* a project mapped to multiple repositories must not reconcile one repo's
+* card against another repo's PR number.
+*/
+function reconcilablePullRequestNumber(item, repository) {
+	if (item.externalSource?.type !== "pull-request") return void 0;
+	const url = item.externalSource.url;
+	if (url) {
+		const match = /^https?:\/\/[^/]+\/(.+)\/pull\/(\d+)(?:[/?#]|$)/.exec(url);
+		if (!match) return void 0;
+		return match[1] === repository.fullName ? Number(match[2]) : void 0;
+	}
+	const externalId = item.externalSource.externalId;
+	const legacy = /^github:(\d+):pull-request:(\d+)$/.exec(externalId);
+	if (legacy) return Number(legacy[1]) === repository.id ? Number(legacy[2]) : void 0;
+	const canonical = /^github-pr:(\d+)$/.exec(externalId);
+	return canonical ? Number(canonical[1]) : void 0;
+}
+/**
+* Extracts the issue number a work item tracks, but only when the item
+* belongs to the given repository. Stricter than
+* {@link reconcilablePullRequestNumber}: a canonical key with no URL is only
+* trusted when the intake-stamped `githubRepositoryId` confirms the
+* repository, because the sweep initiates closes on its own.
+*/
+function reconcilableIssueNumber(item, repository) {
+	if (item.externalSource?.type !== "issue") return void 0;
+	const url = item.externalSource.url;
+	if (url) {
+		const match = /^https?:\/\/[^/]+\/(.+)\/issues\/(\d+)(?:[/?#]|$)/.exec(url);
+		if (!match) return void 0;
+		return match[1] === repository.fullName || item.metadata?.githubRepositoryId === repository.id ? Number(match[2]) : void 0;
+	}
+	const externalId = item.externalSource.externalId;
+	const legacy = /^github:(\d+):issue:(\d+)$/.exec(externalId);
+	if (legacy) return Number(legacy[1]) === repository.id ? Number(legacy[2]) : void 0;
+	const canonical = /^github-issue:(\d+)$/.exec(externalId);
+	if (!canonical) return void 0;
+	return item.metadata?.githubRepositoryId === repository.id ? Number(canonical[1]) : void 0;
+}
+function reconciledIssueClosedEvent(repository, issueNumber, state) {
+	return {
+		event: "issues",
+		deliveryId: `reconcile:${repository.id}:issue:${issueNumber}:closed`,
+		payload: {
+			action: "closed",
+			installation: { id: repository.installationId },
+			repository: {
+				id: repository.id,
+				full_name: repository.fullName
+			},
+			sender: { login: state.author ?? "github" },
+			issue: {
+				number: issueNumber,
+				title: state.title,
+				html_url: state.url,
+				state: "closed",
+				...state.stateReason ? { state_reason: state.stateReason } : {},
+				...state.createdAt ? { created_at: state.createdAt } : {},
+				...state.updatedAt ? { updated_at: state.updatedAt } : {},
+				assignees: githubUsers(state.assignees)
+			}
+		}
+	};
+}
+/**
+* The label-drift replay: an open issue whose labels changed without a
+* `labeled`/`unlabeled` webhook ever arriving (Factory was down, the delivery
+* was lost, or the label was applied by something other than a delivery the
+* webhook saw). Synthesized as an `opened` delivery so the deployment's
+* `issueOpened` rule decides placement, exactly as it does at arrival — one
+* source of placement policy for both.
+*/
+function reconciledIssueRelabeledEvent(repository, issueNumber, state) {
+	const labels = state.labels ?? [];
+	const digest = createHash("sha256").update([...labels].sort().join("\n")).digest("hex").slice(0, 16);
+	const version = state.updatedAt ? `:${createHash("sha256").update(state.updatedAt).digest("hex").slice(0, 16)}` : "";
+	return {
+		event: "issues",
+		deliveryId: `reconcile:${repository.id}:issue:${issueNumber}:relabeled:${digest}${version}`,
+		payload: {
+			action: "opened",
+			installation: { id: repository.installationId },
+			repository: {
+				id: repository.id,
+				full_name: repository.fullName
+			},
+			sender: { login: state.author ?? "github" },
+			issue: {
+				number: issueNumber,
+				title: state.title,
+				html_url: state.url,
+				state: "open",
+				...state.createdAt ? { created_at: state.createdAt } : {},
+				...state.updatedAt ? { updated_at: state.updatedAt } : {},
+				assignees: githubUsers(state.assignees),
+				labels: githubLabels(labels)
+			}
+		}
+	};
+}
+/**
+* The missed-open replay: an open issue with no Work card, because its
+* `opened` delivery never reached the rules ingress. Synthesized as the same
+* `opened` delivery so the deployment's `issueOpened` rule decides whether and
+* where it lands, exactly as it would have at arrival. The delivery id is
+* stable per issue so repeat sweeps dedupe at the ingress.
+*/
+function reconciledIssueOpenedEvent(repository, issueNumber, state) {
+	return {
+		...reconciledIssueRelabeledEvent(repository, issueNumber, state),
+		deliveryId: `reconcile:${repository.id}:issue:${issueNumber}:opened`
+	};
+}
+function polledPullRequestEvent(repository, pullRequestNumber, state) {
+	return {
+		event: "pull_request",
+		deliveryId: `poll:${repository.id}:pull-request:${pullRequestNumber}:${state.createdAt}`,
+		payload: {
+			action: "opened",
+			installation: { id: repository.installationId },
+			repository: {
+				id: repository.id,
+				full_name: repository.fullName
+			},
+			sender: { login: state.author ?? "__unknown__" },
+			pull_request: pullRequestPayload(pullRequestNumber, state)
+		}
+	};
+}
+function reconciledClosedEvent(repository, pullRequestNumber, state) {
+	const outcome = state.merged ? "merged" : "closed";
+	return {
+		event: "pull_request",
+		deliveryId: `reconcile:${repository.id}:pull-request:${pullRequestNumber}:${outcome}`,
+		payload: {
+			action: "closed",
+			installation: { id: repository.installationId },
+			repository: {
+				id: repository.id,
+				full_name: repository.fullName
+			},
+			sender: { login: state.mergedBy ?? "github" },
+			pull_request: pullRequestPayload(pullRequestNumber, {
+				...state,
+				state: "closed"
+			})
+		}
+	};
+}
+function pullRequestPayload(pullRequestNumber, state) {
+	const payload = {
+		number: pullRequestNumber,
+		title: state.title,
+		html_url: state.url,
+		state: state.state,
+		draft: state.draft,
+		merged: state.merged,
+		assignees: githubUsers(state.assignees),
+		requested_reviewers: githubUsers(state.requestedReviewers),
+		labels: githubLabels(state.labels),
+		head: { ref: state.headBranch },
+		base: { ref: state.baseBranch }
+	};
+	if (state.createdAt) payload.created_at = state.createdAt;
+	if (state.author) payload.user = { login: state.author };
+	return payload;
+}
+function githubUsers(logins = []) {
+	return logins.map((login) => ({ login }));
+}
+function githubLabels(names = []) {
+	return names.map((name) => ({ name }));
+}
+function reconciledPullRequestMetadata(state, reconciliation, authorTrusted) {
+	return {
+		state: state.state,
+		draft: state.draft,
+		merged: state.merged,
+		...state.author ? { author: state.author } : {},
+		...state.assignees ? { assignees: state.assignees } : {},
+		...state.requestedReviewers ? { requestedReviewers: state.requestedReviewers } : {},
+		...state.labels ? { labels: state.labels } : {},
+		...authorTrusted === void 0 ? {} : { authorTrusted },
+		[FACTORY_PULL_REQUEST_RECONCILIATION_KEY]: reconciliation === "settled" ? state.merged ? "merged" : "closed" : null
+	};
+}
+function reconciledPullRequestOutcome(metadata) {
+	if (metadata.state !== "closed" || typeof metadata.merged !== "boolean") return void 0;
+	return metadata.merged ? "merged" : "closed";
+}
+/**
+* The webhook handler retires subscriptions itself; the sweep replays only the
+* rules ingress, so without this the thread's PR chip and the workspace row
+* stay `open` forever on a deployment GitHub cannot reach.
+*/
+async function retireReconciledSubscriptions(storage, repository, pullRequestNumber, merged) {
+	const target = changeRequestTargetKey({
+		installationExternalId: String(repository.installationId),
+		repositoryExternalId: String(repository.id),
+		changeRequestId: String(pullRequestNumber)
+	});
+	const rows = await storage.subscriptions.listByTarget(target);
+	await Promise.all(rows.filter((row) => row.status === "open").map((row) => storage.subscriptions.updateStatus(row.id, merged ? "merged" : "closed")));
+}
+/**
+* State-based safety net for merge signals: webhooks and event-log tailing
+* can miss a merge (cursor gaps, downtime, terminally failed decisions), so
+* this sweep compares still-open PR cards against actual GitHub state and
+* replays the merge through the normal rules ingress when they disagree.
+*/
+function createGithubPullRequestReconciler(options, fetchPullRequest) {
+	const rules = new GithubRules(options);
+	return async (repositories) => {
+		const summary = {
+			repositories: 0,
+			checked: 0,
+			merged: 0,
+			closed: 0,
+			failed: 0,
+			errors: []
+		};
+		const recordFailure = (repository, error, pullRequestNumber) => {
+			summary.failed += 1;
+			if (summary.errors.length < 5) summary.errors.push({
+				repository: repository.fullName,
+				...pullRequestNumber === void 0 ? {} : { pullRequestNumber },
+				error: error instanceof Error ? error.message : String(error)
+			});
+		};
+		const configured = new Set((await options.sourceControl.projectRepositories.listConfiguredExternalKeys()).map((key) => `${key.installationExternalId}\u0000${key.repositoryExternalId}`));
+		const scoped = repositories.filter((repository) => configured.has(`${repository.installationId}\u0000${repository.id}`));
+		summary.repositories = scoped.length;
+		for (const repository of scoped) {
+			let cardsByNumber;
+			let unanswered;
+			try {
+				const projects = await options.sourceControl.projectRepositories.listByExternalRepository({
+					installationExternalId: String(repository.installationId),
+					repositoryExternalId: String(repository.id)
+				});
+				if (projects.length === 0) continue;
+				cardsByNumber = /* @__PURE__ */ new Map();
+				unanswered = [];
+				for (const project of projects) {
+					const items = await options.storage.list({
+						orgId: project.orgId,
+						factoryProjectId: project.factoryProjectId
+					});
+					for (const item of items) {
+						const unansweredAuthor = authorAwaitingTrust(item, repository);
+						if (unansweredAuthor) unanswered.push({
+							item,
+							author: unansweredAuthor
+						});
+						const pullRequestNumber = reconcilablePullRequestNumber(item, repository);
+						if (!pullRequestNumber) continue;
+						const metadata = item.metadata ?? {};
+						const reconciliation = metadata[FACTORY_PULL_REQUEST_RECONCILIATION_KEY];
+						const reconciledOutcome = reconciledPullRequestOutcome(metadata);
+						if (workItemPhaseSemantics(options.boards, item)?.kind === "terminal" && reconciledOutcome !== void 0 && reconciliation === reconciledOutcome) continue;
+						const cards = cardsByNumber.get(pullRequestNumber) ?? [];
+						cards.push(item);
+						cardsByNumber.set(pullRequestNumber, cards);
+					}
+				}
+			} catch (error) {
+				recordFailure(repository, error);
+				continue;
+			}
+			const authorTrust = sweepTrustLookup(options.github, repository);
+			for (const { item, author } of unanswered) try {
+				await options.storage.update({
+					orgId: item.orgId,
+					id: item.id,
+					userId: "factory-rule-dispatcher",
+					patch: { metadata: { authorTrusted: await authorTrust(author) } }
+				});
+			} catch (error) {
+				recordFailure(repository, error);
+			}
+			for (const [pullRequestNumber, cards] of cardsByNumber) try {
+				const state = await fetchPullRequest({
+					installationId: repository.installationId,
+					repository: repository.fullName,
+					number: pullRequestNumber
+				});
+				summary.checked += 1;
+				if (!state) continue;
+				let authorTrusted;
+				if (state.author !== void 0) try {
+					authorTrusted = await authorTrust(state.author);
+				} catch (error) {
+					recordFailure(repository, error, pullRequestNumber);
+				}
+				for (const card of cards) {
+					if (state.state === "closed") continue;
+					const metadata = card.metadata ?? {};
+					const statusChanged = metadata.state !== state.state || metadata.draft !== state.draft || metadata.merged !== state.merged;
+					const authorChanged = state.author !== void 0 && metadata.author !== state.author;
+					const assigneesChanged = !sameStrings(metadata.assignees, state.assignees);
+					const reviewersChanged = !sameStrings(metadata.requestedReviewers, state.requestedReviewers);
+					const labelsChanged = !sameStrings(metadata.labels, state.labels);
+					const trustStale = authorTrusted !== void 0 && metadata.authorTrusted !== authorTrusted;
+					const metadataChanged = statusChanged || authorChanged || assigneesChanged || reviewersChanged || labelsChanged || trustStale;
+					const reconciliation = metadata[FACTORY_PULL_REQUEST_RECONCILIATION_KEY];
+					if (!metadataChanged && reconciliation !== "merged" && reconciliation !== "closed") continue;
+					try {
+						await options.storage.update({
+							orgId: card.orgId,
+							id: card.id,
+							userId: "factory-rule-dispatcher",
+							patch: { metadata: reconciledPullRequestMetadata(state, "clear", trustStale ? authorTrusted : void 0) }
+						});
+					} catch (error) {
+						recordFailure(repository, error, pullRequestNumber);
+					}
+				}
+				if (state.state !== "closed") continue;
+				const cleanupFailures = /* @__PURE__ */ new Set();
+				for (const card of cards) {
+					if (workItemPhaseSemantics(options.boards, card)?.kind !== "terminal") continue;
+					try {
+						await options.storage.supersedeDecisionsForWorkItem({
+							orgId: card.orgId,
+							factoryProjectId: card.factoryProjectId,
+							workItemId: card.id,
+							supersededAt: /* @__PURE__ */ new Date()
+						});
+					} catch (error) {
+						recordFailure(repository, error, pullRequestNumber);
+						cleanupFailures.add(card.id);
+					}
+				}
+				await rules.ingest(reconciledClosedEvent(repository, pullRequestNumber, state));
+				await retireReconciledSubscriptions(options.integrationStorage, repository, pullRequestNumber, state.merged);
+				for (const card of cards) {
+					if (cleanupFailures.has(card.id)) continue;
+					const trustStale = authorTrusted !== void 0 && (card.metadata ?? {}).authorTrusted !== authorTrusted;
+					try {
+						await options.storage.update({
+							orgId: card.orgId,
+							id: card.id,
+							userId: "factory-rule-dispatcher",
+							patch: { metadata: reconciledPullRequestMetadata(state, "settled", trustStale ? authorTrusted : void 0) }
+						});
+					} catch (error) {
+						recordFailure(repository, error, pullRequestNumber);
+					}
+				}
+				if (state.merged) summary.merged += 1;
+				else summary.closed += 1;
+			} catch (error) {
+				recordFailure(repository, error, pullRequestNumber);
+			}
+		}
+		return summary;
+	};
+}
+function githubRulesOptions(github, context) {
+	if (!context.runtime) return void 0;
+	return {
+		github,
+		sourceControl: context.storage.sourceControl,
+		integrationStorage: context.storage.generic,
+		projects: context.storage.projects,
+		storage: context.runtime.workItems,
+		configVersion: context.runtime.configVersion,
+		boards: context.runtime.boards,
+		intake: context.storage.intake,
+		...context.hooks?.onRepositoryPush ? { onRepositoryPush: context.hooks.onRepositoryPush } : {}
+	};
+}
+function attachGithubRules(github, context) {
+	const options = githubRulesOptions(github, context);
+	if (!options) return void 0;
+	const rules = new GithubRules(options);
+	return (event) => rules.ingest(event);
+}
+function attachGithubReconciler(github, context, fetchPullRequest) {
+	const options = githubRulesOptions(github, context);
+	if (!options) return void 0;
+	return createGithubPullRequestReconciler(options, fetchPullRequest);
+}
+//#endregion
+export { GithubRules, RECONCILE_ERROR_SAMPLE_LIMIT, attachGithubReconciler, attachGithubRules, cardBelongsToRepository, createGithubPullRequestReconciler, githubRulesOptions, isFactoryGithubLogin, polledPullRequestEvent, reconcilableIssueNumber, reconciledClosedEvent, reconciledIssueClosedEvent, reconciledIssueOpenedEvent, reconciledIssueRelabeledEvent, sameStrings, sweepTrustLookup, trustedCollaborator };
+
+//# sourceMappingURL=rules.js.map