@mastra/factory 0.0.0-esbuild-bundle-worker-20260807173433

package/dist/integrations/github/webhook.d.ts

@@ -0,0 +1,107 @@
+import type { MountedMastraCode } from '@mastra/code-sdk';
+import type { NotificationPriority } from '@mastra/core/notifications';
+import type { Context } from 'hono';
+import type { GithubIntegration, GithubRepositoryPermission } from './integration.js';
+import type { GithubIssueTriageInput, GithubIssueTriageResult } from './issue-triage.js';
+import type { GithubSignalSubscriptionRow, GithubSubscriptionStorage, GithubWebhookPullRequestTarget } from './subscriptions.js';
+export type GithubIssueTriageRunInput = GithubIssueTriageInput;
+export type GithubIssueTriageRunResult = GithubIssueTriageResult;
+export interface GithubWebhookHandlerOptions {
+    /** Integration providing webhook-secret verification + collaborator permission checks. */
+    github: GithubIntegration;
+    runIssueTriage?: (input: GithubIssueTriageRunInput) => Promise<GithubIssueTriageRunResult>;
+    ingestFactoryEvent?: (event: ParsedGithubWebhook) => Promise<unknown>;
+}
+export interface GithubWebhookMetadata {
+    event: string;
+    action?: string;
+    deliveryId: string;
+    repository?: string;
+    repositoryId?: number;
+    issueNumber?: number;
+    pullRequestNumber?: number;
+    sender?: string;
+    senderType?: string;
+    installationId?: number;
+}
+export interface ParsedGithubWebhook {
+    event: string;
+    deliveryId: string;
+    payload: Record<string, unknown>;
+}
+export type GithubWebhookResult = {
+    status: 202;
+    body: {
+        ok: true;
+        ignored?: true;
+    };
+} | {
+    status: 400;
+    body: {
+        error: 'bad_request';
+        message: string;
+    };
+} | {
+    status: 401;
+    body: {
+        error: 'unauthorized';
+        message: string;
+    };
+};
+export interface GithubWebhookNotification {
+    action: string;
+    kind: string;
+    priority: NotificationPriority;
+    summary: string;
+    terminal: boolean;
+    metadata: GithubWebhookMetadata & {
+        pullRequestNumber: number;
+        repositoryId: number;
+        installationId: number;
+    };
+    payload: Record<string, unknown>;
+}
+/** The Factory session row fields a woken session has to run as. */
+export type FactorySessionOwner = {
+    userId: string;
+    orgId: string;
+};
+/**
+ * The integration surface this dispatch uses. Narrow on purpose: the GitHub App
+ * integration and the platform-backed one are unrelated classes, and only this
+ * much is common to both.
+ */
+export interface GithubWebhookDispatchIntegration {
+    readonly integrationStorage: GithubSubscriptionStorage;
+    readonly sourceControlStorage: {
+        sessions: {
+            getBySessionId(sessionId: string): Promise<FactorySessionOwner | null>;
+        };
+    };
+    getRepositoryCollaboratorPermission(installationId: number, repoFullName: string, username: string, signal?: AbortSignal): Promise<GithubRepositoryPermission | undefined>;
+}
+export interface GithubWebhookDispatchDependencies {
+    controller: MountedMastraCode['controller'];
+    /**
+     * Integration used by the default sender-authorization check (collaborator
+     * permission lookup) and to resolve the owner of a session being recreated.
+     * Author-gated notifications fail closed when neither this nor an
+     * `isAuthorizedSender` override is supplied.
+     */
+    github?: GithubWebhookDispatchIntegration;
+    listSubscriptions?: (target: GithubWebhookPullRequestTarget, options?: {
+        includeTerminal?: boolean;
+    }) => Promise<GithubSignalSubscriptionRow[]>;
+    retireSubscription?: (id: string, status: 'open' | 'closed' | 'merged') => Promise<void>;
+    isAuthorizedSender?: (notification: GithubWebhookNotification) => Promise<boolean>;
+    onTargetError?: (subscription: GithubSignalSubscriptionRow, error: unknown) => void;
+}
+export declare function normalizeGithubWebhookMetadata(parsed: ParsedGithubWebhook): GithubWebhookMetadata;
+export declare function classifyGithubWebhook(parsed: ParsedGithubWebhook): GithubWebhookNotification | undefined;
+export declare function dispatchGithubWebhook(parsed: ParsedGithubWebhook, dependencies: GithubWebhookDispatchDependencies): Promise<{
+    delivered: number;
+    failed: number;
+    ignored: boolean;
+}>;
+export declare function handleGithubWebhook(c: Context, options: GithubWebhookHandlerOptions & Partial<Omit<GithubWebhookDispatchDependencies, 'github'>>): Promise<GithubWebhookResult>;
+//# sourceMappingURL=webhook.d.ts.map

package/dist/integrations/github/webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/webhook.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,KAAK,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAEzF,OAAO,KAAK,EACV,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC/B,MAAM,oBAAoB,CAAC;AAE5B,MAAM,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAC/D,MAAM,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AAEjE,MAAM,WAAW,2BAA2B;IAC1C,0FAA0F;IAC1F,MAAM,EAAE,iBAAiB,CAAC;IAC1B,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,yBAAyB,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC3F,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACvE;AAUD,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,IAAI,CAAA;KAAE,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,aAAa,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAChE;IAAE,MAAM,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,cAAc,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEtE,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,qBAAqB,GAAG;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9G,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,oEAAoE;AACpE,MAAM,MAAM,mBAAmB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpE;;;;GAIG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,kBAAkB,EAAE,yBAAyB,CAAC;IACvD,QAAQ,CAAC,oBAAoB,EAAE;QAC7B,QAAQ,EAAE;YAAE,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAA;SAAE,CAAC;KACtF,CAAC;IACF,mCAAmC,CACjC,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,iCAAiC;IAChD,UAAU,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,MAAM,CAAC,EAAE,gCAAgC,CAAC;IAC1C,iBAAiB,CAAC,EAAE,CAClB,MAAM,EAAE,8BAA8B,EACtC,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,KACpC,OAAO,CAAC,2BAA2B,EAAE,CAAC,CAAC;IAC5C,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,kBAAkB,CAAC,EAAE,CAAC,YAAY,EAAE,yBAAyB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF,aAAa,CAAC,EAAE,CAAC,YAAY,EAAE,2BAA2B,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACrF;AAuED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,mBAAmB,GAAG,qBAAqB,CAuBjG;AAiBD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,mBAAmB,GAAG,yBAAyB,GAAG,SAAS,CAgGxG;AA+FD,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,mBAAmB,EAC3B,YAAY,EAAE,iCAAiC,GAC9C,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAuElE;AAED,wBAAsB,mBAAmB,CACvC,CAAC,EAAE,OAAO,EACV,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,iCAAiC,EAAE,QAAQ,CAAC,CAAC,GAChG,OAAO,CAAC,mBAAmB,CAAC,CAwB9B"}

package/dist/integrations/github/webhook.js

@@ -0,0 +1,371 @@
+import { listPullRequestSubscriptionsForWebhook, retirePullRequestSubscription } from "./subscriptions.js";
+import { createHmac, timingSafeEqual } from "crypto";
+import { RequestContext } from "@mastra/core/request-context";
+//#region src/integrations/github/webhook.ts
+const SUPPORTED_GITHUB_WEBHOOK_EVENTS = /* @__PURE__ */ new Set([
+	"issues",
+	"issue_comment",
+	"pull_request",
+	"pull_request_review",
+	"pull_request_review_comment"
+]);
+function normalizeHeader(value) {
+	if (!value) return null;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : null;
+}
+function verifySignature(rawBody, signature, secret) {
+	if (!signature.startsWith("sha256=")) return false;
+	const signatureHex = signature.slice(7);
+	if (!/^[a-fA-F0-9]{64}$/.test(signatureHex)) return false;
+	const expectedHex = createHmac("sha256", secret).update(rawBody).digest("hex");
+	const received = Buffer.from(signatureHex, "hex");
+	const expected = Buffer.from(expectedHex, "hex");
+	return received.length === expected.length && timingSafeEqual(received, expected);
+}
+async function parseGithubWebhook(c, secret) {
+	if (!secret) return {
+		status: 401,
+		body: {
+			error: "unauthorized",
+			message: "GitHub webhook secret is not configured"
+		}
+	};
+	const event = normalizeHeader(c.req.header("x-github-event"));
+	const deliveryId = normalizeHeader(c.req.header("x-github-delivery"));
+	const signature = normalizeHeader(c.req.header("x-hub-signature-256"));
+	if (!event) return {
+		status: 400,
+		body: {
+			error: "bad_request",
+			message: "Missing x-github-event header"
+		}
+	};
+	if (!deliveryId) return {
+		status: 400,
+		body: {
+			error: "bad_request",
+			message: "Missing x-github-delivery header"
+		}
+	};
+	if (!signature) return {
+		status: 401,
+		body: {
+			error: "unauthorized",
+			message: "Missing x-hub-signature-256 header"
+		}
+	};
+	const rawBody = await c.req.text();
+	if (!verifySignature(rawBody, signature, secret)) return {
+		status: 401,
+		body: {
+			error: "unauthorized",
+			message: "Invalid GitHub webhook signature"
+		}
+	};
+	let payload;
+	try {
+		payload = JSON.parse(rawBody);
+	} catch {
+		return {
+			status: 400,
+			body: {
+				error: "bad_request",
+				message: "Malformed JSON payload"
+			}
+		};
+	}
+	if (!payload || typeof payload !== "object" || Array.isArray(payload)) return {
+		status: 400,
+		body: {
+			error: "bad_request",
+			message: "Payload must be a JSON object"
+		}
+	};
+	return {
+		event,
+		deliveryId,
+		payload
+	};
+}
+function getObject(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function getString(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function getNumber(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function getBoolean(value) {
+	return typeof value === "boolean" ? value : void 0;
+}
+function normalizeGithubWebhookMetadata(parsed) {
+	const { event, deliveryId, payload } = parsed;
+	const repository = getObject(payload.repository);
+	const issue = getObject(payload.issue);
+	const pullRequest = getObject(payload.pull_request);
+	const sender = getObject(payload.sender);
+	const installation = getObject(payload.installation);
+	const issuePullRequest = getObject(issue?.pull_request);
+	return {
+		event,
+		action: getString(payload.action),
+		deliveryId,
+		repository: getString(repository?.full_name),
+		repositoryId: getNumber(repository?.id),
+		issueNumber: getNumber(issue?.number),
+		pullRequestNumber: getNumber(pullRequest?.number) ?? (event === "issue_comment" && issuePullRequest ? getNumber(issue?.number) : void 0),
+		sender: getString(sender?.login),
+		senderType: getString(sender?.type),
+		installationId: getNumber(installation?.id)
+	};
+}
+function notificationSummary(metadata, label) {
+	return `${metadata.sender ? `${metadata.sender} ` : ""}${label} on ${metadata.repository}#${metadata.pullRequestNumber}`;
+}
+function notificationTargetUrl(event, payload) {
+	if (event === "issue_comment" || event === "pull_request_review_comment") return getString(getObject(payload.comment)?.html_url);
+	if (event === "pull_request_review") return getString(getObject(payload.review)?.html_url);
+	return getString(getObject(payload.pull_request)?.html_url);
+}
+function classifyGithubWebhook(parsed) {
+	const metadata = normalizeGithubWebhookMetadata(parsed);
+	const { event, payload } = parsed;
+	const action = metadata.action;
+	if (!action || !metadata.repositoryId || !metadata.installationId || !metadata.pullRequestNumber || !metadata.repository) return;
+	let priority;
+	let kind;
+	let label;
+	let terminal = false;
+	if (event === "pull_request_review" && action === "submitted") {
+		const state = getString(getObject(payload.review)?.state)?.toLowerCase().replaceAll("_", "-");
+		priority = state === "approved" || state === "changes-requested" ? "urgent" : "high";
+		kind = state === "approved" ? "review-approved" : state === "changes-requested" ? "review-changes-requested" : "review-submitted";
+		label = state === "approved" ? "approved the pull request" : state === "changes-requested" ? "requested changes" : "submitted a review";
+	} else if (event === "pull_request" && action === "closed") {
+		const merged = getBoolean(getObject(payload.pull_request)?.merged) === true;
+		priority = "urgent";
+		kind = merged ? "pull-request-merged" : "pull-request-closed";
+		label = merged ? "merged the pull request" : "closed the pull request";
+		terminal = true;
+	} else if (event === "issue_comment" && action === "created") {
+		priority = "high";
+		kind = "issue-comment-created";
+		label = "commented";
+	} else if (event === "pull_request_review_comment" && action === "created") {
+		priority = "high";
+		kind = "review-comment-created";
+		label = "left a review comment";
+	} else if (event === "pull_request" && action === "reopened") {
+		priority = "high";
+		kind = "pull-request-reopened";
+		label = "reopened the pull request";
+	} else if (event === "pull_request_review" && action === "dismissed") {
+		priority = "high";
+		kind = "review-dismissed";
+		label = "dismissed a review";
+	} else if (event === "pull_request" && [
+		"synchronize",
+		"ready_for_review",
+		"converted_to_draft",
+		"assigned",
+		"unassigned",
+		"review_requested",
+		"review_request_removed"
+	].includes(action)) {
+		priority = "medium";
+		kind = `pull-request-${action.replaceAll("_", "-")}`;
+		label = action.replaceAll("_", " ");
+	} else if (event === "pull_request" && [
+		"edited",
+		"labeled",
+		"unlabeled",
+		"milestoned",
+		"demilestoned"
+	].includes(action)) {
+		priority = "low";
+		kind = `pull-request-${action.replaceAll("_", "-")}`;
+		label = action.replaceAll("_", " ");
+	} else return;
+	return {
+		action,
+		kind,
+		priority,
+		summary: notificationSummary(metadata, label),
+		terminal,
+		metadata: {
+			...metadata,
+			pullRequestNumber: metadata.pullRequestNumber,
+			repositoryId: metadata.repositoryId,
+			installationId: metadata.installationId
+		},
+		payload
+	};
+}
+async function resolveSubscriptionSession(controller, subscription, github) {
+	const { sessionId, resourceId, threadId } = subscription;
+	if (!sessionId || !resourceId || !threadId) throw new Error(`GitHub subscription ${subscription.id} is missing its session binding.`);
+	const scope = subscription.sessionScope || void 0;
+	let session = await controller.getSessionByResource(resourceId, scope);
+	if (!session) {
+		const tags = {
+			factoryProjectId: resourceId,
+			projectRepositoryId: subscription.data.projectRepositoryId,
+			...scope ? { worktreePath: scope } : {}
+		};
+		const sessionRow = await github?.sourceControlStorage.sessions.getBySessionId(resourceId);
+		if (!sessionRow) throw new Error(`GitHub subscription ${subscription.id} has no Factory session ${resourceId} to run as.`);
+		const requestContext = new RequestContext();
+		requestContext.set("user", {
+			workosId: sessionRow.userId,
+			organizationId: sessionRow.orgId
+		});
+		session = await controller.createSession({
+			id: sessionId,
+			ownerId: sessionRow.userId,
+			resourceId,
+			scope,
+			tags,
+			requestContext
+		});
+	}
+	if (session.thread.getId() !== threadId) await session.thread.switch({
+		threadId,
+		emitEvent: false
+	});
+	if (session.thread.getId() !== threadId) throw new Error(`Session ${sessionId} did not bind thread ${threadId}.`);
+	return session;
+}
+const AUTHORIZED_BOTS = /* @__PURE__ */ new Set(["coderabbitai[bot]", "devin-ai-integration[bot]"]);
+const AUTHORIZED_PERMISSIONS = /* @__PURE__ */ new Set([
+	"admin",
+	"maintain",
+	"write"
+]);
+const PERMISSION_CHECK_TIMEOUT_MS = 5e3;
+const AUTHOR_GATED_KINDS = /* @__PURE__ */ new Set([
+	"issue-comment-created",
+	"review-comment-created",
+	"review-submitted",
+	"review-approved",
+	"review-changes-requested",
+	"review-dismissed"
+]);
+async function isAuthorizedGithubSender(notification, github) {
+	if (!AUTHOR_GATED_KINDS.has(notification.kind)) return true;
+	const sender = notification.metadata.sender;
+	const repository = notification.metadata.repository;
+	if (!sender || !repository) return false;
+	const normalizedSender = sender.toLowerCase();
+	if (notification.metadata.senderType?.toLowerCase() === "bot" || normalizedSender.endsWith("[bot]")) return AUTHORIZED_BOTS.has(normalizedSender);
+	if (!github) return false;
+	const abortController = new AbortController();
+	let timeout;
+	try {
+		const permission = await Promise.race([github.getRepositoryCollaboratorPermission(notification.metadata.installationId, repository, sender, abortController.signal), new Promise((resolve) => {
+			timeout = setTimeout(() => {
+				abortController.abort();
+				resolve(void 0);
+			}, PERMISSION_CHECK_TIMEOUT_MS);
+		})]);
+		return permission !== void 0 && AUTHORIZED_PERMISSIONS.has(permission);
+	} catch {
+		return false;
+	} finally {
+		if (timeout) clearTimeout(timeout);
+	}
+}
+async function dispatchGithubWebhook(parsed, dependencies) {
+	const notification = classifyGithubWebhook(parsed);
+	if (!notification) return {
+		delivered: 0,
+		failed: 0,
+		ignored: true
+	};
+	if (!await (dependencies.isAuthorizedSender ?? ((n) => isAuthorizedGithubSender(n, dependencies.github)))(notification)) return {
+		delivered: 0,
+		failed: 0,
+		ignored: true
+	};
+	const target = {
+		installationExternalId: notification.metadata.installationId.toString(),
+		repositoryExternalId: notification.metadata.repositoryId.toString(),
+		changeRequestId: notification.metadata.pullRequestNumber.toString()
+	};
+	const listSubscriptions = dependencies.listSubscriptions ?? ((subscriptionTarget, options) => {
+		if (!dependencies.github) throw new Error("GitHub integration is required to load webhook subscriptions.");
+		return listPullRequestSubscriptionsForWebhook(subscriptionTarget, options, dependencies.github.integrationStorage);
+	});
+	const retireSubscription = dependencies.retireSubscription ?? ((id, status) => {
+		if (!dependencies.github) throw new Error("GitHub integration is required to retire webhook subscriptions.");
+		return retirePullRequestSubscription(id, status, dependencies.github.integrationStorage);
+	});
+	const subscriptions = await listSubscriptions(target, { includeTerminal: notification.action === "reopened" });
+	let delivered = 0;
+	let failed = 0;
+	for (const subscription of subscriptions) try {
+		const result = await (await resolveSubscriptionSession(dependencies.controller, subscription, dependencies.github)).sendNotificationSignal({
+			source: "github",
+			kind: notification.kind,
+			summary: notification.summary,
+			priority: notification.priority,
+			payload: notification.payload,
+			sourceId: parsed.deliveryId,
+			dedupeKey: `${parsed.deliveryId}:${subscription.sessionId}:${subscription.threadId}`,
+			coalesceKey: `github:${subscription.data.repositoryExternalId}:pull-request:${subscription.data.changeRequestId}`,
+			metadata: {
+				event: notification.metadata.event,
+				action: notification.action,
+				repository: notification.metadata.repository,
+				issueNumber: notification.metadata.issueNumber,
+				pullRequestNumber: notification.metadata.pullRequestNumber,
+				targetUrl: notificationTargetUrl(parsed.event, parsed.payload),
+				deliveryId: parsed.deliveryId
+			}
+		});
+		await Promise.all([result.persisted, result.accepted].filter(Boolean));
+		if (notification.terminal) await retireSubscription(subscription.id, notification.kind === "pull-request-merged" ? "merged" : "closed");
+		else if (notification.action === "reopened") await retireSubscription(subscription.id, "open");
+		delivered += 1;
+	} catch (error) {
+		failed += 1;
+		dependencies.onTargetError?.(subscription, error);
+	}
+	return {
+		delivered,
+		failed,
+		ignored: false
+	};
+}
+async function handleGithubWebhook(c, options) {
+	const parsed = await parseGithubWebhook(c, options.github.webhookSecret);
+	if ("status" in parsed) return parsed;
+	if (!SUPPORTED_GITHUB_WEBHOOK_EVENTS.has(parsed.event)) return {
+		status: 202,
+		body: {
+			ok: true,
+			ignored: true
+		}
+	};
+	const metadata = normalizeGithubWebhookMetadata(parsed);
+	console.info("[GitHub Webhook]", metadata);
+	if (options.ingestFactoryEvent) await options.ingestFactoryEvent(parsed);
+	if (!options.controller) return {
+		status: 202,
+		body: { ok: true }
+	};
+	const result = await dispatchGithubWebhook(parsed, options);
+	if (result.failed > 0) console.warn(`[GitHub Webhook] ${result.failed} subscribed target(s) failed for delivery ${parsed.deliveryId}.`);
+	return {
+		status: 202,
+		body: {
+			ok: true,
+			...result.ignored ? { ignored: true } : {}
+		}
+	};
+}
+//#endregion
+export { classifyGithubWebhook, dispatchGithubWebhook, handleGithubWebhook, normalizeGithubWebhookMetadata };
+
+//# sourceMappingURL=webhook.js.map

package/dist/integrations/github/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.js","names":[],"sources":["../../../src/integrations/github/webhook.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from 'node:crypto';\nimport type { MountedMastraCode } from '@mastra/code-sdk';\nimport type { NotificationPriority } from '@mastra/core/notifications';\nimport { RequestContext } from '@mastra/core/request-context';\nimport type { Context } from 'hono';\nimport type { GithubIntegration, GithubRepositoryPermission } from './integration.js';\nimport type { GithubIssueTriageInput, GithubIssueTriageResult } from './issue-triage.js';\nimport { listPullRequestSubscriptionsForWebhook, retirePullRequestSubscription } from './subscriptions.js';\nimport type {\n  GithubSignalSubscriptionRow,\n  GithubSubscriptionStorage,\n  GithubWebhookPullRequestTarget,\n} from './subscriptions.js';\n\nexport type GithubIssueTriageRunInput = GithubIssueTriageInput;\nexport type GithubIssueTriageRunResult = GithubIssueTriageResult;\n\nexport interface GithubWebhookHandlerOptions {\n  /** Integration providing webhook-secret verification + collaborator permission checks. */\n  github: GithubIntegration;\n  runIssueTriage?: (input: GithubIssueTriageRunInput) => Promise<GithubIssueTriageRunResult>;\n  ingestFactoryEvent?: (event: ParsedGithubWebhook) => Promise<unknown>;\n}\n\nconst SUPPORTED_GITHUB_WEBHOOK_EVENTS = new Set([\n  'issues',\n  'issue_comment',\n  'pull_request',\n  'pull_request_review',\n  'pull_request_review_comment',\n]);\n\nexport interface GithubWebhookMetadata {\n  event: string;\n  action?: string;\n  deliveryId: string;\n  repository?: string;\n  repositoryId?: number;\n  issueNumber?: number;\n  pullRequestNumber?: number;\n  sender?: string;\n  senderType?: string;\n  installationId?: number;\n}\n\nexport interface ParsedGithubWebhook {\n  event: string;\n  deliveryId: string;\n  payload: Record<string, unknown>;\n}\n\nexport type GithubWebhookResult =\n  | { status: 202; body: { ok: true; ignored?: true } }\n  | { status: 400; body: { error: 'bad_request'; message: string } }\n  | { status: 401; body: { error: 'unauthorized'; message: string } };\n\nexport interface GithubWebhookNotification {\n  action: string;\n  kind: string;\n  priority: NotificationPriority;\n  summary: string;\n  terminal: boolean;\n  metadata: GithubWebhookMetadata & { pullRequestNumber: number; repositoryId: number; installationId: number };\n  payload: Record<string, unknown>;\n}\n\n/** The Factory session row fields a woken session has to run as. */\nexport type FactorySessionOwner = { userId: string; orgId: string };\n\n/**\n * The integration surface this dispatch uses. Narrow on purpose: the GitHub App\n * integration and the platform-backed one are unrelated classes, and only this\n * much is common to both.\n */\nexport interface GithubWebhookDispatchIntegration {\n  readonly integrationStorage: GithubSubscriptionStorage;\n  readonly sourceControlStorage: {\n    sessions: { getBySessionId(sessionId: string): Promise<FactorySessionOwner | null> };\n  };\n  getRepositoryCollaboratorPermission(\n    installationId: number,\n    repoFullName: string,\n    username: string,\n    signal?: AbortSignal,\n  ): Promise<GithubRepositoryPermission | undefined>;\n}\n\nexport interface GithubWebhookDispatchDependencies {\n  controller: MountedMastraCode['controller'];\n  /**\n   * Integration used by the default sender-authorization check (collaborator\n   * permission lookup) and to resolve the owner of a session being recreated.\n   * Author-gated notifications fail closed when neither this nor an\n   * `isAuthorizedSender` override is supplied.\n   */\n  github?: GithubWebhookDispatchIntegration;\n  listSubscriptions?: (\n    target: GithubWebhookPullRequestTarget,\n    options?: { includeTerminal?: boolean },\n  ) => Promise<GithubSignalSubscriptionRow[]>;\n  retireSubscription?: (id: string, status: 'open' | 'closed' | 'merged') => Promise<void>;\n  isAuthorizedSender?: (notification: GithubWebhookNotification) => Promise<boolean>;\n  onTargetError?: (subscription: GithubSignalSubscriptionRow, error: unknown) => void;\n}\n\nfunction normalizeHeader(value: string | undefined | null): string | null {\n  if (!value) return null;\n  const trimmed = value.trim();\n  return trimmed.length > 0 ? trimmed : null;\n}\n\nfunction verifySignature(rawBody: string, signature: string, secret: string): boolean {\n  if (!signature.startsWith('sha256=')) return false;\n  const signatureHex = signature.slice('sha256='.length);\n  if (!/^[a-fA-F0-9]{64}$/.test(signatureHex)) return false;\n\n  const expectedHex = createHmac('sha256', secret).update(rawBody).digest('hex');\n  const received = Buffer.from(signatureHex, 'hex');\n  const expected = Buffer.from(expectedHex, 'hex');\n  return received.length === expected.length && timingSafeEqual(received, expected);\n}\n\nasync function parseGithubWebhook(\n  c: Context,\n  secret: string | undefined,\n): Promise<ParsedGithubWebhook | GithubWebhookResult> {\n  if (!secret) {\n    return { status: 401, body: { error: 'unauthorized', message: 'GitHub webhook secret is not configured' } };\n  }\n\n  const event = normalizeHeader(c.req.header('x-github-event'));\n  const deliveryId = normalizeHeader(c.req.header('x-github-delivery'));\n  const signature = normalizeHeader(c.req.header('x-hub-signature-256'));\n\n  if (!event) return { status: 400, body: { error: 'bad_request', message: 'Missing x-github-event header' } };\n  if (!deliveryId) return { status: 400, body: { error: 'bad_request', message: 'Missing x-github-delivery header' } };\n  if (!signature)\n    return { status: 401, body: { error: 'unauthorized', message: 'Missing x-hub-signature-256 header' } };\n\n  const rawBody = await c.req.text();\n  if (!verifySignature(rawBody, signature, secret)) {\n    return { status: 401, body: { error: 'unauthorized', message: 'Invalid GitHub webhook signature' } };\n  }\n\n  let payload: unknown;\n  try {\n    payload = JSON.parse(rawBody);\n  } catch {\n    return { status: 400, body: { error: 'bad_request', message: 'Malformed JSON payload' } };\n  }\n\n  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {\n    return { status: 400, body: { error: 'bad_request', message: 'Payload must be a JSON object' } };\n  }\n\n  return { event, deliveryId, payload: payload as Record<string, unknown> };\n}\n\nfunction getObject(value: unknown): Record<string, unknown> | undefined {\n  return value && typeof value === 'object' && !Array.isArray(value) ? (value as Record<string, unknown>) : undefined;\n}\n\nfunction getString(value: unknown): string | undefined {\n  return typeof value === 'string' && value.length > 0 ? value : undefined;\n}\n\nfunction getNumber(value: unknown): number | undefined {\n  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;\n}\n\nfunction getBoolean(value: unknown): boolean | undefined {\n  return typeof value === 'boolean' ? value : undefined;\n}\n\nexport function normalizeGithubWebhookMetadata(parsed: ParsedGithubWebhook): GithubWebhookMetadata {\n  const { event, deliveryId, payload } = parsed;\n  const repository = getObject(payload.repository);\n  const issue = getObject(payload.issue);\n  const pullRequest = getObject(payload.pull_request);\n  const sender = getObject(payload.sender);\n  const installation = getObject(payload.installation);\n  const issuePullRequest = getObject(issue?.pull_request);\n\n  return {\n    event,\n    action: getString(payload.action),\n    deliveryId,\n    repository: getString(repository?.full_name),\n    repositoryId: getNumber(repository?.id),\n    issueNumber: getNumber(issue?.number),\n    pullRequestNumber:\n      getNumber(pullRequest?.number) ??\n      (event === 'issue_comment' && issuePullRequest ? getNumber(issue?.number) : undefined),\n    sender: getString(sender?.login),\n    senderType: getString(sender?.type),\n    installationId: getNumber(installation?.id),\n  };\n}\n\nfunction notificationSummary(metadata: GithubWebhookMetadata, label: string): string {\n  const actor = metadata.sender ? `${metadata.sender} ` : '';\n  return `${actor}${label} on ${metadata.repository}#${metadata.pullRequestNumber}`;\n}\n\nfunction notificationTargetUrl(event: string, payload: Record<string, unknown>): string | undefined {\n  if (event === 'issue_comment' || event === 'pull_request_review_comment') {\n    return getString(getObject(payload.comment)?.html_url);\n  }\n  if (event === 'pull_request_review') {\n    return getString(getObject(payload.review)?.html_url);\n  }\n  return getString(getObject(payload.pull_request)?.html_url);\n}\n\nexport function classifyGithubWebhook(parsed: ParsedGithubWebhook): GithubWebhookNotification | undefined {\n  const metadata = normalizeGithubWebhookMetadata(parsed);\n  const { event, payload } = parsed;\n  const action = metadata.action;\n  if (\n    !action ||\n    !metadata.repositoryId ||\n    !metadata.installationId ||\n    !metadata.pullRequestNumber ||\n    !metadata.repository\n  ) {\n    return undefined;\n  }\n\n  let priority: NotificationPriority;\n  let kind: string;\n  let label: string;\n  let terminal = false;\n\n  if (event === 'pull_request_review' && action === 'submitted') {\n    const state = getString(getObject(payload.review)?.state)?.toLowerCase().replaceAll('_', '-');\n    priority = state === 'approved' || state === 'changes-requested' ? 'urgent' : 'high';\n    kind =\n      state === 'approved'\n        ? 'review-approved'\n        : state === 'changes-requested'\n          ? 'review-changes-requested'\n          : 'review-submitted';\n    label =\n      state === 'approved'\n        ? 'approved the pull request'\n        : state === 'changes-requested'\n          ? 'requested changes'\n          : 'submitted a review';\n  } else if (event === 'pull_request' && action === 'closed') {\n    const merged = getBoolean(getObject(payload.pull_request)?.merged) === true;\n    priority = 'urgent';\n    kind = merged ? 'pull-request-merged' : 'pull-request-closed';\n    label = merged ? 'merged the pull request' : 'closed the pull request';\n    terminal = true;\n  } else if (event === 'issue_comment' && action === 'created') {\n    priority = 'high';\n    kind = 'issue-comment-created';\n    label = 'commented';\n  } else if (event === 'pull_request_review_comment' && action === 'created') {\n    priority = 'high';\n    kind = 'review-comment-created';\n    label = 'left a review comment';\n  } else if (event === 'pull_request' && action === 'reopened') {\n    priority = 'high';\n    kind = 'pull-request-reopened';\n    label = 'reopened the pull request';\n  } else if (event === 'pull_request_review' && action === 'dismissed') {\n    priority = 'high';\n    kind = 'review-dismissed';\n    label = 'dismissed a review';\n  } else if (\n    event === 'pull_request' &&\n    [\n      'synchronize',\n      'ready_for_review',\n      'converted_to_draft',\n      'assigned',\n      'unassigned',\n      'review_requested',\n      'review_request_removed',\n    ].includes(action)\n  ) {\n    priority = 'medium';\n    kind = `pull-request-${action.replaceAll('_', '-')}`;\n    label = action.replaceAll('_', ' ');\n  } else if (\n    event === 'pull_request' &&\n    ['edited', 'labeled', 'unlabeled', 'milestoned', 'demilestoned'].includes(action)\n  ) {\n    priority = 'low';\n    kind = `pull-request-${action.replaceAll('_', '-')}`;\n    label = action.replaceAll('_', ' ');\n  } else {\n    return undefined;\n  }\n\n  return {\n    action,\n    kind,\n    priority,\n    summary: notificationSummary(metadata, label),\n    terminal,\n    metadata: {\n      ...metadata,\n      pullRequestNumber: metadata.pullRequestNumber,\n      repositoryId: metadata.repositoryId,\n      installationId: metadata.installationId,\n    },\n    payload,\n  };\n}\n\nasync function resolveSubscriptionSession(\n  controller: MountedMastraCode['controller'],\n  subscription: GithubSignalSubscriptionRow,\n  github?: GithubWebhookDispatchIntegration,\n) {\n  const { sessionId, resourceId, threadId } = subscription;\n  if (!sessionId || !resourceId || !threadId) {\n    throw new Error(`GitHub subscription ${subscription.id} is missing its session binding.`);\n  }\n  const scope = subscription.sessionScope || undefined;\n  let session = await controller.getSessionByResource(resourceId, scope);\n  if (!session) {\n    const tags = {\n      factoryProjectId: resourceId,\n      projectRepositoryId: subscription.data.projectRepositoryId,\n      ...(scope ? { worktreePath: scope } : {}),\n    };\n    // Creating the session resolves its workspace, which authorizes the caller\n    // against the Factory session row — no signed-in user, so run as its owner.\n    const sessionRow = await github?.sourceControlStorage.sessions.getBySessionId(resourceId);\n    if (!sessionRow) {\n      throw new Error(`GitHub subscription ${subscription.id} has no Factory session ${resourceId} to run as.`);\n    }\n    const requestContext = new RequestContext();\n    requestContext.set('user', { workosId: sessionRow.userId, organizationId: sessionRow.orgId });\n    session = await controller.createSession({\n      id: sessionId,\n      ownerId: sessionRow.userId,\n      resourceId,\n      scope,\n      tags,\n      requestContext,\n    });\n  }\n  if (session.thread.getId() !== threadId) {\n    await session.thread.switch({ threadId, emitEvent: false });\n  }\n  if (session.thread.getId() !== threadId) {\n    throw new Error(`Session ${sessionId} did not bind thread ${threadId}.`);\n  }\n  return session;\n}\n\nconst AUTHORIZED_BOTS = new Set(['coderabbitai[bot]', 'devin-ai-integration[bot]']);\nconst AUTHORIZED_PERMISSIONS = new Set(['admin', 'maintain', 'write']);\nconst PERMISSION_CHECK_TIMEOUT_MS = 5_000;\nconst AUTHOR_GATED_KINDS = new Set([\n  'issue-comment-created',\n  'review-comment-created',\n  'review-submitted',\n  'review-approved',\n  'review-changes-requested',\n  'review-dismissed',\n]);\n\nasync function isAuthorizedGithubSender(\n  notification: GithubWebhookNotification,\n  github: Pick<GithubWebhookDispatchIntegration, 'getRepositoryCollaboratorPermission'> | undefined,\n): Promise<boolean> {\n  if (!AUTHOR_GATED_KINDS.has(notification.kind)) return true;\n  const sender = notification.metadata.sender;\n  const repository = notification.metadata.repository;\n  if (!sender || !repository) return false;\n  const normalizedSender = sender.toLowerCase();\n  if (notification.metadata.senderType?.toLowerCase() === 'bot' || normalizedSender.endsWith('[bot]')) {\n    return AUTHORIZED_BOTS.has(normalizedSender);\n  }\n  if (!github) return false;\n  const abortController = new AbortController();\n  let timeout: ReturnType<typeof setTimeout> | undefined;\n  try {\n    const permission = await Promise.race([\n      github.getRepositoryCollaboratorPermission(\n        notification.metadata.installationId,\n        repository,\n        sender,\n        abortController.signal,\n      ),\n      new Promise<undefined>(resolve => {\n        timeout = setTimeout(() => {\n          abortController.abort();\n          resolve(undefined);\n        }, PERMISSION_CHECK_TIMEOUT_MS);\n      }),\n    ]);\n    return permission !== undefined && AUTHORIZED_PERMISSIONS.has(permission);\n  } catch {\n    return false;\n  } finally {\n    if (timeout) clearTimeout(timeout);\n  }\n}\n\nexport async function dispatchGithubWebhook(\n  parsed: ParsedGithubWebhook,\n  dependencies: GithubWebhookDispatchDependencies,\n): Promise<{ delivered: number; failed: number; ignored: boolean }> {\n  const notification = classifyGithubWebhook(parsed);\n  if (!notification) return { delivered: 0, failed: 0, ignored: true };\n  const isAuthorizedSender =\n    dependencies.isAuthorizedSender ??\n    ((n: GithubWebhookNotification) => isAuthorizedGithubSender(n, dependencies.github));\n  if (!(await isAuthorizedSender(notification))) {\n    return { delivered: 0, failed: 0, ignored: true };\n  }\n\n  const target = {\n    installationExternalId: notification.metadata.installationId.toString(),\n    repositoryExternalId: notification.metadata.repositoryId.toString(),\n    changeRequestId: notification.metadata.pullRequestNumber.toString(),\n  };\n  const listSubscriptions =\n    dependencies.listSubscriptions ??\n    ((subscriptionTarget: GithubWebhookPullRequestTarget, options?: { includeTerminal?: boolean }) => {\n      if (!dependencies.github) throw new Error('GitHub integration is required to load webhook subscriptions.');\n      return listPullRequestSubscriptionsForWebhook(\n        subscriptionTarget,\n        options,\n        dependencies.github.integrationStorage,\n      );\n    });\n  const retireSubscription =\n    dependencies.retireSubscription ??\n    ((id: string, status: 'open' | 'closed' | 'merged') => {\n      if (!dependencies.github) throw new Error('GitHub integration is required to retire webhook subscriptions.');\n      return retirePullRequestSubscription(id, status, dependencies.github.integrationStorage);\n    });\n  const subscriptions = await listSubscriptions(target, { includeTerminal: notification.action === 'reopened' });\n  let delivered = 0;\n  let failed = 0;\n\n  for (const subscription of subscriptions) {\n    try {\n      const session = await resolveSubscriptionSession(dependencies.controller, subscription, dependencies.github);\n      const result = await session.sendNotificationSignal({\n        source: 'github',\n        kind: notification.kind,\n        summary: notification.summary,\n        priority: notification.priority,\n        payload: notification.payload,\n        sourceId: parsed.deliveryId,\n        dedupeKey: `${parsed.deliveryId}:${subscription.sessionId}:${subscription.threadId}`,\n        coalesceKey: `github:${subscription.data.repositoryExternalId}:pull-request:${subscription.data.changeRequestId}`,\n        metadata: {\n          event: notification.metadata.event,\n          action: notification.action,\n          repository: notification.metadata.repository,\n          issueNumber: notification.metadata.issueNumber,\n          pullRequestNumber: notification.metadata.pullRequestNumber,\n          targetUrl: notificationTargetUrl(parsed.event, parsed.payload),\n          deliveryId: parsed.deliveryId,\n        },\n      });\n      await Promise.all([result.persisted, result.accepted].filter(Boolean));\n      if (notification.terminal) {\n        await retireSubscription(subscription.id, notification.kind === 'pull-request-merged' ? 'merged' : 'closed');\n      } else if (notification.action === 'reopened') {\n        await retireSubscription(subscription.id, 'open');\n      }\n      delivered += 1;\n    } catch (error) {\n      failed += 1;\n      dependencies.onTargetError?.(subscription, error);\n    }\n  }\n\n  return { delivered, failed, ignored: false };\n}\n\nexport async function handleGithubWebhook(\n  c: Context,\n  options: GithubWebhookHandlerOptions & Partial<Omit<GithubWebhookDispatchDependencies, 'github'>>,\n): Promise<GithubWebhookResult> {\n  const parsed = await parseGithubWebhook(c, options.github.webhookSecret);\n  if ('status' in parsed) return parsed;\n\n  if (!SUPPORTED_GITHUB_WEBHOOK_EVENTS.has(parsed.event)) {\n    return { status: 202, body: { ok: true, ignored: true } };\n  }\n\n  const metadata = normalizeGithubWebhookMetadata(parsed);\n  console.info('[GitHub Webhook]', metadata);\n\n  if (options.ingestFactoryEvent) {\n    await options.ingestFactoryEvent(parsed);\n  }\n\n  if (!options.controller) {\n    return { status: 202, body: { ok: true } };\n  }\n\n  const result = await dispatchGithubWebhook(parsed, options as GithubWebhookDispatchDependencies);\n  if (result.failed > 0) {\n    console.warn(`[GitHub Webhook] ${result.failed} subscribed target(s) failed for delivery ${parsed.deliveryId}.`);\n  }\n  return { status: 202, body: { ok: true, ...(result.ignored ? { ignored: true as const } : {}) } };\n}\n"],"mappings":";;;;AAwBA,MAAM,kDAAkC,IAAI,IAAI;CAC9C;CACA;CACA;CACA;CACA;AACF,CAAC;AA2ED,SAAS,gBAAgB,OAAiD;CACxE,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,UAAU,MAAM,KAAK;CAC3B,OAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,gBAAgB,SAAiB,WAAmB,QAAyB;CACpF,IAAI,CAAC,UAAU,WAAW,SAAS,GAAG,OAAO;CAC7C,MAAM,eAAe,UAAU,MAAM,CAAgB;CACrD,IAAI,CAAC,oBAAoB,KAAK,YAAY,GAAG,OAAO;CAEpD,MAAM,cAAc,WAAW,UAAU,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK;CAC7E,MAAM,WAAW,OAAO,KAAK,cAAc,KAAK;CAChD,MAAM,WAAW,OAAO,KAAK,aAAa,KAAK;CAC/C,OAAO,SAAS,WAAW,SAAS,UAAU,gBAAgB,UAAU,QAAQ;AAClF;AAEA,eAAe,mBACb,GACA,QACoD;CACpD,IAAI,CAAC,QACH,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,OAAO;GAAgB,SAAS;EAA0C;CAAE;CAG5G,MAAM,QAAQ,gBAAgB,EAAE,IAAI,OAAO,gBAAgB,CAAC;CAC5D,MAAM,aAAa,gBAAgB,EAAE,IAAI,OAAO,mBAAmB,CAAC;CACpE,MAAM,YAAY,gBAAgB,EAAE,IAAI,OAAO,qBAAqB,CAAC;CAErE,IAAI,CAAC,OAAO,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,OAAO;GAAe,SAAS;EAAgC;CAAE;CAC3G,IAAI,CAAC,YAAY,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,OAAO;GAAe,SAAS;EAAmC;CAAE;CACnH,IAAI,CAAC,WACH,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,OAAO;GAAgB,SAAS;EAAqC;CAAE;CAEvG,MAAM,UAAU,MAAM,EAAE,IAAI,KAAK;CACjC,IAAI,CAAC,gBAAgB,SAAS,WAAW,MAAM,GAC7C,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,OAAO;GAAgB,SAAS;EAAmC;CAAE;CAGrG,IAAI;CACJ,IAAI;EACF,UAAU,KAAK,MAAM,OAAO;CAC9B,QAAQ;EACN,OAAO;GAAE,QAAQ;GAAK,MAAM;IAAE,OAAO;IAAe,SAAS;GAAyB;EAAE;CAC1F;CAEA,IAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAClE,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,OAAO;GAAe,SAAS;EAAgC;CAAE;CAGjG,OAAO;EAAE;EAAO;EAAqB;CAAmC;AAC1E;AAEA,SAAS,UAAU,OAAqD;CACtE,OAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAK,QAAoC,KAAA;AAC5G;AAEA,SAAS,UAAU,OAAoC;CACrD,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ,KAAA;AACjE;AAEA,SAAS,UAAU,OAAoC;CACrD,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,QAAQ,KAAA;AACvE;AAEA,SAAS,WAAW,OAAqC;CACvD,OAAO,OAAO,UAAU,YAAY,QAAQ,KAAA;AAC9C;AAEA,SAAgB,+BAA+B,QAAoD;CACjG,MAAM,EAAE,OAAO,YAAY,YAAY;CACvC,MAAM,aAAa,UAAU,QAAQ,UAAU;CAC/C,MAAM,QAAQ,UAAU,QAAQ,KAAK;CACrC,MAAM,cAAc,UAAU,QAAQ,YAAY;CAClD,MAAM,SAAS,UAAU,QAAQ,MAAM;CACvC,MAAM,eAAe,UAAU,QAAQ,YAAY;CACnD,MAAM,mBAAmB,UAAU,OAAO,YAAY;CAEtD,OAAO;EACL;EACA,QAAQ,UAAU,QAAQ,MAAM;EAChC;EACA,YAAY,UAAU,YAAY,SAAS;EAC3C,cAAc,UAAU,YAAY,EAAE;EACtC,aAAa,UAAU,OAAO,MAAM;EACpC,mBACE,UAAU,aAAa,MAAM,MAC5B,UAAU,mBAAmB,mBAAmB,UAAU,OAAO,MAAM,IAAI,KAAA;EAC9E,QAAQ,UAAU,QAAQ,KAAK;EAC/B,YAAY,UAAU,QAAQ,IAAI;EAClC,gBAAgB,UAAU,cAAc,EAAE;CAC5C;AACF;AAEA,SAAS,oBAAoB,UAAiC,OAAuB;CAEnF,OAAO,GADO,SAAS,SAAS,GAAG,SAAS,OAAO,KAAK,KACtC,MAAM,MAAM,SAAS,WAAW,GAAG,SAAS;AAChE;AAEA,SAAS,sBAAsB,OAAe,SAAsD;CAClG,IAAI,UAAU,mBAAmB,UAAU,+BACzC,OAAO,UAAU,UAAU,QAAQ,OAAO,CAAC,EAAE,QAAQ;CAEvD,IAAI,UAAU,uBACZ,OAAO,UAAU,UAAU,QAAQ,MAAM,CAAC,EAAE,QAAQ;CAEtD,OAAO,UAAU,UAAU,QAAQ,YAAY,CAAC,EAAE,QAAQ;AAC5D;AAEA,SAAgB,sBAAsB,QAAoE;CACxG,MAAM,WAAW,+BAA+B,MAAM;CACtD,MAAM,EAAE,OAAO,YAAY;CAC3B,MAAM,SAAS,SAAS;CACxB,IACE,CAAC,UACD,CAAC,SAAS,gBACV,CAAC,SAAS,kBACV,CAAC,SAAS,qBACV,CAAC,SAAS,YAEV;CAGF,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI,WAAW;CAEf,IAAI,UAAU,yBAAyB,WAAW,aAAa;EAC7D,MAAM,QAAQ,UAAU,UAAU,QAAQ,MAAM,CAAC,EAAE,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC,WAAW,KAAK,GAAG;EAC5F,WAAW,UAAU,cAAc,UAAU,sBAAsB,WAAW;EAC9E,OACE,UAAU,aACN,oBACA,UAAU,sBACR,6BACA;EACR,QACE,UAAU,aACN,8BACA,UAAU,sBACR,sBACA;CACV,OAAO,IAAI,UAAU,kBAAkB,WAAW,UAAU;EAC1D,MAAM,SAAS,WAAW,UAAU,QAAQ,YAAY,CAAC,EAAE,MAAM,MAAM;EACvE,WAAW;EACX,OAAO,SAAS,wBAAwB;EACxC,QAAQ,SAAS,4BAA4B;EAC7C,WAAW;CACb,OAAO,IAAI,UAAU,mBAAmB,WAAW,WAAW;EAC5D,WAAW;EACX,OAAO;EACP,QAAQ;CACV,OAAO,IAAI,UAAU,iCAAiC,WAAW,WAAW;EAC1E,WAAW;EACX,OAAO;EACP,QAAQ;CACV,OAAO,IAAI,UAAU,kBAAkB,WAAW,YAAY;EAC5D,WAAW;EACX,OAAO;EACP,QAAQ;CACV,OAAO,IAAI,UAAU,yBAAyB,WAAW,aAAa;EACpE,WAAW;EACX,OAAO;EACP,QAAQ;CACV,OAAO,IACL,UAAU,kBACV;EACE;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,SAAS,MAAM,GACjB;EACA,WAAW;EACX,OAAO,gBAAgB,OAAO,WAAW,KAAK,GAAG;EACjD,QAAQ,OAAO,WAAW,KAAK,GAAG;CACpC,OAAO,IACL,UAAU,kBACV;EAAC;EAAU;EAAW;EAAa;EAAc;CAAc,CAAC,CAAC,SAAS,MAAM,GAChF;EACA,WAAW;EACX,OAAO,gBAAgB,OAAO,WAAW,KAAK,GAAG;EACjD,QAAQ,OAAO,WAAW,KAAK,GAAG;CACpC,OACE;CAGF,OAAO;EACL;EACA;EACA;EACA,SAAS,oBAAoB,UAAU,KAAK;EAC5C;EACA,UAAU;GACR,GAAG;GACH,mBAAmB,SAAS;GAC5B,cAAc,SAAS;GACvB,gBAAgB,SAAS;EAC3B;EACA;CACF;AACF;AAEA,eAAe,2BACb,YACA,cACA,QACA;CACA,MAAM,EAAE,WAAW,YAAY,aAAa;CAC5C,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,UAChC,MAAM,IAAI,MAAM,uBAAuB,aAAa,GAAG,iCAAiC;CAE1F,MAAM,QAAQ,aAAa,gBAAgB,KAAA;CAC3C,IAAI,UAAU,MAAM,WAAW,qBAAqB,YAAY,KAAK;CACrE,IAAI,CAAC,SAAS;EACZ,MAAM,OAAO;GACX,kBAAkB;GAClB,qBAAqB,aAAa,KAAK;GACvC,GAAI,QAAQ,EAAE,cAAc,MAAM,IAAI,CAAC;EACzC;EAGA,MAAM,aAAa,MAAM,QAAQ,qBAAqB,SAAS,eAAe,UAAU;EACxF,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,uBAAuB,aAAa,GAAG,0BAA0B,WAAW,YAAY;EAE1G,MAAM,iBAAiB,IAAI,eAAe;EAC1C,eAAe,IAAI,QAAQ;GAAE,UAAU,WAAW;GAAQ,gBAAgB,WAAW;EAAM,CAAC;EAC5F,UAAU,MAAM,WAAW,cAAc;GACvC,IAAI;GACJ,SAAS,WAAW;GACpB;GACA;GACA;GACA;EACF,CAAC;CACH;CACA,IAAI,QAAQ,OAAO,MAAM,MAAM,UAC7B,MAAM,QAAQ,OAAO,OAAO;EAAE;EAAU,WAAW;CAAM,CAAC;CAE5D,IAAI,QAAQ,OAAO,MAAM,MAAM,UAC7B,MAAM,IAAI,MAAM,WAAW,UAAU,uBAAuB,SAAS,EAAE;CAEzE,OAAO;AACT;AAEA,MAAM,kCAAkB,IAAI,IAAI,CAAC,qBAAqB,2BAA2B,CAAC;AAClF,MAAM,yCAAyB,IAAI,IAAI;CAAC;CAAS;CAAY;AAAO,CAAC;AACrE,MAAM,8BAA8B;AACpC,MAAM,qCAAqB,IAAI,IAAI;CACjC;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,eAAe,yBACb,cACA,QACkB;CAClB,IAAI,CAAC,mBAAmB,IAAI,aAAa,IAAI,GAAG,OAAO;CACvD,MAAM,SAAS,aAAa,SAAS;CACrC,MAAM,aAAa,aAAa,SAAS;CACzC,IAAI,CAAC,UAAU,CAAC,YAAY,OAAO;CACnC,MAAM,mBAAmB,OAAO,YAAY;CAC5C,IAAI,aAAa,SAAS,YAAY,YAAY,MAAM,SAAS,iBAAiB,SAAS,OAAO,GAChG,OAAO,gBAAgB,IAAI,gBAAgB;CAE7C,IAAI,CAAC,QAAQ,OAAO;CACpB,MAAM,kBAAkB,IAAI,gBAAgB;CAC5C,IAAI;CACJ,IAAI;EACF,MAAM,aAAa,MAAM,QAAQ,KAAK,CACpC,OAAO,oCACL,aAAa,SAAS,gBACtB,YACA,QACA,gBAAgB,MAClB,GACA,IAAI,SAAmB,YAAW;GAChC,UAAU,iBAAiB;IACzB,gBAAgB,MAAM;IACtB,QAAQ,KAAA,CAAS;GACnB,GAAG,2BAA2B;EAChC,CAAC,CACH,CAAC;EACD,OAAO,eAAe,KAAA,KAAa,uBAAuB,IAAI,UAAU;CAC1E,QAAQ;EACN,OAAO;CACT,UAAU;EACR,IAAI,SAAS,aAAa,OAAO;CACnC;AACF;AAEA,eAAsB,sBACpB,QACA,cACkE;CAClE,MAAM,eAAe,sBAAsB,MAAM;CACjD,IAAI,CAAC,cAAc,OAAO;EAAE,WAAW;EAAG,QAAQ;EAAG,SAAS;CAAK;CAInE,IAAI,CAAE,OAFJ,aAAa,wBACX,MAAiC,yBAAyB,GAAG,aAAa,MAAM,GAAA,CACrD,YAAY,GACzC,OAAO;EAAE,WAAW;EAAG,QAAQ;EAAG,SAAS;CAAK;CAGlD,MAAM,SAAS;EACb,wBAAwB,aAAa,SAAS,eAAe,SAAS;EACtE,sBAAsB,aAAa,SAAS,aAAa,SAAS;EAClE,iBAAiB,aAAa,SAAS,kBAAkB,SAAS;CACpE;CACA,MAAM,oBACJ,aAAa,uBACX,oBAAoD,YAA4C;EAChG,IAAI,CAAC,aAAa,QAAQ,MAAM,IAAI,MAAM,+DAA+D;EACzG,OAAO,uCACL,oBACA,SACA,aAAa,OAAO,kBACtB;CACF;CACF,MAAM,qBACJ,aAAa,wBACX,IAAY,WAAyC;EACrD,IAAI,CAAC,aAAa,QAAQ,MAAM,IAAI,MAAM,iEAAiE;EAC3G,OAAO,8BAA8B,IAAI,QAAQ,aAAa,OAAO,kBAAkB;CACzF;CACF,MAAM,gBAAgB,MAAM,kBAAkB,QAAQ,EAAE,iBAAiB,aAAa,WAAW,WAAW,CAAC;CAC7G,IAAI,YAAY;CAChB,IAAI,SAAS;CAEb,KAAK,MAAM,gBAAgB,eACzB,IAAI;EAEF,MAAM,SAAS,OAAM,MADC,2BAA2B,aAAa,YAAY,cAAc,aAAa,MAAM,EAAA,CAC9E,uBAAuB;GAClD,QAAQ;GACR,MAAM,aAAa;GACnB,SAAS,aAAa;GACtB,UAAU,aAAa;GACvB,SAAS,aAAa;GACtB,UAAU,OAAO;GACjB,WAAW,GAAG,OAAO,WAAW,GAAG,aAAa,UAAU,GAAG,aAAa;GAC1E,aAAa,UAAU,aAAa,KAAK,qBAAqB,gBAAgB,aAAa,KAAK;GAChG,UAAU;IACR,OAAO,aAAa,SAAS;IAC7B,QAAQ,aAAa;IACrB,YAAY,aAAa,SAAS;IAClC,aAAa,aAAa,SAAS;IACnC,mBAAmB,aAAa,SAAS;IACzC,WAAW,sBAAsB,OAAO,OAAO,OAAO,OAAO;IAC7D,YAAY,OAAO;GACrB;EACF,CAAC;EACD,MAAM,QAAQ,IAAI,CAAC,OAAO,WAAW,OAAO,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC;EACrE,IAAI,aAAa,UACf,MAAM,mBAAmB,aAAa,IAAI,aAAa,SAAS,wBAAwB,WAAW,QAAQ;OACtG,IAAI,aAAa,WAAW,YACjC,MAAM,mBAAmB,aAAa,IAAI,MAAM;EAElD,aAAa;CACf,SAAS,OAAO;EACd,UAAU;EACV,aAAa,gBAAgB,cAAc,KAAK;CAClD;CAGF,OAAO;EAAE;EAAW;EAAQ,SAAS;CAAM;AAC7C;AAEA,eAAsB,oBACpB,GACA,SAC8B;CAC9B,MAAM,SAAS,MAAM,mBAAmB,GAAG,QAAQ,OAAO,aAAa;CACvE,IAAI,YAAY,QAAQ,OAAO;CAE/B,IAAI,CAAC,gCAAgC,IAAI,OAAO,KAAK,GACnD,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,IAAI;GAAM,SAAS;EAAK;CAAE;CAG1D,MAAM,WAAW,+BAA+B,MAAM;CACtD,QAAQ,KAAK,oBAAoB,QAAQ;CAEzC,IAAI,QAAQ,oBACV,MAAM,QAAQ,mBAAmB,MAAM;CAGzC,IAAI,CAAC,QAAQ,YACX,OAAO;EAAE,QAAQ;EAAK,MAAM,EAAE,IAAI,KAAK;CAAE;CAG3C,MAAM,SAAS,MAAM,sBAAsB,QAAQ,OAA4C;CAC/F,IAAI,OAAO,SAAS,GAClB,QAAQ,KAAK,oBAAoB,OAAO,OAAO,4CAA4C,OAAO,WAAW,EAAE;CAEjH,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,IAAI;GAAM,GAAI,OAAO,UAAU,EAAE,SAAS,KAAc,IAAI,CAAC;EAAG;CAAE;AAClG"}

package/dist/integrations/linear/agent-tools.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Linear tools exposed to the coding agent.
+ *
+ * Wired into the agent through the SDK's async `extraTools` provider: on each
+ * tool-set resolution we map the session's resourceId (the factory project id)
+ * to its owning org and only expose the Linear tools when that org has a
+ * Linear connection. Projects whose org never connected Linear (or when the
+ * feature is disabled) see no Linear tools at all — the model is never shown
+ * tools it can't use.
+ *
+ * Tenancy mirrors the Linear API routes: everything is scoped by the org that
+ * owns the project, and tokens are refreshed through the integration's shared
+ * connection lifecycle.
+ */
+import type { RequestContext } from '@mastra/core/request-context';
+import type { LinearIntegration } from './integration.js';
+declare function createLinearGetIssueTool(linear: LinearIntegration, orgId: string): import("@mastra/core/tools").Tool<{
+    issue: string;
+}, unknown, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "linear_get_issue", unknown>;
+declare function createLinearCommentTool(linear: LinearIntegration, orgId: string): import("@mastra/core/tools").Tool<{
+    issue: string;
+    body: string;
+}, unknown, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "linear_create_comment", unknown>;
+/**
+ * Async `extraTools` provider: expose Linear tools only when the session's
+ * project belongs to an org with an active Linear connection.
+ */
+export declare function buildLinearAgentTools({ requestContext, linear, }: {
+    requestContext: RequestContext;
+    /** The integration instance providing the Linear API client. */
+    linear: LinearIntegration;
+}): Promise<Record<string, ReturnType<typeof createLinearGetIssueTool> | ReturnType<typeof createLinearCommentTool>>>;
+export {};
+//# sourceMappingURL=agent-tools.d.ts.map

package/dist/integrations/linear/agent-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-tools.d.ts","sourceRoot":"","sources":["../../../src/integrations/linear/agent-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAInE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D,iBAAS,wBAAwB,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM;;yIA+BzE;AAED,iBAAS,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM;;;8IAsCxE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,cAAc,EACd,MAAM,GACP,EAAE;IACD,cAAc,EAAE,cAAc,CAAC;IAC/B,gEAAgE;IAChE,MAAM,EAAE,iBAAiB,CAAC;CAC3B,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,wBAAwB,CAAC,GAAG,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAmBpH"}