@mastra/factory 0.0.0-fix-thread-subscription-multi-instance-redis-streams-20260730204150

package/dist/integrations/github/rules.js

@@ -0,0 +1,362 @@
+import { resolveFactoryGithubRule } from "../../rules/resolve.js";
+import { validateFactoryRuleDecisions } from "../../rules/validation.js";
+//#region src/integrations/github/rules.ts
+const TRUSTED_PERMISSIONS = /* @__PURE__ */ new Set(["write", "admin"]);
+const RULE_TIMEOUT_MS = 5e3;
+async function withRuleTimeout(promise) {
+	let timeout;
+	try {
+		return await Promise.race([promise, new Promise((_, reject) => {
+			timeout = setTimeout(() => reject(/* @__PURE__ */ new Error("FACTORY_RULE_TIMEOUT")), RULE_TIMEOUT_MS);
+		})]);
+	} finally {
+		if (timeout) clearTimeout(timeout);
+	}
+}
+function object(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function string(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function number(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function boolean(value) {
+	return typeof value === "boolean" ? value : void 0;
+}
+function eventName(parsed) {
+	const action = string(parsed.payload.action);
+	if (parsed.event === "issues" && action === "opened") return "issueOpened";
+	if (parsed.event === "pull_request" && action === "opened") return "pullRequestOpened";
+	if (parsed.event === "pull_request" && action === "synchronize") return "pullRequestUpdated";
+	if (parsed.event === "pull_request" && action === "closed") return boolean(object(parsed.payload.pull_request)?.merged) ? "pullRequestMerged" : "pullRequestClosed";
+	if (parsed.event === "pull_request" && action === "review_requested") return "pullRequestReviewRequested";
+}
+function canonicalSourceKey(kind, itemNumber) {
+	return kind === "issue" ? `github-issue:${itemNumber}` : `github-pr:${itemNumber}`;
+}
+function legacySourceKey(repositoryId, kind, itemNumber) {
+	return `github:${repositoryId}:${kind}:${itemNumber}`;
+}
+function provenanceTarget(repositoryId, pullRequestNumber) {
+	return `factory-pr-provenance:${repositoryId}:${pullRequestNumber}`;
+}
+function workItemSource(item) {
+	if (!item.externalSource) return "manual";
+	return item.externalSource.type === "pull-request" ? "github-pr" : "github-issue";
+}
+function workItemSourceKey(item) {
+	return item.externalSource?.externalId ?? null;
+}
+async function githubActor(github, input) {
+	let trusted = false;
+	try {
+		const permission = await github.getRepositoryCollaboratorPermission(input.installationId, input.repository, input.login);
+		trusted = permission !== void 0 && TRUSTED_PERMISSIONS.has(permission);
+	} catch {
+		trusted = false;
+	}
+	return {
+		type: "github",
+		login: input.login,
+		trusted,
+		factoryAuthored: input.factoryAuthored
+	};
+}
+function pullRequestProvenance(data) {
+	if (!data || data.kind !== "factory-pr-provenance" || typeof data.workItemId !== "string") return null;
+	return {
+		kind: "factory-pr-provenance",
+		workItemId: data.workItemId
+	};
+}
+var GithubRules = class {
+	options;
+	constructor(options) {
+		this.options = options;
+	}
+	async ingest(parsed) {
+		const event = eventName(parsed);
+		const repository = object(parsed.payload.repository);
+		const installationId = number(object(parsed.payload.installation)?.id);
+		const repositoryId = number(repository?.id);
+		const repositoryName = string(repository?.full_name);
+		const login = string(object(parsed.payload.sender)?.login);
+		if (!event || !installationId || !repositoryId || !repositoryName || !login) return { status: "ignored" };
+		const projects = await this.options.sourceControl.projectRepositories.listByExternalRepository({
+			installationExternalId: String(installationId),
+			repositoryExternalId: String(repositoryId)
+		});
+		if (projects.length === 0) return { status: "ignored" };
+		const results = [];
+		for (const project of projects) results.push(await this.#ingestProject(parsed, event, installationId, repositoryId, repositoryName, login, project));
+		if (results.some((result) => result.status === "committed")) return { status: "committed" };
+		if (results.some((result) => result.status === "replayed")) return { status: "replayed" };
+		return results[0] ?? { status: "ignored" };
+	}
+	async #ingestProject(parsed, event, installationId, repositoryId, repositoryName, login, project) {
+		const factoryProject = await this.options.projects.get({
+			orgId: project.orgId,
+			id: project.factoryProjectId
+		});
+		if (!factoryProject) return { status: "missing" };
+		const issue = object(parsed.payload.issue);
+		const pullRequest = object(parsed.payload.pull_request);
+		const issueNumber = number(issue?.number);
+		const pullRequestNumber = number(pullRequest?.number);
+		const provenance = pullRequestNumber ? pullRequestProvenance((await this.options.integrationStorage.subscriptions.listByTarget(provenanceTarget(repositoryId, pullRequestNumber), { status: "active" })).find((subscription) => subscription.orgId === project.orgId)?.data) : null;
+		const relatedItem = await this.#relatedItem(project.orgId, project.factoryProjectId, repositoryId, issueNumber, pullRequestNumber, string(object(pullRequest?.head)?.ref), provenance);
+		const actor = await githubActor(this.options.github, {
+			installationId,
+			repository: repositoryName,
+			login,
+			factoryAuthored: provenance !== null
+		});
+		const context = {
+			tenant: {
+				orgId: project.orgId,
+				projectId: project.factoryProjectId
+			},
+			actor,
+			ingress: {
+				type: "github",
+				id: `${installationId}:${parsed.deliveryId}`
+			},
+			cause: `github.${event}`,
+			causalChain: [],
+			ruleSetVersion: this.options.rules.version,
+			...relatedItem ? {
+				item: {
+					id: relatedItem.id,
+					source: workItemSource(relatedItem),
+					sourceKey: workItemSourceKey(relatedItem),
+					parentWorkItemId: relatedItem.parentWorkItemId,
+					title: relatedItem.title,
+					url: relatedItem.externalSource?.url ?? null,
+					stages: relatedItem.stages
+				},
+				board: relatedItem.externalSource?.type === "pull-request" ? "review" : "work",
+				itemRevision: relatedItem.revision
+			} : {},
+			event,
+			deliveryId: parsed.deliveryId,
+			factory: { createdAt: factoryProject.createdAt.toISOString() },
+			repository: {
+				id: repositoryId,
+				fullName: repositoryName
+			},
+			...issueNumber && string(issue?.title) && string(issue?.html_url) ? { issue: {
+				number: issueNumber,
+				title: string(issue?.title),
+				url: string(issue?.html_url),
+				...string(issue?.created_at) ? { createdAt: string(issue?.created_at) } : {}
+			} } : {},
+			...pullRequestNumber && string(pullRequest?.title) && string(pullRequest?.html_url) ? { pullRequest: {
+				number: pullRequestNumber,
+				title: string(pullRequest?.title),
+				url: string(pullRequest?.html_url),
+				...string(pullRequest?.created_at) ? { createdAt: string(pullRequest?.created_at) } : {},
+				state: string(pullRequest?.state) === "closed" ? "closed" : "open",
+				merged: boolean(pullRequest?.merged) ?? false,
+				headBranch: string(object(pullRequest?.head)?.ref) ?? "",
+				baseBranch: string(object(pullRequest?.base)?.ref) ?? ""
+			} } : {},
+			...object(parsed.payload.review) ? { review: {
+				id: number(object(parsed.payload.review)?.id) ?? 0,
+				state: string(object(parsed.payload.review)?.state) ?? "unknown",
+				url: string(object(parsed.payload.review)?.html_url) ?? ""
+			} } : {}
+		};
+		const rule = resolveFactoryGithubRule(this.options.rules, event);
+		let decision;
+		let decisions = [];
+		let outcome = { status: "accepted" };
+		try {
+			decision = rule ? await withRuleTimeout(Promise.resolve(rule(Object.freeze(context)))) : void 0;
+			if (decision?.type === "reject") outcome = {
+				status: "rejected",
+				code: decision.code,
+				reason: decision.reason
+			};
+			else if (decision) decisions = validateFactoryRuleDecisions([decision]).map((entry) => ({ ...entry }));
+		} catch (error) {
+			const timedOut = error instanceof Error && error.message === "FACTORY_RULE_TIMEOUT";
+			outcome = {
+				status: "rejected",
+				code: timedOut ? "timeout" : "rule_error",
+				reason: timedOut ? "Factory rule evaluation timed out." : error instanceof Error ? error.message.slice(0, 2e3) : "Factory GitHub rule failed."
+			};
+		}
+		return { status: (await this.options.storage.commitRuleEvaluation({
+			orgId: project.orgId,
+			factoryProjectId: project.factoryProjectId,
+			workItemId: relatedItem?.id ?? null,
+			ingress: {
+				identity: `${installationId}:${parsed.deliveryId}`,
+				triggerType: `github.${event}`
+			},
+			ruleSetVersion: this.options.rules.version,
+			expectedRevision: relatedItem?.revision ?? null,
+			actor: { ...actor },
+			outcome,
+			decisions,
+			causalChain: [],
+			now: /* @__PURE__ */ new Date()
+		})).status };
+	}
+	async #relatedItem(orgId, projectId, repositoryId, issueNumber, pullRequestNumber, pullRequestHeadBranch, provenance) {
+		const items = await this.options.storage.list({
+			orgId,
+			factoryProjectId: projectId
+		});
+		if (provenance) return items.find((item) => item.id === provenance.workItemId);
+		if (issueNumber) return items.find((item) => item.externalSource?.externalId === canonicalSourceKey("issue", issueNumber)) ?? items.find((item) => item.externalSource?.externalId === legacySourceKey(repositoryId, "issue", issueNumber));
+		if (pullRequestNumber) return items.find((item) => item.externalSource?.externalId === canonicalSourceKey("pull-request", pullRequestNumber)) ?? items.find((item) => item.externalSource?.externalId === legacySourceKey(repositoryId, "pull-request", pullRequestNumber)) ?? (pullRequestHeadBranch ? items.find((item) => item.externalSource?.type !== "pull-request" && Object.values(item.sessions).some((session) => session.branch === pullRequestHeadBranch)) : void 0);
+	}
+};
+const RECONCILE_ERROR_SAMPLE_LIMIT = 5;
+/**
+* Extracts the PR number a work item tracks, but only when the item belongs
+* to the given repository. Card URLs pin the repository unambiguously; the
+* legacy source key embeds the repository id. Canonical keys (`github-pr:N`)
+* carry no repository, so they are only trusted when the item has no URL —
+* a project mapped to multiple repositories must not reconcile one repo's
+* card against another repo's PR number.
+*/
+function reconcilablePullRequestNumber(item, repository) {
+	if (item.externalSource?.type !== "pull-request") return void 0;
+	const url = item.externalSource.url;
+	if (url) {
+		const match = /^https?:\/\/[^/]+\/(.+)\/pull\/(\d+)(?:[/?#]|$)/.exec(url);
+		if (!match) return void 0;
+		return match[1] === repository.fullName ? Number(match[2]) : void 0;
+	}
+	const externalId = item.externalSource.externalId;
+	const legacy = /^github:(\d+):pull-request:(\d+)$/.exec(externalId);
+	if (legacy) return Number(legacy[1]) === repository.id ? Number(legacy[2]) : void 0;
+	const canonical = /^github-pr:(\d+)$/.exec(externalId);
+	return canonical ? Number(canonical[1]) : void 0;
+}
+function reconciledClosedEvent(repository, pullRequestNumber, state) {
+	return {
+		event: "pull_request",
+		deliveryId: `reconcile:${repository.id}:pull-request:${pullRequestNumber}:${state.merged ? "merged" : "closed"}`,
+		payload: {
+			action: "closed",
+			installation: { id: repository.installationId },
+			repository: {
+				id: repository.id,
+				full_name: repository.fullName
+			},
+			sender: { login: state.mergedBy ?? "github" },
+			pull_request: {
+				number: pullRequestNumber,
+				title: state.title,
+				html_url: state.url,
+				...state.createdAt ? { created_at: state.createdAt } : {},
+				state: "closed",
+				merged: state.merged,
+				head: { ref: state.headBranch },
+				base: { ref: state.baseBranch }
+			}
+		}
+	};
+}
+/**
+* State-based safety net for merge signals: webhooks and event-log tailing
+* can miss a merge (cursor gaps, downtime, terminally failed decisions), so
+* this sweep compares still-open PR cards against actual GitHub state and
+* replays the merge through the normal rules ingress when they disagree.
+*/
+function createGithubPullRequestReconciler(options, fetchPullRequest) {
+	const rules = new GithubRules(options);
+	return async (repositories) => {
+		const summary = {
+			repositories: 0,
+			checked: 0,
+			merged: 0,
+			closed: 0,
+			failed: 0,
+			errors: []
+		};
+		const recordFailure = (repository, error, pullRequestNumber) => {
+			summary.failed += 1;
+			if (summary.errors.length < RECONCILE_ERROR_SAMPLE_LIMIT) summary.errors.push({
+				repository: repository.fullName,
+				...pullRequestNumber === void 0 ? {} : { pullRequestNumber },
+				error: error instanceof Error ? error.message : String(error)
+			});
+		};
+		const configured = new Set((await options.sourceControl.projectRepositories.listConfiguredExternalKeys()).map((key) => `${key.installationExternalId}\u0000${key.repositoryExternalId}`));
+		const scoped = repositories.filter((repository) => configured.has(`${repository.installationId}\u0000${repository.id}`));
+		summary.repositories = scoped.length;
+		for (const repository of scoped) {
+			let numbers;
+			try {
+				const projects = await options.sourceControl.projectRepositories.listByExternalRepository({
+					installationExternalId: String(repository.installationId),
+					repositoryExternalId: String(repository.id)
+				});
+				if (projects.length === 0) continue;
+				numbers = /* @__PURE__ */ new Set();
+				for (const project of projects) {
+					const items = await options.storage.list({
+						orgId: project.orgId,
+						factoryProjectId: project.factoryProjectId
+					});
+					for (const item of items) {
+						const stage = item.stages[0];
+						if (stage === "done" || stage === "canceled") continue;
+						const pullRequestNumber = reconcilablePullRequestNumber(item, repository);
+						if (pullRequestNumber) numbers.add(pullRequestNumber);
+					}
+				}
+			} catch (error) {
+				recordFailure(repository, error);
+				continue;
+			}
+			for (const pullRequestNumber of numbers) try {
+				const state = await fetchPullRequest({
+					installationId: repository.installationId,
+					repository: repository.fullName,
+					number: pullRequestNumber
+				});
+				summary.checked += 1;
+				if (!state || state.state !== "closed") continue;
+				await rules.ingest(reconciledClosedEvent(repository, pullRequestNumber, state));
+				if (state.merged) summary.merged += 1;
+				else summary.closed += 1;
+			} catch (error) {
+				recordFailure(repository, error, pullRequestNumber);
+			}
+		}
+		return summary;
+	};
+}
+function githubRulesOptions(github, context) {
+	if (!context.rules) return void 0;
+	return {
+		github,
+		sourceControl: context.storage.sourceControl,
+		integrationStorage: context.storage.generic,
+		projects: context.storage.projects,
+		storage: context.rules.workItems,
+		rules: context.rules.config
+	};
+}
+function attachGithubRules(github, context) {
+	const options = githubRulesOptions(github, context);
+	if (!options) return void 0;
+	const rules = new GithubRules(options);
+	return (event) => rules.ingest(event);
+}
+function attachGithubReconciler(github, context, fetchPullRequest) {
+	const options = githubRulesOptions(github, context);
+	if (!options) return void 0;
+	return createGithubPullRequestReconciler(options, fetchPullRequest);
+}
+//#endregion
+export { GithubRules, attachGithubReconciler, attachGithubRules, createGithubPullRequestReconciler, reconciledClosedEvent };
+
+//# sourceMappingURL=rules.js.map

package/dist/integrations/github/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","names":["#ingestProject","#relatedItem"],"sources":["../../../src/integrations/github/rules.ts"],"sourcesContent":["import { resolveFactoryGithubRule } from '../../rules/resolve.js';\nimport type {\n  FactoryGithubEventName,\n  FactoryGithubRuleContext,\n  FactoryRuleActor,\n  FactoryRuleDecision,\n  FactoryRules,\n} from '../../rules/types.js';\nimport { validateFactoryRuleDecisions } from '../../rules/validation.js';\nimport type { IntegrationStorageHandle } from '../../storage/domains/integrations/base.js';\nimport type { FactoryProjectsStorage } from '../../storage/domains/projects/base.js';\nimport type {\n  ExternalRepositoryProjectTarget,\n  SourceControlStorageHandle,\n} from '../../storage/domains/source-control/base.js';\nimport type { WorkItemRow, WorkItemsStorage } from '../../storage/domains/work-items/base.js';\nimport type { IntegrationContext } from '../base.js';\nimport type { GithubRepositoryPermission } from './integration.js';\nimport type { ParsedGithubWebhook } from './webhook.js';\n\nconst TRUSTED_PERMISSIONS = new Set(['write', 'admin']);\nconst RULE_TIMEOUT_MS = 5_000;\n\nasync function withRuleTimeout<T>(promise: Promise<T>): Promise<T> {\n  let timeout: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      promise,\n      new Promise<never>((_, reject) => {\n        timeout = setTimeout(() => reject(new Error('FACTORY_RULE_TIMEOUT')), RULE_TIMEOUT_MS);\n      }),\n    ]);\n  } finally {\n    if (timeout) clearTimeout(timeout);\n  }\n}\n\nfunction object(value: unknown): Record<string, unknown> | undefined {\n  return value && typeof value === 'object' && !Array.isArray(value) ? (value as Record<string, unknown>) : undefined;\n}\n\nfunction string(value: unknown): string | undefined {\n  return typeof value === 'string' && value.length > 0 ? value : undefined;\n}\n\nfunction number(value: unknown): number | undefined {\n  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;\n}\n\nfunction boolean(value: unknown): boolean | undefined {\n  return typeof value === 'boolean' ? value : undefined;\n}\n\nfunction eventName(parsed: ParsedGithubWebhook): FactoryGithubEventName | undefined {\n  const action = string(parsed.payload.action);\n  if (parsed.event === 'issues' && action === 'opened') return 'issueOpened';\n  if (parsed.event === 'pull_request' && action === 'opened') return 'pullRequestOpened';\n  if (parsed.event === 'pull_request' && action === 'synchronize') return 'pullRequestUpdated';\n  if (parsed.event === 'pull_request' && action === 'closed') {\n    return boolean(object(parsed.payload.pull_request)?.merged) ? 'pullRequestMerged' : 'pullRequestClosed';\n  }\n  if (parsed.event === 'pull_request' && action === 'review_requested') return 'pullRequestReviewRequested';\n  return undefined;\n}\n\nfunction canonicalSourceKey(kind: 'issue' | 'pull-request', itemNumber: number): string {\n  return kind === 'issue' ? `github-issue:${itemNumber}` : `github-pr:${itemNumber}`;\n}\n\nfunction legacySourceKey(repositoryId: number, kind: 'issue' | 'pull-request', itemNumber: number): string {\n  return `github:${repositoryId}:${kind}:${itemNumber}`;\n}\n\nfunction provenanceTarget(repositoryId: number, pullRequestNumber: number): string {\n  return `factory-pr-provenance:${repositoryId}:${pullRequestNumber}`;\n}\n\nfunction workItemSource(item: WorkItemRow) {\n  if (!item.externalSource) return 'manual' as const;\n  return item.externalSource.type === 'pull-request' ? ('github-pr' as const) : ('github-issue' as const);\n}\n\nfunction workItemSourceKey(item: WorkItemRow): string | null {\n  return item.externalSource?.externalId ?? null;\n}\n\nasync function githubActor(\n  github: GithubRulesIntegration,\n  input: { installationId: number; repository: string; login: string; factoryAuthored: boolean },\n): Promise<FactoryRuleActor> {\n  let trusted = false;\n  try {\n    const permission = await github.getRepositoryCollaboratorPermission(\n      input.installationId,\n      input.repository,\n      input.login,\n    );\n    trusted = permission !== undefined && TRUSTED_PERMISSIONS.has(permission);\n  } catch {\n    trusted = false;\n  }\n  return { type: 'github', login: input.login, trusted, factoryAuthored: input.factoryAuthored };\n}\n\ninterface FactoryPullRequestProvenanceData {\n  kind: 'factory-pr-provenance';\n  workItemId: string;\n}\n\nfunction pullRequestProvenance(data: Record<string, unknown> | undefined): FactoryPullRequestProvenanceData | null {\n  if (!data || data.kind !== 'factory-pr-provenance' || typeof data.workItemId !== 'string') return null;\n  return { kind: 'factory-pr-provenance', workItemId: data.workItemId };\n}\n\nexport interface GithubRulesIntegration {\n  getRepositoryCollaboratorPermission(\n    installationId: number,\n    repoFullName: string,\n    username: string,\n  ): Promise<GithubRepositoryPermission | undefined>;\n}\n\nexport interface GithubRulesOptions {\n  github: GithubRulesIntegration;\n  sourceControl: SourceControlStorageHandle;\n  /** Integration-scoped storage; provenance rows are validated at read. */\n  integrationStorage: IntegrationStorageHandle;\n  projects: FactoryProjectsStorage;\n  storage: WorkItemsStorage;\n  rules: FactoryRules;\n}\n\nexport class GithubRules {\n  constructor(private readonly options: GithubRulesOptions) {}\n\n  async ingest(parsed: ParsedGithubWebhook): Promise<{ status: 'ignored' | 'committed' | 'replayed' | 'missing' }> {\n    const event = eventName(parsed);\n    const repository = object(parsed.payload.repository);\n    const installationId = number(object(parsed.payload.installation)?.id);\n    const repositoryId = number(repository?.id);\n    const repositoryName = string(repository?.full_name);\n    const login = string(object(parsed.payload.sender)?.login);\n    if (!event || !installationId || !repositoryId || !repositoryName || !login) return { status: 'ignored' };\n\n    const projects = await this.options.sourceControl.projectRepositories.listByExternalRepository({\n      installationExternalId: String(installationId),\n      repositoryExternalId: String(repositoryId),\n    });\n    if (projects.length === 0) return { status: 'ignored' };\n    const results = [];\n    for (const project of projects) {\n      results.push(\n        await this.#ingestProject(parsed, event, installationId, repositoryId, repositoryName, login, project),\n      );\n    }\n    if (results.some(result => result.status === 'committed')) return { status: 'committed' };\n    if (results.some(result => result.status === 'replayed')) return { status: 'replayed' };\n    return results[0] ?? { status: 'ignored' };\n  }\n\n  async #ingestProject(\n    parsed: ParsedGithubWebhook,\n    event: FactoryGithubEventName,\n    installationId: number,\n    repositoryId: number,\n    repositoryName: string,\n    login: string,\n    project: ExternalRepositoryProjectTarget,\n  ): Promise<{ status: 'committed' | 'replayed' | 'missing' }> {\n    const factoryProject = await this.options.projects.get({\n      orgId: project.orgId,\n      id: project.factoryProjectId,\n    });\n    if (!factoryProject) return { status: 'missing' };\n    const issue = object(parsed.payload.issue);\n    const pullRequest = object(parsed.payload.pull_request);\n    const issueNumber = number(issue?.number);\n    const pullRequestNumber = number(pullRequest?.number);\n    const provenance = pullRequestNumber\n      ? pullRequestProvenance(\n          (\n            await this.options.integrationStorage.subscriptions.listByTarget(\n              provenanceTarget(repositoryId, pullRequestNumber),\n              { status: 'active' },\n            )\n          ).find(subscription => subscription.orgId === project.orgId)?.data,\n        )\n      : null;\n    const relatedItem = await this.#relatedItem(\n      project.orgId,\n      project.factoryProjectId,\n      repositoryId,\n      issueNumber,\n      pullRequestNumber,\n      string(object(pullRequest?.head)?.ref),\n      provenance,\n    );\n    const actor = await githubActor(this.options.github, {\n      installationId,\n      repository: repositoryName,\n      login,\n      factoryAuthored: provenance !== null,\n    });\n    const context: FactoryGithubRuleContext = {\n      tenant: { orgId: project.orgId, projectId: project.factoryProjectId },\n      actor,\n      ingress: { type: 'github', id: `${installationId}:${parsed.deliveryId}` },\n      cause: `github.${event}`,\n      causalChain: [],\n      ruleSetVersion: this.options.rules.version,\n      ...(relatedItem\n        ? {\n            item: {\n              id: relatedItem.id,\n              source: workItemSource(relatedItem),\n              sourceKey: workItemSourceKey(relatedItem),\n              parentWorkItemId: relatedItem.parentWorkItemId,\n              title: relatedItem.title,\n              url: relatedItem.externalSource?.url ?? null,\n              stages: relatedItem.stages,\n            },\n            board: relatedItem.externalSource?.type === 'pull-request' ? ('review' as const) : ('work' as const),\n            itemRevision: relatedItem.revision,\n          }\n        : {}),\n      event,\n      deliveryId: parsed.deliveryId,\n      factory: { createdAt: factoryProject.createdAt.toISOString() },\n      repository: { id: repositoryId, fullName: repositoryName },\n      ...(issueNumber && string(issue?.title) && string(issue?.html_url)\n        ? {\n            issue: {\n              number: issueNumber,\n              title: string(issue?.title)!,\n              url: string(issue?.html_url)!,\n              ...(string(issue?.created_at) ? { createdAt: string(issue?.created_at) } : {}),\n            },\n          }\n        : {}),\n      ...(pullRequestNumber && string(pullRequest?.title) && string(pullRequest?.html_url)\n        ? {\n            pullRequest: {\n              number: pullRequestNumber,\n              title: string(pullRequest?.title)!,\n              url: string(pullRequest?.html_url)!,\n              ...(string(pullRequest?.created_at) ? { createdAt: string(pullRequest?.created_at) } : {}),\n              state: string(pullRequest?.state) === 'closed' ? ('closed' as const) : ('open' as const),\n              merged: boolean(pullRequest?.merged) ?? false,\n              headBranch: string(object(pullRequest?.head)?.ref) ?? '',\n              baseBranch: string(object(pullRequest?.base)?.ref) ?? '',\n            },\n          }\n        : {}),\n      ...(object(parsed.payload.review)\n        ? {\n            review: {\n              id: number(object(parsed.payload.review)?.id) ?? 0,\n              state: string(object(parsed.payload.review)?.state) ?? 'unknown',\n              url: string(object(parsed.payload.review)?.html_url) ?? '',\n            },\n          }\n        : {}),\n    };\n\n    const rule = resolveFactoryGithubRule(this.options.rules, event);\n    let decision: FactoryRuleDecision | void;\n    let decisions: Record<string, unknown>[] = [];\n    let outcome: { status: 'accepted' | 'rejected'; code?: string; reason?: string } = { status: 'accepted' };\n    try {\n      decision = rule ? await withRuleTimeout(Promise.resolve(rule(Object.freeze(context)))) : undefined;\n      if (decision?.type === 'reject') {\n        outcome = { status: 'rejected', code: decision.code, reason: decision.reason };\n      } else if (decision) {\n        decisions = validateFactoryRuleDecisions([decision]).map(entry => ({ ...entry }));\n      }\n    } catch (error) {\n      const timedOut = error instanceof Error && error.message === 'FACTORY_RULE_TIMEOUT';\n      outcome = {\n        status: 'rejected',\n        code: timedOut ? 'timeout' : 'rule_error',\n        reason: timedOut\n          ? 'Factory rule evaluation timed out.'\n          : error instanceof Error\n            ? error.message.slice(0, 2_000)\n            : 'Factory GitHub rule failed.',\n      };\n    }\n\n    const committed = await this.options.storage.commitRuleEvaluation({\n      orgId: project.orgId,\n      factoryProjectId: project.factoryProjectId,\n      workItemId: relatedItem?.id ?? null,\n      ingress: { identity: `${installationId}:${parsed.deliveryId}`, triggerType: `github.${event}` },\n      ruleSetVersion: this.options.rules.version,\n      expectedRevision: relatedItem?.revision ?? null,\n      actor: { ...actor },\n      outcome,\n      decisions,\n      causalChain: [],\n      now: new Date(),\n    });\n    return { status: committed.status };\n  }\n\n  async #relatedItem(\n    orgId: string,\n    projectId: string,\n    repositoryId: number,\n    issueNumber: number | undefined,\n    pullRequestNumber: number | undefined,\n    pullRequestHeadBranch: string | undefined,\n    provenance: FactoryPullRequestProvenanceData | null,\n  ): Promise<WorkItemRow | undefined> {\n    const items = await this.options.storage.list({ orgId, factoryProjectId: projectId });\n    if (provenance) return items.find(item => item.id === provenance.workItemId);\n    if (issueNumber) {\n      return (\n        items.find(item => item.externalSource?.externalId === canonicalSourceKey('issue', issueNumber)) ??\n        items.find(item => item.externalSource?.externalId === legacySourceKey(repositoryId, 'issue', issueNumber))\n      );\n    }\n    if (pullRequestNumber) {\n      return (\n        items.find(item => item.externalSource?.externalId === canonicalSourceKey('pull-request', pullRequestNumber)) ??\n        items.find(\n          item => item.externalSource?.externalId === legacySourceKey(repositoryId, 'pull-request', pullRequestNumber),\n        ) ??\n        // Provenance fallback: a PR pushed from a work item's session branch\n        // belongs to that item even when no gh-pr-create provenance was\n        // recorded (session predating state seeding, or the PR was opened\n        // outside the tracked tool call). Session branches are per-item\n        // (`factory/issue-N`), so a head-branch match is unambiguous.\n        (pullRequestHeadBranch\n          ? items.find(\n              item =>\n                item.externalSource?.type !== 'pull-request' &&\n                Object.values(item.sessions).some(session => session.branch === pullRequestHeadBranch),\n            )\n          : undefined)\n      );\n    }\n    return undefined;\n  }\n}\n\nexport interface ReconcilePullRequestState {\n  title: string;\n  url: string;\n  state: 'open' | 'closed';\n  merged: boolean;\n  headBranch: string;\n  baseBranch: string;\n  createdAt?: string;\n  mergedBy?: string;\n}\n\nexport type GithubPullRequestFetcher = (input: {\n  installationId: number;\n  repository: string;\n  number: number;\n}) => Promise<ReconcilePullRequestState | undefined>;\n\nexport interface ReconcileRepository {\n  id: number;\n  fullName: string;\n  installationId: number;\n}\n\nexport interface ReconcileSweepSummary {\n  /** Factory-configured repositories included in the sweep. */\n  repositories: number;\n  /** PRs whose live state was fetched from GitHub. */\n  checked: number;\n  /** Missed merges replayed through the rules ingress. */\n  merged: number;\n  /** Missed closes-without-merge replayed through the rules ingress. */\n  closed: number;\n  /** PRs (or whole repositories) skipped because of an error. */\n  failed: number;\n  /** Error samples with context, capped at {@link RECONCILE_ERROR_SAMPLE_LIMIT}. */\n  errors: Array<{ repository: string; pullRequestNumber?: number; error: string }>;\n}\n\nexport type GithubPullRequestReconciler = (repositories: ReconcileRepository[]) => Promise<ReconcileSweepSummary>;\n\nconst RECONCILE_ERROR_SAMPLE_LIMIT = 5;\n\n/**\n * Extracts the PR number a work item tracks, but only when the item belongs\n * to the given repository. Card URLs pin the repository unambiguously; the\n * legacy source key embeds the repository id. Canonical keys (`github-pr:N`)\n * carry no repository, so they are only trusted when the item has no URL —\n * a project mapped to multiple repositories must not reconcile one repo's\n * card against another repo's PR number.\n */\nfunction reconcilablePullRequestNumber(item: WorkItemRow, repository: ReconcileRepository): number | undefined {\n  if (item.externalSource?.type !== 'pull-request') return undefined;\n  const url = item.externalSource.url;\n  if (url) {\n    const match = /^https?:\\/\\/[^/]+\\/(.+)\\/pull\\/(\\d+)(?:[/?#]|$)/.exec(url);\n    if (!match) return undefined;\n    return match[1] === repository.fullName ? Number(match[2]) : undefined;\n  }\n  const externalId = item.externalSource.externalId;\n  const legacy = /^github:(\\d+):pull-request:(\\d+)$/.exec(externalId);\n  if (legacy) return Number(legacy[1]) === repository.id ? Number(legacy[2]) : undefined;\n  const canonical = /^github-pr:(\\d+)$/.exec(externalId);\n  return canonical ? Number(canonical[1]) : undefined;\n}\n\nexport function reconciledClosedEvent(\n  repository: ReconcileRepository,\n  pullRequestNumber: number,\n  state: ReconcilePullRequestState,\n): ParsedGithubWebhook {\n  return {\n    event: 'pull_request',\n    // Stable per (repository, PR, outcome): the ingress dedupe makes repeat\n    // reconcile cycles replay instead of re-committing decisions.\n    deliveryId: `reconcile:${repository.id}:pull-request:${pullRequestNumber}:${state.merged ? 'merged' : 'closed'}`,\n    payload: {\n      action: 'closed',\n      installation: { id: repository.installationId },\n      repository: { id: repository.id, full_name: repository.fullName },\n      sender: { login: state.mergedBy ?? 'github' },\n      pull_request: {\n        number: pullRequestNumber,\n        title: state.title,\n        html_url: state.url,\n        ...(state.createdAt ? { created_at: state.createdAt } : {}),\n        state: 'closed',\n        merged: state.merged,\n        head: { ref: state.headBranch },\n        base: { ref: state.baseBranch },\n      },\n    },\n  };\n}\n\n/**\n * State-based safety net for merge signals: webhooks and event-log tailing\n * can miss a merge (cursor gaps, downtime, terminally failed decisions), so\n * this sweep compares still-open PR cards against actual GitHub state and\n * replays the merge through the normal rules ingress when they disagree.\n */\nexport function createGithubPullRequestReconciler(\n  options: GithubRulesOptions,\n  fetchPullRequest: GithubPullRequestFetcher,\n): GithubPullRequestReconciler {\n  const rules = new GithubRules(options);\n  return async repositories => {\n    const summary: ReconcileSweepSummary = { repositories: 0, checked: 0, merged: 0, closed: 0, failed: 0, errors: [] };\n    const recordFailure = (repository: ReconcileRepository, error: unknown, pullRequestNumber?: number) => {\n      summary.failed += 1;\n      if (summary.errors.length < RECONCILE_ERROR_SAMPLE_LIMIT) {\n        summary.errors.push({\n          repository: repository.fullName,\n          ...(pullRequestNumber === undefined ? {} : { pullRequestNumber }),\n          error: error instanceof Error ? error.message : String(error),\n        });\n      }\n    };\n    // An installation can expose hundreds of repositories; only the ones\n    // actually linked to a factory project can have cards to reconcile, so\n    // scope the sweep to those up front instead of probing each repository.\n    const configured = new Set(\n      (await options.sourceControl.projectRepositories.listConfiguredExternalKeys()).map(\n        key => `${key.installationExternalId}\\u0000${key.repositoryExternalId}`,\n      ),\n    );\n    const scoped = repositories.filter(repository =>\n      configured.has(`${repository.installationId}\\u0000${repository.id}`),\n    );\n    summary.repositories = scoped.length;\n    for (const repository of scoped) {\n      // One broken repository (or a failing token exchange for its\n      // installation) must not abort the sweep for the others.\n      let numbers: Set<number>;\n      try {\n        const projects = await options.sourceControl.projectRepositories.listByExternalRepository({\n          installationExternalId: String(repository.installationId),\n          repositoryExternalId: String(repository.id),\n        });\n        if (projects.length === 0) continue;\n        numbers = new Set<number>();\n        for (const project of projects) {\n          const items = await options.storage.list({\n            orgId: project.orgId,\n            factoryProjectId: project.factoryProjectId,\n          });\n          for (const item of items) {\n            const stage = item.stages[0];\n            if (stage === 'done' || stage === 'canceled') continue;\n            const pullRequestNumber = reconcilablePullRequestNumber(item, repository);\n            if (pullRequestNumber) numbers.add(pullRequestNumber);\n          }\n        }\n      } catch (error) {\n        recordFailure(repository, error);\n        continue;\n      }\n      for (const pullRequestNumber of numbers) {\n        try {\n          const state = await fetchPullRequest({\n            installationId: repository.installationId,\n            repository: repository.fullName,\n            number: pullRequestNumber,\n          });\n          summary.checked += 1;\n          if (!state || state.state !== 'closed') continue;\n          await rules.ingest(reconciledClosedEvent(repository, pullRequestNumber, state));\n          if (state.merged) summary.merged += 1;\n          else summary.closed += 1;\n        } catch (error) {\n          recordFailure(repository, error, pullRequestNumber);\n        }\n      }\n    }\n    return summary;\n  };\n}\n\nfunction githubRulesOptions(github: GithubRulesIntegration, context: IntegrationContext): GithubRulesOptions | undefined {\n  if (!context.rules) return undefined;\n  return {\n    github,\n    sourceControl: context.storage.sourceControl,\n    integrationStorage: context.storage.generic,\n    projects: context.storage.projects,\n    storage: context.rules.workItems,\n    rules: context.rules.config,\n  };\n}\n\nexport function attachGithubRules(\n  github: GithubRulesIntegration,\n  context: IntegrationContext,\n): ((event: ParsedGithubWebhook) => Promise<unknown>) | undefined {\n  const options = githubRulesOptions(github, context);\n  if (!options) return undefined;\n  const rules = new GithubRules(options);\n  return event => rules.ingest(event);\n}\n\nexport function attachGithubReconciler(\n  github: GithubRulesIntegration,\n  context: IntegrationContext,\n  fetchPullRequest: GithubPullRequestFetcher,\n): GithubPullRequestReconciler | undefined {\n  const options = githubRulesOptions(github, context);\n  if (!options) return undefined;\n  return createGithubPullRequestReconciler(options, fetchPullRequest);\n}\n"],"mappings":";;;AAoBA,MAAM,sCAAsB,IAAI,IAAI,CAAC,SAAS,OAAO,CAAC;AACtD,MAAM,kBAAkB;AAExB,eAAe,gBAAmB,SAAiC;CACjE,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,SACA,IAAI,SAAgB,GAAG,WAAW;GAChC,UAAU,iBAAiB,uBAAO,IAAI,MAAM,sBAAsB,CAAC,GAAG,eAAe;EACvF,CAAC,CACH,CAAC;CACH,UAAU;EACR,IAAI,SAAS,aAAa,OAAO;CACnC;AACF;AAEA,SAAS,OAAO,OAAqD;CACnE,OAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAK,QAAoC,KAAA;AAC5G;AAEA,SAAS,OAAO,OAAoC;CAClD,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ,KAAA;AACjE;AAEA,SAAS,OAAO,OAAoC;CAClD,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,QAAQ,KAAA;AACvE;AAEA,SAAS,QAAQ,OAAqC;CACpD,OAAO,OAAO,UAAU,YAAY,QAAQ,KAAA;AAC9C;AAEA,SAAS,UAAU,QAAiE;CAClF,MAAM,SAAS,OAAO,OAAO,QAAQ,MAAM;CAC3C,IAAI,OAAO,UAAU,YAAY,WAAW,UAAU,OAAO;CAC7D,IAAI,OAAO,UAAU,kBAAkB,WAAW,UAAU,OAAO;CACnE,IAAI,OAAO,UAAU,kBAAkB,WAAW,eAAe,OAAO;CACxE,IAAI,OAAO,UAAU,kBAAkB,WAAW,UAChD,OAAO,QAAQ,OAAO,OAAO,QAAQ,YAAY,CAAC,EAAE,MAAM,IAAI,sBAAsB;CAEtF,IAAI,OAAO,UAAU,kBAAkB,WAAW,oBAAoB,OAAO;AAE/E;AAEA,SAAS,mBAAmB,MAAgC,YAA4B;CACtF,OAAO,SAAS,UAAU,gBAAgB,eAAe,aAAa;AACxE;AAEA,SAAS,gBAAgB,cAAsB,MAAgC,YAA4B;CACzG,OAAO,UAAU,aAAa,GAAG,KAAK,GAAG;AAC3C;AAEA,SAAS,iBAAiB,cAAsB,mBAAmC;CACjF,OAAO,yBAAyB,aAAa,GAAG;AAClD;AAEA,SAAS,eAAe,MAAmB;CACzC,IAAI,CAAC,KAAK,gBAAgB,OAAO;CACjC,OAAO,KAAK,eAAe,SAAS,iBAAkB,cAAyB;AACjF;AAEA,SAAS,kBAAkB,MAAkC;CAC3D,OAAO,KAAK,gBAAgB,cAAc;AAC5C;AAEA,eAAe,YACb,QACA,OAC2B;CAC3B,IAAI,UAAU;CACd,IAAI;EACF,MAAM,aAAa,MAAM,OAAO,oCAC9B,MAAM,gBACN,MAAM,YACN,MAAM,KACR;EACA,UAAU,eAAe,KAAA,KAAa,oBAAoB,IAAI,UAAU;CAC1E,QAAQ;EACN,UAAU;CACZ;CACA,OAAO;EAAE,MAAM;EAAU,OAAO,MAAM;EAAO;EAAS,iBAAiB,MAAM;CAAgB;AAC/F;AAOA,SAAS,sBAAsB,MAAoF;CACjH,IAAI,CAAC,QAAQ,KAAK,SAAS,2BAA2B,OAAO,KAAK,eAAe,UAAU,OAAO;CAClG,OAAO;EAAE,MAAM;EAAyB,YAAY,KAAK;CAAW;AACtE;AAoBA,IAAa,cAAb,MAAyB;CACM;CAA7B,YAAY,SAA8C;EAA7B,KAAA,UAAA;CAA8B;CAE3D,MAAM,OAAO,QAAoG;EAC/G,MAAM,QAAQ,UAAU,MAAM;EAC9B,MAAM,aAAa,OAAO,OAAO,QAAQ,UAAU;EACnD,MAAM,iBAAiB,OAAO,OAAO,OAAO,QAAQ,YAAY,CAAC,EAAE,EAAE;EACrE,MAAM,eAAe,OAAO,YAAY,EAAE;EAC1C,MAAM,iBAAiB,OAAO,YAAY,SAAS;EACnD,MAAM,QAAQ,OAAO,OAAO,OAAO,QAAQ,MAAM,CAAC,EAAE,KAAK;EACzD,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,OAAO,OAAO,EAAE,QAAQ,UAAU;EAExG,MAAM,WAAW,MAAM,KAAK,QAAQ,cAAc,oBAAoB,yBAAyB;GAC7F,wBAAwB,OAAO,cAAc;GAC7C,sBAAsB,OAAO,YAAY;EAC3C,CAAC;EACD,IAAI,SAAS,WAAW,GAAG,OAAO,EAAE,QAAQ,UAAU;EACtD,MAAM,UAAU,CAAC;EACjB,KAAK,MAAM,WAAW,UACpB,QAAQ,KACN,MAAM,KAAKA,eAAe,QAAQ,OAAO,gBAAgB,cAAc,gBAAgB,OAAO,OAAO,CACvG;EAEF,IAAI,QAAQ,MAAK,WAAU,OAAO,WAAW,WAAW,GAAG,OAAO,EAAE,QAAQ,YAAY;EACxF,IAAI,QAAQ,MAAK,WAAU,OAAO,WAAW,UAAU,GAAG,OAAO,EAAE,QAAQ,WAAW;EACtF,OAAO,QAAQ,MAAM,EAAE,QAAQ,UAAU;CAC3C;CAEA,MAAMA,eACJ,QACA,OACA,gBACA,cACA,gBACA,OACA,SAC2D;EAC3D,MAAM,iBAAiB,MAAM,KAAK,QAAQ,SAAS,IAAI;GACrD,OAAO,QAAQ;GACf,IAAI,QAAQ;EACd,CAAC;EACD,IAAI,CAAC,gBAAgB,OAAO,EAAE,QAAQ,UAAU;EAChD,MAAM,QAAQ,OAAO,OAAO,QAAQ,KAAK;EACzC,MAAM,cAAc,OAAO,OAAO,QAAQ,YAAY;EACtD,MAAM,cAAc,OAAO,OAAO,MAAM;EACxC,MAAM,oBAAoB,OAAO,aAAa,MAAM;EACpD,MAAM,aAAa,oBACf,uBAEI,MAAM,KAAK,QAAQ,mBAAmB,cAAc,aAClD,iBAAiB,cAAc,iBAAiB,GAChD,EAAE,QAAQ,SAAS,CACrB,EAAA,CACA,MAAK,iBAAgB,aAAa,UAAU,QAAQ,KAAK,CAAC,EAAE,IAChE,IACA;EACJ,MAAM,cAAc,MAAM,KAAKC,aAC7B,QAAQ,OACR,QAAQ,kBACR,cACA,aACA,mBACA,OAAO,OAAO,aAAa,IAAI,CAAC,EAAE,GAAG,GACrC,UACF;EACA,MAAM,QAAQ,MAAM,YAAY,KAAK,QAAQ,QAAQ;GACnD;GACA,YAAY;GACZ;GACA,iBAAiB,eAAe;EAClC,CAAC;EACD,MAAM,UAAoC;GACxC,QAAQ;IAAE,OAAO,QAAQ;IAAO,WAAW,QAAQ;GAAiB;GACpE;GACA,SAAS;IAAE,MAAM;IAAU,IAAI,GAAG,eAAe,GAAG,OAAO;GAAa;GACxE,OAAO,UAAU;GACjB,aAAa,CAAC;GACd,gBAAgB,KAAK,QAAQ,MAAM;GACnC,GAAI,cACA;IACE,MAAM;KACJ,IAAI,YAAY;KAChB,QAAQ,eAAe,WAAW;KAClC,WAAW,kBAAkB,WAAW;KACxC,kBAAkB,YAAY;KAC9B,OAAO,YAAY;KACnB,KAAK,YAAY,gBAAgB,OAAO;KACxC,QAAQ,YAAY;IACtB;IACA,OAAO,YAAY,gBAAgB,SAAS,iBAAkB,WAAsB;IACpF,cAAc,YAAY;GAC5B,IACA,CAAC;GACL;GACA,YAAY,OAAO;GACnB,SAAS,EAAE,WAAW,eAAe,UAAU,YAAY,EAAE;GAC7D,YAAY;IAAE,IAAI;IAAc,UAAU;GAAe;GACzD,GAAI,eAAe,OAAO,OAAO,KAAK,KAAK,OAAO,OAAO,QAAQ,IAC7D,EACE,OAAO;IACL,QAAQ;IACR,OAAO,OAAO,OAAO,KAAK;IAC1B,KAAK,OAAO,OAAO,QAAQ;IAC3B,GAAI,OAAO,OAAO,UAAU,IAAI,EAAE,WAAW,OAAO,OAAO,UAAU,EAAE,IAAI,CAAC;GAC9E,EACF,IACA,CAAC;GACL,GAAI,qBAAqB,OAAO,aAAa,KAAK,KAAK,OAAO,aAAa,QAAQ,IAC/E,EACE,aAAa;IACX,QAAQ;IACR,OAAO,OAAO,aAAa,KAAK;IAChC,KAAK,OAAO,aAAa,QAAQ;IACjC,GAAI,OAAO,aAAa,UAAU,IAAI,EAAE,WAAW,OAAO,aAAa,UAAU,EAAE,IAAI,CAAC;IACxF,OAAO,OAAO,aAAa,KAAK,MAAM,WAAY,WAAsB;IACxE,QAAQ,QAAQ,aAAa,MAAM,KAAK;IACxC,YAAY,OAAO,OAAO,aAAa,IAAI,CAAC,EAAE,GAAG,KAAK;IACtD,YAAY,OAAO,OAAO,aAAa,IAAI,CAAC,EAAE,GAAG,KAAK;GACxD,EACF,IACA,CAAC;GACL,GAAI,OAAO,OAAO,QAAQ,MAAM,IAC5B,EACE,QAAQ;IACN,IAAI,OAAO,OAAO,OAAO,QAAQ,MAAM,CAAC,EAAE,EAAE,KAAK;IACjD,OAAO,OAAO,OAAO,OAAO,QAAQ,MAAM,CAAC,EAAE,KAAK,KAAK;IACvD,KAAK,OAAO,OAAO,OAAO,QAAQ,MAAM,CAAC,EAAE,QAAQ,KAAK;GAC1D,EACF,IACA,CAAC;EACP;EAEA,MAAM,OAAO,yBAAyB,KAAK,QAAQ,OAAO,KAAK;EAC/D,IAAI;EACJ,IAAI,YAAuC,CAAC;EAC5C,IAAI,UAA+E,EAAE,QAAQ,WAAW;EACxG,IAAI;GACF,WAAW,OAAO,MAAM,gBAAgB,QAAQ,QAAQ,KAAK,OAAO,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,KAAA;GACzF,IAAI,UAAU,SAAS,UACrB,UAAU;IAAE,QAAQ;IAAY,MAAM,SAAS;IAAM,QAAQ,SAAS;GAAO;QACxE,IAAI,UACT,YAAY,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAI,WAAU,EAAE,GAAG,MAAM,EAAE;EAEpF,SAAS,OAAO;GACd,MAAM,WAAW,iBAAiB,SAAS,MAAM,YAAY;GAC7D,UAAU;IACR,QAAQ;IACR,MAAM,WAAW,YAAY;IAC7B,QAAQ,WACJ,uCACA,iBAAiB,QACf,MAAM,QAAQ,MAAM,GAAG,GAAK,IAC5B;GACR;EACF;EAeA,OAAO,EAAE,SAAQ,MAbO,KAAK,QAAQ,QAAQ,qBAAqB;GAChE,OAAO,QAAQ;GACf,kBAAkB,QAAQ;GAC1B,YAAY,aAAa,MAAM;GAC/B,SAAS;IAAE,UAAU,GAAG,eAAe,GAAG,OAAO;IAAc,aAAa,UAAU;GAAQ;GAC9F,gBAAgB,KAAK,QAAQ,MAAM;GACnC,kBAAkB,aAAa,YAAY;GAC3C,OAAO,EAAE,GAAG,MAAM;GAClB;GACA;GACA,aAAa,CAAC;GACd,qBAAK,IAAI,KAAK;EAChB,CAAC,EAAA,CAC0B,OAAO;CACpC;CAEA,MAAMA,aACJ,OACA,WACA,cACA,aACA,mBACA,uBACA,YACkC;EAClC,MAAM,QAAQ,MAAM,KAAK,QAAQ,QAAQ,KAAK;GAAE;GAAO,kBAAkB;EAAU,CAAC;EACpF,IAAI,YAAY,OAAO,MAAM,MAAK,SAAQ,KAAK,OAAO,WAAW,UAAU;EAC3E,IAAI,aACF,OACE,MAAM,MAAK,SAAQ,KAAK,gBAAgB,eAAe,mBAAmB,SAAS,WAAW,CAAC,KAC/F,MAAM,MAAK,SAAQ,KAAK,gBAAgB,eAAe,gBAAgB,cAAc,SAAS,WAAW,CAAC;EAG9G,IAAI,mBACF,OACE,MAAM,MAAK,SAAQ,KAAK,gBAAgB,eAAe,mBAAmB,gBAAgB,iBAAiB,CAAC,KAC5G,MAAM,MACJ,SAAQ,KAAK,gBAAgB,eAAe,gBAAgB,cAAc,gBAAgB,iBAAiB,CAC7G,MAMC,wBACG,MAAM,MACJ,SACE,KAAK,gBAAgB,SAAS,kBAC9B,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,MAAK,YAAW,QAAQ,WAAW,qBAAqB,CACzF,IACA,KAAA;CAIV;AACF;AA0CA,MAAM,+BAA+B;;;;;;;;;AAUrC,SAAS,8BAA8B,MAAmB,YAAqD;CAC7G,IAAI,KAAK,gBAAgB,SAAS,gBAAgB,OAAO,KAAA;CACzD,MAAM,MAAM,KAAK,eAAe;CAChC,IAAI,KAAK;EACP,MAAM,QAAQ,kDAAkD,KAAK,GAAG;EACxE,IAAI,CAAC,OAAO,OAAO,KAAA;EACnB,OAAO,MAAM,OAAO,WAAW,WAAW,OAAO,MAAM,EAAE,IAAI,KAAA;CAC/D;CACA,MAAM,aAAa,KAAK,eAAe;CACvC,MAAM,SAAS,oCAAoC,KAAK,UAAU;CAClE,IAAI,QAAQ,OAAO,OAAO,OAAO,EAAE,MAAM,WAAW,KAAK,OAAO,OAAO,EAAE,IAAI,KAAA;CAC7E,MAAM,YAAY,oBAAoB,KAAK,UAAU;CACrD,OAAO,YAAY,OAAO,UAAU,EAAE,IAAI,KAAA;AAC5C;AAEA,SAAgB,sBACd,YACA,mBACA,OACqB;CACrB,OAAO;EACL,OAAO;EAGP,YAAY,aAAa,WAAW,GAAG,gBAAgB,kBAAkB,GAAG,MAAM,SAAS,WAAW;EACtG,SAAS;GACP,QAAQ;GACR,cAAc,EAAE,IAAI,WAAW,eAAe;GAC9C,YAAY;IAAE,IAAI,WAAW;IAAI,WAAW,WAAW;GAAS;GAChE,QAAQ,EAAE,OAAO,MAAM,YAAY,SAAS;GAC5C,cAAc;IACZ,QAAQ;IACR,OAAO,MAAM;IACb,UAAU,MAAM;IAChB,GAAI,MAAM,YAAY,EAAE,YAAY,MAAM,UAAU,IAAI,CAAC;IACzD,OAAO;IACP,QAAQ,MAAM;IACd,MAAM,EAAE,KAAK,MAAM,WAAW;IAC9B,MAAM,EAAE,KAAK,MAAM,WAAW;GAChC;EACF;CACF;AACF;;;;;;;AAQA,SAAgB,kCACd,SACA,kBAC6B;CAC7B,MAAM,QAAQ,IAAI,YAAY,OAAO;CACrC,OAAO,OAAM,iBAAgB;EAC3B,MAAM,UAAiC;GAAE,cAAc;GAAG,SAAS;GAAG,QAAQ;GAAG,QAAQ;GAAG,QAAQ;GAAG,QAAQ,CAAC;EAAE;EAClH,MAAM,iBAAiB,YAAiC,OAAgB,sBAA+B;GACrG,QAAQ,UAAU;GAClB,IAAI,QAAQ,OAAO,SAAS,8BAC1B,QAAQ,OAAO,KAAK;IAClB,YAAY,WAAW;IACvB,GAAI,sBAAsB,KAAA,IAAY,CAAC,IAAI,EAAE,kBAAkB;IAC/D,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC9D,CAAC;EAEL;EAIA,MAAM,aAAa,IAAI,KACpB,MAAM,QAAQ,cAAc,oBAAoB,2BAA2B,EAAA,CAAG,KAC7E,QAAO,GAAG,IAAI,uBAAuB,QAAQ,IAAI,sBACnD,CACF;EACA,MAAM,SAAS,aAAa,QAAO,eACjC,WAAW,IAAI,GAAG,WAAW,eAAe,QAAQ,WAAW,IAAI,CACrE;EACA,QAAQ,eAAe,OAAO;EAC9B,KAAK,MAAM,cAAc,QAAQ;GAG/B,IAAI;GACJ,IAAI;IACF,MAAM,WAAW,MAAM,QAAQ,cAAc,oBAAoB,yBAAyB;KACxF,wBAAwB,OAAO,WAAW,cAAc;KACxD,sBAAsB,OAAO,WAAW,EAAE;IAC5C,CAAC;IACD,IAAI,SAAS,WAAW,GAAG;IAC3B,0BAAU,IAAI,IAAY;IAC1B,KAAK,MAAM,WAAW,UAAU;KAC9B,MAAM,QAAQ,MAAM,QAAQ,QAAQ,KAAK;MACvC,OAAO,QAAQ;MACf,kBAAkB,QAAQ;KAC5B,CAAC;KACD,KAAK,MAAM,QAAQ,OAAO;MACxB,MAAM,QAAQ,KAAK,OAAO;MAC1B,IAAI,UAAU,UAAU,UAAU,YAAY;MAC9C,MAAM,oBAAoB,8BAA8B,MAAM,UAAU;MACxE,IAAI,mBAAmB,QAAQ,IAAI,iBAAiB;KACtD;IACF;GACF,SAAS,OAAO;IACd,cAAc,YAAY,KAAK;IAC/B;GACF;GACA,KAAK,MAAM,qBAAqB,SAC9B,IAAI;IACF,MAAM,QAAQ,MAAM,iBAAiB;KACnC,gBAAgB,WAAW;KAC3B,YAAY,WAAW;KACvB,QAAQ;IACV,CAAC;IACD,QAAQ,WAAW;IACnB,IAAI,CAAC,SAAS,MAAM,UAAU,UAAU;IACxC,MAAM,MAAM,OAAO,sBAAsB,YAAY,mBAAmB,KAAK,CAAC;IAC9E,IAAI,MAAM,QAAQ,QAAQ,UAAU;SAC/B,QAAQ,UAAU;GACzB,SAAS,OAAO;IACd,cAAc,YAAY,OAAO,iBAAiB;GACpD;EAEJ;EACA,OAAO;CACT;AACF;AAEA,SAAS,mBAAmB,QAAgC,SAA6D;CACvH,IAAI,CAAC,QAAQ,OAAO,OAAO,KAAA;CAC3B,OAAO;EACL;EACA,eAAe,QAAQ,QAAQ;EAC/B,oBAAoB,QAAQ,QAAQ;EACpC,UAAU,QAAQ,QAAQ;EAC1B,SAAS,QAAQ,MAAM;EACvB,OAAO,QAAQ,MAAM;CACvB;AACF;AAEA,SAAgB,kBACd,QACA,SACgE;CAChE,MAAM,UAAU,mBAAmB,QAAQ,OAAO;CAClD,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,MAAM,QAAQ,IAAI,YAAY,OAAO;CACrC,QAAO,UAAS,MAAM,OAAO,KAAK;AACpC;AAEA,SAAgB,uBACd,QACA,SACA,kBACyC;CACzC,MAAM,UAAU,mBAAmB,QAAQ,OAAO;CAClD,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,OAAO,kCAAkC,SAAS,gBAAgB;AACpE"}

package/dist/integrations/github/sandbox-release.d.ts

@@ -0,0 +1,38 @@
+import type { SandboxFleet } from '../../sandbox/fleet.js';
+import type { SourceControlStorageHandle } from '../../storage/domains/source-control/base.js';
+import type { WorkItemsStorage } from '../../storage/domains/work-items/base.js';
+/**
+ * Scrub a sandbox that is about to enter the reuse pool: force-checkout the
+ * default branch and drop the released session's local state, so idle pooled
+ * VMs don't sit on stale branches, dirty worktrees, or abandoned work while
+ * they wait for the next claim. Best-effort — the VM may already be reaped
+ * (the pooled claim then falls back to fresh provisioning) and the claim
+ * path recycles the workdir again before reuse, so a failed scrub never
+ * blocks the release.
+ */
+export declare function cleanReleasedSandbox(options: {
+    fleet: Pick<SandboxFleet, 'reattachSandbox'>;
+    sourceControl: Pick<SourceControlStorageHandle, 'projectRepositories' | 'repositories'>;
+    orgId: string;
+    projectRepositoryId: string;
+    sandboxId: string;
+    sandboxWorkdir: string;
+}): Promise<void>;
+/**
+ * Release the sandboxes held by a work item's sessions back to the reuse pool.
+ *
+ * Called when the item commits into a terminal stage (`done` / `canceled`):
+ * its branch sessions stop receiving runs, so their VMs — which would
+ * otherwise idle until the provider reaps them — can serve the next session
+ * for the same repository instead of a fresh provision. Each session
+ * keeps its row (a reopened branch simply claims a pooled VM or provisions
+ * fresh on next use); it only loses its sandbox binding.
+ */
+export declare function releaseWorkItemSandboxes(options: {
+    workItems: Pick<WorkItemsStorage, 'get'>;
+    sourceControl: Pick<SourceControlStorageHandle, 'sessions' | 'sandboxPool' | 'projectRepositories' | 'repositories'>;
+    fleet: Pick<SandboxFleet, 'reattachSandbox'>;
+    orgId: string;
+    workItemId: string;
+}): Promise<void>;
+//# sourceMappingURL=sandbox-release.d.ts.map

package/dist/integrations/github/sandbox-release.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-release.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/sandbox-release.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAGjF;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;IAC7C,aAAa,EAAE,IAAI,CAAC,0BAA0B,EAAE,qBAAqB,GAAG,cAAc,CAAC,CAAC;IACxF,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBhB;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE;IACtD,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACzC,aAAa,EAAE,IAAI,CAAC,0BAA0B,EAAE,UAAU,GAAG,aAAa,GAAG,qBAAqB,GAAG,cAAc,CAAC,CAAC;IACrH,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB"}

package/dist/integrations/github/sandbox-release.js

@@ -0,0 +1,74 @@
+import { recycleClaimedWorkdir } from "./sandbox.js";
+//#region src/integrations/github/sandbox-release.ts
+/**
+* Scrub a sandbox that is about to enter the reuse pool: force-checkout the
+* default branch and drop the released session's local state, so idle pooled
+* VMs don't sit on stale branches, dirty worktrees, or abandoned work while
+* they wait for the next claim. Best-effort — the VM may already be reaped
+* (the pooled claim then falls back to fresh provisioning) and the claim
+* path recycles the workdir again before reuse, so a failed scrub never
+* blocks the release.
+*/
+async function cleanReleasedSandbox(options) {
+	try {
+		const projectRepository = await options.sourceControl.projectRepositories.get({
+			orgId: options.orgId,
+			id: options.projectRepositoryId
+		});
+		if (!projectRepository) return;
+		const repository = await options.sourceControl.repositories.get({
+			orgId: options.orgId,
+			id: projectRepository.repositoryId
+		});
+		if (!repository) return;
+		await recycleClaimedWorkdir(await options.fleet.reattachSandbox(options.sandboxId), options.sandboxWorkdir, repository.defaultBranch);
+	} catch {}
+}
+/**
+* Release the sandboxes held by a work item's sessions back to the reuse pool.
+*
+* Called when the item commits into a terminal stage (`done` / `canceled`):
+* its branch sessions stop receiving runs, so their VMs — which would
+* otherwise idle until the provider reaps them — can serve the next session
+* for the same repository instead of a fresh provision. Each session
+* keeps its row (a reopened branch simply claims a pooled VM or provisions
+* fresh on next use); it only loses its sandbox binding.
+*/
+async function releaseWorkItemSandboxes(options) {
+	const { workItems, sourceControl } = options;
+	const item = await workItems.get({
+		orgId: options.orgId,
+		id: options.workItemId
+	});
+	if (!item) return;
+	const sessionIds = [...new Set(Object.values(item.sessions).map((session) => session.sessionId))];
+	for (const sessionId of sessionIds) {
+		const session = await sourceControl.sessions.getBySessionId(sessionId);
+		if (!session || session.orgId !== options.orgId) continue;
+		if (!session.sandboxId || !session.sandboxWorkdir) continue;
+		await cleanReleasedSandbox({
+			fleet: options.fleet,
+			sourceControl,
+			orgId: session.orgId,
+			projectRepositoryId: session.projectRepositoryId,
+			sandboxId: session.sandboxId,
+			sandboxWorkdir: session.sandboxWorkdir
+		});
+		await sourceControl.sandboxPool.release({
+			orgId: session.orgId,
+			projectRepositoryId: session.projectRepositoryId,
+			userId: session.userId,
+			sandboxId: session.sandboxId,
+			sandboxWorkdir: session.sandboxWorkdir
+		});
+		await sourceControl.sessions.setSandbox({
+			id: session.id,
+			sandboxId: null,
+			sandboxWorkdir: session.sandboxWorkdir
+		});
+	}
+}
+//#endregion
+export { cleanReleasedSandbox, releaseWorkItemSandboxes };
+
+//# sourceMappingURL=sandbox-release.js.map

package/dist/integrations/github/sandbox-release.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-release.js","names":[],"sources":["../../../src/integrations/github/sandbox-release.ts"],"sourcesContent":["import type { SandboxFleet } from '../../sandbox/fleet.js';\nimport type { SourceControlStorageHandle } from '../../storage/domains/source-control/base.js';\nimport type { WorkItemsStorage } from '../../storage/domains/work-items/base.js';\nimport { recycleClaimedWorkdir } from './sandbox.js';\n\n/**\n * Scrub a sandbox that is about to enter the reuse pool: force-checkout the\n * default branch and drop the released session's local state, so idle pooled\n * VMs don't sit on stale branches, dirty worktrees, or abandoned work while\n * they wait for the next claim. Best-effort — the VM may already be reaped\n * (the pooled claim then falls back to fresh provisioning) and the claim\n * path recycles the workdir again before reuse, so a failed scrub never\n * blocks the release.\n */\nexport async function cleanReleasedSandbox(options: {\n  fleet: Pick<SandboxFleet, 'reattachSandbox'>;\n  sourceControl: Pick<SourceControlStorageHandle, 'projectRepositories' | 'repositories'>;\n  orgId: string;\n  projectRepositoryId: string;\n  sandboxId: string;\n  sandboxWorkdir: string;\n}): Promise<void> {\n  try {\n    const projectRepository = await options.sourceControl.projectRepositories.get({\n      orgId: options.orgId,\n      id: options.projectRepositoryId,\n    });\n    if (!projectRepository) return;\n    const repository = await options.sourceControl.repositories.get({\n      orgId: options.orgId,\n      id: projectRepository.repositoryId,\n    });\n    if (!repository) return;\n    const sandbox = await options.fleet.reattachSandbox(options.sandboxId);\n    await recycleClaimedWorkdir(sandbox, options.sandboxWorkdir, repository.defaultBranch);\n  } catch {\n    // Reaped, unreachable, or wedged — the claim-side recycle is the\n    // correctness guarantee; this scrub is hygiene for idle VMs.\n  }\n}\n\n/**\n * Release the sandboxes held by a work item's sessions back to the reuse pool.\n *\n * Called when the item commits into a terminal stage (`done` / `canceled`):\n * its branch sessions stop receiving runs, so their VMs — which would\n * otherwise idle until the provider reaps them — can serve the next session\n * for the same repository instead of a fresh provision. Each session\n * keeps its row (a reopened branch simply claims a pooled VM or provisions\n * fresh on next use); it only loses its sandbox binding.\n */\nexport async function releaseWorkItemSandboxes(options: {\n  workItems: Pick<WorkItemsStorage, 'get'>;\n  sourceControl: Pick<SourceControlStorageHandle, 'sessions' | 'sandboxPool' | 'projectRepositories' | 'repositories'>;\n  fleet: Pick<SandboxFleet, 'reattachSandbox'>;\n  orgId: string;\n  workItemId: string;\n}): Promise<void> {\n  const { workItems, sourceControl } = options;\n  const item = await workItems.get({ orgId: options.orgId, id: options.workItemId });\n  if (!item) return;\n  const sessionIds = [...new Set(Object.values(item.sessions).map(session => session.sessionId))];\n  for (const sessionId of sessionIds) {\n    const session = await sourceControl.sessions.getBySessionId(sessionId);\n    if (!session || session.orgId !== options.orgId) continue;\n    if (!session.sandboxId || !session.sandboxWorkdir) continue;\n    await cleanReleasedSandbox({\n      fleet: options.fleet,\n      sourceControl,\n      orgId: session.orgId,\n      projectRepositoryId: session.projectRepositoryId,\n      sandboxId: session.sandboxId,\n      sandboxWorkdir: session.sandboxWorkdir,\n    });\n    await sourceControl.sandboxPool.release({\n      orgId: session.orgId,\n      projectRepositoryId: session.projectRepositoryId,\n      userId: session.userId,\n      sandboxId: session.sandboxId,\n      sandboxWorkdir: session.sandboxWorkdir,\n    });\n    await sourceControl.sessions.setSandbox({\n      id: session.id,\n      sandboxId: null,\n      sandboxWorkdir: session.sandboxWorkdir,\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;AAcA,eAAsB,qBAAqB,SAOzB;CAChB,IAAI;EACF,MAAM,oBAAoB,MAAM,QAAQ,cAAc,oBAAoB,IAAI;GAC5E,OAAO,QAAQ;GACf,IAAI,QAAQ;EACd,CAAC;EACD,IAAI,CAAC,mBAAmB;EACxB,MAAM,aAAa,MAAM,QAAQ,cAAc,aAAa,IAAI;GAC9D,OAAO,QAAQ;GACf,IAAI,kBAAkB;EACxB,CAAC;EACD,IAAI,CAAC,YAAY;EAEjB,MAAM,sBAAsB,MADN,QAAQ,MAAM,gBAAgB,QAAQ,SAAS,GAChC,QAAQ,gBAAgB,WAAW,aAAa;CACvF,QAAQ,CAGR;AACF;;;;;;;;;;;AAYA,eAAsB,yBAAyB,SAM7B;CAChB,MAAM,EAAE,WAAW,kBAAkB;CACrC,MAAM,OAAO,MAAM,UAAU,IAAI;EAAE,OAAO,QAAQ;EAAO,IAAI,QAAQ;CAAW,CAAC;CACjF,IAAI,CAAC,MAAM;CACX,MAAM,aAAa,CAAC,GAAG,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,KAAI,YAAW,QAAQ,SAAS,CAAC,CAAC;CAC9F,KAAK,MAAM,aAAa,YAAY;EAClC,MAAM,UAAU,MAAM,cAAc,SAAS,eAAe,SAAS;EACrE,IAAI,CAAC,WAAW,QAAQ,UAAU,QAAQ,OAAO;EACjD,IAAI,CAAC,QAAQ,aAAa,CAAC,QAAQ,gBAAgB;EACnD,MAAM,qBAAqB;GACzB,OAAO,QAAQ;GACf;GACA,OAAO,QAAQ;GACf,qBAAqB,QAAQ;GAC7B,WAAW,QAAQ;GACnB,gBAAgB,QAAQ;EAC1B,CAAC;EACD,MAAM,cAAc,YAAY,QAAQ;GACtC,OAAO,QAAQ;GACf,qBAAqB,QAAQ;GAC7B,QAAQ,QAAQ;GAChB,WAAW,QAAQ;GACnB,gBAAgB,QAAQ;EAC1B,CAAC;EACD,MAAM,cAAc,SAAS,WAAW;GACtC,IAAI,QAAQ;GACZ,WAAW;GACX,gBAAgB,QAAQ;EAC1B,CAAC;CACH;AACF"}