@mastra/factory 0.0.0 → 0.1.0-alpha.3

package/dist/integrations/platform/github/integration.js

@@ -0,0 +1,3253 @@
+// src/integrations/platform/github/integration.ts
+import { registerApiRoute as registerApiRoute2 } from "@mastra/core/server";
+
+// src/integrations/github/routes.ts
+import { randomUUID } from "crypto";
+import { registerApiRoute } from "@mastra/core/server";
+import { streamSSE } from "hono/streaming";
+
+// src/sandbox/fleet.ts
+import path from "path";
+function reportProgress(onProgress, event) {
+  if (!onProgress) return;
+  try {
+    onProgress(event);
+  } catch {
+  }
+}
+var SandboxBudgetError = class extends Error {
+  constructor(max) {
+    super(
+      `Sandbox budget exceeded: this server already has ${max} active sandbox(es), the configured per-replica maximum. Close an existing repository's sandbox and try again.`
+    );
+    this.max = max;
+    this.name = "SandboxBudgetError";
+  }
+  max;
+  code = "sandbox-budget-exceeded";
+};
+
+// src/integrations/github/config.ts
+var GITHUB_APP_ENV_VARS = [
+  "GITHUB_APP_ID",
+  "GITHUB_APP_PRIVATE_KEY",
+  "GITHUB_APP_CLIENT_ID",
+  "GITHUB_APP_CLIENT_SECRET",
+  "GITHUB_APP_SLUG"
+];
+function isGithubFeatureEnabled(options) {
+  return options.github !== void 0 && options.auth.enabled();
+}
+function getGithubFeatureDiagnostics(options) {
+  const { github, auth, appDbConfigured, stateSigner, fleet } = options;
+  return {
+    githubAppConfigured: github !== void 0,
+    factoryAuthEnabled: auth.enabled(),
+    appDbConfigured,
+    stateSecretConfigured: stateSigner?.stable ?? false,
+    sandboxEnabled: fleet?.enabled ?? false,
+    sandboxProvider: fleet?.provider ?? "none",
+    missingGithubAppEnvVars: github ? [] : [...GITHUB_APP_ENV_VARS]
+  };
+}
+
+// src/integrations/github/project-lock.ts
+import { createHash } from "crypto";
+var inProcessLocks = /* @__PURE__ */ new Map();
+function hashKey(key) {
+  const digest = createHash("sha256").update(key).digest();
+  const a = digest.readInt32BE(0);
+  const b = digest.readInt32BE(4);
+  return [a, b];
+}
+function withProjectLock(options) {
+  const { key, storage, fn, pool } = options;
+  const prev = inProcessLocks.get(key) ?? Promise.resolve();
+  const run = () => withDbAdvisoryLock({ key, storage, fn, pool });
+  const next = prev.then(run, run);
+  const tail = next.then(
+    () => void 0,
+    () => void 0
+  );
+  inProcessLocks.set(key, tail);
+  void tail.then(() => {
+    if (inProcessLocks.get(key) === tail) {
+      inProcessLocks.delete(key);
+    }
+  });
+  return next;
+}
+async function withDbAdvisoryLock(options) {
+  const { key, storage, fn, pool } = options;
+  if (process.env.MASTRACODE_DISTRIBUTED_LOCK === "0") {
+    return fn();
+  }
+  if (pool) return advisoryLockOver(pool, key, fn);
+  if (typeof storage?.withDistributedLock !== "function") {
+    return fn();
+  }
+  return storage.withDistributedLock(key, fn);
+}
+async function advisoryLockOver(pool, key, fn) {
+  const [k1, k2] = hashKey(key);
+  const client = await pool.connect();
+  try {
+    await client.query("BEGIN");
+    await client.query("SELECT pg_advisory_xact_lock($1, $2)", [k1, k2]);
+    try {
+      const result = await fn();
+      await client.query("COMMIT");
+      return result;
+    } catch (err) {
+      await client.query("ROLLBACK");
+      throw err;
+    }
+  } finally {
+    client.release();
+  }
+}
+
+// src/integrations/github/sandbox.ts
+import { createHash as createHash2 } from "crypto";
+function bindingStore(row, storage) {
+  return {
+    sandboxId: row.sandboxId,
+    setSandboxId: (id) => id === null ? storage.clearBinding({ id: row.id }) : storage.setSandboxId({ id: row.id, sandboxId: id }),
+    clear: () => storage.clearBinding({ id: row.id })
+  };
+}
+async function ensureProjectSandbox(options) {
+  const { fleet, row, storage, onProgress } = options;
+  return fleet.ensureSandbox(bindingStore(row, storage), onProgress);
+}
+async function teardownProjectSandbox(options) {
+  const { fleet, row, storage, sandbox } = options;
+  return fleet.teardownSandbox(bindingStore(row, storage), sandbox);
+}
+function shellQuote(value) {
+  return `'` + value.split(`'`).join(`'\\''`) + `'`;
+}
+async function sh(sandbox, script) {
+  return sandbox.executeCommand("sh", ["-c", script]);
+}
+var MaterializeError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "MaterializeError";
+  }
+  code;
+};
+function tokenUrl(repoFullName, token) {
+  return `https://x-access-token:${token}@github.com/${repoFullName}.git`;
+}
+function cleanUrl(repoFullName) {
+  return `https://github.com/${repoFullName}.git`;
+}
+async function materializeRepo(options) {
+  const { row: sandboxRow, repoInfo, sandbox, token, storage, onProgress } = options;
+  const workdir = sandboxRow.sandboxWorkdir;
+  const repo = repoInfo.repoFullName;
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) {
+    throw new MaterializeError(`Refusing to materialize: invalid repo full name '${repo}'.`, "clone-failed");
+  }
+  if (!/^[A-Za-z0-9_./-]+$/.test(repoInfo.defaultBranch)) {
+    throw new MaterializeError(
+      `Refusing to materialize: invalid default branch '${repoInfo.defaultBranch}'.`,
+      "clone-failed"
+    );
+  }
+  const gitVersion = await sh(sandbox, "git --version");
+  if (gitVersion.exitCode !== 0) {
+    throw new MaterializeError(
+      "git is not installed in the sandbox. The sandbox template must include git.",
+      "git-missing"
+    );
+  }
+  const authUrl = tokenUrl(repo, token);
+  const alreadyMaterialized = Boolean(sandboxRow.materializedAt) || await hasExistingCheckout(sandbox, workdir, repo);
+  try {
+    if (!alreadyMaterialized) {
+      reportProgress(onProgress, {
+        phase: "cloning",
+        message: `Cloning ${repo} (first open can take a minute)\u2026`
+      });
+      const clone = await sh(
+        sandbox,
+        `git clone --depth=1 --single-branch --branch ${shellQuote(repoInfo.defaultBranch)} ${shellQuote(authUrl)} ${shellQuote(workdir)}`
+      );
+      if (clone.exitCode !== 0) {
+        throw classifyGitFailure(clone, "clone-failed");
+      }
+    } else {
+      reportProgress(onProgress, { phase: "pulling", message: `Updating ${repo} to the latest changes\u2026` });
+      const setUrl = await sh(sandbox, `git -C ${shellQuote(workdir)} remote set-url origin ${shellQuote(authUrl)}`);
+      if (setUrl.exitCode !== 0) {
+        throw new MaterializeError(`Failed to set git remote: ${setUrl.stderr}`, "pull-failed");
+      }
+      const pull = await sh(sandbox, `git -C ${shellQuote(workdir)} pull --ff-only`);
+      if (pull.exitCode !== 0) {
+        throw classifyGitFailure(pull, "pull-failed");
+      }
+    }
+  } finally {
+    await scrubRemote(sandbox, workdir, repo, alreadyMaterialized);
+  }
+  reportProgress(onProgress, { phase: "finalizing", message: "Finalizing workspace\u2026" });
+  await storage.markMaterialized({ id: sandboxRow.id });
+}
+async function hasExistingCheckout(sandbox, workdir, repoFullName) {
+  const result = await sh(sandbox, `git -C ${shellQuote(workdir)} remote get-url origin`);
+  if (result.exitCode !== 0) return false;
+  const url = result.stdout.trim().toLowerCase();
+  const suffix = `github.com/${repoFullName.toLowerCase()}`;
+  return url.endsWith(`${suffix}.git`) || url.endsWith(suffix);
+}
+async function scrubRemote(sandbox, workdir, repoFullName, expectGitDir) {
+  const result = await sh(
+    sandbox,
+    `git -C ${shellQuote(workdir)} remote set-url origin ${shellQuote(cleanUrl(repoFullName))}`
+  );
+  if (result.exitCode !== 0 && expectGitDir) {
+    throw new MaterializeError(
+      `Failed to scrub installation token from git remote: ${result.stderr.trim() || result.stdout.trim()}`,
+      "pull-failed"
+    );
+  }
+}
+function classifyGitFailure(result, fallback) {
+  const stderr = result.stderr || "";
+  if (/could not resolve host|failed to connect|network is unreachable|Connection timed out/i.test(stderr)) {
+    return new MaterializeError(
+      "The sandbox could not reach github.com. The sandbox network must allow outbound egress to github.com.",
+      "egress-blocked"
+    );
+  }
+  const verb = fallback === "clone-failed" ? "clone" : fallback === "pull-failed" ? "pull" : "push";
+  return new MaterializeError(`git ${verb} failed: ${stderr}`, fallback);
+}
+function isValidGitRef(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= 255 && // Reject leading-dash refs (e.g. `--mirror`) so the value can never be
+  // parsed as a git option when interpolated into a command.
+  !value.startsWith("-") && /^[A-Za-z0-9_./-]+$/.test(value);
+}
+function resolveGitIdentity(identity) {
+  const login = (identity.login || "").trim();
+  const name = (identity.name || "").trim() || login || "Mastra Code";
+  const email = (identity.email || "").trim() || (login ? `${login}@users.noreply.github.com` : "mastra-code@users.noreply.github.com");
+  return { name, email };
+}
+async function configureGitIdentity(sandbox, workdir, identity) {
+  const { name, email } = resolveGitIdentity(identity);
+  const setName = await sh(sandbox, `git -C ${shellQuote(workdir)} config user.name ${shellQuote(name)}`);
+  if (setName.exitCode !== 0) {
+    throw new MaterializeError(`Failed to set git user.name: ${setName.stderr.trim()}`, "commit-failed");
+  }
+  const setEmail = await sh(sandbox, `git -C ${shellQuote(workdir)} config user.email ${shellQuote(email)}`);
+  if (setEmail.exitCode !== 0) {
+    throw new MaterializeError(`Failed to set git user.email: ${setEmail.stderr.trim()}`, "commit-failed");
+  }
+}
+async function withInstallToken(sandbox, workdir, repoFullName, token, fn) {
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repoFullName)) {
+    throw new MaterializeError(`Refusing to push: invalid repo full name '${repoFullName}'.`, "push-failed");
+  }
+  const setUrl = await sh(
+    sandbox,
+    `git -C ${shellQuote(workdir)} remote set-url origin ${shellQuote(tokenUrl(repoFullName, token))}`
+  );
+  if (setUrl.exitCode !== 0) {
+    await scrubRemote(sandbox, workdir, repoFullName, false);
+    throw new MaterializeError(`Failed to set git remote: ${setUrl.stderr.trim()}`, "push-failed");
+  }
+  try {
+    return await fn();
+  } finally {
+    await scrubRemote(sandbox, workdir, repoFullName, true);
+  }
+}
+async function pushBranch(sandbox, workdir, branch, token, repoFullName) {
+  if (!isValidGitRef(branch)) {
+    throw new MaterializeError(`Refusing to push: invalid branch name '${branch}'.`, "push-failed");
+  }
+  await withInstallToken(sandbox, workdir, repoFullName, token, async () => {
+    const push = await sh(sandbox, `git -C ${shellQuote(workdir)} push -u origin ${shellQuote(branch)}`);
+    if (push.exitCode !== 0) {
+      throw classifyGitFailure(push, "push-failed");
+    }
+  });
+}
+async function commitAll(sandbox, workdir, message, identity) {
+  await configureGitIdentity(sandbox, workdir, identity);
+  const add = await sh(sandbox, `git -C ${shellQuote(workdir)} add -A`);
+  if (add.exitCode !== 0) {
+    throw new MaterializeError(`git add failed: ${add.stderr.trim() || add.stdout.trim()}`, "commit-failed");
+  }
+  const staged = await sh(sandbox, `git -C ${shellQuote(workdir)} diff --cached --quiet`);
+  if (staged.exitCode === 0) {
+    return { committed: false };
+  }
+  const commit = await sh(sandbox, `git -C ${shellQuote(workdir)} commit -m ${shellQuote(message)}`);
+  if (commit.exitCode !== 0) {
+    throw new MaterializeError(`git commit failed: ${commit.stderr.trim() || commit.stdout.trim()}`, "commit-failed");
+  }
+  return { committed: true };
+}
+var WorktreeError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "WorktreeError";
+  }
+  code;
+};
+function safeBranchDir(branch) {
+  const sanitized = branch.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/\/+/g, "-").replace(/^[-.]+|[-.]+$/g, "").slice(0, 100) || "work";
+  if (sanitized === branch) return sanitized;
+  const hash = createHash2("sha256").update(branch).digest("hex").slice(0, 8);
+  return `${sanitized}-${hash}`;
+}
+function computeWorktreePath(repoWorkdir, branch) {
+  const parent = repoWorkdir.replace(/\/+$/, "").split("/").slice(0, -1).join("/") || "";
+  return `${parent}/worktrees/${safeBranchDir(branch)}`;
+}
+
+// src/integrations/github/subscriptions.ts
+function changeRequestTargetKey(input) {
+  return `change-request:${input.installationExternalId}:${input.repositoryExternalId}:${input.changeRequestId}`;
+}
+function sameSession(row, input) {
+  return row.orgId === input.orgId && row.sessionId === input.sessionId && row.resourceId === input.resourceId && row.threadId === input.threadId && (row.sessionScope ?? "") === (input.sessionScope ?? "");
+}
+async function subscribeToPullRequest(input, storage) {
+  const targetKey = changeRequestTargetKey(input);
+  const existing = (await storage.subscriptions.listByTarget(targetKey)).find((row) => sameSession(row, input));
+  if (existing) {
+    if (existing.status !== "open") await storage.subscriptions.updateStatus(existing.id, "open");
+    return { ...existing, status: "open" };
+  }
+  return storage.subscriptions.create({
+    orgId: input.orgId,
+    targetKey,
+    sessionId: input.sessionId,
+    resourceId: input.resourceId,
+    threadId: input.threadId,
+    sessionScope: input.sessionScope ?? "",
+    status: "open",
+    data: {
+      installationExternalId: input.installationExternalId,
+      projectRepositoryId: input.projectRepositoryId,
+      repositoryExternalId: input.repositoryExternalId,
+      repositorySlug: input.repositorySlug,
+      changeRequestId: input.changeRequestId,
+      ownerId: input.ownerId,
+      source: input.source,
+      subscribedByUserId: input.subscribedByUserId ?? null
+    }
+  });
+}
+async function unsubscribeFromPullRequest(input, storage) {
+  const rows = await storage.subscriptions.listByTarget(changeRequestTargetKey(input));
+  await Promise.all(rows.filter((row) => sameSession(row, input)).map((row) => storage.subscriptions.delete(row.id)));
+}
+async function listPullRequestSubscriptionsForThread(input, storage) {
+  const rows = await storage.subscriptions.listByThread(input.resourceId, input.threadId);
+  return rows.filter(
+    (row) => row.orgId === input.orgId && row.resourceId === input.resourceId && row.threadId === input.threadId && (row.sessionScope ?? "") === (input.sessionScope ?? "")
+  );
+}
+async function listPullRequestSubscriptionsForWebhook(input, options, storage) {
+  const rows = await storage.subscriptions.listByTarget(changeRequestTargetKey(input));
+  return options?.includeTerminal ? rows : rows.filter((row) => row.status === "open");
+}
+function retirePullRequestSubscription(id, status, storage) {
+  return storage.subscriptions.updateStatus(id, status);
+}
+
+// src/integrations/github/webhook.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var SUPPORTED_GITHUB_WEBHOOK_EVENTS = /* @__PURE__ */ new Set([
+  "issues",
+  "issue_comment",
+  "pull_request",
+  "pull_request_review",
+  "pull_request_review_comment"
+]);
+function normalizeHeader(value) {
+  if (!value) return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function verifySignature(rawBody, signature, secret) {
+  if (!signature.startsWith("sha256=")) return false;
+  const signatureHex = signature.slice("sha256=".length);
+  if (!/^[a-fA-F0-9]{64}$/.test(signatureHex)) return false;
+  const expectedHex = createHmac("sha256", secret).update(rawBody).digest("hex");
+  const received = Buffer.from(signatureHex, "hex");
+  const expected = Buffer.from(expectedHex, "hex");
+  return received.length === expected.length && timingSafeEqual(received, expected);
+}
+async function parseGithubWebhook(c, secret) {
+  if (!secret) {
+    return { status: 401, body: { error: "unauthorized", message: "GitHub webhook secret is not configured" } };
+  }
+  const event = normalizeHeader(c.req.header("x-github-event"));
+  const deliveryId = normalizeHeader(c.req.header("x-github-delivery"));
+  const signature = normalizeHeader(c.req.header("x-hub-signature-256"));
+  if (!event) return { status: 400, body: { error: "bad_request", message: "Missing x-github-event header" } };
+  if (!deliveryId) return { status: 400, body: { error: "bad_request", message: "Missing x-github-delivery header" } };
+  if (!signature)
+    return { status: 401, body: { error: "unauthorized", message: "Missing x-hub-signature-256 header" } };
+  const rawBody = await c.req.text();
+  if (!verifySignature(rawBody, signature, secret)) {
+    return { status: 401, body: { error: "unauthorized", message: "Invalid GitHub webhook signature" } };
+  }
+  let payload;
+  try {
+    payload = JSON.parse(rawBody);
+  } catch {
+    return { status: 400, body: { error: "bad_request", message: "Malformed JSON payload" } };
+  }
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return { status: 400, body: { error: "bad_request", message: "Payload must be a JSON object" } };
+  }
+  return { event, deliveryId, payload };
+}
+function getObject(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function getString(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function getNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function getBoolean(value) {
+  return typeof value === "boolean" ? value : void 0;
+}
+function getLabels(value) {
+  if (!Array.isArray(value)) return [];
+  return value.map((label) => typeof label === "string" ? label : getString(getObject(label)?.name)).filter((label) => Boolean(label));
+}
+function getIssueTriageRunInput(parsed) {
+  if (parsed.event !== "issues" || getString(parsed.payload.action) !== "opened") return null;
+  const repository = getString(getObject(parsed.payload.repository)?.full_name);
+  const issue = getObject(parsed.payload.issue);
+  const sender = getString(getObject(parsed.payload.sender)?.login);
+  const installationId = getNumber(getObject(parsed.payload.installation)?.id);
+  const issueNumber = getNumber(issue?.number);
+  const issueTitle = getString(issue?.title);
+  const issueUrl = getString(issue?.html_url);
+  if (!repository || !installationId || !issueNumber || !issueTitle || !issueUrl) return null;
+  return {
+    repository,
+    issueNumber,
+    issueTitle,
+    issueUrl,
+    labels: getLabels(issue?.labels),
+    sender,
+    installationId
+  };
+}
+function normalizeGithubWebhookMetadata(parsed) {
+  const { event, deliveryId, payload } = parsed;
+  const repository = getObject(payload.repository);
+  const issue = getObject(payload.issue);
+  const pullRequest = getObject(payload.pull_request);
+  const sender = getObject(payload.sender);
+  const installation = getObject(payload.installation);
+  const issuePullRequest = getObject(issue?.pull_request);
+  return {
+    event,
+    action: getString(payload.action),
+    deliveryId,
+    repository: getString(repository?.full_name),
+    repositoryId: getNumber(repository?.id),
+    issueNumber: getNumber(issue?.number),
+    pullRequestNumber: getNumber(pullRequest?.number) ?? (event === "issue_comment" && issuePullRequest ? getNumber(issue?.number) : void 0),
+    sender: getString(sender?.login),
+    senderType: getString(sender?.type),
+    installationId: getNumber(installation?.id)
+  };
+}
+function notificationSummary(metadata, label) {
+  const actor = metadata.sender ? `${metadata.sender} ` : "";
+  return `${actor}${label} on ${metadata.repository}#${metadata.pullRequestNumber}`;
+}
+function notificationTargetUrl(event, payload) {
+  if (event === "issue_comment" || event === "pull_request_review_comment") {
+    return getString(getObject(payload.comment)?.html_url);
+  }
+  if (event === "pull_request_review") {
+    return getString(getObject(payload.review)?.html_url);
+  }
+  return getString(getObject(payload.pull_request)?.html_url);
+}
+function classifyGithubWebhook(parsed) {
+  const metadata = normalizeGithubWebhookMetadata(parsed);
+  const { event, payload } = parsed;
+  const action = metadata.action;
+  if (!action || !metadata.repositoryId || !metadata.installationId || !metadata.pullRequestNumber || !metadata.repository) {
+    return void 0;
+  }
+  let priority;
+  let kind;
+  let label;
+  let terminal = false;
+  if (event === "pull_request_review" && action === "submitted") {
+    const state = getString(getObject(payload.review)?.state)?.toLowerCase().replaceAll("_", "-");
+    priority = state === "approved" || state === "changes-requested" ? "urgent" : "high";
+    kind = state === "approved" ? "review-approved" : state === "changes-requested" ? "review-changes-requested" : "review-submitted";
+    label = state === "approved" ? "approved the pull request" : state === "changes-requested" ? "requested changes" : "submitted a review";
+  } else if (event === "pull_request" && action === "closed") {
+    const merged = getBoolean(getObject(payload.pull_request)?.merged) === true;
+    priority = "urgent";
+    kind = merged ? "pull-request-merged" : "pull-request-closed";
+    label = merged ? "merged the pull request" : "closed the pull request";
+    terminal = true;
+  } else if (event === "issue_comment" && action === "created") {
+    priority = "high";
+    kind = "issue-comment-created";
+    label = "commented";
+  } else if (event === "pull_request_review_comment" && action === "created") {
+    priority = "high";
+    kind = "review-comment-created";
+    label = "left a review comment";
+  } else if (event === "pull_request" && action === "reopened") {
+    priority = "high";
+    kind = "pull-request-reopened";
+    label = "reopened the pull request";
+  } else if (event === "pull_request_review" && action === "dismissed") {
+    priority = "high";
+    kind = "review-dismissed";
+    label = "dismissed a review";
+  } else if (event === "pull_request" && [
+    "synchronize",
+    "ready_for_review",
+    "converted_to_draft",
+    "assigned",
+    "unassigned",
+    "review_requested",
+    "review_request_removed"
+  ].includes(action)) {
+    priority = "medium";
+    kind = `pull-request-${action.replaceAll("_", "-")}`;
+    label = action.replaceAll("_", " ");
+  } else if (event === "pull_request" && ["edited", "labeled", "unlabeled", "milestoned", "demilestoned"].includes(action)) {
+    priority = "low";
+    kind = `pull-request-${action.replaceAll("_", "-")}`;
+    label = action.replaceAll("_", " ");
+  } else {
+    return void 0;
+  }
+  return {
+    action,
+    kind,
+    priority,
+    summary: notificationSummary(metadata, label),
+    terminal,
+    metadata: {
+      ...metadata,
+      pullRequestNumber: metadata.pullRequestNumber,
+      repositoryId: metadata.repositoryId,
+      installationId: metadata.installationId
+    },
+    payload
+  };
+}
+async function resolveSubscriptionSession(controller, subscription) {
+  const { sessionId, resourceId, threadId } = subscription;
+  if (!sessionId || !resourceId || !threadId) {
+    throw new Error(`GitHub subscription ${subscription.id} is missing its session binding.`);
+  }
+  const scope = subscription.sessionScope || void 0;
+  let session = await controller.getSessionByResource(resourceId, scope);
+  if (!session) {
+    const tags = {
+      factoryProjectId: resourceId,
+      projectRepositoryId: subscription.data.projectRepositoryId,
+      ...scope ? { worktreePath: scope } : {}
+    };
+    session = await controller.createSession({
+      id: sessionId,
+      ownerId: subscription.data.ownerId,
+      resourceId,
+      scope,
+      tags
+    });
+  }
+  if (session.thread.getId() !== threadId) {
+    await session.thread.switch({ threadId, emitEvent: false });
+  }
+  if (session.thread.getId() !== threadId) {
+    throw new Error(`Session ${sessionId} did not bind thread ${threadId}.`);
+  }
+  return session;
+}
+var AUTHORIZED_BOTS = /* @__PURE__ */ new Set(["coderabbitai[bot]", "devin-ai-integration[bot]"]);
+var AUTHORIZED_PERMISSIONS = /* @__PURE__ */ new Set(["admin", "maintain", "write"]);
+var PERMISSION_CHECK_TIMEOUT_MS = 5e3;
+var AUTHOR_GATED_KINDS = /* @__PURE__ */ new Set([
+  "issue-comment-created",
+  "review-comment-created",
+  "review-submitted",
+  "review-approved",
+  "review-changes-requested",
+  "review-dismissed"
+]);
+async function isAuthorizedGithubSender(notification, github) {
+  if (!AUTHOR_GATED_KINDS.has(notification.kind)) return true;
+  const sender = notification.metadata.sender;
+  const repository = notification.metadata.repository;
+  if (!sender || !repository) return false;
+  const normalizedSender = sender.toLowerCase();
+  if (notification.metadata.senderType?.toLowerCase() === "bot" || normalizedSender.endsWith("[bot]")) {
+    return AUTHORIZED_BOTS.has(normalizedSender);
+  }
+  if (!github) return false;
+  const abortController = new AbortController();
+  let timeout;
+  try {
+    const permission = await Promise.race([
+      github.getRepositoryCollaboratorPermission(
+        notification.metadata.installationId,
+        repository,
+        sender,
+        abortController.signal
+      ),
+      new Promise((resolve) => {
+        timeout = setTimeout(() => {
+          abortController.abort();
+          resolve(void 0);
+        }, PERMISSION_CHECK_TIMEOUT_MS);
+      })
+    ]);
+    return permission !== void 0 && AUTHORIZED_PERMISSIONS.has(permission);
+  } catch {
+    return false;
+  } finally {
+    if (timeout) clearTimeout(timeout);
+  }
+}
+async function dispatchGithubWebhook(parsed, dependencies) {
+  const notification = classifyGithubWebhook(parsed);
+  if (!notification) return { delivered: 0, failed: 0, ignored: true };
+  const isAuthorizedSender = dependencies.isAuthorizedSender ?? ((n) => isAuthorizedGithubSender(n, dependencies.github));
+  if (!await isAuthorizedSender(notification)) {
+    return { delivered: 0, failed: 0, ignored: true };
+  }
+  const target = {
+    installationExternalId: notification.metadata.installationId.toString(),
+    repositoryExternalId: notification.metadata.repositoryId.toString(),
+    changeRequestId: notification.metadata.pullRequestNumber.toString()
+  };
+  const listSubscriptions = dependencies.listSubscriptions ?? ((subscriptionTarget, options) => {
+    if (!dependencies.github) throw new Error("GitHub integration is required to load webhook subscriptions.");
+    return listPullRequestSubscriptionsForWebhook(
+      subscriptionTarget,
+      options,
+      dependencies.github.integrationStorage
+    );
+  });
+  const retireSubscription = dependencies.retireSubscription ?? ((id, status) => {
+    if (!dependencies.github) throw new Error("GitHub integration is required to retire webhook subscriptions.");
+    return retirePullRequestSubscription(id, status, dependencies.github.integrationStorage);
+  });
+  const subscriptions = await listSubscriptions(target, { includeTerminal: notification.action === "reopened" });
+  let delivered = 0;
+  let failed = 0;
+  for (const subscription of subscriptions) {
+    try {
+      const session = await resolveSubscriptionSession(dependencies.controller, subscription);
+      const result = await session.sendNotificationSignal({
+        source: "github",
+        kind: notification.kind,
+        summary: notification.summary,
+        priority: notification.priority,
+        payload: notification.payload,
+        sourceId: parsed.deliveryId,
+        dedupeKey: `${parsed.deliveryId}:${subscription.sessionId}:${subscription.threadId}`,
+        coalesceKey: `github:${subscription.data.repositoryExternalId}:pull-request:${subscription.data.changeRequestId}`,
+        metadata: {
+          event: notification.metadata.event,
+          action: notification.action,
+          repository: notification.metadata.repository,
+          issueNumber: notification.metadata.issueNumber,
+          pullRequestNumber: notification.metadata.pullRequestNumber,
+          targetUrl: notificationTargetUrl(parsed.event, parsed.payload),
+          deliveryId: parsed.deliveryId
+        }
+      });
+      await Promise.all([result.persisted, result.accepted].filter(Boolean));
+      if (notification.terminal) {
+        await retireSubscription(subscription.id, notification.kind === "pull-request-merged" ? "merged" : "closed");
+      } else if (notification.action === "reopened") {
+        await retireSubscription(subscription.id, "open");
+      }
+      delivered += 1;
+    } catch (error) {
+      failed += 1;
+      dependencies.onTargetError?.(subscription, error);
+    }
+  }
+  return { delivered, failed, ignored: false };
+}
+async function handleGithubWebhook(c, options) {
+  const parsed = await parseGithubWebhook(c, options.github.webhookSecret);
+  if ("status" in parsed) return parsed;
+  if (!SUPPORTED_GITHUB_WEBHOOK_EVENTS.has(parsed.event)) {
+    return { status: 202, body: { ok: true, ignored: true } };
+  }
+  const metadata = normalizeGithubWebhookMetadata(parsed);
+  console.info("[GitHub Webhook]", metadata);
+  if (options.ingestFactoryEvent) {
+    await options.ingestFactoryEvent(parsed);
+  } else {
+    const issueTriageRun = getIssueTriageRunInput(parsed);
+    if (issueTriageRun && options.runIssueTriage) {
+      void options.runIssueTriage(issueTriageRun).catch((error) => {
+        console.error("[GitHub Webhook] Failed to run issue triage", {
+          deliveryId: metadata.deliveryId,
+          repository: metadata.repository,
+          issueNumber: metadata.issueNumber,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      });
+    }
+  }
+  if (!options.controller) {
+    return { status: 202, body: { ok: true } };
+  }
+  const result = await dispatchGithubWebhook(parsed, options);
+  if (result.failed > 0) {
+    console.warn(`[GitHub Webhook] ${result.failed} subscribed target(s) failed for delivery ${parsed.deliveryId}.`);
+  }
+  return { status: 202, body: { ok: true, ...result.ignored ? { ignored: true } : {} } };
+}
+
+// src/integrations/github/routes.ts
+function loose(c) {
+  return c;
+}
+async function resolveFactoryDefaultModelId(projects, factoryProjectId) {
+  if (!projects || !factoryProjectId) return void 0;
+  try {
+    const project = await projects.getById({ id: factoryProjectId });
+    return project?.defaultModelId ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
+function pullRequestNumberFromUrl(value, expectedRepo) {
+  try {
+    const url = new URL(value);
+    const match = url.pathname.match(/^\/([^/]+\/[^/]+)\/pull\/(\d+)\/?$/);
+    if (url.protocol !== "https:" || url.hostname !== "github.com" || match?.[1]?.toLowerCase() !== expectedRepo.toLowerCase()) {
+      return void 0;
+    }
+    const number = Number(match[2]);
+    return Number.isInteger(number) && number > 0 ? number : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isCanonicalGithubIssueUrl(value, repoFullName, issueNumber) {
+  try {
+    const url = new URL(value);
+    const [owner, repo] = repoFullName.split("/");
+    return url.protocol === "https:" && url.hostname === "github.com" && url.pathname === `/${owner}/${repo}/issues/${issueNumber}` && url.search === "" && url.hash === "";
+  } catch {
+    return false;
+  }
+}
+function isValidGitRef2(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= 255 && /^[A-Za-z0-9_./-]+$/.test(value);
+}
+async function resolveOrgTenant(c, auth) {
+  await auth.ensureUser(c);
+  const tenant = auth.tenant(c);
+  if (!tenant) return { response: c.json({ error: "unauthorized" }, 401) };
+  if (!tenant.orgId) {
+    return {
+      response: c.json(
+        {
+          error: "organization_required",
+          message: "GitHub projects require a WorkOS organization. Personal accounts cannot connect repositories."
+        },
+        403
+      )
+    };
+  }
+  return { tenant: { orgId: tenant.orgId, userId: tenant.userId } };
+}
+function parseListPage(raw) {
+  if (raw === void 0) return 1;
+  if (!/^\d{1,5}$/.test(raw)) return null;
+  const page = Number(raw);
+  return page >= 1 ? page : null;
+}
+var VALID_ISSUE_LABEL_FILTERS = /* @__PURE__ */ new Set(["auto-triaged", "needs-approval"]);
+function parseIssueLabelFilter(raw) {
+  if (raw === void 0 || raw === "") return void 0;
+  if (VALID_ISSUE_LABEL_FILTERS.has(raw)) return raw;
+  return null;
+}
+function parseIssueNumberParam(raw) {
+  if (!raw || !/^\d{1,10}$/.test(raw)) return null;
+  const issueNumber = Number(raw);
+  return Number.isSafeInteger(issueNumber) && issueNumber > 0 ? issueNumber : null;
+}
+function parseStringList(value) {
+  if (!Array.isArray(value)) return [];
+  return value.filter((item) => typeof item === "string" && item.length > 0);
+}
+async function resolveProjectRepository(args) {
+  const projectRepository = await args.github.sourceControlStorage.projectRepositories.get({
+    orgId: args.orgId,
+    id: args.projectRepositoryId
+  });
+  if (!projectRepository) return null;
+  const connection = await args.github.sourceControlStorage.connections.get({
+    orgId: args.orgId,
+    id: projectRepository.connectionId
+  });
+  if (!connection) return null;
+  const repository = await args.github.sourceControlStorage.repositories.get({
+    orgId: args.orgId,
+    id: projectRepository.repositoryId
+  });
+  if (!repository) return null;
+  const installation = await args.github.sourceControlStorage.installations.get({
+    orgId: args.orgId,
+    id: connection.installationId
+  });
+  if (!installation) return null;
+  return {
+    ...projectRepository,
+    connection,
+    installation,
+    repository,
+    factoryProjectId: connection.factoryProjectId,
+    defaultBranch: projectRepository.branch ?? repository.defaultBranch
+  };
+}
+function polledIssueEvent(project, issue) {
+  const repositoryId = Number(project.repository.externalId);
+  return {
+    event: "issues",
+    deliveryId: `poll:${repositoryId}:issue:${issue.number}:${issue.createdAt}`,
+    payload: {
+      action: "opened",
+      installation: { id: Number(project.installation.externalId) },
+      repository: { id: repositoryId, full_name: project.repository.slug },
+      sender: { login: issue.author ?? "__unknown__" },
+      issue: {
+        number: issue.number,
+        title: issue.title,
+        html_url: issue.url,
+        created_at: issue.createdAt,
+        labels: issue.labels.map((name) => ({ name }))
+      }
+    }
+  };
+}
+function polledPullRequestEvent(project, pullRequest) {
+  const repositoryId = Number(project.repository.externalId);
+  return {
+    event: "pull_request",
+    deliveryId: `poll:${repositoryId}:pull-request:${pullRequest.number}:${pullRequest.createdAt}`,
+    payload: {
+      action: "opened",
+      installation: { id: Number(project.installation.externalId) },
+      repository: { id: repositoryId, full_name: project.repository.slug },
+      sender: { login: pullRequest.author ?? "__unknown__" },
+      pull_request: {
+        number: pullRequest.number,
+        title: pullRequest.title,
+        html_url: pullRequest.url,
+        created_at: pullRequest.createdAt,
+        state: "open",
+        merged: false,
+        head: { ref: pullRequest.headBranch },
+        base: { ref: pullRequest.baseBranch }
+      }
+    }
+  };
+}
+async function ingestPolledEvents(events, ingestFactoryEvent) {
+  if (!ingestFactoryEvent) return;
+  const results = await Promise.allSettled(events.map((event) => ingestFactoryEvent(event)));
+  const rejected = results.find((result) => result.status === "rejected");
+  if (rejected) throw rejected.reason;
+}
+function buildGithubRoutes(options) {
+  const routes = [];
+  const { auth, fleet, storage, github, stateSigner, emitAudit } = options;
+  const diagnostics = () => getGithubFeatureDiagnostics({ github, auth, appDbConfigured: storage !== void 0, stateSigner, fleet });
+  routes.push(
+    registerApiRoute("/web/github/status", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        if (!isGithubFeatureEnabled({ github, auth }) || !github || !stateSigner) {
+          return c.json({
+            enabled: false,
+            connected: false,
+            installations: [],
+            reason: "missing_config",
+            diagnostics: diagnostics()
+          });
+        }
+        await auth.ensureUser(loose(c));
+        const tenant = auth.tenant(loose(c));
+        if (!tenant) return c.json({ error: "unauthorized", reason: "auth_required" }, 401);
+        if (!tenant.orgId) {
+          return c.json({
+            enabled: true,
+            sandboxEnabled: fleet.enabled,
+            organizationRequired: true,
+            connected: false,
+            installations: [],
+            reason: "organization_required",
+            diagnostics: diagnostics()
+          });
+        }
+        const rows = options.github ? await options.github.sourceControlStorage.installations.list({ orgId: tenant.orgId }) : [];
+        const connected = rows.length > 0;
+        return c.json({
+          enabled: true,
+          sandboxEnabled: fleet.enabled,
+          connected,
+          installations: rows.map((r) => ({
+            installationId: Number(r.externalId),
+            accountLogin: r.accountName,
+            accountType: r.accountType
+          })),
+          reason: connected ? "ready" : "not_connected",
+          diagnostics: diagnostics()
+        });
+      }
+    })
+  );
+  if (!isGithubFeatureEnabled({ github, auth }) || !github || !stateSigner) {
+    return routes;
+  }
+  const signState = (orgId, userId) => stateSigner.sign(orgId, userId);
+  const verifyState = (state) => stateSigner.verify(state);
+  const { runIssueTriage } = options;
+  const runBoardIssueTriage = runIssueTriage ? async (input) => {
+    if (!input.resourceId || !input.projectPath) {
+      throw new Error("GitHub issue triage requires an explicit Factory project repository");
+    }
+    await github.addIssueLabels(input.installationId, input.repository, input.issueNumber, ["auto-triaged"]);
+    return runIssueTriage({
+      ...input,
+      defaultModelId: input.defaultModelId ?? await resolveFactoryDefaultModelId(options.projects, input.resourceId),
+      labels: input.labels.includes("auto-triaged") ? input.labels : [...input.labels, "auto-triaged"]
+    });
+  } : void 0;
+  routes.push(
+    registerApiRoute("/web/github/subscriptions", {
+      method: "GET",
+      handler: async (c) => {
+        await auth.ensureUser(loose(c));
+        const tenant = auth.tenant(loose(c));
+        if (!tenant?.orgId) return c.json({ error: "unauthorized" }, 401);
+        const resourceId = c.req.query("resourceId");
+        const threadId = c.req.query("threadId");
+        const sessionScope = c.req.query("scope");
+        if (!resourceId || !threadId) return c.json({ error: "resourceId and threadId are required" }, 400);
+        const subscriptions = await listPullRequestSubscriptionsForThread(
+          {
+            orgId: tenant.orgId,
+            resourceId,
+            threadId,
+            sessionScope
+          },
+          github.integrationStorage
+        );
+        return c.json({
+          subscriptions: subscriptions.map((subscription) => ({
+            id: subscription.id,
+            repoFullName: subscription.data.repositorySlug,
+            pullRequestNumber: Number(subscription.data.changeRequestId),
+            status: subscription.status,
+            url: `https://github.com/${subscription.data.repositorySlug}/pull/${subscription.data.changeRequestId}`
+          }))
+        });
+      }
+    }),
+    registerApiRoute("/web/github/webhook", {
+      method: "POST",
+      requiresAuth: false,
+      handler: async (c) => {
+        const result = await handleGithubWebhook(loose(c), {
+          github,
+          runIssueTriage: runBoardIssueTriage,
+          ingestFactoryEvent: options.ingestFactoryEvent,
+          ...options.controller ? {
+            controller: options.controller,
+            onTargetError: (subscription, error) => {
+              console.warn(
+                `[GitHub Webhook] Delivery failed for subscription ${subscription.id} (${subscription.resourceId}/${subscription.threadId}).`,
+                error
+              );
+            }
+          } : {}
+        });
+        return c.json(result.body, result.status);
+      }
+    })
+  );
+  const redirectUri = options.redirectUri ?? `${(options.baseUrl ?? "").replace(/\/$/, "")}/auth/github/callback`;
+  routes.push(
+    registerApiRoute("/auth/github/connect", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        const resolved = await resolveOrgTenant(loose(c), auth);
+        if ("response" in resolved) return resolved.response;
+        const state = signState(resolved.tenant.orgId, resolved.tenant.userId);
+        if (c.req.query("manage")) return c.redirect(github.buildInstallUrl(state));
+        return c.redirect(github.buildOAuthIdentifyUrl(state, redirectUri));
+      }
+    })
+  );
+  routes.push(
+    registerApiRoute("/auth/github/callback", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        const resolved = await resolveOrgTenant(loose(c), auth);
+        if ("response" in resolved) return resolved.response;
+        const { orgId, userId } = resolved.tenant;
+        const state = c.req.query("state");
+        if (!state) {
+          return c.redirect(github.buildOAuthIdentifyUrl(signState(orgId, userId), redirectUri));
+        }
+        const stateTenant = verifyState(state);
+        if (!stateTenant || stateTenant.userId !== userId || stateTenant.orgId !== orgId) {
+          console.warn(
+            "[GitHub] Install callback rejected: state/tenant mismatch.",
+            JSON.stringify({
+              stateValid: Boolean(stateTenant),
+              stateOrgId: stateTenant?.orgId,
+              stateUserId: stateTenant?.userId,
+              sessionOrgId: orgId,
+              sessionUserId: userId
+            })
+          );
+          return c.redirect("/?github=error");
+        }
+        const code = c.req.query("code");
+        if (!code) {
+          return c.redirect(github.buildOAuthIdentifyUrl(signState(orgId, userId), redirectUri));
+        }
+        try {
+          const userToken = await github.exchangeOAuthCode(code, redirectUri);
+          const installations = await github.listUserInstallations(userToken);
+          if (installations.length === 0) {
+            return c.redirect(github.buildInstallUrl(signState(orgId, userId)));
+          }
+          for (const inst of installations) {
+            await github.sourceControlStorage.installations.upsert({
+              orgId,
+              connectedByUserId: userId,
+              externalId: inst.installationId.toString(),
+              accountName: inst.accountLogin,
+              accountType: inst.accountType
+            });
+          }
+        } catch (error) {
+          console.warn(
+            `[GitHub] Install callback failed to persist installations for org ${orgId} / user ${userId}.`,
+            error
+          );
+          return c.redirect("/?github=error");
+        }
+        return c.redirect("/?github=connected");
+      }
+    })
+  );
+  routes.push(
+    registerApiRoute("/web/github/repos", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        const resolved = await resolveOrgTenant(loose(c), auth);
+        if ("response" in resolved) return resolved.response;
+        const installs = await github.sourceControlStorage.installations.list({ orgId: resolved.tenant.orgId });
+        const query = (c.req.query("q") ?? "").toLowerCase();
+        const repos = [];
+        const seenRepositoryIds = /* @__PURE__ */ new Set();
+        for (const inst of installs) {
+          let list;
+          try {
+            list = await github.listInstallationRepos(Number(inst.externalId));
+          } catch (err) {
+            if (err.status !== 404) throw err;
+            console.error(`[MastraCode Web] pruning stale GitHub installation ${inst.externalId} (404 from GitHub)`);
+            await github.sourceControlStorage.installations.delete({ orgId: resolved.tenant.orgId, id: inst.id });
+            continue;
+          }
+          for (const repo of list) {
+            if (query && !repo.fullName.toLowerCase().includes(query)) continue;
+            if (seenRepositoryIds.has(repo.id)) continue;
+            seenRepositoryIds.add(repo.id);
+            const repository = await github.sourceControlStorage.repositories.upsert({
+              orgId: resolved.tenant.orgId,
+              input: {
+                installationId: inst.id,
+                externalId: repo.id.toString(),
+                slug: repo.fullName,
+                defaultBranch: isValidGitRef2(repo.defaultBranch) ? repo.defaultBranch : "main",
+                providerMetadata: { private: repo.private, owner: repo.owner }
+              }
+            });
+            repos.push({
+              ...repo,
+              installationStorageId: inst.id,
+              repositoryStorageId: repository.id,
+              sandboxProvider: fleet.provider,
+              sandboxWorkdir: fleet.computeWorkdir(repo.fullName)
+            });
+          }
+        }
+        return c.json({ repos });
+      }
+    })
+  );
+  routes.push(
+    registerApiRoute("/web/github/projects/:id/ensure", {
+      method: "POST",
+      requiresAuth: false,
+      handler: async (c) => {
+        const resolved = await resolveOrgTenant(loose(c), auth);
+        if ("response" in resolved) return resolved.response;
+        const { orgId, userId } = resolved.tenant;
+        if (!fleet.enabled) {
+          return c.json({ error: "sandbox_not_configured", message: "No sandbox provider is configured." }, 503);
+        }
+        const projectRepositoryId = c.req.param("id");
+        if (!projectRepositoryId) return c.json({ error: "Project repository not found" }, 404);
+        const project = await resolveProjectRepository({ github, orgId, projectRepositoryId });
+        if (!project) {
+          return c.json({ error: "Project repository not found" }, 404);
+        }
+        const wantsStream = (c.req.header("accept") ?? "").includes("text/event-stream");
+        if (wantsStream) {
+          return streamSSE(loose(c), async (stream) => {
+            try {
+              const result = await prepareProject({
+                github,
+                fleet,
+                project,
+                userId,
+                onProgress: (ev) => void stream.writeSSE({ event: "progress", data: JSON.stringify(ev) })
+              });
+              await stream.writeSSE({ event: "done", data: JSON.stringify(result) });
+            } catch (err) {
+              await stream.writeSSE({ event: "error", data: JSON.stringify(ensureErrorPayload(err).body) });
+            }
+          });
+        }
+        try {
+          const result = await prepareProject({ github, fleet, project, userId });
+          return c.json(result);
+        } catch (err) {
+          const { status, body } = ensureErrorPayload(err);
+          return c.json(body, status);
+        }
+      }
+    })
+  );
+  routes.push(
+    registerApiRoute("/web/github/projects/:id/issues", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        const loaded = await loadOrgProject({ github, auth, c: loose(c) });
+        if ("response" in loaded) return loaded.response;
+        const page = parseListPage(c.req.query("page"));
+        if (page === null) return c.json({ error: "invalid_page" }, 400);
+        const label = parseIssueLabelFilter(c.req.query("label"));
+        if (label === null) return c.json({ error: "invalid_label" }, 400);
+        try {
+          const { issues, nextCursor } = await github.intake.listIssues({
+            connection: {
+              type: "app-installation",
+              installationId: Number(loaded.project.installation.externalId)
+            },
+            sourceIds: [loaded.project.repository.slug],
+            labels: label ? [label] : void 0,
+            cursor: String(page)
+          });
+          const responseIssues = issues.map((issue) => ({
+            number: Number(issue.id),
+            title: issue.title,
+            url: issue.url,
+            author: issue.author,
+            labels: issue.labels,
+            comments: issue.commentCount ?? 0,
+            createdAt: issue.createdAt,
+            updatedAt: issue.updatedAt
+          }));
+          await ingestPolledEvents(
+            responseIssues.map((issue) => polledIssueEvent(loaded.project, issue)),
+            options.ingestFactoryEvent
+          );
+          return c.json({
+            issues: responseIssues,
+            nextPage: nextCursor === null ? null : Number(nextCursor)
+          });
+        } catch (err) {
+          return c.json(
+            { error: "github_fetch_failed", message: err instanceof Error ? err.message : String(err) },
+            502
+          );
+        }
+      }
+    })
+  );
+  routes.push(
+    registerApiRoute("/web/github/projects/:id/issues/:number/triage", {
+      method: "POST",
+      requiresAuth: false,
+      handler: async (c) => {
+        const owned = await loadOwnedProject({ github, auth, fleet, c: loose(c) });
+        if ("response" in owned) return owned.response;
+        const { project, sandboxRow } = owned;
+        const issueNumber = parseIssueNumberParam(c.req.param("number"));
+        if (issueNumber === null) return c.json({ error: "invalid_issue_number" }, 400);
+        let body;
+        try {
+          body = await c.req.json();
+        } catch {
+          return c.json({ error: "Invalid JSON body" }, 400);
+        }
+        if (typeof body.title !== "string" || body.title.trim().length === 0 || body.title.length > 5e3) {
+          return c.json({ error: "invalid_title" }, 400);
+        }
+        if (typeof body.url !== "string" || body.url.trim().length === 0 || body.url.length > 2048 || !isCanonicalGithubIssueUrl(body.url, project.repository.slug, issueNumber)) {
+          return c.json({ error: "invalid_url" }, 400);
+        }
+        if (!runIssueTriage) return c.json({ error: "triage_unavailable" }, 503);
+        const branch = `factory/issue-${issueNumber}`;
+        const projectPath = computeWorktreePath(sandboxRow.sandboxWorkdir, branch);
+        await github.addIssueLabels(Number(project.installation.externalId), project.repository.slug, issueNumber, [
+          "auto-triaged"
+        ]);
+        const result = await runIssueTriage({
+          repository: project.repository.slug,
+          issueNumber,
+          issueTitle: body.title,
+          issueUrl: body.url,
+          labels: parseStringList(body.labels),
+          installationId: Number(project.installation.externalId),
+          resourceId: project.factoryProjectId,
+          projectPath,
+          branch,
+          defaultModelId: await resolveFactoryDefaultModelId(options.projects, project.factoryProjectId)
+        });
+        await emitAudit?.({
+          context: loose(c),
+          input: {
+            action: "factory.triage.started",
+            factoryProjectId: project.factoryProjectId,
+            projectRepositoryId: project.id,
+            targets: [{ type: "issue", id: String(issueNumber), name: body.title }],
+            metadata: { issueNumber, branch, threadId: result.threadId }
+          }
+        });
+        return c.json(
+          {
+            ok: true,
+            threadId: result.threadId,
+            projectPath: result.projectPath ?? projectPath,
+            branch: result.branch ?? branch
+          },
+          202
+        );
+      }
+    })
+  );
+  routes.push(
+    registerApiRoute("/web/github/projects/:id/prs", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        const loaded = await loadOrgProject({ github, auth, c: loose(c) });
+        if ("response" in loaded) return loaded.response;
+        const page = parseListPage(c.req.query("page"));
+        if (page === null) return c.json({ error: "invalid_page" }, 400);
+        try {
+          const { pullRequests, nextCursor } = await github.versionControl.listPullRequests({
+            connection: {
+              type: "app-installation",
+              installationId: Number(loaded.project.installation.externalId)
+            },
+            sourceId: loaded.project.repository.slug,
+            includeDrafts: false,
+            cursor: String(page)
+          });
+          const responsePullRequests = pullRequests.map((pr) => ({
+            number: Number(pr.id),
+            title: pr.title,
+            url: pr.url,
+            author: pr.author,
+            baseBranch: pr.baseBranch,
+            headBranch: pr.headBranch,
+            createdAt: pr.createdAt,
+            updatedAt: pr.updatedAt
+          }));
+          await ingestPolledEvents(
+            responsePullRequests.map((pullRequest) => polledPullRequestEvent(loaded.project, pullRequest)),
+            options.ingestFactoryEvent
+          );
+          return c.json({
+            pullRequests: responsePullRequests,
+            nextPage: nextCursor === null ? null : Number(nextCursor)
+          });
+        } catch (err) {
+          return c.json(
+            { error: "github_fetch_failed", message: err instanceof Error ? err.message : String(err) },
+            502
+          );
+        }
+      }
+    })
+  );
+  routes.push(
+    registerApiRoute("/web/github/projects/:id/settings", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        const loaded = await loadOrgProject({ github, auth, c: loose(c) });
+        if ("response" in loaded) return loaded.response;
+        return c.json({ setupCommand: loaded.project.setupCommand });
+      }
+    })
+  );
+  routes.push(
+    registerApiRoute("/web/github/projects/:id/settings", {
+      method: "POST",
+      requiresAuth: false,
+      handler: async (c) => {
+        const loaded = await loadOrgProject({ github, auth, c: loose(c) });
+        if ("response" in loaded) return loaded.response;
+        let body;
+        try {
+          body = await c.req.json();
+        } catch {
+          return c.json({ error: "Invalid JSON body" }, 400);
+        }
+        if (body.setupCommand !== null && typeof body.setupCommand !== "string") {
+          return c.json({ error: "Invalid setupCommand" }, 400);
+        }
+        if (typeof body.setupCommand === "string" && body.setupCommand.length > 2e3) {
+          return c.json({ error: "setupCommand too long (max 2000 characters)" }, 400);
+        }
+        if (typeof body.setupCommand === "string" && /[\0-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(body.setupCommand)) {
+          return c.json({ error: "setupCommand contains control characters" }, 400);
+        }
+        const setupCommand = typeof body.setupCommand === "string" && body.setupCommand.trim().length > 0 ? body.setupCommand.trim() : null;
+        await github.sourceControlStorage.projectRepositories.update({
+          orgId: loaded.project.installation.orgId,
+          id: loaded.project.id,
+          input: { setupCommand }
+        });
+        return c.json({ setupCommand });
+      }
+    })
+  );
+  routes.push(...buildProjectGitRoutes({ github, auth, fleet, storage, emitAudit }));
+  return routes;
+}
+async function loadOrgProject(options) {
+  const { github, auth, c } = options;
+  const resolved = await resolveOrgTenant(c, auth);
+  if ("response" in resolved) return { response: resolved.response };
+  const { orgId, userId } = resolved.tenant;
+  const projectRepositoryId = c.req.param("id");
+  if (!projectRepositoryId) {
+    return { response: c.json({ error: "Project repository not found" }, 404) };
+  }
+  const project = await resolveProjectRepository({ github, orgId, projectRepositoryId });
+  if (!project) {
+    return { response: c.json({ error: "Project repository not found" }, 404) };
+  }
+  return { project, userId };
+}
+function identityFromUser(user) {
+  const u = user;
+  return { name: u?.name ?? null, email: u?.email ?? null };
+}
+async function resolveProjectSandbox(options) {
+  const { fleet, sandboxRow } = options;
+  if (!sandboxRow.sandboxId) {
+    throw new MaterializeError("Project sandbox is not provisioned. Open the project first.", "clone-failed");
+  }
+  return fleet.reattachSandbox(sandboxRow.sandboxId);
+}
+async function loadOrCreateSandboxRow(github, project, userId) {
+  return github.sourceControlStorage.sandboxes.getOrCreate({ projectRepository: project, userId });
+}
+async function prepareProject(options) {
+  const { github, fleet, project, userId, onProgress } = options;
+  const sandboxRow = await loadOrCreateSandboxRow(github, project, userId);
+  const sandbox = await ensureProjectSandbox({
+    fleet,
+    row: sandboxRow,
+    storage: github.sourceControlStorage.sandboxes,
+    onProgress
+  });
+  const fresh = await github.sourceControlStorage.sandboxes.getById({ id: sandboxRow.id });
+  const access = await github.versionControl.getRepositoryAccess({
+    orgId: project.installation.orgId,
+    repositoryId: project.repository.id
+  });
+  if (!access.authorization) {
+    throw new MaterializeError("Repository access did not include a bearer token.", "clone-failed");
+  }
+  const finalRow = fresh ?? sandboxRow;
+  await materializeRepo({
+    row: finalRow,
+    repoInfo: { repoFullName: project.repository.slug, defaultBranch: project.defaultBranch },
+    sandbox,
+    token: access.authorization.token,
+    storage: github.sourceControlStorage.sandboxes,
+    onProgress
+  });
+  const result = {
+    resourceId: project.factoryProjectId,
+    factoryProjectId: project.factoryProjectId,
+    projectRepositoryId: project.id,
+    sandboxId: finalRow.sandboxId,
+    sandboxWorkdir: finalRow.sandboxWorkdir
+  };
+  const done = { phase: "done", message: "Workspace ready." };
+  onProgress?.(done);
+  return result;
+}
+function ensureErrorPayload(err) {
+  if (err instanceof SandboxBudgetError) {
+    return { status: 429, body: { error: err.code, message: err.message } };
+  }
+  if (err instanceof MaterializeError) {
+    return { status: 502, body: { error: err.code, message: err.message } };
+  }
+  return {
+    status: 500,
+    body: { error: "materialize_failed", message: err instanceof Error ? err.message : String(err) }
+  };
+}
+function gitErrorResponse(c, err) {
+  if (err instanceof WorktreeError) {
+    return c.json({ error: err.code, message: err.message }, err.code === "invalid-branch" ? 400 : 502);
+  }
+  if (err instanceof MaterializeError) {
+    return c.json({ error: err.code, message: err.message }, 502);
+  }
+  return c.json({ error: "git_failed", message: err instanceof Error ? err.message : String(err) }, 500);
+}
+async function loadOwnedProject(options) {
+  const { github, auth, fleet, c } = options;
+  const resolved = await resolveOrgTenant(c, auth);
+  if ("response" in resolved) return { response: resolved.response };
+  const { orgId, userId } = resolved.tenant;
+  if (!fleet.enabled) {
+    return {
+      response: c.json({ error: "sandbox_not_configured", message: "No sandbox provider is configured." }, 503)
+    };
+  }
+  const projectRepositoryId = c.req.param("id");
+  if (!projectRepositoryId) {
+    return { response: c.json({ error: "Project repository not found" }, 404) };
+  }
+  const project = await resolveProjectRepository({ github, orgId, projectRepositoryId });
+  if (!project) {
+    return { response: c.json({ error: "Project repository not found" }, 404) };
+  }
+  const sandboxRow = await loadOrCreateSandboxRow(github, project, userId);
+  return { orgId, userId, project, sandboxRow };
+}
+function buildProjectGitRoutes({
+  github,
+  auth,
+  fleet,
+  storage,
+  emitAudit
+}) {
+  return [
+    // ── Create / list Factory sessions ──────────────────────────────────────
+    registerApiRoute("/web/github/projects/:id/sessions", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        const resolved = await resolveOrgTenant(loose(c), auth);
+        if ("response" in resolved) return resolved.response;
+        const { orgId, userId } = resolved.tenant;
+        const projectRepositoryId = c.req.param("id");
+        const project = projectRepositoryId ? await resolveProjectRepository({ github, orgId, projectRepositoryId }) : null;
+        if (!project) return c.json({ error: "Project repository not found" }, 404);
+        const sessions = await github.sourceControlStorage.sessions.list({ projectRepositoryId: project.id, userId });
+        return c.json({ sessions });
+      }
+    }),
+    registerApiRoute("/web/github/projects/:id/sessions", {
+      method: "POST",
+      requiresAuth: false,
+      handler: async (c) => {
+        const resolved = await resolveOrgTenant(loose(c), auth);
+        if ("response" in resolved) return resolved.response;
+        const { orgId, userId } = resolved.tenant;
+        const projectRepositoryId = c.req.param("id");
+        const project = projectRepositoryId ? await resolveProjectRepository({ github, orgId, projectRepositoryId }) : null;
+        if (!project) return c.json({ error: "Project repository not found" }, 404);
+        let body;
+        try {
+          body = await c.req.json();
+        } catch {
+          return c.json({ error: "Invalid JSON body" }, 400);
+        }
+        if (!isValidGitRef(body.branch)) return c.json({ error: "Invalid branch" }, 400);
+        const baseBranch = body.baseBranch === void 0 ? project.defaultBranch : body.baseBranch;
+        if (!isValidGitRef(baseBranch)) return c.json({ error: "Invalid baseBranch" }, 400);
+        const session = await github.sourceControlStorage.sessions.create({
+          sessionId: randomUUID(),
+          projectRepositoryId: project.id,
+          orgId,
+          userId,
+          branch: body.branch,
+          baseBranch
+        });
+        return c.json({ session });
+      }
+    }),
+    registerApiRoute("/web/user-sessions/:sessionId", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        const resolved = await resolveOrgTenant(loose(c), auth);
+        if ("response" in resolved) return resolved.response;
+        const session = await github.sourceControlStorage.sessions.getBySessionId(c.req.param("sessionId"));
+        if (!session || session.orgId !== resolved.tenant.orgId || session.userId !== resolved.tenant.userId) {
+          return c.json({ error: "Session not found" }, 404);
+        }
+        return c.json({ session });
+      }
+    }),
+    registerApiRoute("/web/user-sessions/:sessionId", {
+      method: "DELETE",
+      requiresAuth: false,
+      handler: async (c) => {
+        const resolved = await resolveOrgTenant(loose(c), auth);
+        if ("response" in resolved) return resolved.response;
+        const session = await github.sourceControlStorage.sessions.getBySessionId(c.req.param("sessionId"));
+        if (!session || session.orgId !== resolved.tenant.orgId || session.userId !== resolved.tenant.userId) {
+          return c.json({ error: "Session not found" }, 404);
+        }
+        let sandbox;
+        if (session.sandboxId) {
+          try {
+            sandbox = await fleet.reattachSandbox(session.sandboxId);
+          } catch {
+          }
+          await fleet.teardownSandbox(
+            {
+              sandboxId: session.sandboxId,
+              setSandboxId: async () => {
+              },
+              clear: async () => {
+                await github.sourceControlStorage.sessions.setSandbox({
+                  id: session.id,
+                  sandboxId: null,
+                  sandboxWorkdir: session.sandboxWorkdir ?? ""
+                });
+              }
+            },
+            sandbox
+          );
+        }
+        await github.sourceControlStorage.sessions.delete(session.id);
+        return c.json({ removed: true });
+      }
+    }),
+    // ── Stage all + commit inside a Factory session workspace ──────────────
+    registerApiRoute("/web/github/projects/:id/commit", {
+      method: "POST",
+      requiresAuth: false,
+      handler: async (c) => {
+        const owned = await loadOwnedProject({ github, auth, fleet, c: loose(c) });
+        if ("response" in owned) return owned.response;
+        const { userId, project } = owned;
+        let body;
+        try {
+          body = await c.req.json();
+        } catch {
+          return c.json({ error: "Invalid JSON body" }, 400);
+        }
+        if (typeof body.message !== "string" || body.message.trim().length === 0 || body.message.length > 5e3) {
+          return c.json({ error: "Invalid message" }, 400);
+        }
+        const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
+        if (!sessionWorkspace) {
+          return c.json({ error: "Invalid sessionId" }, 400);
+        }
+        const { workdir, sandboxBinding } = sessionWorkspace;
+        try {
+          return await withProjectLock({
+            key: `${project.id}:${userId}`,
+            storage,
+            fn: async () => {
+              const sandbox = await resolveProjectSandbox({ fleet, sandboxRow: sandboxBinding });
+              const result = await commitAll(
+                sandbox,
+                workdir,
+                body.message,
+                identityFromUser(await auth.ensureUser(loose(c)))
+              );
+              if (result.committed) {
+                await emitAudit?.({
+                  context: loose(c),
+                  input: {
+                    action: "factory.git.commit",
+                    factoryProjectId: project.factoryProjectId,
+                    projectRepositoryId: project.id,
+                    targets: [{ type: "session", id: sessionWorkspace.session.sessionId }],
+                    metadata: { sessionId: sessionWorkspace.session.sessionId }
+                  }
+                });
+              }
+              return c.json({ committed: result.committed });
+            }
+          });
+        } catch (err) {
+          return gitErrorResponse(loose(c), err);
+        }
+      }
+    }),
+    // ── Push a branch back to GitHub ────────────────────────────────────────
+    registerApiRoute("/web/github/projects/:id/push", {
+      method: "POST",
+      requiresAuth: false,
+      handler: async (c) => {
+        const owned = await loadOwnedProject({ github, auth, fleet, c: loose(c) });
+        if ("response" in owned) return owned.response;
+        const { orgId, userId, project } = owned;
+        let body;
+        try {
+          body = await c.req.json();
+        } catch {
+          return c.json({ error: "Invalid JSON body" }, 400);
+        }
+        if (!isValidGitRef(body.branch)) {
+          return c.json({ error: "Invalid branch" }, 400);
+        }
+        const branch = body.branch;
+        const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
+        if (!sessionWorkspace) {
+          return c.json({ error: "Invalid sessionId" }, 400);
+        }
+        const { workdir, sandboxBinding } = sessionWorkspace;
+        try {
+          return await withProjectLock({
+            key: `${project.id}:${userId}`,
+            storage,
+            fn: async () => {
+              const sandbox = await resolveProjectSandbox({ fleet, sandboxRow: sandboxBinding });
+              const access = await github.versionControl.getRepositoryAccess({
+                orgId,
+                repositoryId: project.repository.id
+              });
+              if (!access.authorization) throw new Error("Repository access did not include a bearer token.");
+              await pushBranch(sandbox, workdir, branch, access.authorization.token, project.repository.slug);
+              await emitAudit?.({
+                context: loose(c),
+                input: {
+                  action: "factory.git.push",
+                  factoryProjectId: project.factoryProjectId,
+                  projectRepositoryId: project.id,
+                  targets: [{ type: "branch", id: branch }],
+                  metadata: { branch, sessionId: sessionWorkspace.session.sessionId }
+                }
+              });
+              return c.json({ pushed: true, branch });
+            }
+          });
+        } catch (err) {
+          return gitErrorResponse(loose(c), err);
+        }
+      }
+    }),
+    // ── Open a pull request through the version-control capability ─────────
+    registerApiRoute("/web/github/projects/:id/pr", {
+      method: "POST",
+      requiresAuth: false,
+      handler: async (c) => {
+        const owned = await loadOwnedProject({ github, auth, fleet, c: loose(c) });
+        if ("response" in owned) return owned.response;
+        const { orgId, userId, project } = owned;
+        let body;
+        try {
+          body = await c.req.json();
+        } catch {
+          return c.json({ error: "Invalid JSON body" }, 400);
+        }
+        if (!isValidGitRef(body.branch)) {
+          return c.json({ error: "Invalid branch" }, 400);
+        }
+        const base = body.base === void 0 ? project.defaultBranch : body.base;
+        if (!isValidGitRef(base)) {
+          return c.json({ error: "Invalid base" }, 400);
+        }
+        if (typeof body.title !== "string" || body.title.trim().length === 0 || body.title.length > 256) {
+          return c.json({ error: "Invalid title" }, 400);
+        }
+        if (body.body !== void 0 && (typeof body.body !== "string" || body.body.length > 65536)) {
+          return c.json({ error: "Invalid body" }, 400);
+        }
+        const head = body.branch;
+        const title = body.title;
+        const prBody = body.body;
+        const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
+        if (!sessionWorkspace) {
+          return c.json({ error: "Invalid sessionId" }, 400);
+        }
+        try {
+          return await withProjectLock({
+            key: `${project.id}:${userId}`,
+            storage,
+            fn: async () => {
+              const result = await github.versionControl.createPullRequest({
+                connection: {
+                  type: "app-installation",
+                  installationId: Number(project.installation.externalId)
+                },
+                sourceId: project.repository.slug,
+                baseBranch: base,
+                headBranch: head,
+                title,
+                body: prBody
+              });
+              await emitAudit?.({
+                context: loose(c),
+                input: {
+                  action: "factory.git.pr_opened",
+                  factoryProjectId: project.factoryProjectId,
+                  projectRepositoryId: project.id,
+                  targets: [{ type: "pull_request", id: result.url, name: title }],
+                  metadata: { branch: head, base, url: result.url }
+                }
+              });
+              const pullRequestNumber = pullRequestNumberFromUrl(result.url, project.repository.slug);
+              if (pullRequestNumber) {
+                const sessionId = sessionWorkspace.session.sessionId;
+                await subscribeToPullRequest(
+                  {
+                    orgId,
+                    installationExternalId: project.installation.externalId,
+                    projectRepositoryId: project.id,
+                    repositoryExternalId: project.repository.externalId,
+                    repositorySlug: project.repository.slug,
+                    changeRequestId: pullRequestNumber.toString(),
+                    sessionId,
+                    ownerId: userId,
+                    resourceId: sessionId,
+                    threadId: sessionId,
+                    source: "factory-pr-create",
+                    subscribedByUserId: userId
+                  },
+                  github.integrationStorage
+                ).catch((error) => {
+                  console.warn(
+                    `[GitHub] Pull request ${result.url} was created but automatic subscription failed.`,
+                    error
+                  );
+                });
+              }
+              return c.json({ url: result.url });
+            }
+          });
+        } catch (err) {
+          return c.json(
+            { error: "github_pr_create_failed", message: err instanceof Error ? err.message : String(err) },
+            502
+          );
+        }
+      }
+    }),
+    // ── Tear down the caller's sandbox for a project ────────────────────────
+    // Per-user teardown only: drops the caller's `(project, user)` sandbox
+    // binding and stops the VM, freeing a slot in the per-replica budget. Project
+    // deletion at the org level is out of scope (org admin model is later).
+    registerApiRoute("/web/github/projects/:id/sandbox", {
+      method: "DELETE",
+      requiresAuth: false,
+      handler: async (c) => {
+        const owned = await loadOwnedProject({ github, auth, fleet, c: loose(c) });
+        if ("response" in owned) return owned.response;
+        const { userId, project, sandboxRow } = owned;
+        if (!sandboxRow.sandboxId) {
+          return c.json({ tornDown: false });
+        }
+        try {
+          return await withProjectLock({
+            key: `${project.id}:${userId}`,
+            storage,
+            fn: async () => {
+              const sandbox = await fleet.reattachSandbox(sandboxRow.sandboxId);
+              await teardownProjectSandbox({
+                fleet,
+                row: sandboxRow,
+                storage: github.sourceControlStorage.sandboxes,
+                sandbox
+              });
+              return c.json({ tornDown: true });
+            }
+          });
+        } catch (err) {
+          return gitErrorResponse(loose(c), err);
+        }
+      }
+    })
+  ];
+}
+async function resolveSessionWorkspace(github, projectId, userId, sessionId) {
+  if (typeof sessionId !== "string") {
+    return void 0;
+  }
+  const session = await github.sourceControlStorage.sessions.getBySessionId(sessionId);
+  if (session?.projectRepositoryId !== projectId || session.userId !== userId || !session.sandboxId || !session.sandboxWorkdir) {
+    return void 0;
+  }
+  return {
+    session,
+    workdir: session.sandboxWorkdir,
+    sandboxBinding: {
+      id: session.id,
+      projectRepositoryId: session.projectRepositoryId,
+      userId: session.userId,
+      sandboxId: session.sandboxId,
+      sandboxWorkdir: session.sandboxWorkdir,
+      materializedAt: session.materializedAt,
+      createdAt: session.createdAt
+    }
+  };
+}
+
+// src/integrations/github/session-subscriptions.ts
+import { createTool } from "@mastra/core/tools";
+import { z } from "zod";
+function sessionUserId(user) {
+  return user?.workosId ?? user?.id;
+}
+function sessionOrgId(user) {
+  return user?.organizationId;
+}
+var pullRequestInputSchema = z.object({
+  pullRequest: z.union([z.number().int().positive(), z.string().min(1)])
+});
+function parsePullRequest(value, expectedRepo) {
+  if (typeof value === "number") return value;
+  if (/^\d+$/.test(value)) return Number(value);
+  const match = value.match(/^https:\/\/github\.com\/([^/]+\/[^/]+)\/pull\/(\d+)\/?$/i);
+  if (!match || match[1].toLowerCase() !== expectedRepo.toLowerCase()) {
+    throw new Error(`Pull request must belong to ${expectedRepo}.`);
+  }
+  return Number(match[2]);
+}
+function isGithubProjectSession(requestContext) {
+  const context = requestContext.get("controller");
+  const user = requestContext.get("user");
+  return Boolean(
+    context?.threadId && context.getState().projectRepositoryId && sessionOrgId(user) && sessionUserId(user)
+  );
+}
+async function resolveSessionTarget(requestContext, github) {
+  const context = requestContext.get("controller");
+  const user = requestContext.get("user");
+  const orgId = sessionOrgId(user);
+  const userId = sessionUserId(user);
+  const projectRepositoryId = context?.getState().projectRepositoryId;
+  if (!context || !context.threadId || !projectRepositoryId || !orgId || !userId) {
+    throw new Error("GitHub subscriptions require an authenticated repository session with an active thread.");
+  }
+  const projectRepository = await github.sourceControlStorage.projectRepositories.get({
+    orgId,
+    id: projectRepositoryId
+  });
+  if (!projectRepository) throw new Error("Project repository not found for this organization.");
+  const connection = await github.sourceControlStorage.connections.get({ orgId, id: projectRepository.connectionId });
+  if (!connection) throw new Error("Source-control connection not found for this organization.");
+  const repository = await github.sourceControlStorage.repositories.get({ orgId, id: projectRepository.repositoryId });
+  if (!repository) throw new Error("Repository not found for this organization.");
+  const installation = await github.sourceControlStorage.installations.get({ orgId, id: connection.installationId });
+  if (!installation) throw new Error("Source-control installation not found for this organization.");
+  return { context, projectRepository, connection, installation, repository, orgId, userId };
+}
+async function verifyPullRequest(target, pullRequest, github) {
+  const [owner, repo] = target.repository.slug.split("/");
+  if (!owner || !repo) throw new Error("GitHub repository is invalid.");
+  const octokit = github.getInstallationOctokit(Number(target.installation.externalId));
+  const { data } = await octokit.pulls.get({ owner, repo, pull_number: pullRequest });
+  if (String(data.base.repo.id) !== target.repository.externalId)
+    throw new Error("Pull request repository does not match the active project repository.");
+}
+async function subscriptionInput(target, pullRequestNumber) {
+  return {
+    orgId: target.orgId,
+    installationExternalId: target.installation.externalId,
+    projectRepositoryId: target.projectRepository.id,
+    repositoryExternalId: target.repository.externalId,
+    repositorySlug: target.repository.slug,
+    changeRequestId: String(pullRequestNumber),
+    sessionId: target.context.session.id,
+    ownerId: target.context.session.ownerId,
+    resourceId: target.connection.factoryProjectId,
+    threadId: target.context.threadId,
+    sessionScope: target.context.scope,
+    source: "explicit-tool",
+    subscribedByUserId: target.userId
+  };
+}
+async function subscribeCurrentSessionToPullRequest(requestContext, pullRequest, source, github) {
+  if (source === "auto-gh-pr-create" && !isGithubProjectSession(requestContext)) return void 0;
+  const target = await resolveSessionTarget(requestContext, github);
+  const number = parsePullRequest(pullRequest, target.repository.slug);
+  await verifyPullRequest(target, number, github);
+  await subscribeToPullRequest({ ...await subscriptionInput(target, number), source }, github.integrationStorage);
+  return number;
+}
+async function unsubscribeCurrentSessionFromPullRequest(requestContext, pullRequest, github) {
+  const target = await resolveSessionTarget(requestContext, github);
+  const number = parsePullRequest(pullRequest, target.repository.slug);
+  await unsubscribeFromPullRequest(await subscriptionInput(target, number), github.integrationStorage);
+  return number;
+}
+function createGithubSubscriptionTools(requestContext, github) {
+  const context = requestContext.get("controller");
+  const user = requestContext.get("user");
+  if (!context?.getState().projectRepositoryId || !sessionOrgId(user) || !sessionUserId(user)) return {};
+  return {
+    github_subscribe_pr: createTool({
+      id: "github_subscribe_pr",
+      description: "Subscribe this thread to GitHub pull request activity. You usually do not need this tool: successful gh pr create commands subscribe automatically. Use it for an existing PR or to recover when automatic subscription did not occur. Closed or merged PRs are unsubscribed automatically. Accepts a PR number or canonical URL for the active project.",
+      inputSchema: pullRequestInputSchema,
+      execute: async ({ pullRequest }) => {
+        const number = await subscribeCurrentSessionToPullRequest(requestContext, pullRequest, "explicit-tool", github);
+        return { subscribed: true, pullRequestNumber: number };
+      }
+    }),
+    github_unsubscribe_pr: createTool({
+      id: "github_unsubscribe_pr",
+      description: "Manually unsubscribe this thread from GitHub pull request activity. You usually do not need this tool because closed or merged PRs are unsubscribed automatically. Use it to stop notifications before then. Accepts a PR number or canonical URL for the active project.",
+      inputSchema: pullRequestInputSchema,
+      execute: async ({ pullRequest }) => {
+        const number = await unsubscribeCurrentSessionFromPullRequest(requestContext, pullRequest, github);
+        return { subscribed: false, pullRequestNumber: number };
+      }
+    })
+  };
+}
+function stripHeredocBodies(command) {
+  const lines = command.split("\n");
+  const executableLines = [];
+  let delimiter;
+  for (const line of lines) {
+    if (delimiter) {
+      if (line.trim() === delimiter) delimiter = void 0;
+      continue;
+    }
+    executableLines.push(line);
+    const heredoc = line.match(/<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/);
+    delimiter = heredoc?.[2];
+  }
+  return executableLines.join("\n");
+}
+function parseCreatedPullRequest(context) {
+  if (context.toolName !== "execute_command" || context.error) return void 0;
+  const command = context.input?.command;
+  if (typeof command !== "string" || !/(?:^|\n|;|&&|\|\|)\s*gh\s+pr\s+create(?:\s|$)/.test(stripHeredocBodies(command))) {
+    return void 0;
+  }
+  const output = context.output;
+  const stdout = typeof context.output === "string" ? context.output : output?.stdout ?? output?.result;
+  if (typeof stdout !== "string") return void 0;
+  const urls = stdout.match(/https:\/\/github\.com\/[^\s/]+\/[^\s/]+\/pull\/\d+/g) ?? [];
+  return urls.length === 1 ? urls[0] : void 0;
+}
+
+// src/integrations/platform/api-client.ts
+function platformApiClientConfigFromEnv() {
+  const sharedApiUrl = process.env.MASTRA_SHARED_API_URL?.trim() || "https://platform.mastra.ai/v1";
+  const accessToken = process.env.MASTRA_PLATFORM_SECRET_KEY?.trim();
+  if (!accessToken) {
+    throw new Error("Platform integration: missing required environment variable MASTRA_PLATFORM_SECRET_KEY.");
+  }
+  return { baseUrl: normalizeSharedApiUrl(sharedApiUrl), accessToken };
+}
+function normalizeSharedApiUrl(sharedApiUrl) {
+  return sharedApiUrl.replace(/\/+$/, "").replace(/\/v1$/, "");
+}
+var PlatformApiError = class extends Error {
+  status;
+  retryAfterSeconds;
+  constructor(message, status, retryAfterSeconds = null) {
+    super(message);
+    this.name = "PlatformApiError";
+    this.status = status;
+    this.retryAfterSeconds = retryAfterSeconds;
+  }
+};
+var PlatformApiClient = class {
+  #baseUrl;
+  #accessToken;
+  #fetch;
+  constructor(config) {
+    const missing = ["baseUrl", "accessToken"].filter((field) => !config[field]);
+    if (missing.length > 0) {
+      throw new Error(`Platform integration: missing required config field(s): ${missing.join(", ")}.`);
+    }
+    this.#baseUrl = config.baseUrl.replace(/\/+$/, "");
+    this.#accessToken = config.accessToken;
+    this.#fetch = config.fetchImpl ?? globalThis.fetch;
+  }
+  async request(method, path2, body, options) {
+    const response = await this.#send(method, path2, body, options);
+    if (!response.ok) {
+      const message = redact(await extractError(response), this.#accessToken);
+      const retryAfterSeconds = parseRetryAfter(response.headers.get("retry-after"));
+      logPlatformError("Platform API request failed", {
+        method,
+        path: path2,
+        status: response.status,
+        retryAfterSeconds,
+        message
+      });
+      throw new PlatformApiError(message, response.status, retryAfterSeconds);
+    }
+    if (response.status === 204) return void 0;
+    return await response.json();
+  }
+  async requestRedirect(method, path2, options) {
+    const response = await this.#send(method, path2, void 0, options, "manual");
+    if (response.status >= 300 && response.status < 400) {
+      const location = response.headers.get("location");
+      if (location) return location;
+    }
+    if (!response.ok) {
+      const message = redact(await extractError(response), this.#accessToken);
+      const retryAfterSeconds = parseRetryAfter(response.headers.get("retry-after"));
+      logPlatformError("Platform API redirect request failed", {
+        method,
+        path: path2,
+        status: response.status,
+        retryAfterSeconds,
+        message
+      });
+      throw new PlatformApiError(message, response.status, retryAfterSeconds);
+    }
+    logPlatformError("Platform API request did not return a redirect", { method, path: path2, status: response.status });
+    throw new PlatformApiError("Platform API request did not return a redirect.", response.status);
+  }
+  async #send(method, path2, body, options, redirect) {
+    const headers = {
+      accept: "application/json",
+      authorization: `Bearer ${this.#accessToken}`
+    };
+    const timeoutSignal = AbortSignal.timeout(15e3);
+    const init = {
+      method,
+      headers,
+      redirect,
+      signal: options?.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal
+    };
+    if (body !== void 0) {
+      headers["content-type"] = "application/json";
+      init.body = JSON.stringify(body);
+    }
+    try {
+      return await this.#fetch(`${this.#baseUrl}${path2}`, init);
+    } catch (error) {
+      if (error instanceof Error && error.message.includes(this.#accessToken)) {
+        const redacted = new Error(redact(error.message, this.#accessToken));
+        redacted.name = error.name;
+        logPlatformError("Platform API transport error", {
+          method,
+          path: path2,
+          name: redacted.name,
+          message: redacted.message
+        });
+        throw redacted;
+      }
+      logPlatformError("Platform API transport error", {
+        method,
+        path: path2,
+        name: error instanceof Error ? error.name : void 0,
+        message: error instanceof Error ? error.message : String(error)
+      });
+      throw error;
+    }
+  }
+};
+async function extractError(response) {
+  try {
+    const data = await response.clone().json();
+    for (const field of ["detail", "error", "title"]) {
+      if (typeof data[field] === "string" && data[field]) return data[field];
+    }
+  } catch {
+  }
+  return `Platform API request failed (${response.status})`;
+}
+function redact(message, accessToken) {
+  return message.split(accessToken).join("[REDACTED]");
+}
+function logPlatformInfo(message, fields) {
+  writePlatformLog("info", message, fields);
+}
+function logPlatformError(message, fields) {
+  writePlatformLog("error", message, fields);
+}
+function writePlatformLog(level, message, fields) {
+  const metadata = fields ? ` ${JSON.stringify(stripUndefined(fields))}` : "";
+  process.stderr.write(`[MastraCode Web] ${level.toUpperCase()} ${message}${metadata}
+`);
+}
+function stripUndefined(fields) {
+  return Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== void 0));
+}
+function parseRetryAfter(value) {
+  if (!value) return null;
+  const seconds = Number.parseInt(value, 10);
+  return Number.isSafeInteger(seconds) && seconds >= 0 ? seconds : null;
+}
+
+// src/integrations/platform/github/event-worker.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { isLeaseProvider, NoopLeaseProvider } from "@mastra/core/events";
+import { MastraWorker } from "@mastra/core/worker";
+var API_PREFIX = "/v1/server/github-app";
+var DEFAULT_POLL_INTERVAL_MS = 5e3;
+var EVENT_PAGE_SIZE = 500;
+var MIN_LEASE_TTL_MS = 3e4;
+var CURSOR_ORG_ID = "__platform_github_event_worker__";
+var CURSOR_USER_ID = "worker";
+var SUPPORTED_EVENTS = /* @__PURE__ */ new Set([
+  "issues",
+  "issue_comment",
+  "pull_request",
+  "pull_request_review",
+  "pull_request_review_comment"
+]);
+var AUTHOR_GATED_KINDS2 = /* @__PURE__ */ new Set([
+  "issue-comment",
+  "pull-request-comment",
+  "pull-request-review",
+  "pull-request-review-comment"
+]);
+var AUTHORIZED_BOTS2 = /* @__PURE__ */ new Set(["coderabbitai[bot]", "devin-ai-integration[bot]"]);
+var AUTHORIZED_PERMISSIONS2 = /* @__PURE__ */ new Set(["admin", "maintain", "write"]);
+var PERMISSION_CHECK_TIMEOUT_MS2 = 5e3;
+var PlatformGithubEventWorker = class extends MastraWorker {
+  name = "platform-github-events";
+  #client;
+  #controller;
+  #github;
+  #storage;
+  #ingestFactoryEvent;
+  #intervalMs;
+  #now;
+  #dispatch;
+  #leaseOwner = randomUUID2();
+  #running = false;
+  #timer;
+  #leaseRenewalTimer;
+  #inFlight;
+  #leaseProvider = NoopLeaseProvider;
+  #leaseTtlMs;
+  #hasLease = false;
+  #startedAt = 0;
+  #settings = { version: 1, repositories: {} };
+  constructor(config) {
+    super();
+    this.#client = config.client;
+    this.#controller = config.controller;
+    this.#github = config.github;
+    this.#storage = config.storage;
+    this.#ingestFactoryEvent = config.ingestFactoryEvent;
+    this.#intervalMs = config.intervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+    if (!Number.isFinite(this.#intervalMs) || this.#intervalMs <= 0) {
+      throw new Error("Platform GitHub event polling interval must be a positive number.");
+    }
+    this.#leaseTtlMs = Math.max(MIN_LEASE_TTL_MS, this.#intervalMs * 3);
+    this.#now = config.now ?? Date.now;
+    this.#dispatch = config.dispatch ?? dispatchGithubWebhook;
+  }
+  async init(deps) {
+    await super.init(deps);
+    this.#leaseProvider = getLeaseProvider(deps.pubsub);
+  }
+  async start() {
+    if (this.#running) return;
+    if (!this.deps) throw new Error("PlatformGithubEventWorker: call init() before start()");
+    this.#startedAt = this.#now() - 1;
+    this.#settings = normalizeSettings(await this.#storage.settings.get(CURSOR_ORG_ID, CURSOR_USER_ID));
+    this.#running = true;
+    this.deps.logger.info("Platform GitHub event polling started", {
+      intervalMs: this.#intervalMs,
+      leaseTtlMs: this.#leaseTtlMs
+    });
+    this.#schedule(0);
+  }
+  async stop() {
+    if (!this.#running) return;
+    this.#running = false;
+    if (this.#timer) clearTimeout(this.#timer);
+    this.#timer = void 0;
+    this.#stopLeaseRenewal();
+    await this.#inFlight;
+    if (this.#hasLease) {
+      await this.#leaseProvider.releaseLease(this.#leaseKey(), this.#leaseOwner).catch(() => void 0);
+      this.#hasLease = false;
+    }
+  }
+  get isRunning() {
+    return this.#running;
+  }
+  #schedule(delayMs) {
+    if (!this.#running) return;
+    this.#timer = setTimeout(() => {
+      this.#timer = void 0;
+      const run = this.#tick();
+      this.#inFlight = run;
+      void run.finally(() => {
+        if (this.#inFlight === run) this.#inFlight = void 0;
+      });
+    }, delayMs);
+    this.#timer.unref?.();
+  }
+  async #tick() {
+    let nextDelay = this.#intervalMs;
+    try {
+      if (!await this.#ensureLease()) return;
+      nextDelay = await this.#poll();
+    } catch (error) {
+      nextDelay = retryDelay(error, this.#intervalMs);
+      this.deps?.logger.error("Platform GitHub event polling cycle failed", {
+        error: error instanceof Error ? error.message : String(error),
+        retryInMs: nextDelay
+      });
+    } finally {
+      this.#schedule(nextDelay);
+    }
+  }
+  async #ensureLease() {
+    if (this.#hasLease) return true;
+    const result = await this.#leaseProvider.acquireLease(this.#leaseKey(), this.#leaseOwner, this.#leaseTtlMs);
+    this.#hasLease = result.acquired;
+    if (this.#hasLease) this.#startLeaseRenewal();
+    return this.#hasLease;
+  }
+  #startLeaseRenewal() {
+    if (this.#leaseRenewalTimer) return;
+    this.#leaseRenewalTimer = setInterval(
+      () => {
+        void this.#leaseProvider.renewLease(this.#leaseKey(), this.#leaseOwner, this.#leaseTtlMs).then((renewed) => {
+          if (!renewed) {
+            this.#hasLease = false;
+            this.#stopLeaseRenewal();
+          }
+        }).catch((error) => {
+          this.#hasLease = false;
+          this.#stopLeaseRenewal();
+          this.deps?.logger.warn("Platform GitHub event polling lease renewal failed", {
+            error: error instanceof Error ? error.message : String(error)
+          });
+        });
+      },
+      Math.floor(this.#leaseTtlMs / 3)
+    );
+    this.#leaseRenewalTimer.unref?.();
+  }
+  #stopLeaseRenewal() {
+    if (this.#leaseRenewalTimer) clearInterval(this.#leaseRenewalTimer);
+    this.#leaseRenewalTimer = void 0;
+  }
+  async #poll() {
+    const repositories = await this.#discoverRepositories();
+    let retryInMs = this.#intervalMs;
+    for (const repository of repositories) {
+      if (!this.#running || !this.#hasLease) break;
+      try {
+        await this.#pollRepository(repository.id);
+      } catch (error) {
+        const delay = retryDelay(error, this.#intervalMs);
+        retryInMs = Math.max(retryInMs, delay);
+        this.deps?.logger.error("Platform GitHub repository event polling failed", {
+          repositoryId: repository.id,
+          error: error instanceof Error ? error.message : String(error),
+          retryInMs: delay
+        });
+        if (error instanceof PlatformApiError && error.status === 429) break;
+      }
+    }
+    return retryInMs;
+  }
+  async #discoverRepositories() {
+    const result = await this.#client.request("GET", `${API_PREFIX}/installations`);
+    const repositories = /* @__PURE__ */ new Map();
+    for (const installation of result.installations) {
+      if (!installation.usable || installation.suspendedAt) continue;
+      const page = await this.#client.request(
+        "GET",
+        `${API_PREFIX}/installations/${installation.installationId}/repositories`
+      );
+      for (const repository of page.repositories) repositories.set(repository.id, repository);
+    }
+    return [...repositories.values()];
+  }
+  async #pollRepository(repositoryId) {
+    const key = String(repositoryId);
+    if (!this.#settings.repositories[key]) {
+      this.#settings.repositories[key] = { afterTimestamp: this.#startedAt };
+      await this.#saveSettings();
+    }
+    while (this.#running && this.#hasLease) {
+      const cursor = this.#settings.repositories[key];
+      const query = new URLSearchParams({ limit: String(EVENT_PAGE_SIZE) });
+      if ("afterEventId" in cursor) query.set("afterEventId", cursor.afterEventId);
+      else query.set("afterTimestamp", String(cursor.afterTimestamp));
+      const page = await this.#client.request(
+        "GET",
+        `${API_PREFIX}/repositories/${repositoryId}/events?${query}`
+      );
+      if (page.events.length === 0 || !page.nextCursor) return;
+      for (const event of page.events) {
+        if (!this.#running || !this.#hasLease) return;
+        const parsed = parseEvent(event);
+        if (!parsed) {
+          this.deps?.logger.warn("Platform GitHub event log returned a malformed event", {
+            repositoryId,
+            eventId: event.id
+          });
+          continue;
+        }
+        if (isFactoryClosureEvent(parsed)) {
+          await this.#ingestFactoryEvent?.(parsed);
+        }
+        const result = await this.#dispatch(parsed, {
+          controller: this.#controller,
+          listSubscriptions: (target, options) => listPullRequestSubscriptionsForWebhook(target, options, this.#github.integrationStorage),
+          retireSubscription: (id, status) => retirePullRequestSubscription(id, status, this.#github.integrationStorage),
+          isAuthorizedSender: (notification) => this.#isAuthorizedSender(notification),
+          onTargetError: (subscription, error) => {
+            this.deps?.logger.error("Platform GitHub event delivery failed for a subscription", {
+              subscriptionId: subscription.id,
+              resourceId: subscription.resourceId,
+              threadId: subscription.threadId,
+              error: error instanceof Error ? error.message : String(error)
+            });
+          }
+        });
+        if (result.failed > 0) {
+          throw new Error(
+            `Platform GitHub event ${event.deliveryId} failed for ${result.failed} subscribed target(s).`
+          );
+        }
+      }
+      if (page.nextCursor === ("afterEventId" in cursor ? cursor.afterEventId : void 0)) return;
+      this.#settings.repositories[key] = { afterEventId: page.nextCursor };
+      await this.#saveSettings();
+    }
+  }
+  async #isAuthorizedSender(notification) {
+    if (!AUTHOR_GATED_KINDS2.has(notification.kind)) return true;
+    const sender = notification.metadata.sender;
+    const repository = notification.metadata.repository;
+    if (!sender || !repository) return false;
+    if (AUTHORIZED_BOTS2.has(sender)) return true;
+    const abortController = new AbortController();
+    const timeout = setTimeout(() => abortController.abort(), PERMISSION_CHECK_TIMEOUT_MS2);
+    try {
+      const permission = await this.#github.getRepositoryCollaboratorPermission(
+        notification.metadata.installationId,
+        repository,
+        sender,
+        abortController.signal
+      );
+      return permission !== void 0 && AUTHORIZED_PERMISSIONS2.has(permission);
+    } catch {
+      return false;
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+  async #saveSettings() {
+    await this.#storage.settings.save(CURSOR_ORG_ID, CURSOR_USER_ID, this.#settings);
+  }
+  #leaseKey() {
+    return `${this.name}:${this.#storage.integrationId}`;
+  }
+};
+function getLeaseProvider(pubsub) {
+  const getProvider = pubsub.getLeaseProvider;
+  if (typeof getProvider === "function") return getProvider.call(pubsub) ?? NoopLeaseProvider;
+  return isLeaseProvider(pubsub) ? pubsub : NoopLeaseProvider;
+}
+function normalizeSettings(value) {
+  if (!value || value.version !== 1 || !value.repositories || typeof value.repositories !== "object") {
+    return { version: 1, repositories: {} };
+  }
+  return { version: 1, repositories: { ...value.repositories } };
+}
+function isFactoryClosureEvent(event) {
+  return (event.event === "issues" || event.event === "pull_request") && event.payload.action === "closed";
+}
+function parseEvent(event) {
+  if (!event.id || !event.deliveryId || !SUPPORTED_EVENTS.has(event.event) || !event.payload || typeof event.payload !== "object" || Array.isArray(event.payload)) {
+    return null;
+  }
+  return {
+    event: event.event,
+    deliveryId: event.deliveryId,
+    payload: event.payload
+  };
+}
+function retryDelay(error, fallbackMs) {
+  if (error instanceof PlatformApiError && error.status === 429 && error.retryAfterSeconds !== null) {
+    return Math.max(fallbackMs, error.retryAfterSeconds * 1e3);
+  }
+  return fallbackMs;
+}
+
+// src/integrations/platform/github/integration.ts
+var PAGE_SIZE = 30;
+var API_PREFIX2 = "/v1/server";
+function loose2(c) {
+  return c;
+}
+function routeBaseUrl(ctx, requestUrl) {
+  return (ctx.baseUrl || new URL(requestUrl).origin).replace(/\/+$/, "");
+}
+var PlatformGithubIntegration = class {
+  id = "github";
+  #client;
+  #endpointHost;
+  #pollingEnabled;
+  #pollingIntervalMs;
+  #storage;
+  #integrationStorage;
+  intake = {
+    listSources: async ({ orgId, userId }) => {
+      const installations = await this.#client.request("GET", `${API_PREFIX2}/github-app/installations`);
+      const usable = installations.installations.filter(
+        (installation) => installation.usable && !installation.suspendedAt
+      );
+      const repositories = await Promise.all(
+        usable.map(async (installation) => {
+          const storedInstallation = await this.versionControl.registerInstallation({
+            orgId,
+            userId,
+            installation: {
+              externalId: String(installation.installationId),
+              accountName: installation.accountLogin,
+              accountType: installation.accountType
+            }
+          });
+          const result = await this.#client.request("GET", `${API_PREFIX2}/github-app/installations/${installation.installationId}/repositories`);
+          await this.versionControl.registerRepositories({
+            orgId,
+            installationId: storedInstallation.id,
+            repositories: result.repositories.map((repository) => ({
+              externalId: String(repository.id),
+              slug: repository.fullName,
+              defaultBranch: repository.defaultBranch,
+              metadata: { private: repository.private, url: repository.htmlUrl }
+            }))
+          });
+          return result.repositories.map((repository) => ({ repository, installation }));
+        })
+      );
+      return repositories.flat().map(({ repository, installation }) => ({
+        id: repository.fullName,
+        name: repository.fullName,
+        type: "repository",
+        metadata: {
+          installationId: installation.installationId,
+          accountLogin: installation.accountLogin,
+          accountType: installation.accountType,
+          repositoryId: repository.id,
+          defaultBranch: repository.defaultBranch,
+          private: repository.private,
+          url: repository.htmlUrl
+        }
+      }));
+    },
+    listItems: async ({ sourceIds, cursor }) => {
+      const page = parsePositiveCursor(cursor);
+      const pages = await Promise.all(
+        sourceIds.map(async (sourceId) => {
+          const connection = { type: "app-installation", installationId: 1 };
+          const [issues, pullRequests] = await Promise.all([
+            this.#listIssues(connection, sourceId, page),
+            this.#listPullRequests({ connection, sourceId, includeDrafts: false, cursor: String(page) })
+          ]);
+          return {
+            items: [
+              ...issues.issues.map((issue) => ({
+                source: { type: "issue", externalId: `${sourceId}:${issue.id}`, url: issue.url },
+                sourceId,
+                title: issue.title,
+                status: issue.state ?? void 0,
+                labels: issue.labels,
+                assignee: issue.assignee,
+                createdAt: issue.createdAt,
+                updatedAt: issue.updatedAt,
+                metadata: { repository: sourceId, number: Number(issue.id), author: issue.author }
+              })),
+              ...pullRequests.pullRequests.map((pullRequest) => ({
+                source: { type: "pull-request", externalId: `${sourceId}:${pullRequest.id}`, url: pullRequest.url },
+                sourceId,
+                title: pullRequest.title,
+                status: pullRequest.state,
+                createdAt: pullRequest.createdAt,
+                updatedAt: pullRequest.updatedAt,
+                metadata: {
+                  repository: sourceId,
+                  number: Number(pullRequest.id),
+                  author: pullRequest.author,
+                  baseBranch: pullRequest.baseBranch,
+                  headBranch: pullRequest.headBranch
+                }
+              }))
+            ],
+            hasNextPage: issues.nextCursor !== null || pullRequests.nextCursor !== null
+          };
+        })
+      );
+      return {
+        items: pages.flatMap((result) => result.items),
+        nextCursor: pages.some((result) => result.hasNextPage) ? String(page + 1) : null
+      };
+    },
+    listIssues: async (input) => {
+      requireGithubConnection(input.connection);
+      const sourceId = requireSingleSource(input.sourceIds, "GitHub Intake requires exactly one repository source.");
+      return this.#listIssues(input.connection, sourceId, parsePositiveCursor(input.cursor), input.labels);
+    },
+    getIssue: (input) => this.#getIssue(input.connection, input.sourceId, input.issueId),
+    createComment: (input) => this.#createIssueComment(input.connection, input.sourceId, input.issueId, input.body)
+  };
+  versionControl = {
+    initialize: ({ storage }) => {
+      this.#storage = storage;
+    },
+    registerInstallation: ({ orgId, userId, installation }) => this.storage.installations.upsert({
+      orgId,
+      connectedByUserId: userId,
+      externalId: installation.externalId,
+      accountName: installation.accountName,
+      accountType: installation.accountType,
+      providerMetadata: installation.metadata
+    }),
+    registerRepositories: ({ orgId, installationId, repositories }) => Promise.all(
+      repositories.map(
+        (repository) => this.storage.repositories.upsert({
+          orgId,
+          input: {
+            installationId,
+            externalId: repository.externalId,
+            slug: repository.slug,
+            defaultBranch: repository.defaultBranch,
+            providerMetadata: repository.metadata
+          }
+        })
+      )
+    ),
+    getRepositoryAccess: async ({ orgId, repositoryId }) => {
+      const repository = await this.storage.repositories.get({ orgId, id: repositoryId });
+      if (!repository) throw new Error("Version-control repository not found.");
+      const installation = await this.storage.installations.get({ orgId, id: repository.installationId });
+      if (!installation) throw new Error("Version-control installation not found.");
+      const installationId = parsePositiveInteger(installation.externalId);
+      if (installationId === null) throw new Error("GitHub installation id is invalid.");
+      const repositoryName = splitRepository(repository.slug).repo;
+      const token = await this.#client.request(
+        "POST",
+        `${API_PREFIX2}/github-app/installations/${installationId}/token`,
+        { repositories: [repositoryName], permissions: { contents: "write" } }
+      );
+      return {
+        cloneUrl: `https://github.com/${repository.slug}.git`,
+        authorization: { scheme: "bearer", token: token.token }
+      };
+    },
+    listPullRequests: (input) => this.#listPullRequests(input),
+    getPullRequest: (input) => this.#getPullRequest(input),
+    createPullRequest: (input) => this.#createPullRequest(input),
+    updatePullRequest: (input) => this.#updatePullRequest(input),
+    closePullRequest: (input) => this.#updatePullRequest({ ...input, state: "closed" }),
+    mergePullRequest: (input) => this.#mergePullRequest(input),
+    listComments: (input) => this.#listComments(input),
+    createComment: (input) => this.#createComment(input),
+    updateComment: (input) => this.#updateComment(input),
+    deleteComment: (input) => this.#deleteComment(input),
+    listReviews: (input) => this.#listReviews(input),
+    getReview: (input) => this.#getReview(input),
+    createReview: (input) => this.#createReview(input),
+    updateReview: (input) => this.#updateReview(input),
+    submitReview: (input) => this.#submitReview(input),
+    dismissReview: (input) => this.#dismissReview(input),
+    deletePendingReview: (input) => this.#deletePendingReview(input),
+    listReviewComments: (input) => this.#listReviewComments(input),
+    createReviewComment: (input) => this.#createReviewComment(input),
+    updateReviewComment: (input) => this.#updateReviewComment(input),
+    deleteReviewComment: (input) => this.#deleteReviewComment(input),
+    listRequestedReviewers: (input) => this.#requestedReviewers("GET", input),
+    requestReviewers: (input) => this.#requestedReviewers("POST", input),
+    removeRequestedReviewers: (input) => this.#requestedReviewers("DELETE", input)
+  };
+  constructor() {
+    const config = platformApiClientConfigFromEnv();
+    this.#client = new PlatformApiClient(config);
+    this.#endpointHost = new URL(config.baseUrl).host;
+    this.#pollingEnabled = process.env.MASTRA_PLATFORM_GITHUB_POLLING_ENABLED?.trim().toLowerCase() !== "false";
+    this.#pollingIntervalMs = optionalPositiveIntegerEnv("MASTRA_PLATFORM_GITHUB_POLLING_INTERVAL_MS");
+  }
+  get storage() {
+    if (!this.#storage) throw new Error("PlatformGithubIntegration source-control storage has not been initialized.");
+    return this.#storage;
+  }
+  get sourceControlStorage() {
+    return this.storage;
+  }
+  get integrationStorage() {
+    if (!this.#integrationStorage) {
+      throw new Error("PlatformGithubIntegration generic storage has not been initialized.");
+    }
+    return this.#integrationStorage;
+  }
+  initialize({ storage }) {
+    this.#integrationStorage = storage;
+    logPlatformInfo("Platform GitHub integration initialized", {
+      endpointHost: this.#endpointHost,
+      pollingEnabled: this.#pollingEnabled,
+      pollingIntervalMs: this.#pollingIntervalMs
+    });
+  }
+  routes(ctx) {
+    return [
+      this.#statusRoute(ctx),
+      this.#connectRoute(ctx),
+      ...buildGithubRoutes({
+        auth: ctx.auth,
+        fleet: ctx.fleet,
+        storage: ctx.factoryStorage,
+        github: this,
+        stateSigner: ctx.stateSigner,
+        baseUrl: ctx.baseUrl,
+        controller: ctx.controller,
+        projects: ctx.storage.projects,
+        emitAudit: ctx.hooks?.emitAudit,
+        ingestFactoryEvent: ctx.hooks?.ingestGithubEvent
+      }).filter(
+        (route) => route.path !== "/web/github/status" && route.path !== "/web/github/webhook" && !route.path.startsWith("/auth/github/")
+      )
+    ];
+  }
+  #statusRoute(ctx) {
+    return registerApiRoute2("/web/github/status", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        await ctx.auth.ensureUser(loose2(c));
+        const tenant = ctx.auth.tenant(loose2(c));
+        if (!tenant) return c.json({ error: "unauthorized", reason: "auth_required" }, 401);
+        if (!tenant.orgId) {
+          return c.json({
+            enabled: true,
+            sandboxEnabled: ctx.fleet.enabled,
+            organizationRequired: true,
+            connected: false,
+            installations: [],
+            reason: "organization_required",
+            diagnostics: this.diagnostics()
+          });
+        }
+        const installations = await this.#syncInstallations(tenant.orgId, tenant.userId);
+        return c.json({
+          enabled: true,
+          sandboxEnabled: ctx.fleet.enabled,
+          connected: installations.length > 0,
+          installations: installations.map((installation) => ({
+            installationId: Number(installation.externalId),
+            accountLogin: installation.accountName,
+            accountType: installation.accountType
+          })),
+          reason: installations.length > 0 ? "ready" : "not_connected",
+          diagnostics: this.diagnostics()
+        });
+      }
+    });
+  }
+  #connectRoute(ctx) {
+    return registerApiRoute2("/auth/github/connect", {
+      method: "GET",
+      requiresAuth: false,
+      handler: async (c) => {
+        await ctx.auth.ensureUser(loose2(c));
+        const tenant = ctx.auth.tenant(loose2(c));
+        if (!tenant?.orgId) return c.json({ error: "unauthorized" }, 401);
+        const redirectTo = c.req.query("redirectTo") || c.req.query("return_to") || "/";
+        const originator = routeBaseUrl(ctx, c.req.url);
+        logPlatformInfo("Starting Platform GitHub connect flow", {
+          orgId: tenant.orgId,
+          redirectTo,
+          originator
+        });
+        const query = new URLSearchParams({
+          action: "install",
+          redirectTo,
+          originator
+        });
+        const { url } = await this.#client.request(
+          "GET",
+          `${API_PREFIX2}/github-app/install-url?${query}`
+        );
+        return c.redirect(url);
+      }
+    });
+  }
+  async #syncInstallations(orgId, userId) {
+    const result = await this.#client.request(
+      "GET",
+      `${API_PREFIX2}/github-app/installations`
+    );
+    const usableInstallations = result.installations.filter(
+      (installation) => installation.usable && !installation.suspendedAt
+    );
+    return Promise.all(
+      usableInstallations.map(
+        (installation) => this.versionControl.registerInstallation({
+          orgId,
+          userId,
+          installation: {
+            externalId: String(installation.installationId),
+            accountName: installation.accountLogin,
+            accountType: installation.accountType
+          }
+        })
+      )
+    );
+  }
+  workers(ctx) {
+    if (!this.#pollingEnabled) return [];
+    if (!ctx.controller) {
+      throw new Error("Platform GitHub event polling requires the mounted Mastra Code controller.");
+    }
+    return [
+      new PlatformGithubEventWorker({
+        client: this.#client,
+        controller: ctx.controller,
+        github: this,
+        storage: ctx.storage.generic,
+        ingestFactoryEvent: ctx.hooks?.ingestGithubEvent,
+        intervalMs: this.#pollingIntervalMs
+      })
+    ];
+  }
+  sessionTools({ requestContext }) {
+    return createGithubSubscriptionTools(requestContext, this);
+  }
+  async postToolObserver({
+    toolContext,
+    requestContext
+  }) {
+    const pullRequestUrl = parseCreatedPullRequest(toolContext);
+    if (!pullRequestUrl || !requestContext) return;
+    await subscribeCurrentSessionToPullRequest(
+      requestContext,
+      pullRequestUrl,
+      "auto-gh-pr-create",
+      this
+    );
+  }
+  diagnostics() {
+    return {
+      mode: "platform",
+      endpointHost: this.#endpointHost,
+      polling: {
+        enabled: this.#pollingEnabled,
+        ...this.#pollingIntervalMs === void 0 ? {} : { intervalMs: this.#pollingIntervalMs }
+      }
+    };
+  }
+  async getRepositoryCollaboratorPermission(_installationId, repoFullName, username, signal) {
+    let repository;
+    try {
+      repository = splitRepository(repoFullName);
+    } catch {
+      return void 0;
+    }
+    try {
+      const result = await this.#client.request(
+        "GET",
+        `${API_PREFIX2}/github/repos/${encodeURIComponent(repository.owner)}/${encodeURIComponent(repository.repo)}/collaborators/${encodeURIComponent(username)}/permission`,
+        void 0,
+        { signal }
+      );
+      return result.permission;
+    } catch {
+      return void 0;
+    }
+  }
+  async listInstallationRepos(installationId) {
+    const result = await this.#client.request("GET", `${API_PREFIX2}/github-app/installations/${installationId}/repositories`);
+    return result.repositories.map((repository) => ({ ...repository, installationId }));
+  }
+  async mintInstallationToken(installationId) {
+    const repositories = await this.listInstallationRepos(installationId);
+    if (repositories.length === 0 || repositories.length > 10) {
+      throw new Error("Platform GitHub token minting requires between one and ten installation repositories.");
+    }
+    const result = await this.#client.request(
+      "POST",
+      `${API_PREFIX2}/github-app/installations/${installationId}/token`,
+      { repositories: repositories.map((repository) => repository.name), permissions: { contents: "write" } }
+    );
+    return result.token;
+  }
+  async addIssueLabels(_installationId, sourceId, issueNumber, labels) {
+    const result = await this.#client.request(
+      "POST",
+      repositoryPath(sourceId, `issues/${issueNumber}/labels`),
+      { labels }
+    );
+    return result.labels;
+  }
+  getInstallationOctokit(_installationId) {
+    return {
+      pulls: {
+        get: async ({ owner, repo, pull_number }) => {
+          const data = await this.#client.request(
+            "GET",
+            repositoryPath(`${owner}/${repo}`, `pulls/${pull_number}`)
+          );
+          return { data: { base: { repo: { id: data.base.repo.id } } } };
+        }
+      }
+    };
+  }
+  async #listIssues(connection, sourceId, page, labels) {
+    requireGithubConnection(connection);
+    const path2 = repositoryPath(sourceId, "issues");
+    const query = new URLSearchParams({ state: "open", page: String(page), per_page: String(PAGE_SIZE) });
+    const normalizedLabels = normalizeLabels(labels);
+    if (normalizedLabels.length > 0) query.set("label", normalizedLabels.join(","));
+    const result = await this.#client.request("GET", `${path2}?${query}`);
+    return {
+      issues: result.issues.map((issue) => parseIntakeIssue(sourceId, issue)),
+      nextCursor: result.issues.length === PAGE_SIZE ? String(page + 1) : null
+    };
+  }
+  async #getIssue(connection, sourceId, issueId) {
+    requireGithubConnection(connection);
+    const repository = requireSource(sourceId, "GitHub Intake requires a repository source.");
+    const issueNumber = requirePositiveId(issueId, "issue");
+    try {
+      const [issue, comments] = await Promise.all([
+        this.#client.request("GET", repositoryPath(repository, `issues/${issueNumber}`)),
+        this.#client.request(
+          "GET",
+          `${repositoryPath(repository, `issues/${issueNumber}/comments`)}?per_page=100`
+        )
+      ]);
+      return parseIntakeIssueDetail(repository, issue, comments.comments);
+    } catch (error) {
+      if (isNotFound(error)) return null;
+      throw error;
+    }
+  }
+  async #createIssueComment(connection, sourceId, issueId, body) {
+    requireGithubConnection(connection);
+    const repository = requireSource(sourceId, "GitHub Intake requires a repository source.");
+    const issueNumber = requirePositiveId(issueId, "issue");
+    try {
+      const comment = await this.#client.request(
+        "POST",
+        repositoryPath(repository, `issues/${issueNumber}/comments`),
+        { body }
+      );
+      return { id: String(comment.id), url: comment.htmlUrl };
+    } catch (error) {
+      if (isNotFound(error)) return null;
+      throw error;
+    }
+  }
+  async #listPullRequests(input) {
+    requireGithubConnection(input.connection);
+    const page = parsePositiveCursor(input.cursor);
+    const query = new URLSearchParams({
+      state: input.state ?? "open",
+      page: String(page),
+      per_page: String(PAGE_SIZE)
+    });
+    const result = await this.#client.request(
+      "GET",
+      `${repositoryPath(input.sourceId, "pulls")}?${query}`
+    );
+    return {
+      pullRequests: result.pullRequests.filter((pullRequest) => input.includeDrafts !== false || !pullRequest.draft).map(parsePullRequest2),
+      nextCursor: result.pullRequests.length === PAGE_SIZE ? String(page + 1) : null
+    };
+  }
+  async #getPullRequest(input) {
+    try {
+      return parsePullRequest2(
+        await this.#client.request("GET", pullRequestPath(input, input.pullRequestId))
+      );
+    } catch (error) {
+      if (isNotFound(error)) return null;
+      throw error;
+    }
+  }
+  async #createPullRequest(input) {
+    requireGithubConnection(input.connection);
+    const result = await this.#client.request("POST", repositoryPath(input.sourceId, "pulls"), {
+      head: input.headBranch,
+      base: input.baseBranch,
+      title: input.title,
+      body: input.body,
+      draft: input.draft
+    });
+    return parsePullRequest2(result);
+  }
+  async #updatePullRequest(input) {
+    const result = await this.#client.request("PATCH", pullRequestPath(input, input.pullRequestId), {
+      title: input.title,
+      body: input.body === null ? "" : input.body,
+      base: input.baseBranch,
+      state: input.state
+    });
+    return parsePullRequest2(result);
+  }
+  #mergePullRequest(input) {
+    return this.#client.request(
+      "PUT",
+      `${pullRequestPath(input, input.pullRequestId)}/merge`,
+      { commitTitle: input.commitTitle, commitMessage: input.commitMessage, method: input.method }
+    );
+  }
+  async #listComments(input) {
+    const page = parsePositiveCursor(input.cursor);
+    const result = await this.#client.request(
+      "GET",
+      `${repositoryPath(input.sourceId, `issues/${requirePositiveId(input.pullRequestId, "pull request")}/comments`)}?page=${page}&per_page=${PAGE_SIZE}`
+    );
+    return {
+      comments: result.comments.map(parseComment),
+      nextCursor: result.comments.length === PAGE_SIZE ? String(page + 1) : null
+    };
+  }
+  async #createComment(input) {
+    const comment = await this.#client.request(
+      "POST",
+      repositoryPath(input.sourceId, `issues/${requirePositiveId(input.pullRequestId, "pull request")}/comments`),
+      { body: input.body }
+    );
+    return parseComment(comment);
+  }
+  async #updateComment(input) {
+    requireGithubConnection(input.connection);
+    const comment = await this.#client.request(
+      "PATCH",
+      repositoryPath(input.sourceId, `issues/comments/${requirePositiveId(input.commentId, "comment")}`),
+      { body: input.body }
+    );
+    return parseComment(comment);
+  }
+  async #deleteComment(input) {
+    requireGithubConnection(input.connection);
+    await this.#client.request(
+      "DELETE",
+      repositoryPath(input.sourceId, `issues/comments/${requirePositiveId(input.commentId, "comment")}`)
+    );
+  }
+  async #listReviews(input) {
+    const page = parsePositiveCursor(input.cursor);
+    const result = await this.#client.request(
+      "GET",
+      `${pullRequestPath(input, input.pullRequestId)}/reviews?page=${page}&per_page=${PAGE_SIZE}`
+    );
+    return {
+      reviews: result.reviews.map(parseReview),
+      nextCursor: result.reviews.length === PAGE_SIZE ? String(page + 1) : null
+    };
+  }
+  async #getReview(input) {
+    try {
+      return parseReview(
+        await this.#client.request(
+          "GET",
+          `${pullRequestPath(input, input.pullRequestId)}/reviews/${requirePositiveId(input.reviewId, "review")}`
+        )
+      );
+    } catch (error) {
+      if (isNotFound(error)) return null;
+      throw error;
+    }
+  }
+  async #createReview(input) {
+    const review = await this.#client.request(
+      "POST",
+      `${pullRequestPath(input, input.pullRequestId)}/reviews`,
+      { body: input.body, commitId: input.commitId, event: input.event ? reviewEvent(input.event) : void 0 }
+    );
+    return parseReview(review);
+  }
+  async #updateReview(input) {
+    const review = await this.#client.request(
+      "PUT",
+      `${pullRequestPath(input, input.pullRequestId)}/reviews/${requirePositiveId(input.reviewId, "review")}`,
+      { body: input.body }
+    );
+    return parseReview(review);
+  }
+  async #submitReview(input) {
+    const review = await this.#client.request(
+      "POST",
+      `${pullRequestPath(input, input.pullRequestId)}/reviews/${requirePositiveId(input.reviewId, "review")}/events`,
+      { body: input.body, event: reviewEvent(input.event) }
+    );
+    return parseReview(review);
+  }
+  async #dismissReview(input) {
+    const review = await this.#client.request(
+      "PUT",
+      `${pullRequestPath(input, input.pullRequestId)}/reviews/${requirePositiveId(input.reviewId, "review")}/dismissals`,
+      { message: input.message }
+    );
+    return parseReview(review);
+  }
+  async #deletePendingReview(input) {
+    await this.#client.request(
+      "DELETE",
+      `${pullRequestPath(input, input.pullRequestId)}/reviews/${requirePositiveId(input.reviewId, "review")}`
+    );
+  }
+  async #listReviewComments(input) {
+    const page = parsePositiveCursor(input.cursor);
+    const result = await this.#client.request(
+      "GET",
+      `${pullRequestPath(input, input.pullRequestId)}/comments?page=${page}&per_page=${PAGE_SIZE}`
+    );
+    return {
+      comments: result.comments.map(parseReviewComment),
+      nextCursor: result.comments.length === PAGE_SIZE ? String(page + 1) : null
+    };
+  }
+  async #createReviewComment(input) {
+    let body;
+    if (input.replyToId !== void 0) {
+      body = { body: input.body, replyToId: requirePositiveId(input.replyToId, "review comment") };
+    } else {
+      if (!input.commitId || !input.path || input.line === void 0 || !input.side) {
+        throw new Error("A review comment requires commitId, path, line, and side unless it is a reply.");
+      }
+      body = {
+        body: input.body,
+        commitId: input.commitId,
+        path: input.path,
+        line: input.line,
+        side: input.side.toUpperCase(),
+        startLine: input.startLine,
+        startSide: input.startSide?.toUpperCase()
+      };
+    }
+    return parseReviewComment(
+      await this.#client.request(
+        "POST",
+        `${pullRequestPath(input, input.pullRequestId)}/comments`,
+        body
+      )
+    );
+  }
+  async #updateReviewComment(input) {
+    requireGithubConnection(input.connection);
+    return parseReviewComment(
+      await this.#client.request(
+        "PATCH",
+        repositoryPath(input.sourceId, `pulls/comments/${requirePositiveId(input.commentId, "review comment")}`),
+        { body: input.body }
+      )
+    );
+  }
+  async #deleteReviewComment(input) {
+    requireGithubConnection(input.connection);
+    await this.#client.request(
+      "DELETE",
+      repositoryPath(input.sourceId, `pulls/comments/${requirePositiveId(input.commentId, "review comment")}`)
+    );
+  }
+  #requestedReviewers(method, input) {
+    requireGithubConnection(input.connection);
+    return this.#client.request(
+      method,
+      `${pullRequestPath(input, input.pullRequestId)}/requested-reviewers`,
+      method === "GET" ? void 0 : { users: input.users, teams: input.teams }
+    );
+  }
+};
+function repositoryPath(sourceId, suffix) {
+  const { owner, repo } = splitRepository(sourceId);
+  return `${API_PREFIX2}/github/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/${suffix}`;
+}
+function pullRequestPath(input, pullRequestId) {
+  requireGithubConnection(input.connection);
+  return repositoryPath(input.sourceId, `pulls/${requirePositiveId(pullRequestId, "pull request")}`);
+}
+function splitRepository(sourceId) {
+  const slash = sourceId.indexOf("/");
+  if (slash <= 0 || slash === sourceId.length - 1) {
+    throw new Error("GitHub capabilities require an owner/repository source.");
+  }
+  return { owner: sourceId.slice(0, slash), repo: sourceId.slice(slash + 1) };
+}
+function parseIntakeIssue(sourceId, issue) {
+  return {
+    id: String(issue.number),
+    identifier: `#${issue.number}`,
+    title: issue.title,
+    url: issue.htmlUrl,
+    author: issue.user?.login ?? null,
+    state: issue.state,
+    stateType: issue.state,
+    priority: null,
+    assignee: issue.assignees[0] ?? null,
+    source: sourceId,
+    labels: issue.labels,
+    commentCount: issue.commentCount,
+    createdAt: issue.createdAt,
+    updatedAt: issue.updatedAt
+  };
+}
+function parseIntakeIssueDetail(sourceId, issue, comments) {
+  return {
+    ...parseIntakeIssue(sourceId, issue),
+    description: issue.body?.trim() ? issue.body : null,
+    comments: comments.map((comment) => ({
+      author: comment.user?.login ?? null,
+      body: comment.body,
+      createdAt: comment.createdAt
+    }))
+  };
+}
+function parsePullRequest2(pullRequest) {
+  return {
+    id: String(pullRequest.number),
+    title: pullRequest.title,
+    url: pullRequest.htmlUrl,
+    author: pullRequest.user?.login ?? null,
+    body: pullRequest.body?.trim() ? pullRequest.body : null,
+    state: pullRequest.state,
+    draft: pullRequest.draft,
+    merged: pullRequest.merged,
+    mergeable: pullRequest.mergeable,
+    baseBranch: pullRequest.base.ref,
+    headBranch: pullRequest.head.ref,
+    headSha: pullRequest.head.sha,
+    createdAt: pullRequest.createdAt,
+    updatedAt: pullRequest.updatedAt
+  };
+}
+function parseComment(comment) {
+  return {
+    id: String(comment.id),
+    url: comment.htmlUrl,
+    author: comment.user?.login ?? null,
+    body: comment.body,
+    createdAt: comment.createdAt,
+    updatedAt: comment.updatedAt
+  };
+}
+function parseReview(review) {
+  const states = {
+    PENDING: "pending",
+    COMMENTED: "commented",
+    APPROVED: "approved",
+    CHANGES_REQUESTED: "changes-requested",
+    DISMISSED: "dismissed"
+  };
+  return {
+    id: String(review.id),
+    url: review.htmlUrl,
+    author: review.user?.login ?? null,
+    body: review.body?.trim() ? review.body : null,
+    state: states[review.state],
+    commitId: review.commitId,
+    submittedAt: review.submittedAt
+  };
+}
+function parseReviewComment(comment) {
+  return {
+    ...parseComment(comment),
+    path: comment.path,
+    line: comment.line,
+    side: comment.side?.toLowerCase(),
+    commitId: comment.commitId,
+    replyToId: comment.replyToId === null ? null : String(comment.replyToId)
+  };
+}
+function requireGithubConnection(connection) {
+  if (connection.type !== "app-installation" && connection.type !== "oauth") {
+    throw new Error("GitHub capabilities require a GitHub connection.");
+  }
+}
+function requireSingleSource(sourceIds, message) {
+  if (sourceIds.length !== 1) throw new Error(message);
+  return sourceIds[0];
+}
+function requireSource(sourceId, message) {
+  if (!sourceId) throw new Error(message);
+  return sourceId;
+}
+function normalizeLabels(labels) {
+  return [...new Set((labels ?? []).map((label) => label.trim()).filter(Boolean))];
+}
+function parsePositiveCursor(cursor) {
+  if (cursor === void 0) return 1;
+  const parsed = parsePositiveInteger(cursor);
+  if (parsed === null) throw new Error("GitHub cursor must be a positive page number.");
+  return parsed;
+}
+function parsePositiveInteger(value) {
+  if (!/^\d+$/.test(value)) return null;
+  const parsed = Number(value);
+  return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : null;
+}
+function optionalPositiveIntegerEnv(name) {
+  const value = process.env[name]?.trim();
+  if (!value) return void 0;
+  const parsed = parsePositiveInteger(value);
+  if (parsed === null) throw new Error(`${name} must be a positive integer.`);
+  return parsed;
+}
+function requirePositiveId(value, resource) {
+  const parsed = parsePositiveInteger(value);
+  if (parsed === null) throw new Error(`GitHub ${resource} id must be a positive integer.`);
+  return parsed;
+}
+function reviewEvent(event) {
+  if (event === "approve") return "APPROVE";
+  if (event === "request-changes") return "REQUEST_CHANGES";
+  return "COMMENT";
+}
+function isNotFound(error) {
+  return error instanceof PlatformApiError && error.status === 404;
+}
+export {
+  PlatformGithubIntegration
+};
+//# sourceMappingURL=integration.js.map