@mastra/factory 0.15.0 → 0.15.1-alpha.0

package/dist/integrations/linear/routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes.js","names":[],"sources":["../../../src/integrations/linear/routes.ts"],"sourcesContent":["/**\n * Mastra `apiRoutes` for the Linear intake feature.\n *\n * Registered alongside the other `/web/*` routes, behind the WorkOS auth gate.\n * Mirrors the GitHub module: every route re-resolves the authenticated user\n * from the request cookie and scopes all rows by the caller's WorkOS org, so an\n * org can only ever see its own Linear connection and issues.\n *\n * When the feature is disabled (`isLinearFeatureEnabled()` false),\n * `buildLinearRoutes` returns only `GET /web/linear/status`, which reports\n * `enabled:false` so the SPA can cleanly hide all Linear UI.\n */\n\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport type { RouteAuth } from '../../routes/route.js';\nimport type { StateSigner } from '../../state-signing.js';\nimport type { IntakeStorage } from '../../storage/domains/intake/base.js';\nimport type { LinearIntegration } from './integration.js';\nimport { LinearReauthRequiredError } from './integration.js';\nimport type { LinearRulesIngress } from './rules.js';\n\ntype RouteContext = Context;\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\n/** Erase a route handler's path-parameterized context to a plain `Context`. */\nfunction loose(c: unknown): RouteContext {\n  return c as RouteContext;\n}\n\n/**\n * Non-secret diagnostic snapshot of every Linear feature gate, mirroring the\n * GitHub diagnostics shape. Only booleans — never values.\n */\nexport interface LinearFeatureDiagnostics {\n  linearAppConfigured: boolean;\n  factoryAuthEnabled: boolean;\n  appDbConfigured: boolean;\n}\n\nexport interface MountLinearRoutesOptions {\n  /**\n   * The integration instance providing OAuth + GraphQL access. Required for\n   * everything beyond the disabled `status` route.\n   */\n  linear?: LinearIntegration;\n  /** Host auth seam. Linear connections are org-owned, so the feature is inert without it. */\n  auth: RouteAuth;\n  /**\n   * Absolute base URL of the web server (e.g. `http://localhost:4111`), used to\n   * build the OAuth redirect URI when one isn't explicitly configured.\n   */\n  baseUrl?: string;\n  /** Explicit OAuth callback URI; defaults to `<baseUrl>/auth/linear/callback`. */\n  redirectUri?: string;\n  /**\n   * Shared OAuth `state` signer (created once per boot by the factory).\n   * Required for the connect/callback flow; when absent, only the disabled\n   * `status` route is served.\n   */\n  stateSigner?: StateSigner;\n  /**\n   * Cross-integration intake selection domain. Required for the issues route's\n   * project filter; when absent, only the disabled `status` route is served.\n   */\n  intake?: IntakeStorage;\n  /**\n   * Factory project domain, used to keep single-project installs working\n   * without any source binding. When absent, unbound sources are treated as\n   * belonging to no project.\n   */\n  projects?: { list(input: { orgId: string }): Promise<unknown[]> };\n  ingestFactoryIssues?: (input: LinearRulesIngress) => Promise<unknown>;\n}\n\n/**\n * Narrow the caller's selected Linear sources to the ones that feed this\n * Factory project.\n *\n * A Linear issue carries no Factory project of its own, so without a binding\n * every board view would ingest every selected source's issues into whichever\n * project happened to be on screen. Routing is explicit: a source feeds this\n * project only when its binding names both the project and a board. Returns\n * the bound board per source so the ingest lands cards where the user asked.\n */\nasync function scopeSourceIdsToProject({\n  intake,\n  orgId,\n  factoryProjectId,\n  selectedIds,\n}: {\n  intake: IntakeStorage;\n  orgId: string;\n  factoryProjectId: string;\n  selectedIds: string[];\n}): Promise<Record<string, string>> {\n  const selected = new Set(selectedIds);\n  const intakeBoards: Record<string, string> = {};\n  for (const binding of await intake.listBindings({ orgId, integrationId: 'linear' })) {\n    if (binding.factoryProjectId === factoryProjectId && binding.board && selected.has(binding.sourceId)) {\n      intakeBoards[binding.sourceId] = binding.board;\n    }\n  }\n  return intakeBoards;\n}\n\n/**\n * Resolve the org-scoped tenant for a Linear request. The connection is\n * org-owned, so it requires both a signed-in user and an organization — same\n * tenancy rules as the GitHub routes.\n */\nasync function resolveOrgTenant(\n  c: RouteContext,\n  auth: RouteAuth,\n): Promise<{ tenant: { orgId: string; userId: string } } | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) return { response: c.json({ error: 'unauthorized' }, 401) };\n  if (!tenant.orgId) {\n    return {\n      response: c.json(\n        {\n          error: 'organization_required',\n          message: 'Linear intake requires an organization. Personal accounts cannot connect Linear.',\n        },\n        403,\n      ),\n    };\n  }\n  return { tenant: { orgId: tenant.orgId, userId: tenant.userId } };\n}\n\n/**\n * Validate an opaque Linear pagination cursor from the query string. Cursors\n * are server-issued (`pageInfo.endCursor`), so anything outside a conservative\n * charset/length is rejected rather than forwarded to Linear.\n */\nfunction parseAfterCursor(raw: string | undefined): string | undefined | null {\n  if (raw === undefined || raw === '') return undefined;\n  if (raw.length > 512 || !/^[\\w+/=.:-]+$/.test(raw)) return null;\n  return raw;\n}\n\n/** Human issue key as it appears on a card (`ENG-123`). */\nconst ISSUE_IDENTIFIER_RE = /^[A-Za-z][A-Za-z0-9]{0,9}-\\d{1,7}$/;\n\n/** Map a Linear read failure to the API response for the SPA. */\nfunction linearFetchError(c: RouteContext, err: unknown) {\n  if (err instanceof LinearReauthRequiredError || (err as { status?: number }).status === 401) {\n    return c.json({ error: 'linear_reauth_required', message: new LinearReauthRequiredError().message }, 409);\n  }\n  return c.json({ error: 'linear_fetch_failed', message: err instanceof Error ? err.message : String(err) }, 502);\n}\n\n/**\n * Build the Linear routes as Mastra `apiRoutes`. When the feature is disabled,\n * returns only the `status` route so the SPA can detect the disabled state.\n */\nexport function buildLinearRoutes(options: MountLinearRoutesOptions): ApiRoute[] {\n  const routes: ApiRoute[] = [];\n  const { linear, auth, stateSigner, intake } = options;\n  const enabled = Boolean(linear) && auth.enabled();\n  const diagnostics = (): LinearFeatureDiagnostics => ({\n    linearAppConfigured: Boolean(linear),\n    factoryAuthEnabled: auth.enabled(),\n    appDbConfigured: true,\n  });\n\n  // The status route is always registered so the SPA can detect the disabled state.\n  routes.push(\n    registerApiRoute('/web/linear/status', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        if (!enabled || !linear || !stateSigner) {\n          return c.json({\n            enabled: false,\n            connected: false,\n            workspace: null,\n            reason: 'missing_config',\n            diagnostics: diagnostics(),\n          });\n        }\n        await auth.ensureUser(loose(c));\n        const tenant = auth.tenant(loose(c));\n        if (!tenant) return c.json({ error: 'unauthorized', reason: 'auth_required' }, 401);\n\n        if (!tenant.orgId) {\n          return c.json({\n            enabled: true,\n            organizationRequired: true,\n            connected: false,\n            workspace: null,\n            reason: 'organization_required',\n            diagnostics: diagnostics(),\n          });\n        }\n\n        const connection = await linear.loadConnection(tenant.orgId);\n        return c.json({\n          enabled: true,\n          connected: Boolean(connection),\n          workspace: connection ? { name: connection.workspaceName, urlKey: connection.workspaceUrlKey } : null,\n          reason: connection ? 'ready' : 'not_connected',\n          diagnostics: diagnostics(),\n        });\n      },\n    }),\n  );\n\n  // Without the integration instance or a state signer the connect/callback\n  // flow cannot talk to Linear or bind the OAuth round-trip to a tenant —\n  // serve only the disabled `status` route (mirrors the feature gate).\n  if (!enabled || !linear || !stateSigner || !intake) {\n    return routes;\n  }\n\n  const redirectUri = options.redirectUri ?? `${(options.baseUrl ?? '').replace(/\\/$/, '')}/auth/linear/callback`;\n\n  // ── Connect: send the user to Linear's OAuth consent screen ─────────────\n  routes.push(\n    registerApiRoute('/auth/linear/connect', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), auth);\n        if ('response' in resolved) return resolved.response;\n        const state = stateSigner.sign(resolved.tenant.orgId, resolved.tenant.userId);\n        return c.redirect(linear.buildAuthorizeUrl(state, redirectUri));\n      },\n    }),\n  );\n\n  // ── Callback: exchange the code, persist the connection for the org ─────\n  routes.push(\n    registerApiRoute('/auth/linear/callback', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), auth);\n        if ('response' in resolved) return resolved.response;\n        const { orgId, userId } = resolved.tenant;\n\n        // CSRF / cross-tenant linking protection: the signed state must belong\n        // to the same logged-in user *and* their current org.\n        const stateTenant = stateSigner.verify(c.req.query('state'));\n        if (!stateTenant || stateTenant.userId !== userId || stateTenant.orgId !== orgId) {\n          console.warn('[Linear] OAuth callback rejected: state/tenant mismatch.');\n          return c.redirect('/?linear=error');\n        }\n\n        const code = c.req.query('code');\n        if (!code) {\n          // User denied consent (or Linear returned an error).\n          return c.redirect('/?linear=error');\n        }\n\n        try {\n          const tokens = await linear.exchangeOAuthCode(code, redirectUri);\n          const workspace = await linear.fetchWorkspace(tokens.accessToken);\n          await linear.upsertConnection({\n            orgId,\n            userId,\n            accessToken: tokens.accessToken,\n            refreshToken: tokens.refreshToken,\n            expiresAt: tokens.expiresAt,\n            scope: tokens.scope,\n            workspaceName: workspace.name,\n            workspaceUrlKey: workspace.urlKey,\n          });\n        } catch (error) {\n          console.warn(`[Linear] OAuth callback failed to persist connection for org ${orgId}.`, error);\n          return c.redirect('/?linear=error');\n        }\n\n        return c.redirect('/?linear=connected');\n      },\n    }),\n  );\n\n  // ── List the workspace's projects (Settings intake-source picker) ───────\n  routes.push(\n    registerApiRoute('/web/linear/projects', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), auth);\n        if ('response' in resolved) return resolved.response;\n\n        const connection = await linear.loadConnection(resolved.tenant.orgId);\n        if (!connection) {\n          return c.json({ error: 'linear_not_connected', message: 'Connect Linear to list Linear projects.' }, 409);\n        }\n\n        try {\n          const accessToken = await linear.getFreshAccessToken(connection);\n          const projects = await linear.listProjects(accessToken);\n          return c.json({ projects });\n        } catch (err) {\n          return linearFetchError(loose(c), err);\n        }\n      },\n    }),\n  );\n\n  // ── List the workspace's active issues (cursor-paged) ───────────────────\n  // Respects the caller's intake config: disabled Linear intake 404s the\n  // source, and an explicit project selection narrows the issue filter.\n  routes.push(\n    registerApiRoute('/web/linear/issues', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), auth);\n        if ('response' in resolved) return resolved.response;\n\n        const after = parseAfterCursor(c.req.query('after'));\n        if (after === null) return c.json({ error: 'invalid_cursor' }, 400);\n        const factoryProjectId = c.req.query('factoryProjectId');\n        if (factoryProjectId && !UUID_RE.test(factoryProjectId)) {\n          return c.json({ error: 'invalid_factory_project_id' }, 400);\n        }\n\n        const connection = await linear.loadConnection(resolved.tenant.orgId);\n        if (!connection) {\n          return c.json({ error: 'linear_not_connected', message: 'Connect Linear to see intake issues.' }, 409);\n        }\n\n        await intake.ensureReady();\n        const config = await intake.getConfig({\n          orgId: resolved.tenant.orgId,\n          userId: resolved.tenant.userId,\n          integrationIds: ['linear'],\n        });\n        const selection = config.linear!;\n        if (!selection.enabled) {\n          return c.json({ error: 'linear_intake_disabled', message: 'Linear intake is turned off in Settings.' }, 404);\n        }\n\n        // No projects selected means nothing is synced — don't fan out to Linear.\n        const selectedIds = selection.sourceIds ?? [];\n        // A board request is also an ingest, so it only ever sees the sources\n        // routed to a board of that Factory project.\n        const intakeBoards = factoryProjectId\n          ? await scopeSourceIdsToProject({\n              intake,\n              orgId: resolved.tenant.orgId,\n              factoryProjectId,\n              selectedIds,\n            })\n          : null;\n        const projectIds = intakeBoards ? Object.keys(intakeBoards) : selectedIds;\n        if (projectIds.length === 0) {\n          return c.json({ issues: [], nextCursor: null });\n        }\n\n        try {\n          const accessToken = await linear.getFreshAccessToken(connection);\n          const { issues, nextCursor } = await linear.intake.listIssues({\n            connection: { type: 'oauth', accessToken },\n            sourceIds: projectIds,\n            cursor: after,\n          });\n          const issuePayload = issues.map(issue => ({\n            id: issue.id,\n            identifier: issue.identifier,\n            title: issue.title,\n            url: issue.url,\n            state: issue.state ?? '',\n            stateType: issue.stateType ?? '',\n            priorityLabel: issue.priority ?? '',\n            assignee: issue.assignee,\n            creator: issue.author,\n            team: issue.source,\n            labels: issue.labels,\n            createdAt: issue.createdAt,\n            updatedAt: issue.updatedAt,\n            sourceId: issue.sourceId ?? null,\n          }));\n          if (factoryProjectId && intakeBoards && options.ingestFactoryIssues) {\n            await options.ingestFactoryIssues({\n              orgId: resolved.tenant.orgId,\n              userId: resolved.tenant.userId,\n              factoryProjectId,\n              issues: issuePayload,\n              intakeBoards,\n            });\n          }\n          return c.json({ issues: issuePayload, nextCursor });\n        } catch (err) {\n          return linearFetchError(loose(c), err);\n        }\n      },\n    }),\n  );\n\n  routes.push(\n    registerApiRoute('/web/linear/issues/:identifier', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), auth);\n        if ('response' in resolved) return resolved.response;\n\n        const identifier = c.req.param('identifier');\n        if (!ISSUE_IDENTIFIER_RE.test(identifier)) return c.json({ error: 'invalid_identifier' }, 400);\n        const factoryProjectId = c.req.query('factoryProjectId');\n        if (!factoryProjectId || !UUID_RE.test(factoryProjectId)) {\n          return c.json({ error: 'invalid_factory_project_id' }, 400);\n        }\n\n        const connection = await linear.loadConnection(resolved.tenant.orgId);\n        if (!connection) {\n          return c.json({ error: 'linear_not_connected', message: 'Connect Linear to see intake issues.' }, 409);\n        }\n\n        await intake.ensureReady();\n        const config = await intake.getConfig({\n          orgId: resolved.tenant.orgId,\n          userId: resolved.tenant.userId,\n          integrationIds: ['linear'],\n        });\n        const selection = config.linear!;\n        if (!selection.enabled) {\n          return c.json({ error: 'linear_intake_disabled', message: 'Linear intake is turned off in Settings.' }, 404);\n        }\n        const projectIds = Object.keys(\n          await scopeSourceIdsToProject({\n            intake,\n            orgId: resolved.tenant.orgId,\n            factoryProjectId,\n            selectedIds: selection.sourceIds ?? [],\n          }),\n        );\n        if (projectIds.length === 0) return c.json({ error: 'issue_not_found' }, 404);\n\n        try {\n          const accessToken = await linear.getFreshAccessToken(connection);\n          const issue = await linear.fetchIssueDetail(accessToken, identifier);\n          // Reads exactly like an issue that doesn't exist.\n          if (!issue || issue.projectId === null || !projectIds.includes(issue.projectId)) {\n            return c.json({ error: 'issue_not_found' }, 404);\n          }\n          return c.json({\n            identifier: issue.identifier,\n            title: issue.title,\n            url: issue.url,\n            description: issue.description,\n          });\n        } catch (err) {\n          return linearFetchError(loose(c), err);\n        }\n      },\n    }),\n  );\n\n  return routes;\n}\n"],"mappings":";;;AA0BA,MAAM,UAAU;;AAGhB,SAAS,MAAM,GAA0B;CACvC,OAAO;AACT;;;;;;;;;;;AAyDA,eAAe,wBAAwB,EACrC,QACA,OACA,kBACA,eAMkC;CAClC,MAAM,WAAW,IAAI,IAAI,WAAW;CACpC,MAAM,eAAuC,CAAC;CAC9C,KAAK,MAAM,WAAW,MAAM,OAAO,aAAa;EAAE;EAAO,eAAe;CAAS,CAAC,GAChF,IAAI,QAAQ,qBAAqB,oBAAoB,QAAQ,SAAS,SAAS,IAAI,QAAQ,QAAQ,GACjG,aAAa,QAAQ,YAAY,QAAQ;CAG7C,OAAO;AACT;;;;;;AAOA,eAAe,iBACb,GACA,MACiF;CACjF,MAAM,KAAK,WAAW,CAAC;CACvB,MAAM,SAAS,KAAK,OAAO,CAAC;CAC5B,IAAI,CAAC,QAAQ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;CACvE,IAAI,CAAC,OAAO,OACV,OAAO,EACL,UAAU,EAAE,KACV;EACE,OAAO;EACP,SAAS;CACX,GACA,GACF,EACF;CAEF,OAAO,EAAE,QAAQ;EAAE,OAAO,OAAO;EAAO,QAAQ,OAAO;CAAO,EAAE;AAClE;;;;;;AAOA,SAAS,iBAAiB,KAAoD;CAC5E,IAAI,QAAQ,KAAA,KAAa,QAAQ,IAAI,OAAO,KAAA;CAC5C,IAAI,IAAI,SAAS,OAAO,CAAC,gBAAgB,KAAK,GAAG,GAAG,OAAO;CAC3D,OAAO;AACT;;AAGA,MAAM,sBAAsB;;AAG5B,SAAS,iBAAiB,GAAiB,KAAc;CACvD,IAAI,eAAe,6BAA8B,IAA4B,WAAW,KACtF,OAAO,EAAE,KAAK;EAAE,OAAO;EAA0B,SAAS,IAAI,0BAA0B,CAAC,CAAC;CAAQ,GAAG,GAAG;CAE1G,OAAO,EAAE,KAAK;EAAE,OAAO;EAAuB,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;CAAE,GAAG,GAAG;AAChH;;;;;AAMA,SAAgB,kBAAkB,SAA+C;CAC/E,MAAM,SAAqB,CAAC;CAC5B,MAAM,EAAE,QAAQ,MAAM,aAAa,WAAW;CAC9C,MAAM,UAAU,QAAQ,MAAM,KAAK,KAAK,QAAQ;CAChD,MAAM,qBAA+C;EACnD,qBAAqB,QAAQ,MAAM;EACnC,oBAAoB,KAAK,QAAQ;EACjC,iBAAiB;CACnB;CAGA,OAAO,KACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,aAC1B,OAAO,EAAE,KAAK;IACZ,SAAS;IACT,WAAW;IACX,WAAW;IACX,QAAQ;IACR,aAAa,YAAY;GAC3B,CAAC;GAEH,MAAM,KAAK,WAAW,MAAM,CAAC,CAAC;GAC9B,MAAM,SAAS,KAAK,OAAO,MAAM,CAAC,CAAC;GACnC,IAAI,CAAC,QAAQ,OAAO,EAAE,KAAK;IAAE,OAAO;IAAgB,QAAQ;GAAgB,GAAG,GAAG;GAElF,IAAI,CAAC,OAAO,OACV,OAAO,EAAE,KAAK;IACZ,SAAS;IACT,sBAAsB;IACtB,WAAW;IACX,WAAW;IACX,QAAQ;IACR,aAAa,YAAY;GAC3B,CAAC;GAGH,MAAM,aAAa,MAAM,OAAO,eAAe,OAAO,KAAK;GAC3D,OAAO,EAAE,KAAK;IACZ,SAAS;IACT,WAAW,QAAQ,UAAU;IAC7B,WAAW,aAAa;KAAE,MAAM,WAAW;KAAe,QAAQ,WAAW;IAAgB,IAAI;IACjG,QAAQ,aAAa,UAAU;IAC/B,aAAa,YAAY;GAC3B,CAAC;EACH;CACF,CAAC,CACH;CAKA,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,eAAe,CAAC,QAC1C,OAAO;CAGT,MAAM,cAAc,QAAQ,eAAe,IAAI,QAAQ,WAAW,GAAA,CAAI,QAAQ,OAAO,EAAE,EAAE;CAGzF,OAAO,KACL,iBAAiB,wBAAwB;EACvC,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,IAAI;GACtD,IAAI,cAAc,UAAU,OAAO,SAAS;GAC5C,MAAM,QAAQ,YAAY,KAAK,SAAS,OAAO,OAAO,SAAS,OAAO,MAAM;GAC5E,OAAO,EAAE,SAAS,OAAO,kBAAkB,OAAO,WAAW,CAAC;EAChE;CACF,CAAC,CACH;CAGA,OAAO,KACL,iBAAiB,yBAAyB;EACxC,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,IAAI;GACtD,IAAI,cAAc,UAAU,OAAO,SAAS;GAC5C,MAAM,EAAE,OAAO,WAAW,SAAS;GAInC,MAAM,cAAc,YAAY,OAAO,EAAE,IAAI,MAAM,OAAO,CAAC;GAC3D,IAAI,CAAC,eAAe,YAAY,WAAW,UAAU,YAAY,UAAU,OAAO;IAChF,QAAQ,KAAK,0DAA0D;IACvE,OAAO,EAAE,SAAS,gBAAgB;GACpC;GAEA,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;GAC/B,IAAI,CAAC,MAEH,OAAO,EAAE,SAAS,gBAAgB;GAGpC,IAAI;IACF,MAAM,SAAS,MAAM,OAAO,kBAAkB,MAAM,WAAW;IAC/D,MAAM,YAAY,MAAM,OAAO,eAAe,OAAO,WAAW;IAChE,MAAM,OAAO,iBAAiB;KAC5B;KACA;KACA,aAAa,OAAO;KACpB,cAAc,OAAO;KACrB,WAAW,OAAO;KAClB,OAAO,OAAO;KACd,eAAe,UAAU;KACzB,iBAAiB,UAAU;IAC7B,CAAC;GACH,SAAS,OAAO;IACd,QAAQ,KAAK,gEAAgE,MAAM,IAAI,KAAK;IAC5F,OAAO,EAAE,SAAS,gBAAgB;GACpC;GAEA,OAAO,EAAE,SAAS,oBAAoB;EACxC;CACF,CAAC,CACH;CAGA,OAAO,KACL,iBAAiB,wBAAwB;EACvC,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,IAAI;GACtD,IAAI,cAAc,UAAU,OAAO,SAAS;GAE5C,MAAM,aAAa,MAAM,OAAO,eAAe,SAAS,OAAO,KAAK;GACpE,IAAI,CAAC,YACH,OAAO,EAAE,KAAK;IAAE,OAAO;IAAwB,SAAS;GAA0C,GAAG,GAAG;GAG1G,IAAI;IACF,MAAM,cAAc,MAAM,OAAO,oBAAoB,UAAU;IAC/D,MAAM,WAAW,MAAM,OAAO,aAAa,WAAW;IACtD,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC;GAC5B,SAAS,KAAK;IACZ,OAAO,iBAAiB,MAAM,CAAC,GAAG,GAAG;GACvC;EACF;CACF,CAAC,CACH;CAKA,OAAO,KACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,IAAI;GACtD,IAAI,cAAc,UAAU,OAAO,SAAS;GAE5C,MAAM,QAAQ,iBAAiB,EAAE,IAAI,MAAM,OAAO,CAAC;GACnD,IAAI,UAAU,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAClE,MAAM,mBAAmB,EAAE,IAAI,MAAM,kBAAkB;GACvD,IAAI,oBAAoB,CAAC,QAAQ,KAAK,gBAAgB,GACpD,OAAO,EAAE,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;GAG5D,MAAM,aAAa,MAAM,OAAO,eAAe,SAAS,OAAO,KAAK;GACpE,IAAI,CAAC,YACH,OAAO,EAAE,KAAK;IAAE,OAAO;IAAwB,SAAS;GAAuC,GAAG,GAAG;GAGvG,MAAM,OAAO,YAAY;GAMzB,MAAM,aAAY,MALG,OAAO,UAAU;IACpC,OAAO,SAAS,OAAO;IACvB,QAAQ,SAAS,OAAO;IACxB,gBAAgB,CAAC,QAAQ;GAC3B,CAAC,EAAA,CACwB;GACzB,IAAI,CAAC,UAAU,SACb,OAAO,EAAE,KAAK;IAAE,OAAO;IAA0B,SAAS;GAA2C,GAAG,GAAG;GAI7G,MAAM,cAAc,UAAU,aAAa,CAAC;GAG5C,MAAM,eAAe,mBACjB,MAAM,wBAAwB;IAC5B;IACA,OAAO,SAAS,OAAO;IACvB;IACA;GACF,CAAC,IACD;GACJ,MAAM,aAAa,eAAe,OAAO,KAAK,YAAY,IAAI;GAC9D,IAAI,WAAW,WAAW,GACxB,OAAO,EAAE,KAAK;IAAE,QAAQ,CAAC;IAAG,YAAY;GAAK,CAAC;GAGhD,IAAI;IACF,MAAM,cAAc,MAAM,OAAO,oBAAoB,UAAU;IAC/D,MAAM,EAAE,QAAQ,eAAe,MAAM,OAAO,OAAO,WAAW;KAC5D,YAAY;MAAE,MAAM;MAAS;KAAY;KACzC,WAAW;KACX,QAAQ;IACV,CAAC;IACD,MAAM,eAAe,OAAO,KAAI,WAAU;KACxC,IAAI,MAAM;KACV,YAAY,MAAM;KAClB,OAAO,MAAM;KACb,KAAK,MAAM;KACX,OAAO,MAAM,SAAS;KACtB,WAAW,MAAM,aAAa;KAC9B,eAAe,MAAM,YAAY;KACjC,UAAU,MAAM;KAChB,SAAS,MAAM;KACf,MAAM,MAAM;KACZ,QAAQ,MAAM;KACd,WAAW,MAAM;KACjB,WAAW,MAAM;KACjB,UAAU,MAAM,YAAY;IAC9B,EAAE;IACF,IAAI,oBAAoB,gBAAgB,QAAQ,qBAC9C,MAAM,QAAQ,oBAAoB;KAChC,OAAO,SAAS,OAAO;KACvB,QAAQ,SAAS,OAAO;KACxB;KACA,QAAQ;KACR;IACF,CAAC;IAEH,OAAO,EAAE,KAAK;KAAE,QAAQ;KAAc;IAAW,CAAC;GACpD,SAAS,KAAK;IACZ,OAAO,iBAAiB,MAAM,CAAC,GAAG,GAAG;GACvC;EACF;CACF,CAAC,CACH;CAEA,OAAO,KACL,iBAAiB,kCAAkC;EACjD,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,IAAI;GACtD,IAAI,cAAc,UAAU,OAAO,SAAS;GAE5C,MAAM,aAAa,EAAE,IAAI,MAAM,YAAY;GAC3C,IAAI,CAAC,oBAAoB,KAAK,UAAU,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAC7F,MAAM,mBAAmB,EAAE,IAAI,MAAM,kBAAkB;GACvD,IAAI,CAAC,oBAAoB,CAAC,QAAQ,KAAK,gBAAgB,GACrD,OAAO,EAAE,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;GAG5D,MAAM,aAAa,MAAM,OAAO,eAAe,SAAS,OAAO,KAAK;GACpE,IAAI,CAAC,YACH,OAAO,EAAE,KAAK;IAAE,OAAO;IAAwB,SAAS;GAAuC,GAAG,GAAG;GAGvG,MAAM,OAAO,YAAY;GAMzB,MAAM,aAAY,MALG,OAAO,UAAU;IACpC,OAAO,SAAS,OAAO;IACvB,QAAQ,SAAS,OAAO;IACxB,gBAAgB,CAAC,QAAQ;GAC3B,CAAC,EAAA,CACwB;GACzB,IAAI,CAAC,UAAU,SACb,OAAO,EAAE,KAAK;IAAE,OAAO;IAA0B,SAAS;GAA2C,GAAG,GAAG;GAE7G,MAAM,aAAa,OAAO,KACxB,MAAM,wBAAwB;IAC5B;IACA,OAAO,SAAS,OAAO;IACvB;IACA,aAAa,UAAU,aAAa,CAAC;GACvC,CAAC,CACH;GACA,IAAI,WAAW,WAAW,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAE5E,IAAI;IACF,MAAM,cAAc,MAAM,OAAO,oBAAoB,UAAU;IAC/D,MAAM,QAAQ,MAAM,OAAO,iBAAiB,aAAa,UAAU;IAEnE,IAAI,CAAC,SAAS,MAAM,cAAc,QAAQ,CAAC,WAAW,SAAS,MAAM,SAAS,GAC5E,OAAO,EAAE,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;IAEjD,OAAO,EAAE,KAAK;KACZ,YAAY,MAAM;KAClB,OAAO,MAAM;KACb,KAAK,MAAM;KACX,aAAa,MAAM;IACrB,CAAC;GACH,SAAS,KAAK;IACZ,OAAO,iBAAiB,MAAM,CAAC,GAAG,GAAG;GACvC;EACF;CACF,CAAC,CACH;CAEA,OAAO;AACT"}
+{"version":3,"file":"routes.js","names":[],"sources":["../../../src/integrations/linear/routes.ts"],"sourcesContent":["/**\n * Mastra `apiRoutes` for the Linear intake feature.\n *\n * Registered alongside the other `/web/*` routes, behind the WorkOS auth gate.\n * Mirrors the GitHub module: every route re-resolves the authenticated user\n * from the request cookie and scopes all rows by the caller's WorkOS org, so an\n * org can only ever see its own Linear connection and issues.\n *\n * When the feature is disabled (`isLinearFeatureEnabled()` false),\n * `buildLinearRoutes` returns only `GET /web/linear/status`, which reports\n * `enabled:false` so the SPA can cleanly hide all Linear UI.\n */\n\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport type { RouteAuth } from '../../routes/route.js';\nimport type { StateSigner } from '../../state-signing.js';\nimport type { IntakeStorage } from '../../storage/domains/intake/base.js';\nimport type { LinearIntegration } from './integration.js';\nimport { LinearReauthRequiredError } from './integration.js';\nimport type { LinearRulesIngress } from './rules.js';\n\ntype RouteContext = Context;\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\n/** Erase a route handler's path-parameterized context to a plain `Context`. */\nfunction loose(c: unknown): RouteContext {\n  return c as RouteContext;\n}\n\n/**\n * Non-secret diagnostic snapshot of every Linear feature gate, mirroring the\n * GitHub diagnostics shape. Only booleans — never values.\n */\nexport interface LinearFeatureDiagnostics {\n  linearAppConfigured: boolean;\n  factoryAuthEnabled: boolean;\n  appDbConfigured: boolean;\n}\n\nexport interface MountLinearRoutesOptions {\n  /**\n   * The integration instance providing OAuth + GraphQL access. Required for\n   * everything beyond the disabled `status` route.\n   */\n  linear?: LinearIntegration;\n  /** Host auth seam. Linear connections are org-owned, so the feature is inert without it. */\n  auth: RouteAuth;\n  /**\n   * Absolute base URL of the web server (e.g. `http://localhost:4111`), used to\n   * build the OAuth redirect URI when one isn't explicitly configured.\n   */\n  baseUrl?: string;\n  /** Explicit OAuth callback URI; defaults to `<baseUrl>/auth/linear/callback`. */\n  redirectUri?: string;\n  /**\n   * Shared OAuth `state` signer (created once per boot by the factory).\n   * Required for the connect/callback flow; when absent, only the disabled\n   * `status` route is served.\n   */\n  stateSigner?: StateSigner;\n  /**\n   * Cross-integration intake selection domain. Required for the issues route's\n   * project filter; when absent, only the disabled `status` route is served.\n   */\n  intake?: IntakeStorage;\n  /**\n   * Factory project domain, used to keep single-project installs working\n   * without any source binding. When absent, unbound sources are treated as\n   * belonging to no project.\n   */\n  projects?: { list(input: { orgId: string }): Promise<unknown[]> };\n  ingestFactoryIssues?: (input: LinearRulesIngress) => Promise<unknown>;\n}\n\n/**\n * Narrow the caller's selected Linear sources to the ones that feed this\n * Factory project.\n *\n * A Linear issue carries no Factory project of its own, so without a binding\n * every board view would ingest every selected source's issues into whichever\n * project happened to be on screen. Routing is explicit: a source feeds this\n * project only when its binding names both the project and a board. Returns\n * the bound board per source so the ingest lands cards where the user asked.\n */\nasync function scopeSourceIdsToProject({\n  intake,\n  orgId,\n  factoryProjectId,\n  selectedIds,\n}: {\n  intake: IntakeStorage;\n  orgId: string;\n  factoryProjectId: string;\n  selectedIds: string[];\n}): Promise<Record<string, string>> {\n  const selected = new Set(selectedIds);\n  const intakeBoards: Record<string, string> = {};\n  for (const binding of await intake.listBindings({ orgId, integrationId: 'linear' })) {\n    if (binding.factoryProjectId === factoryProjectId && binding.board && selected.has(binding.sourceId)) {\n      intakeBoards[binding.sourceId] = binding.board;\n    }\n  }\n  return intakeBoards;\n}\n\n/**\n * Resolve the org-scoped tenant for a Linear request. The connection is\n * org-owned, so it requires both a signed-in user and an organization — same\n * tenancy rules as the GitHub routes.\n */\nasync function resolveOrgTenant(\n  c: RouteContext,\n  auth: RouteAuth,\n): Promise<{ tenant: { orgId: string; userId: string } } | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) return { response: c.json({ error: 'unauthorized' }, 401) };\n  if (!tenant.orgId) {\n    return {\n      response: c.json(\n        {\n          error: 'organization_required',\n          message: 'Linear intake requires an organization. Personal accounts cannot connect Linear.',\n        },\n        403,\n      ),\n    };\n  }\n  return { tenant: { orgId: tenant.orgId, userId: tenant.userId } };\n}\n\n/**\n * Validate an opaque Linear pagination cursor from the query string. Cursors\n * are server-issued (`pageInfo.endCursor`), so anything outside a conservative\n * charset/length is rejected rather than forwarded to Linear.\n */\nfunction parseAfterCursor(raw: string | undefined): string | undefined | null {\n  if (raw === undefined || raw === '') return undefined;\n  if (raw.length > 512 || !/^[\\w+/=.:-]+$/.test(raw)) return null;\n  return raw;\n}\n\n/** Human issue key as it appears on a card (`ENG-123`). */\nconst ISSUE_IDENTIFIER_RE = /^[A-Za-z][A-Za-z0-9]{0,9}-\\d{1,7}$/;\n\n/** Map a Linear read failure to the API response for the SPA. */\nfunction linearFetchError(c: RouteContext, err: unknown) {\n  if (err instanceof LinearReauthRequiredError || (err as { status?: number }).status === 401) {\n    return c.json({ error: 'linear_reauth_required', message: new LinearReauthRequiredError().message }, 409);\n  }\n  return c.json({ error: 'linear_fetch_failed', message: err instanceof Error ? err.message : String(err) }, 502);\n}\n\n/**\n * Build the Linear routes as Mastra `apiRoutes`. When the feature is disabled,\n * returns only the `status` route so the SPA can detect the disabled state.\n */\nexport function buildLinearRoutes(options: MountLinearRoutesOptions): ApiRoute[] {\n  const routes: ApiRoute[] = [];\n  const { linear, auth, stateSigner, intake } = options;\n  const enabled = Boolean(linear) && auth.enabled();\n  const diagnostics = (): LinearFeatureDiagnostics => ({\n    linearAppConfigured: Boolean(linear),\n    factoryAuthEnabled: auth.enabled(),\n    appDbConfigured: true,\n  });\n\n  // The status route is always registered so the SPA can detect the disabled state.\n  routes.push(\n    registerApiRoute('/web/linear/status', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        if (!enabled || !linear || !stateSigner) {\n          return c.json({\n            enabled: false,\n            connected: false,\n            workspace: null,\n            reason: 'missing_config',\n            diagnostics: diagnostics(),\n          });\n        }\n        await auth.ensureUser(loose(c));\n        const tenant = auth.tenant(loose(c));\n        if (!tenant) return c.json({ error: 'unauthorized', reason: 'auth_required' }, 401);\n\n        if (!tenant.orgId) {\n          return c.json({\n            enabled: true,\n            organizationRequired: true,\n            connected: false,\n            workspace: null,\n            reason: 'organization_required',\n            diagnostics: diagnostics(),\n          });\n        }\n\n        const connection = await linear.loadConnection(tenant.orgId);\n        return c.json({\n          enabled: true,\n          connected: Boolean(connection),\n          workspace: connection ? { name: connection.workspaceName, urlKey: connection.workspaceUrlKey } : null,\n          reason: connection ? 'ready' : 'not_connected',\n          diagnostics: diagnostics(),\n        });\n      },\n    }),\n  );\n\n  // Without the integration instance or a state signer the connect/callback\n  // flow cannot talk to Linear or bind the OAuth round-trip to a tenant —\n  // serve only the disabled `status` route (mirrors the feature gate).\n  if (!enabled || !linear || !stateSigner || !intake) {\n    return routes;\n  }\n\n  const redirectUri = options.redirectUri ?? `${(options.baseUrl ?? '').replace(/\\/$/, '')}/auth/linear/callback`;\n\n  // ── Connect: send the user to Linear's OAuth consent screen ─────────────\n  routes.push(\n    registerApiRoute('/auth/linear/connect', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), auth);\n        if ('response' in resolved) return resolved.response;\n        const state = stateSigner.sign(resolved.tenant.orgId, resolved.tenant.userId);\n        return c.redirect(linear.buildAuthorizeUrl(state, redirectUri));\n      },\n    }),\n  );\n\n  // ── Callback: exchange the code, persist the connection for the org ─────\n  routes.push(\n    registerApiRoute('/auth/linear/callback', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), auth);\n        if ('response' in resolved) return resolved.response;\n        const { orgId, userId } = resolved.tenant;\n\n        // CSRF / cross-tenant linking protection: the signed state must belong\n        // to the same logged-in user *and* their current org.\n        const stateTenant = stateSigner.verify(c.req.query('state'));\n        if (!stateTenant || stateTenant.userId !== userId || stateTenant.orgId !== orgId) {\n          console.warn('[Linear] OAuth callback rejected: state/tenant mismatch.');\n          return c.redirect('/?linear=error');\n        }\n\n        const code = c.req.query('code');\n        if (!code) {\n          // User denied consent (or Linear returned an error).\n          return c.redirect('/?linear=error');\n        }\n\n        try {\n          const tokens = await linear.exchangeOAuthCode(code, redirectUri);\n          const workspace = await linear.fetchWorkspace(tokens.accessToken);\n          await linear.upsertConnection({\n            orgId,\n            userId,\n            accessToken: tokens.accessToken,\n            refreshToken: tokens.refreshToken,\n            expiresAt: tokens.expiresAt,\n            scope: tokens.scope,\n            workspaceName: workspace.name,\n            workspaceUrlKey: workspace.urlKey,\n          });\n        } catch (error) {\n          console.warn(`[Linear] OAuth callback failed to persist connection for org ${orgId}.`, error);\n          return c.redirect('/?linear=error');\n        }\n\n        return c.redirect('/?linear=connected');\n      },\n    }),\n  );\n\n  // ── List the workspace's projects (Settings intake-source picker) ───────\n  routes.push(\n    registerApiRoute('/web/linear/projects', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), auth);\n        if ('response' in resolved) return resolved.response;\n\n        const connection = await linear.loadConnection(resolved.tenant.orgId);\n        if (!connection) {\n          return c.json({ error: 'linear_not_connected', message: 'Connect Linear to list Linear projects.' }, 409);\n        }\n\n        try {\n          const accessToken = await linear.getFreshAccessToken(connection);\n          const projects = await linear.listProjects(accessToken);\n          return c.json({ projects });\n        } catch (err) {\n          return linearFetchError(loose(c), err);\n        }\n      },\n    }),\n  );\n\n  // ── List the workspace's active issues (cursor-paged) ───────────────────\n  // Respects the org's intake config: disabled Linear intake 404s the\n  // source, and an explicit project selection narrows the issue filter.\n  routes.push(\n    registerApiRoute('/web/linear/issues', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), auth);\n        if ('response' in resolved) return resolved.response;\n\n        const after = parseAfterCursor(c.req.query('after'));\n        if (after === null) return c.json({ error: 'invalid_cursor' }, 400);\n        const factoryProjectId = c.req.query('factoryProjectId');\n        if (factoryProjectId && !UUID_RE.test(factoryProjectId)) {\n          return c.json({ error: 'invalid_factory_project_id' }, 400);\n        }\n\n        const connection = await linear.loadConnection(resolved.tenant.orgId);\n        if (!connection) {\n          return c.json({ error: 'linear_not_connected', message: 'Connect Linear to see intake issues.' }, 409);\n        }\n\n        await intake.ensureReady();\n        const config = await intake.getConfig({ orgId: resolved.tenant.orgId, integrationIds: ['linear'] });\n        const selection = config.linear!;\n        if (!selection.enabled) {\n          return c.json({ error: 'linear_intake_disabled', message: 'Linear intake is turned off in Settings.' }, 404);\n        }\n\n        // No projects selected means nothing is synced — don't fan out to Linear.\n        const selectedIds = selection.sourceIds ?? [];\n        // A board request is also an ingest, so it only ever sees the sources\n        // routed to a board of that Factory project.\n        const intakeBoards = factoryProjectId\n          ? await scopeSourceIdsToProject({\n              intake,\n              orgId: resolved.tenant.orgId,\n              factoryProjectId,\n              selectedIds,\n            })\n          : null;\n        const projectIds = intakeBoards ? Object.keys(intakeBoards) : selectedIds;\n        if (projectIds.length === 0) {\n          return c.json({ issues: [], nextCursor: null });\n        }\n\n        try {\n          const accessToken = await linear.getFreshAccessToken(connection);\n          const { issues, nextCursor } = await linear.intake.listIssues({\n            connection: { type: 'oauth', accessToken },\n            sourceIds: projectIds,\n            cursor: after,\n          });\n          const issuePayload = issues.map(issue => ({\n            id: issue.id,\n            identifier: issue.identifier,\n            title: issue.title,\n            url: issue.url,\n            state: issue.state ?? '',\n            stateType: issue.stateType ?? '',\n            priorityLabel: issue.priority ?? '',\n            assignee: issue.assignee,\n            creator: issue.author,\n            team: issue.source,\n            labels: issue.labels,\n            createdAt: issue.createdAt,\n            updatedAt: issue.updatedAt,\n            sourceId: issue.sourceId ?? null,\n          }));\n          if (factoryProjectId && intakeBoards && options.ingestFactoryIssues) {\n            await options.ingestFactoryIssues({\n              orgId: resolved.tenant.orgId,\n              userId: resolved.tenant.userId,\n              factoryProjectId,\n              issues: issuePayload,\n              intakeBoards,\n            });\n          }\n          return c.json({ issues: issuePayload, nextCursor });\n        } catch (err) {\n          return linearFetchError(loose(c), err);\n        }\n      },\n    }),\n  );\n\n  routes.push(\n    registerApiRoute('/web/linear/issues/:identifier', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), auth);\n        if ('response' in resolved) return resolved.response;\n\n        const identifier = c.req.param('identifier');\n        if (!ISSUE_IDENTIFIER_RE.test(identifier)) return c.json({ error: 'invalid_identifier' }, 400);\n        const factoryProjectId = c.req.query('factoryProjectId');\n        if (!factoryProjectId || !UUID_RE.test(factoryProjectId)) {\n          return c.json({ error: 'invalid_factory_project_id' }, 400);\n        }\n\n        const connection = await linear.loadConnection(resolved.tenant.orgId);\n        if (!connection) {\n          return c.json({ error: 'linear_not_connected', message: 'Connect Linear to see intake issues.' }, 409);\n        }\n\n        await intake.ensureReady();\n        const config = await intake.getConfig({ orgId: resolved.tenant.orgId, integrationIds: ['linear'] });\n        const selection = config.linear!;\n        if (!selection.enabled) {\n          return c.json({ error: 'linear_intake_disabled', message: 'Linear intake is turned off in Settings.' }, 404);\n        }\n        const projectIds = Object.keys(\n          await scopeSourceIdsToProject({\n            intake,\n            orgId: resolved.tenant.orgId,\n            factoryProjectId,\n            selectedIds: selection.sourceIds ?? [],\n          }),\n        );\n        if (projectIds.length === 0) return c.json({ error: 'issue_not_found' }, 404);\n\n        try {\n          const accessToken = await linear.getFreshAccessToken(connection);\n          const issue = await linear.fetchIssueDetail(accessToken, identifier);\n          // Reads exactly like an issue that doesn't exist.\n          if (!issue || issue.projectId === null || !projectIds.includes(issue.projectId)) {\n            return c.json({ error: 'issue_not_found' }, 404);\n          }\n          return c.json({\n            identifier: issue.identifier,\n            title: issue.title,\n            url: issue.url,\n            description: issue.description,\n          });\n        } catch (err) {\n          return linearFetchError(loose(c), err);\n        }\n      },\n    }),\n  );\n\n  return routes;\n}\n"],"mappings":";;;AA0BA,MAAM,UAAU;;AAGhB,SAAS,MAAM,GAA0B;CACvC,OAAO;AACT;;;;;;;;;;;AAyDA,eAAe,wBAAwB,EACrC,QACA,OACA,kBACA,eAMkC;CAClC,MAAM,WAAW,IAAI,IAAI,WAAW;CACpC,MAAM,eAAuC,CAAC;CAC9C,KAAK,MAAM,WAAW,MAAM,OAAO,aAAa;EAAE;EAAO,eAAe;CAAS,CAAC,GAChF,IAAI,QAAQ,qBAAqB,oBAAoB,QAAQ,SAAS,SAAS,IAAI,QAAQ,QAAQ,GACjG,aAAa,QAAQ,YAAY,QAAQ;CAG7C,OAAO;AACT;;;;;;AAOA,eAAe,iBACb,GACA,MACiF;CACjF,MAAM,KAAK,WAAW,CAAC;CACvB,MAAM,SAAS,KAAK,OAAO,CAAC;CAC5B,IAAI,CAAC,QAAQ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;CACvE,IAAI,CAAC,OAAO,OACV,OAAO,EACL,UAAU,EAAE,KACV;EACE,OAAO;EACP,SAAS;CACX,GACA,GACF,EACF;CAEF,OAAO,EAAE,QAAQ;EAAE,OAAO,OAAO;EAAO,QAAQ,OAAO;CAAO,EAAE;AAClE;;;;;;AAOA,SAAS,iBAAiB,KAAoD;CAC5E,IAAI,QAAQ,KAAA,KAAa,QAAQ,IAAI,OAAO,KAAA;CAC5C,IAAI,IAAI,SAAS,OAAO,CAAC,gBAAgB,KAAK,GAAG,GAAG,OAAO;CAC3D,OAAO;AACT;;AAGA,MAAM,sBAAsB;;AAG5B,SAAS,iBAAiB,GAAiB,KAAc;CACvD,IAAI,eAAe,6BAA8B,IAA4B,WAAW,KACtF,OAAO,EAAE,KAAK;EAAE,OAAO;EAA0B,SAAS,IAAI,0BAA0B,CAAC,CAAC;CAAQ,GAAG,GAAG;CAE1G,OAAO,EAAE,KAAK;EAAE,OAAO;EAAuB,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;CAAE,GAAG,GAAG;AAChH;;;;;AAMA,SAAgB,kBAAkB,SAA+C;CAC/E,MAAM,SAAqB,CAAC;CAC5B,MAAM,EAAE,QAAQ,MAAM,aAAa,WAAW;CAC9C,MAAM,UAAU,QAAQ,MAAM,KAAK,KAAK,QAAQ;CAChD,MAAM,qBAA+C;EACnD,qBAAqB,QAAQ,MAAM;EACnC,oBAAoB,KAAK,QAAQ;EACjC,iBAAiB;CACnB;CAGA,OAAO,KACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,aAC1B,OAAO,EAAE,KAAK;IACZ,SAAS;IACT,WAAW;IACX,WAAW;IACX,QAAQ;IACR,aAAa,YAAY;GAC3B,CAAC;GAEH,MAAM,KAAK,WAAW,MAAM,CAAC,CAAC;GAC9B,MAAM,SAAS,KAAK,OAAO,MAAM,CAAC,CAAC;GACnC,IAAI,CAAC,QAAQ,OAAO,EAAE,KAAK;IAAE,OAAO;IAAgB,QAAQ;GAAgB,GAAG,GAAG;GAElF,IAAI,CAAC,OAAO,OACV,OAAO,EAAE,KAAK;IACZ,SAAS;IACT,sBAAsB;IACtB,WAAW;IACX,WAAW;IACX,QAAQ;IACR,aAAa,YAAY;GAC3B,CAAC;GAGH,MAAM,aAAa,MAAM,OAAO,eAAe,OAAO,KAAK;GAC3D,OAAO,EAAE,KAAK;IACZ,SAAS;IACT,WAAW,QAAQ,UAAU;IAC7B,WAAW,aAAa;KAAE,MAAM,WAAW;KAAe,QAAQ,WAAW;IAAgB,IAAI;IACjG,QAAQ,aAAa,UAAU;IAC/B,aAAa,YAAY;GAC3B,CAAC;EACH;CACF,CAAC,CACH;CAKA,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,eAAe,CAAC,QAC1C,OAAO;CAGT,MAAM,cAAc,QAAQ,eAAe,IAAI,QAAQ,WAAW,GAAA,CAAI,QAAQ,OAAO,EAAE,EAAE;CAGzF,OAAO,KACL,iBAAiB,wBAAwB;EACvC,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,IAAI;GACtD,IAAI,cAAc,UAAU,OAAO,SAAS;GAC5C,MAAM,QAAQ,YAAY,KAAK,SAAS,OAAO,OAAO,SAAS,OAAO,MAAM;GAC5E,OAAO,EAAE,SAAS,OAAO,kBAAkB,OAAO,WAAW,CAAC;EAChE;CACF,CAAC,CACH;CAGA,OAAO,KACL,iBAAiB,yBAAyB;EACxC,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,IAAI;GACtD,IAAI,cAAc,UAAU,OAAO,SAAS;GAC5C,MAAM,EAAE,OAAO,WAAW,SAAS;GAInC,MAAM,cAAc,YAAY,OAAO,EAAE,IAAI,MAAM,OAAO,CAAC;GAC3D,IAAI,CAAC,eAAe,YAAY,WAAW,UAAU,YAAY,UAAU,OAAO;IAChF,QAAQ,KAAK,0DAA0D;IACvE,OAAO,EAAE,SAAS,gBAAgB;GACpC;GAEA,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;GAC/B,IAAI,CAAC,MAEH,OAAO,EAAE,SAAS,gBAAgB;GAGpC,IAAI;IACF,MAAM,SAAS,MAAM,OAAO,kBAAkB,MAAM,WAAW;IAC/D,MAAM,YAAY,MAAM,OAAO,eAAe,OAAO,WAAW;IAChE,MAAM,OAAO,iBAAiB;KAC5B;KACA;KACA,aAAa,OAAO;KACpB,cAAc,OAAO;KACrB,WAAW,OAAO;KAClB,OAAO,OAAO;KACd,eAAe,UAAU;KACzB,iBAAiB,UAAU;IAC7B,CAAC;GACH,SAAS,OAAO;IACd,QAAQ,KAAK,gEAAgE,MAAM,IAAI,KAAK;IAC5F,OAAO,EAAE,SAAS,gBAAgB;GACpC;GAEA,OAAO,EAAE,SAAS,oBAAoB;EACxC;CACF,CAAC,CACH;CAGA,OAAO,KACL,iBAAiB,wBAAwB;EACvC,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,IAAI;GACtD,IAAI,cAAc,UAAU,OAAO,SAAS;GAE5C,MAAM,aAAa,MAAM,OAAO,eAAe,SAAS,OAAO,KAAK;GACpE,IAAI,CAAC,YACH,OAAO,EAAE,KAAK;IAAE,OAAO;IAAwB,SAAS;GAA0C,GAAG,GAAG;GAG1G,IAAI;IACF,MAAM,cAAc,MAAM,OAAO,oBAAoB,UAAU;IAC/D,MAAM,WAAW,MAAM,OAAO,aAAa,WAAW;IACtD,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC;GAC5B,SAAS,KAAK;IACZ,OAAO,iBAAiB,MAAM,CAAC,GAAG,GAAG;GACvC;EACF;CACF,CAAC,CACH;CAKA,OAAO,KACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,IAAI;GACtD,IAAI,cAAc,UAAU,OAAO,SAAS;GAE5C,MAAM,QAAQ,iBAAiB,EAAE,IAAI,MAAM,OAAO,CAAC;GACnD,IAAI,UAAU,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAClE,MAAM,mBAAmB,EAAE,IAAI,MAAM,kBAAkB;GACvD,IAAI,oBAAoB,CAAC,QAAQ,KAAK,gBAAgB,GACpD,OAAO,EAAE,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;GAG5D,MAAM,aAAa,MAAM,OAAO,eAAe,SAAS,OAAO,KAAK;GACpE,IAAI,CAAC,YACH,OAAO,EAAE,KAAK;IAAE,OAAO;IAAwB,SAAS;GAAuC,GAAG,GAAG;GAGvG,MAAM,OAAO,YAAY;GAEzB,MAAM,aAAY,MADG,OAAO,UAAU;IAAE,OAAO,SAAS,OAAO;IAAO,gBAAgB,CAAC,QAAQ;GAAE,CAAC,EAAA,CACzE;GACzB,IAAI,CAAC,UAAU,SACb,OAAO,EAAE,KAAK;IAAE,OAAO;IAA0B,SAAS;GAA2C,GAAG,GAAG;GAI7G,MAAM,cAAc,UAAU,aAAa,CAAC;GAG5C,MAAM,eAAe,mBACjB,MAAM,wBAAwB;IAC5B;IACA,OAAO,SAAS,OAAO;IACvB;IACA;GACF,CAAC,IACD;GACJ,MAAM,aAAa,eAAe,OAAO,KAAK,YAAY,IAAI;GAC9D,IAAI,WAAW,WAAW,GACxB,OAAO,EAAE,KAAK;IAAE,QAAQ,CAAC;IAAG,YAAY;GAAK,CAAC;GAGhD,IAAI;IACF,MAAM,cAAc,MAAM,OAAO,oBAAoB,UAAU;IAC/D,MAAM,EAAE,QAAQ,eAAe,MAAM,OAAO,OAAO,WAAW;KAC5D,YAAY;MAAE,MAAM;MAAS;KAAY;KACzC,WAAW;KACX,QAAQ;IACV,CAAC;IACD,MAAM,eAAe,OAAO,KAAI,WAAU;KACxC,IAAI,MAAM;KACV,YAAY,MAAM;KAClB,OAAO,MAAM;KACb,KAAK,MAAM;KACX,OAAO,MAAM,SAAS;KACtB,WAAW,MAAM,aAAa;KAC9B,eAAe,MAAM,YAAY;KACjC,UAAU,MAAM;KAChB,SAAS,MAAM;KACf,MAAM,MAAM;KACZ,QAAQ,MAAM;KACd,WAAW,MAAM;KACjB,WAAW,MAAM;KACjB,UAAU,MAAM,YAAY;IAC9B,EAAE;IACF,IAAI,oBAAoB,gBAAgB,QAAQ,qBAC9C,MAAM,QAAQ,oBAAoB;KAChC,OAAO,SAAS,OAAO;KACvB,QAAQ,SAAS,OAAO;KACxB;KACA,QAAQ;KACR;IACF,CAAC;IAEH,OAAO,EAAE,KAAK;KAAE,QAAQ;KAAc;IAAW,CAAC;GACpD,SAAS,KAAK;IACZ,OAAO,iBAAiB,MAAM,CAAC,GAAG,GAAG;GACvC;EACF;CACF,CAAC,CACH;CAEA,OAAO,KACL,iBAAiB,kCAAkC;EACjD,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,IAAI;GACtD,IAAI,cAAc,UAAU,OAAO,SAAS;GAE5C,MAAM,aAAa,EAAE,IAAI,MAAM,YAAY;GAC3C,IAAI,CAAC,oBAAoB,KAAK,UAAU,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;GAC7F,MAAM,mBAAmB,EAAE,IAAI,MAAM,kBAAkB;GACvD,IAAI,CAAC,oBAAoB,CAAC,QAAQ,KAAK,gBAAgB,GACrD,OAAO,EAAE,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;GAG5D,MAAM,aAAa,MAAM,OAAO,eAAe,SAAS,OAAO,KAAK;GACpE,IAAI,CAAC,YACH,OAAO,EAAE,KAAK;IAAE,OAAO;IAAwB,SAAS;GAAuC,GAAG,GAAG;GAGvG,MAAM,OAAO,YAAY;GAEzB,MAAM,aAAY,MADG,OAAO,UAAU;IAAE,OAAO,SAAS,OAAO;IAAO,gBAAgB,CAAC,QAAQ;GAAE,CAAC,EAAA,CACzE;GACzB,IAAI,CAAC,UAAU,SACb,OAAO,EAAE,KAAK;IAAE,OAAO;IAA0B,SAAS;GAA2C,GAAG,GAAG;GAE7G,MAAM,aAAa,OAAO,KACxB,MAAM,wBAAwB;IAC5B;IACA,OAAO,SAAS,OAAO;IACvB;IACA,aAAa,UAAU,aAAa,CAAC;GACvC,CAAC,CACH;GACA,IAAI,WAAW,WAAW,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;GAE5E,IAAI;IACF,MAAM,cAAc,MAAM,OAAO,oBAAoB,UAAU;IAC/D,MAAM,QAAQ,MAAM,OAAO,iBAAiB,aAAa,UAAU;IAEnE,IAAI,CAAC,SAAS,MAAM,cAAc,QAAQ,CAAC,WAAW,SAAS,MAAM,SAAS,GAC5E,OAAO,EAAE,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;IAEjD,OAAO,EAAE,KAAK;KACZ,YAAY,MAAM;KAClB,OAAO,MAAM;KACb,KAAK,MAAM;KACX,aAAa,MAAM;IACrB,CAAC;GACH,SAAS,KAAK;IACZ,OAAO,iBAAiB,MAAM,CAAC,GAAG,GAAG;GACvC;EACF;CACF,CAAC,CACH;CAEA,OAAO;AACT"}

package/dist/routes/intake.js

@@ -239,7 +239,7 @@ var IntakeRoutes = class extends Route {
 					if ("response" in tenant) return tenant.response;
 					await intake.ensureReady();
 					const config = await intake.getConfig({
-						...tenant,
+						orgId: tenant.orgId,
 						integrationIds
 					});
 					return c.json({ config });
@@ -269,7 +269,7 @@ var IntakeRoutes = class extends Route {
 					}
 					await intake.ensureReady();
 					await intake.saveConfig({
-						...tenant,
+						orgId: tenant.orgId,
 						config: registeredConfig
 					});
 					await audit.emit({
@@ -507,7 +507,7 @@ var IntakeRoutes = class extends Route {
 					if (!cursors) return c.json({ error: "invalid_cursor" }, 400);
 					await intake.ensureReady();
 					const config = await intake.getConfig({
-						...tenant,
+						orgId: tenant.orgId,
 						integrationIds
 					});
 					const { pages, failures } = await settleByIntegration(integrations.flatMap((integration) => {

package/dist/routes/intake.js.map

@@ -1 +1 @@
-{"version":3,"file":"intake.js","names":["#resolveTenant"],"sources":["../../src/routes/intake.ts"],"sourcesContent":["import type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\nimport { z } from 'zod';\n\nimport type { BoardRegistry } from '../boards/index.js';\nimport { cardLabels, moveCardToBoard } from '../boards/relocate.js';\nimport type { Intake, IntakeItem } from '../capabilities/intake.js';\nimport type { AuditEmitter } from '../storage/domains/audit/domain.js';\nimport { normalizeIntakeLabel, resolveIntakeLabelRoute } from '../storage/domains/intake/base.js';\nimport type { IntakeConfig, IntakeLabelRoute, IntakeStorage } from '../storage/domains/intake/base.js';\nimport type { WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport type { RouteDependencies } from './route.js';\nimport { Route } from './route.js';\n\nexport interface IntakeIntegration {\n  id: string;\n  intake: Pick<Intake, 'listSources' | 'listItems'>;\n}\n\ninterface AggregatedIntakeItem extends Omit<IntakeItem, 'source'> {\n  integrationId: string;\n  externalSource: {\n    integrationId: string;\n    type: string;\n    externalId: string;\n    url?: string;\n  };\n}\n\nexport interface IntakeRoutesDeps extends RouteDependencies {\n  audit: AuditEmitter;\n  /** Intake selection domain handle. */\n  intake: IntakeStorage;\n  /** Factory project domain handle, used to validate binding targets. */\n  projects?: { get(input: { orgId: string; id: string }): Promise<unknown | null> };\n  integrations?: IntakeIntegration[];\n  /** Installed boards, used to validate binding targets. Absent means only legacy routing is accepted. */\n  boardRegistry?: BoardRegistry;\n  /** Work items domain handle; when present, rebinding a source to another board moves its resting cards. */\n  workItems?: Pick<WorkItemsStorage, 'list' | 'update' | 'supersedeDecisionsForWorkItem'>;\n}\n\n/** Upper bound on source pages read while relocating cards, so a huge source cannot stall the request. */\nconst REBIND_MAX_PAGES = 20;\n/**\n * One deadline for the whole rebind read, not one per page: the binding is already saved when we\n * get here, so the caller is only waiting on relocation and a slow provider must not hold the\n * response for pages × timeout.\n */\nconst REBIND_READ_BUDGET_MS = 30_000;\n\n/**\n * Keys under which an intake item may be persisted as a work item. Providers key items by their\n * own id, while materialization uses the human identifier (`linear:MAS-44`), so both are accepted.\n */\nfunction intakeItemSourceKeys(integrationId: string, item: IntakeItem): string[] {\n  const identifier = item.metadata?.identifier;\n  return typeof identifier === 'string' && identifier.length > 0\n    ? [item.source.externalId, `${integrationId}:${identifier}`]\n    : [item.source.externalId];\n}\n\n/**\n * Move the cards that came from a rebound source onto its new board's initial phase. Terminal cards\n * stay put (they are history that belongs where it finished), as do cards with a session attached to\n * a current stage (a run owns them). Everything else moves, including cards parked in a working\n * phase that never started a run — auto-ingested issues sit in Work › Triage that way.\n */\nasync function relocateSourceCards({\n  workItems,\n  integration,\n  boardRegistry,\n  orgId,\n  userId,\n  factoryProjectId,\n  sourceId,\n  targetBoard,\n}: {\n  workItems: Pick<WorkItemsStorage, 'list' | 'update' | 'supersedeDecisionsForWorkItem'>;\n  integration: IntakeIntegration;\n  boardRegistry: BoardRegistry;\n  orgId: string;\n  userId: string;\n  factoryProjectId: string;\n  sourceId: string;\n  targetBoard: string;\n}): Promise<{ moved: number; skipped: number }> {\n  if (!boardRegistry.has(targetBoard)) return { moved: 0, skipped: 0 };\n\n  const sourceKeys = new Set<string>();\n  let cursor: string | undefined;\n  const deadline = Date.now() + REBIND_READ_BUDGET_MS;\n  for (let page = 0; page < REBIND_MAX_PAGES; page += 1) {\n    const result = await withTimeout(\n      integration.id,\n      () => integration.intake.listItems({ orgId, userId, sourceIds: [sourceId], cursor }),\n      deadline - Date.now(),\n    );\n    for (const item of result.items) {\n      for (const key of intakeItemSourceKeys(integration.id, item)) sourceKeys.add(key);\n    }\n    if (!result.nextCursor) break;\n    cursor = result.nextCursor;\n  }\n  if (sourceKeys.size === 0) return { moved: 0, skipped: 0 };\n\n  let moved = 0;\n  let skipped = 0;\n  const items = await workItems.list({ orgId, factoryProjectId });\n  for (const item of items) {\n    const source = item.externalSource;\n    if (!source || source.integrationId !== integration.id || !sourceKeys.has(source.externalId)) continue;\n    const outcome = await moveCardToBoard({ workItems, boardRegistry, userId, item, targetBoard });\n    if (outcome === 'moved') moved += 1;\n    else if (outcome === 'skipped') skipped += 1;\n  }\n  return { moved, skipped };\n}\n\n/**\n * After a label route changes, every issue card in the project that carries `label` is re-routed\n * under the project's current routes: to the board its labels now select, or back to Work when none\n * of them is routed any more.\n */\nasync function relocateLabeledCards({\n  workItems,\n  boardRegistry,\n  orgId,\n  userId,\n  factoryProjectId,\n  integrationId,\n  label,\n  routes,\n}: {\n  workItems: Pick<WorkItemsStorage, 'list' | 'update' | 'supersedeDecisionsForWorkItem'>;\n  boardRegistry: BoardRegistry;\n  orgId: string;\n  userId: string;\n  factoryProjectId: string;\n  integrationId: string;\n  label: string;\n  routes: readonly IntakeLabelRoute[];\n}): Promise<{ moved: number; skipped: number }> {\n  const changed = normalizeIntakeLabel(label);\n  let moved = 0;\n  let skipped = 0;\n  for (const item of await workItems.list({ orgId, factoryProjectId })) {\n    const source = item.externalSource;\n    if (!source || source.integrationId !== integrationId || source.type !== 'issue') continue;\n    const labels = cardLabels(item);\n    if (!labels.some(candidate => normalizeIntakeLabel(candidate) === changed)) continue;\n    const targetBoard = resolveIntakeLabelRoute(routes, labels)?.board ?? 'work';\n    const outcome = await moveCardToBoard({ workItems, boardRegistry, userId, item, targetBoard });\n    if (outcome === 'moved') moved += 1;\n    else if (outcome === 'skipped') skipped += 1;\n  }\n  return { moved, skipped };\n}\n\n/** One integration that failed while the rest of the aggregation succeeded. */\nexport interface IntakeIntegrationFailure {\n  integrationId: string;\n  message: string;\n}\n\ntype SettledIntegration<T> = { integrationId: string; value: T } | IntakeIntegrationFailure;\n\nconst PROVIDER_READ_TIMEOUT_MS = 15_000;\n\n/** The Intake contract takes no abort signal, so a slow read is abandoned, not cancelled. */\nfunction withTimeout<T>(\n  integrationId: string,\n  read: () => Promise<T>,\n  timeoutMs: number = PROVIDER_READ_TIMEOUT_MS,\n): Promise<T> {\n  return new Promise((resolve, reject) => {\n    const budget = Math.max(0, timeoutMs);\n    const timer = setTimeout(\n      () => reject(new Error(`${integrationId} did not answer within ${Math.round(budget / 1000)}s`)),\n      budget,\n    );\n    read()\n      .then(resolve, reject)\n      .finally(() => clearTimeout(timer));\n  });\n}\n\n/**\n * Read every integration concurrently and isolate the ones that throw or hang, so a single\n * unreachable provider degrades to a per-source error instead of failing the listing.\n */\nasync function settleByIntegration<T>(\n  requests: Array<{ integrationId: string; read: () => Promise<T> }>,\n): Promise<{ pages: Array<{ integrationId: string; value: T }>; failures: IntakeIntegrationFailure[] }> {\n  const settled = await Promise.all(\n    requests.map(async ({ integrationId, read }): Promise<SettledIntegration<T>> => {\n      try {\n        return { integrationId, value: await withTimeout(integrationId, read) };\n      } catch (error) {\n        console.error(`[factory] intake integration ${integrationId} is unavailable:`, error);\n        return { integrationId, message: error instanceof Error ? error.message : String(error) };\n      }\n    }),\n  );\n  const pages: Array<{ integrationId: string; value: T }> = [];\n  const failures: IntakeIntegrationFailure[] = [];\n  for (const entry of settled) {\n    if ('value' in entry) pages.push(entry);\n    else failures.push(entry);\n  }\n  return { pages, failures };\n}\n\ninterface ParsedBinding {\n  integrationId: string;\n  sourceId: string;\n  factoryProjectId: string | null;\n  /** Installed board target; `null`/omitted keeps legacy source-type routing. */\n  board: string | null;\n}\n\n/** Validate a binding request body, rejecting unknown shapes. */\nexport function parseIntakeBinding(body: unknown): ParsedBinding | null {\n  if (typeof body !== 'object' || body === null || Array.isArray(body)) return null;\n  const { integrationId, sourceId, factoryProjectId, board } = body as Record<string, unknown>;\n  const isId = (value: unknown) => typeof value === 'string' && value.length > 0 && value.length <= 256;\n  if (!isId(integrationId) || !isId(sourceId)) return null;\n  if (factoryProjectId !== null && !isId(factoryProjectId)) return null;\n  if (board !== undefined && board !== null && !isId(board)) return null;\n  return {\n    integrationId: integrationId as string,\n    sourceId: sourceId as string,\n    factoryProjectId: factoryProjectId as string | null,\n    board: (board as string | null | undefined) ?? null,\n  };\n}\n\nconst identifier = z.string().min(1).max(256);\nconst labelRouteBodySchema = z.object({\n  factoryProjectId: identifier,\n  integrationId: identifier,\n  label: z\n    .string()\n    .max(256)\n    .transform(normalizeIntakeLabel)\n    .refine(label => label.length > 0, 'label must not be blank'),\n  /** Installed board target; `null` removes the route so the label falls back to Work. */\n  board: identifier.nullish().transform(board => board ?? null),\n});\ntype ParsedLabelRoute = z.output<typeof labelRouteBodySchema>;\n\n/** Validate a label-route request body, rejecting unknown shapes. */\nexport function parseIntakeLabelRoute(body: unknown): ParsedLabelRoute | null {\n  const parsed = labelRouteBodySchema.safeParse(body);\n  return parsed.success ? parsed.data : null;\n}\n\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\nfunction sanitizeIdList(value: unknown): string[] | null | undefined {\n  if (value === null) return null;\n  if (!Array.isArray(value) || value.length > 200) return undefined;\n  const ids = value.filter((item): item is string => typeof item === 'string' && item.length > 0 && item.length <= 256);\n  return ids.length === value.length && new Set(ids).size === ids.length ? ids : undefined;\n}\n\n/** Validate a request body into an intake config, rejecting unknown shapes. */\nexport function parseIntakeConfig(body: unknown): IntakeConfig | null {\n  if (typeof body !== 'object' || body === null || Array.isArray(body)) return null;\n  const entries = Object.entries(body);\n  if (entries.length > 50) return null;\n\n  // Null-prototype so an `__proto__` key lands as a real entry instead of silently\n  // reassigning the prototype and disappearing from the validation below.\n  const config: IntakeConfig = Object.create(null);\n  for (const [integrationId, value] of entries) {\n    if (\n      !integrationId ||\n      integrationId.length > 128 ||\n      typeof value !== 'object' ||\n      value === null ||\n      Array.isArray(value)\n    ) {\n      return null;\n    }\n    const selection = value as { enabled?: unknown; sourceIds?: unknown };\n    if (typeof selection.enabled !== 'boolean') return null;\n    const sourceIds = sanitizeIdList(selection.sourceIds ?? null);\n    if (sourceIds === undefined) return null;\n    config[integrationId] = { enabled: selection.enabled, sourceIds };\n  }\n  return config;\n}\n\nfunction encodeCursor(cursors: Record<string, string>): string | null {\n  return Object.keys(cursors).length > 0 ? Buffer.from(JSON.stringify(cursors)).toString('base64url') : null;\n}\n\nfunction decodeCursor(value: string | undefined): Record<string, string> | null {\n  if (!value) return {};\n  try {\n    const parsed = JSON.parse(Buffer.from(value, 'base64url').toString('utf8')) as unknown;\n    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) return null;\n    const entries = Object.entries(parsed);\n    if (entries.some(([key, cursor]) => !key || typeof cursor !== 'string')) return null;\n    return Object.fromEntries(entries) as Record<string, string>;\n  } catch {\n    return null;\n  }\n}\n\nexport class IntakeRoutes extends Route<IntakeRoutesDeps> {\n  async #resolveTenant(c: Context): Promise<{ orgId: string; userId: string } | { response: Response }> {\n    await this.deps.auth.ensureUser(c);\n    const tenant = this.deps.auth.tenant(c);\n    if (!tenant) return { response: c.json({ error: 'unauthorized' }, 401) };\n    if (!tenant.orgId) {\n      return {\n        response: c.json(\n          { error: 'organization_required', message: 'Intake configuration requires an organization.' },\n          403,\n        ),\n      };\n    }\n    return { orgId: tenant.orgId, userId: tenant.userId };\n  }\n\n  routes(): ApiRoute[] {\n    const { audit, intake, projects, integrations = [], boardRegistry, workItems } = this.deps;\n    const integrationIds = integrations.map(integration => integration.id);\n\n    return [\n      registerApiRoute('/web/intake/config', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          await intake.ensureReady();\n          const config = await intake.getConfig({ ...tenant, integrationIds });\n          return c.json({ config });\n        },\n      }),\n      registerApiRoute('/web/intake/config', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n\n          let body: unknown;\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const config = parseIntakeConfig(body);\n          if (!config) {\n            return c.json({ error: 'invalid_config' }, 400);\n          }\n\n          const registeredConfig: IntakeConfig = Object.create(null);\n          for (const [integrationId, selection] of Object.entries(config)) {\n            if (integrationIds.includes(integrationId)) {\n              registeredConfig[integrationId] = selection;\n              continue;\n            }\n            if (selection.enabled || selection.sourceIds?.length) {\n              return c.json({ error: 'invalid_config' }, 400);\n            }\n          }\n\n          await intake.ensureReady();\n          await intake.saveConfig({ ...tenant, config: registeredConfig });\n          await audit.emit({\n            context: loose(c),\n            input: {\n              action: 'factory.intake.config_updated',\n              targets: [{ type: 'intake_config', id: tenant.orgId }],\n              metadata: Object.fromEntries(\n                Object.entries(registeredConfig).map(([integrationId, selection]) => [\n                  integrationId,\n                  { enabled: selection.enabled, sources: selection.sourceIds?.length ?? null },\n                ]),\n              ),\n            },\n          });\n          return c.json({ config: registeredConfig });\n        },\n      }),\n      registerApiRoute('/web/intake/bindings', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          await intake.ensureReady();\n          return c.json({ bindings: await intake.listBindings({ orgId: tenant.orgId }) });\n        },\n      }),\n      registerApiRoute('/web/intake/bindings', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n\n          let body: unknown;\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const binding = parseIntakeBinding(body);\n          if (!binding || !integrationIds.includes(binding.integrationId)) {\n            return c.json({ error: 'invalid_binding' }, 400);\n          }\n          if (binding.factoryProjectId && projects) {\n            const project = await projects.get({ orgId: tenant.orgId, id: binding.factoryProjectId });\n            if (!project) return c.json({ error: 'factory_project_not_found' }, 404);\n          }\n          if (binding.board !== null && !boardRegistry?.has(binding.board)) {\n            return c.json({ error: 'invalid_board', message: `Board '${binding.board}' is not installed.` }, 422);\n          }\n\n          await intake.ensureReady();\n          let auditFactoryProjectId = binding.factoryProjectId;\n          let relocated: { moved: number; skipped: number } | null = null;\n          if (binding.factoryProjectId === null) {\n            const previousBinding = await intake.clearBinding({\n              orgId: tenant.orgId,\n              integrationId: binding.integrationId,\n              sourceId: binding.sourceId,\n            });\n            auditFactoryProjectId = previousBinding?.factoryProjectId ?? null;\n          } else {\n            const previousBinding = await intake.getBinding({\n              orgId: tenant.orgId,\n              integrationId: binding.integrationId,\n              sourceId: binding.sourceId,\n            });\n            await intake.setBinding({\n              orgId: tenant.orgId,\n              userId: tenant.userId,\n              integrationId: binding.integrationId,\n              sourceId: binding.sourceId,\n              factoryProjectId: binding.factoryProjectId,\n              board: binding.board,\n            });\n            // A source that stays in the same project but is pointed at a different board\n            // takes its resting cards along. Bindings that predate persisted boards have a\n            // null board yet still fed Work/Review, so relocation compares each card's\n            // effective board rather than trusting the previous binding value.\n            const nextBoard = binding.board;\n            const integration = integrations.find(candidate => candidate.id === binding.integrationId);\n            if (\n              workItems &&\n              boardRegistry &&\n              integration &&\n              previousBinding?.factoryProjectId === binding.factoryProjectId &&\n              nextBoard !== null &&\n              previousBinding.board !== nextBoard\n            ) {\n              try {\n                relocated = await relocateSourceCards({\n                  workItems,\n                  integration,\n                  boardRegistry,\n                  orgId: tenant.orgId,\n                  userId: tenant.userId,\n                  factoryProjectId: binding.factoryProjectId,\n                  sourceId: binding.sourceId,\n                  targetBoard: nextBoard,\n                });\n              } catch (error) {\n                // The binding is saved; the cards can be moved by hand if the provider was unreachable.\n                console.error(`[factory] intake rebind could not relocate ${binding.integrationId} cards:`, error);\n              }\n            }\n          }\n          await audit.emit({\n            context: loose(c),\n            input: {\n              action: 'factory.intake.binding_updated',\n              ...(auditFactoryProjectId ? { factoryProjectId: auditFactoryProjectId } : {}),\n              targets: [{ type: 'intake_source', id: `${binding.integrationId}:${binding.sourceId}` }],\n              metadata: {\n                factoryProjectId: binding.factoryProjectId,\n                board: binding.board,\n                ...(relocated ? { relocated } : {}),\n              },\n            },\n          });\n          return c.json({\n            bindings: await intake.listBindings({ orgId: tenant.orgId }),\n            ...(relocated ? { relocated } : {}),\n          });\n        },\n      }),\n      registerApiRoute('/web/intake/label-routes', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          const factoryProjectId = c.req.query('factoryProjectId');\n          await intake.ensureReady();\n          return c.json({\n            routes: await intake.listLabelRoutes({\n              orgId: tenant.orgId,\n              ...(factoryProjectId ? { factoryProjectId } : {}),\n            }),\n          });\n        },\n      }),\n      registerApiRoute('/web/intake/label-routes', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n\n          let body: unknown;\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const route = parseIntakeLabelRoute(body);\n          if (!route || !integrationIds.includes(route.integrationId)) {\n            return c.json({ error: 'invalid_label_route' }, 400);\n          }\n          if (projects) {\n            const project = await projects.get({ orgId: tenant.orgId, id: route.factoryProjectId });\n            if (!project) return c.json({ error: 'factory_project_not_found' }, 404);\n          }\n          if (route.board !== null && !boardRegistry?.has(route.board)) {\n            return c.json({ error: 'invalid_board', message: `Board '${route.board}' is not installed.` }, 422);\n          }\n\n          await intake.ensureReady();\n          const scope = {\n            orgId: tenant.orgId,\n            factoryProjectId: route.factoryProjectId,\n            integrationId: route.integrationId,\n          };\n          const previous = (await intake.listLabelRoutes(scope)).find(existing => existing.label === route.label);\n          if (route.board === null) {\n            await intake.clearLabelRoute({ ...scope, label: route.label });\n          } else {\n            await intake.setLabelRoute({ ...scope, label: route.label, board: route.board, userId: tenant.userId });\n          }\n\n          // Cards already carrying the label follow the route: onto the new board, or back to\n          // Work when the label is no longer routed anywhere.\n          let relocated: { moved: number; skipped: number } | null = null;\n          if (workItems && boardRegistry && (previous?.board ?? null) !== route.board) {\n            try {\n              relocated = await relocateLabeledCards({\n                workItems,\n                boardRegistry,\n                orgId: tenant.orgId,\n                userId: tenant.userId,\n                factoryProjectId: route.factoryProjectId,\n                integrationId: route.integrationId,\n                label: route.label,\n                routes: await intake.listLabelRoutes(scope),\n              });\n            } catch (error) {\n              // The route is saved; the cards can be moved by hand.\n              console.error(`[factory] intake label route could not relocate ${route.integrationId} cards:`, error);\n            }\n          }\n          await audit.emit({\n            context: loose(c),\n            input: {\n              action: 'factory.intake.label_route_updated',\n              factoryProjectId: route.factoryProjectId,\n              targets: [{ type: 'intake_label_route', id: `${route.integrationId}:${route.label}` }],\n              metadata: { board: route.board, ...(relocated ? { relocated } : {}) },\n            },\n          });\n          return c.json({\n            routes: await intake.listLabelRoutes({ orgId: tenant.orgId, factoryProjectId: route.factoryProjectId }),\n            ...(relocated ? { relocated } : {}),\n          });\n        },\n      }),\n      registerApiRoute('/web/intake/sources', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          const { pages, failures } = await settleByIntegration(\n            integrations.map(integration => ({\n              integrationId: integration.id,\n              read: () => integration.intake.listSources(tenant),\n            })),\n          );\n          return c.json({\n            sources: pages.flatMap(({ integrationId, value }) => value.map(source => ({ integrationId, ...source }))),\n            failures,\n          });\n        },\n      }),\n      registerApiRoute('/web/intake/items', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          const cursors = decodeCursor(c.req.query('cursor'));\n          if (!cursors) return c.json({ error: 'invalid_cursor' }, 400);\n\n          await intake.ensureReady();\n          const config = await intake.getConfig({ ...tenant, integrationIds });\n          const { pages, failures } = await settleByIntegration(\n            integrations.flatMap(integration => {\n              const selection = config[integration.id];\n              if (!selection?.enabled || !selection.sourceIds?.length) return [];\n              const sourceIds = selection.sourceIds;\n              const cursor = cursors[integration.id];\n              return [\n                {\n                  integrationId: integration.id,\n                  read: () => integration.intake.listItems({ ...tenant, sourceIds, ...(cursor ? { cursor } : {}) }),\n                },\n              ];\n            }),\n          );\n\n          const items: AggregatedIntakeItem[] = [];\n          const nextCursors: Record<string, string> = {};\n          for (const { integrationId, value } of pages) {\n            items.push(\n              ...value.items.map(item => {\n                const { source, ...candidate } = item;\n                return { ...candidate, integrationId, externalSource: { integrationId, ...source } };\n              }),\n            );\n            if (value.nextCursor) nextCursors[integrationId] = value.nextCursor;\n          }\n          // Keep the cursor an unavailable integration came in with, so the next page resumes there instead of replaying it.\n          for (const { integrationId } of failures) {\n            const cursor = cursors[integrationId];\n            if (cursor) nextCursors[integrationId] = cursor;\n          }\n          return c.json({ items, nextCursor: encodeCursor(nextCursors), failures });\n        },\n      }),\n    ];\n  }\n}\n"],"mappings":";;;;;;;AA4CA,MAAM,mBAAmB;;;;;;AAMzB,MAAM,wBAAwB;;;;;AAM9B,SAAS,qBAAqB,eAAuB,MAA4B;CAC/E,MAAM,aAAa,KAAK,UAAU;CAClC,OAAO,OAAO,eAAe,YAAY,WAAW,SAAS,IACzD,CAAC,KAAK,OAAO,YAAY,GAAG,cAAc,GAAG,YAAY,IACzD,CAAC,KAAK,OAAO,UAAU;AAC7B;;;;;;;AAQA,eAAe,oBAAoB,EACjC,WACA,aACA,eACA,OACA,QACA,kBACA,UACA,eAU8C;CAC9C,IAAI,CAAC,cAAc,IAAI,WAAW,GAAG,OAAO;EAAE,OAAO;EAAG,SAAS;CAAE;CAEnE,MAAM,6BAAa,IAAI,IAAY;CACnC,IAAI;CACJ,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,KAAK,IAAI,OAAO,GAAG,OAAO,kBAAkB,QAAQ,GAAG;EACrD,MAAM,SAAS,MAAM,YACnB,YAAY,UACN,YAAY,OAAO,UAAU;GAAE;GAAO;GAAQ,WAAW,CAAC,QAAQ;GAAG;EAAO,CAAC,GACnF,WAAW,KAAK,IAAI,CACtB;EACA,KAAK,MAAM,QAAQ,OAAO,OACxB,KAAK,MAAM,OAAO,qBAAqB,YAAY,IAAI,IAAI,GAAG,WAAW,IAAI,GAAG;EAElF,IAAI,CAAC,OAAO,YAAY;EACxB,SAAS,OAAO;CAClB;CACA,IAAI,WAAW,SAAS,GAAG,OAAO;EAAE,OAAO;EAAG,SAAS;CAAE;CAEzD,IAAI,QAAQ;CACZ,IAAI,UAAU;CACd,MAAM,QAAQ,MAAM,UAAU,KAAK;EAAE;EAAO;CAAiB,CAAC;CAC9D,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,SAAS,KAAK;EACpB,IAAI,CAAC,UAAU,OAAO,kBAAkB,YAAY,MAAM,CAAC,WAAW,IAAI,OAAO,UAAU,GAAG;EAC9F,MAAM,UAAU,MAAM,gBAAgB;GAAE;GAAW;GAAe;GAAQ;GAAM;EAAY,CAAC;EAC7F,IAAI,YAAY,SAAS,SAAS;OAC7B,IAAI,YAAY,WAAW,WAAW;CAC7C;CACA,OAAO;EAAE;EAAO;CAAQ;AAC1B;;;;;;AAOA,eAAe,qBAAqB,EAClC,WACA,eACA,OACA,QACA,kBACA,eACA,OACA,UAU8C;CAC9C,MAAM,UAAU,qBAAqB,KAAK;CAC1C,IAAI,QAAQ;CACZ,IAAI,UAAU;CACd,KAAK,MAAM,QAAQ,MAAM,UAAU,KAAK;EAAE;EAAO;CAAiB,CAAC,GAAG;EACpE,MAAM,SAAS,KAAK;EACpB,IAAI,CAAC,UAAU,OAAO,kBAAkB,iBAAiB,OAAO,SAAS,SAAS;EAClF,MAAM,SAAS,WAAW,IAAI;EAC9B,IAAI,CAAC,OAAO,MAAK,cAAa,qBAAqB,SAAS,MAAM,OAAO,GAAG;EAE5E,MAAM,UAAU,MAAM,gBAAgB;GAAE;GAAW;GAAe;GAAQ;GAAM,aAD5D,wBAAwB,QAAQ,MAAM,CAAC,EAAE,SAAS;EACsB,CAAC;EAC7F,IAAI,YAAY,SAAS,SAAS;OAC7B,IAAI,YAAY,WAAW,WAAW;CAC7C;CACA,OAAO;EAAE;EAAO;CAAQ;AAC1B;AAUA,MAAM,2BAA2B;;AAGjC,SAAS,YACP,eACA,MACA,YAAoB,0BACR;CACZ,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,SAAS,KAAK,IAAI,GAAG,SAAS;EACpC,MAAM,QAAQ,iBACN,uBAAO,IAAI,MAAM,GAAG,cAAc,yBAAyB,KAAK,MAAM,SAAS,GAAI,EAAE,EAAE,CAAC,GAC9F,MACF;EACA,KAAK,CAAC,CACH,KAAK,SAAS,MAAM,CAAC,CACrB,cAAc,aAAa,KAAK,CAAC;CACtC,CAAC;AACH;;;;;AAMA,eAAe,oBACb,UACsG;CACtG,MAAM,UAAU,MAAM,QAAQ,IAC5B,SAAS,IAAI,OAAO,EAAE,eAAe,WAA2C;EAC9E,IAAI;GACF,OAAO;IAAE;IAAe,OAAO,MAAM,YAAY,eAAe,IAAI;GAAE;EACxE,SAAS,OAAO;GACd,QAAQ,MAAM,gCAAgC,cAAc,mBAAmB,KAAK;GACpF,OAAO;IAAE;IAAe,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAAE;EAC1F;CACF,CAAC,CACH;CACA,MAAM,QAAoD,CAAC;CAC3D,MAAM,WAAuC,CAAC;CAC9C,KAAK,MAAM,SAAS,SAClB,IAAI,WAAW,OAAO,MAAM,KAAK,KAAK;MACjC,SAAS,KAAK,KAAK;CAE1B,OAAO;EAAE;EAAO;CAAS;AAC3B;;AAWA,SAAgB,mBAAmB,MAAqC;CACtE,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,GAAG,OAAO;CAC7E,MAAM,EAAE,eAAe,UAAU,kBAAkB,UAAU;CAC7D,MAAM,QAAQ,UAAmB,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,UAAU;CAClG,IAAI,CAAC,KAAK,aAAa,KAAK,CAAC,KAAK,QAAQ,GAAG,OAAO;CACpD,IAAI,qBAAqB,QAAQ,CAAC,KAAK,gBAAgB,GAAG,OAAO;CACjE,IAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,CAAC,KAAK,KAAK,GAAG,OAAO;CAClE,OAAO;EACU;EACL;EACQ;EAClB,OAAQ,SAAuC;CACjD;AACF;AAEA,MAAM,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AAC5C,MAAM,uBAAuB,EAAE,OAAO;CACpC,kBAAkB;CAClB,eAAe;CACf,OAAO,EACJ,OAAO,CAAC,CACR,IAAI,GAAG,CAAC,CACR,UAAU,oBAAoB,CAAC,CAC/B,QAAO,UAAS,MAAM,SAAS,GAAG,yBAAyB;;CAE9D,OAAO,WAAW,QAAQ,CAAC,CAAC,WAAU,UAAS,SAAS,IAAI;AAC9D,CAAC;;AAID,SAAgB,sBAAsB,MAAwC;CAC5E,MAAM,SAAS,qBAAqB,UAAU,IAAI;CAClD,OAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEA,SAAS,MAAM,GAAqB;CAClC,OAAO;AACT;AAEA,SAAS,eAAe,OAA6C;CACnE,IAAI,UAAU,MAAM,OAAO;CAC3B,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,KAAK,OAAO,KAAA;CACxD,MAAM,MAAM,MAAM,QAAQ,SAAyB,OAAO,SAAS,YAAY,KAAK,SAAS,KAAK,KAAK,UAAU,GAAG;CACpH,OAAO,IAAI,WAAW,MAAM,UAAU,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS,IAAI,SAAS,MAAM,KAAA;AACjF;;AAGA,SAAgB,kBAAkB,MAAoC;CACpE,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,GAAG,OAAO;CAC7E,MAAM,UAAU,OAAO,QAAQ,IAAI;CACnC,IAAI,QAAQ,SAAS,IAAI,OAAO;CAIhC,MAAM,SAAuB,OAAO,OAAO,IAAI;CAC/C,KAAK,MAAM,CAAC,eAAe,UAAU,SAAS;EAC5C,IACE,CAAC,iBACD,cAAc,SAAS,OACvB,OAAO,UAAU,YACjB,UAAU,QACV,MAAM,QAAQ,KAAK,GAEnB,OAAO;EAET,MAAM,YAAY;EAClB,IAAI,OAAO,UAAU,YAAY,WAAW,OAAO;EACnD,MAAM,YAAY,eAAe,UAAU,aAAa,IAAI;EAC5D,IAAI,cAAc,KAAA,GAAW,OAAO;EACpC,OAAO,iBAAiB;GAAE,SAAS,UAAU;GAAS;EAAU;CAClE;CACA,OAAO;AACT;AAEA,SAAS,aAAa,SAAgD;CACpE,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAAI,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,WAAW,IAAI;AACxG;AAEA,SAAS,aAAa,OAA0D;CAC9E,IAAI,CAAC,OAAO,OAAO,CAAC;CACpB,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,OAAO,KAAK,OAAO,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;EAC1E,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG,OAAO;EACnF,MAAM,UAAU,OAAO,QAAQ,MAAM;EACrC,IAAI,QAAQ,MAAM,CAAC,KAAK,YAAY,CAAC,OAAO,OAAO,WAAW,QAAQ,GAAG,OAAO;EAChF,OAAO,OAAO,YAAY,OAAO;CACnC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,IAAa,eAAb,cAAkC,MAAwB;CACxD,MAAMA,eAAe,GAAiF;EACpG,MAAM,KAAK,KAAK,KAAK,WAAW,CAAC;EACjC,MAAM,SAAS,KAAK,KAAK,KAAK,OAAO,CAAC;EACtC,IAAI,CAAC,QAAQ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;EACvE,IAAI,CAAC,OAAO,OACV,OAAO,EACL,UAAU,EAAE,KACV;GAAE,OAAO;GAAyB,SAAS;EAAiD,GAC5F,GACF,EACF;EAEF,OAAO;GAAE,OAAO,OAAO;GAAO,QAAQ,OAAO;EAAO;CACtD;CAEA,SAAqB;EACnB,MAAM,EAAE,OAAO,QAAQ,UAAU,eAAe,CAAC,GAAG,eAAe,cAAc,KAAK;EACtF,MAAM,iBAAiB,aAAa,KAAI,gBAAe,YAAY,EAAE;EAErE,OAAO;GACL,iBAAiB,sBAAsB;IACrC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,OAAO,YAAY;KACzB,MAAM,SAAS,MAAM,OAAO,UAAU;MAAE,GAAG;MAAQ;KAAe,CAAC;KACnE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC;IAC1B;GACF,CAAC;GACD,iBAAiB,sBAAsB;IACrC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KAExC,IAAI;KACJ,IAAI;MACF,OAAO,MAAM,EAAE,IAAI,KAAK;KAC1B,QAAQ;MACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACnD;KACA,MAAM,SAAS,kBAAkB,IAAI;KACrC,IAAI,CAAC,QACH,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;KAGhD,MAAM,mBAAiC,OAAO,OAAO,IAAI;KACzD,KAAK,MAAM,CAAC,eAAe,cAAc,OAAO,QAAQ,MAAM,GAAG;MAC/D,IAAI,eAAe,SAAS,aAAa,GAAG;OAC1C,iBAAiB,iBAAiB;OAClC;MACF;MACA,IAAI,UAAU,WAAW,UAAU,WAAW,QAC5C,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;KAElD;KAEA,MAAM,OAAO,YAAY;KACzB,MAAM,OAAO,WAAW;MAAE,GAAG;MAAQ,QAAQ;KAAiB,CAAC;KAC/D,MAAM,MAAM,KAAK;MACf,SAAS,MAAM,CAAC;MAChB,OAAO;OACL,QAAQ;OACR,SAAS,CAAC;QAAE,MAAM;QAAiB,IAAI,OAAO;OAAM,CAAC;OACrD,UAAU,OAAO,YACf,OAAO,QAAQ,gBAAgB,CAAC,CAAC,KAAK,CAAC,eAAe,eAAe,CACnE,eACA;QAAE,SAAS,UAAU;QAAS,SAAS,UAAU,WAAW,UAAU;OAAK,CAC7E,CAAC,CACH;MACF;KACF,CAAC;KACD,OAAO,EAAE,KAAK,EAAE,QAAQ,iBAAiB,CAAC;IAC5C;GACF,CAAC;GACD,iBAAiB,wBAAwB;IACvC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,OAAO,YAAY;KACzB,OAAO,EAAE,KAAK,EAAE,UAAU,MAAM,OAAO,aAAa,EAAE,OAAO,OAAO,MAAM,CAAC,EAAE,CAAC;IAChF;GACF,CAAC;GACD,iBAAiB,wBAAwB;IACvC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KAExC,IAAI;KACJ,IAAI;MACF,OAAO,MAAM,EAAE,IAAI,KAAK;KAC1B,QAAQ;MACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACnD;KACA,MAAM,UAAU,mBAAmB,IAAI;KACvC,IAAI,CAAC,WAAW,CAAC,eAAe,SAAS,QAAQ,aAAa,GAC5D,OAAO,EAAE,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;KAEjD,IAAI,QAAQ,oBAAoB,UAE1B;UAAA,CAAC,MADiB,SAAS,IAAI;OAAE,OAAO,OAAO;OAAO,IAAI,QAAQ;MAAiB,CAAC,GAC1E,OAAO,EAAE,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;KAAA;KAEzE,IAAI,QAAQ,UAAU,QAAQ,CAAC,eAAe,IAAI,QAAQ,KAAK,GAC7D,OAAO,EAAE,KAAK;MAAE,OAAO;MAAiB,SAAS,UAAU,QAAQ,MAAM;KAAqB,GAAG,GAAG;KAGtG,MAAM,OAAO,YAAY;KACzB,IAAI,wBAAwB,QAAQ;KACpC,IAAI,YAAuD;KAC3D,IAAI,QAAQ,qBAAqB,MAM/B,yBAAwB,MALM,OAAO,aAAa;MAChD,OAAO,OAAO;MACd,eAAe,QAAQ;MACvB,UAAU,QAAQ;KACpB,CAAC,EAAA,EACwC,oBAAoB;UACxD;MACL,MAAM,kBAAkB,MAAM,OAAO,WAAW;OAC9C,OAAO,OAAO;OACd,eAAe,QAAQ;OACvB,UAAU,QAAQ;MACpB,CAAC;MACD,MAAM,OAAO,WAAW;OACtB,OAAO,OAAO;OACd,QAAQ,OAAO;OACf,eAAe,QAAQ;OACvB,UAAU,QAAQ;OAClB,kBAAkB,QAAQ;OAC1B,OAAO,QAAQ;MACjB,CAAC;MAKD,MAAM,YAAY,QAAQ;MAC1B,MAAM,cAAc,aAAa,MAAK,cAAa,UAAU,OAAO,QAAQ,aAAa;MACzF,IACE,aACA,iBACA,eACA,iBAAiB,qBAAqB,QAAQ,oBAC9C,cAAc,QACd,gBAAgB,UAAU,WAE1B,IAAI;OACF,YAAY,MAAM,oBAAoB;QACpC;QACA;QACA;QACA,OAAO,OAAO;QACd,QAAQ,OAAO;QACf,kBAAkB,QAAQ;QAC1B,UAAU,QAAQ;QAClB,aAAa;OACf,CAAC;MACH,SAAS,OAAO;OAEd,QAAQ,MAAM,8CAA8C,QAAQ,cAAc,UAAU,KAAK;MACnG;KAEJ;KACA,MAAM,MAAM,KAAK;MACf,SAAS,MAAM,CAAC;MAChB,OAAO;OACL,QAAQ;OACR,GAAI,wBAAwB,EAAE,kBAAkB,sBAAsB,IAAI,CAAC;OAC3E,SAAS,CAAC;QAAE,MAAM;QAAiB,IAAI,GAAG,QAAQ,cAAc,GAAG,QAAQ;OAAW,CAAC;OACvF,UAAU;QACR,kBAAkB,QAAQ;QAC1B,OAAO,QAAQ;QACf,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;OACnC;MACF;KACF,CAAC;KACD,OAAO,EAAE,KAAK;MACZ,UAAU,MAAM,OAAO,aAAa,EAAE,OAAO,OAAO,MAAM,CAAC;MAC3D,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;KACnC,CAAC;IACH;GACF,CAAC;GACD,iBAAiB,4BAA4B;IAC3C,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,mBAAmB,EAAE,IAAI,MAAM,kBAAkB;KACvD,MAAM,OAAO,YAAY;KACzB,OAAO,EAAE,KAAK,EACZ,QAAQ,MAAM,OAAO,gBAAgB;MACnC,OAAO,OAAO;MACd,GAAI,mBAAmB,EAAE,iBAAiB,IAAI,CAAC;KACjD,CAAC,EACH,CAAC;IACH;GACF,CAAC;GACD,iBAAiB,4BAA4B;IAC3C,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KAExC,IAAI;KACJ,IAAI;MACF,OAAO,MAAM,EAAE,IAAI,KAAK;KAC1B,QAAQ;MACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACnD;KACA,MAAM,QAAQ,sBAAsB,IAAI;KACxC,IAAI,CAAC,SAAS,CAAC,eAAe,SAAS,MAAM,aAAa,GACxD,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAErD,IAAI,UAEE;UAAA,CAAC,MADiB,SAAS,IAAI;OAAE,OAAO,OAAO;OAAO,IAAI,MAAM;MAAiB,CAAC,GACxE,OAAO,EAAE,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;KAAA;KAEzE,IAAI,MAAM,UAAU,QAAQ,CAAC,eAAe,IAAI,MAAM,KAAK,GACzD,OAAO,EAAE,KAAK;MAAE,OAAO;MAAiB,SAAS,UAAU,MAAM,MAAM;KAAqB,GAAG,GAAG;KAGpG,MAAM,OAAO,YAAY;KACzB,MAAM,QAAQ;MACZ,OAAO,OAAO;MACd,kBAAkB,MAAM;MACxB,eAAe,MAAM;KACvB;KACA,MAAM,YAAY,MAAM,OAAO,gBAAgB,KAAK,EAAA,CAAG,MAAK,aAAY,SAAS,UAAU,MAAM,KAAK;KACtG,IAAI,MAAM,UAAU,MAClB,MAAM,OAAO,gBAAgB;MAAE,GAAG;MAAO,OAAO,MAAM;KAAM,CAAC;UAE7D,MAAM,OAAO,cAAc;MAAE,GAAG;MAAO,OAAO,MAAM;MAAO,OAAO,MAAM;MAAO,QAAQ,OAAO;KAAO,CAAC;KAKxG,IAAI,YAAuD;KAC3D,IAAI,aAAa,kBAAkB,UAAU,SAAS,UAAU,MAAM,OACpE,IAAI;MACF,YAAY,MAAM,qBAAqB;OACrC;OACA;OACA,OAAO,OAAO;OACd,QAAQ,OAAO;OACf,kBAAkB,MAAM;OACxB,eAAe,MAAM;OACrB,OAAO,MAAM;OACb,QAAQ,MAAM,OAAO,gBAAgB,KAAK;MAC5C,CAAC;KACH,SAAS,OAAO;MAEd,QAAQ,MAAM,mDAAmD,MAAM,cAAc,UAAU,KAAK;KACtG;KAEF,MAAM,MAAM,KAAK;MACf,SAAS,MAAM,CAAC;MAChB,OAAO;OACL,QAAQ;OACR,kBAAkB,MAAM;OACxB,SAAS,CAAC;QAAE,MAAM;QAAsB,IAAI,GAAG,MAAM,cAAc,GAAG,MAAM;OAAQ,CAAC;OACrF,UAAU;QAAE,OAAO,MAAM;QAAO,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;OAAG;MACtE;KACF,CAAC;KACD,OAAO,EAAE,KAAK;MACZ,QAAQ,MAAM,OAAO,gBAAgB;OAAE,OAAO,OAAO;OAAO,kBAAkB,MAAM;MAAiB,CAAC;MACtG,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;KACnC,CAAC;IACH;GACF,CAAC;GACD,iBAAiB,uBAAuB;IACtC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,EAAE,OAAO,aAAa,MAAM,oBAChC,aAAa,KAAI,iBAAgB;MAC/B,eAAe,YAAY;MAC3B,YAAY,YAAY,OAAO,YAAY,MAAM;KACnD,EAAE,CACJ;KACA,OAAO,EAAE,KAAK;MACZ,SAAS,MAAM,SAAS,EAAE,eAAe,YAAY,MAAM,KAAI,YAAW;OAAE;OAAe,GAAG;MAAO,EAAE,CAAC;MACxG;KACF,CAAC;IACH;GACF,CAAC;GACD,iBAAiB,qBAAqB;IACpC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,UAAU,aAAa,EAAE,IAAI,MAAM,QAAQ,CAAC;KAClD,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;KAE5D,MAAM,OAAO,YAAY;KACzB,MAAM,SAAS,MAAM,OAAO,UAAU;MAAE,GAAG;MAAQ;KAAe,CAAC;KACnE,MAAM,EAAE,OAAO,aAAa,MAAM,oBAChC,aAAa,SAAQ,gBAAe;MAClC,MAAM,YAAY,OAAO,YAAY;MACrC,IAAI,CAAC,WAAW,WAAW,CAAC,UAAU,WAAW,QAAQ,OAAO,CAAC;MACjE,MAAM,YAAY,UAAU;MAC5B,MAAM,SAAS,QAAQ,YAAY;MACnC,OAAO,CACL;OACE,eAAe,YAAY;OAC3B,YAAY,YAAY,OAAO,UAAU;QAAE,GAAG;QAAQ;QAAW,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;OAAG,CAAC;MAClG,CACF;KACF,CAAC,CACH;KAEA,MAAM,QAAgC,CAAC;KACvC,MAAM,cAAsC,CAAC;KAC7C,KAAK,MAAM,EAAE,eAAe,WAAW,OAAO;MAC5C,MAAM,KACJ,GAAG,MAAM,MAAM,KAAI,SAAQ;OACzB,MAAM,EAAE,QAAQ,GAAG,cAAc;OACjC,OAAO;QAAE,GAAG;QAAW;QAAe,gBAAgB;SAAE;SAAe,GAAG;QAAO;OAAE;MACrF,CAAC,CACH;MACA,IAAI,MAAM,YAAY,YAAY,iBAAiB,MAAM;KAC3D;KAEA,KAAK,MAAM,EAAE,mBAAmB,UAAU;MACxC,MAAM,SAAS,QAAQ;MACvB,IAAI,QAAQ,YAAY,iBAAiB;KAC3C;KACA,OAAO,EAAE,KAAK;MAAE;MAAO,YAAY,aAAa,WAAW;MAAG;KAAS,CAAC;IAC1E;GACF,CAAC;EACH;CACF;AACF"}
+{"version":3,"file":"intake.js","names":["#resolveTenant"],"sources":["../../src/routes/intake.ts"],"sourcesContent":["import type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\nimport { z } from 'zod';\n\nimport type { BoardRegistry } from '../boards/index.js';\nimport { cardLabels, moveCardToBoard } from '../boards/relocate.js';\nimport type { Intake, IntakeItem } from '../capabilities/intake.js';\nimport type { AuditEmitter } from '../storage/domains/audit/domain.js';\nimport { normalizeIntakeLabel, resolveIntakeLabelRoute } from '../storage/domains/intake/base.js';\nimport type { IntakeConfig, IntakeLabelRoute, IntakeStorage } from '../storage/domains/intake/base.js';\nimport type { WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport type { RouteDependencies } from './route.js';\nimport { Route } from './route.js';\n\nexport interface IntakeIntegration {\n  id: string;\n  intake: Pick<Intake, 'listSources' | 'listItems'>;\n}\n\ninterface AggregatedIntakeItem extends Omit<IntakeItem, 'source'> {\n  integrationId: string;\n  externalSource: {\n    integrationId: string;\n    type: string;\n    externalId: string;\n    url?: string;\n  };\n}\n\nexport interface IntakeRoutesDeps extends RouteDependencies {\n  audit: AuditEmitter;\n  /** Intake selection domain handle. */\n  intake: IntakeStorage;\n  /** Factory project domain handle, used to validate binding targets. */\n  projects?: { get(input: { orgId: string; id: string }): Promise<unknown | null> };\n  integrations?: IntakeIntegration[];\n  /** Installed boards, used to validate binding targets. Absent means only legacy routing is accepted. */\n  boardRegistry?: BoardRegistry;\n  /** Work items domain handle; when present, rebinding a source to another board moves its resting cards. */\n  workItems?: Pick<WorkItemsStorage, 'list' | 'update' | 'supersedeDecisionsForWorkItem'>;\n}\n\n/** Upper bound on source pages read while relocating cards, so a huge source cannot stall the request. */\nconst REBIND_MAX_PAGES = 20;\n/**\n * One deadline for the whole rebind read, not one per page: the binding is already saved when we\n * get here, so the caller is only waiting on relocation and a slow provider must not hold the\n * response for pages × timeout.\n */\nconst REBIND_READ_BUDGET_MS = 30_000;\n\n/**\n * Keys under which an intake item may be persisted as a work item. Providers key items by their\n * own id, while materialization uses the human identifier (`linear:MAS-44`), so both are accepted.\n */\nfunction intakeItemSourceKeys(integrationId: string, item: IntakeItem): string[] {\n  const identifier = item.metadata?.identifier;\n  return typeof identifier === 'string' && identifier.length > 0\n    ? [item.source.externalId, `${integrationId}:${identifier}`]\n    : [item.source.externalId];\n}\n\n/**\n * Move the cards that came from a rebound source onto its new board's initial phase. Terminal cards\n * stay put (they are history that belongs where it finished), as do cards with a session attached to\n * a current stage (a run owns them). Everything else moves, including cards parked in a working\n * phase that never started a run — auto-ingested issues sit in Work › Triage that way.\n */\nasync function relocateSourceCards({\n  workItems,\n  integration,\n  boardRegistry,\n  orgId,\n  userId,\n  factoryProjectId,\n  sourceId,\n  targetBoard,\n}: {\n  workItems: Pick<WorkItemsStorage, 'list' | 'update' | 'supersedeDecisionsForWorkItem'>;\n  integration: IntakeIntegration;\n  boardRegistry: BoardRegistry;\n  orgId: string;\n  userId: string;\n  factoryProjectId: string;\n  sourceId: string;\n  targetBoard: string;\n}): Promise<{ moved: number; skipped: number }> {\n  if (!boardRegistry.has(targetBoard)) return { moved: 0, skipped: 0 };\n\n  const sourceKeys = new Set<string>();\n  let cursor: string | undefined;\n  const deadline = Date.now() + REBIND_READ_BUDGET_MS;\n  for (let page = 0; page < REBIND_MAX_PAGES; page += 1) {\n    const result = await withTimeout(\n      integration.id,\n      () => integration.intake.listItems({ orgId, userId, sourceIds: [sourceId], cursor }),\n      deadline - Date.now(),\n    );\n    for (const item of result.items) {\n      for (const key of intakeItemSourceKeys(integration.id, item)) sourceKeys.add(key);\n    }\n    if (!result.nextCursor) break;\n    cursor = result.nextCursor;\n  }\n  if (sourceKeys.size === 0) return { moved: 0, skipped: 0 };\n\n  let moved = 0;\n  let skipped = 0;\n  const items = await workItems.list({ orgId, factoryProjectId });\n  for (const item of items) {\n    const source = item.externalSource;\n    if (!source || source.integrationId !== integration.id || !sourceKeys.has(source.externalId)) continue;\n    const outcome = await moveCardToBoard({ workItems, boardRegistry, userId, item, targetBoard });\n    if (outcome === 'moved') moved += 1;\n    else if (outcome === 'skipped') skipped += 1;\n  }\n  return { moved, skipped };\n}\n\n/**\n * After a label route changes, every issue card in the project that carries `label` is re-routed\n * under the project's current routes: to the board its labels now select, or back to Work when none\n * of them is routed any more.\n */\nasync function relocateLabeledCards({\n  workItems,\n  boardRegistry,\n  orgId,\n  userId,\n  factoryProjectId,\n  integrationId,\n  label,\n  routes,\n}: {\n  workItems: Pick<WorkItemsStorage, 'list' | 'update' | 'supersedeDecisionsForWorkItem'>;\n  boardRegistry: BoardRegistry;\n  orgId: string;\n  userId: string;\n  factoryProjectId: string;\n  integrationId: string;\n  label: string;\n  routes: readonly IntakeLabelRoute[];\n}): Promise<{ moved: number; skipped: number }> {\n  const changed = normalizeIntakeLabel(label);\n  let moved = 0;\n  let skipped = 0;\n  for (const item of await workItems.list({ orgId, factoryProjectId })) {\n    const source = item.externalSource;\n    if (!source || source.integrationId !== integrationId || source.type !== 'issue') continue;\n    const labels = cardLabels(item);\n    if (!labels.some(candidate => normalizeIntakeLabel(candidate) === changed)) continue;\n    const targetBoard = resolveIntakeLabelRoute(routes, labels)?.board ?? 'work';\n    const outcome = await moveCardToBoard({ workItems, boardRegistry, userId, item, targetBoard });\n    if (outcome === 'moved') moved += 1;\n    else if (outcome === 'skipped') skipped += 1;\n  }\n  return { moved, skipped };\n}\n\n/** One integration that failed while the rest of the aggregation succeeded. */\nexport interface IntakeIntegrationFailure {\n  integrationId: string;\n  message: string;\n}\n\ntype SettledIntegration<T> = { integrationId: string; value: T } | IntakeIntegrationFailure;\n\nconst PROVIDER_READ_TIMEOUT_MS = 15_000;\n\n/** The Intake contract takes no abort signal, so a slow read is abandoned, not cancelled. */\nfunction withTimeout<T>(\n  integrationId: string,\n  read: () => Promise<T>,\n  timeoutMs: number = PROVIDER_READ_TIMEOUT_MS,\n): Promise<T> {\n  return new Promise((resolve, reject) => {\n    const budget = Math.max(0, timeoutMs);\n    const timer = setTimeout(\n      () => reject(new Error(`${integrationId} did not answer within ${Math.round(budget / 1000)}s`)),\n      budget,\n    );\n    read()\n      .then(resolve, reject)\n      .finally(() => clearTimeout(timer));\n  });\n}\n\n/**\n * Read every integration concurrently and isolate the ones that throw or hang, so a single\n * unreachable provider degrades to a per-source error instead of failing the listing.\n */\nasync function settleByIntegration<T>(\n  requests: Array<{ integrationId: string; read: () => Promise<T> }>,\n): Promise<{ pages: Array<{ integrationId: string; value: T }>; failures: IntakeIntegrationFailure[] }> {\n  const settled = await Promise.all(\n    requests.map(async ({ integrationId, read }): Promise<SettledIntegration<T>> => {\n      try {\n        return { integrationId, value: await withTimeout(integrationId, read) };\n      } catch (error) {\n        console.error(`[factory] intake integration ${integrationId} is unavailable:`, error);\n        return { integrationId, message: error instanceof Error ? error.message : String(error) };\n      }\n    }),\n  );\n  const pages: Array<{ integrationId: string; value: T }> = [];\n  const failures: IntakeIntegrationFailure[] = [];\n  for (const entry of settled) {\n    if ('value' in entry) pages.push(entry);\n    else failures.push(entry);\n  }\n  return { pages, failures };\n}\n\ninterface ParsedBinding {\n  integrationId: string;\n  sourceId: string;\n  factoryProjectId: string | null;\n  /** Installed board target; `null`/omitted keeps legacy source-type routing. */\n  board: string | null;\n}\n\n/** Validate a binding request body, rejecting unknown shapes. */\nexport function parseIntakeBinding(body: unknown): ParsedBinding | null {\n  if (typeof body !== 'object' || body === null || Array.isArray(body)) return null;\n  const { integrationId, sourceId, factoryProjectId, board } = body as Record<string, unknown>;\n  const isId = (value: unknown) => typeof value === 'string' && value.length > 0 && value.length <= 256;\n  if (!isId(integrationId) || !isId(sourceId)) return null;\n  if (factoryProjectId !== null && !isId(factoryProjectId)) return null;\n  if (board !== undefined && board !== null && !isId(board)) return null;\n  return {\n    integrationId: integrationId as string,\n    sourceId: sourceId as string,\n    factoryProjectId: factoryProjectId as string | null,\n    board: (board as string | null | undefined) ?? null,\n  };\n}\n\nconst identifier = z.string().min(1).max(256);\nconst labelRouteBodySchema = z.object({\n  factoryProjectId: identifier,\n  integrationId: identifier,\n  label: z\n    .string()\n    .max(256)\n    .transform(normalizeIntakeLabel)\n    .refine(label => label.length > 0, 'label must not be blank'),\n  /** Installed board target; `null` removes the route so the label falls back to Work. */\n  board: identifier.nullish().transform(board => board ?? null),\n});\ntype ParsedLabelRoute = z.output<typeof labelRouteBodySchema>;\n\n/** Validate a label-route request body, rejecting unknown shapes. */\nexport function parseIntakeLabelRoute(body: unknown): ParsedLabelRoute | null {\n  const parsed = labelRouteBodySchema.safeParse(body);\n  return parsed.success ? parsed.data : null;\n}\n\nfunction loose(c: unknown): Context {\n  return c as Context;\n}\n\nfunction sanitizeIdList(value: unknown): string[] | null | undefined {\n  if (value === null) return null;\n  if (!Array.isArray(value) || value.length > 200) return undefined;\n  const ids = value.filter((item): item is string => typeof item === 'string' && item.length > 0 && item.length <= 256);\n  return ids.length === value.length && new Set(ids).size === ids.length ? ids : undefined;\n}\n\n/** Validate a request body into an intake config, rejecting unknown shapes. */\nexport function parseIntakeConfig(body: unknown): IntakeConfig | null {\n  if (typeof body !== 'object' || body === null || Array.isArray(body)) return null;\n  const entries = Object.entries(body);\n  if (entries.length > 50) return null;\n\n  // Null-prototype so an `__proto__` key lands as a real entry instead of silently\n  // reassigning the prototype and disappearing from the validation below.\n  const config: IntakeConfig = Object.create(null);\n  for (const [integrationId, value] of entries) {\n    if (\n      !integrationId ||\n      integrationId.length > 128 ||\n      typeof value !== 'object' ||\n      value === null ||\n      Array.isArray(value)\n    ) {\n      return null;\n    }\n    const selection = value as { enabled?: unknown; sourceIds?: unknown };\n    if (typeof selection.enabled !== 'boolean') return null;\n    const sourceIds = sanitizeIdList(selection.sourceIds ?? null);\n    if (sourceIds === undefined) return null;\n    config[integrationId] = { enabled: selection.enabled, sourceIds };\n  }\n  return config;\n}\n\nfunction encodeCursor(cursors: Record<string, string>): string | null {\n  return Object.keys(cursors).length > 0 ? Buffer.from(JSON.stringify(cursors)).toString('base64url') : null;\n}\n\nfunction decodeCursor(value: string | undefined): Record<string, string> | null {\n  if (!value) return {};\n  try {\n    const parsed = JSON.parse(Buffer.from(value, 'base64url').toString('utf8')) as unknown;\n    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) return null;\n    const entries = Object.entries(parsed);\n    if (entries.some(([key, cursor]) => !key || typeof cursor !== 'string')) return null;\n    return Object.fromEntries(entries) as Record<string, string>;\n  } catch {\n    return null;\n  }\n}\n\nexport class IntakeRoutes extends Route<IntakeRoutesDeps> {\n  async #resolveTenant(c: Context): Promise<{ orgId: string; userId: string } | { response: Response }> {\n    await this.deps.auth.ensureUser(c);\n    const tenant = this.deps.auth.tenant(c);\n    if (!tenant) return { response: c.json({ error: 'unauthorized' }, 401) };\n    if (!tenant.orgId) {\n      return {\n        response: c.json(\n          { error: 'organization_required', message: 'Intake configuration requires an organization.' },\n          403,\n        ),\n      };\n    }\n    return { orgId: tenant.orgId, userId: tenant.userId };\n  }\n\n  routes(): ApiRoute[] {\n    const { audit, intake, projects, integrations = [], boardRegistry, workItems } = this.deps;\n    const integrationIds = integrations.map(integration => integration.id);\n\n    return [\n      registerApiRoute('/web/intake/config', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          await intake.ensureReady();\n          const config = await intake.getConfig({ orgId: tenant.orgId, integrationIds });\n          return c.json({ config });\n        },\n      }),\n      registerApiRoute('/web/intake/config', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n\n          let body: unknown;\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const config = parseIntakeConfig(body);\n          if (!config) {\n            return c.json({ error: 'invalid_config' }, 400);\n          }\n\n          const registeredConfig: IntakeConfig = Object.create(null);\n          for (const [integrationId, selection] of Object.entries(config)) {\n            if (integrationIds.includes(integrationId)) {\n              registeredConfig[integrationId] = selection;\n              continue;\n            }\n            if (selection.enabled || selection.sourceIds?.length) {\n              return c.json({ error: 'invalid_config' }, 400);\n            }\n          }\n\n          await intake.ensureReady();\n          await intake.saveConfig({ orgId: tenant.orgId, config: registeredConfig });\n          await audit.emit({\n            context: loose(c),\n            input: {\n              action: 'factory.intake.config_updated',\n              targets: [{ type: 'intake_config', id: tenant.orgId }],\n              metadata: Object.fromEntries(\n                Object.entries(registeredConfig).map(([integrationId, selection]) => [\n                  integrationId,\n                  { enabled: selection.enabled, sources: selection.sourceIds?.length ?? null },\n                ]),\n              ),\n            },\n          });\n          return c.json({ config: registeredConfig });\n        },\n      }),\n      registerApiRoute('/web/intake/bindings', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          await intake.ensureReady();\n          return c.json({ bindings: await intake.listBindings({ orgId: tenant.orgId }) });\n        },\n      }),\n      registerApiRoute('/web/intake/bindings', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n\n          let body: unknown;\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const binding = parseIntakeBinding(body);\n          if (!binding || !integrationIds.includes(binding.integrationId)) {\n            return c.json({ error: 'invalid_binding' }, 400);\n          }\n          if (binding.factoryProjectId && projects) {\n            const project = await projects.get({ orgId: tenant.orgId, id: binding.factoryProjectId });\n            if (!project) return c.json({ error: 'factory_project_not_found' }, 404);\n          }\n          if (binding.board !== null && !boardRegistry?.has(binding.board)) {\n            return c.json({ error: 'invalid_board', message: `Board '${binding.board}' is not installed.` }, 422);\n          }\n\n          await intake.ensureReady();\n          let auditFactoryProjectId = binding.factoryProjectId;\n          let relocated: { moved: number; skipped: number } | null = null;\n          if (binding.factoryProjectId === null) {\n            const previousBinding = await intake.clearBinding({\n              orgId: tenant.orgId,\n              integrationId: binding.integrationId,\n              sourceId: binding.sourceId,\n            });\n            auditFactoryProjectId = previousBinding?.factoryProjectId ?? null;\n          } else {\n            const previousBinding = await intake.getBinding({\n              orgId: tenant.orgId,\n              integrationId: binding.integrationId,\n              sourceId: binding.sourceId,\n            });\n            await intake.setBinding({\n              orgId: tenant.orgId,\n              userId: tenant.userId,\n              integrationId: binding.integrationId,\n              sourceId: binding.sourceId,\n              factoryProjectId: binding.factoryProjectId,\n              board: binding.board,\n            });\n            // A source that stays in the same project but is pointed at a different board\n            // takes its resting cards along. Bindings that predate persisted boards have a\n            // null board yet still fed Work/Review, so relocation compares each card's\n            // effective board rather than trusting the previous binding value.\n            const nextBoard = binding.board;\n            const integration = integrations.find(candidate => candidate.id === binding.integrationId);\n            if (\n              workItems &&\n              boardRegistry &&\n              integration &&\n              previousBinding?.factoryProjectId === binding.factoryProjectId &&\n              nextBoard !== null &&\n              previousBinding.board !== nextBoard\n            ) {\n              try {\n                relocated = await relocateSourceCards({\n                  workItems,\n                  integration,\n                  boardRegistry,\n                  orgId: tenant.orgId,\n                  userId: tenant.userId,\n                  factoryProjectId: binding.factoryProjectId,\n                  sourceId: binding.sourceId,\n                  targetBoard: nextBoard,\n                });\n              } catch (error) {\n                // The binding is saved; the cards can be moved by hand if the provider was unreachable.\n                console.error(`[factory] intake rebind could not relocate ${binding.integrationId} cards:`, error);\n              }\n            }\n          }\n          await audit.emit({\n            context: loose(c),\n            input: {\n              action: 'factory.intake.binding_updated',\n              ...(auditFactoryProjectId ? { factoryProjectId: auditFactoryProjectId } : {}),\n              targets: [{ type: 'intake_source', id: `${binding.integrationId}:${binding.sourceId}` }],\n              metadata: {\n                factoryProjectId: binding.factoryProjectId,\n                board: binding.board,\n                ...(relocated ? { relocated } : {}),\n              },\n            },\n          });\n          return c.json({\n            bindings: await intake.listBindings({ orgId: tenant.orgId }),\n            ...(relocated ? { relocated } : {}),\n          });\n        },\n      }),\n      registerApiRoute('/web/intake/label-routes', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          const factoryProjectId = c.req.query('factoryProjectId');\n          await intake.ensureReady();\n          return c.json({\n            routes: await intake.listLabelRoutes({\n              orgId: tenant.orgId,\n              ...(factoryProjectId ? { factoryProjectId } : {}),\n            }),\n          });\n        },\n      }),\n      registerApiRoute('/web/intake/label-routes', {\n        method: 'PUT',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n\n          let body: unknown;\n          try {\n            body = await c.req.json();\n          } catch {\n            return c.json({ error: 'Invalid JSON body' }, 400);\n          }\n          const route = parseIntakeLabelRoute(body);\n          if (!route || !integrationIds.includes(route.integrationId)) {\n            return c.json({ error: 'invalid_label_route' }, 400);\n          }\n          if (projects) {\n            const project = await projects.get({ orgId: tenant.orgId, id: route.factoryProjectId });\n            if (!project) return c.json({ error: 'factory_project_not_found' }, 404);\n          }\n          if (route.board !== null && !boardRegistry?.has(route.board)) {\n            return c.json({ error: 'invalid_board', message: `Board '${route.board}' is not installed.` }, 422);\n          }\n\n          await intake.ensureReady();\n          const scope = {\n            orgId: tenant.orgId,\n            factoryProjectId: route.factoryProjectId,\n            integrationId: route.integrationId,\n          };\n          const previous = (await intake.listLabelRoutes(scope)).find(existing => existing.label === route.label);\n          if (route.board === null) {\n            await intake.clearLabelRoute({ ...scope, label: route.label });\n          } else {\n            await intake.setLabelRoute({ ...scope, label: route.label, board: route.board, userId: tenant.userId });\n          }\n\n          // Cards already carrying the label follow the route: onto the new board, or back to\n          // Work when the label is no longer routed anywhere.\n          let relocated: { moved: number; skipped: number } | null = null;\n          if (workItems && boardRegistry && (previous?.board ?? null) !== route.board) {\n            try {\n              relocated = await relocateLabeledCards({\n                workItems,\n                boardRegistry,\n                orgId: tenant.orgId,\n                userId: tenant.userId,\n                factoryProjectId: route.factoryProjectId,\n                integrationId: route.integrationId,\n                label: route.label,\n                routes: await intake.listLabelRoutes(scope),\n              });\n            } catch (error) {\n              // The route is saved; the cards can be moved by hand.\n              console.error(`[factory] intake label route could not relocate ${route.integrationId} cards:`, error);\n            }\n          }\n          await audit.emit({\n            context: loose(c),\n            input: {\n              action: 'factory.intake.label_route_updated',\n              factoryProjectId: route.factoryProjectId,\n              targets: [{ type: 'intake_label_route', id: `${route.integrationId}:${route.label}` }],\n              metadata: { board: route.board, ...(relocated ? { relocated } : {}) },\n            },\n          });\n          return c.json({\n            routes: await intake.listLabelRoutes({ orgId: tenant.orgId, factoryProjectId: route.factoryProjectId }),\n            ...(relocated ? { relocated } : {}),\n          });\n        },\n      }),\n      registerApiRoute('/web/intake/sources', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          const { pages, failures } = await settleByIntegration(\n            integrations.map(integration => ({\n              integrationId: integration.id,\n              read: () => integration.intake.listSources(tenant),\n            })),\n          );\n          return c.json({\n            sources: pages.flatMap(({ integrationId, value }) => value.map(source => ({ integrationId, ...source }))),\n            failures,\n          });\n        },\n      }),\n      registerApiRoute('/web/intake/items', {\n        method: 'GET',\n        requiresAuth: false,\n        handler: async c => {\n          const tenant = await this.#resolveTenant(loose(c));\n          if ('response' in tenant) return tenant.response;\n          const cursors = decodeCursor(c.req.query('cursor'));\n          if (!cursors) return c.json({ error: 'invalid_cursor' }, 400);\n\n          await intake.ensureReady();\n          const config = await intake.getConfig({ orgId: tenant.orgId, integrationIds });\n          const { pages, failures } = await settleByIntegration(\n            integrations.flatMap(integration => {\n              const selection = config[integration.id];\n              if (!selection?.enabled || !selection.sourceIds?.length) return [];\n              const sourceIds = selection.sourceIds;\n              const cursor = cursors[integration.id];\n              return [\n                {\n                  integrationId: integration.id,\n                  read: () => integration.intake.listItems({ ...tenant, sourceIds, ...(cursor ? { cursor } : {}) }),\n                },\n              ];\n            }),\n          );\n\n          const items: AggregatedIntakeItem[] = [];\n          const nextCursors: Record<string, string> = {};\n          for (const { integrationId, value } of pages) {\n            items.push(\n              ...value.items.map(item => {\n                const { source, ...candidate } = item;\n                return { ...candidate, integrationId, externalSource: { integrationId, ...source } };\n              }),\n            );\n            if (value.nextCursor) nextCursors[integrationId] = value.nextCursor;\n          }\n          // Keep the cursor an unavailable integration came in with, so the next page resumes there instead of replaying it.\n          for (const { integrationId } of failures) {\n            const cursor = cursors[integrationId];\n            if (cursor) nextCursors[integrationId] = cursor;\n          }\n          return c.json({ items, nextCursor: encodeCursor(nextCursors), failures });\n        },\n      }),\n    ];\n  }\n}\n"],"mappings":";;;;;;;AA4CA,MAAM,mBAAmB;;;;;;AAMzB,MAAM,wBAAwB;;;;;AAM9B,SAAS,qBAAqB,eAAuB,MAA4B;CAC/E,MAAM,aAAa,KAAK,UAAU;CAClC,OAAO,OAAO,eAAe,YAAY,WAAW,SAAS,IACzD,CAAC,KAAK,OAAO,YAAY,GAAG,cAAc,GAAG,YAAY,IACzD,CAAC,KAAK,OAAO,UAAU;AAC7B;;;;;;;AAQA,eAAe,oBAAoB,EACjC,WACA,aACA,eACA,OACA,QACA,kBACA,UACA,eAU8C;CAC9C,IAAI,CAAC,cAAc,IAAI,WAAW,GAAG,OAAO;EAAE,OAAO;EAAG,SAAS;CAAE;CAEnE,MAAM,6BAAa,IAAI,IAAY;CACnC,IAAI;CACJ,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,KAAK,IAAI,OAAO,GAAG,OAAO,kBAAkB,QAAQ,GAAG;EACrD,MAAM,SAAS,MAAM,YACnB,YAAY,UACN,YAAY,OAAO,UAAU;GAAE;GAAO;GAAQ,WAAW,CAAC,QAAQ;GAAG;EAAO,CAAC,GACnF,WAAW,KAAK,IAAI,CACtB;EACA,KAAK,MAAM,QAAQ,OAAO,OACxB,KAAK,MAAM,OAAO,qBAAqB,YAAY,IAAI,IAAI,GAAG,WAAW,IAAI,GAAG;EAElF,IAAI,CAAC,OAAO,YAAY;EACxB,SAAS,OAAO;CAClB;CACA,IAAI,WAAW,SAAS,GAAG,OAAO;EAAE,OAAO;EAAG,SAAS;CAAE;CAEzD,IAAI,QAAQ;CACZ,IAAI,UAAU;CACd,MAAM,QAAQ,MAAM,UAAU,KAAK;EAAE;EAAO;CAAiB,CAAC;CAC9D,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,SAAS,KAAK;EACpB,IAAI,CAAC,UAAU,OAAO,kBAAkB,YAAY,MAAM,CAAC,WAAW,IAAI,OAAO,UAAU,GAAG;EAC9F,MAAM,UAAU,MAAM,gBAAgB;GAAE;GAAW;GAAe;GAAQ;GAAM;EAAY,CAAC;EAC7F,IAAI,YAAY,SAAS,SAAS;OAC7B,IAAI,YAAY,WAAW,WAAW;CAC7C;CACA,OAAO;EAAE;EAAO;CAAQ;AAC1B;;;;;;AAOA,eAAe,qBAAqB,EAClC,WACA,eACA,OACA,QACA,kBACA,eACA,OACA,UAU8C;CAC9C,MAAM,UAAU,qBAAqB,KAAK;CAC1C,IAAI,QAAQ;CACZ,IAAI,UAAU;CACd,KAAK,MAAM,QAAQ,MAAM,UAAU,KAAK;EAAE;EAAO;CAAiB,CAAC,GAAG;EACpE,MAAM,SAAS,KAAK;EACpB,IAAI,CAAC,UAAU,OAAO,kBAAkB,iBAAiB,OAAO,SAAS,SAAS;EAClF,MAAM,SAAS,WAAW,IAAI;EAC9B,IAAI,CAAC,OAAO,MAAK,cAAa,qBAAqB,SAAS,MAAM,OAAO,GAAG;EAE5E,MAAM,UAAU,MAAM,gBAAgB;GAAE;GAAW;GAAe;GAAQ;GAAM,aAD5D,wBAAwB,QAAQ,MAAM,CAAC,EAAE,SAAS;EACsB,CAAC;EAC7F,IAAI,YAAY,SAAS,SAAS;OAC7B,IAAI,YAAY,WAAW,WAAW;CAC7C;CACA,OAAO;EAAE;EAAO;CAAQ;AAC1B;AAUA,MAAM,2BAA2B;;AAGjC,SAAS,YACP,eACA,MACA,YAAoB,0BACR;CACZ,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,SAAS,KAAK,IAAI,GAAG,SAAS;EACpC,MAAM,QAAQ,iBACN,uBAAO,IAAI,MAAM,GAAG,cAAc,yBAAyB,KAAK,MAAM,SAAS,GAAI,EAAE,EAAE,CAAC,GAC9F,MACF;EACA,KAAK,CAAC,CACH,KAAK,SAAS,MAAM,CAAC,CACrB,cAAc,aAAa,KAAK,CAAC;CACtC,CAAC;AACH;;;;;AAMA,eAAe,oBACb,UACsG;CACtG,MAAM,UAAU,MAAM,QAAQ,IAC5B,SAAS,IAAI,OAAO,EAAE,eAAe,WAA2C;EAC9E,IAAI;GACF,OAAO;IAAE;IAAe,OAAO,MAAM,YAAY,eAAe,IAAI;GAAE;EACxE,SAAS,OAAO;GACd,QAAQ,MAAM,gCAAgC,cAAc,mBAAmB,KAAK;GACpF,OAAO;IAAE;IAAe,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAAE;EAC1F;CACF,CAAC,CACH;CACA,MAAM,QAAoD,CAAC;CAC3D,MAAM,WAAuC,CAAC;CAC9C,KAAK,MAAM,SAAS,SAClB,IAAI,WAAW,OAAO,MAAM,KAAK,KAAK;MACjC,SAAS,KAAK,KAAK;CAE1B,OAAO;EAAE;EAAO;CAAS;AAC3B;;AAWA,SAAgB,mBAAmB,MAAqC;CACtE,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,GAAG,OAAO;CAC7E,MAAM,EAAE,eAAe,UAAU,kBAAkB,UAAU;CAC7D,MAAM,QAAQ,UAAmB,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,UAAU;CAClG,IAAI,CAAC,KAAK,aAAa,KAAK,CAAC,KAAK,QAAQ,GAAG,OAAO;CACpD,IAAI,qBAAqB,QAAQ,CAAC,KAAK,gBAAgB,GAAG,OAAO;CACjE,IAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,CAAC,KAAK,KAAK,GAAG,OAAO;CAClE,OAAO;EACU;EACL;EACQ;EAClB,OAAQ,SAAuC;CACjD;AACF;AAEA,MAAM,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AAC5C,MAAM,uBAAuB,EAAE,OAAO;CACpC,kBAAkB;CAClB,eAAe;CACf,OAAO,EACJ,OAAO,CAAC,CACR,IAAI,GAAG,CAAC,CACR,UAAU,oBAAoB,CAAC,CAC/B,QAAO,UAAS,MAAM,SAAS,GAAG,yBAAyB;;CAE9D,OAAO,WAAW,QAAQ,CAAC,CAAC,WAAU,UAAS,SAAS,IAAI;AAC9D,CAAC;;AAID,SAAgB,sBAAsB,MAAwC;CAC5E,MAAM,SAAS,qBAAqB,UAAU,IAAI;CAClD,OAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEA,SAAS,MAAM,GAAqB;CAClC,OAAO;AACT;AAEA,SAAS,eAAe,OAA6C;CACnE,IAAI,UAAU,MAAM,OAAO;CAC3B,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,KAAK,OAAO,KAAA;CACxD,MAAM,MAAM,MAAM,QAAQ,SAAyB,OAAO,SAAS,YAAY,KAAK,SAAS,KAAK,KAAK,UAAU,GAAG;CACpH,OAAO,IAAI,WAAW,MAAM,UAAU,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS,IAAI,SAAS,MAAM,KAAA;AACjF;;AAGA,SAAgB,kBAAkB,MAAoC;CACpE,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,GAAG,OAAO;CAC7E,MAAM,UAAU,OAAO,QAAQ,IAAI;CACnC,IAAI,QAAQ,SAAS,IAAI,OAAO;CAIhC,MAAM,SAAuB,OAAO,OAAO,IAAI;CAC/C,KAAK,MAAM,CAAC,eAAe,UAAU,SAAS;EAC5C,IACE,CAAC,iBACD,cAAc,SAAS,OACvB,OAAO,UAAU,YACjB,UAAU,QACV,MAAM,QAAQ,KAAK,GAEnB,OAAO;EAET,MAAM,YAAY;EAClB,IAAI,OAAO,UAAU,YAAY,WAAW,OAAO;EACnD,MAAM,YAAY,eAAe,UAAU,aAAa,IAAI;EAC5D,IAAI,cAAc,KAAA,GAAW,OAAO;EACpC,OAAO,iBAAiB;GAAE,SAAS,UAAU;GAAS;EAAU;CAClE;CACA,OAAO;AACT;AAEA,SAAS,aAAa,SAAgD;CACpE,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAAI,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,WAAW,IAAI;AACxG;AAEA,SAAS,aAAa,OAA0D;CAC9E,IAAI,CAAC,OAAO,OAAO,CAAC;CACpB,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,OAAO,KAAK,OAAO,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;EAC1E,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG,OAAO;EACnF,MAAM,UAAU,OAAO,QAAQ,MAAM;EACrC,IAAI,QAAQ,MAAM,CAAC,KAAK,YAAY,CAAC,OAAO,OAAO,WAAW,QAAQ,GAAG,OAAO;EAChF,OAAO,OAAO,YAAY,OAAO;CACnC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,IAAa,eAAb,cAAkC,MAAwB;CACxD,MAAMA,eAAe,GAAiF;EACpG,MAAM,KAAK,KAAK,KAAK,WAAW,CAAC;EACjC,MAAM,SAAS,KAAK,KAAK,KAAK,OAAO,CAAC;EACtC,IAAI,CAAC,QAAQ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;EACvE,IAAI,CAAC,OAAO,OACV,OAAO,EACL,UAAU,EAAE,KACV;GAAE,OAAO;GAAyB,SAAS;EAAiD,GAC5F,GACF,EACF;EAEF,OAAO;GAAE,OAAO,OAAO;GAAO,QAAQ,OAAO;EAAO;CACtD;CAEA,SAAqB;EACnB,MAAM,EAAE,OAAO,QAAQ,UAAU,eAAe,CAAC,GAAG,eAAe,cAAc,KAAK;EACtF,MAAM,iBAAiB,aAAa,KAAI,gBAAe,YAAY,EAAE;EAErE,OAAO;GACL,iBAAiB,sBAAsB;IACrC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,OAAO,YAAY;KACzB,MAAM,SAAS,MAAM,OAAO,UAAU;MAAE,OAAO,OAAO;MAAO;KAAe,CAAC;KAC7E,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC;IAC1B;GACF,CAAC;GACD,iBAAiB,sBAAsB;IACrC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KAExC,IAAI;KACJ,IAAI;MACF,OAAO,MAAM,EAAE,IAAI,KAAK;KAC1B,QAAQ;MACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACnD;KACA,MAAM,SAAS,kBAAkB,IAAI;KACrC,IAAI,CAAC,QACH,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;KAGhD,MAAM,mBAAiC,OAAO,OAAO,IAAI;KACzD,KAAK,MAAM,CAAC,eAAe,cAAc,OAAO,QAAQ,MAAM,GAAG;MAC/D,IAAI,eAAe,SAAS,aAAa,GAAG;OAC1C,iBAAiB,iBAAiB;OAClC;MACF;MACA,IAAI,UAAU,WAAW,UAAU,WAAW,QAC5C,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;KAElD;KAEA,MAAM,OAAO,YAAY;KACzB,MAAM,OAAO,WAAW;MAAE,OAAO,OAAO;MAAO,QAAQ;KAAiB,CAAC;KACzE,MAAM,MAAM,KAAK;MACf,SAAS,MAAM,CAAC;MAChB,OAAO;OACL,QAAQ;OACR,SAAS,CAAC;QAAE,MAAM;QAAiB,IAAI,OAAO;OAAM,CAAC;OACrD,UAAU,OAAO,YACf,OAAO,QAAQ,gBAAgB,CAAC,CAAC,KAAK,CAAC,eAAe,eAAe,CACnE,eACA;QAAE,SAAS,UAAU;QAAS,SAAS,UAAU,WAAW,UAAU;OAAK,CAC7E,CAAC,CACH;MACF;KACF,CAAC;KACD,OAAO,EAAE,KAAK,EAAE,QAAQ,iBAAiB,CAAC;IAC5C;GACF,CAAC;GACD,iBAAiB,wBAAwB;IACvC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,OAAO,YAAY;KACzB,OAAO,EAAE,KAAK,EAAE,UAAU,MAAM,OAAO,aAAa,EAAE,OAAO,OAAO,MAAM,CAAC,EAAE,CAAC;IAChF;GACF,CAAC;GACD,iBAAiB,wBAAwB;IACvC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KAExC,IAAI;KACJ,IAAI;MACF,OAAO,MAAM,EAAE,IAAI,KAAK;KAC1B,QAAQ;MACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACnD;KACA,MAAM,UAAU,mBAAmB,IAAI;KACvC,IAAI,CAAC,WAAW,CAAC,eAAe,SAAS,QAAQ,aAAa,GAC5D,OAAO,EAAE,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;KAEjD,IAAI,QAAQ,oBAAoB,UAE1B;UAAA,CAAC,MADiB,SAAS,IAAI;OAAE,OAAO,OAAO;OAAO,IAAI,QAAQ;MAAiB,CAAC,GAC1E,OAAO,EAAE,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;KAAA;KAEzE,IAAI,QAAQ,UAAU,QAAQ,CAAC,eAAe,IAAI,QAAQ,KAAK,GAC7D,OAAO,EAAE,KAAK;MAAE,OAAO;MAAiB,SAAS,UAAU,QAAQ,MAAM;KAAqB,GAAG,GAAG;KAGtG,MAAM,OAAO,YAAY;KACzB,IAAI,wBAAwB,QAAQ;KACpC,IAAI,YAAuD;KAC3D,IAAI,QAAQ,qBAAqB,MAM/B,yBAAwB,MALM,OAAO,aAAa;MAChD,OAAO,OAAO;MACd,eAAe,QAAQ;MACvB,UAAU,QAAQ;KACpB,CAAC,EAAA,EACwC,oBAAoB;UACxD;MACL,MAAM,kBAAkB,MAAM,OAAO,WAAW;OAC9C,OAAO,OAAO;OACd,eAAe,QAAQ;OACvB,UAAU,QAAQ;MACpB,CAAC;MACD,MAAM,OAAO,WAAW;OACtB,OAAO,OAAO;OACd,QAAQ,OAAO;OACf,eAAe,QAAQ;OACvB,UAAU,QAAQ;OAClB,kBAAkB,QAAQ;OAC1B,OAAO,QAAQ;MACjB,CAAC;MAKD,MAAM,YAAY,QAAQ;MAC1B,MAAM,cAAc,aAAa,MAAK,cAAa,UAAU,OAAO,QAAQ,aAAa;MACzF,IACE,aACA,iBACA,eACA,iBAAiB,qBAAqB,QAAQ,oBAC9C,cAAc,QACd,gBAAgB,UAAU,WAE1B,IAAI;OACF,YAAY,MAAM,oBAAoB;QACpC;QACA;QACA;QACA,OAAO,OAAO;QACd,QAAQ,OAAO;QACf,kBAAkB,QAAQ;QAC1B,UAAU,QAAQ;QAClB,aAAa;OACf,CAAC;MACH,SAAS,OAAO;OAEd,QAAQ,MAAM,8CAA8C,QAAQ,cAAc,UAAU,KAAK;MACnG;KAEJ;KACA,MAAM,MAAM,KAAK;MACf,SAAS,MAAM,CAAC;MAChB,OAAO;OACL,QAAQ;OACR,GAAI,wBAAwB,EAAE,kBAAkB,sBAAsB,IAAI,CAAC;OAC3E,SAAS,CAAC;QAAE,MAAM;QAAiB,IAAI,GAAG,QAAQ,cAAc,GAAG,QAAQ;OAAW,CAAC;OACvF,UAAU;QACR,kBAAkB,QAAQ;QAC1B,OAAO,QAAQ;QACf,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;OACnC;MACF;KACF,CAAC;KACD,OAAO,EAAE,KAAK;MACZ,UAAU,MAAM,OAAO,aAAa,EAAE,OAAO,OAAO,MAAM,CAAC;MAC3D,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;KACnC,CAAC;IACH;GACF,CAAC;GACD,iBAAiB,4BAA4B;IAC3C,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,mBAAmB,EAAE,IAAI,MAAM,kBAAkB;KACvD,MAAM,OAAO,YAAY;KACzB,OAAO,EAAE,KAAK,EACZ,QAAQ,MAAM,OAAO,gBAAgB;MACnC,OAAO,OAAO;MACd,GAAI,mBAAmB,EAAE,iBAAiB,IAAI,CAAC;KACjD,CAAC,EACH,CAAC;IACH;GACF,CAAC;GACD,iBAAiB,4BAA4B;IAC3C,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KAExC,IAAI;KACJ,IAAI;MACF,OAAO,MAAM,EAAE,IAAI,KAAK;KAC1B,QAAQ;MACN,OAAO,EAAE,KAAK,EAAE,OAAO,oBAAoB,GAAG,GAAG;KACnD;KACA,MAAM,QAAQ,sBAAsB,IAAI;KACxC,IAAI,CAAC,SAAS,CAAC,eAAe,SAAS,MAAM,aAAa,GACxD,OAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,GAAG,GAAG;KAErD,IAAI,UAEE;UAAA,CAAC,MADiB,SAAS,IAAI;OAAE,OAAO,OAAO;OAAO,IAAI,MAAM;MAAiB,CAAC,GACxE,OAAO,EAAE,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;KAAA;KAEzE,IAAI,MAAM,UAAU,QAAQ,CAAC,eAAe,IAAI,MAAM,KAAK,GACzD,OAAO,EAAE,KAAK;MAAE,OAAO;MAAiB,SAAS,UAAU,MAAM,MAAM;KAAqB,GAAG,GAAG;KAGpG,MAAM,OAAO,YAAY;KACzB,MAAM,QAAQ;MACZ,OAAO,OAAO;MACd,kBAAkB,MAAM;MACxB,eAAe,MAAM;KACvB;KACA,MAAM,YAAY,MAAM,OAAO,gBAAgB,KAAK,EAAA,CAAG,MAAK,aAAY,SAAS,UAAU,MAAM,KAAK;KACtG,IAAI,MAAM,UAAU,MAClB,MAAM,OAAO,gBAAgB;MAAE,GAAG;MAAO,OAAO,MAAM;KAAM,CAAC;UAE7D,MAAM,OAAO,cAAc;MAAE,GAAG;MAAO,OAAO,MAAM;MAAO,OAAO,MAAM;MAAO,QAAQ,OAAO;KAAO,CAAC;KAKxG,IAAI,YAAuD;KAC3D,IAAI,aAAa,kBAAkB,UAAU,SAAS,UAAU,MAAM,OACpE,IAAI;MACF,YAAY,MAAM,qBAAqB;OACrC;OACA;OACA,OAAO,OAAO;OACd,QAAQ,OAAO;OACf,kBAAkB,MAAM;OACxB,eAAe,MAAM;OACrB,OAAO,MAAM;OACb,QAAQ,MAAM,OAAO,gBAAgB,KAAK;MAC5C,CAAC;KACH,SAAS,OAAO;MAEd,QAAQ,MAAM,mDAAmD,MAAM,cAAc,UAAU,KAAK;KACtG;KAEF,MAAM,MAAM,KAAK;MACf,SAAS,MAAM,CAAC;MAChB,OAAO;OACL,QAAQ;OACR,kBAAkB,MAAM;OACxB,SAAS,CAAC;QAAE,MAAM;QAAsB,IAAI,GAAG,MAAM,cAAc,GAAG,MAAM;OAAQ,CAAC;OACrF,UAAU;QAAE,OAAO,MAAM;QAAO,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;OAAG;MACtE;KACF,CAAC;KACD,OAAO,EAAE,KAAK;MACZ,QAAQ,MAAM,OAAO,gBAAgB;OAAE,OAAO,OAAO;OAAO,kBAAkB,MAAM;MAAiB,CAAC;MACtG,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;KACnC,CAAC;IACH;GACF,CAAC;GACD,iBAAiB,uBAAuB;IACtC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,EAAE,OAAO,aAAa,MAAM,oBAChC,aAAa,KAAI,iBAAgB;MAC/B,eAAe,YAAY;MAC3B,YAAY,YAAY,OAAO,YAAY,MAAM;KACnD,EAAE,CACJ;KACA,OAAO,EAAE,KAAK;MACZ,SAAS,MAAM,SAAS,EAAE,eAAe,YAAY,MAAM,KAAI,YAAW;OAAE;OAAe,GAAG;MAAO,EAAE,CAAC;MACxG;KACF,CAAC;IACH;GACF,CAAC;GACD,iBAAiB,qBAAqB;IACpC,QAAQ;IACR,cAAc;IACd,SAAS,OAAM,MAAK;KAClB,MAAM,SAAS,MAAM,KAAKA,eAAe,MAAM,CAAC,CAAC;KACjD,IAAI,cAAc,QAAQ,OAAO,OAAO;KACxC,MAAM,UAAU,aAAa,EAAE,IAAI,MAAM,QAAQ,CAAC;KAClD,IAAI,CAAC,SAAS,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;KAE5D,MAAM,OAAO,YAAY;KACzB,MAAM,SAAS,MAAM,OAAO,UAAU;MAAE,OAAO,OAAO;MAAO;KAAe,CAAC;KAC7E,MAAM,EAAE,OAAO,aAAa,MAAM,oBAChC,aAAa,SAAQ,gBAAe;MAClC,MAAM,YAAY,OAAO,YAAY;MACrC,IAAI,CAAC,WAAW,WAAW,CAAC,UAAU,WAAW,QAAQ,OAAO,CAAC;MACjE,MAAM,YAAY,UAAU;MAC5B,MAAM,SAAS,QAAQ,YAAY;MACnC,OAAO,CACL;OACE,eAAe,YAAY;OAC3B,YAAY,YAAY,OAAO,UAAU;QAAE,GAAG;QAAQ;QAAW,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;OAAG,CAAC;MAClG,CACF;KACF,CAAC,CACH;KAEA,MAAM,QAAgC,CAAC;KACvC,MAAM,cAAsC,CAAC;KAC7C,KAAK,MAAM,EAAE,eAAe,WAAW,OAAO;MAC5C,MAAM,KACJ,GAAG,MAAM,MAAM,KAAI,SAAQ;OACzB,MAAM,EAAE,QAAQ,GAAG,cAAc;OACjC,OAAO;QAAE,GAAG;QAAW;QAAe,gBAAgB;SAAE;SAAe,GAAG;QAAO;OAAE;MACrF,CAAC,CACH;MACA,IAAI,MAAM,YAAY,YAAY,iBAAiB,MAAM;KAC3D;KAEA,KAAK,MAAM,EAAE,mBAAmB,UAAU;MACxC,MAAM,SAAS,QAAQ;MACvB,IAAI,QAAQ,YAAY,iBAAiB;KAC3C;KACA,OAAO,EAAE,KAAK;MAAE;MAAO,YAAY,aAAa,WAAW;MAAG;KAAS,CAAC;IAC1E;GACF,CAAC;EACH;CACF;AACF"}

package/dist/rules/transition-service.d.ts

@@ -65,6 +65,16 @@ export interface FactoryTransitionServiceOptions {
         workItemId: string;
         item: WorkItemRow;
     }) => Promise<void> | void;
+    /**
+     * Resolves whether a project auto-approves produced plans. Mirrors the
+     * dispatcher's resolver so the two share a single authoritative predicate
+     * (`plansPreapprovedAt` on the item, or this per-project setting). Unset means
+     * off: a plan nobody armed for auto-advance is a plan a person must review.
+     */
+    autoApprovePlans?: (tenant: {
+        orgId: string;
+        factoryProjectId: string;
+    }) => Promise<boolean>;
 }
 export declare function auditActorOf(actor: FactoryRuleActor): {
     actorId: string;

package/dist/rules/transition-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transition-service.d.ts","sourceRoot":"","sources":["../../src/rules/transition-service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAC7G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAE3F,OAAO,KAAK,EAEV,gBAAgB,EAEhB,sBAAsB,EAEtB,gBAAgB,EAChB,iBAAiB,EAEjB,uBAAuB,EACxB,MAAM,YAAY,CAAC;AAsBpB,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,gBAAgB,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,gBAAgB,CAAC;IACxB,YAAY,CAAC,EAAE,sBAAsB,CAAC;IACtC,sEAAsE;IACtE,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE;QAAE,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,YAAY,GAAG,QAAQ,GAAG,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjH,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAChD,iHAAiH;IACjH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,qHAAqH;IACrH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,iBAAiB,CAAC;CAChC;AAED,MAAM,WAAW,+BAA+B;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,yHAAyH;IACzH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,gBAAgB,CAAC;QACxB,QAAQ,EAAE,MAAM,CAAC;KAClB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC3B;;2CAEuC;IACvC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,WAAW,CAAC;KACnB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC5B;AAwBD,wBAAgB,YAAY,CAAC,KAAK,EAAE,gBAAgB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,cAAc,CAAA;CAAE,CAUpG;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,GAAG,SAAS,CAIpF;AAyED,qBAAa,wBAAwB;;gBAUvB,OAAO,EAAE,+BAA+B;IAWpD,IAAI,aAAa,IAAI,MAAM,CAE1B;IAEK,UAAU,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC;CAwXtF"}
+{"version":3,"file":"transition-service.d.ts","sourceRoot":"","sources":["../../src/rules/transition-service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAC7G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAE3F,OAAO,KAAK,EAEV,gBAAgB,EAEhB,sBAAsB,EAEtB,gBAAgB,EAChB,iBAAiB,EAEjB,uBAAuB,EACxB,MAAM,YAAY,CAAC;AAsBpB,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,gBAAgB,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,gBAAgB,CAAC;IACxB,YAAY,CAAC,EAAE,sBAAsB,CAAC;IACtC,sEAAsE;IACtE,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE;QAAE,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,YAAY,GAAG,QAAQ,GAAG,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjH,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAChD,iHAAiH;IACjH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,qHAAqH;IACrH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,iBAAiB,CAAC;CAChC;AAED,MAAM,WAAW,+BAA+B;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,yHAAyH;IACzH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,gBAAgB,CAAC;QACxB,QAAQ,EAAE,MAAM,CAAC;KAClB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC3B;;2CAEuC;IACvC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,WAAW,CAAC;KACnB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC3B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9F;AAwBD,wBAAgB,YAAY,CAAC,KAAK,EAAE,gBAAgB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,cAAc,CAAA;CAAE,CAUpG;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,GAAG,SAAS,CAIpF;AAyED,qBAAa,wBAAwB;;gBAWvB,OAAO,EAAE,+BAA+B;IAYpD,IAAI,aAAa,IAAI,MAAM,CAE1B;IAEK,UAAU,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC;CAkYtF"}

package/dist/rules/transition-service.js

@@ -108,6 +108,7 @@ var FactoryTransitionService = class {
 	#onTerminalStage;
 	#terminalCleanupTimeoutMs;
 	#onAccepted;
+	#autoApprovePlans;
 	#audit;
 	constructor(options) {
 		this.#configVersion = options.configVersion;
@@ -117,6 +118,7 @@ var FactoryTransitionService = class {
 		this.#timeoutMs = options.timeoutMs ?? RULE_TIMEOUT_MS;
 		this.#onTerminalStage = options.onTerminalStage;
 		this.#onAccepted = options.onAccepted;
+		this.#autoApprovePlans = options.autoApprovePlans;
 		this.#terminalCleanupTimeoutMs = options.terminalCleanupTimeoutMs ?? TERMINAL_CLEANUP_TIMEOUT_MS;
 	}
 	get configVersion() {
@@ -230,6 +232,10 @@ var FactoryTransitionService = class {
 		let evaluation;
 		try {
 			evaluation = await withRuleTimeout((async () => {
+				const plansAutoApproved = item.plansPreapprovedAt != null || (this.#autoApprovePlans ? await this.#autoApprovePlans({
+					orgId: request.orgId,
+					factoryProjectId: request.factoryProjectId
+				}) : false);
 				const policy = boardTransitionPolicyResultSchema.parse(await board.transitionPolicy?.(immutablePolicySnapshot({
 					...contextBase,
 					item: {
@@ -239,6 +245,7 @@ var FactoryTransitionService = class {
 					initialEntry: request.initialEntry ?? false,
 					reenter: request.reenter ?? false,
 					isHumanTransition: isHumanTransition(request),
+					plansAutoApproved,
 					requestedTriageType: request.triageType
 				})));
 				if (policy?.type === "reject") return {

package/dist/rules/transition-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"transition-service.js","names":["#configVersion","#boards","#storage","#timeoutMs","#onTerminalStage","#terminalCleanupTimeoutMs","#onAccepted","#audit","#commitRejection","#recordTransition","#evaluateAndCommit","#commit"],"sources":["../../src/rules/transition-service.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\n\nimport { createBoardRegistry } from '../boards/index.js';\nimport type { BoardRegistry } from '../boards/index.js';\nimport { boardTransitionPolicyResultSchema, immutablePolicySnapshot } from '../boards/transition-policy.js';\nimport type { AuditActorProfileInput, AuditActorType, AuditContext } from '../storage/domains/audit/base.js';\nimport type { AuditRecorder } from '../storage/domains/audit/domain.js';\nimport { isAgentActor } from '../storage/domains/work-items/base.js';\nimport type { WorkItemRow, WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport { resolveFactoryStageRules } from './resolve.js';\nimport type {\n  FactoryCommitDecision,\n  FactoryRuleActor,\n  FactoryRuleBoard,\n  FactoryRuleCausalEntry,\n  FactoryRuleRejectionCode,\n  FactoryRuleStage,\n  FactoryTriageType,\n  FactoryStageRuleContext,\n  FactoryTransitionResult,\n} from './types.js';\nimport {\n  externallyAuthoredWorkItem,\n  factoryRuleSourceForWorkItem,\n  isFactoryRuleStage,\n  workItemSource,\n} from './types.js';\nimport {\n  MAX_FACTORY_RULE_CAUSAL_DEPTH,\n  assertFactoryDecisionTarget,\n  validateFactoryRuleDecision,\n  validateFactoryRuleDecisions,\n} from './validation.js';\n\nconst RULE_TIMEOUT_MS = 5_000;\nconst MAX_REJECTION_REASON = 512;\n/** Longest a committed transition waits for terminal resource cleanup. Cleanup\n * reattaches remote sandboxes, so a hung provider call must not leave the\n * already-committed transition request pending; past this bound the cleanup\n * keeps running in the background as pure best-effort. */\nconst TERMINAL_CLEANUP_TIMEOUT_MS = 30_000;\n\nexport interface FactoryTransitionRequest {\n  orgId: string;\n  factoryProjectId: string;\n  workItemId: string;\n  /** Installed board id; the service rejects boards that are not installed. */\n  board: string;\n  stage: FactoryRuleStage;\n  expectedRevision: number;\n  actor: FactoryRuleActor;\n  actorProfile?: AuditActorProfileInput;\n  /** Where a browser request came from; rules and agents carry none. */\n  context?: AuditContext;\n  ingress: { type: 'human' | 'agent' | 'toolResult' | 'github' | 'rule'; identity: string; transitionId?: string };\n  cause: string;\n  causalChain?: readonly FactoryRuleCausalEntry[];\n  /** Internal materialization path: evaluate only the destination onEnter leaf even when already at that stage. */\n  initialEntry?: boolean;\n  /** Re-runs the stage's entry rules when the item already holds that stage, to restart work the entry invalidated. */\n  reenter?: boolean;\n  /** Structured verdict required from a bound triage-agent terminal request. */\n  triageType?: FactoryTriageType;\n}\n\nexport interface FactoryTransitionServiceOptions {\n  configVersion: string;\n  storage: WorkItemsStorage;\n  boards?: BoardRegistry;\n  /** Every commit, accepted or rejected, lands here as `stage_moved` / `transition_rejected` under the request's actor. */\n  audit?: AuditRecorder;\n  timeoutMs?: number;\n  /**\n   * Called after a transition commits into a phase the board declares\n   * terminal — the point where the item's sessions stop receiving runs, so\n   * resources they hold (e.g. sandboxes) can be released for reuse. Awaited,\n   * but failures are swallowed: releasing resources must never break or roll\n   * back the committed transition.\n   */\n  onTerminalStage?: (args: {\n    orgId: string;\n    factoryProjectId: string;\n    workItemId: string;\n    stage: FactoryRuleStage;\n    revision: number;\n  }) => Promise<void> | void;\n  /** Upper bound on how long a committed transition waits for\n   * `onTerminalStage` before returning (default 30s). The cleanup continues\n   * in the background past the bound. */\n  terminalCleanupTimeoutMs?: number;\n  /**\n   * Called after a transition first records a person's acceptance of a\n   * non-bug item (see `WorkItemRow.acceptedAt`). Fire-and-forget: failures\n   * are swallowed, the committed transition never depends on it.\n   */\n  onAccepted?: (args: {\n    orgId: string;\n    factoryProjectId: string;\n    workItemId: string;\n    item: WorkItemRow;\n  }) => Promise<void> | void;\n}\n\nfunction rejection(\n  transitionId: string,\n  itemId: string,\n  code: FactoryRuleRejectionCode,\n  reason: string,\n): FactoryTransitionResult {\n  return { status: 'rejected', transitionId, itemId, code, reason: reason.slice(0, MAX_REJECTION_REASON) };\n}\n\nfunction actorId(actor: FactoryRuleActor): string {\n  switch (actor.type) {\n    case 'human':\n    case 'system':\n      return actor.id;\n    case 'agent':\n      return `agent:${actor.bindingId}`;\n    case 'github':\n      return `github:${actor.login}`;\n  }\n}\n\n// The dispatcher executes an agent-approved decision as a human actor so its consent carries; the trail still names the agent.\nexport function auditActorOf(actor: FactoryRuleActor): { actorId: string; actorType: AuditActorType } {\n  const id = actorId(actor);\n  switch (actor.type) {\n    case 'github':\n      return { actorId: id, actorType: 'human' };\n    case 'human':\n      return { actorId: id, actorType: isAgentActor(id) ? 'agent' : 'human' };\n    default:\n      return { actorId: id, actorType: actor.type };\n  }\n}\n\nexport function currentStage(stages: readonly string[]): FactoryRuleStage | undefined {\n  if (stages.length !== 1) return undefined;\n  const stage = stages[0];\n  return isFactoryRuleStage(stage) ? stage : undefined;\n}\n\ninterface TransitionConsentOptions {\n  autonomy?: 'arm' | 'disarm';\n  consentedBy?: string;\n  accept?: boolean;\n  triageType?: FactoryTriageType;\n}\n\n// Entering a resting lane disarms whoever rests it; only a person's move into a working lane arms.\nfunction transitionConsent(working: boolean, humanMove: boolean): 'arm' | 'disarm' | undefined {\n  if (!working) return 'disarm';\n  return humanMove ? 'arm' : undefined;\n}\n\n// An event arriving as data (GitHub, sweeps) never pre-approves the runs its transition queues.\nfunction bearsConsent(actor: FactoryRuleActor): boolean {\n  return actor.type === 'human' || actor.type === 'agent';\n}\n\n// Rides the transition's own revision-checked commit, so a stale or rejected commit flips nothing.\nfunction consentEffect(\n  request: FactoryTransitionRequest,\n  working: boolean,\n  humanMove: boolean,\n): TransitionConsentOptions {\n  const autonomy = transitionConsent(working, humanMove);\n  return bearsConsent(request.actor) ? { autonomy, consentedBy: actorId(request.actor) } : { autonomy };\n}\n\ntype RunStartDecision = Extract<FactoryCommitDecision, { type: 'invokeSkill' | 'sendMessage' }>;\n\nfunction startsRun(decision: FactoryCommitDecision): decision is RunStartDecision {\n  return decision.type === 'invokeSkill' || (decision.type === 'sendMessage' && decision.prepareBinding === true);\n}\n\n// Answering a recorded run start, or the role's own mid-run agent, with a run would start a second one.\nfunction runAlreadyUnderway(request: FactoryTransitionRequest, decision: RunStartDecision): boolean {\n  if (request.cause === 'run_start') return true;\n  return request.actor.type === 'agent' && request.actor.role === decision.role;\n}\n\nfunction stageTransitionMessage(fromStage: FactoryRuleStage, toStage: FactoryRuleStage): string {\n  return `This work was moved from the ${fromStage} stage to the ${toStage} stage.`;\n}\n\nfunction isTriageAgent(actor: FactoryRuleActor): actor is Extract<FactoryRuleActor, { type: 'agent' }> {\n  return actor.type === 'agent' && actor.role === 'triage';\n}\n\nfunction isHumanTransition(request: FactoryTransitionRequest): boolean {\n  return request.actor.type === 'human' && request.ingress.type === 'human';\n}\n\nfunction ruleFailure(error: unknown): { code: FactoryRuleRejectionCode; reason: string } {\n  return {\n    code: 'rule_error',\n    reason: error instanceof Error ? `Factory rule failed: ${error.message}` : 'Factory rule failed.',\n  };\n}\n\nasync function withRuleTimeout<T>(operation: Promise<T>, timeoutMs: number): Promise<T> {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const timeout = new Promise<never>((_, reject) => {\n    timer = setTimeout(() => reject(new Error('FACTORY_RULE_TIMEOUT')), timeoutMs);\n  });\n  try {\n    return await Promise.race([operation, timeout]);\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n\nexport class FactoryTransitionService {\n  readonly #configVersion: string;\n  readonly #boards: BoardRegistry;\n  readonly #storage: WorkItemsStorage;\n  readonly #timeoutMs: number;\n  readonly #onTerminalStage: FactoryTransitionServiceOptions['onTerminalStage'];\n  readonly #terminalCleanupTimeoutMs: number;\n  readonly #onAccepted: FactoryTransitionServiceOptions['onAccepted'];\n  readonly #audit: AuditRecorder | undefined;\n\n  constructor(options: FactoryTransitionServiceOptions) {\n    this.#configVersion = options.configVersion;\n    this.#boards = options.boards ?? createBoardRegistry();\n    this.#storage = options.storage;\n    this.#audit = options.audit;\n    this.#timeoutMs = options.timeoutMs ?? RULE_TIMEOUT_MS;\n    this.#onTerminalStage = options.onTerminalStage;\n    this.#onAccepted = options.onAccepted;\n    this.#terminalCleanupTimeoutMs = options.terminalCleanupTimeoutMs ?? TERMINAL_CLEANUP_TIMEOUT_MS;\n  }\n\n  get configVersion(): string {\n    return this.#configVersion;\n  }\n\n  async transition(request: FactoryTransitionRequest): Promise<FactoryTransitionResult> {\n    const replay = await this.#storage.getTransitionResultByIngress(\n      request.orgId,\n      request.factoryProjectId,\n      request.ingress.identity,\n    );\n    if (replay) return replay as unknown as FactoryTransitionResult;\n\n    const transitionId = request.ingress.transitionId ?? randomUUID();\n    const item = await this.#storage.get({ orgId: request.orgId, id: request.workItemId });\n    if (!item) {\n      const rejection = await this.#commitRejection(\n        request,\n        transitionId,\n        'invalid_transition',\n        'Work item not found.',\n      );\n      await this.#recordTransition(request, undefined, rejection);\n      return rejection;\n    }\n    const result = await this.#evaluateAndCommit(request, transitionId, item);\n    await this.#recordTransition(request, item, result);\n    return result;\n  }\n\n  /** A rejection can outlive its work item: the row still names the id the caller asked for. */\n  async #recordTransition(\n    request: FactoryTransitionRequest,\n    item: WorkItemRow | undefined,\n    result: FactoryTransitionResult,\n  ): Promise<void> {\n    if (!this.#audit) return;\n    const from = item ? currentStage(item.stages) : undefined;\n    if (result.status === 'accepted' && result.stage === from && !request.reenter) return;\n    const outcome =\n      result.status === 'accepted'\n        ? { action: 'factory.work_item.stage_moved' as const, to: result.stage, revision: result.revision }\n        : {\n            action: 'factory.work_item.transition_rejected' as const,\n            to: request.stage,\n            code: result.code,\n            reason: result.reason,\n          };\n    const { action, ...detail } = outcome;\n    await this.#audit\n      .record({\n        orgId: request.orgId,\n        factoryProjectId: request.factoryProjectId,\n        ...auditActorOf(request.actor),\n        actorProfile: request.actorProfile,\n        ...(request.context ? { context: request.context } : {}),\n        action,\n        idempotencyKey: result.transitionId,\n        targets: [{ type: 'work_item', id: item?.id ?? request.workItemId, ...(item ? { name: item.title } : {}) }],\n        metadata: {\n          transitionId: result.transitionId,\n          ingressType: request.ingress.type,\n          cause: request.cause,\n          configVersion: this.#configVersion,\n          ...(from ? { from } : {}),\n          ...(request.reenter ? { reenter: true } : {}),\n          ...detail,\n        },\n      })\n      .catch(error => {\n        console.warn(`[factory] audit failed for transition ${result.transitionId}:`, error);\n      });\n  }\n\n  async #evaluateAndCommit(\n    request: FactoryTransitionRequest,\n    transitionId: string,\n    item: WorkItemRow,\n  ): Promise<FactoryTransitionResult> {\n    if (request.causalChain && request.causalChain.length > MAX_FACTORY_RULE_CAUSAL_DEPTH) {\n      return this.#commitRejection(\n        request,\n        transitionId,\n        'causal_depth_exceeded',\n        'Factory rule causal depth exceeded.',\n      );\n    }\n    const itemSource = workItemSource(item.externalSource);\n    const source = factoryRuleSourceForWorkItem(itemSource);\n    const legacyBoard = source === 'pullRequest' ? 'review' : 'work';\n    if (item.board === null && !this.#boards.has(legacyBoard)) {\n      return this.#commitRejection(\n        request,\n        transitionId,\n        'invalid_transition',\n        'This legacy work item has no assigned board. Assign an installed board and phase through the work-item PATCH endpoint before transitioning it.',\n      );\n    }\n    const itemBoard = item.board ?? legacyBoard;\n    if (request.board !== itemBoard) {\n      return this.#commitRejection(\n        request,\n        transitionId,\n        'invalid_transition',\n        `The work item belongs to board \"${itemBoard}\", not \"${request.board}\".`,\n      );\n    }\n    if ((itemBoard === 'review' && source !== 'pullRequest') || (itemBoard === 'work' && source === 'pullRequest')) {\n      return this.#commitRejection(\n        request,\n        transitionId,\n        'invalid_transition',\n        'The work item does not belong to the requested board.',\n      );\n    }\n    const board = this.#boards.get(request.board);\n    if (!board) {\n      return this.#commitRejection(\n        request,\n        transitionId,\n        'invalid_transition',\n        `Board \"${request.board}\" is not installed.`,\n      );\n    }\n    const fromStage = item.stages.length === 1 ? item.stages[0] : undefined;\n    if (!fromStage || !Object.prototype.hasOwnProperty.call(board.phases, fromStage)) {\n      return this.#commitRejection(\n        request,\n        transitionId,\n        'invalid_transition',\n        'The work item does not have one canonical phase on the requested board.',\n      );\n    }\n    if (\n      !Object.prototype.hasOwnProperty.call(board.phases, request.stage) ||\n      !board.allowsTransition(fromStage, request.stage)\n    ) {\n      return this.#commitRejection(\n        request,\n        transitionId,\n        'invalid_transition',\n        `The ${board.title} board does not allow moving from ${fromStage} to ${request.stage}.`,\n      );\n    }\n\n    // The coordinator's own self-move at run start would otherwise inject a second run's kickoff.\n    const humanMove = request.actor.type === 'human' && fromStage !== request.stage && request.cause !== 'run_start';\n    // The board, not the phase name, says whether a seat is engaged on either side of this move.\n    const entersWorking = board.isWorking(request.stage);\n    const seatRole = board.roleForPhase(request.stage);\n\n    const contextBase = {\n      tenant: { orgId: request.orgId, projectId: request.factoryProjectId },\n      actor: request.actor,\n      ingress: { type: request.ingress.type, id: request.ingress.identity },\n      cause: request.cause,\n      causalChain: request.causalChain ?? [],\n      configVersion: this.#configVersion,\n      item: {\n        id: item.id,\n        source: itemSource,\n        sourceKey: item.externalSource\n          ? `${item.externalSource.integrationId}:${item.externalSource.type}:${item.externalSource.externalId}`\n          : null,\n        parentWorkItemId: item.parentWorkItemId,\n        title: item.title,\n        url: item.externalSource?.url ?? null,\n        stages: [...item.stages],\n        acceptedAt: item.acceptedAt,\n        metadata: item.metadata,\n      },\n      board: request.board,\n      itemRevision: item.revision,\n      source,\n      fromStage,\n      toStage: request.stage,\n    } satisfies Omit<FactoryStageRuleContext, 'stage'>;\n\n    let evaluation:\n      | { outcome: 'accepted'; decisions: Record<string, unknown>[]; intents: TransitionConsentOptions }\n      | { outcome: 'rejected'; code: string; reason: string };\n    try {\n      evaluation = await withRuleTimeout(\n        (async () => {\n          const policy = boardTransitionPolicyResultSchema.parse(\n            await board.transitionPolicy?.(\n              immutablePolicySnapshot({\n                ...contextBase,\n                item: { ...contextBase.item, triageType: item.triageType },\n                initialEntry: request.initialEntry ?? false,\n                reenter: request.reenter ?? false,\n                isHumanTransition: isHumanTransition(request),\n                requestedTriageType: request.triageType,\n              }),\n            ),\n          );\n          if (policy?.type === 'reject') {\n            return { outcome: 'rejected' as const, code: policy.code, reason: policy.reason };\n          }\n          if (\n            policy?.triageType !== undefined &&\n            (!isTriageAgent(request.actor) ||\n              policy.triageType !== request.triageType ||\n              (item.triageType !== null && item.triageType !== policy.triageType))\n          ) {\n            throw new Error('Board policy requested an unauthorized classification.');\n          }\n          if (policy?.accept && !isHumanTransition(request)) {\n            throw new Error('Board policy requested unauthorized acceptance.');\n          }\n          // External content can steer a bound agent; board allowance cannot bypass this guard.\n          if (\n            request.actor.type === 'agent' &&\n            !board.isWorking(fromStage) &&\n            entersWorking &&\n            externallyAuthoredWorkItem(item)\n          ) {\n            return {\n              outcome: 'rejected' as const,\n              code: 'approval_required',\n              reason:\n                'This card comes from outside the write-access circle; a person must resume it from the Factory board.',\n            };\n          }\n          const decisions: FactoryCommitDecision[] = [];\n          for (const rule of resolveFactoryStageRules(this.#boards, {\n            board: request.board,\n            source,\n            fromStage,\n            toStage: request.stage,\n            initialEntry: request.initialEntry,\n            reenter: request.reenter,\n          })) {\n            const context: FactoryStageRuleContext = Object.freeze({\n              ...contextBase,\n              stage: rule.phase === 'exit' ? fromStage : request.stage,\n            });\n            const raw = await rule.handler(context);\n            if (raw === undefined) continue;\n            const decision = validateFactoryRuleDecision(raw, context.causalChain.length);\n            if (decision.type === 'reject') {\n              return { outcome: 'rejected' as const, code: decision.code, reason: decision.reason };\n            }\n            assertFactoryDecisionTarget(decision, this.#boards, itemBoard);\n            if (startsRun(decision) && runAlreadyUnderway(request, decision)) continue;\n            decisions.push(decision);\n          }\n          const validated = validateFactoryRuleDecisions(decisions);\n          if (humanMove) {\n            const message = stageTransitionMessage(fromStage, request.stage);\n            const skill = validated.find(decision => decision.type === 'invokeSkill');\n            if (skill) {\n              skill.precedingMessage = message;\n            } else {\n              validated.unshift({\n                type: 'sendMessage',\n                idempotencyKey: `factory-stage:${transitionId}`,\n                message,\n                priority: 'urgent',\n                idleBehavior: 'wake',\n                // Parking a card says stop: no seat is right by construction, so\n                // the notice goes to whichever session is live — or nobody.\n                ...(entersWorking && seatRole !== undefined ? { role: seatRole, prepareBinding: true } : {}),\n              });\n            }\n          }\n          return {\n            outcome: 'accepted' as const,\n            intents: { triageType: policy?.triageType, accept: policy?.accept === true && !item.acceptedAt },\n            decisions: validateFactoryRuleDecisions(validated) as unknown as Record<string, unknown>[],\n          };\n        })(),\n        this.#timeoutMs,\n      );\n    } catch (error) {\n      const failed =\n        error instanceof Error && error.message === 'FACTORY_RULE_TIMEOUT'\n          ? { code: 'timeout' as const, reason: 'Factory rule evaluation timed out.' }\n          : ruleFailure(error);\n      evaluation = { outcome: 'rejected', ...failed };\n    }\n    return this.#commit(\n      request,\n      transitionId,\n      evaluation,\n      evaluation.outcome === 'accepted'\n        ? { ...consentEffect(request, entersWorking, humanMove), ...evaluation.intents }\n        : {},\n    );\n  }\n\n  async #commitRejection(\n    request: FactoryTransitionRequest,\n    transitionId: string,\n    code: FactoryRuleRejectionCode,\n    reason: string,\n  ): Promise<FactoryTransitionResult> {\n    return this.#commit(request, transitionId, { outcome: 'rejected', code, reason });\n  }\n\n  async #commit(\n    request: FactoryTransitionRequest,\n    transitionId: string,\n    evaluation:\n      | { outcome: 'accepted'; decisions: Record<string, unknown>[] }\n      | { outcome: 'rejected'; code: string; reason: string },\n    options: TransitionConsentOptions = {},\n  ): Promise<FactoryTransitionResult> {\n    const committed = await this.#storage.commitTransition({\n      autonomy: options.autonomy,\n      consentedBy: options.consentedBy,\n      ...(options.accept ? { accept: true } : {}),\n      orgId: request.orgId,\n      factoryProjectId: request.factoryProjectId,\n      workItemId: request.workItemId,\n      expectedRevision: request.expectedRevision,\n      destinationStage: request.stage,\n      actorId: actorId(request.actor),\n      ingress: { identity: request.ingress.identity, triggerType: request.ingress.type, transitionId },\n      configVersion: this.#configVersion,\n      causalChain: [...(request.causalChain ?? [])],\n      evaluation,\n      ...(options.triageType ? { triageType: options.triageType } : {}),\n    });\n    if (committed.status === 'missing') {\n      return rejection(transitionId, request.workItemId, 'invalid_transition', 'Work item not found.');\n    }\n    const result = committed.result as unknown as FactoryTransitionResult;\n    if (\n      this.#onAccepted &&\n      options.accept &&\n      committed.status === 'committed' &&\n      result.status === 'accepted' &&\n      committed.item?.acceptedAt\n    ) {\n      const item = committed.item;\n      void Promise.resolve(\n        this.#onAccepted({\n          orgId: request.orgId,\n          factoryProjectId: request.factoryProjectId,\n          workItemId: request.workItemId,\n          item,\n        }),\n      ).catch(error => {\n        console.warn(`[factory] acceptance hook failed for work item ${request.workItemId}:`, error);\n      });\n    }\n    // Only an installed board's declaration releases resources; an unknown board or phase never does.\n    if (\n      this.#onTerminalStage &&\n      result.status === 'accepted' &&\n      this.#boards.get(request.board)?.isTerminal(result.stage) === true\n    ) {\n      let timer: ReturnType<typeof setTimeout> | undefined;\n      try {\n        const cleanup = Promise.resolve(\n          this.#onTerminalStage({\n            orgId: request.orgId,\n            factoryProjectId: request.factoryProjectId,\n            workItemId: request.workItemId,\n            stage: result.stage,\n            revision: result.revision,\n          }),\n        );\n        // A late rejection after the timeout wins the race must not surface\n        // as an unhandled rejection.\n        cleanup.catch(() => {});\n        await Promise.race([\n          cleanup,\n          new Promise<void>(resolve => {\n            timer = setTimeout(resolve, this.#terminalCleanupTimeoutMs);\n          }),\n        ]);\n      } catch {\n        // Resource release is best-effort — never fail a committed transition.\n      } finally {\n        clearTimeout(timer);\n      }\n    }\n    return result;\n  }\n}\n"],"mappings":";;;;;;;;;AAkCA,MAAM,kBAAkB;AACxB,MAAM,uBAAuB;;;;;AAK7B,MAAM,8BAA8B;AA+DpC,SAAS,UACP,cACA,QACA,MACA,QACyB;CACzB,OAAO;EAAE,QAAQ;EAAY;EAAc;EAAQ;EAAM,QAAQ,OAAO,MAAM,GAAG,oBAAoB;CAAE;AACzG;AAEA,SAAS,QAAQ,OAAiC;CAChD,QAAQ,MAAM,MAAd;EACE,KAAK;EACL,KAAK,UACH,OAAO,MAAM;EACf,KAAK,SACH,OAAO,SAAS,MAAM;EACxB,KAAK,UACH,OAAO,UAAU,MAAM;CAC3B;AACF;AAGA,SAAgB,aAAa,OAAyE;CACpG,MAAM,KAAK,QAAQ,KAAK;CACxB,QAAQ,MAAM,MAAd;EACE,KAAK,UACH,OAAO;GAAE,SAAS;GAAI,WAAW;EAAQ;EAC3C,KAAK,SACH,OAAO;GAAE,SAAS;GAAI,WAAW,aAAa,EAAE,IAAI,UAAU;EAAQ;EACxE,SACE,OAAO;GAAE,SAAS;GAAI,WAAW,MAAM;EAAK;CAChD;AACF;AAEA,SAAgB,aAAa,QAAyD;CACpF,IAAI,OAAO,WAAW,GAAG,OAAO,KAAA;CAChC,MAAM,QAAQ,OAAO;CACrB,OAAO,mBAAmB,KAAK,IAAI,QAAQ,KAAA;AAC7C;AAUA,SAAS,kBAAkB,SAAkB,WAAkD;CAC7F,IAAI,CAAC,SAAS,OAAO;CACrB,OAAO,YAAY,QAAQ,KAAA;AAC7B;AAGA,SAAS,aAAa,OAAkC;CACtD,OAAO,MAAM,SAAS,WAAW,MAAM,SAAS;AAClD;AAGA,SAAS,cACP,SACA,SACA,WAC0B;CAC1B,MAAM,WAAW,kBAAkB,SAAS,SAAS;CACrD,OAAO,aAAa,QAAQ,KAAK,IAAI;EAAE;EAAU,aAAa,QAAQ,QAAQ,KAAK;CAAE,IAAI,EAAE,SAAS;AACtG;AAIA,SAAS,UAAU,UAA+D;CAChF,OAAO,SAAS,SAAS,iBAAkB,SAAS,SAAS,iBAAiB,SAAS,mBAAmB;AAC5G;AAGA,SAAS,mBAAmB,SAAmC,UAAqC;CAClG,IAAI,QAAQ,UAAU,aAAa,OAAO;CAC1C,OAAO,QAAQ,MAAM,SAAS,WAAW,QAAQ,MAAM,SAAS,SAAS;AAC3E;AAEA,SAAS,uBAAuB,WAA6B,SAAmC;CAC9F,OAAO,gCAAgC,UAAU,gBAAgB,QAAQ;AAC3E;AAEA,SAAS,cAAc,OAAgF;CACrG,OAAO,MAAM,SAAS,WAAW,MAAM,SAAS;AAClD;AAEA,SAAS,kBAAkB,SAA4C;CACrE,OAAO,QAAQ,MAAM,SAAS,WAAW,QAAQ,QAAQ,SAAS;AACpE;AAEA,SAAS,YAAY,OAAoE;CACvF,OAAO;EACL,MAAM;EACN,QAAQ,iBAAiB,QAAQ,wBAAwB,MAAM,YAAY;CAC7E;AACF;AAEA,eAAe,gBAAmB,WAAuB,WAA+B;CACtF,IAAI;CACJ,MAAM,UAAU,IAAI,SAAgB,GAAG,WAAW;EAChD,QAAQ,iBAAiB,uBAAO,IAAI,MAAM,sBAAsB,CAAC,GAAG,SAAS;CAC/E,CAAC;CACD,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CAAC,WAAW,OAAO,CAAC;CAChD,UAAU;EACR,IAAI,OAAO,aAAa,KAAK;CAC/B;AACF;AAEA,IAAa,2BAAb,MAAsC;CACpC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,SAA0C;EACpD,KAAKA,iBAAiB,QAAQ;EAC9B,KAAKC,UAAU,QAAQ,UAAU,oBAAoB;EACrD,KAAKC,WAAW,QAAQ;EACxB,KAAKK,SAAS,QAAQ;EACtB,KAAKJ,aAAa,QAAQ,aAAa;EACvC,KAAKC,mBAAmB,QAAQ;EAChC,KAAKE,cAAc,QAAQ;EAC3B,KAAKD,4BAA4B,QAAQ,4BAA4B;CACvE;CAEA,IAAI,gBAAwB;EAC1B,OAAO,KAAKL;CACd;CAEA,MAAM,WAAW,SAAqE;EACpF,MAAM,SAAS,MAAM,KAAKE,SAAS,6BACjC,QAAQ,OACR,QAAQ,kBACR,QAAQ,QAAQ,QAClB;EACA,IAAI,QAAQ,OAAO;EAEnB,MAAM,eAAe,QAAQ,QAAQ,gBAAgB,WAAW;EAChE,MAAM,OAAO,MAAM,KAAKA,SAAS,IAAI;GAAE,OAAO,QAAQ;GAAO,IAAI,QAAQ;EAAW,CAAC;EACrF,IAAI,CAAC,MAAM;GACT,MAAM,YAAY,MAAM,KAAKM,iBAC3B,SACA,cACA,sBACA,sBACF;GACA,MAAM,KAAKC,kBAAkB,SAAS,KAAA,GAAW,SAAS;GAC1D,OAAO;EACT;EACA,MAAM,SAAS,MAAM,KAAKC,mBAAmB,SAAS,cAAc,IAAI;EACxE,MAAM,KAAKD,kBAAkB,SAAS,MAAM,MAAM;EAClD,OAAO;CACT;;CAGA,MAAMA,kBACJ,SACA,MACA,QACe;EACf,IAAI,CAAC,KAAKF,QAAQ;EAClB,MAAM,OAAO,OAAO,aAAa,KAAK,MAAM,IAAI,KAAA;EAChD,IAAI,OAAO,WAAW,cAAc,OAAO,UAAU,QAAQ,CAAC,QAAQ,SAAS;EAU/E,MAAM,EAAE,QAAQ,GAAG,WARjB,OAAO,WAAW,aACd;GAAE,QAAQ;GAA0C,IAAI,OAAO;GAAO,UAAU,OAAO;EAAS,IAChG;GACE,QAAQ;GACR,IAAI,QAAQ;GACZ,MAAM,OAAO;GACb,QAAQ,OAAO;EACjB;EAEN,MAAM,KAAKA,OACR,OAAO;GACN,OAAO,QAAQ;GACf,kBAAkB,QAAQ;GAC1B,GAAG,aAAa,QAAQ,KAAK;GAC7B,cAAc,QAAQ;GACtB,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;GACtD;GACA,gBAAgB,OAAO;GACvB,SAAS,CAAC;IAAE,MAAM;IAAa,IAAI,MAAM,MAAM,QAAQ;IAAY,GAAI,OAAO,EAAE,MAAM,KAAK,MAAM,IAAI,CAAC;GAAG,CAAC;GAC1G,UAAU;IACR,cAAc,OAAO;IACrB,aAAa,QAAQ,QAAQ;IAC7B,OAAO,QAAQ;IACf,eAAe,KAAKP;IACpB,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;IACvB,GAAI,QAAQ,UAAU,EAAE,SAAS,KAAK,IAAI,CAAC;IAC3C,GAAG;GACL;EACF,CAAC,CAAC,CACD,OAAM,UAAS;GACd,QAAQ,KAAK,yCAAyC,OAAO,aAAa,IAAI,KAAK;EACrF,CAAC;CACL;CAEA,MAAMU,mBACJ,SACA,cACA,MACkC;EAClC,IAAI,QAAQ,eAAe,QAAQ,YAAY,SAAA,GAC7C,OAAO,KAAKF,iBACV,SACA,cACA,yBACA,qCACF;EAEF,MAAM,aAAa,eAAe,KAAK,cAAc;EACrD,MAAM,SAAS,6BAA6B,UAAU;EACtD,MAAM,cAAc,WAAW,gBAAgB,WAAW;EAC1D,IAAI,KAAK,UAAU,QAAQ,CAAC,KAAKP,QAAQ,IAAI,WAAW,GACtD,OAAO,KAAKO,iBACV,SACA,cACA,sBACA,gJACF;EAEF,MAAM,YAAY,KAAK,SAAS;EAChC,IAAI,QAAQ,UAAU,WACpB,OAAO,KAAKA,iBACV,SACA,cACA,sBACA,mCAAmC,UAAU,UAAU,QAAQ,MAAM,GACvE;EAEF,IAAK,cAAc,YAAY,WAAW,iBAAmB,cAAc,UAAU,WAAW,eAC9F,OAAO,KAAKA,iBACV,SACA,cACA,sBACA,uDACF;EAEF,MAAM,QAAQ,KAAKP,QAAQ,IAAI,QAAQ,KAAK;EAC5C,IAAI,CAAC,OACH,OAAO,KAAKO,iBACV,SACA,cACA,sBACA,UAAU,QAAQ,MAAM,oBAC1B;EAEF,MAAM,YAAY,KAAK,OAAO,WAAW,IAAI,KAAK,OAAO,KAAK,KAAA;EAC9D,IAAI,CAAC,aAAa,CAAC,OAAO,UAAU,eAAe,KAAK,MAAM,QAAQ,SAAS,GAC7E,OAAO,KAAKA,iBACV,SACA,cACA,sBACA,yEACF;EAEF,IACE,CAAC,OAAO,UAAU,eAAe,KAAK,MAAM,QAAQ,QAAQ,KAAK,KACjE,CAAC,MAAM,iBAAiB,WAAW,QAAQ,KAAK,GAEhD,OAAO,KAAKA,iBACV,SACA,cACA,sBACA,OAAO,MAAM,MAAM,oCAAoC,UAAU,MAAM,QAAQ,MAAM,EACvF;EAIF,MAAM,YAAY,QAAQ,MAAM,SAAS,WAAW,cAAc,QAAQ,SAAS,QAAQ,UAAU;EAErG,MAAM,gBAAgB,MAAM,UAAU,QAAQ,KAAK;EACnD,MAAM,WAAW,MAAM,aAAa,QAAQ,KAAK;EAEjD,MAAM,cAAc;GAClB,QAAQ;IAAE,OAAO,QAAQ;IAAO,WAAW,QAAQ;GAAiB;GACpE,OAAO,QAAQ;GACf,SAAS;IAAE,MAAM,QAAQ,QAAQ;IAAM,IAAI,QAAQ,QAAQ;GAAS;GACpE,OAAO,QAAQ;GACf,aAAa,QAAQ,eAAe,CAAC;GACrC,eAAe,KAAKR;GACpB,MAAM;IACJ,IAAI,KAAK;IACT,QAAQ;IACR,WAAW,KAAK,iBACZ,GAAG,KAAK,eAAe,cAAc,GAAG,KAAK,eAAe,KAAK,GAAG,KAAK,eAAe,eACxF;IACJ,kBAAkB,KAAK;IACvB,OAAO,KAAK;IACZ,KAAK,KAAK,gBAAgB,OAAO;IACjC,QAAQ,CAAC,GAAG,KAAK,MAAM;IACvB,YAAY,KAAK;IACjB,UAAU,KAAK;GACjB;GACA,OAAO,QAAQ;GACf,cAAc,KAAK;GACnB;GACA;GACA,SAAS,QAAQ;EACnB;EAEA,IAAI;EAGJ,IAAI;GACF,aAAa,MAAM,iBAChB,YAAY;IACX,MAAM,SAAS,kCAAkC,MAC/C,MAAM,MAAM,mBACV,wBAAwB;KACtB,GAAG;KACH,MAAM;MAAE,GAAG,YAAY;MAAM,YAAY,KAAK;KAAW;KACzD,cAAc,QAAQ,gBAAgB;KACtC,SAAS,QAAQ,WAAW;KAC5B,mBAAmB,kBAAkB,OAAO;KAC5C,qBAAqB,QAAQ;IAC/B,CAAC,CACH,CACF;IACA,IAAI,QAAQ,SAAS,UACnB,OAAO;KAAE,SAAS;KAAqB,MAAM,OAAO;KAAM,QAAQ,OAAO;IAAO;IAElF,IACE,QAAQ,eAAe,KAAA,MACtB,CAAC,cAAc,QAAQ,KAAK,KAC3B,OAAO,eAAe,QAAQ,cAC7B,KAAK,eAAe,QAAQ,KAAK,eAAe,OAAO,aAE1D,MAAM,IAAI,MAAM,wDAAwD;IAE1E,IAAI,QAAQ,UAAU,CAAC,kBAAkB,OAAO,GAC9C,MAAM,IAAI,MAAM,iDAAiD;IAGnE,IACE,QAAQ,MAAM,SAAS,WACvB,CAAC,MAAM,UAAU,SAAS,KAC1B,iBACA,2BAA2B,IAAI,GAE/B,OAAO;KACL,SAAS;KACT,MAAM;KACN,QACE;IACJ;IAEF,MAAM,YAAqC,CAAC;IAC5C,KAAK,MAAM,QAAQ,yBAAyB,KAAKC,SAAS;KACxD,OAAO,QAAQ;KACf;KACA;KACA,SAAS,QAAQ;KACjB,cAAc,QAAQ;KACtB,SAAS,QAAQ;IACnB,CAAC,GAAG;KACF,MAAM,UAAmC,OAAO,OAAO;MACrD,GAAG;MACH,OAAO,KAAK,UAAU,SAAS,YAAY,QAAQ;KACrD,CAAC;KACD,MAAM,MAAM,MAAM,KAAK,QAAQ,OAAO;KACtC,IAAI,QAAQ,KAAA,GAAW;KACvB,MAAM,WAAW,4BAA4B,KAAK,QAAQ,YAAY,MAAM;KAC5E,IAAI,SAAS,SAAS,UACpB,OAAO;MAAE,SAAS;MAAqB,MAAM,SAAS;MAAM,QAAQ,SAAS;KAAO;KAEtF,4BAA4B,UAAU,KAAKA,SAAS,SAAS;KAC7D,IAAI,UAAU,QAAQ,KAAK,mBAAmB,SAAS,QAAQ,GAAG;KAClE,UAAU,KAAK,QAAQ;IACzB;IACA,MAAM,YAAY,6BAA6B,SAAS;IACxD,IAAI,WAAW;KACb,MAAM,UAAU,uBAAuB,WAAW,QAAQ,KAAK;KAC/D,MAAM,QAAQ,UAAU,MAAK,aAAY,SAAS,SAAS,aAAa;KACxE,IAAI,OACF,MAAM,mBAAmB;UAEzB,UAAU,QAAQ;MAChB,MAAM;MACN,gBAAgB,iBAAiB;MACjC;MACA,UAAU;MACV,cAAc;MAGd,GAAI,iBAAiB,aAAa,KAAA,IAAY;OAAE,MAAM;OAAU,gBAAgB;MAAK,IAAI,CAAC;KAC5F,CAAC;IAEL;IACA,OAAO;KACL,SAAS;KACT,SAAS;MAAE,YAAY,QAAQ;MAAY,QAAQ,QAAQ,WAAW,QAAQ,CAAC,KAAK;KAAW;KAC/F,WAAW,6BAA6B,SAAS;IACnD;GACF,EAAA,CAAG,GACH,KAAKE,UACP;EACF,SAAS,OAAO;GAKd,aAAa;IAAE,SAAS;IAAY,GAHlC,iBAAiB,SAAS,MAAM,YAAY,yBACxC;KAAE,MAAM;KAAoB,QAAQ;IAAqC,IACzE,YAAY,KAAK;GACuB;EAChD;EACA,OAAO,KAAKQ,QACV,SACA,cACA,YACA,WAAW,YAAY,aACnB;GAAE,GAAG,cAAc,SAAS,eAAe,SAAS;GAAG,GAAG,WAAW;EAAQ,IAC7E,CAAC,CACP;CACF;CAEA,MAAMH,iBACJ,SACA,cACA,MACA,QACkC;EAClC,OAAO,KAAKG,QAAQ,SAAS,cAAc;GAAE,SAAS;GAAY;GAAM;EAAO,CAAC;CAClF;CAEA,MAAMA,QACJ,SACA,cACA,YAGA,UAAoC,CAAC,GACH;EAClC,MAAM,YAAY,MAAM,KAAKT,SAAS,iBAAiB;GACrD,UAAU,QAAQ;GAClB,aAAa,QAAQ;GACrB,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;GACzC,OAAO,QAAQ;GACf,kBAAkB,QAAQ;GAC1B,YAAY,QAAQ;GACpB,kBAAkB,QAAQ;GAC1B,kBAAkB,QAAQ;GAC1B,SAAS,QAAQ,QAAQ,KAAK;GAC9B,SAAS;IAAE,UAAU,QAAQ,QAAQ;IAAU,aAAa,QAAQ,QAAQ;IAAM;GAAa;GAC/F,eAAe,KAAKF;GACpB,aAAa,CAAC,GAAI,QAAQ,eAAe,CAAC,CAAE;GAC5C;GACA,GAAI,QAAQ,aAAa,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;EACjE,CAAC;EACD,IAAI,UAAU,WAAW,WACvB,OAAO,UAAU,cAAc,QAAQ,YAAY,sBAAsB,sBAAsB;EAEjG,MAAM,SAAS,UAAU;EACzB,IACE,KAAKM,eACL,QAAQ,UACR,UAAU,WAAW,eACrB,OAAO,WAAW,cAClB,UAAU,MAAM,YAChB;GACA,MAAM,OAAO,UAAU;GACvB,QAAa,QACX,KAAKA,YAAY;IACf,OAAO,QAAQ;IACf,kBAAkB,QAAQ;IAC1B,YAAY,QAAQ;IACpB;GACF,CAAC,CACH,CAAC,CAAC,OAAM,UAAS;IACf,QAAQ,KAAK,kDAAkD,QAAQ,WAAW,IAAI,KAAK;GAC7F,CAAC;EACH;EAEA,IACE,KAAKF,oBACL,OAAO,WAAW,cAClB,KAAKH,QAAQ,IAAI,QAAQ,KAAK,CAAC,EAAE,WAAW,OAAO,KAAK,MAAM,MAC9D;GACA,IAAI;GACJ,IAAI;IACF,MAAM,UAAU,QAAQ,QACtB,KAAKG,iBAAiB;KACpB,OAAO,QAAQ;KACf,kBAAkB,QAAQ;KAC1B,YAAY,QAAQ;KACpB,OAAO,OAAO;KACd,UAAU,OAAO;IACnB,CAAC,CACH;IAGA,QAAQ,YAAY,CAAC,CAAC;IACtB,MAAM,QAAQ,KAAK,CACjB,SACA,IAAI,SAAc,YAAW;KAC3B,QAAQ,WAAW,SAAS,KAAKC,yBAAyB;IAC5D,CAAC,CACH,CAAC;GACH,QAAQ,CAER,UAAU;IACR,aAAa,KAAK;GACpB;EACF;EACA,OAAO;CACT;AACF"}
+{"version":3,"file":"transition-service.js","names":["#configVersion","#boards","#storage","#timeoutMs","#onTerminalStage","#terminalCleanupTimeoutMs","#onAccepted","#autoApprovePlans","#audit","#commitRejection","#recordTransition","#evaluateAndCommit","#commit"],"sources":["../../src/rules/transition-service.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\n\nimport { createBoardRegistry } from '../boards/index.js';\nimport type { BoardRegistry } from '../boards/index.js';\nimport { boardTransitionPolicyResultSchema, immutablePolicySnapshot } from '../boards/transition-policy.js';\nimport type { AuditActorProfileInput, AuditActorType, AuditContext } from '../storage/domains/audit/base.js';\nimport type { AuditRecorder } from '../storage/domains/audit/domain.js';\nimport { isAgentActor } from '../storage/domains/work-items/base.js';\nimport type { WorkItemRow, WorkItemsStorage } from '../storage/domains/work-items/base.js';\nimport { resolveFactoryStageRules } from './resolve.js';\nimport type {\n  FactoryCommitDecision,\n  FactoryRuleActor,\n  FactoryRuleBoard,\n  FactoryRuleCausalEntry,\n  FactoryRuleRejectionCode,\n  FactoryRuleStage,\n  FactoryTriageType,\n  FactoryStageRuleContext,\n  FactoryTransitionResult,\n} from './types.js';\nimport {\n  externallyAuthoredWorkItem,\n  factoryRuleSourceForWorkItem,\n  isFactoryRuleStage,\n  workItemSource,\n} from './types.js';\nimport {\n  MAX_FACTORY_RULE_CAUSAL_DEPTH,\n  assertFactoryDecisionTarget,\n  validateFactoryRuleDecision,\n  validateFactoryRuleDecisions,\n} from './validation.js';\n\nconst RULE_TIMEOUT_MS = 5_000;\nconst MAX_REJECTION_REASON = 512;\n/** Longest a committed transition waits for terminal resource cleanup. Cleanup\n * reattaches remote sandboxes, so a hung provider call must not leave the\n * already-committed transition request pending; past this bound the cleanup\n * keeps running in the background as pure best-effort. */\nconst TERMINAL_CLEANUP_TIMEOUT_MS = 30_000;\n\nexport interface FactoryTransitionRequest {\n  orgId: string;\n  factoryProjectId: string;\n  workItemId: string;\n  /** Installed board id; the service rejects boards that are not installed. */\n  board: string;\n  stage: FactoryRuleStage;\n  expectedRevision: number;\n  actor: FactoryRuleActor;\n  actorProfile?: AuditActorProfileInput;\n  /** Where a browser request came from; rules and agents carry none. */\n  context?: AuditContext;\n  ingress: { type: 'human' | 'agent' | 'toolResult' | 'github' | 'rule'; identity: string; transitionId?: string };\n  cause: string;\n  causalChain?: readonly FactoryRuleCausalEntry[];\n  /** Internal materialization path: evaluate only the destination onEnter leaf even when already at that stage. */\n  initialEntry?: boolean;\n  /** Re-runs the stage's entry rules when the item already holds that stage, to restart work the entry invalidated. */\n  reenter?: boolean;\n  /** Structured verdict required from a bound triage-agent terminal request. */\n  triageType?: FactoryTriageType;\n}\n\nexport interface FactoryTransitionServiceOptions {\n  configVersion: string;\n  storage: WorkItemsStorage;\n  boards?: BoardRegistry;\n  /** Every commit, accepted or rejected, lands here as `stage_moved` / `transition_rejected` under the request's actor. */\n  audit?: AuditRecorder;\n  timeoutMs?: number;\n  /**\n   * Called after a transition commits into a phase the board declares\n   * terminal — the point where the item's sessions stop receiving runs, so\n   * resources they hold (e.g. sandboxes) can be released for reuse. Awaited,\n   * but failures are swallowed: releasing resources must never break or roll\n   * back the committed transition.\n   */\n  onTerminalStage?: (args: {\n    orgId: string;\n    factoryProjectId: string;\n    workItemId: string;\n    stage: FactoryRuleStage;\n    revision: number;\n  }) => Promise<void> | void;\n  /** Upper bound on how long a committed transition waits for\n   * `onTerminalStage` before returning (default 30s). The cleanup continues\n   * in the background past the bound. */\n  terminalCleanupTimeoutMs?: number;\n  /**\n   * Called after a transition first records a person's acceptance of a\n   * non-bug item (see `WorkItemRow.acceptedAt`). Fire-and-forget: failures\n   * are swallowed, the committed transition never depends on it.\n   */\n  onAccepted?: (args: {\n    orgId: string;\n    factoryProjectId: string;\n    workItemId: string;\n    item: WorkItemRow;\n  }) => Promise<void> | void;\n  /**\n   * Resolves whether a project auto-approves produced plans. Mirrors the\n   * dispatcher's resolver so the two share a single authoritative predicate\n   * (`plansPreapprovedAt` on the item, or this per-project setting). Unset means\n   * off: a plan nobody armed for auto-advance is a plan a person must review.\n   */\n  autoApprovePlans?: (tenant: { orgId: string; factoryProjectId: string }) => Promise<boolean>;\n}\n\nfunction rejection(\n  transitionId: string,\n  itemId: string,\n  code: FactoryRuleRejectionCode,\n  reason: string,\n): FactoryTransitionResult {\n  return { status: 'rejected', transitionId, itemId, code, reason: reason.slice(0, MAX_REJECTION_REASON) };\n}\n\nfunction actorId(actor: FactoryRuleActor): string {\n  switch (actor.type) {\n    case 'human':\n    case 'system':\n      return actor.id;\n    case 'agent':\n      return `agent:${actor.bindingId}`;\n    case 'github':\n      return `github:${actor.login}`;\n  }\n}\n\n// The dispatcher executes an agent-approved decision as a human actor so its consent carries; the trail still names the agent.\nexport function auditActorOf(actor: FactoryRuleActor): { actorId: string; actorType: AuditActorType } {\n  const id = actorId(actor);\n  switch (actor.type) {\n    case 'github':\n      return { actorId: id, actorType: 'human' };\n    case 'human':\n      return { actorId: id, actorType: isAgentActor(id) ? 'agent' : 'human' };\n    default:\n      return { actorId: id, actorType: actor.type };\n  }\n}\n\nexport function currentStage(stages: readonly string[]): FactoryRuleStage | undefined {\n  if (stages.length !== 1) return undefined;\n  const stage = stages[0];\n  return isFactoryRuleStage(stage) ? stage : undefined;\n}\n\ninterface TransitionConsentOptions {\n  autonomy?: 'arm' | 'disarm';\n  consentedBy?: string;\n  accept?: boolean;\n  triageType?: FactoryTriageType;\n}\n\n// Entering a resting lane disarms whoever rests it; only a person's move into a working lane arms.\nfunction transitionConsent(working: boolean, humanMove: boolean): 'arm' | 'disarm' | undefined {\n  if (!working) return 'disarm';\n  return humanMove ? 'arm' : undefined;\n}\n\n// An event arriving as data (GitHub, sweeps) never pre-approves the runs its transition queues.\nfunction bearsConsent(actor: FactoryRuleActor): boolean {\n  return actor.type === 'human' || actor.type === 'agent';\n}\n\n// Rides the transition's own revision-checked commit, so a stale or rejected commit flips nothing.\nfunction consentEffect(\n  request: FactoryTransitionRequest,\n  working: boolean,\n  humanMove: boolean,\n): TransitionConsentOptions {\n  const autonomy = transitionConsent(working, humanMove);\n  return bearsConsent(request.actor) ? { autonomy, consentedBy: actorId(request.actor) } : { autonomy };\n}\n\ntype RunStartDecision = Extract<FactoryCommitDecision, { type: 'invokeSkill' | 'sendMessage' }>;\n\nfunction startsRun(decision: FactoryCommitDecision): decision is RunStartDecision {\n  return decision.type === 'invokeSkill' || (decision.type === 'sendMessage' && decision.prepareBinding === true);\n}\n\n// Answering a recorded run start, or the role's own mid-run agent, with a run would start a second one.\nfunction runAlreadyUnderway(request: FactoryTransitionRequest, decision: RunStartDecision): boolean {\n  if (request.cause === 'run_start') return true;\n  return request.actor.type === 'agent' && request.actor.role === decision.role;\n}\n\nfunction stageTransitionMessage(fromStage: FactoryRuleStage, toStage: FactoryRuleStage): string {\n  return `This work was moved from the ${fromStage} stage to the ${toStage} stage.`;\n}\n\nfunction isTriageAgent(actor: FactoryRuleActor): actor is Extract<FactoryRuleActor, { type: 'agent' }> {\n  return actor.type === 'agent' && actor.role === 'triage';\n}\n\nfunction isHumanTransition(request: FactoryTransitionRequest): boolean {\n  return request.actor.type === 'human' && request.ingress.type === 'human';\n}\n\nfunction ruleFailure(error: unknown): { code: FactoryRuleRejectionCode; reason: string } {\n  return {\n    code: 'rule_error',\n    reason: error instanceof Error ? `Factory rule failed: ${error.message}` : 'Factory rule failed.',\n  };\n}\n\nasync function withRuleTimeout<T>(operation: Promise<T>, timeoutMs: number): Promise<T> {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const timeout = new Promise<never>((_, reject) => {\n    timer = setTimeout(() => reject(new Error('FACTORY_RULE_TIMEOUT')), timeoutMs);\n  });\n  try {\n    return await Promise.race([operation, timeout]);\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n\nexport class FactoryTransitionService {\n  readonly #configVersion: string;\n  readonly #boards: BoardRegistry;\n  readonly #storage: WorkItemsStorage;\n  readonly #timeoutMs: number;\n  readonly #onTerminalStage: FactoryTransitionServiceOptions['onTerminalStage'];\n  readonly #terminalCleanupTimeoutMs: number;\n  readonly #onAccepted: FactoryTransitionServiceOptions['onAccepted'];\n  readonly #autoApprovePlans: FactoryTransitionServiceOptions['autoApprovePlans'];\n  readonly #audit: AuditRecorder | undefined;\n\n  constructor(options: FactoryTransitionServiceOptions) {\n    this.#configVersion = options.configVersion;\n    this.#boards = options.boards ?? createBoardRegistry();\n    this.#storage = options.storage;\n    this.#audit = options.audit;\n    this.#timeoutMs = options.timeoutMs ?? RULE_TIMEOUT_MS;\n    this.#onTerminalStage = options.onTerminalStage;\n    this.#onAccepted = options.onAccepted;\n    this.#autoApprovePlans = options.autoApprovePlans;\n    this.#terminalCleanupTimeoutMs = options.terminalCleanupTimeoutMs ?? TERMINAL_CLEANUP_TIMEOUT_MS;\n  }\n\n  get configVersion(): string {\n    return this.#configVersion;\n  }\n\n  async transition(request: FactoryTransitionRequest): Promise<FactoryTransitionResult> {\n    const replay = await this.#storage.getTransitionResultByIngress(\n      request.orgId,\n      request.factoryProjectId,\n      request.ingress.identity,\n    );\n    if (replay) return replay as unknown as FactoryTransitionResult;\n\n    const transitionId = request.ingress.transitionId ?? randomUUID();\n    const item = await this.#storage.get({ orgId: request.orgId, id: request.workItemId });\n    if (!item) {\n      const rejection = await this.#commitRejection(\n        request,\n        transitionId,\n        'invalid_transition',\n        'Work item not found.',\n      );\n      await this.#recordTransition(request, undefined, rejection);\n      return rejection;\n    }\n    const result = await this.#evaluateAndCommit(request, transitionId, item);\n    await this.#recordTransition(request, item, result);\n    return result;\n  }\n\n  /** A rejection can outlive its work item: the row still names the id the caller asked for. */\n  async #recordTransition(\n    request: FactoryTransitionRequest,\n    item: WorkItemRow | undefined,\n    result: FactoryTransitionResult,\n  ): Promise<void> {\n    if (!this.#audit) return;\n    const from = item ? currentStage(item.stages) : undefined;\n    if (result.status === 'accepted' && result.stage === from && !request.reenter) return;\n    const outcome =\n      result.status === 'accepted'\n        ? { action: 'factory.work_item.stage_moved' as const, to: result.stage, revision: result.revision }\n        : {\n            action: 'factory.work_item.transition_rejected' as const,\n            to: request.stage,\n            code: result.code,\n            reason: result.reason,\n          };\n    const { action, ...detail } = outcome;\n    await this.#audit\n      .record({\n        orgId: request.orgId,\n        factoryProjectId: request.factoryProjectId,\n        ...auditActorOf(request.actor),\n        actorProfile: request.actorProfile,\n        ...(request.context ? { context: request.context } : {}),\n        action,\n        idempotencyKey: result.transitionId,\n        targets: [{ type: 'work_item', id: item?.id ?? request.workItemId, ...(item ? { name: item.title } : {}) }],\n        metadata: {\n          transitionId: result.transitionId,\n          ingressType: request.ingress.type,\n          cause: request.cause,\n          configVersion: this.#configVersion,\n          ...(from ? { from } : {}),\n          ...(request.reenter ? { reenter: true } : {}),\n          ...detail,\n        },\n      })\n      .catch(error => {\n        console.warn(`[factory] audit failed for transition ${result.transitionId}:`, error);\n      });\n  }\n\n  async #evaluateAndCommit(\n    request: FactoryTransitionRequest,\n    transitionId: string,\n    item: WorkItemRow,\n  ): Promise<FactoryTransitionResult> {\n    if (request.causalChain && request.causalChain.length > MAX_FACTORY_RULE_CAUSAL_DEPTH) {\n      return this.#commitRejection(\n        request,\n        transitionId,\n        'causal_depth_exceeded',\n        'Factory rule causal depth exceeded.',\n      );\n    }\n    const itemSource = workItemSource(item.externalSource);\n    const source = factoryRuleSourceForWorkItem(itemSource);\n    const legacyBoard = source === 'pullRequest' ? 'review' : 'work';\n    if (item.board === null && !this.#boards.has(legacyBoard)) {\n      return this.#commitRejection(\n        request,\n        transitionId,\n        'invalid_transition',\n        'This legacy work item has no assigned board. Assign an installed board and phase through the work-item PATCH endpoint before transitioning it.',\n      );\n    }\n    const itemBoard = item.board ?? legacyBoard;\n    if (request.board !== itemBoard) {\n      return this.#commitRejection(\n        request,\n        transitionId,\n        'invalid_transition',\n        `The work item belongs to board \"${itemBoard}\", not \"${request.board}\".`,\n      );\n    }\n    if ((itemBoard === 'review' && source !== 'pullRequest') || (itemBoard === 'work' && source === 'pullRequest')) {\n      return this.#commitRejection(\n        request,\n        transitionId,\n        'invalid_transition',\n        'The work item does not belong to the requested board.',\n      );\n    }\n    const board = this.#boards.get(request.board);\n    if (!board) {\n      return this.#commitRejection(\n        request,\n        transitionId,\n        'invalid_transition',\n        `Board \"${request.board}\" is not installed.`,\n      );\n    }\n    const fromStage = item.stages.length === 1 ? item.stages[0] : undefined;\n    if (!fromStage || !Object.prototype.hasOwnProperty.call(board.phases, fromStage)) {\n      return this.#commitRejection(\n        request,\n        transitionId,\n        'invalid_transition',\n        'The work item does not have one canonical phase on the requested board.',\n      );\n    }\n    if (\n      !Object.prototype.hasOwnProperty.call(board.phases, request.stage) ||\n      !board.allowsTransition(fromStage, request.stage)\n    ) {\n      return this.#commitRejection(\n        request,\n        transitionId,\n        'invalid_transition',\n        `The ${board.title} board does not allow moving from ${fromStage} to ${request.stage}.`,\n      );\n    }\n\n    // The coordinator's own self-move at run start would otherwise inject a second run's kickoff.\n    const humanMove = request.actor.type === 'human' && fromStage !== request.stage && request.cause !== 'run_start';\n    // The board, not the phase name, says whether a seat is engaged on either side of this move.\n    const entersWorking = board.isWorking(request.stage);\n    const seatRole = board.roleForPhase(request.stage);\n\n    const contextBase = {\n      tenant: { orgId: request.orgId, projectId: request.factoryProjectId },\n      actor: request.actor,\n      ingress: { type: request.ingress.type, id: request.ingress.identity },\n      cause: request.cause,\n      causalChain: request.causalChain ?? [],\n      configVersion: this.#configVersion,\n      item: {\n        id: item.id,\n        source: itemSource,\n        sourceKey: item.externalSource\n          ? `${item.externalSource.integrationId}:${item.externalSource.type}:${item.externalSource.externalId}`\n          : null,\n        parentWorkItemId: item.parentWorkItemId,\n        title: item.title,\n        url: item.externalSource?.url ?? null,\n        stages: [...item.stages],\n        acceptedAt: item.acceptedAt,\n        metadata: item.metadata,\n      },\n      board: request.board,\n      itemRevision: item.revision,\n      source,\n      fromStage,\n      toStage: request.stage,\n    } satisfies Omit<FactoryStageRuleContext, 'stage'>;\n\n    let evaluation:\n      | { outcome: 'accepted'; decisions: Record<string, unknown>[]; intents: TransitionConsentOptions }\n      | { outcome: 'rejected'; code: string; reason: string };\n    try {\n      evaluation = await withRuleTimeout(\n        (async () => {\n          // Single authoritative plan-approval predicate, shared with the dispatcher's\n          // `#plansAreAutoApproved`: a per-item preapproval, or the project setting.\n          // Resolved inside the timed block so a resolver rejection surfaces as a\n          // committed rule_error and a slow lookup is bounded by RULE_TIMEOUT_MS.\n          const plansAutoApproved =\n            item.plansPreapprovedAt != null ||\n            (this.#autoApprovePlans\n              ? await this.#autoApprovePlans({ orgId: request.orgId, factoryProjectId: request.factoryProjectId })\n              : false);\n          const policy = boardTransitionPolicyResultSchema.parse(\n            await board.transitionPolicy?.(\n              immutablePolicySnapshot({\n                ...contextBase,\n                item: { ...contextBase.item, triageType: item.triageType },\n                initialEntry: request.initialEntry ?? false,\n                reenter: request.reenter ?? false,\n                isHumanTransition: isHumanTransition(request),\n                plansAutoApproved,\n                requestedTriageType: request.triageType,\n              }),\n            ),\n          );\n          if (policy?.type === 'reject') {\n            return { outcome: 'rejected' as const, code: policy.code, reason: policy.reason };\n          }\n          if (\n            policy?.triageType !== undefined &&\n            (!isTriageAgent(request.actor) ||\n              policy.triageType !== request.triageType ||\n              (item.triageType !== null && item.triageType !== policy.triageType))\n          ) {\n            throw new Error('Board policy requested an unauthorized classification.');\n          }\n          if (policy?.accept && !isHumanTransition(request)) {\n            throw new Error('Board policy requested unauthorized acceptance.');\n          }\n          // External content can steer a bound agent; board allowance cannot bypass this guard.\n          if (\n            request.actor.type === 'agent' &&\n            !board.isWorking(fromStage) &&\n            entersWorking &&\n            externallyAuthoredWorkItem(item)\n          ) {\n            return {\n              outcome: 'rejected' as const,\n              code: 'approval_required',\n              reason:\n                'This card comes from outside the write-access circle; a person must resume it from the Factory board.',\n            };\n          }\n          const decisions: FactoryCommitDecision[] = [];\n          for (const rule of resolveFactoryStageRules(this.#boards, {\n            board: request.board,\n            source,\n            fromStage,\n            toStage: request.stage,\n            initialEntry: request.initialEntry,\n            reenter: request.reenter,\n          })) {\n            const context: FactoryStageRuleContext = Object.freeze({\n              ...contextBase,\n              stage: rule.phase === 'exit' ? fromStage : request.stage,\n            });\n            const raw = await rule.handler(context);\n            if (raw === undefined) continue;\n            const decision = validateFactoryRuleDecision(raw, context.causalChain.length);\n            if (decision.type === 'reject') {\n              return { outcome: 'rejected' as const, code: decision.code, reason: decision.reason };\n            }\n            assertFactoryDecisionTarget(decision, this.#boards, itemBoard);\n            if (startsRun(decision) && runAlreadyUnderway(request, decision)) continue;\n            decisions.push(decision);\n          }\n          const validated = validateFactoryRuleDecisions(decisions);\n          if (humanMove) {\n            const message = stageTransitionMessage(fromStage, request.stage);\n            const skill = validated.find(decision => decision.type === 'invokeSkill');\n            if (skill) {\n              skill.precedingMessage = message;\n            } else {\n              validated.unshift({\n                type: 'sendMessage',\n                idempotencyKey: `factory-stage:${transitionId}`,\n                message,\n                priority: 'urgent',\n                idleBehavior: 'wake',\n                // Parking a card says stop: no seat is right by construction, so\n                // the notice goes to whichever session is live — or nobody.\n                ...(entersWorking && seatRole !== undefined ? { role: seatRole, prepareBinding: true } : {}),\n              });\n            }\n          }\n          return {\n            outcome: 'accepted' as const,\n            intents: { triageType: policy?.triageType, accept: policy?.accept === true && !item.acceptedAt },\n            decisions: validateFactoryRuleDecisions(validated) as unknown as Record<string, unknown>[],\n          };\n        })(),\n        this.#timeoutMs,\n      );\n    } catch (error) {\n      const failed =\n        error instanceof Error && error.message === 'FACTORY_RULE_TIMEOUT'\n          ? { code: 'timeout' as const, reason: 'Factory rule evaluation timed out.' }\n          : ruleFailure(error);\n      evaluation = { outcome: 'rejected', ...failed };\n    }\n    return this.#commit(\n      request,\n      transitionId,\n      evaluation,\n      evaluation.outcome === 'accepted'\n        ? { ...consentEffect(request, entersWorking, humanMove), ...evaluation.intents }\n        : {},\n    );\n  }\n\n  async #commitRejection(\n    request: FactoryTransitionRequest,\n    transitionId: string,\n    code: FactoryRuleRejectionCode,\n    reason: string,\n  ): Promise<FactoryTransitionResult> {\n    return this.#commit(request, transitionId, { outcome: 'rejected', code, reason });\n  }\n\n  async #commit(\n    request: FactoryTransitionRequest,\n    transitionId: string,\n    evaluation:\n      | { outcome: 'accepted'; decisions: Record<string, unknown>[] }\n      | { outcome: 'rejected'; code: string; reason: string },\n    options: TransitionConsentOptions = {},\n  ): Promise<FactoryTransitionResult> {\n    const committed = await this.#storage.commitTransition({\n      autonomy: options.autonomy,\n      consentedBy: options.consentedBy,\n      ...(options.accept ? { accept: true } : {}),\n      orgId: request.orgId,\n      factoryProjectId: request.factoryProjectId,\n      workItemId: request.workItemId,\n      expectedRevision: request.expectedRevision,\n      destinationStage: request.stage,\n      actorId: actorId(request.actor),\n      ingress: { identity: request.ingress.identity, triggerType: request.ingress.type, transitionId },\n      configVersion: this.#configVersion,\n      causalChain: [...(request.causalChain ?? [])],\n      evaluation,\n      ...(options.triageType ? { triageType: options.triageType } : {}),\n    });\n    if (committed.status === 'missing') {\n      return rejection(transitionId, request.workItemId, 'invalid_transition', 'Work item not found.');\n    }\n    const result = committed.result as unknown as FactoryTransitionResult;\n    if (\n      this.#onAccepted &&\n      options.accept &&\n      committed.status === 'committed' &&\n      result.status === 'accepted' &&\n      committed.item?.acceptedAt\n    ) {\n      const item = committed.item;\n      void Promise.resolve(\n        this.#onAccepted({\n          orgId: request.orgId,\n          factoryProjectId: request.factoryProjectId,\n          workItemId: request.workItemId,\n          item,\n        }),\n      ).catch(error => {\n        console.warn(`[factory] acceptance hook failed for work item ${request.workItemId}:`, error);\n      });\n    }\n    // Only an installed board's declaration releases resources; an unknown board or phase never does.\n    if (\n      this.#onTerminalStage &&\n      result.status === 'accepted' &&\n      this.#boards.get(request.board)?.isTerminal(result.stage) === true\n    ) {\n      let timer: ReturnType<typeof setTimeout> | undefined;\n      try {\n        const cleanup = Promise.resolve(\n          this.#onTerminalStage({\n            orgId: request.orgId,\n            factoryProjectId: request.factoryProjectId,\n            workItemId: request.workItemId,\n            stage: result.stage,\n            revision: result.revision,\n          }),\n        );\n        // A late rejection after the timeout wins the race must not surface\n        // as an unhandled rejection.\n        cleanup.catch(() => {});\n        await Promise.race([\n          cleanup,\n          new Promise<void>(resolve => {\n            timer = setTimeout(resolve, this.#terminalCleanupTimeoutMs);\n          }),\n        ]);\n      } catch {\n        // Resource release is best-effort — never fail a committed transition.\n      } finally {\n        clearTimeout(timer);\n      }\n    }\n    return result;\n  }\n}\n"],"mappings":";;;;;;;;;AAkCA,MAAM,kBAAkB;AACxB,MAAM,uBAAuB;;;;;AAK7B,MAAM,8BAA8B;AAsEpC,SAAS,UACP,cACA,QACA,MACA,QACyB;CACzB,OAAO;EAAE,QAAQ;EAAY;EAAc;EAAQ;EAAM,QAAQ,OAAO,MAAM,GAAG,oBAAoB;CAAE;AACzG;AAEA,SAAS,QAAQ,OAAiC;CAChD,QAAQ,MAAM,MAAd;EACE,KAAK;EACL,KAAK,UACH,OAAO,MAAM;EACf,KAAK,SACH,OAAO,SAAS,MAAM;EACxB,KAAK,UACH,OAAO,UAAU,MAAM;CAC3B;AACF;AAGA,SAAgB,aAAa,OAAyE;CACpG,MAAM,KAAK,QAAQ,KAAK;CACxB,QAAQ,MAAM,MAAd;EACE,KAAK,UACH,OAAO;GAAE,SAAS;GAAI,WAAW;EAAQ;EAC3C,KAAK,SACH,OAAO;GAAE,SAAS;GAAI,WAAW,aAAa,EAAE,IAAI,UAAU;EAAQ;EACxE,SACE,OAAO;GAAE,SAAS;GAAI,WAAW,MAAM;EAAK;CAChD;AACF;AAEA,SAAgB,aAAa,QAAyD;CACpF,IAAI,OAAO,WAAW,GAAG,OAAO,KAAA;CAChC,MAAM,QAAQ,OAAO;CACrB,OAAO,mBAAmB,KAAK,IAAI,QAAQ,KAAA;AAC7C;AAUA,SAAS,kBAAkB,SAAkB,WAAkD;CAC7F,IAAI,CAAC,SAAS,OAAO;CACrB,OAAO,YAAY,QAAQ,KAAA;AAC7B;AAGA,SAAS,aAAa,OAAkC;CACtD,OAAO,MAAM,SAAS,WAAW,MAAM,SAAS;AAClD;AAGA,SAAS,cACP,SACA,SACA,WAC0B;CAC1B,MAAM,WAAW,kBAAkB,SAAS,SAAS;CACrD,OAAO,aAAa,QAAQ,KAAK,IAAI;EAAE;EAAU,aAAa,QAAQ,QAAQ,KAAK;CAAE,IAAI,EAAE,SAAS;AACtG;AAIA,SAAS,UAAU,UAA+D;CAChF,OAAO,SAAS,SAAS,iBAAkB,SAAS,SAAS,iBAAiB,SAAS,mBAAmB;AAC5G;AAGA,SAAS,mBAAmB,SAAmC,UAAqC;CAClG,IAAI,QAAQ,UAAU,aAAa,OAAO;CAC1C,OAAO,QAAQ,MAAM,SAAS,WAAW,QAAQ,MAAM,SAAS,SAAS;AAC3E;AAEA,SAAS,uBAAuB,WAA6B,SAAmC;CAC9F,OAAO,gCAAgC,UAAU,gBAAgB,QAAQ;AAC3E;AAEA,SAAS,cAAc,OAAgF;CACrG,OAAO,MAAM,SAAS,WAAW,MAAM,SAAS;AAClD;AAEA,SAAS,kBAAkB,SAA4C;CACrE,OAAO,QAAQ,MAAM,SAAS,WAAW,QAAQ,QAAQ,SAAS;AACpE;AAEA,SAAS,YAAY,OAAoE;CACvF,OAAO;EACL,MAAM;EACN,QAAQ,iBAAiB,QAAQ,wBAAwB,MAAM,YAAY;CAC7E;AACF;AAEA,eAAe,gBAAmB,WAAuB,WAA+B;CACtF,IAAI;CACJ,MAAM,UAAU,IAAI,SAAgB,GAAG,WAAW;EAChD,QAAQ,iBAAiB,uBAAO,IAAI,MAAM,sBAAsB,CAAC,GAAG,SAAS;CAC/E,CAAC;CACD,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CAAC,WAAW,OAAO,CAAC;CAChD,UAAU;EACR,IAAI,OAAO,aAAa,KAAK;CAC/B;AACF;AAEA,IAAa,2BAAb,MAAsC;CACpC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,SAA0C;EACpD,KAAKA,iBAAiB,QAAQ;EAC9B,KAAKC,UAAU,QAAQ,UAAU,oBAAoB;EACrD,KAAKC,WAAW,QAAQ;EACxB,KAAKM,SAAS,QAAQ;EACtB,KAAKL,aAAa,QAAQ,aAAa;EACvC,KAAKC,mBAAmB,QAAQ;EAChC,KAAKE,cAAc,QAAQ;EAC3B,KAAKC,oBAAoB,QAAQ;EACjC,KAAKF,4BAA4B,QAAQ,4BAA4B;CACvE;CAEA,IAAI,gBAAwB;EAC1B,OAAO,KAAKL;CACd;CAEA,MAAM,WAAW,SAAqE;EACpF,MAAM,SAAS,MAAM,KAAKE,SAAS,6BACjC,QAAQ,OACR,QAAQ,kBACR,QAAQ,QAAQ,QAClB;EACA,IAAI,QAAQ,OAAO;EAEnB,MAAM,eAAe,QAAQ,QAAQ,gBAAgB,WAAW;EAChE,MAAM,OAAO,MAAM,KAAKA,SAAS,IAAI;GAAE,OAAO,QAAQ;GAAO,IAAI,QAAQ;EAAW,CAAC;EACrF,IAAI,CAAC,MAAM;GACT,MAAM,YAAY,MAAM,KAAKO,iBAC3B,SACA,cACA,sBACA,sBACF;GACA,MAAM,KAAKC,kBAAkB,SAAS,KAAA,GAAW,SAAS;GAC1D,OAAO;EACT;EACA,MAAM,SAAS,MAAM,KAAKC,mBAAmB,SAAS,cAAc,IAAI;EACxE,MAAM,KAAKD,kBAAkB,SAAS,MAAM,MAAM;EAClD,OAAO;CACT;;CAGA,MAAMA,kBACJ,SACA,MACA,QACe;EACf,IAAI,CAAC,KAAKF,QAAQ;EAClB,MAAM,OAAO,OAAO,aAAa,KAAK,MAAM,IAAI,KAAA;EAChD,IAAI,OAAO,WAAW,cAAc,OAAO,UAAU,QAAQ,CAAC,QAAQ,SAAS;EAU/E,MAAM,EAAE,QAAQ,GAAG,WARjB,OAAO,WAAW,aACd;GAAE,QAAQ;GAA0C,IAAI,OAAO;GAAO,UAAU,OAAO;EAAS,IAChG;GACE,QAAQ;GACR,IAAI,QAAQ;GACZ,MAAM,OAAO;GACb,QAAQ,OAAO;EACjB;EAEN,MAAM,KAAKA,OACR,OAAO;GACN,OAAO,QAAQ;GACf,kBAAkB,QAAQ;GAC1B,GAAG,aAAa,QAAQ,KAAK;GAC7B,cAAc,QAAQ;GACtB,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;GACtD;GACA,gBAAgB,OAAO;GACvB,SAAS,CAAC;IAAE,MAAM;IAAa,IAAI,MAAM,MAAM,QAAQ;IAAY,GAAI,OAAO,EAAE,MAAM,KAAK,MAAM,IAAI,CAAC;GAAG,CAAC;GAC1G,UAAU;IACR,cAAc,OAAO;IACrB,aAAa,QAAQ,QAAQ;IAC7B,OAAO,QAAQ;IACf,eAAe,KAAKR;IACpB,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;IACvB,GAAI,QAAQ,UAAU,EAAE,SAAS,KAAK,IAAI,CAAC;IAC3C,GAAG;GACL;EACF,CAAC,CAAC,CACD,OAAM,UAAS;GACd,QAAQ,KAAK,yCAAyC,OAAO,aAAa,IAAI,KAAK;EACrF,CAAC;CACL;CAEA,MAAMW,mBACJ,SACA,cACA,MACkC;EAClC,IAAI,QAAQ,eAAe,QAAQ,YAAY,SAAA,GAC7C,OAAO,KAAKF,iBACV,SACA,cACA,yBACA,qCACF;EAEF,MAAM,aAAa,eAAe,KAAK,cAAc;EACrD,MAAM,SAAS,6BAA6B,UAAU;EACtD,MAAM,cAAc,WAAW,gBAAgB,WAAW;EAC1D,IAAI,KAAK,UAAU,QAAQ,CAAC,KAAKR,QAAQ,IAAI,WAAW,GACtD,OAAO,KAAKQ,iBACV,SACA,cACA,sBACA,gJACF;EAEF,MAAM,YAAY,KAAK,SAAS;EAChC,IAAI,QAAQ,UAAU,WACpB,OAAO,KAAKA,iBACV,SACA,cACA,sBACA,mCAAmC,UAAU,UAAU,QAAQ,MAAM,GACvE;EAEF,IAAK,cAAc,YAAY,WAAW,iBAAmB,cAAc,UAAU,WAAW,eAC9F,OAAO,KAAKA,iBACV,SACA,cACA,sBACA,uDACF;EAEF,MAAM,QAAQ,KAAKR,QAAQ,IAAI,QAAQ,KAAK;EAC5C,IAAI,CAAC,OACH,OAAO,KAAKQ,iBACV,SACA,cACA,sBACA,UAAU,QAAQ,MAAM,oBAC1B;EAEF,MAAM,YAAY,KAAK,OAAO,WAAW,IAAI,KAAK,OAAO,KAAK,KAAA;EAC9D,IAAI,CAAC,aAAa,CAAC,OAAO,UAAU,eAAe,KAAK,MAAM,QAAQ,SAAS,GAC7E,OAAO,KAAKA,iBACV,SACA,cACA,sBACA,yEACF;EAEF,IACE,CAAC,OAAO,UAAU,eAAe,KAAK,MAAM,QAAQ,QAAQ,KAAK,KACjE,CAAC,MAAM,iBAAiB,WAAW,QAAQ,KAAK,GAEhD,OAAO,KAAKA,iBACV,SACA,cACA,sBACA,OAAO,MAAM,MAAM,oCAAoC,UAAU,MAAM,QAAQ,MAAM,EACvF;EAIF,MAAM,YAAY,QAAQ,MAAM,SAAS,WAAW,cAAc,QAAQ,SAAS,QAAQ,UAAU;EAErG,MAAM,gBAAgB,MAAM,UAAU,QAAQ,KAAK;EACnD,MAAM,WAAW,MAAM,aAAa,QAAQ,KAAK;EAEjD,MAAM,cAAc;GAClB,QAAQ;IAAE,OAAO,QAAQ;IAAO,WAAW,QAAQ;GAAiB;GACpE,OAAO,QAAQ;GACf,SAAS;IAAE,MAAM,QAAQ,QAAQ;IAAM,IAAI,QAAQ,QAAQ;GAAS;GACpE,OAAO,QAAQ;GACf,aAAa,QAAQ,eAAe,CAAC;GACrC,eAAe,KAAKT;GACpB,MAAM;IACJ,IAAI,KAAK;IACT,QAAQ;IACR,WAAW,KAAK,iBACZ,GAAG,KAAK,eAAe,cAAc,GAAG,KAAK,eAAe,KAAK,GAAG,KAAK,eAAe,eACxF;IACJ,kBAAkB,KAAK;IACvB,OAAO,KAAK;IACZ,KAAK,KAAK,gBAAgB,OAAO;IACjC,QAAQ,CAAC,GAAG,KAAK,MAAM;IACvB,YAAY,KAAK;IACjB,UAAU,KAAK;GACjB;GACA,OAAO,QAAQ;GACf,cAAc,KAAK;GACnB;GACA;GACA,SAAS,QAAQ;EACnB;EAEA,IAAI;EAGJ,IAAI;GACF,aAAa,MAAM,iBAChB,YAAY;IAKX,MAAM,oBACJ,KAAK,sBAAsB,SAC1B,KAAKO,oBACF,MAAM,KAAKA,kBAAkB;KAAE,OAAO,QAAQ;KAAO,kBAAkB,QAAQ;IAAiB,CAAC,IACjG;IACN,MAAM,SAAS,kCAAkC,MAC/C,MAAM,MAAM,mBACV,wBAAwB;KACtB,GAAG;KACH,MAAM;MAAE,GAAG,YAAY;MAAM,YAAY,KAAK;KAAW;KACzD,cAAc,QAAQ,gBAAgB;KACtC,SAAS,QAAQ,WAAW;KAC5B,mBAAmB,kBAAkB,OAAO;KAC5C;KACA,qBAAqB,QAAQ;IAC/B,CAAC,CACH,CACF;IACA,IAAI,QAAQ,SAAS,UACnB,OAAO;KAAE,SAAS;KAAqB,MAAM,OAAO;KAAM,QAAQ,OAAO;IAAO;IAElF,IACE,QAAQ,eAAe,KAAA,MACtB,CAAC,cAAc,QAAQ,KAAK,KAC3B,OAAO,eAAe,QAAQ,cAC7B,KAAK,eAAe,QAAQ,KAAK,eAAe,OAAO,aAE1D,MAAM,IAAI,MAAM,wDAAwD;IAE1E,IAAI,QAAQ,UAAU,CAAC,kBAAkB,OAAO,GAC9C,MAAM,IAAI,MAAM,iDAAiD;IAGnE,IACE,QAAQ,MAAM,SAAS,WACvB,CAAC,MAAM,UAAU,SAAS,KAC1B,iBACA,2BAA2B,IAAI,GAE/B,OAAO;KACL,SAAS;KACT,MAAM;KACN,QACE;IACJ;IAEF,MAAM,YAAqC,CAAC;IAC5C,KAAK,MAAM,QAAQ,yBAAyB,KAAKN,SAAS;KACxD,OAAO,QAAQ;KACf;KACA;KACA,SAAS,QAAQ;KACjB,cAAc,QAAQ;KACtB,SAAS,QAAQ;IACnB,CAAC,GAAG;KACF,MAAM,UAAmC,OAAO,OAAO;MACrD,GAAG;MACH,OAAO,KAAK,UAAU,SAAS,YAAY,QAAQ;KACrD,CAAC;KACD,MAAM,MAAM,MAAM,KAAK,QAAQ,OAAO;KACtC,IAAI,QAAQ,KAAA,GAAW;KACvB,MAAM,WAAW,4BAA4B,KAAK,QAAQ,YAAY,MAAM;KAC5E,IAAI,SAAS,SAAS,UACpB,OAAO;MAAE,SAAS;MAAqB,MAAM,SAAS;MAAM,QAAQ,SAAS;KAAO;KAEtF,4BAA4B,UAAU,KAAKA,SAAS,SAAS;KAC7D,IAAI,UAAU,QAAQ,KAAK,mBAAmB,SAAS,QAAQ,GAAG;KAClE,UAAU,KAAK,QAAQ;IACzB;IACA,MAAM,YAAY,6BAA6B,SAAS;IACxD,IAAI,WAAW;KACb,MAAM,UAAU,uBAAuB,WAAW,QAAQ,KAAK;KAC/D,MAAM,QAAQ,UAAU,MAAK,aAAY,SAAS,SAAS,aAAa;KACxE,IAAI,OACF,MAAM,mBAAmB;UAEzB,UAAU,QAAQ;MAChB,MAAM;MACN,gBAAgB,iBAAiB;MACjC;MACA,UAAU;MACV,cAAc;MAGd,GAAI,iBAAiB,aAAa,KAAA,IAAY;OAAE,MAAM;OAAU,gBAAgB;MAAK,IAAI,CAAC;KAC5F,CAAC;IAEL;IACA,OAAO;KACL,SAAS;KACT,SAAS;MAAE,YAAY,QAAQ;MAAY,QAAQ,QAAQ,WAAW,QAAQ,CAAC,KAAK;KAAW;KAC/F,WAAW,6BAA6B,SAAS;IACnD;GACF,EAAA,CAAG,GACH,KAAKE,UACP;EACF,SAAS,OAAO;GAKd,aAAa;IAAE,SAAS;IAAY,GAHlC,iBAAiB,SAAS,MAAM,YAAY,yBACxC;KAAE,MAAM;KAAoB,QAAQ;IAAqC,IACzE,YAAY,KAAK;GACuB;EAChD;EACA,OAAO,KAAKS,QACV,SACA,cACA,YACA,WAAW,YAAY,aACnB;GAAE,GAAG,cAAc,SAAS,eAAe,SAAS;GAAG,GAAG,WAAW;EAAQ,IAC7E,CAAC,CACP;CACF;CAEA,MAAMH,iBACJ,SACA,cACA,MACA,QACkC;EAClC,OAAO,KAAKG,QAAQ,SAAS,cAAc;GAAE,SAAS;GAAY;GAAM;EAAO,CAAC;CAClF;CAEA,MAAMA,QACJ,SACA,cACA,YAGA,UAAoC,CAAC,GACH;EAClC,MAAM,YAAY,MAAM,KAAKV,SAAS,iBAAiB;GACrD,UAAU,QAAQ;GAClB,aAAa,QAAQ;GACrB,GAAI,QAAQ,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;GACzC,OAAO,QAAQ;GACf,kBAAkB,QAAQ;GAC1B,YAAY,QAAQ;GACpB,kBAAkB,QAAQ;GAC1B,kBAAkB,QAAQ;GAC1B,SAAS,QAAQ,QAAQ,KAAK;GAC9B,SAAS;IAAE,UAAU,QAAQ,QAAQ;IAAU,aAAa,QAAQ,QAAQ;IAAM;GAAa;GAC/F,eAAe,KAAKF;GACpB,aAAa,CAAC,GAAI,QAAQ,eAAe,CAAC,CAAE;GAC5C;GACA,GAAI,QAAQ,aAAa,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;EACjE,CAAC;EACD,IAAI,UAAU,WAAW,WACvB,OAAO,UAAU,cAAc,QAAQ,YAAY,sBAAsB,sBAAsB;EAEjG,MAAM,SAAS,UAAU;EACzB,IACE,KAAKM,eACL,QAAQ,UACR,UAAU,WAAW,eACrB,OAAO,WAAW,cAClB,UAAU,MAAM,YAChB;GACA,MAAM,OAAO,UAAU;GACvB,QAAa,QACX,KAAKA,YAAY;IACf,OAAO,QAAQ;IACf,kBAAkB,QAAQ;IAC1B,YAAY,QAAQ;IACpB;GACF,CAAC,CACH,CAAC,CAAC,OAAM,UAAS;IACf,QAAQ,KAAK,kDAAkD,QAAQ,WAAW,IAAI,KAAK;GAC7F,CAAC;EACH;EAEA,IACE,KAAKF,oBACL,OAAO,WAAW,cAClB,KAAKH,QAAQ,IAAI,QAAQ,KAAK,CAAC,EAAE,WAAW,OAAO,KAAK,MAAM,MAC9D;GACA,IAAI;GACJ,IAAI;IACF,MAAM,UAAU,QAAQ,QACtB,KAAKG,iBAAiB;KACpB,OAAO,QAAQ;KACf,kBAAkB,QAAQ;KAC1B,YAAY,QAAQ;KACpB,OAAO,OAAO;KACd,UAAU,OAAO;IACnB,CAAC,CACH;IAGA,QAAQ,YAAY,CAAC,CAAC;IACtB,MAAM,QAAQ,KAAK,CACjB,SACA,IAAI,SAAc,YAAW;KAC3B,QAAQ,WAAW,SAAS,KAAKC,yBAAyB;IAC5D,CAAC,CACH,CAAC;GACH,QAAQ,CAER,UAAU;IACR,aAAa,KAAK;GACpB;EACF;EACA,OAAO;CACT;AACF"}