@mastra/factory 0.2.2-alpha.0 → 0.2.2-alpha.2

package/dist/integrations/github/rules.js

@@ -1,501 +1,233 @@
-// src/rules/resolve.ts
-function resolveFactoryGithubRule(rules, event) {
-  return rules.github[event]?.onEvent;
-}
-
-// src/rules/types.ts
-var FACTORY_RULE_STAGES = ["intake", "triage", "planning", "execute", "review", "done", "canceled"];
-var FACTORY_RULE_BOARDS = ["work", "review"];
-
-// src/rules/validation.ts
-var MAX_FACTORY_RULE_CAUSAL_DEPTH = 8;
-var MAX_IDEMPOTENCY_KEY_LENGTH = 256;
-var MAX_REASON_LENGTH = 512;
-var MAX_TITLE_LENGTH = 512;
-var MAX_MESSAGE_LENGTH = 8192;
-var MAX_ARGUMENTS_LENGTH = 4096;
-var MAX_ROLE_LENGTH = 32;
-var MAX_SKILL_NAME_LENGTH = 128;
-var MAX_SOURCE_KEY_LENGTH = 256;
-var MAX_URL_LENGTH = 2048;
-var MAX_METADATA_JSON_LENGTH = 16384;
-var MAX_JSON_DEPTH = 8;
-var MAX_JSON_COLLECTION_SIZE = 100;
-var IDENTIFIER_RE = /^[a-z0-9][a-z0-9_-]*$/i;
-var SKILL_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-var SENSITIVE_KEY_RE = /(?:authorization|cookie|credential|password|secret|token)/i;
-var WORK_ITEM_SOURCES = ["github-issue", "github-pr", "linear-issue", "manual"];
-var REJECTION_CODES = [
-  "forbidden",
-  "invalid_transition",
-  "missing_binding",
-  "stale",
-  "timeout",
-  "rule_error",
-  "causal_depth_exceeded",
-  "repeated_transition"
-];
-var FactoryRuleValidationError = class extends Error {
-  code = "invalid_factory_rule";
-  constructor(message) {
-    super(message);
-    this.name = "FactoryRuleValidationError";
-  }
-};
-function isPlainObject(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-  const prototype = Object.getPrototypeOf(value);
-  return prototype === Object.prototype || prototype === null;
-}
-function assertExactKeys(value, keys, label) {
-  const allowed = new Set(keys);
-  if (Object.keys(value).some((key) => !allowed.has(key))) {
-    throw new FactoryRuleValidationError(`${label} contains an unsupported field.`);
-  }
-}
-function boundedString(value, label, max, pattern) {
-  if (typeof value !== "string") throw new FactoryRuleValidationError(`${label} must be a string.`);
-  const normalized = value.trim();
-  if (normalized.length === 0 || normalized.length > max || pattern && !pattern.test(normalized)) {
-    throw new FactoryRuleValidationError(`${label} is invalid.`);
-  }
-  return normalized;
-}
-function optionalBoundedString(value, label, max) {
-  if (value === void 0) return void 0;
-  return boundedString(value, label, max);
-}
-function enumValue(value, allowed, label) {
-  if (typeof value !== "string" || !allowed.includes(value)) {
-    throw new FactoryRuleValidationError(`${label} is invalid.`);
-  }
-  return value;
-}
-function normalizeFactoryRuleJsonValue(value, depth = 0, seen = /* @__PURE__ */ new Set()) {
-  if (value === null || typeof value === "boolean" || typeof value === "string") return value;
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) throw new FactoryRuleValidationError("Rule metadata must contain finite numbers.");
-    return value;
-  }
-  if (depth >= MAX_JSON_DEPTH || typeof value !== "object" && !Array.isArray(value)) {
-    throw new FactoryRuleValidationError("Rule metadata is not bounded JSON.");
-  }
-  if (seen.has(value)) throw new FactoryRuleValidationError("Rule metadata must not contain cycles.");
-  seen.add(value);
-  try {
-    if (Array.isArray(value)) {
-      if (value.length > MAX_JSON_COLLECTION_SIZE) {
-        throw new FactoryRuleValidationError("Rule metadata contains too many entries.");
-      }
-      return value.map((entry) => normalizeFactoryRuleJsonValue(entry, depth + 1, seen));
-    }
-    if (!isPlainObject(value)) throw new FactoryRuleValidationError("Rule metadata must use plain objects.");
-    const entries = Object.entries(value);
-    if (entries.length > MAX_JSON_COLLECTION_SIZE) {
-      throw new FactoryRuleValidationError("Rule metadata contains too many fields.");
-    }
-    const sanitized = {};
-    for (const [key, entry] of entries) {
-      const normalizedKey = boundedString(key, "Rule metadata key", 128, IDENTIFIER_RE);
-      sanitized[normalizedKey] = SENSITIVE_KEY_RE.test(normalizedKey) ? "[REDACTED]" : normalizeFactoryRuleJsonValue(entry, depth + 1, seen);
-    }
-    return sanitized;
-  } finally {
-    seen.delete(value);
-  }
-}
-function sanitizeMetadata(value) {
-  if (value === void 0) return void 0;
-  const sanitized = normalizeFactoryRuleJsonValue(value);
-  if (!isPlainObject(sanitized)) throw new FactoryRuleValidationError("Rule metadata must be an object.");
-  if (JSON.stringify(sanitized).length > MAX_METADATA_JSON_LENGTH) {
-    throw new FactoryRuleValidationError("Rule metadata is too large.");
-  }
-  return sanitized;
-}
-function commonCommitFields(value) {
-  return {
-    idempotencyKey: boundedString(value.idempotencyKey, "Factory decision idempotencyKey", MAX_IDEMPOTENCY_KEY_LENGTH)
-  };
-}
-function validateFactoryRuleDecision(value, causalDepth = 0) {
-  if (causalDepth > MAX_FACTORY_RULE_CAUSAL_DEPTH) {
-    throw new FactoryRuleValidationError("Factory rule causal depth exceeded.");
-  }
-  if (!isPlainObject(value)) throw new FactoryRuleValidationError("Factory rule decision must be an object.");
-  const type = value.type;
-  if (typeof type !== "string") throw new FactoryRuleValidationError("Factory rule decision type is required.");
-  switch (type) {
-    case "reject": {
-      assertExactKeys(value, ["type", "code", "reason"], "Factory reject decision");
-      return {
-        type,
-        code: enumValue(value.code, REJECTION_CODES, "Factory rejection code"),
-        reason: boundedString(value.reason, "Factory rejection reason", MAX_REASON_LENGTH)
-      };
-    }
-    case "transition": {
-      assertExactKeys(value, ["type", "idempotencyKey", "board", "stage"], "Factory transition decision");
-      return {
-        type,
-        ...commonCommitFields(value),
-        board: enumValue(value.board, FACTORY_RULE_BOARDS, "Factory transition board"),
-        stage: enumValue(value.stage, FACTORY_RULE_STAGES, "Factory transition stage")
-      };
-    }
-    case "upsertLinkedWorkItem": {
-      assertExactKeys(
-        value,
-        ["type", "idempotencyKey", "board", "source", "sourceKey", "title", "url", "stage", "metadata"],
-        "Factory linked work item decision"
-      );
-      const url = value.url;
-      if (url !== null && (typeof url !== "string" || url.length > MAX_URL_LENGTH || !/^https?:\/\//.test(url))) {
-        throw new FactoryRuleValidationError("Factory linked work item URL is invalid.");
-      }
-      const metadata = sanitizeMetadata(value.metadata);
-      return {
-        type,
-        ...commonCommitFields(value),
-        board: enumValue(value.board, FACTORY_RULE_BOARDS, "Factory linked work item board"),
-        source: enumValue(value.source, WORK_ITEM_SOURCES, "Factory linked work item source"),
-        sourceKey: boundedString(value.sourceKey, "Factory linked work item sourceKey", MAX_SOURCE_KEY_LENGTH),
-        title: boundedString(value.title, "Factory linked work item title", MAX_TITLE_LENGTH),
-        url,
-        stage: enumValue(value.stage, FACTORY_RULE_STAGES, "Factory linked work item stage"),
-        ...metadata ? { metadata } : {}
-      };
-    }
-    case "invokeSkill": {
-      assertExactKeys(
-        value,
-        ["type", "idempotencyKey", "role", "skillName", "arguments", "precedingMessage"],
-        "Factory invoke skill decision"
-      );
-      const args = optionalBoundedString(value.arguments, "Factory skill arguments", MAX_ARGUMENTS_LENGTH);
-      const precedingMessage = optionalBoundedString(
-        value.precedingMessage,
-        "Factory skill preceding message",
-        MAX_MESSAGE_LENGTH
-      );
-      return {
-        type,
-        ...commonCommitFields(value),
-        role: boundedString(value.role, "Factory skill role", MAX_ROLE_LENGTH, IDENTIFIER_RE),
-        skillName: boundedString(value.skillName, "Factory skill name", MAX_SKILL_NAME_LENGTH, SKILL_NAME_RE),
-        ...args ? { arguments: args } : {},
-        ...precedingMessage ? { precedingMessage } : {}
-      };
-    }
-    case "sendMessage": {
-      assertExactKeys(
-        value,
-        ["type", "idempotencyKey", "role", "message", "priority", "idleBehavior", "prepareBinding"],
-        "Factory send message decision"
-      );
-      const priority = value.priority === void 0 ? void 0 : enumValue(value.priority, ["medium", "high", "urgent"], "Factory message priority");
-      const idleBehavior = value.idleBehavior === void 0 ? void 0 : enumValue(value.idleBehavior, ["persist", "wake"], "Factory message idle behavior");
-      if (value.prepareBinding !== void 0 && typeof value.prepareBinding !== "boolean") {
-        throw new FactoryRuleValidationError("Factory message prepareBinding must be a boolean.");
-      }
-      return {
-        type,
-        ...commonCommitFields(value),
-        role: boundedString(value.role, "Factory message role", MAX_ROLE_LENGTH, IDENTIFIER_RE),
-        message: boundedString(value.message, "Factory message", MAX_MESSAGE_LENGTH),
-        ...priority ? { priority } : {},
-        ...idleBehavior ? { idleBehavior } : {},
-        ...value.prepareBinding === true ? { prepareBinding: true } : {}
-      };
-    }
-    case "notify": {
-      assertExactKeys(value, ["type", "idempotencyKey", "title", "body", "level"], "Factory notify decision");
-      const body = optionalBoundedString(value.body, "Factory notification body", MAX_MESSAGE_LENGTH);
-      const level = value.level === void 0 ? void 0 : enumValue(value.level, ["info", "warning", "error"], "Factory notification level");
-      return {
-        type,
-        ...commonCommitFields(value),
-        title: boundedString(value.title, "Factory notification title", MAX_TITLE_LENGTH),
-        ...body ? { body } : {},
-        ...level ? { level } : {}
-      };
-    }
-    default:
-      throw new FactoryRuleValidationError("Factory rule decision type is unsupported.");
-  }
-}
-function validateFactoryRuleDecisions(values, causalDepth = 0) {
-  if (values.length > MAX_JSON_COLLECTION_SIZE) {
-    throw new FactoryRuleValidationError("Factory rule produced too many decisions.");
-  }
-  const decisions = [];
-  for (const value of values) {
-    const decision = validateFactoryRuleDecision(value, causalDepth);
-    if (decision.type === "reject") {
-      throw new FactoryRuleValidationError("A rejection cannot be persisted with commit decisions.");
-    }
-    decisions.push(decision);
-  }
-  const keys = decisions.map((decision) => decision.idempotencyKey);
-  if (new Set(keys).size !== keys.length) {
-    throw new FactoryRuleValidationError("Factory decisions require unique idempotency keys.");
-  }
-  return decisions;
-}
-
-// src/integrations/github/rules.ts
-var TRUSTED_PERMISSIONS = /* @__PURE__ */ new Set(["write", "admin"]);
-var RULE_TIMEOUT_MS = 5e3;
+import { resolveFactoryGithubRule } from "../../rules/resolve.js";
+import { validateFactoryRuleDecisions } from "../../rules/validation.js";
+//#region src/integrations/github/rules.ts
+const TRUSTED_PERMISSIONS = /* @__PURE__ */ new Set(["write", "admin"]);
+const RULE_TIMEOUT_MS = 5e3;
 async function withRuleTimeout(promise) {
-  let timeout;
-  try {
-    return await Promise.race([
-      promise,
-      new Promise((_, reject) => {
-        timeout = setTimeout(() => reject(new Error("FACTORY_RULE_TIMEOUT")), RULE_TIMEOUT_MS);
-      })
-    ]);
-  } finally {
-    if (timeout) clearTimeout(timeout);
-  }
+	let timeout;
+	try {
+		return await Promise.race([promise, new Promise((_, reject) => {
+			timeout = setTimeout(() => reject(/* @__PURE__ */ new Error("FACTORY_RULE_TIMEOUT")), RULE_TIMEOUT_MS);
+		})]);
+	} finally {
+		if (timeout) clearTimeout(timeout);
+	}
 }
 function object(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 function string(value) {
-  return typeof value === "string" && value.length > 0 ? value : void 0;
+	return typeof value === "string" && value.length > 0 ? value : void 0;
 }
 function number(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
 function boolean(value) {
-  return typeof value === "boolean" ? value : void 0;
+	return typeof value === "boolean" ? value : void 0;
 }
 function eventName(parsed) {
-  const action = string(parsed.payload.action);
-  if (parsed.event === "issues" && action === "opened") return "issueOpened";
-  if (parsed.event === "pull_request" && action === "opened") return "pullRequestOpened";
-  if (parsed.event === "pull_request" && action === "synchronize") return "pullRequestUpdated";
-  if (parsed.event === "pull_request" && action === "closed" && boolean(object(parsed.payload.pull_request)?.merged)) {
-    return "pullRequestMerged";
-  }
-  if (parsed.event === "pull_request" && action === "review_requested") return "pullRequestReviewRequested";
-  return void 0;
+	const action = string(parsed.payload.action);
+	if (parsed.event === "issues" && action === "opened") return "issueOpened";
+	if (parsed.event === "pull_request" && action === "opened") return "pullRequestOpened";
+	if (parsed.event === "pull_request" && action === "synchronize") return "pullRequestUpdated";
+	if (parsed.event === "pull_request" && action === "closed" && boolean(object(parsed.payload.pull_request)?.merged)) return "pullRequestMerged";
+	if (parsed.event === "pull_request" && action === "review_requested") return "pullRequestReviewRequested";
 }
 function canonicalSourceKey(kind, itemNumber) {
-  return kind === "issue" ? `github-issue:${itemNumber}` : `github-pr:${itemNumber}`;
+	return kind === "issue" ? `github-issue:${itemNumber}` : `github-pr:${itemNumber}`;
 }
 function legacySourceKey(repositoryId, kind, itemNumber) {
-  return `github:${repositoryId}:${kind}:${itemNumber}`;
+	return `github:${repositoryId}:${kind}:${itemNumber}`;
 }
 function provenanceTarget(repositoryId, pullRequestNumber) {
-  return `factory-pr-provenance:${repositoryId}:${pullRequestNumber}`;
+	return `factory-pr-provenance:${repositoryId}:${pullRequestNumber}`;
 }
 function workItemSource(item) {
-  if (!item.externalSource) return "manual";
-  return item.externalSource.type === "pull-request" ? "github-pr" : "github-issue";
+	if (!item.externalSource) return "manual";
+	return item.externalSource.type === "pull-request" ? "github-pr" : "github-issue";
 }
 function workItemSourceKey(item) {
-  return item.externalSource?.externalId ?? null;
+	return item.externalSource?.externalId ?? null;
 }
 async function githubActor(github, input) {
-  let trusted = false;
-  try {
-    const permission = await github.getRepositoryCollaboratorPermission(
-      input.installationId,
-      input.repository,
-      input.login
-    );
-    trusted = permission !== void 0 && TRUSTED_PERMISSIONS.has(permission);
-  } catch {
-    trusted = false;
-  }
-  return { type: "github", login: input.login, trusted, factoryAuthored: input.factoryAuthored };
+	let trusted = false;
+	try {
+		const permission = await github.getRepositoryCollaboratorPermission(input.installationId, input.repository, input.login);
+		trusted = permission !== void 0 && TRUSTED_PERMISSIONS.has(permission);
+	} catch {
+		trusted = false;
+	}
+	return {
+		type: "github",
+		login: input.login,
+		trusted,
+		factoryAuthored: input.factoryAuthored
+	};
 }
 function pullRequestProvenance(data) {
-  if (!data || data.kind !== "factory-pr-provenance" || typeof data.workItemId !== "string") return null;
-  return { kind: "factory-pr-provenance", workItemId: data.workItemId };
+	if (!data || data.kind !== "factory-pr-provenance" || typeof data.workItemId !== "string") return null;
+	return {
+		kind: "factory-pr-provenance",
+		workItemId: data.workItemId
+	};
 }
 var GithubRules = class {
-  constructor(options) {
-    this.options = options;
-  }
-  options;
-  async ingest(parsed) {
-    const event = eventName(parsed);
-    const repository = object(parsed.payload.repository);
-    const installationId = number(object(parsed.payload.installation)?.id);
-    const repositoryId = number(repository?.id);
-    const repositoryName = string(repository?.full_name);
-    const login = string(object(parsed.payload.sender)?.login);
-    if (!event || !installationId || !repositoryId || !repositoryName || !login) return { status: "ignored" };
-    const projects = await this.options.sourceControl.projectRepositories.listByExternalRepository({
-      installationExternalId: String(installationId),
-      repositoryExternalId: String(repositoryId)
-    });
-    if (projects.length === 0) return { status: "ignored" };
-    const results = [];
-    for (const project of projects) {
-      results.push(
-        await this.#ingestProject(parsed, event, installationId, repositoryId, repositoryName, login, project)
-      );
-    }
-    if (results.some((result) => result.status === "committed")) return { status: "committed" };
-    if (results.some((result) => result.status === "replayed")) return { status: "replayed" };
-    return results[0] ?? { status: "ignored" };
-  }
-  async #ingestProject(parsed, event, installationId, repositoryId, repositoryName, login, project) {
-    const factoryProject = await this.options.projects.get({
-      orgId: project.orgId,
-      id: project.factoryProjectId
-    });
-    if (!factoryProject) return { status: "missing" };
-    const issue = object(parsed.payload.issue);
-    const pullRequest = object(parsed.payload.pull_request);
-    const issueNumber = number(issue?.number);
-    const pullRequestNumber = number(pullRequest?.number);
-    const provenance = pullRequestNumber ? pullRequestProvenance(
-      (await this.options.integrationStorage.subscriptions.listByTarget(
-        provenanceTarget(repositoryId, pullRequestNumber),
-        { status: "active" }
-      )).find((subscription) => subscription.orgId === project.orgId)?.data
-    ) : null;
-    const relatedItem = await this.#relatedItem(
-      project.orgId,
-      project.factoryProjectId,
-      repositoryId,
-      issueNumber,
-      pullRequestNumber,
-      string(object(pullRequest?.head)?.ref),
-      provenance
-    );
-    const actor = await githubActor(this.options.github, {
-      installationId,
-      repository: repositoryName,
-      login,
-      factoryAuthored: provenance !== null
-    });
-    const context = {
-      tenant: { orgId: project.orgId, projectId: project.factoryProjectId },
-      actor,
-      ingress: { type: "github", id: `${installationId}:${parsed.deliveryId}` },
-      cause: `github.${event}`,
-      causalChain: [],
-      ruleSetVersion: this.options.rules.version,
-      ...relatedItem ? {
-        item: {
-          id: relatedItem.id,
-          source: workItemSource(relatedItem),
-          sourceKey: workItemSourceKey(relatedItem),
-          parentWorkItemId: relatedItem.parentWorkItemId,
-          title: relatedItem.title,
-          url: relatedItem.externalSource?.url ?? null,
-          stages: relatedItem.stages
-        },
-        board: relatedItem.externalSource?.type === "pull-request" ? "review" : "work",
-        itemRevision: relatedItem.revision
-      } : {},
-      event,
-      deliveryId: parsed.deliveryId,
-      factory: { createdAt: factoryProject.createdAt.toISOString() },
-      repository: { id: repositoryId, fullName: repositoryName },
-      ...issueNumber && string(issue?.title) && string(issue?.html_url) ? {
-        issue: {
-          number: issueNumber,
-          title: string(issue?.title),
-          url: string(issue?.html_url),
-          ...string(issue?.created_at) ? { createdAt: string(issue?.created_at) } : {}
-        }
-      } : {},
-      ...pullRequestNumber && string(pullRequest?.title) && string(pullRequest?.html_url) ? {
-        pullRequest: {
-          number: pullRequestNumber,
-          title: string(pullRequest?.title),
-          url: string(pullRequest?.html_url),
-          ...string(pullRequest?.created_at) ? { createdAt: string(pullRequest?.created_at) } : {},
-          state: string(pullRequest?.state) === "closed" ? "closed" : "open",
-          merged: boolean(pullRequest?.merged) ?? false,
-          headBranch: string(object(pullRequest?.head)?.ref) ?? "",
-          baseBranch: string(object(pullRequest?.base)?.ref) ?? ""
-        }
-      } : {},
-      ...object(parsed.payload.review) ? {
-        review: {
-          id: number(object(parsed.payload.review)?.id) ?? 0,
-          state: string(object(parsed.payload.review)?.state) ?? "unknown",
-          url: string(object(parsed.payload.review)?.html_url) ?? ""
-        }
-      } : {}
-    };
-    const rule = resolveFactoryGithubRule(this.options.rules, event);
-    let decision;
-    let decisions = [];
-    let outcome = { status: "accepted" };
-    try {
-      decision = rule ? await withRuleTimeout(Promise.resolve(rule(Object.freeze(context)))) : void 0;
-      if (decision?.type === "reject") {
-        outcome = { status: "rejected", code: decision.code, reason: decision.reason };
-      } else if (decision) {
-        decisions = validateFactoryRuleDecisions([decision]).map((entry) => ({ ...entry }));
-      }
-    } catch (error) {
-      const timedOut = error instanceof Error && error.message === "FACTORY_RULE_TIMEOUT";
-      outcome = {
-        status: "rejected",
-        code: timedOut ? "timeout" : "rule_error",
-        reason: timedOut ? "Factory rule evaluation timed out." : error instanceof Error ? error.message.slice(0, 2e3) : "Factory GitHub rule failed."
-      };
-    }
-    const committed = await this.options.storage.commitRuleEvaluation({
-      orgId: project.orgId,
-      factoryProjectId: project.factoryProjectId,
-      workItemId: relatedItem?.id ?? null,
-      ingress: { identity: `${installationId}:${parsed.deliveryId}`, triggerType: `github.${event}` },
-      ruleSetVersion: this.options.rules.version,
-      expectedRevision: relatedItem?.revision ?? null,
-      actor: { ...actor },
-      outcome,
-      decisions,
-      causalChain: [],
-      now: /* @__PURE__ */ new Date()
-    });
-    return { status: committed.status };
-  }
-  async #relatedItem(orgId, projectId, repositoryId, issueNumber, pullRequestNumber, pullRequestHeadBranch, provenance) {
-    const items = await this.options.storage.list({ orgId, factoryProjectId: projectId });
-    if (provenance) return items.find((item) => item.id === provenance.workItemId);
-    if (issueNumber) {
-      return items.find((item) => item.externalSource?.externalId === canonicalSourceKey("issue", issueNumber)) ?? items.find((item) => item.externalSource?.externalId === legacySourceKey(repositoryId, "issue", issueNumber));
-    }
-    if (pullRequestNumber) {
-      return items.find((item) => item.externalSource?.externalId === canonicalSourceKey("pull-request", pullRequestNumber)) ?? items.find(
-        (item) => item.externalSource?.externalId === legacySourceKey(repositoryId, "pull-request", pullRequestNumber)
-      ) ?? // Provenance fallback: a PR pushed from a work item's session branch
-      // belongs to that item even when no gh-pr-create provenance was
-      // recorded (session predating state seeding, or the PR was opened
-      // outside the tracked tool call). Session branches are per-item
-      // (`factory/issue-N`), so a head-branch match is unambiguous.
-      (pullRequestHeadBranch ? items.find(
-        (item) => item.externalSource?.type !== "pull-request" && Object.values(item.sessions).some((session) => session.branch === pullRequestHeadBranch)
-      ) : void 0);
-    }
-    return void 0;
-  }
+	options;
+	constructor(options) {
+		this.options = options;
+	}
+	async ingest(parsed) {
+		const event = eventName(parsed);
+		const repository = object(parsed.payload.repository);
+		const installationId = number(object(parsed.payload.installation)?.id);
+		const repositoryId = number(repository?.id);
+		const repositoryName = string(repository?.full_name);
+		const login = string(object(parsed.payload.sender)?.login);
+		if (!event || !installationId || !repositoryId || !repositoryName || !login) return { status: "ignored" };
+		const projects = await this.options.sourceControl.projectRepositories.listByExternalRepository({
+			installationExternalId: String(installationId),
+			repositoryExternalId: String(repositoryId)
+		});
+		if (projects.length === 0) return { status: "ignored" };
+		const results = [];
+		for (const project of projects) results.push(await this.#ingestProject(parsed, event, installationId, repositoryId, repositoryName, login, project));
+		if (results.some((result) => result.status === "committed")) return { status: "committed" };
+		if (results.some((result) => result.status === "replayed")) return { status: "replayed" };
+		return results[0] ?? { status: "ignored" };
+	}
+	async #ingestProject(parsed, event, installationId, repositoryId, repositoryName, login, project) {
+		const factoryProject = await this.options.projects.get({
+			orgId: project.orgId,
+			id: project.factoryProjectId
+		});
+		if (!factoryProject) return { status: "missing" };
+		const issue = object(parsed.payload.issue);
+		const pullRequest = object(parsed.payload.pull_request);
+		const issueNumber = number(issue?.number);
+		const pullRequestNumber = number(pullRequest?.number);
+		const provenance = pullRequestNumber ? pullRequestProvenance((await this.options.integrationStorage.subscriptions.listByTarget(provenanceTarget(repositoryId, pullRequestNumber), { status: "active" })).find((subscription) => subscription.orgId === project.orgId)?.data) : null;
+		const relatedItem = await this.#relatedItem(project.orgId, project.factoryProjectId, repositoryId, issueNumber, pullRequestNumber, string(object(pullRequest?.head)?.ref), provenance);
+		const actor = await githubActor(this.options.github, {
+			installationId,
+			repository: repositoryName,
+			login,
+			factoryAuthored: provenance !== null
+		});
+		const context = {
+			tenant: {
+				orgId: project.orgId,
+				projectId: project.factoryProjectId
+			},
+			actor,
+			ingress: {
+				type: "github",
+				id: `${installationId}:${parsed.deliveryId}`
+			},
+			cause: `github.${event}`,
+			causalChain: [],
+			ruleSetVersion: this.options.rules.version,
+			...relatedItem ? {
+				item: {
+					id: relatedItem.id,
+					source: workItemSource(relatedItem),
+					sourceKey: workItemSourceKey(relatedItem),
+					parentWorkItemId: relatedItem.parentWorkItemId,
+					title: relatedItem.title,
+					url: relatedItem.externalSource?.url ?? null,
+					stages: relatedItem.stages
+				},
+				board: relatedItem.externalSource?.type === "pull-request" ? "review" : "work",
+				itemRevision: relatedItem.revision
+			} : {},
+			event,
+			deliveryId: parsed.deliveryId,
+			factory: { createdAt: factoryProject.createdAt.toISOString() },
+			repository: {
+				id: repositoryId,
+				fullName: repositoryName
+			},
+			...issueNumber && string(issue?.title) && string(issue?.html_url) ? { issue: {
+				number: issueNumber,
+				title: string(issue?.title),
+				url: string(issue?.html_url),
+				...string(issue?.created_at) ? { createdAt: string(issue?.created_at) } : {}
+			} } : {},
+			...pullRequestNumber && string(pullRequest?.title) && string(pullRequest?.html_url) ? { pullRequest: {
+				number: pullRequestNumber,
+				title: string(pullRequest?.title),
+				url: string(pullRequest?.html_url),
+				...string(pullRequest?.created_at) ? { createdAt: string(pullRequest?.created_at) } : {},
+				state: string(pullRequest?.state) === "closed" ? "closed" : "open",
+				merged: boolean(pullRequest?.merged) ?? false,
+				headBranch: string(object(pullRequest?.head)?.ref) ?? "",
+				baseBranch: string(object(pullRequest?.base)?.ref) ?? ""
+			} } : {},
+			...object(parsed.payload.review) ? { review: {
+				id: number(object(parsed.payload.review)?.id) ?? 0,
+				state: string(object(parsed.payload.review)?.state) ?? "unknown",
+				url: string(object(parsed.payload.review)?.html_url) ?? ""
+			} } : {}
+		};
+		const rule = resolveFactoryGithubRule(this.options.rules, event);
+		let decision;
+		let decisions = [];
+		let outcome = { status: "accepted" };
+		try {
+			decision = rule ? await withRuleTimeout(Promise.resolve(rule(Object.freeze(context)))) : void 0;
+			if (decision?.type === "reject") outcome = {
+				status: "rejected",
+				code: decision.code,
+				reason: decision.reason
+			};
+			else if (decision) decisions = validateFactoryRuleDecisions([decision]).map((entry) => ({ ...entry }));
+		} catch (error) {
+			const timedOut = error instanceof Error && error.message === "FACTORY_RULE_TIMEOUT";
+			outcome = {
+				status: "rejected",
+				code: timedOut ? "timeout" : "rule_error",
+				reason: timedOut ? "Factory rule evaluation timed out." : error instanceof Error ? error.message.slice(0, 2e3) : "Factory GitHub rule failed."
+			};
+		}
+		return { status: (await this.options.storage.commitRuleEvaluation({
+			orgId: project.orgId,
+			factoryProjectId: project.factoryProjectId,
+			workItemId: relatedItem?.id ?? null,
+			ingress: {
+				identity: `${installationId}:${parsed.deliveryId}`,
+				triggerType: `github.${event}`
+			},
+			ruleSetVersion: this.options.rules.version,
+			expectedRevision: relatedItem?.revision ?? null,
+			actor: { ...actor },
+			outcome,
+			decisions,
+			causalChain: [],
+			now: /* @__PURE__ */ new Date()
+		})).status };
+	}
+	async #relatedItem(orgId, projectId, repositoryId, issueNumber, pullRequestNumber, pullRequestHeadBranch, provenance) {
+		const items = await this.options.storage.list({
+			orgId,
+			factoryProjectId: projectId
+		});
+		if (provenance) return items.find((item) => item.id === provenance.workItemId);
+		if (issueNumber) return items.find((item) => item.externalSource?.externalId === canonicalSourceKey("issue", issueNumber)) ?? items.find((item) => item.externalSource?.externalId === legacySourceKey(repositoryId, "issue", issueNumber));
+		if (pullRequestNumber) return items.find((item) => item.externalSource?.externalId === canonicalSourceKey("pull-request", pullRequestNumber)) ?? items.find((item) => item.externalSource?.externalId === legacySourceKey(repositoryId, "pull-request", pullRequestNumber)) ?? (pullRequestHeadBranch ? items.find((item) => item.externalSource?.type !== "pull-request" && Object.values(item.sessions).some((session) => session.branch === pullRequestHeadBranch)) : void 0);
+	}
 };
 function attachGithubRules(github, context) {
-  if (!context.rules) return void 0;
-  const rules = new GithubRules({
-    github,
-    sourceControl: context.storage.sourceControl,
-    integrationStorage: context.storage.generic,
-    projects: context.storage.projects,
-    storage: context.rules.workItems,
-    rules: context.rules.config
-  });
-  return (event) => rules.ingest(event);
-}
-export {
-  GithubRules,
-  attachGithubRules
-};
+	if (!context.rules) return void 0;
+	const rules = new GithubRules({
+		github,
+		sourceControl: context.storage.sourceControl,
+		integrationStorage: context.storage.generic,
+		projects: context.storage.projects,
+		storage: context.rules.workItems,
+		rules: context.rules.config
+	});
+	return (event) => rules.ingest(event);
+}
+//#endregion
+export { GithubRules, attachGithubRules };
+
 //# sourceMappingURL=rules.js.map