@mastra/factory 0.2.2-alpha.0 → 0.2.2-alpha.2

package/dist/integrations/platform/github/integration.js

@@ -1,3989 +1,892 @@
-// src/integrations/platform/github/integration.ts
-import { registerApiRoute as registerApiRoute2 } from "@mastra/core/server";
-
-// src/integrations/github/routes.ts
-import { randomUUID } from "crypto";
+import { createGithubSubscriptionTools, parseCreatedPullRequest, subscribeCurrentSessionToPullRequest } from "../../github/session-subscriptions.js";
+import { buildGithubRoutes } from "../../github/routes.js";
+import { attachGithubRules } from "../../github/rules.js";
+import { PlatformApiClient, PlatformApiError, logPlatformInfo, logPlatformWarn, platformApiClientConfigFromEnv } from "../api-client.js";
+import { PlatformGithubEventWorker } from "./event-worker.js";
 import { registerApiRoute } from "@mastra/core/server";
-import { streamSSE } from "hono/streaming";
-
-// src/sandbox/fleet.ts
-import path from "path";
-function reportProgress(onProgress, event) {
-  if (!onProgress) return;
-  try {
-    onProgress(event);
-  } catch {
-  }
-}
-var SandboxBudgetError = class extends Error {
-  constructor(max) {
-    super(
-      `Sandbox budget exceeded: this server already has ${max} active sandbox(es), the configured per-replica maximum. Close an existing repository's sandbox and try again.`
-    );
-    this.max = max;
-    this.name = "SandboxBudgetError";
-  }
-  max;
-  code = "sandbox-budget-exceeded";
+//#region src/integrations/platform/github/integration.ts
+const PAGE_SIZE = 30;
+const API_PREFIX = "/v1/server";
+/**
+* How long an installation's repository listing may be reused. The repos
+* route and token minting both call it — often several times within one UI
+* interaction — and each call is a full Platform round trip.
+*/
+const INSTALLATION_REPOS_CACHE_TTL_MS = 3e4;
+/**
+* How long a minted repository-scoped token may be reused. GitHub
+* installation tokens live ~60 minutes; 5 minutes keeps a wide validity
+* margin while collapsing the per-session-materialization mint round trip.
+*/
+const REPOSITORY_ACCESS_CACHE_TTL_MS = 5 * 6e4;
+/**
+* Upper bound for both TTL caches. Entries expire lazily on re-access, so
+* without a hard cap keys that stop being queried would accumulate for the
+* integration's (long) lifetime. Insertion-order eviction — matches the
+* bounded verification cache in `@mastra/auth-studio`.
+*/
+const MAX_CACHE_ENTRIES = 1e3;
+function setBounded(cache, key, value) {
+	cache.delete(key);
+	cache.set(key, value);
+	if (cache.size > MAX_CACHE_ENTRIES) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
+	}
+}
+const REPOSITORY_TOKEN_PERMISSIONS = {
+	contents: "write",
+	issues: "write",
+	pull_requests: "write"
 };
-
-// src/integrations/github/config.ts
-var GITHUB_APP_ENV_VARS = [
-  "GITHUB_APP_ID",
-  "GITHUB_APP_PRIVATE_KEY",
-  "GITHUB_APP_CLIENT_ID",
-  "GITHUB_APP_CLIENT_SECRET",
-  "GITHUB_APP_SLUG"
-];
-function isGithubFeatureEnabled(options) {
-  return options.github !== void 0 && options.auth.enabled();
-}
-function getGithubFeatureDiagnostics(options) {
-  const { github, auth, appDbConfigured, stateSigner, fleet } = options;
-  return {
-    githubAppConfigured: github !== void 0,
-    factoryAuthEnabled: auth.enabled(),
-    appDbConfigured,
-    stateSecretConfigured: stateSigner?.stable ?? false,
-    sandboxEnabled: fleet?.enabled ?? false,
-    sandboxProvider: fleet?.provider ?? "none",
-    missingGithubAppEnvVars: github ? [] : [...GITHUB_APP_ENV_VARS]
-  };
-}
-
-// src/integrations/github/pat.ts
-var PAT_SETTINGS_USER_ID = "__github_org_settings__";
-var FIELD_FOR_KIND = {
-  default: "pat",
-  reviewer: "reviewerPat"
-};
-function asToken(value) {
-  return typeof value === "string" && value.length > 0 ? value : null;
-}
-async function getGithubPat(getStorage, orgId, kind = "default") {
-  try {
-    const settings = await getStorage().settings.get(orgId, PAT_SETTINGS_USER_ID);
-    if (!settings) return null;
-    if (kind === "reviewer") return asToken(settings.reviewerPat) ?? asToken(settings.pat);
-    return asToken(settings.pat);
-  } catch {
-    return null;
-  }
-}
-async function getGithubPatStatus(getStorage, orgId) {
-  try {
-    const settings = await getStorage().settings.get(orgId, PAT_SETTINGS_USER_ID);
-    return {
-      configured: asToken(settings?.pat) !== null,
-      reviewerConfigured: asToken(settings?.reviewerPat) !== null
-    };
-  } catch {
-    return { configured: false, reviewerConfigured: false };
-  }
-}
-async function setGithubPat(storage, orgId, pat, kind = "default") {
-  const existing = await storage.settings.get(orgId, PAT_SETTINGS_USER_ID) ?? {};
-  await storage.settings.save(orgId, PAT_SETTINGS_USER_ID, { ...existing, [FIELD_FOR_KIND[kind]]: pat });
-}
-async function clearGithubPat(storage, orgId, kind = "default") {
-  const existing = await storage.settings.get(orgId, PAT_SETTINGS_USER_ID);
-  const field = FIELD_FOR_KIND[kind];
-  if (!existing?.[field]) return;
-  const { [field]: _removed, ...rest } = existing;
-  await storage.settings.save(orgId, PAT_SETTINGS_USER_ID, rest);
-}
-
-// src/integrations/github/sandbox.ts
-import { createHash } from "crypto";
-function bindingStore(row, storage) {
-  return {
-    sandboxId: row.sandboxId,
-    setSandboxId: (id) => id === null ? storage.clearBinding({ id: row.id }) : storage.setSandboxId({ id: row.id, sandboxId: id }),
-    clear: () => storage.clearBinding({ id: row.id })
-  };
-}
-async function ensureProjectSandbox(options) {
-  const { fleet, row, storage, token, onProgress } = options;
-  return fleet.ensureSandbox(bindingStore(row, storage), { GH_TOKEN: token }, onProgress);
-}
-async function teardownProjectSandbox(options) {
-  const { fleet, row, storage, sandbox } = options;
-  return fleet.teardownSandbox(bindingStore(row, storage), sandbox);
-}
-function shellQuote(value) {
-  return `'` + value.split(`'`).join(`'\\''`) + `'`;
-}
-async function sh(sandbox, script) {
-  return sandbox.executeCommand("sh", ["-c", script]);
-}
-var MaterializeError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "MaterializeError";
-  }
-  code;
-};
-function tokenUrl(repoFullName, token) {
-  return `https://x-access-token:${token}@github.com/${repoFullName}.git`;
-}
-function cleanUrl(repoFullName) {
-  return `https://github.com/${repoFullName}.git`;
-}
-async function materializeRepo(options) {
-  const { row: sandboxRow, repoInfo, sandbox, token, storage, onProgress } = options;
-  const workdir = sandboxRow.sandboxWorkdir;
-  const repo = repoInfo.repoFullName;
-  if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) {
-    throw new MaterializeError(`Refusing to materialize: invalid repo full name '${repo}'.`, "clone-failed");
-  }
-  if (!/^[A-Za-z0-9_./-]+$/.test(repoInfo.defaultBranch)) {
-    throw new MaterializeError(
-      `Refusing to materialize: invalid default branch '${repoInfo.defaultBranch}'.`,
-      "clone-failed"
-    );
-  }
-  const gitVersion = await sh(sandbox, "git --version");
-  if (gitVersion.exitCode !== 0) {
-    throw new MaterializeError(
-      "git is not installed in the sandbox. The sandbox template must include git.",
-      "git-missing"
-    );
-  }
-  const authUrl = tokenUrl(repo, token);
-  const alreadyMaterialized = Boolean(sandboxRow.materializedAt) || await hasExistingCheckout(sandbox, workdir, repo);
-  try {
-    if (!alreadyMaterialized) {
-      reportProgress(onProgress, {
-        phase: "cloning",
-        message: `Cloning ${repo} (first open can take a minute)\u2026`
-      });
-      const clone = await sh(
-        sandbox,
-        `git clone --depth=1 --single-branch --branch ${shellQuote(repoInfo.defaultBranch)} ${shellQuote(authUrl)} ${shellQuote(workdir)}`
-      );
-      if (clone.exitCode !== 0) {
-        throw classifyGitFailure(clone, "clone-failed");
-      }
-    } else {
-      reportProgress(onProgress, { phase: "pulling", message: `Updating ${repo} to the latest changes\u2026` });
-      const setUrl = await sh(sandbox, `git -C ${shellQuote(workdir)} remote set-url origin ${shellQuote(authUrl)}`);
-      if (setUrl.exitCode !== 0) {
-        throw new MaterializeError(`Failed to set git remote: ${setUrl.stderr}`, "pull-failed");
-      }
-      const pull = await sh(sandbox, `git -C ${shellQuote(workdir)} pull --ff-only`);
-      if (pull.exitCode !== 0) {
-        throw classifyGitFailure(pull, "pull-failed");
-      }
-    }
-  } finally {
-    await scrubRemote(sandbox, workdir, repo, alreadyMaterialized);
-  }
-  reportProgress(onProgress, { phase: "finalizing", message: "Finalizing workspace\u2026" });
-  await storage.markMaterialized({ id: sandboxRow.id });
-}
-async function hasExistingCheckout(sandbox, workdir, repoFullName) {
-  const result = await sh(sandbox, `git -C ${shellQuote(workdir)} remote get-url origin`);
-  if (result.exitCode !== 0) return false;
-  const url = result.stdout.trim().toLowerCase();
-  const suffix = `github.com/${repoFullName.toLowerCase()}`;
-  return url.endsWith(`${suffix}.git`) || url.endsWith(suffix);
-}
-async function scrubRemote(sandbox, workdir, repoFullName, expectGitDir) {
-  const result = await sh(
-    sandbox,
-    `git -C ${shellQuote(workdir)} remote set-url origin ${shellQuote(cleanUrl(repoFullName))}`
-  );
-  if (result.exitCode !== 0 && expectGitDir) {
-    throw new MaterializeError(
-      `Failed to scrub installation token from git remote: ${result.stderr.trim() || result.stdout.trim()}`,
-      "pull-failed"
-    );
-  }
-}
-function classifyGitFailure(result, fallback) {
-  const stderr = result.stderr || "";
-  if (/could not resolve host|failed to connect|network is unreachable|Connection timed out/i.test(stderr)) {
-    return new MaterializeError(
-      "The sandbox could not reach github.com. The sandbox network must allow outbound egress to github.com.",
-      "egress-blocked"
-    );
-  }
-  const verb = fallback === "clone-failed" ? "clone" : fallback === "pull-failed" ? "pull" : "push";
-  return new MaterializeError(`git ${verb} failed: ${stderr}`, fallback);
-}
-function isValidGitRef(value) {
-  return typeof value === "string" && value.length > 0 && value.length <= 255 && // Reject leading-dash refs (e.g. `--mirror`) so the value can never be
-  // parsed as a git option when interpolated into a command.
-  !value.startsWith("-") && /^[A-Za-z0-9_./-]+$/.test(value);
-}
-function resolveGitIdentity(identity) {
-  const login = (identity.login || "").trim();
-  const name = (identity.name || "").trim() || login || "Mastra Code";
-  const email = (identity.email || "").trim() || (login ? `${login}@users.noreply.github.com` : "mastra-code@users.noreply.github.com");
-  return { name, email };
-}
-async function configureGitIdentity(sandbox, workdir, identity) {
-  const { name, email } = resolveGitIdentity(identity);
-  const setName = await sh(sandbox, `git -C ${shellQuote(workdir)} config user.name ${shellQuote(name)}`);
-  if (setName.exitCode !== 0) {
-    throw new MaterializeError(`Failed to set git user.name: ${setName.stderr.trim()}`, "commit-failed");
-  }
-  const setEmail = await sh(sandbox, `git -C ${shellQuote(workdir)} config user.email ${shellQuote(email)}`);
-  if (setEmail.exitCode !== 0) {
-    throw new MaterializeError(`Failed to set git user.email: ${setEmail.stderr.trim()}`, "commit-failed");
-  }
-}
-async function withInstallToken(sandbox, workdir, repoFullName, token, fn) {
-  if (!/^[\w.-]+\/[\w.-]+$/.test(repoFullName)) {
-    throw new MaterializeError(`Refusing to push: invalid repo full name '${repoFullName}'.`, "push-failed");
-  }
-  const setUrl = await sh(
-    sandbox,
-    `git -C ${shellQuote(workdir)} remote set-url origin ${shellQuote(tokenUrl(repoFullName, token))}`
-  );
-  if (setUrl.exitCode !== 0) {
-    await scrubRemote(sandbox, workdir, repoFullName, false);
-    throw new MaterializeError(`Failed to set git remote: ${setUrl.stderr.trim()}`, "push-failed");
-  }
-  try {
-    return await fn();
-  } finally {
-    await scrubRemote(sandbox, workdir, repoFullName, true);
-  }
-}
-async function pushBranch(sandbox, workdir, branch, token, repoFullName) {
-  if (!isValidGitRef(branch)) {
-    throw new MaterializeError(`Refusing to push: invalid branch name '${branch}'.`, "push-failed");
-  }
-  await withInstallToken(sandbox, workdir, repoFullName, token, async () => {
-    const push = await sh(sandbox, `git -C ${shellQuote(workdir)} push -u origin ${shellQuote(branch)}`);
-    if (push.exitCode !== 0) {
-      throw classifyGitFailure(push, "push-failed");
-    }
-  });
-}
-async function commitAll(sandbox, workdir, message, identity) {
-  await configureGitIdentity(sandbox, workdir, identity);
-  const add = await sh(sandbox, `git -C ${shellQuote(workdir)} add -A`);
-  if (add.exitCode !== 0) {
-    throw new MaterializeError(`git add failed: ${add.stderr.trim() || add.stdout.trim()}`, "commit-failed");
-  }
-  const staged = await sh(sandbox, `git -C ${shellQuote(workdir)} diff --cached --quiet`);
-  if (staged.exitCode === 0) {
-    return { committed: false };
-  }
-  const commit = await sh(sandbox, `git -C ${shellQuote(workdir)} commit -m ${shellQuote(message)}`);
-  if (commit.exitCode !== 0) {
-    throw new MaterializeError(`git commit failed: ${commit.stderr.trim() || commit.stdout.trim()}`, "commit-failed");
-  }
-  return { committed: true };
-}
-var WorktreeError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "WorktreeError";
-  }
-  code;
-};
-function safeBranchDir(branch) {
-  const sanitized = branch.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/\/+/g, "-").replace(/^[-.]+|[-.]+$/g, "").slice(0, 100) || "work";
-  if (sanitized === branch) return sanitized;
-  const hash = createHash("sha256").update(branch).digest("hex").slice(0, 8);
-  return `${sanitized}-${hash}`;
-}
-function computeWorktreePath(repoWorkdir, branch) {
-  const parent = repoWorkdir.replace(/\/+$/, "").split("/").slice(0, -1).join("/") || "";
-  return `${parent}/worktrees/${safeBranchDir(branch)}`;
-}
-
-// src/integrations/github/subscriptions.ts
-function changeRequestTargetKey(input) {
-  return `change-request:${input.installationExternalId}:${input.repositoryExternalId}:${input.changeRequestId}`;
-}
-function sameSession(row, input) {
-  return row.orgId === input.orgId && row.sessionId === input.sessionId && row.resourceId === input.resourceId && row.threadId === input.threadId && (row.sessionScope ?? "") === (input.sessionScope ?? "");
-}
-async function subscribeToPullRequest(input, storage) {
-  const targetKey = changeRequestTargetKey(input);
-  const existing = (await storage.subscriptions.listByTarget(targetKey)).find((row) => sameSession(row, input));
-  if (existing) {
-    if (existing.status !== "open") await storage.subscriptions.updateStatus(existing.id, "open");
-    return { ...existing, status: "open" };
-  }
-  return storage.subscriptions.create({
-    orgId: input.orgId,
-    targetKey,
-    sessionId: input.sessionId,
-    resourceId: input.resourceId,
-    threadId: input.threadId,
-    sessionScope: input.sessionScope ?? "",
-    status: "open",
-    data: {
-      installationExternalId: input.installationExternalId,
-      projectRepositoryId: input.projectRepositoryId,
-      repositoryExternalId: input.repositoryExternalId,
-      repositorySlug: input.repositorySlug,
-      changeRequestId: input.changeRequestId,
-      ownerId: input.ownerId,
-      source: input.source,
-      subscribedByUserId: input.subscribedByUserId ?? null
-    }
-  });
-}
-async function unsubscribeFromPullRequest(input, storage) {
-  const rows = await storage.subscriptions.listByTarget(changeRequestTargetKey(input));
-  await Promise.all(rows.filter((row) => sameSession(row, input)).map((row) => storage.subscriptions.delete(row.id)));
-}
-async function listPullRequestSubscriptionsForThread(input, storage) {
-  const rows = await storage.subscriptions.listByThread(input.resourceId, input.threadId);
-  return rows.filter(
-    (row) => row.orgId === input.orgId && row.resourceId === input.resourceId && row.threadId === input.threadId && (row.sessionScope ?? "") === (input.sessionScope ?? "")
-  );
-}
-async function listPullRequestSubscriptionsForWebhook(input, options, storage) {
-  const rows = await storage.subscriptions.listByTarget(changeRequestTargetKey(input));
-  return options?.includeTerminal ? rows : rows.filter((row) => row.status === "open");
-}
-function retirePullRequestSubscription(id, status, storage) {
-  return storage.subscriptions.updateStatus(id, status);
-}
-
-// src/integrations/github/webhook.ts
-import { createHmac, timingSafeEqual } from "crypto";
-var SUPPORTED_GITHUB_WEBHOOK_EVENTS = /* @__PURE__ */ new Set([
-  "issues",
-  "issue_comment",
-  "pull_request",
-  "pull_request_review",
-  "pull_request_review_comment"
-]);
-function normalizeHeader(value) {
-  if (!value) return null;
-  const trimmed = value.trim();
-  return trimmed.length > 0 ? trimmed : null;
-}
-function verifySignature(rawBody, signature, secret) {
-  if (!signature.startsWith("sha256=")) return false;
-  const signatureHex = signature.slice("sha256=".length);
-  if (!/^[a-fA-F0-9]{64}$/.test(signatureHex)) return false;
-  const expectedHex = createHmac("sha256", secret).update(rawBody).digest("hex");
-  const received = Buffer.from(signatureHex, "hex");
-  const expected = Buffer.from(expectedHex, "hex");
-  return received.length === expected.length && timingSafeEqual(received, expected);
-}
-async function parseGithubWebhook(c, secret) {
-  if (!secret) {
-    return { status: 401, body: { error: "unauthorized", message: "GitHub webhook secret is not configured" } };
-  }
-  const event = normalizeHeader(c.req.header("x-github-event"));
-  const deliveryId = normalizeHeader(c.req.header("x-github-delivery"));
-  const signature = normalizeHeader(c.req.header("x-hub-signature-256"));
-  if (!event) return { status: 400, body: { error: "bad_request", message: "Missing x-github-event header" } };
-  if (!deliveryId) return { status: 400, body: { error: "bad_request", message: "Missing x-github-delivery header" } };
-  if (!signature)
-    return { status: 401, body: { error: "unauthorized", message: "Missing x-hub-signature-256 header" } };
-  const rawBody = await c.req.text();
-  if (!verifySignature(rawBody, signature, secret)) {
-    return { status: 401, body: { error: "unauthorized", message: "Invalid GitHub webhook signature" } };
-  }
-  let payload;
-  try {
-    payload = JSON.parse(rawBody);
-  } catch {
-    return { status: 400, body: { error: "bad_request", message: "Malformed JSON payload" } };
-  }
-  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-    return { status: 400, body: { error: "bad_request", message: "Payload must be a JSON object" } };
-  }
-  return { event, deliveryId, payload };
-}
-function getObject(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-}
-function getString(value) {
-  return typeof value === "string" && value.length > 0 ? value : void 0;
-}
-function getNumber(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
-function getBoolean(value) {
-  return typeof value === "boolean" ? value : void 0;
-}
-function getLabels(value) {
-  if (!Array.isArray(value)) return [];
-  return value.map((label) => typeof label === "string" ? label : getString(getObject(label)?.name)).filter((label) => Boolean(label));
-}
-function getIssueTriageRunInput(parsed) {
-  if (parsed.event !== "issues" || getString(parsed.payload.action) !== "opened") return null;
-  const repository = getString(getObject(parsed.payload.repository)?.full_name);
-  const issue = getObject(parsed.payload.issue);
-  const sender = getString(getObject(parsed.payload.sender)?.login);
-  const installationId = getNumber(getObject(parsed.payload.installation)?.id);
-  const issueNumber = getNumber(issue?.number);
-  const issueTitle = getString(issue?.title);
-  const issueUrl = getString(issue?.html_url);
-  if (!repository || !installationId || !issueNumber || !issueTitle || !issueUrl) return null;
-  return {
-    repository,
-    issueNumber,
-    issueTitle,
-    issueUrl,
-    labels: getLabels(issue?.labels),
-    sender,
-    installationId
-  };
-}
-function normalizeGithubWebhookMetadata(parsed) {
-  const { event, deliveryId, payload } = parsed;
-  const repository = getObject(payload.repository);
-  const issue = getObject(payload.issue);
-  const pullRequest = getObject(payload.pull_request);
-  const sender = getObject(payload.sender);
-  const installation = getObject(payload.installation);
-  const issuePullRequest = getObject(issue?.pull_request);
-  return {
-    event,
-    action: getString(payload.action),
-    deliveryId,
-    repository: getString(repository?.full_name),
-    repositoryId: getNumber(repository?.id),
-    issueNumber: getNumber(issue?.number),
-    pullRequestNumber: getNumber(pullRequest?.number) ?? (event === "issue_comment" && issuePullRequest ? getNumber(issue?.number) : void 0),
-    sender: getString(sender?.login),
-    senderType: getString(sender?.type),
-    installationId: getNumber(installation?.id)
-  };
-}
-function notificationSummary(metadata, label) {
-  const actor = metadata.sender ? `${metadata.sender} ` : "";
-  return `${actor}${label} on ${metadata.repository}#${metadata.pullRequestNumber}`;
-}
-function notificationTargetUrl(event, payload) {
-  if (event === "issue_comment" || event === "pull_request_review_comment") {
-    return getString(getObject(payload.comment)?.html_url);
-  }
-  if (event === "pull_request_review") {
-    return getString(getObject(payload.review)?.html_url);
-  }
-  return getString(getObject(payload.pull_request)?.html_url);
-}
-function classifyGithubWebhook(parsed) {
-  const metadata = normalizeGithubWebhookMetadata(parsed);
-  const { event, payload } = parsed;
-  const action = metadata.action;
-  if (!action || !metadata.repositoryId || !metadata.installationId || !metadata.pullRequestNumber || !metadata.repository) {
-    return void 0;
-  }
-  let priority;
-  let kind;
-  let label;
-  let terminal = false;
-  if (event === "pull_request_review" && action === "submitted") {
-    const state = getString(getObject(payload.review)?.state)?.toLowerCase().replaceAll("_", "-");
-    priority = state === "approved" || state === "changes-requested" ? "urgent" : "high";
-    kind = state === "approved" ? "review-approved" : state === "changes-requested" ? "review-changes-requested" : "review-submitted";
-    label = state === "approved" ? "approved the pull request" : state === "changes-requested" ? "requested changes" : "submitted a review";
-  } else if (event === "pull_request" && action === "closed") {
-    const merged = getBoolean(getObject(payload.pull_request)?.merged) === true;
-    priority = "urgent";
-    kind = merged ? "pull-request-merged" : "pull-request-closed";
-    label = merged ? "merged the pull request" : "closed the pull request";
-    terminal = true;
-  } else if (event === "issue_comment" && action === "created") {
-    priority = "high";
-    kind = "issue-comment-created";
-    label = "commented";
-  } else if (event === "pull_request_review_comment" && action === "created") {
-    priority = "high";
-    kind = "review-comment-created";
-    label = "left a review comment";
-  } else if (event === "pull_request" && action === "reopened") {
-    priority = "high";
-    kind = "pull-request-reopened";
-    label = "reopened the pull request";
-  } else if (event === "pull_request_review" && action === "dismissed") {
-    priority = "high";
-    kind = "review-dismissed";
-    label = "dismissed a review";
-  } else if (event === "pull_request" && [
-    "synchronize",
-    "ready_for_review",
-    "converted_to_draft",
-    "assigned",
-    "unassigned",
-    "review_requested",
-    "review_request_removed"
-  ].includes(action)) {
-    priority = "medium";
-    kind = `pull-request-${action.replaceAll("_", "-")}`;
-    label = action.replaceAll("_", " ");
-  } else if (event === "pull_request" && ["edited", "labeled", "unlabeled", "milestoned", "demilestoned"].includes(action)) {
-    priority = "low";
-    kind = `pull-request-${action.replaceAll("_", "-")}`;
-    label = action.replaceAll("_", " ");
-  } else {
-    return void 0;
-  }
-  return {
-    action,
-    kind,
-    priority,
-    summary: notificationSummary(metadata, label),
-    terminal,
-    metadata: {
-      ...metadata,
-      pullRequestNumber: metadata.pullRequestNumber,
-      repositoryId: metadata.repositoryId,
-      installationId: metadata.installationId
-    },
-    payload
-  };
-}
-async function resolveSubscriptionSession(controller, subscription) {
-  const { sessionId, resourceId, threadId } = subscription;
-  if (!sessionId || !resourceId || !threadId) {
-    throw new Error(`GitHub subscription ${subscription.id} is missing its session binding.`);
-  }
-  const scope = subscription.sessionScope || void 0;
-  let session = await controller.getSessionByResource(resourceId, scope);
-  if (!session) {
-    const tags = {
-      factoryProjectId: resourceId,
-      projectRepositoryId: subscription.data.projectRepositoryId,
-      ...scope ? { worktreePath: scope } : {}
-    };
-    session = await controller.createSession({
-      id: sessionId,
-      ownerId: subscription.data.ownerId,
-      resourceId,
-      scope,
-      tags
-    });
-  }
-  if (session.thread.getId() !== threadId) {
-    await session.thread.switch({ threadId, emitEvent: false });
-  }
-  if (session.thread.getId() !== threadId) {
-    throw new Error(`Session ${sessionId} did not bind thread ${threadId}.`);
-  }
-  return session;
-}
-var AUTHORIZED_BOTS = /* @__PURE__ */ new Set(["coderabbitai[bot]", "devin-ai-integration[bot]"]);
-var AUTHORIZED_PERMISSIONS = /* @__PURE__ */ new Set(["admin", "maintain", "write"]);
-var PERMISSION_CHECK_TIMEOUT_MS = 5e3;
-var AUTHOR_GATED_KINDS = /* @__PURE__ */ new Set([
-  "issue-comment-created",
-  "review-comment-created",
-  "review-submitted",
-  "review-approved",
-  "review-changes-requested",
-  "review-dismissed"
-]);
-async function isAuthorizedGithubSender(notification, github) {
-  if (!AUTHOR_GATED_KINDS.has(notification.kind)) return true;
-  const sender = notification.metadata.sender;
-  const repository = notification.metadata.repository;
-  if (!sender || !repository) return false;
-  const normalizedSender = sender.toLowerCase();
-  if (notification.metadata.senderType?.toLowerCase() === "bot" || normalizedSender.endsWith("[bot]")) {
-    return AUTHORIZED_BOTS.has(normalizedSender);
-  }
-  if (!github) return false;
-  const abortController = new AbortController();
-  let timeout;
-  try {
-    const permission = await Promise.race([
-      github.getRepositoryCollaboratorPermission(
-        notification.metadata.installationId,
-        repository,
-        sender,
-        abortController.signal
-      ),
-      new Promise((resolve) => {
-        timeout = setTimeout(() => {
-          abortController.abort();
-          resolve(void 0);
-        }, PERMISSION_CHECK_TIMEOUT_MS);
-      })
-    ]);
-    return permission !== void 0 && AUTHORIZED_PERMISSIONS.has(permission);
-  } catch {
-    return false;
-  } finally {
-    if (timeout) clearTimeout(timeout);
-  }
-}
-async function dispatchGithubWebhook(parsed, dependencies) {
-  const notification = classifyGithubWebhook(parsed);
-  if (!notification) return { delivered: 0, failed: 0, ignored: true };
-  const isAuthorizedSender = dependencies.isAuthorizedSender ?? ((n) => isAuthorizedGithubSender(n, dependencies.github));
-  if (!await isAuthorizedSender(notification)) {
-    return { delivered: 0, failed: 0, ignored: true };
-  }
-  const target = {
-    installationExternalId: notification.metadata.installationId.toString(),
-    repositoryExternalId: notification.metadata.repositoryId.toString(),
-    changeRequestId: notification.metadata.pullRequestNumber.toString()
-  };
-  const listSubscriptions = dependencies.listSubscriptions ?? ((subscriptionTarget, options) => {
-    if (!dependencies.github) throw new Error("GitHub integration is required to load webhook subscriptions.");
-    return listPullRequestSubscriptionsForWebhook(
-      subscriptionTarget,
-      options,
-      dependencies.github.integrationStorage
-    );
-  });
-  const retireSubscription = dependencies.retireSubscription ?? ((id, status) => {
-    if (!dependencies.github) throw new Error("GitHub integration is required to retire webhook subscriptions.");
-    return retirePullRequestSubscription(id, status, dependencies.github.integrationStorage);
-  });
-  const subscriptions = await listSubscriptions(target, { includeTerminal: notification.action === "reopened" });
-  let delivered = 0;
-  let failed = 0;
-  for (const subscription of subscriptions) {
-    try {
-      const session = await resolveSubscriptionSession(dependencies.controller, subscription);
-      const result = await session.sendNotificationSignal({
-        source: "github",
-        kind: notification.kind,
-        summary: notification.summary,
-        priority: notification.priority,
-        payload: notification.payload,
-        sourceId: parsed.deliveryId,
-        dedupeKey: `${parsed.deliveryId}:${subscription.sessionId}:${subscription.threadId}`,
-        coalesceKey: `github:${subscription.data.repositoryExternalId}:pull-request:${subscription.data.changeRequestId}`,
-        metadata: {
-          event: notification.metadata.event,
-          action: notification.action,
-          repository: notification.metadata.repository,
-          issueNumber: notification.metadata.issueNumber,
-          pullRequestNumber: notification.metadata.pullRequestNumber,
-          targetUrl: notificationTargetUrl(parsed.event, parsed.payload),
-          deliveryId: parsed.deliveryId
-        }
-      });
-      await Promise.all([result.persisted, result.accepted].filter(Boolean));
-      if (notification.terminal) {
-        await retireSubscription(subscription.id, notification.kind === "pull-request-merged" ? "merged" : "closed");
-      } else if (notification.action === "reopened") {
-        await retireSubscription(subscription.id, "open");
-      }
-      delivered += 1;
-    } catch (error) {
-      failed += 1;
-      dependencies.onTargetError?.(subscription, error);
-    }
-  }
-  return { delivered, failed, ignored: false };
-}
-async function handleGithubWebhook(c, options) {
-  const parsed = await parseGithubWebhook(c, options.github.webhookSecret);
-  if ("status" in parsed) return parsed;
-  if (!SUPPORTED_GITHUB_WEBHOOK_EVENTS.has(parsed.event)) {
-    return { status: 202, body: { ok: true, ignored: true } };
-  }
-  const metadata = normalizeGithubWebhookMetadata(parsed);
-  console.info("[GitHub Webhook]", metadata);
-  if (options.ingestFactoryEvent) {
-    await options.ingestFactoryEvent(parsed);
-  } else {
-    const issueTriageRun = getIssueTriageRunInput(parsed);
-    if (issueTriageRun && options.runIssueTriage) {
-      void options.runIssueTriage(issueTriageRun).catch((error) => {
-        console.error("[GitHub Webhook] Failed to run issue triage", {
-          deliveryId: metadata.deliveryId,
-          repository: metadata.repository,
-          issueNumber: metadata.issueNumber,
-          error: error instanceof Error ? error.message : String(error)
-        });
-      });
-    }
-  }
-  if (!options.controller) {
-    return { status: 202, body: { ok: true } };
-  }
-  const result = await dispatchGithubWebhook(parsed, options);
-  if (result.failed > 0) {
-    console.warn(`[GitHub Webhook] ${result.failed} subscribed target(s) failed for delivery ${parsed.deliveryId}.`);
-  }
-  return { status: 202, body: { ok: true, ...result.ignored ? { ignored: true } : {} } };
-}
-
-// src/integrations/github/routes.ts
-var sessionOperationLocks = /* @__PURE__ */ new Map();
-function withSessionOperationLock(sessionId, fn) {
-  const previous = sessionOperationLocks.get(sessionId) ?? Promise.resolve();
-  const next = previous.then(fn, fn);
-  const tail = next.then(
-    () => void 0,
-    () => void 0
-  );
-  sessionOperationLocks.set(sessionId, tail);
-  void tail.then(() => {
-    if (sessionOperationLocks.get(sessionId) === tail) sessionOperationLocks.delete(sessionId);
-  });
-  return next;
-}
 function loose(c) {
-  return c;
-}
-async function resolveFactoryDefaultModelId(projects, factoryProjectId) {
-  if (!projects || !factoryProjectId) return void 0;
-  try {
-    const project = await projects.getById({ id: factoryProjectId });
-    return project?.defaultModelId ?? void 0;
-  } catch {
-    return void 0;
-  }
-}
-function pullRequestNumberFromUrl(value, expectedRepo) {
-  try {
-    const url = new URL(value);
-    const match = url.pathname.match(/^\/([^/]+\/[^/]+)\/pull\/(\d+)\/?$/);
-    if (url.protocol !== "https:" || url.hostname !== "github.com" || match?.[1]?.toLowerCase() !== expectedRepo.toLowerCase()) {
-      return void 0;
-    }
-    const number2 = Number(match[2]);
-    return Number.isInteger(number2) && number2 > 0 ? number2 : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function isCanonicalGithubIssueUrl(value, repoFullName, issueNumber) {
-  try {
-    const url = new URL(value);
-    const [owner, repo] = repoFullName.split("/");
-    return url.protocol === "https:" && url.hostname === "github.com" && url.pathname === `/${owner}/${repo}/issues/${issueNumber}` && url.search === "" && url.hash === "";
-  } catch {
-    return false;
-  }
-}
-function isValidGitRef2(value) {
-  return typeof value === "string" && value.length > 0 && value.length <= 255 && /^[A-Za-z0-9_./-]+$/.test(value);
-}
-async function resolveOrgTenant(c, auth) {
-  await auth.ensureUser(c);
-  const tenant = auth.tenant(c);
-  if (!tenant) return { response: c.json({ error: "unauthorized" }, 401) };
-  if (!tenant.orgId) {
-    return {
-      response: c.json(
-        {
-          error: "organization_required",
-          message: "GitHub projects require a WorkOS organization. Personal accounts cannot connect repositories."
-        },
-        403
-      )
-    };
-  }
-  return { tenant: { orgId: tenant.orgId, userId: tenant.userId } };
-}
-function parseListPage(raw) {
-  if (raw === void 0) return 1;
-  if (!/^\d{1,5}$/.test(raw)) return null;
-  const page = Number(raw);
-  return page >= 1 ? page : null;
-}
-var VALID_ISSUE_LABEL_FILTERS = /* @__PURE__ */ new Set(["auto-triaged", "needs-approval"]);
-function parseIssueLabelFilter(raw) {
-  if (raw === void 0 || raw === "") return void 0;
-  if (VALID_ISSUE_LABEL_FILTERS.has(raw)) return raw;
-  return null;
-}
-function parseIssueNumberParam(raw) {
-  if (!raw || !/^\d{1,10}$/.test(raw)) return null;
-  const issueNumber = Number(raw);
-  return Number.isSafeInteger(issueNumber) && issueNumber > 0 ? issueNumber : null;
-}
-function parseStringList(value) {
-  if (!Array.isArray(value)) return [];
-  return value.filter((item) => typeof item === "string" && item.length > 0);
-}
-async function resolveProjectRepository(args) {
-  const projectRepository = await args.github.sourceControlStorage.projectRepositories.get({
-    orgId: args.orgId,
-    id: args.projectRepositoryId
-  });
-  if (!projectRepository) return null;
-  const connection = await args.github.sourceControlStorage.connections.get({
-    orgId: args.orgId,
-    id: projectRepository.connectionId
-  });
-  if (!connection) return null;
-  const repository = await args.github.sourceControlStorage.repositories.get({
-    orgId: args.orgId,
-    id: projectRepository.repositoryId
-  });
-  if (!repository) return null;
-  const installation = await args.github.sourceControlStorage.installations.get({
-    orgId: args.orgId,
-    id: connection.installationId
-  });
-  if (!installation) return null;
-  return {
-    ...projectRepository,
-    connection,
-    installation,
-    repository,
-    factoryProjectId: connection.factoryProjectId,
-    defaultBranch: projectRepository.branch ?? repository.defaultBranch
-  };
-}
-function polledIssueEvent(project, issue) {
-  const repositoryId = Number(project.repository.externalId);
-  return {
-    event: "issues",
-    deliveryId: `poll:${repositoryId}:issue:${issue.number}:${issue.createdAt}`,
-    payload: {
-      action: "opened",
-      installation: { id: Number(project.installation.externalId) },
-      repository: { id: repositoryId, full_name: project.repository.slug },
-      sender: { login: issue.author ?? "__unknown__" },
-      issue: {
-        number: issue.number,
-        title: issue.title,
-        html_url: issue.url,
-        created_at: issue.createdAt,
-        labels: issue.labels.map((name) => ({ name }))
-      }
-    }
-  };
-}
-function polledPullRequestEvent(project, pullRequest) {
-  const repositoryId = Number(project.repository.externalId);
-  return {
-    event: "pull_request",
-    deliveryId: `poll:${repositoryId}:pull-request:${pullRequest.number}:${pullRequest.createdAt}`,
-    payload: {
-      action: "opened",
-      installation: { id: Number(project.installation.externalId) },
-      repository: { id: repositoryId, full_name: project.repository.slug },
-      sender: { login: pullRequest.author ?? "__unknown__" },
-      pull_request: {
-        number: pullRequest.number,
-        title: pullRequest.title,
-        html_url: pullRequest.url,
-        created_at: pullRequest.createdAt,
-        state: "open",
-        merged: false,
-        head: { ref: pullRequest.headBranch },
-        base: { ref: pullRequest.baseBranch }
-      }
-    }
-  };
-}
-async function ingestPolledEvents(events, ingestFactoryEvent) {
-  if (!ingestFactoryEvent) return;
-  const results = await Promise.allSettled(events.map((event) => ingestFactoryEvent(event)));
-  const rejected = results.find((result) => result.status === "rejected");
-  if (rejected) throw rejected.reason;
-}
-function buildGithubRoutes(options) {
-  const routes = [];
-  const { auth, fleet, storage, github, stateSigner, emitAudit } = options;
-  const diagnostics = () => getGithubFeatureDiagnostics({ github, auth, appDbConfigured: storage !== void 0, stateSigner, fleet });
-  routes.push(
-    registerApiRoute("/web/github/status", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        if (!isGithubFeatureEnabled({ github, auth }) || !github || !stateSigner) {
-          return c.json({
-            enabled: false,
-            connected: false,
-            installations: [],
-            reason: "missing_config",
-            diagnostics: diagnostics()
-          });
-        }
-        await auth.ensureUser(loose(c));
-        const tenant = auth.tenant(loose(c));
-        if (!tenant) return c.json({ error: "unauthorized", reason: "auth_required" }, 401);
-        if (!tenant.orgId) {
-          return c.json({
-            enabled: true,
-            sandboxEnabled: fleet.enabled,
-            organizationRequired: true,
-            connected: false,
-            installations: [],
-            reason: "organization_required",
-            diagnostics: diagnostics()
-          });
-        }
-        const rows = options.github ? await options.github.sourceControlStorage.installations.list({ orgId: tenant.orgId }) : [];
-        const connected = rows.length > 0;
-        return c.json({
-          enabled: true,
-          sandboxEnabled: fleet.enabled,
-          connected,
-          installations: rows.map((r) => ({
-            installationId: Number(r.externalId),
-            accountLogin: r.accountName,
-            accountType: r.accountType
-          })),
-          reason: connected ? "ready" : "not_connected",
-          diagnostics: diagnostics()
-        });
-      }
-    })
-  );
-  if (!isGithubFeatureEnabled({ github, auth }) || !github || !stateSigner) {
-    return routes;
-  }
-  const signState = (orgId, userId) => stateSigner.sign(orgId, userId);
-  const verifyState = (state) => stateSigner.verify(state);
-  const { runIssueTriage } = options;
-  const runBoardIssueTriage = runIssueTriage ? async (input) => {
-    if (!input.resourceId || !input.projectPath) {
-      throw new Error("GitHub issue triage requires an explicit Factory project repository");
-    }
-    await github.addIssueLabels(input.installationId, input.repository, input.issueNumber, ["auto-triaged"]);
-    return runIssueTriage({
-      ...input,
-      defaultModelId: input.defaultModelId ?? await resolveFactoryDefaultModelId(options.projects, input.resourceId),
-      labels: input.labels.includes("auto-triaged") ? input.labels : [...input.labels, "auto-triaged"]
-    });
-  } : void 0;
-  routes.push(
-    registerApiRoute("/web/github/subscriptions", {
-      method: "GET",
-      handler: async (c) => {
-        await auth.ensureUser(loose(c));
-        const tenant = auth.tenant(loose(c));
-        if (!tenant?.orgId) return c.json({ error: "unauthorized" }, 401);
-        const resourceId = c.req.query("resourceId");
-        const threadId = c.req.query("threadId");
-        const sessionScope = c.req.query("scope");
-        if (!resourceId || !threadId) return c.json({ error: "resourceId and threadId are required" }, 400);
-        const subscriptions = await listPullRequestSubscriptionsForThread(
-          {
-            orgId: tenant.orgId,
-            resourceId,
-            threadId,
-            sessionScope
-          },
-          github.integrationStorage
-        );
-        return c.json({
-          subscriptions: subscriptions.map((subscription) => ({
-            id: subscription.id,
-            repoFullName: subscription.data.repositorySlug,
-            pullRequestNumber: Number(subscription.data.changeRequestId),
-            status: subscription.status,
-            url: `https://github.com/${subscription.data.repositorySlug}/pull/${subscription.data.changeRequestId}`
-          }))
-        });
-      }
-    }),
-    registerApiRoute("/web/github/webhook", {
-      method: "POST",
-      requiresAuth: false,
-      handler: async (c) => {
-        const result = await handleGithubWebhook(loose(c), {
-          github,
-          runIssueTriage: runBoardIssueTriage,
-          ingestFactoryEvent: options.ingestFactoryEvent,
-          ...options.controller ? {
-            controller: options.controller,
-            onTargetError: (subscription, error) => {
-              console.warn(
-                `[GitHub Webhook] Delivery failed for subscription ${subscription.id} (${subscription.resourceId}/${subscription.threadId}).`,
-                error
-              );
-            }
-          } : {}
-        });
-        return c.json(result.body, result.status);
-      }
-    })
-  );
-  const redirectUri = options.redirectUri ?? `${(options.baseUrl ?? "").replace(/\/$/, "")}/auth/github/callback`;
-  routes.push(
-    registerApiRoute("/auth/github/connect", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        const state = signState(resolved.tenant.orgId, resolved.tenant.userId);
-        if (c.req.query("manage")) return c.redirect(github.buildInstallUrl(state));
-        return c.redirect(github.buildOAuthIdentifyUrl(state, redirectUri));
-      }
-    })
-  );
-  routes.push(
-    registerApiRoute("/auth/github/callback", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        const { orgId, userId } = resolved.tenant;
-        const state = c.req.query("state");
-        if (!state) {
-          return c.redirect(github.buildOAuthIdentifyUrl(signState(orgId, userId), redirectUri));
-        }
-        const stateTenant = verifyState(state);
-        if (!stateTenant || stateTenant.userId !== userId || stateTenant.orgId !== orgId) {
-          console.warn(
-            "[GitHub] Install callback rejected: state/tenant mismatch.",
-            JSON.stringify({
-              stateValid: Boolean(stateTenant),
-              stateOrgId: stateTenant?.orgId,
-              stateUserId: stateTenant?.userId,
-              sessionOrgId: orgId,
-              sessionUserId: userId
-            })
-          );
-          return c.redirect("/?github=error");
-        }
-        const code = c.req.query("code");
-        if (!code) {
-          return c.redirect(github.buildOAuthIdentifyUrl(signState(orgId, userId), redirectUri));
-        }
-        try {
-          const userToken = await github.exchangeOAuthCode(code, redirectUri);
-          const installations = await github.listUserInstallations(userToken);
-          if (installations.length === 0) {
-            return c.redirect(github.buildInstallUrl(signState(orgId, userId)));
-          }
-          for (const inst of installations) {
-            await github.sourceControlStorage.installations.upsert({
-              orgId,
-              connectedByUserId: userId,
-              externalId: inst.installationId.toString(),
-              accountName: inst.accountLogin,
-              accountType: inst.accountType
-            });
-          }
-        } catch (error) {
-          console.warn(
-            `[GitHub] Install callback failed to persist installations for org ${orgId} / user ${userId}.`,
-            error
-          );
-          return c.redirect("/?github=error");
-        }
-        return c.redirect("/?github=connected");
-      }
-    })
-  );
-  routes.push(
-    registerApiRoute("/web/github/repos", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        const installs = await github.sourceControlStorage.installations.list({ orgId: resolved.tenant.orgId });
-        const query = (c.req.query("q") ?? "").toLowerCase();
-        const repos = [];
-        const seenRepositoryIds = /* @__PURE__ */ new Set();
-        for (const inst of installs) {
-          let list;
-          try {
-            list = await github.listInstallationRepos(Number(inst.externalId));
-          } catch (err) {
-            if (err.status !== 404) throw err;
-            console.error(`[Mastra Factory] pruning stale GitHub installation ${inst.externalId} (404 from GitHub)`);
-            await github.sourceControlStorage.installations.delete({ orgId: resolved.tenant.orgId, id: inst.id });
-            continue;
-          }
-          for (const repo of list) {
-            if (query && !repo.fullName.toLowerCase().includes(query)) continue;
-            if (seenRepositoryIds.has(repo.id)) continue;
-            seenRepositoryIds.add(repo.id);
-            const repository = await github.sourceControlStorage.repositories.upsert({
-              orgId: resolved.tenant.orgId,
-              input: {
-                installationId: inst.id,
-                externalId: repo.id.toString(),
-                slug: repo.fullName,
-                defaultBranch: isValidGitRef2(repo.defaultBranch) ? repo.defaultBranch : "main",
-                providerMetadata: { private: repo.private, owner: repo.owner }
-              }
-            });
-            repos.push({
-              ...repo,
-              installationStorageId: inst.id,
-              repositoryStorageId: repository.id,
-              sandboxProvider: fleet.provider,
-              sandboxWorkdir: fleet.computeWorkdir(repo.fullName)
-            });
-          }
-        }
-        return c.json({ repos });
-      }
-    })
-  );
-  routes.push(
-    registerApiRoute("/web/github/projects/:id/ensure", {
-      method: "POST",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        const { orgId, userId } = resolved.tenant;
-        if (!fleet.enabled) {
-          return c.json({ error: "sandbox_not_configured", message: "No sandbox provider is configured." }, 503);
-        }
-        const projectRepositoryId = c.req.param("id");
-        if (!projectRepositoryId) return c.json({ error: "Project repository not found" }, 404);
-        const project = await resolveProjectRepository({ github, orgId, projectRepositoryId });
-        if (!project) {
-          return c.json({ error: "Project repository not found" }, 404);
-        }
-        const wantsStream = (c.req.header("accept") ?? "").includes("text/event-stream");
-        if (wantsStream) {
-          return streamSSE(loose(c), async (stream) => {
-            try {
-              const result = await prepareProject({
-                github,
-                fleet,
-                project,
-                userId,
-                onProgress: (ev) => void stream.writeSSE({ event: "progress", data: JSON.stringify(ev) })
-              });
-              await stream.writeSSE({ event: "done", data: JSON.stringify(result) });
-            } catch (err) {
-              await stream.writeSSE({ event: "error", data: JSON.stringify(ensureErrorPayload(err).body) });
-            }
-          });
-        }
-        try {
-          const result = await prepareProject({ github, fleet, project, userId });
-          return c.json(result);
-        } catch (err) {
-          const { status, body } = ensureErrorPayload(err);
-          return c.json(body, status);
-        }
-      }
-    })
-  );
-  routes.push(
-    registerApiRoute("/web/github/projects/:id/issues", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        const loaded = await loadOrgProject({ github, auth, c: loose(c) });
-        if ("response" in loaded) return loaded.response;
-        const page = parseListPage(c.req.query("page"));
-        if (page === null) return c.json({ error: "invalid_page" }, 400);
-        const label = parseIssueLabelFilter(c.req.query("label"));
-        if (label === null) return c.json({ error: "invalid_label" }, 400);
-        try {
-          const { issues, nextCursor } = await github.intake.listIssues({
-            connection: {
-              type: "app-installation",
-              installationId: Number(loaded.project.installation.externalId)
-            },
-            sourceIds: [loaded.project.repository.slug],
-            labels: label ? [label] : void 0,
-            cursor: String(page)
-          });
-          const responseIssues = issues.map((issue) => ({
-            number: Number(issue.id),
-            title: issue.title,
-            url: issue.url,
-            author: issue.author,
-            labels: issue.labels,
-            comments: issue.commentCount ?? 0,
-            createdAt: issue.createdAt,
-            updatedAt: issue.updatedAt
-          }));
-          await ingestPolledEvents(
-            responseIssues.map((issue) => polledIssueEvent(loaded.project, issue)),
-            options.ingestFactoryEvent
-          );
-          return c.json({
-            issues: responseIssues,
-            nextPage: nextCursor === null ? null : Number(nextCursor)
-          });
-        } catch (err) {
-          return c.json(
-            { error: "github_fetch_failed", message: err instanceof Error ? err.message : String(err) },
-            502
-          );
-        }
-      }
-    })
-  );
-  routes.push(
-    registerApiRoute("/web/github/projects/:id/issues/:number/triage", {
-      method: "POST",
-      requiresAuth: false,
-      handler: async (c) => {
-        const owned = await loadOwnedProject({ github, auth, fleet, c: loose(c) });
-        if ("response" in owned) return owned.response;
-        const { project, sandboxRow } = owned;
-        const issueNumber = parseIssueNumberParam(c.req.param("number"));
-        if (issueNumber === null) return c.json({ error: "invalid_issue_number" }, 400);
-        let body;
-        try {
-          body = await c.req.json();
-        } catch {
-          return c.json({ error: "Invalid JSON body" }, 400);
-        }
-        if (typeof body.title !== "string" || body.title.trim().length === 0 || body.title.length > 5e3) {
-          return c.json({ error: "invalid_title" }, 400);
-        }
-        if (typeof body.url !== "string" || body.url.trim().length === 0 || body.url.length > 2048 || !isCanonicalGithubIssueUrl(body.url, project.repository.slug, issueNumber)) {
-          return c.json({ error: "invalid_url" }, 400);
-        }
-        if (!runIssueTriage) return c.json({ error: "triage_unavailable" }, 503);
-        const branch = `factory/issue-${issueNumber}`;
-        const projectPath = computeWorktreePath(sandboxRow.sandboxWorkdir, branch);
-        await github.addIssueLabels(Number(project.installation.externalId), project.repository.slug, issueNumber, [
-          "auto-triaged"
-        ]);
-        const result = await runIssueTriage({
-          repository: project.repository.slug,
-          issueNumber,
-          issueTitle: body.title,
-          issueUrl: body.url,
-          labels: parseStringList(body.labels),
-          installationId: Number(project.installation.externalId),
-          resourceId: project.factoryProjectId,
-          projectPath,
-          branch,
-          defaultModelId: await resolveFactoryDefaultModelId(options.projects, project.factoryProjectId)
-        });
-        await emitAudit?.({
-          context: loose(c),
-          input: {
-            action: "factory.triage.started",
-            factoryProjectId: project.factoryProjectId,
-            projectRepositoryId: project.id,
-            targets: [{ type: "issue", id: String(issueNumber), name: body.title }],
-            metadata: { issueNumber, branch, threadId: result.threadId }
-          }
-        });
-        return c.json(
-          {
-            ok: true,
-            threadId: result.threadId,
-            projectPath: result.projectPath ?? projectPath,
-            branch: result.branch ?? branch
-          },
-          202
-        );
-      }
-    })
-  );
-  routes.push(
-    registerApiRoute("/web/github/projects/:id/prs", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        const loaded = await loadOrgProject({ github, auth, c: loose(c) });
-        if ("response" in loaded) return loaded.response;
-        const page = parseListPage(c.req.query("page"));
-        if (page === null) return c.json({ error: "invalid_page" }, 400);
-        try {
-          const { pullRequests, nextCursor } = await github.versionControl.listPullRequests({
-            connection: {
-              type: "app-installation",
-              installationId: Number(loaded.project.installation.externalId)
-            },
-            sourceId: loaded.project.repository.slug,
-            includeDrafts: false,
-            cursor: String(page)
-          });
-          const responsePullRequests = pullRequests.map((pr) => ({
-            number: Number(pr.id),
-            title: pr.title,
-            url: pr.url,
-            author: pr.author,
-            baseBranch: pr.baseBranch,
-            headBranch: pr.headBranch,
-            createdAt: pr.createdAt,
-            updatedAt: pr.updatedAt
-          }));
-          await ingestPolledEvents(
-            responsePullRequests.map((pullRequest) => polledPullRequestEvent(loaded.project, pullRequest)),
-            options.ingestFactoryEvent
-          );
-          return c.json({
-            pullRequests: responsePullRequests,
-            nextPage: nextCursor === null ? null : Number(nextCursor)
-          });
-        } catch (err) {
-          return c.json(
-            { error: "github_fetch_failed", message: err instanceof Error ? err.message : String(err) },
-            502
-          );
-        }
-      }
-    })
-  );
-  routes.push(
-    registerApiRoute("/web/github/projects/:id/settings", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        const loaded = await loadOrgProject({ github, auth, c: loose(c) });
-        if ("response" in loaded) return loaded.response;
-        return c.json({ setupCommand: loaded.project.setupCommand });
-      }
-    })
-  );
-  routes.push(
-    registerApiRoute("/web/github/projects/:id/settings", {
-      method: "POST",
-      requiresAuth: false,
-      handler: async (c) => {
-        const loaded = await loadOrgProject({ github, auth, c: loose(c) });
-        if ("response" in loaded) return loaded.response;
-        let body;
-        try {
-          body = await c.req.json();
-        } catch {
-          return c.json({ error: "Invalid JSON body" }, 400);
-        }
-        if (body.setupCommand !== null && typeof body.setupCommand !== "string") {
-          return c.json({ error: "Invalid setupCommand" }, 400);
-        }
-        if (typeof body.setupCommand === "string" && body.setupCommand.length > 2e3) {
-          return c.json({ error: "setupCommand too long (max 2000 characters)" }, 400);
-        }
-        if (typeof body.setupCommand === "string" && /[\0-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(body.setupCommand)) {
-          return c.json({ error: "setupCommand contains control characters" }, 400);
-        }
-        const setupCommand = typeof body.setupCommand === "string" && body.setupCommand.trim().length > 0 ? body.setupCommand.trim() : null;
-        await github.sourceControlStorage.projectRepositories.update({
-          orgId: loaded.project.installation.orgId,
-          id: loaded.project.id,
-          input: { setupCommand }
-        });
-        return c.json({ setupCommand });
-      }
-    })
-  );
-  const parsePatKind = (value) => {
-    if (value === void 0 || value === null || value === "default") return "default";
-    if (value === "reviewer") return "reviewer";
-    return null;
-  };
-  routes.push(
-    registerApiRoute("/web/github/pat", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        return c.json(await getGithubPatStatus(() => github.integrationStorage, resolved.tenant.orgId));
-      }
-    }),
-    registerApiRoute("/web/github/pat", {
-      method: "POST",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        let body;
-        try {
-          body = await c.req.json();
-        } catch {
-          return c.json({ error: "Invalid JSON body" }, 400);
-        }
-        const kind = parsePatKind(body.kind);
-        if (!kind) return c.json({ error: "kind must be 'default' or 'reviewer'" }, 400);
-        const token = typeof body.token === "string" ? body.token.trim() : "";
-        if (!token) return c.json({ error: "A token is required" }, 400);
-        if (token.length > 500) return c.json({ error: "Token too long (max 500 characters)" }, 400);
-        if (/\s/.test(token)) return c.json({ error: "Token must not contain whitespace" }, 400);
-        await setGithubPat(github.integrationStorage, resolved.tenant.orgId, token, kind);
-        return c.json(await getGithubPatStatus(() => github.integrationStorage, resolved.tenant.orgId));
-      }
-    }),
-    registerApiRoute("/web/github/pat", {
-      method: "DELETE",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        const kind = parsePatKind(c.req.query("kind"));
-        if (!kind) return c.json({ error: "kind must be 'default' or 'reviewer'" }, 400);
-        await clearGithubPat(github.integrationStorage, resolved.tenant.orgId, kind);
-        return c.json(await getGithubPatStatus(() => github.integrationStorage, resolved.tenant.orgId));
-      }
-    })
-  );
-  routes.push(...buildProjectGitRoutes({ github, auth, fleet, emitAudit }));
-  return routes;
-}
-async function loadOrgProject(options) {
-  const { github, auth, c } = options;
-  const resolved = await resolveOrgTenant(c, auth);
-  if ("response" in resolved) return { response: resolved.response };
-  const { orgId, userId } = resolved.tenant;
-  const projectRepositoryId = c.req.param("id");
-  if (!projectRepositoryId) {
-    return { response: c.json({ error: "Project repository not found" }, 404) };
-  }
-  const project = await resolveProjectRepository({ github, orgId, projectRepositoryId });
-  if (!project) {
-    return { response: c.json({ error: "Project repository not found" }, 404) };
-  }
-  return { project, userId };
-}
-function identityFromUser(user) {
-  const u = user;
-  return { name: u?.name ?? null, email: u?.email ?? null };
-}
-async function resolveProjectSandbox(options) {
-  const { fleet, sandboxRow } = options;
-  if (!sandboxRow.sandboxId) {
-    throw new MaterializeError("Project sandbox is not provisioned. Open the project first.", "clone-failed");
-  }
-  return fleet.reattachSandbox(sandboxRow.sandboxId);
-}
-async function loadOrCreateSandboxRow(github, project, userId) {
-  return github.sourceControlStorage.sandboxes.getOrCreate({ projectRepository: project, userId });
-}
-async function prepareProject(options) {
-  const { github, fleet, project, userId, onProgress } = options;
-  const sandboxRow = await loadOrCreateSandboxRow(github, project, userId);
-  const access = await github.versionControl.getRepositoryAccess({
-    orgId: project.installation.orgId,
-    repositoryId: project.repository.id
-  });
-  if (!access.authorization) {
-    throw new MaterializeError("Repository access did not include a bearer token.", "clone-failed");
-  }
-  const ghCliToken = await getGithubPat(() => github.integrationStorage, project.installation.orgId) ?? access.authorization.token;
-  const sandbox = await ensureProjectSandbox({
-    fleet,
-    row: sandboxRow,
-    storage: github.sourceControlStorage.sandboxes,
-    token: ghCliToken,
-    onProgress
-  });
-  const fresh = await github.sourceControlStorage.sandboxes.getById({ id: sandboxRow.id });
-  const finalRow = fresh ?? sandboxRow;
-  await materializeRepo({
-    row: finalRow,
-    repoInfo: { repoFullName: project.repository.slug, defaultBranch: project.defaultBranch },
-    sandbox,
-    token: access.authorization.token,
-    storage: github.sourceControlStorage.sandboxes,
-    onProgress
-  });
-  const result = {
-    resourceId: project.factoryProjectId,
-    factoryProjectId: project.factoryProjectId,
-    projectRepositoryId: project.id,
-    sandboxId: finalRow.sandboxId,
-    sandboxWorkdir: finalRow.sandboxWorkdir
-  };
-  const done = { phase: "done", message: "Workspace ready." };
-  onProgress?.(done);
-  return result;
-}
-function ensureErrorPayload(err) {
-  if (err instanceof SandboxBudgetError) {
-    return { status: 429, body: { error: err.code, message: err.message } };
-  }
-  if (err instanceof MaterializeError) {
-    return { status: 502, body: { error: err.code, message: err.message } };
-  }
-  return {
-    status: 500,
-    body: { error: "materialize_failed", message: err instanceof Error ? err.message : String(err) }
-  };
-}
-function gitErrorResponse(c, err) {
-  if (err instanceof WorktreeError) {
-    return c.json({ error: err.code, message: err.message }, err.code === "invalid-branch" ? 400 : 502);
-  }
-  if (err instanceof MaterializeError) {
-    return c.json({ error: err.code, message: err.message }, 502);
-  }
-  return c.json({ error: "git_failed", message: err instanceof Error ? err.message : String(err) }, 500);
-}
-async function loadOwnedProject(options) {
-  const { github, auth, fleet, c } = options;
-  const resolved = await resolveOrgTenant(c, auth);
-  if ("response" in resolved) return { response: resolved.response };
-  const { orgId, userId } = resolved.tenant;
-  if (!fleet.enabled) {
-    return {
-      response: c.json({ error: "sandbox_not_configured", message: "No sandbox provider is configured." }, 503)
-    };
-  }
-  const projectRepositoryId = c.req.param("id");
-  if (!projectRepositoryId) {
-    return { response: c.json({ error: "Project repository not found" }, 404) };
-  }
-  const project = await resolveProjectRepository({ github, orgId, projectRepositoryId });
-  if (!project) {
-    return { response: c.json({ error: "Project repository not found" }, 404) };
-  }
-  const sandboxRow = await loadOrCreateSandboxRow(github, project, userId);
-  return { orgId, userId, project, sandboxRow };
-}
-function buildProjectGitRoutes({
-  github,
-  auth,
-  fleet,
-  emitAudit
-}) {
-  return [
-    // ── Create / list Factory sessions ──────────────────────────────────────
-    registerApiRoute("/web/github/projects/:id/sessions", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        const { orgId, userId } = resolved.tenant;
-        const projectRepositoryId = c.req.param("id");
-        const project = projectRepositoryId ? await resolveProjectRepository({ github, orgId, projectRepositoryId }) : null;
-        if (!project) return c.json({ error: "Project repository not found" }, 404);
-        const sessions = await github.sourceControlStorage.sessions.list({ projectRepositoryId: project.id, userId });
-        return c.json({ sessions });
-      }
-    }),
-    registerApiRoute("/web/github/projects/:id/sessions", {
-      method: "POST",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        const { orgId, userId } = resolved.tenant;
-        const projectRepositoryId = c.req.param("id");
-        const project = projectRepositoryId ? await resolveProjectRepository({ github, orgId, projectRepositoryId }) : null;
-        if (!project) return c.json({ error: "Project repository not found" }, 404);
-        let body;
-        try {
-          body = await c.req.json();
-        } catch {
-          return c.json({ error: "Invalid JSON body" }, 400);
-        }
-        if (!isValidGitRef(body.branch)) return c.json({ error: "Invalid branch" }, 400);
-        const baseBranch = body.baseBranch === void 0 ? project.defaultBranch : body.baseBranch;
-        if (!isValidGitRef(baseBranch)) return c.json({ error: "Invalid baseBranch" }, 400);
-        const session = await github.sourceControlStorage.sessions.create({
-          sessionId: randomUUID(),
-          projectRepositoryId: project.id,
-          orgId,
-          userId,
-          branch: body.branch,
-          baseBranch
-        });
-        return c.json({ session });
-      }
-    }),
-    registerApiRoute("/web/user-sessions/:sessionId", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        const session = await github.sourceControlStorage.sessions.getBySessionId(c.req.param("sessionId"));
-        if (!session || session.orgId !== resolved.tenant.orgId || session.userId !== resolved.tenant.userId) {
-          return c.json({ error: "Session not found" }, 404);
-        }
-        return c.json({ session });
-      }
-    }),
-    registerApiRoute("/web/user-sessions/:sessionId", {
-      method: "DELETE",
-      requiresAuth: false,
-      handler: async (c) => {
-        const resolved = await resolveOrgTenant(loose(c), auth);
-        if ("response" in resolved) return resolved.response;
-        const session = await github.sourceControlStorage.sessions.getBySessionId(c.req.param("sessionId"));
-        if (!session || session.orgId !== resolved.tenant.orgId || session.userId !== resolved.tenant.userId) {
-          return c.json({ error: "Session not found" }, 404);
-        }
-        let sandbox;
-        if (session.sandboxId) {
-          try {
-            sandbox = await fleet.reattachSandbox(session.sandboxId);
-          } catch {
-          }
-          await fleet.teardownSandbox(
-            {
-              sandboxId: session.sandboxId,
-              setSandboxId: async () => {
-              },
-              clear: async () => {
-                await github.sourceControlStorage.sessions.setSandbox({
-                  id: session.id,
-                  sandboxId: null,
-                  sandboxWorkdir: session.sandboxWorkdir ?? ""
-                });
-              }
-            },
-            sandbox
-          );
-        }
-        await github.sourceControlStorage.sessions.delete(session.id);
-        return c.json({ removed: true });
-      }
-    }),
-    // ── Stage all + commit inside a Factory session workspace ──────────────
-    registerApiRoute("/web/github/projects/:id/commit", {
-      method: "POST",
-      requiresAuth: false,
-      handler: async (c) => {
-        const owned = await loadOwnedProject({ github, auth, fleet, c: loose(c) });
-        if ("response" in owned) return owned.response;
-        const { userId, project } = owned;
-        let body;
-        try {
-          body = await c.req.json();
-        } catch {
-          return c.json({ error: "Invalid JSON body" }, 400);
-        }
-        if (typeof body.message !== "string" || body.message.trim().length === 0 || body.message.length > 5e3) {
-          return c.json({ error: "Invalid message" }, 400);
-        }
-        const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
-        if (!sessionWorkspace) {
-          return c.json({ error: "Invalid sessionId" }, 400);
-        }
-        const { workdir, sandboxBinding } = sessionWorkspace;
-        try {
-          return await withSessionOperationLock(sessionWorkspace.session.sessionId, async () => {
-            const sandbox = await resolveProjectSandbox({ fleet, sandboxRow: sandboxBinding });
-            const result = await commitAll(
-              sandbox,
-              workdir,
-              body.message,
-              identityFromUser(await auth.ensureUser(loose(c)))
-            );
-            if (result.committed) {
-              await emitAudit?.({
-                context: loose(c),
-                input: {
-                  action: "factory.git.commit",
-                  factoryProjectId: project.factoryProjectId,
-                  projectRepositoryId: project.id,
-                  targets: [{ type: "session", id: sessionWorkspace.session.sessionId }],
-                  metadata: { sessionId: sessionWorkspace.session.sessionId }
-                }
-              });
-            }
-            return c.json({ committed: result.committed });
-          });
-        } catch (err) {
-          return gitErrorResponse(loose(c), err);
-        }
-      }
-    }),
-    // ── Push a branch back to GitHub ────────────────────────────────────────
-    registerApiRoute("/web/github/projects/:id/push", {
-      method: "POST",
-      requiresAuth: false,
-      handler: async (c) => {
-        const owned = await loadOwnedProject({ github, auth, fleet, c: loose(c) });
-        if ("response" in owned) return owned.response;
-        const { orgId, userId, project } = owned;
-        let body;
-        try {
-          body = await c.req.json();
-        } catch {
-          return c.json({ error: "Invalid JSON body" }, 400);
-        }
-        if (!isValidGitRef(body.branch)) {
-          return c.json({ error: "Invalid branch" }, 400);
-        }
-        const branch = body.branch;
-        const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
-        if (!sessionWorkspace) {
-          return c.json({ error: "Invalid sessionId" }, 400);
-        }
-        const { workdir, sandboxBinding } = sessionWorkspace;
-        try {
-          return await withSessionOperationLock(sessionWorkspace.session.sessionId, async () => {
-            const sandbox = await resolveProjectSandbox({ fleet, sandboxRow: sandboxBinding });
-            const access = await github.versionControl.getRepositoryAccess({
-              orgId,
-              repositoryId: project.repository.id
-            });
-            if (!access.authorization) throw new Error("Repository access did not include a bearer token.");
-            await pushBranch(sandbox, workdir, branch, access.authorization.token, project.repository.slug);
-            await emitAudit?.({
-              context: loose(c),
-              input: {
-                action: "factory.git.push",
-                factoryProjectId: project.factoryProjectId,
-                projectRepositoryId: project.id,
-                targets: [{ type: "branch", id: branch }],
-                metadata: { branch, sessionId: sessionWorkspace.session.sessionId }
-              }
-            });
-            return c.json({ pushed: true, branch });
-          });
-        } catch (err) {
-          return gitErrorResponse(loose(c), err);
-        }
-      }
-    }),
-    // ── Open a pull request through the version-control capability ─────────
-    registerApiRoute("/web/github/projects/:id/pr", {
-      method: "POST",
-      requiresAuth: false,
-      handler: async (c) => {
-        const owned = await loadOwnedProject({ github, auth, fleet, c: loose(c) });
-        if ("response" in owned) return owned.response;
-        const { orgId, userId, project } = owned;
-        let body;
-        try {
-          body = await c.req.json();
-        } catch {
-          return c.json({ error: "Invalid JSON body" }, 400);
-        }
-        if (!isValidGitRef(body.branch)) {
-          return c.json({ error: "Invalid branch" }, 400);
-        }
-        const base = body.base === void 0 ? project.defaultBranch : body.base;
-        if (!isValidGitRef(base)) {
-          return c.json({ error: "Invalid base" }, 400);
-        }
-        if (typeof body.title !== "string" || body.title.trim().length === 0 || body.title.length > 256) {
-          return c.json({ error: "Invalid title" }, 400);
-        }
-        if (body.body !== void 0 && (typeof body.body !== "string" || body.body.length > 65536)) {
-          return c.json({ error: "Invalid body" }, 400);
-        }
-        const head = body.branch;
-        const title = body.title;
-        const prBody = body.body;
-        const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);
-        if (!sessionWorkspace) {
-          return c.json({ error: "Invalid sessionId" }, 400);
-        }
-        try {
-          return await withSessionOperationLock(sessionWorkspace.session.sessionId, async () => {
-            const result = await github.versionControl.createPullRequest({
-              connection: {
-                type: "app-installation",
-                installationId: Number(project.installation.externalId)
-              },
-              sourceId: project.repository.slug,
-              baseBranch: base,
-              headBranch: head,
-              title,
-              body: prBody,
-              actingUserId: userId
-            });
-            await emitAudit?.({
-              context: loose(c),
-              input: {
-                action: "factory.git.pr_opened",
-                factoryProjectId: project.factoryProjectId,
-                projectRepositoryId: project.id,
-                targets: [{ type: "pull_request", id: result.url, name: title }],
-                metadata: { branch: head, base, url: result.url }
-              }
-            });
-            const pullRequestNumber = pullRequestNumberFromUrl(result.url, project.repository.slug);
-            if (pullRequestNumber) {
-              const sessionId = sessionWorkspace.session.sessionId;
-              await subscribeToPullRequest(
-                {
-                  orgId,
-                  installationExternalId: project.installation.externalId,
-                  projectRepositoryId: project.id,
-                  repositoryExternalId: project.repository.externalId,
-                  repositorySlug: project.repository.slug,
-                  changeRequestId: pullRequestNumber.toString(),
-                  sessionId,
-                  ownerId: userId,
-                  resourceId: sessionId,
-                  threadId: sessionId,
-                  source: "factory-pr-create",
-                  subscribedByUserId: userId
-                },
-                github.integrationStorage
-              ).catch((error) => {
-                console.warn(
-                  `[GitHub] Pull request ${result.url} was created but automatic subscription failed.`,
-                  error
-                );
-              });
-            }
-            return c.json({ url: result.url });
-          });
-        } catch (err) {
-          return c.json(
-            { error: "github_pr_create_failed", message: err instanceof Error ? err.message : String(err) },
-            502
-          );
-        }
-      }
-    }),
-    // ── Tear down the caller's sandbox for a project ────────────────────────
-    // Per-user teardown only: drops the caller's `(project, user)` sandbox
-    // binding and stops the VM, freeing a slot in the per-replica budget. Project
-    // deletion at the org level is out of scope (org admin model is later).
-    registerApiRoute("/web/github/projects/:id/sandbox", {
-      method: "DELETE",
-      requiresAuth: false,
-      handler: async (c) => {
-        const owned = await loadOwnedProject({ github, auth, fleet, c: loose(c) });
-        if ("response" in owned) return owned.response;
-        const { sandboxRow } = owned;
-        if (!sandboxRow.sandboxId) {
-          return c.json({ tornDown: false });
-        }
-        try {
-          return await withSessionOperationLock(`sandbox:${sandboxRow.id}`, async () => {
-            const sandbox = await fleet.reattachSandbox(sandboxRow.sandboxId);
-            await teardownProjectSandbox({
-              fleet,
-              row: sandboxRow,
-              storage: github.sourceControlStorage.sandboxes,
-              sandbox
-            });
-            return c.json({ tornDown: true });
-          });
-        } catch (err) {
-          return gitErrorResponse(loose(c), err);
-        }
-      }
-    })
-  ];
-}
-async function resolveSessionWorkspace(github, projectId, userId, sessionId) {
-  if (typeof sessionId !== "string") {
-    return void 0;
-  }
-  const session = await github.sourceControlStorage.sessions.getBySessionId(sessionId);
-  if (session?.projectRepositoryId !== projectId || session.userId !== userId || !session.sandboxId || !session.sandboxWorkdir) {
-    return void 0;
-  }
-  return {
-    session,
-    workdir: session.sandboxWorkdir,
-    sandboxBinding: {
-      id: session.id,
-      projectRepositoryId: session.projectRepositoryId,
-      userId: session.userId,
-      sandboxId: session.sandboxId,
-      sandboxWorkdir: session.sandboxWorkdir,
-      materializedAt: session.materializedAt,
-      createdAt: session.createdAt
-    }
-  };
-}
-
-// src/rules/resolve.ts
-function resolveFactoryGithubRule(rules, event) {
-  return rules.github[event]?.onEvent;
-}
-
-// src/rules/types.ts
-var FACTORY_RULE_STAGES = ["intake", "triage", "planning", "execute", "review", "done", "canceled"];
-var FACTORY_RULE_BOARDS = ["work", "review"];
-
-// src/rules/validation.ts
-var MAX_FACTORY_RULE_CAUSAL_DEPTH = 8;
-var MAX_IDEMPOTENCY_KEY_LENGTH = 256;
-var MAX_REASON_LENGTH = 512;
-var MAX_TITLE_LENGTH = 512;
-var MAX_MESSAGE_LENGTH = 8192;
-var MAX_ARGUMENTS_LENGTH = 4096;
-var MAX_ROLE_LENGTH = 32;
-var MAX_SKILL_NAME_LENGTH = 128;
-var MAX_SOURCE_KEY_LENGTH = 256;
-var MAX_URL_LENGTH = 2048;
-var MAX_METADATA_JSON_LENGTH = 16384;
-var MAX_JSON_DEPTH = 8;
-var MAX_JSON_COLLECTION_SIZE = 100;
-var IDENTIFIER_RE = /^[a-z0-9][a-z0-9_-]*$/i;
-var SKILL_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-var SENSITIVE_KEY_RE = /(?:authorization|cookie|credential|password|secret|token)/i;
-var WORK_ITEM_SOURCES = ["github-issue", "github-pr", "linear-issue", "manual"];
-var REJECTION_CODES = [
-  "forbidden",
-  "invalid_transition",
-  "missing_binding",
-  "stale",
-  "timeout",
-  "rule_error",
-  "causal_depth_exceeded",
-  "repeated_transition"
-];
-var FactoryRuleValidationError = class extends Error {
-  code = "invalid_factory_rule";
-  constructor(message) {
-    super(message);
-    this.name = "FactoryRuleValidationError";
-  }
-};
-function isPlainObject(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-  const prototype = Object.getPrototypeOf(value);
-  return prototype === Object.prototype || prototype === null;
-}
-function assertExactKeys(value, keys, label) {
-  const allowed = new Set(keys);
-  if (Object.keys(value).some((key) => !allowed.has(key))) {
-    throw new FactoryRuleValidationError(`${label} contains an unsupported field.`);
-  }
-}
-function boundedString(value, label, max, pattern) {
-  if (typeof value !== "string") throw new FactoryRuleValidationError(`${label} must be a string.`);
-  const normalized = value.trim();
-  if (normalized.length === 0 || normalized.length > max || pattern && !pattern.test(normalized)) {
-    throw new FactoryRuleValidationError(`${label} is invalid.`);
-  }
-  return normalized;
-}
-function optionalBoundedString(value, label, max) {
-  if (value === void 0) return void 0;
-  return boundedString(value, label, max);
-}
-function enumValue(value, allowed, label) {
-  if (typeof value !== "string" || !allowed.includes(value)) {
-    throw new FactoryRuleValidationError(`${label} is invalid.`);
-  }
-  return value;
-}
-function normalizeFactoryRuleJsonValue(value, depth = 0, seen = /* @__PURE__ */ new Set()) {
-  if (value === null || typeof value === "boolean" || typeof value === "string") return value;
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) throw new FactoryRuleValidationError("Rule metadata must contain finite numbers.");
-    return value;
-  }
-  if (depth >= MAX_JSON_DEPTH || typeof value !== "object" && !Array.isArray(value)) {
-    throw new FactoryRuleValidationError("Rule metadata is not bounded JSON.");
-  }
-  if (seen.has(value)) throw new FactoryRuleValidationError("Rule metadata must not contain cycles.");
-  seen.add(value);
-  try {
-    if (Array.isArray(value)) {
-      if (value.length > MAX_JSON_COLLECTION_SIZE) {
-        throw new FactoryRuleValidationError("Rule metadata contains too many entries.");
-      }
-      return value.map((entry) => normalizeFactoryRuleJsonValue(entry, depth + 1, seen));
-    }
-    if (!isPlainObject(value)) throw new FactoryRuleValidationError("Rule metadata must use plain objects.");
-    const entries = Object.entries(value);
-    if (entries.length > MAX_JSON_COLLECTION_SIZE) {
-      throw new FactoryRuleValidationError("Rule metadata contains too many fields.");
-    }
-    const sanitized = {};
-    for (const [key, entry] of entries) {
-      const normalizedKey = boundedString(key, "Rule metadata key", 128, IDENTIFIER_RE);
-      sanitized[normalizedKey] = SENSITIVE_KEY_RE.test(normalizedKey) ? "[REDACTED]" : normalizeFactoryRuleJsonValue(entry, depth + 1, seen);
-    }
-    return sanitized;
-  } finally {
-    seen.delete(value);
-  }
-}
-function sanitizeMetadata(value) {
-  if (value === void 0) return void 0;
-  const sanitized = normalizeFactoryRuleJsonValue(value);
-  if (!isPlainObject(sanitized)) throw new FactoryRuleValidationError("Rule metadata must be an object.");
-  if (JSON.stringify(sanitized).length > MAX_METADATA_JSON_LENGTH) {
-    throw new FactoryRuleValidationError("Rule metadata is too large.");
-  }
-  return sanitized;
-}
-function commonCommitFields(value) {
-  return {
-    idempotencyKey: boundedString(value.idempotencyKey, "Factory decision idempotencyKey", MAX_IDEMPOTENCY_KEY_LENGTH)
-  };
-}
-function validateFactoryRuleDecision(value, causalDepth = 0) {
-  if (causalDepth > MAX_FACTORY_RULE_CAUSAL_DEPTH) {
-    throw new FactoryRuleValidationError("Factory rule causal depth exceeded.");
-  }
-  if (!isPlainObject(value)) throw new FactoryRuleValidationError("Factory rule decision must be an object.");
-  const type = value.type;
-  if (typeof type !== "string") throw new FactoryRuleValidationError("Factory rule decision type is required.");
-  switch (type) {
-    case "reject": {
-      assertExactKeys(value, ["type", "code", "reason"], "Factory reject decision");
-      return {
-        type,
-        code: enumValue(value.code, REJECTION_CODES, "Factory rejection code"),
-        reason: boundedString(value.reason, "Factory rejection reason", MAX_REASON_LENGTH)
-      };
-    }
-    case "transition": {
-      assertExactKeys(value, ["type", "idempotencyKey", "board", "stage"], "Factory transition decision");
-      return {
-        type,
-        ...commonCommitFields(value),
-        board: enumValue(value.board, FACTORY_RULE_BOARDS, "Factory transition board"),
-        stage: enumValue(value.stage, FACTORY_RULE_STAGES, "Factory transition stage")
-      };
-    }
-    case "upsertLinkedWorkItem": {
-      assertExactKeys(
-        value,
-        ["type", "idempotencyKey", "board", "source", "sourceKey", "title", "url", "stage", "metadata"],
-        "Factory linked work item decision"
-      );
-      const url = value.url;
-      if (url !== null && (typeof url !== "string" || url.length > MAX_URL_LENGTH || !/^https?:\/\//.test(url))) {
-        throw new FactoryRuleValidationError("Factory linked work item URL is invalid.");
-      }
-      const metadata = sanitizeMetadata(value.metadata);
-      return {
-        type,
-        ...commonCommitFields(value),
-        board: enumValue(value.board, FACTORY_RULE_BOARDS, "Factory linked work item board"),
-        source: enumValue(value.source, WORK_ITEM_SOURCES, "Factory linked work item source"),
-        sourceKey: boundedString(value.sourceKey, "Factory linked work item sourceKey", MAX_SOURCE_KEY_LENGTH),
-        title: boundedString(value.title, "Factory linked work item title", MAX_TITLE_LENGTH),
-        url,
-        stage: enumValue(value.stage, FACTORY_RULE_STAGES, "Factory linked work item stage"),
-        ...metadata ? { metadata } : {}
-      };
-    }
-    case "invokeSkill": {
-      assertExactKeys(
-        value,
-        ["type", "idempotencyKey", "role", "skillName", "arguments", "precedingMessage"],
-        "Factory invoke skill decision"
-      );
-      const args = optionalBoundedString(value.arguments, "Factory skill arguments", MAX_ARGUMENTS_LENGTH);
-      const precedingMessage = optionalBoundedString(
-        value.precedingMessage,
-        "Factory skill preceding message",
-        MAX_MESSAGE_LENGTH
-      );
-      return {
-        type,
-        ...commonCommitFields(value),
-        role: boundedString(value.role, "Factory skill role", MAX_ROLE_LENGTH, IDENTIFIER_RE),
-        skillName: boundedString(value.skillName, "Factory skill name", MAX_SKILL_NAME_LENGTH, SKILL_NAME_RE),
-        ...args ? { arguments: args } : {},
-        ...precedingMessage ? { precedingMessage } : {}
-      };
-    }
-    case "sendMessage": {
-      assertExactKeys(
-        value,
-        ["type", "idempotencyKey", "role", "message", "priority", "idleBehavior", "prepareBinding"],
-        "Factory send message decision"
-      );
-      const priority = value.priority === void 0 ? void 0 : enumValue(value.priority, ["medium", "high", "urgent"], "Factory message priority");
-      const idleBehavior = value.idleBehavior === void 0 ? void 0 : enumValue(value.idleBehavior, ["persist", "wake"], "Factory message idle behavior");
-      if (value.prepareBinding !== void 0 && typeof value.prepareBinding !== "boolean") {
-        throw new FactoryRuleValidationError("Factory message prepareBinding must be a boolean.");
-      }
-      return {
-        type,
-        ...commonCommitFields(value),
-        role: boundedString(value.role, "Factory message role", MAX_ROLE_LENGTH, IDENTIFIER_RE),
-        message: boundedString(value.message, "Factory message", MAX_MESSAGE_LENGTH),
-        ...priority ? { priority } : {},
-        ...idleBehavior ? { idleBehavior } : {},
-        ...value.prepareBinding === true ? { prepareBinding: true } : {}
-      };
-    }
-    case "notify": {
-      assertExactKeys(value, ["type", "idempotencyKey", "title", "body", "level"], "Factory notify decision");
-      const body = optionalBoundedString(value.body, "Factory notification body", MAX_MESSAGE_LENGTH);
-      const level = value.level === void 0 ? void 0 : enumValue(value.level, ["info", "warning", "error"], "Factory notification level");
-      return {
-        type,
-        ...commonCommitFields(value),
-        title: boundedString(value.title, "Factory notification title", MAX_TITLE_LENGTH),
-        ...body ? { body } : {},
-        ...level ? { level } : {}
-      };
-    }
-    default:
-      throw new FactoryRuleValidationError("Factory rule decision type is unsupported.");
-  }
-}
-function validateFactoryRuleDecisions(values, causalDepth = 0) {
-  if (values.length > MAX_JSON_COLLECTION_SIZE) {
-    throw new FactoryRuleValidationError("Factory rule produced too many decisions.");
-  }
-  const decisions = [];
-  for (const value of values) {
-    const decision = validateFactoryRuleDecision(value, causalDepth);
-    if (decision.type === "reject") {
-      throw new FactoryRuleValidationError("A rejection cannot be persisted with commit decisions.");
-    }
-    decisions.push(decision);
-  }
-  const keys = decisions.map((decision) => decision.idempotencyKey);
-  if (new Set(keys).size !== keys.length) {
-    throw new FactoryRuleValidationError("Factory decisions require unique idempotency keys.");
-  }
-  return decisions;
-}
-
-// src/integrations/github/rules.ts
-var TRUSTED_PERMISSIONS = /* @__PURE__ */ new Set(["write", "admin"]);
-var RULE_TIMEOUT_MS = 5e3;
-async function withRuleTimeout(promise) {
-  let timeout;
-  try {
-    return await Promise.race([
-      promise,
-      new Promise((_, reject) => {
-        timeout = setTimeout(() => reject(new Error("FACTORY_RULE_TIMEOUT")), RULE_TIMEOUT_MS);
-      })
-    ]);
-  } finally {
-    if (timeout) clearTimeout(timeout);
-  }
-}
-function object(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-}
-function string(value) {
-  return typeof value === "string" && value.length > 0 ? value : void 0;
-}
-function number(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
-function boolean(value) {
-  return typeof value === "boolean" ? value : void 0;
-}
-function eventName(parsed) {
-  const action = string(parsed.payload.action);
-  if (parsed.event === "issues" && action === "opened") return "issueOpened";
-  if (parsed.event === "pull_request" && action === "opened") return "pullRequestOpened";
-  if (parsed.event === "pull_request" && action === "synchronize") return "pullRequestUpdated";
-  if (parsed.event === "pull_request" && action === "closed" && boolean(object(parsed.payload.pull_request)?.merged)) {
-    return "pullRequestMerged";
-  }
-  if (parsed.event === "pull_request" && action === "review_requested") return "pullRequestReviewRequested";
-  return void 0;
-}
-function canonicalSourceKey(kind, itemNumber) {
-  return kind === "issue" ? `github-issue:${itemNumber}` : `github-pr:${itemNumber}`;
-}
-function legacySourceKey(repositoryId, kind, itemNumber) {
-  return `github:${repositoryId}:${kind}:${itemNumber}`;
-}
-function provenanceTarget(repositoryId, pullRequestNumber) {
-  return `factory-pr-provenance:${repositoryId}:${pullRequestNumber}`;
-}
-function workItemSource(item) {
-  if (!item.externalSource) return "manual";
-  return item.externalSource.type === "pull-request" ? "github-pr" : "github-issue";
-}
-function workItemSourceKey(item) {
-  return item.externalSource?.externalId ?? null;
-}
-async function githubActor(github, input) {
-  let trusted = false;
-  try {
-    const permission = await github.getRepositoryCollaboratorPermission(
-      input.installationId,
-      input.repository,
-      input.login
-    );
-    trusted = permission !== void 0 && TRUSTED_PERMISSIONS.has(permission);
-  } catch {
-    trusted = false;
-  }
-  return { type: "github", login: input.login, trusted, factoryAuthored: input.factoryAuthored };
-}
-function pullRequestProvenance(data) {
-  if (!data || data.kind !== "factory-pr-provenance" || typeof data.workItemId !== "string") return null;
-  return { kind: "factory-pr-provenance", workItemId: data.workItemId };
-}
-var GithubRules = class {
-  constructor(options) {
-    this.options = options;
-  }
-  options;
-  async ingest(parsed) {
-    const event = eventName(parsed);
-    const repository = object(parsed.payload.repository);
-    const installationId = number(object(parsed.payload.installation)?.id);
-    const repositoryId = number(repository?.id);
-    const repositoryName = string(repository?.full_name);
-    const login = string(object(parsed.payload.sender)?.login);
-    if (!event || !installationId || !repositoryId || !repositoryName || !login) return { status: "ignored" };
-    const projects = await this.options.sourceControl.projectRepositories.listByExternalRepository({
-      installationExternalId: String(installationId),
-      repositoryExternalId: String(repositoryId)
-    });
-    if (projects.length === 0) return { status: "ignored" };
-    const results = [];
-    for (const project of projects) {
-      results.push(
-        await this.#ingestProject(parsed, event, installationId, repositoryId, repositoryName, login, project)
-      );
-    }
-    if (results.some((result) => result.status === "committed")) return { status: "committed" };
-    if (results.some((result) => result.status === "replayed")) return { status: "replayed" };
-    return results[0] ?? { status: "ignored" };
-  }
-  async #ingestProject(parsed, event, installationId, repositoryId, repositoryName, login, project) {
-    const factoryProject = await this.options.projects.get({
-      orgId: project.orgId,
-      id: project.factoryProjectId
-    });
-    if (!factoryProject) return { status: "missing" };
-    const issue = object(parsed.payload.issue);
-    const pullRequest = object(parsed.payload.pull_request);
-    const issueNumber = number(issue?.number);
-    const pullRequestNumber = number(pullRequest?.number);
-    const provenance = pullRequestNumber ? pullRequestProvenance(
-      (await this.options.integrationStorage.subscriptions.listByTarget(
-        provenanceTarget(repositoryId, pullRequestNumber),
-        { status: "active" }
-      )).find((subscription) => subscription.orgId === project.orgId)?.data
-    ) : null;
-    const relatedItem = await this.#relatedItem(
-      project.orgId,
-      project.factoryProjectId,
-      repositoryId,
-      issueNumber,
-      pullRequestNumber,
-      string(object(pullRequest?.head)?.ref),
-      provenance
-    );
-    const actor = await githubActor(this.options.github, {
-      installationId,
-      repository: repositoryName,
-      login,
-      factoryAuthored: provenance !== null
-    });
-    const context = {
-      tenant: { orgId: project.orgId, projectId: project.factoryProjectId },
-      actor,
-      ingress: { type: "github", id: `${installationId}:${parsed.deliveryId}` },
-      cause: `github.${event}`,
-      causalChain: [],
-      ruleSetVersion: this.options.rules.version,
-      ...relatedItem ? {
-        item: {
-          id: relatedItem.id,
-          source: workItemSource(relatedItem),
-          sourceKey: workItemSourceKey(relatedItem),
-          parentWorkItemId: relatedItem.parentWorkItemId,
-          title: relatedItem.title,
-          url: relatedItem.externalSource?.url ?? null,
-          stages: relatedItem.stages
-        },
-        board: relatedItem.externalSource?.type === "pull-request" ? "review" : "work",
-        itemRevision: relatedItem.revision
-      } : {},
-      event,
-      deliveryId: parsed.deliveryId,
-      factory: { createdAt: factoryProject.createdAt.toISOString() },
-      repository: { id: repositoryId, fullName: repositoryName },
-      ...issueNumber && string(issue?.title) && string(issue?.html_url) ? {
-        issue: {
-          number: issueNumber,
-          title: string(issue?.title),
-          url: string(issue?.html_url),
-          ...string(issue?.created_at) ? { createdAt: string(issue?.created_at) } : {}
-        }
-      } : {},
-      ...pullRequestNumber && string(pullRequest?.title) && string(pullRequest?.html_url) ? {
-        pullRequest: {
-          number: pullRequestNumber,
-          title: string(pullRequest?.title),
-          url: string(pullRequest?.html_url),
-          ...string(pullRequest?.created_at) ? { createdAt: string(pullRequest?.created_at) } : {},
-          state: string(pullRequest?.state) === "closed" ? "closed" : "open",
-          merged: boolean(pullRequest?.merged) ?? false,
-          headBranch: string(object(pullRequest?.head)?.ref) ?? "",
-          baseBranch: string(object(pullRequest?.base)?.ref) ?? ""
-        }
-      } : {},
-      ...object(parsed.payload.review) ? {
-        review: {
-          id: number(object(parsed.payload.review)?.id) ?? 0,
-          state: string(object(parsed.payload.review)?.state) ?? "unknown",
-          url: string(object(parsed.payload.review)?.html_url) ?? ""
-        }
-      } : {}
-    };
-    const rule = resolveFactoryGithubRule(this.options.rules, event);
-    let decision;
-    let decisions = [];
-    let outcome = { status: "accepted" };
-    try {
-      decision = rule ? await withRuleTimeout(Promise.resolve(rule(Object.freeze(context)))) : void 0;
-      if (decision?.type === "reject") {
-        outcome = { status: "rejected", code: decision.code, reason: decision.reason };
-      } else if (decision) {
-        decisions = validateFactoryRuleDecisions([decision]).map((entry) => ({ ...entry }));
-      }
-    } catch (error) {
-      const timedOut = error instanceof Error && error.message === "FACTORY_RULE_TIMEOUT";
-      outcome = {
-        status: "rejected",
-        code: timedOut ? "timeout" : "rule_error",
-        reason: timedOut ? "Factory rule evaluation timed out." : error instanceof Error ? error.message.slice(0, 2e3) : "Factory GitHub rule failed."
-      };
-    }
-    const committed = await this.options.storage.commitRuleEvaluation({
-      orgId: project.orgId,
-      factoryProjectId: project.factoryProjectId,
-      workItemId: relatedItem?.id ?? null,
-      ingress: { identity: `${installationId}:${parsed.deliveryId}`, triggerType: `github.${event}` },
-      ruleSetVersion: this.options.rules.version,
-      expectedRevision: relatedItem?.revision ?? null,
-      actor: { ...actor },
-      outcome,
-      decisions,
-      causalChain: [],
-      now: /* @__PURE__ */ new Date()
-    });
-    return { status: committed.status };
-  }
-  async #relatedItem(orgId, projectId, repositoryId, issueNumber, pullRequestNumber, pullRequestHeadBranch, provenance) {
-    const items = await this.options.storage.list({ orgId, factoryProjectId: projectId });
-    if (provenance) return items.find((item) => item.id === provenance.workItemId);
-    if (issueNumber) {
-      return items.find((item) => item.externalSource?.externalId === canonicalSourceKey("issue", issueNumber)) ?? items.find((item) => item.externalSource?.externalId === legacySourceKey(repositoryId, "issue", issueNumber));
-    }
-    if (pullRequestNumber) {
-      return items.find((item) => item.externalSource?.externalId === canonicalSourceKey("pull-request", pullRequestNumber)) ?? items.find(
-        (item) => item.externalSource?.externalId === legacySourceKey(repositoryId, "pull-request", pullRequestNumber)
-      ) ?? // Provenance fallback: a PR pushed from a work item's session branch
-      // belongs to that item even when no gh-pr-create provenance was
-      // recorded (session predating state seeding, or the PR was opened
-      // outside the tracked tool call). Session branches are per-item
-      // (`factory/issue-N`), so a head-branch match is unambiguous.
-      (pullRequestHeadBranch ? items.find(
-        (item) => item.externalSource?.type !== "pull-request" && Object.values(item.sessions).some((session) => session.branch === pullRequestHeadBranch)
-      ) : void 0);
-    }
-    return void 0;
-  }
-};
-function attachGithubRules(github, context) {
-  if (!context.rules) return void 0;
-  const rules = new GithubRules({
-    github,
-    sourceControl: context.storage.sourceControl,
-    integrationStorage: context.storage.generic,
-    projects: context.storage.projects,
-    storage: context.rules.workItems,
-    rules: context.rules.config
-  });
-  return (event) => rules.ingest(event);
-}
-
-// src/integrations/github/session-subscriptions.ts
-import { createTool } from "@mastra/core/tools";
-import { z } from "zod";
-
-// src/integrations/github/token-refresh.ts
-var GITHUB_TOKEN_INJECTOR_CONTEXT_KEY = "factoryGithubTokenInjector";
-var GITHUB_PAT_KIND_CONTEXT_KEY = "factoryGithubPatKind";
-function getRegisteredGithubPatKind(requestContext) {
-  const kind = requestContext.get(GITHUB_PAT_KIND_CONTEXT_KEY);
-  return kind === "reviewer" ? "reviewer" : "default";
-}
-function injectGithubToken(requestContext, token) {
-  const injector = requestContext.get(GITHUB_TOKEN_INJECTOR_CONTEXT_KEY);
-  if (!injector) {
-    throw new Error("GitHub token refresh requires an active Factory sandbox workspace.");
-  }
-  injector(token);
-}
-
-// src/integrations/github/session-subscriptions.ts
-function sessionUserId(user) {
-  return user?.workosId ?? user?.id;
-}
-function sessionOrgId(user) {
-  return user?.organizationId;
-}
-var pullRequestInputSchema = z.object({
-  pullRequest: z.union([z.number().int().positive(), z.string().min(1)])
-});
-function parsePullRequest(value, expectedRepo) {
-  if (typeof value === "number") return value;
-  if (/^\d+$/.test(value)) return Number(value);
-  const match = value.match(/^https:\/\/github\.com\/([^/]+\/[^/]+)\/pull\/(\d+)\/?$/i);
-  if (!match || match[1].toLowerCase() !== expectedRepo.toLowerCase()) {
-    throw new Error(`Pull request must belong to ${expectedRepo}.`);
-  }
-  return Number(match[2]);
-}
-function isGithubProjectSession(requestContext) {
-  const context = requestContext.get("controller");
-  const user = requestContext.get("user");
-  return Boolean(
-    context?.threadId && context.getState().projectRepositoryId && sessionOrgId(user) && sessionUserId(user)
-  );
-}
-async function resolveSessionTarget(requestContext, github) {
-  const context = requestContext.get("controller");
-  const user = requestContext.get("user");
-  const orgId = sessionOrgId(user);
-  const userId = sessionUserId(user);
-  const projectRepositoryId = context?.getState().projectRepositoryId;
-  if (!context || !context.threadId || !projectRepositoryId || !orgId || !userId) {
-    throw new Error("GitHub subscriptions require an authenticated repository session with an active thread.");
-  }
-  const projectRepository = await github.sourceControlStorage.projectRepositories.get({
-    orgId,
-    id: projectRepositoryId
-  });
-  if (!projectRepository) throw new Error("Project repository not found for this organization.");
-  const connection = await github.sourceControlStorage.connections.get({ orgId, id: projectRepository.connectionId });
-  if (!connection) throw new Error("Source-control connection not found for this organization.");
-  const repository = await github.sourceControlStorage.repositories.get({ orgId, id: projectRepository.repositoryId });
-  if (!repository) throw new Error("Repository not found for this organization.");
-  const installation = await github.sourceControlStorage.installations.get({ orgId, id: connection.installationId });
-  if (!installation) throw new Error("Source-control installation not found for this organization.");
-  return { context, projectRepository, connection, installation, repository, orgId, userId };
-}
-async function verifyPullRequest(target, pullRequest, github) {
-  const [owner, repo] = target.repository.slug.split("/");
-  if (!owner || !repo) throw new Error("GitHub repository is invalid.");
-  const octokit = github.getInstallationOctokit(Number(target.installation.externalId));
-  const { data } = await octokit.pulls.get({ owner, repo, pull_number: pullRequest });
-  if (String(data.base.repo.id) !== target.repository.externalId)
-    throw new Error("Pull request repository does not match the active project repository.");
-}
-async function subscriptionInput(target, pullRequestNumber) {
-  return {
-    orgId: target.orgId,
-    installationExternalId: target.installation.externalId,
-    projectRepositoryId: target.projectRepository.id,
-    repositoryExternalId: target.repository.externalId,
-    repositorySlug: target.repository.slug,
-    changeRequestId: String(pullRequestNumber),
-    sessionId: target.context.session.id,
-    ownerId: target.context.session.ownerId,
-    resourceId: target.connection.factoryProjectId,
-    threadId: target.context.threadId,
-    sessionScope: target.context.scope,
-    source: "explicit-tool",
-    subscribedByUserId: target.userId
-  };
-}
-async function subscribeCurrentSessionToPullRequest(requestContext, pullRequest, source, github) {
-  if (source === "auto-gh-pr-create" && !isGithubProjectSession(requestContext)) return void 0;
-  const target = await resolveSessionTarget(requestContext, github);
-  const number2 = parsePullRequest(pullRequest, target.repository.slug);
-  await verifyPullRequest(target, number2, github);
-  await subscribeToPullRequest({ ...await subscriptionInput(target, number2), source }, github.integrationStorage);
-  return number2;
-}
-async function unsubscribeCurrentSessionFromPullRequest(requestContext, pullRequest, github) {
-  const target = await resolveSessionTarget(requestContext, github);
-  const number2 = parsePullRequest(pullRequest, target.repository.slug);
-  await unsubscribeFromPullRequest(await subscriptionInput(target, number2), github.integrationStorage);
-  return number2;
-}
-async function refreshGithubToken(requestContext, github) {
-  const target = await resolveSessionTarget(requestContext, github);
-  const pat = await getGithubPat(
-    () => github.integrationStorage,
-    target.orgId,
-    getRegisteredGithubPatKind(requestContext)
-  );
-  if (pat) {
-    injectGithubToken(requestContext, pat);
-    return;
-  }
-  const access = await github.versionControl.getRepositoryAccess({
-    orgId: target.orgId,
-    repositoryId: target.repository.id
-  });
-  const token = access.authorization?.token;
-  if (!token) throw new Error("Repository access did not include a bearer token for the Factory session.");
-  injectGithubToken(requestContext, token);
-}
-function createGithubSubscriptionTools(requestContext, github) {
-  const context = requestContext.get("controller");
-  const user = requestContext.get("user");
-  if (!context?.getState().projectRepositoryId || !sessionOrgId(user) || !sessionUserId(user)) return {};
-  return {
-    github_refresh_token: createTool({
-      id: "github_refresh_token",
-      description: "Refresh GitHub CLI authentication in the active Factory sandbox. Use this after a gh command fails because authentication is expired, invalid, or missing. It installs a fresh GH_TOKEN for subsequent sandbox commands. After this tool succeeds, retry the failed gh command. Takes no arguments and never returns the token.",
-      inputSchema: z.object({}),
-      execute: async () => {
-        await refreshGithubToken(requestContext, github);
-        return { refreshed: true };
-      }
-    }),
-    github_subscribe_pr: createTool({
-      id: "github_subscribe_pr",
-      description: "Subscribe this thread to GitHub pull request activity. You usually do not need this tool: successful gh pr create commands subscribe automatically. Use it for an existing PR or to recover when automatic subscription did not occur. Closed or merged PRs are unsubscribed automatically. Accepts a PR number or canonical URL for the active project.",
-      inputSchema: pullRequestInputSchema,
-      execute: async ({ pullRequest }) => {
-        const number2 = await subscribeCurrentSessionToPullRequest(requestContext, pullRequest, "explicit-tool", github);
-        return { subscribed: true, pullRequestNumber: number2 };
-      }
-    }),
-    github_unsubscribe_pr: createTool({
-      id: "github_unsubscribe_pr",
-      description: "Manually unsubscribe this thread from GitHub pull request activity. You usually do not need this tool because closed or merged PRs are unsubscribed automatically. Use it to stop notifications before then. Accepts a PR number or canonical URL for the active project.",
-      inputSchema: pullRequestInputSchema,
-      execute: async ({ pullRequest }) => {
-        const number2 = await unsubscribeCurrentSessionFromPullRequest(requestContext, pullRequest, github);
-        return { subscribed: false, pullRequestNumber: number2 };
-      }
-    })
-  };
-}
-function stripHeredocBodies(command) {
-  const lines = command.split("\n");
-  const executableLines = [];
-  let delimiter;
-  for (const line of lines) {
-    if (delimiter) {
-      if (line.trim() === delimiter) delimiter = void 0;
-      continue;
-    }
-    executableLines.push(line);
-    const heredoc = line.match(/<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/);
-    delimiter = heredoc?.[2];
-  }
-  return executableLines.join("\n");
-}
-function parseCreatedPullRequest(context) {
-  if (context.toolName !== "execute_command" || context.error) return void 0;
-  const command = context.input?.command;
-  if (typeof command !== "string" || !/(?:^|\n|;|&&|\|\|)\s*gh\s+pr\s+create(?:\s|$)/.test(stripHeredocBodies(command))) {
-    return void 0;
-  }
-  const output = context.output;
-  const stdout = typeof context.output === "string" ? context.output : output?.stdout ?? output?.result;
-  if (typeof stdout !== "string") return void 0;
-  const urls = stdout.match(/https:\/\/github\.com\/[^\s/]+\/[^\s/]+\/pull\/\d+/g) ?? [];
-  return urls.length === 1 ? urls[0] : void 0;
-}
-
-// src/integrations/platform/api-client.ts
-function platformApiClientConfigFromEnv() {
-  const sharedApiUrl = process.env.MASTRA_SHARED_API_URL?.trim() || "https://platform.mastra.ai/v1";
-  const accessToken = process.env.MASTRA_PLATFORM_SECRET_KEY?.trim();
-  if (!accessToken) {
-    throw new Error("Platform integration: missing required environment variable MASTRA_PLATFORM_SECRET_KEY.");
-  }
-  return { baseUrl: normalizeSharedApiUrl(sharedApiUrl), accessToken };
-}
-function normalizeSharedApiUrl(sharedApiUrl) {
-  return sharedApiUrl.replace(/\/+$/, "").replace(/\/v1$/, "");
-}
-var PlatformApiError = class extends Error {
-  status;
-  retryAfterSeconds;
-  constructor(message, status, retryAfterSeconds = null) {
-    super(message);
-    this.name = "PlatformApiError";
-    this.status = status;
-    this.retryAfterSeconds = retryAfterSeconds;
-  }
-};
-var PlatformApiClient = class {
-  #baseUrl;
-  #accessToken;
-  #fetch;
-  constructor(config) {
-    const missing = ["baseUrl", "accessToken"].filter((field) => !config[field]);
-    if (missing.length > 0) {
-      throw new Error(`Platform integration: missing required config field(s): ${missing.join(", ")}.`);
-    }
-    this.#baseUrl = config.baseUrl.replace(/\/+$/, "");
-    this.#accessToken = config.accessToken;
-    this.#fetch = config.fetchImpl ?? globalThis.fetch;
-  }
-  async request(method, path2, body, options) {
-    const response = await this.#send(method, path2, body, options);
-    if (!response.ok) {
-      const message = redact(await extractError(response), this.#accessToken);
-      const retryAfterSeconds = parseRetryAfter(response.headers.get("retry-after"));
-      logPlatformError("Platform API request failed", {
-        method,
-        path: path2,
-        status: response.status,
-        retryAfterSeconds,
-        message
-      });
-      throw new PlatformApiError(message, response.status, retryAfterSeconds);
-    }
-    if (response.status === 204) return void 0;
-    return await response.json();
-  }
-  async requestRedirect(method, path2, options) {
-    const response = await this.#send(method, path2, void 0, options, "manual");
-    if (response.status >= 300 && response.status < 400) {
-      const location = response.headers.get("location");
-      if (location) return location;
-    }
-    if (!response.ok) {
-      const message = redact(await extractError(response), this.#accessToken);
-      const retryAfterSeconds = parseRetryAfter(response.headers.get("retry-after"));
-      logPlatformError("Platform API redirect request failed", {
-        method,
-        path: path2,
-        status: response.status,
-        retryAfterSeconds,
-        message
-      });
-      throw new PlatformApiError(message, response.status, retryAfterSeconds);
-    }
-    logPlatformError("Platform API request did not return a redirect", { method, path: path2, status: response.status });
-    throw new PlatformApiError("Platform API request did not return a redirect.", response.status);
-  }
-  async #send(method, path2, body, options, redirect) {
-    const headers = {
-      accept: "application/json",
-      authorization: `Bearer ${this.#accessToken}`
-    };
-    if (options?.actingUserId) {
-      headers["x-acting-user-id"] = options.actingUserId;
-    }
-    const timeoutSignal = AbortSignal.timeout(15e3);
-    const init = {
-      method,
-      headers,
-      redirect,
-      signal: options?.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal
-    };
-    if (body !== void 0) {
-      headers["content-type"] = "application/json";
-      init.body = JSON.stringify(body);
-    }
-    try {
-      return await this.#fetch(`${this.#baseUrl}${path2}`, init);
-    } catch (error) {
-      if (error instanceof Error && error.message.includes(this.#accessToken)) {
-        const redacted = new Error(redact(error.message, this.#accessToken));
-        redacted.name = error.name;
-        logPlatformError("Platform API transport error", {
-          method,
-          path: path2,
-          name: redacted.name,
-          message: redacted.message
-        });
-        throw redacted;
-      }
-      logPlatformError("Platform API transport error", {
-        method,
-        path: path2,
-        name: error instanceof Error ? error.name : void 0,
-        message: error instanceof Error ? error.message : String(error)
-      });
-      throw error;
-    }
-  }
-};
-async function extractError(response) {
-  try {
-    const data = await response.clone().json();
-    for (const field of ["detail", "error", "title"]) {
-      if (typeof data[field] === "string" && data[field]) return data[field];
-    }
-  } catch {
-  }
-  return `Platform API request failed (${response.status})`;
-}
-function redact(message, accessToken) {
-  return message.split(accessToken).join("[REDACTED]");
-}
-function logPlatformInfo(message, fields) {
-  writePlatformLog("info", message, fields);
-}
-function logPlatformWarn(message, fields) {
-  writePlatformLog("warn", message, fields);
-}
-function logPlatformError(message, fields) {
-  writePlatformLog("error", message, fields);
-}
-function writePlatformLog(level, message, fields) {
-  const metadata = fields ? ` ${JSON.stringify(stripUndefined(fields))}` : "";
-  process.stderr.write(`[Mastra Factory] ${level.toUpperCase()} ${message}${metadata}
-`);
-}
-function stripUndefined(fields) {
-  return Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== void 0));
-}
-function parseRetryAfter(value) {
-  if (!value) return null;
-  const seconds = Number.parseInt(value, 10);
-  return Number.isSafeInteger(seconds) && seconds >= 0 ? seconds : null;
-}
-
-// src/integrations/platform/github/event-worker.ts
-import { randomUUID as randomUUID2 } from "crypto";
-import { isLeaseProvider, NoopLeaseProvider } from "@mastra/core/events";
-import { MastraWorker } from "@mastra/core/worker";
-var API_PREFIX = "/v1/server/github-app";
-var DEFAULT_POLL_INTERVAL_MS = 2e4;
-var EVENT_PAGE_SIZE = 500;
-var MIN_LEASE_TTL_MS = 3e4;
-var CURSOR_ORG_ID = "__platform_github_event_worker__";
-var CURSOR_USER_ID = "worker";
-var SUPPORTED_EVENTS = /* @__PURE__ */ new Set([
-  "issues",
-  "issue_comment",
-  "pull_request",
-  "pull_request_review",
-  "pull_request_review_comment"
-]);
-var AUTHOR_GATED_KINDS2 = /* @__PURE__ */ new Set([
-  "issue-comment",
-  "pull-request-comment",
-  "pull-request-review",
-  "pull-request-review-comment"
-]);
-var AUTHORIZED_BOTS2 = /* @__PURE__ */ new Set(["coderabbitai[bot]", "devin-ai-integration[bot]"]);
-var AUTHORIZED_PERMISSIONS2 = /* @__PURE__ */ new Set(["admin", "maintain", "write"]);
-var PERMISSION_CHECK_TIMEOUT_MS2 = 5e3;
-var PlatformGithubEventWorker = class extends MastraWorker {
-  name = "platform-github-events";
-  #client;
-  #controller;
-  #github;
-  #storage;
-  #ingestFactoryEvent;
-  #intervalMs;
-  #now;
-  #dispatch;
-  #leaseOwner = randomUUID2();
-  #running = false;
-  #timer;
-  #leaseRenewalTimer;
-  #inFlight;
-  #leaseProvider = NoopLeaseProvider;
-  #leaseTtlMs;
-  #hasLease = false;
-  #startedAt = 0;
-  #settings = { version: 1, repositories: {} };
-  constructor(config) {
-    super();
-    this.#client = config.client;
-    this.#controller = config.controller;
-    this.#github = config.github;
-    this.#storage = config.storage;
-    this.#ingestFactoryEvent = config.ingestFactoryEvent;
-    this.#intervalMs = config.intervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-    if (!Number.isFinite(this.#intervalMs) || this.#intervalMs <= 0) {
-      throw new Error("Platform GitHub event polling interval must be a positive number.");
-    }
-    this.#leaseTtlMs = Math.max(MIN_LEASE_TTL_MS, this.#intervalMs * 3);
-    this.#now = config.now ?? Date.now;
-    this.#dispatch = config.dispatch ?? dispatchGithubWebhook;
-  }
-  async init(deps) {
-    await super.init(deps);
-    this.#leaseProvider = getLeaseProvider(deps.pubsub);
-  }
-  async start() {
-    if (this.#running) return;
-    if (!this.deps) throw new Error("PlatformGithubEventWorker: call init() before start()");
-    this.#startedAt = this.#now() - 1;
-    this.#settings = normalizeSettings(await this.#storage.settings.get(CURSOR_ORG_ID, CURSOR_USER_ID));
-    this.#running = true;
-    this.deps.logger.info("Platform GitHub event polling started", {
-      intervalMs: this.#intervalMs,
-      leaseTtlMs: this.#leaseTtlMs
-    });
-    this.#schedule(0);
-  }
-  async stop() {
-    if (!this.#running) return;
-    this.#running = false;
-    if (this.#timer) clearTimeout(this.#timer);
-    this.#timer = void 0;
-    this.#stopLeaseRenewal();
-    await this.#inFlight;
-    if (this.#hasLease) {
-      await this.#leaseProvider.releaseLease(this.#leaseKey(), this.#leaseOwner).catch(() => void 0);
-      this.#hasLease = false;
-    }
-  }
-  get isRunning() {
-    return this.#running;
-  }
-  #schedule(delayMs) {
-    if (!this.#running) return;
-    this.#timer = setTimeout(() => {
-      this.#timer = void 0;
-      const run = this.#tick();
-      this.#inFlight = run;
-      void run.finally(() => {
-        if (this.#inFlight === run) this.#inFlight = void 0;
-      });
-    }, delayMs);
-    this.#timer.unref?.();
-  }
-  async #tick() {
-    let nextDelay = this.#intervalMs;
-    try {
-      if (!await this.#ensureLease()) return;
-      nextDelay = await this.#poll();
-    } catch (error) {
-      nextDelay = retryDelay(error, this.#intervalMs);
-      this.deps?.logger.error("Platform GitHub event polling cycle failed", {
-        error: error instanceof Error ? error.message : String(error),
-        retryInMs: nextDelay
-      });
-    } finally {
-      this.#schedule(nextDelay);
-    }
-  }
-  async #ensureLease() {
-    if (this.#hasLease) return true;
-    const result = await this.#leaseProvider.acquireLease(this.#leaseKey(), this.#leaseOwner, this.#leaseTtlMs);
-    this.#hasLease = result.acquired;
-    if (this.#hasLease) this.#startLeaseRenewal();
-    return this.#hasLease;
-  }
-  #startLeaseRenewal() {
-    if (this.#leaseRenewalTimer) return;
-    this.#leaseRenewalTimer = setInterval(
-      () => {
-        void this.#leaseProvider.renewLease(this.#leaseKey(), this.#leaseOwner, this.#leaseTtlMs).then((renewed) => {
-          if (!renewed) {
-            this.#hasLease = false;
-            this.#stopLeaseRenewal();
-          }
-        }).catch((error) => {
-          this.#hasLease = false;
-          this.#stopLeaseRenewal();
-          this.deps?.logger.warn("Platform GitHub event polling lease renewal failed", {
-            error: error instanceof Error ? error.message : String(error)
-          });
-        });
-      },
-      Math.floor(this.#leaseTtlMs / 3)
-    );
-    this.#leaseRenewalTimer.unref?.();
-  }
-  #stopLeaseRenewal() {
-    if (this.#leaseRenewalTimer) clearInterval(this.#leaseRenewalTimer);
-    this.#leaseRenewalTimer = void 0;
-  }
-  async #poll() {
-    const repositories = await this.#discoverRepositories();
-    let retryInMs = this.#intervalMs;
-    for (const repository of repositories) {
-      if (!this.#running || !this.#hasLease) break;
-      try {
-        await this.#pollRepository(repository.id);
-      } catch (error) {
-        const delay = retryDelay(error, this.#intervalMs);
-        retryInMs = Math.max(retryInMs, delay);
-        this.deps?.logger.error("Platform GitHub repository event polling failed", {
-          repositoryId: repository.id,
-          error: error instanceof Error ? error.message : String(error),
-          retryInMs: delay
-        });
-        if (error instanceof PlatformApiError && error.status === 429) break;
-      }
-    }
-    return retryInMs;
-  }
-  async #discoverRepositories() {
-    const result = await this.#client.request("GET", `${API_PREFIX}/installations`);
-    const repositories = /* @__PURE__ */ new Map();
-    for (const installation of result.installations) {
-      if (!installation.usable || installation.suspendedAt) continue;
-      const page = await this.#client.request(
-        "GET",
-        `${API_PREFIX}/installations/${installation.installationId}/repositories`
-      );
-      for (const repository of page.repositories) repositories.set(repository.id, repository);
-    }
-    return [...repositories.values()];
-  }
-  async #pollRepository(repositoryId) {
-    const key = String(repositoryId);
-    if (!this.#settings.repositories[key]) {
-      this.#settings.repositories[key] = { afterTimestamp: this.#startedAt };
-      await this.#saveSettings();
-    }
-    while (this.#running && this.#hasLease) {
-      const cursor = this.#settings.repositories[key];
-      const query = new URLSearchParams({ limit: String(EVENT_PAGE_SIZE) });
-      if ("afterEventId" in cursor) query.set("afterEventId", cursor.afterEventId);
-      else query.set("afterTimestamp", String(cursor.afterTimestamp));
-      const pollStartedAt = performance.now();
-      const page = await this.#client.request(
-        "GET",
-        `${API_PREFIX}/repositories/${repositoryId}/events?${query}`
-      );
-      this.deps?.logger.info("Platform GitHub repository event poll completed", {
-        repositoryId,
-        eventCount: page.events.length,
-        latencyMs: Math.round(performance.now() - pollStartedAt)
-      });
-      if (page.events.length === 0 || !page.nextCursor) return;
-      for (const event of page.events) {
-        if (!this.#running || !this.#hasLease) return;
-        const parsed = parseEvent(event);
-        if (!parsed) {
-          this.deps?.logger.warn("Platform GitHub event log returned a malformed event", {
-            repositoryId,
-            eventId: event.id
-          });
-          continue;
-        }
-        if (isFactoryClosureEvent(parsed)) {
-          await this.#ingestFactoryEvent?.(parsed);
-        }
-        const result = await this.#dispatch(parsed, {
-          controller: this.#controller,
-          listSubscriptions: (target, options) => listPullRequestSubscriptionsForWebhook(target, options, this.#github.integrationStorage),
-          retireSubscription: (id, status) => retirePullRequestSubscription(id, status, this.#github.integrationStorage),
-          isAuthorizedSender: (notification) => this.#isAuthorizedSender(notification),
-          onTargetError: (subscription, error) => {
-            this.deps?.logger.error("Platform GitHub event delivery failed for a subscription", {
-              subscriptionId: subscription.id,
-              resourceId: subscription.resourceId,
-              threadId: subscription.threadId,
-              error: error instanceof Error ? error.message : String(error)
-            });
-          }
-        });
-        if (result.failed > 0) {
-          throw new Error(
-            `Platform GitHub event ${event.deliveryId} failed for ${result.failed} subscribed target(s).`
-          );
-        }
-      }
-      if (page.nextCursor === ("afterEventId" in cursor ? cursor.afterEventId : void 0)) return;
-      this.#settings.repositories[key] = { afterEventId: page.nextCursor };
-      await this.#saveSettings();
-    }
-  }
-  async #isAuthorizedSender(notification) {
-    if (!AUTHOR_GATED_KINDS2.has(notification.kind)) return true;
-    const sender = notification.metadata.sender;
-    const repository = notification.metadata.repository;
-    if (!sender || !repository) return false;
-    if (AUTHORIZED_BOTS2.has(sender)) return true;
-    const abortController = new AbortController();
-    const timeout = setTimeout(() => abortController.abort(), PERMISSION_CHECK_TIMEOUT_MS2);
-    try {
-      const permission = await this.#github.getRepositoryCollaboratorPermission(
-        notification.metadata.installationId,
-        repository,
-        sender,
-        abortController.signal
-      );
-      return permission !== void 0 && AUTHORIZED_PERMISSIONS2.has(permission);
-    } catch {
-      return false;
-    } finally {
-      clearTimeout(timeout);
-    }
-  }
-  async #saveSettings() {
-    await this.#storage.settings.save(CURSOR_ORG_ID, CURSOR_USER_ID, this.#settings);
-  }
-  #leaseKey() {
-    return `${this.name}:${this.#storage.integrationId}`;
-  }
-};
-function getLeaseProvider(pubsub) {
-  const getProvider = pubsub.getLeaseProvider;
-  if (typeof getProvider === "function") return getProvider.call(pubsub) ?? NoopLeaseProvider;
-  return isLeaseProvider(pubsub) ? pubsub : NoopLeaseProvider;
-}
-function normalizeSettings(value) {
-  if (!value || value.version !== 1 || !value.repositories || typeof value.repositories !== "object") {
-    return { version: 1, repositories: {} };
-  }
-  return { version: 1, repositories: { ...value.repositories } };
-}
-function isFactoryClosureEvent(event) {
-  return (event.event === "issues" || event.event === "pull_request") && event.payload.action === "closed";
-}
-function parseEvent(event) {
-  if (!event.id || !event.deliveryId || !SUPPORTED_EVENTS.has(event.event) || !event.payload || typeof event.payload !== "object" || Array.isArray(event.payload)) {
-    return null;
-  }
-  return {
-    event: event.event,
-    deliveryId: event.deliveryId,
-    payload: event.payload
-  };
-}
-function retryDelay(error, fallbackMs) {
-  if (error instanceof PlatformApiError && error.status === 429 && error.retryAfterSeconds !== null) {
-    return Math.max(fallbackMs, error.retryAfterSeconds * 1e3);
-  }
-  return fallbackMs;
-}
-
-// src/integrations/platform/github/integration.ts
-var PAGE_SIZE = 30;
-var API_PREFIX2 = "/v1/server";
-var REPOSITORY_TOKEN_PERMISSIONS = {
-  contents: "write",
-  issues: "write",
-  pull_requests: "write"
-};
-function loose2(c) {
-  return c;
+	return c;
 }
 function routeBaseUrl(ctx, requestUrl) {
-  return (ctx.baseUrl || new URL(requestUrl).origin).replace(/\/+$/, "");
+	return (ctx.baseUrl || new URL(requestUrl).origin).replace(/\/+$/, "");
 }
 var PlatformGithubIntegration = class {
-  id = "github";
-  #client;
-  #endpointHost;
-  #pollingEnabled;
-  #pollingIntervalMs;
-  #storage;
-  #integrationStorage;
-  intake = {
-    resolveIntakeDispatch: (input) => this.#resolveIntakeDispatch(input),
-    listSources: async ({ orgId, userId }) => {
-      const installations = await this.#client.request("GET", `${API_PREFIX2}/github-app/installations`);
-      const usable = installations.installations.filter(
-        (installation) => installation.usable && !installation.suspendedAt
-      );
-      const repositories = await Promise.all(
-        usable.map(async (installation) => {
-          const storedInstallation = await this.versionControl.registerInstallation({
-            orgId,
-            userId,
-            installation: {
-              externalId: String(installation.installationId),
-              accountName: installation.accountLogin,
-              accountType: installation.accountType
-            }
-          });
-          const result = await this.#client.request("GET", `${API_PREFIX2}/github-app/installations/${installation.installationId}/repositories`);
-          await this.versionControl.registerRepositories({
-            orgId,
-            installationId: storedInstallation.id,
-            repositories: result.repositories.map((repository) => ({
-              externalId: String(repository.id),
-              slug: repository.fullName,
-              defaultBranch: repository.defaultBranch,
-              metadata: { private: repository.private, url: repository.htmlUrl }
-            }))
-          });
-          return result.repositories.map((repository) => ({ repository, installation }));
-        })
-      );
-      return repositories.flat().map(({ repository, installation }) => ({
-        id: repository.fullName,
-        name: repository.fullName,
-        type: "repository",
-        metadata: {
-          installationId: installation.installationId,
-          accountLogin: installation.accountLogin,
-          accountType: installation.accountType,
-          repositoryId: repository.id,
-          defaultBranch: repository.defaultBranch,
-          private: repository.private,
-          url: repository.htmlUrl
-        }
-      }));
-    },
-    listItems: async ({ sourceIds, cursor }) => {
-      const page = parsePositiveCursor(cursor);
-      const pages = await Promise.all(
-        sourceIds.map(async (sourceId) => {
-          const connection = { type: "app-installation", installationId: 1 };
-          const [issues, pullRequests] = await Promise.all([
-            this.#listIssues(connection, sourceId, page),
-            this.#listPullRequests({ connection, sourceId, includeDrafts: false, cursor: String(page) })
-          ]);
-          return {
-            items: [
-              ...issues.issues.map((issue) => ({
-                source: { type: "issue", externalId: `${sourceId}:${issue.id}`, url: issue.url },
-                sourceId,
-                title: issue.title,
-                status: issue.state ?? void 0,
-                labels: issue.labels,
-                assignee: issue.assignee,
-                createdAt: issue.createdAt,
-                updatedAt: issue.updatedAt,
-                metadata: { repository: sourceId, number: Number(issue.id), author: issue.author }
-              })),
-              ...pullRequests.pullRequests.map((pullRequest) => ({
-                source: { type: "pull-request", externalId: `${sourceId}:${pullRequest.id}`, url: pullRequest.url },
-                sourceId,
-                title: pullRequest.title,
-                status: pullRequest.state,
-                createdAt: pullRequest.createdAt,
-                updatedAt: pullRequest.updatedAt,
-                metadata: {
-                  repository: sourceId,
-                  number: Number(pullRequest.id),
-                  author: pullRequest.author,
-                  baseBranch: pullRequest.baseBranch,
-                  headBranch: pullRequest.headBranch
-                }
-              }))
-            ],
-            hasNextPage: issues.nextCursor !== null || pullRequests.nextCursor !== null
-          };
-        })
-      );
-      return {
-        items: pages.flatMap((result) => result.items),
-        nextCursor: pages.some((result) => result.hasNextPage) ? String(page + 1) : null
-      };
-    },
-    listIssues: async (input) => {
-      requireGithubConnection(input.connection);
-      const sourceId = requireSingleSource(input.sourceIds, "GitHub Intake requires exactly one repository source.");
-      return this.#listIssues(input.connection, sourceId, parsePositiveCursor(input.cursor), input.labels);
-    },
-    getIssue: (input) => this.#getIssue(input.connection, input.sourceId, input.issueId),
-    createComment: (input) => this.#createIssueComment(input),
-    updateIssue: (input) => this.#updateIntakeIssue(input)
-  };
-  versionControl = {
-    initialize: ({ storage }) => {
-      this.#storage = storage;
-    },
-    registerInstallation: ({ orgId, userId, installation }) => this.storage.installations.upsert({
-      orgId,
-      connectedByUserId: userId,
-      externalId: installation.externalId,
-      accountName: installation.accountName,
-      accountType: installation.accountType,
-      providerMetadata: installation.metadata
-    }),
-    registerRepositories: ({ orgId, installationId, repositories }) => Promise.all(
-      repositories.map(
-        (repository) => this.storage.repositories.upsert({
-          orgId,
-          input: {
-            installationId,
-            externalId: repository.externalId,
-            slug: repository.slug,
-            defaultBranch: repository.defaultBranch,
-            providerMetadata: repository.metadata
-          }
-        })
-      )
-    ),
-    getRepositoryAccess: async ({ orgId, repositoryId }) => {
-      const repository = await this.storage.repositories.get({ orgId, id: repositoryId });
-      if (!repository) throw new Error("Version-control repository not found.");
-      const cloneUrl = `https://github.com/${repository.slug}.git`;
-      const installation = await this.storage.installations.get({ orgId, id: repository.installationId });
-      if (!installation) throw new Error("Version-control installation not found.");
-      const installationId = parsePositiveInteger(installation.externalId);
-      if (installationId === null) throw new Error("GitHub installation id is invalid.");
-      const repositoryName = splitRepository(repository.slug).repo;
-      const token = await this.#client.request(
-        "POST",
-        `${API_PREFIX2}/github-app/installations/${installationId}/token`,
-        { repositories: [repositoryName], permissions: REPOSITORY_TOKEN_PERMISSIONS }
-      );
-      return {
-        cloneUrl,
-        authorization: { scheme: "bearer", token: token.token }
-      };
-    },
-    listPullRequests: (input) => this.#listPullRequests(input),
-    getPullRequest: (input) => this.#getPullRequest(input),
-    createPullRequest: (input) => this.#createPullRequest(input),
-    updatePullRequest: (input) => this.#updatePullRequest(input),
-    closePullRequest: (input) => this.#updatePullRequest({ ...input, state: "closed" }),
-    mergePullRequest: (input) => this.#mergePullRequest(input),
-    listComments: (input) => this.#listComments(input),
-    createComment: (input) => this.#createComment(input),
-    updateComment: (input) => this.#updateComment(input),
-    deleteComment: (input) => this.#deleteComment(input),
-    listReviews: (input) => this.#listReviews(input),
-    getReview: (input) => this.#getReview(input),
-    createReview: (input) => this.#createReview(input),
-    updateReview: (input) => this.#updateReview(input),
-    submitReview: (input) => this.#submitReview(input),
-    dismissReview: (input) => this.#dismissReview(input),
-    deletePendingReview: (input) => this.#deletePendingReview(input),
-    listReviewComments: (input) => this.#listReviewComments(input),
-    createReviewComment: (input) => this.#createReviewComment(input),
-    updateReviewComment: (input) => this.#updateReviewComment(input),
-    deleteReviewComment: (input) => this.#deleteReviewComment(input),
-    listRequestedReviewers: (input) => this.#requestedReviewers("GET", input),
-    requestReviewers: (input) => this.#requestedReviewers("POST", input),
-    removeRequestedReviewers: (input) => this.#requestedReviewers("DELETE", input)
-  };
-  constructor() {
-    const config = platformApiClientConfigFromEnv();
-    this.#client = new PlatformApiClient(config);
-    this.#endpointHost = new URL(config.baseUrl).host;
-    this.#pollingEnabled = process.env.MASTRA_PLATFORM_GITHUB_POLLING_ENABLED?.trim().toLowerCase() !== "false";
-    this.#pollingIntervalMs = optionalPositiveIntegerEnv("MASTRA_PLATFORM_GITHUB_POLLING_INTERVAL_MS");
-  }
-  get storage() {
-    if (!this.#storage) throw new Error("PlatformGithubIntegration source-control storage has not been initialized.");
-    return this.#storage;
-  }
-  get sourceControlStorage() {
-    return this.storage;
-  }
-  get integrationStorage() {
-    if (!this.#integrationStorage) {
-      throw new Error("PlatformGithubIntegration generic storage has not been initialized.");
-    }
-    return this.#integrationStorage;
-  }
-  /** Resolve a stored GitHub locator without scanning installations or repositories. */
-  async #resolveIntakeDispatch({
-    orgId,
-    externalSource
-  }) {
-    const target = parseGithubExternalTarget(externalSource.externalId);
-    if (!target) return null;
-    const repository = target.repository.includes("/") ? target.repository : (await this.storage.repositories.findByExternalId({ orgId, externalId: target.repository }))?.slug;
-    if (!repository) return null;
-    return {
-      connection: { type: "app-installation", installationId: 1 },
-      sourceId: repository,
-      issueId: target.issueId
-    };
-  }
-  initialize({ storage }) {
-    this.#integrationStorage = storage;
-    logPlatformInfo("Platform GitHub integration initialized", {
-      endpointHost: this.#endpointHost,
-      pollingEnabled: this.#pollingEnabled,
-      pollingIntervalMs: this.#pollingIntervalMs
-    });
-  }
-  routes(ctx) {
-    const ingestFactoryEvent = attachGithubRules(this, ctx);
-    return [
-      this.#statusRoute(ctx),
-      this.#connectRoute(ctx),
-      this.#connectUserRoute(ctx),
-      ...buildGithubRoutes({
-        auth: ctx.auth,
-        fleet: ctx.fleet,
-        storage: ctx.factoryStorage,
-        github: this,
-        stateSigner: ctx.stateSigner,
-        baseUrl: ctx.baseUrl,
-        controller: ctx.controller,
-        projects: ctx.storage.projects,
-        emitAudit: ctx.hooks?.emitAudit,
-        ingestFactoryEvent
-      }).filter(
-        (route) => route.path !== "/web/github/status" && route.path !== "/web/github/webhook" && !route.path.startsWith("/auth/github/")
-      )
-    ];
-  }
-  #statusRoute(ctx) {
-    return registerApiRoute2("/web/github/status", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        await ctx.auth.ensureUser(loose2(c));
-        const tenant = ctx.auth.tenant(loose2(c));
-        if (!tenant) return c.json({ error: "unauthorized", reason: "auth_required" }, 401);
-        if (!tenant.orgId) {
-          return c.json({
-            enabled: true,
-            sandboxEnabled: ctx.fleet.enabled,
-            organizationRequired: true,
-            connected: false,
-            installations: [],
-            userConnected: false,
-            userGithubUsername: null,
-            reason: "organization_required",
-            diagnostics: this.diagnostics()
-          });
-        }
-        const [installations, userConnection] = await Promise.all([
-          this.#syncInstallations(tenant.orgId, tenant.userId),
-          this.#fetchUserConnection(tenant.userId)
-        ]);
-        return c.json({
-          enabled: true,
-          sandboxEnabled: ctx.fleet.enabled,
-          connected: installations.length > 0,
-          installations: installations.map((installation) => ({
-            installationId: Number(installation.externalId),
-            accountLogin: installation.accountName,
-            accountType: installation.accountType
-          })),
-          userConnected: userConnection.connected,
-          userGithubUsername: userConnection.githubUsername,
-          reason: installations.length > 0 ? "ready" : "not_connected",
-          diagnostics: this.diagnostics()
-        });
-      }
-    });
-  }
-  #connectRoute(ctx) {
-    return registerApiRoute2("/auth/github/connect", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        await ctx.auth.ensureUser(loose2(c));
-        const tenant = ctx.auth.tenant(loose2(c));
-        if (!tenant?.orgId) return c.json({ error: "unauthorized" }, 401);
-        const redirectTo = c.req.query("redirectTo") || c.req.query("return_to") || "/";
-        const originator = routeBaseUrl(ctx, c.req.url);
-        logPlatformInfo("Starting Platform GitHub connect flow", {
-          orgId: tenant.orgId,
-          redirectTo,
-          originator
-        });
-        const query = new URLSearchParams({
-          action: "install",
-          redirectTo,
-          originator
-        });
-        const { url } = await this.#client.request(
-          "GET",
-          `${API_PREFIX2}/github-app/install-url?${query}`
-        );
-        return c.redirect(url);
-      }
-    });
-  }
-  #connectUserRoute(ctx) {
-    return registerApiRoute2("/auth/github/connect-user", {
-      method: "GET",
-      requiresAuth: false,
-      handler: async (c) => {
-        await ctx.auth.ensureUser(loose2(c));
-        const tenant = ctx.auth.tenant(loose2(c));
-        if (!tenant?.orgId) return c.json({ error: "unauthorized" }, 401);
-        const redirectTo = c.req.query("redirectTo") || c.req.query("return_to") || "/";
-        const originator = routeBaseUrl(ctx, c.req.url);
-        logPlatformInfo("Starting Platform GitHub user authorization flow", {
-          orgId: tenant.orgId,
-          redirectTo,
-          originator
-        });
-        const query = new URLSearchParams({
-          userId: tenant.userId,
-          redirectTo,
-          originator
-        });
-        const { url } = await this.#client.request(
-          "GET",
-          `${API_PREFIX2}/github-app/authenticate?${query}`
-        );
-        return c.redirect(url);
-      }
-    });
-  }
-  /**
-   * Personal GitHub connection status for the acting user. Returns
-   * not-connected when the platform predates the user-connection endpoint.
-   */
-  async #fetchUserConnection(userId) {
-    try {
-      const connection = await this.#client.request(
-        "GET",
-        `${API_PREFIX2}/github-app/user-connection?${new URLSearchParams({ userId })}`
-      );
-      if (!connection.connected && connection.reason) {
-        logPlatformWarn("Platform GitHub user connection verification failed", {
-          userId,
-          reason: connection.reason
-        });
-      }
-      return connection;
-    } catch {
-      return { connected: false, githubUsername: null };
-    }
-  }
-  async #syncInstallations(orgId, userId) {
-    const result = await this.#client.request(
-      "GET",
-      `${API_PREFIX2}/github-app/installations`
-    );
-    const usableInstallations = result.installations.filter(
-      (installation) => installation.usable && !installation.suspendedAt
-    );
-    return Promise.all(
-      usableInstallations.map(
-        (installation) => this.versionControl.registerInstallation({
-          orgId,
-          userId,
-          installation: {
-            externalId: String(installation.installationId),
-            accountName: installation.accountLogin,
-            accountType: installation.accountType
-          }
-        })
-      )
-    );
-  }
-  workers(ctx) {
-    if (!this.#pollingEnabled) return [];
-    if (!ctx.controller) {
-      throw new Error("Platform GitHub event polling requires the mounted Mastra Code controller.");
-    }
-    return [
-      new PlatformGithubEventWorker({
-        client: this.#client,
-        controller: ctx.controller,
-        github: this,
-        storage: ctx.storage.generic,
-        ingestFactoryEvent: attachGithubRules(this, ctx),
-        intervalMs: this.#pollingIntervalMs
-      })
-    ];
-  }
-  sessionTools({ requestContext }) {
-    return createGithubSubscriptionTools(requestContext, this);
-  }
-  async postToolObserver({
-    toolContext,
-    requestContext
-  }) {
-    const pullRequestUrl = parseCreatedPullRequest(toolContext);
-    if (!pullRequestUrl || !requestContext) return;
-    await subscribeCurrentSessionToPullRequest(
-      requestContext,
-      pullRequestUrl,
-      "auto-gh-pr-create",
-      this
-    );
-  }
-  diagnostics() {
-    return {
-      mode: "platform",
-      endpointHost: this.#endpointHost,
-      polling: {
-        enabled: this.#pollingEnabled,
-        ...this.#pollingIntervalMs === void 0 ? {} : { intervalMs: this.#pollingIntervalMs }
-      }
-    };
-  }
-  async getRepositoryCollaboratorPermission(_installationId, repoFullName, username, signal) {
-    let repository;
-    try {
-      repository = splitRepository(repoFullName);
-    } catch {
-      return void 0;
-    }
-    try {
-      const result = await this.#client.request(
-        "GET",
-        `${API_PREFIX2}/github/repos/${encodeURIComponent(repository.owner)}/${encodeURIComponent(repository.repo)}/collaborators/${encodeURIComponent(username)}/permission`,
-        void 0,
-        { signal }
-      );
-      return result.permission;
-    } catch {
-      return void 0;
-    }
-  }
-  async listInstallationRepos(installationId) {
-    const result = await this.#client.request("GET", `${API_PREFIX2}/github-app/installations/${installationId}/repositories`);
-    return result.repositories.map((repository) => ({ ...repository, installationId }));
-  }
-  async mintInstallationToken(installationId) {
-    const repositories = await this.listInstallationRepos(installationId);
-    if (repositories.length === 0 || repositories.length > 10) {
-      throw new Error("Platform GitHub token minting requires between one and ten installation repositories.");
-    }
-    const result = await this.#client.request(
-      "POST",
-      `${API_PREFIX2}/github-app/installations/${installationId}/token`,
-      { repositories: repositories.map((repository) => repository.name), permissions: REPOSITORY_TOKEN_PERMISSIONS }
-    );
-    return result.token;
-  }
-  async addIssueLabels(_installationId, sourceId, issueNumber, labels) {
-    const result = await this.#client.request(
-      "POST",
-      repositoryPath(sourceId, `issues/${issueNumber}/labels`),
-      { labels }
-    );
-    return result.labels;
-  }
-  getInstallationOctokit(_installationId) {
-    return {
-      pulls: {
-        get: async ({ owner, repo, pull_number }) => {
-          const data = await this.#client.request(
-            "GET",
-            repositoryPath(`${owner}/${repo}`, `pulls/${pull_number}`)
-          );
-          return { data: { base: { repo: { id: data.base.repo.id } } } };
-        }
-      }
-    };
-  }
-  async #listIssues(connection, sourceId, page, labels) {
-    requireGithubConnection(connection);
-    const path2 = repositoryPath(sourceId, "issues");
-    const query = new URLSearchParams({ state: "open", page: String(page), per_page: String(PAGE_SIZE) });
-    const normalizedLabels = normalizeLabels(labels);
-    if (normalizedLabels.length > 0) query.set("label", normalizedLabels.join(","));
-    const result = await this.#client.request("GET", `${path2}?${query}`);
-    return {
-      issues: result.issues.map((issue) => parseIntakeIssue(sourceId, issue)),
-      nextCursor: result.issues.length === PAGE_SIZE ? String(page + 1) : null
-    };
-  }
-  async #getIssue(connection, sourceId, issueId) {
-    requireGithubConnection(connection);
-    const repository = requireSource(sourceId, "GitHub Intake requires a repository source.");
-    const issueNumber = requirePositiveId(issueId, "issue");
-    try {
-      const [issue, comments] = await Promise.all([
-        this.#client.request("GET", repositoryPath(repository, `issues/${issueNumber}`)),
-        this.#client.request(
-          "GET",
-          `${repositoryPath(repository, `issues/${issueNumber}/comments`)}?per_page=100`
-        )
-      ]);
-      return parseIntakeIssueDetail(repository, issue, comments.comments);
-    } catch (error) {
-      if (isNotFound(error)) return null;
-      throw error;
-    }
-  }
-  async #updateIntakeIssue(input) {
-    requireGithubConnection(input.connection);
-    const repository = requireSource(input.sourceId, "GitHub Intake requires a repository source.");
-    const issueNumber = requirePositiveId(input.issueId, "issue");
-    if (input.state.kind === "byName") {
-      logPlatformWarn(`Platform GitHub: updateIssue byName is not supported (name=${input.state.name}); ignoring.`);
-      return null;
-    }
-    const targetState = input.state.stateType === "unstarted" || input.state.stateType === "started" ? "open" : "closed";
-    const stateReason = targetState === "closed" ? input.state.stateType === "canceled" ? "not_planned" : "completed" : null;
-    try {
-      await this.#client.request("GET", repositoryPath(repository, `pulls/${issueNumber}`));
-      logPlatformWarn(`Platform GitHub: updateIssue rejected \u2014 target ${repository}#${issueNumber} is a pull request.`);
-      return null;
-    } catch (error) {
-      if (!isNotFound(error)) throw error;
-    }
-    try {
-      const issue = await this.#client.request(
-        "PATCH",
-        repositoryPath(repository, `issues/${issueNumber}`),
-        {
-          state: targetState,
-          ...stateReason ? { state_reason: stateReason } : {}
-        },
-        { actingUserId: input.actingUserId }
-      );
-      return parseIntakeIssue(repository, issue);
-    } catch (error) {
-      if (isNotFound(error)) return null;
-      throw error;
-    }
-  }
-  async #createIssueComment(input) {
-    requireGithubConnection(input.connection);
-    const repository = requireSource(input.sourceId, "GitHub Intake requires a repository source.");
-    const issueNumber = requirePositiveId(input.issueId, "issue");
-    try {
-      const comment = await this.#client.request(
-        "POST",
-        repositoryPath(repository, `issues/${issueNumber}/comments`),
-        { body: input.body },
-        { actingUserId: input.actingUserId }
-      );
-      return { id: String(comment.id), url: comment.htmlUrl };
-    } catch (error) {
-      if (isNotFound(error)) return null;
-      throw error;
-    }
-  }
-  async #listPullRequests(input) {
-    requireGithubConnection(input.connection);
-    const page = parsePositiveCursor(input.cursor);
-    const query = new URLSearchParams({
-      state: input.state ?? "open",
-      page: String(page),
-      per_page: String(PAGE_SIZE)
-    });
-    const result = await this.#client.request(
-      "GET",
-      `${repositoryPath(input.sourceId, "pulls")}?${query}`
-    );
-    return {
-      pullRequests: result.pullRequests.filter((pullRequest) => input.includeDrafts !== false || !pullRequest.draft).map(parsePullRequest2),
-      nextCursor: result.pullRequests.length === PAGE_SIZE ? String(page + 1) : null
-    };
-  }
-  async #getPullRequest(input) {
-    try {
-      return parsePullRequest2(
-        await this.#client.request("GET", pullRequestPath(input, input.pullRequestId))
-      );
-    } catch (error) {
-      if (isNotFound(error)) return null;
-      throw error;
-    }
-  }
-  async #createPullRequest(input) {
-    requireGithubConnection(input.connection);
-    const result = await this.#client.request(
-      "POST",
-      repositoryPath(input.sourceId, "pulls"),
-      {
-        head: input.headBranch,
-        base: input.baseBranch,
-        title: input.title,
-        body: input.body,
-        draft: input.draft
-      },
-      { actingUserId: input.actingUserId }
-    );
-    return parsePullRequest2(result);
-  }
-  async #updatePullRequest(input) {
-    const result = await this.#client.request(
-      "PATCH",
-      pullRequestPath(input, input.pullRequestId),
-      {
-        title: input.title,
-        body: input.body === null ? "" : input.body,
-        base: input.baseBranch,
-        state: input.state
-      },
-      { actingUserId: input.actingUserId }
-    );
-    return parsePullRequest2(result);
-  }
-  #mergePullRequest(input) {
-    return this.#client.request(
-      "PUT",
-      `${pullRequestPath(input, input.pullRequestId)}/merge`,
-      { commitTitle: input.commitTitle, commitMessage: input.commitMessage, method: input.method },
-      { actingUserId: input.actingUserId }
-    );
-  }
-  async #listComments(input) {
-    const page = parsePositiveCursor(input.cursor);
-    const result = await this.#client.request(
-      "GET",
-      `${repositoryPath(input.sourceId, `issues/${requirePositiveId(input.pullRequestId, "pull request")}/comments`)}?page=${page}&per_page=${PAGE_SIZE}`
-    );
-    return {
-      comments: result.comments.map(parseComment),
-      nextCursor: result.comments.length === PAGE_SIZE ? String(page + 1) : null
-    };
-  }
-  async #createComment(input) {
-    const comment = await this.#client.request(
-      "POST",
-      repositoryPath(input.sourceId, `issues/${requirePositiveId(input.pullRequestId, "pull request")}/comments`),
-      { body: input.body },
-      { actingUserId: input.actingUserId }
-    );
-    return parseComment(comment);
-  }
-  async #updateComment(input) {
-    requireGithubConnection(input.connection);
-    const comment = await this.#client.request(
-      "PATCH",
-      repositoryPath(input.sourceId, `issues/comments/${requirePositiveId(input.commentId, "comment")}`),
-      { body: input.body },
-      { actingUserId: input.actingUserId }
-    );
-    return parseComment(comment);
-  }
-  async #deleteComment(input) {
-    requireGithubConnection(input.connection);
-    await this.#client.request(
-      "DELETE",
-      repositoryPath(input.sourceId, `issues/comments/${requirePositiveId(input.commentId, "comment")}`),
-      void 0,
-      { actingUserId: input.actingUserId }
-    );
-  }
-  async #listReviews(input) {
-    const page = parsePositiveCursor(input.cursor);
-    const result = await this.#client.request(
-      "GET",
-      `${pullRequestPath(input, input.pullRequestId)}/reviews?page=${page}&per_page=${PAGE_SIZE}`
-    );
-    return {
-      reviews: result.reviews.map(parseReview),
-      nextCursor: result.reviews.length === PAGE_SIZE ? String(page + 1) : null
-    };
-  }
-  async #getReview(input) {
-    try {
-      return parseReview(
-        await this.#client.request(
-          "GET",
-          `${pullRequestPath(input, input.pullRequestId)}/reviews/${requirePositiveId(input.reviewId, "review")}`
-        )
-      );
-    } catch (error) {
-      if (isNotFound(error)) return null;
-      throw error;
-    }
-  }
-  async #createReview(input) {
-    const review = await this.#client.request(
-      "POST",
-      `${pullRequestPath(input, input.pullRequestId)}/reviews`,
-      { body: input.body, commitId: input.commitId, event: input.event ? reviewEvent(input.event) : void 0 },
-      { actingUserId: input.actingUserId }
-    );
-    return parseReview(review);
-  }
-  async #updateReview(input) {
-    const review = await this.#client.request(
-      "PUT",
-      `${pullRequestPath(input, input.pullRequestId)}/reviews/${requirePositiveId(input.reviewId, "review")}`,
-      { body: input.body },
-      { actingUserId: input.actingUserId }
-    );
-    return parseReview(review);
-  }
-  async #submitReview(input) {
-    const review = await this.#client.request(
-      "POST",
-      `${pullRequestPath(input, input.pullRequestId)}/reviews/${requirePositiveId(input.reviewId, "review")}/events`,
-      { body: input.body, event: reviewEvent(input.event) },
-      { actingUserId: input.actingUserId }
-    );
-    return parseReview(review);
-  }
-  async #dismissReview(input) {
-    const review = await this.#client.request(
-      "PUT",
-      `${pullRequestPath(input, input.pullRequestId)}/reviews/${requirePositiveId(input.reviewId, "review")}/dismissals`,
-      { message: input.message },
-      { actingUserId: input.actingUserId }
-    );
-    return parseReview(review);
-  }
-  async #deletePendingReview(input) {
-    await this.#client.request(
-      "DELETE",
-      `${pullRequestPath(input, input.pullRequestId)}/reviews/${requirePositiveId(input.reviewId, "review")}`,
-      void 0,
-      { actingUserId: input.actingUserId }
-    );
-  }
-  async #listReviewComments(input) {
-    const page = parsePositiveCursor(input.cursor);
-    const result = await this.#client.request(
-      "GET",
-      `${pullRequestPath(input, input.pullRequestId)}/comments?page=${page}&per_page=${PAGE_SIZE}`
-    );
-    return {
-      comments: result.comments.map(parseReviewComment),
-      nextCursor: result.comments.length === PAGE_SIZE ? String(page + 1) : null
-    };
-  }
-  async #createReviewComment(input) {
-    let body;
-    if (input.replyToId !== void 0) {
-      body = { body: input.body, replyToId: requirePositiveId(input.replyToId, "review comment") };
-    } else {
-      if (!input.commitId || !input.path || input.line === void 0 || !input.side) {
-        throw new Error("A review comment requires commitId, path, line, and side unless it is a reply.");
-      }
-      body = {
-        body: input.body,
-        commitId: input.commitId,
-        path: input.path,
-        line: input.line,
-        side: input.side.toUpperCase(),
-        startLine: input.startLine,
-        startSide: input.startSide?.toUpperCase()
-      };
-    }
-    return parseReviewComment(
-      await this.#client.request(
-        "POST",
-        `${pullRequestPath(input, input.pullRequestId)}/comments`,
-        body,
-        { actingUserId: input.actingUserId }
-      )
-    );
-  }
-  async #updateReviewComment(input) {
-    requireGithubConnection(input.connection);
-    return parseReviewComment(
-      await this.#client.request(
-        "PATCH",
-        repositoryPath(input.sourceId, `pulls/comments/${requirePositiveId(input.commentId, "review comment")}`),
-        { body: input.body },
-        { actingUserId: input.actingUserId }
-      )
-    );
-  }
-  async #deleteReviewComment(input) {
-    requireGithubConnection(input.connection);
-    await this.#client.request(
-      "DELETE",
-      repositoryPath(input.sourceId, `pulls/comments/${requirePositiveId(input.commentId, "review comment")}`),
-      void 0,
-      { actingUserId: input.actingUserId }
-    );
-  }
-  #requestedReviewers(method, input) {
-    requireGithubConnection(input.connection);
-    return this.#client.request(
-      method,
-      `${pullRequestPath(input, input.pullRequestId)}/requested-reviewers`,
-      method === "GET" ? void 0 : { users: input.users, teams: input.teams },
-      method === "GET" ? void 0 : { actingUserId: input.actingUserId }
-    );
-  }
+	id = "github";
+	#client;
+	#endpointHost;
+	#pollingEnabled;
+	#pollingIntervalMs;
+	#storage;
+	#integrationStorage;
+	/** installationId → cached repository listing (TTL-bounded). */
+	#installationReposCache = /* @__PURE__ */ new Map();
+	/** `orgId:repositoryId` → cached repository access (TTL-bounded). */
+	#repositoryAccessCache = /* @__PURE__ */ new Map();
+	intake = {
+		resolveIntakeDispatch: (input) => this.#resolveIntakeDispatch(input),
+		listSources: async ({ orgId, userId }) => {
+			const usable = (await this.#client.request("GET", `${API_PREFIX}/github-app/installations`)).installations.filter((installation) => installation.usable && !installation.suspendedAt);
+			return (await Promise.all(usable.map(async (installation) => {
+				const storedInstallation = await this.versionControl.registerInstallation({
+					orgId,
+					userId,
+					installation: {
+						externalId: String(installation.installationId),
+						accountName: installation.accountLogin,
+						accountType: installation.accountType
+					}
+				});
+				const result = await this.#client.request("GET", `${API_PREFIX}/github-app/installations/${installation.installationId}/repositories`);
+				await this.versionControl.registerRepositories({
+					orgId,
+					installationId: storedInstallation.id,
+					repositories: result.repositories.map((repository) => ({
+						externalId: String(repository.id),
+						slug: repository.fullName,
+						defaultBranch: repository.defaultBranch,
+						metadata: {
+							private: repository.private,
+							url: repository.htmlUrl
+						}
+					}))
+				});
+				return result.repositories.map((repository) => ({
+					repository,
+					installation
+				}));
+			}))).flat().map(({ repository, installation }) => ({
+				id: repository.fullName,
+				name: repository.fullName,
+				type: "repository",
+				metadata: {
+					installationId: installation.installationId,
+					accountLogin: installation.accountLogin,
+					accountType: installation.accountType,
+					repositoryId: repository.id,
+					defaultBranch: repository.defaultBranch,
+					private: repository.private,
+					url: repository.htmlUrl
+				}
+			}));
+		},
+		listItems: async ({ sourceIds, cursor }) => {
+			const page = parsePositiveCursor(cursor);
+			const pages = await Promise.all(sourceIds.map(async (sourceId) => {
+				const connection = {
+					type: "app-installation",
+					installationId: 1
+				};
+				const [issues, pullRequests] = await Promise.all([this.#listIssues(connection, sourceId, page), this.#listPullRequests({
+					connection,
+					sourceId,
+					includeDrafts: false,
+					cursor: String(page)
+				})]);
+				return {
+					items: [...issues.issues.map((issue) => ({
+						source: {
+							type: "issue",
+							externalId: `${sourceId}:${issue.id}`,
+							url: issue.url
+						},
+						sourceId,
+						title: issue.title,
+						status: issue.state ?? void 0,
+						labels: issue.labels,
+						assignee: issue.assignee,
+						createdAt: issue.createdAt,
+						updatedAt: issue.updatedAt,
+						metadata: {
+							repository: sourceId,
+							number: Number(issue.id),
+							author: issue.author
+						}
+					})), ...pullRequests.pullRequests.map((pullRequest) => ({
+						source: {
+							type: "pull-request",
+							externalId: `${sourceId}:${pullRequest.id}`,
+							url: pullRequest.url
+						},
+						sourceId,
+						title: pullRequest.title,
+						status: pullRequest.state,
+						createdAt: pullRequest.createdAt,
+						updatedAt: pullRequest.updatedAt,
+						metadata: {
+							repository: sourceId,
+							number: Number(pullRequest.id),
+							author: pullRequest.author,
+							baseBranch: pullRequest.baseBranch,
+							headBranch: pullRequest.headBranch
+						}
+					}))],
+					hasNextPage: issues.nextCursor !== null || pullRequests.nextCursor !== null
+				};
+			}));
+			return {
+				items: pages.flatMap((result) => result.items),
+				nextCursor: pages.some((result) => result.hasNextPage) ? String(page + 1) : null
+			};
+		},
+		listIssues: async (input) => {
+			requireGithubConnection(input.connection);
+			const sourceId = requireSingleSource(input.sourceIds, "GitHub Intake requires exactly one repository source.");
+			return this.#listIssues(input.connection, sourceId, parsePositiveCursor(input.cursor), input.labels);
+		},
+		getIssue: (input) => this.#getIssue(input.connection, input.sourceId, input.issueId),
+		createComment: (input) => this.#createIssueComment(input),
+		updateIssue: (input) => this.#updateIntakeIssue(input)
+	};
+	versionControl = {
+		initialize: ({ storage }) => {
+			this.#storage = storage;
+		},
+		registerInstallation: ({ orgId, userId, installation }) => this.storage.installations.upsert({
+			orgId,
+			connectedByUserId: userId,
+			externalId: installation.externalId,
+			accountName: installation.accountName,
+			accountType: installation.accountType,
+			providerMetadata: installation.metadata
+		}),
+		registerRepositories: ({ orgId, installationId, repositories }) => Promise.all(repositories.map((repository) => this.storage.repositories.upsert({
+			orgId,
+			input: {
+				installationId,
+				externalId: repository.externalId,
+				slug: repository.slug,
+				defaultBranch: repository.defaultBranch,
+				providerMetadata: repository.metadata
+			}
+		}))),
+		getRepositoryAccess: async ({ orgId, repositoryId }) => {
+			const cacheKey = `${orgId}:${repositoryId}`;
+			const cached = this.#repositoryAccessCache.get(cacheKey);
+			if (cached && cached.expiresAt > Date.now()) return cached.access;
+			this.#repositoryAccessCache.delete(cacheKey);
+			const repository = await this.storage.repositories.get({
+				orgId,
+				id: repositoryId
+			});
+			if (!repository) throw new Error("Version-control repository not found.");
+			const cloneUrl = `https://github.com/${repository.slug}.git`;
+			const installation = await this.storage.installations.get({
+				orgId,
+				id: repository.installationId
+			});
+			if (!installation) throw new Error("Version-control installation not found.");
+			const installationId = parsePositiveInteger(installation.externalId);
+			if (installationId === null) throw new Error("GitHub installation id is invalid.");
+			const repositoryName = splitRepository(repository.slug).repo;
+			const access = {
+				cloneUrl,
+				authorization: {
+					scheme: "bearer",
+					token: (await this.#client.request("POST", `${API_PREFIX}/github-app/installations/${installationId}/token`, {
+						repositories: [repositoryName],
+						permissions: REPOSITORY_TOKEN_PERMISSIONS
+					})).token
+				}
+			};
+			setBounded(this.#repositoryAccessCache, cacheKey, {
+				access,
+				expiresAt: Date.now() + REPOSITORY_ACCESS_CACHE_TTL_MS
+			});
+			return access;
+		},
+		listPullRequests: (input) => this.#listPullRequests(input),
+		getPullRequest: (input) => this.#getPullRequest(input),
+		createPullRequest: (input) => this.#createPullRequest(input),
+		updatePullRequest: (input) => this.#updatePullRequest(input),
+		closePullRequest: (input) => this.#updatePullRequest({
+			...input,
+			state: "closed"
+		}),
+		mergePullRequest: (input) => this.#mergePullRequest(input),
+		listComments: (input) => this.#listComments(input),
+		createComment: (input) => this.#createComment(input),
+		updateComment: (input) => this.#updateComment(input),
+		deleteComment: (input) => this.#deleteComment(input),
+		listReviews: (input) => this.#listReviews(input),
+		getReview: (input) => this.#getReview(input),
+		createReview: (input) => this.#createReview(input),
+		updateReview: (input) => this.#updateReview(input),
+		submitReview: (input) => this.#submitReview(input),
+		dismissReview: (input) => this.#dismissReview(input),
+		deletePendingReview: (input) => this.#deletePendingReview(input),
+		listReviewComments: (input) => this.#listReviewComments(input),
+		createReviewComment: (input) => this.#createReviewComment(input),
+		updateReviewComment: (input) => this.#updateReviewComment(input),
+		deleteReviewComment: (input) => this.#deleteReviewComment(input),
+		listRequestedReviewers: (input) => this.#requestedReviewers("GET", input),
+		requestReviewers: (input) => this.#requestedReviewers("POST", input),
+		removeRequestedReviewers: (input) => this.#requestedReviewers("DELETE", input)
+	};
+	constructor() {
+		const config = platformApiClientConfigFromEnv();
+		this.#client = new PlatformApiClient(config);
+		this.#endpointHost = new URL(config.baseUrl).host;
+		this.#pollingEnabled = process.env.MASTRA_PLATFORM_GITHUB_POLLING_ENABLED?.trim().toLowerCase() !== "false";
+		this.#pollingIntervalMs = optionalPositiveIntegerEnv("MASTRA_PLATFORM_GITHUB_POLLING_INTERVAL_MS");
+	}
+	get storage() {
+		if (!this.#storage) throw new Error("PlatformGithubIntegration source-control storage has not been initialized.");
+		return this.#storage;
+	}
+	get sourceControlStorage() {
+		return this.storage;
+	}
+	get integrationStorage() {
+		if (!this.#integrationStorage) throw new Error("PlatformGithubIntegration generic storage has not been initialized.");
+		return this.#integrationStorage;
+	}
+	/** Resolve a stored GitHub locator without scanning installations or repositories. */
+	async #resolveIntakeDispatch({ orgId, externalSource }) {
+		const target = parseGithubExternalTarget(externalSource.externalId);
+		if (!target) return null;
+		const repository = target.repository.includes("/") ? target.repository : (await this.storage.repositories.findByExternalId({
+			orgId,
+			externalId: target.repository
+		}))?.slug;
+		if (!repository) return null;
+		return {
+			connection: {
+				type: "app-installation",
+				installationId: 1
+			},
+			sourceId: repository,
+			issueId: target.issueId
+		};
+	}
+	initialize({ storage }) {
+		this.#integrationStorage = storage;
+		logPlatformInfo("Platform GitHub integration initialized", {
+			endpointHost: this.#endpointHost,
+			pollingEnabled: this.#pollingEnabled,
+			pollingIntervalMs: this.#pollingIntervalMs
+		});
+	}
+	routes(ctx) {
+		const ingestFactoryEvent = attachGithubRules(this, ctx);
+		return [
+			this.#statusRoute(ctx),
+			this.#connectRoute(ctx),
+			this.#connectUserRoute(ctx),
+			...buildGithubRoutes({
+				auth: ctx.auth,
+				fleet: ctx.fleet,
+				storage: ctx.factoryStorage,
+				github: this,
+				stateSigner: ctx.stateSigner,
+				baseUrl: ctx.baseUrl,
+				controller: ctx.controller,
+				projects: ctx.storage.projects,
+				emitAudit: ctx.hooks?.emitAudit,
+				ingestFactoryEvent
+			}).filter((route) => route.path !== "/web/github/status" && route.path !== "/web/github/webhook" && !route.path.startsWith("/auth/github/"))
+		];
+	}
+	#statusRoute(ctx) {
+		return registerApiRoute("/web/github/status", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				await ctx.auth.ensureUser(loose(c));
+				const tenant = ctx.auth.tenant(loose(c));
+				if (!tenant) return c.json({
+					error: "unauthorized",
+					reason: "auth_required"
+				}, 401);
+				if (!tenant.orgId) return c.json({
+					enabled: true,
+					sandboxEnabled: ctx.fleet.enabled,
+					organizationRequired: true,
+					connected: false,
+					installations: [],
+					userConnected: false,
+					userGithubUsername: null,
+					reason: "organization_required",
+					diagnostics: this.diagnostics()
+				});
+				const [installations, userConnection] = await Promise.all([this.#syncInstallations(tenant.orgId, tenant.userId), this.#fetchUserConnection(tenant.userId)]);
+				return c.json({
+					enabled: true,
+					sandboxEnabled: ctx.fleet.enabled,
+					connected: installations.length > 0,
+					installations: installations.map((installation) => ({
+						installationId: Number(installation.externalId),
+						accountLogin: installation.accountName,
+						accountType: installation.accountType
+					})),
+					userConnected: userConnection.connected,
+					userGithubUsername: userConnection.githubUsername,
+					reason: installations.length > 0 ? "ready" : "not_connected",
+					diagnostics: this.diagnostics()
+				});
+			}
+		});
+	}
+	#connectRoute(ctx) {
+		return registerApiRoute("/auth/github/connect", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				await ctx.auth.ensureUser(loose(c));
+				const tenant = ctx.auth.tenant(loose(c));
+				if (!tenant?.orgId) return c.json({ error: "unauthorized" }, 401);
+				const redirectTo = c.req.query("redirectTo") || c.req.query("return_to") || "/";
+				const originator = routeBaseUrl(ctx, c.req.url);
+				logPlatformInfo("Starting Platform GitHub connect flow", {
+					orgId: tenant.orgId,
+					redirectTo,
+					originator
+				});
+				const query = new URLSearchParams({
+					action: "install",
+					redirectTo,
+					originator
+				});
+				const { url } = await this.#client.request("GET", `${API_PREFIX}/github-app/install-url?${query}`);
+				return c.redirect(url);
+			}
+		});
+	}
+	#connectUserRoute(ctx) {
+		return registerApiRoute("/auth/github/connect-user", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				await ctx.auth.ensureUser(loose(c));
+				const tenant = ctx.auth.tenant(loose(c));
+				if (!tenant?.orgId) return c.json({ error: "unauthorized" }, 401);
+				const redirectTo = c.req.query("redirectTo") || c.req.query("return_to") || "/";
+				const originator = routeBaseUrl(ctx, c.req.url);
+				logPlatformInfo("Starting Platform GitHub user authorization flow", {
+					orgId: tenant.orgId,
+					redirectTo,
+					originator
+				});
+				const query = new URLSearchParams({
+					userId: tenant.userId,
+					redirectTo,
+					originator
+				});
+				const { url } = await this.#client.request("GET", `${API_PREFIX}/github-app/authenticate?${query}`);
+				return c.redirect(url);
+			}
+		});
+	}
+	/**
+	* Personal GitHub connection status for the acting user. Returns
+	* not-connected when the platform predates the user-connection endpoint.
+	*/
+	async #fetchUserConnection(userId) {
+		try {
+			const connection = await this.#client.request("GET", `${API_PREFIX}/github-app/user-connection?${new URLSearchParams({ userId })}`);
+			if (!connection.connected && connection.reason) logPlatformWarn("Platform GitHub user connection verification failed", {
+				userId,
+				reason: connection.reason
+			});
+			return connection;
+		} catch {
+			return {
+				connected: false,
+				githubUsername: null
+			};
+		}
+	}
+	async #syncInstallations(orgId, userId) {
+		const usableInstallations = (await this.#client.request("GET", `${API_PREFIX}/github-app/installations`)).installations.filter((installation) => installation.usable && !installation.suspendedAt);
+		return Promise.all(usableInstallations.map((installation) => this.versionControl.registerInstallation({
+			orgId,
+			userId,
+			installation: {
+				externalId: String(installation.installationId),
+				accountName: installation.accountLogin,
+				accountType: installation.accountType
+			}
+		})));
+	}
+	workers(ctx) {
+		if (!this.#pollingEnabled) return [];
+		if (!ctx.controller) throw new Error("Platform GitHub event polling requires the mounted Mastra Code controller.");
+		return [new PlatformGithubEventWorker({
+			client: this.#client,
+			controller: ctx.controller,
+			github: this,
+			storage: ctx.storage.generic,
+			ingestFactoryEvent: attachGithubRules(this, ctx),
+			intervalMs: this.#pollingIntervalMs
+		})];
+	}
+	sessionTools({ requestContext }) {
+		return createGithubSubscriptionTools(requestContext, this);
+	}
+	async postToolObserver({ toolContext, requestContext }) {
+		const pullRequestUrl = parseCreatedPullRequest(toolContext);
+		if (!pullRequestUrl || !requestContext) return;
+		await subscribeCurrentSessionToPullRequest(requestContext, pullRequestUrl, "auto-gh-pr-create", this);
+	}
+	diagnostics() {
+		return {
+			mode: "platform",
+			endpointHost: this.#endpointHost,
+			polling: {
+				enabled: this.#pollingEnabled,
+				...this.#pollingIntervalMs === void 0 ? {} : { intervalMs: this.#pollingIntervalMs }
+			}
+		};
+	}
+	async getRepositoryCollaboratorPermission(_installationId, repoFullName, username, signal) {
+		let repository;
+		try {
+			repository = splitRepository(repoFullName);
+		} catch {
+			return;
+		}
+		try {
+			return (await this.#client.request("GET", `${API_PREFIX}/github/repos/${encodeURIComponent(repository.owner)}/${encodeURIComponent(repository.repo)}/collaborators/${encodeURIComponent(username)}/permission`, void 0, { signal })).permission;
+		} catch {
+			return;
+		}
+	}
+	async listInstallationRepos(installationId) {
+		const cached = this.#installationReposCache.get(installationId);
+		if (cached && cached.expiresAt > Date.now()) return cached.repos;
+		this.#installationReposCache.delete(installationId);
+		const repos = (await this.#client.request("GET", `${API_PREFIX}/github-app/installations/${installationId}/repositories`)).repositories.map((repository) => ({
+			...repository,
+			installationId
+		}));
+		setBounded(this.#installationReposCache, installationId, {
+			repos,
+			expiresAt: Date.now() + INSTALLATION_REPOS_CACHE_TTL_MS
+		});
+		return repos;
+	}
+	async mintInstallationToken(installationId) {
+		const repositories = await this.listInstallationRepos(installationId);
+		if (repositories.length === 0 || repositories.length > 10) throw new Error("Platform GitHub token minting requires between one and ten installation repositories.");
+		return (await this.#client.request("POST", `${API_PREFIX}/github-app/installations/${installationId}/token`, {
+			repositories: repositories.map((repository) => repository.name),
+			permissions: REPOSITORY_TOKEN_PERMISSIONS
+		})).token;
+	}
+	async addIssueLabels(_installationId, sourceId, issueNumber, labels) {
+		return (await this.#client.request("POST", repositoryPath(sourceId, `issues/${issueNumber}/labels`), { labels })).labels;
+	}
+	getInstallationOctokit(_installationId) {
+		return { pulls: { get: async ({ owner, repo, pull_number }) => {
+			return { data: { base: { repo: { id: (await this.#client.request("GET", repositoryPath(`${owner}/${repo}`, `pulls/${pull_number}`))).base.repo.id } } } };
+		} } };
+	}
+	async #listIssues(connection, sourceId, page, labels) {
+		requireGithubConnection(connection);
+		const path = repositoryPath(sourceId, "issues");
+		const query = new URLSearchParams({
+			state: "open",
+			page: String(page),
+			per_page: String(PAGE_SIZE)
+		});
+		const normalizedLabels = normalizeLabels(labels);
+		if (normalizedLabels.length > 0) query.set("label", normalizedLabels.join(","));
+		const result = await this.#client.request("GET", `${path}?${query}`);
+		return {
+			issues: result.issues.map((issue) => parseIntakeIssue(sourceId, issue)),
+			nextCursor: result.issues.length === PAGE_SIZE ? String(page + 1) : null
+		};
+	}
+	async #getIssue(connection, sourceId, issueId) {
+		requireGithubConnection(connection);
+		const repository = requireSource(sourceId, "GitHub Intake requires a repository source.");
+		const issueNumber = requirePositiveId(issueId, "issue");
+		try {
+			const [issue, comments] = await Promise.all([this.#client.request("GET", repositoryPath(repository, `issues/${issueNumber}`)), this.#client.request("GET", `${repositoryPath(repository, `issues/${issueNumber}/comments`)}?per_page=100`)]);
+			return parseIntakeIssueDetail(repository, issue, comments.comments);
+		} catch (error) {
+			if (isNotFound(error)) return null;
+			throw error;
+		}
+	}
+	async #updateIntakeIssue(input) {
+		requireGithubConnection(input.connection);
+		const repository = requireSource(input.sourceId, "GitHub Intake requires a repository source.");
+		const issueNumber = requirePositiveId(input.issueId, "issue");
+		if (input.state.kind === "byName") {
+			logPlatformWarn(`Platform GitHub: updateIssue byName is not supported (name=${input.state.name}); ignoring.`);
+			return null;
+		}
+		const targetState = input.state.stateType === "unstarted" || input.state.stateType === "started" ? "open" : "closed";
+		const stateReason = targetState === "closed" ? input.state.stateType === "canceled" ? "not_planned" : "completed" : null;
+		try {
+			await this.#client.request("GET", repositoryPath(repository, `pulls/${issueNumber}`));
+			logPlatformWarn(`Platform GitHub: updateIssue rejected — target ${repository}#${issueNumber} is a pull request.`);
+			return null;
+		} catch (error) {
+			if (!isNotFound(error)) throw error;
+		}
+		try {
+			return parseIntakeIssue(repository, await this.#client.request("PATCH", repositoryPath(repository, `issues/${issueNumber}`), {
+				state: targetState,
+				...stateReason ? { state_reason: stateReason } : {}
+			}, { actingUserId: input.actingUserId }));
+		} catch (error) {
+			if (isNotFound(error)) return null;
+			throw error;
+		}
+	}
+	async #createIssueComment(input) {
+		requireGithubConnection(input.connection);
+		const repository = requireSource(input.sourceId, "GitHub Intake requires a repository source.");
+		const issueNumber = requirePositiveId(input.issueId, "issue");
+		try {
+			const comment = await this.#client.request("POST", repositoryPath(repository, `issues/${issueNumber}/comments`), { body: input.body }, { actingUserId: input.actingUserId });
+			return {
+				id: String(comment.id),
+				url: comment.htmlUrl
+			};
+		} catch (error) {
+			if (isNotFound(error)) return null;
+			throw error;
+		}
+	}
+	async #listPullRequests(input) {
+		requireGithubConnection(input.connection);
+		const page = parsePositiveCursor(input.cursor);
+		const query = new URLSearchParams({
+			state: input.state ?? "open",
+			page: String(page),
+			per_page: String(PAGE_SIZE)
+		});
+		const result = await this.#client.request("GET", `${repositoryPath(input.sourceId, "pulls")}?${query}`);
+		return {
+			pullRequests: result.pullRequests.filter((pullRequest) => input.includeDrafts !== false || !pullRequest.draft).map(parsePullRequest),
+			nextCursor: result.pullRequests.length === PAGE_SIZE ? String(page + 1) : null
+		};
+	}
+	async #getPullRequest(input) {
+		try {
+			return parsePullRequest(await this.#client.request("GET", pullRequestPath(input, input.pullRequestId)));
+		} catch (error) {
+			if (isNotFound(error)) return null;
+			throw error;
+		}
+	}
+	async #createPullRequest(input) {
+		requireGithubConnection(input.connection);
+		return parsePullRequest(await this.#client.request("POST", repositoryPath(input.sourceId, "pulls"), {
+			head: input.headBranch,
+			base: input.baseBranch,
+			title: input.title,
+			body: input.body,
+			draft: input.draft
+		}, { actingUserId: input.actingUserId }));
+	}
+	async #updatePullRequest(input) {
+		return parsePullRequest(await this.#client.request("PATCH", pullRequestPath(input, input.pullRequestId), {
+			title: input.title,
+			body: input.body === null ? "" : input.body,
+			base: input.baseBranch,
+			state: input.state
+		}, { actingUserId: input.actingUserId }));
+	}
+	#mergePullRequest(input) {
+		return this.#client.request("PUT", `${pullRequestPath(input, input.pullRequestId)}/merge`, {
+			commitTitle: input.commitTitle,
+			commitMessage: input.commitMessage,
+			method: input.method
+		}, { actingUserId: input.actingUserId });
+	}
+	async #listComments(input) {
+		const page = parsePositiveCursor(input.cursor);
+		const result = await this.#client.request("GET", `${repositoryPath(input.sourceId, `issues/${requirePositiveId(input.pullRequestId, "pull request")}/comments`)}?page=${page}&per_page=${PAGE_SIZE}`);
+		return {
+			comments: result.comments.map(parseComment),
+			nextCursor: result.comments.length === PAGE_SIZE ? String(page + 1) : null
+		};
+	}
+	async #createComment(input) {
+		return parseComment(await this.#client.request("POST", repositoryPath(input.sourceId, `issues/${requirePositiveId(input.pullRequestId, "pull request")}/comments`), { body: input.body }, { actingUserId: input.actingUserId }));
+	}
+	async #updateComment(input) {
+		requireGithubConnection(input.connection);
+		return parseComment(await this.#client.request("PATCH", repositoryPath(input.sourceId, `issues/comments/${requirePositiveId(input.commentId, "comment")}`), { body: input.body }, { actingUserId: input.actingUserId }));
+	}
+	async #deleteComment(input) {
+		requireGithubConnection(input.connection);
+		await this.#client.request("DELETE", repositoryPath(input.sourceId, `issues/comments/${requirePositiveId(input.commentId, "comment")}`), void 0, { actingUserId: input.actingUserId });
+	}
+	async #listReviews(input) {
+		const page = parsePositiveCursor(input.cursor);
+		const result = await this.#client.request("GET", `${pullRequestPath(input, input.pullRequestId)}/reviews?page=${page}&per_page=${PAGE_SIZE}`);
+		return {
+			reviews: result.reviews.map(parseReview),
+			nextCursor: result.reviews.length === PAGE_SIZE ? String(page + 1) : null
+		};
+	}
+	async #getReview(input) {
+		try {
+			return parseReview(await this.#client.request("GET", `${pullRequestPath(input, input.pullRequestId)}/reviews/${requirePositiveId(input.reviewId, "review")}`));
+		} catch (error) {
+			if (isNotFound(error)) return null;
+			throw error;
+		}
+	}
+	async #createReview(input) {
+		return parseReview(await this.#client.request("POST", `${pullRequestPath(input, input.pullRequestId)}/reviews`, {
+			body: input.body,
+			commitId: input.commitId,
+			event: input.event ? reviewEvent(input.event) : void 0
+		}, { actingUserId: input.actingUserId }));
+	}
+	async #updateReview(input) {
+		return parseReview(await this.#client.request("PUT", `${pullRequestPath(input, input.pullRequestId)}/reviews/${requirePositiveId(input.reviewId, "review")}`, { body: input.body }, { actingUserId: input.actingUserId }));
+	}
+	async #submitReview(input) {
+		return parseReview(await this.#client.request("POST", `${pullRequestPath(input, input.pullRequestId)}/reviews/${requirePositiveId(input.reviewId, "review")}/events`, {
+			body: input.body,
+			event: reviewEvent(input.event)
+		}, { actingUserId: input.actingUserId }));
+	}
+	async #dismissReview(input) {
+		return parseReview(await this.#client.request("PUT", `${pullRequestPath(input, input.pullRequestId)}/reviews/${requirePositiveId(input.reviewId, "review")}/dismissals`, { message: input.message }, { actingUserId: input.actingUserId }));
+	}
+	async #deletePendingReview(input) {
+		await this.#client.request("DELETE", `${pullRequestPath(input, input.pullRequestId)}/reviews/${requirePositiveId(input.reviewId, "review")}`, void 0, { actingUserId: input.actingUserId });
+	}
+	async #listReviewComments(input) {
+		const page = parsePositiveCursor(input.cursor);
+		const result = await this.#client.request("GET", `${pullRequestPath(input, input.pullRequestId)}/comments?page=${page}&per_page=${PAGE_SIZE}`);
+		return {
+			comments: result.comments.map(parseReviewComment),
+			nextCursor: result.comments.length === PAGE_SIZE ? String(page + 1) : null
+		};
+	}
+	async #createReviewComment(input) {
+		let body;
+		if (input.replyToId !== void 0) body = {
+			body: input.body,
+			replyToId: requirePositiveId(input.replyToId, "review comment")
+		};
+		else {
+			if (!input.commitId || !input.path || input.line === void 0 || !input.side) throw new Error("A review comment requires commitId, path, line, and side unless it is a reply.");
+			body = {
+				body: input.body,
+				commitId: input.commitId,
+				path: input.path,
+				line: input.line,
+				side: input.side.toUpperCase(),
+				startLine: input.startLine,
+				startSide: input.startSide?.toUpperCase()
+			};
+		}
+		return parseReviewComment(await this.#client.request("POST", `${pullRequestPath(input, input.pullRequestId)}/comments`, body, { actingUserId: input.actingUserId }));
+	}
+	async #updateReviewComment(input) {
+		requireGithubConnection(input.connection);
+		return parseReviewComment(await this.#client.request("PATCH", repositoryPath(input.sourceId, `pulls/comments/${requirePositiveId(input.commentId, "review comment")}`), { body: input.body }, { actingUserId: input.actingUserId }));
+	}
+	async #deleteReviewComment(input) {
+		requireGithubConnection(input.connection);
+		await this.#client.request("DELETE", repositoryPath(input.sourceId, `pulls/comments/${requirePositiveId(input.commentId, "review comment")}`), void 0, { actingUserId: input.actingUserId });
+	}
+	#requestedReviewers(method, input) {
+		requireGithubConnection(input.connection);
+		return this.#client.request(method, `${pullRequestPath(input, input.pullRequestId)}/requested-reviewers`, method === "GET" ? void 0 : {
+			users: input.users,
+			teams: input.teams
+		}, method === "GET" ? void 0 : { actingUserId: input.actingUserId });
+	}
 };
 function repositoryPath(sourceId, suffix) {
-  const { owner, repo } = splitRepository(sourceId);
-  return `${API_PREFIX2}/github/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/${suffix}`;
+	const { owner, repo } = splitRepository(sourceId);
+	return `${API_PREFIX}/github/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/${suffix}`;
 }
 function pullRequestPath(input, pullRequestId) {
-  requireGithubConnection(input.connection);
-  return repositoryPath(input.sourceId, `pulls/${requirePositiveId(pullRequestId, "pull request")}`);
+	requireGithubConnection(input.connection);
+	return repositoryPath(input.sourceId, `pulls/${requirePositiveId(pullRequestId, "pull request")}`);
 }
 function splitRepository(sourceId) {
-  const slash = sourceId.indexOf("/");
-  if (slash <= 0 || slash === sourceId.length - 1) {
-    throw new Error("GitHub capabilities require an owner/repository source.");
-  }
-  return { owner: sourceId.slice(0, slash), repo: sourceId.slice(slash + 1) };
+	const slash = sourceId.indexOf("/");
+	if (slash <= 0 || slash === sourceId.length - 1) throw new Error("GitHub capabilities require an owner/repository source.");
+	return {
+		owner: sourceId.slice(0, slash),
+		repo: sourceId.slice(slash + 1)
+	};
 }
 function parseIntakeIssue(sourceId, issue) {
-  return {
-    id: String(issue.number),
-    identifier: `#${issue.number}`,
-    title: issue.title,
-    url: issue.htmlUrl,
-    author: issue.user?.login ?? null,
-    state: issue.state,
-    stateType: issue.state,
-    priority: null,
-    assignee: issue.assignees[0] ?? null,
-    source: sourceId,
-    labels: issue.labels,
-    commentCount: issue.commentCount,
-    createdAt: issue.createdAt,
-    updatedAt: issue.updatedAt
-  };
+	return {
+		id: String(issue.number),
+		identifier: `#${issue.number}`,
+		title: issue.title,
+		url: issue.htmlUrl,
+		author: issue.user?.login ?? null,
+		state: issue.state,
+		stateType: issue.state,
+		priority: null,
+		assignee: issue.assignees[0] ?? null,
+		source: sourceId,
+		labels: issue.labels,
+		commentCount: issue.commentCount,
+		createdAt: issue.createdAt,
+		updatedAt: issue.updatedAt
+	};
 }
 function parseIntakeIssueDetail(sourceId, issue, comments) {
-  return {
-    ...parseIntakeIssue(sourceId, issue),
-    description: issue.body?.trim() ? issue.body : null,
-    comments: comments.map((comment) => ({
-      author: comment.user?.login ?? null,
-      body: comment.body,
-      createdAt: comment.createdAt
-    }))
-  };
-}
-function parsePullRequest2(pullRequest) {
-  return {
-    id: String(pullRequest.number),
-    title: pullRequest.title,
-    url: pullRequest.htmlUrl,
-    author: pullRequest.user?.login ?? null,
-    body: pullRequest.body?.trim() ? pullRequest.body : null,
-    state: pullRequest.state,
-    draft: pullRequest.draft,
-    merged: pullRequest.merged,
-    mergeable: pullRequest.mergeable,
-    baseBranch: pullRequest.base.ref,
-    headBranch: pullRequest.head.ref,
-    headSha: pullRequest.head.sha,
-    createdAt: pullRequest.createdAt,
-    updatedAt: pullRequest.updatedAt
-  };
+	return {
+		...parseIntakeIssue(sourceId, issue),
+		description: issue.body?.trim() ? issue.body : null,
+		comments: comments.map((comment) => ({
+			author: comment.user?.login ?? null,
+			body: comment.body,
+			createdAt: comment.createdAt
+		}))
+	};
+}
+function parsePullRequest(pullRequest) {
+	return {
+		id: String(pullRequest.number),
+		title: pullRequest.title,
+		url: pullRequest.htmlUrl,
+		author: pullRequest.user?.login ?? null,
+		body: pullRequest.body?.trim() ? pullRequest.body : null,
+		state: pullRequest.state,
+		draft: pullRequest.draft,
+		merged: pullRequest.merged,
+		mergeable: pullRequest.mergeable,
+		baseBranch: pullRequest.base.ref,
+		headBranch: pullRequest.head.ref,
+		headSha: pullRequest.head.sha,
+		createdAt: pullRequest.createdAt,
+		updatedAt: pullRequest.updatedAt
+	};
 }
 function parseComment(comment) {
-  return {
-    id: String(comment.id),
-    url: comment.htmlUrl,
-    author: comment.user?.login ?? null,
-    body: comment.body,
-    createdAt: comment.createdAt,
-    updatedAt: comment.updatedAt
-  };
+	return {
+		id: String(comment.id),
+		url: comment.htmlUrl,
+		author: comment.user?.login ?? null,
+		body: comment.body,
+		createdAt: comment.createdAt,
+		updatedAt: comment.updatedAt
+	};
 }
 function parseReview(review) {
-  const states = {
-    PENDING: "pending",
-    COMMENTED: "commented",
-    APPROVED: "approved",
-    CHANGES_REQUESTED: "changes-requested",
-    DISMISSED: "dismissed"
-  };
-  return {
-    id: String(review.id),
-    url: review.htmlUrl,
-    author: review.user?.login ?? null,
-    body: review.body?.trim() ? review.body : null,
-    state: states[review.state],
-    commitId: review.commitId,
-    submittedAt: review.submittedAt
-  };
+	return {
+		id: String(review.id),
+		url: review.htmlUrl,
+		author: review.user?.login ?? null,
+		body: review.body?.trim() ? review.body : null,
+		state: {
+			PENDING: "pending",
+			COMMENTED: "commented",
+			APPROVED: "approved",
+			CHANGES_REQUESTED: "changes-requested",
+			DISMISSED: "dismissed"
+		}[review.state],
+		commitId: review.commitId,
+		submittedAt: review.submittedAt
+	};
 }
 function parseReviewComment(comment) {
-  return {
-    ...parseComment(comment),
-    path: comment.path,
-    line: comment.line,
-    side: comment.side?.toLowerCase(),
-    commitId: comment.commitId,
-    replyToId: comment.replyToId === null ? null : String(comment.replyToId)
-  };
+	return {
+		...parseComment(comment),
+		path: comment.path,
+		line: comment.line,
+		side: comment.side?.toLowerCase(),
+		commitId: comment.commitId,
+		replyToId: comment.replyToId === null ? null : String(comment.replyToId)
+	};
 }
 function requireGithubConnection(connection) {
-  if (connection.type !== "app-installation" && connection.type !== "oauth") {
-    throw new Error("GitHub capabilities require a GitHub connection.");
-  }
+	if (connection.type !== "app-installation" && connection.type !== "oauth") throw new Error("GitHub capabilities require a GitHub connection.");
 }
 function requireSingleSource(sourceIds, message) {
-  if (sourceIds.length !== 1) throw new Error(message);
-  return sourceIds[0];
+	if (sourceIds.length !== 1) throw new Error(message);
+	return sourceIds[0];
 }
 function requireSource(sourceId, message) {
-  if (!sourceId) throw new Error(message);
-  return sourceId;
+	if (!sourceId) throw new Error(message);
+	return sourceId;
 }
 function normalizeLabels(labels) {
-  return [...new Set((labels ?? []).map((label) => label.trim()).filter(Boolean))];
+	return [...new Set((labels ?? []).map((label) => label.trim()).filter(Boolean))];
 }
 function parsePositiveCursor(cursor) {
-  if (cursor === void 0) return 1;
-  const parsed = parsePositiveInteger(cursor);
-  if (parsed === null) throw new Error("GitHub cursor must be a positive page number.");
-  return parsed;
+	if (cursor === void 0) return 1;
+	const parsed = parsePositiveInteger(cursor);
+	if (parsed === null) throw new Error("GitHub cursor must be a positive page number.");
+	return parsed;
 }
 function parsePositiveInteger(value) {
-  if (!/^\d+$/.test(value)) return null;
-  const parsed = Number(value);
-  return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : null;
+	if (!/^\d+$/.test(value)) return null;
+	const parsed = Number(value);
+	return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : null;
 }
 function parseGithubExternalTarget(externalId) {
-  const match = externalId.match(/^(.+\/.+):(\d+)$/) ?? externalId.match(/^github:(\d+):(?:issue|pull-request):(\d+)$/) ?? externalId.match(/^(\d+):(\d+)$/);
-  if (!match?.[1] || !match[2] || parsePositiveInteger(match[2]) === null) return null;
-  return { repository: match[1], issueId: match[2] };
+	const match = externalId.match(/^(.+\/.+):(\d+)$/) ?? externalId.match(/^github:(\d+):(?:issue|pull-request):(\d+)$/) ?? externalId.match(/^(\d+):(\d+)$/);
+	if (!match?.[1] || !match[2] || parsePositiveInteger(match[2]) === null) return null;
+	return {
+		repository: match[1],
+		issueId: match[2]
+	};
 }
 function optionalPositiveIntegerEnv(name) {
-  const value = process.env[name]?.trim();
-  if (!value) return void 0;
-  const parsed = parsePositiveInteger(value);
-  if (parsed === null) throw new Error(`${name} must be a positive integer.`);
-  return parsed;
+	const value = process.env[name]?.trim();
+	if (!value) return void 0;
+	const parsed = parsePositiveInteger(value);
+	if (parsed === null) throw new Error(`${name} must be a positive integer.`);
+	return parsed;
 }
 function requirePositiveId(value, resource) {
-  const parsed = parsePositiveInteger(value);
-  if (parsed === null) throw new Error(`GitHub ${resource} id must be a positive integer.`);
-  return parsed;
+	const parsed = parsePositiveInteger(value);
+	if (parsed === null) throw new Error(`GitHub ${resource} id must be a positive integer.`);
+	return parsed;
 }
 function reviewEvent(event) {
-  if (event === "approve") return "APPROVE";
-  if (event === "request-changes") return "REQUEST_CHANGES";
-  return "COMMENT";
+	if (event === "approve") return "APPROVE";
+	if (event === "request-changes") return "REQUEST_CHANGES";
+	return "COMMENT";
 }
 function isNotFound(error) {
-  return error instanceof PlatformApiError && error.status === 404;
+	return error instanceof PlatformApiError && error.status === 404;
 }
-export {
-  PlatformGithubIntegration
-};
+//#endregion
+export { PlatformGithubIntegration };
+
 //# sourceMappingURL=integration.js.map