@mastra/factory 0.2.2-alpha.3 → 0.2.2-alpha.4

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @mastra/factory
 
+## 0.2.2-alpha.4
+
+### Patch Changes
+
+- Make shared-factory credentials discoverable and shareable. The providers config route now reports `orgKey` per provider (an org-wide API key exists, even when shadowed by a personal credential) and `orgKeyAdmin` on the envelope (whether the caller may write org-scoped keys). The Studio UI uses this to default factory-setup API keys to org scope, warn when a factory default model is backed by a personal-only credential, show Personal/Org key badges, and replace the composer with an actionable notice when the signed-in user has no credential for the factory default model's provider. ([#20315](https://github.com/mastra-ai/mastra/pull/20315))
+
+- Reopening a workspace no longer fails with "git pull failed: Not possible to fast-forward" when the sandbox workdir was left on a session branch that diverged from its upstream (or has no upstream / detached HEAD). That state is the session's local work, so materialization now keeps the checkout as-is and continues instead of erroring the thread page; genuine pull failures (auth, egress, corruption) still surface. ([#20315](https://github.com/mastra-ai/mastra/pull/20315))
+
+- Pin Factory session agents to their session workdir. The agent system prompt derives its working directory from `state.projectPath`, which for Factory sessions inherited the controller-global default — the web server's own checkout. Review agents would `cd` into the host repository and run `gh pr checkout` there, mutating the developer's working tree instead of the session sandbox. The session workspace factory now seeds `projectPath`/`projectName` with the resolved sandbox workdir when the session is created and self-heals live state on later requests. ([#20320](https://github.com/mastra-ai/mastra/pull/20320))
+
+- Made Factory session opens and rule-driven kickoffs resilient to platform sandbox failures: ([#20294](https://github.com/mastra-ai/mastra/pull/20294))
+
+  - Skill kickoffs now wait for the agent to accept the wake signal (via the new `requireDelivery` option on `session.sendSignal`) and automatically retry when delivery fails — for example when a platform sandbox is unreachable. Previously kickoffs were marked as sent even when the wake never reached the agent, so review sessions ended up as permanently empty threads.
+  - Exec calls in the repo materialize/checkout/worktree-setup path retry thrown transport errors with a 5xx status (up to 2 retries with backoff). When several platform sandboxes are provisioned concurrently, the workspace proxy can return a transient 5xx on exec while a VM is still booting; this previously failed the whole session open with "Platform proxy request failed with 500". Command failures are unaffected — they resolve with a non-zero exit code and are never retried.
+  - A sandbox whose git preflight fails (`git-missing`) is now treated as poisoned: the workspace factory tears it down, clears the persisted binding, and retries once on a freshly provisioned sandbox. Previously a sandbox booted from a bare base image (e.g. when the provider's template build fails) was reattached forever, so every session open failed with "git is not installed in the sandbox".
+  - Concurrent kickoff preparation no longer surfaces a spurious unique-constraint error: a losing preparer can collide on both the work item's `source_key` and the pending start's `kickoff_key` in sequence, so the insert-or-replay loop now retries once more before giving up.
+
+- Added a periodic merged-PR reconciler so review board cards can never get stuck when a merge event is missed. Every 5 minutes the platform GitHub worker lists still-open `github-pr` review cards, fetches the live pull request state from GitHub, and replays a missed merge through the normal rules ingress with a state-derived idempotency key — moving the card to Done (and notifying an active session, if any) exactly once. The sweep has its own switch, `MASTRA_PLATFORM_GITHUB_RECONCILE_ENABLED` (default on), and keeps running in a reconcile-only worker mode even when `MASTRA_PLATFORM_GITHUB_POLLING_ENABLED=false`. Sweep failures are logged and stay on cadence instead of retrying every poll tick. ([#20315](https://github.com/mastra-ai/mastra/pull/20315))
+
+- Move merged pull request Review cards to Done automatically. When a PR merge event binds to the PR's own Review card, the built-in rule now transitions the card to Done (delivering a note to the card's active session when one exists) instead of attempting to message a work session that may not exist. Merge events bound to a provenance-linked Work item still only remind that agent to assess completion and never auto-complete the Work item. ([#20315](https://github.com/mastra-ai/mastra/pull/20315))
+
+  Pull requests closed without merging now clear off the board too: a new built-in `pullRequestClosed` rule moves the PR's Review card to Canceled, and the reconcile sweep replays missed closes (not just missed merges) so abandoned PRs no longer sit in Reviewing forever.
+
+  The reconcile sweep is also scoped to factory-configured repositories: instead of probing every repository a GitHub installation exposes, it bulk-loads the (installation, repository) pairs linked to factory projects and only sweeps those, reporting the swept repository count in its summary log.
+
+- Updated dependencies [[`6218217`](https://github.com/mastra-ai/mastra/commit/62182171b6cfca0b099f1c6a77a2e65e7639ab86), [`d12b2e4`](https://github.com/mastra-ai/mastra/commit/d12b2e4023fd9e3d3e93a9169f5088bcee2a849c)]:
+  - @mastra/core@1.54.0-alpha.4
+  - @mastra/code-sdk@1.1.0-alpha.4
+
 ## 0.2.2-alpha.3
 
 ### Patch Changes

package/dist/integrations/github/rules.d.ts

@@ -26,5 +26,53 @@ export declare class GithubRules {
         status: 'ignored' | 'committed' | 'replayed' | 'missing';
     }>;
 }
+export interface ReconcilePullRequestState {
+    title: string;
+    url: string;
+    state: 'open' | 'closed';
+    merged: boolean;
+    headBranch: string;
+    baseBranch: string;
+    createdAt?: string;
+    mergedBy?: string;
+}
+export type GithubPullRequestFetcher = (input: {
+    installationId: number;
+    repository: string;
+    number: number;
+}) => Promise<ReconcilePullRequestState | undefined>;
+export interface ReconcileRepository {
+    id: number;
+    fullName: string;
+    installationId: number;
+}
+export interface ReconcileSweepSummary {
+    /** Factory-configured repositories included in the sweep. */
+    repositories: number;
+    /** PRs whose live state was fetched from GitHub. */
+    checked: number;
+    /** Missed merges replayed through the rules ingress. */
+    merged: number;
+    /** Missed closes-without-merge replayed through the rules ingress. */
+    closed: number;
+    /** PRs (or whole repositories) skipped because of an error. */
+    failed: number;
+    /** Error samples with context, capped at {@link RECONCILE_ERROR_SAMPLE_LIMIT}. */
+    errors: Array<{
+        repository: string;
+        pullRequestNumber?: number;
+        error: string;
+    }>;
+}
+export type GithubPullRequestReconciler = (repositories: ReconcileRepository[]) => Promise<ReconcileSweepSummary>;
+export declare function reconciledClosedEvent(repository: ReconcileRepository, pullRequestNumber: number, state: ReconcilePullRequestState): ParsedGithubWebhook;
+/**
+ * State-based safety net for merge signals: webhooks and event-log tailing
+ * can miss a merge (cursor gaps, downtime, terminally failed decisions), so
+ * this sweep compares still-open PR cards against actual GitHub state and
+ * replays the merge through the normal rules ingress when they disagree.
+ */
+export declare function createGithubPullRequestReconciler(options: GithubRulesOptions, fetchPullRequest: GithubPullRequestFetcher): GithubPullRequestReconciler;
 export declare function attachGithubRules(github: GithubRulesIntegration, context: IntegrationContext): ((event: ParsedGithubWebhook) => Promise<unknown>) | undefined;
+export declare function attachGithubReconciler(github: GithubRulesIntegration, context: IntegrationContext, fetchPullRequest: GithubPullRequestFetcher): GithubPullRequestReconciler | undefined;
 //# sourceMappingURL=rules.d.ts.map

package/dist/integrations/github/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/rules.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAKV,YAAY,EACb,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,KAAK,EAEV,0BAA0B,EAC3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,KAAK,EAAe,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC9F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAgGxD,MAAM,WAAW,sBAAsB;IACrC,mCAAmC,CACjC,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,aAAa,EAAE,0BAA0B,CAAC;IAC1C,yEAAyE;IACzE,kBAAkB,EAAE,wBAAwB,CAAC;IAC7C,QAAQ,EAAE,sBAAsB,CAAC;IACjC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,qBAAa,WAAW;;IACV,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,kBAAkB;IAElD,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,CAAA;KAAE,CAAC;CAgNjH;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,kBAAkB,GAC1B,CAAC,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAWhE"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/rules.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAKV,YAAY,EACb,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,KAAK,EAEV,0BAA0B,EAC3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,KAAK,EAAe,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC9F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAgGxD,MAAM,WAAW,sBAAsB;IACrC,mCAAmC,CACjC,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,aAAa,EAAE,0BAA0B,CAAC;IAC1C,yEAAyE;IACzE,kBAAkB,EAAE,wBAAwB,CAAC;IAC7C,QAAQ,EAAE,sBAAsB,CAAC;IACjC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,qBAAa,WAAW;;IACV,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,kBAAkB;IAElD,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,CAAA;KAAE,CAAC;CAgNjH;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC;IACzB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,wBAAwB,GAAG,CAAC,KAAK,EAAE;IAC7C,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,KAAK,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAAC;AAErD,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,6DAA6D;IAC7D,YAAY,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,MAAM,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClF;AAED,MAAM,MAAM,2BAA2B,GAAG,CAAC,YAAY,EAAE,mBAAmB,EAAE,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;AA2BlH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,mBAAmB,EAC/B,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,yBAAyB,GAC/B,mBAAmB,CAuBrB;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,kBAAkB,EAC3B,gBAAgB,EAAE,wBAAwB,GACzC,2BAA2B,CAwE7B;AAcD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,kBAAkB,GAC1B,CAAC,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAKhE;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,kBAAkB,EAC3B,gBAAgB,EAAE,wBAAwB,GACzC,2BAA2B,GAAG,SAAS,CAIzC"}

package/dist/integrations/github/rules.js

@@ -30,7 +30,7 @@ function eventName(parsed) {
 	if (parsed.event === "issues" && action === "opened") return "issueOpened";
 	if (parsed.event === "pull_request" && action === "opened") return "pullRequestOpened";
 	if (parsed.event === "pull_request" && action === "synchronize") return "pullRequestUpdated";
-	if (parsed.event === "pull_request" && action === "closed" && boolean(object(parsed.payload.pull_request)?.merged)) return "pullRequestMerged";
+	if (parsed.event === "pull_request" && action === "closed") return boolean(object(parsed.payload.pull_request)?.merged) ? "pullRequestMerged" : "pullRequestClosed";
 	if (parsed.event === "pull_request" && action === "review_requested") return "pullRequestReviewRequested";
 }
 function canonicalSourceKey(kind, itemNumber) {
@@ -215,19 +215,148 @@ var GithubRules = class {
 		if (pullRequestNumber) return items.find((item) => item.externalSource?.externalId === canonicalSourceKey("pull-request", pullRequestNumber)) ?? items.find((item) => item.externalSource?.externalId === legacySourceKey(repositoryId, "pull-request", pullRequestNumber)) ?? (pullRequestHeadBranch ? items.find((item) => item.externalSource?.type !== "pull-request" && Object.values(item.sessions).some((session) => session.branch === pullRequestHeadBranch)) : void 0);
 	}
 };
-function attachGithubRules(github, context) {
+const RECONCILE_ERROR_SAMPLE_LIMIT = 5;
+/**
+* Extracts the PR number a work item tracks, but only when the item belongs
+* to the given repository. Card URLs pin the repository unambiguously; the
+* legacy source key embeds the repository id. Canonical keys (`github-pr:N`)
+* carry no repository, so they are only trusted when the item has no URL —
+* a project mapped to multiple repositories must not reconcile one repo's
+* card against another repo's PR number.
+*/
+function reconcilablePullRequestNumber(item, repository) {
+	if (item.externalSource?.type !== "pull-request") return void 0;
+	const url = item.externalSource.url;
+	if (url) {
+		const match = /^https?:\/\/[^/]+\/(.+)\/pull\/(\d+)(?:[/?#]|$)/.exec(url);
+		if (!match) return void 0;
+		return match[1] === repository.fullName ? Number(match[2]) : void 0;
+	}
+	const externalId = item.externalSource.externalId;
+	const legacy = /^github:(\d+):pull-request:(\d+)$/.exec(externalId);
+	if (legacy) return Number(legacy[1]) === repository.id ? Number(legacy[2]) : void 0;
+	const canonical = /^github-pr:(\d+)$/.exec(externalId);
+	return canonical ? Number(canonical[1]) : void 0;
+}
+function reconciledClosedEvent(repository, pullRequestNumber, state) {
+	return {
+		event: "pull_request",
+		deliveryId: `reconcile:${repository.id}:pull-request:${pullRequestNumber}:${state.merged ? "merged" : "closed"}`,
+		payload: {
+			action: "closed",
+			installation: { id: repository.installationId },
+			repository: {
+				id: repository.id,
+				full_name: repository.fullName
+			},
+			sender: { login: state.mergedBy ?? "github" },
+			pull_request: {
+				number: pullRequestNumber,
+				title: state.title,
+				html_url: state.url,
+				...state.createdAt ? { created_at: state.createdAt } : {},
+				state: "closed",
+				merged: state.merged,
+				head: { ref: state.headBranch },
+				base: { ref: state.baseBranch }
+			}
+		}
+	};
+}
+/**
+* State-based safety net for merge signals: webhooks and event-log tailing
+* can miss a merge (cursor gaps, downtime, terminally failed decisions), so
+* this sweep compares still-open PR cards against actual GitHub state and
+* replays the merge through the normal rules ingress when they disagree.
+*/
+function createGithubPullRequestReconciler(options, fetchPullRequest) {
+	const rules = new GithubRules(options);
+	return async (repositories) => {
+		const summary = {
+			repositories: 0,
+			checked: 0,
+			merged: 0,
+			closed: 0,
+			failed: 0,
+			errors: []
+		};
+		const recordFailure = (repository, error, pullRequestNumber) => {
+			summary.failed += 1;
+			if (summary.errors.length < RECONCILE_ERROR_SAMPLE_LIMIT) summary.errors.push({
+				repository: repository.fullName,
+				...pullRequestNumber === void 0 ? {} : { pullRequestNumber },
+				error: error instanceof Error ? error.message : String(error)
+			});
+		};
+		const configured = new Set((await options.sourceControl.projectRepositories.listConfiguredExternalKeys()).map((key) => `${key.installationExternalId}\u0000${key.repositoryExternalId}`));
+		const scoped = repositories.filter((repository) => configured.has(`${repository.installationId}\u0000${repository.id}`));
+		summary.repositories = scoped.length;
+		for (const repository of scoped) {
+			let numbers;
+			try {
+				const projects = await options.sourceControl.projectRepositories.listByExternalRepository({
+					installationExternalId: String(repository.installationId),
+					repositoryExternalId: String(repository.id)
+				});
+				if (projects.length === 0) continue;
+				numbers = /* @__PURE__ */ new Set();
+				for (const project of projects) {
+					const items = await options.storage.list({
+						orgId: project.orgId,
+						factoryProjectId: project.factoryProjectId
+					});
+					for (const item of items) {
+						const stage = item.stages[0];
+						if (stage === "done" || stage === "canceled") continue;
+						const pullRequestNumber = reconcilablePullRequestNumber(item, repository);
+						if (pullRequestNumber) numbers.add(pullRequestNumber);
+					}
+				}
+			} catch (error) {
+				recordFailure(repository, error);
+				continue;
+			}
+			for (const pullRequestNumber of numbers) try {
+				const state = await fetchPullRequest({
+					installationId: repository.installationId,
+					repository: repository.fullName,
+					number: pullRequestNumber
+				});
+				summary.checked += 1;
+				if (!state || state.state !== "closed") continue;
+				await rules.ingest(reconciledClosedEvent(repository, pullRequestNumber, state));
+				if (state.merged) summary.merged += 1;
+				else summary.closed += 1;
+			} catch (error) {
+				recordFailure(repository, error, pullRequestNumber);
+			}
+		}
+		return summary;
+	};
+}
+function githubRulesOptions(github, context) {
 	if (!context.rules) return void 0;
-	const rules = new GithubRules({
+	return {
 		github,
 		sourceControl: context.storage.sourceControl,
 		integrationStorage: context.storage.generic,
 		projects: context.storage.projects,
 		storage: context.rules.workItems,
 		rules: context.rules.config
-	});
+	};
+}
+function attachGithubRules(github, context) {
+	const options = githubRulesOptions(github, context);
+	if (!options) return void 0;
+	const rules = new GithubRules(options);
 	return (event) => rules.ingest(event);
 }
+function attachGithubReconciler(github, context, fetchPullRequest) {
+	const options = githubRulesOptions(github, context);
+	if (!options) return void 0;
+	return createGithubPullRequestReconciler(options, fetchPullRequest);
+}
 //#endregion
-export { GithubRules, attachGithubRules };
+export { GithubRules, attachGithubReconciler, attachGithubRules, createGithubPullRequestReconciler, reconciledClosedEvent };
 
 //# sourceMappingURL=rules.js.map

package/dist/integrations/github/rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules.js","names":["#ingestProject","#relatedItem"],"sources":["../../../src/integrations/github/rules.ts"],"sourcesContent":["import { resolveFactoryGithubRule } from '../../rules/resolve.js';\nimport type {\n  FactoryGithubEventName,\n  FactoryGithubRuleContext,\n  FactoryRuleActor,\n  FactoryRuleDecision,\n  FactoryRules,\n} from '../../rules/types.js';\nimport { validateFactoryRuleDecisions } from '../../rules/validation.js';\nimport type { IntegrationStorageHandle } from '../../storage/domains/integrations/base.js';\nimport type { FactoryProjectsStorage } from '../../storage/domains/projects/base.js';\nimport type {\n  ExternalRepositoryProjectTarget,\n  SourceControlStorageHandle,\n} from '../../storage/domains/source-control/base.js';\nimport type { WorkItemRow, WorkItemsStorage } from '../../storage/domains/work-items/base.js';\nimport type { IntegrationContext } from '../base.js';\nimport type { GithubRepositoryPermission } from './integration.js';\nimport type { ParsedGithubWebhook } from './webhook.js';\n\nconst TRUSTED_PERMISSIONS = new Set(['write', 'admin']);\nconst RULE_TIMEOUT_MS = 5_000;\n\nasync function withRuleTimeout<T>(promise: Promise<T>): Promise<T> {\n  let timeout: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      promise,\n      new Promise<never>((_, reject) => {\n        timeout = setTimeout(() => reject(new Error('FACTORY_RULE_TIMEOUT')), RULE_TIMEOUT_MS);\n      }),\n    ]);\n  } finally {\n    if (timeout) clearTimeout(timeout);\n  }\n}\n\nfunction object(value: unknown): Record<string, unknown> | undefined {\n  return value && typeof value === 'object' && !Array.isArray(value) ? (value as Record<string, unknown>) : undefined;\n}\n\nfunction string(value: unknown): string | undefined {\n  return typeof value === 'string' && value.length > 0 ? value : undefined;\n}\n\nfunction number(value: unknown): number | undefined {\n  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;\n}\n\nfunction boolean(value: unknown): boolean | undefined {\n  return typeof value === 'boolean' ? value : undefined;\n}\n\nfunction eventName(parsed: ParsedGithubWebhook): FactoryGithubEventName | undefined {\n  const action = string(parsed.payload.action);\n  if (parsed.event === 'issues' && action === 'opened') return 'issueOpened';\n  if (parsed.event === 'pull_request' && action === 'opened') return 'pullRequestOpened';\n  if (parsed.event === 'pull_request' && action === 'synchronize') return 'pullRequestUpdated';\n  if (parsed.event === 'pull_request' && action === 'closed' && boolean(object(parsed.payload.pull_request)?.merged)) {\n    return 'pullRequestMerged';\n  }\n  if (parsed.event === 'pull_request' && action === 'review_requested') return 'pullRequestReviewRequested';\n  return undefined;\n}\n\nfunction canonicalSourceKey(kind: 'issue' | 'pull-request', itemNumber: number): string {\n  return kind === 'issue' ? `github-issue:${itemNumber}` : `github-pr:${itemNumber}`;\n}\n\nfunction legacySourceKey(repositoryId: number, kind: 'issue' | 'pull-request', itemNumber: number): string {\n  return `github:${repositoryId}:${kind}:${itemNumber}`;\n}\n\nfunction provenanceTarget(repositoryId: number, pullRequestNumber: number): string {\n  return `factory-pr-provenance:${repositoryId}:${pullRequestNumber}`;\n}\n\nfunction workItemSource(item: WorkItemRow) {\n  if (!item.externalSource) return 'manual' as const;\n  return item.externalSource.type === 'pull-request' ? ('github-pr' as const) : ('github-issue' as const);\n}\n\nfunction workItemSourceKey(item: WorkItemRow): string | null {\n  return item.externalSource?.externalId ?? null;\n}\n\nasync function githubActor(\n  github: GithubRulesIntegration,\n  input: { installationId: number; repository: string; login: string; factoryAuthored: boolean },\n): Promise<FactoryRuleActor> {\n  let trusted = false;\n  try {\n    const permission = await github.getRepositoryCollaboratorPermission(\n      input.installationId,\n      input.repository,\n      input.login,\n    );\n    trusted = permission !== undefined && TRUSTED_PERMISSIONS.has(permission);\n  } catch {\n    trusted = false;\n  }\n  return { type: 'github', login: input.login, trusted, factoryAuthored: input.factoryAuthored };\n}\n\ninterface FactoryPullRequestProvenanceData {\n  kind: 'factory-pr-provenance';\n  workItemId: string;\n}\n\nfunction pullRequestProvenance(data: Record<string, unknown> | undefined): FactoryPullRequestProvenanceData | null {\n  if (!data || data.kind !== 'factory-pr-provenance' || typeof data.workItemId !== 'string') return null;\n  return { kind: 'factory-pr-provenance', workItemId: data.workItemId };\n}\n\nexport interface GithubRulesIntegration {\n  getRepositoryCollaboratorPermission(\n    installationId: number,\n    repoFullName: string,\n    username: string,\n  ): Promise<GithubRepositoryPermission | undefined>;\n}\n\nexport interface GithubRulesOptions {\n  github: GithubRulesIntegration;\n  sourceControl: SourceControlStorageHandle;\n  /** Integration-scoped storage; provenance rows are validated at read. */\n  integrationStorage: IntegrationStorageHandle;\n  projects: FactoryProjectsStorage;\n  storage: WorkItemsStorage;\n  rules: FactoryRules;\n}\n\nexport class GithubRules {\n  constructor(private readonly options: GithubRulesOptions) {}\n\n  async ingest(parsed: ParsedGithubWebhook): Promise<{ status: 'ignored' | 'committed' | 'replayed' | 'missing' }> {\n    const event = eventName(parsed);\n    const repository = object(parsed.payload.repository);\n    const installationId = number(object(parsed.payload.installation)?.id);\n    const repositoryId = number(repository?.id);\n    const repositoryName = string(repository?.full_name);\n    const login = string(object(parsed.payload.sender)?.login);\n    if (!event || !installationId || !repositoryId || !repositoryName || !login) return { status: 'ignored' };\n\n    const projects = await this.options.sourceControl.projectRepositories.listByExternalRepository({\n      installationExternalId: String(installationId),\n      repositoryExternalId: String(repositoryId),\n    });\n    if (projects.length === 0) return { status: 'ignored' };\n    const results = [];\n    for (const project of projects) {\n      results.push(\n        await this.#ingestProject(parsed, event, installationId, repositoryId, repositoryName, login, project),\n      );\n    }\n    if (results.some(result => result.status === 'committed')) return { status: 'committed' };\n    if (results.some(result => result.status === 'replayed')) return { status: 'replayed' };\n    return results[0] ?? { status: 'ignored' };\n  }\n\n  async #ingestProject(\n    parsed: ParsedGithubWebhook,\n    event: FactoryGithubEventName,\n    installationId: number,\n    repositoryId: number,\n    repositoryName: string,\n    login: string,\n    project: ExternalRepositoryProjectTarget,\n  ): Promise<{ status: 'committed' | 'replayed' | 'missing' }> {\n    const factoryProject = await this.options.projects.get({\n      orgId: project.orgId,\n      id: project.factoryProjectId,\n    });\n    if (!factoryProject) return { status: 'missing' };\n    const issue = object(parsed.payload.issue);\n    const pullRequest = object(parsed.payload.pull_request);\n    const issueNumber = number(issue?.number);\n    const pullRequestNumber = number(pullRequest?.number);\n    const provenance = pullRequestNumber\n      ? pullRequestProvenance(\n          (\n            await this.options.integrationStorage.subscriptions.listByTarget(\n              provenanceTarget(repositoryId, pullRequestNumber),\n              { status: 'active' },\n            )\n          ).find(subscription => subscription.orgId === project.orgId)?.data,\n        )\n      : null;\n    const relatedItem = await this.#relatedItem(\n      project.orgId,\n      project.factoryProjectId,\n      repositoryId,\n      issueNumber,\n      pullRequestNumber,\n      string(object(pullRequest?.head)?.ref),\n      provenance,\n    );\n    const actor = await githubActor(this.options.github, {\n      installationId,\n      repository: repositoryName,\n      login,\n      factoryAuthored: provenance !== null,\n    });\n    const context: FactoryGithubRuleContext = {\n      tenant: { orgId: project.orgId, projectId: project.factoryProjectId },\n      actor,\n      ingress: { type: 'github', id: `${installationId}:${parsed.deliveryId}` },\n      cause: `github.${event}`,\n      causalChain: [],\n      ruleSetVersion: this.options.rules.version,\n      ...(relatedItem\n        ? {\n            item: {\n              id: relatedItem.id,\n              source: workItemSource(relatedItem),\n              sourceKey: workItemSourceKey(relatedItem),\n              parentWorkItemId: relatedItem.parentWorkItemId,\n              title: relatedItem.title,\n              url: relatedItem.externalSource?.url ?? null,\n              stages: relatedItem.stages,\n            },\n            board: relatedItem.externalSource?.type === 'pull-request' ? ('review' as const) : ('work' as const),\n            itemRevision: relatedItem.revision,\n          }\n        : {}),\n      event,\n      deliveryId: parsed.deliveryId,\n      factory: { createdAt: factoryProject.createdAt.toISOString() },\n      repository: { id: repositoryId, fullName: repositoryName },\n      ...(issueNumber && string(issue?.title) && string(issue?.html_url)\n        ? {\n            issue: {\n              number: issueNumber,\n              title: string(issue?.title)!,\n              url: string(issue?.html_url)!,\n              ...(string(issue?.created_at) ? { createdAt: string(issue?.created_at) } : {}),\n            },\n          }\n        : {}),\n      ...(pullRequestNumber && string(pullRequest?.title) && string(pullRequest?.html_url)\n        ? {\n            pullRequest: {\n              number: pullRequestNumber,\n              title: string(pullRequest?.title)!,\n              url: string(pullRequest?.html_url)!,\n              ...(string(pullRequest?.created_at) ? { createdAt: string(pullRequest?.created_at) } : {}),\n              state: string(pullRequest?.state) === 'closed' ? ('closed' as const) : ('open' as const),\n              merged: boolean(pullRequest?.merged) ?? false,\n              headBranch: string(object(pullRequest?.head)?.ref) ?? '',\n              baseBranch: string(object(pullRequest?.base)?.ref) ?? '',\n            },\n          }\n        : {}),\n      ...(object(parsed.payload.review)\n        ? {\n            review: {\n              id: number(object(parsed.payload.review)?.id) ?? 0,\n              state: string(object(parsed.payload.review)?.state) ?? 'unknown',\n              url: string(object(parsed.payload.review)?.html_url) ?? '',\n            },\n          }\n        : {}),\n    };\n\n    const rule = resolveFactoryGithubRule(this.options.rules, event);\n    let decision: FactoryRuleDecision | void;\n    let decisions: Record<string, unknown>[] = [];\n    let outcome: { status: 'accepted' | 'rejected'; code?: string; reason?: string } = { status: 'accepted' };\n    try {\n      decision = rule ? await withRuleTimeout(Promise.resolve(rule(Object.freeze(context)))) : undefined;\n      if (decision?.type === 'reject') {\n        outcome = { status: 'rejected', code: decision.code, reason: decision.reason };\n      } else if (decision) {\n        decisions = validateFactoryRuleDecisions([decision]).map(entry => ({ ...entry }));\n      }\n    } catch (error) {\n      const timedOut = error instanceof Error && error.message === 'FACTORY_RULE_TIMEOUT';\n      outcome = {\n        status: 'rejected',\n        code: timedOut ? 'timeout' : 'rule_error',\n        reason: timedOut\n          ? 'Factory rule evaluation timed out.'\n          : error instanceof Error\n            ? error.message.slice(0, 2_000)\n            : 'Factory GitHub rule failed.',\n      };\n    }\n\n    const committed = await this.options.storage.commitRuleEvaluation({\n      orgId: project.orgId,\n      factoryProjectId: project.factoryProjectId,\n      workItemId: relatedItem?.id ?? null,\n      ingress: { identity: `${installationId}:${parsed.deliveryId}`, triggerType: `github.${event}` },\n      ruleSetVersion: this.options.rules.version,\n      expectedRevision: relatedItem?.revision ?? null,\n      actor: { ...actor },\n      outcome,\n      decisions,\n      causalChain: [],\n      now: new Date(),\n    });\n    return { status: committed.status };\n  }\n\n  async #relatedItem(\n    orgId: string,\n    projectId: string,\n    repositoryId: number,\n    issueNumber: number | undefined,\n    pullRequestNumber: number | undefined,\n    pullRequestHeadBranch: string | undefined,\n    provenance: FactoryPullRequestProvenanceData | null,\n  ): Promise<WorkItemRow | undefined> {\n    const items = await this.options.storage.list({ orgId, factoryProjectId: projectId });\n    if (provenance) return items.find(item => item.id === provenance.workItemId);\n    if (issueNumber) {\n      return (\n        items.find(item => item.externalSource?.externalId === canonicalSourceKey('issue', issueNumber)) ??\n        items.find(item => item.externalSource?.externalId === legacySourceKey(repositoryId, 'issue', issueNumber))\n      );\n    }\n    if (pullRequestNumber) {\n      return (\n        items.find(item => item.externalSource?.externalId === canonicalSourceKey('pull-request', pullRequestNumber)) ??\n        items.find(\n          item => item.externalSource?.externalId === legacySourceKey(repositoryId, 'pull-request', pullRequestNumber),\n        ) ??\n        // Provenance fallback: a PR pushed from a work item's session branch\n        // belongs to that item even when no gh-pr-create provenance was\n        // recorded (session predating state seeding, or the PR was opened\n        // outside the tracked tool call). Session branches are per-item\n        // (`factory/issue-N`), so a head-branch match is unambiguous.\n        (pullRequestHeadBranch\n          ? items.find(\n              item =>\n                item.externalSource?.type !== 'pull-request' &&\n                Object.values(item.sessions).some(session => session.branch === pullRequestHeadBranch),\n            )\n          : undefined)\n      );\n    }\n    return undefined;\n  }\n}\n\nexport function attachGithubRules(\n  github: GithubRulesIntegration,\n  context: IntegrationContext,\n): ((event: ParsedGithubWebhook) => Promise<unknown>) | undefined {\n  if (!context.rules) return undefined;\n  const rules = new GithubRules({\n    github,\n    sourceControl: context.storage.sourceControl,\n    integrationStorage: context.storage.generic,\n    projects: context.storage.projects,\n    storage: context.rules.workItems,\n    rules: context.rules.config,\n  });\n  return event => rules.ingest(event);\n}\n"],"mappings":";;;AAoBA,MAAM,sCAAsB,IAAI,IAAI,CAAC,SAAS,OAAO,CAAC;AACtD,MAAM,kBAAkB;AAExB,eAAe,gBAAmB,SAAiC;CACjE,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,SACA,IAAI,SAAgB,GAAG,WAAW;GAChC,UAAU,iBAAiB,uBAAO,IAAI,MAAM,sBAAsB,CAAC,GAAG,eAAe;EACvF,CAAC,CACH,CAAC;CACH,UAAU;EACR,IAAI,SAAS,aAAa,OAAO;CACnC;AACF;AAEA,SAAS,OAAO,OAAqD;CACnE,OAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAK,QAAoC,KAAA;AAC5G;AAEA,SAAS,OAAO,OAAoC;CAClD,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ,KAAA;AACjE;AAEA,SAAS,OAAO,OAAoC;CAClD,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,QAAQ,KAAA;AACvE;AAEA,SAAS,QAAQ,OAAqC;CACpD,OAAO,OAAO,UAAU,YAAY,QAAQ,KAAA;AAC9C;AAEA,SAAS,UAAU,QAAiE;CAClF,MAAM,SAAS,OAAO,OAAO,QAAQ,MAAM;CAC3C,IAAI,OAAO,UAAU,YAAY,WAAW,UAAU,OAAO;CAC7D,IAAI,OAAO,UAAU,kBAAkB,WAAW,UAAU,OAAO;CACnE,IAAI,OAAO,UAAU,kBAAkB,WAAW,eAAe,OAAO;CACxE,IAAI,OAAO,UAAU,kBAAkB,WAAW,YAAY,QAAQ,OAAO,OAAO,QAAQ,YAAY,CAAC,EAAE,MAAM,GAC/G,OAAO;CAET,IAAI,OAAO,UAAU,kBAAkB,WAAW,oBAAoB,OAAO;AAE/E;AAEA,SAAS,mBAAmB,MAAgC,YAA4B;CACtF,OAAO,SAAS,UAAU,gBAAgB,eAAe,aAAa;AACxE;AAEA,SAAS,gBAAgB,cAAsB,MAAgC,YAA4B;CACzG,OAAO,UAAU,aAAa,GAAG,KAAK,GAAG;AAC3C;AAEA,SAAS,iBAAiB,cAAsB,mBAAmC;CACjF,OAAO,yBAAyB,aAAa,GAAG;AAClD;AAEA,SAAS,eAAe,MAAmB;CACzC,IAAI,CAAC,KAAK,gBAAgB,OAAO;CACjC,OAAO,KAAK,eAAe,SAAS,iBAAkB,cAAyB;AACjF;AAEA,SAAS,kBAAkB,MAAkC;CAC3D,OAAO,KAAK,gBAAgB,cAAc;AAC5C;AAEA,eAAe,YACb,QACA,OAC2B;CAC3B,IAAI,UAAU;CACd,IAAI;EACF,MAAM,aAAa,MAAM,OAAO,oCAC9B,MAAM,gBACN,MAAM,YACN,MAAM,KACR;EACA,UAAU,eAAe,KAAA,KAAa,oBAAoB,IAAI,UAAU;CAC1E,QAAQ;EACN,UAAU;CACZ;CACA,OAAO;EAAE,MAAM;EAAU,OAAO,MAAM;EAAO;EAAS,iBAAiB,MAAM;CAAgB;AAC/F;AAOA,SAAS,sBAAsB,MAAoF;CACjH,IAAI,CAAC,QAAQ,KAAK,SAAS,2BAA2B,OAAO,KAAK,eAAe,UAAU,OAAO;CAClG,OAAO;EAAE,MAAM;EAAyB,YAAY,KAAK;CAAW;AACtE;AAoBA,IAAa,cAAb,MAAyB;CACM;CAA7B,YAAY,SAA8C;EAA7B,KAAA,UAAA;CAA8B;CAE3D,MAAM,OAAO,QAAoG;EAC/G,MAAM,QAAQ,UAAU,MAAM;EAC9B,MAAM,aAAa,OAAO,OAAO,QAAQ,UAAU;EACnD,MAAM,iBAAiB,OAAO,OAAO,OAAO,QAAQ,YAAY,CAAC,EAAE,EAAE;EACrE,MAAM,eAAe,OAAO,YAAY,EAAE;EAC1C,MAAM,iBAAiB,OAAO,YAAY,SAAS;EACnD,MAAM,QAAQ,OAAO,OAAO,OAAO,QAAQ,MAAM,CAAC,EAAE,KAAK;EACzD,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,OAAO,OAAO,EAAE,QAAQ,UAAU;EAExG,MAAM,WAAW,MAAM,KAAK,QAAQ,cAAc,oBAAoB,yBAAyB;GAC7F,wBAAwB,OAAO,cAAc;GAC7C,sBAAsB,OAAO,YAAY;EAC3C,CAAC;EACD,IAAI,SAAS,WAAW,GAAG,OAAO,EAAE,QAAQ,UAAU;EACtD,MAAM,UAAU,CAAC;EACjB,KAAK,MAAM,WAAW,UACpB,QAAQ,KACN,MAAM,KAAKA,eAAe,QAAQ,OAAO,gBAAgB,cAAc,gBAAgB,OAAO,OAAO,CACvG;EAEF,IAAI,QAAQ,MAAK,WAAU,OAAO,WAAW,WAAW,GAAG,OAAO,EAAE,QAAQ,YAAY;EACxF,IAAI,QAAQ,MAAK,WAAU,OAAO,WAAW,UAAU,GAAG,OAAO,EAAE,QAAQ,WAAW;EACtF,OAAO,QAAQ,MAAM,EAAE,QAAQ,UAAU;CAC3C;CAEA,MAAMA,eACJ,QACA,OACA,gBACA,cACA,gBACA,OACA,SAC2D;EAC3D,MAAM,iBAAiB,MAAM,KAAK,QAAQ,SAAS,IAAI;GACrD,OAAO,QAAQ;GACf,IAAI,QAAQ;EACd,CAAC;EACD,IAAI,CAAC,gBAAgB,OAAO,EAAE,QAAQ,UAAU;EAChD,MAAM,QAAQ,OAAO,OAAO,QAAQ,KAAK;EACzC,MAAM,cAAc,OAAO,OAAO,QAAQ,YAAY;EACtD,MAAM,cAAc,OAAO,OAAO,MAAM;EACxC,MAAM,oBAAoB,OAAO,aAAa,MAAM;EACpD,MAAM,aAAa,oBACf,uBAEI,MAAM,KAAK,QAAQ,mBAAmB,cAAc,aAClD,iBAAiB,cAAc,iBAAiB,GAChD,EAAE,QAAQ,SAAS,CACrB,EAAA,CACA,MAAK,iBAAgB,aAAa,UAAU,QAAQ,KAAK,CAAC,EAAE,IAChE,IACA;EACJ,MAAM,cAAc,MAAM,KAAKC,aAC7B,QAAQ,OACR,QAAQ,kBACR,cACA,aACA,mBACA,OAAO,OAAO,aAAa,IAAI,CAAC,EAAE,GAAG,GACrC,UACF;EACA,MAAM,QAAQ,MAAM,YAAY,KAAK,QAAQ,QAAQ;GACnD;GACA,YAAY;GACZ;GACA,iBAAiB,eAAe;EAClC,CAAC;EACD,MAAM,UAAoC;GACxC,QAAQ;IAAE,OAAO,QAAQ;IAAO,WAAW,QAAQ;GAAiB;GACpE;GACA,SAAS;IAAE,MAAM;IAAU,IAAI,GAAG,eAAe,GAAG,OAAO;GAAa;GACxE,OAAO,UAAU;GACjB,aAAa,CAAC;GACd,gBAAgB,KAAK,QAAQ,MAAM;GACnC,GAAI,cACA;IACE,MAAM;KACJ,IAAI,YAAY;KAChB,QAAQ,eAAe,WAAW;KAClC,WAAW,kBAAkB,WAAW;KACxC,kBAAkB,YAAY;KAC9B,OAAO,YAAY;KACnB,KAAK,YAAY,gBAAgB,OAAO;KACxC,QAAQ,YAAY;IACtB;IACA,OAAO,YAAY,gBAAgB,SAAS,iBAAkB,WAAsB;IACpF,cAAc,YAAY;GAC5B,IACA,CAAC;GACL;GACA,YAAY,OAAO;GACnB,SAAS,EAAE,WAAW,eAAe,UAAU,YAAY,EAAE;GAC7D,YAAY;IAAE,IAAI;IAAc,UAAU;GAAe;GACzD,GAAI,eAAe,OAAO,OAAO,KAAK,KAAK,OAAO,OAAO,QAAQ,IAC7D,EACE,OAAO;IACL,QAAQ;IACR,OAAO,OAAO,OAAO,KAAK;IAC1B,KAAK,OAAO,OAAO,QAAQ;IAC3B,GAAI,OAAO,OAAO,UAAU,IAAI,EAAE,WAAW,OAAO,OAAO,UAAU,EAAE,IAAI,CAAC;GAC9E,EACF,IACA,CAAC;GACL,GAAI,qBAAqB,OAAO,aAAa,KAAK,KAAK,OAAO,aAAa,QAAQ,IAC/E,EACE,aAAa;IACX,QAAQ;IACR,OAAO,OAAO,aAAa,KAAK;IAChC,KAAK,OAAO,aAAa,QAAQ;IACjC,GAAI,OAAO,aAAa,UAAU,IAAI,EAAE,WAAW,OAAO,aAAa,UAAU,EAAE,IAAI,CAAC;IACxF,OAAO,OAAO,aAAa,KAAK,MAAM,WAAY,WAAsB;IACxE,QAAQ,QAAQ,aAAa,MAAM,KAAK;IACxC,YAAY,OAAO,OAAO,aAAa,IAAI,CAAC,EAAE,GAAG,KAAK;IACtD,YAAY,OAAO,OAAO,aAAa,IAAI,CAAC,EAAE,GAAG,KAAK;GACxD,EACF,IACA,CAAC;GACL,GAAI,OAAO,OAAO,QAAQ,MAAM,IAC5B,EACE,QAAQ;IACN,IAAI,OAAO,OAAO,OAAO,QAAQ,MAAM,CAAC,EAAE,EAAE,KAAK;IACjD,OAAO,OAAO,OAAO,OAAO,QAAQ,MAAM,CAAC,EAAE,KAAK,KAAK;IACvD,KAAK,OAAO,OAAO,OAAO,QAAQ,MAAM,CAAC,EAAE,QAAQ,KAAK;GAC1D,EACF,IACA,CAAC;EACP;EAEA,MAAM,OAAO,yBAAyB,KAAK,QAAQ,OAAO,KAAK;EAC/D,IAAI;EACJ,IAAI,YAAuC,CAAC;EAC5C,IAAI,UAA+E,EAAE,QAAQ,WAAW;EACxG,IAAI;GACF,WAAW,OAAO,MAAM,gBAAgB,QAAQ,QAAQ,KAAK,OAAO,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,KAAA;GACzF,IAAI,UAAU,SAAS,UACrB,UAAU;IAAE,QAAQ;IAAY,MAAM,SAAS;IAAM,QAAQ,SAAS;GAAO;QACxE,IAAI,UACT,YAAY,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAI,WAAU,EAAE,GAAG,MAAM,EAAE;EAEpF,SAAS,OAAO;GACd,MAAM,WAAW,iBAAiB,SAAS,MAAM,YAAY;GAC7D,UAAU;IACR,QAAQ;IACR,MAAM,WAAW,YAAY;IAC7B,QAAQ,WACJ,uCACA,iBAAiB,QACf,MAAM,QAAQ,MAAM,GAAG,GAAK,IAC5B;GACR;EACF;EAeA,OAAO,EAAE,SAAQ,MAbO,KAAK,QAAQ,QAAQ,qBAAqB;GAChE,OAAO,QAAQ;GACf,kBAAkB,QAAQ;GAC1B,YAAY,aAAa,MAAM;GAC/B,SAAS;IAAE,UAAU,GAAG,eAAe,GAAG,OAAO;IAAc,aAAa,UAAU;GAAQ;GAC9F,gBAAgB,KAAK,QAAQ,MAAM;GACnC,kBAAkB,aAAa,YAAY;GAC3C,OAAO,EAAE,GAAG,MAAM;GAClB;GACA;GACA,aAAa,CAAC;GACd,qBAAK,IAAI,KAAK;EAChB,CAAC,EAAA,CAC0B,OAAO;CACpC;CAEA,MAAMA,aACJ,OACA,WACA,cACA,aACA,mBACA,uBACA,YACkC;EAClC,MAAM,QAAQ,MAAM,KAAK,QAAQ,QAAQ,KAAK;GAAE;GAAO,kBAAkB;EAAU,CAAC;EACpF,IAAI,YAAY,OAAO,MAAM,MAAK,SAAQ,KAAK,OAAO,WAAW,UAAU;EAC3E,IAAI,aACF,OACE,MAAM,MAAK,SAAQ,KAAK,gBAAgB,eAAe,mBAAmB,SAAS,WAAW,CAAC,KAC/F,MAAM,MAAK,SAAQ,KAAK,gBAAgB,eAAe,gBAAgB,cAAc,SAAS,WAAW,CAAC;EAG9G,IAAI,mBACF,OACE,MAAM,MAAK,SAAQ,KAAK,gBAAgB,eAAe,mBAAmB,gBAAgB,iBAAiB,CAAC,KAC5G,MAAM,MACJ,SAAQ,KAAK,gBAAgB,eAAe,gBAAgB,cAAc,gBAAgB,iBAAiB,CAC7G,MAMC,wBACG,MAAM,MACJ,SACE,KAAK,gBAAgB,SAAS,kBAC9B,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,MAAK,YAAW,QAAQ,WAAW,qBAAqB,CACzF,IACA,KAAA;CAIV;AACF;AAEA,SAAgB,kBACd,QACA,SACgE;CAChE,IAAI,CAAC,QAAQ,OAAO,OAAO,KAAA;CAC3B,MAAM,QAAQ,IAAI,YAAY;EAC5B;EACA,eAAe,QAAQ,QAAQ;EAC/B,oBAAoB,QAAQ,QAAQ;EACpC,UAAU,QAAQ,QAAQ;EAC1B,SAAS,QAAQ,MAAM;EACvB,OAAO,QAAQ,MAAM;CACvB,CAAC;CACD,QAAO,UAAS,MAAM,OAAO,KAAK;AACpC"}
+{"version":3,"file":"rules.js","names":["#ingestProject","#relatedItem"],"sources":["../../../src/integrations/github/rules.ts"],"sourcesContent":["import { resolveFactoryGithubRule } from '../../rules/resolve.js';\nimport type {\n  FactoryGithubEventName,\n  FactoryGithubRuleContext,\n  FactoryRuleActor,\n  FactoryRuleDecision,\n  FactoryRules,\n} from '../../rules/types.js';\nimport { validateFactoryRuleDecisions } from '../../rules/validation.js';\nimport type { IntegrationStorageHandle } from '../../storage/domains/integrations/base.js';\nimport type { FactoryProjectsStorage } from '../../storage/domains/projects/base.js';\nimport type {\n  ExternalRepositoryProjectTarget,\n  SourceControlStorageHandle,\n} from '../../storage/domains/source-control/base.js';\nimport type { WorkItemRow, WorkItemsStorage } from '../../storage/domains/work-items/base.js';\nimport type { IntegrationContext } from '../base.js';\nimport type { GithubRepositoryPermission } from './integration.js';\nimport type { ParsedGithubWebhook } from './webhook.js';\n\nconst TRUSTED_PERMISSIONS = new Set(['write', 'admin']);\nconst RULE_TIMEOUT_MS = 5_000;\n\nasync function withRuleTimeout<T>(promise: Promise<T>): Promise<T> {\n  let timeout: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      promise,\n      new Promise<never>((_, reject) => {\n        timeout = setTimeout(() => reject(new Error('FACTORY_RULE_TIMEOUT')), RULE_TIMEOUT_MS);\n      }),\n    ]);\n  } finally {\n    if (timeout) clearTimeout(timeout);\n  }\n}\n\nfunction object(value: unknown): Record<string, unknown> | undefined {\n  return value && typeof value === 'object' && !Array.isArray(value) ? (value as Record<string, unknown>) : undefined;\n}\n\nfunction string(value: unknown): string | undefined {\n  return typeof value === 'string' && value.length > 0 ? value : undefined;\n}\n\nfunction number(value: unknown): number | undefined {\n  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;\n}\n\nfunction boolean(value: unknown): boolean | undefined {\n  return typeof value === 'boolean' ? value : undefined;\n}\n\nfunction eventName(parsed: ParsedGithubWebhook): FactoryGithubEventName | undefined {\n  const action = string(parsed.payload.action);\n  if (parsed.event === 'issues' && action === 'opened') return 'issueOpened';\n  if (parsed.event === 'pull_request' && action === 'opened') return 'pullRequestOpened';\n  if (parsed.event === 'pull_request' && action === 'synchronize') return 'pullRequestUpdated';\n  if (parsed.event === 'pull_request' && action === 'closed') {\n    return boolean(object(parsed.payload.pull_request)?.merged) ? 'pullRequestMerged' : 'pullRequestClosed';\n  }\n  if (parsed.event === 'pull_request' && action === 'review_requested') return 'pullRequestReviewRequested';\n  return undefined;\n}\n\nfunction canonicalSourceKey(kind: 'issue' | 'pull-request', itemNumber: number): string {\n  return kind === 'issue' ? `github-issue:${itemNumber}` : `github-pr:${itemNumber}`;\n}\n\nfunction legacySourceKey(repositoryId: number, kind: 'issue' | 'pull-request', itemNumber: number): string {\n  return `github:${repositoryId}:${kind}:${itemNumber}`;\n}\n\nfunction provenanceTarget(repositoryId: number, pullRequestNumber: number): string {\n  return `factory-pr-provenance:${repositoryId}:${pullRequestNumber}`;\n}\n\nfunction workItemSource(item: WorkItemRow) {\n  if (!item.externalSource) return 'manual' as const;\n  return item.externalSource.type === 'pull-request' ? ('github-pr' as const) : ('github-issue' as const);\n}\n\nfunction workItemSourceKey(item: WorkItemRow): string | null {\n  return item.externalSource?.externalId ?? null;\n}\n\nasync function githubActor(\n  github: GithubRulesIntegration,\n  input: { installationId: number; repository: string; login: string; factoryAuthored: boolean },\n): Promise<FactoryRuleActor> {\n  let trusted = false;\n  try {\n    const permission = await github.getRepositoryCollaboratorPermission(\n      input.installationId,\n      input.repository,\n      input.login,\n    );\n    trusted = permission !== undefined && TRUSTED_PERMISSIONS.has(permission);\n  } catch {\n    trusted = false;\n  }\n  return { type: 'github', login: input.login, trusted, factoryAuthored: input.factoryAuthored };\n}\n\ninterface FactoryPullRequestProvenanceData {\n  kind: 'factory-pr-provenance';\n  workItemId: string;\n}\n\nfunction pullRequestProvenance(data: Record<string, unknown> | undefined): FactoryPullRequestProvenanceData | null {\n  if (!data || data.kind !== 'factory-pr-provenance' || typeof data.workItemId !== 'string') return null;\n  return { kind: 'factory-pr-provenance', workItemId: data.workItemId };\n}\n\nexport interface GithubRulesIntegration {\n  getRepositoryCollaboratorPermission(\n    installationId: number,\n    repoFullName: string,\n    username: string,\n  ): Promise<GithubRepositoryPermission | undefined>;\n}\n\nexport interface GithubRulesOptions {\n  github: GithubRulesIntegration;\n  sourceControl: SourceControlStorageHandle;\n  /** Integration-scoped storage; provenance rows are validated at read. */\n  integrationStorage: IntegrationStorageHandle;\n  projects: FactoryProjectsStorage;\n  storage: WorkItemsStorage;\n  rules: FactoryRules;\n}\n\nexport class GithubRules {\n  constructor(private readonly options: GithubRulesOptions) {}\n\n  async ingest(parsed: ParsedGithubWebhook): Promise<{ status: 'ignored' | 'committed' | 'replayed' | 'missing' }> {\n    const event = eventName(parsed);\n    const repository = object(parsed.payload.repository);\n    const installationId = number(object(parsed.payload.installation)?.id);\n    const repositoryId = number(repository?.id);\n    const repositoryName = string(repository?.full_name);\n    const login = string(object(parsed.payload.sender)?.login);\n    if (!event || !installationId || !repositoryId || !repositoryName || !login) return { status: 'ignored' };\n\n    const projects = await this.options.sourceControl.projectRepositories.listByExternalRepository({\n      installationExternalId: String(installationId),\n      repositoryExternalId: String(repositoryId),\n    });\n    if (projects.length === 0) return { status: 'ignored' };\n    const results = [];\n    for (const project of projects) {\n      results.push(\n        await this.#ingestProject(parsed, event, installationId, repositoryId, repositoryName, login, project),\n      );\n    }\n    if (results.some(result => result.status === 'committed')) return { status: 'committed' };\n    if (results.some(result => result.status === 'replayed')) return { status: 'replayed' };\n    return results[0] ?? { status: 'ignored' };\n  }\n\n  async #ingestProject(\n    parsed: ParsedGithubWebhook,\n    event: FactoryGithubEventName,\n    installationId: number,\n    repositoryId: number,\n    repositoryName: string,\n    login: string,\n    project: ExternalRepositoryProjectTarget,\n  ): Promise<{ status: 'committed' | 'replayed' | 'missing' }> {\n    const factoryProject = await this.options.projects.get({\n      orgId: project.orgId,\n      id: project.factoryProjectId,\n    });\n    if (!factoryProject) return { status: 'missing' };\n    const issue = object(parsed.payload.issue);\n    const pullRequest = object(parsed.payload.pull_request);\n    const issueNumber = number(issue?.number);\n    const pullRequestNumber = number(pullRequest?.number);\n    const provenance = pullRequestNumber\n      ? pullRequestProvenance(\n          (\n            await this.options.integrationStorage.subscriptions.listByTarget(\n              provenanceTarget(repositoryId, pullRequestNumber),\n              { status: 'active' },\n            )\n          ).find(subscription => subscription.orgId === project.orgId)?.data,\n        )\n      : null;\n    const relatedItem = await this.#relatedItem(\n      project.orgId,\n      project.factoryProjectId,\n      repositoryId,\n      issueNumber,\n      pullRequestNumber,\n      string(object(pullRequest?.head)?.ref),\n      provenance,\n    );\n    const actor = await githubActor(this.options.github, {\n      installationId,\n      repository: repositoryName,\n      login,\n      factoryAuthored: provenance !== null,\n    });\n    const context: FactoryGithubRuleContext = {\n      tenant: { orgId: project.orgId, projectId: project.factoryProjectId },\n      actor,\n      ingress: { type: 'github', id: `${installationId}:${parsed.deliveryId}` },\n      cause: `github.${event}`,\n      causalChain: [],\n      ruleSetVersion: this.options.rules.version,\n      ...(relatedItem\n        ? {\n            item: {\n              id: relatedItem.id,\n              source: workItemSource(relatedItem),\n              sourceKey: workItemSourceKey(relatedItem),\n              parentWorkItemId: relatedItem.parentWorkItemId,\n              title: relatedItem.title,\n              url: relatedItem.externalSource?.url ?? null,\n              stages: relatedItem.stages,\n            },\n            board: relatedItem.externalSource?.type === 'pull-request' ? ('review' as const) : ('work' as const),\n            itemRevision: relatedItem.revision,\n          }\n        : {}),\n      event,\n      deliveryId: parsed.deliveryId,\n      factory: { createdAt: factoryProject.createdAt.toISOString() },\n      repository: { id: repositoryId, fullName: repositoryName },\n      ...(issueNumber && string(issue?.title) && string(issue?.html_url)\n        ? {\n            issue: {\n              number: issueNumber,\n              title: string(issue?.title)!,\n              url: string(issue?.html_url)!,\n              ...(string(issue?.created_at) ? { createdAt: string(issue?.created_at) } : {}),\n            },\n          }\n        : {}),\n      ...(pullRequestNumber && string(pullRequest?.title) && string(pullRequest?.html_url)\n        ? {\n            pullRequest: {\n              number: pullRequestNumber,\n              title: string(pullRequest?.title)!,\n              url: string(pullRequest?.html_url)!,\n              ...(string(pullRequest?.created_at) ? { createdAt: string(pullRequest?.created_at) } : {}),\n              state: string(pullRequest?.state) === 'closed' ? ('closed' as const) : ('open' as const),\n              merged: boolean(pullRequest?.merged) ?? false,\n              headBranch: string(object(pullRequest?.head)?.ref) ?? '',\n              baseBranch: string(object(pullRequest?.base)?.ref) ?? '',\n            },\n          }\n        : {}),\n      ...(object(parsed.payload.review)\n        ? {\n            review: {\n              id: number(object(parsed.payload.review)?.id) ?? 0,\n              state: string(object(parsed.payload.review)?.state) ?? 'unknown',\n              url: string(object(parsed.payload.review)?.html_url) ?? '',\n            },\n          }\n        : {}),\n    };\n\n    const rule = resolveFactoryGithubRule(this.options.rules, event);\n    let decision: FactoryRuleDecision | void;\n    let decisions: Record<string, unknown>[] = [];\n    let outcome: { status: 'accepted' | 'rejected'; code?: string; reason?: string } = { status: 'accepted' };\n    try {\n      decision = rule ? await withRuleTimeout(Promise.resolve(rule(Object.freeze(context)))) : undefined;\n      if (decision?.type === 'reject') {\n        outcome = { status: 'rejected', code: decision.code, reason: decision.reason };\n      } else if (decision) {\n        decisions = validateFactoryRuleDecisions([decision]).map(entry => ({ ...entry }));\n      }\n    } catch (error) {\n      const timedOut = error instanceof Error && error.message === 'FACTORY_RULE_TIMEOUT';\n      outcome = {\n        status: 'rejected',\n        code: timedOut ? 'timeout' : 'rule_error',\n        reason: timedOut\n          ? 'Factory rule evaluation timed out.'\n          : error instanceof Error\n            ? error.message.slice(0, 2_000)\n            : 'Factory GitHub rule failed.',\n      };\n    }\n\n    const committed = await this.options.storage.commitRuleEvaluation({\n      orgId: project.orgId,\n      factoryProjectId: project.factoryProjectId,\n      workItemId: relatedItem?.id ?? null,\n      ingress: { identity: `${installationId}:${parsed.deliveryId}`, triggerType: `github.${event}` },\n      ruleSetVersion: this.options.rules.version,\n      expectedRevision: relatedItem?.revision ?? null,\n      actor: { ...actor },\n      outcome,\n      decisions,\n      causalChain: [],\n      now: new Date(),\n    });\n    return { status: committed.status };\n  }\n\n  async #relatedItem(\n    orgId: string,\n    projectId: string,\n    repositoryId: number,\n    issueNumber: number | undefined,\n    pullRequestNumber: number | undefined,\n    pullRequestHeadBranch: string | undefined,\n    provenance: FactoryPullRequestProvenanceData | null,\n  ): Promise<WorkItemRow | undefined> {\n    const items = await this.options.storage.list({ orgId, factoryProjectId: projectId });\n    if (provenance) return items.find(item => item.id === provenance.workItemId);\n    if (issueNumber) {\n      return (\n        items.find(item => item.externalSource?.externalId === canonicalSourceKey('issue', issueNumber)) ??\n        items.find(item => item.externalSource?.externalId === legacySourceKey(repositoryId, 'issue', issueNumber))\n      );\n    }\n    if (pullRequestNumber) {\n      return (\n        items.find(item => item.externalSource?.externalId === canonicalSourceKey('pull-request', pullRequestNumber)) ??\n        items.find(\n          item => item.externalSource?.externalId === legacySourceKey(repositoryId, 'pull-request', pullRequestNumber),\n        ) ??\n        // Provenance fallback: a PR pushed from a work item's session branch\n        // belongs to that item even when no gh-pr-create provenance was\n        // recorded (session predating state seeding, or the PR was opened\n        // outside the tracked tool call). Session branches are per-item\n        // (`factory/issue-N`), so a head-branch match is unambiguous.\n        (pullRequestHeadBranch\n          ? items.find(\n              item =>\n                item.externalSource?.type !== 'pull-request' &&\n                Object.values(item.sessions).some(session => session.branch === pullRequestHeadBranch),\n            )\n          : undefined)\n      );\n    }\n    return undefined;\n  }\n}\n\nexport interface ReconcilePullRequestState {\n  title: string;\n  url: string;\n  state: 'open' | 'closed';\n  merged: boolean;\n  headBranch: string;\n  baseBranch: string;\n  createdAt?: string;\n  mergedBy?: string;\n}\n\nexport type GithubPullRequestFetcher = (input: {\n  installationId: number;\n  repository: string;\n  number: number;\n}) => Promise<ReconcilePullRequestState | undefined>;\n\nexport interface ReconcileRepository {\n  id: number;\n  fullName: string;\n  installationId: number;\n}\n\nexport interface ReconcileSweepSummary {\n  /** Factory-configured repositories included in the sweep. */\n  repositories: number;\n  /** PRs whose live state was fetched from GitHub. */\n  checked: number;\n  /** Missed merges replayed through the rules ingress. */\n  merged: number;\n  /** Missed closes-without-merge replayed through the rules ingress. */\n  closed: number;\n  /** PRs (or whole repositories) skipped because of an error. */\n  failed: number;\n  /** Error samples with context, capped at {@link RECONCILE_ERROR_SAMPLE_LIMIT}. */\n  errors: Array<{ repository: string; pullRequestNumber?: number; error: string }>;\n}\n\nexport type GithubPullRequestReconciler = (repositories: ReconcileRepository[]) => Promise<ReconcileSweepSummary>;\n\nconst RECONCILE_ERROR_SAMPLE_LIMIT = 5;\n\n/**\n * Extracts the PR number a work item tracks, but only when the item belongs\n * to the given repository. Card URLs pin the repository unambiguously; the\n * legacy source key embeds the repository id. Canonical keys (`github-pr:N`)\n * carry no repository, so they are only trusted when the item has no URL —\n * a project mapped to multiple repositories must not reconcile one repo's\n * card against another repo's PR number.\n */\nfunction reconcilablePullRequestNumber(item: WorkItemRow, repository: ReconcileRepository): number | undefined {\n  if (item.externalSource?.type !== 'pull-request') return undefined;\n  const url = item.externalSource.url;\n  if (url) {\n    const match = /^https?:\\/\\/[^/]+\\/(.+)\\/pull\\/(\\d+)(?:[/?#]|$)/.exec(url);\n    if (!match) return undefined;\n    return match[1] === repository.fullName ? Number(match[2]) : undefined;\n  }\n  const externalId = item.externalSource.externalId;\n  const legacy = /^github:(\\d+):pull-request:(\\d+)$/.exec(externalId);\n  if (legacy) return Number(legacy[1]) === repository.id ? Number(legacy[2]) : undefined;\n  const canonical = /^github-pr:(\\d+)$/.exec(externalId);\n  return canonical ? Number(canonical[1]) : undefined;\n}\n\nexport function reconciledClosedEvent(\n  repository: ReconcileRepository,\n  pullRequestNumber: number,\n  state: ReconcilePullRequestState,\n): ParsedGithubWebhook {\n  return {\n    event: 'pull_request',\n    // Stable per (repository, PR, outcome): the ingress dedupe makes repeat\n    // reconcile cycles replay instead of re-committing decisions.\n    deliveryId: `reconcile:${repository.id}:pull-request:${pullRequestNumber}:${state.merged ? 'merged' : 'closed'}`,\n    payload: {\n      action: 'closed',\n      installation: { id: repository.installationId },\n      repository: { id: repository.id, full_name: repository.fullName },\n      sender: { login: state.mergedBy ?? 'github' },\n      pull_request: {\n        number: pullRequestNumber,\n        title: state.title,\n        html_url: state.url,\n        ...(state.createdAt ? { created_at: state.createdAt } : {}),\n        state: 'closed',\n        merged: state.merged,\n        head: { ref: state.headBranch },\n        base: { ref: state.baseBranch },\n      },\n    },\n  };\n}\n\n/**\n * State-based safety net for merge signals: webhooks and event-log tailing\n * can miss a merge (cursor gaps, downtime, terminally failed decisions), so\n * this sweep compares still-open PR cards against actual GitHub state and\n * replays the merge through the normal rules ingress when they disagree.\n */\nexport function createGithubPullRequestReconciler(\n  options: GithubRulesOptions,\n  fetchPullRequest: GithubPullRequestFetcher,\n): GithubPullRequestReconciler {\n  const rules = new GithubRules(options);\n  return async repositories => {\n    const summary: ReconcileSweepSummary = { repositories: 0, checked: 0, merged: 0, closed: 0, failed: 0, errors: [] };\n    const recordFailure = (repository: ReconcileRepository, error: unknown, pullRequestNumber?: number) => {\n      summary.failed += 1;\n      if (summary.errors.length < RECONCILE_ERROR_SAMPLE_LIMIT) {\n        summary.errors.push({\n          repository: repository.fullName,\n          ...(pullRequestNumber === undefined ? {} : { pullRequestNumber }),\n          error: error instanceof Error ? error.message : String(error),\n        });\n      }\n    };\n    // An installation can expose hundreds of repositories; only the ones\n    // actually linked to a factory project can have cards to reconcile, so\n    // scope the sweep to those up front instead of probing each repository.\n    const configured = new Set(\n      (await options.sourceControl.projectRepositories.listConfiguredExternalKeys()).map(\n        key => `${key.installationExternalId}\\u0000${key.repositoryExternalId}`,\n      ),\n    );\n    const scoped = repositories.filter(repository =>\n      configured.has(`${repository.installationId}\\u0000${repository.id}`),\n    );\n    summary.repositories = scoped.length;\n    for (const repository of scoped) {\n      // One broken repository (or a failing token exchange for its\n      // installation) must not abort the sweep for the others.\n      let numbers: Set<number>;\n      try {\n        const projects = await options.sourceControl.projectRepositories.listByExternalRepository({\n          installationExternalId: String(repository.installationId),\n          repositoryExternalId: String(repository.id),\n        });\n        if (projects.length === 0) continue;\n        numbers = new Set<number>();\n        for (const project of projects) {\n          const items = await options.storage.list({\n            orgId: project.orgId,\n            factoryProjectId: project.factoryProjectId,\n          });\n          for (const item of items) {\n            const stage = item.stages[0];\n            if (stage === 'done' || stage === 'canceled') continue;\n            const pullRequestNumber = reconcilablePullRequestNumber(item, repository);\n            if (pullRequestNumber) numbers.add(pullRequestNumber);\n          }\n        }\n      } catch (error) {\n        recordFailure(repository, error);\n        continue;\n      }\n      for (const pullRequestNumber of numbers) {\n        try {\n          const state = await fetchPullRequest({\n            installationId: repository.installationId,\n            repository: repository.fullName,\n            number: pullRequestNumber,\n          });\n          summary.checked += 1;\n          if (!state || state.state !== 'closed') continue;\n          await rules.ingest(reconciledClosedEvent(repository, pullRequestNumber, state));\n          if (state.merged) summary.merged += 1;\n          else summary.closed += 1;\n        } catch (error) {\n          recordFailure(repository, error, pullRequestNumber);\n        }\n      }\n    }\n    return summary;\n  };\n}\n\nfunction githubRulesOptions(github: GithubRulesIntegration, context: IntegrationContext): GithubRulesOptions | undefined {\n  if (!context.rules) return undefined;\n  return {\n    github,\n    sourceControl: context.storage.sourceControl,\n    integrationStorage: context.storage.generic,\n    projects: context.storage.projects,\n    storage: context.rules.workItems,\n    rules: context.rules.config,\n  };\n}\n\nexport function attachGithubRules(\n  github: GithubRulesIntegration,\n  context: IntegrationContext,\n): ((event: ParsedGithubWebhook) => Promise<unknown>) | undefined {\n  const options = githubRulesOptions(github, context);\n  if (!options) return undefined;\n  const rules = new GithubRules(options);\n  return event => rules.ingest(event);\n}\n\nexport function attachGithubReconciler(\n  github: GithubRulesIntegration,\n  context: IntegrationContext,\n  fetchPullRequest: GithubPullRequestFetcher,\n): GithubPullRequestReconciler | undefined {\n  const options = githubRulesOptions(github, context);\n  if (!options) return undefined;\n  return createGithubPullRequestReconciler(options, fetchPullRequest);\n}\n"],"mappings":";;;AAoBA,MAAM,sCAAsB,IAAI,IAAI,CAAC,SAAS,OAAO,CAAC;AACtD,MAAM,kBAAkB;AAExB,eAAe,gBAAmB,SAAiC;CACjE,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,SACA,IAAI,SAAgB,GAAG,WAAW;GAChC,UAAU,iBAAiB,uBAAO,IAAI,MAAM,sBAAsB,CAAC,GAAG,eAAe;EACvF,CAAC,CACH,CAAC;CACH,UAAU;EACR,IAAI,SAAS,aAAa,OAAO;CACnC;AACF;AAEA,SAAS,OAAO,OAAqD;CACnE,OAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAK,QAAoC,KAAA;AAC5G;AAEA,SAAS,OAAO,OAAoC;CAClD,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ,KAAA;AACjE;AAEA,SAAS,OAAO,OAAoC;CAClD,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,QAAQ,KAAA;AACvE;AAEA,SAAS,QAAQ,OAAqC;CACpD,OAAO,OAAO,UAAU,YAAY,QAAQ,KAAA;AAC9C;AAEA,SAAS,UAAU,QAAiE;CAClF,MAAM,SAAS,OAAO,OAAO,QAAQ,MAAM;CAC3C,IAAI,OAAO,UAAU,YAAY,WAAW,UAAU,OAAO;CAC7D,IAAI,OAAO,UAAU,kBAAkB,WAAW,UAAU,OAAO;CACnE,IAAI,OAAO,UAAU,kBAAkB,WAAW,eAAe,OAAO;CACxE,IAAI,OAAO,UAAU,kBAAkB,WAAW,UAChD,OAAO,QAAQ,OAAO,OAAO,QAAQ,YAAY,CAAC,EAAE,MAAM,IAAI,sBAAsB;CAEtF,IAAI,OAAO,UAAU,kBAAkB,WAAW,oBAAoB,OAAO;AAE/E;AAEA,SAAS,mBAAmB,MAAgC,YAA4B;CACtF,OAAO,SAAS,UAAU,gBAAgB,eAAe,aAAa;AACxE;AAEA,SAAS,gBAAgB,cAAsB,MAAgC,YAA4B;CACzG,OAAO,UAAU,aAAa,GAAG,KAAK,GAAG;AAC3C;AAEA,SAAS,iBAAiB,cAAsB,mBAAmC;CACjF,OAAO,yBAAyB,aAAa,GAAG;AAClD;AAEA,SAAS,eAAe,MAAmB;CACzC,IAAI,CAAC,KAAK,gBAAgB,OAAO;CACjC,OAAO,KAAK,eAAe,SAAS,iBAAkB,cAAyB;AACjF;AAEA,SAAS,kBAAkB,MAAkC;CAC3D,OAAO,KAAK,gBAAgB,cAAc;AAC5C;AAEA,eAAe,YACb,QACA,OAC2B;CAC3B,IAAI,UAAU;CACd,IAAI;EACF,MAAM,aAAa,MAAM,OAAO,oCAC9B,MAAM,gBACN,MAAM,YACN,MAAM,KACR;EACA,UAAU,eAAe,KAAA,KAAa,oBAAoB,IAAI,UAAU;CAC1E,QAAQ;EACN,UAAU;CACZ;CACA,OAAO;EAAE,MAAM;EAAU,OAAO,MAAM;EAAO;EAAS,iBAAiB,MAAM;CAAgB;AAC/F;AAOA,SAAS,sBAAsB,MAAoF;CACjH,IAAI,CAAC,QAAQ,KAAK,SAAS,2BAA2B,OAAO,KAAK,eAAe,UAAU,OAAO;CAClG,OAAO;EAAE,MAAM;EAAyB,YAAY,KAAK;CAAW;AACtE;AAoBA,IAAa,cAAb,MAAyB;CACM;CAA7B,YAAY,SAA8C;EAA7B,KAAA,UAAA;CAA8B;CAE3D,MAAM,OAAO,QAAoG;EAC/G,MAAM,QAAQ,UAAU,MAAM;EAC9B,MAAM,aAAa,OAAO,OAAO,QAAQ,UAAU;EACnD,MAAM,iBAAiB,OAAO,OAAO,OAAO,QAAQ,YAAY,CAAC,EAAE,EAAE;EACrE,MAAM,eAAe,OAAO,YAAY,EAAE;EAC1C,MAAM,iBAAiB,OAAO,YAAY,SAAS;EACnD,MAAM,QAAQ,OAAO,OAAO,OAAO,QAAQ,MAAM,CAAC,EAAE,KAAK;EACzD,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,OAAO,OAAO,EAAE,QAAQ,UAAU;EAExG,MAAM,WAAW,MAAM,KAAK,QAAQ,cAAc,oBAAoB,yBAAyB;GAC7F,wBAAwB,OAAO,cAAc;GAC7C,sBAAsB,OAAO,YAAY;EAC3C,CAAC;EACD,IAAI,SAAS,WAAW,GAAG,OAAO,EAAE,QAAQ,UAAU;EACtD,MAAM,UAAU,CAAC;EACjB,KAAK,MAAM,WAAW,UACpB,QAAQ,KACN,MAAM,KAAKA,eAAe,QAAQ,OAAO,gBAAgB,cAAc,gBAAgB,OAAO,OAAO,CACvG;EAEF,IAAI,QAAQ,MAAK,WAAU,OAAO,WAAW,WAAW,GAAG,OAAO,EAAE,QAAQ,YAAY;EACxF,IAAI,QAAQ,MAAK,WAAU,OAAO,WAAW,UAAU,GAAG,OAAO,EAAE,QAAQ,WAAW;EACtF,OAAO,QAAQ,MAAM,EAAE,QAAQ,UAAU;CAC3C;CAEA,MAAMA,eACJ,QACA,OACA,gBACA,cACA,gBACA,OACA,SAC2D;EAC3D,MAAM,iBAAiB,MAAM,KAAK,QAAQ,SAAS,IAAI;GACrD,OAAO,QAAQ;GACf,IAAI,QAAQ;EACd,CAAC;EACD,IAAI,CAAC,gBAAgB,OAAO,EAAE,QAAQ,UAAU;EAChD,MAAM,QAAQ,OAAO,OAAO,QAAQ,KAAK;EACzC,MAAM,cAAc,OAAO,OAAO,QAAQ,YAAY;EACtD,MAAM,cAAc,OAAO,OAAO,MAAM;EACxC,MAAM,oBAAoB,OAAO,aAAa,MAAM;EACpD,MAAM,aAAa,oBACf,uBAEI,MAAM,KAAK,QAAQ,mBAAmB,cAAc,aAClD,iBAAiB,cAAc,iBAAiB,GAChD,EAAE,QAAQ,SAAS,CACrB,EAAA,CACA,MAAK,iBAAgB,aAAa,UAAU,QAAQ,KAAK,CAAC,EAAE,IAChE,IACA;EACJ,MAAM,cAAc,MAAM,KAAKC,aAC7B,QAAQ,OACR,QAAQ,kBACR,cACA,aACA,mBACA,OAAO,OAAO,aAAa,IAAI,CAAC,EAAE,GAAG,GACrC,UACF;EACA,MAAM,QAAQ,MAAM,YAAY,KAAK,QAAQ,QAAQ;GACnD;GACA,YAAY;GACZ;GACA,iBAAiB,eAAe;EAClC,CAAC;EACD,MAAM,UAAoC;GACxC,QAAQ;IAAE,OAAO,QAAQ;IAAO,WAAW,QAAQ;GAAiB;GACpE;GACA,SAAS;IAAE,MAAM;IAAU,IAAI,GAAG,eAAe,GAAG,OAAO;GAAa;GACxE,OAAO,UAAU;GACjB,aAAa,CAAC;GACd,gBAAgB,KAAK,QAAQ,MAAM;GACnC,GAAI,cACA;IACE,MAAM;KACJ,IAAI,YAAY;KAChB,QAAQ,eAAe,WAAW;KAClC,WAAW,kBAAkB,WAAW;KACxC,kBAAkB,YAAY;KAC9B,OAAO,YAAY;KACnB,KAAK,YAAY,gBAAgB,OAAO;KACxC,QAAQ,YAAY;IACtB;IACA,OAAO,YAAY,gBAAgB,SAAS,iBAAkB,WAAsB;IACpF,cAAc,YAAY;GAC5B,IACA,CAAC;GACL;GACA,YAAY,OAAO;GACnB,SAAS,EAAE,WAAW,eAAe,UAAU,YAAY,EAAE;GAC7D,YAAY;IAAE,IAAI;IAAc,UAAU;GAAe;GACzD,GAAI,eAAe,OAAO,OAAO,KAAK,KAAK,OAAO,OAAO,QAAQ,IAC7D,EACE,OAAO;IACL,QAAQ;IACR,OAAO,OAAO,OAAO,KAAK;IAC1B,KAAK,OAAO,OAAO,QAAQ;IAC3B,GAAI,OAAO,OAAO,UAAU,IAAI,EAAE,WAAW,OAAO,OAAO,UAAU,EAAE,IAAI,CAAC;GAC9E,EACF,IACA,CAAC;GACL,GAAI,qBAAqB,OAAO,aAAa,KAAK,KAAK,OAAO,aAAa,QAAQ,IAC/E,EACE,aAAa;IACX,QAAQ;IACR,OAAO,OAAO,aAAa,KAAK;IAChC,KAAK,OAAO,aAAa,QAAQ;IACjC,GAAI,OAAO,aAAa,UAAU,IAAI,EAAE,WAAW,OAAO,aAAa,UAAU,EAAE,IAAI,CAAC;IACxF,OAAO,OAAO,aAAa,KAAK,MAAM,WAAY,WAAsB;IACxE,QAAQ,QAAQ,aAAa,MAAM,KAAK;IACxC,YAAY,OAAO,OAAO,aAAa,IAAI,CAAC,EAAE,GAAG,KAAK;IACtD,YAAY,OAAO,OAAO,aAAa,IAAI,CAAC,EAAE,GAAG,KAAK;GACxD,EACF,IACA,CAAC;GACL,GAAI,OAAO,OAAO,QAAQ,MAAM,IAC5B,EACE,QAAQ;IACN,IAAI,OAAO,OAAO,OAAO,QAAQ,MAAM,CAAC,EAAE,EAAE,KAAK;IACjD,OAAO,OAAO,OAAO,OAAO,QAAQ,MAAM,CAAC,EAAE,KAAK,KAAK;IACvD,KAAK,OAAO,OAAO,OAAO,QAAQ,MAAM,CAAC,EAAE,QAAQ,KAAK;GAC1D,EACF,IACA,CAAC;EACP;EAEA,MAAM,OAAO,yBAAyB,KAAK,QAAQ,OAAO,KAAK;EAC/D,IAAI;EACJ,IAAI,YAAuC,CAAC;EAC5C,IAAI,UAA+E,EAAE,QAAQ,WAAW;EACxG,IAAI;GACF,WAAW,OAAO,MAAM,gBAAgB,QAAQ,QAAQ,KAAK,OAAO,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,KAAA;GACzF,IAAI,UAAU,SAAS,UACrB,UAAU;IAAE,QAAQ;IAAY,MAAM,SAAS;IAAM,QAAQ,SAAS;GAAO;QACxE,IAAI,UACT,YAAY,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAI,WAAU,EAAE,GAAG,MAAM,EAAE;EAEpF,SAAS,OAAO;GACd,MAAM,WAAW,iBAAiB,SAAS,MAAM,YAAY;GAC7D,UAAU;IACR,QAAQ;IACR,MAAM,WAAW,YAAY;IAC7B,QAAQ,WACJ,uCACA,iBAAiB,QACf,MAAM,QAAQ,MAAM,GAAG,GAAK,IAC5B;GACR;EACF;EAeA,OAAO,EAAE,SAAQ,MAbO,KAAK,QAAQ,QAAQ,qBAAqB;GAChE,OAAO,QAAQ;GACf,kBAAkB,QAAQ;GAC1B,YAAY,aAAa,MAAM;GAC/B,SAAS;IAAE,UAAU,GAAG,eAAe,GAAG,OAAO;IAAc,aAAa,UAAU;GAAQ;GAC9F,gBAAgB,KAAK,QAAQ,MAAM;GACnC,kBAAkB,aAAa,YAAY;GAC3C,OAAO,EAAE,GAAG,MAAM;GAClB;GACA;GACA,aAAa,CAAC;GACd,qBAAK,IAAI,KAAK;EAChB,CAAC,EAAA,CAC0B,OAAO;CACpC;CAEA,MAAMA,aACJ,OACA,WACA,cACA,aACA,mBACA,uBACA,YACkC;EAClC,MAAM,QAAQ,MAAM,KAAK,QAAQ,QAAQ,KAAK;GAAE;GAAO,kBAAkB;EAAU,CAAC;EACpF,IAAI,YAAY,OAAO,MAAM,MAAK,SAAQ,KAAK,OAAO,WAAW,UAAU;EAC3E,IAAI,aACF,OACE,MAAM,MAAK,SAAQ,KAAK,gBAAgB,eAAe,mBAAmB,SAAS,WAAW,CAAC,KAC/F,MAAM,MAAK,SAAQ,KAAK,gBAAgB,eAAe,gBAAgB,cAAc,SAAS,WAAW,CAAC;EAG9G,IAAI,mBACF,OACE,MAAM,MAAK,SAAQ,KAAK,gBAAgB,eAAe,mBAAmB,gBAAgB,iBAAiB,CAAC,KAC5G,MAAM,MACJ,SAAQ,KAAK,gBAAgB,eAAe,gBAAgB,cAAc,gBAAgB,iBAAiB,CAC7G,MAMC,wBACG,MAAM,MACJ,SACE,KAAK,gBAAgB,SAAS,kBAC9B,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,MAAK,YAAW,QAAQ,WAAW,qBAAqB,CACzF,IACA,KAAA;CAIV;AACF;AA0CA,MAAM,+BAA+B;;;;;;;;;AAUrC,SAAS,8BAA8B,MAAmB,YAAqD;CAC7G,IAAI,KAAK,gBAAgB,SAAS,gBAAgB,OAAO,KAAA;CACzD,MAAM,MAAM,KAAK,eAAe;CAChC,IAAI,KAAK;EACP,MAAM,QAAQ,kDAAkD,KAAK,GAAG;EACxE,IAAI,CAAC,OAAO,OAAO,KAAA;EACnB,OAAO,MAAM,OAAO,WAAW,WAAW,OAAO,MAAM,EAAE,IAAI,KAAA;CAC/D;CACA,MAAM,aAAa,KAAK,eAAe;CACvC,MAAM,SAAS,oCAAoC,KAAK,UAAU;CAClE,IAAI,QAAQ,OAAO,OAAO,OAAO,EAAE,MAAM,WAAW,KAAK,OAAO,OAAO,EAAE,IAAI,KAAA;CAC7E,MAAM,YAAY,oBAAoB,KAAK,UAAU;CACrD,OAAO,YAAY,OAAO,UAAU,EAAE,IAAI,KAAA;AAC5C;AAEA,SAAgB,sBACd,YACA,mBACA,OACqB;CACrB,OAAO;EACL,OAAO;EAGP,YAAY,aAAa,WAAW,GAAG,gBAAgB,kBAAkB,GAAG,MAAM,SAAS,WAAW;EACtG,SAAS;GACP,QAAQ;GACR,cAAc,EAAE,IAAI,WAAW,eAAe;GAC9C,YAAY;IAAE,IAAI,WAAW;IAAI,WAAW,WAAW;GAAS;GAChE,QAAQ,EAAE,OAAO,MAAM,YAAY,SAAS;GAC5C,cAAc;IACZ,QAAQ;IACR,OAAO,MAAM;IACb,UAAU,MAAM;IAChB,GAAI,MAAM,YAAY,EAAE,YAAY,MAAM,UAAU,IAAI,CAAC;IACzD,OAAO;IACP,QAAQ,MAAM;IACd,MAAM,EAAE,KAAK,MAAM,WAAW;IAC9B,MAAM,EAAE,KAAK,MAAM,WAAW;GAChC;EACF;CACF;AACF;;;;;;;AAQA,SAAgB,kCACd,SACA,kBAC6B;CAC7B,MAAM,QAAQ,IAAI,YAAY,OAAO;CACrC,OAAO,OAAM,iBAAgB;EAC3B,MAAM,UAAiC;GAAE,cAAc;GAAG,SAAS;GAAG,QAAQ;GAAG,QAAQ;GAAG,QAAQ;GAAG,QAAQ,CAAC;EAAE;EAClH,MAAM,iBAAiB,YAAiC,OAAgB,sBAA+B;GACrG,QAAQ,UAAU;GAClB,IAAI,QAAQ,OAAO,SAAS,8BAC1B,QAAQ,OAAO,KAAK;IAClB,YAAY,WAAW;IACvB,GAAI,sBAAsB,KAAA,IAAY,CAAC,IAAI,EAAE,kBAAkB;IAC/D,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC9D,CAAC;EAEL;EAIA,MAAM,aAAa,IAAI,KACpB,MAAM,QAAQ,cAAc,oBAAoB,2BAA2B,EAAA,CAAG,KAC7E,QAAO,GAAG,IAAI,uBAAuB,QAAQ,IAAI,sBACnD,CACF;EACA,MAAM,SAAS,aAAa,QAAO,eACjC,WAAW,IAAI,GAAG,WAAW,eAAe,QAAQ,WAAW,IAAI,CACrE;EACA,QAAQ,eAAe,OAAO;EAC9B,KAAK,MAAM,cAAc,QAAQ;GAG/B,IAAI;GACJ,IAAI;IACF,MAAM,WAAW,MAAM,QAAQ,cAAc,oBAAoB,yBAAyB;KACxF,wBAAwB,OAAO,WAAW,cAAc;KACxD,sBAAsB,OAAO,WAAW,EAAE;IAC5C,CAAC;IACD,IAAI,SAAS,WAAW,GAAG;IAC3B,0BAAU,IAAI,IAAY;IAC1B,KAAK,MAAM,WAAW,UAAU;KAC9B,MAAM,QAAQ,MAAM,QAAQ,QAAQ,KAAK;MACvC,OAAO,QAAQ;MACf,kBAAkB,QAAQ;KAC5B,CAAC;KACD,KAAK,MAAM,QAAQ,OAAO;MACxB,MAAM,QAAQ,KAAK,OAAO;MAC1B,IAAI,UAAU,UAAU,UAAU,YAAY;MAC9C,MAAM,oBAAoB,8BAA8B,MAAM,UAAU;MACxE,IAAI,mBAAmB,QAAQ,IAAI,iBAAiB;KACtD;IACF;GACF,SAAS,OAAO;IACd,cAAc,YAAY,KAAK;IAC/B;GACF;GACA,KAAK,MAAM,qBAAqB,SAC9B,IAAI;IACF,MAAM,QAAQ,MAAM,iBAAiB;KACnC,gBAAgB,WAAW;KAC3B,YAAY,WAAW;KACvB,QAAQ;IACV,CAAC;IACD,QAAQ,WAAW;IACnB,IAAI,CAAC,SAAS,MAAM,UAAU,UAAU;IACxC,MAAM,MAAM,OAAO,sBAAsB,YAAY,mBAAmB,KAAK,CAAC;IAC9E,IAAI,MAAM,QAAQ,QAAQ,UAAU;SAC/B,QAAQ,UAAU;GACzB,SAAS,OAAO;IACd,cAAc,YAAY,OAAO,iBAAiB;GACpD;EAEJ;EACA,OAAO;CACT;AACF;AAEA,SAAS,mBAAmB,QAAgC,SAA6D;CACvH,IAAI,CAAC,QAAQ,OAAO,OAAO,KAAA;CAC3B,OAAO;EACL;EACA,eAAe,QAAQ,QAAQ;EAC/B,oBAAoB,QAAQ,QAAQ;EACpC,UAAU,QAAQ,QAAQ;EAC1B,SAAS,QAAQ,MAAM;EACvB,OAAO,QAAQ,MAAM;CACvB;AACF;AAEA,SAAgB,kBACd,QACA,SACgE;CAChE,MAAM,UAAU,mBAAmB,QAAQ,OAAO;CAClD,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,MAAM,QAAQ,IAAI,YAAY,OAAO;CACrC,QAAO,UAAS,MAAM,OAAO,KAAK;AACpC;AAEA,SAAgB,uBACd,QACA,SACA,kBACyC;CACzC,MAAM,UAAU,mBAAmB,QAAQ,OAAO;CAClD,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,OAAO,kCAAkC,SAAS,gBAAgB;AACpE"}

package/dist/integrations/github/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EACV,sBAAsB,EACtB,UAAU,EAGV,YAAY,EACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,8CAA8C,CAAC;AAEtD,KAAK,2BAA2B,GAAG,0BAA0B,CAAC,WAAW,CAAC,CAAC;AAC3E,KAAK,oBAAoB,GAAG,IAAI,CAAC,2BAA2B,EAAE,kBAAkB,CAAC,CAAC;AAElF,UAAU,0BAA0B;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;CAC7B;AAYD;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,KAAK,EAAE,YAAY,CAAC;IACpB,GAAG,EAAE,wBAAwB,CAAC;IAC9B,OAAO,EAAE,2BAA2B,CAAC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAGlC;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACpD,KAAK,EAAE,YAAY,CAAC;IACpB,GAAG,EAAE,wBAAwB,CAAC;IAC9B,OAAO,EAAE,2BAA2B,CAAC;IACrC,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAClC,GAAG,OAAO,CAAC,IAAI,CAAC,CAGhB;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGhD;AASD,4EAA4E;AAC5E,eAAO,MAAM,2BAA2B,QAAa,CAAC;AAiCtD,8EAA8E;AAC9E,qBAAa,gBAAiB,SAAQ,KAAK;IAGvC,QAAQ,CAAC,IAAI,EACT,aAAa,GACb,gBAAgB,GAChB,cAAc,GACd,aAAa,GACb,aAAa,GACb,eAAe,GACf,YAAY,GACZ,WAAW;gBATf,OAAO,EAAE,MAAM,EACN,IAAI,EACT,aAAa,GACb,gBAAgB,GAChB,cAAc,GACd,aAAa,GACb,aAAa,GACb,eAAe,GACf,YAAY,GACZ,WAAW;CAKlB;AAcD,gFAAgF;AAChF,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,uFAAuF;IACvF,GAAG,EAAE,0BAA0B,CAAC;IAChC,oDAAoD;IACpD,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,0CAA0C;IAC1C,OAAO,EAAE,sBAAsB,CAAC;IAChC,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,oBAAoB,CAAC;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkFhB;AAED,yEAAyE;AACzE,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,MAAM,EACf,EACE,MAAM,EACN,UAAU,EACV,KAAK,EACL,YAAY,GACb,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC7E,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAwED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAU7D;AAED,0DAA0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,yFAAyF;IACzF,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAOzF;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAuBZ;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,YAAY,CAAC,CAqBvB;AAUD,gFAAgF;AAChF,qBAAa,aAAc,SAAQ,KAAK;IAGpC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,iBAAiB,GAAG,cAAc;gBADpE,OAAO,EAAE,MAAM,EACN,IAAI,EAAE,gBAAgB,GAAG,iBAAiB,GAAG,cAAc;CAKvE;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAUpD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAG/E;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,sBAAsB,EAC/B,WAAW,EAAE,MAAM,EACnB,EACE,MAAM,EACN,UAAU,EACV,KAAK,EACL,YAAY,GACb,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC7E,OAAO,CAAC,oBAAoB,CAAC,CAgD/B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,sBAAsB,EAC/B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,sBAAsB,EAC/B,WAAW,EAAE,MAAM,EACnB,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACjE,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAYD,MAAM,WAAW,qBAAqB;IACpC,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;CACb;AAuBD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,MAAM,EACf,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,qBAAqB,GACxD,OAAO,CAAC,uBAAuB,CAAC,CAwClC"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EACV,sBAAsB,EACtB,UAAU,EAGV,YAAY,EACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,8CAA8C,CAAC;AAEtD,KAAK,2BAA2B,GAAG,0BAA0B,CAAC,WAAW,CAAC,CAAC;AAC3E,KAAK,oBAAoB,GAAG,IAAI,CAAC,2BAA2B,EAAE,kBAAkB,CAAC,CAAC;AAElF,UAAU,0BAA0B;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;CAC7B;AAYD;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,KAAK,EAAE,YAAY,CAAC;IACpB,GAAG,EAAE,wBAAwB,CAAC;IAC9B,OAAO,EAAE,2BAA2B,CAAC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAGlC;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACpD,KAAK,EAAE,YAAY,CAAC;IACpB,GAAG,EAAE,wBAAwB,CAAC;IAC9B,OAAO,EAAE,2BAA2B,CAAC;IACrC,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAClC,GAAG,OAAO,CAAC,IAAI,CAAC,CAGhB;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGhD;AASD,4EAA4E;AAC5E,eAAO,MAAM,2BAA2B,QAAa,CAAC;AA4EtD,8EAA8E;AAC9E,qBAAa,gBAAiB,SAAQ,KAAK;IAGvC,QAAQ,CAAC,IAAI,EACT,aAAa,GACb,gBAAgB,GAChB,cAAc,GACd,aAAa,GACb,aAAa,GACb,eAAe,GACf,YAAY,GACZ,WAAW;gBATf,OAAO,EAAE,MAAM,EACN,IAAI,EACT,aAAa,GACb,gBAAgB,GAChB,cAAc,GACd,aAAa,GACb,aAAa,GACb,eAAe,GACf,YAAY,GACZ,WAAW;CAKlB;AAcD,gFAAgF;AAChF,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,uFAAuF;IACvF,GAAG,EAAE,0BAA0B,CAAC;IAChC,oDAAoD;IACpD,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,0CAA0C;IAC1C,OAAO,EAAE,sBAAsB,CAAC;IAChC,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,oBAAoB,CAAC;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6FhB;AAED,yEAAyE;AACzE,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,MAAM,EACf,EACE,MAAM,EACN,UAAU,EACV,KAAK,EACL,YAAY,GACb,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC7E,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAwFD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAU7D;AAED,0DAA0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,yFAAyF;IACzF,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAOzF;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAuBZ;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,YAAY,CAAC,CAqBvB;AAUD,gFAAgF;AAChF,qBAAa,aAAc,SAAQ,KAAK;IAGpC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,iBAAiB,GAAG,cAAc;gBADpE,OAAO,EAAE,MAAM,EACN,IAAI,EAAE,gBAAgB,GAAG,iBAAiB,GAAG,cAAc;CAKvE;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAUpD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAG/E;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,sBAAsB,EAC/B,WAAW,EAAE,MAAM,EACnB,EACE,MAAM,EACN,UAAU,EACV,KAAK,EACL,YAAY,GACb,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC7E,OAAO,CAAC,oBAAoB,CAAC,CAgD/B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,sBAAsB,EAC/B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,sBAAsB,EAC/B,WAAW,EAAE,MAAM,EACnB,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACjE,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAYD,MAAM,WAAW,qBAAqB;IACpC,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;CACb;AAuBD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,MAAM,EACf,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,qBAAqB,GACxD,OAAO,CAAC,uBAAuB,CAAC,CAwClC"}

package/dist/integrations/github/sandbox.js

@@ -69,8 +69,43 @@ function shellQuote(value) {
 const DEFAULT_COMMAND_TIMEOUT_MS = 15 * 6e4;
 /** Branch checkout only fetches one ref — a much tighter budget applies. */
 const CHECKOUT_COMMAND_TIMEOUT_MS = 5 * 6e4;
-/** Run a shell script in the sandbox via `sh -c`, bounded by a hang guard. */
+/**
+* A thrown transport-level failure that is worth retrying: remote sandbox
+* providers (e.g. the platform workspace proxy) surface transient 5xx errors
+* as exceptions carrying an HTTP `status` — typically while a freshly
+* provisioned VM is still coming up. Command failures are NOT exceptions
+* (they resolve with a non-zero exit code), so retrying here never re-runs a
+* command that the sandbox already executed and rejected.
+*/
+function isTransientTransportError(error) {
+	const status = error?.status;
+	return typeof status === "number" && status >= 500;
+}
+const SH_RETRIES = 2;
+const SH_RETRY_DELAY_MS = 2e3;
+/**
+* Run a shell script in the sandbox via `sh -c`, bounded by a hang guard.
+* Transient transport-level 5xx failures (proxy hiccups while the VM boots)
+* are retried with a short backoff; every script routed through here is safe
+* to re-run. Hang-guard timeouts are NOT retried — the budget applies to the
+* command as a whole.
+*/
 async function sh(sandbox, script, options = {}) {
+	const deadlineMs = Date.now() + (options.timeoutMs ?? DEFAULT_COMMAND_TIMEOUT_MS);
+	for (let attempt = 0;; attempt++) try {
+		return await shOnce(sandbox, script, {
+			...options,
+			timeoutMs: Math.max(deadlineMs - Date.now(), 1)
+		});
+	} catch (error) {
+		if (attempt >= SH_RETRIES || !isTransientTransportError(error)) throw error;
+		const delayMs = SH_RETRY_DELAY_MS * (attempt + 1);
+		if (deadlineMs - Date.now() <= delayMs) throw error;
+		await new Promise((resolve) => setTimeout(resolve, delayMs));
+	}
+}
+/** Single `sh -c` execution attempt, bounded by the hang guard. */
+async function shOnce(sandbox, script, options) {
 	const timeoutMs = options.timeoutMs ?? DEFAULT_COMMAND_TIMEOUT_MS;
 	let timer;
 	const hangGuard = new Promise((_, reject) => {
@@ -137,7 +172,13 @@ async function materializeRepo(options) {
 			const setUrl = await sh(sandbox, `git -C ${shellQuote(workdir)} remote set-url origin ${shellQuote(authUrl)}`);
 			if (setUrl.exitCode !== 0) throw new MaterializeError(`Failed to set git remote: ${setUrl.stderr}`, "pull-failed");
 			const pull = await sh(sandbox, `git -C ${shellQuote(workdir)} pull --ff-only`, { phase: "repository pull" });
-			if (pull.exitCode !== 0) throw classifyGitFailure(pull, "pull-failed");
+			if (pull.exitCode !== 0) {
+				if (!isBenignNonFastForward(pull)) throw classifyGitFailure(pull, "pull-failed");
+				reportProgress(onProgress, {
+					phase: "pulling",
+					message: "Workspace has local changes that diverge from the remote — keeping them as-is."
+				});
+			}
 		}
 		succeeded = true;
 	} finally {
@@ -196,6 +237,19 @@ async function scrubRemote(sandbox, workdir, repoFullName, expectGitDir) {
 	if (result.exitCode !== 0 && expectGitDir) throw new MaterializeError(`Failed to scrub installation token from git remote: ${result.stderr.trim() || result.stdout.trim()}`, "pull-failed");
 }
 /**
+* True when a failed `git pull --ff-only` on re-open just means the current
+* branch can't be fast-forwarded — not that anything is broken. The shared
+* workdir is routinely left on a session's working branch, which may have
+* local commits diverging from upstream, no upstream at all (session branches
+* are created from `FETCH_HEAD`), or a detached HEAD. In all of those cases
+* the checkout is intact and holds the session's work; materialization must
+* keep it rather than fail the workspace open.
+*/
+function isBenignNonFastForward(result) {
+	const output = `${result.stderr || ""}\n${result.stdout || ""}`;
+	return /Not possible to fast-forward|Diverging branches can't be fast-forwarded|no tracking information for the current branch|You are not currently on a branch/i.test(output);
+}
+/**
 * Turn a failed git command into an actionable error, detecting the common
 * "cannot reach github.com" egress failure.
 */