@mastra/factory 0.5.1-alpha.0 → 0.6.0-alpha.3

package/dist/integrations/github/rules.js

@@ -27,6 +27,21 @@ function number(value) {
 function boolean(value) {
 	return typeof value === "boolean" ? value : void 0;
 }
+function actorLogins(value) {
+	if (!Array.isArray(value)) return [];
+	return value.flatMap((actor) => {
+		const login = string(object(actor)?.login);
+		return login ? [login] : [];
+	});
+}
+function labelNames(value) {
+	if (!Array.isArray(value)) return [];
+	return value.flatMap((label) => {
+		if (typeof label === "string") return label ? [label] : [];
+		const name = string(object(label)?.name);
+		return name ? [name] : [];
+	});
+}
 function eventName(parsed) {
 	const action = string(parsed.payload.action);
 	if (parsed.event === "issues" && action === "opened") return "issueOpened";
@@ -34,6 +49,7 @@ function eventName(parsed) {
 		const changes = object(parsed.payload.changes);
 		return object(changes?.title) || object(changes?.body) ? "issueEdited" : void 0;
 	}
+	if (parsed.event === "issues" && action === "closed") return "issueClosed";
 	if (parsed.event === "issue_comment") {
 		if (object(object(parsed.payload.issue)?.pull_request)) return void 0;
 		if (action === "created") return "issueCommentCreated";
@@ -45,6 +61,21 @@ function eventName(parsed) {
 	if (parsed.event === "pull_request" && action === "closed") return boolean(object(parsed.payload.pull_request)?.merged) ? "pullRequestMerged" : "pullRequestClosed";
 	if (parsed.event === "pull_request" && action === "review_requested") return "pullRequestReviewRequested";
 }
+/**
+* Canonical source keys (`github-issue:N`, `github-pr:N`) do not identify a
+* repository, so a project linked to several repositories could bind repo A's
+* event to repo B's same-numbered card. The card's intake-stamped URL is
+* authoritative; the intake-stamped `githubRepositoryId` covers URL-less
+* cards. A card with neither signal cannot be attributed by number alone.
+*/
+function cardBelongsToRepository(item, repositoryId, repositoryFullName) {
+	const url = item.externalSource?.url;
+	if (url) {
+		const match = /^https?:\/\/[^/]+\/(.+)\/(?:issues|pull)\/\d+(?:[/?#]|$)/.exec(url);
+		if (match && match[1] === repositoryFullName) return true;
+	}
+	return item.metadata?.githubRepositoryId === repositoryId;
+}
 function canonicalSourceKey(kind, itemNumber) {
 	return kind === "issue" ? `github-issue:${itemNumber}` : `github-pr:${itemNumber}`;
 }
@@ -120,12 +151,14 @@ var GithubRules = class {
 		const issueNumber = number(issue?.number);
 		const pullRequestNumber = number(pullRequest?.number);
 		const provenance = pullRequestNumber ? pullRequestProvenance((await this.options.integrationStorage.subscriptions.listByTarget(provenanceTarget(repositoryId, pullRequestNumber), { status: "active" })).find((subscription) => subscription.orgId === project.orgId)?.data) : null;
-		const relatedItem = await this.#relatedItem(project.orgId, project.factoryProjectId, repositoryId, issueNumber, pullRequestNumber, string(object(pullRequest?.head)?.ref), provenance);
+		const reviewRequested = event === "pullRequestReviewRequested";
+		const requestedReviewer = string(object(parsed.payload.requested_reviewer)?.login);
+		const relatedItem = await this.#relatedItem(project.orgId, project.factoryProjectId, repositoryId, repositoryName, issueNumber, pullRequestNumber, string(object(pullRequest?.head)?.ref), reviewRequested ? null : provenance);
 		const actor = await githubActor(this.options.github, {
 			installationId,
 			repository: repositoryName,
 			login,
-			factoryAuthored: provenance !== null || login === `${this.options.github.slug}[bot]`
+			factoryAuthored: !reviewRequested && provenance !== null || login === `${this.options.github.slug}[bot]`
 		});
 		if (actor.type === "github" && actor.factoryAuthored && (event === "issueCommentCreated" || event === "issueCommentEdited") && string(issueComment?.body)?.includes(FACTORY_TRIAGE_COMMENT_MARKER)) return { status: "ignored" };
 		const context = {
@@ -166,7 +199,11 @@ var GithubRules = class {
 				title: string(issue?.title),
 				url: string(issue?.html_url),
 				...string(issue?.created_at) ? { createdAt: string(issue?.created_at) } : {},
-				...string(issue?.updated_at) ? { updatedAt: string(issue?.updated_at) } : {}
+				...string(issue?.updated_at) ? { updatedAt: string(issue?.updated_at) } : {},
+				assignees: actorLogins(issue?.assignees),
+				labels: labelNames(issue?.labels),
+				...string(issue?.state) === "closed" || string(issue?.state) === "open" ? { state: string(issue?.state) } : {},
+				...string(issue?.state_reason) ? { stateReason: string(issue?.state_reason) } : {}
 			} } : {},
 			...event === "issueEdited" ? { issueChange: {
 				title: Boolean(object(changes?.title)),
@@ -187,10 +224,18 @@ var GithubRules = class {
 				url: string(pullRequest?.html_url),
 				...string(pullRequest?.created_at) ? { createdAt: string(pullRequest?.created_at) } : {},
 				state: string(pullRequest?.state) === "closed" ? "closed" : "open",
+				draft: boolean(pullRequest?.draft) ?? false,
 				merged: boolean(pullRequest?.merged) ?? false,
+				assignees: actorLogins(pullRequest?.assignees),
+				requestedReviewers: actorLogins(pullRequest?.requested_reviewers),
+				labels: labelNames(pullRequest?.labels),
 				headBranch: string(object(pullRequest?.head)?.ref) ?? "",
 				baseBranch: string(object(pullRequest?.base)?.ref) ?? ""
 			} } : {},
+			...reviewRequested && requestedReviewer ? { reviewRequest: {
+				reviewer: requestedReviewer,
+				factoryReviewer: requestedReviewer === `${this.options.github.slug}[bot]`
+			} } : {},
 			...object(parsed.payload.review) ? { review: {
 				id: number(object(parsed.payload.review)?.id) ?? 0,
 				state: string(object(parsed.payload.review)?.state) ?? "unknown",
@@ -234,17 +279,24 @@ var GithubRules = class {
 			now: /* @__PURE__ */ new Date()
 		})).status };
 	}
-	async #relatedItem(orgId, projectId, repositoryId, issueNumber, pullRequestNumber, pullRequestHeadBranch, provenance) {
+	async #relatedItem(orgId, projectId, repositoryId, repositoryFullName, issueNumber, pullRequestNumber, pullRequestHeadBranch, provenance) {
 		const items = await this.options.storage.list({
 			orgId,
 			factoryProjectId: projectId
 		});
 		if (provenance) return items.find((item) => item.id === provenance.workItemId);
-		if (issueNumber) return items.find((item) => item.externalSource?.externalId === canonicalSourceKey("issue", issueNumber)) ?? items.find((item) => item.externalSource?.externalId === legacySourceKey(repositoryId, "issue", issueNumber));
-		if (pullRequestNumber) return items.find((item) => item.externalSource?.externalId === canonicalSourceKey("pull-request", pullRequestNumber)) ?? items.find((item) => item.externalSource?.externalId === legacySourceKey(repositoryId, "pull-request", pullRequestNumber)) ?? (pullRequestHeadBranch ? items.find((item) => item.externalSource?.type !== "pull-request" && Object.values(item.sessions).some((session) => session.branch === pullRequestHeadBranch)) : void 0);
+		if (issueNumber) return items.find((item) => item.externalSource?.externalId === canonicalSourceKey("issue", issueNumber) && cardBelongsToRepository(item, repositoryId, repositoryFullName)) ?? items.find((item) => item.externalSource?.externalId === legacySourceKey(repositoryId, "issue", issueNumber));
+		if (pullRequestNumber) return items.find((item) => item.externalSource?.externalId === canonicalSourceKey("pull-request", pullRequestNumber) && cardBelongsToRepository(item, repositoryId, repositoryFullName)) ?? items.find((item) => item.externalSource?.externalId === legacySourceKey(repositoryId, "pull-request", pullRequestNumber)) ?? (pullRequestHeadBranch ? items.find((item) => item.externalSource?.type !== "pull-request" && Object.values(item.sessions).some((session) => session.branch === pullRequestHeadBranch)) : void 0);
 	}
 };
 const RECONCILE_ERROR_SAMPLE_LIMIT = 5;
+function sameStrings(left, right) {
+	if (right === void 0) return true;
+	if (!Array.isArray(left)) return false;
+	const leftValues = new Set(left.flatMap((value) => typeof value === "string" ? [value] : []));
+	const rightValues = new Set(right);
+	return leftValues.size === rightValues.size && [...leftValues].every((value) => rightValues.has(value));
+}
 /**
 * Extracts the PR number a work item tracks, but only when the item belongs
 * to the given repository. Card URLs pin the repository unambiguously; the
@@ -267,6 +319,53 @@ function reconcilablePullRequestNumber(item, repository) {
 	const canonical = /^github-pr:(\d+)$/.exec(externalId);
 	return canonical ? Number(canonical[1]) : void 0;
 }
+/**
+* Extracts the issue number a work item tracks, but only when the item
+* belongs to the given repository. Stricter than
+* {@link reconcilablePullRequestNumber}: a canonical key with no URL is only
+* trusted when the intake-stamped `githubRepositoryId` confirms the
+* repository, because the sweep initiates closes on its own.
+*/
+function reconcilableIssueNumber(item, repository) {
+	if (item.externalSource?.type !== "issue") return void 0;
+	const url = item.externalSource.url;
+	if (url) {
+		const match = /^https?:\/\/[^/]+\/(.+)\/issues\/(\d+)(?:[/?#]|$)/.exec(url);
+		if (!match) return void 0;
+		return match[1] === repository.fullName || item.metadata?.githubRepositoryId === repository.id ? Number(match[2]) : void 0;
+	}
+	const externalId = item.externalSource.externalId;
+	const legacy = /^github:(\d+):issue:(\d+)$/.exec(externalId);
+	if (legacy) return Number(legacy[1]) === repository.id ? Number(legacy[2]) : void 0;
+	const canonical = /^github-issue:(\d+)$/.exec(externalId);
+	if (!canonical) return void 0;
+	return item.metadata?.githubRepositoryId === repository.id ? Number(canonical[1]) : void 0;
+}
+function reconciledIssueClosedEvent(repository, issueNumber, state) {
+	return {
+		event: "issues",
+		deliveryId: `reconcile:${repository.id}:issue:${issueNumber}:closed`,
+		payload: {
+			action: "closed",
+			installation: { id: repository.installationId },
+			repository: {
+				id: repository.id,
+				full_name: repository.fullName
+			},
+			sender: { login: state.author ?? "github" },
+			issue: {
+				number: issueNumber,
+				title: state.title,
+				html_url: state.url,
+				state: "closed",
+				...state.stateReason ? { state_reason: state.stateReason } : {},
+				...state.createdAt ? { created_at: state.createdAt } : {},
+				...state.updatedAt ? { updated_at: state.updatedAt } : {},
+				assignees: (state.assignees ?? []).map((login) => ({ login }))
+			}
+		}
+	};
+}
 function reconciledClosedEvent(repository, pullRequestNumber, state) {
 	return {
 		event: "pull_request",
@@ -285,7 +384,11 @@ function reconciledClosedEvent(repository, pullRequestNumber, state) {
 				html_url: state.url,
 				...state.createdAt ? { created_at: state.createdAt } : {},
 				state: "closed",
+				draft: state.draft,
 				merged: state.merged,
+				assignees: (state.assignees ?? []).map((login) => ({ login })),
+				requested_reviewers: (state.requestedReviewers ?? []).map((login) => ({ login })),
+				labels: (state.labels ?? []).map((name) => ({ name })),
 				head: { ref: state.headBranch },
 				base: { ref: state.baseBranch }
 			}
@@ -325,7 +428,7 @@ function createGithubPullRequestReconciler(options, fetchPullRequest) {
 		};
 		const recordFailure = (repository, error, pullRequestNumber) => {
 			summary.failed += 1;
-			if (summary.errors.length < RECONCILE_ERROR_SAMPLE_LIMIT) summary.errors.push({
+			if (summary.errors.length < 5) summary.errors.push({
 				repository: repository.fullName,
 				...pullRequestNumber === void 0 ? {} : { pullRequestNumber },
 				error: error instanceof Error ? error.message : String(error)
@@ -335,14 +438,14 @@ function createGithubPullRequestReconciler(options, fetchPullRequest) {
 		const scoped = repositories.filter((repository) => configured.has(`${repository.installationId}\u0000${repository.id}`));
 		summary.repositories = scoped.length;
 		for (const repository of scoped) {
-			let numbers;
+			let cardsByNumber;
 			try {
 				const projects = await options.sourceControl.projectRepositories.listByExternalRepository({
 					installationExternalId: String(repository.installationId),
 					repositoryExternalId: String(repository.id)
 				});
 				if (projects.length === 0) continue;
-				numbers = /* @__PURE__ */ new Set();
+				cardsByNumber = /* @__PURE__ */ new Map();
 				for (const project of projects) {
 					const items = await options.storage.list({
 						orgId: project.orgId,
@@ -350,23 +453,56 @@ function createGithubPullRequestReconciler(options, fetchPullRequest) {
 					});
 					for (const item of items) {
 						const stage = item.stages[0];
-						if (stage === "done" || stage === "canceled") continue;
 						const pullRequestNumber = reconcilablePullRequestNumber(item, repository);
-						if (pullRequestNumber) numbers.add(pullRequestNumber);
+						if (!pullRequestNumber) continue;
+						const metadata = item.metadata ?? {};
+						const hasReconciledMetadata = (metadata.state === "open" || metadata.state === "closed") && typeof metadata.draft === "boolean" && typeof metadata.merged === "boolean" && typeof metadata.author === "string" && Array.isArray(metadata.assignees) && Array.isArray(metadata.requestedReviewers) && Array.isArray(metadata.labels);
+						if ((stage === "done" || stage === "canceled") && hasReconciledMetadata) continue;
+						const cards = cardsByNumber.get(pullRequestNumber) ?? [];
+						cards.push(item);
+						cardsByNumber.set(pullRequestNumber, cards);
 					}
 				}
 			} catch (error) {
 				recordFailure(repository, error);
 				continue;
 			}
-			for (const pullRequestNumber of numbers) try {
+			for (const [pullRequestNumber, cards] of cardsByNumber) try {
 				const state = await fetchPullRequest({
 					installationId: repository.installationId,
 					repository: repository.fullName,
 					number: pullRequestNumber
 				});
 				summary.checked += 1;
-				if (!state || state.state !== "closed") continue;
+				if (!state) continue;
+				for (const card of cards) {
+					const metadata = card.metadata ?? {};
+					const statusChanged = metadata.state !== state.state || metadata.draft !== state.draft || metadata.merged !== state.merged;
+					const authorChanged = state.author !== void 0 && metadata.author !== state.author;
+					const assigneesChanged = !sameStrings(metadata.assignees, state.assignees);
+					const reviewersChanged = !sameStrings(metadata.requestedReviewers, state.requestedReviewers);
+					const labelsChanged = !sameStrings(metadata.labels, state.labels);
+					if (!statusChanged && !authorChanged && !assigneesChanged && !reviewersChanged && !labelsChanged) continue;
+					try {
+						await options.storage.update({
+							orgId: card.orgId,
+							id: card.id,
+							userId: "factory-rule-dispatcher",
+							patch: { metadata: {
+								state: state.state,
+								draft: state.draft,
+								merged: state.merged,
+								...state.author ? { author: state.author } : {},
+								...state.assignees ? { assignees: state.assignees } : {},
+								...state.requestedReviewers ? { requestedReviewers: state.requestedReviewers } : {},
+								...state.labels ? { labels: state.labels } : {}
+							} }
+						});
+					} catch (error) {
+						recordFailure(repository, error, pullRequestNumber);
+					}
+				}
+				if (state.state !== "closed") continue;
 				await rules.ingest(reconciledClosedEvent(repository, pullRequestNumber, state));
 				await retireReconciledSubscriptions(options.integrationStorage, repository, pullRequestNumber, state.merged);
 				if (state.merged) summary.merged += 1;
@@ -401,6 +537,6 @@ function attachGithubReconciler(github, context, fetchPullRequest) {
 	return createGithubPullRequestReconciler(options, fetchPullRequest);
 }
 //#endregion
-export { GithubRules, attachGithubReconciler, attachGithubRules, createGithubPullRequestReconciler, reconciledClosedEvent };
+export { GithubRules, RECONCILE_ERROR_SAMPLE_LIMIT, attachGithubReconciler, attachGithubRules, createGithubPullRequestReconciler, githubRulesOptions, reconcilableIssueNumber, reconciledClosedEvent, reconciledIssueClosedEvent, sameStrings };
 
 //# sourceMappingURL=rules.js.map

package/dist/integrations/github/rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules.js","names":["#ingestProject","#relatedItem"],"sources":["../../../src/integrations/github/rules.ts"],"sourcesContent":["import { resolveFactoryGithubRule } from '../../rules/resolve.js';\nimport type {\n  FactoryGithubEventName,\n  FactoryGithubRuleContext,\n  FactoryRuleActor,\n  FactoryRuleDecision,\n  FactoryRules,\n} from '../../rules/types.js';\nimport { validateFactoryRuleDecisions } from '../../rules/validation.js';\nimport type { IntegrationStorageHandle } from '../../storage/domains/integrations/base.js';\nimport type { FactoryProjectsStorage } from '../../storage/domains/projects/base.js';\nimport type {\n  ExternalRepositoryProjectTarget,\n  SourceControlStorageHandle,\n} from '../../storage/domains/source-control/base.js';\nimport type { WorkItemRow, WorkItemsStorage } from '../../storage/domains/work-items/base.js';\nimport type { IntegrationContext } from '../base.js';\nimport type { GithubRepositoryPermission } from './integration.js';\nimport { changeRequestTargetKey } from './subscriptions.js';\nimport type { ParsedGithubWebhook } from './webhook.js';\n\nconst TRUSTED_PERMISSIONS = new Set(['write', 'admin']);\nconst RULE_TIMEOUT_MS = 5_000;\nconst FACTORY_TRIAGE_COMMENT_MARKER = '<!-- mastra-factory-triage -->';\n\nasync function withRuleTimeout<T>(promise: Promise<T>): Promise<T> {\n  let timeout: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      promise,\n      new Promise<never>((_, reject) => {\n        timeout = setTimeout(() => reject(new Error('FACTORY_RULE_TIMEOUT')), RULE_TIMEOUT_MS);\n      }),\n    ]);\n  } finally {\n    if (timeout) clearTimeout(timeout);\n  }\n}\n\nfunction object(value: unknown): Record<string, unknown> | undefined {\n  return value && typeof value === 'object' && !Array.isArray(value) ? (value as Record<string, unknown>) : undefined;\n}\n\nfunction string(value: unknown): string | undefined {\n  return typeof value === 'string' && value.length > 0 ? value : undefined;\n}\n\nfunction number(value: unknown): number | undefined {\n  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;\n}\n\nfunction boolean(value: unknown): boolean | undefined {\n  return typeof value === 'boolean' ? value : undefined;\n}\n\nfunction eventName(parsed: ParsedGithubWebhook): FactoryGithubEventName | undefined {\n  const action = string(parsed.payload.action);\n  if (parsed.event === 'issues' && action === 'opened') return 'issueOpened';\n  if (parsed.event === 'issues' && action === 'edited') {\n    const changes = object(parsed.payload.changes);\n    return object(changes?.title) || object(changes?.body) ? 'issueEdited' : undefined;\n  }\n  if (parsed.event === 'issue_comment') {\n    const issue = object(parsed.payload.issue);\n    if (object(issue?.pull_request)) return undefined;\n    if (action === 'created') return 'issueCommentCreated';\n    if (action === 'edited') return 'issueCommentEdited';\n    if (action === 'deleted') return 'issueCommentDeleted';\n  }\n  if (parsed.event === 'pull_request' && action === 'opened') return 'pullRequestOpened';\n  if (parsed.event === 'pull_request' && action === 'synchronize') return 'pullRequestUpdated';\n  if (parsed.event === 'pull_request' && action === 'closed') {\n    return boolean(object(parsed.payload.pull_request)?.merged) ? 'pullRequestMerged' : 'pullRequestClosed';\n  }\n  if (parsed.event === 'pull_request' && action === 'review_requested') return 'pullRequestReviewRequested';\n  return undefined;\n}\n\nfunction canonicalSourceKey(kind: 'issue' | 'pull-request', itemNumber: number): string {\n  return kind === 'issue' ? `github-issue:${itemNumber}` : `github-pr:${itemNumber}`;\n}\n\nfunction legacySourceKey(repositoryId: number, kind: 'issue' | 'pull-request', itemNumber: number): string {\n  return `github:${repositoryId}:${kind}:${itemNumber}`;\n}\n\nfunction provenanceTarget(repositoryId: number, pullRequestNumber: number): string {\n  return `factory-pr-provenance:${repositoryId}:${pullRequestNumber}`;\n}\n\nfunction workItemSource(item: WorkItemRow) {\n  if (!item.externalSource) return 'manual' as const;\n  return item.externalSource.type === 'pull-request' ? ('github-pr' as const) : ('github-issue' as const);\n}\n\nfunction workItemSourceKey(item: WorkItemRow): string | null {\n  return item.externalSource?.externalId ?? null;\n}\n\nasync function githubActor(\n  github: GithubRulesIntegration,\n  input: { installationId: number; repository: string; login: string; factoryAuthored: boolean },\n): Promise<FactoryRuleActor> {\n  let trusted = false;\n  try {\n    const permission = await github.getRepositoryCollaboratorPermission(\n      input.installationId,\n      input.repository,\n      input.login,\n    );\n    trusted = permission !== undefined && TRUSTED_PERMISSIONS.has(permission);\n  } catch {\n    trusted = false;\n  }\n  return { type: 'github', login: input.login, trusted, factoryAuthored: input.factoryAuthored };\n}\n\ninterface FactoryPullRequestProvenanceData {\n  kind: 'factory-pr-provenance';\n  workItemId: string;\n}\n\nfunction pullRequestProvenance(data: Record<string, unknown> | undefined): FactoryPullRequestProvenanceData | null {\n  if (!data || data.kind !== 'factory-pr-provenance' || typeof data.workItemId !== 'string') return null;\n  return { kind: 'factory-pr-provenance', workItemId: data.workItemId };\n}\n\nexport interface GithubRulesIntegration {\n  readonly slug?: string;\n  getRepositoryCollaboratorPermission(\n    installationId: number,\n    repoFullName: string,\n    username: string,\n  ): Promise<GithubRepositoryPermission | undefined>;\n}\n\nexport interface GithubRulesOptions {\n  github: GithubRulesIntegration;\n  sourceControl: SourceControlStorageHandle;\n  /** Integration-scoped storage; provenance rows are validated at read. */\n  integrationStorage: IntegrationStorageHandle;\n  projects: FactoryProjectsStorage;\n  storage: WorkItemsStorage;\n  rules: FactoryRules;\n}\n\nexport class GithubRules {\n  constructor(private readonly options: GithubRulesOptions) {}\n\n  async ingest(parsed: ParsedGithubWebhook): Promise<{ status: 'ignored' | 'committed' | 'replayed' | 'missing' }> {\n    const event = eventName(parsed);\n    const repository = object(parsed.payload.repository);\n    const installationId = number(object(parsed.payload.installation)?.id);\n    const repositoryId = number(repository?.id);\n    const repositoryName = string(repository?.full_name);\n    const login = string(object(parsed.payload.sender)?.login);\n    if (!event || !installationId || !repositoryId || !repositoryName || !login) return { status: 'ignored' };\n\n    const projects = await this.options.sourceControl.projectRepositories.listByExternalRepository({\n      installationExternalId: String(installationId),\n      repositoryExternalId: String(repositoryId),\n    });\n    if (projects.length === 0) return { status: 'ignored' };\n    const results = [];\n    for (const project of projects) {\n      results.push(\n        await this.#ingestProject(parsed, event, installationId, repositoryId, repositoryName, login, project),\n      );\n    }\n    if (results.some(result => result.status === 'committed')) return { status: 'committed' };\n    if (results.some(result => result.status === 'replayed')) return { status: 'replayed' };\n    return results[0] ?? { status: 'ignored' };\n  }\n\n  async #ingestProject(\n    parsed: ParsedGithubWebhook,\n    event: FactoryGithubEventName,\n    installationId: number,\n    repositoryId: number,\n    repositoryName: string,\n    login: string,\n    project: ExternalRepositoryProjectTarget,\n  ): Promise<{ status: 'ignored' | 'committed' | 'replayed' | 'missing' }> {\n    const factoryProject = await this.options.projects.get({\n      orgId: project.orgId,\n      id: project.factoryProjectId,\n    });\n    if (!factoryProject) return { status: 'missing' };\n    const issue = object(parsed.payload.issue);\n    const issueComment = object(parsed.payload.comment);\n    const changes = object(parsed.payload.changes);\n    const pullRequest = object(parsed.payload.pull_request);\n    const issueNumber = number(issue?.number);\n    const pullRequestNumber = number(pullRequest?.number);\n    const provenance = pullRequestNumber\n      ? pullRequestProvenance(\n          (\n            await this.options.integrationStorage.subscriptions.listByTarget(\n              provenanceTarget(repositoryId, pullRequestNumber),\n              { status: 'active' },\n            )\n          ).find(subscription => subscription.orgId === project.orgId)?.data,\n        )\n      : null;\n    const relatedItem = await this.#relatedItem(\n      project.orgId,\n      project.factoryProjectId,\n      repositoryId,\n      issueNumber,\n      pullRequestNumber,\n      string(object(pullRequest?.head)?.ref),\n      provenance,\n    );\n    const actor = await githubActor(this.options.github, {\n      installationId,\n      repository: repositoryName,\n      login,\n      factoryAuthored: provenance !== null || login === `${this.options.github.slug}[bot]`,\n    });\n    if (\n      actor.type === 'github' &&\n      actor.factoryAuthored &&\n      (event === 'issueCommentCreated' || event === 'issueCommentEdited') &&\n      string(issueComment?.body)?.includes(FACTORY_TRIAGE_COMMENT_MARKER)\n    ) {\n      return { status: 'ignored' };\n    }\n    const context: FactoryGithubRuleContext = {\n      tenant: { orgId: project.orgId, projectId: project.factoryProjectId },\n      actor,\n      ingress: { type: 'github', id: `${installationId}:${parsed.deliveryId}` },\n      cause: `github.${event}`,\n      causalChain: [],\n      ruleSetVersion: this.options.rules.version,\n      ...(relatedItem\n        ? {\n            item: {\n              id: relatedItem.id,\n              source: workItemSource(relatedItem),\n              sourceKey: workItemSourceKey(relatedItem),\n              parentWorkItemId: relatedItem.parentWorkItemId,\n              title: relatedItem.title,\n              url: relatedItem.externalSource?.url ?? null,\n              stages: relatedItem.stages,\n            },\n            board: relatedItem.externalSource?.type === 'pull-request' ? ('review' as const) : ('work' as const),\n            itemRevision: relatedItem.revision,\n          }\n        : {}),\n      event,\n      deliveryId: parsed.deliveryId,\n      factory: { createdAt: factoryProject.createdAt.toISOString() },\n      repository: { id: repositoryId, fullName: repositoryName },\n      ...(issueNumber && string(issue?.title) && string(issue?.html_url)\n        ? {\n            issue: {\n              number: issueNumber,\n              title: string(issue?.title)!,\n              url: string(issue?.html_url)!,\n              ...(string(issue?.created_at) ? { createdAt: string(issue?.created_at) } : {}),\n              ...(string(issue?.updated_at) ? { updatedAt: string(issue?.updated_at) } : {}),\n            },\n          }\n        : {}),\n      ...(event === 'issueEdited'\n        ? { issueChange: { title: Boolean(object(changes?.title)), body: Boolean(object(changes?.body)) } }\n        : {}),\n      ...(number(issueComment?.id)\n        ? {\n            issueComment: {\n              id: number(issueComment?.id)!,\n              ...(string(issueComment?.body) ? { body: string(issueComment?.body) } : {}),\n              ...(string(issueComment?.html_url) ? { url: string(issueComment?.html_url) } : {}),\n              ...(string(object(issueComment?.user)?.login) ? { author: string(object(issueComment?.user)?.login) } : {}),\n              ...(string(object(issueComment?.user)?.type) ? { authorType: string(object(issueComment?.user)?.type) } : {}),\n              ...(string(issueComment?.created_at) ? { createdAt: string(issueComment?.created_at) } : {}),\n              ...(string(issueComment?.updated_at) ? { updatedAt: string(issueComment?.updated_at) } : {}),\n            },\n          }\n        : {}),\n      ...(pullRequestNumber && string(pullRequest?.title) && string(pullRequest?.html_url)\n        ? {\n            pullRequest: {\n              number: pullRequestNumber,\n              title: string(pullRequest?.title)!,\n              url: string(pullRequest?.html_url)!,\n              ...(string(pullRequest?.created_at) ? { createdAt: string(pullRequest?.created_at) } : {}),\n              state: string(pullRequest?.state) === 'closed' ? ('closed' as const) : ('open' as const),\n              merged: boolean(pullRequest?.merged) ?? false,\n              headBranch: string(object(pullRequest?.head)?.ref) ?? '',\n              baseBranch: string(object(pullRequest?.base)?.ref) ?? '',\n            },\n          }\n        : {}),\n      ...(object(parsed.payload.review)\n        ? {\n            review: {\n              id: number(object(parsed.payload.review)?.id) ?? 0,\n              state: string(object(parsed.payload.review)?.state) ?? 'unknown',\n              url: string(object(parsed.payload.review)?.html_url) ?? '',\n            },\n          }\n        : {}),\n    };\n\n    const rule = resolveFactoryGithubRule(this.options.rules, event);\n    let decision: FactoryRuleDecision | void;\n    let decisions: Record<string, unknown>[] = [];\n    let outcome: { status: 'accepted' | 'rejected'; code?: string; reason?: string } = { status: 'accepted' };\n    try {\n      decision = rule ? await withRuleTimeout(Promise.resolve(rule(Object.freeze(context)))) : undefined;\n      if (decision?.type === 'reject') {\n        outcome = { status: 'rejected', code: decision.code, reason: decision.reason };\n      } else if (decision) {\n        decisions = validateFactoryRuleDecisions([decision]).map(entry => ({ ...entry }));\n      }\n    } catch (error) {\n      const timedOut = error instanceof Error && error.message === 'FACTORY_RULE_TIMEOUT';\n      outcome = {\n        status: 'rejected',\n        code: timedOut ? 'timeout' : 'rule_error',\n        reason: timedOut\n          ? 'Factory rule evaluation timed out.'\n          : error instanceof Error\n            ? error.message.slice(0, 2_000)\n            : 'Factory GitHub rule failed.',\n      };\n    }\n\n    const committed = await this.options.storage.commitRuleEvaluation({\n      orgId: project.orgId,\n      factoryProjectId: project.factoryProjectId,\n      workItemId: relatedItem?.id ?? null,\n      ingress: { identity: `${installationId}:${parsed.deliveryId}`, triggerType: `github.${event}` },\n      ruleSetVersion: this.options.rules.version,\n      expectedRevision: relatedItem?.revision ?? null,\n      actor: { ...actor },\n      outcome,\n      decisions,\n      causalChain: [],\n      now: new Date(),\n    });\n    return { status: committed.status };\n  }\n\n  async #relatedItem(\n    orgId: string,\n    projectId: string,\n    repositoryId: number,\n    issueNumber: number | undefined,\n    pullRequestNumber: number | undefined,\n    pullRequestHeadBranch: string | undefined,\n    provenance: FactoryPullRequestProvenanceData | null,\n  ): Promise<WorkItemRow | undefined> {\n    const items = await this.options.storage.list({ orgId, factoryProjectId: projectId });\n    if (provenance) return items.find(item => item.id === provenance.workItemId);\n    if (issueNumber) {\n      return (\n        items.find(item => item.externalSource?.externalId === canonicalSourceKey('issue', issueNumber)) ??\n        items.find(item => item.externalSource?.externalId === legacySourceKey(repositoryId, 'issue', issueNumber))\n      );\n    }\n    if (pullRequestNumber) {\n      return (\n        items.find(item => item.externalSource?.externalId === canonicalSourceKey('pull-request', pullRequestNumber)) ??\n        items.find(\n          item => item.externalSource?.externalId === legacySourceKey(repositoryId, 'pull-request', pullRequestNumber),\n        ) ??\n        // Provenance fallback: a PR pushed from a work item's session branch\n        // belongs to that item even when no gh-pr-create provenance was\n        // recorded (session predating state seeding, or the PR was opened\n        // outside the tracked tool call). Session branches are per-item\n        // (`factory/issue-N`), so a head-branch match is unambiguous.\n        (pullRequestHeadBranch\n          ? items.find(\n              item =>\n                item.externalSource?.type !== 'pull-request' &&\n                Object.values(item.sessions).some(session => session.branch === pullRequestHeadBranch),\n            )\n          : undefined)\n      );\n    }\n    return undefined;\n  }\n}\n\nexport interface ReconcilePullRequestState {\n  title: string;\n  url: string;\n  state: 'open' | 'closed';\n  merged: boolean;\n  headBranch: string;\n  baseBranch: string;\n  createdAt?: string;\n  mergedBy?: string;\n}\n\nexport type GithubPullRequestFetcher = (input: {\n  installationId: number;\n  repository: string;\n  number: number;\n}) => Promise<ReconcilePullRequestState | undefined>;\n\nexport interface ReconcileRepository {\n  id: number;\n  fullName: string;\n  installationId: number;\n}\n\nexport interface ReconcileSweepSummary {\n  /** Factory-configured repositories included in the sweep. */\n  repositories: number;\n  /** PRs whose live state was fetched from GitHub. */\n  checked: number;\n  /** Missed merges replayed through the rules ingress. */\n  merged: number;\n  /** Missed closes-without-merge replayed through the rules ingress. */\n  closed: number;\n  /** PRs (or whole repositories) skipped because of an error. */\n  failed: number;\n  /** Error samples with context, capped at {@link RECONCILE_ERROR_SAMPLE_LIMIT}. */\n  errors: Array<{ repository: string; pullRequestNumber?: number; error: string }>;\n}\n\nexport type GithubPullRequestReconciler = (repositories: ReconcileRepository[]) => Promise<ReconcileSweepSummary>;\n\nconst RECONCILE_ERROR_SAMPLE_LIMIT = 5;\n\n/**\n * Extracts the PR number a work item tracks, but only when the item belongs\n * to the given repository. Card URLs pin the repository unambiguously; the\n * legacy source key embeds the repository id. Canonical keys (`github-pr:N`)\n * carry no repository, so they are only trusted when the item has no URL —\n * a project mapped to multiple repositories must not reconcile one repo's\n * card against another repo's PR number.\n */\nfunction reconcilablePullRequestNumber(item: WorkItemRow, repository: ReconcileRepository): number | undefined {\n  if (item.externalSource?.type !== 'pull-request') return undefined;\n  const url = item.externalSource.url;\n  if (url) {\n    const match = /^https?:\\/\\/[^/]+\\/(.+)\\/pull\\/(\\d+)(?:[/?#]|$)/.exec(url);\n    if (!match) return undefined;\n    return match[1] === repository.fullName ? Number(match[2]) : undefined;\n  }\n  const externalId = item.externalSource.externalId;\n  const legacy = /^github:(\\d+):pull-request:(\\d+)$/.exec(externalId);\n  if (legacy) return Number(legacy[1]) === repository.id ? Number(legacy[2]) : undefined;\n  const canonical = /^github-pr:(\\d+)$/.exec(externalId);\n  return canonical ? Number(canonical[1]) : undefined;\n}\n\nexport function reconciledClosedEvent(\n  repository: ReconcileRepository,\n  pullRequestNumber: number,\n  state: ReconcilePullRequestState,\n): ParsedGithubWebhook {\n  return {\n    event: 'pull_request',\n    // Stable per (repository, PR, outcome): the ingress dedupe makes repeat\n    // reconcile cycles replay instead of re-committing decisions.\n    deliveryId: `reconcile:${repository.id}:pull-request:${pullRequestNumber}:${state.merged ? 'merged' : 'closed'}`,\n    payload: {\n      action: 'closed',\n      installation: { id: repository.installationId },\n      repository: { id: repository.id, full_name: repository.fullName },\n      sender: { login: state.mergedBy ?? 'github' },\n      pull_request: {\n        number: pullRequestNumber,\n        title: state.title,\n        html_url: state.url,\n        ...(state.createdAt ? { created_at: state.createdAt } : {}),\n        state: 'closed',\n        merged: state.merged,\n        head: { ref: state.headBranch },\n        base: { ref: state.baseBranch },\n      },\n    },\n  };\n}\n\n/**\n * The webhook handler retires subscriptions itself; the sweep replays only the\n * rules ingress, so without this the thread's PR chip and the workspace row\n * stay `open` forever on a deployment GitHub cannot reach.\n */\nasync function retireReconciledSubscriptions(\n  storage: IntegrationStorageHandle,\n  repository: ReconcileRepository,\n  pullRequestNumber: number,\n  merged: boolean,\n): Promise<void> {\n  const target = changeRequestTargetKey({\n    installationExternalId: String(repository.installationId),\n    repositoryExternalId: String(repository.id),\n    changeRequestId: String(pullRequestNumber),\n  });\n  const rows = await storage.subscriptions.listByTarget(target);\n  await Promise.all(\n    rows\n      .filter(row => row.status === 'open')\n      .map(row => storage.subscriptions.updateStatus(row.id, merged ? 'merged' : 'closed')),\n  );\n}\n\n/**\n * State-based safety net for merge signals: webhooks and event-log tailing\n * can miss a merge (cursor gaps, downtime, terminally failed decisions), so\n * this sweep compares still-open PR cards against actual GitHub state and\n * replays the merge through the normal rules ingress when they disagree.\n */\nexport function createGithubPullRequestReconciler(\n  options: GithubRulesOptions,\n  fetchPullRequest: GithubPullRequestFetcher,\n): GithubPullRequestReconciler {\n  const rules = new GithubRules(options);\n  return async repositories => {\n    const summary: ReconcileSweepSummary = { repositories: 0, checked: 0, merged: 0, closed: 0, failed: 0, errors: [] };\n    const recordFailure = (repository: ReconcileRepository, error: unknown, pullRequestNumber?: number) => {\n      summary.failed += 1;\n      if (summary.errors.length < RECONCILE_ERROR_SAMPLE_LIMIT) {\n        summary.errors.push({\n          repository: repository.fullName,\n          ...(pullRequestNumber === undefined ? {} : { pullRequestNumber }),\n          error: error instanceof Error ? error.message : String(error),\n        });\n      }\n    };\n    // An installation can expose hundreds of repositories; only the ones\n    // actually linked to a factory project can have cards to reconcile, so\n    // scope the sweep to those up front instead of probing each repository.\n    const configured = new Set(\n      (await options.sourceControl.projectRepositories.listConfiguredExternalKeys()).map(\n        key => `${key.installationExternalId}\\u0000${key.repositoryExternalId}`,\n      ),\n    );\n    const scoped = repositories.filter(repository =>\n      configured.has(`${repository.installationId}\\u0000${repository.id}`),\n    );\n    summary.repositories = scoped.length;\n    for (const repository of scoped) {\n      // One broken repository (or a failing token exchange for its\n      // installation) must not abort the sweep for the others.\n      let numbers: Set<number>;\n      try {\n        const projects = await options.sourceControl.projectRepositories.listByExternalRepository({\n          installationExternalId: String(repository.installationId),\n          repositoryExternalId: String(repository.id),\n        });\n        if (projects.length === 0) continue;\n        numbers = new Set<number>();\n        for (const project of projects) {\n          const items = await options.storage.list({\n            orgId: project.orgId,\n            factoryProjectId: project.factoryProjectId,\n          });\n          for (const item of items) {\n            const stage = item.stages[0];\n            if (stage === 'done' || stage === 'canceled') continue;\n            const pullRequestNumber = reconcilablePullRequestNumber(item, repository);\n            if (pullRequestNumber) numbers.add(pullRequestNumber);\n          }\n        }\n      } catch (error) {\n        recordFailure(repository, error);\n        continue;\n      }\n      for (const pullRequestNumber of numbers) {\n        try {\n          const state = await fetchPullRequest({\n            installationId: repository.installationId,\n            repository: repository.fullName,\n            number: pullRequestNumber,\n          });\n          summary.checked += 1;\n          if (!state || state.state !== 'closed') continue;\n          await rules.ingest(reconciledClosedEvent(repository, pullRequestNumber, state));\n          await retireReconciledSubscriptions(options.integrationStorage, repository, pullRequestNumber, state.merged);\n          if (state.merged) summary.merged += 1;\n          else summary.closed += 1;\n        } catch (error) {\n          recordFailure(repository, error, pullRequestNumber);\n        }\n      }\n    }\n    return summary;\n  };\n}\n\nfunction githubRulesOptions(\n  github: GithubRulesIntegration,\n  context: IntegrationContext,\n): GithubRulesOptions | undefined {\n  if (!context.rules) return undefined;\n  return {\n    github,\n    sourceControl: context.storage.sourceControl,\n    integrationStorage: context.storage.generic,\n    projects: context.storage.projects,\n    storage: context.rules.workItems,\n    rules: context.rules.config,\n  };\n}\n\nexport function attachGithubRules(\n  github: GithubRulesIntegration,\n  context: IntegrationContext,\n): ((event: ParsedGithubWebhook) => Promise<unknown>) | undefined {\n  const options = githubRulesOptions(github, context);\n  if (!options) return undefined;\n  const rules = new GithubRules(options);\n  return event => rules.ingest(event);\n}\n\nexport function attachGithubReconciler(\n  github: GithubRulesIntegration,\n  context: IntegrationContext,\n  fetchPullRequest: GithubPullRequestFetcher,\n): GithubPullRequestReconciler | undefined {\n  const options = githubRulesOptions(github, context);\n  if (!options) return undefined;\n  return createGithubPullRequestReconciler(options, fetchPullRequest);\n}\n"],"mappings":";;;;AAqBA,MAAM,sCAAsB,IAAI,IAAI,CAAC,SAAS,OAAO,CAAC;AACtD,MAAM,kBAAkB;AACxB,MAAM,gCAAgC;AAEtC,eAAe,gBAAmB,SAAiC;CACjE,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,SACA,IAAI,SAAgB,GAAG,WAAW;GAChC,UAAU,iBAAiB,uBAAO,IAAI,MAAM,sBAAsB,CAAC,GAAG,eAAe;EACvF,CAAC,CACH,CAAC;CACH,UAAU;EACR,IAAI,SAAS,aAAa,OAAO;CACnC;AACF;AAEA,SAAS,OAAO,OAAqD;CACnE,OAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAK,QAAoC,KAAA;AAC5G;AAEA,SAAS,OAAO,OAAoC;CAClD,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ,KAAA;AACjE;AAEA,SAAS,OAAO,OAAoC;CAClD,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,QAAQ,KAAA;AACvE;AAEA,SAAS,QAAQ,OAAqC;CACpD,OAAO,OAAO,UAAU,YAAY,QAAQ,KAAA;AAC9C;AAEA,SAAS,UAAU,QAAiE;CAClF,MAAM,SAAS,OAAO,OAAO,QAAQ,MAAM;CAC3C,IAAI,OAAO,UAAU,YAAY,WAAW,UAAU,OAAO;CAC7D,IAAI,OAAO,UAAU,YAAY,WAAW,UAAU;EACpD,MAAM,UAAU,OAAO,OAAO,QAAQ,OAAO;EAC7C,OAAO,OAAO,SAAS,KAAK,KAAK,OAAO,SAAS,IAAI,IAAI,gBAAgB,KAAA;CAC3E;CACA,IAAI,OAAO,UAAU,iBAAiB;EAEpC,IAAI,OADU,OAAO,OAAO,QAAQ,KACrB,CAAC,EAAE,YAAY,GAAG,OAAO,KAAA;EACxC,IAAI,WAAW,WAAW,OAAO;EACjC,IAAI,WAAW,UAAU,OAAO;EAChC,IAAI,WAAW,WAAW,OAAO;CACnC;CACA,IAAI,OAAO,UAAU,kBAAkB,WAAW,UAAU,OAAO;CACnE,IAAI,OAAO,UAAU,kBAAkB,WAAW,eAAe,OAAO;CACxE,IAAI,OAAO,UAAU,kBAAkB,WAAW,UAChD,OAAO,QAAQ,OAAO,OAAO,QAAQ,YAAY,CAAC,EAAE,MAAM,IAAI,sBAAsB;CAEtF,IAAI,OAAO,UAAU,kBAAkB,WAAW,oBAAoB,OAAO;AAE/E;AAEA,SAAS,mBAAmB,MAAgC,YAA4B;CACtF,OAAO,SAAS,UAAU,gBAAgB,eAAe,aAAa;AACxE;AAEA,SAAS,gBAAgB,cAAsB,MAAgC,YAA4B;CACzG,OAAO,UAAU,aAAa,GAAG,KAAK,GAAG;AAC3C;AAEA,SAAS,iBAAiB,cAAsB,mBAAmC;CACjF,OAAO,yBAAyB,aAAa,GAAG;AAClD;AAEA,SAAS,eAAe,MAAmB;CACzC,IAAI,CAAC,KAAK,gBAAgB,OAAO;CACjC,OAAO,KAAK,eAAe,SAAS,iBAAkB,cAAyB;AACjF;AAEA,SAAS,kBAAkB,MAAkC;CAC3D,OAAO,KAAK,gBAAgB,cAAc;AAC5C;AAEA,eAAe,YACb,QACA,OAC2B;CAC3B,IAAI,UAAU;CACd,IAAI;EACF,MAAM,aAAa,MAAM,OAAO,oCAC9B,MAAM,gBACN,MAAM,YACN,MAAM,KACR;EACA,UAAU,eAAe,KAAA,KAAa,oBAAoB,IAAI,UAAU;CAC1E,QAAQ;EACN,UAAU;CACZ;CACA,OAAO;EAAE,MAAM;EAAU,OAAO,MAAM;EAAO;EAAS,iBAAiB,MAAM;CAAgB;AAC/F;AAOA,SAAS,sBAAsB,MAAoF;CACjH,IAAI,CAAC,QAAQ,KAAK,SAAS,2BAA2B,OAAO,KAAK,eAAe,UAAU,OAAO;CAClG,OAAO;EAAE,MAAM;EAAyB,YAAY,KAAK;CAAW;AACtE;AAqBA,IAAa,cAAb,MAAyB;CACM;CAA7B,YAAY,SAA8C;EAA7B,KAAA,UAAA;CAA8B;CAE3D,MAAM,OAAO,QAAoG;EAC/G,MAAM,QAAQ,UAAU,MAAM;EAC9B,MAAM,aAAa,OAAO,OAAO,QAAQ,UAAU;EACnD,MAAM,iBAAiB,OAAO,OAAO,OAAO,QAAQ,YAAY,CAAC,EAAE,EAAE;EACrE,MAAM,eAAe,OAAO,YAAY,EAAE;EAC1C,MAAM,iBAAiB,OAAO,YAAY,SAAS;EACnD,MAAM,QAAQ,OAAO,OAAO,OAAO,QAAQ,MAAM,CAAC,EAAE,KAAK;EACzD,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,OAAO,OAAO,EAAE,QAAQ,UAAU;EAExG,MAAM,WAAW,MAAM,KAAK,QAAQ,cAAc,oBAAoB,yBAAyB;GAC7F,wBAAwB,OAAO,cAAc;GAC7C,sBAAsB,OAAO,YAAY;EAC3C,CAAC;EACD,IAAI,SAAS,WAAW,GAAG,OAAO,EAAE,QAAQ,UAAU;EACtD,MAAM,UAAU,CAAC;EACjB,KAAK,MAAM,WAAW,UACpB,QAAQ,KACN,MAAM,KAAKA,eAAe,QAAQ,OAAO,gBAAgB,cAAc,gBAAgB,OAAO,OAAO,CACvG;EAEF,IAAI,QAAQ,MAAK,WAAU,OAAO,WAAW,WAAW,GAAG,OAAO,EAAE,QAAQ,YAAY;EACxF,IAAI,QAAQ,MAAK,WAAU,OAAO,WAAW,UAAU,GAAG,OAAO,EAAE,QAAQ,WAAW;EACtF,OAAO,QAAQ,MAAM,EAAE,QAAQ,UAAU;CAC3C;CAEA,MAAMA,eACJ,QACA,OACA,gBACA,cACA,gBACA,OACA,SACuE;EACvE,MAAM,iBAAiB,MAAM,KAAK,QAAQ,SAAS,IAAI;GACrD,OAAO,QAAQ;GACf,IAAI,QAAQ;EACd,CAAC;EACD,IAAI,CAAC,gBAAgB,OAAO,EAAE,QAAQ,UAAU;EAChD,MAAM,QAAQ,OAAO,OAAO,QAAQ,KAAK;EACzC,MAAM,eAAe,OAAO,OAAO,QAAQ,OAAO;EAClD,MAAM,UAAU,OAAO,OAAO,QAAQ,OAAO;EAC7C,MAAM,cAAc,OAAO,OAAO,QAAQ,YAAY;EACtD,MAAM,cAAc,OAAO,OAAO,MAAM;EACxC,MAAM,oBAAoB,OAAO,aAAa,MAAM;EACpD,MAAM,aAAa,oBACf,uBAEI,MAAM,KAAK,QAAQ,mBAAmB,cAAc,aAClD,iBAAiB,cAAc,iBAAiB,GAChD,EAAE,QAAQ,SAAS,CACrB,EAAA,CACA,MAAK,iBAAgB,aAAa,UAAU,QAAQ,KAAK,CAAC,EAAE,IAChE,IACA;EACJ,MAAM,cAAc,MAAM,KAAKC,aAC7B,QAAQ,OACR,QAAQ,kBACR,cACA,aACA,mBACA,OAAO,OAAO,aAAa,IAAI,CAAC,EAAE,GAAG,GACrC,UACF;EACA,MAAM,QAAQ,MAAM,YAAY,KAAK,QAAQ,QAAQ;GACnD;GACA,YAAY;GACZ;GACA,iBAAiB,eAAe,QAAQ,UAAU,GAAG,KAAK,QAAQ,OAAO,KAAK;EAChF,CAAC;EACD,IACE,MAAM,SAAS,YACf,MAAM,oBACL,UAAU,yBAAyB,UAAU,yBAC9C,OAAO,cAAc,IAAI,CAAC,EAAE,SAAS,6BAA6B,GAElE,OAAO,EAAE,QAAQ,UAAU;EAE7B,MAAM,UAAoC;GACxC,QAAQ;IAAE,OAAO,QAAQ;IAAO,WAAW,QAAQ;GAAiB;GACpE;GACA,SAAS;IAAE,MAAM;IAAU,IAAI,GAAG,eAAe,GAAG,OAAO;GAAa;GACxE,OAAO,UAAU;GACjB,aAAa,CAAC;GACd,gBAAgB,KAAK,QAAQ,MAAM;GACnC,GAAI,cACA;IACE,MAAM;KACJ,IAAI,YAAY;KAChB,QAAQ,eAAe,WAAW;KAClC,WAAW,kBAAkB,WAAW;KACxC,kBAAkB,YAAY;KAC9B,OAAO,YAAY;KACnB,KAAK,YAAY,gBAAgB,OAAO;KACxC,QAAQ,YAAY;IACtB;IACA,OAAO,YAAY,gBAAgB,SAAS,iBAAkB,WAAsB;IACpF,cAAc,YAAY;GAC5B,IACA,CAAC;GACL;GACA,YAAY,OAAO;GACnB,SAAS,EAAE,WAAW,eAAe,UAAU,YAAY,EAAE;GAC7D,YAAY;IAAE,IAAI;IAAc,UAAU;GAAe;GACzD,GAAI,eAAe,OAAO,OAAO,KAAK,KAAK,OAAO,OAAO,QAAQ,IAC7D,EACE,OAAO;IACL,QAAQ;IACR,OAAO,OAAO,OAAO,KAAK;IAC1B,KAAK,OAAO,OAAO,QAAQ;IAC3B,GAAI,OAAO,OAAO,UAAU,IAAI,EAAE,WAAW,OAAO,OAAO,UAAU,EAAE,IAAI,CAAC;IAC5E,GAAI,OAAO,OAAO,UAAU,IAAI,EAAE,WAAW,OAAO,OAAO,UAAU,EAAE,IAAI,CAAC;GAC9E,EACF,IACA,CAAC;GACL,GAAI,UAAU,gBACV,EAAE,aAAa;IAAE,OAAO,QAAQ,OAAO,SAAS,KAAK,CAAC;IAAG,MAAM,QAAQ,OAAO,SAAS,IAAI,CAAC;GAAE,EAAE,IAChG,CAAC;GACL,GAAI,OAAO,cAAc,EAAE,IACvB,EACE,cAAc;IACZ,IAAI,OAAO,cAAc,EAAE;IAC3B,GAAI,OAAO,cAAc,IAAI,IAAI,EAAE,MAAM,OAAO,cAAc,IAAI,EAAE,IAAI,CAAC;IACzE,GAAI,OAAO,cAAc,QAAQ,IAAI,EAAE,KAAK,OAAO,cAAc,QAAQ,EAAE,IAAI,CAAC;IAChF,GAAI,OAAO,OAAO,cAAc,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,QAAQ,OAAO,OAAO,cAAc,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC;IACzG,GAAI,OAAO,OAAO,cAAc,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,YAAY,OAAO,OAAO,cAAc,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC;IAC3G,GAAI,OAAO,cAAc,UAAU,IAAI,EAAE,WAAW,OAAO,cAAc,UAAU,EAAE,IAAI,CAAC;IAC1F,GAAI,OAAO,cAAc,UAAU,IAAI,EAAE,WAAW,OAAO,cAAc,UAAU,EAAE,IAAI,CAAC;GAC5F,EACF,IACA,CAAC;GACL,GAAI,qBAAqB,OAAO,aAAa,KAAK,KAAK,OAAO,aAAa,QAAQ,IAC/E,EACE,aAAa;IACX,QAAQ;IACR,OAAO,OAAO,aAAa,KAAK;IAChC,KAAK,OAAO,aAAa,QAAQ;IACjC,GAAI,OAAO,aAAa,UAAU,IAAI,EAAE,WAAW,OAAO,aAAa,UAAU,EAAE,IAAI,CAAC;IACxF,OAAO,OAAO,aAAa,KAAK,MAAM,WAAY,WAAsB;IACxE,QAAQ,QAAQ,aAAa,MAAM,KAAK;IACxC,YAAY,OAAO,OAAO,aAAa,IAAI,CAAC,EAAE,GAAG,KAAK;IACtD,YAAY,OAAO,OAAO,aAAa,IAAI,CAAC,EAAE,GAAG,KAAK;GACxD,EACF,IACA,CAAC;GACL,GAAI,OAAO,OAAO,QAAQ,MAAM,IAC5B,EACE,QAAQ;IACN,IAAI,OAAO,OAAO,OAAO,QAAQ,MAAM,CAAC,EAAE,EAAE,KAAK;IACjD,OAAO,OAAO,OAAO,OAAO,QAAQ,MAAM,CAAC,EAAE,KAAK,KAAK;IACvD,KAAK,OAAO,OAAO,OAAO,QAAQ,MAAM,CAAC,EAAE,QAAQ,KAAK;GAC1D,EACF,IACA,CAAC;EACP;EAEA,MAAM,OAAO,yBAAyB,KAAK,QAAQ,OAAO,KAAK;EAC/D,IAAI;EACJ,IAAI,YAAuC,CAAC;EAC5C,IAAI,UAA+E,EAAE,QAAQ,WAAW;EACxG,IAAI;GACF,WAAW,OAAO,MAAM,gBAAgB,QAAQ,QAAQ,KAAK,OAAO,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,KAAA;GACzF,IAAI,UAAU,SAAS,UACrB,UAAU;IAAE,QAAQ;IAAY,MAAM,SAAS;IAAM,QAAQ,SAAS;GAAO;QACxE,IAAI,UACT,YAAY,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAI,WAAU,EAAE,GAAG,MAAM,EAAE;EAEpF,SAAS,OAAO;GACd,MAAM,WAAW,iBAAiB,SAAS,MAAM,YAAY;GAC7D,UAAU;IACR,QAAQ;IACR,MAAM,WAAW,YAAY;IAC7B,QAAQ,WACJ,uCACA,iBAAiB,QACf,MAAM,QAAQ,MAAM,GAAG,GAAK,IAC5B;GACR;EACF;EAeA,OAAO,EAAE,SAAQ,MAbO,KAAK,QAAQ,QAAQ,qBAAqB;GAChE,OAAO,QAAQ;GACf,kBAAkB,QAAQ;GAC1B,YAAY,aAAa,MAAM;GAC/B,SAAS;IAAE,UAAU,GAAG,eAAe,GAAG,OAAO;IAAc,aAAa,UAAU;GAAQ;GAC9F,gBAAgB,KAAK,QAAQ,MAAM;GACnC,kBAAkB,aAAa,YAAY;GAC3C,OAAO,EAAE,GAAG,MAAM;GAClB;GACA;GACA,aAAa,CAAC;GACd,qBAAK,IAAI,KAAK;EAChB,CAAC,EAAA,CAC0B,OAAO;CACpC;CAEA,MAAMA,aACJ,OACA,WACA,cACA,aACA,mBACA,uBACA,YACkC;EAClC,MAAM,QAAQ,MAAM,KAAK,QAAQ,QAAQ,KAAK;GAAE;GAAO,kBAAkB;EAAU,CAAC;EACpF,IAAI,YAAY,OAAO,MAAM,MAAK,SAAQ,KAAK,OAAO,WAAW,UAAU;EAC3E,IAAI,aACF,OACE,MAAM,MAAK,SAAQ,KAAK,gBAAgB,eAAe,mBAAmB,SAAS,WAAW,CAAC,KAC/F,MAAM,MAAK,SAAQ,KAAK,gBAAgB,eAAe,gBAAgB,cAAc,SAAS,WAAW,CAAC;EAG9G,IAAI,mBACF,OACE,MAAM,MAAK,SAAQ,KAAK,gBAAgB,eAAe,mBAAmB,gBAAgB,iBAAiB,CAAC,KAC5G,MAAM,MACJ,SAAQ,KAAK,gBAAgB,eAAe,gBAAgB,cAAc,gBAAgB,iBAAiB,CAC7G,MAMC,wBACG,MAAM,MACJ,SACE,KAAK,gBAAgB,SAAS,kBAC9B,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,MAAK,YAAW,QAAQ,WAAW,qBAAqB,CACzF,IACA,KAAA;CAIV;AACF;AA0CA,MAAM,+BAA+B;;;;;;;;;AAUrC,SAAS,8BAA8B,MAAmB,YAAqD;CAC7G,IAAI,KAAK,gBAAgB,SAAS,gBAAgB,OAAO,KAAA;CACzD,MAAM,MAAM,KAAK,eAAe;CAChC,IAAI,KAAK;EACP,MAAM,QAAQ,kDAAkD,KAAK,GAAG;EACxE,IAAI,CAAC,OAAO,OAAO,KAAA;EACnB,OAAO,MAAM,OAAO,WAAW,WAAW,OAAO,MAAM,EAAE,IAAI,KAAA;CAC/D;CACA,MAAM,aAAa,KAAK,eAAe;CACvC,MAAM,SAAS,oCAAoC,KAAK,UAAU;CAClE,IAAI,QAAQ,OAAO,OAAO,OAAO,EAAE,MAAM,WAAW,KAAK,OAAO,OAAO,EAAE,IAAI,KAAA;CAC7E,MAAM,YAAY,oBAAoB,KAAK,UAAU;CACrD,OAAO,YAAY,OAAO,UAAU,EAAE,IAAI,KAAA;AAC5C;AAEA,SAAgB,sBACd,YACA,mBACA,OACqB;CACrB,OAAO;EACL,OAAO;EAGP,YAAY,aAAa,WAAW,GAAG,gBAAgB,kBAAkB,GAAG,MAAM,SAAS,WAAW;EACtG,SAAS;GACP,QAAQ;GACR,cAAc,EAAE,IAAI,WAAW,eAAe;GAC9C,YAAY;IAAE,IAAI,WAAW;IAAI,WAAW,WAAW;GAAS;GAChE,QAAQ,EAAE,OAAO,MAAM,YAAY,SAAS;GAC5C,cAAc;IACZ,QAAQ;IACR,OAAO,MAAM;IACb,UAAU,MAAM;IAChB,GAAI,MAAM,YAAY,EAAE,YAAY,MAAM,UAAU,IAAI,CAAC;IACzD,OAAO;IACP,QAAQ,MAAM;IACd,MAAM,EAAE,KAAK,MAAM,WAAW;IAC9B,MAAM,EAAE,KAAK,MAAM,WAAW;GAChC;EACF;CACF;AACF;;;;;;AAOA,eAAe,8BACb,SACA,YACA,mBACA,QACe;CACf,MAAM,SAAS,uBAAuB;EACpC,wBAAwB,OAAO,WAAW,cAAc;EACxD,sBAAsB,OAAO,WAAW,EAAE;EAC1C,iBAAiB,OAAO,iBAAiB;CAC3C,CAAC;CACD,MAAM,OAAO,MAAM,QAAQ,cAAc,aAAa,MAAM;CAC5D,MAAM,QAAQ,IACZ,KACG,QAAO,QAAO,IAAI,WAAW,MAAM,CAAC,CACpC,KAAI,QAAO,QAAQ,cAAc,aAAa,IAAI,IAAI,SAAS,WAAW,QAAQ,CAAC,CACxF;AACF;;;;;;;AAQA,SAAgB,kCACd,SACA,kBAC6B;CAC7B,MAAM,QAAQ,IAAI,YAAY,OAAO;CACrC,OAAO,OAAM,iBAAgB;EAC3B,MAAM,UAAiC;GAAE,cAAc;GAAG,SAAS;GAAG,QAAQ;GAAG,QAAQ;GAAG,QAAQ;GAAG,QAAQ,CAAC;EAAE;EAClH,MAAM,iBAAiB,YAAiC,OAAgB,sBAA+B;GACrG,QAAQ,UAAU;GAClB,IAAI,QAAQ,OAAO,SAAS,8BAC1B,QAAQ,OAAO,KAAK;IAClB,YAAY,WAAW;IACvB,GAAI,sBAAsB,KAAA,IAAY,CAAC,IAAI,EAAE,kBAAkB;IAC/D,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC9D,CAAC;EAEL;EAIA,MAAM,aAAa,IAAI,KACpB,MAAM,QAAQ,cAAc,oBAAoB,2BAA2B,EAAA,CAAG,KAC7E,QAAO,GAAG,IAAI,uBAAuB,QAAQ,IAAI,sBACnD,CACF;EACA,MAAM,SAAS,aAAa,QAAO,eACjC,WAAW,IAAI,GAAG,WAAW,eAAe,QAAQ,WAAW,IAAI,CACrE;EACA,QAAQ,eAAe,OAAO;EAC9B,KAAK,MAAM,cAAc,QAAQ;GAG/B,IAAI;GACJ,IAAI;IACF,MAAM,WAAW,MAAM,QAAQ,cAAc,oBAAoB,yBAAyB;KACxF,wBAAwB,OAAO,WAAW,cAAc;KACxD,sBAAsB,OAAO,WAAW,EAAE;IAC5C,CAAC;IACD,IAAI,SAAS,WAAW,GAAG;IAC3B,0BAAU,IAAI,IAAY;IAC1B,KAAK,MAAM,WAAW,UAAU;KAC9B,MAAM,QAAQ,MAAM,QAAQ,QAAQ,KAAK;MACvC,OAAO,QAAQ;MACf,kBAAkB,QAAQ;KAC5B,CAAC;KACD,KAAK,MAAM,QAAQ,OAAO;MACxB,MAAM,QAAQ,KAAK,OAAO;MAC1B,IAAI,UAAU,UAAU,UAAU,YAAY;MAC9C,MAAM,oBAAoB,8BAA8B,MAAM,UAAU;MACxE,IAAI,mBAAmB,QAAQ,IAAI,iBAAiB;KACtD;IACF;GACF,SAAS,OAAO;IACd,cAAc,YAAY,KAAK;IAC/B;GACF;GACA,KAAK,MAAM,qBAAqB,SAC9B,IAAI;IACF,MAAM,QAAQ,MAAM,iBAAiB;KACnC,gBAAgB,WAAW;KAC3B,YAAY,WAAW;KACvB,QAAQ;IACV,CAAC;IACD,QAAQ,WAAW;IACnB,IAAI,CAAC,SAAS,MAAM,UAAU,UAAU;IACxC,MAAM,MAAM,OAAO,sBAAsB,YAAY,mBAAmB,KAAK,CAAC;IAC9E,MAAM,8BAA8B,QAAQ,oBAAoB,YAAY,mBAAmB,MAAM,MAAM;IAC3G,IAAI,MAAM,QAAQ,QAAQ,UAAU;SAC/B,QAAQ,UAAU;GACzB,SAAS,OAAO;IACd,cAAc,YAAY,OAAO,iBAAiB;GACpD;EAEJ;EACA,OAAO;CACT;AACF;AAEA,SAAS,mBACP,QACA,SACgC;CAChC,IAAI,CAAC,QAAQ,OAAO,OAAO,KAAA;CAC3B,OAAO;EACL;EACA,eAAe,QAAQ,QAAQ;EAC/B,oBAAoB,QAAQ,QAAQ;EACpC,UAAU,QAAQ,QAAQ;EAC1B,SAAS,QAAQ,MAAM;EACvB,OAAO,QAAQ,MAAM;CACvB;AACF;AAEA,SAAgB,kBACd,QACA,SACgE;CAChE,MAAM,UAAU,mBAAmB,QAAQ,OAAO;CAClD,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,MAAM,QAAQ,IAAI,YAAY,OAAO;CACrC,QAAO,UAAS,MAAM,OAAO,KAAK;AACpC;AAEA,SAAgB,uBACd,QACA,SACA,kBACyC;CACzC,MAAM,UAAU,mBAAmB,QAAQ,OAAO;CAClD,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,OAAO,kCAAkC,SAAS,gBAAgB;AACpE"}
+{"version":3,"file":"rules.js","names":["#ingestProject","#relatedItem"],"sources":["../../../src/integrations/github/rules.ts"],"sourcesContent":["import { resolveFactoryGithubRule } from '../../rules/resolve.js';\nimport type {\n  FactoryGithubEventName,\n  FactoryGithubRuleContext,\n  FactoryRuleActor,\n  FactoryRuleDecision,\n  FactoryRules,\n} from '../../rules/types.js';\nimport { validateFactoryRuleDecisions } from '../../rules/validation.js';\nimport type { IntegrationStorageHandle } from '../../storage/domains/integrations/base.js';\nimport type { FactoryProjectsStorage } from '../../storage/domains/projects/base.js';\nimport type {\n  ExternalRepositoryProjectTarget,\n  SourceControlStorageHandle,\n} from '../../storage/domains/source-control/base.js';\nimport type { WorkItemRow, WorkItemsStorage } from '../../storage/domains/work-items/base.js';\nimport type { IntegrationContext } from '../base.js';\nimport type { GithubRepositoryPermission } from './integration.js';\nimport { changeRequestTargetKey } from './subscriptions.js';\nimport type { ParsedGithubWebhook } from './webhook.js';\n\nconst TRUSTED_PERMISSIONS = new Set(['write', 'admin']);\nconst RULE_TIMEOUT_MS = 5_000;\nconst FACTORY_TRIAGE_COMMENT_MARKER = '<!-- mastra-factory-triage -->';\n\nasync function withRuleTimeout<T>(promise: Promise<T>): Promise<T> {\n  let timeout: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      promise,\n      new Promise<never>((_, reject) => {\n        timeout = setTimeout(() => reject(new Error('FACTORY_RULE_TIMEOUT')), RULE_TIMEOUT_MS);\n      }),\n    ]);\n  } finally {\n    if (timeout) clearTimeout(timeout);\n  }\n}\n\nfunction object(value: unknown): Record<string, unknown> | undefined {\n  return value && typeof value === 'object' && !Array.isArray(value) ? (value as Record<string, unknown>) : undefined;\n}\n\nfunction string(value: unknown): string | undefined {\n  return typeof value === 'string' && value.length > 0 ? value : undefined;\n}\n\nfunction number(value: unknown): number | undefined {\n  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;\n}\n\nfunction boolean(value: unknown): boolean | undefined {\n  return typeof value === 'boolean' ? value : undefined;\n}\n\nfunction actorLogins(value: unknown): string[] {\n  if (!Array.isArray(value)) return [];\n  return value.flatMap(actor => {\n    const login = string(object(actor)?.login);\n    return login ? [login] : [];\n  });\n}\n\nfunction labelNames(value: unknown): string[] {\n  if (!Array.isArray(value)) return [];\n  return value.flatMap(label => {\n    if (typeof label === 'string') return label ? [label] : [];\n    const name = string(object(label)?.name);\n    return name ? [name] : [];\n  });\n}\n\nfunction eventName(parsed: ParsedGithubWebhook): FactoryGithubEventName | undefined {\n  const action = string(parsed.payload.action);\n  if (parsed.event === 'issues' && action === 'opened') return 'issueOpened';\n  if (parsed.event === 'issues' && action === 'edited') {\n    const changes = object(parsed.payload.changes);\n    return object(changes?.title) || object(changes?.body) ? 'issueEdited' : undefined;\n  }\n  if (parsed.event === 'issues' && action === 'closed') return 'issueClosed';\n  if (parsed.event === 'issue_comment') {\n    const issue = object(parsed.payload.issue);\n    if (object(issue?.pull_request)) return undefined;\n    if (action === 'created') return 'issueCommentCreated';\n    if (action === 'edited') return 'issueCommentEdited';\n    if (action === 'deleted') return 'issueCommentDeleted';\n  }\n  if (parsed.event === 'pull_request' && action === 'opened') return 'pullRequestOpened';\n  if (parsed.event === 'pull_request' && action === 'synchronize') return 'pullRequestUpdated';\n  if (parsed.event === 'pull_request' && action === 'closed') {\n    return boolean(object(parsed.payload.pull_request)?.merged) ? 'pullRequestMerged' : 'pullRequestClosed';\n  }\n  if (parsed.event === 'pull_request' && action === 'review_requested') return 'pullRequestReviewRequested';\n  return undefined;\n}\n\n/**\n * Canonical source keys (`github-issue:N`, `github-pr:N`) do not identify a\n * repository, so a project linked to several repositories could bind repo A's\n * event to repo B's same-numbered card. The card's intake-stamped URL is\n * authoritative; the intake-stamped `githubRepositoryId` covers URL-less\n * cards. A card with neither signal cannot be attributed by number alone.\n */\nfunction cardBelongsToRepository(item: WorkItemRow, repositoryId: number, repositoryFullName: string): boolean {\n  const url = item.externalSource?.url;\n  if (url) {\n    const match = /^https?:\\/\\/[^/]+\\/(.+)\\/(?:issues|pull)\\/\\d+(?:[/?#]|$)/.exec(url);\n    if (match && match[1] === repositoryFullName) return true;\n  }\n  // A renamed repository leaves the old owner/name in the card URL, so a URL\n  // mismatch still defers to the stable intake-stamped repository id.\n  return item.metadata?.githubRepositoryId === repositoryId;\n}\n\nfunction canonicalSourceKey(kind: 'issue' | 'pull-request', itemNumber: number): string {\n  return kind === 'issue' ? `github-issue:${itemNumber}` : `github-pr:${itemNumber}`;\n}\n\nfunction legacySourceKey(repositoryId: number, kind: 'issue' | 'pull-request', itemNumber: number): string {\n  return `github:${repositoryId}:${kind}:${itemNumber}`;\n}\n\nfunction provenanceTarget(repositoryId: number, pullRequestNumber: number): string {\n  return `factory-pr-provenance:${repositoryId}:${pullRequestNumber}`;\n}\n\nfunction workItemSource(item: WorkItemRow) {\n  if (!item.externalSource) return 'manual' as const;\n  return item.externalSource.type === 'pull-request' ? ('github-pr' as const) : ('github-issue' as const);\n}\n\nfunction workItemSourceKey(item: WorkItemRow): string | null {\n  return item.externalSource?.externalId ?? null;\n}\n\nasync function githubActor(\n  github: GithubRulesIntegration,\n  input: { installationId: number; repository: string; login: string; factoryAuthored: boolean },\n): Promise<FactoryRuleActor> {\n  let trusted = false;\n  try {\n    const permission = await github.getRepositoryCollaboratorPermission(\n      input.installationId,\n      input.repository,\n      input.login,\n    );\n    trusted = permission !== undefined && TRUSTED_PERMISSIONS.has(permission);\n  } catch {\n    trusted = false;\n  }\n  return { type: 'github', login: input.login, trusted, factoryAuthored: input.factoryAuthored };\n}\n\ninterface FactoryPullRequestProvenanceData {\n  kind: 'factory-pr-provenance';\n  workItemId: string;\n}\n\nfunction pullRequestProvenance(data: Record<string, unknown> | undefined): FactoryPullRequestProvenanceData | null {\n  if (!data || data.kind !== 'factory-pr-provenance' || typeof data.workItemId !== 'string') return null;\n  return { kind: 'factory-pr-provenance', workItemId: data.workItemId };\n}\n\nexport interface GithubRulesIntegration {\n  readonly slug?: string;\n  getRepositoryCollaboratorPermission(\n    installationId: number,\n    repoFullName: string,\n    username: string,\n  ): Promise<GithubRepositoryPermission | undefined>;\n}\n\nexport interface GithubRulesOptions {\n  github: GithubRulesIntegration;\n  sourceControl: SourceControlStorageHandle;\n  /** Integration-scoped storage; provenance rows are validated at read. */\n  integrationStorage: IntegrationStorageHandle;\n  projects: FactoryProjectsStorage;\n  storage: WorkItemsStorage;\n  rules: FactoryRules;\n}\n\nexport class GithubRules {\n  constructor(private readonly options: GithubRulesOptions) {}\n\n  async ingest(parsed: ParsedGithubWebhook): Promise<{ status: 'ignored' | 'committed' | 'replayed' | 'missing' }> {\n    const event = eventName(parsed);\n    const repository = object(parsed.payload.repository);\n    const installationId = number(object(parsed.payload.installation)?.id);\n    const repositoryId = number(repository?.id);\n    const repositoryName = string(repository?.full_name);\n    const login = string(object(parsed.payload.sender)?.login);\n    if (!event || !installationId || !repositoryId || !repositoryName || !login) return { status: 'ignored' };\n\n    const projects = await this.options.sourceControl.projectRepositories.listByExternalRepository({\n      installationExternalId: String(installationId),\n      repositoryExternalId: String(repositoryId),\n    });\n    if (projects.length === 0) return { status: 'ignored' };\n    const results = [];\n    for (const project of projects) {\n      results.push(\n        await this.#ingestProject(parsed, event, installationId, repositoryId, repositoryName, login, project),\n      );\n    }\n    if (results.some(result => result.status === 'committed')) return { status: 'committed' };\n    if (results.some(result => result.status === 'replayed')) return { status: 'replayed' };\n    return results[0] ?? { status: 'ignored' };\n  }\n\n  async #ingestProject(\n    parsed: ParsedGithubWebhook,\n    event: FactoryGithubEventName,\n    installationId: number,\n    repositoryId: number,\n    repositoryName: string,\n    login: string,\n    project: ExternalRepositoryProjectTarget,\n  ): Promise<{ status: 'ignored' | 'committed' | 'replayed' | 'missing' }> {\n    const factoryProject = await this.options.projects.get({\n      orgId: project.orgId,\n      id: project.factoryProjectId,\n    });\n    if (!factoryProject) return { status: 'missing' };\n    const issue = object(parsed.payload.issue);\n    const issueComment = object(parsed.payload.comment);\n    const changes = object(parsed.payload.changes);\n    const pullRequest = object(parsed.payload.pull_request);\n    const issueNumber = number(issue?.number);\n    const pullRequestNumber = number(pullRequest?.number);\n    const provenance = pullRequestNumber\n      ? pullRequestProvenance(\n          (\n            await this.options.integrationStorage.subscriptions.listByTarget(\n              provenanceTarget(repositoryId, pullRequestNumber),\n              { status: 'active' },\n            )\n          ).find(subscription => subscription.orgId === project.orgId)?.data,\n        )\n      : null;\n    // A review re-request targets the PR's own Review card, not the Work item\n    // that provenance would bind the event to — and the sender is whoever\n    // clicked re-request, so a Factory-authored PR must not brand a human\n    // requester as factory-authored.\n    const reviewRequested = event === 'pullRequestReviewRequested';\n    const requestedReviewer = string(object(parsed.payload.requested_reviewer)?.login);\n    const relatedItem = await this.#relatedItem(\n      project.orgId,\n      project.factoryProjectId,\n      repositoryId,\n      repositoryName,\n      issueNumber,\n      pullRequestNumber,\n      string(object(pullRequest?.head)?.ref),\n      reviewRequested ? null : provenance,\n    );\n    const actor = await githubActor(this.options.github, {\n      installationId,\n      repository: repositoryName,\n      login,\n      factoryAuthored: (!reviewRequested && provenance !== null) || login === `${this.options.github.slug}[bot]`,\n    });\n    if (\n      actor.type === 'github' &&\n      actor.factoryAuthored &&\n      (event === 'issueCommentCreated' || event === 'issueCommentEdited') &&\n      string(issueComment?.body)?.includes(FACTORY_TRIAGE_COMMENT_MARKER)\n    ) {\n      return { status: 'ignored' };\n    }\n    const context: FactoryGithubRuleContext = {\n      tenant: { orgId: project.orgId, projectId: project.factoryProjectId },\n      actor,\n      ingress: { type: 'github', id: `${installationId}:${parsed.deliveryId}` },\n      cause: `github.${event}`,\n      causalChain: [],\n      ruleSetVersion: this.options.rules.version,\n      ...(relatedItem\n        ? {\n            item: {\n              id: relatedItem.id,\n              source: workItemSource(relatedItem),\n              sourceKey: workItemSourceKey(relatedItem),\n              parentWorkItemId: relatedItem.parentWorkItemId,\n              title: relatedItem.title,\n              url: relatedItem.externalSource?.url ?? null,\n              stages: relatedItem.stages,\n            },\n            board: relatedItem.externalSource?.type === 'pull-request' ? ('review' as const) : ('work' as const),\n            itemRevision: relatedItem.revision,\n          }\n        : {}),\n      event,\n      deliveryId: parsed.deliveryId,\n      factory: { createdAt: factoryProject.createdAt.toISOString() },\n      repository: { id: repositoryId, fullName: repositoryName },\n      ...(issueNumber && string(issue?.title) && string(issue?.html_url)\n        ? {\n            issue: {\n              number: issueNumber,\n              title: string(issue?.title)!,\n              url: string(issue?.html_url)!,\n              ...(string(issue?.created_at) ? { createdAt: string(issue?.created_at) } : {}),\n              ...(string(issue?.updated_at) ? { updatedAt: string(issue?.updated_at) } : {}),\n              assignees: actorLogins(issue?.assignees),\n              labels: labelNames(issue?.labels),\n              ...(string(issue?.state) === 'closed' || string(issue?.state) === 'open'\n                ? { state: string(issue?.state) as 'open' | 'closed' }\n                : {}),\n              ...(string(issue?.state_reason) ? { stateReason: string(issue?.state_reason) } : {}),\n            },\n          }\n        : {}),\n      ...(event === 'issueEdited'\n        ? { issueChange: { title: Boolean(object(changes?.title)), body: Boolean(object(changes?.body)) } }\n        : {}),\n      ...(number(issueComment?.id)\n        ? {\n            issueComment: {\n              id: number(issueComment?.id)!,\n              ...(string(issueComment?.body) ? { body: string(issueComment?.body) } : {}),\n              ...(string(issueComment?.html_url) ? { url: string(issueComment?.html_url) } : {}),\n              ...(string(object(issueComment?.user)?.login) ? { author: string(object(issueComment?.user)?.login) } : {}),\n              ...(string(object(issueComment?.user)?.type) ? { authorType: string(object(issueComment?.user)?.type) } : {}),\n              ...(string(issueComment?.created_at) ? { createdAt: string(issueComment?.created_at) } : {}),\n              ...(string(issueComment?.updated_at) ? { updatedAt: string(issueComment?.updated_at) } : {}),\n            },\n          }\n        : {}),\n      ...(pullRequestNumber && string(pullRequest?.title) && string(pullRequest?.html_url)\n        ? {\n            pullRequest: {\n              number: pullRequestNumber,\n              title: string(pullRequest?.title)!,\n              url: string(pullRequest?.html_url)!,\n              ...(string(pullRequest?.created_at) ? { createdAt: string(pullRequest?.created_at) } : {}),\n              state: string(pullRequest?.state) === 'closed' ? ('closed' as const) : ('open' as const),\n              draft: boolean(pullRequest?.draft) ?? false,\n              merged: boolean(pullRequest?.merged) ?? false,\n              assignees: actorLogins(pullRequest?.assignees),\n              requestedReviewers: actorLogins(pullRequest?.requested_reviewers),\n              labels: labelNames(pullRequest?.labels),\n              headBranch: string(object(pullRequest?.head)?.ref) ?? '',\n              baseBranch: string(object(pullRequest?.base)?.ref) ?? '',\n            },\n          }\n        : {}),\n      ...(reviewRequested && requestedReviewer\n        ? {\n            reviewRequest: {\n              reviewer: requestedReviewer,\n              factoryReviewer: requestedReviewer === `${this.options.github.slug}[bot]`,\n            },\n          }\n        : {}),\n      ...(object(parsed.payload.review)\n        ? {\n            review: {\n              id: number(object(parsed.payload.review)?.id) ?? 0,\n              state: string(object(parsed.payload.review)?.state) ?? 'unknown',\n              url: string(object(parsed.payload.review)?.html_url) ?? '',\n            },\n          }\n        : {}),\n    };\n\n    const rule = resolveFactoryGithubRule(this.options.rules, event);\n    let decision: FactoryRuleDecision | void;\n    let decisions: Record<string, unknown>[] = [];\n    let outcome: { status: 'accepted' | 'rejected'; code?: string; reason?: string } = { status: 'accepted' };\n    try {\n      decision = rule ? await withRuleTimeout(Promise.resolve(rule(Object.freeze(context)))) : undefined;\n      if (decision?.type === 'reject') {\n        outcome = { status: 'rejected', code: decision.code, reason: decision.reason };\n      } else if (decision) {\n        decisions = validateFactoryRuleDecisions([decision]).map(entry => ({ ...entry }));\n      }\n    } catch (error) {\n      const timedOut = error instanceof Error && error.message === 'FACTORY_RULE_TIMEOUT';\n      outcome = {\n        status: 'rejected',\n        code: timedOut ? 'timeout' : 'rule_error',\n        reason: timedOut\n          ? 'Factory rule evaluation timed out.'\n          : error instanceof Error\n            ? error.message.slice(0, 2_000)\n            : 'Factory GitHub rule failed.',\n      };\n    }\n\n    const committed = await this.options.storage.commitRuleEvaluation({\n      orgId: project.orgId,\n      factoryProjectId: project.factoryProjectId,\n      workItemId: relatedItem?.id ?? null,\n      ingress: { identity: `${installationId}:${parsed.deliveryId}`, triggerType: `github.${event}` },\n      ruleSetVersion: this.options.rules.version,\n      expectedRevision: relatedItem?.revision ?? null,\n      actor: { ...actor },\n      outcome,\n      decisions,\n      causalChain: [],\n      now: new Date(),\n    });\n    return { status: committed.status };\n  }\n\n  async #relatedItem(\n    orgId: string,\n    projectId: string,\n    repositoryId: number,\n    repositoryFullName: string,\n    issueNumber: number | undefined,\n    pullRequestNumber: number | undefined,\n    pullRequestHeadBranch: string | undefined,\n    provenance: FactoryPullRequestProvenanceData | null,\n  ): Promise<WorkItemRow | undefined> {\n    const items = await this.options.storage.list({ orgId, factoryProjectId: projectId });\n    if (provenance) return items.find(item => item.id === provenance.workItemId);\n    if (issueNumber) {\n      return (\n        items.find(\n          item =>\n            item.externalSource?.externalId === canonicalSourceKey('issue', issueNumber) &&\n            cardBelongsToRepository(item, repositoryId, repositoryFullName),\n        ) ?? items.find(item => item.externalSource?.externalId === legacySourceKey(repositoryId, 'issue', issueNumber))\n      );\n    }\n    if (pullRequestNumber) {\n      return (\n        items.find(\n          item =>\n            item.externalSource?.externalId === canonicalSourceKey('pull-request', pullRequestNumber) &&\n            cardBelongsToRepository(item, repositoryId, repositoryFullName),\n        ) ??\n        items.find(\n          item => item.externalSource?.externalId === legacySourceKey(repositoryId, 'pull-request', pullRequestNumber),\n        ) ??\n        // Provenance fallback: a PR pushed from a work item's session branch\n        // belongs to that item even when no gh-pr-create provenance was\n        // recorded (session predating state seeding, or the PR was opened\n        // outside the tracked tool call). Session branches are per-item\n        // (`factory/issue-N`), so a head-branch match is unambiguous.\n        (pullRequestHeadBranch\n          ? items.find(\n              item =>\n                item.externalSource?.type !== 'pull-request' &&\n                Object.values(item.sessions).some(session => session.branch === pullRequestHeadBranch),\n            )\n          : undefined)\n      );\n    }\n    return undefined;\n  }\n}\n\nexport interface ReconcilePullRequestState {\n  title: string;\n  url: string;\n  state: 'open' | 'closed';\n  draft: boolean;\n  merged: boolean;\n  assignees?: string[];\n  requestedReviewers?: string[];\n  labels?: string[];\n  headBranch: string;\n  baseBranch: string;\n  author?: string;\n  createdAt?: string;\n  mergedBy?: string;\n}\n\nexport type GithubPullRequestFetcher = (input: {\n  installationId: number;\n  repository: string;\n  number: number;\n}) => Promise<ReconcilePullRequestState | undefined>;\n\nexport interface ReconcileIssueState {\n  title: string;\n  url: string;\n  state: 'open' | 'closed';\n  /** GitHub close reason: `completed`, `not_planned`, or `duplicate`. */\n  stateReason?: string;\n  assignees?: string[];\n  labels?: string[];\n  author?: string;\n  createdAt?: string;\n  updatedAt?: string;\n}\n\nexport type GithubIssueFetcher = (input: {\n  installationId: number;\n  repository: string;\n  number: number;\n}) => Promise<ReconcileIssueState | undefined>;\n\nexport interface ReconcileRepository {\n  id: number;\n  fullName: string;\n  installationId: number;\n}\n\nexport interface ReconcileSweepSummary {\n  /** Factory-configured repositories included in the sweep. */\n  repositories: number;\n  /** PRs whose live state was fetched from GitHub. */\n  checked: number;\n  /** Missed merges replayed through the rules ingress. */\n  merged: number;\n  /** Missed closes-without-merge replayed through the rules ingress. */\n  closed: number;\n  /** PRs/issues (or whole repositories) skipped because of an error. */\n  failed: number;\n  /** Error samples with context, capped at {@link RECONCILE_ERROR_SAMPLE_LIMIT}. */\n  errors: Array<{ repository: string; pullRequestNumber?: number; issueNumber?: number; error: string }>;\n}\n\nexport type GithubPullRequestReconciler = (repositories: ReconcileRepository[]) => Promise<ReconcileSweepSummary>;\n\nexport const RECONCILE_ERROR_SAMPLE_LIMIT = 5;\n\nexport function sameStrings(left: unknown, right: string[] | undefined): boolean {\n  if (right === undefined) return true;\n  if (!Array.isArray(left)) return false;\n  const leftValues = new Set(left.flatMap(value => (typeof value === 'string' ? [value] : [])));\n  const rightValues = new Set(right);\n  return leftValues.size === rightValues.size && [...leftValues].every(value => rightValues.has(value));\n}\n\n/**\n * Extracts the PR number a work item tracks, but only when the item belongs\n * to the given repository. Card URLs pin the repository unambiguously; the\n * legacy source key embeds the repository id. Canonical keys (`github-pr:N`)\n * carry no repository, so they are only trusted when the item has no URL —\n * a project mapped to multiple repositories must not reconcile one repo's\n * card against another repo's PR number.\n */\nfunction reconcilablePullRequestNumber(item: WorkItemRow, repository: ReconcileRepository): number | undefined {\n  if (item.externalSource?.type !== 'pull-request') return undefined;\n  const url = item.externalSource.url;\n  if (url) {\n    const match = /^https?:\\/\\/[^/]+\\/(.+)\\/pull\\/(\\d+)(?:[/?#]|$)/.exec(url);\n    if (!match) return undefined;\n    return match[1] === repository.fullName ? Number(match[2]) : undefined;\n  }\n  const externalId = item.externalSource.externalId;\n  const legacy = /^github:(\\d+):pull-request:(\\d+)$/.exec(externalId);\n  if (legacy) return Number(legacy[1]) === repository.id ? Number(legacy[2]) : undefined;\n  const canonical = /^github-pr:(\\d+)$/.exec(externalId);\n  return canonical ? Number(canonical[1]) : undefined;\n}\n\n/**\n * Extracts the issue number a work item tracks, but only when the item\n * belongs to the given repository. Stricter than\n * {@link reconcilablePullRequestNumber}: a canonical key with no URL is only\n * trusted when the intake-stamped `githubRepositoryId` confirms the\n * repository, because the sweep initiates closes on its own.\n */\nexport function reconcilableIssueNumber(item: WorkItemRow, repository: ReconcileRepository): number | undefined {\n  if (item.externalSource?.type !== 'issue') return undefined;\n  const url = item.externalSource.url;\n  if (url) {\n    const match = /^https?:\\/\\/[^/]+\\/(.+)\\/issues\\/(\\d+)(?:[/?#]|$)/.exec(url);\n    if (!match) return undefined;\n    // A renamed repository leaves the old owner/name in the card URL, so a\n    // URL mismatch still defers to the stable intake-stamped repository id.\n    const belongs = match[1] === repository.fullName || item.metadata?.githubRepositoryId === repository.id;\n    return belongs ? Number(match[2]) : undefined;\n  }\n  const externalId = item.externalSource.externalId;\n  const legacy = /^github:(\\d+):issue:(\\d+)$/.exec(externalId);\n  if (legacy) return Number(legacy[1]) === repository.id ? Number(legacy[2]) : undefined;\n  const canonical = /^github-issue:(\\d+)$/.exec(externalId);\n  if (!canonical) return undefined;\n  // Canonical keys carry no repository; only the intake-stamped repository id\n  // can attribute a URL-less card, and guessing would let a multi-repo\n  // project close repo B's card because repo A's same-numbered issue closed.\n  return item.metadata?.githubRepositoryId === repository.id ? Number(canonical[1]) : undefined;\n}\n\nexport function reconciledIssueClosedEvent(\n  repository: ReconcileRepository,\n  issueNumber: number,\n  state: ReconcileIssueState,\n): ParsedGithubWebhook {\n  return {\n    event: 'issues',\n    // Stable per (repository, issue): the ingress dedupe makes repeat\n    // reconcile cycles replay instead of re-committing decisions.\n    deliveryId: `reconcile:${repository.id}:issue:${issueNumber}:closed`,\n    payload: {\n      action: 'closed',\n      installation: { id: repository.installationId },\n      repository: { id: repository.id, full_name: repository.fullName },\n      sender: { login: state.author ?? 'github' },\n      issue: {\n        number: issueNumber,\n        title: state.title,\n        html_url: state.url,\n        state: 'closed',\n        ...(state.stateReason ? { state_reason: state.stateReason } : {}),\n        ...(state.createdAt ? { created_at: state.createdAt } : {}),\n        ...(state.updatedAt ? { updated_at: state.updatedAt } : {}),\n        assignees: (state.assignees ?? []).map(login => ({ login })),\n      },\n    },\n  };\n}\n\nexport function reconciledClosedEvent(\n  repository: ReconcileRepository,\n  pullRequestNumber: number,\n  state: ReconcilePullRequestState,\n): ParsedGithubWebhook {\n  return {\n    event: 'pull_request',\n    // Stable per (repository, PR, outcome): the ingress dedupe makes repeat\n    // reconcile cycles replay instead of re-committing decisions.\n    deliveryId: `reconcile:${repository.id}:pull-request:${pullRequestNumber}:${state.merged ? 'merged' : 'closed'}`,\n    payload: {\n      action: 'closed',\n      installation: { id: repository.installationId },\n      repository: { id: repository.id, full_name: repository.fullName },\n      sender: { login: state.mergedBy ?? 'github' },\n      pull_request: {\n        number: pullRequestNumber,\n        title: state.title,\n        html_url: state.url,\n        ...(state.createdAt ? { created_at: state.createdAt } : {}),\n        state: 'closed',\n        draft: state.draft,\n        merged: state.merged,\n        assignees: (state.assignees ?? []).map(login => ({ login })),\n        requested_reviewers: (state.requestedReviewers ?? []).map(login => ({ login })),\n        labels: (state.labels ?? []).map(name => ({ name })),\n        head: { ref: state.headBranch },\n        base: { ref: state.baseBranch },\n      },\n    },\n  };\n}\n\n/**\n * The webhook handler retires subscriptions itself; the sweep replays only the\n * rules ingress, so without this the thread's PR chip and the workspace row\n * stay `open` forever on a deployment GitHub cannot reach.\n */\nasync function retireReconciledSubscriptions(\n  storage: IntegrationStorageHandle,\n  repository: ReconcileRepository,\n  pullRequestNumber: number,\n  merged: boolean,\n): Promise<void> {\n  const target = changeRequestTargetKey({\n    installationExternalId: String(repository.installationId),\n    repositoryExternalId: String(repository.id),\n    changeRequestId: String(pullRequestNumber),\n  });\n  const rows = await storage.subscriptions.listByTarget(target);\n  await Promise.all(\n    rows\n      .filter(row => row.status === 'open')\n      .map(row => storage.subscriptions.updateStatus(row.id, merged ? 'merged' : 'closed')),\n  );\n}\n\n/**\n * State-based safety net for merge signals: webhooks and event-log tailing\n * can miss a merge (cursor gaps, downtime, terminally failed decisions), so\n * this sweep compares still-open PR cards against actual GitHub state and\n * replays the merge through the normal rules ingress when they disagree.\n */\nexport function createGithubPullRequestReconciler(\n  options: GithubRulesOptions,\n  fetchPullRequest: GithubPullRequestFetcher,\n): GithubPullRequestReconciler {\n  const rules = new GithubRules(options);\n  return async repositories => {\n    const summary: ReconcileSweepSummary = {\n      repositories: 0,\n      checked: 0,\n      merged: 0,\n      closed: 0,\n      failed: 0,\n      errors: [],\n    };\n    const recordFailure = (\n      repository: ReconcileRepository,\n      error: unknown,\n      pullRequestNumber?: number,\n    ) => {\n      summary.failed += 1;\n      if (summary.errors.length < RECONCILE_ERROR_SAMPLE_LIMIT) {\n        summary.errors.push({\n          repository: repository.fullName,\n          ...(pullRequestNumber === undefined ? {} : { pullRequestNumber }),\n          error: error instanceof Error ? error.message : String(error),\n        });\n      }\n    };\n    // An installation can expose hundreds of repositories; only the ones\n    // actually linked to a factory project can have cards to reconcile, so\n    // scope the sweep to those up front instead of probing each repository.\n    const configured = new Set(\n      (await options.sourceControl.projectRepositories.listConfiguredExternalKeys()).map(\n        key => `${key.installationExternalId}\\u0000${key.repositoryExternalId}`,\n      ),\n    );\n    const scoped = repositories.filter(repository =>\n      configured.has(`${repository.installationId}\\u0000${repository.id}`),\n    );\n    summary.repositories = scoped.length;\n    for (const repository of scoped) {\n      // One broken repository (or a failing token exchange for its\n      // installation) must not abort the sweep for the others.\n      let cardsByNumber: Map<number, WorkItemRow[]>;\n      try {\n        const projects = await options.sourceControl.projectRepositories.listByExternalRepository({\n          installationExternalId: String(repository.installationId),\n          repositoryExternalId: String(repository.id),\n        });\n        if (projects.length === 0) continue;\n        cardsByNumber = new Map<number, WorkItemRow[]>();\n        for (const project of projects) {\n          const items = await options.storage.list({\n            orgId: project.orgId,\n            factoryProjectId: project.factoryProjectId,\n          });\n          for (const item of items) {\n            const stage = item.stages[0];\n            const pullRequestNumber = reconcilablePullRequestNumber(item, repository);\n            if (!pullRequestNumber) continue;\n            const metadata = item.metadata ?? {};\n            const hasReconciledMetadata =\n              (metadata.state === 'open' || metadata.state === 'closed') &&\n              typeof metadata.draft === 'boolean' &&\n              typeof metadata.merged === 'boolean' &&\n              typeof metadata.author === 'string' &&\n              Array.isArray(metadata.assignees) &&\n              Array.isArray(metadata.requestedReviewers) &&\n              Array.isArray(metadata.labels);\n            if ((stage === 'done' || stage === 'canceled') && hasReconciledMetadata) continue;\n            const cards = cardsByNumber.get(pullRequestNumber) ?? [];\n            cards.push(item);\n            cardsByNumber.set(pullRequestNumber, cards);\n          }\n        }\n      } catch (error) {\n        recordFailure(repository, error);\n        continue;\n      }\n      for (const [pullRequestNumber, cards] of cardsByNumber) {\n        try {\n          const state = await fetchPullRequest({\n            installationId: repository.installationId,\n            repository: repository.fullName,\n            number: pullRequestNumber,\n          });\n          summary.checked += 1;\n          if (!state) continue;\n          for (const card of cards) {\n            const metadata = card.metadata ?? {};\n            const statusChanged =\n              metadata.state !== state.state || metadata.draft !== state.draft || metadata.merged !== state.merged;\n            const authorChanged = state.author !== undefined && metadata.author !== state.author;\n            const assigneesChanged = !sameStrings(metadata.assignees, state.assignees);\n            const reviewersChanged = !sameStrings(metadata.requestedReviewers, state.requestedReviewers);\n            const labelsChanged = !sameStrings(metadata.labels, state.labels);\n            if (!statusChanged && !authorChanged && !assigneesChanged && !reviewersChanged && !labelsChanged) continue;\n            try {\n              await options.storage.update({\n                orgId: card.orgId,\n                id: card.id,\n                userId: 'factory-rule-dispatcher',\n                patch: {\n                  metadata: {\n                    state: state.state,\n                    draft: state.draft,\n                    merged: state.merged,\n                    ...(state.author ? { author: state.author } : {}),\n                    ...(state.assignees ? { assignees: state.assignees } : {}),\n                    ...(state.requestedReviewers ? { requestedReviewers: state.requestedReviewers } : {}),\n                    ...(state.labels ? { labels: state.labels } : {}),\n                  },\n                },\n              });\n            } catch (error) {\n              recordFailure(repository, error, pullRequestNumber);\n            }\n          }\n          if (state.state !== 'closed') continue;\n          await rules.ingest(reconciledClosedEvent(repository, pullRequestNumber, state));\n          await retireReconciledSubscriptions(options.integrationStorage, repository, pullRequestNumber, state.merged);\n          if (state.merged) summary.merged += 1;\n          else summary.closed += 1;\n        } catch (error) {\n          recordFailure(repository, error, pullRequestNumber);\n        }\n      }\n    }\n    return summary;\n  };\n}\n\nexport function githubRulesOptions(\n  github: GithubRulesIntegration,\n  context: IntegrationContext,\n): GithubRulesOptions | undefined {\n  if (!context.rules) return undefined;\n  return {\n    github,\n    sourceControl: context.storage.sourceControl,\n    integrationStorage: context.storage.generic,\n    projects: context.storage.projects,\n    storage: context.rules.workItems,\n    rules: context.rules.config,\n  };\n}\n\nexport function attachGithubRules(\n  github: GithubRulesIntegration,\n  context: IntegrationContext,\n): ((event: ParsedGithubWebhook) => Promise<unknown>) | undefined {\n  const options = githubRulesOptions(github, context);\n  if (!options) return undefined;\n  const rules = new GithubRules(options);\n  return event => rules.ingest(event);\n}\n\nexport function attachGithubReconciler(\n  github: GithubRulesIntegration,\n  context: IntegrationContext,\n  fetchPullRequest: GithubPullRequestFetcher,\n): GithubPullRequestReconciler | undefined {\n  const options = githubRulesOptions(github, context);\n  if (!options) return undefined;\n  return createGithubPullRequestReconciler(options, fetchPullRequest);\n}\n"],"mappings":";;;;AAqBA,MAAM,sCAAsB,IAAI,IAAI,CAAC,SAAS,OAAO,CAAC;AACtD,MAAM,kBAAkB;AACxB,MAAM,gCAAgC;AAEtC,eAAe,gBAAmB,SAAiC;CACjE,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,SACA,IAAI,SAAgB,GAAG,WAAW;GAChC,UAAU,iBAAiB,uBAAO,IAAI,MAAM,sBAAsB,CAAC,GAAG,eAAe;EACvF,CAAC,CACH,CAAC;CACH,UAAU;EACR,IAAI,SAAS,aAAa,OAAO;CACnC;AACF;AAEA,SAAS,OAAO,OAAqD;CACnE,OAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAK,QAAoC,KAAA;AAC5G;AAEA,SAAS,OAAO,OAAoC;CAClD,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ,KAAA;AACjE;AAEA,SAAS,OAAO,OAAoC;CAClD,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,QAAQ,KAAA;AACvE;AAEA,SAAS,QAAQ,OAAqC;CACpD,OAAO,OAAO,UAAU,YAAY,QAAQ,KAAA;AAC9C;AAEA,SAAS,YAAY,OAA0B;CAC7C,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,OAAO,CAAC;CACnC,OAAO,MAAM,SAAQ,UAAS;EAC5B,MAAM,QAAQ,OAAO,OAAO,KAAK,CAAC,EAAE,KAAK;EACzC,OAAO,QAAQ,CAAC,KAAK,IAAI,CAAC;CAC5B,CAAC;AACH;AAEA,SAAS,WAAW,OAA0B;CAC5C,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,OAAO,CAAC;CACnC,OAAO,MAAM,SAAQ,UAAS;EAC5B,IAAI,OAAO,UAAU,UAAU,OAAO,QAAQ,CAAC,KAAK,IAAI,CAAC;EACzD,MAAM,OAAO,OAAO,OAAO,KAAK,CAAC,EAAE,IAAI;EACvC,OAAO,OAAO,CAAC,IAAI,IAAI,CAAC;CAC1B,CAAC;AACH;AAEA,SAAS,UAAU,QAAiE;CAClF,MAAM,SAAS,OAAO,OAAO,QAAQ,MAAM;CAC3C,IAAI,OAAO,UAAU,YAAY,WAAW,UAAU,OAAO;CAC7D,IAAI,OAAO,UAAU,YAAY,WAAW,UAAU;EACpD,MAAM,UAAU,OAAO,OAAO,QAAQ,OAAO;EAC7C,OAAO,OAAO,SAAS,KAAK,KAAK,OAAO,SAAS,IAAI,IAAI,gBAAgB,KAAA;CAC3E;CACA,IAAI,OAAO,UAAU,YAAY,WAAW,UAAU,OAAO;CAC7D,IAAI,OAAO,UAAU,iBAAiB;EAEpC,IAAI,OADU,OAAO,OAAO,QAAQ,KACrB,CAAC,EAAE,YAAY,GAAG,OAAO,KAAA;EACxC,IAAI,WAAW,WAAW,OAAO;EACjC,IAAI,WAAW,UAAU,OAAO;EAChC,IAAI,WAAW,WAAW,OAAO;CACnC;CACA,IAAI,OAAO,UAAU,kBAAkB,WAAW,UAAU,OAAO;CACnE,IAAI,OAAO,UAAU,kBAAkB,WAAW,eAAe,OAAO;CACxE,IAAI,OAAO,UAAU,kBAAkB,WAAW,UAChD,OAAO,QAAQ,OAAO,OAAO,QAAQ,YAAY,CAAC,EAAE,MAAM,IAAI,sBAAsB;CAEtF,IAAI,OAAO,UAAU,kBAAkB,WAAW,oBAAoB,OAAO;AAE/E;;;;;;;;AASA,SAAS,wBAAwB,MAAmB,cAAsB,oBAAqC;CAC7G,MAAM,MAAM,KAAK,gBAAgB;CACjC,IAAI,KAAK;EACP,MAAM,QAAQ,2DAA2D,KAAK,GAAG;EACjF,IAAI,SAAS,MAAM,OAAO,oBAAoB,OAAO;CACvD;CAGA,OAAO,KAAK,UAAU,uBAAuB;AAC/C;AAEA,SAAS,mBAAmB,MAAgC,YAA4B;CACtF,OAAO,SAAS,UAAU,gBAAgB,eAAe,aAAa;AACxE;AAEA,SAAS,gBAAgB,cAAsB,MAAgC,YAA4B;CACzG,OAAO,UAAU,aAAa,GAAG,KAAK,GAAG;AAC3C;AAEA,SAAS,iBAAiB,cAAsB,mBAAmC;CACjF,OAAO,yBAAyB,aAAa,GAAG;AAClD;AAEA,SAAS,eAAe,MAAmB;CACzC,IAAI,CAAC,KAAK,gBAAgB,OAAO;CACjC,OAAO,KAAK,eAAe,SAAS,iBAAkB,cAAyB;AACjF;AAEA,SAAS,kBAAkB,MAAkC;CAC3D,OAAO,KAAK,gBAAgB,cAAc;AAC5C;AAEA,eAAe,YACb,QACA,OAC2B;CAC3B,IAAI,UAAU;CACd,IAAI;EACF,MAAM,aAAa,MAAM,OAAO,oCAC9B,MAAM,gBACN,MAAM,YACN,MAAM,KACR;EACA,UAAU,eAAe,KAAA,KAAa,oBAAoB,IAAI,UAAU;CAC1E,QAAQ;EACN,UAAU;CACZ;CACA,OAAO;EAAE,MAAM;EAAU,OAAO,MAAM;EAAO;EAAS,iBAAiB,MAAM;CAAgB;AAC/F;AAOA,SAAS,sBAAsB,MAAoF;CACjH,IAAI,CAAC,QAAQ,KAAK,SAAS,2BAA2B,OAAO,KAAK,eAAe,UAAU,OAAO;CAClG,OAAO;EAAE,MAAM;EAAyB,YAAY,KAAK;CAAW;AACtE;AAqBA,IAAa,cAAb,MAAyB;CACM;CAA7B,YAAY,SAA8C;EAA7B,KAAA,UAAA;CAA8B;CAE3D,MAAM,OAAO,QAAoG;EAC/G,MAAM,QAAQ,UAAU,MAAM;EAC9B,MAAM,aAAa,OAAO,OAAO,QAAQ,UAAU;EACnD,MAAM,iBAAiB,OAAO,OAAO,OAAO,QAAQ,YAAY,CAAC,EAAE,EAAE;EACrE,MAAM,eAAe,OAAO,YAAY,EAAE;EAC1C,MAAM,iBAAiB,OAAO,YAAY,SAAS;EACnD,MAAM,QAAQ,OAAO,OAAO,OAAO,QAAQ,MAAM,CAAC,EAAE,KAAK;EACzD,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,OAAO,OAAO,EAAE,QAAQ,UAAU;EAExG,MAAM,WAAW,MAAM,KAAK,QAAQ,cAAc,oBAAoB,yBAAyB;GAC7F,wBAAwB,OAAO,cAAc;GAC7C,sBAAsB,OAAO,YAAY;EAC3C,CAAC;EACD,IAAI,SAAS,WAAW,GAAG,OAAO,EAAE,QAAQ,UAAU;EACtD,MAAM,UAAU,CAAC;EACjB,KAAK,MAAM,WAAW,UACpB,QAAQ,KACN,MAAM,KAAKA,eAAe,QAAQ,OAAO,gBAAgB,cAAc,gBAAgB,OAAO,OAAO,CACvG;EAEF,IAAI,QAAQ,MAAK,WAAU,OAAO,WAAW,WAAW,GAAG,OAAO,EAAE,QAAQ,YAAY;EACxF,IAAI,QAAQ,MAAK,WAAU,OAAO,WAAW,UAAU,GAAG,OAAO,EAAE,QAAQ,WAAW;EACtF,OAAO,QAAQ,MAAM,EAAE,QAAQ,UAAU;CAC3C;CAEA,MAAMA,eACJ,QACA,OACA,gBACA,cACA,gBACA,OACA,SACuE;EACvE,MAAM,iBAAiB,MAAM,KAAK,QAAQ,SAAS,IAAI;GACrD,OAAO,QAAQ;GACf,IAAI,QAAQ;EACd,CAAC;EACD,IAAI,CAAC,gBAAgB,OAAO,EAAE,QAAQ,UAAU;EAChD,MAAM,QAAQ,OAAO,OAAO,QAAQ,KAAK;EACzC,MAAM,eAAe,OAAO,OAAO,QAAQ,OAAO;EAClD,MAAM,UAAU,OAAO,OAAO,QAAQ,OAAO;EAC7C,MAAM,cAAc,OAAO,OAAO,QAAQ,YAAY;EACtD,MAAM,cAAc,OAAO,OAAO,MAAM;EACxC,MAAM,oBAAoB,OAAO,aAAa,MAAM;EACpD,MAAM,aAAa,oBACf,uBAEI,MAAM,KAAK,QAAQ,mBAAmB,cAAc,aAClD,iBAAiB,cAAc,iBAAiB,GAChD,EAAE,QAAQ,SAAS,CACrB,EAAA,CACA,MAAK,iBAAgB,aAAa,UAAU,QAAQ,KAAK,CAAC,EAAE,IAChE,IACA;EAKJ,MAAM,kBAAkB,UAAU;EAClC,MAAM,oBAAoB,OAAO,OAAO,OAAO,QAAQ,kBAAkB,CAAC,EAAE,KAAK;EACjF,MAAM,cAAc,MAAM,KAAKC,aAC7B,QAAQ,OACR,QAAQ,kBACR,cACA,gBACA,aACA,mBACA,OAAO,OAAO,aAAa,IAAI,CAAC,EAAE,GAAG,GACrC,kBAAkB,OAAO,UAC3B;EACA,MAAM,QAAQ,MAAM,YAAY,KAAK,QAAQ,QAAQ;GACnD;GACA,YAAY;GACZ;GACA,iBAAkB,CAAC,mBAAmB,eAAe,QAAS,UAAU,GAAG,KAAK,QAAQ,OAAO,KAAK;EACtG,CAAC;EACD,IACE,MAAM,SAAS,YACf,MAAM,oBACL,UAAU,yBAAyB,UAAU,yBAC9C,OAAO,cAAc,IAAI,CAAC,EAAE,SAAS,6BAA6B,GAElE,OAAO,EAAE,QAAQ,UAAU;EAE7B,MAAM,UAAoC;GACxC,QAAQ;IAAE,OAAO,QAAQ;IAAO,WAAW,QAAQ;GAAiB;GACpE;GACA,SAAS;IAAE,MAAM;IAAU,IAAI,GAAG,eAAe,GAAG,OAAO;GAAa;GACxE,OAAO,UAAU;GACjB,aAAa,CAAC;GACd,gBAAgB,KAAK,QAAQ,MAAM;GACnC,GAAI,cACA;IACE,MAAM;KACJ,IAAI,YAAY;KAChB,QAAQ,eAAe,WAAW;KAClC,WAAW,kBAAkB,WAAW;KACxC,kBAAkB,YAAY;KAC9B,OAAO,YAAY;KACnB,KAAK,YAAY,gBAAgB,OAAO;KACxC,QAAQ,YAAY;IACtB;IACA,OAAO,YAAY,gBAAgB,SAAS,iBAAkB,WAAsB;IACpF,cAAc,YAAY;GAC5B,IACA,CAAC;GACL;GACA,YAAY,OAAO;GACnB,SAAS,EAAE,WAAW,eAAe,UAAU,YAAY,EAAE;GAC7D,YAAY;IAAE,IAAI;IAAc,UAAU;GAAe;GACzD,GAAI,eAAe,OAAO,OAAO,KAAK,KAAK,OAAO,OAAO,QAAQ,IAC7D,EACE,OAAO;IACL,QAAQ;IACR,OAAO,OAAO,OAAO,KAAK;IAC1B,KAAK,OAAO,OAAO,QAAQ;IAC3B,GAAI,OAAO,OAAO,UAAU,IAAI,EAAE,WAAW,OAAO,OAAO,UAAU,EAAE,IAAI,CAAC;IAC5E,GAAI,OAAO,OAAO,UAAU,IAAI,EAAE,WAAW,OAAO,OAAO,UAAU,EAAE,IAAI,CAAC;IAC5E,WAAW,YAAY,OAAO,SAAS;IACvC,QAAQ,WAAW,OAAO,MAAM;IAChC,GAAI,OAAO,OAAO,KAAK,MAAM,YAAY,OAAO,OAAO,KAAK,MAAM,SAC9D,EAAE,OAAO,OAAO,OAAO,KAAK,EAAuB,IACnD,CAAC;IACL,GAAI,OAAO,OAAO,YAAY,IAAI,EAAE,aAAa,OAAO,OAAO,YAAY,EAAE,IAAI,CAAC;GACpF,EACF,IACA,CAAC;GACL,GAAI,UAAU,gBACV,EAAE,aAAa;IAAE,OAAO,QAAQ,OAAO,SAAS,KAAK,CAAC;IAAG,MAAM,QAAQ,OAAO,SAAS,IAAI,CAAC;GAAE,EAAE,IAChG,CAAC;GACL,GAAI,OAAO,cAAc,EAAE,IACvB,EACE,cAAc;IACZ,IAAI,OAAO,cAAc,EAAE;IAC3B,GAAI,OAAO,cAAc,IAAI,IAAI,EAAE,MAAM,OAAO,cAAc,IAAI,EAAE,IAAI,CAAC;IACzE,GAAI,OAAO,cAAc,QAAQ,IAAI,EAAE,KAAK,OAAO,cAAc,QAAQ,EAAE,IAAI,CAAC;IAChF,GAAI,OAAO,OAAO,cAAc,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,QAAQ,OAAO,OAAO,cAAc,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC;IACzG,GAAI,OAAO,OAAO,cAAc,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,YAAY,OAAO,OAAO,cAAc,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC;IAC3G,GAAI,OAAO,cAAc,UAAU,IAAI,EAAE,WAAW,OAAO,cAAc,UAAU,EAAE,IAAI,CAAC;IAC1F,GAAI,OAAO,cAAc,UAAU,IAAI,EAAE,WAAW,OAAO,cAAc,UAAU,EAAE,IAAI,CAAC;GAC5F,EACF,IACA,CAAC;GACL,GAAI,qBAAqB,OAAO,aAAa,KAAK,KAAK,OAAO,aAAa,QAAQ,IAC/E,EACE,aAAa;IACX,QAAQ;IACR,OAAO,OAAO,aAAa,KAAK;IAChC,KAAK,OAAO,aAAa,QAAQ;IACjC,GAAI,OAAO,aAAa,UAAU,IAAI,EAAE,WAAW,OAAO,aAAa,UAAU,EAAE,IAAI,CAAC;IACxF,OAAO,OAAO,aAAa,KAAK,MAAM,WAAY,WAAsB;IACxE,OAAO,QAAQ,aAAa,KAAK,KAAK;IACtC,QAAQ,QAAQ,aAAa,MAAM,KAAK;IACxC,WAAW,YAAY,aAAa,SAAS;IAC7C,oBAAoB,YAAY,aAAa,mBAAmB;IAChE,QAAQ,WAAW,aAAa,MAAM;IACtC,YAAY,OAAO,OAAO,aAAa,IAAI,CAAC,EAAE,GAAG,KAAK;IACtD,YAAY,OAAO,OAAO,aAAa,IAAI,CAAC,EAAE,GAAG,KAAK;GACxD,EACF,IACA,CAAC;GACL,GAAI,mBAAmB,oBACnB,EACE,eAAe;IACb,UAAU;IACV,iBAAiB,sBAAsB,GAAG,KAAK,QAAQ,OAAO,KAAK;GACrE,EACF,IACA,CAAC;GACL,GAAI,OAAO,OAAO,QAAQ,MAAM,IAC5B,EACE,QAAQ;IACN,IAAI,OAAO,OAAO,OAAO,QAAQ,MAAM,CAAC,EAAE,EAAE,KAAK;IACjD,OAAO,OAAO,OAAO,OAAO,QAAQ,MAAM,CAAC,EAAE,KAAK,KAAK;IACvD,KAAK,OAAO,OAAO,OAAO,QAAQ,MAAM,CAAC,EAAE,QAAQ,KAAK;GAC1D,EACF,IACA,CAAC;EACP;EAEA,MAAM,OAAO,yBAAyB,KAAK,QAAQ,OAAO,KAAK;EAC/D,IAAI;EACJ,IAAI,YAAuC,CAAC;EAC5C,IAAI,UAA+E,EAAE,QAAQ,WAAW;EACxG,IAAI;GACF,WAAW,OAAO,MAAM,gBAAgB,QAAQ,QAAQ,KAAK,OAAO,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,KAAA;GACzF,IAAI,UAAU,SAAS,UACrB,UAAU;IAAE,QAAQ;IAAY,MAAM,SAAS;IAAM,QAAQ,SAAS;GAAO;QACxE,IAAI,UACT,YAAY,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAI,WAAU,EAAE,GAAG,MAAM,EAAE;EAEpF,SAAS,OAAO;GACd,MAAM,WAAW,iBAAiB,SAAS,MAAM,YAAY;GAC7D,UAAU;IACR,QAAQ;IACR,MAAM,WAAW,YAAY;IAC7B,QAAQ,WACJ,uCACA,iBAAiB,QACf,MAAM,QAAQ,MAAM,GAAG,GAAK,IAC5B;GACR;EACF;EAeA,OAAO,EAAE,SAAQ,MAbO,KAAK,QAAQ,QAAQ,qBAAqB;GAChE,OAAO,QAAQ;GACf,kBAAkB,QAAQ;GAC1B,YAAY,aAAa,MAAM;GAC/B,SAAS;IAAE,UAAU,GAAG,eAAe,GAAG,OAAO;IAAc,aAAa,UAAU;GAAQ;GAC9F,gBAAgB,KAAK,QAAQ,MAAM;GACnC,kBAAkB,aAAa,YAAY;GAC3C,OAAO,EAAE,GAAG,MAAM;GAClB;GACA;GACA,aAAa,CAAC;GACd,qBAAK,IAAI,KAAK;EAChB,CAAC,EAAA,CAC0B,OAAO;CACpC;CAEA,MAAMA,aACJ,OACA,WACA,cACA,oBACA,aACA,mBACA,uBACA,YACkC;EAClC,MAAM,QAAQ,MAAM,KAAK,QAAQ,QAAQ,KAAK;GAAE;GAAO,kBAAkB;EAAU,CAAC;EACpF,IAAI,YAAY,OAAO,MAAM,MAAK,SAAQ,KAAK,OAAO,WAAW,UAAU;EAC3E,IAAI,aACF,OACE,MAAM,MACJ,SACE,KAAK,gBAAgB,eAAe,mBAAmB,SAAS,WAAW,KAC3E,wBAAwB,MAAM,cAAc,kBAAkB,CAClE,KAAK,MAAM,MAAK,SAAQ,KAAK,gBAAgB,eAAe,gBAAgB,cAAc,SAAS,WAAW,CAAC;EAGnH,IAAI,mBACF,OACE,MAAM,MACJ,SACE,KAAK,gBAAgB,eAAe,mBAAmB,gBAAgB,iBAAiB,KACxF,wBAAwB,MAAM,cAAc,kBAAkB,CAClE,KACA,MAAM,MACJ,SAAQ,KAAK,gBAAgB,eAAe,gBAAgB,cAAc,gBAAgB,iBAAiB,CAC7G,MAMC,wBACG,MAAM,MACJ,SACE,KAAK,gBAAgB,SAAS,kBAC9B,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,MAAK,YAAW,QAAQ,WAAW,qBAAqB,CACzF,IACA,KAAA;CAIV;AACF;AAkEA,MAAa,+BAA+B;AAE5C,SAAgB,YAAY,MAAe,OAAsC;CAC/E,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,IAAI,CAAC,MAAM,QAAQ,IAAI,GAAG,OAAO;CACjC,MAAM,aAAa,IAAI,IAAI,KAAK,SAAQ,UAAU,OAAO,UAAU,WAAW,CAAC,KAAK,IAAI,CAAC,CAAE,CAAC;CAC5F,MAAM,cAAc,IAAI,IAAI,KAAK;CACjC,OAAO,WAAW,SAAS,YAAY,QAAQ,CAAC,GAAG,UAAU,CAAC,CAAC,OAAM,UAAS,YAAY,IAAI,KAAK,CAAC;AACtG;;;;;;;;;AAUA,SAAS,8BAA8B,MAAmB,YAAqD;CAC7G,IAAI,KAAK,gBAAgB,SAAS,gBAAgB,OAAO,KAAA;CACzD,MAAM,MAAM,KAAK,eAAe;CAChC,IAAI,KAAK;EACP,MAAM,QAAQ,kDAAkD,KAAK,GAAG;EACxE,IAAI,CAAC,OAAO,OAAO,KAAA;EACnB,OAAO,MAAM,OAAO,WAAW,WAAW,OAAO,MAAM,EAAE,IAAI,KAAA;CAC/D;CACA,MAAM,aAAa,KAAK,eAAe;CACvC,MAAM,SAAS,oCAAoC,KAAK,UAAU;CAClE,IAAI,QAAQ,OAAO,OAAO,OAAO,EAAE,MAAM,WAAW,KAAK,OAAO,OAAO,EAAE,IAAI,KAAA;CAC7E,MAAM,YAAY,oBAAoB,KAAK,UAAU;CACrD,OAAO,YAAY,OAAO,UAAU,EAAE,IAAI,KAAA;AAC5C;;;;;;;;AASA,SAAgB,wBAAwB,MAAmB,YAAqD;CAC9G,IAAI,KAAK,gBAAgB,SAAS,SAAS,OAAO,KAAA;CAClD,MAAM,MAAM,KAAK,eAAe;CAChC,IAAI,KAAK;EACP,MAAM,QAAQ,oDAAoD,KAAK,GAAG;EAC1E,IAAI,CAAC,OAAO,OAAO,KAAA;EAInB,OADgB,MAAM,OAAO,WAAW,YAAY,KAAK,UAAU,uBAAuB,WAAW,KACpF,OAAO,MAAM,EAAE,IAAI,KAAA;CACtC;CACA,MAAM,aAAa,KAAK,eAAe;CACvC,MAAM,SAAS,6BAA6B,KAAK,UAAU;CAC3D,IAAI,QAAQ,OAAO,OAAO,OAAO,EAAE,MAAM,WAAW,KAAK,OAAO,OAAO,EAAE,IAAI,KAAA;CAC7E,MAAM,YAAY,uBAAuB,KAAK,UAAU;CACxD,IAAI,CAAC,WAAW,OAAO,KAAA;CAIvB,OAAO,KAAK,UAAU,uBAAuB,WAAW,KAAK,OAAO,UAAU,EAAE,IAAI,KAAA;AACtF;AAEA,SAAgB,2BACd,YACA,aACA,OACqB;CACrB,OAAO;EACL,OAAO;EAGP,YAAY,aAAa,WAAW,GAAG,SAAS,YAAY;EAC5D,SAAS;GACP,QAAQ;GACR,cAAc,EAAE,IAAI,WAAW,eAAe;GAC9C,YAAY;IAAE,IAAI,WAAW;IAAI,WAAW,WAAW;GAAS;GAChE,QAAQ,EAAE,OAAO,MAAM,UAAU,SAAS;GAC1C,OAAO;IACL,QAAQ;IACR,OAAO,MAAM;IACb,UAAU,MAAM;IAChB,OAAO;IACP,GAAI,MAAM,cAAc,EAAE,cAAc,MAAM,YAAY,IAAI,CAAC;IAC/D,GAAI,MAAM,YAAY,EAAE,YAAY,MAAM,UAAU,IAAI,CAAC;IACzD,GAAI,MAAM,YAAY,EAAE,YAAY,MAAM,UAAU,IAAI,CAAC;IACzD,YAAY,MAAM,aAAa,CAAC,EAAA,CAAG,KAAI,WAAU,EAAE,MAAM,EAAE;GAC7D;EACF;CACF;AACF;AAEA,SAAgB,sBACd,YACA,mBACA,OACqB;CACrB,OAAO;EACL,OAAO;EAGP,YAAY,aAAa,WAAW,GAAG,gBAAgB,kBAAkB,GAAG,MAAM,SAAS,WAAW;EACtG,SAAS;GACP,QAAQ;GACR,cAAc,EAAE,IAAI,WAAW,eAAe;GAC9C,YAAY;IAAE,IAAI,WAAW;IAAI,WAAW,WAAW;GAAS;GAChE,QAAQ,EAAE,OAAO,MAAM,YAAY,SAAS;GAC5C,cAAc;IACZ,QAAQ;IACR,OAAO,MAAM;IACb,UAAU,MAAM;IAChB,GAAI,MAAM,YAAY,EAAE,YAAY,MAAM,UAAU,IAAI,CAAC;IACzD,OAAO;IACP,OAAO,MAAM;IACb,QAAQ,MAAM;IACd,YAAY,MAAM,aAAa,CAAC,EAAA,CAAG,KAAI,WAAU,EAAE,MAAM,EAAE;IAC3D,sBAAsB,MAAM,sBAAsB,CAAC,EAAA,CAAG,KAAI,WAAU,EAAE,MAAM,EAAE;IAC9E,SAAS,MAAM,UAAU,CAAC,EAAA,CAAG,KAAI,UAAS,EAAE,KAAK,EAAE;IACnD,MAAM,EAAE,KAAK,MAAM,WAAW;IAC9B,MAAM,EAAE,KAAK,MAAM,WAAW;GAChC;EACF;CACF;AACF;;;;;;AAOA,eAAe,8BACb,SACA,YACA,mBACA,QACe;CACf,MAAM,SAAS,uBAAuB;EACpC,wBAAwB,OAAO,WAAW,cAAc;EACxD,sBAAsB,OAAO,WAAW,EAAE;EAC1C,iBAAiB,OAAO,iBAAiB;CAC3C,CAAC;CACD,MAAM,OAAO,MAAM,QAAQ,cAAc,aAAa,MAAM;CAC5D,MAAM,QAAQ,IACZ,KACG,QAAO,QAAO,IAAI,WAAW,MAAM,CAAC,CACpC,KAAI,QAAO,QAAQ,cAAc,aAAa,IAAI,IAAI,SAAS,WAAW,QAAQ,CAAC,CACxF;AACF;;;;;;;AAQA,SAAgB,kCACd,SACA,kBAC6B;CAC7B,MAAM,QAAQ,IAAI,YAAY,OAAO;CACrC,OAAO,OAAM,iBAAgB;EAC3B,MAAM,UAAiC;GACrC,cAAc;GACd,SAAS;GACT,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,QAAQ,CAAC;EACX;EACA,MAAM,iBACJ,YACA,OACA,sBACG;GACH,QAAQ,UAAU;GAClB,IAAI,QAAQ,OAAO,SAAA,GACjB,QAAQ,OAAO,KAAK;IAClB,YAAY,WAAW;IACvB,GAAI,sBAAsB,KAAA,IAAY,CAAC,IAAI,EAAE,kBAAkB;IAC/D,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC9D,CAAC;EAEL;EAIA,MAAM,aAAa,IAAI,KACpB,MAAM,QAAQ,cAAc,oBAAoB,2BAA2B,EAAA,CAAG,KAC7E,QAAO,GAAG,IAAI,uBAAuB,QAAQ,IAAI,sBACnD,CACF;EACA,MAAM,SAAS,aAAa,QAAO,eACjC,WAAW,IAAI,GAAG,WAAW,eAAe,QAAQ,WAAW,IAAI,CACrE;EACA,QAAQ,eAAe,OAAO;EAC9B,KAAK,MAAM,cAAc,QAAQ;GAG/B,IAAI;GACJ,IAAI;IACF,MAAM,WAAW,MAAM,QAAQ,cAAc,oBAAoB,yBAAyB;KACxF,wBAAwB,OAAO,WAAW,cAAc;KACxD,sBAAsB,OAAO,WAAW,EAAE;IAC5C,CAAC;IACD,IAAI,SAAS,WAAW,GAAG;IAC3B,gCAAgB,IAAI,IAA2B;IAC/C,KAAK,MAAM,WAAW,UAAU;KAC9B,MAAM,QAAQ,MAAM,QAAQ,QAAQ,KAAK;MACvC,OAAO,QAAQ;MACf,kBAAkB,QAAQ;KAC5B,CAAC;KACD,KAAK,MAAM,QAAQ,OAAO;MACxB,MAAM,QAAQ,KAAK,OAAO;MAC1B,MAAM,oBAAoB,8BAA8B,MAAM,UAAU;MACxE,IAAI,CAAC,mBAAmB;MACxB,MAAM,WAAW,KAAK,YAAY,CAAC;MACnC,MAAM,yBACH,SAAS,UAAU,UAAU,SAAS,UAAU,aACjD,OAAO,SAAS,UAAU,aAC1B,OAAO,SAAS,WAAW,aAC3B,OAAO,SAAS,WAAW,YAC3B,MAAM,QAAQ,SAAS,SAAS,KAChC,MAAM,QAAQ,SAAS,kBAAkB,KACzC,MAAM,QAAQ,SAAS,MAAM;MAC/B,KAAK,UAAU,UAAU,UAAU,eAAe,uBAAuB;MACzE,MAAM,QAAQ,cAAc,IAAI,iBAAiB,KAAK,CAAC;MACvD,MAAM,KAAK,IAAI;MACf,cAAc,IAAI,mBAAmB,KAAK;KAC5C;IACF;GACF,SAAS,OAAO;IACd,cAAc,YAAY,KAAK;IAC/B;GACF;GACA,KAAK,MAAM,CAAC,mBAAmB,UAAU,eACvC,IAAI;IACF,MAAM,QAAQ,MAAM,iBAAiB;KACnC,gBAAgB,WAAW;KAC3B,YAAY,WAAW;KACvB,QAAQ;IACV,CAAC;IACD,QAAQ,WAAW;IACnB,IAAI,CAAC,OAAO;IACZ,KAAK,MAAM,QAAQ,OAAO;KACxB,MAAM,WAAW,KAAK,YAAY,CAAC;KACnC,MAAM,gBACJ,SAAS,UAAU,MAAM,SAAS,SAAS,UAAU,MAAM,SAAS,SAAS,WAAW,MAAM;KAChG,MAAM,gBAAgB,MAAM,WAAW,KAAA,KAAa,SAAS,WAAW,MAAM;KAC9E,MAAM,mBAAmB,CAAC,YAAY,SAAS,WAAW,MAAM,SAAS;KACzE,MAAM,mBAAmB,CAAC,YAAY,SAAS,oBAAoB,MAAM,kBAAkB;KAC3F,MAAM,gBAAgB,CAAC,YAAY,SAAS,QAAQ,MAAM,MAAM;KAChE,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,eAAe;KAClG,IAAI;MACF,MAAM,QAAQ,QAAQ,OAAO;OAC3B,OAAO,KAAK;OACZ,IAAI,KAAK;OACT,QAAQ;OACR,OAAO,EACL,UAAU;QACR,OAAO,MAAM;QACb,OAAO,MAAM;QACb,QAAQ,MAAM;QACd,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;QAC/C,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;QACxD,GAAI,MAAM,qBAAqB,EAAE,oBAAoB,MAAM,mBAAmB,IAAI,CAAC;QACnF,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;OACjD,EACF;MACF,CAAC;KACH,SAAS,OAAO;MACd,cAAc,YAAY,OAAO,iBAAiB;KACpD;IACF;IACA,IAAI,MAAM,UAAU,UAAU;IAC9B,MAAM,MAAM,OAAO,sBAAsB,YAAY,mBAAmB,KAAK,CAAC;IAC9E,MAAM,8BAA8B,QAAQ,oBAAoB,YAAY,mBAAmB,MAAM,MAAM;IAC3G,IAAI,MAAM,QAAQ,QAAQ,UAAU;SAC/B,QAAQ,UAAU;GACzB,SAAS,OAAO;IACd,cAAc,YAAY,OAAO,iBAAiB;GACpD;EAEJ;EACA,OAAO;CACT;AACF;AAEA,SAAgB,mBACd,QACA,SACgC;CAChC,IAAI,CAAC,QAAQ,OAAO,OAAO,KAAA;CAC3B,OAAO;EACL;EACA,eAAe,QAAQ,QAAQ;EAC/B,oBAAoB,QAAQ,QAAQ;EACpC,UAAU,QAAQ,QAAQ;EAC1B,SAAS,QAAQ,MAAM;EACvB,OAAO,QAAQ,MAAM;CACvB;AACF;AAEA,SAAgB,kBACd,QACA,SACgE;CAChE,MAAM,UAAU,mBAAmB,QAAQ,OAAO;CAClD,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,MAAM,QAAQ,IAAI,YAAY,OAAO;CACrC,QAAO,UAAS,MAAM,OAAO,KAAK;AACpC;AAEA,SAAgB,uBACd,QACA,SACA,kBACyC;CACzC,MAAM,UAAU,mBAAmB,QAAQ,OAAO;CAClD,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,OAAO,kCAAkC,SAAS,gBAAgB;AACpE"}

package/dist/integrations/github/sandbox-release.d.ts

@@ -1,5 +1,5 @@
 import type { SandboxFleet } from '../../sandbox/fleet.js';
-import type { SourceControlStorageHandle } from '../../storage/domains/source-control/base.js';
+import type { SourceControlSession, SourceControlStorageHandle } from '../../storage/domains/source-control/base.js';
 import type { WorkItemsStorage } from '../../storage/domains/work-items/base.js';
 /**
  * Scrub a sandbox that is about to enter the reuse pool: force-checkout the
@@ -18,6 +18,21 @@ export declare function cleanReleasedSandbox(options: {
     sandboxId: string;
     sandboxWorkdir: string;
 }): Promise<void>;
+/**
+ * Reclaim the sandbox a just-deleted user session was holding: return a remote
+ * VM to the reuse pool (scrubbed first), or tear a local/unpooled one down.
+ *
+ * Runs after the session row is already gone. Waking the VM and scrubbing a
+ * large checkout takes minutes, and none of it is something the caller can act
+ * on — the workspace has disappeared from their list either way. Nothing can
+ * claim the sandbox until `release` publishes it to the pool, so deferring the
+ * whole sequence preserves the scrub-before-reuse guarantee.
+ */
+export declare function reclaimDeletedSessionSandbox(options: {
+    fleet: Pick<SandboxFleet, 'provider' | 'reattachSandbox' | 'teardownSandbox'>;
+    sourceControl: Pick<SourceControlStorageHandle, 'sandboxPool' | 'projectRepositories' | 'repositories'>;
+    session: Pick<SourceControlSession, 'orgId' | 'userId' | 'projectRepositoryId' | 'sandboxId' | 'sandboxWorkdir'>;
+}): Promise<void>;
 /**
  * Release the sandboxes held by a work item's sessions back to the reuse pool.
  *

package/dist/integrations/github/sandbox-release.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-release.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/sandbox-release.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAGjF;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;IAC7C,aAAa,EAAE,IAAI,CAAC,0BAA0B,EAAE,qBAAqB,GAAG,cAAc,CAAC,CAAC;IACxF,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBhB;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE;IACtD,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACzC,aAAa,EAAE,IAAI,CAAC,0BAA0B,EAAE,UAAU,GAAG,aAAa,GAAG,qBAAqB,GAAG,cAAc,CAAC,CAAC;IACrH,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB"}
+{"version":3,"file":"sandbox-release.d.ts","sourceRoot":"","sources":["../../../src/integrations/github/sandbox-release.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA0B,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,KAAK,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AACrH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAGjF;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;IAC7C,aAAa,EAAE,IAAI,CAAC,0BAA0B,EAAE,qBAAqB,GAAG,cAAc,CAAC,CAAC;IACxF,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBhB;AAED;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAAC,OAAO,EAAE;IAC1D,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,GAAG,iBAAiB,GAAG,iBAAiB,CAAC,CAAC;IAC9E,aAAa,EAAE,IAAI,CAAC,0BAA0B,EAAE,aAAa,GAAG,qBAAqB,GAAG,cAAc,CAAC,CAAC;IACxG,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,OAAO,GAAG,QAAQ,GAAG,qBAAqB,GAAG,WAAW,GAAG,gBAAgB,CAAC,CAAC;CAClH,GAAG,OAAO,CAAC,IAAI,CAAC,CAqChB;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE;IACtD,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACzC,aAAa,EAAE,IAAI,CAAC,0BAA0B,EAAE,UAAU,GAAG,aAAa,GAAG,qBAAqB,GAAG,cAAc,CAAC,CAAC;IACrH,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB"}

package/dist/integrations/github/sandbox-release.js

@@ -25,6 +25,47 @@ async function cleanReleasedSandbox(options) {
 	} catch {}
 }
 /**
+* Reclaim the sandbox a just-deleted user session was holding: return a remote
+* VM to the reuse pool (scrubbed first), or tear a local/unpooled one down.
+*
+* Runs after the session row is already gone. Waking the VM and scrubbing a
+* large checkout takes minutes, and none of it is something the caller can act
+* on — the workspace has disappeared from their list either way. Nothing can
+* claim the sandbox until `release` publishes it to the pool, so deferring the
+* whole sequence preserves the scrub-before-reuse guarantee.
+*/
+async function reclaimDeletedSessionSandbox(options) {
+	const { fleet, sourceControl, session } = options;
+	if (!session.sandboxId) return;
+	if (fleet.provider !== "local" && session.sandboxWorkdir) {
+		await cleanReleasedSandbox({
+			fleet,
+			sourceControl,
+			orgId: session.orgId,
+			projectRepositoryId: session.projectRepositoryId,
+			sandboxId: session.sandboxId,
+			sandboxWorkdir: session.sandboxWorkdir
+		});
+		await sourceControl.sandboxPool.release({
+			orgId: session.orgId,
+			projectRepositoryId: session.projectRepositoryId,
+			userId: session.userId,
+			sandboxId: session.sandboxId,
+			sandboxWorkdir: session.sandboxWorkdir
+		});
+		return;
+	}
+	let sandbox;
+	try {
+		sandbox = await fleet.reattachSandbox(session.sandboxId);
+	} catch {}
+	await fleet.teardownSandbox({
+		sandboxId: session.sandboxId,
+		setSandboxId: async () => {},
+		clear: async () => {}
+	}, sandbox);
+}
+/**
 * Release the sandboxes held by a work item's sessions back to the reuse pool.
 *
 * Called when the item commits into a terminal stage (`done` / `canceled`):
@@ -69,6 +110,6 @@ async function releaseWorkItemSandboxes(options) {
 	}
 }
 //#endregion
-export { cleanReleasedSandbox, releaseWorkItemSandboxes };
+export { cleanReleasedSandbox, reclaimDeletedSessionSandbox, releaseWorkItemSandboxes };
 
 //# sourceMappingURL=sandbox-release.js.map

package/dist/integrations/github/sandbox-release.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-release.js","names":[],"sources":["../../../src/integrations/github/sandbox-release.ts"],"sourcesContent":["import type { SandboxFleet } from '../../sandbox/fleet.js';\nimport type { SourceControlStorageHandle } from '../../storage/domains/source-control/base.js';\nimport type { WorkItemsStorage } from '../../storage/domains/work-items/base.js';\nimport { recycleClaimedWorkdir } from './sandbox.js';\n\n/**\n * Scrub a sandbox that is about to enter the reuse pool: force-checkout the\n * default branch and drop the released session's local state, so idle pooled\n * VMs don't sit on stale branches, dirty worktrees, or abandoned work while\n * they wait for the next claim. Best-effort — the VM may already be reaped\n * (the pooled claim then falls back to fresh provisioning) and the claim\n * path recycles the workdir again before reuse, so a failed scrub never\n * blocks the release.\n */\nexport async function cleanReleasedSandbox(options: {\n  fleet: Pick<SandboxFleet, 'reattachSandbox'>;\n  sourceControl: Pick<SourceControlStorageHandle, 'projectRepositories' | 'repositories'>;\n  orgId: string;\n  projectRepositoryId: string;\n  sandboxId: string;\n  sandboxWorkdir: string;\n}): Promise<void> {\n  try {\n    const projectRepository = await options.sourceControl.projectRepositories.get({\n      orgId: options.orgId,\n      id: options.projectRepositoryId,\n    });\n    if (!projectRepository) return;\n    const repository = await options.sourceControl.repositories.get({\n      orgId: options.orgId,\n      id: projectRepository.repositoryId,\n    });\n    if (!repository) return;\n    const sandbox = await options.fleet.reattachSandbox(options.sandboxId);\n    await recycleClaimedWorkdir(sandbox, options.sandboxWorkdir, repository.defaultBranch);\n  } catch {\n    // Reaped, unreachable, or wedged — the claim-side recycle is the\n    // correctness guarantee; this scrub is hygiene for idle VMs.\n  }\n}\n\n/**\n * Release the sandboxes held by a work item's sessions back to the reuse pool.\n *\n * Called when the item commits into a terminal stage (`done` / `canceled`):\n * its branch sessions stop receiving runs, so their VMs — which would\n * otherwise idle until the provider reaps them — can serve the next session\n * for the same repository instead of a fresh provision. Each session\n * keeps its row (a reopened branch simply claims a pooled VM or provisions\n * fresh on next use); it only loses its sandbox binding.\n */\nexport async function releaseWorkItemSandboxes(options: {\n  workItems: Pick<WorkItemsStorage, 'get'>;\n  sourceControl: Pick<SourceControlStorageHandle, 'sessions' | 'sandboxPool' | 'projectRepositories' | 'repositories'>;\n  fleet: Pick<SandboxFleet, 'reattachSandbox'>;\n  orgId: string;\n  workItemId: string;\n}): Promise<void> {\n  const { workItems, sourceControl } = options;\n  const item = await workItems.get({ orgId: options.orgId, id: options.workItemId });\n  if (!item) return;\n  const sessionIds = [...new Set(Object.values(item.sessions).map(session => session.sessionId))];\n  for (const sessionId of sessionIds) {\n    const session = await sourceControl.sessions.getBySessionId(sessionId);\n    if (!session || session.orgId !== options.orgId) continue;\n    if (!session.sandboxId || !session.sandboxWorkdir) continue;\n    await cleanReleasedSandbox({\n      fleet: options.fleet,\n      sourceControl,\n      orgId: session.orgId,\n      projectRepositoryId: session.projectRepositoryId,\n      sandboxId: session.sandboxId,\n      sandboxWorkdir: session.sandboxWorkdir,\n    });\n    await sourceControl.sandboxPool.release({\n      orgId: session.orgId,\n      projectRepositoryId: session.projectRepositoryId,\n      userId: session.userId,\n      sandboxId: session.sandboxId,\n      sandboxWorkdir: session.sandboxWorkdir,\n    });\n    await sourceControl.sessions.setSandbox({\n      id: session.id,\n      sandboxId: null,\n      sandboxWorkdir: session.sandboxWorkdir,\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;AAcA,eAAsB,qBAAqB,SAOzB;CAChB,IAAI;EACF,MAAM,oBAAoB,MAAM,QAAQ,cAAc,oBAAoB,IAAI;GAC5E,OAAO,QAAQ;GACf,IAAI,QAAQ;EACd,CAAC;EACD,IAAI,CAAC,mBAAmB;EACxB,MAAM,aAAa,MAAM,QAAQ,cAAc,aAAa,IAAI;GAC9D,OAAO,QAAQ;GACf,IAAI,kBAAkB;EACxB,CAAC;EACD,IAAI,CAAC,YAAY;EAEjB,MAAM,sBAAsB,MADN,QAAQ,MAAM,gBAAgB,QAAQ,SAAS,GAChC,QAAQ,gBAAgB,WAAW,aAAa;CACvF,QAAQ,CAGR;AACF;;;;;;;;;;;AAYA,eAAsB,yBAAyB,SAM7B;CAChB,MAAM,EAAE,WAAW,kBAAkB;CACrC,MAAM,OAAO,MAAM,UAAU,IAAI;EAAE,OAAO,QAAQ;EAAO,IAAI,QAAQ;CAAW,CAAC;CACjF,IAAI,CAAC,MAAM;CACX,MAAM,aAAa,CAAC,GAAG,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,KAAI,YAAW,QAAQ,SAAS,CAAC,CAAC;CAC9F,KAAK,MAAM,aAAa,YAAY;EAClC,MAAM,UAAU,MAAM,cAAc,SAAS,eAAe,SAAS;EACrE,IAAI,CAAC,WAAW,QAAQ,UAAU,QAAQ,OAAO;EACjD,IAAI,CAAC,QAAQ,aAAa,CAAC,QAAQ,gBAAgB;EACnD,MAAM,qBAAqB;GACzB,OAAO,QAAQ;GACf;GACA,OAAO,QAAQ;GACf,qBAAqB,QAAQ;GAC7B,WAAW,QAAQ;GACnB,gBAAgB,QAAQ;EAC1B,CAAC;EACD,MAAM,cAAc,YAAY,QAAQ;GACtC,OAAO,QAAQ;GACf,qBAAqB,QAAQ;GAC7B,QAAQ,QAAQ;GAChB,WAAW,QAAQ;GACnB,gBAAgB,QAAQ;EAC1B,CAAC;EACD,MAAM,cAAc,SAAS,WAAW;GACtC,IAAI,QAAQ;GACZ,WAAW;GACX,gBAAgB,QAAQ;EAC1B,CAAC;CACH;AACF"}
+{"version":3,"file":"sandbox-release.js","names":[],"sources":["../../../src/integrations/github/sandbox-release.ts"],"sourcesContent":["import type { MaterializationSandbox, SandboxFleet } from '../../sandbox/fleet.js';\nimport type { SourceControlSession, SourceControlStorageHandle } from '../../storage/domains/source-control/base.js';\nimport type { WorkItemsStorage } from '../../storage/domains/work-items/base.js';\nimport { recycleClaimedWorkdir } from './sandbox.js';\n\n/**\n * Scrub a sandbox that is about to enter the reuse pool: force-checkout the\n * default branch and drop the released session's local state, so idle pooled\n * VMs don't sit on stale branches, dirty worktrees, or abandoned work while\n * they wait for the next claim. Best-effort — the VM may already be reaped\n * (the pooled claim then falls back to fresh provisioning) and the claim\n * path recycles the workdir again before reuse, so a failed scrub never\n * blocks the release.\n */\nexport async function cleanReleasedSandbox(options: {\n  fleet: Pick<SandboxFleet, 'reattachSandbox'>;\n  sourceControl: Pick<SourceControlStorageHandle, 'projectRepositories' | 'repositories'>;\n  orgId: string;\n  projectRepositoryId: string;\n  sandboxId: string;\n  sandboxWorkdir: string;\n}): Promise<void> {\n  try {\n    const projectRepository = await options.sourceControl.projectRepositories.get({\n      orgId: options.orgId,\n      id: options.projectRepositoryId,\n    });\n    if (!projectRepository) return;\n    const repository = await options.sourceControl.repositories.get({\n      orgId: options.orgId,\n      id: projectRepository.repositoryId,\n    });\n    if (!repository) return;\n    const sandbox = await options.fleet.reattachSandbox(options.sandboxId);\n    await recycleClaimedWorkdir(sandbox, options.sandboxWorkdir, repository.defaultBranch);\n  } catch {\n    // Reaped, unreachable, or wedged — the claim-side recycle is the\n    // correctness guarantee; this scrub is hygiene for idle VMs.\n  }\n}\n\n/**\n * Reclaim the sandbox a just-deleted user session was holding: return a remote\n * VM to the reuse pool (scrubbed first), or tear a local/unpooled one down.\n *\n * Runs after the session row is already gone. Waking the VM and scrubbing a\n * large checkout takes minutes, and none of it is something the caller can act\n * on — the workspace has disappeared from their list either way. Nothing can\n * claim the sandbox until `release` publishes it to the pool, so deferring the\n * whole sequence preserves the scrub-before-reuse guarantee.\n */\nexport async function reclaimDeletedSessionSandbox(options: {\n  fleet: Pick<SandboxFleet, 'provider' | 'reattachSandbox' | 'teardownSandbox'>;\n  sourceControl: Pick<SourceControlStorageHandle, 'sandboxPool' | 'projectRepositories' | 'repositories'>;\n  session: Pick<SourceControlSession, 'orgId' | 'userId' | 'projectRepositoryId' | 'sandboxId' | 'sandboxWorkdir'>;\n}): Promise<void> {\n  const { fleet, sourceControl, session } = options;\n  if (!session.sandboxId) return;\n  if (fleet.provider !== 'local' && session.sandboxWorkdir) {\n    // Keep the remote VM alive: return it to the reuse pool so the next\n    // session for this repository link and user claims it (repo already\n    // cloned) instead of provisioning a fresh sandbox. Scrub the session's\n    // work off the VM first so it doesn't idle with stale branches or dirty\n    // state, and so nothing claims it mid-scrub.\n    await cleanReleasedSandbox({\n      fleet,\n      sourceControl,\n      orgId: session.orgId,\n      projectRepositoryId: session.projectRepositoryId,\n      sandboxId: session.sandboxId,\n      sandboxWorkdir: session.sandboxWorkdir,\n    });\n    await sourceControl.sandboxPool.release({\n      orgId: session.orgId,\n      projectRepositoryId: session.projectRepositoryId,\n      userId: session.userId,\n      sandboxId: session.sandboxId,\n      sandboxWorkdir: session.sandboxWorkdir,\n    });\n    return;\n  }\n  let sandbox: MaterializationSandbox | undefined;\n  try {\n    sandbox = await fleet.reattachSandbox(session.sandboxId);\n  } catch {\n    // The provider may already have reclaimed the sandbox.\n  }\n  // The session row is deleted, so there is no binding left to clear.\n  await fleet.teardownSandbox(\n    { sandboxId: session.sandboxId, setSandboxId: async () => {}, clear: async () => {} },\n    sandbox,\n  );\n}\n\n/**\n * Release the sandboxes held by a work item's sessions back to the reuse pool.\n *\n * Called when the item commits into a terminal stage (`done` / `canceled`):\n * its branch sessions stop receiving runs, so their VMs — which would\n * otherwise idle until the provider reaps them — can serve the next session\n * for the same repository instead of a fresh provision. Each session\n * keeps its row (a reopened branch simply claims a pooled VM or provisions\n * fresh on next use); it only loses its sandbox binding.\n */\nexport async function releaseWorkItemSandboxes(options: {\n  workItems: Pick<WorkItemsStorage, 'get'>;\n  sourceControl: Pick<SourceControlStorageHandle, 'sessions' | 'sandboxPool' | 'projectRepositories' | 'repositories'>;\n  fleet: Pick<SandboxFleet, 'reattachSandbox'>;\n  orgId: string;\n  workItemId: string;\n}): Promise<void> {\n  const { workItems, sourceControl } = options;\n  const item = await workItems.get({ orgId: options.orgId, id: options.workItemId });\n  if (!item) return;\n  const sessionIds = [...new Set(Object.values(item.sessions).map(session => session.sessionId))];\n  for (const sessionId of sessionIds) {\n    const session = await sourceControl.sessions.getBySessionId(sessionId);\n    if (!session || session.orgId !== options.orgId) continue;\n    if (!session.sandboxId || !session.sandboxWorkdir) continue;\n    await cleanReleasedSandbox({\n      fleet: options.fleet,\n      sourceControl,\n      orgId: session.orgId,\n      projectRepositoryId: session.projectRepositoryId,\n      sandboxId: session.sandboxId,\n      sandboxWorkdir: session.sandboxWorkdir,\n    });\n    await sourceControl.sandboxPool.release({\n      orgId: session.orgId,\n      projectRepositoryId: session.projectRepositoryId,\n      userId: session.userId,\n      sandboxId: session.sandboxId,\n      sandboxWorkdir: session.sandboxWorkdir,\n    });\n    await sourceControl.sessions.setSandbox({\n      id: session.id,\n      sandboxId: null,\n      sandboxWorkdir: session.sandboxWorkdir,\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;AAcA,eAAsB,qBAAqB,SAOzB;CAChB,IAAI;EACF,MAAM,oBAAoB,MAAM,QAAQ,cAAc,oBAAoB,IAAI;GAC5E,OAAO,QAAQ;GACf,IAAI,QAAQ;EACd,CAAC;EACD,IAAI,CAAC,mBAAmB;EACxB,MAAM,aAAa,MAAM,QAAQ,cAAc,aAAa,IAAI;GAC9D,OAAO,QAAQ;GACf,IAAI,kBAAkB;EACxB,CAAC;EACD,IAAI,CAAC,YAAY;EAEjB,MAAM,sBAAsB,MADN,QAAQ,MAAM,gBAAgB,QAAQ,SAAS,GAChC,QAAQ,gBAAgB,WAAW,aAAa;CACvF,QAAQ,CAGR;AACF;;;;;;;;;;;AAYA,eAAsB,6BAA6B,SAIjC;CAChB,MAAM,EAAE,OAAO,eAAe,YAAY;CAC1C,IAAI,CAAC,QAAQ,WAAW;CACxB,IAAI,MAAM,aAAa,WAAW,QAAQ,gBAAgB;EAMxD,MAAM,qBAAqB;GACzB;GACA;GACA,OAAO,QAAQ;GACf,qBAAqB,QAAQ;GAC7B,WAAW,QAAQ;GACnB,gBAAgB,QAAQ;EAC1B,CAAC;EACD,MAAM,cAAc,YAAY,QAAQ;GACtC,OAAO,QAAQ;GACf,qBAAqB,QAAQ;GAC7B,QAAQ,QAAQ;GAChB,WAAW,QAAQ;GACnB,gBAAgB,QAAQ;EAC1B,CAAC;EACD;CACF;CACA,IAAI;CACJ,IAAI;EACF,UAAU,MAAM,MAAM,gBAAgB,QAAQ,SAAS;CACzD,QAAQ,CAER;CAEA,MAAM,MAAM,gBACV;EAAE,WAAW,QAAQ;EAAW,cAAc,YAAY,CAAC;EAAG,OAAO,YAAY,CAAC;CAAE,GACpF,OACF;AACF;;;;;;;;;;;AAYA,eAAsB,yBAAyB,SAM7B;CAChB,MAAM,EAAE,WAAW,kBAAkB;CACrC,MAAM,OAAO,MAAM,UAAU,IAAI;EAAE,OAAO,QAAQ;EAAO,IAAI,QAAQ;CAAW,CAAC;CACjF,IAAI,CAAC,MAAM;CACX,MAAM,aAAa,CAAC,GAAG,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,KAAI,YAAW,QAAQ,SAAS,CAAC,CAAC;CAC9F,KAAK,MAAM,aAAa,YAAY;EAClC,MAAM,UAAU,MAAM,cAAc,SAAS,eAAe,SAAS;EACrE,IAAI,CAAC,WAAW,QAAQ,UAAU,QAAQ,OAAO;EACjD,IAAI,CAAC,QAAQ,aAAa,CAAC,QAAQ,gBAAgB;EACnD,MAAM,qBAAqB;GACzB,OAAO,QAAQ;GACf;GACA,OAAO,QAAQ;GACf,qBAAqB,QAAQ;GAC7B,WAAW,QAAQ;GACnB,gBAAgB,QAAQ;EAC1B,CAAC;EACD,MAAM,cAAc,YAAY,QAAQ;GACtC,OAAO,QAAQ;GACf,qBAAqB,QAAQ;GAC7B,QAAQ,QAAQ;GAChB,WAAW,QAAQ;GACnB,gBAAgB,QAAQ;EAC1B,CAAC;EACD,MAAM,cAAc,SAAS,WAAW;GACtC,IAAI,QAAQ;GACZ,WAAW;GACX,gBAAgB,QAAQ;EAC1B,CAAC;CACH;AACF"}