@mastra/factory 0.8.0-alpha.8 → 0.8.0

package/dist/integrations/linear/routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes.js","names":[],"sources":["../../../src/integrations/linear/routes.ts"],"sourcesContent":["/**\n * Mastra `apiRoutes` for the Linear intake feature.\n *\n * Registered alongside the other `/web/*` routes, behind the WorkOS auth gate.\n * Mirrors the GitHub module: every route re-resolves the authenticated user\n * from the request cookie and scopes all rows by the caller's WorkOS org, so an\n * org can only ever see its own Linear connection and issues.\n *\n * When the feature is disabled (`isLinearFeatureEnabled()` false),\n * `buildLinearRoutes` returns only `GET /web/linear/status`, which reports\n * `enabled:false` so the SPA can cleanly hide all Linear UI.\n */\n\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport type { RouteAuth } from '../../routes/route.js';\nimport type { StateSigner } from '../../state-signing.js';\nimport type { IntakeStorage } from '../../storage/domains/intake/base.js';\nimport type { LinearIntegration } from './integration.js';\nimport { LinearReauthRequiredError } from './integration.js';\nimport type { LinearRulesIngress } from './rules.js';\n\ntype RouteContext = Context;\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\n/** Erase a route handler's path-parameterized context to a plain `Context`. */\nfunction loose(c: unknown): RouteContext {\n  return c as RouteContext;\n}\n\n/**\n * Non-secret diagnostic snapshot of every Linear feature gate, mirroring the\n * GitHub diagnostics shape. Only booleans — never values.\n */\nexport interface LinearFeatureDiagnostics {\n  linearAppConfigured: boolean;\n  factoryAuthEnabled: boolean;\n  appDbConfigured: boolean;\n}\n\nexport interface MountLinearRoutesOptions {\n  /**\n   * The integration instance providing OAuth + GraphQL access. Required for\n   * everything beyond the disabled `status` route.\n   */\n  linear?: LinearIntegration;\n  /** Host auth seam. Linear connections are org-owned, so the feature is inert without it. */\n  auth: RouteAuth;\n  /**\n   * Absolute base URL of the web server (e.g. `http://localhost:4111`), used to\n   * build the OAuth redirect URI when one isn't explicitly configured.\n   */\n  baseUrl?: string;\n  /** Explicit OAuth callback URI; defaults to `<baseUrl>/auth/linear/callback`. */\n  redirectUri?: string;\n  /**\n   * Shared OAuth `state` signer (created once per boot by the factory).\n   * Required for the connect/callback flow; when absent, only the disabled\n   * `status` route is served.\n   */\n  stateSigner?: StateSigner;\n  /**\n   * Cross-integration intake selection domain. Required for the issues route's\n   * project filter; when absent, only the disabled `status` route is served.\n   */\n  intake?: IntakeStorage;\n  ingestFactoryIssues?: (input: LinearRulesIngress) => Promise<unknown>;\n}\n\n/**\n * Resolve the org-scoped tenant for a Linear request. The connection is\n * org-owned, so it requires both a signed-in user and an organization — same\n * tenancy rules as the GitHub routes.\n */\nasync function resolveOrgTenant(\n  c: RouteContext,\n  auth: RouteAuth,\n): Promise<{ tenant: { orgId: string; userId: string } } | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) return { response: c.json({ error: 'unauthorized' }, 401) };\n  if (!tenant.orgId) {\n    return {\n      response: c.json(\n        {\n          error: 'organization_required',\n          message: 'Linear intake requires an organization. Personal accounts cannot connect Linear.',\n        },\n        403,\n      ),\n    };\n  }\n  return { tenant: { orgId: tenant.orgId, userId: tenant.userId } };\n}\n\n/**\n * Validate an opaque Linear pagination cursor from the query string. Cursors\n * are server-issued (`pageInfo.endCursor`), so anything outside a conservative\n * charset/length is rejected rather than forwarded to Linear.\n */\nfunction parseAfterCursor(raw: string | undefined): string | undefined | null {\n  if (raw === undefined || raw === '') return undefined;\n  if (raw.length > 512 || !/^[\\w+/=.:-]+$/.test(raw)) return null;\n  return raw;\n}\n\n/** Map a Linear read failure to the API response for the SPA. */\nfunction linearFetchError(c: RouteContext, err: unknown) {\n  if (err instanceof LinearReauthRequiredError || (err as { status?: number }).status === 401) {\n    return c.json({ error: 'linear_reauth_required', message: new LinearReauthRequiredError().message }, 409);\n  }\n  return c.json({ error: 'linear_fetch_failed', message: err instanceof Error ? err.message : String(err) }, 502);\n}\n\n/**\n * Build the Linear routes as Mastra `apiRoutes`. When the feature is disabled,\n * returns only the `status` route so the SPA can detect the disabled state.\n */\nexport function buildLinearRoutes(options: MountLinearRoutesOptions): ApiRoute[] {\n  const routes: ApiRoute[] = [];\n  const { linear, auth, stateSigner, intake } = options;\n  const enabled = Boolean(linear) && auth.enabled();\n  const diagnostics = (): LinearFeatureDiagnostics => ({\n    linearAppConfigured: Boolean(linear),\n    factoryAuthEnabled: auth.enabled(),\n    appDbConfigured: true,\n  });\n\n  // The status route is always registered so the SPA can detect the disabled state.\n  routes.push(\n    registerApiRoute('/web/linear/status', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        if (!enabled || !linear || !stateSigner) {\n          return c.json({\n            enabled: false,\n            connected: false,\n            workspace: null,\n            reason: 'missing_config',\n            diagnostics: diagnostics(),\n          });\n        }\n        await auth.ensureUser(loose(c));\n        const tenant = auth.tenant(loose(c));\n        if (!tenant) return c.json({ error: 'unauthorized', reason: 'auth_required' }, 401);\n\n        if (!tenant.orgId) {\n          return c.json({\n            enabled: true,\n            organizationRequired: true,\n            connected: false,\n            workspace: null,\n            reason: 'organization_required',\n            diagnostics: diagnostics(),\n          });\n        }\n\n        const connection = await linear.loadConnection(tenant.orgId);\n        return c.json({\n          enabled: true,\n          connected: Boolean(connection),\n          workspace: connection ? { name: connection.workspaceName, urlKey: connection.workspaceUrlKey } : null,\n          reason: connection ? 'ready' : 'not_connected',\n          diagnostics: diagnostics(),\n        });\n      },\n    }),\n  );\n\n  // Without the integration instance or a state signer the connect/callback\n  // flow cannot talk to Linear or bind the OAuth round-trip to a tenant —\n  // serve only the disabled `status` route (mirrors the feature gate).\n  if (!enabled || !linear || !stateSigner || !intake) {\n    return routes;\n  }\n\n  const redirectUri = options.redirectUri ?? `${(options.baseUrl ?? '').replace(/\\/$/, '')}/auth/linear/callback`;\n\n  // ── Connect: send the user to Linear's OAuth consent screen ─────────────\n  routes.push(\n    registerApiRoute('/auth/linear/connect', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), auth);\n        if ('response' in resolved) return resolved.response;\n        const state = stateSigner.sign(resolved.tenant.orgId, resolved.tenant.userId);\n        return c.redirect(linear.buildAuthorizeUrl(state, redirectUri));\n      },\n    }),\n  );\n\n  // ── Callback: exchange the code, persist the connection for the org ─────\n  routes.push(\n    registerApiRoute('/auth/linear/callback', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), auth);\n        if ('response' in resolved) return resolved.response;\n        const { orgId, userId } = resolved.tenant;\n\n        // CSRF / cross-tenant linking protection: the signed state must belong\n        // to the same logged-in user *and* their current org.\n        const stateTenant = stateSigner.verify(c.req.query('state'));\n        if (!stateTenant || stateTenant.userId !== userId || stateTenant.orgId !== orgId) {\n          console.warn('[Linear] OAuth callback rejected: state/tenant mismatch.');\n          return c.redirect('/?linear=error');\n        }\n\n        const code = c.req.query('code');\n        if (!code) {\n          // User denied consent (or Linear returned an error).\n          return c.redirect('/?linear=error');\n        }\n\n        try {\n          const tokens = await linear.exchangeOAuthCode(code, redirectUri);\n          const workspace = await linear.fetchWorkspace(tokens.accessToken);\n          await linear.upsertConnection({\n            orgId,\n            userId,\n            accessToken: tokens.accessToken,\n            refreshToken: tokens.refreshToken,\n            expiresAt: tokens.expiresAt,\n            scope: tokens.scope,\n            workspaceName: workspace.name,\n            workspaceUrlKey: workspace.urlKey,\n          });\n        } catch (error) {\n          console.warn(`[Linear] OAuth callback failed to persist connection for org ${orgId}.`, error);\n          return c.redirect('/?linear=error');\n        }\n\n        return c.redirect('/?linear=connected');\n      },\n    }),\n  );\n\n  // ── List the workspace's projects (Settings intake-source picker) ───────\n  routes.push(\n    registerApiRoute('/web/linear/projects', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), auth);\n        if ('response' in resolved) return resolved.response;\n\n        const connection = await linear.loadConnection(resolved.tenant.orgId);\n        if (!connection) {\n          return c.json({ error: 'linear_not_connected', message: 'Connect Linear to list Linear projects.' }, 409);\n        }\n\n        try {\n          const accessToken = await linear.getFreshAccessToken(connection);\n          const projects = await linear.listProjects(accessToken);\n          return c.json({ projects });\n        } catch (err) {\n          return linearFetchError(loose(c), err);\n        }\n      },\n    }),\n  );\n\n  // ── List the workspace's active issues (cursor-paged) ───────────────────\n  // Respects the caller's intake config: disabled Linear intake 404s the\n  // source, and an explicit project selection narrows the issue filter.\n  routes.push(\n    registerApiRoute('/web/linear/issues', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), auth);\n        if ('response' in resolved) return resolved.response;\n\n        const after = parseAfterCursor(c.req.query('after'));\n        if (after === null) return c.json({ error: 'invalid_cursor' }, 400);\n        const factoryProjectId = c.req.query('factoryProjectId');\n        if (factoryProjectId && !UUID_RE.test(factoryProjectId)) {\n          return c.json({ error: 'invalid_factory_project_id' }, 400);\n        }\n\n        const connection = await linear.loadConnection(resolved.tenant.orgId);\n        if (!connection) {\n          return c.json({ error: 'linear_not_connected', message: 'Connect Linear to see intake issues.' }, 409);\n        }\n\n        await intake.ensureReady();\n        const config = await intake.getConfig({\n          orgId: resolved.tenant.orgId,\n          userId: resolved.tenant.userId,\n          integrationIds: ['linear'],\n        });\n        const selection = config.linear!;\n        if (!selection.enabled) {\n          return c.json({ error: 'linear_intake_disabled', message: 'Linear intake is turned off in Settings.' }, 404);\n        }\n\n        // No projects selected means nothing is synced — don't fan out to Linear.\n        const projectIds = selection.sourceIds ?? [];\n        if (projectIds.length === 0) {\n          return c.json({ issues: [], nextCursor: null });\n        }\n\n        try {\n          const accessToken = await linear.getFreshAccessToken(connection);\n          const { issues, nextCursor } = await linear.intake.listIssues({\n            connection: { type: 'oauth', accessToken },\n            sourceIds: projectIds,\n            cursor: after,\n          });\n          const issuePayload = issues.map(issue => ({\n            id: issue.id,\n            identifier: issue.identifier,\n            title: issue.title,\n            url: issue.url,\n            state: issue.state ?? '',\n            stateType: issue.stateType ?? '',\n            priorityLabel: issue.priority ?? '',\n            assignee: issue.assignee,\n            creator: issue.author,\n            team: issue.source,\n            labels: issue.labels,\n            createdAt: issue.createdAt,\n            updatedAt: issue.updatedAt,\n          }));\n          if (factoryProjectId && options.ingestFactoryIssues) {\n            await options.ingestFactoryIssues({\n              orgId: resolved.tenant.orgId,\n              userId: resolved.tenant.userId,\n              factoryProjectId,\n              issues: issuePayload,\n            });\n          }\n          return c.json({ issues: issuePayload, nextCursor });\n        } catch (err) {\n          return linearFetchError(loose(c), err);\n        }\n      },\n    }),\n  );\n\n  return routes;\n}\n"],"mappings":";;;AA0BA,MAAM,UAAU;;AAGhB,SAAS,MAAM,GAA0B;CACvC,OAAO;AACT;;;;;;AA8CA,eAAe,iBACb,GACA,MACiF;CACjF,MAAM,KAAK,WAAW,CAAC;CACvB,MAAM,SAAS,KAAK,OAAO,CAAC;CAC5B,IAAI,CAAC,QAAQ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;CACvE,IAAI,CAAC,OAAO,OACV,OAAO,EACL,UAAU,EAAE,KACV;EACE,OAAO;EACP,SAAS;CACX,GACA,GACF,EACF;CAEF,OAAO,EAAE,QAAQ;EAAE,OAAO,OAAO;EAAO,QAAQ,OAAO;CAAO,EAAE;AAClE;;;;;;AAOA,SAAS,iBAAiB,KAAoD;CAC5E,IAAI,QAAQ,KAAA,KAAa,QAAQ,IAAI,OAAO,KAAA;CAC5C,IAAI,IAAI,SAAS,OAAO,CAAC,gBAAgB,KAAK,GAAG,GAAG,OAAO;CAC3D,OAAO;AACT;;AAGA,SAAS,iBAAiB,GAAiB,KAAc;CACvD,IAAI,eAAe,6BAA8B,IAA4B,WAAW,KACtF,OAAO,EAAE,KAAK;EAAE,OAAO;EAA0B,SAAS,IAAI,0BAA0B,CAAC,CAAC;CAAQ,GAAG,GAAG;CAE1G,OAAO,EAAE,KAAK;EAAE,OAAO;EAAuB,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;CAAE,GAAG,GAAG;AAChH;;;;;AAMA,SAAgB,kBAAkB,SAA+C;CAC/E,MAAM,SAAqB,CAAC;CAC5B,MAAM,EAAE,QAAQ,MAAM,aAAa,WAAW;CAC9C,MAAM,UAAU,QAAQ,MAAM,KAAK,KAAK,QAAQ;CAChD,MAAM,qBAA+C;EACnD,qBAAqB,QAAQ,MAAM;EACnC,oBAAoB,KAAK,QAAQ;EACjC,iBAAiB;CACnB;CAGA,OAAO,KACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,aAC1B,OAAO,EAAE,KAAK;IACZ,SAAS;IACT,WAAW;IACX,WAAW;IACX,QAAQ;IACR,aAAa,YAAY;GAC3B,CAAC;GAEH,MAAM,KAAK,WAAW,MAAM,CAAC,CAAC;GAC9B,MAAM,SAAS,KAAK,OAAO,MAAM,CAAC,CAAC;GACnC,IAAI,CAAC,QAAQ,OAAO,EAAE,KAAK;IAAE,OAAO;IAAgB,QAAQ;GAAgB,GAAG,GAAG;GAElF,IAAI,CAAC,OAAO,OACV,OAAO,EAAE,KAAK;IACZ,SAAS;IACT,sBAAsB;IACtB,WAAW;IACX,WAAW;IACX,QAAQ;IACR,aAAa,YAAY;GAC3B,CAAC;GAGH,MAAM,aAAa,MAAM,OAAO,eAAe,OAAO,KAAK;GAC3D,OAAO,EAAE,KAAK;IACZ,SAAS;IACT,WAAW,QAAQ,UAAU;IAC7B,WAAW,aAAa;KAAE,MAAM,WAAW;KAAe,QAAQ,WAAW;IAAgB,IAAI;IACjG,QAAQ,aAAa,UAAU;IAC/B,aAAa,YAAY;GAC3B,CAAC;EACH;CACF,CAAC,CACH;CAKA,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,eAAe,CAAC,QAC1C,OAAO;CAGT,MAAM,cAAc,QAAQ,eAAe,IAAI,QAAQ,WAAW,GAAA,CAAI,QAAQ,OAAO,EAAE,EAAE;CAGzF,OAAO,KACL,iBAAiB,wBAAwB;EACvC,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,IAAI;GACtD,IAAI,cAAc,UAAU,OAAO,SAAS;GAC5C,MAAM,QAAQ,YAAY,KAAK,SAAS,OAAO,OAAO,SAAS,OAAO,MAAM;GAC5E,OAAO,EAAE,SAAS,OAAO,kBAAkB,OAAO,WAAW,CAAC;EAChE;CACF,CAAC,CACH;CAGA,OAAO,KACL,iBAAiB,yBAAyB;EACxC,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,IAAI;GACtD,IAAI,cAAc,UAAU,OAAO,SAAS;GAC5C,MAAM,EAAE,OAAO,WAAW,SAAS;GAInC,MAAM,cAAc,YAAY,OAAO,EAAE,IAAI,MAAM,OAAO,CAAC;GAC3D,IAAI,CAAC,eAAe,YAAY,WAAW,UAAU,YAAY,UAAU,OAAO;IAChF,QAAQ,KAAK,0DAA0D;IACvE,OAAO,EAAE,SAAS,gBAAgB;GACpC;GAEA,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;GAC/B,IAAI,CAAC,MAEH,OAAO,EAAE,SAAS,gBAAgB;GAGpC,IAAI;IACF,MAAM,SAAS,MAAM,OAAO,kBAAkB,MAAM,WAAW;IAC/D,MAAM,YAAY,MAAM,OAAO,eAAe,OAAO,WAAW;IAChE,MAAM,OAAO,iBAAiB;KAC5B;KACA;KACA,aAAa,OAAO;KACpB,cAAc,OAAO;KACrB,WAAW,OAAO;KAClB,OAAO,OAAO;KACd,eAAe,UAAU;KACzB,iBAAiB,UAAU;IAC7B,CAAC;GACH,SAAS,OAAO;IACd,QAAQ,KAAK,gEAAgE,MAAM,IAAI,KAAK;IAC5F,OAAO,EAAE,SAAS,gBAAgB;GACpC;GAEA,OAAO,EAAE,SAAS,oBAAoB;EACxC;CACF,CAAC,CACH;CAGA,OAAO,KACL,iBAAiB,wBAAwB;EACvC,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,IAAI;GACtD,IAAI,cAAc,UAAU,OAAO,SAAS;GAE5C,MAAM,aAAa,MAAM,OAAO,eAAe,SAAS,OAAO,KAAK;GACpE,IAAI,CAAC,YACH,OAAO,EAAE,KAAK;IAAE,OAAO;IAAwB,SAAS;GAA0C,GAAG,GAAG;GAG1G,IAAI;IACF,MAAM,cAAc,MAAM,OAAO,oBAAoB,UAAU;IAC/D,MAAM,WAAW,MAAM,OAAO,aAAa,WAAW;IACtD,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC;GAC5B,SAAS,KAAK;IACZ,OAAO,iBAAiB,MAAM,CAAC,GAAG,GAAG;GACvC;EACF;CACF,CAAC,CACH;CAKA,OAAO,KACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,IAAI;GACtD,IAAI,cAAc,UAAU,OAAO,SAAS;GAE5C,MAAM,QAAQ,iBAAiB,EAAE,IAAI,MAAM,OAAO,CAAC;GACnD,IAAI,UAAU,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAClE,MAAM,mBAAmB,EAAE,IAAI,MAAM,kBAAkB;GACvD,IAAI,oBAAoB,CAAC,QAAQ,KAAK,gBAAgB,GACpD,OAAO,EAAE,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;GAG5D,MAAM,aAAa,MAAM,OAAO,eAAe,SAAS,OAAO,KAAK;GACpE,IAAI,CAAC,YACH,OAAO,EAAE,KAAK;IAAE,OAAO;IAAwB,SAAS;GAAuC,GAAG,GAAG;GAGvG,MAAM,OAAO,YAAY;GAMzB,MAAM,aAAY,MALG,OAAO,UAAU;IACpC,OAAO,SAAS,OAAO;IACvB,QAAQ,SAAS,OAAO;IACxB,gBAAgB,CAAC,QAAQ;GAC3B,CAAC,EAAA,CACwB;GACzB,IAAI,CAAC,UAAU,SACb,OAAO,EAAE,KAAK;IAAE,OAAO;IAA0B,SAAS;GAA2C,GAAG,GAAG;GAI7G,MAAM,aAAa,UAAU,aAAa,CAAC;GAC3C,IAAI,WAAW,WAAW,GACxB,OAAO,EAAE,KAAK;IAAE,QAAQ,CAAC;IAAG,YAAY;GAAK,CAAC;GAGhD,IAAI;IACF,MAAM,cAAc,MAAM,OAAO,oBAAoB,UAAU;IAC/D,MAAM,EAAE,QAAQ,eAAe,MAAM,OAAO,OAAO,WAAW;KAC5D,YAAY;MAAE,MAAM;MAAS;KAAY;KACzC,WAAW;KACX,QAAQ;IACV,CAAC;IACD,MAAM,eAAe,OAAO,KAAI,WAAU;KACxC,IAAI,MAAM;KACV,YAAY,MAAM;KAClB,OAAO,MAAM;KACb,KAAK,MAAM;KACX,OAAO,MAAM,SAAS;KACtB,WAAW,MAAM,aAAa;KAC9B,eAAe,MAAM,YAAY;KACjC,UAAU,MAAM;KAChB,SAAS,MAAM;KACf,MAAM,MAAM;KACZ,QAAQ,MAAM;KACd,WAAW,MAAM;KACjB,WAAW,MAAM;IACnB,EAAE;IACF,IAAI,oBAAoB,QAAQ,qBAC9B,MAAM,QAAQ,oBAAoB;KAChC,OAAO,SAAS,OAAO;KACvB,QAAQ,SAAS,OAAO;KACxB;KACA,QAAQ;IACV,CAAC;IAEH,OAAO,EAAE,KAAK;KAAE,QAAQ;KAAc;IAAW,CAAC;GACpD,SAAS,KAAK;IACZ,OAAO,iBAAiB,MAAM,CAAC,GAAG,GAAG;GACvC;EACF;CACF,CAAC,CACH;CAEA,OAAO;AACT"}
+{"version":3,"file":"routes.js","names":[],"sources":["../../../src/integrations/linear/routes.ts"],"sourcesContent":["/**\n * Mastra `apiRoutes` for the Linear intake feature.\n *\n * Registered alongside the other `/web/*` routes, behind the WorkOS auth gate.\n * Mirrors the GitHub module: every route re-resolves the authenticated user\n * from the request cookie and scopes all rows by the caller's WorkOS org, so an\n * org can only ever see its own Linear connection and issues.\n *\n * When the feature is disabled (`isLinearFeatureEnabled()` false),\n * `buildLinearRoutes` returns only `GET /web/linear/status`, which reports\n * `enabled:false` so the SPA can cleanly hide all Linear UI.\n */\n\nimport type { ApiRoute } from '@mastra/core/server';\nimport { registerApiRoute } from '@mastra/core/server';\nimport type { Context } from 'hono';\n\nimport type { RouteAuth } from '../../routes/route.js';\nimport type { StateSigner } from '../../state-signing.js';\nimport type { IntakeStorage } from '../../storage/domains/intake/base.js';\nimport type { LinearIntegration } from './integration.js';\nimport { LinearReauthRequiredError } from './integration.js';\nimport type { LinearRulesIngress } from './rules.js';\n\ntype RouteContext = Context;\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\n/** Erase a route handler's path-parameterized context to a plain `Context`. */\nfunction loose(c: unknown): RouteContext {\n  return c as RouteContext;\n}\n\n/**\n * Non-secret diagnostic snapshot of every Linear feature gate, mirroring the\n * GitHub diagnostics shape. Only booleans — never values.\n */\nexport interface LinearFeatureDiagnostics {\n  linearAppConfigured: boolean;\n  factoryAuthEnabled: boolean;\n  appDbConfigured: boolean;\n}\n\nexport interface MountLinearRoutesOptions {\n  /**\n   * The integration instance providing OAuth + GraphQL access. Required for\n   * everything beyond the disabled `status` route.\n   */\n  linear?: LinearIntegration;\n  /** Host auth seam. Linear connections are org-owned, so the feature is inert without it. */\n  auth: RouteAuth;\n  /**\n   * Absolute base URL of the web server (e.g. `http://localhost:4111`), used to\n   * build the OAuth redirect URI when one isn't explicitly configured.\n   */\n  baseUrl?: string;\n  /** Explicit OAuth callback URI; defaults to `<baseUrl>/auth/linear/callback`. */\n  redirectUri?: string;\n  /**\n   * Shared OAuth `state` signer (created once per boot by the factory).\n   * Required for the connect/callback flow; when absent, only the disabled\n   * `status` route is served.\n   */\n  stateSigner?: StateSigner;\n  /**\n   * Cross-integration intake selection domain. Required for the issues route's\n   * project filter; when absent, only the disabled `status` route is served.\n   */\n  intake?: IntakeStorage;\n  /**\n   * Factory project domain, used to keep single-project installs working\n   * without any source binding. When absent, unbound sources are treated as\n   * belonging to no project.\n   */\n  projects?: { list(input: { orgId: string }): Promise<unknown[]> };\n  ingestFactoryIssues?: (input: LinearRulesIngress) => Promise<unknown>;\n}\n\n/**\n * Narrow the caller's selected Linear sources to the ones that feed this\n * Factory project.\n *\n * A Linear issue carries no Factory project of its own, so without a binding\n * every board view would ingest every selected source's issues into whichever\n * project happened to be on screen. Bound sources win; when the org has no\n * bindings at all we fall back to the full selection for single-project\n * installs, where \"which project\" is unambiguous.\n */\nasync function scopeSourceIdsToProject({\n  intake,\n  projects,\n  orgId,\n  factoryProjectId,\n  selectedIds,\n}: {\n  intake: IntakeStorage;\n  projects: MountLinearRoutesOptions['projects'];\n  orgId: string;\n  factoryProjectId: string;\n  selectedIds: string[];\n}): Promise<string[]> {\n  const bound = await intake.listBoundSourceIds({ orgId, integrationId: 'linear', factoryProjectId });\n  if (bound.length > 0) {\n    const boundSet = new Set(bound);\n    return selectedIds.filter(id => boundSet.has(id));\n  }\n  const orgBindings = await intake.listBindings({ orgId, integrationId: 'linear' });\n  if (orgBindings.length > 0) return [];\n  if (!projects) return [];\n  const all = await projects.list({ orgId });\n  return all.length <= 1 ? selectedIds : [];\n}\n\n/**\n * Resolve the org-scoped tenant for a Linear request. The connection is\n * org-owned, so it requires both a signed-in user and an organization — same\n * tenancy rules as the GitHub routes.\n */\nasync function resolveOrgTenant(\n  c: RouteContext,\n  auth: RouteAuth,\n): Promise<{ tenant: { orgId: string; userId: string } } | { response: Response }> {\n  await auth.ensureUser(c);\n  const tenant = auth.tenant(c);\n  if (!tenant) return { response: c.json({ error: 'unauthorized' }, 401) };\n  if (!tenant.orgId) {\n    return {\n      response: c.json(\n        {\n          error: 'organization_required',\n          message: 'Linear intake requires an organization. Personal accounts cannot connect Linear.',\n        },\n        403,\n      ),\n    };\n  }\n  return { tenant: { orgId: tenant.orgId, userId: tenant.userId } };\n}\n\n/**\n * Validate an opaque Linear pagination cursor from the query string. Cursors\n * are server-issued (`pageInfo.endCursor`), so anything outside a conservative\n * charset/length is rejected rather than forwarded to Linear.\n */\nfunction parseAfterCursor(raw: string | undefined): string | undefined | null {\n  if (raw === undefined || raw === '') return undefined;\n  if (raw.length > 512 || !/^[\\w+/=.:-]+$/.test(raw)) return null;\n  return raw;\n}\n\n/** Map a Linear read failure to the API response for the SPA. */\nfunction linearFetchError(c: RouteContext, err: unknown) {\n  if (err instanceof LinearReauthRequiredError || (err as { status?: number }).status === 401) {\n    return c.json({ error: 'linear_reauth_required', message: new LinearReauthRequiredError().message }, 409);\n  }\n  return c.json({ error: 'linear_fetch_failed', message: err instanceof Error ? err.message : String(err) }, 502);\n}\n\n/**\n * Build the Linear routes as Mastra `apiRoutes`. When the feature is disabled,\n * returns only the `status` route so the SPA can detect the disabled state.\n */\nexport function buildLinearRoutes(options: MountLinearRoutesOptions): ApiRoute[] {\n  const routes: ApiRoute[] = [];\n  const { linear, auth, stateSigner, intake } = options;\n  const enabled = Boolean(linear) && auth.enabled();\n  const diagnostics = (): LinearFeatureDiagnostics => ({\n    linearAppConfigured: Boolean(linear),\n    factoryAuthEnabled: auth.enabled(),\n    appDbConfigured: true,\n  });\n\n  // The status route is always registered so the SPA can detect the disabled state.\n  routes.push(\n    registerApiRoute('/web/linear/status', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        if (!enabled || !linear || !stateSigner) {\n          return c.json({\n            enabled: false,\n            connected: false,\n            workspace: null,\n            reason: 'missing_config',\n            diagnostics: diagnostics(),\n          });\n        }\n        await auth.ensureUser(loose(c));\n        const tenant = auth.tenant(loose(c));\n        if (!tenant) return c.json({ error: 'unauthorized', reason: 'auth_required' }, 401);\n\n        if (!tenant.orgId) {\n          return c.json({\n            enabled: true,\n            organizationRequired: true,\n            connected: false,\n            workspace: null,\n            reason: 'organization_required',\n            diagnostics: diagnostics(),\n          });\n        }\n\n        const connection = await linear.loadConnection(tenant.orgId);\n        return c.json({\n          enabled: true,\n          connected: Boolean(connection),\n          workspace: connection ? { name: connection.workspaceName, urlKey: connection.workspaceUrlKey } : null,\n          reason: connection ? 'ready' : 'not_connected',\n          diagnostics: diagnostics(),\n        });\n      },\n    }),\n  );\n\n  // Without the integration instance or a state signer the connect/callback\n  // flow cannot talk to Linear or bind the OAuth round-trip to a tenant —\n  // serve only the disabled `status` route (mirrors the feature gate).\n  if (!enabled || !linear || !stateSigner || !intake) {\n    return routes;\n  }\n\n  const redirectUri = options.redirectUri ?? `${(options.baseUrl ?? '').replace(/\\/$/, '')}/auth/linear/callback`;\n\n  // ── Connect: send the user to Linear's OAuth consent screen ─────────────\n  routes.push(\n    registerApiRoute('/auth/linear/connect', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), auth);\n        if ('response' in resolved) return resolved.response;\n        const state = stateSigner.sign(resolved.tenant.orgId, resolved.tenant.userId);\n        return c.redirect(linear.buildAuthorizeUrl(state, redirectUri));\n      },\n    }),\n  );\n\n  // ── Callback: exchange the code, persist the connection for the org ─────\n  routes.push(\n    registerApiRoute('/auth/linear/callback', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), auth);\n        if ('response' in resolved) return resolved.response;\n        const { orgId, userId } = resolved.tenant;\n\n        // CSRF / cross-tenant linking protection: the signed state must belong\n        // to the same logged-in user *and* their current org.\n        const stateTenant = stateSigner.verify(c.req.query('state'));\n        if (!stateTenant || stateTenant.userId !== userId || stateTenant.orgId !== orgId) {\n          console.warn('[Linear] OAuth callback rejected: state/tenant mismatch.');\n          return c.redirect('/?linear=error');\n        }\n\n        const code = c.req.query('code');\n        if (!code) {\n          // User denied consent (or Linear returned an error).\n          return c.redirect('/?linear=error');\n        }\n\n        try {\n          const tokens = await linear.exchangeOAuthCode(code, redirectUri);\n          const workspace = await linear.fetchWorkspace(tokens.accessToken);\n          await linear.upsertConnection({\n            orgId,\n            userId,\n            accessToken: tokens.accessToken,\n            refreshToken: tokens.refreshToken,\n            expiresAt: tokens.expiresAt,\n            scope: tokens.scope,\n            workspaceName: workspace.name,\n            workspaceUrlKey: workspace.urlKey,\n          });\n        } catch (error) {\n          console.warn(`[Linear] OAuth callback failed to persist connection for org ${orgId}.`, error);\n          return c.redirect('/?linear=error');\n        }\n\n        return c.redirect('/?linear=connected');\n      },\n    }),\n  );\n\n  // ── List the workspace's projects (Settings intake-source picker) ───────\n  routes.push(\n    registerApiRoute('/web/linear/projects', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), auth);\n        if ('response' in resolved) return resolved.response;\n\n        const connection = await linear.loadConnection(resolved.tenant.orgId);\n        if (!connection) {\n          return c.json({ error: 'linear_not_connected', message: 'Connect Linear to list Linear projects.' }, 409);\n        }\n\n        try {\n          const accessToken = await linear.getFreshAccessToken(connection);\n          const projects = await linear.listProjects(accessToken);\n          return c.json({ projects });\n        } catch (err) {\n          return linearFetchError(loose(c), err);\n        }\n      },\n    }),\n  );\n\n  // ── List the workspace's active issues (cursor-paged) ───────────────────\n  // Respects the caller's intake config: disabled Linear intake 404s the\n  // source, and an explicit project selection narrows the issue filter.\n  routes.push(\n    registerApiRoute('/web/linear/issues', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        const resolved = await resolveOrgTenant(loose(c), auth);\n        if ('response' in resolved) return resolved.response;\n\n        const after = parseAfterCursor(c.req.query('after'));\n        if (after === null) return c.json({ error: 'invalid_cursor' }, 400);\n        const factoryProjectId = c.req.query('factoryProjectId');\n        if (factoryProjectId && !UUID_RE.test(factoryProjectId)) {\n          return c.json({ error: 'invalid_factory_project_id' }, 400);\n        }\n\n        const connection = await linear.loadConnection(resolved.tenant.orgId);\n        if (!connection) {\n          return c.json({ error: 'linear_not_connected', message: 'Connect Linear to see intake issues.' }, 409);\n        }\n\n        await intake.ensureReady();\n        const config = await intake.getConfig({\n          orgId: resolved.tenant.orgId,\n          userId: resolved.tenant.userId,\n          integrationIds: ['linear'],\n        });\n        const selection = config.linear!;\n        if (!selection.enabled) {\n          return c.json({ error: 'linear_intake_disabled', message: 'Linear intake is turned off in Settings.' }, 404);\n        }\n\n        // No projects selected means nothing is synced — don't fan out to Linear.\n        const selectedIds = selection.sourceIds ?? [];\n        // A board request is also an ingest, so it only ever sees the sources\n        // bound to that Factory project.\n        const projectIds = factoryProjectId\n          ? await scopeSourceIdsToProject({\n              intake,\n              projects: options.projects,\n              orgId: resolved.tenant.orgId,\n              factoryProjectId,\n              selectedIds,\n            })\n          : selectedIds;\n        if (projectIds.length === 0) {\n          return c.json({ issues: [], nextCursor: null });\n        }\n\n        try {\n          const accessToken = await linear.getFreshAccessToken(connection);\n          const { issues, nextCursor } = await linear.intake.listIssues({\n            connection: { type: 'oauth', accessToken },\n            sourceIds: projectIds,\n            cursor: after,\n          });\n          const issuePayload = issues.map(issue => ({\n            id: issue.id,\n            identifier: issue.identifier,\n            title: issue.title,\n            url: issue.url,\n            state: issue.state ?? '',\n            stateType: issue.stateType ?? '',\n            priorityLabel: issue.priority ?? '',\n            assignee: issue.assignee,\n            creator: issue.author,\n            team: issue.source,\n            labels: issue.labels,\n            createdAt: issue.createdAt,\n            updatedAt: issue.updatedAt,\n          }));\n          if (factoryProjectId && options.ingestFactoryIssues) {\n            await options.ingestFactoryIssues({\n              orgId: resolved.tenant.orgId,\n              userId: resolved.tenant.userId,\n              factoryProjectId,\n              issues: issuePayload,\n            });\n          }\n          return c.json({ issues: issuePayload, nextCursor });\n        } catch (err) {\n          return linearFetchError(loose(c), err);\n        }\n      },\n    }),\n  );\n\n  return routes;\n}\n"],"mappings":";;;AA0BA,MAAM,UAAU;;AAGhB,SAAS,MAAM,GAA0B;CACvC,OAAO;AACT;;;;;;;;;;;AAyDA,eAAe,wBAAwB,EACrC,QACA,UACA,OACA,kBACA,eAOoB;CACpB,MAAM,QAAQ,MAAM,OAAO,mBAAmB;EAAE;EAAO,eAAe;EAAU;CAAiB,CAAC;CAClG,IAAI,MAAM,SAAS,GAAG;EACpB,MAAM,WAAW,IAAI,IAAI,KAAK;EAC9B,OAAO,YAAY,QAAO,OAAM,SAAS,IAAI,EAAE,CAAC;CAClD;CAEA,KAAI,MADsB,OAAO,aAAa;EAAE;EAAO,eAAe;CAAS,CAAC,EAAA,CAChE,SAAS,GAAG,OAAO,CAAC;CACpC,IAAI,CAAC,UAAU,OAAO,CAAC;CAEvB,QAAO,MADW,SAAS,KAAK,EAAE,MAAM,CAAC,EAAA,CAC9B,UAAU,IAAI,cAAc,CAAC;AAC1C;;;;;;AAOA,eAAe,iBACb,GACA,MACiF;CACjF,MAAM,KAAK,WAAW,CAAC;CACvB,MAAM,SAAS,KAAK,OAAO,CAAC;CAC5B,IAAI,CAAC,QAAQ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG,EAAE;CACvE,IAAI,CAAC,OAAO,OACV,OAAO,EACL,UAAU,EAAE,KACV;EACE,OAAO;EACP,SAAS;CACX,GACA,GACF,EACF;CAEF,OAAO,EAAE,QAAQ;EAAE,OAAO,OAAO;EAAO,QAAQ,OAAO;CAAO,EAAE;AAClE;;;;;;AAOA,SAAS,iBAAiB,KAAoD;CAC5E,IAAI,QAAQ,KAAA,KAAa,QAAQ,IAAI,OAAO,KAAA;CAC5C,IAAI,IAAI,SAAS,OAAO,CAAC,gBAAgB,KAAK,GAAG,GAAG,OAAO;CAC3D,OAAO;AACT;;AAGA,SAAS,iBAAiB,GAAiB,KAAc;CACvD,IAAI,eAAe,6BAA8B,IAA4B,WAAW,KACtF,OAAO,EAAE,KAAK;EAAE,OAAO;EAA0B,SAAS,IAAI,0BAA0B,CAAC,CAAC;CAAQ,GAAG,GAAG;CAE1G,OAAO,EAAE,KAAK;EAAE,OAAO;EAAuB,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;CAAE,GAAG,GAAG;AAChH;;;;;AAMA,SAAgB,kBAAkB,SAA+C;CAC/E,MAAM,SAAqB,CAAC;CAC5B,MAAM,EAAE,QAAQ,MAAM,aAAa,WAAW;CAC9C,MAAM,UAAU,QAAQ,MAAM,KAAK,KAAK,QAAQ;CAChD,MAAM,qBAA+C;EACnD,qBAAqB,QAAQ,MAAM;EACnC,oBAAoB,KAAK,QAAQ;EACjC,iBAAiB;CACnB;CAGA,OAAO,KACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,aAC1B,OAAO,EAAE,KAAK;IACZ,SAAS;IACT,WAAW;IACX,WAAW;IACX,QAAQ;IACR,aAAa,YAAY;GAC3B,CAAC;GAEH,MAAM,KAAK,WAAW,MAAM,CAAC,CAAC;GAC9B,MAAM,SAAS,KAAK,OAAO,MAAM,CAAC,CAAC;GACnC,IAAI,CAAC,QAAQ,OAAO,EAAE,KAAK;IAAE,OAAO;IAAgB,QAAQ;GAAgB,GAAG,GAAG;GAElF,IAAI,CAAC,OAAO,OACV,OAAO,EAAE,KAAK;IACZ,SAAS;IACT,sBAAsB;IACtB,WAAW;IACX,WAAW;IACX,QAAQ;IACR,aAAa,YAAY;GAC3B,CAAC;GAGH,MAAM,aAAa,MAAM,OAAO,eAAe,OAAO,KAAK;GAC3D,OAAO,EAAE,KAAK;IACZ,SAAS;IACT,WAAW,QAAQ,UAAU;IAC7B,WAAW,aAAa;KAAE,MAAM,WAAW;KAAe,QAAQ,WAAW;IAAgB,IAAI;IACjG,QAAQ,aAAa,UAAU;IAC/B,aAAa,YAAY;GAC3B,CAAC;EACH;CACF,CAAC,CACH;CAKA,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,eAAe,CAAC,QAC1C,OAAO;CAGT,MAAM,cAAc,QAAQ,eAAe,IAAI,QAAQ,WAAW,GAAA,CAAI,QAAQ,OAAO,EAAE,EAAE;CAGzF,OAAO,KACL,iBAAiB,wBAAwB;EACvC,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,IAAI;GACtD,IAAI,cAAc,UAAU,OAAO,SAAS;GAC5C,MAAM,QAAQ,YAAY,KAAK,SAAS,OAAO,OAAO,SAAS,OAAO,MAAM;GAC5E,OAAO,EAAE,SAAS,OAAO,kBAAkB,OAAO,WAAW,CAAC;EAChE;CACF,CAAC,CACH;CAGA,OAAO,KACL,iBAAiB,yBAAyB;EACxC,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,IAAI;GACtD,IAAI,cAAc,UAAU,OAAO,SAAS;GAC5C,MAAM,EAAE,OAAO,WAAW,SAAS;GAInC,MAAM,cAAc,YAAY,OAAO,EAAE,IAAI,MAAM,OAAO,CAAC;GAC3D,IAAI,CAAC,eAAe,YAAY,WAAW,UAAU,YAAY,UAAU,OAAO;IAChF,QAAQ,KAAK,0DAA0D;IACvE,OAAO,EAAE,SAAS,gBAAgB;GACpC;GAEA,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;GAC/B,IAAI,CAAC,MAEH,OAAO,EAAE,SAAS,gBAAgB;GAGpC,IAAI;IACF,MAAM,SAAS,MAAM,OAAO,kBAAkB,MAAM,WAAW;IAC/D,MAAM,YAAY,MAAM,OAAO,eAAe,OAAO,WAAW;IAChE,MAAM,OAAO,iBAAiB;KAC5B;KACA;KACA,aAAa,OAAO;KACpB,cAAc,OAAO;KACrB,WAAW,OAAO;KAClB,OAAO,OAAO;KACd,eAAe,UAAU;KACzB,iBAAiB,UAAU;IAC7B,CAAC;GACH,SAAS,OAAO;IACd,QAAQ,KAAK,gEAAgE,MAAM,IAAI,KAAK;IAC5F,OAAO,EAAE,SAAS,gBAAgB;GACpC;GAEA,OAAO,EAAE,SAAS,oBAAoB;EACxC;CACF,CAAC,CACH;CAGA,OAAO,KACL,iBAAiB,wBAAwB;EACvC,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,IAAI;GACtD,IAAI,cAAc,UAAU,OAAO,SAAS;GAE5C,MAAM,aAAa,MAAM,OAAO,eAAe,SAAS,OAAO,KAAK;GACpE,IAAI,CAAC,YACH,OAAO,EAAE,KAAK;IAAE,OAAO;IAAwB,SAAS;GAA0C,GAAG,GAAG;GAG1G,IAAI;IACF,MAAM,cAAc,MAAM,OAAO,oBAAoB,UAAU;IAC/D,MAAM,WAAW,MAAM,OAAO,aAAa,WAAW;IACtD,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC;GAC5B,SAAS,KAAK;IACZ,OAAO,iBAAiB,MAAM,CAAC,GAAG,GAAG;GACvC;EACF;CACF,CAAC,CACH;CAKA,OAAO,KACL,iBAAiB,sBAAsB;EACrC,QAAQ;EACR,cAAc;EACd,SAAS,OAAM,MAAK;GAClB,MAAM,WAAW,MAAM,iBAAiB,MAAM,CAAC,GAAG,IAAI;GACtD,IAAI,cAAc,UAAU,OAAO,SAAS;GAE5C,MAAM,QAAQ,iBAAiB,EAAE,IAAI,MAAM,OAAO,CAAC;GACnD,IAAI,UAAU,MAAM,OAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;GAClE,MAAM,mBAAmB,EAAE,IAAI,MAAM,kBAAkB;GACvD,IAAI,oBAAoB,CAAC,QAAQ,KAAK,gBAAgB,GACpD,OAAO,EAAE,KAAK,EAAE,OAAO,6BAA6B,GAAG,GAAG;GAG5D,MAAM,aAAa,MAAM,OAAO,eAAe,SAAS,OAAO,KAAK;GACpE,IAAI,CAAC,YACH,OAAO,EAAE,KAAK;IAAE,OAAO;IAAwB,SAAS;GAAuC,GAAG,GAAG;GAGvG,MAAM,OAAO,YAAY;GAMzB,MAAM,aAAY,MALG,OAAO,UAAU;IACpC,OAAO,SAAS,OAAO;IACvB,QAAQ,SAAS,OAAO;IACxB,gBAAgB,CAAC,QAAQ;GAC3B,CAAC,EAAA,CACwB;GACzB,IAAI,CAAC,UAAU,SACb,OAAO,EAAE,KAAK;IAAE,OAAO;IAA0B,SAAS;GAA2C,GAAG,GAAG;GAI7G,MAAM,cAAc,UAAU,aAAa,CAAC;GAG5C,MAAM,aAAa,mBACf,MAAM,wBAAwB;IAC5B;IACA,UAAU,QAAQ;IAClB,OAAO,SAAS,OAAO;IACvB;IACA;GACF,CAAC,IACD;GACJ,IAAI,WAAW,WAAW,GACxB,OAAO,EAAE,KAAK;IAAE,QAAQ,CAAC;IAAG,YAAY;GAAK,CAAC;GAGhD,IAAI;IACF,MAAM,cAAc,MAAM,OAAO,oBAAoB,UAAU;IAC/D,MAAM,EAAE,QAAQ,eAAe,MAAM,OAAO,OAAO,WAAW;KAC5D,YAAY;MAAE,MAAM;MAAS;KAAY;KACzC,WAAW;KACX,QAAQ;IACV,CAAC;IACD,MAAM,eAAe,OAAO,KAAI,WAAU;KACxC,IAAI,MAAM;KACV,YAAY,MAAM;KAClB,OAAO,MAAM;KACb,KAAK,MAAM;KACX,OAAO,MAAM,SAAS;KACtB,WAAW,MAAM,aAAa;KAC9B,eAAe,MAAM,YAAY;KACjC,UAAU,MAAM;KAChB,SAAS,MAAM;KACf,MAAM,MAAM;KACZ,QAAQ,MAAM;KACd,WAAW,MAAM;KACjB,WAAW,MAAM;IACnB,EAAE;IACF,IAAI,oBAAoB,QAAQ,qBAC9B,MAAM,QAAQ,oBAAoB;KAChC,OAAO,SAAS,OAAO;KACvB,QAAQ,SAAS,OAAO;KACxB;KACA,QAAQ;IACV,CAAC;IAEH,OAAO,EAAE,KAAK;KAAE,QAAQ;KAAc;IAAW,CAAC;GACpD,SAAS,KAAK;IACZ,OAAO,iBAAiB,MAAM,CAAC,GAAG,GAAG;GACvC;EACF;CACF,CAAC,CACH;CAEA,OAAO;AACT"}

package/dist/integrations/linear/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../src/integrations/linear/rules.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAiD,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAExG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,KAAK,EAAe,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC9F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAkBrD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,EAAE,gBAAgB,CAAC;IAC1B,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,KAAK,aAAa,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,CAAC;AAE1D,qBAAa,WAAW;;IACV,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,kBAAkB;IAElD,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,aAAa,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CA+F9F;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,CAAC,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAQ/D"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../src/integrations/linear/rules.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAiD,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAExG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,KAAK,EAAe,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC9F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAkBrD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,EAAE,gBAAgB,CAAC;IAC1B,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,KAAK,aAAa,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,CAAC;AAE1D,qBAAa,WAAW;;IACV,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,kBAAkB;IAElD,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,aAAa,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAgG9F;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,CAAC,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAQ/D"}

package/dist/integrations/linear/rules.js

@@ -75,7 +75,8 @@ var LinearRules = class {
 					parentWorkItemId: relatedItem.parentWorkItemId,
 					title: relatedItem.title,
 					url: relatedItem.externalSource?.url ?? null,
-					stages: relatedItem.stages
+					stages: relatedItem.stages,
+					metadata: relatedItem.metadata
 				},
 				board: "work",
 				itemRevision: relatedItem.revision

package/dist/integrations/linear/rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules.js","names":["#ingestIssue"],"sources":["../../../src/integrations/linear/rules.ts"],"sourcesContent":["import { resolveFactoryLinearRule } from '../../rules/resolve.js';\nimport type { FactoryLinearRuleContext, FactoryRuleDecision, FactoryRules } from '../../rules/types.js';\nimport { validateFactoryRuleDecisions } from '../../rules/validation.js';\nimport type { FactoryProjectsStorage } from '../../storage/domains/projects/base.js';\nimport type { WorkItemRow, WorkItemsStorage } from '../../storage/domains/work-items/base.js';\nimport type { IntegrationContext } from '../base.js';\n\nconst RULE_TIMEOUT_MS = 5_000;\n\nasync function withRuleTimeout<T>(promise: Promise<T>): Promise<T> {\n  let timeout: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      promise,\n      new Promise<never>((_, reject) => {\n        timeout = setTimeout(() => reject(new Error('FACTORY_RULE_TIMEOUT')), RULE_TIMEOUT_MS);\n      }),\n    ]);\n  } finally {\n    if (timeout) clearTimeout(timeout);\n  }\n}\n\nexport interface LinearIssueIngress {\n  id: string;\n  identifier: string;\n  title: string;\n  url: string;\n  state: string;\n  stateType: string;\n  priorityLabel: string;\n  assignee: string | null;\n  /** Display name of the Linear user who created the issue, when available. */\n  creator: string | null;\n  team: string | null;\n  labels: string[];\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport interface LinearRulesOptions {\n  projects: Pick<FactoryProjectsStorage, 'get'>;\n  storage: WorkItemsStorage;\n  rules: FactoryRules;\n}\n\nexport interface LinearRulesIngress {\n  orgId: string;\n  userId: string;\n  factoryProjectId: string;\n  issues: LinearIssueIngress[];\n}\n\ntype IngressStatus = 'committed' | 'replayed' | 'missing';\n\nexport class LinearRules {\n  constructor(private readonly options: LinearRulesOptions) {}\n\n  async ingest(input: LinearRulesIngress): Promise<{ status: IngressStatus; ingested: number }> {\n    const project = await this.options.projects.get({ orgId: input.orgId, id: input.factoryProjectId });\n    if (!project) return { status: 'missing', ingested: 0 };\n\n    const items = await this.options.storage.list({ orgId: input.orgId, factoryProjectId: input.factoryProjectId });\n    const itemsBySourceKey = new Map(items.map(item => [item.externalSource?.externalId, item]));\n    const statuses: IngressStatus[] = [];\n    for (const issue of input.issues) {\n      statuses.push(await this.#ingestIssue(input, issue, itemsBySourceKey.get(`linear:${issue.identifier}`)));\n    }\n    if (statuses.some(status => status === 'committed')) return { status: 'committed', ingested: statuses.length };\n    if (statuses.some(status => status === 'replayed')) return { status: 'replayed', ingested: statuses.length };\n    return { status: 'missing', ingested: statuses.length };\n  }\n\n  async #ingestIssue(\n    input: LinearRulesIngress,\n    issue: LinearIssueIngress,\n    relatedItem: WorkItemRow | undefined,\n  ): Promise<IngressStatus> {\n    const ingressId = `linear:${issue.id}:${issue.updatedAt}`;\n    const actor = { type: 'human' as const, id: input.userId };\n\n    // Closed issues without existing work items should not create new ones.\n    const isClosed = issue.stateType === 'completed' || issue.stateType === 'canceled';\n    if (isClosed && !relatedItem) {\n      return 'missing';\n    }\n\n    const event = isClosed ? 'issueClosed' : 'issueObserved';\n    const context: FactoryLinearRuleContext = {\n      tenant: { orgId: input.orgId, projectId: input.factoryProjectId },\n      actor,\n      ingress: { type: 'linear', id: ingressId },\n      cause: `linear.${event}`,\n      causalChain: [],\n      ruleSetVersion: this.options.rules.version,\n      ...(relatedItem\n        ? {\n            item: {\n              id: relatedItem.id,\n              source: 'linear-issue',\n              sourceKey: relatedItem.externalSource?.externalId ?? null,\n              parentWorkItemId: relatedItem.parentWorkItemId,\n              title: relatedItem.title,\n              url: relatedItem.externalSource?.url ?? null,\n              stages: relatedItem.stages,\n            },\n            board: 'work' as const,\n            itemRevision: relatedItem.revision,\n          }\n        : {}),\n      event,\n      issue,\n    };\n\n    const rule = resolveFactoryLinearRule(this.options.rules, context.event);\n    let decision: FactoryRuleDecision | void;\n    let decisions: Record<string, unknown>[] = [];\n    let outcome: { status: 'accepted' | 'rejected'; code?: string; reason?: string } = { status: 'accepted' };\n    try {\n      decision = rule ? await withRuleTimeout(Promise.resolve(rule(Object.freeze(context)))) : undefined;\n      if (decision?.type === 'reject') {\n        outcome = { status: 'rejected', code: decision.code, reason: decision.reason };\n      } else if (decision) {\n        decisions = validateFactoryRuleDecisions([decision]).map(entry => ({ ...entry }));\n      }\n    } catch (error) {\n      const timedOut = error instanceof Error && error.message === 'FACTORY_RULE_TIMEOUT';\n      outcome = {\n        status: 'rejected',\n        code: timedOut ? 'timeout' : 'rule_error',\n        reason: timedOut\n          ? 'Factory rule evaluation timed out.'\n          : error instanceof Error\n            ? error.message.slice(0, 2_000)\n            : 'Factory Linear rule failed.',\n      };\n    }\n\n    const committed = await this.options.storage.commitRuleEvaluation({\n      orgId: input.orgId,\n      factoryProjectId: input.factoryProjectId,\n      workItemId: relatedItem?.id ?? null,\n      ingress: { identity: ingressId, triggerType: 'linear.issueObserved' },\n      ruleSetVersion: this.options.rules.version,\n      expectedRevision: relatedItem?.revision ?? null,\n      actor,\n      outcome,\n      decisions,\n      causalChain: [],\n      now: new Date(),\n    });\n    return committed.status;\n  }\n}\n\nexport function attachLinearRules(\n  context: IntegrationContext,\n): ((input: LinearRulesIngress) => Promise<unknown>) | undefined {\n  if (!context.rules) return undefined;\n  const rules = new LinearRules({\n    projects: context.storage.projects,\n    storage: context.rules.workItems,\n    rules: context.rules.config,\n  });\n  return input => rules.ingest(input);\n}\n"],"mappings":";;;AAOA,MAAM,kBAAkB;AAExB,eAAe,gBAAmB,SAAiC;CACjE,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,SACA,IAAI,SAAgB,GAAG,WAAW;GAChC,UAAU,iBAAiB,uBAAO,IAAI,MAAM,sBAAsB,CAAC,GAAG,eAAe;EACvF,CAAC,CACH,CAAC;CACH,UAAU;EACR,IAAI,SAAS,aAAa,OAAO;CACnC;AACF;AAkCA,IAAa,cAAb,MAAyB;CACM;CAA7B,YAAY,SAA8C;EAA7B,KAAA,UAAA;CAA8B;CAE3D,MAAM,OAAO,OAAiF;EAE5F,IAAI,CAAC,MADiB,KAAK,QAAQ,SAAS,IAAI;GAAE,OAAO,MAAM;GAAO,IAAI,MAAM;EAAiB,CAAC,GACpF,OAAO;GAAE,QAAQ;GAAW,UAAU;EAAE;EAEtD,MAAM,QAAQ,MAAM,KAAK,QAAQ,QAAQ,KAAK;GAAE,OAAO,MAAM;GAAO,kBAAkB,MAAM;EAAiB,CAAC;EAC9G,MAAM,mBAAmB,IAAI,IAAI,MAAM,KAAI,SAAQ,CAAC,KAAK,gBAAgB,YAAY,IAAI,CAAC,CAAC;EAC3F,MAAM,WAA4B,CAAC;EACnC,KAAK,MAAM,SAAS,MAAM,QACxB,SAAS,KAAK,MAAM,KAAKA,aAAa,OAAO,OAAO,iBAAiB,IAAI,UAAU,MAAM,YAAY,CAAC,CAAC;EAEzG,IAAI,SAAS,MAAK,WAAU,WAAW,WAAW,GAAG,OAAO;GAAE,QAAQ;GAAa,UAAU,SAAS;EAAO;EAC7G,IAAI,SAAS,MAAK,WAAU,WAAW,UAAU,GAAG,OAAO;GAAE,QAAQ;GAAY,UAAU,SAAS;EAAO;EAC3G,OAAO;GAAE,QAAQ;GAAW,UAAU,SAAS;EAAO;CACxD;CAEA,MAAMA,aACJ,OACA,OACA,aACwB;EACxB,MAAM,YAAY,UAAU,MAAM,GAAG,GAAG,MAAM;EAC9C,MAAM,QAAQ;GAAE,MAAM;GAAkB,IAAI,MAAM;EAAO;EAGzD,MAAM,WAAW,MAAM,cAAc,eAAe,MAAM,cAAc;EACxE,IAAI,YAAY,CAAC,aACf,OAAO;EAGT,MAAM,QAAQ,WAAW,gBAAgB;EACzC,MAAM,UAAoC;GACxC,QAAQ;IAAE,OAAO,MAAM;IAAO,WAAW,MAAM;GAAiB;GAChE;GACA,SAAS;IAAE,MAAM;IAAU,IAAI;GAAU;GACzC,OAAO,UAAU;GACjB,aAAa,CAAC;GACd,gBAAgB,KAAK,QAAQ,MAAM;GACnC,GAAI,cACA;IACE,MAAM;KACJ,IAAI,YAAY;KAChB,QAAQ;KACR,WAAW,YAAY,gBAAgB,cAAc;KACrD,kBAAkB,YAAY;KAC9B,OAAO,YAAY;KACnB,KAAK,YAAY,gBAAgB,OAAO;KACxC,QAAQ,YAAY;IACtB;IACA,OAAO;IACP,cAAc,YAAY;GAC5B,IACA,CAAC;GACL;GACA;EACF;EAEA,MAAM,OAAO,yBAAyB,KAAK,QAAQ,OAAO,QAAQ,KAAK;EACvE,IAAI;EACJ,IAAI,YAAuC,CAAC;EAC5C,IAAI,UAA+E,EAAE,QAAQ,WAAW;EACxG,IAAI;GACF,WAAW,OAAO,MAAM,gBAAgB,QAAQ,QAAQ,KAAK,OAAO,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,KAAA;GACzF,IAAI,UAAU,SAAS,UACrB,UAAU;IAAE,QAAQ;IAAY,MAAM,SAAS;IAAM,QAAQ,SAAS;GAAO;QACxE,IAAI,UACT,YAAY,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAI,WAAU,EAAE,GAAG,MAAM,EAAE;EAEpF,SAAS,OAAO;GACd,MAAM,WAAW,iBAAiB,SAAS,MAAM,YAAY;GAC7D,UAAU;IACR,QAAQ;IACR,MAAM,WAAW,YAAY;IAC7B,QAAQ,WACJ,uCACA,iBAAiB,QACf,MAAM,QAAQ,MAAM,GAAG,GAAK,IAC5B;GACR;EACF;EAeA,QAAO,MAbiB,KAAK,QAAQ,QAAQ,qBAAqB;GAChE,OAAO,MAAM;GACb,kBAAkB,MAAM;GACxB,YAAY,aAAa,MAAM;GAC/B,SAAS;IAAE,UAAU;IAAW,aAAa;GAAuB;GACpE,gBAAgB,KAAK,QAAQ,MAAM;GACnC,kBAAkB,aAAa,YAAY;GAC3C;GACA;GACA;GACA,aAAa,CAAC;GACd,qBAAK,IAAI,KAAK;EAChB,CAAC,EAAA,CACgB;CACnB;AACF;AAEA,SAAgB,kBACd,SAC+D;CAC/D,IAAI,CAAC,QAAQ,OAAO,OAAO,KAAA;CAC3B,MAAM,QAAQ,IAAI,YAAY;EAC5B,UAAU,QAAQ,QAAQ;EAC1B,SAAS,QAAQ,MAAM;EACvB,OAAO,QAAQ,MAAM;CACvB,CAAC;CACD,QAAO,UAAS,MAAM,OAAO,KAAK;AACpC"}
+{"version":3,"file":"rules.js","names":["#ingestIssue"],"sources":["../../../src/integrations/linear/rules.ts"],"sourcesContent":["import { resolveFactoryLinearRule } from '../../rules/resolve.js';\nimport type { FactoryLinearRuleContext, FactoryRuleDecision, FactoryRules } from '../../rules/types.js';\nimport { validateFactoryRuleDecisions } from '../../rules/validation.js';\nimport type { FactoryProjectsStorage } from '../../storage/domains/projects/base.js';\nimport type { WorkItemRow, WorkItemsStorage } from '../../storage/domains/work-items/base.js';\nimport type { IntegrationContext } from '../base.js';\n\nconst RULE_TIMEOUT_MS = 5_000;\n\nasync function withRuleTimeout<T>(promise: Promise<T>): Promise<T> {\n  let timeout: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      promise,\n      new Promise<never>((_, reject) => {\n        timeout = setTimeout(() => reject(new Error('FACTORY_RULE_TIMEOUT')), RULE_TIMEOUT_MS);\n      }),\n    ]);\n  } finally {\n    if (timeout) clearTimeout(timeout);\n  }\n}\n\nexport interface LinearIssueIngress {\n  id: string;\n  identifier: string;\n  title: string;\n  url: string;\n  state: string;\n  stateType: string;\n  priorityLabel: string;\n  assignee: string | null;\n  /** Display name of the Linear user who created the issue, when available. */\n  creator: string | null;\n  team: string | null;\n  labels: string[];\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport interface LinearRulesOptions {\n  projects: Pick<FactoryProjectsStorage, 'get'>;\n  storage: WorkItemsStorage;\n  rules: FactoryRules;\n}\n\nexport interface LinearRulesIngress {\n  orgId: string;\n  userId: string;\n  factoryProjectId: string;\n  issues: LinearIssueIngress[];\n}\n\ntype IngressStatus = 'committed' | 'replayed' | 'missing';\n\nexport class LinearRules {\n  constructor(private readonly options: LinearRulesOptions) {}\n\n  async ingest(input: LinearRulesIngress): Promise<{ status: IngressStatus; ingested: number }> {\n    const project = await this.options.projects.get({ orgId: input.orgId, id: input.factoryProjectId });\n    if (!project) return { status: 'missing', ingested: 0 };\n\n    const items = await this.options.storage.list({ orgId: input.orgId, factoryProjectId: input.factoryProjectId });\n    const itemsBySourceKey = new Map(items.map(item => [item.externalSource?.externalId, item]));\n    const statuses: IngressStatus[] = [];\n    for (const issue of input.issues) {\n      statuses.push(await this.#ingestIssue(input, issue, itemsBySourceKey.get(`linear:${issue.identifier}`)));\n    }\n    if (statuses.some(status => status === 'committed')) return { status: 'committed', ingested: statuses.length };\n    if (statuses.some(status => status === 'replayed')) return { status: 'replayed', ingested: statuses.length };\n    return { status: 'missing', ingested: statuses.length };\n  }\n\n  async #ingestIssue(\n    input: LinearRulesIngress,\n    issue: LinearIssueIngress,\n    relatedItem: WorkItemRow | undefined,\n  ): Promise<IngressStatus> {\n    const ingressId = `linear:${issue.id}:${issue.updatedAt}`;\n    const actor = { type: 'human' as const, id: input.userId };\n\n    // Closed issues without existing work items should not create new ones.\n    const isClosed = issue.stateType === 'completed' || issue.stateType === 'canceled';\n    if (isClosed && !relatedItem) {\n      return 'missing';\n    }\n\n    const event = isClosed ? 'issueClosed' : 'issueObserved';\n    const context: FactoryLinearRuleContext = {\n      tenant: { orgId: input.orgId, projectId: input.factoryProjectId },\n      actor,\n      ingress: { type: 'linear', id: ingressId },\n      cause: `linear.${event}`,\n      causalChain: [],\n      ruleSetVersion: this.options.rules.version,\n      ...(relatedItem\n        ? {\n            item: {\n              id: relatedItem.id,\n              source: 'linear-issue',\n              sourceKey: relatedItem.externalSource?.externalId ?? null,\n              parentWorkItemId: relatedItem.parentWorkItemId,\n              title: relatedItem.title,\n              url: relatedItem.externalSource?.url ?? null,\n              stages: relatedItem.stages,\n              metadata: relatedItem.metadata,\n            },\n            board: 'work' as const,\n            itemRevision: relatedItem.revision,\n          }\n        : {}),\n      event,\n      issue,\n    };\n\n    const rule = resolveFactoryLinearRule(this.options.rules, context.event);\n    let decision: FactoryRuleDecision | void;\n    let decisions: Record<string, unknown>[] = [];\n    let outcome: { status: 'accepted' | 'rejected'; code?: string; reason?: string } = { status: 'accepted' };\n    try {\n      decision = rule ? await withRuleTimeout(Promise.resolve(rule(Object.freeze(context)))) : undefined;\n      if (decision?.type === 'reject') {\n        outcome = { status: 'rejected', code: decision.code, reason: decision.reason };\n      } else if (decision) {\n        decisions = validateFactoryRuleDecisions([decision]).map(entry => ({ ...entry }));\n      }\n    } catch (error) {\n      const timedOut = error instanceof Error && error.message === 'FACTORY_RULE_TIMEOUT';\n      outcome = {\n        status: 'rejected',\n        code: timedOut ? 'timeout' : 'rule_error',\n        reason: timedOut\n          ? 'Factory rule evaluation timed out.'\n          : error instanceof Error\n            ? error.message.slice(0, 2_000)\n            : 'Factory Linear rule failed.',\n      };\n    }\n\n    const committed = await this.options.storage.commitRuleEvaluation({\n      orgId: input.orgId,\n      factoryProjectId: input.factoryProjectId,\n      workItemId: relatedItem?.id ?? null,\n      ingress: { identity: ingressId, triggerType: 'linear.issueObserved' },\n      ruleSetVersion: this.options.rules.version,\n      expectedRevision: relatedItem?.revision ?? null,\n      actor,\n      outcome,\n      decisions,\n      causalChain: [],\n      now: new Date(),\n    });\n    return committed.status;\n  }\n}\n\nexport function attachLinearRules(\n  context: IntegrationContext,\n): ((input: LinearRulesIngress) => Promise<unknown>) | undefined {\n  if (!context.rules) return undefined;\n  const rules = new LinearRules({\n    projects: context.storage.projects,\n    storage: context.rules.workItems,\n    rules: context.rules.config,\n  });\n  return input => rules.ingest(input);\n}\n"],"mappings":";;;AAOA,MAAM,kBAAkB;AAExB,eAAe,gBAAmB,SAAiC;CACjE,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,SACA,IAAI,SAAgB,GAAG,WAAW;GAChC,UAAU,iBAAiB,uBAAO,IAAI,MAAM,sBAAsB,CAAC,GAAG,eAAe;EACvF,CAAC,CACH,CAAC;CACH,UAAU;EACR,IAAI,SAAS,aAAa,OAAO;CACnC;AACF;AAkCA,IAAa,cAAb,MAAyB;CACM;CAA7B,YAAY,SAA8C;EAA7B,KAAA,UAAA;CAA8B;CAE3D,MAAM,OAAO,OAAiF;EAE5F,IAAI,CAAC,MADiB,KAAK,QAAQ,SAAS,IAAI;GAAE,OAAO,MAAM;GAAO,IAAI,MAAM;EAAiB,CAAC,GACpF,OAAO;GAAE,QAAQ;GAAW,UAAU;EAAE;EAEtD,MAAM,QAAQ,MAAM,KAAK,QAAQ,QAAQ,KAAK;GAAE,OAAO,MAAM;GAAO,kBAAkB,MAAM;EAAiB,CAAC;EAC9G,MAAM,mBAAmB,IAAI,IAAI,MAAM,KAAI,SAAQ,CAAC,KAAK,gBAAgB,YAAY,IAAI,CAAC,CAAC;EAC3F,MAAM,WAA4B,CAAC;EACnC,KAAK,MAAM,SAAS,MAAM,QACxB,SAAS,KAAK,MAAM,KAAKA,aAAa,OAAO,OAAO,iBAAiB,IAAI,UAAU,MAAM,YAAY,CAAC,CAAC;EAEzG,IAAI,SAAS,MAAK,WAAU,WAAW,WAAW,GAAG,OAAO;GAAE,QAAQ;GAAa,UAAU,SAAS;EAAO;EAC7G,IAAI,SAAS,MAAK,WAAU,WAAW,UAAU,GAAG,OAAO;GAAE,QAAQ;GAAY,UAAU,SAAS;EAAO;EAC3G,OAAO;GAAE,QAAQ;GAAW,UAAU,SAAS;EAAO;CACxD;CAEA,MAAMA,aACJ,OACA,OACA,aACwB;EACxB,MAAM,YAAY,UAAU,MAAM,GAAG,GAAG,MAAM;EAC9C,MAAM,QAAQ;GAAE,MAAM;GAAkB,IAAI,MAAM;EAAO;EAGzD,MAAM,WAAW,MAAM,cAAc,eAAe,MAAM,cAAc;EACxE,IAAI,YAAY,CAAC,aACf,OAAO;EAGT,MAAM,QAAQ,WAAW,gBAAgB;EACzC,MAAM,UAAoC;GACxC,QAAQ;IAAE,OAAO,MAAM;IAAO,WAAW,MAAM;GAAiB;GAChE;GACA,SAAS;IAAE,MAAM;IAAU,IAAI;GAAU;GACzC,OAAO,UAAU;GACjB,aAAa,CAAC;GACd,gBAAgB,KAAK,QAAQ,MAAM;GACnC,GAAI,cACA;IACE,MAAM;KACJ,IAAI,YAAY;KAChB,QAAQ;KACR,WAAW,YAAY,gBAAgB,cAAc;KACrD,kBAAkB,YAAY;KAC9B,OAAO,YAAY;KACnB,KAAK,YAAY,gBAAgB,OAAO;KACxC,QAAQ,YAAY;KACpB,UAAU,YAAY;IACxB;IACA,OAAO;IACP,cAAc,YAAY;GAC5B,IACA,CAAC;GACL;GACA;EACF;EAEA,MAAM,OAAO,yBAAyB,KAAK,QAAQ,OAAO,QAAQ,KAAK;EACvE,IAAI;EACJ,IAAI,YAAuC,CAAC;EAC5C,IAAI,UAA+E,EAAE,QAAQ,WAAW;EACxG,IAAI;GACF,WAAW,OAAO,MAAM,gBAAgB,QAAQ,QAAQ,KAAK,OAAO,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,KAAA;GACzF,IAAI,UAAU,SAAS,UACrB,UAAU;IAAE,QAAQ;IAAY,MAAM,SAAS;IAAM,QAAQ,SAAS;GAAO;QACxE,IAAI,UACT,YAAY,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAI,WAAU,EAAE,GAAG,MAAM,EAAE;EAEpF,SAAS,OAAO;GACd,MAAM,WAAW,iBAAiB,SAAS,MAAM,YAAY;GAC7D,UAAU;IACR,QAAQ;IACR,MAAM,WAAW,YAAY;IAC7B,QAAQ,WACJ,uCACA,iBAAiB,QACf,MAAM,QAAQ,MAAM,GAAG,GAAK,IAC5B;GACR;EACF;EAeA,QAAO,MAbiB,KAAK,QAAQ,QAAQ,qBAAqB;GAChE,OAAO,MAAM;GACb,kBAAkB,MAAM;GACxB,YAAY,aAAa,MAAM;GAC/B,SAAS;IAAE,UAAU;IAAW,aAAa;GAAuB;GACpE,gBAAgB,KAAK,QAAQ,MAAM;GACnC,kBAAkB,aAAa,YAAY;GAC3C;GACA;GACA;GACA,aAAa,CAAC;GACd,qBAAK,IAAI,KAAK;EAChB,CAAC,EAAA,CACgB;CACnB;AACF;AAEA,SAAgB,kBACd,SAC+D;CAC/D,IAAI,CAAC,QAAQ,OAAO,OAAO,KAAA;CAC3B,MAAM,QAAQ,IAAI,YAAY;EAC5B,UAAU,QAAQ,QAAQ;EAC1B,SAAS,QAAQ,MAAM;EACvB,OAAO,QAAQ,MAAM;CACvB,CAAC;CACD,QAAO,UAAS,MAAM,OAAO,KAAK;AACpC"}

package/dist/integrations/platform/github/event-worker.d.ts

@@ -3,6 +3,7 @@ import { MastraWorker } from '@mastra/core/worker';
 import type { WorkerDeps } from '@mastra/core/worker';
 import type { IntegrationStorageHandle } from '../../../storage/domains/integrations/base.js';
 import type { GithubIssueReconciler } from '../../github/issue-reconciler.js';
+import type { GithubReconcileRepositorySource } from '../../github/reconcile-worker.js';
 import type { GithubPullRequestReconciler } from '../../github/rules.js';
 import { dispatchGithubWebhook } from '../../github/webhook.js';
 import type { GithubWebhookDispatchIntegration, ParsedGithubWebhook } from '../../github/webhook.js';
@@ -23,9 +24,19 @@ export interface PlatformGithubEventWorkerConfig {
     controller: MountedMastraCode['controller'];
     github: PlatformGithubEventDispatchIntegration;
     storage: PlatformGithubEventStorage;
+    /**
+     * Source-control storage used to resolve the set of repositories the worker
+     * should poll. The worker restricts itself to `(installation, repository)`
+     * pairs linked to a factory project — the same set the reconciler uses —
+     * so polling scales with Factory usage, not with the size of the underlying
+     * GitHub org.
+     */
+    sourceControl: GithubReconcileRepositorySource;
     ingestFactoryEvent?: (event: ParsedGithubWebhook) => Promise<unknown>;
     reconcileFactoryState?: GithubPullRequestReconciler;
     reconcileIssuesFactoryState?: GithubIssueReconciler;
+    /** Base-checkpoint freshness sweep, run after the reconcilers within the lease. */
+    sweepBaseCheckpoints?: () => Promise<void>;
     /** When false the worker skips event tailing and only runs enabled reconciliation sweeps. */
     pollEventsEnabled?: boolean;
     intervalMs?: number;

package/dist/integrations/platform/github/event-worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"event-worker.d.ts","sourceRoot":"","sources":["../../../../src/integrations/platform/github/event-worker.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAE9F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,KAAK,EAAE,2BAA2B,EAAuB,MAAM,uBAAuB,CAAC;AAE9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EACV,gCAAgC,EAEhC,mBAAmB,EACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AA2B1D,KAAK,WAAW,GAAG;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC;AACzE,KAAK,iCAAiC,GAAG;IACvC,OAAO,EAAE,CAAC,CAAC;IACX,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,wBAAwB,CAC/D,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvB,iCAAiC,EACjC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CACxB,CAAC;AAWF,MAAM,MAAM,sCAAsC,GAAG,gCAAgC,CAAC;AAEtF,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,iBAAiB,CAAC;IAC1B,UAAU,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,EAAE,sCAAsC,CAAC;IAC/C,OAAO,EAAE,0BAA0B,CAAC;IACpC,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,qBAAqB,CAAC,EAAE,2BAA2B,CAAC;IACpD,2BAA2B,CAAC,EAAE,qBAAqB,CAAC;IACpD,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,qBAAqB,CAAC;CACzC;AAED,qBAAa,yBAA0B,SAAQ,YAAY;;IACzD,QAAQ,CAAC,IAAI,4BAA4B;gBA6B7B,MAAM,EAAE,+BAA+B;IA+B7C,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IActB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAa3B,IAAI,SAAS,IAAI,OAAO,CAEvB;CA6SF"}
+{"version":3,"file":"event-worker.d.ts","sourceRoot":"","sources":["../../../../src/integrations/platform/github/event-worker.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAE9F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACxF,OAAO,KAAK,EAAE,2BAA2B,EAAuB,MAAM,uBAAuB,CAAC;AAE9F,OAAO,EAAE,qBAAqB,EAA6C,MAAM,yBAAyB,CAAC;AAC3G,OAAO,KAAK,EACV,gCAAgC,EAEhC,mBAAmB,EACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAiC1D,KAAK,WAAW,GAAG;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC;AACzE,KAAK,iCAAiC,GAAG;IACvC,OAAO,EAAE,CAAC,CAAC;IACX,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,wBAAwB,CAC/D,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvB,iCAAiC,EACjC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CACxB,CAAC;AAWF,MAAM,MAAM,sCAAsC,GAAG,gCAAgC,CAAC;AAEtF,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,iBAAiB,CAAC;IAC1B,UAAU,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,EAAE,sCAAsC,CAAC;IAC/C,OAAO,EAAE,0BAA0B,CAAC;IACpC;;;;;;OAMG;IACH,aAAa,EAAE,+BAA+B,CAAC;IAC/C,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,qBAAqB,CAAC,EAAE,2BAA2B,CAAC;IACpD,2BAA2B,CAAC,EAAE,qBAAqB,CAAC;IACpD,mFAAmF;IACnF,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,qBAAqB,CAAC;CACzC;AAED,qBAAa,yBAA0B,SAAQ,YAAY;;IACzD,QAAQ,CAAC,IAAI,4BAA4B;gBA+B7B,MAAM,EAAE,+BAA+B;IAiC7C,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IActB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAa3B,IAAI,SAAS,IAAI,OAAO,CAEvB;CAsWF"}

package/dist/integrations/platform/github/event-worker.js

@@ -1,5 +1,5 @@
 import { listPullRequestSubscriptionsForWebhook, retirePullRequestSubscription } from "../../github/subscriptions.js";
-import { dispatchGithubWebhook } from "../../github/webhook.js";
+import { dispatchGithubWebhook, isFactoryAppSender, resolveAuthorizedBots } from "../../github/webhook.js";
 import { PlatformApiError } from "../api-client.js";
 import { randomUUID } from "crypto";
 import { NoopLeaseProvider, isLeaseProvider } from "@mastra/core/events";
@@ -17,15 +17,17 @@ const SUPPORTED_EVENTS = /* @__PURE__ */ new Set([
 	"issue_comment",
 	"pull_request",
 	"pull_request_review",
-	"pull_request_review_comment"
+	"pull_request_review_comment",
+	"push"
 ]);
 const AUTHOR_GATED_KINDS = /* @__PURE__ */ new Set([
-	"issue-comment",
-	"pull-request-comment",
-	"pull-request-review",
-	"pull-request-review-comment"
+	"issue-comment-created",
+	"review-comment-created",
+	"review-approved",
+	"review-changes-requested",
+	"review-submitted",
+	"review-dismissed"
 ]);
-const AUTHORIZED_BOTS = /* @__PURE__ */ new Set(["coderabbitai[bot]", "devin-ai-integration[bot]"]);
 const AUTHORIZED_PERMISSIONS = /* @__PURE__ */ new Set([
 	"admin",
 	"maintain",
@@ -41,12 +43,14 @@ var PlatformGithubEventWorker = class extends MastraWorker {
 	#ingestFactoryEvent;
 	#reconcileFactoryState;
 	#reconcileIssuesFactoryState;
+	#sweepBaseCheckpoints;
 	#pollEventsEnabled;
 	#pullRequestReconcileIntervalMs;
 	#issueReconcileIntervalMs;
 	#intervalMs;
 	#now;
 	#dispatch;
+	#sourceControl;
 	#leaseOwner = randomUUID();
 	#running = false;
 	#timer;
@@ -71,6 +75,7 @@ var PlatformGithubEventWorker = class extends MastraWorker {
 		this.#ingestFactoryEvent = config.ingestFactoryEvent;
 		this.#reconcileFactoryState = config.reconcileFactoryState;
 		this.#reconcileIssuesFactoryState = config.reconcileIssuesFactoryState;
+		this.#sweepBaseCheckpoints = config.sweepBaseCheckpoints;
 		this.#pollEventsEnabled = config.pollEventsEnabled ?? true;
 		const legacyReconcileIntervalMs = config.reconcileIntervalMs ?? DEFAULT_RECONCILE_INTERVAL_MS;
 		this.#pullRequestReconcileIntervalMs = config.pullRequestReconcileIntervalMs ?? legacyReconcileIntervalMs;
@@ -82,6 +87,7 @@ var PlatformGithubEventWorker = class extends MastraWorker {
 		this.#leaseTtlMs = Math.max(MIN_LEASE_TTL_MS, Math.min(this.#intervalMs, this.#pullRequestReconcileIntervalMs, this.#issueReconcileIntervalMs) * 3);
 		this.#now = config.now ?? Date.now;
 		this.#dispatch = config.dispatch ?? dispatchGithubWebhook;
+		this.#sourceControl = config.sourceControl;
 	}
 	async init(deps) {
 		await super.init(deps);
@@ -257,16 +263,36 @@ var PlatformGithubEventWorker = class extends MastraWorker {
 				});
 			}
 		}
+		if (this.#sweepBaseCheckpoints && this.#hasLease) try {
+			await this.#sweepBaseCheckpoints();
+		} catch (error) {
+			this.deps?.logger.warn("Platform GitHub base-checkpoint freshness sweep failed", { error: error instanceof Error ? error.message : String(error) });
+		}
 	}
+	/**
+	* Configured `(installation, repository)` pairs — the same set the
+	* reconciler sweeps — resolved to the numeric ids and slug the poll
+	* addresses GitHub with. Repositories not linked to any factory project
+	* cannot produce work for Factory, so polling and reconciling them is
+	* wasted `/events` bandwidth and platform load.
+	*/
 	async #discoverRepositories() {
-		const result = await this.#client.request("GET", `${API_PREFIX}/installations`);
+		const keys = await this.#sourceControl.projectRepositories.listConfiguredExternalKeys();
 		const repositories = /* @__PURE__ */ new Map();
-		for (const installation of result.installations) {
-			if (!installation.usable || installation.suspendedAt) continue;
-			const page = await this.#client.request("GET", `${API_PREFIX}/installations/${installation.installationId}/repositories`);
-			for (const repository of page.repositories) repositories.set(repository.id, {
-				...repository,
-				installationId: installation.installationId
+		for (const key of keys) {
+			const installationId = Number(key.installationExternalId);
+			const repositoryId = Number(key.repositoryExternalId);
+			if (!Number.isSafeInteger(installationId) || installationId <= 0 || !Number.isSafeInteger(repositoryId) || repositoryId <= 0) continue;
+			if (repositories.has(repositoryId)) continue;
+			const orgId = (await this.#sourceControl.projectRepositories.listByExternalRepository(key))[0]?.orgId;
+			const repository = orgId ? await this.#sourceControl.repositories.findByExternalId({
+				orgId,
+				externalId: key.repositoryExternalId
+			}) : null;
+			repositories.set(repositoryId, {
+				id: repositoryId,
+				installationId,
+				fullName: repository?.slug
 			});
 		}
 		return [...repositories.values()];
@@ -307,6 +333,21 @@ var PlatformGithubEventWorker = class extends MastraWorker {
 					retireSubscription: (id, status) => retirePullRequestSubscription(id, status, this.#github.integrationStorage),
 					github: this.#github,
 					isAuthorizedSender: (notification) => this.#isAuthorizedSender(notification),
+					onTargetSkipped: (subscription) => {
+						this.deps?.logger.debug("Platform GitHub event skipped: thread is not held here", {
+							deliveryId: event.deliveryId,
+							subscriptionId: subscription.id,
+							threadId: subscription.threadId
+						});
+					},
+					onSenderRejected: (notification) => {
+						this.deps?.logger.debug("Platform GitHub event dropped: sender not authorized", {
+							deliveryId: event.deliveryId,
+							repository: notification.metadata.repository,
+							sender: notification.metadata.sender,
+							kind: notification.kind
+						});
+					},
 					onTargetError: (subscription, error) => {
 						this.deps?.logger.error("Platform GitHub event delivery failed for a subscription", {
 							deliveryId: event.deliveryId,
@@ -334,7 +375,11 @@ var PlatformGithubEventWorker = class extends MastraWorker {
 		const sender = notification.metadata.sender;
 		const repository = notification.metadata.repository;
 		if (!sender || !repository) return false;
-		if (AUTHORIZED_BOTS.has(sender)) return true;
+		if (this.#github.identity?.matches(sender)) return true;
+		if (isFactoryAppSender(sender, this.#github.slug)) return true;
+		const normalizedSender = sender.toLowerCase();
+		if (resolveAuthorizedBots(this.#github.authorizedBots).has(normalizedSender)) return true;
+		if (notification.metadata.senderType?.toLowerCase() === "bot" || normalizedSender.endsWith("[bot]")) return false;
 		const abortController = new AbortController();
 		const timeout = setTimeout(() => abortController.abort(), PERMISSION_CHECK_TIMEOUT_MS);
 		try {
@@ -372,8 +417,11 @@ function isFactoryIngestedEvent(event) {
 	if ((event.event === "issues" || event.event === "pull_request") && event.payload.action === "closed") return true;
 	if (event.event === "pull_request") {
 		const action = event.payload.action;
-		if (action === "synchronize" || action === "review_requested") return true;
+		if (action === "opened" || action === "synchronize" || action === "review_requested") return true;
 	}
+	if (event.event === "pull_request_review" && event.payload.action === "submitted") return true;
+	if (event.event === "issue_comment" && event.payload.action === "created") return true;
+	if (event.event === "push") return true;
 	return false;
 }
 function parseEvent(event) {

package/dist/integrations/platform/github/event-worker.js.map

@@ -1 +1 @@
-{"version":3,"file":"event-worker.js","names":["#client","#controller","#github","#storage","#ingestFactoryEvent","#reconcileFactoryState","#reconcileIssuesFactoryState","#pollEventsEnabled","#pullRequestReconcileIntervalMs","#issueReconcileIntervalMs","#intervalMs","#now","#dispatch","#leaseOwner","#leaseTtlMs","#leaseProvider","#running","#startedAt","#settings","#schedule","#timer","#stopLeaseRenewal","#inFlight","#hasLease","#leaseKey","#tick","#ensureLease","#poll","#startLeaseRenewal","#leaseRenewalTimer","#discoverRepositories","#reconcileCadence","#pollRepository","#maybeReconcile","#lastPullRequestReconcileAt","#lastIssueReconcileAt","#saveSettings","#isAuthorizedSender"],"sources":["../../../../src/integrations/platform/github/event-worker.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\n\nimport type { MountedMastraCode } from '@mastra/code-sdk';\nimport { isLeaseProvider, NoopLeaseProvider } from '@mastra/core/events';\nimport type { LeaseProvider, PubSub } from '@mastra/core/events';\nimport { MastraWorker } from '@mastra/core/worker';\nimport type { WorkerDeps } from '@mastra/core/worker';\n\nimport type { IntegrationStorageHandle } from '../../../storage/domains/integrations/base.js';\nimport type { GithubRepositoryPermission } from '../../github/integration.js';\nimport type { GithubIssueReconciler } from '../../github/issue-reconciler.js';\nimport type { GithubPullRequestReconciler, ReconcileRepository } from '../../github/rules.js';\nimport { listPullRequestSubscriptionsForWebhook, retirePullRequestSubscription } from '../../github/subscriptions.js';\nimport { dispatchGithubWebhook } from '../../github/webhook.js';\nimport type {\n  GithubWebhookDispatchIntegration,\n  GithubWebhookNotification,\n  ParsedGithubWebhook,\n} from '../../github/webhook.js';\nimport type { PlatformApiClient } from '../api-client.js';\nimport { PlatformApiError } from '../api-client.js';\n\nconst API_PREFIX = '/v1/server/github-app';\nconst DEFAULT_POLL_INTERVAL_MS = 20_000;\nconst DEFAULT_RECONCILE_INTERVAL_MS = 5 * 60_000;\nconst EVENT_PAGE_SIZE = 500;\nconst MIN_LEASE_TTL_MS = 30_000;\nconst CURSOR_ORG_ID = '__platform_github_event_worker__';\nconst CURSOR_USER_ID = 'worker';\nconst SUPPORTED_EVENTS = new Set([\n  'issues',\n  'issue_comment',\n  'pull_request',\n  'pull_request_review',\n  'pull_request_review_comment',\n]);\nconst AUTHOR_GATED_KINDS = new Set([\n  'issue-comment',\n  'pull-request-comment',\n  'pull-request-review',\n  'pull-request-review-comment',\n]);\nconst AUTHORIZED_BOTS = new Set(['coderabbitai[bot]', 'devin-ai-integration[bot]']);\nconst AUTHORIZED_PERMISSIONS = new Set<GithubRepositoryPermission>(['admin', 'maintain', 'write']);\nconst PERMISSION_CHECK_TIMEOUT_MS = 5_000;\n\ntype EventCursor = { afterEventId: string } | { afterTimestamp: number };\ntype PlatformGithubEventWorkerSettings = {\n  version: 1;\n  repositories: Record<string, EventCursor>;\n};\n\nexport type PlatformGithubEventStorage = IntegrationStorageHandle<\n  Record<string, unknown>,\n  PlatformGithubEventWorkerSettings,\n  Record<string, unknown>\n>;\n\ntype EventLogEntry = {\n  id: string;\n  deliveryId: string;\n  event: string;\n  payload: unknown;\n};\n\ntype Repository = { id: number; fullName?: string; installationId: number };\n\nexport type PlatformGithubEventDispatchIntegration = GithubWebhookDispatchIntegration;\n\nexport interface PlatformGithubEventWorkerConfig {\n  client: PlatformApiClient;\n  controller: MountedMastraCode['controller'];\n  github: PlatformGithubEventDispatchIntegration;\n  storage: PlatformGithubEventStorage;\n  ingestFactoryEvent?: (event: ParsedGithubWebhook) => Promise<unknown>;\n  reconcileFactoryState?: GithubPullRequestReconciler;\n  reconcileIssuesFactoryState?: GithubIssueReconciler;\n  /** When false the worker skips event tailing and only runs enabled reconciliation sweeps. */\n  pollEventsEnabled?: boolean;\n  intervalMs?: number;\n  /** Legacy shared reconciliation cadence. */\n  reconcileIntervalMs?: number;\n  pullRequestReconcileIntervalMs?: number;\n  issueReconcileIntervalMs?: number;\n  now?: () => number;\n  dispatch?: typeof dispatchGithubWebhook;\n}\n\nexport class PlatformGithubEventWorker extends MastraWorker {\n  readonly name = 'platform-github-events';\n\n  readonly #client: PlatformApiClient;\n  readonly #controller: MountedMastraCode['controller'];\n  readonly #github: PlatformGithubEventDispatchIntegration;\n  readonly #storage: PlatformGithubEventStorage;\n  readonly #ingestFactoryEvent: ((event: ParsedGithubWebhook) => Promise<unknown>) | undefined;\n  readonly #reconcileFactoryState: GithubPullRequestReconciler | undefined;\n  readonly #reconcileIssuesFactoryState: GithubIssueReconciler | undefined;\n  readonly #pollEventsEnabled: boolean;\n  readonly #pullRequestReconcileIntervalMs: number;\n  readonly #issueReconcileIntervalMs: number;\n  readonly #intervalMs: number;\n  readonly #now: () => number;\n  readonly #dispatch: typeof dispatchGithubWebhook;\n  readonly #leaseOwner = randomUUID();\n\n  #running = false;\n  #timer: ReturnType<typeof setTimeout> | undefined;\n  #leaseRenewalTimer: ReturnType<typeof setInterval> | undefined;\n  #inFlight: Promise<void> | undefined;\n  #leaseProvider: LeaseProvider = NoopLeaseProvider;\n  #leaseTtlMs: number;\n  #hasLease = false;\n  #startedAt = 0;\n  #lastPullRequestReconcileAt = 0;\n  #lastIssueReconcileAt = 0;\n  #settings: PlatformGithubEventWorkerSettings = { version: 1, repositories: {} };\n\n  constructor(config: PlatformGithubEventWorkerConfig) {\n    super();\n    this.#client = config.client;\n    this.#controller = config.controller;\n    this.#github = config.github;\n    this.#storage = config.storage;\n    this.#ingestFactoryEvent = config.ingestFactoryEvent;\n    this.#reconcileFactoryState = config.reconcileFactoryState;\n    this.#reconcileIssuesFactoryState = config.reconcileIssuesFactoryState;\n    this.#pollEventsEnabled = config.pollEventsEnabled ?? true;\n    const legacyReconcileIntervalMs = config.reconcileIntervalMs ?? DEFAULT_RECONCILE_INTERVAL_MS;\n    this.#pullRequestReconcileIntervalMs = config.pullRequestReconcileIntervalMs ?? legacyReconcileIntervalMs;\n    this.#issueReconcileIntervalMs = config.issueReconcileIntervalMs ?? legacyReconcileIntervalMs;\n    this.#intervalMs = config.intervalMs ?? DEFAULT_POLL_INTERVAL_MS;\n    if (!Number.isFinite(this.#intervalMs) || this.#intervalMs <= 0) {\n      throw new Error('Platform GitHub event polling interval must be a positive number.');\n    }\n    if (!Number.isFinite(this.#pullRequestReconcileIntervalMs) || this.#pullRequestReconcileIntervalMs <= 0) {\n      throw new Error('Platform GitHub pull request reconcile interval must be a positive number.');\n    }\n    if (!Number.isFinite(this.#issueReconcileIntervalMs) || this.#issueReconcileIntervalMs <= 0) {\n      throw new Error('Platform GitHub issue reconcile interval must be a positive number.');\n    }\n    this.#leaseTtlMs = Math.max(\n      MIN_LEASE_TTL_MS,\n      Math.min(this.#intervalMs, this.#pullRequestReconcileIntervalMs, this.#issueReconcileIntervalMs) * 3,\n    );\n    this.#now = config.now ?? Date.now;\n    this.#dispatch = config.dispatch ?? dispatchGithubWebhook;\n  }\n\n  async init(deps: WorkerDeps): Promise<void> {\n    await super.init(deps);\n    this.#leaseProvider = getLeaseProvider(deps.pubsub);\n  }\n\n  async start(): Promise<void> {\n    if (this.#running) return;\n    if (!this.deps) throw new Error('PlatformGithubEventWorker: call init() before start()');\n\n    this.#startedAt = this.#now() - 1;\n    this.#settings = normalizeSettings(await this.#storage.settings.get(CURSOR_ORG_ID, CURSOR_USER_ID));\n    this.#running = true;\n    this.deps.logger.info('Platform GitHub event polling started', {\n      intervalMs: this.#intervalMs,\n      leaseTtlMs: this.#leaseTtlMs,\n    });\n    this.#schedule(0);\n  }\n\n  async stop(): Promise<void> {\n    if (!this.#running) return;\n    this.#running = false;\n    if (this.#timer) clearTimeout(this.#timer);\n    this.#timer = undefined;\n    this.#stopLeaseRenewal();\n    await this.#inFlight;\n    if (this.#hasLease) {\n      await this.#leaseProvider.releaseLease(this.#leaseKey(), this.#leaseOwner).catch(() => undefined);\n      this.#hasLease = false;\n    }\n  }\n\n  get isRunning(): boolean {\n    return this.#running;\n  }\n\n  #schedule(delayMs: number): void {\n    if (!this.#running) return;\n    this.#timer = setTimeout(() => {\n      this.#timer = undefined;\n      const run = this.#tick();\n      this.#inFlight = run;\n      void run.finally(() => {\n        if (this.#inFlight === run) this.#inFlight = undefined;\n      });\n    }, delayMs);\n    this.#timer.unref?.();\n  }\n\n  async #tick(): Promise<void> {\n    let nextDelay = this.#intervalMs;\n    try {\n      if (!(await this.#ensureLease())) return;\n      nextDelay = await this.#poll();\n    } catch (error) {\n      nextDelay = retryDelay(error, this.#intervalMs);\n      this.deps?.logger.error('Platform GitHub event polling cycle failed', {\n        error: error instanceof Error ? error.message : String(error),\n        retryInMs: nextDelay,\n      });\n    } finally {\n      this.#schedule(nextDelay);\n    }\n  }\n\n  async #ensureLease(): Promise<boolean> {\n    if (this.#hasLease) return true;\n    const result = await this.#leaseProvider.acquireLease(this.#leaseKey(), this.#leaseOwner, this.#leaseTtlMs);\n    this.#hasLease = result.acquired;\n    if (this.#hasLease) this.#startLeaseRenewal();\n    return this.#hasLease;\n  }\n\n  #startLeaseRenewal(): void {\n    if (this.#leaseRenewalTimer) return;\n    this.#leaseRenewalTimer = setInterval(\n      () => {\n        void this.#leaseProvider\n          .renewLease(this.#leaseKey(), this.#leaseOwner, this.#leaseTtlMs)\n          .then(renewed => {\n            if (!renewed) {\n              this.#hasLease = false;\n              this.#stopLeaseRenewal();\n            }\n          })\n          .catch(error => {\n            this.#hasLease = false;\n            this.#stopLeaseRenewal();\n            this.deps?.logger.warn('Platform GitHub event polling lease renewal failed', {\n              error: error instanceof Error ? error.message : String(error),\n            });\n          });\n      },\n      Math.floor(this.#leaseTtlMs / 3),\n    );\n    this.#leaseRenewalTimer.unref?.();\n  }\n\n  #stopLeaseRenewal(): void {\n    if (this.#leaseRenewalTimer) clearInterval(this.#leaseRenewalTimer);\n    this.#leaseRenewalTimer = undefined;\n  }\n\n  async #poll(): Promise<number> {\n    const repositories = await this.#discoverRepositories();\n    let retryInMs = this.#pollEventsEnabled ? this.#intervalMs : this.#reconcileCadence();\n\n    if (this.#pollEventsEnabled) {\n      for (const repository of repositories) {\n        if (!this.#running || !this.#hasLease) break;\n        try {\n          await this.#pollRepository(repository.id);\n        } catch (error) {\n          const delay = retryDelay(error, this.#intervalMs);\n          retryInMs = Math.max(retryInMs, delay);\n          this.deps?.logger.error('Platform GitHub repository event polling failed', {\n            repositoryId: repository.id,\n            error: error instanceof Error ? error.message : String(error),\n            retryInMs: delay,\n          });\n          if (error instanceof PlatformApiError && error.status === 429) break;\n        }\n      }\n    }\n\n    await this.#maybeReconcile(repositories);\n    return retryInMs;\n  }\n\n  #reconcileCadence(): number {\n    const cadences = [\n      this.#reconcileFactoryState ? this.#pullRequestReconcileIntervalMs : undefined,\n      this.#reconcileIssuesFactoryState ? this.#issueReconcileIntervalMs : undefined,\n    ].filter((interval): interval is number => interval !== undefined);\n    return cadences.length > 0 ? Math.min(...cadences) : this.#intervalMs;\n  }\n\n  async #maybeReconcile(repositories: Repository[]): Promise<void> {\n    if (!this.#running || !this.#hasLease) return;\n    const now = this.#now();\n    const reconcilePullRequests = Boolean(\n      this.#reconcileFactoryState && now - this.#lastPullRequestReconcileAt >= this.#pullRequestReconcileIntervalMs,\n    );\n    const reconcileIssues = Boolean(\n      this.#reconcileIssuesFactoryState && now - this.#lastIssueReconcileAt >= this.#issueReconcileIntervalMs,\n    );\n    if (!reconcilePullRequests && !reconcileIssues) return;\n    if (reconcilePullRequests) this.#lastPullRequestReconcileAt = now;\n    if (reconcileIssues) this.#lastIssueReconcileAt = now;\n\n    const targets: ReconcileRepository[] = repositories.flatMap(repository =>\n      repository.fullName\n        ? [{ id: repository.id, fullName: repository.fullName, installationId: repository.installationId }]\n        : [],\n    );\n    if (targets.length === 0) {\n      this.deps?.logger.debug('Platform GitHub reconciliation skipped: no named repositories');\n      return;\n    }\n\n    if (reconcilePullRequests && this.#reconcileFactoryState) {\n      const startedAt = Date.now();\n      try {\n        const { errors, ...counts } = await this.#reconcileFactoryState(targets);\n        const context = { ...counts, candidateRepositories: targets.length, durationMs: Date.now() - startedAt };\n        if (counts.failed > 0) {\n          this.deps?.logger.warn('Platform GitHub pull request reconcile sweep completed with failures', {\n            ...context,\n            errors,\n          });\n        } else if (counts.merged > 0 || counts.closed > 0) {\n          this.deps?.logger.info('Platform GitHub pull request reconcile replayed missed merges/closes', context);\n        } else {\n          this.deps?.logger.info('Platform GitHub pull request reconcile sweep completed', context);\n        }\n      } catch (error) {\n        this.deps?.logger.error('Platform GitHub pull request reconcile failed', {\n          repositories: targets.length,\n          durationMs: Date.now() - startedAt,\n          error: error instanceof Error ? error.message : String(error),\n        });\n      }\n    }\n\n    if (reconcileIssues && this.#reconcileIssuesFactoryState && this.#hasLease) {\n      const startedAt = Date.now();\n      try {\n        const { errors, ...counts } = await this.#reconcileIssuesFactoryState(targets);\n        const context = { ...counts, candidateRepositories: targets.length, durationMs: Date.now() - startedAt };\n        if (counts.failed > 0) {\n          this.deps?.logger.warn('Platform GitHub issue reconcile sweep completed with failures', { ...context, errors });\n        } else if (counts.closed > 0) {\n          this.deps?.logger.info('Platform GitHub issue reconcile replayed closed work items', context);\n        } else if (counts.updated > 0) {\n          this.deps?.logger.info('Platform GitHub issue reconcile patched stale metadata', context);\n        } else {\n          this.deps?.logger.debug('Platform GitHub issue reconcile sweep completed', context);\n        }\n      } catch (error) {\n        this.deps?.logger.error('Platform GitHub issue reconcile failed', {\n          repositories: targets.length,\n          durationMs: Date.now() - startedAt,\n          error: error instanceof Error ? error.message : String(error),\n        });\n      }\n    }\n  }\n\n  async #discoverRepositories(): Promise<Repository[]> {\n    const result = await this.#client.request<{\n      installations: Array<{\n        installationId: number;\n        usable: boolean;\n        suspendedAt: string | null;\n      }>;\n    }>('GET', `${API_PREFIX}/installations`);\n    const repositories = new Map<number, Repository>();\n\n    for (const installation of result.installations) {\n      if (!installation.usable || installation.suspendedAt) continue;\n      const page = await this.#client.request<{ repositories: Array<{ id: number; fullName?: string }> }>(\n        'GET',\n        `${API_PREFIX}/installations/${installation.installationId}/repositories`,\n      );\n      for (const repository of page.repositories) {\n        repositories.set(repository.id, { ...repository, installationId: installation.installationId });\n      }\n    }\n\n    return [...repositories.values()];\n  }\n\n  async #pollRepository(repositoryId: number): Promise<void> {\n    const key = String(repositoryId);\n    if (!this.#settings.repositories[key]) {\n      this.#settings.repositories[key] = { afterTimestamp: this.#startedAt };\n      await this.#saveSettings();\n    }\n\n    while (this.#running && this.#hasLease) {\n      const cursor: EventCursor = this.#settings.repositories[key]!;\n      const query = new URLSearchParams({ limit: String(EVENT_PAGE_SIZE) });\n      if ('afterEventId' in cursor) query.set('afterEventId', cursor.afterEventId);\n      else query.set('afterTimestamp', String(cursor.afterTimestamp));\n\n      const pollStartedAt = performance.now();\n      const page = await this.#client.request<{ events: EventLogEntry[]; nextCursor: string | null }>(\n        'GET',\n        `${API_PREFIX}/repositories/${repositoryId}/events?${query}`,\n      );\n      this.deps?.logger.debug('Platform GitHub repository event poll completed', {\n        repositoryId,\n        eventCount: page.events.length,\n        latencyMs: Math.round(performance.now() - pollStartedAt),\n      });\n      if (page.events.length === 0 || !page.nextCursor) return;\n\n      for (const event of page.events) {\n        if (!this.#running || !this.#hasLease) return;\n        const parsed = parseEvent(event);\n        if (!parsed) {\n          this.deps?.logger.warn('Platform GitHub event log returned a malformed event', {\n            repositoryId,\n            eventId: event.id,\n          });\n          continue;\n        }\n        if (isFactoryIngestedEvent(parsed)) {\n          await this.#ingestFactoryEvent?.(parsed);\n        }\n        const result = await this.#dispatch(parsed, {\n          controller: this.#controller,\n          listSubscriptions: (target, options) =>\n            listPullRequestSubscriptionsForWebhook(target, options, this.#github.integrationStorage),\n          retireSubscription: (id, status) =>\n            retirePullRequestSubscription(id, status, this.#github.integrationStorage),\n          github: this.#github,\n          isAuthorizedSender: notification => this.#isAuthorizedSender(notification),\n          onTargetError: (subscription, error) => {\n            this.deps?.logger.error('Platform GitHub event delivery failed for a subscription', {\n              deliveryId: event.deliveryId,\n              subscriptionId: subscription.id,\n              resourceId: subscription.resourceId,\n              threadId: subscription.threadId,\n              error: error instanceof Error ? error.message : String(error),\n            });\n          },\n        });\n        if (result.failed > 0) {\n          this.deps?.logger.warn('Platform GitHub event completed with failed subscription deliveries', {\n            repositoryId,\n            deliveryId: event.deliveryId,\n            delivered: result.delivered,\n            failed: result.failed,\n          });\n        }\n      }\n\n      if (page.nextCursor === ('afterEventId' in cursor ? cursor.afterEventId : undefined)) return;\n      this.#settings.repositories[key] = { afterEventId: page.nextCursor };\n      await this.#saveSettings();\n    }\n  }\n\n  async #isAuthorizedSender(notification: GithubWebhookNotification): Promise<boolean> {\n    if (!AUTHOR_GATED_KINDS.has(notification.kind)) return true;\n    const sender = notification.metadata.sender;\n    const repository = notification.metadata.repository;\n    if (!sender || !repository) return false;\n    if (AUTHORIZED_BOTS.has(sender)) return true;\n\n    const abortController = new AbortController();\n    const timeout = setTimeout(() => abortController.abort(), PERMISSION_CHECK_TIMEOUT_MS);\n    try {\n      const permission = await this.#github.getRepositoryCollaboratorPermission(\n        notification.metadata.installationId,\n        repository,\n        sender,\n        abortController.signal,\n      );\n      return permission !== undefined && AUTHORIZED_PERMISSIONS.has(permission);\n    } catch {\n      return false;\n    } finally {\n      clearTimeout(timeout);\n    }\n  }\n\n  async #saveSettings(): Promise<void> {\n    await this.#storage.settings.save(CURSOR_ORG_ID, CURSOR_USER_ID, this.#settings);\n  }\n\n  #leaseKey(): string {\n    return `${this.name}:${this.#storage.integrationId}`;\n  }\n}\n\nfunction getLeaseProvider(pubsub: PubSub): LeaseProvider {\n  const getProvider = (pubsub as PubSub & { getLeaseProvider?: () => LeaseProvider | undefined }).getLeaseProvider;\n  if (typeof getProvider === 'function') return getProvider.call(pubsub) ?? NoopLeaseProvider;\n  return isLeaseProvider(pubsub) ? pubsub : NoopLeaseProvider;\n}\n\nfunction normalizeSettings(value: PlatformGithubEventWorkerSettings | null): PlatformGithubEventWorkerSettings {\n  if (!value || value.version !== 1 || !value.repositories || typeof value.repositories !== 'object') {\n    return { version: 1, repositories: {} };\n  }\n  return { version: 1, repositories: { ...value.repositories } };\n}\n\n// Events the polling worker forwards to the factory rules engine. Closures\n// let the reconciler finalize cards; `synchronize` and `review_requested` on a\n// pull request are the two triggers the review board's re-review path listens\n// for. Direct-webhook consumers ingest every parsed event; the platform path\n// gates because most other events (comments, reviews, edits) only interest the\n// subscription dispatcher, not the factory rules.\nfunction isFactoryIngestedEvent(event: ParsedGithubWebhook): boolean {\n  if ((event.event === 'issues' || event.event === 'pull_request') && event.payload.action === 'closed') {\n    return true;\n  }\n  if (event.event === 'pull_request') {\n    const action = event.payload.action;\n    if (action === 'synchronize' || action === 'review_requested') return true;\n  }\n  return false;\n}\n\nfunction parseEvent(event: EventLogEntry): ParsedGithubWebhook | null {\n  if (\n    !event.id ||\n    !event.deliveryId ||\n    !SUPPORTED_EVENTS.has(event.event) ||\n    !event.payload ||\n    typeof event.payload !== 'object' ||\n    Array.isArray(event.payload)\n  ) {\n    return null;\n  }\n  return {\n    event: event.event,\n    deliveryId: event.deliveryId,\n    payload: event.payload as Record<string, unknown>,\n  };\n}\n\nfunction retryDelay(error: unknown, fallbackMs: number): number {\n  if (error instanceof PlatformApiError && error.status === 429 && error.retryAfterSeconds !== null) {\n    return Math.max(fallbackMs, error.retryAfterSeconds * 1_000);\n  }\n  return fallbackMs;\n}\n"],"mappings":";;;;;;;AAsBA,MAAM,aAAa;AACnB,MAAM,2BAA2B;AACjC,MAAM,gCAAgC,IAAI;AAC1C,MAAM,kBAAkB;AACxB,MAAM,mBAAmB;AACzB,MAAM,gBAAgB;AACtB,MAAM,iBAAiB;AACvB,MAAM,mCAAmB,IAAI,IAAI;CAC/B;CACA;CACA;CACA;CACA;AACF,CAAC;AACD,MAAM,qCAAqB,IAAI,IAAI;CACjC;CACA;CACA;CACA;AACF,CAAC;AACD,MAAM,kCAAkB,IAAI,IAAI,CAAC,qBAAqB,2BAA2B,CAAC;AAClF,MAAM,yCAAyB,IAAI,IAAgC;CAAC;CAAS;CAAY;AAAO,CAAC;AACjG,MAAM,8BAA8B;AA4CpC,IAAa,4BAAb,cAA+C,aAAa;CAC1D,OAAgB;CAEhB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,cAAuB,WAAW;CAElC,WAAW;CACX;CACA;CACA;CACA,iBAAgC;CAChC;CACA,YAAY;CACZ,aAAa;CACb,8BAA8B;CAC9B,wBAAwB;CACxB,YAA+C;EAAE,SAAS;EAAG,cAAc,CAAC;CAAE;CAE9E,YAAY,QAAyC;EACnD,MAAM;EACN,KAAKA,UAAU,OAAO;EACtB,KAAKC,cAAc,OAAO;EAC1B,KAAKC,UAAU,OAAO;EACtB,KAAKC,WAAW,OAAO;EACvB,KAAKC,sBAAsB,OAAO;EAClC,KAAKC,yBAAyB,OAAO;EACrC,KAAKC,+BAA+B,OAAO;EAC3C,KAAKC,qBAAqB,OAAO,qBAAqB;EACtD,MAAM,4BAA4B,OAAO,uBAAuB;EAChE,KAAKC,kCAAkC,OAAO,kCAAkC;EAChF,KAAKC,4BAA4B,OAAO,4BAA4B;EACpE,KAAKC,cAAc,OAAO,cAAc;EACxC,IAAI,CAAC,OAAO,SAAS,KAAKA,WAAW,KAAK,KAAKA,eAAe,GAC5D,MAAM,IAAI,MAAM,mEAAmE;EAErF,IAAI,CAAC,OAAO,SAAS,KAAKF,+BAA+B,KAAK,KAAKA,mCAAmC,GACpG,MAAM,IAAI,MAAM,4EAA4E;EAE9F,IAAI,CAAC,OAAO,SAAS,KAAKC,yBAAyB,KAAK,KAAKA,6BAA6B,GACxF,MAAM,IAAI,MAAM,qEAAqE;EAEvF,KAAKK,cAAc,KAAK,IACtB,kBACA,KAAK,IAAI,KAAKJ,aAAa,KAAKF,iCAAiC,KAAKC,yBAAyB,IAAI,CACrG;EACA,KAAKE,OAAO,OAAO,OAAO,KAAK;EAC/B,KAAKC,YAAY,OAAO,YAAY;CACtC;CAEA,MAAM,KAAK,MAAiC;EAC1C,MAAM,MAAM,KAAK,IAAI;EACrB,KAAKG,iBAAiB,iBAAiB,KAAK,MAAM;CACpD;CAEA,MAAM,QAAuB;EAC3B,IAAI,KAAKC,UAAU;EACnB,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,MAAM,uDAAuD;EAEvF,KAAKC,aAAa,KAAKN,KAAK,IAAI;EAChC,KAAKO,YAAY,kBAAkB,MAAM,KAAKf,SAAS,SAAS,IAAI,eAAe,cAAc,CAAC;EAClG,KAAKa,WAAW;EAChB,KAAK,KAAK,OAAO,KAAK,yCAAyC;GAC7D,YAAY,KAAKN;GACjB,YAAY,KAAKI;EACnB,CAAC;EACD,KAAKK,UAAU,CAAC;CAClB;CAEA,MAAM,OAAsB;EAC1B,IAAI,CAAC,KAAKH,UAAU;EACpB,KAAKA,WAAW;EAChB,IAAI,KAAKI,QAAQ,aAAa,KAAKA,MAAM;EACzC,KAAKA,SAAS,KAAA;EACd,KAAKC,kBAAkB;EACvB,MAAM,KAAKC;EACX,IAAI,KAAKC,WAAW;GAClB,MAAM,KAAKR,eAAe,aAAa,KAAKS,UAAU,GAAG,KAAKX,WAAW,CAAC,CAAC,YAAY,KAAA,CAAS;GAChG,KAAKU,YAAY;EACnB;CACF;CAEA,IAAI,YAAqB;EACvB,OAAO,KAAKP;CACd;CAEA,UAAU,SAAuB;EAC/B,IAAI,CAAC,KAAKA,UAAU;EACpB,KAAKI,SAAS,iBAAiB;GAC7B,KAAKA,SAAS,KAAA;GACd,MAAM,MAAM,KAAKK,MAAM;GACvB,KAAKH,YAAY;GACjB,IAAS,cAAc;IACrB,IAAI,KAAKA,cAAc,KAAK,KAAKA,YAAY,KAAA;GAC/C,CAAC;EACH,GAAG,OAAO;EACV,KAAKF,OAAO,QAAQ;CACtB;CAEA,MAAMK,QAAuB;EAC3B,IAAI,YAAY,KAAKf;EACrB,IAAI;GACF,IAAI,CAAE,MAAM,KAAKgB,aAAa,GAAI;GAClC,YAAY,MAAM,KAAKC,MAAM;EAC/B,SAAS,OAAO;GACd,YAAY,WAAW,OAAO,KAAKjB,WAAW;GAC9C,KAAK,MAAM,OAAO,MAAM,8CAA8C;IACpE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC5D,WAAW;GACb,CAAC;EACH,UAAU;GACR,KAAKS,UAAU,SAAS;EAC1B;CACF;CAEA,MAAMO,eAAiC;EACrC,IAAI,KAAKH,WAAW,OAAO;EAC3B,MAAM,SAAS,MAAM,KAAKR,eAAe,aAAa,KAAKS,UAAU,GAAG,KAAKX,aAAa,KAAKC,WAAW;EAC1G,KAAKS,YAAY,OAAO;EACxB,IAAI,KAAKA,WAAW,KAAKK,mBAAmB;EAC5C,OAAO,KAAKL;CACd;CAEA,qBAA2B;EACzB,IAAI,KAAKM,oBAAoB;EAC7B,KAAKA,qBAAqB,kBAClB;GACJ,KAAUd,eACP,WAAW,KAAKS,UAAU,GAAG,KAAKX,aAAa,KAAKC,WAAW,CAAC,CAChE,MAAK,YAAW;IACf,IAAI,CAAC,SAAS;KACZ,KAAKS,YAAY;KACjB,KAAKF,kBAAkB;IACzB;GACF,CAAC,CAAC,CACD,OAAM,UAAS;IACd,KAAKE,YAAY;IACjB,KAAKF,kBAAkB;IACvB,KAAK,MAAM,OAAO,KAAK,sDAAsD,EAC3E,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC9D,CAAC;GACH,CAAC;EACL,GACA,KAAK,MAAM,KAAKP,cAAc,CAAC,CACjC;EACA,KAAKe,mBAAmB,QAAQ;CAClC;CAEA,oBAA0B;EACxB,IAAI,KAAKA,oBAAoB,cAAc,KAAKA,kBAAkB;EAClE,KAAKA,qBAAqB,KAAA;CAC5B;CAEA,MAAMF,QAAyB;EAC7B,MAAM,eAAe,MAAM,KAAKG,sBAAsB;EACtD,IAAI,YAAY,KAAKvB,qBAAqB,KAAKG,cAAc,KAAKqB,kBAAkB;EAEpF,IAAI,KAAKxB,oBACP,KAAK,MAAM,cAAc,cAAc;GACrC,IAAI,CAAC,KAAKS,YAAY,CAAC,KAAKO,WAAW;GACvC,IAAI;IACF,MAAM,KAAKS,gBAAgB,WAAW,EAAE;GAC1C,SAAS,OAAO;IACd,MAAM,QAAQ,WAAW,OAAO,KAAKtB,WAAW;IAChD,YAAY,KAAK,IAAI,WAAW,KAAK;IACrC,KAAK,MAAM,OAAO,MAAM,mDAAmD;KACzE,cAAc,WAAW;KACzB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KAC5D,WAAW;IACb,CAAC;IACD,IAAI,iBAAiB,oBAAoB,MAAM,WAAW,KAAK;GACjE;EACF;EAGF,MAAM,KAAKuB,gBAAgB,YAAY;EACvC,OAAO;CACT;CAEA,oBAA4B;EAC1B,MAAM,WAAW,CACf,KAAK5B,yBAAyB,KAAKG,kCAAkC,KAAA,GACrE,KAAKF,+BAA+B,KAAKG,4BAA4B,KAAA,CACvE,CAAC,CAAC,QAAQ,aAAiC,aAAa,KAAA,CAAS;EACjE,OAAO,SAAS,SAAS,IAAI,KAAK,IAAI,GAAG,QAAQ,IAAI,KAAKC;CAC5D;CAEA,MAAMuB,gBAAgB,cAA2C;EAC/D,IAAI,CAAC,KAAKjB,YAAY,CAAC,KAAKO,WAAW;EACvC,MAAM,MAAM,KAAKZ,KAAK;EACtB,MAAM,wBAAwB,QAC5B,KAAKN,0BAA0B,MAAM,KAAK6B,+BAA+B,KAAK1B,+BAChF;EACA,MAAM,kBAAkB,QACtB,KAAKF,gCAAgC,MAAM,KAAK6B,yBAAyB,KAAK1B,yBAChF;EACA,IAAI,CAAC,yBAAyB,CAAC,iBAAiB;EAChD,IAAI,uBAAuB,KAAKyB,8BAA8B;EAC9D,IAAI,iBAAiB,KAAKC,wBAAwB;EAElD,MAAM,UAAiC,aAAa,SAAQ,eAC1D,WAAW,WACP,CAAC;GAAE,IAAI,WAAW;GAAI,UAAU,WAAW;GAAU,gBAAgB,WAAW;EAAe,CAAC,IAChG,CAAC,CACP;EACA,IAAI,QAAQ,WAAW,GAAG;GACxB,KAAK,MAAM,OAAO,MAAM,+DAA+D;GACvF;EACF;EAEA,IAAI,yBAAyB,KAAK9B,wBAAwB;GACxD,MAAM,YAAY,KAAK,IAAI;GAC3B,IAAI;IACF,MAAM,EAAE,QAAQ,GAAG,WAAW,MAAM,KAAKA,uBAAuB,OAAO;IACvE,MAAM,UAAU;KAAE,GAAG;KAAQ,uBAAuB,QAAQ;KAAQ,YAAY,KAAK,IAAI,IAAI;IAAU;IACvG,IAAI,OAAO,SAAS,GAClB,KAAK,MAAM,OAAO,KAAK,wEAAwE;KAC7F,GAAG;KACH;IACF,CAAC;SACI,IAAI,OAAO,SAAS,KAAK,OAAO,SAAS,GAC9C,KAAK,MAAM,OAAO,KAAK,wEAAwE,OAAO;SAEtG,KAAK,MAAM,OAAO,KAAK,0DAA0D,OAAO;GAE5F,SAAS,OAAO;IACd,KAAK,MAAM,OAAO,MAAM,iDAAiD;KACvE,cAAc,QAAQ;KACtB,YAAY,KAAK,IAAI,IAAI;KACzB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC9D,CAAC;GACH;EACF;EAEA,IAAI,mBAAmB,KAAKC,gCAAgC,KAAKiB,WAAW;GAC1E,MAAM,YAAY,KAAK,IAAI;GAC3B,IAAI;IACF,MAAM,EAAE,QAAQ,GAAG,WAAW,MAAM,KAAKjB,6BAA6B,OAAO;IAC7E,MAAM,UAAU;KAAE,GAAG;KAAQ,uBAAuB,QAAQ;KAAQ,YAAY,KAAK,IAAI,IAAI;IAAU;IACvG,IAAI,OAAO,SAAS,GAClB,KAAK,MAAM,OAAO,KAAK,iEAAiE;KAAE,GAAG;KAAS;IAAO,CAAC;SACzG,IAAI,OAAO,SAAS,GACzB,KAAK,MAAM,OAAO,KAAK,8DAA8D,OAAO;SACvF,IAAI,OAAO,UAAU,GAC1B,KAAK,MAAM,OAAO,KAAK,0DAA0D,OAAO;SAExF,KAAK,MAAM,OAAO,MAAM,mDAAmD,OAAO;GAEtF,SAAS,OAAO;IACd,KAAK,MAAM,OAAO,MAAM,0CAA0C;KAChE,cAAc,QAAQ;KACtB,YAAY,KAAK,IAAI,IAAI;KACzB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC9D,CAAC;GACH;EACF;CACF;CAEA,MAAMwB,wBAA+C;EACnD,MAAM,SAAS,MAAM,KAAK9B,QAAQ,QAM/B,OAAO,GAAG,WAAW,eAAe;EACvC,MAAM,+BAAe,IAAI,IAAwB;EAEjD,KAAK,MAAM,gBAAgB,OAAO,eAAe;GAC/C,IAAI,CAAC,aAAa,UAAU,aAAa,aAAa;GACtD,MAAM,OAAO,MAAM,KAAKA,QAAQ,QAC9B,OACA,GAAG,WAAW,iBAAiB,aAAa,eAAe,cAC7D;GACA,KAAK,MAAM,cAAc,KAAK,cAC5B,aAAa,IAAI,WAAW,IAAI;IAAE,GAAG;IAAY,gBAAgB,aAAa;GAAe,CAAC;EAElG;EAEA,OAAO,CAAC,GAAG,aAAa,OAAO,CAAC;CAClC;CAEA,MAAMgC,gBAAgB,cAAqC;EACzD,MAAM,MAAM,OAAO,YAAY;EAC/B,IAAI,CAAC,KAAKd,UAAU,aAAa,MAAM;GACrC,KAAKA,UAAU,aAAa,OAAO,EAAE,gBAAgB,KAAKD,WAAW;GACrE,MAAM,KAAKmB,cAAc;EAC3B;EAEA,OAAO,KAAKpB,YAAY,KAAKO,WAAW;GACtC,MAAM,SAAsB,KAAKL,UAAU,aAAa;GACxD,MAAM,QAAQ,IAAI,gBAAgB,EAAE,OAAO,OAAO,eAAe,EAAE,CAAC;GACpE,IAAI,kBAAkB,QAAQ,MAAM,IAAI,gBAAgB,OAAO,YAAY;QACtE,MAAM,IAAI,kBAAkB,OAAO,OAAO,cAAc,CAAC;GAE9D,MAAM,gBAAgB,YAAY,IAAI;GACtC,MAAM,OAAO,MAAM,KAAKlB,QAAQ,QAC9B,OACA,GAAG,WAAW,gBAAgB,aAAa,UAAU,OACvD;GACA,KAAK,MAAM,OAAO,MAAM,mDAAmD;IACzE;IACA,YAAY,KAAK,OAAO;IACxB,WAAW,KAAK,MAAM,YAAY,IAAI,IAAI,aAAa;GACzD,CAAC;GACD,IAAI,KAAK,OAAO,WAAW,KAAK,CAAC,KAAK,YAAY;GAElD,KAAK,MAAM,SAAS,KAAK,QAAQ;IAC/B,IAAI,CAAC,KAAKgB,YAAY,CAAC,KAAKO,WAAW;IACvC,MAAM,SAAS,WAAW,KAAK;IAC/B,IAAI,CAAC,QAAQ;KACX,KAAK,MAAM,OAAO,KAAK,wDAAwD;MAC7E;MACA,SAAS,MAAM;KACjB,CAAC;KACD;IACF;IACA,IAAI,uBAAuB,MAAM,GAC/B,MAAM,KAAKnB,sBAAsB,MAAM;IAEzC,MAAM,SAAS,MAAM,KAAKQ,UAAU,QAAQ;KAC1C,YAAY,KAAKX;KACjB,oBAAoB,QAAQ,YAC1B,uCAAuC,QAAQ,SAAS,KAAKC,QAAQ,kBAAkB;KACzF,qBAAqB,IAAI,WACvB,8BAA8B,IAAI,QAAQ,KAAKA,QAAQ,kBAAkB;KAC3E,QAAQ,KAAKA;KACb,qBAAoB,iBAAgB,KAAKmC,oBAAoB,YAAY;KACzE,gBAAgB,cAAc,UAAU;MACtC,KAAK,MAAM,OAAO,MAAM,4DAA4D;OAClF,YAAY,MAAM;OAClB,gBAAgB,aAAa;OAC7B,YAAY,aAAa;OACzB,UAAU,aAAa;OACvB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;MAC9D,CAAC;KACH;IACF,CAAC;IACD,IAAI,OAAO,SAAS,GAClB,KAAK,MAAM,OAAO,KAAK,uEAAuE;KAC5F;KACA,YAAY,MAAM;KAClB,WAAW,OAAO;KAClB,QAAQ,OAAO;IACjB,CAAC;GAEL;GAEA,IAAI,KAAK,gBAAgB,kBAAkB,SAAS,OAAO,eAAe,KAAA,IAAY;GACtF,KAAKnB,UAAU,aAAa,OAAO,EAAE,cAAc,KAAK,WAAW;GACnE,MAAM,KAAKkB,cAAc;EAC3B;CACF;CAEA,MAAMC,oBAAoB,cAA2D;EACnF,IAAI,CAAC,mBAAmB,IAAI,aAAa,IAAI,GAAG,OAAO;EACvD,MAAM,SAAS,aAAa,SAAS;EACrC,MAAM,aAAa,aAAa,SAAS;EACzC,IAAI,CAAC,UAAU,CAAC,YAAY,OAAO;EACnC,IAAI,gBAAgB,IAAI,MAAM,GAAG,OAAO;EAExC,MAAM,kBAAkB,IAAI,gBAAgB;EAC5C,MAAM,UAAU,iBAAiB,gBAAgB,MAAM,GAAG,2BAA2B;EACrF,IAAI;GACF,MAAM,aAAa,MAAM,KAAKnC,QAAQ,oCACpC,aAAa,SAAS,gBACtB,YACA,QACA,gBAAgB,MAClB;GACA,OAAO,eAAe,KAAA,KAAa,uBAAuB,IAAI,UAAU;EAC1E,QAAQ;GACN,OAAO;EACT,UAAU;GACR,aAAa,OAAO;EACtB;CACF;CAEA,MAAMkC,gBAA+B;EACnC,MAAM,KAAKjC,SAAS,SAAS,KAAK,eAAe,gBAAgB,KAAKe,SAAS;CACjF;CAEA,YAAoB;EAClB,OAAO,GAAG,KAAK,KAAK,GAAG,KAAKf,SAAS;CACvC;AACF;AAEA,SAAS,iBAAiB,QAA+B;CACvD,MAAM,cAAe,OAA2E;CAChG,IAAI,OAAO,gBAAgB,YAAY,OAAO,YAAY,KAAK,MAAM,KAAK;CAC1E,OAAO,gBAAgB,MAAM,IAAI,SAAS;AAC5C;AAEA,SAAS,kBAAkB,OAAoF;CAC7G,IAAI,CAAC,SAAS,MAAM,YAAY,KAAK,CAAC,MAAM,gBAAgB,OAAO,MAAM,iBAAiB,UACxF,OAAO;EAAE,SAAS;EAAG,cAAc,CAAC;CAAE;CAExC,OAAO;EAAE,SAAS;EAAG,cAAc,EAAE,GAAG,MAAM,aAAa;CAAE;AAC/D;AAQA,SAAS,uBAAuB,OAAqC;CACnE,KAAK,MAAM,UAAU,YAAY,MAAM,UAAU,mBAAmB,MAAM,QAAQ,WAAW,UAC3F,OAAO;CAET,IAAI,MAAM,UAAU,gBAAgB;EAClC,MAAM,SAAS,MAAM,QAAQ;EAC7B,IAAI,WAAW,iBAAiB,WAAW,oBAAoB,OAAO;CACxE;CACA,OAAO;AACT;AAEA,SAAS,WAAW,OAAkD;CACpE,IACE,CAAC,MAAM,MACP,CAAC,MAAM,cACP,CAAC,iBAAiB,IAAI,MAAM,KAAK,KACjC,CAAC,MAAM,WACP,OAAO,MAAM,YAAY,YACzB,MAAM,QAAQ,MAAM,OAAO,GAE3B,OAAO;CAET,OAAO;EACL,OAAO,MAAM;EACb,YAAY,MAAM;EAClB,SAAS,MAAM;CACjB;AACF;AAEA,SAAS,WAAW,OAAgB,YAA4B;CAC9D,IAAI,iBAAiB,oBAAoB,MAAM,WAAW,OAAO,MAAM,sBAAsB,MAC3F,OAAO,KAAK,IAAI,YAAY,MAAM,oBAAoB,GAAK;CAE7D,OAAO;AACT"}
+{"version":3,"file":"event-worker.js","names":["#client","#controller","#github","#storage","#ingestFactoryEvent","#reconcileFactoryState","#reconcileIssuesFactoryState","#sweepBaseCheckpoints","#pollEventsEnabled","#pullRequestReconcileIntervalMs","#issueReconcileIntervalMs","#intervalMs","#now","#dispatch","#sourceControl","#leaseOwner","#leaseTtlMs","#leaseProvider","#running","#startedAt","#settings","#schedule","#timer","#stopLeaseRenewal","#inFlight","#hasLease","#leaseKey","#tick","#ensureLease","#poll","#startLeaseRenewal","#leaseRenewalTimer","#discoverRepositories","#reconcileCadence","#pollRepository","#maybeReconcile","#lastPullRequestReconcileAt","#lastIssueReconcileAt","#saveSettings","#isAuthorizedSender"],"sources":["../../../../src/integrations/platform/github/event-worker.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\n\nimport type { MountedMastraCode } from '@mastra/code-sdk';\nimport { isLeaseProvider, NoopLeaseProvider } from '@mastra/core/events';\nimport type { LeaseProvider, PubSub } from '@mastra/core/events';\nimport { MastraWorker } from '@mastra/core/worker';\nimport type { WorkerDeps } from '@mastra/core/worker';\n\nimport type { IntegrationStorageHandle } from '../../../storage/domains/integrations/base.js';\nimport type { GithubRepositoryPermission } from '../../github/integration.js';\nimport type { GithubIssueReconciler } from '../../github/issue-reconciler.js';\nimport type { GithubReconcileRepositorySource } from '../../github/reconcile-worker.js';\nimport type { GithubPullRequestReconciler, ReconcileRepository } from '../../github/rules.js';\nimport { listPullRequestSubscriptionsForWebhook, retirePullRequestSubscription } from '../../github/subscriptions.js';\nimport { dispatchGithubWebhook, isFactoryAppSender, resolveAuthorizedBots } from '../../github/webhook.js';\nimport type {\n  GithubWebhookDispatchIntegration,\n  GithubWebhookNotification,\n  ParsedGithubWebhook,\n} from '../../github/webhook.js';\nimport type { PlatformApiClient } from '../api-client.js';\nimport { PlatformApiError } from '../api-client.js';\n\nconst API_PREFIX = '/v1/server/github-app';\nconst DEFAULT_POLL_INTERVAL_MS = 20_000;\nconst DEFAULT_RECONCILE_INTERVAL_MS = 5 * 60_000;\nconst EVENT_PAGE_SIZE = 500;\nconst MIN_LEASE_TTL_MS = 30_000;\nconst CURSOR_ORG_ID = '__platform_github_event_worker__';\nconst CURSOR_USER_ID = 'worker';\nconst SUPPORTED_EVENTS = new Set([\n  'issues',\n  'issue_comment',\n  'pull_request',\n  'pull_request_review',\n  'pull_request_review_comment',\n  // Pushes never reach the subscription dispatcher; they feed the factory\n  // ingest path so base checkpoints rebuild on default-branch updates.\n  'push',\n]);\n// Kinds emitted by `classifyGithubWebhook` that carry untrusted sender-authored\n// content and must pass the sender authorization gate below.\nconst AUTHOR_GATED_KINDS = new Set([\n  'issue-comment-created',\n  'review-comment-created',\n  'review-approved',\n  'review-changes-requested',\n  'review-submitted',\n  'review-dismissed',\n]);\nconst AUTHORIZED_PERMISSIONS = new Set<GithubRepositoryPermission>(['admin', 'maintain', 'write']);\nconst PERMISSION_CHECK_TIMEOUT_MS = 5_000;\n\ntype EventCursor = { afterEventId: string } | { afterTimestamp: number };\ntype PlatformGithubEventWorkerSettings = {\n  version: 1;\n  repositories: Record<string, EventCursor>;\n};\n\nexport type PlatformGithubEventStorage = IntegrationStorageHandle<\n  Record<string, unknown>,\n  PlatformGithubEventWorkerSettings,\n  Record<string, unknown>\n>;\n\ntype EventLogEntry = {\n  id: string;\n  deliveryId: string;\n  event: string;\n  payload: unknown;\n};\n\ntype Repository = { id: number; fullName?: string; installationId: number };\n\nexport type PlatformGithubEventDispatchIntegration = GithubWebhookDispatchIntegration;\n\nexport interface PlatformGithubEventWorkerConfig {\n  client: PlatformApiClient;\n  controller: MountedMastraCode['controller'];\n  github: PlatformGithubEventDispatchIntegration;\n  storage: PlatformGithubEventStorage;\n  /**\n   * Source-control storage used to resolve the set of repositories the worker\n   * should poll. The worker restricts itself to `(installation, repository)`\n   * pairs linked to a factory project — the same set the reconciler uses —\n   * so polling scales with Factory usage, not with the size of the underlying\n   * GitHub org.\n   */\n  sourceControl: GithubReconcileRepositorySource;\n  ingestFactoryEvent?: (event: ParsedGithubWebhook) => Promise<unknown>;\n  reconcileFactoryState?: GithubPullRequestReconciler;\n  reconcileIssuesFactoryState?: GithubIssueReconciler;\n  /** Base-checkpoint freshness sweep, run after the reconcilers within the lease. */\n  sweepBaseCheckpoints?: () => Promise<void>;\n  /** When false the worker skips event tailing and only runs enabled reconciliation sweeps. */\n  pollEventsEnabled?: boolean;\n  intervalMs?: number;\n  /** Legacy shared reconciliation cadence. */\n  reconcileIntervalMs?: number;\n  pullRequestReconcileIntervalMs?: number;\n  issueReconcileIntervalMs?: number;\n  now?: () => number;\n  dispatch?: typeof dispatchGithubWebhook;\n}\n\nexport class PlatformGithubEventWorker extends MastraWorker {\n  readonly name = 'platform-github-events';\n\n  readonly #client: PlatformApiClient;\n  readonly #controller: MountedMastraCode['controller'];\n  readonly #github: PlatformGithubEventDispatchIntegration;\n  readonly #storage: PlatformGithubEventStorage;\n  readonly #ingestFactoryEvent: ((event: ParsedGithubWebhook) => Promise<unknown>) | undefined;\n  readonly #reconcileFactoryState: GithubPullRequestReconciler | undefined;\n  readonly #reconcileIssuesFactoryState: GithubIssueReconciler | undefined;\n  readonly #sweepBaseCheckpoints: (() => Promise<void>) | undefined;\n  readonly #pollEventsEnabled: boolean;\n  readonly #pullRequestReconcileIntervalMs: number;\n  readonly #issueReconcileIntervalMs: number;\n  readonly #intervalMs: number;\n  readonly #now: () => number;\n  readonly #dispatch: typeof dispatchGithubWebhook;\n  readonly #sourceControl: GithubReconcileRepositorySource;\n  readonly #leaseOwner = randomUUID();\n\n  #running = false;\n  #timer: ReturnType<typeof setTimeout> | undefined;\n  #leaseRenewalTimer: ReturnType<typeof setInterval> | undefined;\n  #inFlight: Promise<void> | undefined;\n  #leaseProvider: LeaseProvider = NoopLeaseProvider;\n  #leaseTtlMs: number;\n  #hasLease = false;\n  #startedAt = 0;\n  #lastPullRequestReconcileAt = 0;\n  #lastIssueReconcileAt = 0;\n  #settings: PlatformGithubEventWorkerSettings = { version: 1, repositories: {} };\n\n  constructor(config: PlatformGithubEventWorkerConfig) {\n    super();\n    this.#client = config.client;\n    this.#controller = config.controller;\n    this.#github = config.github;\n    this.#storage = config.storage;\n    this.#ingestFactoryEvent = config.ingestFactoryEvent;\n    this.#reconcileFactoryState = config.reconcileFactoryState;\n    this.#reconcileIssuesFactoryState = config.reconcileIssuesFactoryState;\n    this.#sweepBaseCheckpoints = config.sweepBaseCheckpoints;\n    this.#pollEventsEnabled = config.pollEventsEnabled ?? true;\n    const legacyReconcileIntervalMs = config.reconcileIntervalMs ?? DEFAULT_RECONCILE_INTERVAL_MS;\n    this.#pullRequestReconcileIntervalMs = config.pullRequestReconcileIntervalMs ?? legacyReconcileIntervalMs;\n    this.#issueReconcileIntervalMs = config.issueReconcileIntervalMs ?? legacyReconcileIntervalMs;\n    this.#intervalMs = config.intervalMs ?? DEFAULT_POLL_INTERVAL_MS;\n    if (!Number.isFinite(this.#intervalMs) || this.#intervalMs <= 0) {\n      throw new Error('Platform GitHub event polling interval must be a positive number.');\n    }\n    if (!Number.isFinite(this.#pullRequestReconcileIntervalMs) || this.#pullRequestReconcileIntervalMs <= 0) {\n      throw new Error('Platform GitHub pull request reconcile interval must be a positive number.');\n    }\n    if (!Number.isFinite(this.#issueReconcileIntervalMs) || this.#issueReconcileIntervalMs <= 0) {\n      throw new Error('Platform GitHub issue reconcile interval must be a positive number.');\n    }\n    this.#leaseTtlMs = Math.max(\n      MIN_LEASE_TTL_MS,\n      Math.min(this.#intervalMs, this.#pullRequestReconcileIntervalMs, this.#issueReconcileIntervalMs) * 3,\n    );\n    this.#now = config.now ?? Date.now;\n    this.#dispatch = config.dispatch ?? dispatchGithubWebhook;\n    this.#sourceControl = config.sourceControl;\n  }\n\n  async init(deps: WorkerDeps): Promise<void> {\n    await super.init(deps);\n    this.#leaseProvider = getLeaseProvider(deps.pubsub);\n  }\n\n  async start(): Promise<void> {\n    if (this.#running) return;\n    if (!this.deps) throw new Error('PlatformGithubEventWorker: call init() before start()');\n\n    this.#startedAt = this.#now() - 1;\n    this.#settings = normalizeSettings(await this.#storage.settings.get(CURSOR_ORG_ID, CURSOR_USER_ID));\n    this.#running = true;\n    this.deps.logger.info('Platform GitHub event polling started', {\n      intervalMs: this.#intervalMs,\n      leaseTtlMs: this.#leaseTtlMs,\n    });\n    this.#schedule(0);\n  }\n\n  async stop(): Promise<void> {\n    if (!this.#running) return;\n    this.#running = false;\n    if (this.#timer) clearTimeout(this.#timer);\n    this.#timer = undefined;\n    this.#stopLeaseRenewal();\n    await this.#inFlight;\n    if (this.#hasLease) {\n      await this.#leaseProvider.releaseLease(this.#leaseKey(), this.#leaseOwner).catch(() => undefined);\n      this.#hasLease = false;\n    }\n  }\n\n  get isRunning(): boolean {\n    return this.#running;\n  }\n\n  #schedule(delayMs: number): void {\n    if (!this.#running) return;\n    this.#timer = setTimeout(() => {\n      this.#timer = undefined;\n      const run = this.#tick();\n      this.#inFlight = run;\n      void run.finally(() => {\n        if (this.#inFlight === run) this.#inFlight = undefined;\n      });\n    }, delayMs);\n    this.#timer.unref?.();\n  }\n\n  async #tick(): Promise<void> {\n    let nextDelay = this.#intervalMs;\n    try {\n      if (!(await this.#ensureLease())) return;\n      nextDelay = await this.#poll();\n    } catch (error) {\n      nextDelay = retryDelay(error, this.#intervalMs);\n      this.deps?.logger.error('Platform GitHub event polling cycle failed', {\n        error: error instanceof Error ? error.message : String(error),\n        retryInMs: nextDelay,\n      });\n    } finally {\n      this.#schedule(nextDelay);\n    }\n  }\n\n  async #ensureLease(): Promise<boolean> {\n    if (this.#hasLease) return true;\n    const result = await this.#leaseProvider.acquireLease(this.#leaseKey(), this.#leaseOwner, this.#leaseTtlMs);\n    this.#hasLease = result.acquired;\n    if (this.#hasLease) this.#startLeaseRenewal();\n    return this.#hasLease;\n  }\n\n  #startLeaseRenewal(): void {\n    if (this.#leaseRenewalTimer) return;\n    this.#leaseRenewalTimer = setInterval(\n      () => {\n        void this.#leaseProvider\n          .renewLease(this.#leaseKey(), this.#leaseOwner, this.#leaseTtlMs)\n          .then(renewed => {\n            if (!renewed) {\n              this.#hasLease = false;\n              this.#stopLeaseRenewal();\n            }\n          })\n          .catch(error => {\n            this.#hasLease = false;\n            this.#stopLeaseRenewal();\n            this.deps?.logger.warn('Platform GitHub event polling lease renewal failed', {\n              error: error instanceof Error ? error.message : String(error),\n            });\n          });\n      },\n      Math.floor(this.#leaseTtlMs / 3),\n    );\n    this.#leaseRenewalTimer.unref?.();\n  }\n\n  #stopLeaseRenewal(): void {\n    if (this.#leaseRenewalTimer) clearInterval(this.#leaseRenewalTimer);\n    this.#leaseRenewalTimer = undefined;\n  }\n\n  async #poll(): Promise<number> {\n    const repositories = await this.#discoverRepositories();\n    let retryInMs = this.#pollEventsEnabled ? this.#intervalMs : this.#reconcileCadence();\n\n    if (this.#pollEventsEnabled) {\n      for (const repository of repositories) {\n        if (!this.#running || !this.#hasLease) break;\n        try {\n          await this.#pollRepository(repository.id);\n        } catch (error) {\n          const delay = retryDelay(error, this.#intervalMs);\n          retryInMs = Math.max(retryInMs, delay);\n          this.deps?.logger.error('Platform GitHub repository event polling failed', {\n            repositoryId: repository.id,\n            error: error instanceof Error ? error.message : String(error),\n            retryInMs: delay,\n          });\n          if (error instanceof PlatformApiError && error.status === 429) break;\n        }\n      }\n    }\n\n    await this.#maybeReconcile(repositories);\n    return retryInMs;\n  }\n\n  #reconcileCadence(): number {\n    const cadences = [\n      this.#reconcileFactoryState ? this.#pullRequestReconcileIntervalMs : undefined,\n      this.#reconcileIssuesFactoryState ? this.#issueReconcileIntervalMs : undefined,\n    ].filter((interval): interval is number => interval !== undefined);\n    return cadences.length > 0 ? Math.min(...cadences) : this.#intervalMs;\n  }\n\n  async #maybeReconcile(repositories: Repository[]): Promise<void> {\n    if (!this.#running || !this.#hasLease) return;\n    const now = this.#now();\n    const reconcilePullRequests = Boolean(\n      this.#reconcileFactoryState && now - this.#lastPullRequestReconcileAt >= this.#pullRequestReconcileIntervalMs,\n    );\n    const reconcileIssues = Boolean(\n      this.#reconcileIssuesFactoryState && now - this.#lastIssueReconcileAt >= this.#issueReconcileIntervalMs,\n    );\n    if (!reconcilePullRequests && !reconcileIssues) return;\n    if (reconcilePullRequests) this.#lastPullRequestReconcileAt = now;\n    if (reconcileIssues) this.#lastIssueReconcileAt = now;\n\n    const targets: ReconcileRepository[] = repositories.flatMap(repository =>\n      repository.fullName\n        ? [{ id: repository.id, fullName: repository.fullName, installationId: repository.installationId }]\n        : [],\n    );\n    if (targets.length === 0) {\n      this.deps?.logger.debug('Platform GitHub reconciliation skipped: no named repositories');\n      return;\n    }\n\n    if (reconcilePullRequests && this.#reconcileFactoryState) {\n      const startedAt = Date.now();\n      try {\n        const { errors, ...counts } = await this.#reconcileFactoryState(targets);\n        const context = { ...counts, candidateRepositories: targets.length, durationMs: Date.now() - startedAt };\n        if (counts.failed > 0) {\n          this.deps?.logger.warn('Platform GitHub pull request reconcile sweep completed with failures', {\n            ...context,\n            errors,\n          });\n        } else if (counts.merged > 0 || counts.closed > 0) {\n          this.deps?.logger.info('Platform GitHub pull request reconcile replayed missed merges/closes', context);\n        } else {\n          this.deps?.logger.info('Platform GitHub pull request reconcile sweep completed', context);\n        }\n      } catch (error) {\n        this.deps?.logger.error('Platform GitHub pull request reconcile failed', {\n          repositories: targets.length,\n          durationMs: Date.now() - startedAt,\n          error: error instanceof Error ? error.message : String(error),\n        });\n      }\n    }\n\n    if (reconcileIssues && this.#reconcileIssuesFactoryState && this.#hasLease) {\n      const startedAt = Date.now();\n      try {\n        const { errors, ...counts } = await this.#reconcileIssuesFactoryState(targets);\n        const context = { ...counts, candidateRepositories: targets.length, durationMs: Date.now() - startedAt };\n        if (counts.failed > 0) {\n          this.deps?.logger.warn('Platform GitHub issue reconcile sweep completed with failures', { ...context, errors });\n        } else if (counts.closed > 0) {\n          this.deps?.logger.info('Platform GitHub issue reconcile replayed closed work items', context);\n        } else if (counts.updated > 0) {\n          this.deps?.logger.info('Platform GitHub issue reconcile patched stale metadata', context);\n        } else {\n          this.deps?.logger.debug('Platform GitHub issue reconcile sweep completed', context);\n        }\n      } catch (error) {\n        this.deps?.logger.error('Platform GitHub issue reconcile failed', {\n          repositories: targets.length,\n          durationMs: Date.now() - startedAt,\n          error: error instanceof Error ? error.message : String(error),\n        });\n      }\n    }\n\n    if (this.#sweepBaseCheckpoints && this.#hasLease) {\n      try {\n        await this.#sweepBaseCheckpoints();\n      } catch (error) {\n        this.deps?.logger.warn('Platform GitHub base-checkpoint freshness sweep failed', {\n          error: error instanceof Error ? error.message : String(error),\n        });\n      }\n    }\n  }\n\n  /**\n   * Configured `(installation, repository)` pairs — the same set the\n   * reconciler sweeps — resolved to the numeric ids and slug the poll\n   * addresses GitHub with. Repositories not linked to any factory project\n   * cannot produce work for Factory, so polling and reconciling them is\n   * wasted `/events` bandwidth and platform load.\n   */\n  async #discoverRepositories(): Promise<Repository[]> {\n    const keys = await this.#sourceControl.projectRepositories.listConfiguredExternalKeys();\n    const repositories = new Map<number, Repository>();\n    for (const key of keys) {\n      const installationId = Number(key.installationExternalId);\n      const repositoryId = Number(key.repositoryExternalId);\n      if (\n        !Number.isSafeInteger(installationId) ||\n        installationId <= 0 ||\n        !Number.isSafeInteger(repositoryId) ||\n        repositoryId <= 0\n      ) {\n        continue;\n      }\n      if (repositories.has(repositoryId)) continue;\n      // A configured key exists per project link, so `listByExternalRepository`\n      // always yields at least one row; the first row's orgId is enough to\n      // look up the repository row for its slug.\n      const projects = await this.#sourceControl.projectRepositories.listByExternalRepository(key);\n      const orgId = projects[0]?.orgId;\n      const repository = orgId\n        ? await this.#sourceControl.repositories.findByExternalId({ orgId, externalId: key.repositoryExternalId })\n        : null;\n      repositories.set(repositoryId, {\n        id: repositoryId,\n        installationId,\n        fullName: repository?.slug,\n      });\n    }\n    return [...repositories.values()];\n  }\n\n  async #pollRepository(repositoryId: number): Promise<void> {\n    const key = String(repositoryId);\n    if (!this.#settings.repositories[key]) {\n      this.#settings.repositories[key] = { afterTimestamp: this.#startedAt };\n      await this.#saveSettings();\n    }\n\n    while (this.#running && this.#hasLease) {\n      const cursor: EventCursor = this.#settings.repositories[key]!;\n      const query = new URLSearchParams({ limit: String(EVENT_PAGE_SIZE) });\n      if ('afterEventId' in cursor) query.set('afterEventId', cursor.afterEventId);\n      else query.set('afterTimestamp', String(cursor.afterTimestamp));\n\n      const pollStartedAt = performance.now();\n      const page = await this.#client.request<{ events: EventLogEntry[]; nextCursor: string | null }>(\n        'GET',\n        `${API_PREFIX}/repositories/${repositoryId}/events?${query}`,\n      );\n      this.deps?.logger.debug('Platform GitHub repository event poll completed', {\n        repositoryId,\n        eventCount: page.events.length,\n        latencyMs: Math.round(performance.now() - pollStartedAt),\n      });\n      if (page.events.length === 0 || !page.nextCursor) return;\n\n      for (const event of page.events) {\n        if (!this.#running || !this.#hasLease) return;\n        const parsed = parseEvent(event);\n        if (!parsed) {\n          this.deps?.logger.warn('Platform GitHub event log returned a malformed event', {\n            repositoryId,\n            eventId: event.id,\n          });\n          continue;\n        }\n        if (isFactoryIngestedEvent(parsed)) {\n          await this.#ingestFactoryEvent?.(parsed);\n        }\n        const result = await this.#dispatch(parsed, {\n          controller: this.#controller,\n          listSubscriptions: (target, options) =>\n            listPullRequestSubscriptionsForWebhook(target, options, this.#github.integrationStorage),\n          retireSubscription: (id, status) =>\n            retirePullRequestSubscription(id, status, this.#github.integrationStorage),\n          github: this.#github,\n          isAuthorizedSender: notification => this.#isAuthorizedSender(notification),\n          onTargetSkipped: subscription => {\n            // Routine when a subscription's thread belongs to another\n            // deployment, so this stays at debug rather than warning on a loop.\n            this.deps?.logger.debug('Platform GitHub event skipped: thread is not held here', {\n              deliveryId: event.deliveryId,\n              subscriptionId: subscription.id,\n              threadId: subscription.threadId,\n            });\n          },\n          onSenderRejected: notification => {\n            this.deps?.logger.debug('Platform GitHub event dropped: sender not authorized', {\n              deliveryId: event.deliveryId,\n              repository: notification.metadata.repository,\n              sender: notification.metadata.sender,\n              kind: notification.kind,\n            });\n          },\n          onTargetError: (subscription, error) => {\n            this.deps?.logger.error('Platform GitHub event delivery failed for a subscription', {\n              deliveryId: event.deliveryId,\n              subscriptionId: subscription.id,\n              resourceId: subscription.resourceId,\n              threadId: subscription.threadId,\n              error: error instanceof Error ? error.message : String(error),\n            });\n          },\n        });\n        if (result.failed > 0) {\n          this.deps?.logger.warn('Platform GitHub event completed with failed subscription deliveries', {\n            repositoryId,\n            deliveryId: event.deliveryId,\n            delivered: result.delivered,\n            failed: result.failed,\n          });\n        }\n      }\n\n      if (page.nextCursor === ('afterEventId' in cursor ? cursor.afterEventId : undefined)) return;\n      this.#settings.repositories[key] = { afterEventId: page.nextCursor };\n      await this.#saveSettings();\n    }\n  }\n\n  async #isAuthorizedSender(notification: GithubWebhookNotification): Promise<boolean> {\n    if (!AUTHOR_GATED_KINDS.has(notification.kind)) return true;\n    const sender = notification.metadata.sender;\n    const repository = notification.metadata.repository;\n    if (!sender || !repository) return false;\n    // Factory's own app has to clear the gate before the bot rules below, which\n    // fail closed for every bot that is not explicitly allowlisted. GitHub\n    // forbids an app from reviewing its own pull request, so `factory-review`\n    // posts its verdict as a comment under this login and that comment is the\n    // handoff the authoring agent wakes on.\n    if (this.#github.identity?.matches(sender)) return true;\n    if (isFactoryAppSender(sender, this.#github.slug)) return true;\n    const normalizedSender = sender.toLowerCase();\n    const authorizedBots = resolveAuthorizedBots(this.#github.authorizedBots);\n    if (authorizedBots.has(normalizedSender)) return true;\n    // Any other bot is gated purely by the allowlist: a GitHub App never holds a\n    // collaborator permission under its sender login, so falling through to the\n    // permission lookup would only fail closed after a wasted API call.\n    if (notification.metadata.senderType?.toLowerCase() === 'bot' || normalizedSender.endsWith('[bot]')) {\n      return false;\n    }\n\n    const abortController = new AbortController();\n    const timeout = setTimeout(() => abortController.abort(), PERMISSION_CHECK_TIMEOUT_MS);\n    try {\n      const permission = await this.#github.getRepositoryCollaboratorPermission(\n        notification.metadata.installationId,\n        repository,\n        sender,\n        abortController.signal,\n      );\n      return permission !== undefined && AUTHORIZED_PERMISSIONS.has(permission);\n    } catch {\n      return false;\n    } finally {\n      clearTimeout(timeout);\n    }\n  }\n\n  async #saveSettings(): Promise<void> {\n    await this.#storage.settings.save(CURSOR_ORG_ID, CURSOR_USER_ID, this.#settings);\n  }\n\n  #leaseKey(): string {\n    return `${this.name}:${this.#storage.integrationId}`;\n  }\n}\n\nfunction getLeaseProvider(pubsub: PubSub): LeaseProvider {\n  const getProvider = (pubsub as PubSub & { getLeaseProvider?: () => LeaseProvider | undefined }).getLeaseProvider;\n  if (typeof getProvider === 'function') return getProvider.call(pubsub) ?? NoopLeaseProvider;\n  return isLeaseProvider(pubsub) ? pubsub : NoopLeaseProvider;\n}\n\nfunction normalizeSettings(value: PlatformGithubEventWorkerSettings | null): PlatformGithubEventWorkerSettings {\n  if (!value || value.version !== 1 || !value.repositories || typeof value.repositories !== 'object') {\n    return { version: 1, repositories: {} };\n  }\n  return { version: 1, repositories: { ...value.repositories } };\n}\n\n// Events the polling worker forwards to the factory rules engine. Closures\n// let the reconciler finalize cards; `synchronize` and `review_requested` on a\n// pull request are the triggers the review board's re-review path listens for;\n// submitted reviews and pull request comments are how review feedback reaches\n// the agent that authored the branch. Direct-webhook consumers ingest every\n// parsed event; the platform path gates because the remaining events (issue\n// edits, comment edits and deletions) only interest the subscription\n// dispatcher, not the factory rules.\nfunction isFactoryIngestedEvent(event: ParsedGithubWebhook): boolean {\n  if ((event.event === 'issues' || event.event === 'pull_request') && event.payload.action === 'closed') {\n    return true;\n  }\n  if (event.event === 'pull_request') {\n    const action = event.payload.action;\n    // `opened` is what mints the Review card for a pull request. Without it a\n    // factory-authored PR never gets reviewed on the polling path, which is the\n    // only path a local deployment has.\n    if (action === 'opened' || action === 'synchronize' || action === 'review_requested') return true;\n  }\n  if (event.event === 'pull_request_review' && event.payload.action === 'submitted') return true;\n  if (event.event === 'issue_comment' && event.payload.action === 'created') return true;\n  // Default-branch pushes drive base-checkpoint rebuilds\n  // (`withBaseCheckpointWebhookTrigger` wraps the ingest callback).\n  if (event.event === 'push') return true;\n  return false;\n}\n\nfunction parseEvent(event: EventLogEntry): ParsedGithubWebhook | null {\n  if (\n    !event.id ||\n    !event.deliveryId ||\n    !SUPPORTED_EVENTS.has(event.event) ||\n    !event.payload ||\n    typeof event.payload !== 'object' ||\n    Array.isArray(event.payload)\n  ) {\n    return null;\n  }\n  return {\n    event: event.event,\n    deliveryId: event.deliveryId,\n    payload: event.payload as Record<string, unknown>,\n  };\n}\n\nfunction retryDelay(error: unknown, fallbackMs: number): number {\n  if (error instanceof PlatformApiError && error.status === 429 && error.retryAfterSeconds !== null) {\n    return Math.max(fallbackMs, error.retryAfterSeconds * 1_000);\n  }\n  return fallbackMs;\n}\n"],"mappings":";;;;;;;AAuBA,MAAM,aAAa;AACnB,MAAM,2BAA2B;AACjC,MAAM,gCAAgC,IAAI;AAC1C,MAAM,kBAAkB;AACxB,MAAM,mBAAmB;AACzB,MAAM,gBAAgB;AACtB,MAAM,iBAAiB;AACvB,MAAM,mCAAmB,IAAI,IAAI;CAC/B;CACA;CACA;CACA;CACA;CAGA;AACF,CAAC;AAGD,MAAM,qCAAqB,IAAI,IAAI;CACjC;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AACD,MAAM,yCAAyB,IAAI,IAAgC;CAAC;CAAS;CAAY;AAAO,CAAC;AACjG,MAAM,8BAA8B;AAsDpC,IAAa,4BAAb,cAA+C,aAAa;CAC1D,OAAgB;CAEhB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,cAAuB,WAAW;CAElC,WAAW;CACX;CACA;CACA;CACA,iBAAgC;CAChC;CACA,YAAY;CACZ,aAAa;CACb,8BAA8B;CAC9B,wBAAwB;CACxB,YAA+C;EAAE,SAAS;EAAG,cAAc,CAAC;CAAE;CAE9E,YAAY,QAAyC;EACnD,MAAM;EACN,KAAKA,UAAU,OAAO;EACtB,KAAKC,cAAc,OAAO;EAC1B,KAAKC,UAAU,OAAO;EACtB,KAAKC,WAAW,OAAO;EACvB,KAAKC,sBAAsB,OAAO;EAClC,KAAKC,yBAAyB,OAAO;EACrC,KAAKC,+BAA+B,OAAO;EAC3C,KAAKC,wBAAwB,OAAO;EACpC,KAAKC,qBAAqB,OAAO,qBAAqB;EACtD,MAAM,4BAA4B,OAAO,uBAAuB;EAChE,KAAKC,kCAAkC,OAAO,kCAAkC;EAChF,KAAKC,4BAA4B,OAAO,4BAA4B;EACpE,KAAKC,cAAc,OAAO,cAAc;EACxC,IAAI,CAAC,OAAO,SAAS,KAAKA,WAAW,KAAK,KAAKA,eAAe,GAC5D,MAAM,IAAI,MAAM,mEAAmE;EAErF,IAAI,CAAC,OAAO,SAAS,KAAKF,+BAA+B,KAAK,KAAKA,mCAAmC,GACpG,MAAM,IAAI,MAAM,4EAA4E;EAE9F,IAAI,CAAC,OAAO,SAAS,KAAKC,yBAAyB,KAAK,KAAKA,6BAA6B,GACxF,MAAM,IAAI,MAAM,qEAAqE;EAEvF,KAAKM,cAAc,KAAK,IACtB,kBACA,KAAK,IAAI,KAAKL,aAAa,KAAKF,iCAAiC,KAAKC,yBAAyB,IAAI,CACrG;EACA,KAAKE,OAAO,OAAO,OAAO,KAAK;EAC/B,KAAKC,YAAY,OAAO,YAAY;EACpC,KAAKC,iBAAiB,OAAO;CAC/B;CAEA,MAAM,KAAK,MAAiC;EAC1C,MAAM,MAAM,KAAK,IAAI;EACrB,KAAKG,iBAAiB,iBAAiB,KAAK,MAAM;CACpD;CAEA,MAAM,QAAuB;EAC3B,IAAI,KAAKC,UAAU;EACnB,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,MAAM,uDAAuD;EAEvF,KAAKC,aAAa,KAAKP,KAAK,IAAI;EAChC,KAAKQ,YAAY,kBAAkB,MAAM,KAAKjB,SAAS,SAAS,IAAI,eAAe,cAAc,CAAC;EAClG,KAAKe,WAAW;EAChB,KAAK,KAAK,OAAO,KAAK,yCAAyC;GAC7D,YAAY,KAAKP;GACjB,YAAY,KAAKK;EACnB,CAAC;EACD,KAAKK,UAAU,CAAC;CAClB;CAEA,MAAM,OAAsB;EAC1B,IAAI,CAAC,KAAKH,UAAU;EACpB,KAAKA,WAAW;EAChB,IAAI,KAAKI,QAAQ,aAAa,KAAKA,MAAM;EACzC,KAAKA,SAAS,KAAA;EACd,KAAKC,kBAAkB;EACvB,MAAM,KAAKC;EACX,IAAI,KAAKC,WAAW;GAClB,MAAM,KAAKR,eAAe,aAAa,KAAKS,UAAU,GAAG,KAAKX,WAAW,CAAC,CAAC,YAAY,KAAA,CAAS;GAChG,KAAKU,YAAY;EACnB;CACF;CAEA,IAAI,YAAqB;EACvB,OAAO,KAAKP;CACd;CAEA,UAAU,SAAuB;EAC/B,IAAI,CAAC,KAAKA,UAAU;EACpB,KAAKI,SAAS,iBAAiB;GAC7B,KAAKA,SAAS,KAAA;GACd,MAAM,MAAM,KAAKK,MAAM;GACvB,KAAKH,YAAY;GACjB,IAAS,cAAc;IACrB,IAAI,KAAKA,cAAc,KAAK,KAAKA,YAAY,KAAA;GAC/C,CAAC;EACH,GAAG,OAAO;EACV,KAAKF,OAAO,QAAQ;CACtB;CAEA,MAAMK,QAAuB;EAC3B,IAAI,YAAY,KAAKhB;EACrB,IAAI;GACF,IAAI,CAAE,MAAM,KAAKiB,aAAa,GAAI;GAClC,YAAY,MAAM,KAAKC,MAAM;EAC/B,SAAS,OAAO;GACd,YAAY,WAAW,OAAO,KAAKlB,WAAW;GAC9C,KAAK,MAAM,OAAO,MAAM,8CAA8C;IACpE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC5D,WAAW;GACb,CAAC;EACH,UAAU;GACR,KAAKU,UAAU,SAAS;EAC1B;CACF;CAEA,MAAMO,eAAiC;EACrC,IAAI,KAAKH,WAAW,OAAO;EAC3B,MAAM,SAAS,MAAM,KAAKR,eAAe,aAAa,KAAKS,UAAU,GAAG,KAAKX,aAAa,KAAKC,WAAW;EAC1G,KAAKS,YAAY,OAAO;EACxB,IAAI,KAAKA,WAAW,KAAKK,mBAAmB;EAC5C,OAAO,KAAKL;CACd;CAEA,qBAA2B;EACzB,IAAI,KAAKM,oBAAoB;EAC7B,KAAKA,qBAAqB,kBAClB;GACJ,KAAUd,eACP,WAAW,KAAKS,UAAU,GAAG,KAAKX,aAAa,KAAKC,WAAW,CAAC,CAChE,MAAK,YAAW;IACf,IAAI,CAAC,SAAS;KACZ,KAAKS,YAAY;KACjB,KAAKF,kBAAkB;IACzB;GACF,CAAC,CAAC,CACD,OAAM,UAAS;IACd,KAAKE,YAAY;IACjB,KAAKF,kBAAkB;IACvB,KAAK,MAAM,OAAO,KAAK,sDAAsD,EAC3E,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC9D,CAAC;GACH,CAAC;EACL,GACA,KAAK,MAAM,KAAKP,cAAc,CAAC,CACjC;EACA,KAAKe,mBAAmB,QAAQ;CAClC;CAEA,oBAA0B;EACxB,IAAI,KAAKA,oBAAoB,cAAc,KAAKA,kBAAkB;EAClE,KAAKA,qBAAqB,KAAA;CAC5B;CAEA,MAAMF,QAAyB;EAC7B,MAAM,eAAe,MAAM,KAAKG,sBAAsB;EACtD,IAAI,YAAY,KAAKxB,qBAAqB,KAAKG,cAAc,KAAKsB,kBAAkB;EAEpF,IAAI,KAAKzB,oBACP,KAAK,MAAM,cAAc,cAAc;GACrC,IAAI,CAAC,KAAKU,YAAY,CAAC,KAAKO,WAAW;GACvC,IAAI;IACF,MAAM,KAAKS,gBAAgB,WAAW,EAAE;GAC1C,SAAS,OAAO;IACd,MAAM,QAAQ,WAAW,OAAO,KAAKvB,WAAW;IAChD,YAAY,KAAK,IAAI,WAAW,KAAK;IACrC,KAAK,MAAM,OAAO,MAAM,mDAAmD;KACzE,cAAc,WAAW;KACzB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KAC5D,WAAW;IACb,CAAC;IACD,IAAI,iBAAiB,oBAAoB,MAAM,WAAW,KAAK;GACjE;EACF;EAGF,MAAM,KAAKwB,gBAAgB,YAAY;EACvC,OAAO;CACT;CAEA,oBAA4B;EAC1B,MAAM,WAAW,CACf,KAAK9B,yBAAyB,KAAKI,kCAAkC,KAAA,GACrE,KAAKH,+BAA+B,KAAKI,4BAA4B,KAAA,CACvE,CAAC,CAAC,QAAQ,aAAiC,aAAa,KAAA,CAAS;EACjE,OAAO,SAAS,SAAS,IAAI,KAAK,IAAI,GAAG,QAAQ,IAAI,KAAKC;CAC5D;CAEA,MAAMwB,gBAAgB,cAA2C;EAC/D,IAAI,CAAC,KAAKjB,YAAY,CAAC,KAAKO,WAAW;EACvC,MAAM,MAAM,KAAKb,KAAK;EACtB,MAAM,wBAAwB,QAC5B,KAAKP,0BAA0B,MAAM,KAAK+B,+BAA+B,KAAK3B,+BAChF;EACA,MAAM,kBAAkB,QACtB,KAAKH,gCAAgC,MAAM,KAAK+B,yBAAyB,KAAK3B,yBAChF;EACA,IAAI,CAAC,yBAAyB,CAAC,iBAAiB;EAChD,IAAI,uBAAuB,KAAK0B,8BAA8B;EAC9D,IAAI,iBAAiB,KAAKC,wBAAwB;EAElD,MAAM,UAAiC,aAAa,SAAQ,eAC1D,WAAW,WACP,CAAC;GAAE,IAAI,WAAW;GAAI,UAAU,WAAW;GAAU,gBAAgB,WAAW;EAAe,CAAC,IAChG,CAAC,CACP;EACA,IAAI,QAAQ,WAAW,GAAG;GACxB,KAAK,MAAM,OAAO,MAAM,+DAA+D;GACvF;EACF;EAEA,IAAI,yBAAyB,KAAKhC,wBAAwB;GACxD,MAAM,YAAY,KAAK,IAAI;GAC3B,IAAI;IACF,MAAM,EAAE,QAAQ,GAAG,WAAW,MAAM,KAAKA,uBAAuB,OAAO;IACvE,MAAM,UAAU;KAAE,GAAG;KAAQ,uBAAuB,QAAQ;KAAQ,YAAY,KAAK,IAAI,IAAI;IAAU;IACvG,IAAI,OAAO,SAAS,GAClB,KAAK,MAAM,OAAO,KAAK,wEAAwE;KAC7F,GAAG;KACH;IACF,CAAC;SACI,IAAI,OAAO,SAAS,KAAK,OAAO,SAAS,GAC9C,KAAK,MAAM,OAAO,KAAK,wEAAwE,OAAO;SAEtG,KAAK,MAAM,OAAO,KAAK,0DAA0D,OAAO;GAE5F,SAAS,OAAO;IACd,KAAK,MAAM,OAAO,MAAM,iDAAiD;KACvE,cAAc,QAAQ;KACtB,YAAY,KAAK,IAAI,IAAI;KACzB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC9D,CAAC;GACH;EACF;EAEA,IAAI,mBAAmB,KAAKC,gCAAgC,KAAKmB,WAAW;GAC1E,MAAM,YAAY,KAAK,IAAI;GAC3B,IAAI;IACF,MAAM,EAAE,QAAQ,GAAG,WAAW,MAAM,KAAKnB,6BAA6B,OAAO;IAC7E,MAAM,UAAU;KAAE,GAAG;KAAQ,uBAAuB,QAAQ;KAAQ,YAAY,KAAK,IAAI,IAAI;IAAU;IACvG,IAAI,OAAO,SAAS,GAClB,KAAK,MAAM,OAAO,KAAK,iEAAiE;KAAE,GAAG;KAAS;IAAO,CAAC;SACzG,IAAI,OAAO,SAAS,GACzB,KAAK,MAAM,OAAO,KAAK,8DAA8D,OAAO;SACvF,IAAI,OAAO,UAAU,GAC1B,KAAK,MAAM,OAAO,KAAK,0DAA0D,OAAO;SAExF,KAAK,MAAM,OAAO,MAAM,mDAAmD,OAAO;GAEtF,SAAS,OAAO;IACd,KAAK,MAAM,OAAO,MAAM,0CAA0C;KAChE,cAAc,QAAQ;KACtB,YAAY,KAAK,IAAI,IAAI;KACzB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC9D,CAAC;GACH;EACF;EAEA,IAAI,KAAKC,yBAAyB,KAAKkB,WACrC,IAAI;GACF,MAAM,KAAKlB,sBAAsB;EACnC,SAAS,OAAO;GACd,KAAK,MAAM,OAAO,KAAK,0DAA0D,EAC/E,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC9D,CAAC;EACH;CAEJ;;;;;;;;CASA,MAAMyB,wBAA+C;EACnD,MAAM,OAAO,MAAM,KAAKlB,eAAe,oBAAoB,2BAA2B;EACtF,MAAM,+BAAe,IAAI,IAAwB;EACjD,KAAK,MAAM,OAAO,MAAM;GACtB,MAAM,iBAAiB,OAAO,IAAI,sBAAsB;GACxD,MAAM,eAAe,OAAO,IAAI,oBAAoB;GACpD,IACE,CAAC,OAAO,cAAc,cAAc,KACpC,kBAAkB,KAClB,CAAC,OAAO,cAAc,YAAY,KAClC,gBAAgB,GAEhB;GAEF,IAAI,aAAa,IAAI,YAAY,GAAG;GAKpC,MAAM,SAAQ,MADS,KAAKA,eAAe,oBAAoB,yBAAyB,GAAG,EAAA,CACpE,EAAE,EAAE;GAC3B,MAAM,aAAa,QACf,MAAM,KAAKA,eAAe,aAAa,iBAAiB;IAAE;IAAO,YAAY,IAAI;GAAqB,CAAC,IACvG;GACJ,aAAa,IAAI,cAAc;IAC7B,IAAI;IACJ;IACA,UAAU,YAAY;GACxB,CAAC;EACH;EACA,OAAO,CAAC,GAAG,aAAa,OAAO,CAAC;CAClC;CAEA,MAAMoB,gBAAgB,cAAqC;EACzD,MAAM,MAAM,OAAO,YAAY;EAC/B,IAAI,CAAC,KAAKd,UAAU,aAAa,MAAM;GACrC,KAAKA,UAAU,aAAa,OAAO,EAAE,gBAAgB,KAAKD,WAAW;GACrE,MAAM,KAAKmB,cAAc;EAC3B;EAEA,OAAO,KAAKpB,YAAY,KAAKO,WAAW;GACtC,MAAM,SAAsB,KAAKL,UAAU,aAAa;GACxD,MAAM,QAAQ,IAAI,gBAAgB,EAAE,OAAO,OAAO,eAAe,EAAE,CAAC;GACpE,IAAI,kBAAkB,QAAQ,MAAM,IAAI,gBAAgB,OAAO,YAAY;QACtE,MAAM,IAAI,kBAAkB,OAAO,OAAO,cAAc,CAAC;GAE9D,MAAM,gBAAgB,YAAY,IAAI;GACtC,MAAM,OAAO,MAAM,KAAKpB,QAAQ,QAC9B,OACA,GAAG,WAAW,gBAAgB,aAAa,UAAU,OACvD;GACA,KAAK,MAAM,OAAO,MAAM,mDAAmD;IACzE;IACA,YAAY,KAAK,OAAO;IACxB,WAAW,KAAK,MAAM,YAAY,IAAI,IAAI,aAAa;GACzD,CAAC;GACD,IAAI,KAAK,OAAO,WAAW,KAAK,CAAC,KAAK,YAAY;GAElD,KAAK,MAAM,SAAS,KAAK,QAAQ;IAC/B,IAAI,CAAC,KAAKkB,YAAY,CAAC,KAAKO,WAAW;IACvC,MAAM,SAAS,WAAW,KAAK;IAC/B,IAAI,CAAC,QAAQ;KACX,KAAK,MAAM,OAAO,KAAK,wDAAwD;MAC7E;MACA,SAAS,MAAM;KACjB,CAAC;KACD;IACF;IACA,IAAI,uBAAuB,MAAM,GAC/B,MAAM,KAAKrB,sBAAsB,MAAM;IAEzC,MAAM,SAAS,MAAM,KAAKS,UAAU,QAAQ;KAC1C,YAAY,KAAKZ;KACjB,oBAAoB,QAAQ,YAC1B,uCAAuC,QAAQ,SAAS,KAAKC,QAAQ,kBAAkB;KACzF,qBAAqB,IAAI,WACvB,8BAA8B,IAAI,QAAQ,KAAKA,QAAQ,kBAAkB;KAC3E,QAAQ,KAAKA;KACb,qBAAoB,iBAAgB,KAAKqC,oBAAoB,YAAY;KACzE,kBAAiB,iBAAgB;MAG/B,KAAK,MAAM,OAAO,MAAM,0DAA0D;OAChF,YAAY,MAAM;OAClB,gBAAgB,aAAa;OAC7B,UAAU,aAAa;MACzB,CAAC;KACH;KACA,mBAAkB,iBAAgB;MAChC,KAAK,MAAM,OAAO,MAAM,wDAAwD;OAC9E,YAAY,MAAM;OAClB,YAAY,aAAa,SAAS;OAClC,QAAQ,aAAa,SAAS;OAC9B,MAAM,aAAa;MACrB,CAAC;KACH;KACA,gBAAgB,cAAc,UAAU;MACtC,KAAK,MAAM,OAAO,MAAM,4DAA4D;OAClF,YAAY,MAAM;OAClB,gBAAgB,aAAa;OAC7B,YAAY,aAAa;OACzB,UAAU,aAAa;OACvB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;MAC9D,CAAC;KACH;IACF,CAAC;IACD,IAAI,OAAO,SAAS,GAClB,KAAK,MAAM,OAAO,KAAK,uEAAuE;KAC5F;KACA,YAAY,MAAM;KAClB,WAAW,OAAO;KAClB,QAAQ,OAAO;IACjB,CAAC;GAEL;GAEA,IAAI,KAAK,gBAAgB,kBAAkB,SAAS,OAAO,eAAe,KAAA,IAAY;GACtF,KAAKnB,UAAU,aAAa,OAAO,EAAE,cAAc,KAAK,WAAW;GACnE,MAAM,KAAKkB,cAAc;EAC3B;CACF;CAEA,MAAMC,oBAAoB,cAA2D;EACnF,IAAI,CAAC,mBAAmB,IAAI,aAAa,IAAI,GAAG,OAAO;EACvD,MAAM,SAAS,aAAa,SAAS;EACrC,MAAM,aAAa,aAAa,SAAS;EACzC,IAAI,CAAC,UAAU,CAAC,YAAY,OAAO;EAMnC,IAAI,KAAKrC,QAAQ,UAAU,QAAQ,MAAM,GAAG,OAAO;EACnD,IAAI,mBAAmB,QAAQ,KAAKA,QAAQ,IAAI,GAAG,OAAO;EAC1D,MAAM,mBAAmB,OAAO,YAAY;EAE5C,IADuB,sBAAsB,KAAKA,QAAQ,cACzC,CAAC,CAAC,IAAI,gBAAgB,GAAG,OAAO;EAIjD,IAAI,aAAa,SAAS,YAAY,YAAY,MAAM,SAAS,iBAAiB,SAAS,OAAO,GAChG,OAAO;EAGT,MAAM,kBAAkB,IAAI,gBAAgB;EAC5C,MAAM,UAAU,iBAAiB,gBAAgB,MAAM,GAAG,2BAA2B;EACrF,IAAI;GACF,MAAM,aAAa,MAAM,KAAKA,QAAQ,oCACpC,aAAa,SAAS,gBACtB,YACA,QACA,gBAAgB,MAClB;GACA,OAAO,eAAe,KAAA,KAAa,uBAAuB,IAAI,UAAU;EAC1E,QAAQ;GACN,OAAO;EACT,UAAU;GACR,aAAa,OAAO;EACtB;CACF;CAEA,MAAMoC,gBAA+B;EACnC,MAAM,KAAKnC,SAAS,SAAS,KAAK,eAAe,gBAAgB,KAAKiB,SAAS;CACjF;CAEA,YAAoB;EAClB,OAAO,GAAG,KAAK,KAAK,GAAG,KAAKjB,SAAS;CACvC;AACF;AAEA,SAAS,iBAAiB,QAA+B;CACvD,MAAM,cAAe,OAA2E;CAChG,IAAI,OAAO,gBAAgB,YAAY,OAAO,YAAY,KAAK,MAAM,KAAK;CAC1E,OAAO,gBAAgB,MAAM,IAAI,SAAS;AAC5C;AAEA,SAAS,kBAAkB,OAAoF;CAC7G,IAAI,CAAC,SAAS,MAAM,YAAY,KAAK,CAAC,MAAM,gBAAgB,OAAO,MAAM,iBAAiB,UACxF,OAAO;EAAE,SAAS;EAAG,cAAc,CAAC;CAAE;CAExC,OAAO;EAAE,SAAS;EAAG,cAAc,EAAE,GAAG,MAAM,aAAa;CAAE;AAC/D;AAUA,SAAS,uBAAuB,OAAqC;CACnE,KAAK,MAAM,UAAU,YAAY,MAAM,UAAU,mBAAmB,MAAM,QAAQ,WAAW,UAC3F,OAAO;CAET,IAAI,MAAM,UAAU,gBAAgB;EAClC,MAAM,SAAS,MAAM,QAAQ;EAI7B,IAAI,WAAW,YAAY,WAAW,iBAAiB,WAAW,oBAAoB,OAAO;CAC/F;CACA,IAAI,MAAM,UAAU,yBAAyB,MAAM,QAAQ,WAAW,aAAa,OAAO;CAC1F,IAAI,MAAM,UAAU,mBAAmB,MAAM,QAAQ,WAAW,WAAW,OAAO;CAGlF,IAAI,MAAM,UAAU,QAAQ,OAAO;CACnC,OAAO;AACT;AAEA,SAAS,WAAW,OAAkD;CACpE,IACE,CAAC,MAAM,MACP,CAAC,MAAM,cACP,CAAC,iBAAiB,IAAI,MAAM,KAAK,KACjC,CAAC,MAAM,WACP,OAAO,MAAM,YAAY,YACzB,MAAM,QAAQ,MAAM,OAAO,GAE3B,OAAO;CAET,OAAO;EACL,OAAO,MAAM;EACb,YAAY,MAAM;EAClB,SAAS,MAAM;CACjB;AACF;AAEA,SAAS,WAAW,OAAgB,YAA4B;CAC9D,IAAI,iBAAiB,oBAAoB,MAAM,WAAW,OAAO,MAAM,sBAAsB,MAC3F,OAAO,KAAK,IAAI,YAAY,MAAM,oBAAoB,GAAK;CAE7D,OAAO;AACT"}

package/dist/integrations/platform/github/integration.d.ts

@@ -6,12 +6,24 @@ import type { VersionControl } from '../../../capabilities/version-control.js';
 import type { IntegrationStorageHandle } from '../../../storage/domains/integrations/base.js';
 import type { SourceControlStorageHandle } from '../../../storage/domains/source-control/base.js';
 import type { FactoryIntegration, IntegrationContext, IntegrationTools } from '../../base.js';
+import { GithubAppIdentity } from '../../github/app-identity.js';
 import type { GithubIntegration, GithubRepositoryPermission, RepoSummary } from '../../github/integration.js';
 import type { ReconcileIssueState, ReconcilePullRequestState } from '../../github/rules.js';
 import type { GithubSubscriptionStorage } from '../../github/subscriptions.js';
 export declare class PlatformGithubIntegration implements FactoryIntegration {
     #private;
     readonly id = "github";
+    /**
+     * Factory's own GitHub identity. Platform credentials do not carry the login
+     * they post as, so this starts from the configured slug (usually absent on a
+     * Platform deployment) and is corrected the first time Factory writes.
+     */
+    readonly identity: GithubAppIdentity;
+    /**
+     * Extra reviewer bot logins this deployment trusts for author-gated
+     * notifications, merged over the built-in defaults.
+     */
+    readonly authorizedBots: readonly string[];
     readonly intake: Intake;
     readonly versionControl: VersionControl;
     constructor(options?: {

package/dist/integrations/platform/github/integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration.d.ts","sourceRoot":"","sources":["../../../../src/integrations/platform/github/integration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAIxD,OAAO,KAAK,EAEV,MAAM,EAIP,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAwBV,cAAc,EACf,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,KAAK,EAEV,0BAA0B,EAC3B,MAAM,iDAAiD,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,KAAK,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAK9G,OAAO,KAAK,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAM5F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAoI/E,qBAAa,yBAA0B,YAAW,kBAAkB;;IAClE,QAAQ,CAAC,EAAE,YAAY;IAiBvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAsHrB;IAEF,QAAQ,CAAC,cAAc,EAAE,cAAc,CA0HrC;gBAGA,OAAO,GAAE;QACP,sEAAsE;QACtE,IAAI,CAAC,EAAE,MAAM,CAAC;KACV;IAwBR,kEAAkE;IAClE,IAAI,IAAI,IAAI,MAAM,GAAG,SAAS,CAE7B;IAED,IAAI,OAAO,IAAI,0BAA0B,CAGxC;IAED,IAAI,oBAAoB,IAAI,0BAA0B,CAErD;IAED,IAAI,kBAAkB,IAAI,yBAAyB,CAKlD;IAuBD,UAAU,CAAC,EAAE,OAAO,EAAE,EAAE;QAAE,OAAO,EAAE,wBAAwB,CAAA;KAAE,GAAG,IAAI;IAWpE,MAAM,CAAC,GAAG,EAAE,kBAAkB,GAAG,QAAQ,EAAE;IA+K3C,OAAO,CAAC,GAAG,EAAE,kBAAkB,GAAG,YAAY,EAAE;IA0BhD;;;;OAIG;IACG,qBAAqB,CAAC,KAAK,EAAE;QACjC,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC;IAkDlD;;;;OAIG;IACG,eAAe,CAAC,KAAK,EAAE;QAC3B,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAwC5C,YAAY,CAAC,EAAE,cAAc,EAAE,EAAE;QAAE,cAAc,EAAE,cAAc,CAAA;KAAE,GAAG,gBAAgB;IAIhF,gBAAgB,CAAC,EACrB,WAAW,EACX,cAAc,GACf,EAAE,UAAU,CAAC,WAAW,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAWrF,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAuBhC,mCAAmC,CACvC,eAAe,EAAE,MAAM,EACvB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC;IAoB5C,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IA0BrE,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAa9D,cAAc,CAClB,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EAAE,GACf,OAAO,CAAC,MAAM,EAAE,CAAC;IASpB,sBAAsB,CAAC,eAAe,EAAE,MAAM,GAAG,UAAU,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;CA6WzG"}
+{"version":3,"file":"integration.d.ts","sourceRoot":"","sources":["../../../../src/integrations/platform/github/integration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAIxD,OAAO,KAAK,EAEV,MAAM,EAIP,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAwBV,cAAc,EACf,MAAM,0CAA0C,CAAC;AAElD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,KAAK,EAEV,0BAA0B,EAC3B,MAAM,iDAAiD,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAK9G,OAAO,KAAK,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAM5F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AA4I/E,qBAAa,yBAA0B,YAAW,kBAAkB;;IAClE,QAAQ,CAAC,EAAE,YAAY;IAIvB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAc3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAsHrB;IAEF,QAAQ,CAAC,cAAc,EAAE,cAAc,CA0HrC;gBAGA,OAAO,GAAE;QACP,sEAAsE;QACtE,IAAI,CAAC,EAAE,MAAM,CAAC;KACV;IAkCR,kEAAkE;IAClE,IAAI,IAAI,IAAI,MAAM,GAAG,SAAS,CAE7B;IAED,IAAI,OAAO,IAAI,0BAA0B,CAGxC;IAED,IAAI,oBAAoB,IAAI,0BAA0B,CAErD;IAED,IAAI,kBAAkB,IAAI,yBAAyB,CAKlD;IAuBD,UAAU,CAAC,EAAE,OAAO,EAAE,EAAE;QAAE,OAAO,EAAE,wBAAwB,CAAA;KAAE,GAAG,IAAI;IAWpE,MAAM,CAAC,GAAG,EAAE,kBAAkB,GAAG,QAAQ,EAAE;IA+K3C,OAAO,CAAC,GAAG,EAAE,kBAAkB,GAAG,YAAY,EAAE;IAuChD;;;;OAIG;IACG,qBAAqB,CAAC,KAAK,EAAE;QACjC,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC;IAkDlD;;;;OAIG;IACG,eAAe,CAAC,KAAK,EAAE;QAC3B,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAwC5C,YAAY,CAAC,EAAE,cAAc,EAAE,EAAE;QAAE,cAAc,EAAE,cAAc,CAAA;KAAE,GAAG,gBAAgB;IAIhF,gBAAgB,CAAC,EACrB,WAAW,EACX,cAAc,GACf,EAAE,UAAU,CAAC,WAAW,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAWrF,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAuBhC,mCAAmC,CACvC,eAAe,EAAE,MAAM,EACvB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC;IAoB5C,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IA0BrE,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAa9D,cAAc,CAClB,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EAAE,GACf,OAAO,CAAC,MAAM,EAAE,CAAC;IASpB,sBAAsB,CAAC,eAAe,EAAE,MAAM,GAAG,UAAU,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;CAyXzG"}