@mastra/factory 0.8.0-alpha.9 → 0.8.0

package/dist/integrations/github/webhook.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook.js","names":[],"sources":["../../../src/integrations/github/webhook.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from 'node:crypto';\nimport type { MountedMastraCode } from '@mastra/code-sdk';\nimport type { NotificationPriority } from '@mastra/core/notifications';\nimport { RequestContext } from '@mastra/core/request-context';\nimport type { Context } from 'hono';\nimport type { GithubIntegration, GithubRepositoryPermission } from './integration.js';\nimport { listPullRequestSubscriptionsForWebhook, retirePullRequestSubscription } from './subscriptions.js';\nimport type {\n  GithubSignalSubscriptionRow,\n  GithubSubscriptionStorage,\n  GithubWebhookPullRequestTarget,\n} from './subscriptions.js';\n\nexport interface GithubWebhookHandlerOptions {\n  /** Integration providing webhook-secret verification + collaborator permission checks. */\n  github: GithubIntegration;\n  ingestFactoryEvent?: (event: ParsedGithubWebhook) => Promise<unknown>;\n}\n\nconst SUPPORTED_GITHUB_WEBHOOK_EVENTS = new Set([\n  'issues',\n  'issue_comment',\n  'pull_request',\n  'pull_request_review',\n  'pull_request_review_comment',\n]);\n\nexport interface GithubWebhookMetadata {\n  event: string;\n  action?: string;\n  deliveryId: string;\n  repository?: string;\n  repositoryId?: number;\n  issueNumber?: number;\n  pullRequestNumber?: number;\n  sender?: string;\n  senderType?: string;\n  installationId?: number;\n}\n\nexport interface ParsedGithubWebhook {\n  event: string;\n  deliveryId: string;\n  payload: Record<string, unknown>;\n}\n\nexport type GithubWebhookResult =\n  | { status: 202; body: { ok: true; ignored?: true } }\n  | { status: 400; body: { error: 'bad_request'; message: string } }\n  | { status: 401; body: { error: 'unauthorized'; message: string } };\n\nexport interface GithubWebhookNotification {\n  action: string;\n  kind: string;\n  priority: NotificationPriority;\n  summary: string;\n  terminal: boolean;\n  metadata: GithubWebhookMetadata & { pullRequestNumber: number; repositoryId: number; installationId: number };\n  payload: Record<string, unknown>;\n}\n\n/** The Factory session row fields a woken session has to run as. */\nexport type FactorySessionOwner = { userId: string; orgId: string };\n\n/**\n * The integration surface this dispatch uses. Narrow on purpose: the GitHub App\n * integration and the platform-backed one are unrelated classes, and only this\n * much is common to both.\n */\nexport interface GithubWebhookDispatchIntegration {\n  readonly integrationStorage: GithubSubscriptionStorage;\n  /**\n   * Extra bot logins this deployment authorizes to trigger author-gated\n   * notifications, merged over `DEFAULT_AUTHORIZED_BOTS`.\n   */\n  readonly authorizedBots?: readonly string[];\n  readonly sourceControlStorage: {\n    sessions: { getBySessionId(sessionId: string): Promise<FactorySessionOwner | null> };\n  };\n  getRepositoryCollaboratorPermission(\n    installationId: number,\n    repoFullName: string,\n    username: string,\n    signal?: AbortSignal,\n  ): Promise<GithubRepositoryPermission | undefined>;\n}\n\nexport interface GithubWebhookDispatchDependencies {\n  controller: MountedMastraCode['controller'];\n  /**\n   * Integration used by the default sender-authorization check (collaborator\n   * permission lookup) and to resolve the owner of a session being recreated.\n   * Author-gated notifications fail closed when neither this nor an\n   * `isAuthorizedSender` override is supplied.\n   */\n  github?: GithubWebhookDispatchIntegration;\n  listSubscriptions?: (\n    target: GithubWebhookPullRequestTarget,\n    options?: { includeTerminal?: boolean },\n  ) => Promise<GithubSignalSubscriptionRow[]>;\n  retireSubscription?: (id: string, status: 'open' | 'closed' | 'merged') => Promise<void>;\n  isAuthorizedSender?: (notification: GithubWebhookNotification) => Promise<boolean>;\n  /** Called when the sender gate drops a notification, so the drop is observable. */\n  onSenderRejected?: (notification: GithubWebhookNotification) => void;\n  onTargetError?: (subscription: GithubSignalSubscriptionRow, error: unknown) => void;\n}\n\nfunction normalizeHeader(value: string | undefined | null): string | null {\n  if (!value) return null;\n  const trimmed = value.trim();\n  return trimmed.length > 0 ? trimmed : null;\n}\n\nfunction verifySignature(rawBody: string, signature: string, secret: string): boolean {\n  if (!signature.startsWith('sha256=')) return false;\n  const signatureHex = signature.slice('sha256='.length);\n  if (!/^[a-fA-F0-9]{64}$/.test(signatureHex)) return false;\n\n  const expectedHex = createHmac('sha256', secret).update(rawBody).digest('hex');\n  const received = Buffer.from(signatureHex, 'hex');\n  const expected = Buffer.from(expectedHex, 'hex');\n  return received.length === expected.length && timingSafeEqual(received, expected);\n}\n\nasync function parseGithubWebhook(\n  c: Context,\n  secret: string | undefined,\n): Promise<ParsedGithubWebhook | GithubWebhookResult> {\n  if (!secret) {\n    return { status: 401, body: { error: 'unauthorized', message: 'GitHub webhook secret is not configured' } };\n  }\n\n  const event = normalizeHeader(c.req.header('x-github-event'));\n  const deliveryId = normalizeHeader(c.req.header('x-github-delivery'));\n  const signature = normalizeHeader(c.req.header('x-hub-signature-256'));\n\n  if (!event) return { status: 400, body: { error: 'bad_request', message: 'Missing x-github-event header' } };\n  if (!deliveryId) return { status: 400, body: { error: 'bad_request', message: 'Missing x-github-delivery header' } };\n  if (!signature)\n    return { status: 401, body: { error: 'unauthorized', message: 'Missing x-hub-signature-256 header' } };\n\n  const rawBody = await c.req.text();\n  if (!verifySignature(rawBody, signature, secret)) {\n    return { status: 401, body: { error: 'unauthorized', message: 'Invalid GitHub webhook signature' } };\n  }\n\n  let payload: unknown;\n  try {\n    payload = JSON.parse(rawBody);\n  } catch {\n    return { status: 400, body: { error: 'bad_request', message: 'Malformed JSON payload' } };\n  }\n\n  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {\n    return { status: 400, body: { error: 'bad_request', message: 'Payload must be a JSON object' } };\n  }\n\n  return { event, deliveryId, payload: payload as Record<string, unknown> };\n}\n\nfunction getObject(value: unknown): Record<string, unknown> | undefined {\n  return value && typeof value === 'object' && !Array.isArray(value) ? (value as Record<string, unknown>) : undefined;\n}\n\nfunction getString(value: unknown): string | undefined {\n  return typeof value === 'string' && value.length > 0 ? value : undefined;\n}\n\nfunction getNumber(value: unknown): number | undefined {\n  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;\n}\n\nfunction getBoolean(value: unknown): boolean | undefined {\n  return typeof value === 'boolean' ? value : undefined;\n}\n\nexport function normalizeGithubWebhookMetadata(parsed: ParsedGithubWebhook): GithubWebhookMetadata {\n  const { event, deliveryId, payload } = parsed;\n  const repository = getObject(payload.repository);\n  const issue = getObject(payload.issue);\n  const pullRequest = getObject(payload.pull_request);\n  const sender = getObject(payload.sender);\n  const installation = getObject(payload.installation);\n  const issuePullRequest = getObject(issue?.pull_request);\n\n  return {\n    event,\n    action: getString(payload.action),\n    deliveryId,\n    repository: getString(repository?.full_name),\n    repositoryId: getNumber(repository?.id),\n    issueNumber: getNumber(issue?.number),\n    pullRequestNumber:\n      getNumber(pullRequest?.number) ??\n      (event === 'issue_comment' && issuePullRequest ? getNumber(issue?.number) : undefined),\n    sender: getString(sender?.login),\n    senderType: getString(sender?.type),\n    installationId: getNumber(installation?.id),\n  };\n}\n\nfunction notificationSummary(metadata: GithubWebhookMetadata, label: string): string {\n  const actor = metadata.sender ? `${metadata.sender} ` : '';\n  return `${actor}${label} on ${metadata.repository}#${metadata.pullRequestNumber}`;\n}\n\nfunction notificationTargetUrl(event: string, payload: Record<string, unknown>): string | undefined {\n  if (event === 'issue_comment' || event === 'pull_request_review_comment') {\n    return getString(getObject(payload.comment)?.html_url);\n  }\n  if (event === 'pull_request_review') {\n    return getString(getObject(payload.review)?.html_url);\n  }\n  return getString(getObject(payload.pull_request)?.html_url);\n}\n\nexport function classifyGithubWebhook(parsed: ParsedGithubWebhook): GithubWebhookNotification | undefined {\n  const metadata = normalizeGithubWebhookMetadata(parsed);\n  const { event, payload } = parsed;\n  const action = metadata.action;\n  if (\n    !action ||\n    !metadata.repositoryId ||\n    !metadata.installationId ||\n    !metadata.pullRequestNumber ||\n    !metadata.repository\n  ) {\n    return undefined;\n  }\n\n  let priority: NotificationPriority;\n  let kind: string;\n  let label: string;\n  let terminal = false;\n\n  if (event === 'pull_request_review' && action === 'submitted') {\n    const state = getString(getObject(payload.review)?.state)?.toLowerCase().replaceAll('_', '-');\n    priority = state === 'approved' || state === 'changes-requested' ? 'urgent' : 'high';\n    kind =\n      state === 'approved'\n        ? 'review-approved'\n        : state === 'changes-requested'\n          ? 'review-changes-requested'\n          : 'review-submitted';\n    label =\n      state === 'approved'\n        ? 'approved the pull request'\n        : state === 'changes-requested'\n          ? 'requested changes'\n          : 'submitted a review';\n  } else if (event === 'pull_request' && action === 'closed') {\n    const merged = getBoolean(getObject(payload.pull_request)?.merged) === true;\n    priority = 'urgent';\n    kind = merged ? 'pull-request-merged' : 'pull-request-closed';\n    label = merged ? 'merged the pull request' : 'closed the pull request';\n    terminal = true;\n  } else if (event === 'issue_comment' && action === 'created') {\n    priority = 'high';\n    kind = 'issue-comment-created';\n    label = 'commented';\n  } else if (event === 'pull_request_review_comment' && action === 'created') {\n    priority = 'high';\n    kind = 'review-comment-created';\n    label = 'left a review comment';\n  } else if (event === 'pull_request' && action === 'reopened') {\n    priority = 'high';\n    kind = 'pull-request-reopened';\n    label = 'reopened the pull request';\n  } else if (event === 'pull_request_review' && action === 'dismissed') {\n    priority = 'high';\n    kind = 'review-dismissed';\n    label = 'dismissed a review';\n  } else if (\n    event === 'pull_request' &&\n    [\n      'synchronize',\n      'ready_for_review',\n      'converted_to_draft',\n      'assigned',\n      'unassigned',\n      'review_requested',\n      'review_request_removed',\n    ].includes(action)\n  ) {\n    priority = 'medium';\n    kind = `pull-request-${action.replaceAll('_', '-')}`;\n    label = action.replaceAll('_', ' ');\n  } else if (\n    event === 'pull_request' &&\n    ['edited', 'labeled', 'unlabeled', 'milestoned', 'demilestoned'].includes(action)\n  ) {\n    priority = 'low';\n    kind = `pull-request-${action.replaceAll('_', '-')}`;\n    label = action.replaceAll('_', ' ');\n  } else {\n    return undefined;\n  }\n\n  return {\n    action,\n    kind,\n    priority,\n    summary: notificationSummary(metadata, label),\n    terminal,\n    metadata: {\n      ...metadata,\n      pullRequestNumber: metadata.pullRequestNumber,\n      repositoryId: metadata.repositoryId,\n      installationId: metadata.installationId,\n    },\n    payload,\n  };\n}\n\nasync function resolveSubscriptionSession(\n  controller: MountedMastraCode['controller'],\n  subscription: GithubSignalSubscriptionRow,\n  github?: GithubWebhookDispatchIntegration,\n) {\n  const { sessionId, resourceId, threadId } = subscription;\n  if (!sessionId || !resourceId || !threadId) {\n    throw new Error(`GitHub subscription ${subscription.id} is missing its session binding.`);\n  }\n  const scope = subscription.sessionScope || undefined;\n  let session = await controller.getSessionByResource(resourceId, scope);\n  if (!session) {\n    const tags = {\n      factoryProjectId: resourceId,\n      projectRepositoryId: subscription.data.projectRepositoryId,\n      ...(scope ? { worktreePath: scope } : {}),\n    };\n    // Creating the session resolves its workspace, which authorizes the caller\n    // against the Factory session row — no signed-in user, so run as its owner.\n    // The controller resource is the Factory project for scoped sessions; the\n    // persisted Factory session is keyed by the subscription's session ID.\n    const sessionRow = await github?.sourceControlStorage.sessions.getBySessionId(sessionId);\n    if (!sessionRow) {\n      throw new Error(`GitHub subscription ${subscription.id} has no Factory session ${sessionId} to run as.`);\n    }\n    const requestContext = new RequestContext();\n    requestContext.set('user', { workosId: sessionRow.userId, organizationId: sessionRow.orgId });\n    session = await controller.createSession({\n      id: sessionId,\n      ownerId: sessionRow.userId,\n      resourceId,\n      scope,\n      tags,\n      requestContext,\n    });\n  }\n  if (session.thread.getId() !== threadId) {\n    await session.thread.switch({ threadId, emitEvent: false });\n  }\n  if (session.thread.getId() !== threadId) {\n    throw new Error(`Session ${sessionId} did not bind thread ${threadId}.`);\n  }\n  return session;\n}\n\n/**\n * Reviewer bots authorized out of the box. Deployments extend — never replace —\n * this set through the integration's `authorizedBots`.\n */\nexport const DEFAULT_AUTHORIZED_BOTS: readonly string[] = ['coderabbitai[bot]', 'devin-ai-integration[bot]'];\n\n/**\n * Parse a comma-separated `MASTRACODE_GITHUB_AUTHORIZED_BOTS` value into extra\n * bot logins. Returns undefined when nothing usable was configured.\n */\nexport function parseAuthorizedBotsEnv(value: string | undefined): string[] | undefined {\n  const bots = (value ?? '')\n    .split(',')\n    .map(bot => bot.trim())\n    .filter(Boolean);\n  return bots.length > 0 ? bots : undefined;\n}\n\n/** Lowercased union of the default bot logins and any the deployment opted in. */\nexport function resolveAuthorizedBots(extra?: readonly string[]): Set<string> {\n  const bots = new Set(DEFAULT_AUTHORIZED_BOTS);\n  for (const bot of extra ?? []) {\n    const normalized = bot.trim().toLowerCase();\n    if (normalized) bots.add(normalized);\n  }\n  return bots;\n}\n\nconst AUTHORIZED_PERMISSIONS = new Set(['admin', 'maintain', 'write']);\nconst PERMISSION_CHECK_TIMEOUT_MS = 5_000;\nconst AUTHOR_GATED_KINDS = new Set([\n  'issue-comment-created',\n  'review-comment-created',\n  'review-submitted',\n  'review-approved',\n  'review-changes-requested',\n  'review-dismissed',\n]);\n\nasync function isAuthorizedGithubSender(\n  notification: GithubWebhookNotification,\n  github: Pick<GithubWebhookDispatchIntegration, 'getRepositoryCollaboratorPermission' | 'authorizedBots'> | undefined,\n): Promise<boolean> {\n  if (!AUTHOR_GATED_KINDS.has(notification.kind)) return true;\n  const sender = notification.metadata.sender;\n  const repository = notification.metadata.repository;\n  if (!sender || !repository) return false;\n  const normalizedSender = sender.toLowerCase();\n  if (notification.metadata.senderType?.toLowerCase() === 'bot' || normalizedSender.endsWith('[bot]')) {\n    return resolveAuthorizedBots(github?.authorizedBots).has(normalizedSender);\n  }\n  if (!github) return false;\n  const abortController = new AbortController();\n  let timeout: ReturnType<typeof setTimeout> | undefined;\n  try {\n    const permission = await Promise.race([\n      github.getRepositoryCollaboratorPermission(\n        notification.metadata.installationId,\n        repository,\n        sender,\n        abortController.signal,\n      ),\n      new Promise<undefined>(resolve => {\n        timeout = setTimeout(() => {\n          abortController.abort();\n          resolve(undefined);\n        }, PERMISSION_CHECK_TIMEOUT_MS);\n      }),\n    ]);\n    return permission !== undefined && AUTHORIZED_PERMISSIONS.has(permission);\n  } catch {\n    return false;\n  } finally {\n    if (timeout) clearTimeout(timeout);\n  }\n}\n\nexport async function dispatchGithubWebhook(\n  parsed: ParsedGithubWebhook,\n  dependencies: GithubWebhookDispatchDependencies,\n): Promise<{ delivered: number; failed: number; ignored: boolean }> {\n  const notification = classifyGithubWebhook(parsed);\n  if (!notification) return { delivered: 0, failed: 0, ignored: true };\n  const isAuthorizedSender =\n    dependencies.isAuthorizedSender ??\n    ((n: GithubWebhookNotification) => isAuthorizedGithubSender(n, dependencies.github));\n  if (!(await isAuthorizedSender(notification))) {\n    dependencies.onSenderRejected?.(notification);\n    return { delivered: 0, failed: 0, ignored: true };\n  }\n\n  const target = {\n    installationExternalId: notification.metadata.installationId.toString(),\n    repositoryExternalId: notification.metadata.repositoryId.toString(),\n    changeRequestId: notification.metadata.pullRequestNumber.toString(),\n  };\n  const listSubscriptions =\n    dependencies.listSubscriptions ??\n    ((subscriptionTarget: GithubWebhookPullRequestTarget, options?: { includeTerminal?: boolean }) => {\n      if (!dependencies.github) throw new Error('GitHub integration is required to load webhook subscriptions.');\n      return listPullRequestSubscriptionsForWebhook(\n        subscriptionTarget,\n        options,\n        dependencies.github.integrationStorage,\n      );\n    });\n  const retireSubscription =\n    dependencies.retireSubscription ??\n    ((id: string, status: 'open' | 'closed' | 'merged') => {\n      if (!dependencies.github) throw new Error('GitHub integration is required to retire webhook subscriptions.');\n      return retirePullRequestSubscription(id, status, dependencies.github.integrationStorage);\n    });\n  const subscriptions = await listSubscriptions(target, { includeTerminal: notification.action === 'reopened' });\n  let delivered = 0;\n  let failed = 0;\n\n  for (const subscription of subscriptions) {\n    try {\n      const session = await resolveSubscriptionSession(dependencies.controller, subscription, dependencies.github);\n      const result = await session.sendNotificationSignal({\n        source: 'github',\n        kind: notification.kind,\n        summary: notification.summary,\n        priority: notification.priority,\n        payload: notification.payload,\n        sourceId: parsed.deliveryId,\n        dedupeKey: `${parsed.deliveryId}:${subscription.sessionId}:${subscription.threadId}`,\n        coalesceKey: `github:${subscription.data.repositoryExternalId}:pull-request:${subscription.data.changeRequestId}`,\n        metadata: {\n          event: notification.metadata.event,\n          action: notification.action,\n          repository: notification.metadata.repository,\n          issueNumber: notification.metadata.issueNumber,\n          pullRequestNumber: notification.metadata.pullRequestNumber,\n          targetUrl: notificationTargetUrl(parsed.event, parsed.payload),\n          deliveryId: parsed.deliveryId,\n        },\n      });\n      await Promise.all([result.persisted, result.accepted].filter(Boolean));\n      if (notification.terminal) {\n        await retireSubscription(subscription.id, notification.kind === 'pull-request-merged' ? 'merged' : 'closed');\n      } else if (notification.action === 'reopened') {\n        await retireSubscription(subscription.id, 'open');\n      }\n      delivered += 1;\n    } catch (error) {\n      failed += 1;\n      dependencies.onTargetError?.(subscription, error);\n    }\n  }\n\n  return { delivered, failed, ignored: false };\n}\n\nexport async function handleGithubWebhook(\n  c: Context,\n  options: GithubWebhookHandlerOptions & Partial<Omit<GithubWebhookDispatchDependencies, 'github'>>,\n): Promise<GithubWebhookResult> {\n  const parsed = await parseGithubWebhook(c, options.github.webhookSecret);\n  if ('status' in parsed) return parsed;\n\n  if (!SUPPORTED_GITHUB_WEBHOOK_EVENTS.has(parsed.event)) {\n    return { status: 202, body: { ok: true, ignored: true } };\n  }\n\n  const metadata = normalizeGithubWebhookMetadata(parsed);\n  console.info('[GitHub Webhook]', metadata);\n\n  if (options.ingestFactoryEvent) {\n    await options.ingestFactoryEvent(parsed);\n  }\n\n  if (!options.controller) {\n    return { status: 202, body: { ok: true } };\n  }\n\n  const result = await dispatchGithubWebhook(parsed, {\n    onSenderRejected: notification => {\n      console.info('[GitHub Webhook] sender not authorized', {\n        deliveryId: parsed.deliveryId,\n        repository: notification.metadata.repository,\n        sender: notification.metadata.sender,\n        kind: notification.kind,\n      });\n    },\n    ...(options as GithubWebhookDispatchDependencies),\n  });\n  if (result.failed > 0) {\n    console.warn(`[GitHub Webhook] ${result.failed} subscribed target(s) failed for delivery ${parsed.deliveryId}.`);\n  }\n  return { status: 202, body: { ok: true, ...(result.ignored ? { ignored: true as const } : {}) } };\n}\n"],"mappings":";;;;AAmBA,MAAM,kDAAkC,IAAI,IAAI;CAC9C;CACA;CACA;CACA;CACA;AACF,CAAC;AAkFD,SAAS,gBAAgB,OAAiD;CACxE,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,UAAU,MAAM,KAAK;CAC3B,OAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,gBAAgB,SAAiB,WAAmB,QAAyB;CACpF,IAAI,CAAC,UAAU,WAAW,SAAS,GAAG,OAAO;CAC7C,MAAM,eAAe,UAAU,MAAM,CAAgB;CACrD,IAAI,CAAC,oBAAoB,KAAK,YAAY,GAAG,OAAO;CAEpD,MAAM,cAAc,WAAW,UAAU,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK;CAC7E,MAAM,WAAW,OAAO,KAAK,cAAc,KAAK;CAChD,MAAM,WAAW,OAAO,KAAK,aAAa,KAAK;CAC/C,OAAO,SAAS,WAAW,SAAS,UAAU,gBAAgB,UAAU,QAAQ;AAClF;AAEA,eAAe,mBACb,GACA,QACoD;CACpD,IAAI,CAAC,QACH,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,OAAO;GAAgB,SAAS;EAA0C;CAAE;CAG5G,MAAM,QAAQ,gBAAgB,EAAE,IAAI,OAAO,gBAAgB,CAAC;CAC5D,MAAM,aAAa,gBAAgB,EAAE,IAAI,OAAO,mBAAmB,CAAC;CACpE,MAAM,YAAY,gBAAgB,EAAE,IAAI,OAAO,qBAAqB,CAAC;CAErE,IAAI,CAAC,OAAO,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,OAAO;GAAe,SAAS;EAAgC;CAAE;CAC3G,IAAI,CAAC,YAAY,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,OAAO;GAAe,SAAS;EAAmC;CAAE;CACnH,IAAI,CAAC,WACH,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,OAAO;GAAgB,SAAS;EAAqC;CAAE;CAEvG,MAAM,UAAU,MAAM,EAAE,IAAI,KAAK;CACjC,IAAI,CAAC,gBAAgB,SAAS,WAAW,MAAM,GAC7C,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,OAAO;GAAgB,SAAS;EAAmC;CAAE;CAGrG,IAAI;CACJ,IAAI;EACF,UAAU,KAAK,MAAM,OAAO;CAC9B,QAAQ;EACN,OAAO;GAAE,QAAQ;GAAK,MAAM;IAAE,OAAO;IAAe,SAAS;GAAyB;EAAE;CAC1F;CAEA,IAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAClE,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,OAAO;GAAe,SAAS;EAAgC;CAAE;CAGjG,OAAO;EAAE;EAAO;EAAqB;CAAmC;AAC1E;AAEA,SAAS,UAAU,OAAqD;CACtE,OAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAK,QAAoC,KAAA;AAC5G;AAEA,SAAS,UAAU,OAAoC;CACrD,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ,KAAA;AACjE;AAEA,SAAS,UAAU,OAAoC;CACrD,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,QAAQ,KAAA;AACvE;AAEA,SAAS,WAAW,OAAqC;CACvD,OAAO,OAAO,UAAU,YAAY,QAAQ,KAAA;AAC9C;AAEA,SAAgB,+BAA+B,QAAoD;CACjG,MAAM,EAAE,OAAO,YAAY,YAAY;CACvC,MAAM,aAAa,UAAU,QAAQ,UAAU;CAC/C,MAAM,QAAQ,UAAU,QAAQ,KAAK;CACrC,MAAM,cAAc,UAAU,QAAQ,YAAY;CAClD,MAAM,SAAS,UAAU,QAAQ,MAAM;CACvC,MAAM,eAAe,UAAU,QAAQ,YAAY;CACnD,MAAM,mBAAmB,UAAU,OAAO,YAAY;CAEtD,OAAO;EACL;EACA,QAAQ,UAAU,QAAQ,MAAM;EAChC;EACA,YAAY,UAAU,YAAY,SAAS;EAC3C,cAAc,UAAU,YAAY,EAAE;EACtC,aAAa,UAAU,OAAO,MAAM;EACpC,mBACE,UAAU,aAAa,MAAM,MAC5B,UAAU,mBAAmB,mBAAmB,UAAU,OAAO,MAAM,IAAI,KAAA;EAC9E,QAAQ,UAAU,QAAQ,KAAK;EAC/B,YAAY,UAAU,QAAQ,IAAI;EAClC,gBAAgB,UAAU,cAAc,EAAE;CAC5C;AACF;AAEA,SAAS,oBAAoB,UAAiC,OAAuB;CAEnF,OAAO,GADO,SAAS,SAAS,GAAG,SAAS,OAAO,KAAK,KACtC,MAAM,MAAM,SAAS,WAAW,GAAG,SAAS;AAChE;AAEA,SAAS,sBAAsB,OAAe,SAAsD;CAClG,IAAI,UAAU,mBAAmB,UAAU,+BACzC,OAAO,UAAU,UAAU,QAAQ,OAAO,CAAC,EAAE,QAAQ;CAEvD,IAAI,UAAU,uBACZ,OAAO,UAAU,UAAU,QAAQ,MAAM,CAAC,EAAE,QAAQ;CAEtD,OAAO,UAAU,UAAU,QAAQ,YAAY,CAAC,EAAE,QAAQ;AAC5D;AAEA,SAAgB,sBAAsB,QAAoE;CACxG,MAAM,WAAW,+BAA+B,MAAM;CACtD,MAAM,EAAE,OAAO,YAAY;CAC3B,MAAM,SAAS,SAAS;CACxB,IACE,CAAC,UACD,CAAC,SAAS,gBACV,CAAC,SAAS,kBACV,CAAC,SAAS,qBACV,CAAC,SAAS,YAEV;CAGF,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI,WAAW;CAEf,IAAI,UAAU,yBAAyB,WAAW,aAAa;EAC7D,MAAM,QAAQ,UAAU,UAAU,QAAQ,MAAM,CAAC,EAAE,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC,WAAW,KAAK,GAAG;EAC5F,WAAW,UAAU,cAAc,UAAU,sBAAsB,WAAW;EAC9E,OACE,UAAU,aACN,oBACA,UAAU,sBACR,6BACA;EACR,QACE,UAAU,aACN,8BACA,UAAU,sBACR,sBACA;CACV,OAAO,IAAI,UAAU,kBAAkB,WAAW,UAAU;EAC1D,MAAM,SAAS,WAAW,UAAU,QAAQ,YAAY,CAAC,EAAE,MAAM,MAAM;EACvE,WAAW;EACX,OAAO,SAAS,wBAAwB;EACxC,QAAQ,SAAS,4BAA4B;EAC7C,WAAW;CACb,OAAO,IAAI,UAAU,mBAAmB,WAAW,WAAW;EAC5D,WAAW;EACX,OAAO;EACP,QAAQ;CACV,OAAO,IAAI,UAAU,iCAAiC,WAAW,WAAW;EAC1E,WAAW;EACX,OAAO;EACP,QAAQ;CACV,OAAO,IAAI,UAAU,kBAAkB,WAAW,YAAY;EAC5D,WAAW;EACX,OAAO;EACP,QAAQ;CACV,OAAO,IAAI,UAAU,yBAAyB,WAAW,aAAa;EACpE,WAAW;EACX,OAAO;EACP,QAAQ;CACV,OAAO,IACL,UAAU,kBACV;EACE;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,SAAS,MAAM,GACjB;EACA,WAAW;EACX,OAAO,gBAAgB,OAAO,WAAW,KAAK,GAAG;EACjD,QAAQ,OAAO,WAAW,KAAK,GAAG;CACpC,OAAO,IACL,UAAU,kBACV;EAAC;EAAU;EAAW;EAAa;EAAc;CAAc,CAAC,CAAC,SAAS,MAAM,GAChF;EACA,WAAW;EACX,OAAO,gBAAgB,OAAO,WAAW,KAAK,GAAG;EACjD,QAAQ,OAAO,WAAW,KAAK,GAAG;CACpC,OACE;CAGF,OAAO;EACL;EACA;EACA;EACA,SAAS,oBAAoB,UAAU,KAAK;EAC5C;EACA,UAAU;GACR,GAAG;GACH,mBAAmB,SAAS;GAC5B,cAAc,SAAS;GACvB,gBAAgB,SAAS;EAC3B;EACA;CACF;AACF;AAEA,eAAe,2BACb,YACA,cACA,QACA;CACA,MAAM,EAAE,WAAW,YAAY,aAAa;CAC5C,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,UAChC,MAAM,IAAI,MAAM,uBAAuB,aAAa,GAAG,iCAAiC;CAE1F,MAAM,QAAQ,aAAa,gBAAgB,KAAA;CAC3C,IAAI,UAAU,MAAM,WAAW,qBAAqB,YAAY,KAAK;CACrE,IAAI,CAAC,SAAS;EACZ,MAAM,OAAO;GACX,kBAAkB;GAClB,qBAAqB,aAAa,KAAK;GACvC,GAAI,QAAQ,EAAE,cAAc,MAAM,IAAI,CAAC;EACzC;EAKA,MAAM,aAAa,MAAM,QAAQ,qBAAqB,SAAS,eAAe,SAAS;EACvF,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,uBAAuB,aAAa,GAAG,0BAA0B,UAAU,YAAY;EAEzG,MAAM,iBAAiB,IAAI,eAAe;EAC1C,eAAe,IAAI,QAAQ;GAAE,UAAU,WAAW;GAAQ,gBAAgB,WAAW;EAAM,CAAC;EAC5F,UAAU,MAAM,WAAW,cAAc;GACvC,IAAI;GACJ,SAAS,WAAW;GACpB;GACA;GACA;GACA;EACF,CAAC;CACH;CACA,IAAI,QAAQ,OAAO,MAAM,MAAM,UAC7B,MAAM,QAAQ,OAAO,OAAO;EAAE;EAAU,WAAW;CAAM,CAAC;CAE5D,IAAI,QAAQ,OAAO,MAAM,MAAM,UAC7B,MAAM,IAAI,MAAM,WAAW,UAAU,uBAAuB,SAAS,EAAE;CAEzE,OAAO;AACT;;;;;AAMA,MAAa,0BAA6C,CAAC,qBAAqB,2BAA2B;;;;;AAM3G,SAAgB,uBAAuB,OAAiD;CACtF,MAAM,QAAQ,SAAS,GAAA,CACpB,MAAM,GAAG,CAAC,CACV,KAAI,QAAO,IAAI,KAAK,CAAC,CAAC,CACtB,OAAO,OAAO;CACjB,OAAO,KAAK,SAAS,IAAI,OAAO,KAAA;AAClC;;AAGA,SAAgB,sBAAsB,OAAwC;CAC5E,MAAM,OAAO,IAAI,IAAI,uBAAuB;CAC5C,KAAK,MAAM,OAAO,SAAS,CAAC,GAAG;EAC7B,MAAM,aAAa,IAAI,KAAK,CAAC,CAAC,YAAY;EAC1C,IAAI,YAAY,KAAK,IAAI,UAAU;CACrC;CACA,OAAO;AACT;AAEA,MAAM,yCAAyB,IAAI,IAAI;CAAC;CAAS;CAAY;AAAO,CAAC;AACrE,MAAM,8BAA8B;AACpC,MAAM,qCAAqB,IAAI,IAAI;CACjC;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,eAAe,yBACb,cACA,QACkB;CAClB,IAAI,CAAC,mBAAmB,IAAI,aAAa,IAAI,GAAG,OAAO;CACvD,MAAM,SAAS,aAAa,SAAS;CACrC,MAAM,aAAa,aAAa,SAAS;CACzC,IAAI,CAAC,UAAU,CAAC,YAAY,OAAO;CACnC,MAAM,mBAAmB,OAAO,YAAY;CAC5C,IAAI,aAAa,SAAS,YAAY,YAAY,MAAM,SAAS,iBAAiB,SAAS,OAAO,GAChG,OAAO,sBAAsB,QAAQ,cAAc,CAAC,CAAC,IAAI,gBAAgB;CAE3E,IAAI,CAAC,QAAQ,OAAO;CACpB,MAAM,kBAAkB,IAAI,gBAAgB;CAC5C,IAAI;CACJ,IAAI;EACF,MAAM,aAAa,MAAM,QAAQ,KAAK,CACpC,OAAO,oCACL,aAAa,SAAS,gBACtB,YACA,QACA,gBAAgB,MAClB,GACA,IAAI,SAAmB,YAAW;GAChC,UAAU,iBAAiB;IACzB,gBAAgB,MAAM;IACtB,QAAQ,KAAA,CAAS;GACnB,GAAG,2BAA2B;EAChC,CAAC,CACH,CAAC;EACD,OAAO,eAAe,KAAA,KAAa,uBAAuB,IAAI,UAAU;CAC1E,QAAQ;EACN,OAAO;CACT,UAAU;EACR,IAAI,SAAS,aAAa,OAAO;CACnC;AACF;AAEA,eAAsB,sBACpB,QACA,cACkE;CAClE,MAAM,eAAe,sBAAsB,MAAM;CACjD,IAAI,CAAC,cAAc,OAAO;EAAE,WAAW;EAAG,QAAQ;EAAG,SAAS;CAAK;CAInE,IAAI,CAAE,OAFJ,aAAa,wBACX,MAAiC,yBAAyB,GAAG,aAAa,MAAM,GAAA,CACrD,YAAY,GAAI;EAC7C,aAAa,mBAAmB,YAAY;EAC5C,OAAO;GAAE,WAAW;GAAG,QAAQ;GAAG,SAAS;EAAK;CAClD;CAEA,MAAM,SAAS;EACb,wBAAwB,aAAa,SAAS,eAAe,SAAS;EACtE,sBAAsB,aAAa,SAAS,aAAa,SAAS;EAClE,iBAAiB,aAAa,SAAS,kBAAkB,SAAS;CACpE;CACA,MAAM,oBACJ,aAAa,uBACX,oBAAoD,YAA4C;EAChG,IAAI,CAAC,aAAa,QAAQ,MAAM,IAAI,MAAM,+DAA+D;EACzG,OAAO,uCACL,oBACA,SACA,aAAa,OAAO,kBACtB;CACF;CACF,MAAM,qBACJ,aAAa,wBACX,IAAY,WAAyC;EACrD,IAAI,CAAC,aAAa,QAAQ,MAAM,IAAI,MAAM,iEAAiE;EAC3G,OAAO,8BAA8B,IAAI,QAAQ,aAAa,OAAO,kBAAkB;CACzF;CACF,MAAM,gBAAgB,MAAM,kBAAkB,QAAQ,EAAE,iBAAiB,aAAa,WAAW,WAAW,CAAC;CAC7G,IAAI,YAAY;CAChB,IAAI,SAAS;CAEb,KAAK,MAAM,gBAAgB,eACzB,IAAI;EAEF,MAAM,SAAS,OAAM,MADC,2BAA2B,aAAa,YAAY,cAAc,aAAa,MAAM,EAAA,CAC9E,uBAAuB;GAClD,QAAQ;GACR,MAAM,aAAa;GACnB,SAAS,aAAa;GACtB,UAAU,aAAa;GACvB,SAAS,aAAa;GACtB,UAAU,OAAO;GACjB,WAAW,GAAG,OAAO,WAAW,GAAG,aAAa,UAAU,GAAG,aAAa;GAC1E,aAAa,UAAU,aAAa,KAAK,qBAAqB,gBAAgB,aAAa,KAAK;GAChG,UAAU;IACR,OAAO,aAAa,SAAS;IAC7B,QAAQ,aAAa;IACrB,YAAY,aAAa,SAAS;IAClC,aAAa,aAAa,SAAS;IACnC,mBAAmB,aAAa,SAAS;IACzC,WAAW,sBAAsB,OAAO,OAAO,OAAO,OAAO;IAC7D,YAAY,OAAO;GACrB;EACF,CAAC;EACD,MAAM,QAAQ,IAAI,CAAC,OAAO,WAAW,OAAO,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC;EACrE,IAAI,aAAa,UACf,MAAM,mBAAmB,aAAa,IAAI,aAAa,SAAS,wBAAwB,WAAW,QAAQ;OACtG,IAAI,aAAa,WAAW,YACjC,MAAM,mBAAmB,aAAa,IAAI,MAAM;EAElD,aAAa;CACf,SAAS,OAAO;EACd,UAAU;EACV,aAAa,gBAAgB,cAAc,KAAK;CAClD;CAGF,OAAO;EAAE;EAAW;EAAQ,SAAS;CAAM;AAC7C;AAEA,eAAsB,oBACpB,GACA,SAC8B;CAC9B,MAAM,SAAS,MAAM,mBAAmB,GAAG,QAAQ,OAAO,aAAa;CACvE,IAAI,YAAY,QAAQ,OAAO;CAE/B,IAAI,CAAC,gCAAgC,IAAI,OAAO,KAAK,GACnD,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,IAAI;GAAM,SAAS;EAAK;CAAE;CAG1D,MAAM,WAAW,+BAA+B,MAAM;CACtD,QAAQ,KAAK,oBAAoB,QAAQ;CAEzC,IAAI,QAAQ,oBACV,MAAM,QAAQ,mBAAmB,MAAM;CAGzC,IAAI,CAAC,QAAQ,YACX,OAAO;EAAE,QAAQ;EAAK,MAAM,EAAE,IAAI,KAAK;CAAE;CAG3C,MAAM,SAAS,MAAM,sBAAsB,QAAQ;EACjD,mBAAkB,iBAAgB;GAChC,QAAQ,KAAK,0CAA0C;IACrD,YAAY,OAAO;IACnB,YAAY,aAAa,SAAS;IAClC,QAAQ,aAAa,SAAS;IAC9B,MAAM,aAAa;GACrB,CAAC;EACH;EACA,GAAI;CACN,CAAC;CACD,IAAI,OAAO,SAAS,GAClB,QAAQ,KAAK,oBAAoB,OAAO,OAAO,4CAA4C,OAAO,WAAW,EAAE;CAEjH,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,IAAI;GAAM,GAAI,OAAO,UAAU,EAAE,SAAS,KAAc,IAAI,CAAC;EAAG;CAAE;AAClG"}
+{"version":3,"file":"webhook.js","names":[],"sources":["../../../src/integrations/github/webhook.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from 'node:crypto';\nimport type { MountedMastraCode } from '@mastra/code-sdk';\nimport type { NotificationPriority } from '@mastra/core/notifications';\nimport { RequestContext } from '@mastra/core/request-context';\nimport type { Context } from 'hono';\nimport { GithubAppIdentity } from './app-identity.js';\nimport type { GithubIntegration, GithubRepositoryPermission } from './integration.js';\nimport { listPullRequestSubscriptionsForWebhook, retirePullRequestSubscription } from './subscriptions.js';\nimport type {\n  GithubSignalSubscriptionRow,\n  GithubSubscriptionStorage,\n  GithubWebhookPullRequestTarget,\n} from './subscriptions.js';\n\nexport interface GithubWebhookHandlerOptions {\n  /** Integration providing webhook-secret verification + collaborator permission checks. */\n  github: GithubIntegration;\n  ingestFactoryEvent?: (event: ParsedGithubWebhook) => Promise<unknown>;\n}\n\nconst SUPPORTED_GITHUB_WEBHOOK_EVENTS = new Set([\n  'issues',\n  'issue_comment',\n  'pull_request',\n  'pull_request_review',\n  'pull_request_review_comment',\n  // Direct pushes to the default branch drive base-checkpoint rebuilds. The\n  // rules engine and subscription dispatcher both ignore push events.\n  'push',\n]);\n\nexport interface GithubWebhookMetadata {\n  event: string;\n  action?: string;\n  deliveryId: string;\n  repository?: string;\n  repositoryId?: number;\n  issueNumber?: number;\n  pullRequestNumber?: number;\n  sender?: string;\n  senderType?: string;\n  installationId?: number;\n}\n\nexport interface ParsedGithubWebhook {\n  event: string;\n  deliveryId: string;\n  payload: Record<string, unknown>;\n}\n\nexport type GithubWebhookResult =\n  | { status: 202; body: { ok: true; ignored?: true } }\n  | { status: 400; body: { error: 'bad_request'; message: string } }\n  | { status: 401; body: { error: 'unauthorized'; message: string } };\n\nexport interface GithubWebhookNotification {\n  action: string;\n  kind: string;\n  priority: NotificationPriority;\n  summary: string;\n  terminal: boolean;\n  metadata: GithubWebhookMetadata & { pullRequestNumber: number; repositoryId: number; installationId: number };\n  payload: Record<string, unknown>;\n}\n\n/** The Factory session row fields a woken session has to run as. */\nexport type FactorySessionOwner = { userId: string; orgId: string };\n\n/**\n * The integration surface this dispatch uses. Narrow on purpose: the GitHub App\n * integration and the platform-backed one are unrelated classes, and only this\n * much is common to both.\n */\nexport interface GithubWebhookDispatchIntegration {\n  /** App slug, used to recognize Factory's own bot identity. */\n  readonly slug?: string;\n  /**\n   * Resolved identity of the App this integration posts as. Preferred over\n   * {@link slug}, which names the deployment's own self-hosted App and is unset\n   * on deployments that run against Platform's App.\n   */\n  readonly identity?: GithubAppIdentity;\n  readonly integrationStorage: GithubSubscriptionStorage;\n  /**\n   * Extra bot logins this deployment authorizes to trigger author-gated\n   * notifications, merged over `DEFAULT_AUTHORIZED_BOTS`.\n   */\n  readonly authorizedBots?: readonly string[];\n  readonly sourceControlStorage: {\n    sessions: { getBySessionId(sessionId: string): Promise<FactorySessionOwner | null> };\n  };\n  getRepositoryCollaboratorPermission(\n    installationId: number,\n    repoFullName: string,\n    username: string,\n    signal?: AbortSignal,\n  ): Promise<GithubRepositoryPermission | undefined>;\n}\n\nexport interface GithubWebhookDispatchDependencies {\n  controller: MountedMastraCode['controller'];\n  /**\n   * Integration used by the default sender-authorization check (collaborator\n   * permission lookup) and to resolve the owner of a session being recreated.\n   * Author-gated notifications fail closed when neither this nor an\n   * `isAuthorizedSender` override is supplied.\n   */\n  github?: GithubWebhookDispatchIntegration;\n  listSubscriptions?: (\n    target: GithubWebhookPullRequestTarget,\n    options?: { includeTerminal?: boolean },\n  ) => Promise<GithubSignalSubscriptionRow[]>;\n  retireSubscription?: (id: string, status: 'open' | 'closed' | 'merged') => Promise<void>;\n  isAuthorizedSender?: (notification: GithubWebhookNotification) => Promise<boolean>;\n  /** Called when the sender gate drops a notification, so the drop is observable. */\n  onSenderRejected?: (notification: GithubWebhookNotification) => void;\n  onTargetError?: (subscription: GithubSignalSubscriptionRow, error: unknown) => void;\n  /** Called when a subscription names a thread this deployment does not hold. */\n  onTargetSkipped?: (subscription: GithubSignalSubscriptionRow) => void;\n}\n\nfunction normalizeHeader(value: string | undefined | null): string | null {\n  if (!value) return null;\n  const trimmed = value.trim();\n  return trimmed.length > 0 ? trimmed : null;\n}\n\nfunction verifySignature(rawBody: string, signature: string, secret: string): boolean {\n  if (!signature.startsWith('sha256=')) return false;\n  const signatureHex = signature.slice('sha256='.length);\n  if (!/^[a-fA-F0-9]{64}$/.test(signatureHex)) return false;\n\n  const expectedHex = createHmac('sha256', secret).update(rawBody).digest('hex');\n  const received = Buffer.from(signatureHex, 'hex');\n  const expected = Buffer.from(expectedHex, 'hex');\n  return received.length === expected.length && timingSafeEqual(received, expected);\n}\n\nasync function parseGithubWebhook(\n  c: Context,\n  secret: string | undefined,\n): Promise<ParsedGithubWebhook | GithubWebhookResult> {\n  if (!secret) {\n    return { status: 401, body: { error: 'unauthorized', message: 'GitHub webhook secret is not configured' } };\n  }\n\n  const event = normalizeHeader(c.req.header('x-github-event'));\n  const deliveryId = normalizeHeader(c.req.header('x-github-delivery'));\n  const signature = normalizeHeader(c.req.header('x-hub-signature-256'));\n\n  if (!event) return { status: 400, body: { error: 'bad_request', message: 'Missing x-github-event header' } };\n  if (!deliveryId) return { status: 400, body: { error: 'bad_request', message: 'Missing x-github-delivery header' } };\n  if (!signature)\n    return { status: 401, body: { error: 'unauthorized', message: 'Missing x-hub-signature-256 header' } };\n\n  const rawBody = await c.req.text();\n  if (!verifySignature(rawBody, signature, secret)) {\n    return { status: 401, body: { error: 'unauthorized', message: 'Invalid GitHub webhook signature' } };\n  }\n\n  let payload: unknown;\n  try {\n    payload = JSON.parse(rawBody);\n  } catch {\n    return { status: 400, body: { error: 'bad_request', message: 'Malformed JSON payload' } };\n  }\n\n  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {\n    return { status: 400, body: { error: 'bad_request', message: 'Payload must be a JSON object' } };\n  }\n\n  return { event, deliveryId, payload: payload as Record<string, unknown> };\n}\n\nfunction getObject(value: unknown): Record<string, unknown> | undefined {\n  return value && typeof value === 'object' && !Array.isArray(value) ? (value as Record<string, unknown>) : undefined;\n}\n\nfunction getString(value: unknown): string | undefined {\n  return typeof value === 'string' && value.length > 0 ? value : undefined;\n}\n\nfunction getNumber(value: unknown): number | undefined {\n  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;\n}\n\nfunction getBoolean(value: unknown): boolean | undefined {\n  return typeof value === 'boolean' ? value : undefined;\n}\n\nexport function normalizeGithubWebhookMetadata(parsed: ParsedGithubWebhook): GithubWebhookMetadata {\n  const { event, deliveryId, payload } = parsed;\n  const repository = getObject(payload.repository);\n  const issue = getObject(payload.issue);\n  const pullRequest = getObject(payload.pull_request);\n  const sender = getObject(payload.sender);\n  const installation = getObject(payload.installation);\n  const issuePullRequest = getObject(issue?.pull_request);\n\n  return {\n    event,\n    action: getString(payload.action),\n    deliveryId,\n    repository: getString(repository?.full_name),\n    repositoryId: getNumber(repository?.id),\n    issueNumber: getNumber(issue?.number),\n    pullRequestNumber:\n      getNumber(pullRequest?.number) ??\n      (event === 'issue_comment' && issuePullRequest ? getNumber(issue?.number) : undefined),\n    sender: getString(sender?.login),\n    senderType: getString(sender?.type),\n    installationId: getNumber(installation?.id),\n  };\n}\n\nfunction notificationSummary(metadata: GithubWebhookMetadata, label: string): string {\n  const actor = metadata.sender ? `${metadata.sender} ` : '';\n  return `${actor}${label} on ${metadata.repository}#${metadata.pullRequestNumber}`;\n}\n\nfunction notificationTargetUrl(event: string, payload: Record<string, unknown>): string | undefined {\n  if (event === 'issue_comment' || event === 'pull_request_review_comment') {\n    return getString(getObject(payload.comment)?.html_url);\n  }\n  if (event === 'pull_request_review') {\n    return getString(getObject(payload.review)?.html_url);\n  }\n  return getString(getObject(payload.pull_request)?.html_url);\n}\n\nexport function classifyGithubWebhook(parsed: ParsedGithubWebhook): GithubWebhookNotification | undefined {\n  const metadata = normalizeGithubWebhookMetadata(parsed);\n  const { event, payload } = parsed;\n  const action = metadata.action;\n  if (\n    !action ||\n    !metadata.repositoryId ||\n    !metadata.installationId ||\n    !metadata.pullRequestNumber ||\n    !metadata.repository\n  ) {\n    return undefined;\n  }\n\n  let priority: NotificationPriority;\n  let kind: string;\n  let label: string;\n  let terminal = false;\n\n  if (event === 'pull_request_review' && action === 'submitted') {\n    const state = getString(getObject(payload.review)?.state)?.toLowerCase().replaceAll('_', '-');\n    priority = state === 'approved' || state === 'changes-requested' ? 'urgent' : 'high';\n    kind =\n      state === 'approved'\n        ? 'review-approved'\n        : state === 'changes-requested'\n          ? 'review-changes-requested'\n          : 'review-submitted';\n    label =\n      state === 'approved'\n        ? 'approved the pull request'\n        : state === 'changes-requested'\n          ? 'requested changes'\n          : 'submitted a review';\n  } else if (event === 'pull_request' && action === 'closed') {\n    const merged = getBoolean(getObject(payload.pull_request)?.merged) === true;\n    priority = 'urgent';\n    kind = merged ? 'pull-request-merged' : 'pull-request-closed';\n    label = merged ? 'merged the pull request' : 'closed the pull request';\n    terminal = true;\n  } else if (event === 'issue_comment' && action === 'created') {\n    priority = 'high';\n    kind = 'issue-comment-created';\n    label = 'commented';\n  } else if (event === 'pull_request_review_comment' && action === 'created') {\n    priority = 'high';\n    kind = 'review-comment-created';\n    label = 'left a review comment';\n  } else if (event === 'pull_request' && action === 'reopened') {\n    priority = 'high';\n    kind = 'pull-request-reopened';\n    label = 'reopened the pull request';\n  } else if (event === 'pull_request_review' && action === 'dismissed') {\n    priority = 'high';\n    kind = 'review-dismissed';\n    label = 'dismissed a review';\n  } else if (\n    event === 'pull_request' &&\n    [\n      'synchronize',\n      'ready_for_review',\n      'converted_to_draft',\n      'assigned',\n      'unassigned',\n      'review_requested',\n      'review_request_removed',\n    ].includes(action)\n  ) {\n    priority = 'medium';\n    kind = `pull-request-${action.replaceAll('_', '-')}`;\n    label = action.replaceAll('_', ' ');\n  } else if (\n    event === 'pull_request' &&\n    ['edited', 'labeled', 'unlabeled', 'milestoned', 'demilestoned'].includes(action)\n  ) {\n    priority = 'low';\n    kind = `pull-request-${action.replaceAll('_', '-')}`;\n    label = action.replaceAll('_', ' ');\n  } else {\n    return undefined;\n  }\n\n  return {\n    action,\n    kind,\n    priority,\n    summary: notificationSummary(metadata, label),\n    terminal,\n    metadata: {\n      ...metadata,\n      pullRequestNumber: metadata.pullRequestNumber,\n      repositoryId: metadata.repositoryId,\n      installationId: metadata.installationId,\n    },\n    payload,\n  };\n}\n\nasync function resolveSubscriptionSession(\n  controller: MountedMastraCode['controller'],\n  subscription: GithubSignalSubscriptionRow,\n  github?: GithubWebhookDispatchIntegration,\n) {\n  const { sessionId, resourceId, threadId } = subscription;\n  if (!sessionId || !resourceId || !threadId) {\n    throw new Error(`GitHub subscription ${subscription.id} is missing its session binding.`);\n  }\n  // Read the thread straight from storage before touching sessions. This answers\n  // two questions at once, and `queryThreadById` does it without constructing a\n  // session (so no workspace or sandbox is provisioned just to make the check).\n  //\n  // First: do we even have this thread? A pull request's events can reach a\n  // deployment that never owned the subscribed thread, and delivery must not\n  // fabricate a session for a thread that lives somewhere else.\n  //\n  // Second: which resource owns it? The subscription records the Factory project\n  // as its `resourceId`, but an unscoped session is registered under its own id,\n  // so the stored value routinely names a resource that does not own the thread.\n  // The thread row is the authoritative answer; the stored id is only a fallback.\n  const thread = await controller.queryThreadById({ threadId });\n  if (!thread) return undefined;\n  const ownerResourceId = thread.resourceId || resourceId;\n  const scope = subscription.sessionScope || undefined;\n  let session = await controller.getSessionByResource(ownerResourceId, scope);\n  if (!session) {\n    const tags = {\n      factoryProjectId: resourceId,\n      projectRepositoryId: subscription.data.projectRepositoryId,\n      ...(scope ? { worktreePath: scope } : {}),\n    };\n    // Creating the session resolves its workspace, which authorizes the caller\n    // against the Factory session row — no signed-in user, so run as its owner.\n    // The session is created under the resource that owns the thread, so the\n    // thread switch below resolves; the persisted Factory session is keyed by\n    // the subscription's session ID.\n    const sessionRow = await github?.sourceControlStorage.sessions.getBySessionId(sessionId);\n    if (!sessionRow) {\n      throw new Error(`GitHub subscription ${subscription.id} has no Factory session ${sessionId} to run as.`);\n    }\n    const requestContext = new RequestContext();\n    requestContext.set('user', { workosId: sessionRow.userId, organizationId: sessionRow.orgId });\n    session = await controller.createSession({\n      id: sessionId,\n      ownerId: sessionRow.userId,\n      resourceId: ownerResourceId,\n      scope,\n      tags,\n      requestContext,\n    });\n  }\n  if (session.thread.getId() !== threadId) {\n    await session.thread.switch({ threadId, emitEvent: false });\n  }\n  if (session.thread.getId() !== threadId) {\n    throw new Error(`Session ${sessionId} did not bind thread ${threadId}.`);\n  }\n  return session;\n}\n\n/**\n * Reviewer bots authorized out of the box. Deployments extend — never replace —\n * this set through the integration's `authorizedBots`.\n */\nexport const DEFAULT_AUTHORIZED_BOTS: readonly string[] = ['coderabbitai[bot]', 'devin-ai-integration[bot]'];\n\n/**\n * Parse a comma-separated `MASTRACODE_GITHUB_AUTHORIZED_BOTS` value into extra\n * bot logins. Returns undefined when nothing usable was configured.\n */\nexport function parseAuthorizedBotsEnv(value: string | undefined): string[] | undefined {\n  const bots = (value ?? '')\n    .split(',')\n    .map(bot => bot.trim())\n    .filter(Boolean);\n  return bots.length > 0 ? bots : undefined;\n}\n\n/** Lowercased union of the default bot logins and any the deployment opted in. */\nexport function resolveAuthorizedBots(extra?: readonly string[]): Set<string> {\n  const bots = new Set(DEFAULT_AUTHORIZED_BOTS);\n  for (const bot of extra ?? []) {\n    const normalized = bot.trim().toLowerCase();\n    if (normalized) bots.add(normalized);\n  }\n  return bots;\n}\n\nconst AUTHORIZED_PERMISSIONS = new Set(['admin', 'maintain', 'write']);\nconst PERMISSION_CHECK_TIMEOUT_MS = 5_000;\nconst AUTHOR_GATED_KINDS = new Set([\n  'issue-comment-created',\n  'review-comment-created',\n  'review-submitted',\n  'review-approved',\n  'review-changes-requested',\n  'review-dismissed',\n]);\n\n/**\n * Recognizes Factory's own GitHub App identity. GitHub forbids an app from\n * reviewing a pull request it authored, so `factory-review` falls back to\n * posting its verdict as a comment under this login. Those comments have to\n * clear the author gate for the review handoff to reach the authoring agent;\n * the rules layer still decides which of them are worth acting on.\n */\nexport function isFactoryAppSender(sender: string | undefined, slug: string | undefined): boolean {\n  if (!sender || !slug) return false;\n  return sender.toLowerCase() === `${slug.toLowerCase()}[bot]`;\n}\n\nasync function isAuthorizedGithubSender(\n  notification: GithubWebhookNotification,\n  github:\n    | Pick<\n        GithubWebhookDispatchIntegration,\n        'getRepositoryCollaboratorPermission' | 'slug' | 'identity' | 'authorizedBots'\n      >\n    | undefined,\n): Promise<boolean> {\n  if (!AUTHOR_GATED_KINDS.has(notification.kind)) return true;\n  const sender = notification.metadata.sender;\n  const repository = notification.metadata.repository;\n  if (!sender || !repository) return false;\n  if (github?.identity?.matches(sender)) return true;\n  if (isFactoryAppSender(sender, github?.slug)) return true;\n  const normalizedSender = sender.toLowerCase();\n  if (notification.metadata.senderType?.toLowerCase() === 'bot' || normalizedSender.endsWith('[bot]')) {\n    return resolveAuthorizedBots(github?.authorizedBots).has(normalizedSender);\n  }\n  if (!github) return false;\n  const abortController = new AbortController();\n  let timeout: ReturnType<typeof setTimeout> | undefined;\n  try {\n    const permission = await Promise.race([\n      github.getRepositoryCollaboratorPermission(\n        notification.metadata.installationId,\n        repository,\n        sender,\n        abortController.signal,\n      ),\n      new Promise<undefined>(resolve => {\n        timeout = setTimeout(() => {\n          abortController.abort();\n          resolve(undefined);\n        }, PERMISSION_CHECK_TIMEOUT_MS);\n      }),\n    ]);\n    return permission !== undefined && AUTHORIZED_PERMISSIONS.has(permission);\n  } catch {\n    return false;\n  } finally {\n    if (timeout) clearTimeout(timeout);\n  }\n}\n\nexport async function dispatchGithubWebhook(\n  parsed: ParsedGithubWebhook,\n  dependencies: GithubWebhookDispatchDependencies,\n): Promise<{ delivered: number; failed: number; skipped: number; ignored: boolean }> {\n  const notification = classifyGithubWebhook(parsed);\n  if (!notification) return { delivered: 0, failed: 0, skipped: 0, ignored: true };\n  const isAuthorizedSender =\n    dependencies.isAuthorizedSender ??\n    ((n: GithubWebhookNotification) => isAuthorizedGithubSender(n, dependencies.github));\n  if (!(await isAuthorizedSender(notification))) {\n    dependencies.onSenderRejected?.(notification);\n    return { delivered: 0, failed: 0, skipped: 0, ignored: true };\n  }\n\n  const target = {\n    installationExternalId: notification.metadata.installationId.toString(),\n    repositoryExternalId: notification.metadata.repositoryId.toString(),\n    changeRequestId: notification.metadata.pullRequestNumber.toString(),\n  };\n  const listSubscriptions =\n    dependencies.listSubscriptions ??\n    ((subscriptionTarget: GithubWebhookPullRequestTarget, options?: { includeTerminal?: boolean }) => {\n      if (!dependencies.github) throw new Error('GitHub integration is required to load webhook subscriptions.');\n      return listPullRequestSubscriptionsForWebhook(\n        subscriptionTarget,\n        options,\n        dependencies.github.integrationStorage,\n      );\n    });\n  const retireSubscription =\n    dependencies.retireSubscription ??\n    ((id: string, status: 'open' | 'closed' | 'merged') => {\n      if (!dependencies.github) throw new Error('GitHub integration is required to retire webhook subscriptions.');\n      return retirePullRequestSubscription(id, status, dependencies.github.integrationStorage);\n    });\n  const subscriptions = await listSubscriptions(target, { includeTerminal: notification.action === 'reopened' });\n  let delivered = 0;\n  let failed = 0;\n  let skipped = 0;\n\n  for (const subscription of subscriptions) {\n    try {\n      const session = await resolveSubscriptionSession(dependencies.controller, subscription, dependencies.github);\n      // No session means this deployment does not hold the subscribed thread.\n      // That is not a delivery failure, so it must not be retried or counted as\n      // one; the subscription is left untouched because the thread may exist\n      // wherever the subscription was created.\n      if (!session) {\n        skipped += 1;\n        dependencies.onTargetSkipped?.(subscription);\n        continue;\n      }\n      const result = await session.sendNotificationSignal({\n        source: 'github',\n        kind: notification.kind,\n        summary: notification.summary,\n        priority: notification.priority,\n        payload: notification.payload,\n        sourceId: parsed.deliveryId,\n        dedupeKey: `${parsed.deliveryId}:${subscription.sessionId}:${subscription.threadId}`,\n        coalesceKey: `github:${subscription.data.repositoryExternalId}:pull-request:${subscription.data.changeRequestId}`,\n        metadata: {\n          event: notification.metadata.event,\n          action: notification.action,\n          repository: notification.metadata.repository,\n          issueNumber: notification.metadata.issueNumber,\n          pullRequestNumber: notification.metadata.pullRequestNumber,\n          targetUrl: notificationTargetUrl(parsed.event, parsed.payload),\n          deliveryId: parsed.deliveryId,\n        },\n      });\n      await Promise.all([result.persisted, result.accepted].filter(Boolean));\n      if (notification.terminal) {\n        await retireSubscription(subscription.id, notification.kind === 'pull-request-merged' ? 'merged' : 'closed');\n      } else if (notification.action === 'reopened') {\n        await retireSubscription(subscription.id, 'open');\n      }\n      delivered += 1;\n    } catch (error) {\n      failed += 1;\n      dependencies.onTargetError?.(subscription, error);\n    }\n  }\n\n  return { delivered, failed, skipped, ignored: false };\n}\n\nexport async function handleGithubWebhook(\n  c: Context,\n  options: GithubWebhookHandlerOptions & Partial<Omit<GithubWebhookDispatchDependencies, 'github'>>,\n): Promise<GithubWebhookResult> {\n  const parsed = await parseGithubWebhook(c, options.github.webhookSecret);\n  if ('status' in parsed) return parsed;\n\n  if (!SUPPORTED_GITHUB_WEBHOOK_EVENTS.has(parsed.event)) {\n    return { status: 202, body: { ok: true, ignored: true } };\n  }\n\n  const metadata = normalizeGithubWebhookMetadata(parsed);\n  console.info('[GitHub Webhook]', metadata);\n\n  if (options.ingestFactoryEvent) {\n    await options.ingestFactoryEvent(parsed);\n  }\n\n  if (!options.controller) {\n    return { status: 202, body: { ok: true } };\n  }\n\n  const result = await dispatchGithubWebhook(parsed, {\n    onSenderRejected: notification => {\n      console.info('[GitHub Webhook] sender not authorized', {\n        deliveryId: parsed.deliveryId,\n        repository: notification.metadata.repository,\n        sender: notification.metadata.sender,\n        kind: notification.kind,\n      });\n    },\n    ...(options as GithubWebhookDispatchDependencies),\n  });\n  if (result.failed > 0) {\n    console.warn(`[GitHub Webhook] ${result.failed} subscribed target(s) failed for delivery ${parsed.deliveryId}.`);\n  }\n  return { status: 202, body: { ok: true, ...(result.ignored ? { ignored: true as const } : {}) } };\n}\n"],"mappings":";;;;AAoBA,MAAM,kDAAkC,IAAI,IAAI;CAC9C;CACA;CACA;CACA;CACA;CAGA;AACF,CAAC;AA4FD,SAAS,gBAAgB,OAAiD;CACxE,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,UAAU,MAAM,KAAK;CAC3B,OAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAEA,SAAS,gBAAgB,SAAiB,WAAmB,QAAyB;CACpF,IAAI,CAAC,UAAU,WAAW,SAAS,GAAG,OAAO;CAC7C,MAAM,eAAe,UAAU,MAAM,CAAgB;CACrD,IAAI,CAAC,oBAAoB,KAAK,YAAY,GAAG,OAAO;CAEpD,MAAM,cAAc,WAAW,UAAU,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK;CAC7E,MAAM,WAAW,OAAO,KAAK,cAAc,KAAK;CAChD,MAAM,WAAW,OAAO,KAAK,aAAa,KAAK;CAC/C,OAAO,SAAS,WAAW,SAAS,UAAU,gBAAgB,UAAU,QAAQ;AAClF;AAEA,eAAe,mBACb,GACA,QACoD;CACpD,IAAI,CAAC,QACH,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,OAAO;GAAgB,SAAS;EAA0C;CAAE;CAG5G,MAAM,QAAQ,gBAAgB,EAAE,IAAI,OAAO,gBAAgB,CAAC;CAC5D,MAAM,aAAa,gBAAgB,EAAE,IAAI,OAAO,mBAAmB,CAAC;CACpE,MAAM,YAAY,gBAAgB,EAAE,IAAI,OAAO,qBAAqB,CAAC;CAErE,IAAI,CAAC,OAAO,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,OAAO;GAAe,SAAS;EAAgC;CAAE;CAC3G,IAAI,CAAC,YAAY,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,OAAO;GAAe,SAAS;EAAmC;CAAE;CACnH,IAAI,CAAC,WACH,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,OAAO;GAAgB,SAAS;EAAqC;CAAE;CAEvG,MAAM,UAAU,MAAM,EAAE,IAAI,KAAK;CACjC,IAAI,CAAC,gBAAgB,SAAS,WAAW,MAAM,GAC7C,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,OAAO;GAAgB,SAAS;EAAmC;CAAE;CAGrG,IAAI;CACJ,IAAI;EACF,UAAU,KAAK,MAAM,OAAO;CAC9B,QAAQ;EACN,OAAO;GAAE,QAAQ;GAAK,MAAM;IAAE,OAAO;IAAe,SAAS;GAAyB;EAAE;CAC1F;CAEA,IAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAClE,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,OAAO;GAAe,SAAS;EAAgC;CAAE;CAGjG,OAAO;EAAE;EAAO;EAAqB;CAAmC;AAC1E;AAEA,SAAS,UAAU,OAAqD;CACtE,OAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAK,QAAoC,KAAA;AAC5G;AAEA,SAAS,UAAU,OAAoC;CACrD,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ,KAAA;AACjE;AAEA,SAAS,UAAU,OAAoC;CACrD,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,QAAQ,KAAA;AACvE;AAEA,SAAS,WAAW,OAAqC;CACvD,OAAO,OAAO,UAAU,YAAY,QAAQ,KAAA;AAC9C;AAEA,SAAgB,+BAA+B,QAAoD;CACjG,MAAM,EAAE,OAAO,YAAY,YAAY;CACvC,MAAM,aAAa,UAAU,QAAQ,UAAU;CAC/C,MAAM,QAAQ,UAAU,QAAQ,KAAK;CACrC,MAAM,cAAc,UAAU,QAAQ,YAAY;CAClD,MAAM,SAAS,UAAU,QAAQ,MAAM;CACvC,MAAM,eAAe,UAAU,QAAQ,YAAY;CACnD,MAAM,mBAAmB,UAAU,OAAO,YAAY;CAEtD,OAAO;EACL;EACA,QAAQ,UAAU,QAAQ,MAAM;EAChC;EACA,YAAY,UAAU,YAAY,SAAS;EAC3C,cAAc,UAAU,YAAY,EAAE;EACtC,aAAa,UAAU,OAAO,MAAM;EACpC,mBACE,UAAU,aAAa,MAAM,MAC5B,UAAU,mBAAmB,mBAAmB,UAAU,OAAO,MAAM,IAAI,KAAA;EAC9E,QAAQ,UAAU,QAAQ,KAAK;EAC/B,YAAY,UAAU,QAAQ,IAAI;EAClC,gBAAgB,UAAU,cAAc,EAAE;CAC5C;AACF;AAEA,SAAS,oBAAoB,UAAiC,OAAuB;CAEnF,OAAO,GADO,SAAS,SAAS,GAAG,SAAS,OAAO,KAAK,KACtC,MAAM,MAAM,SAAS,WAAW,GAAG,SAAS;AAChE;AAEA,SAAS,sBAAsB,OAAe,SAAsD;CAClG,IAAI,UAAU,mBAAmB,UAAU,+BACzC,OAAO,UAAU,UAAU,QAAQ,OAAO,CAAC,EAAE,QAAQ;CAEvD,IAAI,UAAU,uBACZ,OAAO,UAAU,UAAU,QAAQ,MAAM,CAAC,EAAE,QAAQ;CAEtD,OAAO,UAAU,UAAU,QAAQ,YAAY,CAAC,EAAE,QAAQ;AAC5D;AAEA,SAAgB,sBAAsB,QAAoE;CACxG,MAAM,WAAW,+BAA+B,MAAM;CACtD,MAAM,EAAE,OAAO,YAAY;CAC3B,MAAM,SAAS,SAAS;CACxB,IACE,CAAC,UACD,CAAC,SAAS,gBACV,CAAC,SAAS,kBACV,CAAC,SAAS,qBACV,CAAC,SAAS,YAEV;CAGF,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI,WAAW;CAEf,IAAI,UAAU,yBAAyB,WAAW,aAAa;EAC7D,MAAM,QAAQ,UAAU,UAAU,QAAQ,MAAM,CAAC,EAAE,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC,WAAW,KAAK,GAAG;EAC5F,WAAW,UAAU,cAAc,UAAU,sBAAsB,WAAW;EAC9E,OACE,UAAU,aACN,oBACA,UAAU,sBACR,6BACA;EACR,QACE,UAAU,aACN,8BACA,UAAU,sBACR,sBACA;CACV,OAAO,IAAI,UAAU,kBAAkB,WAAW,UAAU;EAC1D,MAAM,SAAS,WAAW,UAAU,QAAQ,YAAY,CAAC,EAAE,MAAM,MAAM;EACvE,WAAW;EACX,OAAO,SAAS,wBAAwB;EACxC,QAAQ,SAAS,4BAA4B;EAC7C,WAAW;CACb,OAAO,IAAI,UAAU,mBAAmB,WAAW,WAAW;EAC5D,WAAW;EACX,OAAO;EACP,QAAQ;CACV,OAAO,IAAI,UAAU,iCAAiC,WAAW,WAAW;EAC1E,WAAW;EACX,OAAO;EACP,QAAQ;CACV,OAAO,IAAI,UAAU,kBAAkB,WAAW,YAAY;EAC5D,WAAW;EACX,OAAO;EACP,QAAQ;CACV,OAAO,IAAI,UAAU,yBAAyB,WAAW,aAAa;EACpE,WAAW;EACX,OAAO;EACP,QAAQ;CACV,OAAO,IACL,UAAU,kBACV;EACE;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,SAAS,MAAM,GACjB;EACA,WAAW;EACX,OAAO,gBAAgB,OAAO,WAAW,KAAK,GAAG;EACjD,QAAQ,OAAO,WAAW,KAAK,GAAG;CACpC,OAAO,IACL,UAAU,kBACV;EAAC;EAAU;EAAW;EAAa;EAAc;CAAc,CAAC,CAAC,SAAS,MAAM,GAChF;EACA,WAAW;EACX,OAAO,gBAAgB,OAAO,WAAW,KAAK,GAAG;EACjD,QAAQ,OAAO,WAAW,KAAK,GAAG;CACpC,OACE;CAGF,OAAO;EACL;EACA;EACA;EACA,SAAS,oBAAoB,UAAU,KAAK;EAC5C;EACA,UAAU;GACR,GAAG;GACH,mBAAmB,SAAS;GAC5B,cAAc,SAAS;GACvB,gBAAgB,SAAS;EAC3B;EACA;CACF;AACF;AAEA,eAAe,2BACb,YACA,cACA,QACA;CACA,MAAM,EAAE,WAAW,YAAY,aAAa;CAC5C,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,UAChC,MAAM,IAAI,MAAM,uBAAuB,aAAa,GAAG,iCAAiC;CAc1F,MAAM,SAAS,MAAM,WAAW,gBAAgB,EAAE,SAAS,CAAC;CAC5D,IAAI,CAAC,QAAQ,OAAO,KAAA;CACpB,MAAM,kBAAkB,OAAO,cAAc;CAC7C,MAAM,QAAQ,aAAa,gBAAgB,KAAA;CAC3C,IAAI,UAAU,MAAM,WAAW,qBAAqB,iBAAiB,KAAK;CAC1E,IAAI,CAAC,SAAS;EACZ,MAAM,OAAO;GACX,kBAAkB;GAClB,qBAAqB,aAAa,KAAK;GACvC,GAAI,QAAQ,EAAE,cAAc,MAAM,IAAI,CAAC;EACzC;EAMA,MAAM,aAAa,MAAM,QAAQ,qBAAqB,SAAS,eAAe,SAAS;EACvF,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,uBAAuB,aAAa,GAAG,0BAA0B,UAAU,YAAY;EAEzG,MAAM,iBAAiB,IAAI,eAAe;EAC1C,eAAe,IAAI,QAAQ;GAAE,UAAU,WAAW;GAAQ,gBAAgB,WAAW;EAAM,CAAC;EAC5F,UAAU,MAAM,WAAW,cAAc;GACvC,IAAI;GACJ,SAAS,WAAW;GACpB,YAAY;GACZ;GACA;GACA;EACF,CAAC;CACH;CACA,IAAI,QAAQ,OAAO,MAAM,MAAM,UAC7B,MAAM,QAAQ,OAAO,OAAO;EAAE;EAAU,WAAW;CAAM,CAAC;CAE5D,IAAI,QAAQ,OAAO,MAAM,MAAM,UAC7B,MAAM,IAAI,MAAM,WAAW,UAAU,uBAAuB,SAAS,EAAE;CAEzE,OAAO;AACT;;;;;AAMA,MAAa,0BAA6C,CAAC,qBAAqB,2BAA2B;;;;;AAM3G,SAAgB,uBAAuB,OAAiD;CACtF,MAAM,QAAQ,SAAS,GAAA,CACpB,MAAM,GAAG,CAAC,CACV,KAAI,QAAO,IAAI,KAAK,CAAC,CAAC,CACtB,OAAO,OAAO;CACjB,OAAO,KAAK,SAAS,IAAI,OAAO,KAAA;AAClC;;AAGA,SAAgB,sBAAsB,OAAwC;CAC5E,MAAM,OAAO,IAAI,IAAI,uBAAuB;CAC5C,KAAK,MAAM,OAAO,SAAS,CAAC,GAAG;EAC7B,MAAM,aAAa,IAAI,KAAK,CAAC,CAAC,YAAY;EAC1C,IAAI,YAAY,KAAK,IAAI,UAAU;CACrC;CACA,OAAO;AACT;AAEA,MAAM,yCAAyB,IAAI,IAAI;CAAC;CAAS;CAAY;AAAO,CAAC;AACrE,MAAM,8BAA8B;AACpC,MAAM,qCAAqB,IAAI,IAAI;CACjC;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;;;AASD,SAAgB,mBAAmB,QAA4B,MAAmC;CAChG,IAAI,CAAC,UAAU,CAAC,MAAM,OAAO;CAC7B,OAAO,OAAO,YAAY,MAAM,GAAG,KAAK,YAAY,EAAE;AACxD;AAEA,eAAe,yBACb,cACA,QAMkB;CAClB,IAAI,CAAC,mBAAmB,IAAI,aAAa,IAAI,GAAG,OAAO;CACvD,MAAM,SAAS,aAAa,SAAS;CACrC,MAAM,aAAa,aAAa,SAAS;CACzC,IAAI,CAAC,UAAU,CAAC,YAAY,OAAO;CACnC,IAAI,QAAQ,UAAU,QAAQ,MAAM,GAAG,OAAO;CAC9C,IAAI,mBAAmB,QAAQ,QAAQ,IAAI,GAAG,OAAO;CACrD,MAAM,mBAAmB,OAAO,YAAY;CAC5C,IAAI,aAAa,SAAS,YAAY,YAAY,MAAM,SAAS,iBAAiB,SAAS,OAAO,GAChG,OAAO,sBAAsB,QAAQ,cAAc,CAAC,CAAC,IAAI,gBAAgB;CAE3E,IAAI,CAAC,QAAQ,OAAO;CACpB,MAAM,kBAAkB,IAAI,gBAAgB;CAC5C,IAAI;CACJ,IAAI;EACF,MAAM,aAAa,MAAM,QAAQ,KAAK,CACpC,OAAO,oCACL,aAAa,SAAS,gBACtB,YACA,QACA,gBAAgB,MAClB,GACA,IAAI,SAAmB,YAAW;GAChC,UAAU,iBAAiB;IACzB,gBAAgB,MAAM;IACtB,QAAQ,KAAA,CAAS;GACnB,GAAG,2BAA2B;EAChC,CAAC,CACH,CAAC;EACD,OAAO,eAAe,KAAA,KAAa,uBAAuB,IAAI,UAAU;CAC1E,QAAQ;EACN,OAAO;CACT,UAAU;EACR,IAAI,SAAS,aAAa,OAAO;CACnC;AACF;AAEA,eAAsB,sBACpB,QACA,cACmF;CACnF,MAAM,eAAe,sBAAsB,MAAM;CACjD,IAAI,CAAC,cAAc,OAAO;EAAE,WAAW;EAAG,QAAQ;EAAG,SAAS;EAAG,SAAS;CAAK;CAI/E,IAAI,CAAE,OAFJ,aAAa,wBACX,MAAiC,yBAAyB,GAAG,aAAa,MAAM,GAAA,CACrD,YAAY,GAAI;EAC7C,aAAa,mBAAmB,YAAY;EAC5C,OAAO;GAAE,WAAW;GAAG,QAAQ;GAAG,SAAS;GAAG,SAAS;EAAK;CAC9D;CAEA,MAAM,SAAS;EACb,wBAAwB,aAAa,SAAS,eAAe,SAAS;EACtE,sBAAsB,aAAa,SAAS,aAAa,SAAS;EAClE,iBAAiB,aAAa,SAAS,kBAAkB,SAAS;CACpE;CACA,MAAM,oBACJ,aAAa,uBACX,oBAAoD,YAA4C;EAChG,IAAI,CAAC,aAAa,QAAQ,MAAM,IAAI,MAAM,+DAA+D;EACzG,OAAO,uCACL,oBACA,SACA,aAAa,OAAO,kBACtB;CACF;CACF,MAAM,qBACJ,aAAa,wBACX,IAAY,WAAyC;EACrD,IAAI,CAAC,aAAa,QAAQ,MAAM,IAAI,MAAM,iEAAiE;EAC3G,OAAO,8BAA8B,IAAI,QAAQ,aAAa,OAAO,kBAAkB;CACzF;CACF,MAAM,gBAAgB,MAAM,kBAAkB,QAAQ,EAAE,iBAAiB,aAAa,WAAW,WAAW,CAAC;CAC7G,IAAI,YAAY;CAChB,IAAI,SAAS;CACb,IAAI,UAAU;CAEd,KAAK,MAAM,gBAAgB,eACzB,IAAI;EACF,MAAM,UAAU,MAAM,2BAA2B,aAAa,YAAY,cAAc,aAAa,MAAM;EAK3G,IAAI,CAAC,SAAS;GACZ,WAAW;GACX,aAAa,kBAAkB,YAAY;GAC3C;EACF;EACA,MAAM,SAAS,MAAM,QAAQ,uBAAuB;GAClD,QAAQ;GACR,MAAM,aAAa;GACnB,SAAS,aAAa;GACtB,UAAU,aAAa;GACvB,SAAS,aAAa;GACtB,UAAU,OAAO;GACjB,WAAW,GAAG,OAAO,WAAW,GAAG,aAAa,UAAU,GAAG,aAAa;GAC1E,aAAa,UAAU,aAAa,KAAK,qBAAqB,gBAAgB,aAAa,KAAK;GAChG,UAAU;IACR,OAAO,aAAa,SAAS;IAC7B,QAAQ,aAAa;IACrB,YAAY,aAAa,SAAS;IAClC,aAAa,aAAa,SAAS;IACnC,mBAAmB,aAAa,SAAS;IACzC,WAAW,sBAAsB,OAAO,OAAO,OAAO,OAAO;IAC7D,YAAY,OAAO;GACrB;EACF,CAAC;EACD,MAAM,QAAQ,IAAI,CAAC,OAAO,WAAW,OAAO,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC;EACrE,IAAI,aAAa,UACf,MAAM,mBAAmB,aAAa,IAAI,aAAa,SAAS,wBAAwB,WAAW,QAAQ;OACtG,IAAI,aAAa,WAAW,YACjC,MAAM,mBAAmB,aAAa,IAAI,MAAM;EAElD,aAAa;CACf,SAAS,OAAO;EACd,UAAU;EACV,aAAa,gBAAgB,cAAc,KAAK;CAClD;CAGF,OAAO;EAAE;EAAW;EAAQ;EAAS,SAAS;CAAM;AACtD;AAEA,eAAsB,oBACpB,GACA,SAC8B;CAC9B,MAAM,SAAS,MAAM,mBAAmB,GAAG,QAAQ,OAAO,aAAa;CACvE,IAAI,YAAY,QAAQ,OAAO;CAE/B,IAAI,CAAC,gCAAgC,IAAI,OAAO,KAAK,GACnD,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,IAAI;GAAM,SAAS;EAAK;CAAE;CAG1D,MAAM,WAAW,+BAA+B,MAAM;CACtD,QAAQ,KAAK,oBAAoB,QAAQ;CAEzC,IAAI,QAAQ,oBACV,MAAM,QAAQ,mBAAmB,MAAM;CAGzC,IAAI,CAAC,QAAQ,YACX,OAAO;EAAE,QAAQ;EAAK,MAAM,EAAE,IAAI,KAAK;CAAE;CAG3C,MAAM,SAAS,MAAM,sBAAsB,QAAQ;EACjD,mBAAkB,iBAAgB;GAChC,QAAQ,KAAK,0CAA0C;IACrD,YAAY,OAAO;IACnB,YAAY,aAAa,SAAS;IAClC,QAAQ,aAAa,SAAS;IAC9B,MAAM,aAAa;GACrB,CAAC;EACH;EACA,GAAI;CACN,CAAC;CACD,IAAI,OAAO,SAAS,GAClB,QAAQ,KAAK,oBAAoB,OAAO,OAAO,4CAA4C,OAAO,WAAW,EAAE;CAEjH,OAAO;EAAE,QAAQ;EAAK,MAAM;GAAE,IAAI;GAAM,GAAI,OAAO,UAAU,EAAE,SAAS,KAAc,IAAI,CAAC;EAAG;CAAE;AAClG"}

package/dist/integrations/linear/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../src/integrations/linear/rules.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAiD,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAExG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,KAAK,EAAe,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC9F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAkBrD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,EAAE,gBAAgB,CAAC;IAC1B,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,KAAK,aAAa,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,CAAC;AAE1D,qBAAa,WAAW;;IACV,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,kBAAkB;IAElD,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,aAAa,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CA+F9F;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,CAAC,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAQ/D"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../src/integrations/linear/rules.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAiD,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAExG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,KAAK,EAAe,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC9F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAkBrD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,EAAE,gBAAgB,CAAC;IAC1B,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,KAAK,aAAa,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,CAAC;AAE1D,qBAAa,WAAW;;IACV,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,kBAAkB;IAElD,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,aAAa,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAgG9F;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,CAAC,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAQ/D"}

package/dist/integrations/linear/rules.js

@@ -75,7 +75,8 @@ var LinearRules = class {
 					parentWorkItemId: relatedItem.parentWorkItemId,
 					title: relatedItem.title,
 					url: relatedItem.externalSource?.url ?? null,
-					stages: relatedItem.stages
+					stages: relatedItem.stages,
+					metadata: relatedItem.metadata
 				},
 				board: "work",
 				itemRevision: relatedItem.revision

package/dist/integrations/linear/rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules.js","names":["#ingestIssue"],"sources":["../../../src/integrations/linear/rules.ts"],"sourcesContent":["import { resolveFactoryLinearRule } from '../../rules/resolve.js';\nimport type { FactoryLinearRuleContext, FactoryRuleDecision, FactoryRules } from '../../rules/types.js';\nimport { validateFactoryRuleDecisions } from '../../rules/validation.js';\nimport type { FactoryProjectsStorage } from '../../storage/domains/projects/base.js';\nimport type { WorkItemRow, WorkItemsStorage } from '../../storage/domains/work-items/base.js';\nimport type { IntegrationContext } from '../base.js';\n\nconst RULE_TIMEOUT_MS = 5_000;\n\nasync function withRuleTimeout<T>(promise: Promise<T>): Promise<T> {\n  let timeout: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      promise,\n      new Promise<never>((_, reject) => {\n        timeout = setTimeout(() => reject(new Error('FACTORY_RULE_TIMEOUT')), RULE_TIMEOUT_MS);\n      }),\n    ]);\n  } finally {\n    if (timeout) clearTimeout(timeout);\n  }\n}\n\nexport interface LinearIssueIngress {\n  id: string;\n  identifier: string;\n  title: string;\n  url: string;\n  state: string;\n  stateType: string;\n  priorityLabel: string;\n  assignee: string | null;\n  /** Display name of the Linear user who created the issue, when available. */\n  creator: string | null;\n  team: string | null;\n  labels: string[];\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport interface LinearRulesOptions {\n  projects: Pick<FactoryProjectsStorage, 'get'>;\n  storage: WorkItemsStorage;\n  rules: FactoryRules;\n}\n\nexport interface LinearRulesIngress {\n  orgId: string;\n  userId: string;\n  factoryProjectId: string;\n  issues: LinearIssueIngress[];\n}\n\ntype IngressStatus = 'committed' | 'replayed' | 'missing';\n\nexport class LinearRules {\n  constructor(private readonly options: LinearRulesOptions) {}\n\n  async ingest(input: LinearRulesIngress): Promise<{ status: IngressStatus; ingested: number }> {\n    const project = await this.options.projects.get({ orgId: input.orgId, id: input.factoryProjectId });\n    if (!project) return { status: 'missing', ingested: 0 };\n\n    const items = await this.options.storage.list({ orgId: input.orgId, factoryProjectId: input.factoryProjectId });\n    const itemsBySourceKey = new Map(items.map(item => [item.externalSource?.externalId, item]));\n    const statuses: IngressStatus[] = [];\n    for (const issue of input.issues) {\n      statuses.push(await this.#ingestIssue(input, issue, itemsBySourceKey.get(`linear:${issue.identifier}`)));\n    }\n    if (statuses.some(status => status === 'committed')) return { status: 'committed', ingested: statuses.length };\n    if (statuses.some(status => status === 'replayed')) return { status: 'replayed', ingested: statuses.length };\n    return { status: 'missing', ingested: statuses.length };\n  }\n\n  async #ingestIssue(\n    input: LinearRulesIngress,\n    issue: LinearIssueIngress,\n    relatedItem: WorkItemRow | undefined,\n  ): Promise<IngressStatus> {\n    const ingressId = `linear:${issue.id}:${issue.updatedAt}`;\n    const actor = { type: 'human' as const, id: input.userId };\n\n    // Closed issues without existing work items should not create new ones.\n    const isClosed = issue.stateType === 'completed' || issue.stateType === 'canceled';\n    if (isClosed && !relatedItem) {\n      return 'missing';\n    }\n\n    const event = isClosed ? 'issueClosed' : 'issueObserved';\n    const context: FactoryLinearRuleContext = {\n      tenant: { orgId: input.orgId, projectId: input.factoryProjectId },\n      actor,\n      ingress: { type: 'linear', id: ingressId },\n      cause: `linear.${event}`,\n      causalChain: [],\n      ruleSetVersion: this.options.rules.version,\n      ...(relatedItem\n        ? {\n            item: {\n              id: relatedItem.id,\n              source: 'linear-issue',\n              sourceKey: relatedItem.externalSource?.externalId ?? null,\n              parentWorkItemId: relatedItem.parentWorkItemId,\n              title: relatedItem.title,\n              url: relatedItem.externalSource?.url ?? null,\n              stages: relatedItem.stages,\n            },\n            board: 'work' as const,\n            itemRevision: relatedItem.revision,\n          }\n        : {}),\n      event,\n      issue,\n    };\n\n    const rule = resolveFactoryLinearRule(this.options.rules, context.event);\n    let decision: FactoryRuleDecision | void;\n    let decisions: Record<string, unknown>[] = [];\n    let outcome: { status: 'accepted' | 'rejected'; code?: string; reason?: string } = { status: 'accepted' };\n    try {\n      decision = rule ? await withRuleTimeout(Promise.resolve(rule(Object.freeze(context)))) : undefined;\n      if (decision?.type === 'reject') {\n        outcome = { status: 'rejected', code: decision.code, reason: decision.reason };\n      } else if (decision) {\n        decisions = validateFactoryRuleDecisions([decision]).map(entry => ({ ...entry }));\n      }\n    } catch (error) {\n      const timedOut = error instanceof Error && error.message === 'FACTORY_RULE_TIMEOUT';\n      outcome = {\n        status: 'rejected',\n        code: timedOut ? 'timeout' : 'rule_error',\n        reason: timedOut\n          ? 'Factory rule evaluation timed out.'\n          : error instanceof Error\n            ? error.message.slice(0, 2_000)\n            : 'Factory Linear rule failed.',\n      };\n    }\n\n    const committed = await this.options.storage.commitRuleEvaluation({\n      orgId: input.orgId,\n      factoryProjectId: input.factoryProjectId,\n      workItemId: relatedItem?.id ?? null,\n      ingress: { identity: ingressId, triggerType: 'linear.issueObserved' },\n      ruleSetVersion: this.options.rules.version,\n      expectedRevision: relatedItem?.revision ?? null,\n      actor,\n      outcome,\n      decisions,\n      causalChain: [],\n      now: new Date(),\n    });\n    return committed.status;\n  }\n}\n\nexport function attachLinearRules(\n  context: IntegrationContext,\n): ((input: LinearRulesIngress) => Promise<unknown>) | undefined {\n  if (!context.rules) return undefined;\n  const rules = new LinearRules({\n    projects: context.storage.projects,\n    storage: context.rules.workItems,\n    rules: context.rules.config,\n  });\n  return input => rules.ingest(input);\n}\n"],"mappings":";;;AAOA,MAAM,kBAAkB;AAExB,eAAe,gBAAmB,SAAiC;CACjE,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,SACA,IAAI,SAAgB,GAAG,WAAW;GAChC,UAAU,iBAAiB,uBAAO,IAAI,MAAM,sBAAsB,CAAC,GAAG,eAAe;EACvF,CAAC,CACH,CAAC;CACH,UAAU;EACR,IAAI,SAAS,aAAa,OAAO;CACnC;AACF;AAkCA,IAAa,cAAb,MAAyB;CACM;CAA7B,YAAY,SAA8C;EAA7B,KAAA,UAAA;CAA8B;CAE3D,MAAM,OAAO,OAAiF;EAE5F,IAAI,CAAC,MADiB,KAAK,QAAQ,SAAS,IAAI;GAAE,OAAO,MAAM;GAAO,IAAI,MAAM;EAAiB,CAAC,GACpF,OAAO;GAAE,QAAQ;GAAW,UAAU;EAAE;EAEtD,MAAM,QAAQ,MAAM,KAAK,QAAQ,QAAQ,KAAK;GAAE,OAAO,MAAM;GAAO,kBAAkB,MAAM;EAAiB,CAAC;EAC9G,MAAM,mBAAmB,IAAI,IAAI,MAAM,KAAI,SAAQ,CAAC,KAAK,gBAAgB,YAAY,IAAI,CAAC,CAAC;EAC3F,MAAM,WAA4B,CAAC;EACnC,KAAK,MAAM,SAAS,MAAM,QACxB,SAAS,KAAK,MAAM,KAAKA,aAAa,OAAO,OAAO,iBAAiB,IAAI,UAAU,MAAM,YAAY,CAAC,CAAC;EAEzG,IAAI,SAAS,MAAK,WAAU,WAAW,WAAW,GAAG,OAAO;GAAE,QAAQ;GAAa,UAAU,SAAS;EAAO;EAC7G,IAAI,SAAS,MAAK,WAAU,WAAW,UAAU,GAAG,OAAO;GAAE,QAAQ;GAAY,UAAU,SAAS;EAAO;EAC3G,OAAO;GAAE,QAAQ;GAAW,UAAU,SAAS;EAAO;CACxD;CAEA,MAAMA,aACJ,OACA,OACA,aACwB;EACxB,MAAM,YAAY,UAAU,MAAM,GAAG,GAAG,MAAM;EAC9C,MAAM,QAAQ;GAAE,MAAM;GAAkB,IAAI,MAAM;EAAO;EAGzD,MAAM,WAAW,MAAM,cAAc,eAAe,MAAM,cAAc;EACxE,IAAI,YAAY,CAAC,aACf,OAAO;EAGT,MAAM,QAAQ,WAAW,gBAAgB;EACzC,MAAM,UAAoC;GACxC,QAAQ;IAAE,OAAO,MAAM;IAAO,WAAW,MAAM;GAAiB;GAChE;GACA,SAAS;IAAE,MAAM;IAAU,IAAI;GAAU;GACzC,OAAO,UAAU;GACjB,aAAa,CAAC;GACd,gBAAgB,KAAK,QAAQ,MAAM;GACnC,GAAI,cACA;IACE,MAAM;KACJ,IAAI,YAAY;KAChB,QAAQ;KACR,WAAW,YAAY,gBAAgB,cAAc;KACrD,kBAAkB,YAAY;KAC9B,OAAO,YAAY;KACnB,KAAK,YAAY,gBAAgB,OAAO;KACxC,QAAQ,YAAY;IACtB;IACA,OAAO;IACP,cAAc,YAAY;GAC5B,IACA,CAAC;GACL;GACA;EACF;EAEA,MAAM,OAAO,yBAAyB,KAAK,QAAQ,OAAO,QAAQ,KAAK;EACvE,IAAI;EACJ,IAAI,YAAuC,CAAC;EAC5C,IAAI,UAA+E,EAAE,QAAQ,WAAW;EACxG,IAAI;GACF,WAAW,OAAO,MAAM,gBAAgB,QAAQ,QAAQ,KAAK,OAAO,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,KAAA;GACzF,IAAI,UAAU,SAAS,UACrB,UAAU;IAAE,QAAQ;IAAY,MAAM,SAAS;IAAM,QAAQ,SAAS;GAAO;QACxE,IAAI,UACT,YAAY,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAI,WAAU,EAAE,GAAG,MAAM,EAAE;EAEpF,SAAS,OAAO;GACd,MAAM,WAAW,iBAAiB,SAAS,MAAM,YAAY;GAC7D,UAAU;IACR,QAAQ;IACR,MAAM,WAAW,YAAY;IAC7B,QAAQ,WACJ,uCACA,iBAAiB,QACf,MAAM,QAAQ,MAAM,GAAG,GAAK,IAC5B;GACR;EACF;EAeA,QAAO,MAbiB,KAAK,QAAQ,QAAQ,qBAAqB;GAChE,OAAO,MAAM;GACb,kBAAkB,MAAM;GACxB,YAAY,aAAa,MAAM;GAC/B,SAAS;IAAE,UAAU;IAAW,aAAa;GAAuB;GACpE,gBAAgB,KAAK,QAAQ,MAAM;GACnC,kBAAkB,aAAa,YAAY;GAC3C;GACA;GACA;GACA,aAAa,CAAC;GACd,qBAAK,IAAI,KAAK;EAChB,CAAC,EAAA,CACgB;CACnB;AACF;AAEA,SAAgB,kBACd,SAC+D;CAC/D,IAAI,CAAC,QAAQ,OAAO,OAAO,KAAA;CAC3B,MAAM,QAAQ,IAAI,YAAY;EAC5B,UAAU,QAAQ,QAAQ;EAC1B,SAAS,QAAQ,MAAM;EACvB,OAAO,QAAQ,MAAM;CACvB,CAAC;CACD,QAAO,UAAS,MAAM,OAAO,KAAK;AACpC"}
+{"version":3,"file":"rules.js","names":["#ingestIssue"],"sources":["../../../src/integrations/linear/rules.ts"],"sourcesContent":["import { resolveFactoryLinearRule } from '../../rules/resolve.js';\nimport type { FactoryLinearRuleContext, FactoryRuleDecision, FactoryRules } from '../../rules/types.js';\nimport { validateFactoryRuleDecisions } from '../../rules/validation.js';\nimport type { FactoryProjectsStorage } from '../../storage/domains/projects/base.js';\nimport type { WorkItemRow, WorkItemsStorage } from '../../storage/domains/work-items/base.js';\nimport type { IntegrationContext } from '../base.js';\n\nconst RULE_TIMEOUT_MS = 5_000;\n\nasync function withRuleTimeout<T>(promise: Promise<T>): Promise<T> {\n  let timeout: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      promise,\n      new Promise<never>((_, reject) => {\n        timeout = setTimeout(() => reject(new Error('FACTORY_RULE_TIMEOUT')), RULE_TIMEOUT_MS);\n      }),\n    ]);\n  } finally {\n    if (timeout) clearTimeout(timeout);\n  }\n}\n\nexport interface LinearIssueIngress {\n  id: string;\n  identifier: string;\n  title: string;\n  url: string;\n  state: string;\n  stateType: string;\n  priorityLabel: string;\n  assignee: string | null;\n  /** Display name of the Linear user who created the issue, when available. */\n  creator: string | null;\n  team: string | null;\n  labels: string[];\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport interface LinearRulesOptions {\n  projects: Pick<FactoryProjectsStorage, 'get'>;\n  storage: WorkItemsStorage;\n  rules: FactoryRules;\n}\n\nexport interface LinearRulesIngress {\n  orgId: string;\n  userId: string;\n  factoryProjectId: string;\n  issues: LinearIssueIngress[];\n}\n\ntype IngressStatus = 'committed' | 'replayed' | 'missing';\n\nexport class LinearRules {\n  constructor(private readonly options: LinearRulesOptions) {}\n\n  async ingest(input: LinearRulesIngress): Promise<{ status: IngressStatus; ingested: number }> {\n    const project = await this.options.projects.get({ orgId: input.orgId, id: input.factoryProjectId });\n    if (!project) return { status: 'missing', ingested: 0 };\n\n    const items = await this.options.storage.list({ orgId: input.orgId, factoryProjectId: input.factoryProjectId });\n    const itemsBySourceKey = new Map(items.map(item => [item.externalSource?.externalId, item]));\n    const statuses: IngressStatus[] = [];\n    for (const issue of input.issues) {\n      statuses.push(await this.#ingestIssue(input, issue, itemsBySourceKey.get(`linear:${issue.identifier}`)));\n    }\n    if (statuses.some(status => status === 'committed')) return { status: 'committed', ingested: statuses.length };\n    if (statuses.some(status => status === 'replayed')) return { status: 'replayed', ingested: statuses.length };\n    return { status: 'missing', ingested: statuses.length };\n  }\n\n  async #ingestIssue(\n    input: LinearRulesIngress,\n    issue: LinearIssueIngress,\n    relatedItem: WorkItemRow | undefined,\n  ): Promise<IngressStatus> {\n    const ingressId = `linear:${issue.id}:${issue.updatedAt}`;\n    const actor = { type: 'human' as const, id: input.userId };\n\n    // Closed issues without existing work items should not create new ones.\n    const isClosed = issue.stateType === 'completed' || issue.stateType === 'canceled';\n    if (isClosed && !relatedItem) {\n      return 'missing';\n    }\n\n    const event = isClosed ? 'issueClosed' : 'issueObserved';\n    const context: FactoryLinearRuleContext = {\n      tenant: { orgId: input.orgId, projectId: input.factoryProjectId },\n      actor,\n      ingress: { type: 'linear', id: ingressId },\n      cause: `linear.${event}`,\n      causalChain: [],\n      ruleSetVersion: this.options.rules.version,\n      ...(relatedItem\n        ? {\n            item: {\n              id: relatedItem.id,\n              source: 'linear-issue',\n              sourceKey: relatedItem.externalSource?.externalId ?? null,\n              parentWorkItemId: relatedItem.parentWorkItemId,\n              title: relatedItem.title,\n              url: relatedItem.externalSource?.url ?? null,\n              stages: relatedItem.stages,\n              metadata: relatedItem.metadata,\n            },\n            board: 'work' as const,\n            itemRevision: relatedItem.revision,\n          }\n        : {}),\n      event,\n      issue,\n    };\n\n    const rule = resolveFactoryLinearRule(this.options.rules, context.event);\n    let decision: FactoryRuleDecision | void;\n    let decisions: Record<string, unknown>[] = [];\n    let outcome: { status: 'accepted' | 'rejected'; code?: string; reason?: string } = { status: 'accepted' };\n    try {\n      decision = rule ? await withRuleTimeout(Promise.resolve(rule(Object.freeze(context)))) : undefined;\n      if (decision?.type === 'reject') {\n        outcome = { status: 'rejected', code: decision.code, reason: decision.reason };\n      } else if (decision) {\n        decisions = validateFactoryRuleDecisions([decision]).map(entry => ({ ...entry }));\n      }\n    } catch (error) {\n      const timedOut = error instanceof Error && error.message === 'FACTORY_RULE_TIMEOUT';\n      outcome = {\n        status: 'rejected',\n        code: timedOut ? 'timeout' : 'rule_error',\n        reason: timedOut\n          ? 'Factory rule evaluation timed out.'\n          : error instanceof Error\n            ? error.message.slice(0, 2_000)\n            : 'Factory Linear rule failed.',\n      };\n    }\n\n    const committed = await this.options.storage.commitRuleEvaluation({\n      orgId: input.orgId,\n      factoryProjectId: input.factoryProjectId,\n      workItemId: relatedItem?.id ?? null,\n      ingress: { identity: ingressId, triggerType: 'linear.issueObserved' },\n      ruleSetVersion: this.options.rules.version,\n      expectedRevision: relatedItem?.revision ?? null,\n      actor,\n      outcome,\n      decisions,\n      causalChain: [],\n      now: new Date(),\n    });\n    return committed.status;\n  }\n}\n\nexport function attachLinearRules(\n  context: IntegrationContext,\n): ((input: LinearRulesIngress) => Promise<unknown>) | undefined {\n  if (!context.rules) return undefined;\n  const rules = new LinearRules({\n    projects: context.storage.projects,\n    storage: context.rules.workItems,\n    rules: context.rules.config,\n  });\n  return input => rules.ingest(input);\n}\n"],"mappings":";;;AAOA,MAAM,kBAAkB;AAExB,eAAe,gBAAmB,SAAiC;CACjE,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,SACA,IAAI,SAAgB,GAAG,WAAW;GAChC,UAAU,iBAAiB,uBAAO,IAAI,MAAM,sBAAsB,CAAC,GAAG,eAAe;EACvF,CAAC,CACH,CAAC;CACH,UAAU;EACR,IAAI,SAAS,aAAa,OAAO;CACnC;AACF;AAkCA,IAAa,cAAb,MAAyB;CACM;CAA7B,YAAY,SAA8C;EAA7B,KAAA,UAAA;CAA8B;CAE3D,MAAM,OAAO,OAAiF;EAE5F,IAAI,CAAC,MADiB,KAAK,QAAQ,SAAS,IAAI;GAAE,OAAO,MAAM;GAAO,IAAI,MAAM;EAAiB,CAAC,GACpF,OAAO;GAAE,QAAQ;GAAW,UAAU;EAAE;EAEtD,MAAM,QAAQ,MAAM,KAAK,QAAQ,QAAQ,KAAK;GAAE,OAAO,MAAM;GAAO,kBAAkB,MAAM;EAAiB,CAAC;EAC9G,MAAM,mBAAmB,IAAI,IAAI,MAAM,KAAI,SAAQ,CAAC,KAAK,gBAAgB,YAAY,IAAI,CAAC,CAAC;EAC3F,MAAM,WAA4B,CAAC;EACnC,KAAK,MAAM,SAAS,MAAM,QACxB,SAAS,KAAK,MAAM,KAAKA,aAAa,OAAO,OAAO,iBAAiB,IAAI,UAAU,MAAM,YAAY,CAAC,CAAC;EAEzG,IAAI,SAAS,MAAK,WAAU,WAAW,WAAW,GAAG,OAAO;GAAE,QAAQ;GAAa,UAAU,SAAS;EAAO;EAC7G,IAAI,SAAS,MAAK,WAAU,WAAW,UAAU,GAAG,OAAO;GAAE,QAAQ;GAAY,UAAU,SAAS;EAAO;EAC3G,OAAO;GAAE,QAAQ;GAAW,UAAU,SAAS;EAAO;CACxD;CAEA,MAAMA,aACJ,OACA,OACA,aACwB;EACxB,MAAM,YAAY,UAAU,MAAM,GAAG,GAAG,MAAM;EAC9C,MAAM,QAAQ;GAAE,MAAM;GAAkB,IAAI,MAAM;EAAO;EAGzD,MAAM,WAAW,MAAM,cAAc,eAAe,MAAM,cAAc;EACxE,IAAI,YAAY,CAAC,aACf,OAAO;EAGT,MAAM,QAAQ,WAAW,gBAAgB;EACzC,MAAM,UAAoC;GACxC,QAAQ;IAAE,OAAO,MAAM;IAAO,WAAW,MAAM;GAAiB;GAChE;GACA,SAAS;IAAE,MAAM;IAAU,IAAI;GAAU;GACzC,OAAO,UAAU;GACjB,aAAa,CAAC;GACd,gBAAgB,KAAK,QAAQ,MAAM;GACnC,GAAI,cACA;IACE,MAAM;KACJ,IAAI,YAAY;KAChB,QAAQ;KACR,WAAW,YAAY,gBAAgB,cAAc;KACrD,kBAAkB,YAAY;KAC9B,OAAO,YAAY;KACnB,KAAK,YAAY,gBAAgB,OAAO;KACxC,QAAQ,YAAY;KACpB,UAAU,YAAY;IACxB;IACA,OAAO;IACP,cAAc,YAAY;GAC5B,IACA,CAAC;GACL;GACA;EACF;EAEA,MAAM,OAAO,yBAAyB,KAAK,QAAQ,OAAO,QAAQ,KAAK;EACvE,IAAI;EACJ,IAAI,YAAuC,CAAC;EAC5C,IAAI,UAA+E,EAAE,QAAQ,WAAW;EACxG,IAAI;GACF,WAAW,OAAO,MAAM,gBAAgB,QAAQ,QAAQ,KAAK,OAAO,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,KAAA;GACzF,IAAI,UAAU,SAAS,UACrB,UAAU;IAAE,QAAQ;IAAY,MAAM,SAAS;IAAM,QAAQ,SAAS;GAAO;QACxE,IAAI,UACT,YAAY,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAI,WAAU,EAAE,GAAG,MAAM,EAAE;EAEpF,SAAS,OAAO;GACd,MAAM,WAAW,iBAAiB,SAAS,MAAM,YAAY;GAC7D,UAAU;IACR,QAAQ;IACR,MAAM,WAAW,YAAY;IAC7B,QAAQ,WACJ,uCACA,iBAAiB,QACf,MAAM,QAAQ,MAAM,GAAG,GAAK,IAC5B;GACR;EACF;EAeA,QAAO,MAbiB,KAAK,QAAQ,QAAQ,qBAAqB;GAChE,OAAO,MAAM;GACb,kBAAkB,MAAM;GACxB,YAAY,aAAa,MAAM;GAC/B,SAAS;IAAE,UAAU;IAAW,aAAa;GAAuB;GACpE,gBAAgB,KAAK,QAAQ,MAAM;GACnC,kBAAkB,aAAa,YAAY;GAC3C;GACA;GACA;GACA,aAAa,CAAC;GACd,qBAAK,IAAI,KAAK;EAChB,CAAC,EAAA,CACgB;CACnB;AACF;AAEA,SAAgB,kBACd,SAC+D;CAC/D,IAAI,CAAC,QAAQ,OAAO,OAAO,KAAA;CAC3B,MAAM,QAAQ,IAAI,YAAY;EAC5B,UAAU,QAAQ,QAAQ;EAC1B,SAAS,QAAQ,MAAM;EACvB,OAAO,QAAQ,MAAM;CACvB,CAAC;CACD,QAAO,UAAS,MAAM,OAAO,KAAK;AACpC"}

package/dist/integrations/platform/github/event-worker.d.ts

@@ -3,6 +3,7 @@ import { MastraWorker } from '@mastra/core/worker';
 import type { WorkerDeps } from '@mastra/core/worker';
 import type { IntegrationStorageHandle } from '../../../storage/domains/integrations/base.js';
 import type { GithubIssueReconciler } from '../../github/issue-reconciler.js';
+import type { GithubReconcileRepositorySource } from '../../github/reconcile-worker.js';
 import type { GithubPullRequestReconciler } from '../../github/rules.js';
 import { dispatchGithubWebhook } from '../../github/webhook.js';
 import type { GithubWebhookDispatchIntegration, ParsedGithubWebhook } from '../../github/webhook.js';
@@ -23,9 +24,19 @@ export interface PlatformGithubEventWorkerConfig {
     controller: MountedMastraCode['controller'];
     github: PlatformGithubEventDispatchIntegration;
     storage: PlatformGithubEventStorage;
+    /**
+     * Source-control storage used to resolve the set of repositories the worker
+     * should poll. The worker restricts itself to `(installation, repository)`
+     * pairs linked to a factory project — the same set the reconciler uses —
+     * so polling scales with Factory usage, not with the size of the underlying
+     * GitHub org.
+     */
+    sourceControl: GithubReconcileRepositorySource;
     ingestFactoryEvent?: (event: ParsedGithubWebhook) => Promise<unknown>;
     reconcileFactoryState?: GithubPullRequestReconciler;
     reconcileIssuesFactoryState?: GithubIssueReconciler;
+    /** Base-checkpoint freshness sweep, run after the reconcilers within the lease. */
+    sweepBaseCheckpoints?: () => Promise<void>;
     /** When false the worker skips event tailing and only runs enabled reconciliation sweeps. */
     pollEventsEnabled?: boolean;
     intervalMs?: number;

package/dist/integrations/platform/github/event-worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"event-worker.d.ts","sourceRoot":"","sources":["../../../../src/integrations/platform/github/event-worker.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAE9F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,KAAK,EAAE,2BAA2B,EAAuB,MAAM,uBAAuB,CAAC;AAE9F,OAAO,EAAE,qBAAqB,EAAyB,MAAM,yBAAyB,CAAC;AACvF,OAAO,KAAK,EACV,gCAAgC,EAEhC,mBAAmB,EACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AA0B1D,KAAK,WAAW,GAAG;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC;AACzE,KAAK,iCAAiC,GAAG;IACvC,OAAO,EAAE,CAAC,CAAC;IACX,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,wBAAwB,CAC/D,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvB,iCAAiC,EACjC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CACxB,CAAC;AAWF,MAAM,MAAM,sCAAsC,GAAG,gCAAgC,CAAC;AAEtF,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,iBAAiB,CAAC;IAC1B,UAAU,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,EAAE,sCAAsC,CAAC;IAC/C,OAAO,EAAE,0BAA0B,CAAC;IACpC,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,qBAAqB,CAAC,EAAE,2BAA2B,CAAC;IACpD,2BAA2B,CAAC,EAAE,qBAAqB,CAAC;IACpD,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,qBAAqB,CAAC;CACzC;AAED,qBAAa,yBAA0B,SAAQ,YAAY;;IACzD,QAAQ,CAAC,IAAI,4BAA4B;gBA6B7B,MAAM,EAAE,+BAA+B;IA+B7C,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IActB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAa3B,IAAI,SAAS,IAAI,OAAO,CAEvB;CA6TF"}
+{"version":3,"file":"event-worker.d.ts","sourceRoot":"","sources":["../../../../src/integrations/platform/github/event-worker.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAE9F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACxF,OAAO,KAAK,EAAE,2BAA2B,EAAuB,MAAM,uBAAuB,CAAC;AAE9F,OAAO,EAAE,qBAAqB,EAA6C,MAAM,yBAAyB,CAAC;AAC3G,OAAO,KAAK,EACV,gCAAgC,EAEhC,mBAAmB,EACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAiC1D,KAAK,WAAW,GAAG;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC;AACzE,KAAK,iCAAiC,GAAG;IACvC,OAAO,EAAE,CAAC,CAAC;IACX,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,wBAAwB,CAC/D,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvB,iCAAiC,EACjC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CACxB,CAAC;AAWF,MAAM,MAAM,sCAAsC,GAAG,gCAAgC,CAAC;AAEtF,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,iBAAiB,CAAC;IAC1B,UAAU,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,EAAE,sCAAsC,CAAC;IAC/C,OAAO,EAAE,0BAA0B,CAAC;IACpC;;;;;;OAMG;IACH,aAAa,EAAE,+BAA+B,CAAC;IAC/C,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,qBAAqB,CAAC,EAAE,2BAA2B,CAAC;IACpD,2BAA2B,CAAC,EAAE,qBAAqB,CAAC;IACpD,mFAAmF;IACnF,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,qBAAqB,CAAC;CACzC;AAED,qBAAa,yBAA0B,SAAQ,YAAY;;IACzD,QAAQ,CAAC,IAAI,4BAA4B;gBA+B7B,MAAM,EAAE,+BAA+B;IAiC7C,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IActB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAa3B,IAAI,SAAS,IAAI,OAAO,CAEvB;CAsWF"}

package/dist/integrations/platform/github/event-worker.js

@@ -1,5 +1,5 @@
 import { listPullRequestSubscriptionsForWebhook, retirePullRequestSubscription } from "../../github/subscriptions.js";
-import { dispatchGithubWebhook, resolveAuthorizedBots } from "../../github/webhook.js";
+import { dispatchGithubWebhook, isFactoryAppSender, resolveAuthorizedBots } from "../../github/webhook.js";
 import { PlatformApiError } from "../api-client.js";
 import { randomUUID } from "crypto";
 import { NoopLeaseProvider, isLeaseProvider } from "@mastra/core/events";
@@ -17,13 +17,16 @@ const SUPPORTED_EVENTS = /* @__PURE__ */ new Set([
 	"issue_comment",
 	"pull_request",
 	"pull_request_review",
-	"pull_request_review_comment"
+	"pull_request_review_comment",
+	"push"
 ]);
 const AUTHOR_GATED_KINDS = /* @__PURE__ */ new Set([
-	"issue-comment",
-	"pull-request-comment",
-	"pull-request-review",
-	"pull-request-review-comment"
+	"issue-comment-created",
+	"review-comment-created",
+	"review-approved",
+	"review-changes-requested",
+	"review-submitted",
+	"review-dismissed"
 ]);
 const AUTHORIZED_PERMISSIONS = /* @__PURE__ */ new Set([
 	"admin",
@@ -40,12 +43,14 @@ var PlatformGithubEventWorker = class extends MastraWorker {
 	#ingestFactoryEvent;
 	#reconcileFactoryState;
 	#reconcileIssuesFactoryState;
+	#sweepBaseCheckpoints;
 	#pollEventsEnabled;
 	#pullRequestReconcileIntervalMs;
 	#issueReconcileIntervalMs;
 	#intervalMs;
 	#now;
 	#dispatch;
+	#sourceControl;
 	#leaseOwner = randomUUID();
 	#running = false;
 	#timer;
@@ -70,6 +75,7 @@ var PlatformGithubEventWorker = class extends MastraWorker {
 		this.#ingestFactoryEvent = config.ingestFactoryEvent;
 		this.#reconcileFactoryState = config.reconcileFactoryState;
 		this.#reconcileIssuesFactoryState = config.reconcileIssuesFactoryState;
+		this.#sweepBaseCheckpoints = config.sweepBaseCheckpoints;
 		this.#pollEventsEnabled = config.pollEventsEnabled ?? true;
 		const legacyReconcileIntervalMs = config.reconcileIntervalMs ?? DEFAULT_RECONCILE_INTERVAL_MS;
 		this.#pullRequestReconcileIntervalMs = config.pullRequestReconcileIntervalMs ?? legacyReconcileIntervalMs;
@@ -81,6 +87,7 @@ var PlatformGithubEventWorker = class extends MastraWorker {
 		this.#leaseTtlMs = Math.max(MIN_LEASE_TTL_MS, Math.min(this.#intervalMs, this.#pullRequestReconcileIntervalMs, this.#issueReconcileIntervalMs) * 3);
 		this.#now = config.now ?? Date.now;
 		this.#dispatch = config.dispatch ?? dispatchGithubWebhook;
+		this.#sourceControl = config.sourceControl;
 	}
 	async init(deps) {
 		await super.init(deps);
@@ -256,16 +263,36 @@ var PlatformGithubEventWorker = class extends MastraWorker {
 				});
 			}
 		}
+		if (this.#sweepBaseCheckpoints && this.#hasLease) try {
+			await this.#sweepBaseCheckpoints();
+		} catch (error) {
+			this.deps?.logger.warn("Platform GitHub base-checkpoint freshness sweep failed", { error: error instanceof Error ? error.message : String(error) });
+		}
 	}
+	/**
+	* Configured `(installation, repository)` pairs — the same set the
+	* reconciler sweeps — resolved to the numeric ids and slug the poll
+	* addresses GitHub with. Repositories not linked to any factory project
+	* cannot produce work for Factory, so polling and reconciling them is
+	* wasted `/events` bandwidth and platform load.
+	*/
 	async #discoverRepositories() {
-		const result = await this.#client.request("GET", `${API_PREFIX}/installations`);
+		const keys = await this.#sourceControl.projectRepositories.listConfiguredExternalKeys();
 		const repositories = /* @__PURE__ */ new Map();
-		for (const installation of result.installations) {
-			if (!installation.usable || installation.suspendedAt) continue;
-			const page = await this.#client.request("GET", `${API_PREFIX}/installations/${installation.installationId}/repositories`);
-			for (const repository of page.repositories) repositories.set(repository.id, {
-				...repository,
-				installationId: installation.installationId
+		for (const key of keys) {
+			const installationId = Number(key.installationExternalId);
+			const repositoryId = Number(key.repositoryExternalId);
+			if (!Number.isSafeInteger(installationId) || installationId <= 0 || !Number.isSafeInteger(repositoryId) || repositoryId <= 0) continue;
+			if (repositories.has(repositoryId)) continue;
+			const orgId = (await this.#sourceControl.projectRepositories.listByExternalRepository(key))[0]?.orgId;
+			const repository = orgId ? await this.#sourceControl.repositories.findByExternalId({
+				orgId,
+				externalId: key.repositoryExternalId
+			}) : null;
+			repositories.set(repositoryId, {
+				id: repositoryId,
+				installationId,
+				fullName: repository?.slug
 			});
 		}
 		return [...repositories.values()];
@@ -306,6 +333,13 @@ var PlatformGithubEventWorker = class extends MastraWorker {
 					retireSubscription: (id, status) => retirePullRequestSubscription(id, status, this.#github.integrationStorage),
 					github: this.#github,
 					isAuthorizedSender: (notification) => this.#isAuthorizedSender(notification),
+					onTargetSkipped: (subscription) => {
+						this.deps?.logger.debug("Platform GitHub event skipped: thread is not held here", {
+							deliveryId: event.deliveryId,
+							subscriptionId: subscription.id,
+							threadId: subscription.threadId
+						});
+					},
 					onSenderRejected: (notification) => {
 						this.deps?.logger.debug("Platform GitHub event dropped: sender not authorized", {
 							deliveryId: event.deliveryId,
@@ -341,6 +375,8 @@ var PlatformGithubEventWorker = class extends MastraWorker {
 		const sender = notification.metadata.sender;
 		const repository = notification.metadata.repository;
 		if (!sender || !repository) return false;
+		if (this.#github.identity?.matches(sender)) return true;
+		if (isFactoryAppSender(sender, this.#github.slug)) return true;
 		const normalizedSender = sender.toLowerCase();
 		if (resolveAuthorizedBots(this.#github.authorizedBots).has(normalizedSender)) return true;
 		if (notification.metadata.senderType?.toLowerCase() === "bot" || normalizedSender.endsWith("[bot]")) return false;
@@ -381,8 +417,11 @@ function isFactoryIngestedEvent(event) {
 	if ((event.event === "issues" || event.event === "pull_request") && event.payload.action === "closed") return true;
 	if (event.event === "pull_request") {
 		const action = event.payload.action;
-		if (action === "synchronize" || action === "review_requested") return true;
+		if (action === "opened" || action === "synchronize" || action === "review_requested") return true;
 	}
+	if (event.event === "pull_request_review" && event.payload.action === "submitted") return true;
+	if (event.event === "issue_comment" && event.payload.action === "created") return true;
+	if (event.event === "push") return true;
 	return false;
 }
 function parseEvent(event) {

package/dist/integrations/platform/github/event-worker.js.map

@@ -1 +1 @@
-{"version":3,"file":"event-worker.js","names":["#client","#controller","#github","#storage","#ingestFactoryEvent","#reconcileFactoryState","#reconcileIssuesFactoryState","#pollEventsEnabled","#pullRequestReconcileIntervalMs","#issueReconcileIntervalMs","#intervalMs","#now","#dispatch","#leaseOwner","#leaseTtlMs","#leaseProvider","#running","#startedAt","#settings","#schedule","#timer","#stopLeaseRenewal","#inFlight","#hasLease","#leaseKey","#tick","#ensureLease","#poll","#startLeaseRenewal","#leaseRenewalTimer","#discoverRepositories","#reconcileCadence","#pollRepository","#maybeReconcile","#lastPullRequestReconcileAt","#lastIssueReconcileAt","#saveSettings","#isAuthorizedSender"],"sources":["../../../../src/integrations/platform/github/event-worker.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\n\nimport type { MountedMastraCode } from '@mastra/code-sdk';\nimport { isLeaseProvider, NoopLeaseProvider } from '@mastra/core/events';\nimport type { LeaseProvider, PubSub } from '@mastra/core/events';\nimport { MastraWorker } from '@mastra/core/worker';\nimport type { WorkerDeps } from '@mastra/core/worker';\n\nimport type { IntegrationStorageHandle } from '../../../storage/domains/integrations/base.js';\nimport type { GithubRepositoryPermission } from '../../github/integration.js';\nimport type { GithubIssueReconciler } from '../../github/issue-reconciler.js';\nimport type { GithubPullRequestReconciler, ReconcileRepository } from '../../github/rules.js';\nimport { listPullRequestSubscriptionsForWebhook, retirePullRequestSubscription } from '../../github/subscriptions.js';\nimport { dispatchGithubWebhook, resolveAuthorizedBots } from '../../github/webhook.js';\nimport type {\n  GithubWebhookDispatchIntegration,\n  GithubWebhookNotification,\n  ParsedGithubWebhook,\n} from '../../github/webhook.js';\nimport type { PlatformApiClient } from '../api-client.js';\nimport { PlatformApiError } from '../api-client.js';\n\nconst API_PREFIX = '/v1/server/github-app';\nconst DEFAULT_POLL_INTERVAL_MS = 20_000;\nconst DEFAULT_RECONCILE_INTERVAL_MS = 5 * 60_000;\nconst EVENT_PAGE_SIZE = 500;\nconst MIN_LEASE_TTL_MS = 30_000;\nconst CURSOR_ORG_ID = '__platform_github_event_worker__';\nconst CURSOR_USER_ID = 'worker';\nconst SUPPORTED_EVENTS = new Set([\n  'issues',\n  'issue_comment',\n  'pull_request',\n  'pull_request_review',\n  'pull_request_review_comment',\n]);\nconst AUTHOR_GATED_KINDS = new Set([\n  'issue-comment',\n  'pull-request-comment',\n  'pull-request-review',\n  'pull-request-review-comment',\n]);\nconst AUTHORIZED_PERMISSIONS = new Set<GithubRepositoryPermission>(['admin', 'maintain', 'write']);\nconst PERMISSION_CHECK_TIMEOUT_MS = 5_000;\n\ntype EventCursor = { afterEventId: string } | { afterTimestamp: number };\ntype PlatformGithubEventWorkerSettings = {\n  version: 1;\n  repositories: Record<string, EventCursor>;\n};\n\nexport type PlatformGithubEventStorage = IntegrationStorageHandle<\n  Record<string, unknown>,\n  PlatformGithubEventWorkerSettings,\n  Record<string, unknown>\n>;\n\ntype EventLogEntry = {\n  id: string;\n  deliveryId: string;\n  event: string;\n  payload: unknown;\n};\n\ntype Repository = { id: number; fullName?: string; installationId: number };\n\nexport type PlatformGithubEventDispatchIntegration = GithubWebhookDispatchIntegration;\n\nexport interface PlatformGithubEventWorkerConfig {\n  client: PlatformApiClient;\n  controller: MountedMastraCode['controller'];\n  github: PlatformGithubEventDispatchIntegration;\n  storage: PlatformGithubEventStorage;\n  ingestFactoryEvent?: (event: ParsedGithubWebhook) => Promise<unknown>;\n  reconcileFactoryState?: GithubPullRequestReconciler;\n  reconcileIssuesFactoryState?: GithubIssueReconciler;\n  /** When false the worker skips event tailing and only runs enabled reconciliation sweeps. */\n  pollEventsEnabled?: boolean;\n  intervalMs?: number;\n  /** Legacy shared reconciliation cadence. */\n  reconcileIntervalMs?: number;\n  pullRequestReconcileIntervalMs?: number;\n  issueReconcileIntervalMs?: number;\n  now?: () => number;\n  dispatch?: typeof dispatchGithubWebhook;\n}\n\nexport class PlatformGithubEventWorker extends MastraWorker {\n  readonly name = 'platform-github-events';\n\n  readonly #client: PlatformApiClient;\n  readonly #controller: MountedMastraCode['controller'];\n  readonly #github: PlatformGithubEventDispatchIntegration;\n  readonly #storage: PlatformGithubEventStorage;\n  readonly #ingestFactoryEvent: ((event: ParsedGithubWebhook) => Promise<unknown>) | undefined;\n  readonly #reconcileFactoryState: GithubPullRequestReconciler | undefined;\n  readonly #reconcileIssuesFactoryState: GithubIssueReconciler | undefined;\n  readonly #pollEventsEnabled: boolean;\n  readonly #pullRequestReconcileIntervalMs: number;\n  readonly #issueReconcileIntervalMs: number;\n  readonly #intervalMs: number;\n  readonly #now: () => number;\n  readonly #dispatch: typeof dispatchGithubWebhook;\n  readonly #leaseOwner = randomUUID();\n\n  #running = false;\n  #timer: ReturnType<typeof setTimeout> | undefined;\n  #leaseRenewalTimer: ReturnType<typeof setInterval> | undefined;\n  #inFlight: Promise<void> | undefined;\n  #leaseProvider: LeaseProvider = NoopLeaseProvider;\n  #leaseTtlMs: number;\n  #hasLease = false;\n  #startedAt = 0;\n  #lastPullRequestReconcileAt = 0;\n  #lastIssueReconcileAt = 0;\n  #settings: PlatformGithubEventWorkerSettings = { version: 1, repositories: {} };\n\n  constructor(config: PlatformGithubEventWorkerConfig) {\n    super();\n    this.#client = config.client;\n    this.#controller = config.controller;\n    this.#github = config.github;\n    this.#storage = config.storage;\n    this.#ingestFactoryEvent = config.ingestFactoryEvent;\n    this.#reconcileFactoryState = config.reconcileFactoryState;\n    this.#reconcileIssuesFactoryState = config.reconcileIssuesFactoryState;\n    this.#pollEventsEnabled = config.pollEventsEnabled ?? true;\n    const legacyReconcileIntervalMs = config.reconcileIntervalMs ?? DEFAULT_RECONCILE_INTERVAL_MS;\n    this.#pullRequestReconcileIntervalMs = config.pullRequestReconcileIntervalMs ?? legacyReconcileIntervalMs;\n    this.#issueReconcileIntervalMs = config.issueReconcileIntervalMs ?? legacyReconcileIntervalMs;\n    this.#intervalMs = config.intervalMs ?? DEFAULT_POLL_INTERVAL_MS;\n    if (!Number.isFinite(this.#intervalMs) || this.#intervalMs <= 0) {\n      throw new Error('Platform GitHub event polling interval must be a positive number.');\n    }\n    if (!Number.isFinite(this.#pullRequestReconcileIntervalMs) || this.#pullRequestReconcileIntervalMs <= 0) {\n      throw new Error('Platform GitHub pull request reconcile interval must be a positive number.');\n    }\n    if (!Number.isFinite(this.#issueReconcileIntervalMs) || this.#issueReconcileIntervalMs <= 0) {\n      throw new Error('Platform GitHub issue reconcile interval must be a positive number.');\n    }\n    this.#leaseTtlMs = Math.max(\n      MIN_LEASE_TTL_MS,\n      Math.min(this.#intervalMs, this.#pullRequestReconcileIntervalMs, this.#issueReconcileIntervalMs) * 3,\n    );\n    this.#now = config.now ?? Date.now;\n    this.#dispatch = config.dispatch ?? dispatchGithubWebhook;\n  }\n\n  async init(deps: WorkerDeps): Promise<void> {\n    await super.init(deps);\n    this.#leaseProvider = getLeaseProvider(deps.pubsub);\n  }\n\n  async start(): Promise<void> {\n    if (this.#running) return;\n    if (!this.deps) throw new Error('PlatformGithubEventWorker: call init() before start()');\n\n    this.#startedAt = this.#now() - 1;\n    this.#settings = normalizeSettings(await this.#storage.settings.get(CURSOR_ORG_ID, CURSOR_USER_ID));\n    this.#running = true;\n    this.deps.logger.info('Platform GitHub event polling started', {\n      intervalMs: this.#intervalMs,\n      leaseTtlMs: this.#leaseTtlMs,\n    });\n    this.#schedule(0);\n  }\n\n  async stop(): Promise<void> {\n    if (!this.#running) return;\n    this.#running = false;\n    if (this.#timer) clearTimeout(this.#timer);\n    this.#timer = undefined;\n    this.#stopLeaseRenewal();\n    await this.#inFlight;\n    if (this.#hasLease) {\n      await this.#leaseProvider.releaseLease(this.#leaseKey(), this.#leaseOwner).catch(() => undefined);\n      this.#hasLease = false;\n    }\n  }\n\n  get isRunning(): boolean {\n    return this.#running;\n  }\n\n  #schedule(delayMs: number): void {\n    if (!this.#running) return;\n    this.#timer = setTimeout(() => {\n      this.#timer = undefined;\n      const run = this.#tick();\n      this.#inFlight = run;\n      void run.finally(() => {\n        if (this.#inFlight === run) this.#inFlight = undefined;\n      });\n    }, delayMs);\n    this.#timer.unref?.();\n  }\n\n  async #tick(): Promise<void> {\n    let nextDelay = this.#intervalMs;\n    try {\n      if (!(await this.#ensureLease())) return;\n      nextDelay = await this.#poll();\n    } catch (error) {\n      nextDelay = retryDelay(error, this.#intervalMs);\n      this.deps?.logger.error('Platform GitHub event polling cycle failed', {\n        error: error instanceof Error ? error.message : String(error),\n        retryInMs: nextDelay,\n      });\n    } finally {\n      this.#schedule(nextDelay);\n    }\n  }\n\n  async #ensureLease(): Promise<boolean> {\n    if (this.#hasLease) return true;\n    const result = await this.#leaseProvider.acquireLease(this.#leaseKey(), this.#leaseOwner, this.#leaseTtlMs);\n    this.#hasLease = result.acquired;\n    if (this.#hasLease) this.#startLeaseRenewal();\n    return this.#hasLease;\n  }\n\n  #startLeaseRenewal(): void {\n    if (this.#leaseRenewalTimer) return;\n    this.#leaseRenewalTimer = setInterval(\n      () => {\n        void this.#leaseProvider\n          .renewLease(this.#leaseKey(), this.#leaseOwner, this.#leaseTtlMs)\n          .then(renewed => {\n            if (!renewed) {\n              this.#hasLease = false;\n              this.#stopLeaseRenewal();\n            }\n          })\n          .catch(error => {\n            this.#hasLease = false;\n            this.#stopLeaseRenewal();\n            this.deps?.logger.warn('Platform GitHub event polling lease renewal failed', {\n              error: error instanceof Error ? error.message : String(error),\n            });\n          });\n      },\n      Math.floor(this.#leaseTtlMs / 3),\n    );\n    this.#leaseRenewalTimer.unref?.();\n  }\n\n  #stopLeaseRenewal(): void {\n    if (this.#leaseRenewalTimer) clearInterval(this.#leaseRenewalTimer);\n    this.#leaseRenewalTimer = undefined;\n  }\n\n  async #poll(): Promise<number> {\n    const repositories = await this.#discoverRepositories();\n    let retryInMs = this.#pollEventsEnabled ? this.#intervalMs : this.#reconcileCadence();\n\n    if (this.#pollEventsEnabled) {\n      for (const repository of repositories) {\n        if (!this.#running || !this.#hasLease) break;\n        try {\n          await this.#pollRepository(repository.id);\n        } catch (error) {\n          const delay = retryDelay(error, this.#intervalMs);\n          retryInMs = Math.max(retryInMs, delay);\n          this.deps?.logger.error('Platform GitHub repository event polling failed', {\n            repositoryId: repository.id,\n            error: error instanceof Error ? error.message : String(error),\n            retryInMs: delay,\n          });\n          if (error instanceof PlatformApiError && error.status === 429) break;\n        }\n      }\n    }\n\n    await this.#maybeReconcile(repositories);\n    return retryInMs;\n  }\n\n  #reconcileCadence(): number {\n    const cadences = [\n      this.#reconcileFactoryState ? this.#pullRequestReconcileIntervalMs : undefined,\n      this.#reconcileIssuesFactoryState ? this.#issueReconcileIntervalMs : undefined,\n    ].filter((interval): interval is number => interval !== undefined);\n    return cadences.length > 0 ? Math.min(...cadences) : this.#intervalMs;\n  }\n\n  async #maybeReconcile(repositories: Repository[]): Promise<void> {\n    if (!this.#running || !this.#hasLease) return;\n    const now = this.#now();\n    const reconcilePullRequests = Boolean(\n      this.#reconcileFactoryState && now - this.#lastPullRequestReconcileAt >= this.#pullRequestReconcileIntervalMs,\n    );\n    const reconcileIssues = Boolean(\n      this.#reconcileIssuesFactoryState && now - this.#lastIssueReconcileAt >= this.#issueReconcileIntervalMs,\n    );\n    if (!reconcilePullRequests && !reconcileIssues) return;\n    if (reconcilePullRequests) this.#lastPullRequestReconcileAt = now;\n    if (reconcileIssues) this.#lastIssueReconcileAt = now;\n\n    const targets: ReconcileRepository[] = repositories.flatMap(repository =>\n      repository.fullName\n        ? [{ id: repository.id, fullName: repository.fullName, installationId: repository.installationId }]\n        : [],\n    );\n    if (targets.length === 0) {\n      this.deps?.logger.debug('Platform GitHub reconciliation skipped: no named repositories');\n      return;\n    }\n\n    if (reconcilePullRequests && this.#reconcileFactoryState) {\n      const startedAt = Date.now();\n      try {\n        const { errors, ...counts } = await this.#reconcileFactoryState(targets);\n        const context = { ...counts, candidateRepositories: targets.length, durationMs: Date.now() - startedAt };\n        if (counts.failed > 0) {\n          this.deps?.logger.warn('Platform GitHub pull request reconcile sweep completed with failures', {\n            ...context,\n            errors,\n          });\n        } else if (counts.merged > 0 || counts.closed > 0) {\n          this.deps?.logger.info('Platform GitHub pull request reconcile replayed missed merges/closes', context);\n        } else {\n          this.deps?.logger.info('Platform GitHub pull request reconcile sweep completed', context);\n        }\n      } catch (error) {\n        this.deps?.logger.error('Platform GitHub pull request reconcile failed', {\n          repositories: targets.length,\n          durationMs: Date.now() - startedAt,\n          error: error instanceof Error ? error.message : String(error),\n        });\n      }\n    }\n\n    if (reconcileIssues && this.#reconcileIssuesFactoryState && this.#hasLease) {\n      const startedAt = Date.now();\n      try {\n        const { errors, ...counts } = await this.#reconcileIssuesFactoryState(targets);\n        const context = { ...counts, candidateRepositories: targets.length, durationMs: Date.now() - startedAt };\n        if (counts.failed > 0) {\n          this.deps?.logger.warn('Platform GitHub issue reconcile sweep completed with failures', { ...context, errors });\n        } else if (counts.closed > 0) {\n          this.deps?.logger.info('Platform GitHub issue reconcile replayed closed work items', context);\n        } else if (counts.updated > 0) {\n          this.deps?.logger.info('Platform GitHub issue reconcile patched stale metadata', context);\n        } else {\n          this.deps?.logger.debug('Platform GitHub issue reconcile sweep completed', context);\n        }\n      } catch (error) {\n        this.deps?.logger.error('Platform GitHub issue reconcile failed', {\n          repositories: targets.length,\n          durationMs: Date.now() - startedAt,\n          error: error instanceof Error ? error.message : String(error),\n        });\n      }\n    }\n  }\n\n  async #discoverRepositories(): Promise<Repository[]> {\n    const result = await this.#client.request<{\n      installations: Array<{\n        installationId: number;\n        usable: boolean;\n        suspendedAt: string | null;\n      }>;\n    }>('GET', `${API_PREFIX}/installations`);\n    const repositories = new Map<number, Repository>();\n\n    for (const installation of result.installations) {\n      if (!installation.usable || installation.suspendedAt) continue;\n      const page = await this.#client.request<{ repositories: Array<{ id: number; fullName?: string }> }>(\n        'GET',\n        `${API_PREFIX}/installations/${installation.installationId}/repositories`,\n      );\n      for (const repository of page.repositories) {\n        repositories.set(repository.id, { ...repository, installationId: installation.installationId });\n      }\n    }\n\n    return [...repositories.values()];\n  }\n\n  async #pollRepository(repositoryId: number): Promise<void> {\n    const key = String(repositoryId);\n    if (!this.#settings.repositories[key]) {\n      this.#settings.repositories[key] = { afterTimestamp: this.#startedAt };\n      await this.#saveSettings();\n    }\n\n    while (this.#running && this.#hasLease) {\n      const cursor: EventCursor = this.#settings.repositories[key]!;\n      const query = new URLSearchParams({ limit: String(EVENT_PAGE_SIZE) });\n      if ('afterEventId' in cursor) query.set('afterEventId', cursor.afterEventId);\n      else query.set('afterTimestamp', String(cursor.afterTimestamp));\n\n      const pollStartedAt = performance.now();\n      const page = await this.#client.request<{ events: EventLogEntry[]; nextCursor: string | null }>(\n        'GET',\n        `${API_PREFIX}/repositories/${repositoryId}/events?${query}`,\n      );\n      this.deps?.logger.debug('Platform GitHub repository event poll completed', {\n        repositoryId,\n        eventCount: page.events.length,\n        latencyMs: Math.round(performance.now() - pollStartedAt),\n      });\n      if (page.events.length === 0 || !page.nextCursor) return;\n\n      for (const event of page.events) {\n        if (!this.#running || !this.#hasLease) return;\n        const parsed = parseEvent(event);\n        if (!parsed) {\n          this.deps?.logger.warn('Platform GitHub event log returned a malformed event', {\n            repositoryId,\n            eventId: event.id,\n          });\n          continue;\n        }\n        if (isFactoryIngestedEvent(parsed)) {\n          await this.#ingestFactoryEvent?.(parsed);\n        }\n        const result = await this.#dispatch(parsed, {\n          controller: this.#controller,\n          listSubscriptions: (target, options) =>\n            listPullRequestSubscriptionsForWebhook(target, options, this.#github.integrationStorage),\n          retireSubscription: (id, status) =>\n            retirePullRequestSubscription(id, status, this.#github.integrationStorage),\n          github: this.#github,\n          isAuthorizedSender: notification => this.#isAuthorizedSender(notification),\n          onSenderRejected: notification => {\n            this.deps?.logger.debug('Platform GitHub event dropped: sender not authorized', {\n              deliveryId: event.deliveryId,\n              repository: notification.metadata.repository,\n              sender: notification.metadata.sender,\n              kind: notification.kind,\n            });\n          },\n          onTargetError: (subscription, error) => {\n            this.deps?.logger.error('Platform GitHub event delivery failed for a subscription', {\n              deliveryId: event.deliveryId,\n              subscriptionId: subscription.id,\n              resourceId: subscription.resourceId,\n              threadId: subscription.threadId,\n              error: error instanceof Error ? error.message : String(error),\n            });\n          },\n        });\n        if (result.failed > 0) {\n          this.deps?.logger.warn('Platform GitHub event completed with failed subscription deliveries', {\n            repositoryId,\n            deliveryId: event.deliveryId,\n            delivered: result.delivered,\n            failed: result.failed,\n          });\n        }\n      }\n\n      if (page.nextCursor === ('afterEventId' in cursor ? cursor.afterEventId : undefined)) return;\n      this.#settings.repositories[key] = { afterEventId: page.nextCursor };\n      await this.#saveSettings();\n    }\n  }\n\n  async #isAuthorizedSender(notification: GithubWebhookNotification): Promise<boolean> {\n    if (!AUTHOR_GATED_KINDS.has(notification.kind)) return true;\n    const sender = notification.metadata.sender;\n    const repository = notification.metadata.repository;\n    if (!sender || !repository) return false;\n    const normalizedSender = sender.toLowerCase();\n    const authorizedBots = resolveAuthorizedBots(this.#github.authorizedBots);\n    if (authorizedBots.has(normalizedSender)) return true;\n    // Any other bot is gated purely by the allowlist: a GitHub App never holds a\n    // collaborator permission under its sender login, so falling through to the\n    // permission lookup would only fail closed after a wasted API call.\n    if (notification.metadata.senderType?.toLowerCase() === 'bot' || normalizedSender.endsWith('[bot]')) {\n      return false;\n    }\n\n    const abortController = new AbortController();\n    const timeout = setTimeout(() => abortController.abort(), PERMISSION_CHECK_TIMEOUT_MS);\n    try {\n      const permission = await this.#github.getRepositoryCollaboratorPermission(\n        notification.metadata.installationId,\n        repository,\n        sender,\n        abortController.signal,\n      );\n      return permission !== undefined && AUTHORIZED_PERMISSIONS.has(permission);\n    } catch {\n      return false;\n    } finally {\n      clearTimeout(timeout);\n    }\n  }\n\n  async #saveSettings(): Promise<void> {\n    await this.#storage.settings.save(CURSOR_ORG_ID, CURSOR_USER_ID, this.#settings);\n  }\n\n  #leaseKey(): string {\n    return `${this.name}:${this.#storage.integrationId}`;\n  }\n}\n\nfunction getLeaseProvider(pubsub: PubSub): LeaseProvider {\n  const getProvider = (pubsub as PubSub & { getLeaseProvider?: () => LeaseProvider | undefined }).getLeaseProvider;\n  if (typeof getProvider === 'function') return getProvider.call(pubsub) ?? NoopLeaseProvider;\n  return isLeaseProvider(pubsub) ? pubsub : NoopLeaseProvider;\n}\n\nfunction normalizeSettings(value: PlatformGithubEventWorkerSettings | null): PlatformGithubEventWorkerSettings {\n  if (!value || value.version !== 1 || !value.repositories || typeof value.repositories !== 'object') {\n    return { version: 1, repositories: {} };\n  }\n  return { version: 1, repositories: { ...value.repositories } };\n}\n\n// Events the polling worker forwards to the factory rules engine. Closures\n// let the reconciler finalize cards; `synchronize` and `review_requested` on a\n// pull request are the two triggers the review board's re-review path listens\n// for. Direct-webhook consumers ingest every parsed event; the platform path\n// gates because most other events (comments, reviews, edits) only interest the\n// subscription dispatcher, not the factory rules.\nfunction isFactoryIngestedEvent(event: ParsedGithubWebhook): boolean {\n  if ((event.event === 'issues' || event.event === 'pull_request') && event.payload.action === 'closed') {\n    return true;\n  }\n  if (event.event === 'pull_request') {\n    const action = event.payload.action;\n    if (action === 'synchronize' || action === 'review_requested') return true;\n  }\n  return false;\n}\n\nfunction parseEvent(event: EventLogEntry): ParsedGithubWebhook | null {\n  if (\n    !event.id ||\n    !event.deliveryId ||\n    !SUPPORTED_EVENTS.has(event.event) ||\n    !event.payload ||\n    typeof event.payload !== 'object' ||\n    Array.isArray(event.payload)\n  ) {\n    return null;\n  }\n  return {\n    event: event.event,\n    deliveryId: event.deliveryId,\n    payload: event.payload as Record<string, unknown>,\n  };\n}\n\nfunction retryDelay(error: unknown, fallbackMs: number): number {\n  if (error instanceof PlatformApiError && error.status === 429 && error.retryAfterSeconds !== null) {\n    return Math.max(fallbackMs, error.retryAfterSeconds * 1_000);\n  }\n  return fallbackMs;\n}\n"],"mappings":";;;;;;;AAsBA,MAAM,aAAa;AACnB,MAAM,2BAA2B;AACjC,MAAM,gCAAgC,IAAI;AAC1C,MAAM,kBAAkB;AACxB,MAAM,mBAAmB;AACzB,MAAM,gBAAgB;AACtB,MAAM,iBAAiB;AACvB,MAAM,mCAAmB,IAAI,IAAI;CAC/B;CACA;CACA;CACA;CACA;AACF,CAAC;AACD,MAAM,qCAAqB,IAAI,IAAI;CACjC;CACA;CACA;CACA;AACF,CAAC;AACD,MAAM,yCAAyB,IAAI,IAAgC;CAAC;CAAS;CAAY;AAAO,CAAC;AACjG,MAAM,8BAA8B;AA4CpC,IAAa,4BAAb,cAA+C,aAAa;CAC1D,OAAgB;CAEhB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,cAAuB,WAAW;CAElC,WAAW;CACX;CACA;CACA;CACA,iBAAgC;CAChC;CACA,YAAY;CACZ,aAAa;CACb,8BAA8B;CAC9B,wBAAwB;CACxB,YAA+C;EAAE,SAAS;EAAG,cAAc,CAAC;CAAE;CAE9E,YAAY,QAAyC;EACnD,MAAM;EACN,KAAKA,UAAU,OAAO;EACtB,KAAKC,cAAc,OAAO;EAC1B,KAAKC,UAAU,OAAO;EACtB,KAAKC,WAAW,OAAO;EACvB,KAAKC,sBAAsB,OAAO;EAClC,KAAKC,yBAAyB,OAAO;EACrC,KAAKC,+BAA+B,OAAO;EAC3C,KAAKC,qBAAqB,OAAO,qBAAqB;EACtD,MAAM,4BAA4B,OAAO,uBAAuB;EAChE,KAAKC,kCAAkC,OAAO,kCAAkC;EAChF,KAAKC,4BAA4B,OAAO,4BAA4B;EACpE,KAAKC,cAAc,OAAO,cAAc;EACxC,IAAI,CAAC,OAAO,SAAS,KAAKA,WAAW,KAAK,KAAKA,eAAe,GAC5D,MAAM,IAAI,MAAM,mEAAmE;EAErF,IAAI,CAAC,OAAO,SAAS,KAAKF,+BAA+B,KAAK,KAAKA,mCAAmC,GACpG,MAAM,IAAI,MAAM,4EAA4E;EAE9F,IAAI,CAAC,OAAO,SAAS,KAAKC,yBAAyB,KAAK,KAAKA,6BAA6B,GACxF,MAAM,IAAI,MAAM,qEAAqE;EAEvF,KAAKK,cAAc,KAAK,IACtB,kBACA,KAAK,IAAI,KAAKJ,aAAa,KAAKF,iCAAiC,KAAKC,yBAAyB,IAAI,CACrG;EACA,KAAKE,OAAO,OAAO,OAAO,KAAK;EAC/B,KAAKC,YAAY,OAAO,YAAY;CACtC;CAEA,MAAM,KAAK,MAAiC;EAC1C,MAAM,MAAM,KAAK,IAAI;EACrB,KAAKG,iBAAiB,iBAAiB,KAAK,MAAM;CACpD;CAEA,MAAM,QAAuB;EAC3B,IAAI,KAAKC,UAAU;EACnB,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,MAAM,uDAAuD;EAEvF,KAAKC,aAAa,KAAKN,KAAK,IAAI;EAChC,KAAKO,YAAY,kBAAkB,MAAM,KAAKf,SAAS,SAAS,IAAI,eAAe,cAAc,CAAC;EAClG,KAAKa,WAAW;EAChB,KAAK,KAAK,OAAO,KAAK,yCAAyC;GAC7D,YAAY,KAAKN;GACjB,YAAY,KAAKI;EACnB,CAAC;EACD,KAAKK,UAAU,CAAC;CAClB;CAEA,MAAM,OAAsB;EAC1B,IAAI,CAAC,KAAKH,UAAU;EACpB,KAAKA,WAAW;EAChB,IAAI,KAAKI,QAAQ,aAAa,KAAKA,MAAM;EACzC,KAAKA,SAAS,KAAA;EACd,KAAKC,kBAAkB;EACvB,MAAM,KAAKC;EACX,IAAI,KAAKC,WAAW;GAClB,MAAM,KAAKR,eAAe,aAAa,KAAKS,UAAU,GAAG,KAAKX,WAAW,CAAC,CAAC,YAAY,KAAA,CAAS;GAChG,KAAKU,YAAY;EACnB;CACF;CAEA,IAAI,YAAqB;EACvB,OAAO,KAAKP;CACd;CAEA,UAAU,SAAuB;EAC/B,IAAI,CAAC,KAAKA,UAAU;EACpB,KAAKI,SAAS,iBAAiB;GAC7B,KAAKA,SAAS,KAAA;GACd,MAAM,MAAM,KAAKK,MAAM;GACvB,KAAKH,YAAY;GACjB,IAAS,cAAc;IACrB,IAAI,KAAKA,cAAc,KAAK,KAAKA,YAAY,KAAA;GAC/C,CAAC;EACH,GAAG,OAAO;EACV,KAAKF,OAAO,QAAQ;CACtB;CAEA,MAAMK,QAAuB;EAC3B,IAAI,YAAY,KAAKf;EACrB,IAAI;GACF,IAAI,CAAE,MAAM,KAAKgB,aAAa,GAAI;GAClC,YAAY,MAAM,KAAKC,MAAM;EAC/B,SAAS,OAAO;GACd,YAAY,WAAW,OAAO,KAAKjB,WAAW;GAC9C,KAAK,MAAM,OAAO,MAAM,8CAA8C;IACpE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC5D,WAAW;GACb,CAAC;EACH,UAAU;GACR,KAAKS,UAAU,SAAS;EAC1B;CACF;CAEA,MAAMO,eAAiC;EACrC,IAAI,KAAKH,WAAW,OAAO;EAC3B,MAAM,SAAS,MAAM,KAAKR,eAAe,aAAa,KAAKS,UAAU,GAAG,KAAKX,aAAa,KAAKC,WAAW;EAC1G,KAAKS,YAAY,OAAO;EACxB,IAAI,KAAKA,WAAW,KAAKK,mBAAmB;EAC5C,OAAO,KAAKL;CACd;CAEA,qBAA2B;EACzB,IAAI,KAAKM,oBAAoB;EAC7B,KAAKA,qBAAqB,kBAClB;GACJ,KAAUd,eACP,WAAW,KAAKS,UAAU,GAAG,KAAKX,aAAa,KAAKC,WAAW,CAAC,CAChE,MAAK,YAAW;IACf,IAAI,CAAC,SAAS;KACZ,KAAKS,YAAY;KACjB,KAAKF,kBAAkB;IACzB;GACF,CAAC,CAAC,CACD,OAAM,UAAS;IACd,KAAKE,YAAY;IACjB,KAAKF,kBAAkB;IACvB,KAAK,MAAM,OAAO,KAAK,sDAAsD,EAC3E,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC9D,CAAC;GACH,CAAC;EACL,GACA,KAAK,MAAM,KAAKP,cAAc,CAAC,CACjC;EACA,KAAKe,mBAAmB,QAAQ;CAClC;CAEA,oBAA0B;EACxB,IAAI,KAAKA,oBAAoB,cAAc,KAAKA,kBAAkB;EAClE,KAAKA,qBAAqB,KAAA;CAC5B;CAEA,MAAMF,QAAyB;EAC7B,MAAM,eAAe,MAAM,KAAKG,sBAAsB;EACtD,IAAI,YAAY,KAAKvB,qBAAqB,KAAKG,cAAc,KAAKqB,kBAAkB;EAEpF,IAAI,KAAKxB,oBACP,KAAK,MAAM,cAAc,cAAc;GACrC,IAAI,CAAC,KAAKS,YAAY,CAAC,KAAKO,WAAW;GACvC,IAAI;IACF,MAAM,KAAKS,gBAAgB,WAAW,EAAE;GAC1C,SAAS,OAAO;IACd,MAAM,QAAQ,WAAW,OAAO,KAAKtB,WAAW;IAChD,YAAY,KAAK,IAAI,WAAW,KAAK;IACrC,KAAK,MAAM,OAAO,MAAM,mDAAmD;KACzE,cAAc,WAAW;KACzB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KAC5D,WAAW;IACb,CAAC;IACD,IAAI,iBAAiB,oBAAoB,MAAM,WAAW,KAAK;GACjE;EACF;EAGF,MAAM,KAAKuB,gBAAgB,YAAY;EACvC,OAAO;CACT;CAEA,oBAA4B;EAC1B,MAAM,WAAW,CACf,KAAK5B,yBAAyB,KAAKG,kCAAkC,KAAA,GACrE,KAAKF,+BAA+B,KAAKG,4BAA4B,KAAA,CACvE,CAAC,CAAC,QAAQ,aAAiC,aAAa,KAAA,CAAS;EACjE,OAAO,SAAS,SAAS,IAAI,KAAK,IAAI,GAAG,QAAQ,IAAI,KAAKC;CAC5D;CAEA,MAAMuB,gBAAgB,cAA2C;EAC/D,IAAI,CAAC,KAAKjB,YAAY,CAAC,KAAKO,WAAW;EACvC,MAAM,MAAM,KAAKZ,KAAK;EACtB,MAAM,wBAAwB,QAC5B,KAAKN,0BAA0B,MAAM,KAAK6B,+BAA+B,KAAK1B,+BAChF;EACA,MAAM,kBAAkB,QACtB,KAAKF,gCAAgC,MAAM,KAAK6B,yBAAyB,KAAK1B,yBAChF;EACA,IAAI,CAAC,yBAAyB,CAAC,iBAAiB;EAChD,IAAI,uBAAuB,KAAKyB,8BAA8B;EAC9D,IAAI,iBAAiB,KAAKC,wBAAwB;EAElD,MAAM,UAAiC,aAAa,SAAQ,eAC1D,WAAW,WACP,CAAC;GAAE,IAAI,WAAW;GAAI,UAAU,WAAW;GAAU,gBAAgB,WAAW;EAAe,CAAC,IAChG,CAAC,CACP;EACA,IAAI,QAAQ,WAAW,GAAG;GACxB,KAAK,MAAM,OAAO,MAAM,+DAA+D;GACvF;EACF;EAEA,IAAI,yBAAyB,KAAK9B,wBAAwB;GACxD,MAAM,YAAY,KAAK,IAAI;GAC3B,IAAI;IACF,MAAM,EAAE,QAAQ,GAAG,WAAW,MAAM,KAAKA,uBAAuB,OAAO;IACvE,MAAM,UAAU;KAAE,GAAG;KAAQ,uBAAuB,QAAQ;KAAQ,YAAY,KAAK,IAAI,IAAI;IAAU;IACvG,IAAI,OAAO,SAAS,GAClB,KAAK,MAAM,OAAO,KAAK,wEAAwE;KAC7F,GAAG;KACH;IACF,CAAC;SACI,IAAI,OAAO,SAAS,KAAK,OAAO,SAAS,GAC9C,KAAK,MAAM,OAAO,KAAK,wEAAwE,OAAO;SAEtG,KAAK,MAAM,OAAO,KAAK,0DAA0D,OAAO;GAE5F,SAAS,OAAO;IACd,KAAK,MAAM,OAAO,MAAM,iDAAiD;KACvE,cAAc,QAAQ;KACtB,YAAY,KAAK,IAAI,IAAI;KACzB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC9D,CAAC;GACH;EACF;EAEA,IAAI,mBAAmB,KAAKC,gCAAgC,KAAKiB,WAAW;GAC1E,MAAM,YAAY,KAAK,IAAI;GAC3B,IAAI;IACF,MAAM,EAAE,QAAQ,GAAG,WAAW,MAAM,KAAKjB,6BAA6B,OAAO;IAC7E,MAAM,UAAU;KAAE,GAAG;KAAQ,uBAAuB,QAAQ;KAAQ,YAAY,KAAK,IAAI,IAAI;IAAU;IACvG,IAAI,OAAO,SAAS,GAClB,KAAK,MAAM,OAAO,KAAK,iEAAiE;KAAE,GAAG;KAAS;IAAO,CAAC;SACzG,IAAI,OAAO,SAAS,GACzB,KAAK,MAAM,OAAO,KAAK,8DAA8D,OAAO;SACvF,IAAI,OAAO,UAAU,GAC1B,KAAK,MAAM,OAAO,KAAK,0DAA0D,OAAO;SAExF,KAAK,MAAM,OAAO,MAAM,mDAAmD,OAAO;GAEtF,SAAS,OAAO;IACd,KAAK,MAAM,OAAO,MAAM,0CAA0C;KAChE,cAAc,QAAQ;KACtB,YAAY,KAAK,IAAI,IAAI;KACzB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC9D,CAAC;GACH;EACF;CACF;CAEA,MAAMwB,wBAA+C;EACnD,MAAM,SAAS,MAAM,KAAK9B,QAAQ,QAM/B,OAAO,GAAG,WAAW,eAAe;EACvC,MAAM,+BAAe,IAAI,IAAwB;EAEjD,KAAK,MAAM,gBAAgB,OAAO,eAAe;GAC/C,IAAI,CAAC,aAAa,UAAU,aAAa,aAAa;GACtD,MAAM,OAAO,MAAM,KAAKA,QAAQ,QAC9B,OACA,GAAG,WAAW,iBAAiB,aAAa,eAAe,cAC7D;GACA,KAAK,MAAM,cAAc,KAAK,cAC5B,aAAa,IAAI,WAAW,IAAI;IAAE,GAAG;IAAY,gBAAgB,aAAa;GAAe,CAAC;EAElG;EAEA,OAAO,CAAC,GAAG,aAAa,OAAO,CAAC;CAClC;CAEA,MAAMgC,gBAAgB,cAAqC;EACzD,MAAM,MAAM,OAAO,YAAY;EAC/B,IAAI,CAAC,KAAKd,UAAU,aAAa,MAAM;GACrC,KAAKA,UAAU,aAAa,OAAO,EAAE,gBAAgB,KAAKD,WAAW;GACrE,MAAM,KAAKmB,cAAc;EAC3B;EAEA,OAAO,KAAKpB,YAAY,KAAKO,WAAW;GACtC,MAAM,SAAsB,KAAKL,UAAU,aAAa;GACxD,MAAM,QAAQ,IAAI,gBAAgB,EAAE,OAAO,OAAO,eAAe,EAAE,CAAC;GACpE,IAAI,kBAAkB,QAAQ,MAAM,IAAI,gBAAgB,OAAO,YAAY;QACtE,MAAM,IAAI,kBAAkB,OAAO,OAAO,cAAc,CAAC;GAE9D,MAAM,gBAAgB,YAAY,IAAI;GACtC,MAAM,OAAO,MAAM,KAAKlB,QAAQ,QAC9B,OACA,GAAG,WAAW,gBAAgB,aAAa,UAAU,OACvD;GACA,KAAK,MAAM,OAAO,MAAM,mDAAmD;IACzE;IACA,YAAY,KAAK,OAAO;IACxB,WAAW,KAAK,MAAM,YAAY,IAAI,IAAI,aAAa;GACzD,CAAC;GACD,IAAI,KAAK,OAAO,WAAW,KAAK,CAAC,KAAK,YAAY;GAElD,KAAK,MAAM,SAAS,KAAK,QAAQ;IAC/B,IAAI,CAAC,KAAKgB,YAAY,CAAC,KAAKO,WAAW;IACvC,MAAM,SAAS,WAAW,KAAK;IAC/B,IAAI,CAAC,QAAQ;KACX,KAAK,MAAM,OAAO,KAAK,wDAAwD;MAC7E;MACA,SAAS,MAAM;KACjB,CAAC;KACD;IACF;IACA,IAAI,uBAAuB,MAAM,GAC/B,MAAM,KAAKnB,sBAAsB,MAAM;IAEzC,MAAM,SAAS,MAAM,KAAKQ,UAAU,QAAQ;KAC1C,YAAY,KAAKX;KACjB,oBAAoB,QAAQ,YAC1B,uCAAuC,QAAQ,SAAS,KAAKC,QAAQ,kBAAkB;KACzF,qBAAqB,IAAI,WACvB,8BAA8B,IAAI,QAAQ,KAAKA,QAAQ,kBAAkB;KAC3E,QAAQ,KAAKA;KACb,qBAAoB,iBAAgB,KAAKmC,oBAAoB,YAAY;KACzE,mBAAkB,iBAAgB;MAChC,KAAK,MAAM,OAAO,MAAM,wDAAwD;OAC9E,YAAY,MAAM;OAClB,YAAY,aAAa,SAAS;OAClC,QAAQ,aAAa,SAAS;OAC9B,MAAM,aAAa;MACrB,CAAC;KACH;KACA,gBAAgB,cAAc,UAAU;MACtC,KAAK,MAAM,OAAO,MAAM,4DAA4D;OAClF,YAAY,MAAM;OAClB,gBAAgB,aAAa;OAC7B,YAAY,aAAa;OACzB,UAAU,aAAa;OACvB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;MAC9D,CAAC;KACH;IACF,CAAC;IACD,IAAI,OAAO,SAAS,GAClB,KAAK,MAAM,OAAO,KAAK,uEAAuE;KAC5F;KACA,YAAY,MAAM;KAClB,WAAW,OAAO;KAClB,QAAQ,OAAO;IACjB,CAAC;GAEL;GAEA,IAAI,KAAK,gBAAgB,kBAAkB,SAAS,OAAO,eAAe,KAAA,IAAY;GACtF,KAAKnB,UAAU,aAAa,OAAO,EAAE,cAAc,KAAK,WAAW;GACnE,MAAM,KAAKkB,cAAc;EAC3B;CACF;CAEA,MAAMC,oBAAoB,cAA2D;EACnF,IAAI,CAAC,mBAAmB,IAAI,aAAa,IAAI,GAAG,OAAO;EACvD,MAAM,SAAS,aAAa,SAAS;EACrC,MAAM,aAAa,aAAa,SAAS;EACzC,IAAI,CAAC,UAAU,CAAC,YAAY,OAAO;EACnC,MAAM,mBAAmB,OAAO,YAAY;EAE5C,IADuB,sBAAsB,KAAKnC,QAAQ,cACzC,CAAC,CAAC,IAAI,gBAAgB,GAAG,OAAO;EAIjD,IAAI,aAAa,SAAS,YAAY,YAAY,MAAM,SAAS,iBAAiB,SAAS,OAAO,GAChG,OAAO;EAGT,MAAM,kBAAkB,IAAI,gBAAgB;EAC5C,MAAM,UAAU,iBAAiB,gBAAgB,MAAM,GAAG,2BAA2B;EACrF,IAAI;GACF,MAAM,aAAa,MAAM,KAAKA,QAAQ,oCACpC,aAAa,SAAS,gBACtB,YACA,QACA,gBAAgB,MAClB;GACA,OAAO,eAAe,KAAA,KAAa,uBAAuB,IAAI,UAAU;EAC1E,QAAQ;GACN,OAAO;EACT,UAAU;GACR,aAAa,OAAO;EACtB;CACF;CAEA,MAAMkC,gBAA+B;EACnC,MAAM,KAAKjC,SAAS,SAAS,KAAK,eAAe,gBAAgB,KAAKe,SAAS;CACjF;CAEA,YAAoB;EAClB,OAAO,GAAG,KAAK,KAAK,GAAG,KAAKf,SAAS;CACvC;AACF;AAEA,SAAS,iBAAiB,QAA+B;CACvD,MAAM,cAAe,OAA2E;CAChG,IAAI,OAAO,gBAAgB,YAAY,OAAO,YAAY,KAAK,MAAM,KAAK;CAC1E,OAAO,gBAAgB,MAAM,IAAI,SAAS;AAC5C;AAEA,SAAS,kBAAkB,OAAoF;CAC7G,IAAI,CAAC,SAAS,MAAM,YAAY,KAAK,CAAC,MAAM,gBAAgB,OAAO,MAAM,iBAAiB,UACxF,OAAO;EAAE,SAAS;EAAG,cAAc,CAAC;CAAE;CAExC,OAAO;EAAE,SAAS;EAAG,cAAc,EAAE,GAAG,MAAM,aAAa;CAAE;AAC/D;AAQA,SAAS,uBAAuB,OAAqC;CACnE,KAAK,MAAM,UAAU,YAAY,MAAM,UAAU,mBAAmB,MAAM,QAAQ,WAAW,UAC3F,OAAO;CAET,IAAI,MAAM,UAAU,gBAAgB;EAClC,MAAM,SAAS,MAAM,QAAQ;EAC7B,IAAI,WAAW,iBAAiB,WAAW,oBAAoB,OAAO;CACxE;CACA,OAAO;AACT;AAEA,SAAS,WAAW,OAAkD;CACpE,IACE,CAAC,MAAM,MACP,CAAC,MAAM,cACP,CAAC,iBAAiB,IAAI,MAAM,KAAK,KACjC,CAAC,MAAM,WACP,OAAO,MAAM,YAAY,YACzB,MAAM,QAAQ,MAAM,OAAO,GAE3B,OAAO;CAET,OAAO;EACL,OAAO,MAAM;EACb,YAAY,MAAM;EAClB,SAAS,MAAM;CACjB;AACF;AAEA,SAAS,WAAW,OAAgB,YAA4B;CAC9D,IAAI,iBAAiB,oBAAoB,MAAM,WAAW,OAAO,MAAM,sBAAsB,MAC3F,OAAO,KAAK,IAAI,YAAY,MAAM,oBAAoB,GAAK;CAE7D,OAAO;AACT"}
+{"version":3,"file":"event-worker.js","names":["#client","#controller","#github","#storage","#ingestFactoryEvent","#reconcileFactoryState","#reconcileIssuesFactoryState","#sweepBaseCheckpoints","#pollEventsEnabled","#pullRequestReconcileIntervalMs","#issueReconcileIntervalMs","#intervalMs","#now","#dispatch","#sourceControl","#leaseOwner","#leaseTtlMs","#leaseProvider","#running","#startedAt","#settings","#schedule","#timer","#stopLeaseRenewal","#inFlight","#hasLease","#leaseKey","#tick","#ensureLease","#poll","#startLeaseRenewal","#leaseRenewalTimer","#discoverRepositories","#reconcileCadence","#pollRepository","#maybeReconcile","#lastPullRequestReconcileAt","#lastIssueReconcileAt","#saveSettings","#isAuthorizedSender"],"sources":["../../../../src/integrations/platform/github/event-worker.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\n\nimport type { MountedMastraCode } from '@mastra/code-sdk';\nimport { isLeaseProvider, NoopLeaseProvider } from '@mastra/core/events';\nimport type { LeaseProvider, PubSub } from '@mastra/core/events';\nimport { MastraWorker } from '@mastra/core/worker';\nimport type { WorkerDeps } from '@mastra/core/worker';\n\nimport type { IntegrationStorageHandle } from '../../../storage/domains/integrations/base.js';\nimport type { GithubRepositoryPermission } from '../../github/integration.js';\nimport type { GithubIssueReconciler } from '../../github/issue-reconciler.js';\nimport type { GithubReconcileRepositorySource } from '../../github/reconcile-worker.js';\nimport type { GithubPullRequestReconciler, ReconcileRepository } from '../../github/rules.js';\nimport { listPullRequestSubscriptionsForWebhook, retirePullRequestSubscription } from '../../github/subscriptions.js';\nimport { dispatchGithubWebhook, isFactoryAppSender, resolveAuthorizedBots } from '../../github/webhook.js';\nimport type {\n  GithubWebhookDispatchIntegration,\n  GithubWebhookNotification,\n  ParsedGithubWebhook,\n} from '../../github/webhook.js';\nimport type { PlatformApiClient } from '../api-client.js';\nimport { PlatformApiError } from '../api-client.js';\n\nconst API_PREFIX = '/v1/server/github-app';\nconst DEFAULT_POLL_INTERVAL_MS = 20_000;\nconst DEFAULT_RECONCILE_INTERVAL_MS = 5 * 60_000;\nconst EVENT_PAGE_SIZE = 500;\nconst MIN_LEASE_TTL_MS = 30_000;\nconst CURSOR_ORG_ID = '__platform_github_event_worker__';\nconst CURSOR_USER_ID = 'worker';\nconst SUPPORTED_EVENTS = new Set([\n  'issues',\n  'issue_comment',\n  'pull_request',\n  'pull_request_review',\n  'pull_request_review_comment',\n  // Pushes never reach the subscription dispatcher; they feed the factory\n  // ingest path so base checkpoints rebuild on default-branch updates.\n  'push',\n]);\n// Kinds emitted by `classifyGithubWebhook` that carry untrusted sender-authored\n// content and must pass the sender authorization gate below.\nconst AUTHOR_GATED_KINDS = new Set([\n  'issue-comment-created',\n  'review-comment-created',\n  'review-approved',\n  'review-changes-requested',\n  'review-submitted',\n  'review-dismissed',\n]);\nconst AUTHORIZED_PERMISSIONS = new Set<GithubRepositoryPermission>(['admin', 'maintain', 'write']);\nconst PERMISSION_CHECK_TIMEOUT_MS = 5_000;\n\ntype EventCursor = { afterEventId: string } | { afterTimestamp: number };\ntype PlatformGithubEventWorkerSettings = {\n  version: 1;\n  repositories: Record<string, EventCursor>;\n};\n\nexport type PlatformGithubEventStorage = IntegrationStorageHandle<\n  Record<string, unknown>,\n  PlatformGithubEventWorkerSettings,\n  Record<string, unknown>\n>;\n\ntype EventLogEntry = {\n  id: string;\n  deliveryId: string;\n  event: string;\n  payload: unknown;\n};\n\ntype Repository = { id: number; fullName?: string; installationId: number };\n\nexport type PlatformGithubEventDispatchIntegration = GithubWebhookDispatchIntegration;\n\nexport interface PlatformGithubEventWorkerConfig {\n  client: PlatformApiClient;\n  controller: MountedMastraCode['controller'];\n  github: PlatformGithubEventDispatchIntegration;\n  storage: PlatformGithubEventStorage;\n  /**\n   * Source-control storage used to resolve the set of repositories the worker\n   * should poll. The worker restricts itself to `(installation, repository)`\n   * pairs linked to a factory project — the same set the reconciler uses —\n   * so polling scales with Factory usage, not with the size of the underlying\n   * GitHub org.\n   */\n  sourceControl: GithubReconcileRepositorySource;\n  ingestFactoryEvent?: (event: ParsedGithubWebhook) => Promise<unknown>;\n  reconcileFactoryState?: GithubPullRequestReconciler;\n  reconcileIssuesFactoryState?: GithubIssueReconciler;\n  /** Base-checkpoint freshness sweep, run after the reconcilers within the lease. */\n  sweepBaseCheckpoints?: () => Promise<void>;\n  /** When false the worker skips event tailing and only runs enabled reconciliation sweeps. */\n  pollEventsEnabled?: boolean;\n  intervalMs?: number;\n  /** Legacy shared reconciliation cadence. */\n  reconcileIntervalMs?: number;\n  pullRequestReconcileIntervalMs?: number;\n  issueReconcileIntervalMs?: number;\n  now?: () => number;\n  dispatch?: typeof dispatchGithubWebhook;\n}\n\nexport class PlatformGithubEventWorker extends MastraWorker {\n  readonly name = 'platform-github-events';\n\n  readonly #client: PlatformApiClient;\n  readonly #controller: MountedMastraCode['controller'];\n  readonly #github: PlatformGithubEventDispatchIntegration;\n  readonly #storage: PlatformGithubEventStorage;\n  readonly #ingestFactoryEvent: ((event: ParsedGithubWebhook) => Promise<unknown>) | undefined;\n  readonly #reconcileFactoryState: GithubPullRequestReconciler | undefined;\n  readonly #reconcileIssuesFactoryState: GithubIssueReconciler | undefined;\n  readonly #sweepBaseCheckpoints: (() => Promise<void>) | undefined;\n  readonly #pollEventsEnabled: boolean;\n  readonly #pullRequestReconcileIntervalMs: number;\n  readonly #issueReconcileIntervalMs: number;\n  readonly #intervalMs: number;\n  readonly #now: () => number;\n  readonly #dispatch: typeof dispatchGithubWebhook;\n  readonly #sourceControl: GithubReconcileRepositorySource;\n  readonly #leaseOwner = randomUUID();\n\n  #running = false;\n  #timer: ReturnType<typeof setTimeout> | undefined;\n  #leaseRenewalTimer: ReturnType<typeof setInterval> | undefined;\n  #inFlight: Promise<void> | undefined;\n  #leaseProvider: LeaseProvider = NoopLeaseProvider;\n  #leaseTtlMs: number;\n  #hasLease = false;\n  #startedAt = 0;\n  #lastPullRequestReconcileAt = 0;\n  #lastIssueReconcileAt = 0;\n  #settings: PlatformGithubEventWorkerSettings = { version: 1, repositories: {} };\n\n  constructor(config: PlatformGithubEventWorkerConfig) {\n    super();\n    this.#client = config.client;\n    this.#controller = config.controller;\n    this.#github = config.github;\n    this.#storage = config.storage;\n    this.#ingestFactoryEvent = config.ingestFactoryEvent;\n    this.#reconcileFactoryState = config.reconcileFactoryState;\n    this.#reconcileIssuesFactoryState = config.reconcileIssuesFactoryState;\n    this.#sweepBaseCheckpoints = config.sweepBaseCheckpoints;\n    this.#pollEventsEnabled = config.pollEventsEnabled ?? true;\n    const legacyReconcileIntervalMs = config.reconcileIntervalMs ?? DEFAULT_RECONCILE_INTERVAL_MS;\n    this.#pullRequestReconcileIntervalMs = config.pullRequestReconcileIntervalMs ?? legacyReconcileIntervalMs;\n    this.#issueReconcileIntervalMs = config.issueReconcileIntervalMs ?? legacyReconcileIntervalMs;\n    this.#intervalMs = config.intervalMs ?? DEFAULT_POLL_INTERVAL_MS;\n    if (!Number.isFinite(this.#intervalMs) || this.#intervalMs <= 0) {\n      throw new Error('Platform GitHub event polling interval must be a positive number.');\n    }\n    if (!Number.isFinite(this.#pullRequestReconcileIntervalMs) || this.#pullRequestReconcileIntervalMs <= 0) {\n      throw new Error('Platform GitHub pull request reconcile interval must be a positive number.');\n    }\n    if (!Number.isFinite(this.#issueReconcileIntervalMs) || this.#issueReconcileIntervalMs <= 0) {\n      throw new Error('Platform GitHub issue reconcile interval must be a positive number.');\n    }\n    this.#leaseTtlMs = Math.max(\n      MIN_LEASE_TTL_MS,\n      Math.min(this.#intervalMs, this.#pullRequestReconcileIntervalMs, this.#issueReconcileIntervalMs) * 3,\n    );\n    this.#now = config.now ?? Date.now;\n    this.#dispatch = config.dispatch ?? dispatchGithubWebhook;\n    this.#sourceControl = config.sourceControl;\n  }\n\n  async init(deps: WorkerDeps): Promise<void> {\n    await super.init(deps);\n    this.#leaseProvider = getLeaseProvider(deps.pubsub);\n  }\n\n  async start(): Promise<void> {\n    if (this.#running) return;\n    if (!this.deps) throw new Error('PlatformGithubEventWorker: call init() before start()');\n\n    this.#startedAt = this.#now() - 1;\n    this.#settings = normalizeSettings(await this.#storage.settings.get(CURSOR_ORG_ID, CURSOR_USER_ID));\n    this.#running = true;\n    this.deps.logger.info('Platform GitHub event polling started', {\n      intervalMs: this.#intervalMs,\n      leaseTtlMs: this.#leaseTtlMs,\n    });\n    this.#schedule(0);\n  }\n\n  async stop(): Promise<void> {\n    if (!this.#running) return;\n    this.#running = false;\n    if (this.#timer) clearTimeout(this.#timer);\n    this.#timer = undefined;\n    this.#stopLeaseRenewal();\n    await this.#inFlight;\n    if (this.#hasLease) {\n      await this.#leaseProvider.releaseLease(this.#leaseKey(), this.#leaseOwner).catch(() => undefined);\n      this.#hasLease = false;\n    }\n  }\n\n  get isRunning(): boolean {\n    return this.#running;\n  }\n\n  #schedule(delayMs: number): void {\n    if (!this.#running) return;\n    this.#timer = setTimeout(() => {\n      this.#timer = undefined;\n      const run = this.#tick();\n      this.#inFlight = run;\n      void run.finally(() => {\n        if (this.#inFlight === run) this.#inFlight = undefined;\n      });\n    }, delayMs);\n    this.#timer.unref?.();\n  }\n\n  async #tick(): Promise<void> {\n    let nextDelay = this.#intervalMs;\n    try {\n      if (!(await this.#ensureLease())) return;\n      nextDelay = await this.#poll();\n    } catch (error) {\n      nextDelay = retryDelay(error, this.#intervalMs);\n      this.deps?.logger.error('Platform GitHub event polling cycle failed', {\n        error: error instanceof Error ? error.message : String(error),\n        retryInMs: nextDelay,\n      });\n    } finally {\n      this.#schedule(nextDelay);\n    }\n  }\n\n  async #ensureLease(): Promise<boolean> {\n    if (this.#hasLease) return true;\n    const result = await this.#leaseProvider.acquireLease(this.#leaseKey(), this.#leaseOwner, this.#leaseTtlMs);\n    this.#hasLease = result.acquired;\n    if (this.#hasLease) this.#startLeaseRenewal();\n    return this.#hasLease;\n  }\n\n  #startLeaseRenewal(): void {\n    if (this.#leaseRenewalTimer) return;\n    this.#leaseRenewalTimer = setInterval(\n      () => {\n        void this.#leaseProvider\n          .renewLease(this.#leaseKey(), this.#leaseOwner, this.#leaseTtlMs)\n          .then(renewed => {\n            if (!renewed) {\n              this.#hasLease = false;\n              this.#stopLeaseRenewal();\n            }\n          })\n          .catch(error => {\n            this.#hasLease = false;\n            this.#stopLeaseRenewal();\n            this.deps?.logger.warn('Platform GitHub event polling lease renewal failed', {\n              error: error instanceof Error ? error.message : String(error),\n            });\n          });\n      },\n      Math.floor(this.#leaseTtlMs / 3),\n    );\n    this.#leaseRenewalTimer.unref?.();\n  }\n\n  #stopLeaseRenewal(): void {\n    if (this.#leaseRenewalTimer) clearInterval(this.#leaseRenewalTimer);\n    this.#leaseRenewalTimer = undefined;\n  }\n\n  async #poll(): Promise<number> {\n    const repositories = await this.#discoverRepositories();\n    let retryInMs = this.#pollEventsEnabled ? this.#intervalMs : this.#reconcileCadence();\n\n    if (this.#pollEventsEnabled) {\n      for (const repository of repositories) {\n        if (!this.#running || !this.#hasLease) break;\n        try {\n          await this.#pollRepository(repository.id);\n        } catch (error) {\n          const delay = retryDelay(error, this.#intervalMs);\n          retryInMs = Math.max(retryInMs, delay);\n          this.deps?.logger.error('Platform GitHub repository event polling failed', {\n            repositoryId: repository.id,\n            error: error instanceof Error ? error.message : String(error),\n            retryInMs: delay,\n          });\n          if (error instanceof PlatformApiError && error.status === 429) break;\n        }\n      }\n    }\n\n    await this.#maybeReconcile(repositories);\n    return retryInMs;\n  }\n\n  #reconcileCadence(): number {\n    const cadences = [\n      this.#reconcileFactoryState ? this.#pullRequestReconcileIntervalMs : undefined,\n      this.#reconcileIssuesFactoryState ? this.#issueReconcileIntervalMs : undefined,\n    ].filter((interval): interval is number => interval !== undefined);\n    return cadences.length > 0 ? Math.min(...cadences) : this.#intervalMs;\n  }\n\n  async #maybeReconcile(repositories: Repository[]): Promise<void> {\n    if (!this.#running || !this.#hasLease) return;\n    const now = this.#now();\n    const reconcilePullRequests = Boolean(\n      this.#reconcileFactoryState && now - this.#lastPullRequestReconcileAt >= this.#pullRequestReconcileIntervalMs,\n    );\n    const reconcileIssues = Boolean(\n      this.#reconcileIssuesFactoryState && now - this.#lastIssueReconcileAt >= this.#issueReconcileIntervalMs,\n    );\n    if (!reconcilePullRequests && !reconcileIssues) return;\n    if (reconcilePullRequests) this.#lastPullRequestReconcileAt = now;\n    if (reconcileIssues) this.#lastIssueReconcileAt = now;\n\n    const targets: ReconcileRepository[] = repositories.flatMap(repository =>\n      repository.fullName\n        ? [{ id: repository.id, fullName: repository.fullName, installationId: repository.installationId }]\n        : [],\n    );\n    if (targets.length === 0) {\n      this.deps?.logger.debug('Platform GitHub reconciliation skipped: no named repositories');\n      return;\n    }\n\n    if (reconcilePullRequests && this.#reconcileFactoryState) {\n      const startedAt = Date.now();\n      try {\n        const { errors, ...counts } = await this.#reconcileFactoryState(targets);\n        const context = { ...counts, candidateRepositories: targets.length, durationMs: Date.now() - startedAt };\n        if (counts.failed > 0) {\n          this.deps?.logger.warn('Platform GitHub pull request reconcile sweep completed with failures', {\n            ...context,\n            errors,\n          });\n        } else if (counts.merged > 0 || counts.closed > 0) {\n          this.deps?.logger.info('Platform GitHub pull request reconcile replayed missed merges/closes', context);\n        } else {\n          this.deps?.logger.info('Platform GitHub pull request reconcile sweep completed', context);\n        }\n      } catch (error) {\n        this.deps?.logger.error('Platform GitHub pull request reconcile failed', {\n          repositories: targets.length,\n          durationMs: Date.now() - startedAt,\n          error: error instanceof Error ? error.message : String(error),\n        });\n      }\n    }\n\n    if (reconcileIssues && this.#reconcileIssuesFactoryState && this.#hasLease) {\n      const startedAt = Date.now();\n      try {\n        const { errors, ...counts } = await this.#reconcileIssuesFactoryState(targets);\n        const context = { ...counts, candidateRepositories: targets.length, durationMs: Date.now() - startedAt };\n        if (counts.failed > 0) {\n          this.deps?.logger.warn('Platform GitHub issue reconcile sweep completed with failures', { ...context, errors });\n        } else if (counts.closed > 0) {\n          this.deps?.logger.info('Platform GitHub issue reconcile replayed closed work items', context);\n        } else if (counts.updated > 0) {\n          this.deps?.logger.info('Platform GitHub issue reconcile patched stale metadata', context);\n        } else {\n          this.deps?.logger.debug('Platform GitHub issue reconcile sweep completed', context);\n        }\n      } catch (error) {\n        this.deps?.logger.error('Platform GitHub issue reconcile failed', {\n          repositories: targets.length,\n          durationMs: Date.now() - startedAt,\n          error: error instanceof Error ? error.message : String(error),\n        });\n      }\n    }\n\n    if (this.#sweepBaseCheckpoints && this.#hasLease) {\n      try {\n        await this.#sweepBaseCheckpoints();\n      } catch (error) {\n        this.deps?.logger.warn('Platform GitHub base-checkpoint freshness sweep failed', {\n          error: error instanceof Error ? error.message : String(error),\n        });\n      }\n    }\n  }\n\n  /**\n   * Configured `(installation, repository)` pairs — the same set the\n   * reconciler sweeps — resolved to the numeric ids and slug the poll\n   * addresses GitHub with. Repositories not linked to any factory project\n   * cannot produce work for Factory, so polling and reconciling them is\n   * wasted `/events` bandwidth and platform load.\n   */\n  async #discoverRepositories(): Promise<Repository[]> {\n    const keys = await this.#sourceControl.projectRepositories.listConfiguredExternalKeys();\n    const repositories = new Map<number, Repository>();\n    for (const key of keys) {\n      const installationId = Number(key.installationExternalId);\n      const repositoryId = Number(key.repositoryExternalId);\n      if (\n        !Number.isSafeInteger(installationId) ||\n        installationId <= 0 ||\n        !Number.isSafeInteger(repositoryId) ||\n        repositoryId <= 0\n      ) {\n        continue;\n      }\n      if (repositories.has(repositoryId)) continue;\n      // A configured key exists per project link, so `listByExternalRepository`\n      // always yields at least one row; the first row's orgId is enough to\n      // look up the repository row for its slug.\n      const projects = await this.#sourceControl.projectRepositories.listByExternalRepository(key);\n      const orgId = projects[0]?.orgId;\n      const repository = orgId\n        ? await this.#sourceControl.repositories.findByExternalId({ orgId, externalId: key.repositoryExternalId })\n        : null;\n      repositories.set(repositoryId, {\n        id: repositoryId,\n        installationId,\n        fullName: repository?.slug,\n      });\n    }\n    return [...repositories.values()];\n  }\n\n  async #pollRepository(repositoryId: number): Promise<void> {\n    const key = String(repositoryId);\n    if (!this.#settings.repositories[key]) {\n      this.#settings.repositories[key] = { afterTimestamp: this.#startedAt };\n      await this.#saveSettings();\n    }\n\n    while (this.#running && this.#hasLease) {\n      const cursor: EventCursor = this.#settings.repositories[key]!;\n      const query = new URLSearchParams({ limit: String(EVENT_PAGE_SIZE) });\n      if ('afterEventId' in cursor) query.set('afterEventId', cursor.afterEventId);\n      else query.set('afterTimestamp', String(cursor.afterTimestamp));\n\n      const pollStartedAt = performance.now();\n      const page = await this.#client.request<{ events: EventLogEntry[]; nextCursor: string | null }>(\n        'GET',\n        `${API_PREFIX}/repositories/${repositoryId}/events?${query}`,\n      );\n      this.deps?.logger.debug('Platform GitHub repository event poll completed', {\n        repositoryId,\n        eventCount: page.events.length,\n        latencyMs: Math.round(performance.now() - pollStartedAt),\n      });\n      if (page.events.length === 0 || !page.nextCursor) return;\n\n      for (const event of page.events) {\n        if (!this.#running || !this.#hasLease) return;\n        const parsed = parseEvent(event);\n        if (!parsed) {\n          this.deps?.logger.warn('Platform GitHub event log returned a malformed event', {\n            repositoryId,\n            eventId: event.id,\n          });\n          continue;\n        }\n        if (isFactoryIngestedEvent(parsed)) {\n          await this.#ingestFactoryEvent?.(parsed);\n        }\n        const result = await this.#dispatch(parsed, {\n          controller: this.#controller,\n          listSubscriptions: (target, options) =>\n            listPullRequestSubscriptionsForWebhook(target, options, this.#github.integrationStorage),\n          retireSubscription: (id, status) =>\n            retirePullRequestSubscription(id, status, this.#github.integrationStorage),\n          github: this.#github,\n          isAuthorizedSender: notification => this.#isAuthorizedSender(notification),\n          onTargetSkipped: subscription => {\n            // Routine when a subscription's thread belongs to another\n            // deployment, so this stays at debug rather than warning on a loop.\n            this.deps?.logger.debug('Platform GitHub event skipped: thread is not held here', {\n              deliveryId: event.deliveryId,\n              subscriptionId: subscription.id,\n              threadId: subscription.threadId,\n            });\n          },\n          onSenderRejected: notification => {\n            this.deps?.logger.debug('Platform GitHub event dropped: sender not authorized', {\n              deliveryId: event.deliveryId,\n              repository: notification.metadata.repository,\n              sender: notification.metadata.sender,\n              kind: notification.kind,\n            });\n          },\n          onTargetError: (subscription, error) => {\n            this.deps?.logger.error('Platform GitHub event delivery failed for a subscription', {\n              deliveryId: event.deliveryId,\n              subscriptionId: subscription.id,\n              resourceId: subscription.resourceId,\n              threadId: subscription.threadId,\n              error: error instanceof Error ? error.message : String(error),\n            });\n          },\n        });\n        if (result.failed > 0) {\n          this.deps?.logger.warn('Platform GitHub event completed with failed subscription deliveries', {\n            repositoryId,\n            deliveryId: event.deliveryId,\n            delivered: result.delivered,\n            failed: result.failed,\n          });\n        }\n      }\n\n      if (page.nextCursor === ('afterEventId' in cursor ? cursor.afterEventId : undefined)) return;\n      this.#settings.repositories[key] = { afterEventId: page.nextCursor };\n      await this.#saveSettings();\n    }\n  }\n\n  async #isAuthorizedSender(notification: GithubWebhookNotification): Promise<boolean> {\n    if (!AUTHOR_GATED_KINDS.has(notification.kind)) return true;\n    const sender = notification.metadata.sender;\n    const repository = notification.metadata.repository;\n    if (!sender || !repository) return false;\n    // Factory's own app has to clear the gate before the bot rules below, which\n    // fail closed for every bot that is not explicitly allowlisted. GitHub\n    // forbids an app from reviewing its own pull request, so `factory-review`\n    // posts its verdict as a comment under this login and that comment is the\n    // handoff the authoring agent wakes on.\n    if (this.#github.identity?.matches(sender)) return true;\n    if (isFactoryAppSender(sender, this.#github.slug)) return true;\n    const normalizedSender = sender.toLowerCase();\n    const authorizedBots = resolveAuthorizedBots(this.#github.authorizedBots);\n    if (authorizedBots.has(normalizedSender)) return true;\n    // Any other bot is gated purely by the allowlist: a GitHub App never holds a\n    // collaborator permission under its sender login, so falling through to the\n    // permission lookup would only fail closed after a wasted API call.\n    if (notification.metadata.senderType?.toLowerCase() === 'bot' || normalizedSender.endsWith('[bot]')) {\n      return false;\n    }\n\n    const abortController = new AbortController();\n    const timeout = setTimeout(() => abortController.abort(), PERMISSION_CHECK_TIMEOUT_MS);\n    try {\n      const permission = await this.#github.getRepositoryCollaboratorPermission(\n        notification.metadata.installationId,\n        repository,\n        sender,\n        abortController.signal,\n      );\n      return permission !== undefined && AUTHORIZED_PERMISSIONS.has(permission);\n    } catch {\n      return false;\n    } finally {\n      clearTimeout(timeout);\n    }\n  }\n\n  async #saveSettings(): Promise<void> {\n    await this.#storage.settings.save(CURSOR_ORG_ID, CURSOR_USER_ID, this.#settings);\n  }\n\n  #leaseKey(): string {\n    return `${this.name}:${this.#storage.integrationId}`;\n  }\n}\n\nfunction getLeaseProvider(pubsub: PubSub): LeaseProvider {\n  const getProvider = (pubsub as PubSub & { getLeaseProvider?: () => LeaseProvider | undefined }).getLeaseProvider;\n  if (typeof getProvider === 'function') return getProvider.call(pubsub) ?? NoopLeaseProvider;\n  return isLeaseProvider(pubsub) ? pubsub : NoopLeaseProvider;\n}\n\nfunction normalizeSettings(value: PlatformGithubEventWorkerSettings | null): PlatformGithubEventWorkerSettings {\n  if (!value || value.version !== 1 || !value.repositories || typeof value.repositories !== 'object') {\n    return { version: 1, repositories: {} };\n  }\n  return { version: 1, repositories: { ...value.repositories } };\n}\n\n// Events the polling worker forwards to the factory rules engine. Closures\n// let the reconciler finalize cards; `synchronize` and `review_requested` on a\n// pull request are the triggers the review board's re-review path listens for;\n// submitted reviews and pull request comments are how review feedback reaches\n// the agent that authored the branch. Direct-webhook consumers ingest every\n// parsed event; the platform path gates because the remaining events (issue\n// edits, comment edits and deletions) only interest the subscription\n// dispatcher, not the factory rules.\nfunction isFactoryIngestedEvent(event: ParsedGithubWebhook): boolean {\n  if ((event.event === 'issues' || event.event === 'pull_request') && event.payload.action === 'closed') {\n    return true;\n  }\n  if (event.event === 'pull_request') {\n    const action = event.payload.action;\n    // `opened` is what mints the Review card for a pull request. Without it a\n    // factory-authored PR never gets reviewed on the polling path, which is the\n    // only path a local deployment has.\n    if (action === 'opened' || action === 'synchronize' || action === 'review_requested') return true;\n  }\n  if (event.event === 'pull_request_review' && event.payload.action === 'submitted') return true;\n  if (event.event === 'issue_comment' && event.payload.action === 'created') return true;\n  // Default-branch pushes drive base-checkpoint rebuilds\n  // (`withBaseCheckpointWebhookTrigger` wraps the ingest callback).\n  if (event.event === 'push') return true;\n  return false;\n}\n\nfunction parseEvent(event: EventLogEntry): ParsedGithubWebhook | null {\n  if (\n    !event.id ||\n    !event.deliveryId ||\n    !SUPPORTED_EVENTS.has(event.event) ||\n    !event.payload ||\n    typeof event.payload !== 'object' ||\n    Array.isArray(event.payload)\n  ) {\n    return null;\n  }\n  return {\n    event: event.event,\n    deliveryId: event.deliveryId,\n    payload: event.payload as Record<string, unknown>,\n  };\n}\n\nfunction retryDelay(error: unknown, fallbackMs: number): number {\n  if (error instanceof PlatformApiError && error.status === 429 && error.retryAfterSeconds !== null) {\n    return Math.max(fallbackMs, error.retryAfterSeconds * 1_000);\n  }\n  return fallbackMs;\n}\n"],"mappings":";;;;;;;AAuBA,MAAM,aAAa;AACnB,MAAM,2BAA2B;AACjC,MAAM,gCAAgC,IAAI;AAC1C,MAAM,kBAAkB;AACxB,MAAM,mBAAmB;AACzB,MAAM,gBAAgB;AACtB,MAAM,iBAAiB;AACvB,MAAM,mCAAmB,IAAI,IAAI;CAC/B;CACA;CACA;CACA;CACA;CAGA;AACF,CAAC;AAGD,MAAM,qCAAqB,IAAI,IAAI;CACjC;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AACD,MAAM,yCAAyB,IAAI,IAAgC;CAAC;CAAS;CAAY;AAAO,CAAC;AACjG,MAAM,8BAA8B;AAsDpC,IAAa,4BAAb,cAA+C,aAAa;CAC1D,OAAgB;CAEhB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,cAAuB,WAAW;CAElC,WAAW;CACX;CACA;CACA;CACA,iBAAgC;CAChC;CACA,YAAY;CACZ,aAAa;CACb,8BAA8B;CAC9B,wBAAwB;CACxB,YAA+C;EAAE,SAAS;EAAG,cAAc,CAAC;CAAE;CAE9E,YAAY,QAAyC;EACnD,MAAM;EACN,KAAKA,UAAU,OAAO;EACtB,KAAKC,cAAc,OAAO;EAC1B,KAAKC,UAAU,OAAO;EACtB,KAAKC,WAAW,OAAO;EACvB,KAAKC,sBAAsB,OAAO;EAClC,KAAKC,yBAAyB,OAAO;EACrC,KAAKC,+BAA+B,OAAO;EAC3C,KAAKC,wBAAwB,OAAO;EACpC,KAAKC,qBAAqB,OAAO,qBAAqB;EACtD,MAAM,4BAA4B,OAAO,uBAAuB;EAChE,KAAKC,kCAAkC,OAAO,kCAAkC;EAChF,KAAKC,4BAA4B,OAAO,4BAA4B;EACpE,KAAKC,cAAc,OAAO,cAAc;EACxC,IAAI,CAAC,OAAO,SAAS,KAAKA,WAAW,KAAK,KAAKA,eAAe,GAC5D,MAAM,IAAI,MAAM,mEAAmE;EAErF,IAAI,CAAC,OAAO,SAAS,KAAKF,+BAA+B,KAAK,KAAKA,mCAAmC,GACpG,MAAM,IAAI,MAAM,4EAA4E;EAE9F,IAAI,CAAC,OAAO,SAAS,KAAKC,yBAAyB,KAAK,KAAKA,6BAA6B,GACxF,MAAM,IAAI,MAAM,qEAAqE;EAEvF,KAAKM,cAAc,KAAK,IACtB,kBACA,KAAK,IAAI,KAAKL,aAAa,KAAKF,iCAAiC,KAAKC,yBAAyB,IAAI,CACrG;EACA,KAAKE,OAAO,OAAO,OAAO,KAAK;EAC/B,KAAKC,YAAY,OAAO,YAAY;EACpC,KAAKC,iBAAiB,OAAO;CAC/B;CAEA,MAAM,KAAK,MAAiC;EAC1C,MAAM,MAAM,KAAK,IAAI;EACrB,KAAKG,iBAAiB,iBAAiB,KAAK,MAAM;CACpD;CAEA,MAAM,QAAuB;EAC3B,IAAI,KAAKC,UAAU;EACnB,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,MAAM,uDAAuD;EAEvF,KAAKC,aAAa,KAAKP,KAAK,IAAI;EAChC,KAAKQ,YAAY,kBAAkB,MAAM,KAAKjB,SAAS,SAAS,IAAI,eAAe,cAAc,CAAC;EAClG,KAAKe,WAAW;EAChB,KAAK,KAAK,OAAO,KAAK,yCAAyC;GAC7D,YAAY,KAAKP;GACjB,YAAY,KAAKK;EACnB,CAAC;EACD,KAAKK,UAAU,CAAC;CAClB;CAEA,MAAM,OAAsB;EAC1B,IAAI,CAAC,KAAKH,UAAU;EACpB,KAAKA,WAAW;EAChB,IAAI,KAAKI,QAAQ,aAAa,KAAKA,MAAM;EACzC,KAAKA,SAAS,KAAA;EACd,KAAKC,kBAAkB;EACvB,MAAM,KAAKC;EACX,IAAI,KAAKC,WAAW;GAClB,MAAM,KAAKR,eAAe,aAAa,KAAKS,UAAU,GAAG,KAAKX,WAAW,CAAC,CAAC,YAAY,KAAA,CAAS;GAChG,KAAKU,YAAY;EACnB;CACF;CAEA,IAAI,YAAqB;EACvB,OAAO,KAAKP;CACd;CAEA,UAAU,SAAuB;EAC/B,IAAI,CAAC,KAAKA,UAAU;EACpB,KAAKI,SAAS,iBAAiB;GAC7B,KAAKA,SAAS,KAAA;GACd,MAAM,MAAM,KAAKK,MAAM;GACvB,KAAKH,YAAY;GACjB,IAAS,cAAc;IACrB,IAAI,KAAKA,cAAc,KAAK,KAAKA,YAAY,KAAA;GAC/C,CAAC;EACH,GAAG,OAAO;EACV,KAAKF,OAAO,QAAQ;CACtB;CAEA,MAAMK,QAAuB;EAC3B,IAAI,YAAY,KAAKhB;EACrB,IAAI;GACF,IAAI,CAAE,MAAM,KAAKiB,aAAa,GAAI;GAClC,YAAY,MAAM,KAAKC,MAAM;EAC/B,SAAS,OAAO;GACd,YAAY,WAAW,OAAO,KAAKlB,WAAW;GAC9C,KAAK,MAAM,OAAO,MAAM,8CAA8C;IACpE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC5D,WAAW;GACb,CAAC;EACH,UAAU;GACR,KAAKU,UAAU,SAAS;EAC1B;CACF;CAEA,MAAMO,eAAiC;EACrC,IAAI,KAAKH,WAAW,OAAO;EAC3B,MAAM,SAAS,MAAM,KAAKR,eAAe,aAAa,KAAKS,UAAU,GAAG,KAAKX,aAAa,KAAKC,WAAW;EAC1G,KAAKS,YAAY,OAAO;EACxB,IAAI,KAAKA,WAAW,KAAKK,mBAAmB;EAC5C,OAAO,KAAKL;CACd;CAEA,qBAA2B;EACzB,IAAI,KAAKM,oBAAoB;EAC7B,KAAKA,qBAAqB,kBAClB;GACJ,KAAUd,eACP,WAAW,KAAKS,UAAU,GAAG,KAAKX,aAAa,KAAKC,WAAW,CAAC,CAChE,MAAK,YAAW;IACf,IAAI,CAAC,SAAS;KACZ,KAAKS,YAAY;KACjB,KAAKF,kBAAkB;IACzB;GACF,CAAC,CAAC,CACD,OAAM,UAAS;IACd,KAAKE,YAAY;IACjB,KAAKF,kBAAkB;IACvB,KAAK,MAAM,OAAO,KAAK,sDAAsD,EAC3E,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC9D,CAAC;GACH,CAAC;EACL,GACA,KAAK,MAAM,KAAKP,cAAc,CAAC,CACjC;EACA,KAAKe,mBAAmB,QAAQ;CAClC;CAEA,oBAA0B;EACxB,IAAI,KAAKA,oBAAoB,cAAc,KAAKA,kBAAkB;EAClE,KAAKA,qBAAqB,KAAA;CAC5B;CAEA,MAAMF,QAAyB;EAC7B,MAAM,eAAe,MAAM,KAAKG,sBAAsB;EACtD,IAAI,YAAY,KAAKxB,qBAAqB,KAAKG,cAAc,KAAKsB,kBAAkB;EAEpF,IAAI,KAAKzB,oBACP,KAAK,MAAM,cAAc,cAAc;GACrC,IAAI,CAAC,KAAKU,YAAY,CAAC,KAAKO,WAAW;GACvC,IAAI;IACF,MAAM,KAAKS,gBAAgB,WAAW,EAAE;GAC1C,SAAS,OAAO;IACd,MAAM,QAAQ,WAAW,OAAO,KAAKvB,WAAW;IAChD,YAAY,KAAK,IAAI,WAAW,KAAK;IACrC,KAAK,MAAM,OAAO,MAAM,mDAAmD;KACzE,cAAc,WAAW;KACzB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KAC5D,WAAW;IACb,CAAC;IACD,IAAI,iBAAiB,oBAAoB,MAAM,WAAW,KAAK;GACjE;EACF;EAGF,MAAM,KAAKwB,gBAAgB,YAAY;EACvC,OAAO;CACT;CAEA,oBAA4B;EAC1B,MAAM,WAAW,CACf,KAAK9B,yBAAyB,KAAKI,kCAAkC,KAAA,GACrE,KAAKH,+BAA+B,KAAKI,4BAA4B,KAAA,CACvE,CAAC,CAAC,QAAQ,aAAiC,aAAa,KAAA,CAAS;EACjE,OAAO,SAAS,SAAS,IAAI,KAAK,IAAI,GAAG,QAAQ,IAAI,KAAKC;CAC5D;CAEA,MAAMwB,gBAAgB,cAA2C;EAC/D,IAAI,CAAC,KAAKjB,YAAY,CAAC,KAAKO,WAAW;EACvC,MAAM,MAAM,KAAKb,KAAK;EACtB,MAAM,wBAAwB,QAC5B,KAAKP,0BAA0B,MAAM,KAAK+B,+BAA+B,KAAK3B,+BAChF;EACA,MAAM,kBAAkB,QACtB,KAAKH,gCAAgC,MAAM,KAAK+B,yBAAyB,KAAK3B,yBAChF;EACA,IAAI,CAAC,yBAAyB,CAAC,iBAAiB;EAChD,IAAI,uBAAuB,KAAK0B,8BAA8B;EAC9D,IAAI,iBAAiB,KAAKC,wBAAwB;EAElD,MAAM,UAAiC,aAAa,SAAQ,eAC1D,WAAW,WACP,CAAC;GAAE,IAAI,WAAW;GAAI,UAAU,WAAW;GAAU,gBAAgB,WAAW;EAAe,CAAC,IAChG,CAAC,CACP;EACA,IAAI,QAAQ,WAAW,GAAG;GACxB,KAAK,MAAM,OAAO,MAAM,+DAA+D;GACvF;EACF;EAEA,IAAI,yBAAyB,KAAKhC,wBAAwB;GACxD,MAAM,YAAY,KAAK,IAAI;GAC3B,IAAI;IACF,MAAM,EAAE,QAAQ,GAAG,WAAW,MAAM,KAAKA,uBAAuB,OAAO;IACvE,MAAM,UAAU;KAAE,GAAG;KAAQ,uBAAuB,QAAQ;KAAQ,YAAY,KAAK,IAAI,IAAI;IAAU;IACvG,IAAI,OAAO,SAAS,GAClB,KAAK,MAAM,OAAO,KAAK,wEAAwE;KAC7F,GAAG;KACH;IACF,CAAC;SACI,IAAI,OAAO,SAAS,KAAK,OAAO,SAAS,GAC9C,KAAK,MAAM,OAAO,KAAK,wEAAwE,OAAO;SAEtG,KAAK,MAAM,OAAO,KAAK,0DAA0D,OAAO;GAE5F,SAAS,OAAO;IACd,KAAK,MAAM,OAAO,MAAM,iDAAiD;KACvE,cAAc,QAAQ;KACtB,YAAY,KAAK,IAAI,IAAI;KACzB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC9D,CAAC;GACH;EACF;EAEA,IAAI,mBAAmB,KAAKC,gCAAgC,KAAKmB,WAAW;GAC1E,MAAM,YAAY,KAAK,IAAI;GAC3B,IAAI;IACF,MAAM,EAAE,QAAQ,GAAG,WAAW,MAAM,KAAKnB,6BAA6B,OAAO;IAC7E,MAAM,UAAU;KAAE,GAAG;KAAQ,uBAAuB,QAAQ;KAAQ,YAAY,KAAK,IAAI,IAAI;IAAU;IACvG,IAAI,OAAO,SAAS,GAClB,KAAK,MAAM,OAAO,KAAK,iEAAiE;KAAE,GAAG;KAAS;IAAO,CAAC;SACzG,IAAI,OAAO,SAAS,GACzB,KAAK,MAAM,OAAO,KAAK,8DAA8D,OAAO;SACvF,IAAI,OAAO,UAAU,GAC1B,KAAK,MAAM,OAAO,KAAK,0DAA0D,OAAO;SAExF,KAAK,MAAM,OAAO,MAAM,mDAAmD,OAAO;GAEtF,SAAS,OAAO;IACd,KAAK,MAAM,OAAO,MAAM,0CAA0C;KAChE,cAAc,QAAQ;KACtB,YAAY,KAAK,IAAI,IAAI;KACzB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC9D,CAAC;GACH;EACF;EAEA,IAAI,KAAKC,yBAAyB,KAAKkB,WACrC,IAAI;GACF,MAAM,KAAKlB,sBAAsB;EACnC,SAAS,OAAO;GACd,KAAK,MAAM,OAAO,KAAK,0DAA0D,EAC/E,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC9D,CAAC;EACH;CAEJ;;;;;;;;CASA,MAAMyB,wBAA+C;EACnD,MAAM,OAAO,MAAM,KAAKlB,eAAe,oBAAoB,2BAA2B;EACtF,MAAM,+BAAe,IAAI,IAAwB;EACjD,KAAK,MAAM,OAAO,MAAM;GACtB,MAAM,iBAAiB,OAAO,IAAI,sBAAsB;GACxD,MAAM,eAAe,OAAO,IAAI,oBAAoB;GACpD,IACE,CAAC,OAAO,cAAc,cAAc,KACpC,kBAAkB,KAClB,CAAC,OAAO,cAAc,YAAY,KAClC,gBAAgB,GAEhB;GAEF,IAAI,aAAa,IAAI,YAAY,GAAG;GAKpC,MAAM,SAAQ,MADS,KAAKA,eAAe,oBAAoB,yBAAyB,GAAG,EAAA,CACpE,EAAE,EAAE;GAC3B,MAAM,aAAa,QACf,MAAM,KAAKA,eAAe,aAAa,iBAAiB;IAAE;IAAO,YAAY,IAAI;GAAqB,CAAC,IACvG;GACJ,aAAa,IAAI,cAAc;IAC7B,IAAI;IACJ;IACA,UAAU,YAAY;GACxB,CAAC;EACH;EACA,OAAO,CAAC,GAAG,aAAa,OAAO,CAAC;CAClC;CAEA,MAAMoB,gBAAgB,cAAqC;EACzD,MAAM,MAAM,OAAO,YAAY;EAC/B,IAAI,CAAC,KAAKd,UAAU,aAAa,MAAM;GACrC,KAAKA,UAAU,aAAa,OAAO,EAAE,gBAAgB,KAAKD,WAAW;GACrE,MAAM,KAAKmB,cAAc;EAC3B;EAEA,OAAO,KAAKpB,YAAY,KAAKO,WAAW;GACtC,MAAM,SAAsB,KAAKL,UAAU,aAAa;GACxD,MAAM,QAAQ,IAAI,gBAAgB,EAAE,OAAO,OAAO,eAAe,EAAE,CAAC;GACpE,IAAI,kBAAkB,QAAQ,MAAM,IAAI,gBAAgB,OAAO,YAAY;QACtE,MAAM,IAAI,kBAAkB,OAAO,OAAO,cAAc,CAAC;GAE9D,MAAM,gBAAgB,YAAY,IAAI;GACtC,MAAM,OAAO,MAAM,KAAKpB,QAAQ,QAC9B,OACA,GAAG,WAAW,gBAAgB,aAAa,UAAU,OACvD;GACA,KAAK,MAAM,OAAO,MAAM,mDAAmD;IACzE;IACA,YAAY,KAAK,OAAO;IACxB,WAAW,KAAK,MAAM,YAAY,IAAI,IAAI,aAAa;GACzD,CAAC;GACD,IAAI,KAAK,OAAO,WAAW,KAAK,CAAC,KAAK,YAAY;GAElD,KAAK,MAAM,SAAS,KAAK,QAAQ;IAC/B,IAAI,CAAC,KAAKkB,YAAY,CAAC,KAAKO,WAAW;IACvC,MAAM,SAAS,WAAW,KAAK;IAC/B,IAAI,CAAC,QAAQ;KACX,KAAK,MAAM,OAAO,KAAK,wDAAwD;MAC7E;MACA,SAAS,MAAM;KACjB,CAAC;KACD;IACF;IACA,IAAI,uBAAuB,MAAM,GAC/B,MAAM,KAAKrB,sBAAsB,MAAM;IAEzC,MAAM,SAAS,MAAM,KAAKS,UAAU,QAAQ;KAC1C,YAAY,KAAKZ;KACjB,oBAAoB,QAAQ,YAC1B,uCAAuC,QAAQ,SAAS,KAAKC,QAAQ,kBAAkB;KACzF,qBAAqB,IAAI,WACvB,8BAA8B,IAAI,QAAQ,KAAKA,QAAQ,kBAAkB;KAC3E,QAAQ,KAAKA;KACb,qBAAoB,iBAAgB,KAAKqC,oBAAoB,YAAY;KACzE,kBAAiB,iBAAgB;MAG/B,KAAK,MAAM,OAAO,MAAM,0DAA0D;OAChF,YAAY,MAAM;OAClB,gBAAgB,aAAa;OAC7B,UAAU,aAAa;MACzB,CAAC;KACH;KACA,mBAAkB,iBAAgB;MAChC,KAAK,MAAM,OAAO,MAAM,wDAAwD;OAC9E,YAAY,MAAM;OAClB,YAAY,aAAa,SAAS;OAClC,QAAQ,aAAa,SAAS;OAC9B,MAAM,aAAa;MACrB,CAAC;KACH;KACA,gBAAgB,cAAc,UAAU;MACtC,KAAK,MAAM,OAAO,MAAM,4DAA4D;OAClF,YAAY,MAAM;OAClB,gBAAgB,aAAa;OAC7B,YAAY,aAAa;OACzB,UAAU,aAAa;OACvB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;MAC9D,CAAC;KACH;IACF,CAAC;IACD,IAAI,OAAO,SAAS,GAClB,KAAK,MAAM,OAAO,KAAK,uEAAuE;KAC5F;KACA,YAAY,MAAM;KAClB,WAAW,OAAO;KAClB,QAAQ,OAAO;IACjB,CAAC;GAEL;GAEA,IAAI,KAAK,gBAAgB,kBAAkB,SAAS,OAAO,eAAe,KAAA,IAAY;GACtF,KAAKnB,UAAU,aAAa,OAAO,EAAE,cAAc,KAAK,WAAW;GACnE,MAAM,KAAKkB,cAAc;EAC3B;CACF;CAEA,MAAMC,oBAAoB,cAA2D;EACnF,IAAI,CAAC,mBAAmB,IAAI,aAAa,IAAI,GAAG,OAAO;EACvD,MAAM,SAAS,aAAa,SAAS;EACrC,MAAM,aAAa,aAAa,SAAS;EACzC,IAAI,CAAC,UAAU,CAAC,YAAY,OAAO;EAMnC,IAAI,KAAKrC,QAAQ,UAAU,QAAQ,MAAM,GAAG,OAAO;EACnD,IAAI,mBAAmB,QAAQ,KAAKA,QAAQ,IAAI,GAAG,OAAO;EAC1D,MAAM,mBAAmB,OAAO,YAAY;EAE5C,IADuB,sBAAsB,KAAKA,QAAQ,cACzC,CAAC,CAAC,IAAI,gBAAgB,GAAG,OAAO;EAIjD,IAAI,aAAa,SAAS,YAAY,YAAY,MAAM,SAAS,iBAAiB,SAAS,OAAO,GAChG,OAAO;EAGT,MAAM,kBAAkB,IAAI,gBAAgB;EAC5C,MAAM,UAAU,iBAAiB,gBAAgB,MAAM,GAAG,2BAA2B;EACrF,IAAI;GACF,MAAM,aAAa,MAAM,KAAKA,QAAQ,oCACpC,aAAa,SAAS,gBACtB,YACA,QACA,gBAAgB,MAClB;GACA,OAAO,eAAe,KAAA,KAAa,uBAAuB,IAAI,UAAU;EAC1E,QAAQ;GACN,OAAO;EACT,UAAU;GACR,aAAa,OAAO;EACtB;CACF;CAEA,MAAMoC,gBAA+B;EACnC,MAAM,KAAKnC,SAAS,SAAS,KAAK,eAAe,gBAAgB,KAAKiB,SAAS;CACjF;CAEA,YAAoB;EAClB,OAAO,GAAG,KAAK,KAAK,GAAG,KAAKjB,SAAS;CACvC;AACF;AAEA,SAAS,iBAAiB,QAA+B;CACvD,MAAM,cAAe,OAA2E;CAChG,IAAI,OAAO,gBAAgB,YAAY,OAAO,YAAY,KAAK,MAAM,KAAK;CAC1E,OAAO,gBAAgB,MAAM,IAAI,SAAS;AAC5C;AAEA,SAAS,kBAAkB,OAAoF;CAC7G,IAAI,CAAC,SAAS,MAAM,YAAY,KAAK,CAAC,MAAM,gBAAgB,OAAO,MAAM,iBAAiB,UACxF,OAAO;EAAE,SAAS;EAAG,cAAc,CAAC;CAAE;CAExC,OAAO;EAAE,SAAS;EAAG,cAAc,EAAE,GAAG,MAAM,aAAa;CAAE;AAC/D;AAUA,SAAS,uBAAuB,OAAqC;CACnE,KAAK,MAAM,UAAU,YAAY,MAAM,UAAU,mBAAmB,MAAM,QAAQ,WAAW,UAC3F,OAAO;CAET,IAAI,MAAM,UAAU,gBAAgB;EAClC,MAAM,SAAS,MAAM,QAAQ;EAI7B,IAAI,WAAW,YAAY,WAAW,iBAAiB,WAAW,oBAAoB,OAAO;CAC/F;CACA,IAAI,MAAM,UAAU,yBAAyB,MAAM,QAAQ,WAAW,aAAa,OAAO;CAC1F,IAAI,MAAM,UAAU,mBAAmB,MAAM,QAAQ,WAAW,WAAW,OAAO;CAGlF,IAAI,MAAM,UAAU,QAAQ,OAAO;CACnC,OAAO;AACT;AAEA,SAAS,WAAW,OAAkD;CACpE,IACE,CAAC,MAAM,MACP,CAAC,MAAM,cACP,CAAC,iBAAiB,IAAI,MAAM,KAAK,KACjC,CAAC,MAAM,WACP,OAAO,MAAM,YAAY,YACzB,MAAM,QAAQ,MAAM,OAAO,GAE3B,OAAO;CAET,OAAO;EACL,OAAO,MAAM;EACb,YAAY,MAAM;EAClB,SAAS,MAAM;CACjB;AACF;AAEA,SAAS,WAAW,OAAgB,YAA4B;CAC9D,IAAI,iBAAiB,oBAAoB,MAAM,WAAW,OAAO,MAAM,sBAAsB,MAC3F,OAAO,KAAK,IAAI,YAAY,MAAM,oBAAoB,GAAK;CAE7D,OAAO;AACT"}

package/dist/integrations/platform/github/integration.d.ts

@@ -6,12 +6,19 @@ import type { VersionControl } from '../../../capabilities/version-control.js';
 import type { IntegrationStorageHandle } from '../../../storage/domains/integrations/base.js';
 import type { SourceControlStorageHandle } from '../../../storage/domains/source-control/base.js';
 import type { FactoryIntegration, IntegrationContext, IntegrationTools } from '../../base.js';
+import { GithubAppIdentity } from '../../github/app-identity.js';
 import type { GithubIntegration, GithubRepositoryPermission, RepoSummary } from '../../github/integration.js';
 import type { ReconcileIssueState, ReconcilePullRequestState } from '../../github/rules.js';
 import type { GithubSubscriptionStorage } from '../../github/subscriptions.js';
 export declare class PlatformGithubIntegration implements FactoryIntegration {
     #private;
     readonly id = "github";
+    /**
+     * Factory's own GitHub identity. Platform credentials do not carry the login
+     * they post as, so this starts from the configured slug (usually absent on a
+     * Platform deployment) and is corrected the first time Factory writes.
+     */
+    readonly identity: GithubAppIdentity;
     /**
      * Extra reviewer bot logins this deployment trusts for author-gated
      * notifications, merged over the built-in defaults.