agent-relay-server 0.61.2 → 0.62.1

package/src/routes/issue-associations.ts

@@ -0,0 +1,76 @@
+import { ISSUE_ASSOCIATION_ENTITY_TYPES, ISSUE_PROVIDERS, isRecord, type IssueAssociationEntityType, type IssueProvider } from "../types";
+import { associateIssueRef, listIssueEntities, listIssueRefsForEntity, removeIssueAssociation, resolveAssociationIssueRef } from "../services/issue-associations";
+import { cleanEnum, cleanString, optionalEnum } from "../validation";
+import { error, json, parseBody, type Handler } from "./_shared";
+
+function cleanEntityType(value: unknown): IssueAssociationEntityType {
+  return cleanEnum(value, "entityType", ISSUE_ASSOCIATION_ENTITY_TYPES) as IssueAssociationEntityType;
+}
+
+function cleanIssueInput(value: Record<string, unknown>) {
+  return {
+    issueRefId: cleanString(value.issueRefId, "issueRefId", { max: 120 }),
+    ref: cleanString(value.ref, "ref", { max: 1000 }),
+    defaultRepo: cleanString(value.defaultRepo, "defaultRepo", { max: 500 }),
+    provider: optionalEnum(value.provider, "provider", ISSUE_PROVIDERS) as IssueProvider | undefined,
+    repo: cleanString(value.repo, "repo", { max: 500 }),
+    externalKey: cleanString(value.externalKey, "externalKey", { max: 240 }),
+    url: cleanString(value.url, "url", { max: 2000 }),
+    title: cleanString(value.title, "title", { max: 500 }),
+  };
+}
+
+function cleanAssociationBody(body: unknown) {
+  if (!isRecord(body)) throw new Error("issue association body required");
+  return {
+    ...cleanIssueInput(body),
+    entityType: cleanEntityType(body.entityType),
+    entityId: cleanString(body.entityId, "entityId", { required: true, max: 240 })!,
+  };
+}
+
+function routeError(err: unknown): Response {
+  return error(err instanceof Error ? err.message : "issue associations route failed");
+}
+
+export const postIssueAssociationRoute: Handler = async (req) => {
+  const parsed = await parseBody<unknown>(req);
+  if (!parsed.ok) return error(parsed.error, parsed.status);
+  try {
+    return json(associateIssueRef(cleanAssociationBody(parsed.body)));
+  } catch (err) {
+    return routeError(err);
+  }
+};
+
+export const getIssueAssociationEntityIssuesRoute: Handler = (_req, params) => {
+  try {
+    return json({
+      issues: listIssueRefsForEntity(
+        cleanEntityType(params.entityType),
+        cleanString(params.entityId, "entityId", { required: true, max: 240 })!,
+      ),
+    });
+  } catch (err) {
+    return routeError(err);
+  }
+};
+
+export const getIssueAssociationIssueEntitiesRoute: Handler = (_req, params) => {
+  try {
+    const issueRef = resolveAssociationIssueRef({ issueRefId: cleanString(params.issueRefId, "issueRefId", { required: true, max: 120 })! });
+    return json({ issueRef, entities: listIssueEntities(issueRef.id) });
+  } catch (err) {
+    return routeError(err);
+  }
+};
+
+export const deleteIssueAssociationRoute: Handler = async (req) => {
+  const parsed = await parseBody<unknown>(req);
+  if (!parsed.ok) return error(parsed.error, parsed.status);
+  try {
+    return json(removeIssueAssociation(cleanAssociationBody(parsed.body)));
+  } catch (err) {
+    return routeError(err);
+  }
+};

package/src/routes/issue-lifecycle.ts

@@ -0,0 +1,34 @@
+import { reopenIssueLifecycle } from "../services/issue-lifecycle";
+import { cleanEnum, cleanString, optionalEnum } from "../validation";
+import { error, json, parseBody, type Handler } from "./_shared";
+import { ISSUE_ASSOCIATION_ENTITY_TYPES, ISSUE_PROVIDERS, isRecord, type IssueAssociationEntityType, type IssueProvider } from "../types";
+
+function cleanReopenBody(body: unknown) {
+  if (!isRecord(body)) throw new Error("issue lifecycle reopen body required");
+  return {
+    issueRefId: cleanString(body.issueRefId, "issueRefId", { max: 120 }),
+    ref: cleanString(body.ref, "ref", { max: 1000 }),
+    defaultRepo: cleanString(body.defaultRepo ?? body.repo, "defaultRepo", { max: 500 }),
+    provider: optionalEnum(body.provider, "provider", ISSUE_PROVIDERS) as IssueProvider | undefined,
+    repo: cleanString(body.repo, "repo", { max: 500 }),
+    externalKey: cleanString(body.externalKey, "externalKey", { max: 240 }),
+    url: cleanString(body.url, "url", { max: 2000 }),
+    title: cleanString(body.title, "title", { max: 500 }),
+    comment: cleanString(body.comment, "comment", { max: 2000 }),
+    agentId: cleanString(body.agentId, "agentId", { max: 200 }),
+    entityType: body.entityType === undefined ? undefined : cleanEnum(body.entityType, "entityType", ISSUE_ASSOCIATION_ENTITY_TYPES) as IssueAssociationEntityType,
+    entityId: cleanString(body.entityId, "entityId", { max: 240 }),
+  };
+}
+
+export const postIssueLifecycleReopenRoute: Handler = async (req) => {
+  const parsed = await parseBody<unknown>(req);
+  if (!parsed.ok) return error(parsed.error, parsed.status);
+  try {
+    const result = await reopenIssueLifecycle(cleanReopenBody(parsed.body));
+    if (result.action === "failed") return error(result.error, 502);
+    return json(result);
+  } catch (err) {
+    return error(err instanceof Error ? err.message : "issue lifecycle route failed");
+  }
+};

package/src/routes/issue-refs.ts

@@ -0,0 +1,137 @@
+import { deleteIssueRefMapping, getIssueRef, listIssueRefs, patchIssueRefMapping, resolveIssueRefMapping, upsertIssueRefMapping, type ListIssueRefsOptions } from "../services/issue-refs";
+import { cleanEnum, cleanString, optionalEnum } from "../validation";
+import { error, json, parseBody, parseQueryInt, type Handler } from "./_shared";
+import { ISSUE_PROVIDERS, ISSUE_REF_STATUSES, isRecord, type IssueProvider, type IssueRefStatus } from "../types";
+
+function cleanStatus(value: unknown): IssueRefStatus | undefined {
+  return optionalEnum(value, "status", ISSUE_REF_STATUSES) as IssueRefStatus | undefined;
+}
+
+function cleanProvider(value: unknown): IssueProvider {
+  return cleanEnum(value, "provider", ISSUE_PROVIDERS) as IssueProvider;
+}
+
+function cleanTimestamp(value: unknown): number | undefined {
+  if (value === undefined || value === null) return undefined;
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error("statusSyncedAt must be a non-negative integer");
+  return value;
+}
+
+function cleanUpsertBody(body: unknown) {
+  if (!isRecord(body)) throw new Error("issue ref body required");
+  return {
+    provider: cleanProvider(body.provider),
+    repo: cleanString(body.repo, "repo", { required: true, max: 500 })!,
+    externalKey: cleanString(body.externalKey, "externalKey", { required: true, max: 240 })!,
+    url: cleanString(body.url, "url", { required: true, max: 2000 })!,
+    title: cleanString(body.title, "title", { max: 500 }),
+    status: cleanStatus(body.status),
+    statusSyncedAt: cleanTimestamp(body.statusSyncedAt),
+  };
+}
+
+function cleanPatchBody(body: unknown) {
+  if (!isRecord(body)) throw new Error("issue ref patch body required");
+  return {
+    url: cleanString(body.url, "url", { max: 2000 }),
+    title: cleanString(body.title, "title", { max: 500 }),
+    status: cleanStatus(body.status),
+    statusSyncedAt: cleanTimestamp(body.statusSyncedAt),
+  };
+}
+
+function cleanResolveBody(body: unknown) {
+  if (!isRecord(body)) throw new Error("issue ref resolve body required");
+  return body;
+}
+
+export const listIssueRefsRoute: Handler = (req) => {
+  try {
+    const url = new URL(req.url);
+    const rawLimit = parseQueryInt(url.searchParams.get("limit"), { min: 1, max: 500, clamp: true });
+    if (Number.isNaN(rawLimit)) return error("limit must be an integer");
+    const opts: ListIssueRefsOptions = {
+      provider: optionalEnum(url.searchParams.get("provider") ?? undefined, "provider", ISSUE_PROVIDERS) as IssueProvider | undefined,
+      repo: cleanString(url.searchParams.get("repo") ?? undefined, "repo", { max: 500 }),
+      status: optionalEnum(url.searchParams.get("status") ?? undefined, "status", ISSUE_REF_STATUSES) as IssueRefStatus | undefined,
+      limit: rawLimit ?? undefined,
+    };
+    return json({ issueRefs: listIssueRefs(opts) });
+  } catch (err) {
+    return error(err instanceof Error ? err.message : "issue refs route failed");
+  }
+};
+
+export const postIssueRefRoute: Handler = async (req) => {
+  const parsed = await parseBody<unknown>(req);
+  if (!parsed.ok) return error(parsed.error, parsed.status);
+  try {
+    return json({ issueRef: upsertIssueRefMapping(cleanUpsertBody(parsed.body)) });
+  } catch (err) {
+    return error(err instanceof Error ? err.message : "issue refs route failed");
+  }
+};
+
+export const resolveIssueRefRoute: Handler = async (req) => {
+  const url = new URL(req.url);
+  const body = req.method === "POST" ? await parseBody<unknown>(req) : null;
+  if (body && !body.ok) return error(body.error, body.status);
+  try {
+    const value = body ? cleanResolveBody(body.body) : Object.fromEntries(url.searchParams.entries());
+    const ref = cleanString(value.ref, "ref", { max: 1000 });
+    const issueRef = ref
+      ? resolveIssueRefMapping({
+        ref,
+        defaultRepo: cleanString(value.defaultRepo ?? value.repo, "defaultRepo", { max: 500 }),
+        provider: optionalEnum(value.provider, "provider", ISSUE_PROVIDERS, "github") as IssueProvider,
+        title: cleanString(value.title, "title", { max: 500 }),
+        status: cleanStatus(value.status),
+        statusSyncedAt: cleanTimestamp(value.statusSyncedAt),
+      })
+      : resolveIssueRefMapping({
+        provider: cleanProvider(value.provider),
+        repo: cleanString(value.repo, "repo", { required: true, max: 500 })!,
+        externalKey: cleanString(value.externalKey, "externalKey", { required: true, max: 240 })!,
+        url: cleanString(value.url, "url", { max: 2000 }),
+        title: cleanString(value.title, "title", { max: 500 }),
+        status: cleanStatus(value.status),
+        statusSyncedAt: cleanTimestamp(value.statusSyncedAt),
+      });
+    return json({ issueRef });
+  } catch (err) {
+    return error(err instanceof Error ? err.message : "issue refs route failed");
+  }
+};
+
+export const getIssueRefRoute: Handler = (_req, params) => {
+  try {
+    const id = cleanString(params.id, "id", { required: true, max: 120 })!;
+    const issueRef = getIssueRef(id);
+    if (!issueRef) return error("issue ref not found", 404);
+    return json({ issueRef });
+  } catch (err) {
+    return error(err instanceof Error ? err.message : "issue refs route failed");
+  }
+};
+
+export const patchIssueRefRoute: Handler = async (req, params) => {
+  const parsed = await parseBody<unknown>(req);
+  if (!parsed.ok) return error(parsed.error, parsed.status);
+  try {
+    const issueRef = patchIssueRefMapping(cleanString(params.id, "id", { required: true, max: 120 })!, cleanPatchBody(parsed.body));
+    if (!issueRef) return error("issue ref not found", 404);
+    return json({ issueRef });
+  } catch (err) {
+    return error(err instanceof Error ? err.message : "issue refs route failed");
+  }
+};
+
+export const deleteIssueRefRoute: Handler = (_req, params) => {
+  try {
+    const deleted = deleteIssueRefMapping(cleanString(params.id, "id", { required: true, max: 120 })!);
+    if (!deleted) return error("issue ref not found", 404);
+    return json({ deleted });
+  } catch (err) {
+    return error(err instanceof Error ? err.message : "issue refs route failed");
+  }
+};

package/src/routes/orchestrator-bootstrap.ts

@@ -85,7 +85,8 @@ export const postOrchestratorBootstrapExchange: Handler = async (req) => {
       baseDir,
       createdBy: auth.jti ? `bootstrap:${auth.jti}` : "bootstrap",
     });
-    if (auth.jti) revokeToken(auth.jti);
+    // One-shot bootstrap token consumed: hard-revoke (rotation), never re-mintable.
+    if (auth.jti) revokeToken(auth.jti, "rotation");
     return json(runtimeToken, 201);
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);

package/src/routes/orchestrator.ts

@@ -364,6 +364,26 @@ function orchestratorSelfUpgradeError(orch: ReturnType<typeof getOrchestrator>):
   return undefined;
 }
 
+// One-time, server-authority migration of host-local provider config files into the
+// central provider-config rows (#465). The orchestrator reports its files via the
+// command result; the server seeds the rows (see patchCommand). Capability-gated so
+// pre-#465 orchestrators that lack the handler never get a command they'd reject.
+function dispatchProviderConfigMigration(
+  orch: NonNullable<ReturnType<typeof getOrchestrator>>,
+  requestedBy = "system",
+): ReturnType<typeof createCommand> | null {
+  if (!orch.capabilities?.migrateProviderConfig) return null;
+  const command = createCommand({
+    type: "orchestrator.migrate-provider-config",
+    source: "system",
+    target: orch.agentId,
+    ttlMs: 10 * 60_000,
+    params: { orchestratorId: orch.id, requestedBy },
+  });
+  emitCommand(command);
+  return command;
+}
+
 function reconcileOrchestratorUpgrade(orch: ReturnType<typeof getOrchestrator>): void {
   if (!orch) return;
   const up = orch.upgrade;
@@ -389,6 +409,9 @@ function reconcileOrchestratorUpgrade(orch: ReturnType<typeof getOrchestrator>):
       view: "orchestrators",
       metadata: { orchestratorId: orch.id, version: reported, commandId: up.commandId },
     });
+    // Upgrade settled — the orchestrator is now running new-enough code to handle
+    // the provider-config migration, so seed the central rows from its local files (#465).
+    dispatchProviderConfigMigration(orch);
     emitOrchestratorStatus(orch.id);
   } else if (up.status === "pending" && Date.now() - up.requestedAt > ORCH_UPGRADE_DEADLINE_MS) {
     const errMsg = `upgrade timed out; orchestrator still reports ${reported ?? "unknown"} (wanted ${up.desiredVersion})`;
@@ -416,9 +439,27 @@ export const postOrchestratorAction: Handler = async (req, params) => {
     if (!orch) return error("orchestrator not found", 404);
 
     if (!isRecord(parsed.body)) return error("body required");
-    const action = optionalEnum(parsed.body.action, "action", ["restart", "shutdown", "upgrade"] as const);
+    const action = optionalEnum(parsed.body.action, "action", ["restart", "shutdown", "upgrade", "migrate-provider-config"] as const);
     if (!action) return error("action required");
 
+    if (action === "migrate-provider-config") {
+      const denied = authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } });
+      if (denied) return denied;
+      const command = dispatchProviderConfigMigration(orch, "dashboard");
+      if (!command) return error(`orchestrator ${orch.id} does not support provider-config migration; upgrade it first`, 409);
+      auditEvent({
+        clientId: `server-orchestrator-migrate-provider-config-${orch.id}-${command.id}`,
+        kind: "state",
+        title: "Provider config migration requested",
+        body: orch.id,
+        meta: orch.id,
+        icon: "ti-arrow-up-circle",
+        view: "orchestrators",
+        metadata: { orchestratorId: orch.id, commandId: command.id, ...authAuditMetadata(req), ...dashboardAttribution(req, parsed.body.surface) },
+      });
+      return json({ ok: true, action, command }, 202);
+    }
+
     if (action === "upgrade") {
       const denied = authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } });
       if (denied) return denied;

package/src/routes/tokens.ts

@@ -337,6 +337,6 @@ export const deleteTokenProfileRoute: Handler = (_req, params) => {
 };
 
 export const postTokenRevoke: Handler = (_req, params) => {
-  if (!revokeToken(params.jti!)) return error("token not found or already revoked", 404);
+  if (!revokeToken(params.jti!, "admin")) return error("token not found or already revoked", 404);
   return json({ ok: true });
 };

package/src/runtime-tokens.ts

@@ -1,4 +1,4 @@
-import { createToken, getTokenProfile, revokeToken } from "./token-db";
+import { createToken, getTokenProfile, hardenStaleRevocation, revokeToken } from "./token-db";
 import { verifyComponentTokenAllowExpired } from "./security";
 import { spawnGrantForProfile } from "./config-store";
 import type { TokenRecord } from "./types";
@@ -26,20 +26,22 @@ interface RuntimeTokenResult {
 // a long-dead token to a sane window — a live session re-mints well within this.
 const REMINT_MAX_EXPIRED_AGE_SECONDS = 30 * 24 * 60 * 60; // 30 days
 
-// Orchestrator-mediated re-mint: given a runner's current (possibly expired) token
-// and the calling orchestrator's id, verify the token belongs to a runner of THIS
-// orchestrator and issue a fresh provider-agent token cloning its scope. The old
-// token is revoked. The caller MUST already be authenticated/authorized as the
-// orchestrator — this only establishes that the presented token is a genuine,
-// non-revoked runner token owned by that orchestrator. See approach #1 in the
-// runner self-heal design: the relay stays strict, the orchestrator's standing
-// privilege is the authorization, the signed token is the identity.
+// Orchestrator-mediated re-mint: given a runner's current (possibly expired OR
+// stale-revoked) token and the calling orchestrator's id, verify the token belongs
+// to a runner of THIS orchestrator and issue a fresh provider-agent token cloning
+// its scope. The old token is then hard-revoked so it cannot be re-minted twice.
+// The caller MUST already be authenticated/authorized as the orchestrator — this
+// only establishes that the presented token is a genuine runner token owned by that
+// orchestrator. See approach #1/#2 in the runner self-heal design (#484): the relay
+// stays strict, the orchestrator's standing privilege is the authorization, the
+// signed token is the identity. A token revoked as "stale" (the restart-strand of a
+// still-live process) is heal-able here; a hard kill (admin/rotation/removal) is not.
 export function reissueRunnerRuntimeToken(input: {
   expiredToken: string;
   orchestratorId: string;
   createdBy?: string;
 }): RuntimeTokenResult | { error: string } {
-  const payload = verifyComponentTokenAllowExpired(input.expiredToken);
+  const payload = verifyComponentTokenAllowExpired(input.expiredToken, { allowStaleRevoked: true });
   if (!payload) return { error: "invalid or revoked runner token" };
   if (payload.role !== "provider" || !payload.sub.startsWith("runner:")) {
     return { error: "not a runner token" };
@@ -60,7 +62,9 @@ export function reissueRunnerRuntimeToken(input: {
     constraints: payload.constraints,
     createdBy: input.createdBy ?? `remint:${payload.jti ?? "unknown"}`,
   });
-  if (payload.jti) revokeToken(payload.jti);
+  // Hard-revoke the consumed token so it can't mint again. revokeToken no-ops on an
+  // already-revoked (stale) token, so harden that case explicitly to "rotation".
+  if (payload.jti && !revokeToken(payload.jti, "rotation")) hardenStaleRevocation(payload.jti);
   return reissued;
 }
 

package/src/security.ts

@@ -188,6 +188,10 @@ export function requiredScopeFor(method: string, pathname: string): string | nul
   if (pathname.startsWith("/api/pairs")) return method === "GET" ? "pairs:read" : "pairs:write";
   if (pathname.startsWith("/api/teams")) return method === "GET" ? "teams:read" : "teams:write";
   if (pathname.startsWith("/api/blackboard")) return method === "GET" ? "blackboard:read" : "blackboard:write";
+  if (pathname.startsWith("/api/issue-associations")) return method === "GET" ? "issue:read" : "issue:write";
+  if (pathname.startsWith("/api/issue-activity")) return method === "GET" ? "issue:read" : "issue:write";
+  if (pathname.startsWith("/api/issue-lifecycle")) return method === "GET" ? "issue:read" : "issue:write";
+  if (pathname.startsWith("/api/issue-refs")) return method === "GET" ? "issue:read" : "issue:write";
   if (pathname.startsWith("/api/projects")) return method === "GET" ? "project:read" : "project:write";
   // Insights config (the feature toggle) stays admin-only via the default; only the
   // mechanical observation feed is writable by lower-privilege callers.
@@ -269,6 +273,10 @@ export function requiredComponentScopeFor(method: string, pathname: string): str
   if (pathname.startsWith("/api/plans")) return method === "GET" ? "plans:read" : "plans:write";
   if (pathname.startsWith("/api/teams")) return method === "GET" ? "teams:read" : "teams:write";
   if (pathname.startsWith("/api/blackboard")) return method === "GET" ? "blackboard:read" : "blackboard:write";
+  if (pathname.startsWith("/api/issue-associations")) return method === "GET" ? "issue:read" : "issue:write";
+  if (pathname.startsWith("/api/issue-activity")) return method === "GET" ? "issue:read" : "issue:write";
+  if (pathname.startsWith("/api/issue-lifecycle")) return method === "GET" ? "issue:read" : "issue:write";
+  if (pathname.startsWith("/api/issue-refs")) return method === "GET" ? "issue:read" : "issue:write";
   // Fail-closed default returns system:admin, so this case is load-bearing: without it
   // every /api/projects call from a scoped component token would 403-blackhole (#405).
   if (pathname.startsWith("/api/projects")) return method === "GET" ? "project:read" : "project:write";
@@ -331,20 +339,60 @@ export function verifyComponentToken(token: string, nowSeconds = Math.floor(Date
   return payload;
 }
 
+// Why a token was revoked (#484). The reason decides whether an orchestrator may
+// re-mint it: a "stale" revocation (relay marked an agent stale across its own
+// restart/reconnect) is recoverable for a process the orchestrator can confirm is
+// alive; every other reason is a hard kill. This is the single home for the
+// taxonomy — callers import the type, never re-declare the strings.
+export type TokenRevokeReason = "stale" | "rotation" | "admin" | "agent-removed" | "pruned";
+
+// The ONLY revocation reason an orchestrator-mediated re-mint may heal. A genuine
+// kill — admin revoke, rotation, agent removal/prune, or a legacy NULL reason —
+// stays an unconditional hard kill.
+const REMINTABLE_REVOKE_REASONS: ReadonlySet<TokenRevokeReason> = new Set(["stale"]);
+
+// Returns undefined if the token is not revoked, otherwise its reason string
+// (NULL/legacy → null, treated as a hard kill).
+function tokenRevocationReason(jti: string): string | null | undefined {
+  try {
+    const row = getDb().query("SELECT revoked_at, revoked_reason FROM tokens WHERE jti = ?").get(jti) as
+      | { revoked_at?: number | null; revoked_reason?: string | null }
+      | undefined;
+    if (!row?.revoked_at) return undefined;
+    return row.revoked_reason ?? null;
+  } catch {
+    return undefined;
+  }
+}
+
 // Verify a component token's signature and revocation WITHOUT enforcing expiry.
 // Used only for orchestrator-mediated runner-token re-minting: an expired runner
 // token is unforgeable proof of identity (it is HMAC-signed by this relay), even
 // though it can no longer authenticate a request. The caller (an authenticated
 // orchestrator) supplies the authorization; this just establishes which runner.
-// Revoked tokens are still rejected — revocation is a hard kill.
-export function verifyComponentTokenAllowExpired(token: string): ComponentToken | null {
+// Revoked tokens are rejected as a hard kill EXCEPT when the caller opts into
+// `allowStaleRevoked` AND the token was revoked as "stale" (#484) — that case is the
+// restart-strand of a still-live process, which the orchestrator heals by re-minting.
+export function verifyComponentTokenAllowExpired(
+  token: string,
+  options?: { allowStaleRevoked?: boolean },
+): ComponentToken | null {
   const parts = token.split(".");
   if (parts.length !== 3) return null;
   const [headerRaw, payloadRaw, signature] = parts as [string, string, string];
   if (!safeEqual(signature, hmac(`${headerRaw}.${payloadRaw}`))) return null;
   const payload = parseBase64urlJson(payloadRaw);
   if (!isComponentToken(payload)) return null;
-  if (payload.jti && isTokenRevoked(payload.jti)) return null;
+  if (payload.jti) {
+    const reason = tokenRevocationReason(payload.jti);
+    if (reason !== undefined) {
+      const remintable =
+        options?.allowStaleRevoked === true &&
+        typeof reason === "string" &&
+        REMINTABLE_REVOKE_REASONS.has(reason as TokenRevokeReason);
+      if (!remintable) return null;
+    }
+  }
   return payload;
 }
 

package/src/services/issue-activity.ts

@@ -0,0 +1,30 @@
+import {
+  ISSUE_ACTIVITY_ACTIONS,
+  listAgentIssueActivity,
+  listIssueActivityAgents,
+  recordIssueActivity,
+  resolveIssueActivityRef,
+  type IssueActivityAction,
+  type RecordIssueActivityInput,
+} from "../db/activity";
+import { emitActivityEvent } from "../sse";
+import type { IssueProvider } from "../types";
+
+export {
+  ISSUE_ACTIVITY_ACTIONS,
+  listAgentIssueActivity,
+  listIssueActivityAgents,
+  recordIssueActivity,
+  type IssueActivityAction,
+  type RecordIssueActivityInput,
+};
+
+export function recordAndEmitIssueActivity(input: RecordIssueActivityInput) {
+  const event = recordIssueActivity(input);
+  emitActivityEvent(event);
+  return event;
+}
+
+export function resolveIssueActivityMapping(input: { issueRefId?: string; issueRef?: string; defaultRepo?: string; provider?: IssueProvider }) {
+  return resolveIssueActivityRef(input);
+}

package/src/services/issue-associations.ts

@@ -0,0 +1,72 @@
+import {
+  associateIssue,
+  listEntitiesForIssue,
+  listIssuesForEntity,
+  removeAssociation,
+} from "../db/issue-associations";
+import { getIssueRef, resolveIssueRefByExternalKey, resolveIssueRefFromString } from "../db/issue-refs";
+import type { IssueAssociationEntityType, IssueAssociationIssue, IssueProvider } from "../types";
+import { ValidationError } from "../db/connection";
+
+export interface ResolveAssociationIssueInput {
+  issueRefId?: string;
+  ref?: string;
+  defaultRepo?: string;
+  provider?: IssueProvider;
+  repo?: string;
+  externalKey?: string;
+  url?: string;
+  title?: string;
+}
+
+export interface AssociateIssueInput extends ResolveAssociationIssueInput {
+  entityType: IssueAssociationEntityType;
+  entityId: string;
+}
+
+export function resolveAssociationIssueRef(input: ResolveAssociationIssueInput) {
+  if (input.issueRefId) {
+    const issueRef = getIssueRef(input.issueRefId);
+    if (!issueRef) throw new ValidationError(`issue ref ${input.issueRefId} not found`);
+    return issueRef;
+  }
+  if (input.ref) {
+    return resolveIssueRefFromString({
+      ref: input.ref,
+      defaultRepo: input.defaultRepo ?? input.repo,
+      provider: input.provider,
+      title: input.title,
+    });
+  }
+  if (input.provider && input.repo && input.externalKey) {
+    return resolveIssueRefByExternalKey({
+      provider: input.provider,
+      repo: input.repo,
+      externalKey: input.externalKey,
+      url: input.url,
+      title: input.title,
+    });
+  }
+  throw new ValidationError("issueRefId, ref, or provider/repo/externalKey required");
+}
+
+export function associateIssueRef(input: AssociateIssueInput) {
+  const issueRef = resolveAssociationIssueRef(input);
+  return {
+    association: associateIssue(issueRef.id, input.entityType, input.entityId),
+    issueRef,
+  };
+}
+
+export function listIssueRefsForEntity(entityType: IssueAssociationEntityType, entityId: string): IssueAssociationIssue[] {
+  return listIssuesForEntity(entityType, entityId);
+}
+
+export function listIssueEntities(issueRefId: string) {
+  return listEntitiesForIssue(issueRefId);
+}
+
+export function removeIssueAssociation(input: AssociateIssueInput): { deleted: boolean } {
+  const issueRef = resolveAssociationIssueRef(input);
+  return { deleted: removeAssociation(issueRef.id, input.entityType, input.entityId) };
+}