devchain-cli 0.21.0 → 0.22.1

package/dist/server/modules/external-integrations/subscribers/external-subtask-sync.subscriber.js

@@ -0,0 +1,1092 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExternalSubtaskSyncSubscriber = exports.MANAGED_SUBTASK_DELIVERY_KEY = void 0;
+const common_1 = require("@nestjs/common");
+const node_crypto_1 = require("node:crypto");
+const error_types_1 = require("../../../common/errors/error-types");
+const logger_1 = require("../../../common/logging/logger");
+const events_service_1 = require("../../events/services/events.service");
+const storage_interface_1 = require("../../storage/interfaces/storage.interface");
+const external_provider_errors_1 = require("../errors/external-provider.errors");
+const external_task_provider_registry_1 = require("../external-task-provider.registry");
+const external_task_source_1 = require("../models/external-task-source");
+const provider_operation_gate_1 = require("../sessions/provider-operation-gate");
+const managed_subtask_recovery_policy_1 = require("./managed-subtask-recovery-policy");
+const managed_subtask_content_1 = require("./managed-subtask-content");
+const logger = (0, logger_1.createLogger)('ExternalSubtaskSyncSubscriber');
+exports.MANAGED_SUBTASK_DELIVERY_KEY = 'managed-subtask-sync';
+const RETRY_DELAY_MS = 30_000;
+let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
+    storage;
+    events;
+    providers;
+    providerGate;
+    unregister;
+    projectionTails = new Map();
+    constructor(storage, events, providers, providerGate) {
+        this.storage = storage;
+        this.events = events;
+        this.providers = providers;
+        this.providerGate = providerGate;
+    }
+    onModuleInit() {
+        this.unregister = this.events.registerDurableSubscriber({
+            deliveryKey: exports.MANAGED_SUBTASK_DELIVERY_KEY,
+            ordered: false,
+            eventNames: [
+                'epic.created',
+                'epic.updated',
+                'epic.deleted',
+                'integration.connection.created',
+                'integration.connection.updated',
+                'integration.connection.deleted',
+            ],
+            handle: (event) => this.handleCommittedEvent(event),
+        });
+    }
+    onModuleDestroy() {
+        this.unregister?.();
+        this.unregister = undefined;
+    }
+    async handleCommittedEvent(event) {
+        let results = [];
+        if (event.name === 'epic.created' ||
+            event.name === 'epic.updated' ||
+            event.name === 'epic.deleted') {
+            const epicId = event.payload.epicId;
+            results = await this.reconcileEpic(epicId);
+        }
+        else if (event.name === 'integration.connection.created' ||
+            event.name === 'integration.connection.updated') {
+            const provider = event.payload.provider;
+            results = await this.reconcileProvider(provider);
+        }
+        else if (event.name === 'integration.connection.deleted') {
+            const provider = event.payload.provider;
+            results = await this.projectDisconnected(provider);
+        }
+        const retryCount = results.filter((result) => result.outcome === 'retry').length;
+        if (retryCount > 0) {
+            throw new Error(`Managed subtask reconciliation has ${retryCount} retryable projection(s).`);
+        }
+    }
+    async reconcileEpic(epicId, providerFilter) {
+        const allExisting = await this.storage.listExternalManagedSubtaskLinksForEpicSnapshot(epicId);
+        const existing = allExisting.filter((row) => !providerFilter || row.provider === providerFilter);
+        const epic = await this.loadEpicOrNull(epicId);
+        const desired = epic?.parentId
+            ? await this.desiredProjections(epic, providerFilter)
+            : new Map();
+        const results = [];
+        const obsolete = existing.filter((row) => !desired.has(row.parentSourceLinkIdSnapshot));
+        const current = existing.filter((row) => desired.has(row.parentSourceLinkIdSnapshot));
+        const obsoleteIds = new Set(obsolete.map((row) => row.id));
+        const replacementBlockedProviders = new Set();
+        for (const row of [...obsolete, ...current]) {
+            const result = await this.withProjectionLock(row.id, () => this.reconcileExisting(row, epic, desired.get(row.parentSourceLinkIdSnapshot) ?? null));
+            results.push(result);
+            if (obsoleteIds.has(row.id) &&
+                (result.outcome === 'retry' || result.outcome === 'needs_attention')) {
+                replacementBlockedProviders.add(row.provider);
+            }
+        }
+        if (!epic?.parentId) {
+            return results;
+        }
+        const ordinaryLinks = await this.storage.listExternalTaskLinksForEpic(epic.id);
+        for (const link of ordinaryLinks) {
+            const belongsToExistingManagedProjection = allExisting.some((row) => row.epicIdSnapshot === epic.id &&
+                row.provider === link.provider &&
+                row.remoteScopeKey === link.remoteScopeKey &&
+                row.remoteTaskId === link.remoteTaskId);
+            if (belongsToExistingManagedProjection) {
+                continue;
+            }
+            const result = {
+                epicId: epic.id,
+                provider: link.provider,
+                managedLinkId: null,
+                outcome: 'already_remote_unmanaged',
+                reason: 'ordinary_link_is_not_managed',
+            };
+            logger.info(result, 'Skipped managed projection for an imported remote task');
+            results.push(result);
+            return results;
+        }
+        const existingSourceIds = new Set(existing.map((row) => row.parentSourceLinkIdSnapshot));
+        for (const projection of desired.values()) {
+            if (existingSourceIds.has(projection.parentSource.id)) {
+                continue;
+            }
+            if (replacementBlockedProviders.has(projection.parentSource.provider)) {
+                continue;
+            }
+            const created = await this.createManagedProjection(projection);
+            results.push(await this.withProjectionLock(created.id, () => this.reconcileExisting(created, epic, projection)));
+        }
+        return results;
+    }
+    async reconcileProvider(provider) {
+        const results = [];
+        const existing = await this.storage.listExternalManagedSubtaskLinksByProvider(provider);
+        const processedEpicIds = new Set();
+        for (const row of existing) {
+            if (processedEpicIds.has(row.epicIdSnapshot)) {
+                continue;
+            }
+            processedEpicIds.add(row.epicIdSnapshot);
+            results.push(...(await this.reconcileEpic(row.epicIdSnapshot, provider)));
+        }
+        let projectOffset = 0;
+        while (true) {
+            const projects = await this.storage.listProjects({ limit: 500, offset: projectOffset });
+            for (const project of projects.items) {
+                if (project.isTemplate) {
+                    continue;
+                }
+                let offset = 0;
+                while (true) {
+                    const page = await this.storage.listProjectEpics(project.id, {
+                        type: 'all',
+                        limit: 500,
+                        offset,
+                    });
+                    for (const epic of page.items) {
+                        if (epic.parentId && !processedEpicIds.has(epic.id)) {
+                            processedEpicIds.add(epic.id);
+                            results.push(...(await this.reconcileEpic(epic.id, provider)));
+                        }
+                    }
+                    offset += page.items.length;
+                    if (page.items.length === 0 || offset >= page.total) {
+                        break;
+                    }
+                }
+            }
+            projectOffset += projects.items.length;
+            if (projects.items.length === 0 || projectOffset >= projects.total) {
+                break;
+            }
+        }
+        return results;
+    }
+    async reconcileManagedLink(id) {
+        return this.withProjectionLock(id, async () => {
+            const row = await this.storage.getExternalManagedSubtaskLink(id);
+            const epic = await this.loadEpicOrNull(row.epicIdSnapshot);
+            const desired = epic?.parentId
+                ? await this.desiredProjections(epic, row.provider)
+                : new Map();
+            return this.reconcileExisting(row, epic, desired.get(row.parentSourceLinkIdSnapshot) ?? null);
+        });
+    }
+    async verifyManagedLink(id) {
+        const row = await this.storage.getExternalManagedSubtaskLink(id);
+        if (row.operationPhase === 'dispatch_admitted' ||
+            row.operationPhase === 'outcome_unknown' ||
+            row.operationPhase === 'needs_attention') {
+            await this.storage.updateExternalManagedSubtaskLink(id, {
+                operationPhase: 'outcome_unknown',
+                retryAt: null,
+            });
+        }
+        return this.reconcileManagedLink(id);
+    }
+    async retryManagedLink(id) {
+        const row = await this.storage.getExternalManagedSubtaskLink(id);
+        const decision = (0, managed_subtask_recovery_policy_1.managedSubtaskRetryDecision)(row);
+        if (!decision.allowed) {
+            throw new error_types_1.ConflictError(decision.reason === 'verification_required'
+                ? 'Unknown managed-subtask outcomes must be verified before retry.'
+                : 'Managed-subtask state does not allow Retry.', {
+                managedLinkId: id,
+                reason: decision.reason,
+            });
+        }
+        await this.storage.updateExternalManagedSubtaskLink(id, {
+            operationPhase: 'pre_dispatch',
+            safeErrorCode: null,
+            retryAt: null,
+        });
+        return this.reconcileManagedLink(id);
+    }
+    async reconcileExisting(original, epic, desired) {
+        let row = await this.storage.getExternalManagedSubtaskLink(original.id);
+        const connection = await this.storage.getIntegrationConnection(row.provider);
+        if (!connection?.subtaskSyncEnabled) {
+            return this.result(row, 'paused', connection ? 'sync_disabled' : 'connection_missing');
+        }
+        row = await this.refreshConnectionFence(row, connection);
+        const safeAbsentProjection = !row.remoteTaskId &&
+            (row.operationPhase === 'pre_dispatch' ||
+                (row.operationPhase === 'needs_attention' &&
+                    row.safeErrorCode?.startsWith('provider_') === true));
+        if ((!epic || !desired) && safeAbsentProjection) {
+            await this.storage.removeExternalManagedSubtaskLink(row.id);
+            return this.result(row, 'deleted');
+        }
+        if (row.operationPhase === 'needs_attention' || row.tombstoneState === 'orphan_risk') {
+            return this.result(row, 'needs_attention', row.safeErrorCode ?? 'needs_attention');
+        }
+        if (this.retryIsInFuture(row.retryAt)) {
+            return this.result(row, 'retry', row.safeErrorCode ?? 'retry_scheduled');
+        }
+        if (row.operationPhase === 'dispatch_admitted') {
+            row = await this.storage.updateExternalManagedSubtaskLink(row.id, {
+                operationPhase: 'outcome_unknown',
+                safeErrorCode: 'recovered_dispatched_operation',
+            });
+        }
+        if (!epic || !desired) {
+            const tombstoneState = epic ? 'move_out' : 'local_deleted';
+            if (row.operationPhase === 'outcome_unknown' && !row.remoteTaskId) {
+                return this.resolveUnknownCreateForRemoval(row, tombstoneState);
+            }
+            row = await this.storage.updateExternalManagedSubtaskLink(row.id, {
+                tombstoneState,
+                tombstonedAt: row.tombstonedAt ?? new Date().toISOString(),
+            });
+            return this.deleteProjection(row);
+        }
+        const versionOnlyChange = row.operationPhase === 'confirmed' &&
+            row.remoteTaskId !== null &&
+            row.confirmedFingerprint === desired.desiredFingerprint &&
+            row.desiredFingerprint === desired.desiredFingerprint;
+        let confirmationUpdate = {};
+        if (versionOnlyChange) {
+            confirmationUpdate = {
+                confirmedVersion: epic.version,
+                confirmedFingerprint: desired.desiredFingerprint,
+            };
+        }
+        else if (row.operationPhase === 'confirmed') {
+            confirmationUpdate = { operationPhase: 'pre_dispatch' };
+        }
+        const desiredChanged = row.desiredVersion !== epic.version ||
+            row.desiredFingerprint !== desired.desiredFingerprint ||
+            row.connectionIdSnapshot !== connection.id ||
+            row.connectionGeneration !== connection.generation ||
+            row.syncSettingRevision !== connection.syncSettingRevision;
+        if (desiredChanged) {
+            row = await this.storage.updateExternalManagedSubtaskLink(row.id, {
+                connectionIdSnapshot: connection.id,
+                connectionGeneration: connection.generation,
+                syncSettingRevision: connection.syncSettingRevision,
+                desiredVersion: epic.version,
+                desiredFingerprint: desired.desiredFingerprint,
+                ...confirmationUpdate,
+                safeErrorCode: null,
+                retryAt: null,
+            });
+        }
+        if (row.operationPhase === 'outcome_unknown') {
+            return this.resolveUnknown(row, epic, desired);
+        }
+        if (!row.remoteTaskId) {
+            return this.createProjection(row, epic, desired);
+        }
+        if (row.operationPhase === 'confirmed' &&
+            row.confirmedVersion === row.desiredVersion &&
+            row.confirmedFingerprint === row.desiredFingerprint) {
+            const recognized = await this.storage.findRecognizedManagedSubtask(row.epicIdSnapshot, row.provider, row.remoteScopeKey, row.remoteTaskId);
+            if (recognized) {
+                return this.result(row, 'unchanged');
+            }
+            return this.repairRecognition(row, epic, desired);
+        }
+        return this.updateProjection(row, epic, desired);
+    }
+    async createProjection(row, epic, desired) {
+        const admission = await this.admitMutation(row);
+        if (!admission) {
+            return this.result(row, 'retry', 'admission_changed');
+        }
+        try {
+            const snapshot = await admission.capability.create(admission.credentials, admission.context, {
+                parentRemoteTaskId: row.parentRemoteTaskId,
+                ownershipToken: row.ownershipToken,
+                title: epic.title,
+                description: epic.description,
+            });
+            if (!(await this.fenceStillCurrent(admission.connection))) {
+                await this.markUnknown(row, 'connection_changed_after_dispatch');
+                return this.result(row, 'retry', 'connection_changed_after_dispatch');
+            }
+            this.assertOwnedSnapshot(row, snapshot);
+            const confirmed = await this.storage.confirmExternalManagedSubtaskLink({
+                managedLinkId: row.id,
+                remoteTaskId: snapshot.remoteTaskId,
+                remoteKey: snapshot.remoteKey,
+                confirmedVersion: row.desiredVersion,
+                confirmedFingerprint: row.desiredFingerprint,
+                sourceSnapshot: this.sourceSnapshot(row, desired, snapshot, admission.credentials),
+            });
+            return this.result(confirmed.managedLink, 'confirmed');
+        }
+        catch (error) {
+            return this.persistPostAdmissionFailure(row, error);
+        }
+    }
+    async updateProjection(row, epic, desired) {
+        if (!row.remoteTaskId) {
+            return this.createProjection(row, epic, desired);
+        }
+        const ownershipFailure = await this.verifyOwnershipBeforeMutation(row);
+        if (ownershipFailure) {
+            return ownershipFailure;
+        }
+        const admission = await this.admitMutation(row);
+        if (!admission) {
+            return this.result(row, 'retry', 'admission_changed');
+        }
+        try {
+            await admission.capability.update(admission.credentials, admission.context, {
+                remoteTaskId: row.remoteTaskId,
+                expectedParentRemoteTaskId: row.parentRemoteTaskId,
+                ownershipToken: row.ownershipToken,
+                title: epic.title,
+                description: epic.description,
+            });
+            const snapshot = await admission.capability.readExact(admission.credentials, admission.context, row.remoteTaskId);
+            if (!(await this.fenceStillCurrent(admission.connection))) {
+                await this.markUnknown(row, 'connection_changed_after_dispatch');
+                return this.result(row, 'retry', 'connection_changed_after_dispatch');
+            }
+            if (!snapshot) {
+                return this.keepUnknownForRetry(row, 'remote_task_missing_after_update');
+            }
+            this.assertOwnedSnapshot(row, snapshot);
+            if (!(0, managed_subtask_content_1.managedSubtaskContentMatches)(row.provider, snapshot, epic)) {
+                return this.keepUnknownForRetry(row, 'remote_verification_mismatch');
+            }
+            const confirmed = await this.storage.confirmExternalManagedSubtaskLink({
+                managedLinkId: row.id,
+                remoteTaskId: snapshot.remoteTaskId,
+                remoteKey: snapshot.remoteKey,
+                confirmedVersion: row.desiredVersion,
+                confirmedFingerprint: row.desiredFingerprint,
+                sourceSnapshot: this.sourceSnapshot(row, desired, snapshot, admission.credentials),
+            });
+            return this.result(confirmed.managedLink, 'confirmed');
+        }
+        catch (error) {
+            return this.persistPostAdmissionFailure(row, error);
+        }
+    }
+    async deleteProjection(row) {
+        if (!row.remoteTaskId) {
+            await this.storage.removeExternalManagedSubtaskLink(row.id);
+            return this.result(row, 'deleted');
+        }
+        const remoteTaskId = row.remoteTaskId;
+        if (row.operationPhase === 'dispatch_admitted') {
+            row = await this.storage.updateExternalManagedSubtaskLink(row.id, {
+                operationPhase: 'outcome_unknown',
+                safeErrorCode: 'recovered_dispatched_operation',
+            });
+        }
+        if (row.operationPhase === 'outcome_unknown') {
+            return this.resolveUnknownDelete(row);
+        }
+        const ownershipFailure = await this.verifyOwnershipBeforeMutation(row);
+        if (ownershipFailure) {
+            return ownershipFailure;
+        }
+        const admission = await this.admitMutation(row);
+        if (!admission) {
+            return this.result(row, 'retry', 'admission_changed');
+        }
+        try {
+            await admission.capability.delete(admission.credentials, admission.context, {
+                remoteTaskId,
+                expectedParentRemoteTaskId: row.parentRemoteTaskId,
+                ownershipToken: row.ownershipToken,
+            });
+            if (!(await this.fenceStillCurrent(admission.connection))) {
+                await this.markUnknown(row, 'connection_changed_after_dispatch');
+                return this.result(row, 'retry', 'connection_changed_after_dispatch');
+            }
+            await this.storage.removeExternalManagedSubtaskLink(row.id);
+            return this.result(row, 'deleted');
+        }
+        catch (error) {
+            return this.persistPostAdmissionFailure(row, error);
+        }
+    }
+    async resolveUnknown(row, epic, desired) {
+        if (!row.remoteTaskId) {
+            return this.resolveUnknownCreate(row, epic, desired);
+        }
+        const access = await this.captureReadAccess(row.provider);
+        if (!access) {
+            return this.result(row, 'retry', 'verification_unavailable');
+        }
+        try {
+            const snapshot = await access.capability.readExact(access.credentials, access.context, row.remoteTaskId);
+            if (!(await this.fenceStillCurrent(access.connection))) {
+                return this.keepUnknownForRetry(row, 'connection_changed_during_verification');
+            }
+            if (!snapshot) {
+                return this.markNeedsAttention(row, 'remote_task_missing_after_unknown_update');
+            }
+            this.assertOwnedSnapshot(row, snapshot);
+            if ((0, managed_subtask_content_1.managedSubtaskContentMatches)(row.provider, snapshot, epic)) {
+                const confirmed = await this.storage.confirmExternalManagedSubtaskLink({
+                    managedLinkId: row.id,
+                    remoteTaskId: snapshot.remoteTaskId,
+                    remoteKey: snapshot.remoteKey,
+                    confirmedVersion: row.desiredVersion,
+                    confirmedFingerprint: row.desiredFingerprint,
+                    sourceSnapshot: this.sourceSnapshot(row, desired, snapshot, access.credentials),
+                });
+                return this.result(confirmed.managedLink, 'confirmed');
+            }
+            const retryable = await this.storage.updateExternalManagedSubtaskLink(row.id, {
+                operationPhase: 'pre_dispatch',
+                safeErrorCode: null,
+                retryAt: null,
+            });
+            return this.updateProjection(retryable, epic, desired);
+        }
+        catch (error) {
+            if (this.isOwnershipFailure(error)) {
+                return this.markNeedsAttention(row, this.ownershipFailureCode(error));
+            }
+            return this.persistVerificationFailure(row, error);
+        }
+    }
+    async resolveUnknownCreate(row, epic, desired) {
+        const access = await this.captureReadAccess(row.provider);
+        if (!access) {
+            return this.result(row, 'retry', 'verification_unavailable');
+        }
+        let adopted = null;
+        let adoptedFingerprint = null;
+        let adoptedMatchesDesired = false;
+        try {
+            const children = await access.capability.listOwnedDirectChildren(access.credentials, access.context, row.parentRemoteTaskId, row.ownershipToken);
+            if (!(await this.fenceStillCurrent(access.connection))) {
+                return this.keepUnknownForRetry(row, 'connection_changed_during_verification');
+            }
+            const matches = children.items.filter((item) => item.ownershipToken === row.ownershipToken &&
+                item.parentRemoteTaskId === row.parentRemoteTaskId);
+            if (matches.length === 1) {
+                const snapshot = matches[0];
+                this.assertOwnedSnapshot(row, snapshot);
+                adoptedMatchesDesired = (0, managed_subtask_content_1.managedSubtaskContentMatches)(row.provider, snapshot, epic);
+                adoptedFingerprint = adoptedMatchesDesired
+                    ? row.desiredFingerprint
+                    : this.projectionFingerprint(snapshot.title, snapshot.description, row.parentSourceLinkIdSnapshot, row.parentRemoteTaskId);
+                const confirmed = await this.storage.confirmExternalManagedSubtaskLink({
+                    managedLinkId: row.id,
+                    remoteTaskId: snapshot.remoteTaskId,
+                    remoteKey: snapshot.remoteKey,
+                    confirmedVersion: row.desiredVersion,
+                    confirmedFingerprint: adoptedFingerprint,
+                    sourceSnapshot: this.sourceSnapshot(row, desired, snapshot, access.credentials),
+                });
+                adopted = confirmed.managedLink;
+            }
+            if (!adopted && matches.length === 0 && children.complete) {
+                const retryable = await this.storage.updateExternalManagedSubtaskLink(row.id, {
+                    operationPhase: 'pre_dispatch',
+                    safeErrorCode: null,
+                    retryAt: null,
+                });
+                return this.createProjection(retryable, epic, desired);
+            }
+            if (!adopted) {
+                return this.markNeedsAttention(row, matches.length > 1 ? 'multiple_owned_children' : 'ownership_scan_incomplete');
+            }
+        }
+        catch (error) {
+            return this.persistVerificationFailure(row, error);
+        }
+        if (adoptedMatchesDesired) {
+            return this.result(adopted, 'confirmed');
+        }
+        return this.updateProjection(adopted, epic, desired);
+    }
+    async resolveUnknownCreateForRemoval(row, tombstoneState) {
+        const access = await this.captureReadAccess(row.provider);
+        if (!access) {
+            return this.result(row, 'retry', 'verification_unavailable');
+        }
+        try {
+            const children = await access.capability.listOwnedDirectChildren(access.credentials, access.context, row.parentRemoteTaskId, row.ownershipToken);
+            if (!(await this.fenceStillCurrent(access.connection))) {
+                return this.keepUnknownForRetry(row, 'connection_changed_during_verification');
+            }
+            const matches = children.items.filter((item) => item.ownershipToken === row.ownershipToken &&
+                item.parentRemoteTaskId === row.parentRemoteTaskId);
+            if (matches.length === 0 && children.complete) {
+                await this.storage.removeExternalManagedSubtaskLink(row.id);
+                return this.result(row, 'deleted');
+            }
+            if (matches.length !== 1) {
+                return this.markNeedsAttention(row, matches.length > 1 ? 'multiple_owned_children' : 'ownership_scan_incomplete');
+            }
+            const snapshot = matches[0];
+            this.assertOwnedSnapshot(row, snapshot);
+            const adopted = await this.storage.updateExternalManagedSubtaskLink(row.id, {
+                remoteTaskId: snapshot.remoteTaskId,
+                remoteKey: snapshot.remoteKey,
+                operationPhase: 'pre_dispatch',
+                safeErrorCode: null,
+                retryAt: null,
+                tombstoneState,
+                tombstonedAt: row.tombstonedAt ?? new Date().toISOString(),
+            });
+            return this.deleteProjection(adopted);
+        }
+        catch (error) {
+            if (this.isOwnershipFailure(error)) {
+                return this.markNeedsAttention(row, this.ownershipFailureCode(error));
+            }
+            return this.persistVerificationFailure(row, error);
+        }
+    }
+    async resolveUnknownDelete(row) {
+        if (!row.remoteTaskId) {
+            await this.storage.removeExternalManagedSubtaskLink(row.id);
+            return this.result(row, 'deleted');
+        }
+        const access = await this.captureReadAccess(row.provider);
+        if (!access) {
+            return this.result(row, 'retry', 'verification_unavailable');
+        }
+        try {
+            const snapshot = await access.capability.readExact(access.credentials, access.context, row.remoteTaskId);
+            if (!(await this.fenceStillCurrent(access.connection))) {
+                return this.keepUnknownForRetry(row, 'connection_changed_during_verification');
+            }
+            if (!snapshot) {
+                await this.storage.removeExternalManagedSubtaskLink(row.id);
+                return this.result(row, 'deleted');
+            }
+            this.assertOwnedSnapshot(row, snapshot);
+            const retryable = await this.storage.updateExternalManagedSubtaskLink(row.id, {
+                operationPhase: 'pre_dispatch',
+                safeErrorCode: null,
+                retryAt: null,
+            });
+            return this.deleteProjection(retryable);
+        }
+        catch (error) {
+            if (this.isOwnershipFailure(error)) {
+                return this.markNeedsAttention(row, this.ownershipFailureCode(error));
+            }
+            return this.persistVerificationFailure(row, error);
+        }
+    }
+    async repairRecognition(row, epic, desired) {
+        if (!row.remoteTaskId) {
+            return this.createProjection(row, epic, desired);
+        }
+        const access = await this.captureReadAccess(row.provider);
+        if (!access) {
+            return this.result(row, 'retry', 'verification_unavailable');
+        }
+        try {
+            const snapshot = await access.capability.readExact(access.credentials, access.context, row.remoteTaskId);
+            if (!(await this.fenceStillCurrent(access.connection))) {
+                return this.keepUnknownForRetry(row, 'connection_changed_during_verification');
+            }
+            if (!snapshot) {
+                return this.markNeedsAttention(row, 'remote_task_missing');
+            }
+            this.assertOwnedSnapshot(row, snapshot);
+            const repaired = await this.storage.confirmExternalManagedSubtaskLink({
+                managedLinkId: row.id,
+                remoteTaskId: snapshot.remoteTaskId,
+                remoteKey: snapshot.remoteKey,
+                confirmedVersion: row.desiredVersion,
+                confirmedFingerprint: row.desiredFingerprint,
+                sourceSnapshot: this.sourceSnapshot(row, desired, snapshot, access.credentials),
+            });
+            return this.result(repaired.managedLink, 'confirmed', 'recognition_repaired');
+        }
+        catch (error) {
+            if (this.isOwnershipFailure(error)) {
+                return this.markNeedsAttention(row, this.ownershipFailureCode(error));
+            }
+            return this.persistVerificationFailure(row, error);
+        }
+    }
+    async verifyOwnershipBeforeMutation(row) {
+        if (!row.remoteTaskId) {
+            return this.markNeedsAttention(row, 'remote_identity_missing');
+        }
+        const access = await this.captureReadAccess(row.provider);
+        if (!access) {
+            return this.result(row, 'retry', 'ownership_verification_unavailable');
+        }
+        try {
+            const snapshot = await access.capability.readExact(access.credentials, access.context, row.remoteTaskId);
+            if (!(await this.fenceStillCurrent(access.connection))) {
+                return this.keepUnknownForRetry(row, 'connection_changed_during_verification');
+            }
+            if (!snapshot) {
+                return this.markNeedsAttention(row, 'remote_task_missing');
+            }
+            this.assertOwnedSnapshot(row, snapshot);
+            return null;
+        }
+        catch (error) {
+            if (this.isOwnershipFailure(error)) {
+                return this.markNeedsAttention(row, this.ownershipFailureCode(error));
+            }
+            return this.persistVerificationFailure(row, error);
+        }
+    }
+    async admitMutation(row) {
+        try {
+            return await this.providerGate.run(row.provider, async () => {
+                const connection = await this.storage.getIntegrationConnection(row.provider);
+                if (!connection?.subtaskSyncEnabled ||
+                    connection.id !== row.connectionIdSnapshot ||
+                    connection.generation !== row.connectionGeneration ||
+                    connection.syncSettingRevision !== row.syncSettingRevision) {
+                    return null;
+                }
+                const adapter = this.providers.get(row.provider);
+                const credentials = await this.storage.getIntegrationConnectionCredentials(row.provider);
+                const rechecked = await this.storage.getIntegrationConnection(row.provider);
+                if (!adapter.subtaskSync ||
+                    !credentials ||
+                    credentials.provider !== row.provider ||
+                    !rechecked?.subtaskSyncEnabled ||
+                    rechecked.id !== connection.id ||
+                    rechecked.generation !== connection.generation ||
+                    rechecked.syncSettingRevision !== connection.syncSettingRevision) {
+                    return null;
+                }
+                await this.storage.updateExternalManagedSubtaskLink(row.id, {
+                    operationPhase: 'dispatch_admitted',
+                    safeErrorCode: null,
+                    retryAt: null,
+                });
+                return {
+                    connection,
+                    credentials,
+                    capability: adapter.subtaskSync,
+                    context: this.context(connection),
+                };
+            });
+        }
+        catch (error) {
+            if (error instanceof error_types_1.BusyError) {
+                await this.storage.updateExternalManagedSubtaskLink(row.id, {
+                    operationPhase: 'pre_dispatch',
+                    safeErrorCode: 'provider_operation_busy',
+                    retryAt: new Date(Date.now() + RETRY_DELAY_MS).toISOString(),
+                });
+                return null;
+            }
+            throw error;
+        }
+    }
+    async captureReadAccess(provider) {
+        try {
+            return await this.providerGate.run(provider, async () => {
+                const connection = await this.storage.getIntegrationConnection(provider);
+                const adapter = this.providers.get(provider);
+                const credentials = await this.storage.getIntegrationConnectionCredentials(provider);
+                const rechecked = await this.storage.getIntegrationConnection(provider);
+                if (!connection?.subtaskSyncEnabled ||
+                    !adapter.subtaskSync ||
+                    !credentials ||
+                    credentials.provider !== provider ||
+                    !rechecked?.subtaskSyncEnabled ||
+                    rechecked.id !== connection.id ||
+                    rechecked.generation !== connection.generation ||
+                    rechecked.syncSettingRevision !== connection.syncSettingRevision) {
+                    return null;
+                }
+                return {
+                    connection,
+                    credentials,
+                    capability: adapter.subtaskSync,
+                    context: this.context(connection),
+                };
+            });
+        }
+        catch (error) {
+            if (error instanceof error_types_1.BusyError) {
+                return null;
+            }
+            throw error;
+        }
+    }
+    async refreshConnectionFence(row, connection) {
+        if (row.connectionIdSnapshot === connection.id &&
+            row.connectionGeneration === connection.generation &&
+            row.syncSettingRevision === connection.syncSettingRevision) {
+            return row;
+        }
+        if (!row.remoteTaskId) {
+            return this.storage.updateExternalManagedSubtaskLink(row.id, {
+                connectionIdSnapshot: connection.id,
+                connectionGeneration: connection.generation,
+                syncSettingRevision: connection.syncSettingRevision,
+            });
+        }
+        const access = await this.captureReadAccess(row.provider);
+        if (!access) {
+            return this.storage.updateExternalManagedSubtaskLink(row.id, {
+                operationPhase: 'pre_dispatch',
+                safeErrorCode: 'connection_fence_verification_pending',
+                retryAt: new Date(Date.now() + RETRY_DELAY_MS).toISOString(),
+            });
+        }
+        try {
+            const snapshot = await access.capability.readExact(access.credentials, access.context, row.remoteTaskId);
+            if (!(await this.fenceStillCurrent(access.connection))) {
+                return this.storage.updateExternalManagedSubtaskLink(row.id, {
+                    operationPhase: 'pre_dispatch',
+                    safeErrorCode: 'connection_fence_verification_pending',
+                    retryAt: new Date(Date.now() + RETRY_DELAY_MS).toISOString(),
+                });
+            }
+            if (!snapshot) {
+                return this.storage.updateExternalManagedSubtaskLink(row.id, {
+                    operationPhase: 'needs_attention',
+                    safeErrorCode: 'connection_generation_changed',
+                    retryAt: null,
+                });
+            }
+            this.assertOwnedSnapshot(row, snapshot);
+            return this.storage.updateExternalManagedSubtaskLink(row.id, {
+                connectionIdSnapshot: connection.id,
+                connectionGeneration: connection.generation,
+                syncSettingRevision: connection.syncSettingRevision,
+                safeErrorCode: null,
+                retryAt: null,
+            });
+        }
+        catch (error) {
+            if (this.isOwnershipFailure(error)) {
+                return this.storage.updateExternalManagedSubtaskLink(row.id, {
+                    operationPhase: 'needs_attention',
+                    safeErrorCode: this.ownershipFailureCode(error),
+                    retryAt: null,
+                });
+            }
+            const failure = this.classifyFailure(error);
+            return this.storage.updateExternalManagedSubtaskLink(row.id, {
+                operationPhase: failure.retry ? 'pre_dispatch' : 'needs_attention',
+                safeErrorCode: failure.safeErrorCode,
+                retryAt: failure.retryAt,
+            });
+        }
+    }
+    async desiredProjections(epic, providerFilter) {
+        const result = new Map();
+        if (!epic.parentId) {
+            return result;
+        }
+        const sources = await this.storage.listExternalTaskLinksForEpic(epic.parentId);
+        for (const source of sources) {
+            if (providerFilter && source.provider !== providerFilter) {
+                continue;
+            }
+            const connection = await this.storage.getIntegrationConnection(source.provider);
+            if (!connection?.subtaskSyncEnabled ||
+                source.connectionId !== connection.id ||
+                !this.providers.get(source.provider).subtaskSync) {
+                continue;
+            }
+            const workAreaRemoteId = this.sourceText(source.sourceSnapshot, 'workAreaId');
+            if (!workAreaRemoteId) {
+                continue;
+            }
+            result.set(source.id, {
+                epic,
+                parentSource: source,
+                connection,
+                workAreaRemoteId,
+                desiredFingerprint: this.desiredFingerprint(epic, source),
+            });
+        }
+        return result;
+    }
+    async createManagedProjection(desired) {
+        try {
+            return await this.storage.createExternalManagedSubtaskLink({
+                epicId: desired.epic.id,
+                epicIdSnapshot: desired.epic.id,
+                parentEpicIdSnapshot: desired.parentSource.epicId,
+                parentSourceLinkIdSnapshot: desired.parentSource.id,
+                connectionIdSnapshot: desired.connection.id,
+                provider: desired.parentSource.provider,
+                remoteScopeKey: desired.parentSource.remoteScopeKey,
+                workAreaRemoteId: desired.workAreaRemoteId,
+                parentRemoteTaskId: desired.parentSource.remoteTaskId,
+                connectionGeneration: desired.connection.generation,
+                syncSettingRevision: desired.connection.syncSettingRevision,
+                ownershipToken: (0, node_crypto_1.randomUUID)(),
+                desiredVersion: desired.epic.version,
+                desiredFingerprint: desired.desiredFingerprint,
+            });
+        }
+        catch (error) {
+            const existing = (await this.storage.listExternalManagedSubtaskLinksForEpicSnapshot(desired.epic.id)).find((row) => row.parentSourceLinkIdSnapshot === desired.parentSource.id);
+            if (existing) {
+                return existing;
+            }
+            throw error;
+        }
+    }
+    async projectDisconnected(provider) {
+        const rows = await this.storage.listExternalManagedSubtaskLinksByProvider(provider);
+        return Promise.all(rows.map(async (row) => {
+            const updated = await this.storage.updateExternalManagedSubtaskLink(row.id, {
+                safeErrorCode: 'connection_missing',
+                retryAt: null,
+            });
+            return this.result(updated, 'paused', 'connection_missing');
+        }));
+    }
+    async persistPostAdmissionFailure(row, error) {
+        const failure = this.classifyFailure(error);
+        const safeErrorCode = this.isOwnershipFailure(error)
+            ? this.ownershipFailureCode(error)
+            : failure.safeErrorCode === 'unexpected_provider_failure'
+                ? 'post_dispatch_local_failure'
+                : failure.safeErrorCode;
+        const updated = await this.storage.updateExternalManagedSubtaskLink(row.id, {
+            operationPhase: 'outcome_unknown',
+            safeErrorCode,
+            retryAt: failure.retryAt ?? new Date(Date.now() + RETRY_DELAY_MS).toISOString(),
+        });
+        return this.result(updated, 'retry', safeErrorCode);
+    }
+    async persistVerificationFailure(row, error) {
+        const failure = this.classifyFailure(error);
+        if (!failure.retry) {
+            return this.markNeedsAttention(row, failure.safeErrorCode);
+        }
+        const updated = await this.storage.updateExternalManagedSubtaskLink(row.id, {
+            operationPhase: 'outcome_unknown',
+            safeErrorCode: failure.safeErrorCode,
+            retryAt: failure.retryAt,
+        });
+        return this.result(updated, 'retry', failure.safeErrorCode);
+    }
+    classifyFailure(error) {
+        if (error instanceof external_provider_errors_1.ExternalProviderError) {
+            const reason = typeof error.details?.reason === 'string' ? error.details.reason : 'provider_error';
+            const retryAt = typeof error.details?.retryAt === 'string'
+                ? error.details.retryAt
+                : new Date(Date.now() + RETRY_DELAY_MS).toISOString();
+            if (error.details?.dispatched === true) {
+                return {
+                    phase: 'outcome_unknown',
+                    safeErrorCode: `provider_${reason}`,
+                    retryAt,
+                    retry: true,
+                };
+            }
+            if (error.details?.retryable === true) {
+                return {
+                    phase: 'pre_dispatch',
+                    safeErrorCode: `provider_${reason}`,
+                    retryAt,
+                    retry: true,
+                };
+            }
+            return {
+                phase: 'needs_attention',
+                safeErrorCode: `provider_${reason}`,
+                retryAt: null,
+                retry: false,
+            };
+        }
+        return {
+            phase: 'needs_attention',
+            safeErrorCode: 'unexpected_provider_failure',
+            retryAt: null,
+            retry: false,
+        };
+    }
+    async markNeedsAttention(row, reason) {
+        const updated = await this.storage.updateExternalManagedSubtaskLink(row.id, {
+            operationPhase: 'needs_attention',
+            safeErrorCode: reason,
+            retryAt: null,
+        });
+        return this.result(updated, 'needs_attention', reason);
+    }
+    async markUnknown(row, reason) {
+        await this.storage.updateExternalManagedSubtaskLink(row.id, {
+            operationPhase: 'outcome_unknown',
+            safeErrorCode: reason,
+            retryAt: new Date(Date.now() + RETRY_DELAY_MS).toISOString(),
+        });
+    }
+    async keepUnknownForRetry(row, reason) {
+        const updated = await this.storage.updateExternalManagedSubtaskLink(row.id, {
+            operationPhase: 'outcome_unknown',
+            safeErrorCode: reason,
+            retryAt: new Date(Date.now() + RETRY_DELAY_MS).toISOString(),
+        });
+        return this.result(updated, 'retry', reason);
+    }
+    assertOwnedSnapshot(row, snapshot) {
+        if (!snapshot.ownershipToken) {
+            throw new Error('ownership_marker_missing');
+        }
+        if (snapshot.ownershipToken !== row.ownershipToken) {
+            throw new Error('ownership_mismatch');
+        }
+        if (snapshot.parentRemoteTaskId !== row.parentRemoteTaskId) {
+            throw new Error('parent_mismatch');
+        }
+        if (snapshot.workAreaRemoteId !== row.workAreaRemoteId) {
+            throw new Error('work_area_mismatch');
+        }
+    }
+    isOwnershipFailure(error) {
+        if (error instanceof external_provider_errors_1.ExternalProviderError &&
+            (error.details?.reason === 'ownership_mismatch' ||
+                error.details?.reason === 'parent_mismatch')) {
+            return true;
+        }
+        return (error instanceof Error &&
+            [
+                'ownership_marker_missing',
+                'ownership_mismatch',
+                'parent_mismatch',
+                'work_area_mismatch',
+            ].includes(error.message));
+    }
+    ownershipFailureCode(error) {
+        if (error instanceof external_provider_errors_1.ExternalProviderError &&
+            (error.details?.reason === 'ownership_mismatch' ||
+                error.details?.reason === 'parent_mismatch')) {
+            return error.details.reason;
+        }
+        return error instanceof Error && this.isOwnershipFailure(error)
+            ? error.message
+            : 'ownership_mismatch';
+    }
+    async fenceStillCurrent(expected) {
+        const current = await this.storage.getIntegrationConnection(expected.provider);
+        return (current?.subtaskSyncEnabled === true &&
+            current.id === expected.id &&
+            current.generation === expected.generation &&
+            current.syncSettingRevision === expected.syncSettingRevision);
+    }
+    sourceSnapshot(row, desired, snapshot, credentials) {
+        const parentSnapshot = desired.parentSource.sourceSnapshot;
+        return {
+            remoteKey: snapshot.remoteKey,
+            title: snapshot.title,
+            description: snapshot.description,
+            webUrl: this.remoteWebUrl(row.provider, snapshot, credentials),
+            workAreaId: row.workAreaRemoteId,
+            workAreaName: this.sourceText(parentSnapshot, 'workAreaName') ?? row.workAreaRemoteId,
+            statusName: 'Managed by DevChain',
+            ownershipToken: row.ownershipToken,
+            parentRemoteTaskId: row.parentRemoteTaskId,
+            workAreaRemoteId: row.workAreaRemoteId,
+        };
+    }
+    remoteWebUrl(provider, snapshot, credentials) {
+        if (provider === 'clickup') {
+            const candidate = `https://app.clickup.com/t/${encodeURIComponent(snapshot.remoteTaskId)}`;
+            return (0, external_task_source_1.normalizeExternalTaskSourceUrl)(provider, candidate);
+        }
+        if (credentials.provider !== 'jira') {
+            return null;
+        }
+        const candidate = `${new URL(credentials.siteUrl).origin}/browse/${encodeURIComponent(snapshot.remoteKey)}`;
+        return (0, external_task_source_1.normalizeExternalTaskSourceUrl)(provider, candidate);
+    }
+    desiredFingerprint(epic, parentSource) {
+        return this.projectionFingerprint(epic.title, epic.description, parentSource.id, parentSource.remoteTaskId);
+    }
+    projectionFingerprint(title, description, parentSourceLinkId, parentRemoteTaskId) {
+        return (0, node_crypto_1.createHash)('sha256')
+            .update(JSON.stringify({
+            title,
+            description,
+            parentSourceLinkId,
+            parentRemoteTaskId,
+        }))
+            .digest('hex');
+    }
+    sourceText(snapshot, key) {
+        const value = snapshot[key];
+        return typeof value === 'string' && value.trim() ? value.trim() : null;
+    }
+    context(connection) {
+        return {
+            connectionId: connection.id,
+            connectionGeneration: connection.generation,
+        };
+    }
+    retryIsInFuture(retryAt) {
+        return Boolean(retryAt && Date.parse(retryAt) > Date.now());
+    }
+    async loadEpicOrNull(id) {
+        try {
+            return await this.storage.getEpic(id);
+        }
+        catch (error) {
+            if (error instanceof error_types_1.NotFoundError) {
+                return null;
+            }
+            throw error;
+        }
+    }
+    result(row, outcome, reason) {
+        return {
+            epicId: row.epicIdSnapshot,
+            provider: row.provider,
+            managedLinkId: row.id,
+            outcome,
+            ...(reason ? { reason } : {}),
+        };
+    }
+    async withProjectionLock(id, operation) {
+        const previous = this.projectionTails.get(id) ?? Promise.resolve();
+        let release;
+        const tail = new Promise((resolve) => {
+            release = resolve;
+        });
+        const queued = previous.then(() => tail);
+        this.projectionTails.set(id, queued);
+        await previous;
+        try {
+            return await operation();
+        }
+        finally {
+            release();
+            if (this.projectionTails.get(id) === queued) {
+                this.projectionTails.delete(id);
+            }
+        }
+    }
+};
+exports.ExternalSubtaskSyncSubscriber = ExternalSubtaskSyncSubscriber;
+exports.ExternalSubtaskSyncSubscriber = ExternalSubtaskSyncSubscriber = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(storage_interface_1.STORAGE_SERVICE)),
+    __metadata("design:paramtypes", [Object, events_service_1.EventsService,
+        external_task_provider_registry_1.ExternalTaskProviderRegistry,
+        provider_operation_gate_1.ProviderOperationGate])
+], ExternalSubtaskSyncSubscriber);
+//# sourceMappingURL=external-subtask-sync.subscriber.js.map