devchain-cli 0.22.1 → 0.23.0

package/dist/server/modules/external-integrations/subscribers/external-subtask-sync.subscriber.js

@@ -70,24 +70,26 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
         }
         else if (event.name === 'integration.connection.created' ||
             event.name === 'integration.connection.updated') {
-            const provider = event.payload.provider;
-            results = await this.reconcileProvider(provider);
+            results =
+                'projectId' in event.payload
+                    ? await this.reconcileProjectConnection(event.payload)
+                    : await this.reconcileLegacyConnection(event.payload.connectionId, event.payload.provider);
         }
         else if (event.name === 'integration.connection.deleted') {
-            const provider = event.payload.provider;
-            results = await this.projectDisconnected(provider);
+            results = await this.connectionDisconnected(event.payload.provider, event.payload.connectionId);
         }
         const retryCount = results.filter((result) => result.outcome === 'retry').length;
         if (retryCount > 0) {
             throw new Error(`Managed subtask reconciliation has ${retryCount} retryable projection(s).`);
         }
     }
-    async reconcileEpic(epicId, providerFilter) {
+    async reconcileEpic(epicId, providerFilter, connectionFilter) {
         const allExisting = await this.storage.listExternalManagedSubtaskLinksForEpicSnapshot(epicId);
-        const existing = allExisting.filter((row) => !providerFilter || row.provider === providerFilter);
+        const existing = allExisting.filter((row) => (!providerFilter || row.provider === providerFilter) &&
+            (!connectionFilter || row.connectionIdSnapshot === connectionFilter.id));
         const epic = await this.loadEpicOrNull(epicId);
         const desired = epic?.parentId
-            ? await this.desiredProjections(epic, providerFilter)
+            ? await this.desiredProjections(epic, providerFilter, connectionFilter)
             : new Map();
         const results = [];
         const obsolete = existing.filter((row) => !desired.has(row.parentSourceLinkIdSnapshot));
@@ -182,50 +184,118 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
         }
         return results;
     }
-    async reconcileManagedLink(id) {
+    async reconcileProjectConnection(input) {
+        const connection = await this.storage.getIntegrationConnectionById(input.connectionId);
+        if (!connection ||
+            connection.projectId !== input.projectId ||
+            connection.provider !== input.provider) {
+            return [];
+        }
+        return this.reconcileConnection(connection);
+    }
+    async reconcileLegacyConnection(legacySourceConnectionId, provider) {
+        const connections = (await this.storage.listIntegrationConnectionsByLegacySourceConnectionId(legacySourceConnectionId)).filter((connection) => connection.provider === provider);
+        const results = [];
+        for (const connection of connections) {
+            results.push(...(await this.reconcileConnection(connection)));
+        }
+        return results;
+    }
+    async reconcileConnection(connection) {
+        const results = [];
+        const existing = (await this.storage.listExternalManagedSubtaskLinksByConnection(connection.id)).filter((row) => row.provider === connection.provider);
+        const processedEpicIds = new Set();
+        for (const row of existing) {
+            if (processedEpicIds.has(row.epicIdSnapshot)) {
+                continue;
+            }
+            processedEpicIds.add(row.epicIdSnapshot);
+            results.push(...(await this.reconcileEpic(row.epicIdSnapshot, connection.provider, connection)));
+        }
+        if (!connection.projectId) {
+            return results;
+        }
+        let offset = 0;
+        while (true) {
+            const page = await this.storage.listProjectEpics(connection.projectId, {
+                type: 'all',
+                limit: 500,
+                offset,
+            });
+            for (const epic of page.items) {
+                if (epic.parentId && !processedEpicIds.has(epic.id)) {
+                    processedEpicIds.add(epic.id);
+                    results.push(...(await this.reconcileEpic(epic.id, connection.provider, connection)));
+                }
+            }
+            offset += page.items.length;
+            if (page.items.length === 0 || offset >= page.total) {
+                break;
+            }
+        }
+        return results;
+    }
+    async reconcileManagedLink(id, expectedConnectionId) {
+        return this.withProjectionLock(id, () => this.reconcileManagedLinkUnlocked(id, expectedConnectionId));
+    }
+    async verifyManagedLink(id, expectedConnectionId) {
         return this.withProjectionLock(id, async () => {
             const row = await this.storage.getExternalManagedSubtaskLink(id);
-            const epic = await this.loadEpicOrNull(row.epicIdSnapshot);
-            const desired = epic?.parentId
-                ? await this.desiredProjections(epic, row.provider)
-                : new Map();
-            return this.reconcileExisting(row, epic, desired.get(row.parentSourceLinkIdSnapshot) ?? null);
+            this.assertExpectedConnection(row, expectedConnectionId);
+            if (row.operationPhase === 'dispatch_admitted' ||
+                row.operationPhase === 'outcome_unknown' ||
+                row.operationPhase === 'needs_attention') {
+                await this.storage.updateExternalManagedSubtaskLink(id, {
+                    operationPhase: 'outcome_unknown',
+                    retryAt: null,
+                });
+            }
+            return this.reconcileManagedLinkUnlocked(id, expectedConnectionId);
         });
     }
-    async verifyManagedLink(id) {
-        const row = await this.storage.getExternalManagedSubtaskLink(id);
-        if (row.operationPhase === 'dispatch_admitted' ||
-            row.operationPhase === 'outcome_unknown' ||
-            row.operationPhase === 'needs_attention') {
+    async retryManagedLink(id, expectedConnectionId) {
+        return this.withProjectionLock(id, async () => {
+            const row = await this.storage.getExternalManagedSubtaskLink(id);
+            this.assertExpectedConnection(row, expectedConnectionId);
+            const decision = (0, managed_subtask_recovery_policy_1.managedSubtaskRetryDecision)(row);
+            if (!decision.allowed) {
+                throw new error_types_1.ConflictError(decision.reason === 'verification_required'
+                    ? 'Unknown managed-subtask outcomes must be verified before retry.'
+                    : 'Managed-subtask state does not allow Retry.', {
+                    managedLinkId: id,
+                    reason: decision.reason,
+                });
+            }
             await this.storage.updateExternalManagedSubtaskLink(id, {
-                operationPhase: 'outcome_unknown',
+                operationPhase: 'pre_dispatch',
+                safeErrorCode: null,
                 retryAt: null,
             });
-        }
-        return this.reconcileManagedLink(id);
+            return this.reconcileManagedLinkUnlocked(id, expectedConnectionId);
+        });
     }
-    async retryManagedLink(id) {
+    async reconcileManagedLinkUnlocked(id, expectedConnectionId) {
         const row = await this.storage.getExternalManagedSubtaskLink(id);
-        const decision = (0, managed_subtask_recovery_policy_1.managedSubtaskRetryDecision)(row);
-        if (!decision.allowed) {
-            throw new error_types_1.ConflictError(decision.reason === 'verification_required'
-                ? 'Unknown managed-subtask outcomes must be verified before retry.'
-                : 'Managed-subtask state does not allow Retry.', {
-                managedLinkId: id,
-                reason: decision.reason,
-            });
-        }
-        await this.storage.updateExternalManagedSubtaskLink(id, {
-            operationPhase: 'pre_dispatch',
-            safeErrorCode: null,
-            retryAt: null,
-        });
-        return this.reconcileManagedLink(id);
+        this.assertExpectedConnection(row, expectedConnectionId);
+        const [epic, connection] = await Promise.all([
+            this.loadEpicOrNull(row.epicIdSnapshot),
+            this.storage.getIntegrationConnectionById(row.connectionIdSnapshot),
+        ]);
+        const allowUnassignedConnection = Boolean(expectedConnectionId && !connection?.projectId);
+        const desired = epic?.parentId && connection
+            ? await this.desiredProjections(epic, row.provider, connection, allowUnassignedConnection)
+            : new Map();
+        return this.reconcileExisting(row, epic, desired.get(row.parentSourceLinkIdSnapshot) ?? null, allowUnassignedConnection);
     }
-    async reconcileExisting(original, epic, desired) {
+    async reconcileExisting(original, epic, desired, allowUnassignedConnection = false) {
         let row = await this.storage.getExternalManagedSubtaskLink(original.id);
-        const connection = await this.storage.getIntegrationConnection(row.provider);
-        if (!connection?.subtaskSyncEnabled) {
+        const connection = await this.storage.getIntegrationConnectionById(row.connectionIdSnapshot);
+        if (!connection ||
+            connection.provider !== row.provider ||
+            (epic &&
+                connection.projectId !== epic.projectId &&
+                !(allowUnassignedConnection && connection.projectId === null)) ||
+            !connection.subtaskSyncEnabled) {
             return this.result(row, 'paused', connection ? 'sync_disabled' : 'connection_missing');
         }
         row = await this.refreshConnectionFence(row, connection);
@@ -235,6 +305,7 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
                     row.safeErrorCode?.startsWith('provider_') === true));
         if ((!epic || !desired) && safeAbsentProjection) {
             await this.storage.removeExternalManagedSubtaskLink(row.id);
+            await this.publishEpicTimeScopeHint(row.epicIdSnapshot);
             return this.result(row, 'deleted');
         }
         if (row.operationPhase === 'needs_attention' || row.tombstoneState === 'orphan_risk') {
@@ -308,6 +379,19 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
         }
         return this.updateProjection(row, epic, desired);
     }
+    async publishEpicTimeScopeHint(epicId) {
+        if (!epicId)
+            return;
+        try {
+            const epic = await this.storage.getEpic(epicId);
+            const project = await this.storage.getProject(epic.projectId);
+            await this.events.publish('epic.time.scope.invalidated', {
+                workspaceId: project.workspaceId,
+            });
+        }
+        catch {
+        }
+    }
     async createProjection(row, epic, desired) {
         const admission = await this.admitMutation(row);
         if (!admission) {
@@ -317,8 +401,8 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
             const snapshot = await admission.capability.create(admission.credentials, admission.context, {
                 parentRemoteTaskId: row.parentRemoteTaskId,
                 ownershipToken: row.ownershipToken,
-                title: epic.title,
-                description: epic.description,
+                title: desired.content.title,
+                description: desired.content.description,
             });
             if (!(await this.fenceStillCurrent(admission.connection))) {
                 await this.markUnknown(row, 'connection_changed_after_dispatch');
@@ -333,6 +417,7 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
                 confirmedFingerprint: row.desiredFingerprint,
                 sourceSnapshot: this.sourceSnapshot(row, desired, snapshot, admission.credentials),
             });
+            await this.publishEpicTimeScopeHint(confirmed.managedLink.epicIdSnapshot);
             return this.result(confirmed.managedLink, 'confirmed');
         }
         catch (error) {
@@ -356,8 +441,8 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
                 remoteTaskId: row.remoteTaskId,
                 expectedParentRemoteTaskId: row.parentRemoteTaskId,
                 ownershipToken: row.ownershipToken,
-                title: epic.title,
-                description: epic.description,
+                title: desired.content.title,
+                description: desired.content.description,
             });
             const snapshot = await admission.capability.readExact(admission.credentials, admission.context, row.remoteTaskId);
             if (!(await this.fenceStillCurrent(admission.connection))) {
@@ -368,7 +453,7 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
                 return this.keepUnknownForRetry(row, 'remote_task_missing_after_update');
             }
             this.assertOwnedSnapshot(row, snapshot);
-            if (!(0, managed_subtask_content_1.managedSubtaskContentMatches)(row.provider, snapshot, epic)) {
+            if (!(0, managed_subtask_content_1.managedSubtaskContentMatches)(row.provider, snapshot, desired.content)) {
                 return this.keepUnknownForRetry(row, 'remote_verification_mismatch');
             }
             const confirmed = await this.storage.confirmExternalManagedSubtaskLink({
@@ -379,6 +464,7 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
                 confirmedFingerprint: row.desiredFingerprint,
                 sourceSnapshot: this.sourceSnapshot(row, desired, snapshot, admission.credentials),
             });
+            await this.publishEpicTimeScopeHint(confirmed.managedLink.epicIdSnapshot);
             return this.result(confirmed.managedLink, 'confirmed');
         }
         catch (error) {
@@ -388,6 +474,7 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
     async deleteProjection(row) {
         if (!row.remoteTaskId) {
             await this.storage.removeExternalManagedSubtaskLink(row.id);
+            await this.publishEpicTimeScopeHint(row.epicIdSnapshot);
             return this.result(row, 'deleted');
         }
         const remoteTaskId = row.remoteTaskId;
@@ -419,6 +506,7 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
                 return this.result(row, 'retry', 'connection_changed_after_dispatch');
             }
             await this.storage.removeExternalManagedSubtaskLink(row.id);
+            await this.publishEpicTimeScopeHint(row.epicIdSnapshot);
             return this.result(row, 'deleted');
         }
         catch (error) {
@@ -429,7 +517,7 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
         if (!row.remoteTaskId) {
             return this.resolveUnknownCreate(row, epic, desired);
         }
-        const access = await this.captureReadAccess(row.provider);
+        const access = await this.captureReadAccess(row);
         if (!access) {
             return this.result(row, 'retry', 'verification_unavailable');
         }
@@ -442,7 +530,7 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
                 return this.markNeedsAttention(row, 'remote_task_missing_after_unknown_update');
             }
             this.assertOwnedSnapshot(row, snapshot);
-            if ((0, managed_subtask_content_1.managedSubtaskContentMatches)(row.provider, snapshot, epic)) {
+            if ((0, managed_subtask_content_1.managedSubtaskContentMatches)(row.provider, snapshot, desired.content)) {
                 const confirmed = await this.storage.confirmExternalManagedSubtaskLink({
                     managedLinkId: row.id,
                     remoteTaskId: snapshot.remoteTaskId,
@@ -451,6 +539,7 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
                     confirmedFingerprint: row.desiredFingerprint,
                     sourceSnapshot: this.sourceSnapshot(row, desired, snapshot, access.credentials),
                 });
+                await this.publishEpicTimeScopeHint(confirmed.managedLink.epicIdSnapshot);
                 return this.result(confirmed.managedLink, 'confirmed');
             }
             const retryable = await this.storage.updateExternalManagedSubtaskLink(row.id, {
@@ -468,7 +557,7 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
         }
     }
     async resolveUnknownCreate(row, epic, desired) {
-        const access = await this.captureReadAccess(row.provider);
+        const access = await this.captureReadAccess(row);
         if (!access) {
             return this.result(row, 'retry', 'verification_unavailable');
         }
@@ -485,7 +574,7 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
             if (matches.length === 1) {
                 const snapshot = matches[0];
                 this.assertOwnedSnapshot(row, snapshot);
-                adoptedMatchesDesired = (0, managed_subtask_content_1.managedSubtaskContentMatches)(row.provider, snapshot, epic);
+                adoptedMatchesDesired = (0, managed_subtask_content_1.managedSubtaskContentMatches)(row.provider, snapshot, desired.content);
                 adoptedFingerprint = adoptedMatchesDesired
                     ? row.desiredFingerprint
                     : this.projectionFingerprint(snapshot.title, snapshot.description, row.parentSourceLinkIdSnapshot, row.parentRemoteTaskId);
@@ -497,6 +586,7 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
                     confirmedFingerprint: adoptedFingerprint,
                     sourceSnapshot: this.sourceSnapshot(row, desired, snapshot, access.credentials),
                 });
+                await this.publishEpicTimeScopeHint(confirmed.managedLink.epicIdSnapshot);
                 adopted = confirmed.managedLink;
             }
             if (!adopted && matches.length === 0 && children.complete) {
@@ -520,7 +610,7 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
         return this.updateProjection(adopted, epic, desired);
     }
     async resolveUnknownCreateForRemoval(row, tombstoneState) {
-        const access = await this.captureReadAccess(row.provider);
+        const access = await this.captureReadAccess(row);
         if (!access) {
             return this.result(row, 'retry', 'verification_unavailable');
         }
@@ -533,6 +623,7 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
                 item.parentRemoteTaskId === row.parentRemoteTaskId);
             if (matches.length === 0 && children.complete) {
                 await this.storage.removeExternalManagedSubtaskLink(row.id);
+                await this.publishEpicTimeScopeHint(row.epicIdSnapshot);
                 return this.result(row, 'deleted');
             }
             if (matches.length !== 1) {
@@ -561,9 +652,10 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
     async resolveUnknownDelete(row) {
         if (!row.remoteTaskId) {
             await this.storage.removeExternalManagedSubtaskLink(row.id);
+            await this.publishEpicTimeScopeHint(row.epicIdSnapshot);
             return this.result(row, 'deleted');
         }
-        const access = await this.captureReadAccess(row.provider);
+        const access = await this.captureReadAccess(row);
         if (!access) {
             return this.result(row, 'retry', 'verification_unavailable');
         }
@@ -574,6 +666,7 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
             }
             if (!snapshot) {
                 await this.storage.removeExternalManagedSubtaskLink(row.id);
+                await this.publishEpicTimeScopeHint(row.epicIdSnapshot);
                 return this.result(row, 'deleted');
             }
             this.assertOwnedSnapshot(row, snapshot);
@@ -595,7 +688,7 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
         if (!row.remoteTaskId) {
             return this.createProjection(row, epic, desired);
         }
-        const access = await this.captureReadAccess(row.provider);
+        const access = await this.captureReadAccess(row);
         if (!access) {
             return this.result(row, 'retry', 'verification_unavailable');
         }
@@ -616,6 +709,7 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
                 confirmedFingerprint: row.desiredFingerprint,
                 sourceSnapshot: this.sourceSnapshot(row, desired, snapshot, access.credentials),
             });
+            await this.publishEpicTimeScopeHint(repaired.managedLink.epicIdSnapshot);
             return this.result(repaired.managedLink, 'confirmed', 'recognition_repaired');
         }
         catch (error) {
@@ -629,7 +723,7 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
         if (!row.remoteTaskId) {
             return this.markNeedsAttention(row, 'remote_identity_missing');
         }
-        const access = await this.captureReadAccess(row.provider);
+        const access = await this.captureReadAccess(row);
         if (!access) {
             return this.result(row, 'retry', 'ownership_verification_unavailable');
         }
@@ -652,22 +746,29 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
         }
     }
     async admitMutation(row) {
+        const scopedConnection = await this.storage.getIntegrationConnectionById(row.connectionIdSnapshot);
+        if (!scopedConnection || scopedConnection.provider !== row.provider) {
+            return null;
+        }
         try {
-            return await this.providerGate.run(row.provider, async () => {
-                const connection = await this.storage.getIntegrationConnection(row.provider);
+            return await this.providerGate.run(this.connectionOperationScope(scopedConnection), async () => {
+                const connection = await this.storage.getIntegrationConnectionById(row.connectionIdSnapshot);
                 if (!connection?.subtaskSyncEnabled ||
+                    connection.projectId !== scopedConnection.projectId ||
                     connection.id !== row.connectionIdSnapshot ||
                     connection.generation !== row.connectionGeneration ||
                     connection.syncSettingRevision !== row.syncSettingRevision) {
                     return null;
                 }
                 const adapter = this.providers.get(row.provider);
-                const credentials = await this.storage.getIntegrationConnectionCredentials(row.provider);
-                const rechecked = await this.storage.getIntegrationConnection(row.provider);
+                const credentials = await this.storage.getIntegrationConnectionCredentialsById(row.connectionIdSnapshot);
+                const rechecked = await this.storage.getIntegrationConnectionById(row.connectionIdSnapshot);
                 if (!adapter.subtaskSync ||
                     !credentials ||
                     credentials.provider !== row.provider ||
                     !rechecked?.subtaskSyncEnabled ||
+                    rechecked.projectId !== connection.projectId ||
+                    rechecked.provider !== row.provider ||
                     rechecked.id !== connection.id ||
                     rechecked.generation !== connection.generation ||
                     rechecked.syncSettingRevision !== connection.syncSettingRevision) {
@@ -698,18 +799,26 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
             throw error;
         }
     }
-    async captureReadAccess(provider) {
+    async captureReadAccess(row) {
+        const scopedConnection = await this.storage.getIntegrationConnectionById(row.connectionIdSnapshot);
+        if (!scopedConnection || scopedConnection.provider !== row.provider) {
+            return null;
+        }
         try {
-            return await this.providerGate.run(provider, async () => {
-                const connection = await this.storage.getIntegrationConnection(provider);
-                const adapter = this.providers.get(provider);
-                const credentials = await this.storage.getIntegrationConnectionCredentials(provider);
-                const rechecked = await this.storage.getIntegrationConnection(provider);
-                if (!connection?.subtaskSyncEnabled ||
+            return await this.providerGate.run(this.connectionOperationScope(scopedConnection), async () => {
+                const connection = await this.storage.getIntegrationConnectionById(row.connectionIdSnapshot);
+                const adapter = this.providers.get(row.provider);
+                const credentials = await this.storage.getIntegrationConnectionCredentialsById(row.connectionIdSnapshot);
+                const rechecked = await this.storage.getIntegrationConnectionById(row.connectionIdSnapshot);
+                if (connection?.provider !== row.provider ||
+                    connection.projectId !== scopedConnection.projectId ||
+                    !connection.subtaskSyncEnabled ||
                     !adapter.subtaskSync ||
                     !credentials ||
-                    credentials.provider !== provider ||
+                    credentials.provider !== row.provider ||
                     !rechecked?.subtaskSyncEnabled ||
+                    rechecked.projectId !== connection.projectId ||
+                    rechecked.provider !== row.provider ||
                     rechecked.id !== connection.id ||
                     rechecked.generation !== connection.generation ||
                     rechecked.syncSettingRevision !== connection.syncSettingRevision) {
@@ -743,7 +852,7 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
                 syncSettingRevision: connection.syncSettingRevision,
             });
         }
-        const access = await this.captureReadAccess(row.provider);
+        const access = await this.captureReadAccess(row);
         if (!access) {
             return this.storage.updateExternalManagedSubtaskLink(row.id, {
                 operationPhase: 'pre_dispatch',
@@ -792,18 +901,35 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
             });
         }
     }
-    async desiredProjections(epic, providerFilter) {
+    async desiredProjections(epic, providerFilter, connectionFilter, allowUnassignedConnection = false) {
         const result = new Map();
         if (!epic.parentId) {
             return result;
         }
+        const workspaceProjects = await this.storage.getProjectWorkspaceSnapshot(epic.projectId);
+        const project = workspaceProjects.find((candidate) => candidate.id === epic.projectId);
+        if (!project) {
+            throw new error_types_1.NotFoundError('Project', epic.projectId);
+        }
+        const content = (0, managed_subtask_content_1.redactManagedSubtaskContent)(epic, project.rootPath, undefined, {
+            owningProjectId: project.id,
+            projects: workspaceProjects,
+        });
         const sources = await this.storage.listExternalTaskLinksForEpic(epic.parentId);
         for (const source of sources) {
             if (providerFilter && source.provider !== providerFilter) {
                 continue;
             }
-            const connection = await this.storage.getIntegrationConnection(source.provider);
+            if (connectionFilter && source.connectionId !== connectionFilter.id) {
+                continue;
+            }
+            let connection = connectionFilter ?? null;
+            if (!connection && source.connectionId) {
+                connection = await this.storage.getIntegrationConnectionById(source.connectionId);
+            }
             if (!connection?.subtaskSyncEnabled ||
+                (connection.projectId !== epic.projectId &&
+                    !(allowUnassignedConnection && connection.projectId === null)) ||
                 source.connectionId !== connection.id ||
                 !this.providers.get(source.provider).subtaskSync) {
                 continue;
@@ -814,10 +940,11 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
             }
             result.set(source.id, {
                 epic,
+                content,
                 parentSource: source,
                 connection,
                 workAreaRemoteId,
-                desiredFingerprint: this.desiredFingerprint(epic, source),
+                desiredFingerprint: this.desiredFingerprint(content, source),
             });
         }
         return result;
@@ -836,7 +963,7 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
                 parentRemoteTaskId: desired.parentSource.remoteTaskId,
                 connectionGeneration: desired.connection.generation,
                 syncSettingRevision: desired.connection.syncSettingRevision,
-                ownershipToken: (0, node_crypto_1.randomUUID)(),
+                ownershipToken: (0, node_crypto_1.randomUUID)().slice(0, 8),
                 desiredVersion: desired.epic.version,
                 desiredFingerprint: desired.desiredFingerprint,
             });
@@ -849,8 +976,8 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
             throw error;
         }
     }
-    async projectDisconnected(provider) {
-        const rows = await this.storage.listExternalManagedSubtaskLinksByProvider(provider);
+    async connectionDisconnected(provider, connectionIdSnapshot) {
+        const rows = (await this.storage.listExternalManagedSubtaskLinksByConnection(connectionIdSnapshot)).filter((row) => row.provider === provider);
         return Promise.all(rows.map(async (row) => {
             const updated = await this.storage.updateExternalManagedSubtaskLink(row.id, {
                 safeErrorCode: 'connection_missing',
@@ -983,7 +1110,7 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
             : 'ownership_mismatch';
     }
     async fenceStillCurrent(expected) {
-        const current = await this.storage.getIntegrationConnection(expected.provider);
+        const current = await this.storage.getIntegrationConnectionById(expected.id);
         return (current?.subtaskSyncEnabled === true &&
             current.id === expected.id &&
             current.generation === expected.generation &&
@@ -1015,8 +1142,8 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
         const candidate = `${new URL(credentials.siteUrl).origin}/browse/${encodeURIComponent(snapshot.remoteKey)}`;
         return (0, external_task_source_1.normalizeExternalTaskSourceUrl)(provider, candidate);
     }
-    desiredFingerprint(epic, parentSource) {
-        return this.projectionFingerprint(epic.title, epic.description, parentSource.id, parentSource.remoteTaskId);
+    desiredFingerprint(content, parentSource) {
+        return this.projectionFingerprint(content.title, content.description, parentSource.id, parentSource.remoteTaskId);
     }
     projectionFingerprint(title, description, parentSourceLinkId, parentRemoteTaskId) {
         return (0, node_crypto_1.createHash)('sha256')
@@ -1038,9 +1165,19 @@ let ExternalSubtaskSyncSubscriber = class ExternalSubtaskSyncSubscriber {
             connectionGeneration: connection.generation,
         };
     }
+    connectionOperationScope(connection) {
+        return connection.projectId
+            ? { projectId: connection.projectId, provider: connection.provider }
+            : { connectionId: connection.id, provider: connection.provider };
+    }
     retryIsInFuture(retryAt) {
         return Boolean(retryAt && Date.parse(retryAt) > Date.now());
     }
+    assertExpectedConnection(row, expectedConnectionId) {
+        if (expectedConnectionId && row.connectionIdSnapshot !== expectedConnectionId) {
+            throw new error_types_1.NotFoundError('Managed subtask link', row.id);
+        }
+    }
     async loadEpicOrNull(id) {
         try {
             return await this.storage.getEpic(id);