@sentry/junior-github 0.105.0 → 0.107.0

package/dist/index.js

@@ -1,3 +1,8 @@
+import {
+  gitHubPullRequestSubscribable,
+  normalizeGitHubResourceEvents
+} from "./chunk-JDNXIBCQ.js";
+
 // src/index.ts
 import { createPrivateKey, createSign } from "crypto";
 import {
@@ -293,14 +298,14 @@ function parseRepo(value) {
   };
 }
 async function readJsonResponse(response) {
-  const text = await response.text();
-  if (!text) {
+  const text2 = await response.text();
+  if (!text2) {
     return void 0;
   }
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return text;
+    return text2;
   }
 }
 function githubApiErrorMessage(payload) {
@@ -472,6 +477,7 @@ import {
 import { Type as Type2 } from "@sinclair/typebox";
 import { Value as Value2 } from "@sinclair/typebox/value";
 import { z as z2 } from "zod";
+import { subscribableResourceSchema } from "@sentry/junior-plugin-api";
 var GITHUB_PULL_REQUEST_CREATE_IDEMPOTENCY_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 var GITHUB_PULL_REQUEST_CREATE_LOCK_TTL_MS = 6e4;
 var GitHubPullRequestCreateRejectedError = class extends Error {
@@ -537,14 +543,6 @@ var createPullRequestStateSchema = Type2.Union([
     { additionalProperties: false }
   )
 ]);
-var subscribableResourceSchema = z2.object({
-  provider: z2.string(),
-  type: z2.string(),
-  resourceRef: z2.string(),
-  label: z2.string(),
-  supportedEvents: z2.array(z2.string()),
-  suggestedEvents: z2.array(z2.string()).optional()
-}).strict();
 var gitHubPullRequestDataSchema = z2.object({
   number: z2.number(),
   url: z2.string(),
@@ -586,14 +584,14 @@ function parseRepo2(value) {
   };
 }
 async function readJsonResponse2(response) {
-  const text = await response.text();
-  if (!text) {
+  const text2 = await response.text();
+  if (!text2) {
     return void 0;
   }
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return text;
+    return text2;
   }
 }
 function githubApiErrorMessage2(payload) {
@@ -706,45 +704,13 @@ async function createGitHubPullRequest(ctx, request) {
     url: pullRequest.html_url
   };
 }
-function gitHubPullRequestSubscribable(input, result) {
-  const repo = parseRepo2(input.repo);
-  const repoRef = `${repo.owner}/${repo.name}`;
-  const supportedEvents = [
-    "checks.failed",
-    "checks.recovered",
-    "comment.created",
-    "review.approved",
-    "review.changes_requested",
-    "review.commented",
-    "review_comment.created",
-    "state.merged",
-    "state.closed_unmerged"
-  ];
-  return {
-    label: `GitHub PR ${repoRef}#${result.number}`,
-    provider: "github",
-    resourceRef: `github:pull_request:${repoRef}#${result.number}`,
-    suggestedEvents: [
-      "checks.failed",
-      "comment.created",
-      "review.changes_requested",
-      "review.commented",
-      "review_comment.created",
-      "state.merged",
-      "state.closed_unmerged"
-    ],
-    supportedEvents,
-    type: "pull_request"
-  };
-}
 function gitHubPullRequestToolResult(input, result) {
-  if (!process.env.GITHUB_WEBHOOK_SECRET?.trim()) {
-    return result;
-  }
-  return {
-    ...result,
-    subscribable: gitHubPullRequestSubscribable(input, result)
-  };
+  const repo = parseRepo2(input.repo);
+  const subscribable = gitHubPullRequestSubscribable({
+    number: result.number,
+    repo: `${repo.owner}/${repo.name}`
+  });
+  return { ...result, ...subscribable ? { subscribable } : {} };
 }
 function gitHubPullRequestStructuredResult(input, result) {
   const data = gitHubPullRequestToolResult(input, result);
@@ -832,11 +798,699 @@ function createGitHubPullRequestTool(ctx) {
   });
 }
 
+// src/tools/get-pull-request.ts
+import {
+  definePluginTool as definePluginTool3,
+  PluginToolInputError as PluginToolInputError4,
+  pluginToolResultSchema as pluginToolResultSchema3
+} from "@sentry/junior-plugin-api";
+import { z as z3 } from "zod";
+import { subscribableResourceSchema as subscribableResourceSchema2 } from "@sentry/junior-plugin-api";
+var inputSchema = z3.object({
+  repo: z3.string().describe('Repository in "owner/name" format.'),
+  number: z3.number().int().positive().describe("Pull request number.")
+}).strict();
+var pullRequestSchema = z3.object({
+  base: z3.string(),
+  draft: z3.boolean(),
+  head: z3.string(),
+  merged: z3.boolean(),
+  number: z3.number(),
+  state: z3.string(),
+  subscribable: subscribableResourceSchema2.optional(),
+  title: z3.string(),
+  url: z3.string()
+});
+var outputSchema = pluginToolResultSchema3.extend({
+  ok: z3.literal(true),
+  status: z3.literal("success"),
+  target: z3.literal("getPullRequest"),
+  data: pullRequestSchema,
+  ...pullRequestSchema.shape
+});
+function parseRepo3(value) {
+  const parts = value.split("/").map((part) => part.trim());
+  if (parts.length !== 2 || !parts[0] || !parts[1]) {
+    throw new PluginToolInputError4('repo must use "owner/name" format');
+  }
+  return { owner: parts[0], name: parts[1], ref: `${parts[0]}/${parts[1]}` };
+}
+async function readJson(response) {
+  const text2 = await response.text();
+  if (!text2) return void 0;
+  try {
+    return JSON.parse(text2);
+  } catch {
+    return text2;
+  }
+}
+function createGitHubGetPullRequestTool(ctx) {
+  return definePluginTool3({
+    description: "Get a GitHub pull request. Use this when an existing PR may need resource-event monitoring; the result includes a subscribable hint when GitHub webhooks are configured.",
+    inputSchema,
+    outputSchema,
+    async execute(input) {
+      const repo = parseRepo3(input.repo);
+      const response = await ctx.egress.fetch({
+        provider: "github",
+        operation: "github.pull.get",
+        request: new Request(
+          `https://api.github.com/repos/${encodeURIComponent(repo.owner)}/${encodeURIComponent(repo.name)}/pulls/${input.number}`,
+          {
+            headers: {
+              Accept: "application/vnd.github+json",
+              "X-GitHub-Api-Version": "2022-11-28"
+            }
+          }
+        )
+      });
+      const parsed = await readJson(response);
+      if (!response.ok)
+        throw new Error(
+          `GitHub pull request lookup failed with HTTP ${response.status}`
+        );
+      const providerResult = z3.object({
+        base: z3.object({ ref: z3.string() }),
+        draft: z3.boolean(),
+        head: z3.object({ ref: z3.string() }),
+        html_url: z3.string(),
+        merged: z3.boolean().optional().default(false),
+        number: z3.number(),
+        state: z3.string(),
+        title: z3.string()
+      }).parse(parsed);
+      const subscribable = gitHubPullRequestSubscribable({
+        number: providerResult.number,
+        repo: repo.ref
+      });
+      const data = {
+        base: providerResult.base.ref,
+        draft: providerResult.draft,
+        head: providerResult.head.ref,
+        merged: providerResult.merged,
+        number: providerResult.number,
+        state: providerResult.state,
+        ...subscribable ? { subscribable } : {},
+        title: providerResult.title,
+        url: providerResult.html_url
+      };
+      return {
+        ok: true,
+        status: "success",
+        target: "getPullRequest",
+        data,
+        ...data
+      };
+    }
+  });
+}
+
+// src/tools/update-pull-request.ts
+import {
+  definePluginTool as definePluginTool4,
+  PluginToolInputError as PluginToolInputError5,
+  pluginToolResultSchema as pluginToolResultSchema4
+} from "@sentry/junior-plugin-api";
+import { z as z4 } from "zod";
+import { subscribableResourceSchema as subscribableResourceSchema3 } from "@sentry/junior-plugin-api";
+var inputSchema2 = z4.object({
+  repo: z4.string().describe('Repository in "owner/name" format.'),
+  number: z4.number().int().positive().describe("Pull request number."),
+  title: z4.string().trim().min(1).optional().describe("Replacement pull request title."),
+  body: z4.string().optional().describe(
+    "Replacement pull request body. Junior appends requester attribution and the conversation footer."
+  ),
+  base: z4.string().trim().min(1).optional().describe("Replacement base branch."),
+  state: z4.enum(["open", "closed"]).optional().describe("Replacement pull request state.")
+}).strict().refine(
+  ({ title, body, base, state }) => title !== void 0 || body !== void 0 || base !== void 0 || state !== void 0,
+  { message: "At least one pull request field must be provided." }
+);
+var pullRequestSchema2 = z4.object({
+  base: z4.string(),
+  body: z4.string().nullable(),
+  draft: z4.boolean(),
+  number: z4.number(),
+  state: z4.string(),
+  subscribable: subscribableResourceSchema3.optional(),
+  title: z4.string(),
+  url: z4.string()
+});
+var outputSchema2 = pluginToolResultSchema4.extend({
+  ok: z4.literal(true),
+  status: z4.literal("success"),
+  target: z4.literal("updatePullRequest"),
+  data: pullRequestSchema2,
+  ...pullRequestSchema2.shape
+});
+function nonEmptyString4(value, name) {
+  if (!value?.trim()) {
+    throw new PluginToolInputError5(`${name} is required`);
+  }
+  return value.trim();
+}
+function parseRepo4(value) {
+  const parts = value.split("/").map((part) => part.trim());
+  if (parts.length !== 2 || !parts[0] || !parts[1]) {
+    throw new PluginToolInputError5('repo must use "owner/name" format');
+  }
+  return { owner: parts[0], name: parts[1], ref: `${parts[0]}/${parts[1]}` };
+}
+async function readJson2(response) {
+  const text2 = await response.text();
+  if (!text2) return void 0;
+  try {
+    return JSON.parse(text2);
+  } catch {
+    return text2;
+  }
+}
+function githubApiErrorMessage3(payload) {
+  if (payload && typeof payload === "object" && !Array.isArray(payload)) {
+    const message = payload.message;
+    if (typeof message === "string" && message.trim()) return message.trim();
+  }
+  if (typeof payload === "string" && payload.trim()) return payload.trim();
+  return "GitHub request failed";
+}
+function createGitHubUpdatePullRequestTool(ctx) {
+  return definePluginTool4({
+    description: "Update an existing GitHub pull request's title, body, base branch, or open/closed state. Use this instead of raw GitHub API calls when changing PR metadata.",
+    inputSchema: inputSchema2,
+    outputSchema: outputSchema2,
+    async execute(input) {
+      const parsedInput = inputSchema2.safeParse(input);
+      if (!parsedInput.success) {
+        throw new PluginToolInputError5(
+          "Invalid GitHub updatePullRequest input.",
+          { cause: parsedInput.error }
+        );
+      }
+      const update = parsedInput.data;
+      const repo = parseRepo4(update.repo);
+      const payload = {
+        ...update.title !== void 0 ? { title: update.title } : {},
+        ...update.body !== void 0 ? {
+          body: appendGitHubFooter(
+            appendGitHubRequesterAttribution(update.body, ctx.actor),
+            nonEmptyString4(ctx.conversationId, "conversationId"),
+            ctx.slack?.conversationLink?.url
+          )
+        } : {},
+        ...update.base !== void 0 ? { base: update.base } : {},
+        ...update.state !== void 0 ? { state: update.state } : {}
+      };
+      const response = await ctx.egress.fetch({
+        provider: "github",
+        operation: "github.pull.update",
+        request: new Request(
+          `https://api.github.com/repos/${encodeURIComponent(repo.owner)}/${encodeURIComponent(repo.name)}/pulls/${update.number}`,
+          {
+            method: "PATCH",
+            headers: {
+              Accept: "application/vnd.github+json",
+              "Content-Type": "application/json",
+              "X-GitHub-Api-Version": "2022-11-28"
+            },
+            body: JSON.stringify(payload)
+          }
+        )
+      });
+      const parsed = await readJson2(response);
+      if (!response.ok) {
+        throw new Error(
+          `GitHub pull request update failed with HTTP ${response.status}: ${githubApiErrorMessage3(parsed)}`
+        );
+      }
+      const providerResult = z4.object({
+        base: z4.object({ ref: z4.string() }),
+        body: z4.string().nullable().optional().default(null),
+        draft: z4.boolean(),
+        html_url: z4.string(),
+        number: z4.number(),
+        state: z4.string(),
+        title: z4.string()
+      }).parse(parsed);
+      const subscribable = gitHubPullRequestSubscribable({
+        number: providerResult.number,
+        repo: repo.ref
+      });
+      const data = {
+        base: providerResult.base.ref,
+        body: providerResult.body,
+        draft: providerResult.draft,
+        number: providerResult.number,
+        state: providerResult.state,
+        ...subscribable ? { subscribable } : {},
+        title: providerResult.title,
+        url: providerResult.html_url
+      };
+      return {
+        ok: true,
+        status: "success",
+        target: "updatePullRequest",
+        data,
+        ...data
+      };
+    }
+  });
+}
+
 // src/tools.ts
 function createGitHubTools(ctx) {
   return {
     createIssue: createGitHubIssueTool(ctx),
-    createPullRequest: createGitHubPullRequestTool(ctx)
+    createPullRequest: createGitHubPullRequestTool(ctx),
+    getPullRequest: createGitHubGetPullRequestTool(ctx),
+    updatePullRequest: createGitHubUpdatePullRequestTool(ctx)
+  };
+}
+
+// src/webhooks/handler.ts
+import { createHmac, timingSafeEqual } from "crypto";
+
+// src/pull-request-outcomes/store.ts
+import { and, eq, lte } from "drizzle-orm";
+import { z as z6 } from "zod";
+
+// src/db/schema.ts
+import { sql } from "drizzle-orm";
+import { index, integer, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+import { z as z5 } from "zod";
+var githubPullRequestStateSchema = z5.enum([
+  "closed_unmerged",
+  "merged",
+  "open"
+]);
+var juniorGitHubPullRequests = pgTable(
+  "junior_github_pull_requests",
+  {
+    pullRequestId: text("pull_request_id").primaryKey(),
+    repositoryId: text("repository_id").notNull(),
+    repositoryFullName: text("repository_full_name").notNull(),
+    number: integer("number").notNull(),
+    state: text("state").$type().notNull(),
+    openedAt: timestamp("opened_at", { withTimezone: true }).notNull(),
+    mergedAt: timestamp("merged_at", { withTimezone: true }),
+    closedAt: timestamp("closed_at", { withTimezone: true }),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull()
+  },
+  (table) => [
+    index("junior_github_pull_requests_opened_at_idx").on(table.openedAt),
+    index("junior_github_pull_requests_merged_at_idx").on(table.mergedAt),
+    index("junior_github_pull_requests_closed_at_idx").on(table.closedAt),
+    index("junior_github_pull_requests_open_idx").on(table.pullRequestId).where(sql`${table.state} = 'open'`)
+  ]
+);
+
+// src/pull-request-outcomes/store.ts
+var githubPullRequestOutcomeInputSchema = z6.object({
+  candidateOwned: z6.boolean(),
+  closedAt: z6.date().optional(),
+  mergedAt: z6.date().optional(),
+  number: z6.number().int().positive(),
+  openedAt: z6.date(),
+  pullRequestId: z6.string().min(1),
+  repositoryFullName: z6.string().min(1),
+  repositoryId: z6.string().min(1),
+  state: githubPullRequestStateSchema,
+  updatedAt: z6.date()
+}).strict();
+function projectionValues(input) {
+  return {
+    closedAt: input.closedAt ?? null,
+    mergedAt: input.mergedAt ?? null,
+    number: input.number,
+    openedAt: input.openedAt,
+    repositoryFullName: input.repositoryFullName,
+    repositoryId: input.repositoryId,
+    state: input.state,
+    updatedAt: input.updatedAt
+  };
+}
+async function recordGitHubPullRequestOutcome(db, input) {
+  const outcome = githubPullRequestOutcomeInputSchema.parse(input);
+  const values = projectionValues(outcome);
+  if (!outcome.candidateOwned) {
+    await db.update(juniorGitHubPullRequests).set(values).where(
+      and(
+        eq(juniorGitHubPullRequests.pullRequestId, outcome.pullRequestId),
+        lte(juniorGitHubPullRequests.updatedAt, outcome.updatedAt)
+      )
+    );
+    return;
+  }
+  await db.insert(juniorGitHubPullRequests).values({ pullRequestId: outcome.pullRequestId, ...values }).onConflictDoUpdate({
+    target: juniorGitHubPullRequests.pullRequestId,
+    set: values,
+    where: lte(juniorGitHubPullRequests.updatedAt, outcome.updatedAt)
+  });
+}
+
+// src/webhooks/pull-request-outcome.ts
+import { z as z7 } from "zod";
+var pullRequestOutcomeSchema = z7.object({
+  action: z7.enum(["opened", "closed", "reopened"]),
+  pull_request: z7.object({
+    body: z7.string().nullable().optional(),
+    closed_at: z7.string().nullable().optional(),
+    created_at: z7.string(),
+    id: z7.number().int().positive(),
+    merged: z7.boolean(),
+    merged_at: z7.string().nullable().optional(),
+    number: z7.number().int().positive(),
+    updated_at: z7.string(),
+    user: z7.object({ login: z7.string().min(1) })
+  }),
+  repository: z7.object({
+    full_name: z7.string().min(1),
+    id: z7.number().int().positive()
+  })
+});
+var pullRequestLifecycleActionSchema = z7.object({ action: z7.string() });
+var GITHUB_NOREPLY_DOMAIN = "users.noreply.github.com";
+function botLoginFromEmail(value) {
+  const email = value?.trim();
+  if (!email) return void 0;
+  const separator = email.lastIndexOf("@");
+  if (separator <= 0) return void 0;
+  const domain = email.slice(separator + 1).toLowerCase();
+  if (domain !== GITHUB_NOREPLY_DOMAIN) return void 0;
+  const localPart = email.slice(0, separator);
+  const login = localPart.slice(localPart.indexOf("+") + 1).trim();
+  return login.toLowerCase().endsWith("[bot]") ? login : void 0;
+}
+function timestamp2(value) {
+  if (!value) return void 0;
+  const parsed = new Date(value);
+  return Number.isFinite(parsed.getTime()) ? parsed : void 0;
+}
+function normalizeGitHubPullRequestOutcome(args) {
+  const lifecycle = pullRequestLifecycleActionSchema.safeParse(args.body);
+  if (!lifecycle.success || !["opened", "closed", "reopened"].includes(lifecycle.data.action)) {
+    return void 0;
+  }
+  const parsed = pullRequestOutcomeSchema.parse(args.body);
+  const pullRequest = parsed.pull_request;
+  const openedAt = timestamp2(pullRequest.created_at);
+  const updatedAt = timestamp2(pullRequest.updated_at);
+  if (!openedAt || !updatedAt) {
+    throw new Error("GitHub pull request lifecycle timestamps are invalid");
+  }
+  const authorLogin = pullRequest.user.login.trim().toLowerCase();
+  const botLogin = botLoginFromEmail(args.botEmail)?.toLowerCase();
+  if (parsed.action === "opened" && !botLogin) {
+    throw new Error(
+      "The configured GitHub App bot email must encode a [bot] login in GitHub's noreply format to classify pull request ownership"
+    );
+  }
+  const hasOwnershipMarker = Boolean(
+    botLogin && authorLogin === botLogin && pullRequest.body?.includes(GITHUB_SESSION_FOOTER_START)
+  );
+  const candidateOwned = hasOwnershipMarker && (parsed.action === "opened" || parsed.action === "closed");
+  const state = parsed.action !== "closed" ? "open" : pullRequest.merged ? "merged" : "closed_unmerged";
+  const closedAt = timestamp2(pullRequest.closed_at);
+  const mergedAt = timestamp2(pullRequest.merged_at);
+  if (parsed.action === "closed" && (pullRequest.merged ? !mergedAt : !closedAt)) {
+    throw new Error("GitHub pull request terminal timestamp is invalid");
+  }
+  return {
+    candidateOwned,
+    closedAt,
+    mergedAt,
+    number: pullRequest.number,
+    openedAt,
+    pullRequestId: String(pullRequest.id),
+    repositoryFullName: parsed.repository.full_name,
+    repositoryId: String(parsed.repository.id),
+    state,
+    updatedAt
+  };
+}
+
+// src/webhooks/handler.ts
+function verifyGitHubSignature(body, signature, secret) {
+  if (!secret || !signature.startsWith("sha256=")) return false;
+  const actual = Buffer.from(signature);
+  const expected = Buffer.from(
+    `sha256=${createHmac("sha256", secret).update(body).digest("hex")}`
+  );
+  return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+function parseJson(body) {
+  try {
+    return JSON.parse(body);
+  } catch {
+    return void 0;
+  }
+}
+function createGitHubWebhookRoute(args) {
+  return {
+    method: "POST",
+    path: "/api/webhooks/github",
+    async handler(request) {
+      const rawBody = await request.text();
+      const signature = request.headers.get("x-hub-signature-256") ?? "";
+      if (!verifyGitHubSignature(rawBody, signature, args.webhookSecret())) {
+        return new Response("Unauthorized", { status: 401 });
+      }
+      const deliveryId = request.headers.get("x-github-delivery");
+      const eventName = request.headers.get("x-github-event");
+      if (!deliveryId || !eventName) {
+        return new Response("Malformed GitHub webhook", { status: 400 });
+      }
+      const body = parseJson(rawBody);
+      const outcome = eventName === "pull_request" ? normalizeGitHubPullRequestOutcome({
+        body,
+        botEmail: args.botEmail()
+      }) : void 0;
+      if (outcome) {
+        await recordGitHubPullRequestOutcome(args.db, outcome);
+      }
+      const resourceEvents = normalizeGitHubResourceEvents({
+        body,
+        deliveryId,
+        eventName
+      });
+      for (const event of resourceEvents) {
+        await args.resourceEvents.publish(event);
+      }
+      if (!outcome && resourceEvents.length === 0) {
+        return new Response("Ignored", { status: 202 });
+      }
+      return new Response("Accepted", { status: 202 });
+    }
+  };
+}
+
+// src/pull-request-outcomes/report.ts
+import { sql as sql2 } from "drizzle-orm";
+import { z as z8 } from "zod";
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var WINDOWS = [7, 30, 90];
+var outcomeStatsSchema = z8.object({
+  closed: z8.number().int().nonnegative(),
+  created: z8.number().int().nonnegative(),
+  days: z8.number().int().positive(),
+  medianMergeTimeMs: z8.number().nonnegative().nullable(),
+  merged: z8.number().int().nonnegative(),
+  open: z8.number().int().nonnegative()
+}).strict().transform((row) => {
+  const terminal = row.merged + row.closed;
+  return {
+    ...row,
+    medianMergeTimeMs: row.medianMergeTimeMs ?? void 0,
+    mergeRate: terminal > 0 ? row.merged / terminal : void 0
+  };
+});
+var repositoryStatsSchema = z8.object({
+  closed: z8.number().int().nonnegative(),
+  created: z8.number().int().nonnegative(),
+  merged: z8.number().int().nonnegative(),
+  open: z8.number().int().nonnegative(),
+  repository: z8.string().min(1)
+}).strict().transform((row) => {
+  const terminal = row.merged + row.closed;
+  return {
+    ...row,
+    mergeRate: terminal > 0 ? row.merged / terminal : void 0
+  };
+});
+function queryRows(result) {
+  if (typeof result !== "object" || result === null || !("rows" in result) || !Array.isArray(result.rows)) {
+    throw new TypeError("GitHub outcome query did not return rows");
+  }
+  return result.rows;
+}
+async function aggregateOutcomeWindows(args) {
+  const starts = WINDOWS.map(
+    (days) => [days, new Date(args.nowMs - days * DAY_MS)]
+  );
+  const oldestStart = starts.at(-1)[1];
+  const table = juniorGitHubPullRequests;
+  const result = await args.db.execute(sql2`
+    WITH windows(days, start_at) AS (
+      VALUES
+        (${starts[0][0]}::integer, ${starts[0][1]}::timestamptz),
+        (${starts[1][0]}::integer, ${starts[1][1]}::timestamptz),
+        (${starts[2][0]}::integer, ${starts[2][1]}::timestamptz)
+    ), recent_pull_requests AS MATERIALIZED (
+      SELECT
+        ${table.pullRequestId},
+        ${table.state},
+        ${table.openedAt},
+        ${table.mergedAt},
+        ${table.closedAt}
+      FROM ${table}
+      WHERE ${table.state} = 'open'
+        OR ${table.openedAt} >= ${oldestStart}
+        OR ${table.mergedAt} >= ${oldestStart}
+        OR ${table.closedAt} >= ${oldestStart}
+    )
+    SELECT
+      windows.days AS "days",
+      count(recent_pull_requests.pull_request_id)
+        FILTER (WHERE recent_pull_requests.opened_at >= windows.start_at)::integer
+        AS "created",
+      count(recent_pull_requests.pull_request_id)
+        FILTER (
+          WHERE recent_pull_requests.state = 'merged'
+            AND recent_pull_requests.merged_at >= windows.start_at
+        )::integer AS "merged",
+      count(recent_pull_requests.pull_request_id)
+        FILTER (
+          WHERE recent_pull_requests.state = 'closed_unmerged'
+            AND recent_pull_requests.closed_at >= windows.start_at
+        )::integer AS "closed",
+      count(recent_pull_requests.pull_request_id)
+        FILTER (WHERE recent_pull_requests.state = 'open')::integer AS "open",
+      (
+        percentile_cont(0.5) WITHIN GROUP (
+          ORDER BY extract(
+            epoch FROM (
+              recent_pull_requests.merged_at - recent_pull_requests.opened_at
+            )
+          ) * 1000
+        ) FILTER (
+          WHERE recent_pull_requests.state = 'merged'
+            AND recent_pull_requests.merged_at >= windows.start_at
+        )
+      )::double precision AS "medianMergeTimeMs"
+    FROM windows
+    LEFT JOIN recent_pull_requests ON true
+    GROUP BY windows.days
+    ORDER BY windows.days
+  `);
+  return z8.array(outcomeStatsSchema).parse(queryRows(result));
+}
+async function aggregateRepositories(args) {
+  const start = new Date(args.nowMs - 30 * DAY_MS);
+  const table = juniorGitHubPullRequests;
+  const result = await args.db.execute(sql2`
+    SELECT
+      ${table.repositoryFullName} AS "repository",
+      count(*) FILTER (WHERE ${table.openedAt} >= ${start})::integer
+        AS "created",
+      count(*) FILTER (
+        WHERE ${table.state} = 'merged' AND ${table.mergedAt} >= ${start}
+      )::integer AS "merged",
+      count(*) FILTER (
+        WHERE ${table.state} = 'closed_unmerged'
+          AND ${table.closedAt} >= ${start}
+      )::integer AS "closed",
+      count(*) FILTER (WHERE ${table.state} = 'open')::integer AS "open"
+    FROM ${table}
+    WHERE ${table.state} = 'open'
+      OR ${table.openedAt} >= ${start}
+      OR ${table.mergedAt} >= ${start}
+      OR ${table.closedAt} >= ${start}
+    GROUP BY ${table.repositoryFullName}
+    ORDER BY "merged" DESC, "created" DESC, "repository" ASC
+    LIMIT 25
+  `);
+  return z8.array(repositoryStatsSchema).parse(queryRows(result));
+}
+function formatPercent(value) {
+  return value === void 0 ? "\u2014" : `${Math.round(value * 100)}%`;
+}
+function formatDuration(value) {
+  if (value === void 0) return "\u2014";
+  const hours = value / (60 * 60 * 1e3);
+  if (hours < 1) return `${Math.round(hours * 60)}m`;
+  if (hours < 24) return `${Math.round(hours * 10) / 10}h`;
+  return `${Math.round(hours / 24 * 10) / 10}d`;
+}
+async function buildGitHubOutcomeReport(args) {
+  const [windows, repositories] = await Promise.all([
+    aggregateOutcomeWindows(args),
+    aggregateRepositories(args)
+  ]);
+  const thirtyDays = windows.find((window) => window.days === 30);
+  return {
+    generatedAt: new Date(args.nowMs).toISOString(),
+    title: "GitHub work delivered",
+    metrics: [
+      { label: "created \xB7 30d", value: String(thirtyDays.created) },
+      {
+        label: "merged \xB7 30d",
+        tone: thirtyDays.merged > 0 ? "good" : "neutral",
+        value: String(thirtyDays.merged)
+      },
+      { label: "closed unmerged \xB7 30d", value: String(thirtyDays.closed) },
+      { label: "open now", value: String(thirtyDays.open) },
+      { label: "merge rate \xB7 30d", value: formatPercent(thirtyDays.mergeRate) },
+      {
+        label: "median merge time \xB7 30d",
+        value: formatDuration(thirtyDays.medianMergeTimeMs)
+      }
+    ],
+    recordSets: [
+      {
+        title: "Outcome windows",
+        fields: [
+          { key: "window", label: "Window" },
+          { key: "created", label: "Created" },
+          { key: "merged", label: "Merged" },
+          { key: "closed", label: "Closed unmerged" },
+          { key: "mergeRate", label: "Merge rate" },
+          { key: "mergeTime", label: "Median merge time" }
+        ],
+        records: windows.map((stats) => ({
+          id: `${stats.days}d`,
+          values: {
+            window: `${stats.days} days`,
+            created: String(stats.created),
+            merged: String(stats.merged),
+            closed: String(stats.closed),
+            mergeRate: formatPercent(stats.mergeRate),
+            mergeTime: formatDuration(stats.medianMergeTimeMs)
+          }
+        }))
+      },
+      {
+        title: "Repositories \xB7 30d",
+        emptyText: "No Junior-owned pull request activity yet.",
+        fields: [
+          { key: "repository", label: "Repository" },
+          { key: "created", label: "Created" },
+          { key: "merged", label: "Merged" },
+          { key: "closed", label: "Closed unmerged" },
+          { key: "open", label: "Open now" },
+          { key: "mergeRate", label: "Merge rate" }
+        ],
+        records: repositories.map(({ repository, ...stats }) => ({
+          id: repository,
+          values: {
+            repository,
+            created: String(stats.created),
+            merged: String(stats.merged),
+            closed: String(stats.closed),
+            open: String(stats.open),
+            mergeRate: formatPercent(stats.mergeRate)
+          }
+        }))
+      }
+    ]
   };
 }
 
@@ -1177,11 +1831,11 @@ async function githubRequest(apiBase, path, params) {
     },
     ...params.body ? { body: JSON.stringify(params.body) } : {}
   });
-  const text = await response.text();
+  const text2 = await response.text();
   let parsed;
-  if (text) {
+  if (text2) {
     try {
-      parsed = JSON.parse(text);
+      parsed = JSON.parse(text2);
     } catch {
       parsed = void 0;
     }
@@ -2067,6 +2721,22 @@ function githubPlugin(options = {}) {
       ]
     },
     hooks: {
+      routes(ctx) {
+        return [
+          createGitHubWebhookRoute({
+            botEmail: () => readEnv(botEmailEnv),
+            db: ctx.db,
+            resourceEvents: ctx.resourceEvents,
+            webhookSecret: () => readEnv("GITHUB_WEBHOOK_SECRET")
+          })
+        ];
+      },
+      async operationalReport(ctx) {
+        return await buildGitHubOutcomeReport({
+          db: ctx.db,
+          nowMs: ctx.nowMs
+        });
+      },
       tools(ctx) {
         return createGitHubTools(ctx);
       },