@sentry/junior-github 0.107.1 → 0.109.0

package/dist/index.js

@@ -90,6 +90,7 @@ import { z } from "zod";
 import { PluginToolInputError } from "@sentry/junior-plugin-api";
 var GITHUB_SESSION_FOOTER_START = "<!-- junior-session-footer:start -->";
 var GITHUB_SESSION_FOOTER_END = "<!-- junior-session-footer:end -->";
+var GITHUB_CONVERSATION_ID_MARKER = "junior-conversation-id:";
 function nonEmptyString(value, name) {
   if (!value?.trim()) {
     throw new PluginToolInputError(`${name} is required`);
@@ -132,7 +133,9 @@ function githubConversationFooter(conversationId, dashboardUrl) {
     return void 0;
   }
   const label = normalizedDashboardUrl ? "View Junior Session" : "View Junior Session in Sentry";
+  const conversationMarker = `<!-- ${GITHUB_CONVERSATION_ID_MARKER}${encodeURIComponent(id)} -->`;
   return `${GITHUB_SESSION_FOOTER_START}
+${conversationMarker}
 
 --
 
@@ -140,6 +143,29 @@ function githubConversationFooter(conversationId, dashboardUrl) {
 
 ${GITHUB_SESSION_FOOTER_END}`;
 }
+function githubConversationIds(body) {
+  if (!body) return [];
+  const ids = /* @__PURE__ */ new Set();
+  const footer = new RegExp(
+    `${escapeRegExp(GITHUB_SESSION_FOOTER_START)}[\\s\\S]*?${escapeRegExp(GITHUB_SESSION_FOOTER_END)}`,
+    "g"
+  );
+  const marker = new RegExp(
+    `<!--\\s*${escapeRegExp(GITHUB_CONVERSATION_ID_MARKER)}([^\\s]+)\\s*-->`,
+    "g"
+  );
+  for (const footerMatch of body.matchAll(footer)) {
+    for (const markerMatch of footerMatch[0].matchAll(marker)) {
+      try {
+        const id = decodeURIComponent(markerMatch[1] ?? "").trim();
+        if (id) ids.add(id);
+      } catch {
+        continue;
+      }
+    }
+  }
+  return [...ids];
+}
 function appendGitHubFooter(body, conversationId, dashboardUrl) {
   const footer = githubConversationFooter(conversationId, dashboardUrl);
   const normalizedBody = body.trimEnd();
@@ -1069,7 +1095,7 @@ function createGitHubTools(ctx) {
 // src/webhooks/handler.ts
 import { createHmac, timingSafeEqual } from "crypto";
 
-// src/pull-request-outcomes/store.ts
+// src/issue-outcomes/store.ts
 import { and, eq, lte } from "drizzle-orm";
 import { z as z6 } from "zod";
 
@@ -1082,6 +1108,36 @@ var githubPullRequestStateSchema = z5.enum([
   "merged",
   "open"
 ]);
+var githubPullRequestCommitCompositionSchema = z5.enum([
+  "junior_only",
+  "mixed"
+]);
+var githubIssueStateSchema = z5.enum(["closed", "open"]);
+var githubIssueStateReasonSchema = z5.enum([
+  "completed",
+  "duplicate",
+  "not_planned",
+  "reopened"
+]);
+var juniorGitHubIssues = pgTable(
+  "junior_github_issues",
+  {
+    issueId: text("issue_id").primaryKey(),
+    repositoryId: text("repository_id").notNull(),
+    repositoryFullName: text("repository_full_name").notNull(),
+    number: integer("number").notNull(),
+    state: text("state").$type().notNull(),
+    stateReason: text("state_reason").$type(),
+    openedAt: timestamp("opened_at", { withTimezone: true }).notNull(),
+    closedAt: timestamp("closed_at", { withTimezone: true }),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull()
+  },
+  (table) => [
+    index("junior_github_issues_opened_at_idx").on(table.openedAt),
+    index("junior_github_issues_closed_at_idx").on(table.closedAt),
+    index("junior_github_issues_open_idx").on(table.issueId).where(sql`${table.state} = 'open'`)
+  ]
+);
 var juniorGitHubPullRequests = pgTable(
   "junior_github_pull_requests",
   {
@@ -1090,6 +1146,8 @@ var juniorGitHubPullRequests = pgTable(
     repositoryFullName: text("repository_full_name").notNull(),
     number: integer("number").notNull(),
     state: text("state").$type().notNull(),
+    commitComposition: text("commit_composition").$type(),
+    conversationIds: text("conversation_ids").array().notNull().default(sql`ARRAY[]::text[]`),
     openedAt: timestamp("opened_at", { withTimezone: true }).notNull(),
     mergedAt: timestamp("merged_at", { withTimezone: true }),
     closedAt: timestamp("closed_at", { withTimezone: true }),
@@ -1103,71 +1161,137 @@ var juniorGitHubPullRequests = pgTable(
   ]
 );
 
-// src/pull-request-outcomes/store.ts
-var githubPullRequestOutcomeInputSchema = z6.object({
+// src/issue-outcomes/store.ts
+var githubIssueOutcomeInputSchema = z6.object({
   candidateOwned: z6.boolean(),
   closedAt: z6.date().optional(),
-  mergedAt: z6.date().optional(),
+  issueId: z6.string().min(1),
   number: z6.number().int().positive(),
   openedAt: z6.date(),
-  pullRequestId: z6.string().min(1),
   repositoryFullName: z6.string().min(1),
   repositoryId: z6.string().min(1),
-  state: githubPullRequestStateSchema,
+  state: githubIssueStateSchema,
+  stateReason: githubIssueStateReasonSchema.optional(),
   updatedAt: z6.date()
 }).strict();
 function projectionValues(input) {
   return {
     closedAt: input.closedAt ?? null,
-    mergedAt: input.mergedAt ?? null,
     number: input.number,
     openedAt: input.openedAt,
     repositoryFullName: input.repositoryFullName,
     repositoryId: input.repositoryId,
     state: input.state,
+    stateReason: input.stateReason ?? null,
     updatedAt: input.updatedAt
   };
 }
-async function recordGitHubPullRequestOutcome(db, input) {
-  const outcome = githubPullRequestOutcomeInputSchema.parse(input);
+async function recordGitHubIssueOutcome(db, input) {
+  const outcome = githubIssueOutcomeInputSchema.parse(input);
   const values = projectionValues(outcome);
   if (!outcome.candidateOwned) {
-    await db.update(juniorGitHubPullRequests).set(values).where(
+    await db.update(juniorGitHubIssues).set(values).where(
       and(
-        eq(juniorGitHubPullRequests.pullRequestId, outcome.pullRequestId),
-        lte(juniorGitHubPullRequests.updatedAt, outcome.updatedAt)
+        eq(juniorGitHubIssues.issueId, outcome.issueId),
+        lte(juniorGitHubIssues.updatedAt, outcome.updatedAt)
       )
     );
     return;
   }
-  await db.insert(juniorGitHubPullRequests).values({ pullRequestId: outcome.pullRequestId, ...values }).onConflictDoUpdate({
-    target: juniorGitHubPullRequests.pullRequestId,
+  await db.insert(juniorGitHubIssues).values({ issueId: outcome.issueId, ...values }).onConflictDoUpdate({
+    target: juniorGitHubIssues.issueId,
     set: values,
-    where: lte(juniorGitHubPullRequests.updatedAt, outcome.updatedAt)
+    where: lte(juniorGitHubIssues.updatedAt, outcome.updatedAt)
   });
 }
 
-// src/webhooks/pull-request-outcome.ts
+// src/pull-request-outcomes/store.ts
+import { and as and2, eq as eq2, lte as lte2, sql as sql2 } from "drizzle-orm";
 import { z as z7 } from "zod";
-var pullRequestOutcomeSchema = z7.object({
-  action: z7.enum(["opened", "closed", "reopened"]),
-  pull_request: z7.object({
-    body: z7.string().nullable().optional(),
-    closed_at: z7.string().nullable().optional(),
-    created_at: z7.string(),
-    id: z7.number().int().positive(),
-    merged: z7.boolean(),
-    merged_at: z7.string().nullable().optional(),
-    number: z7.number().int().positive(),
-    updated_at: z7.string(),
-    user: z7.object({ login: z7.string().min(1) })
-  }),
-  repository: z7.object({
-    full_name: z7.string().min(1),
-    id: z7.number().int().positive()
-  })
-});
-var pullRequestLifecycleActionSchema = z7.object({ action: z7.string() });
+var githubPullRequestOutcomeInputSchema = z7.object({
+  candidateOwned: z7.boolean(),
+  closedAt: z7.date().optional(),
+  commitComposition: githubPullRequestCommitCompositionSchema.optional(),
+  mergedAt: z7.date().optional(),
+  number: z7.number().int().positive(),
+  openedAt: z7.date(),
+  pullRequestId: z7.string().min(1),
+  repositoryFullName: z7.string().min(1),
+  repositoryId: z7.string().min(1),
+  state: githubPullRequestStateSchema,
+  updatedAt: z7.date()
+}).strict();
+var githubPullRequestConversationsInputSchema = z7.object({
+  conversationIds: z7.array(z7.string().min(1)).min(1),
+  pullRequestId: z7.string().min(1)
+}).strict();
+function projectionValues2(input) {
+  return {
+    closedAt: input.closedAt ?? null,
+    ...input.commitComposition ? { commitComposition: input.commitComposition } : {},
+    mergedAt: input.mergedAt ?? null,
+    number: input.number,
+    openedAt: input.openedAt,
+    repositoryFullName: input.repositoryFullName,
+    repositoryId: input.repositoryId,
+    state: input.state,
+    updatedAt: input.updatedAt
+  };
+}
+async function recordGitHubPullRequestOutcome(db, input) {
+  const outcome = githubPullRequestOutcomeInputSchema.parse(input);
+  const values = projectionValues2(outcome);
+  if (!outcome.candidateOwned) {
+    const updated = await db.update(juniorGitHubPullRequests).set(values).where(
+      and2(
+        eq2(juniorGitHubPullRequests.pullRequestId, outcome.pullRequestId),
+        lte2(juniorGitHubPullRequests.updatedAt, outcome.updatedAt)
+      )
+    ).returning({
+      commitComposition: juniorGitHubPullRequests.commitComposition
+    });
+    return {
+      applied: updated.length > 0,
+      commitComposition: updated[0]?.commitComposition ?? void 0
+    };
+  }
+  const inserted = await db.insert(juniorGitHubPullRequests).values({ pullRequestId: outcome.pullRequestId, ...values }).onConflictDoUpdate({
+    target: juniorGitHubPullRequests.pullRequestId,
+    set: values,
+    where: lte2(juniorGitHubPullRequests.updatedAt, outcome.updatedAt)
+  }).returning({
+    commitComposition: juniorGitHubPullRequests.commitComposition
+  });
+  return {
+    applied: inserted.length > 0,
+    commitComposition: inserted[0]?.commitComposition ?? void 0
+  };
+}
+async function recordGitHubPullRequestConversations(db, input) {
+  const association = githubPullRequestConversationsInputSchema.parse(input);
+  const conversationIds = sql2.join(
+    association.conversationIds.map((id) => sql2`${id}`),
+    sql2`, `
+  );
+  const updated = await db.update(juniorGitHubPullRequests).set({
+    conversationIds: sql2`ARRAY(
+        SELECT DISTINCT value
+        FROM unnest(
+          ${juniorGitHubPullRequests.conversationIds}
+          || ARRAY[${conversationIds}]::text[]
+        ) AS value
+        ORDER BY value
+      )`
+  }).where(
+    eq2(juniorGitHubPullRequests.pullRequestId, association.pullRequestId)
+  ).returning({ pullRequestId: juniorGitHubPullRequests.pullRequestId });
+  return updated.length > 0;
+}
+
+// src/webhooks/issue-outcome.ts
+import { z as z8 } from "zod";
+
+// src/webhooks/ownership.ts
 var GITHUB_NOREPLY_DOMAIN = "users.noreply.github.com";
 function botLoginFromEmail(value) {
   const email = value?.trim();
@@ -1180,11 +1304,195 @@ function botLoginFromEmail(value) {
   const login = localPart.slice(localPart.indexOf("+") + 1).trim();
   return login.toLowerCase().endsWith("[bot]") ? login : void 0;
 }
+
+// src/webhooks/issue-outcome.ts
+var canonicalIssueOutcomeSchema = z8.object({
+  action: z8.enum(["opened", "closed", "reopened"]),
+  issue: z8.object({
+    body: z8.string().nullable().optional(),
+    closed_at: z8.string().nullable().optional(),
+    created_at: z8.string(),
+    id: z8.number().int().positive(),
+    number: z8.number().int().positive(),
+    state_reason: githubIssueStateReasonSchema.nullable().optional(),
+    updated_at: z8.string(),
+    user: z8.object({ login: z8.string().min(1) }).strict()
+  }).strict(),
+  repository: z8.object({
+    full_name: z8.string().min(1),
+    id: z8.number().int().positive()
+  }).strict()
+}).strict();
+var issueOutcomeSchema = z8.object({
+  action: z8.enum(["opened", "closed", "reopened"]),
+  issue: z8.object({
+    body: z8.string().nullable().optional(),
+    closed_at: z8.string().nullable().optional(),
+    created_at: z8.string(),
+    id: z8.number().int().positive(),
+    number: z8.number().int().positive(),
+    state_reason: githubIssueStateReasonSchema.nullable().optional(),
+    updated_at: z8.string(),
+    user: z8.object({ login: z8.string().min(1) }).passthrough()
+  }).passthrough(),
+  repository: z8.object({
+    full_name: z8.string().min(1),
+    id: z8.number().int().positive()
+  }).passthrough()
+}).passthrough().transform(
+  (provider) => canonicalIssueOutcomeSchema.parse({
+    action: provider.action,
+    issue: {
+      body: provider.issue.body,
+      closed_at: provider.issue.closed_at,
+      created_at: provider.issue.created_at,
+      id: provider.issue.id,
+      number: provider.issue.number,
+      state_reason: provider.issue.state_reason,
+      updated_at: provider.issue.updated_at,
+      user: { login: provider.issue.user.login }
+    },
+    repository: {
+      full_name: provider.repository.full_name,
+      id: provider.repository.id
+    }
+  })
+);
+var issueLifecycleActionSchema = z8.object({ action: z8.string() }).passthrough();
 function timestamp2(value) {
   if (!value) return void 0;
   const parsed = new Date(value);
   return Number.isFinite(parsed.getTime()) ? parsed : void 0;
 }
+function normalizeGitHubIssueOutcome(args) {
+  const lifecycle = issueLifecycleActionSchema.safeParse(args.body);
+  if (!lifecycle.success || !["opened", "closed", "reopened"].includes(lifecycle.data.action)) {
+    return void 0;
+  }
+  const parsed = issueOutcomeSchema.parse(args.body);
+  const issue = parsed.issue;
+  const openedAt = timestamp2(issue.created_at);
+  const updatedAt = timestamp2(issue.updated_at);
+  if (!openedAt || !updatedAt) {
+    throw new Error("GitHub issue lifecycle timestamps are invalid");
+  }
+  const authorLogin = issue.user.login.trim().toLowerCase();
+  const botLogin = botLoginFromEmail(args.botEmail)?.toLowerCase();
+  if (parsed.action === "opened" && !botLogin) {
+    throw new Error(
+      "The configured GitHub App bot email must encode a [bot] login in GitHub's noreply format to classify issue ownership"
+    );
+  }
+  const hasOwnershipMarker = Boolean(
+    botLogin && authorLogin === botLogin && issue.body?.includes(GITHUB_SESSION_FOOTER_START)
+  );
+  const candidateOwned = hasOwnershipMarker && (parsed.action === "opened" || parsed.action === "closed");
+  const closedAt = timestamp2(issue.closed_at);
+  if (parsed.action === "closed" && !closedAt) {
+    throw new Error("GitHub issue terminal timestamp is invalid");
+  }
+  return {
+    candidateOwned,
+    closedAt,
+    issueId: String(issue.id),
+    number: issue.number,
+    openedAt,
+    repositoryFullName: parsed.repository.full_name,
+    repositoryId: String(parsed.repository.id),
+    state: parsed.action === "closed" ? "closed" : "open",
+    stateReason: parsed.action === "closed" ? issue.state_reason ?? void 0 : void 0,
+    updatedAt
+  };
+}
+
+// src/webhooks/pull-request-outcome.ts
+import { z as z9 } from "zod";
+var canonicalPullRequestOutcomeSchema = z9.object({
+  action: z9.enum(["opened", "closed", "reopened"]),
+  pull_request: z9.object({
+    body: z9.string().nullable().optional(),
+    closed_at: z9.string().nullable().optional(),
+    created_at: z9.string(),
+    id: z9.number().int().positive(),
+    merged: z9.boolean(),
+    merged_at: z9.string().nullable().optional(),
+    number: z9.number().int().positive(),
+    updated_at: z9.string(),
+    user: z9.object({ login: z9.string().min(1) }).strict()
+  }).strict(),
+  repository: z9.object({
+    full_name: z9.string().min(1),
+    id: z9.number().int().positive()
+  }).strict()
+}).strict();
+var pullRequestOutcomeSchema = z9.object({
+  action: z9.enum(["opened", "closed", "reopened"]),
+  pull_request: z9.object({
+    body: z9.string().nullable().optional(),
+    closed_at: z9.string().nullable().optional(),
+    created_at: z9.string(),
+    id: z9.number().int().positive(),
+    merged: z9.boolean(),
+    merged_at: z9.string().nullable().optional(),
+    number: z9.number().int().positive(),
+    updated_at: z9.string(),
+    user: z9.object({ login: z9.string().min(1) }).passthrough()
+  }).passthrough(),
+  repository: z9.object({
+    full_name: z9.string().min(1),
+    id: z9.number().int().positive()
+  }).passthrough()
+}).passthrough().transform(
+  (provider) => canonicalPullRequestOutcomeSchema.parse({
+    action: provider.action,
+    pull_request: {
+      body: provider.pull_request.body,
+      closed_at: provider.pull_request.closed_at,
+      created_at: provider.pull_request.created_at,
+      id: provider.pull_request.id,
+      merged: provider.pull_request.merged,
+      merged_at: provider.pull_request.merged_at,
+      number: provider.pull_request.number,
+      updated_at: provider.pull_request.updated_at,
+      user: { login: provider.pull_request.user.login }
+    },
+    repository: {
+      full_name: provider.repository.full_name,
+      id: provider.repository.id
+    }
+  })
+);
+var pullRequestLifecycleActionSchema = z9.object({ action: z9.string() }).passthrough();
+var canonicalPullRequestConversationSchema = z9.object({
+  pull_request: z9.object({
+    body: z9.string().nullable().optional(),
+    id: z9.number().int().positive(),
+    user: z9.object({ login: z9.string().min(1) }).strict()
+  }).strict(),
+  sender: z9.object({ login: z9.string().min(1) }).strict()
+}).strict();
+var pullRequestConversationSchema = z9.object({
+  pull_request: z9.object({
+    body: z9.string().nullable().optional(),
+    id: z9.number().int().positive(),
+    user: z9.object({ login: z9.string().min(1) }).passthrough()
+  }).passthrough(),
+  sender: z9.object({ login: z9.string().min(1) }).passthrough()
+}).passthrough().transform(
+  (provider) => canonicalPullRequestConversationSchema.parse({
+    pull_request: {
+      body: provider.pull_request.body,
+      id: provider.pull_request.id,
+      user: { login: provider.pull_request.user.login }
+    },
+    sender: { login: provider.sender.login }
+  })
+);
+function timestamp3(value) {
+  if (!value) return void 0;
+  const parsed = new Date(value);
+  return Number.isFinite(parsed.getTime()) ? parsed : void 0;
+}
 function normalizeGitHubPullRequestOutcome(args) {
   const lifecycle = pullRequestLifecycleActionSchema.safeParse(args.body);
   if (!lifecycle.success || !["opened", "closed", "reopened"].includes(lifecycle.data.action)) {
@@ -1192,8 +1500,8 @@ function normalizeGitHubPullRequestOutcome(args) {
   }
   const parsed = pullRequestOutcomeSchema.parse(args.body);
   const pullRequest = parsed.pull_request;
-  const openedAt = timestamp2(pullRequest.created_at);
-  const updatedAt = timestamp2(pullRequest.updated_at);
+  const openedAt = timestamp3(pullRequest.created_at);
+  const updatedAt = timestamp3(pullRequest.updated_at);
   if (!openedAt || !updatedAt) {
     throw new Error("GitHub pull request lifecycle timestamps are invalid");
   }
@@ -1209,8 +1517,8 @@ function normalizeGitHubPullRequestOutcome(args) {
   );
   const candidateOwned = hasOwnershipMarker && (parsed.action === "opened" || parsed.action === "closed");
   const state = parsed.action !== "closed" ? "open" : pullRequest.merged ? "merged" : "closed_unmerged";
-  const closedAt = timestamp2(pullRequest.closed_at);
-  const mergedAt = timestamp2(pullRequest.merged_at);
+  const closedAt = timestamp3(pullRequest.closed_at);
+  const mergedAt = timestamp3(pullRequest.merged_at);
   if (parsed.action === "closed" && (pullRequest.merged ? !mergedAt : !closedAt)) {
     throw new Error("GitHub pull request terminal timestamp is invalid");
   }
@@ -1227,6 +1535,19 @@ function normalizeGitHubPullRequestOutcome(args) {
     updatedAt
   };
 }
+function normalizeGitHubPullRequestConversations(args) {
+  const parsed = pullRequestConversationSchema.safeParse(args.body);
+  const botLogin = botLoginFromEmail(args.botEmail)?.toLowerCase();
+  if (!parsed.success || !botLogin) return void 0;
+  if (parsed.data.pull_request.user.login.trim().toLowerCase() !== botLogin || parsed.data.sender.login.trim().toLowerCase() !== botLogin) {
+    return void 0;
+  }
+  const conversationIds = githubConversationIds(parsed.data.pull_request.body);
+  return conversationIds.length > 0 ? {
+    conversationIds,
+    pullRequestId: String(parsed.data.pull_request.id)
+  } : void 0;
+}
 
 // src/webhooks/handler.ts
 function verifyGitHubSignature(body, signature, secret) {
@@ -1260,13 +1581,45 @@ function createGitHubWebhookRoute(args) {
         return new Response("Malformed GitHub webhook", { status: 400 });
       }
       const body = parseJson(rawBody);
-      const outcome = eventName === "pull_request" ? normalizeGitHubPullRequestOutcome({
-        body,
-        botEmail: args.botEmail()
-      }) : void 0;
-      if (outcome) {
-        await recordGitHubPullRequestOutcome(args.db, outcome);
+      const botEmail = args.botEmail();
+      const pullRequestOutcome = eventName === "pull_request" ? normalizeGitHubPullRequestOutcome({ body, botEmail }) : void 0;
+      const issueOutcome = eventName === "issues" ? normalizeGitHubIssueOutcome({ body, botEmail }) : void 0;
+      const pullRequestConversations = eventName === "pull_request" ? normalizeGitHubPullRequestConversations({ body, botEmail }) : void 0;
+      if (pullRequestOutcome) {
+        const recordedOutcome = await recordGitHubPullRequestOutcome(
+          args.db,
+          pullRequestOutcome
+        );
+        if (recordedOutcome.applied && !recordedOutcome.commitComposition && pullRequestOutcome.state === "merged" && args.classifyPullRequestCommits) {
+          let commitComposition;
+          try {
+            commitComposition = await args.classifyPullRequestCommits({
+              number: pullRequestOutcome.number,
+              repositoryFullName: pullRequestOutcome.repositoryFullName
+            });
+          } catch (error) {
+            args.log?.error("GitHub PR commit classification failed", {
+              deliveryId,
+              errorType: error instanceof Error ? error.name : "UnknownError",
+              number: pullRequestOutcome.number,
+              repository: pullRequestOutcome.repositoryFullName
+            });
+          }
+          if (commitComposition) {
+            await recordGitHubPullRequestOutcome(args.db, {
+              ...pullRequestOutcome,
+              commitComposition
+            });
+          }
+        }
+      }
+      if (issueOutcome) {
+        await recordGitHubIssueOutcome(args.db, issueOutcome);
       }
+      const recordedPullRequestConversations = pullRequestConversations ? await recordGitHubPullRequestConversations(
+        args.db,
+        pullRequestConversations
+      ) : false;
       const resourceEvents = normalizeGitHubResourceEvents({
         body,
         deliveryId,
@@ -1275,7 +1628,7 @@ function createGitHubWebhookRoute(args) {
       for (const event of resourceEvents) {
         await args.resourceEvents.publish(event);
       }
-      if (!outcome && resourceEvents.length === 0) {
+      if (!pullRequestOutcome && !issueOutcome && !recordedPullRequestConversations && resourceEvents.length === 0) {
         return new Response("Ignored", { status: 202 });
       }
       return new Response("Accepted", { status: 202 });
@@ -1283,32 +1636,38 @@ function createGitHubWebhookRoute(args) {
   };
 }
 
-// src/pull-request-outcomes/report.ts
-import { sql as sql2 } from "drizzle-orm";
-import { z as z8 } from "zod";
+// src/outcomes/report.ts
+import { sql as sql3 } from "drizzle-orm";
+import { z as z10 } from "zod";
 var DAY_MS = 24 * 60 * 60 * 1e3;
 var WINDOWS = [7, 30, 90];
-var outcomeStatsSchema = z8.object({
-  closed: z8.number().int().nonnegative(),
-  created: z8.number().int().nonnegative(),
-  days: z8.number().int().positive(),
-  medianMergeTimeMs: z8.number().nonnegative().nullable(),
-  merged: z8.number().int().nonnegative(),
-  open: z8.number().int().nonnegative()
+var pullRequestStatsSchema = z10.object({
+  closed: z10.number().int().nonnegative(),
+  compositionUnknown: z10.number().int().nonnegative(),
+  created: z10.number().int().nonnegative(),
+  days: z10.number().int().positive(),
+  juniorOnly: z10.number().int().nonnegative(),
+  medianMergeTimeMs: z10.number().nonnegative().nullable(),
+  merged: z10.number().int().nonnegative(),
+  mixed: z10.number().int().nonnegative()
 }).strict().transform((row) => {
   const terminal = row.merged + row.closed;
+  const classified = row.juniorOnly + row.mixed;
   return {
     ...row,
     medianMergeTimeMs: row.medianMergeTimeMs ?? void 0,
-    mergeRate: terminal > 0 ? row.merged / terminal : void 0
+    mergeRate: terminal > 0 ? row.merged / terminal : void 0,
+    juniorOnlyRate: classified > 0 ? row.juniorOnly / classified : void 0
   };
 });
-var repositoryStatsSchema = z8.object({
-  closed: z8.number().int().nonnegative(),
-  created: z8.number().int().nonnegative(),
-  merged: z8.number().int().nonnegative(),
-  open: z8.number().int().nonnegative(),
-  repository: z8.string().min(1)
+var pullRequestRepositoryStatsSchema = z10.object({
+  closed: z10.number().int().nonnegative(),
+  compositionUnknown: z10.number().int().nonnegative(),
+  created: z10.number().int().nonnegative(),
+  juniorOnly: z10.number().int().nonnegative(),
+  merged: z10.number().int().nonnegative(),
+  mixed: z10.number().int().nonnegative(),
+  repository: z10.string().min(1)
 }).strict().transform((row) => {
   const terminal = row.merged + row.closed;
   return {
@@ -1316,19 +1675,39 @@ var repositoryStatsSchema = z8.object({
     mergeRate: terminal > 0 ? row.merged / terminal : void 0
   };
 });
+var issueStatsSchema = z10.object({
+  closedCompleted: z10.number().int().nonnegative(),
+  closedDuplicate: z10.number().int().nonnegative(),
+  closedNotPlanned: z10.number().int().nonnegative(),
+  closedUnknown: z10.number().int().nonnegative(),
+  created: z10.number().int().nonnegative(),
+  days: z10.number().int().positive(),
+  medianCloseTimeMs: z10.number().nonnegative().nullable()
+}).strict().transform((row) => ({
+  ...row,
+  medianCloseTimeMs: row.medianCloseTimeMs ?? void 0
+}));
+var issueRepositoryStatsSchema = z10.object({
+  closedCompleted: z10.number().int().nonnegative(),
+  closedDuplicate: z10.number().int().nonnegative(),
+  closedNotPlanned: z10.number().int().nonnegative(),
+  closedUnknown: z10.number().int().nonnegative(),
+  created: z10.number().int().nonnegative(),
+  repository: z10.string().min(1)
+}).strict();
 function queryRows(result) {
   if (typeof result !== "object" || result === null || !("rows" in result) || !Array.isArray(result.rows)) {
     throw new TypeError("GitHub outcome query did not return rows");
   }
   return result.rows;
 }
-async function aggregateOutcomeWindows(args) {
+async function aggregatePullRequestWindows(args) {
   const starts = WINDOWS.map(
     (days) => [days, new Date(args.nowMs - days * DAY_MS)]
   );
   const oldestStart = starts.at(-1)[1];
   const table = juniorGitHubPullRequests;
-  const result = await args.db.execute(sql2`
+  const result = await args.db.execute(sql3`
     WITH windows(days, start_at) AS (
       VALUES
         (${starts[0][0]}::integer, ${starts[0][1]}::timestamptz),
@@ -1338,12 +1717,12 @@ async function aggregateOutcomeWindows(args) {
       SELECT
         ${table.pullRequestId},
         ${table.state},
+        ${table.commitComposition},
         ${table.openedAt},
         ${table.mergedAt},
         ${table.closedAt}
       FROM ${table}
-      WHERE ${table.state} = 'open'
-        OR ${table.openedAt} >= ${oldestStart}
+      WHERE ${table.openedAt} >= ${oldestStart}
         OR ${table.mergedAt} >= ${oldestStart}
         OR ${table.closedAt} >= ${oldestStart}
     )
@@ -1363,7 +1742,23 @@ async function aggregateOutcomeWindows(args) {
             AND recent_pull_requests.closed_at >= windows.start_at
         )::integer AS "closed",
       count(recent_pull_requests.pull_request_id)
-        FILTER (WHERE recent_pull_requests.state = 'open')::integer AS "open",
+        FILTER (
+          WHERE recent_pull_requests.state = 'merged'
+            AND recent_pull_requests.merged_at >= windows.start_at
+            AND recent_pull_requests.commit_composition = 'junior_only'
+        )::integer AS "juniorOnly",
+      count(recent_pull_requests.pull_request_id)
+        FILTER (
+          WHERE recent_pull_requests.state = 'merged'
+            AND recent_pull_requests.merged_at >= windows.start_at
+            AND recent_pull_requests.commit_composition = 'mixed'
+        )::integer AS "mixed",
+      count(recent_pull_requests.pull_request_id)
+        FILTER (
+          WHERE recent_pull_requests.state = 'merged'
+            AND recent_pull_requests.merged_at >= windows.start_at
+            AND recent_pull_requests.commit_composition IS NULL
+        )::integer AS "compositionUnknown",
       (
         percentile_cont(0.5) WITHIN GROUP (
           ORDER BY extract(
@@ -1381,12 +1776,12 @@ async function aggregateOutcomeWindows(args) {
     GROUP BY windows.days
     ORDER BY windows.days
   `);
-  return z8.array(outcomeStatsSchema).parse(queryRows(result));
+  return z10.array(pullRequestStatsSchema).parse(queryRows(result));
 }
-async function aggregateRepositories(args) {
+async function aggregatePullRequestRepositories(args) {
   const start = new Date(args.nowMs - 30 * DAY_MS);
   const table = juniorGitHubPullRequests;
-  const result = await args.db.execute(sql2`
+  const result = await args.db.execute(sql3`
     SELECT
       ${table.repositoryFullName} AS "repository",
       count(*) FILTER (WHERE ${table.openedAt} >= ${start})::integer
@@ -1398,17 +1793,136 @@ async function aggregateRepositories(args) {
         WHERE ${table.state} = 'closed_unmerged'
           AND ${table.closedAt} >= ${start}
       )::integer AS "closed",
-      count(*) FILTER (WHERE ${table.state} = 'open')::integer AS "open"
+      count(*) FILTER (
+        WHERE ${table.state} = 'merged'
+          AND ${table.mergedAt} >= ${start}
+          AND ${table.commitComposition} = 'junior_only'
+      )::integer AS "juniorOnly",
+      count(*) FILTER (
+        WHERE ${table.state} = 'merged'
+          AND ${table.mergedAt} >= ${start}
+          AND ${table.commitComposition} = 'mixed'
+      )::integer AS "mixed",
+      count(*) FILTER (
+        WHERE ${table.state} = 'merged'
+          AND ${table.mergedAt} >= ${start}
+          AND ${table.commitComposition} IS NULL
+      )::integer AS "compositionUnknown"
     FROM ${table}
-    WHERE ${table.state} = 'open'
-      OR ${table.openedAt} >= ${start}
+    WHERE ${table.openedAt} >= ${start}
       OR ${table.mergedAt} >= ${start}
       OR ${table.closedAt} >= ${start}
     GROUP BY ${table.repositoryFullName}
     ORDER BY "merged" DESC, "created" DESC, "repository" ASC
     LIMIT 25
   `);
-  return z8.array(repositoryStatsSchema).parse(queryRows(result));
+  return z10.array(pullRequestRepositoryStatsSchema).parse(queryRows(result));
+}
+async function aggregateIssueWindows(args) {
+  const starts = WINDOWS.map(
+    (days) => [days, new Date(args.nowMs - days * DAY_MS)]
+  );
+  const oldestStart = starts.at(-1)[1];
+  const table = juniorGitHubIssues;
+  const result = await args.db.execute(sql3`
+    WITH windows(days, start_at) AS (
+      VALUES
+        (${starts[0][0]}::integer, ${starts[0][1]}::timestamptz),
+        (${starts[1][0]}::integer, ${starts[1][1]}::timestamptz),
+        (${starts[2][0]}::integer, ${starts[2][1]}::timestamptz)
+    ), recent_issues AS MATERIALIZED (
+      SELECT
+        ${table.issueId},
+        ${table.state},
+        ${table.stateReason},
+        ${table.openedAt},
+        ${table.closedAt}
+      FROM ${table}
+      WHERE ${table.openedAt} >= ${oldestStart}
+        OR ${table.closedAt} >= ${oldestStart}
+    )
+    SELECT
+      windows.days AS "days",
+      count(recent_issues.issue_id)
+        FILTER (WHERE recent_issues.opened_at >= windows.start_at)::integer
+        AS "created",
+      count(recent_issues.issue_id)
+        FILTER (
+          WHERE recent_issues.state = 'closed'
+            AND recent_issues.state_reason = 'completed'
+            AND recent_issues.closed_at >= windows.start_at
+        )::integer AS "closedCompleted",
+      count(recent_issues.issue_id)
+        FILTER (
+          WHERE recent_issues.state = 'closed'
+            AND recent_issues.state_reason = 'duplicate'
+            AND recent_issues.closed_at >= windows.start_at
+        )::integer AS "closedDuplicate",
+      count(recent_issues.issue_id)
+        FILTER (
+          WHERE recent_issues.state = 'closed'
+            AND recent_issues.state_reason = 'not_planned'
+            AND recent_issues.closed_at >= windows.start_at
+        )::integer AS "closedNotPlanned",
+      count(recent_issues.issue_id)
+        FILTER (
+          WHERE recent_issues.state = 'closed'
+            AND recent_issues.state_reason IS NULL
+            AND recent_issues.closed_at >= windows.start_at
+        )::integer AS "closedUnknown",
+      (
+        percentile_cont(0.5) WITHIN GROUP (
+          ORDER BY extract(
+            epoch FROM (recent_issues.closed_at - recent_issues.opened_at)
+          ) * 1000
+        ) FILTER (
+          WHERE recent_issues.state = 'closed'
+            AND recent_issues.closed_at >= windows.start_at
+        )
+      )::double precision AS "medianCloseTimeMs"
+    FROM windows
+    LEFT JOIN recent_issues ON true
+    GROUP BY windows.days
+    ORDER BY windows.days
+  `);
+  return z10.array(issueStatsSchema).parse(queryRows(result));
+}
+async function aggregateIssueRepositories(args) {
+  const start = new Date(args.nowMs - 30 * DAY_MS);
+  const table = juniorGitHubIssues;
+  const result = await args.db.execute(sql3`
+    SELECT
+      ${table.repositoryFullName} AS "repository",
+      count(*) FILTER (WHERE ${table.openedAt} >= ${start})::integer
+        AS "created",
+      count(*) FILTER (
+        WHERE ${table.state} = 'closed'
+          AND ${table.stateReason} = 'completed'
+          AND ${table.closedAt} >= ${start}
+      )::integer AS "closedCompleted",
+      count(*) FILTER (
+        WHERE ${table.state} = 'closed'
+          AND ${table.stateReason} = 'duplicate'
+          AND ${table.closedAt} >= ${start}
+      )::integer AS "closedDuplicate",
+      count(*) FILTER (
+        WHERE ${table.state} = 'closed'
+          AND ${table.stateReason} = 'not_planned'
+          AND ${table.closedAt} >= ${start}
+      )::integer AS "closedNotPlanned",
+      count(*) FILTER (
+        WHERE ${table.state} = 'closed'
+          AND ${table.stateReason} IS NULL
+          AND ${table.closedAt} >= ${start}
+      )::integer AS "closedUnknown"
+    FROM ${table}
+    WHERE ${table.openedAt} >= ${start}
+      OR ${table.closedAt} >= ${start}
+    GROUP BY ${table.repositoryFullName}
+    ORDER BY "created" DESC, "closedCompleted" DESC, "repository" ASC
+    LIMIT 25
+  `);
+  return z10.array(issueRepositoryStatsSchema).parse(queryRows(result));
 }
 function formatPercent(value) {
   return value === void 0 ? "\u2014" : `${Math.round(value * 100)}%`;
@@ -1420,38 +1934,68 @@ function formatDuration(value) {
   if (hours < 24) return `${Math.round(hours * 10) / 10}h`;
   return `${Math.round(hours / 24 * 10) / 10}d`;
 }
+function formatCommitComposition(stats) {
+  return `${stats.juniorOnly} Junior-only \xB7 ${stats.mixed} mixed \xB7 ${stats.compositionUnknown} unknown`;
+}
 async function buildGitHubOutcomeReport(args) {
-  const [windows, repositories] = await Promise.all([
-    aggregateOutcomeWindows(args),
-    aggregateRepositories(args)
+  const [windows, repositories, issueWindows, issueRepositories] = await Promise.all([
+    aggregatePullRequestWindows(args),
+    aggregatePullRequestRepositories(args),
+    aggregateIssueWindows(args),
+    aggregateIssueRepositories(args)
   ]);
   const thirtyDays = windows.find((window) => window.days === 30);
+  const issueThirtyDays = issueWindows.find((window) => window.days === 30);
   return {
     generatedAt: new Date(args.nowMs).toISOString(),
     title: "GitHub work delivered",
     metrics: [
-      { label: "created \xB7 30d", value: String(thirtyDays.created) },
+      { label: "PRs created \xB7 30d", value: String(thirtyDays.created) },
       {
-        label: "merged \xB7 30d",
+        label: "PRs merged \xB7 30d",
         tone: thirtyDays.merged > 0 ? "good" : "neutral",
         value: String(thirtyDays.merged)
       },
-      { label: "closed unmerged \xB7 30d", value: String(thirtyDays.closed) },
-      { label: "open now", value: String(thirtyDays.open) },
-      { label: "merge rate \xB7 30d", value: formatPercent(thirtyDays.mergeRate) },
       {
-        label: "median merge time \xB7 30d",
+        label: "Junior-only merge rate \xB7 30d",
+        value: formatPercent(thirtyDays.juniorOnlyRate)
+      },
+      {
+        label: "PRs closed unmerged \xB7 30d",
+        value: String(thirtyDays.closed)
+      },
+      {
+        label: "PR merge rate \xB7 30d",
+        value: formatPercent(thirtyDays.mergeRate)
+      },
+      {
+        label: "median PR merge time \xB7 30d",
         value: formatDuration(thirtyDays.medianMergeTimeMs)
+      },
+      { label: "issues created \xB7 30d", value: String(issueThirtyDays.created) },
+      {
+        label: "issues completed \xB7 30d",
+        tone: issueThirtyDays.closedCompleted > 0 ? "good" : "neutral",
+        value: String(issueThirtyDays.closedCompleted)
+      },
+      {
+        label: "issues closed as duplicate \xB7 30d",
+        value: String(issueThirtyDays.closedDuplicate)
+      },
+      {
+        label: "issues closed as not planned \xB7 30d",
+        value: String(issueThirtyDays.closedNotPlanned)
       }
     ],
     recordSets: [
       {
-        title: "Outcome windows",
+        title: "Pull request outcome windows",
         fields: [
           { key: "window", label: "Window" },
           { key: "created", label: "Created" },
           { key: "merged", label: "Merged" },
           { key: "closed", label: "Closed unmerged" },
+          { key: "commitComposition", label: "Merged commit composition" },
           { key: "mergeRate", label: "Merge rate" },
           { key: "mergeTime", label: "Median merge time" }
         ],
@@ -1462,20 +2006,21 @@ async function buildGitHubOutcomeReport(args) {
             created: String(stats.created),
             merged: String(stats.merged),
             closed: String(stats.closed),
+            commitComposition: formatCommitComposition(stats),
             mergeRate: formatPercent(stats.mergeRate),
             mergeTime: formatDuration(stats.medianMergeTimeMs)
           }
         }))
       },
       {
-        title: "Repositories \xB7 30d",
+        title: "Pull request repositories \xB7 30d",
         emptyText: "No Junior-owned pull request activity yet.",
         fields: [
           { key: "repository", label: "Repository" },
           { key: "created", label: "Created" },
           { key: "merged", label: "Merged" },
           { key: "closed", label: "Closed unmerged" },
-          { key: "open", label: "Open now" },
+          { key: "commitComposition", label: "Merged commit composition" },
           { key: "mergeRate", label: "Merge rate" }
         ],
         records: repositories.map(({ repository, ...stats }) => ({
@@ -1485,15 +2030,115 @@ async function buildGitHubOutcomeReport(args) {
             created: String(stats.created),
             merged: String(stats.merged),
             closed: String(stats.closed),
-            open: String(stats.open),
+            commitComposition: formatCommitComposition(stats),
             mergeRate: formatPercent(stats.mergeRate)
           }
         }))
+      },
+      {
+        title: "Issue outcome windows",
+        fields: [
+          { key: "window", label: "Window" },
+          { key: "created", label: "Created" },
+          { key: "completed", label: "Completed" },
+          { key: "duplicate", label: "Duplicate" },
+          { key: "notPlanned", label: "Not planned" },
+          { key: "unknown", label: "Unknown reason" },
+          { key: "closeTime", label: "Median close time" }
+        ],
+        records: issueWindows.map((stats) => ({
+          id: `${stats.days}d`,
+          values: {
+            window: `${stats.days} days`,
+            created: String(stats.created),
+            completed: String(stats.closedCompleted),
+            duplicate: String(stats.closedDuplicate),
+            notPlanned: String(stats.closedNotPlanned),
+            unknown: String(stats.closedUnknown),
+            closeTime: formatDuration(stats.medianCloseTimeMs)
+          }
+        }))
+      },
+      {
+        title: "Issue repositories \xB7 30d",
+        emptyText: "No Junior-owned issue activity yet.",
+        fields: [
+          { key: "repository", label: "Repository" },
+          { key: "created", label: "Created" },
+          { key: "completed", label: "Completed" },
+          { key: "duplicate", label: "Duplicate" },
+          { key: "notPlanned", label: "Not planned" },
+          { key: "unknown", label: "Unknown reason" }
+        ],
+        records: issueRepositories.map(({ repository, ...stats }) => ({
+          id: repository,
+          values: {
+            repository,
+            created: String(stats.created),
+            completed: String(stats.closedCompleted),
+            duplicate: String(stats.closedDuplicate),
+            notPlanned: String(stats.closedNotPlanned),
+            unknown: String(stats.closedUnknown)
+          }
+        }))
       }
     ]
   };
 }
 
+// src/pull-request-outcomes/commit-composition.ts
+import { z as z11 } from "zod";
+var canonicalCommitSchema = z11.object({
+  authorEmail: z11.string().nullable(),
+  authorLogin: z11.string().nullable()
+}).strict();
+var providerCommitSchema = z11.object({
+  author: z11.object({ login: z11.string() }).passthrough().nullable(),
+  commit: z11.object({
+    author: z11.object({ email: z11.string() }).passthrough().nullable()
+  }).passthrough()
+}).passthrough();
+var commitPageSchema = z11.array(providerCommitSchema).transform(
+  (commits) => commits.map(
+    (commit) => canonicalCommitSchema.parse({
+      authorEmail: commit.commit.author?.email ?? null,
+      authorLogin: commit.author?.login ?? null
+    })
+  )
+);
+var PAGE_SIZE = 100;
+var MAX_PAGES = 3;
+var MAX_LISTED_COMMITS = 250;
+async function classifyGitHubPullRequestCommitComposition(args) {
+  const botEmail = args.botEmail.trim().toLowerCase();
+  const botLogin = botLoginFromEmail(botEmail)?.toLowerCase();
+  if (!botEmail || !botLogin) {
+    throw new Error(
+      "The configured GitHub App bot email cannot classify pull request commits"
+    );
+  }
+  let foundCommit = false;
+  let inspectedCommits = 0;
+  for (let page = 1; page <= MAX_PAGES; page += 1) {
+    const commits = commitPageSchema.parse(
+      await args.loadPage(page, PAGE_SIZE)
+    );
+    inspectedCommits += commits.length;
+    for (const commit of commits) {
+      foundCommit = true;
+      const authorLogin = commit.authorLogin?.trim().toLowerCase();
+      const authorEmail = commit.authorEmail?.trim().toLowerCase();
+      if (authorLogin !== botLogin && authorEmail !== botEmail) {
+        return "mixed";
+      }
+    }
+    if (inspectedCommits >= MAX_LISTED_COMMITS) return void 0;
+    if (commits.length < PAGE_SIZE) break;
+    if (page === MAX_PAGES) return void 0;
+  }
+  return foundCommit ? "junior_only" : void 0;
+}
+
 // src/index.ts
 var GITHUB_APP_ID_ENV = "GITHUB_APP_ID";
 var GITHUB_APP_PRIVATE_KEY_ENV = "GITHUB_APP_PRIVATE_KEY";
@@ -2059,28 +2704,6 @@ function githubRepositoryFromLeaseScope(leaseScope) {
   }
   return { owner: match[1], name: match[2] };
 }
-function githubRepositoryIdFromUploadUrl(upstreamUrl) {
-  const repositoryId = Number(upstreamUrl.searchParams.get("repository_id"));
-  if (!Number.isSafeInteger(repositoryId) || repositoryId <= 0) {
-    throw new EgressPolicyDenied(
-      "GitHub asset upload request is missing a valid repository_id."
-    );
-  }
-  return repositoryId;
-}
-function githubRepositoryIdLeaseScope(repositoryId) {
-  return `repository-id:${repositoryId}`;
-}
-function githubRepositoryIdFromLeaseScope(leaseScope) {
-  const match = /^repository-id:(\d+)$/.exec(leaseScope ?? "");
-  const repositoryId = Number(match?.[1]);
-  if (!Number.isSafeInteger(repositoryId) || repositoryId <= 0) {
-    throw new GitHubPluginSetupError(
-      "GitHub asset upload grant is missing a repository id lease scope."
-    );
-  }
-  return repositoryId;
-}
 async function resolveUserAccount(tokens) {
   const account = await githubRequest("https://api.github.com", "/user", {
     token: tokens.accessToken
@@ -2250,7 +2873,7 @@ async function issueUserCredential(ctx, options) {
   }
   return credentialNeeded("Your GitHub authorization has expired.", scope);
 }
-async function issueInstallationCredential(options) {
+async function issueInstallationToken(options) {
   const appId = requireEnv(options.appIdEnv);
   const installationIdRaw = requireEnv(options.installationIdEnv);
   const installationId = Number(installationIdRaw);
@@ -2258,8 +2881,10 @@ async function issueInstallationCredential(options) {
     throw new GitHubPluginSetupError(`Invalid ${options.installationIdEnv}`);
   }
   const appJwt = createAppJwt(appId, options.privateKeyEnv);
-  const body = "repositories" in options ? { repositories: options.repositories } : "repositoryIds" in options ? { repository_ids: options.repositoryIds } : {
-    permissions: "permissions" in options ? options.permissions : await options.loadPermissions({ appJwt, installationId })
+  const permissions = "permissions" in options ? options.permissions : typeof options.loadPermissions === "function" ? await options.loadPermissions({ appJwt, installationId }) : void 0;
+  const body = {
+    ...permissions ? { permissions } : {},
+    ..."repositories" in options ? { repositories: options.repositories } : {}
   };
   const accessTokenResponse = await githubRequest(
     "https://api.github.com",
@@ -2271,14 +2896,16 @@ async function issueInstallationCredential(options) {
     }
   );
   const parsedToken = parseInstallationTokenResponse(accessTokenResponse);
-  const expiresAtMs = Math.min(
-    parsedToken.expiresAtMs,
-    Date.now() + MAX_LEASE_MS
-  );
+  return {
+    expiresAtMs: Math.min(parsedToken.expiresAtMs, Date.now() + MAX_LEASE_MS),
+    token: parsedToken.token
+  };
+}
+async function issueInstallationCredential(options) {
+  const token = await issueInstallationToken(options);
   return createCredentialLease({
-    ...options.domains ? { domains: options.domains } : {},
-    token: parsedToken.token,
-    expiresAtMs
+    token: token.token,
+    expiresAtMs: token.expiresAtMs
   });
 }
 function createPermissionCache() {
@@ -2595,13 +3222,7 @@ async function githubGrantForEgress(ctx) {
     upstreamUrl
   });
   if (isGitHubAssetUploadRequest(method, upstreamUrl)) {
-    const repositoryId = githubRepositoryIdFromUploadUrl(upstreamUrl);
-    return grantForAccess(
-      "write",
-      "github.asset-upload",
-      "installation-write",
-      githubRepositoryIdLeaseScope(repositoryId)
-    );
+    return grantForAccess("write", "github.asset-upload", "user-write");
   }
   const smartHttpAccess = githubSmartHttpAccess(upstreamUrl);
   if (smartHttpAccess) {
@@ -2725,7 +3346,34 @@ function githubPlugin(options = {}) {
         return [
           createGitHubWebhookRoute({
             botEmail: () => readEnv(botEmailEnv),
+            classifyPullRequestCommits: async ({
+              number,
+              repositoryFullName
+            }) => {
+              const [owner, name, ...extra] = repositoryFullName.split("/");
+              if (!owner || !name || extra.length > 0) {
+                throw new Error(
+                  "GitHub pull request commit classification received an invalid repository name"
+                );
+              }
+              const token = await issueInstallationToken({
+                appIdEnv,
+                privateKeyEnv,
+                installationIdEnv,
+                permissions: { pull_requests: "read" },
+                repositories: [name]
+              });
+              return await classifyGitHubPullRequestCommitComposition({
+                botEmail: requireEnv(botEmailEnv),
+                loadPage: async (page, perPage) => await githubRequest(
+                  "https://api.github.com",
+                  `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/pulls/${number}/commits?per_page=${perPage}&page=${page}`,
+                  { token: token.token }
+                )
+              });
+            },
             db: ctx.db,
+            log: ctx.log,
             resourceEvents: ctx.resourceEvents,
             webhookSecret: () => readEnv("GITHUB_WEBHOOK_SECRET")
           })
@@ -2808,18 +3456,6 @@ function githubPlugin(options = {}) {
             });
           }
           if (ctx.grant.name === "installation-write") {
-            if (ctx.grant.reason === "github.asset-upload") {
-              const repositoryId = githubRepositoryIdFromLeaseScope(
-                ctx.grant.leaseScope
-              );
-              return await issueInstallationCredential({
-                appIdEnv,
-                domains: GITHUB_ASSET_UPLOAD_CREDENTIAL_DOMAINS,
-                privateKeyEnv,
-                installationIdEnv,
-                repositoryIds: [repositoryId]
-              });
-            }
             const repository = githubRepositoryFromLeaseScope(
               ctx.grant.leaseScope
             );