@sentry/junior-github 0.113.0 → 0.115.0

package/dist/credential-support.d.ts

@@ -0,0 +1,90 @@
+import type { PluginCredentialResult, PluginGrant, PluginProviderAccount, PluginStoredTokens, IssueCredentialHookContext } from "@sentry/junior-plugin-api";
+import { type GitHubAppPermissions } from "./permissions.js";
+export type JsonRecord = Record<string, unknown>;
+export type GitHubGrantName = "installation-read" | "installation-write" | "user-read" | "user-write";
+export type GitHubGrantReason = "github.api-read" | "github.asset-upload" | "github.git-read" | "github.graphql-read" | "github.installation-write" | "github.user-read" | "github.user-write";
+export type GitHubGrant = PluginGrant & {
+    name: GitHubGrantName;
+    reason: GitHubGrantReason;
+};
+interface GitHubRequestParams {
+    body?: unknown;
+    method?: string;
+    token: string;
+}
+interface UserCredentialOptions {
+    clientIdEnv: string;
+    clientSecretEnv: string;
+    userScope?: string;
+}
+interface InstallationCredentialBaseOptions {
+    appIdEnv: string;
+    installationIdEnv: string;
+    privateKeyEnv: string;
+}
+type InstallationCredentialOptions = InstallationCredentialBaseOptions & ({
+    loadPermissions?: never;
+    permissions?: GitHubAppPermissions;
+    repositories: string[];
+} | {
+    loadPermissions?: never;
+    permissions: GitHubAppPermissions;
+    repositories?: never;
+} | {
+    loadPermissions: LoadInstallationReadPermissions;
+    permissions?: never;
+    repositories?: never;
+});
+type LoadInstallationReadPermissions = (input: {
+    appJwt: string;
+    installationId: number;
+}) => Promise<Record<string, "read">>;
+interface GitHubRepository {
+    name: string;
+    owner: string;
+}
+export declare const GITHUB_APP_ID_ENV = "GITHUB_APP_ID";
+export declare const GITHUB_APP_PRIVATE_KEY_ENV = "GITHUB_APP_PRIVATE_KEY";
+export declare const GITHUB_INSTALLATION_ID_ENV = "GITHUB_INSTALLATION_ID";
+export declare const GITHUB_AUTH_TOKEN_ENV = "GITHUB_TOKEN";
+export declare const GITHUB_AUTH_TOKEN_PLACEHOLDER = "ghp_host_managed_credential";
+export declare const GITHUB_GRAPHQL_RESPONSE_BODY_LIMIT_BYTES: number;
+export declare const HTTP_READ_METHODS: Set<string>;
+export declare const USER_TOKEN_GRANTS: Set<string>;
+export declare const CREATE_TOOL_ROUTING_GUIDANCE = "This is a Junior tool-routing denial, not a GitHub permission failure. Do not ask the user for GitHub permissions; retry with the required Junior tool.";
+export declare const USER_WRITE_REQUIREMENTS: string[];
+export declare class GitHubPluginSetupError extends Error {
+    constructor(message: string);
+}
+/** Return whether a provider value is a JSON object. */
+export declare function isRecord(value: unknown): value is JsonRecord;
+/** Read a non-empty GitHub plugin environment value. */
+export declare function readEnv(name: string): string | undefined;
+/** Read a required GitHub plugin environment value. */
+export declare function requireEnv(name: string): string;
+/** Normalize configured GitHub OAuth scopes. */
+export declare function normalizeScopeList(scopes?: string[]): string[];
+/** Send an authenticated request to the GitHub API. */
+export declare function githubRequest(apiBase: string, path: string, params: GitHubRequestParams): Promise<unknown>;
+/** Return a credential result for invalid GitHub App configuration. */
+export declare function credentialUnavailable(message: string): PluginCredentialResult;
+/** Parse a GitHub repository from an API or Git URL. */
+export declare function githubRepositoryFromUrl(upstreamUrl: URL): GitHubRepository | undefined;
+/** Build the stable lease scope for a GitHub repository. */
+export declare function githubRepositoryLeaseScope(repository: GitHubRepository): string;
+/** Parse the repository bound to an installation-write lease. */
+export declare function githubRepositoryFromLeaseScope(leaseScope: string | undefined): GitHubRepository;
+/** Resolve the GitHub account associated with stored user tokens. */
+export declare function resolveUserAccount(tokens: PluginStoredTokens): Promise<PluginProviderAccount>;
+/** Issue a bounded GitHub user credential for an approved grant. */
+export declare function issueUserCredential(ctx: IssueCredentialHookContext, options: UserCredentialOptions): Promise<PluginCredentialResult>;
+/** Issue a bounded raw token for plugin-owned GitHub API calls. */
+export declare function issueInstallationToken(options: InstallationCredentialOptions): Promise<{
+    expiresAtMs: number;
+    token: string;
+}>;
+/** Issue a bounded GitHub App installation credential. */
+export declare function issueInstallationCredential(options: InstallationCredentialOptions): Promise<PluginCredentialResult>;
+/** Cache the installation's read permissions for one lease period. */
+export declare function createPermissionCache(): LoadInstallationReadPermissions;
+export {};

package/dist/git-config.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Git identity and commit-hook setup for GitHub sandboxes.
+ */
+import type { Actor, SandboxPrepareHookContext } from "@sentry/junior-plugin-api";
+/**
+ * Build `Co-Authored-By` trailers crediting human run actors.
+ *
+ * `run.actors` is attribution only (see `multi-actor-runs.md`): a steerer
+ * without a resolvable name and email is silently omitted rather than
+ * denying the commit. Dedupes by identity and resolved email so the same human
+ * under two display profiles, or an actor matching the bot identity, only ever
+ * produces one line.
+ */
+export declare function additionalActorCoauthorTrailers(args: {
+    actors?: Actor[];
+    botEmail: string;
+}): string[];
+/** Build the hook that replaces model-supplied commit attribution. */
+export declare function prepareCommitMsgHook(): string;
+/** Set one global Git option inside the prepared sandbox. */
+export declare function configureGit(ctx: SandboxPrepareHookContext, key: string, value: string): Promise<void>;

package/dist/index.d.ts

@@ -1,40 +1,2 @@
-import { type PluginRegistration } from "@sentry/junior-plugin-api";
-import { type GitHubAppPermissions } from "./permissions.js";
+export { githubPlugin, type GitHubPluginOptions } from "./plugin.js";
 export type { GitHubAppPermissionLevel } from "./permissions.js";
-/** Configure the built-in GitHub plugin manifest and hooks. */
-export interface GitHubPluginOptions {
-    /**
-     * Extra OAuth `scope` values to request during GitHub App user authorization.
-     *
-     * GitHub App user tokens report empty scopes, so Junior treats this as a
-     * local reauthorization contract only. Effective access still comes from the
-     * app permissions, installation repositories, and requesting user's access.
-     */
-    additionalUserScopes?: string[];
-    /**
-     * GitHub App permissions Junior should expose as capabilities and downscope
-     * to read for installation-read tokens.
-     *
-     * Keys may use GitHub permission names with underscores or hyphens. Junior
-     * records these as plugin capabilities. Installation-write tokens inherit
-     * the App installation's complete permission envelope.
-     * GitHub remains the source of truth for whether a permission exists.
-     */
-    appPermissions?: GitHubAppPermissions;
-    /** Environment variable containing the GitHub App id. */
-    appIdEnv?: string;
-    /** Environment variable containing Junior's Git committer email. */
-    botEmailEnv?: string;
-    /** Environment variable containing Junior's Git committer name. */
-    botNameEnv?: string;
-    /** Environment variable containing the GitHub App OAuth client id. */
-    clientIdEnv?: string;
-    /** Environment variable containing the GitHub App OAuth client secret. */
-    clientSecretEnv?: string;
-    /** Environment variable containing the GitHub App installation id. */
-    installationIdEnv?: string;
-    /** Environment variable containing the GitHub App private key. */
-    privateKeyEnv?: string;
-}
-/** Register GitHub runtime hooks for repository workflows. */
-export declare function githubPlugin(options?: GitHubPluginOptions): PluginRegistration;

package/dist/index.js

@@ -3,8 +3,7 @@ import {
   normalizeGitHubResourceEvents
 } from "./chunk-JDNXIBCQ.js";
 
-// src/index.ts
-import { createPrivateKey, createSign } from "crypto";
+// src/plugin.ts
 import {
   defineJuniorPlugin,
   EgressPolicyDenied
@@ -1828,10 +1827,14 @@ var costWindowSchema = z10.object({
 }));
 var repositoryCostSchema = z10.object({
   issueCostUsd: z10.number().nonnegative().nullable(),
+  medianIssueCostUsd: z10.number().nonnegative().nullable(),
+  medianPullRequestCostUsd: z10.number().nonnegative().nullable(),
   pullRequestCostUsd: z10.number().nonnegative().nullable(),
   repository: z10.string().min(1)
 }).strict().transform((row) => ({
   issueCostUsd: row.issueCostUsd ?? void 0,
+  medianIssueCostUsd: row.medianIssueCostUsd ?? void 0,
+  medianPullRequestCostUsd: row.medianPullRequestCostUsd ?? void 0,
   pullRequestCostUsd: row.pullRequestCostUsd ?? void 0,
   repository: row.repository
 }));
@@ -2048,7 +2051,8 @@ async function aggregateGitHubRepositoryCosts(args) {
     WITH pull_request_entities AS (
       SELECT
         ${pullRequests.repositoryFullName} AS repository,
-        conversation_ids.ids AS ids
+        conversation_ids.ids AS ids,
+        ${conversationTreeCost} AS cost_usd
       FROM ${pullRequests}
       CROSS JOIN LATERAL (
         SELECT ${pullRequestConversationIds} AS ids
@@ -2057,7 +2061,8 @@ async function aggregateGitHubRepositoryCosts(args) {
     ), issue_entities AS (
       SELECT
         ${issues.repositoryFullName} AS repository,
-        conversation_ids.ids AS ids
+        conversation_ids.ids AS ids,
+        ${conversationTreeCost} AS cost_usd
       FROM ${issues}
       CROSS JOIN LATERAL (
         SELECT ${issueConversationIds} AS ids
@@ -2079,7 +2084,15 @@ async function aggregateGitHubRepositoryCosts(args) {
               WHERE pull_request_entities.repository = repositories.repository
             ) AS ids
           ) AS conversation_ids
-        ), 0)::double precision AS pull_request_cost_usd
+        ), 0)::double precision AS pull_request_cost_usd,
+        (
+          SELECT percentile_cont(0.5) WITHIN GROUP (
+            ORDER BY pull_request_entities.cost_usd
+          )
+          FROM pull_request_entities
+          WHERE pull_request_entities.repository = repositories.repository
+            AND pull_request_entities.cost_usd > 0
+        )::double precision AS median_pull_request_cost_usd
       FROM repositories
     ), issue_totals AS (
       SELECT
@@ -2093,21 +2106,32 @@ async function aggregateGitHubRepositoryCosts(args) {
               WHERE issue_entities.repository = repositories.repository
             ) AS ids
           ) AS conversation_ids
-        ), 0)::double precision AS issue_cost_usd
+        ), 0)::double precision AS issue_cost_usd,
+        (
+          SELECT percentile_cont(0.5) WITHIN GROUP (
+            ORDER BY issue_entities.cost_usd
+          )
+          FROM issue_entities
+          WHERE issue_entities.repository = repositories.repository
+            AND issue_entities.cost_usd > 0
+        )::double precision AS median_issue_cost_usd
       FROM repositories
     )
     SELECT
       repositories.repository AS "repository",
       coalesce(pull_request_totals.pull_request_cost_usd, 0)::double precision
         AS "pullRequestCostUsd",
+      pull_request_totals.median_pull_request_cost_usd
+        AS "medianPullRequestCostUsd",
       coalesce(issue_totals.issue_cost_usd, 0)::double precision
-        AS "issueCostUsd"
+        AS "issueCostUsd",
+      issue_totals.median_issue_cost_usd AS "medianIssueCostUsd"
     FROM repositories
     LEFT JOIN pull_request_totals
       ON pull_request_totals.repository = repositories.repository
     LEFT JOIN issue_totals
       ON issue_totals.repository = repositories.repository
-    ORDER BY "pullRequestCostUsd" DESC, "issueCostUsd" DESC, "repository" ASC
+    ORDER BY "repository" ASC
   `);
   return z10.array(repositoryCostSchema).parse(queryRows(result));
 }
@@ -2548,7 +2572,7 @@ async function buildGitHubOutcomeReport(args) {
           { key: "merged", label: "Merged" },
           { key: "closed", label: "Closed unmerged" },
           { key: "mergeRate", label: "Closure merge rate" },
-          { key: "cost", label: "Cost" }
+          { key: "medianCost", label: "Median cost" }
         ],
         records: repositories.map(({ repository, ...stats }) => ({
           id: repository,
@@ -2559,8 +2583,8 @@ async function buildGitHubOutcomeReport(args) {
             closed: String(stats.closed),
             juniorOnly: String(stats.juniorOnly),
             mergeRate: formatPercent(stats.mergeRate),
-            cost: formatCostUsd(
-              repositoryCostByName.get(repository)?.pullRequestCostUsd ?? 0
+            medianCost: formatCostUsd(
+              repositoryCostByName.get(repository)?.medianPullRequestCostUsd
             )
           }
         }))
@@ -2575,7 +2599,7 @@ async function buildGitHubOutcomeReport(args) {
           { key: "duplicate", label: "Duplicate" },
           { key: "notPlanned", label: "Not planned" },
           { key: "unknown", label: "Unknown reason" },
-          { key: "cost", label: "Cost" }
+          { key: "medianCost", label: "Median cost" }
         ],
         records: issueRepositories.map(({ repository, ...stats }) => ({
           id: repository,
@@ -2586,8 +2610,8 @@ async function buildGitHubOutcomeReport(args) {
             duplicate: String(stats.closedDuplicate),
             notPlanned: String(stats.closedNotPlanned),
             unknown: String(stats.closedUnknown),
-            cost: formatCostUsd(
-              repositoryCostByName.get(repository)?.issueCostUsd ?? 0
+            medianCost: formatCostUsd(
+              repositoryCostByName.get(repository)?.medianIssueCostUsd
             )
           }
         }))
@@ -2649,87 +2673,7 @@ async function classifyGitHubPullRequestCommitComposition(args) {
   return foundCommit ? "junior_only" : void 0;
 }
 
-// src/index.ts
-var GITHUB_APP_ID_ENV = "GITHUB_APP_ID";
-var GITHUB_APP_PRIVATE_KEY_ENV = "GITHUB_APP_PRIVATE_KEY";
-var GITHUB_INSTALLATION_ID_ENV = "GITHUB_INSTALLATION_ID";
-var GITHUB_AUTH_TOKEN_ENV = "GITHUB_TOKEN";
-var GITHUB_AUTH_TOKEN_PLACEHOLDER = "ghp_host_managed_credential";
-var MAX_LEASE_MS = 60 * 60 * 1e3;
-var REFRESH_BUFFER_MS = 5 * 60 * 1e3;
-var USER_REFRESH_TIMEOUT_MS = 2e4;
-var GITHUB_GRAPHQL_RESPONSE_BODY_LIMIT_BYTES = 64 * 1024;
-var HTTP_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
-var USER_TOKEN_GRANTS = /* @__PURE__ */ new Set(["user-read", "user-write"]);
-var CREATE_TOOL_ROUTING_GUIDANCE = "This is a Junior tool-routing denial, not a GitHub permission failure. Do not ask the user for GitHub permissions; retry with the required Junior tool.";
-var USER_WRITE_REQUIREMENTS = [
-  "requesting GitHub user permission to perform this operation"
-];
-var GITHUB_CREDENTIAL_DOMAINS = ["api.github.com", "github.com"];
-var GITHUB_ASSET_UPLOAD_CREDENTIAL_DOMAINS = [
-  ...GITHUB_CREDENTIAL_DOMAINS,
-  "uploads.github.com"
-];
-var GitHubUserRefreshRejectedError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "GitHubUserRefreshRejectedError";
-  }
-};
-var GitHubRequestError = class extends Error {
-  status;
-  constructor(message, status) {
-    super(message);
-    this.name = "GitHubRequestError";
-    this.status = status;
-  }
-};
-var GitHubPluginSetupError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "GitHubPluginSetupError";
-  }
-};
-function isRecord(value) {
-  return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-function readEnv(name) {
-  const value = process.env[name];
-  if (typeof value !== "string") {
-    return void 0;
-  }
-  const trimmed = value.trim();
-  return trimmed ? trimmed : void 0;
-}
-function requireEnv(name) {
-  const value = readEnv(name);
-  if (!value) {
-    throw new GitHubPluginSetupError(`Missing ${name}`);
-  }
-  return value;
-}
-function normalizeScopeList(scopes) {
-  return [
-    ...new Set(
-      (scopes ?? []).flatMap((scope) => String(scope).split(/\s+/)).map((scope) => scope.trim()).filter(Boolean)
-    )
-  ].sort();
-}
-function normalizeOAuthScope(scope) {
-  const normalized = normalizeScopeList(scope ? [scope] : []);
-  return normalized.length ? normalized.join(" ") : void 0;
-}
-function hasRequiredOAuthScope(storedScope, requiredScope) {
-  const required = normalizeScopeList(requiredScope ? [requiredScope] : []);
-  if (required.length === 0) {
-    return true;
-  }
-  const stored = new Set(normalizeScopeList(storedScope ? [storedScope] : []));
-  if (stored.size === 0) {
-    return false;
-  }
-  return required.every((scope) => stored.has(scope));
-}
+// src/git-config.ts
 function cleanIdentityPart(value) {
   return String(value ?? "").replaceAll("\n", " ").replaceAll("\r", " ").replace(/[<>]/g, "").trim();
 }
@@ -2937,6 +2881,92 @@ async function configureGit(ctx, key, value) {
     );
   }
 }
+
+// src/credential-support.ts
+import { createPrivateKey, createSign } from "crypto";
+var GITHUB_APP_ID_ENV = "GITHUB_APP_ID";
+var GITHUB_APP_PRIVATE_KEY_ENV = "GITHUB_APP_PRIVATE_KEY";
+var GITHUB_INSTALLATION_ID_ENV = "GITHUB_INSTALLATION_ID";
+var GITHUB_AUTH_TOKEN_ENV = "GITHUB_TOKEN";
+var GITHUB_AUTH_TOKEN_PLACEHOLDER = "ghp_host_managed_credential";
+var MAX_LEASE_MS = 60 * 60 * 1e3;
+var REFRESH_BUFFER_MS = 5 * 60 * 1e3;
+var USER_REFRESH_TIMEOUT_MS = 2e4;
+var GITHUB_GRAPHQL_RESPONSE_BODY_LIMIT_BYTES = 64 * 1024;
+var HTTP_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+var USER_TOKEN_GRANTS = /* @__PURE__ */ new Set(["user-read", "user-write"]);
+var CREATE_TOOL_ROUTING_GUIDANCE = "This is a Junior tool-routing denial, not a GitHub permission failure. Do not ask the user for GitHub permissions; retry with the required Junior tool.";
+var USER_WRITE_REQUIREMENTS = [
+  "requesting GitHub user permission to perform this operation"
+];
+var GITHUB_CREDENTIAL_DOMAINS = ["api.github.com", "github.com"];
+var GITHUB_ASSET_UPLOAD_CREDENTIAL_DOMAINS = [
+  ...GITHUB_CREDENTIAL_DOMAINS,
+  "uploads.github.com"
+];
+var GitHubUserRefreshRejectedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GitHubUserRefreshRejectedError";
+  }
+};
+var GitHubRequestError = class extends Error {
+  status;
+  constructor(message, status) {
+    super(message);
+    this.name = "GitHubRequestError";
+    this.status = status;
+  }
+};
+var GitHubPluginSetupError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GitHubPluginSetupError";
+  }
+};
+function isRecord(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function readEnv(name) {
+  const value = process.env[name];
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const trimmed = value.trim();
+  return trimmed ? trimmed : void 0;
+}
+function requireEnv(name) {
+  const value = readEnv(name);
+  if (!value) {
+    throw new GitHubPluginSetupError(`Missing ${name}`);
+  }
+  return value;
+}
+function normalizeScopeList(scopes) {
+  return [
+    ...new Set(
+      (scopes ?? []).flatMap((scope) => String(scope).split(/\s+/)).map((scope) => scope.trim()).filter(Boolean)
+    )
+  ].sort();
+}
+function normalizeOAuthScope(scope) {
+  const normalized = normalizeScopeList(scope ? [scope] : []);
+  return normalized.length ? normalized.join(" ") : void 0;
+}
+function hasRequiredOAuthScope(storedScope, requiredScope) {
+  const required = normalizeScopeList(requiredScope ? [requiredScope] : []);
+  if (required.length === 0) {
+    return true;
+  }
+  const stored = new Set(normalizeScopeList(storedScope ? [storedScope] : []));
+  if (stored.size === 0) {
+    return false;
+  }
+  return required.every((scope) => stored.has(scope));
+}
+function isGitHubApiUrl(upstreamUrl) {
+  return upstreamUrl.hostname.toLowerCase() === "api.github.com";
+}
 function base64Url(input) {
   return Buffer.from(input).toString("base64").replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
 }
@@ -3437,6 +3467,8 @@ function createPermissionCache() {
     return await pending;
   };
 }
+
+// src/plugin.ts
 function githubSmartHttpAccess(upstreamUrl) {
   const pathname = upstreamUrl.pathname.toLowerCase();
   const service = upstreamUrl.searchParams.get("service")?.toLowerCase();
@@ -3455,14 +3487,14 @@ function githubSmartHttpAccess(upstreamUrl) {
 function isGitHubGraphqlUrl(upstreamUrl) {
   return upstreamUrl.hostname.toLowerCase() === "api.github.com" && upstreamUrl.pathname.toLowerCase().endsWith("/graphql");
 }
-function isGitHubApiUrl(upstreamUrl) {
+function isGitHubApiUrl2(upstreamUrl) {
   return upstreamUrl.hostname.toLowerCase() === "api.github.com";
 }
 function isGitHubAssetUploadRequest(method, upstreamUrl) {
   return method === "POST" && upstreamUrl.hostname.toLowerCase() === "uploads.github.com" && upstreamUrl.pathname === "/user-attachments/assets";
 }
 function githubUserReadReason(method, upstreamUrl) {
-  if (method !== "GET" || !isGitHubApiUrl(upstreamUrl)) {
+  if (method !== "GET" || !isGitHubApiUrl2(upstreamUrl)) {
     return void 0;
   }
   return upstreamUrl.pathname.toLowerCase() === "/user" ? "github.user-read" : void 0;
@@ -3590,7 +3622,7 @@ function shouldInspectGitHubGraphqlResponse(ctx) {
 }
 function githubApiWriteGrantName(method, upstreamUrl) {
   const pathname = upstreamUrl.pathname.toLowerCase();
-  if (!isGitHubApiUrl(upstreamUrl)) {
+  if (!isGitHubApiUrl2(upstreamUrl)) {
     return void 0;
   }
   if (method === "POST" && /^\/repos\/[^/]+\/[^/]+\/actions\/workflows\/[^/]+\/dispatches$/.test(
@@ -3632,10 +3664,10 @@ function githubApiWriteGrantName(method, upstreamUrl) {
   return void 0;
 }
 function isGitHubIssueCreateRestRequest(method, upstreamUrl) {
-  return method === "POST" && isGitHubApiUrl(upstreamUrl) && /^\/repos\/[^/]+\/[^/]+\/issues$/.test(upstreamUrl.pathname.toLowerCase());
+  return method === "POST" && isGitHubApiUrl2(upstreamUrl) && /^\/repos\/[^/]+\/[^/]+\/issues$/.test(upstreamUrl.pathname.toLowerCase());
 }
 function isGitHubPullCreateRestRequest(method, upstreamUrl) {
-  return method === "POST" && isGitHubApiUrl(upstreamUrl) && /^\/repos\/[^/]+\/[^/]+\/pulls$/.test(upstreamUrl.pathname.toLowerCase());
+  return method === "POST" && isGitHubApiUrl2(upstreamUrl) && /^\/repos\/[^/]+\/[^/]+\/pulls$/.test(upstreamUrl.pathname.toLowerCase());
 }
 function isGitHubIssueCreateGraphqlMutation(method, upstreamUrl, bodyText) {
   if (method !== "POST" || !isGitHubGraphqlUrl(upstreamUrl)) {

package/dist/outcomes/cost.d.ts

@@ -21,14 +21,20 @@ declare const costWindowSchema: z.ZodPipe<z.ZodObject<{
 }>>;
 declare const repositoryCostSchema: z.ZodPipe<z.ZodObject<{
     issueCostUsd: z.ZodNullable<z.ZodNumber>;
+    medianIssueCostUsd: z.ZodNullable<z.ZodNumber>;
+    medianPullRequestCostUsd: z.ZodNullable<z.ZodNumber>;
     pullRequestCostUsd: z.ZodNullable<z.ZodNumber>;
     repository: z.ZodString;
 }, z.core.$strict>, z.ZodTransform<{
     issueCostUsd: number | undefined;
+    medianIssueCostUsd: number | undefined;
+    medianPullRequestCostUsd: number | undefined;
     pullRequestCostUsd: number | undefined;
     repository: string;
 }, {
     issueCostUsd: number | null;
+    medianIssueCostUsd: number | null;
+    medianPullRequestCostUsd: number | null;
     pullRequestCostUsd: number | null;
     repository: string;
 }>>;

package/dist/plugin.d.ts

@@ -0,0 +1,44 @@
+/**
+ * GitHub plugin runtime boundary.
+ *
+ * This module composes GitHub hooks and owns GitHub egress policy.
+ */
+import { type PluginRegistration } from "@sentry/junior-plugin-api";
+import { type GitHubAppPermissions } from "./permissions.js";
+/** Configure the built-in GitHub plugin manifest and hooks. */
+export interface GitHubPluginOptions {
+    /**
+     * Extra OAuth `scope` values to request during GitHub App user authorization.
+     *
+     * GitHub App user tokens report empty scopes, so Junior treats this as a
+     * local reauthorization contract only. Effective access still comes from the
+     * app permissions, installation repositories, and requesting user's access.
+     */
+    additionalUserScopes?: string[];
+    /**
+     * GitHub App permissions Junior should expose as capabilities and downscope
+     * to read for installation-read tokens.
+     *
+     * Keys may use GitHub permission names with underscores or hyphens. Junior
+     * records these as plugin capabilities. Installation-write tokens inherit
+     * the App installation's complete permission envelope.
+     * GitHub remains the source of truth for whether a permission exists.
+     */
+    appPermissions?: GitHubAppPermissions;
+    /** Environment variable containing the GitHub App id. */
+    appIdEnv?: string;
+    /** Environment variable containing Junior's Git committer email. */
+    botEmailEnv?: string;
+    /** Environment variable containing Junior's Git committer name. */
+    botNameEnv?: string;
+    /** Environment variable containing the GitHub App OAuth client id. */
+    clientIdEnv?: string;
+    /** Environment variable containing the GitHub App OAuth client secret. */
+    clientSecretEnv?: string;
+    /** Environment variable containing the GitHub App installation id. */
+    installationIdEnv?: string;
+    /** Environment variable containing the GitHub App private key. */
+    privateKeyEnv?: string;
+}
+/** Register GitHub runtime hooks for repository workflows. */
+export declare function githubPlugin(options?: GitHubPluginOptions): PluginRegistration;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-github",
-  "version": "0.113.0",
+  "version": "0.115.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -31,7 +31,7 @@
     "@sinclair/typebox": "^0.34.49",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@sentry/junior-plugin-api": "0.113.0"
+    "@sentry/junior-plugin-api": "0.115.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",

package/skills/attach-github-assets/SOURCES.md

@@ -5,7 +5,8 @@
 - `intercom/2x-skills@59213af`, `plugins/pr-tools/skills/attach-github-assets/SKILL.md` — upstream runtime intent and supported use cases; primary source; high confidence; MIT.
 - `intercom/2x-skills@59213af`, `plugins/pr-tools/skills/attach-github-assets/scripts/upload.sh` — upstream endpoint, MIME mapping, and response contract; primary implementation source; high confidence; MIT.
 - `intercom/2x-skills@59213af`, `plugins/pr-tools/LICENSE` — upstream copyright and license notice; authoritative legal source; high confidence.
-- `packages/junior-github/src/index.ts` — local GitHub credential and egress boundary; authoritative local source; high confidence.
+- `packages/junior-github/src/credential-support.ts` — local GitHub credential boundary; authoritative local source; high confidence.
+- `packages/junior-github/src/plugin.ts` — local GitHub egress boundary; authoritative local source; high confidence.
 - `packages/junior-github/skills/github-code/SKILL.md` — local repository targeting and credential guidance; authoritative local convention; high confidence.
 - GitHub REST API documentation — no documented user-attachment upload operation found; official source; medium confidence for absence.