@sentry/junior-github 0.181.0 → 0.182.0

package/dist/index.js

@@ -1,728 +1,54 @@
 import {
+  CREATE_TOOL_ROUTING_GUIDANCE,
+  GITHUB_APP_ID_ENV,
+  GITHUB_APP_PRIVATE_KEY_ENV,
+  GITHUB_AUTH_TOKEN_ENV,
+  GITHUB_AUTH_TOKEN_PLACEHOLDER,
   GITHUB_DEPLOYMENT_EVENTS,
   GITHUB_DEPLOYMENT_SUGGESTED_EVENTS,
+  GITHUB_GRAPHQL_RESPONSE_BODY_LIMIT_BYTES,
+  GITHUB_INSTALLATION_ID_ENV,
   GITHUB_ISSUE_EVENTS,
   GITHUB_ISSUE_SUGGESTED_EVENTS,
   GITHUB_PULL_REQUEST_EVENTS,
+  GITHUB_PULL_REQUEST_MATCH_FIELDS,
   GITHUB_PULL_REQUEST_SUGGESTED_EVENTS,
   GITHUB_RELEASE_EVENTS,
   GITHUB_RELEASE_SUGGESTED_EVENTS,
+  GitHubPluginSetupError,
+  HTTP_READ_METHODS,
+  USER_TOKEN_GRANTS,
+  USER_WRITE_REQUIREMENTS,
+  createPermissionCache,
+  credentialUnavailable,
   gitHubDeploymentSourceSubscribable,
   gitHubIssueSubscribable,
   gitHubPullRequestSubscribable,
   gitHubReleaseSourceSubscribable,
   gitHubRepositorySubscribable,
+  githubRepositoryFromLeaseScope,
+  githubRepositoryFromUrl,
+  githubRepositoryLeaseScope,
+  githubRequest,
+  isRecord,
+  issueInstallationCredential,
+  issueInstallationToken,
+  issueUserCredential,
+  loadCheckSuiteFacts,
   normalizeGitHubResourceEvents,
-  parseCheckSuiteEnrichmentTarget,
-  selectFailingChecks
-} from "./chunk-GXZVNEIB.js";
+  normalizePermissions,
+  normalizeScopeList,
+  readEnv,
+  readGrantPermissions,
+  requireEnv,
+  resolveUserAccount
+} from "./chunk-JROTRF27.js";
 
 // src/plugin.ts
 import {
-  defineJuniorPlugin,
-  EgressPolicyDenied as EgressPolicyDenied2,
-  enforceEgressPolicy
+  defineJuniorPlugin
 } from "@sentry/junior-plugin-api";
 
-// src/permissions.ts
-var LEVELS = /* @__PURE__ */ new Set(["read", "write", "admin"]);
-var WRITE_ONLY_PERMISSIONS = /* @__PURE__ */ new Set(["profile", "workflows"]);
-function isLevel(value) {
-  return LEVELS.has(value);
-}
-function normalizeScope(rawScope) {
-  return String(rawScope).trim().replace(/-/g, "_");
-}
-function normalizePermissions(permissions) {
-  if (permissions === void 0) {
-    return void 0;
-  }
-  const entries = Object.entries(permissions);
-  if (entries.length === 0) {
-    throw new Error(
-      "githubPlugin appPermissions must contain at least one permission when provided."
-    );
-  }
-  const request = {};
-  for (const [rawScope, rawLevel] of entries) {
-    const normalizedScope = normalizeScope(rawScope);
-    if (!normalizedScope) {
-      throw new Error(
-        "githubPlugin appPermissions contains an empty permission name."
-      );
-    }
-    if (!/^[a-z][a-z0-9_]*$/.test(normalizedScope)) {
-      throw new Error(
-        `githubPlugin appPermissions contains invalid permission "${rawScope}".`
-      );
-    }
-    if (!isLevel(rawLevel)) {
-      throw new Error(
-        `githubPlugin appPermissions.${rawScope} must be "read", "write", or "admin".`
-      );
-    }
-    request[normalizedScope] = rawLevel;
-  }
-  return request;
-}
-function readGrantPermissions(permissions) {
-  const readOnly = { metadata: "read" };
-  for (const [scope, level] of Object.entries(permissions ?? {})) {
-    if (!isLevel(level)) {
-      throw new Error(
-        `GitHub permission "${scope}" returned invalid level "${String(level)}".`
-      );
-    }
-    if (!WRITE_ONLY_PERMISSIONS.has(scope)) {
-      readOnly[scope] = "read";
-    }
-  }
-  return readOnly;
-}
-
-// src/pull-request-review-policy.ts
-import { EgressPolicyDenied } from "@sentry/junior-plugin-api";
-
-// src/credential-support.ts
-import { createPrivateKey, createSign } from "crypto";
-var GITHUB_APP_ID_ENV = "GITHUB_APP_ID";
-var GITHUB_APP_PRIVATE_KEY_ENV = "GITHUB_APP_PRIVATE_KEY";
-var GITHUB_INSTALLATION_ID_ENV = "GITHUB_INSTALLATION_ID";
-var GITHUB_AUTH_TOKEN_ENV = "GITHUB_TOKEN";
-var GITHUB_AUTH_TOKEN_PLACEHOLDER = "ghp_host_managed_credential";
-var MAX_LEASE_MS = 60 * 60 * 1e3;
-var REFRESH_BUFFER_MS = 5 * 60 * 1e3;
-var USER_REFRESH_TIMEOUT_MS = 2e4;
-var GITHUB_GRAPHQL_RESPONSE_BODY_LIMIT_BYTES = 64 * 1024;
-var HTTP_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
-var USER_TOKEN_GRANTS = /* @__PURE__ */ new Set(["user-read", "user-write"]);
-var CREATE_TOOL_ROUTING_GUIDANCE = "This is a Junior tool-routing denial, not a GitHub permission failure. Do not ask the user for GitHub permissions; retry with the required Junior tool.";
-var USER_WRITE_REQUIREMENTS = [
-  "requesting GitHub user permission to perform this operation"
-];
-var GITHUB_CREDENTIAL_DOMAINS = ["api.github.com", "github.com"];
-var GITHUB_ASSET_UPLOAD_CREDENTIAL_DOMAINS = [
-  ...GITHUB_CREDENTIAL_DOMAINS,
-  "uploads.github.com"
-];
-var GitHubUserRefreshRejectedError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "GitHubUserRefreshRejectedError";
-  }
-};
-var GitHubRequestError = class extends Error {
-  status;
-  constructor(message, status) {
-    super(message);
-    this.name = "GitHubRequestError";
-    this.status = status;
-  }
-};
-var GitHubPluginSetupError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "GitHubPluginSetupError";
-  }
-};
-function isRecord(value) {
-  return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-function readEnv(name) {
-  const value = process.env[name];
-  if (typeof value !== "string") {
-    return void 0;
-  }
-  const trimmed = value.trim();
-  return trimmed ? trimmed : void 0;
-}
-function requireEnv(name) {
-  const value = readEnv(name);
-  if (!value) {
-    throw new GitHubPluginSetupError(`Missing ${name}`);
-  }
-  return value;
-}
-function normalizeScopeList(scopes) {
-  return [
-    ...new Set(
-      (scopes ?? []).flatMap((scope) => String(scope).split(/\s+/)).map((scope) => scope.trim()).filter(Boolean)
-    )
-  ].sort();
-}
-function normalizeOAuthScope(scope) {
-  const normalized = normalizeScopeList(scope ? [scope] : []);
-  return normalized.length ? normalized.join(" ") : void 0;
-}
-function hasRequiredOAuthScope(storedScope, requiredScope) {
-  const required = normalizeScopeList(requiredScope ? [requiredScope] : []);
-  if (required.length === 0) {
-    return true;
-  }
-  const stored = new Set(normalizeScopeList(storedScope ? [storedScope] : []));
-  if (stored.size === 0) {
-    return false;
-  }
-  return required.every((scope) => stored.has(scope));
-}
-function isGitHubApiUrl(upstreamUrl) {
-  return upstreamUrl.hostname.toLowerCase() === "api.github.com";
-}
-function base64Url(input) {
-  return Buffer.from(input).toString("base64").replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
-}
-function getPrivateKey(envName) {
-  const raw = requireEnv(envName);
-  let key;
-  try {
-    key = createPrivateKey({ key: raw, format: "pem" });
-  } catch {
-    throw new GitHubPluginSetupError(
-      `Invalid ${envName}: expected a PEM-encoded RSA private key`
-    );
-  }
-  if (key.asymmetricKeyType !== "rsa") {
-    throw new GitHubPluginSetupError(
-      `Invalid ${envName}: GitHub App signing requires an RSA private key`
-    );
-  }
-  return key;
-}
-function createAppJwt(appId, privateKeyEnv) {
-  const now = Math.floor(Date.now() / 1e3);
-  const header = { alg: "RS256", typ: "JWT" };
-  const payload = { iat: now - 60, exp: now + 9 * 60, iss: appId };
-  const encodedHeader = base64Url(JSON.stringify(header));
-  const encodedPayload = base64Url(JSON.stringify(payload));
-  const signingInput = `${encodedHeader}.${encodedPayload}`;
-  const signer = createSign("RSA-SHA256");
-  signer.update(signingInput);
-  signer.end();
-  const signature = signer.sign(getPrivateKey(privateKeyEnv)).toString("base64").replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
-  return `${signingInput}.${signature}`;
-}
-async function githubRequest(apiBase, path, params) {
-  const response = await fetch(`${apiBase}${path}`, {
-    method: params.method ?? "GET",
-    headers: {
-      Accept: "application/vnd.github+json",
-      Authorization: `Bearer ${params.token}`,
-      "X-GitHub-Api-Version": "2022-11-28",
-      ...params.body ? { "Content-Type": "application/json" } : void 0
-    },
-    ...params.body ? { body: JSON.stringify(params.body) } : void 0
-  });
-  const text2 = await response.text();
-  let parsed;
-  if (text2) {
-    try {
-      parsed = JSON.parse(text2);
-    } catch {
-      parsed = void 0;
-    }
-  }
-  if (!response.ok) {
-    const message = isRecord(parsed) && typeof parsed.message === "string" ? parsed.message : `GitHub API error ${response.status}`;
-    throw new GitHubRequestError(message, response.status);
-  }
-  return parsed;
-}
-function buildOAuthTokenRequest(input) {
-  const payload = {
-    ...input.payload,
-    client_id: input.clientId,
-    client_secret: input.clientSecret
-  };
-  return {
-    headers: {
-      Accept: "application/json",
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
-    body: new URLSearchParams(payload)
-  };
-}
-function parseOAuthResponseJson(responseText) {
-  if (!responseText.trim()) {
-    return void 0;
-  }
-  try {
-    return JSON.parse(responseText);
-  } catch {
-    return void 0;
-  }
-}
-function oauthErrorCode(data) {
-  return isRecord(data) && typeof data.error === "string" ? data.error : void 0;
-}
-function isRejectedRefreshError(errorCode) {
-  return errorCode === "bad_refresh_token" || errorCode === "invalid_grant";
-}
-function parseOAuthTokenResponse(data, requestedScope) {
-  if (!isRecord(data)) {
-    throw new Error("OAuth token response is invalid");
-  }
-  if (typeof data.access_token !== "string" || !data.access_token.trim()) {
-    throw new Error("OAuth token response missing access_token");
-  }
-  if (typeof data.refresh_token !== "string" || !data.refresh_token.trim()) {
-    throw new Error("OAuth token response missing refresh_token");
-  }
-  let scope = normalizeOAuthScope(requestedScope);
-  if (data.scope !== void 0) {
-    if (typeof data.scope !== "string") {
-      throw new Error("OAuth token response returned invalid scope");
-    }
-    scope = normalizeOAuthScope(data.scope) ?? scope;
-  }
-  const result = {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    ...scope ? { scope } : void 0
-  };
-  if (data.expires_in !== void 0) {
-    if (typeof data.expires_in !== "number" || !Number.isFinite(data.expires_in) || data.expires_in <= 0) {
-      throw new Error("OAuth token response returned invalid expires_in");
-    }
-    result.expiresAt = Date.now() + data.expires_in * 1e3;
-  }
-  if (data.refresh_token_expires_in !== void 0) {
-    if (typeof data.refresh_token_expires_in !== "number" || !Number.isFinite(data.refresh_token_expires_in) || data.refresh_token_expires_in <= 0) {
-      throw new Error(
-        "OAuth token response returned invalid refresh_token_expires_in"
-      );
-    }
-    result.refreshTokenExpiresAt = Date.now() + data.refresh_token_expires_in * 1e3;
-  }
-  return result;
-}
-async function refreshUserAccessToken(input) {
-  const clientId = requireEnv(input.clientIdEnv);
-  const clientSecret = requireEnv(input.clientSecretEnv);
-  const request = buildOAuthTokenRequest({
-    clientId,
-    clientSecret,
-    payload: {
-      grant_type: "refresh_token",
-      refresh_token: input.refreshToken
-    }
-  });
-  const response = await fetch("https://github.com/login/oauth/access_token", {
-    method: "POST",
-    headers: request.headers,
-    body: request.body,
-    signal: AbortSignal.timeout(USER_REFRESH_TIMEOUT_MS)
-  });
-  const responseText = await response.text();
-  const responseData = parseOAuthResponseJson(responseText);
-  const errorCode = oauthErrorCode(responseData);
-  if (isRejectedRefreshError(errorCode)) {
-    throw new GitHubUserRefreshRejectedError(
-      `GitHub user token refresh rejected: ${errorCode}`
-    );
-  }
-  if (!response.ok || errorCode) {
-    throw new Error(
-      `GitHub user token refresh failed: ${response.status}${errorCode ? ` ${errorCode}` : ""}`
-    );
-  }
-  try {
-    return parseOAuthTokenResponse(responseData, input.requestedScope);
-  } catch (error) {
-    if (error instanceof Error && error.message === "OAuth token response missing access_token") {
-      throw new GitHubUserRefreshRejectedError(error.message);
-    }
-    throw error;
-  }
-}
-function leaseExpiry(expiresAt) {
-  return expiresAt ? Math.min(expiresAt, Date.now() + MAX_LEASE_MS) : Date.now() + MAX_LEASE_MS;
-}
-function isGitSmartHttpDomain(domain) {
-  return domain.toLowerCase() === "github.com";
-}
-function authorizationFor(domain, token) {
-  if (isGitSmartHttpDomain(domain)) {
-    return `Basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}`;
-  }
-  return `Bearer ${token}`;
-}
-function createCredentialLease(input) {
-  return {
-    type: "lease",
-    lease: {
-      ...input.account ? { account: input.account } : void 0,
-      ...input.authorization ? { authorization: input.authorization } : void 0,
-      expiresAt: new Date(input.expiresAtMs).toISOString(),
-      headerTransforms: (input.domains ?? (input.authorization ? GITHUB_ASSET_UPLOAD_CREDENTIAL_DOMAINS : GITHUB_CREDENTIAL_DOMAINS)).map((domain) => ({
-        domain,
-        headers: {
-          Authorization: authorizationFor(domain, input.token)
-        }
-      }))
-    }
-  };
-}
-function githubUserAuthorization(scope) {
-  return {
-    type: "oauth",
-    provider: "github",
-    ...scope ? { scope } : void 0
-  };
-}
-function credentialNeeded(message, scope, allowAuthorization = true) {
-  return {
-    type: "needed",
-    message,
-    ...allowAuthorization ? { authorization: githubUserAuthorization(scope) } : void 0
-  };
-}
-function credentialUnavailable(message) {
-  return {
-    type: "unavailable",
-    message
-  };
-}
-function parseInstallationTokenResponse(data) {
-  if (!isRecord(data)) {
-    throw new Error("GitHub installation token response is invalid");
-  }
-  const token = data.token;
-  if (typeof token !== "string" || !token.trim()) {
-    throw new Error("GitHub installation token response missing token");
-  }
-  const expiresAt = data.expires_at;
-  const expiresAtMs = typeof expiresAt === "string" ? Date.parse(expiresAt) : Number.NaN;
-  if (!Number.isFinite(expiresAtMs) || expiresAtMs <= Date.now()) {
-    throw new Error(
-      "GitHub installation token response returned invalid expires_at"
-    );
-  }
-  return { token, expiresAtMs };
-}
-function readInstallationPermissions(installation) {
-  if (!isRecord(installation) || !isRecord(installation.permissions)) {
-    throw new Error("GitHub installation response missing permissions");
-  }
-  return readGrantPermissions(installation.permissions);
-}
-function decodeGitHubPathSegment(value) {
-  try {
-    const decoded = decodeURIComponent(value).trim();
-    return decoded && !decoded.includes("/") ? decoded : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function githubRepositoryFromUrl(upstreamUrl) {
-  const segments = upstreamUrl.pathname.split("/").filter(Boolean);
-  if (isGitHubApiUrl(upstreamUrl) && segments[0]?.toLowerCase() === "repos") {
-    const owner2 = segments[1] ? decodeGitHubPathSegment(segments[1]) : void 0;
-    const name2 = segments[2] ? decodeGitHubPathSegment(segments[2]) : void 0;
-    return owner2 && name2 ? { owner: owner2, name: name2 } : void 0;
-  }
-  if (upstreamUrl.hostname.toLowerCase() !== "github.com") {
-    return void 0;
-  }
-  const owner = segments[0] ? decodeGitHubPathSegment(segments[0]) : void 0;
-  const rawName = segments[1]?.replace(/\.git$/i, "");
-  const name = rawName ? decodeGitHubPathSegment(rawName) : void 0;
-  return owner && name ? { owner, name } : void 0;
-}
-function githubRepositoryLeaseScope(repository) {
-  return `repository:${repository.owner.toLowerCase()}/${repository.name.toLowerCase()}`;
-}
-function githubRepositoryFromLeaseScope(leaseScope) {
-  const match = /^repository:([^/]+)\/([^/]+)$/.exec(leaseScope ?? "");
-  if (!match?.[1] || !match[2]) {
-    throw new GitHubPluginSetupError(
-      "GitHub installation write grant is missing a repository lease scope."
-    );
-  }
-  return { owner: match[1], name: match[2] };
-}
-async function resolveUserAccount(tokens) {
-  const account = await githubRequest("https://api.github.com", "/user", {
-    token: tokens.accessToken
-  });
-  if (!isRecord(account)) {
-    throw new Error("GitHub user response is invalid");
-  }
-  const id = account.id;
-  const login = account.login;
-  if (typeof id !== "number" && typeof id !== "string" || typeof login !== "string" || !login.trim()) {
-    throw new Error("GitHub user response missing id or login");
-  }
-  const url = typeof account.html_url === "string" ? account.html_url : void 0;
-  return {
-    handle: login.trim(),
-    id: String(id),
-    label: login.trim(),
-    ...url ? { url } : void 0
-  };
-}
-async function tokensWithAccount(tokenSlot, stored, scope) {
-  if (stored.account) {
-    return { ok: true, tokens: stored };
-  }
-  let account;
-  try {
-    account = await resolveUserAccount(stored);
-  } catch (error) {
-    if (error instanceof GitHubRequestError && (error.status === 401 || error.status === 403)) {
-      return {
-        ok: false,
-        result: credentialNeeded(
-          "Your GitHub authorization needs to be refreshed.",
-          scope
-        )
-      };
-    }
-    throw error;
-  }
-  const updated = { ...stored, account };
-  await tokenSlot.set(updated);
-  return { ok: true, tokens: updated };
-}
-function shouldRefreshUserToken(stored, now = Date.now()) {
-  return stored.expiresAt !== void 0 && stored.expiresAt - now < REFRESH_BUFFER_MS;
-}
-function canUseStoredUserToken(stored) {
-  return stored.expiresAt === void 0 || stored.expiresAt > Date.now() && !shouldRefreshUserToken(stored);
-}
-async function refreshUserTokensWithLock(tokenSlot, scope, options) {
-  return await tokenSlot.withRefresh(async () => {
-    const latest = await tokenSlot.get();
-    if (!latest) {
-      return {
-        ok: false,
-        result: credentialNeeded("Connect your GitHub account.", scope)
-      };
-    }
-    if (!hasRequiredOAuthScope(latest.scope, scope)) {
-      return {
-        ok: false,
-        result: credentialNeeded(
-          "Your GitHub authorization needs to be refreshed.",
-          scope
-        )
-      };
-    }
-    if (canUseStoredUserToken(latest)) {
-      return { ok: true, tokens: latest };
-    }
-    let refreshed;
-    try {
-      refreshed = await refreshUserAccessToken({
-        clientIdEnv: options.clientIdEnv,
-        clientSecretEnv: options.clientSecretEnv,
-        refreshToken: latest.refreshToken,
-        requestedScope: latest.scope ?? scope
-      });
-    } catch (error) {
-      if (!(error instanceof GitHubUserRefreshRejectedError)) {
-        throw error;
-      }
-      return {
-        ok: false,
-        result: credentialNeeded(
-          "Your GitHub authorization has expired.",
-          scope
-        )
-      };
-    }
-    if (!hasRequiredOAuthScope(refreshed.scope, scope)) {
-      return {
-        ok: false,
-        result: credentialNeeded(
-          "Your GitHub authorization needs to be refreshed.",
-          scope
-        )
-      };
-    }
-    const refreshedTokens = {
-      ...latest.refreshTokenExpiresAt ? { refreshTokenExpiresAt: latest.refreshTokenExpiresAt } : void 0,
-      ...refreshed,
-      ...latest.account ? { account: latest.account } : void 0
-    };
-    await tokenSlot.set(refreshedTokens);
-    return { ok: true, tokens: refreshedTokens };
-  });
-}
-async function issueUserCredential(ctx, options) {
-  const scope = options.userScope;
-  const tokenSlot = ctx.tokens.currentUser ?? ctx.tokens.credentialSubject;
-  if (!tokenSlot) {
-    return credentialNeeded(
-      "GitHub write access requires a current user or delegated user credential subject.",
-      scope,
-      false
-    );
-  }
-  const stored = await tokenSlot.get();
-  if (!stored) {
-    return credentialNeeded(
-      "GitHub write access requires user authorization.",
-      scope
-    );
-  }
-  if (!hasRequiredOAuthScope(stored.scope, scope)) {
-    return credentialNeeded(
-      "Your GitHub authorization needs to be refreshed.",
-      scope
-    );
-  }
-  const now = Date.now();
-  if (stored.expiresAt !== void 0 && stored.expiresAt - now < REFRESH_BUFFER_MS) {
-    const refreshResult = await refreshUserTokensWithLock(
-      tokenSlot,
-      scope,
-      options
-    );
-    if (!refreshResult.ok) {
-      return refreshResult.result;
-    }
-    const withAccount = await tokensWithAccount(
-      tokenSlot,
-      refreshResult.tokens,
-      scope
-    );
-    if (!withAccount.ok) {
-      return withAccount.result;
-    }
-    return createCredentialLease({
-      account: withAccount.tokens.account,
-      token: withAccount.tokens.accessToken,
-      expiresAtMs: leaseExpiry(withAccount.tokens.expiresAt),
-      authorization: githubUserAuthorization(scope)
-    });
-  }
-  if (stored.expiresAt === void 0 || stored.expiresAt > Date.now()) {
-    const withAccount = await tokensWithAccount(tokenSlot, stored, scope);
-    if (!withAccount.ok) {
-      return withAccount.result;
-    }
-    return createCredentialLease({
-      account: withAccount.tokens.account,
-      token: withAccount.tokens.accessToken,
-      expiresAtMs: leaseExpiry(withAccount.tokens.expiresAt),
-      authorization: githubUserAuthorization(scope)
-    });
-  }
-  return credentialNeeded("Your GitHub authorization has expired.", scope);
-}
-async function issueInstallationToken(options) {
-  const appId = requireEnv(options.appIdEnv);
-  const installationIdRaw = requireEnv(options.installationIdEnv);
-  const installationId = Number(installationIdRaw);
-  if (!Number.isSafeInteger(installationId) || installationId <= 0) {
-    throw new GitHubPluginSetupError(`Invalid ${options.installationIdEnv}`);
-  }
-  const appJwt = createAppJwt(appId, options.privateKeyEnv);
-  const permissions = "permissions" in options ? options.permissions : typeof options.loadPermissions === "function" ? await options.loadPermissions({ appJwt, installationId }) : void 0;
-  const body = {
-    ...permissions ? { permissions } : void 0,
-    ..."repositories" in options ? { repositories: options.repositories } : void 0
-  };
-  const accessTokenResponse = await githubRequest(
-    "https://api.github.com",
-    `/app/installations/${installationId}/access_tokens`,
-    {
-      method: "POST",
-      token: appJwt,
-      body
-    }
-  );
-  const parsedToken = parseInstallationTokenResponse(accessTokenResponse);
-  return {
-    expiresAtMs: Math.min(parsedToken.expiresAtMs, Date.now() + MAX_LEASE_MS),
-    token: parsedToken.token
-  };
-}
-async function issueInstallationCredential(options) {
-  const token = await issueInstallationToken(options);
-  return createCredentialLease({
-    token: token.token,
-    expiresAtMs: token.expiresAtMs
-  });
-}
-function createPermissionCache() {
-  let cached;
-  let pending;
-  return async ({ appJwt, installationId }) => {
-    if (cached && cached.expiresAtMs > Date.now()) {
-      return cached.permissions;
-    }
-    pending ??= githubRequest(
-      "https://api.github.com",
-      `/app/installations/${installationId}`,
-      { token: appJwt }
-    ).then((installation) => {
-      const permissions = readInstallationPermissions(installation);
-      cached = {
-        expiresAtMs: Date.now() + MAX_LEASE_MS,
-        permissions
-      };
-      return permissions;
-    }).finally(() => {
-      pending = void 0;
-    });
-    return await pending;
-  };
-}
-
-// src/pull-request-review-policy.ts
-function assertGitHubPullRequestApprovalDenied(input) {
-  if (input.method !== "POST" || input.upstreamUrl.hostname.toLowerCase() !== "api.github.com") {
-    return;
-  }
-  const match = input.upstreamUrl.pathname.toLowerCase().match(
-    /^\/repos\/[^/]+\/[^/]+\/pulls\/[^/]+\/reviews(?:\/[^/]+\/(events))?$/
-  );
-  if (!match) return;
-  const isEventsPath = match[1] === "events";
-  const bodyText = input.bodyText?.trim() ?? "";
-  if (!bodyText) {
-    if (isEventsPath) {
-      throw new EgressPolicyDenied(
-        "GitHub pull request review submissions must include a parseable non-APPROVE event so Junior can enforce the no-approve policy."
-      );
-    }
-    return;
-  }
-  let body;
-  try {
-    body = JSON.parse(bodyText);
-  } catch {
-    throw new EgressPolicyDenied(
-      "GitHub pull request review requests must use JSON bodies so Junior can enforce the no-approve policy."
-    );
-  }
-  if (!isRecord(body)) {
-    throw new EgressPolicyDenied(
-      "GitHub pull request review requests must use JSON object bodies so Junior can enforce the no-approve policy."
-    );
-  }
-  let event;
-  if ("event" in body) {
-    if (typeof body.event !== "string" || body.event.trim().length === 0) {
-      throw new EgressPolicyDenied(
-        "GitHub pull request review submissions must include a parseable non-APPROVE event so Junior can enforce the no-approve policy."
-      );
-    }
-    event = body.event.trim().toUpperCase();
-  }
-  if (event === "APPROVE") {
-    throw new EgressPolicyDenied(
-      "Junior cannot approve GitHub pull requests. Request changes, leave a comment review, or dismiss Junior's own review instead."
-    );
-  }
-  if (isEventsPath && event === void 0) {
-    throw new EgressPolicyDenied(
-      "GitHub pull request review submissions must include a parseable non-APPROVE event so Junior can enforce the no-approve policy."
-    );
-  }
-}
-
 // src/tools/clone-repository.ts
 import {
   definePluginTool,
@@ -3683,12 +3009,18 @@ function createGitHubWebhookRoute(args) {
         args.db,
         pullRequestLinkedIssues
       ) : false;
-      const failingChecks = eventName === "check_suite" && args.loadFailingChecks ? await args.loadFailingChecks(body) : void 0;
+      const checkSuiteFacts = eventName === "check_suite" ? await loadCheckSuiteFacts({
+        appIdEnv: args.appIdEnv,
+        body,
+        installationIdEnv: args.installationIdEnv,
+        log: args.log,
+        privateKeyEnv: args.privateKeyEnv
+      }) : void 0;
       const resourceEvents = normalizeGitHubResourceEvents({
         body,
+        ...checkSuiteFacts ? { checkSuiteFacts } : void 0,
         deliveryId,
-        eventName,
-        failingChecks
+        eventName
       });
       for (const event of resourceEvents) {
         await args.resourceEvents.publish(event);
@@ -4852,44 +4184,6 @@ function githubSidebarAnnotations(annotations) {
   }).sort((left, right) => right.updatedAt.localeCompare(left.updatedAt)).map(({ annotation }) => annotation);
 }
 
-// src/webhooks/check-suite-enrichment.ts
-function checkRunsFromResponse(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return [];
-  }
-  const checkRuns = value.check_runs;
-  return Array.isArray(checkRuns) ? checkRuns : [];
-}
-async function loadFailingChecksForSuite(args) {
-  const target = parseCheckSuiteEnrichmentTarget(args.body);
-  if (!target) return void 0;
-  try {
-    const token = await issueInstallationToken({
-      appIdEnv: args.appIdEnv,
-      installationIdEnv: args.installationIdEnv,
-      permissions: { checks: "read" },
-      privateKeyEnv: args.privateKeyEnv,
-      repositories: [target.repoName]
-    });
-    const response = await githubRequest(
-      "https://api.github.com",
-      `/repos/${encodeURIComponent(target.owner)}/${encodeURIComponent(target.repoName)}/check-suites/${target.checkSuiteId}/check-runs?filter=latest&per_page=100`,
-      { token: token.token }
-    );
-    const failing = selectFailingChecks(checkRunsFromResponse(response), {
-      checkSuiteId: target.checkSuiteId
-    });
-    return failing.length > 0 ? failing : void 0;
-  } catch (error) {
-    args.log?.error("GitHub check suite enrichment failed", {
-      checkSuiteId: target.checkSuiteId,
-      errorType: error instanceof Error ? error.name : "UnknownError",
-      repository: `${target.owner}/${target.repoName}`
-    });
-    return void 0;
-  }
-}
-
 // src/git-config.ts
 function cleanIdentityPart(value) {
   return String(value ?? "").replaceAll("\n", " ").replaceAll("\r", " ").replace(/[<>]/g, "").trim();
@@ -5438,7 +4732,67 @@ async function prepareWorkspace(ctx) {
   }
 }
 
-// src/plugin.ts
+// src/egress-policy.ts
+import {
+  EgressPolicyDenied as EgressPolicyDenied2,
+  enforceEgressPolicy
+} from "@sentry/junior-plugin-api";
+
+// src/pull-request-review-policy.ts
+import { EgressPolicyDenied } from "@sentry/junior-plugin-api";
+function assertGitHubPullRequestApprovalDenied(input) {
+  if (input.method !== "POST" || input.upstreamUrl.hostname.toLowerCase() !== "api.github.com") {
+    return;
+  }
+  const match = input.upstreamUrl.pathname.toLowerCase().match(
+    /^\/repos\/[^/]+\/[^/]+\/pulls\/[^/]+\/reviews(?:\/[^/]+\/(events))?$/
+  );
+  if (!match) return;
+  const isEventsPath = match[1] === "events";
+  const bodyText = input.bodyText?.trim() ?? "";
+  if (!bodyText) {
+    if (isEventsPath) {
+      throw new EgressPolicyDenied(
+        "GitHub pull request review submissions must include a parseable non-APPROVE event so Junior can enforce the no-approve policy."
+      );
+    }
+    return;
+  }
+  let body;
+  try {
+    body = JSON.parse(bodyText);
+  } catch {
+    throw new EgressPolicyDenied(
+      "GitHub pull request review requests must use JSON bodies so Junior can enforce the no-approve policy."
+    );
+  }
+  if (!isRecord(body)) {
+    throw new EgressPolicyDenied(
+      "GitHub pull request review requests must use JSON object bodies so Junior can enforce the no-approve policy."
+    );
+  }
+  let event;
+  if ("event" in body) {
+    if (typeof body.event !== "string" || body.event.trim().length === 0) {
+      throw new EgressPolicyDenied(
+        "GitHub pull request review submissions must include a parseable non-APPROVE event so Junior can enforce the no-approve policy."
+      );
+    }
+    event = body.event.trim().toUpperCase();
+  }
+  if (event === "APPROVE") {
+    throw new EgressPolicyDenied(
+      "Junior cannot approve GitHub pull requests. Request changes, leave a comment review, or dismiss Junior's own review instead."
+    );
+  }
+  if (isEventsPath && event === void 0) {
+    throw new EgressPolicyDenied(
+      "GitHub pull request review submissions must include a parseable non-APPROVE event so Junior can enforce the no-approve policy."
+    );
+  }
+}
+
+// src/egress-policy.ts
 function githubSmartHttpAccess(upstreamUrl) {
   const pathname = upstreamUrl.pathname.toLowerCase();
   const service = upstreamUrl.searchParams.get("service")?.toLowerCase();
@@ -5457,14 +4811,14 @@ function githubSmartHttpAccess(upstreamUrl) {
 function isGitHubGraphqlUrl(upstreamUrl) {
   return upstreamUrl.hostname.toLowerCase() === "api.github.com" && upstreamUrl.pathname.toLowerCase().endsWith("/graphql");
 }
-function isGitHubApiUrl2(upstreamUrl) {
+function isGitHubApiUrl(upstreamUrl) {
   return upstreamUrl.hostname.toLowerCase() === "api.github.com";
 }
 function isGitHubAssetUploadRequest(method, upstreamUrl) {
   return method === "POST" && upstreamUrl.hostname.toLowerCase() === "uploads.github.com" && upstreamUrl.pathname === "/user-attachments/assets";
 }
 function githubUserReadReason(method, upstreamUrl) {
-  if (method !== "GET" || !isGitHubApiUrl2(upstreamUrl)) {
+  if (method !== "GET" || !isGitHubApiUrl(upstreamUrl)) {
     return void 0;
   }
   return upstreamUrl.pathname.toLowerCase() === "/user" ? "github.user-read" : void 0;
@@ -5622,7 +4976,7 @@ var GITHUB_BODY_WRITES = [
 ];
 function githubApiWriteGrantName(method, upstreamUrl) {
   const pathname = upstreamUrl.pathname.toLowerCase();
-  if (!isGitHubApiUrl2(upstreamUrl)) {
+  if (!isGitHubApiUrl(upstreamUrl)) {
     return void 0;
   }
   if (method === "POST" && /^\/repos\/[^/]+\/[^/]+\/actions\/workflows\/[^/]+\/dispatches$/.test(
@@ -5710,7 +5064,7 @@ function applyGitHubEgressPolicy(input) {
   });
   const pathname = input.upstreamUrl.pathname.toLowerCase();
   const write = GITHUB_BODY_WRITES.find(
-    (candidate) => candidate.method === input.method && isGitHubApiUrl2(input.upstreamUrl) && candidate.restPath.test(pathname) || isGitHubGraphqlMutation(
+    (candidate) => candidate.method === input.method && isGitHubApiUrl(input.upstreamUrl) && candidate.restPath.test(pathname) || isGitHubGraphqlMutation(
       input.method,
       input.upstreamUrl,
       input.bodyText,
@@ -5821,6 +5175,8 @@ async function githubGrantForEgress(ctx) {
   }
   return grantForAccess(access, "github.api-read", "installation-read");
 }
+
+// src/plugin.ts
 function githubPlugin(options = {}) {
   const botNameEnv = options.botNameEnv ?? "GITHUB_APP_BOT_NAME";
   const botEmailEnv = options.botEmailEnv ?? "GITHUB_APP_BOT_EMAIL";
@@ -5852,6 +5208,7 @@ function githubPlugin(options = {}) {
           type: "pull_request",
           supportedEvents: [...GITHUB_PULL_REQUEST_EVENTS],
           suggestedEvents: [...GITHUB_PULL_REQUEST_SUGGESTED_EVENTS],
+          matchFields: GITHUB_PULL_REQUEST_MATCH_FIELDS,
           ...options.pullRequestEvents?.guidance ? { guidance: options.pullRequestEvents.guidance } : void 0
         },
         {
@@ -5861,16 +5218,14 @@ function githubPlugin(options = {}) {
         },
         {
           type: "repository",
-          supportedEvents: [
-            ...GITHUB_ISSUE_EVENTS,
-            ...GITHUB_PULL_REQUEST_EVENTS
-          ],
+          supportedEvents: [...GITHUB_ISSUE_EVENTS, ...GITHUB_PULL_REQUEST_EVENTS],
           suggestedEvents: [
             "issue.opened",
             "pull_request.opened",
             ...GITHUB_ISSUE_SUGGESTED_EVENTS,
             ...GITHUB_PULL_REQUEST_SUGGESTED_EVENTS
-          ]
+          ],
+          matchFields: GITHUB_PULL_REQUEST_MATCH_FIELDS
         }
       ],
       isEnabled: () => Boolean(readEnv("GITHUB_WEBHOOK_SECRET")),
@@ -5959,6 +5314,7 @@ function githubPlugin(options = {}) {
         return [
           createGitHubWebhookRoute({
             annotations: ctx.annotations,
+            appIdEnv,
             botEmail: () => readEnv(botEmailEnv),
             classifyPullRequestCommits: async ({
               number,
@@ -5988,14 +5344,9 @@ function githubPlugin(options = {}) {
             },
             db: ctx.db,
             installationId: () => readEnv(installationIdEnv),
-            loadFailingChecks: async (body) => await loadFailingChecksForSuite({
-              appIdEnv,
-              body,
-              installationIdEnv,
-              log: ctx.log,
-              privateKeyEnv
-            }),
+            installationIdEnv,
             log: ctx.log,
+            privateKeyEnv,
             resourceEvents: ctx.resourceEvents,
             webhookSecret: () => readEnv("GITHUB_WEBHOOK_SECRET")
           })