@sentry/junior-github 0.181.1 → 0.182.0

package/dist/chunk-JROTRF27.js

@@ -0,0 +1,1731 @@
+// src/webhooks/resource-events.ts
+import { z as z2 } from "zod";
+
+// src/resource-events/deployment.ts
+var GITHUB_DEPLOYMENT_EVENTS = [
+  "deployment.created",
+  "deployment.queued",
+  "deployment.pending",
+  "deployment.in_progress",
+  "deployment.succeeded",
+  "deployment.failed",
+  "deployment.error"
+];
+var GITHUB_DEPLOYMENT_SUGGESTED_EVENTS = [
+  "deployment.succeeded",
+  "deployment.failed",
+  "deployment.error"
+];
+function gitHubDeploymentSourceResource(input) {
+  const commitSha = input.commitSha.toLowerCase();
+  const environment = input.environment?.trim();
+  const repo = input.repo.toLowerCase();
+  return {
+    label: `GitHub deployment for ${repo} at ${commitSha.slice(0, 12)}`,
+    namespace: "github",
+    identifier: environment ? `deployment-source:${repo}:${encodeURIComponent(environment.toLowerCase())}:${commitSha}` : `deployment-source:${repo}:${commitSha}`
+  };
+}
+function gitHubDeploymentSourceSubscribable(input) {
+  if (!process.env.GITHUB_WEBHOOK_SECRET?.trim()) return void 0;
+  return {
+    ...gitHubDeploymentSourceResource(input),
+    suggestedEvents: GITHUB_DEPLOYMENT_SUGGESTED_EVENTS,
+    supportedEvents: [...GITHUB_DEPLOYMENT_EVENTS],
+    type: "deployment_source"
+  };
+}
+
+// src/resource-events/issue.ts
+var GITHUB_ISSUE_EVENTS = [
+  "issue.comment.created",
+  "issue.opened",
+  "issue.closed",
+  "issue.reopened"
+];
+var GITHUB_ISSUE_SUGGESTED_EVENTS = [
+  "issue.comment.created",
+  "issue.closed",
+  "issue.reopened"
+];
+function gitHubIssueResource(input) {
+  return {
+    label: `GitHub issue ${input.repo}#${input.number}`,
+    namespace: "github",
+    identifier: `${input.repo.toLowerCase()}#${input.number}`
+  };
+}
+function gitHubIssueSubscribable(input) {
+  if (!process.env.GITHUB_WEBHOOK_SECRET?.trim()) return void 0;
+  return {
+    ...gitHubIssueResource(input),
+    suggestedEvents: GITHUB_ISSUE_SUGGESTED_EVENTS,
+    supportedEvents: GITHUB_ISSUE_EVENTS,
+    type: "issue"
+  };
+}
+
+// src/resource-events/pull-request.ts
+import {
+  resourceEventMatchFieldsSchema
+} from "@sentry/junior-plugin-api";
+var GITHUB_PULL_REQUEST_EVENTS = [
+  "pull_request.checks.failed",
+  "pull_request.checks.recovered",
+  "pull_request.comment.created",
+  "pull_request.opened",
+  "pull_request.ready_for_review",
+  "pull_request.review.approved",
+  "pull_request.review.changes_requested",
+  "pull_request.review.commented",
+  "pull_request.review_comment.created",
+  "pull_request.merged",
+  "pull_request.closed_unmerged"
+];
+var GITHUB_PULL_REQUEST_SUGGESTED_EVENTS = [
+  "pull_request.checks.failed",
+  "pull_request.comment.created",
+  "pull_request.ready_for_review",
+  "pull_request.review.changes_requested",
+  "pull_request.review.commented",
+  "pull_request.review_comment.created",
+  "pull_request.merged",
+  "pull_request.closed_unmerged"
+];
+var GITHUB_PULL_REQUEST_MATCH_FIELDS = resourceEventMatchFieldsSchema.parse({
+  authorEmail: {
+    kind: "string",
+    description: "pull request author email when GitHub sends it"
+  },
+  authorUsername: {
+    kind: "string",
+    description: "pull request author login"
+  },
+  isDraft: {
+    kind: "boolean",
+    description: "true when the pull request is a draft"
+  }
+});
+function gitHubPullRequestResource(input) {
+  return {
+    label: `GitHub PR ${input.repo}#${input.number}`,
+    namespace: "github",
+    identifier: `${input.repo.toLowerCase()}#${input.number}`
+  };
+}
+function gitHubPullRequestSubscribable(input) {
+  if (!process.env.GITHUB_WEBHOOK_SECRET?.trim()) return void 0;
+  const omitted = new Set(input.omitSuggestedEvents ?? []);
+  const suggestedEvents = GITHUB_PULL_REQUEST_SUGGESTED_EVENTS.filter(
+    (eventType) => !omitted.has(eventType)
+  );
+  return {
+    ...gitHubPullRequestResource(input),
+    ...suggestedEvents.length > 0 ? { suggestedEvents: [...suggestedEvents] } : void 0,
+    supportedEvents: [...GITHUB_PULL_REQUEST_EVENTS],
+    type: "pull_request"
+  };
+}
+
+// src/resource-events/release.ts
+var GITHUB_RELEASE_EVENTS = ["release.published"];
+var GITHUB_RELEASE_SUGGESTED_EVENTS = ["release.published"];
+function gitHubReleaseSourceResource(input) {
+  const repo = input.repo.toLowerCase();
+  const tag = input.tag?.trim();
+  return {
+    label: `GitHub release for ${repo}`,
+    namespace: "github",
+    identifier: tag ? `release-source:${repo}:${encodeURIComponent(tag)}` : `release-source:${repo}`
+  };
+}
+function gitHubReleaseSourceSubscribable(input) {
+  if (!process.env.GITHUB_WEBHOOK_SECRET?.trim()) return void 0;
+  return {
+    ...gitHubReleaseSourceResource(input),
+    suggestedEvents: GITHUB_RELEASE_SUGGESTED_EVENTS,
+    supportedEvents: [...GITHUB_RELEASE_EVENTS],
+    type: "release_source"
+  };
+}
+
+// src/resource-events/repository.ts
+function gitHubRepositoryResource(input) {
+  return {
+    label: `GitHub repository ${input.repo}`,
+    namespace: "github",
+    identifier: input.repo.toLowerCase()
+  };
+}
+function gitHubRepositorySubscribable(input) {
+  if (!process.env.GITHUB_WEBHOOK_SECRET?.trim()) return void 0;
+  return {
+    ...gitHubRepositoryResource(input),
+    suggestedEvents: [
+      "issue.opened",
+      "pull_request.opened",
+      ...GITHUB_ISSUE_SUGGESTED_EVENTS,
+      ...GITHUB_PULL_REQUEST_SUGGESTED_EVENTS
+    ],
+    supportedEvents: [...GITHUB_ISSUE_EVENTS, ...GITHUB_PULL_REQUEST_EVENTS],
+    type: "repository"
+  };
+}
+
+// src/webhooks/check-suite.ts
+import { z } from "zod";
+
+// src/credential-support.ts
+import { createPrivateKey, createSign } from "crypto";
+
+// src/permissions.ts
+var LEVELS = /* @__PURE__ */ new Set(["read", "write", "admin"]);
+var WRITE_ONLY_PERMISSIONS = /* @__PURE__ */ new Set(["profile", "workflows"]);
+function isLevel(value) {
+  return LEVELS.has(value);
+}
+function normalizeScope(rawScope) {
+  return String(rawScope).trim().replace(/-/g, "_");
+}
+function normalizePermissions(permissions) {
+  if (permissions === void 0) {
+    return void 0;
+  }
+  const entries = Object.entries(permissions);
+  if (entries.length === 0) {
+    throw new Error(
+      "githubPlugin appPermissions must contain at least one permission when provided."
+    );
+  }
+  const request = {};
+  for (const [rawScope, rawLevel] of entries) {
+    const normalizedScope = normalizeScope(rawScope);
+    if (!normalizedScope) {
+      throw new Error(
+        "githubPlugin appPermissions contains an empty permission name."
+      );
+    }
+    if (!/^[a-z][a-z0-9_]*$/.test(normalizedScope)) {
+      throw new Error(
+        `githubPlugin appPermissions contains invalid permission "${rawScope}".`
+      );
+    }
+    if (!isLevel(rawLevel)) {
+      throw new Error(
+        `githubPlugin appPermissions.${rawScope} must be "read", "write", or "admin".`
+      );
+    }
+    request[normalizedScope] = rawLevel;
+  }
+  return request;
+}
+function readGrantPermissions(permissions) {
+  const readOnly = { metadata: "read" };
+  for (const [scope, level] of Object.entries(permissions ?? {})) {
+    if (!isLevel(level)) {
+      throw new Error(
+        `GitHub permission "${scope}" returned invalid level "${String(level)}".`
+      );
+    }
+    if (!WRITE_ONLY_PERMISSIONS.has(scope)) {
+      readOnly[scope] = "read";
+    }
+  }
+  return readOnly;
+}
+
+// src/credential-support.ts
+var GITHUB_APP_ID_ENV = "GITHUB_APP_ID";
+var GITHUB_APP_PRIVATE_KEY_ENV = "GITHUB_APP_PRIVATE_KEY";
+var GITHUB_INSTALLATION_ID_ENV = "GITHUB_INSTALLATION_ID";
+var GITHUB_AUTH_TOKEN_ENV = "GITHUB_TOKEN";
+var GITHUB_AUTH_TOKEN_PLACEHOLDER = "ghp_host_managed_credential";
+var MAX_LEASE_MS = 60 * 60 * 1e3;
+var REFRESH_BUFFER_MS = 5 * 60 * 1e3;
+var USER_REFRESH_TIMEOUT_MS = 2e4;
+var GITHUB_GRAPHQL_RESPONSE_BODY_LIMIT_BYTES = 64 * 1024;
+var HTTP_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+var USER_TOKEN_GRANTS = /* @__PURE__ */ new Set(["user-read", "user-write"]);
+var CREATE_TOOL_ROUTING_GUIDANCE = "This is a Junior tool-routing denial, not a GitHub permission failure. Do not ask the user for GitHub permissions; retry with the required Junior tool.";
+var USER_WRITE_REQUIREMENTS = [
+  "requesting GitHub user permission to perform this operation"
+];
+var GITHUB_CREDENTIAL_DOMAINS = ["api.github.com", "github.com"];
+var GITHUB_ASSET_UPLOAD_CREDENTIAL_DOMAINS = [
+  ...GITHUB_CREDENTIAL_DOMAINS,
+  "uploads.github.com"
+];
+var GitHubUserRefreshRejectedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GitHubUserRefreshRejectedError";
+  }
+};
+var GitHubRequestError = class extends Error {
+  status;
+  constructor(message, status) {
+    super(message);
+    this.name = "GitHubRequestError";
+    this.status = status;
+  }
+};
+var GitHubPluginSetupError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GitHubPluginSetupError";
+  }
+};
+function isRecord(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function readEnv(name) {
+  const value = process.env[name];
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const trimmed = value.trim();
+  return trimmed ? trimmed : void 0;
+}
+function requireEnv(name) {
+  const value = readEnv(name);
+  if (!value) {
+    throw new GitHubPluginSetupError(`Missing ${name}`);
+  }
+  return value;
+}
+function normalizeScopeList(scopes) {
+  return [
+    ...new Set(
+      (scopes ?? []).flatMap((scope) => String(scope).split(/\s+/)).map((scope) => scope.trim()).filter(Boolean)
+    )
+  ].sort();
+}
+function normalizeOAuthScope(scope) {
+  const normalized = normalizeScopeList(scope ? [scope] : []);
+  return normalized.length ? normalized.join(" ") : void 0;
+}
+function hasRequiredOAuthScope(storedScope, requiredScope) {
+  const required = normalizeScopeList(requiredScope ? [requiredScope] : []);
+  if (required.length === 0) {
+    return true;
+  }
+  const stored = new Set(normalizeScopeList(storedScope ? [storedScope] : []));
+  if (stored.size === 0) {
+    return false;
+  }
+  return required.every((scope) => stored.has(scope));
+}
+function isGitHubApiUrl(upstreamUrl) {
+  return upstreamUrl.hostname.toLowerCase() === "api.github.com";
+}
+function base64Url(input) {
+  return Buffer.from(input).toString("base64").replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function getPrivateKey(envName) {
+  const raw = requireEnv(envName);
+  let key;
+  try {
+    key = createPrivateKey({ key: raw, format: "pem" });
+  } catch {
+    throw new GitHubPluginSetupError(
+      `Invalid ${envName}: expected a PEM-encoded RSA private key`
+    );
+  }
+  if (key.asymmetricKeyType !== "rsa") {
+    throw new GitHubPluginSetupError(
+      `Invalid ${envName}: GitHub App signing requires an RSA private key`
+    );
+  }
+  return key;
+}
+function createAppJwt(appId, privateKeyEnv) {
+  const now = Math.floor(Date.now() / 1e3);
+  const header = { alg: "RS256", typ: "JWT" };
+  const payload = { iat: now - 60, exp: now + 9 * 60, iss: appId };
+  const encodedHeader = base64Url(JSON.stringify(header));
+  const encodedPayload = base64Url(JSON.stringify(payload));
+  const signingInput = `${encodedHeader}.${encodedPayload}`;
+  const signer = createSign("RSA-SHA256");
+  signer.update(signingInput);
+  signer.end();
+  const signature = signer.sign(getPrivateKey(privateKeyEnv)).toString("base64").replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  return `${signingInput}.${signature}`;
+}
+async function githubRequest(apiBase, path, params) {
+  const response = await fetch(`${apiBase}${path}`, {
+    method: params.method ?? "GET",
+    headers: {
+      Accept: "application/vnd.github+json",
+      Authorization: `Bearer ${params.token}`,
+      "X-GitHub-Api-Version": "2022-11-28",
+      ...params.body ? { "Content-Type": "application/json" } : void 0
+    },
+    ...params.body ? { body: JSON.stringify(params.body) } : void 0
+  });
+  const text = await response.text();
+  let parsed;
+  if (text) {
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      parsed = void 0;
+    }
+  }
+  if (!response.ok) {
+    const message = isRecord(parsed) && typeof parsed.message === "string" ? parsed.message : `GitHub API error ${response.status}`;
+    throw new GitHubRequestError(message, response.status);
+  }
+  return parsed;
+}
+function buildOAuthTokenRequest(input) {
+  const payload = {
+    ...input.payload,
+    client_id: input.clientId,
+    client_secret: input.clientSecret
+  };
+  return {
+    headers: {
+      Accept: "application/json",
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: new URLSearchParams(payload)
+  };
+}
+function parseOAuthResponseJson(responseText) {
+  if (!responseText.trim()) {
+    return void 0;
+  }
+  try {
+    return JSON.parse(responseText);
+  } catch {
+    return void 0;
+  }
+}
+function oauthErrorCode(data) {
+  return isRecord(data) && typeof data.error === "string" ? data.error : void 0;
+}
+function isRejectedRefreshError(errorCode) {
+  return errorCode === "bad_refresh_token" || errorCode === "invalid_grant";
+}
+function parseOAuthTokenResponse(data, requestedScope) {
+  if (!isRecord(data)) {
+    throw new Error("OAuth token response is invalid");
+  }
+  if (typeof data.access_token !== "string" || !data.access_token.trim()) {
+    throw new Error("OAuth token response missing access_token");
+  }
+  if (typeof data.refresh_token !== "string" || !data.refresh_token.trim()) {
+    throw new Error("OAuth token response missing refresh_token");
+  }
+  let scope = normalizeOAuthScope(requestedScope);
+  if (data.scope !== void 0) {
+    if (typeof data.scope !== "string") {
+      throw new Error("OAuth token response returned invalid scope");
+    }
+    scope = normalizeOAuthScope(data.scope) ?? scope;
+  }
+  const result = {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    ...scope ? { scope } : void 0
+  };
+  if (data.expires_in !== void 0) {
+    if (typeof data.expires_in !== "number" || !Number.isFinite(data.expires_in) || data.expires_in <= 0) {
+      throw new Error("OAuth token response returned invalid expires_in");
+    }
+    result.expiresAt = Date.now() + data.expires_in * 1e3;
+  }
+  if (data.refresh_token_expires_in !== void 0) {
+    if (typeof data.refresh_token_expires_in !== "number" || !Number.isFinite(data.refresh_token_expires_in) || data.refresh_token_expires_in <= 0) {
+      throw new Error(
+        "OAuth token response returned invalid refresh_token_expires_in"
+      );
+    }
+    result.refreshTokenExpiresAt = Date.now() + data.refresh_token_expires_in * 1e3;
+  }
+  return result;
+}
+async function refreshUserAccessToken(input) {
+  const clientId = requireEnv(input.clientIdEnv);
+  const clientSecret = requireEnv(input.clientSecretEnv);
+  const request = buildOAuthTokenRequest({
+    clientId,
+    clientSecret,
+    payload: {
+      grant_type: "refresh_token",
+      refresh_token: input.refreshToken
+    }
+  });
+  const response = await fetch("https://github.com/login/oauth/access_token", {
+    method: "POST",
+    headers: request.headers,
+    body: request.body,
+    signal: AbortSignal.timeout(USER_REFRESH_TIMEOUT_MS)
+  });
+  const responseText = await response.text();
+  const responseData = parseOAuthResponseJson(responseText);
+  const errorCode = oauthErrorCode(responseData);
+  if (isRejectedRefreshError(errorCode)) {
+    throw new GitHubUserRefreshRejectedError(
+      `GitHub user token refresh rejected: ${errorCode}`
+    );
+  }
+  if (!response.ok || errorCode) {
+    throw new Error(
+      `GitHub user token refresh failed: ${response.status}${errorCode ? ` ${errorCode}` : ""}`
+    );
+  }
+  try {
+    return parseOAuthTokenResponse(responseData, input.requestedScope);
+  } catch (error) {
+    if (error instanceof Error && error.message === "OAuth token response missing access_token") {
+      throw new GitHubUserRefreshRejectedError(error.message);
+    }
+    throw error;
+  }
+}
+function leaseExpiry(expiresAt) {
+  return expiresAt ? Math.min(expiresAt, Date.now() + MAX_LEASE_MS) : Date.now() + MAX_LEASE_MS;
+}
+function isGitSmartHttpDomain(domain) {
+  return domain.toLowerCase() === "github.com";
+}
+function authorizationFor(domain, token) {
+  if (isGitSmartHttpDomain(domain)) {
+    return `Basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}`;
+  }
+  return `Bearer ${token}`;
+}
+function createCredentialLease(input) {
+  return {
+    type: "lease",
+    lease: {
+      ...input.account ? { account: input.account } : void 0,
+      ...input.authorization ? { authorization: input.authorization } : void 0,
+      expiresAt: new Date(input.expiresAtMs).toISOString(),
+      headerTransforms: (input.domains ?? (input.authorization ? GITHUB_ASSET_UPLOAD_CREDENTIAL_DOMAINS : GITHUB_CREDENTIAL_DOMAINS)).map((domain) => ({
+        domain,
+        headers: {
+          Authorization: authorizationFor(domain, input.token)
+        }
+      }))
+    }
+  };
+}
+function githubUserAuthorization(scope) {
+  return {
+    type: "oauth",
+    provider: "github",
+    ...scope ? { scope } : void 0
+  };
+}
+function credentialNeeded(message, scope, allowAuthorization = true) {
+  return {
+    type: "needed",
+    message,
+    ...allowAuthorization ? { authorization: githubUserAuthorization(scope) } : void 0
+  };
+}
+function credentialUnavailable(message) {
+  return {
+    type: "unavailable",
+    message
+  };
+}
+function parseInstallationTokenResponse(data) {
+  if (!isRecord(data)) {
+    throw new Error("GitHub installation token response is invalid");
+  }
+  const token = data.token;
+  if (typeof token !== "string" || !token.trim()) {
+    throw new Error("GitHub installation token response missing token");
+  }
+  const expiresAt = data.expires_at;
+  const expiresAtMs = typeof expiresAt === "string" ? Date.parse(expiresAt) : Number.NaN;
+  if (!Number.isFinite(expiresAtMs) || expiresAtMs <= Date.now()) {
+    throw new Error(
+      "GitHub installation token response returned invalid expires_at"
+    );
+  }
+  return { token, expiresAtMs };
+}
+function readInstallationPermissions(installation) {
+  if (!isRecord(installation) || !isRecord(installation.permissions)) {
+    throw new Error("GitHub installation response missing permissions");
+  }
+  return readGrantPermissions(installation.permissions);
+}
+function decodeGitHubPathSegment(value) {
+  try {
+    const decoded = decodeURIComponent(value).trim();
+    return decoded && !decoded.includes("/") ? decoded : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function githubRepositoryFromUrl(upstreamUrl) {
+  const segments = upstreamUrl.pathname.split("/").filter(Boolean);
+  if (isGitHubApiUrl(upstreamUrl) && segments[0]?.toLowerCase() === "repos") {
+    const owner2 = segments[1] ? decodeGitHubPathSegment(segments[1]) : void 0;
+    const name2 = segments[2] ? decodeGitHubPathSegment(segments[2]) : void 0;
+    return owner2 && name2 ? { owner: owner2, name: name2 } : void 0;
+  }
+  if (upstreamUrl.hostname.toLowerCase() !== "github.com") {
+    return void 0;
+  }
+  const owner = segments[0] ? decodeGitHubPathSegment(segments[0]) : void 0;
+  const rawName = segments[1]?.replace(/\.git$/i, "");
+  const name = rawName ? decodeGitHubPathSegment(rawName) : void 0;
+  return owner && name ? { owner, name } : void 0;
+}
+function githubRepositoryLeaseScope(repository) {
+  return `repository:${repository.owner.toLowerCase()}/${repository.name.toLowerCase()}`;
+}
+function githubRepositoryFromLeaseScope(leaseScope) {
+  const match = /^repository:([^/]+)\/([^/]+)$/.exec(leaseScope ?? "");
+  if (!match?.[1] || !match[2]) {
+    throw new GitHubPluginSetupError(
+      "GitHub installation write grant is missing a repository lease scope."
+    );
+  }
+  return { owner: match[1], name: match[2] };
+}
+async function resolveUserAccount(tokens) {
+  const account = await githubRequest("https://api.github.com", "/user", {
+    token: tokens.accessToken
+  });
+  if (!isRecord(account)) {
+    throw new Error("GitHub user response is invalid");
+  }
+  const id = account.id;
+  const login = account.login;
+  if (typeof id !== "number" && typeof id !== "string" || typeof login !== "string" || !login.trim()) {
+    throw new Error("GitHub user response missing id or login");
+  }
+  const url = typeof account.html_url === "string" ? account.html_url : void 0;
+  return {
+    handle: login.trim(),
+    id: String(id),
+    label: login.trim(),
+    ...url ? { url } : void 0
+  };
+}
+async function tokensWithAccount(tokenSlot, stored, scope) {
+  if (stored.account) {
+    return { ok: true, tokens: stored };
+  }
+  let account;
+  try {
+    account = await resolveUserAccount(stored);
+  } catch (error) {
+    if (error instanceof GitHubRequestError && (error.status === 401 || error.status === 403)) {
+      return {
+        ok: false,
+        result: credentialNeeded(
+          "Your GitHub authorization needs to be refreshed.",
+          scope
+        )
+      };
+    }
+    throw error;
+  }
+  const updated = { ...stored, account };
+  await tokenSlot.set(updated);
+  return { ok: true, tokens: updated };
+}
+function shouldRefreshUserToken(stored, now = Date.now()) {
+  return stored.expiresAt !== void 0 && stored.expiresAt - now < REFRESH_BUFFER_MS;
+}
+function canUseStoredUserToken(stored) {
+  return stored.expiresAt === void 0 || stored.expiresAt > Date.now() && !shouldRefreshUserToken(stored);
+}
+async function refreshUserTokensWithLock(tokenSlot, scope, options) {
+  return await tokenSlot.withRefresh(async () => {
+    const latest = await tokenSlot.get();
+    if (!latest) {
+      return {
+        ok: false,
+        result: credentialNeeded("Connect your GitHub account.", scope)
+      };
+    }
+    if (!hasRequiredOAuthScope(latest.scope, scope)) {
+      return {
+        ok: false,
+        result: credentialNeeded(
+          "Your GitHub authorization needs to be refreshed.",
+          scope
+        )
+      };
+    }
+    if (canUseStoredUserToken(latest)) {
+      return { ok: true, tokens: latest };
+    }
+    let refreshed;
+    try {
+      refreshed = await refreshUserAccessToken({
+        clientIdEnv: options.clientIdEnv,
+        clientSecretEnv: options.clientSecretEnv,
+        refreshToken: latest.refreshToken,
+        requestedScope: latest.scope ?? scope
+      });
+    } catch (error) {
+      if (!(error instanceof GitHubUserRefreshRejectedError)) {
+        throw error;
+      }
+      return {
+        ok: false,
+        result: credentialNeeded(
+          "Your GitHub authorization has expired.",
+          scope
+        )
+      };
+    }
+    if (!hasRequiredOAuthScope(refreshed.scope, scope)) {
+      return {
+        ok: false,
+        result: credentialNeeded(
+          "Your GitHub authorization needs to be refreshed.",
+          scope
+        )
+      };
+    }
+    const refreshedTokens = {
+      ...latest.refreshTokenExpiresAt ? { refreshTokenExpiresAt: latest.refreshTokenExpiresAt } : void 0,
+      ...refreshed,
+      ...latest.account ? { account: latest.account } : void 0
+    };
+    await tokenSlot.set(refreshedTokens);
+    return { ok: true, tokens: refreshedTokens };
+  });
+}
+async function issueUserCredential(ctx, options) {
+  const scope = options.userScope;
+  const tokenSlot = ctx.tokens.currentUser ?? ctx.tokens.credentialSubject;
+  if (!tokenSlot) {
+    return credentialNeeded(
+      "GitHub write access requires a current user or delegated user credential subject.",
+      scope,
+      false
+    );
+  }
+  const stored = await tokenSlot.get();
+  if (!stored) {
+    return credentialNeeded(
+      "GitHub write access requires user authorization.",
+      scope
+    );
+  }
+  if (!hasRequiredOAuthScope(stored.scope, scope)) {
+    return credentialNeeded(
+      "Your GitHub authorization needs to be refreshed.",
+      scope
+    );
+  }
+  const now = Date.now();
+  if (stored.expiresAt !== void 0 && stored.expiresAt - now < REFRESH_BUFFER_MS) {
+    const refreshResult = await refreshUserTokensWithLock(
+      tokenSlot,
+      scope,
+      options
+    );
+    if (!refreshResult.ok) {
+      return refreshResult.result;
+    }
+    const withAccount = await tokensWithAccount(
+      tokenSlot,
+      refreshResult.tokens,
+      scope
+    );
+    if (!withAccount.ok) {
+      return withAccount.result;
+    }
+    return createCredentialLease({
+      account: withAccount.tokens.account,
+      token: withAccount.tokens.accessToken,
+      expiresAtMs: leaseExpiry(withAccount.tokens.expiresAt),
+      authorization: githubUserAuthorization(scope)
+    });
+  }
+  if (stored.expiresAt === void 0 || stored.expiresAt > Date.now()) {
+    const withAccount = await tokensWithAccount(tokenSlot, stored, scope);
+    if (!withAccount.ok) {
+      return withAccount.result;
+    }
+    return createCredentialLease({
+      account: withAccount.tokens.account,
+      token: withAccount.tokens.accessToken,
+      expiresAtMs: leaseExpiry(withAccount.tokens.expiresAt),
+      authorization: githubUserAuthorization(scope)
+    });
+  }
+  return credentialNeeded("Your GitHub authorization has expired.", scope);
+}
+async function issueInstallationToken(options) {
+  const appId = requireEnv(options.appIdEnv);
+  const installationIdRaw = requireEnv(options.installationIdEnv);
+  const installationId = Number(installationIdRaw);
+  if (!Number.isSafeInteger(installationId) || installationId <= 0) {
+    throw new GitHubPluginSetupError(`Invalid ${options.installationIdEnv}`);
+  }
+  const appJwt = createAppJwt(appId, options.privateKeyEnv);
+  const permissions = "permissions" in options ? options.permissions : typeof options.loadPermissions === "function" ? await options.loadPermissions({ appJwt, installationId }) : void 0;
+  const body = {
+    ...permissions ? { permissions } : void 0,
+    ..."repositories" in options ? { repositories: options.repositories } : void 0
+  };
+  const accessTokenResponse = await githubRequest(
+    "https://api.github.com",
+    `/app/installations/${installationId}/access_tokens`,
+    {
+      method: "POST",
+      token: appJwt,
+      body
+    }
+  );
+  const parsedToken = parseInstallationTokenResponse(accessTokenResponse);
+  return {
+    expiresAtMs: Math.min(parsedToken.expiresAtMs, Date.now() + MAX_LEASE_MS),
+    token: parsedToken.token
+  };
+}
+async function issueInstallationCredential(options) {
+  const token = await issueInstallationToken(options);
+  return createCredentialLease({
+    token: token.token,
+    expiresAtMs: token.expiresAtMs
+  });
+}
+function createPermissionCache() {
+  let cached;
+  let pending;
+  return async ({ appJwt, installationId }) => {
+    if (cached && cached.expiresAtMs > Date.now()) {
+      return cached.permissions;
+    }
+    pending ??= githubRequest(
+      "https://api.github.com",
+      `/app/installations/${installationId}`,
+      { token: appJwt }
+    ).then((installation) => {
+      const permissions = readInstallationPermissions(installation);
+      cached = {
+        expiresAtMs: Date.now() + MAX_LEASE_MS,
+        permissions
+      };
+      return permissions;
+    }).finally(() => {
+      pending = void 0;
+    });
+    return await pending;
+  };
+}
+
+// src/webhooks/check-suite.ts
+function gitHubEventKey(deliveryId, eventType) {
+  return `github:${deliveryId}:${eventType}`;
+}
+function pullRequestTargets(event, repo) {
+  const { terminal: _terminal, ...repositoryEvent } = event;
+  return [
+    event,
+    {
+      ...repositoryEvent,
+      identifier: gitHubRepositoryResource({ repo }).identifier
+    }
+  ];
+}
+var repositorySchema = z.object({ full_name: z.string().min(1) }).passthrough();
+var checkSuiteWebhookSchema = z.object({
+  action: z.string(),
+  check_suite: z.object({
+    app: z.object({
+      name: z.string().optional().nullable(),
+      slug: z.string().optional().nullable()
+    }).optional().nullable(),
+    conclusion: z.string().optional().nullable(),
+    head_sha: z.string().optional(),
+    id: z.number().optional(),
+    latest_check_runs_count: z.number().optional().nullable(),
+    pull_requests: z.array(
+      z.object({ draft: z.boolean().optional(), number: z.number() })
+    )
+  }),
+  repository: repositorySchema
+});
+var FAILING_CHECK_CONCLUSIONS = /* @__PURE__ */ new Set([
+  "failure",
+  "timed_out",
+  "cancelled",
+  "action_required",
+  "startup_failure"
+]);
+function buildCheckSuiteUrl(args) {
+  return `https://github.com/${args.repo}/commit/${args.headSha}/checks?check_suite_id=${args.checkSuiteId}`;
+}
+function oneLineLabel(value, maxLength = 80) {
+  return value.replace(/[\r\n]+/g, " ").replace(/\s+/g, " ").trim().slice(0, maxLength);
+}
+function buildCheckSuiteResourceEvent(args) {
+  const resource = gitHubPullRequestResource({
+    number: args.pullRequestNumber,
+    repo: args.repo
+  });
+  const shortSha = args.headSha?.slice(0, 12);
+  const failingChecks = (args.failingChecks ?? []).slice(0, 12);
+  const failingCount = failingChecks.length;
+  const trustedSummary = args.eventType === "pull_request.checks.failed" ? `${resource.label} checks failed${failingCount > 0 ? ` (${failingCount})` : ""}${shortSha ? ` for ${shortSha}` : ""}.` : `${resource.label} check suite recovered${shortSha ? ` for ${shortSha}` : ""}.`;
+  const data = {
+    repo: args.repo,
+    pullRequest: args.pullRequestNumber,
+    scope: "check_suite",
+    suiteConclusion: args.suiteConclusion
+  };
+  if (typeof args.isDraft === "boolean") data.isDraft = args.isDraft;
+  if (args.authorUsername) data.authorUsername = args.authorUsername;
+  if (args.authorEmail) data.authorEmail = args.authorEmail;
+  if (args.headSha) data.headSha = args.headSha;
+  if (args.checkSuiteId !== void 0) data.checkSuiteId = args.checkSuiteId;
+  if (args.checkSuiteId !== void 0 && args.headSha) {
+    data.checkSuiteUrl = buildCheckSuiteUrl({
+      checkSuiteId: args.checkSuiteId,
+      headSha: args.headSha,
+      repo: args.repo
+    });
+  }
+  if (args.appName) data.appName = oneLineLabel(args.appName, 120);
+  if (args.latestCheckRunsCount !== void 0) {
+    data.latestCheckRunsCount = args.latestCheckRunsCount;
+  }
+  if (args.eventType === "pull_request.checks.failed" && failingCount > 0) {
+    data.failingChecks = failingChecks.map((check) => ({
+      conclusion: check.conclusion,
+      ...check.htmlUrl ? { htmlUrl: check.htmlUrl } : void 0,
+      checkRunId: check.checkRunId
+    }));
+  }
+  const untrustedParts = args.eventType === "pull_request.checks.failed" ? failingChecks.map((check) => {
+    const name = oneLineLabel(check.name);
+    if (!name) return void 0;
+    return check.htmlUrl ? `${name}: ${check.htmlUrl}` : name;
+  }).filter((part) => part !== void 0) : [];
+  const untrustedText = untrustedParts.length > 0 ? [`Failed checks:`, ...untrustedParts.map((part) => `- ${part}`)].join(
+    "\n"
+  ) : void 0;
+  return {
+    eventKey: gitHubEventKey(
+      args.deliveryId,
+      `${args.eventType}:${args.pullRequestNumber}`
+    ),
+    eventType: args.eventType,
+    occurredAtMs: Date.now(),
+    identifier: resource.identifier,
+    trustedSummary,
+    data,
+    ...untrustedText ? { untrustedText } : void 0
+  };
+}
+function selectFailingChecks(checkRuns, options) {
+  if (!Array.isArray(checkRuns)) return [];
+  const failing = [];
+  for (const run of checkRuns) {
+    if (!run || typeof run !== "object" || Array.isArray(run)) continue;
+    const record = run;
+    if (options?.checkSuiteId !== void 0) {
+      const suite = record.check_suite;
+      const suiteId = suite && typeof suite === "object" && !Array.isArray(suite) && typeof suite.id === "number" ? suite.id : void 0;
+      if (suiteId !== void 0 && suiteId !== options.checkSuiteId) continue;
+    }
+    const conclusion = typeof record.conclusion === "string" ? record.conclusion : void 0;
+    const name = typeof record.name === "string" ? record.name.trim() : "";
+    const checkRunId = typeof record.id === "number" && Number.isSafeInteger(record.id) ? record.id : void 0;
+    if (!conclusion || !FAILING_CHECK_CONCLUSIONS.has(conclusion)) continue;
+    if (!name || checkRunId === void 0) continue;
+    const htmlUrl = typeof record.html_url === "string" && record.html_url.length > 0 ? record.html_url : void 0;
+    failing.push({
+      checkRunId,
+      conclusion,
+      ...htmlUrl ? { htmlUrl } : void 0,
+      name
+    });
+  }
+  return failing.slice(0, 12);
+}
+function normalizeCheckSuiteEvents(deliveryId, body, options) {
+  const parsed = checkSuiteWebhookSchema.safeParse(body);
+  if (!parsed.success || parsed.data.action !== "completed") return [];
+  const conclusion = parsed.data.check_suite.conclusion;
+  if (!conclusion) return [];
+  const eventType = conclusion === "failure" || conclusion === "timed_out" ? "pull_request.checks.failed" : conclusion === "success" ? "pull_request.checks.recovered" : void 0;
+  if (!eventType) return [];
+  const suite = parsed.data.check_suite;
+  const appName = suite.app?.name?.trim() || suite.app?.slug?.trim() || void 0;
+  const headSha = typeof suite.head_sha === "string" && /^[0-9a-f]{7,40}$/i.test(suite.head_sha) ? suite.head_sha : void 0;
+  return suite.pull_requests.flatMap((pullRequest) => {
+    const repo = parsed.data.repository.full_name;
+    const facts = options?.pullRequestFactsByNumber?.[pullRequest.number];
+    const draft = typeof pullRequest.draft === "boolean" ? pullRequest.draft : typeof facts?.isDraft === "boolean" ? facts.isDraft : void 0;
+    return pullRequestTargets(
+      buildCheckSuiteResourceEvent({
+        appName,
+        ...facts?.authorEmail ? { authorEmail: facts.authorEmail } : void 0,
+        ...facts?.authorUsername ? { authorUsername: facts.authorUsername } : void 0,
+        checkSuiteId: suite.id,
+        deliveryId,
+        eventType,
+        failingChecks: eventType === "pull_request.checks.failed" ? options?.failingChecks : void 0,
+        headSha,
+        ...typeof draft === "boolean" ? { isDraft: draft } : void 0,
+        latestCheckRunsCount: typeof suite.latest_check_runs_count === "number" ? suite.latest_check_runs_count : void 0,
+        pullRequestNumber: pullRequest.number,
+        repo,
+        suiteConclusion: conclusion
+      }),
+      repo
+    );
+  });
+}
+function parseCheckSuiteFactsTarget(body) {
+  const parsed = checkSuiteWebhookSchema.safeParse(body);
+  if (!parsed.success || parsed.data.action !== "completed") return void 0;
+  const conclusion = parsed.data.check_suite.conclusion;
+  if (conclusion !== "failure" && conclusion !== "timed_out" && conclusion !== "success") {
+    return void 0;
+  }
+  const headSha = parsed.data.check_suite.head_sha;
+  const checkSuiteId = parsed.data.check_suite.id;
+  if (typeof headSha !== "string" || !/^[0-9a-f]{7,40}$/i.test(headSha) || typeof checkSuiteId !== "number") {
+    return void 0;
+  }
+  const [owner, repoName, ...extra] = parsed.data.repository.full_name.split("/");
+  if (!owner || !repoName || extra.length > 0) return void 0;
+  const pullRequestNumbers = [
+    ...new Set(
+      parsed.data.check_suite.pull_requests.map(
+        (pullRequest) => pullRequest.number
+      )
+    )
+  ];
+  const loadFailingChecks = conclusion === "failure" || conclusion === "timed_out";
+  if (!loadFailingChecks && pullRequestNumbers.length === 0) {
+    return void 0;
+  }
+  return {
+    checkSuiteId,
+    headSha,
+    loadFailingChecks,
+    owner,
+    pullRequestNumbers,
+    repoName
+  };
+}
+function checkRunsFromResponse(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return [];
+  }
+  const checkRuns = value.check_runs;
+  return Array.isArray(checkRuns) ? checkRuns : [];
+}
+function pullRequestFactsFromResponse(value) {
+  if (!isRecord(value)) return void 0;
+  const facts = {};
+  if (typeof value.draft === "boolean") facts.isDraft = value.draft;
+  const user = value.user;
+  if (isRecord(user)) {
+    const username = typeof user.login === "string" ? user.login.trim() : void 0;
+    if (username) facts.authorUsername = username;
+    const email = typeof user.email === "string" ? user.email.trim() : void 0;
+    if (email) facts.authorEmail = email;
+  }
+  return Object.keys(facts).length > 0 ? facts : void 0;
+}
+async function loadCheckSuiteFacts(args) {
+  const target = parseCheckSuiteFactsTarget(args.body);
+  if (!target) return void 0;
+  const facts = {};
+  if (target.loadFailingChecks) {
+    try {
+      const token = await issueInstallationToken({
+        appIdEnv: args.appIdEnv,
+        installationIdEnv: args.installationIdEnv,
+        permissions: { checks: "read" },
+        privateKeyEnv: args.privateKeyEnv,
+        repositories: [target.repoName]
+      });
+      const response = await githubRequest(
+        "https://api.github.com",
+        `/repos/${encodeURIComponent(target.owner)}/${encodeURIComponent(target.repoName)}/check-suites/${target.checkSuiteId}/check-runs?filter=latest&per_page=100`,
+        { token: token.token }
+      );
+      const failing = selectFailingChecks(checkRunsFromResponse(response), {
+        checkSuiteId: target.checkSuiteId
+      });
+      if (failing.length > 0) facts.failingChecks = failing;
+    } catch (error) {
+      args.log?.error("GitHub check suite load failed", {
+        checkSuiteId: target.checkSuiteId,
+        errorType: error instanceof Error ? error.name : "UnknownError",
+        repository: `${target.owner}/${target.repoName}`
+      });
+    }
+  }
+  if (target.pullRequestNumbers.length > 0) {
+    try {
+      const token = await issueInstallationToken({
+        appIdEnv: args.appIdEnv,
+        installationIdEnv: args.installationIdEnv,
+        permissions: { pull_requests: "read" },
+        privateKeyEnv: args.privateKeyEnv,
+        repositories: [target.repoName]
+      });
+      const loaded = await Promise.all(
+        target.pullRequestNumbers.map(async (number) => {
+          try {
+            const response = await githubRequest(
+              "https://api.github.com",
+              `/repos/${encodeURIComponent(target.owner)}/${encodeURIComponent(target.repoName)}/pulls/${number}`,
+              { token: token.token }
+            );
+            const facts2 = pullRequestFactsFromResponse(response);
+            return facts2 ? [number, facts2] : void 0;
+          } catch (error) {
+            args.log?.error("GitHub pull request data load failed", {
+              errorType: error instanceof Error ? error.name : "UnknownError",
+              pullRequest: number,
+              repository: `${target.owner}/${target.repoName}`
+            });
+            return void 0;
+          }
+        })
+      );
+      const pullRequestFactsByNumber = {};
+      for (const entry of loaded) {
+        if (!entry) continue;
+        pullRequestFactsByNumber[entry[0]] = entry[1];
+      }
+      if (Object.keys(pullRequestFactsByNumber).length > 0) {
+        facts.pullRequestFactsByNumber = pullRequestFactsByNumber;
+      }
+    } catch (error) {
+      args.log?.error("GitHub check suite pull request data load failed", {
+        checkSuiteId: target.checkSuiteId,
+        errorType: error instanceof Error ? error.name : "UnknownError",
+        repository: `${target.owner}/${target.repoName}`
+      });
+    }
+  }
+  return facts.failingChecks || facts.pullRequestFactsByNumber ? facts : void 0;
+}
+
+// src/webhooks/resource-events.ts
+function gitHubEventKey2(deliveryId, eventType) {
+  return `github:${deliveryId}:${eventType}`;
+}
+function pullRequestDraftData(draft) {
+  return typeof draft === "boolean" ? { isDraft: draft } : void 0;
+}
+function pullRequestAuthorData(user) {
+  const data = {};
+  const username = user?.login?.trim();
+  if (username) data.authorUsername = username;
+  const email = user?.email?.trim();
+  if (email) data.authorEmail = email;
+  return data;
+}
+function pullRequestMatchData(parts) {
+  const data = {};
+  for (const part of parts) {
+    if (!part) continue;
+    Object.assign(data, part);
+  }
+  return Object.keys(data).length > 0 ? data : void 0;
+}
+function pullRequestTargets2(event, repo) {
+  const { terminal: _terminal, ...repositoryEvent } = event;
+  return [
+    event,
+    {
+      ...repositoryEvent,
+      identifier: gitHubRepositoryResource({ repo }).identifier
+    }
+  ];
+}
+var repositorySchema2 = z2.object({ full_name: z2.string().min(1) }).passthrough();
+var deploymentSchema = z2.object({
+  created_at: z2.string().optional(),
+  environment: z2.string().min(1),
+  id: z2.number(),
+  sha: z2.string().regex(/^[0-9a-f]{40}$/i)
+}).passthrough();
+var deploymentWebhookSchema = z2.object({
+  action: z2.string(),
+  deployment: deploymentSchema,
+  repository: repositorySchema2
+}).passthrough();
+var canonicalDeploymentEventSchema = z2.object({
+  action: z2.string(),
+  commitSha: z2.string().regex(/^[0-9a-f]{40}$/i),
+  createdAt: z2.string().optional(),
+  deploymentId: z2.number(),
+  environment: z2.string().min(1),
+  repo: z2.string().min(1)
+}).strict();
+function parseDeploymentEvent(body) {
+  const parsed = deploymentWebhookSchema.safeParse(body);
+  if (!parsed.success) return void 0;
+  return canonicalDeploymentEventSchema.parse({
+    action: parsed.data.action,
+    commitSha: parsed.data.deployment.sha,
+    createdAt: parsed.data.deployment.created_at,
+    deploymentId: parsed.data.deployment.id,
+    environment: parsed.data.deployment.environment,
+    repo: parsed.data.repository.full_name
+  });
+}
+function normalizeDeploymentEvent(deliveryId, body) {
+  const parsed = parseDeploymentEvent(body);
+  if (!parsed || parsed.action !== "created") return [];
+  const eventType = "deployment.created";
+  return deploymentSourceTargets(parsed).map(({ resource }) => ({
+    eventKey: gitHubEventKey2(deliveryId, eventType),
+    eventType,
+    occurredAtMs: providerTime(parsed.createdAt) ?? Date.now(),
+    identifier: resource.identifier,
+    trustedSummary: `${resource.label} was created (deployment ${parsed.deploymentId}).`
+  }));
+}
+var deploymentStatusWebhookSchema = z2.object({
+  action: z2.string(),
+  deployment: deploymentSchema,
+  deployment_status: z2.object({
+    created_at: z2.string().optional(),
+    description: z2.string().optional().nullable(),
+    state: z2.string()
+  }).passthrough(),
+  repository: repositorySchema2
+}).passthrough();
+var canonicalDeploymentStatusEventSchema = canonicalDeploymentEventSchema.extend({
+  description: z2.string().optional().nullable(),
+  state: z2.string(),
+  statusCreatedAt: z2.string().optional()
+}).strict();
+function parseDeploymentStatusEvent(body) {
+  const parsed = deploymentStatusWebhookSchema.safeParse(body);
+  if (!parsed.success) return void 0;
+  return canonicalDeploymentStatusEventSchema.parse({
+    action: parsed.data.action,
+    commitSha: parsed.data.deployment.sha,
+    createdAt: parsed.data.deployment.created_at,
+    deploymentId: parsed.data.deployment.id,
+    description: parsed.data.deployment_status.description,
+    environment: parsed.data.deployment.environment,
+    repo: parsed.data.repository.full_name,
+    state: parsed.data.deployment_status.state,
+    statusCreatedAt: parsed.data.deployment_status.created_at
+  });
+}
+function deploymentStatusEventType(state) {
+  switch (state) {
+    case "queued":
+    case "pending":
+    case "in_progress":
+      return `deployment.${state}`;
+    case "success":
+      return "deployment.succeeded";
+    case "failure":
+      return "deployment.failed";
+    case "error":
+      return "deployment.error";
+    default:
+      return void 0;
+  }
+}
+function normalizeDeploymentStatusEvent(deliveryId, body) {
+  const parsed = parseDeploymentStatusEvent(body);
+  if (!parsed || parsed.action !== "created") return [];
+  const eventType = deploymentStatusEventType(parsed.state);
+  if (!eventType) return [];
+  const outcome = eventType === "deployment.succeeded" ? "succeeded" : eventType === "deployment.failed" ? "failed" : eventType === "deployment.error" ? "reported an error" : eventType === "deployment.in_progress" ? "started" : `is ${parsed.state}`;
+  const terminal = eventType === "deployment.succeeded" || eventType === "deployment.failed" || eventType === "deployment.error";
+  return deploymentSourceTargets(parsed).map(
+    ({ completeOnTerminalEvent, resource }) => ({
+      eventKey: gitHubEventKey2(deliveryId, eventType),
+      eventType,
+      occurredAtMs: providerTime(parsed.statusCreatedAt) ?? Date.now(),
+      identifier: resource.identifier,
+      ...terminal && completeOnTerminalEvent ? { terminal: true } : void 0,
+      trustedSummary: `${resource.label} ${outcome} (deployment ${parsed.deploymentId}).`,
+      untrustedText: parsed.description ?? void 0
+    })
+  );
+}
+function deploymentSourceTargets(input) {
+  return [
+    {
+      completeOnTerminalEvent: true,
+      resource: gitHubDeploymentSourceResource(input)
+    },
+    {
+      completeOnTerminalEvent: false,
+      resource: gitHubDeploymentSourceResource({
+        commitSha: input.commitSha,
+        repo: input.repo
+      })
+    }
+  ];
+}
+var issueCommentWebhookSchema = z2.object({
+  action: z2.string(),
+  comment: z2.object({
+    body: z2.string(),
+    user: z2.object({ login: z2.string().optional() }).optional()
+  }),
+  issue: z2.object({
+    draft: z2.boolean().optional(),
+    number: z2.number(),
+    pull_request: z2.object({ url: z2.string().min(1) }).optional(),
+    user: z2.object({
+      email: z2.string().optional().nullable(),
+      login: z2.string().optional().nullable()
+    }).optional().nullable()
+  }),
+  repository: repositorySchema2
+});
+function normalizeIssueCommentEvents(deliveryId, body) {
+  const parsed = issueCommentWebhookSchema.safeParse(body);
+  if (!parsed.success || parsed.data.action !== "created") return [];
+  const input = {
+    number: parsed.data.issue.number,
+    repo: parsed.data.repository.full_name
+  };
+  const author = parsed.data.comment.user?.login;
+  if (parsed.data.issue.pull_request) {
+    const eventType = "pull_request.comment.created";
+    const resource = gitHubPullRequestResource(input);
+    const data = pullRequestMatchData([
+      pullRequestDraftData(parsed.data.issue.draft),
+      pullRequestAuthorData(parsed.data.issue.user)
+    ]);
+    return pullRequestTargets2(
+      {
+        eventKey: gitHubEventKey2(deliveryId, eventType),
+        eventType,
+        occurredAtMs: Date.now(),
+        identifier: resource.identifier,
+        trustedSummary: `${resource.label} received a comment${author ? ` from ${author}` : ""}.`,
+        ...data ? { data } : void 0,
+        untrustedText: parsed.data.comment.body
+      },
+      input.repo
+    );
+  }
+  const issue = gitHubIssueResource(input);
+  const repository = gitHubRepositoryResource(input);
+  return [
+    {
+      eventKey: gitHubEventKey2(deliveryId, "issue.comment.created"),
+      eventType: "issue.comment.created",
+      occurredAtMs: Date.now(),
+      identifier: issue.identifier,
+      trustedSummary: `${issue.label} received a comment${author ? ` from ${author}` : ""}.`,
+      untrustedText: parsed.data.comment.body
+    },
+    {
+      eventKey: gitHubEventKey2(deliveryId, "issue.comment.created"),
+      eventType: "issue.comment.created",
+      occurredAtMs: Date.now(),
+      identifier: repository.identifier,
+      trustedSummary: `${issue.label} received a comment${author ? ` from ${author}` : ""}.`,
+      untrustedText: parsed.data.comment.body
+    }
+  ];
+}
+var issueWebhookSchema = z2.object({
+  action: z2.string(),
+  issue: z2.object({
+    body: z2.string().optional().nullable(),
+    closed_at: z2.string().optional().nullable(),
+    created_at: z2.string().optional(),
+    number: z2.number(),
+    title: z2.string().optional(),
+    updated_at: z2.string().optional()
+  }),
+  repository: repositorySchema2
+});
+function issueEventText(issue) {
+  const parts = [
+    issue.title ? `Title: ${issue.title}` : void 0,
+    issue.body?.trim() || void 0
+  ].filter((part) => part !== void 0);
+  return parts.length > 0 ? parts.join("\n\n") : void 0;
+}
+function normalizeIssueEvents(deliveryId, body) {
+  const parsed = issueWebhookSchema.safeParse(body);
+  if (!parsed.success) return [];
+  const state = parsed.data.action === "opened" ? "opened" : parsed.data.action === "closed" ? "closed" : parsed.data.action === "reopened" ? "reopened" : void 0;
+  if (!state) return [];
+  const input = {
+    number: parsed.data.issue.number,
+    repo: parsed.data.repository.full_name
+  };
+  const issue = gitHubIssueResource(input);
+  const repository = gitHubRepositoryResource(input);
+  const occurredAtMs = providerTime(
+    state === "opened" ? parsed.data.issue.created_at : state === "closed" ? parsed.data.issue.closed_at : parsed.data.issue.updated_at
+  ) ?? Date.now();
+  const untrustedText = issueEventText(parsed.data.issue);
+  return [
+    {
+      eventKey: gitHubEventKey2(deliveryId, `issue.${state}`),
+      eventType: `issue.${state}`,
+      occurredAtMs,
+      identifier: issue.identifier,
+      trustedSummary: `${issue.label} was ${state}.`,
+      ...untrustedText ? { untrustedText } : void 0
+    },
+    {
+      eventKey: gitHubEventKey2(deliveryId, `issue.${state}`),
+      eventType: `issue.${state}`,
+      occurredAtMs,
+      identifier: repository.identifier,
+      trustedSummary: `${issue.label} was ${state}.`,
+      ...untrustedText ? { untrustedText } : void 0
+    }
+  ];
+}
+var pullRequestReviewCommentWebhookSchema = z2.object({
+  action: z2.string(),
+  comment: z2.object({
+    body: z2.string(),
+    user: z2.object({ login: z2.string().optional() }).optional()
+  }),
+  pull_request: z2.object({
+    draft: z2.boolean().optional(),
+    number: z2.number(),
+    user: z2.object({
+      email: z2.string().optional().nullable(),
+      login: z2.string().optional().nullable()
+    }).optional().nullable()
+  }),
+  repository: repositorySchema2
+});
+function normalizePullRequestReviewCommentEvent(deliveryId, body) {
+  const parsed = pullRequestReviewCommentWebhookSchema.safeParse(body);
+  if (!parsed.success || parsed.data.action !== "created") return [];
+  const eventType = "pull_request.review_comment.created";
+  const repo = parsed.data.repository.full_name;
+  const resource = gitHubPullRequestResource({
+    number: parsed.data.pull_request.number,
+    repo
+  });
+  const author = parsed.data.comment.user?.login;
+  const data = pullRequestMatchData([
+    pullRequestDraftData(parsed.data.pull_request.draft),
+    pullRequestAuthorData(parsed.data.pull_request.user)
+  ]);
+  return pullRequestTargets2(
+    {
+      eventKey: gitHubEventKey2(deliveryId, eventType),
+      eventType,
+      occurredAtMs: Date.now(),
+      identifier: resource.identifier,
+      trustedSummary: `${resource.label} received an inline review comment${author ? ` from ${author}` : ""}.`,
+      ...data ? { data } : void 0,
+      untrustedText: parsed.data.comment.body
+    },
+    repo
+  );
+}
+var pullRequestReviewWebhookSchema = z2.object({
+  action: z2.string(),
+  pull_request: z2.object({
+    draft: z2.boolean().optional(),
+    number: z2.number(),
+    user: z2.object({
+      email: z2.string().optional().nullable(),
+      login: z2.string().optional().nullable()
+    }).optional().nullable()
+  }),
+  repository: repositorySchema2,
+  review: z2.object({
+    body: z2.string().optional().nullable(),
+    state: z2.string(),
+    user: z2.object({ login: z2.string().optional() }).optional()
+  })
+});
+function normalizePullRequestReviewEvent(deliveryId, body) {
+  const parsed = pullRequestReviewWebhookSchema.safeParse(body);
+  if (!parsed.success || parsed.data.action !== "submitted") return [];
+  const reviewState = parsed.data.review.state.toUpperCase();
+  const eventType = reviewState === "APPROVED" ? "pull_request.review.approved" : reviewState === "CHANGES_REQUESTED" ? "pull_request.review.changes_requested" : reviewState === "COMMENTED" ? "pull_request.review.commented" : void 0;
+  if (!eventType) return [];
+  const repo = parsed.data.repository.full_name;
+  const resource = gitHubPullRequestResource({
+    number: parsed.data.pull_request.number,
+    repo
+  });
+  const reviewer = parsed.data.review.user?.login;
+  const data = pullRequestMatchData([
+    pullRequestDraftData(parsed.data.pull_request.draft),
+    pullRequestAuthorData(parsed.data.pull_request.user)
+  ]);
+  return pullRequestTargets2(
+    {
+      eventKey: gitHubEventKey2(deliveryId, eventType),
+      eventType,
+      occurredAtMs: Date.now(),
+      identifier: resource.identifier,
+      trustedSummary: eventType === "pull_request.review.approved" ? `${resource.label} was approved${reviewer ? ` by ${reviewer}` : ""}.` : eventType === "pull_request.review.changes_requested" ? `${resource.label} received requested changes${reviewer ? ` from ${reviewer}` : ""}.` : `${resource.label} received a review comment${reviewer ? ` from ${reviewer}` : ""}.`,
+      ...data ? { data } : void 0,
+      untrustedText: parsed.data.review.body ?? void 0
+    },
+    repo
+  );
+}
+var pullRequestWebhookSchema = z2.object({
+  action: z2.string(),
+  pull_request: z2.object({
+    body: z2.string().optional().nullable(),
+    closed_at: z2.string().optional().nullable(),
+    created_at: z2.string().optional(),
+    draft: z2.boolean().optional(),
+    merged: z2.boolean().optional(),
+    merged_at: z2.string().optional().nullable(),
+    number: z2.number(),
+    title: z2.string().optional(),
+    updated_at: z2.string().optional(),
+    user: z2.object({
+      email: z2.string().optional().nullable(),
+      login: z2.string().optional().nullable()
+    }).optional().nullable()
+  }),
+  repository: repositorySchema2
+});
+function providerTime(value) {
+  if (!value) return void 0;
+  const parsed = Date.parse(value);
+  return Number.isFinite(parsed) ? parsed : void 0;
+}
+function pullRequestEventText(pullRequest) {
+  const parts = [
+    pullRequest.title ? `Title: ${pullRequest.title}` : void 0,
+    pullRequest.body?.trim() || void 0
+  ].filter((part) => part !== void 0);
+  return parts.length > 0 ? parts.join("\n\n") : void 0;
+}
+function pullRequestLifecycleEvents(input) {
+  const data = pullRequestMatchData([
+    pullRequestDraftData(input.isDraft),
+    pullRequestAuthorData({
+      email: input.authorEmail,
+      login: input.authorUsername
+    })
+  ]);
+  return pullRequestTargets2(
+    {
+      eventKey: gitHubEventKey2(input.deliveryId, input.eventType),
+      eventType: input.eventType,
+      occurredAtMs: input.occurredAtMs,
+      identifier: input.resource.identifier,
+      ...input.terminal ? { terminal: true } : void 0,
+      trustedSummary: input.trustedSummary,
+      ...data ? { data } : void 0,
+      ...input.untrustedText ? { untrustedText: input.untrustedText } : void 0
+    },
+    input.repo
+  );
+}
+function normalizePullRequestEvent(deliveryId, body) {
+  const parsed = pullRequestWebhookSchema.safeParse(body);
+  if (!parsed.success) return [];
+  const repo = parsed.data.repository.full_name;
+  const resource = gitHubPullRequestResource({
+    number: parsed.data.pull_request.number,
+    repo
+  });
+  const draft = parsed.data.pull_request.draft;
+  const isDraft = typeof draft === "boolean" ? draft : void 0;
+  const author = pullRequestAuthorData(parsed.data.pull_request.user);
+  const untrustedText = pullRequestEventText(parsed.data.pull_request);
+  if (parsed.data.action === "opened") {
+    const openedAtMs = providerTime(parsed.data.pull_request.created_at) ?? Date.now();
+    const events = pullRequestLifecycleEvents({
+      ...author,
+      deliveryId,
+      eventType: "pull_request.opened",
+      ...isDraft !== void 0 ? { isDraft } : void 0,
+      occurredAtMs: openedAtMs,
+      repo,
+      resource,
+      trustedSummary: `${resource.label} was opened.`,
+      untrustedText
+    });
+    if (draft !== true) {
+      events.push(
+        ...pullRequestLifecycleEvents({
+          ...author,
+          deliveryId,
+          eventType: "pull_request.ready_for_review",
+          isDraft: false,
+          occurredAtMs: openedAtMs,
+          repo,
+          resource,
+          trustedSummary: `${resource.label} is ready for review.`,
+          untrustedText
+        })
+      );
+    }
+    return events;
+  }
+  if (parsed.data.action === "ready_for_review") {
+    return pullRequestLifecycleEvents({
+      ...author,
+      deliveryId,
+      eventType: "pull_request.ready_for_review",
+      isDraft: false,
+      occurredAtMs: providerTime(parsed.data.pull_request.updated_at) ?? Date.now(),
+      repo,
+      resource,
+      trustedSummary: `${resource.label} is ready for review.`,
+      untrustedText
+    });
+  }
+  if (parsed.data.action !== "closed") return [];
+  const eventType = parsed.data.pull_request.merged ? "pull_request.merged" : "pull_request.closed_unmerged";
+  return pullRequestLifecycleEvents({
+    ...author,
+    deliveryId,
+    eventType,
+    ...isDraft !== void 0 ? { isDraft } : void 0,
+    occurredAtMs: providerTime(
+      parsed.data.pull_request.merged ? parsed.data.pull_request.merged_at : parsed.data.pull_request.closed_at
+    ) ?? Date.now(),
+    repo,
+    resource,
+    terminal: true,
+    trustedSummary: eventType === "pull_request.merged" ? `${resource.label} was merged.` : `${resource.label} was closed without being merged.`
+  });
+}
+var releaseWebhookSchema = z2.object({
+  action: z2.string(),
+  release: z2.object({
+    body: z2.string().optional().nullable(),
+    draft: z2.boolean().optional(),
+    id: z2.number(),
+    name: z2.string().optional().nullable(),
+    prerelease: z2.boolean().optional(),
+    published_at: z2.string().optional().nullable(),
+    tag_name: z2.string().min(1)
+  }).passthrough(),
+  repository: repositorySchema2
+}).passthrough();
+function releaseSourceTargets(input) {
+  return [
+    {
+      completeOnTerminalEvent: true,
+      resource: gitHubReleaseSourceResource(input)
+    },
+    {
+      completeOnTerminalEvent: false,
+      resource: gitHubReleaseSourceResource({ repo: input.repo })
+    }
+  ];
+}
+function normalizeReleaseEvent(deliveryId, body) {
+  const parsed = releaseWebhookSchema.safeParse(body);
+  if (!parsed.success || parsed.data.action !== "published") return [];
+  if (parsed.data.release.draft) return [];
+  const eventType = "release.published";
+  const repo = parsed.data.repository.full_name;
+  const tag = parsed.data.release.tag_name;
+  const untrustedParts = [
+    tag ? `Tag: ${tag}` : void 0,
+    parsed.data.release.name?.trim() ? `Name: ${parsed.data.release.name.trim()}` : void 0,
+    parsed.data.release.body?.trim() || void 0
+  ].filter((part) => part !== void 0);
+  const untrustedText = untrustedParts.length > 0 ? untrustedParts.join("\n\n") : void 0;
+  return releaseSourceTargets({ repo, tag }).map(
+    ({ completeOnTerminalEvent, resource }) => ({
+      eventKey: gitHubEventKey2(deliveryId, eventType),
+      eventType,
+      occurredAtMs: providerTime(parsed.data.release.published_at) ?? Date.now(),
+      identifier: resource.identifier,
+      ...completeOnTerminalEvent ? { terminal: true } : void 0,
+      trustedSummary: `${resource.label} was published (release ${parsed.data.release.id}).`,
+      ...untrustedText ? { untrustedText } : void 0
+    })
+  );
+}
+function normalizeGitHubResourceEvents(args) {
+  switch (args.eventName) {
+    case "deployment":
+      return normalizeDeploymentEvent(args.deliveryId, args.body);
+    case "deployment_status":
+      return normalizeDeploymentStatusEvent(args.deliveryId, args.body);
+    case "pull_request":
+      return normalizePullRequestEvent(args.deliveryId, args.body);
+    case "issues":
+      return normalizeIssueEvents(args.deliveryId, args.body);
+    case "pull_request_review":
+      return normalizePullRequestReviewEvent(args.deliveryId, args.body);
+    case "issue_comment":
+      return normalizeIssueCommentEvents(args.deliveryId, args.body);
+    case "pull_request_review_comment":
+      return normalizePullRequestReviewCommentEvent(args.deliveryId, args.body);
+    case "check_suite":
+      return normalizeCheckSuiteEvents(
+        args.deliveryId,
+        args.body,
+        args.checkSuiteFacts
+      );
+    case "release":
+      return normalizeReleaseEvent(args.deliveryId, args.body);
+    default:
+      return [];
+  }
+}
+
+export {
+  normalizePermissions,
+  readGrantPermissions,
+  GITHUB_ISSUE_EVENTS,
+  GITHUB_ISSUE_SUGGESTED_EVENTS,
+  gitHubIssueSubscribable,
+  GITHUB_DEPLOYMENT_EVENTS,
+  GITHUB_DEPLOYMENT_SUGGESTED_EVENTS,
+  gitHubDeploymentSourceSubscribable,
+  GITHUB_PULL_REQUEST_EVENTS,
+  GITHUB_PULL_REQUEST_SUGGESTED_EVENTS,
+  GITHUB_PULL_REQUEST_MATCH_FIELDS,
+  gitHubPullRequestSubscribable,
+  GITHUB_RELEASE_EVENTS,
+  GITHUB_RELEASE_SUGGESTED_EVENTS,
+  gitHubReleaseSourceSubscribable,
+  gitHubRepositorySubscribable,
+  GITHUB_APP_ID_ENV,
+  GITHUB_APP_PRIVATE_KEY_ENV,
+  GITHUB_INSTALLATION_ID_ENV,
+  GITHUB_AUTH_TOKEN_ENV,
+  GITHUB_AUTH_TOKEN_PLACEHOLDER,
+  GITHUB_GRAPHQL_RESPONSE_BODY_LIMIT_BYTES,
+  HTTP_READ_METHODS,
+  USER_TOKEN_GRANTS,
+  CREATE_TOOL_ROUTING_GUIDANCE,
+  USER_WRITE_REQUIREMENTS,
+  GitHubPluginSetupError,
+  isRecord,
+  readEnv,
+  requireEnv,
+  normalizeScopeList,
+  githubRequest,
+  credentialUnavailable,
+  githubRepositoryFromUrl,
+  githubRepositoryLeaseScope,
+  githubRepositoryFromLeaseScope,
+  resolveUserAccount,
+  issueUserCredential,
+  issueInstallationToken,
+  issueInstallationCredential,
+  createPermissionCache,
+  loadCheckSuiteFacts,
+  normalizeGitHubResourceEvents
+};