@sentry/junior 0.80.1 → 0.82.0

package/dist/app.js

@@ -10,13 +10,13 @@ import {
   buildDeliveredTurnStatePatch,
   buildDeterministicTurnId,
   clearPendingAuth,
-  clearSandboxEgressCredentialLease,
   coerceThreadArtifactsState,
   createConversationMemoryService,
   createUserTokenStore,
   deleteMcpAuthSession,
   deleteSlackMessage,
   estimateTextTokens,
+  executeCredentialedEgressRequest,
   finalizeMcpAuthorization,
   formatProviderLabel,
   generateAssistantReply,
@@ -30,7 +30,6 @@ import {
   getMcpStoredOAuthCredentials,
   getPersistedSandboxState,
   getPersistedThreadState,
-  getSandboxEgressCredentialLease,
   getThreadTitleSourceMessage,
   isAuthResumeRetryableTurnError,
   isCooperativeTurnYieldError,
@@ -39,12 +38,10 @@ import {
   isRedundantReactionAckText,
   isRetryableTurnError,
   isTurnInputCommitLostError,
-  issueProviderCredentialLease,
   listThreadReplies,
   markConversationMessage,
   markTurnClosed,
   markTurnFailed,
-  matchesSandboxEgressDomain,
   mergeArtifactsState,
   normalizeConversationText,
   normalizeSandboxEgressTracePropagationDomains,
@@ -57,12 +54,10 @@ import {
   removeReactionFromMessage,
   renderSlackLegacyAttachmentText,
   resolveBaseUrl,
+  resolvePluginOAuthAccount,
   resolveSandboxEgressProviderForHost,
   scheduleSessionCompletedPluginTasks,
   setConfigDefaults,
-  setSandboxEgressAuthRequiredSignal,
-  setSandboxEgressCredentialLease,
-  setSandboxEgressPermissionDeniedSignal,
   shouldEmitDevAgentTrace,
   shouldPropagateSandboxEgressTrace,
   startActiveTurn,
@@ -71,7 +66,7 @@ import {
   updateConversationStats,
   uploadFilesToThread,
   upsertConversationMessage
-} from "./chunk-W2QGQCKG.js";
+} from "./chunk-NC6LR6U4.js";
 import {
   CONVERSATION_WORK_CHECK_IN_INTERVAL_MS,
   CONVERSATION_WORK_STALE_ENQUEUE_MS,
@@ -149,7 +144,7 @@ import {
   setPlugins,
   validatePlugins,
   verifySlackDirectCredentialSubject
-} from "./chunk-Y3YUOEAZ.js";
+} from "./chunk-TR2G37II.js";
 import {
   createPluginLogger,
   createPluginState
@@ -203,7 +198,6 @@ import {
   discoverSkills
 } from "./chunk-WCXVEQPI.js";
 import {
-  CredentialUnavailableError,
   buildOAuthTokenRequest,
   hasRequiredOAuthScope,
   parseOAuthTokenResponse,
@@ -3548,194 +3542,6 @@ async function GET3(request, provider, waitUntil, options = {}) {
 // src/handlers/oauth-callback.ts
 import { THREAD_STATE_TTL_MS as THREAD_STATE_TTL_MS2 } from "chat";
 
-// src/chat/plugins/credential-hooks.ts
-import {
-  pluginAuthorizationSchema,
-  pluginCredentialResultSchema,
-  pluginGrantSchema,
-  pluginProviderAccountSchema
-} from "@sentry/junior-plugin-api";
-function parseSchema(schema, value, message) {
-  const result = schema.safeParse(value);
-  if (!result.success) {
-    throw new Error(message);
-  }
-  return result.data;
-}
-function parseAuthorization(value, pluginName) {
-  if (value === void 0) {
-    return void 0;
-  }
-  const authorization = parseSchema(
-    pluginAuthorizationSchema,
-    value,
-    `Plugin "${pluginName}" grant authorization is invalid`
-  );
-  if (authorization.provider !== pluginName) {
-    throw new Error(
-      `Plugin "${pluginName}" grant authorization provider must match the issuing plugin`
-    );
-  }
-  return authorization;
-}
-function parseGrant(value, pluginName) {
-  return parseSchema(
-    pluginGrantSchema,
-    value,
-    `Plugin "${pluginName}" grantForEgress returned an invalid grant`
-  );
-}
-function pluginFor(provider) {
-  return getPlugins().find((candidate) => candidate.manifest.name === provider);
-}
-function basePluginContext(plugin) {
-  const pluginName = plugin.manifest.name;
-  return {
-    plugin: { name: pluginName },
-    log: createPluginLogger(pluginName),
-    db: getDb()
-  };
-}
-function parseCredentialResult(value, pluginName) {
-  const result = parseSchema(
-    pluginCredentialResultSchema,
-    value,
-    `Plugin "${pluginName}" issueCredential result is invalid`
-  );
-  if (result.type === "lease") {
-    parseAuthorization(result.lease.authorization, pluginName);
-    return result;
-  }
-  if (result.type === "unavailable") {
-    return result;
-  }
-  parseAuthorization(result.authorization, pluginName);
-  return result;
-}
-async function selectPluginGrant(input) {
-  const plugin = pluginFor(input.provider);
-  const hook = plugin?.hooks?.grantForEgress;
-  if (!plugin || !hook) {
-    return void 0;
-  }
-  const result = await hook({
-    ...basePluginContext(plugin),
-    request: {
-      ...input.bodyText !== void 0 ? { bodyText: input.bodyText } : {},
-      method: input.method,
-      url: input.upstreamUrl.toString()
-    }
-  });
-  return result === void 0 ? void 0 : parseGrant(result, plugin.manifest.name);
-}
-async function onPluginEgressResponse(input) {
-  const plugin = pluginFor(input.provider);
-  const hook = plugin?.hooks?.onEgressResponse;
-  if (!plugin || !hook) {
-    return {};
-  }
-  let permissionDenied;
-  await hook({
-    ...basePluginContext(plugin),
-    grant: input.grant,
-    permissionDenied(message) {
-      const trimmed = message.trim();
-      if (!trimmed) {
-        throw new Error(
-          `Plugin "${plugin.manifest.name}" onEgressResponse permissionDenied message is empty`
-        );
-      }
-      permissionDenied = { message: trimmed };
-    },
-    request: {
-      method: input.method,
-      url: input.upstreamUrl.toString()
-    },
-    response: input.response
-  });
-  return permissionDenied ? { permissionDenied } : {};
-}
-function hasEgressCredentialHooks(provider) {
-  const hooks = pluginFor(provider)?.hooks;
-  return Boolean(hooks?.grantForEgress || hooks?.issueCredential);
-}
-async function resolvePluginOAuthAccount(input) {
-  const plugin = pluginFor(input.provider);
-  const hook = plugin?.hooks?.resolveOAuthAccount;
-  if (!plugin || !hook) {
-    return void 0;
-  }
-  const account = await hook({
-    ...basePluginContext(plugin),
-    tokens: input.tokens
-  });
-  return account === void 0 ? void 0 : parseSchema(
-    pluginProviderAccountSchema,
-    account,
-    `Plugin "${plugin.manifest.name}" resolveOAuthAccount returned an invalid account`
-  );
-}
-async function issuePluginCredential(input) {
-  const plugin = pluginFor(input.provider);
-  const hook = plugin?.hooks?.issueCredential;
-  if (!plugin || !hook) {
-    throw new Error(`Plugin "${input.provider}" has no issueCredential hook`);
-  }
-  const currentUserId = input.actor.type === "user" ? input.actor.userId : void 0;
-  const credentialSubjectUserId = input.credentialSubject?.userId;
-  const result = await hook({
-    ...basePluginContext(plugin),
-    actor: input.actor,
-    grant: input.grant,
-    ...input.credentialSubject ? { credentialSubject: input.credentialSubject } : {},
-    tokens: {
-      ...currentUserId ? {
-        currentUser: {
-          userId: currentUserId,
-          get: async () => await input.userTokenStore.get(
-            currentUserId,
-            plugin.manifest.name
-          ),
-          set: async (tokens) => {
-            await input.userTokenStore.set(
-              currentUserId,
-              plugin.manifest.name,
-              tokens
-            );
-          },
-          withRefresh: async (callback) => await input.userTokenStore.withRefresh(
-            currentUserId,
-            plugin.manifest.name,
-            callback
-          )
-        }
-      } : {},
-      ...credentialSubjectUserId ? {
-        credentialSubject: {
-          userId: credentialSubjectUserId,
-          get: async () => await input.userTokenStore.get(
-            credentialSubjectUserId,
-            plugin.manifest.name
-          ),
-          set: async (tokens) => {
-            await input.userTokenStore.set(
-              credentialSubjectUserId,
-              plugin.manifest.name,
-              tokens
-            );
-          },
-          withRefresh: async (callback) => await input.userTokenStore.withRefresh(
-            credentialSubjectUserId,
-            plugin.manifest.name,
-            callback
-          )
-        }
-      } : {}
-    }
-  });
-  return parseCredentialResult(result, plugin.manifest.name);
-}
-
 // src/chat/slack/app-home.ts
 import fs from "fs";
 import path from "path";
@@ -4554,174 +4360,7 @@ async function GET4(request, provider, waitUntil, options = {}) {
   });
 }
 
-// src/chat/sandbox/egress-credentials.ts
-var HTTP_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
-var SandboxEgressCredentialError = class extends Error {
-  authorization;
-  grant;
-  kind;
-  provider;
-  constructor(input) {
-    super(input.message);
-    this.name = "SandboxEgressCredentialError";
-    this.authorization = input.authorization;
-    this.grant = input.grant;
-    this.kind = input.kind;
-    this.provider = input.provider;
-  }
-};
-function defaultGrantForProvider(input) {
-  const access = HTTP_READ_METHODS.has(
-    input.method.toUpperCase()
-  ) ? "read" : "write";
-  return {
-    source: "broker",
-    grant: {
-      name: "default",
-      access,
-      reason: `sandbox-egress:${input.provider}:${access}`
-    }
-  };
-}
-function oauthAuthorizationForProvider(provider) {
-  const oauth = pluginCatalogRuntime.getOAuthConfig(provider);
-  return oauth ? {
-    type: "oauth",
-    provider,
-    ...oauth.scope ? { scope: oauth.scope } : {}
-  } : void 0;
-}
-function credentialSubjectFromContext(context) {
-  return "subject" in context.credentials && context.credentials.subject ? { type: "user", userId: context.credentials.subject.userId } : void 0;
-}
-function assertLeaseTransformsOwnedByProvider(provider, lease) {
-  for (const transform of lease.headerTransforms) {
-    if (resolveSandboxEgressProviderForHost(transform.domain) !== provider) {
-      throw new Error(
-        `Credential lease for ${provider} included header transform for unowned domain ${transform.domain}`
-      );
-    }
-  }
-}
-async function selectSandboxEgressGrant(input) {
-  if (!hasEgressCredentialHooks(input.provider)) {
-    return defaultGrantForProvider(input);
-  }
-  const pluginGrant = await selectPluginGrant({
-    ...input.bodyText !== void 0 ? { bodyText: input.bodyText } : {},
-    provider: input.provider,
-    method: input.method,
-    upstreamUrl: input.upstreamUrl
-  });
-  if (!pluginGrant) {
-    throw new Error(
-      `Plugin "${input.provider}" grantForEgress must return a grant for sandbox egress`
-    );
-  }
-  return { source: "plugin", grant: pluginGrant };
-}
-function authorizationForSandboxEgressGrant(provider, selection) {
-  return selection.source === "broker" ? oauthAuthorizationForProvider(provider) : void 0;
-}
-async function sandboxEgressCredentialLease(provider, selection, context) {
-  const { grant } = selection;
-  const cached = await getSandboxEgressCredentialLease(
-    provider,
-    grant.name,
-    context
-  );
-  if (cached) {
-    if (selection.source === "plugin" && cached.grant.access !== grant.access) {
-      throw new Error(
-        `Cached credential lease for ${provider}/${grant.name} has ${cached.grant.access} access, but ${grant.access} was selected`
-      );
-    }
-    return {
-      ...cached,
-      grant
-    };
-  }
-  let lease;
-  if (selection.source === "plugin") {
-    const credentialSubject = credentialSubjectFromContext(context);
-    const pluginResult = await issuePluginCredential({
-      provider,
-      grant,
-      actor: context.credentials.actor,
-      ...credentialSubject ? { credentialSubject } : {},
-      userTokenStore: createUserTokenStore()
-    });
-    if (pluginResult.type === "needed") {
-      throw new SandboxEgressCredentialError({
-        provider,
-        grant,
-        kind: "auth_required",
-        authorization: pluginResult.authorization,
-        message: pluginResult.message
-      });
-    }
-    if (pluginResult.type === "unavailable") {
-      throw new SandboxEgressCredentialError({
-        provider,
-        grant,
-        kind: "unavailable",
-        message: pluginResult.message
-      });
-    }
-    lease = pluginResult.lease;
-  } else {
-    try {
-      lease = await issueProviderCredentialLease({
-        context: context.credentials,
-        provider,
-        reason: grant.reason ?? `sandbox-egress:${provider}:default`
-      });
-    } catch (error) {
-      if (error instanceof CredentialUnavailableError) {
-        throw new SandboxEgressCredentialError({
-          provider,
-          grant,
-          kind: "auth_required",
-          authorization: authorizationForSandboxEgressGrant(
-            provider,
-            selection
-          ),
-          message: error.message
-        });
-      }
-      throw error;
-    }
-  }
-  const headerTransforms = lease.headerTransforms ?? [];
-  if (headerTransforms.length === 0) {
-    throw new Error(
-      `Credential lease for ${provider} did not include header transforms`
-    );
-  }
-  const leaseExpiresAtMs = Date.parse(lease.expiresAt);
-  if (!Number.isFinite(leaseExpiresAtMs) || leaseExpiresAtMs <= Date.now()) {
-    throw new Error(`Credential lease for ${provider} is expired`);
-  }
-  const authorization = selection.source === "broker" ? oauthAuthorizationForProvider(provider) : lease.authorization;
-  const cachedLease = {
-    provider,
-    grant,
-    ...lease.account ? { account: lease.account } : {},
-    ...authorization ? { authorization } : {},
-    expiresAt: lease.expiresAt,
-    headerTransforms
-  };
-  assertLeaseTransformsOwnedByProvider(provider, cachedLease);
-  await setSandboxEgressCredentialLease(context, cachedLease);
-  return cachedLease;
-}
-function hasSandboxEgressLeaseTransformForHost(lease, host) {
-  return lease.headerTransforms.some(
-    (transform) => matchesSandboxEgressDomain(host, transform.domain)
-  );
-}
-
-// src/chat/sandbox/egress-oidc.ts
+// src/chat/sandbox/egress/oidc.ts
 import {
   createRemoteJWKSet,
   decodeJwt,
@@ -4791,71 +4430,19 @@ async function verifyVercelSandboxOidcToken(token) {
   return verified.payload;
 }
 
-// src/chat/sandbox/egress-proxy.ts
-import { EgressAuthRequired } from "@sentry/junior-plugin-api";
+// src/chat/sandbox/egress/proxy.ts
 var OIDC_TOKEN_HEADER = "vercel-sandbox-oidc-token";
 var FORWARDED_HOST_HEADER = "vercel-forwarded-host";
 var FORWARDED_SCHEME_HEADER = "vercel-forwarded-scheme";
 var FORWARDED_PORT_HEADER = "vercel-forwarded-port";
 var FORWARDED_PATH_HEADER = "vercel-forwarded-path";
-var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
-  "connection",
-  "host",
-  "keep-alive",
-  "proxy-authenticate",
-  "proxy-authorization",
-  "te",
-  "trailer",
-  "transfer-encoding",
-  "upgrade"
-]);
-var PROXY_ONLY_HEADERS = /* @__PURE__ */ new Set([
-  OIDC_TOKEN_HEADER,
-  FORWARDED_HOST_HEADER,
-  FORWARDED_SCHEME_HEADER,
-  FORWARDED_PORT_HEADER,
-  FORWARDED_PATH_HEADER
-]);
-var TRACE_PROPAGATION_HEADERS = /* @__PURE__ */ new Set([
-  "baggage",
-  "sentry-trace",
-  "traceparent"
-]);
-var DECODED_RESPONSE_HEADERS = /* @__PURE__ */ new Set([
-  "content-encoding",
-  "content-length"
-]);
-var UPSTREAM_TOKEN_REJECTION_STATUS = 401;
-var UPSTREAM_PERMISSION_REJECTION_STATUS = 403;
-var GRANT_SELECTION_BODY_TEXT_LIMIT_BYTES = 64 * 1024;
-var RESPONSE_BODY_TEXT_LIMIT_BYTES = 64 * 1024;
 function jsonError(message, status) {
   return Response.json({ error: message }, { status });
 }
-function authRequiredResponse(input) {
-  return new Response(
-    `junior-auth-required provider=${input.provider} grant=${input.grant.name} access=${input.grant.access} 401 unauthorized
-${input.message}`,
-    {
-      status: 401,
-      headers: {
-        "content-type": "text/plain; charset=utf-8",
-        "cache-control": "no-store"
-      }
-    }
-  );
-}
-function shouldLogSandboxEgressInfo() {
-  const environment = (process.env.SENTRY_ENVIRONMENT ?? process.env.VERCEL_ENV ?? process.env.NODE_ENV ?? "").trim().toLowerCase();
-  return environment !== "production";
-}
 function egressAttributes(input) {
   return {
     ...input.egressId ? { "app.sandbox.egress_id": input.egressId } : {},
     ...input.provider ? { "app.provider.name": input.provider } : {},
-    ...input.grantName ? { "app.grant.name": input.grantName } : {},
-    ...input.grantAccess ? { "app.grant.access": input.grantAccess } : {},
-    ...input.grantReason ? { "app.grant.reason": input.grantReason } : {},
     ...input.host ? { "server.address": input.host } : {},
     ...input.method ? { "http.request.method": input.method } : {},
     ...input.path ? { "url.path": input.path } : {},
@@ -4898,63 +4485,6 @@ function routingAttributes(request, upstreamUrl) {
   }
   return attributes;
 }
-function displayedUpstreamPath(upstreamUrl) {
-  const gitService = upstreamUrl.searchParams.get("service");
-  if (upstreamUrl.hostname.toLowerCase() === "github.com" && (gitService === "git-upload-pack" || gitService === "git-receive-pack")) {
-    return `${upstreamUrl.pathname}?service=${gitService}`;
-  }
-  return upstreamUrl.pathname;
-}
-function upstreamPermissionAttributes(provider, upstream) {
-  if (provider !== "github") {
-    return {};
-  }
-  return {
-    "app.github.accepted_permissions": upstream.headers.get("x-accepted-github-permissions") ?? void 0,
-    "app.github.sso": upstream.headers.get("x-github-sso") ?? void 0
-  };
-}
-function githubPermissionHeaders(upstream) {
-  const acceptedPermissions = upstream.headers.get(
-    "x-accepted-github-permissions"
-  );
-  const sso = upstream.headers.get("x-github-sso");
-  return {
-    ...acceptedPermissions ? { acceptedPermissions } : {},
-    ...sso ? { sso } : {}
-  };
-}
-function permissionDeniedMessage(provider, grant) {
-  return `${provider} returned HTTP 403 after Junior injected the ${grant.name} grant. Junior forwarded the request; this is not a local runtime block.`;
-}
-function isEgressAuthRequired(error) {
-  return error instanceof EgressAuthRequired || error instanceof Error && error.name === "EgressAuthRequired";
-}
-function logSandboxEgressUpstreamRequest(input) {
-  if (!shouldLogSandboxEgressInfo()) {
-    return;
-  }
-  logInfo(
-    "sandbox_egress_upstream_request",
-    {},
-    {
-      ...egressAttributes({
-        egressId: input.egressId,
-        grantAccess: input.grantAccess,
-        grantName: input.grantName,
-        grantReason: input.grantReason,
-        host: input.upstreamUrl.hostname,
-        method: input.request.method,
-        path: input.upstreamUrl.pathname,
-        provider: input.provider,
-        status: input.upstream.status
-      }),
-      ...routingAttributes(input.request, input.upstreamUrl),
-      "app.sandbox.egress.upstream_ok": input.upstream.ok
-    },
-    `Sandbox egress ${input.request.method} ${input.upstreamUrl.hostname}${displayedUpstreamPath(input.upstreamUrl)} -> ${input.upstream.status}`
-  );
-}
 function normalizeHost(value) {
   const trimmed = value.trim().toLowerCase();
   if (!trimmed || trimmed.includes("/") || trimmed.includes("\\") || trimmed.includes(":")) {
@@ -5032,123 +4562,6 @@ function buildUpstreamUrl(request) {
     return { ok: false, error: "Invalid forwarded URL" };
   }
 }
-async function requestBodyBytes(request) {
-  if (request.method === "GET" || request.method === "HEAD" || request.body === null) {
-    return void 0;
-  }
-  return await request.arrayBuffer();
-}
-function isGrantSelectionBodyVisible(input) {
-  return input.provider === "github" && input.upstreamUrl.hostname.toLowerCase() === "api.github.com" && input.upstreamUrl.pathname.toLowerCase().endsWith("/graphql");
-}
-function requestBodyText(body) {
-  if (body === void 0 || body.byteLength > GRANT_SELECTION_BODY_TEXT_LIMIT_BYTES) {
-    return void 0;
-  }
-  return new TextDecoder().decode(body);
-}
-function responseContentLength(upstream) {
-  const raw = upstream.headers.get("content-length");
-  if (!raw) {
-    return void 0;
-  }
-  const parsed = Number(raw);
-  return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : void 0;
-}
-async function responseTextWithinLimit(upstream, maxBytes) {
-  const limit = Math.min(
-    Math.max(0, Math.floor(maxBytes)),
-    RESPONSE_BODY_TEXT_LIMIT_BYTES
-  );
-  if (limit <= 0) {
-    return void 0;
-  }
-  const contentLength = responseContentLength(upstream);
-  if (contentLength !== void 0 && contentLength > limit) {
-    return void 0;
-  }
-  let clone;
-  try {
-    clone = upstream.clone();
-  } catch {
-    return void 0;
-  }
-  const body = clone.body;
-  if (!body) {
-    return "";
-  }
-  const reader = body.getReader();
-  const chunks = [];
-  let bytes = 0;
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) {
-        break;
-      }
-      if (!value) {
-        continue;
-      }
-      bytes += value.byteLength;
-      if (bytes > limit) {
-        await reader.cancel().catch(() => void 0);
-        return void 0;
-      }
-      chunks.push(value);
-    }
-  } catch {
-    await reader.cancel().catch(() => void 0);
-    return void 0;
-  } finally {
-    reader.releaseLock();
-  }
-  const combined = new Uint8Array(bytes);
-  let offset = 0;
-  for (const chunk of chunks) {
-    combined.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return new TextDecoder().decode(combined);
-}
-function requestHeaders(request, lease, upstreamHost, tracePropagation) {
-  const headers = new Headers();
-  const mayPropagateTrace = shouldPropagateSandboxEgressTrace(
-    upstreamHost,
-    tracePropagation
-  );
-  request.headers.forEach((value, key) => {
-    const normalized = key.toLowerCase();
-    if (HOP_BY_HOP_HEADERS.has(normalized) || PROXY_ONLY_HEADERS.has(normalized)) {
-      return;
-    }
-    if (TRACE_PROPAGATION_HEADERS.has(normalized) && !mayPropagateTrace) {
-      return;
-    }
-    headers.append(key, value);
-  });
-  for (const transform of lease.headerTransforms) {
-    if (!matchesSandboxEgressDomain(upstreamHost, transform.domain)) {
-      continue;
-    }
-    for (const [key, value] of Object.entries(transform.headers)) {
-      if (TRACE_PROPAGATION_HEADERS.has(key.toLowerCase()) && !mayPropagateTrace) {
-        continue;
-      }
-      headers.set(key, value);
-    }
-  }
-  return headers;
-}
-function responseHeaders(upstream) {
-  const headers = new Headers();
-  upstream.headers.forEach((value, key) => {
-    const normalized = key.toLowerCase();
-    if (!HOP_BY_HOP_HEADERS.has(normalized) && !DECODED_RESPONSE_HEADERS.has(normalized)) {
-      headers.append(key, value);
-    }
-  });
-  return headers;
-}
 function continueSandboxEgressTrace(request, upstreamHost, tracePropagation, callback) {
   const sentryTrace = request.headers.get("sentry-trace") ?? void 0;
   const baggage = request.headers.get("baggage") ?? void 0;
@@ -5167,9 +4580,6 @@ function isSandboxEgressForwardedRequest(request) {
   );
 }
 async function proxySandboxEgressRequest(request, deps = {}) {
-  return await proxySandboxEgressRequestImpl(request, deps);
-}
-async function proxySandboxEgressRequestImpl(request, deps) {
   const oidcToken = request.headers.get(OIDC_TOKEN_HEADER)?.trim();
   if (!oidcToken) {
     return jsonError("Missing Vercel Sandbox OIDC token", 401);
@@ -5273,7 +4683,7 @@ async function proxySandboxEgressRequestImpl(request, deps) {
     request,
     upstreamUrl.hostname,
     deps.tracePropagation ?? {},
-    async () => await proxySandboxEgressVerifiedRequest({
+    async () => await executeCredentialedEgressRequest({
       activeEgressId,
       credentialContext,
       deps,
@@ -5283,314 +4693,6 @@ async function proxySandboxEgressRequestImpl(request, deps) {
     })
   );
 }
-async function proxySandboxEgressVerifiedRequest(input) {
-  const {
-    activeEgressId,
-    credentialContext,
-    deps,
-    provider,
-    request,
-    upstreamUrl
-  } = input;
-  let body;
-  let bodyRead = false;
-  if (isGrantSelectionBodyVisible({ provider, upstreamUrl })) {
-    body = await requestBodyBytes(request);
-    bodyRead = true;
-  }
-  const grantSelection = await selectSandboxEgressGrant({
-    bodyText: requestBodyText(body),
-    provider,
-    method: request.method,
-    upstreamUrl
-  });
-  let lease;
-  try {
-    lease = await sandboxEgressCredentialLease(
-      provider,
-      grantSelection,
-      credentialContext
-    );
-  } catch (error) {
-    if (error instanceof SandboxEgressCredentialError) {
-      await setSandboxEgressAuthRequiredSignal(credentialContext, {
-        provider: error.provider,
-        grant: error.grant,
-        kind: error.kind,
-        ...error.authorization ? { authorization: error.authorization } : {},
-        message: error.message
-      });
-      const isAuthRequired = error.kind === "auth_required";
-      logWarn(
-        isAuthRequired ? "sandbox_egress_credential_needed" : "sandbox_egress_credential_unavailable",
-        {},
-        {
-          ...egressAttributes({
-            egressId: activeEgressId,
-            grantAccess: error.grant.access,
-            grantName: error.grant.name,
-            grantReason: error.grant.reason,
-            host: upstreamUrl.hostname,
-            method: request.method,
-            path: upstreamUrl.pathname,
-            provider: error.provider,
-            status: 401
-          }),
-          ...routingAttributes(request, upstreamUrl)
-        },
-        isAuthRequired ? "Sandbox egress grant needs user authorization before issuing a credential lease" : "Sandbox egress credential lease is unavailable for selected grant"
-      );
-      return authRequiredResponse({
-        provider: error.provider,
-        grant: error.grant,
-        message: error.message
-      });
-    }
-    throw error;
-  }
-  if (!hasSandboxEgressLeaseTransformForHost(lease, upstreamUrl.hostname)) {
-    logWarn(
-      "sandbox_egress_transform_missing",
-      {},
-      {
-        ...egressAttributes({
-          egressId: activeEgressId,
-          grantAccess: lease.grant.access,
-          grantName: lease.grant.name,
-          grantReason: lease.grant.reason,
-          host: upstreamUrl.hostname,
-          method: request.method,
-          path: upstreamUrl.pathname,
-          provider,
-          status: 403
-        }),
-        "app.sandbox.egress.transform_domains": lease.headerTransforms.map(
-          (transform) => transform.domain
-        ),
-        ...routingAttributes(request, upstreamUrl)
-      },
-      "Sandbox egress credential lease does not cover forwarded host"
-    );
-    return jsonError("Credential lease does not cover forwarded host", 403);
-  }
-  const fetchImpl = deps.fetch ?? fetch;
-  const headers = requestHeaders(
-    request,
-    lease,
-    upstreamUrl.hostname,
-    deps.tracePropagation ?? {}
-  );
-  if (!bodyRead) {
-    body = await requestBodyBytes(request);
-  }
-  const intercepted = await deps.interceptHttp?.({
-    provider,
-    request: new Request(upstreamUrl, {
-      method: request.method,
-      headers,
-      ...body !== void 0 ? { body } : {}
-    }),
-    upstreamUrl
-  });
-  if (intercepted) {
-    return intercepted;
-  }
-  const upstream = await fetchImpl(upstreamUrl, {
-    method: request.method,
-    headers,
-    ...body !== void 0 ? { body } : {},
-    redirect: "manual"
-  });
-  try {
-    const effects = await onPluginEgressResponse({
-      provider,
-      grant: lease.grant,
-      method: request.method,
-      upstreamUrl,
-      response: {
-        headers: new Headers(upstream.headers),
-        readText: async (maxBytes) => await responseTextWithinLimit(upstream, maxBytes),
-        status: upstream.status
-      }
-    });
-    if (effects.permissionDenied) {
-      await setSandboxEgressPermissionDeniedSignal(credentialContext, {
-        provider,
-        grant: lease.grant,
-        ...lease.account ? { account: lease.account } : {},
-        message: effects.permissionDenied.message,
-        source: "upstream",
-        status: upstream.status,
-        upstreamHost: upstreamUrl.hostname,
-        upstreamPath: displayedUpstreamPath(upstreamUrl),
-        ...provider === "github" ? githubPermissionHeaders(upstream) : {}
-      });
-      logWarn(
-        "sandbox_egress_upstream_permission_classified",
-        {},
-        {
-          ...egressAttributes({
-            egressId: activeEgressId,
-            grantAccess: lease.grant.access,
-            grantName: lease.grant.name,
-            grantReason: lease.grant.reason,
-            host: upstreamUrl.hostname,
-            method: request.method,
-            path: upstreamUrl.pathname,
-            provider,
-            status: upstream.status
-          }),
-          ...routingAttributes(request, upstreamUrl),
-          ...upstreamPermissionAttributes(provider, upstream)
-        },
-        "Sandbox egress plugin classified upstream response as permission denied"
-      );
-    }
-  } catch (error) {
-    if (!isEgressAuthRequired(error)) {
-      throw error;
-    }
-    await clearSandboxEgressCredentialLease(
-      provider,
-      lease.grant.name,
-      credentialContext
-    );
-    await setSandboxEgressAuthRequiredSignal(credentialContext, {
-      provider,
-      grant: lease.grant,
-      kind: "auth_required",
-      ...error.authorization ?? lease.authorization ? { authorization: error.authorization ?? lease.authorization } : {},
-      message: error.message
-    });
-    logWarn(
-      "sandbox_egress_upstream_auth_required_classified",
-      {},
-      {
-        ...egressAttributes({
-          egressId: activeEgressId,
-          grantAccess: lease.grant.access,
-          grantName: lease.grant.name,
-          grantReason: lease.grant.reason,
-          host: upstreamUrl.hostname,
-          method: request.method,
-          path: upstreamUrl.pathname,
-          provider,
-          status: upstream.status
-        }),
-        ...routingAttributes(request, upstreamUrl),
-        ...upstreamPermissionAttributes(provider, upstream)
-      },
-      "Sandbox egress plugin classified upstream response as auth required"
-    );
-    await upstream.body?.cancel().catch(() => void 0);
-    return authRequiredResponse({
-      provider,
-      grant: lease.grant,
-      message: error.message
-    });
-  }
-  logSandboxEgressUpstreamRequest({
-    egressId: activeEgressId,
-    grantAccess: lease.grant.access,
-    grantName: lease.grant.name,
-    grantReason: lease.grant.reason,
-    provider,
-    request,
-    upstream,
-    upstreamUrl
-  });
-  if (upstream.status >= 400) {
-    logWarn(
-      "sandbox_egress_upstream_error_response",
-      {},
-      {
-        ...egressAttributes({
-          egressId: activeEgressId,
-          grantAccess: lease.grant.access,
-          grantName: lease.grant.name,
-          grantReason: lease.grant.reason,
-          host: upstreamUrl.hostname,
-          method: request.method,
-          path: upstreamUrl.pathname,
-          provider,
-          status: upstream.status
-        }),
-        ...routingAttributes(request, upstreamUrl),
-        ...upstreamPermissionAttributes(provider, upstream),
-        "error.type": `http_${upstream.status}`
-      },
-      `Sandbox egress upstream returned HTTP ${upstream.status}`
-    );
-  }
-  if (upstream.status === UPSTREAM_TOKEN_REJECTION_STATUS || upstream.status === UPSTREAM_PERMISSION_REJECTION_STATUS) {
-    logWarn(
-      "sandbox_egress_upstream_auth_rejected",
-      {},
-      {
-        ...egressAttributes({
-          egressId: activeEgressId,
-          grantAccess: lease.grant.access,
-          grantName: lease.grant.name,
-          grantReason: lease.grant.reason,
-          host: upstreamUrl.hostname,
-          method: request.method,
-          path: upstreamUrl.pathname,
-          provider,
-          status: upstream.status
-        }),
-        ...routingAttributes(request, upstreamUrl),
-        ...upstreamPermissionAttributes(provider, upstream),
-        ...upstream.status === UPSTREAM_TOKEN_REJECTION_STATUS ? {
-          "app.sandbox.egress.www_authenticate": upstream.headers.get("www-authenticate") ?? void 0
-        } : {}
-      },
-      upstream.status === UPSTREAM_TOKEN_REJECTION_STATUS ? "Sandbox egress upstream auth rejected injected credential" : "Sandbox egress upstream permission denied"
-    );
-    if (upstream.status === UPSTREAM_TOKEN_REJECTION_STATUS) {
-      await clearSandboxEgressCredentialLease(
-        provider,
-        lease.grant.name,
-        credentialContext
-      );
-      await setSandboxEgressAuthRequiredSignal(credentialContext, {
-        provider,
-        grant: lease.grant,
-        kind: "auth_required",
-        ...lease.authorization ? { authorization: lease.authorization } : {},
-        message: `Provider rejected the injected ${provider} credential.`
-      });
-      await upstream.body?.cancel().catch(() => void 0);
-      return authRequiredResponse({
-        provider,
-        grant: lease.grant,
-        message: `Provider rejected the injected ${provider} credential.
-`
-      });
-    } else {
-      await clearSandboxEgressCredentialLease(
-        provider,
-        lease.grant.name,
-        credentialContext
-      );
-      await setSandboxEgressPermissionDeniedSignal(credentialContext, {
-        provider,
-        grant: lease.grant,
-        ...lease.account ? { account: lease.account } : {},
-        message: permissionDeniedMessage(provider, lease.grant),
-        source: "upstream",
-        status: UPSTREAM_PERMISSION_REJECTION_STATUS,
-        upstreamHost: upstreamUrl.hostname,
-        upstreamPath: displayedUpstreamPath(upstreamUrl),
-        ...provider === "github" ? githubPermissionHeaders(upstream) : {}
-      });
-    }
-  }
-  return new Response(upstream.body, {
-    status: upstream.status,
-    statusText: upstream.statusText,
-    headers: responseHeaders(upstream)
-  });
-}
 
 // src/handlers/sandbox-egress-proxy.ts
 async function ALL(request, options = {}) {