@sentry/junior-plugin-api 0.101.0 → 0.102.0

package/README.md

@@ -48,6 +48,9 @@ reports, migrations, and other typed hook surfaces exported by this package.
   execute through the host queue/callback lifecycle.
 - `ctx.agent.dispatch` creates durable agent work with an explicit actor,
   destination, source, metadata, and idempotency identity.
+- Delegated credential subjects declare the narrow action that authorized them.
+  Core owns runtime bindings; scheduler task subjects are accepted only from the
+  scheduler plugin and are bound to the exact task id.
 - Completed dispatch and task projections are durable plugin inputs, not an
   invitation to inspect unrestricted conversation state.
 

package/dist/index.js

@@ -7,6 +7,9 @@ var exactActorUserIdSchema = z.string().min(1).refine(
   (value) => value === value.trim() && value.toLowerCase() !== "unknown"
 );
 var nonBlankStringSchema = z.string().refine((value) => value.trim().length > 0);
+var exactNonBlankStringSchema = nonBlankStringSchema.refine(
+  (value) => value === value.trim()
+);
 var platformSchema = z.enum(["slack", "local"]);
 var sourceTypeSchema = z.enum(["pub", "priv"]);
 var slackAddressSchema = z.object({
@@ -37,11 +40,22 @@ var sourceSchema = z.discriminatedUnion("platform", [
   slackSourceSchema,
   localSourceSchema
 ]);
-var pluginCredentialSubjectSchema = z.object({
-  type: z.literal("user"),
-  userId: exactActorUserIdSchema,
-  allowedWhen: z.literal("private-direct-conversation")
-}).strict();
+var pluginCredentialSubjectSchema = z.discriminatedUnion(
+  "allowedWhen",
+  [
+    z.object({
+      type: z.literal("user"),
+      userId: exactActorUserIdSchema,
+      allowedWhen: z.literal("private-direct-conversation")
+    }).strict(),
+    z.object({
+      type: z.literal("user"),
+      userId: exactActorUserIdSchema,
+      allowedWhen: z.literal("scheduled-task"),
+      taskId: exactNonBlankStringSchema
+    }).strict()
+  ]
+);
 var actorProfileSchema = {
   email: nonBlankStringSchema.optional(),
   fullName: nonBlankStringSchema.optional(),

package/dist/schemas.d.ts

@@ -65,11 +65,16 @@ export declare const sourceSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     conversationId: z.ZodString;
 }, z.core.$strict>], "platform">;
 /** Stable user credential subject shape accepted from plugins. */
-export declare const pluginCredentialSubjectSchema: z.ZodObject<{
+export declare const pluginCredentialSubjectSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     type: z.ZodLiteral<"user">;
     userId: z.ZodString;
     allowedWhen: z.ZodLiteral<"private-direct-conversation">;
-}, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"user">;
+    userId: z.ZodString;
+    allowedWhen: z.ZodLiteral<"scheduled-task">;
+    taskId: z.ZodString;
+}, z.core.$strict>], "allowedWhen">;
 export declare const slackActorSchema: z.ZodObject<{
     platform: z.ZodLiteral<"slack">;
     teamId: z.ZodString;
@@ -110,11 +115,16 @@ export declare const actorSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
 /** Plugin dispatch request accepted by Junior core. */
 export declare const dispatchOptionsSchema: z.ZodObject<{
     idempotencyKey: z.ZodPipe<z.ZodString, z.ZodString>;
-    credentialSubject: z.ZodOptional<z.ZodObject<{
+    credentialSubject: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
         type: z.ZodLiteral<"user">;
         userId: z.ZodString;
         allowedWhen: z.ZodLiteral<"private-direct-conversation">;
-    }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        userId: z.ZodString;
+        allowedWhen: z.ZodLiteral<"scheduled-task">;
+        taskId: z.ZodString;
+    }, z.core.$strict>], "allowedWhen">>;
     destination: z.ZodObject<{
         platform: z.ZodLiteral<"slack">;
         teamId: z.ZodString;

package/dist/tools.d.ts

@@ -153,7 +153,9 @@ export interface SlackToolRegistrationHookContext {
         canCreateCanvas: boolean;
         canPostToChannel: boolean;
     };
-    credentialSubject?: PluginCredentialSubject;
+    credentialSubject?: Extract<PluginCredentialSubject, {
+        allowedWhen: "private-direct-conversation";
+    }>;
 }
 interface BaseToolRegistrationHookContext extends PluginContext {
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-plugin-api",
-  "version": "0.101.0",
+  "version": "0.102.0",
   "private": false,
   "publishConfig": {
     "access": "public"

package/src/schemas.ts

@@ -15,6 +15,9 @@ const exactActorUserIdSchema = z
 export const nonBlankStringSchema = z
   .string()
   .refine((value) => value.trim().length > 0);
+const exactNonBlankStringSchema = nonBlankStringSchema.refine(
+  (value) => value === value.trim(),
+);
 
 /** Runtime platform names supported by plugin public contracts. */
 export const platformSchema = z.enum(["slack", "local"]);
@@ -72,13 +75,26 @@ export const sourceSchema = z.discriminatedUnion("platform", [
 ]);
 
 /** Stable user credential subject shape accepted from plugins. */
-export const pluginCredentialSubjectSchema = z
-  .object({
-    type: z.literal("user"),
-    userId: exactActorUserIdSchema,
-    allowedWhen: z.literal("private-direct-conversation"),
-  })
-  .strict();
+export const pluginCredentialSubjectSchema = z.discriminatedUnion(
+  "allowedWhen",
+  [
+    z
+      .object({
+        type: z.literal("user"),
+        userId: exactActorUserIdSchema,
+        allowedWhen: z.literal("private-direct-conversation"),
+      })
+      .strict(),
+    z
+      .object({
+        type: z.literal("user"),
+        userId: exactActorUserIdSchema,
+        allowedWhen: z.literal("scheduled-task"),
+        taskId: exactNonBlankStringSchema,
+      })
+      .strict(),
+  ],
+);
 
 /** Shared exact actor profile fields for platform-scoped actors. */
 const actorProfileSchema = {

package/src/tools.ts

@@ -277,7 +277,10 @@ export interface SlackToolRegistrationHookContext {
     canCreateCanvas: boolean;
     canPostToChannel: boolean;
   };
-  credentialSubject?: PluginCredentialSubject;
+  credentialSubject?: Extract<
+    PluginCredentialSubject,
+    { allowedWhen: "private-direct-conversation" }
+  >;
 }
 
 interface BaseToolRegistrationHookContext extends PluginContext {