@sentry/junior 0.100.0 → 0.102.0

package/dist/chat/credentials/context.d.ts

@@ -1,15 +1,20 @@
 import { z } from "zod";
-declare const credentialSubjectBindingSchema: z.ZodObject<{
+declare const credentialSubjectBindingSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     type: z.ZodLiteral<"slack-direct-conversation">;
     teamId: z.ZodString;
     channelId: z.ZodString;
     signature: z.ZodString;
-}, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"scheduled-task">;
+    plugin: z.ZodString;
+    taskId: z.ZodString;
+    signature: z.ZodString;
+}, z.core.$strict>], "type">;
 declare const credentialSystemActorSchema: z.ZodObject<{
     platform: z.ZodLiteral<"system">;
     name: z.ZodString;
 }, z.core.$strict>;
-export declare const credentialSubjectSchema: z.ZodObject<{
+export declare const credentialSubjectSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     type: z.ZodLiteral<"user">;
     userId: z.ZodString;
     allowedWhen: z.ZodLiteral<"private-direct-conversation">;
@@ -19,7 +24,18 @@ export declare const credentialSubjectSchema: z.ZodObject<{
         channelId: z.ZodString;
         signature: z.ZodString;
     }, z.core.$strict>;
-}, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"user">;
+    userId: z.ZodString;
+    allowedWhen: z.ZodLiteral<"scheduled-task">;
+    taskId: z.ZodString;
+    binding: z.ZodObject<{
+        type: z.ZodLiteral<"scheduled-task">;
+        plugin: z.ZodString;
+        taskId: z.ZodString;
+        signature: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>], "allowedWhen">;
 export declare const credentialContextSchema: z.ZodUnion<readonly [z.ZodObject<{
     actor: z.ZodObject<{
         type: z.ZodLiteral<"user">;
@@ -30,7 +46,7 @@ export declare const credentialContextSchema: z.ZodUnion<readonly [z.ZodObject<{
         platform: z.ZodLiteral<"system">;
         name: z.ZodString;
     }, z.core.$strict>;
-    subject: z.ZodOptional<z.ZodObject<{
+    subject: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
         type: z.ZodLiteral<"user">;
         userId: z.ZodString;
         allowedWhen: z.ZodLiteral<"private-direct-conversation">;
@@ -40,7 +56,18 @@ export declare const credentialContextSchema: z.ZodUnion<readonly [z.ZodObject<{
             channelId: z.ZodString;
             signature: z.ZodString;
         }, z.core.$strict>;
-    }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        userId: z.ZodString;
+        allowedWhen: z.ZodLiteral<"scheduled-task">;
+        taskId: z.ZodString;
+        binding: z.ZodObject<{
+            type: z.ZodLiteral<"scheduled-task">;
+            plugin: z.ZodString;
+            taskId: z.ZodString;
+            signature: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>], "allowedWhen">>;
 }, z.core.$strict>]>;
 export type CredentialSubjectBinding = z.output<typeof credentialSubjectBindingSchema>;
 export type CredentialSystemActor = z.output<typeof credentialSystemActorSchema>;

package/dist/chat/credentials/subject.d.ts

@@ -1,11 +1,14 @@
 import type { PluginCredentialSubject } from "@sentry/junior-plugin-api";
 import type { CredentialSubject } from "@/chat/credentials/context";
+type SlackDirectPluginCredentialSubject = Extract<PluginCredentialSubject, {
+    allowedWhen: "private-direct-conversation";
+}>;
 /** Create a delegated user credential subject for a verified Slack DM turn. */
 export declare function createSlackDirectCredentialSubject(input: {
     channelId: string | undefined;
     teamId: string | undefined;
     userId: string | undefined;
-}): PluginCredentialSubject | undefined;
+}): SlackDirectPluginCredentialSubject | undefined;
 /** Bind a delegated user subject to the Slack DM destination being dispatched. */
 export declare function bindSlackDirectCredentialSubject(input: {
     channelId: string;
@@ -18,3 +21,14 @@ export declare function verifySlackDirectCredentialSubject(input: {
     subject: CredentialSubject;
     teamId: string;
 }): boolean;
+/** Bind a delegated user subject to one scheduler task dispatch. */
+export declare function bindScheduledTaskCredentialSubject(input: {
+    plugin: string;
+    subject: PluginCredentialSubject;
+}): CredentialSubject | undefined;
+/** Verify that a delegated subject was signed for one scheduler task. */
+export declare function verifyScheduledTaskCredentialSubject(input: {
+    plugin: string;
+    subject: CredentialSubject;
+}): boolean;
+export {};

package/dist/chat/logging.d.ts

@@ -53,6 +53,8 @@ export declare function createChatSdkLogger(): ChatSdkLogger;
 export declare function withLogContext<T>(context: LogContext, callback: () => Promise<T>): Promise<T>;
 export declare function setLogContext(context: LogContext): void;
 export declare function getLogContextAttributes(): LogAttributes;
+/** Return inherited log context filtered to attributes valid for the span operation. */
+export declare function getLogContextAttributesForSpan(op: string): LogAttributes;
 export declare function registerLogRecordSink(sink: (record: EmittedLogRecord) => void): () => void;
 export declare function createLogContextFromRequest(request: Request, context?: Partial<LogContext>): LogContext;
 export declare function toSpanAttributes(context: LogContext): Record<string, string>;
@@ -93,7 +95,7 @@ export declare function captureExceptionInScope(error: unknown, context?: LogCon
 export declare function getActiveTraceId(): string | undefined;
 /** Build the static user-facing response for a failed turn. */
 export declare function buildTurnFailureResponse(eventId: string): string;
-/** Serialize an AI model response value into a truncated log attribute. */
+/** Serialize a bounded AI value, omitting it when valid JSON cannot fit. */
 export declare function serializeGenAiAttribute(value: unknown, maxChars?: number): string | undefined;
 /**
  * Sum pi-ai `Usage` counters across every source into an `AgentTurnUsage`.
@@ -104,5 +106,5 @@ export declare function serializeGenAiAttribute(value: unknown, maxChars?: numbe
  */
 export declare function extractGenAiUsageSummary(...sources: unknown[]): AgentTurnUsage;
 /** Extract GenAI token and estimated USD cost attributes for tracing. */
-export declare function extractGenAiUsageAttributes(...sources: unknown[]): Partial<Record<"gen_ai.usage.input_tokens" | "gen_ai.usage.output_tokens" | "gen_ai.usage.input_tokens.cached" | "gen_ai.usage.input_tokens.cache_write" | "gen_ai.usage.total_tokens", number> & Partial<Record<"app.ai.cost.input_usd" | "app.ai.cost.output_usd" | "app.ai.cost.cache_read_usd" | "app.ai.cost.cache_write_usd" | "app.ai.cost.total_usd" | "app.ai.reasoning_tokens", number>>>;
+export declare function extractGenAiUsageAttributes(...sources: unknown[]): Partial<Record<"gen_ai.usage.input_tokens" | "gen_ai.usage.output_tokens" | "gen_ai.usage.cache_read.input_tokens" | "gen_ai.usage.cache_creation.input_tokens" | "gen_ai.usage.reasoning.output_tokens", number> & Partial<Record<"app.cost.input_usd" | "app.cost.output_usd" | "app.cost.cache_read_usd" | "app.cost.cache_write_usd" | "app.cost.total_usd", number>>>;
 export {};

package/dist/chat/mcp/auth-store.d.ts

@@ -3,6 +3,7 @@ import type { OAuthDiscoveryState } from "@modelcontextprotocol/sdk/client/auth.
 import { type Destination, type Source } from "@sentry/junior-plugin-api";
 import type { ThreadArtifactsState } from "@/chat/state/artifacts";
 export interface McpAuthSessionState {
+    schemaVersion: 2;
     authSessionId: string;
     provider: string;
     userId: string;

package/dist/chat/mcp/client.d.ts

@@ -15,6 +15,7 @@ export declare class PluginMcpClient {
     private readonly plugin;
     private readonly options;
     private client?;
+    private clientPromise?;
     private lastAttemptedTransportSessionId?;
     private transport?;
     private listedTools?;
@@ -24,6 +25,7 @@ export declare class PluginMcpClient {
     close(): Promise<void>;
     private withSessionRecovery;
     private getClient;
+    private connectClient;
     private wrapAuth;
     private shouldResetMissingSession;
     private disposeClient;

package/dist/chat/mcp/oauth-provider.d.ts

@@ -5,8 +5,9 @@ export declare class StateBackedMcpOAuthClientProvider implements OAuthClientPro
     readonly authSessionId: string;
     private readonly callbackUrl;
     private readonly sessionContext?;
+    private readonly runCredentialMutation?;
     readonly clientMetadata: OAuthClientMetadata;
-    constructor(authSessionId: string, callbackUrl: string, sessionContext?: Omit<McpAuthSessionState, "authSessionId" | "authorizationUrl" | "codeVerifier" | "createdAtMs" | "updatedAtMs"> | undefined);
+    constructor(authSessionId: string, callbackUrl: string, sessionContext?: Omit<McpAuthSessionState, "schemaVersion" | "authSessionId" | "authorizationUrl" | "codeVerifier" | "createdAtMs" | "updatedAtMs"> | undefined, runCredentialMutation?: (<T>(mutation: () => Promise<T>) => Promise<T>) | undefined);
     get redirectUrl(): string;
     state(): Promise<string>;
     clientInformation(): Promise<OAuthClientInformationMixed | undefined>;
@@ -21,6 +22,8 @@ export declare class StateBackedMcpOAuthClientProvider implements OAuthClientPro
     invalidateCredentials(scope: "all" | "client" | "tokens" | "verifier" | "discovery"): Promise<void>;
     getMcpServerSessionId(): Promise<string | undefined>;
     saveMcpServerSessionId(sessionId: string | undefined): Promise<void>;
+    /** Route shared credential writes through callback-owned freshness control. */
+    private mutateCredentials;
     private getCredentialContext;
     private ensureSession;
     private requireSession;

package/dist/chat/mcp/oauth.d.ts

@@ -3,6 +3,7 @@ import type { ThreadArtifactsState } from "@/chat/state/artifacts";
 import { type McpAuthSessionState } from "./auth-store";
 import { StateBackedMcpOAuthClientProvider } from "./oauth-provider";
 export declare function getMcpOAuthCallbackPath(provider: string): string;
+/** Create one immutable provider authorization attempt for the active turn. */
 export declare function createMcpOAuthClientProvider(input: {
     provider: string;
     conversationId: string;
@@ -17,4 +18,5 @@ export declare function createMcpOAuthClientProvider(input: {
     configuration?: Record<string, unknown>;
     artifactState?: ThreadArtifactsState;
 }): Promise<StateBackedMcpOAuthClientProvider>;
-export declare function finalizeMcpAuthorization(provider: string, authSessionId: string, authorizationCode: string): Promise<McpAuthSessionState>;
+/** Exchange a callback code while guarding every shared credential mutation. */
+export declare function finalizeMcpAuthorization(provider: string, authSessionId: string, authorizationCode: string, runCredentialMutation?: <T>(mutation: () => Promise<T>) => Promise<T>): Promise<McpAuthSessionState>;

package/dist/chat/mcp/tool-manager.d.ts

@@ -8,7 +8,7 @@
  */
 import type { ImageContent, TextContent } from "@earendil-works/pi-ai";
 import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
-import { type ConversationPrivacy } from "@/chat/conversation-privacy";
+import type { ConversationPrivacy } from "@/chat/conversation-privacy";
 import type { SkillMetadata } from "@/chat/skills";
 import type { PluginDefinition } from "@/chat/plugins/types";
 import { McpAuthorizationRequiredError } from "./client";
@@ -43,6 +43,7 @@ export declare class McpToolManager {
     private readonly activeProviders;
     private readonly authorizationPendingProviders;
     private readonly clientsByProvider;
+    private readonly clientPromisesByProvider;
     private readonly toolsByProvider;
     constructor(plugins: PluginDefinition[], options?: McpToolManagerOptions);
     getActiveProviders(): string[];
@@ -61,6 +62,7 @@ export declare class McpToolManager {
     }): ManagedMcpToolDescriptor[];
     private filterListedTools;
     private getClient;
+    private createClient;
     private toManagedTool;
     private handleAuthorizationRequired;
     /** Return all active ManagedMcpTool objects, optionally filtered by provider. */

package/dist/chat/sandbox/egress/schemas.d.ts

@@ -17,7 +17,7 @@ export declare const sandboxEgressCredentialContextSchema: z.ZodObject<{
             platform: z.ZodLiteral<"system">;
             name: z.ZodString;
         }, z.core.$strict>;
-        subject: z.ZodOptional<z.ZodObject<{
+        subject: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
             type: z.ZodLiteral<"user">;
             userId: z.ZodString;
             allowedWhen: z.ZodLiteral<"private-direct-conversation">;
@@ -27,7 +27,18 @@ export declare const sandboxEgressCredentialContextSchema: z.ZodObject<{
                 channelId: z.ZodString;
                 signature: z.ZodString;
             }, z.core.$strict>;
-        }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"user">;
+            userId: z.ZodString;
+            allowedWhen: z.ZodLiteral<"scheduled-task">;
+            taskId: z.ZodString;
+            binding: z.ZodObject<{
+                type: z.ZodLiteral<"scheduled-task">;
+                plugin: z.ZodString;
+                taskId: z.ZodString;
+                signature: z.ZodString;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "allowedWhen">>;
     }, z.core.$strict>]>;
     egressId: z.ZodString;
     expiresAtMs: z.ZodNumber;

package/dist/chat/services/context-compaction-marker.d.ts

@@ -0,0 +1,8 @@
+import type { PiMessage } from "@/chat/pi/messages";
+export declare const COMPACTION_SUMMARY_PREFIX = "Context compaction summary for future Junior turns:";
+export declare const LEGACY_COMPACTION_SUMMARY_PREFIX = "Context handoff summary for future Junior turns:";
+export declare const MODEL_HANDOFF_SUMMARY_PREFIX = "Model handoff checkpoint. Continue the outstanding request now using this summary as the complete prior context:";
+/** Return whether text is one of Junior's durable compacted-context markers. */
+export declare function isCompactionSummaryText(text: string): boolean;
+/** Return whether model-visible history contains a durable compacted context marker. */
+export declare function hasCompactedConversationContext(messages: PiMessage[]): boolean;

package/dist/chat/services/mcp-auth-orchestration.d.ts

@@ -30,7 +30,7 @@ export interface McpAuthOrchestrationInput {
     getConfiguration: () => Record<string, unknown>;
     getArtifactState: () => ThreadArtifactsState | undefined;
     getMergedArtifactState: () => ThreadArtifactsState;
-    recordPendingAuth?: (pendingAuth: ConversationPendingAuthState) => void | Promise<void>;
+    recordPendingAuth?: (pendingAuth: ConversationPendingAuthState | undefined) => void | Promise<void>;
     authorizationFlowMode?: AuthorizationFlowMode;
 }
 export interface McpAuthOrchestration {

package/dist/chat/services/pending-auth.d.ts

@@ -10,22 +10,30 @@ export declare function canReusePendingAuthLink(args: {
     scope?: string;
     sessionId: string;
 }): boolean;
+/** Return the exact pending authorization target for one actor and provider. */
 export declare function getConversationPendingAuth(args: {
     conversation: ThreadConversationState;
-    kind: AuthorizationPauseKind;
+    kind: "mcp";
     provider: string;
     actorId: string;
     scope?: string;
-}): ConversationPendingAuthState | undefined;
-export declare function clearPendingAuth(conversation: ThreadConversationState, sessionId?: string): void;
-/**
- * Apply a new pending-auth record to the conversation and, when replacing a
- * different session's pending-auth, mark the prior session record as abandoned.
- * Callers are responsible for persisting the mutated conversation afterwards.
- */
-export declare function applyPendingAuthUpdate(args: {
+}): Extract<ConversationPendingAuthState, {
+    kind: "mcp";
+}> | undefined;
+export declare function getConversationPendingAuth(args: {
     conversation: ThreadConversationState;
+    kind: "plugin";
+    provider: string;
+    actorId: string;
+    scope?: string;
+}): Extract<ConversationPendingAuthState, {
+    kind: "plugin";
+}> | undefined;
+export declare function clearPendingAuth(conversation: ThreadConversationState, sessionId?: string): void;
+/** Mark the prior blocked turn abandoned after a new auth attempt replaces it. */
+export declare function abandonReplacedPendingAuth(args: {
     conversationId: string | undefined;
+    previousPendingAuth: ConversationPendingAuthState | undefined;
     nextPendingAuth: ConversationPendingAuthState;
 }): Promise<void>;
 /**

package/dist/chat/state/conversation.d.ts

@@ -1,4 +1,3 @@
-import type { AuthorizationPauseKind } from "@/chat/services/auth-pause";
 type ConversationRole = "assistant" | "system" | "user";
 export interface ConversationAuthor {
     fullName?: string;
@@ -39,14 +38,19 @@ export interface ConversationProcessingState {
     lastCompletedAtMs?: number;
     pendingAuth?: ConversationPendingAuthState;
 }
-export interface ConversationPendingAuthState {
-    kind: AuthorizationPauseKind;
+interface ConversationPendingAuthBase {
     linkSentAtMs: number;
     provider: string;
     actorId: string;
     scope?: string;
     sessionId: string;
 }
+export type ConversationPendingAuthState = (ConversationPendingAuthBase & {
+    authSessionId: string;
+    kind: "mcp";
+}) | (ConversationPendingAuthBase & {
+    kind: "plugin";
+});
 export interface ConversationStats {
     compactedMessageCount: number;
     estimatedContextTokens: number;

package/dist/{chunk-XJA7BPHS.js → chunk-3OABPOHR.js}

@@ -7,13 +7,13 @@ import {
 import {
   getStateAdapter,
   toOptionalTrimmed
-} from "./chunk-A7X2FDUO.js";
+} from "./chunk-SHBPSE7A.js";
 import {
   pluginCatalogRuntime
-} from "./chunk-LMJPRYHP.js";
+} from "./chunk-77LHNQK4.js";
 import {
   withSpan
-} from "./chunk-I35CTGPO.js";
+} from "./chunk-AEWZ7F65.js";
 
 // src/chat/sandbox/runtime-dependency-snapshots.ts
 import { createHash } from "crypto";

package/dist/{chunk-2T7DCRAW.js → chunk-3UK5DFKW.js}

@@ -1,18 +1,18 @@
 import {
   JUNIOR_THREAD_STATE_TTL_MS
-} from "./chunk-6DTVCPLO.js";
+} from "./chunk-XIMUQ4IU.js";
 import {
   getChatConfig,
   getDefaultRedisStateAdapterFor,
   getStateAdapter
-} from "./chunk-A7X2FDUO.js";
+} from "./chunk-SHBPSE7A.js";
 import {
   parseDestination,
   sameDestination
 } from "./chunk-B7PUBQQM.js";
 import {
   parseStoredSlackActor
-} from "./chunk-I35CTGPO.js";
+} from "./chunk-AEWZ7F65.js";
 import {
   isRecord,
   toOptionalNumber,

package/dist/{chunk-IDZBM3NW.js → chunk-4YN2ZXKB.js}

@@ -2,7 +2,7 @@ import {
   actorIdentitySchema,
   conversationStatsItemSchema,
   conversationSummaryReportSchema
-} from "./chunk-MM5UFDAC.js";
+} from "./chunk-HYDQULR2.js";
 
 // src/api/people/schema.ts
 import { z } from "zod";
@@ -20,6 +20,11 @@ var actorActivityDayReportSchema = z.object({
   failed: z.number(),
   tokens: z.number().optional()
 }).strict();
+var peopleActivityDayReportSchema = z.object({
+  activePeople: z.number(),
+  conversations: z.number(),
+  date: z.string()
+}).strict();
 var actorTotalsReportSchema = z.object({
   active: z.number(),
   activeDays: z.number(),
@@ -35,9 +40,12 @@ var actorSummaryReportSchema = actorTotalsReportSchema.extend({
   actor: identifiedActorSchema
 }).strict();
 var actorDirectoryReportSchema = z.object({
+  activityDays: z.array(peopleActivityDayReportSchema),
   generatedAt: z.string(),
   people: z.array(actorSummaryReportSchema),
-  source: z.literal("conversation_index")
+  source: z.literal("conversation_index"),
+  windowEnd: z.string(),
+  windowStart: z.string()
 }).strict();
 var actorProfileReportSchema = z.object({
   activityDays: z.array(actorActivityDayReportSchema),

package/dist/{chunk-NSOCZGOH.js → chunk-5K4N73TP.js}

@@ -1,16 +1,16 @@
 import {
   JUNIOR_THREAD_STATE_TTL_MS,
   buildConversationStatePatch
-} from "./chunk-6DTVCPLO.js";
+} from "./chunk-XIMUQ4IU.js";
 import {
   abandonAgentTurnSessionRecord,
   addAgentTurnUsage,
   getAgentTurnSessionRecord,
   upsertAgentTurnSessionRecord
-} from "./chunk-IVXL57YF.js";
+} from "./chunk-EOB77KME.js";
 import {
   persistConversationMessages
-} from "./chunk-JPQISMMJ.js";
+} from "./chunk-VSAFV2GI.js";
 import {
   sleep
 } from "./chunk-4ZNGQH7C.js";
@@ -18,11 +18,11 @@ import {
   getPiMessageRole,
   getStateAdapter,
   trimTrailingAssistantMessages
-} from "./chunk-A7X2FDUO.js";
+} from "./chunk-SHBPSE7A.js";
 import {
   getActiveTraceId,
   logException
-} from "./chunk-I35CTGPO.js";
+} from "./chunk-AEWZ7F65.js";
 import {
   isRecord,
   toOptionalString
@@ -899,13 +899,11 @@ function clearPendingAuth(conversation, sessionId) {
   }
   conversation.processing.pendingAuth = void 0;
 }
-async function applyPendingAuthUpdate(args) {
-  const previousPendingAuth = args.conversation.processing.pendingAuth;
-  args.conversation.processing.pendingAuth = args.nextPendingAuth;
-  if (previousPendingAuth && previousPendingAuth.sessionId !== args.nextPendingAuth.sessionId && args.conversationId) {
+async function abandonReplacedPendingAuth(args) {
+  if (args.previousPendingAuth && args.previousPendingAuth.sessionId !== args.nextPendingAuth.sessionId && args.conversationId) {
     await abandonAgentTurnSessionRecord({
       conversationId: args.conversationId,
-      sessionId: previousPendingAuth.sessionId,
+      sessionId: args.previousPendingAuth.sessionId,
       errorMessage: "Abandoned by a newer auth-blocked request in the same conversation."
     });
   }
@@ -951,7 +949,7 @@ export {
   canReusePendingAuthLink,
   getConversationPendingAuth,
   clearPendingAuth,
-  applyPendingAuthUpdate,
+  abandonReplacedPendingAuth,
   isPendingAuthLatestRequest,
   coerceThreadArtifactsState,
   mergeArtifactsState,

package/dist/{chunk-LMJPRYHP.js → chunk-77LHNQK4.js}

@@ -3,7 +3,7 @@ import {
   logWarn,
   parseActorUserId,
   setSpanAttributes
-} from "./chunk-I35CTGPO.js";
+} from "./chunk-AEWZ7F65.js";
 import {
   discoverInstalledPluginPackageContent,
   normalizePluginPackageNames
@@ -1084,12 +1084,23 @@ var CredentialUnavailableError = class extends Error {
 // src/chat/credentials/context.ts
 import { z as z2 } from "zod";
 var exactActorIdSchema = z2.string().refine((value) => parseActorUserId(value) === value);
-var credentialSubjectBindingSchema = z2.object({
+var exactNonBlankStringSchema = z2.string().min(1).refine((value) => value === value.trim());
+var slackDirectCredentialSubjectBindingSchema = z2.object({
   type: z2.literal("slack-direct-conversation"),
   teamId: z2.string().min(1),
   channelId: z2.string().min(1),
   signature: z2.string().min(1)
 }).strict();
+var scheduledTaskCredentialSubjectBindingSchema = z2.object({
+  type: z2.literal("scheduled-task"),
+  plugin: z2.string().min(1),
+  taskId: exactNonBlankStringSchema,
+  signature: z2.string().min(1)
+}).strict();
+var credentialSubjectBindingSchema = z2.discriminatedUnion("type", [
+  slackDirectCredentialSubjectBindingSchema,
+  scheduledTaskCredentialSubjectBindingSchema
+]);
 var credentialUserActorSchema = z2.object({
   type: z2.literal("user"),
   userId: exactActorIdSchema
@@ -1098,12 +1109,24 @@ var credentialSystemActorSchema = z2.object({
   platform: z2.literal("system"),
   name: exactActorIdSchema
 }).strict();
-var credentialSubjectSchema = z2.object({
-  type: z2.literal("user"),
-  userId: exactActorIdSchema,
-  allowedWhen: z2.literal("private-direct-conversation"),
-  binding: credentialSubjectBindingSchema
-}).strict();
+var credentialSubjectSchema = z2.discriminatedUnion("allowedWhen", [
+  z2.object({
+    type: z2.literal("user"),
+    userId: exactActorIdSchema,
+    allowedWhen: z2.literal("private-direct-conversation"),
+    binding: slackDirectCredentialSubjectBindingSchema
+  }).strict(),
+  z2.object({
+    type: z2.literal("user"),
+    userId: exactActorIdSchema,
+    allowedWhen: z2.literal("scheduled-task"),
+    taskId: exactNonBlankStringSchema,
+    binding: scheduledTaskCredentialSubjectBindingSchema
+  }).strict().refine((subject) => subject.binding.taskId === subject.taskId, {
+    message: "Scheduled task credential subject requires task binding",
+    path: ["binding"]
+  })
+]);
 var credentialContextSchema = z2.union([
   z2.object({
     actor: credentialUserActorSchema
@@ -2048,6 +2071,7 @@ export {
   parsePluginManifest,
   parseInlinePluginManifest,
   CredentialUnavailableError,
+  credentialSubjectSchema,
   credentialContextSchema,
   hasRequiredOAuthScope,
   resolvePluginCommandEnv,