@sentry/junior 0.113.0 → 0.115.0

package/dist/chunk-4CODA7P5.js

@@ -0,0 +1,43 @@
+import {
+  getClient
+} from "./chunk-6GWA276C.js";
+
+// src/chat/sentry-links.ts
+function getSentryOrgSlug() {
+  const slug = process.env.SENTRY_ORG_SLUG?.trim();
+  return slug || void 0;
+}
+function isSentrySaasDsnHost(host) {
+  return host === "sentry.io" || host.endsWith(".sentry.io");
+}
+function buildSentryWebBaseUrl(dsn) {
+  if (isSentrySaasDsnHost(dsn.host)) {
+    return "https://sentry.io";
+  }
+  const port = dsn.port ? `:${dsn.port}` : "";
+  const path = dsn.path ? `/${dsn.path}` : "";
+  return `${dsn.protocol}://${dsn.host}${port}${path}`;
+}
+function buildSentryConversationUrl(conversationId) {
+  const client = getClient();
+  const dsn = client?.getDsn();
+  if (!dsn?.host || !dsn.projectId) {
+    return void 0;
+  }
+  const orgSlug = getSentryOrgSlug();
+  if (!orgSlug) {
+    return void 0;
+  }
+  const encodedId = encodeURIComponent(conversationId);
+  const params = new URLSearchParams();
+  params.set("project", dsn.projectId);
+  const path = `explore/conversations/${encodedId}/?${params.toString()}`;
+  if (isSentrySaasDsnHost(dsn.host)) {
+    return `https://${orgSlug}.sentry.io/${path}`;
+  }
+  return `${buildSentryWebBaseUrl(dsn)}/organizations/${orgSlug}/${path}`;
+}
+
+export {
+  buildSentryConversationUrl
+};

package/dist/{chunk-HMRVILWZ.js → chunk-67CVNDJ7.js}

@@ -1,6 +1,6 @@
 import {
   getChatConfig
-} from "./chunk-RCBUZGIT.js";
+} from "./chunk-SYJT7AKB.js";
 
 // src/chat/state/adapter.ts
 import { createMemoryState } from "@chat-adapter/state-memory";

package/dist/{chunk-LR2SKL5Y.js → chunk-6FKLPVF3.js}

@@ -1,6 +1,6 @@
 import {
   createPluginCatalogRuntime
-} from "./chunk-OXE5ZUTS.js";
+} from "./chunk-EW5MLKT5.js";
 
 // src/chat/plugins/catalog-runtime.ts
 var pluginCatalogRuntime = createPluginCatalogRuntime();

package/dist/{chunk-2ZTTXTSZ.js → chunk-6OPTF4BQ.js}

@@ -5,8 +5,14 @@ var healthReportSchema = z.object({
   service: z.string(),
   timestamp: z.string()
 }).strict();
-var pluginReportSchema = z.object({ name: z.string() }).strict();
-var pluginReportsSchema = z.array(pluginReportSchema);
+var pluginSchema = z.object({
+  capabilities: z.array(z.string()),
+  configKeys: z.array(z.string()),
+  description: z.string(),
+  displayName: z.string(),
+  name: z.string()
+}).strict();
+var pluginsSchema = z.array(pluginSchema);
 var skillReportSchema = z.object({
   name: z.string(),
   pluginProvider: z.string().optional()
@@ -97,8 +103,8 @@ var pluginOperationalReportFeedSchema = z.object({
 
 export {
   healthReportSchema,
-  pluginReportSchema,
-  pluginReportsSchema,
+  pluginSchema,
+  pluginsSchema,
   skillReportSchema,
   skillReportsSchema,
   pluginPackageContentItemReportSchema,

package/dist/{chunk-3CTIAKSS.js → chunk-6V762AB4.js}

@@ -1,6 +1,6 @@
 import {
   pluginCatalogRuntime
-} from "./chunk-LR2SKL5Y.js";
+} from "./chunk-6FKLPVF3.js";
 
 // src/chat/plugins/validation.ts
 import { isDeepStrictEqual } from "util";

package/dist/{chunk-WBB22ANL.js → chunk-AGLQYELI.js}

@@ -4,6 +4,7 @@ import {
   sendVercelPluginTask
 } from "./chunk-KNFROR7R.js";
 import {
+  buildDeterministicTurnId,
   clearPendingAuth,
   coerceThreadConversationState,
   getAgentTurnSessionRecord,
@@ -15,36 +16,38 @@ import {
   isToolResultError,
   isToolResultMessage,
   markConversationMessage,
+  markTurnClosed,
   markTurnCompleted,
   mergeArtifactsState,
   normalizeToolNameFromResult,
+  persistThreadStateById,
   stripRuntimeTurnContext,
   updateConversationStats
-} from "./chunk-DXRPHBOU.js";
+} from "./chunk-CEYOL62C.js";
 import {
   createPluginEmbedder,
   createPluginLogger,
   createPluginModel,
   createPluginState,
   getPlugins
-} from "./chunk-YJ44UT7D.js";
+} from "./chunk-RAVKCKXA.js";
 import {
   getStateAdapter
-} from "./chunk-HMRVILWZ.js";
+} from "./chunk-67CVNDJ7.js";
 import {
   getDb
-} from "./chunk-LLKDNPYV.js";
+} from "./chunk-HWCQRGLL.js";
 import {
   ProviderError,
   getProviderErrorAttributes,
   getProviderErrorUserMessage
-} from "./chunk-RCBUZGIT.js";
+} from "./chunk-SYJT7AKB.js";
 import {
   buildTurnFailureResponse
-} from "./chunk-36UJA3OD.js";
+} from "./chunk-NVUQSFWX.js";
 import {
   parseSlackMessageTs
-} from "./chunk-42WRQLJ6.js";
+} from "./chunk-F3B2YJ76.js";
 
 // src/chat/services/turn-failure-response.ts
 function requireTurnFailureEventId(eventId, eventName) {
@@ -523,6 +526,66 @@ function buildDeliveredTurnStatePatch(args) {
   };
 }
 
+// src/chat/runtime/turn-user-message.ts
+function getTurnUserMessage(conversation, sessionId) {
+  for (let index = conversation.messages.length - 1; index >= 0; index -= 1) {
+    const message = conversation.messages[index];
+    if (message?.role !== "user") {
+      continue;
+    }
+    if (buildDeterministicTurnId(message.id) === sessionId) {
+      return message;
+    }
+  }
+  return void 0;
+}
+function getTurnUserMessageId(conversation, sessionId) {
+  return getTurnUserMessage(conversation, sessionId)?.id;
+}
+function getTurnUserSlackMessageTs(message) {
+  return parseSlackMessageTs(message?.meta?.slackTs);
+}
+function getTurnUserReplyAttachmentContext(message) {
+  const inboundAttachmentCount = message?.meta?.attachmentCount ?? 0;
+  const imageAttachmentCount = message?.meta?.imageAttachmentCount ?? 0;
+  const imagesHydrated = message?.meta?.imagesHydrated === true;
+  return {
+    ...inboundAttachmentCount > 0 ? { inboundAttachmentCount } : {},
+    ...!imagesHydrated && imageAttachmentCount > 0 ? { omittedImageAttachmentCount: imageAttachmentCount } : {}
+  };
+}
+
+// src/chat/runtime/auth-pause-state.ts
+function completeAuthPauseTurn(args) {
+  markConversationMessage(
+    args.conversation,
+    getTurnUserMessageId(args.conversation, args.sessionId),
+    {
+      replied: true,
+      skippedReason: void 0
+    }
+  );
+  markTurnClosed({
+    conversation: args.conversation,
+    nowMs: Date.now(),
+    sessionId: args.sessionId,
+    updateConversationStats
+  });
+}
+async function persistAuthPauseTurnState(args) {
+  const currentState = await getPersistedThreadState(args.threadStateId);
+  const conversation = coerceThreadConversationState(currentState);
+  await hydrateConversationMessages({
+    conversation,
+    conversationId: args.threadStateId
+  });
+  completeAuthPauseTurn({
+    conversation,
+    sessionId: args.sessionId
+  });
+  await persistThreadStateById(args.threadStateId, { conversation });
+}
+
 export {
   requireTurnFailureEventId,
   getAgentTurnDiagnosticsAttributes,
@@ -530,5 +593,11 @@ export {
   ConversationTurnLifecycleService,
   scheduleSessionCompletedPluginTasks,
   processPluginTask,
-  buildDeliveredTurnStatePatch
+  buildDeliveredTurnStatePatch,
+  getTurnUserMessage,
+  getTurnUserMessageId,
+  getTurnUserSlackMessageTs,
+  getTurnUserReplyAttachmentContext,
+  completeAuthPauseTurn,
+  persistAuthPauseTurnState
 };

package/dist/{chunk-DXRPHBOU.js → chunk-CEYOL62C.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-MU6HHZEN.js";
 import {
   getStateAdapter
-} from "./chunk-HMRVILWZ.js";
+} from "./chunk-67CVNDJ7.js";
 import {
   contextProvenance,
   createSqlConversationEventStore,
@@ -15,7 +15,7 @@ import {
   instructionProvenanceFor,
   sanitizePostgresJson,
   withConversationEventLock
-} from "./chunk-LLKDNPYV.js";
+} from "./chunk-HWCQRGLL.js";
 import {
   sleep
 } from "./chunk-4ZNGQH7C.js";
@@ -23,24 +23,25 @@ import {
   botConfig,
   escapeXml,
   resolveGatewayModel,
-  standardModelId,
   unwrapCurrentInstruction
-} from "./chunk-RCBUZGIT.js";
+} from "./chunk-SYJT7AKB.js";
 import {
   toStoredSlackActor
-} from "./chunk-C4MZ3GP5.js";
+} from "./chunk-HZF5P5UN.js";
 import {
   getActiveTraceId,
   logException,
   logWarn,
   setSpanAttributes
-} from "./chunk-36UJA3OD.js";
+} from "./chunk-NVUQSFWX.js";
 import {
   isRecord,
-  parseSlackMessageTs,
   toOptionalNumber,
   toOptionalString
-} from "./chunk-42WRQLJ6.js";
+} from "./chunk-OB42YVAE.js";
+import {
+  parseSlackMessageTs
+} from "./chunk-F3B2YJ76.js";
 
 // src/chat/turn-context-tag.ts
 var TURN_CONTEXT_TAG = "runtime-turn-context";
@@ -451,6 +452,36 @@ async function recordAuthorizationCompleted(args) {
     }
   ]);
 }
+async function loadTurnRoute(args) {
+  const event = await getConversationEventStore().loadByIdempotencyKey(
+    args.conversationId,
+    `turn:${args.turnId}:routed`
+  );
+  if (!event) {
+    return void 0;
+  }
+  if (event.data.type !== "turn_routed" || event.data.turnId !== args.turnId) {
+    throw new Error(`Turn route key for "${args.turnId}" has invalid data`);
+  }
+  return event.data;
+}
+async function recordTurnRoute(args) {
+  await getConversationEventStore().append(args.conversationId, [
+    {
+      idempotencyKey: `turn:${args.turnId}:routed`,
+      createdAtMs: Date.now(),
+      data: {
+        type: "turn_routed",
+        turnId: args.turnId,
+        modelProfile: args.modelProfile,
+        modelId: args.modelId,
+        reasoningLevel: args.reasoningLevel,
+        ...args.confidence !== void 0 ? { confidence: args.confidence } : {},
+        source: args.source
+      }
+    }
+  ]);
+}
 async function recordToolExecutionStarted(args) {
   await getConversationEventStore().append(args.conversationId, [
     {
@@ -1588,11 +1619,10 @@ function buildConversationStatePatch(conversation) {
 }
 
 // src/chat/services/context-budget.ts
-var COMPACTION_TRIGGER_INPUT_RATIO = 0.75;
-var COMPACTION_OUTPUT_RESERVE_RATIO = 0.25;
+var COMPACTION_TRIGGER_RATIO = 0.9;
+var CONTEXT_INPUT_LIMIT_RATIO = 0.95;
 var COMPACTION_TARGET_RATIO = 0.8;
 var FALLBACK_CONTEXT_WINDOW_TOKENS = 4e5;
-var FALLBACK_MAX_OUTPUT_TOKENS = 128e3;
 function positiveInteger(value, fallback) {
   return Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;
 }
@@ -1604,36 +1634,43 @@ function calculateContextCompactionTriggerTokens(model) {
     model.contextWindow,
     FALLBACK_CONTEXT_WINDOW_TOKENS
   );
-  const maxTokens = positiveInteger(
-    model.maxTokens,
-    FALLBACK_MAX_OUTPUT_TOKENS
-  );
-  const outputReserve = Math.min(
-    maxTokens,
-    Math.floor(contextWindow * COMPACTION_OUTPUT_RESERVE_RATIO)
-  );
-  const usableInputTokens = Math.max(1, contextWindow - outputReserve);
-  return Math.max(
-    1,
-    Math.floor(usableInputTokens * COMPACTION_TRIGGER_INPUT_RATIO)
+  return Math.max(1, Math.floor(contextWindow * COMPACTION_TRIGGER_RATIO));
+}
+function calculateContextInputLimitTokens(model) {
+  const contextWindow = positiveInteger(
+    model.contextWindow,
+    FALLBACK_CONTEXT_WINDOW_TOKENS
   );
+  return Math.max(1, Math.floor(contextWindow * CONTEXT_INPUT_LIMIT_RATIO));
 }
 function calculateContextCompactionTargetTokens(triggerTokens) {
   return Math.max(1, Math.floor(triggerTokens * COMPACTION_TARGET_RATIO));
 }
-function getAgentContextCompactionTriggerTokens() {
-  const model = resolveGatewayModel(standardModelId(botConfig));
-  return calculateContextCompactionTriggerTokens({
-    contextWindow: botConfig.modelContextWindowTokens ?? model.contextWindow,
-    maxTokens: model.maxTokens
-  });
+function getModelContextBudget(modelId) {
+  const model = resolveGatewayModel(modelId);
+  const advertisedContextWindow = positiveInteger(
+    model.contextWindow,
+    FALLBACK_CONTEXT_WINDOW_TOKENS
+  );
+  return {
+    contextWindow: Math.min(
+      botConfig.contextWindowTokens,
+      advertisedContextWindow
+    )
+  };
+}
+function getAgentContextCompactionTriggerTokens(modelId) {
+  return calculateContextCompactionTriggerTokens(
+    getModelContextBudget(modelId)
+  );
+}
+function getAgentContextInputLimitTokens(modelId) {
+  return calculateContextInputLimitTokens(getModelContextBudget(modelId));
 }
 function getConversationContextCompactionTriggerTokens() {
-  const model = resolveGatewayModel(botConfig.fastModelId);
-  return calculateContextCompactionTriggerTokens({
-    contextWindow: model.contextWindow,
-    maxTokens: model.maxTokens
-  });
+  return calculateContextCompactionTriggerTokens(
+    getModelContextBudget(botConfig.fastModelId)
+  );
 }
 
 // src/chat/services/conversation-memory.ts
@@ -1646,7 +1683,7 @@ function generateConversationId(prefix) {
   return `${prefix}_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
 }
 function normalizeConversationText(text) {
-  return text.trim().replace(/\s+/g, " ").slice(0, CONTEXT_MAX_MESSAGE_CHARS);
+  return text.replace(/\r\n?/g, "\n").trim();
 }
 function buildImageContextSuffix(message, conversation) {
   const byFileId = conversation?.vision.byFileId;
@@ -1662,6 +1699,7 @@ function buildImageContextSuffix(message, conversation) {
 }
 function renderConversationMessageLine(message, conversation) {
   const displayName = conversationAuthorDisplayName(message);
+  const text = message.text.replace(/\s+/g, " ").slice(0, CONTEXT_MAX_MESSAGE_CHARS);
   const markers = [];
   if (message.meta?.replied === false) {
     markers.push(
@@ -1673,7 +1711,7 @@ function renderConversationMessageLine(message, conversation) {
   }
   const markerSuffix = markers.length > 0 ? ` (${markers.join("; ")})` : "";
   const imageContext = buildImageContextSuffix(message, conversation);
-  return `[${message.role}] ${displayName}: ${message.text}${imageContext}${markerSuffix}`;
+  return `[${message.role}] ${displayName}: ${text}${imageContext}${markerSuffix}`;
 }
 function conversationAuthorDisplayName(message) {
   const author = message.author;
@@ -2650,6 +2688,8 @@ export {
   recordMcpProviderConnected,
   recordAuthorizationRequested,
   recordAuthorizationCompleted,
+  loadTurnRoute,
+  recordTurnRoute,
   recordToolExecutionStarted,
   buildDeterministicTurnId,
   buildDeterministicAssistantMessageId,
@@ -2692,6 +2732,7 @@ export {
   persistConversationMessageSummaries,
   estimateTextTokens,
   getAgentContextCompactionTriggerTokens,
+  getAgentContextInputLimitTokens,
   normalizeConversationText,
   updateConversationStats,
   upsertConversationMessage,

package/dist/{chunk-QTS66GMR.js → chunk-CWEZEPD4.js}

@@ -3,16 +3,16 @@ import {
 } from "./chunk-4ZNGQH7C.js";
 import {
   getSlackBotToken
-} from "./chunk-RCBUZGIT.js";
+} from "./chunk-SYJT7AKB.js";
 import {
   logWarn,
   setSpanAttributes,
   setSpanStatus,
   withSpan
-} from "./chunk-36UJA3OD.js";
+} from "./chunk-NVUQSFWX.js";
 import {
   parseSlackChannelReferenceId
-} from "./chunk-42WRQLJ6.js";
+} from "./chunk-F3B2YJ76.js";
 
 // src/chat/slack/client.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";

package/dist/chunk-DIB4GX3G.js

@@ -0,0 +1,8 @@
+// src/chat/oauth-authorization.ts
+function authorizationId(args) {
+  return `${args.sessionId}:${args.kind}:${args.provider}`;
+}
+
+export {
+  authorizationId
+};

package/dist/{chunk-OXE5ZUTS.js → chunk-EW5MLKT5.js}

@@ -1,11 +1,11 @@
 import {
-  parseActorUserId
-} from "./chunk-C4MZ3GP5.js";
+  credentialUserSubjectId
+} from "./chunk-W3U3YQYI.js";
 import {
   logInfo,
   logWarn,
   setSpanAttributes
-} from "./chunk-36UJA3OD.js";
+} from "./chunk-NVUQSFWX.js";
 import {
   discoverInstalledPluginPackageContent,
   normalizePluginPackageNames
@@ -1083,68 +1083,6 @@ var CredentialUnavailableError = class extends Error {
   }
 };
 
-// src/chat/credentials/context.ts
-import { z as z2 } from "zod";
-var exactActorIdSchema = z2.string().refine((value) => parseActorUserId(value) === value);
-var exactNonBlankStringSchema = z2.string().min(1).refine((value) => value === value.trim());
-var slackDirectCredentialSubjectBindingSchema = z2.object({
-  type: z2.literal("slack-direct-conversation"),
-  teamId: z2.string().min(1),
-  channelId: z2.string().min(1),
-  signature: z2.string().min(1)
-}).strict();
-var scheduledTaskCredentialSubjectBindingSchema = z2.object({
-  type: z2.literal("scheduled-task"),
-  plugin: z2.string().min(1),
-  taskId: exactNonBlankStringSchema,
-  signature: z2.string().min(1)
-}).strict();
-var credentialSubjectBindingSchema = z2.discriminatedUnion("type", [
-  slackDirectCredentialSubjectBindingSchema,
-  scheduledTaskCredentialSubjectBindingSchema
-]);
-var credentialUserActorSchema = z2.object({
-  type: z2.literal("user"),
-  userId: exactActorIdSchema
-}).strict();
-var credentialSystemActorSchema = z2.object({
-  platform: z2.literal("system"),
-  name: exactActorIdSchema
-}).strict();
-var credentialSubjectSchema = z2.discriminatedUnion("allowedWhen", [
-  z2.object({
-    type: z2.literal("user"),
-    userId: exactActorIdSchema,
-    allowedWhen: z2.literal("private-direct-conversation"),
-    binding: slackDirectCredentialSubjectBindingSchema
-  }).strict(),
-  z2.object({
-    type: z2.literal("user"),
-    userId: exactActorIdSchema,
-    allowedWhen: z2.literal("scheduled-task"),
-    taskId: exactNonBlankStringSchema,
-    binding: scheduledTaskCredentialSubjectBindingSchema
-  }).strict().refine((subject) => subject.binding.taskId === subject.taskId, {
-    message: "Scheduled task credential subject requires task binding",
-    path: ["binding"]
-  })
-]);
-var credentialContextSchema = z2.union([
-  z2.object({
-    actor: credentialUserActorSchema
-  }).strict(),
-  z2.object({
-    actor: credentialSystemActorSchema,
-    subject: credentialSubjectSchema.optional()
-  }).strict()
-]);
-function credentialUserSubjectId(context) {
-  if ("type" in context.actor) {
-    return context.actor.userId;
-  }
-  return "subject" in context ? context.subject?.userId : void 0;
-}
-
 // src/chat/credentials/header-transforms.ts
 function mergeHeaderTransforms(transforms) {
   const byDomain = /* @__PURE__ */ new Map();
@@ -1277,7 +1215,7 @@ function createApiHeadersBroker(manifest) {
 }
 
 // src/chat/plugins/auth/oauth-request.ts
-import { z as z3 } from "zod";
+import { z as z2 } from "zod";
 var DEFAULT_TOKEN_CONTENT_TYPE = "application/x-www-form-urlencoded";
 function requireNonEmptyTokenField(data, field) {
   const value = data[field];
@@ -1292,12 +1230,12 @@ function requireTokenResponseObject(data) {
   }
   return data;
 }
-var parsedOAuthTokenResponseSchema = z3.object({
-  accessToken: z3.string().min(1),
-  refreshToken: z3.string().min(1),
-  expiresAt: z3.number().positive().optional(),
-  refreshTokenExpiresAt: z3.number().positive().optional(),
-  scope: z3.string().min(1).optional()
+var parsedOAuthTokenResponseSchema = z2.object({
+  accessToken: z2.string().min(1),
+  refreshToken: z2.string().min(1),
+  expiresAt: z2.number().positive().optional(),
+  refreshTokenExpiresAt: z2.number().positive().optional(),
+  scope: z2.string().min(1).optional()
 }).strict();
 function contentTypeToBody(contentType, payload) {
   const mediaType = contentType.split(";", 1)[0]?.trim().toLowerCase();
@@ -2070,9 +2008,6 @@ export {
   parsePluginManifest,
   parseInlinePluginManifest,
   CredentialUnavailableError,
-  credentialSubjectSchema,
-  credentialContextSchema,
-  credentialUserSubjectId,
   hasRequiredOAuthScope,
   resolvePluginCommandEnv,
   resolveAuthTokenPlaceholder,

package/dist/{chunk-42WRQLJ6.js → chunk-F3B2YJ76.js}

@@ -1,14 +1,3 @@
-// src/chat/coerce.ts
-function toOptionalString(value) {
-  return typeof value === "string" && value.trim() ? value : void 0;
-}
-function toOptionalNumber(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null;
-}
-
 // src/chat/slack/timestamp.ts
 import { z } from "zod";
 var slackMessageTsSchema = z.string().trim().regex(/^\d+(?:\.\d+)?$/).brand();
@@ -60,9 +49,6 @@ function parseSlackUserId(value) {
 }
 
 export {
-  toOptionalString,
-  toOptionalNumber,
-  isRecord,
   parseSlackMessageTs,
   parseSlackChannelId,
   parseSlackChannelReferenceId,

package/dist/chunk-FA6POGLH.js

@@ -0,0 +1,70 @@
+// src/chat/local/oauth-relay.ts
+import { randomBytes } from "crypto";
+import { jwtVerify, SignJWT } from "jose";
+import { z } from "zod";
+var LOCAL_OAUTH_STATE_PREFIX = "jr-local";
+var LOCAL_OAUTH_TOKEN_CONTEXT = "junior.local-oauth-relay.v1";
+var LOCAL_OAUTH_TOKEN_TTL = "10m";
+var localOAuthRelayPayloadSchema = z.object({
+  aud: z.literal(LOCAL_OAUTH_TOKEN_CONTEXT),
+  exp: z.number().int(),
+  iss: z.literal(LOCAL_OAUTH_TOKEN_CONTEXT),
+  jti: z.string().min(1),
+  port: z.number().int().min(1).max(65535)
+}).strict();
+function relayKey() {
+  const secret = process.env.JUNIOR_SECRET?.trim();
+  if (!secret) {
+    throw new Error("Local OAuth requires JUNIOR_SECRET");
+  }
+  return new TextEncoder().encode(secret);
+}
+async function createLocalOAuthState(port) {
+  if (!Number.isSafeInteger(port) || port < 1 || port > 65535) {
+    throw new Error("Local OAuth callback port is invalid");
+  }
+  const token = await new SignJWT({ port }).setProtectedHeader({ alg: "HS256" }).setIssuer(LOCAL_OAUTH_TOKEN_CONTEXT).setAudience(LOCAL_OAUTH_TOKEN_CONTEXT).setJti(randomBytes(24).toString("base64url")).setExpirationTime(LOCAL_OAUTH_TOKEN_TTL).sign(relayKey());
+  return `${LOCAL_OAUTH_STATE_PREFIX}.${token}`;
+}
+async function localOAuthRelayPort(state) {
+  const prefix = `${LOCAL_OAUTH_STATE_PREFIX}.`;
+  if (!state.startsWith(prefix)) {
+    return void 0;
+  }
+  try {
+    const { payload } = await jwtVerify(
+      state.slice(prefix.length),
+      relayKey(),
+      {
+        algorithms: ["HS256"],
+        issuer: LOCAL_OAUTH_TOKEN_CONTEXT,
+        audience: LOCAL_OAUTH_TOKEN_CONTEXT
+      }
+    );
+    const parsed = localOAuthRelayPayloadSchema.safeParse(payload);
+    return parsed.success ? parsed.data.port : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function relayLocalOAuthCallback(request) {
+  const url = new URL(request.url);
+  if (url.searchParams.get("jr_local_relay") === "complete") {
+    return void 0;
+  }
+  const state = url.searchParams.get("state");
+  const port = state ? await localOAuthRelayPort(state) : void 0;
+  if (!port) {
+    return void 0;
+  }
+  url.protocol = "http:";
+  url.hostname = "127.0.0.1";
+  url.port = String(port);
+  url.searchParams.set("jr_local_relay", "complete");
+  return Response.redirect(url, 302);
+}
+
+export {
+  createLocalOAuthState,
+  relayLocalOAuthCallback
+};