@sentry/junior 0.114.0 → 0.115.0

package/dist/chunk-LYA2AB5G.js

@@ -0,0 +1,1914 @@
+import {
+  getInterruptionMarker
+} from "./chunk-CEYOL62C.js";
+import {
+  createPluginLogger,
+  getPlugins
+} from "./chunk-RAVKCKXA.js";
+import {
+  acquireActiveLock,
+  getStateAdapter
+} from "./chunk-67CVNDJ7.js";
+import {
+  SlackActionError,
+  getSlackClient,
+  isDmChannel,
+  normalizeSlackConversationId,
+  withSlackRetries
+} from "./chunk-CWEZEPD4.js";
+import {
+  getDb,
+  parseDestination
+} from "./chunk-HWCQRGLL.js";
+import {
+  sleep
+} from "./chunk-4ZNGQH7C.js";
+import {
+  normalizeSlackEmojiName
+} from "./chunk-SYJT7AKB.js";
+import {
+  pluginCatalogRuntime
+} from "./chunk-6FKLPVF3.js";
+import {
+  logInfo,
+  logWarn
+} from "./chunk-NVUQSFWX.js";
+import {
+  isRecord
+} from "./chunk-OB42YVAE.js";
+import {
+  parseSlackMessageTs,
+  parseSlackUserId
+} from "./chunk-F3B2YJ76.js";
+
+// src/chat/capabilities/catalog.ts
+var cachedCatalog;
+function getCapabilityCatalog() {
+  const signature = pluginCatalogRuntime.getSignature();
+  if (cachedCatalog?.signature === signature) return cachedCatalog;
+  const providers = pluginCatalogRuntime.getCapabilityProviders();
+  const capabilityToProvider = /* @__PURE__ */ new Map();
+  for (const provider of providers) {
+    for (const capability of provider.capabilities) {
+      if (capabilityToProvider.has(capability)) {
+        throw new Error(
+          `Duplicate capability registration for "${capability}"`
+        );
+      }
+      capabilityToProvider.set(capability, provider);
+    }
+  }
+  cachedCatalog = { signature, providers, capabilityToProvider };
+  return cachedCatalog;
+}
+var catalogLogged = false;
+function logCapabilityCatalogLoadedOnce() {
+  if (catalogLogged) return;
+  catalogLogged = true;
+  const { providers } = getCapabilityCatalog();
+  const capabilityNames = providers.flatMap((p) => p.capabilities).sort();
+  const configKeys = [
+    ...new Set(providers.flatMap((p) => p.configKeys))
+  ].sort();
+  logInfo(
+    "capability_catalog_loaded",
+    {},
+    {
+      "app.capability.providers": providers.map((p) => p.provider),
+      "app.capability.count": capabilityNames.length,
+      "app.capability.names": capabilityNames,
+      "app.config.key_count": configKeys.length,
+      "app.config.keys": configKeys
+    },
+    "Loaded capability provider catalog"
+  );
+}
+
+// src/chat/capabilities/router.ts
+var ProviderCredentialRouter = class {
+  brokersByProvider;
+  constructor(input) {
+    this.brokersByProvider = input.brokersByProvider;
+  }
+  async issue(input) {
+    const broker = this.brokersByProvider[input.provider];
+    if (!broker) {
+      throw new Error(
+        `No credential broker registered for provider: ${input.provider}`
+      );
+    }
+    return await broker.issue({
+      context: input.context,
+      reason: input.reason
+    });
+  }
+};
+
+// src/chat/credentials/user-token-store.ts
+import {
+  pluginStoredTokensSchema
+} from "@sentry/junior-plugin-api";
+var storedTokensSchema = pluginStoredTokensSchema;
+
+// src/chat/credentials/state-adapter-token-store.ts
+var KEY_PREFIX = "oauth-token";
+var BUFFER_MS = 24 * 60 * 60 * 1e3;
+var LONG_LIVED_TTL_MS = 365 * 24 * 60 * 60 * 1e3;
+var REFRESH_LOCK_WAIT_MS = 3e4;
+var REFRESH_LOCK_RETRY_MS = 100;
+function tokenKey(userId, provider) {
+  return `${KEY_PREFIX}:${userId}:${provider}`;
+}
+function refreshLockKey(userId, provider) {
+  return `${tokenKey(userId, provider)}:refresh`;
+}
+var StateAdapterTokenStore = class {
+  state;
+  constructor(stateAdapter) {
+    this.state = stateAdapter;
+  }
+  async get(userId, provider) {
+    const stored = await this.state.get(tokenKey(userId, provider));
+    return stored === null || stored === void 0 ? void 0 : storedTokensSchema.parse(stored);
+  }
+  async set(userId, provider, tokens) {
+    const parsed = storedTokensSchema.parse(tokens);
+    const expiresAt = parsed.refreshTokenExpiresAt ?? parsed.expiresAt;
+    const ttlMs = expiresAt ? Math.max(expiresAt - Date.now() + BUFFER_MS, BUFFER_MS) : LONG_LIVED_TTL_MS;
+    await this.state.set(tokenKey(userId, provider), parsed, ttlMs);
+  }
+  async delete(userId, provider) {
+    await this.state.delete(tokenKey(userId, provider));
+  }
+  /** Wait for the per-slot refresh gate so rotated refresh tokens are used once. */
+  async withRefresh(userId, provider, callback) {
+    const lockKey = refreshLockKey(userId, provider);
+    const deadline = Date.now() + REFRESH_LOCK_WAIT_MS;
+    while (true) {
+      const lock = await acquireActiveLock(this.state, lockKey);
+      if (lock) {
+        try {
+          return await callback();
+        } finally {
+          await this.state.releaseLock(lock);
+        }
+      }
+      if (Date.now() >= deadline) {
+        throw new Error(`Could not acquire OAuth token refresh lock`);
+      }
+      await sleep(REFRESH_LOCK_RETRY_MS);
+    }
+  }
+};
+
+// src/chat/capabilities/factory.ts
+var sandboxEgressRouters = /* @__PURE__ */ new WeakMap();
+function createUserTokenStore() {
+  return new StateAdapterTokenStore(getStateAdapter());
+}
+function createProviderCredentialRouter(userTokenStore) {
+  logCapabilityCatalogLoadedOnce();
+  const brokersByProvider = {};
+  for (const plugin of pluginCatalogRuntime.getProviders()) {
+    const { name } = plugin.manifest;
+    if (!plugin.manifest.credentials && !plugin.manifest.apiHeaders) {
+      continue;
+    }
+    brokersByProvider[name] = pluginCatalogRuntime.createBroker(name, {
+      userTokenStore
+    });
+  }
+  return new ProviderCredentialRouter({ brokersByProvider });
+}
+function getSandboxEgressRouter() {
+  const stateAdapter = getStateAdapter();
+  let router = sandboxEgressRouters.get(stateAdapter);
+  if (!router) {
+    router = createProviderCredentialRouter(
+      new StateAdapterTokenStore(stateAdapter)
+    );
+    sandboxEgressRouters.set(stateAdapter, router);
+  }
+  return router;
+}
+async function issueProviderCredentialLease(input) {
+  return await getSandboxEgressRouter().issue(input);
+}
+
+// src/chat/agent/request.ts
+var RetryableDeliveryError = class extends Error {
+  constructor(cause) {
+    super("Assistant delivery was transient or ambiguous", { cause });
+    this.name = "RetryableDeliveryError";
+  }
+};
+function actorFromRouting(routing) {
+  if (routing.dispatch?.actor) {
+    return routing.dispatch.actor;
+  }
+  if (routing.actor) {
+    return routing.actor;
+  }
+  if (routing.credentialContext && !("type" in routing.credentialContext.actor)) {
+    return routing.credentialContext.actor;
+  }
+  return void 0;
+}
+function assertRunRoutingConsistency(request) {
+  const { destination, source } = request.routing;
+  if (source.platform !== destination.platform) {
+    throw new TypeError("Run source and destination platforms do not match");
+  }
+  if (source.platform === "slack" && destination.platform === "slack") {
+    if (source.teamId !== destination.teamId) {
+      throw new TypeError("Slack source and destination teams do not match");
+    }
+  } else if (source.platform === "local" && destination.platform === "local" && (source.conversationId !== request.conversationId || destination.conversationId !== request.conversationId)) {
+    throw new TypeError(
+      "Local source, destination, and run conversation IDs do not match"
+    );
+  }
+  const actor = request.routing.dispatch?.actor ?? request.routing.actor;
+  if (!actor || actor.platform === "system") {
+    return;
+  }
+  if (actor.platform !== destination.platform) {
+    throw new TypeError(
+      `Actor platform "${actor.platform}" does not match destination platform "${destination.platform}"`
+    );
+  }
+  if (actor.platform === "slack" && destination.platform === "slack" && actor.teamId !== destination.teamId) {
+    throw new TypeError("Slack actor team does not match destination team");
+  }
+}
+function toolInvocationDestination(routing) {
+  if (routing.destination.platform !== "slack" || !routing.toolChannelId) {
+    return routing.destination;
+  }
+  return {
+    platform: "slack",
+    teamId: routing.destination.teamId,
+    channelId: routing.toolChannelId
+  };
+}
+function surfaceFromRouting(routing) {
+  if (routing.surface) {
+    return routing.surface;
+  }
+  return routing.source.platform === "slack" ? "slack" : "internal";
+}
+
+// src/chat/slack/outbound.ts
+var MAX_SLACK_MESSAGE_TEXT_CHARS = 4e4;
+function requireSlackConversationId(channelId, action) {
+  const normalized = normalizeSlackConversationId(channelId);
+  if (!normalized) {
+    throw new Error(`${action} requires a valid channel ID`);
+  }
+  return normalized;
+}
+function requireSlackThreadTimestamp(threadTs, action) {
+  const normalized = threadTs.trim();
+  if (!normalized) {
+    throw new Error(`${action} requires a thread timestamp`);
+  }
+  return normalized;
+}
+function requireSlackMessageTimestamp(timestamp, action) {
+  const normalized = parseSlackMessageTs(timestamp);
+  if (!normalized) {
+    throw new Error(`${action} requires a target message timestamp`);
+  }
+  return normalized;
+}
+function requireSlackMessageText(text, action) {
+  if (text.trim().length === 0) {
+    throw new Error(`${action} requires non-empty text`);
+  }
+  if (text.length > MAX_SLACK_MESSAGE_TEXT_CHARS) {
+    throw new Error(
+      `${action} text exceeds Slack's 40000 character truncation limit`
+    );
+  }
+  return text;
+}
+async function getSlackMessagePermalink(args) {
+  try {
+    const response = await withSlackRetries(
+      () => getSlackClient().chat.getPermalink({
+        channel: args.channelId,
+        message_ts: args.messageTs
+      }),
+      3,
+      {
+        action: "chat.getPermalink",
+        idempotent: true,
+        spanAttributes: {
+          "app.slack.channel_id": args.channelId,
+          "app.slack.message_ts": args.messageTs
+        }
+      }
+    );
+    return response.permalink;
+  } catch {
+    return void 0;
+  }
+}
+async function postSlackMessage(input) {
+  const channelId = requireSlackConversationId(
+    input.channelId,
+    "Slack message posting"
+  );
+  const text = requireSlackMessageText(input.text, "Slack message posting");
+  const threadTs = input.threadTs ? requireSlackThreadTimestamp(
+    input.threadTs,
+    "Slack thread message posting"
+  ) : void 0;
+  const response = await withSlackRetries(
+    () => getSlackClient().chat.postMessage({
+      channel: channelId,
+      text,
+      ...input.blocks?.length ? {
+        blocks: input.blocks
+      } : {},
+      ...threadTs ? { thread_ts: threadTs } : {}
+    }),
+    3,
+    {
+      action: "chat.postMessage",
+      spanAttributes: {
+        "app.slack.channel_id": channelId,
+        ...threadTs ? { "app.slack.thread_ts": threadTs } : {}
+      }
+    }
+  );
+  const messageTs = parseSlackMessageTs(response.ts);
+  if (!messageTs) {
+    throw new Error("Slack message posted without ts");
+  }
+  return {
+    ts: messageTs,
+    ...input.includePermalink ? {
+      permalink: await getSlackMessagePermalink({
+        channelId,
+        messageTs
+      })
+    } : {}
+  };
+}
+async function postSlackEphemeralMessage(input) {
+  const channelId = requireSlackConversationId(
+    input.channelId,
+    "Slack ephemeral message posting"
+  );
+  const userId = parseSlackUserId(input.userId);
+  if (!userId) {
+    throw new Error("Slack ephemeral message posting requires a user ID");
+  }
+  const text = requireSlackMessageText(
+    input.text,
+    "Slack ephemeral message posting"
+  );
+  const threadTs = input.threadTs ? requireSlackThreadTimestamp(
+    input.threadTs,
+    "Slack ephemeral thread message posting"
+  ) : void 0;
+  const response = await withSlackRetries(
+    () => getSlackClient().chat.postEphemeral({
+      channel: channelId,
+      user: userId,
+      text,
+      ...threadTs ? { thread_ts: threadTs } : {}
+    }),
+    3,
+    {
+      action: "chat.postEphemeral",
+      spanAttributes: {
+        "app.slack.channel_id": channelId,
+        "app.slack.user_id": userId,
+        ...threadTs ? { "app.slack.thread_ts": threadTs } : {}
+      }
+    }
+  );
+  return {
+    messageTs: response.message_ts
+  };
+}
+async function uploadFilesToConversation(input) {
+  const channelId = requireSlackConversationId(
+    input.channelId,
+    "Slack file upload"
+  );
+  const threadTs = input.threadTs ? requireSlackThreadTimestamp(input.threadTs, "Slack file upload") : void 0;
+  if (input.files.length === 0) {
+    throw new Error("Slack file upload requires at least one file");
+  }
+  const fileUploads = input.files.map((file) => {
+    const filename = file.filename.trim();
+    if (!filename) {
+      throw new Error(
+        "Slack file upload requires every file to have a filename"
+      );
+    }
+    return {
+      file: file.data,
+      filename
+    };
+  });
+  const response = await withSlackRetries(
+    () => getSlackClient().filesUploadV2({
+      channel_id: channelId,
+      ...threadTs ? { thread_ts: threadTs } : {},
+      file_uploads: fileUploads
+    }),
+    3,
+    {
+      action: "filesUploadV2",
+      spanAttributes: {
+        "app.slack.channel_id": channelId,
+        ...threadTs ? { "app.slack.thread_ts": threadTs } : {}
+      }
+    }
+  );
+  return {
+    files: (response.files ?? []).flatMap(
+      (completion) => (completion.files ?? []).map((file) => file.id ? { id: file.id } : {})
+    )
+  };
+}
+async function addReactionToMessage(input) {
+  const channelId = requireSlackConversationId(
+    input.channelId,
+    "Slack reaction"
+  );
+  const timestamp = requireSlackMessageTimestamp(
+    input.timestamp,
+    "Slack reaction"
+  );
+  const emoji = normalizeSlackEmojiName(input.emoji);
+  if (!emoji) {
+    throw new Error("Slack reaction requires a valid emoji alias name");
+  }
+  try {
+    await withSlackRetries(
+      () => getSlackClient().reactions.add({
+        channel: channelId,
+        timestamp,
+        name: emoji
+      }),
+      3,
+      {
+        action: "reactions.add",
+        idempotent: true,
+        spanAttributes: {
+          "app.slack.channel_id": channelId,
+          "app.slack.message_ts": timestamp,
+          "app.slack.reaction": emoji
+        }
+      }
+    );
+  } catch (error) {
+    if (error instanceof SlackActionError && error.code === "already_reacted") {
+      return { ok: true };
+    }
+    throw error;
+  }
+  return { ok: true };
+}
+async function removeReactionFromMessage(input) {
+  const channelId = requireSlackConversationId(
+    input.channelId,
+    "Slack reaction removal"
+  );
+  const timestamp = requireSlackMessageTimestamp(
+    input.timestamp,
+    "Slack reaction removal"
+  );
+  const emoji = normalizeSlackEmojiName(input.emoji);
+  if (!emoji) {
+    throw new Error("Slack reaction removal requires a valid emoji alias name");
+  }
+  try {
+    await withSlackRetries(
+      () => getSlackClient().reactions.remove({
+        channel: channelId,
+        timestamp,
+        name: emoji
+      }),
+      3,
+      {
+        action: "reactions.remove",
+        idempotent: true,
+        spanAttributes: {
+          "app.slack.channel_id": channelId,
+          "app.slack.message_ts": timestamp,
+          "app.slack.reaction": emoji
+        }
+      }
+    );
+  } catch (error) {
+    if (error instanceof SlackActionError && error.code === "no_reaction") {
+      return { ok: true };
+    }
+    throw error;
+  }
+  return { ok: true };
+}
+
+// src/chat/oauth-flow.ts
+import { randomBytes } from "crypto";
+import {
+  sourceSchema
+} from "@sentry/junior-plugin-api";
+
+// src/chat/slack/status-format.ts
+var SLACK_STATUS_MAX_LENGTH = 50;
+function truncateStatusText(text) {
+  const trimmed = text.trim();
+  if (!trimmed) {
+    return "";
+  }
+  if (trimmed.length <= SLACK_STATUS_MAX_LENGTH) {
+    return trimmed;
+  }
+  return `${trimmed.slice(0, SLACK_STATUS_MAX_LENGTH - 3).trimEnd()}...`;
+}
+
+// src/chat/slack/mrkdwn.ts
+function escapeSlackMrkdwnText(text) {
+  return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}
+function escapeSlackLinkUrl(url) {
+  return url.replaceAll("&", "&amp;").replaceAll("<", "%3C").replaceAll(">", "%3E");
+}
+function formatSlackLink(url, label) {
+  return `<${escapeSlackLinkUrl(url)}|${escapeSlackMrkdwnText(label)}>`;
+}
+function readInlineCodeSpan(line, start) {
+  if (line[start] !== "`") {
+    return void 0;
+  }
+  let n = 1;
+  while (line[start + n] === "`") {
+    n++;
+  }
+  const marker = "`".repeat(n);
+  let search = start + n;
+  while (search < line.length) {
+    const close = line.indexOf(marker, search);
+    if (close === -1) {
+      return void 0;
+    }
+    const after = close + n;
+    if (line[after] !== "`") {
+      return { text: line.slice(start, after), end: after };
+    }
+    search = after + 1;
+  }
+  return void 0;
+}
+function readExistingSlackAngleToken(line, start) {
+  if (line[start] !== "<") {
+    return void 0;
+  }
+  const close = line.indexOf(">", start + 1);
+  if (close === -1) {
+    return void 0;
+  }
+  const body = line.slice(start + 1, close);
+  if (/^(?:https?:\/\/|@|#|!)/.test(body)) {
+    return { text: line.slice(start, close + 1), end: close + 1 };
+  }
+  return void 0;
+}
+function readMarkdownLink(line, start) {
+  if (line[start] !== "[") {
+    return void 0;
+  }
+  const labelEnd = line.indexOf("](", start + 1);
+  if (labelEnd === -1) {
+    return void 0;
+  }
+  const destStart = labelEnd + 2;
+  if (!line.startsWith("http://", destStart) && !line.startsWith("https://", destStart)) {
+    return void 0;
+  }
+  const closeParens = line.indexOf(")", destStart);
+  if (closeParens === -1) {
+    return void 0;
+  }
+  return { text: line.slice(start, closeParens + 1), end: closeParens + 1 };
+}
+function hasUnmatchedClosingParen(text) {
+  let balance = 0;
+  for (const ch of text) {
+    if (ch === "(") balance++;
+    else if (ch === ")") balance--;
+  }
+  return balance < 0;
+}
+function readBareUrl(line, start) {
+  let end = start;
+  while (end < line.length) {
+    const ch = line[end];
+    if (/\s/.test(ch) || ch === "<" || ch === ">" || ch === '"' || ch === "`" || ch === "|" || ch === "*") {
+      break;
+    }
+    end++;
+  }
+  if (end === start) {
+    return void 0;
+  }
+  let raw = line.slice(start, end);
+  let suffix = "";
+  const peel = () => {
+    suffix = raw.slice(-1) + suffix;
+    raw = raw.slice(0, -1);
+  };
+  const shouldPeel = () => raw.endsWith("_") || /[.,!?;:]$/.test(raw) || raw.endsWith(")") && hasUnmatchedClosingParen(raw);
+  while (raw.length > 0 && shouldPeel()) {
+    peel();
+  }
+  if (!/^https?:\/\/.+/.test(raw)) {
+    return void 0;
+  }
+  return { url: raw, suffix, end };
+}
+function wrapBareUrlsOnLine(line) {
+  let result = "";
+  let i = 0;
+  while (i < line.length) {
+    const codeSpan = readInlineCodeSpan(line, i);
+    if (codeSpan) {
+      result += codeSpan.text;
+      i = codeSpan.end;
+      continue;
+    }
+    const angleToken = readExistingSlackAngleToken(line, i);
+    if (angleToken) {
+      result += angleToken.text;
+      i = angleToken.end;
+      continue;
+    }
+    const mdLink = readMarkdownLink(line, i);
+    if (mdLink) {
+      result += mdLink.text;
+      i = mdLink.end;
+      continue;
+    }
+    if (line.startsWith("https://", i) || line.startsWith("http://", i)) {
+      const parsed = readBareUrl(line, i);
+      if (parsed) {
+        result += `<${parsed.url}>${parsed.suffix}`;
+        i = parsed.end;
+        continue;
+      }
+    }
+    result += line[i];
+    i++;
+  }
+  return result;
+}
+function wrapBareUrls(text) {
+  const lines = text.split("\n");
+  const out = [];
+  let inCodeBlock = false;
+  for (const line of lines) {
+    if (line.trimStart().startsWith("```")) {
+      inCodeBlock = !inCodeBlock;
+      out.push(line);
+      continue;
+    }
+    out.push(inCodeBlock ? line : wrapBareUrlsOnLine(line));
+  }
+  return out.join("\n");
+}
+function ensureBlockSpacing(text) {
+  const codeBlockPattern = /^```/;
+  const listItemPattern = /^[-*•]\s|^\d+\.\s/;
+  const lines = text.split("\n");
+  const result = [];
+  let inCodeBlock = false;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const isCodeFence = codeBlockPattern.test(line.trimStart());
+    if (isCodeFence) {
+      if (!inCodeBlock) {
+        const prev2 = result.length > 0 ? result[result.length - 1] : void 0;
+        if (prev2 !== void 0 && prev2.trim() !== "") {
+          result.push("");
+        }
+      }
+      inCodeBlock = !inCodeBlock;
+      result.push(line);
+      continue;
+    }
+    if (inCodeBlock) {
+      result.push(line);
+      continue;
+    }
+    const prev = result.length > 0 ? result[result.length - 1] : void 0;
+    if (prev !== void 0 && prev.trim() !== "" && line.trim() !== "" && !(listItemPattern.test(prev.trimStart()) && listItemPattern.test(line.trimStart()))) {
+      result.push("");
+    }
+    result.push(line);
+  }
+  return result.join("\n");
+}
+function normalizeSlackReplyMarkdown(text) {
+  let normalized = text.replace(/\r\n?/g, "\n").replace(/[ \t]+$/gm, "");
+  normalized = wrapBareUrls(normalized);
+  normalized = ensureBlockSpacing(normalized);
+  return normalized.replace(/\n{3,}/g, "\n\n").trim();
+}
+function normalizeSlackStatusText(text) {
+  const trimmed = text.trim();
+  if (!trimmed) {
+    return "";
+  }
+  return truncateStatusText(trimmed.replace(/(?:\.\s*)+$/, "").trim());
+}
+
+// src/chat/slack/oauth-authorization-message.ts
+function formatOAuthAuthorizationMessage(args) {
+  return `${formatSlackLink(args.authorizationUrl, args.label)}. ${args.completionText}`;
+}
+
+// src/chat/oauth-flow.ts
+var OAUTH_STATE_TTL_MS = 10 * 60 * 1e3;
+function optionalString(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function parseOAuthStatePayload(value) {
+  if (!isRecord(value)) {
+    return void 0;
+  }
+  if (typeof value.userId !== "string" || typeof value.provider !== "string") {
+    return void 0;
+  }
+  const destination = parseDestination(value.destination);
+  if (value.destination !== void 0 && !destination) {
+    return void 0;
+  }
+  const source = value.source === void 0 ? void 0 : sourceSchema.safeParse(value.source);
+  if (value.source !== void 0 && (!source || !source.success)) {
+    return void 0;
+  }
+  return {
+    userId: value.userId,
+    provider: value.provider,
+    ...optionalString(value.channelId) ? { channelId: optionalString(value.channelId) } : {},
+    ...destination ? { destination } : {},
+    ...source?.success ? { source: source.data } : {},
+    ...optionalString(value.threadTs) ? { threadTs: optionalString(value.threadTs) } : {},
+    ...optionalString(value.resumeConversationId) ? { resumeConversationId: optionalString(value.resumeConversationId) } : {},
+    ...optionalString(value.resumeSessionId) ? { resumeSessionId: optionalString(value.resumeSessionId) } : {},
+    ...optionalString(value.scope) ? { scope: optionalString(value.scope) } : {}
+  };
+}
+function formatProviderLabel(provider) {
+  const displayName = pluginCatalogRuntime.getDisplayName(provider);
+  if (!displayName) {
+    throw new Error(`Unknown plugin provider display name: "${provider}"`);
+  }
+  return displayName;
+}
+function resolveBaseUrl() {
+  const explicit = process.env.JUNIOR_BASE_URL?.trim();
+  if (explicit) return explicit;
+  const vercelProd = process.env.VERCEL_PROJECT_PRODUCTION_URL?.trim();
+  if (vercelProd) return `https://${vercelProd}`;
+  const vercelUrl = process.env.VERCEL_URL?.trim();
+  if (vercelUrl) return `https://${vercelUrl}`;
+  return void 0;
+}
+async function deliverPrivateMessage(input) {
+  let client;
+  try {
+    client = getSlackClient();
+  } catch {
+    logWarn(
+      "oauth_private_delivery_skip",
+      {},
+      { "app.reason": "missing_bot_token" },
+      "Skipped private message delivery \u2014 no SLACK_BOT_TOKEN"
+    );
+    return false;
+  }
+  if (input.channelId) {
+    try {
+      if (isDmChannel(input.channelId)) {
+        await postSlackMessage({
+          channelId: input.channelId,
+          text: input.text,
+          threadTs: input.threadTs
+        });
+      } else {
+        await postSlackEphemeralMessage({
+          channelId: input.channelId,
+          userId: input.userId,
+          text: input.text,
+          threadTs: input.threadTs
+        });
+      }
+      return "in_context";
+    } catch (error) {
+      logWarn(
+        "oauth_private_delivery_failed",
+        {},
+        {
+          "app.slack.error": error instanceof Error ? error.message : String(error),
+          "app.slack.channel": input.channelId
+        },
+        "Private message delivery failed, falling back to DM"
+      );
+    }
+  }
+  try {
+    const dmChannelId = (await withSlackRetries(
+      () => client.conversations.open({ users: input.userId }),
+      3,
+      {
+        action: "conversations.open",
+        spanAttributes: { "app.slack.user_id": input.userId }
+      }
+    )).channel?.id;
+    if (!dmChannelId) {
+      logWarn(
+        "oauth_dm_fallback_failed",
+        {},
+        { "app.reason": "no_dm_channel_id" },
+        "conversations.open returned no channel ID"
+      );
+      return false;
+    }
+    await postSlackMessage({ channelId: dmChannelId, text: input.text });
+    return "fallback_dm";
+  } catch (error) {
+    logWarn(
+      "oauth_dm_fallback_failed",
+      {},
+      {
+        "app.slack.error": error instanceof Error ? error.message : String(error)
+      },
+      "DM fallback delivery failed"
+    );
+    return false;
+  }
+}
+async function deliverOAuthAuthorization(request, input) {
+  if (input.authorization) {
+    await input.authorization.deliver(request);
+    return "in_context";
+  }
+  return await deliverPrivateMessage({
+    channelId: input.channelId,
+    threadTs: input.threadTs,
+    userId: input.userId,
+    text: formatOAuthAuthorizationMessage(request)
+  });
+}
+async function startOAuthFlow(provider, input) {
+  const providerConfig = pluginCatalogRuntime.getOAuthConfig(provider);
+  if (!providerConfig) {
+    return {
+      ok: false,
+      error: `Provider "${provider}" does not support OAuth authorization`
+    };
+  }
+  const clientId = process.env[providerConfig.clientIdEnv]?.trim();
+  if (!clientId) {
+    return {
+      ok: false,
+      error: `Missing ${providerConfig.clientIdEnv} environment variable`
+    };
+  }
+  const baseUrl = resolveBaseUrl();
+  if (!baseUrl) {
+    return {
+      ok: false,
+      error: "Cannot determine base URL (set JUNIOR_BASE_URL or deploy to Vercel)"
+    };
+  }
+  const state = input.authorization ? await input.authorization.createState() : randomBytes(32).toString("hex");
+  const requestedScope = input.scope ?? providerConfig.scope;
+  await getStateAdapter().set(
+    `oauth-state:${state}`,
+    {
+      userId: input.actorId,
+      provider,
+      ...input.channelId ? { channelId: input.channelId } : {},
+      ...input.destination ? { destination: input.destination } : {},
+      ...input.source ? { source: input.source } : {},
+      ...input.threadTs ? { threadTs: input.threadTs } : {},
+      ...input.resumeConversationId ? { resumeConversationId: input.resumeConversationId } : {},
+      ...input.resumeSessionId ? { resumeSessionId: input.resumeSessionId } : {},
+      ...requestedScope ? { scope: requestedScope } : {}
+    },
+    OAUTH_STATE_TTL_MS
+  );
+  const authorizeParams = new URLSearchParams({
+    client_id: clientId,
+    state,
+    redirect_uri: `${baseUrl}${providerConfig.callbackPath}`,
+    response_type: "code"
+  });
+  if (requestedScope) {
+    authorizeParams.set("scope", requestedScope);
+  }
+  for (const [key, value] of Object.entries(
+    providerConfig.authorizeParams ?? {}
+  )) {
+    authorizeParams.set(key, value);
+  }
+  logInfo(
+    "jr_rpc_oauth_start",
+    {},
+    {
+      "app.credential.provider": provider,
+      ...input.activeSkillName ? { "app.skill.name": input.activeSkillName } : {}
+    },
+    "Initiated OAuth authorization code flow"
+  );
+  const authorizationUrl = `${providerConfig.authorizeEndpoint}?${authorizeParams.toString()}`;
+  const authorizationRequest = {
+    authorizationUrl,
+    label: `Click here to link your ${formatProviderLabel(provider)} account`,
+    completionText: input.resumeSessionId ? "Once you've authorized, Junior will continue automatically." : "Once you've authorized, you'll see a confirmation in Slack."
+  };
+  return {
+    ok: true,
+    delivery: await deliverOAuthAuthorization(authorizationRequest, {
+      authorization: input.authorization,
+      channelId: input.channelId,
+      threadTs: input.threadTs,
+      userId: input.actorId
+    })
+  };
+}
+
+// src/chat/mcp/auth-store.ts
+import {
+  sourceSchema as sourceSchema2
+} from "@sentry/junior-plugin-api";
+var MCP_AUTH_SESSION_PREFIX = "junior:mcp_oauth_attempt:v2";
+var MCP_AUTH_CREDENTIALS_PREFIX = "junior:mcp_auth_credentials";
+var MCP_AUTH_SESSION_INDEX_PREFIX = "junior:mcp_oauth_attempt_index:v2";
+var MCP_SERVER_SESSION_PREFIX = "junior:mcp_server_session";
+var MCP_AUTH_SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
+var MCP_AUTH_CREDENTIALS_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+var MCP_SERVER_SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
+function sessionKey(authSessionId) {
+  return `${MCP_AUTH_SESSION_PREFIX}:${authSessionId}`;
+}
+function credentialsKey(userId, provider) {
+  return `${MCP_AUTH_CREDENTIALS_PREFIX}:${userId}:${provider}`;
+}
+function sessionIndexKey(userId, provider) {
+  return `${MCP_AUTH_SESSION_INDEX_PREFIX}:${userId}:${provider}`;
+}
+function serverSessionKey(userId, provider) {
+  return `${MCP_SERVER_SESSION_PREFIX}:${userId}:${provider}`;
+}
+function parseSessionIndex(value) {
+  if (typeof value !== "string") {
+    return [];
+  }
+  try {
+    const parsed = JSON.parse(value);
+    if (!Array.isArray(parsed)) {
+      return [];
+    }
+    return [
+      ...new Set(parsed.filter((id) => typeof id === "string"))
+    ];
+  } catch {
+    return [];
+  }
+}
+function parseMcpAuthSession(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  try {
+    const parsed = JSON.parse(value);
+    if (!isRecord(parsed)) {
+      return void 0;
+    }
+    if (parsed.schemaVersion !== 2 || typeof parsed.authSessionId !== "string" || typeof parsed.provider !== "string" || typeof parsed.userId !== "string" || typeof parsed.conversationId !== "string" || typeof parsed.sessionId !== "string" || typeof parsed.userMessage !== "string" || typeof parsed.createdAtMs !== "number" || typeof parsed.updatedAtMs !== "number") {
+      return void 0;
+    }
+    const destination = parsed.destination === void 0 ? void 0 : parseDestination(parsed.destination);
+    if (parsed.destination !== void 0 && !destination) {
+      return void 0;
+    }
+    const source = parsed.source === void 0 ? void 0 : sourceSchema2.safeParse(parsed.source);
+    if (parsed.source !== void 0 && (!source || !source.success)) {
+      return void 0;
+    }
+    return {
+      schemaVersion: 2,
+      authSessionId: parsed.authSessionId,
+      provider: parsed.provider,
+      userId: parsed.userId,
+      conversationId: parsed.conversationId,
+      ...destination ? { destination } : {},
+      ...source?.success ? { source: source.data } : {},
+      sessionId: parsed.sessionId,
+      userMessage: parsed.userMessage,
+      createdAtMs: parsed.createdAtMs,
+      updatedAtMs: parsed.updatedAtMs,
+      ...typeof parsed.channelId === "string" ? { channelId: parsed.channelId } : {},
+      ...typeof parsed.threadTs === "string" ? { threadTs: parsed.threadTs } : {},
+      ...typeof parsed.toolChannelId === "string" ? { toolChannelId: parsed.toolChannelId } : {},
+      ...isRecord(parsed.configuration) ? { configuration: parsed.configuration } : {},
+      ...isRecord(parsed.artifactState) ? { artifactState: parsed.artifactState } : {},
+      ...typeof parsed.authorizationUrl === "string" ? { authorizationUrl: parsed.authorizationUrl } : {},
+      ...typeof parsed.codeVerifier === "string" ? { codeVerifier: parsed.codeVerifier } : {}
+    };
+  } catch {
+    return void 0;
+  }
+}
+function parseServerSession(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  try {
+    const parsed = JSON.parse(value);
+    if (!isRecord(parsed) || typeof parsed.sessionId !== "string" || typeof parsed.updatedAtMs !== "number") {
+      return void 0;
+    }
+    return {
+      sessionId: parsed.sessionId,
+      updatedAtMs: parsed.updatedAtMs
+    };
+  } catch {
+    return void 0;
+  }
+}
+function parseStoredCredentials(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  try {
+    const parsed = JSON.parse(value);
+    if (!isRecord(parsed)) {
+      return void 0;
+    }
+    return {
+      ...isRecord(parsed.clientInformation) ? {
+        clientInformation: parsed.clientInformation
+      } : {},
+      ...isRecord(parsed.discoveryState) ? {
+        discoveryState: parsed.discoveryState
+      } : {},
+      ...isRecord(parsed.tokens) ? { tokens: parsed.tokens } : {}
+    };
+  } catch {
+    return void 0;
+  }
+}
+async function getConnectedStateAdapter() {
+  const stateAdapter = getStateAdapter();
+  await stateAdapter.connect();
+  return stateAdapter;
+}
+async function getMcpAuthSession(authSessionId) {
+  const stateAdapter = await getConnectedStateAdapter();
+  return parseMcpAuthSession(await stateAdapter.get(sessionKey(authSessionId)));
+}
+async function putMcpAuthSession(session, ttlMs = MCP_AUTH_SESSION_TTL_MS) {
+  const stateAdapter = await getConnectedStateAdapter();
+  await stateAdapter.set(
+    sessionKey(session.authSessionId),
+    JSON.stringify(session),
+    ttlMs
+  );
+  const nextIndex = parseSessionIndex(
+    await stateAdapter.get(sessionIndexKey(session.userId, session.provider))
+  );
+  if (!nextIndex.includes(session.authSessionId)) {
+    nextIndex.push(session.authSessionId);
+  }
+  await stateAdapter.set(
+    sessionIndexKey(session.userId, session.provider),
+    JSON.stringify(nextIndex),
+    ttlMs
+  );
+}
+async function patchMcpAuthSession(authSessionId, patch) {
+  const current = await getMcpAuthSession(authSessionId);
+  if (!current) {
+    throw new Error(`Unknown MCP auth session: ${authSessionId}`);
+  }
+  const next = {
+    ...current,
+    ...patch,
+    schemaVersion: 2,
+    authSessionId: current.authSessionId,
+    provider: current.provider,
+    userId: current.userId,
+    conversationId: current.conversationId,
+    ...current.destination ? { destination: current.destination } : {},
+    sessionId: current.sessionId,
+    userMessage: current.userMessage,
+    createdAtMs: current.createdAtMs,
+    updatedAtMs: Date.now()
+  };
+  await putMcpAuthSession(next);
+  return next;
+}
+async function deleteMcpAuthSession(authSessionId) {
+  const stateAdapter = await getConnectedStateAdapter();
+  const current = parseMcpAuthSession(
+    await stateAdapter.get(sessionKey(authSessionId))
+  );
+  await stateAdapter.delete(sessionKey(authSessionId));
+  if (!current) {
+    return;
+  }
+  const nextIndex = parseSessionIndex(
+    await stateAdapter.get(sessionIndexKey(current.userId, current.provider))
+  ).filter((id) => id !== authSessionId);
+  if (nextIndex.length > 0) {
+    await stateAdapter.set(
+      sessionIndexKey(current.userId, current.provider),
+      JSON.stringify(nextIndex),
+      MCP_AUTH_SESSION_TTL_MS
+    );
+    return;
+  }
+  await stateAdapter.delete(sessionIndexKey(current.userId, current.provider));
+}
+async function deleteMcpAuthSessionsForUserProvider(userId, provider) {
+  const stateAdapter = await getConnectedStateAdapter();
+  const indexKey = sessionIndexKey(userId, provider);
+  const authSessionIds = parseSessionIndex(await stateAdapter.get(indexKey));
+  for (const authSessionId of authSessionIds) {
+    await stateAdapter.delete(sessionKey(authSessionId));
+  }
+  await stateAdapter.delete(indexKey);
+}
+async function getMcpStoredOAuthCredentials(userId, provider) {
+  const stateAdapter = await getConnectedStateAdapter();
+  return parseStoredCredentials(
+    await stateAdapter.get(credentialsKey(userId, provider))
+  );
+}
+async function putMcpStoredOAuthCredentials(userId, provider, value, ttlMs = MCP_AUTH_CREDENTIALS_TTL_MS) {
+  const stateAdapter = await getConnectedStateAdapter();
+  await stateAdapter.set(
+    credentialsKey(userId, provider),
+    JSON.stringify(value),
+    ttlMs
+  );
+}
+async function deleteMcpStoredOAuthCredentials(userId, provider) {
+  const stateAdapter = await getConnectedStateAdapter();
+  await stateAdapter.delete(credentialsKey(userId, provider));
+}
+async function getMcpServerSessionId(userId, provider) {
+  const stateAdapter = await getConnectedStateAdapter();
+  return parseServerSession(
+    await stateAdapter.get(serverSessionKey(userId, provider))
+  )?.sessionId;
+}
+async function putMcpServerSessionId(userId, provider, sessionId, ttlMs = MCP_SERVER_SESSION_TTL_MS) {
+  const stateAdapter = await getConnectedStateAdapter();
+  await stateAdapter.set(
+    serverSessionKey(userId, provider),
+    JSON.stringify({
+      sessionId,
+      updatedAtMs: Date.now()
+    }),
+    ttlMs
+  );
+}
+async function deleteMcpServerSessionId(userId, provider) {
+  const stateAdapter = await getConnectedStateAdapter();
+  await stateAdapter.delete(serverSessionKey(userId, provider));
+}
+
+// src/chat/mcp/oauth.ts
+import { randomUUID } from "crypto";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+
+// src/chat/mcp/oauth-provider.ts
+function createClientMetadata(callbackUrl) {
+  return {
+    client_name: "Junior MCP Client",
+    redirect_uris: [callbackUrl],
+    grant_types: ["authorization_code", "refresh_token"],
+    response_types: ["code"],
+    token_endpoint_auth_method: "none"
+  };
+}
+function clientAllowsRedirectUri(clientInformation, callbackUrl) {
+  const redirectUris = clientInformation.redirect_uris;
+  if (!Array.isArray(redirectUris)) {
+    return true;
+  }
+  return redirectUris.includes(callbackUrl);
+}
+var StateBackedMcpOAuthClientProvider = class {
+  constructor(authSessionId, callbackUrl, sessionContext, runCredentialMutation) {
+    this.authSessionId = authSessionId;
+    this.callbackUrl = callbackUrl;
+    this.sessionContext = sessionContext;
+    this.runCredentialMutation = runCredentialMutation;
+    this.clientMetadata = createClientMetadata(callbackUrl);
+  }
+  authSessionId;
+  callbackUrl;
+  sessionContext;
+  runCredentialMutation;
+  clientMetadata;
+  get redirectUrl() {
+    return this.callbackUrl;
+  }
+  async state() {
+    return this.authSessionId;
+  }
+  async clientInformation() {
+    const session = await this.getCredentialContext();
+    const credentials = await getMcpStoredOAuthCredentials(
+      session.userId,
+      session.provider
+    );
+    const clientInformation = credentials?.clientInformation;
+    if (!clientInformation) {
+      return void 0;
+    }
+    if (clientAllowsRedirectUri(clientInformation, this.callbackUrl)) {
+      return clientInformation;
+    }
+    return void 0;
+  }
+  async saveClientInformation(clientInformation) {
+    await this.mutateCredentials(async () => {
+      const session = await this.getCredentialContext();
+      const credentials = await getMcpStoredOAuthCredentials(
+        session.userId,
+        session.provider
+      ) ?? {};
+      await putMcpStoredOAuthCredentials(session.userId, session.provider, {
+        ...credentials,
+        clientInformation
+      });
+    });
+  }
+  async tokens() {
+    const session = await this.getCredentialContext();
+    const credentials = await getMcpStoredOAuthCredentials(
+      session.userId,
+      session.provider
+    );
+    return credentials?.tokens;
+  }
+  async saveTokens(tokens) {
+    await this.mutateCredentials(async () => {
+      const session = await this.getCredentialContext();
+      const credentials = await getMcpStoredOAuthCredentials(
+        session.userId,
+        session.provider
+      ) ?? {};
+      await putMcpStoredOAuthCredentials(session.userId, session.provider, {
+        ...credentials,
+        tokens
+      });
+    });
+  }
+  async redirectToAuthorization(authorizationUrl) {
+    const existing = await getMcpAuthSession(this.authSessionId);
+    if (existing?.authorizationUrl && existing.authorizationUrl !== authorizationUrl.toString()) {
+      throw new Error("MCP OAuth authorization attempt is already initialized");
+    }
+    await this.ensureSession({
+      authorizationUrl: authorizationUrl.toString()
+    });
+  }
+  async saveCodeVerifier(codeVerifier) {
+    const existing = await getMcpAuthSession(this.authSessionId);
+    if (existing?.codeVerifier && existing.codeVerifier !== codeVerifier) {
+      throw new Error("MCP OAuth authorization attempt is already initialized");
+    }
+    await this.ensureSession({ codeVerifier });
+  }
+  async codeVerifier() {
+    const session = await this.requireSession();
+    if (!session.codeVerifier) {
+      throw new Error("Missing MCP OAuth code verifier");
+    }
+    return session.codeVerifier;
+  }
+  async saveDiscoveryState(state) {
+    await this.mutateCredentials(async () => {
+      const session = await this.getCredentialContext();
+      const credentials = await getMcpStoredOAuthCredentials(
+        session.userId,
+        session.provider
+      ) ?? {};
+      await putMcpStoredOAuthCredentials(session.userId, session.provider, {
+        ...credentials,
+        discoveryState: state
+      });
+    });
+  }
+  async discoveryState() {
+    const session = await this.getCredentialContext();
+    const credentials = await getMcpStoredOAuthCredentials(
+      session.userId,
+      session.provider
+    );
+    return credentials?.discoveryState;
+  }
+  async invalidateCredentials(scope) {
+    await this.mutateCredentials(async () => {
+      const session = await this.getCredentialContext();
+      const credentials = await getMcpStoredOAuthCredentials(
+        session.userId,
+        session.provider
+      ) ?? {};
+      await putMcpStoredOAuthCredentials(session.userId, session.provider, {
+        ...scope === "tokens" || scope === "all" ? {} : credentials.tokens ? { tokens: credentials.tokens } : {},
+        ...scope === "client" || scope === "all" ? {} : credentials.clientInformation ? { clientInformation: credentials.clientInformation } : {},
+        ...scope === "discovery" || scope === "all" ? {} : credentials.discoveryState ? { discoveryState: credentials.discoveryState } : {}
+      });
+    });
+  }
+  async getMcpServerSessionId() {
+    const session = await this.getCredentialContext();
+    return await getMcpServerSessionId(session.userId, session.provider);
+  }
+  async saveMcpServerSessionId(sessionId) {
+    await this.mutateCredentials(async () => {
+      const session = await this.getCredentialContext();
+      if (!sessionId) {
+        await deleteMcpServerSessionId(session.userId, session.provider);
+        return;
+      }
+      await putMcpServerSessionId(session.userId, session.provider, sessionId);
+    });
+  }
+  /** Route shared credential writes through callback-owned freshness control. */
+  async mutateCredentials(mutation) {
+    return this.runCredentialMutation ? await this.runCredentialMutation(mutation) : await mutation();
+  }
+  async getCredentialContext() {
+    return this.sessionContext ?? await this.requireSession();
+  }
+  async ensureSession(patch) {
+    const existing = await getMcpAuthSession(this.authSessionId);
+    if (existing) {
+      return await patchMcpAuthSession(this.authSessionId, patch);
+    }
+    if (!this.sessionContext) {
+      throw new Error(`Unknown MCP auth session: ${this.authSessionId}`);
+    }
+    const now = Date.now();
+    const nextSession = {
+      schemaVersion: 2,
+      authSessionId: this.authSessionId,
+      ...this.sessionContext,
+      ...patch,
+      createdAtMs: now,
+      updatedAtMs: now
+    };
+    await putMcpAuthSession(nextSession);
+    return nextSession;
+  }
+  async requireSession() {
+    const session = await getMcpAuthSession(this.authSessionId);
+    if (!session) {
+      throw new Error(`Unknown MCP auth session: ${this.authSessionId}`);
+    }
+    return session;
+  }
+};
+
+// src/chat/mcp/oauth.ts
+function getMcpOAuthCallbackPath(provider) {
+  return `/api/oauth/callback/mcp/${provider}`;
+}
+function requirePluginWithMcp(provider) {
+  const plugin = pluginCatalogRuntime.getDefinition(provider);
+  if (!plugin?.manifest.mcp) {
+    throw new Error(`Plugin "${provider}" does not support MCP`);
+  }
+  return plugin;
+}
+async function createMcpOAuthClientProvider(input) {
+  requirePluginWithMcp(input.provider);
+  const baseUrl = resolveBaseUrl();
+  if (!baseUrl) {
+    throw new Error(
+      "Cannot determine base URL (set JUNIOR_BASE_URL or deploy to Vercel)"
+    );
+  }
+  const authSessionId = input.createAuthorizationState ? await input.createAuthorizationState() : randomUUID();
+  return new StateBackedMcpOAuthClientProvider(
+    authSessionId,
+    `${baseUrl}${getMcpOAuthCallbackPath(input.provider)}`,
+    {
+      provider: input.provider,
+      userId: input.userId,
+      conversationId: input.conversationId,
+      ...input.destination ? { destination: input.destination } : {},
+      ...input.source ? { source: input.source } : {},
+      sessionId: input.sessionId,
+      userMessage: input.userMessage,
+      ...input.channelId ? { channelId: input.channelId } : {},
+      ...input.threadTs ? { threadTs: input.threadTs } : {},
+      ...input.toolChannelId ? { toolChannelId: input.toolChannelId } : {},
+      ...input.configuration ? { configuration: input.configuration } : {},
+      ...input.artifactState ? { artifactState: input.artifactState } : {}
+    }
+  );
+}
+async function finalizeMcpAuthorization(provider, authSessionId, authorizationCode, runCredentialMutation) {
+  const plugin = requirePluginWithMcp(provider);
+  const mcp = plugin.manifest.mcp;
+  if (!mcp) {
+    throw new Error(`Plugin "${provider}" does not support MCP`);
+  }
+  const session = await getMcpAuthSession(authSessionId);
+  if (!session) {
+    throw new Error(`Unknown MCP auth session: ${authSessionId}`);
+  }
+  if (session.provider !== provider) {
+    throw new Error(
+      `MCP auth session provider mismatch: expected "${provider}", got "${session.provider}"`
+    );
+  }
+  const baseUrl = resolveBaseUrl();
+  if (!baseUrl) {
+    throw new Error(
+      "Cannot determine base URL (set JUNIOR_BASE_URL or deploy to Vercel)"
+    );
+  }
+  const callbackUrl = `${baseUrl}${getMcpOAuthCallbackPath(provider)}`;
+  const authProvider = new StateBackedMcpOAuthClientProvider(
+    authSessionId,
+    callbackUrl,
+    void 0,
+    runCredentialMutation
+  );
+  const requestInit = {};
+  if (mcp.headers && Object.keys(mcp.headers).length > 0) {
+    requestInit.headers = new Headers(mcp.headers);
+  }
+  const transport = new StreamableHTTPClientTransport(new URL(mcp.url), {
+    ...Object.keys(requestInit).length > 0 ? { requestInit } : {},
+    authProvider
+  });
+  try {
+    await transport.finishAuth(authorizationCode);
+  } finally {
+    await transport.close();
+  }
+  const nextSession = await getMcpAuthSession(authSessionId);
+  if (!nextSession) {
+    throw new Error(`Unknown MCP auth session: ${authSessionId}`);
+  }
+  return nextSession;
+}
+
+// src/chat/plugins/credential-hooks.ts
+import {
+  pluginAuthorizationSchema,
+  pluginCredentialResultSchema,
+  pluginGrantSchema,
+  pluginProviderAccountSchema
+} from "@sentry/junior-plugin-api";
+function parseSchema(schema, value, message) {
+  const result = schema.safeParse(value);
+  if (!result.success) {
+    throw new Error(message);
+  }
+  return result.data;
+}
+function parseAuthorization(value, pluginName) {
+  if (value === void 0) {
+    return void 0;
+  }
+  const authorization = parseSchema(
+    pluginAuthorizationSchema,
+    value,
+    `Plugin "${pluginName}" grant authorization is invalid`
+  );
+  if (authorization.provider !== pluginName) {
+    throw new Error(
+      `Plugin "${pluginName}" grant authorization provider must match the issuing plugin`
+    );
+  }
+  return authorization;
+}
+function parseGrant(value, pluginName) {
+  return parseSchema(
+    pluginGrantSchema,
+    value,
+    `Plugin "${pluginName}" grantForEgress returned an invalid grant`
+  );
+}
+function pluginFor(provider) {
+  return getPlugins().find((candidate) => candidate.manifest.name === provider);
+}
+function basePluginContext(plugin) {
+  const pluginName = plugin.manifest.name;
+  return {
+    plugin: { name: pluginName },
+    log: createPluginLogger(pluginName),
+    db: getDb()
+  };
+}
+function parseCredentialResult(value, pluginName) {
+  const result = parseSchema(
+    pluginCredentialResultSchema,
+    value,
+    `Plugin "${pluginName}" issueCredential result is invalid`
+  );
+  if (result.type === "lease") {
+    parseAuthorization(result.lease.authorization, pluginName);
+    return result;
+  }
+  if (result.type === "unavailable") {
+    return result;
+  }
+  parseAuthorization(result.authorization, pluginName);
+  return result;
+}
+async function selectPluginGrant(input) {
+  const plugin = pluginFor(input.provider);
+  const hook = plugin?.hooks?.grantForEgress;
+  if (!plugin || !hook) {
+    return void 0;
+  }
+  const result = await hook({
+    ...basePluginContext(plugin),
+    request: {
+      ...input.bodyText !== void 0 ? { bodyText: input.bodyText } : {},
+      method: input.method,
+      ...input.operation ? { operation: input.operation } : {},
+      url: input.upstreamUrl.toString()
+    }
+  });
+  return result === void 0 ? void 0 : parseGrant(result, plugin.manifest.name);
+}
+async function onPluginEgressResponse(input) {
+  const plugin = pluginFor(input.provider);
+  const hook = plugin?.hooks?.onEgressResponse;
+  if (!plugin || !hook) {
+    return {};
+  }
+  let permissionDenied;
+  await hook({
+    ...basePluginContext(plugin),
+    grant: input.grant,
+    permissionDenied(message) {
+      const trimmed = message.trim();
+      if (!trimmed) {
+        throw new Error(
+          `Plugin "${plugin.manifest.name}" onEgressResponse permissionDenied message is empty`
+        );
+      }
+      permissionDenied = { message: trimmed };
+    },
+    request: {
+      method: input.method,
+      ...input.operation ? { operation: input.operation } : {},
+      url: input.upstreamUrl.toString()
+    },
+    response: input.response
+  });
+  return permissionDenied ? { permissionDenied } : {};
+}
+function hasEgressCredentialHooks(provider) {
+  const hooks = pluginFor(provider)?.hooks;
+  return Boolean(hooks?.grantForEgress || hooks?.issueCredential);
+}
+async function resolvePluginOAuthAccount(input) {
+  const plugin = pluginFor(input.provider);
+  const hook = plugin?.hooks?.resolveOAuthAccount;
+  if (!plugin || !hook) {
+    return void 0;
+  }
+  const account = await hook({
+    ...basePluginContext(plugin),
+    tokens: input.tokens
+  });
+  return account === void 0 ? void 0 : parseSchema(
+    pluginProviderAccountSchema,
+    account,
+    `Plugin "${plugin.manifest.name}" resolveOAuthAccount returned an invalid account`
+  );
+}
+async function issuePluginCredential(input) {
+  const plugin = pluginFor(input.provider);
+  const hook = plugin?.hooks?.issueCredential;
+  if (!plugin || !hook) {
+    throw new Error(`Plugin "${input.provider}" has no issueCredential hook`);
+  }
+  const currentUserId = "type" in input.actor ? input.actor.userId : void 0;
+  const credentialSubjectUserId = input.credentialSubject?.userId;
+  const result = await hook({
+    ...basePluginContext(plugin),
+    actor: input.actor,
+    grant: input.grant,
+    ...input.credentialSubject ? { credentialSubject: input.credentialSubject } : {},
+    tokens: {
+      ...currentUserId ? {
+        currentUser: {
+          userId: currentUserId,
+          get: async () => await input.userTokenStore.get(
+            currentUserId,
+            plugin.manifest.name
+          ),
+          set: async (tokens) => {
+            await input.userTokenStore.set(
+              currentUserId,
+              plugin.manifest.name,
+              tokens
+            );
+          },
+          withRefresh: async (callback) => await input.userTokenStore.withRefresh(
+            currentUserId,
+            plugin.manifest.name,
+            callback
+          )
+        }
+      } : {},
+      ...credentialSubjectUserId ? {
+        credentialSubject: {
+          userId: credentialSubjectUserId,
+          get: async () => await input.userTokenStore.get(
+            credentialSubjectUserId,
+            plugin.manifest.name
+          ),
+          set: async (tokens) => {
+            await input.userTokenStore.set(
+              credentialSubjectUserId,
+              plugin.manifest.name,
+              tokens
+            );
+          },
+          withRefresh: async (callback) => await input.userTokenStore.withRefresh(
+            credentialSubjectUserId,
+            plugin.manifest.name,
+            callback
+          )
+        }
+      } : {}
+    }
+  });
+  return parseCredentialResult(result, plugin.manifest.name);
+}
+
+// src/chat/slack/output.ts
+var MAX_INLINE_CHARS = 2200;
+var MAX_INLINE_LINES = 45;
+var CONTINUED_MARKER = "\n\n[Continued below]";
+function countSlackLines(text) {
+  if (!text) {
+    return 0;
+  }
+  return text.split("\n").length;
+}
+function fitsInlineBudget(text, maxChars = MAX_INLINE_CHARS, maxLines = MAX_INLINE_LINES) {
+  return text.length <= maxChars && countSlackLines(text) <= maxLines;
+}
+function findSplitIndex(text, maxChars) {
+  if (text.length <= maxChars) {
+    return text.length;
+  }
+  const bounded = text.slice(0, maxChars);
+  const newlineIndex = bounded.lastIndexOf("\n");
+  if (newlineIndex > 0) {
+    return newlineIndex;
+  }
+  const spaceIndex = bounded.lastIndexOf(" ");
+  if (spaceIndex > 0) {
+    return spaceIndex;
+  }
+  return maxChars;
+}
+function splitByLineBudget(text, maxLines) {
+  if (maxLines <= 0) {
+    return "";
+  }
+  const lines = text.split("\n");
+  if (lines.length <= maxLines) {
+    return text;
+  }
+  return lines.slice(0, maxLines).join("\n");
+}
+function reserveInlineBudgetForSuffix(suffix, maxChars = MAX_INLINE_CHARS, maxLines = MAX_INLINE_LINES) {
+  return {
+    maxChars: Math.max(1, maxChars - suffix.length),
+    maxLines: Math.max(1, maxLines - Math.max(0, countSlackLines(suffix) - 1))
+  };
+}
+function forceSplitBudget(text, budget) {
+  const lineCount = countSlackLines(text);
+  return {
+    maxChars: text.length <= budget.maxChars ? Math.max(1, text.length - 1) : budget.maxChars,
+    maxLines: lineCount <= budget.maxLines ? Math.max(1, lineCount - 1) : budget.maxLines
+  };
+}
+function getFenceContinuation(text) {
+  let open;
+  for (const line of text.split("\n")) {
+    const trimmed = line.trimStart();
+    const openerMatch = trimmed.match(/^(`{3,}|~{3,})(.*)$/);
+    if (!openerMatch) {
+      continue;
+    }
+    if (!open) {
+      open = {
+        fence: openerMatch[1],
+        openerLine: trimmed
+      };
+      continue;
+    }
+    if (new RegExp(`^${open.fence}\\s*$`).test(trimmed)) {
+      open = void 0;
+    }
+  }
+  if (!open) {
+    return null;
+  }
+  return {
+    closeSuffix: text.endsWith("\n") ? open.fence : `
+${open.fence}`,
+    reopenPrefix: `${open.openerLine}
+`
+  };
+}
+function appendSlackSuffix(text, marker) {
+  const carryover = getFenceContinuation(text);
+  return `${text}${carryover?.closeSuffix ?? ""}${marker}`;
+}
+function stripTrailingContinuationMarker(text) {
+  return text.endsWith(CONTINUED_MARKER) ? text.slice(0, -CONTINUED_MARKER.length) : text;
+}
+function takeSlackContinuationChunk(text, budget) {
+  let { prefix, rest } = takeSlackInlinePrefix(text, budget);
+  if (!rest) {
+    ({ prefix, rest } = takeSlackInlinePrefix(
+      text,
+      forceSplitBudget(text, budget)
+    ));
+  }
+  let carryover = rest ? getFenceContinuation(prefix) : null;
+  if (!carryover) {
+    return { prefix, rest };
+  }
+  const carryoverBudget = reserveInlineBudgetForSuffix(
+    `${carryover.closeSuffix}${CONTINUED_MARKER}`
+  );
+  ({ prefix, rest } = takeSlackInlinePrefix(text, carryoverBudget));
+  if (!rest) {
+    ({ prefix, rest } = takeSlackInlinePrefix(
+      text,
+      forceSplitBudget(text, carryoverBudget)
+    ));
+  }
+  carryover = rest ? getFenceContinuation(prefix) : null;
+  if (!carryover) {
+    return { prefix, rest };
+  }
+  return {
+    prefix,
+    rest: `${carryover.reopenPrefix}${rest}`
+  };
+}
+function takeSlackContinuationPrefix(text, options) {
+  const budget = {
+    maxChars: options?.maxChars ?? getSlackContinuationBudget().maxChars,
+    maxLines: options?.maxLines ?? getSlackContinuationBudget().maxLines
+  };
+  const { prefix, rest } = (() => {
+    if (options?.forceSplit) {
+      return takeSlackContinuationChunk(text, budget);
+    }
+    const initial = takeSlackInlinePrefix(text, budget);
+    return initial.rest ? takeSlackContinuationChunk(text, budget) : initial;
+  })();
+  return {
+    prefix,
+    renderedPrefix: rest ? appendSlackSuffix(prefix, CONTINUED_MARKER) : prefix,
+    rest
+  };
+}
+function takeSlackInlinePrefix(text, options) {
+  const maxChars = options?.maxChars ?? MAX_INLINE_CHARS;
+  const maxLines = options?.maxLines ?? MAX_INLINE_LINES;
+  const normalized = text.replace(/\r\n?/g, "\n");
+  if (!normalized) {
+    return { prefix: "", rest: "" };
+  }
+  if (fitsInlineBudget(normalized, maxChars, maxLines)) {
+    return { prefix: normalized, rest: "" };
+  }
+  const lineBounded = splitByLineBudget(normalized, maxLines);
+  const cutIndex = findSplitIndex(lineBounded, maxChars);
+  const prefix = lineBounded.slice(0, cutIndex).trimEnd();
+  if (prefix) {
+    return {
+      prefix,
+      rest: normalized.slice(prefix.length).trimStart()
+    };
+  }
+  const hardPrefix = normalized.slice(0, Math.max(1, maxChars)).trimEnd();
+  return {
+    prefix: hardPrefix || normalized.slice(0, Math.max(1, maxChars)),
+    rest: normalized.slice(hardPrefix.length || Math.max(1, maxChars)).trimStart()
+  };
+}
+function splitSlackReplyText(text, options) {
+  const normalized = normalizeSlackReplyMarkdown(text);
+  if (!normalized) {
+    return [];
+  }
+  const chunks = [];
+  const continuationBudget = reserveInlineBudgetForSuffix(CONTINUED_MARKER);
+  let remaining = normalized;
+  while (remaining) {
+    const fitsFinalChunk = options?.interrupted ? fitsInlineBudget(appendSlackSuffix(remaining, getInterruptionMarker())) : fitsInlineBudget(remaining);
+    if (fitsFinalChunk) {
+      chunks.push(
+        options?.interrupted ? appendSlackSuffix(remaining, getInterruptionMarker()) : remaining
+      );
+      break;
+    }
+    const { renderedPrefix, rest } = takeSlackContinuationPrefix(remaining, {
+      ...continuationBudget,
+      forceSplit: true
+    });
+    chunks.push(renderedPrefix);
+    remaining = rest;
+  }
+  if (chunks.length === 2) {
+    chunks[0] = stripTrailingContinuationMarker(chunks[0] ?? "");
+  }
+  return chunks;
+}
+function getSlackContinuationBudget() {
+  return reserveInlineBudgetForSuffix(CONTINUED_MARKER);
+}
+function buildSlackOutputMessage(text) {
+  const normalized = normalizeSlackReplyMarkdown(text);
+  if (!normalized) {
+    throw new Error(
+      `Slack output normalized to empty content: original_length=${text.length} parsed_length=${normalized.length}`
+    );
+  }
+  return {
+    markdown: normalized
+  };
+}
+var slackOutputPolicy = {
+  maxInlineChars: MAX_INLINE_CHARS,
+  maxInlineLines: MAX_INLINE_LINES
+};
+
+export {
+  RetryableDeliveryError,
+  actorFromRouting,
+  assertRunRoutingConsistency,
+  toolInvocationDestination,
+  surfaceFromRouting,
+  truncateStatusText,
+  escapeSlackMrkdwnText,
+  formatSlackLink,
+  normalizeSlackStatusText,
+  splitSlackReplyText,
+  buildSlackOutputMessage,
+  slackOutputPolicy,
+  createUserTokenStore,
+  issueProviderCredentialLease,
+  getSlackMessagePermalink,
+  postSlackMessage,
+  uploadFilesToConversation,
+  addReactionToMessage,
+  removeReactionFromMessage,
+  parseOAuthStatePayload,
+  formatProviderLabel,
+  resolveBaseUrl,
+  deliverOAuthAuthorization,
+  startOAuthFlow,
+  getMcpAuthSession,
+  patchMcpAuthSession,
+  deleteMcpAuthSession,
+  deleteMcpAuthSessionsForUserProvider,
+  getMcpStoredOAuthCredentials,
+  deleteMcpStoredOAuthCredentials,
+  deleteMcpServerSessionId,
+  createMcpOAuthClientProvider,
+  finalizeMcpAuthorization,
+  selectPluginGrant,
+  onPluginEgressResponse,
+  hasEgressCredentialHooks,
+  resolvePluginOAuthAccount,
+  issuePluginCredential
+};