@sentry/junior 0.114.0 → 0.116.0

package/dist/{chunk-TLGM5X2M.js → chunk-6RQ5GCWH.js}

@@ -1,9 +1,9 @@
 import {
   pluginCatalogRuntime
-} from "./chunk-OSKEC4XU.js";
+} from "./chunk-25GU5B5E.js";
 import {
   logWarn
-} from "./chunk-4FUEG3QY.js";
+} from "./chunk-3JOGUT46.js";
 import {
   skillRoots
 } from "./chunk-3V7OFJZC.js";

package/dist/{chunk-MIAKQNYX.js → chunk-6ZK6FZIV.js}

@@ -1,6 +1,6 @@
 import {
   createVercelQueueClient
-} from "./chunk-KNFROR7R.js";
+} from "./chunk-5I6ORJUY.js";
 
 // src/chat/task-execution/queue-signing.ts
 import { createHmac, timingSafeEqual } from "crypto";

package/dist/{chunk-W6RDUAO3.js → chunk-BXLS3I4W.js}

@@ -1,6 +1,6 @@
 import {
   pluginCatalogRuntime
-} from "./chunk-OSKEC4XU.js";
+} from "./chunk-25GU5B5E.js";
 
 // src/chat/plugins/validation.ts
 import { isDeepStrictEqual } from "util";

package/dist/{chunk-RD7EJI7H.js → chunk-CI3VK7X5.js}

@@ -1,18 +1,82 @@
+import {
+  juniorConversationAnnotations
+} from "./chunk-RXRQJF7Y.js";
 import {
   sleep
 } from "./chunk-4ZNGQH7C.js";
 import {
   getSlackBotToken
-} from "./chunk-ZGXH3REA.js";
+} from "./chunk-PZGPCOSD.js";
 import {
   logWarn,
   setSpanAttributes,
   setSpanStatus,
   withSpan
-} from "./chunk-4FUEG3QY.js";
+} from "./chunk-3JOGUT46.js";
 import {
   parseSlackChannelReferenceId
-} from "./chunk-42WRQLJ6.js";
+} from "./chunk-F3B2YJ76.js";
+
+// src/chat/plugins/annotations.ts
+import { and, desc, eq } from "drizzle-orm";
+import {
+  conversationAnnotationInputSchema
+} from "@sentry/junior-plugin-api";
+function createPluginAnnotations(args) {
+  return {
+    async upsert(input) {
+      const annotation = conversationAnnotationInputSchema.parse(input);
+      const now = /* @__PURE__ */ new Date();
+      await args.db.insert(juniorConversationAnnotations).values({
+        annotation,
+        conversationId: args.conversationId,
+        createdAt: now,
+        key: annotation.key,
+        kind: annotation.kind,
+        plugin: args.plugin,
+        updatedAt: now
+      }).onConflictDoUpdate({
+        target: [
+          juniorConversationAnnotations.conversationId,
+          juniorConversationAnnotations.plugin,
+          juniorConversationAnnotations.kind,
+          juniorConversationAnnotations.key
+        ],
+        set: { annotation, updatedAt: now }
+      });
+    },
+    async remove(kind, key) {
+      await args.db.delete(juniorConversationAnnotations).where(
+        and(
+          eq(
+            juniorConversationAnnotations.conversationId,
+            args.conversationId
+          ),
+          eq(juniorConversationAnnotations.plugin, args.plugin),
+          eq(juniorConversationAnnotations.kind, kind),
+          eq(juniorConversationAnnotations.key, key)
+        )
+      );
+    },
+    async list() {
+      return (await listConversationAnnotations(args.db, args.conversationId)).filter((a) => a.plugin === args.plugin);
+    }
+  };
+}
+async function listConversationAnnotations(db, conversationId) {
+  const rows = await db.select().from(juniorConversationAnnotations).where(eq(juniorConversationAnnotations.conversationId, conversationId)).orderBy(desc(juniorConversationAnnotations.updatedAt));
+  return rows.flatMap((row) => {
+    const parsed = conversationAnnotationInputSchema.safeParse(row.annotation);
+    return parsed.success ? [
+      {
+        ...parsed.data,
+        plugin: row.plugin,
+        createdAt: row.createdAt.toISOString(),
+        updatedAt: row.updatedAt.toISOString()
+      }
+    ] : [];
+  });
+}
 
 // src/chat/slack/client.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
@@ -435,6 +499,8 @@ async function downloadPrivateSlackFile(url) {
 }
 
 export {
+  createPluginAnnotations,
+  listConversationAnnotations,
   runWithWorkspaceTeamId,
   getWorkspaceTeamId,
   SlackActionError,

package/dist/chunk-DIB4GX3G.js

@@ -0,0 +1,8 @@
+// src/chat/oauth-authorization.ts
+function authorizationId(args) {
+  return `${args.sessionId}:${args.kind}:${args.provider}`;
+}
+
+export {
+  authorizationId
+};

package/dist/{chunk-42WRQLJ6.js → chunk-F3B2YJ76.js}

@@ -1,14 +1,3 @@
-// src/chat/coerce.ts
-function toOptionalString(value) {
-  return typeof value === "string" && value.trim() ? value : void 0;
-}
-function toOptionalNumber(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null;
-}
-
 // src/chat/slack/timestamp.ts
 import { z } from "zod";
 var slackMessageTsSchema = z.string().trim().regex(/^\d+(?:\.\d+)?$/).brand();
@@ -60,9 +49,6 @@ function parseSlackUserId(value) {
 }
 
 export {
-  toOptionalString,
-  toOptionalNumber,
-  isRecord,
   parseSlackMessageTs,
   parseSlackChannelId,
   parseSlackChannelReferenceId,

package/dist/chunk-FA6POGLH.js

@@ -0,0 +1,70 @@
+// src/chat/local/oauth-relay.ts
+import { randomBytes } from "crypto";
+import { jwtVerify, SignJWT } from "jose";
+import { z } from "zod";
+var LOCAL_OAUTH_STATE_PREFIX = "jr-local";
+var LOCAL_OAUTH_TOKEN_CONTEXT = "junior.local-oauth-relay.v1";
+var LOCAL_OAUTH_TOKEN_TTL = "10m";
+var localOAuthRelayPayloadSchema = z.object({
+  aud: z.literal(LOCAL_OAUTH_TOKEN_CONTEXT),
+  exp: z.number().int(),
+  iss: z.literal(LOCAL_OAUTH_TOKEN_CONTEXT),
+  jti: z.string().min(1),
+  port: z.number().int().min(1).max(65535)
+}).strict();
+function relayKey() {
+  const secret = process.env.JUNIOR_SECRET?.trim();
+  if (!secret) {
+    throw new Error("Local OAuth requires JUNIOR_SECRET");
+  }
+  return new TextEncoder().encode(secret);
+}
+async function createLocalOAuthState(port) {
+  if (!Number.isSafeInteger(port) || port < 1 || port > 65535) {
+    throw new Error("Local OAuth callback port is invalid");
+  }
+  const token = await new SignJWT({ port }).setProtectedHeader({ alg: "HS256" }).setIssuer(LOCAL_OAUTH_TOKEN_CONTEXT).setAudience(LOCAL_OAUTH_TOKEN_CONTEXT).setJti(randomBytes(24).toString("base64url")).setExpirationTime(LOCAL_OAUTH_TOKEN_TTL).sign(relayKey());
+  return `${LOCAL_OAUTH_STATE_PREFIX}.${token}`;
+}
+async function localOAuthRelayPort(state) {
+  const prefix = `${LOCAL_OAUTH_STATE_PREFIX}.`;
+  if (!state.startsWith(prefix)) {
+    return void 0;
+  }
+  try {
+    const { payload } = await jwtVerify(
+      state.slice(prefix.length),
+      relayKey(),
+      {
+        algorithms: ["HS256"],
+        issuer: LOCAL_OAUTH_TOKEN_CONTEXT,
+        audience: LOCAL_OAUTH_TOKEN_CONTEXT
+      }
+    );
+    const parsed = localOAuthRelayPayloadSchema.safeParse(payload);
+    return parsed.success ? parsed.data.port : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function relayLocalOAuthCallback(request) {
+  const url = new URL(request.url);
+  if (url.searchParams.get("jr_local_relay") === "complete") {
+    return void 0;
+  }
+  const state = url.searchParams.get("state");
+  const port = state ? await localOAuthRelayPort(state) : void 0;
+  if (!port) {
+    return void 0;
+  }
+  url.protocol = "http:";
+  url.hostname = "127.0.0.1";
+  url.port = String(port);
+  url.searchParams.set("jr_local_relay", "complete");
+  return Response.redirect(url, 302);
+}
+
+export {
+  createLocalOAuthState,
+  relayLocalOAuthCallback
+};

package/dist/{chunk-6Y5L4BOM.js → chunk-FXOYURO4.js}

@@ -1,9 +1,11 @@
+import {
+  toOptionalString
+} from "./chunk-OB42YVAE.js";
 import {
   parseSlackChannelId,
   parseSlackMessageTs,
-  parseSlackTeamId,
-  toOptionalString
-} from "./chunk-42WRQLJ6.js";
+  parseSlackTeamId
+} from "./chunk-F3B2YJ76.js";
 
 // src/chat/conversation-privacy.ts
 import { AsyncLocalStorage } from "async_hooks";

package/dist/chunk-HDSDCEPK.js

@@ -0,0 +1,80 @@
+import {
+  credentialContextSchema
+} from "./chunk-W3U3YQYI.js";
+
+// src/chat/sandbox/egress/schemas.ts
+import { z } from "zod";
+import {
+  pluginAuthorizationSchema,
+  pluginCredentialHeaderTransformSchema,
+  pluginGrantSchema,
+  pluginProviderAccountSchema
+} from "@sentry/junior-plugin-api";
+var finiteNumberSchema = z.number().refine(Number.isFinite);
+var httpStatusSchema = z.number().int().min(100).max(599);
+var providerNameSchema = z.string().regex(/^[a-z][a-z0-9-]*$/);
+var credentialSignalKindSchema = z.enum(["auth_required", "unavailable"]);
+var sandboxEgressGrantSchema = pluginGrantSchema;
+var sandboxEgressCredentialContextSchema = z.object({
+  credentials: credentialContextSchema,
+  egressId: z.string().min(1),
+  expiresAtMs: finiteNumberSchema,
+  contextId: z.string().min(1)
+}).strict();
+var sandboxEgressCredentialLeaseSchema = z.object({
+  account: pluginProviderAccountSchema.optional(),
+  authorization: pluginAuthorizationSchema.optional(),
+  grant: sandboxEgressGrantSchema,
+  provider: providerNameSchema,
+  expiresAt: z.string().min(1),
+  headerTransforms: z.array(pluginCredentialHeaderTransformSchema).min(1)
+}).strict();
+var sandboxEgressAuthRequiredSignalSchema = z.object({
+  authorization: pluginAuthorizationSchema.optional(),
+  grant: sandboxEgressGrantSchema,
+  kind: credentialSignalKindSchema.default("auth_required"),
+  provider: providerNameSchema,
+  message: z.string().optional(),
+  createdAtMs: finiteNumberSchema
+}).strict().superRefine((signal, ctx) => {
+  if (signal.authorization && signal.authorization.provider !== signal.provider) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "Auth signal authorization provider must match provider",
+      path: ["authorization", "provider"]
+    });
+  }
+});
+var sandboxEgressPermissionDeniedSignalSchema = z.object({
+  account: pluginProviderAccountSchema.optional(),
+  acceptedPermissions: z.string().optional(),
+  grant: sandboxEgressGrantSchema,
+  message: z.string().min(1),
+  provider: providerNameSchema,
+  source: z.literal("upstream"),
+  sso: z.string().optional(),
+  status: httpStatusSchema,
+  upstreamHost: z.string().min(1),
+  upstreamPath: z.string().min(1),
+  createdAtMs: finiteNumberSchema
+}).strict();
+var sandboxEgressSignalsResponseSchema = z.object({
+  auth_required: sandboxEgressAuthRequiredSignalSchema.optional(),
+  permission_denied: sandboxEgressPermissionDeniedSignalSchema.optional()
+}).strict();
+function parseSandboxEgressAuthRequiredSignal(value) {
+  const result = sandboxEgressAuthRequiredSignalSchema.safeParse(value);
+  return result.success ? result.data : void 0;
+}
+function parseSandboxEgressPermissionDeniedSignal(value) {
+  const result = sandboxEgressPermissionDeniedSignalSchema.safeParse(value);
+  return result.success ? result.data : void 0;
+}
+
+export {
+  sandboxEgressCredentialContextSchema,
+  sandboxEgressCredentialLeaseSchema,
+  sandboxEgressSignalsResponseSchema,
+  parseSandboxEgressAuthRequiredSignal,
+  parseSandboxEgressPermissionDeniedSignal
+};

package/dist/{chunk-C4MZ3GP5.js → chunk-HZF5P5UN.js}

@@ -1,6 +1,6 @@
 import {
   parseSlackTeamId
-} from "./chunk-42WRQLJ6.js";
+} from "./chunk-F3B2YJ76.js";
 
 // src/chat/actor.ts
 import { z } from "zod";

package/dist/{chunk-K2W4CK7K.js → chunk-JZPQ5K4V.js}

@@ -1,11 +1,11 @@
 import {
-  parseActorUserId
-} from "./chunk-C4MZ3GP5.js";
+  credentialUserSubjectId
+} from "./chunk-W3U3YQYI.js";
 import {
   logInfo,
   logWarn,
   setSpanAttributes
-} from "./chunk-4FUEG3QY.js";
+} from "./chunk-3JOGUT46.js";
 import {
   discoverInstalledPluginPackageContent,
   normalizePluginPackageNames
@@ -105,11 +105,6 @@ function inlineManifestSource(manifest) {
   setDefined(result, "name", manifest.name);
   setDefined(result, "display-name", manifest.displayName);
   setDefined(result, "description", manifest.description);
-  setDefined(
-    result,
-    "capabilities",
-    inlineTokenListSource(manifest.name, manifest.capabilities)
-  );
   setDefined(
     result,
     "config-keys",
@@ -138,7 +133,6 @@ function inlineManifestSource(manifest) {
 
 // src/chat/plugins/manifest.ts
 var PLUGIN_NAME_RE = /^[a-z][a-z0-9-]*$/;
-var SHORT_CAPABILITY_RE = /^[a-z0-9-]+(\.[a-z0-9-]+)*$/;
 var SHORT_CONFIG_KEY_RE = /^[a-z0-9]+(\.[a-z0-9-]+)*$/;
 var TARGET_FLAG_RE = /^-{1,2}[A-Za-z0-9][A-Za-z0-9-]*$/;
 var AUTH_TOKEN_ENV_RE = /^[A-Z][A-Z0-9_]*$/;
@@ -321,9 +315,6 @@ var manifestSourceSchema = z.object({
   }),
   "display-name": nonEmptyTrimmedString,
   description: nonEmptyTrimmedString,
-  capabilities: z.array(z.string(), {
-    error: "must be an array when provided"
-  }).optional(),
   "config-keys": z.array(z.string(), {
     error: "must be an array when provided"
   }).optional(),
@@ -361,7 +352,6 @@ function manifestConfigPatch(config) {
   const result = {};
   setDefined2(result, "display-name", config.displayName);
   setDefined2(result, "description", config.description);
-  setDefined2(result, "capabilities", config.capabilities);
   setDefined2(result, "config-keys", config.configKeys);
   setDefined2(result, "domains", config.domains);
   setDefined2(result, "api-headers", config.apiHeaders);
@@ -854,11 +844,6 @@ function parseManifestSource(parsedSource, dir, config, options) {
     if (path2 === "description") {
       throw new Error(`Invalid plugin description in ${dir}`);
     }
-    if (path2 === "capabilities") {
-      throw new Error(
-        `Plugin ${String(parsedSource.name ?? "unknown")} capabilities must be an array when provided`
-      );
-    }
     if (path2 === "config-keys") {
       throw new Error(
         `Plugin ${String(parsedSource.name ?? "unknown")} config-keys must be an array when provided`
@@ -917,14 +902,6 @@ function parseManifestSource(parsedSource, dir, config, options) {
     throw new Error(issue?.message ?? `Invalid plugin manifest in ${dir}`);
   }
   const data = sourceResult.data;
-  const capabilities = (data.capabilities ?? []).map((cap) => {
-    if (!SHORT_CAPABILITY_RE.test(cap)) {
-      throw new Error(
-        `Invalid capability token "${cap}" in plugin ${data.name}`
-      );
-    }
-    return `${data.name}.${cap}`;
-  });
   const configKeys = (data["config-keys"] ?? []).map((key) => {
     if (!SHORT_CONFIG_KEY_RE.test(key)) {
       throw new Error(`Invalid config key "${key}" in plugin ${data.name}`);
@@ -959,7 +936,6 @@ function parseManifestSource(parsedSource, dir, config, options) {
     name: data.name,
     displayName: data["display-name"],
     description: data.description,
-    capabilities,
     configKeys,
     ...domains ? { domains } : {},
     ...apiHeaders ? { apiHeaders } : {},
@@ -1083,68 +1059,6 @@ var CredentialUnavailableError = class extends Error {
   }
 };
 
-// src/chat/credentials/context.ts
-import { z as z2 } from "zod";
-var exactActorIdSchema = z2.string().refine((value) => parseActorUserId(value) === value);
-var exactNonBlankStringSchema = z2.string().min(1).refine((value) => value === value.trim());
-var slackDirectCredentialSubjectBindingSchema = z2.object({
-  type: z2.literal("slack-direct-conversation"),
-  teamId: z2.string().min(1),
-  channelId: z2.string().min(1),
-  signature: z2.string().min(1)
-}).strict();
-var scheduledTaskCredentialSubjectBindingSchema = z2.object({
-  type: z2.literal("scheduled-task"),
-  plugin: z2.string().min(1),
-  taskId: exactNonBlankStringSchema,
-  signature: z2.string().min(1)
-}).strict();
-var credentialSubjectBindingSchema = z2.discriminatedUnion("type", [
-  slackDirectCredentialSubjectBindingSchema,
-  scheduledTaskCredentialSubjectBindingSchema
-]);
-var credentialUserActorSchema = z2.object({
-  type: z2.literal("user"),
-  userId: exactActorIdSchema
-}).strict();
-var credentialSystemActorSchema = z2.object({
-  platform: z2.literal("system"),
-  name: exactActorIdSchema
-}).strict();
-var credentialSubjectSchema = z2.discriminatedUnion("allowedWhen", [
-  z2.object({
-    type: z2.literal("user"),
-    userId: exactActorIdSchema,
-    allowedWhen: z2.literal("private-direct-conversation"),
-    binding: slackDirectCredentialSubjectBindingSchema
-  }).strict(),
-  z2.object({
-    type: z2.literal("user"),
-    userId: exactActorIdSchema,
-    allowedWhen: z2.literal("scheduled-task"),
-    taskId: exactNonBlankStringSchema,
-    binding: scheduledTaskCredentialSubjectBindingSchema
-  }).strict().refine((subject) => subject.binding.taskId === subject.taskId, {
-    message: "Scheduled task credential subject requires task binding",
-    path: ["binding"]
-  })
-]);
-var credentialContextSchema = z2.union([
-  z2.object({
-    actor: credentialUserActorSchema
-  }).strict(),
-  z2.object({
-    actor: credentialSystemActorSchema,
-    subject: credentialSubjectSchema.optional()
-  }).strict()
-]);
-function credentialUserSubjectId(context) {
-  if ("type" in context.actor) {
-    return context.actor.userId;
-  }
-  return "subject" in context ? context.subject?.userId : void 0;
-}
-
 // src/chat/credentials/header-transforms.ts
 function mergeHeaderTransforms(transforms) {
   const byDomain = /* @__PURE__ */ new Map();
@@ -1277,7 +1191,7 @@ function createApiHeadersBroker(manifest) {
 }
 
 // src/chat/plugins/auth/oauth-request.ts
-import { z as z3 } from "zod";
+import { z as z2 } from "zod";
 var DEFAULT_TOKEN_CONTENT_TYPE = "application/x-www-form-urlencoded";
 function requireNonEmptyTokenField(data, field) {
   const value = data[field];
@@ -1292,12 +1206,12 @@ function requireTokenResponseObject(data) {
   }
   return data;
 }
-var parsedOAuthTokenResponseSchema = z3.object({
-  accessToken: z3.string().min(1),
-  refreshToken: z3.string().min(1),
-  expiresAt: z3.number().positive().optional(),
-  refreshTokenExpiresAt: z3.number().positive().optional(),
-  scope: z3.string().min(1).optional()
+var parsedOAuthTokenResponseSchema = z2.object({
+  accessToken: z2.string().min(1),
+  refreshToken: z2.string().min(1),
+  expiresAt: z2.number().positive().optional(),
+  refreshTokenExpiresAt: z2.number().positive().optional(),
+  scope: z2.string().min(1).optional()
 }).strict();
 function contentTypeToBody(contentType, payload) {
   const mediaType = contentType.split(";", 1)[0]?.trim().toLowerCase();
@@ -1612,7 +1526,6 @@ function createLoadedPluginState(signature) {
     signature,
     pluginDefinitions: [],
     pluginMigrationRoots: /* @__PURE__ */ new Map(),
-    capabilityToPlugin: /* @__PURE__ */ new Map(),
     domainToPlugin: /* @__PURE__ */ new Map(),
     pluginConfigKeys: /* @__PURE__ */ new Set(),
     pluginsByName: /* @__PURE__ */ new Map(),
@@ -1631,13 +1544,6 @@ function registerPluginManifest(state, manifest, pluginDir, skillsDir, migration
   if (state.pluginsByName.has(manifest.name)) {
     throw new Error(`Duplicate plugin name "${manifest.name}"`);
   }
-  for (const cap of manifest.capabilities) {
-    if (state.capabilityToPlugin.has(cap)) {
-      throw new Error(
-        `Duplicate capability "${cap}" in plugin "${manifest.name}"`
-      );
-    }
-  }
   for (const domain of providerDomains(manifest)) {
     const owner = state.domainToPlugin.get(domain);
     if (owner) {
@@ -1657,9 +1563,6 @@ function registerPluginManifest(state, manifest, pluginDir, skillsDir, migration
   if (definition.migrationsDir) {
     state.pluginMigrationRoots.set(manifest.name, definition.migrationsDir);
   }
-  for (const cap of manifest.capabilities) {
-    state.capabilityToPlugin.set(cap, definition);
-  }
   for (const key of manifest.configKeys) {
     state.pluginConfigKeys.add(key);
   }
@@ -1879,7 +1782,6 @@ function logLoadedPlugins(state) {
       {},
       {
         "app.plugin.name": plugin.manifest.name,
-        "app.plugin.capability_count": plugin.manifest.capabilities.length,
         "app.plugin.config_key_count": plugin.manifest.configKeys.length,
         "app.plugin.has_mcp": Boolean(plugin.manifest.mcp),
         "file.directory": plugin.dir,
@@ -1916,20 +1818,6 @@ function createPluginCatalogRuntime() {
     getSignature() {
       return ensurePluginsLoaded(runtime).signature;
     },
-    getCapabilityProviders() {
-      const state = ensurePluginsLoaded(runtime);
-      return state.pluginDefinitions.map((plugin) => ({
-        provider: plugin.manifest.name,
-        capabilities: [...plugin.manifest.capabilities],
-        configKeys: [...plugin.manifest.configKeys],
-        ...plugin.manifest.target ? {
-          target: {
-            ...plugin.manifest.target,
-            ...plugin.manifest.target.commandFlags ? { commandFlags: [...plugin.manifest.target.commandFlags] } : {}
-          }
-        } : {}
-      }));
-    },
     getProviders() {
       return [...ensurePluginsLoaded(runtime).pluginDefinitions];
     },
@@ -2033,9 +1921,6 @@ function createPluginCatalogRuntime() {
     isProvider(provider) {
       return ensurePluginsLoaded(runtime).pluginsByName.has(provider);
     },
-    isCapability(capability) {
-      return ensurePluginsLoaded(runtime).capabilityToPlugin.has(capability);
-    },
     isConfigKey(key) {
       return ensurePluginsLoaded(runtime).pluginConfigKeys.has(key);
     },
@@ -2058,7 +1943,6 @@ function createPluginCatalogRuntime() {
       }
       setSpanAttributes({
         "app.plugin.name": name,
-        "app.plugin.capabilities": plugin.manifest.capabilities,
         "app.plugin.has_oauth": Boolean(plugin.manifest.oauth)
       });
       return broker;
@@ -2070,9 +1954,6 @@ export {
   parsePluginManifest,
   parseInlinePluginManifest,
   CredentialUnavailableError,
-  credentialSubjectSchema,
-  credentialContextSchema,
-  credentialUserSubjectId,
   hasRequiredOAuthScope,
   resolvePluginCommandEnv,
   resolveAuthTokenPlaceholder,