@sentry/junior 0.116.1 → 0.117.0

package/dist/chat/oauth-response.d.ts

@@ -0,0 +1,21 @@
+export type OAuthProviderErrorPhase = "token_exchange" | "token_refresh";
+export interface OAuthProviderErrorDetails {
+    phase: OAuthProviderErrorPhase;
+    provider: string;
+    resourceHost: string;
+    status?: number;
+}
+/** Safe failure at a generic OAuth provider boundary. */
+export declare class OAuthProviderError extends Error {
+    readonly phase: OAuthProviderErrorPhase;
+    readonly provider: string;
+    readonly resourceHost: string;
+    readonly status?: number;
+    constructor(details: OAuthProviderErrorDetails);
+}
+/** Return safe generic OAuth provider fields for logs and spans. */
+export declare function getOAuthProviderErrorAttributes(error: unknown): Record<string, string | number>;
+/** Read only the bounded prefix needed to classify an OAuth error response. */
+export declare function readBoundedOAuthErrorBody(response: Response): Promise<string>;
+/** Preserve small OAuth error responses while bounding bodies before SDK parsing. */
+export declare function fetchWithBoundedOAuthErrorBodies(fetchFn?: typeof fetch, onErrorResponseStatus?: (status: number) => void): typeof fetch;

package/dist/chat/plugins/prompt.d.ts

@@ -1,4 +1,13 @@
+/** Validated plugin context retained for the current turn. */
+export interface PluginTurnContext {
+    content: Record<string, unknown>;
+    kind: string;
+    loadedAtMs: number;
+    pluginName: string;
+    version: number;
+}
 export interface PluginPromptContributionContext {
+    context?: PluginTurnContext;
     id: string;
     pluginName: string;
     text: string;

package/dist/chat/plugins/types.d.ts

@@ -1,4 +1,6 @@
+import type { PluginRuntimeDependency, PluginRuntimePostinstallCommand } from "@sentry/junior-plugin-api";
 import type { UserTokenStore } from "@/chat/credentials/user-token-store";
+export type { PluginNpmRuntimeDependency, PluginRuntimeDependency, PluginRuntimePostinstallCommand, PluginSystemRuntimeDependency, PluginSystemRuntimeDependencyFromUrl, } from "@sentry/junior-plugin-api";
 export interface PluginOAuthConfig {
     clientIdEnv: string;
     clientSecretEnv: string;
@@ -28,26 +30,6 @@ export interface OAuthBearerCredentials {
     authTokenPlaceholder?: string;
 }
 export type PluginCredentials = OAuthBearerCredentials;
-export interface PluginNpmRuntimeDependency {
-    type: "npm";
-    package: string;
-    version: string;
-}
-export interface PluginSystemRuntimeDependency {
-    type: "system";
-    package: string;
-}
-export interface PluginSystemRuntimeDependencyFromUrl {
-    type: "system";
-    url: string;
-    sha256: string;
-}
-export type PluginRuntimeDependency = PluginNpmRuntimeDependency | PluginSystemRuntimeDependency | PluginSystemRuntimeDependencyFromUrl;
-export interface PluginRuntimePostinstallCommand {
-    cmd: string;
-    args?: string[];
-    sudo?: boolean;
-}
 export interface PluginMcpHttpConfig {
     transport: "http";
     url: string;
@@ -148,4 +130,3 @@ export interface InlinePluginManifestDefinition {
     manifest: PluginManifest;
     packageName?: string;
 }
-export {};

package/dist/chat/sandbox/snapshot/install.d.ts

@@ -0,0 +1,6 @@
+import type { PluginRuntimeDependency, PluginRuntimePostinstallCommand } from "@/chat/plugins/types";
+import type { SandboxSession } from "@/chat/sandbox/workspace";
+/** Install declared system and npm dependencies into a snapshot sandbox. */
+export declare function dependencies(sandbox: SandboxSession, values: PluginRuntimeDependency[]): Promise<void>;
+/** Run declared postinstall commands after dependency binaries are available. */
+export declare function postinstall(sandbox: SandboxSession, commands: PluginRuntimePostinstallCommand[]): Promise<void>;

package/dist/chat/sandbox/snapshot/profile.d.ts

@@ -0,0 +1,14 @@
+import type { PluginRuntimeDependency, PluginRuntimePostinstallCommand } from "@/chat/plugins/types";
+export type Profile = {
+    hash: string;
+    dependencyCount: number;
+    floating: boolean;
+    dependencies: PluginRuntimeDependency[];
+    postinstall: PluginRuntimePostinstallCommand[];
+};
+/** Build the dependency profile that selects a reusable sandbox snapshot. */
+export declare function create(runtime: string): Profile | null;
+/** Return the current dependency profile hash without building its snapshot. */
+export declare function hash(runtime: string): string | undefined;
+/** Decide whether a cached snapshot has outlived a floating profile. */
+export declare function isStale(profile: Profile, createdAtMs: number): boolean;

package/dist/chat/sandbox/snapshot/resolve.d.ts

@@ -0,0 +1,22 @@
+export type ResolveOutcome = "no_profile" | "cache_hit" | "cache_hit_after_lock_wait" | "rebuilt" | "forced_rebuild";
+export type RebuildReason = "cache_miss" | "floating_stale" | "force_rebuild" | "snapshot_missing";
+/** Result of resolving the reusable snapshot for one dependency profile. */
+export interface Snapshot {
+    snapshotId?: string;
+    profileHash?: string;
+    dependencyCount: number;
+    cacheHit: boolean;
+    resolveOutcome: ResolveOutcome;
+    rebuildReason?: RebuildReason;
+}
+export type ProgressPhase = "resolve_start" | "cache_hit" | "waiting_for_lock" | "building_snapshot" | "build_complete";
+/** Resolve or build the reusable snapshot for the current dependency profile. */
+export declare function resolve(params: {
+    runtime: string;
+    timeoutMs: number;
+    forceRebuild?: boolean;
+    staleSnapshotId?: string;
+    onProgress?: (phase: ProgressPhase) => void | Promise<void>;
+}): Promise<Snapshot>;
+/** Identify provider errors that mean a referenced snapshot no longer exists. */
+export declare function isMissingError(error: unknown): boolean;

package/dist/chat/sandbox/snapshot/span.d.ts

@@ -0,0 +1,2 @@
+/** Record one stage of dependency snapshot resolution or creation. */
+export declare function trace<T>(name: string, op: string, attributes: Record<string, unknown>, callback: () => Promise<T>): Promise<T>;

package/dist/chat/services/context-compaction-marker.d.ts

@@ -1,5 +1,6 @@
 import type { PiMessage } from "@/chat/pi/messages";
 export declare const COMPACTION_SUMMARY_PREFIX = "Context compaction summary for future Junior turns:";
+export declare const ACTIVE_TURN_COMPACTION_SUMMARY_PREFIX = "Active-turn context checkpoint. If no newer user instruction follows this checkpoint, continue the same unfinished task now using the authoritative instructions above and this summary as internal continuation state. If a newer user instruction follows, treat this checkpoint as prior context and follow that newer instruction. Do not reply with a plan or summary solely because this checkpoint appeared:";
 export declare const MODEL_HANDOFF_SUMMARY_PREFIX = "Model handoff checkpoint. Continue the outstanding request now using this summary as the complete prior context:";
 /** Return whether text is one of Junior's durable compacted-context markers. */
 export declare function isCompactionSummaryText(text: string): boolean;

package/dist/chat/services/turn-session-record.d.ts

@@ -4,6 +4,7 @@ import type { Destination, Actor, Source } from "@sentry/junior-plugin-api";
 import type { PiMessage } from "@/chat/pi/messages";
 import type { ConversationMessageProvenance } from "@/chat/conversations/provenance";
 import { type AgentTurnUsage } from "@/chat/usage";
+import type { PluginTurnContext } from "@/chat/plugins/prompt";
 export interface TurnSessionContext {
     conversationId: string;
     sessionId: string;
@@ -40,6 +41,7 @@ export declare function persistRunningSessionRecord(args: {
     actor?: Actor;
     reasoningLevel?: string;
     surface?: AgentTurnSurface;
+    turnContexts?: PluginTurnContext[];
     turnStartMessageIndex?: number;
 }): Promise<boolean>;
 /**

package/dist/chat/state/turn-session.d.ts

@@ -12,6 +12,7 @@ import { type Destination, type Source } from "@sentry/junior-plugin-api";
 import { type PiMessage } from "@/chat/pi/messages";
 import { type Actor } from "@/chat/actor";
 import { type ConversationMessageProvenance } from "@/chat/conversations/provenance";
+import type { PluginTurnContext } from "@/chat/plugins/prompt";
 import { type AgentTurnUsage } from "@/chat/usage";
 import type { ConversationPrivacy } from "@/chat/conversation-privacy";
 import type { ConversationStore } from "@/chat/conversations/store";
@@ -95,6 +96,7 @@ export declare function upsertAgentTurnSessionRecord(args: {
     errorMessage?: string;
     resumedFromSliceId?: number;
     traceId?: string;
+    turnContexts?: PluginTurnContext[];
     turnStartMessageIndex?: number;
     ttlMs?: number;
 }): Promise<AgentTurnSessionRecord>;

package/dist/chat/tools/query-conversation-events.d.ts

@@ -9,7 +9,7 @@ export declare function createQueryConversationEventsTool(context: ToolRuntimeCo
         after_seq?: number | null | undefined;
         before_seq?: number | null | undefined;
         limit?: number | null | undefined;
-        types?: ("message" | "handoff" | "user_message" | "assistant_message" | "tool_result" | "compaction" | "mcp_provider_connected" | "authorization_requested" | "authorization_completed" | "tool_execution_started" | "message_updated" | "message_handled" | "messages_summarized" | "turn_started" | "turn_routed" | "turn_completed" | "turn_failed" | "subagent_started" | "subagent_ended")[] | null | undefined;
+        types?: ("message" | "handoff" | "user_message" | "assistant_message" | "tool_result" | "compaction" | "mcp_provider_connected" | "authorization_requested" | "authorization_completed" | "tool_execution_started" | "message_updated" | "message_handled" | "messages_summarized" | "turn_started" | "turn_routed" | "turn_context" | "turn_completed" | "turn_failed" | "subagent_started" | "subagent_ended")[] | null | undefined;
     };
     execute?: ((input: unknown, options: import("./definition").ToolExecuteOptions) => {
         [x: string]: unknown;

package/dist/chat/tools/sandbox/view-image.d.ts

@@ -0,0 +1,11 @@
+import type { SandboxWorkspace } from "@/chat/sandbox/workspace";
+import type { ViewImageToolDeps } from "@/chat/tools/types";
+/** Create a tool that loads a sandbox image into the active model context. */
+export declare function createViewImageTool(sandbox: SandboxWorkspace, supportsImageInput: () => boolean, deps?: ViewImageToolDeps): Omit<import("../definition").AnyToolDefinition, "inputSchema" | "outputSchema" | "prepareArguments" | "execute"> & {
+    inputSchema: import("../definition").JsonSchemaObject;
+    outputSchema?: undefined;
+    prepareArguments(args: unknown): {
+        path: string;
+    };
+    execute?: (input: unknown, options: import("../definition").ToolExecuteOptions) => Promise<import("@/chat/tool-support/zod-tool").ContentOnlyToolResult> | import("@/chat/tool-support/zod-tool").ContentOnlyToolResult;
+};

package/dist/chat/tools/types.d.ts

@@ -34,6 +34,10 @@ export interface WebSearchToolDeps {
         max_results?: number;
     }) => Promise<JuniorToolResult> | JuniorToolResult;
 }
+/** Optional host image reader for deterministic tool execution without sandbox I/O. */
+export interface ViewImageToolDeps {
+    readFile?: (path: string) => Promise<Buffer | null | undefined>;
+}
 export interface ToolHooks {
     /**
      * Materialize generated files and return sandbox paths that exist before the
@@ -44,6 +48,7 @@ export interface ToolHooks {
     onSkillLoaded?: (skill: Skill) => void | LoadSkillMetadata | Promise<void | LoadSkillMetadata>;
     toolOverrides?: {
         imageGenerate?: ImageGenerateToolDeps;
+        viewImage?: ViewImageToolDeps;
         webFetch?: WebFetchToolDeps;
         webSearch?: WebSearchToolDeps;
     };
@@ -70,6 +75,8 @@ interface BaseToolRuntimeContext {
     egress: PluginEgress;
     mcpToolManager?: McpToolManager;
     workspace: SandboxWorkspace;
+    /** Report whether the model currently executing the turn accepts images. */
+    supportsImageInput?: () => boolean;
 }
 interface SlackToolRuntimeContext extends BaseToolRuntimeContext {
     destination: SlackDestination;

package/dist/{chunk-RYFAVWP3.js → chunk-27KWTFP6.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-MU6HHZEN.js";
 import {
   getStateAdapter
-} from "./chunk-7CSVG54J.js";
+} from "./chunk-KU6ALEJC.js";
 import {
   agentHistoryItemSchema,
   contextProvenance,
@@ -16,7 +16,7 @@ import {
   instructionProvenanceFor,
   sanitizePostgresJson,
   withConversationEventLock
-} from "./chunk-BFYVIOTS.js";
+} from "./chunk-ZRQUQJUV.js";
 import {
   sleep
 } from "./chunk-4ZNGQH7C.js";
@@ -25,7 +25,7 @@ import {
   escapeXml,
   resolveGatewayModel,
   unwrapCurrentInstruction
-} from "./chunk-CY7NXM32.js";
+} from "./chunk-DS27ZBSP.js";
 import {
   toStoredSlackActor
 } from "./chunk-HZF5P5UN.js";
@@ -34,7 +34,7 @@ import {
   logException,
   logWarn,
   setSpanAttributes
-} from "./chunk-F3SWGSPG.js";
+} from "./chunk-72Z3HNTQ.js";
 import {
   isRecord,
   toOptionalNumber,
@@ -412,16 +412,29 @@ async function commitMessagesLocked(args, executor) {
   });
   if (matchingPrefix === current.messages.length) {
     const newMessages = nextLocalMessages.slice(matchingPrefix);
-    await eventStore.append(
-      args.conversationId,
-      newMessages.map((message, index) => ({
+    const turnContext = args.turnContext;
+    const turnContextEvents = turnContext?.contexts.map((context, index) => ({
+      idempotencyKey: `turn:${turnContext.turnId}:context:${context.pluginName}:${index}`,
+      createdAtMs: context.loadedAtMs,
+      data: {
+        type: "turn_context",
+        turnId: turnContext.turnId,
+        pluginName: context.pluginName,
+        kind: context.kind,
+        version: context.version,
+        content: context.content
+      }
+    })) ?? [];
+    await eventStore.append(args.conversationId, [
+      ...newMessages.map((message, index) => ({
         data: historyItemFromPiMessage(
           message,
           nextLocalProvenance[matchingPrefix + index]
         ),
         createdAtMs: messageTimestamp(message)
-      }))
-    );
+      })),
+      ...turnContextEvents
+    ]);
   } else {
     throw new Error(
       `Agent history for ${args.conversationId} changed before its committed boundary`
@@ -818,6 +831,7 @@ function materializeAgentTurnSessionRecord(stored, piProjection, turnStartMessag
 function restoreRuntimeContext(messages, runtimeContext) {
   if (!runtimeContext || runtimeContext.length === 0) return messages;
   const restored = [...messages];
+  const unmatchedRuntimeContext = [];
   for (const runtimeMessage of runtimeContext) {
     const runtime = runtimeMessage;
     const targetIndex = restored.findIndex((message) => {
@@ -825,7 +839,7 @@ function restoreRuntimeContext(messages, runtimeContext) {
       return candidate.role === "user" && candidate.timestamp === runtime.timestamp;
     });
     if (targetIndex < 0) {
-      restored.push(runtimeMessage);
+      unmatchedRuntimeContext.push(runtimeMessage);
       continue;
     }
     const target = restored[targetIndex];
@@ -837,7 +851,7 @@ function restoreRuntimeContext(messages, runtimeContext) {
       ]
     };
   }
-  return restored;
+  return [...unmatchedRuntimeContext, ...restored];
 }
 async function getStoredAgentTurnSessionRecord(conversationId, sessionId) {
   const stateAdapter = getStateAdapter();
@@ -1022,7 +1036,13 @@ async function upsertAgentTurnSessionRecord(args) {
     conversationId: args.conversationId,
     messages: args.piMessages,
     ...instructionActor ? { newMessageProvenance: instructionProvenanceFor(instructionActor) } : {},
-    ...args.trailingMessageProvenance ? { trailingMessageProvenance: args.trailingMessageProvenance } : {}
+    ...args.trailingMessageProvenance ? { trailingMessageProvenance: args.trailingMessageProvenance } : {},
+    ...args.turnContexts && args.turnContexts.length > 0 ? {
+      turnContext: {
+        contexts: args.turnContexts,
+        turnId: args.sessionId
+      }
+    } : {}
   });
   const durableTurnStartMessageIndex = args.turnStartMessageIndex === void 0 ? void 0 : stripRuntimeTurnContext(
     args.piMessages.slice(0, args.turnStartMessageIndex)
@@ -1294,6 +1314,7 @@ async function persistRunningSessionRecord(args) {
       ...args.loadedSkillNames ? { loadedSkillNames: args.loadedSkillNames } : {},
       modelId: args.modelId,
       ...args.reasoningLevel ? { reasoningLevel: args.reasoningLevel } : {},
+      ...args.turnContexts ? { turnContexts: args.turnContexts } : {},
       ...args.actor ?? latestSessionRecord?.actor ? { actor: args.actor ?? latestSessionRecord?.actor } : {},
       ...getActiveTraceId() ?? latestSessionRecord?.traceId ? { traceId: getActiveTraceId() ?? latestSessionRecord?.traceId } : {},
       ...(args.turnStartMessageIndex ?? latestSessionRecord?.turnStartMessageIndex) !== void 0 ? {

package/dist/{chunk-N3C4XCRE.js → chunk-3GE3F4LT.js}

@@ -1,7 +1,7 @@
 // package.json
 var package_default = {
   name: "@sentry/junior",
-  version: "0.116.1",
+  version: "0.117.0",
   private: false,
   publishConfig: {
     access: "public"

package/dist/{chunk-XA3VLFPK.js → chunk-5O3JDQDG.js}

@@ -5,7 +5,7 @@ import {
   logInfo,
   logWarn,
   setSpanAttributes
-} from "./chunk-F3SWGSPG.js";
+} from "./chunk-72Z3HNTQ.js";
 import {
   discoverInstalledPluginPackageContent,
   normalizePluginPackageNames
@@ -1097,6 +1097,115 @@ function hasRequiredOAuthScope(storedScope, requiredScope) {
   return required.every((scope) => stored.has(scope));
 }
 
+// src/chat/oauth-response.ts
+var MAX_OAUTH_ERROR_BODY_BYTES = 16 * 1024;
+var MAX_OAUTH_ERROR_BODY_READS = MAX_OAUTH_ERROR_BODY_BYTES;
+var MAX_OAUTH_ERROR_BODY_READ_MS = 5e3;
+var OAUTH_ERROR_BODY_READ_TIMEOUT = /* @__PURE__ */ Symbol("oauth-error-body-read-timeout");
+async function readOAuthErrorBodyChunk(reader) {
+  let timeout;
+  const timeoutResult = new Promise(
+    (resolve) => {
+      timeout = setTimeout(
+        resolve,
+        MAX_OAUTH_ERROR_BODY_READ_MS,
+        OAUTH_ERROR_BODY_READ_TIMEOUT
+      );
+    }
+  );
+  try {
+    const result = await Promise.race([reader.read(), timeoutResult]);
+    if (result === OAUTH_ERROR_BODY_READ_TIMEOUT) {
+      await reader.cancel();
+      throw new Error("OAuth error body read timed out");
+    }
+    return result;
+  } finally {
+    if (timeout) {
+      clearTimeout(timeout);
+    }
+  }
+}
+var OAuthProviderError = class extends Error {
+  phase;
+  provider;
+  resourceHost;
+  status;
+  constructor(details) {
+    super(`OAuth provider ${details.phase.replace("_", " ")} failed`);
+    this.name = "OAuthProviderError";
+    this.phase = details.phase;
+    this.provider = details.provider;
+    this.resourceHost = details.resourceHost;
+    this.status = details.status;
+  }
+};
+function getOAuthProviderErrorAttributes(error) {
+  if (!(error instanceof OAuthProviderError)) {
+    return {};
+  }
+  return {
+    "app.credential.provider": error.provider,
+    "app.oauth.error.phase": error.phase,
+    "server.address": error.resourceHost,
+    ...error.status !== void 0 ? { "http.response.status_code": error.status } : {}
+  };
+}
+async function readBoundedOAuthErrorBody(response) {
+  if (!response.body) {
+    return "";
+  }
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let bytesRead = 0;
+  let reads = 0;
+  let text = "";
+  try {
+    while (bytesRead < MAX_OAUTH_ERROR_BODY_BYTES && reads < MAX_OAUTH_ERROR_BODY_READS) {
+      reads += 1;
+      const { done, value } = await readOAuthErrorBodyChunk(reader);
+      if (done) {
+        return text + decoder.decode();
+      }
+      const remaining = MAX_OAUTH_ERROR_BODY_BYTES - bytesRead;
+      const chunk = value.subarray(0, remaining);
+      bytesRead += chunk.byteLength;
+      text += decoder.decode(chunk, { stream: true });
+      if (chunk.byteLength < value.byteLength) {
+        await reader.cancel();
+        return text + decoder.decode();
+      }
+    }
+    await reader.cancel();
+    return text + decoder.decode();
+  } finally {
+    reader.releaseLock();
+  }
+}
+function fetchWithBoundedOAuthErrorBodies(fetchFn = globalThis.fetch, onErrorResponseStatus) {
+  return (async (input, init) => {
+    const response = await fetchFn(input, init);
+    if (response.ok) {
+      return response;
+    }
+    onErrorResponseStatus?.(response.status);
+    if (!response.body) {
+      return response;
+    }
+    let body = "";
+    try {
+      body = await readBoundedOAuthErrorBody(response);
+    } catch {
+      await response.body.cancel().catch(() => void 0);
+    }
+    return new Response(body, {
+      headers: response.headers,
+      status: response.status,
+      statusText: response.statusText
+    });
+  });
+}
+
 // src/chat/plugins/command-env.ts
 var ENV_PLACEHOLDER_RE2 = /\$\{([A-Z_][A-Z0-9_]*)\}/g;
 function resolveValue(manifest, value) {
@@ -1320,7 +1429,7 @@ function parseRefreshError(text) {
     return void 0;
   }
 }
-async function refreshAccessToken(refreshToken, oauth, requestedScope) {
+async function refreshAccessToken(provider, refreshToken, oauth, requestedScope) {
   const clientId = process.env[oauth.clientIdEnv]?.trim();
   const clientSecret = process.env[oauth.clientSecretEnv]?.trim();
   if (!clientId || !clientSecret) {
@@ -1338,28 +1447,49 @@ async function refreshAccessToken(refreshToken, oauth, requestedScope) {
     tokenAuthMethod: oauth.tokenAuthMethod,
     tokenExtraHeaders: oauth.tokenExtraHeaders
   });
-  const response = await fetch(oauth.tokenEndpoint, {
-    method: "POST",
-    headers: request.headers,
-    body: request.body,
-    signal: AbortSignal.timeout(TOKEN_REFRESH_TIMEOUT_MS)
-  });
+  const errorDetails = {
+    phase: "token_refresh",
+    provider,
+    resourceHost: new URL(oauth.tokenEndpoint).hostname
+  };
+  let response;
+  try {
+    response = await fetch(oauth.tokenEndpoint, {
+      method: "POST",
+      headers: request.headers,
+      body: request.body,
+      signal: AbortSignal.timeout(TOKEN_REFRESH_TIMEOUT_MS)
+    });
+  } catch {
+    throw new OAuthProviderError(errorDetails);
+  }
   if (!response.ok) {
-    const errorCode = parseRefreshError(await response.text());
+    let errorCode;
+    try {
+      errorCode = parseRefreshError(await readBoundedOAuthErrorBody(response));
+    } catch {
+      throw new OAuthProviderError({
+        ...errorDetails,
+        status: response.status
+      });
+    }
     if (errorCode === "invalid_grant" || errorCode === "bad_refresh_token") {
-      throw new OAuthRefreshRejectedError(
-        `Token refresh rejected: ${errorCode}`
-      );
+      throw new OAuthRefreshRejectedError("Token refresh was rejected");
     }
-    throw new Error(
-      `Token refresh failed: ${response.status}${errorCode ? ` ${errorCode}` : ""}`
-    );
+    throw new OAuthProviderError({
+      ...errorDetails,
+      status: response.status
+    });
+  }
+  try {
+    const data = await response.json();
+    return parseOAuthTokenResponse(data, requestedScope, {
+      treatEmptyScopeAsUnreported: oauth.treatEmptyScopeAsUnreported,
+      refreshToken
+    });
+  } catch {
+    throw new OAuthProviderError(errorDetails);
   }
-  const data = await response.json();
-  return parseOAuthTokenResponse(data, requestedScope, {
-    treatEmptyScopeAsUnreported: oauth.treatEmptyScopeAsUnreported,
-    refreshToken
-  });
 }
 function getLeaseExpiry(expiresAt) {
   return expiresAt ? Math.min(expiresAt, Date.now() + MAX_LEASE_MS2) : Date.now() + MAX_LEASE_MS2;
@@ -1447,6 +1577,7 @@ function createOAuthBearerBroker(manifest, credentials, deps) {
                     );
                   }
                   const refreshed = await refreshAccessToken(
+                    provider,
                     latest.refreshToken,
                     oauth,
                     latest.scope ?? oauth.scope
@@ -1955,6 +2086,9 @@ export {
   parseInlinePluginManifest,
   CredentialUnavailableError,
   hasRequiredOAuthScope,
+  OAuthProviderError,
+  getOAuthProviderErrorAttributes,
+  fetchWithBoundedOAuthErrorBodies,
   resolvePluginCommandEnv,
   resolveAuthTokenPlaceholder,
   buildOAuthTokenRequest,