@sentry/junior 0.127.0 → 0.128.0

package/dist/{chunk-TLMI3Q4Q.js → chunk-A76LKS5W.js}

@@ -1,25 +1,25 @@
 import {
   getConversationEventStore,
   getDb
-} from "./chunk-PDG3BSOD.js";
+} from "./chunk-B7FPRGUJ.js";
 import {
   juniorConversationAnnotations,
   juniorConversationEvents,
   juniorIdentities,
   juniorUsers
-} from "./chunk-S4PUICSB.js";
+} from "./chunk-SHMHHXD5.js";
 import {
   SANDBOX_WORKSPACE_ROOT,
   getStateAdapter,
   sleep
-} from "./chunk-SH7HDO2D.js";
+} from "./chunk-G6XQODHM.js";
 import {
   botConfig,
   completeObject,
   embedTexts,
   getSlackBotToken,
   standardModelId
-} from "./chunk-L7L7RYJM.js";
+} from "./chunk-K5ZB3WWH.js";
 import {
   isActorUserId,
   parseActorUserId
@@ -37,7 +37,7 @@ import {
   setSpanAttributes,
   setSpanStatus,
   withSpan
-} from "./chunk-AYICPT5T.js";
+} from "./chunk-B6E3YA2H.js";
 
 // src/chat/plugins/agent-hooks.ts
 import {
@@ -424,88 +424,6 @@ function getDashboardConversationLink(conversationId) {
   return `${baseURL}${path}`;
 }
 
-// src/chat/slack/tools/context.ts
-function getSlackToolContext(context) {
-  if (context.source.platform !== "slack") {
-    return void 0;
-  }
-  if (context.destination.platform !== "slack") {
-    throw new TypeError("Slack source requires a Slack destination");
-  }
-  const destinationChannelId = parseSlackChannelReferenceId(
-    context.destination.channelId
-  );
-  const sourceChannelId = parseSlackChannelReferenceId(
-    context.source.channelId
-  );
-  const teamId = parseSlackTeamId(context.source.teamId);
-  if (!destinationChannelId || !sourceChannelId || !teamId) {
-    return void 0;
-  }
-  return {
-    destination: context.destination,
-    source: context.source,
-    actor: context.actor?.platform === "slack" ? context.actor : void 0,
-    destinationChannelId,
-    messageTs: parseSlackMessageTs(context.source.messageTs),
-    sourceChannelId,
-    teamId,
-    threadTs: parseSlackMessageTs(context.source.threadTs)
-  };
-}
-
-// src/chat/plugins/viewer-actors.ts
-import { and as and3, eq as eq3 } from "drizzle-orm";
-import {
-  actorSchema
-} from "@sentry/junior-plugin-api";
-async function readViewerActorsFromSql(db, email) {
-  const normalizedEmail = normalizeIdentityEmail(email);
-  if (!normalizedEmail) return [];
-  const rows = await db.select({
-    displayName: juniorIdentities.displayName,
-    email: juniorUsers.primaryEmail,
-    handle: juniorIdentities.handle,
-    provider: juniorIdentities.provider,
-    providerSubjectId: juniorIdentities.providerSubjectId,
-    providerTenantId: juniorIdentities.providerTenantId
-  }).from(juniorIdentities).innerJoin(juniorUsers, eq3(juniorUsers.id, juniorIdentities.userId)).where(
-    and3(
-      eq3(juniorUsers.primaryEmailNormalized, normalizedEmail),
-      eq3(juniorIdentities.kind, "user")
-    )
-  );
-  const actors = [];
-  for (const row of rows) {
-    const candidate = row.provider === "slack" ? {
-      platform: "slack",
-      teamId: row.providerTenantId,
-      userId: row.providerSubjectId,
-      email: row.email,
-      ...row.displayName ? { fullName: row.displayName } : {},
-      ...row.handle ? { userName: row.handle } : {}
-    } : row.provider === "local" ? {
-      platform: "local",
-      userId: row.providerSubjectId,
-      email: row.email,
-      ...row.displayName ? { fullName: row.displayName } : {},
-      ...row.handle ? { userName: row.handle } : {}
-    } : void 0;
-    if (!candidate) continue;
-    const parsed = actorSchema.safeParse(candidate);
-    if (parsed.success && parsed.data.platform !== "system") {
-      actors.push(parsed.data);
-    }
-  }
-  return actors;
-}
-async function readViewerActors(email) {
-  return await readViewerActorsFromSql(getDb(), email);
-}
-
-// src/chat/credentials/subject.ts
-import { createHmac, timingSafeEqual } from "crypto";
-
 // src/chat/slack/client.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 import { WebClient } from "@slack/web-api";
@@ -916,7 +834,138 @@ async function downloadPrivateSlackFile(url) {
   );
 }
 
+// src/chat/resource-events/workspace.ts
+function canRouteResourceEvents() {
+  return Boolean(getSlackBotToken());
+}
+function createResourceEventTeamIdResolver() {
+  let pending;
+  return async () => {
+    if (!canRouteResourceEvents()) return void 0;
+    pending ??= getSlackClient().auth.test().then((result) => {
+      const teamId = result.team_id?.trim();
+      if (!teamId) {
+        throw new Error("Slack auth.test did not return a workspace team id");
+      }
+      return teamId;
+    }).catch((error) => {
+      pending = void 0;
+      throw error;
+    });
+    return await pending;
+  };
+}
+
+// src/chat/slack/tools/context.ts
+function getSlackToolContext(context) {
+  if (context.source.platform !== "slack") {
+    return void 0;
+  }
+  if (context.destination.platform !== "slack") {
+    throw new TypeError("Slack source requires a Slack destination");
+  }
+  const destinationChannelId = parseSlackChannelReferenceId(
+    context.destination.channelId
+  );
+  const sourceChannelId = parseSlackChannelReferenceId(
+    context.source.channelId
+  );
+  const teamId = parseSlackTeamId(context.source.teamId);
+  if (!destinationChannelId || !sourceChannelId || !teamId) {
+    return void 0;
+  }
+  return {
+    destination: context.destination,
+    source: context.source,
+    actor: context.actor?.platform === "slack" ? context.actor : void 0,
+    destinationChannelId,
+    messageTs: parseSlackMessageTs(context.source.messageTs),
+    sourceChannelId,
+    teamId,
+    threadTs: parseSlackMessageTs(context.source.threadTs)
+  };
+}
+
+// src/chat/plugins/viewer.ts
+import { randomUUID } from "crypto";
+import { and as and3, asc, eq as eq3 } from "drizzle-orm";
+import {
+  identitySchema,
+  userSchema
+} from "@sentry/junior-plugin-api";
+function identityFromRow(row) {
+  return identitySchema.parse({
+    id: row.id,
+    provider: row.provider,
+    providerSubjectId: row.providerSubjectId,
+    ...row.providerTenantId ? { providerTenantId: row.providerTenantId } : {},
+    ...row.displayName ? { displayName: row.displayName } : {},
+    ...row.handle ? { handle: row.handle } : {}
+  });
+}
+async function readUserById(db, userRow) {
+  const identityRows = await db.select().from(juniorIdentities).where(
+    and3(
+      eq3(juniorIdentities.userId, userRow.id),
+      eq3(juniorIdentities.kind, "user")
+    )
+  ).orderBy(
+    asc(juniorIdentities.provider),
+    asc(juniorIdentities.providerTenantId),
+    asc(juniorIdentities.providerSubjectId)
+  );
+  return userSchema.parse({
+    email: userRow.primaryEmail,
+    id: userRow.id,
+    identities: identityRows.map(identityFromRow),
+    ...userRow.displayName ? { displayName: userRow.displayName } : {}
+  });
+}
+async function resolveViewerUserFromSql(db, email) {
+  const normalizedEmail = normalizeIdentityEmail(email);
+  if (!normalizedEmail) return void 0;
+  const now = /* @__PURE__ */ new Date();
+  const rows = await db.insert(juniorUsers).values({
+    id: randomUUID(),
+    primaryEmail: email.trim(),
+    primaryEmailNormalized: normalizedEmail,
+    displayName: null,
+    createdAt: now,
+    updatedAt: now
+  }).onConflictDoNothing({ target: juniorUsers.primaryEmailNormalized }).returning();
+  const userRow = rows[0] ?? (await db.select().from(juniorUsers).where(eq3(juniorUsers.primaryEmailNormalized, normalizedEmail)).limit(1))[0];
+  return userRow ? await readUserById(db, userRow) : void 0;
+}
+async function resolveViewerUser(email) {
+  return await resolveViewerUserFromSql(getDb(), email);
+}
+async function readActorIdentityFromSql(db, actor) {
+  if (actor.platform === "system") return void 0;
+  const providerTenantId = actor.platform === "slack" ? actor.teamId : "";
+  const rows = await db.select({
+    identity: juniorIdentities,
+    user: juniorUsers
+  }).from(juniorIdentities).leftJoin(juniorUsers, eq3(juniorUsers.id, juniorIdentities.userId)).where(
+    and3(
+      eq3(juniorIdentities.kind, "user"),
+      eq3(juniorIdentities.provider, actor.platform),
+      eq3(juniorIdentities.providerTenantId, providerTenantId),
+      eq3(juniorIdentities.providerSubjectId, actor.userId)
+    )
+  ).limit(1);
+  const row = rows[0];
+  if (!row) return void 0;
+  return {
+    identity: identityFromRow(row.identity),
+    ...row.user ? { user: await readUserById(db, row.user) } : {}
+  };
+}
+async function readActorIdentity(actor) {
+  return await readActorIdentityFromSql(getDb(), actor);
+}
+
 // src/chat/credentials/subject.ts
+import { createHmac, timingSafeEqual } from "crypto";
 var CREDENTIAL_SUBJECT_HMAC_CONTEXT = "junior.credential_subject.v1";
 var CREDENTIAL_SUBJECT_SIGNATURE_VERSION = "v1";
 function getCredentialSubjectSecret() {
@@ -1041,6 +1090,51 @@ function verifyScheduledTaskCredentialSubject(input) {
   );
   return timingSafeMatch(expected, binding.signature);
 }
+function bindEventTaskCredentialSubject(input) {
+  const secret = getCredentialSubjectSecret();
+  const plugin = input.plugin.trim();
+  const userId = parseActorUserId(input.subject.userId);
+  if (!secret || plugin !== "junior" || !userId || input.subject.allowedWhen !== "event-task") {
+    return void 0;
+  }
+  const taskId = input.subject.taskId;
+  if (!taskId || taskId !== taskId.trim()) {
+    return void 0;
+  }
+  return {
+    type: "user",
+    userId,
+    allowedWhen: "event-task",
+    taskId,
+    binding: {
+      type: "event-task",
+      plugin,
+      taskId,
+      signature: signPayload(
+        secret,
+        buildPayload(["event-task", plugin, taskId, userId])
+      )
+    }
+  };
+}
+function verifyEventTaskCredentialSubject(input) {
+  const secret = getCredentialSubjectSecret();
+  const { subject } = input;
+  const binding = subject.binding;
+  if (!secret || input.plugin !== "junior" || subject.type !== "user" || !isActorUserId(subject.userId) || subject.allowedWhen !== "event-task" || !subject.taskId || binding.type !== "event-task" || binding.plugin !== input.plugin || binding.taskId !== subject.taskId) {
+    return false;
+  }
+  const expected = signPayload(
+    secret,
+    buildPayload([
+      "event-task",
+      binding.plugin,
+      binding.taskId,
+      subject.userId
+    ])
+  );
+  return timingSafeMatch(expected, binding.signature);
+}
 
 // src/chat/slack/tools/channel-capabilities.ts
 function resolveChannelCapabilities(channelId) {
@@ -1425,6 +1519,10 @@ function getPluginTools(context) {
       plugin: pluginName
     }) : void 0;
     const mcp = pluginMcpContext(plugin, context);
+    const resourceEvents = {
+      canSubscribe: context.source.platform === "slack" && canRouteResourceEvents()
+    };
+    const resolveActor = context.resolveActorIdentity ?? (async () => void 0);
     let pluginContext;
     if (context.source.platform === "slack") {
       if (context.destination.platform !== "slack") {
@@ -1445,7 +1543,9 @@ function getPluginTools(context) {
         egress: context.egress,
         ...mcp ? { mcp } : {},
         model: createPluginModel(pluginName, plugin.model),
-        state: createPluginState(pluginName)
+        resourceEvents,
+        state: createPluginState(pluginName),
+        users: { resolveActor }
       };
     } else {
       if (context.destination.platform !== "local") {
@@ -1465,7 +1565,9 @@ function getPluginTools(context) {
         egress: context.egress,
         ...mcp ? { mcp } : {},
         model: createPluginModel(pluginName, plugin.model),
-        state: createPluginState(pluginName)
+        resourceEvents,
+        state: createPluginState(pluginName),
+        users: { resolveActor }
       };
     }
     const pluginTools = hook(pluginContext);
@@ -1635,9 +1737,7 @@ function getPluginApiRoutes() {
     const app = hook({
       ...basePluginContext(plugin),
       eventStats: createPluginConversationEventStats(plugin),
-      viewer: {
-        actors: readViewerActors
-      }
+      users: { resolve: resolveViewerUser }
     });
     if (app === void 0) {
       continue;
@@ -2106,8 +2206,6 @@ export {
   createPluginState,
   setDashboardConversationLinkOptions,
   getDashboardConversationLink,
-  getSlackToolContext,
-  readViewerActors,
   runWithWorkspaceTeamId,
   getWorkspaceTeamId,
   SlackActionError,
@@ -2120,10 +2218,17 @@ export {
   isConversationScopedChannel,
   getFilePermalink,
   downloadPrivateSlackFile,
+  canRouteResourceEvents,
+  createResourceEventTeamIdResolver,
+  getSlackToolContext,
+  resolveViewerUser,
+  readActorIdentity,
   bindSlackDirectCredentialSubject,
   verifySlackDirectCredentialSubject,
   bindScheduledTaskCredentialSubject,
   verifyScheduledTaskCredentialSubject,
+  bindEventTaskCredentialSubject,
+  verifyEventTaskCredentialSubject,
   resolveChannelCapabilities,
   PluginHookDeniedError,
   validatePlugins,

package/dist/{chunk-AYICPT5T.js → chunk-B6E3YA2H.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-6GWA276C.js";
 import {
   getDeploymentTelemetryAttributes
-} from "./chunk-AKL3BAYJ.js";
+} from "./chunk-RYWMDDWK.js";
 
 // src/chat/logging.ts
 import path from "path";

package/dist/{chunk-PDG3BSOD.js → chunk-B7FPRGUJ.js}

@@ -4,12 +4,12 @@ import {
   juniorConversations,
   juniorIdentities,
   juniorUsers
-} from "./chunk-S4PUICSB.js";
+} from "./chunk-SHMHHXD5.js";
 import {
   TURN_REASONING_LEVELS,
   getChatConfig,
   modelProfileSchema
-} from "./chunk-L7L7RYJM.js";
+} from "./chunk-K5ZB3WWH.js";
 import {
   juniorDestinations
 } from "./chunk-VFUK3X5B.js";
@@ -19,7 +19,7 @@ import {
 } from "./chunk-F3B2YJ76.js";
 import {
   normalizeIdentityEmail
-} from "./chunk-AYICPT5T.js";
+} from "./chunk-B6E3YA2H.js";
 
 // src/chat/conversations/sql/store.ts
 import { randomUUID as randomUUID2 } from "crypto";

package/dist/{chunk-JNYR4G7A.js → chunk-BY43CEXN.js}

@@ -1,9 +1,9 @@
 import {
   pluginCatalogRuntime
-} from "./chunk-2N6EL22B.js";
+} from "./chunk-WZ365SQC.js";
 import {
   logWarn
-} from "./chunk-AYICPT5T.js";
+} from "./chunk-B6E3YA2H.js";
 import {
   skillRoots
 } from "./chunk-H4HBKISO.js";

package/dist/{chunk-HDSDCEPK.js → chunk-EPBBYMNE.js}

@@ -1,6 +1,6 @@
 import {
   credentialContextSchema
-} from "./chunk-W3U3YQYI.js";
+} from "./chunk-77VDLF3Z.js";
 
 // src/chat/sandbox/egress/schemas.ts
 import { z } from "zod";

package/dist/{chunk-VHUMNUJL.js → chunk-FJEIX3AH.js}

@@ -1,9 +1,9 @@
 import {
   getDb
-} from "./chunk-PDG3BSOD.js";
+} from "./chunk-B7FPRGUJ.js";
 import {
   juniorStats
-} from "./chunk-S4PUICSB.js";
+} from "./chunk-SHMHHXD5.js";
 
 // src/stats.ts
 import { and, asc, gte, lte, sql } from "drizzle-orm";

package/dist/{chunk-SH7HDO2D.js → chunk-G6XQODHM.js}

@@ -1,6 +1,6 @@
 import {
   getChatConfig
-} from "./chunk-L7L7RYJM.js";
+} from "./chunk-K5ZB3WWH.js";
 
 // src/chat/state/adapter.ts
 import { createMemoryState } from "@chat-adapter/state-memory";

package/dist/{chunk-WXP2ZXC7.js → chunk-HBFQLSGV.js}

@@ -16,17 +16,17 @@ import {
   instructionProvenanceFor,
   sanitizePostgresJson,
   withConversationEventLock
-} from "./chunk-PDG3BSOD.js";
+} from "./chunk-B7FPRGUJ.js";
 import {
   getStateAdapter,
   sleep
-} from "./chunk-SH7HDO2D.js";
+} from "./chunk-G6XQODHM.js";
 import {
   botConfig,
   escapeXml,
   resolveGatewayModel,
   unwrapCurrentInstruction
-} from "./chunk-L7L7RYJM.js";
+} from "./chunk-K5ZB3WWH.js";
 import {
   toStoredSlackActor
 } from "./chunk-HZF5P5UN.js";
@@ -41,7 +41,7 @@ import {
   setSpanAttributes,
   toOptionalNumber,
   toOptionalString
-} from "./chunk-AYICPT5T.js";
+} from "./chunk-B6E3YA2H.js";
 
 // src/chat/turn-context-tag.ts
 var TURN_CONTEXT_TAG = "runtime-turn-context";

package/dist/{chunk-C7AVHH3H.js → chunk-JDCPDJ54.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-UTL3MHPC.js";
 import {
   parseSlackThreadId
-} from "./chunk-2M6LYDTB.js";
+} from "./chunk-PBWUUVVG.js";
 import {
   normalizeSlackConversationId
-} from "./chunk-TLMI3Q4Q.js";
+} from "./chunk-A76LKS5W.js";
 
 // src/handlers/health.ts
 function readHealthReport() {

package/dist/{chunk-L7L7RYJM.js → chunk-K5ZB3WWH.js}

@@ -3,7 +3,7 @@ import {
   toCanonicalInputMessage,
   toCanonicalOutputMessage,
   toGenAiMessagesTraceAttributes
-} from "./chunk-NK7QVIMJ.js";
+} from "./chunk-Z4KTQMWW.js";
 import {
   extractGenAiUsageAttributes,
   logException,
@@ -11,7 +11,7 @@ import {
   normalizeGenAiFinishReason,
   serializeGenAiAttribute,
   withSpan
-} from "./chunk-AYICPT5T.js";
+} from "./chunk-B6E3YA2H.js";
 
 // src/chat/config.ts
 import { getModel as getModel2 } from "@earendil-works/pi-ai/compat";

package/dist/{chunk-4H2NZPFJ.js → chunk-KNRODVH2.js}

@@ -22,7 +22,7 @@ import {
   persistThreadStateById,
   stripRuntimeTurnContext,
   updateConversationStats
-} from "./chunk-WXP2ZXC7.js";
+} from "./chunk-HBFQLSGV.js";
 import {
   createPluginConversationEvents,
   createPluginEmbedder,
@@ -30,26 +30,26 @@ import {
   createPluginModel,
   createPluginState,
   getPlugins
-} from "./chunk-TLMI3Q4Q.js";
+} from "./chunk-A76LKS5W.js";
 import {
   getDb,
   sameActorIdentity
-} from "./chunk-PDG3BSOD.js";
+} from "./chunk-B7FPRGUJ.js";
 import {
   getStateAdapter
-} from "./chunk-SH7HDO2D.js";
+} from "./chunk-G6XQODHM.js";
 import {
   ProviderError,
   findProviderError,
   getProviderErrorAttributes,
   getProviderErrorUserMessage
-} from "./chunk-L7L7RYJM.js";
+} from "./chunk-K5ZB3WWH.js";
 import {
   parseSlackMessageTs
 } from "./chunk-F3B2YJ76.js";
 import {
   buildTurnFailureResponse
-} from "./chunk-AYICPT5T.js";
+} from "./chunk-B6E3YA2H.js";
 
 // src/chat/runtime/delivered-turn-state.ts
 function buildDeliveredTurnStatePatch(args) {

package/dist/{chunk-JXQWTNDI.js → chunk-KTGJAWRO.js}

@@ -1,7 +1,7 @@
 // package.json
 var package_default = {
   name: "@sentry/junior",
-  version: "0.127.0",
+  version: "0.128.0",
   private: false,
   publishConfig: {
     access: "public"

package/dist/{chunk-6DU2ZNF7.js → chunk-NHWE6Y7G.js}

@@ -6,25 +6,25 @@ import {
   isDmChannel,
   normalizeSlackConversationId,
   withSlackRetries
-} from "./chunk-TLMI3Q4Q.js";
+} from "./chunk-A76LKS5W.js";
 import {
   getDb,
   parseDestination
-} from "./chunk-PDG3BSOD.js";
+} from "./chunk-B7FPRGUJ.js";
 import {
   acquireActiveLock,
   getStateAdapter,
   sleep
-} from "./chunk-SH7HDO2D.js";
+} from "./chunk-G6XQODHM.js";
 import {
   normalizeSlackEmojiName
-} from "./chunk-L7L7RYJM.js";
+} from "./chunk-K5ZB3WWH.js";
 import {
   pluginCatalogRuntime
-} from "./chunk-2N6EL22B.js";
+} from "./chunk-WZ365SQC.js";
 import {
   fetchWithBoundedOAuthErrorBodies
-} from "./chunk-FVIU6NQO.js";
+} from "./chunk-OLGB5Y7R.js";
 import {
   parseSlackMessageTs,
   parseSlackUserId
@@ -33,7 +33,7 @@ import {
   isRecord,
   logInfo,
   logWarn
-} from "./chunk-AYICPT5T.js";
+} from "./chunk-B6E3YA2H.js";
 
 // src/chat/capabilities/router.ts
 var ProviderCredentialRouter = class {

package/dist/{chunk-FVIU6NQO.js → chunk-OLGB5Y7R.js}

@@ -1,11 +1,11 @@
 import {
   credentialUserSubjectId
-} from "./chunk-W3U3YQYI.js";
+} from "./chunk-77VDLF3Z.js";
 import {
   logInfo,
   logWarn,
   setSpanAttributes
-} from "./chunk-AYICPT5T.js";
+} from "./chunk-B6E3YA2H.js";
 import {
   discoverInstalledPluginPackageContent,
   normalizePluginPackageNames

package/dist/{chunk-2M6LYDTB.js → chunk-PBWUUVVG.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-F3B2YJ76.js";
 import {
   toOptionalString
-} from "./chunk-AYICPT5T.js";
+} from "./chunk-B6E3YA2H.js";
 
 // src/chat/slack/context.ts
 import { z } from "zod";

package/dist/{chunk-AKL3BAYJ.js → chunk-RYWMDDWK.js}

@@ -1,6 +1,6 @@
 import {
   JUNIOR_VERSION
-} from "./chunk-JXQWTNDI.js";
+} from "./chunk-KTGJAWRO.js";
 
 // src/deployment.ts
 var JUNIOR_HEARTBEAT_ROUTE = "/api/internal/heartbeat";