@sentry/junior 0.202.0 → 0.204.0

package/dist/context-B45_WqVX.js

@@ -0,0 +1,298 @@
+import { z } from "zod";
+import "@sentry/junior-plugin-api";
+//#region src/chat/slack/timestamp.ts
+/** Native Slack message timestamp, safe to pass as Slack Web API `message_ts`. */
+const slackMessageTsSchema = z.string().trim().regex(/^\d+(?:\.\d+)?$/).brand();
+/** Parse a native Slack message timestamp from untrusted message metadata. */
+function parseSlackMessageTs(value) {
+	const parsed = slackMessageTsSchema.safeParse(value);
+	return parsed.success ? parsed.data : void 0;
+}
+//#endregion
+//#region src/chat/slack/ids.ts
+const slackChannelIdSchema = z.string().regex(/^[CDG][A-Z0-9]+$/).brand();
+const slackTeamIdSchema = z.string().regex(/^T[A-Z0-9]+$/).brand();
+const slackUserIdSchema = z.string().regex(/^[UW][A-Z0-9]+$/).brand();
+const SLACK_CHANNEL_MENTION_RE = /^<#([CDG][A-Z0-9]+)(?:\|[^>]*)?>$/;
+function slackChannelReferenceCandidate(value) {
+	const trimmed = value.trim();
+	if (!trimmed.startsWith("slack:")) return trimmed;
+	const parts = trimmed.split(":");
+	if (parts.length === 2) return parts[1]?.trim() ?? "";
+	if (parts.length === 3 && parseSlackMessageTs(parts[2])) return parts[1]?.trim() ?? "";
+	return "";
+}
+/** Parse an exact Slack channel/conversation ID from untrusted input. */
+function parseSlackChannelId(value) {
+	if (typeof value !== "string") return void 0;
+	const parsed = slackChannelIdSchema.safeParse(value.trim());
+	return parsed.success ? parsed.data : void 0;
+}
+/**
+* Parse a channel id from common tool/model reference forms.
+*
+* Accepts exact ids (`C123`), Slack mentions (`<#C123>` / `<#C123|name>`),
+* and Junior slack references (`slack:C123`, `slack:C123:ts`). Plain channel
+* names are not ids and are rejected here.
+*/
+function parseSlackChannelReferenceId(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	const mentionMatch = SLACK_CHANNEL_MENTION_RE.exec(trimmed);
+	if (mentionMatch?.[1]) return parseSlackChannelId(mentionMatch[1]);
+	return parseSlackChannelId(slackChannelReferenceCandidate(trimmed));
+}
+/** Parse a Slack workspace/team ID from untrusted metadata. */
+function parseSlackTeamId(value) {
+	if (typeof value !== "string") return void 0;
+	const parsed = slackTeamIdSchema.safeParse(value.trim());
+	return parsed.success ? parsed.data : void 0;
+}
+/** Parse a Slack user ID from untrusted metadata. */
+function parseSlackUserId(value) {
+	if (typeof value !== "string") return void 0;
+	const parsed = slackUserIdSchema.safeParse(value.trim());
+	return parsed.success ? parsed.data : void 0;
+}
+//#endregion
+//#region src/chat/actor.ts
+/**
+* Canonical actor identity.
+*
+* Runtime actors are platform-scoped actors. Stored Slack actor parsing
+* remains explicit so durable conversation metadata is not repaired on read.
+*/
+const SLACK_USER_ID_DISPLAY_PATTERN = /^[UW][A-Z0-9]{5,}$/;
+const EMAIL_PATTERN = /^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/;
+const exactStoredStringSchema = z.string().min(1).refine((value) => value === value.trim());
+const storedSlackActorSchema = z.object({
+	email: exactStoredStringSchema.optional(),
+	fullName: exactStoredStringSchema.optional(),
+	platform: z.literal("slack").optional(),
+	slackUserId: exactStoredStringSchema.optional(),
+	slackUserName: exactStoredStringSchema.optional(),
+	teamId: exactStoredStringSchema.optional()
+}).strict();
+/** Return whether an actor is a platform-scoped user actor. */
+function isUserActor(actor) {
+	return Boolean(actor && "userId" in actor);
+}
+function clean(value) {
+	const trimmed = value?.trim();
+	return trimmed ? trimmed : void 0;
+}
+function isSyntheticActorUserId(value) {
+	return value.toLowerCase() === "unknown";
+}
+function isSlackUserId(value) {
+	return SLACK_USER_ID_DISPLAY_PATTERN.test(value);
+}
+function cleanActorDisplayName(value, userId) {
+	const displayName = clean(value);
+	if (!displayName) return;
+	if (displayName.toLowerCase() === "unknown") return;
+	if (userId && displayName === userId) return;
+	return isSlackUserId(displayName) ? void 0 : displayName;
+}
+function cleanActorEmail(value) {
+	const email = clean(value);
+	return email && EMAIL_PATTERN.test(email) ? email : void 0;
+}
+/** Keep actor ids exact at platform boundaries before they enter owned state. */
+function parseActorUserId(value) {
+	if (typeof value !== "string" || value.length === 0) return;
+	if (value !== value.trim() || isSyntheticActorUserId(value)) return;
+	return value;
+}
+/** Assert persisted actor ids without read-side repair. */
+function isActorUserId(value) {
+	return parseActorUserId(value) === value;
+}
+/** Build Junior's canonical platform actor from exact actor ids and profile data. */
+function createActor(input, context) {
+	const platform = context.platform ?? input?.platform;
+	if (!platform) return;
+	const contextUserId = parseActorUserId(context.userId);
+	if (context.userId !== void 0 && !contextUserId) return;
+	const inputUserId = parseActorUserId(input?.userId);
+	if (input?.userId !== void 0 && !inputUserId) return;
+	const actorUserId = contextUserId ?? inputUserId;
+	if (!actorUserId) return;
+	const contextTeamId = parseSlackTeamId(context.teamId);
+	if (context.teamId !== void 0 && !contextTeamId) return;
+	const inputTeamId = parseSlackTeamId(input?.teamId);
+	if (input?.teamId !== void 0 && !inputTeamId) return;
+	const actorTeamId = contextTeamId ?? inputTeamId;
+	if (platform === "slack" && !actorTeamId) return;
+	const canUseInputProfile = (!contextUserId || !inputUserId || contextUserId === inputUserId) && (platform !== "slack" || !contextTeamId || !inputTeamId || contextTeamId === inputTeamId);
+	const actor = {
+		...canUseInputProfile && cleanActorEmail(input?.email) ? { email: cleanActorEmail(input?.email) } : void 0,
+		...canUseInputProfile && cleanActorDisplayName(input?.fullName, actorUserId) ? { fullName: cleanActorDisplayName(input?.fullName, actorUserId) } : void 0,
+		platform,
+		userId: actorUserId,
+		...canUseInputProfile && cleanActorDisplayName(input?.userName, actorUserId) ? { userName: cleanActorDisplayName(input?.userName, actorUserId) } : void 0
+	};
+	if (platform === "slack") return {
+		...actor,
+		platform,
+		teamId: actorTeamId
+	};
+	return {
+		...actor,
+		platform
+	};
+}
+/** Build Junior's canonical actor from Slack profile data. */
+function createSlackActor(teamId, userId, profile) {
+	const actorUserId = parseActorUserId(userId);
+	const actorTeamId = parseSlackTeamId(teamId);
+	if (!actorTeamId || !actorUserId) throw new Error("Slack actor requires team and user ids");
+	const actor = createActor({
+		email: profile?.email,
+		fullName: profile?.fullName,
+		platform: "slack",
+		teamId: actorTeamId,
+		userId: actorUserId,
+		userName: profile?.userName
+	}, {
+		teamId: actorTeamId,
+		userId: actorUserId
+	});
+	if (!actor || actor.platform !== "slack") throw new Error("Slack actor requires team and user ids");
+	return actor;
+}
+/** Parse a serialized Slack actor that crossed a runtime boundary. */
+function parseStoredSlackActor(value) {
+	const parsed = storedSlackActorSchema.safeParse(value);
+	if (!parsed.success) return;
+	if (parsed.data.slackUserId !== void 0 && !parseActorUserId(parsed.data.slackUserId)) return;
+	if (parsed.data.teamId !== void 0 && !parseSlackTeamId(parsed.data.teamId)) return;
+	if ((parsed.data.platform !== void 0 || parsed.data.teamId !== void 0) && (!parsed.data.platform || !parsed.data.teamId)) return;
+	return parsed.data;
+}
+/** Convert a runtime Slack actor into its durable session shape. */
+function toStoredSlackActor(actor) {
+	return {
+		...actor.email ? { email: actor.email } : void 0,
+		...actor.fullName ? { fullName: actor.fullName } : void 0,
+		platform: actor.platform,
+		slackUserId: actor.userId,
+		...actor.userName ? { slackUserName: actor.userName } : void 0,
+		teamId: actor.teamId
+	};
+}
+/**
+* Resolve a Slack resume actor from stored profile data and the active actor.
+*
+* TODO(dcramer): Require Actor and remove ID-only construction after no
+* deployed Turn cursor can omit Actor.
+*/
+function createSlackResumeActor(args) {
+	if (args.actor) {
+		if (args.actor.platform !== "slack" || args.actor.teamId !== args.teamId || args.actor.userId !== args.userId) throw new Error("Stored Slack actor did not match resume actor");
+	}
+	const actor = createActor(args.actor, {
+		platform: "slack",
+		teamId: args.teamId,
+		userId: args.userId
+	});
+	if (!actor || actor.platform !== "slack") throw new Error("Slack actor requires team and user ids");
+	return actor;
+}
+//#endregion
+//#region src/chat/credentials/context.ts
+const exactActorIdSchema = z.string().refine((value) => parseActorUserId(value) === value);
+const exactNonBlankStringSchema = z.string().min(1).refine((value) => value === value.trim());
+const slackDirectCredentialSubjectBindingSchema = z.object({
+	type: z.literal("slack-direct-conversation"),
+	teamId: z.string().min(1),
+	channelId: z.string().min(1),
+	signature: z.string().min(1)
+}).strict();
+const scheduledTaskCredentialSubjectBindingSchema = z.object({
+	type: z.literal("scheduled-task"),
+	plugin: z.string().min(1),
+	taskId: exactNonBlankStringSchema,
+	signature: z.string().min(1)
+}).strict();
+const eventTaskCredentialSubjectBindingSchema = z.object({
+	type: z.literal("event-task"),
+	plugin: z.string().min(1),
+	taskId: exactNonBlankStringSchema,
+	signature: z.string().min(1)
+}).strict();
+z.discriminatedUnion("type", [
+	slackDirectCredentialSubjectBindingSchema,
+	scheduledTaskCredentialSubjectBindingSchema,
+	eventTaskCredentialSubjectBindingSchema
+]);
+const credentialUserActorSchema = z.object({
+	type: z.literal("user"),
+	userId: exactActorIdSchema
+}).strict();
+const credentialSystemActorSchema = z.object({
+	platform: z.literal("system"),
+	name: exactActorIdSchema
+}).strict();
+const credentialSubjectSchema = z.discriminatedUnion("allowedWhen", [
+	z.object({
+		type: z.literal("user"),
+		userId: exactActorIdSchema,
+		allowedWhen: z.literal("private-direct-conversation"),
+		binding: slackDirectCredentialSubjectBindingSchema
+	}).strict(),
+	z.object({
+		type: z.literal("user"),
+		userId: exactActorIdSchema,
+		allowedWhen: z.literal("scheduled-task"),
+		taskId: exactNonBlankStringSchema,
+		binding: scheduledTaskCredentialSubjectBindingSchema
+	}).strict().refine((subject) => subject.binding.taskId === subject.taskId, {
+		message: "Scheduled task credential subject requires task binding",
+		path: ["binding"]
+	}),
+	z.object({
+		type: z.literal("user"),
+		userId: exactActorIdSchema,
+		allowedWhen: z.literal("event-task"),
+		taskId: exactNonBlankStringSchema,
+		binding: eventTaskCredentialSubjectBindingSchema
+	}).strict().refine((subject) => subject.binding.taskId === subject.taskId, {
+		message: "Event task credential subject requires task binding",
+		path: ["binding"]
+	})
+]);
+const credentialContextSchema = z.union([z.object({ actor: credentialUserActorSchema }).strict(), z.object({
+	actor: credentialSystemActorSchema,
+	subject: credentialSubjectSchema.optional()
+}).strict()]);
+/**
+* Build credential authority from the run actor.
+*
+* `actor` is the rich execution principal. This projects the credential stub
+* tools/auth need from it:
+* - user actor → `{ actor: { type: "user", userId } }`
+* - system actor → `{ actor: systemActor, subject? }`
+*
+* They only diverge when a system run carries an explicit delegated `subject`
+* (scheduled/event-task creator credentials). Callers should set `actor` first,
+* then derive this — do not hand-build parallel shapes.
+*/
+function credentialContextForActor(actor, subject) {
+	if (actor.platform === "system") return subject ? {
+		actor,
+		subject
+	} : { actor };
+	if (subject) throw new TypeError("Delegated credential subjects require a system actor");
+	return { actor: {
+		type: "user",
+		userId: actor.userId
+	} };
+}
+/** Return the user whose OAuth token may satisfy this credential request. */
+function credentialUserSubjectId(context) {
+	if ("type" in context.actor) return context.actor.userId;
+	return "subject" in context ? context.subject?.userId : void 0;
+}
+//#endregion
+export { parseSlackMessageTs as _, createActor as a, isActorUserId as c, parseStoredSlackActor as d, toStoredSlackActor as f, parseSlackUserId as g, parseSlackTeamId as h, credentialUserSubjectId as i, isUserActor as l, parseSlackChannelReferenceId as m, credentialContextSchema as n, createSlackActor as o, parseSlackChannelId as p, credentialSubjectSchema as r, createSlackResumeActor as s, credentialContextForActor as t, parseActorUserId as u };

package/dist/conversation-privacy-B4voFRSm.js

@@ -0,0 +1,182 @@
+import { f as logWarn } from "./logging-BzAk1S_s.js";
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/chat/conversation-privacy.ts
+const SAFE_METADATA_KEY_LIMIT = 20;
+const conversationPrivacyStorage = new AsyncLocalStorage();
+/**
+* Resolve whether a Conversation may expose full transcript and tool data.
+*
+* Read visibility from the stored Conversation. If it is missing, warn and
+* treat the Conversation as private. Do not infer visibility from identifiers.
+*/
+function resolveConversationPrivacy(input) {
+	if (input.visibility === void 0) logWarn("conversation.visibility.defaulted");
+	return input.visibility === "public" ? "public" : "private";
+}
+/** Return whether a public Conversation may expose transcript and tool data. */
+function canExposeConversationPayload(input) {
+	return resolveConversationPrivacy(input) === "public";
+}
+/** Return privacy for the current agent Turn. */
+function getCurrentConversationPrivacy() {
+	return conversationPrivacyStorage.getStore();
+}
+/** Bind one conversation privacy mode to all async work in a turn. */
+function runWithConversationPrivacy(privacy, callback) {
+	return conversationPrivacyStorage.run(privacy, callback);
+}
+function payloadType(payload) {
+	return Array.isArray(payload) ? "array" : typeof payload;
+}
+function payloadKeys(payload) {
+	if (!payload || typeof payload !== "object" || Array.isArray(payload)) return;
+	const keys = Object.keys(payload).slice(0, SAFE_METADATA_KEY_LIMIT);
+	return keys.length > 0 ? keys : void 0;
+}
+function serializedLength(payload) {
+	return (typeof payload === "string" ? payload : JSON.stringify(payload))?.length ?? 0;
+}
+/** Convert an arbitrary payload into safe structured metadata for trace data fields. */
+function toGenAiPayloadMetadata(payload) {
+	const base = {
+		type: payloadType(payload),
+		chars: serializedLength(payload)
+	};
+	if (!payload || typeof payload !== "object" || Array.isArray(payload)) return base;
+	const keys = payloadKeys(payload);
+	return {
+		...base,
+		...keys ? { keys } : void 0
+	};
+}
+/** Convert an arbitrary payload into safe flattened trace attributes. */
+function toGenAiPayloadTraceAttributes(prefix, payload) {
+	const size = serializedLength(payload);
+	const attributes = {
+		[`${prefix}.type`]: payloadType(payload),
+		[`${prefix}.size_chars`]: size,
+		[`${prefix}.size`]: size
+	};
+	const keys = payloadKeys(payload);
+	if (keys) attributes[`${prefix}.keys`] = keys;
+	return attributes;
+}
+function summarizeContent(content) {
+	if (typeof content === "string") return {
+		chars: content.length,
+		partTypes: ["text"]
+	};
+	if (!Array.isArray(content)) return {
+		chars: serializedLength(content),
+		partTypes: [payloadType(content)]
+	};
+	let chars = 0;
+	const partTypes = /* @__PURE__ */ new Set();
+	for (const part of content) {
+		if (!part || typeof part !== "object") {
+			chars += serializedLength(part);
+			partTypes.add(payloadType(part));
+			continue;
+		}
+		const record = part;
+		const type = canonicalContentPartType(typeof record.type === "string" ? record.type : "unknown");
+		partTypes.add(type);
+		if (typeof record.text === "string") chars += record.text.length;
+		else if (typeof record.thinking === "string") chars += record.thinking.length;
+		else if (typeof record.data === "string") chars += record.data.length;
+		else chars += serializedLength(part);
+	}
+	return {
+		chars,
+		partTypes: [...partTypes]
+	};
+}
+function normalizeFinishReason(reason) {
+	return reason === "toolUse" ? "tool_call" : reason;
+}
+function canonicalContentPartType(type) {
+	if (type === "thinking") return "reasoning";
+	if (type === "toolCall") return "tool_call";
+	return type;
+}
+function toCanonicalPart(part) {
+	if (part.type === "text") return {
+		type: "text",
+		content: part.text
+	};
+	if (part.type === "thinking") {
+		if (part.redacted) return;
+		return {
+			type: "reasoning",
+			content: part.thinking
+		};
+	}
+	if (part.type === "toolCall") return {
+		type: "tool_call",
+		id: part.id,
+		name: part.name,
+		arguments: part.arguments
+	};
+}
+function toCanonicalParts(parts) {
+	return parts.map(toCanonicalPart).filter((part) => part !== void 0);
+}
+/**
+* Map a pi-ai AssistantMessage to the canonical gen_ai.output.messages shape:
+* `{ role, parts: [...], finish_reason }` — drops provider noise fields.
+*/
+function toCanonicalOutputMessage(message) {
+	return {
+		role: "assistant",
+		parts: toCanonicalParts(message.content),
+		finish_reason: normalizeFinishReason(message.stopReason)
+	};
+}
+/**
+* Map a pi-ai Message (user/assistant/toolResult) to the canonical
+* gen_ai.input.messages shape: `{ role, parts: [...] }`.
+*/
+function toCanonicalInputMessage(message) {
+	if (message.role === "user") return {
+		role: "user",
+		parts: typeof message.content === "string" ? [{
+			type: "text",
+			content: message.content
+		}] : toCanonicalParts(message.content)
+	};
+	if (message.role === "toolResult") return {
+		role: "tool",
+		parts: [{
+			type: "tool_call_response",
+			id: message.toolCallId,
+			response: toCanonicalParts(message.content)
+		}]
+	};
+	return toCanonicalOutputMessage(message);
+}
+/** Summarize a message list without exposing raw message content. */
+function toGenAiMessagesTraceAttributes(prefix, messages) {
+	let contentChars = 0;
+	const roles = /* @__PURE__ */ new Set();
+	const partTypes = /* @__PURE__ */ new Set();
+	for (const message of messages) {
+		if (!message || typeof message !== "object") {
+			contentChars += serializedLength(message);
+			continue;
+		}
+		const record = message;
+		if (typeof record.role === "string") roles.add(record.role);
+		const summary = summarizeContent(record.content);
+		contentChars += summary.chars;
+		for (const partType of summary.partTypes) partTypes.add(partType);
+	}
+	return {
+		[`${prefix}.message_count`]: messages.length,
+		[`${prefix}.content_chars`]: contentChars,
+		[`${prefix}.messages.size`]: contentChars,
+		...roles.size > 0 ? { [`${prefix}.roles`]: [...roles] } : void 0,
+		...partTypes.size > 0 ? { [`${prefix}.part_types`]: [...partTypes] } : void 0
+	};
+}
+//#endregion
+export { toCanonicalInputMessage as a, toGenAiPayloadMetadata as c, runWithConversationPrivacy as i, toGenAiPayloadTraceAttributes as l, getCurrentConversationPrivacy as n, toCanonicalOutputMessage as o, resolveConversationPrivacy as r, toGenAiMessagesTraceAttributes as s, canExposeConversationPayload as t };

package/dist/conversation-work-C6y3T5Hx.js

@@ -0,0 +1,51 @@
+//#region src/chat/local/conversation-work.ts
+/**
+* Run local conversation work in this process and wait for every accepted wake.
+*
+* Wakes start on a later event-loop turn so their producer can persist the
+* accepted marker first. Idempotent, delayed, and follow-up wakes remain
+* tracked so CLI shutdown cannot abandon accepted child work.
+*/
+function createLocalConversationWork(processMessage) {
+	const acceptedWakeIds = /* @__PURE__ */ new Map();
+	const pending = /* @__PURE__ */ new Set();
+	let firstError;
+	let nextWakeId = 1;
+	function schedule(message, options) {
+		const delayMs = Math.max(0, options?.delayMs ?? 0);
+		let work;
+		work = (async () => {
+			await new Promise((resolve) => {
+				setTimeout(resolve, delayMs);
+			});
+			await processMessage(message);
+		})().catch((error) => {
+			firstError ??= error;
+		}).finally(() => {
+			pending.delete(work);
+		});
+		pending.add(work);
+	}
+	return {
+		queue: { async send(message, options) {
+			const idempotencyKey = options?.idempotencyKey;
+			const acceptedWakeId = idempotencyKey ? acceptedWakeIds.get(idempotencyKey) : void 0;
+			if (acceptedWakeId) return { messageId: acceptedWakeId };
+			const messageId = `local-conversation-work:${nextWakeId}`;
+			nextWakeId += 1;
+			if (idempotencyKey) acceptedWakeIds.set(idempotencyKey, messageId);
+			schedule(message, options);
+			return { messageId };
+		} },
+		async drain() {
+			while (pending.size > 0) await Promise.all(pending);
+			if (firstError !== void 0) {
+				const error = firstError;
+				firstError = void 0;
+				throw error;
+			}
+		}
+	};
+}
+//#endregion
+export { createLocalConversationWork };