@sentry/junior 0.202.0 → 0.204.0

package/dist/chunk-BXCX5QKA.js

@@ -1,2086 +0,0 @@
-import {
-  credentialUserSubjectId
-} from "./chunk-CEMMLV5L.js";
-import {
-  discoverInstalledPluginPackageContent,
-  normalizePluginPackageNames
-} from "./chunk-DWPN6SCH.js";
-import {
-  pluginRoots
-} from "./chunk-TXKUKMVO.js";
-import {
-  logInfo,
-  logWarn,
-  setSpanAttributes
-} from "./chunk-MAGNK5J4.js";
-
-// src/chat/plugins/manifest.ts
-import { z } from "zod";
-import { parse as parseYaml } from "yaml";
-
-// src/chat/plugins/inline-manifest-source.ts
-function setDefined(target, key, value) {
-  if (value !== void 0) {
-    target[key] = value;
-  }
-}
-function isRecord(value) {
-  return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-function unqualifyManifestToken(name, value) {
-  if (typeof name === "string" && typeof value === "string" && value.startsWith(`${name}.`)) {
-    return value.slice(name.length + 1);
-  }
-  return value;
-}
-function inlineTokenListSource(name, values) {
-  if (values === void 0 || !Array.isArray(values)) {
-    return values;
-  }
-  return values.map((value) => unqualifyManifestToken(name, value));
-}
-function inlineCredentialsSource(credentials) {
-  if (credentials === void 0 || !isRecord(credentials)) {
-    return credentials;
-  }
-  const result = {};
-  setDefined(result, "type", credentials.type);
-  setDefined(result, "domains", credentials.domains);
-  setDefined(result, "api-headers", credentials.apiHeaders);
-  setDefined(result, "auth-token-env", credentials.authTokenEnv);
-  setDefined(
-    result,
-    "auth-token-placeholder",
-    credentials.authTokenPlaceholder
-  );
-  return result;
-}
-function inlineMcpSource(mcp) {
-  if (mcp === void 0 || !isRecord(mcp)) {
-    return mcp;
-  }
-  const result = {};
-  setDefined(result, "transport", mcp.transport);
-  setDefined(result, "url", mcp.url);
-  setDefined(result, "headers", mcp.headers);
-  setDefined(result, "allowed-tools", mcp.allowedTools);
-  setDefined(result, "wrapped-tools", mcp.wrappedTools);
-  return result;
-}
-function inlineOauthSource(oauth) {
-  if (oauth === void 0 || !isRecord(oauth)) {
-    return oauth;
-  }
-  const result = {};
-  setDefined(result, "client-id-env", oauth.clientIdEnv);
-  setDefined(result, "client-secret-env", oauth.clientSecretEnv);
-  setDefined(result, "authorize-endpoint", oauth.authorizeEndpoint);
-  setDefined(result, "token-endpoint", oauth.tokenEndpoint);
-  setDefined(result, "scope", oauth.scope);
-  setDefined(result, "authorize-params", oauth.authorizeParams);
-  setDefined(result, "token-auth-method", oauth.tokenAuthMethod);
-  setDefined(result, "token-extra-headers", oauth.tokenExtraHeaders);
-  setDefined(
-    result,
-    "treat-empty-scope-as-unreported",
-    oauth.treatEmptyScopeAsUnreported
-  );
-  return result;
-}
-function inlineTargetSource(name, target) {
-  if (target === void 0 || !isRecord(target)) {
-    return target;
-  }
-  const result = {};
-  setDefined(result, "type", target.type);
-  setDefined(
-    result,
-    "config-key",
-    unqualifyManifestToken(name, target.configKey)
-  );
-  setDefined(result, "command-flags", target.commandFlags);
-  return result;
-}
-function inlineManifestSource(manifest) {
-  const result = {};
-  setDefined(result, "name", manifest.name);
-  setDefined(result, "display-name", manifest.displayName);
-  setDefined(result, "description", manifest.description);
-  setDefined(
-    result,
-    "config-keys",
-    inlineTokenListSource(manifest.name, manifest.configKeys)
-  );
-  setDefined(result, "domains", manifest.domains);
-  setDefined(result, "api-headers", manifest.apiHeaders);
-  setDefined(result, "command-env", manifest.commandEnv);
-  setDefined(result, "env-vars", manifest.envVars);
-  setDefined(
-    result,
-    "credentials",
-    inlineCredentialsSource(manifest.credentials)
-  );
-  setDefined(result, "runtime-dependencies", manifest.runtimeDependencies);
-  setDefined(result, "runtime-postinstall", manifest.runtimePostinstall);
-  setDefined(result, "mcp", inlineMcpSource(manifest.mcp));
-  setDefined(result, "oauth", inlineOauthSource(manifest.oauth));
-  setDefined(
-    result,
-    "target",
-    inlineTargetSource(manifest.name, manifest.target)
-  );
-  return result;
-}
-
-// src/chat/plugins/manifest.ts
-var PLUGIN_NAME_RE = /^[a-z][a-z0-9-]*$/;
-var SHORT_CONFIG_KEY_RE = /^[a-z0-9]+(\.[a-z0-9-]+)*$/;
-var TARGET_FLAG_RE = /^-{1,2}[A-Za-z0-9][A-Za-z0-9-]*$/;
-var AUTH_TOKEN_ENV_RE = /^[A-Z][A-Z0-9_]*$/;
-var ENV_VAR_NAME_RE = /^[A-Z_][A-Z0-9_]*$/;
-var ENV_PLACEHOLDER_RE = /\$\{([A-Z_][A-Z0-9_]*)\}/g;
-var API_DOMAIN_RE = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
-var RUNTIME_POSTINSTALL_CMD_RE = /^[A-Za-z0-9._/-]+$/;
-var RESERVED_AUTHORIZE_PARAM_KEYS = /* @__PURE__ */ new Set([
-  "client_id",
-  "scope",
-  "state",
-  "redirect_uri",
-  "response_type"
-]);
-var FORBIDDEN_API_HEADER_NAMES = /* @__PURE__ */ new Set(["authorization"]);
-var FORBIDDEN_TOKEN_HEADER_NAMES = /* @__PURE__ */ new Set(["authorization"]);
-var trimmedString = z.string().transform((value) => value.trim());
-var nonEmptyTrimmedString = trimmedString.pipe(
-  z.string().min(1, { error: "must be a non-empty string" })
-);
-var nonEmptyStringArraySchema = (fieldName, options = {}) => z.array(z.string(), {
-  error: "must be an array of strings when provided"
-}).min(1, {
-  error: options.nonEmptyMessage ?? "must be a non-empty array of strings when provided"
-}).transform((values, ctx) => {
-  const result = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const rawValue of values) {
-    const value = rawValue.trim();
-    if (!value) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: `${fieldName} entries must be non-empty strings`
-      });
-      return z.NEVER;
-    }
-    if (seen.has(value)) {
-      continue;
-    }
-    seen.add(value);
-    result.push(value);
-  }
-  return result;
-});
-var envVarString = nonEmptyTrimmedString.refine(
-  (value) => AUTH_TOKEN_ENV_RE.test(value),
-  {
-    error: "must be an uppercase env var name"
-  }
-);
-var httpsUrlString = nonEmptyTrimmedString.superRefine((value, ctx) => {
-  let parsed;
-  try {
-    parsed = new URL(value);
-  } catch {
-    ctx.addIssue({
-      code: z.ZodIssueCode.custom,
-      message: "must be a valid URL"
-    });
-    return;
-  }
-  if (parsed.protocol !== "https:") {
-    ctx.addIssue({
-      code: z.ZodIssueCode.custom,
-      message: "must use https"
-    });
-  }
-});
-var stringMapSchema = z.record(z.string(), z.unknown()).transform((record, ctx) => {
-  const entries = Object.entries(record);
-  const result = {};
-  const seen = /* @__PURE__ */ new Set();
-  for (const [rawKey, rawValue] of entries) {
-    const key = rawKey.trim();
-    if (!key) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: "keys must be non-empty strings"
-      });
-      return z.NEVER;
-    }
-    if (typeof rawValue !== "string" || !rawValue.trim()) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: `${key} must be a non-empty string`
-      });
-      return z.NEVER;
-    }
-    const normalizedKey = key.toLowerCase();
-    if (seen.has(normalizedKey)) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: `${key} is duplicated`
-      });
-      return z.NEVER;
-    }
-    seen.add(normalizedKey);
-    result[key] = rawValue.trim();
-  }
-  return result;
-});
-var domainsSchema = z.array(z.unknown()).min(1, {
-  error: "must be a non-empty array of strings"
-}).transform((domains, ctx) => {
-  return domains.map((rawDomain) => {
-    const domain = typeof rawDomain === "string" ? rawDomain.trim().toLowerCase() : "";
-    if (!domain) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: "entries must be non-empty strings"
-      });
-      return z.NEVER;
-    }
-    if (!API_DOMAIN_RE.test(domain)) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: "entries must be valid domain names"
-      });
-      return z.NEVER;
-    }
-    return domain;
-  });
-});
-var baseCredentialsSchema = z.object({
-  domains: domainsSchema.optional()
-}).passthrough();
-var oauthBearerCredentialsSchema = baseCredentialsSchema.extend({
-  "api-headers": stringMapSchema.optional(),
-  "auth-token-env": envVarString,
-  "auth-token-placeholder": nonEmptyTrimmedString.optional(),
-  type: z.literal("oauth-bearer")
-});
-var runtimeDependencyEntrySchema = z.object({
-  type: z.enum(["npm", "system"]),
-  package: z.string().optional(),
-  version: z.string().optional(),
-  url: z.string().optional(),
-  sha256: z.string().optional()
-}).passthrough();
-var runtimePostinstallCommandSourceSchema = z.object({
-  cmd: nonEmptyTrimmedString,
-  args: z.array(z.string(), {
-    error: "args must be an array of strings when provided"
-  }).optional(),
-  sudo: z.boolean({
-    error: "sudo must be a boolean when provided"
-  }).optional()
-}).passthrough();
-var oauthSourceSchema = z.object({
-  "client-id-env": envVarString,
-  "client-secret-env": envVarString,
-  "authorize-endpoint": httpsUrlString,
-  "token-endpoint": httpsUrlString,
-  scope: nonEmptyTrimmedString.optional(),
-  "authorize-params": stringMapSchema.optional(),
-  "token-extra-headers": stringMapSchema.optional(),
-  "token-auth-method": nonEmptyTrimmedString.refine((value) => value === "body" || value === "basic", {
-    error: 'must be "body" or "basic"'
-  }).optional(),
-  "treat-empty-scope-as-unreported": z.boolean().optional()
-}).passthrough();
-var mcpSourceSchema = z.object({
-  transport: nonEmptyTrimmedString.refine((value) => value === "http", {
-    error: 'must be "http"'
-  }).optional(),
-  url: httpsUrlString,
-  headers: stringMapSchema.optional(),
-  "allowed-tools": nonEmptyStringArraySchema("allowed-tools").optional(),
-  "wrapped-tools": nonEmptyStringArraySchema("wrapped-tools").optional()
-}).passthrough();
-var targetSourceSchema = z.object({
-  type: nonEmptyTrimmedString.refine((value) => PLUGIN_NAME_RE.test(value), {
-    error: "type must be a lowercase target identifier"
-  }),
-  "config-key": nonEmptyTrimmedString,
-  "command-flags": nonEmptyStringArraySchema("command-flags").optional()
-}).passthrough();
-var manifestSourceSchema = z.object({
-  name: z.string().refine((value) => PLUGIN_NAME_RE.test(value), {
-    error: "invalid"
-  }),
-  "display-name": nonEmptyTrimmedString,
-  description: nonEmptyTrimmedString,
-  "config-keys": z.array(z.string(), {
-    error: "must be an array when provided"
-  }).optional(),
-  domains: domainsSchema.optional(),
-  "api-headers": stringMapSchema.optional(),
-  "command-env": stringMapSchema.optional(),
-  credentials: z.record(z.string(), z.unknown(), {
-    error: "must be an object when provided"
-  }).optional(),
-  "runtime-dependencies": z.array(z.unknown(), {
-    error: "must be an array"
-  }).optional(),
-  "runtime-postinstall": z.array(z.unknown(), {
-    error: "must be an array"
-  }).optional(),
-  "env-vars": z.record(z.string(), z.unknown(), {
-    error: "must be an object"
-  }).optional(),
-  mcp: z.record(z.string(), z.unknown(), {
-    error: "must be an object"
-  }).optional(),
-  oauth: z.record(z.string(), z.unknown(), {
-    error: "must be an object"
-  }).optional(),
-  target: z.record(z.string(), z.unknown(), {
-    error: "must be an object"
-  }).optional()
-}).passthrough();
-function setDefined2(target, key, value) {
-  if (value !== void 0) {
-    target[key] = value;
-  }
-}
-function manifestConfigPatch(config) {
-  const result = {};
-  setDefined2(result, "display-name", config.displayName);
-  setDefined2(result, "description", config.description);
-  setDefined2(result, "config-keys", config.configKeys);
-  setDefined2(result, "domains", config.domains);
-  setDefined2(result, "api-headers", config.apiHeaders);
-  setDefined2(result, "command-env", config.commandEnv);
-  setDefined2(result, "env-vars", config.envVars);
-  if (config.credentials !== void 0) {
-    if (!config.credentials) {
-      result.credentials = null;
-    } else {
-      const credentials = {};
-      setDefined2(credentials, "type", config.credentials.type);
-      setDefined2(credentials, "domains", config.credentials.domains);
-      setDefined2(credentials, "api-headers", config.credentials.apiHeaders);
-      setDefined2(
-        credentials,
-        "auth-token-env",
-        config.credentials.authTokenEnv
-      );
-      setDefined2(
-        credentials,
-        "auth-token-placeholder",
-        config.credentials.authTokenPlaceholder
-      );
-      result.credentials = credentials;
-    }
-  }
-  setDefined2(result, "runtime-dependencies", config.runtimeDependencies);
-  setDefined2(result, "runtime-postinstall", config.runtimePostinstall);
-  if (config.mcp !== void 0) {
-    if (!config.mcp) {
-      result.mcp = null;
-    } else {
-      const mcp = {};
-      setDefined2(mcp, "transport", config.mcp.transport);
-      setDefined2(mcp, "url", config.mcp.url);
-      setDefined2(mcp, "headers", config.mcp.headers);
-      setDefined2(mcp, "allowed-tools", config.mcp.allowedTools);
-      setDefined2(mcp, "wrapped-tools", config.mcp.wrappedTools);
-      result.mcp = mcp;
-    }
-  }
-  if (config.oauth !== void 0) {
-    if (!config.oauth) {
-      result.oauth = null;
-    } else {
-      const oauth = {};
-      setDefined2(oauth, "client-id-env", config.oauth.clientIdEnv);
-      setDefined2(oauth, "client-secret-env", config.oauth.clientSecretEnv);
-      setDefined2(oauth, "authorize-endpoint", config.oauth.authorizeEndpoint);
-      setDefined2(oauth, "token-endpoint", config.oauth.tokenEndpoint);
-      setDefined2(oauth, "scope", config.oauth.scope);
-      setDefined2(oauth, "authorize-params", config.oauth.authorizeParams);
-      setDefined2(oauth, "token-auth-method", config.oauth.tokenAuthMethod);
-      setDefined2(oauth, "token-extra-headers", config.oauth.tokenExtraHeaders);
-      setDefined2(
-        oauth,
-        "treat-empty-scope-as-unreported",
-        config.oauth.treatEmptyScopeAsUnreported
-      );
-      result.oauth = oauth;
-    }
-  }
-  if (config.target !== void 0) {
-    if (!config.target) {
-      result.target = null;
-    } else {
-      const target = {};
-      setDefined2(target, "type", config.target.type);
-      setDefined2(target, "config-key", config.target.configKey);
-      setDefined2(target, "command-flags", config.target.commandFlags);
-      result.target = target;
-    }
-  }
-  return result;
-}
-function isPlainRecord(value) {
-  return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-function mergeManifestConfig(base, patch, options = {}) {
-  const merged = { ...base };
-  for (const [key, value] of Object.entries(patch)) {
-    if (options.root && key === "name") {
-      throw new Error("plugins.manifests cannot change plugin names");
-    }
-    if (value === null) {
-      delete merged[key];
-      continue;
-    }
-    const current = merged[key];
-    if (isPlainRecord(current) && isPlainRecord(value)) {
-      merged[key] = mergeManifestConfig(current, value);
-      continue;
-    }
-    merged[key] = value;
-  }
-  return merged;
-}
-function applyManifestConfig(source, config) {
-  const name = source.name;
-  if (typeof name !== "string") {
-    return source;
-  }
-  const manifestConfig = config?.manifests?.[name];
-  if (manifestConfig && "name" in manifestConfig) {
-    throw new Error("plugins.manifests cannot change plugin names");
-  }
-  return manifestConfig ? mergeManifestConfig(source, manifestConfigPatch(manifestConfig), {
-    root: true
-  }) : source;
-}
-function formatPath(path2) {
-  return path2.map((segment) => String(segment)).join(".");
-}
-function issueMessage(error, prefix) {
-  const issue = error.issues[0];
-  if (!issue) {
-    return prefix;
-  }
-  const suffix = formatPath(issue.path);
-  return suffix ? `${prefix}.${suffix} ${issue.message}` : `${prefix} ${issue.message}`;
-}
-function normalizeStringMap(value, prefix, options = {}) {
-  if (!value) {
-    return void 0;
-  }
-  const keys = Object.keys(value);
-  if (keys.length === 0) {
-    return void 0;
-  }
-  for (const key of keys) {
-    const normalizedKey = key.toLowerCase();
-    if (options.reservedKeys?.has(normalizedKey)) {
-      throw new Error(`${prefix}.${key} is reserved by the runtime`);
-    }
-    if (options.forbiddenKeys?.has(normalizedKey)) {
-      throw new Error(`${prefix}.${key} is not allowed`);
-    }
-  }
-  return value;
-}
-function envReferences(value) {
-  return Array.from(value.matchAll(ENV_PLACEHOLDER_RE), (match) => {
-    return match[1];
-  });
-}
-function assertDeclaredEnvReferences(value, envVars, context) {
-  for (const name of envReferences(value)) {
-    if (!Object.prototype.hasOwnProperty.call(envVars, name)) {
-      throw new Error(
-        `${context} references env var ${name} which is not declared in env-vars`
-      );
-    }
-    if (envVars[name]?.default !== void 0) {
-      throw new Error(
-        `${context} references env var ${name}, but API header env vars must not declare defaults`
-      );
-    }
-  }
-}
-function normalizeRequiredApiHeaders(value, prefix, envVars) {
-  const apiHeaders = normalizeStringMap(value, prefix);
-  if (!apiHeaders) {
-    throw new Error(`${prefix} must contain at least one header`);
-  }
-  for (const [key, headerValue] of Object.entries(apiHeaders)) {
-    assertDeclaredEnvReferences(headerValue, envVars, `${prefix}.${key}`);
-  }
-  return apiHeaders;
-}
-function assertCommandEnvReferencesDeclared(value, envVars, context) {
-  for (const name of envReferences(value)) {
-    if (!Object.prototype.hasOwnProperty.call(envVars, name)) {
-      throw new Error(
-        `${context} references env var ${name} which is not declared in env-vars`
-      );
-    }
-  }
-}
-function expandCommandEnvPlaceholders(template, envVars, context) {
-  return template.replace(ENV_PLACEHOLDER_RE, (match, name) => {
-    const varName = name;
-    const declaration = envVars[varName];
-    if (declaration?.default === void 0) {
-      return match;
-    }
-    return expandEnvPlaceholders(match, envVars, context);
-  });
-}
-function normalizeCommandEnv(value, prefix, envVars) {
-  const env = normalizeStringMap(value, prefix);
-  if (!env) {
-    throw new Error(`${prefix} must contain at least one env var`);
-  }
-  for (const [key, envValue] of Object.entries(env)) {
-    if (!ENV_VAR_NAME_RE.test(key)) {
-      throw new Error(`${prefix}.${key} must be an uppercase env var name`);
-    }
-    assertCommandEnvReferencesDeclared(envValue, envVars, `${prefix}.${key}`);
-  }
-  return Object.fromEntries(
-    Object.entries(env).map(([key, envValue]) => [
-      key,
-      expandCommandEnvPlaceholders(envValue, envVars, `${prefix}.${key}`)
-    ])
-  );
-}
-function assertCommandEnvDoesNotExposeHostSecretRefs(commandEnv, apiHeaders, credentials, oauth, pluginName) {
-  if (!commandEnv) {
-    return;
-  }
-  const hostOnlyRefs = /* @__PURE__ */ new Set();
-  for (const value of Object.values(apiHeaders ?? {})) {
-    for (const name of envReferences(value)) {
-      hostOnlyRefs.add(name);
-    }
-  }
-  if (credentials) {
-    if (credentials.authTokenEnv) {
-      hostOnlyRefs.add(credentials.authTokenEnv);
-    }
-  }
-  if (oauth) {
-    hostOnlyRefs.add(oauth.clientIdEnv);
-    hostOnlyRefs.add(oauth.clientSecretEnv);
-  }
-  for (const [key, value] of Object.entries(commandEnv)) {
-    for (const name of envReferences(value)) {
-      if (hostOnlyRefs.has(name)) {
-        throw new Error(
-          `Plugin ${pluginName} command-env.${key} references env var ${name}, but credential/API header env vars must stay host-only`
-        );
-      }
-    }
-  }
-}
-function assertCommandEnvHostRefsAreExplicitlyExposed(commandEnv, envVars, pluginName) {
-  if (!commandEnv) {
-    return;
-  }
-  for (const [key, value] of Object.entries(commandEnv)) {
-    for (const name of envReferences(value)) {
-      const declaration = envVars[name];
-      if (declaration && declaration.default === void 0 && declaration.exposeToCommandEnv !== true) {
-        throw new Error(
-          `Plugin ${pluginName} command-env.${key} references env var ${name}, but env-vars.${name} must set expose-to-command-env: true before host env can be exposed to sandbox`
-        );
-      }
-    }
-  }
-}
-function normalizeCredentials(data, name) {
-  if (data.type !== "oauth-bearer") {
-    throw new Error(
-      `Plugin ${name} has unsupported credentials.type: "${String(data.type)}"`
-    );
-  }
-  const result = oauthBearerCredentialsSchema.safeParse(data);
-  if (!result.success) {
-    throw new Error(issueMessage(result.error, `Plugin ${name} credentials`));
-  }
-  if (!result.data.domains) {
-    throw new Error(`Plugin ${name} credentials requires domains`);
-  }
-  const domains = result.data.domains;
-  const apiHeaders = result.data["api-headers"] ? normalizeStringMap(
-    result.data["api-headers"],
-    `Plugin ${name} credentials.api-headers`,
-    { forbiddenKeys: FORBIDDEN_API_HEADER_NAMES }
-  ) : void 0;
-  return {
-    type: "oauth-bearer",
-    domains,
-    ...apiHeaders ? { apiHeaders } : void 0,
-    authTokenEnv: result.data["auth-token-env"],
-    ...result.data["auth-token-placeholder"] ? { authTokenPlaceholder: result.data["auth-token-placeholder"] } : void 0
-  };
-}
-function normalizeRuntimeDependencies(entries, name) {
-  const parsed = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const entry of entries) {
-    const result = runtimeDependencyEntrySchema.safeParse(entry);
-    if (!result.success) {
-      throw new Error(
-        issueMessage(
-          result.error,
-          `Plugin ${name} runtime-dependencies entries`
-        )
-      );
-    }
-    const record = result.data;
-    const packageName = typeof record.package === "string" ? record.package.trim() : "";
-    const packageUrl = typeof record.url === "string" ? record.url.trim() : "";
-    const version = record.version;
-    const sha256 = record.sha256;
-    if (record.type === "npm") {
-      if (!packageName) {
-        throw new Error(
-          `Plugin ${name} runtime dependency package must be a non-empty string`
-        );
-      }
-      if (record.url !== void 0 || sha256 !== void 0) {
-        throw new Error(
-          `Plugin ${name} npm runtime dependencies must only include package/version fields`
-        );
-      }
-      const normalizedVersion = typeof version === "string" ? version.trim() : "latest";
-      if (!normalizedVersion) {
-        throw new Error(
-          `Plugin ${name} runtime dependency version must be a non-empty string when provided`
-        );
-      }
-      const dedupeKey2 = `${record.type}:${packageName}:${normalizedVersion}`;
-      if (seen.has(dedupeKey2)) {
-        continue;
-      }
-      seen.add(dedupeKey2);
-      parsed.push({
-        type: "npm",
-        package: packageName,
-        version: normalizedVersion
-      });
-      continue;
-    }
-    if (version !== void 0) {
-      throw new Error(
-        `Plugin ${name} system runtime dependencies must not include a version`
-      );
-    }
-    if (packageName && packageUrl) {
-      throw new Error(
-        `Plugin ${name} system runtime dependencies must specify either package or url, not both`
-      );
-    }
-    if (!packageName && !packageUrl) {
-      throw new Error(
-        `Plugin ${name} system runtime dependencies must specify package or url`
-      );
-    }
-    if (packageName) {
-      if (sha256 !== void 0) {
-        throw new Error(
-          `Plugin ${name} system runtime dependency package entries must not include sha256`
-        );
-      }
-      const dedupeKey2 = `${record.type}:package:${packageName}`;
-      if (seen.has(dedupeKey2)) {
-        continue;
-      }
-      seen.add(dedupeKey2);
-      parsed.push({
-        type: "system",
-        package: packageName
-      });
-      continue;
-    }
-    if (!/^https:\/\//i.test(packageUrl)) {
-      throw new Error(
-        `Plugin ${name} system runtime dependency url must be an https URL`
-      );
-    }
-    const normalizedSha256 = typeof sha256 === "string" ? sha256.trim().toLowerCase() : "";
-    if (!/^[a-f0-9]{64}$/.test(normalizedSha256)) {
-      throw new Error(
-        `Plugin ${name} system runtime dependency url entries must include a valid sha256`
-      );
-    }
-    const dedupeKey = `${record.type}:url:${packageUrl}:${normalizedSha256}`;
-    if (seen.has(dedupeKey)) {
-      continue;
-    }
-    seen.add(dedupeKey);
-    parsed.push({
-      type: "system",
-      url: packageUrl,
-      sha256: normalizedSha256
-    });
-  }
-  return parsed.length > 0 ? parsed : void 0;
-}
-function normalizeRuntimePostinstall(commands, name) {
-  const parsed = [];
-  for (const command of commands) {
-    const result = runtimePostinstallCommandSourceSchema.safeParse(command);
-    if (!result.success) {
-      throw new Error(
-        issueMessage(result.error, `Plugin ${name} runtime-postinstall`)
-      );
-    }
-    if (!RUNTIME_POSTINSTALL_CMD_RE.test(result.data.cmd)) {
-      throw new Error(
-        `Plugin ${name} runtime-postinstall cmd must be a single executable token (letters, digits, ., _, /, -)`
-      );
-    }
-    const normalizedArgs = result.data.args?.map((arg) => arg.trim()).filter((arg) => arg.length > 0);
-    parsed.push({
-      cmd: result.data.cmd,
-      ...normalizedArgs && normalizedArgs.length > 0 ? { args: normalizedArgs } : void 0,
-      ...typeof result.data.sudo === "boolean" ? { sudo: result.data.sudo } : void 0
-    });
-  }
-  return parsed.length > 0 ? parsed : void 0;
-}
-var envVarDeclarationSchema = z.preprocess(
-  (value) => value === null || value === void 0 ? {} : value,
-  z.object({
-    default: z.string().optional(),
-    "expose-to-command-env": z.boolean().optional(),
-    exposeToCommandEnv: z.boolean().optional()
-  }).strict()
-);
-function normalizeEnvVars(data, pluginName) {
-  const normalized = {};
-  for (const [rawName, rawDecl] of Object.entries(data)) {
-    const name = rawName.trim();
-    if (!ENV_VAR_NAME_RE.test(name)) {
-      throw new Error(
-        `Plugin ${pluginName} env-vars key "${rawName}" must match [A-Z_][A-Z0-9_]*`
-      );
-    }
-    const parsed = envVarDeclarationSchema.safeParse(rawDecl);
-    if (!parsed.success) {
-      throw new Error(
-        issueMessage(parsed.error, `Plugin ${pluginName} env-vars.${name}`)
-      );
-    }
-    const decl = {};
-    if (parsed.data.default !== void 0) {
-      decl.default = parsed.data.default;
-    }
-    if (parsed.data["expose-to-command-env"] === true || parsed.data.exposeToCommandEnv === true) {
-      decl.exposeToCommandEnv = true;
-    }
-    normalized[name] = decl;
-  }
-  return normalized;
-}
-function expandEnvPlaceholders(template, envVars, context) {
-  return template.replace(ENV_PLACEHOLDER_RE, (_match, name) => {
-    const varName = name;
-    if (!Object.prototype.hasOwnProperty.call(envVars, varName)) {
-      throw new Error(
-        `${context} references env var ${varName} which is not declared in env-vars`
-      );
-    }
-    const decl = envVars[varName];
-    const fromProcess = process.env[varName];
-    if (fromProcess !== void 0 && fromProcess !== "") {
-      return fromProcess;
-    }
-    if (decl.default !== void 0) {
-      return decl.default;
-    }
-    throw new Error(
-      `${context} env var ${varName} is unset and has no default in env-vars`
-    );
-  });
-}
-function normalizeMcp(data, envVars, name) {
-  const prepared = { ...data };
-  if (typeof prepared.url === "string") {
-    prepared.url = expandEnvPlaceholders(
-      prepared.url,
-      envVars,
-      `Plugin ${name} mcp.url`
-    );
-  }
-  const result = mcpSourceSchema.safeParse(prepared);
-  if (!result.success) {
-    throw new Error(issueMessage(result.error, `Plugin ${name} mcp`));
-  }
-  const headers = result.data.headers ? normalizeStringMap(result.data.headers, `Plugin ${name} mcp.headers`, {
-    forbiddenKeys: FORBIDDEN_API_HEADER_NAMES
-  }) : void 0;
-  return {
-    transport: "http",
-    url: result.data.url,
-    ...headers ? { headers } : void 0,
-    ...result.data["allowed-tools"] ? { allowedTools: result.data["allowed-tools"] } : void 0,
-    ...result.data["wrapped-tools"] ? { wrappedTools: result.data["wrapped-tools"] } : void 0
-  };
-}
-function parseManifestSource(parsedSource, dir, config, options) {
-  const source = applyManifestConfig(parsedSource, config);
-  const sourceResult = manifestSourceSchema.safeParse(source);
-  if (!sourceResult.success) {
-    const issue = sourceResult.error.issues[0];
-    const path2 = formatPath(issue?.path ?? []);
-    if (path2 === "name") {
-      throw new Error(`Invalid plugin name in ${dir}: "${parsedSource.name}"`);
-    }
-    if (path2 === "description") {
-      throw new Error(`Invalid plugin description in ${dir}`);
-    }
-    if (path2 === "config-keys") {
-      throw new Error(
-        `Plugin ${String(parsedSource.name ?? "unknown")} config-keys must be an array when provided`
-      );
-    }
-    if (path2 === "domains") {
-      throw new Error(
-        `Plugin ${String(parsedSource.name ?? "unknown")} ${path2} must be a non-empty array of domains`
-      );
-    }
-    if (path2 === "api-headers") {
-      throw new Error(
-        `Plugin ${String(parsedSource.name ?? "unknown")} api-headers must be an object when provided`
-      );
-    }
-    if (path2 === "command-env") {
-      throw new Error(
-        `Plugin ${String(parsedSource.name ?? "unknown")} command-env must be an object when provided`
-      );
-    }
-    if (path2 === "credentials") {
-      throw new Error(
-        `Plugin ${String(parsedSource.name ?? "unknown")} credentials must be an object when provided`
-      );
-    }
-    if (path2 === "runtime-dependencies") {
-      throw new Error(
-        `Plugin ${String(parsedSource.name ?? "unknown")} runtime-dependencies must be an array`
-      );
-    }
-    if (path2 === "runtime-postinstall") {
-      throw new Error(
-        `Plugin ${String(parsedSource.name ?? "unknown")} runtime-postinstall must be an array`
-      );
-    }
-    if (path2 === "env-vars") {
-      throw new Error(
-        `Plugin ${String(parsedSource.name ?? "unknown")} env-vars must be an object`
-      );
-    }
-    if (path2 === "mcp") {
-      throw new Error(
-        `Plugin ${String(parsedSource.name ?? "unknown")} mcp must be an object`
-      );
-    }
-    if (path2 === "oauth") {
-      throw new Error(
-        `Plugin ${String(parsedSource.name ?? "unknown")} oauth must be an object`
-      );
-    }
-    if (path2 === "target") {
-      throw new Error(
-        `Plugin ${String(parsedSource.name ?? "unknown")} target must be an object`
-      );
-    }
-    throw new Error(issue?.message ?? `Invalid plugin manifest in ${dir}`);
-  }
-  const data = sourceResult.data;
-  const configKeys = (data["config-keys"] ?? []).map((key) => {
-    if (!SHORT_CONFIG_KEY_RE.test(key)) {
-      throw new Error(`Invalid config key "${key}" in plugin ${data.name}`);
-    }
-    return `${data.name}.${key}`;
-  });
-  const envVars = data["env-vars"] ? normalizeEnvVars(data["env-vars"], data.name) : {};
-  const apiHeaders = data["api-headers"] ? normalizeRequiredApiHeaders(
-    data["api-headers"],
-    `Plugin ${data.name} api-headers`,
-    envVars
-  ) : void 0;
-  const domains = data.domains;
-  if (apiHeaders && !domains) {
-    throw new Error(`Plugin ${data.name} api-headers requires domains`);
-  }
-  if (domains && !apiHeaders && !data.credentials && options?.allowHookManagedEgress !== true) {
-    throw new Error(
-      `Plugin ${data.name} domains requires credentials or api-headers`
-    );
-  }
-  const commandEnv = data["command-env"] ? normalizeCommandEnv(
-    data["command-env"],
-    `Plugin ${data.name} command-env`,
-    envVars
-  ) : void 0;
-  const credentials = data.credentials ? normalizeCredentials(data.credentials, data.name) : void 0;
-  const runtimeDependencies = data["runtime-dependencies"] ? normalizeRuntimeDependencies(data["runtime-dependencies"], data.name) : void 0;
-  const runtimePostinstall = data["runtime-postinstall"] ? normalizeRuntimePostinstall(data["runtime-postinstall"], data.name) : void 0;
-  const mcp = data.mcp ? normalizeMcp(data.mcp, envVars, data.name) : void 0;
-  const manifest = {
-    name: data.name,
-    displayName: data["display-name"],
-    description: data.description,
-    configKeys,
-    ...domains ? { domains } : void 0,
-    ...apiHeaders ? { apiHeaders } : void 0,
-    ...commandEnv ? { commandEnv } : void 0,
-    ...Object.keys(envVars).length > 0 ? { envVars } : void 0,
-    ...credentials ? { credentials } : void 0,
-    ...runtimeDependencies ? { runtimeDependencies } : void 0,
-    ...runtimePostinstall ? { runtimePostinstall } : void 0,
-    ...mcp ? { mcp } : void 0
-  };
-  if (data.oauth) {
-    if (!credentials && options?.allowHookManagedEgress !== true) {
-      throw new Error(`Plugin ${data.name} oauth requires credentials`);
-    }
-    const result = oauthSourceSchema.safeParse(data.oauth);
-    if (!result.success) {
-      throw new Error(issueMessage(result.error, `Plugin ${data.name} oauth`));
-    }
-    const authorizeParams = result.data["authorize-params"] ? normalizeStringMap(
-      result.data["authorize-params"],
-      `Plugin ${data.name} oauth.authorize-params`,
-      {
-        reservedKeys: RESERVED_AUTHORIZE_PARAM_KEYS
-      }
-    ) : void 0;
-    const tokenExtraHeaders = result.data["token-extra-headers"] ? normalizeStringMap(
-      result.data["token-extra-headers"],
-      `Plugin ${data.name} oauth.token-extra-headers`,
-      {
-        forbiddenKeys: FORBIDDEN_TOKEN_HEADER_NAMES
-      }
-    ) : void 0;
-    manifest.oauth = {
-      clientIdEnv: result.data["client-id-env"],
-      clientSecretEnv: result.data["client-secret-env"],
-      authorizeEndpoint: result.data["authorize-endpoint"],
-      tokenEndpoint: result.data["token-endpoint"],
-      ...result.data.scope ? { scope: result.data.scope } : void 0,
-      ...authorizeParams ? { authorizeParams } : void 0,
-      ...result.data["token-auth-method"] ? { tokenAuthMethod: result.data["token-auth-method"] } : void 0,
-      ...tokenExtraHeaders ? { tokenExtraHeaders } : void 0,
-      ...result.data["treat-empty-scope-as-unreported"] ? { treatEmptyScopeAsUnreported: true } : void 0
-    };
-  }
-  assertCommandEnvDoesNotExposeHostSecretRefs(
-    data["command-env"],
-    apiHeaders,
-    credentials,
-    manifest.oauth,
-    data.name
-  );
-  assertCommandEnvHostRefsAreExplicitlyExposed(
-    data["command-env"],
-    envVars,
-    data.name
-  );
-  if (data.target) {
-    const result = targetSourceSchema.safeParse(data.target);
-    if (!result.success) {
-      throw new Error(issueMessage(result.error, `Plugin ${data.name} target`));
-    }
-    if (!SHORT_CONFIG_KEY_RE.test(result.data["config-key"])) {
-      throw new Error(
-        `Plugin ${data.name} target.config-key "${result.data["config-key"]}" is invalid`
-      );
-    }
-    const qualifiedKey = `${data.name}.${result.data["config-key"]}`;
-    if (!configKeys.includes(qualifiedKey)) {
-      throw new Error(
-        `Plugin ${data.name} target.config-key "${result.data["config-key"]}" must be listed in config-keys`
-      );
-    }
-    const commandFlags = result.data["command-flags"];
-    if (commandFlags && commandFlags.some((flag) => !TARGET_FLAG_RE.test(flag))) {
-      throw new Error(
-        `Plugin ${data.name} target.command-flags must contain CLI flags like --repo or -R`
-      );
-    }
-    manifest.target = {
-      type: result.data.type,
-      configKey: qualifiedKey,
-      ...commandFlags ? { commandFlags } : void 0
-    };
-  }
-  return manifest;
-}
-function parsePluginManifest(raw, dir, config) {
-  let parsedYaml;
-  try {
-    parsedYaml = parseYaml(raw);
-  } catch (error) {
-    throw new Error(
-      `Invalid plugin manifest in ${dir}: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-  if (!parsedYaml || typeof parsedYaml !== "object" || Array.isArray(parsedYaml)) {
-    throw new Error(`Invalid plugin manifest in ${dir}: expected an object`);
-  }
-  return parseManifestSource(parsedYaml, dir, config);
-}
-function parseInlinePluginManifest(manifest, dir, config) {
-  return parseManifestSource(inlineManifestSource(manifest), dir, config, {
-    allowHookManagedEgress: true
-  });
-}
-
-// src/chat/plugins/registry.ts
-import { readFileSync, readdirSync, statSync } from "fs";
-import path from "path";
-
-// src/chat/plugins/auth/oauth-bearer-broker.ts
-import { randomUUID as randomUUID2 } from "crypto";
-
-// src/chat/credentials/broker.ts
-var CredentialUnavailableError = class extends Error {
-  provider;
-  constructor(provider, message) {
-    super(message);
-    this.name = "CredentialUnavailableError";
-    this.provider = provider;
-  }
-};
-
-// src/chat/credentials/header-transforms.ts
-function mergeHeaderTransforms(transforms) {
-  const byDomain = /* @__PURE__ */ new Map();
-  for (const transform of transforms) {
-    byDomain.set(transform.domain, {
-      ...byDomain.get(transform.domain) ?? {},
-      ...transform.headers
-    });
-  }
-  return [...byDomain.entries()].map(([domain, headers]) => ({
-    domain,
-    headers
-  }));
-}
-
-// src/chat/credentials/oauth-scope.ts
-function parseScope(scope) {
-  if (!scope) {
-    return [];
-  }
-  return [...new Set(scope.split(/\s+/).filter(Boolean))].sort();
-}
-function normalizeOAuthScope(scope) {
-  const parsed = parseScope(scope);
-  return parsed.length > 0 ? parsed.join(" ") : void 0;
-}
-function hasRequiredOAuthScope(storedScope, requiredScope) {
-  const required = parseScope(requiredScope);
-  if (required.length === 0) {
-    return true;
-  }
-  const stored = new Set(parseScope(storedScope));
-  if (stored.size === 0) {
-    return false;
-  }
-  return required.every((scope) => stored.has(scope));
-}
-
-// src/chat/oauth-response.ts
-var MAX_OAUTH_ERROR_BODY_BYTES = 16 * 1024;
-var MAX_OAUTH_ERROR_BODY_READS = MAX_OAUTH_ERROR_BODY_BYTES;
-var MAX_OAUTH_ERROR_BODY_READ_MS = 5e3;
-var OAUTH_ERROR_BODY_READ_TIMEOUT = /* @__PURE__ */ Symbol("oauth-error-body-read-timeout");
-async function readOAuthErrorBodyChunk(reader) {
-  let timeout;
-  const timeoutResult = new Promise(
-    (resolve) => {
-      timeout = setTimeout(
-        resolve,
-        MAX_OAUTH_ERROR_BODY_READ_MS,
-        OAUTH_ERROR_BODY_READ_TIMEOUT
-      );
-    }
-  );
-  try {
-    const result = await Promise.race([reader.read(), timeoutResult]);
-    if (result === OAUTH_ERROR_BODY_READ_TIMEOUT) {
-      await reader.cancel();
-      throw new Error("OAuth error body read timed out");
-    }
-    return result;
-  } finally {
-    if (timeout) {
-      clearTimeout(timeout);
-    }
-  }
-}
-var OAuthProviderError = class extends Error {
-  phase;
-  provider;
-  resourceHost;
-  status;
-  constructor(details) {
-    super(`OAuth provider ${details.phase.replace("_", " ")} failed`);
-    this.name = "OAuthProviderError";
-    this.phase = details.phase;
-    this.provider = details.provider;
-    this.resourceHost = details.resourceHost;
-    this.status = details.status;
-  }
-};
-function getOAuthProviderErrorAttributes(error) {
-  if (!(error instanceof OAuthProviderError)) {
-    return {};
-  }
-  return {
-    "app.credential.provider": error.provider,
-    "app.oauth.error.phase": error.phase,
-    "server.address": error.resourceHost,
-    ...error.status !== void 0 ? { "http.response.status_code": error.status } : void 0
-  };
-}
-async function readBoundedOAuthErrorBody(response) {
-  if (!response.body) {
-    return "";
-  }
-  const reader = response.body.getReader();
-  const decoder = new TextDecoder();
-  let bytesRead = 0;
-  let reads = 0;
-  let text = "";
-  try {
-    while (bytesRead < MAX_OAUTH_ERROR_BODY_BYTES && reads < MAX_OAUTH_ERROR_BODY_READS) {
-      reads += 1;
-      const { done, value } = await readOAuthErrorBodyChunk(reader);
-      if (done) {
-        return text + decoder.decode();
-      }
-      const remaining = MAX_OAUTH_ERROR_BODY_BYTES - bytesRead;
-      const chunk = value.subarray(0, remaining);
-      bytesRead += chunk.byteLength;
-      text += decoder.decode(chunk, { stream: true });
-      if (chunk.byteLength < value.byteLength) {
-        await reader.cancel();
-        return text + decoder.decode();
-      }
-    }
-    await reader.cancel();
-    return text + decoder.decode();
-  } finally {
-    reader.releaseLock();
-  }
-}
-function fetchWithBoundedOAuthErrorBodies(fetchFn = globalThis.fetch, onErrorResponseStatus) {
-  return (async (input, init) => {
-    const response = await fetchFn(input, init);
-    if (response.ok) {
-      return response;
-    }
-    onErrorResponseStatus?.(response.status);
-    if (!response.body) {
-      return response;
-    }
-    let body = "";
-    try {
-      body = await readBoundedOAuthErrorBody(response);
-    } catch {
-      await response.body.cancel().catch(() => void 0);
-    }
-    return new Response(body, {
-      headers: response.headers,
-      status: response.status,
-      statusText: response.statusText
-    });
-  });
-}
-
-// src/chat/plugins/command-env.ts
-var ENV_PLACEHOLDER_RE2 = /\$\{([A-Z_][A-Z0-9_]*)\}/g;
-function resolveValue(manifest, value) {
-  let missing = false;
-  const resolved = value.replace(ENV_PLACEHOLDER_RE2, (match, name) => {
-    const envName = name;
-    const declaration = manifest.envVars?.[envName];
-    if (!declaration || declaration.default !== void 0) {
-      return match;
-    }
-    const hostValue = process.env[envName];
-    if (hostValue === void 0 || hostValue === "") {
-      missing = true;
-      return "";
-    }
-    return hostValue;
-  });
-  return missing ? void 0 : resolved;
-}
-function resolvePluginCommandEnv(manifest) {
-  const env = {};
-  for (const [key, value] of Object.entries(manifest.commandEnv ?? {})) {
-    const resolved = resolveValue(manifest, value);
-    if (resolved === void 0) {
-      continue;
-    }
-    env[key] = resolved;
-  }
-  return env;
-}
-
-// src/chat/plugins/auth/auth-token-placeholder.ts
-var DEFAULT_PLACEHOLDERS = {
-  "oauth-bearer": "host_managed_credential"
-};
-function resolveAuthTokenPlaceholder(credentials) {
-  return credentials.authTokenPlaceholder?.trim() || DEFAULT_PLACEHOLDERS[credentials.type];
-}
-
-// src/chat/plugins/auth/api-headers-broker.ts
-import { randomUUID } from "crypto";
-var MAX_LEASE_MS = 60 * 60 * 1e3;
-var ENV_PLACEHOLDER_RE3 = /\$\{([A-Z_][A-Z0-9_]*)\}/g;
-function resolveHeaders(provider, headers) {
-  return Object.fromEntries(
-    Object.entries(headers).map(([key, value]) => {
-      const resolved = value.replace(ENV_PLACEHOLDER_RE3, (_match, name) => {
-        const envName = name;
-        const envValue = process.env[envName]?.trim();
-        if (!envValue) {
-          throw new Error(
-            `Missing ${envName} for API header provider "${provider}"`
-          );
-        }
-        return envValue;
-      });
-      return [key, resolved];
-    })
-  );
-}
-function resolveApiHeaderTransforms(manifest) {
-  const { domains, apiHeaders } = manifest;
-  if (!domains || !apiHeaders) {
-    return [];
-  }
-  const resolvedHeaders = resolveHeaders(manifest.name, apiHeaders);
-  return domains.map((domain) => ({
-    domain,
-    headers: resolvedHeaders
-  }));
-}
-function createApiHeadersBroker(manifest) {
-  const provider = manifest.name;
-  return {
-    async issue(input) {
-      const headerTransforms = resolveApiHeaderTransforms(manifest);
-      if (headerTransforms.length === 0) {
-        throw new Error(`No API headers configured for plugin "${provider}"`);
-      }
-      return {
-        id: randomUUID(),
-        provider,
-        env: resolvePluginCommandEnv(manifest),
-        headerTransforms,
-        expiresAt: new Date(Date.now() + MAX_LEASE_MS).toISOString(),
-        metadata: {
-          reason: input.reason
-        }
-      };
-    }
-  };
-}
-
-// src/chat/plugins/auth/oauth-request.ts
-import { z as z2 } from "zod";
-var DEFAULT_TOKEN_CONTENT_TYPE = "application/x-www-form-urlencoded";
-function requireNonEmptyTokenField(data, field) {
-  const value = data[field];
-  if (typeof value !== "string" || !value.trim()) {
-    throw new Error(`OAuth token response missing ${field}`);
-  }
-  return value;
-}
-function requireTokenResponseObject(data) {
-  if (!data || typeof data !== "object" || Array.isArray(data)) {
-    throw new Error("OAuth token response must be an object");
-  }
-  return data;
-}
-var parsedOAuthTokenResponseSchema = z2.object({
-  accessToken: z2.string().min(1),
-  refreshToken: z2.string().min(1),
-  expiresAt: z2.number().positive().optional(),
-  refreshTokenExpiresAt: z2.number().positive().optional(),
-  scope: z2.string().min(1).optional()
-}).strict();
-function contentTypeToBody(contentType, payload) {
-  const mediaType = contentType.split(";", 1)[0]?.trim().toLowerCase();
-  if (!mediaType || mediaType === DEFAULT_TOKEN_CONTENT_TYPE) {
-    return new URLSearchParams(payload);
-  }
-  if (mediaType === "application/json" || mediaType.endsWith("+json")) {
-    return JSON.stringify(payload);
-  }
-  throw new Error(`Unsupported OAuth token Content-Type: ${contentType}`);
-}
-function buildOAuthTokenRequest(input) {
-  const headers = new Headers({ Accept: "application/json" });
-  for (const [name, value] of Object.entries(input.tokenExtraHeaders ?? {})) {
-    headers.set(name, value);
-  }
-  if (!headers.has("Content-Type")) {
-    headers.set("Content-Type", DEFAULT_TOKEN_CONTENT_TYPE);
-  }
-  const payload = { ...input.payload };
-  if (input.tokenAuthMethod === "basic") {
-    headers.set(
-      "Authorization",
-      `Basic ${Buffer.from(`${input.clientId}:${input.clientSecret}`).toString("base64")}`
-    );
-  } else {
-    payload.client_id = input.clientId;
-    payload.client_secret = input.clientSecret;
-  }
-  const contentType = headers.get("Content-Type") ?? DEFAULT_TOKEN_CONTENT_TYPE;
-  const serializedHeaders = {};
-  headers.forEach((value, key) => {
-    serializedHeaders[key] = value;
-  });
-  return {
-    headers: serializedHeaders,
-    body: contentTypeToBody(contentType, payload)
-  };
-}
-function parseOAuthTokenResponse(data, requestedScope, options) {
-  const response = requireTokenResponseObject(data);
-  const accessToken = requireNonEmptyTokenField(response, "access_token");
-  const resolvedRefreshToken = response.refresh_token === void 0 ? options?.refreshToken : requireNonEmptyTokenField(response, "refresh_token");
-  if (!resolvedRefreshToken) {
-    throw new Error("OAuth token response missing refresh_token");
-  }
-  const expiresIn = response.expires_in;
-  const refreshTokenExpiresIn = response.refresh_token_expires_in;
-  const responseScope = response.scope;
-  let scope;
-  if (responseScope !== void 0) {
-    if (typeof responseScope !== "string") {
-      throw new Error("OAuth token response returned invalid scope");
-    }
-    const normalized = normalizeOAuthScope(responseScope);
-    if (normalized !== void 0) {
-      scope = normalized;
-    } else if (options?.treatEmptyScopeAsUnreported) {
-      scope = normalizeOAuthScope(requestedScope);
-    } else {
-      throw new Error("OAuth token response returned empty scope");
-    }
-  } else {
-    scope = normalizeOAuthScope(requestedScope);
-  }
-  const result = {
-    accessToken,
-    refreshToken: resolvedRefreshToken,
-    ...scope ? { scope } : void 0
-  };
-  if (expiresIn !== void 0) {
-    if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || expiresIn <= 0) {
-      throw new Error("OAuth token response returned invalid expires_in");
-    }
-    result.expiresAt = Date.now() + expiresIn * 1e3;
-  }
-  if (refreshTokenExpiresIn !== void 0) {
-    if (typeof refreshTokenExpiresIn !== "number" || !Number.isFinite(refreshTokenExpiresIn) || refreshTokenExpiresIn <= 0) {
-      throw new Error(
-        "OAuth token response returned invalid refresh_token_expires_in"
-      );
-    }
-    result.refreshTokenExpiresAt = Date.now() + refreshTokenExpiresIn * 1e3;
-  }
-  return parsedOAuthTokenResponseSchema.parse(result);
-}
-
-// src/chat/plugins/auth/oauth-bearer-broker.ts
-var MAX_LEASE_MS2 = 60 * 60 * 1e3;
-var REFRESH_BUFFER_MS = 5 * 60 * 1e3;
-var TOKEN_REFRESH_TIMEOUT_MS = 2e4;
-var OAuthRefreshRejectedError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "OAuthRefreshRejectedError";
-  }
-};
-function parseRefreshError(text) {
-  if (!text.trim()) {
-    return void 0;
-  }
-  try {
-    const parsed = JSON.parse(text);
-    return parsed && typeof parsed === "object" && !Array.isArray(parsed) && typeof parsed.error === "string" ? parsed.error : void 0;
-  } catch {
-    return void 0;
-  }
-}
-async function refreshAccessToken(provider, refreshToken, oauth, requestedScope) {
-  const clientId = process.env[oauth.clientIdEnv]?.trim();
-  const clientSecret = process.env[oauth.clientSecretEnv]?.trim();
-  if (!clientId || !clientSecret) {
-    throw new Error(
-      `Missing ${oauth.clientIdEnv} or ${oauth.clientSecretEnv} for token refresh`
-    );
-  }
-  const request = buildOAuthTokenRequest({
-    clientId,
-    clientSecret,
-    payload: {
-      grant_type: "refresh_token",
-      refresh_token: refreshToken
-    },
-    tokenAuthMethod: oauth.tokenAuthMethod,
-    tokenExtraHeaders: oauth.tokenExtraHeaders
-  });
-  const errorDetails = {
-    phase: "token_refresh",
-    provider,
-    resourceHost: new URL(oauth.tokenEndpoint).hostname
-  };
-  let response;
-  try {
-    response = await fetch(oauth.tokenEndpoint, {
-      method: "POST",
-      headers: request.headers,
-      body: request.body,
-      signal: AbortSignal.timeout(TOKEN_REFRESH_TIMEOUT_MS)
-    });
-  } catch {
-    throw new OAuthProviderError(errorDetails);
-  }
-  if (!response.ok) {
-    let errorCode;
-    try {
-      errorCode = parseRefreshError(await readBoundedOAuthErrorBody(response));
-    } catch {
-      throw new OAuthProviderError({
-        ...errorDetails,
-        status: response.status
-      });
-    }
-    if (errorCode === "invalid_grant" || errorCode === "bad_refresh_token") {
-      throw new OAuthRefreshRejectedError("Token refresh was rejected");
-    }
-    throw new OAuthProviderError({
-      ...errorDetails,
-      status: response.status
-    });
-  }
-  try {
-    const data = await response.json();
-    return parseOAuthTokenResponse(data, requestedScope, {
-      treatEmptyScopeAsUnreported: oauth.treatEmptyScopeAsUnreported,
-      refreshToken
-    });
-  } catch {
-    throw new OAuthProviderError(errorDetails);
-  }
-}
-function getLeaseExpiry(expiresAt) {
-  return expiresAt ? Math.min(expiresAt, Date.now() + MAX_LEASE_MS2) : Date.now() + MAX_LEASE_MS2;
-}
-function canUseStoredToken(stored) {
-  return stored !== void 0 && (stored.expiresAt === void 0 || stored.expiresAt > Date.now());
-}
-function shouldRefreshStoredToken(stored) {
-  return stored !== void 0 && stored.expiresAt !== void 0 && stored.expiresAt - Date.now() < REFRESH_BUFFER_MS;
-}
-function createOAuthBearerBroker(manifest, credentials, deps) {
-  const provider = manifest.name;
-  const { domains, apiHeaders, authTokenEnv } = credentials;
-  const authTokenPlaceholder = resolveAuthTokenPlaceholder(credentials);
-  const pluginHeaderTransforms = () => resolveApiHeaderTransforms(manifest);
-  function buildLease(token, expiresAtMs, reason) {
-    return {
-      id: randomUUID2(),
-      provider,
-      env: {
-        ...resolvePluginCommandEnv(manifest),
-        [authTokenEnv]: authTokenPlaceholder
-      },
-      headerTransforms: mergeHeaderTransforms([
-        ...pluginHeaderTransforms(),
-        ...domains.map((domain) => ({
-          domain,
-          headers: { ...apiHeaders ?? {}, Authorization: `Bearer ${token}` }
-        }))
-      ]),
-      expiresAt: new Date(expiresAtMs).toISOString(),
-      metadata: { reason }
-    };
-  }
-  return {
-    async issue(input) {
-      const envToken = process.env[authTokenEnv]?.trim();
-      const oauth = manifest.oauth;
-      const userSubjectId = credentialUserSubjectId(input.context);
-      if (!oauth) {
-        if (envToken) {
-          return buildLease(envToken, Date.now() + MAX_LEASE_MS2, input.reason);
-        }
-        throw new CredentialUnavailableError(
-          provider,
-          `No ${provider} credentials available.`
-        );
-      }
-      if (userSubjectId) {
-        const stored = await deps.userTokenStore.get(userSubjectId, provider);
-        if (stored) {
-          if (!hasRequiredOAuthScope(stored.scope, oauth.scope)) {
-            throw new CredentialUnavailableError(
-              provider,
-              `Your ${provider} connection needs to be reauthorized.`
-            );
-          }
-          if (shouldRefreshStoredToken(stored)) {
-            try {
-              return await deps.userTokenStore.withRefresh(
-                userSubjectId,
-                provider,
-                async () => {
-                  const latest = await deps.userTokenStore.get(
-                    userSubjectId,
-                    provider
-                  );
-                  if (latest && !hasRequiredOAuthScope(latest.scope, oauth.scope)) {
-                    throw new CredentialUnavailableError(
-                      provider,
-                      `Your ${provider} connection needs to be reauthorized.`
-                    );
-                  }
-                  if (!shouldRefreshStoredToken(latest) && canUseStoredToken(latest)) {
-                    return buildLease(
-                      latest.accessToken,
-                      getLeaseExpiry(latest.expiresAt),
-                      input.reason
-                    );
-                  }
-                  if (!latest) {
-                    throw new CredentialUnavailableError(
-                      provider,
-                      `No ${provider} credentials available.`
-                    );
-                  }
-                  const refreshed = await refreshAccessToken(
-                    provider,
-                    latest.refreshToken,
-                    oauth,
-                    latest.scope ?? oauth.scope
-                  );
-                  if (!hasRequiredOAuthScope(refreshed.scope, oauth.scope)) {
-                    throw new CredentialUnavailableError(
-                      provider,
-                      `Your ${provider} connection needs to be reauthorized.`
-                    );
-                  }
-                  const refreshedTokens = {
-                    ...latest.refreshTokenExpiresAt ? { refreshTokenExpiresAt: latest.refreshTokenExpiresAt } : void 0,
-                    ...refreshed,
-                    ...latest.account ? { account: latest.account } : void 0
-                  };
-                  await deps.userTokenStore.set(
-                    userSubjectId,
-                    provider,
-                    refreshedTokens
-                  );
-                  return buildLease(
-                    refreshed.accessToken,
-                    getLeaseExpiry(refreshed.expiresAt),
-                    input.reason
-                  );
-                }
-              );
-            } catch (error) {
-              if (error instanceof CredentialUnavailableError) {
-                throw error;
-              }
-              if (error instanceof OAuthRefreshRejectedError) {
-                throw new CredentialUnavailableError(
-                  provider,
-                  `Your ${provider} connection has expired.`
-                );
-              }
-              throw error;
-            }
-          }
-          if (canUseStoredToken(stored)) {
-            return buildLease(
-              stored.accessToken,
-              getLeaseExpiry(stored.expiresAt),
-              input.reason
-            );
-          }
-          throw new CredentialUnavailableError(
-            provider,
-            `Your ${provider} connection has expired.`
-          );
-        }
-        throw new CredentialUnavailableError(
-          provider,
-          `No ${provider} credentials available.`
-        );
-      }
-      if (envToken) {
-        return buildLease(envToken, getLeaseExpiry(), input.reason);
-      }
-      throw new CredentialUnavailableError(
-        provider,
-        `No ${provider} credentials available.`
-      );
-    }
-  };
-}
-
-// src/chat/plugins/registry.ts
-function getLoggedPluginNames() {
-  const globalState = globalThis;
-  globalState.__juniorLoggedPluginNames ??= /* @__PURE__ */ new Set();
-  return globalState.__juniorLoggedPluginNames;
-}
-function createLoadedPluginState(signature) {
-  return {
-    signature,
-    pluginDefinitions: [],
-    pluginMigrationRoots: /* @__PURE__ */ new Map(),
-    domainToPlugin: /* @__PURE__ */ new Map(),
-    pluginConfigKeys: /* @__PURE__ */ new Set(),
-    pluginsByName: /* @__PURE__ */ new Map(),
-    packageSkillRoots: /* @__PURE__ */ new Set()
-  };
-}
-function providerDomains(manifest) {
-  return [
-    .../* @__PURE__ */ new Set([
-      ...manifest.credentials?.domains ?? [],
-      ...manifest.domains ?? []
-    ])
-  ].sort((left, right) => left.localeCompare(right));
-}
-function registerPluginManifest(state, manifest, pluginDir, skillsDir, migrationsDir) {
-  if (state.pluginsByName.has(manifest.name)) {
-    throw new Error(`Duplicate plugin name "${manifest.name}"`);
-  }
-  for (const domain of providerDomains(manifest)) {
-    const owner = state.domainToPlugin.get(domain);
-    if (owner) {
-      throw new Error(
-        `Duplicate provider domain "${domain}" in plugin "${manifest.name}" already declared by plugin "${owner}". Use plugins.manifests in PluginCatalogConfig to change one plugin's domains or credentials.`
-      );
-    }
-  }
-  const definition = {
-    manifest,
-    dir: pluginDir,
-    ...migrationsDir ? { migrationsDir } : void 0,
-    ...skillsDir ? { skillsDir } : void 0
-  };
-  state.pluginDefinitions.push(definition);
-  state.pluginsByName.set(manifest.name, definition);
-  if (definition.migrationsDir) {
-    state.pluginMigrationRoots.set(manifest.name, definition.migrationsDir);
-  }
-  for (const key of manifest.configKeys) {
-    state.pluginConfigKeys.add(key);
-  }
-  for (const domain of providerDomains(manifest)) {
-    state.domainToPlugin.set(domain, manifest.name);
-  }
-}
-function registerYamlPluginManifest(state, raw, pluginDir, config) {
-  const manifest = parsePluginManifest(raw, pluginDir, config);
-  const candidateSkillsDir = path.join(pluginDir, "skills");
-  const hasSkillsDir = (() => {
-    try {
-      return statSync(candidateSkillsDir).isDirectory();
-    } catch {
-      return false;
-    }
-  })();
-  registerPluginManifest(
-    state,
-    manifest,
-    pluginDir,
-    hasSkillsDir ? candidateSkillsDir : void 0
-  );
-}
-function normalizePluginRoots(roots) {
-  const resolved = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const root of roots) {
-    const normalized = path.resolve(root);
-    if (seen.has(normalized)) {
-      continue;
-    }
-    seen.add(normalized);
-    resolved.push(normalized);
-  }
-  return resolved;
-}
-function getPluginCatalogSource(runtime) {
-  const packagedContent = discoverConfiguredPluginPackageContent(
-    runtime.pluginConfig
-  );
-  const localRoots = normalizePluginRoots(pluginRoots());
-  const manifestRoots = normalizePluginRoots([
-    ...localRoots,
-    ...packagedContent.manifestRoots
-  ]);
-  const packagedSkillRoots = normalizePluginRoots(packagedContent.skillRoots);
-  const inlineManifests = runtime.pluginConfig?.inlineManifests ?? [];
-  return {
-    inlineManifests,
-    manifestRoots,
-    packagedSkillRoots,
-    packagedContent,
-    signature: JSON.stringify({
-      inlineManifests,
-      manifestRoots,
-      packages: packagedContent.packages.map((pkg) => ({
-        dir: path.resolve(pkg.dir),
-        hasMigrationsDir: pkg.hasMigrationsDir,
-        hasSkillsDir: pkg.hasSkillsDir,
-        packageName: pkg.packageName
-      })).sort(
-        (left, right) => left.packageName.localeCompare(right.packageName)
-      ),
-      packagedSkillRoots,
-      packageNames: [...packagedContent.packageNames].sort(),
-      pluginConfig: runtime.pluginConfig ?? {}
-    })
-  };
-}
-function normalizePluginCatalogConfig(config) {
-  if (!config) {
-    return void 0;
-  }
-  return {
-    inlineManifests: config.inlineManifests ? structuredClone(config.inlineManifests) : void 0,
-    packages: normalizePluginPackageNames(config.packages),
-    ...config.manifests ? { manifests: structuredClone(config.manifests) } : void 0
-  };
-}
-function clonePluginCatalogConfig(config) {
-  if (!config) {
-    return void 0;
-  }
-  return {
-    ...config.inlineManifests ? { inlineManifests: structuredClone(config.inlineManifests) } : void 0,
-    packages: [...config.packages ?? []],
-    ...config.manifests ? { manifests: structuredClone(config.manifests) } : void 0
-  };
-}
-function packageContentByName(packagedContent, packageName) {
-  return packagedContent.packages.find(
-    (pkg) => pkg.packageName === packageName
-  );
-}
-function registerInlineManifests(state, source, config) {
-  const migrationOwners = /* @__PURE__ */ new Map();
-  for (const definition of source.inlineManifests) {
-    const pkg = definition.packageName ? packageContentByName(source.packagedContent, definition.packageName) : void 0;
-    const dir = pkg?.dir ?? process.cwd();
-    const skillsDir = pkg?.hasSkillsDir ? path.join(pkg.dir, "skills") : void 0;
-    const migrationsDir = pkg?.hasMigrationsDir && statSync(path.join(pkg.dir, "migrations"), {
-      throwIfNoEntry: false
-    })?.isDirectory() ? path.join(pkg.dir, "migrations") : void 0;
-    const manifest = parseInlinePluginManifest(
-      definition.manifest,
-      dir,
-      config
-    );
-    if (migrationsDir) {
-      const owner = migrationOwners.get(migrationsDir);
-      if (owner) {
-        throw new Error(
-          `Plugin "${manifest.name}" cannot share migrations directory with plugin "${owner}"`
-        );
-      }
-      migrationOwners.set(migrationsDir, manifest.name);
-    }
-    registerPluginManifest(state, manifest, dir, skillsDir, migrationsDir);
-  }
-}
-function discoverConfiguredPluginPackageContent(config) {
-  return discoverInstalledPluginPackageContent(process.cwd(), {
-    packageNames: config?.packages
-  });
-}
-function buildLoadedPluginState(source, config) {
-  const state = createLoadedPluginState(source.signature);
-  for (const skillRoot of source.packagedSkillRoots) {
-    state.packageSkillRoots.add(skillRoot);
-  }
-  registerInlineManifests(state, source, config);
-  const roots = source.manifestRoots;
-  for (const pluginsRoot of roots) {
-    let entries;
-    let rootStat;
-    try {
-      rootStat = statSync(pluginsRoot);
-    } catch (error) {
-      logWarn("plugin.root.read.failed", {
-        "file.directory": pluginsRoot,
-        "exception.message": error instanceof Error ? error.message : String(error)
-      });
-      continue;
-    }
-    if (rootStat.isDirectory()) {
-      const manifestPath = path.join(pluginsRoot, "plugin.yaml");
-      let hasRootManifest = false;
-      try {
-        hasRootManifest = statSync(manifestPath).isFile();
-      } catch {
-        hasRootManifest = false;
-      }
-      if (hasRootManifest) {
-        const rawRootManifest = readFileSync(manifestPath, "utf8");
-        registerYamlPluginManifest(state, rawRootManifest, pluginsRoot, config);
-        continue;
-      }
-    }
-    try {
-      entries = readdirSync(pluginsRoot);
-    } catch (error) {
-      logWarn("plugin.root.read.failed", {
-        "file.directory": pluginsRoot,
-        "exception.message": error instanceof Error ? error.message : String(error)
-      });
-      continue;
-    }
-    for (const entry of entries.sort()) {
-      const pluginDir = path.join(pluginsRoot, entry);
-      try {
-        const stat = statSync(pluginDir);
-        if (!stat.isDirectory()) continue;
-      } catch {
-        continue;
-      }
-      const manifestPath = path.join(pluginDir, "plugin.yaml");
-      let raw;
-      try {
-        raw = readFileSync(manifestPath, "utf8");
-      } catch {
-        continue;
-      }
-      registerYamlPluginManifest(state, raw, pluginDir, config);
-    }
-  }
-  for (const name of Object.keys(config?.manifests ?? {})) {
-    if (!state.pluginsByName.has(name)) {
-      throw new Error(
-        `plugins.manifests.${name} does not match a loaded plugin`
-      );
-    }
-  }
-  return state;
-}
-function logLoadedPlugins(state) {
-  const loggedPluginNames = getLoggedPluginNames();
-  for (const plugin of [...state.pluginDefinitions].sort(
-    (left, right) => left.manifest.name.localeCompare(right.manifest.name)
-  )) {
-    if (loggedPluginNames.has(plugin.manifest.name)) {
-      continue;
-    }
-    loggedPluginNames.add(plugin.manifest.name);
-    logInfo("plugin.loaded", {
-      "app.plugin.name": plugin.manifest.name,
-      "app.plugin.config_key_count": plugin.manifest.configKeys.length,
-      "app.plugin.has_mcp": Boolean(plugin.manifest.mcp),
-      "file.directory": plugin.dir,
-      ...plugin.skillsDir ? { "app.file.skill_directory": plugin.skillsDir } : void 0
-    });
-  }
-}
-function ensurePluginsLoaded(runtime) {
-  const source = getPluginCatalogSource(runtime);
-  if (runtime.loadedPluginState?.signature === source.signature) {
-    return runtime.loadedPluginState;
-  }
-  const state = buildLoadedPluginState(source, runtime.pluginConfig);
-  runtime.loadedPluginState = state;
-  logLoadedPlugins(state);
-  return state;
-}
-function createPluginCatalogRuntime() {
-  const runtime = {};
-  return {
-    setConfig(config) {
-      const previousConfig = clonePluginCatalogConfig(runtime.pluginConfig);
-      runtime.pluginConfig = normalizePluginCatalogConfig(config);
-      return previousConfig;
-    },
-    parseConfiguredInlineManifest(manifest, dir) {
-      return parseInlinePluginManifest(manifest, dir, runtime.pluginConfig);
-    },
-    getPackageContent() {
-      return discoverConfiguredPluginPackageContent(runtime.pluginConfig);
-    },
-    getSignature() {
-      return ensurePluginsLoaded(runtime).signature;
-    },
-    getProviders() {
-      return [...ensurePluginsLoaded(runtime).pluginDefinitions];
-    },
-    getMigrationRoots() {
-      const state = ensurePluginsLoaded(runtime);
-      return [...state.pluginMigrationRoots.entries()].map(([pluginName, dir]) => ({ pluginName, dir })).sort((left, right) => left.pluginName.localeCompare(right.pluginName));
-    },
-    getMcpProviders() {
-      return ensurePluginsLoaded(runtime).pluginDefinitions.filter(
-        (plugin) => Boolean(plugin.manifest.mcp)
-      );
-    },
-    getRuntimeDependencies() {
-      const state = ensurePluginsLoaded(runtime);
-      const seen = /* @__PURE__ */ new Set();
-      const deps = [];
-      for (const plugin of state.pluginDefinitions) {
-        for (const dep of plugin.manifest.runtimeDependencies ?? []) {
-          const key = dep.type === "npm" ? `${dep.type}:${dep.package}:${dep.version}` : "package" in dep ? `${dep.type}:package:${dep.package}` : `${dep.type}:url:${dep.url}:${dep.sha256}`;
-          if (seen.has(key)) {
-            continue;
-          }
-          seen.add(key);
-          deps.push(dep);
-        }
-      }
-      return deps.sort((left, right) => {
-        if (left.type !== right.type) {
-          return left.type.localeCompare(right.type);
-        }
-        const leftIdentity = "package" in left ? `package:${left.package}` : `url:${left.url}:${left.sha256}`;
-        const rightIdentity = "package" in right ? `package:${right.package}` : `url:${right.url}:${right.sha256}`;
-        if (leftIdentity !== rightIdentity) {
-          return leftIdentity.localeCompare(rightIdentity);
-        }
-        if (left.type === "npm" && right.type === "npm") {
-          return left.version.localeCompare(right.version);
-        }
-        return 0;
-      });
-    },
-    getRuntimePostinstall() {
-      const state = ensurePluginsLoaded(runtime);
-      const commands = [];
-      for (const plugin of state.pluginDefinitions) {
-        for (const command of plugin.manifest.runtimePostinstall ?? []) {
-          commands.push({
-            cmd: command.cmd,
-            ...command.args ? { args: [...command.args] } : void 0,
-            ...command.sudo !== void 0 ? { sudo: command.sudo } : void 0
-          });
-        }
-      }
-      return commands;
-    },
-    getOAuthConfig(provider) {
-      const plugin = ensurePluginsLoaded(runtime).pluginsByName.get(provider);
-      if (!plugin?.manifest.oauth) return void 0;
-      const oauth = plugin.manifest.oauth;
-      return {
-        clientIdEnv: oauth.clientIdEnv,
-        clientSecretEnv: oauth.clientSecretEnv,
-        authorizeEndpoint: oauth.authorizeEndpoint,
-        tokenEndpoint: oauth.tokenEndpoint,
-        ...oauth.scope ? { scope: oauth.scope } : void 0,
-        ...oauth.authorizeParams ? { authorizeParams: { ...oauth.authorizeParams } } : void 0,
-        ...oauth.tokenAuthMethod ? { tokenAuthMethod: oauth.tokenAuthMethod } : void 0,
-        ...oauth.tokenExtraHeaders ? { tokenExtraHeaders: { ...oauth.tokenExtraHeaders } } : void 0,
-        ...oauth.treatEmptyScopeAsUnreported ? { treatEmptyScopeAsUnreported: true } : void 0,
-        callbackPath: `/api/oauth/callback/${plugin.manifest.name}`
-      };
-    },
-    getSkillRoots() {
-      const state = ensurePluginsLoaded(runtime);
-      return [
-        .../* @__PURE__ */ new Set([
-          ...state.pluginDefinitions.flatMap(
-            (plugin) => plugin.skillsDir ? [plugin.skillsDir] : []
-          ),
-          ...state.packageSkillRoots
-        ])
-      ];
-    },
-    getForSkillPath(skillPath) {
-      const state = ensurePluginsLoaded(runtime);
-      const resolvedSkillPath = path.resolve(skillPath);
-      return state.pluginDefinitions.find((plugin) => {
-        if (!plugin.skillsDir) {
-          return false;
-        }
-        const resolvedSkillsDir = path.resolve(plugin.skillsDir);
-        return resolvedSkillPath === resolvedSkillsDir || resolvedSkillPath.startsWith(`${resolvedSkillsDir}${path.sep}`);
-      });
-    },
-    getDefinition(provider) {
-      return ensurePluginsLoaded(runtime).pluginsByName.get(provider);
-    },
-    getDisplayName(provider) {
-      return ensurePluginsLoaded(runtime).pluginsByName.get(provider)?.manifest.displayName;
-    },
-    isProvider(provider) {
-      return ensurePluginsLoaded(runtime).pluginsByName.has(provider);
-    },
-    isConfigKey(key) {
-      return ensurePluginsLoaded(runtime).pluginConfigKeys.has(key);
-    },
-    createBroker(provider, deps) {
-      const plugin = ensurePluginsLoaded(runtime).pluginsByName.get(provider);
-      if (!plugin) {
-        throw new Error(`Unknown plugin provider: "${provider}"`);
-      }
-      const { credentials, name } = plugin.manifest;
-      if (!credentials && !plugin.manifest.apiHeaders) {
-        throw new Error(
-          `Provider "${name}" has no credentials or API headers configured`
-        );
-      }
-      let broker;
-      if (!credentials) {
-        broker = createApiHeadersBroker(plugin.manifest);
-      } else {
-        broker = createOAuthBearerBroker(plugin.manifest, credentials, deps);
-      }
-      setSpanAttributes({
-        "app.plugin.name": name,
-        "app.plugin.has_oauth": Boolean(plugin.manifest.oauth)
-      });
-      return broker;
-    }
-  };
-}
-
-export {
-  parsePluginManifest,
-  parseInlinePluginManifest,
-  CredentialUnavailableError,
-  hasRequiredOAuthScope,
-  OAuthProviderError,
-  getOAuthProviderErrorAttributes,
-  fetchWithBoundedOAuthErrorBodies,
-  resolvePluginCommandEnv,
-  resolveAuthTokenPlaceholder,
-  buildOAuthTokenRequest,
-  parseOAuthTokenResponse,
-  createPluginCatalogRuntime
-};