@sentry/junior 0.203.0 → 0.205.0

package/dist/chunk-PSJCGIGO.js

@@ -1,1163 +0,0 @@
-import {
-  resolveBaseUrl
-} from "./chunk-UE4GPWSD.js";
-import {
-  createPluginLogger,
-  getPlugins,
-  getSlackClient,
-  withSlackRetries
-} from "./chunk-IZ5B5IHQ.js";
-import {
-  getDb,
-  parseDestination
-} from "./chunk-GKEOHJL5.js";
-import {
-  sleep
-} from "./chunk-5AHX53NQ.js";
-import {
-  acquireActiveLock,
-  getStateAdapter
-} from "./chunk-P6KTRNVC.js";
-import {
-  pluginCatalogRuntime
-} from "./chunk-WCNQJKFT.js";
-import {
-  fetchWithBoundedOAuthErrorBodies
-} from "./chunk-7GWQ5S5R.js";
-import {
-  isRecord
-} from "./chunk-WS7NAFTM.js";
-
-// src/chat/capabilities/router.ts
-var ProviderCredentialRouter = class {
-  brokersByProvider;
-  constructor(input) {
-    this.brokersByProvider = input.brokersByProvider;
-  }
-  async issue(input) {
-    const broker = this.brokersByProvider[input.provider];
-    if (!broker) {
-      throw new Error(
-        `No credential broker registered for provider: ${input.provider}`
-      );
-    }
-    return await broker.issue({
-      context: input.context,
-      reason: input.reason
-    });
-  }
-};
-
-// src/chat/credentials/user-token-store.ts
-import {
-  pluginStoredTokensSchema
-} from "@sentry/junior-plugin-api";
-var storedTokensSchema = pluginStoredTokensSchema;
-
-// src/chat/credentials/state-adapter-token-store.ts
-var KEY_PREFIX = "oauth-token";
-var BUFFER_MS = 24 * 60 * 60 * 1e3;
-var LONG_LIVED_TTL_MS = 365 * 24 * 60 * 60 * 1e3;
-var REFRESH_LOCK_WAIT_MS = 3e4;
-var REFRESH_LOCK_RETRY_MS = 100;
-function tokenKey(userId, provider) {
-  return `${KEY_PREFIX}:${userId}:${provider}`;
-}
-function refreshLockKey(userId, provider) {
-  return `${tokenKey(userId, provider)}:refresh`;
-}
-var StateAdapterTokenStore = class {
-  state;
-  constructor(stateAdapter) {
-    this.state = stateAdapter;
-  }
-  async get(userId, provider) {
-    const stored = await this.state.get(tokenKey(userId, provider));
-    return stored === null || stored === void 0 ? void 0 : storedTokensSchema.parse(stored);
-  }
-  async set(userId, provider, tokens) {
-    const parsed = storedTokensSchema.parse(tokens);
-    const expiresAt = parsed.refreshTokenExpiresAt ?? parsed.expiresAt;
-    const ttlMs = expiresAt ? Math.max(expiresAt - Date.now() + BUFFER_MS, BUFFER_MS) : LONG_LIVED_TTL_MS;
-    await this.state.set(tokenKey(userId, provider), parsed, ttlMs);
-  }
-  async delete(userId, provider) {
-    await this.state.delete(tokenKey(userId, provider));
-  }
-  /** Wait for the per-slot refresh gate so rotated refresh tokens are used once. */
-  async withRefresh(userId, provider, callback) {
-    const lockKey = refreshLockKey(userId, provider);
-    const deadline = Date.now() + REFRESH_LOCK_WAIT_MS;
-    while (true) {
-      const lock = await acquireActiveLock(this.state, lockKey);
-      if (lock) {
-        try {
-          return await callback();
-        } finally {
-          await this.state.releaseLock(lock);
-        }
-      }
-      if (Date.now() >= deadline) {
-        throw new Error(`Could not acquire OAuth token refresh lock`);
-      }
-      await sleep(REFRESH_LOCK_RETRY_MS);
-    }
-  }
-};
-
-// src/chat/capabilities/factory.ts
-var sandboxEgressRouters = /* @__PURE__ */ new WeakMap();
-function createUserTokenStore() {
-  return new StateAdapterTokenStore(getStateAdapter());
-}
-function createProviderCredentialRouter(userTokenStore) {
-  const brokersByProvider = {};
-  for (const plugin of pluginCatalogRuntime.getProviders()) {
-    const { name } = plugin.manifest;
-    if (!plugin.manifest.credentials && !plugin.manifest.apiHeaders) {
-      continue;
-    }
-    brokersByProvider[name] = pluginCatalogRuntime.createBroker(name, {
-      userTokenStore
-    });
-  }
-  return new ProviderCredentialRouter({ brokersByProvider });
-}
-function getSandboxEgressRouter() {
-  const stateAdapter = getStateAdapter();
-  let router = sandboxEgressRouters.get(stateAdapter);
-  if (!router) {
-    router = createProviderCredentialRouter(
-      new StateAdapterTokenStore(stateAdapter)
-    );
-    sandboxEgressRouters.set(stateAdapter, router);
-  }
-  return router;
-}
-async function issueProviderCredentialLease(input) {
-  return await getSandboxEgressRouter().issue(input);
-}
-
-// src/chat/mcp/errors.ts
-var McpProviderError = class extends Error {
-  phase;
-  provider;
-  missingSession;
-  resourceHost;
-  status;
-  constructor(details) {
-    super(`MCP provider ${details.phase.replace("_", " ")} failed`);
-    this.name = "McpProviderError";
-    this.phase = details.phase;
-    this.provider = details.provider;
-    this.missingSession = details.missingSession;
-    this.resourceHost = details.resourceHost;
-    this.status = details.status;
-  }
-};
-function providerStatus(error) {
-  if (!error || typeof error !== "object") {
-    return void 0;
-  }
-  const value = error;
-  const status = typeof value.status === "number" ? value.status : typeof value.code === "number" ? value.code : void 0;
-  return status !== void 0 && status >= 100 && status <= 599 ? status : void 0;
-}
-function toMcpProviderError(error, details) {
-  if (error instanceof McpProviderError) {
-    return error;
-  }
-  return new McpProviderError({
-    ...details,
-    status: details.status ?? providerStatus(error)
-  });
-}
-function getMcpProviderErrorAttributes(error) {
-  if (!(error instanceof McpProviderError)) {
-    return {};
-  }
-  return {
-    "app.credential.provider": error.provider,
-    "app.mcp.error.phase": error.phase,
-    ...error.status !== void 0 ? { "http.response.status_code": error.status } : void 0,
-    ...error.resourceHost ? { "server.address": error.resourceHost } : void 0
-  };
-}
-var McpToolError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "McpToolError";
-  }
-};
-function getMcpAwareErrorType(error, fallback) {
-  if (error instanceof McpToolError) {
-    return "tool_error";
-  }
-  if (error instanceof McpProviderError) {
-    return "mcp_provider_error";
-  }
-  return error instanceof Error ? error.name : fallback;
-}
-function getMcpAwareErrorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-function getMcpAwareTelemetryMessage(error, _privacy) {
-  if (error instanceof McpToolError) {
-    return "MCP tool call failed";
-  }
-  if (error instanceof McpProviderError) {
-    return error.message;
-  }
-  return getMcpAwareErrorMessage(error);
-}
-
-// src/chat/slack/users.ts
-function normalizeUser(raw) {
-  const rawFields = raw.profile?.fields;
-  const profileFields = [];
-  if (rawFields && typeof rawFields === "object") {
-    for (const [id, field] of Object.entries(rawFields)) {
-      if (!field) continue;
-      profileFields.push({
-        id,
-        label: field.label || void 0,
-        value: field.value || void 0,
-        alt: field.alt || void 0
-      });
-    }
-  }
-  return {
-    id: raw.id ?? "",
-    team_id: raw.team_id || void 0,
-    name: raw.name || void 0,
-    real_name: raw.real_name || raw.profile?.real_name || void 0,
-    display_name: raw.profile?.display_name || void 0,
-    title: raw.profile?.title || void 0,
-    email: raw.profile?.email || void 0,
-    status_text: raw.profile?.status_text ?? void 0,
-    status_emoji: raw.profile?.status_emoji ?? void 0,
-    is_bot: raw.is_bot ?? false,
-    is_deleted: raw.deleted ?? false,
-    timezone: raw.tz || void 0,
-    ...profileFields.length > 0 ? { profile_fields: profileFields } : void 0
-  };
-}
-function normalizeNameTokens(value) {
-  return value.toLowerCase().split(/[^\p{L}\p{N}]+/u).filter(Boolean);
-}
-function nameFields(user) {
-  return [
-    user.name ?? "",
-    user.profile?.display_name ?? "",
-    user.real_name ?? user.profile?.real_name ?? ""
-  ].map((value) => value.toLowerCase().trim()).filter(Boolean);
-}
-async function lookupSlackUserProfile(userId) {
-  const client = getSlackClient();
-  const result = await withSlackRetries(
-    () => client.users.info({ user: userId }),
-    3,
-    { action: "users.info" }
-  );
-  const user = result.user;
-  if (!user) {
-    throw new Error(`Slack users.info returned no user for ${userId}`);
-  }
-  return normalizeUser(user);
-}
-async function lookupSlackUserByEmail(email) {
-  const client = getSlackClient();
-  let result;
-  try {
-    result = await withSlackRetries(
-      () => client.users.lookupByEmail({ email }),
-      3,
-      { action: "users.lookupByEmail" }
-    );
-  } catch (error) {
-    const apiError = error.apiError;
-    if (apiError === "users_not_found") {
-      return null;
-    }
-    throw error;
-  }
-  const user = result.user;
-  if (!user) {
-    return null;
-  }
-  return normalizeUser(user);
-}
-function scoreNameMatch(user, query) {
-  const queryLower = query.toLowerCase().trim();
-  if (!queryLower) return 0;
-  const fields = nameFields(user);
-  if (fields.length === 0) return 0;
-  let best = 0;
-  const queryTokens = normalizeNameTokens(queryLower);
-  for (const field of fields) {
-    if (field === queryLower) {
-      best = Math.max(best, 100);
-      continue;
-    }
-    if (field.startsWith(queryLower)) {
-      best = Math.max(best, 70);
-    } else if (field.includes(queryLower)) {
-      best = Math.max(best, 25);
-    }
-    const tokens = normalizeNameTokens(field);
-    for (const token of tokens) {
-      if (token === queryLower) {
-        best = Math.max(best, 85);
-      } else if (token.startsWith(queryLower)) {
-        best = Math.max(best, 60);
-      }
-    }
-    if (queryTokens.length > 1 && queryTokens.every(
-      (queryToken) => tokens.some(
-        (token) => token === queryToken || token.startsWith(queryToken)
-      )
-    )) {
-      best = Math.max(best, 95);
-    }
-  }
-  return best;
-}
-function compareNameMatches(left, right) {
-  if (right.score !== left.score) return right.score - left.score;
-  return (left.user.name ?? "").localeCompare(right.user.name ?? "");
-}
-async function listWorkspaceUsers(options) {
-  const client = getSlackClient();
-  const matches = [];
-  let cursor;
-  let pages = 0;
-  let totalScanned = 0;
-  while (pages < options.maxPages) {
-    pages++;
-    const result = await withSlackRetries(
-      () => client.users.list({
-        limit: 200,
-        ...cursor ? { cursor } : void 0
-      }),
-      3,
-      { action: "users.list" }
-    );
-    const members = result.members ?? [];
-    totalScanned += members.length;
-    for (const member of members) {
-      if (!options.includeDeleted && member.deleted) continue;
-      if (!options.includeBots && member.is_bot) continue;
-      if (member.id === "USLACKBOT") continue;
-      const score = options.score(member);
-      if (score <= 0) continue;
-      matches.push({ user: member, score });
-    }
-    const nextCursor = result.response_metadata?.next_cursor;
-    if (!nextCursor) {
-      cursor = void 0;
-      break;
-    }
-    cursor = nextCursor;
-  }
-  return {
-    matches,
-    searched_pages: pages,
-    searched_user_count: totalScanned,
-    // True only when we hit the page cap with more data remaining.
-    truncated: pages >= options.maxPages && Boolean(cursor)
-  };
-}
-async function searchSlackUsers(options) {
-  const {
-    query,
-    limit = 10,
-    maxPages = 3,
-    includeDeleted = false,
-    includeBots = false
-  } = options;
-  const queryLower = query.toLowerCase().trim();
-  const listed = await listWorkspaceUsers({
-    maxPages,
-    includeDeleted,
-    includeBots,
-    score: (member) => scoreNameMatch(member, queryLower)
-  });
-  listed.matches.sort(compareNameMatches);
-  return {
-    users: listed.matches.slice(0, limit).map((m) => normalizeUser(m.user)),
-    searched_pages: listed.searched_pages,
-    searched_user_count: listed.searched_user_count,
-    truncated: listed.truncated
-  };
-}
-
-// src/chat/plugins/credential-hooks.ts
-import {
-  pluginAuthorizationSchema,
-  pluginCredentialResultSchema,
-  pluginGrantSchema,
-  pluginProviderAccountSchema
-} from "@sentry/junior-plugin-api";
-function parseSchema(schema, value, message) {
-  const result = schema.safeParse(value);
-  if (!result.success) {
-    throw new Error(message);
-  }
-  return result.data;
-}
-function parseAuthorization(value, pluginName) {
-  if (value === void 0) {
-    return void 0;
-  }
-  const authorization = parseSchema(
-    pluginAuthorizationSchema,
-    value,
-    `Plugin "${pluginName}" grant authorization is invalid`
-  );
-  if (authorization.provider !== pluginName) {
-    throw new Error(
-      `Plugin "${pluginName}" grant authorization provider must match the issuing plugin`
-    );
-  }
-  return authorization;
-}
-function parseGrant(value, pluginName) {
-  return parseSchema(
-    pluginGrantSchema,
-    value,
-    `Plugin "${pluginName}" grantForEgress returned an invalid grant`
-  );
-}
-function pluginFor(provider) {
-  return getPlugins().find((candidate) => candidate.manifest.name === provider);
-}
-function basePluginContext(plugin) {
-  const pluginName = plugin.manifest.name;
-  return {
-    plugin: { name: pluginName },
-    log: createPluginLogger(pluginName),
-    db: getDb()
-  };
-}
-function parseCredentialResult(value, pluginName) {
-  const result = parseSchema(
-    pluginCredentialResultSchema,
-    value,
-    `Plugin "${pluginName}" issueCredential result is invalid`
-  );
-  if (result.type === "lease") {
-    parseAuthorization(result.lease.authorization, pluginName);
-    return result;
-  }
-  if (result.type === "unavailable") {
-    return result;
-  }
-  parseAuthorization(result.authorization, pluginName);
-  return result;
-}
-async function selectPluginGrant(input) {
-  const plugin = pluginFor(input.provider);
-  const hook = plugin?.hooks?.grantForEgress;
-  if (!plugin || !hook) {
-    return void 0;
-  }
-  const result = await hook({
-    ...basePluginContext(plugin),
-    request: {
-      ...input.bodyText !== void 0 ? { bodyText: input.bodyText } : void 0,
-      method: input.method,
-      ...input.operation ? { operation: input.operation } : void 0,
-      url: input.upstreamUrl.toString()
-    }
-  });
-  return result === void 0 ? void 0 : parseGrant(result, plugin.manifest.name);
-}
-async function onPluginEgressResponse(input) {
-  const plugin = pluginFor(input.provider);
-  const hook = plugin?.hooks?.onEgressResponse;
-  if (!plugin || !hook) {
-    return {};
-  }
-  let permissionDenied;
-  await hook({
-    ...basePluginContext(plugin),
-    grant: input.grant,
-    permissionDenied(message) {
-      const trimmed = message.trim();
-      if (!trimmed) {
-        throw new Error(
-          `Plugin "${plugin.manifest.name}" onEgressResponse permissionDenied message is empty`
-        );
-      }
-      permissionDenied = { message: trimmed };
-    },
-    request: {
-      method: input.method,
-      ...input.operation ? { operation: input.operation } : void 0,
-      url: input.upstreamUrl.toString()
-    },
-    response: input.response
-  });
-  return permissionDenied ? { permissionDenied } : {};
-}
-function hasEgressCredentialHooks(provider) {
-  const hooks = pluginFor(provider)?.hooks;
-  return Boolean(hooks?.grantForEgress || hooks?.issueCredential);
-}
-function getOAuthAccountProviders() {
-  return getPlugins().filter((plugin) => Boolean(plugin.hooks?.resolveOAuthAccount)).map((plugin) => plugin.manifest.name);
-}
-async function resolvePluginOAuthAccount(input) {
-  const plugin = pluginFor(input.provider);
-  const hook = plugin?.hooks?.resolveOAuthAccount;
-  if (!plugin || !hook) {
-    return void 0;
-  }
-  const account = await hook({
-    ...basePluginContext(plugin),
-    tokens: input.tokens
-  });
-  return account === void 0 ? void 0 : parseSchema(
-    pluginProviderAccountSchema,
-    account,
-    `Plugin "${plugin.manifest.name}" resolveOAuthAccount returned an invalid account`
-  );
-}
-async function issuePluginCredential(input) {
-  const plugin = pluginFor(input.provider);
-  const hook = plugin?.hooks?.issueCredential;
-  if (!plugin || !hook) {
-    throw new Error(`Plugin "${input.provider}" has no issueCredential hook`);
-  }
-  const currentUserId = "type" in input.actor ? input.actor.userId : void 0;
-  const credentialSubjectUserId = input.credentialSubject?.userId;
-  const result = await hook({
-    ...basePluginContext(plugin),
-    actor: input.actor,
-    grant: input.grant,
-    ...input.credentialSubject ? { credentialSubject: input.credentialSubject } : void 0,
-    tokens: {
-      ...currentUserId ? {
-        currentUser: {
-          userId: currentUserId,
-          get: async () => await input.userTokenStore.get(
-            currentUserId,
-            plugin.manifest.name
-          ),
-          set: async (tokens) => {
-            await input.userTokenStore.set(
-              currentUserId,
-              plugin.manifest.name,
-              tokens
-            );
-          },
-          withRefresh: async (callback) => await input.userTokenStore.withRefresh(
-            currentUserId,
-            plugin.manifest.name,
-            callback
-          )
-        }
-      } : void 0,
-      ...credentialSubjectUserId ? {
-        credentialSubject: {
-          userId: credentialSubjectUserId,
-          get: async () => await input.userTokenStore.get(
-            credentialSubjectUserId,
-            plugin.manifest.name
-          ),
-          set: async (tokens) => {
-            await input.userTokenStore.set(
-              credentialSubjectUserId,
-              plugin.manifest.name,
-              tokens
-            );
-          },
-          withRefresh: async (callback) => await input.userTokenStore.withRefresh(
-            credentialSubjectUserId,
-            plugin.manifest.name,
-            callback
-          )
-        }
-      } : void 0
-    }
-  });
-  return parseCredentialResult(result, plugin.manifest.name);
-}
-
-// src/chat/mcp/auth-store.ts
-import {
-  sourceSchema
-} from "@sentry/junior-plugin-api";
-var MCP_AUTH_SESSION_PREFIX = "junior:mcp_oauth_attempt:v2";
-var MCP_AUTH_CREDENTIALS_PREFIX = "junior:mcp_auth_credentials";
-var MCP_AUTH_SESSION_INDEX_PREFIX = "junior:mcp_oauth_attempt_index:v2";
-var MCP_SERVER_SESSION_PREFIX = "junior:mcp_server_session";
-var MCP_AUTH_SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
-var MCP_AUTH_CREDENTIALS_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
-var MCP_SERVER_SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
-function sessionKey(authSessionId) {
-  return `${MCP_AUTH_SESSION_PREFIX}:${authSessionId}`;
-}
-function credentialsKey(userId, provider) {
-  return `${MCP_AUTH_CREDENTIALS_PREFIX}:${userId}:${provider}`;
-}
-function sessionIndexKey(userId, provider) {
-  return `${MCP_AUTH_SESSION_INDEX_PREFIX}:${userId}:${provider}`;
-}
-function serverSessionKey(userId, provider) {
-  return `${MCP_SERVER_SESSION_PREFIX}:${userId}:${provider}`;
-}
-function parseSessionIndex(value) {
-  if (typeof value !== "string") {
-    return [];
-  }
-  try {
-    const parsed = JSON.parse(value);
-    if (!Array.isArray(parsed)) {
-      return [];
-    }
-    return [
-      ...new Set(parsed.filter((id) => typeof id === "string"))
-    ];
-  } catch {
-    return [];
-  }
-}
-function parseMcpAuthSession(value) {
-  if (typeof value !== "string") {
-    return void 0;
-  }
-  try {
-    const parsed = JSON.parse(value);
-    if (!isRecord(parsed)) {
-      return void 0;
-    }
-    if (parsed.schemaVersion !== 2 || typeof parsed.authSessionId !== "string" || typeof parsed.provider !== "string" || typeof parsed.userId !== "string" || typeof parsed.conversationId !== "string" || typeof parsed.sessionId !== "string" || typeof parsed.userMessage !== "string" || typeof parsed.createdAtMs !== "number" || typeof parsed.updatedAtMs !== "number") {
-      return void 0;
-    }
-    const destination = parsed.destination === void 0 ? void 0 : parseDestination(parsed.destination);
-    if (parsed.destination !== void 0 && !destination) {
-      return void 0;
-    }
-    const source = parsed.source === void 0 ? void 0 : sourceSchema.safeParse(parsed.source);
-    if (parsed.source !== void 0 && (!source || !source.success)) {
-      return void 0;
-    }
-    return {
-      schemaVersion: 2,
-      authSessionId: parsed.authSessionId,
-      provider: parsed.provider,
-      userId: parsed.userId,
-      conversationId: parsed.conversationId,
-      ...destination ? { destination } : void 0,
-      ...source?.success ? { source: source.data } : void 0,
-      sessionId: parsed.sessionId,
-      userMessage: parsed.userMessage,
-      createdAtMs: parsed.createdAtMs,
-      updatedAtMs: parsed.updatedAtMs,
-      ...typeof parsed.channelId === "string" ? { channelId: parsed.channelId } : void 0,
-      ...typeof parsed.threadTs === "string" ? { threadTs: parsed.threadTs } : void 0,
-      ...typeof parsed.toolChannelId === "string" ? { toolChannelId: parsed.toolChannelId } : void 0,
-      ...isRecord(parsed.configuration) ? { configuration: parsed.configuration } : void 0,
-      ...typeof parsed.authorizationUrl === "string" ? { authorizationUrl: parsed.authorizationUrl } : void 0,
-      ...typeof parsed.codeVerifier === "string" ? { codeVerifier: parsed.codeVerifier } : void 0
-    };
-  } catch {
-    return void 0;
-  }
-}
-function parseServerSession(value) {
-  if (typeof value !== "string") {
-    return void 0;
-  }
-  try {
-    const parsed = JSON.parse(value);
-    if (!isRecord(parsed) || typeof parsed.sessionId !== "string" || typeof parsed.updatedAtMs !== "number") {
-      return void 0;
-    }
-    return {
-      sessionId: parsed.sessionId,
-      updatedAtMs: parsed.updatedAtMs
-    };
-  } catch {
-    return void 0;
-  }
-}
-function parseStoredCredentials(value) {
-  if (typeof value !== "string") {
-    return void 0;
-  }
-  try {
-    const parsed = JSON.parse(value);
-    if (!isRecord(parsed)) {
-      return void 0;
-    }
-    return {
-      ...isRecord(parsed.clientInformation) ? {
-        clientInformation: parsed.clientInformation
-      } : void 0,
-      ...isRecord(parsed.discoveryState) ? {
-        // @ts-expect-error non-overlapping boundary cast; rule forbids as-unknown-as chains
-        discoveryState: parsed.discoveryState
-      } : void 0,
-      ...isRecord(parsed.tokens) ? { tokens: parsed.tokens } : void 0
-    };
-  } catch {
-    return void 0;
-  }
-}
-async function getConnectedStateAdapter() {
-  const stateAdapter = getStateAdapter();
-  await stateAdapter.connect();
-  return stateAdapter;
-}
-async function getMcpAuthSession(authSessionId) {
-  const stateAdapter = await getConnectedStateAdapter();
-  return parseMcpAuthSession(await stateAdapter.get(sessionKey(authSessionId)));
-}
-async function putMcpAuthSession(session, ttlMs = MCP_AUTH_SESSION_TTL_MS) {
-  const stateAdapter = await getConnectedStateAdapter();
-  await stateAdapter.set(
-    sessionKey(session.authSessionId),
-    JSON.stringify(session),
-    ttlMs
-  );
-  const nextIndex = parseSessionIndex(
-    await stateAdapter.get(sessionIndexKey(session.userId, session.provider))
-  );
-  if (!nextIndex.includes(session.authSessionId)) {
-    nextIndex.push(session.authSessionId);
-  }
-  await stateAdapter.set(
-    sessionIndexKey(session.userId, session.provider),
-    JSON.stringify(nextIndex),
-    ttlMs
-  );
-}
-async function patchMcpAuthSession(authSessionId, patch) {
-  const current = await getMcpAuthSession(authSessionId);
-  if (!current) {
-    throw new Error(`Unknown MCP auth session: ${authSessionId}`);
-  }
-  const next = {
-    ...current,
-    ...patch,
-    schemaVersion: 2,
-    authSessionId: current.authSessionId,
-    provider: current.provider,
-    userId: current.userId,
-    conversationId: current.conversationId,
-    ...current.destination ? { destination: current.destination } : void 0,
-    sessionId: current.sessionId,
-    userMessage: current.userMessage,
-    createdAtMs: current.createdAtMs,
-    updatedAtMs: Date.now()
-  };
-  await putMcpAuthSession(next);
-  return next;
-}
-async function deleteMcpAuthSession(authSessionId) {
-  const stateAdapter = await getConnectedStateAdapter();
-  const current = parseMcpAuthSession(
-    await stateAdapter.get(sessionKey(authSessionId))
-  );
-  await stateAdapter.delete(sessionKey(authSessionId));
-  if (!current) {
-    return;
-  }
-  const nextIndex = parseSessionIndex(
-    await stateAdapter.get(sessionIndexKey(current.userId, current.provider))
-  ).filter((id) => id !== authSessionId);
-  if (nextIndex.length > 0) {
-    await stateAdapter.set(
-      sessionIndexKey(current.userId, current.provider),
-      JSON.stringify(nextIndex),
-      MCP_AUTH_SESSION_TTL_MS
-    );
-    return;
-  }
-  await stateAdapter.delete(sessionIndexKey(current.userId, current.provider));
-}
-async function deleteMcpAuthSessionsForUserProvider(userId, provider) {
-  const stateAdapter = await getConnectedStateAdapter();
-  const indexKey = sessionIndexKey(userId, provider);
-  const authSessionIds = parseSessionIndex(await stateAdapter.get(indexKey));
-  for (const authSessionId of authSessionIds) {
-    await stateAdapter.delete(sessionKey(authSessionId));
-  }
-  await stateAdapter.delete(indexKey);
-}
-async function getMcpStoredOAuthCredentials(userId, provider) {
-  const stateAdapter = await getConnectedStateAdapter();
-  return parseStoredCredentials(
-    await stateAdapter.get(credentialsKey(userId, provider))
-  );
-}
-async function putMcpStoredOAuthCredentials(userId, provider, value, ttlMs = MCP_AUTH_CREDENTIALS_TTL_MS) {
-  const stateAdapter = await getConnectedStateAdapter();
-  await stateAdapter.set(
-    credentialsKey(userId, provider),
-    JSON.stringify(value),
-    ttlMs
-  );
-}
-async function deleteMcpStoredOAuthCredentials(userId, provider) {
-  const stateAdapter = await getConnectedStateAdapter();
-  await stateAdapter.delete(credentialsKey(userId, provider));
-}
-async function getMcpServerSessionId(userId, provider) {
-  const stateAdapter = await getConnectedStateAdapter();
-  return parseServerSession(
-    await stateAdapter.get(serverSessionKey(userId, provider))
-  )?.sessionId;
-}
-async function putMcpServerSessionId(userId, provider, sessionId, ttlMs = MCP_SERVER_SESSION_TTL_MS) {
-  const stateAdapter = await getConnectedStateAdapter();
-  await stateAdapter.set(
-    serverSessionKey(userId, provider),
-    JSON.stringify({
-      sessionId,
-      updatedAtMs: Date.now()
-    }),
-    ttlMs
-  );
-}
-async function deleteMcpServerSessionId(userId, provider) {
-  const stateAdapter = await getConnectedStateAdapter();
-  await stateAdapter.delete(serverSessionKey(userId, provider));
-}
-
-// src/chat/mcp/oauth.ts
-import { randomUUID } from "crypto";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-
-// src/chat/mcp/oauth-provider.ts
-function createClientMetadata(callbackUrl) {
-  return {
-    client_name: "Junior MCP Client",
-    redirect_uris: [callbackUrl],
-    grant_types: ["authorization_code", "refresh_token"],
-    response_types: ["code"],
-    token_endpoint_auth_method: "none"
-  };
-}
-function clientAllowsRedirectUri(clientInformation, callbackUrl) {
-  const redirectUris = clientInformation.redirect_uris;
-  if (!Array.isArray(redirectUris)) {
-    return true;
-  }
-  return redirectUris.includes(callbackUrl);
-}
-var StateBackedMcpOAuthClientProvider = class {
-  constructor(authSessionId, callbackUrl, sessionContext, runCredentialMutation) {
-    this.authSessionId = authSessionId;
-    this.callbackUrl = callbackUrl;
-    this.sessionContext = sessionContext;
-    this.runCredentialMutation = runCredentialMutation;
-    this.clientMetadata = createClientMetadata(callbackUrl);
-  }
-  authSessionId;
-  callbackUrl;
-  sessionContext;
-  runCredentialMutation;
-  clientMetadata;
-  get redirectUrl() {
-    return this.callbackUrl;
-  }
-  async state() {
-    return this.authSessionId;
-  }
-  async clientInformation() {
-    const session = await this.getCredentialContext();
-    const credentials = await getMcpStoredOAuthCredentials(
-      session.userId,
-      session.provider
-    );
-    const clientInformation = credentials?.clientInformation;
-    if (!clientInformation) {
-      return void 0;
-    }
-    if (clientAllowsRedirectUri(clientInformation, this.callbackUrl)) {
-      return clientInformation;
-    }
-    return void 0;
-  }
-  async saveClientInformation(clientInformation) {
-    await this.mutateCredentials(async () => {
-      const session = await this.getCredentialContext();
-      const credentials = await getMcpStoredOAuthCredentials(
-        session.userId,
-        session.provider
-      ) ?? {};
-      await putMcpStoredOAuthCredentials(session.userId, session.provider, {
-        ...credentials,
-        clientInformation
-      });
-    });
-  }
-  async tokens() {
-    const session = await this.getCredentialContext();
-    const credentials = await getMcpStoredOAuthCredentials(
-      session.userId,
-      session.provider
-    );
-    return credentials?.tokens;
-  }
-  async saveTokens(tokens) {
-    await this.mutateCredentials(async () => {
-      const session = await this.getCredentialContext();
-      const credentials = await getMcpStoredOAuthCredentials(
-        session.userId,
-        session.provider
-      ) ?? {};
-      await putMcpStoredOAuthCredentials(session.userId, session.provider, {
-        ...credentials,
-        tokens
-      });
-    });
-  }
-  async redirectToAuthorization(authorizationUrl) {
-    const existing = await getMcpAuthSession(this.authSessionId);
-    if (existing?.authorizationUrl && existing.authorizationUrl !== authorizationUrl.toString()) {
-      throw new Error("MCP OAuth authorization attempt is already initialized");
-    }
-    await this.ensureSession({
-      authorizationUrl: authorizationUrl.toString()
-    });
-  }
-  async saveCodeVerifier(codeVerifier) {
-    const existing = await getMcpAuthSession(this.authSessionId);
-    if (existing?.codeVerifier && existing.codeVerifier !== codeVerifier) {
-      throw new Error("MCP OAuth authorization attempt is already initialized");
-    }
-    await this.ensureSession({ codeVerifier });
-  }
-  async codeVerifier() {
-    const session = await this.requireSession();
-    if (!session.codeVerifier) {
-      throw new Error("Missing MCP OAuth code verifier");
-    }
-    return session.codeVerifier;
-  }
-  async saveDiscoveryState(state) {
-    await this.mutateCredentials(async () => {
-      const session = await this.getCredentialContext();
-      const credentials = await getMcpStoredOAuthCredentials(
-        session.userId,
-        session.provider
-      ) ?? {};
-      await putMcpStoredOAuthCredentials(session.userId, session.provider, {
-        ...credentials,
-        discoveryState: state
-      });
-    });
-  }
-  async discoveryState() {
-    const session = await this.getCredentialContext();
-    const credentials = await getMcpStoredOAuthCredentials(
-      session.userId,
-      session.provider
-    );
-    return credentials?.discoveryState;
-  }
-  async invalidateCredentials(scope) {
-    await this.mutateCredentials(async () => {
-      const session = await this.getCredentialContext();
-      const credentials = await getMcpStoredOAuthCredentials(
-        session.userId,
-        session.provider
-      ) ?? {};
-      await putMcpStoredOAuthCredentials(session.userId, session.provider, {
-        ...scope === "tokens" || scope === "all" ? void 0 : credentials.tokens ? { tokens: credentials.tokens } : {},
-        ...scope === "client" || scope === "all" ? void 0 : credentials.clientInformation ? { clientInformation: credentials.clientInformation } : {},
-        ...scope === "discovery" || scope === "all" ? void 0 : credentials.discoveryState ? { discoveryState: credentials.discoveryState } : {}
-      });
-    });
-  }
-  async getMcpServerSessionId() {
-    const session = await this.getCredentialContext();
-    return await getMcpServerSessionId(session.userId, session.provider);
-  }
-  async saveMcpServerSessionId(sessionId) {
-    await this.mutateCredentials(async () => {
-      const session = await this.getCredentialContext();
-      if (!sessionId) {
-        await deleteMcpServerSessionId(session.userId, session.provider);
-        return;
-      }
-      await putMcpServerSessionId(session.userId, session.provider, sessionId);
-    });
-  }
-  /** Route shared credential writes through callback-owned freshness control. */
-  async mutateCredentials(mutation) {
-    return this.runCredentialMutation ? await this.runCredentialMutation(mutation) : await mutation();
-  }
-  async getCredentialContext() {
-    return this.sessionContext ?? await this.requireSession();
-  }
-  async ensureSession(patch) {
-    const existing = await getMcpAuthSession(this.authSessionId);
-    if (existing) {
-      return await patchMcpAuthSession(this.authSessionId, patch);
-    }
-    if (!this.sessionContext) {
-      throw new Error(`Unknown MCP auth session: ${this.authSessionId}`);
-    }
-    const now = Date.now();
-    const nextSession = {
-      schemaVersion: 2,
-      authSessionId: this.authSessionId,
-      ...this.sessionContext,
-      ...patch,
-      createdAtMs: now,
-      updatedAtMs: now
-    };
-    await putMcpAuthSession(nextSession);
-    return nextSession;
-  }
-  async requireSession() {
-    const session = await getMcpAuthSession(this.authSessionId);
-    if (!session) {
-      throw new Error(`Unknown MCP auth session: ${this.authSessionId}`);
-    }
-    return session;
-  }
-};
-
-// src/chat/mcp/oauth.ts
-function getMcpOAuthCallbackPath(provider) {
-  return `/api/oauth/callback/mcp/${provider}`;
-}
-function requirePluginWithMcp(provider) {
-  const plugin = pluginCatalogRuntime.getDefinition(provider);
-  if (!plugin?.manifest.mcp) {
-    throw new Error(`Plugin "${provider}" does not support MCP`);
-  }
-  return plugin;
-}
-async function createMcpOAuthClientProvider(input) {
-  requirePluginWithMcp(input.provider);
-  const baseUrl = resolveBaseUrl();
-  if (!baseUrl) {
-    throw new Error(
-      "Cannot determine base URL (set JUNIOR_BASE_URL or deploy to Vercel)"
-    );
-  }
-  const authSessionId = input.createAuthorizationState ? await input.createAuthorizationState() : randomUUID();
-  return new StateBackedMcpOAuthClientProvider(
-    authSessionId,
-    `${baseUrl}${getMcpOAuthCallbackPath(input.provider)}`,
-    {
-      provider: input.provider,
-      userId: input.userId,
-      conversationId: input.conversationId,
-      ...input.destination ? { destination: input.destination } : void 0,
-      ...input.source ? { source: input.source } : void 0,
-      sessionId: input.sessionId,
-      userMessage: input.userMessage,
-      ...input.channelId ? { channelId: input.channelId } : void 0,
-      ...input.threadTs ? { threadTs: input.threadTs } : void 0,
-      ...input.toolChannelId ? { toolChannelId: input.toolChannelId } : void 0,
-      ...input.configuration ? { configuration: input.configuration } : void 0
-    }
-  );
-}
-async function finalizeMcpAuthorization(provider, authSessionId, authorizationCode, runCredentialMutation) {
-  const plugin = requirePluginWithMcp(provider);
-  const mcp = plugin.manifest.mcp;
-  if (!mcp) {
-    throw new Error(`Plugin "${provider}" does not support MCP`);
-  }
-  const session = await getMcpAuthSession(authSessionId);
-  if (!session) {
-    throw new Error(`Unknown MCP auth session: ${authSessionId}`);
-  }
-  if (session.provider !== provider) {
-    throw new Error(
-      `MCP auth session provider mismatch: expected "${provider}", got "${session.provider}"`
-    );
-  }
-  const baseUrl = resolveBaseUrl();
-  if (!baseUrl) {
-    throw new Error(
-      "Cannot determine base URL (set JUNIOR_BASE_URL or deploy to Vercel)"
-    );
-  }
-  const callbackUrl = `${baseUrl}${getMcpOAuthCallbackPath(provider)}`;
-  const authProvider = new StateBackedMcpOAuthClientProvider(
-    authSessionId,
-    callbackUrl,
-    void 0,
-    runCredentialMutation
-  );
-  const requestInit = {};
-  if (mcp.headers && Object.keys(mcp.headers).length > 0) {
-    requestInit.headers = new Headers(mcp.headers);
-  }
-  let providerStatus2;
-  const transport = new StreamableHTTPClientTransport(new URL(mcp.url), {
-    ...Object.keys(requestInit).length > 0 ? { requestInit } : void 0,
-    authProvider,
-    fetch: fetchWithBoundedOAuthErrorBodies(void 0, (status) => {
-      providerStatus2 = status;
-    })
-  });
-  let failure;
-  try {
-    await transport.finishAuth(authorizationCode);
-  } catch (error) {
-    failure = toMcpProviderError(error, {
-      phase: "oauth_callback",
-      provider,
-      resourceHost: new URL(mcp.url).hostname,
-      status: providerStatus2
-    });
-  }
-  try {
-    await transport.close();
-  } catch (error) {
-    failure ??= toMcpProviderError(error, {
-      phase: "oauth_callback",
-      provider,
-      resourceHost: new URL(mcp.url).hostname
-    });
-  }
-  if (failure) {
-    throw failure;
-  }
-  const nextSession = await getMcpAuthSession(authSessionId);
-  if (!nextSession) {
-    throw new Error(`Unknown MCP auth session: ${authSessionId}`);
-  }
-  return nextSession;
-}
-
-export {
-  createUserTokenStore,
-  issueProviderCredentialLease,
-  McpProviderError,
-  toMcpProviderError,
-  getMcpProviderErrorAttributes,
-  McpToolError,
-  getMcpAwareErrorType,
-  getMcpAwareTelemetryMessage,
-  lookupSlackUserProfile,
-  lookupSlackUserByEmail,
-  searchSlackUsers,
-  selectPluginGrant,
-  onPluginEgressResponse,
-  hasEgressCredentialHooks,
-  getOAuthAccountProviders,
-  resolvePluginOAuthAccount,
-  issuePluginCredential,
-  getMcpAuthSession,
-  patchMcpAuthSession,
-  deleteMcpAuthSession,
-  deleteMcpAuthSessionsForUserProvider,
-  getMcpStoredOAuthCredentials,
-  putMcpStoredOAuthCredentials,
-  deleteMcpStoredOAuthCredentials,
-  deleteMcpServerSessionId,
-  createMcpOAuthClientProvider,
-  finalizeMcpAuthorization
-};