@sentry/junior 0.256.0 → 0.258.0

package/dist/{client-BVrAp-pq.js → client-DbyHuMFU.js}

@@ -1,11 +1,11 @@
-import { d as logException, g as serializeGenAiAttribute, i as extractGenAiUsageAttributes, m as normalizeGenAiFinishReason, p as logWarn, w as withSpan } from "./logging-tPQeUe2i.js";
-import { a as toCanonicalInputMessage, n as getCurrentConversationPrivacy, o as toCanonicalOutputMessage, s as toGenAiMessagesTraceAttributes } from "./conversation-privacy-CpSYOWnP.js";
+import { T as withSpan, _ as serializeGenAiAttribute, f as logException, h as normalizeGenAiFinishReason, i as extractGenAiUsageAttributes, m as logWarn } from "./logging-DsHONhVm.js";
+import { a as toCanonicalInputMessage, n as getCurrentConversationPrivacy, o as toCanonicalOutputMessage, s as toGenAiMessagesTraceAttributes } from "./conversation-privacy-DHP_xnVj.js";
 import { calculateCost, completeSimple, getEnvApiKey, getModels, registerApiProvider } from "@earendil-works/pi-ai/compat";
 import { stream as streamAnthropic, streamSimple as streamSimpleAnthropic } from "@earendil-works/pi-ai/api/anthropic-messages";
 import { createGatewayProvider } from "@ai-sdk/gateway";
 import { getVercelOidcToken } from "@vercel/oidc";
 import { NoObjectGeneratedError, embedMany, generateObject } from "ai";
-//#region src/chat/optional-string.ts
+// src/chat/optional-string.ts
 /**
 * Normalize optional env-style strings so blank values do not masquerade as
 * configured inputs.
@@ -15,8 +15,7 @@ function toOptionalTrimmed(value) {
 	const trimmed = value.trim();
 	return trimmed.length > 0 ? trimmed : void 0;
 }
-//#endregion
-//#region src/chat/pi/gateway-auth.ts
+// src/chat/pi/gateway-auth.ts
 /**
 * AI Gateway credential resolution for every Junior model path.
 *
@@ -51,8 +50,7 @@ async function resolveGatewayCredential() {
 async function getGatewayApiKey() {
 	return (await resolveGatewayCredential())?.token;
 }
-//#endregion
-//#region src/chat/services/provider-error.ts
+// src/chat/services/provider-error.ts
 /** Structured failure produced at an AI provider boundary. */
 var ProviderError = class extends Error {
 	code = "provider_error";
@@ -227,8 +225,7 @@ function getProviderErrorAttributes(error) {
 		...error.modelId ? { "gen_ai.request.model": error.modelId } : void 0
 	};
 }
-//#endregion
-//#region src/chat/xml.ts
+// src/chat/xml.ts
 function escapeXml(value) {
 	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&apos;");
 }
@@ -236,8 +233,7 @@ function escapeXml(value) {
 function unescapeXml(value) {
 	return value.replaceAll("&quot;", "\"").replaceAll("&apos;", "'").replaceAll("&gt;", ">").replaceAll("&lt;", "<").replaceAll("&amp;", "&");
 }
-//#endregion
-//#region src/chat/current-instruction.ts
+// src/chat/current-instruction.ts
 const CURRENT_INSTRUCTION_TAG = "current-instruction";
 const CURRENT_INSTRUCTION_OPEN_PREFIX = `<${CURRENT_INSTRUCTION_TAG}`;
 const CURRENT_INSTRUCTION_OPEN_BARE = `<${CURRENT_INSTRUCTION_TAG}>`;
@@ -275,8 +271,7 @@ function unwrapCurrentInstruction(text) {
 	const body = readCurrentInstructionBody(text);
 	return body === void 0 ? void 0 : unescapeXml(body);
 }
-//#endregion
-//#region src/chat/services/context-compaction-marker.ts
+// src/chat/services/context-compaction-marker.ts
 const COMPACTION_SUMMARY_PREFIX = "Another language model started to solve this problem and produced a summary of its thinking process. You also have access to the state of the tools that were used by that language model. Use this to build on the work that has already been done and avoid duplicating work. Here is the summary produced by the other language model, use the information in this summary to assist with your own analysis:";
 /** Return whether text is one of Junior's durable compacted-context markers. */
 function isCompactionSummaryText(text) {
@@ -292,8 +287,7 @@ function hasCompactedConversationContext(messages) {
 		return content.some((part) => part && typeof part === "object" && part.type === "text" && typeof part.text === "string" && isCompactionSummaryText(part.text));
 	});
 }
-//#endregion
-//#region src/chat/pi/client.ts
+// src/chat/pi/client.ts
 registerApiProvider({
 	api: "anthropic-messages",
 	stream: streamAnthropic,
@@ -671,5 +665,4 @@ async function embedTexts(params) {
 		throw providerError;
 	}
 }
-//#endregion
 export { toOptionalTrimmed as S, getProviderErrorUserMessage as _, embedTexts as a, getGatewayApiKey as b, hasCompactedConversationContext as c, unwrapCurrentInstruction as d, escapeXml as f, getProviderErrorAttributes as g, findProviderError as h, completeText as i, isCompactionSummaryText as l, createProviderError as m, GEN_AI_SERVER_ADDRESS as n, resolveGatewayModel as o, ProviderError as p, completeObject as r, COMPACTION_SUMMARY_PREFIX as s, GEN_AI_PROVIDER_NAME as t, renderCurrentInstruction as u, isProviderRetryError as v, resolveGatewayCredential as x, MISSING_GATEWAY_CREDENTIALS_ERROR as y };

package/dist/{config-DdBiDanf.js → config-_WO_AjCB.js}

@@ -1,8 +1,8 @@
-import { t as __exportAll } from "./rolldown-runtime-B4FMCO8f.js";
-import { S as toOptionalTrimmed, o as resolveGatewayModel } from "./client-BVrAp-pq.js";
-import { p as logWarn } from "./logging-tPQeUe2i.js";
-import { l as TURN_REASONING_LEVELS, s as modelProfileSchema, t as DEFAULT_MODEL_PROFILES, u as parseTurnReasoningLevel } from "./model-profile-BwU8mqwD.js";
-//#region src/chat/slack/emoji.ts
+import { t as __exportAll } from "./rolldown-runtime-nwUcYXjP.js";
+import { S as toOptionalTrimmed, o as resolveGatewayModel } from "./client-DbyHuMFU.js";
+import { m as logWarn } from "./logging-DsHONhVm.js";
+import { l as TURN_REASONING_LEVELS, s as modelProfileSchema, t as DEFAULT_MODEL_PROFILES, u as parseTurnReasoningLevel } from "./model-profile-Bg8EoCKD.js";
+// src/chat/slack/emoji.ts
 const SLACK_EMOJI_NAME_RE = /^(?:[a-z0-9_+-]+)(?:::(?:skin-tone-[2-6]))?$/;
 function normalizeSlackEmojiName(value) {
 	const trimmed = value.trim().toLowerCase();
@@ -10,8 +10,7 @@ function normalizeSlackEmojiName(value) {
 	const normalized = trimmed.startsWith(":") && trimmed.endsWith(":") ? trimmed.slice(1, -1) : trimmed;
 	return SLACK_EMOJI_NAME_RE.test(normalized) ? normalized : null;
 }
-//#endregion
-//#region src/chat/config.ts
+// src/chat/config.ts
 var config_exports = /* @__PURE__ */ __exportAll({
 	CONVERSATION_WORK_SOFT_YIELD_BUFFER_SECONDS: () => 40,
 	DEFAULT_SQL_STATEMENT_TIMEOUT_MS: () => DEFAULT_SQL_STATEMENT_TIMEOUT_MS,
@@ -60,12 +59,14 @@ const MAX_TOOL_CALLS_PER_TURN = 1e3;
 */
 const MAX_CONSECUTIVE_AUTOMATED_TURNS = 25;
 /**
-* Max runs one Event automation can start in a rolling hour. Each run is a
-* full agent turn, and Event automations skip the consecutive automated-turn
-* limit. Kept low so a broad trigger, such as every message in a channel,
-* blocks quickly instead of starting a turn for each Event.
+* Max runs one Event automation can start in one rolling run window. Each run
+* is a full agent turn, and Event automations skip the consecutive
+* automated-turn limit. Kept low so a broad trigger, such as every message in
+* a channel, blocks quickly instead of starting a turn for each Event.
 */
-const MAX_EVENT_AUTOMATION_RUNS_PER_HOUR = 10;
+const MAX_EVENT_AUTOMATION_RUNS = 10;
+/** Length of the rolling window for the Event automation run limit. */
+const EVENT_AUTOMATION_RUN_WINDOW_MS = 6e4;
 const DEFAULT_FUNCTION_MAX_DURATION_SECONDS = 300;
 const DEFAULT_SLACK_SLASH_COMMAND = "/jr";
 const DEFAULT_PROCESSING_REACTION_EMOJI = "eyes";
@@ -270,7 +271,8 @@ function readBotConfig(env, functionMaxDurationSeconds) {
 		maxToolCallsPerTurn: MAX_TOOL_CALLS_PER_TURN,
 		maxTurnCostUsd: MAX_TURN_COST_USD,
 		maxConsecutiveAutomatedTurns: MAX_CONSECUTIVE_AUTOMATED_TURNS,
-		maxEventAutomationRunsPerHour: MAX_EVENT_AUTOMATION_RUNS_PER_HOUR,
+		maxEventAutomationRuns: MAX_EVENT_AUTOMATION_RUNS,
+		eventAutomationRunWindowMs: EVENT_AUTOMATION_RUN_WINDOW_MS,
 		turnTimeoutMs: parseAgentTurnTimeoutMs(env.AGENT_TURN_TIMEOUT_MS, maxTurnTimeoutMs),
 		webSearchModelId: validateGatewayModelId(env.AI_WEB_SEARCH_MODEL) ?? DEFAULT_WEB_SEARCH_MODEL_ID
 	};
@@ -384,7 +386,9 @@ function setRuntimeLimits(limits) {
 		bot.maxAgentDepth = limits.maxAgentDepth;
 	}
 	if (limits?.maxConsecutiveAutomatedTurns !== void 0) bot.maxConsecutiveAutomatedTurns = requirePositiveLimit("maxConsecutiveAutomatedTurns", limits.maxConsecutiveAutomatedTurns);
-	if (limits?.maxEventAutomationRunsPerHour !== void 0) bot.maxEventAutomationRunsPerHour = requirePositiveLimit("maxEventAutomationRunsPerHour", limits.maxEventAutomationRunsPerHour);
+	const runLimit = limits?.eventAutomationRunLimit;
+	if (runLimit?.maxRuns !== void 0) bot.maxEventAutomationRuns = requirePositiveLimit("eventAutomationRunLimit.maxRuns", runLimit.maxRuns);
+	if (runLimit?.windowMs !== void 0) bot.eventAutomationRunWindowMs = requirePositiveLimit("eventAutomationRunLimit.windowMs", runLimit.windowMs);
 	if (limits?.maxSlicesPerTurn !== void 0) bot.maxSlicesPerTurn = requirePositiveLimit("maxSlicesPerTurn", limits.maxSlicesPerTurn);
 	if (limits?.maxToolCallsPerTurn !== void 0) bot.maxToolCallsPerTurn = requirePositiveLimit("maxToolCallsPerTurn", limits.maxToolCallsPerTurn);
 	if (limits?.maxTurnCostUsd !== void 0) bot.maxTurnCostUsd = requirePositiveLimit("maxTurnCostUsd", limits.maxTurnCostUsd);
@@ -440,5 +444,4 @@ function setSlackReactionConfig(overrides) {
 	if (overrides.processingReactionEmoji !== void 0) chatConfig.slack.processingReactionEmoji = parseReactionEmoji("processingReactionEmoji", overrides.processingReactionEmoji, chatConfig.slack.processingReactionEmoji);
 	if (overrides.completedReactionEmoji !== void 0) chatConfig.slack.completedReactionEmoji = parseReactionEmoji("completedReactionEmoji", overrides.completedReactionEmoji, chatConfig.slack.completedReactionEmoji);
 }
-//#endregion
 export { snapshotRuntimeConfig as _, getRuntimeMetadata as a, getSlackClientSecret as c, restoreRuntimeConfig as d, setBotModelConfig as f, setSlackReactionConfig as g, setRuntimeLimits as h, getChatConfig as i, getSlackSigningSecret as l, setProfiles as m, botConfig as n, getSlackBotToken as o, setCrossActorMidRunMode as p, config_exports as r, getSlackClientId as s, DEFAULT_SQL_STATEMENT_TIMEOUT_MS as t, resetRuntimeConfig as u, normalizeSlackEmojiName as v };

package/dist/{connections-CG04HdpC.js → connections-ag_1JOhB.js}

@@ -1,15 +1,15 @@
-import { It as startOAuthFlow, c as deleteMcpAuthSessionsForUserProvider, l as deleteMcpServerSessionId, u as deleteMcpStoredOAuthCredentials } from "./agent-runner-C6_cd61V.js";
-import { D as deleteProviderIdentityForSlackUser, c as getConversationEventStore, f as getSqlExecutor } from "./viewer-C-9nFKYr.js";
-import { u as hasRequiredOAuthScope } from "./registry-CsNavQ_Z.js";
-import { n as pluginCatalogRuntime } from "./catalog-runtime-DF5OWqCc.js";
-import { G as loadTurnCheckpoint, X as getTurnRecord, Y as failTurnRecord } from "./tasks-CODtRzvX.js";
-import { w as getStateAdapter } from "./profile-Bb1zCVGP.js";
-import { a as getVercelConversationWorkQueue } from "./job-queue-BbGg3gvu.js";
-import { m as ensureConversationWake, w as requestConversationWork } from "./store-D2It0ozF.js";
-import { n as resolveTurnSessionRouting } from "./turn-session-routing-BcWM3PLm.js";
+import { It as startOAuthFlow, c as deleteMcpAuthSessionsForUserProvider, l as deleteMcpServerSessionId, u as deleteMcpStoredOAuthCredentials } from "./agent-runner-DGsFQw72.js";
+import { A as deleteProviderIdentityForUser, c as getConversationEventStore, f as getSqlExecutor, k as deleteProviderIdentityForSlackUser } from "./viewer-CGvvRqKp.js";
+import { u as hasRequiredOAuthScope } from "./registry-Du566MtJ.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-BN4DVxco.js";
+import { K as loadTurnCheckpoint, X as failTurnRecord, Z as getTurnRecord } from "./tasks-CEXKTASS.js";
+import { w as getStateAdapter } from "./profile-DpYjfKke.js";
+import { a as getVercelConversationWorkQueue } from "./job-queue-DVe37it2.js";
+import { m as ensureConversationWake, w as requestConversationWork } from "./store-DJLwq4x8.js";
+import { n as resolveTurnSessionRouting } from "./turn-session-routing-CUxtfpr7.js";
 import { z } from "zod";
 import { randomBytes, randomUUID } from "node:crypto";
-//#region src/chat/task-execution/authorized-turn.ts
+// src/chat/task-execution/authorized-turn.ts
 /**
 * OAuth callbacks save readiness, not agent history. The conversation worker
 * consumes this event under its lease before it resumes the paused Turn.
@@ -56,8 +56,7 @@ async function getTurnAuthorization(turn) {
 	if (event?.data.type !== "structured_event") return void 0;
 	return authorizationSchema.parse(event.data.content);
 }
-//#endregion
-//#region src/chat/task-execution/turn-wake.ts
+// src/chat/task-execution/turn-wake.ts
 /** Build the worker input for a paused turn. */
 async function getPausedTurnRequest(args) {
 	const turn = (await loadTurnCheckpoint({
@@ -126,8 +125,7 @@ async function wakeAuthorizedTurn(args, queue) {
 	const request = await recordTurnAuthorization(args);
 	if (request) await wakePausedTurn(request, { queue });
 }
-//#endregion
-//#region src/chat/conversations/web-authorization.ts
+// src/chat/conversations/web-authorization.ts
 const WEB_AUTHORIZATION_PREFIX = "junior:web_authorization:v1";
 const WEB_AUTHORIZATION_TTL_MS = 864e5;
 function authorizationKey(conversationId, actorId) {
@@ -161,8 +159,7 @@ async function getWebAuthorization(args) {
 async function deleteWebAuthorization(args) {
 	await getStateAdapter().delete(authorizationKey(args.conversationId, args.actorId));
 }
-//#endregion
-//#region src/chat/credentials/unlink-provider.ts
+// src/chat/credentials/unlink-provider.ts
 /** Remove one provider connection and its exact stored account identity. */
 async function unlinkProvider(userId, provider, userTokenStore, slackTeamId) {
 	const tokens = await userTokenStore.get(userId, provider);
@@ -174,8 +171,7 @@ async function unlinkProvider(userId, provider, userTokenStore, slackTeamId) {
 		deleteMcpAuthSessionsForUserProvider(userId, provider)
 	]);
 }
-//#endregion
-//#region src/chat/credentials/connections.ts
+// src/chat/credentials/connections.ts
 /** Return stored OAuth tokens only when they still carry the manifest scope. */
 async function readConnectedOAuthTokens(userId, plugin, userTokenStore) {
 	if (!plugin.manifest.oauth && !plugin.manifest.credentials) return;
@@ -231,9 +227,13 @@ async function startConnection(provider, actor) {
 		authorizationUrl: request.authorizationUrl
 	};
 }
-/** Remove the user's stored connection for one provider. */
-async function disconnectConnection(userId, provider, userTokenStore) {
+/**
+* Remove the user's stored connection for one provider and the provider
+* identity that the connection linked to the viewer's user.
+*/
+async function disconnectConnection(userId, provider, userTokenStore, viewerUserId) {
+	const tokens = await userTokenStore.get(userId, provider);
+	if (tokens?.account) await deleteProviderIdentityForUser(getSqlExecutor(), viewerUserId, provider, tokens.account.id);
 	await unlinkProvider(userId, provider, userTokenStore);
 }
-//#endregion
 export { startConnection as a, deleteWebAuthorization as c, getPausedTurnRequest as d, wakeAuthorizedTurn as f, readConnectedOAuthTokens as i, getWebAuthorization as l, getTurnAuthorization as m, isConnectableProvider as n, unlinkProvider as o, wakePausedTurn as p, listConnections as r, createWebAuthorization as s, disconnectConnection as t, createPausedTurns as u };

package/dist/{conversation-T18Xlkx9.js → conversation-DjN3mlog.js}

@@ -1,7 +1,7 @@
-import { a as conversationTurnFailureReasonSchema, h as usageSchema, i as conversationTurnFailureCodeSchema } from "./history-9pO1Zd4Y.js";
+import { a as conversationTurnFailureReasonSchema, h as usageSchema, i as conversationTurnFailureCodeSchema } from "./history-AY8rs-FR.js";
 import { z } from "zod";
 import { codeChangeStateSchema, conversationAnnotationInputSchema, conversationEventPresentationSchema, conversationSidebarAnnotationSchema, objectFactFields, objectTypeSchema } from "@sentry/junior-plugin-api";
-//#region src/chat/automations/card.ts
+// src/chat/automations/card.ts
 /** Saved automation facts shown with a Message, not a live status view. */
 const automationCardSchema = z.object({
 	kind: z.literal("automation"),
@@ -23,8 +23,7 @@ function automationCardText(card) {
 		`Automation ID: ${card.id}`
 	].filter(Boolean).join("\n");
 }
-//#endregion
-//#region src/chat/conversations/cards.ts
+// src/chat/conversations/cards.ts
 const storedCardSchema = automationCardSchema.extend({ operation: z.enum([
 	"created",
 	"updated",
@@ -93,8 +92,7 @@ function annotationCard(annotation) {
 		title: value.label
 	};
 }
-//#endregion
-//#region src/chat/briefs/schema.ts
+// src/chat/briefs/schema.ts
 /**
 * Runtime schemas for the Brief record and the generator input. Both cross a
 * durable or CLI edge, so these schemas own the exported types.
@@ -211,8 +209,7 @@ function parseBriefInput(input) {
 		entries: [...parsed.entries].sort((left, right) => left.index - right.index || left.createdAtMs - right.createdAtMs)
 	};
 }
-//#endregion
-//#region src/chat/attachments/media.ts
+// src/chat/attachments/media.ts
 const INPUT_IMAGE_TYPES = [
 	"image/png",
 	"image/jpeg",
@@ -294,8 +291,7 @@ function isVisionImageMediaType(mediaType) {
 	const normalized = mediaType.split(";", 1)[0]?.trim().toLowerCase();
 	return normalized ? INPUT_IMAGE_TYPES.some((type) => type === normalized) : false;
 }
-//#endregion
-//#region src/chat/attachments/input.ts
+// src/chat/attachments/input.ts
 /** Bound JSON image input below the hosting platform's request size limit. */
 const MAX_INPUT_IMAGE_BYTES = 3145728;
 const MAX_INPUT_IMAGES = 3;
@@ -316,8 +312,7 @@ const messageAttachmentSchema = z.object({
 function readMessageAttachments(value) {
 	return messageAttachmentSchema.array().parse(value ?? []);
 }
-//#endregion
-//#region src/api/schema/child-agent-totals.ts
+// src/api/schema/child-agent-totals.ts
 /**
 * The part of a Conversation total that its child agents spent, at any depth.
 * Present only when the Conversation has child agents. The Conversation's own
@@ -329,8 +324,7 @@ const conversationChildAgentTotalsSchema = z.object({
 	cumulativeDurationMs: z.number(),
 	cumulativeUsage: usageSchema.optional()
 }).strict();
-//#endregion
-//#region src/api/schema/conversation.ts
+// src/api/schema/conversation.ts
 const conversationReportStatusSchema = z.enum([
 	"active",
 	"completed",
@@ -528,6 +522,7 @@ const conversationReportMessageEventDataSchema = z.object({
 	]),
 	source: z.enum(["slack", "web"]).optional(),
 	actorIdentity: actorIdentitySchema.optional(),
+	mentions: z.array(actorIdentitySchema).optional(),
 	eventType: z.string().min(1).optional(),
 	eventObjectType: objectTypeSchema.optional(),
 	explicitMention: z.boolean().optional(),
@@ -541,9 +536,9 @@ const conversationReportMessageEventDataSchema = z.object({
 		code: "custom",
 		message: "message content must be text or explicitly redacted"
 	});
-	if (data.redacted && (data.actorIdentity || data.cards || data.attachments)) context.addIssue({
+	if (data.redacted && (data.actorIdentity || data.mentions || data.cards || data.attachments)) context.addIssue({
 		code: "custom",
-		message: "redacted messages must not expose actor identity, cards, or attachments"
+		message: "redacted messages must not expose actor identity, mentions, cards, or attachments"
 	});
 });
 const conversationReportMessageHandledEventDataSchema = z.object({
@@ -959,5 +954,4 @@ const conversationStatsReportSchema = z.object({
 	windowEnd: z.string(),
 	windowStart: z.string()
 }).strict();
-//#endregion
 export { forkConversationBodySchema as A, briefLinkSchema as B, conversationReportEventSchema as C, conversationUsageSchema as D, conversationSummaryReportSchema as E, readMessageAttachments as F, messageCardRef as G, conversationBriefSchema as H, INPUT_IMAGE_TYPES as I, removedCardSchema as J, messageCardText as K, detectImageMediaType as L, conversationChildAgentTotalsSchema as M, MAX_INPUT_IMAGES as N, createConversationBodySchema as O, MAX_INPUT_IMAGE_BYTES as P, isVisionImageMediaType as R, conversationReportEventDataSchema as S, conversationStatsReportSchema as T, parseBriefInput as U, briefOutcomeStatusSchema as V, annotationCard as W, resolveMessageCards as Y, conversationParamsSchema as _, cancelConversationPendingMessagesBodySchema as a, conversationPendingMessageSchema as b, conversationAttachmentParamsSchema as c, conversationDetailReportSchema as d, conversationEventHistorySchema as f, conversationFeedSchema as g, conversationFeedQuerySchema as h, archiveConversationResponseSchema as i, forkConversationResponseSchema as j, createConversationMessageBodySchema as k, conversationAuxiliaryCostsSchema as l, conversationEventsQuerySchema as m, actorIdentitySchema as n, cancelConversationPendingMessagesResponseSchema as o, conversationEventPageSchema as p, readMessageCardRefs as q, archiveConversationBodySchema as r, conversationActivityPreviewSchema as s, acceptedConversationMessageSchema as t, conversationDetailQuerySchema as u, conversationPendingAuthorizationSchema as v, conversationStatsItemSchema as w, conversationPendingMessagesReportSchema as x, conversationPendingMessageDeliverySchema as y, briefCodeChangeSchema as z };

package/dist/{conversation-privacy-CpSYOWnP.js → conversation-privacy-DHP_xnVj.js}

@@ -1,6 +1,6 @@
-import { p as logWarn } from "./logging-tPQeUe2i.js";
+import { m as logWarn } from "./logging-DsHONhVm.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-//#region src/chat/conversation-privacy.ts
+// src/chat/conversation-privacy.ts
 const SAFE_METADATA_KEY_LIMIT = 20;
 const conversationPrivacyStorage = new AsyncLocalStorage();
 /**
@@ -178,5 +178,4 @@ function toGenAiMessagesTraceAttributes(prefix, messages) {
 		...partTypes.size > 0 ? { [`${prefix}.part_types`]: [...partTypes] } : void 0
 	};
 }
-//#endregion
 export { toCanonicalInputMessage as a, toGenAiPayloadMetadata as c, runWithConversationPrivacy as i, toGenAiPayloadTraceAttributes as l, getCurrentConversationPrivacy as n, toCanonicalOutputMessage as o, resolveConversationPrivacy as r, toGenAiMessagesTraceAttributes as s, canExposeConversationPayload as t };

package/dist/{conversation-work-C6y3T5Hx.js → conversation-work-BaT_T6EB.js}

@@ -1,4 +1,4 @@
-//#region src/chat/local/conversation-work.ts
+// src/chat/local/conversation-work.ts
 /**
 * Run local conversation work in this process and wait for every accepted wake.
 *
@@ -47,5 +47,4 @@ function createLocalConversationWork(processMessage) {
 		}
 	};
 }
-//#endregion
 export { createLocalConversationWork };

package/dist/{credential-sync-DKWNdcgm.js → credential-sync-B-CPX_ag.js}

@@ -1,26 +1,26 @@
-import { Ft as resolveBaseUrl, Lt as createUserTokenStore, Nt as formatProviderLabel, Pt as parseOAuthStatePayload, _ as resolvePluginOAuthAccount, d as getMcpAuthSession, f as getMcpStoredOAuthCredentials, o as finalizeMcpAuthorization, p as putMcpStoredOAuthCredentials, s as deleteMcpAuthSession, x as lookupSlackUserProfile, xt as getMcpProviderErrorAttributes } from "./agent-runner-C6_cd61V.js";
-import { f as escapeXml } from "./client-BVrAp-pq.js";
-import { d as logException, h as runBestEffort, p as logWarn } from "./logging-tPQeUe2i.js";
-import { a as getRuntimeMetadata, n as botConfig } from "./config-DdBiDanf.js";
-import { f as parseSlackUserId } from "./actor-BTtLaeWy.js";
-import { A as upsertIdentity, f as getSqlExecutor, j as upsertLinkedIdentity } from "./viewer-C-9nFKYr.js";
-import { i as homeDir } from "./package-discovery-BVvSnQBB.js";
-import { n as buildOAuthTokenRequest, r as parseOAuthTokenResponse, u as hasRequiredOAuthScope } from "./registry-CsNavQ_Z.js";
-import { n as pluginCatalogRuntime } from "./catalog-runtime-DF5OWqCc.js";
-import { t as discoverSkills } from "./skills-CyvTsR9M.js";
-import { Ft as recordAuthorizationCompleted, Pt as recordAuthenticationLinked, X as getTurnRecord, z as postSlackMessage } from "./tasks-CODtRzvX.js";
-import { Ht as getSlackClient } from "./agent-hooks-DlSK8PQQ.js";
-import { E as acquireActiveLock, w as getStateAdapter } from "./profile-Bb1zCVGP.js";
-import { i as getConversationPendingAuth } from "./pending-auth-DT3MRVW8.js";
-import { r as getPersistedThreadState, s as coerceThreadConversationState } from "./thread-state-BPkwVmvK.js";
-import { c as deleteWebAuthorization, f as wakeAuthorizedTurn, i as readConnectedOAuthTokens, p as wakePausedTurn } from "./connections-CG04HdpC.js";
-import { n as relayLocalOAuthCallback } from "./oauth-relay-CdCnu80W.js";
+import { Ft as resolveBaseUrl, Lt as createUserTokenStore, Nt as formatProviderLabel, Pt as parseOAuthStatePayload, _ as resolvePluginOAuthAccount, d as getMcpAuthSession, f as getMcpStoredOAuthCredentials, o as finalizeMcpAuthorization, p as putMcpStoredOAuthCredentials, s as deleteMcpAuthSession, x as lookupSlackUserProfile, xt as getMcpProviderErrorAttributes } from "./agent-runner-DGsFQw72.js";
+import { f as escapeXml } from "./client-DbyHuMFU.js";
+import { L as isNativeIdentityProvider, f as logException, g as runBestEffort, m as logWarn } from "./logging-DsHONhVm.js";
+import { a as getRuntimeMetadata, n as botConfig } from "./config-_WO_AjCB.js";
+import { f as parseSlackUserId } from "./actor-tlxzqaRe.js";
+import { F as upsertIdentity, I as upsertLinkedIdentity, b as identityFromActor, f as getSqlExecutor, j as findUserByVerifiedEmails } from "./viewer-CGvvRqKp.js";
+import { i as homeDir } from "./package-discovery-DJBompdd.js";
+import { n as buildOAuthTokenRequest, r as parseOAuthTokenResponse, u as hasRequiredOAuthScope } from "./registry-Du566MtJ.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-BN4DVxco.js";
+import { t as discoverSkills } from "./skills-DyQBLIrK.js";
+import { B as postSlackMessage, Ft as recordAuthenticationLinked, It as recordAuthorizationCompleted, Z as getTurnRecord } from "./tasks-CEXKTASS.js";
+import { Ht as getSlackClient } from "./agent-hooks-BJ_5mlRH.js";
+import { E as acquireActiveLock, w as getStateAdapter } from "./profile-DpYjfKke.js";
+import { i as getConversationPendingAuth } from "./pending-auth-D8J1uJUS.js";
+import { r as getPersistedThreadState, s as coerceThreadConversationState } from "./thread-state-W3f6kAtz.js";
+import { c as deleteWebAuthorization, f as wakeAuthorizedTurn, i as readConnectedOAuthTokens, p as wakePausedTurn } from "./connections-ag_1JOhB.js";
+import { n as relayLocalOAuthCallback } from "./oauth-relay-CTygMkNx.js";
 import path from "node:path";
 import { z } from "zod";
 import { createHmac, createSecretKey, timingSafeEqual } from "node:crypto";
 import { pluginStoredTokensSchema } from "@sentry/junior-plugin-api";
 import fs from "node:fs";
-//#region src/handlers/oauth-html.ts
+// src/handlers/oauth-html.ts
 /** Build pre-escaped callback HTML with the shared response security policy. */
 function htmlCallbackResponse(title, message, status, options = {}) {
 	const footerMessage = options.footerMessage ?? `You can close this tab and return to ${botConfig.userName}.`;
@@ -183,8 +183,7 @@ function htmlCallbackResponse(title, message, status, options = {}) {
 		}
 	});
 }
-//#endregion
-//#region src/handlers/mcp-oauth-callback.ts
+// src/handlers/mcp-oauth-callback.ts
 /**
 * MCP OAuth callback handler.
 *
@@ -404,8 +403,7 @@ async function GET$1(request, provider, waitUntil, options) {
 		return htmlResponse("failure");
 	}
 }
-//#endregion
-//#region src/chat/slack/app-home.ts
+// src/chat/slack/app-home.ts
 const DEFAULT_DESCRIPTION_TEXT = "I help your team investigate, summarize, and act on work in Slack.";
 const MAX_HOME_SKILLS = 6;
 const MAX_SECTION_TEXT_CHARS = 3e3;
@@ -536,8 +534,7 @@ async function publishAppHomeView(slackClient, userId, userTokenStore) {
 		view
 	});
 }
-//#endregion
-//#region src/handlers/oauth-callback.ts
+// src/handlers/oauth-callback.ts
 /**
 * OAuth callbacks exchange and store credentials. Public signed callbacks
 * relay to the owning CLI, which controls local continuation. Slack callbacks
@@ -558,6 +555,57 @@ function oauthTokenErrorAttributes(provider, endpoint, status) {
 function pluginAuthorizationId(args) {
 	return `${args.sessionId}:plugin:${args.provider}`;
 }
+/** Return the Junior user of the person who started the OAuth connection. */
+async function resolveOAuthActorUserId(actor) {
+	if (actor.platform === "web") {
+		const observation = identityFromActor(actor.email ? {
+			email: actor.email,
+			...actor.fullName ? { fullName: actor.fullName } : void 0
+		} : void 0);
+		return observation ? (await upsertIdentity(getSqlExecutor(), observation)).userId : void 0;
+	}
+	const slackUserId = parseSlackUserId(actor.userId);
+	if (!slackUserId) throw new Error("OAuth Slack actor user id is invalid");
+	const profile = await lookupSlackUserProfile(slackUserId);
+	return (await upsertIdentity(getSqlExecutor(), {
+		kind: "user",
+		provider: "slack",
+		providerTenantId: actor.teamId,
+		providerSubjectId: profile.id,
+		displayName: profile.real_name || profile.display_name,
+		handle: profile.name,
+		...profile.email ? {
+			email: profile.email,
+			emailVerified: true
+		} : void 0
+	})).userId;
+}
+/**
+* Link a connected provider account to the person who connected it.
+*
+* The actor's user wins. A provider-verified email that matches exactly one
+* user links the account when the actor has no user, and is saved on the
+* identity when it matches the actor's user.
+*/
+async function linkOAuthAccountIdentity(args) {
+	const executor = getSqlExecutor();
+	const actorUserId = await resolveOAuthActorUserId(args.actor);
+	const emailMatch = await findUserByVerifiedEmails(executor, args.verifiedEmails);
+	const userId = actorUserId ?? emailMatch?.userId;
+	if (!userId) throw new Error("OAuth account has no Junior user to link");
+	const email = emailMatch?.userId === userId ? emailMatch.email : void 0;
+	await upsertLinkedIdentity(executor, userId, {
+		kind: "user",
+		provider: args.provider,
+		providerSubjectId: args.account.id,
+		displayName: args.account.displayName,
+		handle: args.account.handle ?? args.account.label,
+		...email ? {
+			email,
+			emailVerified: true
+		} : void 0
+	});
+}
 /** Queue the pending Turn, including a newer Turn that reused this auth link. */
 async function wakeAuthorizedPluginTurn(stored, options) {
 	if (!stored.resumeConversationId || !stored.resumeSessionId || !stored.destination) return;
@@ -640,8 +688,9 @@ async function GET(request, provider, waitUntil, options) {
 		return htmlErrorResponse("Connection failed", "The token exchange with the provider failed. Please try again.", 500);
 	}
 	let parsedTokenResponse;
+	let tokenData;
 	try {
-		const tokenData = await tokenResponse.json();
+		tokenData = await tokenResponse.json();
 		parsedTokenResponse = parseOAuthTokenResponse(tokenData, requestedScope, { treatEmptyScopeAsUnreported: providerConfig.treatEmptyScopeAsUnreported });
 	} catch {
 		logWarn("oauth.token_exchange.failed", oauthTokenErrorAttributes(provider, providerConfig.tokenEndpoint, tokenResponse.status));
@@ -650,11 +699,18 @@ async function GET(request, provider, waitUntil, options) {
 	if (!hasRequiredOAuthScope(parsedTokenResponse.scope, requestedScope)) return htmlErrorResponse("Connection failed", `The ${providerLabel} authorization did not grant the access Junior requires. Return to Junior and connect your ${providerLabel} account again.`, 400);
 	const userTokenStore = createUserTokenStore();
 	let account;
+	let verifiedEmails = [];
 	try {
-		account = await resolvePluginOAuthAccount({
+		const resolved = await resolvePluginOAuthAccount({
 			provider,
+			tokenResponse: tokenData,
 			tokens: parsedTokenResponse
 		});
+		if (resolved) {
+			const { verifiedEmails: emails, ...rest } = resolved;
+			account = rest;
+			verifiedEmails = emails ?? [];
+		}
 	} catch {
 		return htmlErrorResponse("Connection failed", `Junior could not verify the connected ${providerLabel} account. Please try again.`, 500);
 	}
@@ -662,30 +718,13 @@ async function GET(request, provider, waitUntil, options) {
 		...parsedTokenResponse,
 		...account ? { account } : void 0
 	});
-	const slackActor = stored.actor?.platform === "slack" ? stored.actor : void 0;
-	if (account && slackActor) await runBestEffort(async () => {
-		const slackUserId = parseSlackUserId(slackActor.userId);
-		if (!slackUserId) throw new Error("OAuth Slack actor user id is invalid");
-		const profile = await lookupSlackUserProfile(slackUserId);
-		const slackIdentity = await upsertIdentity(getSqlExecutor(), {
-			kind: "user",
-			provider: "slack",
-			providerTenantId: slackActor.teamId,
-			providerSubjectId: profile.id,
-			displayName: profile.real_name || profile.display_name,
-			handle: profile.name,
-			...profile.email ? {
-				email: profile.email,
-				emailVerified: true
-			} : void 0
-		});
-		if (!slackIdentity.userId) throw new Error("OAuth Slack identity is not linked to a user");
-		await upsertLinkedIdentity(getSqlExecutor(), slackIdentity.userId, {
-			kind: "user",
+	const linkActor = stored.actor;
+	if (account && !isNativeIdentityProvider(provider) && (linkActor?.platform === "slack" || linkActor?.platform === "web")) await runBestEffort(async () => {
+		await linkOAuthAccountIdentity({
+			account,
+			actor: linkActor,
 			provider,
-			providerSubjectId: account.id,
-			displayName: account.displayName,
-			handle: account.handle ?? account.label
+			verifiedEmails
 		});
 	}, "oauth.callback.identity_link.failed", { "app.credential.provider": provider });
 	const resumeConversationId = stored.resumeConversationId;
@@ -751,8 +790,7 @@ async function GET(request, provider, waitUntil, options) {
 	const footerMessage = stored.destination?.platform === "local" || resumesWebTurn || webActor ? `You can close this tab and return to ${botName}.` : "You can close this tab and return to Slack.";
 	return htmlCallbackResponse(escapeXml(`${providerLabel} account connected`), escapeXml(statusMessage), 200, { footerMessage: escapeXml(footerMessage) });
 }
-//#endregion
-//#region src/chat/local/credential-sync.ts
+// src/chat/local/credential-sync.ts
 const LOCAL_CREDENTIAL_SYNC_CONTEXT = "junior.local-credential-sync.v1";
 const LOCAL_CREDENTIAL_SYNC_MAX_AGE_MS = 6e4;
 const localCredentialSyncSchema = z.object({
@@ -812,5 +850,4 @@ async function receiveLocalOAuthCredential(request) {
 	await createUserTokenStore().set("local-cli", payload.data.provider, payload.data.tokens);
 	return new Response(null, { status: 204 });
 }
-//#endregion
 export { GET$1 as a, publishAppHomeView as i, syncLocalOAuthCredential as n, GET as r, receiveLocalOAuthCredential as t };

package/dist/{db-Ca9Nt5ci.d.ts → db-BnRqQ7G5.d.ts}

@@ -1,4 +1,4 @@
-import "./store-DoewL5mG.js";
+import "./store-CG0VJyye.js";
 import { z } from "zod";
 import "drizzle-orm/pg-core";
 import "drizzle-orm/migrator";