@sentry/junior 0.257.0 → 0.259.0

package/dist/{profile-h-72wM78.js → profile-qBM6B_-V.js}

@@ -1,12 +1,8 @@
-import { S as toOptionalTrimmed } from "./client-D8HnkOQX.js";
-import { b as setSpanStatus, y as setSpanAttributes } from "./logging-CWxiIuCF.js";
-import { i as getChatConfig } from "./config-CJRnWK9H.js";
-import { n as pluginCatalogRuntime } from "./catalog-runtime-CZzhGQ7F.js";
+import { C as toOptionalTrimmed } from "./client-BZdxgKyL.js";
+import { b as setSpanStatus, y as setSpanAttributes } from "./logging-BStXN56b.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-B8SuFPGb.js";
 import { createHash } from "node:crypto";
-import { createMemoryState } from "@chat-adapter/state-memory";
-import { createRedisState } from "@chat-adapter/state-redis";
-import { setTimeout as setTimeout$1 } from "node:timers/promises";
-//#region src/chat/sandbox/paths.ts
+// src/chat/sandbox/paths.ts
 function normalizeWorkspaceRoot(input) {
 	const candidate = (input ?? "").trim();
 	if (!candidate) return "/vercel/sandbox";
@@ -28,8 +24,7 @@ function sandboxSkillPathResolution(skillName) {
 	const skillDir = sandboxSkillDir(skillName);
 	return `Resolve relative paths in this skill against ${skillDir}. For bash commands from this skill, cd to ${skillDir} first or use absolute paths.`;
 }
-//#endregion
-//#region src/chat/sleep.ts
+// src/chat/sleep.ts
 /** Wait for a duration, rejecting with the owning signal reason when cancelled. */
 function sleep(ms, signal) {
 	if (!signal) return new Promise((resolve) => setTimeout(resolve, ms));
@@ -49,275 +44,7 @@ function sleep(ms, signal) {
 		signal.addEventListener("abort", onAbort, { once: true });
 	});
 }
-//#endregion
-//#region src/chat/state/locks.ts
-const ACTIVE_LOCK_TTL_MS = 9e4;
-const MUTATION_LOCK_TTL_MS = 1e4;
-/**
-* Acquire a lock for long-running work that the queued state adapter should
-* keep alive while the owning invocation is still making progress.
-*/
-async function acquireActiveLock(state, threadId) {
-	return await state.acquireLock(threadId, ACTIVE_LOCK_TTL_MS);
-}
-/**
-* Run work under one lock, optionally waiting for the current owner.
-* `keepAlive` is for multi-store mutations that must retain ownership until all
-* side effects finish; callers should still fence each blind write.
-*/
-async function withLock(state, key, run, options = {}) {
-	const startedAtMs = Date.now();
-	let lock;
-	while (true) {
-		lock = await state.acquireLock(key, options.ttlMs ?? 9e4);
-		if (lock) break;
-		if (Date.now() - startedAtMs >= (options.waitMs ?? 0)) return { acquired: false };
-		await setTimeout$1(options.retryMs ?? 25, void 0, { ref: false });
-	}
-	const ttlMs = options.ttlMs ?? 9e4;
-	const heartbeat = options.keepAlive ? setInterval(() => {
-		state.extendLock(lock, ttlMs);
-	}, Math.max(1, Math.floor(ttlMs / 3))) : void 0;
-	heartbeat?.unref();
-	try {
-		return {
-			acquired: true,
-			value: await run(lock)
-		};
-	} finally {
-		if (heartbeat) clearInterval(heartbeat);
-		await state.releaseLock(lock);
-	}
-}
-/**
-* Prove lock ownership immediately before a blind write.
-*
-* Whole-record mutations must stop if their lock expired rather than overwrite
-* state committed by a newer owner.
-*/
-async function fenceLock(state, lock, ttlMs = MUTATION_LOCK_TTL_MS) {
-	if (!await state.extendLock(lock, ttlMs)) throw new Error(`Lock ownership was lost before write for ${lock.threadId}`);
-}
-//#endregion
-//#region src/chat/state/adapter.ts
-const ACTIVE_LOCK_HEARTBEAT_MS = 3e4;
-let stateAdapter;
-let redisStateAdapter;
-/** Lazily connect state operations, including queued-adapter lock heartbeats. */
-function createConnectingStateAdapter(base) {
-	const connected = async (operation) => {
-		await base.connect();
-		return await operation();
-	};
-	return {
-		appendToList: (key, value, options) => connected(() => base.appendToList(key, value, options)),
-		connect: () => base.connect(),
-		disconnect: () => base.disconnect(),
-		subscribe: (threadId) => connected(() => base.subscribe(threadId)),
-		unsubscribe: (threadId) => connected(() => base.unsubscribe(threadId)),
-		isSubscribed: (threadId) => connected(() => base.isSubscribed(threadId)),
-		acquireLock: (threadId, ttlMs) => connected(() => base.acquireLock(threadId, ttlMs)),
-		releaseLock: (lock) => connected(() => base.releaseLock(lock)),
-		extendLock: (lock, ttlMs) => connected(() => base.extendLock(lock, ttlMs)),
-		forceReleaseLock: (threadId) => connected(() => base.forceReleaseLock(threadId)),
-		enqueue: (threadId, entry, maxSize) => connected(() => base.enqueue(threadId, entry, maxSize)),
-		dequeue: (threadId) => connected(() => base.dequeue(threadId)),
-		queueDepth: (threadId) => connected(() => base.queueDepth(threadId)),
-		get: (key) => connected(() => base.get(key)),
-		getList: (key) => connected(() => base.getList(key)),
-		set: (key, value, ttlMs) => connected(() => base.set(key, value, ttlMs)),
-		setIfNotExists: (key, value, ttlMs) => connected(() => base.setIfNotExists(key, value, ttlMs)),
-		delete: (key) => connected(() => base.delete(key))
-	};
-}
-function createPrefixedStateAdapter(base, prefix) {
-	const prefixed = (value) => `${prefix}:${value}`;
-	const unprefixed = (value) => value.startsWith(`${prefix}:`) ? value.slice(prefix.length + 1) : value;
-	const prefixLock = (lock) => ({
-		...lock,
-		threadId: prefixed(lock.threadId)
-	});
-	const unprefixLock = (lock) => ({
-		...lock,
-		threadId: unprefixed(lock.threadId)
-	});
-	return {
-		appendToList: (key, value, options) => base.appendToList(prefixed(key), value, options),
-		connect: () => base.connect(),
-		disconnect: () => base.disconnect(),
-		subscribe: (threadId) => base.subscribe(prefixed(threadId)),
-		unsubscribe: (threadId) => base.unsubscribe(prefixed(threadId)),
-		isSubscribed: (threadId) => base.isSubscribed(prefixed(threadId)),
-		acquireLock: async (threadId, ttlMs) => {
-			const lock = await base.acquireLock(prefixed(threadId), ttlMs);
-			return lock ? unprefixLock(lock) : null;
-		},
-		releaseLock: (lock) => base.releaseLock(prefixLock(lock)),
-		extendLock: async (lock, ttlMs) => {
-			const prefixedLock = prefixLock(lock);
-			const extended = await base.extendLock(prefixedLock, ttlMs);
-			if (extended) lock.expiresAt = prefixedLock.expiresAt;
-			return extended;
-		},
-		forceReleaseLock: (threadId) => base.forceReleaseLock(prefixed(threadId)),
-		enqueue: (threadId, entry, maxSize) => base.enqueue(prefixed(threadId), entry, maxSize),
-		dequeue: (threadId) => base.dequeue(prefixed(threadId)),
-		queueDepth: (threadId) => base.queueDepth(prefixed(threadId)),
-		get: (key) => base.get(prefixed(key)),
-		getList: (key) => base.getList(prefixed(key)),
-		set: (key, value, ttlMs) => base.set(prefixed(key), value, ttlMs),
-		setIfNotExists: (key, value, ttlMs) => base.setIfNotExists(prefixed(key), value, ttlMs),
-		delete: (key) => base.delete(prefixed(key))
-	};
-}
-function createQueuedStateAdapter(base, options) {
-	const heartbeats = /* @__PURE__ */ new Map();
-	const shouldHeartbeatLock = (ttlMs) => ttlMs === ACTIVE_LOCK_TTL_MS;
-	const heartbeatKey = (lock) => `${lock.threadId}:${lock.token}`;
-	const stopHeartbeatByKey = (key) => {
-		const heartbeat = heartbeats.get(key);
-		if (!heartbeat) return;
-		clearInterval(heartbeat.timer);
-		heartbeats.delete(key);
-	};
-	const stopHeartbeat = (lock) => {
-		stopHeartbeatByKey(heartbeatKey(lock));
-	};
-	const stopHeartbeatsForThread = (threadId) => {
-		for (const [key, heartbeat] of heartbeats) if (heartbeat.lock.threadId === threadId) stopHeartbeatByKey(key);
-	};
-	const stopAllHeartbeats = () => {
-		for (const key of heartbeats.keys()) stopHeartbeatByKey(key);
-	};
-	const runHeartbeat = async (key) => {
-		const heartbeat = heartbeats.get(key);
-		if (!heartbeat || heartbeat.inFlight) return;
-		heartbeat.inFlight = true;
-		try {
-			if (Date.now() - heartbeat.startedAtMs >= options.activeLockMaxAgeMs) {
-				stopHeartbeatByKey(key);
-				return;
-			}
-			if (!await base.extendLock(heartbeat.lock, heartbeat.ttlMs)) {
-				stopHeartbeatByKey(key);
-				return;
-			}
-			heartbeat.lock.expiresAt = Date.now() + heartbeat.ttlMs;
-		} catch {} finally {
-			const current = heartbeats.get(key);
-			if (current === heartbeat) current.inFlight = false;
-		}
-	};
-	const startOrUpdateHeartbeat = (lock, ttlMs) => {
-		const key = heartbeatKey(lock);
-		const existing = heartbeats.get(key);
-		if (existing) {
-			existing.ttlMs = ttlMs;
-			return;
-		}
-		const timer = setInterval(() => {
-			runHeartbeat(key);
-		}, ACTIVE_LOCK_HEARTBEAT_MS);
-		timer.unref?.();
-		heartbeats.set(key, {
-			inFlight: false,
-			lock,
-			startedAtMs: Date.now(),
-			timer,
-			ttlMs
-		});
-	};
-	const acquireLock = async (threadId, ttlMs) => {
-		const lock = await base.acquireLock(threadId, ttlMs);
-		if (lock && shouldHeartbeatLock(ttlMs)) startOrUpdateHeartbeat(lock, ttlMs);
-		return lock;
-	};
-	return {
-		appendToList: (key, value, options) => base.appendToList(key, value, options),
-		connect: () => base.connect(),
-		disconnect: async () => {
-			stopAllHeartbeats();
-			await base.disconnect();
-		},
-		subscribe: (threadId) => base.subscribe(threadId),
-		unsubscribe: (threadId) => base.unsubscribe(threadId),
-		isSubscribed: (threadId) => base.isSubscribed(threadId),
-		acquireLock,
-		releaseLock: async (lock) => {
-			stopHeartbeat(lock);
-			await base.releaseLock(lock);
-		},
-		extendLock: async (lock, ttlMs) => {
-			const extended = await base.extendLock(lock, ttlMs);
-			if (extended) {
-				lock.expiresAt = Date.now() + ttlMs;
-				if (shouldHeartbeatLock(ttlMs)) startOrUpdateHeartbeat(lock, ttlMs);
-				else stopHeartbeat(lock);
-			} else stopHeartbeat(lock);
-			return extended;
-		},
-		forceReleaseLock: async (threadId) => {
-			stopHeartbeatsForThread(threadId);
-			await base.forceReleaseLock(threadId);
-		},
-		enqueue: (threadId, entry, maxSize) => base.enqueue(threadId, entry, maxSize),
-		dequeue: (threadId) => base.dequeue(threadId),
-		queueDepth: (threadId) => base.queueDepth(threadId),
-		get: (key) => base.get(key),
-		getList: (key) => base.getList(key),
-		set: (key, value, ttlMs) => base.set(key, value, ttlMs),
-		setIfNotExists: (key, value, ttlMs) => base.setIfNotExists(key, value, ttlMs),
-		delete: (key) => base.delete(key)
-	};
-}
-function withOptionalPrefix(base, prefix) {
-	return prefix ? createPrefixedStateAdapter(base, prefix) : base;
-}
-function createStateAdapter() {
-	const config = getChatConfig();
-	const activeLockMaxAgeMs = config.bot.turnTimeoutMs + ACTIVE_LOCK_TTL_MS;
-	if (config.state.adapter === "memory") {
-		redisStateAdapter = void 0;
-		return createQueuedStateAdapter(createConnectingStateAdapter(withOptionalPrefix(createMemoryState(), config.state.keyPrefix)), { activeLockMaxAgeMs });
-	}
-	if (!config.state.redisUrl) throw new Error("REDIS_URL is required for durable Slack thread state");
-	const redisState = createRedisState({ url: config.state.redisUrl });
-	redisStateAdapter = redisState;
-	return createQueuedStateAdapter(createConnectingStateAdapter(withOptionalPrefix(redisState, config.state.keyPrefix)), { activeLockMaxAgeMs });
-}
-function getOptionalRedisStateAdapter() {
-	getStateAdapter();
-	return redisStateAdapter;
-}
-async function getConnectedStateContext() {
-	const adapter = getStateAdapter();
-	await adapter.connect();
-	return {
-		redisStateAdapter: getOptionalRedisStateAdapter(),
-		stateAdapter: adapter
-	};
-}
-/** Return the Redis adapter only when the caller is using the default state adapter. */
-async function getDefaultRedisStateAdapterFor(adapter) {
-	if (adapter !== stateAdapter) return;
-	const context = await getConnectedStateContext();
-	return context.stateAdapter === adapter ? context.redisStateAdapter : void 0;
-}
-function getStateAdapter() {
-	if (!stateAdapter) stateAdapter = createStateAdapter();
-	return stateAdapter;
-}
-async function disconnectStateAdapter() {
-	if (!stateAdapter) return;
-	try {
-		await stateAdapter.disconnect();
-	} finally {
-		stateAdapter = void 0;
-		redisStateAdapter = void 0;
-	}
-}
-//#endregion
-//#region src/chat/sandbox/noninteractive-command.ts
+// src/chat/sandbox/noninteractive-command.ts
 const NON_INTERACTIVE_ENV = {
 	CI: "1",
 	TERM: "dumb",
@@ -382,8 +109,7 @@ async function runNonInteractiveCommand(sandbox, input) {
 	};
 	return await sandbox.runCommand(command);
 }
-//#endregion
-//#region src/chat/sandbox/credentials.ts
+// src/chat/sandbox/credentials.ts
 /**
 * Resolve explicit Vercel Sandbox credentials, or return undefined to let
 * the SDK read ambient Vercel auth from its own environment detection.
@@ -398,8 +124,7 @@ function getVercelSandboxCredentials() {
 		projectId
 	};
 }
-//#endregion
-//#region src/chat/sandbox/http-error-details.ts
+// src/chat/sandbox/http-error-details.ts
 const DEFAULT_PREVIEW_LIMIT = 512;
 function toTrimmedString(value, maxChars) {
 	if (typeof value !== "string") return;
@@ -458,8 +183,7 @@ function extractHttpErrorDetails(error, options = {}) {
 		searchableText
 	};
 }
-//#endregion
-//#region src/chat/sandbox/snapshot/not-ready-error.ts
+// src/chat/sandbox/snapshot/not-ready-error.ts
 /** Report that a Workspace snapshot is not ready to use. */
 var WorkspaceSnapshotNotReadyError = class extends Error {
 	workspaceName;
@@ -487,8 +211,7 @@ function isWorkspaceSnapshotNotReadyError(error) {
 function workspaceSnapshotNotReadyUserMessage(error) {
 	return `The ${error.workspaceName} workspace is still preparing its sandbox. Wait for that preparation to finish, then try again.`;
 }
-//#endregion
-//#region src/chat/sandbox/errors.ts
+// src/chat/sandbox/errors.ts
 const SANDBOX_ERROR_FIELDS = [{
 	sourceKey: "sandboxId",
 	attributeKey: "sandbox_id",
@@ -617,8 +340,7 @@ function throwSandboxOperationError(action, error, includeMissingPath = false) {
 	setSpanStatus("error");
 	throw new Error(details.summary ? `${action} failed (${details.summary})` : `${action} failed`, { cause: error });
 }
-//#endregion
-//#region src/chat/sandbox/docker.ts
+// src/chat/sandbox/docker.ts
 /** Docker daemon config for Vercel sandbox guests (nested containers). */
 const DOCKER_DAEMON_JSON = `{
   "storage-driver": "overlay2",
@@ -714,8 +436,7 @@ async function ensureDockerDaemon(sandbox, signal) {
 		signal
 	});
 }
-//#endregion
-//#region src/chat/sandbox/runtime-dependencies.ts
+// src/chat/sandbox/runtime-dependencies.ts
 const GLOBAL_RUNTIME_DEPENDENCIES = [
 	{
 		type: "system",
@@ -762,8 +483,7 @@ const GLOBAL_RUNTIME_POSTINSTALL = [{
 	].join("\n")],
 	sudo: true
 }];
-//#endregion
-//#region src/chat/sandbox/snapshot/profile.ts
+// src/chat/sandbox/snapshot/profile.ts
 const VERSION = 1;
 const DEFAULT_FLOATING_MAX_AGE_MS = 6048e5;
 function isExactNpmVersion(version) {
@@ -852,5 +572,4 @@ function isStale(profile, createdAtMs) {
 	const maxAgeMs = floatingMaxAgeMs();
 	return maxAgeMs === 0 || Date.now() - createdAtMs > maxAgeMs;
 }
-//#endregion
-export { SANDBOX_DATA_ROOT as A, getDefaultRedisStateAdapterFor as C, fenceLock as D, acquireActiveLock as E, sandboxSkillFile as F, sandboxSkillPathResolution as I, SANDBOX_SKILLS_ROOT as M, SANDBOX_WORKSPACE_ROOT as N, withLock as O, sandboxSkillDir as P, disconnectStateAdapter as S, MUTATION_LOCK_TTL_MS as T, workspaceSnapshotNotReadyUserMessage as _, isAbortError as a, buildNonInteractiveShellScript as b, isSandboxCommandStreamInterruptedError as c, isSnapshottingError as d, throwSandboxOperationError as f, isWorkspaceSnapshotNotReadyError as g, getWorkspaceSnapshotNotReadyError as h, ensureDockerDaemon as i, SANDBOX_REPOS_ROOT as j, sleep as k, isSandboxMissingError as l, WorkspaceSnapshotNotReadyError as m, hash as n, isAlreadyExistsError as o, wrapSandboxSetupError as p, isStale as r, isSandboxApiTransientError as s, create as t, isSandboxUnavailableError as u, getVercelSandboxCredentials as v, getStateAdapter as w, runNonInteractiveCommand as x, buildCommandScript as y };
+export { SANDBOX_DATA_ROOT as C, sandboxSkillDir as D, SANDBOX_WORKSPACE_ROOT as E, sandboxSkillFile as O, sleep as S, SANDBOX_SKILLS_ROOT as T, workspaceSnapshotNotReadyUserMessage as _, isAbortError as a, buildNonInteractiveShellScript as b, isSandboxCommandStreamInterruptedError as c, isSnapshottingError as d, throwSandboxOperationError as f, isWorkspaceSnapshotNotReadyError as g, getWorkspaceSnapshotNotReadyError as h, ensureDockerDaemon as i, sandboxSkillPathResolution as k, isSandboxMissingError as l, WorkspaceSnapshotNotReadyError as m, hash as n, isAlreadyExistsError as o, wrapSandboxSetupError as p, isStale as r, isSandboxApiTransientError as s, create as t, isSandboxUnavailableError as u, getVercelSandboxCredentials as v, SANDBOX_REPOS_ROOT as w, runNonInteractiveCommand as x, buildCommandScript as y };

package/dist/{prompt-DyoEj9c2.js → prompt-xgpyMtg7.js}

@@ -1,6 +1,6 @@
-import { H as conversationBriefSchema, U as parseBriefInput, V as briefOutcomeStatusSchema } from "./conversation-CKNLYBJt.js";
+import { H as conversationBriefSchema, U as parseBriefInput, V as briefOutcomeStatusSchema } from "./conversation-DjN3mlog.js";
 import { z } from "zod";
-//#region src/chat/briefs/generate.ts
+// src/chat/briefs/generate.ts
 const MAX_INPUT_CHARS = 6e4;
 const MAX_MESSAGE_TEXT_CHARS = 4e3;
 const MAX_TOOL_TEXT_CHARS = 1500;
@@ -406,8 +406,7 @@ async function generateBrief(args) {
 		throughIndex: args.throughIndex
 	};
 }
-//#endregion
-//#region src/chat/events/actor.ts
+// src/chat/events/actor.ts
 /**
 * System author ID stamped on event mailbox messages.
 *
@@ -439,8 +438,7 @@ const EVENT_SYSTEM_ACTOR = {
 function isEventConversationMessage(message) {
 	return Boolean(message.meta?.eventType) || message.author?.userId === "UJRNEVENT";
 }
-//#endregion
-//#region src/chat/briefs/event-entries.ts
+// src/chat/briefs/event-entries.ts
 const TOOL_TEXT_LIMIT = 1500;
 function actorIdentityKey(actor) {
 	const slackUserId = actor?.slackUserId?.trim();
@@ -527,8 +525,7 @@ function briefEntriesFromReportEvents(events) {
 	}
 	return entries;
 }
-//#endregion
-//#region src/chat/briefs/prompt.ts
+// src/chat/briefs/prompt.ts
 const BRIEF_PROMPT = `You write one durable Brief for a Junior Conversation.
 
 Use only facts supported by the supplied entries, evidence, or previous Brief. Do not invent names, ids, numbers, outcomes, choices, owners, or links.
@@ -548,5 +545,4 @@ Rules:
 - Cite a URL only when its exact full string occurs in an entry, evidence, or the previous Brief. Return cited URLs in urls. Core adds code changes and resources separately.
 - Keep the summary under 600 characters, intent under 400 characters, outcome text under 600 characters, and each other string under 400 characters.
 `;
-//#endregion
 export { EVENT_SYSTEM_ACTOR as a, EVENT_MESSAGE_AUTHOR as i, briefEntriesFromReportEvents as n, isEventConversationMessage as o, EVENT_AUTHOR_ID as r, generateBrief as s, BRIEF_PROMPT as t };

package/dist/{queue-B5SnqRln.d.ts → queue-C37RbDVc.d.ts}

@@ -1,5 +1,4 @@
 import { z } from "zod";
-//#region src/chat/task-execution/queue.d.ts
 /** Validate the v2 conversation work hint sent through Vercel Queue. */
 declare const conversationQueueMessageSchema: z.ZodObject<{
   schemaVersion: z.ZodLiteral<2>;
@@ -21,5 +20,4 @@ interface ConversationQueueSendResult {
 interface ConversationWorkQueue {
   send(message: ConversationQueueMessage, options?: ConversationQueueSendOptions): Promise<ConversationQueueSendResult | void>;
 }
-//#endregion
 export { ConversationWorkQueue as n, ConversationQueueMessage as t };

package/dist/{registry-sLTr-sV9.js → registry-B_M_x_iS.js}

@@ -1,12 +1,12 @@
-import { m as logWarn, p as logInfo, y as setSpanAttributes } from "./logging-CWxiIuCF.js";
-import { a as isUserActor, o as parseActorUserId } from "./actor-BTtLaeWy.js";
-import { n as normalizePluginPackageNames, o as pluginRoots, t as discoverInstalledPluginPackageContent } from "./package-discovery-BVvSnQBB.js";
+import { m as logWarn, p as logInfo, y as setSpanAttributes } from "./logging-BStXN56b.js";
+import { a as isUserActor, o as parseActorUserId } from "./actor-tlxzqaRe.js";
+import { n as normalizePluginPackageNames, o as pluginRoots, t as discoverInstalledPluginPackageContent } from "./package-discovery-DJBompdd.js";
 import path from "node:path";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { parse } from "yaml";
 import { readFileSync, readdirSync, statSync } from "node:fs";
-//#region src/chat/plugins/inline-manifest-source.ts
+// src/chat/plugins/inline-manifest-source.ts
 function setDefined$1(target, key, value) {
 	if (value !== void 0) target[key] = value;
 }
@@ -49,6 +49,13 @@ function mcpOauthClientSource(oauthClient) {
 	setDefined$1(result, "authorize-params", oauthClient.authorizeParams);
 	return result;
 }
+/** Convert a camelCase `accounts` block to its plugin.yaml source keys. */
+function accountsSource(accounts) {
+	const result = {};
+	setDefined$1(result, "user-oauth", accounts.userOAuth);
+	setDefined$1(result, "service-account", accounts.serviceAccount);
+	return result;
+}
 function inlineMcpSource(mcp) {
 	if (mcp === void 0 || !isRecord(mcp)) return mcp;
 	const result = {};
@@ -99,11 +106,11 @@ function inlineManifestSource(manifest) {
 	setDefined$1(result, "runtime-postinstall", manifest.runtimePostinstall);
 	setDefined$1(result, "mcp", inlineMcpSource(manifest.mcp));
 	setDefined$1(result, "oauth", inlineOauthSource(manifest.oauth));
+	setDefined$1(result, "accounts", manifest.accounts && accountsSource(manifest.accounts));
 	setDefined$1(result, "target", inlineTargetSource(manifest.name, manifest.target));
 	return result;
 }
-//#endregion
-//#region src/chat/plugins/manifest.ts
+// src/chat/plugins/manifest.ts
 const PLUGIN_NAME_RE = /^[a-z][a-z0-9-]*$/;
 const SHORT_CONFIG_KEY_RE = /^[a-z0-9]+(\.[a-z0-9-]+)*$/;
 const TARGET_FLAG_RE = /^-{1,2}[A-Za-z0-9][A-Za-z0-9-]*$/;
@@ -250,6 +257,10 @@ const mcpOauthClientSourceSchema = z.object({
 	scope: nonEmptyTrimmedString.optional(),
 	"authorize-params": stringMapSchema.optional()
 }).passthrough();
+const accountsSourceSchema = z.object({
+	"user-oauth": z.boolean().optional(),
+	"service-account": z.object({ tools: nonEmptyStringArraySchema("tools") }).strict().optional()
+}).strict();
 const mcpSourceSchema = z.object({
 	transport: nonEmptyTrimmedString.refine((value) => value === "http", { error: "must be \"http\"" }).optional(),
 	url: httpsUrlString,
@@ -278,6 +289,7 @@ const manifestSourceSchema = z.object({
 	"env-vars": z.record(z.string(), z.unknown(), { error: "must be an object" }).optional(),
 	mcp: z.record(z.string(), z.unknown(), { error: "must be an object" }).optional(),
 	oauth: z.record(z.string(), z.unknown(), { error: "must be an object" }).optional(),
+	accounts: z.record(z.string(), z.unknown(), { error: "must be an object" }).optional(),
 	target: z.record(z.string(), z.unknown(), { error: "must be an object" }).optional()
 }).passthrough();
 function setDefined(target, key, value) {
@@ -336,6 +348,7 @@ function manifestConfigPatch(config) {
 			result.oauth = oauth;
 		}
 	}
+	if (config.accounts !== void 0) result.accounts = config.accounts && accountsSource(config.accounts);
 	if (config.target !== void 0) {
 		if (!config.target) result.target = null;
 		else {
@@ -621,6 +634,28 @@ function normalizeMcp(data, envVars, name) {
 		...result.data["wrapped-tools"] ? { wrappedTools: result.data["wrapped-tools"] } : void 0
 	};
 }
+/**
+* Validate which accounts the plugin may use against the surfaces that
+* support them. Today only MCP OAuth stores a service account.
+*/
+function normalizeAccounts(data, mcp, name) {
+	const result = accountsSourceSchema.safeParse(data);
+	if (!result.success) throw new Error(issueMessage(result.error, `Plugin ${name} accounts`));
+	const userOAuth = result.data["user-oauth"];
+	const serviceAccount = result.data["service-account"];
+	if (userOAuth === false && !serviceAccount) throw new Error(`Plugin ${name} accounts.user-oauth false requires accounts.service-account`);
+	if (!serviceAccount) return;
+	if (!mcp || mcp.auth || mcp.oauthClient) throw new Error(`Plugin ${name} accounts.service-account requires mcp without auth or oauth-client`);
+	if (mcp.allowedTools) {
+		const loadedTools = /* @__PURE__ */ new Set([...mcp.allowedTools, ...mcp.wrappedTools ?? []]);
+		const unknownTools = serviceAccount.tools.filter((tool) => !loadedTools.has(tool));
+		if (unknownTools.length > 0) throw new Error(`Plugin ${name} accounts.service-account.tools must be listed in mcp.allowed-tools or mcp.wrapped-tools: ${unknownTools.join(", ")}`);
+	}
+	return {
+		...userOAuth === false ? { userOAuth } : void 0,
+		serviceAccount: { tools: serviceAccount.tools }
+	};
+}
 function parseManifestSource(parsedSource, dir, config, options) {
 	const source = applyManifestConfig(parsedSource, config);
 	const sourceResult = manifestSourceSchema.safeParse(source);
@@ -639,6 +674,7 @@ function parseManifestSource(parsedSource, dir, config, options) {
 		if (path === "env-vars") throw new Error(`Plugin ${String(parsedSource.name ?? "unknown")} env-vars must be an object`);
 		if (path === "mcp") throw new Error(`Plugin ${String(parsedSource.name ?? "unknown")} mcp must be an object`);
 		if (path === "oauth") throw new Error(`Plugin ${String(parsedSource.name ?? "unknown")} oauth must be an object`);
+		if (path === "accounts") throw new Error(`Plugin ${String(parsedSource.name ?? "unknown")} accounts must be an object`);
 		if (path === "target") throw new Error(`Plugin ${String(parsedSource.name ?? "unknown")} target must be an object`);
 		throw new Error(issue?.message ?? `Invalid plugin manifest in ${dir}`);
 	}
@@ -657,6 +693,7 @@ function parseManifestSource(parsedSource, dir, config, options) {
 	const runtimeDependencies = data["runtime-dependencies"] ? normalizeRuntimeDependencies(data["runtime-dependencies"], data.name) : void 0;
 	const runtimePostinstall = data["runtime-postinstall"] ? normalizeRuntimePostinstall(data["runtime-postinstall"], data.name) : void 0;
 	const mcp = data.mcp ? normalizeMcp(data.mcp, envVars, data.name) : void 0;
+	const accounts = data.accounts ? normalizeAccounts(data.accounts, mcp, data.name) : void 0;
 	const manifest = {
 		name: data.name,
 		displayName: data["display-name"],
@@ -669,7 +706,8 @@ function parseManifestSource(parsedSource, dir, config, options) {
 		...credentials ? { credentials } : void 0,
 		...runtimeDependencies ? { runtimeDependencies } : void 0,
 		...runtimePostinstall ? { runtimePostinstall } : void 0,
-		...mcp ? { mcp } : void 0
+		...mcp ? { mcp } : void 0,
+		...accounts ? { accounts } : void 0
 	};
 	if (data.oauth) {
 		if (!credentials && options?.allowHookManagedEgress !== true) throw new Error(`Plugin ${data.name} oauth requires credentials`);
@@ -727,8 +765,7 @@ function parsePluginManifest(raw, dir, config) {
 function parseInlinePluginManifest(manifest, dir, config) {
 	return parseManifestSource(inlineManifestSource(manifest), dir, config, { allowHookManagedEgress: true });
 }
-//#endregion
-//#region src/chat/credentials/broker.ts
+// src/chat/credentials/broker.ts
 var CredentialUnavailableError = class extends Error {
 	provider;
 	constructor(provider, message) {
@@ -737,8 +774,7 @@ var CredentialUnavailableError = class extends Error {
 		this.provider = provider;
 	}
 };
-//#endregion
-//#region src/chat/credentials/context.ts
+// src/chat/credentials/context.ts
 const exactActorIdSchema = z.string().refine((value) => parseActorUserId(value) === value);
 const exactNonBlankStringSchema = z.string().min(1).refine((value) => value === value.trim());
 const slackDirectCredentialSubjectBindingSchema = z.object({
@@ -885,8 +921,7 @@ function credentialUserSubjectId(context) {
 	if ("type" in context.actor) return context.actor.userId;
 	return "subject" in context ? context.subject?.userId : void 0;
 }
-//#endregion
-//#region src/chat/credentials/header-transforms.ts
+// src/chat/credentials/header-transforms.ts
 /** Merge transforms by domain so later transforms override earlier headers. */
 function mergeHeaderTransforms(transforms) {
 	const byDomain = /* @__PURE__ */ new Map();
@@ -899,8 +934,7 @@ function mergeHeaderTransforms(transforms) {
 		headers
 	}));
 }
-//#endregion
-//#region src/chat/credentials/oauth-scope.ts
+// src/chat/credentials/oauth-scope.ts
 function parseScope(scope) {
 	if (!scope) return [];
 	return [...new Set(scope.split(/\s+/).filter(Boolean))].sort();
@@ -918,8 +952,7 @@ function hasRequiredOAuthScope(storedScope, requiredScope) {
 	if (stored.size === 0) return false;
 	return required.every((scope) => stored.has(scope));
 }
-//#endregion
-//#region src/chat/oauth-response.ts
+// src/chat/oauth-response.ts
 const MAX_OAUTH_ERROR_BODY_BYTES = 16384;
 const MAX_OAUTH_ERROR_BODY_READS = MAX_OAUTH_ERROR_BODY_BYTES;
 const MAX_OAUTH_ERROR_BODY_READ_MS = 5e3;
@@ -1013,8 +1046,7 @@ function fetchWithBoundedOAuthErrorBodies(fetchFn = globalThis.fetch, onErrorRes
 		});
 	});
 }
-//#endregion
-//#region src/chat/plugins/command-env.ts
+// src/chat/plugins/command-env.ts
 const ENV_PLACEHOLDER_RE$1 = /\$\{([A-Z_][A-Z0-9_]*)\}/g;
 function resolveValue(manifest, value) {
 	let missing = false;
@@ -1041,15 +1073,13 @@ function resolvePluginCommandEnv(manifest) {
 	}
 	return env;
 }
-//#endregion
-//#region src/chat/plugins/auth/auth-token-placeholder.ts
+// src/chat/plugins/auth/auth-token-placeholder.ts
 const DEFAULT_PLACEHOLDERS = { "oauth-bearer": "host_managed_credential" };
 /** Resolve the non-secret sandbox token placeholder for token-backed credentials. */
 function resolveAuthTokenPlaceholder(credentials) {
 	return credentials.authTokenPlaceholder?.trim() || DEFAULT_PLACEHOLDERS[credentials.type];
 }
-//#endregion
-//#region src/chat/plugins/auth/api-headers-broker.ts
+// src/chat/plugins/auth/api-headers-broker.ts
 const MAX_LEASE_MS$1 = 36e5;
 const ENV_PLACEHOLDER_RE = /\$\{([A-Z_][A-Z0-9_]*)\}/g;
 /**
@@ -1094,8 +1124,7 @@ function createApiHeadersBroker(manifest) {
 		};
 	} };
 }
-//#endregion
-//#region src/chat/plugins/auth/oauth-request.ts
+// src/chat/plugins/auth/oauth-request.ts
 const DEFAULT_TOKEN_CONTENT_TYPE = "application/x-www-form-urlencoded";
 function requireNonEmptyTokenField(data, field) {
 	const value = data[field];
@@ -1171,8 +1200,7 @@ function parseOAuthTokenResponse(data, requestedScope, options) {
 	}
 	return parsedOAuthTokenResponseSchema.parse(result);
 }
-//#endregion
-//#region src/chat/plugins/auth/oauth-bearer-broker.ts
+// src/chat/plugins/auth/oauth-bearer-broker.ts
 const MAX_LEASE_MS = 36e5;
 const REFRESH_BUFFER_MS = 3e5;
 const TOKEN_REFRESH_TIMEOUT_MS = 2e4;
@@ -1321,8 +1349,7 @@ function createOAuthBearerBroker(manifest, credentials, deps) {
 		throw new CredentialUnavailableError(provider, `No ${provider} credentials available.`);
 	} };
 }
-//#endregion
-//#region src/chat/plugins/registry.ts
+// src/chat/plugins/registry.ts
 function getLoggedPluginNames() {
 	const globalState = globalThis;
 	globalState.__juniorLoggedPluginNames ??= /* @__PURE__ */ new Set();
@@ -1643,5 +1670,4 @@ function createPluginCatalogRuntime() {
 		}
 	};
 }
-//#endregion
 export { CredentialUnavailableError as _, resolveAuthTokenPlaceholder as a, fetchWithBoundedOAuthErrorBodies as c, actorLogContext as d, credentialContextForActor as f, credentialUserSubjectId as g, credentialSubjectSchema as h, resolvePluginHeaderEnvRefs as i, getOAuthProviderErrorAttributes as l, credentialLogContext as m, buildOAuthTokenRequest as n, resolvePluginCommandEnv as o, credentialContextSchema as p, parseOAuthTokenResponse as r, OAuthProviderError as s, createPluginCatalogRuntime as t, hasRequiredOAuthScope as u, parseInlinePluginManifest as v, parsePluginManifest as y };