@sentry/junior 0.258.0 → 0.259.0

package/dist/{client-DbyHuMFU.js → client-BZdxgKyL.js}

@@ -1,10 +1,10 @@
-import { T as withSpan, _ as serializeGenAiAttribute, f as logException, h as normalizeGenAiFinishReason, i as extractGenAiUsageAttributes, m as logWarn } from "./logging-DsHONhVm.js";
-import { a as toCanonicalInputMessage, n as getCurrentConversationPrivacy, o as toCanonicalOutputMessage, s as toGenAiMessagesTraceAttributes } from "./conversation-privacy-DHP_xnVj.js";
+import { T as withSpan, _ as serializeGenAiAttribute, f as logException, h as normalizeGenAiFinishReason, i as extractGenAiUsageAttributes, m as logWarn } from "./logging-BStXN56b.js";
+import { a as toCanonicalInputMessage, n as getCurrentConversationPrivacy, o as toCanonicalOutputMessage, s as toGenAiMessagesTraceAttributes } from "./conversation-privacy-CFhNKxp-.js";
 import { calculateCost, completeSimple, getEnvApiKey, getModels, registerApiProvider } from "@earendil-works/pi-ai/compat";
 import { stream as streamAnthropic, streamSimple as streamSimpleAnthropic } from "@earendil-works/pi-ai/api/anthropic-messages";
 import { createGatewayProvider } from "@ai-sdk/gateway";
 import { getVercelOidcToken } from "@vercel/oidc";
-import { NoObjectGeneratedError, embedMany, generateObject } from "ai";
+import { Experimental_DecisionRefusalError, NoObjectGeneratedError, embedMany, experimental_decide, generateObject } from "ai";
 // src/chat/optional-string.ts
 /**
 * Normalize optional env-style strings so blank values do not masquerade as
@@ -400,6 +400,7 @@ const GEN_AI_PROVIDER_NAME = GATEWAY_PROVIDER;
 const GEN_AI_SERVER_ADDRESS = "ai-gateway.vercel.sh";
 const GEN_AI_OPERATION_CHAT = "chat";
 const GEN_AI_OPERATION_EMBEDDINGS = "embeddings";
+const GEN_AI_OPERATION_DECIDE = "decide";
 const EMBEDDING_INPUT_COST_USD_PER_MILLION_TOKENS = {
 	"cohere/embed-v4.0": .12,
 	"google/gemini-embedding-001": .15,
@@ -411,6 +412,14 @@ const EMBEDDING_INPUT_COST_USD_PER_MILLION_TOKENS = {
 	"voyage/voyage-3.5": .06,
 	"voyage/voyage-3.5-lite": .02
 };
+const DECISION_INPUT_COST_USD_PER_MILLION_TOKENS = {
+	"openai/gpt-6-luna-decisions": .1,
+	"typesafe-ai/jev": .042
+};
+function decisionCostUsd(modelId, inputTokens) {
+	const costPerMillionTokens = DECISION_INPUT_COST_USD_PER_MILLION_TOKENS[modelId];
+	return costPerMillionTokens === void 0 || inputTokens === void 0 ? void 0 : inputTokens * costPerMillionTokens / 1e6;
+}
 function embeddingCostUsd(modelId, inputTokens) {
 	const costPerMillionTokens = EMBEDDING_INPUT_COST_USD_PER_MILLION_TOKENS[modelId];
 	return costPerMillionTokens === void 0 ? void 0 : inputTokens * costPerMillionTokens / 1e6;
@@ -605,6 +614,50 @@ async function completeObject(params) {
 		...costUsd !== void 0 ? { costUsd } : void 0
 	};
 }
+/** Answer typed decision questions with an AI Gateway decision model, such as Jev. */
+async function completeDecision(params) {
+	const credential = await resolveGatewayCredential();
+	const provider = createGatewayProvider(credential ? { apiKey: credential.token } : {});
+	try {
+		const result = await withSpan(`${GEN_AI_OPERATION_DECIDE} ${params.modelId}`, "gen_ai.decide", logContextFromMetadata(params.modelId, params.metadata), async (setSpanAttributes) => {
+			const result = await experimental_decide({
+				model: provider.decisionModel(params.modelId),
+				state: params.state,
+				questions: params.questions,
+				...params.signal !== void 0 ? { abortSignal: params.signal } : void 0
+			});
+			const costUsd = decisionCostUsd(params.modelId, result.usage.inputTokens);
+			setSpanAttributes(extractGenAiUsageAttributes({
+				...result.usage,
+				...costUsd !== void 0 ? { cost: {
+					input: costUsd,
+					total: costUsd
+				} } : void 0
+			}));
+			return {
+				answers: result.answers,
+				costUsd
+			};
+		}, {
+			"gen_ai.provider.name": GEN_AI_PROVIDER_NAME,
+			"gen_ai.operation.name": GEN_AI_OPERATION_DECIDE,
+			"gen_ai.request.model": params.modelId,
+			...params.promptName ? { "gen_ai.prompt.name": params.promptName } : void 0,
+			"server.address": GEN_AI_SERVER_ADDRESS,
+			"server.port": 443,
+			"gen_ai.provider.auth_mode": credential?.mode ?? "api_key"
+		});
+		return {
+			answers: result.answers,
+			...result.costUsd !== void 0 ? { costUsd: result.costUsd } : void 0
+		};
+	} catch (error) {
+		throw createProviderError(error, {
+			...Experimental_DecisionRefusalError.isInstance(error) ? { kind: "invalid_response" } : void 0,
+			modelId: params.modelId
+		});
+	}
+}
 /** Generate text embeddings through the host-owned AI Gateway provider. */
 async function embedTexts(params) {
 	const texts = params.texts.map((text) => text.trim());
@@ -665,4 +718,4 @@ async function embedTexts(params) {
 		throw providerError;
 	}
 }
-export { toOptionalTrimmed as S, getProviderErrorUserMessage as _, embedTexts as a, getGatewayApiKey as b, hasCompactedConversationContext as c, unwrapCurrentInstruction as d, escapeXml as f, getProviderErrorAttributes as g, findProviderError as h, completeText as i, isCompactionSummaryText as l, createProviderError as m, GEN_AI_SERVER_ADDRESS as n, resolveGatewayModel as o, ProviderError as p, completeObject as r, COMPACTION_SUMMARY_PREFIX as s, GEN_AI_PROVIDER_NAME as t, renderCurrentInstruction as u, isProviderRetryError as v, resolveGatewayCredential as x, MISSING_GATEWAY_CREDENTIALS_ERROR as y };
+export { toOptionalTrimmed as C, resolveGatewayCredential as S, getProviderErrorAttributes as _, completeText as a, MISSING_GATEWAY_CREDENTIALS_ERROR as b, COMPACTION_SUMMARY_PREFIX as c, renderCurrentInstruction as d, unwrapCurrentInstruction as f, findProviderError as g, createProviderError as h, completeObject as i, hasCompactedConversationContext as l, ProviderError as m, GEN_AI_SERVER_ADDRESS as n, embedTexts as o, escapeXml as p, completeDecision as r, resolveGatewayModel as s, GEN_AI_PROVIDER_NAME as t, isCompactionSummaryText as u, getProviderErrorUserMessage as v, getGatewayApiKey as x, isProviderRetryError as y };

package/dist/{config-_WO_AjCB.js → config-Deqpfpg9.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-nwUcYXjP.js";
-import { S as toOptionalTrimmed, o as resolveGatewayModel } from "./client-DbyHuMFU.js";
-import { m as logWarn } from "./logging-DsHONhVm.js";
+import { C as toOptionalTrimmed, s as resolveGatewayModel } from "./client-BZdxgKyL.js";
+import { m as logWarn } from "./logging-BStXN56b.js";
 import { l as TURN_REASONING_LEVELS, s as modelProfileSchema, t as DEFAULT_MODEL_PROFILES, u as parseTurnReasoningLevel } from "./model-profile-Bg8EoCKD.js";
 // src/chat/slack/emoji.ts
 const SLACK_EMOJI_NAME_RE = /^(?:[a-z0-9_+-]+)(?:::(?:skin-tone-[2-6]))?$/;
@@ -145,6 +145,7 @@ const DEFAULT_FAST_MODEL_ID = resolveGatewayModel("openai/gpt-6-luna").id;
 const DEFAULT_GUARDIAN_MODEL_ID = resolveGatewayModel("openai/gpt-6-luna").id;
 const DEFAULT_HANDOFF_MODEL_ID = resolveGatewayModel(DEFAULT_MODEL_PROFILES.handoff.modelId).id;
 const DEFAULT_WEB_SEARCH_MODEL_ID = resolveGatewayModel("openai/gpt-6-luna").id;
+const DEFAULT_DECISION_MODEL_ID = "typesafe-ai/jev";
 const DEFAULT_EMBEDDING_MODEL_ID = "openai/text-embedding-3-small";
 const DEFAULT_IMAGE_GENERATION_MODEL_ID = "google/gemini-3-pro-image";
 const DEFAULT_VISION_MODEL_ID = resolveGatewayModel("openai/gpt-5.6-sol").id;
@@ -260,6 +261,7 @@ function readBotConfig(env, functionMaxDurationSeconds) {
 		profiles: parseProfiles(env.AI_MODEL_PROFILES, modelId, handoffModelId),
 		contextWindowTokens: parseOptionalPositiveInteger("AI_MODEL_CONTEXT_WINDOW_TOKENS", env.AI_MODEL_CONTEXT_WINDOW_TOKENS) ?? DEFAULT_MODEL_CONTEXT_WINDOW_TOKENS,
 		reasoningLevel: reasoningLevel === void 0 ? void 0 : parseTurnReasoningLevel(reasoningLevel),
+		decisionModelId: toOptionalTrimmed(env.AI_DECISION_MODEL) ?? DEFAULT_DECISION_MODEL_ID,
 		fastModelId,
 		guardianModelId,
 		imageGenerationModelId: toOptionalTrimmed(env.AI_IMAGE_MODEL) ?? DEFAULT_IMAGE_GENERATION_MODEL_ID,
@@ -422,6 +424,7 @@ function getRuntimeMetadata() {
 }
 /** Apply model overrides from createApp(). */
 function setBotModelConfig(config) {
+	if (config.decisionModelId !== void 0) botConfig.decisionModelId = requireModelId("decisionModelId", config.decisionModelId, toOptionalTrimmed);
 	if (config.embeddingModelId !== void 0) botConfig.embeddingModelId = requireModelId("embeddingModelId", config.embeddingModelId, validateEmbeddingModelId);
 	if (config.fastModelId !== void 0) botConfig.fastModelId = requireModelId("fastModelId", config.fastModelId, validateGatewayModelId);
 	if (config.guardianModelId !== void 0) botConfig.guardianModelId = requireModelId("guardianModelId", config.guardianModelId, validateGatewayModelId);

package/dist/{connections-ag_1JOhB.js → connections-9gJkfS85.js}

@@ -1,12 +1,13 @@
-import { It as startOAuthFlow, c as deleteMcpAuthSessionsForUserProvider, l as deleteMcpServerSessionId, u as deleteMcpStoredOAuthCredentials } from "./agent-runner-DGsFQw72.js";
-import { A as deleteProviderIdentityForUser, c as getConversationEventStore, f as getSqlExecutor, k as deleteProviderIdentityForSlackUser } from "./viewer-CGvvRqKp.js";
-import { u as hasRequiredOAuthScope } from "./registry-Du566MtJ.js";
-import { n as pluginCatalogRuntime } from "./catalog-runtime-BN4DVxco.js";
-import { K as loadTurnCheckpoint, X as failTurnRecord, Z as getTurnRecord } from "./tasks-CEXKTASS.js";
-import { w as getStateAdapter } from "./profile-DpYjfKke.js";
-import { a as getVercelConversationWorkQueue } from "./job-queue-DVe37it2.js";
-import { m as ensureConversationWake, w as requestConversationWork } from "./store-DJLwq4x8.js";
-import { n as resolveTurnSessionRouting } from "./turn-session-routing-CUxtfpr7.js";
+import { Ft as startOAuthFlow, c as deleteMcpAuthSessionsForUserProvider, l as deleteMcpServerSessionId, u as deleteMcpStoredOAuthCredentials } from "./agent-runner-CPSd7rKm.js";
+import { n as botConfig } from "./config-Deqpfpg9.js";
+import { A as deleteProviderIdentityForUser, c as getConversationEventStore, f as getSqlExecutor, k as deleteProviderIdentityForSlackUser } from "./viewer-B2_ABsYi.js";
+import { u as hasRequiredOAuthScope } from "./registry-B_M_x_iS.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-B8SuFPGb.js";
+import { K as loadTurnCheckpoint, X as failTurnRecord, Z as getTurnRecord } from "./tasks-DieKX3d4.js";
+import { r as getStateAdapter } from "./adapter-Bn0gFVSF.js";
+import { a as getVercelConversationWorkQueue } from "./job-queue-vdGU-5ge.js";
+import { m as ensureConversationWake, w as requestConversationWork } from "./store-B1GES4gC.js";
+import { n as resolveTurnSessionRouting } from "./turn-session-routing-BlajheOU.js";
 import { z } from "zod";
 import { randomBytes, randomUUID } from "node:crypto";
 // src/chat/task-execution/authorized-turn.ts
@@ -125,6 +126,169 @@ async function wakeAuthorizedTurn(args, queue) {
 	const request = await recordTurnAuthorization(args);
 	if (request) await wakePausedTurn(request, { queue });
 }
+// src/handlers/oauth-html.ts
+/** Build pre-escaped callback HTML with the shared response security policy. */
+function htmlCallbackResponse(title, message, status, options = {}) {
+	const footerMessage = options.footerMessage ?? `You can close this tab and return to ${botConfig.userName}.`;
+	const isSuccess = status >= 200 && status < 300;
+	const statusClass = isSuccess ? "success" : "error";
+	const statusIcon = isSuccess ? "" : "!";
+	const html = `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="color-scheme" content="light dark">
+  <title>${title}</title>
+  <style>
+    :root {
+      color-scheme: light dark;
+      --canvas: #f4f1fa;
+      --surface: #ffffff;
+      --text: #211a2c;
+      --muted: #6e6479;
+      --border: #ded7e8;
+      --accent: #6c5fc7;
+      --success: #16835c;
+      --success-soft: #ddf5ea;
+      --error: #bc3d50;
+      --error-soft: #fce7eb;
+      --shadow: 0 24px 64px rgba(45, 31, 63, 0.14);
+    }
+
+    * { box-sizing: border-box; }
+
+    body {
+      min-height: 100vh;
+      margin: 0;
+      display: grid;
+      place-items: center;
+      padding: 24px;
+      background: var(--canvas);
+      color: var(--text);
+      font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+    }
+
+    main {
+      width: min(100%, 480px);
+      padding: 48px 40px 40px;
+      text-align: center;
+      background: var(--surface);
+      border: 1px solid var(--border);
+      border-radius: 24px;
+      box-shadow: var(--shadow);
+    }
+
+    .brand {
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      margin-bottom: 32px;
+      color: var(--muted);
+      font-size: 14px;
+      font-weight: 700;
+      letter-spacing: 0.08em;
+      text-transform: uppercase;
+    }
+
+    .brand-mark {
+      width: 10px;
+      height: 10px;
+      background: var(--accent);
+      border-radius: 3px;
+      transform: rotate(12deg);
+    }
+
+    .status {
+      width: 64px;
+      height: 64px;
+      margin: 0 auto 24px;
+      display: grid;
+      place-items: center;
+      border-radius: 20px;
+      font-size: 32px;
+      font-weight: 750;
+      line-height: 1;
+    }
+
+    .status.success { color: var(--success); background: var(--success-soft); }
+    .status.success::before {
+      content: "";
+      width: 12px;
+      height: 24px;
+      margin-top: -5px;
+      border-right: 4px solid currentColor;
+      border-bottom: 4px solid currentColor;
+      transform: rotate(45deg);
+    }
+    .status.error { color: var(--error); background: var(--error-soft); }
+
+    h1 {
+      margin: 0;
+      font-size: clamp(28px, 7vw, 36px);
+      line-height: 1.12;
+      letter-spacing: -0.035em;
+    }
+
+    .message {
+      margin: 16px auto 0;
+      color: var(--muted);
+      font-size: 17px;
+      line-height: 1.6;
+    }
+
+    .footer {
+      margin: 32px 0 0;
+      padding-top: 24px;
+      color: var(--muted);
+      border-top: 1px solid var(--border);
+      font-size: 14px;
+      line-height: 1.5;
+    }
+
+    @media (prefers-color-scheme: dark) {
+      :root {
+        --canvas: #15121a;
+        --surface: #211c28;
+        --text: #f6f1fb;
+        --muted: #b8adbf;
+        --border: #3a3243;
+        --accent: #a99af0;
+        --success: #72d6ad;
+        --success-soft: #193c30;
+        --error: #ff9aaa;
+        --error-soft: #48262e;
+        --shadow: 0 24px 64px rgba(0, 0, 0, 0.36);
+      }
+    }
+
+    @media (max-width: 520px) {
+      body { padding: 16px; }
+      main { padding: 40px 24px 32px; border-radius: 20px; }
+    }
+  </style>
+</head>
+<body>
+  <main>
+    <div class="brand"><span class="brand-mark" aria-hidden="true"></span>${botConfig.userName}</div>
+    <div class="status ${statusClass}" aria-hidden="true">${statusIcon}</div>
+    <h1>${title}</h1>
+    <p class="message">${message}</p>
+    <p class="footer">${footerMessage}</p>
+  </main>
+</body>
+</html>`;
+	return new Response(html, {
+		status,
+		headers: {
+			"Cache-Control": "no-store",
+			"Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'",
+			"Content-Type": "text/html; charset=utf-8",
+			"Referrer-Policy": "no-referrer",
+			"X-Content-Type-Options": "nosniff"
+		}
+	});
+}
 // src/chat/conversations/web-authorization.ts
 const WEB_AUTHORIZATION_PREFIX = "junior:web_authorization:v1";
 const WEB_AUTHORIZATION_TTL_MS = 864e5;
@@ -236,4 +400,4 @@ async function disconnectConnection(userId, provider, userTokenStore, viewerUser
 	if (tokens?.account) await deleteProviderIdentityForUser(getSqlExecutor(), viewerUserId, provider, tokens.account.id);
 	await unlinkProvider(userId, provider, userTokenStore);
 }
-export { startConnection as a, deleteWebAuthorization as c, getPausedTurnRequest as d, wakeAuthorizedTurn as f, readConnectedOAuthTokens as i, getWebAuthorization as l, getTurnAuthorization as m, isConnectableProvider as n, unlinkProvider as o, wakePausedTurn as p, listConnections as r, createWebAuthorization as s, disconnectConnection as t, createPausedTurns as u };
+export { startConnection as a, deleteWebAuthorization as c, createPausedTurns as d, getPausedTurnRequest as f, getTurnAuthorization as h, readConnectedOAuthTokens as i, getWebAuthorization as l, wakePausedTurn as m, isConnectableProvider as n, unlinkProvider as o, wakeAuthorizedTurn as p, listConnections as r, createWebAuthorization as s, disconnectConnection as t, htmlCallbackResponse as u };

package/dist/{conversation-privacy-DHP_xnVj.js → conversation-privacy-CFhNKxp-.js}

@@ -1,4 +1,4 @@
-import { m as logWarn } from "./logging-DsHONhVm.js";
+import { m as logWarn } from "./logging-BStXN56b.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 // src/chat/conversation-privacy.ts
 const SAFE_METADATA_KEY_LIMIT = 20;

package/dist/{credential-sync-B-CPX_ag.js → credential-sync-BABGymK3.js}

@@ -1,188 +1,26 @@
-import { Ft as resolveBaseUrl, Lt as createUserTokenStore, Nt as formatProviderLabel, Pt as parseOAuthStatePayload, _ as resolvePluginOAuthAccount, d as getMcpAuthSession, f as getMcpStoredOAuthCredentials, o as finalizeMcpAuthorization, p as putMcpStoredOAuthCredentials, s as deleteMcpAuthSession, x as lookupSlackUserProfile, xt as getMcpProviderErrorAttributes } from "./agent-runner-DGsFQw72.js";
-import { f as escapeXml } from "./client-DbyHuMFU.js";
-import { L as isNativeIdentityProvider, f as logException, g as runBestEffort, m as logWarn } from "./logging-DsHONhVm.js";
-import { a as getRuntimeMetadata, n as botConfig } from "./config-_WO_AjCB.js";
+import { It as createUserTokenStore, Mt as formatProviderLabel, Nt as parseOAuthStatePayload, Pt as resolveBaseUrl, _ as resolvePluginOAuthAccount, d as getMcpAuthSession, f as getMcpStoredOAuthCredentials, o as finalizeMcpAuthorization, p as putMcpStoredOAuthCredentials, s as deleteMcpAuthSession, x as lookupSlackUserProfile } from "./agent-runner-CPSd7rKm.js";
+import { p as escapeXml } from "./client-BZdxgKyL.js";
+import { L as isNativeIdentityProvider, f as logException, g as runBestEffort, m as logWarn } from "./logging-BStXN56b.js";
+import { a as getRuntimeMetadata, n as botConfig } from "./config-Deqpfpg9.js";
 import { f as parseSlackUserId } from "./actor-tlxzqaRe.js";
-import { F as upsertIdentity, I as upsertLinkedIdentity, b as identityFromActor, f as getSqlExecutor, j as findUserByVerifiedEmails } from "./viewer-CGvvRqKp.js";
+import { F as upsertIdentity, I as upsertLinkedIdentity, b as identityFromActor, f as getSqlExecutor, j as findUserByVerifiedEmails } from "./viewer-B2_ABsYi.js";
 import { i as homeDir } from "./package-discovery-DJBompdd.js";
-import { n as buildOAuthTokenRequest, r as parseOAuthTokenResponse, u as hasRequiredOAuthScope } from "./registry-Du566MtJ.js";
-import { n as pluginCatalogRuntime } from "./catalog-runtime-BN4DVxco.js";
-import { t as discoverSkills } from "./skills-DyQBLIrK.js";
-import { B as postSlackMessage, Ft as recordAuthenticationLinked, It as recordAuthorizationCompleted, Z as getTurnRecord } from "./tasks-CEXKTASS.js";
-import { Ht as getSlackClient } from "./agent-hooks-BJ_5mlRH.js";
-import { E as acquireActiveLock, w as getStateAdapter } from "./profile-DpYjfKke.js";
-import { i as getConversationPendingAuth } from "./pending-auth-D8J1uJUS.js";
-import { r as getPersistedThreadState, s as coerceThreadConversationState } from "./thread-state-W3f6kAtz.js";
-import { c as deleteWebAuthorization, f as wakeAuthorizedTurn, i as readConnectedOAuthTokens, p as wakePausedTurn } from "./connections-ag_1JOhB.js";
+import { n as buildOAuthTokenRequest, r as parseOAuthTokenResponse, u as hasRequiredOAuthScope } from "./registry-B_M_x_iS.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-B8SuFPGb.js";
+import { t as discoverSkills } from "./skills-CiWS5_Ub.js";
+import { B as postSlackMessage, Ft as recordAuthenticationLinked, It as recordAuthorizationCompleted, Z as getTurnRecord } from "./tasks-DieKX3d4.js";
+import { Ht as getSlackClient } from "./agent-hooks-B00FaKdP.js";
+import { i as getConversationPendingAuth } from "./pending-auth-rG5U_QS1.js";
+import { a as acquireActiveLock, r as getStateAdapter } from "./adapter-Bn0gFVSF.js";
+import { _ as getMcpProviderErrorAttributes } from "./service-account-BzhW7kXu.js";
+import { r as getPersistedThreadState, s as coerceThreadConversationState } from "./thread-state-DpSWS4Rr.js";
+import { c as deleteWebAuthorization, i as readConnectedOAuthTokens, m as wakePausedTurn, p as wakeAuthorizedTurn, u as htmlCallbackResponse } from "./connections-9gJkfS85.js";
 import { n as relayLocalOAuthCallback } from "./oauth-relay-CTygMkNx.js";
 import path from "node:path";
 import { z } from "zod";
 import { createHmac, createSecretKey, timingSafeEqual } from "node:crypto";
 import { pluginStoredTokensSchema } from "@sentry/junior-plugin-api";
 import fs from "node:fs";
-// src/handlers/oauth-html.ts
-/** Build pre-escaped callback HTML with the shared response security policy. */
-function htmlCallbackResponse(title, message, status, options = {}) {
-	const footerMessage = options.footerMessage ?? `You can close this tab and return to ${botConfig.userName}.`;
-	const isSuccess = status >= 200 && status < 300;
-	const statusClass = isSuccess ? "success" : "error";
-	const statusIcon = isSuccess ? "" : "!";
-	const html = `<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <meta name="color-scheme" content="light dark">
-  <title>${title}</title>
-  <style>
-    :root {
-      color-scheme: light dark;
-      --canvas: #f4f1fa;
-      --surface: #ffffff;
-      --text: #211a2c;
-      --muted: #6e6479;
-      --border: #ded7e8;
-      --accent: #6c5fc7;
-      --success: #16835c;
-      --success-soft: #ddf5ea;
-      --error: #bc3d50;
-      --error-soft: #fce7eb;
-      --shadow: 0 24px 64px rgba(45, 31, 63, 0.14);
-    }
-
-    * { box-sizing: border-box; }
-
-    body {
-      min-height: 100vh;
-      margin: 0;
-      display: grid;
-      place-items: center;
-      padding: 24px;
-      background: var(--canvas);
-      color: var(--text);
-      font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
-    }
-
-    main {
-      width: min(100%, 480px);
-      padding: 48px 40px 40px;
-      text-align: center;
-      background: var(--surface);
-      border: 1px solid var(--border);
-      border-radius: 24px;
-      box-shadow: var(--shadow);
-    }
-
-    .brand {
-      display: inline-flex;
-      align-items: center;
-      gap: 8px;
-      margin-bottom: 32px;
-      color: var(--muted);
-      font-size: 14px;
-      font-weight: 700;
-      letter-spacing: 0.08em;
-      text-transform: uppercase;
-    }
-
-    .brand-mark {
-      width: 10px;
-      height: 10px;
-      background: var(--accent);
-      border-radius: 3px;
-      transform: rotate(12deg);
-    }
-
-    .status {
-      width: 64px;
-      height: 64px;
-      margin: 0 auto 24px;
-      display: grid;
-      place-items: center;
-      border-radius: 20px;
-      font-size: 32px;
-      font-weight: 750;
-      line-height: 1;
-    }
-
-    .status.success { color: var(--success); background: var(--success-soft); }
-    .status.success::before {
-      content: "";
-      width: 12px;
-      height: 24px;
-      margin-top: -5px;
-      border-right: 4px solid currentColor;
-      border-bottom: 4px solid currentColor;
-      transform: rotate(45deg);
-    }
-    .status.error { color: var(--error); background: var(--error-soft); }
-
-    h1 {
-      margin: 0;
-      font-size: clamp(28px, 7vw, 36px);
-      line-height: 1.12;
-      letter-spacing: -0.035em;
-    }
-
-    .message {
-      margin: 16px auto 0;
-      color: var(--muted);
-      font-size: 17px;
-      line-height: 1.6;
-    }
-
-    .footer {
-      margin: 32px 0 0;
-      padding-top: 24px;
-      color: var(--muted);
-      border-top: 1px solid var(--border);
-      font-size: 14px;
-      line-height: 1.5;
-    }
-
-    @media (prefers-color-scheme: dark) {
-      :root {
-        --canvas: #15121a;
-        --surface: #211c28;
-        --text: #f6f1fb;
-        --muted: #b8adbf;
-        --border: #3a3243;
-        --accent: #a99af0;
-        --success: #72d6ad;
-        --success-soft: #193c30;
-        --error: #ff9aaa;
-        --error-soft: #48262e;
-        --shadow: 0 24px 64px rgba(0, 0, 0, 0.36);
-      }
-    }
-
-    @media (max-width: 520px) {
-      body { padding: 16px; }
-      main { padding: 40px 24px 32px; border-radius: 20px; }
-    }
-  </style>
-</head>
-<body>
-  <main>
-    <div class="brand"><span class="brand-mark" aria-hidden="true"></span>${botConfig.userName}</div>
-    <div class="status ${statusClass}" aria-hidden="true">${statusIcon}</div>
-    <h1>${title}</h1>
-    <p class="message">${message}</p>
-    <p class="footer">${footerMessage}</p>
-  </main>
-</body>
-</html>`;
-	return new Response(html, {
-		status,
-		headers: {
-			"Cache-Control": "no-store",
-			"Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'",
-			"Content-Type": "text/html; charset=utf-8",
-			"Referrer-Policy": "no-referrer",
-			"X-Content-Type-Options": "nosniff"
-		}
-	});
-}
 // src/handlers/mcp-oauth-callback.ts
 /**
 * MCP OAuth callback handler.

package/dist/{executor-RvG6kVe1.js → executor-Bb3eQb8q.js}

@@ -1,6 +1,6 @@
-import { f as logException } from "./logging-DsHONhVm.js";
+import { f as logException } from "./logging-BStXN56b.js";
 import { g as startSpanManual } from "./sentry-BBUlHih9.js";
-import "./config-_WO_AjCB.js";
+import "./config-Deqpfpg9.js";
 import { a as juniorAgentInvocations, c as juniorIdentities, d as juniorDestinations, f as timestamptz, i as juniorAgentBindings, l as juniorUsers, s as juniorConversations } from "./agent-invocations-Qfz7dWgU.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { sql } from "drizzle-orm";

package/dist/{images-C2J_bj2g.js → images-BbSdVHC6.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-nwUcYXjP.js";
-import { D as storeAttachment, T as readLiveAttachment } from "./agent-runner-DGsFQw72.js";
-import { f as getSqlExecutor } from "./viewer-CGvvRqKp.js";
+import { D as storeAttachment, T as readLiveAttachment } from "./agent-runner-CPSd7rKm.js";
+import { f as getSqlExecutor } from "./viewer-B2_ABsYi.js";
 import { L as detectImageMediaType } from "./conversation-DjN3mlog.js";
 // src/chat/attachments/images.ts
 var images_exports = /* @__PURE__ */ __exportAll({

package/dist/instrumentation.js

@@ -1,6 +1,6 @@
-import { F as getDeploymentTelemetryAttributes, P as getDeploymentServiceVersion } from "./logging-DsHONhVm.js";
+import { F as getDeploymentTelemetryAttributes, P as getDeploymentServiceVersion } from "./logging-BStXN56b.js";
 import { _ as vercelAIIntegration, a as getClient, b as withStreamedSpan, c as init, o as getGlobalScope } from "./sentry-BBUlHih9.js";
-import { n as getCurrentConversationPrivacy } from "./conversation-privacy-DHP_xnVj.js";
+import { n as getCurrentConversationPrivacy } from "./conversation-privacy-CFhNKxp-.js";
 import { t as consumePrivateTraceResultMarker } from "./private-trace-result-CE7_lEdq.js";
 // src/chat/sentry-payload-filter.ts
 const PAYLOAD_ATTRIBUTE_KEYS = /* @__PURE__ */ new Set([

package/dist/{job-queue-DVe37it2.js → job-queue-vdGU-5ge.js}

@@ -1,4 +1,4 @@
-import { i as getChatConfig } from "./config-_WO_AjCB.js";
+import { i as getChatConfig } from "./config-Deqpfpg9.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { z } from "zod";
 import { createHash, createHmac, timingSafeEqual } from "node:crypto";

package/dist/{logging-DsHONhVm.js → logging-BStXN56b.js}

@@ -1,5 +1,5 @@
 import { d as setTag, f as setUser, h as startSpan, i as getActiveSpan, l as logger, n as captureMessage, p as spanToJSON, s as getTraceData, t as captureException, y as withScope } from "./sentry-BBUlHih9.js";
-import { t as JUNIOR_VERSION } from "./version-C0U6rHg0.js";
+import { t as JUNIOR_VERSION } from "./version-B_XumRx-.js";
 import path from "node:path";
 import { styleText } from "node:util";
 import { ConfigError, configureSync, getConfig, getLogger } from "@logtape/logtape";

package/dist/{message-DyitL8no.js → message-DRf6m4uO.js}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./rolldown-runtime-nwUcYXjP.js";
-import { Ht as toolInvocationDestination, Q as getActiveAgentInvocationForConversation, Vt as actorFromRun, Y as createAgentInvocationForMessage, Z as findChildAgentConversationId, _t as AgentMessageTargetError, vt as PARENT_AGENT_TARGET } from "./agent-runner-DGsFQw72.js";
-import { n as enqueueAgentMessageToParent } from "./result-BBbKA61B.js";
-import { r as enqueueAgentInvocation } from "./work-DRcsJ3hV.js";
+import { Bt as actorFromRun, Q as getActiveAgentInvocationForConversation, Vt as toolInvocationDestination, Y as createAgentInvocationForMessage, Z as findChildAgentConversationId, _t as AgentMessageTargetError, vt as PARENT_AGENT_TARGET } from "./agent-runner-CPSd7rKm.js";
+import { n as enqueueAgentMessageToParent } from "./result-DEZH_AnZ.js";
+import { r as enqueueAgentInvocation } from "./work-D3QKiV0O.js";
 // src/chat/agent-invocations/message.ts
 var message_exports = /* @__PURE__ */ __exportAll({ bindMessageAgent: () => bindMessageAgent });
 /**

package/dist/nitro.d.ts

@@ -1,5 +1,5 @@
-import { r as JuniorDashboardOptions } from "./app-PX2H1PxU.js";
-import { n as JuniorPluginSet } from "./plugins-B11Mfkmv.js";
+import { r as JuniorDashboardOptions } from "./app-Bbxrehjf.js";
+import { n as JuniorPluginSet } from "./plugins-B_0Cr0MO.js";
 export type JuniorNitroDashboardOptions = JuniorDashboardOptions;
 export interface JuniorPluginModuleReference {
   /** Runtime-safe module that exports a `defineJuniorPlugins(...)` set. */

package/dist/nitro.js

@@ -1,8 +1,8 @@
-import { A as JUNIOR_RETENTION_CRON_SCHEDULE, D as JUNIOR_HEARTBEAT_CRON_SCHEDULE, E as JUNIOR_CONVERSATION_WORK_CALLBACK_ROUTE, M as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, O as JUNIOR_HEARTBEAT_ROUTE, j as JUNIOR_RETENTION_ROUTE, k as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE } from "./logging-DsHONhVm.js";
+import { A as JUNIOR_RETENTION_CRON_SCHEDULE, D as JUNIOR_HEARTBEAT_CRON_SCHEDULE, E as JUNIOR_CONVERSATION_WORK_CALLBACK_ROUTE, M as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, O as JUNIOR_HEARTBEAT_ROUTE, j as JUNIOR_RETENTION_ROUTE, k as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE } from "./logging-BStXN56b.js";
 import { d as resolvePackageDir, t as discoverInstalledPluginPackageContent, u as isValidPackageName } from "./package-discovery-DJBompdd.js";
-import { o as resolveConversationWorkQueueTopic, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-DVe37it2.js";
+import { o as resolveConversationWorkQueueTopic, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-vdGU-5ge.js";
 import { a as pluginRuntimeRegistrationsFromPluginSet, r as pluginCatalogConfigFromPluginSet } from "./plugins-DOm9Y6qI.js";
-import { t as PLUGIN_TASK_QUEUE_TOPIC } from "./task-queue-BzW4MaWU.js";
+import { t as PLUGIN_TASK_QUEUE_TOPIC } from "./task-queue-BAeGEMjJ.js";
 import { n as loadPluginSetFromModule, r as resolvePluginModule } from "./plugin-module-Cf5gVPWP.js";
 import path from "node:path";
 import { cpSync, existsSync, mkdirSync, readdirSync, statSync } from "node:fs";

package/dist/{oauth-callback-server-CDby-pCn.js → oauth-callback-server-JmOgLcGl.js}

@@ -1,5 +1,5 @@
-import { Lt as createUserTokenStore } from "./agent-runner-DGsFQw72.js";
-import { a as GET, n as syncLocalOAuthCredential, r as GET$1 } from "./credential-sync-B-CPX_ag.js";
+import { It as createUserTokenStore } from "./agent-runner-CPSd7rKm.js";
+import { a as GET, n as syncLocalOAuthCredential, r as GET$1 } from "./credential-sync-BABGymK3.js";
 import { createServer } from "node:http";
 // src/chat/local/oauth-callback-server.ts
 const LOCAL_OAUTH_TIMEOUT_MS = 6e5;