@sentry/junior 0.263.0 → 0.265.0

package/dist/{automation-CWX0qL8U.js → automation-2RbKzpMT.js}

@@ -425,13 +425,18 @@ const scheduledAutomationSummarySchema = automationSummaryBaseSchema.extend({
 		"completed"
 	])
 }).strict();
-const eventAutomationSummarySchema = automationSummaryBaseSchema.extend({
+/** An Event trigger in plain words, the same in the dashboard and Slack. */
+const eventTriggerDescriptionSchema = z.object({
 	events: z.array(z.string().min(1)).min(1),
-	match: eventMatchSchema.optional(),
+	filters: z.array(z.string().min(1)),
+	/** Why the trigger cannot work. The trigger is available when empty. */
+	problems: z.array(z.string().min(1))
+}).strict();
+const eventAutomationSummarySchema = automationSummaryBaseSchema.extend({
+	trigger: eventTriggerDescriptionSchema,
 	kind: z.literal("event"),
 	resource: z.string().min(1),
 	source: z.string().min(1),
-	triggerAvailable: z.boolean(),
 	statusReason: z.string().optional(),
 	status: z.enum([
 		"active",
@@ -509,13 +514,22 @@ const automationExecutionStatusSchema = z.enum([
 	"failed"
 ]);
 const automationExecutionSchema = z.object({
+	/** Automation version that the run dispatched, when recorded. */
+	automationVersion: z.number().int().positive().optional(),
 	conversationId: z.string().min(1).optional(),
 	/** Estimated model cost for the linked conversation, when known. */
 	costUsd: z.number().finite().nonnegative().optional(),
+	/** Accounts that the dispatched version could use. */
+	credentialMode: z.enum(["creator", "system"]).optional(),
 	/** Cumulative conversation runtime in milliseconds, when known. */
 	durationMs: z.number().finite().nonnegative().optional(),
+	/** Reason that the run failed or was blocked, when recorded. */
+	error: z.string().min(1).optional(),
 	executedAt: z.string().datetime(),
 	executionId: z.string().min(1),
+	/** Planned occurrence of a Scheduled automation run. */
+	scheduledFor: z.string().datetime().optional(),
+	startedAt: z.string().datetime().optional(),
 	status: automationExecutionStatusSchema,
 	title: z.string().min(1).optional(),
 	/** Cumulative conversation token total, when known. */
@@ -555,8 +569,7 @@ const automationVersionFields = {
 	/** Null for versions saved by the upgrade, because the editor is unknown. */
 	editedBy: eventAutomationPrincipalSchema.nullable()
 };
-/** One saved Automation definition. Newer versions have larger numbers. */
-const automationVersionSchema = z.discriminatedUnion("kind", [z.object({
+const scheduledAutomationVersionSchema = z.object({
 	...automationVersionFields,
 	kind: z.literal("scheduled"),
 	definition: scheduledAutomationSchema.pick({
@@ -565,7 +578,8 @@ const automationVersionSchema = z.discriminatedUnion("kind", [z.object({
 		outcomes: true,
 		schedule: true
 	}).extend(automationDefinitionFields).strict()
-}).strict(), z.object({
+}).strict();
+const eventAutomationVersionSchema = z.object({
 	...automationVersionFields,
 	kind: z.literal("event"),
 	definition: eventAutomationSchema.pick({
@@ -574,10 +588,18 @@ const automationVersionSchema = z.discriminatedUnion("kind", [z.object({
 		outcomes: true,
 		trigger: true
 	}).extend(automationDefinitionFields).strict()
-}).strict()]);
+}).strict();
+/** One saved Automation definition. Newer versions have larger numbers. */
+const automationVersionSchema = z.discriminatedUnion("kind", [scheduledAutomationVersionSchema, eventAutomationVersionSchema]);
+/**
+* One version in the version history. An Event version also has its saved
+* trigger in plain words. The definition stays as saved, so it can be made
+* active again.
+*/
+const listedAutomationVersionSchema = z.discriminatedUnion("kind", [scheduledAutomationVersionSchema, eventAutomationVersionSchema.extend({ trigger: eventTriggerDescriptionSchema }).strict()]);
 /** Newest versions first. */
 const automationVersionListSchema = z.object({
-	versions: z.array(automationVersionSchema),
+	versions: z.array(listedAutomationVersionSchema),
 	/** Newest version that matches the current definition. Null when none match. */
 	activeVersion: z.number().int().positive().nullable(),
 	truncated: z.boolean()
@@ -617,7 +639,6 @@ const automationEditSchema = z.discriminatedUnion("kind", [automationEditBaseSch
 }).strict(), automationEditBaseSchema.extend({
 	kind: z.literal("event"),
 	trigger: eventAutomationTriggerSchema,
-	triggerAvailable: z.boolean(),
 	status: z.enum([
 		"active",
 		"blocked",

package/dist/{briefs-h55v5lX9.js → briefs-DRjx8kQ9.js}

@@ -1,7 +1,7 @@
-import { i as completeObject } from "./client-DZBCBj1M.js";
+import { i as completeObject } from "./client-DX34VNtH.js";
 import { r as defaultModelId } from "./model-profile-Bg8EoCKD.js";
 import { J as parseBriefInput, W as briefCodeChangeSchema, d as conversationDetailReportSchema, p as conversationEventPageSchema } from "./conversation-B0baEwoA.js";
-import { n as briefEntriesFromReportEvents, s as generateBrief, t as BRIEF_PROMPT } from "./prompt-CxatQVaj.js";
+import { n as briefEntriesFromReportEvents, s as generateBrief, t as BRIEF_PROMPT } from "./prompt-CvaDdSX3.js";
 import { CLI_USAGE } from "./cli/run.js";
 import path from "node:path";
 import { z } from "zod";
@@ -267,7 +267,7 @@ async function parseRunOptions(argv) {
 * `DATABASE_URL` at import, and `briefs pull` must work with only a token.
 */
 async function configuredDefaultModelId() {
-	const { botConfig } = await import("./config-Dnv8KmNs.js").then((n) => n.r);
+	const { botConfig } = await import("./config-BayQ9hHH.js").then((n) => n.r);
 	return defaultModelId(botConfig);
 }
 function apiUrl(baseUrl, pathname) {

package/dist/{catalog-runtime-Suf-aLlh.js → catalog-runtime-D3qbJlYz.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-nwUcYXjP.js";
-import { t as createPluginCatalogRuntime } from "./registry-BFzQFV_y.js";
+import { t as createPluginCatalogRuntime } from "./registry-COTeZ2cV.js";
 // src/chat/plugins/catalog-runtime.ts
 var catalog_runtime_exports = /* @__PURE__ */ __exportAll({ pluginCatalogRuntime: () => pluginCatalogRuntime });
 const pluginCatalogRuntime = createPluginCatalogRuntime();

package/dist/cli/chat.js

@@ -1,4 +1,4 @@
-import { n as executeAgentRun, t as createAgentRunner } from "../agent-runner-BUBas7Yy.js";
+import { n as executeAgentRun, t as createAgentRunner } from "../agent-runner-C6MwHJEs.js";
 import { t as loadAppPluginSet } from "../plugin-module-Cf5gVPWP.js";
 import path from "node:path";
 import { createHash, randomUUID } from "node:crypto";
@@ -99,10 +99,10 @@ async function loadLocalPluginSet() {
 async function configureLocalChatPlugins(pluginSet) {
 	const [pluginsModule, agentHooksModule, catalogRuntimeModule, validationModule, databaseModule] = await Promise.all([
 		import("../plugins-DOm9Y6qI.js").then((n) => n.o),
-		import("../agent-hooks-CqnZfuCt.js").then((n) => n.t),
-		import("../catalog-runtime-Suf-aLlh.js").then((n) => n.t),
-		import("../validation-BeTriWC2.js").then((n) => n.r),
-		import("../viewer-DmNRM88V.js").then((n) => n.s)
+		import("../credentialed-C6pKlB1p.js").then((n) => n.a),
+		import("../catalog-runtime-D3qbJlYz.js").then((n) => n.t),
+		import("../validation-C0X3CX51.js").then((n) => n.r),
+		import("../viewer-B2wXNspU.js").then((n) => n.c)
 	]);
 	const resolvedPluginSet = pluginSet === void 0 ? await loadLocalPluginSet() : pluginSet ?? void 0;
 	const plugins = pluginsModule.pluginRuntimeRegistrationsFromPluginSet(resolvedPluginSet);
@@ -152,19 +152,19 @@ function localDevServerUrl() {
 async function prepareLocalChatRun(io, pluginSet) {
 	defaultStateAdapterForLocalChat();
 	await configureLocalChatPlugins(pluginSet);
-	const { setBriefsConfig } = await import("../agent-hooks-CqnZfuCt.js").then((n) => n.m);
+	const { setBriefsConfig } = await import("../credentialed-C6pKlB1p.js").then((n) => n._);
 	setBriefsConfig({ enabled: true });
-	const { runLocalAgentTurn } = await import("../runner-CJd9Wec-.js");
-	const { startLocalOAuthCallbackServer } = await import("../oauth-callback-server-bTspTMCC.js");
+	const { runLocalAgentTurn } = await import("../runner-BnTNS7x_.js");
+	const { startLocalOAuthCallbackServer } = await import("../oauth-callback-server-BtMf3TPZ.js");
 	const { createLocalOAuthState } = await import("../oauth-relay-CTygMkNx.js").then((n) => n.t);
-	const { createLocalSandboxEgressSignalTransport } = await import("../sandbox-egress-signals-DUmVkOx4.js");
-	const { bindSpawnAgent } = await import("../spawn-D8WU99UV.js").then((n) => n.n);
-	const { bindMessageAgent } = await import("../message-BzseAFH1.js").then((n) => n.n);
-	const { createAgentInvocationWorker, routeAgentInvocationWork } = await import("../work-DLJMV02b.js").then((n) => n.a);
-	const { startAgentInvocationsForChildInput } = await import("../result-DczfmNBa.js").then((n) => n.r);
-	const { skipInputBeforeConversationStop } = await import("../session-stop-CtyJsnEj.js").then((n) => n.r);
+	const { createLocalSandboxEgressSignalTransport } = await import("../sandbox-egress-signals-C_IIdLFk.js");
+	const { bindSpawnAgent } = await import("../spawn-mbTcrLb3.js").then((n) => n.n);
+	const { bindMessageAgent } = await import("../message-C9ymnpBS.js").then((n) => n.n);
+	const { createAgentInvocationWorker, routeAgentInvocationWork } = await import("../work-DMbqK0kT.js").then((n) => n.a);
+	const { startAgentInvocationsForChildInput } = await import("../result-COnC42GR.js").then((n) => n.r);
+	const { skipInputBeforeConversationStop } = await import("../session-stop-CpCUy1ZJ.js").then((n) => n.r);
 	const { createLocalConversationWork } = await import("../conversation-work-BaT_T6EB.js");
-	const { processConversationWork } = await import("../worker-vfG2ESg1.js").then((n) => n.n);
+	const { processConversationWork } = await import("../worker-B-rDJ3XN.js").then((n) => n.n);
 	let agentRunner;
 	const localConversationWork = createLocalConversationWork(async (message) => {
 		if (!agentRunner) throw new Error("Local agent runner is not ready");

package/dist/cli/check.js

@@ -1,6 +1,6 @@
-import { E as JUNIOR_CONVERSATION_WORK_CALLBACK_ROUTE, N as LEGACY_JUNIOR_CONVERSATION_WORK_FUNCTION, O as JUNIOR_HEARTBEAT_ROUTE } from "../logging-Dk_FpF36.js";
-import { v as parseInlinePluginManifest, y as parsePluginManifest } from "../registry-BFzQFV_y.js";
-import { i as parseSkillFile } from "../skills-Dbzx9-rS.js";
+import { E as JUNIOR_CONVERSATION_WORK_CALLBACK_ROUTE, N as LEGACY_JUNIOR_CONVERSATION_WORK_FUNCTION, O as JUNIOR_HEARTBEAT_ROUTE } from "../logging-D2QBriUo.js";
+import { v as parseInlinePluginManifest, y as parsePluginManifest } from "../registry-COTeZ2cV.js";
+import { i as parseSkillFile } from "../skills-Bb2KaJ3m.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 import { pathToFileURL } from "node:url";

package/dist/cli/init.js

@@ -24,12 +24,6 @@ const app = await createApp({
 export default app;
 `);
 }
-function writeInstrumentFile(targetDir) {
-	fs.writeFileSync(path.join(targetDir, "instrument.mjs"), `import { initSentry } from "@sentry/junior/instrumentation";
-
-initSentry();
-`);
-}
 function writePluginsFile(targetDir) {
 	fs.writeFileSync(path.join(targetDir, "plugins.ts"), `import { defineJuniorPlugins } from "@sentry/junior";
 import { memoryPlugin } from "@sentry/junior-memory";
@@ -41,9 +35,8 @@ export const plugins = defineJuniorPlugins([
 `);
 }
 function writeNitroConfig(targetDir) {
-	fs.writeFileSync(path.join(targetDir, "nitro.config.ts"), `import { withSentryConfig } from "@sentry/nitro";
-import { defineConfig } from "nitro";
-import { juniorNitro } from "@sentry/junior/nitro";
+	fs.writeFileSync(path.join(targetDir, "nitro.config.ts"), `import { defineConfig } from "nitro";
+import { juniorNitro, withSentryConfig } from "@sentry/junior/nitro";
 
 const config = defineConfig({
   preset: "vercel",
@@ -74,8 +67,6 @@ function writePnpmWorkspace(targetDir) {
 	fs.writeFileSync(path.join(targetDir, "pnpm-workspace.yaml"), `minimumReleaseAge: 1440
 minimumReleaseAgeExclude:
   - "@sentry/*"
-allowBuilds:
-  "@sentry/cli": true
 `);
 }
 function writeVercelJson(targetDir) {
@@ -123,24 +114,20 @@ async function runInit(dir, log = console.log) {
 		private: true,
 		type: "module",
 		scripts: {
-			dev: "cross-env NODE_OPTIONS=--import=./instrument.mjs nitro dev",
+			dev: "nitro dev",
 			check: "junior check",
 			build: "junior snapshot create && nitro build",
-			preview: "cross-env NODE_OPTIONS=--import=./instrument.mjs nitro preview",
+			preview: "nitro preview",
 			typecheck: "tsc --noEmit"
 		},
 		dependencies: {
-			"@opentelemetry/api": "1.9.1",
-			"@opentelemetry/core": "2.9.0",
 			"@sentry/junior": "latest",
 			"@sentry/junior-memory": "latest",
 			"@sentry/junior-maintenance": "latest",
-			"@sentry/nitro": "10.65.0",
 			hono: "^4.13.11"
 		},
 		devDependencies: {
 			"@types/node": "^25.9.1",
-			"cross-env": "^10.1.0",
 			jiti: "^2.7.0",
 			nitro: "3.0.260522-beta",
 			typescript: "^7.0.2"
@@ -194,7 +181,6 @@ SENTRY_PROJECT=
 SENTRY_AUTH_TOKEN=
 `);
 	writeServerEntry(target);
-	writeInstrumentFile(target);
 	writePluginsFile(target);
 	writeNitroConfig(target);
 	writeTsConfig(target);

package/dist/cli/main.js

@@ -4,7 +4,7 @@ import { pathToFileURL } from "node:url";
 // src/cli/main.ts
 const SENTRY_FLUSH_TIMEOUT_MS = 2e3;
 async function flushSentry() {
-	await (await import("../sentry-BBUlHih9.js").then((n) => n.u)).flush(SENTRY_FLUSH_TIMEOUT_MS);
+	await (await import("../sentry-MDkYAVPV.js").then((n) => n.u)).flush(SENTRY_FLUSH_TIMEOUT_MS);
 }
 async function initSentry() {
 	(await import("../instrumentation.js")).initSentry();
@@ -25,13 +25,13 @@ async function runChat(argv, pluginSet) {
 	return await (await import("./chat.js")).runChat(argv, void 0, { pluginSet });
 }
 async function runAdmin(argv) {
-	return await (await import("../admin-C7vUk7s9.js")).runAdmin(argv);
+	return await (await import("../admin-Cf0rDmWV.js")).runAdmin(argv);
 }
 async function runServiceAccount(argv) {
-	return await (await import("../service-account-BI2kQDrb.js")).runServiceAccount(argv);
+	return await (await import("../service-account-CwvToidT.js")).runServiceAccount(argv);
 }
 async function runBriefs(argv) {
-	return await (await import("../briefs-h55v5lX9.js")).runBriefs(argv);
+	return await (await import("../briefs-DRjx8kQ9.js")).runBriefs(argv);
 }
 function topLevelCommand(argv) {
 	return (argv[0] === "--" ? argv.slice(1) : argv)[0];

package/dist/cli/plugins.js

@@ -1,7 +1,7 @@
-import { d as getDb } from "../viewer-DmNRM88V.js";
-import { n as pluginCatalogRuntime } from "../catalog-runtime-Suf-aLlh.js";
-import { Et as createPluginLogger, d as setPlugins, f as validatePlugins } from "../agent-hooks-CqnZfuCt.js";
-import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "../validation-BeTriWC2.js";
+import { f as getDb } from "../viewer-B2wXNspU.js";
+import { n as pluginCatalogRuntime } from "../catalog-runtime-D3qbJlYz.js";
+import { An as createPluginLogger, h as validatePlugins, m as setPlugins } from "../credentialed-C6pKlB1p.js";
+import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "../validation-C0X3CX51.js";
 import { a as pluginRuntimeRegistrationsFromPluginSet, i as pluginCliRegistrationsFromPluginSet, r as pluginCatalogConfigFromPluginSet } from "../plugins-DOm9Y6qI.js";
 import { t as loadAppPluginSet } from "../plugin-module-Cf5gVPWP.js";
 import { stderr, stdout } from "node:process";

package/dist/cli/snapshot-create.js

@@ -1,7 +1,7 @@
-import { n as pluginCatalogRuntime } from "../catalog-runtime-Suf-aLlh.js";
-import { t as disconnectStateAdapter } from "../adapter-BIacI0Bt.js";
-import { t as create } from "../profile-Dq5I7TV1.js";
-import { r as resolve } from "../resolve-CnRHib0U.js";
+import { n as pluginCatalogRuntime } from "../catalog-runtime-D3qbJlYz.js";
+import { M as create } from "../credentialed-C6pKlB1p.js";
+import { t as disconnectStateAdapter } from "../adapter-cUkPH3Om.js";
+import { n as resolve } from "../resolve-g9PKz9pH.js";
 // src/cli/snapshot-create.ts
 const DEFAULT_RUNTIME = "node22";
 const DEFAULT_TIMEOUT_MS = 6e5;

package/dist/cli/upgrade.js

@@ -1,6 +1,6 @@
-import { i as getChatConfig } from "../config-Dnv8KmNs.js";
-import { t as createJuniorSqlExecutor } from "../executor-J9k2sp9m.js";
-import { t as createPluginCatalogRuntime } from "../registry-BFzQFV_y.js";
+import { i as getChatConfig } from "../config-BayQ9hHH.js";
+import { t as createJuniorSqlExecutor } from "../executor-CAr7xQr2.js";
+import { t as createPluginCatalogRuntime } from "../registry-COTeZ2cV.js";
 import { n as pluginCatalogConfigFromEnv, r as pluginCatalogConfigFromPluginSet, t as defineJuniorPlugins } from "../plugins-DOm9Y6qI.js";
 import { t as loadAppPluginSet } from "../plugin-module-Cf5gVPWP.js";
 import { basename, dirname, join, resolve } from "node:path";

package/dist/{client-DZBCBj1M.js → client-DX34VNtH.js}

@@ -1,5 +1,5 @@
-import { T as withSpan, _ as serializeGenAiAttribute, f as logException, h as normalizeGenAiFinishReason, i as extractGenAiUsageAttributes, m as logWarn } from "./logging-Dk_FpF36.js";
-import { a as toCanonicalInputMessage, n as getCurrentConversationPrivacy, o as toCanonicalOutputMessage, s as toGenAiMessagesTraceAttributes } from "./conversation-privacy-FY8yc2q3.js";
+import { T as withSpan, _ as serializeGenAiAttribute, f as logException, h as normalizeGenAiFinishReason, i as extractGenAiUsageAttributes, m as logWarn } from "./logging-D2QBriUo.js";
+import { a as toCanonicalInputMessage, n as getCurrentConversationPrivacy, o as toCanonicalOutputMessage, s as toGenAiMessagesTraceAttributes } from "./conversation-privacy-frjQCJa9.js";
 import { calculateCost, completeSimple, getEnvApiKey, getModels, registerApiProvider } from "@earendil-works/pi-ai/compat";
 import { stream as streamAnthropic, streamSimple as streamSimpleAnthropic } from "@earendil-works/pi-ai/api/anthropic-messages";
 import { createGatewayProvider } from "@ai-sdk/gateway";
@@ -202,7 +202,7 @@ function getProviderErrorUserMessage(error) {
 		case "timeout":
 		case "network":
 		case "server": return "The model provider had a temporary connection problem. Please try again.";
-		case "auth": return "The model provider rejected Junior's credentials. This needs an administrator or configuration fix.";
+		case "auth": return "The model provider rejected the configured credentials. This needs an administrator or configuration fix.";
 		case "permission": return "The model provider denied access to this model or request. Ask an administrator to check model access, organization policy, and region availability.";
 		case "quota": return "The model provider's usage quota has been exhausted. This needs an administrator or billing configuration fix.";
 		case "content_policy": return "The model provider blocked this request under its content policy. Please revise the request and try again.";
@@ -577,11 +577,6 @@ async function completeObject(params) {
 				...params.system !== void 0 ? { system: params.system } : void 0,
 				...params.temperature !== void 0 ? { temperature: params.temperature } : void 0,
 				...params.maxTokens !== void 0 ? { maxOutputTokens: params.maxTokens } : void 0,
-				...params.recordTelemetryPayloads === false ? { experimental_telemetry: {
-					isEnabled: true,
-					recordInputs: false,
-					recordOutputs: false
-				} } : void 0,
 				...params.signal !== void 0 ? { abortSignal: params.signal } : void 0
 			});
 			setSpanAttributes({

package/dist/{config-Dnv8KmNs.js → config-BayQ9hHH.js}

@@ -1,7 +1,103 @@
 import { t as __exportAll } from "./rolldown-runtime-nwUcYXjP.js";
-import { C as toOptionalTrimmed, s as resolveGatewayModel } from "./client-DZBCBj1M.js";
-import { m as logWarn } from "./logging-Dk_FpF36.js";
+import { C as toOptionalTrimmed, s as resolveGatewayModel } from "./client-DX34VNtH.js";
+import { m as logWarn } from "./logging-D2QBriUo.js";
 import { l as TURN_REASONING_LEVELS, s as modelProfileSchema, t as DEFAULT_MODEL_PROFILES, u as parseTurnReasoningLevel } from "./model-profile-Bg8EoCKD.js";
+import { AwsClient } from "aws4fetch";
+// src/chat/attachments/s3.ts
+function readRequiredSetting(env, name) {
+	const value = toOptionalTrimmed(env[name]);
+	if (value === void 0) throw new Error(`${name} is required when JUNIOR_ATTACHMENT_STORAGE_PROVIDER is s3`);
+	return value;
+}
+/** Read S3 settings from `JUNIOR_S3_*` environment variables. */
+function readS3StorageConfig(env) {
+	return {
+		accessKeyId: readRequiredSetting(env, "JUNIOR_S3_ACCESS_KEY_ID"),
+		bucket: readRequiredSetting(env, "JUNIOR_S3_BUCKET"),
+		endpoint: readRequiredSetting(env, "JUNIOR_S3_ENDPOINT"),
+		region: toOptionalTrimmed(env.JUNIOR_S3_REGION) ?? "us-east-1",
+		secretAccessKey: readRequiredSetting(env, "JUNIOR_S3_SECRET_ACCESS_KEY")
+	};
+}
+/**
+* Path-style object URL. Local S3 servers and AWS S3 both accept it.
+*
+* URL parsing removes `.` and `..` segments, also in `%2e` form. A key with
+* such a segment would address a different object, so reject it.
+*/
+function objectUrl(config, key) {
+	const endpoint = config.endpoint.replace(/\/+$/, "");
+	const segments = key.split("/");
+	if (segments.some((segment) => segment === "." || segment === "..")) throw new Error("S3 object keys cannot contain . or .. path segments");
+	const path = segments.map(encodeURIComponent).join("/");
+	return `${endpoint}/${encodeURIComponent(config.bucket)}/${path}`;
+}
+/**
+* Read a small S3 response body to the end so the connection is released.
+*
+* Error and empty bodies are small. `body.cancel()` can hang under the test
+* HTTP interceptor, so read the body instead.
+*/
+async function drain(response) {
+	await response.arrayBuffer();
+}
+/** Throw on a failed S3 response, and release the response body. */
+async function expectOk(response, operation) {
+	await drain(response);
+	if (!response.ok) throw new Error(`S3 ${operation} failed with status ${response.status}`);
+}
+/** Store private conversation attachments in an S3-compatible bucket. */
+function createS3AttachmentStorage(config) {
+	const client = new AwsClient({
+		accessKeyId: config.accessKeyId,
+		region: config.region,
+		secretAccessKey: config.secretAccessKey,
+		service: "s3"
+	});
+	return {
+		provider: "s3",
+		async put(input) {
+			await expectOk(await client.fetch(objectUrl(config, input.key), {
+				body: new Uint8Array(input.body),
+				headers: { "content-type": input.contentType },
+				method: "PUT"
+			}), "put");
+		},
+		async get(key) {
+			const response = await client.fetch(objectUrl(config, key));
+			if (response.status === 404) {
+				await drain(response);
+				return null;
+			}
+			if (!response.ok) await expectOk(response, "get");
+			return response.body;
+		},
+		async delete(keys) {
+			await Promise.all(keys.map(async (key) => {
+				const response = await client.fetch(objectUrl(config, key), { method: "DELETE" });
+				if (response.status === 404) {
+					await drain(response);
+					return;
+				}
+				await expectOk(response, "delete");
+			}));
+		}
+	};
+}
+// src/chat/attachments/config.ts
+/** Read attachment storage settings from environment variables. */
+function readAttachmentStorageConfig(env) {
+	const provider = toOptionalTrimmed(env.JUNIOR_ATTACHMENT_STORAGE_PROVIDER) ?? "vercel-blob";
+	switch (provider) {
+		case "vercel-blob":
+		case "memory": return { provider };
+		case "s3": return {
+			provider,
+			s3: readS3StorageConfig(env)
+		};
+		default: throw new Error("JUNIOR_ATTACHMENT_STORAGE_PROVIDER must be vercel-blob, s3, or memory");
+	}
+}
 // src/chat/slack/emoji.ts
 const SLACK_EMOJI_NAME_RE = /^(?:[a-z0-9_+-]+)(?:::(?:skin-tone-[2-6]))?$/;
 function normalizeSlackEmojiName(value) {
@@ -314,6 +410,7 @@ function readChatConfig(env = process.env, functionMaxDurationSeconds = DEFAULT_
 	warnDeprecatedProfileEnv(env);
 	const resolvedFunctionMaxDurationSeconds = resolveFunctionMaxDurationSeconds(functionMaxDurationSeconds);
 	return {
+		attachmentStorage: readAttachmentStorageConfig(env),
 		bot: readBotConfig(env, resolvedFunctionMaxDurationSeconds),
 		functionMaxDurationSeconds: resolvedFunctionMaxDurationSeconds,
 		conversationWorkEnabled: parseConversationWorkEnabled(env.JUNIOR_CONVERSATION_WORK_ENABLED),
@@ -447,4 +544,4 @@ function setSlackReactionConfig(overrides) {
 	if (overrides.processingReactionEmoji !== void 0) chatConfig.slack.processingReactionEmoji = parseReactionEmoji("processingReactionEmoji", overrides.processingReactionEmoji, chatConfig.slack.processingReactionEmoji);
 	if (overrides.completedReactionEmoji !== void 0) chatConfig.slack.completedReactionEmoji = parseReactionEmoji("completedReactionEmoji", overrides.completedReactionEmoji, chatConfig.slack.completedReactionEmoji);
 }
-export { snapshotRuntimeConfig as _, getRuntimeMetadata as a, getSlackClientSecret as c, restoreRuntimeConfig as d, setBotModelConfig as f, setSlackReactionConfig as g, setRuntimeLimits as h, getChatConfig as i, getSlackSigningSecret as l, setProfiles as m, botConfig as n, getSlackBotToken as o, setCrossActorMidRunMode as p, config_exports as r, getSlackClientId as s, DEFAULT_SQL_STATEMENT_TIMEOUT_MS as t, resetRuntimeConfig as u, normalizeSlackEmojiName as v };
+export { snapshotRuntimeConfig as _, getRuntimeMetadata as a, getSlackClientSecret as c, restoreRuntimeConfig as d, setBotModelConfig as f, setSlackReactionConfig as g, setRuntimeLimits as h, getChatConfig as i, getSlackSigningSecret as l, setProfiles as m, botConfig as n, getSlackBotToken as o, setCrossActorMidRunMode as p, config_exports as r, getSlackClientId as s, DEFAULT_SQL_STATEMENT_TIMEOUT_MS as t, resetRuntimeConfig as u, normalizeSlackEmojiName as v, createS3AttachmentStorage as y };

package/dist/{connections-Br0_xv27.js → connections-mpN5Lsnj.js}

@@ -1,13 +1,14 @@
-import { Ln as startOAuthFlow, Mt as failTurnRecord, Nt as getTurnRecord, Ot as loadTurnCheckpoint } from "./tasks-LOItiYgL.js";
-import { n as botConfig } from "./config-Dnv8KmNs.js";
-import { A as deleteProviderIdentityForUser, c as getConversationEventStore, f as getSqlExecutor, k as deleteProviderIdentityForSlackUser } from "./viewer-DmNRM88V.js";
-import { u as hasRequiredOAuthScope } from "./registry-BFzQFV_y.js";
-import { n as pluginCatalogRuntime } from "./catalog-runtime-Suf-aLlh.js";
-import { c as deleteMcpServerSessionId, l as deleteMcpStoredOAuthCredentials, s as deleteMcpAuthSessionsForUserProvider } from "./agent-runner-BUBas7Yy.js";
-import { r as getStateAdapter } from "./adapter-BIacI0Bt.js";
-import { a as getVercelConversationWorkQueue } from "./job-queue-B4yTgklN.js";
-import { m as ensureConversationWake, w as requestConversationWork } from "./store-UlOrW6JC.js";
-import { n as resolveTurnSessionRouting } from "./turn-session-routing-5Nyv4fso.js";
+import { Mt as failTurnRecord, Nt as getTurnRecord, Ot as loadTurnCheckpoint } from "./tasks-DGbrur6x.js";
+import { n as botConfig } from "./config-BayQ9hHH.js";
+import { A as deleteProviderIdentityForSlackUser, j as deleteProviderIdentityForUser, l as getConversationEventStore, p as getSqlExecutor } from "./viewer-B2wXNspU.js";
+import { u as hasRequiredOAuthScope } from "./registry-COTeZ2cV.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-D3qbJlYz.js";
+import { c as deleteMcpServerSessionId, l as deleteMcpStoredOAuthCredentials, s as deleteMcpAuthSessionsForUserProvider } from "./agent-runner-C6MwHJEs.js";
+import { ct as startOAuthFlow } from "./credentialed-C6pKlB1p.js";
+import { r as getStateAdapter } from "./adapter-cUkPH3Om.js";
+import { a as getVercelConversationWorkQueue } from "./job-queue-Cjo6Yg_b.js";
+import { m as ensureConversationWake, w as requestConversationWork } from "./store-DdT74Lvq.js";
+import { n as resolveTurnSessionRouting } from "./turn-session-routing-BKx6rfVd.js";
 import { z } from "zod";
 import { randomBytes, randomUUID } from "node:crypto";
 // src/chat/task-execution/authorized-turn.ts

package/dist/{conversation-privacy-FY8yc2q3.js → conversation-privacy-frjQCJa9.js}

@@ -1,4 +1,4 @@
-import { m as logWarn } from "./logging-Dk_FpF36.js";
+import { m as logWarn } from "./logging-D2QBriUo.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 // src/chat/conversation-privacy.ts
 const SAFE_METADATA_KEY_LIMIT = 20;

package/dist/{credential-sync-BvkiyWF5.js → credential-sync-CZmyDNdR.js}

@@ -1,19 +1,19 @@
-import { $n as resolvePluginOAuthAccount, Fn as parseOAuthStatePayload, H as recordAuthorizationCompleted, In as resolveBaseUrl, Nt as getTurnRecord, Pn as formatProviderLabel, Tt as getConversationPendingAuth, V as recordAuthenticationLinked, bn as createUserTokenStore, qn as postSlackMessage } from "./tasks-LOItiYgL.js";
-import { p as escapeXml } from "./client-DZBCBj1M.js";
-import { L as isNativeIdentityProvider, f as logException, g as runBestEffort, m as logWarn } from "./logging-Dk_FpF36.js";
-import { a as getRuntimeMetadata, n as botConfig } from "./config-Dnv8KmNs.js";
+import { H as recordAuthorizationCompleted, Nt as getTurnRecord, Tt as getConversationPendingAuth, V as recordAuthenticationLinked } from "./tasks-DGbrur6x.js";
+import { p as escapeXml } from "./client-DX34VNtH.js";
+import { a as getRuntimeMetadata, n as botConfig } from "./config-BayQ9hHH.js";
+import { L as isNativeIdentityProvider, f as logException, g as runBestEffort, m as logWarn } from "./logging-D2QBriUo.js";
 import { f as parseSlackUserId } from "./actor-tlxzqaRe.js";
-import { F as upsertIdentity, I as upsertLinkedIdentity, b as identityFromActor, f as getSqlExecutor, j as findUserByVerifiedEmails } from "./viewer-DmNRM88V.js";
+import { I as upsertIdentity, L as upsertLinkedIdentity, M as findUserByVerifiedEmails, p as getSqlExecutor, x as identityFromActor } from "./viewer-B2wXNspU.js";
 import { i as homeDir } from "./package-discovery-DJBompdd.js";
-import { n as buildOAuthTokenRequest, r as parseOAuthTokenResponse, u as hasRequiredOAuthScope } from "./registry-BFzQFV_y.js";
-import { n as pluginCatalogRuntime } from "./catalog-runtime-Suf-aLlh.js";
-import { t as discoverSkills } from "./skills-Dbzx9-rS.js";
-import { a as finalizeMcpAuthorization, d as getMcpStoredOAuthCredentials, f as putMcpStoredOAuthCredentials, o as deleteMcpAuthSession, u as getMcpAuthSession, v as lookupSlackUserProfile } from "./agent-runner-BUBas7Yy.js";
-import { ct as getSlackClient } from "./agent-hooks-CqnZfuCt.js";
-import { a as acquireActiveLock, r as getStateAdapter } from "./adapter-BIacI0Bt.js";
-import { _ as getMcpProviderErrorAttributes } from "./service-account-x2QZXm4X.js";
-import { r as getPersistedThreadState, s as coerceThreadConversationState } from "./thread-state-IDHdZA7R.js";
-import { c as deleteWebAuthorization, i as readConnectedOAuthTokens, m as wakePausedTurn, p as wakeAuthorizedTurn, u as htmlCallbackResponse } from "./connections-Br0_xv27.js";
+import { n as buildOAuthTokenRequest, r as parseOAuthTokenResponse, u as hasRequiredOAuthScope } from "./registry-COTeZ2cV.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-D3qbJlYz.js";
+import { t as discoverSkills } from "./skills-Bb2KaJ3m.js";
+import { a as finalizeMcpAuthorization, d as getMcpStoredOAuthCredentials, f as putMcpStoredOAuthCredentials, o as deleteMcpAuthSession, u as getMcpAuthSession, v as lookupSlackUserProfile } from "./agent-runner-C6MwHJEs.js";
+import { at as formatProviderLabel, en as getSlackClient, i as resolvePluginOAuthAccount, n as createUserTokenStore, ot as parseOAuthStatePayload, st as resolveBaseUrl, vt as postSlackMessage } from "./credentialed-C6pKlB1p.js";
+import { a as acquireActiveLock, r as getStateAdapter } from "./adapter-cUkPH3Om.js";
+import { _ as getMcpProviderErrorAttributes } from "./service-account-YdYftwV2.js";
+import { r as getPersistedThreadState, s as coerceThreadConversationState } from "./thread-state-D45lz-oC.js";
+import { c as deleteWebAuthorization, i as readConnectedOAuthTokens, m as wakePausedTurn, p as wakeAuthorizedTurn, u as htmlCallbackResponse } from "./connections-mpN5Lsnj.js";
 import { n as relayLocalOAuthCallback } from "./oauth-relay-CTygMkNx.js";
 import path from "node:path";
 import { z } from "zod";
@@ -319,7 +319,7 @@ async function buildHomeView(userId, userTokenStore) {
 				type: "header",
 				text: {
 					type: "plain_text",
-					text: "Junior"
+					text: botConfig.userName
 				}
 			},
 			{
@@ -481,14 +481,14 @@ async function GET(request, provider, waitUntil, options) {
 	const state = url.searchParams.get("state");
 	if (errorParam) {
 		if (state) await getStateAdapter().delete(`oauth-state:${state}`);
-		if (errorParam === "access_denied") return htmlErrorResponse("Authorization declined", `You declined the ${providerLabel} authorization request. Return to Junior and connect your ${providerLabel} account again if you change your mind.`, 400);
-		return htmlErrorResponse("Authorization failed", `${providerLabel} returned an error: ${errorParam}. Return to Junior and try again.`, 400);
+		if (errorParam === "access_denied") return htmlErrorResponse("Authorization declined", `You declined the ${providerLabel} authorization request. Return to the conversation and connect your ${providerLabel} account again if you change your mind.`, 400);
+		return htmlErrorResponse("Authorization failed", `${providerLabel} returned an error: ${errorParam}. Return to the conversation and try again.`, 400);
 	}
 	if (!code || !state) return htmlErrorResponse("Invalid request", "This authorization link is missing required parameters.", 400);
 	const stateAdapter = getStateAdapter();
 	const stateKey = `oauth-state:${state}`;
 	const stored = parseOAuthStatePayload(await stateAdapter.get(stateKey));
-	if (!stored) return htmlErrorResponse("Link expired", `This authorization link has expired (links are valid for 10 minutes). Return to Junior and connect your ${providerLabel} account again to get a new link.`, 400);
+	if (!stored) return htmlErrorResponse("Link expired", `This authorization link has expired (links are valid for 10 minutes). Return to the conversation and connect your ${providerLabel} account again to get a new link.`, 400);
 	if (stored.provider !== provider) return htmlErrorResponse("Provider mismatch", "This authorization link does not match the expected provider.", 400);
 	await stateAdapter.delete(stateKey);
 	const clientId = process.env[providerConfig.clientIdEnv]?.trim();
@@ -533,7 +533,7 @@ async function GET(request, provider, waitUntil, options) {
 		logWarn("oauth.token_exchange.failed", oauthTokenErrorAttributes(provider, providerConfig.tokenEndpoint, tokenResponse.status));
 		return htmlErrorResponse("Connection failed", "The provider returned an incomplete token response. Please try again.", 500);
 	}
-	if (!hasRequiredOAuthScope(parsedTokenResponse.scope, requestedScope)) return htmlErrorResponse("Connection failed", `The ${providerLabel} authorization did not grant the access Junior requires. Return to Junior and connect your ${providerLabel} account again.`, 400);
+	if (!hasRequiredOAuthScope(parsedTokenResponse.scope, requestedScope)) return htmlErrorResponse("Connection failed", `The ${providerLabel} authorization did not grant the required access. Return to the conversation and connect your ${providerLabel} account again.`, 400);
 	const userTokenStore = createUserTokenStore();
 	let account;
 	let verifiedEmails = [];
@@ -549,7 +549,7 @@ async function GET(request, provider, waitUntil, options) {
 			verifiedEmails = emails ?? [];
 		}
 	} catch {
-		return htmlErrorResponse("Connection failed", `Junior could not verify the connected ${providerLabel} account. Please try again.`, 500);
+		return htmlErrorResponse("Connection failed", `The connected ${providerLabel} account could not be verified. Please try again.`, 500);
 	}
 	await userTokenStore.set(stored.userId, provider, {
 		...parsedTokenResponse,