@sentry/junior 0.53.0 → 0.55.0

package/dist/{chunk-KCOKQLBF.js → chunk-XI3CFWTA.js}

@@ -7,14 +7,14 @@ import {
   serializeGenAiAttribute,
   setSpanAttributes,
   withSpan
-} from "./chunk-Q3FDONU7.js";
+} from "./chunk-TTUY467K.js";
 
 // src/chat/state/adapter.ts
 import { createMemoryState } from "@chat-adapter/state-memory";
 import { createRedisState } from "@chat-adapter/state-redis";
 
 // src/chat/config.ts
-import { getModel } from "@mariozechner/pi-ai";
+import { getModel } from "@earendil-works/pi-ai";
 
 // src/chat/optional-string.ts
 function toOptionalTrimmed(value) {
@@ -31,11 +31,11 @@ import {
   getEnvApiKey,
   getModels,
   registerApiProvider
-} from "@mariozechner/pi-ai";
+} from "@earendil-works/pi-ai";
 import {
   streamAnthropic,
   streamSimpleAnthropic
-} from "@mariozechner/pi-ai/anthropic";
+} from "@earendil-works/pi-ai/anthropic";
 registerApiProvider({
   api: "anthropic-messages",
   stream: streamAnthropic,
@@ -385,6 +385,7 @@ function readChatConfig(env = process.env) {
     },
     state: {
       adapter: env.JUNIOR_STATE_ADAPTER?.trim().toLowerCase() === "memory" ? "memory" : "redis",
+      keyPrefix: toOptionalTrimmed(env.JUNIOR_STATE_KEY_PREFIX),
       redisUrl: toOptionalTrimmed(env.REDIS_URL)
     }
   };
@@ -413,25 +414,166 @@ function getRuntimeMetadata() {
 }
 
 // src/chat/state/adapter.ts
-var MIN_LOCK_TTL_MS = 1e3 * 60 * 5;
+var ACTIVE_LOCK_TTL_MS = 9e4;
+var ACTIVE_LOCK_HEARTBEAT_MS = 3e4;
 var stateAdapter;
 var redisStateAdapter;
-function createQueuedStateAdapter(base) {
+function createPrefixedStateAdapter(base, prefix) {
+  const prefixed = (value) => `${prefix}:${value}`;
+  const unprefixed = (value) => value.startsWith(`${prefix}:`) ? value.slice(prefix.length + 1) : value;
+  const prefixLock = (lock) => ({
+    ...lock,
+    threadId: prefixed(lock.threadId)
+  });
+  const unprefixLock = (lock) => ({
+    ...lock,
+    threadId: unprefixed(lock.threadId)
+  });
+  return {
+    appendToList: (key, value, options) => base.appendToList(prefixed(key), value, options),
+    connect: () => base.connect(),
+    disconnect: () => base.disconnect(),
+    subscribe: (threadId) => base.subscribe(prefixed(threadId)),
+    unsubscribe: (threadId) => base.unsubscribe(prefixed(threadId)),
+    isSubscribed: (threadId) => base.isSubscribed(prefixed(threadId)),
+    acquireLock: async (threadId, ttlMs) => {
+      const lock = await base.acquireLock(prefixed(threadId), ttlMs);
+      return lock ? unprefixLock(lock) : null;
+    },
+    releaseLock: (lock) => base.releaseLock(prefixLock(lock)),
+    extendLock: async (lock, ttlMs) => {
+      const prefixedLock = prefixLock(lock);
+      const extended = await base.extendLock(prefixedLock, ttlMs);
+      if (extended) {
+        lock.expiresAt = prefixedLock.expiresAt;
+      }
+      return extended;
+    },
+    forceReleaseLock: (threadId) => base.forceReleaseLock(prefixed(threadId)),
+    enqueue: (threadId, entry, maxSize) => base.enqueue(prefixed(threadId), entry, maxSize),
+    dequeue: (threadId) => base.dequeue(prefixed(threadId)),
+    queueDepth: (threadId) => base.queueDepth(prefixed(threadId)),
+    get: (key) => base.get(prefixed(key)),
+    getList: (key) => base.getList(prefixed(key)),
+    set: (key, value, ttlMs) => base.set(prefixed(key), value, ttlMs),
+    setIfNotExists: (key, value, ttlMs) => base.setIfNotExists(prefixed(key), value, ttlMs),
+    delete: (key) => base.delete(prefixed(key))
+  };
+}
+function createQueuedStateAdapter(base, options) {
+  const heartbeats = /* @__PURE__ */ new Map();
+  const effectiveLockTtlMs = (ttlMs) => Math.max(ttlMs, ACTIVE_LOCK_TTL_MS);
+  const shouldHeartbeatLock = (ttlMs) => ttlMs <= ACTIVE_LOCK_TTL_MS;
+  const heartbeatKey = (lock) => `${lock.threadId}:${lock.token}`;
+  const stopHeartbeatByKey = (key) => {
+    const heartbeat = heartbeats.get(key);
+    if (!heartbeat) {
+      return;
+    }
+    clearInterval(heartbeat.timer);
+    heartbeats.delete(key);
+  };
+  const stopHeartbeat = (lock) => {
+    stopHeartbeatByKey(heartbeatKey(lock));
+  };
+  const stopHeartbeatsForThread = (threadId) => {
+    for (const [key, heartbeat] of heartbeats) {
+      if (heartbeat.lock.threadId === threadId) {
+        stopHeartbeatByKey(key);
+      }
+    }
+  };
+  const stopAllHeartbeats = () => {
+    for (const key of heartbeats.keys()) {
+      stopHeartbeatByKey(key);
+    }
+  };
+  const runHeartbeat = async (key) => {
+    const heartbeat = heartbeats.get(key);
+    if (!heartbeat || heartbeat.inFlight) {
+      return;
+    }
+    heartbeat.inFlight = true;
+    try {
+      if (Date.now() - heartbeat.startedAtMs >= options.activeLockMaxAgeMs) {
+        stopHeartbeatByKey(key);
+        return;
+      }
+      const extended = await base.extendLock(heartbeat.lock, heartbeat.ttlMs);
+      if (!extended) {
+        stopHeartbeatByKey(key);
+        return;
+      }
+      heartbeat.lock.expiresAt = Date.now() + heartbeat.ttlMs;
+    } catch {
+    } finally {
+      const current = heartbeats.get(key);
+      if (current === heartbeat) {
+        current.inFlight = false;
+      }
+    }
+  };
+  const startOrUpdateHeartbeat = (lock, ttlMs) => {
+    const key = heartbeatKey(lock);
+    const existing = heartbeats.get(key);
+    if (existing) {
+      existing.ttlMs = ttlMs;
+      return;
+    }
+    const timer = setInterval(() => {
+      void runHeartbeat(key);
+    }, ACTIVE_LOCK_HEARTBEAT_MS);
+    timer.unref?.();
+    heartbeats.set(key, {
+      inFlight: false,
+      lock,
+      startedAtMs: Date.now(),
+      timer,
+      ttlMs
+    });
+  };
   const acquireLock = async (threadId, ttlMs) => {
-    const effectiveTtlMs = Math.max(ttlMs, MIN_LOCK_TTL_MS);
-    return await base.acquireLock(threadId, effectiveTtlMs);
+    const effectiveTtlMs = effectiveLockTtlMs(ttlMs);
+    const lock = await base.acquireLock(threadId, effectiveTtlMs);
+    if (lock && shouldHeartbeatLock(ttlMs)) {
+      startOrUpdateHeartbeat(lock, effectiveTtlMs);
+    }
+    return lock;
   };
   return {
-    appendToList: (key, value, options) => base.appendToList(key, value, options),
+    appendToList: (key, value, options2) => base.appendToList(key, value, options2),
     connect: () => base.connect(),
-    disconnect: () => base.disconnect(),
+    disconnect: async () => {
+      stopAllHeartbeats();
+      await base.disconnect();
+    },
     subscribe: (threadId) => base.subscribe(threadId),
     unsubscribe: (threadId) => base.unsubscribe(threadId),
     isSubscribed: (threadId) => base.isSubscribed(threadId),
     acquireLock,
-    releaseLock: (lock) => base.releaseLock(lock),
-    extendLock: (lock, ttlMs) => base.extendLock(lock, Math.max(ttlMs, MIN_LOCK_TTL_MS)),
-    forceReleaseLock: (threadId) => base.forceReleaseLock(threadId),
+    releaseLock: async (lock) => {
+      stopHeartbeat(lock);
+      await base.releaseLock(lock);
+    },
+    extendLock: async (lock, ttlMs) => {
+      const effectiveTtlMs = effectiveLockTtlMs(ttlMs);
+      const extended = await base.extendLock(lock, effectiveTtlMs);
+      if (extended) {
+        lock.expiresAt = Date.now() + effectiveTtlMs;
+        if (shouldHeartbeatLock(ttlMs)) {
+          startOrUpdateHeartbeat(lock, effectiveTtlMs);
+        } else {
+          stopHeartbeat(lock);
+        }
+      } else {
+        stopHeartbeat(lock);
+      }
+      return extended;
+    },
+    forceReleaseLock: async (threadId) => {
+      stopHeartbeatsForThread(threadId);
+      await base.forceReleaseLock(threadId);
+    },
     enqueue: (threadId, entry, maxSize) => base.enqueue(threadId, entry, maxSize),
     dequeue: (threadId) => base.dequeue(threadId),
     queueDepth: (threadId) => base.queueDepth(threadId),
@@ -442,11 +584,18 @@ function createQueuedStateAdapter(base) {
     delete: (key) => base.delete(key)
   };
 }
+function withOptionalPrefix(base, prefix) {
+  return prefix ? createPrefixedStateAdapter(base, prefix) : base;
+}
 function createStateAdapter() {
   const config = getChatConfig();
+  const activeLockMaxAgeMs = config.bot.turnTimeoutMs + ACTIVE_LOCK_TTL_MS;
   if (config.state.adapter === "memory") {
     redisStateAdapter = void 0;
-    return createQueuedStateAdapter(createMemoryState());
+    return createQueuedStateAdapter(
+      withOptionalPrefix(createMemoryState(), config.state.keyPrefix),
+      { activeLockMaxAgeMs }
+    );
   }
   if (!config.state.redisUrl) {
     throw new Error("REDIS_URL is required for durable Slack thread state");
@@ -455,7 +604,10 @@ function createStateAdapter() {
     url: config.state.redisUrl
   });
   redisStateAdapter = redisState;
-  return createQueuedStateAdapter(redisState);
+  return createQueuedStateAdapter(
+    withOptionalPrefix(redisState, config.state.keyPrefix),
+    { activeLockMaxAgeMs }
+  );
 }
 function getStateAdapter() {
   if (!stateAdapter) {
@@ -1173,6 +1325,7 @@ export {
   getSlackClientId,
   getSlackClientSecret,
   getRuntimeMetadata,
+  ACTIVE_LOCK_TTL_MS,
   getStateAdapter,
   disconnectStateAdapter,
   SANDBOX_WORKSPACE_ROOT,

package/dist/cli/check.js

@@ -1,11 +1,11 @@
 import {
   parseSkillFile
-} from "../chunk-ZNFNY53B.js";
+} from "../chunk-D3G3YOU4.js";
 import {
   parsePluginManifest
-} from "../chunk-Q3FDONU7.js";
+} from "../chunk-TTUY467K.js";
 import "../chunk-Z3YD6NHK.js";
-import "../chunk-XPXD3FCE.js";
+import "../chunk-5LUISFEY.js";
 import "../chunk-2KG3PWR4.js";
 
 // src/cli/check.ts

package/dist/cli/init.js

@@ -1,3 +1,6 @@
+import {
+  juniorVercelConfig
+} from "../chunk-SCQPBJAU.js";
 import "../chunk-2KG3PWR4.js";
 
 // src/cli/init.ts
@@ -51,7 +54,7 @@ export default defineConfig({
 function writeVercelJson(targetDir) {
   fs.writeFileSync(
     path.join(targetDir, "vercel.json"),
-    `${JSON.stringify({ framework: "nitro", buildCommand: "pnpm build" }, null, 2)}
+    `${JSON.stringify(juniorVercelConfig(), null, 2)}
 `
   );
 }
@@ -171,12 +174,14 @@ Operational context and domain knowledge for ${name}.
     path.join(target, ".env.example"),
     `SLACK_BOT_TOKEN=
 SLACK_SIGNING_SECRET=
+JUNIOR_SECRET=
 JUNIOR_BOT_NAME=
 AI_MODEL=
 AI_FAST_MODEL=
 AI_VISION_MODEL=
 AI_WEB_SEARCH_MODEL=
 REDIS_URL=
+CRON_SECRET=
 SENTRY_DSN=
 SENTRY_ORG_SLUG=
 `

package/dist/cli/snapshot-warmup.js

@@ -1,14 +1,14 @@
 import {
   disconnectStateAdapter,
   resolveRuntimeDependencySnapshot
-} from "../chunk-KCOKQLBF.js";
+} from "../chunk-XI3CFWTA.js";
 import {
   getPluginProviders,
   getPluginRuntimeDependencies,
   getPluginRuntimePostinstall
-} from "../chunk-Q3FDONU7.js";
+} from "../chunk-TTUY467K.js";
 import "../chunk-Z3YD6NHK.js";
-import "../chunk-XPXD3FCE.js";
+import "../chunk-5LUISFEY.js";
 import "../chunk-2KG3PWR4.js";
 
 // src/cli/snapshot-warmup.ts

package/dist/handlers/agent-dispatch.d.ts

@@ -0,0 +1,3 @@
+import type { WaitUntilFn } from "@/handlers/types";
+/** Handle the authenticated internal agent-dispatch callback. */
+export declare function POST(request: Request, waitUntil: WaitUntilFn): Promise<Response>;

package/dist/handlers/diagnostics-dashboard.d.ts

@@ -0,0 +1,2 @@
+/** Serve an HTML diagnostics dashboard showing health, plugins, and skills. */
+export declare function GET(): Promise<Response>;

package/dist/handlers/diagnostics.d.ts

@@ -0,0 +1,2 @@
+/** Return a runtime discovery snapshot for built-app diagnostics. */
+export declare function GET(): Promise<Response>;

package/dist/handlers/health.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Returns a minimal JSON health response for runtime health checks.
+ */
+export declare function GET(): Response;

package/dist/handlers/heartbeat.d.ts

@@ -0,0 +1,3 @@
+import type { WaitUntilFn } from "@/handlers/types";
+/** Handle the authenticated internal heartbeat. */
+export declare function GET(request: Request, waitUntil: WaitUntilFn): Promise<Response>;

package/dist/handlers/mcp-oauth-callback.d.ts

@@ -0,0 +1,2 @@
+import type { WaitUntilFn } from "@/handlers/types";
+export declare function GET(request: Request, provider: string, waitUntil: WaitUntilFn): Promise<Response>;

package/dist/handlers/oauth-callback.d.ts

@@ -0,0 +1,2 @@
+import type { WaitUntilFn } from "@/handlers/types";
+export declare function GET(request: Request, provider: string, waitUntil: WaitUntilFn): Promise<Response>;

package/dist/handlers/oauth-html.d.ts

@@ -0,0 +1,2 @@
+/** Build a simple centered HTML callback page. Callers must pre-escape dynamic strings. */
+export declare function htmlCallbackResponse(title: string, message: string, status: number): Response;

package/dist/handlers/sandbox-egress-proxy.d.ts

@@ -0,0 +1,9 @@
+import { type SandboxEgressHttpInterceptor } from "@/chat/sandbox/egress-proxy";
+interface SandboxEgressProxyOptions {
+    interceptHttp?: SandboxEgressHttpInterceptor;
+}
+/** Handles Vercel Sandbox firewall egress proxy requests. */
+export declare function ALL(request: Request, options?: SandboxEgressProxyOptions): Promise<Response>;
+/** Return whether a request should be routed through sandbox egress proxying. */
+export declare function isSandboxEgressRequest(request: Request): boolean;
+export {};

package/dist/handlers/turn-resume.d.ts

@@ -0,0 +1,3 @@
+import type { WaitUntilFn } from "@/handlers/types";
+/** Handle the authenticated internal timeout-resume callback. */
+export declare function POST(request: Request, waitUntil: WaitUntilFn): Promise<Response>;

package/dist/handlers/types.d.ts

@@ -0,0 +1,2 @@
+/** Callback to schedule background work that must finish before the function exits. */
+export type WaitUntilFn = (task: Promise<unknown> | (() => Promise<unknown>)) => void;

package/dist/handlers/webhooks.d.ts

@@ -0,0 +1,15 @@
+import type { WaitUntilFn } from "@/handlers/types";
+/**
+ * Handles `POST /api/webhooks/:platform`.
+ *
+ * The router only resolves the platform and delegates to the adapter webhook
+ * implementation; request semantics stay owned by the adapter package.
+ *
+ * For Slack, the body is read once and used to detect `message_changed` events
+ * that introduce a new bot @mention, which the Slack adapter silently ignores.
+ * The request is then reconstructed so the adapter can consume it normally.
+ */
+export declare function handlePlatformWebhook(request: Request, platform: string, waitUntil: WaitUntilFn, bot?: import("../chat/ingress/junior-chat").JuniorChat<{
+    slack: import("@chat-adapter/slack").SlackAdapter;
+}>): Promise<Response>;
+export declare function POST(request: Request, platform: string, waitUntil: WaitUntilFn): Promise<Response>;

package/dist/instrumentation.d.ts

@@ -1,4 +1,2 @@
 /** Initialize Sentry for the Junior runtime. Call at the top of your entry point. */
-declare function initSentry(): void;
-
-export { initSentry };
+export declare function initSentry(): void;

package/dist/nitro.d.ts

@@ -1,6 +1,5 @@
-import { P as PluginConfig } from './types-X_iCClPb.js';
-
-interface JuniorNitroOptions {
+import type { PluginConfig } from "@/chat/plugins/types";
+export interface JuniorNitroOptions {
     cwd?: string;
     maxDuration?: number;
     /** Plugin packages and manifest overrides bundled into the app. */
@@ -9,15 +8,13 @@ interface JuniorNitroOptions {
      * Extra file patterns to copy into the server output for files that the
      * bundler cannot trace (e.g. dynamically imported providers).
      * Each entry is `"<package-name>/<subpath-glob>"`, resolved via Node
-     * module resolution. Example: `"@mariozechner/pi-ai/dist/providers/*.js"`
+     * module resolution. Example: `"@earendil-works/pi-ai/dist/providers/*.js"`
      */
     includeFiles?: string[];
 }
 /** Nitro module that copies app and plugin content into the Vercel build output. */
-declare function juniorNitro(options?: JuniorNitroOptions): {
+export declare function juniorNitro(options?: JuniorNitroOptions): {
     nitro: {
         setup(nitro: unknown): void;
     };
 };
-
-export { type JuniorNitroOptions, juniorNitro };

package/dist/nitro.js

@@ -1,10 +1,12 @@
 import {
-  discoverInstalledPluginPackageContent
-} from "./chunk-XPXD3FCE.js";
+  discoverInstalledPluginPackageContent,
+  isValidPackageName,
+  resolvePackageDir
+} from "./chunk-5LUISFEY.js";
 import "./chunk-2KG3PWR4.js";
 
 // src/nitro.ts
-import path3 from "path";
+import path2 from "path";
 
 // src/build/rolldown-workarounds.ts
 function applyRolldownTreeshakeWorkaround(nitro) {
@@ -18,8 +20,8 @@ function applyRolldownTreeshakeWorkaround(nitro) {
 }
 
 // src/build/copy-build-content.ts
-import { cpSync, existsSync as existsSync2, mkdirSync, readdirSync } from "fs";
-import path2 from "path";
+import { cpSync, existsSync, mkdirSync, readdirSync, statSync } from "fs";
+import path from "path";
 
 // src/build/glob-to-regex.ts
 function globToRegex(pattern) {
@@ -27,39 +29,18 @@ function globToRegex(pattern) {
   return new RegExp(`^${escaped}$`);
 }
 
-// src/build/resolve-package.ts
-import { existsSync } from "fs";
-import path from "path";
-import { fileURLToPath } from "url";
-function resolvePackageDir(pkgName) {
-  try {
-    const resolved = import.meta.resolve(pkgName);
-    const entry = resolved.startsWith("file://") ? fileURLToPath(resolved) : resolved;
-    let dir = path.dirname(entry);
-    while (dir !== path.dirname(dir)) {
-      if (existsSync(path.join(dir, "package.json"))) return dir;
-      dir = path.dirname(dir);
-    }
-  } catch {
-  }
-  return void 0;
-}
-
 // src/build/copy-build-content.ts
 function copyAppAndPluginContent(cwd, serverRoot, packageNames) {
-  copyIfExists(path2.join(cwd, "app"), path2.join(serverRoot, "app"));
+  copyIfExists(path.join(cwd, "app"), path.join(serverRoot, "app"));
   const packagedContent = discoverInstalledPluginPackageContent(cwd, {
     packageNames
   });
   for (const root of packagedContent.manifestRoots) {
-    if (existsSync2(path2.join(root, "plugin.yaml"))) {
-      const relative = path2.relative(cwd, root);
-      if (!relative || path2.isAbsolute(relative) || relative.startsWith("..")) {
-        continue;
-      }
+    if (existsSync(path.join(root, "plugin.yaml"))) {
+      const manifestPath = path.join(root, "plugin.yaml");
       copyIfExists(
-        path2.join(root, "plugin.yaml"),
-        path2.join(serverRoot, relative, "plugin.yaml")
+        manifestPath,
+        resolveServerOutputPath(cwd, serverRoot, manifestPath)
       );
       continue;
     }
@@ -69,43 +50,119 @@ function copyAppAndPluginContent(cwd, serverRoot, packageNames) {
     copyRootIntoServerOutput(cwd, serverRoot, root);
   }
 }
-function copyIncludedFiles(serverRoot, patterns) {
-  if (!patterns?.length) return;
+function copyIncludedFiles(cwd, serverRoot, patterns) {
+  if (patterns === void 0) return;
+  if (!Array.isArray(patterns)) {
+    throw new Error(
+      "includeFiles must be an array of package subpath patterns"
+    );
+  }
+  if (patterns.length === 0) return;
   for (const pattern of patterns) {
-    const normalized = pattern.replace(/^node_modules\//, "");
-    const parts = normalized.split("/");
-    const pkgName = parts[0].startsWith("@") ? `${parts[0]}/${parts[1]}` : parts[0];
-    const subpath = parts.slice(pkgName.includes("/") ? 2 : 1).join("/");
-    const fileGlob = path2.basename(subpath);
-    const subDir = path2.dirname(subpath);
-    const pkgDir = resolvePackageDir(pkgName);
-    if (!pkgDir) continue;
-    const sourceDir = path2.join(pkgDir, subDir);
-    if (!existsSync2(sourceDir)) continue;
+    if (typeof pattern !== "string" || !pattern.trim()) {
+      throw new Error("includeFiles entries must be package subpath patterns");
+    }
+    const { pkgName, subDir, fileGlob } = parseIncludePattern(pattern);
+    const pkgDir = resolvePackageDir(cwd, pkgName);
+    if (!pkgDir) {
+      throw new Error(
+        `includeFiles entry "${pattern}" references package "${pkgName}", but it could not be resolved`
+      );
+    }
+    const sourceDir = path.join(pkgDir, subDir);
+    if (!isDirectory(sourceDir)) {
+      throw new Error(
+        `includeFiles entry "${pattern}" references missing directory ${sourceDir}`
+      );
+    }
     const entries = readdirSync(sourceDir);
     const re = fileGlob.includes("*") ? globToRegex(fileGlob) : null;
+    let matched = false;
+    let copied = false;
     for (const entry of entries) {
       if (re ? !re.test(entry) : entry !== fileGlob) continue;
-      copyIfExists(
-        path2.join(sourceDir, entry),
-        path2.join(serverRoot, "node_modules", pkgName, subDir, entry)
+      matched = true;
+      copied = copyIfExists(
+        path.join(sourceDir, entry),
+        path.join(serverRoot, "node_modules", pkgName, subDir, entry)
+      ) || copied;
+    }
+    if (!matched) {
+      throw new Error(
+        `includeFiles entry "${pattern}" did not match any files in ${sourceDir}`
+      );
+    }
+    if (!copied) {
+      throw new Error(
+        `includeFiles entry "${pattern}" matched files in ${sourceDir} but did not copy any existing files`
       );
     }
   }
 }
+function parseIncludePattern(pattern) {
+  const normalized = pattern.trim().replace(/^node_modules\//, "");
+  const parts = normalized.split("/");
+  if (!normalized || path.isAbsolute(normalized) || parts.some((part) => !part || part === "." || part === "..")) {
+    throw new Error(
+      `includeFiles entry "${pattern}" must be a package subpath pattern`
+    );
+  }
+  const isScopedPackage = parts[0].startsWith("@");
+  const packagePartCount = isScopedPackage ? 2 : 1;
+  const pkgName = parts.slice(0, packagePartCount).join("/");
+  const subpath = parts.slice(packagePartCount).join("/");
+  if (!pkgName || !isValidPackageName(pkgName) || !subpath) {
+    throw new Error(
+      `includeFiles entry "${pattern}" must include a package subpath`
+    );
+  }
+  return {
+    pkgName,
+    subDir: path.dirname(subpath),
+    fileGlob: path.basename(subpath)
+  };
+}
+function isDirectory(targetPath) {
+  try {
+    return statSync(targetPath).isDirectory();
+  } catch {
+    return false;
+  }
+}
 function copyIfExists(source, target) {
-  if (!existsSync2(source)) {
-    return;
+  if (!existsSync(source)) {
+    return false;
   }
-  mkdirSync(path2.dirname(target), { recursive: true });
+  mkdirSync(path.dirname(target), { recursive: true });
   cpSync(source, target, { recursive: true });
+  return true;
 }
 function copyRootIntoServerOutput(cwd, serverRoot, root) {
-  const relative = path2.relative(cwd, root);
-  if (!relative || path2.isAbsolute(relative) || relative.startsWith("..")) {
-    return;
+  copyIfExists(root, resolveServerOutputPath(cwd, serverRoot, root));
+}
+function resolveServerOutputPath(cwd, serverRoot, sourcePath) {
+  const relative = path.relative(cwd, sourcePath);
+  if (isLocalRelativePath(relative)) {
+    return path.join(serverRoot, relative);
+  }
+  const nodeModulesRelative = nodeModulesRelativePath(sourcePath);
+  if (nodeModulesRelative) {
+    return path.join(serverRoot, nodeModulesRelative);
   }
-  copyIfExists(root, path2.join(serverRoot, relative));
+  throw new Error(
+    `Cannot copy configured plugin content outside the app root or node_modules: ${sourcePath}`
+  );
+}
+function isLocalRelativePath(relativePath) {
+  return Boolean(relativePath) && !path.isAbsolute(relativePath) && relativePath !== ".." && !relativePath.startsWith(`..${path.sep}`);
+}
+function nodeModulesRelativePath(sourcePath) {
+  const parts = path.resolve(sourcePath).split(path.sep);
+  const nodeModulesIndex = parts.lastIndexOf("node_modules");
+  if (nodeModulesIndex === -1 || nodeModulesIndex === parts.length - 1) {
+    return null;
+  }
+  return path.join("node_modules", ...parts.slice(nodeModulesIndex + 1));
 }
 
 // src/build/virtual-config.ts
@@ -118,7 +175,7 @@ function juniorNitro(options = {}) {
   return {
     nitro: {
       setup(nitro) {
-        const cwd = path3.resolve(
+        const cwd = path2.resolve(
           options.cwd ?? nitro.options.rootDir ?? process.cwd()
         );
         nitro.options.vercel ??= {};
@@ -133,6 +190,7 @@ function juniorNitro(options = {}) {
             options.plugins?.packages
           );
           copyIncludedFiles(
+            cwd,
             nitro.options.output.serverDir,
             options.includeFiles
           );

package/dist/package-resolution.d.ts

@@ -0,0 +1,13 @@
+export interface ResolvedPackageLocation {
+    dir: string;
+    nodeModulesDir?: string;
+}
+export interface ResolvePackageLocationOptions {
+    nodeModulesDirs?: string[];
+}
+/** Return whether a string is shaped like an npm package name. */
+export declare function isValidPackageName(packageName: string): boolean;
+/** Resolve a package root from an app cwd without requiring the package to expose a JS entry point. */
+export declare function resolvePackageLocation(cwd: string, packageName: string, options?: ResolvePackageLocationOptions): ResolvedPackageLocation | undefined;
+/** Resolve a package root directory from an app cwd. */
+export declare function resolvePackageDir(cwd: string, packageName: string): string | undefined;