@open-everywhere/adapters 0.1.0

package/dist/agent/directory/okta.js

@@ -0,0 +1,178 @@
+// THE OKTA DIRECTORY ADAPTER — everything it returns is a PROPOSAL, and nothing here confirms a link. The
+// grade follows the field: `externalId` is attested (the SCIM write-back), `credentials.userName` asserted.
+import { getSecretVia } from "@open-everywhere/core/agent/adapter-api.js";
+/** Okta user statuses that mean "this person is deactivated". Everything else (ACTIVE, PROVISIONED,
+ *  STAGED, RECOVERY, LOCKED_OUT, PASSWORD_EXPIRED) is a live human with an access problem, not a
+ *  departed one — and treating a locked-out person as deprovisioned would suspend their identity
+ *  every time they fat-fingered a password. */
+const DEPROVISIONED_STATUSES = new Set(["DEPROVISIONED", "SUSPENDED"]);
+/** Page size. Okta's `/users` and `/groups` cap at 200; `/apps/{id}/users` allows 500. Asking for
+ *  the max is what keeps a small org to one round trip per resource. */
+const PAGE_LIMIT = 200;
+const APP_PAGE_LIMIT = 500;
+/** A hard cap on pages followed per resource — a runaway `Link: rel="next"` loop (a proxy rewriting
+ *  the header, a vendor bug) must not spin forever inside a scheduled tick. 200 pages ≈ 40k users. */
+const MAX_PAGES = 200;
+/** The display name to show a human, from whichever profile fields Okta actually filled in. DISPLAY
+ *  ONLY — link-store.ts invariant 4 means it can never become a lookup key, here or downstream. */
+function displayNameOf(user) {
+    const p = user.profile ?? {};
+    const full = [p.firstName, p.lastName].filter(Boolean).join(" ").trim();
+    return p.displayName?.trim() || full || p.login?.trim() || p.email?.trim() || user.id || "unknown";
+}
+/**
+ * The `rel="next"` URL from the RFC-5988 `Link` header. Okta paginates with an opaque cursor and no total
+ * count, so following the header is the ONLY correct way to page — an offset would truncate or duplicate.
+ */
+export function nextLink(header) {
+    if (!header)
+        return undefined;
+    for (const part of header.split(",")) {
+        const m = /^\s*<([^>]+)>\s*;\s*(.+)$/u.exec(part);
+        if (m && /\brel\s*=\s*"?next"?/u.test(m[2]))
+            return m[1];
+    }
+    return undefined;
+}
+/** Build the Okta directory provider. Every edge is injected, so the whole mapping is offline-testable. */
+export function makeOktaDirectoryProvider(deps) {
+    const { config } = deps;
+    const fetchImpl = deps.fetch ?? fetch;
+    const resolveToken = deps.resolveToken ?? ((broker, ref) => getSecretVia(broker, ref));
+    // The operator's OWN Okta origin — the ONLY origin the SSWS token may ever be sent to. Computed
+    // once; every request in getAll (the first AND every `Link: rel="next"` hop) is checked against it.
+    const orgOrigin = new URL(config.orgUrl).origin;
+    /** One authenticated GET, following `Link: rel="next"` to the end. Returns the concatenated pages. */
+    async function getAll(path, token) {
+        let url = path.startsWith("http") ? path : `${config.orgUrl}${path}`;
+        const out = [];
+        for (let page = 0; url && page < MAX_PAGES; page++) {
+            // 🔴 SAME-ORIGIN OR REFUSE: a `Link: rel="next"` is an absolute URL, and this request carries the SSWS token
+            // in its header. Any cross-origin URL, initial or paginated, is refused before the fetch.
+            let reqOrigin;
+            try {
+                reqOrigin = new URL(url).origin;
+            }
+            catch {
+                throw new Error(`Okta pagination produced an unparseable URL — refusing to send the API token to it.`);
+            }
+            if (reqOrigin !== orgOrigin) {
+                throw new Error(`Okta pagination tried to leave the org origin (${reqOrigin} ≠ ${orgOrigin}) — refusing to send the SSWS token off ${orgOrigin}.`);
+            }
+            let res;
+            try {
+                res = await fetchImpl(url, {
+                    method: "GET",
+                    // Okta paginates by the Link header, NEVER a 3xx — so a redirect is unexpected, and
+                    // FOLLOWING one could carry the token to the redirect target. Error out instead (F6).
+                    redirect: "error",
+                    headers: { authorization: `SSWS ${token}`, accept: "application/json" },
+                });
+            }
+            catch (err) {
+                // The URL is safe to name (it is the operator's own org); the token is not, and never
+                // appears in a message raised from here.
+                throw new Error(`Okta request to ${url} failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            if (!res.ok) {
+                let detail = "";
+                try {
+                    const body = (await res.json());
+                    detail = [body.errorCode, body.errorSummary].filter(Boolean).join(" — ");
+                }
+                catch {
+                    /* non-JSON error body: the status alone is the whole message */
+                }
+                throw new Error(`Okta ${res.status} for ${url}${detail ? ` — ${detail}` : ""}`);
+            }
+            const body = (await res.json());
+            if (Array.isArray(body))
+                out.push(...body);
+            url = nextLink(res.headers.get("link"));
+        }
+        return out;
+    }
+    /**
+     * Okta user id → the IdP group NAMES they belong to. GROUP-FIRST: its cost is O(groups), where a per-user
+     * shape costs one round trip per person against Okta's org-wide rate limit.
+     */
+    async function groupsByUser(token) {
+        const byUser = new Map();
+        const groups = await getAll(`/api/v1/groups?limit=${PAGE_LIMIT}`, token);
+        for (const group of groups) {
+            const name = group.profile?.name?.trim();
+            if (!group.id || !name)
+                continue;
+            const members = await getAll(`/api/v1/groups/${encodeURIComponent(group.id)}/users?limit=${PAGE_LIMIT}`, token);
+            for (const m of members) {
+                if (!m.id)
+                    continue;
+                const list = byUser.get(m.id) ?? [];
+                list.push(name);
+                byUser.set(m.id, list);
+            }
+        }
+        return byUser;
+    }
+    /** Okta user id → the platform accounts the mapped apps provision for them. */
+    async function accountsByUser(token) {
+        const byUser = new Map();
+        for (const app of config.apps) {
+            const assignments = await getAll(`/api/v1/apps/${encodeURIComponent(app.appId)}/users?limit=${APP_PAGE_LIMIT}`, token);
+            for (const a of assignments) {
+                if (!a.id)
+                    continue;
+                // A deprovisioned ASSIGNMENT is not a mapping any more. (It is also not evidence that the
+                // person is gone — that is the user's own status — so it only ever removes this one
+                // proposal, and never proposes an unlink: absence is not evidence.)
+                if (a.status && DEPROVISIONED_STATUSES.has(a.status.toUpperCase()))
+                    continue;
+                const nativeId = appSideId(a, app);
+                if (!nativeId)
+                    continue;
+                const list = byUser.get(a.id) ?? [];
+                // THE GRADE IS A FUNCTION OF WHICH FIELD WAS READ, and of nothing else. The workspace comes off the APP MAP —
+                // the operator's own env, never anything Okta said; omitted keeps the sole-admitted-workspace meaning.
+                list.push({ platform: app.platform, ...(app.tenant ? { tenant: app.tenant } : {}), nativeId, grade: app.field === "userName" ? "asserted" : "attested" });
+                byUser.set(a.id, list);
+            }
+        }
+        return byUser;
+    }
+    return {
+        id: "okta",
+        name: `Okta (${config.orgUrl})`,
+        async listPeople() {
+            // Resolved ONCE per sync, through the broker, and held only for the duration of this call.
+            const token = await resolveToken(config.tokenBroker, config.tokenRef);
+            const users = await getAll(`/api/v1/users?limit=${PAGE_LIMIT}`, token);
+            const groups = await groupsByUser(token);
+            const accounts = await accountsByUser(token);
+            const people = [];
+            for (const user of users) {
+                if (!user.id)
+                    continue;
+                const email = user.profile?.email?.trim();
+                people.push({
+                    externalId: user.id,
+                    displayName: displayNameOf(user),
+                    ...(email ? { email } : {}),
+                    accounts: accounts.get(user.id) ?? [],
+                    groups: (groups.get(user.id) ?? []).slice().sort(),
+                    deprovisioned: DEPROVISIONED_STATUSES.has((user.status ?? "").toUpperCase()),
+                });
+            }
+            return people;
+        },
+    };
+}
+/**
+ * The app-side identity for one assignment, per the app's configured field. Empty ⇒ no mapping, NEVER a
+ * fallback to another field: the grade contract rests on which field was read.
+ */
+function appSideId(assignment, app) {
+    const raw = app.field === "userName" ? assignment.credentials?.userName : assignment.externalId;
+    const trimmed = raw?.trim();
+    return trimmed ? trimmed : undefined;
+}
+//# sourceMappingURL=okta.js.map

package/dist/agent/directory/okta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"okta.js","sourceRoot":"","sources":["../../../agent/directory/okta.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,4GAA4G;AAE5G,OAAO,EAAE,YAAY,EAAuE,MAAM,4CAA4C,CAAC;AAM/I;;;+CAG+C;AAC/C,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;AAEvE;wEACwE;AACxE,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B;sGACsG;AACtG,MAAM,SAAS,GAAG,GAAG,CAAC;AA6CtB;mGACmG;AACnG,SAAS,aAAa,CAAC,IAAc;IACnC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,OAAO,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC;AACrG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAiC;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,yBAAyB,CAAC,IAAuB;IAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACtC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,MAAc,EAAE,GAAW,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAEvG,gGAAgG;IAChG,oGAAoG;IACpG,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAEhD,sGAAsG;IACtG,KAAK,UAAU,MAAM,CAAI,IAAY,EAAE,KAAa;QAClD,IAAI,GAAG,GAAuB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACzF,MAAM,GAAG,GAAQ,EAAE,CAAC;QACpB,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;YACnD,6GAA6G;YAC7G,0FAA0F;YAC1F,IAAI,SAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;YACzG,CAAC;YACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,kDAAkD,SAAS,MAAM,SAAS,2CAA2C,SAAS,GAAG,CAAC,CAAC;YACrJ,CAAC;YACD,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;oBACzB,MAAM,EAAE,KAAK;oBACb,oFAAoF;oBACpF,sFAAsF;oBACtF,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,EAAE,aAAa,EAAE,QAAQ,KAAK,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;iBACxE,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,sFAAsF;gBACtF,yCAAyC;gBACzC,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxG,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAc,CAAC;oBAC7C,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC3E,CAAC;gBAAC,MAAM,CAAC;oBACP,gEAAgE;gBAClE,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;YAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAI,IAAY,CAAC,CAAC;YACpD,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,YAAY,CAAC,KAAa;QACvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAY,wBAAwB,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;QACpF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,IAAI;gBAAE,SAAS;YACjC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAW,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;YAC1H,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,SAAS;gBACpB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;gBACpC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,+EAA+E;IAC/E,KAAK,UAAU,cAAc,CAAC,KAAa;QACzC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;QACrD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,MAAM,MAAM,CAAc,gBAAgB,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,cAAc,EAAE,EAAE,KAAK,CAAC,CAAC;YACpI,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,SAAS;gBACpB,0FAA0F;gBAC1F,oFAAoF;gBACpF,oEAAoE;gBACpE,IAAI,CAAC,CAAC,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;oBAAE,SAAS;gBAC7E,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACnC,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBACxB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;gBACpC,8GAA8G;gBAC9G,uGAAuG;gBACvG,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;gBAC1J,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,SAAS,MAAM,CAAC,MAAM,GAAG;QAC/B,KAAK,CAAC,UAAU;YACd,2FAA2F;YAC3F,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAW,uBAAuB,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;YACjF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;YAE7C,MAAM,MAAM,GAAsB,EAAE,CAAC;YACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,EAAE;oBAAE,SAAS;gBACvB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBAC1C,MAAM,CAAC,IAAI,CAAC;oBACV,UAAU,EAAE,IAAI,CAAC,EAAE;oBACnB,WAAW,EAAE,aAAa,CAAC,IAAI,CAAC;oBAChC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3B,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE;oBACrC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE;oBAClD,aAAa,EAAE,sBAAsB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;iBAC7E,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,UAAuB,EAAE,GAAmB;IAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAChG,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC"}

package/dist/agent/directory/register.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Arm the directory adapter if this deployment selected one; returns the registered provider id, or null.
+ * FAIL-LOUD on a half-configured selection — silence would look like an IdP with nothing to say.
+ */
+export declare function registerDirectoryAdapter(): string | null;
+//# sourceMappingURL=register.d.ts.map

package/dist/agent/directory/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../agent/directory/register.ts"],"names":[],"mappings":"AAOA;;;GAGG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,GAAG,IAAI,CAIxD"}

package/dist/agent/directory/register.js

@@ -0,0 +1,16 @@
+// Boot wiring for the directory plane: register ONLY when the selector names a provider AND its config block
+// loads. Selector-off ⇒ nothing registers, and the whole feature is cleanly off.
+import { registerDirectoryProvider } from "@open-everywhere/core/agent/adapter-api.js";
+import { loadOktaDirectoryConfig, oktaDirectoryEnabled } from "./config.js";
+import { makeOktaDirectoryProvider } from "./okta.js";
+/**
+ * Arm the directory adapter if this deployment selected one; returns the registered provider id, or null.
+ * FAIL-LOUD on a half-configured selection — silence would look like an IdP with nothing to say.
+ */
+export function registerDirectoryAdapter() {
+    if (!oktaDirectoryEnabled())
+        return null;
+    registerDirectoryProvider(makeOktaDirectoryProvider({ config: loadOktaDirectoryConfig() }));
+    return "okta";
+}
+//# sourceMappingURL=register.js.map

package/dist/agent/directory/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../agent/directory/register.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,iFAAiF;AAEjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAEtD;;;GAGG;AACH,MAAM,UAAU,wBAAwB;IACtC,IAAI,CAAC,oBAAoB,EAAE;QAAE,OAAO,IAAI,CAAC;IACzC,yBAAyB,CAAC,yBAAyB,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5F,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/agent/instrumentation.d.ts

@@ -0,0 +1,5 @@
+declare const _default: import("eve/instrumentation").InstrumentationDeclaration<{
+    readonly setup: ({ agentName }: import("eve/instrumentation").ProviderSetupContext) => void;
+}>;
+export default _default;
+//# sourceMappingURL=instrumentation.d.ts.map

package/dist/agent/instrumentation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instrumentation.d.ts","sourceRoot":"","sources":["../../agent/instrumentation.ts"],"names":[],"mappings":""}

package/dist/agent/instrumentation.js

@@ -0,0 +1,39 @@
+// OpenTelemetry tracing through eve's instrumentation seam; the vendor SDK is why this lives in adapters.
+// A provider registers only when a collector is configured, and NO model input or output reaches a span.
+// eve's `defineInstrumentation` accepts `recordInputs` and `recordOutputs`; it normalises each as
+// `=== true`, so an absent field reads FALSE. This adapter sets neither, so enabling model content
+// takes action — suppressing it does not. A fork that sets them true still meets eve's audience
+// ceiling (`applyAudienceCeiling`, eve `shared/instrumentation-content.js`), which forces both off
+// for every channel whose audience is not `public` (an `unknown` audience records only inside eve's
+// own dev environment).
+import { defineInstrumentation } from "eve/instrumentation";
+import { registerOTel } from "@vercel/otel";
+import { installLogShipping, initTelemetry } from "@open-everywhere/core/agent/adapter-api.js";
+/**
+ * A collector is configured when a standard OTLP endpoint env var is set, or when running on Vercel, where
+ * `registerOTel` auto-wires the built-in collector. Neither holds locally or in CI.
+ */
+function collectorConfigured() {
+    return Boolean(process.env.OTEL_EXPORTER_OTLP_ENDPOINT ||
+        process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT ||
+        process.env.VERCEL);
+}
+export default defineInstrumentation({
+    setup({ agentName }) {
+        // Structured log shipping (vendor-neutral HTTP ingest; core seam). Independent of
+        // the OTel collector check below: it has its own env gate (OE_LOG_SHIP_URL) and is
+        // a full no-op — console untouched — when that is unset.
+        installLogShipping();
+        // Anonymous usage telemetry (default ON; core seam, own env gate — OE_TELEMETRY/
+        // DO_NOT_TRACK). Prints the boot disclosure line before anything is transmitted;
+        // fire-and-forget (this callback is synchronous, must never block boot).
+        initTelemetry();
+        if (!collectorConfigured())
+            return;
+        // serviceName = the agent name from `defineAgent`, per Eve's guidance. Exporter
+        // wiring (endpoint, headers, protocol) comes from the standard `OTEL_EXPORTER_OTLP_*`
+        // env vars that `@vercel/otel` reads.
+        registerOTel({ serviceName: agentName });
+    },
+});
+//# sourceMappingURL=instrumentation.js.map

package/dist/agent/instrumentation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instrumentation.js","sourceRoot":"","sources":["../../agent/instrumentation.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,yGAAyG;AACzG,kGAAkG;AAClG,mGAAmG;AACnG,gGAAgG;AAChG,mGAAmG;AACnG,oGAAoG;AACpG,wBAAwB;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,4CAA4C,CAAC;AAE/F;;;GAGG;AACH,SAAS,mBAAmB;IAC1B,OAAO,OAAO,CACZ,OAAO,CAAC,GAAG,CAAC,2BAA2B;QACrC,OAAO,CAAC,GAAG,CAAC,kCAAkC;QAC9C,OAAO,CAAC,GAAG,CAAC,MAAM,CACrB,CAAC;AACJ,CAAC;AAED,eAAe,qBAAqB,CAAC;IACnC,KAAK,CAAC,EAAE,SAAS,EAAE;QACjB,kFAAkF;QAClF,mFAAmF;QACnF,yDAAyD;QACzD,kBAAkB,EAAE,CAAC;QACrB,iFAAiF;QACjF,iFAAiF;QACjF,yEAAyE;QACzE,aAAa,EAAE,CAAC;QAChB,IAAI,CAAC,mBAAmB,EAAE;YAAE,OAAO;QACnC,gFAAgF;QAChF,sFAAsF;QACtF,sCAAsC;QACtC,YAAY,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3C,CAAC;CACF,CAAC,CAAC"}

package/dist/agent/model/approval-judge.d.ts

@@ -0,0 +1,15 @@
+import { type JudgePass } from "@open-everywhere/core/agent/adapter-api.js";
+import { type GatewayRoutedDefaults } from "./gateway.js";
+/** Map one pass onto its call settings. Pure — exported for tests (no network call needed to
+ *  assert the pass split), mirroring dreamCallSettings. */
+export declare function approvalJudgeCallSettings(pass: JudgePass, defaults: GatewayRoutedDefaults): {
+    id: string;
+    maxOutputTokens?: number;
+    providerOptions?: Record<string, unknown>;
+};
+/**
+ * Build and register the gateway judge transport at boot. Without it the judge answers `defer` everywhere;
+ * registration IS the transport opt-in, and arming is separate (approvals.judgeMode, default off).
+ */
+export declare function registerGatewayApprovalJudge(defaults: GatewayRoutedDefaults): void;
+//# sourceMappingURL=approval-judge.d.ts.map

package/dist/agent/model/approval-judge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-judge.d.ts","sourceRoot":"","sources":["../../../agent/model/approval-judge.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,SAAS,EAEf,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAuB,KAAK,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAQ/E;2DAC2D;AAC3D,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,qBAAqB,GAC9B;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAOrF;AAqBD;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAElF"}

package/dist/agent/model/approval-judge.js

@@ -0,0 +1,46 @@
+// Gateway transport for the approval judge — core owns the seam; this owns the vendor call on the fixed
+// `judge` model role. NO scope routing: the judge must not inherit whatever a domain routed its seat onto.
+import { gateway, generateText } from "ai";
+import { registerApprovalJudgeCompletion, } from "@open-everywhere/core/agent/adapter-api.js";
+import { applyGatewayOptions } from "./gateway.js";
+/**
+ * Output budget for the scrutiny pass. A reasoning model spends reasoning tokens INSIDE the budget, so a
+ * tight cap truncates to empty text (live 2026-08-08: 16 produced empty completions). 512 costs ~nothing.
+ */
+const SCRUTINY_MAX_OUTPUT_TOKENS = 512;
+/** Map one pass onto its call settings. Pure — exported for tests (no network call needed to
+ *  assert the pass split), mirroring dreamCallSettings. */
+export function approvalJudgeCallSettings(pass, defaults) {
+    const options = applyGatewayOptions({}, {}, { id: defaults.id, defaultId: defaults.id }, defaults.gateway);
+    return {
+        id: defaults.id,
+        ...(pass === "scrutiny" ? { maxOutputTokens: SCRUTINY_MAX_OUTPUT_TOKENS } : {}),
+        ...(options.providerOptions !== undefined ? { providerOptions: options.providerOptions } : {}),
+    };
+}
+/**
+ * The gateway-backed judge completion. It DOES NOT touch the model stamp: the judge can run DETACHED from
+ * the turn, and a concurrent save and restore races the seat for the single per-session slot.
+ */
+function gatewayApprovalJudgeCompletion(defaults) {
+    return async (prompt, pass) => {
+        const s = approvalJudgeCallSettings(pass, defaults);
+        const { text } = await generateText({
+            model: gateway(s.id),
+            prompt,
+            ...(s.maxOutputTokens !== undefined ? { maxOutputTokens: s.maxOutputTokens } : {}),
+            ...(s.providerOptions !== undefined
+                ? { providerOptions: s.providerOptions }
+                : {}),
+        });
+        return text;
+    };
+}
+/**
+ * Build and register the gateway judge transport at boot. Without it the judge answers `defer` everywhere;
+ * registration IS the transport opt-in, and arming is separate (approvals.judgeMode, default off).
+ */
+export function registerGatewayApprovalJudge(defaults) {
+    registerApprovalJudgeCompletion(gatewayApprovalJudgeCompletion(defaults));
+}
+//# sourceMappingURL=approval-judge.js.map

package/dist/agent/model/approval-judge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-judge.js","sourceRoot":"","sources":["../../../agent/model/approval-judge.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,2GAA2G;AAE3G,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC3C,OAAO,EAGL,+BAA+B,GAChC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAA8B,MAAM,cAAc,CAAC;AAE/E;;;GAGG;AACH,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC;2DAC2D;AAC3D,MAAM,UAAU,yBAAyB,CACvC,IAAe,EACf,QAA+B;IAE/B,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC3G,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,8BAA8B,CAAC,QAA+B;IACrE,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC5B,MAAM,CAAC,GAAG,yBAAyB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACpB,MAAM;YACN,GAAG,CAAC,CAAC,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,CAAC,CAAC,eAAe,KAAK,SAAS;gBACjC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,eAAwE,EAAE;gBACjG,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAA+B;IAC1E,+BAA+B,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC5E,CAAC"}

package/dist/agent/model/dream-judge.d.ts

@@ -0,0 +1,40 @@
+import { type ModelRoute, type DreamJudge } from "@open-everywhere/core/agent/adapter-api.js";
+import { type GatewayRoutedDefaults } from "./gateway.js";
+/**
+ * The effective `utility` route for a dream scope (channel key | silo name | other).
+ * Pure given the registered config; {} (→ static defaults) when config isn't registered
+ * or nothing routes. Exported for tests.
+ */
+export declare function utilityRouteForScope(scope: string): ModelRoute;
+/**
+ * Map a resolved route onto one completion call: the gateway model id, the reasoning
+ * effort, and the call's `providerOptions.gateway` (via the same pin/posture rules as
+ * the routed turn model — applyGatewayOptions). Pure — exported for tests.
+ */
+export declare function dreamCallSettings(route: ModelRoute, defaults: GatewayRoutedDefaults): {
+    id: string;
+    reasoning?: ModelRoute["reasoning"];
+    providerOptions?: Record<string, unknown>;
+};
+/**
+ * dreamCallSettings plus the model-stamp side effect, split out so a test exercises the stamp with no network.
+ * Whether the stamp LANDS depends on the caller: the cron-fired tidy pass has no session, so it no-ops.
+ */
+export declare function resolvedDreamCallSettings(scope: string, defaults: GatewayRoutedDefaults): {
+    id: string;
+    reasoning?: ModelRoute["reasoning"];
+    providerOptions?: Record<string, unknown>;
+};
+/** The gateway-backed DreamJudge — core's fail-quiet skeleton over the completion above. */
+export declare function gatewayDreamJudge(defaults: GatewayRoutedDefaults): DreamJudge;
+/**
+ * Convenience for agent.ts: build + register the gateway judge at boot. Without this
+ * call the dream cycle runs its zero-LLM v1 heuristics — registration IS the v2 opt-in.
+ */
+export declare function registerGatewayDreamJudge(defaults: GatewayRoutedDefaults): void;
+/**
+ * Build and register the Mode-3 failure-facet judge at boot, on the SAME completion this module already
+ * builds. Without it the weekly digest falls back to static facets — registration IS the opt-in.
+ */
+export declare function registerGatewayFailureFacetJudge(defaults: GatewayRoutedDefaults): void;
+//# sourceMappingURL=dream-judge.d.ts.map

package/dist/agent/model/dream-judge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dream-judge.d.ts","sourceRoot":"","sources":["../../../agent/model/dream-judge.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,KAAK,UAAU,EAMf,KAAK,UAAU,EAMhB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAuB,KAAK,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE/E;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAc9D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,qBAAqB,GAC9B;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAIhG;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,qBAAqB,GAC9B;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAIhG;AAkBD,4FAA4F;AAC5F,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,UAAU,CAE7E;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAE/E;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAEtF"}

package/dist/agent/model/dream-judge.js

@@ -0,0 +1,80 @@
+// Gateway transport for the dream judge — core owns the seam; this owns one completion on the `utility`
+// role. The SCOPE locates the route: a channel key, a silo's owning domain, else `org`. It FAILS QUIET.
+import { gateway, generateText } from "ai";
+import { modelRouteFor, memoryRefs, domainRoster, getConfig, judgeFromCompletion, registerDreamJudge, facetJudgeFromCompletion, registerFailureFacetJudge, stampModelCall, } from "@open-everywhere/core/agent/adapter-api.js";
+import { applyGatewayOptions } from "./gateway.js";
+/**
+ * The effective `utility` route for a dream scope (channel key | silo name | other).
+ * Pure given the registered config; {} (→ static defaults) when config isn't registered
+ * or nothing routes. Exported for tests.
+ */
+export function utilityRouteForScope(scope) {
+    try {
+        const domains = getConfig().loadDomains();
+        // Role presets rung in here exactly as they do on the live turn path (item 26) —
+        // a role that presets a `utility` route governs the dream judge for its domains too.
+        const roles = getConfig().loadRoles?.() ?? [];
+        if (domains.some((d) => domainRoster(d).includes(scope)))
+            return modelRouteFor("utility", scope, domains, roles);
+        const owner = domains.find((d) => memoryRefs(d).includes(scope) && domainRoster(d).length > 0);
+        // An unknown/unowned scope key matches no explicit domain, so modelRouteFor yields
+        // the `org` pseudo-domain layer alone — exactly the wanted fallback.
+        return modelRouteFor("utility", owner ? (domainRoster(owner)[0] ?? scope) : scope, domains, roles);
+    }
+    catch {
+        return {}; // config not registered (tests, cold paths) → static defaults, fail quiet
+    }
+}
+/**
+ * Map a resolved route onto one completion call: the gateway model id, the reasoning
+ * effort, and the call's `providerOptions.gateway` (via the same pin/posture rules as
+ * the routed turn model — applyGatewayOptions). Pure — exported for tests.
+ */
+export function dreamCallSettings(route, defaults) {
+    const id = route.id ?? defaults.id;
+    const options = applyGatewayOptions(route, {}, { id, defaultId: defaults.id }, defaults.gateway);
+    return { id, reasoning: route.reasoning, providerOptions: options.providerOptions };
+}
+/**
+ * dreamCallSettings plus the model-stamp side effect, split out so a test exercises the stamp with no network.
+ * Whether the stamp LANDS depends on the caller: the cron-fired tidy pass has no session, so it no-ops.
+ */
+export function resolvedDreamCallSettings(scope, defaults) {
+    const s = dreamCallSettings(utilityRouteForScope(scope), defaults);
+    stampModelCall(s.id);
+    return s;
+}
+/** One cheap gateway completion on the scope's utility route. */
+function gatewayDreamCompletion(defaults) {
+    return async (scope, prompt) => {
+        const s = resolvedDreamCallSettings(scope, defaults);
+        const { text } = await generateText({
+            model: gateway(s.id),
+            prompt,
+            ...(s.reasoning !== undefined ? { reasoning: s.reasoning } : {}),
+            ...(s.providerOptions !== undefined
+                ? { providerOptions: s.providerOptions }
+                : {}),
+        });
+        return text;
+    };
+}
+/** The gateway-backed DreamJudge — core's fail-quiet skeleton over the completion above. */
+export function gatewayDreamJudge(defaults) {
+    return judgeFromCompletion(gatewayDreamCompletion(defaults));
+}
+/**
+ * Convenience for agent.ts: build + register the gateway judge at boot. Without this
+ * call the dream cycle runs its zero-LLM v1 heuristics — registration IS the v2 opt-in.
+ */
+export function registerGatewayDreamJudge(defaults) {
+    registerDreamJudge(gatewayDreamJudge(defaults));
+}
+/**
+ * Build and register the Mode-3 failure-facet judge at boot, on the SAME completion this module already
+ * builds. Without it the weekly digest falls back to static facets — registration IS the opt-in.
+ */
+export function registerGatewayFailureFacetJudge(defaults) {
+    registerFailureFacetJudge(facetJudgeFromCompletion(gatewayDreamCompletion(defaults)));
+}
+//# sourceMappingURL=dream-judge.js.map

package/dist/agent/model/dream-judge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dream-judge.js","sourceRoot":"","sources":["../../../agent/model/dream-judge.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,wGAAwG;AAExG,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC3C,OAAO,EAEL,aAAa,EACb,UAAU,EACV,YAAY,EACZ,SAAS,EAGT,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,yBAAyB,EACzB,cAAc,GACf,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAA8B,MAAM,cAAc,CAAC;AAE/E;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,iFAAiF;QACjF,qFAAqF;QACrF,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;QAC9C,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACjH,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/F,mFAAmF;QACnF,qEAAqE;QACrE,OAAO,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACrG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,0EAA0E;IACvF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAiB,EACjB,QAA+B;IAE/B,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjG,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;AACtF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAa,EACb,QAA+B;IAE/B,MAAM,CAAC,GAAG,iBAAiB,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;IACnE,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,iEAAiE;AACjE,SAAS,sBAAsB,CAAC,QAA+B;IAC7D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,yBAAyB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACpB,MAAM;YACN,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,CAAC,CAAC,eAAe,KAAK,SAAS;gBACjC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,eAAwE,EAAE;gBACjG,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,iBAAiB,CAAC,QAA+B;IAC/D,OAAO,mBAAmB,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAA+B;IACvE,kBAAkB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAAC,QAA+B;IAC9E,yBAAyB,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC"}

package/dist/agent/model/gateway-vision.d.ts

@@ -0,0 +1,53 @@
+import { type ImageDescribeResult, type ImageDescribeUsage, type ImageDescriber } from "@open-everywhere/core/agent/adapter-api.js";
+/** Static config for the gateway vision transport. */
+export interface GatewayVisionDefaults {
+    /** Gateway vision model id, e.g. "alibaba/qwen3-vl-instruct". */
+    readonly id: string;
+    /**
+     * providerOptions.gateway for the call, forwarded verbatim. Absent in the reference config: ZDR is the
+     * gateway's org policy now. A self-host wanting a per-call posture passes one here.
+     */
+    readonly gateway?: Record<string, unknown>;
+}
+/**
+ * Tolerantly parse a vision completion into `{description, ocrText}`: the strict-JSON shape, else the whole
+ * completion as the description. Pure — exported for tests.
+ */
+export declare function parseVisionResult(text: string): ImageDescribeResult;
+/**
+ * Wrap a failed vision call so the error NAMES THE MODEL ID this role asked for: a gateway refusal names only
+ * the provider, and the id lives in app config that neither the tool nor its audit row can see.
+ */
+export declare function visionCallError(id: string, err: unknown): Error;
+/** The `generateText` fields this transport reads for its own accounting — declared structurally
+ *  rather than imported, because the AI SDK types them as broad optionals and the extraction below
+ *  has to be defensive about every one of them anyway. */
+interface VisionCallTelemetry {
+    readonly usage?: {
+        readonly inputTokens?: number;
+        readonly outputTokens?: number;
+        readonly inputTokenDetails?: {
+            readonly cacheReadTokens?: number;
+            readonly cacheWriteTokens?: number;
+        };
+        readonly outputTokenDetails?: {
+            readonly reasoningTokens?: number;
+        };
+    };
+    readonly providerMetadata?: Record<string, unknown>;
+}
+/**
+ * What this call cost, reduced to the seam's usage shape. 🔴 The extraction rules are EVE'S, copied
+ * field-for-field: these rows sit in the same two tables as turn steps and are summed by the same caps.
+ */
+export declare function visionCallUsage(id: string, res: VisionCallTelemetry): ImageDescribeUsage;
+/** Build the gateway-backed ImageDescriber. A gateway/model error — including the gateway
+ *  refusing to route the vision model under a ZDR-only org policy — propagates as a throw, and
+ *  the tool's fail-closed contract turns it into "couldn't describe". */
+export declare function gatewayImageDescriber(defaults: GatewayVisionDefaults): ImageDescriber;
+/** Convenience for agent.ts: build + register the gateway image describer at boot. Without this
+ *  call the `describe_image` tool has no backend and fails closed on every call (the agent says
+ *  it can't see the image) — registration IS the "agent can see images" opt-in. */
+export declare function registerGatewayImageDescriber(defaults: GatewayVisionDefaults): void;
+export {};
+//# sourceMappingURL=gateway-vision.d.ts.map

package/dist/agent/model/gateway-vision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-vision.d.ts","sourceRoot":"","sources":["../../../agent/model/gateway-vision.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EAEpB,MAAM,4CAA4C,CAAC;AAEpD,sDAAsD;AACtD,MAAM,WAAW,qBAAqB;IACpC,iEAAiE;IACjE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAWD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,CAiBnE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,KAAK,CAE/D;AAED;;0DAE0D;AAC1D,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,iBAAiB,CAAC,EAAE;YAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACvG,QAAQ,CAAC,kBAAkB,CAAC,EAAE;YAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACrE,CAAC;IACF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,kBAAkB,CAuCxF;AAED;;yEAEyE;AACzE,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,cAAc,CA8BrF;AAED;;mFAEmF;AACnF,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAEnF"}