@open-everywhere/adapters 0.1.0

package/dist/agent/model/gateway-vision.js

@@ -0,0 +1,129 @@
+// Gateway transport for the image describer — core owns the seam. Zero-data-retention is enforced AT THE
+// GATEWAY by org policy; the call is fail-closed, reports its own spend, and must NOT stamp the model.
+import { gateway, generateText } from "ai";
+import { registerImageDescriber, } from "@open-everywhere/core/agent/adapter-api.js";
+// The instruction: describe, transcribe on-image text, reply STRICT JSON. Kept here rather than in core
+// because it is paired with THIS transport's message shape.
+const VISION_PROMPT = "You are a vision assistant reducing an image to text for a text-only agent. Look at the " +
+    "image and reply with STRICT JSON only, no prose outside it: " +
+    '{"description": "<a plain, factual description of what the image shows>", ' +
+    '"ocr_text": "<ALL text visible in the image, transcribed verbatim; empty string if none>"}. ' +
+    "Describe only what is actually visible — never invent detail you cannot see.";
+/**
+ * Tolerantly parse a vision completion into `{description, ocrText}`: the strict-JSON shape, else the whole
+ * completion as the description. Pure — exported for tests.
+ */
+export function parseVisionResult(text) {
+    const start = text.indexOf("{");
+    const end = text.lastIndexOf("}");
+    if (start !== -1 && end > start) {
+        try {
+            const o = JSON.parse(text.slice(start, end + 1));
+            const description = typeof o["description"] === "string" ? o["description"].trim() : "";
+            const ocrRaw = typeof o["ocr_text"] === "string" ? o["ocr_text"].trim() : "";
+            if (description.length > 0 || ocrRaw.length > 0) {
+                return { description: description.length > 0 ? description : "(no description returned)", ...(ocrRaw.length > 0 ? { ocrText: ocrRaw } : {}) };
+            }
+        }
+        catch {
+            /* fall through to the raw-text fallback */
+        }
+    }
+    const raw = text.trim();
+    return { description: raw.length > 0 ? raw : "(no description returned)" };
+}
+/**
+ * Wrap a failed vision call so the error NAMES THE MODEL ID this role asked for: a gateway refusal names only
+ * the provider, and the id lives in app config that neither the tool nor its audit row can see.
+ */
+export function visionCallError(id, err) {
+    return new Error(`vision model "${id}": ${err instanceof Error ? err.message : String(err)}`);
+}
+/**
+ * What this call cost, reduced to the seam's usage shape. 🔴 The extraction rules are EVE'S, copied
+ * field-for-field: these rows sit in the same two tables as turn steps and are summed by the same caps.
+ */
+export function visionCallUsage(id, res) {
+    const u = res.usage;
+    const gw = (() => {
+        const raw = res.providerMetadata?.["gateway"];
+        return raw !== null && typeof raw === "object" && !Array.isArray(raw) ? raw : undefined;
+    })();
+    const costUsd = (() => {
+        const raw = gw?.["cost"];
+        if (typeof raw === "number" && Number.isFinite(raw))
+            return raw;
+        if (typeof raw === "string") {
+            const n = Number(raw);
+            if (Number.isFinite(n))
+                return n;
+        }
+        return undefined;
+    })();
+    const generationId = typeof gw?.["generationId"] === "string" && gw["generationId"].length > 0 ? gw["generationId"] : undefined;
+    // Finiteness-guarded, not merely typeof-guarded: `NaN` is a number, and every one of these
+    // lands in a column a cap sums. An unreadable count is dropped (the row then simply under-reports
+    // that dimension) rather than propagated as a value arithmetic cannot use.
+    const num = (v) => (typeof v === "number" && Number.isFinite(v) ? v : undefined);
+    const tok = {
+        inputTokens: num(u?.inputTokens),
+        outputTokens: num(u?.outputTokens),
+        cacheReadTokens: num(u?.inputTokenDetails?.cacheReadTokens),
+        cacheWriteTokens: num(u?.inputTokenDetails?.cacheWriteTokens),
+        // The REASONING dimension, and this is the one place OE can read it — eve's `extractStepUsage` never copies
+        // `outputTokenDetails.reasoningTokens`. Absent means unreported rather than zero, and it is NEVER priced.
+        reasoningTokens: num(u?.outputTokenDetails?.reasoningTokens),
+    };
+    return {
+        model: id,
+        ...(tok.inputTokens !== undefined ? { inputTokens: tok.inputTokens } : {}),
+        ...(tok.outputTokens !== undefined ? { outputTokens: tok.outputTokens } : {}),
+        ...(tok.cacheReadTokens !== undefined ? { cacheReadTokens: tok.cacheReadTokens } : {}),
+        ...(tok.cacheWriteTokens !== undefined ? { cacheWriteTokens: tok.cacheWriteTokens } : {}),
+        ...(tok.reasoningTokens !== undefined ? { reasoningTokens: tok.reasoningTokens } : {}),
+        ...(costUsd !== undefined ? { costUsd } : {}),
+        ...(generationId !== undefined ? { generationId } : {}),
+    };
+}
+/** Build the gateway-backed ImageDescriber. A gateway/model error — including the gateway
+ *  refusing to route the vision model under a ZDR-only org policy — propagates as a throw, and
+ *  the tool's fail-closed contract turns it into "couldn't describe". */
+export function gatewayImageDescriber(defaults) {
+    return {
+        async describe(req) {
+            let res;
+            try {
+                res = await generateText({
+                    model: gateway(defaults.id),
+                    messages: [
+                        {
+                            role: "user",
+                            content: [
+                                { type: "text", text: req.hint ? `${VISION_PROMPT}\nContext hint: ${req.hint}` : VISION_PROMPT },
+                                { type: "image", image: req.bytes, mediaType: req.mimeType },
+                            ],
+                        },
+                    ],
+                    ...(defaults.gateway !== undefined
+                        ? { providerOptions: { gateway: defaults.gateway } }
+                        : {}),
+                });
+            }
+            catch (err) {
+                // Re-thrown with the model id prefixed (visionCallError) and nothing else changed: the
+                // tool's fail-closed contract is unaffected, the failure just becomes attributable.
+                throw visionCallError(defaults.id, err);
+            }
+            // The call's own accounting rides back with the result (OPE-403) — describe_image writes the
+            // attributed ledger + usage rows from it, because nothing else in the tree can see this call.
+            return { ...parseVisionResult(res.text), usage: visionCallUsage(defaults.id, res) };
+        },
+    };
+}
+/** Convenience for agent.ts: build + register the gateway image describer at boot. Without this
+ *  call the `describe_image` tool has no backend and fails closed on every call (the agent says
+ *  it can't see the image) — registration IS the "agent can see images" opt-in. */
+export function registerGatewayImageDescriber(defaults) {
+    registerImageDescriber(gatewayImageDescriber(defaults));
+}
+//# sourceMappingURL=gateway-vision.js.map

package/dist/agent/model/gateway-vision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-vision.js","sourceRoot":"","sources":["../../../agent/model/gateway-vision.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,uGAAuG;AAEvG,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC3C,OAAO,EAKL,sBAAsB,GACvB,MAAM,4CAA4C,CAAC;AAapD,wGAAwG;AACxG,4DAA4D;AAC5D,MAAM,aAAa,GACjB,0FAA0F;IAC1F,8DAA8D;IAC9D,4EAA4E;IAC5E,8FAA8F;IAC9F,8EAA8E,CAAC;AAEjF;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAA4B,CAAC;YAC5E,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,2BAA2B,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAChJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2CAA2C;QAC7C,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACxB,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,2BAA2B,EAAE,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,EAAU,EAAE,GAAY;IACtD,OAAO,IAAI,KAAK,CAAC,iBAAiB,EAAE,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAChG,CAAC;AAeD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,EAAU,EAAE,GAAwB;IAClE,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;IACpB,MAAM,EAAE,GAAG,CAAC,GAAwC,EAAE;QACpD,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9C,OAAO,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAA+B,CAAC,CAAC,CAAC,SAAS,CAAC;IACvH,CAAC,CAAC,EAAE,CAAC;IACL,MAAM,OAAO,GAAG,CAAC,GAAuB,EAAE;QACxC,MAAM,GAAG,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QAChE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,EAAE,CAAC;IACL,MAAM,YAAY,GAAG,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAK,EAAE,CAAC,cAAc,CAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,cAAc,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACxJ,2FAA2F;IAC3F,kGAAkG;IAClG,2EAA2E;IAC3E,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9G,MAAM,GAAG,GAAG;QACV,WAAW,EAAE,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC;QAChC,YAAY,EAAE,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC;QAClC,eAAe,EAAE,GAAG,CAAC,CAAC,EAAE,iBAAiB,EAAE,eAAe,CAAC;QAC3D,gBAAgB,EAAE,GAAG,CAAC,CAAC,EAAE,iBAAiB,EAAE,gBAAgB,CAAC;QAC7D,4GAA4G;QAC5G,0GAA0G;QAC1G,eAAe,EAAE,GAAG,CAAC,CAAC,EAAE,kBAAkB,EAAE,eAAe,CAAC;KAC7D,CAAC;IACF,OAAO;QACL,KAAK,EAAE,EAAE;QACT,GAAG,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,GAAG,CAAC,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC;AAED;;yEAEyE;AACzE,MAAM,UAAU,qBAAqB,CAAC,QAA+B;IACnE,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,GAAyB;YACtC,IAAI,GAA2C,CAAC;YAChD,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,YAAY,CAAC;oBACvB,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC3B,QAAQ,EAAE;wBACR;4BACE,IAAI,EAAE,MAAM;4BACZ,OAAO,EAAE;gCACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,aAAa,mBAAmB,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE;gCAChG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE;6BAC7D;yBACF;qBACF;oBACD,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS;wBAChC,CAAC,CAAC,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAA2D,EAAE;wBAC7G,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uFAAuF;gBACvF,oFAAoF;gBACpF,MAAM,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1C,CAAC;YACD,6FAA6F;YAC7F,8FAA8F;YAC9F,OAAO,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QACtF,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;mFAEmF;AACnF,MAAM,UAAU,6BAA6B,CAAC,QAA+B;IAC3E,sBAAsB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/agent/model/gateway.d.ts

@@ -0,0 +1,30 @@
+import { gateway } from "ai";
+import { type ModelRoute, type ModelBackend, type RoutedCallOptions } from "@open-everywhere/core/agent/adapter-api.js";
+type GatewayModel = ReturnType<typeof gateway>;
+/** Static defaults for one routed slot — mirrors what a plain string config said. */
+export interface GatewayRoutedDefaults {
+    /** Default gateway model id (what unrouted channels use), e.g. "zai/glm-5.2". */
+    readonly id: string;
+    /**
+     * Gateway providerOptions applied when the CALL carries none — a floor, since turn calls carry their own.
+     * Any gateway option is forwarded verbatim; this mapping has no allow-list of keys.
+     */
+    readonly gateway?: Record<string, unknown>;
+}
+/**
+ * Map a route's provider hints onto one call's gateway options. Pure. A MODEL CHANGE strips the pin keys — a
+ * pin set for one model is broken for another — and a route's `providers` becomes `order`, never `only`.
+ */
+export declare function applyGatewayOptions(route: ModelRoute, options: RoutedCallOptions, ids: {
+    readonly id: string;
+    readonly defaultId: string;
+}, defaults?: Record<string, unknown>): RoutedCallOptions;
+/** The gateway ModelBackend (see core ModelBackend). */
+export declare function gatewayModelBackend(defaults?: Record<string, unknown>): ModelBackend<GatewayModel>;
+/**
+ * A `step.started` dynamic-model resolver. It MUST be `step.started`: eve discards a model INSTANCE at turn
+ * scope. It ALWAYS returns a model, never null, and `event` carries the turn id this ctx does not.
+ */
+export declare function gatewayModelResolver(primary: GatewayRoutedDefaults): (event: unknown, ctx: unknown) => Promise<GatewayModel>;
+export {};
+//# sourceMappingURL=gateway.d.ts.map

package/dist/agent/model/gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../../agent/model/gateway.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAiB,MAAM,IAAI,CAAC;AAC5C,OAAO,EACL,KAAK,UAAU,EAEf,KAAK,YAAY,EACjB,KAAK,iBAAiB,EAGvB,MAAM,4CAA4C,CAAC;AAEpD,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;AAY/C,qFAAqF;AACrF,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAKD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EACxD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,iBAAiB,CAanB;AAED,wDAAwD;AACxD,wBAAgB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY,CAAC,YAAY,CAAC,CAKlG;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,YAAY,CAAC,CAG5H"}

package/dist/agent/model/gateway.js

@@ -0,0 +1,55 @@
+// The Vercel AI Gateway model backend — the reference `ModelBackend`. Provider SELECTION is not pinned here:
+// that is a gateway-operator concern, and `ModelRoute.providers` is only an optional per-route preference.
+import { gateway, createGateway } from "ai";
+import { liveIdentity, resolvePrimaryModel, } from "@open-everywhere/core/agent/adapter-api.js";
+/**
+ * THE GATEWAY TARGET — `OE_AI_GATEWAY_URL`, read once at module load: a target that changed mid-process would
+ * send two calls in one turn to two providers. Unset ⇒ the plain `gateway` export, byte-identical.
+ */
+const GATEWAY_BASE_URL = process.env.OE_AI_GATEWAY_URL?.trim();
+/** The gateway provider this backend resolves model ids through — retargeted only when
+ *  {@link GATEWAY_BASE_URL} names a different host. */
+const provider = GATEWAY_BASE_URL ? createGateway({ baseURL: GATEWAY_BASE_URL }) : gateway;
+/** Gateway pin keys a route replaces — a pin belongs to the id it was set with. */
+const PIN_KEYS = ["only", "order"];
+/**
+ * Map a route's provider hints onto one call's gateway options. Pure. A MODEL CHANGE strips the pin keys — a
+ * pin set for one model is broken for another — and a route's `providers` becomes `order`, never `only`.
+ */
+export function applyGatewayOptions(route, options, ids, defaults) {
+    const base = (options.providerOptions?.gateway ?? defaults);
+    let gatewayOpts = base;
+    if (ids.id !== ids.defaultId && base !== undefined) {
+        gatewayOpts = { ...base };
+        for (const k of PIN_KEYS)
+            delete gatewayOpts[k];
+    }
+    if (route.providers !== undefined) {
+        gatewayOpts = { ...(gatewayOpts ?? {}), order: [...route.providers] };
+        delete gatewayOpts["only"];
+    }
+    if (gatewayOpts === undefined)
+        return options;
+    return { ...options, providerOptions: { ...options.providerOptions, gateway: gatewayOpts } };
+}
+/** The gateway ModelBackend (see core ModelBackend). */
+export function gatewayModelBackend(defaults) {
+    return {
+        model: (id) => provider(id),
+        applyOptions: (route, options, ids) => applyGatewayOptions(route, options, ids, defaults),
+    };
+}
+/**
+ * A `step.started` dynamic-model resolver. It MUST be `step.started`: eve discards a model INSTANCE at turn
+ * scope. It ALWAYS returns a model, never null, and `event` carries the turn id this ctx does not.
+ */
+export function gatewayModelResolver(primary) {
+    const deps = { ...liveIdentity, backend: gatewayModelBackend(primary.gateway) };
+    return (event, ctx) => resolvePrimaryModel(ctx, { primary: { id: primary.id } }, deps, event);
+}
+// There is deliberately NO exported compaction model here. eve 0.38.3 cannot run an authored
+// `compaction.model` under a dynamic agent model — it resolves the slot's reference through the
+// AGENT-LEVEL `model` field and throws (OPE-670; the full chain is on `agent/agent.ts`'s
+// `compaction` block). Compaction runs on the live turn model instead, which this file already
+// serves through `gatewayModelResolver`.
+//# sourceMappingURL=gateway.js.map

package/dist/agent/model/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../../../agent/model/gateway.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,2GAA2G;AAE3G,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC5C,OAAO,EAKL,YAAY,EACZ,mBAAmB,GACpB,MAAM,4CAA4C,CAAC;AAIpD;;;GAGG;AACH,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;AAE/D;uDACuD;AACvD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAa3F,mFAAmF;AACnF,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,OAAO,CAAU,CAAC;AAE5C;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAiB,EACjB,OAA0B,EAC1B,GAAwD,EACxD,QAAkC;IAElC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,IAAI,QAAQ,CAAwC,CAAC;IACnG,IAAI,WAAW,GAAG,IAAI,CAAC;IACvB,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACnD,WAAW,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAClC,WAAW,GAAG,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACtE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC9C,OAAO,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC;AAC/F,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,mBAAmB,CAAC,QAAkC;IACpE,OAAO;QACL,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC;KAC1F,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,MAAM,IAAI,GAAG,EAAE,GAAG,YAAY,EAAE,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IAChF,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAsB,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AACnH,CAAC;AAED,6FAA6F;AAC7F,gGAAgG;AAChG,yFAAyF;AACzF,+FAA+F;AAC/F,yCAAyC"}

package/dist/agent/oe-oauth/config.d.ts

@@ -0,0 +1,69 @@
+/** The JSON provider-config block env var. */
+export declare const OE_OAUTH_CONFIG_ENV = "OE_OAUTH_CONFIG";
+/** The discovery + DCR + PKCE public-client dialect — the original and default mode. */
+export declare const OE_OAUTH_MODE_DISCOVERY = "discovery-dcr-pkce";
+/** The static confidential-client dialect (OPE-1086) — no discovery, no registration, HTTP Basic. */
+export declare const OE_OAUTH_MODE_STATIC = "static-confidential";
+/** How a static provider encodes its token-request body. Declared, never inferred: Notion's REST
+ *  token endpoint takes JSON, the RFC 6749 default is form-encoded, and sending the wrong one reads
+ *  as an authentication failure rather than as a shape error. */
+export type OeOauthBodyEncoding = "json" | "form";
+/** Fields every provider entry carries, whatever its mode. */
+interface OeOauthProviderConfigBase {
+    /** The opaque connector id (the connection's providerRef, and this map's key). */
+    readonly ref: string;
+    /** Requested scopes (space-joined onto the authorization + token requests when present). */
+    readonly scopes?: readonly string[];
+}
+/** A provider whose authorization server publishes RFC 8414 metadata and an RFC 7591 registration
+ *  endpoint — the hosted-MCP shape the adapter was built for. */
+export interface OeOauthDiscoveryProviderConfig extends OeOauthProviderConfigBase {
+    readonly mode: typeof OE_OAUTH_MODE_DISCOVERY;
+    /** The hosted-MCP server URL — discovery base + RFC 8707 resource indicator. */
+    readonly resource: string;
+    /** The `client_name` sent at Dynamic Client Registration (default "Open Everywhere"). */
+    readonly clientName?: string;
+}
+/**
+ * A provider whose client is created BY A HUMAN in the vendor's developer portal, and authenticated
+ * as a CONFIDENTIAL client with a secret (OPE-1086). Nothing here is discovered at runtime.
+ */
+export interface OeOauthStaticProviderConfig extends OeOauthProviderConfigBase {
+    readonly mode: typeof OE_OAUTH_MODE_STATIC;
+    /** Where the human is sent to consent. HTTPS only. */
+    readonly authorizationEndpoint: string;
+    /** Where the code is exchanged and the refresh happens. HTTPS only. */
+    readonly tokenEndpoint: string;
+    /** RFC 7009 revocation, when the vendor offers one. ABSENT ⇒ a purge is local-only, exactly as it
+     *  is for a discovered server that publishes no `revocation_endpoint`. Notion documents none. */
+    readonly revocationEndpoint?: string;
+    /** The client id from the vendor's developer portal. Not a secret — it rides the authorize URL. */
+    readonly clientId: string;
+    /** The credential-store REF of the client secret. NEVER the value. */
+    readonly clientSecretRef: string;
+    /** The broker the ref resolves through. Default "db" — the encrypted credential store. */
+    readonly clientSecretBroker: string;
+    /** Extra authorize-URL query parameters the vendor requires (Notion needs `owner=user`). The
+     *  parameters this adapter sets itself are RESERVED and cannot be overridden here. */
+    readonly authorizeParams?: Readonly<Record<string, string>>;
+    /** Extra token-request headers the vendor requires (Notion needs `Notion-Version`). `authorization`
+     *  is RESERVED — config may not replace the Basic credential. */
+    readonly tokenHeaders?: Readonly<Record<string, string>>;
+    /** How the token-request body is encoded. */
+    readonly bodyEncoding: OeOauthBodyEncoding;
+}
+/** One provider's OAuth target, in one of the two declared modes. */
+export type OeOauthProviderConfig = OeOauthDiscoveryProviderConfig | OeOauthStaticProviderConfig;
+/** Narrow a provider config to the static confidential-client mode. Reads the DECLARED `mode` and
+ *  nothing else — never the presence of a field. */
+export declare function isStaticConfidential(cfg: OeOauthProviderConfig): cfg is OeOauthStaticProviderConfig;
+/** Truthiness for the master flag — same off-spellings as the connector flags (default OFF). */
+export declare function oeOauthEnabled(): boolean;
+/**
+ * Load the provider config map from env, or `undefined` when no provider is configured (the
+ * "config-absent" path — combined with {@link oeOauthEnabled}, both must be truthy for the own-rolled
+ * OAuth layer to register). Explicit OE_OAUTH_CONFIG entries win over the notion shortcut.
+ */
+export declare function loadOeOauthConfig(): Map<string, OeOauthProviderConfig> | undefined;
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/agent/oe-oauth/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../agent/oe-oauth/config.ts"],"names":[],"mappings":"AAKA,8CAA8C;AAC9C,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAIrD,wFAAwF;AACxF,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAC5D,qGAAqG;AACrG,eAAO,MAAM,oBAAoB,wBAAwB,CAAC;AAE1D;;iEAEiE;AACjE,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,CAAC;AAElD,8DAA8D;AAC9D,UAAU,yBAAyB;IACjC,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;iEACiE;AACjE,MAAM,WAAW,8BAA+B,SAAQ,yBAAyB;IAC/E,QAAQ,CAAC,IAAI,EAAE,OAAO,uBAAuB,CAAC;IAC9C,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA4B,SAAQ,yBAAyB;IAC5E,QAAQ,CAAC,IAAI,EAAE,OAAO,oBAAoB,CAAC;IAC3C,sDAAsD;IACtD,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,uEAAuE;IACvE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;qGACiG;IACjG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,0FAA0F;IAC1F,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;0FACsF;IACtF,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D;qEACiE;IACjE,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;CAC5C;AAED,qEAAqE;AACrE,MAAM,MAAM,qBAAqB,GAAG,8BAA8B,GAAG,2BAA2B,CAAC;AAEjG;oDACoD;AACpD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,qBAAqB,GAAG,GAAG,IAAI,2BAA2B,CAEnG;AAED,gGAAgG;AAChG,wBAAgB,cAAc,IAAI,OAAO,CAKxC;AAoJD;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,GAAG,SAAS,CAUlF"}

package/dist/agent/oe-oauth/config.js

@@ -0,0 +1,182 @@
+// The `oe-oauth` master flag and provider config, env-sourced. 🔴 The client SECRET is a REF — a literal in
+// the JSON is REFUSED. ⚠️ A map key must equal the credential home's ref, or the click dies late, at DCR.
+/** The master arming flag env var — one string this module's readers share. */
+const OE_OAUTH_ENABLED_ENV = "OE_OAUTH_ENABLED";
+/** The JSON provider-config block env var. */
+export const OE_OAUTH_CONFIG_ENV = "OE_OAUTH_CONFIG";
+/** Convenience: a `notion` provider's resource (mcp.notion.com), without hand-writing the JSON. */
+const OE_OAUTH_NOTION_RESOURCE_ENV = "OE_OAUTH_NOTION_RESOURCE";
+/** The discovery + DCR + PKCE public-client dialect — the original and default mode. */
+export const OE_OAUTH_MODE_DISCOVERY = "discovery-dcr-pkce";
+/** The static confidential-client dialect (OPE-1086) — no discovery, no registration, HTTP Basic. */
+export const OE_OAUTH_MODE_STATIC = "static-confidential";
+/** Narrow a provider config to the static confidential-client mode. Reads the DECLARED `mode` and
+ *  nothing else — never the presence of a field. */
+export function isStaticConfidential(cfg) {
+    return cfg.mode === OE_OAUTH_MODE_STATIC;
+}
+/** Truthiness for the master flag — same off-spellings as the connector flags (default OFF). */
+export function oeOauthEnabled() {
+    const raw = process.env[OE_OAUTH_ENABLED_ENV];
+    if (raw === undefined)
+        return false;
+    const v = raw.trim().toLowerCase();
+    return v !== "" && v !== "0" && v !== "false" && v !== "off" && v !== "no";
+}
+/** Authorize-URL parameters this adapter composes itself. A config entry that named one of these
+ *  could point the consent at another client id or another redirect target, so the parser refuses
+ *  them instead of letting the last writer win. */
+const RESERVED_AUTHORIZE_PARAMS = new Set(["response_type", "client_id", "redirect_uri", "state", "scope", "code_challenge", "code_challenge_method"]);
+function requireString(v, where) {
+    if (typeof v !== "string" || v.trim() === "")
+        throw new Error(`${where} must be a non-empty string.`);
+    return v.trim();
+}
+/** An endpoint must be an absolute HTTPS URL. A client secret rides these requests in an
+ *  `Authorization` header, so `http:` would put it on the wire in the clear, and a relative value
+ *  would resolve against whatever base the runtime happened to have. */
+function requireHttpsUrl(v, where) {
+    const raw = requireString(v, where);
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new Error(`${where} must be an absolute URL (got ${JSON.stringify(raw)}).`);
+    }
+    if (parsed.protocol !== "https:") {
+        throw new Error(`${where} must use https — a confidential client presents its secret on this request, so ${JSON.stringify(parsed.protocol)} is refused.`);
+    }
+    return raw;
+}
+function optionalStringMap(v, where) {
+    if (v === undefined)
+        return undefined;
+    if (typeof v !== "object" || v === null || Array.isArray(v))
+        throw new Error(`${where} must be a JSON object of string values.`);
+    const out = {};
+    for (const [k, raw] of Object.entries(v)) {
+        if (typeof raw !== "string")
+            throw new Error(`${where}["${k}"] must be a string.`);
+        out[k] = raw;
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+function parseScopes(v) {
+    const scopes = Array.isArray(v) ? v.filter((s) => typeof s === "string") : undefined;
+    return scopes && scopes.length ? scopes : undefined;
+}
+/** Parse ONE `static-confidential` entry, with every refusal stated. */
+function parseStaticProvider(ref, rec) {
+    const where = `${OE_OAUTH_CONFIG_ENV}["${ref}"]`;
+    // 🔴 A LITERAL SECRET IS REFUSED, NOT ACCEPTED. See the module header: this block is an env var.
+    if ("clientSecret" in rec) {
+        throw new Error(`${where} carries a literal "clientSecret". The client secret must NEVER live in this config block — ` +
+            `store it in the credential store and name it with "clientSecretRef" (for example "db:notion:rest-client-secret").`);
+    }
+    const authorizeParams = optionalStringMap(rec.authorizeParams, `${where}.authorizeParams`);
+    for (const name of Object.keys(authorizeParams ?? {})) {
+        if (RESERVED_AUTHORIZE_PARAMS.has(name.toLowerCase())) {
+            throw new Error(`${where}.authorizeParams may not set "${name}" — the adapter composes that parameter itself.`);
+        }
+    }
+    const tokenHeaders = optionalStringMap(rec.tokenHeaders, `${where}.tokenHeaders`);
+    for (const name of Object.keys(tokenHeaders ?? {})) {
+        if (name.toLowerCase() === "authorization") {
+            throw new Error(`${where}.tokenHeaders may not set "${name}" — that header carries the confidential client's Basic credential.`);
+        }
+    }
+    const bodyEncoding = requireString(rec.bodyEncoding, `${where}.bodyEncoding`);
+    if (bodyEncoding !== "json" && bodyEncoding !== "form") {
+        throw new Error(`${where}.bodyEncoding must be "json" or "form" — the dialect is declared, not guessed.`);
+    }
+    const revocationEndpoint = rec.revocationEndpoint === undefined ? undefined : requireHttpsUrl(rec.revocationEndpoint, `${where}.revocationEndpoint`);
+    const scopes = parseScopes(rec.scopes);
+    return {
+        mode: OE_OAUTH_MODE_STATIC,
+        ref,
+        authorizationEndpoint: requireHttpsUrl(rec.authorizationEndpoint, `${where}.authorizationEndpoint`),
+        tokenEndpoint: requireHttpsUrl(rec.tokenEndpoint, `${where}.tokenEndpoint`),
+        ...(revocationEndpoint ? { revocationEndpoint } : {}),
+        clientId: requireString(rec.clientId, `${where}.clientId`),
+        clientSecretRef: requireString(rec.clientSecretRef, `${where}.clientSecretRef`),
+        clientSecretBroker: rec.clientSecretBroker === undefined ? "db" : requireString(rec.clientSecretBroker, `${where}.clientSecretBroker`),
+        ...(authorizeParams ? { authorizeParams } : {}),
+        ...(tokenHeaders ? { tokenHeaders } : {}),
+        bodyEncoding,
+    };
+}
+/** Parse ONE `discovery-dcr-pkce` entry. */
+function parseDiscoveryProvider(ref, rec) {
+    const where = `${OE_OAUTH_CONFIG_ENV}["${ref}"]`;
+    const resource = typeof rec.resource === "string" ? rec.resource.trim() : "";
+    if (!resource)
+        throw new Error(`${where} is missing a string "resource".`);
+    const scopes = parseScopes(rec.scopes);
+    return {
+        mode: OE_OAUTH_MODE_DISCOVERY,
+        ref,
+        resource,
+        ...(scopes ? { scopes } : {}),
+        ...(typeof rec.clientName === "string" && rec.clientName.trim() ? { clientName: rec.clientName.trim() } : {}),
+    };
+}
+function parseJsonConfig(raw) {
+    const out = new Map();
+    let obj;
+    try {
+        obj = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`${OE_OAUTH_CONFIG_ENV} is not valid JSON — expected {"<ref>":{"resource":"..."}}.`);
+    }
+    if (typeof obj !== "object" || obj === null || Array.isArray(obj)) {
+        throw new Error(`${OE_OAUTH_CONFIG_ENV} must be a JSON object mapping provider ref → one provider entry.`);
+    }
+    for (const [ref, v] of Object.entries(obj)) {
+        if (typeof v !== "object" || v === null)
+            continue;
+        const rec = v;
+        // The MODE decides how the rest is read. An absent `mode` is the discovery dialect, which is
+        // what every entry authored before OPE-1086 means. An unknown one is refused rather than
+        // defaulted: silently reading a mistyped mode as the public-client flow would drop the client
+        // secret and the Basic authentication without saying so.
+        const mode = rec.mode === undefined ? OE_OAUTH_MODE_DISCOVERY : rec.mode;
+        if (mode === OE_OAUTH_MODE_STATIC) {
+            out.set(ref, parseStaticProvider(ref, rec));
+            continue;
+        }
+        if (mode !== OE_OAUTH_MODE_DISCOVERY) {
+            throw new Error(`${OE_OAUTH_CONFIG_ENV}["${ref}"].mode ${JSON.stringify(mode)} is not a known oe-oauth mode — use "${OE_OAUTH_MODE_DISCOVERY}" or "${OE_OAUTH_MODE_STATIC}".`);
+        }
+        const parsed = parseDiscoveryProvider(ref, rec);
+        // A discovery entry that also carries confidential-client fields is a MIS-DECLARED entry, not a
+        // static one. Refusing it here is the whole "declared, not sniffed" rule in one place: the
+        // adapter will not promote an entry to the confidential mode because it looks like one.
+        for (const field of ["clientId", "clientSecretRef", "clientSecret", "tokenEndpoint", "authorizationEndpoint"]) {
+            if (field in rec) {
+                throw new Error(`${OE_OAUTH_CONFIG_ENV}["${ref}"] carries "${field}" but declares no mode, so it reads as "${OE_OAUTH_MODE_DISCOVERY}" ` +
+                    `(discovery + dynamic registration + PKCE), which ignores that field. Add "mode": "${OE_OAUTH_MODE_STATIC}" if that is what you meant.`);
+            }
+        }
+        out.set(ref, parsed);
+    }
+    return out;
+}
+/**
+ * Load the provider config map from env, or `undefined` when no provider is configured (the
+ * "config-absent" path — combined with {@link oeOauthEnabled}, both must be truthy for the own-rolled
+ * OAuth layer to register). Explicit OE_OAUTH_CONFIG entries win over the notion shortcut.
+ */
+export function loadOeOauthConfig() {
+    const providers = new Map();
+    const notionResource = process.env[OE_OAUTH_NOTION_RESOURCE_ENV]?.trim();
+    if (notionResource)
+        providers.set("notion", { mode: OE_OAUTH_MODE_DISCOVERY, ref: "notion", resource: notionResource });
+    const rawJson = process.env[OE_OAUTH_CONFIG_ENV]?.trim();
+    if (rawJson)
+        for (const [ref, cfg] of parseJsonConfig(rawJson))
+            providers.set(ref, cfg);
+    return providers.size > 0 ? providers : undefined;
+}
+//# sourceMappingURL=config.js.map

package/dist/agent/oe-oauth/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../agent/oe-oauth/config.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,0GAA0G;AAE1G,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAChD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AACrD,mGAAmG;AACnG,MAAM,4BAA4B,GAAG,0BAA0B,CAAC;AAEhE,wFAAwF;AACxF,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAC5D,qGAAqG;AACrG,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAyD1D;oDACoD;AACpD,MAAM,UAAU,oBAAoB,CAAC,GAA0B;IAC7D,OAAO,GAAG,CAAC,IAAI,KAAK,oBAAoB,CAAC;AAC3C,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC9C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC;AAC7E,CAAC;AAED;;mDAEmD;AACnD,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,CAAC,CAAC;AAEvJ,SAAS,aAAa,CAAC,CAAU,EAAE,KAAa;IAC9C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IACtG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC;AAED;;wEAEwE;AACxE,SAAS,eAAe,CAAC,CAAU,EAAE,KAAa;IAChD,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mFAAmF,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC5J,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAU,EAAE,KAAa;IAClD,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0CAA0C,CAAC,CAAC;IACjI,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,EAAE,CAAC;QACpE,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACnF,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,wEAAwE;AACxE,SAAS,mBAAmB,CAAC,GAAW,EAAE,GAA4B;IACpE,MAAM,KAAK,GAAG,GAAG,mBAAmB,KAAK,GAAG,IAAI,CAAC;IACjD,iGAAiG;IACjG,IAAI,cAAc,IAAI,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,8FAA8F;YACpG,mHAAmH,CACtH,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,iBAAiB,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,KAAK,kBAAkB,CAAC,CAAC;IAC3F,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QACtD,IAAI,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,IAAI,iDAAiD,CAAC,CAAC;QAClH,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,KAAK,eAAe,CAAC,CAAC;IAClF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;QACnD,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,IAAI,qEAAqE,CAAC,CAAC;QACnI,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,KAAK,eAAe,CAAC,CAAC;IAC9E,IAAI,YAAY,KAAK,MAAM,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gFAAgF,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACrJ,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,GAAG;QACH,qBAAqB,EAAE,eAAe,CAAC,GAAG,CAAC,qBAAqB,EAAE,GAAG,KAAK,wBAAwB,CAAC;QACnG,aAAa,EAAE,eAAe,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,KAAK,gBAAgB,CAAC;QAC3E,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,WAAW,CAAC;QAC1D,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,KAAK,kBAAkB,CAAC;QAC/E,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,KAAK,qBAAqB,CAAC;QACtI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,YAAY;KACb,CAAC;AACJ,CAAC;AAED,4CAA4C;AAC5C,SAAS,sBAAsB,CAAC,GAAW,EAAE,GAA4B;IACvE,MAAM,KAAK,GAAG,GAAG,mBAAmB,KAAK,GAAG,IAAI,CAAC;IACjD,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kCAAkC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,GAAG;QACH,QAAQ;QACR,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9G,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAiC,CAAC;IACrD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,mBAAmB,6DAA6D,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,GAAG,mBAAmB,mEAAmE,CAAC,CAAC;IAC7G,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QAClD,MAAM,GAAG,GAAG,CAA4B,CAAC;QACzC,6FAA6F;QAC7F,yFAAyF;QACzF,8FAA8F;QAC9F,yDAAyD;QACzD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACzE,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAClC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,GAAG,mBAAmB,KAAK,GAAG,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,wCAAwC,uBAAuB,SAAS,oBAAoB,IAAI,CAC9J,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChD,gGAAgG;QAChG,2FAA2F;QAC3F,wFAAwF;QACxF,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,uBAAuB,CAAC,EAAE,CAAC;YAC9G,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CACb,GAAG,mBAAmB,KAAK,GAAG,eAAe,KAAK,2CAA2C,uBAAuB,IAAI;oBACtH,qFAAqF,oBAAoB,8BAA8B,CAC1I,CAAC;YACJ,CAAC;QACH,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiC,CAAC;IAE3D,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,EAAE,IAAI,EAAE,CAAC;IACzE,IAAI,cAAc;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;IAExH,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,OAAO;QAAE,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAExF,OAAO,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC"}

package/dist/agent/oe-oauth/errors.d.ts

@@ -0,0 +1,63 @@
+/** The subject an error is about, as a log-safe label (never an opaque token). */
+export declare function subjectLabel(subject: {
+    readonly type: "user";
+    readonly id: string;
+} | {
+    readonly type: "app";
+}): string;
+/** The human has NEVER authorized this (provider, subject) — no token is stored. The connector plane
+ *  turns this into a fresh consent link. */
+export declare class OeOauthNeedsConsentError extends Error {
+    readonly code = "oe_oauth_needs_consent";
+    constructor(providerRef: string, subject: {
+        readonly type: "user";
+        readonly id: string;
+    } | {
+        readonly type: "app";
+    });
+}
+/** A previously-working authorization is dead (refresh token rejected / rotated away) — the human
+ *  must RE-authorize. Distinct from needs-consent so the audit trail can tell a first connect from a
+ *  lapsed one, but both classify as "user authorization required". */
+export declare class OeOauthNeedsReconsentError extends Error {
+    readonly code = "oe_oauth_needs_reconsent";
+    constructor(providerRef: string, subject: {
+        readonly type: "user";
+        readonly id: string;
+    } | {
+        readonly type: "app";
+    }, why: string);
+}
+/** The cross-process single-flight LOSER timed out (OPE-91): another instance holds the refresh claim
+ *  and did not release a rotated token within this caller's wait budget. TRANSIENT and RETRYABLE — a
+ *  fresh request may win the claim or find the rotated token — so it is DELIBERATELY not classified as
+ *  user-auth-required (the human need do nothing; nothing is re-consented). Carries no secret material,
+ *  only the provider ref + subject label. */
+export declare class OeOauthRefreshContendedError extends Error {
+    readonly code = "oe_oauth_refresh_contended";
+    constructor(providerRef: string, subject: {
+        readonly type: "user";
+        readonly id: string;
+    } | {
+        readonly type: "app";
+    });
+}
+/** A generic upstream OAuth failure (token endpoint / discovery / DCR returned an error). `oauthError`
+ *  is the RFC 6749 `error` code when the body carried one (e.g. "invalid_grant", "invalid_client") —
+ *  a fixed-vocabulary string, never a secret. */
+export declare class OeOauthError extends Error {
+    readonly code = "oe_oauth_error";
+    readonly oauthError?: string;
+    readonly httpStatus?: number;
+    constructor(message: string, opts?: {
+        readonly oauthError?: string;
+        readonly httpStatus?: number;
+    });
+}
+/** True iff `e` is an upstream OAuth failure whose `error` code is `invalid_grant` (the refresh token
+ *  was rejected — consumed by a rotation, revoked, or expired). Duck-typed for cross-process safety. */
+export declare function isInvalidGrant(e: unknown): boolean;
+/** The connector-plane classifier (used by UserAuthFlowProvider.isUserAuthRequired). Duck-typed on
+ *  the stable `code` strings so a cross-process instance still matches. */
+export declare function isUserAuthRequiredError(e: unknown): boolean;
+//# sourceMappingURL=errors.d.ts.map

package/dist/agent/oe-oauth/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../agent/oe-oauth/errors.ts"],"names":[],"mappings":"AAGA,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,OAAO,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,GAAG,MAAM,CAEvH;AAED;4CAC4C;AAC5C,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,4BAA4B;IACzC,YAAY,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;KAAE,EAGlH;CACF;AAED;;sEAEsE;AACtE,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,IAAI,8BAA8B;IAC3C,YAAY,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;KAAE,EAAE,GAAG,EAAE,MAAM,EAG/H;CACF;AAED;;;;6CAI6C;AAC7C,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,IAAI,gCAAgC;IAC7C,YAAY,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;KAAE,EAGlH;CACF;AAED;;iDAEiD;AACjD,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,oBAAoB;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,EAKrG;CACF;AAED;wGACwG;AACxG,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAIlD;AAED;2EAC2E;AAC3E,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAS3D"}