@open-everywhere/adapters 0.1.0

package/dist/agent/oe-oauth/token-vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-vault.js","sourceRoot":"","sources":["../../../agent/oe-oauth/token-vault.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,4GAA4G;AAG5G,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACpH,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAgE,MAAM,aAAa,CAAC;AACvI,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,2BAA2B,EAC3B,YAAY,EACZ,wBAAwB,EACxB,YAAY,EACZ,wBAAwB,EACxB,WAAW,EACX,uBAAuB,GAIxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAyCjI,SAAS,cAAc,CAAC,GAAiB;IACvC,OAAQ,GAA0B,CAAC,IAAI,KAAK,oBAAoB,CAAC;AACnE,CAAC;AAmDD,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,wBAAwB;AACvE,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,oCAAoC;AAE9E,2GAA2G;AAC3G,kGAAkG;AAClG,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD,6GAA6G;AAC7G,iGAAiG;AACjG,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AACzC,6GAA6G;AAC7G,wGAAwG;AACxG,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,2EAA2E;AAC3E,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,SAAS,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AA2BvF,SAAS,UAAU,CAAC,OAAuB;IACzC,OAAO,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;IACzE,OAAO,GAAG,UAAU,GAAG,sBAAsB,EAAE,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAqD,EAAE,IAAI,GAAqB,EAAE;IACtH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,gBAAgB,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC;IACzC,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,IAAI,sBAAsB,CAAC;IAC/D,MAAM,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,IAAI,4BAA4B,CAAC;IACjF,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,sBAAsB,CAAC;IACzD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,MAA0B,EAAE,GAAW,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAErH,MAAM,MAAM,GAAG,CAAC,WAAmB,EAAE,EAAE,CAAC,gBAAgB,WAAW,EAAE,CAAC;IACtE,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,iBAAiB,KAAK,EAAE,CAAC;IAC5D,MAAM,MAAM,GAAG,CAAC,WAAmB,EAAE,OAAuB,EAAE,EAAE,CAAC,gBAAgB,WAAW,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IAEtH,SAAS,cAAc,CAAC,WAAmB;QACzC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,WAAW,kFAAkF,CAAC,CAAC;QACxI,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,UAAU,QAAQ,CAAI,GAAW;QACpC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,wFAAwF;QACvG,CAAC;IACH,CAAC;IAED;;gGAE4F;IAC5F,SAAS,sBAAsB,CAAC,GAAoB;QAClD,OAAO,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC;IAC9C,CAAC;IAED;;0FAEsF;IACtF,KAAK,UAAU,eAAe,CAAC,WAAmB;QAChD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAkB,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QACtE,IAAI,QAAQ,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;QACnE,MAAM,GAAG,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;QACxC,0FAA0F;QAC1F,+FAA+F;QAC/F,yFAAyF;QACzF,IAAI,oBAAoB,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,WAAW,oBAAoB,oBAAoB,4CAA4C,CAAC,CAAC;QAC/J,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAkB,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YACnE,IAAI,KAAK,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC,CAAC,sCAAsC;YACjG,IAAI,KAAK,EAAE,CAAC;gBACV,yFAAyF;gBACzF,sFAAsF;gBACtF,0EAA0E;gBAC1E,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;oBACjE,IAAI,SAAS,CAAC,kBAAkB,KAAK,SAAS;wBAAE,OAAO,KAAK,CAAC,CAAC,+BAA+B;oBAC7F,MAAM,UAAU,GAAoB,EAAE,GAAG,KAAK,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE,CAAC;oBACnG,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;oBAC/F,OAAO,UAAU,CAAC;gBACpB,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,CAAC,IAAI,CAAC,iDAAiD,WAAW,gCAAgC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACvJ,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YACD,MAAM,WAAW,GAAG,aAAa,EAAE,CAAC;YACpC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,eAAe,WAAW,uFAAuF,CAAC,CAAC;YACrI,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACjE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CACvC,SAAS,CAAC,oBAAoB,EAC9B,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,iBAAiB,EAAE,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAC/G,OAAO,CACR,CAAC;YACF,MAAM,MAAM,GAAoB;gBAC9B,QAAQ;gBACR,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;gBACtD,aAAa,EAAE,SAAS,CAAC,aAAa;gBACtC,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;gBACpD,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7F,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,YAAY,EAAE,GAAG,EAAE;aACpB,CAAC;YACF,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;YAC3F,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;qGACiG;IACjG,SAAS,YAAY,CAAC,GAAgC;QACpD,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;YAChD,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,YAAY,CAAC,WAAmB;QAC7C,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvC,OAAO,GAAG,KAAK,SAAS,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IAC3G,CAAC;IAED;;;;;;OAMG;IACH,KAAK,UAAU,qBAAqB,CAAC,GAAgC;QACnE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;QAChF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,eAAe,GAAG,CAAC,GAAG,sCAAsC,GAAG,CAAC,eAAe,cAAc,GAAG,CAAC,kBAAkB,2BAA2B;gBAC5I,iCAAiC,GAAG,CAAC,eAAe,6CAA6C,CACpG,CAAC;QACJ,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,YAAY,EAAE,MAAM;YACpB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,kBAAkB,CAAC,OAAsB,EAAE,IAAY;QACpE,iGAAiG;QACjG,gGAAgG;QAChG,iEAAiE;QACjE,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,KAAK,oBAAoB,CAAC;QAC5D,IAAI,GAAG,KAAK,SAAS,IAAI,oBAAoB,CAAC,GAAG,CAAC,KAAK,aAAa,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CACb,eAAe,OAAO,CAAC,WAAW,oCAAoC,aAAa,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,sBAAsB,IAAI;gBAC/I,qEAAqE,CACxE,CAAC;QACJ,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,CAAC,WAAW,4HAA4H,CAAC,CAAC;YAClL,CAAC;YACD,OAAO,wBAAwB,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,MAAM,qBAAqB,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;QAChJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,CAAC,WAAW,2EAA2E,CAAC,CAAC;QACtJ,OAAO,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IAC1L,CAAC;IAED,SAAS,SAAS,CAAC,GAAgB;QACjC,OAAO,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,EAAE,IAAI,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;IACtE,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,WAAmB,EAAE,OAAuB,EAAE,GAAuB,EAAE,YAAqB;QACpH,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,IAAI,YAAY,CAAC,CAAC,qDAAqD;QACxG,MAAM,MAAM,GAAgB;YAC1B,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,UAAU,EAAE,GAAG,EAAE;SAClB,CAAC;QACF,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QACpG,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,MAAM,CAAC,WAAmB,EAAE,OAAuB;QAChE,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;YACpC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAc,GAAG,CAAC,CAAC;YAC7C,IAAI,GAAG,EAAE,CAAC;gBACR,4FAA4F;gBAC5F,yFAAyF;gBACzF,wFAAwF;gBACxF,+EAA+E;gBAC/E,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACvC,MAAM,MAAM,GAAwB,GAAG,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAkB,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;gBAChJ,sFAAsF;gBACtF,wDAAwD;gBACxD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,WAAW,CAAC;gBAClD,IAAI,MAAM,EAAE,kBAAkB,IAAI,KAAK,EAAE,CAAC;oBACxC,IAAI,CAAC;wBACH,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAE,eAAyB,CAAC,CAAC,CAAE,cAAwB,CAAC;wBACvF,IAAI,GAAG,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;4BACrC,MAAM,uBAAuB,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,MAAM,qBAAqB,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;wBACtI,CAAC;6BAAM,CAAC;4BACN,MAAM,WAAW,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;wBACnH,CAAC;oBACH,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,oFAAoF;wBACpF,wFAAwF;wBACxF,+DAA+D;wBAC/D,OAAO,CAAC,IAAI,CAAC,qDAAqD,WAAW,+BAA+B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBAC5J,CAAC;gBACH,CAAC;YACH,CAAC;YACD,+FAA+F;YAC/F,sFAAsF;YACtF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,mBAAmB;QAChC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACpD,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,0FAA0F;YAC1F,4FAA4F;YAC5F,6FAA6F;YAC7F,4FAA4F;YAC5F,6FAA6F;YAC7F,8BAA8B;YAC9B,IAAI,GAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,QAAQ,CAAgB,GAAG,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjF,UAAU,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;YACD,IAAI,GAAG,EAAE,IAAI,GAAG,CAAC,SAAS,GAAG,gBAAgB,EAAE,CAAC;gBAC9C,IAAI,EAAE,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,UAAU;QAEV,wEAAwE;QACxE,MAAM;QAEN,oFAAoF;QACpF,mBAAmB;QAEnB;;;WAGG;QACH,KAAK,CAAC,SAAS,CAAC,OAAuB;YACrC,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,IAAI,SAAkB,CAAC;YACvB,KAAK,MAAM,WAAW,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC3C,IAAI,CAAC;oBACH,IAAI,MAAM,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC;wBAAE,MAAM,EAAE,CAAC;gBACnD,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,QAAQ,EAAE,CAAC;oBACX,SAAS,GAAG,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;YACD,IAAI,QAAQ,GAAG,CAAC,IAAI,MAAM,KAAK,CAAC,IAAI,QAAQ,KAAK,SAAS,CAAC,IAAI;gBAAE,MAAM,SAAS,CAAC;YACjF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED;;;;;WAKG;QACH,KAAK,CAAC,QAAQ,CAAC,WAAmB,EAAE,OAAuB;YACzD,OAAO,CAAC,MAAM,QAAQ,CAAc,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;QAC9E,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,kBAAkB,CACtB,WAAmB,EACnB,OAAuB,EACvB,OAAsE;YAEtE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;YAC/C,MAAM,WAAW,GAAG,aAAa,EAAE,CAAC;YACpC,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,WAAW,+DAA+D,CAAC,CAAC;YAC7H,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,4FAA4F;YAC5F,mFAAmF;YACnF,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAClF,MAAM,OAAO,GAAkB;gBAC7B,WAAW;gBACX,OAAO;gBACP,YAAY,EAAE,IAAI,CAAC,QAAQ;gBAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC5F,WAAW;gBACX,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,SAAS,EAAE,GAAG,EAAE;gBAChB,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,UAAU,CAAC;gBACtD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzD,CAAC;YACF,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;YACvF,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC;gBAChC,CAAC,CAAC,2BAA2B,CAAC;oBAC1B,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;oBACnD,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,WAAW;oBACX,KAAK;oBACL,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnD,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3E,CAAC;gBACJ,CAAC,CAAC,qBAAqB,CAAC;oBACpB,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;oBACnD,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,WAAW;oBACX,KAAK;oBACL,aAAa,EAAE,IAAI,CAAC,SAAS;oBAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpD,CAAC,CAAC;YACP,IAAI,CAAC;gBACH,MAAM,mBAAmB,EAAE,CAAC;YAC9B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,sFAAsF,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACnJ,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,CAAC;QACjB,CAAC;QAED;;;;;;;WAOG;QACH,KAAK,CAAC,qBAAqB,CAAC,KAAa,EAAE,IAAY;YACrD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAgB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACxE,IAAI,OAAO,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC1E,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC9E,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACpD,kGAAkG;YAClG,gGAAgG;YAChG,qEAAqE;YACrE,kGAAkG;YAClG,gGAAgG;YAChG,iGAAiG;YACjG,6FAA6F;YAC7F,kGAAkG;YAClG,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAc,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;YACrG,MAAM,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC5D,mFAAmF;YACnF,6FAA6F;YAC7F,qFAAqF;YACrF,0FAA0F;YAC1F,2FAA2F;YAC3F,2DAA2D;YAC3D,MAAM,KAAK,CAAC,KAAK,CACf,OAAO,CAAC,KAAK,CAAC,EACd,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EACpF,EAAE,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CACnC,CAAC;YACF,+FAA+F;YAC/F,2FAA2F;YAC3F,2FAA2F;YAC3F,iEAAiE;YACjE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3I,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,cAAc,CAAC,WAAmB,EAAE,OAAuB;YAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAc,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,wBAAwB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACpE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC,WAAW,CAAC;YAE9C,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;gBACpC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAc,GAAG,CAAC,CAAC;gBAC7C,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,wBAAwB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;gBACnE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;oBAAE,OAAO,GAAG,CAAC,WAAW,CAAC,CAAC,yCAAyC;gBACtF,IAAI,CAAC,GAAG,CAAC,YAAY;oBAAE,MAAM,IAAI,0BAA0B,CAAC,WAAW,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC;gBAC7G,MAAM,gBAAgB,GAAG,GAAG,CAAC,YAAY,CAAC;gBAE1C,6FAA6F;gBAC7F,+FAA+F;gBAC/F,oGAAoG;gBACpG,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,kBAAkB,CAAC,CAAC;gBACvE,IAAI,GAAG,EAAE,CAAC;oBACR,IAAI,CAAC;wBACH,sFAAsF;wBACtF,iFAAiF;wBACjF,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;wBACvC,IAAI,GAAuB,CAAC;wBAC5B,IAAI,CAAC;4BACH,mFAAmF;4BACnF,mEAAmE;4BACnE,IAAI,GAAG,KAAK,SAAS,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;gCACnD,GAAG,GAAG,MAAM,wBAAwB,CAClC,GAAG,CAAC,aAAa,EACjB,EAAE,YAAY,EAAE,gBAAgB,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACjF,MAAM,qBAAqB,CAAC,GAAG,CAAC,EAChC,OAAO,CACR,CAAC;4BACJ,CAAC;iCAAM,CAAC;gCACN,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;gCAClD,GAAG,GAAG,MAAM,YAAY,CACtB,MAAM,CAAC,aAAa,EACpB,EAAE,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAC7I,OAAO,CACR,CAAC;4BACJ,CAAC;wBACH,CAAC;wBAAC,OAAO,CAAC,EAAE,CAAC;4BACX,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;gCACtB,uFAAuF;gCACvF,uFAAuF;gCACvF,iDAAiD;gCACjD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAc,GAAG,CAAC,CAAC;gCAC9C,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,KAAK,GAAG,CAAC,YAAY;oCAAE,OAAO,IAAI,CAAC,WAAW,CAAC;gCAChG,MAAM,IAAI,0BAA0B,CAAC,WAAW,EAAE,OAAO,EAAE,wCAAwC,CAAC,CAAC;4BACvG,CAAC;4BACD,MAAM,CAAC,CAAC;wBACV,CAAC;wBACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;wBAC7E,OAAO,MAAM,CAAC,WAAW,CAAC;oBAC5B,CAAC;4BAAS,CAAC;wBACT,MAAM,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;oBACzC,CAAC;gBACH,CAAC;gBAED,0FAA0F;gBAC1F,4FAA4F;gBAC5F,0FAA0F;gBAC1F,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,oBAAoB,CAAC;gBAC9C,SAAS,CAAC;oBACR,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAc,GAAG,CAAC,CAAC;oBAC9C,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;wBAAE,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,mCAAmC;oBAC1F,IAAI,GAAG,EAAE,IAAI,QAAQ;wBAAE,MAAM,IAAI,4BAA4B,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;oBACpF,MAAM,KAAK,CAAC,aAAa,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/agent/oe-oauth/user-auth-flow.d.ts

@@ -0,0 +1,10 @@
+import type { UserAuthFlowProvider, OeOauthCallbackCompleter, CredentialPurgeHook } from "@open-everywhere/core/agent/adapter-api.js";
+import type { OeOauthProviderConfig } from "./config.js";
+import { type OeOauthVaultDeps } from "./token-vault.js";
+/** Build the own-rolled provider plus the callback completer, sharing one token vault. `deps` is the DI seam. */
+export declare function makeOeOauth(providers: ReadonlyMap<string, OeOauthProviderConfig>, deps?: OeOauthVaultDeps): {
+    readonly flow: UserAuthFlowProvider;
+    readonly completer: OeOauthCallbackCompleter;
+    readonly purge: CredentialPurgeHook;
+};
+//# sourceMappingURL=user-auth-flow.d.ts.map

package/dist/agent/oe-oauth/user-auth-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-auth-flow.d.ts","sourceRoot":"","sources":["../../../agent/oe-oauth/user-auth-flow.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAwC,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AAC5K,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAyB,KAAK,gBAAgB,EAAuB,MAAM,kBAAkB,CAAC;AAQrG,iHAAiH;AACjH,wBAAgB,WAAW,CACzB,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC,EACrD,IAAI,GAAE,gBAAqB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,CAyD5H"}

package/dist/agent/oe-oauth/user-auth-flow.js

@@ -0,0 +1,66 @@
+// The own-rolled OAuth USER-AUTH-FLOW adapter — core's vendor-neutral port over our own client and token
+// vault. The callback completer shares ONE vault instance, so the single-flight lock covers both paths.
+import { makeOeOauthTokenVault } from "./token-vault.js";
+import { isUserAuthRequiredError } from "./errors.js";
+/** Normalise the port's UserAuthSubject into the vault's subject shape. */
+function toVaultSubject(subject) {
+    return subject.type === "app" ? { type: "app" } : { type: "user", id: subject.id };
+}
+/** Build the own-rolled provider plus the callback completer, sharing one token vault. `deps` is the DI seam. */
+export function makeOeOauth(providers, deps = {}) {
+    const vault = makeOeOauthTokenVault(providers, deps);
+    const flow = {
+        async mintServiceToken(providerRef, _getTokenOptions) {
+            return { token: await vault.accessTokenFor(providerRef, { type: "app" }) };
+        },
+        async mintUserToken(providerRef, params) {
+            return { token: await vault.accessTokenFor(providerRef, { type: "user", id: params.subject.id }) };
+        },
+        async startAuthorization(providerRef, params, options) {
+            // `consent` (OPE-1619) rides through UNREAD — it is core's opaque record of the request this
+            // detour interrupted, and the vault stores it beside the pending row and returns it at the
+            // callback. This adapter never inspects it.
+            return vault.startAuthorization(providerRef, toVaultSubject(params.subject), {
+                ...(options.expiresInMs ? { expiresInMs: options.expiresInMs } : {}),
+                ...(options.consent ? { consent: options.consent } : {}),
+            });
+        },
+        isUserAuthRequired(e) {
+            return isUserAuthRequiredError(e);
+        },
+        async environmentClaim() {
+            return "self";
+        },
+        async hasFreshGrant(providerRef, subject) {
+            // (OPE-93) Existence check of the user's token vault row — the mid-turn self-heal signal (the real
+            // mint refreshes an expired token, so ROW EXISTENCE is what matters). Fail-soft: a vault-read
+            // failure reports `false`, never throws, so a probe error leaves the memo's short-circuit standing.
+            try {
+                return await vault.hasToken(providerRef, toVaultSubject(subject));
+            }
+            catch {
+                return false;
+            }
+        },
+    };
+    const completer = async ({ state, code }) => {
+        try {
+            // `subject` and `rebound` ride out UNREAD by this adapter: core's callback route audits them as
+            // `connector.credential_bound` (OPE-1937). No token material is on this path, by construction.
+            const { providerRef, subject, rebound, consent } = await vault.completeAuthorization(state, code);
+            return { ok: true, connectionName: providerRef, subject, rebound, ...(consent ? { consent } : {}) };
+        }
+        catch (err) {
+            return { ok: false, detail: err instanceof Error ? err.message : String(err) };
+        }
+    };
+    // The credential-purge hook, sharing the mint methods' vault: whatever this adapter can MINT for a subject it
+    // can also DESTROY. There is no app-subject purge — the service identity is not a person.
+    const purge = {
+        async purgeSubject(subjectId) {
+            return vault.forgetAll({ type: "user", id: subjectId });
+        },
+    };
+    return { flow, completer, purge };
+}
+//# sourceMappingURL=user-auth-flow.js.map

package/dist/agent/oe-oauth/user-auth-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-auth-flow.js","sourceRoot":"","sources":["../../../agent/oe-oauth/user-auth-flow.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,wGAAwG;AAKxG,OAAO,EAAE,qBAAqB,EAA8C,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEtD,2EAA2E;AAC3E,SAAS,cAAc,CAAC,OAAwB;IAC9C,OAAO,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;AACrF,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,WAAW,CACzB,SAAqD,EACrD,IAAI,GAAqB,EAAE;IAE3B,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAErD,MAAM,IAAI,GAAyB;QACjC,KAAK,CAAC,gBAAgB,CAAC,WAAmB,EAAE,gBAAyB;YACnE,OAAO,EAAE,KAAK,EAAE,MAAM,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,WAAmB,EAAE,MAA2B;YAClE,OAAO,EAAE,KAAK,EAAE,MAAM,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACrG,CAAC;QACD,KAAK,CAAC,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO;YACnD,6FAA6F;YAC7F,2FAA2F;YAC3F,4CAA4C;YAC5C,OAAO,KAAK,CAAC,kBAAkB,CAAC,WAAW,EAAE,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;gBAC3E,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzD,CAAC,CAAC;QACL,CAAC;QACD,kBAAkB,CAAC,CAAU;YAC3B,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,gBAAgB;YACpB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,WAAmB,EAAE,OAAwB;YAC/D,mGAAmG;YACnG,8FAA8F;YAC9F,oGAAoG;YACpG,IAAI,CAAC;gBACH,OAAO,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;YACpE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;IAEF,MAAM,SAAS,GAA6B,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;QACpE,IAAI,CAAC;YACH,gGAAgG;YAChG,+FAA+F;YAC/F,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAClG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACtG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACjF,CAAC;IACH,CAAC,CAAC;IAEF,8GAA8G;IAC9G,0FAA0F;IAC1F,MAAM,KAAK,GAAwB;QACjC,KAAK,CAAC,YAAY,CAAC,SAAiB;YAClC,OAAO,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1D,CAAC;KACF,CAAC;IAEF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC"}

package/dist/agent/postgres/neon.d.ts

@@ -0,0 +1,29 @@
+import { type PgClient } from "@open-everywhere/core/agent/adapter-api.js";
+/**
+ * Construct a Neon serverless client, initialise the schema, and register it as both the memory and the
+ * operational Postgres backend. Call once at startup, before the first session.
+ */
+export declare function registerNeon(connectionString?: string | undefined): Promise<PgClient>;
+/** The subset of @neondatabase/serverless's `neonConfig` we touch for the local-wsproxy recipe.
+ *  `wsProxy` maps a target (host, port) to the proxy's `<host:port>/v1?address=…` URL. */
+interface NeonConfig {
+    wsProxy?: (host: string, port: number) => string;
+    useSecureWebSocket?: boolean;
+    pipelineTLS?: boolean;
+    pipelineConnect?: boolean | "password";
+    webSocketConstructor?: unknown;
+}
+/**
+ * Point the driver at a local `wsproxy` so it reaches a plain Postgres over the compose network. NO-OP unless
+ * OE_NEON_WS_PROXY is set. Insecure WS is correct for a same-network local proxy ONLY, never a remote one.
+ */
+export declare function configureLocalWsProxy(neonConfig: NeonConfig): void;
+/**
+ * The Pool is a long-lived EventEmitter, and an idle connection's socket can error during teardown. With no
+ * 'error' listener Node kills the process, even after the request returned 200 — this listener is the fix.
+ */
+export declare function attachPoolErrorHandler(pool: {
+    on?(event: "error", listener: (err: unknown) => void): unknown;
+}): void;
+export {};
+//# sourceMappingURL=neon.d.ts.map

package/dist/agent/postgres/neon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"neon.d.ts","sourceRoot":"","sources":["../../../agent/postgres/neon.ts"],"names":[],"mappings":"AAGA,OAAO,EAIL,KAAK,QAAQ,EAEd,MAAM,4CAA4C,CAAC;AAEpD;;;GAGG;AACH,wBAAsB,YAAY,CAAC,gBAAgB,qBAA2B,GAAG,OAAO,CAAC,QAAQ,CAAC,CAiDjG;AASD;0FAC0F;AAC1F,UAAU,UAAU;IAClB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACjD,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IACvC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAUlE;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAAE,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAA;CAAE,GAAG,IAAI,CAIrH"}

package/dist/agent/postgres/neon.js

@@ -0,0 +1,76 @@
+// Neon (serverless Postgres) adapter — where the driver is constructed and handed to core's register seams,
+// so core stays vendor-SDK-free. LIVE-ONLY: it needs a real DATABASE_URL, and the driver imports dynamically.
+import { registerPostgres, registerOperationalPostgres, initPostgresSchema, initOperationalSchema, } from "@open-everywhere/core/agent/adapter-api.js";
+/**
+ * Construct a Neon serverless client, initialise the schema, and register it as both the memory and the
+ * operational Postgres backend. Call once at startup, before the first session.
+ */
+export async function registerNeon(connectionString = process.env.DATABASE_URL) {
+    if (!connectionString) {
+        throw new Error("registerNeon: no connection string (set DATABASE_URL)");
+    }
+    // 🔴 This specifier is DELIBERATELY statically analyzable: hosted functions ship no node_modules, so the
+    // driver must be inlined by static resolution. A dynamic form killed every prod request (2026-08-11).
+    const mod = (await import("@neondatabase/serverless"));
+    // Local dev only: the serverless driver speaks WebSockets/HTTPS, not raw TCP, so a plain Postgres
+    // (the docker-compose postgres:16 sidecar) is reached through a `wsproxy` in front of it. OFF unless
+    // OE_NEON_WS_PROXY is set ⇒ the hosted Neon path is byte-identical. See docker-compose.yml.
+    configureLocalWsProxy(mod.neonConfig);
+    const { Pool } = mod;
+    const pool = new Pool({ connectionString });
+    attachPoolErrorHandler(pool);
+    const client = {
+        query: (text, params) => pool.query(text, params),
+        // The connection-pinning seam (OPE-1636). The audit chain's append needs `BEGIN … COMMIT`
+        // plus a transaction-scoped advisory lock on ONE connection; without this the hosted
+        // runtime's separate functions fork the chain. Every exit path releases, so a throwing
+        // callback can never leak a connection out of the pool.
+        withConnection: async (fn) => {
+            const conn = await pool.connect();
+            try {
+                const result = await fn({ query: (text, params) => conn.query(text, params) });
+                conn.release();
+                return result;
+            }
+            catch (err) {
+                // 🔴 `release(err)` DESTROYS the connection; a bare `release()` returns it to the pool
+                // whatever state it is in. A failed append can leave an open transaction holding the
+                // org's advisory lock, and that connection would then block every other appender for
+                // that org until it happened to be reused.
+                conn.release(err);
+                throw err;
+            }
+        },
+    };
+    await initPostgresSchema(client);
+    await initOperationalSchema(client);
+    registerPostgres(client);
+    registerOperationalPostgres(client);
+    return client;
+}
+/**
+ * Point the driver at a local `wsproxy` so it reaches a plain Postgres over the compose network. NO-OP unless
+ * OE_NEON_WS_PROXY is set. Insecure WS is correct for a same-network local proxy ONLY, never a remote one.
+ */
+export function configureLocalWsProxy(neonConfig) {
+    const proxy = process.env.OE_NEON_WS_PROXY?.trim();
+    if (!proxy)
+        return;
+    neonConfig.wsProxy = (host, port) => `${proxy}/v1?address=${host}:${port}`;
+    neonConfig.useSecureWebSocket = false;
+    neonConfig.pipelineTLS = false;
+    neonConfig.pipelineConnect = false;
+    if (!neonConfig.webSocketConstructor && typeof globalThis.WebSocket !== "undefined") {
+        neonConfig.webSocketConstructor = globalThis.WebSocket;
+    }
+}
+/**
+ * The Pool is a long-lived EventEmitter, and an idle connection's socket can error during teardown. With no
+ * 'error' listener Node kills the process, even after the request returned 200 — this listener is the fix.
+ */
+export function attachPoolErrorHandler(pool) {
+    pool.on?.("error", (err) => {
+        console.warn(`[open-everywhere:neon] pool error on an idle connection (ignored, no query affected): ${err instanceof Error ? err.message : String(err)}`);
+    });
+}
+//# sourceMappingURL=neon.js.map

package/dist/agent/postgres/neon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"neon.js","sourceRoot":"","sources":["../../../agent/postgres/neon.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,8GAA8G;AAE9G,OAAO,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,kBAAkB,EAElB,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AAEpD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY;IAC5E,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,yGAAyG;IACzG,sGAAsG;IACtG,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAGpD,CAAC;IACF,kGAAkG;IAClG,qGAAqG;IACrG,4FAA4F;IAC5F,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;IACrB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,CAIzC,CAAC;IACF,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAa;QACvB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;QACjD,0FAA0F;QAC1F,qFAAqF;QACrF,uFAAuF;QACvF,wDAAwD;QACxD,cAAc,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC/E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACf,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uFAAuF;gBACvF,qFAAqF;gBACrF,qFAAqF;gBACrF,2CAA2C;gBAC3C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAClB,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;KACF,CAAC;IAEF,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACpC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC;AAChB,CAAC;AAmBD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAsB;IAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,UAAU,CAAC,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,KAAK,eAAe,IAAI,IAAI,IAAI,EAAE,CAAC;IAC3E,UAAU,CAAC,kBAAkB,GAAG,KAAK,CAAC;IACtC,UAAU,CAAC,WAAW,GAAG,KAAK,CAAC;IAC/B,UAAU,CAAC,eAAe,GAAG,KAAK,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,oBAAoB,IAAI,OAAQ,UAAsC,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;QACjH,UAAU,CAAC,oBAAoB,GAAI,UAAqC,CAAC,SAAS,CAAC;IACrF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAwE;IAC7G,IAAI,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACzB,OAAO,CAAC,IAAI,CAAC,yFAAyF,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5J,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/agent/sandbox/backend-stop.d.ts

@@ -0,0 +1,98 @@
+/** One sandbox as its backend reports it — `createdAt` (epoch ms) is the one honestly-observable
+ *  timing reference (see vercel-lifecycle.ts's file-level comment on delta billing). */
+export interface SandboxListing {
+    readonly name: string;
+    readonly status: string;
+    readonly createdAt: number;
+}
+/**
+ * The backend-specific half of the turn-end stop. One implementation per sandbox backend OE can
+ * select; `resolveSandboxStopper()` picks the one matching the running deployment.
+ *
+ * Injected into `stopSessionSandboxes` so the decision logic is testable without credentials, a
+ * docker daemon, or a platform.
+ */
+export interface SandboxStopper {
+    /** Backend id, matching `OE_SANDBOX_BACKEND` / eve's backend name. For logs and tests. */
+    readonly backend: string;
+    /** Does this backend bill sandbox runtime by wall clock? Only then is a stop priced. */
+    readonly metered: boolean;
+    /** One line naming who owns the stop on this deployment, logged once per process. */
+    readonly ownership: string;
+    /** Sandboxes already tagged to this session. MUST NOT provision — an empty list is the
+     *  correct answer for a backend that cannot look without creating. */
+    list(sessionId: string): Promise<SandboxListing[]>;
+    /** Stop the compute, preserving whatever the backend needs to reopen the session. */
+    stop(name: string): Promise<void>;
+    /**
+     * Re-tag an existing sandbox onto `sessionId`. Returns `true` when the backend re-tagged, and
+     * `false` when this backend never re-tags on attach — in which case there is nothing to undo
+     * and the caller must not treat the `false` as a failure. See the OPE-447 note on the Vercel
+     * implementation for why this exists at all.
+     */
+    retag(name: string, sessionId: string): Promise<boolean>;
+}
+/** Only a booted (or booting) sandbox is worth stopping; stopped/snapshotting are already done.
+ *  Vercel's status vocabulary is the shared one — every other stopper normalises onto it. */
+export declare function shouldStop(status: string): boolean;
+/**
+ * `Sandbox.list({tags})` is the zero-side-effect peek this hook depends on, and `resume: false` keeps a
+ * stopped sandbox stopped. RETAG: `update` REPLACES the tag map, so the restore merges and overrides one key.
+ */
+/**
+ * The raw Vercel SDK surface `createVercelList` needs — injectable so the OPE-722 augmentation
+ * below (falling back to a direct `Sandbox.get` for a name THIS process recorded opening) is
+ * unit-testable without live credentials. `defaultVercelListSdk` is the real `@vercel/sandbox`
+ * calls; tests inject a fake to prove the merge deterministically.
+ */
+export interface VercelListSdk {
+    /** The tag-index query. OPE-722 reported this returning empty immediately after
+     *  `Sandbox.create`, attributed to eventual consistency in the tag index; see the OPE-722
+     *  doc comment on `createVercelList` below for what a later re-probe actually found. */
+    listByTag(sessionId: string): Promise<SandboxListing[]>;
+    /** A primary-key lookup by name. `undefined` when the sandbox genuinely does not exist (or the
+     *  lookup failed) — the caller treats that exactly like "not found by the tag index either". */
+    getByName(name: string): Promise<SandboxListing | undefined>;
+}
+/**
+ * Augment the tag-index result with a direct `Sandbox.get` for any name THIS process recorded this turn
+ * (created-sandbox-registry.ts) — a primary-key read, so the stop never depends on tag-index freshness.
+ */
+export declare function createVercelList(sdk?: VercelListSdk): SandboxStopper["list"];
+export declare const vercelStopper: SandboxStopper;
+/**
+ * eve labels every session container it CREATES with its diagnostic tags, prefixed
+ * `eve.sandbox.tag.` (its docker binding's `startDockerContainer`). That label is the only
+ * zero-side-effect handle on a running session container, so `docker ps` by label is the peek.
+ *
+ * The container is long-lived by construction: eve starts it with a `sleep 2147483647` keepalive
+ * and only ever stops it on `handle.stop()` or server shutdown. Without a turn-end stop a
+ * self-hosted box therefore accumulates one running container per conversation, indefinitely.
+ * `docker stop` (never `rm`) is the right verb: eve's `create` restarts a stopped container by
+ * name and the filesystem survives, which is the same stop/resume shape Vercel snapshots give.
+ */
+export declare const DOCKER_SESSION_LABEL = "eve.sandbox.tag.sessionId";
+/** The docker CLI as this module needs it. Injected in tests; the default shells out exactly as
+ *  eve does, honouring `EVE_DOCKER_PATH` so a Podman-shimmed deployment keeps working. */
+export interface DockerRunner {
+    (args: readonly string[]): Promise<string>;
+}
+/** Docker's own state vocabulary, mapped onto the shared one `shouldStop` reads. Anything else
+ *  (exited, dead, removing, paused) passes through unchanged and is left alone. */
+export declare function dockerStatusToSandboxStatus(state: string): string;
+export declare function createDockerStopper(run?: DockerRunner): SandboxStopper;
+/**
+ * The just-bash backend is an in-process interpreter — no VM, no container, no metered runtime — so this
+ * stopper is deliberately inert. It names itself in the log rather than swallowing an error.
+ */
+export declare const justBashStopper: SandboxStopper;
+/**
+ * The ONE "who stops the sandbox on this deployment" decision. It reads the SAME two switches the
+ * app reads to BUILD the backend — `onVercel()` and `resolveSelfHostBackendKind()` — so the
+ * backend that runs and the backend that stops can never disagree. An unknown
+ * `OE_SANDBOX_BACKEND` throws here exactly as it throws at boot; the hook's fail-soft catch logs
+ * it rather than failing the turn.
+ */
+export declare function resolveSandboxStopper(): SandboxStopper;
+export declare function setSandboxStopperForTest(stopper: SandboxStopper | undefined): void;
+//# sourceMappingURL=backend-stop.d.ts.map

package/dist/agent/sandbox/backend-stop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-stop.d.ts","sourceRoot":"","sources":["../../../agent/sandbox/backend-stop.ts"],"names":[],"mappings":"AAQA;wFACwF;AACxF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,0FAA0F;IAC1F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;0EACsE;IACtE,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACnD,qFAAqF;IACrF,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC;;;;;OAKG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1D;AAED;6FAC6F;AAC7F,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAElD;AAID;;;GAGG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B;;4FAEwF;IACxF,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACxD;oGACgG;IAChG,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;CAC9D;AAqBD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,aAAoC,GAAG,cAAc,CAAC,MAAM,CAAC,CAUlG;AAED,eAAO,MAAM,aAAa,EAAE,cAc3B,CAAC;AAIF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAEhE;0FAC0F;AAC1F,MAAM,WAAW,YAAY;IAC3B,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5C;AAWD;mFACmF;AACnF,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIjE;AAOD,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,YAAkC,GAAG,cAAc,CA+C3F;AAID;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,cAc7B,CAAC;AAIF;;;;;;GAMG;AACH,wBAAgB,qBAAqB,IAAI,cAAc,CAItD;AAKD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,cAAc,GAAG,SAAS,GAAG,IAAI,CAElF"}

package/dist/agent/sandbox/backend-stop.js

@@ -0,0 +1,188 @@
+// WHO OWNS THE TURN-END SANDBOX STOP — one implementation per sandbox backend. Each is a ZERO-SIDE-EFFECT
+// peek first: eve's own `stop()` provisions, and a turn-end hook must never create a sandbox to stop one.
+import { Sandbox } from "@vercel/sandbox";
+import { execFile } from "node:child_process";
+import { onVercel, resolveSelfHostBackendKind } from "@open-everywhere/core/agent/adapter-api.js";
+import { getRecordedSandboxName } from "./created-sandbox-registry.js";
+/** Only a booted (or booting) sandbox is worth stopping; stopped/snapshotting are already done.
+ *  Vercel's status vocabulary is the shared one — every other stopper normalises onto it. */
+export function shouldStop(status) {
+    return status === "running" || status === "pending";
+}
+const defaultVercelListSdk = {
+    async listByTag(sessionId) {
+        const result = await Sandbox.list({ tags: { sessionId } });
+        const out = [];
+        for await (const s of result)
+            out.push({ name: s.name, status: s.status, createdAt: s.createdAt });
+        return out;
+    },
+    async getByName(name) {
+        try {
+            const s = await Sandbox.get({ name, resume: false });
+            // Sandbox.get()'s `.createdAt` is a Date; Sandbox.list()'s iterated items report a number
+            // (epoch ms) for the same field — normalise onto the number SandboxListing already uses.
+            return { name: s.name, status: s.status, createdAt: s.createdAt.getTime() };
+        }
+        catch {
+            return undefined;
+        }
+    },
+};
+/**
+ * Augment the tag-index result with a direct `Sandbox.get` for any name THIS process recorded this turn
+ * (created-sandbox-registry.ts) — a primary-key read, so the stop never depends on tag-index freshness.
+ */
+export function createVercelList(sdk = defaultVercelListSdk) {
+    return async (sessionId) => {
+        const out = await sdk.listByTag(sessionId);
+        const recordedName = getRecordedSandboxName(sessionId);
+        if (recordedName !== undefined && !out.some((s) => s.name === recordedName)) {
+            const direct = await sdk.getByName(recordedName);
+            if (direct !== undefined)
+                out.push(direct);
+        }
+        return out;
+    };
+}
+export const vercelStopper = {
+    backend: "vercel",
+    metered: true,
+    ownership: "stop owner = vercel — @vercel/sandbox stops the session VM at turn end, and its runtime seconds are priced into the spend ledger",
+    list: createVercelList(),
+    async stop(name) {
+        await (await Sandbox.get({ name, resume: false })).stop();
+    },
+    async retag(name, sessionId) {
+        const sandbox = await Sandbox.get({ name, resume: false });
+        await sandbox.update({ tags: { ...(sandbox.tags ?? {}), sessionId } });
+        return true;
+    },
+};
+// ── docker ────────────────────────────────────────────────────────────────────────────────────
+/**
+ * eve labels every session container it CREATES with its diagnostic tags, prefixed
+ * `eve.sandbox.tag.` (its docker binding's `startDockerContainer`). That label is the only
+ * zero-side-effect handle on a running session container, so `docker ps` by label is the peek.
+ *
+ * The container is long-lived by construction: eve starts it with a `sleep 2147483647` keepalive
+ * and only ever stops it on `handle.stop()` or server shutdown. Without a turn-end stop a
+ * self-hosted box therefore accumulates one running container per conversation, indefinitely.
+ * `docker stop` (never `rm`) is the right verb: eve's `create` restarts a stopped container by
+ * name and the filesystem survives, which is the same stop/resume shape Vercel snapshots give.
+ */
+export const DOCKER_SESSION_LABEL = "eve.sandbox.tag.sessionId";
+const defaultDockerRunner = async (args) => await new Promise((resolve, reject) => {
+    const bin = process.env.EVE_DOCKER_PATH?.trim() || "docker";
+    execFile(bin, [...args], { encoding: "utf8", maxBuffer: 8 * 1024 * 1024 }, (err, stdout) => {
+        if (err)
+            reject(err);
+        else
+            resolve(stdout);
+    });
+});
+/** Docker's own state vocabulary, mapped onto the shared one `shouldStop` reads. Anything else
+ *  (exited, dead, removing, paused) passes through unchanged and is left alone. */
+export function dockerStatusToSandboxStatus(state) {
+    if (state === "running")
+        return "running";
+    if (state === "created" || state === "restarting")
+        return "pending";
+    return state;
+}
+/** `docker inspect` reports `0001-01-01T00:00:00Z` for a container that never started. Anything
+ *  before this floor is not a real start time — report "now" so the window is 0, never a
+ *  two-thousand-year one. */
+const DOCKER_START_TIME_FLOOR_MS = Date.UTC(2000, 0, 1);
+export function createDockerStopper(run = defaultDockerRunner) {
+    return {
+        backend: "docker",
+        metered: false,
+        ownership: "stop owner = docker — eve's session containers are stopped through the docker CLI at turn end. Runtime is NOT metered per second on this backend, so no spend-ledger row is written for it",
+        async list(sessionId) {
+            const names = (await run(["ps", "-a", "--no-trunc", "--filter", `label=${DOCKER_SESSION_LABEL}=${sessionId}`, "--format", "{{.Names}}"]))
+                .split("\n")
+                .map((l) => l.trim())
+                .filter((l) => l.length > 0);
+            if (names.length === 0)
+                return [];
+            // One inspect for all of them; `{{.Name}}` carries a leading slash, so the name is read back
+            // rather than zipped by position. `docker inspect` FAILS THE WHOLE CALL if any one name has
+            // gone away since the peek, so a vanished container must not blind the sweep to its
+            // siblings: fall back to treating every listed name as running now. `docker stop` on a name
+            // that no longer exists then fails soft, per sandbox, in stopSessionSandboxes.
+            let inspected;
+            try {
+                inspected = await run(["inspect", "--format", "{{.Name}}\t{{.State.Status}}\t{{.State.StartedAt}}", ...names]);
+            }
+            catch {
+                const now = Date.now();
+                return names.map((name) => ({ name, status: "running", createdAt: now }));
+            }
+            const out = [];
+            for (const line of inspected.split("\n")) {
+                const [rawName, state, startedAt] = line.trim().split("\t");
+                if (rawName === undefined || state === undefined)
+                    continue;
+                const name = rawName.replace(/^\//, "");
+                if (name.length === 0)
+                    continue;
+                const parsed = startedAt === undefined ? Number.NaN : Date.parse(startedAt);
+                const createdAt = Number.isFinite(parsed) && parsed >= DOCKER_START_TIME_FLOOR_MS ? parsed : Date.now();
+                out.push({ name, status: dockerStatusToSandboxStatus(state), createdAt });
+            }
+            return out;
+        },
+        async stop(name) {
+            await run(["stop", "-t", "0", name]);
+        },
+        async retag() {
+            // eve's docker binding applies labels ONLY on `docker run`, i.e. when it creates the
+            // container. A reattach (`container inspect` then `docker start`) never re-labels, and a
+            // running container's labels are immutable anyway. So the OPE-447 re-tag hazard does not
+            // exist on this backend and there is nothing to hand back.
+            return false;
+        },
+    };
+}
+// ── just-bash ─────────────────────────────────────────────────────────────────────────────────
+/**
+ * The just-bash backend is an in-process interpreter — no VM, no container, no metered runtime — so this
+ * stopper is deliberately inert. It names itself in the log rather than swallowing an error.
+ */
+export const justBashStopper = {
+    backend: "just-bash",
+    metered: false,
+    ownership: "stop owner = NONE — the just-bash backend runs inside this app process. There is no VM or container to stop and no metered runtime, so the turn-end sweep is inert by design. Set OE_SANDBOX_BACKEND=docker for a backend whose compute is stopped at turn end",
+    async list() {
+        return [];
+    },
+    async stop() {
+        // Unreachable: list() never yields a name.
+    },
+    async retag() {
+        return false;
+    },
+};
+// ── selection ─────────────────────────────────────────────────────────────────────────────────
+/**
+ * The ONE "who stops the sandbox on this deployment" decision. It reads the SAME two switches the
+ * app reads to BUILD the backend — `onVercel()` and `resolveSelfHostBackendKind()` — so the
+ * backend that runs and the backend that stops can never disagree. An unknown
+ * `OE_SANDBOX_BACKEND` throws here exactly as it throws at boot; the hook's fail-soft catch logs
+ * it rather than failing the turn.
+ */
+export function resolveSandboxStopper() {
+    if (forcedStopper !== undefined)
+        return forcedStopper;
+    if (onVercel())
+        return vercelStopper;
+    return resolveSelfHostBackendKind() === "justbash" ? justBashStopper : createDockerStopper();
+}
+/** Test seam: force the resolved stopper so the hook's own branching can be driven without a
+ *  platform, credentials or a docker daemon. Pass `undefined` to restore real selection. */
+let forcedStopper;
+export function setSandboxStopperForTest(stopper) {
+    forcedStopper = stopper;
+}
+//# sourceMappingURL=backend-stop.js.map

package/dist/agent/sandbox/backend-stop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-stop.js","sourceRoot":"","sources":["../../../agent/sandbox/backend-stop.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,0GAA0G;AAE1G,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAClG,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAsCvE;6FAC6F;AAC7F,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,CAAC;AACtD,CAAC;AAyBD,MAAM,oBAAoB,GAAkB;IAC1C,KAAK,CAAC,SAAS,CAAC,SAAS;QACvB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAqB,EAAE,CAAC;QACjC,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACnG,OAAO,GAAG,CAAC;IACb,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,IAAI;QAClB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,0FAA0F;YAC1F,yFAAyF;YACzF,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAG,GAAkB,oBAAoB;IACxE,OAAO,KAAK,EAAE,SAAS,EAAE,EAAE;QACzB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;YAC5E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YACjD,IAAI,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAmB;IAC3C,OAAO,EAAE,QAAQ;IACjB,OAAO,EAAE,IAAI;IACb,SAAS,EACP,kIAAkI;IACpI,IAAI,EAAE,gBAAgB,EAAE;IACxB,KAAK,CAAC,IAAI,CAAC,IAAI;QACb,MAAM,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS;QACzB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC;AAEF,iGAAiG;AAEjG;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AAQhE,MAAM,mBAAmB,GAAiB,KAAK,EAAE,IAAI,EAAE,EAAE,CACvD,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;IAC5D,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QACzF,IAAI,GAAG;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;YAChB,OAAO,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL;mFACmF;AACnF,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,YAAY;QAAE,OAAO,SAAS,CAAC;IACpE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;6BAE6B;AAC7B,MAAM,0BAA0B,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAExD,MAAM,UAAU,mBAAmB,CAAC,GAAG,GAAiB,mBAAmB;IACzE,OAAO;QACL,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,KAAK;QACd,SAAS,EACP,4LAA4L;QAC9L,KAAK,CAAC,IAAI,CAAC,SAAS;YAClB,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,oBAAoB,IAAI,SAAS,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;iBACtI,KAAK,CAAC,IAAI,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAClC,6FAA6F;YAC7F,4FAA4F;YAC5F,oFAAoF;YACpF,4FAA4F;YAC5F,+EAA+E;YAC/E,IAAI,SAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,oDAAoD,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;YACjH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACvB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,GAAG,GAAqB,EAAE,CAAC;YACjC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC5D,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;oBAAE,SAAS;gBAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAChC,MAAM,MAAM,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,0BAA0B,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACxG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,2BAA2B,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI;YACb,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACvC,CAAC;QACD,KAAK,CAAC,KAAK;YACT,qFAAqF;YACrF,yFAAyF;YACzF,yFAAyF;YACzF,2DAA2D;YAC3D,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AAEjG;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAmB;IAC7C,OAAO,EAAE,WAAW;IACpB,OAAO,EAAE,KAAK;IACd,SAAS,EACP,gQAAgQ;IAClQ,KAAK,CAAC,IAAI;QACR,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,KAAK,CAAC,IAAI;QACR,2CAA2C;IAC7C,CAAC;IACD,KAAK,CAAC,KAAK;QACT,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAC;AAEF,iGAAiG;AAEjG;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB;IACnC,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IACtD,IAAI,QAAQ,EAAE;QAAE,OAAO,aAAa,CAAC;IACrC,OAAO,0BAA0B,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC;AAC/F,CAAC;AAED;4FAC4F;AAC5F,IAAI,aAAyC,CAAC;AAC9C,MAAM,UAAU,wBAAwB,CAAC,OAAmC;IAC1E,aAAa,GAAG,OAAO,CAAC;AAC1B,CAAC"}

package/dist/agent/sandbox/created-sandbox-registry.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Record the vendor sandbox name eve just opened for `sessionId`, in THIS process. Called from
+ * `agent/sandbox/sandbox.ts`'s `onSession` hook. Never throws — a caller that races this against
+ * a torn-down process loses nothing beyond falling back to the pre-fix `Sandbox.list` behaviour.
+ */
+export declare function recordCreatedSandbox(sessionId: string, name: string): void;
+/**
+ * The vendor sandbox name recorded for `sessionId` in THIS process, if any. `undefined` means
+ * either no sandbox was opened here this invocation, or it was opened by a different process —
+ * both cases fall back to the vendor's tag index, exactly as before this fix.
+ */
+export declare function getRecordedSandboxName(sessionId: string): string | undefined;
+/** Test seam: reset between assertions so one test's recording can't leak into the next. */
+export declare function clearRecordedSandboxesForTest(): void;
+//# sourceMappingURL=created-sandbox-registry.d.ts.map

package/dist/agent/sandbox/created-sandbox-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"created-sandbox-registry.d.ts","sourceRoot":"","sources":["../../../agent/sandbox/created-sandbox-registry.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAG1E;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE5E;AAED,4FAA4F;AAC5F,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}

package/dist/agent/sandbox/created-sandbox-registry.js

@@ -0,0 +1,26 @@
+// Record the sandbox name THIS process opened, so the stop hook can reach it with a primary-key
+// `Sandbox.get` instead of the tag index. It NARROWS the create-then-stop race, and never replaces `list()`.
+const recordedSandboxNames = new Map();
+/**
+ * Record the vendor sandbox name eve just opened for `sessionId`, in THIS process. Called from
+ * `agent/sandbox/sandbox.ts`'s `onSession` hook. Never throws — a caller that races this against
+ * a torn-down process loses nothing beyond falling back to the pre-fix `Sandbox.list` behaviour.
+ */
+export function recordCreatedSandbox(sessionId, name) {
+    if (sessionId.length === 0 || name.length === 0)
+        return;
+    recordedSandboxNames.set(sessionId, name);
+}
+/**
+ * The vendor sandbox name recorded for `sessionId` in THIS process, if any. `undefined` means
+ * either no sandbox was opened here this invocation, or it was opened by a different process —
+ * both cases fall back to the vendor's tag index, exactly as before this fix.
+ */
+export function getRecordedSandboxName(sessionId) {
+    return recordedSandboxNames.get(sessionId);
+}
+/** Test seam: reset between assertions so one test's recording can't leak into the next. */
+export function clearRecordedSandboxesForTest() {
+    recordedSandboxNames.clear();
+}
+//# sourceMappingURL=created-sandbox-registry.js.map

package/dist/agent/sandbox/created-sandbox-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"created-sandbox-registry.js","sourceRoot":"","sources":["../../../agent/sandbox/created-sandbox-registry.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,6GAA6G;AAC7G,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,IAAY;IAClE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACxD,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,OAAO,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,6BAA6B;IAC3C,oBAAoB,CAAC,KAAK,EAAE,CAAC;AAC/B,CAAC"}