@agent-native/core 0.92.12 → 0.94.0

package/dist/integrations/remote-devices-store.js

@@ -109,6 +109,12 @@ export function toPublicRemoteDevice(device) {
         updatedAt: device.updatedAt,
     };
 }
+export function getRemoteComputerCapabilities(device) {
+    const value = device.metadata?.computerCapabilities;
+    if (!value || typeof value !== "object")
+        return null;
+    return normalizeComputerCapabilities(value);
+}
 export async function createRemoteDevice(input) {
     await ensureTable();
     const client = getDbExec();
@@ -129,7 +135,7 @@ export async function createRemoteDevice(input) {
             sanitizeOptionalString(input.platform, 80),
             sanitizeOptionalString(input.appVersion, 120),
             sanitizeOptionalString(input.hostName, 200),
-            input.metadata ? JSON.stringify(input.metadata) : null,
+            serializeRemoteDeviceMetadata(input.metadata),
             tokenHash,
             now,
             "active",
@@ -251,7 +257,7 @@ export async function updateRemoteDeviceDetails(input) {
     }
     if (input.metadata !== undefined) {
         updates.push("metadata_json = ?");
-        args.push(input.metadata ? JSON.stringify(input.metadata) : null);
+        args.push(serializeRemoteDeviceMetadata(input.metadata));
     }
     if (updates.length === 0)
         return getRemoteDevice(input.id);
@@ -321,6 +327,47 @@ function parseJson(value, fallback) {
         return fallback;
     }
 }
+function serializeRemoteDeviceMetadata(metadata) {
+    if (!metadata)
+        return null;
+    const normalized = { ...metadata };
+    if (metadata.computerCapabilities !== undefined) {
+        normalized.computerCapabilities = normalizeComputerCapabilities(metadata.computerCapabilities);
+    }
+    const json = JSON.stringify(normalized);
+    if (new TextEncoder().encode(json).byteLength > 32_768) {
+        throw new Error("Remote device metadata exceeds 32 KiB");
+    }
+    if (/"data:[^"]*"/i.test(json) || looksLikeLargeBase64(json)) {
+        throw new Error("Remote device metadata cannot contain binary payloads");
+    }
+    return json;
+}
+function normalizeComputerCapabilities(value) {
+    const result = {};
+    if (value.browser && typeof value.browser === "object") {
+        result.browser = {
+            observe: value.browser.observe === true,
+            control: value.browser.control === true,
+            provider: sanitizeOptionalString(value.browser.provider, 120),
+            version: sanitizeOptionalString(value.browser.version, 120),
+        };
+    }
+    if (value.desktop && typeof value.desktop === "object") {
+        result.desktop = {
+            observe: value.desktop.observe === true,
+            control: value.desktop.control === true,
+            accessibility: value.desktop.accessibility === true,
+            screenCapture: value.desktop.screenCapture === true,
+            provider: sanitizeOptionalString(value.desktop.provider, 120),
+            version: sanitizeOptionalString(value.desktop.version, 120),
+        };
+    }
+    return result;
+}
+function looksLikeLargeBase64(value) {
+    return value.length > 4_096 && /[A-Za-z0-9+/]{4_096,}={0,2}/.test(value);
+}
 function randomHex(byteLength) {
     const bytes = new Uint8Array(byteLength);
     globalThis.crypto.getRandomValues(bytes);

package/dist/integrations/remote-devices-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote-devices-store.js","sourceRoot":"","sources":["../../src/integrations/remote-devices-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,OAAO,EACP,UAAU,EACV,cAAc,GACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAG5B,IAAI,YAAuC,CAAC;AAE5C,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG;;;;;;;;;;;yBAWC,OAAO,EAAE;;uBAEX,OAAO,EAAE;uBACT,OAAO,EAAE;uBACT,OAAO,EAAE;;OAEzB,CAAC;YAEF,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,0FAA0F;gBAC1F,MAAM,iBAAiB,CAAC,4BAA4B,EAAE,SAAS,CAAC,CAAC;gBACjE,MAAM,kBAAkB,CACtB,4BAA4B,EAC5B,UAAU,EACV,+EAA+E,CAChF,CAAC;gBACF,MAAM,kBAAkB,CACtB,4BAA4B,EAC5B,aAAa,EACb,kFAAkF,CACnF,CAAC;gBACF,MAAM,kBAAkB,CACtB,4BAA4B,EAC5B,WAAW,EACX,gFAAgF,CACjF,CAAC;gBACF,MAAM,kBAAkB,CACtB,4BAA4B,EAC5B,eAAe,EACf,oFAAoF,CACrF,CAAC;gBACF,MAAM,kBAAkB,CACtB,4BAA4B,EAC5B,YAAY,EACZ,8EAA8E,OAAO,EAAE,EAAE,CAC1F,CAAC;gBACF,MAAM,iBAAiB,CACrB,+BAA+B,EAC/B,kHAAkH,CACnH,CAAC;gBACF,MAAM,iBAAiB,CACrB,0BAA0B,EAC1B,wGAAwG,CACzG,CAAC;gBACF,OAAO;YACT,CAAC;YACD,sDAAsD;YACtD,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;YACtD,MAAM,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC7C,MAAM,kBAAkB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAChD,MAAM,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC9C,MAAM,kBAAkB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAClD,MAAM,kBAAkB,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;YAClD,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CACZ,kHAAkH,CACnH,CACF,CAAC;YACF,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CACZ,wGAAwG,CACzG,CACF,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,sDAAsD;YACtD,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAAY,EACZ,UAAkB;IAElB,MAAM,GAAG,GAAG,UAAU,EAAE;QACtB,CAAC,CAAC,mEAAmE,IAAI,IAAI,UAAU,EAAE;QACzF,CAAC,CAAC,qDAAqD,IAAI,IAAI,UAAU,EAAE,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,sBAAsB,CAAC,GAAG,CAAC;YAAE,OAAO;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAY;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAE,GAA0B,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAE,GAA6B,EAAE,OAAO,IAAI,GAAG,CAAC;SACnE,WAAW,EAAE;SACb,IAAI,EAAE,CAAC;IACV,OAAO,CACL,IAAI,KAAK,OAAO;QAChB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CACnC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B;IAC/C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAY;QACpB,UAAU,EAAE,GAAG,CAAC,WAAqB;QACrC,KAAK,EAAG,GAAG,CAAC,MAAwB,IAAI,IAAI;QAC5C,KAAK,EAAE,GAAG,CAAC,KAAe;QAC1B,QAAQ,EAAG,GAAG,CAAC,QAA0B,IAAI,IAAI;QACjD,UAAU,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;QACtD,QAAQ,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;QAClD,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAGnC;QACR,eAAe,EAAE,GAAG,CAAC,iBAA2B;QAChD,UAAU,EACR,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,YAAsB,CAAC;QACtE,MAAM,EAAE,GAAG,CAAC,MAAgC;QAC5C,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAoB,CAAC;QAC3E,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;QACtC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAoB;IACvD,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAQxC;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,iBAAiB,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,MAAM,KAAK,GAAG,OAAO,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAErD,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;;wDAG+C;QACpD,IAAI,EAAE;YACJ,EAAE;YACF,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,KAAK,IAAI,IAAI;YACnB,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,eAAe;YACrC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC1C,sBAAsB,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC;YAC7C,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC;YAC3C,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YACtD,SAAS;YACT,GAAG;YACH,QAAQ;YACR,IAAI;YACJ,GAAG;YACH,GAAG;SACJ;KACF,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC5D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAU;IAEV,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EAAE,+DAA+D;QACpE,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAA4B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAI7C;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EAAE;;;;kBAIS;QACd,IAAI,EAAE;YACJ,KAAK,CAAC,EAAE;YACR,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,KAAK,IAAI,IAAI;YACnB,KAAK,CAAC,KAAK,IAAI,IAAI;SACpB;KACF,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAA4B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAK/C;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAA2B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;YACzC,GAAG,EAAE;mCACwB,YAAY;;oBAE3B;YACd,IAAI;SACL,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAA8B,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,IAAI,GAAkC;QAC1C,KAAK,CAAC,UAAU;QAChB,KAAK,CAAC,KAAK,IAAI,IAAI;QACnB,KAAK,CAAC,KAAK,IAAI,IAAI;KACpB,CAAC;IACF,IAAI,KAAK,CAAC,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EAAE;;gEAEuD,YAAY;;kBAE1D;QACd,IAAI;KACL,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAA8B,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,QAAmC;IAEnC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE;;kBAES;QACd,IAAI,EAAE,CAAC,SAAS,CAAC;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAA4B,CAAC,CAAC;IAC/D,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;uBAEc;QACnB,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAO/C;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAkC,EAAE,CAAC;IAC/C,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,eAAe,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE3D,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACzB,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACxB,GAAG,EAAE;gBACO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;6CACW;QACzC,IAAI;KACL,CAAC,CAAC;IACH,OAAO,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAIhD;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACxB,GAAG,EAAE;;;;;;+DAMsD;QAC3D,IAAI,EAAE;YACJ,GAAG;YACH,GAAG;YACH,KAAK,CAAC,EAAE;YACR,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,KAAK,IAAI,IAAI;YACnB,KAAK,CAAC,KAAK,IAAI,IAAI;SACpB;KACF,CAAC,CAAC;IACH,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAAU;IACrD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACvC,GAAG,EAAE;;;;6CAIoC;QACzC,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;KACrB,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,YAAY,IAAK,MAAc,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAa;IACvD,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACvE,OAAO,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAgC,EAChC,GAAW;IAEX,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,QAAiB;IAClD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,QAAQ,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB;IACnC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACjD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC","sourcesContent":["import {\n  getDbExec,\n  intType,\n  isPostgres,\n  retryOnDdlRace,\n} from \"../db/client.js\";\nimport {\n  ensureColumnExists,\n  ensureIndexExists,\n  ensureTableExists,\n} from \"../db/ddl-guard.js\";\nimport type { PublicRemoteDevice, RemoteDevice } from \"./remote-types.js\";\n\nlet _initPromise: Promise<void> | undefined;\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      const createSql = `\n        CREATE TABLE IF NOT EXISTS integration_remote_devices (\n          id TEXT PRIMARY KEY,\n          owner_email TEXT NOT NULL,\n          org_id TEXT,\n          label TEXT NOT NULL,\n          platform TEXT,\n          app_version TEXT,\n          host_name TEXT,\n          metadata_json TEXT,\n          device_token_hash TEXT NOT NULL,\n          last_seen_at ${intType()},\n          status TEXT NOT NULL,\n          revoked_at ${intType()},\n          created_at ${intType()} NOT NULL,\n          updated_at ${intType()} NOT NULL\n        )\n      `;\n\n      if (isPostgres()) {\n        // PG guard: probe via information_schema, only issue DDL if missing, bounded lock_timeout\n        await ensureTableExists(\"integration_remote_devices\", createSql);\n        await ensureColumnExists(\n          \"integration_remote_devices\",\n          \"platform\",\n          `ALTER TABLE integration_remote_devices ADD COLUMN IF NOT EXISTS platform TEXT`,\n        );\n        await ensureColumnExists(\n          \"integration_remote_devices\",\n          \"app_version\",\n          `ALTER TABLE integration_remote_devices ADD COLUMN IF NOT EXISTS app_version TEXT`,\n        );\n        await ensureColumnExists(\n          \"integration_remote_devices\",\n          \"host_name\",\n          `ALTER TABLE integration_remote_devices ADD COLUMN IF NOT EXISTS host_name TEXT`,\n        );\n        await ensureColumnExists(\n          \"integration_remote_devices\",\n          \"metadata_json\",\n          `ALTER TABLE integration_remote_devices ADD COLUMN IF NOT EXISTS metadata_json TEXT`,\n        );\n        await ensureColumnExists(\n          \"integration_remote_devices\",\n          \"revoked_at\",\n          `ALTER TABLE integration_remote_devices ADD COLUMN IF NOT EXISTS revoked_at ${intType()}`,\n        );\n        await ensureIndexExists(\n          \"idx_remote_devices_token_hash\",\n          `CREATE UNIQUE INDEX IF NOT EXISTS idx_remote_devices_token_hash ON integration_remote_devices(device_token_hash)`,\n        );\n        await ensureIndexExists(\n          \"idx_remote_devices_owner\",\n          `CREATE INDEX IF NOT EXISTS idx_remote_devices_owner ON integration_remote_devices(owner_email, org_id)`,\n        );\n        return;\n      }\n      // SQLite (local dev): keep existing behavior verbatim\n      await retryOnDdlRace(() => client.execute(createSql));\n      await addColumnIfMissing(\"platform\", \"TEXT\");\n      await addColumnIfMissing(\"app_version\", \"TEXT\");\n      await addColumnIfMissing(\"host_name\", \"TEXT\");\n      await addColumnIfMissing(\"metadata_json\", \"TEXT\");\n      await addColumnIfMissing(\"revoked_at\", intType());\n      await retryOnDdlRace(() =>\n        client.execute(\n          `CREATE UNIQUE INDEX IF NOT EXISTS idx_remote_devices_token_hash ON integration_remote_devices(device_token_hash)`,\n        ),\n      );\n      await retryOnDdlRace(() =>\n        client.execute(\n          `CREATE INDEX IF NOT EXISTS idx_remote_devices_owner ON integration_remote_devices(owner_email, org_id)`,\n        ),\n      );\n    })().catch((err) => {\n      // Retry init on the next call after a failed startup.\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\nasync function addColumnIfMissing(\n  name: string,\n  definition: string,\n): Promise<void> {\n  const sql = isPostgres()\n    ? `ALTER TABLE integration_remote_devices ADD COLUMN IF NOT EXISTS ${name} ${definition}`\n    : `ALTER TABLE integration_remote_devices ADD COLUMN ${name} ${definition}`;\n  try {\n    await retryOnDdlRace(() => getDbExec().execute(sql));\n  } catch (err) {\n    if (isDuplicateColumnError(err)) return;\n    throw err;\n  }\n}\n\nfunction isDuplicateColumnError(err: unknown): boolean {\n  const code = String((err as { code?: unknown })?.code ?? \"\");\n  const message = String((err as { message?: unknown })?.message ?? err)\n    .toLowerCase()\n    .trim();\n  return (\n    code === \"42701\" ||\n    message.includes(\"duplicate column\") ||\n    message.includes(\"already exists\")\n  );\n}\n\nfunction rowToDevice(row: Record<string, unknown>): RemoteDevice {\n  return {\n    id: row.id as string,\n    ownerEmail: row.owner_email as string,\n    orgId: (row.org_id as string | null) ?? null,\n    label: row.label as string,\n    platform: (row.platform as string | null) ?? null,\n    appVersion: (row.app_version as string | null) ?? null,\n    hostName: (row.host_name as string | null) ?? null,\n    metadata: parseJson(row.metadata_json, null) as Record<\n      string,\n      unknown\n    > | null,\n    deviceTokenHash: row.device_token_hash as string,\n    lastSeenAt:\n      row.last_seen_at == null ? null : Number(row.last_seen_at as number),\n    status: row.status as RemoteDevice[\"status\"],\n    revokedAt: row.revoked_at == null ? null : Number(row.revoked_at as number),\n    createdAt: Number(row.created_at ?? 0),\n    updatedAt: Number(row.updated_at ?? 0),\n  };\n}\n\nexport function toPublicRemoteDevice(device: RemoteDevice): PublicRemoteDevice {\n  return {\n    id: device.id,\n    ownerEmail: device.ownerEmail,\n    orgId: device.orgId,\n    label: device.label,\n    platform: device.platform,\n    appVersion: device.appVersion,\n    hostName: device.hostName,\n    metadata: device.metadata,\n    lastSeenAt: device.lastSeenAt,\n    status: device.status,\n    revokedAt: device.revokedAt,\n    createdAt: device.createdAt,\n    updatedAt: device.updatedAt,\n  };\n}\n\nexport async function createRemoteDevice(input: {\n  ownerEmail: string;\n  orgId?: string | null;\n  label: string;\n  platform?: string | null;\n  appVersion?: string | null;\n  hostName?: string | null;\n  metadata?: Record<string, unknown> | null;\n}): Promise<{ device: RemoteDevice; token: string }> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  const id = `remote-device-${now}-${randomHex(8)}`;\n  const token = `anr_${randomHex(32)}`;\n  const tokenHash = await hashRemoteDeviceToken(token);\n\n  await client.execute({\n    sql: `INSERT INTO integration_remote_devices\n      (id, owner_email, org_id, label, platform, app_version, host_name, metadata_json,\n       device_token_hash, last_seen_at, status, revoked_at, created_at, updated_at)\n      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      id,\n      input.ownerEmail,\n      input.orgId ?? null,\n      input.label.trim() || \"Remote device\",\n      sanitizeOptionalString(input.platform, 80),\n      sanitizeOptionalString(input.appVersion, 120),\n      sanitizeOptionalString(input.hostName, 200),\n      input.metadata ? JSON.stringify(input.metadata) : null,\n      tokenHash,\n      now,\n      \"active\",\n      null,\n      now,\n      now,\n    ],\n  });\n\n  const device = await getRemoteDevice(id);\n  if (!device) throw new Error(\"remote device insert failed\");\n  return { device, token };\n}\n\nexport async function getRemoteDevice(\n  id: string,\n): Promise<RemoteDevice | null> {\n  await ensureTable();\n  const { rows } = await getDbExec().execute({\n    sql: `SELECT * FROM integration_remote_devices WHERE id = ? LIMIT 1`,\n    args: [id],\n  });\n  return rows[0] ? rowToDevice(rows[0] as Record<string, unknown>) : null;\n}\n\nexport async function getRemoteDeviceForOwner(input: {\n  id: string;\n  ownerEmail: string;\n  orgId?: string | null;\n}): Promise<RemoteDevice | null> {\n  await ensureTable();\n  const { rows } = await getDbExec().execute({\n    sql: `SELECT * FROM integration_remote_devices\n          WHERE id = ?\n            AND owner_email = ?\n            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)\n          LIMIT 1`,\n    args: [\n      input.id,\n      input.ownerEmail,\n      input.orgId ?? null,\n      input.orgId ?? null,\n    ],\n  });\n  return rows[0] ? rowToDevice(rows[0] as Record<string, unknown>) : null;\n}\n\nexport async function listRemoteDevicesForOwner(input: {\n  ownerEmail: string;\n  orgId?: string | null;\n  status?: RemoteDevice[\"status\"];\n  limit?: number;\n}): Promise<RemoteDevice[]> {\n  await ensureTable();\n  const limit = Math.max(1, Math.min(input.limit ?? 50, 100));\n  const statusClause = input.status ? \" AND status = ?\" : \"\";\n  if (!Object.prototype.hasOwnProperty.call(input, \"orgId\")) {\n    const args: Array<string | number> = [input.ownerEmail];\n    if (input.status) args.push(input.status);\n    args.push(limit);\n    const { rows } = await getDbExec().execute({\n      sql: `SELECT * FROM integration_remote_devices\n            WHERE owner_email = ?${statusClause}\n            ORDER BY COALESCE(last_seen_at, updated_at) DESC\n            LIMIT ?`,\n      args,\n    });\n    return rows.map((row) => rowToDevice(row as Record<string, unknown>));\n  }\n  const args: Array<string | number | null> = [\n    input.ownerEmail,\n    input.orgId ?? null,\n    input.orgId ?? null,\n  ];\n  if (input.status) args.push(input.status);\n  args.push(limit);\n  const { rows } = await getDbExec().execute({\n    sql: `SELECT * FROM integration_remote_devices\n          WHERE owner_email = ?\n            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)${statusClause}\n          ORDER BY COALESCE(last_seen_at, updated_at) DESC\n          LIMIT ?`,\n    args,\n  });\n  return rows.map((row) => rowToDevice(row as Record<string, unknown>));\n}\n\nexport async function authenticateRemoteDeviceToken(\n  rawToken: string | null | undefined,\n): Promise<RemoteDevice | null> {\n  if (!rawToken) return null;\n  await ensureTable();\n  const tokenHash = await hashRemoteDeviceToken(rawToken);\n  const now = Date.now();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT * FROM integration_remote_devices\n          WHERE device_token_hash = ? AND status = 'active'\n          LIMIT 1`,\n    args: [tokenHash],\n  });\n  if (!rows[0]) return null;\n  const device = rowToDevice(rows[0] as Record<string, unknown>);\n  await client.execute({\n    sql: `UPDATE integration_remote_devices\n          SET last_seen_at = ?, updated_at = ?\n          WHERE id = ?`,\n    args: [now, now, device.id],\n  });\n  return { ...device, lastSeenAt: now, updatedAt: now };\n}\n\nexport async function updateRemoteDeviceDetails(input: {\n  id: string;\n  label?: string | null;\n  platform?: string | null;\n  appVersion?: string | null;\n  hostName?: string | null;\n  metadata?: Record<string, unknown> | null;\n}): Promise<RemoteDevice | null> {\n  await ensureTable();\n  const now = Date.now();\n  const updates: string[] = [];\n  const args: Array<string | number | null> = [];\n  if (input.label !== undefined) {\n    updates.push(\"label = ?\");\n    args.push(sanitizeOptionalString(input.label, 200) ?? \"Remote device\");\n  }\n  if (input.platform !== undefined) {\n    updates.push(\"platform = ?\");\n    args.push(sanitizeOptionalString(input.platform, 80));\n  }\n  if (input.appVersion !== undefined) {\n    updates.push(\"app_version = ?\");\n    args.push(sanitizeOptionalString(input.appVersion, 120));\n  }\n  if (input.hostName !== undefined) {\n    updates.push(\"host_name = ?\");\n    args.push(sanitizeOptionalString(input.hostName, 200));\n  }\n  if (input.metadata !== undefined) {\n    updates.push(\"metadata_json = ?\");\n    args.push(input.metadata ? JSON.stringify(input.metadata) : null);\n  }\n  if (updates.length === 0) return getRemoteDevice(input.id);\n\n  updates.push(\"updated_at = ?\");\n  args.push(now, input.id);\n  await getDbExec().execute({\n    sql: `UPDATE integration_remote_devices\n          SET ${updates.join(\", \")}\n          WHERE id = ? AND status = 'active'`,\n    args,\n  });\n  return getRemoteDevice(input.id);\n}\n\nexport async function revokeRemoteDeviceForOwner(input: {\n  id: string;\n  ownerEmail: string;\n  orgId?: string | null;\n}): Promise<RemoteDevice | null> {\n  await ensureTable();\n  const now = Date.now();\n  await getDbExec().execute({\n    sql: `UPDATE integration_remote_devices\n          SET status = 'inactive',\n              revoked_at = COALESCE(revoked_at, ?),\n              updated_at = ?\n          WHERE id = ?\n            AND owner_email = ?\n            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)`,\n    args: [\n      now,\n      now,\n      input.id,\n      input.ownerEmail,\n      input.orgId ?? null,\n      input.orgId ?? null,\n    ],\n  });\n  return getRemoteDeviceForOwner(input);\n}\n\nexport async function unregisterRemoteDevice(id: string): Promise<boolean> {\n  await ensureTable();\n  const now = Date.now();\n  const result = await getDbExec().execute({\n    sql: `UPDATE integration_remote_devices\n          SET status = 'inactive',\n              revoked_at = COALESCE(revoked_at, ?),\n              updated_at = ?\n          WHERE id = ? AND status = 'active'`,\n    args: [now, now, id],\n  });\n  return (result.rowsAffected ?? (result as any).rowCount ?? 0) > 0;\n}\n\nexport async function hashRemoteDeviceToken(token: string): Promise<string> {\n  const bytes = new TextEncoder().encode(token);\n  const digest = await globalThis.crypto.subtle.digest(\"SHA-256\", bytes);\n  return bytesToHex(new Uint8Array(digest));\n}\n\nfunction sanitizeOptionalString(\n  value: string | null | undefined,\n  max: number,\n): string | null {\n  if (typeof value !== \"string\") return null;\n  const trimmed = value.trim();\n  return trimmed ? trimmed.slice(0, max) : null;\n}\n\nfunction parseJson(value: unknown, fallback: unknown): unknown {\n  if (value == null) return fallback;\n  try {\n    return JSON.parse(String(value));\n  } catch {\n    return fallback;\n  }\n}\n\nfunction randomHex(byteLength: number): string {\n  const bytes = new Uint8Array(byteLength);\n  globalThis.crypto.getRandomValues(bytes);\n  return bytesToHex(bytes);\n}\n\nfunction bytesToHex(bytes: Uint8Array): string {\n  return Array.from(bytes)\n    .map((byte) => byte.toString(16).padStart(2, \"0\"))\n    .join(\"\");\n}\n"]}
+{"version":3,"file":"remote-devices-store.js","sourceRoot":"","sources":["../../src/integrations/remote-devices-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,OAAO,EACP,UAAU,EACV,cAAc,GACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAQ5B,IAAI,YAAuC,CAAC;AAE5C,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG;;;;;;;;;;;yBAWC,OAAO,EAAE;;uBAEX,OAAO,EAAE;uBACT,OAAO,EAAE;uBACT,OAAO,EAAE;;OAEzB,CAAC;YAEF,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,0FAA0F;gBAC1F,MAAM,iBAAiB,CAAC,4BAA4B,EAAE,SAAS,CAAC,CAAC;gBACjE,MAAM,kBAAkB,CACtB,4BAA4B,EAC5B,UAAU,EACV,+EAA+E,CAChF,CAAC;gBACF,MAAM,kBAAkB,CACtB,4BAA4B,EAC5B,aAAa,EACb,kFAAkF,CACnF,CAAC;gBACF,MAAM,kBAAkB,CACtB,4BAA4B,EAC5B,WAAW,EACX,gFAAgF,CACjF,CAAC;gBACF,MAAM,kBAAkB,CACtB,4BAA4B,EAC5B,eAAe,EACf,oFAAoF,CACrF,CAAC;gBACF,MAAM,kBAAkB,CACtB,4BAA4B,EAC5B,YAAY,EACZ,8EAA8E,OAAO,EAAE,EAAE,CAC1F,CAAC;gBACF,MAAM,iBAAiB,CACrB,+BAA+B,EAC/B,kHAAkH,CACnH,CAAC;gBACF,MAAM,iBAAiB,CACrB,0BAA0B,EAC1B,wGAAwG,CACzG,CAAC;gBACF,OAAO;YACT,CAAC;YACD,sDAAsD;YACtD,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;YACtD,MAAM,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC7C,MAAM,kBAAkB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAChD,MAAM,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC9C,MAAM,kBAAkB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAClD,MAAM,kBAAkB,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;YAClD,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CACZ,kHAAkH,CACnH,CACF,CAAC;YACF,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CACZ,wGAAwG,CACzG,CACF,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,sDAAsD;YACtD,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAAY,EACZ,UAAkB;IAElB,MAAM,GAAG,GAAG,UAAU,EAAE;QACtB,CAAC,CAAC,mEAAmE,IAAI,IAAI,UAAU,EAAE;QACzF,CAAC,CAAC,qDAAqD,IAAI,IAAI,UAAU,EAAE,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,sBAAsB,CAAC,GAAG,CAAC;YAAE,OAAO;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAY;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAE,GAA0B,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAE,GAA6B,EAAE,OAAO,IAAI,GAAG,CAAC;SACnE,WAAW,EAAE;SACb,IAAI,EAAE,CAAC;IACV,OAAO,CACL,IAAI,KAAK,OAAO;QAChB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CACnC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B;IAC/C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAY;QACpB,UAAU,EAAE,GAAG,CAAC,WAAqB;QACrC,KAAK,EAAG,GAAG,CAAC,MAAwB,IAAI,IAAI;QAC5C,KAAK,EAAE,GAAG,CAAC,KAAe;QAC1B,QAAQ,EAAG,GAAG,CAAC,QAA0B,IAAI,IAAI;QACjD,UAAU,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;QACtD,QAAQ,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;QAClD,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAgC;QAC3E,eAAe,EAAE,GAAG,CAAC,iBAA2B;QAChD,UAAU,EACR,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,YAAsB,CAAC;QACtE,MAAM,EAAE,GAAG,CAAC,MAAgC;QAC5C,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAoB,CAAC;QAC3E,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;QACtC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAoB;IACvD,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,MAAsC;IAEtC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACpD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,6BAA6B,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAQxC;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,iBAAiB,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,MAAM,KAAK,GAAG,OAAO,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAErD,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;;wDAG+C;QACpD,IAAI,EAAE;YACJ,EAAE;YACF,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,KAAK,IAAI,IAAI;YACnB,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,eAAe;YACrC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC1C,sBAAsB,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC;YAC7C,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC;YAC3C,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC7C,SAAS;YACT,GAAG;YACH,QAAQ;YACR,IAAI;YACJ,GAAG;YACH,GAAG;SACJ;KACF,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC5D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAU;IAEV,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EAAE,+DAA+D;QACpE,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAA4B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAI7C;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EAAE;;;;kBAIS;QACd,IAAI,EAAE;YACJ,KAAK,CAAC,EAAE;YACR,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,KAAK,IAAI,IAAI;YACnB,KAAK,CAAC,KAAK,IAAI,IAAI;SACpB;KACF,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAA4B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAK/C;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAA2B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;YACzC,GAAG,EAAE;mCACwB,YAAY;;oBAE3B;YACd,IAAI;SACL,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAA8B,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,IAAI,GAAkC;QAC1C,KAAK,CAAC,UAAU;QAChB,KAAK,CAAC,KAAK,IAAI,IAAI;QACnB,KAAK,CAAC,KAAK,IAAI,IAAI;KACpB,CAAC;IACF,IAAI,KAAK,CAAC,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EAAE;;gEAEuD,YAAY;;kBAE1D;QACd,IAAI;KACL,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAA8B,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,QAAmC;IAEnC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE;;kBAES;QACd,IAAI,EAAE,CAAC,SAAS,CAAC;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAA4B,CAAC,CAAC;IAC/D,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;uBAEc;QACnB,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAO/C;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAkC,EAAE,CAAC;IAC/C,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,eAAe,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE3D,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACzB,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACxB,GAAG,EAAE;gBACO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;6CACW;QACzC,IAAI;KACL,CAAC,CAAC;IACH,OAAO,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAIhD;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACxB,GAAG,EAAE;;;;;;+DAMsD;QAC3D,IAAI,EAAE;YACJ,GAAG;YACH,GAAG;YACH,KAAK,CAAC,EAAE;YACR,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,KAAK,IAAI,IAAI;YACnB,KAAK,CAAC,KAAK,IAAI,IAAI;SACpB;KACF,CAAC,CAAC;IACH,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAAU;IACrD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACvC,GAAG,EAAE;;;;6CAIoC;QACzC,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;KACrB,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,YAAY,IAAK,MAAc,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAa;IACvD,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACvE,OAAO,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAgC,EAChC,GAAW;IAEX,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,QAAiB;IAClD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,QAAQ,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CACpC,QAAiD;IAEjD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,UAAU,GAAyB,EAAE,GAAG,QAAQ,EAAE,CAAC;IACzD,IAAI,QAAQ,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAChD,UAAU,CAAC,oBAAoB,GAAG,6BAA6B,CAC7D,QAAQ,CAAC,oBAAoB,CAC9B,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,MAAM,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,6BAA6B,CACpC,KAAiC;IAEjC,MAAM,MAAM,GAA+B,EAAE,CAAC;IAC9C,IAAI,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACvD,MAAM,CAAC,OAAO,GAAG;YACf,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI;YACvC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI;YACvC,QAAQ,EAAE,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;YAC7D,OAAO,EAAE,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SAC5D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACvD,MAAM,CAAC,OAAO,GAAG;YACf,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI;YACvC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI;YACvC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,KAAK,IAAI;YACnD,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,KAAK,IAAI;YACnD,QAAQ,EAAE,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;YAC7D,OAAO,EAAE,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SAC5D,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,MAAM,GAAG,KAAK,IAAI,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB;IACnC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACjD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC","sourcesContent":["import {\n  getDbExec,\n  intType,\n  isPostgres,\n  retryOnDdlRace,\n} from \"../db/client.js\";\nimport {\n  ensureColumnExists,\n  ensureIndexExists,\n  ensureTableExists,\n} from \"../db/ddl-guard.js\";\nimport type {\n  PublicRemoteDevice,\n  RemoteComputerCapabilities,\n  RemoteDevice,\n  RemoteDeviceMetadata,\n} from \"./remote-types.js\";\n\nlet _initPromise: Promise<void> | undefined;\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      const createSql = `\n        CREATE TABLE IF NOT EXISTS integration_remote_devices (\n          id TEXT PRIMARY KEY,\n          owner_email TEXT NOT NULL,\n          org_id TEXT,\n          label TEXT NOT NULL,\n          platform TEXT,\n          app_version TEXT,\n          host_name TEXT,\n          metadata_json TEXT,\n          device_token_hash TEXT NOT NULL,\n          last_seen_at ${intType()},\n          status TEXT NOT NULL,\n          revoked_at ${intType()},\n          created_at ${intType()} NOT NULL,\n          updated_at ${intType()} NOT NULL\n        )\n      `;\n\n      if (isPostgres()) {\n        // PG guard: probe via information_schema, only issue DDL if missing, bounded lock_timeout\n        await ensureTableExists(\"integration_remote_devices\", createSql);\n        await ensureColumnExists(\n          \"integration_remote_devices\",\n          \"platform\",\n          `ALTER TABLE integration_remote_devices ADD COLUMN IF NOT EXISTS platform TEXT`,\n        );\n        await ensureColumnExists(\n          \"integration_remote_devices\",\n          \"app_version\",\n          `ALTER TABLE integration_remote_devices ADD COLUMN IF NOT EXISTS app_version TEXT`,\n        );\n        await ensureColumnExists(\n          \"integration_remote_devices\",\n          \"host_name\",\n          `ALTER TABLE integration_remote_devices ADD COLUMN IF NOT EXISTS host_name TEXT`,\n        );\n        await ensureColumnExists(\n          \"integration_remote_devices\",\n          \"metadata_json\",\n          `ALTER TABLE integration_remote_devices ADD COLUMN IF NOT EXISTS metadata_json TEXT`,\n        );\n        await ensureColumnExists(\n          \"integration_remote_devices\",\n          \"revoked_at\",\n          `ALTER TABLE integration_remote_devices ADD COLUMN IF NOT EXISTS revoked_at ${intType()}`,\n        );\n        await ensureIndexExists(\n          \"idx_remote_devices_token_hash\",\n          `CREATE UNIQUE INDEX IF NOT EXISTS idx_remote_devices_token_hash ON integration_remote_devices(device_token_hash)`,\n        );\n        await ensureIndexExists(\n          \"idx_remote_devices_owner\",\n          `CREATE INDEX IF NOT EXISTS idx_remote_devices_owner ON integration_remote_devices(owner_email, org_id)`,\n        );\n        return;\n      }\n      // SQLite (local dev): keep existing behavior verbatim\n      await retryOnDdlRace(() => client.execute(createSql));\n      await addColumnIfMissing(\"platform\", \"TEXT\");\n      await addColumnIfMissing(\"app_version\", \"TEXT\");\n      await addColumnIfMissing(\"host_name\", \"TEXT\");\n      await addColumnIfMissing(\"metadata_json\", \"TEXT\");\n      await addColumnIfMissing(\"revoked_at\", intType());\n      await retryOnDdlRace(() =>\n        client.execute(\n          `CREATE UNIQUE INDEX IF NOT EXISTS idx_remote_devices_token_hash ON integration_remote_devices(device_token_hash)`,\n        ),\n      );\n      await retryOnDdlRace(() =>\n        client.execute(\n          `CREATE INDEX IF NOT EXISTS idx_remote_devices_owner ON integration_remote_devices(owner_email, org_id)`,\n        ),\n      );\n    })().catch((err) => {\n      // Retry init on the next call after a failed startup.\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\nasync function addColumnIfMissing(\n  name: string,\n  definition: string,\n): Promise<void> {\n  const sql = isPostgres()\n    ? `ALTER TABLE integration_remote_devices ADD COLUMN IF NOT EXISTS ${name} ${definition}`\n    : `ALTER TABLE integration_remote_devices ADD COLUMN ${name} ${definition}`;\n  try {\n    await retryOnDdlRace(() => getDbExec().execute(sql));\n  } catch (err) {\n    if (isDuplicateColumnError(err)) return;\n    throw err;\n  }\n}\n\nfunction isDuplicateColumnError(err: unknown): boolean {\n  const code = String((err as { code?: unknown })?.code ?? \"\");\n  const message = String((err as { message?: unknown })?.message ?? err)\n    .toLowerCase()\n    .trim();\n  return (\n    code === \"42701\" ||\n    message.includes(\"duplicate column\") ||\n    message.includes(\"already exists\")\n  );\n}\n\nfunction rowToDevice(row: Record<string, unknown>): RemoteDevice {\n  return {\n    id: row.id as string,\n    ownerEmail: row.owner_email as string,\n    orgId: (row.org_id as string | null) ?? null,\n    label: row.label as string,\n    platform: (row.platform as string | null) ?? null,\n    appVersion: (row.app_version as string | null) ?? null,\n    hostName: (row.host_name as string | null) ?? null,\n    metadata: parseJson(row.metadata_json, null) as RemoteDeviceMetadata | null,\n    deviceTokenHash: row.device_token_hash as string,\n    lastSeenAt:\n      row.last_seen_at == null ? null : Number(row.last_seen_at as number),\n    status: row.status as RemoteDevice[\"status\"],\n    revokedAt: row.revoked_at == null ? null : Number(row.revoked_at as number),\n    createdAt: Number(row.created_at ?? 0),\n    updatedAt: Number(row.updated_at ?? 0),\n  };\n}\n\nexport function toPublicRemoteDevice(device: RemoteDevice): PublicRemoteDevice {\n  return {\n    id: device.id,\n    ownerEmail: device.ownerEmail,\n    orgId: device.orgId,\n    label: device.label,\n    platform: device.platform,\n    appVersion: device.appVersion,\n    hostName: device.hostName,\n    metadata: device.metadata,\n    lastSeenAt: device.lastSeenAt,\n    status: device.status,\n    revokedAt: device.revokedAt,\n    createdAt: device.createdAt,\n    updatedAt: device.updatedAt,\n  };\n}\n\nexport function getRemoteComputerCapabilities(\n  device: Pick<RemoteDevice, \"metadata\">,\n): RemoteComputerCapabilities | null {\n  const value = device.metadata?.computerCapabilities;\n  if (!value || typeof value !== \"object\") return null;\n  return normalizeComputerCapabilities(value);\n}\n\nexport async function createRemoteDevice(input: {\n  ownerEmail: string;\n  orgId?: string | null;\n  label: string;\n  platform?: string | null;\n  appVersion?: string | null;\n  hostName?: string | null;\n  metadata?: RemoteDeviceMetadata | null;\n}): Promise<{ device: RemoteDevice; token: string }> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  const id = `remote-device-${now}-${randomHex(8)}`;\n  const token = `anr_${randomHex(32)}`;\n  const tokenHash = await hashRemoteDeviceToken(token);\n\n  await client.execute({\n    sql: `INSERT INTO integration_remote_devices\n      (id, owner_email, org_id, label, platform, app_version, host_name, metadata_json,\n       device_token_hash, last_seen_at, status, revoked_at, created_at, updated_at)\n      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      id,\n      input.ownerEmail,\n      input.orgId ?? null,\n      input.label.trim() || \"Remote device\",\n      sanitizeOptionalString(input.platform, 80),\n      sanitizeOptionalString(input.appVersion, 120),\n      sanitizeOptionalString(input.hostName, 200),\n      serializeRemoteDeviceMetadata(input.metadata),\n      tokenHash,\n      now,\n      \"active\",\n      null,\n      now,\n      now,\n    ],\n  });\n\n  const device = await getRemoteDevice(id);\n  if (!device) throw new Error(\"remote device insert failed\");\n  return { device, token };\n}\n\nexport async function getRemoteDevice(\n  id: string,\n): Promise<RemoteDevice | null> {\n  await ensureTable();\n  const { rows } = await getDbExec().execute({\n    sql: `SELECT * FROM integration_remote_devices WHERE id = ? LIMIT 1`,\n    args: [id],\n  });\n  return rows[0] ? rowToDevice(rows[0] as Record<string, unknown>) : null;\n}\n\nexport async function getRemoteDeviceForOwner(input: {\n  id: string;\n  ownerEmail: string;\n  orgId?: string | null;\n}): Promise<RemoteDevice | null> {\n  await ensureTable();\n  const { rows } = await getDbExec().execute({\n    sql: `SELECT * FROM integration_remote_devices\n          WHERE id = ?\n            AND owner_email = ?\n            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)\n          LIMIT 1`,\n    args: [\n      input.id,\n      input.ownerEmail,\n      input.orgId ?? null,\n      input.orgId ?? null,\n    ],\n  });\n  return rows[0] ? rowToDevice(rows[0] as Record<string, unknown>) : null;\n}\n\nexport async function listRemoteDevicesForOwner(input: {\n  ownerEmail: string;\n  orgId?: string | null;\n  status?: RemoteDevice[\"status\"];\n  limit?: number;\n}): Promise<RemoteDevice[]> {\n  await ensureTable();\n  const limit = Math.max(1, Math.min(input.limit ?? 50, 100));\n  const statusClause = input.status ? \" AND status = ?\" : \"\";\n  if (!Object.prototype.hasOwnProperty.call(input, \"orgId\")) {\n    const args: Array<string | number> = [input.ownerEmail];\n    if (input.status) args.push(input.status);\n    args.push(limit);\n    const { rows } = await getDbExec().execute({\n      sql: `SELECT * FROM integration_remote_devices\n            WHERE owner_email = ?${statusClause}\n            ORDER BY COALESCE(last_seen_at, updated_at) DESC\n            LIMIT ?`,\n      args,\n    });\n    return rows.map((row) => rowToDevice(row as Record<string, unknown>));\n  }\n  const args: Array<string | number | null> = [\n    input.ownerEmail,\n    input.orgId ?? null,\n    input.orgId ?? null,\n  ];\n  if (input.status) args.push(input.status);\n  args.push(limit);\n  const { rows } = await getDbExec().execute({\n    sql: `SELECT * FROM integration_remote_devices\n          WHERE owner_email = ?\n            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)${statusClause}\n          ORDER BY COALESCE(last_seen_at, updated_at) DESC\n          LIMIT ?`,\n    args,\n  });\n  return rows.map((row) => rowToDevice(row as Record<string, unknown>));\n}\n\nexport async function authenticateRemoteDeviceToken(\n  rawToken: string | null | undefined,\n): Promise<RemoteDevice | null> {\n  if (!rawToken) return null;\n  await ensureTable();\n  const tokenHash = await hashRemoteDeviceToken(rawToken);\n  const now = Date.now();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT * FROM integration_remote_devices\n          WHERE device_token_hash = ? AND status = 'active'\n          LIMIT 1`,\n    args: [tokenHash],\n  });\n  if (!rows[0]) return null;\n  const device = rowToDevice(rows[0] as Record<string, unknown>);\n  await client.execute({\n    sql: `UPDATE integration_remote_devices\n          SET last_seen_at = ?, updated_at = ?\n          WHERE id = ?`,\n    args: [now, now, device.id],\n  });\n  return { ...device, lastSeenAt: now, updatedAt: now };\n}\n\nexport async function updateRemoteDeviceDetails(input: {\n  id: string;\n  label?: string | null;\n  platform?: string | null;\n  appVersion?: string | null;\n  hostName?: string | null;\n  metadata?: RemoteDeviceMetadata | null;\n}): Promise<RemoteDevice | null> {\n  await ensureTable();\n  const now = Date.now();\n  const updates: string[] = [];\n  const args: Array<string | number | null> = [];\n  if (input.label !== undefined) {\n    updates.push(\"label = ?\");\n    args.push(sanitizeOptionalString(input.label, 200) ?? \"Remote device\");\n  }\n  if (input.platform !== undefined) {\n    updates.push(\"platform = ?\");\n    args.push(sanitizeOptionalString(input.platform, 80));\n  }\n  if (input.appVersion !== undefined) {\n    updates.push(\"app_version = ?\");\n    args.push(sanitizeOptionalString(input.appVersion, 120));\n  }\n  if (input.hostName !== undefined) {\n    updates.push(\"host_name = ?\");\n    args.push(sanitizeOptionalString(input.hostName, 200));\n  }\n  if (input.metadata !== undefined) {\n    updates.push(\"metadata_json = ?\");\n    args.push(serializeRemoteDeviceMetadata(input.metadata));\n  }\n  if (updates.length === 0) return getRemoteDevice(input.id);\n\n  updates.push(\"updated_at = ?\");\n  args.push(now, input.id);\n  await getDbExec().execute({\n    sql: `UPDATE integration_remote_devices\n          SET ${updates.join(\", \")}\n          WHERE id = ? AND status = 'active'`,\n    args,\n  });\n  return getRemoteDevice(input.id);\n}\n\nexport async function revokeRemoteDeviceForOwner(input: {\n  id: string;\n  ownerEmail: string;\n  orgId?: string | null;\n}): Promise<RemoteDevice | null> {\n  await ensureTable();\n  const now = Date.now();\n  await getDbExec().execute({\n    sql: `UPDATE integration_remote_devices\n          SET status = 'inactive',\n              revoked_at = COALESCE(revoked_at, ?),\n              updated_at = ?\n          WHERE id = ?\n            AND owner_email = ?\n            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)`,\n    args: [\n      now,\n      now,\n      input.id,\n      input.ownerEmail,\n      input.orgId ?? null,\n      input.orgId ?? null,\n    ],\n  });\n  return getRemoteDeviceForOwner(input);\n}\n\nexport async function unregisterRemoteDevice(id: string): Promise<boolean> {\n  await ensureTable();\n  const now = Date.now();\n  const result = await getDbExec().execute({\n    sql: `UPDATE integration_remote_devices\n          SET status = 'inactive',\n              revoked_at = COALESCE(revoked_at, ?),\n              updated_at = ?\n          WHERE id = ? AND status = 'active'`,\n    args: [now, now, id],\n  });\n  return (result.rowsAffected ?? (result as any).rowCount ?? 0) > 0;\n}\n\nexport async function hashRemoteDeviceToken(token: string): Promise<string> {\n  const bytes = new TextEncoder().encode(token);\n  const digest = await globalThis.crypto.subtle.digest(\"SHA-256\", bytes);\n  return bytesToHex(new Uint8Array(digest));\n}\n\nfunction sanitizeOptionalString(\n  value: string | null | undefined,\n  max: number,\n): string | null {\n  if (typeof value !== \"string\") return null;\n  const trimmed = value.trim();\n  return trimmed ? trimmed.slice(0, max) : null;\n}\n\nfunction parseJson(value: unknown, fallback: unknown): unknown {\n  if (value == null) return fallback;\n  try {\n    return JSON.parse(String(value));\n  } catch {\n    return fallback;\n  }\n}\n\nfunction serializeRemoteDeviceMetadata(\n  metadata: RemoteDeviceMetadata | null | undefined,\n): string | null {\n  if (!metadata) return null;\n  const normalized: RemoteDeviceMetadata = { ...metadata };\n  if (metadata.computerCapabilities !== undefined) {\n    normalized.computerCapabilities = normalizeComputerCapabilities(\n      metadata.computerCapabilities,\n    );\n  }\n  const json = JSON.stringify(normalized);\n  if (new TextEncoder().encode(json).byteLength > 32_768) {\n    throw new Error(\"Remote device metadata exceeds 32 KiB\");\n  }\n  if (/\"data:[^\"]*\"/i.test(json) || looksLikeLargeBase64(json)) {\n    throw new Error(\"Remote device metadata cannot contain binary payloads\");\n  }\n  return json;\n}\n\nfunction normalizeComputerCapabilities(\n  value: RemoteComputerCapabilities,\n): RemoteComputerCapabilities {\n  const result: RemoteComputerCapabilities = {};\n  if (value.browser && typeof value.browser === \"object\") {\n    result.browser = {\n      observe: value.browser.observe === true,\n      control: value.browser.control === true,\n      provider: sanitizeOptionalString(value.browser.provider, 120),\n      version: sanitizeOptionalString(value.browser.version, 120),\n    };\n  }\n  if (value.desktop && typeof value.desktop === \"object\") {\n    result.desktop = {\n      observe: value.desktop.observe === true,\n      control: value.desktop.control === true,\n      accessibility: value.desktop.accessibility === true,\n      screenCapture: value.desktop.screenCapture === true,\n      provider: sanitizeOptionalString(value.desktop.provider, 120),\n      version: sanitizeOptionalString(value.desktop.version, 120),\n    };\n  }\n  return result;\n}\n\nfunction looksLikeLargeBase64(value: string): boolean {\n  return value.length > 4_096 && /[A-Za-z0-9+/]{4_096,}={0,2}/.test(value);\n}\n\nfunction randomHex(byteLength: number): string {\n  const bytes = new Uint8Array(byteLength);\n  globalThis.crypto.getRandomValues(bytes);\n  return bytesToHex(bytes);\n}\n\nfunction bytesToHex(bytes: Uint8Array): string {\n  return Array.from(bytes)\n    .map((byte) => byte.toString(16).padStart(2, \"0\"))\n    .join(\"\");\n}\n"]}

package/dist/integrations/remote-json-safety.d.ts

@@ -0,0 +1,6 @@
+export declare function serializeBoundedRemoteJson(value: unknown, options: {
+    label: string;
+    maxBytes: number;
+}): string;
+export declare function assertNoBinaryPayload(value: unknown, label: string): void;
+//# sourceMappingURL=remote-json-safety.d.ts.map

package/dist/integrations/remote-json-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-json-safety.d.ts","sourceRoot":"","sources":["../../src/integrations/remote-json-safety.ts"],"names":[],"mappings":"AAkBA,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC3C,MAAM,CAgBR;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAuEzE"}

package/dist/integrations/remote-json-safety.js

@@ -0,0 +1,114 @@
+const DATA_URL_PATTERN = /data:[a-z][^;,]{0,100}[;,]/i;
+const BASE64_PREFIX_PATTERN = /(?:^|[,;])base64,/i;
+const MAX_TRAVERSAL_DEPTH = 20;
+const MAX_TRAVERSAL_NODES = 25_000;
+const BINARY_FIELD_NAMES = new Set([
+    "base64",
+    "dataurl",
+    "image",
+    "imagebase64",
+    "imagedata",
+    "imagebytes",
+    "screenshot",
+    "screenshotbase64",
+    "screenshotdata",
+    "bytes",
+    "buffer",
+]);
+export function serializeBoundedRemoteJson(value, options) {
+    assertNoBinaryPayload(value, options.label);
+    let json;
+    try {
+        json = JSON.stringify(value);
+    }
+    catch {
+        throw new Error(`${options.label} must contain only serializable JSON`);
+    }
+    if (json === undefined) {
+        throw new Error(`${options.label} must contain a JSON value`);
+    }
+    const bytes = new TextEncoder().encode(json).byteLength;
+    if (bytes > options.maxBytes) {
+        throw new Error(`${options.label} exceeds ${options.maxBytes} JSON bytes`);
+    }
+    return json;
+}
+export function assertNoBinaryPayload(value, label) {
+    let visited = 0;
+    const seen = new Set();
+    const visit = (entry, depth, key) => {
+        visited++;
+        if (visited > MAX_TRAVERSAL_NODES || depth > MAX_TRAVERSAL_DEPTH) {
+            throw new Error(`${label} is too deeply nested or complex`);
+        }
+        if (typeof entry === "string") {
+            const trimmed = entry.trim();
+            if (DATA_URL_PATTERN.test(trimmed) ||
+                BASE64_PREFIX_PATTERN.test(trimmed) ||
+                looksLikeBase64(trimmed) ||
+                (isBinaryFieldName(key) && trimmed.length > 0)) {
+                throw new Error(`${label} cannot contain screenshots, images, base64, or data URLs`);
+            }
+            return;
+        }
+        if (entry == null ||
+            typeof entry === "number" ||
+            typeof entry === "boolean") {
+            return;
+        }
+        if (typeof entry === "bigint" ||
+            typeof entry === "function" ||
+            typeof entry === "symbol" ||
+            typeof entry === "undefined") {
+            throw new Error(`${label} must contain only serializable JSON`);
+        }
+        if (ArrayBuffer.isView(entry) || entry instanceof ArrayBuffer) {
+            throw new Error(`${label} cannot contain binary buffers`);
+        }
+        if (typeof Blob !== "undefined" && entry instanceof Blob) {
+            throw new Error(`${label} cannot contain binary blobs`);
+        }
+        if (typeof entry !== "object")
+            return;
+        if (seen.has(entry)) {
+            throw new Error(`${label} must not contain circular values`);
+        }
+        seen.add(entry);
+        if (Array.isArray(entry)) {
+            if (isBinaryFieldName(key) && entry.length > 0) {
+                throw new Error(`${label} cannot contain binary arrays`);
+            }
+            for (const item of entry)
+                visit(item, depth + 1, key);
+            seen.delete(entry);
+            return;
+        }
+        const record = entry;
+        if (record.type === "Buffer" && Array.isArray(record.data)) {
+            throw new Error(`${label} cannot contain serialized buffers`);
+        }
+        for (const [childKey, child] of Object.entries(record)) {
+            if (isBinaryFieldName(childKey) && child != null) {
+                throw new Error(`${label} cannot contain screenshots, images, base64, or data URLs`);
+            }
+            visit(child, depth + 1, childKey);
+        }
+        seen.delete(entry);
+    };
+    visit(value, 0);
+}
+function isBinaryFieldName(key) {
+    if (!key)
+        return false;
+    const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
+    return BINARY_FIELD_NAMES.has(normalized);
+}
+function looksLikeBase64(value) {
+    if (value.length < 512)
+        return false;
+    const compact = value.replace(/[\r\n]/g, "");
+    return (compact.length >= 512 &&
+        compact.length % 4 === 0 &&
+        /^[A-Za-z0-9+/]+={0,2}$/.test(compact));
+}
+//# sourceMappingURL=remote-json-safety.js.map

package/dist/integrations/remote-json-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-json-safety.js","sourceRoot":"","sources":["../../src/integrations/remote-json-safety.ts"],"names":[],"mappings":"AAAA,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AACvD,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;AACnD,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,QAAQ;IACR,SAAS;IACT,OAAO;IACP,aAAa;IACb,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,kBAAkB;IAClB,gBAAgB;IAChB,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,UAAU,0BAA0B,CACxC,KAAc,EACd,OAA4C;IAE5C,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,IAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,4BAA4B,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;IACxD,IAAI,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,YAAY,OAAO,CAAC,QAAQ,aAAa,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc,EAAE,KAAa;IACjE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,KAAa,EAAE,GAAY,EAAQ,EAAE;QAClE,OAAO,EAAE,CAAC;QACV,IAAI,OAAO,GAAG,mBAAmB,IAAI,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kCAAkC,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC7B,IACE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC9B,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC;gBACnC,eAAe,CAAC,OAAO,CAAC;gBACxB,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EAC9C,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,2DAA2D,CACpE,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QACD,IACE,KAAK,IAAI,IAAI;YACb,OAAO,KAAK,KAAK,QAAQ;YACzB,OAAO,KAAK,KAAK,SAAS,EAC1B,CAAC;YACD,OAAO;QACT,CAAC;QACD,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,OAAO,KAAK,KAAK,UAAU;YAC3B,OAAO,KAAK,KAAK,QAAQ;YACzB,OAAO,KAAK,KAAK,WAAW,EAC5B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gCAAgC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,WAAW,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO;QACtC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAC;YAC3D,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;YACtD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;QAChE,CAAC;QACD,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,IAAI,iBAAiB,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,2DAA2D,CACpE,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC,CAAC;IACF,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAuB;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC/D,OAAO,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7C,OAAO,CACL,OAAO,CAAC,MAAM,IAAI,GAAG;QACrB,OAAO,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QACxB,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CACvC,CAAC;AACJ,CAAC","sourcesContent":["const DATA_URL_PATTERN = /data:[a-z][^;,]{0,100}[;,]/i;\nconst BASE64_PREFIX_PATTERN = /(?:^|[,;])base64,/i;\nconst MAX_TRAVERSAL_DEPTH = 20;\nconst MAX_TRAVERSAL_NODES = 25_000;\nconst BINARY_FIELD_NAMES = new Set([\n  \"base64\",\n  \"dataurl\",\n  \"image\",\n  \"imagebase64\",\n  \"imagedata\",\n  \"imagebytes\",\n  \"screenshot\",\n  \"screenshotbase64\",\n  \"screenshotdata\",\n  \"bytes\",\n  \"buffer\",\n]);\n\nexport function serializeBoundedRemoteJson(\n  value: unknown,\n  options: { label: string; maxBytes: number },\n): string {\n  assertNoBinaryPayload(value, options.label);\n  let json: string | undefined;\n  try {\n    json = JSON.stringify(value);\n  } catch {\n    throw new Error(`${options.label} must contain only serializable JSON`);\n  }\n  if (json === undefined) {\n    throw new Error(`${options.label} must contain a JSON value`);\n  }\n  const bytes = new TextEncoder().encode(json).byteLength;\n  if (bytes > options.maxBytes) {\n    throw new Error(`${options.label} exceeds ${options.maxBytes} JSON bytes`);\n  }\n  return json;\n}\n\nexport function assertNoBinaryPayload(value: unknown, label: string): void {\n  let visited = 0;\n  const seen = new Set<object>();\n  const visit = (entry: unknown, depth: number, key?: string): void => {\n    visited++;\n    if (visited > MAX_TRAVERSAL_NODES || depth > MAX_TRAVERSAL_DEPTH) {\n      throw new Error(`${label} is too deeply nested or complex`);\n    }\n    if (typeof entry === \"string\") {\n      const trimmed = entry.trim();\n      if (\n        DATA_URL_PATTERN.test(trimmed) ||\n        BASE64_PREFIX_PATTERN.test(trimmed) ||\n        looksLikeBase64(trimmed) ||\n        (isBinaryFieldName(key) && trimmed.length > 0)\n      ) {\n        throw new Error(\n          `${label} cannot contain screenshots, images, base64, or data URLs`,\n        );\n      }\n      return;\n    }\n    if (\n      entry == null ||\n      typeof entry === \"number\" ||\n      typeof entry === \"boolean\"\n    ) {\n      return;\n    }\n    if (\n      typeof entry === \"bigint\" ||\n      typeof entry === \"function\" ||\n      typeof entry === \"symbol\" ||\n      typeof entry === \"undefined\"\n    ) {\n      throw new Error(`${label} must contain only serializable JSON`);\n    }\n    if (ArrayBuffer.isView(entry) || entry instanceof ArrayBuffer) {\n      throw new Error(`${label} cannot contain binary buffers`);\n    }\n    if (typeof Blob !== \"undefined\" && entry instanceof Blob) {\n      throw new Error(`${label} cannot contain binary blobs`);\n    }\n    if (typeof entry !== \"object\") return;\n    if (seen.has(entry)) {\n      throw new Error(`${label} must not contain circular values`);\n    }\n    seen.add(entry);\n    if (Array.isArray(entry)) {\n      if (isBinaryFieldName(key) && entry.length > 0) {\n        throw new Error(`${label} cannot contain binary arrays`);\n      }\n      for (const item of entry) visit(item, depth + 1, key);\n      seen.delete(entry);\n      return;\n    }\n    const record = entry as Record<string, unknown>;\n    if (record.type === \"Buffer\" && Array.isArray(record.data)) {\n      throw new Error(`${label} cannot contain serialized buffers`);\n    }\n    for (const [childKey, child] of Object.entries(record)) {\n      if (isBinaryFieldName(childKey) && child != null) {\n        throw new Error(\n          `${label} cannot contain screenshots, images, base64, or data URLs`,\n        );\n      }\n      visit(child, depth + 1, childKey);\n    }\n    seen.delete(entry);\n  };\n  visit(value, 0);\n}\n\nfunction isBinaryFieldName(key: string | undefined): boolean {\n  if (!key) return false;\n  const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, \"\");\n  return BINARY_FIELD_NAMES.has(normalized);\n}\n\nfunction looksLikeBase64(value: string): boolean {\n  if (value.length < 512) return false;\n  const compact = value.replace(/[\\r\\n]/g, \"\");\n  return (\n    compact.length >= 512 &&\n    compact.length % 4 === 0 &&\n    /^[A-Za-z0-9+/]+={0,2}$/.test(compact)\n  );\n}\n"]}

package/dist/integrations/remote-run-events-store.d.ts

@@ -1,4 +1,4 @@
-import type { RemoteRunEvent } from "./remote-types.js";
+import type { RemoteLiveViewEvent, RemoteRunEvent } from "./remote-types.js";
 export declare function insertRemoteRunEvents(input: {
     deviceId: string;
     remoteRunId: string;
@@ -9,6 +9,16 @@ export declare function insertRemoteRunEvents(input: {
 }): Promise<{
     inserted: number;
 }>;
+export declare function insertRemoteLiveViewEvents(input: {
+    deviceId: string;
+    remoteRunId: string;
+    events: Array<{
+        seq: number;
+        event: RemoteLiveViewEvent;
+    }>;
+}): Promise<{
+    inserted: number;
+}>;
 export declare function listRemoteRunEvents(input: {
     deviceId: string;
     remoteRunId: string;

package/dist/integrations/remote-run-events-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-run-events-store.d.ts","sourceRoot":"","sources":["../../src/integrations/remote-run-events-store.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAoExD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAChD,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAwBhC;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAiB5B"}
+{"version":3,"file":"remote-run-events-store.d.ts","sourceRoot":"","sources":["../../src/integrations/remote-run-events-store.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAuE7E,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAChD,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAsChC;AAED,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAAC;CAC5D,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAQhC;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAiB5B"}

package/dist/integrations/remote-run-events-store.js

@@ -1,5 +1,8 @@
 import { getDbExec, isPostgres, intType, retryOnDdlRace, } from "../db/client.js";
 import { ensureTableExists, ensureIndexExists } from "../db/ddl-guard.js";
+import { serializeBoundedRemoteJson } from "./remote-json-safety.js";
+const MAX_EVENT_JSON_BYTES = 256_000;
+const MAX_EVENT_BATCH_JSON_BYTES = 1_000_000;
 let _initPromise;
 // Build the CREATE SQL lazily (not at module scope) so intType() runs at
 // RUNTIME, not import time — a module-scope call breaks any consumer whose
@@ -50,26 +53,49 @@ function rowToRunEvent(row) {
 }
 export async function insertRemoteRunEvents(input) {
     await ensureTable();
+    if (input.events.length === 0)
+        return { inserted: 0 };
+    if (input.events.length > 1_000) {
+        throw new Error("A remote run event batch cannot exceed 1,000 events");
+    }
     const client = getDbExec();
     const now = Date.now();
-    let inserted = 0;
-    for (const event of input.events) {
-        const result = await client.execute({
-            sql: `INSERT INTO integration_remote_run_events
-              (device_id, remote_run_id, seq, event_json, created_at)
-            VALUES (?, ?, ?, ?, ?)
-            ON CONFLICT(device_id, remote_run_id, seq) DO NOTHING`,
-            args: [
-                input.deviceId,
-                input.remoteRunId,
-                event.seq,
-                JSON.stringify(event.event ?? null),
-                now,
-            ],
+    const values = input.events.map(() => "(?, ?, ?, ?, ?)").join(", ");
+    let batchBytes = 0;
+    const args = input.events.flatMap((event) => {
+        const value = isLiveViewEvent(event.event)
+            ? normalizeLiveViewEvent(event.event)
+            : (event.event ?? null);
+        const eventJson = serializeBoundedRemoteJson(value, {
+            label: "Remote run event",
+            maxBytes: MAX_EVENT_JSON_BYTES,
         });
-        inserted += result.rowsAffected ?? result.rowCount ?? 0;
-    }
-    return { inserted };
+        batchBytes += new TextEncoder().encode(eventJson).byteLength;
+        if (batchBytes > MAX_EVENT_BATCH_JSON_BYTES) {
+            throw new Error(`Remote run event batch exceeds ${MAX_EVENT_BATCH_JSON_BYTES} JSON bytes`);
+        }
+        return [input.deviceId, input.remoteRunId, event.seq, eventJson, now];
+    });
+    const result = await client.execute({
+        sql: `INSERT INTO integration_remote_run_events
+            (device_id, remote_run_id, seq, event_json, created_at)
+          VALUES ${values}
+          ON CONFLICT(device_id, remote_run_id, seq) DO NOTHING`,
+        args,
+    });
+    return {
+        inserted: result.rowsAffected ??
+            Number(result.rowCount ?? 0),
+    };
+}
+export async function insertRemoteLiveViewEvents(input) {
+    return insertRemoteRunEvents({
+        ...input,
+        events: input.events.map(({ seq, event }) => ({
+            seq,
+            event: normalizeLiveViewEvent(event),
+        })),
+    });
 }
 export async function listRemoteRunEvents(input) {
     await ensureTable();
@@ -99,4 +125,46 @@ function parseJson(value, fallback) {
         return fallback;
     }
 }
+function normalizeLiveViewEvent(event) {
+    if (!event || event.type !== "computer.live-view") {
+        throw new Error("Invalid computer live-view event");
+    }
+    const frameHandle = sanitizeString(event.frameHandle, 240);
+    if (/^data:/i.test(frameHandle) || looksLikeLargeBase64(frameHandle)) {
+        throw new Error("Live-view frames must use ephemeral handles, not image data");
+    }
+    if (!Number.isSafeInteger(event.capturedAt) || event.capturedAt < 0) {
+        throw new Error("Live-view capturedAt must be an epoch timestamp");
+    }
+    return {
+        type: "computer.live-view",
+        frameHandle,
+        capturedAt: event.capturedAt,
+        width: boundedDimension(event.width),
+        height: boundedDimension(event.height),
+        targetLabel: event.targetLabel == null ? null : sanitizeString(event.targetLabel, 240),
+    };
+}
+function isLiveViewEvent(value) {
+    return (Boolean(value) &&
+        typeof value === "object" &&
+        value.type === "computer.live-view");
+}
+function boundedDimension(value) {
+    if (value == null)
+        return null;
+    if (!Number.isInteger(value) || value < 1 || value > 100_000) {
+        throw new Error("Live-view dimensions must be positive integers");
+    }
+    return value;
+}
+function sanitizeString(value, max) {
+    if (typeof value !== "string" || !value.trim() || value.length > max) {
+        throw new Error(`Expected a non-empty string of at most ${max} chars`);
+    }
+    return value.trim();
+}
+function looksLikeLargeBase64(value) {
+    return value.length > 512 && /^[A-Za-z0-9+/]+={0,2}$/.test(value);
+}
 //# sourceMappingURL=remote-run-events-store.js.map

package/dist/integrations/remote-run-events-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote-run-events-store.js","sourceRoot":"","sources":["../../src/integrations/remote-run-events-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,EACV,OAAO,EACP,cAAc,GACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAG1E,IAAI,YAAuC,CAAC;AAE5C,yEAAyE;AACzE,2EAA2E;AAC3E,6DAA6D;AAC7D,SAAS,cAAc;IACrB,OAAO;;;;UAIC,OAAO,EAAE;;iBAEF,OAAO,EAAE;;CAEzB,CAAC;AACF,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;YACnC,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,0FAA0F;gBAC1F,MAAM,iBAAiB,CAAC,+BAA+B,EAAE,SAAS,CAAC,CAAC;gBACpE,MAAM,iBAAiB,CACrB,8BAA8B,EAC9B,gIAAgI,CACjI,CAAC;gBACF,MAAM,iBAAiB,CACrB,2BAA2B,EAC3B,sHAAsH,CACvH,CAAC;gBACF,OAAO;YACT,CAAC;YACD,6CAA6C;YAC7C,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;YACtD,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CACZ,gIAAgI,CACjI,CACF,CAAC;YACF,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CACZ,sHAAsH,CACvH,CACF,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,sDAAsD;YACtD,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B;IACjD,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,SAAmB;QACjC,WAAW,EAAE,GAAG,CAAC,aAAuB;QACxC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QACzB,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC;QACtC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAI3C;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE;;;kEAGuD;YAC5D,IAAI,EAAE;gBACJ,KAAK,CAAC,QAAQ;gBACd,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,GAAG;gBACT,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC;gBACnC,GAAG;aACJ;SACF,CAAC,CAAC;QACH,QAAQ,IAAI,MAAM,CAAC,YAAY,IAAK,MAAc,CAAC,QAAQ,IAAI,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAKzC;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EAAE;;;;;kBAKS;QACd,IAAI,EAAE;YACJ,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;YACpB,KAAK,CAAC,KAAK,IAAI,GAAG;SACnB;KACF,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAA8B,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,QAAiB;IAClD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,QAAQ,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC","sourcesContent":["import {\n  getDbExec,\n  isPostgres,\n  intType,\n  retryOnDdlRace,\n} from \"../db/client.js\";\nimport { ensureTableExists, ensureIndexExists } from \"../db/ddl-guard.js\";\nimport type { RemoteRunEvent } from \"./remote-types.js\";\n\nlet _initPromise: Promise<void> | undefined;\n\n// Build the CREATE SQL lazily (not at module scope) so intType() runs at\n// RUNTIME, not import time — a module-scope call breaks any consumer whose\n// db/client mock doesn't stub intType (e.g. db-admin specs).\nfunction buildCreateSql(): string {\n  return `\n  CREATE TABLE IF NOT EXISTS integration_remote_run_events (\n    device_id TEXT NOT NULL,\n    remote_run_id TEXT NOT NULL,\n    seq ${intType()} NOT NULL,\n    event_json TEXT NOT NULL,\n    created_at ${intType()} NOT NULL\n  )\n`;\n}\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      const createSql = buildCreateSql();\n      if (isPostgres()) {\n        // PG guard: probe via information_schema, only issue DDL if missing, bounded lock_timeout\n        await ensureTableExists(\"integration_remote_run_events\", createSql);\n        await ensureIndexExists(\n          \"idx_remote_run_events_unique\",\n          `CREATE UNIQUE INDEX IF NOT EXISTS idx_remote_run_events_unique ON integration_remote_run_events(device_id, remote_run_id, seq)`,\n        );\n        await ensureIndexExists(\n          \"idx_remote_run_events_run\",\n          `CREATE INDEX IF NOT EXISTS idx_remote_run_events_run ON integration_remote_run_events(device_id, remote_run_id, seq)`,\n        );\n        return;\n      }\n      // SQLite (local dev): keep existing behavior\n      await retryOnDdlRace(() => client.execute(createSql));\n      await retryOnDdlRace(() =>\n        client.execute(\n          `CREATE UNIQUE INDEX IF NOT EXISTS idx_remote_run_events_unique ON integration_remote_run_events(device_id, remote_run_id, seq)`,\n        ),\n      );\n      await retryOnDdlRace(() =>\n        client.execute(\n          `CREATE INDEX IF NOT EXISTS idx_remote_run_events_run ON integration_remote_run_events(device_id, remote_run_id, seq)`,\n        ),\n      );\n    })().catch((err) => {\n      // Retry init on the next call after a failed startup.\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\nfunction rowToRunEvent(row: Record<string, unknown>): RemoteRunEvent {\n  return {\n    deviceId: row.device_id as string,\n    remoteRunId: row.remote_run_id as string,\n    seq: Number(row.seq ?? 0),\n    event: parseJson(row.event_json, null),\n    createdAt: Number(row.created_at ?? 0),\n  };\n}\n\nexport async function insertRemoteRunEvents(input: {\n  deviceId: string;\n  remoteRunId: string;\n  events: Array<{ seq: number; event: unknown }>;\n}): Promise<{ inserted: number }> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  let inserted = 0;\n\n  for (const event of input.events) {\n    const result = await client.execute({\n      sql: `INSERT INTO integration_remote_run_events\n              (device_id, remote_run_id, seq, event_json, created_at)\n            VALUES (?, ?, ?, ?, ?)\n            ON CONFLICT(device_id, remote_run_id, seq) DO NOTHING`,\n      args: [\n        input.deviceId,\n        input.remoteRunId,\n        event.seq,\n        JSON.stringify(event.event ?? null),\n        now,\n      ],\n    });\n    inserted += result.rowsAffected ?? (result as any).rowCount ?? 0;\n  }\n\n  return { inserted };\n}\n\nexport async function listRemoteRunEvents(input: {\n  deviceId: string;\n  remoteRunId: string;\n  afterSeq?: number;\n  limit?: number;\n}): Promise<RemoteRunEvent[]> {\n  await ensureTable();\n  const { rows } = await getDbExec().execute({\n    sql: `SELECT * FROM integration_remote_run_events\n          WHERE device_id = ?\n            AND remote_run_id = ?\n            AND seq > ?\n          ORDER BY seq ASC\n          LIMIT ?`,\n    args: [\n      input.deviceId,\n      input.remoteRunId,\n      input.afterSeq ?? -1,\n      input.limit ?? 500,\n    ],\n  });\n  return rows.map((row) => rowToRunEvent(row as Record<string, unknown>));\n}\n\nfunction parseJson(value: unknown, fallback: unknown): unknown {\n  if (value == null) return fallback;\n  try {\n    return JSON.parse(String(value));\n  } catch {\n    return fallback;\n  }\n}\n"]}
+{"version":3,"file":"remote-run-events-store.js","sourceRoot":"","sources":["../../src/integrations/remote-run-events-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,EACV,OAAO,EACP,cAAc,GACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAGrE,MAAM,oBAAoB,GAAG,OAAO,CAAC;AACrC,MAAM,0BAA0B,GAAG,SAAS,CAAC;AAE7C,IAAI,YAAuC,CAAC;AAE5C,yEAAyE;AACzE,2EAA2E;AAC3E,6DAA6D;AAC7D,SAAS,cAAc;IACrB,OAAO;;;;UAIC,OAAO,EAAE;;iBAEF,OAAO,EAAE;;CAEzB,CAAC;AACF,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;YACnC,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,0FAA0F;gBAC1F,MAAM,iBAAiB,CAAC,+BAA+B,EAAE,SAAS,CAAC,CAAC;gBACpE,MAAM,iBAAiB,CACrB,8BAA8B,EAC9B,gIAAgI,CACjI,CAAC;gBACF,MAAM,iBAAiB,CACrB,2BAA2B,EAC3B,sHAAsH,CACvH,CAAC;gBACF,OAAO;YACT,CAAC;YACD,6CAA6C;YAC7C,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;YACtD,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CACZ,gIAAgI,CACjI,CACF,CAAC;YACF,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CACZ,sHAAsH,CACvH,CACF,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,sDAAsD;YACtD,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B;IACjD,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,SAAmB;QACjC,WAAW,EAAE,GAAG,CAAC,aAAuB;QACxC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QACzB,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC;QACtC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAI3C;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACtD,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC;YACxC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC;YACrC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;QAC1B,MAAM,SAAS,GAAG,0BAA0B,CAAC,KAAK,EAAE;YAClD,KAAK,EAAE,kBAAkB;YACzB,QAAQ,EAAE,oBAAoB;SAC/B,CAAC,CAAC;QACH,UAAU,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC;QAC7D,IAAI,UAAU,GAAG,0BAA0B,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,kCAAkC,0BAA0B,aAAa,CAC1E,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE;;mBAEU,MAAM;gEACuC;QAC5D,IAAI;KACL,CAAC,CAAC;IACH,OAAO;QACL,QAAQ,EACN,MAAM,CAAC,YAAY;YACnB,MAAM,CAAE,MAAiC,CAAC,QAAQ,IAAI,CAAC,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAIhD;IACC,OAAO,qBAAqB,CAAC;QAC3B,GAAG,KAAK;QACR,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC5C,GAAG;YACH,KAAK,EAAE,sBAAsB,CAAC,KAAK,CAAC;SACrC,CAAC,CAAC;KACJ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAKzC;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EAAE;;;;;kBAKS;QACd,IAAI,EAAE;YACJ,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;YACpB,KAAK,CAAC,KAAK,IAAI,GAAG;SACnB;KACF,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAA8B,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,QAAiB;IAClD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,QAAQ,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAA0B;IAE1B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC3D,IAAI,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,WAAW;QACX,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC;QACpC,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC;QACtC,WAAW,EACT,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,CACL,OAAO,CAAC,KAAK,CAAC;QACd,OAAO,KAAK,KAAK,QAAQ;QACxB,KAA4B,CAAC,IAAI,KAAK,oBAAoB,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAgC;IACxD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,OAAO,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,GAAW;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,QAAQ,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC","sourcesContent":["import {\n  getDbExec,\n  isPostgres,\n  intType,\n  retryOnDdlRace,\n} from \"../db/client.js\";\nimport { ensureTableExists, ensureIndexExists } from \"../db/ddl-guard.js\";\nimport { serializeBoundedRemoteJson } from \"./remote-json-safety.js\";\nimport type { RemoteLiveViewEvent, RemoteRunEvent } from \"./remote-types.js\";\n\nconst MAX_EVENT_JSON_BYTES = 256_000;\nconst MAX_EVENT_BATCH_JSON_BYTES = 1_000_000;\n\nlet _initPromise: Promise<void> | undefined;\n\n// Build the CREATE SQL lazily (not at module scope) so intType() runs at\n// RUNTIME, not import time — a module-scope call breaks any consumer whose\n// db/client mock doesn't stub intType (e.g. db-admin specs).\nfunction buildCreateSql(): string {\n  return `\n  CREATE TABLE IF NOT EXISTS integration_remote_run_events (\n    device_id TEXT NOT NULL,\n    remote_run_id TEXT NOT NULL,\n    seq ${intType()} NOT NULL,\n    event_json TEXT NOT NULL,\n    created_at ${intType()} NOT NULL\n  )\n`;\n}\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      const createSql = buildCreateSql();\n      if (isPostgres()) {\n        // PG guard: probe via information_schema, only issue DDL if missing, bounded lock_timeout\n        await ensureTableExists(\"integration_remote_run_events\", createSql);\n        await ensureIndexExists(\n          \"idx_remote_run_events_unique\",\n          `CREATE UNIQUE INDEX IF NOT EXISTS idx_remote_run_events_unique ON integration_remote_run_events(device_id, remote_run_id, seq)`,\n        );\n        await ensureIndexExists(\n          \"idx_remote_run_events_run\",\n          `CREATE INDEX IF NOT EXISTS idx_remote_run_events_run ON integration_remote_run_events(device_id, remote_run_id, seq)`,\n        );\n        return;\n      }\n      // SQLite (local dev): keep existing behavior\n      await retryOnDdlRace(() => client.execute(createSql));\n      await retryOnDdlRace(() =>\n        client.execute(\n          `CREATE UNIQUE INDEX IF NOT EXISTS idx_remote_run_events_unique ON integration_remote_run_events(device_id, remote_run_id, seq)`,\n        ),\n      );\n      await retryOnDdlRace(() =>\n        client.execute(\n          `CREATE INDEX IF NOT EXISTS idx_remote_run_events_run ON integration_remote_run_events(device_id, remote_run_id, seq)`,\n        ),\n      );\n    })().catch((err) => {\n      // Retry init on the next call after a failed startup.\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\nfunction rowToRunEvent(row: Record<string, unknown>): RemoteRunEvent {\n  return {\n    deviceId: row.device_id as string,\n    remoteRunId: row.remote_run_id as string,\n    seq: Number(row.seq ?? 0),\n    event: parseJson(row.event_json, null),\n    createdAt: Number(row.created_at ?? 0),\n  };\n}\n\nexport async function insertRemoteRunEvents(input: {\n  deviceId: string;\n  remoteRunId: string;\n  events: Array<{ seq: number; event: unknown }>;\n}): Promise<{ inserted: number }> {\n  await ensureTable();\n  if (input.events.length === 0) return { inserted: 0 };\n  if (input.events.length > 1_000) {\n    throw new Error(\"A remote run event batch cannot exceed 1,000 events\");\n  }\n  const client = getDbExec();\n  const now = Date.now();\n  const values = input.events.map(() => \"(?, ?, ?, ?, ?)\").join(\", \");\n  let batchBytes = 0;\n  const args = input.events.flatMap((event) => {\n    const value = isLiveViewEvent(event.event)\n      ? normalizeLiveViewEvent(event.event)\n      : (event.event ?? null);\n    const eventJson = serializeBoundedRemoteJson(value, {\n      label: \"Remote run event\",\n      maxBytes: MAX_EVENT_JSON_BYTES,\n    });\n    batchBytes += new TextEncoder().encode(eventJson).byteLength;\n    if (batchBytes > MAX_EVENT_BATCH_JSON_BYTES) {\n      throw new Error(\n        `Remote run event batch exceeds ${MAX_EVENT_BATCH_JSON_BYTES} JSON bytes`,\n      );\n    }\n    return [input.deviceId, input.remoteRunId, event.seq, eventJson, now];\n  });\n  const result = await client.execute({\n    sql: `INSERT INTO integration_remote_run_events\n            (device_id, remote_run_id, seq, event_json, created_at)\n          VALUES ${values}\n          ON CONFLICT(device_id, remote_run_id, seq) DO NOTHING`,\n    args,\n  });\n  return {\n    inserted:\n      result.rowsAffected ??\n      Number((result as { rowCount?: unknown }).rowCount ?? 0),\n  };\n}\n\nexport async function insertRemoteLiveViewEvents(input: {\n  deviceId: string;\n  remoteRunId: string;\n  events: Array<{ seq: number; event: RemoteLiveViewEvent }>;\n}): Promise<{ inserted: number }> {\n  return insertRemoteRunEvents({\n    ...input,\n    events: input.events.map(({ seq, event }) => ({\n      seq,\n      event: normalizeLiveViewEvent(event),\n    })),\n  });\n}\n\nexport async function listRemoteRunEvents(input: {\n  deviceId: string;\n  remoteRunId: string;\n  afterSeq?: number;\n  limit?: number;\n}): Promise<RemoteRunEvent[]> {\n  await ensureTable();\n  const { rows } = await getDbExec().execute({\n    sql: `SELECT * FROM integration_remote_run_events\n          WHERE device_id = ?\n            AND remote_run_id = ?\n            AND seq > ?\n          ORDER BY seq ASC\n          LIMIT ?`,\n    args: [\n      input.deviceId,\n      input.remoteRunId,\n      input.afterSeq ?? -1,\n      input.limit ?? 500,\n    ],\n  });\n  return rows.map((row) => rowToRunEvent(row as Record<string, unknown>));\n}\n\nfunction parseJson(value: unknown, fallback: unknown): unknown {\n  if (value == null) return fallback;\n  try {\n    return JSON.parse(String(value));\n  } catch {\n    return fallback;\n  }\n}\n\nfunction normalizeLiveViewEvent(\n  event: RemoteLiveViewEvent,\n): RemoteLiveViewEvent {\n  if (!event || event.type !== \"computer.live-view\") {\n    throw new Error(\"Invalid computer live-view event\");\n  }\n  const frameHandle = sanitizeString(event.frameHandle, 240);\n  if (/^data:/i.test(frameHandle) || looksLikeLargeBase64(frameHandle)) {\n    throw new Error(\n      \"Live-view frames must use ephemeral handles, not image data\",\n    );\n  }\n  if (!Number.isSafeInteger(event.capturedAt) || event.capturedAt < 0) {\n    throw new Error(\"Live-view capturedAt must be an epoch timestamp\");\n  }\n  return {\n    type: \"computer.live-view\",\n    frameHandle,\n    capturedAt: event.capturedAt,\n    width: boundedDimension(event.width),\n    height: boundedDimension(event.height),\n    targetLabel:\n      event.targetLabel == null ? null : sanitizeString(event.targetLabel, 240),\n  };\n}\n\nfunction isLiveViewEvent(value: unknown): value is RemoteLiveViewEvent {\n  return (\n    Boolean(value) &&\n    typeof value === \"object\" &&\n    (value as { type?: unknown }).type === \"computer.live-view\"\n  );\n}\n\nfunction boundedDimension(value: number | null | undefined): number | null {\n  if (value == null) return null;\n  if (!Number.isInteger(value) || value < 1 || value > 100_000) {\n    throw new Error(\"Live-view dimensions must be positive integers\");\n  }\n  return value;\n}\n\nfunction sanitizeString(value: unknown, max: number): string {\n  if (typeof value !== \"string\" || !value.trim() || value.length > max) {\n    throw new Error(`Expected a non-empty string of at most ${max} chars`);\n  }\n  return value.trim();\n}\n\nfunction looksLikeLargeBase64(value: string): boolean {\n  return value.length > 512 && /^[A-Za-z0-9+/]+={0,2}$/.test(value);\n}\n"]}

package/dist/integrations/remote-types.d.ts

@@ -1,4 +1,46 @@
-export type RemoteCommandKind = "create-run" | "list-runs" | "get-run" | "append-followup" | "approve" | "deny" | "stop" | "status";
+export type RemoteCommandKind = "create-run" | "list-runs" | "get-run" | "append-followup" | "approve" | "deny" | "stop" | "status" | "computer-operation";
+export type ComputerOperationClass = "browser.observe" | "browser.control" | "desktop.observe" | "desktop.control";
+export type ComputerApprovalScope = "once" | "run" | "task";
+export interface ComputerCommandAction {
+    type: string;
+    target?: Record<string, unknown> | null;
+    input?: unknown;
+}
+export interface ComputerCommandEnvelope {
+    version: 1;
+    taskId: string;
+    runId: string;
+    sequence: number;
+    idempotencyKey: string;
+    operationClass: ComputerOperationClass;
+    action: ComputerCommandAction;
+    approval: {
+        id?: string | null;
+        scope: ComputerApprovalScope;
+        actionHash: string;
+    };
+    issuedAt: number;
+    leaseExpiresAt: number;
+}
+export interface RemoteComputerCapabilities {
+    browser?: {
+        observe: boolean;
+        control: boolean;
+        provider?: string | null;
+        version?: string | null;
+    };
+    desktop?: {
+        observe: boolean;
+        control: boolean;
+        accessibility?: boolean;
+        screenCapture?: boolean;
+        provider?: string | null;
+        version?: string | null;
+    };
+}
+export interface RemoteDeviceMetadata extends Record<string, unknown> {
+    computerCapabilities?: RemoteComputerCapabilities;
+}
 export type RemoteCommandStatus = "pending" | "claimed" | "running" | "completed" | "failed";
 export type RemoteDeviceStatus = "active" | "inactive";
 export interface RemoteDevice {
@@ -9,7 +51,7 @@ export interface RemoteDevice {
     platform: string | null;
     appVersion: string | null;
     hostName: string | null;
-    metadata: Record<string, unknown> | null;
+    metadata: RemoteDeviceMetadata | null;
     deviceTokenHash: string;
     lastSeenAt: number | null;
     status: RemoteDeviceStatus;
@@ -25,7 +67,7 @@ export interface PublicRemoteDevice {
     platform: string | null;
     appVersion: string | null;
     hostName: string | null;
-    metadata: Record<string, unknown> | null;
+    metadata: RemoteDeviceMetadata | null;
     lastSeenAt: number | null;
     status: RemoteDeviceStatus;
     revokedAt: number | null;
@@ -43,6 +85,7 @@ export interface RemoteCommand {
     result: unknown;
     platform: string | null;
     externalThreadId: string | null;
+    computerOperation?: ComputerCommandEnvelope | null;
     attempts: number;
     nextCheckAt: number;
     claimedAt: number | null;
@@ -58,6 +101,14 @@ export interface RemoteRunEvent {
     event: unknown;
     createdAt: number;
 }
+export interface RemoteLiveViewEvent {
+    type: "computer.live-view";
+    frameHandle: string;
+    capturedAt: number;
+    width?: number | null;
+    height?: number | null;
+    targetLabel?: string | null;
+}
 export type RemotePushRegistrationStatus = "active" | "inactive";
 export interface RemotePushRegistration {
     id: string;