@agent-native/core 0.93.0 → 0.94.0

package/dist/integrations/awaiting-input-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"awaiting-input-store.js","sourceRoot":"","sources":["../../src/integrations/awaiting-input-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,IAAI,WAAsC,CAAC;AAE3C,yEAAyE;AACzE,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAErE,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;YACxB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG;;;;;uBAKD,OAAO,EAAE;uBACT,OAAO,EAAE;uBACT,OAAO,EAAE;;;OAGzB,CAAC;YACF,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,MAAM,iBAAiB,CAAC,6BAA6B,EAAE,SAAS,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACnB,WAAW,GAAG,SAAS,CAAC;YACxB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAKjD;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,GAAG,GAAG,iCAAiC,CAAC;IAC7E,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,UAAU,EAAE;YACf,CAAC,CAAC;;;;;8CAKsC;YACxC,CAAC,CAAC;qCAC6B;QACjC,IAAI,EAAE;YACJ,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,gBAAgB;YACtB,WAAW;YACX,SAAS;YACT,GAAG;YACH,GAAG;SACJ;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAIrD;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,UAAU,EAAE;YACf,CAAC,CAAC;;;;;8BAKsB;YACxB,CAAC,CAAC;;;;gCAIwB;QAC5B,IAAI,EAAE;YACJ,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,gBAAgB;YACtB,KAAK,CAAC,WAAW;YACjB,IAAI,CAAC,GAAG,EAAE;SACX;KACF,CAAC,CAAC;IAEH,IAAI,UAAU,EAAE;QAAE,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACxD,MAAM,QAAQ,GACX,MAAuD,CAAC,YAAY;QACpE,MAAuD,CAAC,QAAQ;QACjE,CAAC,CAAC;IACJ,OAAO,QAAQ,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,QAAgB,EAChB,gBAAwB;IAExB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACxB,GAAG,EAAE,uFAAuF;QAC5F,IAAI,EAAE,CAAC,QAAQ,EAAE,gBAAgB,CAAC;KACnC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,2CAA2C;IACzD,WAAW,GAAG,SAAS,CAAC;AAC1B,CAAC","sourcesContent":["import { getDbExec, intType, isPostgres } from \"../db/client.js\";\nimport { ensureTableExists } from \"../db/ddl-guard.js\";\n\nlet initPromise: Promise<void> | undefined;\n\n/** Channel-thread clarification windows are deliberately short-lived. */\nexport const INTEGRATION_AWAITING_INPUT_TTL_MS = 24 * 60 * 60 * 1000;\n\nasync function ensureTable(): Promise<void> {\n  if (!initPromise) {\n    initPromise = (async () => {\n      const client = getDbExec();\n      const createSql = `\n        CREATE TABLE IF NOT EXISTS integration_awaiting_inputs (\n          platform TEXT NOT NULL,\n          external_thread_id TEXT NOT NULL,\n          requester_id TEXT NOT NULL,\n          expires_at ${intType()} NOT NULL,\n          created_at ${intType()} NOT NULL,\n          updated_at ${intType()} NOT NULL,\n          PRIMARY KEY (platform, external_thread_id)\n        )\n      `;\n      if (isPostgres()) {\n        await ensureTableExists(\"integration_awaiting_inputs\", createSql);\n        return;\n      }\n      await client.execute(createSql);\n    })().catch((error) => {\n      initPromise = undefined;\n      throw error;\n    });\n  }\n  return initPromise;\n}\n\n/**\n * Open (or refresh) the bounded reply window after an integration explicitly\n * asks the originating Slack user a question. The workspace-qualified external\n * thread id and requester id prevent unrelated channel messages from opting in.\n */\nexport async function setIntegrationAwaitingInput(input: {\n  platform: string;\n  externalThreadId: string;\n  requesterId: string;\n  expiresAt?: number;\n}): Promise<void> {\n  await ensureTable();\n  const requesterId = input.requesterId.trim();\n  if (!requesterId) throw new Error(\"requesterId is required\");\n  const now = Date.now();\n  const expiresAt = input.expiresAt ?? now + INTEGRATION_AWAITING_INPUT_TTL_MS;\n  const client = getDbExec();\n  await client.execute({\n    sql: isPostgres()\n      ? `INSERT INTO integration_awaiting_inputs (platform, external_thread_id, requester_id, expires_at, created_at, updated_at)\n           VALUES (?, ?, ?, ?, ?, ?)\n           ON CONFLICT (platform, external_thread_id) DO UPDATE SET\n             requester_id = EXCLUDED.requester_id,\n             expires_at = EXCLUDED.expires_at,\n             updated_at = EXCLUDED.updated_at`\n      : `INSERT OR REPLACE INTO integration_awaiting_inputs (platform, external_thread_id, requester_id, expires_at, created_at, updated_at)\n           VALUES (?, ?, ?, ?, ?, ?)`,\n    args: [\n      input.platform,\n      input.externalThreadId,\n      requesterId,\n      expiresAt,\n      now,\n      now,\n    ],\n  });\n}\n\n/**\n * Atomically consume the one reply window for this exact requester. Competing\n * Slack deliveries cannot both claim it, and expired rows never authorize a\n * later unmentioned reply.\n */\nexport async function consumeIntegrationAwaitingInput(input: {\n  platform: string;\n  externalThreadId: string;\n  requesterId: string;\n}): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const result = await client.execute({\n    sql: isPostgres()\n      ? `DELETE FROM integration_awaiting_inputs\n           WHERE platform = ?\n             AND external_thread_id = ?\n             AND requester_id = ?\n             AND expires_at > ?\n           RETURNING platform`\n      : `DELETE FROM integration_awaiting_inputs\n           WHERE platform = ?\n             AND external_thread_id = ?\n             AND requester_id = ?\n             AND expires_at > ?`,\n    args: [\n      input.platform,\n      input.externalThreadId,\n      input.requesterId,\n      Date.now(),\n    ],\n  });\n\n  if (isPostgres()) return (result.rows ?? []).length > 0;\n  const affected =\n    (result as { rowsAffected?: number; rowCount?: number }).rowsAffected ??\n    (result as { rowsAffected?: number; rowCount?: number }).rowCount ??\n    0;\n  return affected > 0;\n}\n\n/** Clear any outstanding clarification window once the thread resolves. */\nexport async function clearIntegrationAwaitingInput(\n  platform: string,\n  externalThreadId: string,\n): Promise<void> {\n  await ensureTable();\n  await getDbExec().execute({\n    sql: `DELETE FROM integration_awaiting_inputs WHERE platform = ? AND external_thread_id = ?`,\n    args: [platform, externalThreadId],\n  });\n}\n\nexport function _resetIntegrationAwaitingInputStoreForTests(): void {\n  initPromise = undefined;\n}\n"]}

package/dist/integrations/computer-supervision-store.d.ts

@@ -0,0 +1,65 @@
+import type { DbExec } from "../db/client.js";
+import type { ComputerApprovalScope, ComputerCommandEnvelope, ComputerOperationClass } from "./remote-types.js";
+export type ComputerApprovalStatus = "pending" | "approved" | "denied" | "consumed" | "expired";
+export interface ComputerApprovalRecord {
+    id: string;
+    ownerEmail: string;
+    orgId: string | null;
+    deviceId: string;
+    taskId: string;
+    runId: string;
+    operationClass: ComputerOperationClass;
+    scope: ComputerApprovalScope;
+    actionHash: string;
+    status: ComputerApprovalStatus;
+    decisionResult: Record<string, unknown> | null;
+    decidedBy: string | null;
+    decidedAt: number | null;
+    expiresAt: number;
+    consumedAt: number | null;
+    createdAt: number;
+    updatedAt: number;
+}
+export declare function ensureComputerApprovalStore(): Promise<void>;
+export declare function createComputerApprovalRequest(input: {
+    ownerEmail: string;
+    orgId?: string | null;
+    deviceId: string;
+    envelope: ComputerCommandEnvelope;
+}): Promise<ComputerApprovalRecord>;
+export declare function decideComputerApproval(input: {
+    id: string;
+    ownerEmail: string;
+    orgId?: string | null;
+    actionHash: string;
+    decision: "approved" | "denied";
+    decidedBy: string;
+    result?: Record<string, unknown> | null;
+}): Promise<ComputerApprovalRecord | null>;
+export declare function getComputerApprovalForOwner(input: {
+    id: string;
+    ownerEmail: string;
+    orgId?: string | null;
+}): Promise<ComputerApprovalRecord | null>;
+export declare function listComputerApprovalsForOwner(input: {
+    ownerEmail: string;
+    orgId?: string | null;
+    deviceId?: string;
+    taskId?: string;
+    runId?: string;
+    status?: ComputerApprovalStatus;
+    limit?: number;
+}): Promise<ComputerApprovalRecord[]>;
+/**
+ * Authorizes an operation immediately before it is enqueued. Callers should
+ * pass their transaction handle so one-shot approval consumption and command
+ * insertion commit atomically.
+ */
+export declare function authorizeComputerOperation(input: {
+    ownerEmail: string;
+    orgId?: string | null;
+    deviceId: string;
+    envelope: ComputerCommandEnvelope;
+    now?: number;
+}, client?: DbExec): Promise<void>;
+//# sourceMappingURL=computer-supervision-store.d.ts.map

package/dist/integrations/computer-supervision-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"computer-supervision-store.d.ts","sourceRoot":"","sources":["../../src/integrations/computer-supervision-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAe9C,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACvB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,sBAAsB,GAC9B,SAAS,GACT,UAAU,GACV,QAAQ,GACR,UAAU,GACV,SAAS,CAAC;AAEd,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,sBAAsB,CAAC;IACvC,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC,CAoDjE;AAED,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,uBAAuB,CAAC;CACnC,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAiDlC;AAED,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,UAAU,GAAG,QAAQ,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACzC,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CA2BzC;AAED,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAezC;AAED,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAoCpC;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,uBAAuB,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,EACD,MAAM,GAAE,MAAoB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAkFf"}

package/dist/integrations/computer-supervision-store.js

@@ -0,0 +1,296 @@
+import { getDbExec, intType, isPostgres, retryOnDdlRace, } from "../db/client.js";
+import { ensureIndexExists, ensureTableExists } from "../db/ddl-guard.js";
+import { assertValidComputerCommandEnvelope, ComputerSupervisionError, computerOperationRequiresApproval, } from "./computer-supervision.js";
+import { getRemoteDeviceForOwner } from "./remote-devices-store.js";
+import { serializeBoundedRemoteJson } from "./remote-json-safety.js";
+let _initPromise;
+export async function ensureComputerApprovalStore() {
+    if (!_initPromise) {
+        _initPromise = (async () => {
+            const createSql = `CREATE TABLE IF NOT EXISTS integration_computer_approvals (
+  id TEXT PRIMARY KEY,
+  owner_email TEXT NOT NULL,
+  org_id TEXT,
+  device_id TEXT NOT NULL,
+  task_id TEXT NOT NULL,
+  run_id TEXT NOT NULL,
+  operation_class TEXT NOT NULL,
+  approval_scope TEXT NOT NULL,
+  action_hash TEXT NOT NULL,
+  status TEXT NOT NULL,
+  decision_result_json TEXT,
+  decided_by TEXT,
+  decided_at ${intType()},
+  expires_at ${intType()} NOT NULL,
+  consumed_at ${intType()},
+  created_at ${intType()} NOT NULL,
+  updated_at ${intType()} NOT NULL
+)`;
+            if (isPostgres()) {
+                await ensureTableExists("integration_computer_approvals", createSql);
+                await ensureIndexExists("idx_computer_approvals_owner", `CREATE INDEX IF NOT EXISTS idx_computer_approvals_owner ON integration_computer_approvals(owner_email, org_id, updated_at)`);
+                await ensureIndexExists("idx_computer_approvals_binding", `CREATE INDEX IF NOT EXISTS idx_computer_approvals_binding ON integration_computer_approvals(device_id, task_id, run_id, action_hash)`);
+                return;
+            }
+            const client = getDbExec();
+            await retryOnDdlRace(() => client.execute(createSql));
+            await retryOnDdlRace(() => client.execute(`CREATE INDEX IF NOT EXISTS idx_computer_approvals_owner ON integration_computer_approvals(owner_email, org_id, updated_at)`));
+            await retryOnDdlRace(() => client.execute(`CREATE INDEX IF NOT EXISTS idx_computer_approvals_binding ON integration_computer_approvals(device_id, task_id, run_id, action_hash)`));
+        })().catch((error) => {
+            _initPromise = undefined;
+            throw error;
+        });
+    }
+    return _initPromise;
+}
+export async function createComputerApprovalRequest(input) {
+    const device = await getRemoteDeviceForOwner({
+        id: input.deviceId,
+        ownerEmail: input.ownerEmail,
+        orgId: input.orgId,
+    });
+    if (!device || device.status !== "active") {
+        throw new ComputerSupervisionError("approval-mismatch", "Computer device does not belong to this owner and organization");
+    }
+    await ensureComputerApprovalStore();
+    const envelope = await assertValidComputerCommandEnvelope(input.envelope);
+    const now = Date.now();
+    const id = `computer-approval-${now}-${randomHex(8)}`;
+    await getDbExec().execute({
+        sql: `INSERT INTO integration_computer_approvals
+      (id, owner_email, org_id, device_id, task_id, run_id, operation_class,
+       approval_scope, action_hash, status, decision_result_json, decided_by,
+       decided_at, expires_at, consumed_at, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        args: [
+            id,
+            input.ownerEmail,
+            input.orgId ?? null,
+            input.deviceId,
+            envelope.taskId,
+            envelope.runId,
+            envelope.operationClass,
+            envelope.approval.scope,
+            envelope.approval.actionHash,
+            "pending",
+            null,
+            null,
+            null,
+            envelope.leaseExpiresAt,
+            null,
+            now,
+            now,
+        ],
+    });
+    const approval = await getComputerApprovalForOwner({
+        id,
+        ownerEmail: input.ownerEmail,
+        orgId: input.orgId,
+    });
+    if (!approval)
+        throw new Error("computer approval insert failed");
+    return approval;
+}
+export async function decideComputerApproval(input) {
+    await ensureComputerApprovalStore();
+    const now = Date.now();
+    const resultJson = serializeDecisionResult(input.result);
+    const result = await getDbExec().execute({
+        sql: `UPDATE integration_computer_approvals
+          SET status = ?, decision_result_json = ?, decided_by = ?,
+              decided_at = ?, updated_at = ?
+          WHERE id = ? AND owner_email = ?
+            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)
+            AND action_hash = ? AND status = 'pending' AND expires_at > ?`,
+        args: [
+            input.decision,
+            resultJson,
+            input.decidedBy.slice(0, 240),
+            now,
+            now,
+            input.id,
+            input.ownerEmail,
+            input.orgId ?? null,
+            input.orgId ?? null,
+            input.actionHash,
+            now,
+        ],
+    });
+    if (affectedRows(result) === 0)
+        return null;
+    return getComputerApprovalForOwner(input);
+}
+export async function getComputerApprovalForOwner(input) {
+    await ensureComputerApprovalStore();
+    const { rows } = await getDbExec().execute({
+        sql: `SELECT * FROM integration_computer_approvals
+          WHERE id = ? AND owner_email = ?
+            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)
+          LIMIT 1`,
+        args: [
+            input.id,
+            input.ownerEmail,
+            input.orgId ?? null,
+            input.orgId ?? null,
+        ],
+    });
+    return rows[0] ? rowToApproval(rows[0]) : null;
+}
+export async function listComputerApprovalsForOwner(input) {
+    await ensureComputerApprovalStore();
+    const clauses = [
+        "owner_email = ?",
+        "((org_id IS NULL AND ? IS NULL) OR org_id = ?)",
+    ];
+    const args = [
+        input.ownerEmail,
+        input.orgId ?? null,
+        input.orgId ?? null,
+    ];
+    if (input.deviceId) {
+        clauses.push("device_id = ?");
+        args.push(input.deviceId);
+    }
+    if (input.taskId) {
+        clauses.push("task_id = ?");
+        args.push(input.taskId);
+    }
+    if (input.runId) {
+        clauses.push("run_id = ?");
+        args.push(input.runId);
+    }
+    if (input.status) {
+        clauses.push("status = ?");
+        args.push(input.status);
+    }
+    args.push(Math.max(1, Math.min(input.limit ?? 100, 250)));
+    const { rows } = await getDbExec().execute({
+        sql: `SELECT * FROM integration_computer_approvals
+          WHERE ${clauses.join(" AND ")}
+          ORDER BY updated_at DESC
+          LIMIT ?`,
+        args,
+    });
+    return rows.map((row) => rowToApproval(row));
+}
+/**
+ * Authorizes an operation immediately before it is enqueued. Callers should
+ * pass their transaction handle so one-shot approval consumption and command
+ * insertion commit atomically.
+ */
+export async function authorizeComputerOperation(input, client = getDbExec()) {
+    const now = input.now ?? Date.now();
+    if (input.envelope.leaseExpiresAt <= now) {
+        throw new ComputerSupervisionError("expired-lease", "Computer operation lease has expired");
+    }
+    if (!computerOperationRequiresApproval(input.envelope.operationClass))
+        return;
+    const approvalId = input.envelope.approval.id;
+    if (!approvalId) {
+        throw new ComputerSupervisionError("approval-required", "Computer control requires an approved action binding");
+    }
+    const { rows } = await client.execute({
+        sql: `SELECT * FROM integration_computer_approvals
+          WHERE id = ? AND owner_email = ?
+            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)
+            AND device_id = ? AND task_id = ? AND run_id = ?
+          LIMIT 1`,
+        args: [
+            approvalId,
+            input.ownerEmail,
+            input.orgId ?? null,
+            input.orgId ?? null,
+            input.deviceId,
+            input.envelope.taskId,
+            input.envelope.runId,
+        ],
+    });
+    if (!rows[0]) {
+        throw new ComputerSupervisionError("approval-mismatch", "Computer approval does not belong to this owner, device, task, and run");
+    }
+    const approval = rowToApproval(rows[0]);
+    if (approval.actionHash !== input.envelope.approval.actionHash ||
+        approval.operationClass !== input.envelope.operationClass ||
+        approval.scope !== input.envelope.approval.scope) {
+        throw new ComputerSupervisionError("approval-mismatch", "Computer approval does not match the requested action");
+    }
+    if (approval.expiresAt <= now) {
+        await client.execute({
+            sql: `UPDATE integration_computer_approvals
+            SET status = 'expired', updated_at = ?
+            WHERE id = ? AND status IN ('pending', 'approved')`,
+            args: [now, approval.id],
+        });
+        throw new ComputerSupervisionError("approval-denied", "Computer approval has expired");
+    }
+    if (approval.status !== "approved") {
+        throw new ComputerSupervisionError(approval.status === "consumed" ? "replay" : "approval-denied", approval.status === "consumed"
+            ? "One-shot computer approval has already been consumed"
+            : "Computer action is not approved");
+    }
+    if (approval.scope !== "once")
+        return;
+    const result = await client.execute({
+        sql: `UPDATE integration_computer_approvals
+          SET status = 'consumed', consumed_at = ?, updated_at = ?
+          WHERE id = ? AND status = 'approved'`,
+        args: [now, now, approval.id],
+    });
+    if (affectedRows(result) === 0) {
+        throw new ComputerSupervisionError("replay", "One-shot computer approval has already been consumed");
+    }
+}
+function rowToApproval(row) {
+    return {
+        id: String(row.id),
+        ownerEmail: String(row.owner_email),
+        orgId: row.org_id == null ? null : String(row.org_id),
+        deviceId: String(row.device_id),
+        taskId: String(row.task_id),
+        runId: String(row.run_id),
+        operationClass: row.operation_class,
+        scope: row.approval_scope,
+        actionHash: String(row.action_hash),
+        status: row.status,
+        decisionResult: parseRecord(row.decision_result_json),
+        decidedBy: row.decided_by == null ? null : String(row.decided_by),
+        decidedAt: row.decided_at == null ? null : Number(row.decided_at),
+        expiresAt: Number(row.expires_at),
+        consumedAt: row.consumed_at == null ? null : Number(row.consumed_at),
+        createdAt: Number(row.created_at),
+        updatedAt: Number(row.updated_at),
+    };
+}
+function serializeDecisionResult(result) {
+    if (!result)
+        return null;
+    return serializeBoundedRemoteJson(result, {
+        label: "Computer approval result",
+        maxBytes: 8_192,
+    });
+}
+function parseRecord(value) {
+    if (value == null)
+        return null;
+    try {
+        const parsed = JSON.parse(String(value));
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function affectedRows(result) {
+    return (result.rowsAffected ??
+        Number(result.rowCount ?? 0));
+}
+function randomHex(byteLength) {
+    const bytes = new Uint8Array(byteLength);
+    globalThis.crypto.getRandomValues(bytes);
+    return Array.from(bytes)
+        .map((byte) => byte.toString(16).padStart(2, "0"))
+        .join("");
+}
+//# sourceMappingURL=computer-supervision-store.js.map

package/dist/integrations/computer-supervision-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"computer-supervision-store.js","sourceRoot":"","sources":["../../src/integrations/computer-supervision-store.ts"],"names":[],"mappings":"AACA,OAAO,EACL,SAAS,EACT,OAAO,EACP,UAAU,EACV,cAAc,GACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,iCAAiC,GAClC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAkCrE,IAAI,YAAuC,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,2BAA2B;IAC/C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,SAAS,GAAG;;;;;;;;;;;;;eAaT,OAAO,EAAE;eACT,OAAO,EAAE;gBACR,OAAO,EAAE;eACV,OAAO,EAAE;eACT,OAAO,EAAE;EACtB,CAAC;YACG,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,MAAM,iBAAiB,CAAC,gCAAgC,EAAE,SAAS,CAAC,CAAC;gBACrE,MAAM,iBAAiB,CACrB,8BAA8B,EAC9B,4HAA4H,CAC7H,CAAC;gBACF,MAAM,iBAAiB,CACrB,gCAAgC,EAChC,sIAAsI,CACvI,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;YACtD,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CACZ,4HAA4H,CAC7H,CACF,CAAC;YACF,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CACZ,sIAAsI,CACvI,CACF,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACnB,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAKnD;IACC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;QAC3C,EAAE,EAAE,KAAK,CAAC,QAAQ;QAClB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,wBAAwB,CAChC,mBAAmB,EACnB,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,2BAA2B,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,kCAAkC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,qBAAqB,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACxB,GAAG,EAAE;;;;iEAIwD;QAC7D,IAAI,EAAE;YACJ,EAAE;YACF,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,KAAK,IAAI,IAAI;YACnB,KAAK,CAAC,QAAQ;YACd,QAAQ,CAAC,MAAM;YACf,QAAQ,CAAC,KAAK;YACd,QAAQ,CAAC,cAAc;YACvB,QAAQ,CAAC,QAAQ,CAAC,KAAK;YACvB,QAAQ,CAAC,QAAQ,CAAC,UAAU;YAC5B,SAAS;YACT,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,QAAQ,CAAC,cAAc;YACvB,IAAI;YACJ,GAAG;YACH,GAAG;SACJ;KACF,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,EAAE;QACF,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAClE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAQ5C;IACC,MAAM,2BAA2B,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACvC,GAAG,EAAE;;;;;0EAKiE;QACtE,IAAI,EAAE;YACJ,KAAK,CAAC,QAAQ;YACd,UAAU;YACV,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YAC7B,GAAG;YACH,GAAG;YACH,KAAK,CAAC,EAAE;YACR,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,KAAK,IAAI,IAAI;YACnB,KAAK,CAAC,KAAK,IAAI,IAAI;YACnB,KAAK,CAAC,UAAU;YAChB,GAAG;SACJ;KACF,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,2BAA2B,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IACC,MAAM,2BAA2B,EAAE,CAAC;IACpC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EAAE;;;kBAGS;QACd,IAAI,EAAE;YACJ,KAAK,CAAC,EAAE;YACR,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,KAAK,IAAI,IAAI;YACnB,KAAK,CAAC,KAAK,IAAI,IAAI;SACpB;KACF,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAA4B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAQnD;IACC,MAAM,2BAA2B,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG;QACd,iBAAiB;QACjB,gDAAgD;KACjD,CAAC;IACF,MAAM,IAAI,GAAkC;QAC1C,KAAK,CAAC,UAAU;QAChB,KAAK,CAAC,KAAK,IAAI,IAAI;QACnB,KAAK,CAAC,KAAK,IAAI,IAAI;KACpB,CAAC;IACF,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EAAE;kBACS,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;;kBAErB;QACd,IAAI;KACL,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAA8B,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAMC,EACD,MAAM,GAAW,SAAS,EAAE;IAE5B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACpC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,IAAI,GAAG,EAAE,CAAC;QACzC,MAAM,IAAI,wBAAwB,CAChC,eAAe,EACf,sCAAsC,CACvC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,iCAAiC,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO;IAC9E,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC9C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,wBAAwB,CAChC,mBAAmB,EACnB,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE;;;;kBAIS;QACd,IAAI,EAAE;YACJ,UAAU;YACV,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,KAAK,IAAI,IAAI;YACnB,KAAK,CAAC,KAAK,IAAI,IAAI;YACnB,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,QAAQ,CAAC,MAAM;YACrB,KAAK,CAAC,QAAQ,CAAC,KAAK;SACrB;KACF,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAChC,mBAAmB,EACnB,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAA4B,CAAC,CAAC;IACnE,IACE,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU;QAC1D,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,QAAQ,CAAC,cAAc;QACzD,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAChD,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,mBAAmB,EACnB,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE;;+DAEoD;YACzD,IAAI,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;SACzB,CAAC,CAAC;QACH,MAAM,IAAI,wBAAwB,CAChC,iBAAiB,EACjB,+BAA+B,CAChC,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,wBAAwB,CAChC,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,EAC7D,QAAQ,CAAC,MAAM,KAAK,UAAU;YAC5B,CAAC,CAAC,sDAAsD;YACxD,CAAC,CAAC,iCAAiC,CACtC,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,KAAK,MAAM;QAAE,OAAO;IACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE;;+CAEsC;QAC3C,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;KAC9B,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,wBAAwB,CAChC,QAAQ,EACR,sDAAsD,CACvD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B;IACjD,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;QACnC,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QACrD,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAC/B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QACzB,cAAc,EAAE,GAAG,CAAC,eAAyC;QAC7D,KAAK,EAAE,GAAG,CAAC,cAAuC;QAClD,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;QACnC,MAAM,EAAE,GAAG,CAAC,MAAgC;QAC5C,cAAc,EAAE,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACrD,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACjE,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACjE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACjC,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;QACpE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAkD;IAElD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,0BAA0B,CAAC,MAAM,EAAE;QACxC,KAAK,EAAE,0BAA0B;QACjC,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACzC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACnE,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAGrB;IACC,OAAO,CACL,MAAM,CAAC,YAAY;QACnB,MAAM,CAAE,MAAiC,CAAC,QAAQ,IAAI,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB;IACnC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACjD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC","sourcesContent":["import type { DbExec } from \"../db/client.js\";\nimport {\n  getDbExec,\n  intType,\n  isPostgres,\n  retryOnDdlRace,\n} from \"../db/client.js\";\nimport { ensureIndexExists, ensureTableExists } from \"../db/ddl-guard.js\";\nimport {\n  assertValidComputerCommandEnvelope,\n  ComputerSupervisionError,\n  computerOperationRequiresApproval,\n} from \"./computer-supervision.js\";\nimport { getRemoteDeviceForOwner } from \"./remote-devices-store.js\";\nimport { serializeBoundedRemoteJson } from \"./remote-json-safety.js\";\nimport type {\n  ComputerApprovalScope,\n  ComputerCommandEnvelope,\n  ComputerOperationClass,\n} from \"./remote-types.js\";\n\nexport type ComputerApprovalStatus =\n  | \"pending\"\n  | \"approved\"\n  | \"denied\"\n  | \"consumed\"\n  | \"expired\";\n\nexport interface ComputerApprovalRecord {\n  id: string;\n  ownerEmail: string;\n  orgId: string | null;\n  deviceId: string;\n  taskId: string;\n  runId: string;\n  operationClass: ComputerOperationClass;\n  scope: ComputerApprovalScope;\n  actionHash: string;\n  status: ComputerApprovalStatus;\n  decisionResult: Record<string, unknown> | null;\n  decidedBy: string | null;\n  decidedAt: number | null;\n  expiresAt: number;\n  consumedAt: number | null;\n  createdAt: number;\n  updatedAt: number;\n}\n\nlet _initPromise: Promise<void> | undefined;\n\nexport async function ensureComputerApprovalStore(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const createSql = `CREATE TABLE IF NOT EXISTS integration_computer_approvals (\n  id TEXT PRIMARY KEY,\n  owner_email TEXT NOT NULL,\n  org_id TEXT,\n  device_id TEXT NOT NULL,\n  task_id TEXT NOT NULL,\n  run_id TEXT NOT NULL,\n  operation_class TEXT NOT NULL,\n  approval_scope TEXT NOT NULL,\n  action_hash TEXT NOT NULL,\n  status TEXT NOT NULL,\n  decision_result_json TEXT,\n  decided_by TEXT,\n  decided_at ${intType()},\n  expires_at ${intType()} NOT NULL,\n  consumed_at ${intType()},\n  created_at ${intType()} NOT NULL,\n  updated_at ${intType()} NOT NULL\n)`;\n      if (isPostgres()) {\n        await ensureTableExists(\"integration_computer_approvals\", createSql);\n        await ensureIndexExists(\n          \"idx_computer_approvals_owner\",\n          `CREATE INDEX IF NOT EXISTS idx_computer_approvals_owner ON integration_computer_approvals(owner_email, org_id, updated_at)`,\n        );\n        await ensureIndexExists(\n          \"idx_computer_approvals_binding\",\n          `CREATE INDEX IF NOT EXISTS idx_computer_approvals_binding ON integration_computer_approvals(device_id, task_id, run_id, action_hash)`,\n        );\n        return;\n      }\n      const client = getDbExec();\n      await retryOnDdlRace(() => client.execute(createSql));\n      await retryOnDdlRace(() =>\n        client.execute(\n          `CREATE INDEX IF NOT EXISTS idx_computer_approvals_owner ON integration_computer_approvals(owner_email, org_id, updated_at)`,\n        ),\n      );\n      await retryOnDdlRace(() =>\n        client.execute(\n          `CREATE INDEX IF NOT EXISTS idx_computer_approvals_binding ON integration_computer_approvals(device_id, task_id, run_id, action_hash)`,\n        ),\n      );\n    })().catch((error) => {\n      _initPromise = undefined;\n      throw error;\n    });\n  }\n  return _initPromise;\n}\n\nexport async function createComputerApprovalRequest(input: {\n  ownerEmail: string;\n  orgId?: string | null;\n  deviceId: string;\n  envelope: ComputerCommandEnvelope;\n}): Promise<ComputerApprovalRecord> {\n  const device = await getRemoteDeviceForOwner({\n    id: input.deviceId,\n    ownerEmail: input.ownerEmail,\n    orgId: input.orgId,\n  });\n  if (!device || device.status !== \"active\") {\n    throw new ComputerSupervisionError(\n      \"approval-mismatch\",\n      \"Computer device does not belong to this owner and organization\",\n    );\n  }\n  await ensureComputerApprovalStore();\n  const envelope = await assertValidComputerCommandEnvelope(input.envelope);\n  const now = Date.now();\n  const id = `computer-approval-${now}-${randomHex(8)}`;\n  await getDbExec().execute({\n    sql: `INSERT INTO integration_computer_approvals\n      (id, owner_email, org_id, device_id, task_id, run_id, operation_class,\n       approval_scope, action_hash, status, decision_result_json, decided_by,\n       decided_at, expires_at, consumed_at, created_at, updated_at)\n      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      id,\n      input.ownerEmail,\n      input.orgId ?? null,\n      input.deviceId,\n      envelope.taskId,\n      envelope.runId,\n      envelope.operationClass,\n      envelope.approval.scope,\n      envelope.approval.actionHash,\n      \"pending\",\n      null,\n      null,\n      null,\n      envelope.leaseExpiresAt,\n      null,\n      now,\n      now,\n    ],\n  });\n  const approval = await getComputerApprovalForOwner({\n    id,\n    ownerEmail: input.ownerEmail,\n    orgId: input.orgId,\n  });\n  if (!approval) throw new Error(\"computer approval insert failed\");\n  return approval;\n}\n\nexport async function decideComputerApproval(input: {\n  id: string;\n  ownerEmail: string;\n  orgId?: string | null;\n  actionHash: string;\n  decision: \"approved\" | \"denied\";\n  decidedBy: string;\n  result?: Record<string, unknown> | null;\n}): Promise<ComputerApprovalRecord | null> {\n  await ensureComputerApprovalStore();\n  const now = Date.now();\n  const resultJson = serializeDecisionResult(input.result);\n  const result = await getDbExec().execute({\n    sql: `UPDATE integration_computer_approvals\n          SET status = ?, decision_result_json = ?, decided_by = ?,\n              decided_at = ?, updated_at = ?\n          WHERE id = ? AND owner_email = ?\n            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)\n            AND action_hash = ? AND status = 'pending' AND expires_at > ?`,\n    args: [\n      input.decision,\n      resultJson,\n      input.decidedBy.slice(0, 240),\n      now,\n      now,\n      input.id,\n      input.ownerEmail,\n      input.orgId ?? null,\n      input.orgId ?? null,\n      input.actionHash,\n      now,\n    ],\n  });\n  if (affectedRows(result) === 0) return null;\n  return getComputerApprovalForOwner(input);\n}\n\nexport async function getComputerApprovalForOwner(input: {\n  id: string;\n  ownerEmail: string;\n  orgId?: string | null;\n}): Promise<ComputerApprovalRecord | null> {\n  await ensureComputerApprovalStore();\n  const { rows } = await getDbExec().execute({\n    sql: `SELECT * FROM integration_computer_approvals\n          WHERE id = ? AND owner_email = ?\n            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)\n          LIMIT 1`,\n    args: [\n      input.id,\n      input.ownerEmail,\n      input.orgId ?? null,\n      input.orgId ?? null,\n    ],\n  });\n  return rows[0] ? rowToApproval(rows[0] as Record<string, unknown>) : null;\n}\n\nexport async function listComputerApprovalsForOwner(input: {\n  ownerEmail: string;\n  orgId?: string | null;\n  deviceId?: string;\n  taskId?: string;\n  runId?: string;\n  status?: ComputerApprovalStatus;\n  limit?: number;\n}): Promise<ComputerApprovalRecord[]> {\n  await ensureComputerApprovalStore();\n  const clauses = [\n    \"owner_email = ?\",\n    \"((org_id IS NULL AND ? IS NULL) OR org_id = ?)\",\n  ];\n  const args: Array<string | number | null> = [\n    input.ownerEmail,\n    input.orgId ?? null,\n    input.orgId ?? null,\n  ];\n  if (input.deviceId) {\n    clauses.push(\"device_id = ?\");\n    args.push(input.deviceId);\n  }\n  if (input.taskId) {\n    clauses.push(\"task_id = ?\");\n    args.push(input.taskId);\n  }\n  if (input.runId) {\n    clauses.push(\"run_id = ?\");\n    args.push(input.runId);\n  }\n  if (input.status) {\n    clauses.push(\"status = ?\");\n    args.push(input.status);\n  }\n  args.push(Math.max(1, Math.min(input.limit ?? 100, 250)));\n  const { rows } = await getDbExec().execute({\n    sql: `SELECT * FROM integration_computer_approvals\n          WHERE ${clauses.join(\" AND \")}\n          ORDER BY updated_at DESC\n          LIMIT ?`,\n    args,\n  });\n  return rows.map((row) => rowToApproval(row as Record<string, unknown>));\n}\n\n/**\n * Authorizes an operation immediately before it is enqueued. Callers should\n * pass their transaction handle so one-shot approval consumption and command\n * insertion commit atomically.\n */\nexport async function authorizeComputerOperation(\n  input: {\n    ownerEmail: string;\n    orgId?: string | null;\n    deviceId: string;\n    envelope: ComputerCommandEnvelope;\n    now?: number;\n  },\n  client: DbExec = getDbExec(),\n): Promise<void> {\n  const now = input.now ?? Date.now();\n  if (input.envelope.leaseExpiresAt <= now) {\n    throw new ComputerSupervisionError(\n      \"expired-lease\",\n      \"Computer operation lease has expired\",\n    );\n  }\n  if (!computerOperationRequiresApproval(input.envelope.operationClass)) return;\n  const approvalId = input.envelope.approval.id;\n  if (!approvalId) {\n    throw new ComputerSupervisionError(\n      \"approval-required\",\n      \"Computer control requires an approved action binding\",\n    );\n  }\n  const { rows } = await client.execute({\n    sql: `SELECT * FROM integration_computer_approvals\n          WHERE id = ? AND owner_email = ?\n            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)\n            AND device_id = ? AND task_id = ? AND run_id = ?\n          LIMIT 1`,\n    args: [\n      approvalId,\n      input.ownerEmail,\n      input.orgId ?? null,\n      input.orgId ?? null,\n      input.deviceId,\n      input.envelope.taskId,\n      input.envelope.runId,\n    ],\n  });\n  if (!rows[0]) {\n    throw new ComputerSupervisionError(\n      \"approval-mismatch\",\n      \"Computer approval does not belong to this owner, device, task, and run\",\n    );\n  }\n  const approval = rowToApproval(rows[0] as Record<string, unknown>);\n  if (\n    approval.actionHash !== input.envelope.approval.actionHash ||\n    approval.operationClass !== input.envelope.operationClass ||\n    approval.scope !== input.envelope.approval.scope\n  ) {\n    throw new ComputerSupervisionError(\n      \"approval-mismatch\",\n      \"Computer approval does not match the requested action\",\n    );\n  }\n  if (approval.expiresAt <= now) {\n    await client.execute({\n      sql: `UPDATE integration_computer_approvals\n            SET status = 'expired', updated_at = ?\n            WHERE id = ? AND status IN ('pending', 'approved')`,\n      args: [now, approval.id],\n    });\n    throw new ComputerSupervisionError(\n      \"approval-denied\",\n      \"Computer approval has expired\",\n    );\n  }\n  if (approval.status !== \"approved\") {\n    throw new ComputerSupervisionError(\n      approval.status === \"consumed\" ? \"replay\" : \"approval-denied\",\n      approval.status === \"consumed\"\n        ? \"One-shot computer approval has already been consumed\"\n        : \"Computer action is not approved\",\n    );\n  }\n  if (approval.scope !== \"once\") return;\n  const result = await client.execute({\n    sql: `UPDATE integration_computer_approvals\n          SET status = 'consumed', consumed_at = ?, updated_at = ?\n          WHERE id = ? AND status = 'approved'`,\n    args: [now, now, approval.id],\n  });\n  if (affectedRows(result) === 0) {\n    throw new ComputerSupervisionError(\n      \"replay\",\n      \"One-shot computer approval has already been consumed\",\n    );\n  }\n}\n\nfunction rowToApproval(row: Record<string, unknown>): ComputerApprovalRecord {\n  return {\n    id: String(row.id),\n    ownerEmail: String(row.owner_email),\n    orgId: row.org_id == null ? null : String(row.org_id),\n    deviceId: String(row.device_id),\n    taskId: String(row.task_id),\n    runId: String(row.run_id),\n    operationClass: row.operation_class as ComputerOperationClass,\n    scope: row.approval_scope as ComputerApprovalScope,\n    actionHash: String(row.action_hash),\n    status: row.status as ComputerApprovalStatus,\n    decisionResult: parseRecord(row.decision_result_json),\n    decidedBy: row.decided_by == null ? null : String(row.decided_by),\n    decidedAt: row.decided_at == null ? null : Number(row.decided_at),\n    expiresAt: Number(row.expires_at),\n    consumedAt: row.consumed_at == null ? null : Number(row.consumed_at),\n    createdAt: Number(row.created_at),\n    updatedAt: Number(row.updated_at),\n  };\n}\n\nfunction serializeDecisionResult(\n  result: Record<string, unknown> | null | undefined,\n): string | null {\n  if (!result) return null;\n  return serializeBoundedRemoteJson(result, {\n    label: \"Computer approval result\",\n    maxBytes: 8_192,\n  });\n}\n\nfunction parseRecord(value: unknown): Record<string, unknown> | null {\n  if (value == null) return null;\n  try {\n    const parsed = JSON.parse(String(value));\n    return parsed && typeof parsed === \"object\" && !Array.isArray(parsed)\n      ? (parsed as Record<string, unknown>)\n      : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction affectedRows(result: {\n  rowsAffected?: number;\n  rows?: unknown[];\n}): number {\n  return (\n    result.rowsAffected ??\n    Number((result as { rowCount?: unknown }).rowCount ?? 0)\n  );\n}\n\nfunction randomHex(byteLength: number): string {\n  const bytes = new Uint8Array(byteLength);\n  globalThis.crypto.getRandomValues(bytes);\n  return Array.from(bytes)\n    .map((byte) => byte.toString(16).padStart(2, \"0\"))\n    .join(\"\");\n}\n"]}

package/dist/integrations/computer-supervision.d.ts

@@ -0,0 +1,11 @@
+import type { ComputerCommandEnvelope, ComputerOperationClass } from "./remote-types.js";
+export declare class ComputerSupervisionError extends Error {
+    readonly code: "invalid-envelope" | "expired-lease" | "action-hash-mismatch" | "approval-required" | "approval-denied" | "approval-mismatch" | "replay";
+    constructor(code: "invalid-envelope" | "expired-lease" | "action-hash-mismatch" | "approval-required" | "approval-denied" | "approval-mismatch" | "replay", message: string);
+}
+export declare function computerOperationRequiresApproval(operationClass: ComputerOperationClass): boolean;
+export declare function computeComputerActionHash(envelope: Pick<ComputerCommandEnvelope, "version" | "taskId" | "runId" | "sequence" | "operationClass" | "action">): Promise<string>;
+export declare function assertValidComputerCommandEnvelope(value: unknown, options?: {
+    now?: number;
+}): Promise<ComputerCommandEnvelope>;
+//# sourceMappingURL=computer-supervision.d.ts.map

package/dist/integrations/computer-supervision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"computer-supervision.d.ts","sourceRoot":"","sources":["../../src/integrations/computer-supervision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,sBAAsB,EACvB,MAAM,mBAAmB,CAAC;AAY3B,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,IAAI,EAChB,kBAAkB,GAClB,eAAe,GACf,sBAAsB,GACtB,mBAAmB,GACnB,iBAAiB,GACjB,mBAAmB,GACnB,QAAQ;IARd,YACkB,IAAI,EAChB,kBAAkB,GAClB,eAAe,GACf,sBAAsB,GACtB,mBAAmB,GACnB,iBAAiB,GACjB,mBAAmB,GACnB,QAAQ,EACZ,OAAO,EAAE,MAAM,EAIhB;CACF;AAED,wBAAgB,iCAAiC,CAC/C,cAAc,EAAE,sBAAsB,GACrC,OAAO,CAET;AAED,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,IAAI,CACZ,uBAAuB,EACvB,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,gBAAgB,GAAG,QAAQ,CAC1E,GACA,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,wBAAsB,kCAAkC,CACtD,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACzB,OAAO,CAAC,uBAAuB,CAAC,CA6FlC"}

package/dist/integrations/computer-supervision.js

@@ -0,0 +1,160 @@
+const OPERATION_CLASSES = new Set([
+    "browser.observe",
+    "browser.control",
+    "desktop.observe",
+    "desktop.control",
+]);
+const APPROVAL_SCOPES = new Set(["once", "run", "task"]);
+const MAX_ACTION_BYTES = 32_768;
+const MAX_LEASE_MS = 24 * 60 * 60_000;
+export class ComputerSupervisionError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "ComputerSupervisionError";
+    }
+}
+export function computerOperationRequiresApproval(operationClass) {
+    return operationClass.endsWith(".control");
+}
+export async function computeComputerActionHash(envelope) {
+    const canonical = stableJson({
+        version: envelope.version,
+        taskId: envelope.taskId,
+        runId: envelope.runId,
+        sequence: envelope.sequence,
+        operationClass: envelope.operationClass,
+        action: envelope.action,
+    });
+    const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonical));
+    return Array.from(new Uint8Array(digest))
+        .map((byte) => byte.toString(16).padStart(2, "0"))
+        .join("");
+}
+export async function assertValidComputerCommandEnvelope(value, options) {
+    if (!isRecord(value)) {
+        throw invalid("Computer command envelope must be an object");
+    }
+    if (value.version !== 1) {
+        throw invalid("Unsupported computer command envelope version");
+    }
+    const taskId = boundedString(value.taskId, "taskId", 200);
+    const runId = boundedString(value.runId, "runId", 200);
+    const idempotencyKey = boundedString(value.idempotencyKey, "idempotencyKey", 200);
+    if (!Number.isSafeInteger(value.sequence) || Number(value.sequence) < 0) {
+        throw invalid("sequence must be a non-negative safe integer");
+    }
+    if (!OPERATION_CLASSES.has(value.operationClass)) {
+        throw invalid("Unknown computer operation class");
+    }
+    if (!isRecord(value.action)) {
+        throw invalid("action must be an object");
+    }
+    boundedString(value.action.type, "action.type", 120);
+    const actionJson = stableJson(value.action);
+    if (new TextEncoder().encode(actionJson).byteLength > MAX_ACTION_BYTES) {
+        throw invalid("Computer action exceeds the 32 KiB metadata limit");
+    }
+    if (!isRecord(value.approval)) {
+        throw invalid("approval binding is required");
+    }
+    if (!APPROVAL_SCOPES.has(value.approval.scope)) {
+        throw invalid("Unknown computer approval scope");
+    }
+    const actionHash = boundedString(value.approval.actionHash, "approval.actionHash", 64).toLowerCase();
+    if (!/^[a-f0-9]{64}$/.test(actionHash)) {
+        throw invalid("approval.actionHash must be a SHA-256 hex digest");
+    }
+    const approvalId = value.approval.id == null
+        ? null
+        : boundedString(value.approval.id, "approval.id", 240);
+    if (!Number.isSafeInteger(value.issuedAt) || Number(value.issuedAt) < 0) {
+        throw invalid("issuedAt must be a valid epoch timestamp");
+    }
+    if (!Number.isSafeInteger(value.leaseExpiresAt) ||
+        Number(value.leaseExpiresAt) < 0) {
+        throw invalid("leaseExpiresAt must be a valid epoch timestamp");
+    }
+    const now = options?.now ?? Date.now();
+    const issuedAt = Number(value.issuedAt);
+    const leaseExpiresAt = Number(value.leaseExpiresAt);
+    if (leaseExpiresAt <= now || leaseExpiresAt <= issuedAt) {
+        throw new ComputerSupervisionError("expired-lease", "Computer operation lease has expired");
+    }
+    if (leaseExpiresAt - issuedAt > MAX_LEASE_MS) {
+        throw invalid("Computer operation lease cannot exceed 24 hours");
+    }
+    const envelope = {
+        version: 1,
+        taskId,
+        runId,
+        sequence: Number(value.sequence),
+        idempotencyKey,
+        operationClass: value.operationClass,
+        action: value.action,
+        approval: {
+            id: approvalId,
+            scope: value.approval
+                .scope,
+            actionHash,
+        },
+        issuedAt,
+        leaseExpiresAt,
+    };
+    const expectedHash = await computeComputerActionHash(envelope);
+    if (expectedHash !== actionHash) {
+        throw new ComputerSupervisionError("action-hash-mismatch", "Computer operation does not match its approved action hash");
+    }
+    return envelope;
+}
+function stableJson(value) {
+    const seen = new Set();
+    const normalize = (entry, depth) => {
+        if (depth > 12)
+            throw invalid("Computer action is nested too deeply");
+        if (entry === null ||
+            typeof entry === "string" ||
+            typeof entry === "boolean") {
+            if (typeof entry === "string" &&
+                (/^data:/i.test(entry) || looksLikeLargeBase64(entry))) {
+                throw invalid("Binary or data URL payloads are not allowed");
+            }
+            return entry;
+        }
+        if (typeof entry === "number" && Number.isFinite(entry))
+            return entry;
+        if (Array.isArray(entry)) {
+            return entry.map((item) => normalize(item, depth + 1));
+        }
+        if (!isRecord(entry)) {
+            throw invalid("Computer actions must contain only JSON values");
+        }
+        if (seen.has(entry))
+            throw invalid("Computer action contains a cycle");
+        seen.add(entry);
+        const result = {};
+        for (const key of Object.keys(entry).sort()) {
+            result[key] = normalize(entry[key], depth + 1);
+        }
+        seen.delete(entry);
+        return result;
+    };
+    return JSON.stringify(normalize(value, 0));
+}
+function looksLikeLargeBase64(value) {
+    return value.length > 512 && /^[A-Za-z0-9+/]+={0,2}$/.test(value);
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function boundedString(value, name, max) {
+    if (typeof value !== "string" || !value.trim() || value.length > max) {
+        throw invalid(`${name} must be a non-empty string of at most ${max} chars`);
+    }
+    return value.trim();
+}
+function invalid(message) {
+    return new ComputerSupervisionError("invalid-envelope", message);
+}
+//# sourceMappingURL=computer-supervision.js.map

package/dist/integrations/computer-supervision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"computer-supervision.js","sourceRoot":"","sources":["../../src/integrations/computer-supervision.ts"],"names":[],"mappings":"AAKA,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAyB;IACxD,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;CAClB,CAAC,CAAC;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAU,CAAC,CAAC;AAClE,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAEtC,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAE/B,IAAI;IADtB,YACkB,IAOJ,EACZ,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;oBAVC,IAAI;QAWpB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,UAAU,iCAAiC,CAC/C,cAAsC;IAEtC,OAAO,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAGC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC;QAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,MAAM,EAAE,QAAQ,CAAC,MAAM;KACxB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAClD,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACpC,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACjD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAAc,EACd,OAA0B;IAE1B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,OAAO,CAAC,6CAA6C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,CAAC,+CAA+C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,aAAa,CAClC,KAAK,CAAC,cAAc,EACpB,gBAAgB,EAChB,GAAG,CACJ,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxE,MAAM,OAAO,CAAC,8CAA8C,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,cAAwC,CAAC,EAAE,CAAC;QAC3E,MAAM,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC5C,CAAC;IACD,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,UAAU,GAAG,gBAAgB,EAAE,CAAC;QACvE,MAAM,OAAO,CAAC,mDAAmD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAY,CAAC,EAAE,CAAC;QACtD,MAAM,OAAO,CAAC,iCAAiC,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,UAAU,GAAG,aAAa,CAC9B,KAAK,CAAC,QAAQ,CAAC,UAAU,EACzB,qBAAqB,EACrB,EAAE,CACH,CAAC,WAAW,EAAE,CAAC;IAChB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,CAAC,kDAAkD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,UAAU,GACd,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI;QACvB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxE,MAAM,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAC5D,CAAC;IACD,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,EAChC,CAAC;QACD,MAAM,OAAO,CAAC,gDAAgD,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACpD,IAAI,cAAc,IAAI,GAAG,IAAI,cAAc,IAAI,QAAQ,EAAE,CAAC;QACxD,MAAM,IAAI,wBAAwB,CAChC,eAAe,EACf,sCAAsC,CACvC,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,GAAG,QAAQ,GAAG,YAAY,EAAE,CAAC;QAC7C,MAAM,OAAO,CAAC,iDAAiD,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,QAAQ,GAA4B;QACxC,OAAO,EAAE,CAAC;QACV,MAAM;QACN,KAAK;QACL,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;QAChC,cAAc;QACd,cAAc,EAAE,KAAK,CAAC,cAAwC;QAC9D,MAAM,EAAE,KAAK,CAAC,MAA2C;QACzD,QAAQ,EAAE;YACR,EAAE,EAAE,UAAU;YACd,KAAK,EAAE,KAAK,CAAC,QAAQ;iBAClB,KAAqD;YACxD,UAAU;SACX;QACD,QAAQ;QACR,cAAc;KACf,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,wBAAwB,CAChC,sBAAsB,EACtB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,KAAa,EAAW,EAAE;QAC3D,IAAI,KAAK,GAAG,EAAE;YAAE,MAAM,OAAO,CAAC,sCAAsC,CAAC,CAAC;QACtE,IACE,KAAK,KAAK,IAAI;YACd,OAAO,KAAK,KAAK,QAAQ;YACzB,OAAO,KAAK,KAAK,SAAS,EAC1B,CAAC;YACD,IACE,OAAO,KAAK,KAAK,QAAQ;gBACzB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC,EACtD,CAAC;gBACD,MAAM,OAAO,CAAC,6CAA6C,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,OAAO,CAAC,gDAAgD,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM,OAAO,CAAC,kCAAkC,CAAC,CAAC;QACvE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5C,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,IAAY,EAAE,GAAW;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACrE,MAAM,OAAO,CAAC,GAAG,IAAI,0CAA0C,GAAG,QAAQ,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,IAAI,wBAAwB,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;AACnE,CAAC","sourcesContent":["import type {\n  ComputerCommandEnvelope,\n  ComputerOperationClass,\n} from \"./remote-types.js\";\n\nconst OPERATION_CLASSES = new Set<ComputerOperationClass>([\n  \"browser.observe\",\n  \"browser.control\",\n  \"desktop.observe\",\n  \"desktop.control\",\n]);\nconst APPROVAL_SCOPES = new Set([\"once\", \"run\", \"task\"] as const);\nconst MAX_ACTION_BYTES = 32_768;\nconst MAX_LEASE_MS = 24 * 60 * 60_000;\n\nexport class ComputerSupervisionError extends Error {\n  constructor(\n    public readonly code:\n      | \"invalid-envelope\"\n      | \"expired-lease\"\n      | \"action-hash-mismatch\"\n      | \"approval-required\"\n      | \"approval-denied\"\n      | \"approval-mismatch\"\n      | \"replay\",\n    message: string,\n  ) {\n    super(message);\n    this.name = \"ComputerSupervisionError\";\n  }\n}\n\nexport function computerOperationRequiresApproval(\n  operationClass: ComputerOperationClass,\n): boolean {\n  return operationClass.endsWith(\".control\");\n}\n\nexport async function computeComputerActionHash(\n  envelope: Pick<\n    ComputerCommandEnvelope,\n    \"version\" | \"taskId\" | \"runId\" | \"sequence\" | \"operationClass\" | \"action\"\n  >,\n): Promise<string> {\n  const canonical = stableJson({\n    version: envelope.version,\n    taskId: envelope.taskId,\n    runId: envelope.runId,\n    sequence: envelope.sequence,\n    operationClass: envelope.operationClass,\n    action: envelope.action,\n  });\n  const digest = await globalThis.crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(canonical),\n  );\n  return Array.from(new Uint8Array(digest))\n    .map((byte) => byte.toString(16).padStart(2, \"0\"))\n    .join(\"\");\n}\n\nexport async function assertValidComputerCommandEnvelope(\n  value: unknown,\n  options?: { now?: number },\n): Promise<ComputerCommandEnvelope> {\n  if (!isRecord(value)) {\n    throw invalid(\"Computer command envelope must be an object\");\n  }\n  if (value.version !== 1) {\n    throw invalid(\"Unsupported computer command envelope version\");\n  }\n  const taskId = boundedString(value.taskId, \"taskId\", 200);\n  const runId = boundedString(value.runId, \"runId\", 200);\n  const idempotencyKey = boundedString(\n    value.idempotencyKey,\n    \"idempotencyKey\",\n    200,\n  );\n  if (!Number.isSafeInteger(value.sequence) || Number(value.sequence) < 0) {\n    throw invalid(\"sequence must be a non-negative safe integer\");\n  }\n  if (!OPERATION_CLASSES.has(value.operationClass as ComputerOperationClass)) {\n    throw invalid(\"Unknown computer operation class\");\n  }\n  if (!isRecord(value.action)) {\n    throw invalid(\"action must be an object\");\n  }\n  boundedString(value.action.type, \"action.type\", 120);\n  const actionJson = stableJson(value.action);\n  if (new TextEncoder().encode(actionJson).byteLength > MAX_ACTION_BYTES) {\n    throw invalid(\"Computer action exceeds the 32 KiB metadata limit\");\n  }\n  if (!isRecord(value.approval)) {\n    throw invalid(\"approval binding is required\");\n  }\n  if (!APPROVAL_SCOPES.has(value.approval.scope as any)) {\n    throw invalid(\"Unknown computer approval scope\");\n  }\n  const actionHash = boundedString(\n    value.approval.actionHash,\n    \"approval.actionHash\",\n    64,\n  ).toLowerCase();\n  if (!/^[a-f0-9]{64}$/.test(actionHash)) {\n    throw invalid(\"approval.actionHash must be a SHA-256 hex digest\");\n  }\n  const approvalId =\n    value.approval.id == null\n      ? null\n      : boundedString(value.approval.id, \"approval.id\", 240);\n  if (!Number.isSafeInteger(value.issuedAt) || Number(value.issuedAt) < 0) {\n    throw invalid(\"issuedAt must be a valid epoch timestamp\");\n  }\n  if (\n    !Number.isSafeInteger(value.leaseExpiresAt) ||\n    Number(value.leaseExpiresAt) < 0\n  ) {\n    throw invalid(\"leaseExpiresAt must be a valid epoch timestamp\");\n  }\n  const now = options?.now ?? Date.now();\n  const issuedAt = Number(value.issuedAt);\n  const leaseExpiresAt = Number(value.leaseExpiresAt);\n  if (leaseExpiresAt <= now || leaseExpiresAt <= issuedAt) {\n    throw new ComputerSupervisionError(\n      \"expired-lease\",\n      \"Computer operation lease has expired\",\n    );\n  }\n  if (leaseExpiresAt - issuedAt > MAX_LEASE_MS) {\n    throw invalid(\"Computer operation lease cannot exceed 24 hours\");\n  }\n\n  const envelope: ComputerCommandEnvelope = {\n    version: 1,\n    taskId,\n    runId,\n    sequence: Number(value.sequence),\n    idempotencyKey,\n    operationClass: value.operationClass as ComputerOperationClass,\n    action: value.action as ComputerCommandEnvelope[\"action\"],\n    approval: {\n      id: approvalId,\n      scope: value.approval\n        .scope as ComputerCommandEnvelope[\"approval\"][\"scope\"],\n      actionHash,\n    },\n    issuedAt,\n    leaseExpiresAt,\n  };\n  const expectedHash = await computeComputerActionHash(envelope);\n  if (expectedHash !== actionHash) {\n    throw new ComputerSupervisionError(\n      \"action-hash-mismatch\",\n      \"Computer operation does not match its approved action hash\",\n    );\n  }\n  return envelope;\n}\n\nfunction stableJson(value: unknown): string {\n  const seen = new Set<object>();\n  const normalize = (entry: unknown, depth: number): unknown => {\n    if (depth > 12) throw invalid(\"Computer action is nested too deeply\");\n    if (\n      entry === null ||\n      typeof entry === \"string\" ||\n      typeof entry === \"boolean\"\n    ) {\n      if (\n        typeof entry === \"string\" &&\n        (/^data:/i.test(entry) || looksLikeLargeBase64(entry))\n      ) {\n        throw invalid(\"Binary or data URL payloads are not allowed\");\n      }\n      return entry;\n    }\n    if (typeof entry === \"number\" && Number.isFinite(entry)) return entry;\n    if (Array.isArray(entry)) {\n      return entry.map((item) => normalize(item, depth + 1));\n    }\n    if (!isRecord(entry)) {\n      throw invalid(\"Computer actions must contain only JSON values\");\n    }\n    if (seen.has(entry)) throw invalid(\"Computer action contains a cycle\");\n    seen.add(entry);\n    const result: Record<string, unknown> = {};\n    for (const key of Object.keys(entry).sort()) {\n      result[key] = normalize(entry[key], depth + 1);\n    }\n    seen.delete(entry);\n    return result;\n  };\n  return JSON.stringify(normalize(value, 0));\n}\n\nfunction looksLikeLargeBase64(value: string): boolean {\n  return value.length > 512 && /^[A-Za-z0-9+/]+={0,2}$/.test(value);\n}\n\nfunction isRecord(value: unknown): value is Record<string, any> {\n  return Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction boundedString(value: unknown, name: string, max: number): string {\n  if (typeof value !== \"string\" || !value.trim() || value.length > max) {\n    throw invalid(`${name} must be a non-empty string of at most ${max} chars`);\n  }\n  return value.trim();\n}\n\nfunction invalid(message: string): ComputerSupervisionError {\n  return new ComputerSupervisionError(\"invalid-envelope\", message);\n}\n"]}