@agimon-ai/po-computer-use 0.0.0-alpha.5 → 0.0.0-alpha.50

package/LICENSE

@@ -1,21 +1,149 @@
-MIT License
-
-Copyright (c) 2026 Vuong Ngo
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+License text copyright © 2017 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+Parameters
+
+Licensor:             Agimon Pty Ltd
+Licensed Work:        Po, the software in the Po source repository and the
+                      packages released from it, in each version released by
+                      the Licensor.
+                      The Licensed Work is (c) 2026 Agimon Pty Ltd.
+                      Material identified as third-party in the "Third-party
+                      components" section at the end of this file or in a
+                      NOTICE file, and any package or directory whose own
+                      license file grants a different license, is not part of
+                      the Licensed Work and remains under its own license.
+Additional Use Grant: You may make production use of the Licensed Work if
+  your use is Eligible Use. "Eligible Use" is production use that falls
+  within at least one of the following:
+
+  (a) Personal Use. Use by an individual for their own personal purposes,
+      and not on behalf of, or for the benefit of, an employer, client, or
+      other Organization. Use by an individual in the course of employment
+      or engagement by an Organization is use by that Organization.
+
+  (b) Small Organization Use. Use by or on behalf of an Organization whose
+      Annual Revenue is less than USD 1,000,000.
+
+  (c) Non-profit, Education and Research Use. Use, regardless of Annual
+      Revenue, by (i) an Organization registered or recognized as a
+      non-profit or charitable organization under the laws of its
+      jurisdiction, for its non-profit purposes; (ii) an accredited school,
+      college, or university, for teaching, learning, or academic research;
+      or (iii) a publicly funded research institution, for its research.
+
+  (d) Service Provider Use. Use by a consultant, contractor, agency, or other
+      service provider, regardless of its own Annual Revenue, solely to
+      build, deploy, host, operate, or support the Licensed Work for a client
+      whose own use would be Eligible Use under (a), (b), or (c). A service
+      provider's use for its own purposes is Eligible Use only if the service
+      provider itself qualifies under (b) or (c).
+
+
+  Hosted services. Offering the Licensed Work to third parties as a hosted
+  or managed service whose primary value is the Licensed Work is Eligible
+  Use only if each such third party's own use would be Eligible Use.
+
+  Definitions. "Organization" means any company, partnership, sole
+  proprietorship, trust, association, government body, or other entity, and
+  includes an individual acting in a business or professional capacity.
+  "Affiliate" means any entity that directly or indirectly controls, is
+  controlled by, or is under common control with an Organization, where
+  "control" means ownership of more than 50% of the voting interests of an
+  entity or the power to direct its management and policies by contract or
+  otherwise. "Annual Revenue" means the total gross revenue of an
+  Organization and all of its Affiliates combined, from all sources and
+  whether or not related to the Licensed Work, for its most recently
+  completed fiscal year, or, if it has not completed a fiscal year, for the
+  twelve months before the use (or since its formation, if shorter),
+  converted into US dollars at the average exchange rate for that period.
+  Proceeds of equity or debt financing are not revenue.
+
+  Threshold. If an Organization stops qualifying under (b), its existing
+  production use remains Eligible Use for 90 days after it stops
+  qualifying, after which it must obtain a commercial license or stop
+  production use. Use that was Eligible Use when it occurred never requires
+  a commercial license after the fact.
+Change Date:          Four years from the date a version of the Licensed Work
+                      is first publicly released by the Licensor.
+Change License:       Apache License, Version 2.0
+
+For information about alternative licensing arrangements for the Licensed
+Work, please visit: https://agimon.ai/licensing
+
+Notice
+
+The Business Source License (this document, or the "License") is not an Open
+Source license. However, the Licensed Work will eventually be made available
+under an Open Source License, as stated in this License.
+
+-----------------------------------------------------------------------------
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works
+of the Licensed Work, are subject to this License. This License applies
+separately for each version of the Licensed Work and the Change Date may vary
+for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or
+modified form from a third party, the terms and conditions set forth in this
+License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or logo of
+Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
+AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
+TITLE.
+
+MariaDB hereby grants you permission to use this License’s text to license
+your works, and to refer to it using the trademark “Business Source License”,
+as long as you comply with the Covenants of Licensor below.
+
+Covenants of Licensor
+
+In consideration of the right to use this License’s text and the “Business
+Source License” name and trademark, Licensor covenants to MariaDB, and to all
+other recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version,
+   or a license that is compatible with GPL Version 2.0 or a later version,
+   where “compatible” means that software provided under the Change License can
+   be included in a program with software provided under GPL Version 2.0 or a
+   later version. Licensor may specify additional Change Licenses without
+   limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not
+   impose any additional restriction on the right granted in this License, as
+   the Additional Use Grant; or (b) insert the text “None”.
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.

package/README.md

@@ -16,12 +16,15 @@ The `computer-use` minor mode exposes Activate, Deactivate, and Doctor actions.
 
 While active, the package exposes three tools:
 
-- `computer_state` observes the authorized window and returns a semantic snapshot.
+- `computer_state` observes the authorized window and returns a semantic snapshot. `saveScreenshot: true` also keeps the screenshot in session artifacts under `computer-use/<run>/` and returns its `artifact:` path.
 - `computer_action` performs one semantic press, focus change, value change, or scroll against a current snapshot.
 - `computer_exec` executes a reusable JavaScript or erasable TypeScript function and its relative helpers in a restricted runtime, then returns a fresh semantic observation.
 
+Every finished recording is copied from the native store into session artifacts under `computer-use/`, in bounded ranges, when artifacts are available. The private player keeps its own copy.
 Generated functions receive the authorized program API, JSON input, bounded logging, and cancellation. They do not receive Node or filesystem access. Script-internal observations omit screenshots by default, and `includeScreenshot: true` requests an image explicitly. Full Node execution requires both `trusted: true` and an exact host-configured `PO_COMPUTER_USE_SCRIPT_PATHS` allowlist. Trusted scripts remain unsandboxed, including their imported dependencies. See [Author computer functions](./docs/computer-scripts.md) for the contract, limits, trust boundary, and examples.
 
+With code mode, the same operations are the `computer` namespace in `exec` (`state`, `act`, `run`, `stop`), registered only while the native grant is active, and the three tools are withdrawn from the agent. The `codemode-how-to-computer-use` guide is listed whenever the mode is selected. MCP clients and hosts without code mode keep the tools.
+
 All three tools remain unavailable during setup and are admitted only after the native grant becomes active. Disabling the mode or global opt-in, stopping control, expiry, or Desktop disconnection stops further actions. Once Desktop claims a session, browser and remote MCP clients cannot drive it, including previously attached clients. This ownership stays pinned for the server lifetime and is not restored from saved session data.
 
 ## Public API
@@ -31,7 +34,7 @@ import { ComputerScriptRunner, createComputerUseSessionClient } from '@agimon-ai
 import type { ComputerScriptRun } from '@agimon-ai/po-computer-use';
 ```
 
-The session-scoped server facet owns the agent and hub routes. Their host-issued context tokens remain opaque and session-bound inside the request broker.
+The session-scoped server plugin owns the agent and hub routes. Their host-issued context tokens remain opaque and session-bound inside the request broker.
 
 ## Development
 
@@ -44,6 +47,6 @@ pnpm build
 
 ## License
 
-MIT
+Business Source License 1.1: free for personal use, organisations under USD 1M revenue, non-profits and education. See [LICENSE](LICENSE) and https://agimon.ai/licensing.
 
 Direct plugin routes live in `src/extensions`. The session root constructs one broker shared by the typed agent client and activation API. The host owns the Desktop IPC connection, native renderer authentication, session identity, and grant lifetime. The hub channel uses lifecycle events rather than polling to forward operations. Public exports remain under `src/exports`.

package/dist/apiContracts.cjs

@@ -44,6 +44,26 @@ const ComputerStateSchema = typebox.Type.Object({
 	failure: O(Error),
 	artifact: O(Artifact)
 });
+const Permission = values([
+	"accessibility",
+	"screen-recording",
+	"microphone",
+	"automation",
+	"full-disk-access"
+]);
+const PermissionState = values([
+	"granted",
+	"denied",
+	"not-determined",
+	"per-app"
+]);
+const DesktopPermissionStatesSchema = typebox.Type.Object({
+	accessibility: PermissionState,
+	"screen-recording": PermissionState,
+	microphone: PermissionState,
+	automation: PermissionState,
+	"full-disk-access": PermissionState
+});
 const Reference = {
 	snapshotId: typebox.Type.String({ minLength: 1 }),
 	elementRef: typebox.Type.String({ minLength: 1 })
@@ -96,6 +116,32 @@ const apiContracts = (0, _agimon_ai_po_core_apiContracts.defineApiContract)({
 	version: 1,
 	dynamic: ["Desktop provider target extensions, observations and operation results are runtime-defined JSON."],
 	http: [
+		...[
+			"global",
+			"workspace",
+			"session"
+		].flatMap((scope) => ["GET", "POST"].map((method) => ({
+			id: `computer.permissions.${method === "GET" ? "read" : "request"}`,
+			scope,
+			basePath: "desktop-permissions",
+			path: "/",
+			method,
+			authentication: "owner",
+			description: method === "GET" ? "Read the Mac-owned permission states. Requires an authorized local Desktop caller or trusted remote caller." : "Ask macOS for one named permission. Requires an authorized local Desktop caller or remote passkey step-up.",
+			availability: "Requires Po Desktop to be running this server; otherwise returns 404.",
+			...method === "POST" ? { body: {
+				required: true,
+				contentType: "application/json",
+				schema: typebox.Type.Object({ permission: Permission })
+			} } : {},
+			responses: {
+				...(0, _agimon_ai_po_core_apiContracts.jsonApiResponses)(DesktopPermissionStatesSchema),
+				"502": {
+					description: "Desktop permission request failed.",
+					schema: typebox.Type.Object({ error: S })
+				}
+			}
+		}))),
 		{
 			id: "computer.activation.state",
 			scope: "session",

package/dist/apiContracts.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"apiContracts.cjs","names":["Type","jsonApiResponses","defineApiContract"],"sources":["../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract, jsonApiResponses, type PoHttpContract } from '@agimon-ai/po-core/apiContracts';\nimport { Type } from 'typebox';\n\nconst S = Type.String();\nconst N = Type.Number();\nconst O = Type.Optional;\nconst values = <T extends string>(items: T[]) => Type.Union(items.map((item) => Type.Literal(item)));\nconst Json = Type.Unknown({\n  description:\n    'Desktop provider JSON value. Targets, observations and action results are supplied by the admitted Desktop provider.',\n});\nconst Target = Type.Record(S, Json);\nconst Error = Type.Object({ code: S, message: S });\nconst Artifact = Type.Object({\n  artifactId: S,\n  status: values(['ready', 'failed']),\n  sizeBytes: O(N),\n  downloadUrl: O(S),\n  previewUrl: O(S),\n  actionCount: O(N),\n  completedAt: O(S),\n  failure: O(Error),\n});\nexport const ComputerStateSchema = Type.Object({\n  sessionId: S,\n  revision: N,\n  wake: N,\n  phase: values(['inactive', 'awaiting_confirmation', 'activating', 'active', 'stopping', 'failed']),\n  requestId: O(S),\n  target: O(Target),\n  durationMs: O(N),\n  expiresAt: O(N),\n  failure: O(Error),\n  artifact: O(Artifact),\n});\nconst Reference = { snapshotId: Type.String({ minLength: 1 }), elementRef: Type.String({ minLength: 1 }) };\nexport const ComputerActionSchema = Type.Union([\n  Type.Object({ kind: values(['press', 'focus']), ...Reference }, { additionalProperties: false }),\n  Type.Object({ kind: Type.Literal('set_value'), ...Reference, value: S }, { additionalProperties: false }),\n  Type.Object(\n    {\n      kind: Type.Literal('scroll'),\n      ...Reference,\n      direction: values(['up', 'down', 'left', 'right']),\n      amount: values(['line', 'page']),\n    },\n    { additionalProperties: false },\n  ),\n]);\nconst internal = (\n  method: 'GET' | 'POST',\n  path: string,\n  output: object,\n  body?: object,\n  status = 200,\n): PoHttpContract => ({\n  id: `computer.${path.slice(1).replaceAll('/', '.')}`,\n  scope: 'session',\n  basePath: 'computer-use',\n  path,\n  method,\n  authentication: 'owner',\n  description: `Computer use broker ${path}. Requires the host-issued ${path.startsWith('/agent/') ? 'agent' : 'hub'} bearer token.`,\n  availability: 'Internal broker route; ordinary browser credentials are insufficient.',\n  parameters: [{ name: 'Authorization', in: 'header', required: true, schema: Type.String({ pattern: '^Bearer .+' }) }],\n  ...(body ? { body: { required: true, contentType: 'application/json', schema: body } } : {}),\n  responses: jsonApiResponses(output, status),\n});\nexport const apiContracts = defineApiContract({\n  version: 1,\n  dynamic: ['Desktop provider target extensions, observations and operation results are runtime-defined JSON.'],\n  http: [\n    {\n      id: 'computer.activation.state',\n      scope: 'session',\n      basePath: 'computer-use',\n      path: '/activate',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read state as the matching pending requester or approved recording reader.',\n      responses: jsonApiResponses(ComputerStateSchema),\n    },\n    {\n      id: 'computer.activation.cancel',\n      scope: 'session',\n      basePath: 'computer-use',\n      path: '/activate',\n      method: 'DELETE',\n      authentication: 'owner',\n      description: 'Cancel only the matching requester pending activation.',\n      responses: jsonApiResponses(ComputerStateSchema, 202),\n    },\n    {\n      id: 'computer.activate',\n      scope: 'session',\n      basePath: 'computer-use',\n      path: '/activate',\n      method: 'POST',\n      authentication: 'owner',\n      description:\n        'Request confirmed Desktop access with admitted caller and remote step-up context. A remote caller may omit target so the local Mac selects the window.',\n      body: {\n        required: true,\n        contentType: 'application/json',\n        schema: Type.Object({\n          target: O(Type.Object({ windowId: S, bundleId: S })),\n          durationMs: Type.Integer({ minimum: 1000, maximum: 1800000 }),\n        }),\n      },\n      responses: jsonApiResponses(ComputerStateSchema, 202),\n    },\n    {\n      id: 'computer.artifact',\n      scope: 'session',\n      basePath: 'computer-use',\n      path: '/artifact',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read at most 1 MiB of a recording belonging to this session and approved caller.',\n      parameters: [\n        { name: 'artifactId', in: 'query', required: true, schema: S },\n        { name: 'offset', in: 'query', required: true, schema: Type.Integer({ minimum: 0 }) },\n      ],\n      responses: {\n        206: {\n          description: 'Bounded recording bytes.',\n          contentType: 'video/mp4',\n          schema: Type.String({ format: 'binary' }),\n        },\n      },\n    },\n    internal('GET', '/agent/state', ComputerStateSchema),\n    internal('GET', '/hub/state', ComputerStateSchema),\n    internal('POST', '/agent/observe', Json),\n    internal('POST', '/agent/action', Json, ComputerActionSchema),\n    internal('POST', '/agent/stop', ComputerStateSchema, undefined, 202),\n    internal(\n      'GET',\n      '/hub/activation',\n      Type.Union([\n        Type.Null(),\n        Type.Object({\n          requestId: S,\n          target: Target,\n          durationSeconds: N,\n          createdAt: N,\n          confirmationExpiresAt: N,\n          caller: Type.Object({ locality: values(['local', 'remote']), stepUp: S }),\n        }),\n      ]),\n    ),\n    internal('GET', '/hub/authorization', Type.Union([Type.Null(), Type.Object({ grantId: S, expiresAt: O(N) })])),\n    internal(\n      'GET',\n      '/hub/next',\n      Type.Union([\n        Type.Null(),\n        Type.Object({ id: S, operation: values(['observe', 'act']), payload: O(Json), grantId: S, sequence: O(N) }),\n      ]),\n    ),\n    internal('POST', '/hub/complete', ComputerStateSchema, Type.Object({ id: S, error: O(S), result: O(Json) })),\n    internal(\n      'POST',\n      '/hub/stop',\n      ComputerStateSchema,\n      Type.Object({ error: O(S), host: O(Type.Object({ grantId: S, expiresAt: N })), artifact: O(Artifact) }),\n    ),\n  ],\n  sockets: (['global', 'workspace'] as const).flatMap((scope) => [\n    {\n      id: 'computer.state',\n      scope,\n      service: 'po.hub',\n      member: 'computer_use_state',\n      kind: 'channel',\n      direction: 'server-to-client',\n      description: 'Computer use channel payload.',\n      input: Type.Object({ state: ComputerStateSchema, targets: Type.Array(Target), busy: O(Type.Literal(true)) }),\n    },\n    {\n      id: 'computer.command',\n      scope,\n      service: 'po.hub',\n      member: 'computer_use_state',\n      kind: 'channel',\n      direction: 'client-to-server',\n      description: 'Computer use browser channel command.',\n      input: Type.Object({ action: values(['status', 'targets', 'stop', 'artifacts']) }),\n    },\n  ]),\n});\nexport default apiContracts;\n"],"mappings":";;;;;;;AAGA,MAAM,IAAIA,QAAAA,KAAK,OAAO;AACtB,MAAM,IAAIA,QAAAA,KAAK,OAAO;AACtB,MAAM,IAAIA,QAAAA,KAAK;AACf,MAAM,UAA4B,UAAeA,QAAAA,KAAK,MAAM,MAAM,KAAK,SAASA,QAAAA,KAAK,QAAQ,IAAI,CAAC,CAAC;AACnG,MAAM,OAAOA,QAAAA,KAAK,QAAQ,EACxB,aACE,uHACJ,CAAC;AACD,MAAM,SAASA,QAAAA,KAAK,OAAO,GAAG,IAAI;AAClC,MAAM,QAAQA,QAAAA,KAAK,OAAO;CAAE,MAAM;CAAG,SAAS;AAAE,CAAC;AACjD,MAAM,WAAWA,QAAAA,KAAK,OAAO;CAC3B,YAAY;CACZ,QAAQ,OAAO,CAAC,SAAS,QAAQ,CAAC;CAClC,WAAW,EAAE,CAAC;CACd,aAAa,EAAE,CAAC;CAChB,YAAY,EAAE,CAAC;CACf,aAAa,EAAE,CAAC;CAChB,aAAa,EAAE,CAAC;CAChB,SAAS,EAAE,KAAK;AAClB,CAAC;AACD,MAAa,sBAAsBA,QAAAA,KAAK,OAAO;CAC7C,WAAW;CACX,UAAU;CACV,MAAM;CACN,OAAO,OAAO;EAAC;EAAY;EAAyB;EAAc;EAAU;EAAY;CAAQ,CAAC;CACjG,WAAW,EAAE,CAAC;CACd,QAAQ,EAAE,MAAM;CAChB,YAAY,EAAE,CAAC;CACf,WAAW,EAAE,CAAC;CACd,SAAS,EAAE,KAAK;CAChB,UAAU,EAAE,QAAQ;AACtB,CAAC;AACD,MAAM,YAAY;CAAE,YAAYA,QAAAA,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CAAG,YAAYA,QAAAA,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;AAAE;AACzG,MAAa,uBAAuBA,QAAAA,KAAK,MAAM;CAC7CA,QAAAA,KAAK,OAAO;EAAE,MAAM,OAAO,CAAC,SAAS,OAAO,CAAC;EAAG,GAAG;CAAU,GAAG,EAAE,sBAAsB,MAAM,CAAC;CAC/FA,QAAAA,KAAK,OAAO;EAAE,MAAMA,QAAAA,KAAK,QAAQ,WAAW;EAAG,GAAG;EAAW,OAAO;CAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC;CACxGA,QAAAA,KAAK,OACH;EACE,MAAMA,QAAAA,KAAK,QAAQ,QAAQ;EAC3B,GAAG;EACH,WAAW,OAAO;GAAC;GAAM;GAAQ;GAAQ;EAAO,CAAC;EACjD,QAAQ,OAAO,CAAC,QAAQ,MAAM,CAAC;CACjC,GACA,EAAE,sBAAsB,MAAM,CAChC;AACF,CAAC;AACD,MAAM,YACJ,QACA,MACA,QACA,MACA,SAAS,SACW;CACpB,IAAI,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,KAAK,GAAG;CACjD,OAAO;CACP,UAAU;CACV;CACA;CACA,gBAAgB;CAChB,aAAa,uBAAuB,KAAK,6BAA6B,KAAK,WAAW,SAAS,IAAI,UAAU,MAAM;CACnH,cAAc;CACd,YAAY,CAAC;EAAE,MAAM;EAAiB,IAAI;EAAU,UAAU;EAAM,QAAQA,QAAAA,KAAK,OAAO,EAAE,SAAS,aAAa,CAAC;CAAE,CAAC;CACpH,GAAI,OAAO,EAAE,MAAM;EAAE,UAAU;EAAM,aAAa;EAAoB,QAAQ;CAAK,EAAE,IAAI,CAAC;CAC1F,YAAA,GAAWC,gCAAAA,iBAAAA,CAAiB,QAAQ,MAAM;AAC5C;AACA,MAAa,gBAAA,GAAeC,gCAAAA,kBAAAA,CAAkB;CAC5C,SAAS;CACT,SAAS,CAAC,kGAAkG;CAC5G,MAAM;EACJ;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAA,GAAWD,gCAAAA,iBAAAA,CAAiB,mBAAmB;EACjD;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAA,GAAWA,gCAAAA,iBAAAA,CAAiB,qBAAqB,GAAG;EACtD;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aACE;GACF,MAAM;IACJ,UAAU;IACV,aAAa;IACb,QAAQD,QAAAA,KAAK,OAAO;KAClB,QAAQ,EAAEA,QAAAA,KAAK,OAAO;MAAE,UAAU;MAAG,UAAU;KAAE,CAAC,CAAC;KACnD,YAAYA,QAAAA,KAAK,QAAQ;MAAE,SAAS;MAAM,SAAS;KAAQ,CAAC;IAC9D,CAAC;GACH;GACA,YAAA,GAAWC,gCAAAA,iBAAAA,CAAiB,qBAAqB,GAAG;EACtD;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY,CACV;IAAE,MAAM;IAAc,IAAI;IAAS,UAAU;IAAM,QAAQ;GAAE,GAC7D;IAAE,MAAM;IAAU,IAAI;IAAS,UAAU;IAAM,QAAQD,QAAAA,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;GAAE,CACtF;GACA,WAAW,EACT,KAAK;IACH,aAAa;IACb,aAAa;IACb,QAAQA,QAAAA,KAAK,OAAO,EAAE,QAAQ,SAAS,CAAC;GAC1C,EACF;EACF;EACA,SAAS,OAAO,gBAAgB,mBAAmB;EACnD,SAAS,OAAO,cAAc,mBAAmB;EACjD,SAAS,QAAQ,kBAAkB,IAAI;EACvC,SAAS,QAAQ,iBAAiB,MAAM,oBAAoB;EAC5D,SAAS,QAAQ,eAAe,qBAAqB,KAAA,GAAW,GAAG;EACnE,SACE,OACA,mBACAA,QAAAA,KAAK,MAAM,CACTA,QAAAA,KAAK,KAAK,GACVA,QAAAA,KAAK,OAAO;GACV,WAAW;GACX,QAAQ;GACR,iBAAiB;GACjB,WAAW;GACX,uBAAuB;GACvB,QAAQA,QAAAA,KAAK,OAAO;IAAE,UAAU,OAAO,CAAC,SAAS,QAAQ,CAAC;IAAG,QAAQ;GAAE,CAAC;EAC1E,CAAC,CACH,CAAC,CACH;EACA,SAAS,OAAO,sBAAsBA,QAAAA,KAAK,MAAM,CAACA,QAAAA,KAAK,KAAK,GAAGA,QAAAA,KAAK,OAAO;GAAE,SAAS;GAAG,WAAW,EAAE,CAAC;EAAE,CAAC,CAAC,CAAC,CAAC;EAC7G,SACE,OACA,aACAA,QAAAA,KAAK,MAAM,CACTA,QAAAA,KAAK,KAAK,GACVA,QAAAA,KAAK,OAAO;GAAE,IAAI;GAAG,WAAW,OAAO,CAAC,WAAW,KAAK,CAAC;GAAG,SAAS,EAAE,IAAI;GAAG,SAAS;GAAG,UAAU,EAAE,CAAC;EAAE,CAAC,CAC5G,CAAC,CACH;EACA,SAAS,QAAQ,iBAAiB,qBAAqBA,QAAAA,KAAK,OAAO;GAAE,IAAI;GAAG,OAAO,EAAE,CAAC;GAAG,QAAQ,EAAE,IAAI;EAAE,CAAC,CAAC;EAC3G,SACE,QACA,aACA,qBACAA,QAAAA,KAAK,OAAO;GAAE,OAAO,EAAE,CAAC;GAAG,MAAM,EAAEA,QAAAA,KAAK,OAAO;IAAE,SAAS;IAAG,WAAW;GAAE,CAAC,CAAC;GAAG,UAAU,EAAE,QAAQ;EAAE,CAAC,CACxG;CACF;CACA,SAAU,CAAC,UAAU,WAAW,CAAC,CAAW,SAAS,UAAU,CAC7D;EACE,IAAI;EACJ;EACA,SAAS;EACT,QAAQ;EACR,MAAM;EACN,WAAW;EACX,aAAa;EACb,OAAOA,QAAAA,KAAK,OAAO;GAAE,OAAO;GAAqB,SAASA,QAAAA,KAAK,MAAM,MAAM;GAAG,MAAM,EAAEA,QAAAA,KAAK,QAAQ,IAAI,CAAC;EAAE,CAAC;CAC7G,GACA;EACE,IAAI;EACJ;EACA,SAAS;EACT,QAAQ;EACR,MAAM;EACN,WAAW;EACX,aAAa;EACb,OAAOA,QAAAA,KAAK,OAAO,EAAE,QAAQ,OAAO;GAAC;GAAU;GAAW;GAAQ;EAAW,CAAC,EAAE,CAAC;CACnF,CACF,CAAC;AACH,CAAC"}
+{"version":3,"file":"apiContracts.cjs","names":["Type","jsonApiResponses","defineApiContract"],"sources":["../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract, jsonApiResponses, type PoHttpContract } from '@agimon-ai/po-core/apiContracts';\nimport { Type } from 'typebox';\n\nconst S = Type.String();\nconst N = Type.Number();\nconst O = Type.Optional;\nconst values = <T extends string>(items: T[]) => Type.Union(items.map((item) => Type.Literal(item)));\nconst Json = Type.Unknown({\n  description:\n    'Desktop provider JSON value. Targets, observations and action results are supplied by the admitted Desktop provider.',\n});\nconst Target = Type.Record(S, Json);\nconst Error = Type.Object({ code: S, message: S });\nconst Artifact = Type.Object({\n  artifactId: S,\n  status: values(['ready', 'failed']),\n  sizeBytes: O(N),\n  downloadUrl: O(S),\n  previewUrl: O(S),\n  actionCount: O(N),\n  completedAt: O(S),\n  failure: O(Error),\n});\nexport const ComputerStateSchema = Type.Object({\n  sessionId: S,\n  revision: N,\n  wake: N,\n  phase: values(['inactive', 'awaiting_confirmation', 'activating', 'active', 'stopping', 'failed']),\n  requestId: O(S),\n  target: O(Target),\n  durationMs: O(N),\n  expiresAt: O(N),\n  failure: O(Error),\n  artifact: O(Artifact),\n});\nconst Permission = values(['accessibility', 'screen-recording', 'microphone', 'automation', 'full-disk-access']);\nconst PermissionState = values(['granted', 'denied', 'not-determined', 'per-app']);\nexport const DesktopPermissionStatesSchema = Type.Object({\n  accessibility: PermissionState,\n  'screen-recording': PermissionState,\n  microphone: PermissionState,\n  automation: PermissionState,\n  'full-disk-access': PermissionState,\n});\nconst Reference = { snapshotId: Type.String({ minLength: 1 }), elementRef: Type.String({ minLength: 1 }) };\nexport const ComputerActionSchema = Type.Union([\n  Type.Object({ kind: values(['press', 'focus']), ...Reference }, { additionalProperties: false }),\n  Type.Object({ kind: Type.Literal('set_value'), ...Reference, value: S }, { additionalProperties: false }),\n  Type.Object(\n    {\n      kind: Type.Literal('scroll'),\n      ...Reference,\n      direction: values(['up', 'down', 'left', 'right']),\n      amount: values(['line', 'page']),\n    },\n    { additionalProperties: false },\n  ),\n]);\nconst internal = (\n  method: 'GET' | 'POST',\n  path: string,\n  output: object,\n  body?: object,\n  status = 200,\n): PoHttpContract => ({\n  id: `computer.${path.slice(1).replaceAll('/', '.')}`,\n  scope: 'session',\n  basePath: 'computer-use',\n  path,\n  method,\n  authentication: 'owner',\n  description: `Computer use broker ${path}. Requires the host-issued ${path.startsWith('/agent/') ? 'agent' : 'hub'} bearer token.`,\n  availability: 'Internal broker route; ordinary browser credentials are insufficient.',\n  parameters: [{ name: 'Authorization', in: 'header', required: true, schema: Type.String({ pattern: '^Bearer .+' }) }],\n  ...(body ? { body: { required: true, contentType: 'application/json', schema: body } } : {}),\n  responses: jsonApiResponses(output, status),\n});\nexport const apiContracts = defineApiContract({\n  version: 1,\n  dynamic: ['Desktop provider target extensions, observations and operation results are runtime-defined JSON.'],\n  http: [\n    ...(['global', 'workspace', 'session'] as const).flatMap((scope) =>\n      (['GET', 'POST'] as const).map((method) => ({\n        id: `computer.permissions.${method === 'GET' ? 'read' : 'request'}`,\n        scope,\n        basePath: 'desktop-permissions',\n        path: '/',\n        method,\n        authentication: 'owner' as const,\n        description:\n          method === 'GET'\n            ? 'Read the Mac-owned permission states. Requires an authorized local Desktop caller or trusted remote caller.'\n            : 'Ask macOS for one named permission. Requires an authorized local Desktop caller or remote passkey step-up.',\n        availability: 'Requires Po Desktop to be running this server; otherwise returns 404.',\n        ...(method === 'POST'\n          ? {\n              body: {\n                required: true,\n                contentType: 'application/json',\n                schema: Type.Object({ permission: Permission }),\n              },\n            }\n          : {}),\n        responses: {\n          ...jsonApiResponses(DesktopPermissionStatesSchema),\n          '502': { description: 'Desktop permission request failed.', schema: Type.Object({ error: S }) },\n        },\n      })),\n    ),\n    {\n      id: 'computer.activation.state',\n      scope: 'session',\n      basePath: 'computer-use',\n      path: '/activate',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read state as the matching pending requester or approved recording reader.',\n      responses: jsonApiResponses(ComputerStateSchema),\n    },\n    {\n      id: 'computer.activation.cancel',\n      scope: 'session',\n      basePath: 'computer-use',\n      path: '/activate',\n      method: 'DELETE',\n      authentication: 'owner',\n      description: 'Cancel only the matching requester pending activation.',\n      responses: jsonApiResponses(ComputerStateSchema, 202),\n    },\n    {\n      id: 'computer.activate',\n      scope: 'session',\n      basePath: 'computer-use',\n      path: '/activate',\n      method: 'POST',\n      authentication: 'owner',\n      description:\n        'Request confirmed Desktop access with admitted caller and remote step-up context. A remote caller may omit target so the local Mac selects the window.',\n      body: {\n        required: true,\n        contentType: 'application/json',\n        schema: Type.Object({\n          target: O(Type.Object({ windowId: S, bundleId: S })),\n          durationMs: Type.Integer({ minimum: 1000, maximum: 1800000 }),\n        }),\n      },\n      responses: jsonApiResponses(ComputerStateSchema, 202),\n    },\n    {\n      id: 'computer.artifact',\n      scope: 'session',\n      basePath: 'computer-use',\n      path: '/artifact',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read at most 1 MiB of a recording belonging to this session and approved caller.',\n      parameters: [\n        { name: 'artifactId', in: 'query', required: true, schema: S },\n        { name: 'offset', in: 'query', required: true, schema: Type.Integer({ minimum: 0 }) },\n      ],\n      responses: {\n        206: {\n          description: 'Bounded recording bytes.',\n          contentType: 'video/mp4',\n          schema: Type.String({ format: 'binary' }),\n        },\n      },\n    },\n    internal('GET', '/agent/state', ComputerStateSchema),\n    internal('GET', '/hub/state', ComputerStateSchema),\n    internal('POST', '/agent/observe', Json),\n    internal('POST', '/agent/action', Json, ComputerActionSchema),\n    internal('POST', '/agent/stop', ComputerStateSchema, undefined, 202),\n    internal(\n      'GET',\n      '/hub/activation',\n      Type.Union([\n        Type.Null(),\n        Type.Object({\n          requestId: S,\n          target: Target,\n          durationSeconds: N,\n          createdAt: N,\n          confirmationExpiresAt: N,\n          caller: Type.Object({ locality: values(['local', 'remote']), stepUp: S }),\n        }),\n      ]),\n    ),\n    internal('GET', '/hub/authorization', Type.Union([Type.Null(), Type.Object({ grantId: S, expiresAt: O(N) })])),\n    internal(\n      'GET',\n      '/hub/next',\n      Type.Union([\n        Type.Null(),\n        Type.Object({ id: S, operation: values(['observe', 'act']), payload: O(Json), grantId: S, sequence: O(N) }),\n      ]),\n    ),\n    internal('POST', '/hub/complete', ComputerStateSchema, Type.Object({ id: S, error: O(S), result: O(Json) })),\n    internal(\n      'POST',\n      '/hub/stop',\n      ComputerStateSchema,\n      Type.Object({ error: O(S), host: O(Type.Object({ grantId: S, expiresAt: N })), artifact: O(Artifact) }),\n    ),\n  ],\n  sockets: (['global', 'workspace'] as const).flatMap((scope) => [\n    {\n      id: 'computer.state',\n      scope,\n      service: 'po.hub',\n      member: 'computer_use_state',\n      kind: 'channel',\n      direction: 'server-to-client',\n      description: 'Computer use channel payload.',\n      input: Type.Object({ state: ComputerStateSchema, targets: Type.Array(Target), busy: O(Type.Literal(true)) }),\n    },\n    {\n      id: 'computer.command',\n      scope,\n      service: 'po.hub',\n      member: 'computer_use_state',\n      kind: 'channel',\n      direction: 'client-to-server',\n      description: 'Computer use browser channel command.',\n      input: Type.Object({ action: values(['status', 'targets', 'stop', 'artifacts']) }),\n    },\n  ]),\n});\nexport default apiContracts;\n"],"mappings":";;;;;;;AAGA,MAAM,IAAIA,QAAAA,KAAK,OAAO;AACtB,MAAM,IAAIA,QAAAA,KAAK,OAAO;AACtB,MAAM,IAAIA,QAAAA,KAAK;AACf,MAAM,UAA4B,UAAeA,QAAAA,KAAK,MAAM,MAAM,KAAK,SAASA,QAAAA,KAAK,QAAQ,IAAI,CAAC,CAAC;AACnG,MAAM,OAAOA,QAAAA,KAAK,QAAQ,EACxB,aACE,uHACJ,CAAC;AACD,MAAM,SAASA,QAAAA,KAAK,OAAO,GAAG,IAAI;AAClC,MAAM,QAAQA,QAAAA,KAAK,OAAO;CAAE,MAAM;CAAG,SAAS;AAAE,CAAC;AACjD,MAAM,WAAWA,QAAAA,KAAK,OAAO;CAC3B,YAAY;CACZ,QAAQ,OAAO,CAAC,SAAS,QAAQ,CAAC;CAClC,WAAW,EAAE,CAAC;CACd,aAAa,EAAE,CAAC;CAChB,YAAY,EAAE,CAAC;CACf,aAAa,EAAE,CAAC;CAChB,aAAa,EAAE,CAAC;CAChB,SAAS,EAAE,KAAK;AAClB,CAAC;AACD,MAAa,sBAAsBA,QAAAA,KAAK,OAAO;CAC7C,WAAW;CACX,UAAU;CACV,MAAM;CACN,OAAO,OAAO;EAAC;EAAY;EAAyB;EAAc;EAAU;EAAY;CAAQ,CAAC;CACjG,WAAW,EAAE,CAAC;CACd,QAAQ,EAAE,MAAM;CAChB,YAAY,EAAE,CAAC;CACf,WAAW,EAAE,CAAC;CACd,SAAS,EAAE,KAAK;CAChB,UAAU,EAAE,QAAQ;AACtB,CAAC;AACD,MAAM,aAAa,OAAO;CAAC;CAAiB;CAAoB;CAAc;CAAc;AAAkB,CAAC;AAC/G,MAAM,kBAAkB,OAAO;CAAC;CAAW;CAAU;CAAkB;AAAS,CAAC;AACjF,MAAa,gCAAgCA,QAAAA,KAAK,OAAO;CACvD,eAAe;CACf,oBAAoB;CACpB,YAAY;CACZ,YAAY;CACZ,oBAAoB;AACtB,CAAC;AACD,MAAM,YAAY;CAAE,YAAYA,QAAAA,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CAAG,YAAYA,QAAAA,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;AAAE;AACzG,MAAa,uBAAuBA,QAAAA,KAAK,MAAM;CAC7CA,QAAAA,KAAK,OAAO;EAAE,MAAM,OAAO,CAAC,SAAS,OAAO,CAAC;EAAG,GAAG;CAAU,GAAG,EAAE,sBAAsB,MAAM,CAAC;CAC/FA,QAAAA,KAAK,OAAO;EAAE,MAAMA,QAAAA,KAAK,QAAQ,WAAW;EAAG,GAAG;EAAW,OAAO;CAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC;CACxGA,QAAAA,KAAK,OACH;EACE,MAAMA,QAAAA,KAAK,QAAQ,QAAQ;EAC3B,GAAG;EACH,WAAW,OAAO;GAAC;GAAM;GAAQ;GAAQ;EAAO,CAAC;EACjD,QAAQ,OAAO,CAAC,QAAQ,MAAM,CAAC;CACjC,GACA,EAAE,sBAAsB,MAAM,CAChC;AACF,CAAC;AACD,MAAM,YACJ,QACA,MACA,QACA,MACA,SAAS,SACW;CACpB,IAAI,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,KAAK,GAAG;CACjD,OAAO;CACP,UAAU;CACV;CACA;CACA,gBAAgB;CAChB,aAAa,uBAAuB,KAAK,6BAA6B,KAAK,WAAW,SAAS,IAAI,UAAU,MAAM;CACnH,cAAc;CACd,YAAY,CAAC;EAAE,MAAM;EAAiB,IAAI;EAAU,UAAU;EAAM,QAAQA,QAAAA,KAAK,OAAO,EAAE,SAAS,aAAa,CAAC;CAAE,CAAC;CACpH,GAAI,OAAO,EAAE,MAAM;EAAE,UAAU;EAAM,aAAa;EAAoB,QAAQ;CAAK,EAAE,IAAI,CAAC;CAC1F,YAAA,GAAWC,gCAAAA,iBAAAA,CAAiB,QAAQ,MAAM;AAC5C;AACA,MAAa,gBAAA,GAAeC,gCAAAA,kBAAAA,CAAkB;CAC5C,SAAS;CACT,SAAS,CAAC,kGAAkG;CAC5G,MAAM;EACJ,GAAI;GAAC;GAAU;GAAa;EAAS,CAAC,CAAW,SAAS,UACvD,CAAC,OAAO,MAAM,CAAC,CAAW,KAAK,YAAY;GAC1C,IAAI,wBAAwB,WAAW,QAAQ,SAAS;GACxD;GACA,UAAU;GACV,MAAM;GACN;GACA,gBAAgB;GAChB,aACE,WAAW,QACP,gHACA;GACN,cAAc;GACd,GAAI,WAAW,SACX,EACE,MAAM;IACJ,UAAU;IACV,aAAa;IACb,QAAQF,QAAAA,KAAK,OAAO,EAAE,YAAY,WAAW,CAAC;GAChD,EACF,IACA,CAAC;GACL,WAAW;IACT,IAAA,GAAGC,gCAAAA,iBAAAA,CAAiB,6BAA6B;IACjD,OAAO;KAAE,aAAa;KAAsC,QAAQD,QAAAA,KAAK,OAAO,EAAE,OAAO,EAAE,CAAC;IAAE;GAChG;EACF,EAAE,CACJ;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAA,GAAWC,gCAAAA,iBAAAA,CAAiB,mBAAmB;EACjD;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAA,GAAWA,gCAAAA,iBAAAA,CAAiB,qBAAqB,GAAG;EACtD;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aACE;GACF,MAAM;IACJ,UAAU;IACV,aAAa;IACb,QAAQD,QAAAA,KAAK,OAAO;KAClB,QAAQ,EAAEA,QAAAA,KAAK,OAAO;MAAE,UAAU;MAAG,UAAU;KAAE,CAAC,CAAC;KACnD,YAAYA,QAAAA,KAAK,QAAQ;MAAE,SAAS;MAAM,SAAS;KAAQ,CAAC;IAC9D,CAAC;GACH;GACA,YAAA,GAAWC,gCAAAA,iBAAAA,CAAiB,qBAAqB,GAAG;EACtD;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY,CACV;IAAE,MAAM;IAAc,IAAI;IAAS,UAAU;IAAM,QAAQ;GAAE,GAC7D;IAAE,MAAM;IAAU,IAAI;IAAS,UAAU;IAAM,QAAQD,QAAAA,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;GAAE,CACtF;GACA,WAAW,EACT,KAAK;IACH,aAAa;IACb,aAAa;IACb,QAAQA,QAAAA,KAAK,OAAO,EAAE,QAAQ,SAAS,CAAC;GAC1C,EACF;EACF;EACA,SAAS,OAAO,gBAAgB,mBAAmB;EACnD,SAAS,OAAO,cAAc,mBAAmB;EACjD,SAAS,QAAQ,kBAAkB,IAAI;EACvC,SAAS,QAAQ,iBAAiB,MAAM,oBAAoB;EAC5D,SAAS,QAAQ,eAAe,qBAAqB,KAAA,GAAW,GAAG;EACnE,SACE,OACA,mBACAA,QAAAA,KAAK,MAAM,CACTA,QAAAA,KAAK,KAAK,GACVA,QAAAA,KAAK,OAAO;GACV,WAAW;GACX,QAAQ;GACR,iBAAiB;GACjB,WAAW;GACX,uBAAuB;GACvB,QAAQA,QAAAA,KAAK,OAAO;IAAE,UAAU,OAAO,CAAC,SAAS,QAAQ,CAAC;IAAG,QAAQ;GAAE,CAAC;EAC1E,CAAC,CACH,CAAC,CACH;EACA,SAAS,OAAO,sBAAsBA,QAAAA,KAAK,MAAM,CAACA,QAAAA,KAAK,KAAK,GAAGA,QAAAA,KAAK,OAAO;GAAE,SAAS;GAAG,WAAW,EAAE,CAAC;EAAE,CAAC,CAAC,CAAC,CAAC;EAC7G,SACE,OACA,aACAA,QAAAA,KAAK,MAAM,CACTA,QAAAA,KAAK,KAAK,GACVA,QAAAA,KAAK,OAAO;GAAE,IAAI;GAAG,WAAW,OAAO,CAAC,WAAW,KAAK,CAAC;GAAG,SAAS,EAAE,IAAI;GAAG,SAAS;GAAG,UAAU,EAAE,CAAC;EAAE,CAAC,CAC5G,CAAC,CACH;EACA,SAAS,QAAQ,iBAAiB,qBAAqBA,QAAAA,KAAK,OAAO;GAAE,IAAI;GAAG,OAAO,EAAE,CAAC;GAAG,QAAQ,EAAE,IAAI;EAAE,CAAC,CAAC;EAC3G,SACE,QACA,aACA,qBACAA,QAAAA,KAAK,OAAO;GAAE,OAAO,EAAE,CAAC;GAAG,MAAM,EAAEA,QAAAA,KAAK,OAAO;IAAE,SAAS;IAAG,WAAW;GAAE,CAAC,CAAC;GAAG,UAAU,EAAE,QAAQ;EAAE,CAAC,CACxG;CACF;CACA,SAAU,CAAC,UAAU,WAAW,CAAC,CAAW,SAAS,UAAU,CAC7D;EACE,IAAI;EACJ;EACA,SAAS;EACT,QAAQ;EACR,MAAM;EACN,WAAW;EACX,aAAa;EACb,OAAOA,QAAAA,KAAK,OAAO;GAAE,OAAO;GAAqB,SAASA,QAAAA,KAAK,MAAM,MAAM;GAAG,MAAM,EAAEA,QAAAA,KAAK,QAAQ,IAAI,CAAC;EAAE,CAAC;CAC7G,GACA;EACE,IAAI;EACJ;EACA,SAAS;EACT,QAAQ;EACR,MAAM;EACN,WAAW;EACX,aAAa;EACb,OAAOA,QAAAA,KAAK,OAAO,EAAE,QAAQ,OAAO;GAAC;GAAU;GAAW;GAAQ;EAAW,CAAC,EAAE,CAAC;CACnF,CACF,CAAC;AACH,CAAC"}

package/dist/apiContracts.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"apiContracts.d.mts","names":[],"sources":["../src/schemas/apiContracts.ts"],"mappings":";;qBAoEa"}
+{"version":3,"file":"apiContracts.d.mts","names":[],"sources":["../src/schemas/apiContracts.ts"],"mappings":";;qBA6Ea"}

package/dist/apiContracts.mjs

@@ -40,6 +40,26 @@ const ComputerStateSchema = Type.Object({
 	failure: O(Error),
 	artifact: O(Artifact)
 });
+const Permission = values([
+	"accessibility",
+	"screen-recording",
+	"microphone",
+	"automation",
+	"full-disk-access"
+]);
+const PermissionState = values([
+	"granted",
+	"denied",
+	"not-determined",
+	"per-app"
+]);
+const DesktopPermissionStatesSchema = Type.Object({
+	accessibility: PermissionState,
+	"screen-recording": PermissionState,
+	microphone: PermissionState,
+	automation: PermissionState,
+	"full-disk-access": PermissionState
+});
 const Reference = {
 	snapshotId: Type.String({ minLength: 1 }),
 	elementRef: Type.String({ minLength: 1 })
@@ -92,6 +112,32 @@ const apiContracts = defineApiContract({
 	version: 1,
 	dynamic: ["Desktop provider target extensions, observations and operation results are runtime-defined JSON."],
 	http: [
+		...[
+			"global",
+			"workspace",
+			"session"
+		].flatMap((scope) => ["GET", "POST"].map((method) => ({
+			id: `computer.permissions.${method === "GET" ? "read" : "request"}`,
+			scope,
+			basePath: "desktop-permissions",
+			path: "/",
+			method,
+			authentication: "owner",
+			description: method === "GET" ? "Read the Mac-owned permission states. Requires an authorized local Desktop caller or trusted remote caller." : "Ask macOS for one named permission. Requires an authorized local Desktop caller or remote passkey step-up.",
+			availability: "Requires Po Desktop to be running this server; otherwise returns 404.",
+			...method === "POST" ? { body: {
+				required: true,
+				contentType: "application/json",
+				schema: Type.Object({ permission: Permission })
+			} } : {},
+			responses: {
+				...jsonApiResponses(DesktopPermissionStatesSchema),
+				"502": {
+					description: "Desktop permission request failed.",
+					schema: Type.Object({ error: S })
+				}
+			}
+		}))),
 		{
 			id: "computer.activation.state",
 			scope: "session",

package/dist/apiContracts.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"apiContracts.mjs","names":[],"sources":["../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract, jsonApiResponses, type PoHttpContract } from '@agimon-ai/po-core/apiContracts';\nimport { Type } from 'typebox';\n\nconst S = Type.String();\nconst N = Type.Number();\nconst O = Type.Optional;\nconst values = <T extends string>(items: T[]) => Type.Union(items.map((item) => Type.Literal(item)));\nconst Json = Type.Unknown({\n  description:\n    'Desktop provider JSON value. Targets, observations and action results are supplied by the admitted Desktop provider.',\n});\nconst Target = Type.Record(S, Json);\nconst Error = Type.Object({ code: S, message: S });\nconst Artifact = Type.Object({\n  artifactId: S,\n  status: values(['ready', 'failed']),\n  sizeBytes: O(N),\n  downloadUrl: O(S),\n  previewUrl: O(S),\n  actionCount: O(N),\n  completedAt: O(S),\n  failure: O(Error),\n});\nexport const ComputerStateSchema = Type.Object({\n  sessionId: S,\n  revision: N,\n  wake: N,\n  phase: values(['inactive', 'awaiting_confirmation', 'activating', 'active', 'stopping', 'failed']),\n  requestId: O(S),\n  target: O(Target),\n  durationMs: O(N),\n  expiresAt: O(N),\n  failure: O(Error),\n  artifact: O(Artifact),\n});\nconst Reference = { snapshotId: Type.String({ minLength: 1 }), elementRef: Type.String({ minLength: 1 }) };\nexport const ComputerActionSchema = Type.Union([\n  Type.Object({ kind: values(['press', 'focus']), ...Reference }, { additionalProperties: false }),\n  Type.Object({ kind: Type.Literal('set_value'), ...Reference, value: S }, { additionalProperties: false }),\n  Type.Object(\n    {\n      kind: Type.Literal('scroll'),\n      ...Reference,\n      direction: values(['up', 'down', 'left', 'right']),\n      amount: values(['line', 'page']),\n    },\n    { additionalProperties: false },\n  ),\n]);\nconst internal = (\n  method: 'GET' | 'POST',\n  path: string,\n  output: object,\n  body?: object,\n  status = 200,\n): PoHttpContract => ({\n  id: `computer.${path.slice(1).replaceAll('/', '.')}`,\n  scope: 'session',\n  basePath: 'computer-use',\n  path,\n  method,\n  authentication: 'owner',\n  description: `Computer use broker ${path}. Requires the host-issued ${path.startsWith('/agent/') ? 'agent' : 'hub'} bearer token.`,\n  availability: 'Internal broker route; ordinary browser credentials are insufficient.',\n  parameters: [{ name: 'Authorization', in: 'header', required: true, schema: Type.String({ pattern: '^Bearer .+' }) }],\n  ...(body ? { body: { required: true, contentType: 'application/json', schema: body } } : {}),\n  responses: jsonApiResponses(output, status),\n});\nexport const apiContracts = defineApiContract({\n  version: 1,\n  dynamic: ['Desktop provider target extensions, observations and operation results are runtime-defined JSON.'],\n  http: [\n    {\n      id: 'computer.activation.state',\n      scope: 'session',\n      basePath: 'computer-use',\n      path: '/activate',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read state as the matching pending requester or approved recording reader.',\n      responses: jsonApiResponses(ComputerStateSchema),\n    },\n    {\n      id: 'computer.activation.cancel',\n      scope: 'session',\n      basePath: 'computer-use',\n      path: '/activate',\n      method: 'DELETE',\n      authentication: 'owner',\n      description: 'Cancel only the matching requester pending activation.',\n      responses: jsonApiResponses(ComputerStateSchema, 202),\n    },\n    {\n      id: 'computer.activate',\n      scope: 'session',\n      basePath: 'computer-use',\n      path: '/activate',\n      method: 'POST',\n      authentication: 'owner',\n      description:\n        'Request confirmed Desktop access with admitted caller and remote step-up context. A remote caller may omit target so the local Mac selects the window.',\n      body: {\n        required: true,\n        contentType: 'application/json',\n        schema: Type.Object({\n          target: O(Type.Object({ windowId: S, bundleId: S })),\n          durationMs: Type.Integer({ minimum: 1000, maximum: 1800000 }),\n        }),\n      },\n      responses: jsonApiResponses(ComputerStateSchema, 202),\n    },\n    {\n      id: 'computer.artifact',\n      scope: 'session',\n      basePath: 'computer-use',\n      path: '/artifact',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read at most 1 MiB of a recording belonging to this session and approved caller.',\n      parameters: [\n        { name: 'artifactId', in: 'query', required: true, schema: S },\n        { name: 'offset', in: 'query', required: true, schema: Type.Integer({ minimum: 0 }) },\n      ],\n      responses: {\n        206: {\n          description: 'Bounded recording bytes.',\n          contentType: 'video/mp4',\n          schema: Type.String({ format: 'binary' }),\n        },\n      },\n    },\n    internal('GET', '/agent/state', ComputerStateSchema),\n    internal('GET', '/hub/state', ComputerStateSchema),\n    internal('POST', '/agent/observe', Json),\n    internal('POST', '/agent/action', Json, ComputerActionSchema),\n    internal('POST', '/agent/stop', ComputerStateSchema, undefined, 202),\n    internal(\n      'GET',\n      '/hub/activation',\n      Type.Union([\n        Type.Null(),\n        Type.Object({\n          requestId: S,\n          target: Target,\n          durationSeconds: N,\n          createdAt: N,\n          confirmationExpiresAt: N,\n          caller: Type.Object({ locality: values(['local', 'remote']), stepUp: S }),\n        }),\n      ]),\n    ),\n    internal('GET', '/hub/authorization', Type.Union([Type.Null(), Type.Object({ grantId: S, expiresAt: O(N) })])),\n    internal(\n      'GET',\n      '/hub/next',\n      Type.Union([\n        Type.Null(),\n        Type.Object({ id: S, operation: values(['observe', 'act']), payload: O(Json), grantId: S, sequence: O(N) }),\n      ]),\n    ),\n    internal('POST', '/hub/complete', ComputerStateSchema, Type.Object({ id: S, error: O(S), result: O(Json) })),\n    internal(\n      'POST',\n      '/hub/stop',\n      ComputerStateSchema,\n      Type.Object({ error: O(S), host: O(Type.Object({ grantId: S, expiresAt: N })), artifact: O(Artifact) }),\n    ),\n  ],\n  sockets: (['global', 'workspace'] as const).flatMap((scope) => [\n    {\n      id: 'computer.state',\n      scope,\n      service: 'po.hub',\n      member: 'computer_use_state',\n      kind: 'channel',\n      direction: 'server-to-client',\n      description: 'Computer use channel payload.',\n      input: Type.Object({ state: ComputerStateSchema, targets: Type.Array(Target), busy: O(Type.Literal(true)) }),\n    },\n    {\n      id: 'computer.command',\n      scope,\n      service: 'po.hub',\n      member: 'computer_use_state',\n      kind: 'channel',\n      direction: 'client-to-server',\n      description: 'Computer use browser channel command.',\n      input: Type.Object({ action: values(['status', 'targets', 'stop', 'artifacts']) }),\n    },\n  ]),\n});\nexport default apiContracts;\n"],"mappings":";;;AAGA,MAAM,IAAI,KAAK,OAAO;AACtB,MAAM,IAAI,KAAK,OAAO;AACtB,MAAM,IAAI,KAAK;AACf,MAAM,UAA4B,UAAe,KAAK,MAAM,MAAM,KAAK,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC;AACnG,MAAM,OAAO,KAAK,QAAQ,EACxB,aACE,uHACJ,CAAC;AACD,MAAM,SAAS,KAAK,OAAO,GAAG,IAAI;AAClC,MAAM,QAAQ,KAAK,OAAO;CAAE,MAAM;CAAG,SAAS;AAAE,CAAC;AACjD,MAAM,WAAW,KAAK,OAAO;CAC3B,YAAY;CACZ,QAAQ,OAAO,CAAC,SAAS,QAAQ,CAAC;CAClC,WAAW,EAAE,CAAC;CACd,aAAa,EAAE,CAAC;CAChB,YAAY,EAAE,CAAC;CACf,aAAa,EAAE,CAAC;CAChB,aAAa,EAAE,CAAC;CAChB,SAAS,EAAE,KAAK;AAClB,CAAC;AACD,MAAa,sBAAsB,KAAK,OAAO;CAC7C,WAAW;CACX,UAAU;CACV,MAAM;CACN,OAAO,OAAO;EAAC;EAAY;EAAyB;EAAc;EAAU;EAAY;CAAQ,CAAC;CACjG,WAAW,EAAE,CAAC;CACd,QAAQ,EAAE,MAAM;CAChB,YAAY,EAAE,CAAC;CACf,WAAW,EAAE,CAAC;CACd,SAAS,EAAE,KAAK;CAChB,UAAU,EAAE,QAAQ;AACtB,CAAC;AACD,MAAM,YAAY;CAAE,YAAY,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CAAG,YAAY,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;AAAE;AACzG,MAAa,uBAAuB,KAAK,MAAM;CAC7C,KAAK,OAAO;EAAE,MAAM,OAAO,CAAC,SAAS,OAAO,CAAC;EAAG,GAAG;CAAU,GAAG,EAAE,sBAAsB,MAAM,CAAC;CAC/F,KAAK,OAAO;EAAE,MAAM,KAAK,QAAQ,WAAW;EAAG,GAAG;EAAW,OAAO;CAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC;CACxG,KAAK,OACH;EACE,MAAM,KAAK,QAAQ,QAAQ;EAC3B,GAAG;EACH,WAAW,OAAO;GAAC;GAAM;GAAQ;GAAQ;EAAO,CAAC;EACjD,QAAQ,OAAO,CAAC,QAAQ,MAAM,CAAC;CACjC,GACA,EAAE,sBAAsB,MAAM,CAChC;AACF,CAAC;AACD,MAAM,YACJ,QACA,MACA,QACA,MACA,SAAS,SACW;CACpB,IAAI,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,KAAK,GAAG;CACjD,OAAO;CACP,UAAU;CACV;CACA;CACA,gBAAgB;CAChB,aAAa,uBAAuB,KAAK,6BAA6B,KAAK,WAAW,SAAS,IAAI,UAAU,MAAM;CACnH,cAAc;CACd,YAAY,CAAC;EAAE,MAAM;EAAiB,IAAI;EAAU,UAAU;EAAM,QAAQ,KAAK,OAAO,EAAE,SAAS,aAAa,CAAC;CAAE,CAAC;CACpH,GAAI,OAAO,EAAE,MAAM;EAAE,UAAU;EAAM,aAAa;EAAoB,QAAQ;CAAK,EAAE,IAAI,CAAC;CAC1F,WAAW,iBAAiB,QAAQ,MAAM;AAC5C;AACA,MAAa,eAAe,kBAAkB;CAC5C,SAAS;CACT,SAAS,CAAC,kGAAkG;CAC5G,MAAM;EACJ;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,WAAW,iBAAiB,mBAAmB;EACjD;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,WAAW,iBAAiB,qBAAqB,GAAG;EACtD;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aACE;GACF,MAAM;IACJ,UAAU;IACV,aAAa;IACb,QAAQ,KAAK,OAAO;KAClB,QAAQ,EAAE,KAAK,OAAO;MAAE,UAAU;MAAG,UAAU;KAAE,CAAC,CAAC;KACnD,YAAY,KAAK,QAAQ;MAAE,SAAS;MAAM,SAAS;KAAQ,CAAC;IAC9D,CAAC;GACH;GACA,WAAW,iBAAiB,qBAAqB,GAAG;EACtD;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY,CACV;IAAE,MAAM;IAAc,IAAI;IAAS,UAAU;IAAM,QAAQ;GAAE,GAC7D;IAAE,MAAM;IAAU,IAAI;IAAS,UAAU;IAAM,QAAQ,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;GAAE,CACtF;GACA,WAAW,EACT,KAAK;IACH,aAAa;IACb,aAAa;IACb,QAAQ,KAAK,OAAO,EAAE,QAAQ,SAAS,CAAC;GAC1C,EACF;EACF;EACA,SAAS,OAAO,gBAAgB,mBAAmB;EACnD,SAAS,OAAO,cAAc,mBAAmB;EACjD,SAAS,QAAQ,kBAAkB,IAAI;EACvC,SAAS,QAAQ,iBAAiB,MAAM,oBAAoB;EAC5D,SAAS,QAAQ,eAAe,qBAAqB,KAAA,GAAW,GAAG;EACnE,SACE,OACA,mBACA,KAAK,MAAM,CACT,KAAK,KAAK,GACV,KAAK,OAAO;GACV,WAAW;GACX,QAAQ;GACR,iBAAiB;GACjB,WAAW;GACX,uBAAuB;GACvB,QAAQ,KAAK,OAAO;IAAE,UAAU,OAAO,CAAC,SAAS,QAAQ,CAAC;IAAG,QAAQ;GAAE,CAAC;EAC1E,CAAC,CACH,CAAC,CACH;EACA,SAAS,OAAO,sBAAsB,KAAK,MAAM,CAAC,KAAK,KAAK,GAAG,KAAK,OAAO;GAAE,SAAS;GAAG,WAAW,EAAE,CAAC;EAAE,CAAC,CAAC,CAAC,CAAC;EAC7G,SACE,OACA,aACA,KAAK,MAAM,CACT,KAAK,KAAK,GACV,KAAK,OAAO;GAAE,IAAI;GAAG,WAAW,OAAO,CAAC,WAAW,KAAK,CAAC;GAAG,SAAS,EAAE,IAAI;GAAG,SAAS;GAAG,UAAU,EAAE,CAAC;EAAE,CAAC,CAC5G,CAAC,CACH;EACA,SAAS,QAAQ,iBAAiB,qBAAqB,KAAK,OAAO;GAAE,IAAI;GAAG,OAAO,EAAE,CAAC;GAAG,QAAQ,EAAE,IAAI;EAAE,CAAC,CAAC;EAC3G,SACE,QACA,aACA,qBACA,KAAK,OAAO;GAAE,OAAO,EAAE,CAAC;GAAG,MAAM,EAAE,KAAK,OAAO;IAAE,SAAS;IAAG,WAAW;GAAE,CAAC,CAAC;GAAG,UAAU,EAAE,QAAQ;EAAE,CAAC,CACxG;CACF;CACA,SAAU,CAAC,UAAU,WAAW,CAAC,CAAW,SAAS,UAAU,CAC7D;EACE,IAAI;EACJ;EACA,SAAS;EACT,QAAQ;EACR,MAAM;EACN,WAAW;EACX,aAAa;EACb,OAAO,KAAK,OAAO;GAAE,OAAO;GAAqB,SAAS,KAAK,MAAM,MAAM;GAAG,MAAM,EAAE,KAAK,QAAQ,IAAI,CAAC;EAAE,CAAC;CAC7G,GACA;EACE,IAAI;EACJ;EACA,SAAS;EACT,QAAQ;EACR,MAAM;EACN,WAAW;EACX,aAAa;EACb,OAAO,KAAK,OAAO,EAAE,QAAQ,OAAO;GAAC;GAAU;GAAW;GAAQ;EAAW,CAAC,EAAE,CAAC;CACnF,CACF,CAAC;AACH,CAAC"}
+{"version":3,"file":"apiContracts.mjs","names":[],"sources":["../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract, jsonApiResponses, type PoHttpContract } from '@agimon-ai/po-core/apiContracts';\nimport { Type } from 'typebox';\n\nconst S = Type.String();\nconst N = Type.Number();\nconst O = Type.Optional;\nconst values = <T extends string>(items: T[]) => Type.Union(items.map((item) => Type.Literal(item)));\nconst Json = Type.Unknown({\n  description:\n    'Desktop provider JSON value. Targets, observations and action results are supplied by the admitted Desktop provider.',\n});\nconst Target = Type.Record(S, Json);\nconst Error = Type.Object({ code: S, message: S });\nconst Artifact = Type.Object({\n  artifactId: S,\n  status: values(['ready', 'failed']),\n  sizeBytes: O(N),\n  downloadUrl: O(S),\n  previewUrl: O(S),\n  actionCount: O(N),\n  completedAt: O(S),\n  failure: O(Error),\n});\nexport const ComputerStateSchema = Type.Object({\n  sessionId: S,\n  revision: N,\n  wake: N,\n  phase: values(['inactive', 'awaiting_confirmation', 'activating', 'active', 'stopping', 'failed']),\n  requestId: O(S),\n  target: O(Target),\n  durationMs: O(N),\n  expiresAt: O(N),\n  failure: O(Error),\n  artifact: O(Artifact),\n});\nconst Permission = values(['accessibility', 'screen-recording', 'microphone', 'automation', 'full-disk-access']);\nconst PermissionState = values(['granted', 'denied', 'not-determined', 'per-app']);\nexport const DesktopPermissionStatesSchema = Type.Object({\n  accessibility: PermissionState,\n  'screen-recording': PermissionState,\n  microphone: PermissionState,\n  automation: PermissionState,\n  'full-disk-access': PermissionState,\n});\nconst Reference = { snapshotId: Type.String({ minLength: 1 }), elementRef: Type.String({ minLength: 1 }) };\nexport const ComputerActionSchema = Type.Union([\n  Type.Object({ kind: values(['press', 'focus']), ...Reference }, { additionalProperties: false }),\n  Type.Object({ kind: Type.Literal('set_value'), ...Reference, value: S }, { additionalProperties: false }),\n  Type.Object(\n    {\n      kind: Type.Literal('scroll'),\n      ...Reference,\n      direction: values(['up', 'down', 'left', 'right']),\n      amount: values(['line', 'page']),\n    },\n    { additionalProperties: false },\n  ),\n]);\nconst internal = (\n  method: 'GET' | 'POST',\n  path: string,\n  output: object,\n  body?: object,\n  status = 200,\n): PoHttpContract => ({\n  id: `computer.${path.slice(1).replaceAll('/', '.')}`,\n  scope: 'session',\n  basePath: 'computer-use',\n  path,\n  method,\n  authentication: 'owner',\n  description: `Computer use broker ${path}. Requires the host-issued ${path.startsWith('/agent/') ? 'agent' : 'hub'} bearer token.`,\n  availability: 'Internal broker route; ordinary browser credentials are insufficient.',\n  parameters: [{ name: 'Authorization', in: 'header', required: true, schema: Type.String({ pattern: '^Bearer .+' }) }],\n  ...(body ? { body: { required: true, contentType: 'application/json', schema: body } } : {}),\n  responses: jsonApiResponses(output, status),\n});\nexport const apiContracts = defineApiContract({\n  version: 1,\n  dynamic: ['Desktop provider target extensions, observations and operation results are runtime-defined JSON.'],\n  http: [\n    ...(['global', 'workspace', 'session'] as const).flatMap((scope) =>\n      (['GET', 'POST'] as const).map((method) => ({\n        id: `computer.permissions.${method === 'GET' ? 'read' : 'request'}`,\n        scope,\n        basePath: 'desktop-permissions',\n        path: '/',\n        method,\n        authentication: 'owner' as const,\n        description:\n          method === 'GET'\n            ? 'Read the Mac-owned permission states. Requires an authorized local Desktop caller or trusted remote caller.'\n            : 'Ask macOS for one named permission. Requires an authorized local Desktop caller or remote passkey step-up.',\n        availability: 'Requires Po Desktop to be running this server; otherwise returns 404.',\n        ...(method === 'POST'\n          ? {\n              body: {\n                required: true,\n                contentType: 'application/json',\n                schema: Type.Object({ permission: Permission }),\n              },\n            }\n          : {}),\n        responses: {\n          ...jsonApiResponses(DesktopPermissionStatesSchema),\n          '502': { description: 'Desktop permission request failed.', schema: Type.Object({ error: S }) },\n        },\n      })),\n    ),\n    {\n      id: 'computer.activation.state',\n      scope: 'session',\n      basePath: 'computer-use',\n      path: '/activate',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read state as the matching pending requester or approved recording reader.',\n      responses: jsonApiResponses(ComputerStateSchema),\n    },\n    {\n      id: 'computer.activation.cancel',\n      scope: 'session',\n      basePath: 'computer-use',\n      path: '/activate',\n      method: 'DELETE',\n      authentication: 'owner',\n      description: 'Cancel only the matching requester pending activation.',\n      responses: jsonApiResponses(ComputerStateSchema, 202),\n    },\n    {\n      id: 'computer.activate',\n      scope: 'session',\n      basePath: 'computer-use',\n      path: '/activate',\n      method: 'POST',\n      authentication: 'owner',\n      description:\n        'Request confirmed Desktop access with admitted caller and remote step-up context. A remote caller may omit target so the local Mac selects the window.',\n      body: {\n        required: true,\n        contentType: 'application/json',\n        schema: Type.Object({\n          target: O(Type.Object({ windowId: S, bundleId: S })),\n          durationMs: Type.Integer({ minimum: 1000, maximum: 1800000 }),\n        }),\n      },\n      responses: jsonApiResponses(ComputerStateSchema, 202),\n    },\n    {\n      id: 'computer.artifact',\n      scope: 'session',\n      basePath: 'computer-use',\n      path: '/artifact',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read at most 1 MiB of a recording belonging to this session and approved caller.',\n      parameters: [\n        { name: 'artifactId', in: 'query', required: true, schema: S },\n        { name: 'offset', in: 'query', required: true, schema: Type.Integer({ minimum: 0 }) },\n      ],\n      responses: {\n        206: {\n          description: 'Bounded recording bytes.',\n          contentType: 'video/mp4',\n          schema: Type.String({ format: 'binary' }),\n        },\n      },\n    },\n    internal('GET', '/agent/state', ComputerStateSchema),\n    internal('GET', '/hub/state', ComputerStateSchema),\n    internal('POST', '/agent/observe', Json),\n    internal('POST', '/agent/action', Json, ComputerActionSchema),\n    internal('POST', '/agent/stop', ComputerStateSchema, undefined, 202),\n    internal(\n      'GET',\n      '/hub/activation',\n      Type.Union([\n        Type.Null(),\n        Type.Object({\n          requestId: S,\n          target: Target,\n          durationSeconds: N,\n          createdAt: N,\n          confirmationExpiresAt: N,\n          caller: Type.Object({ locality: values(['local', 'remote']), stepUp: S }),\n        }),\n      ]),\n    ),\n    internal('GET', '/hub/authorization', Type.Union([Type.Null(), Type.Object({ grantId: S, expiresAt: O(N) })])),\n    internal(\n      'GET',\n      '/hub/next',\n      Type.Union([\n        Type.Null(),\n        Type.Object({ id: S, operation: values(['observe', 'act']), payload: O(Json), grantId: S, sequence: O(N) }),\n      ]),\n    ),\n    internal('POST', '/hub/complete', ComputerStateSchema, Type.Object({ id: S, error: O(S), result: O(Json) })),\n    internal(\n      'POST',\n      '/hub/stop',\n      ComputerStateSchema,\n      Type.Object({ error: O(S), host: O(Type.Object({ grantId: S, expiresAt: N })), artifact: O(Artifact) }),\n    ),\n  ],\n  sockets: (['global', 'workspace'] as const).flatMap((scope) => [\n    {\n      id: 'computer.state',\n      scope,\n      service: 'po.hub',\n      member: 'computer_use_state',\n      kind: 'channel',\n      direction: 'server-to-client',\n      description: 'Computer use channel payload.',\n      input: Type.Object({ state: ComputerStateSchema, targets: Type.Array(Target), busy: O(Type.Literal(true)) }),\n    },\n    {\n      id: 'computer.command',\n      scope,\n      service: 'po.hub',\n      member: 'computer_use_state',\n      kind: 'channel',\n      direction: 'client-to-server',\n      description: 'Computer use browser channel command.',\n      input: Type.Object({ action: values(['status', 'targets', 'stop', 'artifacts']) }),\n    },\n  ]),\n});\nexport default apiContracts;\n"],"mappings":";;;AAGA,MAAM,IAAI,KAAK,OAAO;AACtB,MAAM,IAAI,KAAK,OAAO;AACtB,MAAM,IAAI,KAAK;AACf,MAAM,UAA4B,UAAe,KAAK,MAAM,MAAM,KAAK,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC;AACnG,MAAM,OAAO,KAAK,QAAQ,EACxB,aACE,uHACJ,CAAC;AACD,MAAM,SAAS,KAAK,OAAO,GAAG,IAAI;AAClC,MAAM,QAAQ,KAAK,OAAO;CAAE,MAAM;CAAG,SAAS;AAAE,CAAC;AACjD,MAAM,WAAW,KAAK,OAAO;CAC3B,YAAY;CACZ,QAAQ,OAAO,CAAC,SAAS,QAAQ,CAAC;CAClC,WAAW,EAAE,CAAC;CACd,aAAa,EAAE,CAAC;CAChB,YAAY,EAAE,CAAC;CACf,aAAa,EAAE,CAAC;CAChB,aAAa,EAAE,CAAC;CAChB,SAAS,EAAE,KAAK;AAClB,CAAC;AACD,MAAa,sBAAsB,KAAK,OAAO;CAC7C,WAAW;CACX,UAAU;CACV,MAAM;CACN,OAAO,OAAO;EAAC;EAAY;EAAyB;EAAc;EAAU;EAAY;CAAQ,CAAC;CACjG,WAAW,EAAE,CAAC;CACd,QAAQ,EAAE,MAAM;CAChB,YAAY,EAAE,CAAC;CACf,WAAW,EAAE,CAAC;CACd,SAAS,EAAE,KAAK;CAChB,UAAU,EAAE,QAAQ;AACtB,CAAC;AACD,MAAM,aAAa,OAAO;CAAC;CAAiB;CAAoB;CAAc;CAAc;AAAkB,CAAC;AAC/G,MAAM,kBAAkB,OAAO;CAAC;CAAW;CAAU;CAAkB;AAAS,CAAC;AACjF,MAAa,gCAAgC,KAAK,OAAO;CACvD,eAAe;CACf,oBAAoB;CACpB,YAAY;CACZ,YAAY;CACZ,oBAAoB;AACtB,CAAC;AACD,MAAM,YAAY;CAAE,YAAY,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CAAG,YAAY,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;AAAE;AACzG,MAAa,uBAAuB,KAAK,MAAM;CAC7C,KAAK,OAAO;EAAE,MAAM,OAAO,CAAC,SAAS,OAAO,CAAC;EAAG,GAAG;CAAU,GAAG,EAAE,sBAAsB,MAAM,CAAC;CAC/F,KAAK,OAAO;EAAE,MAAM,KAAK,QAAQ,WAAW;EAAG,GAAG;EAAW,OAAO;CAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC;CACxG,KAAK,OACH;EACE,MAAM,KAAK,QAAQ,QAAQ;EAC3B,GAAG;EACH,WAAW,OAAO;GAAC;GAAM;GAAQ;GAAQ;EAAO,CAAC;EACjD,QAAQ,OAAO,CAAC,QAAQ,MAAM,CAAC;CACjC,GACA,EAAE,sBAAsB,MAAM,CAChC;AACF,CAAC;AACD,MAAM,YACJ,QACA,MACA,QACA,MACA,SAAS,SACW;CACpB,IAAI,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,KAAK,GAAG;CACjD,OAAO;CACP,UAAU;CACV;CACA;CACA,gBAAgB;CAChB,aAAa,uBAAuB,KAAK,6BAA6B,KAAK,WAAW,SAAS,IAAI,UAAU,MAAM;CACnH,cAAc;CACd,YAAY,CAAC;EAAE,MAAM;EAAiB,IAAI;EAAU,UAAU;EAAM,QAAQ,KAAK,OAAO,EAAE,SAAS,aAAa,CAAC;CAAE,CAAC;CACpH,GAAI,OAAO,EAAE,MAAM;EAAE,UAAU;EAAM,aAAa;EAAoB,QAAQ;CAAK,EAAE,IAAI,CAAC;CAC1F,WAAW,iBAAiB,QAAQ,MAAM;AAC5C;AACA,MAAa,eAAe,kBAAkB;CAC5C,SAAS;CACT,SAAS,CAAC,kGAAkG;CAC5G,MAAM;EACJ,GAAI;GAAC;GAAU;GAAa;EAAS,CAAC,CAAW,SAAS,UACvD,CAAC,OAAO,MAAM,CAAC,CAAW,KAAK,YAAY;GAC1C,IAAI,wBAAwB,WAAW,QAAQ,SAAS;GACxD;GACA,UAAU;GACV,MAAM;GACN;GACA,gBAAgB;GAChB,aACE,WAAW,QACP,gHACA;GACN,cAAc;GACd,GAAI,WAAW,SACX,EACE,MAAM;IACJ,UAAU;IACV,aAAa;IACb,QAAQ,KAAK,OAAO,EAAE,YAAY,WAAW,CAAC;GAChD,EACF,IACA,CAAC;GACL,WAAW;IACT,GAAG,iBAAiB,6BAA6B;IACjD,OAAO;KAAE,aAAa;KAAsC,QAAQ,KAAK,OAAO,EAAE,OAAO,EAAE,CAAC;IAAE;GAChG;EACF,EAAE,CACJ;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,WAAW,iBAAiB,mBAAmB;EACjD;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,WAAW,iBAAiB,qBAAqB,GAAG;EACtD;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aACE;GACF,MAAM;IACJ,UAAU;IACV,aAAa;IACb,QAAQ,KAAK,OAAO;KAClB,QAAQ,EAAE,KAAK,OAAO;MAAE,UAAU;MAAG,UAAU;KAAE,CAAC,CAAC;KACnD,YAAY,KAAK,QAAQ;MAAE,SAAS;MAAM,SAAS;KAAQ,CAAC;IAC9D,CAAC;GACH;GACA,WAAW,iBAAiB,qBAAqB,GAAG;EACtD;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY,CACV;IAAE,MAAM;IAAc,IAAI;IAAS,UAAU;IAAM,QAAQ;GAAE,GAC7D;IAAE,MAAM;IAAU,IAAI;IAAS,UAAU;IAAM,QAAQ,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;GAAE,CACtF;GACA,WAAW,EACT,KAAK;IACH,aAAa;IACb,aAAa;IACb,QAAQ,KAAK,OAAO,EAAE,QAAQ,SAAS,CAAC;GAC1C,EACF;EACF;EACA,SAAS,OAAO,gBAAgB,mBAAmB;EACnD,SAAS,OAAO,cAAc,mBAAmB;EACjD,SAAS,QAAQ,kBAAkB,IAAI;EACvC,SAAS,QAAQ,iBAAiB,MAAM,oBAAoB;EAC5D,SAAS,QAAQ,eAAe,qBAAqB,KAAA,GAAW,GAAG;EACnE,SACE,OACA,mBACA,KAAK,MAAM,CACT,KAAK,KAAK,GACV,KAAK,OAAO;GACV,WAAW;GACX,QAAQ;GACR,iBAAiB;GACjB,WAAW;GACX,uBAAuB;GACvB,QAAQ,KAAK,OAAO;IAAE,UAAU,OAAO,CAAC,SAAS,QAAQ,CAAC;IAAG,QAAQ;GAAE,CAAC;EAC1E,CAAC,CACH,CAAC,CACH;EACA,SAAS,OAAO,sBAAsB,KAAK,MAAM,CAAC,KAAK,KAAK,GAAG,KAAK,OAAO;GAAE,SAAS;GAAG,WAAW,EAAE,CAAC;EAAE,CAAC,CAAC,CAAC,CAAC;EAC7G,SACE,OACA,aACA,KAAK,MAAM,CACT,KAAK,KAAK,GACV,KAAK,OAAO;GAAE,IAAI;GAAG,WAAW,OAAO,CAAC,WAAW,KAAK,CAAC;GAAG,SAAS,EAAE,IAAI;GAAG,SAAS;GAAG,UAAU,EAAE,CAAC;EAAE,CAAC,CAC5G,CAAC,CACH;EACA,SAAS,QAAQ,iBAAiB,qBAAqB,KAAK,OAAO;GAAE,IAAI;GAAG,OAAO,EAAE,CAAC;GAAG,QAAQ,EAAE,IAAI;EAAE,CAAC,CAAC;EAC3G,SACE,QACA,aACA,qBACA,KAAK,OAAO;GAAE,OAAO,EAAE,CAAC;GAAG,MAAM,EAAE,KAAK,OAAO;IAAE,SAAS;IAAG,WAAW;GAAE,CAAC,CAAC;GAAG,UAAU,EAAE,QAAQ;EAAE,CAAC,CACxG;CACF;CACA,SAAU,CAAC,UAAU,WAAW,CAAC,CAAW,SAAS,UAAU,CAC7D;EACE,IAAI;EACJ;EACA,SAAS;EACT,QAAQ;EACR,MAAM;EACN,WAAW;EACX,aAAa;EACb,OAAO,KAAK,OAAO;GAAE,OAAO;GAAqB,SAAS,KAAK,MAAM,MAAM;GAAG,MAAM,EAAE,KAAK,QAAQ,IAAI,CAAC;EAAE,CAAC;CAC7G,GACA;EACE,IAAI;EACJ;EACA,SAAS;EACT,QAAQ;EACR,MAAM;EACN,WAAW;EACX,aAAa;EACb,OAAO,KAAK,OAAO,EAAE,QAAQ,OAAO;GAAC;GAAU;GAAW;GAAQ;EAAW,CAAC,EAAE,CAAC;CACnF,CACF,CAAC;AACH,CAAC"}

package/dist/{extensionService-Bp0q295i.cjs → extensionService-CgmosGkY.cjs}

@@ -35,6 +35,13 @@ const COMPUTER_USE_TOOL_NAMES = [
 	"computer_action",
 	"computer_exec"
 ];
+/** The session artifact storage service and the folder computer-use evidence lands in. */
+const COMPUTER_USE_ARTIFACTS_SERVICE = "po/artifacts";
+const COMPUTER_USE_ARTIFACT_DIRECTORY = "computer-use";
+/** The host recording store's own bounds: its largest recording and its range size. */
+const COMPUTER_USE_RECORDING_MAX_BYTES = 134217728;
+const COMPUTER_USE_RECORDING_CHUNK_BYTES = 1048576;
+const COMPUTER_USE_CODEMODE_GUIDANCE = "[COMPUTER USE ACTIVE]\nUse computer.state() in exec before acting and after any action that may change the interface. Use only element refs and snapshot ids returned by computer.state(). Never infer coordinates or bypass secure elements. Call computer.stop() when the task is complete. Load codemode-how-to-computer-use for details.";
 //#endregion
 //#region src/services/computerScriptWorker/index.ts
 /** Source for an isolated child process. Restricted modules execute in QuickJS, not in Node's realm. */
@@ -68,10 +75,12 @@ async function restricted(message) {
   runtime.setMaxStackSize(512 * 1024);
   const deadline = Date.now() + message.timeoutMs;
   runtime.setInterruptHandler(() => controller.signal.aborted || Date.now() >= deadline);
-  const root = realpathSync(message.scriptRoot);
+  const { realpath } = await import('node:fs/promises');
+  const root = await realpath(message.scriptRoot);
   const sources = new Map();
   let sourceBytes = 0;
   let moduleFailure;
+  // sync: QuickJS invokes module normalization and loading synchronously and cannot await filesystem reads.
   const modulePath = (candidate) => {
     const filename = realpathSync(candidate);
     const relative = path.relative(root, filename);
@@ -464,12 +473,42 @@ Object.defineProperty(exports, "COMMAND_NAME", {
 		return COMMAND_NAME;
 	}
 });
+Object.defineProperty(exports, "COMPUTER_USE_ARTIFACTS_SERVICE", {
+	enumerable: true,
+	get: function() {
+		return COMPUTER_USE_ARTIFACTS_SERVICE;
+	}
+});
+Object.defineProperty(exports, "COMPUTER_USE_ARTIFACT_DIRECTORY", {
+	enumerable: true,
+	get: function() {
+		return COMPUTER_USE_ARTIFACT_DIRECTORY;
+	}
+});
+Object.defineProperty(exports, "COMPUTER_USE_CODEMODE_GUIDANCE", {
+	enumerable: true,
+	get: function() {
+		return COMPUTER_USE_CODEMODE_GUIDANCE;
+	}
+});
 Object.defineProperty(exports, "COMPUTER_USE_GUIDANCE", {
 	enumerable: true,
 	get: function() {
 		return COMPUTER_USE_GUIDANCE;
 	}
 });
+Object.defineProperty(exports, "COMPUTER_USE_RECORDING_CHUNK_BYTES", {
+	enumerable: true,
+	get: function() {
+		return COMPUTER_USE_RECORDING_CHUNK_BYTES;
+	}
+});
+Object.defineProperty(exports, "COMPUTER_USE_RECORDING_MAX_BYTES", {
+	enumerable: true,
+	get: function() {
+		return COMPUTER_USE_RECORDING_MAX_BYTES;
+	}
+});
 Object.defineProperty(exports, "COMPUTER_USE_TOOL_NAMES", {
 	enumerable: true,
 	get: function() {
@@ -501,4 +540,4 @@ Object.defineProperty(exports, "__toESM", {
 	}
 });
 
-//# sourceMappingURL=extensionService-Bp0q295i.cjs.map
+//# sourceMappingURL=extensionService-CgmosGkY.cjs.map

package/dist/extensionService-CgmosGkY.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"extensionService-CgmosGkY.cjs","names":["realpath","path","createRequire","spawn"],"sources":["../src/constants/computerUse.ts","../src/services/computerScriptWorker/index.ts","../src/services/computerScriptRunner/index.ts","../src/services/extensionService/index.ts"],"sourcesContent":["export const COMPUTER_USE_GUIDANCE = `[COMPUTER USE ACTIVE]\nUse computer_state before acting and after any action that may change the interface. Use only element refs and snapshot ids returned by computer_state. Use computer_action for one semantic press, focus, set_value, or scroll at a time. Use computer_exec only for a trusted, explicitly allowed local TypeScript script. Never infer coordinates, inspect another application, bypass secure elements, or retry an uncertain outcome. Stop computer use when the task is complete.`;\nexport const COMMAND_NAME = 'computer-use';\nexport const COMMAND_DESCRIPTION = 'Inspect or manage the session computer use mode';\n\nexport const COMPUTER_USE_TOOL_NAMES = ['computer_state', 'computer_action', 'computer_exec'] as const;\n/** The session artifact storage service and the folder computer-use evidence lands in. */\nexport const COMPUTER_USE_ARTIFACTS_SERVICE = 'po/artifacts';\nexport const COMPUTER_USE_ARTIFACT_DIRECTORY = 'computer-use';\n/** The host recording store's own bounds: its largest recording and its range size. */\nexport const COMPUTER_USE_RECORDING_MAX_BYTES = 128 * 1024 * 1024;\nexport const COMPUTER_USE_RECORDING_CHUNK_BYTES = 1024 * 1024;\nexport const COMPUTER_USE_CODEMODE_GUIDANCE =\n  '[COMPUTER USE ACTIVE]\\nUse computer.state() in exec before acting and after any action that may change the interface. Use only element refs and snapshot ids returned by computer.state(). Never infer coordinates or bypass secure elements. Call computer.stop() when the task is complete. Load codemode-how-to-computer-use for details.';\n","/** Source for an isolated child process. Restricted modules execute in QuickJS, not in Node's realm. */\nexport const COMPUTER_SCRIPT_WORKER_SOURCE = String.raw`\nimport { readFileSync, realpathSync, statSync } from 'node:fs';\nimport path from 'node:path';\nimport { stripTypeScriptTypes } from 'node:module';\nimport { pathToFileURL } from 'node:url';\n\nlet nextRequestId = 0;\nlet started = false;\nconst pending = new Map();\nconst controller = new AbortController();\nprocess.once('SIGTERM', () => controller.abort());\nconst send = (message) => {\n  if (process.connected) process.send(message, () => {});\n};\nconst call = (operation, payload) => new Promise((resolve, reject) => {\n  if (controller.signal.aborted) return reject(new Error('Computer script was cancelled.'));\n  if (pending.size >= 64) return reject(new Error('Too many outstanding program operations.'));\n  const id = String(++nextRequestId);\n  pending.set(id, { resolve, reject });\n  send({ type: 'program', id, operation, payload });\n});\n\nasync function restricted(message) {\n  const { getQuickJS } = await import(pathToFileURL(message.quickjsPath).href);\n  const QuickJS = await getQuickJS();\n  const runtime = QuickJS.newRuntime();\n  runtime.setMemoryLimit(32 * 1024 * 1024);\n  runtime.setMaxStackSize(512 * 1024);\n  const deadline = Date.now() + message.timeoutMs;\n  runtime.setInterruptHandler(() => controller.signal.aborted || Date.now() >= deadline);\n  const { realpath } = await import('node:fs/promises');\n  const root = await realpath(message.scriptRoot);\n  const sources = new Map();\n  let sourceBytes = 0;\n  let moduleFailure;\n  // sync: QuickJS invokes module normalization and loading synchronously and cannot await filesystem reads.\n  const modulePath = (candidate) => {\n    const filename = realpathSync(candidate);\n    const relative = path.relative(root, filename);\n    if (relative === '..' || relative.startsWith('..' + path.sep) || path.isAbsolute(relative)) {\n      throw new Error('Computer helper escapes the admitted script root.');\n    }\n    if (!/\\.(ts|js|mjs)$/.test(filename)) throw new Error('Computer helpers must be JavaScript or erasable TypeScript.');\n    return filename;\n  };\n  const entry = modulePath(message.scriptPath);\n  runtime.setModuleLoader((filename) => {\n    // Preserve a rejected normalization even if the engine subsequently asks to load an empty name.\n    if (moduleFailure) throw moduleFailure;\n    if (sources.has(filename)) return sources.get(filename);\n    if (sources.size >= 32 || statSync(filename).size > 256 * 1024) throw new Error('Computer script module limit exceeded.');\n    const source = readFileSync(filename, 'utf8');\n    sourceBytes += Buffer.byteLength(source);\n    if (sourceBytes > 512 * 1024) throw new Error('Computer script source limit exceeded.');\n    const compiled = filename.endsWith('.ts') ? stripTypeScriptTypes(source, { mode: 'strip' }) : source;\n    sources.set(filename, compiled);\n    return compiled;\n  }, (base, name) => {\n    try {\n      if (name === '__entry__') return entry;\n      if (!name.startsWith('./') && !name.startsWith('../')) {\n        throw new Error('Restricted computer functions cannot import host or package modules.');\n      }\n      return modulePath(path.resolve(path.dirname(base), name));\n    } catch (error) {\n      moduleFailure = error;\n      throw error;\n    }\n  });\n  const vm = runtime.newContext();\n  let disposed = false;\n  const deferreds = new Set();\n  const pump = () => {\n    if (disposed) return;\n    const jobs = runtime.executePendingJobs();\n    if (jobs.error) {\n      const detail = vm.dump(jobs.error);\n      jobs.error.dispose();\n      throw new Error(detail?.message ?? String(detail));\n    }\n  };\n  const set = (name, value) => {\n    vm.setProp(vm.global, name, value);\n    value.dispose();\n  };\n  set('__input', vm.newString(JSON.stringify(message.input)));\n  set('__aborted', vm.newFunction('__aborted', () => controller.signal.aborted ? vm.true : vm.false));\n  set('__log', vm.newFunction('__log', (level, text) => {\n    send({ type: 'log', level: vm.getString(level), message: vm.getString(text) });\n  }));\n  set('__call', vm.newFunction('__call', (operationHandle, payloadHandle) => {\n    const operation = vm.getString(operationHandle);\n    const serialized = vm.getString(payloadHandle);\n    if (serialized.length > message.maxOutputBytes) throw new Error('Computer action exceeds the size limit.');\n    if (operation !== 'observe' && operation !== 'act') throw new Error('Unsupported program operation.');\n    const deferred = vm.newPromise();\n    deferreds.add(deferred);\n    call(operation, JSON.parse(serialized)).then((value) => {\n      if (disposed) return;\n      const handle = vm.newString(JSON.stringify(value));\n      deferred.resolve(handle);\n      handle.dispose();\n    }, (error) => {\n      if (disposed) return;\n      const handle = vm.newError(error.message);\n      deferred.reject(handle);\n      handle.dispose();\n    }).then(() => {\n      if (disposed) return;\n      deferred.dispose();\n      deferreds.delete(deferred);\n      pump();\n    }).catch((error) => send({ type: 'failed', error: error.message }));\n    return deferred.handle.dup();\n  }));\n  let evaluation;\n  try {\n    evaluation = vm.unwrapResult(vm.evalCode(\n      'import { run } from \"__entry__\";\\n' +\n      'const invoke = __call; const log = __log; const isAborted = __aborted;\\n' +\n      'const program = Object.freeze({\\n' +\n      ' observe: async (options = {}) => JSON.parse(await invoke(\"observe\", JSON.stringify(options))),\\n' +\n      ' act: async (action) => JSON.parse(await invoke(\"act\", JSON.stringify(action)))\\n' +\n      '});\\n' +\n      'const logger = Object.freeze(Object.fromEntries([\"debug\",\"info\",\"warn\",\"error\"].map(level => [level, value => log(level, String(value))])));\\n' +\n      'const signal = Object.freeze({ get aborted() { return isAborted(); }, throwIfAborted() { if (isAborted()) throw new Error(\"Computer script was cancelled.\"); } });\\n' +\n      'const result = await run({ context: { program }, input: JSON.parse(__input), logger, signal });\\n' +\n      'globalThis.__result = result === undefined ? undefined : JSON.stringify(result);',\n      path.join(root, '__computer_entry__.mjs'), { type: 'module' },\n    ));\n    const completion = vm.resolvePromise(evaluation);\n    pump();\n    const completed = vm.unwrapResult(await completion);\n    completed.dispose();\n    const result = vm.getProp(vm.global, '__result');\n    const resultJson = vm.dump(result);\n    result.dispose();\n    return resultJson;\n  } finally {\n    disposed = true;\n    for (const deferred of deferreds) deferred.dispose();\n    evaluation?.dispose();\n    vm.dispose();\n    runtime.dispose();\n  }\n}\n\nprocess.on('message', async (message) => {\n  if (message?.type === 'response') {\n    const request = pending.get(message.id);\n    if (!request) return;\n    pending.delete(message.id);\n    if (message.error) request.reject(new Error(message.error));\n    else request.resolve(message.value);\n    return;\n  }\n  if (message?.type !== 'start' || started) return;\n  started = true;\n  try {\n    let resultJson;\n    if (message.trusted) {\n      const loaded = await import(pathToFileURL(message.scriptPath).href);\n      if (typeof loaded.run !== 'function') throw new Error('Computer script must export a named run function.');\n      const program = {\n        observe: (options = {}) => call('observe', options),\n        act: (action) => call('act', action),\n      };\n      const logger = Object.fromEntries(['debug','info','warn','error'].map(level => [level, value => {\n        send({ type: 'log', level, message: String(value) });\n      }]));\n      const result = await loaded.run({ context: { program }, input: message.input, logger, signal: controller.signal });\n      resultJson = result === undefined ? undefined : JSON.stringify(result);\n    } else {\n      resultJson = await restricted(message);\n    }\n    if (typeof resultJson === 'string' && Buffer.byteLength(resultJson) > message.maxOutputBytes) {\n      throw new Error('Computer script result exceeded the size limit.');\n    }\n    send({ type: 'complete', resultJson });\n  } catch (error) {\n    send({ type: 'failed', error: String(error?.message ?? error).slice(0, 1024) });\n  }\n});\n`;\n","import { spawn } from 'node:child_process';\nimport { realpath } from 'node:fs/promises';\nimport { createRequire } from 'node:module';\nimport path from 'node:path';\n\nimport type {\n  ComputerScriptExecutionOptions,\n  ComputerScriptExecutionResult,\n  ComputerScriptRunnerOptions,\n} from '../../types/computerScript';\nimport type { ComputerUseAction, ComputerUseObservation, ComputerUseSessionClient } from '../../types/computerUse';\nimport { COMPUTER_SCRIPT_WORKER_SOURCE } from '../computerScriptWorker';\n\nconst DEFAULT_TIMEOUT_MS = 30_000;\nconst DEFAULT_MAX_OUTPUT_BYTES = 256 * 1024;\nconst MAX_IMAGE_BYTES = 6 * 1024 * 1024;\nconst MAX_PENDING_OPERATIONS = 64;\n\nexport class ComputerScriptExecutionError extends Error {\n  constructor(\n    message: string,\n    readonly completedActions: number,\n    readonly outcomeUncertain: boolean,\n  ) {\n    super(message);\n    this.name = 'ComputerScriptExecutionError';\n  }\n}\n\ninterface WorkerMessage {\n  readonly type?: unknown;\n  readonly id?: unknown;\n  readonly operation?: unknown;\n  readonly payload?: unknown;\n  readonly level?: unknown;\n  readonly message?: unknown;\n  readonly resultJson?: unknown;\n  readonly error?: unknown;\n}\n\nexport class ComputerScriptRunner {\n  private readonly client: ComputerUseSessionClient;\n  private readonly allowedScriptPaths: readonly string[];\n  private readonly scriptRoot?: string;\n  private readonly timeoutMs: number;\n  private readonly maxOutputBytes: number;\n\n  constructor(options: ComputerScriptRunnerOptions) {\n    this.client = options.client;\n    this.allowedScriptPaths = options.allowedScriptPaths;\n    this.scriptRoot = options.scriptRoot;\n    this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    this.maxOutputBytes = options.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;\n  }\n\n  async execute(\n    scriptPath: string,\n    input: unknown,\n    signal?: AbortSignal,\n    options: ComputerScriptExecutionOptions = {},\n    cwd?: string,\n  ): Promise<ComputerScriptExecutionResult> {\n    signal?.throwIfAborted();\n    const resolvedPath = await realpath(path.resolve(this.scriptRoot ?? cwd ?? process.cwd(), scriptPath));\n    const allowedPaths = await Promise.all(\n      this.allowedScriptPaths.map(async (candidate) => realpath(candidate).catch(() => '')),\n    );\n    const trusted = options.trusted === true;\n    if ((trusted || this.scriptRoot === undefined) && !allowedPaths.includes(resolvedPath)) {\n      throw new Error('Computer script path is not explicitly allowed.');\n    }\n    if (!/\\.(ts|js|mjs)$/u.test(resolvedPath))\n      throw new Error('Computer scripts must be JavaScript or erasable TypeScript files.');\n    const root = await realpath(this.scriptRoot ?? path.dirname(resolvedPath));\n    const relative = path.relative(root, resolvedPath);\n    if (!trusted && (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative))) {\n      throw new Error('Computer script escapes the admitted script root.');\n    }\n    const serializedInput = JSON.stringify(input);\n    if (serializedInput === undefined) throw new Error('Computer script input must be JSON serializable.');\n    if (Buffer.byteLength(serializedInput) > this.maxOutputBytes)\n      throw new Error('Computer script input exceeds the size limit.');\n    const quickjsPath = trusted ? undefined : createRequire(import.meta.url).resolve('quickjs-emscripten');\n    signal?.throwIfAborted();\n    const started = performance.now();\n\n    return new Promise((resolve, reject) => {\n      const child = spawn(process.execPath, ['--input-type=module', '--eval', COMPUTER_SCRIPT_WORKER_SOURCE], {\n        stdio: ['ignore', 'pipe', 'pipe', 'ipc'],\n        // Preserve Electron's Node mode, but no host credentials, for restricted workers.\n        env: trusted ? process.env : { ELECTRON_RUN_AS_NODE: '1' },\n      });\n      const controller = new AbortController();\n      const logs: string[] = [];\n      let outputBytes = 0;\n      let completedActions = 0;\n      let observations = 0;\n      let actionInFlight = false;\n      let settled = false;\n      let completing = false;\n      let outstanding = 0;\n      let operation: Promise<void> = Promise.resolve();\n      const finish = (error?: Error, value?: ComputerScriptExecutionResult): void => {\n        if (settled) return;\n        settled = true;\n        clearTimeout(timeout);\n        signal?.removeEventListener('abort', onAbort);\n        controller.abort();\n        child.kill('SIGTERM');\n        const killTimer = setTimeout(() => child.kill('SIGKILL'), 250);\n        killTimer.unref();\n        if (error) reject(new ComputerScriptExecutionError(error.message, completedActions, actionInFlight));\n        else resolve(value!);\n      };\n      const addOutput = (value: string): boolean => {\n        outputBytes += Buffer.byteLength(value);\n        if (outputBytes <= this.maxOutputBytes) return true;\n        finish(new Error('Computer script output exceeded the size limit.'));\n        return false;\n      };\n      const send = (value: object): void => {\n        if (settled || !child.connected) return;\n        child.send(value, (error) => {\n          if (error && !settled) finish(error);\n        });\n      };\n      const onAbort = (): void => finish(new Error('Computer script execution was cancelled.'));\n      const timeout = setTimeout(() => finish(new Error('Computer script execution timed out.')), this.timeoutMs);\n      timeout.unref();\n      signal?.addEventListener('abort', onAbort, { once: true });\n      if (signal?.aborted) return onAbort();\n      child.stdout?.on('data', (chunk: Buffer) => addOutput(chunk.toString('utf8')));\n      child.stderr?.on('data', (chunk: Buffer) => addOutput(chunk.toString('utf8')));\n      child.on('error', (error) => finish(error));\n      child.on('exit', (code, exitSignal) => {\n        if (!settled)\n          finish(new Error(`Computer script worker exited before completion (${exitSignal ?? code ?? 'unknown'}).`));\n      });\n\n      const observe = async (includeScreenshot: boolean): Promise<ComputerUseObservation> => {\n        const value = await this.client.observe(controller.signal, { includeScreenshot });\n        observations += 1;\n        const { screenshot, ...semantic } = value;\n        if (Buffer.byteLength(JSON.stringify(semantic)) > this.maxOutputBytes)\n          throw new Error('Computer observation exceeds the size limit.');\n        if (includeScreenshot && screenshot) {\n          if (screenshot.mimeType !== 'image/png' || screenshot.data.length > Math.ceil(MAX_IMAGE_BYTES / 3) * 4) {\n            throw new Error('Computer screenshot exceeds the image limit.');\n          }\n          return { ...semantic, screenshot };\n        }\n        return semantic;\n      };\n\n      child.on('message', (raw: WorkerMessage) => {\n        if (settled) return;\n        if (!raw || typeof raw !== 'object' || Buffer.byteLength(JSON.stringify(raw)) > this.maxOutputBytes + 4096) {\n          finish(new Error('Computer worker message exceeds the size limit.'));\n          return;\n        }\n        if (raw.type === 'log' && typeof raw.message === 'string') {\n          const line = `[${String(raw.level)}] ${raw.message}`;\n          if (addOutput(line)) logs.push(line);\n          return;\n        }\n        if (raw.type === 'program') {\n          if (\n            completing ||\n            typeof raw.id !== 'string' ||\n            raw.id.length > 128 ||\n            (raw.operation !== 'observe' && raw.operation !== 'act') ||\n            outstanding >= MAX_PENDING_OPERATIONS\n          ) {\n            finish(new Error('Invalid or excessive computer program operations.'));\n            return;\n          }\n          outstanding += 1;\n          operation = operation\n            .then(async () => {\n              if (settled || controller.signal.aborted) return;\n              try {\n                let value: unknown;\n                if (raw.operation === 'observe') {\n                  const settings = raw.payload;\n                  if (\n                    !settings ||\n                    typeof settings !== 'object' ||\n                    Array.isArray(settings) ||\n                    Object.keys(settings).some((key) => key !== 'includeScreenshot') ||\n                    ('includeScreenshot' in settings && typeof settings.includeScreenshot !== 'boolean')\n                  ) {\n                    throw new Error('Invalid observation options.');\n                  }\n                  value = await observe('includeScreenshot' in settings && settings.includeScreenshot === true);\n                } else {\n                  actionInFlight = true;\n                  value = await this.client.act(raw.payload as ComputerUseAction, controller.signal);\n                  completedActions += 1;\n                  actionInFlight = false;\n                }\n                send({ type: 'response', id: raw.id, value });\n              } catch (error) {\n                // An action can have taken effect before its transport failed. Never run the remaining chain.\n                if (actionInFlight) finish(error instanceof Error ? error : new Error(String(error)));\n                else\n                  send({ type: 'response', id: raw.id, error: error instanceof Error ? error.message : String(error) });\n              } finally {\n                outstanding -= 1;\n              }\n            })\n            .catch((error: unknown) => finish(error instanceof Error ? error : new Error(String(error))));\n          return;\n        }\n        if (raw.type === 'failed' && typeof raw.error === 'string') {\n          finish(new Error(raw.error));\n          return;\n        }\n        if (raw.type === 'complete') {\n          if (completing) {\n            finish(new Error('Computer worker completed twice.'));\n            return;\n          }\n          completing = true;\n          operation = operation\n            .then(async () => {\n              if (settled) return;\n              const resultJson = raw.resultJson;\n              if (resultJson !== undefined && typeof resultJson !== 'string')\n                throw new Error('Computer script returned an invalid result.');\n              if (typeof resultJson === 'string' && !addOutput(resultJson)) return;\n              const observation = await observe(options.includeScreenshot === true);\n              if (settled || !addOutput(JSON.stringify({ ...observation, screenshot: undefined }))) return;\n              finish(undefined, {\n                ...(typeof resultJson === 'string' ? { result: JSON.parse(resultJson) as unknown } : {}),\n                observation,\n                logs,\n                metrics: {\n                  actions: completedActions,\n                  observations,\n                  durationMs: Math.round(performance.now() - started),\n                  outputBytes,\n                },\n              });\n            })\n            .catch((error: unknown) => finish(error instanceof Error ? error : new Error(String(error))));\n        }\n      });\n      send({\n        type: 'start',\n        scriptPath: resolvedPath,\n        scriptRoot: root,\n        input: JSON.parse(serializedInput) as unknown,\n        trusted,\n        quickjsPath,\n        timeoutMs: this.timeoutMs,\n        maxOutputBytes: this.maxOutputBytes,\n      });\n    });\n  }\n}\n","import type { ComputerUseExtensionResult, ComputerUseExtensionService } from '../../types/extension';\nimport type { ComputerUseSessionClient } from '../sessionApiClient';\n\nexport class DefaultComputerUseExtensionService implements ComputerUseExtensionService {\n  public constructor(private readonly client?: ComputerUseSessionClient) {}\n\n  public async execute(): Promise<ComputerUseExtensionResult> {\n    if (this.client === undefined) return { message: 'Computer use requires a Po Desktop session.', level: 'error' };\n    const state = await this.client.state();\n    return { message: `Computer use is ${state.phase.replaceAll('_', ' ')}.`, level: 'info' };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,MAAa,wBAAwB;;AAErC,MAAa,eAAe;AAC5B,MAAa,sBAAsB;AAEnC,MAAa,0BAA0B;CAAC;CAAkB;CAAmB;AAAe;;AAE5F,MAAa,iCAAiC;AAC9C,MAAa,kCAAkC;;AAE/C,MAAa,mCAAmC;AAChD,MAAa,qCAAqC;AAClD,MAAa,iCACX;;;;ACZF,MAAa,gCAAgC,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACYvD,MAAM,qBAAqB;AAC3B,MAAM,2BAA2B;AACjC,MAAM,kBAAkB;AACxB,MAAM,yBAAyB;AAE/B,IAAa,+BAAb,cAAkD,MAAM;CAG3C;CACA;CAHX,YACE,SACA,kBACA,kBACA;EACA,MAAM,OAAO;EAHJ,KAAA,mBAAA;EACA,KAAA,mBAAA;EAGT,KAAK,OAAO;CACd;AACF;AAaA,IAAa,uBAAb,MAAkC;CAChC;CACA;CACA;CACA;CACA;CAEA,YAAY,SAAsC;EAChD,KAAK,SAAS,QAAQ;EACtB,KAAK,qBAAqB,QAAQ;EAClC,KAAK,aAAa,QAAQ;EAC1B,KAAK,YAAY,QAAQ,aAAa;EACtC,KAAK,iBAAiB,QAAQ,kBAAkB;CAClD;CAEA,MAAM,QACJ,YACA,OACA,QACA,UAA0C,CAAC,GAC3C,KACwC;EACxC,QAAQ,eAAe;EACvB,MAAM,eAAe,OAAA,GAAMA,iBAAAA,SAAAA,CAASC,UAAAA,QAAK,QAAQ,KAAK,cAAc,OAAO,QAAQ,IAAI,GAAG,UAAU,CAAC;EACrG,MAAM,eAAe,MAAM,QAAQ,IACjC,KAAK,mBAAmB,IAAI,OAAO,eAAA,GAAcD,iBAAAA,SAAAA,CAAS,SAAS,CAAC,CAAC,YAAY,EAAE,CAAC,CACtF;EACA,MAAM,UAAU,QAAQ,YAAY;EACpC,KAAK,WAAW,KAAK,eAAe,KAAA,MAAc,CAAC,aAAa,SAAS,YAAY,GACnF,MAAM,IAAI,MAAM,iDAAiD;EAEnE,IAAI,CAAC,kBAAkB,KAAK,YAAY,GACtC,MAAM,IAAI,MAAM,mEAAmE;EACrF,MAAM,OAAO,OAAA,GAAMA,iBAAAA,SAAAA,CAAS,KAAK,cAAcC,UAAAA,QAAK,QAAQ,YAAY,CAAC;EACzE,MAAM,WAAWA,UAAAA,QAAK,SAAS,MAAM,YAAY;EACjD,IAAI,CAAC,YAAY,aAAa,QAAQ,SAAS,WAAW,KAAKA,UAAAA,QAAK,KAAK,KAAKA,UAAAA,QAAK,WAAW,QAAQ,IACpG,MAAM,IAAI,MAAM,mDAAmD;EAErE,MAAM,kBAAkB,KAAK,UAAU,KAAK;EAC5C,IAAI,oBAAoB,KAAA,GAAW,MAAM,IAAI,MAAM,kDAAkD;EACrG,IAAI,OAAO,WAAW,eAAe,IAAI,KAAK,gBAC5C,MAAM,IAAI,MAAM,+CAA+C;EACjE,MAAM,cAAc,UAAU,KAAA,KAAA,GAAYC,YAAAA,cAAAA,CAAAA,QAAAA,KAAAA,CAAAA,CAAAA,cAAAA,UAAAA,CAAAA,CAAAA,IAA6B,CAAC,CAAC,QAAQ,oBAAoB;EACrG,QAAQ,eAAe;EACvB,MAAM,UAAU,YAAY,IAAI;EAEhC,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,MAAM,SAAA,GAAQC,mBAAAA,MAAAA,CAAM,QAAQ,UAAU;IAAC;IAAuB;IAAU;GAA6B,GAAG;IACtG,OAAO;KAAC;KAAU;KAAQ;KAAQ;IAAK;IAEvC,KAAK,UAAU,QAAQ,MAAM,EAAE,sBAAsB,IAAI;GAC3D,CAAC;GACD,MAAM,aAAa,IAAI,gBAAgB;GACvC,MAAM,OAAiB,CAAC;GACxB,IAAI,cAAc;GAClB,IAAI,mBAAmB;GACvB,IAAI,eAAe;GACnB,IAAI,iBAAiB;GACrB,IAAI,UAAU;GACd,IAAI,aAAa;GACjB,IAAI,cAAc;GAClB,IAAI,YAA2B,QAAQ,QAAQ;GAC/C,MAAM,UAAU,OAAe,UAAgD;IAC7E,IAAI,SAAS;IACb,UAAU;IACV,aAAa,OAAO;IACpB,QAAQ,oBAAoB,SAAS,OAAO;IAC5C,WAAW,MAAM;IACjB,MAAM,KAAK,SAAS;IAEpB,iBADmC,MAAM,KAAK,SAAS,GAAG,GAClD,CAAC,CAAC,MAAM;IAChB,IAAI,OAAO,OAAO,IAAI,6BAA6B,MAAM,SAAS,kBAAkB,cAAc,CAAC;SAC9F,QAAQ,KAAM;GACrB;GACA,MAAM,aAAa,UAA2B;IAC5C,eAAe,OAAO,WAAW,KAAK;IACtC,IAAI,eAAe,KAAK,gBAAgB,OAAO;IAC/C,uBAAO,IAAI,MAAM,iDAAiD,CAAC;IACnE,OAAO;GACT;GACA,MAAM,QAAQ,UAAwB;IACpC,IAAI,WAAW,CAAC,MAAM,WAAW;IACjC,MAAM,KAAK,QAAQ,UAAU;KAC3B,IAAI,SAAS,CAAC,SAAS,OAAO,KAAK;IACrC,CAAC;GACH;GACA,MAAM,gBAAsB,uBAAO,IAAI,MAAM,0CAA0C,CAAC;GACxF,MAAM,UAAU,iBAAiB,uBAAO,IAAI,MAAM,sCAAsC,CAAC,GAAG,KAAK,SAAS;GAC1G,QAAQ,MAAM;GACd,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;GACzD,IAAI,QAAQ,SAAS,OAAO,QAAQ;GACpC,MAAM,QAAQ,GAAG,SAAS,UAAkB,UAAU,MAAM,SAAS,MAAM,CAAC,CAAC;GAC7E,MAAM,QAAQ,GAAG,SAAS,UAAkB,UAAU,MAAM,SAAS,MAAM,CAAC,CAAC;GAC7E,MAAM,GAAG,UAAU,UAAU,OAAO,KAAK,CAAC;GAC1C,MAAM,GAAG,SAAS,MAAM,eAAe;IACrC,IAAI,CAAC,SACH,uBAAO,IAAI,MAAM,oDAAoD,cAAc,QAAQ,UAAU,GAAG,CAAC;GAC7G,CAAC;GAED,MAAM,UAAU,OAAO,sBAAgE;IACrF,MAAM,QAAQ,MAAM,KAAK,OAAO,QAAQ,WAAW,QAAQ,EAAE,kBAAkB,CAAC;IAChF,gBAAgB;IAChB,MAAM,EAAE,YAAY,GAAG,aAAa;IACpC,IAAI,OAAO,WAAW,KAAK,UAAU,QAAQ,CAAC,IAAI,KAAK,gBACrD,MAAM,IAAI,MAAM,8CAA8C;IAChE,IAAI,qBAAqB,YAAY;KACnC,IAAI,WAAW,aAAa,eAAe,WAAW,KAAK,SAAS,KAAK,KAAK,kBAAkB,CAAC,IAAI,GACnG,MAAM,IAAI,MAAM,8CAA8C;KAEhE,OAAO;MAAE,GAAG;MAAU;KAAW;IACnC;IACA,OAAO;GACT;GAEA,MAAM,GAAG,YAAY,QAAuB;IAC1C,IAAI,SAAS;IACb,IAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,OAAO,WAAW,KAAK,UAAU,GAAG,CAAC,IAAI,KAAK,iBAAiB,MAAM;KAC1G,uBAAO,IAAI,MAAM,iDAAiD,CAAC;KACnE;IACF;IACA,IAAI,IAAI,SAAS,SAAS,OAAO,IAAI,YAAY,UAAU;KACzD,MAAM,OAAO,IAAI,OAAO,IAAI,KAAK,EAAE,IAAI,IAAI;KAC3C,IAAI,UAAU,IAAI,GAAG,KAAK,KAAK,IAAI;KACnC;IACF;IACA,IAAI,IAAI,SAAS,WAAW;KAC1B,IACE,cACA,OAAO,IAAI,OAAO,YAClB,IAAI,GAAG,SAAS,OACf,IAAI,cAAc,aAAa,IAAI,cAAc,SAClD,eAAe,wBACf;MACA,uBAAO,IAAI,MAAM,mDAAmD,CAAC;MACrE;KACF;KACA,eAAe;KACf,YAAY,UACT,KAAK,YAAY;MAChB,IAAI,WAAW,WAAW,OAAO,SAAS;MAC1C,IAAI;OACF,IAAI;OACJ,IAAI,IAAI,cAAc,WAAW;QAC/B,MAAM,WAAW,IAAI;QACrB,IACE,CAAC,YACD,OAAO,aAAa,YACpB,MAAM,QAAQ,QAAQ,KACtB,OAAO,KAAK,QAAQ,CAAC,CAAC,MAAM,QAAQ,QAAQ,mBAAmB,KAC9D,uBAAuB,YAAY,OAAO,SAAS,sBAAsB,WAE1E,MAAM,IAAI,MAAM,8BAA8B;QAEhD,QAAQ,MAAM,QAAQ,uBAAuB,YAAY,SAAS,sBAAsB,IAAI;OAC9F,OAAO;QACL,iBAAiB;QACjB,QAAQ,MAAM,KAAK,OAAO,IAAI,IAAI,SAA8B,WAAW,MAAM;QACjF,oBAAoB;QACpB,iBAAiB;OACnB;OACA,KAAK;QAAE,MAAM;QAAY,IAAI,IAAI;QAAI;OAAM,CAAC;MAC9C,SAAS,OAAO;OAEd,IAAI,gBAAgB,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;YAElF,KAAK;QAAE,MAAM;QAAY,IAAI,IAAI;QAAI,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;OAAE,CAAC;MACxG,UAAU;OACR,eAAe;MACjB;KACF,CAAC,CAAC,CACD,OAAO,UAAmB,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC,CAAC;KAC9F;IACF;IACA,IAAI,IAAI,SAAS,YAAY,OAAO,IAAI,UAAU,UAAU;KAC1D,OAAO,IAAI,MAAM,IAAI,KAAK,CAAC;KAC3B;IACF;IACA,IAAI,IAAI,SAAS,YAAY;KAC3B,IAAI,YAAY;MACd,uBAAO,IAAI,MAAM,kCAAkC,CAAC;MACpD;KACF;KACA,aAAa;KACb,YAAY,UACT,KAAK,YAAY;MAChB,IAAI,SAAS;MACb,MAAM,aAAa,IAAI;MACvB,IAAI,eAAe,KAAA,KAAa,OAAO,eAAe,UACpD,MAAM,IAAI,MAAM,6CAA6C;MAC/D,IAAI,OAAO,eAAe,YAAY,CAAC,UAAU,UAAU,GAAG;MAC9D,MAAM,cAAc,MAAM,QAAQ,QAAQ,sBAAsB,IAAI;MACpE,IAAI,WAAW,CAAC,UAAU,KAAK,UAAU;OAAE,GAAG;OAAa,YAAY,KAAA;MAAU,CAAC,CAAC,GAAG;MACtF,OAAO,KAAA,GAAW;OAChB,GAAI,OAAO,eAAe,WAAW,EAAE,QAAQ,KAAK,MAAM,UAAU,EAAa,IAAI,CAAC;OACtF;OACA;OACA,SAAS;QACP,SAAS;QACT;QACA,YAAY,KAAK,MAAM,YAAY,IAAI,IAAI,OAAO;QAClD;OACF;MACF,CAAC;KACH,CAAC,CAAC,CACD,OAAO,UAAmB,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC,CAAC;IAChG;GACF,CAAC;GACD,KAAK;IACH,MAAM;IACN,YAAY;IACZ,YAAY;IACZ,OAAO,KAAK,MAAM,eAAe;IACjC;IACA;IACA,WAAW,KAAK;IAChB,gBAAgB,KAAK;GACvB,CAAC;EACH,CAAC;CACH;AACF;;;AChQA,IAAa,qCAAb,MAAuF;CACjD;CAApC,YAAmB,QAAoD;EAAnC,KAAA,SAAA;CAAoC;CAExE,MAAa,UAA+C;EAC1D,IAAI,KAAK,WAAW,KAAA,GAAW,OAAO;GAAE,SAAS;GAA+C,OAAO;EAAQ;EAE/G,OAAO;GAAE,SAAS,oBAAmB,MADjB,KAAK,OAAO,MAAM,EAAA,CACK,MAAM,WAAW,KAAK,GAAG,EAAE;GAAI,OAAO;EAAO;CAC1F;AACF"}