@agimon-ai/po 0.0.0-alpha.0

package/dist/src/builders/server/computerUseBinding.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"computerUseBinding.cjs","names":["ComputerUseRecordingStore","fs","path","os","timingSafeEqual","doomApiCallerFrom","randomUUID"],"sources":["../../../../src/builders/server/computerUseBinding.ts"],"sourcesContent":["import { randomUUID, timingSafeEqual } from 'node:crypto';\nimport fs from 'node:fs/promises';\nimport os from 'node:os';\nimport path from 'node:path';\n\nimport type { DoomComputerUseHostBinding } from '@agimon-ai/po-core/hubChannel';\nimport { doomApiCallerFrom } from '@agimon-ai/po-core/packageApi';\n\nimport { ComputerUseRecordingStore } from './computerUseRecordings';\n\nconst VERSION = 1;\nconst MAX_BYTES = 8 * 1024 * 1024;\nconst DESKTOP_HEADER = 'x-po-desktop';\ntype Transport = Pick<NodeJS.Process, 'send' | 'connected' | 'on' | 'off'>;\n\n/** The capability is discovered over the inherited Desktop IPC channel, never from environment flags. */\nexport async function createComputerUseBinding(\n  transport: Transport = process,\n  remotePolicy: {\n    isDeviceAuthorized?: (deviceId: string) => boolean;\n    stepUpRequired?: () => boolean;\n  } = {},\n): Promise<DoomComputerUseHostBinding | undefined> {\n  if (!transport.send || !transport.connected) return undefined;\n  const recordings = new ComputerUseRecordingStore(await fs.mkdtemp(path.join(os.tmpdir(), 'po-recordings-')));\n  let available = false;\n  let enabled = false;\n  let closed = false;\n  let token = '';\n  let generation: string | undefined;\n  const ownedSessions = new Set<string>();\n  const revokedSessions = new Set<string>();\n  const listeners = new Map<() => void, string | undefined>();\n  const delegations = new Map<\n    string,\n    { deviceId: string; approved: boolean; abort: AbortController; grantId?: string; expiresAt?: number }\n  >();\n  const nativeAuthorized = (headers: Headers): boolean => {\n    const proof = headers.get(DESKTOP_HEADER) ?? '';\n    return available && /^[a-f0-9]{64}$/u.test(proof) && timingSafeEqual(Buffer.from(proof), Buffer.from(token));\n  };\n  const remoteCaller = (headers: Headers) => {\n    const caller = doomApiCallerFrom(headers);\n    return caller?.locality === 'remote' && remotePolicy.isDeviceAuthorized?.(caller.deviceId) === true\n      ? caller\n      : undefined;\n  };\n  const notify = (sessionId?: string): void => {\n    for (const [listener, session] of listeners) if (sessionId === undefined || session === sessionId) listener();\n  };\n  const revoke = (sessionId: string, retainRecording = false): void => {\n    const delegated = delegations.get(sessionId);\n    if (delegated === undefined) return;\n    if (!retainRecording) delegations.delete(sessionId);\n    delegated.expiresAt = undefined;\n    delegated.abort.abort();\n    revokedSessions.add(sessionId);\n    if (delegated.grantId !== undefined && available) {\n      void exchange(\n        { type: 'po:computer-use:request', sessionId, operation: 'stop', payload: { grantId: delegated.grantId } },\n        30_000,\n      )\n        .then((result) => recordings.importStop(sessionId, delegated.grantId!, result.result))\n        .catch(() => close());\n    }\n    notify(sessionId);\n  };\n  const pending = new Map<string, { finish: (value?: Record<string, unknown>, error?: Error) => void }>();\n  const send = (value: object): void => {\n    if (closed || !transport.connected) throw new Error('Desktop computer use is disconnected.');\n    transport.send!(value, (error: Error | null) => {\n      if (error) close();\n    });\n  };\n  const close = (): void => {\n    if (closed) return;\n    closed = true;\n    available = false;\n    token = '';\n    transport.off('message', onMessage);\n    transport.off('disconnect', close);\n    transport.off('exit', close);\n    for (const request of pending.values())\n      request.finish(undefined, new Error('Desktop computer use is disconnected.'));\n    pending.clear();\n    for (const sessionId of delegations.keys()) revoke(sessionId);\n    notify();\n    listeners.clear();\n    void recordings.close().catch(() => process.emitWarning('Computer-use recording cleanup failed.'));\n    // Keep ownership pinned while the server is alive, including after Desktop disconnects.\n  };\n  const onMessage = (value: unknown): void => {\n    if (!value || typeof value !== 'object' || Array.isArray(value)) return;\n    const message = value as Record<string, unknown>;\n    if (message.version !== VERSION) return;\n    if (message.type === 'po:computer-use:availability' && typeof message.enabled === 'boolean') {\n      enabled = message.enabled;\n      // Native stop/expiry also notifies availability without changing the global setting.\n      for (const sessionId of delegations.keys()) revoke(sessionId, true);\n      notify();\n      return;\n    }\n    if (typeof message.requestId !== 'string') return;\n    if (message.type !== 'po:computer-use:ready' && message.type !== 'po:computer-use:response') return;\n    if (Buffer.byteLength(JSON.stringify(message)) > MAX_BYTES) {\n      close();\n      return;\n    }\n    pending.get(message.requestId)?.finish(message);\n  };\n  transport.on('message', onMessage);\n  transport.on('disconnect', close);\n  transport.on('exit', close);\n\n  const exchange = (\n    value: Record<string, unknown>,\n    timeoutMs: number,\n    signal?: AbortSignal,\n  ): Promise<Record<string, unknown>> =>\n    new Promise((resolve, reject) => {\n      signal?.throwIfAborted();\n      if (closed || pending.size >= 128) throw new Error('Desktop computer-use transport is unavailable or busy.');\n      const requestId = randomUUID();\n      const cancel = (): void => {\n        try {\n          send({ type: 'po:computer-use:cancel', version: VERSION, requestId });\n        } catch {\n          /* Already disconnected. */\n        }\n      };\n      const finish = (result?: Record<string, unknown>, error?: Error): void => {\n        if (!pending.delete(requestId)) return;\n        clearTimeout(timer);\n        signal?.removeEventListener('abort', onAbort);\n        if (error) reject(error);\n        else resolve(result!);\n      };\n      const onAbort = (): void => {\n        cancel();\n        finish(undefined, new Error('Desktop computer-use request was cancelled.'));\n      };\n      const timer = setTimeout(() => {\n        cancel();\n        finish(undefined, new Error('Desktop computer-use request timed out.'));\n      }, timeoutMs);\n      pending.set(requestId, { finish });\n      signal?.addEventListener('abort', onAbort, { once: true });\n      try {\n        const message = { ...value, version: VERSION, requestId };\n        if (Buffer.byteLength(JSON.stringify(message)) > MAX_BYTES)\n          throw new Error('Desktop computer-use request is too large.');\n        send(message);\n      } catch (error) {\n        finish(undefined, error instanceof Error ? error : new Error(String(error)));\n      }\n    });\n\n  try {\n    const ready = await exchange({ type: 'po:computer-use:hello' }, 1_500);\n    if (\n      ready.type !== 'po:computer-use:ready' ||\n      typeof ready.token !== 'string' ||\n      !/^[a-f0-9]{64}$/u.test(ready.token)\n    ) {\n      throw new Error('Invalid Desktop capability handshake.');\n    }\n    token = ready.token;\n    available = true;\n    enabled = ready.enabled === true;\n  } catch {\n    close();\n    return undefined;\n  }\n\n  return {\n    get available() {\n      return available;\n    },\n    get enabled() {\n      return available && enabled;\n    },\n    authorize: nativeAuthorized,\n    readRecording: (scope, artifactId, range) => recordings.read(scope.sessionId, artifactId, range),\n    authorizeActivation(headers) {\n      if (!available || !enabled) return false;\n      if (nativeAuthorized(headers)) return true;\n      const caller = remoteCaller(headers);\n      return (\n        caller !== undefined &&\n        (remotePolicy.stepUpRequired?.() === true ? caller.stepUp === 'verified' : caller.stepUp === 'not-required')\n      );\n    },\n    authorizePending(sessionId, headers) {\n      if (nativeAuthorized(headers)) return true;\n      const caller = remoteCaller(headers);\n      const delegated = delegations.get(sessionId);\n      return (\n        available &&\n        enabled &&\n        caller !== undefined &&\n        delegated !== undefined &&\n        delegated.deviceId === caller.deviceId &&\n        delegated.expiresAt === undefined &&\n        !delegated.abort.signal.aborted\n      );\n    },\n    authorizeRecording(sessionId, headers) {\n      if (nativeAuthorized(headers)) return true;\n      const caller = remoteCaller(headers);\n      const delegated = delegations.get(sessionId);\n      return (\n        available && caller !== undefined && delegated?.approved === true && delegated.deviceId === caller.deviceId\n      );\n    },\n    authorizeSession(sessionId, headers) {\n      if (nativeAuthorized(headers)) return true;\n      const caller = remoteCaller(headers);\n      const delegated = delegations.get(sessionId);\n      if (available && enabled && caller !== undefined && !ownedSessions.has(sessionId)) return true;\n      return (\n        available &&\n        enabled &&\n        caller !== undefined &&\n        delegated?.approved === true &&\n        delegated.expiresAt !== undefined &&\n        delegated.expiresAt > Date.now() &&\n        delegated.deviceId === caller.deviceId &&\n        !delegated.abort.signal.aborted\n      );\n    },\n    claimSession(sessionId, headers) {\n      if (!available || !enabled) throw new Error('Desktop computer use is unavailable.');\n      const caller = headers === undefined ? undefined : remoteCaller(headers);\n      if (caller !== undefined) {\n        const previous = delegations.get(sessionId);\n        if (previous !== undefined && previous.deviceId !== caller.deviceId)\n          throw new Error('This session belongs to another paired device.');\n        if (previous?.abort.signal.aborted) {\n          previous.abort = new AbortController();\n          previous.grantId = undefined;\n        }\n        if (previous === undefined)\n          delegations.set(sessionId, {\n            deviceId: caller.deviceId,\n            approved: false,\n            abort: new AbortController(),\n          });\n      } else if (headers !== undefined && !nativeAuthorized(headers)) {\n        throw new Error('Native or paired authorization is required.');\n      }\n      revokedSessions.delete(sessionId);\n      ownedSessions.add(sessionId);\n    },\n    revokeDevice(deviceId) {\n      for (const [sessionId, delegated] of delegations) if (delegated.deviceId === deviceId) revoke(sessionId);\n    },\n    ownsSession: (sessionId) => ownedSessions.has(sessionId),\n    forgetSession: (sessionId) => {\n      revoke(sessionId);\n      void recordings\n        .forgetSession(sessionId)\n        .catch(() => process.emitWarning('Computer-use recording cleanup failed.'));\n      // Keep private history pinned to Desktop, but never replay device approval after restart.\n    },\n    subscribe(listener, sessionId) {\n      listeners.set(listener, sessionId);\n      return () => {\n        listeners.delete(listener);\n      };\n    },\n    async request(scope, request) {\n      if (!available) throw new Error('Desktop computer use is unavailable.');\n      if (revokedSessions.has(scope.sessionId) && request.operation !== 'stop' && request.operation !== 'status')\n        throw new Error('Computer-use delegation was revoked.');\n      if (request.operation !== 'status' && request.operation !== 'targets' && !ownedSessions.has(scope.sessionId)) {\n        throw new Error('This session has not been authorized by Desktop.');\n      }\n      const delegated = delegations.get(scope.sessionId);\n      if (delegated !== undefined && remotePolicy.isDeviceAuthorized?.(delegated.deviceId) !== true) {\n        revoke(scope.sessionId);\n        if (request.operation !== 'stop') throw new Error('The paired device was revoked.');\n      }\n      if (request.operation === 'stop' && delegated !== undefined) {\n        delegated.expiresAt = undefined;\n        delegated.abort.abort();\n      }\n      const signal =\n        delegated === undefined || request.operation === 'stop'\n          ? request.signal\n          : request.signal === undefined\n            ? delegated.abort.signal\n            : AbortSignal.any([request.signal, delegated.abort.signal]);\n      const result = await exchange(\n        {\n          type: 'po:computer-use:request',\n          sessionId: scope.sessionId,\n          operation: request.operation,\n          ...(request.payload === undefined ? {} : { payload: request.payload }),\n        },\n        request.operation === 'activate' ? 120_000 : 30_000,\n        signal,\n      );\n      if (\n        typeof result.hostGeneration !== 'string' ||\n        (generation !== undefined && generation !== result.hostGeneration)\n      ) {\n        close();\n        throw new Error('Desktop generation changed. Authorize a new session.');\n      }\n      generation = result.hostGeneration;\n      if (result.ok !== true)\n        throw new Error(typeof result.error === 'string' ? result.error : 'Desktop request failed.');\n      if (request.operation === 'activate' && delegated !== undefined) {\n        if (\n          delegations.get(scope.sessionId) !== delegated ||\n          delegated.abort.signal.aborted ||\n          remotePolicy.isDeviceAuthorized?.(delegated.deviceId) !== true\n        )\n          throw new Error('The paired activation was revoked.');\n        delegated.approved = true;\n        const grant = result.result as { grantId?: unknown; expiresAt?: unknown } | undefined;\n        if (typeof grant?.expiresAt === 'number') delegated.expiresAt = grant.expiresAt;\n        if (typeof grant?.grantId === 'string') delegated.grantId = grant.grantId;\n      }\n      if (request.operation === 'stop') {\n        if (delegated !== undefined) delegated.expiresAt = undefined;\n        const grantId = (request.payload as { grantId?: unknown } | undefined)?.grantId;\n        if (typeof grantId !== 'string') throw new Error('Recording finalization requires its grant.');\n        return recordings.importStop(scope.sessionId, grantId, result.result);\n      }\n      return result.result;\n    },\n    close() {\n      if (closed) return;\n      try {\n        send({ type: 'po:computer-use:close', version: VERSION });\n      } finally {\n        close();\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;AAUA,MAAM,UAAU;AAChB,MAAM,YAAY;AAClB,MAAM,iBAAiB;;AAIvB,eAAsB,yBACpB,YAAuB,SACvB,eAGI,CAAC,GAC4C;CACjD,IAAI,CAAC,UAAU,QAAQ,CAAC,UAAU,WAAW,OAAO,KAAA;CACpD,MAAM,aAAa,IAAIA,8BAAAA,0BAA0B,MAAMC,iBAAAA,QAAG,QAAQC,UAAAA,QAAK,KAAKC,QAAAA,QAAG,OAAO,GAAG,gBAAgB,CAAC,CAAC;CAC3G,IAAI,YAAY;CAChB,IAAI,UAAU;CACd,IAAI,SAAS;CACb,IAAI,QAAQ;CACZ,IAAI;CACJ,MAAM,gCAAgB,IAAI,IAAY;CACtC,MAAM,kCAAkB,IAAI,IAAY;CACxC,MAAM,4BAAY,IAAI,IAAoC;CAC1D,MAAM,8BAAc,IAAI,IAGtB;CACF,MAAM,oBAAoB,YAA8B;EACtD,MAAM,QAAQ,QAAQ,IAAI,cAAc,KAAK;EAC7C,OAAO,aAAa,kBAAkB,KAAK,KAAK,MAAA,GAAKC,YAAAA,gBAAAA,CAAgB,OAAO,KAAK,KAAK,GAAG,OAAO,KAAK,KAAK,CAAC;CAC7G;CACA,MAAM,gBAAgB,YAAqB;EACzC,MAAM,UAAA,GAASC,8BAAAA,kBAAAA,CAAkB,OAAO;EACxC,OAAO,QAAQ,aAAa,YAAY,aAAa,qBAAqB,OAAO,QAAQ,MAAM,OAC3F,SACA,KAAA;CACN;CACA,MAAM,UAAU,cAA6B;EAC3C,KAAK,MAAM,CAAC,UAAU,YAAY,WAAW,IAAI,cAAc,KAAA,KAAa,YAAY,WAAW,SAAS;CAC9G;CACA,MAAM,UAAU,WAAmB,kBAAkB,UAAgB;EACnE,MAAM,YAAY,YAAY,IAAI,SAAS;EAC3C,IAAI,cAAc,KAAA,GAAW;EAC7B,IAAI,CAAC,iBAAiB,YAAY,OAAO,SAAS;EAClD,UAAU,YAAY,KAAA;EACtB,UAAU,MAAM,MAAM;EACtB,gBAAgB,IAAI,SAAS;EAC7B,IAAI,UAAU,YAAY,KAAA,KAAa,WACrC,SACE;GAAE,MAAM;GAA2B;GAAW,WAAW;GAAQ,SAAS,EAAE,SAAS,UAAU,QAAQ;EAAE,GACzG,GACF,CAAC,CACE,MAAM,WAAW,WAAW,WAAW,WAAW,UAAU,SAAU,OAAO,MAAM,CAAC,CAAC,CACrF,YAAY,MAAM,CAAC;EAExB,OAAO,SAAS;CAClB;CACA,MAAM,0BAAU,IAAI,IAAkF;CACtG,MAAM,QAAQ,UAAwB;EACpC,IAAI,UAAU,CAAC,UAAU,WAAW,MAAM,IAAI,MAAM,uCAAuC;EAC3F,UAAU,KAAM,QAAQ,UAAwB;GAC9C,IAAI,OAAO,MAAM;EACnB,CAAC;CACH;CACA,MAAM,cAAoB;EACxB,IAAI,QAAQ;EACZ,SAAS;EACT,YAAY;EACZ,QAAQ;EACR,UAAU,IAAI,WAAW,SAAS;EAClC,UAAU,IAAI,cAAc,KAAK;EACjC,UAAU,IAAI,QAAQ,KAAK;EAC3B,KAAK,MAAM,WAAW,QAAQ,OAAO,GACnC,QAAQ,OAAO,KAAA,mBAAW,IAAI,MAAM,uCAAuC,CAAC;EAC9E,QAAQ,MAAM;EACd,KAAK,MAAM,aAAa,YAAY,KAAK,GAAG,OAAO,SAAS;EAC5D,OAAO;EACP,UAAU,MAAM;EAChB,WAAgB,MAAM,CAAC,CAAC,YAAY,QAAQ,YAAY,wCAAwC,CAAC;CAEnG;CACA,MAAM,aAAa,UAAyB;EAC1C,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;EACjE,MAAM,UAAU;EAChB,IAAI,QAAQ,YAAY,SAAS;EACjC,IAAI,QAAQ,SAAS,kCAAkC,OAAO,QAAQ,YAAY,WAAW;GAC3F,UAAU,QAAQ;GAElB,KAAK,MAAM,aAAa,YAAY,KAAK,GAAG,OAAO,WAAW,IAAI;GAClE,OAAO;GACP;EACF;EACA,IAAI,OAAO,QAAQ,cAAc,UAAU;EAC3C,IAAI,QAAQ,SAAS,2BAA2B,QAAQ,SAAS,4BAA4B;EAC7F,IAAI,OAAO,WAAW,KAAK,UAAU,OAAO,CAAC,IAAI,WAAW;GAC1D,MAAM;GACN;EACF;EACA,QAAQ,IAAI,QAAQ,SAAS,CAAC,EAAE,OAAO,OAAO;CAChD;CACA,UAAU,GAAG,WAAW,SAAS;CACjC,UAAU,GAAG,cAAc,KAAK;CAChC,UAAU,GAAG,QAAQ,KAAK;CAE1B,MAAM,YACJ,OACA,WACA,WAEA,IAAI,SAAS,SAAS,WAAW;EAC/B,QAAQ,eAAe;EACvB,IAAI,UAAU,QAAQ,QAAQ,KAAK,MAAM,IAAI,MAAM,wDAAwD;EAC3G,MAAM,aAAA,GAAYC,YAAAA,WAAAA,CAAW;EAC7B,MAAM,eAAqB;GACzB,IAAI;IACF,KAAK;KAAE,MAAM;KAA0B,SAAS;KAAS;IAAU,CAAC;GACtE,QAAQ,CAER;EACF;EACA,MAAM,UAAU,QAAkC,UAAwB;GACxE,IAAI,CAAC,QAAQ,OAAO,SAAS,GAAG;GAChC,aAAa,KAAK;GAClB,QAAQ,oBAAoB,SAAS,OAAO;GAC5C,IAAI,OAAO,OAAO,KAAK;QAClB,QAAQ,MAAO;EACtB;EACA,MAAM,gBAAsB;GAC1B,OAAO;GACP,OAAO,KAAA,mBAAW,IAAI,MAAM,6CAA6C,CAAC;EAC5E;EACA,MAAM,QAAQ,iBAAiB;GAC7B,OAAO;GACP,OAAO,KAAA,mBAAW,IAAI,MAAM,yCAAyC,CAAC;EACxE,GAAG,SAAS;EACZ,QAAQ,IAAI,WAAW,EAAE,OAAO,CAAC;EACjC,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;EACzD,IAAI;GACF,MAAM,UAAU;IAAE,GAAG;IAAO,SAAS;IAAS;GAAU;GACxD,IAAI,OAAO,WAAW,KAAK,UAAU,OAAO,CAAC,IAAI,WAC/C,MAAM,IAAI,MAAM,4CAA4C;GAC9D,KAAK,OAAO;EACd,SAAS,OAAO;GACd,OAAO,KAAA,GAAW,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EAC7E;CACF,CAAC;CAEH,IAAI;EACF,MAAM,QAAQ,MAAM,SAAS,EAAE,MAAM,wBAAwB,GAAG,IAAK;EACrE,IACE,MAAM,SAAS,2BACf,OAAO,MAAM,UAAU,YACvB,CAAC,kBAAkB,KAAK,MAAM,KAAK,GAEnC,MAAM,IAAI,MAAM,uCAAuC;EAEzD,QAAQ,MAAM;EACd,YAAY;EACZ,UAAU,MAAM,YAAY;CAC9B,QAAQ;EACN,MAAM;EACN;CACF;CAEA,OAAO;EACL,IAAI,YAAY;GACd,OAAO;EACT;EACA,IAAI,UAAU;GACZ,OAAO,aAAa;EACtB;EACA,WAAW;EACX,gBAAgB,OAAO,YAAY,UAAU,WAAW,KAAK,MAAM,WAAW,YAAY,KAAK;EAC/F,oBAAoB,SAAS;GAC3B,IAAI,CAAC,aAAa,CAAC,SAAS,OAAO;GACnC,IAAI,iBAAiB,OAAO,GAAG,OAAO;GACtC,MAAM,SAAS,aAAa,OAAO;GACnC,OACE,WAAW,KAAA,MACV,aAAa,iBAAiB,MAAM,OAAO,OAAO,WAAW,aAAa,OAAO,WAAW;EAEjG;EACA,iBAAiB,WAAW,SAAS;GACnC,IAAI,iBAAiB,OAAO,GAAG,OAAO;GACtC,MAAM,SAAS,aAAa,OAAO;GACnC,MAAM,YAAY,YAAY,IAAI,SAAS;GAC3C,OACE,aACA,WACA,WAAW,KAAA,KACX,cAAc,KAAA,KACd,UAAU,aAAa,OAAO,YAC9B,UAAU,cAAc,KAAA,KACxB,CAAC,UAAU,MAAM,OAAO;EAE5B;EACA,mBAAmB,WAAW,SAAS;GACrC,IAAI,iBAAiB,OAAO,GAAG,OAAO;GACtC,MAAM,SAAS,aAAa,OAAO;GACnC,MAAM,YAAY,YAAY,IAAI,SAAS;GAC3C,OACE,aAAa,WAAW,KAAA,KAAa,WAAW,aAAa,QAAQ,UAAU,aAAa,OAAO;EAEvG;EACA,iBAAiB,WAAW,SAAS;GACnC,IAAI,iBAAiB,OAAO,GAAG,OAAO;GACtC,MAAM,SAAS,aAAa,OAAO;GACnC,MAAM,YAAY,YAAY,IAAI,SAAS;GAC3C,IAAI,aAAa,WAAW,WAAW,KAAA,KAAa,CAAC,cAAc,IAAI,SAAS,GAAG,OAAO;GAC1F,OACE,aACA,WACA,WAAW,KAAA,KACX,WAAW,aAAa,QACxB,UAAU,cAAc,KAAA,KACxB,UAAU,YAAY,KAAK,IAAI,KAC/B,UAAU,aAAa,OAAO,YAC9B,CAAC,UAAU,MAAM,OAAO;EAE5B;EACA,aAAa,WAAW,SAAS;GAC/B,IAAI,CAAC,aAAa,CAAC,SAAS,MAAM,IAAI,MAAM,sCAAsC;GAClF,MAAM,SAAS,YAAY,KAAA,IAAY,KAAA,IAAY,aAAa,OAAO;GACvE,IAAI,WAAW,KAAA,GAAW;IACxB,MAAM,WAAW,YAAY,IAAI,SAAS;IAC1C,IAAI,aAAa,KAAA,KAAa,SAAS,aAAa,OAAO,UACzD,MAAM,IAAI,MAAM,gDAAgD;IAClE,IAAI,UAAU,MAAM,OAAO,SAAS;KAClC,SAAS,QAAQ,IAAI,gBAAgB;KACrC,SAAS,UAAU,KAAA;IACrB;IACA,IAAI,aAAa,KAAA,GACf,YAAY,IAAI,WAAW;KACzB,UAAU,OAAO;KACjB,UAAU;KACV,OAAO,IAAI,gBAAgB;IAC7B,CAAC;GACL,OAAO,IAAI,YAAY,KAAA,KAAa,CAAC,iBAAiB,OAAO,GAC3D,MAAM,IAAI,MAAM,6CAA6C;GAE/D,gBAAgB,OAAO,SAAS;GAChC,cAAc,IAAI,SAAS;EAC7B;EACA,aAAa,UAAU;GACrB,KAAK,MAAM,CAAC,WAAW,cAAc,aAAa,IAAI,UAAU,aAAa,UAAU,OAAO,SAAS;EACzG;EACA,cAAc,cAAc,cAAc,IAAI,SAAS;EACvD,gBAAgB,cAAc;GAC5B,OAAO,SAAS;GAChB,WACG,cAAc,SAAS,CAAC,CACxB,YAAY,QAAQ,YAAY,wCAAwC,CAAC;EAE9E;EACA,UAAU,UAAU,WAAW;GAC7B,UAAU,IAAI,UAAU,SAAS;GACjC,aAAa;IACX,UAAU,OAAO,QAAQ;GAC3B;EACF;EACA,MAAM,QAAQ,OAAO,SAAS;GAC5B,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,sCAAsC;GACtE,IAAI,gBAAgB,IAAI,MAAM,SAAS,KAAK,QAAQ,cAAc,UAAU,QAAQ,cAAc,UAChG,MAAM,IAAI,MAAM,sCAAsC;GACxD,IAAI,QAAQ,cAAc,YAAY,QAAQ,cAAc,aAAa,CAAC,cAAc,IAAI,MAAM,SAAS,GACzG,MAAM,IAAI,MAAM,kDAAkD;GAEpE,MAAM,YAAY,YAAY,IAAI,MAAM,SAAS;GACjD,IAAI,cAAc,KAAA,KAAa,aAAa,qBAAqB,UAAU,QAAQ,MAAM,MAAM;IAC7F,OAAO,MAAM,SAAS;IACtB,IAAI,QAAQ,cAAc,QAAQ,MAAM,IAAI,MAAM,gCAAgC;GACpF;GACA,IAAI,QAAQ,cAAc,UAAU,cAAc,KAAA,GAAW;IAC3D,UAAU,YAAY,KAAA;IACtB,UAAU,MAAM,MAAM;GACxB;GACA,MAAM,SACJ,cAAc,KAAA,KAAa,QAAQ,cAAc,SAC7C,QAAQ,SACR,QAAQ,WAAW,KAAA,IACjB,UAAU,MAAM,SAChB,YAAY,IAAI,CAAC,QAAQ,QAAQ,UAAU,MAAM,MAAM,CAAC;GAChE,MAAM,SAAS,MAAM,SACnB;IACE,MAAM;IACN,WAAW,MAAM;IACjB,WAAW,QAAQ;IACnB,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;GACtE,GACA,QAAQ,cAAc,aAAa,OAAU,KAC7C,MACF;GACA,IACE,OAAO,OAAO,mBAAmB,YAChC,eAAe,KAAA,KAAa,eAAe,OAAO,gBACnD;IACA,MAAM;IACN,MAAM,IAAI,MAAM,sDAAsD;GACxE;GACA,aAAa,OAAO;GACpB,IAAI,OAAO,OAAO,MAChB,MAAM,IAAI,MAAM,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ,yBAAyB;GAC7F,IAAI,QAAQ,cAAc,cAAc,cAAc,KAAA,GAAW;IAC/D,IACE,YAAY,IAAI,MAAM,SAAS,MAAM,aACrC,UAAU,MAAM,OAAO,WACvB,aAAa,qBAAqB,UAAU,QAAQ,MAAM,MAE1D,MAAM,IAAI,MAAM,oCAAoC;IACtD,UAAU,WAAW;IACrB,MAAM,QAAQ,OAAO;IACrB,IAAI,OAAO,OAAO,cAAc,UAAU,UAAU,YAAY,MAAM;IACtE,IAAI,OAAO,OAAO,YAAY,UAAU,UAAU,UAAU,MAAM;GACpE;GACA,IAAI,QAAQ,cAAc,QAAQ;IAChC,IAAI,cAAc,KAAA,GAAW,UAAU,YAAY,KAAA;IACnD,MAAM,UAAW,QAAQ,SAA+C;IACxE,IAAI,OAAO,YAAY,UAAU,MAAM,IAAI,MAAM,4CAA4C;IAC7F,OAAO,WAAW,WAAW,MAAM,WAAW,SAAS,OAAO,MAAM;GACtE;GACA,OAAO,OAAO;EAChB;EACA,QAAQ;GACN,IAAI,QAAQ;GACZ,IAAI;IACF,KAAK;KAAE,MAAM;KAAyB,SAAS;IAAQ,CAAC;GAC1D,UAAU;IACR,MAAM;GACR;EACF;CACF;AACF"}

package/dist/src/builders/server/computerUseBinding.mjs

@@ -0,0 +1,269 @@
+import { ComputerUseRecordingStore } from "./computerUseRecordings.mjs";
+import path from "node:path";
+import os from "node:os";
+import { randomUUID, timingSafeEqual } from "node:crypto";
+import { doomApiCallerFrom } from "@agimon-ai/po-core/packageApi";
+import fs from "node:fs/promises";
+//#region src/builders/server/computerUseBinding.ts
+const VERSION = 1;
+const MAX_BYTES = 8388608;
+const DESKTOP_HEADER = "x-po-desktop";
+/** The capability is discovered over the inherited Desktop IPC channel, never from environment flags. */
+async function createComputerUseBinding(transport = process, remotePolicy = {}) {
+	if (!transport.send || !transport.connected) return void 0;
+	const recordings = new ComputerUseRecordingStore(await fs.mkdtemp(path.join(os.tmpdir(), "po-recordings-")));
+	let available = false;
+	let enabled = false;
+	let closed = false;
+	let token = "";
+	let generation;
+	const ownedSessions = /* @__PURE__ */ new Set();
+	const revokedSessions = /* @__PURE__ */ new Set();
+	const listeners = /* @__PURE__ */ new Map();
+	const delegations = /* @__PURE__ */ new Map();
+	const nativeAuthorized = (headers) => {
+		const proof = headers.get(DESKTOP_HEADER) ?? "";
+		return available && /^[a-f0-9]{64}$/u.test(proof) && timingSafeEqual(Buffer.from(proof), Buffer.from(token));
+	};
+	const remoteCaller = (headers) => {
+		const caller = doomApiCallerFrom(headers);
+		return caller?.locality === "remote" && remotePolicy.isDeviceAuthorized?.(caller.deviceId) === true ? caller : void 0;
+	};
+	const notify = (sessionId) => {
+		for (const [listener, session] of listeners) if (sessionId === void 0 || session === sessionId) listener();
+	};
+	const revoke = (sessionId, retainRecording = false) => {
+		const delegated = delegations.get(sessionId);
+		if (delegated === void 0) return;
+		if (!retainRecording) delegations.delete(sessionId);
+		delegated.expiresAt = void 0;
+		delegated.abort.abort();
+		revokedSessions.add(sessionId);
+		if (delegated.grantId !== void 0 && available) exchange({
+			type: "po:computer-use:request",
+			sessionId,
+			operation: "stop",
+			payload: { grantId: delegated.grantId }
+		}, 3e4).then((result) => recordings.importStop(sessionId, delegated.grantId, result.result)).catch(() => close());
+		notify(sessionId);
+	};
+	const pending = /* @__PURE__ */ new Map();
+	const send = (value) => {
+		if (closed || !transport.connected) throw new Error("Desktop computer use is disconnected.");
+		transport.send(value, (error) => {
+			if (error) close();
+		});
+	};
+	const close = () => {
+		if (closed) return;
+		closed = true;
+		available = false;
+		token = "";
+		transport.off("message", onMessage);
+		transport.off("disconnect", close);
+		transport.off("exit", close);
+		for (const request of pending.values()) request.finish(void 0, /* @__PURE__ */ new Error("Desktop computer use is disconnected."));
+		pending.clear();
+		for (const sessionId of delegations.keys()) revoke(sessionId);
+		notify();
+		listeners.clear();
+		recordings.close().catch(() => process.emitWarning("Computer-use recording cleanup failed."));
+	};
+	const onMessage = (value) => {
+		if (!value || typeof value !== "object" || Array.isArray(value)) return;
+		const message = value;
+		if (message.version !== VERSION) return;
+		if (message.type === "po:computer-use:availability" && typeof message.enabled === "boolean") {
+			enabled = message.enabled;
+			for (const sessionId of delegations.keys()) revoke(sessionId, true);
+			notify();
+			return;
+		}
+		if (typeof message.requestId !== "string") return;
+		if (message.type !== "po:computer-use:ready" && message.type !== "po:computer-use:response") return;
+		if (Buffer.byteLength(JSON.stringify(message)) > MAX_BYTES) {
+			close();
+			return;
+		}
+		pending.get(message.requestId)?.finish(message);
+	};
+	transport.on("message", onMessage);
+	transport.on("disconnect", close);
+	transport.on("exit", close);
+	const exchange = (value, timeoutMs, signal) => new Promise((resolve, reject) => {
+		signal?.throwIfAborted();
+		if (closed || pending.size >= 128) throw new Error("Desktop computer-use transport is unavailable or busy.");
+		const requestId = randomUUID();
+		const cancel = () => {
+			try {
+				send({
+					type: "po:computer-use:cancel",
+					version: VERSION,
+					requestId
+				});
+			} catch {}
+		};
+		const finish = (result, error) => {
+			if (!pending.delete(requestId)) return;
+			clearTimeout(timer);
+			signal?.removeEventListener("abort", onAbort);
+			if (error) reject(error);
+			else resolve(result);
+		};
+		const onAbort = () => {
+			cancel();
+			finish(void 0, /* @__PURE__ */ new Error("Desktop computer-use request was cancelled."));
+		};
+		const timer = setTimeout(() => {
+			cancel();
+			finish(void 0, /* @__PURE__ */ new Error("Desktop computer-use request timed out."));
+		}, timeoutMs);
+		pending.set(requestId, { finish });
+		signal?.addEventListener("abort", onAbort, { once: true });
+		try {
+			const message = {
+				...value,
+				version: VERSION,
+				requestId
+			};
+			if (Buffer.byteLength(JSON.stringify(message)) > MAX_BYTES) throw new Error("Desktop computer-use request is too large.");
+			send(message);
+		} catch (error) {
+			finish(void 0, error instanceof Error ? error : new Error(String(error)));
+		}
+	});
+	try {
+		const ready = await exchange({ type: "po:computer-use:hello" }, 1500);
+		if (ready.type !== "po:computer-use:ready" || typeof ready.token !== "string" || !/^[a-f0-9]{64}$/u.test(ready.token)) throw new Error("Invalid Desktop capability handshake.");
+		token = ready.token;
+		available = true;
+		enabled = ready.enabled === true;
+	} catch {
+		close();
+		return;
+	}
+	return {
+		get available() {
+			return available;
+		},
+		get enabled() {
+			return available && enabled;
+		},
+		authorize: nativeAuthorized,
+		readRecording: (scope, artifactId, range) => recordings.read(scope.sessionId, artifactId, range),
+		authorizeActivation(headers) {
+			if (!available || !enabled) return false;
+			if (nativeAuthorized(headers)) return true;
+			const caller = remoteCaller(headers);
+			return caller !== void 0 && (remotePolicy.stepUpRequired?.() === true ? caller.stepUp === "verified" : caller.stepUp === "not-required");
+		},
+		authorizePending(sessionId, headers) {
+			if (nativeAuthorized(headers)) return true;
+			const caller = remoteCaller(headers);
+			const delegated = delegations.get(sessionId);
+			return available && enabled && caller !== void 0 && delegated !== void 0 && delegated.deviceId === caller.deviceId && delegated.expiresAt === void 0 && !delegated.abort.signal.aborted;
+		},
+		authorizeRecording(sessionId, headers) {
+			if (nativeAuthorized(headers)) return true;
+			const caller = remoteCaller(headers);
+			const delegated = delegations.get(sessionId);
+			return available && caller !== void 0 && delegated?.approved === true && delegated.deviceId === caller.deviceId;
+		},
+		authorizeSession(sessionId, headers) {
+			if (nativeAuthorized(headers)) return true;
+			const caller = remoteCaller(headers);
+			const delegated = delegations.get(sessionId);
+			if (available && enabled && caller !== void 0 && !ownedSessions.has(sessionId)) return true;
+			return available && enabled && caller !== void 0 && delegated?.approved === true && delegated.expiresAt !== void 0 && delegated.expiresAt > Date.now() && delegated.deviceId === caller.deviceId && !delegated.abort.signal.aborted;
+		},
+		claimSession(sessionId, headers) {
+			if (!available || !enabled) throw new Error("Desktop computer use is unavailable.");
+			const caller = headers === void 0 ? void 0 : remoteCaller(headers);
+			if (caller !== void 0) {
+				const previous = delegations.get(sessionId);
+				if (previous !== void 0 && previous.deviceId !== caller.deviceId) throw new Error("This session belongs to another paired device.");
+				if (previous?.abort.signal.aborted) {
+					previous.abort = new AbortController();
+					previous.grantId = void 0;
+				}
+				if (previous === void 0) delegations.set(sessionId, {
+					deviceId: caller.deviceId,
+					approved: false,
+					abort: new AbortController()
+				});
+			} else if (headers !== void 0 && !nativeAuthorized(headers)) throw new Error("Native or paired authorization is required.");
+			revokedSessions.delete(sessionId);
+			ownedSessions.add(sessionId);
+		},
+		revokeDevice(deviceId) {
+			for (const [sessionId, delegated] of delegations) if (delegated.deviceId === deviceId) revoke(sessionId);
+		},
+		ownsSession: (sessionId) => ownedSessions.has(sessionId),
+		forgetSession: (sessionId) => {
+			revoke(sessionId);
+			recordings.forgetSession(sessionId).catch(() => process.emitWarning("Computer-use recording cleanup failed."));
+		},
+		subscribe(listener, sessionId) {
+			listeners.set(listener, sessionId);
+			return () => {
+				listeners.delete(listener);
+			};
+		},
+		async request(scope, request) {
+			if (!available) throw new Error("Desktop computer use is unavailable.");
+			if (revokedSessions.has(scope.sessionId) && request.operation !== "stop" && request.operation !== "status") throw new Error("Computer-use delegation was revoked.");
+			if (request.operation !== "status" && request.operation !== "targets" && !ownedSessions.has(scope.sessionId)) throw new Error("This session has not been authorized by Desktop.");
+			const delegated = delegations.get(scope.sessionId);
+			if (delegated !== void 0 && remotePolicy.isDeviceAuthorized?.(delegated.deviceId) !== true) {
+				revoke(scope.sessionId);
+				if (request.operation !== "stop") throw new Error("The paired device was revoked.");
+			}
+			if (request.operation === "stop" && delegated !== void 0) {
+				delegated.expiresAt = void 0;
+				delegated.abort.abort();
+			}
+			const signal = delegated === void 0 || request.operation === "stop" ? request.signal : request.signal === void 0 ? delegated.abort.signal : AbortSignal.any([request.signal, delegated.abort.signal]);
+			const result = await exchange({
+				type: "po:computer-use:request",
+				sessionId: scope.sessionId,
+				operation: request.operation,
+				...request.payload === void 0 ? {} : { payload: request.payload }
+			}, request.operation === "activate" ? 12e4 : 3e4, signal);
+			if (typeof result.hostGeneration !== "string" || generation !== void 0 && generation !== result.hostGeneration) {
+				close();
+				throw new Error("Desktop generation changed. Authorize a new session.");
+			}
+			generation = result.hostGeneration;
+			if (result.ok !== true) throw new Error(typeof result.error === "string" ? result.error : "Desktop request failed.");
+			if (request.operation === "activate" && delegated !== void 0) {
+				if (delegations.get(scope.sessionId) !== delegated || delegated.abort.signal.aborted || remotePolicy.isDeviceAuthorized?.(delegated.deviceId) !== true) throw new Error("The paired activation was revoked.");
+				delegated.approved = true;
+				const grant = result.result;
+				if (typeof grant?.expiresAt === "number") delegated.expiresAt = grant.expiresAt;
+				if (typeof grant?.grantId === "string") delegated.grantId = grant.grantId;
+			}
+			if (request.operation === "stop") {
+				if (delegated !== void 0) delegated.expiresAt = void 0;
+				const grantId = request.payload?.grantId;
+				if (typeof grantId !== "string") throw new Error("Recording finalization requires its grant.");
+				return recordings.importStop(scope.sessionId, grantId, result.result);
+			}
+			return result.result;
+		},
+		close() {
+			if (closed) return;
+			try {
+				send({
+					type: "po:computer-use:close",
+					version: VERSION
+				});
+			} finally {
+				close();
+			}
+		}
+	};
+}
+//#endregion
+export { createComputerUseBinding };
+
+//# sourceMappingURL=computerUseBinding.mjs.map

package/dist/src/builders/server/computerUseBinding.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"computerUseBinding.mjs","names":[],"sources":["../../../../src/builders/server/computerUseBinding.ts"],"sourcesContent":["import { randomUUID, timingSafeEqual } from 'node:crypto';\nimport fs from 'node:fs/promises';\nimport os from 'node:os';\nimport path from 'node:path';\n\nimport type { DoomComputerUseHostBinding } from '@agimon-ai/po-core/hubChannel';\nimport { doomApiCallerFrom } from '@agimon-ai/po-core/packageApi';\n\nimport { ComputerUseRecordingStore } from './computerUseRecordings';\n\nconst VERSION = 1;\nconst MAX_BYTES = 8 * 1024 * 1024;\nconst DESKTOP_HEADER = 'x-po-desktop';\ntype Transport = Pick<NodeJS.Process, 'send' | 'connected' | 'on' | 'off'>;\n\n/** The capability is discovered over the inherited Desktop IPC channel, never from environment flags. */\nexport async function createComputerUseBinding(\n  transport: Transport = process,\n  remotePolicy: {\n    isDeviceAuthorized?: (deviceId: string) => boolean;\n    stepUpRequired?: () => boolean;\n  } = {},\n): Promise<DoomComputerUseHostBinding | undefined> {\n  if (!transport.send || !transport.connected) return undefined;\n  const recordings = new ComputerUseRecordingStore(await fs.mkdtemp(path.join(os.tmpdir(), 'po-recordings-')));\n  let available = false;\n  let enabled = false;\n  let closed = false;\n  let token = '';\n  let generation: string | undefined;\n  const ownedSessions = new Set<string>();\n  const revokedSessions = new Set<string>();\n  const listeners = new Map<() => void, string | undefined>();\n  const delegations = new Map<\n    string,\n    { deviceId: string; approved: boolean; abort: AbortController; grantId?: string; expiresAt?: number }\n  >();\n  const nativeAuthorized = (headers: Headers): boolean => {\n    const proof = headers.get(DESKTOP_HEADER) ?? '';\n    return available && /^[a-f0-9]{64}$/u.test(proof) && timingSafeEqual(Buffer.from(proof), Buffer.from(token));\n  };\n  const remoteCaller = (headers: Headers) => {\n    const caller = doomApiCallerFrom(headers);\n    return caller?.locality === 'remote' && remotePolicy.isDeviceAuthorized?.(caller.deviceId) === true\n      ? caller\n      : undefined;\n  };\n  const notify = (sessionId?: string): void => {\n    for (const [listener, session] of listeners) if (sessionId === undefined || session === sessionId) listener();\n  };\n  const revoke = (sessionId: string, retainRecording = false): void => {\n    const delegated = delegations.get(sessionId);\n    if (delegated === undefined) return;\n    if (!retainRecording) delegations.delete(sessionId);\n    delegated.expiresAt = undefined;\n    delegated.abort.abort();\n    revokedSessions.add(sessionId);\n    if (delegated.grantId !== undefined && available) {\n      void exchange(\n        { type: 'po:computer-use:request', sessionId, operation: 'stop', payload: { grantId: delegated.grantId } },\n        30_000,\n      )\n        .then((result) => recordings.importStop(sessionId, delegated.grantId!, result.result))\n        .catch(() => close());\n    }\n    notify(sessionId);\n  };\n  const pending = new Map<string, { finish: (value?: Record<string, unknown>, error?: Error) => void }>();\n  const send = (value: object): void => {\n    if (closed || !transport.connected) throw new Error('Desktop computer use is disconnected.');\n    transport.send!(value, (error: Error | null) => {\n      if (error) close();\n    });\n  };\n  const close = (): void => {\n    if (closed) return;\n    closed = true;\n    available = false;\n    token = '';\n    transport.off('message', onMessage);\n    transport.off('disconnect', close);\n    transport.off('exit', close);\n    for (const request of pending.values())\n      request.finish(undefined, new Error('Desktop computer use is disconnected.'));\n    pending.clear();\n    for (const sessionId of delegations.keys()) revoke(sessionId);\n    notify();\n    listeners.clear();\n    void recordings.close().catch(() => process.emitWarning('Computer-use recording cleanup failed.'));\n    // Keep ownership pinned while the server is alive, including after Desktop disconnects.\n  };\n  const onMessage = (value: unknown): void => {\n    if (!value || typeof value !== 'object' || Array.isArray(value)) return;\n    const message = value as Record<string, unknown>;\n    if (message.version !== VERSION) return;\n    if (message.type === 'po:computer-use:availability' && typeof message.enabled === 'boolean') {\n      enabled = message.enabled;\n      // Native stop/expiry also notifies availability without changing the global setting.\n      for (const sessionId of delegations.keys()) revoke(sessionId, true);\n      notify();\n      return;\n    }\n    if (typeof message.requestId !== 'string') return;\n    if (message.type !== 'po:computer-use:ready' && message.type !== 'po:computer-use:response') return;\n    if (Buffer.byteLength(JSON.stringify(message)) > MAX_BYTES) {\n      close();\n      return;\n    }\n    pending.get(message.requestId)?.finish(message);\n  };\n  transport.on('message', onMessage);\n  transport.on('disconnect', close);\n  transport.on('exit', close);\n\n  const exchange = (\n    value: Record<string, unknown>,\n    timeoutMs: number,\n    signal?: AbortSignal,\n  ): Promise<Record<string, unknown>> =>\n    new Promise((resolve, reject) => {\n      signal?.throwIfAborted();\n      if (closed || pending.size >= 128) throw new Error('Desktop computer-use transport is unavailable or busy.');\n      const requestId = randomUUID();\n      const cancel = (): void => {\n        try {\n          send({ type: 'po:computer-use:cancel', version: VERSION, requestId });\n        } catch {\n          /* Already disconnected. */\n        }\n      };\n      const finish = (result?: Record<string, unknown>, error?: Error): void => {\n        if (!pending.delete(requestId)) return;\n        clearTimeout(timer);\n        signal?.removeEventListener('abort', onAbort);\n        if (error) reject(error);\n        else resolve(result!);\n      };\n      const onAbort = (): void => {\n        cancel();\n        finish(undefined, new Error('Desktop computer-use request was cancelled.'));\n      };\n      const timer = setTimeout(() => {\n        cancel();\n        finish(undefined, new Error('Desktop computer-use request timed out.'));\n      }, timeoutMs);\n      pending.set(requestId, { finish });\n      signal?.addEventListener('abort', onAbort, { once: true });\n      try {\n        const message = { ...value, version: VERSION, requestId };\n        if (Buffer.byteLength(JSON.stringify(message)) > MAX_BYTES)\n          throw new Error('Desktop computer-use request is too large.');\n        send(message);\n      } catch (error) {\n        finish(undefined, error instanceof Error ? error : new Error(String(error)));\n      }\n    });\n\n  try {\n    const ready = await exchange({ type: 'po:computer-use:hello' }, 1_500);\n    if (\n      ready.type !== 'po:computer-use:ready' ||\n      typeof ready.token !== 'string' ||\n      !/^[a-f0-9]{64}$/u.test(ready.token)\n    ) {\n      throw new Error('Invalid Desktop capability handshake.');\n    }\n    token = ready.token;\n    available = true;\n    enabled = ready.enabled === true;\n  } catch {\n    close();\n    return undefined;\n  }\n\n  return {\n    get available() {\n      return available;\n    },\n    get enabled() {\n      return available && enabled;\n    },\n    authorize: nativeAuthorized,\n    readRecording: (scope, artifactId, range) => recordings.read(scope.sessionId, artifactId, range),\n    authorizeActivation(headers) {\n      if (!available || !enabled) return false;\n      if (nativeAuthorized(headers)) return true;\n      const caller = remoteCaller(headers);\n      return (\n        caller !== undefined &&\n        (remotePolicy.stepUpRequired?.() === true ? caller.stepUp === 'verified' : caller.stepUp === 'not-required')\n      );\n    },\n    authorizePending(sessionId, headers) {\n      if (nativeAuthorized(headers)) return true;\n      const caller = remoteCaller(headers);\n      const delegated = delegations.get(sessionId);\n      return (\n        available &&\n        enabled &&\n        caller !== undefined &&\n        delegated !== undefined &&\n        delegated.deviceId === caller.deviceId &&\n        delegated.expiresAt === undefined &&\n        !delegated.abort.signal.aborted\n      );\n    },\n    authorizeRecording(sessionId, headers) {\n      if (nativeAuthorized(headers)) return true;\n      const caller = remoteCaller(headers);\n      const delegated = delegations.get(sessionId);\n      return (\n        available && caller !== undefined && delegated?.approved === true && delegated.deviceId === caller.deviceId\n      );\n    },\n    authorizeSession(sessionId, headers) {\n      if (nativeAuthorized(headers)) return true;\n      const caller = remoteCaller(headers);\n      const delegated = delegations.get(sessionId);\n      if (available && enabled && caller !== undefined && !ownedSessions.has(sessionId)) return true;\n      return (\n        available &&\n        enabled &&\n        caller !== undefined &&\n        delegated?.approved === true &&\n        delegated.expiresAt !== undefined &&\n        delegated.expiresAt > Date.now() &&\n        delegated.deviceId === caller.deviceId &&\n        !delegated.abort.signal.aborted\n      );\n    },\n    claimSession(sessionId, headers) {\n      if (!available || !enabled) throw new Error('Desktop computer use is unavailable.');\n      const caller = headers === undefined ? undefined : remoteCaller(headers);\n      if (caller !== undefined) {\n        const previous = delegations.get(sessionId);\n        if (previous !== undefined && previous.deviceId !== caller.deviceId)\n          throw new Error('This session belongs to another paired device.');\n        if (previous?.abort.signal.aborted) {\n          previous.abort = new AbortController();\n          previous.grantId = undefined;\n        }\n        if (previous === undefined)\n          delegations.set(sessionId, {\n            deviceId: caller.deviceId,\n            approved: false,\n            abort: new AbortController(),\n          });\n      } else if (headers !== undefined && !nativeAuthorized(headers)) {\n        throw new Error('Native or paired authorization is required.');\n      }\n      revokedSessions.delete(sessionId);\n      ownedSessions.add(sessionId);\n    },\n    revokeDevice(deviceId) {\n      for (const [sessionId, delegated] of delegations) if (delegated.deviceId === deviceId) revoke(sessionId);\n    },\n    ownsSession: (sessionId) => ownedSessions.has(sessionId),\n    forgetSession: (sessionId) => {\n      revoke(sessionId);\n      void recordings\n        .forgetSession(sessionId)\n        .catch(() => process.emitWarning('Computer-use recording cleanup failed.'));\n      // Keep private history pinned to Desktop, but never replay device approval after restart.\n    },\n    subscribe(listener, sessionId) {\n      listeners.set(listener, sessionId);\n      return () => {\n        listeners.delete(listener);\n      };\n    },\n    async request(scope, request) {\n      if (!available) throw new Error('Desktop computer use is unavailable.');\n      if (revokedSessions.has(scope.sessionId) && request.operation !== 'stop' && request.operation !== 'status')\n        throw new Error('Computer-use delegation was revoked.');\n      if (request.operation !== 'status' && request.operation !== 'targets' && !ownedSessions.has(scope.sessionId)) {\n        throw new Error('This session has not been authorized by Desktop.');\n      }\n      const delegated = delegations.get(scope.sessionId);\n      if (delegated !== undefined && remotePolicy.isDeviceAuthorized?.(delegated.deviceId) !== true) {\n        revoke(scope.sessionId);\n        if (request.operation !== 'stop') throw new Error('The paired device was revoked.');\n      }\n      if (request.operation === 'stop' && delegated !== undefined) {\n        delegated.expiresAt = undefined;\n        delegated.abort.abort();\n      }\n      const signal =\n        delegated === undefined || request.operation === 'stop'\n          ? request.signal\n          : request.signal === undefined\n            ? delegated.abort.signal\n            : AbortSignal.any([request.signal, delegated.abort.signal]);\n      const result = await exchange(\n        {\n          type: 'po:computer-use:request',\n          sessionId: scope.sessionId,\n          operation: request.operation,\n          ...(request.payload === undefined ? {} : { payload: request.payload }),\n        },\n        request.operation === 'activate' ? 120_000 : 30_000,\n        signal,\n      );\n      if (\n        typeof result.hostGeneration !== 'string' ||\n        (generation !== undefined && generation !== result.hostGeneration)\n      ) {\n        close();\n        throw new Error('Desktop generation changed. Authorize a new session.');\n      }\n      generation = result.hostGeneration;\n      if (result.ok !== true)\n        throw new Error(typeof result.error === 'string' ? result.error : 'Desktop request failed.');\n      if (request.operation === 'activate' && delegated !== undefined) {\n        if (\n          delegations.get(scope.sessionId) !== delegated ||\n          delegated.abort.signal.aborted ||\n          remotePolicy.isDeviceAuthorized?.(delegated.deviceId) !== true\n        )\n          throw new Error('The paired activation was revoked.');\n        delegated.approved = true;\n        const grant = result.result as { grantId?: unknown; expiresAt?: unknown } | undefined;\n        if (typeof grant?.expiresAt === 'number') delegated.expiresAt = grant.expiresAt;\n        if (typeof grant?.grantId === 'string') delegated.grantId = grant.grantId;\n      }\n      if (request.operation === 'stop') {\n        if (delegated !== undefined) delegated.expiresAt = undefined;\n        const grantId = (request.payload as { grantId?: unknown } | undefined)?.grantId;\n        if (typeof grantId !== 'string') throw new Error('Recording finalization requires its grant.');\n        return recordings.importStop(scope.sessionId, grantId, result.result);\n      }\n      return result.result;\n    },\n    close() {\n      if (closed) return;\n      try {\n        send({ type: 'po:computer-use:close', version: VERSION });\n      } finally {\n        close();\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;;AAUA,MAAM,UAAU;AAChB,MAAM,YAAY;AAClB,MAAM,iBAAiB;;AAIvB,eAAsB,yBACpB,YAAuB,SACvB,eAGI,CAAC,GAC4C;CACjD,IAAI,CAAC,UAAU,QAAQ,CAAC,UAAU,WAAW,OAAO,KAAA;CACpD,MAAM,aAAa,IAAI,0BAA0B,MAAM,GAAG,QAAQ,KAAK,KAAK,GAAG,OAAO,GAAG,gBAAgB,CAAC,CAAC;CAC3G,IAAI,YAAY;CAChB,IAAI,UAAU;CACd,IAAI,SAAS;CACb,IAAI,QAAQ;CACZ,IAAI;CACJ,MAAM,gCAAgB,IAAI,IAAY;CACtC,MAAM,kCAAkB,IAAI,IAAY;CACxC,MAAM,4BAAY,IAAI,IAAoC;CAC1D,MAAM,8BAAc,IAAI,IAGtB;CACF,MAAM,oBAAoB,YAA8B;EACtD,MAAM,QAAQ,QAAQ,IAAI,cAAc,KAAK;EAC7C,OAAO,aAAa,kBAAkB,KAAK,KAAK,KAAK,gBAAgB,OAAO,KAAK,KAAK,GAAG,OAAO,KAAK,KAAK,CAAC;CAC7G;CACA,MAAM,gBAAgB,YAAqB;EACzC,MAAM,SAAS,kBAAkB,OAAO;EACxC,OAAO,QAAQ,aAAa,YAAY,aAAa,qBAAqB,OAAO,QAAQ,MAAM,OAC3F,SACA,KAAA;CACN;CACA,MAAM,UAAU,cAA6B;EAC3C,KAAK,MAAM,CAAC,UAAU,YAAY,WAAW,IAAI,cAAc,KAAA,KAAa,YAAY,WAAW,SAAS;CAC9G;CACA,MAAM,UAAU,WAAmB,kBAAkB,UAAgB;EACnE,MAAM,YAAY,YAAY,IAAI,SAAS;EAC3C,IAAI,cAAc,KAAA,GAAW;EAC7B,IAAI,CAAC,iBAAiB,YAAY,OAAO,SAAS;EAClD,UAAU,YAAY,KAAA;EACtB,UAAU,MAAM,MAAM;EACtB,gBAAgB,IAAI,SAAS;EAC7B,IAAI,UAAU,YAAY,KAAA,KAAa,WACrC,SACE;GAAE,MAAM;GAA2B;GAAW,WAAW;GAAQ,SAAS,EAAE,SAAS,UAAU,QAAQ;EAAE,GACzG,GACF,CAAC,CACE,MAAM,WAAW,WAAW,WAAW,WAAW,UAAU,SAAU,OAAO,MAAM,CAAC,CAAC,CACrF,YAAY,MAAM,CAAC;EAExB,OAAO,SAAS;CAClB;CACA,MAAM,0BAAU,IAAI,IAAkF;CACtG,MAAM,QAAQ,UAAwB;EACpC,IAAI,UAAU,CAAC,UAAU,WAAW,MAAM,IAAI,MAAM,uCAAuC;EAC3F,UAAU,KAAM,QAAQ,UAAwB;GAC9C,IAAI,OAAO,MAAM;EACnB,CAAC;CACH;CACA,MAAM,cAAoB;EACxB,IAAI,QAAQ;EACZ,SAAS;EACT,YAAY;EACZ,QAAQ;EACR,UAAU,IAAI,WAAW,SAAS;EAClC,UAAU,IAAI,cAAc,KAAK;EACjC,UAAU,IAAI,QAAQ,KAAK;EAC3B,KAAK,MAAM,WAAW,QAAQ,OAAO,GACnC,QAAQ,OAAO,KAAA,mBAAW,IAAI,MAAM,uCAAuC,CAAC;EAC9E,QAAQ,MAAM;EACd,KAAK,MAAM,aAAa,YAAY,KAAK,GAAG,OAAO,SAAS;EAC5D,OAAO;EACP,UAAU,MAAM;EAChB,WAAgB,MAAM,CAAC,CAAC,YAAY,QAAQ,YAAY,wCAAwC,CAAC;CAEnG;CACA,MAAM,aAAa,UAAyB;EAC1C,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;EACjE,MAAM,UAAU;EAChB,IAAI,QAAQ,YAAY,SAAS;EACjC,IAAI,QAAQ,SAAS,kCAAkC,OAAO,QAAQ,YAAY,WAAW;GAC3F,UAAU,QAAQ;GAElB,KAAK,MAAM,aAAa,YAAY,KAAK,GAAG,OAAO,WAAW,IAAI;GAClE,OAAO;GACP;EACF;EACA,IAAI,OAAO,QAAQ,cAAc,UAAU;EAC3C,IAAI,QAAQ,SAAS,2BAA2B,QAAQ,SAAS,4BAA4B;EAC7F,IAAI,OAAO,WAAW,KAAK,UAAU,OAAO,CAAC,IAAI,WAAW;GAC1D,MAAM;GACN;EACF;EACA,QAAQ,IAAI,QAAQ,SAAS,CAAC,EAAE,OAAO,OAAO;CAChD;CACA,UAAU,GAAG,WAAW,SAAS;CACjC,UAAU,GAAG,cAAc,KAAK;CAChC,UAAU,GAAG,QAAQ,KAAK;CAE1B,MAAM,YACJ,OACA,WACA,WAEA,IAAI,SAAS,SAAS,WAAW;EAC/B,QAAQ,eAAe;EACvB,IAAI,UAAU,QAAQ,QAAQ,KAAK,MAAM,IAAI,MAAM,wDAAwD;EAC3G,MAAM,YAAY,WAAW;EAC7B,MAAM,eAAqB;GACzB,IAAI;IACF,KAAK;KAAE,MAAM;KAA0B,SAAS;KAAS;IAAU,CAAC;GACtE,QAAQ,CAER;EACF;EACA,MAAM,UAAU,QAAkC,UAAwB;GACxE,IAAI,CAAC,QAAQ,OAAO,SAAS,GAAG;GAChC,aAAa,KAAK;GAClB,QAAQ,oBAAoB,SAAS,OAAO;GAC5C,IAAI,OAAO,OAAO,KAAK;QAClB,QAAQ,MAAO;EACtB;EACA,MAAM,gBAAsB;GAC1B,OAAO;GACP,OAAO,KAAA,mBAAW,IAAI,MAAM,6CAA6C,CAAC;EAC5E;EACA,MAAM,QAAQ,iBAAiB;GAC7B,OAAO;GACP,OAAO,KAAA,mBAAW,IAAI,MAAM,yCAAyC,CAAC;EACxE,GAAG,SAAS;EACZ,QAAQ,IAAI,WAAW,EAAE,OAAO,CAAC;EACjC,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;EACzD,IAAI;GACF,MAAM,UAAU;IAAE,GAAG;IAAO,SAAS;IAAS;GAAU;GACxD,IAAI,OAAO,WAAW,KAAK,UAAU,OAAO,CAAC,IAAI,WAC/C,MAAM,IAAI,MAAM,4CAA4C;GAC9D,KAAK,OAAO;EACd,SAAS,OAAO;GACd,OAAO,KAAA,GAAW,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EAC7E;CACF,CAAC;CAEH,IAAI;EACF,MAAM,QAAQ,MAAM,SAAS,EAAE,MAAM,wBAAwB,GAAG,IAAK;EACrE,IACE,MAAM,SAAS,2BACf,OAAO,MAAM,UAAU,YACvB,CAAC,kBAAkB,KAAK,MAAM,KAAK,GAEnC,MAAM,IAAI,MAAM,uCAAuC;EAEzD,QAAQ,MAAM;EACd,YAAY;EACZ,UAAU,MAAM,YAAY;CAC9B,QAAQ;EACN,MAAM;EACN;CACF;CAEA,OAAO;EACL,IAAI,YAAY;GACd,OAAO;EACT;EACA,IAAI,UAAU;GACZ,OAAO,aAAa;EACtB;EACA,WAAW;EACX,gBAAgB,OAAO,YAAY,UAAU,WAAW,KAAK,MAAM,WAAW,YAAY,KAAK;EAC/F,oBAAoB,SAAS;GAC3B,IAAI,CAAC,aAAa,CAAC,SAAS,OAAO;GACnC,IAAI,iBAAiB,OAAO,GAAG,OAAO;GACtC,MAAM,SAAS,aAAa,OAAO;GACnC,OACE,WAAW,KAAA,MACV,aAAa,iBAAiB,MAAM,OAAO,OAAO,WAAW,aAAa,OAAO,WAAW;EAEjG;EACA,iBAAiB,WAAW,SAAS;GACnC,IAAI,iBAAiB,OAAO,GAAG,OAAO;GACtC,MAAM,SAAS,aAAa,OAAO;GACnC,MAAM,YAAY,YAAY,IAAI,SAAS;GAC3C,OACE,aACA,WACA,WAAW,KAAA,KACX,cAAc,KAAA,KACd,UAAU,aAAa,OAAO,YAC9B,UAAU,cAAc,KAAA,KACxB,CAAC,UAAU,MAAM,OAAO;EAE5B;EACA,mBAAmB,WAAW,SAAS;GACrC,IAAI,iBAAiB,OAAO,GAAG,OAAO;GACtC,MAAM,SAAS,aAAa,OAAO;GACnC,MAAM,YAAY,YAAY,IAAI,SAAS;GAC3C,OACE,aAAa,WAAW,KAAA,KAAa,WAAW,aAAa,QAAQ,UAAU,aAAa,OAAO;EAEvG;EACA,iBAAiB,WAAW,SAAS;GACnC,IAAI,iBAAiB,OAAO,GAAG,OAAO;GACtC,MAAM,SAAS,aAAa,OAAO;GACnC,MAAM,YAAY,YAAY,IAAI,SAAS;GAC3C,IAAI,aAAa,WAAW,WAAW,KAAA,KAAa,CAAC,cAAc,IAAI,SAAS,GAAG,OAAO;GAC1F,OACE,aACA,WACA,WAAW,KAAA,KACX,WAAW,aAAa,QACxB,UAAU,cAAc,KAAA,KACxB,UAAU,YAAY,KAAK,IAAI,KAC/B,UAAU,aAAa,OAAO,YAC9B,CAAC,UAAU,MAAM,OAAO;EAE5B;EACA,aAAa,WAAW,SAAS;GAC/B,IAAI,CAAC,aAAa,CAAC,SAAS,MAAM,IAAI,MAAM,sCAAsC;GAClF,MAAM,SAAS,YAAY,KAAA,IAAY,KAAA,IAAY,aAAa,OAAO;GACvE,IAAI,WAAW,KAAA,GAAW;IACxB,MAAM,WAAW,YAAY,IAAI,SAAS;IAC1C,IAAI,aAAa,KAAA,KAAa,SAAS,aAAa,OAAO,UACzD,MAAM,IAAI,MAAM,gDAAgD;IAClE,IAAI,UAAU,MAAM,OAAO,SAAS;KAClC,SAAS,QAAQ,IAAI,gBAAgB;KACrC,SAAS,UAAU,KAAA;IACrB;IACA,IAAI,aAAa,KAAA,GACf,YAAY,IAAI,WAAW;KACzB,UAAU,OAAO;KACjB,UAAU;KACV,OAAO,IAAI,gBAAgB;IAC7B,CAAC;GACL,OAAO,IAAI,YAAY,KAAA,KAAa,CAAC,iBAAiB,OAAO,GAC3D,MAAM,IAAI,MAAM,6CAA6C;GAE/D,gBAAgB,OAAO,SAAS;GAChC,cAAc,IAAI,SAAS;EAC7B;EACA,aAAa,UAAU;GACrB,KAAK,MAAM,CAAC,WAAW,cAAc,aAAa,IAAI,UAAU,aAAa,UAAU,OAAO,SAAS;EACzG;EACA,cAAc,cAAc,cAAc,IAAI,SAAS;EACvD,gBAAgB,cAAc;GAC5B,OAAO,SAAS;GAChB,WACG,cAAc,SAAS,CAAC,CACxB,YAAY,QAAQ,YAAY,wCAAwC,CAAC;EAE9E;EACA,UAAU,UAAU,WAAW;GAC7B,UAAU,IAAI,UAAU,SAAS;GACjC,aAAa;IACX,UAAU,OAAO,QAAQ;GAC3B;EACF;EACA,MAAM,QAAQ,OAAO,SAAS;GAC5B,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,sCAAsC;GACtE,IAAI,gBAAgB,IAAI,MAAM,SAAS,KAAK,QAAQ,cAAc,UAAU,QAAQ,cAAc,UAChG,MAAM,IAAI,MAAM,sCAAsC;GACxD,IAAI,QAAQ,cAAc,YAAY,QAAQ,cAAc,aAAa,CAAC,cAAc,IAAI,MAAM,SAAS,GACzG,MAAM,IAAI,MAAM,kDAAkD;GAEpE,MAAM,YAAY,YAAY,IAAI,MAAM,SAAS;GACjD,IAAI,cAAc,KAAA,KAAa,aAAa,qBAAqB,UAAU,QAAQ,MAAM,MAAM;IAC7F,OAAO,MAAM,SAAS;IACtB,IAAI,QAAQ,cAAc,QAAQ,MAAM,IAAI,MAAM,gCAAgC;GACpF;GACA,IAAI,QAAQ,cAAc,UAAU,cAAc,KAAA,GAAW;IAC3D,UAAU,YAAY,KAAA;IACtB,UAAU,MAAM,MAAM;GACxB;GACA,MAAM,SACJ,cAAc,KAAA,KAAa,QAAQ,cAAc,SAC7C,QAAQ,SACR,QAAQ,WAAW,KAAA,IACjB,UAAU,MAAM,SAChB,YAAY,IAAI,CAAC,QAAQ,QAAQ,UAAU,MAAM,MAAM,CAAC;GAChE,MAAM,SAAS,MAAM,SACnB;IACE,MAAM;IACN,WAAW,MAAM;IACjB,WAAW,QAAQ;IACnB,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;GACtE,GACA,QAAQ,cAAc,aAAa,OAAU,KAC7C,MACF;GACA,IACE,OAAO,OAAO,mBAAmB,YAChC,eAAe,KAAA,KAAa,eAAe,OAAO,gBACnD;IACA,MAAM;IACN,MAAM,IAAI,MAAM,sDAAsD;GACxE;GACA,aAAa,OAAO;GACpB,IAAI,OAAO,OAAO,MAChB,MAAM,IAAI,MAAM,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ,yBAAyB;GAC7F,IAAI,QAAQ,cAAc,cAAc,cAAc,KAAA,GAAW;IAC/D,IACE,YAAY,IAAI,MAAM,SAAS,MAAM,aACrC,UAAU,MAAM,OAAO,WACvB,aAAa,qBAAqB,UAAU,QAAQ,MAAM,MAE1D,MAAM,IAAI,MAAM,oCAAoC;IACtD,UAAU,WAAW;IACrB,MAAM,QAAQ,OAAO;IACrB,IAAI,OAAO,OAAO,cAAc,UAAU,UAAU,YAAY,MAAM;IACtE,IAAI,OAAO,OAAO,YAAY,UAAU,UAAU,UAAU,MAAM;GACpE;GACA,IAAI,QAAQ,cAAc,QAAQ;IAChC,IAAI,cAAc,KAAA,GAAW,UAAU,YAAY,KAAA;IACnD,MAAM,UAAW,QAAQ,SAA+C;IACxE,IAAI,OAAO,YAAY,UAAU,MAAM,IAAI,MAAM,4CAA4C;IAC7F,OAAO,WAAW,WAAW,MAAM,WAAW,SAAS,OAAO,MAAM;GACtE;GACA,OAAO,OAAO;EAChB;EACA,QAAQ;GACN,IAAI,QAAQ;GACZ,IAAI;IACF,KAAK;KAAE,MAAM;KAAyB,SAAS;IAAQ,CAAC;GAC1D,UAAU;IACR,MAAM;GACR;EACF;CACF;AACF"}

package/dist/src/builders/server/computerUseRecordings.cjs

@@ -0,0 +1,188 @@
+const require_runtime = require("../../../_virtual/_rolldown/runtime.cjs");
+let node_fs = require("node:fs");
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path, 1);
+let node_os = require("node:os");
+node_os = require_runtime.__toESM(node_os, 1);
+let node_crypto = require("node:crypto");
+let node_fs_promises = require("node:fs/promises");
+node_fs_promises = require_runtime.__toESM(node_fs_promises, 1);
+//#region src/builders/server/computerUseRecordings.ts
+const MAX_RECORDING_BYTES = 134217728;
+const MAX_STORE_BYTES = 536870912;
+const MAX_RECORDINGS = 8;
+const RETENTION_MS = 864e5;
+const CHUNK_BYTES = 1048576;
+const SAFE_ID = /^[a-zA-Z0-9-]{1,128}$/u;
+/** Imports only grant-bound native IPC receipts, never browser-provided paths. */
+var ComputerUseRecordingStore = class {
+	directory;
+	stagingRoot;
+	recordings = /* @__PURE__ */ new Map();
+	imports = /* @__PURE__ */ new Map();
+	closed = false;
+	incarnations = /* @__PURE__ */ new Map();
+	constructor(directory, stagingRoot = node_path.default.join(node_os.default.tmpdir(), "po-computer-use")) {
+		this.directory = directory;
+		this.stagingRoot = stagingRoot;
+	}
+	async prune() {
+		let bytes = [...this.recordings.values()].reduce((total, item) => total + item.sizeBytes, 0);
+		for (const [id, item] of this.recordings) {
+			if (Date.now() - Date.parse(item.completedAt) < RETENTION_MS && this.recordings.size <= MAX_RECORDINGS && bytes <= MAX_STORE_BYTES) break;
+			this.recordings.delete(id);
+			this.imports.delete(`${item.sessionId}\0${item.grantId}`);
+			bytes -= item.sizeBytes;
+			await node_fs_promises.default.rm(item.file, { force: true });
+		}
+	}
+	async importStop(sessionId, grantId, value) {
+		if (this.closed) throw new Error("Recording storage is closed.");
+		const key = `${sessionId}\0${grantId}`;
+		const previous = this.imports.get(key);
+		if (previous) return previous;
+		const pending = this.importReceipt(sessionId, grantId, value);
+		this.imports.set(key, pending);
+		try {
+			const result = await pending;
+			if (!result?.artifact) this.imports.delete(key);
+			return result;
+		} catch {
+			this.imports.delete(key);
+			throw new Error("Native recording import failed.");
+		}
+	}
+	async importReceipt(sessionId, grantId, value) {
+		const receipt = value;
+		if (receipt?.stopped !== true || receipt.artifact === void 0) return { stopped: receipt?.stopped === true };
+		const incarnation = this.incarnations.get(sessionId) ?? 0;
+		const artifact = receipt.artifact;
+		if (!SAFE_ID.test(grantId) || artifact.kind !== "screen_recording" || artifact.contentType !== "video/mp4" || artifact.audioScope !== "target_application") throw new Error("Invalid native recording receipt.");
+		const grantDirectory = node_path.default.join(this.stagingRoot, grantId);
+		const source = node_path.default.join(grantDirectory, "recording.mp4");
+		if (artifact.path !== source) throw new Error("Invalid native recording location.");
+		for (const directory of [this.stagingRoot, grantDirectory]) {
+			const stat = await node_fs_promises.default.lstat(directory);
+			if (!stat.isDirectory() || stat.isSymbolicLink() || (stat.mode & 63) !== 0) throw new Error("Recording staging is not private.");
+		}
+		const input = await node_fs_promises.default.open(source, node_fs.constants.O_RDONLY | node_fs.constants.O_NOFOLLOW);
+		const artifactId = (0, node_crypto.randomUUID)();
+		const destination = node_path.default.join(this.directory, `${artifactId}.mp4`);
+		const temporary = `${destination}.tmp`;
+		let output;
+		try {
+			const stat = await input.stat();
+			if (!stat.isFile() || stat.size < 1 || stat.size > MAX_RECORDING_BYTES) throw new Error("Recording exceeds the permitted size.");
+			await node_fs_promises.default.mkdir(this.directory, {
+				recursive: true,
+				mode: 448
+			});
+			const root = await node_fs_promises.default.lstat(this.directory);
+			if (!root.isDirectory() || root.isSymbolicLink() || (root.mode & 63) !== 0) throw new Error("Recording storage is not private.");
+			output = await node_fs_promises.default.open(temporary, "wx", 384);
+			const buffer = Buffer.alloc(CHUNK_BYTES);
+			let copied = 0;
+			while (true) {
+				const { bytesRead } = await input.read(buffer, 0, buffer.length, null);
+				if (bytesRead === 0) break;
+				copied += bytesRead;
+				if (copied > MAX_RECORDING_BYTES || copied > stat.size) throw new Error("Recording changed during import.");
+				await output.writeFile(buffer.subarray(0, bytesRead));
+			}
+			if (copied !== stat.size) throw new Error("Recording changed during import.");
+			await output.sync();
+			await output.close();
+			output = void 0;
+			if (this.closed || (this.incarnations.get(sessionId) ?? 0) !== incarnation) throw new Error("Recording storage is closed.");
+			await node_fs_promises.default.rename(temporary, destination);
+			if (this.closed || (this.incarnations.get(sessionId) ?? 0) !== incarnation) {
+				await node_fs_promises.default.rm(destination, { force: true });
+				throw new Error("Recording storage is closed.");
+			}
+			const item = {
+				sessionId,
+				grantId,
+				artifactId,
+				sizeBytes: copied,
+				completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+				file: destination
+			};
+			this.recordings.set(artifactId, item);
+			await this.prune();
+			await node_fs_promises.default.unlink(source);
+			await node_fs_promises.default.rmdir(grantDirectory);
+			return {
+				stopped: true,
+				artifact: {
+					artifactId,
+					status: "ready",
+					sizeBytes: copied,
+					completedAt: item.completedAt
+				}
+			};
+		} catch {
+			this.recordings.delete(artifactId);
+			await node_fs_promises.default.rm(temporary, { force: true });
+			await node_fs_promises.default.rm(destination, { force: true });
+			throw new Error("Native recording import failed.");
+		} finally {
+			await output?.close();
+			await input.close();
+		}
+	}
+	async forgetSession(sessionId) {
+		this.incarnations.set(sessionId, (this.incarnations.get(sessionId) ?? 0) + 1);
+		const files = [];
+		for (const [id, item] of this.recordings) {
+			if (item.sessionId !== sessionId) continue;
+			this.recordings.delete(id);
+			files.push(item.file);
+		}
+		for (const key of this.imports.keys()) if (key.startsWith(`${sessionId}\0`)) this.imports.delete(key);
+		await Promise.all(files.map((file) => node_fs_promises.default.rm(file, { force: true })));
+	}
+	async close() {
+		this.closed = true;
+		await Promise.allSettled(this.imports.values());
+		this.imports.clear();
+		this.recordings.clear();
+		await node_fs_promises.default.rm(this.directory, {
+			recursive: true,
+			force: true
+		});
+	}
+	async read(sessionId, artifactId, range) {
+		if (this.closed) return new Response(null, { status: 404 });
+		await this.prune();
+		const item = this.recordings.get(artifactId);
+		if (!item || item.sessionId !== sessionId) return new Response(null, { status: 404 });
+		const match = /^bytes=(\d+)-(\d+)$/u.exec(range ?? "");
+		const start = Number(match?.[1]);
+		const requestedEnd = Number(match?.[2]);
+		if (!match || !Number.isSafeInteger(start) || !Number.isSafeInteger(requestedEnd) || start < 0 || start >= item.sizeBytes || requestedEnd < start || requestedEnd - start >= CHUNK_BYTES) return new Response(null, { status: 416 });
+		const end = Math.min(requestedEnd, item.sizeBytes - 1);
+		const input = await node_fs_promises.default.open(item.file, node_fs.constants.O_RDONLY | node_fs.constants.O_NOFOLLOW).catch(() => void 0);
+		if (input === void 0) return new Response(null, { status: 410 });
+		try {
+			const bytes = Buffer.alloc(end - start + 1);
+			const { bytesRead } = await input.read(bytes, 0, bytes.length, start);
+			if (bytesRead !== bytes.length) return new Response(null, { status: 410 });
+			return new Response(bytes, {
+				status: 206,
+				headers: {
+					"content-type": "video/mp4",
+					"content-range": `bytes ${start}-${end}/${item.sizeBytes}`,
+					"accept-ranges": "bytes",
+					"cache-control": "no-store",
+					"content-length": String(bytes.length)
+				}
+			});
+		} finally {
+			await input.close();
+		}
+	}
+};
+//#endregion
+exports.ComputerUseRecordingStore = ComputerUseRecordingStore;
+
+//# sourceMappingURL=computerUseRecordings.cjs.map

package/dist/src/builders/server/computerUseRecordings.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"computerUseRecordings.cjs","names":["path","os","fs","constants","randomUUID"],"sources":["../../../../src/builders/server/computerUseRecordings.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { constants } from 'node:fs';\nimport fs from 'node:fs/promises';\nimport os from 'node:os';\nimport path from 'node:path';\n\nconst MAX_RECORDING_BYTES = 128 * 1024 * 1024;\nconst MAX_STORE_BYTES = 512 * 1024 * 1024;\nconst MAX_RECORDINGS = 8;\nconst RETENTION_MS = 24 * 60 * 60 * 1000;\nconst CHUNK_BYTES = 1024 * 1024;\nconst SAFE_ID = /^[a-zA-Z0-9-]{1,128}$/u;\n\ntype Recording = {\n  sessionId: string;\n  grantId: string;\n  artifactId: string;\n  sizeBytes: number;\n  completedAt: string;\n  file: string;\n};\n\n/** Imports only grant-bound native IPC receipts, never browser-provided paths. */\nexport class ComputerUseRecordingStore {\n  private readonly recordings = new Map<string, Recording>();\n  private readonly imports = new Map<string, Promise<unknown>>();\n  private closed = false;\n  private readonly incarnations = new Map<string, number>();\n  constructor(\n    private readonly directory: string,\n    private readonly stagingRoot = path.join(os.tmpdir(), 'po-computer-use'),\n  ) {}\n\n  private async prune(): Promise<void> {\n    let bytes = [...this.recordings.values()].reduce((total, item) => total + item.sizeBytes, 0);\n    for (const [id, item] of this.recordings) {\n      if (\n        Date.now() - Date.parse(item.completedAt) < RETENTION_MS &&\n        this.recordings.size <= MAX_RECORDINGS &&\n        bytes <= MAX_STORE_BYTES\n      )\n        break;\n      this.recordings.delete(id);\n      this.imports.delete(`${item.sessionId}\\0${item.grantId}`);\n      bytes -= item.sizeBytes;\n      await fs.rm(item.file, { force: true });\n    }\n  }\n\n  async importStop(sessionId: string, grantId: string, value: unknown): Promise<unknown> {\n    if (this.closed) throw new Error('Recording storage is closed.');\n    const key = `${sessionId}\\0${grantId}`;\n    const previous = this.imports.get(key);\n    if (previous) return previous;\n    const pending = this.importReceipt(sessionId, grantId, value);\n    this.imports.set(key, pending);\n    try {\n      const result = await pending;\n      if (!(result as { artifact?: unknown } | undefined)?.artifact) this.imports.delete(key);\n      return result;\n    } catch {\n      this.imports.delete(key);\n      throw new Error('Native recording import failed.');\n    }\n  }\n\n  private async importReceipt(sessionId: string, grantId: string, value: unknown): Promise<unknown> {\n    const receipt = value as {\n      stopped?: unknown;\n      artifact?: { kind?: unknown; path?: unknown; contentType?: unknown; audioScope?: unknown };\n    } | null;\n    if (receipt?.stopped !== true || receipt.artifact === undefined) return { stopped: receipt?.stopped === true };\n    const incarnation = this.incarnations.get(sessionId) ?? 0;\n    const artifact = receipt.artifact;\n    if (\n      !SAFE_ID.test(grantId) ||\n      artifact.kind !== 'screen_recording' ||\n      artifact.contentType !== 'video/mp4' ||\n      artifact.audioScope !== 'target_application'\n    )\n      throw new Error('Invalid native recording receipt.');\n    const grantDirectory = path.join(this.stagingRoot, grantId);\n    const source = path.join(grantDirectory, 'recording.mp4');\n    if (artifact.path !== source) throw new Error('Invalid native recording location.');\n    for (const directory of [this.stagingRoot, grantDirectory]) {\n      const stat = await fs.lstat(directory);\n      if (!stat.isDirectory() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0)\n        throw new Error('Recording staging is not private.');\n    }\n    const input = await fs.open(source, constants.O_RDONLY | constants.O_NOFOLLOW);\n    const artifactId = randomUUID();\n    const destination = path.join(this.directory, `${artifactId}.mp4`);\n    const temporary = `${destination}.tmp`;\n    let output: Awaited<ReturnType<typeof fs.open>> | undefined;\n    try {\n      const stat = await input.stat();\n      if (!stat.isFile() || stat.size < 1 || stat.size > MAX_RECORDING_BYTES)\n        throw new Error('Recording exceeds the permitted size.');\n      await fs.mkdir(this.directory, { recursive: true, mode: 0o700 });\n      const root = await fs.lstat(this.directory);\n      if (!root.isDirectory() || root.isSymbolicLink() || (root.mode & 0o077) !== 0)\n        throw new Error('Recording storage is not private.');\n      output = await fs.open(temporary, 'wx', 0o600);\n      const buffer = Buffer.alloc(CHUNK_BYTES);\n      let copied = 0;\n      while (true) {\n        const { bytesRead } = await input.read(buffer, 0, buffer.length, null);\n        if (bytesRead === 0) break;\n        copied += bytesRead;\n        if (copied > MAX_RECORDING_BYTES || copied > stat.size) throw new Error('Recording changed during import.');\n        await output.writeFile(buffer.subarray(0, bytesRead));\n      }\n      if (copied !== stat.size) throw new Error('Recording changed during import.');\n      await output.sync();\n      await output.close();\n      output = undefined;\n      if (this.closed || (this.incarnations.get(sessionId) ?? 0) !== incarnation)\n        throw new Error('Recording storage is closed.');\n      await fs.rename(temporary, destination);\n      if (this.closed || (this.incarnations.get(sessionId) ?? 0) !== incarnation) {\n        await fs.rm(destination, { force: true });\n        throw new Error('Recording storage is closed.');\n      }\n      const item = {\n        sessionId,\n        grantId,\n        artifactId,\n        sizeBytes: copied,\n        completedAt: new Date().toISOString(),\n        file: destination,\n      };\n      this.recordings.set(artifactId, item);\n      await this.prune();\n      await fs.unlink(source);\n      await fs.rmdir(grantDirectory);\n      return {\n        stopped: true,\n        artifact: { artifactId, status: 'ready', sizeBytes: copied, completedAt: item.completedAt },\n      };\n    } catch {\n      this.recordings.delete(artifactId);\n      await fs.rm(temporary, { force: true });\n      await fs.rm(destination, { force: true });\n      throw new Error('Native recording import failed.');\n    } finally {\n      await output?.close();\n      await input.close();\n    }\n  }\n\n  async forgetSession(sessionId: string): Promise<void> {\n    this.incarnations.set(sessionId, (this.incarnations.get(sessionId) ?? 0) + 1);\n    const files: string[] = [];\n    for (const [id, item] of this.recordings) {\n      if (item.sessionId !== sessionId) continue;\n      this.recordings.delete(id);\n      files.push(item.file);\n    }\n    for (const key of this.imports.keys()) if (key.startsWith(`${sessionId}\\0`)) this.imports.delete(key);\n    await Promise.all(files.map((file) => fs.rm(file, { force: true })));\n  }\n\n  async close(): Promise<void> {\n    this.closed = true;\n    await Promise.allSettled(this.imports.values());\n    this.imports.clear();\n    this.recordings.clear();\n    await fs.rm(this.directory, { recursive: true, force: true });\n  }\n\n  async read(sessionId: string, artifactId: string, range: string | undefined): Promise<Response> {\n    if (this.closed) return new Response(null, { status: 404 });\n    await this.prune();\n    const item = this.recordings.get(artifactId);\n    if (!item || item.sessionId !== sessionId) return new Response(null, { status: 404 });\n    const match = /^bytes=(\\d+)-(\\d+)$/u.exec(range ?? '');\n    const start = Number(match?.[1]);\n    const requestedEnd = Number(match?.[2]);\n    if (\n      !match ||\n      !Number.isSafeInteger(start) ||\n      !Number.isSafeInteger(requestedEnd) ||\n      start < 0 ||\n      start >= item.sizeBytes ||\n      requestedEnd < start ||\n      requestedEnd - start >= CHUNK_BYTES\n    )\n      return new Response(null, { status: 416 });\n    const end = Math.min(requestedEnd, item.sizeBytes - 1);\n    const input = await fs.open(item.file, constants.O_RDONLY | constants.O_NOFOLLOW).catch(() => undefined);\n    if (input === undefined) return new Response(null, { status: 410 });\n    try {\n      const bytes = Buffer.alloc(end - start + 1);\n      const { bytesRead } = await input.read(bytes, 0, bytes.length, start);\n      if (bytesRead !== bytes.length) return new Response(null, { status: 410 });\n      return new Response(bytes, {\n        status: 206,\n        headers: {\n          'content-type': 'video/mp4',\n          'content-range': `bytes ${start}-${end}/${item.sizeBytes}`,\n          'accept-ranges': 'bytes',\n          'cache-control': 'no-store',\n          'content-length': String(bytes.length),\n        },\n      });\n    } finally {\n      await input.close();\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;AAMA,MAAM,sBAAsB;AAC5B,MAAM,kBAAkB;AACxB,MAAM,iBAAiB;AACvB,MAAM,eAAe;AACrB,MAAM,cAAc;AACpB,MAAM,UAAU;;AAYhB,IAAa,4BAAb,MAAuC;CAMlB;CACA;CANnB,6BAA8B,IAAI,IAAuB;CACzD,0BAA2B,IAAI,IAA8B;CAC7D,SAAiB;CACjB,+BAAgC,IAAI,IAAoB;CACxD,YACE,WACA,cAA+BA,UAAAA,QAAK,KAAKC,QAAAA,QAAG,OAAO,GAAG,iBAAiB,GACvE;EAFiB,KAAA,YAAA;EACA,KAAA,cAAA;CAChB;CAEH,MAAc,QAAuB;EACnC,IAAI,QAAQ,CAAC,GAAG,KAAK,WAAW,OAAO,CAAC,CAAC,CAAC,QAAQ,OAAO,SAAS,QAAQ,KAAK,WAAW,CAAC;EAC3F,KAAK,MAAM,CAAC,IAAI,SAAS,KAAK,YAAY;GACxC,IACE,KAAK,IAAI,IAAI,KAAK,MAAM,KAAK,WAAW,IAAI,gBAC5C,KAAK,WAAW,QAAQ,kBACxB,SAAS,iBAET;GACF,KAAK,WAAW,OAAO,EAAE;GACzB,KAAK,QAAQ,OAAO,GAAG,KAAK,UAAU,IAAI,KAAK,SAAS;GACxD,SAAS,KAAK;GACd,MAAMC,iBAAAA,QAAG,GAAG,KAAK,MAAM,EAAE,OAAO,KAAK,CAAC;EACxC;CACF;CAEA,MAAM,WAAW,WAAmB,SAAiB,OAAkC;EACrF,IAAI,KAAK,QAAQ,MAAM,IAAI,MAAM,8BAA8B;EAC/D,MAAM,MAAM,GAAG,UAAU,IAAI;EAC7B,MAAM,WAAW,KAAK,QAAQ,IAAI,GAAG;EACrC,IAAI,UAAU,OAAO;EACrB,MAAM,UAAU,KAAK,cAAc,WAAW,SAAS,KAAK;EAC5D,KAAK,QAAQ,IAAI,KAAK,OAAO;EAC7B,IAAI;GACF,MAAM,SAAS,MAAM;GACrB,IAAI,CAAE,QAA+C,UAAU,KAAK,QAAQ,OAAO,GAAG;GACtF,OAAO;EACT,QAAQ;GACN,KAAK,QAAQ,OAAO,GAAG;GACvB,MAAM,IAAI,MAAM,iCAAiC;EACnD;CACF;CAEA,MAAc,cAAc,WAAmB,SAAiB,OAAkC;EAChG,MAAM,UAAU;EAIhB,IAAI,SAAS,YAAY,QAAQ,QAAQ,aAAa,KAAA,GAAW,OAAO,EAAE,SAAS,SAAS,YAAY,KAAK;EAC7G,MAAM,cAAc,KAAK,aAAa,IAAI,SAAS,KAAK;EACxD,MAAM,WAAW,QAAQ;EACzB,IACE,CAAC,QAAQ,KAAK,OAAO,KACrB,SAAS,SAAS,sBAClB,SAAS,gBAAgB,eACzB,SAAS,eAAe,sBAExB,MAAM,IAAI,MAAM,mCAAmC;EACrD,MAAM,iBAAiBF,UAAAA,QAAK,KAAK,KAAK,aAAa,OAAO;EAC1D,MAAM,SAASA,UAAAA,QAAK,KAAK,gBAAgB,eAAe;EACxD,IAAI,SAAS,SAAS,QAAQ,MAAM,IAAI,MAAM,oCAAoC;EAClF,KAAK,MAAM,aAAa,CAAC,KAAK,aAAa,cAAc,GAAG;GAC1D,MAAM,OAAO,MAAME,iBAAAA,QAAG,MAAM,SAAS;GACrC,IAAI,CAAC,KAAK,YAAY,KAAK,KAAK,eAAe,MAAM,KAAK,OAAO,QAAW,GAC1E,MAAM,IAAI,MAAM,mCAAmC;EACvD;EACA,MAAM,QAAQ,MAAMA,iBAAAA,QAAG,KAAK,QAAQC,QAAAA,UAAU,WAAWA,QAAAA,UAAU,UAAU;EAC7E,MAAM,cAAA,GAAaC,YAAAA,WAAAA,CAAW;EAC9B,MAAM,cAAcJ,UAAAA,QAAK,KAAK,KAAK,WAAW,GAAG,WAAW,KAAK;EACjE,MAAM,YAAY,GAAG,YAAY;EACjC,IAAI;EACJ,IAAI;GACF,MAAM,OAAO,MAAM,MAAM,KAAK;GAC9B,IAAI,CAAC,KAAK,OAAO,KAAK,KAAK,OAAO,KAAK,KAAK,OAAO,qBACjD,MAAM,IAAI,MAAM,uCAAuC;GACzD,MAAME,iBAAAA,QAAG,MAAM,KAAK,WAAW;IAAE,WAAW;IAAM,MAAM;GAAM,CAAC;GAC/D,MAAM,OAAO,MAAMA,iBAAAA,QAAG,MAAM,KAAK,SAAS;GAC1C,IAAI,CAAC,KAAK,YAAY,KAAK,KAAK,eAAe,MAAM,KAAK,OAAO,QAAW,GAC1E,MAAM,IAAI,MAAM,mCAAmC;GACrD,SAAS,MAAMA,iBAAAA,QAAG,KAAK,WAAW,MAAM,GAAK;GAC7C,MAAM,SAAS,OAAO,MAAM,WAAW;GACvC,IAAI,SAAS;GACb,OAAO,MAAM;IACX,MAAM,EAAE,cAAc,MAAM,MAAM,KAAK,QAAQ,GAAG,OAAO,QAAQ,IAAI;IACrE,IAAI,cAAc,GAAG;IACrB,UAAU;IACV,IAAI,SAAS,uBAAuB,SAAS,KAAK,MAAM,MAAM,IAAI,MAAM,kCAAkC;IAC1G,MAAM,OAAO,UAAU,OAAO,SAAS,GAAG,SAAS,CAAC;GACtD;GACA,IAAI,WAAW,KAAK,MAAM,MAAM,IAAI,MAAM,kCAAkC;GAC5E,MAAM,OAAO,KAAK;GAClB,MAAM,OAAO,MAAM;GACnB,SAAS,KAAA;GACT,IAAI,KAAK,WAAW,KAAK,aAAa,IAAI,SAAS,KAAK,OAAO,aAC7D,MAAM,IAAI,MAAM,8BAA8B;GAChD,MAAMA,iBAAAA,QAAG,OAAO,WAAW,WAAW;GACtC,IAAI,KAAK,WAAW,KAAK,aAAa,IAAI,SAAS,KAAK,OAAO,aAAa;IAC1E,MAAMA,iBAAAA,QAAG,GAAG,aAAa,EAAE,OAAO,KAAK,CAAC;IACxC,MAAM,IAAI,MAAM,8BAA8B;GAChD;GACA,MAAM,OAAO;IACX;IACA;IACA;IACA,WAAW;IACX,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;IACpC,MAAM;GACR;GACA,KAAK,WAAW,IAAI,YAAY,IAAI;GACpC,MAAM,KAAK,MAAM;GACjB,MAAMA,iBAAAA,QAAG,OAAO,MAAM;GACtB,MAAMA,iBAAAA,QAAG,MAAM,cAAc;GAC7B,OAAO;IACL,SAAS;IACT,UAAU;KAAE;KAAY,QAAQ;KAAS,WAAW;KAAQ,aAAa,KAAK;IAAY;GAC5F;EACF,QAAQ;GACN,KAAK,WAAW,OAAO,UAAU;GACjC,MAAMA,iBAAAA,QAAG,GAAG,WAAW,EAAE,OAAO,KAAK,CAAC;GACtC,MAAMA,iBAAAA,QAAG,GAAG,aAAa,EAAE,OAAO,KAAK,CAAC;GACxC,MAAM,IAAI,MAAM,iCAAiC;EACnD,UAAU;GACR,MAAM,QAAQ,MAAM;GACpB,MAAM,MAAM,MAAM;EACpB;CACF;CAEA,MAAM,cAAc,WAAkC;EACpD,KAAK,aAAa,IAAI,YAAY,KAAK,aAAa,IAAI,SAAS,KAAK,KAAK,CAAC;EAC5E,MAAM,QAAkB,CAAC;EACzB,KAAK,MAAM,CAAC,IAAI,SAAS,KAAK,YAAY;GACxC,IAAI,KAAK,cAAc,WAAW;GAClC,KAAK,WAAW,OAAO,EAAE;GACzB,MAAM,KAAK,KAAK,IAAI;EACtB;EACA,KAAK,MAAM,OAAO,KAAK,QAAQ,KAAK,GAAG,IAAI,IAAI,WAAW,GAAG,UAAU,GAAG,GAAG,KAAK,QAAQ,OAAO,GAAG;EACpG,MAAM,QAAQ,IAAI,MAAM,KAAK,SAASA,iBAAAA,QAAG,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC;CACrE;CAEA,MAAM,QAAuB;EAC3B,KAAK,SAAS;EACd,MAAM,QAAQ,WAAW,KAAK,QAAQ,OAAO,CAAC;EAC9C,KAAK,QAAQ,MAAM;EACnB,KAAK,WAAW,MAAM;EACtB,MAAMA,iBAAAA,QAAG,GAAG,KAAK,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CAC9D;CAEA,MAAM,KAAK,WAAmB,YAAoB,OAA8C;EAC9F,IAAI,KAAK,QAAQ,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;EAC1D,MAAM,KAAK,MAAM;EACjB,MAAM,OAAO,KAAK,WAAW,IAAI,UAAU;EAC3C,IAAI,CAAC,QAAQ,KAAK,cAAc,WAAW,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;EACpF,MAAM,QAAQ,uBAAuB,KAAK,SAAS,EAAE;EACrD,MAAM,QAAQ,OAAO,QAAQ,EAAE;EAC/B,MAAM,eAAe,OAAO,QAAQ,EAAE;EACtC,IACE,CAAC,SACD,CAAC,OAAO,cAAc,KAAK,KAC3B,CAAC,OAAO,cAAc,YAAY,KAClC,QAAQ,KACR,SAAS,KAAK,aACd,eAAe,SACf,eAAe,SAAS,aAExB,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;EAC3C,MAAM,MAAM,KAAK,IAAI,cAAc,KAAK,YAAY,CAAC;EACrD,MAAM,QAAQ,MAAMA,iBAAAA,QAAG,KAAK,KAAK,MAAMC,QAAAA,UAAU,WAAWA,QAAAA,UAAU,UAAU,CAAC,CAAC,YAAY,KAAA,CAAS;EACvG,IAAI,UAAU,KAAA,GAAW,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;EAClE,IAAI;GACF,MAAM,QAAQ,OAAO,MAAM,MAAM,QAAQ,CAAC;GAC1C,MAAM,EAAE,cAAc,MAAM,MAAM,KAAK,OAAO,GAAG,MAAM,QAAQ,KAAK;GACpE,IAAI,cAAc,MAAM,QAAQ,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;GACzE,OAAO,IAAI,SAAS,OAAO;IACzB,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,iBAAiB,SAAS,MAAM,GAAG,IAAI,GAAG,KAAK;KAC/C,iBAAiB;KACjB,iBAAiB;KACjB,kBAAkB,OAAO,MAAM,MAAM;IACvC;GACF,CAAC;EACH,UAAU;GACR,MAAM,MAAM,MAAM;EACpB;CACF;AACF"}