@kafca/agentdock 0.1.41 → 0.1.43

package/dist-electron/services/local-ai-core/src/acp/store/schema.js

@@ -0,0 +1,275 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureLocalCoreAcpSchema = ensureLocalCoreAcpSchema;
+function ensureLocalCoreAcpSchema(db) {
+    db.exec(`
+    PRAGMA foreign_keys = ON;
+    CREATE TABLE IF NOT EXISTS threads (
+      id TEXT PRIMARY KEY,
+      workspace_id TEXT NOT NULL,
+      session_id TEXT NOT NULL,
+      bridge_session_key TEXT NOT NULL,
+      title TEXT NOT NULL,
+      agent_type TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      history_count INTEGER NOT NULL DEFAULT 0,
+      excerpt TEXT NOT NULL DEFAULT '',
+      acp_session_id TEXT,
+      acp_supports_load INTEGER NOT NULL DEFAULT 0,
+      agent_mode TEXT NOT NULL DEFAULT 'default'
+    );
+    CREATE INDEX IF NOT EXISTS idx_threads_workspace_updated ON threads (workspace_id, updated_at DESC);
+    CREATE TABLE IF NOT EXISTS messages (
+      id TEXT PRIMARY KEY,
+      thread_id TEXT NOT NULL,
+      role TEXT NOT NULL,
+      content TEXT NOT NULL,
+      tool_call_json TEXT,
+      bridge_kind TEXT,
+      bridge_status TEXT,
+      timestamp TEXT NOT NULL,
+      kind TEXT NOT NULL,
+      seq INTEGER NOT NULL,
+      FOREIGN KEY (thread_id) REFERENCES threads(id) ON DELETE CASCADE
+    );
+    CREATE INDEX IF NOT EXISTS idx_messages_thread_seq ON messages (thread_id, seq ASC);
+    CREATE TABLE IF NOT EXISTS runs (
+      id TEXT PRIMARY KEY,
+      thread_id TEXT NOT NULL,
+      status TEXT NOT NULL,
+      started_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      FOREIGN KEY (thread_id) REFERENCES threads(id) ON DELETE CASCADE
+    );
+    CREATE INDEX IF NOT EXISTS idx_runs_thread_updated ON runs (thread_id, updated_at DESC);
+    CREATE TABLE IF NOT EXISTS platform_pairings (
+      code TEXT PRIMARY KEY,
+      workspace_id TEXT NOT NULL,
+      platform TEXT NOT NULL,
+      platform_user_id TEXT NOT NULL,
+      chat_id TEXT NOT NULL,
+      display_name TEXT NOT NULL,
+      requested_at TEXT NOT NULL,
+      expires_at TEXT NOT NULL,
+      status TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_platform_pairings_workspace_status ON platform_pairings (workspace_id, status, expires_at DESC);
+    CREATE TABLE IF NOT EXISTS platform_users (
+      id TEXT PRIMARY KEY,
+      workspace_id TEXT NOT NULL,
+      platform TEXT NOT NULL,
+      platform_user_id TEXT NOT NULL,
+      chat_id TEXT NOT NULL,
+      display_name TEXT NOT NULL,
+      thread_id TEXT,
+      authorized_at TEXT NOT NULL,
+      UNIQUE(workspace_id, platform, platform_user_id)
+    );
+    CREATE INDEX IF NOT EXISTS idx_platform_users_workspace_platform ON platform_users (workspace_id, platform);
+    CREATE TABLE IF NOT EXISTS platform_thread_bindings (
+      workspace_id TEXT NOT NULL,
+      platform TEXT NOT NULL,
+      chat_id TEXT NOT NULL,
+      platform_user_id TEXT NOT NULL,
+      thread_id TEXT NOT NULL,
+      last_platform_message_id TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      PRIMARY KEY (workspace_id, platform, chat_id, platform_user_id)
+    );
+    CREATE INDEX IF NOT EXISTS idx_platform_thread_bindings_thread ON platform_thread_bindings (thread_id);
+    CREATE TABLE IF NOT EXISTS scheduled_jobs (
+      id TEXT PRIMARY KEY,
+      workspace_id TEXT NOT NULL,
+      platform TEXT NOT NULL,
+      route_type TEXT NOT NULL,
+      route_config TEXT NOT NULL,
+      execution_mode TEXT NOT NULL DEFAULT 'same-thread',
+      trigger_type TEXT NOT NULL,
+      cron_expr TEXT,
+      run_at TEXT,
+      prompt_template TEXT NOT NULL,
+      description TEXT NOT NULL DEFAULT '',
+      enabled INTEGER NOT NULL DEFAULT 1,
+      concurrency_policy TEXT NOT NULL DEFAULT 'skip_if_running',
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      last_run_at TEXT,
+      last_status TEXT,
+      last_error TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_scheduled_jobs_workspace_updated ON scheduled_jobs (workspace_id, updated_at DESC);
+    CREATE INDEX IF NOT EXISTS idx_scheduled_jobs_enabled ON scheduled_jobs (enabled, trigger_type, run_at);
+    CREATE TABLE IF NOT EXISTS scheduled_job_runs (
+      id TEXT PRIMARY KEY,
+      job_id TEXT NOT NULL,
+      status TEXT NOT NULL,
+      triggered_at TEXT NOT NULL,
+      started_at TEXT,
+      finished_at TEXT,
+      error TEXT,
+      thread_id TEXT,
+      run_id TEXT,
+      platform_message_id TEXT,
+      platform_message_ids_json TEXT,
+      delivery_mode TEXT,
+      delivery_status TEXT,
+      delivery_error TEXT,
+      last_bridge_event_at TEXT,
+      FOREIGN KEY (job_id) REFERENCES scheduled_jobs(id) ON DELETE CASCADE
+    );
+    CREATE INDEX IF NOT EXISTS idx_scheduled_job_runs_job_triggered ON scheduled_job_runs (job_id, triggered_at DESC);
+    CREATE TABLE IF NOT EXISTS automation_monitors (
+      id TEXT PRIMARY KEY,
+      workspace_id TEXT NOT NULL,
+      title TEXT NOT NULL,
+      source_type TEXT NOT NULL,
+      source_config_json TEXT NOT NULL DEFAULT '{}',
+      condition_json TEXT NOT NULL,
+      prompt_template TEXT NOT NULL,
+      platform TEXT NOT NULL,
+      route_type TEXT NOT NULL,
+      route_config TEXT NOT NULL,
+      execution_mode TEXT NOT NULL DEFAULT 'side-thread',
+      enabled INTEGER NOT NULL DEFAULT 1,
+      cooldown_ms INTEGER NOT NULL DEFAULT 900000,
+      concurrency_policy TEXT NOT NULL DEFAULT 'skip_if_running',
+      last_state_json TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      last_triggered_at TEXT,
+      last_status TEXT,
+      last_error TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_automation_monitors_workspace_updated ON automation_monitors (workspace_id, updated_at DESC);
+    CREATE INDEX IF NOT EXISTS idx_automation_monitors_enabled ON automation_monitors (enabled, source_type);
+    CREATE TABLE IF NOT EXISTS automation_monitor_runs (
+      id TEXT PRIMARY KEY,
+      monitor_id TEXT NOT NULL,
+      status TEXT NOT NULL,
+      triggered_at TEXT NOT NULL,
+      started_at TEXT,
+      finished_at TEXT,
+      error TEXT,
+      event_snapshot_json TEXT,
+      thread_id TEXT,
+      run_id TEXT,
+      delivery_mode TEXT,
+      delivery_status TEXT,
+      delivery_error TEXT,
+      last_bridge_event_at TEXT,
+      FOREIGN KEY (monitor_id) REFERENCES automation_monitors(id) ON DELETE CASCADE
+    );
+    CREATE INDEX IF NOT EXISTS idx_automation_monitor_runs_monitor_triggered ON automation_monitor_runs (monitor_id, triggered_at DESC);
+    CREATE TABLE IF NOT EXISTS workspace_registry (
+      id TEXT PRIMARY KEY,
+      display_name TEXT NOT NULL,
+      path TEXT NOT NULL,
+      device_id TEXT NOT NULL,
+      default_runtime_id TEXT,
+      git_json TEXT NOT NULL DEFAULT '{}',
+      health_json TEXT NOT NULL DEFAULT '{}',
+      metadata_json TEXT NOT NULL DEFAULT '{}',
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      last_opened_at TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_workspace_registry_updated ON workspace_registry (updated_at DESC);
+    CREATE TABLE IF NOT EXISTS agent_tasks (
+      id TEXT PRIMARY KEY,
+      workspace_id TEXT NOT NULL,
+      device_id TEXT NOT NULL,
+      runtime_id TEXT NOT NULL,
+      thread_id TEXT,
+      run_id TEXT,
+      title TEXT NOT NULL,
+      prompt TEXT,
+      status TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      queued_at TEXT,
+      started_at TEXT,
+      completed_at TEXT,
+      summary TEXT,
+      error TEXT,
+      timeline_json TEXT NOT NULL DEFAULT '[]',
+      logs_json TEXT NOT NULL DEFAULT '[]',
+      artifacts_json TEXT NOT NULL DEFAULT '[]',
+      approval_ids_json TEXT NOT NULL DEFAULT '[]',
+      metadata_json TEXT NOT NULL DEFAULT '{}'
+    );
+    CREATE INDEX IF NOT EXISTS idx_agent_tasks_workspace_updated ON agent_tasks (workspace_id, updated_at DESC);
+    CREATE INDEX IF NOT EXISTS idx_agent_tasks_status_updated ON agent_tasks (status, updated_at DESC);
+    CREATE INDEX IF NOT EXISTS idx_agent_tasks_run ON agent_tasks (run_id);
+    CREATE TABLE IF NOT EXISTS workspace_security_settings (
+      workspace_id TEXT PRIMARY KEY,
+      permissions_json TEXT NOT NULL,
+      allow_paths_json TEXT NOT NULL DEFAULT '[]',
+      deny_paths_json TEXT NOT NULL DEFAULT '[]',
+      updated_at TEXT NOT NULL,
+      updated_by TEXT
+    );
+    CREATE TABLE IF NOT EXISTS approval_requests (
+      id TEXT PRIMARY KEY,
+      workspace_id TEXT NOT NULL,
+      task_id TEXT,
+      thread_id TEXT,
+      run_id TEXT,
+      device_id TEXT NOT NULL,
+      kind TEXT NOT NULL,
+      status TEXT NOT NULL,
+      risk_level TEXT NOT NULL,
+      title TEXT NOT NULL,
+      description TEXT NOT NULL,
+      requested_action TEXT NOT NULL,
+      command TEXT,
+      scopes_json TEXT NOT NULL DEFAULT '[]',
+      options_json TEXT NOT NULL DEFAULT '[]',
+      requested_by TEXT,
+      resolved_by TEXT,
+      resolution TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      resolved_at TEXT,
+      expires_at TEXT,
+      metadata_json TEXT NOT NULL DEFAULT '{}'
+    );
+    CREATE INDEX IF NOT EXISTS idx_approval_requests_workspace_updated ON approval_requests (workspace_id, updated_at DESC);
+    CREATE INDEX IF NOT EXISTS idx_approval_requests_status_updated ON approval_requests (status, updated_at DESC);
+    CREATE INDEX IF NOT EXISTS idx_approval_requests_task ON approval_requests (task_id);
+    CREATE INDEX IF NOT EXISTS idx_approval_requests_run ON approval_requests (run_id);
+    CREATE TABLE IF NOT EXISTS audit_events (
+      id TEXT PRIMARY KEY,
+      type TEXT NOT NULL,
+      workspace_id TEXT,
+      task_id TEXT,
+      approval_id TEXT,
+      actor TEXT,
+      summary TEXT NOT NULL,
+      risk_level TEXT,
+      created_at TEXT NOT NULL,
+      metadata_json TEXT NOT NULL DEFAULT '{}'
+    );
+    CREATE INDEX IF NOT EXISTS idx_audit_events_workspace_created ON audit_events (workspace_id, created_at DESC);
+    CREATE INDEX IF NOT EXISTS idx_audit_events_task_created ON audit_events (task_id, created_at DESC);
+    CREATE INDEX IF NOT EXISTS idx_audit_events_type_created ON audit_events (type, created_at DESC);
+  `);
+    ensureColumn(db, 'messages', 'tool_call_json', 'TEXT');
+    ensureColumn(db, 'messages', 'bridge_kind', 'TEXT');
+    ensureColumn(db, 'messages', 'bridge_status', 'TEXT');
+    ensureColumn(db, 'scheduled_jobs', 'execution_mode', "TEXT NOT NULL DEFAULT 'same-thread'");
+    ensureColumn(db, 'scheduled_job_runs', 'platform_message_ids_json', 'TEXT');
+    ensureColumn(db, 'scheduled_job_runs', 'delivery_mode', 'TEXT');
+    ensureColumn(db, 'scheduled_job_runs', 'delivery_status', 'TEXT');
+    ensureColumn(db, 'scheduled_job_runs', 'delivery_error', 'TEXT');
+    ensureColumn(db, 'scheduled_job_runs', 'last_bridge_event_at', 'TEXT');
+    ensureColumn(db, 'threads', 'agent_mode', "TEXT NOT NULL DEFAULT 'default'");
+}
+function ensureColumn(db, table, column, definition) {
+    const rows = db.prepare(`PRAGMA table_info(${table})`).all();
+    if (rows.some((row) => row.name === column)) {
+        return;
+    }
+    db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
+}

package/dist-electron/services/local-ai-core/src/acp/store/security-store.js

@@ -0,0 +1,266 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalSecurityStore = void 0;
+const node_crypto_1 = require("node:crypto");
+const index_js_1 = require("../../../../../packages/contracts/src/index.js");
+const utils_js_1 = require("./utils.js");
+class LocalSecurityStore {
+    db;
+    updateAgentTask;
+    constructor(db, updateAgentTask) {
+        this.db = db;
+        this.updateAgentTask = updateAgentTask;
+    }
+    getWorkspaceSecuritySettings(workspaceId) {
+        const row = this.db.prepare(`
+      SELECT workspace_id, permissions_json, allow_paths_json, deny_paths_json, updated_at, updated_by
+      FROM workspace_security_settings
+      WHERE workspace_id = ?
+    `).get(workspaceId);
+        if (row) {
+            return this.toWorkspaceSecuritySettings(row);
+        }
+        const now = new Date().toISOString();
+        return {
+            workspaceId,
+            permissions: (0, utils_js_1.defaultPermissions)(),
+            allowPaths: [],
+            denyPaths: [],
+            updatedAt: now,
+        };
+    }
+    updateWorkspaceSecuritySettings(workspaceId, input) {
+        const existing = this.getWorkspaceSecuritySettings(workspaceId);
+        const now = new Date().toISOString();
+        const next = {
+            workspaceId,
+            permissions: {
+                ...existing.permissions,
+                ...(input.permissions || {}),
+            },
+            allowPaths: Array.isArray(input.allowPaths) ? input.allowPaths : existing.allowPaths,
+            denyPaths: Array.isArray(input.denyPaths) ? input.denyPaths : existing.denyPaths,
+            updatedAt: now,
+            updatedBy: input.updatedBy || existing.updatedBy,
+        };
+        this.db.prepare(`
+      INSERT INTO workspace_security_settings (workspace_id, permissions_json, allow_paths_json, deny_paths_json, updated_at, updated_by)
+      VALUES (?, ?, ?, ?, ?, ?)
+      ON CONFLICT(workspace_id) DO UPDATE SET
+        permissions_json = excluded.permissions_json,
+        allow_paths_json = excluded.allow_paths_json,
+        deny_paths_json = excluded.deny_paths_json,
+        updated_at = excluded.updated_at,
+        updated_by = excluded.updated_by
+    `).run(workspaceId, JSON.stringify(next.permissions), JSON.stringify(next.allowPaths), JSON.stringify(next.denyPaths), now, next.updatedBy || null);
+        this.createAuditEvent({
+            type: 'permission.changed',
+            workspaceId,
+            actor: next.updatedBy || 'local',
+            summary: 'Workspace security settings changed.',
+            metadata: {
+                permissions: next.permissions,
+                allowPaths: next.allowPaths,
+                denyPaths: next.denyPaths,
+            },
+        });
+        return this.getWorkspaceSecuritySettings(workspaceId);
+    }
+    createApprovalRequest(input) {
+        const id = `approval:${(0, node_crypto_1.randomUUID)()}`;
+        const now = new Date().toISOString();
+        this.db.prepare(`
+      INSERT INTO approval_requests (
+        id, workspace_id, task_id, thread_id, run_id, device_id, kind, status, risk_level, title, description,
+        requested_action, command, scopes_json, options_json, requested_by, created_at, updated_at, expires_at, metadata_json
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(id, input.workspaceId, input.taskId || null, input.threadId || null, input.runId || null, input.deviceId || 'local', input.kind, input.riskLevel, input.title, (0, utils_js_1.redactSecrets)(input.description), (0, utils_js_1.redactSecrets)(input.requestedAction), input.command ? (0, utils_js_1.redactSecrets)(input.command) : null, JSON.stringify(input.scopes || []), JSON.stringify(input.options || []), input.requestedBy || null, now, now, input.expiresAt || null, JSON.stringify(input.metadata || {}));
+        const approval = this.getApprovalRequest(id);
+        this.createAuditEvent({
+            type: 'approval.requested',
+            workspaceId: approval.workspaceId,
+            taskId: approval.taskId,
+            approvalId: approval.approvalId,
+            actor: approval.requestedBy || 'agent',
+            summary: approval.title,
+            riskLevel: approval.riskLevel,
+            metadata: {
+                kind: approval.kind,
+                requestedAction: approval.requestedAction,
+                scopes: approval.scopes,
+            },
+        });
+        if (approval.taskId) {
+            this.updateAgentTask(approval.taskId, {
+                approvalId: approval.approvalId,
+                timelineItem: {
+                    type: 'approval_requested',
+                    title: approval.title,
+                    description: approval.description,
+                    metadata: { approvalId: approval.approvalId, riskLevel: approval.riskLevel },
+                },
+            });
+        }
+        return approval;
+    }
+    listApprovalRequests(query = {}) {
+        const predicates = [];
+        const params = [];
+        if (query.workspaceId) {
+            predicates.push('workspace_id = ?');
+            params.push(query.workspaceId);
+        }
+        if (query.taskId) {
+            predicates.push('task_id = ?');
+            params.push(query.taskId);
+        }
+        if (query.status) {
+            const statuses = (Array.isArray(query.status) ? query.status : [query.status]).map((status) => (0, index_js_1.normalizeApprovalRequestStatus)(status));
+            predicates.push(`status IN (${statuses.map(() => '?').join(', ')})`);
+            params.push(...statuses);
+        }
+        const limit = Math.max(1, Math.min(Number(query.limit || 50), 100));
+        const where = predicates.length ? `WHERE ${predicates.join(' AND ')}` : '';
+        const rows = this.db.prepare(`
+      SELECT *
+      FROM approval_requests
+      ${where}
+      ORDER BY updated_at DESC
+      LIMIT ?
+    `).all(...params, limit);
+        return { approvals: rows.map((row) => this.toApprovalRequest(row)) };
+    }
+    getApprovalRequest(approvalId) {
+        const row = this.db.prepare('SELECT * FROM approval_requests WHERE id = ?').get(approvalId);
+        return row ? this.toApprovalRequest(row) : undefined;
+    }
+    resolveApprovalRequest(approvalId, input) {
+        const existing = this.getApprovalRequest(approvalId);
+        if (!existing) {
+            throw new Error(`Approval not found: ${approvalId}`);
+        }
+        const now = new Date().toISOString();
+        this.db.prepare(`
+      UPDATE approval_requests
+      SET status = ?, resolved_by = ?, resolution = ?, resolved_at = ?, updated_at = ?
+      WHERE id = ?
+    `).run(input.status, input.resolvedBy || existing.resolvedBy || 'local', input.resolution || existing.resolution || null, now, now, approvalId);
+        const approval = this.getApprovalRequest(approvalId);
+        this.createAuditEvent({
+            type: input.status === 'rejected' ? 'approval.rejected' : 'approval.resolved',
+            workspaceId: approval.workspaceId,
+            taskId: approval.taskId,
+            approvalId: approval.approvalId,
+            actor: approval.resolvedBy || 'local',
+            summary: `Approval ${input.status}: ${approval.title}`,
+            riskLevel: approval.riskLevel,
+            metadata: { resolution: approval.resolution },
+        });
+        if (approval.taskId) {
+            this.updateAgentTask(approval.taskId, {
+                timelineItem: {
+                    type: 'approval_resolved',
+                    title: `Approval ${input.status}`,
+                    description: approval.resolution || approval.title,
+                    metadata: { approvalId: approval.approvalId, status: input.status },
+                },
+            });
+        }
+        return approval;
+    }
+    createAuditEvent(input) {
+        const id = `audit:${(0, node_crypto_1.randomUUID)()}`;
+        const now = new Date().toISOString();
+        this.db.prepare(`
+      INSERT INTO audit_events (id, type, workspace_id, task_id, approval_id, actor, summary, risk_level, created_at, metadata_json)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(id, input.type, input.workspaceId || null, input.taskId || null, input.approvalId || null, input.actor || null, (0, utils_js_1.redactSecrets)(input.summary), input.riskLevel || null, now, JSON.stringify(input.metadata || {}));
+        return this.toAuditEvent(this.db.prepare('SELECT * FROM audit_events WHERE id = ?').get(id));
+    }
+    listAuditEvents(query = {}) {
+        const predicates = [];
+        const params = [];
+        if (query.workspaceId) {
+            predicates.push('workspace_id = ?');
+            params.push(query.workspaceId);
+        }
+        if (query.taskId) {
+            predicates.push('task_id = ?');
+            params.push(query.taskId);
+        }
+        if (query.approvalId) {
+            predicates.push('approval_id = ?');
+            params.push(query.approvalId);
+        }
+        if (query.type) {
+            const types = Array.isArray(query.type) ? query.type : [query.type];
+            predicates.push(`type IN (${types.map(() => '?').join(', ')})`);
+            params.push(...types);
+        }
+        const limit = Math.max(1, Math.min(Number(query.limit || 50), 100));
+        const where = predicates.length ? `WHERE ${predicates.join(' AND ')}` : '';
+        const rows = this.db.prepare(`
+      SELECT *
+      FROM audit_events
+      ${where}
+      ORDER BY created_at DESC
+      LIMIT ?
+    `).all(...params, limit);
+        return { events: rows.map((row) => this.toAuditEvent(row)) };
+    }
+    toWorkspaceSecuritySettings(row) {
+        return {
+            workspaceId: row.workspace_id,
+            permissions: {
+                ...(0, utils_js_1.defaultPermissions)(),
+                ...(0, utils_js_1.parseJson)(row.permissions_json, {}),
+            },
+            allowPaths: (0, utils_js_1.parseJson)(row.allow_paths_json, []),
+            denyPaths: (0, utils_js_1.parseJson)(row.deny_paths_json, []),
+            updatedAt: row.updated_at,
+            updatedBy: row.updated_by || undefined,
+        };
+    }
+    toApprovalRequest(row) {
+        return {
+            approvalId: row.id,
+            workspaceId: row.workspace_id,
+            taskId: row.task_id || undefined,
+            threadId: row.thread_id || undefined,
+            runId: row.run_id || undefined,
+            deviceId: row.device_id,
+            kind: row.kind,
+            status: (0, index_js_1.normalizeApprovalRequestStatus)(row.status),
+            riskLevel: row.risk_level,
+            title: row.title,
+            description: row.description,
+            requestedAction: row.requested_action,
+            command: row.command || undefined,
+            scopes: (0, utils_js_1.parseJson)(row.scopes_json, []),
+            options: (0, utils_js_1.parseJson)(row.options_json, []),
+            requestedBy: row.requested_by || undefined,
+            resolvedBy: row.resolved_by || undefined,
+            resolution: row.resolution || undefined,
+            createdAt: row.created_at,
+            updatedAt: row.updated_at,
+            resolvedAt: row.resolved_at || undefined,
+            expiresAt: row.expires_at || undefined,
+            metadata: (0, utils_js_1.parseJson)(row.metadata_json, {}),
+        };
+    }
+    toAuditEvent(row) {
+        return {
+            auditId: row.id,
+            type: row.type,
+            workspaceId: row.workspace_id || undefined,
+            taskId: row.task_id || undefined,
+            approvalId: row.approval_id || undefined,
+            actor: row.actor || undefined,
+            summary: row.summary,
+            riskLevel: row.risk_level || undefined,
+            createdAt: row.created_at,
+            metadata: (0, utils_js_1.parseJson)(row.metadata_json, {}),
+        };
+    }
+}
+exports.LocalSecurityStore = LocalSecurityStore;