@oneuptime/common 14.0.1 → 14.0.2

package/build/dist/Server/Utils/Workspace/WorkspaceReactionNote.js

@@ -0,0 +1,450 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import AlertEpisodeInternalNote from "../../../Models/DatabaseModels/AlertEpisodeInternalNote";
+import AlertInternalNote from "../../../Models/DatabaseModels/AlertInternalNote";
+import IncidentEpisodeInternalNote from "../../../Models/DatabaseModels/IncidentEpisodeInternalNote";
+import IncidentInternalNote from "../../../Models/DatabaseModels/IncidentInternalNote";
+import IncidentPublicNote from "../../../Models/DatabaseModels/IncidentPublicNote";
+import ScheduledMaintenanceInternalNote from "../../../Models/DatabaseModels/ScheduledMaintenanceInternalNote";
+import ScheduledMaintenancePublicNote from "../../../Models/DatabaseModels/ScheduledMaintenancePublicNote";
+import SortOrder from "../../../Types/BaseDatabase/SortOrder";
+import ObjectID from "../../../Types/ObjectID";
+import { WorkspaceNoteType } from "../../../Types/Workspace/WorkspaceNoteReaction";
+import AlertEpisodeInternalNoteService from "../../Services/AlertEpisodeInternalNoteService";
+import AlertEpisodeService from "../../Services/AlertEpisodeService";
+import AlertInternalNoteService from "../../Services/AlertInternalNoteService";
+import AlertService from "../../Services/AlertService";
+import IncidentEpisodeInternalNoteService from "../../Services/IncidentEpisodeInternalNoteService";
+import IncidentEpisodeService from "../../Services/IncidentEpisodeService";
+import IncidentInternalNoteService from "../../Services/IncidentInternalNoteService";
+import IncidentPublicNoteService from "../../Services/IncidentPublicNoteService";
+import IncidentService from "../../Services/IncidentService";
+import ScheduledMaintenanceInternalNoteService from "../../Services/ScheduledMaintenanceInternalNoteService";
+import ScheduledMaintenancePublicNoteService from "../../Services/ScheduledMaintenancePublicNoteService";
+import ScheduledMaintenanceService from "../../Services/ScheduledMaintenanceService";
+import WorkspaceNotificationLogService from "../../Services/WorkspaceNotificationLogService";
+import QueryHelper from "../../Types/Database/QueryHelper";
+import CaptureSpan from "../Telemetry/CaptureSpan";
+export var WorkspaceNoteResourceType;
+(function (WorkspaceNoteResourceType) {
+    WorkspaceNoteResourceType["Incident"] = "Incident";
+    WorkspaceNoteResourceType["Alert"] = "Alert";
+    WorkspaceNoteResourceType["ScheduledMaintenance"] = "ScheduledMaintenance";
+    WorkspaceNoteResourceType["IncidentEpisode"] = "IncidentEpisode";
+    WorkspaceNoteResourceType["AlertEpisode"] = "AlertEpisode";
+})(WorkspaceNoteResourceType || (WorkspaceNoteResourceType = {}));
+export var WorkspaceNoteSaveResult;
+(function (WorkspaceNoteSaveResult) {
+    WorkspaceNoteSaveResult["Saved"] = "Saved";
+    // A note was already saved from this message.
+    WorkspaceNoteSaveResult["Duplicate"] = "Duplicate";
+})(WorkspaceNoteSaveResult || (WorkspaceNoteSaveResult = {}));
+const RESOURCE_TYPES = {
+    [WorkspaceNoteResourceType.Incident]: {
+        service: () => {
+            return IncidentService;
+        },
+        logColumn: "incidentId",
+        noun: "incident",
+        label: "Incident",
+    },
+    [WorkspaceNoteResourceType.Alert]: {
+        service: () => {
+            return AlertService;
+        },
+        logColumn: "alertId",
+        noun: "alert",
+        label: "Alert",
+    },
+    [WorkspaceNoteResourceType.ScheduledMaintenance]: {
+        service: () => {
+            return ScheduledMaintenanceService;
+        },
+        logColumn: "scheduledMaintenanceId",
+        noun: "scheduled maintenance",
+        label: "Scheduled Maintenance",
+    },
+    [WorkspaceNoteResourceType.IncidentEpisode]: {
+        service: () => {
+            return IncidentEpisodeService;
+        },
+        logColumn: "incidentEpisodeId",
+        noun: "incident episode",
+        label: "Incident Episode",
+    },
+    [WorkspaceNoteResourceType.AlertEpisode]: {
+        service: () => {
+            return AlertEpisodeService;
+        },
+        logColumn: "alertEpisodeId",
+        noun: "alert episode",
+        label: "Alert Episode",
+    },
+};
+/*
+ * Saves a chat message as a note when someone reacts to it with a note emoji
+ * (see WorkspaceNoteReactionUtil). The Slack and Microsoft Teams integrations
+ * both come through here; they differ only in how they learn about the
+ * reaction and read the message.
+ */
+export default class WorkspaceReactionNote {
+    static getAllResourceTypes() {
+        return Object.values(WorkspaceNoteResourceType);
+    }
+    // Public notes are posted to status pages, which only incidents and scheduled maintenance have.
+    static supportsNoteType(resourceType, noteType) {
+        if (noteType === WorkspaceNoteType.Private) {
+            return true;
+        }
+        return (resourceType === WorkspaceNoteResourceType.Incident ||
+            resourceType === WorkspaceNoteResourceType.ScheduledMaintenance);
+    }
+    // The row the note writes, which is what the user must be allowed to create.
+    static getNoteModelType(resourceType, noteType) {
+        const isPublic = noteType === WorkspaceNoteType.Public;
+        switch (resourceType) {
+            case WorkspaceNoteResourceType.Incident:
+                return isPublic ? IncidentPublicNote : IncidentInternalNote;
+            case WorkspaceNoteResourceType.ScheduledMaintenance:
+                return isPublic
+                    ? ScheduledMaintenancePublicNote
+                    : ScheduledMaintenanceInternalNote;
+            case WorkspaceNoteResourceType.Alert:
+                return AlertInternalNote;
+            case WorkspaceNoteResourceType.IncidentEpisode:
+                return IncidentEpisodeInternalNote;
+            case WorkspaceNoteResourceType.AlertEpisode:
+                return AlertEpisodeInternalNote;
+        }
+    }
+    static getResourceService(resourceType) {
+        return RESOURCE_TYPES[resourceType].service();
+    }
+    // Completes "You do not have permission to ...".
+    static getAuthorizationAction(resourceType, noteType) {
+        return `add a ${noteType} note to this ${RESOURCE_TYPES[resourceType].noun}`;
+    }
+    /*
+     * Identifies the chat message a note came from, so reacting twice (or two
+     * people reacting) saves it once. Stored in the notes' postedFromSlackMessageId
+     * column, which despite its name holds Teams messages as well.
+     */
+    static getSourceMessageKey(data) {
+        return `${data.channelId}:${data.messageId}`;
+    }
+    /*
+     * The resource a channel belongs to, most specific evidence first:
+     *
+     *   1. a resource that lists the channel in postUpdatesToWorkspaceChannels,
+     *      i.e. the channel OneUptime created for that incident / alert / ...,
+     *   2. the resource whose notification is the reacted-to message,
+     *   3. the resource OneUptime most recently posted about in the channel.
+     *
+     * This used to be (3) alone, which broke three ways: notification logs are
+     * hard-deleted after a few days on OneUptime Cloud, so a reaction in a quiet
+     * channel found nothing; episode messages are never logged with their
+     * episode, so episode reactions never worked; and with no sort order the row
+     * picked in a shared channel was arbitrary.
+     */
+    static async resolveResourceForChannel(data) {
+        if (!data.channelId || data.projectIds.length === 0) {
+            return null;
+        }
+        const resourceTypes = data.resourceTypes && data.resourceTypes.length > 0
+            ? data.resourceTypes
+            : this.getAllResourceTypes();
+        const projectIdQuery = data.projectIds.length === 1
+            ? data.projectIds[0]
+            : QueryHelper.any(data.projectIds);
+        const fromChannel = await this.findResourceOwningChannel({
+            projectIdQuery: projectIdQuery,
+            channelId: data.channelId,
+            resourceTypes: resourceTypes,
+        });
+        if (fromChannel) {
+            return fromChannel;
+        }
+        if (data.messageId) {
+            const fromMessage = await this.findResourceFromLogs({
+                projectIdQuery: projectIdQuery,
+                workspaceType: data.workspaceType,
+                channelId: data.channelId,
+                threadId: data.messageId,
+                resourceTypes: resourceTypes,
+            });
+            if (fromMessage) {
+                return fromMessage;
+            }
+        }
+        return await this.findResourceFromLogs({
+            projectIdQuery: projectIdQuery,
+            workspaceType: data.workspaceType,
+            channelId: data.channelId,
+            resourceTypes: resourceTypes,
+        });
+    }
+    static async findResourceOwningChannel(data) {
+        let newest = null;
+        for (const resourceType of data.resourceTypes) {
+            const row = await this.getResourceService(resourceType).findOneBy({
+                query: {
+                    projectId: data.projectIdQuery,
+                    postUpdatesToWorkspaceChannels: QueryHelper.jsonContains([
+                        { id: data.channelId },
+                    ]),
+                },
+                select: {
+                    _id: true,
+                    projectId: true,
+                    createdAt: true,
+                },
+                sort: {
+                    createdAt: SortOrder.Descending,
+                },
+                props: {
+                    isRoot: true,
+                },
+            });
+            if (!row || !row.id || !row.projectId) {
+                continue;
+            }
+            const createdAt = row.createdAt
+                ? new Date(row.createdAt).getTime()
+                : 0;
+            if (!newest || createdAt > newest.createdAt) {
+                newest = {
+                    resource: {
+                        resourceType: resourceType,
+                        resourceId: row.id,
+                        projectId: row.projectId,
+                    },
+                    createdAt: createdAt,
+                };
+            }
+        }
+        return newest ? newest.resource : null;
+    }
+    static async findResourceFromLogs(data) {
+        let newest = null;
+        for (const resourceType of data.resourceTypes) {
+            const logColumn = RESOURCE_TYPES[resourceType].logColumn;
+            const query = {
+                projectId: data.projectIdQuery,
+                workspaceType: data.workspaceType,
+                channelId: data.channelId,
+                [logColumn]: QueryHelper.notNull(),
+            };
+            if (data.threadId) {
+                query.threadId = data.threadId;
+            }
+            const log = await WorkspaceNotificationLogService.findOneBy({
+                query: query,
+                select: {
+                    _id: true,
+                    projectId: true,
+                    createdAt: true,
+                    [logColumn]: true,
+                },
+                sort: {
+                    createdAt: SortOrder.Descending,
+                },
+                props: {
+                    isRoot: true,
+                },
+            });
+            const resourceId = log === null || log === void 0 ? void 0 : log[logColumn];
+            if (!log || !resourceId || !log.projectId) {
+                continue;
+            }
+            const createdAt = log.createdAt
+                ? new Date(log.createdAt).getTime()
+                : 0;
+            if (!newest || createdAt > newest.createdAt) {
+                newest = {
+                    resource: {
+                        resourceType: resourceType,
+                        resourceId: new ObjectID(resourceId.toString()),
+                        projectId: log.projectId,
+                    },
+                    createdAt: createdAt,
+                };
+            }
+        }
+        return newest ? newest.resource : null;
+    }
+    /*
+     * Saves the note unless one was already saved from the same message. The
+     * caller must have authorized the user (see getNoteModelType) and checked
+     * supportsNoteType.
+     */
+    static async saveNote(data) {
+        if (!this.supportsNoteType(data.resource.resourceType, data.noteType)) {
+            throw new Error(`${RESOURCE_TYPES[data.resource.resourceType].label} does not support ${data.noteType} notes.`);
+        }
+        if (await this.hasNote({
+            resource: data.resource,
+            noteType: data.noteType,
+            sourceMessageKey: data.sourceMessageKey,
+        })) {
+            return WorkspaceNoteSaveResult.Duplicate;
+        }
+        await this.addNote(data);
+        return WorkspaceNoteSaveResult.Saved;
+    }
+    // Whether a note of this type was already saved from the message.
+    static async hasNote(data) {
+        const id = data.resource.resourceId;
+        const postedFromSlackMessageId = data.sourceMessageKey;
+        const isPublic = data.noteType === WorkspaceNoteType.Public;
+        switch (data.resource.resourceType) {
+            case WorkspaceNoteResourceType.Incident:
+                return await (isPublic ? IncidentPublicNoteService : IncidentInternalNoteService).hasNoteFromSlackMessage({
+                    incidentId: id,
+                    postedFromSlackMessageId: postedFromSlackMessageId,
+                });
+            case WorkspaceNoteResourceType.ScheduledMaintenance:
+                return await (isPublic
+                    ? ScheduledMaintenancePublicNoteService
+                    : ScheduledMaintenanceInternalNoteService).hasNoteFromSlackMessage({
+                    scheduledMaintenanceId: id,
+                    postedFromSlackMessageId: postedFromSlackMessageId,
+                });
+            case WorkspaceNoteResourceType.Alert:
+                return await AlertInternalNoteService.hasNoteFromSlackMessage({
+                    alertId: id,
+                    postedFromSlackMessageId: postedFromSlackMessageId,
+                });
+            case WorkspaceNoteResourceType.IncidentEpisode:
+                return await IncidentEpisodeInternalNoteService.hasNoteFromSlackMessage({
+                    incidentEpisodeId: id,
+                    postedFromSlackMessageId: postedFromSlackMessageId,
+                });
+            case WorkspaceNoteResourceType.AlertEpisode:
+                return await AlertEpisodeInternalNoteService.hasNoteFromSlackMessage({
+                    alertEpisodeId: id,
+                    postedFromSlackMessageId: postedFromSlackMessageId,
+                });
+        }
+    }
+    static async addNote(data) {
+        const id = data.resource.resourceId;
+        const isPublic = data.noteType === WorkspaceNoteType.Public;
+        const common = {
+            projectId: data.resource.projectId,
+            userId: data.userId,
+            note: data.note,
+            postedFromSlackMessageId: data.sourceMessageKey,
+        };
+        switch (data.resource.resourceType) {
+            case WorkspaceNoteResourceType.Incident:
+                await (isPublic ? IncidentPublicNoteService : IncidentInternalNoteService).addNote(Object.assign(Object.assign({}, common), { incidentId: id }));
+                return;
+            case WorkspaceNoteResourceType.ScheduledMaintenance:
+                await (isPublic
+                    ? ScheduledMaintenancePublicNoteService
+                    : ScheduledMaintenanceInternalNoteService).addNote(Object.assign(Object.assign({}, common), { scheduledMaintenanceId: id }));
+                return;
+            case WorkspaceNoteResourceType.Alert:
+                await AlertInternalNoteService.addNote(Object.assign(Object.assign({}, common), { alertId: id }));
+                return;
+            case WorkspaceNoteResourceType.IncidentEpisode:
+                await IncidentEpisodeInternalNoteService.addNote(Object.assign(Object.assign({}, common), { incidentEpisodeId: id }));
+                return;
+            case WorkspaceNoteResourceType.AlertEpisode:
+                await AlertEpisodeInternalNoteService.addNote(Object.assign(Object.assign({}, common), { alertEpisodeId: id }));
+                return;
+        }
+    }
+    // "Incident #42" and its dashboard link, for the confirmation reply.
+    static async getResourceDisplay(resource) {
+        const { projectId, resourceId } = resource;
+        const label = RESOURCE_TYPES[resource.resourceType].label;
+        let numberResult;
+        let link;
+        switch (resource.resourceType) {
+            case WorkspaceNoteResourceType.Incident:
+                numberResult = await IncidentService.getIncidentNumber({
+                    incidentId: resourceId,
+                });
+                link = await IncidentService.getIncidentLinkInDashboard(projectId, resourceId);
+                break;
+            case WorkspaceNoteResourceType.Alert:
+                numberResult = await AlertService.getAlertNumber({
+                    alertId: resourceId,
+                });
+                link = await AlertService.getAlertLinkInDashboard(projectId, resourceId);
+                break;
+            case WorkspaceNoteResourceType.ScheduledMaintenance:
+                numberResult =
+                    await ScheduledMaintenanceService.getScheduledMaintenanceNumber({
+                        scheduledMaintenanceId: resourceId,
+                    });
+                link =
+                    await ScheduledMaintenanceService.getScheduledMaintenanceLinkInDashboard(projectId, resourceId);
+                break;
+            case WorkspaceNoteResourceType.IncidentEpisode:
+                numberResult = await IncidentEpisodeService.getEpisodeNumber({
+                    episodeId: resourceId,
+                });
+                link = await IncidentEpisodeService.getEpisodeLinkInDashboard(projectId, resourceId);
+                break;
+            case WorkspaceNoteResourceType.AlertEpisode:
+                numberResult = await AlertEpisodeService.getEpisodeNumber({
+                    episodeId: resourceId,
+                });
+                link = await AlertEpisodeService.getEpisodeLinkInDashboard(projectId, resourceId);
+                break;
+        }
+        const numberDisplay = numberResult.numberWithPrefix ||
+            (numberResult.number !== null && numberResult.number !== undefined
+                ? `#${numberResult.number}`
+                : "");
+        return {
+            label: numberDisplay ? `${label} ${numberDisplay}` : label,
+            link: link,
+        };
+    }
+    /*
+     * The confirmation posted in the message's thread. `formatLink` renders a
+     * link in the workspace's own syntax.
+     */
+    static getConfirmationMessage(data) {
+        const link = data.formatLink(data.resourceLink, data.resourceLabel);
+        if (data.noteType === WorkspaceNoteType.Public) {
+            return `✅ Message saved as ${data.formatBold("public note")} to ${link}. This note will be visible on the status page.`;
+        }
+        return `✅ Message saved as ${data.formatBold("private note")} to ${link}.`;
+    }
+}
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], WorkspaceReactionNote, "resolveResourceForChannel", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], WorkspaceReactionNote, "saveNote", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], WorkspaceReactionNote, "hasNote", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], WorkspaceReactionNote, "getResourceDisplay", null);
+//# sourceMappingURL=WorkspaceReactionNote.js.map

package/build/dist/Server/Utils/Workspace/WorkspaceReactionNote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkspaceReactionNote.js","sourceRoot":"","sources":["../../../../../Server/Utils/Workspace/WorkspaceReactionNote.ts"],"names":[],"mappings":";;;;;;;;;AAGA,OAAO,wBAAwB,MAAM,yDAAyD,CAAC;AAC/F,OAAO,iBAAiB,MAAM,kDAAkD,CAAC;AAGjF,OAAO,2BAA2B,MAAM,4DAA4D,CAAC;AACrG,OAAO,oBAAoB,MAAM,qDAAqD,CAAC;AACvF,OAAO,kBAAkB,MAAM,mDAAmD,CAAC;AAEnF,OAAO,gCAAgC,MAAM,iEAAiE,CAAC;AAC/G,OAAO,8BAA8B,MAAM,+DAA+D,CAAC;AAG3G,OAAO,SAAS,MAAM,uCAAuC,CAAC;AAC9D,OAAO,QAAQ,MAAM,yBAAyB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gDAAgD,CAAC;AAEnF,OAAO,+BAA+B,MAAM,gDAAgD,CAAC;AAC7F,OAAO,mBAAmB,MAAM,oCAAoC,CAAC;AACrE,OAAO,wBAAwB,MAAM,yCAAyC,CAAC;AAC/E,OAAO,YAAY,MAAM,6BAA6B,CAAC;AAEvD,OAAO,kCAAkC,MAAM,mDAAmD,CAAC;AACnG,OAAO,sBAAsB,MAAM,uCAAuC,CAAC;AAC3E,OAAO,2BAA2B,MAAM,4CAA4C,CAAC;AACrF,OAAO,yBAAyB,MAAM,0CAA0C,CAAC;AACjF,OAAO,eAAe,MAAM,gCAAgC,CAAC;AAC7D,OAAO,uCAAuC,MAAM,wDAAwD,CAAC;AAC7G,OAAO,qCAAqC,MAAM,sDAAsD,CAAC;AACzG,OAAO,2BAA2B,MAAM,4CAA4C,CAAC;AACrF,OAAO,+BAA+B,MAAM,gDAAgD,CAAC;AAC7F,OAAO,WAAW,MAAM,kCAAkC,CAAC;AAE3D,OAAO,WAAW,MAAM,0BAA0B,CAAC;AAEnD,MAAM,CAAN,IAAY,yBAMX;AAND,WAAY,yBAAyB;IACnC,kDAAqB,CAAA;IACrB,4CAAe,CAAA;IACf,0EAA6C,CAAA;IAC7C,gEAAmC,CAAA;IACnC,0DAA6B,CAAA;AAC/B,CAAC,EANW,yBAAyB,KAAzB,yBAAyB,QAMpC;AASD,MAAM,CAAN,IAAY,uBAIX;AAJD,WAAY,uBAAuB;IACjC,0CAAe,CAAA;IACf,8CAA8C;IAC9C,kDAAuB,CAAA;AACzB,CAAC,EAJW,uBAAuB,KAAvB,uBAAuB,QAIlC;AAgBD,MAAM,cAAc,GAGhB;IACF,CAAC,yBAAyB,CAAC,QAAQ,CAAC,EAAE;QACpC,OAAO,EAAE,GAAoB,EAAE;YAC7B,OAAO,eAA6C,CAAC;QACvD,CAAC;QACD,SAAS,EAAE,YAAY;QACvB,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,UAAU;KAClB;IACD,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE;QACjC,OAAO,EAAE,GAAoB,EAAE;YAC7B,OAAO,YAA0C,CAAC;QACpD,CAAC;QACD,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,OAAO;KACf;IACD,CAAC,yBAAyB,CAAC,oBAAoB,CAAC,EAAE;QAChD,OAAO,EAAE,GAAoB,EAAE;YAC7B,OAAO,2BAAyD,CAAC;QACnE,CAAC;QACD,SAAS,EAAE,wBAAwB;QACnC,IAAI,EAAE,uBAAuB;QAC7B,KAAK,EAAE,uBAAuB;KAC/B;IACD,CAAC,yBAAyB,CAAC,eAAe,CAAC,EAAE;QAC3C,OAAO,EAAE,GAAoB,EAAE;YAC7B,OAAO,sBAAoD,CAAC;QAC9D,CAAC;QACD,SAAS,EAAE,mBAAmB;QAC9B,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,kBAAkB;KAC1B;IACD,CAAC,yBAAyB,CAAC,YAAY,CAAC,EAAE;QACxC,OAAO,EAAE,GAAoB,EAAE;YAC7B,OAAO,mBAAiD,CAAC;QAC3D,CAAC;QACD,SAAS,EAAE,gBAAgB;QAC3B,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,eAAe;KACvB;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,OAAO,OAAO,qBAAqB;IACjC,MAAM,CAAC,mBAAmB;QAC/B,OAAO,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAClD,CAAC;IAED,gGAAgG;IACzF,MAAM,CAAC,gBAAgB,CAC5B,YAAuC,EACvC,QAA2B;QAE3B,IAAI,QAAQ,KAAK,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,CACL,YAAY,KAAK,yBAAyB,CAAC,QAAQ;YACnD,YAAY,KAAK,yBAAyB,CAAC,oBAAoB,CAChE,CAAC;IACJ,CAAC;IAED,6EAA6E;IACtE,MAAM,CAAC,gBAAgB,CAC5B,YAAuC,EACvC,QAA2B;QAE3B,MAAM,QAAQ,GAAY,QAAQ,KAAK,iBAAiB,CAAC,MAAM,CAAC;QAEhE,QAAQ,YAAY,EAAE,CAAC;YACrB,KAAK,yBAAyB,CAAC,QAAQ;gBACrC,OAAO,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,oBAAoB,CAAC;YAC9D,KAAK,yBAAyB,CAAC,oBAAoB;gBACjD,OAAO,QAAQ;oBACb,CAAC,CAAC,8BAA8B;oBAChC,CAAC,CAAC,gCAAgC,CAAC;YACvC,KAAK,yBAAyB,CAAC,KAAK;gBAClC,OAAO,iBAAiB,CAAC;YAC3B,KAAK,yBAAyB,CAAC,eAAe;gBAC5C,OAAO,2BAA2B,CAAC;YACrC,KAAK,yBAAyB,CAAC,YAAY;gBACzC,OAAO,wBAAwB,CAAC;QACpC,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,kBAAkB,CAC9B,YAAuC;QAEvC,OAAO,cAAc,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;IAChD,CAAC;IAED,iDAAiD;IAC1C,MAAM,CAAC,sBAAsB,CAClC,YAAuC,EACvC,QAA2B;QAE3B,OAAO,SAAS,QAAQ,iBAAiB,cAAc,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,mBAAmB,CAAC,IAGjC;QACC,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;;;;OAaG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,IAM7C;QACC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GACjB,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,aAAa;YACpB,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAEjC,MAAM,cAAc,GAClB,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;YAC1B,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAE;YACrB,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEvC,MAAM,WAAW,GACf,MAAM,IAAI,CAAC,yBAAyB,CAAC;YACnC,cAAc,EAAE,cAAc;YAC9B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,aAAa;SAC7B,CAAC,CAAC;QAEL,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,WAAW,GACf,MAAM,IAAI,CAAC,oBAAoB,CAAC;gBAC9B,cAAc,EAAE,cAAc;gBAC9B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,IAAI,CAAC,SAAS;gBACxB,aAAa,EAAE,aAAa;aAC7B,CAAC,CAAC;YAEL,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,WAAW,CAAC;YACrB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC;YACrC,cAAc,EAAE,cAAc;YAC9B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,aAAa;SAC7B,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,IAI9C;QACC,IAAI,MAAM,GACR,IAAI,CAAC;QAEP,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC9C,MAAM,GAAG,GAME,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC;gBAC/D,KAAK,EAAE;oBACL,SAAS,EAAE,IAAI,CAAC,cAAc;oBAC9B,8BAA8B,EAAE,WAAW,CAAC,YAAY,CAAC;wBACvD,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE;qBACvB,CAAC;iBACgB;gBACpB,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;oBACT,SAAS,EAAE,IAAI;oBACf,SAAS,EAAE,IAAI;iBAChB;gBACD,IAAI,EAAE;oBACJ,SAAS,EAAE,SAAS,CAAC,UAAU;iBAChC;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;gBACtC,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAW,GAAG,CAAC,SAAS;gBACrC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;gBACnC,CAAC,CAAC,CAAC,CAAC;YAEN,IAAI,CAAC,MAAM,IAAI,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC5C,MAAM,GAAG;oBACP,QAAQ,EAAE;wBACR,YAAY,EAAE,YAAY;wBAC1B,UAAU,EAAE,GAAG,CAAC,EAAE;wBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;qBACzB;oBACD,SAAS,EAAE,SAAS;iBACrB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAMzC;QACC,IAAI,MAAM,GACR,IAAI,CAAC;QAEP,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC9C,MAAM,SAAS,GACb,cAAc,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC;YAEzC,MAAM,KAAK,GAAoC;gBAC7C,SAAS,EAAE,IAAI,CAAC,cAAc;gBAC9B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,OAAO,EAAE;aACA,CAAC;YAErC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;YACjC,CAAC;YAED,MAAM,GAAG,GACP,MAAM,+BAA+B,CAAC,SAAS,CAAC;gBAC9C,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;oBACT,SAAS,EAAE,IAAI;oBACf,SAAS,EAAE,IAAI;oBACf,CAAC,SAAS,CAAC,EAAE,IAAI;iBAClB;gBACD,IAAI,EAAE;oBACJ,SAAS,EAAE,SAAS,CAAC,UAAU;iBAChC;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YAEL,MAAM,UAAU,GAAyB,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAG,SAAS,CAE3C,CAAC;YAEd,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;gBAC1C,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAW,GAAG,CAAC,SAAS;gBACrC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;gBACnC,CAAC,CAAC,CAAC,CAAC;YAEN,IAAI,CAAC,MAAM,IAAI,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC5C,MAAM,GAAG;oBACP,QAAQ,EAAE;wBACR,YAAY,EAAE,YAAY;wBAC1B,UAAU,EAAE,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;wBAC/C,SAAS,EAAE,GAAG,CAAC,SAAS;qBACzB;oBACD,SAAS,EAAE,SAAS;iBACrB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED;;;;OAIG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAM5B;QACC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,KAAK,qBAAqB,IAAI,CAAC,QAAQ,SAAS,CAC/F,CAAC;QACJ,CAAC;QAED,IACE,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;SACxC,CAAC,EACF,CAAC;YACD,OAAO,uBAAuB,CAAC,SAAS,CAAC;QAC3C,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEzB,OAAO,uBAAuB,CAAC,KAAK,CAAC;IACvC,CAAC;IAED,kEAAkE;IAE9C,AAAb,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAI3B;QACC,MAAM,EAAE,GAAa,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC9C,MAAM,wBAAwB,GAAW,IAAI,CAAC,gBAAgB,CAAC;QAC/D,MAAM,QAAQ,GAAY,IAAI,CAAC,QAAQ,KAAK,iBAAiB,CAAC,MAAM,CAAC;QAErE,QAAQ,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YACnC,KAAK,yBAAyB,CAAC,QAAQ;gBACrC,OAAO,MAAM,CACX,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,2BAA2B,CACnE,CAAC,uBAAuB,CAAC;oBACxB,UAAU,EAAE,EAAE;oBACd,wBAAwB,EAAE,wBAAwB;iBACnD,CAAC,CAAC;YACL,KAAK,yBAAyB,CAAC,oBAAoB;gBACjD,OAAO,MAAM,CACX,QAAQ;oBACN,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,uCAAuC,CAC5C,CAAC,uBAAuB,CAAC;oBACxB,sBAAsB,EAAE,EAAE;oBAC1B,wBAAwB,EAAE,wBAAwB;iBACnD,CAAC,CAAC;YACL,KAAK,yBAAyB,CAAC,KAAK;gBAClC,OAAO,MAAM,wBAAwB,CAAC,uBAAuB,CAAC;oBAC5D,OAAO,EAAE,EAAE;oBACX,wBAAwB,EAAE,wBAAwB;iBACnD,CAAC,CAAC;YACL,KAAK,yBAAyB,CAAC,eAAe;gBAC5C,OAAO,MAAM,kCAAkC,CAAC,uBAAuB,CACrE;oBACE,iBAAiB,EAAE,EAAE;oBACrB,wBAAwB,EAAE,wBAAwB;iBACnD,CACF,CAAC;YACJ,KAAK,yBAAyB,CAAC,YAAY;gBACzC,OAAO,MAAM,+BAA+B,CAAC,uBAAuB,CAAC;oBACnE,cAAc,EAAE,EAAE;oBAClB,wBAAwB,EAAE,wBAAwB;iBACnD,CAAC,CAAC;QACP,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAM5B;QACC,MAAM,EAAE,GAAa,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC9C,MAAM,QAAQ,GAAY,IAAI,CAAC,QAAQ,KAAK,iBAAiB,CAAC,MAAM,CAAC;QACrE,MAAM,MAAM,GAKR;YACF,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;YAClC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,wBAAwB,EAAE,IAAI,CAAC,gBAAgB;SAChD,CAAC;QAEF,QAAQ,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YACnC,KAAK,yBAAyB,CAAC,QAAQ;gBACrC,MAAM,CACJ,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,2BAA2B,CACnE,CAAC,OAAO,iCAAM,MAAM,KAAE,UAAU,EAAE,EAAE,IAAG,CAAC;gBACzC,OAAO;YACT,KAAK,yBAAyB,CAAC,oBAAoB;gBACjD,MAAM,CACJ,QAAQ;oBACN,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,uCAAuC,CAC5C,CAAC,OAAO,iCAAM,MAAM,KAAE,sBAAsB,EAAE,EAAE,IAAG,CAAC;gBACrD,OAAO;YACT,KAAK,yBAAyB,CAAC,KAAK;gBAClC,MAAM,wBAAwB,CAAC,OAAO,iCAAM,MAAM,KAAE,OAAO,EAAE,EAAE,IAAG,CAAC;gBACnE,OAAO;YACT,KAAK,yBAAyB,CAAC,eAAe;gBAC5C,MAAM,kCAAkC,CAAC,OAAO,iCAC3C,MAAM,KACT,iBAAiB,EAAE,EAAE,IACrB,CAAC;gBACH,OAAO;YACT,KAAK,yBAAyB,CAAC,YAAY;gBACzC,MAAM,+BAA+B,CAAC,OAAO,iCACxC,MAAM,KACT,cAAc,EAAE,EAAE,IAClB,CAAC;gBACH,OAAO;QACX,CAAC;IACH,CAAC;IAED,qEAAqE;IAEjD,AAAb,MAAM,CAAC,KAAK,CAAC,kBAAkB,CACpC,QAA+B;QAE/B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC;QAC3C,MAAM,KAAK,GAAW,cAAc,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC;QAElE,IAAI,YAGH,CAAC;QACF,IAAI,IAAS,CAAC;QAEd,QAAQ,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC9B,KAAK,yBAAyB,CAAC,QAAQ;gBACrC,YAAY,GAAG,MAAM,eAAe,CAAC,iBAAiB,CAAC;oBACrD,UAAU,EAAE,UAAU;iBACvB,CAAC,CAAC;gBACH,IAAI,GAAG,MAAM,eAAe,CAAC,0BAA0B,CACrD,SAAS,EACT,UAAU,CACX,CAAC;gBACF,MAAM;YACR,KAAK,yBAAyB,CAAC,KAAK;gBAClC,YAAY,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC;oBAC/C,OAAO,EAAE,UAAU;iBACpB,CAAC,CAAC;gBACH,IAAI,GAAG,MAAM,YAAY,CAAC,uBAAuB,CAC/C,SAAS,EACT,UAAU,CACX,CAAC;gBACF,MAAM;YACR,KAAK,yBAAyB,CAAC,oBAAoB;gBACjD,YAAY;oBACV,MAAM,2BAA2B,CAAC,6BAA6B,CAAC;wBAC9D,sBAAsB,EAAE,UAAU;qBACnC,CAAC,CAAC;gBACL,IAAI;oBACF,MAAM,2BAA2B,CAAC,sCAAsC,CACtE,SAAS,EACT,UAAU,CACX,CAAC;gBACJ,MAAM;YACR,KAAK,yBAAyB,CAAC,eAAe;gBAC5C,YAAY,GAAG,MAAM,sBAAsB,CAAC,gBAAgB,CAAC;oBAC3D,SAAS,EAAE,UAAU;iBACtB,CAAC,CAAC;gBACH,IAAI,GAAG,MAAM,sBAAsB,CAAC,yBAAyB,CAC3D,SAAS,EACT,UAAU,CACX,CAAC;gBACF,MAAM;YACR,KAAK,yBAAyB,CAAC,YAAY;gBACzC,YAAY,GAAG,MAAM,mBAAmB,CAAC,gBAAgB,CAAC;oBACxD,SAAS,EAAE,UAAU;iBACtB,CAAC,CAAC;gBACH,IAAI,GAAG,MAAM,mBAAmB,CAAC,yBAAyB,CACxD,SAAS,EACT,UAAU,CACX,CAAC;gBACF,MAAM;QACV,CAAC;QAED,MAAM,aAAa,GACjB,YAAY,CAAC,gBAAgB;YAC7B,CAAC,YAAY,CAAC,MAAM,KAAK,IAAI,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS;gBAChE,CAAC,CAAC,IAAI,YAAY,CAAC,MAAM,EAAE;gBAC3B,CAAC,CAAC,EAAE,CAAC,CAAC;QAEV,OAAO;YACL,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,KAAK;YAC1D,IAAI,EAAE,IAAI;SACX,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,sBAAsB,CAAC,IAMpC;QACC,MAAM,IAAI,GAAW,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAE5E,IAAI,IAAI,CAAC,QAAQ,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;YAC/C,OAAO,sBAAsB,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,OAAO,IAAI,iDAAiD,CAAC;QAC1H,CAAC;QAED,OAAO,sBAAsB,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,OAAO,IAAI,GAAG,CAAC;IAC7E,CAAC;CACF;AA3ZqB;IADnB,WAAW,EAAE;;;;4DAsDb;AAuImB;IADnB,WAAW,EAAE;;;;2CA2Bb;AAImB;IADnB,WAAW,EAAE;;;;0CA6Cb;AAwDmB;IADnB,WAAW,EAAE;;;;qDAyEb"}

package/build/dist/Types/AutoRemediation/AiRemediationCommandPlan.js

@@ -1,4 +1,5 @@
 import RunbookStepType from "../Runbook/RunbookStepType";
+import { KubectlCommandTier, PROTECTED_KUBERNETES_NAMESPACES, } from "../Kubernetes/KubernetesClusterAiAccess";
 /*
  * The AI-composed command plan stored on
  * AutoRemediationSuggestion.commandPlan (jsonb). Everything in here is
@@ -8,14 +9,15 @@ import RunbookStepType from "../Runbook/RunbookStepType";
  * resolves them at claim time.
  */
 /*
- * The only step types an AI remediation run may compose. Kubernetes stays
- * runbook-only: its structured restart/scale actions cannot express an
- * arbitrary command, which is the whole point of this lane, and operators
- * who want kubectl can expose it to a Bash command instead.
+ * The only step types an AI remediation run may compose. The structured
+ * Kubernetes step (restart/scale) stays runbook-only; AI reaches a cluster
+ * through the Kubectl step instead, whose argv is tiered by KubectlPolicy
+ * and which targets a Runner the cluster's AI page bound.
  */
 export const AI_COMMAND_STEP_TYPES = [
     RunbookStepType.Bash,
     RunbookStepType.SSH,
+    RunbookStepType.Kubectl,
 ];
 export var AiRemediationCommandPolicyVerdict;
 (function (AiRemediationCommandPolicyVerdict) {
@@ -38,7 +40,12 @@ export var AiRemediationCommandExecutionStatus;
     AiRemediationCommandExecutionStatus["Running"] = "Running";
     AiRemediationCommandExecutionStatus["Succeeded"] = "Succeeded";
     AiRemediationCommandExecutionStatus["Failed"] = "Failed";
-    // An earlier command in the plan failed, so this one never ran.
+    /*
+     * Never ran: an earlier command in the plan failed, the remediation was
+     * settled before this command's turn, or — for a rollback — the cluster
+     * no longer allowed the undo to run unattended, so a human was told to
+     * undo it instead.
+     */
     AiRemediationCommandExecutionStatus["Skipped"] = "Skipped";
 })(AiRemediationCommandExecutionStatus || (AiRemediationCommandExecutionStatus = {}));
 export var AiRemediationPlanExecutionStatus;
@@ -56,12 +63,84 @@ export var AiRemediationRollbackStatus;
     // No executed command carried a rollback command.
     AiRemediationRollbackStatus["NotApplicable"] = "NotApplicable";
 })(AiRemediationRollbackStatus || (AiRemediationRollbackStatus = {}));
+/*
+ * A command's execution record has reached an outcome. Pending and Running
+ * records may still change: the job they name can finish later.
+ */
+export function isSettledCommandExecutionStatus(status) {
+    return (status === AiRemediationCommandExecutionStatus.Succeeded ||
+        status === AiRemediationCommandExecutionStatus.Failed ||
+        status === AiRemediationCommandExecutionStatus.Skipped);
+}
+/*
+ * RunnerJob.stepId prefixes of the three ways a plan's commands reach a
+ * Runner: executed INLINE by a FullAuto run while it plans, executed by the
+ * approved-plan executor after a human's click, or run by the rollback arm
+ * after verification failed. The per-cluster circuit breaker counts inline
+ * kubectl jobs by the first; the rollback arm resolves an interrupted
+ * command through the prefix its lane used when the job id never reached
+ * the command's record. Spelled out here, once, so the lanes never drift.
+ */
+export const INLINE_COMMAND_STEP_ID_PREFIX = "ai-command-";
+export const APPROVED_COMMAND_STEP_ID_PREFIX = "ai-approved-";
+export const ROLLBACK_COMMAND_STEP_ID_PREFIX = "ai-rollback-";
+/*
+ * The stepId the FORWARD job of a command carries: inline when a FullAuto
+ * run executed it while planning, approved otherwise. Unique per suggestion
+ * — a plan executes at most once and a retried run never re-executes.
+ */
+export function getForwardCommandStepId(command) {
+    return `${command.wasAutoExecuted === true
+        ? INLINE_COMMAND_STEP_ID_PREFIX
+        : APPROVED_COMMAND_STEP_ID_PREFIX}${command.sequence}`;
+}
+export function getRollbackCommandStepId(command) {
+    return `${ROLLBACK_COMMAND_STEP_ID_PREFIX}${command.sequence}`;
+}
 // Hard caps — enforced at plan acceptance, not just in the prompt.
 export const MAX_PLAN_COMMANDS = 5;
 export const MAX_COMMAND_LENGTH_CHARS = 2000;
 export const MIN_COMMAND_TIMEOUT_MS = 1000;
 export const MAX_COMMAND_TIMEOUT_MS = 5 * 60 * 1000;
 export const DEFAULT_COMMAND_TIMEOUT_MS = 60 * 1000;
+// SafeWrite: what an Automatic cluster runs without a human.
+export function getKubectlSafeChangesSummary(options) {
+    return `rollout restart/undo/pause/resume of one workload, scale of one workload to a non-zero replica count, delete of one named pod, ${options.allowNodeOperations ? "cordon/uncordon of one node, " : ""}and label/annotate of one pod or workload with unreserved keys — each on exactly ONE named object (TYPE/NAME, e.g. deployment/web), never a selector, --all, several names or a bare kind`;
+}
+// RiskyWrite: needs a human unless the allowlist names it or approvals are bypassed.
+export function getKubectlRiskierChangesSummary(options) {
+    return `patch, set image/env/resources, ${options.allowNodeOperations ? "drain, taint, " : ""}scale to zero, deleting a workload or a job, create job --from=cronjob/<name>, and any change that touches several objects at once`;
+}
+/*
+ * Asks a human whatever the cluster's mode, allowlist included: a
+ * protected-namespace write, and — where the Runner may change nodes at
+ * all — a node drain, a node taint and a patch of a Node (the canonical
+ * mode text in KubernetesClusterAiAccess).
+ */
+export function getKubectlAlwaysAsksSummary(options) {
+    return `a write in a protected namespace (${PROTECTED_KUBERNETES_NAMESPACES.join(", ")})${options.allowNodeOperations
+        ? ", a node drain, a node taint and a patch of a Node always need"
+        : " always needs"} a human, in every mode — Bypass approval and the allowlist included`;
+}
+export const KUBECTL_SAFE_CHANGES_SUMMARY = getKubectlSafeChangesSummary({ allowNodeOperations: true });
+export const KUBECTL_RISKIER_CHANGES_SUMMARY = getKubectlRiskierChangesSummary({ allowNodeOperations: true });
+export const KUBECTL_ALWAYS_ASKS_SUMMARY = getKubectlAlwaysAsksSummary({
+    allowNodeOperations: true,
+});
+// Denied: never runs, whoever approves it.
+export const KUBECTL_NEVER_RUNS_SUMMARY = "destructive commands never run, even with approval: exec, cp, port-forward, run, apply, edit, deleting namespaces/volumes/nodes/secrets/CRDs, any write to RBAC, admission-webhook or API-extension objects, create deployment/cronjob/job with --image, and a patch whose body is not JSON or that changes a pod's identity, privileges, host access, Secrets or command";
+// How the cluster's allowlist is read.
+export const KUBECTL_ALLOWLIST_SUMMARY = "the cluster's kubectl allowlist is matched token by token: a pattern must have exactly as many tokens as the command, a * matches within one token only, and a flag must be spelled as the pattern spells it";
+export function getKubectlAutomaticModeSummary(options) {
+    return `Automatic: safe changes run without a human (${getKubectlSafeChangesSummary(options)}). A riskier change (${getKubectlRiskierChangesSummary(options)}) never runs without one: when the round could only find riskier fixes it ends by proposing exactly those for one-click approval; when it also ran safe fixes, a riskier fix is proposed only if verification shows the safe ones did not recover the signal (the follow-up round, which asks). Shapes on the cluster's kubectl allowlist run on their own.`;
+}
+export const KUBECTL_AUTOMATIC_MODE_SUMMARY = getKubectlAutomaticModeSummary({ allowNodeOperations: true });
+/*
+ * Interpolated into prompts and feed copy on its own, so it names the
+ * exceptions instead of pointing at a list "below".
+ */
+export const KUBECTL_BYPASS_MODE_SUMMARY = "Bypass approval: AI does not ask. Every change the policy allows — safe AND riskier — runs on its own, follow-up rounds included, except for what always needs a human.";
+export const KUBECTL_EVERY_MODE_LIMITS_SUMMARY = `In every mode, Bypass approval included: ${KUBECTL_NEVER_RUNS_SUMMARY}; ${KUBECTL_ALWAYS_ASKS_SUMMARY}; the cluster's in-cluster Runner never changes its own namespace, nor a namespace outside the ones its chart lets it change, nor nodes when its chart turned node operations off; and an unattended run becomes a proposal when the hourly per-cluster circuit breaker trips or another unattended round already holds the cluster.`;
 export class AiRemediationCommandPlanUtil {
     /*
      * Parse a jsonb column value back into a typed plan. Fail-closed: any
@@ -101,6 +180,15 @@ export class AiRemediationCommandPlanUtil {
                 (typeof obj["credentialId"] !== "string" || !obj["credentialId"].trim())) {
                 return null;
             }
+            if (stepType === RunbookStepType.Kubectl &&
+                (typeof obj["kubernetesClusterId"] !== "string" ||
+                    !obj["kubernetesClusterId"].trim())) {
+                return null;
+            }
+            const kubectlTierRaw = String(obj["kubectlTier"] || "");
+            const kubectlTier = Object.values(KubectlCommandTier).includes(kubectlTierRaw)
+                ? kubectlTierRaw
+                : undefined;
             const verdict = String(obj["policyVerdict"] || "");
             if (verdict !== AiRemediationCommandPolicyVerdict.AutoApproved &&
                 verdict !== AiRemediationCommandPolicyVerdict.RequiresApproval) {
@@ -126,6 +214,13 @@ export class AiRemediationCommandPlanUtil {
                 credentialNameSnapshot: typeof obj["credentialNameSnapshot"] === "string"
                     ? obj["credentialNameSnapshot"]
                     : undefined,
+                kubernetesClusterId: typeof obj["kubernetesClusterId"] === "string"
+                    ? obj["kubernetesClusterId"]
+                    : undefined,
+                kubernetesClusterNameSnapshot: typeof obj["kubernetesClusterNameSnapshot"] === "string"
+                    ? obj["kubernetesClusterNameSnapshot"]
+                    : undefined,
+                kubectlTier,
                 command: command,
                 timeoutInMs: timeoutInMs,
                 rationale: typeof obj["rationale"] === "string" ? obj["rationale"] : "",
@@ -162,6 +257,9 @@ export class AiRemediationCommandPlanUtil {
         if (Object.values(AiRemediationRollbackStatus).includes(rollbackStatus)) {
             plan.rollbackStatus = rollbackStatus;
         }
+        if (typeof json["rollbackHeartbeatAt"] === "string") {
+            plan.rollbackHeartbeatAt = json["rollbackHeartbeatAt"];
+        }
         return plan;
     }
     static toJSON(plan) {