@oneuptime/common 14.0.8 → 14.0.10

package/build/dist/Types/ResourceAiAgent/AiResourceType.js

@@ -0,0 +1,242 @@
+/*
+ * The infrastructure resources a resource AI agent can give OneUptime AI
+ * access to, and what each one's agent runs.
+ *
+ * One resource AI agent (image RESOURCE_AI_AGENT_IMAGE_REPOSITORY) is
+ * installed next to each resource's telemetry collector. It registers the
+ * resource by the same identity the collector reports (identityEnvVars), and
+ * runs only the programs listed for its type — every command an argv, never
+ * a shell line, tiered by the resource command policy
+ * (Utils/AiRemediation/Resource) on the server tool, at the enqueue
+ * chokepoint and again on the agent before anything is spawned.
+ *
+ * Kubernetes clusters are NOT here: they keep their own Kubernetes AI agent
+ * (Types/Kubernetes/KubernetesClusterAiAccess).
+ *
+ * This file imports NOTHING outside Types/ResourceAiAgent on purpose: the
+ * resource AI agent (agents/ResourceAIAgent) carries a byte-identical copy of
+ * this directory and must compile without the rest of Common.
+ */
+/*
+ * Stored as a plain string (ResourceAiAgent.resourceType, RunnerJob and
+ * AutoRemediationSuggestion rows, job payloads), so each value IS the wire
+ * and database contract: never rename one.
+ */
+var AiResourceType;
+(function (AiResourceType) {
+    AiResourceType["DockerHost"] = "DockerHost";
+    AiResourceType["PodmanHost"] = "PodmanHost";
+    AiResourceType["DockerSwarmCluster"] = "DockerSwarmCluster";
+    AiResourceType["ProxmoxCluster"] = "ProxmoxCluster";
+    AiResourceType["VMwareVCenter"] = "VMwareVCenter";
+    AiResourceType["CephCluster"] = "CephCluster";
+    AiResourceType["DatabaseServer"] = "DatabaseServer";
+    AiResourceType["Host"] = "Host";
+})(AiResourceType || (AiResourceType = {}));
+export default AiResourceType;
+/*
+ * Every type, in declaration order. This is also the priority order in
+ * which a remediation round picks among several resources linked to one
+ * incident or alert, so reordering it changes which resource AI fixes first.
+ */
+export const ALL_AI_RESOURCE_TYPES = [
+    AiResourceType.DockerHost,
+    AiResourceType.PodmanHost,
+    AiResourceType.DockerSwarmCluster,
+    AiResourceType.ProxmoxCluster,
+    AiResourceType.VMwareVCenter,
+    AiResourceType.CephCluster,
+    AiResourceType.DatabaseServer,
+    AiResourceType.Host,
+];
+// Exactly an enum value, case included — what a stored row must hold.
+export function isAiResourceType(value) {
+    return (typeof value === "string" &&
+        ALL_AI_RESOURCE_TYPES.includes(value));
+}
+// The CLIs a Host agent runs through nsenter on the host itself.
+const HOST_PROGRAMS = [
+    "systemctl",
+    "journalctl",
+    "df",
+    "free",
+    "uptime",
+    "ps",
+    "ss",
+    "ip",
+    "dmesg",
+    "lsblk",
+    "cat",
+    "top",
+    "uname",
+    "hostnamectl",
+    "timedatectl",
+    "kill",
+];
+export const AI_RESOURCE_TYPE_INFO = {
+    [AiResourceType.DockerHost]: {
+        type: AiResourceType.DockerHost,
+        displayName: "Docker host",
+        agentDisplayName: "Docker AI agent",
+        agentAlias: "docker",
+        programs: ["docker"],
+        testCommands: ["docker version", "docker info"],
+        identityEnvVars: ["DOCKER_HOST_NAME"],
+        defaultIdentityPlaceholders: ["docker-host"],
+    },
+    /*
+     * Podman serves the Docker-compatible API on its socket, so the agent
+     * drives it with the same docker CLI and the same engine policy.
+     */
+    [AiResourceType.PodmanHost]: {
+        type: AiResourceType.PodmanHost,
+        displayName: "Podman host",
+        agentDisplayName: "Podman AI agent",
+        agentAlias: "podman",
+        programs: ["docker"],
+        testCommands: ["docker version", "docker info"],
+        identityEnvVars: ["PODMAN_HOST_NAME"],
+        defaultIdentityPlaceholders: ["podman-host"],
+    },
+    /*
+     * The swarm agent must run on a manager node: `docker node ls` fails on a
+     * worker, which is exactly what "Test connection" should reveal.
+     */
+    [AiResourceType.DockerSwarmCluster]: {
+        type: AiResourceType.DockerSwarmCluster,
+        displayName: "Docker Swarm cluster",
+        agentDisplayName: "Docker Swarm AI agent",
+        agentAlias: "docker-swarm",
+        programs: ["docker"],
+        testCommands: ["docker version", "docker node ls"],
+        identityEnvVars: ["DOCKER_SWARM_CLUSTER_NAME"],
+        // The compose default, and the name install.sh suggests.
+        defaultIdentityPlaceholders: ["docker-swarm", "my-swarm"],
+    },
+    /*
+     * There is no Proxmox CLI in the agent: "pvesh" is parsed by the policy
+     * and executed as calls to the Proxmox VE HTTPS API with the agent's own
+     * API token.
+     */
+    [AiResourceType.ProxmoxCluster]: {
+        type: AiResourceType.ProxmoxCluster,
+        displayName: "Proxmox cluster",
+        agentDisplayName: "Proxmox AI agent",
+        agentAlias: "proxmox",
+        programs: ["pvesh"],
+        testCommands: ["pvesh get /version", "pvesh get /cluster/status"],
+        identityEnvVars: ["PROXMOX_CLUSTER_NAME"],
+        defaultIdentityPlaceholders: ["proxmox-cluster"],
+    },
+    [AiResourceType.VMwareVCenter]: {
+        type: AiResourceType.VMwareVCenter,
+        displayName: "VMware vCenter",
+        agentDisplayName: "VMware AI agent",
+        agentAlias: "vmware",
+        programs: ["govc"],
+        testCommands: ["govc about"],
+        identityEnvVars: ["VMWARE_VCENTER_NAME"],
+        defaultIdentityPlaceholders: ["vmware-vcenter"],
+    },
+    [AiResourceType.CephCluster]: {
+        type: AiResourceType.CephCluster,
+        displayName: "Ceph cluster",
+        agentDisplayName: "Ceph AI agent",
+        agentAlias: "ceph",
+        programs: ["ceph"],
+        testCommands: ["ceph health", "ceph versions"],
+        identityEnvVars: ["CEPH_CLUSTER_NAME"],
+        defaultIdentityPlaceholders: ["ceph"],
+    },
+    /*
+     * "db" is not a binary: it names a typed catalog of diagnostic queries the
+     * agent runs through the database's own driver. Free SQL never runs.
+     * Database servers register by id or endpoint, never by name (names are
+     * not unique), so there is no placeholder to warn about.
+     */
+    [AiResourceType.DatabaseServer]: {
+        type: AiResourceType.DatabaseServer,
+        displayName: "Database server",
+        agentDisplayName: "Database AI agent",
+        agentAlias: "database",
+        programs: ["db"],
+        testCommands: ["db ping", "db version"],
+        identityEnvVars: [
+            "DATABASE_SERVER_ID",
+            "DATABASE_SYSTEM",
+            "DATABASE_SERVER_ADDRESS",
+            "DATABASE_SERVER_PORT",
+        ],
+        defaultIdentityPlaceholders: [],
+    },
+    // HOST_NAME defaults to the host's own hostname, so there is no placeholder.
+    [AiResourceType.Host]: {
+        type: AiResourceType.Host,
+        displayName: "Host",
+        agentDisplayName: "Host AI agent",
+        agentAlias: "host",
+        programs: HOST_PROGRAMS,
+        testCommands: ["uptime", "systemctl list-units --failed --no-pager"],
+        identityEnvVars: ["HOST_NAME"],
+        defaultIdentityPlaceholders: [],
+    },
+};
+export function getAiResourceTypeInfo(type) {
+    return AI_RESOURCE_TYPE_INFO[type];
+}
+/*
+ * Words an operator may set ONEUPTIME_AI_AGENT_RESOURCE_TYPE to besides the
+ * agentAlias itself. Compared after trimming, lowercasing and reading "_"
+ * as "-".
+ */
+const EXTRA_AGENT_ALIASES = {
+    swarm: AiResourceType.DockerSwarmCluster,
+    vcenter: AiResourceType.VMwareVCenter,
+    db: AiResourceType.DatabaseServer,
+};
+/*
+ * Read a resource type from configuration or a request: an enum value in
+ * any case ("DockerHost", "dockerhost"), or an agent alias ("docker",
+ * "podman", "docker-swarm"/"swarm", "proxmox", "vmware"/"vcenter", "ceph",
+ * "database"/"db", "host"). Anything else is null — never a guess.
+ */
+export function parseAiResourceType(value) {
+    if (typeof value !== "string") {
+        return null;
+    }
+    const trimmed = value.trim();
+    if (!trimmed) {
+        return null;
+    }
+    const folded = trimmed.toLowerCase();
+    for (const type of ALL_AI_RESOURCE_TYPES) {
+        if (type.toLowerCase() === folded) {
+            return type;
+        }
+    }
+    const alias = folded.replace(/_/g, "-");
+    for (const type of ALL_AI_RESOURCE_TYPES) {
+        if (AI_RESOURCE_TYPE_INFO[type].agentAlias === alias) {
+            return type;
+        }
+    }
+    if (Object.prototype.hasOwnProperty.call(EXTRA_AGENT_ALIASES, alias)) {
+        return EXTRA_AGENT_ALIASES[alias] || null;
+    }
+    return null;
+}
+/*
+ * Whether an agent's identity is one of its collector's defaults, compared
+ * the way the resource rows are looked up (trimmed, case-insensitively). The
+ * agent warns on true; it never refuses.
+ */
+export function isDefaultIdentityPlaceholder(type, identifier) {
+    if (typeof identifier !== "string" || !isAiResourceType(type)) {
+        return false;
+    }
+    const folded = identifier.trim().toLowerCase();
+    return AI_RESOURCE_TYPE_INFO[type].defaultIdentityPlaceholders.some((placeholder) => {
+        return placeholder.toLowerCase() === folded;
+    });
+}
+//# sourceMappingURL=AiResourceType.js.map

package/build/dist/Types/ResourceAiAgent/AiResourceType.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AiResourceType.js","sourceRoot":"","sources":["../../../../Types/ResourceAiAgent/AiResourceType.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;GAIG;AACH,IAAK,cASJ;AATD,WAAK,cAAc;IACjB,2CAAyB,CAAA;IACzB,2CAAyB,CAAA;IACzB,2DAAyC,CAAA;IACzC,mDAAiC,CAAA;IACjC,iDAA+B,CAAA;IAC/B,6CAA2B,CAAA;IAC3B,mDAAiC,CAAA;IACjC,+BAAa,CAAA;AACf,CAAC,EATI,cAAc,KAAd,cAAc,QASlB;AAED,eAAe,cAAc,CAAC;AAE9B;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAkC;IAClE,cAAc,CAAC,UAAU;IACzB,cAAc,CAAC,UAAU;IACzB,cAAc,CAAC,kBAAkB;IACjC,cAAc,CAAC,cAAc;IAC7B,cAAc,CAAC,aAAa;IAC5B,cAAc,CAAC,WAAW;IAC1B,cAAc,CAAC,cAAc;IAC7B,cAAc,CAAC,IAAI;CACpB,CAAC;AAEF,sEAAsE;AACtE,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,qBAA+C,CAAC,QAAQ,CAAC,KAAK,CAAC,CACjE,CAAC;AACJ,CAAC;AAyCD,iEAAiE;AACjE,MAAM,aAAa,GAA0B;IAC3C,WAAW;IACX,YAAY;IACZ,IAAI;IACJ,MAAM;IACN,QAAQ;IACR,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,OAAO;IACP,KAAK;IACL,KAAK;IACL,OAAO;IACP,aAAa;IACb,aAAa;IACb,MAAM;CACP,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAE9B;IACF,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE;QAC3B,IAAI,EAAE,cAAc,CAAC,UAAU;QAC/B,WAAW,EAAE,aAAa;QAC1B,gBAAgB,EAAE,iBAAiB;QACnC,UAAU,EAAE,QAAQ;QACpB,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,YAAY,EAAE,CAAC,gBAAgB,EAAE,aAAa,CAAC;QAC/C,eAAe,EAAE,CAAC,kBAAkB,CAAC;QACrC,2BAA2B,EAAE,CAAC,aAAa,CAAC;KAC7C;IACD;;;OAGG;IACH,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE;QAC3B,IAAI,EAAE,cAAc,CAAC,UAAU;QAC/B,WAAW,EAAE,aAAa;QAC1B,gBAAgB,EAAE,iBAAiB;QACnC,UAAU,EAAE,QAAQ;QACpB,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,YAAY,EAAE,CAAC,gBAAgB,EAAE,aAAa,CAAC;QAC/C,eAAe,EAAE,CAAC,kBAAkB,CAAC;QACrC,2BAA2B,EAAE,CAAC,aAAa,CAAC;KAC7C;IACD;;;OAGG;IACH,CAAC,cAAc,CAAC,kBAAkB,CAAC,EAAE;QACnC,IAAI,EAAE,cAAc,CAAC,kBAAkB;QACvC,WAAW,EAAE,sBAAsB;QACnC,gBAAgB,EAAE,uBAAuB;QACzC,UAAU,EAAE,cAAc;QAC1B,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,YAAY,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;QAClD,eAAe,EAAE,CAAC,2BAA2B,CAAC;QAC9C,yDAAyD;QACzD,2BAA2B,EAAE,CAAC,cAAc,EAAE,UAAU,CAAC;KAC1D;IACD;;;;OAIG;IACH,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE;QAC/B,IAAI,EAAE,cAAc,CAAC,cAAc;QACnC,WAAW,EAAE,iBAAiB;QAC9B,gBAAgB,EAAE,kBAAkB;QACpC,UAAU,EAAE,SAAS;QACrB,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,YAAY,EAAE,CAAC,oBAAoB,EAAE,2BAA2B,CAAC;QACjE,eAAe,EAAE,CAAC,sBAAsB,CAAC;QACzC,2BAA2B,EAAE,CAAC,iBAAiB,CAAC;KACjD;IACD,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE;QAC9B,IAAI,EAAE,cAAc,CAAC,aAAa;QAClC,WAAW,EAAE,gBAAgB;QAC7B,gBAAgB,EAAE,iBAAiB;QACnC,UAAU,EAAE,QAAQ;QACpB,QAAQ,EAAE,CAAC,MAAM,CAAC;QAClB,YAAY,EAAE,CAAC,YAAY,CAAC;QAC5B,eAAe,EAAE,CAAC,qBAAqB,CAAC;QACxC,2BAA2B,EAAE,CAAC,gBAAgB,CAAC;KAChD;IACD,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE;QAC5B,IAAI,EAAE,cAAc,CAAC,WAAW;QAChC,WAAW,EAAE,cAAc;QAC3B,gBAAgB,EAAE,eAAe;QACjC,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,CAAC,MAAM,CAAC;QAClB,YAAY,EAAE,CAAC,aAAa,EAAE,eAAe,CAAC;QAC9C,eAAe,EAAE,CAAC,mBAAmB,CAAC;QACtC,2BAA2B,EAAE,CAAC,MAAM,CAAC;KACtC;IACD;;;;;OAKG;IACH,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE;QAC/B,IAAI,EAAE,cAAc,CAAC,cAAc;QACnC,WAAW,EAAE,iBAAiB;QAC9B,gBAAgB,EAAE,mBAAmB;QACrC,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,CAAC,IAAI,CAAC;QAChB,YAAY,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC;QACvC,eAAe,EAAE;YACf,oBAAoB;YACpB,iBAAiB;YACjB,yBAAyB;YACzB,sBAAsB;SACvB;QACD,2BAA2B,EAAE,EAAE;KAChC;IACD,6EAA6E;IAC7E,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE;QACrB,IAAI,EAAE,cAAc,CAAC,IAAI;QACzB,WAAW,EAAE,MAAM;QACnB,gBAAgB,EAAE,eAAe;QACjC,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,aAAa;QACvB,YAAY,EAAE,CAAC,QAAQ,EAAE,0CAA0C,CAAC;QACpE,eAAe,EAAE,CAAC,WAAW,CAAC;QAC9B,2BAA2B,EAAE,EAAE;KAChC;CACF,CAAC;AAEF,MAAM,UAAU,qBAAqB,CACnC,IAAoB;IAEpB,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,mBAAmB,GAA6C;IACpE,KAAK,EAAE,cAAc,CAAC,kBAAkB;IACxC,OAAO,EAAE,cAAc,CAAC,aAAa;IACrC,EAAE,EAAE,cAAc,CAAC,cAAc;CAClC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAW,KAAK,CAAC,IAAI,EAAE,CAAC;IAErC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAW,OAAO,CAAC,WAAW,EAAE,CAAC;IAE7C,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAW,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEhD,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC;QACrE,OAAO,mBAAmB,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;IAC5C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAAoB,EACpB,UAAmB;IAEnB,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAW,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEvD,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,2BAA2B,CAAC,IAAI,CACjE,CAAC,WAAmB,EAAW,EAAE;QAC/B,OAAO,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;IAC9C,CAAC,CACF,CAAC;AACJ,CAAC"}

package/build/dist/Types/ResourceAiAgent/ResourceAiAccess.js

@@ -0,0 +1,275 @@
+/*
+ * OneUptime AI access to an infrastructure resource through its resource AI
+ * agent: the command tiers and remediation modes, the agent's posture, the
+ * access status the dashboard and the AI runs read, the agent <-> server
+ * wire protocol and the shared caps.
+ *
+ * The tier and mode enums carry exactly the string values of the Kubernetes
+ * ones (KubectlCommandTier, KubernetesAiRemediationMode — a Common test
+ * asserts it), so stored strings are interchangeable and every prompt,
+ * card and ladder that reads a tier or a mode means the same thing for a
+ * cluster and for any other resource.
+ *
+ * Imports only ./AiResourceType on purpose: the resource AI agent
+ * (agents/ResourceAIAgent) carries a byte-identical copy of this directory
+ * and must compile without the rest of Common.
+ */
+import { isAiResourceType } from "./AiResourceType";
+/*
+ * The tier the resource command policy assigns to one command. Tiers are the
+ * whole safety model: what a run may execute is a function of (tier, mode),
+ * never of prose in a prompt.
+ *
+ * Read:       inspects the resource and changes nothing (docker ps, pvesh
+ *             get, govc vm.info, ceph health, systemctl status, ...).
+ *             Investigations only ever run these.
+ * SafeWrite:  a reversible change to exactly ONE named object (restart one
+ *             container, start one VM, restart one unit, ...). Automatic mode
+ *             runs these without a human.
+ * RiskyWrite: a change that can take something down or alter what runs
+ *             (stop, kill, update, migrate, ...). Needs a human unless the
+ *             operator allowlisted the exact shape on the resource or the
+ *             resource bypasses approvals.
+ * Denied:     never runs, even with human approval (exec, run, rm, prune,
+ *             anything reading credentials, anything the policy does not
+ *             know).
+ */
+export var ResourceCommandTier;
+(function (ResourceCommandTier) {
+    ResourceCommandTier["Read"] = "Read";
+    ResourceCommandTier["SafeWrite"] = "SafeWrite";
+    ResourceCommandTier["RiskyWrite"] = "RiskyWrite";
+    ResourceCommandTier["Denied"] = "Denied";
+})(ResourceCommandTier || (ResourceCommandTier = {}));
+/*
+ * How OneUptime AI may change a resource once it has diagnosed a signal —
+ * the same four modes a Kubernetes cluster has.
+ *
+ * Disabled:        AI never proposes or runs a change on this resource.
+ * RequireApproval: AI composes a command plan and a human approves it with
+ *                  one click before anything runs.
+ * Automatic:       safe changes (SafeWrite) run without a human; a riskier
+ *                  change is proposed for approval unless the resource's
+ *                  allowlist names its exact shape.
+ * BypassApproval:  every change the policy allows — safe AND riskier — runs
+ *                  on its own, except what always needs a human.
+ *
+ * In EVERY mode: Denied commands never run, commands the policy marks
+ * requiresHuman always ask, and the agent itself refuses every write unless
+ * it was started with RESOURCE_AI_ALLOW_WRITES_ENV=true (and then only on
+ * the targets RESOURCE_AI_WRITE_TARGETS_ENV allows, never its protected
+ * targets).
+ */
+export var ResourceAiRemediationMode;
+(function (ResourceAiRemediationMode) {
+    ResourceAiRemediationMode["Disabled"] = "Disabled";
+    ResourceAiRemediationMode["RequireApproval"] = "RequireApproval";
+    ResourceAiRemediationMode["Automatic"] = "Automatic";
+    ResourceAiRemediationMode["BypassApproval"] = "BypassApproval";
+})(ResourceAiRemediationMode || (ResourceAiRemediationMode = {}));
+// The modes in which OneUptime AI executes changes without a human.
+export const UNATTENDED_RESOURCE_REMEDIATION_MODES = [
+    ResourceAiRemediationMode.Automatic,
+    ResourceAiRemediationMode.BypassApproval,
+];
+export function isUnattendedResourceRemediationMode(mode) {
+    return (mode !== undefined &&
+        mode !== null &&
+        UNATTENDED_RESOURCE_REMEDIATION_MODES.includes(mode));
+}
+/*
+ * A stored or submitted mode, exactly as spelled. Anything unknown is
+ * Disabled: a value this build cannot read must never widen what AI may do.
+ */
+export function parseResourceAiRemediationMode(value) {
+    if (typeof value === "string" &&
+        Object.values(ResourceAiRemediationMode).includes(value)) {
+        return value;
+    }
+    return ResourceAiRemediationMode.Disabled;
+}
+// The agent heartbeats every 30 seconds; it counts as online this long after.
+export const RESOURCE_AI_AGENT_ALIVE_WINDOW_IN_MINUTES = 5;
+// Every agent route (register, heartbeat, claim-next-job, ...) lives under it.
+export const RESOURCE_AI_AGENT_INGEST_PATH = "/resource-ai-agent-ingest";
+export const RESOURCE_AI_AGENT_IMAGE_REPOSITORY = "oneuptime/resource-ai-agent";
+// The Kubernetes AI agent uses 3876; both can run on one host.
+export const RESOURCE_AI_AGENT_DEFAULT_HEALTH_PORT = 3877;
+/*
+ * Environment the resource AI agent reads. The single source of truth: the
+ * agent's Config imports these from its copy of this file, and the install
+ * docs are pinned against them.
+ *
+ * RESOURCE_TYPE: which resource the agent serves (an agentAlias or an enum
+ *                value, read with parseAiResourceType).
+ * RESOURCE_NAME: overrides the identity otherwise read from the type's
+ *                identityEnvVars (the collector's own variables).
+ * ALLOW_WRITES:  "true" lets the agent run writes at all. Anything else —
+ *                unset included — keeps it read-only, whatever the dashboard
+ *                says.
+ * WRITE_TARGETS: comma-separated globs of the targets (container, service,
+ *                VM, unit, ... names) a write may touch. Empty or unset means
+ *                any target except the agent's protected ones.
+ * API_KEY:       the first non-empty of these authenticates registration
+ *                (the collectors already set one of them).
+ */
+export const RESOURCE_AI_AGENT_RESOURCE_TYPE_ENV = "ONEUPTIME_AI_AGENT_RESOURCE_TYPE";
+export const RESOURCE_AI_AGENT_RESOURCE_NAME_ENV = "ONEUPTIME_AI_AGENT_RESOURCE_NAME";
+export const RESOURCE_AI_ALLOW_WRITES_ENV = "ONEUPTIME_AI_ALLOW_WRITES";
+export const RESOURCE_AI_WRITE_TARGETS_ENV = "ONEUPTIME_AI_WRITE_TARGETS";
+export const RESOURCE_AI_AGENT_API_KEY_ENVS = [
+    "ONEUPTIME_API_KEY",
+    "ONEUPTIME_TELEMETRY_INGESTION_KEY",
+    "ONEUPTIME_SERVICE_TOKEN",
+];
+// Bounds parseResourceAiAgentPosture holds every posture to.
+export const MAX_POSTURE_LIST_ENTRIES = 64;
+export const MAX_POSTURE_STRING_LENGTH = 256;
+// Keys that would reach an object's prototype if assigned.
+const UNSAFE_OBJECT_KEYS = [
+    "__proto__",
+    "constructor",
+    "prototype",
+];
+// A display-only string: kept (trimmed, capped) when it is one, else null.
+function readDisplayString(value) {
+    if (typeof value !== "string") {
+        return null;
+    }
+    const trimmed = value.trim();
+    if (!trimmed) {
+        return null;
+    }
+    return trimmed.slice(0, MAX_POSTURE_STRING_LENGTH);
+}
+/*
+ * A list the write scope depends on. Absent reads as []; anything else must
+ * be an array of at most MAX_POSTURE_LIST_ENTRIES non-empty strings of at
+ * most MAX_POSTURE_STRING_LENGTH characters. A list that breaks the rules is
+ * reported as malformed (never partially trusted): dropping one entry of a
+ * protected list, or one of an allowlist, would change what a write may
+ * touch.
+ */
+function readTargetList(value) {
+    if (value === undefined || value === null) {
+        return { list: [], malformed: false };
+    }
+    if (!Array.isArray(value) || value.length > MAX_POSTURE_LIST_ENTRIES) {
+        return { list: [], malformed: true };
+    }
+    const list = [];
+    for (const entry of value) {
+        if (typeof entry !== "string") {
+            return { list: [], malformed: true };
+        }
+        const trimmed = entry.trim();
+        if (!trimmed || trimmed.length > MAX_POSTURE_STRING_LENGTH) {
+            return { list: [], malformed: true };
+        }
+        if (!list.includes(trimmed)) {
+            list.push(trimmed);
+        }
+    }
+    return { list, malformed: false };
+}
+function readDetails(value) {
+    const details = {};
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return details;
+    }
+    let count = 0;
+    for (const key of Object.keys(value)) {
+        if (count >= MAX_POSTURE_LIST_ENTRIES) {
+            break;
+        }
+        if (!key ||
+            key.length > MAX_POSTURE_STRING_LENGTH ||
+            UNSAFE_OBJECT_KEYS.includes(key)) {
+            continue;
+        }
+        const entry = value[key];
+        if (typeof entry === "string") {
+            details[key] = entry.slice(0, MAX_POSTURE_STRING_LENGTH);
+        }
+        else if (typeof entry === "number" && Number.isFinite(entry)) {
+            details[key] = entry;
+        }
+        else if (typeof entry === "boolean" || entry === null) {
+            details[key] = entry;
+        }
+        else {
+            continue;
+        }
+        count++;
+    }
+    return details;
+}
+/*
+ * Read a posture from an agent's request body or the ResourceAiAgent.posture
+ * column. Strict and fail-closed:
+ *   - null unless resourceType is exactly an AiResourceType value and
+ *     resourceIdentifier a non-empty string of at most 256 characters;
+ *   - allowWrites is true only for the boolean true;
+ *   - a malformed writeTargets or protectedTargets list (not an array of
+ *     non-empty strings, over 64 entries, an entry over 256 characters)
+ *     forces allowWrites to false rather than being partly trusted;
+ *   - display strings are trimmed and capped at 256 characters, details keep
+ *     only scalar values (at most 64 of them), and reportedAt only a
+ *     parseable date.
+ */
+export function parseResourceAiAgentPosture(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    const raw = value;
+    const resourceType = raw["resourceType"];
+    if (!isAiResourceType(resourceType)) {
+        return null;
+    }
+    const identifierRaw = raw["resourceIdentifier"];
+    if (typeof identifierRaw !== "string") {
+        return null;
+    }
+    const resourceIdentifier = identifierRaw.trim();
+    if (!resourceIdentifier ||
+        resourceIdentifier.length > MAX_POSTURE_STRING_LENGTH) {
+        return null;
+    }
+    const writeTargets = readTargetList(raw["writeTargets"]);
+    const protectedTargets = readTargetList(raw["protectedTargets"]);
+    const posture = {
+        resourceType,
+        resourceIdentifier,
+        agentVersion: readDisplayString(raw["agentVersion"]),
+        allowWrites: raw["allowWrites"] === true &&
+            !writeTargets.malformed &&
+            !protectedTargets.malformed,
+        allowWritesSetting: readDisplayString(raw["allowWritesSetting"]),
+        writeTargets: writeTargets.list,
+        protectedTargets: protectedTargets.list,
+        toolVersion: readDisplayString(raw["toolVersion"]),
+        reachable: raw["reachable"] === true,
+        reachError: readDisplayString(raw["reachError"]),
+        details: readDetails(raw["details"]),
+    };
+    const reportedAt = raw["reportedAt"];
+    if (typeof reportedAt === "string" &&
+        reportedAt.length <= 64 &&
+        !Number.isNaN(Date.parse(reportedAt))) {
+        posture.reportedAt = reportedAt;
+    }
+    return posture;
+}
+// The refusals that clear without anyone doing anything; retrying is right.
+export const TRANSIENT_RESOURCE_AI_AGENT_REGISTRATION_REFUSALS = ["previous_instance_online"];
+export function isTransientResourceAiAgentRegistrationRefusal(reason) {
+    return (typeof reason === "string" &&
+        TRANSIENT_RESOURCE_AI_AGENT_REGISTRATION_REFUSALS.includes(reason));
+}
+// Caps shared by the investigation tool, the remediation toolkit and the agent.
+export const MAX_RESOURCE_COMMANDS_PER_INVESTIGATION = 8;
+export const DEFAULT_RESOURCE_COMMAND_TIMEOUT_MS = 30 * 1000;
+export const MAX_RESOURCE_COMMAND_TIMEOUT_MS = 2 * 60 * 1000;
+export const MAX_RESOURCE_COMMAND_OUTPUT_CHARS_FOR_LLM = 8000;
+export const MAX_RESOURCE_AGENT_OUTPUT_BYTES = 50 * 1024;
+//# sourceMappingURL=ResourceAiAccess.js.map

package/build/dist/Types/ResourceAiAgent/ResourceAiAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResourceAiAccess.js","sourceRoot":"","sources":["../../../../Types/ResourceAiAgent/ResourceAiAccess.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAuB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAN,IAAY,mBAKX;AALD,WAAY,mBAAmB;IAC7B,oCAAa,CAAA;IACb,8CAAuB,CAAA;IACvB,gDAAyB,CAAA;IACzB,wCAAiB,CAAA;AACnB,CAAC,EALW,mBAAmB,KAAnB,mBAAmB,QAK9B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAN,IAAY,yBAKX;AALD,WAAY,yBAAyB;IACnC,kDAAqB,CAAA;IACrB,gEAAmC,CAAA;IACnC,oDAAuB,CAAA;IACvB,8DAAiC,CAAA;AACnC,CAAC,EALW,yBAAyB,KAAzB,yBAAyB,QAKpC;AAED,oEAAoE;AACpE,MAAM,CAAC,MAAM,qCAAqC,GAChD;IACE,yBAAyB,CAAC,SAAS;IACnC,yBAAyB,CAAC,cAAc;CACzC,CAAC;AAEJ,MAAM,UAAU,mCAAmC,CACjD,IAAkD;IAElD,OAAO,CACL,IAAI,KAAK,SAAS;QAClB,IAAI,KAAK,IAAI;QACb,qCAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC,CACrD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAAc;IAEd,IACE,OAAO,KAAK,KAAK,QAAQ;QACxB,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC3E,CAAC;QACD,OAAO,KAAkC,CAAC;IAC5C,CAAC;IAED,OAAO,yBAAyB,CAAC,QAAQ,CAAC;AAC5C,CAAC;AAUD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,yCAAyC,GAAW,CAAC,CAAC;AAEnE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,6BAA6B,GACxC,2BAA2B,CAAC;AAE9B,MAAM,CAAC,MAAM,kCAAkC,GAC7C,6BAA6B,CAAC;AAEhC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,qCAAqC,GAAW,IAAI,CAAC;AAElE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAC9C,kCAAkC,CAAC;AACrC,MAAM,CAAC,MAAM,mCAAmC,GAC9C,kCAAkC,CAAC;AACrC,MAAM,CAAC,MAAM,4BAA4B,GAAW,2BAA2B,CAAC;AAChF,MAAM,CAAC,MAAM,6BAA6B,GACxC,4BAA4B,CAAC;AAC/B,MAAM,CAAC,MAAM,8BAA8B,GAA0B;IACnE,mBAAmB;IACnB,mCAAmC;IACnC,yBAAyB;CAC1B,CAAC;AAyCF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,wBAAwB,GAAW,EAAE,CAAC;AACnD,MAAM,CAAC,MAAM,yBAAyB,GAAW,GAAG,CAAC;AAErD,2DAA2D;AAC3D,MAAM,kBAAkB,GAA0B;IAChD,WAAW;IACX,aAAa;IACb,WAAW;CACZ,CAAC;AAEF,2EAA2E;AAC3E,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAW,KAAK,CAAC,IAAI,EAAE,CAAC;IAErC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,KAAc;IAIpC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;QACrE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,IAAI,GAAkB,EAAE,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,OAAO,GAAW,KAAK,CAAC,IAAI,EAAE,CAAC;QAErC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;YAC3D,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAClB,KAAc;IAEd,MAAM,OAAO,GAAqD,EAAE,CAAC;IAErE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,KAAK,GAAW,CAAC,CAAC;IAEtB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,EAAE,CAAC;QAChE,IAAI,KAAK,IAAI,wBAAwB,EAAE,CAAC;YACtC,MAAM;QACR,CAAC;QAED,IACE,CAAC,GAAG;YACJ,GAAG,CAAC,MAAM,GAAG,yBAAyB;YACtC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAChC,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAa,KAAiC,CAAC,GAAG,CAAC,CAAC;QAE/D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;QAC3D,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/D,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,SAAS;QACX,CAAC;QAED,KAAK,EAAE,CAAC;IACV,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAA4B,KAAgC,CAAC;IAEtE,MAAM,YAAY,GAAY,GAAG,CAAC,cAAc,CAAC,CAAC;IAElD,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAY,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAEzD,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,kBAAkB,GAAW,aAAa,CAAC,IAAI,EAAE,CAAC;IAExD,IACE,CAAC,kBAAkB;QACnB,kBAAkB,CAAC,MAAM,GAAG,yBAAyB,EACrD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAChB,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IACtC,MAAM,gBAAgB,GACpB,cAAc,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAE1C,MAAM,OAAO,GAA2B;QACtC,YAAY;QACZ,kBAAkB;QAClB,YAAY,EAAE,iBAAiB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACpD,WAAW,EACT,GAAG,CAAC,aAAa,CAAC,KAAK,IAAI;YAC3B,CAAC,YAAY,CAAC,SAAS;YACvB,CAAC,gBAAgB,CAAC,SAAS;QAC7B,kBAAkB,EAAE,iBAAiB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAChE,YAAY,EAAE,YAAY,CAAC,IAAI;QAC/B,gBAAgB,EAAE,gBAAgB,CAAC,IAAI;QACvC,WAAW,EAAE,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAClD,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,KAAK,IAAI;QACpC,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;KACrC,CAAC;IAEF,MAAM,UAAU,GAAY,GAAG,CAAC,YAAY,CAAC,CAAC;IAE9C,IACE,OAAO,UAAU,KAAK,QAAQ;QAC9B,UAAU,CAAC,MAAM,IAAI,EAAE;QACvB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EACrC,CAAC;QACD,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;IAClC,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AA0JD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iDAAiD,GAC5D,CAAC,0BAA0B,CAAC,CAAC;AAE/B,MAAM,UAAU,6CAA6C,CAC3D,MAAe;IAEf,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;QAExB,iDACD,CAAC,QAAQ,CAAC,MAAM,CAAC,CACnB,CAAC;AACJ,CAAC;AAoBD,gFAAgF;AAChF,MAAM,CAAC,MAAM,uCAAuC,GAAW,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,mCAAmC,GAAW,EAAE,GAAG,IAAI,CAAC;AACrE,MAAM,CAAC,MAAM,+BAA+B,GAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACrE,MAAM,CAAC,MAAM,yCAAyC,GAAW,IAAI,CAAC;AACtE,MAAM,CAAC,MAAM,+BAA+B,GAAW,EAAE,GAAG,IAAI,CAAC"}

package/build/dist/Types/Rum/SessionReplayBudgetMetricType.js

@@ -0,0 +1,45 @@
+/*
+ * Metric names the session replay budget sweep posts every five minutes
+ * (Common/Server/Utils/SessionReplay/SessionReplayBudgetMetrics.ts), so the
+ * two storage budgets on the Replay Health page can be charted and alerted on
+ * like any other metric - the same way monitors post `oneuptime.monitor.*`
+ * and SLOs post `oneuptime.slo.*`. Without them a spent budget was only ever
+ * visible to someone looking at the Health page: recorders are told to stop,
+ * quietly, and recordings simply stop appearing.
+ *
+ * The values are stored verbatim as metric names in ClickHouse. Renaming one
+ * orphans every point already written under the old name and silences every
+ * monitor watching it, so treat them as a public, append-only contract.
+ *
+ * Every row is keyed to a RUM application (primaryEntityId = its id, type
+ * RealUserMonitor), which is what lets a monitor scoped to that application
+ * see it. The project series carry only a `projectId` attribute: the daily
+ * limit belongs to the project, and the same value is posted under each
+ * application that records, so nothing about the row may read as that
+ * application's own usage. The application series also carry
+ * `rumApplicationId` and `rumApplicationName`.
+ */
+var SessionReplayBudgetMetricType;
+(function (SessionReplayBudgetMetricType) {
+    /*
+     * Replay upload bytes the gate has charged since 00:00 UTC, for the whole
+     * project (every application together). Unit "By".
+     */
+    SessionReplayBudgetMetricType["ProjectDailyUsedBytes"] = "oneuptime.rum.session.replay.budget.project.daily.used.bytes";
+    /*
+     * The above as a percent of the deployment's daily limit, rounded down to
+     * 0.01 so ">= 100" means exactly what the gate means by "spent". Not
+     * capped: the request that crosses the limit stays charged. Unit "%".
+     */
+    SessionReplayBudgetMetricType["ProjectDailyUsedPercent"] = "oneuptime.rum.session.replay.budget.project.daily.used.percent";
+    /*
+     * Replay upload bytes charged to one application's monthly budget since the
+     * 1st (UTC). Only counted, and only posted, while the application has a
+     * monthly budget. Unit "By".
+     */
+    SessionReplayBudgetMetricType["ApplicationMonthlyUsedBytes"] = "oneuptime.rum.session.replay.budget.application.monthly.used.bytes";
+    // The above as a percent of the application's monthly budget. Unit "%".
+    SessionReplayBudgetMetricType["ApplicationMonthlyUsedPercent"] = "oneuptime.rum.session.replay.budget.application.monthly.used.percent";
+})(SessionReplayBudgetMetricType || (SessionReplayBudgetMetricType = {}));
+export default SessionReplayBudgetMetricType;
+//# sourceMappingURL=SessionReplayBudgetMetricType.js.map

package/build/dist/Types/Rum/SessionReplayBudgetMetricType.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionReplayBudgetMetricType.js","sourceRoot":"","sources":["../../../../Types/Rum/SessionReplayBudgetMetricType.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,IAAK,6BAuBJ;AAvBD,WAAK,6BAA6B;IAChC;;;OAGG;IACH,uHAAsF,CAAA;IAEtF;;;;OAIG;IACH,2HAA0F,CAAA;IAE1F;;;;OAIG;IACH,mIAAkG,CAAA;IAElG,wEAAwE;IACxE,uIAAsG,CAAA;AACxG,CAAC,EAvBI,6BAA6B,KAA7B,6BAA6B,QAuBjC;AAED,eAAe,6BAA6B,CAAC"}

package/build/dist/Types/Runbook/RunbookStepType.js

@@ -15,6 +15,15 @@ var RunbookStepType;
      * commands, remediations run policy-tiered writes); not authored in runbooks.
      */
     RunbookStepType["Kubectl"] = "Kubectl";
+    /*
+     * A single command for an infrastructure resource's AI agent (Docker,
+     * Podman, Docker Swarm, Proxmox, VMware, Ceph, a database server or a
+     * host), dispatched as an argv (never a shell line) to that resource's
+     * online ResourceAiAgent — never claimed by a Runner, never run by the
+     * Worker. Composed only by OneUptime AI and tiered by the resource command
+     * policy (Utils/AiRemediation/Resource); not authored in runbooks.
+     */
+    RunbookStepType["ResourceCommand"] = "ResourceCommand";
 })(RunbookStepType || (RunbookStepType = {}));
 export default RunbookStepType;
 /*
@@ -62,4 +71,22 @@ export const PAYLOAD_CARRYING_STEP_TYPES = [
 export function isPayloadCarryingStepType(type) {
     return PAYLOAD_CARRYING_STEP_TYPES.includes(type);
 }
+/*
+ * Step types executed by an infrastructure resource's AI agent (a
+ * ResourceAiAgent row), a third lane beside the Runner and the Worker. Such
+ * a job is written with targetResourceAiAgentId and no targetAgentId, so no
+ * Runner can claim it: RunnerJobService.enqueue refuses these types (they
+ * are not in RUNNER_EXECUTED_STEP_TYPES), a Runner may not ask for them on a
+ * claim, and the Worker's step switch has no case for them.
+ *
+ * Deliberately NOT in PAYLOAD_CARRYING_STEP_TYPES, which is the payload half
+ * of the Runner lane (a test asserts the two Runner halves are
+ * complementary); these jobs still carry their argv in RunnerJob.payload.
+ */
+export const AI_AGENT_EXECUTED_STEP_TYPES = [
+    RunbookStepType.ResourceCommand,
+];
+export function isAiAgentExecutedStepType(type) {
+    return AI_AGENT_EXECUTED_STEP_TYPES.includes(type);
+}
 //# sourceMappingURL=RunbookStepType.js.map

package/build/dist/Types/Runbook/RunbookStepType.js.map

@@ -1 +1 @@
-{"version":3,"file":"RunbookStepType.js","sourceRoot":"","sources":["../../../../Types/Runbook/RunbookStepType.ts"],"names":[],"mappings":"AAAA,IAAK,eAgBJ;AAhBD,WAAK,eAAe;IAClB,oCAAiB,CAAA;IACjB,4CAAyB,CAAA;IACzB,8CAA2B,CAAA;IAC3B,gCAAa,CAAA;IACb,4BAAS,CAAA;IACT,8BAAW,CAAA;IACX,4CAAyB,CAAA;IACzB;;;;;;OAMG;IACH,sCAAmB,CAAA;AACrB,CAAC,EAhBI,eAAe,KAAf,eAAe,QAgBnB;AAED,eAAe,eAAe,CAAC;AAE/B;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA2B;IAChE,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,IAAI;IACpB,eAAe,CAAC,GAAG;IACnB,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,OAAO;CACxB,CAAC;AAEF,MAAM,UAAU,wBAAwB,CAAC,IAAqB;IAC5D,OAAO,0BAA0B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAA2B;IACjE,eAAe,CAAC,GAAG;IACnB,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,OAAO;CACxB,CAAC;AAEF,MAAM,UAAU,yBAAyB,CAAC,IAAqB;IAC7D,OAAO,2BAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"RunbookStepType.js","sourceRoot":"","sources":["../../../../Types/Runbook/RunbookStepType.ts"],"names":[],"mappings":"AAAA,IAAK,eAyBJ;AAzBD,WAAK,eAAe;IAClB,oCAAiB,CAAA;IACjB,4CAAyB,CAAA;IACzB,8CAA2B,CAAA;IAC3B,gCAAa,CAAA;IACb,4BAAS,CAAA;IACT,8BAAW,CAAA;IACX,4CAAyB,CAAA;IACzB;;;;;;OAMG;IACH,sCAAmB,CAAA;IACnB;;;;;;;OAOG;IACH,sDAAmC,CAAA;AACrC,CAAC,EAzBI,eAAe,KAAf,eAAe,QAyBnB;AAED,eAAe,eAAe,CAAC;AAE/B;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA2B;IAChE,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,IAAI;IACpB,eAAe,CAAC,GAAG;IACnB,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,OAAO;CACxB,CAAC;AAEF,MAAM,UAAU,wBAAwB,CAAC,IAAqB;IAC5D,OAAO,0BAA0B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAA2B;IACjE,eAAe,CAAC,GAAG;IACnB,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,OAAO;CACxB,CAAC;AAEF,MAAM,UAAU,yBAAyB,CAAC,IAAqB;IAC7D,OAAO,2BAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAA2B;IAClE,eAAe,CAAC,eAAe;CAChC,CAAC;AAEF,MAAM,UAAU,yBAAyB,CAAC,IAAqB;IAC7D,OAAO,4BAA4B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC"}

package/build/dist/Types/Team/ComplianceNotificationChannel.js

@@ -0,0 +1,23 @@
+/*
+ * The notification channel an on-call compliance rule can insist on
+ * (TeamComplianceSetting.notificationChannel). NULL on a setting means "any
+ * channel". The string values are stored, so they must never be renamed.
+ *
+ * Every channel a UserNotificationRule can point at is here, because a
+ * compliance rule that could only ask about four of the nine would report a
+ * member whose pager is Telegram as unreachable when they are not.
+ */
+var ComplianceNotificationChannel;
+(function (ComplianceNotificationChannel) {
+    ComplianceNotificationChannel["Call"] = "Call";
+    ComplianceNotificationChannel["SMS"] = "SMS";
+    ComplianceNotificationChannel["Push"] = "Push";
+    ComplianceNotificationChannel["Email"] = "Email";
+    ComplianceNotificationChannel["WhatsApp"] = "WhatsApp";
+    ComplianceNotificationChannel["Telegram"] = "Telegram";
+    ComplianceNotificationChannel["Slack"] = "Slack";
+    ComplianceNotificationChannel["MicrosoftTeams"] = "MicrosoftTeams";
+    ComplianceNotificationChannel["Webhook"] = "Webhook";
+})(ComplianceNotificationChannel || (ComplianceNotificationChannel = {}));
+export default ComplianceNotificationChannel;
+//# sourceMappingURL=ComplianceNotificationChannel.js.map

package/build/dist/Types/Team/ComplianceNotificationChannel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ComplianceNotificationChannel.js","sourceRoot":"","sources":["../../../../Types/Team/ComplianceNotificationChannel.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,IAAK,6BAUJ;AAVD,WAAK,6BAA6B;IAChC,8CAAa,CAAA;IACb,4CAAW,CAAA;IACX,8CAAa,CAAA;IACb,gDAAe,CAAA;IACf,sDAAqB,CAAA;IACrB,sDAAqB,CAAA;IACrB,gDAAe,CAAA;IACf,kEAAiC,CAAA;IACjC,oDAAmB,CAAA;AACrB,CAAC,EAVI,6BAA6B,KAA7B,6BAA6B,QAUjC;AAED,eAAe,6BAA6B,CAAC"}