@oneuptime/common 14.0.9 → 14.0.10

package/build/dist/Types/ResourceAiAgent/ResourceAiAccess.js

@@ -0,0 +1,275 @@
+/*
+ * OneUptime AI access to an infrastructure resource through its resource AI
+ * agent: the command tiers and remediation modes, the agent's posture, the
+ * access status the dashboard and the AI runs read, the agent <-> server
+ * wire protocol and the shared caps.
+ *
+ * The tier and mode enums carry exactly the string values of the Kubernetes
+ * ones (KubectlCommandTier, KubernetesAiRemediationMode — a Common test
+ * asserts it), so stored strings are interchangeable and every prompt,
+ * card and ladder that reads a tier or a mode means the same thing for a
+ * cluster and for any other resource.
+ *
+ * Imports only ./AiResourceType on purpose: the resource AI agent
+ * (agents/ResourceAIAgent) carries a byte-identical copy of this directory
+ * and must compile without the rest of Common.
+ */
+import { isAiResourceType } from "./AiResourceType";
+/*
+ * The tier the resource command policy assigns to one command. Tiers are the
+ * whole safety model: what a run may execute is a function of (tier, mode),
+ * never of prose in a prompt.
+ *
+ * Read:       inspects the resource and changes nothing (docker ps, pvesh
+ *             get, govc vm.info, ceph health, systemctl status, ...).
+ *             Investigations only ever run these.
+ * SafeWrite:  a reversible change to exactly ONE named object (restart one
+ *             container, start one VM, restart one unit, ...). Automatic mode
+ *             runs these without a human.
+ * RiskyWrite: a change that can take something down or alter what runs
+ *             (stop, kill, update, migrate, ...). Needs a human unless the
+ *             operator allowlisted the exact shape on the resource or the
+ *             resource bypasses approvals.
+ * Denied:     never runs, even with human approval (exec, run, rm, prune,
+ *             anything reading credentials, anything the policy does not
+ *             know).
+ */
+export var ResourceCommandTier;
+(function (ResourceCommandTier) {
+    ResourceCommandTier["Read"] = "Read";
+    ResourceCommandTier["SafeWrite"] = "SafeWrite";
+    ResourceCommandTier["RiskyWrite"] = "RiskyWrite";
+    ResourceCommandTier["Denied"] = "Denied";
+})(ResourceCommandTier || (ResourceCommandTier = {}));
+/*
+ * How OneUptime AI may change a resource once it has diagnosed a signal —
+ * the same four modes a Kubernetes cluster has.
+ *
+ * Disabled:        AI never proposes or runs a change on this resource.
+ * RequireApproval: AI composes a command plan and a human approves it with
+ *                  one click before anything runs.
+ * Automatic:       safe changes (SafeWrite) run without a human; a riskier
+ *                  change is proposed for approval unless the resource's
+ *                  allowlist names its exact shape.
+ * BypassApproval:  every change the policy allows — safe AND riskier — runs
+ *                  on its own, except what always needs a human.
+ *
+ * In EVERY mode: Denied commands never run, commands the policy marks
+ * requiresHuman always ask, and the agent itself refuses every write unless
+ * it was started with RESOURCE_AI_ALLOW_WRITES_ENV=true (and then only on
+ * the targets RESOURCE_AI_WRITE_TARGETS_ENV allows, never its protected
+ * targets).
+ */
+export var ResourceAiRemediationMode;
+(function (ResourceAiRemediationMode) {
+    ResourceAiRemediationMode["Disabled"] = "Disabled";
+    ResourceAiRemediationMode["RequireApproval"] = "RequireApproval";
+    ResourceAiRemediationMode["Automatic"] = "Automatic";
+    ResourceAiRemediationMode["BypassApproval"] = "BypassApproval";
+})(ResourceAiRemediationMode || (ResourceAiRemediationMode = {}));
+// The modes in which OneUptime AI executes changes without a human.
+export const UNATTENDED_RESOURCE_REMEDIATION_MODES = [
+    ResourceAiRemediationMode.Automatic,
+    ResourceAiRemediationMode.BypassApproval,
+];
+export function isUnattendedResourceRemediationMode(mode) {
+    return (mode !== undefined &&
+        mode !== null &&
+        UNATTENDED_RESOURCE_REMEDIATION_MODES.includes(mode));
+}
+/*
+ * A stored or submitted mode, exactly as spelled. Anything unknown is
+ * Disabled: a value this build cannot read must never widen what AI may do.
+ */
+export function parseResourceAiRemediationMode(value) {
+    if (typeof value === "string" &&
+        Object.values(ResourceAiRemediationMode).includes(value)) {
+        return value;
+    }
+    return ResourceAiRemediationMode.Disabled;
+}
+// The agent heartbeats every 30 seconds; it counts as online this long after.
+export const RESOURCE_AI_AGENT_ALIVE_WINDOW_IN_MINUTES = 5;
+// Every agent route (register, heartbeat, claim-next-job, ...) lives under it.
+export const RESOURCE_AI_AGENT_INGEST_PATH = "/resource-ai-agent-ingest";
+export const RESOURCE_AI_AGENT_IMAGE_REPOSITORY = "oneuptime/resource-ai-agent";
+// The Kubernetes AI agent uses 3876; both can run on one host.
+export const RESOURCE_AI_AGENT_DEFAULT_HEALTH_PORT = 3877;
+/*
+ * Environment the resource AI agent reads. The single source of truth: the
+ * agent's Config imports these from its copy of this file, and the install
+ * docs are pinned against them.
+ *
+ * RESOURCE_TYPE: which resource the agent serves (an agentAlias or an enum
+ *                value, read with parseAiResourceType).
+ * RESOURCE_NAME: overrides the identity otherwise read from the type's
+ *                identityEnvVars (the collector's own variables).
+ * ALLOW_WRITES:  "true" lets the agent run writes at all. Anything else —
+ *                unset included — keeps it read-only, whatever the dashboard
+ *                says.
+ * WRITE_TARGETS: comma-separated globs of the targets (container, service,
+ *                VM, unit, ... names) a write may touch. Empty or unset means
+ *                any target except the agent's protected ones.
+ * API_KEY:       the first non-empty of these authenticates registration
+ *                (the collectors already set one of them).
+ */
+export const RESOURCE_AI_AGENT_RESOURCE_TYPE_ENV = "ONEUPTIME_AI_AGENT_RESOURCE_TYPE";
+export const RESOURCE_AI_AGENT_RESOURCE_NAME_ENV = "ONEUPTIME_AI_AGENT_RESOURCE_NAME";
+export const RESOURCE_AI_ALLOW_WRITES_ENV = "ONEUPTIME_AI_ALLOW_WRITES";
+export const RESOURCE_AI_WRITE_TARGETS_ENV = "ONEUPTIME_AI_WRITE_TARGETS";
+export const RESOURCE_AI_AGENT_API_KEY_ENVS = [
+    "ONEUPTIME_API_KEY",
+    "ONEUPTIME_TELEMETRY_INGESTION_KEY",
+    "ONEUPTIME_SERVICE_TOKEN",
+];
+// Bounds parseResourceAiAgentPosture holds every posture to.
+export const MAX_POSTURE_LIST_ENTRIES = 64;
+export const MAX_POSTURE_STRING_LENGTH = 256;
+// Keys that would reach an object's prototype if assigned.
+const UNSAFE_OBJECT_KEYS = [
+    "__proto__",
+    "constructor",
+    "prototype",
+];
+// A display-only string: kept (trimmed, capped) when it is one, else null.
+function readDisplayString(value) {
+    if (typeof value !== "string") {
+        return null;
+    }
+    const trimmed = value.trim();
+    if (!trimmed) {
+        return null;
+    }
+    return trimmed.slice(0, MAX_POSTURE_STRING_LENGTH);
+}
+/*
+ * A list the write scope depends on. Absent reads as []; anything else must
+ * be an array of at most MAX_POSTURE_LIST_ENTRIES non-empty strings of at
+ * most MAX_POSTURE_STRING_LENGTH characters. A list that breaks the rules is
+ * reported as malformed (never partially trusted): dropping one entry of a
+ * protected list, or one of an allowlist, would change what a write may
+ * touch.
+ */
+function readTargetList(value) {
+    if (value === undefined || value === null) {
+        return { list: [], malformed: false };
+    }
+    if (!Array.isArray(value) || value.length > MAX_POSTURE_LIST_ENTRIES) {
+        return { list: [], malformed: true };
+    }
+    const list = [];
+    for (const entry of value) {
+        if (typeof entry !== "string") {
+            return { list: [], malformed: true };
+        }
+        const trimmed = entry.trim();
+        if (!trimmed || trimmed.length > MAX_POSTURE_STRING_LENGTH) {
+            return { list: [], malformed: true };
+        }
+        if (!list.includes(trimmed)) {
+            list.push(trimmed);
+        }
+    }
+    return { list, malformed: false };
+}
+function readDetails(value) {
+    const details = {};
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return details;
+    }
+    let count = 0;
+    for (const key of Object.keys(value)) {
+        if (count >= MAX_POSTURE_LIST_ENTRIES) {
+            break;
+        }
+        if (!key ||
+            key.length > MAX_POSTURE_STRING_LENGTH ||
+            UNSAFE_OBJECT_KEYS.includes(key)) {
+            continue;
+        }
+        const entry = value[key];
+        if (typeof entry === "string") {
+            details[key] = entry.slice(0, MAX_POSTURE_STRING_LENGTH);
+        }
+        else if (typeof entry === "number" && Number.isFinite(entry)) {
+            details[key] = entry;
+        }
+        else if (typeof entry === "boolean" || entry === null) {
+            details[key] = entry;
+        }
+        else {
+            continue;
+        }
+        count++;
+    }
+    return details;
+}
+/*
+ * Read a posture from an agent's request body or the ResourceAiAgent.posture
+ * column. Strict and fail-closed:
+ *   - null unless resourceType is exactly an AiResourceType value and
+ *     resourceIdentifier a non-empty string of at most 256 characters;
+ *   - allowWrites is true only for the boolean true;
+ *   - a malformed writeTargets or protectedTargets list (not an array of
+ *     non-empty strings, over 64 entries, an entry over 256 characters)
+ *     forces allowWrites to false rather than being partly trusted;
+ *   - display strings are trimmed and capped at 256 characters, details keep
+ *     only scalar values (at most 64 of them), and reportedAt only a
+ *     parseable date.
+ */
+export function parseResourceAiAgentPosture(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    const raw = value;
+    const resourceType = raw["resourceType"];
+    if (!isAiResourceType(resourceType)) {
+        return null;
+    }
+    const identifierRaw = raw["resourceIdentifier"];
+    if (typeof identifierRaw !== "string") {
+        return null;
+    }
+    const resourceIdentifier = identifierRaw.trim();
+    if (!resourceIdentifier ||
+        resourceIdentifier.length > MAX_POSTURE_STRING_LENGTH) {
+        return null;
+    }
+    const writeTargets = readTargetList(raw["writeTargets"]);
+    const protectedTargets = readTargetList(raw["protectedTargets"]);
+    const posture = {
+        resourceType,
+        resourceIdentifier,
+        agentVersion: readDisplayString(raw["agentVersion"]),
+        allowWrites: raw["allowWrites"] === true &&
+            !writeTargets.malformed &&
+            !protectedTargets.malformed,
+        allowWritesSetting: readDisplayString(raw["allowWritesSetting"]),
+        writeTargets: writeTargets.list,
+        protectedTargets: protectedTargets.list,
+        toolVersion: readDisplayString(raw["toolVersion"]),
+        reachable: raw["reachable"] === true,
+        reachError: readDisplayString(raw["reachError"]),
+        details: readDetails(raw["details"]),
+    };
+    const reportedAt = raw["reportedAt"];
+    if (typeof reportedAt === "string" &&
+        reportedAt.length <= 64 &&
+        !Number.isNaN(Date.parse(reportedAt))) {
+        posture.reportedAt = reportedAt;
+    }
+    return posture;
+}
+// The refusals that clear without anyone doing anything; retrying is right.
+export const TRANSIENT_RESOURCE_AI_AGENT_REGISTRATION_REFUSALS = ["previous_instance_online"];
+export function isTransientResourceAiAgentRegistrationRefusal(reason) {
+    return (typeof reason === "string" &&
+        TRANSIENT_RESOURCE_AI_AGENT_REGISTRATION_REFUSALS.includes(reason));
+}
+// Caps shared by the investigation tool, the remediation toolkit and the agent.
+export const MAX_RESOURCE_COMMANDS_PER_INVESTIGATION = 8;
+export const DEFAULT_RESOURCE_COMMAND_TIMEOUT_MS = 30 * 1000;
+export const MAX_RESOURCE_COMMAND_TIMEOUT_MS = 2 * 60 * 1000;
+export const MAX_RESOURCE_COMMAND_OUTPUT_CHARS_FOR_LLM = 8000;
+export const MAX_RESOURCE_AGENT_OUTPUT_BYTES = 50 * 1024;
+//# sourceMappingURL=ResourceAiAccess.js.map

package/build/dist/Types/ResourceAiAgent/ResourceAiAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResourceAiAccess.js","sourceRoot":"","sources":["../../../../Types/ResourceAiAgent/ResourceAiAccess.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAuB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAN,IAAY,mBAKX;AALD,WAAY,mBAAmB;IAC7B,oCAAa,CAAA;IACb,8CAAuB,CAAA;IACvB,gDAAyB,CAAA;IACzB,wCAAiB,CAAA;AACnB,CAAC,EALW,mBAAmB,KAAnB,mBAAmB,QAK9B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAN,IAAY,yBAKX;AALD,WAAY,yBAAyB;IACnC,kDAAqB,CAAA;IACrB,gEAAmC,CAAA;IACnC,oDAAuB,CAAA;IACvB,8DAAiC,CAAA;AACnC,CAAC,EALW,yBAAyB,KAAzB,yBAAyB,QAKpC;AAED,oEAAoE;AACpE,MAAM,CAAC,MAAM,qCAAqC,GAChD;IACE,yBAAyB,CAAC,SAAS;IACnC,yBAAyB,CAAC,cAAc;CACzC,CAAC;AAEJ,MAAM,UAAU,mCAAmC,CACjD,IAAkD;IAElD,OAAO,CACL,IAAI,KAAK,SAAS;QAClB,IAAI,KAAK,IAAI;QACb,qCAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC,CACrD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAAc;IAEd,IACE,OAAO,KAAK,KAAK,QAAQ;QACxB,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC3E,CAAC;QACD,OAAO,KAAkC,CAAC;IAC5C,CAAC;IAED,OAAO,yBAAyB,CAAC,QAAQ,CAAC;AAC5C,CAAC;AAUD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,yCAAyC,GAAW,CAAC,CAAC;AAEnE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,6BAA6B,GACxC,2BAA2B,CAAC;AAE9B,MAAM,CAAC,MAAM,kCAAkC,GAC7C,6BAA6B,CAAC;AAEhC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,qCAAqC,GAAW,IAAI,CAAC;AAElE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAC9C,kCAAkC,CAAC;AACrC,MAAM,CAAC,MAAM,mCAAmC,GAC9C,kCAAkC,CAAC;AACrC,MAAM,CAAC,MAAM,4BAA4B,GAAW,2BAA2B,CAAC;AAChF,MAAM,CAAC,MAAM,6BAA6B,GACxC,4BAA4B,CAAC;AAC/B,MAAM,CAAC,MAAM,8BAA8B,GAA0B;IACnE,mBAAmB;IACnB,mCAAmC;IACnC,yBAAyB;CAC1B,CAAC;AAyCF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,wBAAwB,GAAW,EAAE,CAAC;AACnD,MAAM,CAAC,MAAM,yBAAyB,GAAW,GAAG,CAAC;AAErD,2DAA2D;AAC3D,MAAM,kBAAkB,GAA0B;IAChD,WAAW;IACX,aAAa;IACb,WAAW;CACZ,CAAC;AAEF,2EAA2E;AAC3E,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAW,KAAK,CAAC,IAAI,EAAE,CAAC;IAErC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,KAAc;IAIpC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;QACrE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,IAAI,GAAkB,EAAE,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,OAAO,GAAW,KAAK,CAAC,IAAI,EAAE,CAAC;QAErC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;YAC3D,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAClB,KAAc;IAEd,MAAM,OAAO,GAAqD,EAAE,CAAC;IAErE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,KAAK,GAAW,CAAC,CAAC;IAEtB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,EAAE,CAAC;QAChE,IAAI,KAAK,IAAI,wBAAwB,EAAE,CAAC;YACtC,MAAM;QACR,CAAC;QAED,IACE,CAAC,GAAG;YACJ,GAAG,CAAC,MAAM,GAAG,yBAAyB;YACtC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAChC,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAa,KAAiC,CAAC,GAAG,CAAC,CAAC;QAE/D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;QAC3D,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/D,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,SAAS;QACX,CAAC;QAED,KAAK,EAAE,CAAC;IACV,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAA4B,KAAgC,CAAC;IAEtE,MAAM,YAAY,GAAY,GAAG,CAAC,cAAc,CAAC,CAAC;IAElD,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAY,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAEzD,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,kBAAkB,GAAW,aAAa,CAAC,IAAI,EAAE,CAAC;IAExD,IACE,CAAC,kBAAkB;QACnB,kBAAkB,CAAC,MAAM,GAAG,yBAAyB,EACrD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAChB,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IACtC,MAAM,gBAAgB,GACpB,cAAc,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAE1C,MAAM,OAAO,GAA2B;QACtC,YAAY;QACZ,kBAAkB;QAClB,YAAY,EAAE,iBAAiB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACpD,WAAW,EACT,GAAG,CAAC,aAAa,CAAC,KAAK,IAAI;YAC3B,CAAC,YAAY,CAAC,SAAS;YACvB,CAAC,gBAAgB,CAAC,SAAS;QAC7B,kBAAkB,EAAE,iBAAiB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAChE,YAAY,EAAE,YAAY,CAAC,IAAI;QAC/B,gBAAgB,EAAE,gBAAgB,CAAC,IAAI;QACvC,WAAW,EAAE,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAClD,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,KAAK,IAAI;QACpC,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;KACrC,CAAC;IAEF,MAAM,UAAU,GAAY,GAAG,CAAC,YAAY,CAAC,CAAC;IAE9C,IACE,OAAO,UAAU,KAAK,QAAQ;QAC9B,UAAU,CAAC,MAAM,IAAI,EAAE;QACvB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EACrC,CAAC;QACD,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;IAClC,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AA0JD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iDAAiD,GAC5D,CAAC,0BAA0B,CAAC,CAAC;AAE/B,MAAM,UAAU,6CAA6C,CAC3D,MAAe;IAEf,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;QAExB,iDACD,CAAC,QAAQ,CAAC,MAAM,CAAC,CACnB,CAAC;AACJ,CAAC;AAoBD,gFAAgF;AAChF,MAAM,CAAC,MAAM,uCAAuC,GAAW,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,mCAAmC,GAAW,EAAE,GAAG,IAAI,CAAC;AACrE,MAAM,CAAC,MAAM,+BAA+B,GAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACrE,MAAM,CAAC,MAAM,yCAAyC,GAAW,IAAI,CAAC;AACtE,MAAM,CAAC,MAAM,+BAA+B,GAAW,EAAE,GAAG,IAAI,CAAC"}

package/build/dist/Types/Rum/SessionReplayBudgetMetricType.js

@@ -0,0 +1,45 @@
+/*
+ * Metric names the session replay budget sweep posts every five minutes
+ * (Common/Server/Utils/SessionReplay/SessionReplayBudgetMetrics.ts), so the
+ * two storage budgets on the Replay Health page can be charted and alerted on
+ * like any other metric - the same way monitors post `oneuptime.monitor.*`
+ * and SLOs post `oneuptime.slo.*`. Without them a spent budget was only ever
+ * visible to someone looking at the Health page: recorders are told to stop,
+ * quietly, and recordings simply stop appearing.
+ *
+ * The values are stored verbatim as metric names in ClickHouse. Renaming one
+ * orphans every point already written under the old name and silences every
+ * monitor watching it, so treat them as a public, append-only contract.
+ *
+ * Every row is keyed to a RUM application (primaryEntityId = its id, type
+ * RealUserMonitor), which is what lets a monitor scoped to that application
+ * see it. The project series carry only a `projectId` attribute: the daily
+ * limit belongs to the project, and the same value is posted under each
+ * application that records, so nothing about the row may read as that
+ * application's own usage. The application series also carry
+ * `rumApplicationId` and `rumApplicationName`.
+ */
+var SessionReplayBudgetMetricType;
+(function (SessionReplayBudgetMetricType) {
+    /*
+     * Replay upload bytes the gate has charged since 00:00 UTC, for the whole
+     * project (every application together). Unit "By".
+     */
+    SessionReplayBudgetMetricType["ProjectDailyUsedBytes"] = "oneuptime.rum.session.replay.budget.project.daily.used.bytes";
+    /*
+     * The above as a percent of the deployment's daily limit, rounded down to
+     * 0.01 so ">= 100" means exactly what the gate means by "spent". Not
+     * capped: the request that crosses the limit stays charged. Unit "%".
+     */
+    SessionReplayBudgetMetricType["ProjectDailyUsedPercent"] = "oneuptime.rum.session.replay.budget.project.daily.used.percent";
+    /*
+     * Replay upload bytes charged to one application's monthly budget since the
+     * 1st (UTC). Only counted, and only posted, while the application has a
+     * monthly budget. Unit "By".
+     */
+    SessionReplayBudgetMetricType["ApplicationMonthlyUsedBytes"] = "oneuptime.rum.session.replay.budget.application.monthly.used.bytes";
+    // The above as a percent of the application's monthly budget. Unit "%".
+    SessionReplayBudgetMetricType["ApplicationMonthlyUsedPercent"] = "oneuptime.rum.session.replay.budget.application.monthly.used.percent";
+})(SessionReplayBudgetMetricType || (SessionReplayBudgetMetricType = {}));
+export default SessionReplayBudgetMetricType;
+//# sourceMappingURL=SessionReplayBudgetMetricType.js.map

package/build/dist/Types/Rum/SessionReplayBudgetMetricType.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionReplayBudgetMetricType.js","sourceRoot":"","sources":["../../../../Types/Rum/SessionReplayBudgetMetricType.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,IAAK,6BAuBJ;AAvBD,WAAK,6BAA6B;IAChC;;;OAGG;IACH,uHAAsF,CAAA;IAEtF;;;;OAIG;IACH,2HAA0F,CAAA;IAE1F;;;;OAIG;IACH,mIAAkG,CAAA;IAElG,wEAAwE;IACxE,uIAAsG,CAAA;AACxG,CAAC,EAvBI,6BAA6B,KAA7B,6BAA6B,QAuBjC;AAED,eAAe,6BAA6B,CAAC"}

package/build/dist/Types/Runbook/RunbookStepType.js

@@ -15,6 +15,15 @@ var RunbookStepType;
      * commands, remediations run policy-tiered writes); not authored in runbooks.
      */
     RunbookStepType["Kubectl"] = "Kubectl";
+    /*
+     * A single command for an infrastructure resource's AI agent (Docker,
+     * Podman, Docker Swarm, Proxmox, VMware, Ceph, a database server or a
+     * host), dispatched as an argv (never a shell line) to that resource's
+     * online ResourceAiAgent — never claimed by a Runner, never run by the
+     * Worker. Composed only by OneUptime AI and tiered by the resource command
+     * policy (Utils/AiRemediation/Resource); not authored in runbooks.
+     */
+    RunbookStepType["ResourceCommand"] = "ResourceCommand";
 })(RunbookStepType || (RunbookStepType = {}));
 export default RunbookStepType;
 /*
@@ -62,4 +71,22 @@ export const PAYLOAD_CARRYING_STEP_TYPES = [
 export function isPayloadCarryingStepType(type) {
     return PAYLOAD_CARRYING_STEP_TYPES.includes(type);
 }
+/*
+ * Step types executed by an infrastructure resource's AI agent (a
+ * ResourceAiAgent row), a third lane beside the Runner and the Worker. Such
+ * a job is written with targetResourceAiAgentId and no targetAgentId, so no
+ * Runner can claim it: RunnerJobService.enqueue refuses these types (they
+ * are not in RUNNER_EXECUTED_STEP_TYPES), a Runner may not ask for them on a
+ * claim, and the Worker's step switch has no case for them.
+ *
+ * Deliberately NOT in PAYLOAD_CARRYING_STEP_TYPES, which is the payload half
+ * of the Runner lane (a test asserts the two Runner halves are
+ * complementary); these jobs still carry their argv in RunnerJob.payload.
+ */
+export const AI_AGENT_EXECUTED_STEP_TYPES = [
+    RunbookStepType.ResourceCommand,
+];
+export function isAiAgentExecutedStepType(type) {
+    return AI_AGENT_EXECUTED_STEP_TYPES.includes(type);
+}
 //# sourceMappingURL=RunbookStepType.js.map

package/build/dist/Types/Runbook/RunbookStepType.js.map

@@ -1 +1 @@
-{"version":3,"file":"RunbookStepType.js","sourceRoot":"","sources":["../../../../Types/Runbook/RunbookStepType.ts"],"names":[],"mappings":"AAAA,IAAK,eAgBJ;AAhBD,WAAK,eAAe;IAClB,oCAAiB,CAAA;IACjB,4CAAyB,CAAA;IACzB,8CAA2B,CAAA;IAC3B,gCAAa,CAAA;IACb,4BAAS,CAAA;IACT,8BAAW,CAAA;IACX,4CAAyB,CAAA;IACzB;;;;;;OAMG;IACH,sCAAmB,CAAA;AACrB,CAAC,EAhBI,eAAe,KAAf,eAAe,QAgBnB;AAED,eAAe,eAAe,CAAC;AAE/B;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA2B;IAChE,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,IAAI;IACpB,eAAe,CAAC,GAAG;IACnB,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,OAAO;CACxB,CAAC;AAEF,MAAM,UAAU,wBAAwB,CAAC,IAAqB;IAC5D,OAAO,0BAA0B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAA2B;IACjE,eAAe,CAAC,GAAG;IACnB,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,OAAO;CACxB,CAAC;AAEF,MAAM,UAAU,yBAAyB,CAAC,IAAqB;IAC7D,OAAO,2BAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"RunbookStepType.js","sourceRoot":"","sources":["../../../../Types/Runbook/RunbookStepType.ts"],"names":[],"mappings":"AAAA,IAAK,eAyBJ;AAzBD,WAAK,eAAe;IAClB,oCAAiB,CAAA;IACjB,4CAAyB,CAAA;IACzB,8CAA2B,CAAA;IAC3B,gCAAa,CAAA;IACb,4BAAS,CAAA;IACT,8BAAW,CAAA;IACX,4CAAyB,CAAA;IACzB;;;;;;OAMG;IACH,sCAAmB,CAAA;IACnB;;;;;;;OAOG;IACH,sDAAmC,CAAA;AACrC,CAAC,EAzBI,eAAe,KAAf,eAAe,QAyBnB;AAED,eAAe,eAAe,CAAC;AAE/B;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA2B;IAChE,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,IAAI;IACpB,eAAe,CAAC,GAAG;IACnB,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,OAAO;CACxB,CAAC;AAEF,MAAM,UAAU,wBAAwB,CAAC,IAAqB;IAC5D,OAAO,0BAA0B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAA2B;IACjE,eAAe,CAAC,GAAG;IACnB,eAAe,CAAC,UAAU;IAC1B,eAAe,CAAC,OAAO;CACxB,CAAC;AAEF,MAAM,UAAU,yBAAyB,CAAC,IAAqB;IAC7D,OAAO,2BAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAA2B;IAClE,eAAe,CAAC,eAAe;CAChC,CAAC;AAEF,MAAM,UAAU,yBAAyB,CAAC,IAAqB;IAC7D,OAAO,4BAA4B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC"}

package/build/dist/Types/Telemetry/TelemetryIngestSurface.js

@@ -42,10 +42,19 @@ var TelemetryIngestSurface;
      * with. Server keys only, for the same reason as the Runner above.
      */
     TelemetryIngestSurface["KubernetesAiAgent"] = "kubernetes-ai-agent";
+    /*
+     * A resource AI agent (Docker, Podman, Docker Swarm, Proxmox, VMware,
+     * Ceph, a database server or a host) registers itself with the same
+     * project ingestion key its collector uses, and receives an agent key
+     * that every command for its resource is claimed with. Server keys only,
+     * for the same reason as the two above.
+     */
+    TelemetryIngestSurface["ResourceAiAgent"] = "resource-ai-agent";
 })(TelemetryIngestSurface || (TelemetryIngestSurface = {}));
 /*
- * Surfaces that mint an IDENTITY (a key that kubectl jobs for a cluster are
- * targeted at) rather than accept telemetry. The ingest middleware holds
+ * Surfaces that mint an IDENTITY (a key that kubectl jobs for a cluster, or
+ * commands for another infrastructure resource, are targeted at) rather
+ * than accept telemetry. The ingest middleware holds
  * every one of them to the same two extra rules, keyed on this set so a new
  * identity surface cannot quietly miss one:
  *
@@ -59,6 +68,7 @@ var TelemetryIngestSurface;
 export const IDENTITY_REGISTRATION_SURFACES = new Set([
     TelemetryIngestSurface.KubernetesAgentRunner,
     TelemetryIngestSurface.KubernetesAiAgent,
+    TelemetryIngestSurface.ResourceAiAgent,
 ]);
 /*
  * The only surfaces a Browser key may write to. This is an ALLOWLIST, not a
@@ -103,6 +113,7 @@ const INGEST_SURFACE_READABLE_NAMES = {
     [TelemetryIngestSurface.Mqtt]: "MQTT ingest",
     [TelemetryIngestSurface.KubernetesAgentRunner]: "Kubernetes agent Runner registration",
     [TelemetryIngestSurface.KubernetesAiAgent]: "Kubernetes AI agent registration",
+    [TelemetryIngestSurface.ResourceAiAgent]: "infrastructure AI agent registration",
 };
 export const getIngestSurfaceReadableName = (surface) => {
     /*

package/build/dist/Types/Telemetry/TelemetryIngestSurface.js.map

@@ -1 +1 @@
-{"version":3,"file":"TelemetryIngestSurface.js","sourceRoot":"","sources":["../../../../Types/Telemetry/TelemetryIngestSurface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,IAAK,sBA6BJ;AA7BD,WAAK,sBAAsB;IACzB,oDAA0B,CAAA;IAC1B,gDAAsB,CAAA;IACtB,sDAA4B,CAAA;IAC5B,wDAA8B,CAAA;IAC9B,0DAAgC,CAAA;IAChC,kDAAwB,CAAA;IACxB,2CAAiB,CAAA;IACjB,2CAAiB,CAAA;IACjB,iDAAuB,CAAA;IACvB,4DAAkC,CAAA;IAClC,wDAA8B,CAAA;IAC9B,4DAAkC,CAAA;IAClC,uCAAa,CAAA;IACb,uCAAa,CAAA;IACb;;;;;OAKG;IACH,2EAAiD,CAAA;IACjD;;;;;OAKG;IACH,mEAAyC,CAAA;AAC3C,CAAC,EA7BI,sBAAsB,KAAtB,sBAAsB,QA6B1B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,8BAA8B,GACzC,IAAI,GAAG,CAAyB;IAC9B,sBAAsB,CAAC,qBAAqB;IAC5C,sBAAsB,CAAC,iBAAiB;CACzC,CAAC,CAAC;AAEL;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAC1C,IAAI,GAAG,CAAyB;IAC9B,sBAAsB,CAAC,UAAU;IACjC,sBAAsB,CAAC,QAAQ;IAC/B,sBAAsB,CAAC,WAAW;IAClC,sBAAsB,CAAC,aAAa;CACrC,CAAC,CAAC;AAEL;;;;GAIG;AACH,MAAM,6BAA6B,GAA2C;IAC5E,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,mBAAmB;IACxD,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,iBAAiB;IACpD,CAAC,sBAAsB,CAAC,WAAW,CAAC,EAAE,oBAAoB;IAC1D,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,qBAAqB;IAC5D,CAAC,sBAAsB,CAAC,aAAa,CAAC,EAAE,uBAAuB;IAC/D,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE,mBAAmB;IACvD,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,eAAe;IAChD,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,6BAA6B;IAC9D,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE,0BAA0B;IAC9D,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,wBAAwB;IACjE,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,qBAAqB;IAC5D,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,uBAAuB;IAChE,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,aAAa;IAC5C,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,aAAa;IAC5C,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAC5C,sCAAsC;IACxC,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EACxC,kCAAkC;CACrC,CAAC;AAMF,MAAM,CAAC,MAAM,4BAA4B,GACvC,CAAC,OAA+B,EAAU,EAAE;IAC1C;;;;;OAKG;IACH,MAAM,YAAY,GAChB,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAEzC,OAAO,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC,CAAC;AAEJ,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"TelemetryIngestSurface.js","sourceRoot":"","sources":["../../../../Types/Telemetry/TelemetryIngestSurface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,IAAK,sBAqCJ;AArCD,WAAK,sBAAsB;IACzB,oDAA0B,CAAA;IAC1B,gDAAsB,CAAA;IACtB,sDAA4B,CAAA;IAC5B,wDAA8B,CAAA;IAC9B,0DAAgC,CAAA;IAChC,kDAAwB,CAAA;IACxB,2CAAiB,CAAA;IACjB,2CAAiB,CAAA;IACjB,iDAAuB,CAAA;IACvB,4DAAkC,CAAA;IAClC,wDAA8B,CAAA;IAC9B,4DAAkC,CAAA;IAClC,uCAAa,CAAA;IACb,uCAAa,CAAA;IACb;;;;;OAKG;IACH,2EAAiD,CAAA;IACjD;;;;;OAKG;IACH,mEAAyC,CAAA;IACzC;;;;;;OAMG;IACH,+DAAqC,CAAA;AACvC,CAAC,EArCI,sBAAsB,KAAtB,sBAAsB,QAqC1B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,8BAA8B,GACzC,IAAI,GAAG,CAAyB;IAC9B,sBAAsB,CAAC,qBAAqB;IAC5C,sBAAsB,CAAC,iBAAiB;IACxC,sBAAsB,CAAC,eAAe;CACvC,CAAC,CAAC;AAEL;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAC1C,IAAI,GAAG,CAAyB;IAC9B,sBAAsB,CAAC,UAAU;IACjC,sBAAsB,CAAC,QAAQ;IAC/B,sBAAsB,CAAC,WAAW;IAClC,sBAAsB,CAAC,aAAa;CACrC,CAAC,CAAC;AAEL;;;;GAIG;AACH,MAAM,6BAA6B,GAA2C;IAC5E,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,mBAAmB;IACxD,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,iBAAiB;IACpD,CAAC,sBAAsB,CAAC,WAAW,CAAC,EAAE,oBAAoB;IAC1D,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,qBAAqB;IAC5D,CAAC,sBAAsB,CAAC,aAAa,CAAC,EAAE,uBAAuB;IAC/D,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE,mBAAmB;IACvD,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,eAAe;IAChD,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,6BAA6B;IAC9D,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE,0BAA0B;IAC9D,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,wBAAwB;IACjE,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,qBAAqB;IAC5D,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,uBAAuB;IAChE,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,aAAa;IAC5C,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,aAAa;IAC5C,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,EAC5C,sCAAsC;IACxC,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EACxC,kCAAkC;IACpC,CAAC,sBAAsB,CAAC,eAAe,CAAC,EACtC,sCAAsC;CACzC,CAAC;AAMF,MAAM,CAAC,MAAM,4BAA4B,GACvC,CAAC,OAA+B,EAAU,EAAE;IAC1C;;;;;OAKG;IACH,MAAM,YAAY,GAChB,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAEzC,OAAO,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC,CAAC;AAEJ,eAAe,sBAAsB,CAAC"}

package/build/dist/Utils/AI/InvestigationReport.js

@@ -99,16 +99,20 @@ const LEADING_WHITESPACE_REGEX = /^[ \t]/;
  * "- **[C1]** label — 7 row(s)", or a cluster tool's line, which says what
  * the call did instead of counting rows: "— succeeded", "— kubectl returned
  * an error", "— 2 cluster(s)" (and "— never ran" / "— result unknown" for a
- * kubectl command that gave no result). The label is greedy so a label
- * that itself contains " — " keeps everything up to the LAST " — <outcome>".
+ * kubectl command that gave no result). An infrastructure tool's line says
+ * "— succeeded", "— command returned an error" or "— 3 resource(s)". The
+ * label is greedy so a label that itself contains " — " keeps everything
+ * up to the LAST " — <outcome>".
  */
-const EVIDENCE_CHECKED_ENTRY_REGEX = /^[ \t]*(?:[-*+]|\d{1,3}[.)])[ \t]+(?:\*\*|__)?\[(C\d{1,3})\](?:\*\*|__)?(.+)[ \t][—–-][ \t]+(\d+[ \t]+(?:rows?|clusters?)(?:\(s\))?|succeeded|kubectl[ \t]+returned[ \t]+an[ \t]+error|never[ \t]+ran|did[ \t]+not[ \t]+run|(?:kubectl[ \t]+)?result[ \t]+unknown|unknown)[ \t]*$/i;
+const EVIDENCE_CHECKED_ENTRY_REGEX = /^[ \t]*(?:[-*+]|\d{1,3}[.)])[ \t]+(?:\*\*|__)?\[(C\d{1,3})\](?:\*\*|__)?(.+)[ \t][—–-][ \t]+(\d+[ \t]+(?:rows?|clusters?|resources?)(?:\(s\))?|succeeded|kubectl[ \t]+returned[ \t]+an[ \t]+error|command[ \t]+returned[ \t]+an[ \t]+error|never[ \t]+ran|did[ \t]+not[ \t]+run|(?:kubectl[ \t]+)?result[ \t]+unknown|unknown)[ \t]*$/i;
 // The entry regex backtracks over the label; never feed it a runaway line.
 const MAX_EVIDENCE_CHECKED_LINE_LENGTH = 2000;
 // How one entry's outcome (group 3 of the entry regex) reads.
 const EVIDENCE_ROWS_OUTCOME_REGEX = /^(\d+)[ \t]+rows?(?:\(s\))?$/i;
 const EVIDENCE_CLUSTERS_OUTCOME_REGEX = /^(\d+)[ \t]+clusters?(?:\(s\))?$/i;
 const EVIDENCE_KUBECTL_SUCCEEDED_REGEX = /^succeeded$/i;
+const EVIDENCE_RESOURCES_OUTCOME_REGEX = /^(\d+)[ \t]+resources?(?:\(s\))?$/i;
+const EVIDENCE_INFRASTRUCTURE_ERROR_REGEX = /^command[ \t]+returned[ \t]+an[ \t]+error$/i;
 const FOOTER_EMPHASIS_REGEX = /^(\*\*|__|\*|_)([\s\S]+)\1$/;
 const FOOTER_USING_REGEX = /\busing[ \t]+/;
 const FOOTER_QUERIES_RUN_REGEX = /\bquer(?:y|ies)[ \t]+run\b/i;
@@ -116,6 +120,15 @@ const FOOTER_QUERIES_RUN_REGEX = /\bquer(?:y|ies)[ \t]+run\b/i;
 const FOOTER_KUBECTL_COMMANDS_RUN_REGEX = /\b(\d{1,9})[ \t]+kubectl[ \t]+commands?[ \t]+run\b/i;
 // A run that used cluster tools but cited no query and no kubectl command.
 const FOOTER_NOTHING_RUN_REGEX = /\bno[ \t]+telemetry[ \t]+queries[ \t]+or[ \t]+kubectl[ \t]+commands[ \t]+run\b/i;
+// "... and 3 infrastructure commands run on your infrastructure" -> 3.
+const FOOTER_INFRASTRUCTURE_COMMANDS_RUN_REGEX = /\b(\d{1,9})[ \t]+infrastructure[ \t]+commands?[ \t]+run\b/i;
+/*
+ * A run that used the infrastructure tools (and maybe the cluster ones) but
+ * cited no query and no command: "no telemetry queries or infrastructure
+ * commands run", "no telemetry queries, kubectl commands or infrastructure
+ * commands run".
+ */
+const FOOTER_NOTHING_RUN_WITH_INFRASTRUCTURE_REGEX = /\bno[ \t]+telemetry[ \t]+queries(,[ \t]+kubectl[ \t]+commands)?[ \t]+or[ \t]+infrastructure[ \t]+commands[ \t]+run\b/i;
 const DIGIT_REGEX = /\d/;
 const EVENT_REFERENCE_PATTERN = "#(\\d{1,9})(?!\\w)";
 const WORD_CHARACTER_REGEX = /\w/;
@@ -588,20 +601,33 @@ function findFooter(lines, fenced) {
         footer.modelName = modelName;
     }
     const nothingRun = FOOTER_NOTHING_RUN_REGEX.test(text);
-    const queryCount = nothingRun
-        ? 0
-        : readFooterQueryCount(text);
+    const nothingRunWithInfrastructure = FOOTER_NOTHING_RUN_WITH_INFRASTRUCTURE_REGEX.exec(text);
+    const queryCount = nothingRun || nothingRunWithInfrastructure ? 0 : readFooterQueryCount(text);
     if (queryCount !== undefined) {
         footer.queryCount = queryCount;
     }
-    const kubectlCommandCount = nothingRun
+    const kubectlCommandCount = nothingRun || (nothingRunWithInfrastructure === null || nothingRunWithInfrastructure === void 0 ? void 0 : nothingRunWithInfrastructure[1])
         ? 0
         : readFooterKubectlCommandCount(text);
     if (kubectlCommandCount !== undefined) {
         footer.kubectlCommandCount = kubectlCommandCount;
     }
+    const infrastructureCommandCount = nothingRunWithInfrastructure
+        ? 0
+        : readFooterInfrastructureCommandCount(text);
+    if (infrastructureCommandCount !== undefined) {
+        footer.infrastructureCommandCount = infrastructureCommandCount;
+    }
     return { breakIndex, footer };
 }
+/*
+ * "... and 3 infrastructure commands run on ..." / "1 infrastructure
+ * command run" -> 3 / 1.
+ */
+function readFooterInfrastructureCommandCount(text) {
+    const commands = FOOTER_INFRASTRUCTURE_COMMANDS_RUN_REGEX.exec(text);
+    return commands ? parseInt(commands[1] || "0", 10) : undefined;
+}
 // "... and 2 kubectl commands run on ..." / "1 kubectl command run" -> 2 / 1.
 function readFooterKubectlCommandCount(text) {
     const commands = FOOTER_KUBECTL_COMMANDS_RUN_REGEX.exec(text);
@@ -698,6 +724,18 @@ function readEvidenceCheckedOutcome(outcomeText) {
             outcome,
         };
     }
+    const resources = EVIDENCE_RESOURCES_OUTCOME_REGEX.exec(outcome);
+    if (resources) {
+        return {
+            kind: "resources",
+            rowCount: parseInt(resources[1] || "0", 10),
+            outcome,
+        };
+    }
+    // An infrastructure command that ran and returned an error counts as 0.
+    if (EVIDENCE_INFRASTRUCTURE_ERROR_REGEX.test(outcome)) {
+        return { kind: "infrastructure", rowCount: 0, outcome };
+    }
     /*
      * The engine counts a kubectl command that succeeded as 1 and one that
      * returned an error as 0; a command with no result has nothing to count.
@@ -750,15 +788,25 @@ function parseEvidenceCheckedEntries(lines) {
  * the one run whose only citations are listings. A footer saying "0
  * queries run" never goes with a block. Without a readable count (no
  * footer, an older format) the block is trusted.
+ *
+ * Infrastructure commands follow the same rule against the footer's
+ * infrastructure count, and a resource listing like a cluster listing. A
+ * line the two command tools share ("succeeded") fits their counts
+ * together; a footer that says nothing about infrastructure reads as 0 of
+ * them, so every older report is judged exactly as it was.
  */
 function isServerEvidenceCheckedBlock(entries, footer) {
     const queryCount = footer === null || footer === void 0 ? void 0 : footer.queryCount;
     const kubectlCommandCount = footer === null || footer === void 0 ? void 0 : footer.kubectlCommandCount;
-    if (queryCount === undefined && kubectlCommandCount === undefined) {
+    const infrastructureCommandCount = footer === null || footer === void 0 ? void 0 : footer.infrastructureCommandCount;
+    if (queryCount === undefined &&
+        kubectlCommandCount === undefined &&
+        infrastructureCommandCount === undefined) {
         return true;
     }
     let queryLines = 0;
     let kubectlLines = 0;
+    let infrastructureLines = 0;
     let clusterLines = 0;
     for (const parsed of entries) {
         if (parsed.kind === "query") {
@@ -767,6 +815,9 @@ function isServerEvidenceCheckedBlock(entries, footer) {
         else if (parsed.kind === "kubectl") {
             kubectlLines++;
         }
+        else if (parsed.kind === "infrastructure") {
+            infrastructureLines++;
+        }
         else {
             clusterLines++;
         }
@@ -774,13 +825,22 @@ function isServerEvidenceCheckedBlock(entries, footer) {
     if (queryLines > (queryCount !== null && queryCount !== void 0 ? queryCount : 0)) {
         return false;
     }
-    if (kubectlLines > (kubectlCommandCount !== null && kubectlCommandCount !== void 0 ? kubectlCommandCount : 0)) {
+    if (infrastructureLines > (infrastructureCommandCount !== null && infrastructureCommandCount !== void 0 ? infrastructureCommandCount : 0)) {
+        return false;
+    }
+    if (kubectlLines + infrastructureLines >
+        (kubectlCommandCount !== null && kubectlCommandCount !== void 0 ? kubectlCommandCount : 0) + (infrastructureCommandCount !== null && infrastructureCommandCount !== void 0 ? infrastructureCommandCount : 0)) {
         return false;
     }
-    if ((queryCount !== null && queryCount !== void 0 ? queryCount : 0) + (kubectlCommandCount !== null && kubectlCommandCount !== void 0 ? kubectlCommandCount : 0) > 0) {
+    if ((queryCount !== null && queryCount !== void 0 ? queryCount : 0) +
+        (kubectlCommandCount !== null && kubectlCommandCount !== void 0 ? kubectlCommandCount : 0) +
+        (infrastructureCommandCount !== null && infrastructureCommandCount !== void 0 ? infrastructureCommandCount : 0) >
+        0) {
         return true;
     }
-    return kubectlCommandCount !== undefined && clusterLines > 0;
+    return ((kubectlCommandCount !== undefined ||
+        infrastructureCommandCount !== undefined) &&
+        clusterLines > 0);
 }
 function createEmptyReport() {
     return {