@opengeni/interaction 0.2.2 → 0.4.1

package/dist/controller-core.d.ts

@@ -43,7 +43,7 @@ type InteractionDriver<TCommand extends InteractionCoreCommand, TTarget extends
     target(targetId: string): Promise<TTarget | null>;
     observe(targetId: string): Promise<TObservation>;
     validate?(command: TCommand, target: TTarget): Promise<void> | void;
-    dispatch(command: TCommand): Promise<TObservation>;
+    dispatch(command: TCommand): Promise<TObservation | null>;
 };
 type InteractionCoreAdapter<TCommand extends InteractionCoreCommand, TTarget extends InteractionCoreTarget, TObservation extends InteractionCoreObservation<TTarget>, TReceipt extends InteractionCoreReceipt<TObservation>> = {
     resourceLabel: string;
@@ -76,6 +76,10 @@ export type InteractionControllerCoreOptions<TCommand extends InteractionCoreCom
     now?: () => Date;
     initialJournal?: readonly InteractionOperationJournalRecord<TReceipt>[];
     onJournalRecord?: (record: InteractionOperationJournalRecord<TReceipt>) => Promise<void> | void;
+    /** Override only when a private command contains ephemeral secret material.
+     * The callback must bind every non-secret semantic input while excluding the
+     * value bytes themselves and return lowercase SHA-256. */
+    commandDigest?: (command: TCommand) => string;
 };
 /**
  * Resource-neutral placement mutation authority. Public Browser and Computer
@@ -89,6 +93,7 @@ export declare class InteractionControllerCore<TCommand extends InteractionCoreC
     private readonly maxJournalEntries;
     private readonly now;
     private readonly onJournalRecord;
+    private readonly commandDigest;
     private readonly journal;
     private readonly targetTails;
     constructor(options: InteractionControllerCoreOptions<TCommand, TTarget, TObservation, TReceipt>);

package/dist/index.d.ts

@@ -1,11 +1,11 @@
-import { type BrowserActionCommand as BrowserActionCommandValue, type BrowserActionReceipt as BrowserActionReceiptValue, type BrowserObservation as BrowserObservationValue, type BrowserTarget as BrowserTargetValue, type ComputerActionCommand as ComputerActionCommandValue, type ComputerActionReceipt as ComputerActionReceiptValue, type ComputerObservation as ComputerObservationValue, type ComputerTarget as ComputerTargetValue } from "@opengeni/contracts";
+import { type BrowserActionCommand as BrowserActionCommandValue, type BrowserActionReceipt as BrowserActionReceiptValue, type BrowserObservation as BrowserObservationValue, type BrowserProtectedAuthFillCommand as BrowserProtectedAuthFillCommandValue, type BrowserProtectedAuthFillReceipt as BrowserProtectedAuthFillReceiptValue, type BrowserProtectedAuthObservation as BrowserProtectedAuthObservationValue, type BrowserTarget as BrowserTargetValue, type ComputerActionCommand as ComputerActionCommandValue, type ComputerActionReceipt as ComputerActionReceiptValue, type ComputerObservation as ComputerObservationValue, type ComputerTarget as ComputerTargetValue } from "@opengeni/contracts";
 import { InteractionControllerError, InteractionDefiniteDriverError, type InteractionControllerErrorCode, type InteractionOperationJournalRecord } from "./controller-core.js";
 export { InteractionControllerError, InteractionDefiniteDriverError, type InteractionControllerErrorCode, };
 export type BrowserInteractionDriver = {
     target(targetId: string): Promise<BrowserTargetValue | null>;
     observe(targetId: string): Promise<BrowserObservationValue>;
     validate?(command: BrowserActionCommandValue, target: BrowserTargetValue): Promise<void> | void;
-    dispatch(command: BrowserActionCommandValue): Promise<BrowserObservationValue>;
+    dispatch(command: BrowserActionCommandValue): Promise<BrowserObservationValue | null>;
 };
 export type BrowserInteractionAuthority = {
     authorizeDispatch(command: BrowserActionCommandValue): Promise<void> | void;
@@ -32,11 +32,43 @@ export declare class BrowserInteractionController {
     waitForIdle(): Promise<void>;
 }
 export declare function recoverBrowserOperationJournalRecord(record: BrowserOperationJournalRecord, settledAt: string): BrowserOperationJournalRecord;
+export type BrowserProtectedAuthDriver = {
+    target(targetId: string): Promise<BrowserTargetValue | null>;
+    observe(targetId: string): Promise<BrowserProtectedAuthObservationValue>;
+    validate?(command: BrowserProtectedAuthFillCommandValue, target: BrowserTargetValue): Promise<void> | void;
+    dispatch(command: BrowserProtectedAuthFillCommandValue): Promise<BrowserProtectedAuthObservationValue>;
+};
+export type BrowserProtectedAuthAuthority = {
+    authorizeDispatch(command: BrowserProtectedAuthFillCommandValue): Promise<void> | void;
+};
+export type BrowserProtectedAuthOperationJournalRecord = InteractionOperationJournalRecord<BrowserProtectedAuthFillReceiptValue>;
+export type BrowserProtectedAuthControllerOptions = {
+    browserSessionId: string;
+    controllerGeneration: string;
+    driver: BrowserProtectedAuthDriver;
+    authority?: BrowserProtectedAuthAuthority;
+    maxJournalEntries?: number;
+    now?: () => Date;
+    initialJournal?: readonly BrowserProtectedAuthOperationJournalRecord[];
+    onJournalRecord?: (record: BrowserProtectedAuthOperationJournalRecord) => Promise<void> | void;
+};
+/** Secret-bearing commands are admitted only through this controller-private
+ * authority. Its durable digest binds all semantics plus credential version,
+ * but deliberately excludes ephemeral password/TOTP value bytes. */
+export declare class BrowserProtectedAuthController {
+    private readonly core;
+    constructor(options: BrowserProtectedAuthControllerOptions);
+    run(command: BrowserProtectedAuthFillCommandValue): Promise<BrowserProtectedAuthFillReceiptValue>;
+    receipt(operationId: string): BrowserProtectedAuthFillReceiptValue | null;
+    journalSnapshot(): BrowserProtectedAuthOperationJournalRecord[];
+    waitForIdle(): Promise<void>;
+}
+export declare function recoverBrowserProtectedAuthOperationJournalRecord(record: BrowserProtectedAuthOperationJournalRecord, settledAt: string): BrowserProtectedAuthOperationJournalRecord;
 export type ComputerInteractionDriver = {
     target(targetId: string): Promise<ComputerTargetValue | null>;
     observe(targetId: string): Promise<ComputerObservationValue>;
     validate?(command: ComputerActionCommandValue, target: ComputerTargetValue): Promise<void> | void;
-    dispatch(command: ComputerActionCommandValue): Promise<ComputerObservationValue>;
+    dispatch(command: ComputerActionCommandValue): Promise<ComputerObservationValue | null>;
 };
 export type ComputerInteractionAuthority = {
     authorizeDispatch(command: ComputerActionCommandValue): Promise<void> | void;

package/dist/index.js

@@ -1,8 +1,12 @@
 // src/index.ts
+import { createHash as createHash2 } from "crypto";
 import {
   BrowserActionCommand,
   BrowserActionReceipt,
   BrowserObservation,
+  BrowserProtectedAuthFillCommand,
+  BrowserProtectedAuthFillReceipt,
+  BrowserProtectedAuthObservation,
   BrowserTarget,
   ComputerActionCommand,
   ComputerActionReceipt,
@@ -40,6 +44,7 @@ var InteractionControllerCore = class {
   maxJournalEntries;
   now;
   onJournalRecord;
+  commandDigest;
   journal = /* @__PURE__ */ new Map();
   targetTails = /* @__PURE__ */ new Map();
   constructor(options) {
@@ -49,6 +54,7 @@ var InteractionControllerCore = class {
     this.maxJournalEntries = options.maxJournalEntries ?? 1e4;
     this.now = options.now ?? (() => /* @__PURE__ */ new Date());
     this.onJournalRecord = options.onJournalRecord;
+    this.commandDigest = options.commandDigest ?? digestJson;
     if (!Number.isSafeInteger(this.maxJournalEntries) || this.maxJournalEntries < 1) {
       throw new Error("maxJournalEntries must be a positive safe integer");
     }
@@ -63,7 +69,10 @@ var InteractionControllerCore = class {
   run(commandInput) {
     const command = this.adapter.parseCommand(commandInput);
     this.adapter.assertCommandAuthority(command);
-    const commandDigest = digestJson(command);
+    const commandDigest = this.commandDigest(command);
+    if (!/^[0-9a-f]{64}$/u.test(commandDigest)) {
+      throw new Error(`${this.adapter.resourceLabel} command digest must be lowercase SHA-256`);
+    }
     const existing = this.journal.get(command.operationId);
     if (existing) {
       if (existing.commandDigest !== commandDigest) {
@@ -154,8 +163,9 @@ var InteractionControllerCore = class {
       );
     }
     try {
-      const observation = this.adapter.parseObservation(await this.driver.dispatch(command));
-      this.adapter.assertObservationAuthority(observation, command.targetId);
+      const dispatchedObservation = await this.driver.dispatch(command);
+      const observation = dispatchedObservation === null ? null : this.adapter.parseObservation(dispatchedObservation);
+      if (observation) this.adapter.assertObservationAuthority(observation, command.targetId);
       const completed = this.makeReceipt(
         command,
         "completed",
@@ -371,13 +381,15 @@ var BrowserInteractionController = class {
           if (command.expectedTargetGeneration !== target.targetGeneration) {
             throw new InteractionControllerError(
               "target_stale",
-              "browser target changed before the command could dispatch"
+              "browser target changed before the command could dispatch",
+              true
             );
           }
           if (command.expectedDocumentGeneration !== target.documentGeneration) {
             throw new InteractionControllerError(
               "document_stale",
-              "browser document changed before the command could dispatch"
+              "browser document changed before the command could dispatch",
+              true
             );
           }
         },
@@ -447,6 +459,145 @@ function recoverBrowserOperationJournalRecord(record, settledAt) {
     )
   };
 }
+var BrowserProtectedAuthController = class {
+  core;
+  constructor(options) {
+    const { browserSessionId, controllerGeneration } = options;
+    this.core = new InteractionControllerCore({
+      driver: options.driver,
+      ...options.authority ? { authority: options.authority } : {},
+      ...options.maxJournalEntries !== void 0 ? { maxJournalEntries: options.maxJournalEntries } : {},
+      ...options.now ? { now: options.now } : {},
+      ...options.initialJournal ? { initialJournal: options.initialJournal } : {},
+      ...options.onJournalRecord ? { onJournalRecord: options.onJournalRecord } : {},
+      commandDigest: protectedAuthCommandDigest,
+      adapter: {
+        resourceLabel: "browser protected fill",
+        parseCommand: (value) => BrowserProtectedAuthFillCommand.parse(value),
+        parseTarget: (value) => BrowserTarget.parse(value),
+        parseObservation: (value) => BrowserProtectedAuthObservation.parse(value),
+        parseReceipt: (value) => BrowserProtectedAuthFillReceipt.parse(value),
+        assertCommandAuthority(command) {
+          if (command.browserSessionId !== browserSessionId) {
+            throw new InteractionControllerError(
+              "resource_not_found",
+              "protected fill targets another browser session"
+            );
+          }
+          if (command.controllerGeneration !== controllerGeneration) {
+            throw new InteractionControllerError(
+              "controller_stale",
+              "protected fill targets a stale browser controller"
+            );
+          }
+        },
+        assertTargetAuthority(target) {
+          if (target.browserSessionId !== browserSessionId || target.controllerGeneration !== controllerGeneration) {
+            throw new InteractionControllerError(
+              "controller_stale",
+              "protected-fill target belongs to a stale browser controller"
+            );
+          }
+        },
+        assertExpectedGenerations(command, target) {
+          if (command.expectedTargetGeneration !== target.targetGeneration) {
+            throw new InteractionControllerError(
+              "target_stale",
+              "browser target changed before protected fill",
+              true
+            );
+          }
+          if (command.expectedDocumentGeneration !== target.documentGeneration) {
+            throw new InteractionControllerError(
+              "document_stale",
+              "browser document changed before protected fill",
+              true
+            );
+          }
+        },
+        assertObservationAuthority(observation, targetId) {
+          if (observation.target.id !== targetId || observation.target.browserSessionId !== browserSessionId || observation.target.controllerGeneration !== controllerGeneration) {
+            throw new InteractionControllerError(
+              "driver_failed",
+              "protected-fill driver returned a result outside controller authority"
+            );
+          }
+        },
+        makeReceipt(input) {
+          return BrowserProtectedAuthFillReceipt.parse({
+            protocolVersion: 1,
+            operationId: input.command.operationId,
+            browserSessionId,
+            controllerGeneration,
+            targetId: input.command.targetId,
+            state: input.state,
+            dispatchedAt: input.dispatchedAt,
+            settledAt: input.settledAt,
+            observation: input.observation,
+            error: input.error
+          });
+        },
+        recoverReceipt(receipt, settledAt) {
+          if (receipt.browserSessionId !== browserSessionId || receipt.controllerGeneration !== controllerGeneration) {
+            throw new Error(
+              `restored protected-fill operation ${receipt.operationId} is outside controller authority`
+            );
+          }
+          return recoverInteractionReceipt(
+            receipt,
+            settledAt,
+            "browser protected fill",
+            (value) => BrowserProtectedAuthFillReceipt.parse(value)
+          );
+        }
+      }
+    });
+  }
+  run(command) {
+    return this.core.run(command);
+  }
+  receipt(operationId) {
+    return this.core.receipt(operationId);
+  }
+  journalSnapshot() {
+    return this.core.journalSnapshot();
+  }
+  waitForIdle() {
+    return this.core.waitForIdle();
+  }
+};
+function recoverBrowserProtectedAuthOperationJournalRecord(record, settledAt) {
+  const receipt = BrowserProtectedAuthFillReceipt.parse(record.receipt);
+  return {
+    ...record,
+    receipt: recoverInteractionReceipt(
+      receipt,
+      settledAt,
+      "browser protected fill",
+      (value) => BrowserProtectedAuthFillReceipt.parse(value)
+    )
+  };
+}
+function protectedAuthCommandDigest(command) {
+  const { fields, ...metadata } = command;
+  const secretFree = {
+    ...metadata,
+    fields: fields.map(({ value: _value, ...field }) => field)
+  };
+  return createHash2("sha256").update(canonicalJson2(secretFree), "utf8").digest("hex");
+}
+function canonicalJson2(value) {
+  return JSON.stringify(canonicalJsonValue2(value));
+}
+function canonicalJsonValue2(value) {
+  if (Array.isArray(value)) return value.map(canonicalJsonValue2);
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).filter(([, entry]) => entry !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => [key, canonicalJsonValue2(entry)])
+    );
+  }
+  return value;
+}
 var ComputerInteractionController = class {
   core;
   constructor(options) {
@@ -490,7 +641,8 @@ var ComputerInteractionController = class {
           if (command.expectedTargetGeneration !== target.targetGeneration) {
             throw new InteractionControllerError(
               "target_stale",
-              "computer target changed before the command could dispatch"
+              "computer target changed before the command could dispatch",
+              true
             );
           }
         },
@@ -562,10 +714,12 @@ function recoverComputerOperationJournalRecord(record, settledAt) {
 }
 export {
   BrowserInteractionController,
+  BrowserProtectedAuthController,
   ComputerInteractionController,
   InteractionControllerError,
   InteractionDefiniteDriverError,
   recoverBrowserOperationJournalRecord,
+  recoverBrowserProtectedAuthOperationJournalRecord,
   recoverComputerOperationJournalRecord
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/controller-core.ts"],"sourcesContent":["import {\n  BrowserActionCommand,\n  BrowserActionReceipt,\n  BrowserObservation,\n  BrowserTarget,\n  ComputerActionCommand,\n  ComputerActionReceipt,\n  ComputerObservation,\n  ComputerTarget,\n  type BrowserActionCommand as BrowserActionCommandValue,\n  type BrowserActionReceipt as BrowserActionReceiptValue,\n  type BrowserObservation as BrowserObservationValue,\n  type BrowserTarget as BrowserTargetValue,\n  type ComputerActionCommand as ComputerActionCommandValue,\n  type ComputerActionReceipt as ComputerActionReceiptValue,\n  type ComputerObservation as ComputerObservationValue,\n  type ComputerTarget as ComputerTargetValue,\n} from \"@opengeni/contracts\";\nimport {\n  InteractionControllerCore,\n  InteractionControllerError,\n  InteractionDefiniteDriverError,\n  recoverInteractionReceipt,\n  type InteractionControllerErrorCode,\n  type InteractionOperationJournalRecord,\n} from \"./controller-core\";\n\nexport {\n  InteractionControllerError,\n  InteractionDefiniteDriverError,\n  type InteractionControllerErrorCode,\n};\n\nexport type BrowserInteractionDriver = {\n  target(targetId: string): Promise<BrowserTargetValue | null>;\n  observe(targetId: string): Promise<BrowserObservationValue>;\n  validate?(command: BrowserActionCommandValue, target: BrowserTargetValue): Promise<void> | void;\n  dispatch(command: BrowserActionCommandValue): Promise<BrowserObservationValue>;\n};\n\nexport type BrowserInteractionAuthority = {\n  authorizeDispatch(command: BrowserActionCommandValue): Promise<void> | void;\n};\n\nexport type BrowserOperationJournalRecord =\n  InteractionOperationJournalRecord<BrowserActionReceiptValue>;\n\nexport type BrowserInteractionControllerOptions = {\n  browserSessionId: string;\n  controllerGeneration: string;\n  driver: BrowserInteractionDriver;\n  authority?: BrowserInteractionAuthority;\n  maxJournalEntries?: number;\n  now?: () => Date;\n  initialJournal?: readonly BrowserOperationJournalRecord[];\n  onJournalRecord?: (record: BrowserOperationJournalRecord) => Promise<void> | void;\n};\n\n/** Placement-resident BrowserSession mutation authority. */\nexport class BrowserInteractionController {\n  private readonly core: InteractionControllerCore<\n    BrowserActionCommandValue,\n    BrowserTargetValue,\n    BrowserObservationValue,\n    BrowserActionReceiptValue\n  >;\n\n  constructor(options: BrowserInteractionControllerOptions) {\n    const { browserSessionId, controllerGeneration } = options;\n    this.core = new InteractionControllerCore({\n      driver: options.driver,\n      ...(options.authority ? { authority: options.authority } : {}),\n      ...(options.maxJournalEntries !== undefined\n        ? { maxJournalEntries: options.maxJournalEntries }\n        : {}),\n      ...(options.now ? { now: options.now } : {}),\n      ...(options.initialJournal ? { initialJournal: options.initialJournal } : {}),\n      ...(options.onJournalRecord ? { onJournalRecord: options.onJournalRecord } : {}),\n      adapter: {\n        resourceLabel: \"browser\",\n        parseCommand: (value) => BrowserActionCommand.parse(value),\n        parseTarget: (value) => BrowserTarget.parse(value),\n        parseObservation: (value) => BrowserObservation.parse(value),\n        parseReceipt: (value) => BrowserActionReceipt.parse(value),\n        assertCommandAuthority(command) {\n          if (command.browserSessionId !== browserSessionId) {\n            throw new InteractionControllerError(\n              \"resource_not_found\",\n              \"browser command targets another browser session\",\n            );\n          }\n          if (command.controllerGeneration !== controllerGeneration) {\n            throw new InteractionControllerError(\n              \"controller_stale\",\n              \"browser command targets a stale controller generation\",\n            );\n          }\n        },\n        assertTargetAuthority(target) {\n          if (\n            target.browserSessionId !== browserSessionId ||\n            target.controllerGeneration !== controllerGeneration\n          ) {\n            throw new InteractionControllerError(\n              \"controller_stale\",\n              \"browser target belongs to a stale controller generation\",\n            );\n          }\n        },\n        assertExpectedGenerations(command, target) {\n          if (command.expectedTargetGeneration !== target.targetGeneration) {\n            throw new InteractionControllerError(\n              \"target_stale\",\n              \"browser target changed before the command could dispatch\",\n            );\n          }\n          if (command.expectedDocumentGeneration !== target.documentGeneration) {\n            throw new InteractionControllerError(\n              \"document_stale\",\n              \"browser document changed before the command could dispatch\",\n            );\n          }\n        },\n        assertObservationAuthority(observation, targetId) {\n          if (\n            observation.browserSessionId !== browserSessionId ||\n            observation.target.id !== targetId ||\n            observation.target.browserSessionId !== browserSessionId ||\n            observation.target.controllerGeneration !== controllerGeneration\n          ) {\n            throw new InteractionControllerError(\n              \"driver_failed\",\n              \"browser driver returned an observation outside controller authority\",\n            );\n          }\n        },\n        makeReceipt(input) {\n          return BrowserActionReceipt.parse({\n            protocolVersion: 1,\n            operationId: input.command.operationId,\n            browserSessionId,\n            controllerGeneration,\n            targetId: input.command.targetId,\n            state: input.state,\n            dispatchedAt: input.dispatchedAt,\n            settledAt: input.settledAt,\n            observation: input.observation,\n            error: input.error,\n          });\n        },\n        recoverReceipt(receipt, settledAt) {\n          if (\n            receipt.browserSessionId !== browserSessionId ||\n            receipt.controllerGeneration !== controllerGeneration\n          ) {\n            throw new Error(\n              `restored operation ${receipt.operationId} is outside controller authority`,\n            );\n          }\n          return recoverInteractionReceipt(receipt, settledAt, \"browser\", (value) =>\n            BrowserActionReceipt.parse(value),\n          );\n        },\n      },\n    });\n  }\n\n  observe(targetId: string): Promise<BrowserObservationValue> {\n    return this.core.observe(targetId);\n  }\n\n  run(command: BrowserActionCommandValue): Promise<BrowserActionReceiptValue> {\n    return this.core.run(command);\n  }\n\n  receipt(operationId: string): BrowserActionReceiptValue | null {\n    return this.core.receipt(operationId);\n  }\n\n  journalSnapshot(): BrowserOperationJournalRecord[] {\n    return this.core.journalSnapshot();\n  }\n\n  waitForIdle(): Promise<void> {\n    return this.core.waitForIdle();\n  }\n}\n\nexport function recoverBrowserOperationJournalRecord(\n  record: BrowserOperationJournalRecord,\n  settledAt: string,\n): BrowserOperationJournalRecord {\n  const receipt = BrowserActionReceipt.parse(record.receipt);\n  return {\n    ...record,\n    receipt: recoverInteractionReceipt(receipt, settledAt, \"browser\", (value) =>\n      BrowserActionReceipt.parse(value),\n    ),\n  };\n}\n\nexport type ComputerInteractionDriver = {\n  target(targetId: string): Promise<ComputerTargetValue | null>;\n  observe(targetId: string): Promise<ComputerObservationValue>;\n  validate?(command: ComputerActionCommandValue, target: ComputerTargetValue): Promise<void> | void;\n  dispatch(command: ComputerActionCommandValue): Promise<ComputerObservationValue>;\n};\n\nexport type ComputerInteractionAuthority = {\n  authorizeDispatch(command: ComputerActionCommandValue): Promise<void> | void;\n};\n\nexport type ComputerOperationJournalRecord =\n  InteractionOperationJournalRecord<ComputerActionReceiptValue>;\n\nexport type ComputerInteractionControllerOptions = {\n  computerSessionId: string;\n  controllerGeneration: string;\n  driver: ComputerInteractionDriver;\n  authority?: ComputerInteractionAuthority;\n  maxJournalEntries?: number;\n  now?: () => Date;\n  initialJournal?: readonly ComputerOperationJournalRecord[];\n  onJournalRecord?: (record: ComputerOperationJournalRecord) => Promise<void> | void;\n};\n\n/** Placement-resident ComputerSession mutation authority. Linux AT-SPI/X11,\n * macOS AX/ScreenCaptureKit, and later UIA adapters share this exact core. */\nexport class ComputerInteractionController {\n  private readonly core: InteractionControllerCore<\n    ComputerActionCommandValue,\n    ComputerTargetValue,\n    ComputerObservationValue,\n    ComputerActionReceiptValue\n  >;\n\n  constructor(options: ComputerInteractionControllerOptions) {\n    const { computerSessionId, controllerGeneration } = options;\n    this.core = new InteractionControllerCore({\n      driver: options.driver,\n      ...(options.authority ? { authority: options.authority } : {}),\n      ...(options.maxJournalEntries !== undefined\n        ? { maxJournalEntries: options.maxJournalEntries }\n        : {}),\n      ...(options.now ? { now: options.now } : {}),\n      ...(options.initialJournal ? { initialJournal: options.initialJournal } : {}),\n      ...(options.onJournalRecord ? { onJournalRecord: options.onJournalRecord } : {}),\n      adapter: {\n        resourceLabel: \"computer\",\n        parseCommand: (value) => ComputerActionCommand.parse(value),\n        parseTarget: (value) => ComputerTarget.parse(value),\n        parseObservation: (value) => ComputerObservation.parse(value),\n        parseReceipt: (value) => ComputerActionReceipt.parse(value),\n        assertCommandAuthority(command) {\n          if (command.computerSessionId !== computerSessionId) {\n            throw new InteractionControllerError(\n              \"resource_not_found\",\n              \"computer command targets another computer session\",\n            );\n          }\n          if (command.controllerGeneration !== controllerGeneration) {\n            throw new InteractionControllerError(\n              \"controller_stale\",\n              \"computer command targets a stale controller generation\",\n            );\n          }\n        },\n        assertTargetAuthority(target) {\n          if (\n            target.computerSessionId !== computerSessionId ||\n            target.controllerGeneration !== controllerGeneration\n          ) {\n            throw new InteractionControllerError(\n              \"controller_stale\",\n              \"computer target belongs to a stale controller generation\",\n            );\n          }\n        },\n        assertExpectedGenerations(command, target) {\n          if (command.expectedTargetGeneration !== target.targetGeneration) {\n            throw new InteractionControllerError(\n              \"target_stale\",\n              \"computer target changed before the command could dispatch\",\n            );\n          }\n        },\n        assertObservationAuthority(observation, targetId) {\n          if (\n            observation.computerSessionId !== computerSessionId ||\n            observation.target.id !== targetId ||\n            observation.target.computerSessionId !== computerSessionId ||\n            observation.target.controllerGeneration !== controllerGeneration\n          ) {\n            throw new InteractionControllerError(\n              \"driver_failed\",\n              \"computer driver returned an observation outside controller authority\",\n            );\n          }\n        },\n        makeReceipt(input) {\n          return ComputerActionReceipt.parse({\n            protocolVersion: 1,\n            operationId: input.command.operationId,\n            computerSessionId,\n            controllerGeneration,\n            targetId: input.command.targetId,\n            state: input.state,\n            dispatchedAt: input.dispatchedAt,\n            settledAt: input.settledAt,\n            observation: input.observation,\n            error: input.error,\n          });\n        },\n        recoverReceipt(receipt, settledAt) {\n          if (\n            receipt.computerSessionId !== computerSessionId ||\n            receipt.controllerGeneration !== controllerGeneration\n          ) {\n            throw new Error(\n              `restored operation ${receipt.operationId} is outside controller authority`,\n            );\n          }\n          return recoverInteractionReceipt(receipt, settledAt, \"computer\", (value) =>\n            ComputerActionReceipt.parse(value),\n          );\n        },\n      },\n    });\n  }\n\n  observe(targetId: string): Promise<ComputerObservationValue> {\n    return this.core.observe(targetId);\n  }\n\n  run(command: ComputerActionCommandValue): Promise<ComputerActionReceiptValue> {\n    return this.core.run(command);\n  }\n\n  receipt(operationId: string): ComputerActionReceiptValue | null {\n    return this.core.receipt(operationId);\n  }\n\n  journalSnapshot(): ComputerOperationJournalRecord[] {\n    return this.core.journalSnapshot();\n  }\n\n  waitForIdle(): Promise<void> {\n    return this.core.waitForIdle();\n  }\n}\n\nexport function recoverComputerOperationJournalRecord(\n  record: ComputerOperationJournalRecord,\n  settledAt: string,\n): ComputerOperationJournalRecord {\n  const receipt = ComputerActionReceipt.parse(record.receipt);\n  return {\n    ...record,\n    receipt: recoverInteractionReceipt(receipt, settledAt, \"computer\", (value) =>\n      ComputerActionReceipt.parse(value),\n    ),\n  };\n}\n","import { createHash } from \"node:crypto\";\nimport type { InteractionError, InteractionOperationState } from \"@opengeni/contracts\";\n\nexport type InteractionControllerErrorCode = InteractionError[\"code\"] | \"journal_full\";\n\n/** A safe, typed rejection known not to have dispatched a side effect. */\nexport class InteractionControllerError extends Error {\n  constructor(\n    readonly code: InteractionControllerErrorCode,\n    message: string,\n    readonly retryable = false,\n  ) {\n    super(message);\n    this.name = \"InteractionControllerError\";\n  }\n}\n\n/** Driver proof that a dispatched command definitively failed without an ambiguous outcome. */\nexport class InteractionDefiniteDriverError extends Error {\n  constructor(\n    readonly code: InteractionError[\"code\"],\n    message: string,\n    readonly retryable = false,\n  ) {\n    super(message);\n    this.name = \"InteractionDefiniteDriverError\";\n  }\n}\n\nexport type InteractionCoreCommand = {\n  operationId: string;\n  controllerGeneration: string;\n  targetId: string;\n};\n\nexport type InteractionCoreTarget = {\n  id: string;\n  controllerGeneration: string;\n};\n\nexport type InteractionCoreObservation<TTarget extends InteractionCoreTarget> = {\n  target: TTarget;\n};\n\nexport type InteractionCoreReceipt<TObservation> = {\n  operationId: string;\n  controllerGeneration: string;\n  targetId: string;\n  state: InteractionOperationState;\n  dispatchedAt: string | null;\n  settledAt: string | null;\n  observation: TObservation | null;\n  error: InteractionError | null;\n};\n\nexport type InteractionOperationJournalRecord<TReceipt> = {\n  operationId: string;\n  commandDigest: string;\n  receipt: TReceipt;\n};\n\ntype InteractionDriver<\n  TCommand extends InteractionCoreCommand,\n  TTarget extends InteractionCoreTarget,\n  TObservation extends InteractionCoreObservation<TTarget>,\n> = {\n  target(targetId: string): Promise<TTarget | null>;\n  observe(targetId: string): Promise<TObservation>;\n  validate?(command: TCommand, target: TTarget): Promise<void> | void;\n  dispatch(command: TCommand): Promise<TObservation>;\n};\n\ntype InteractionCoreAdapter<\n  TCommand extends InteractionCoreCommand,\n  TTarget extends InteractionCoreTarget,\n  TObservation extends InteractionCoreObservation<TTarget>,\n  TReceipt extends InteractionCoreReceipt<TObservation>,\n> = {\n  resourceLabel: string;\n  parseCommand(value: unknown): TCommand;\n  parseTarget(value: unknown): TTarget;\n  parseObservation(value: unknown): TObservation;\n  parseReceipt(value: unknown): TReceipt;\n  assertCommandAuthority(command: TCommand): void;\n  assertTargetAuthority(target: TTarget): void;\n  assertExpectedGenerations(command: TCommand, target: TTarget): void;\n  assertObservationAuthority(observation: TObservation, targetId: string): void;\n  makeReceipt(input: {\n    command: TCommand;\n    state: InteractionOperationState;\n    dispatchedAt: string | null;\n    settledAt: string | null;\n    observation: TObservation | null;\n    error: InteractionError | null;\n  }): TReceipt;\n  recoverReceipt(receipt: TReceipt, settledAt: string): TReceipt;\n};\n\ntype InteractionCoreAuthority<TCommand> = {\n  authorizeDispatch(command: TCommand): Promise<void> | void;\n};\n\nexport type InteractionControllerCoreOptions<\n  TCommand extends InteractionCoreCommand,\n  TTarget extends InteractionCoreTarget,\n  TObservation extends InteractionCoreObservation<TTarget>,\n  TReceipt extends InteractionCoreReceipt<TObservation>,\n> = {\n  driver: InteractionDriver<TCommand, TTarget, TObservation>;\n  adapter: InteractionCoreAdapter<TCommand, TTarget, TObservation, TReceipt>;\n  authority?: InteractionCoreAuthority<TCommand>;\n  maxJournalEntries?: number;\n  now?: () => Date;\n  initialJournal?: readonly InteractionOperationJournalRecord<TReceipt>[];\n  onJournalRecord?: (record: InteractionOperationJournalRecord<TReceipt>) => Promise<void> | void;\n};\n\ntype JournalEntry<TReceipt> = InteractionOperationJournalRecord<TReceipt> & {\n  completion: Promise<TReceipt>;\n  preparationPersisted: Promise<boolean>;\n};\n\nconst terminalStates = new Set<InteractionOperationState>([\n  \"completed\",\n  \"failed\",\n  \"outcome_unknown\",\n]);\n\n/**\n * Resource-neutral placement mutation authority. Public Browser and Computer\n * controllers supply only their schemas and generation semantics; journaling,\n * idempotency, target-local serialization, and crash policy stay identical.\n */\nexport class InteractionControllerCore<\n  TCommand extends InteractionCoreCommand,\n  TTarget extends InteractionCoreTarget,\n  TObservation extends InteractionCoreObservation<TTarget>,\n  TReceipt extends InteractionCoreReceipt<TObservation>,\n> {\n  private readonly driver: InteractionDriver<TCommand, TTarget, TObservation>;\n  private readonly adapter: InteractionCoreAdapter<TCommand, TTarget, TObservation, TReceipt>;\n  private readonly authority: InteractionCoreAuthority<TCommand> | undefined;\n  private readonly maxJournalEntries: number;\n  private readonly now: () => Date;\n  private readonly onJournalRecord:\n    | ((record: InteractionOperationJournalRecord<TReceipt>) => Promise<void> | void)\n    | undefined;\n  private readonly journal = new Map<string, JournalEntry<TReceipt>>();\n  private readonly targetTails = new Map<string, Promise<void>>();\n\n  constructor(\n    options: InteractionControllerCoreOptions<TCommand, TTarget, TObservation, TReceipt>,\n  ) {\n    this.driver = options.driver;\n    this.adapter = options.adapter;\n    this.authority = options.authority;\n    this.maxJournalEntries = options.maxJournalEntries ?? 10_000;\n    this.now = options.now ?? (() => new Date());\n    this.onJournalRecord = options.onJournalRecord;\n    if (!Number.isSafeInteger(this.maxJournalEntries) || this.maxJournalEntries < 1) {\n      throw new Error(\"maxJournalEntries must be a positive safe integer\");\n    }\n    for (const record of options.initialJournal ?? []) this.restoreJournalRecord(record);\n  }\n\n  async observe(targetId: string): Promise<TObservation> {\n    const target = await this.requireCurrentTarget(targetId);\n    const observed = this.adapter.parseObservation(await this.driver.observe(target.id));\n    this.adapter.assertObservationAuthority(observed, target.id);\n    return observed;\n  }\n\n  run(commandInput: TCommand): Promise<TReceipt> {\n    const command = this.adapter.parseCommand(commandInput);\n    this.adapter.assertCommandAuthority(command);\n    const commandDigest = digestJson(command);\n    const existing = this.journal.get(command.operationId);\n    if (existing) {\n      if (existing.commandDigest !== commandDigest) {\n        throw new InteractionControllerError(\n          \"operation_conflict\",\n          `operation id is already bound to a different ${this.adapter.resourceLabel} command`,\n        );\n      }\n      return existing.completion;\n    }\n\n    this.makeJournalSpace();\n    const prepared = this.makeReceipt(command, \"prepared\", null, null, null, null);\n    const entry: JournalEntry<TReceipt> = {\n      operationId: command.operationId,\n      commandDigest,\n      receipt: prepared,\n      completion: Promise.resolve(prepared),\n      preparationPersisted: this.publish(command.operationId, commandDigest, prepared).then(\n        () => true,\n        () => false,\n      ),\n    };\n    this.journal.set(command.operationId, entry);\n\n    const previous = this.targetTails.get(command.targetId) ?? Promise.resolve();\n    entry.completion = previous.then(async () => await this.execute(entry, command));\n    const tail = entry.completion.then(\n      () => undefined,\n      () => undefined,\n    );\n    this.targetTails.set(command.targetId, tail);\n    void tail.finally(() => {\n      if (this.targetTails.get(command.targetId) === tail)\n        this.targetTails.delete(command.targetId);\n    });\n    return entry.completion;\n  }\n\n  receipt(operationId: string): TReceipt | null {\n    return this.journal.get(operationId)?.receipt ?? null;\n  }\n\n  journalSnapshot(): InteractionOperationJournalRecord<TReceipt>[] {\n    return [...this.journal.values()].map(({ operationId, commandDigest, receipt }) => ({\n      operationId,\n      commandDigest,\n      receipt,\n    }));\n  }\n\n  /** Wait until every command already admitted to a target queue settles.\n   * Callers must fence new dispatch through `authority` before awaiting this. */\n  async waitForIdle(): Promise<void> {\n    while (this.targetTails.size > 0) await Promise.all([...this.targetTails.values()]);\n  }\n\n  private async execute(entry: JournalEntry<TReceipt>, command: TCommand): Promise<TReceipt> {\n    if (!(await entry.preparationPersisted)) {\n      return await this.failBeforeDispatch(\n        entry,\n        command,\n        `${this.adapter.resourceLabel} operation journal rejected the command before dispatch`,\n      );\n    }\n\n    try {\n      await this.authority?.authorizeDispatch(command);\n      const target = await this.requireCurrentTarget(command.targetId);\n      this.adapter.assertExpectedGenerations(command, target);\n      await this.driver.validate?.(command, target);\n    } catch (error) {\n      return await this.settle(\n        entry,\n        this.makeReceipt(\n          command,\n          \"failed\",\n          null,\n          this.timestamp(),\n          null,\n          safePredispatchError(error, this.adapter.resourceLabel),\n        ),\n      );\n    }\n\n    const dispatchedAt = this.timestamp();\n    const dispatched = this.makeReceipt(command, \"dispatched\", dispatchedAt, null, null, null);\n    try {\n      await this.publish(entry.operationId, entry.commandDigest, dispatched);\n      entry.receipt = dispatched;\n    } catch {\n      return await this.failBeforeDispatch(\n        entry,\n        command,\n        `${this.adapter.resourceLabel} operation journal became unavailable before dispatch`,\n      );\n    }\n\n    try {\n      const observation = this.adapter.parseObservation(await this.driver.dispatch(command));\n      this.adapter.assertObservationAuthority(observation, command.targetId);\n      const completed = this.makeReceipt(\n        command,\n        \"completed\",\n        dispatchedAt,\n        this.timestamp(),\n        observation,\n        null,\n      );\n      try {\n        await this.publish(entry.operationId, entry.commandDigest, completed);\n        entry.receipt = completed;\n        return completed;\n      } catch {\n        return await this.settle(\n          entry,\n          this.makeReceipt(command, \"outcome_unknown\", dispatchedAt, this.timestamp(), null, {\n            code: \"controller_lost\",\n            message: `${this.adapter.resourceLabel} command completed but its durable outcome could not be recorded`,\n            retryable: false,\n          }),\n        );\n      }\n    } catch (error) {\n      if (error instanceof InteractionDefiniteDriverError) {\n        return await this.settle(\n          entry,\n          this.makeReceipt(command, \"failed\", dispatchedAt, this.timestamp(), null, {\n            code: error.code,\n            message: error.message,\n            retryable: error.retryable,\n          }),\n        );\n      }\n      return await this.settle(\n        entry,\n        this.makeReceipt(command, \"outcome_unknown\", dispatchedAt, this.timestamp(), null, {\n          code: \"controller_lost\",\n          message: `${this.adapter.resourceLabel} command outcome is unknown after dispatch`,\n          retryable: false,\n        }),\n      );\n    }\n  }\n\n  private async requireCurrentTarget(targetId: string): Promise<TTarget> {\n    const target = await this.driver.target(targetId);\n    if (!target) {\n      throw new InteractionControllerError(\n        \"target_not_found\",\n        `${this.adapter.resourceLabel} target does not exist`,\n      );\n    }\n    const parsed = this.adapter.parseTarget(target);\n    this.adapter.assertTargetAuthority(parsed);\n    return parsed;\n  }\n\n  private makeReceipt(\n    command: TCommand,\n    state: InteractionOperationState,\n    dispatchedAt: string | null,\n    settledAt: string | null,\n    observation: TObservation | null,\n    error: InteractionError | null,\n  ): TReceipt {\n    return this.adapter.makeReceipt({\n      command,\n      state,\n      dispatchedAt,\n      settledAt,\n      observation,\n      error,\n    });\n  }\n\n  private async settle(entry: JournalEntry<TReceipt>, receipt: TReceipt): Promise<TReceipt> {\n    entry.receipt = receipt;\n    try {\n      await this.publish(entry.operationId, entry.commandDigest, receipt);\n    } catch {\n      // Controller-lifetime terminal truth remains authoritative. A restored\n      // dispatched receipt is always recovered as outcome_unknown, never replayed.\n    }\n    return receipt;\n  }\n\n  private async failBeforeDispatch(\n    entry: JournalEntry<TReceipt>,\n    command: TCommand,\n    message: string,\n  ): Promise<TReceipt> {\n    return await this.settle(\n      entry,\n      this.makeReceipt(command, \"failed\", null, this.timestamp(), null, {\n        code: \"driver_failed\",\n        message,\n        retryable: true,\n      }),\n    );\n  }\n\n  private async publish(\n    operationId: string,\n    commandDigest: string,\n    receipt: TReceipt,\n  ): Promise<void> {\n    await this.onJournalRecord?.({ operationId, commandDigest, receipt });\n  }\n\n  private timestamp(): string {\n    return this.now().toISOString();\n  }\n\n  private makeJournalSpace(): void {\n    while (this.journal.size >= this.maxJournalEntries) {\n      const terminal = [...this.journal.entries()].find(([, entry]) =>\n        terminalStates.has(entry.receipt.state),\n      );\n      if (!terminal) {\n        throw new InteractionControllerError(\n          \"journal_full\",\n          `${this.adapter.resourceLabel} operation journal has no safely evictable terminal entry`,\n          true,\n        );\n      }\n      this.journal.delete(terminal[0]);\n    }\n  }\n\n  private restoreJournalRecord(record: InteractionOperationJournalRecord<TReceipt>): void {\n    if (this.journal.has(record.operationId)) {\n      throw new Error(`duplicate restored operation id: ${record.operationId}`);\n    }\n    const parsed = this.adapter.parseReceipt(record.receipt);\n    if (parsed.operationId !== record.operationId) {\n      throw new Error(`restored operation ${record.operationId} has another receipt id`);\n    }\n    const receipt = this.adapter.recoverReceipt(parsed, this.timestamp());\n    const entry: JournalEntry<TReceipt> = {\n      operationId: record.operationId,\n      commandDigest: record.commandDigest,\n      receipt,\n      completion: Promise.resolve(receipt),\n      preparationPersisted: Promise.resolve(true),\n    };\n    this.journal.set(record.operationId, entry);\n  }\n}\n\nexport function recoverInteractionReceipt<TReceipt extends InteractionCoreReceipt<unknown>>(\n  receipt: TReceipt,\n  settledAt: string,\n  resourceLabel: string,\n  parse: (value: unknown) => TReceipt,\n): TReceipt {\n  if (terminalStates.has(receipt.state)) return receipt;\n  return parse({\n    ...receipt,\n    state: receipt.state === \"dispatched\" ? \"outcome_unknown\" : \"failed\",\n    settledAt,\n    observation: null,\n    error:\n      receipt.state === \"dispatched\"\n        ? {\n            code: \"controller_lost\",\n            message: `${resourceLabel} controller restarted after command dispatch`,\n            retryable: false,\n          }\n        : {\n            code: \"controller_lost\",\n            message: `${resourceLabel} controller restarted before command dispatch`,\n            retryable: true,\n          },\n  });\n}\n\nfunction safePredispatchError(error: unknown, resourceLabel: string): InteractionError {\n  if (error instanceof InteractionControllerError && error.code !== \"journal_full\") {\n    return {\n      code: error.code,\n      message: error.message,\n      retryable: error.retryable,\n    };\n  }\n  return {\n    code: \"driver_failed\",\n    message: `${resourceLabel} command failed before dispatch`,\n    retryable: false,\n  };\n}\n\nfunction digestJson(value: unknown): string {\n  return createHash(\"sha256\").update(canonicalJson(value), \"utf8\").digest(\"hex\");\n}\n\nfunction canonicalJson(value: unknown): string {\n  return JSON.stringify(canonicalJsonValue(value));\n}\n\nfunction canonicalJsonValue(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(canonicalJsonValue);\n  if (value !== null && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.entries(value as Record<string, unknown>)\n        .sort(([left], [right]) => left.localeCompare(right))\n        .map(([key, entry]) => [key, canonicalJsonValue(entry)]),\n    );\n  }\n  return value;\n}\n"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OASK;;;ACjBP,SAAS,kBAAkB;AAMpB,IAAM,6BAAN,cAAyC,MAAM;AAAA,EACpD,YACW,MACT,SACS,YAAY,OACrB;AACA,UAAM,OAAO;AAJJ;AAEA;AAGT,SAAK,OAAO;AAAA,EACd;AACF;AAGO,IAAM,iCAAN,cAA6C,MAAM;AAAA,EACxD,YACW,MACT,SACS,YAAY,OACrB;AACA,UAAM,OAAO;AAJJ;AAEA;AAGT,SAAK,OAAO;AAAA,EACd;AACF;AA+FA,IAAM,iBAAiB,oBAAI,IAA+B;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOM,IAAM,4BAAN,MAKL;AAAA,EACiB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA,UAAU,oBAAI,IAAoC;AAAA,EAClD,cAAc,oBAAI,IAA2B;AAAA,EAE9D,YACE,SACA;AACA,SAAK,SAAS,QAAQ;AACtB,SAAK,UAAU,QAAQ;AACvB,SAAK,YAAY,QAAQ;AACzB,SAAK,oBAAoB,QAAQ,qBAAqB;AACtD,SAAK,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC1C,SAAK,kBAAkB,QAAQ;AAC/B,QAAI,CAAC,OAAO,cAAc,KAAK,iBAAiB,KAAK,KAAK,oBAAoB,GAAG;AAC/E,YAAM,IAAI,MAAM,mDAAmD;AAAA,IACrE;AACA,eAAW,UAAU,QAAQ,kBAAkB,CAAC,EAAG,MAAK,qBAAqB,MAAM;AAAA,EACrF;AAAA,EAEA,MAAM,QAAQ,UAAyC;AACrD,UAAM,SAAS,MAAM,KAAK,qBAAqB,QAAQ;AACvD,UAAM,WAAW,KAAK,QAAQ,iBAAiB,MAAM,KAAK,OAAO,QAAQ,OAAO,EAAE,CAAC;AACnF,SAAK,QAAQ,2BAA2B,UAAU,OAAO,EAAE;AAC3D,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,cAA2C;AAC7C,UAAM,UAAU,KAAK,QAAQ,aAAa,YAAY;AACtD,SAAK,QAAQ,uBAAuB,OAAO;AAC3C,UAAM,gBAAgB,WAAW,OAAO;AACxC,UAAM,WAAW,KAAK,QAAQ,IAAI,QAAQ,WAAW;AACrD,QAAI,UAAU;AACZ,UAAI,SAAS,kBAAkB,eAAe;AAC5C,cAAM,IAAI;AAAA,UACR;AAAA,UACA,gDAAgD,KAAK,QAAQ,aAAa;AAAA,QAC5E;AAAA,MACF;AACA,aAAO,SAAS;AAAA,IAClB;AAEA,SAAK,iBAAiB;AACtB,UAAM,WAAW,KAAK,YAAY,SAAS,YAAY,MAAM,MAAM,MAAM,IAAI;AAC7E,UAAM,QAAgC;AAAA,MACpC,aAAa,QAAQ;AAAA,MACrB;AAAA,MACA,SAAS;AAAA,MACT,YAAY,QAAQ,QAAQ,QAAQ;AAAA,MACpC,sBAAsB,KAAK,QAAQ,QAAQ,aAAa,eAAe,QAAQ,EAAE;AAAA,QAC/E,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AACA,SAAK,QAAQ,IAAI,QAAQ,aAAa,KAAK;AAE3C,UAAM,WAAW,KAAK,YAAY,IAAI,QAAQ,QAAQ,KAAK,QAAQ,QAAQ;AAC3E,UAAM,aAAa,SAAS,KAAK,YAAY,MAAM,KAAK,QAAQ,OAAO,OAAO,CAAC;AAC/E,UAAM,OAAO,MAAM,WAAW;AAAA,MAC5B,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,SAAK,YAAY,IAAI,QAAQ,UAAU,IAAI;AAC3C,SAAK,KAAK,QAAQ,MAAM;AACtB,UAAI,KAAK,YAAY,IAAI,QAAQ,QAAQ,MAAM;AAC7C,aAAK,YAAY,OAAO,QAAQ,QAAQ;AAAA,IAC5C,CAAC;AACD,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,QAAQ,aAAsC;AAC5C,WAAO,KAAK,QAAQ,IAAI,WAAW,GAAG,WAAW;AAAA,EACnD;AAAA,EAEA,kBAAiE;AAC/D,WAAO,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,aAAa,eAAe,QAAQ,OAAO;AAAA,MAClF;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE;AAAA,EACJ;AAAA;AAAA;AAAA,EAIA,MAAM,cAA6B;AACjC,WAAO,KAAK,YAAY,OAAO,EAAG,OAAM,QAAQ,IAAI,CAAC,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC;AAAA,EACpF;AAAA,EAEA,MAAc,QAAQ,OAA+B,SAAsC;AACzF,QAAI,CAAE,MAAM,MAAM,sBAAuB;AACvC,aAAO,MAAM,KAAK;AAAA,QAChB;AAAA,QACA;AAAA,QACA,GAAG,KAAK,QAAQ,aAAa;AAAA,MAC/B;AAAA,IACF;AAEA,QAAI;AACF,YAAM,KAAK,WAAW,kBAAkB,OAAO;AAC/C,YAAM,SAAS,MAAM,KAAK,qBAAqB,QAAQ,QAAQ;AAC/D,WAAK,QAAQ,0BAA0B,SAAS,MAAM;AACtD,YAAM,KAAK,OAAO,WAAW,SAAS,MAAM;AAAA,IAC9C,SAAS,OAAO;AACd,aAAO,MAAM,KAAK;AAAA,QAChB;AAAA,QACA,KAAK;AAAA,UACH;AAAA,UACA;AAAA,UACA;AAAA,UACA,KAAK,UAAU;AAAA,UACf;AAAA,UACA,qBAAqB,OAAO,KAAK,QAAQ,aAAa;AAAA,QACxD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,eAAe,KAAK,UAAU;AACpC,UAAM,aAAa,KAAK,YAAY,SAAS,cAAc,cAAc,MAAM,MAAM,IAAI;AACzF,QAAI;AACF,YAAM,KAAK,QAAQ,MAAM,aAAa,MAAM,eAAe,UAAU;AACrE,YAAM,UAAU;AAAA,IAClB,QAAQ;AACN,aAAO,MAAM,KAAK;AAAA,QAChB;AAAA,QACA;AAAA,QACA,GAAG,KAAK,QAAQ,aAAa;AAAA,MAC/B;AAAA,IACF;AAEA,QAAI;AACF,YAAM,cAAc,KAAK,QAAQ,iBAAiB,MAAM,KAAK,OAAO,SAAS,OAAO,CAAC;AACrF,WAAK,QAAQ,2BAA2B,aAAa,QAAQ,QAAQ;AACrE,YAAM,YAAY,KAAK;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,QACA,KAAK,UAAU;AAAA,QACf;AAAA,QACA;AAAA,MACF;AACA,UAAI;AACF,cAAM,KAAK,QAAQ,MAAM,aAAa,MAAM,eAAe,SAAS;AACpE,cAAM,UAAU;AAChB,eAAO;AAAA,MACT,QAAQ;AACN,eAAO,MAAM,KAAK;AAAA,UAChB;AAAA,UACA,KAAK,YAAY,SAAS,mBAAmB,cAAc,KAAK,UAAU,GAAG,MAAM;AAAA,YACjF,MAAM;AAAA,YACN,SAAS,GAAG,KAAK,QAAQ,aAAa;AAAA,YACtC,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,UAAI,iBAAiB,gCAAgC;AACnD,eAAO,MAAM,KAAK;AAAA,UAChB;AAAA,UACA,KAAK,YAAY,SAAS,UAAU,cAAc,KAAK,UAAU,GAAG,MAAM;AAAA,YACxE,MAAM,MAAM;AAAA,YACZ,SAAS,MAAM;AAAA,YACf,WAAW,MAAM;AAAA,UACnB,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO,MAAM,KAAK;AAAA,QAChB;AAAA,QACA,KAAK,YAAY,SAAS,mBAAmB,cAAc,KAAK,UAAU,GAAG,MAAM;AAAA,UACjF,MAAM;AAAA,UACN,SAAS,GAAG,KAAK,QAAQ,aAAa;AAAA,UACtC,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,qBAAqB,UAAoC;AACrE,UAAM,SAAS,MAAM,KAAK,OAAO,OAAO,QAAQ;AAChD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI;AAAA,QACR;AAAA,QACA,GAAG,KAAK,QAAQ,aAAa;AAAA,MAC/B;AAAA,IACF;AACA,UAAM,SAAS,KAAK,QAAQ,YAAY,MAAM;AAC9C,SAAK,QAAQ,sBAAsB,MAAM;AACzC,WAAO;AAAA,EACT;AAAA,EAEQ,YACN,SACA,OACA,cACA,WACA,aACA,OACU;AACV,WAAO,KAAK,QAAQ,YAAY;AAAA,MAC9B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,OAAO,OAA+B,SAAsC;AACxF,UAAM,UAAU;AAChB,QAAI;AACF,YAAM,KAAK,QAAQ,MAAM,aAAa,MAAM,eAAe,OAAO;AAAA,IACpE,QAAQ;AAAA,IAGR;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,mBACZ,OACA,SACA,SACmB;AACnB,WAAO,MAAM,KAAK;AAAA,MAChB;AAAA,MACA,KAAK,YAAY,SAAS,UAAU,MAAM,KAAK,UAAU,GAAG,MAAM;AAAA,QAChE,MAAM;AAAA,QACN;AAAA,QACA,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,QACZ,aACA,eACA,SACe;AACf,UAAM,KAAK,kBAAkB,EAAE,aAAa,eAAe,QAAQ,CAAC;AAAA,EACtE;AAAA,EAEQ,YAAoB;AAC1B,WAAO,KAAK,IAAI,EAAE,YAAY;AAAA,EAChC;AAAA,EAEQ,mBAAyB;AAC/B,WAAO,KAAK,QAAQ,QAAQ,KAAK,mBAAmB;AAClD,YAAM,WAAW,CAAC,GAAG,KAAK,QAAQ,QAAQ,CAAC,EAAE;AAAA,QAAK,CAAC,CAAC,EAAE,KAAK,MACzD,eAAe,IAAI,MAAM,QAAQ,KAAK;AAAA,MACxC;AACA,UAAI,CAAC,UAAU;AACb,cAAM,IAAI;AAAA,UACR;AAAA,UACA,GAAG,KAAK,QAAQ,aAAa;AAAA,UAC7B;AAAA,QACF;AAAA,MACF;AACA,WAAK,QAAQ,OAAO,SAAS,CAAC,CAAC;AAAA,IACjC;AAAA,EACF;AAAA,EAEQ,qBAAqB,QAA2D;AACtF,QAAI,KAAK,QAAQ,IAAI,OAAO,WAAW,GAAG;AACxC,YAAM,IAAI,MAAM,oCAAoC,OAAO,WAAW,EAAE;AAAA,IAC1E;AACA,UAAM,SAAS,KAAK,QAAQ,aAAa,OAAO,OAAO;AACvD,QAAI,OAAO,gBAAgB,OAAO,aAAa;AAC7C,YAAM,IAAI,MAAM,sBAAsB,OAAO,WAAW,yBAAyB;AAAA,IACnF;AACA,UAAM,UAAU,KAAK,QAAQ,eAAe,QAAQ,KAAK,UAAU,CAAC;AACpE,UAAM,QAAgC;AAAA,MACpC,aAAa,OAAO;AAAA,MACpB,eAAe,OAAO;AAAA,MACtB;AAAA,MACA,YAAY,QAAQ,QAAQ,OAAO;AAAA,MACnC,sBAAsB,QAAQ,QAAQ,IAAI;AAAA,IAC5C;AACA,SAAK,QAAQ,IAAI,OAAO,aAAa,KAAK;AAAA,EAC5C;AACF;AAEO,SAAS,0BACd,SACA,WACA,eACA,OACU;AACV,MAAI,eAAe,IAAI,QAAQ,KAAK,EAAG,QAAO;AAC9C,SAAO,MAAM;AAAA,IACX,GAAG;AAAA,IACH,OAAO,QAAQ,UAAU,eAAe,oBAAoB;AAAA,IAC5D;AAAA,IACA,aAAa;AAAA,IACb,OACE,QAAQ,UAAU,eACd;AAAA,MACE,MAAM;AAAA,MACN,SAAS,GAAG,aAAa;AAAA,MACzB,WAAW;AAAA,IACb,IACA;AAAA,MACE,MAAM;AAAA,MACN,SAAS,GAAG,aAAa;AAAA,MACzB,WAAW;AAAA,IACb;AAAA,EACR,CAAC;AACH;AAEA,SAAS,qBAAqB,OAAgB,eAAyC;AACrF,MAAI,iBAAiB,8BAA8B,MAAM,SAAS,gBAAgB;AAChF,WAAO;AAAA,MACL,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM;AAAA,MACf,WAAW,MAAM;AAAA,IACnB;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,GAAG,aAAa;AAAA,IACzB,WAAW;AAAA,EACb;AACF;AAEA,SAAS,WAAW,OAAwB;AAC1C,SAAO,WAAW,QAAQ,EAAE,OAAO,cAAc,KAAK,GAAG,MAAM,EAAE,OAAO,KAAK;AAC/E;AAEA,SAAS,cAAc,OAAwB;AAC7C,SAAO,KAAK,UAAU,mBAAmB,KAAK,CAAC;AACjD;AAEA,SAAS,mBAAmB,OAAyB;AACnD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,kBAAkB;AAC7D,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,KAAgC,EAC5C,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,mBAAmB,KAAK,CAAC,CAAC;AAAA,IAC3D;AAAA,EACF;AACA,SAAO;AACT;;;AD3aO,IAAM,+BAAN,MAAmC;AAAA,EACvB;AAAA,EAOjB,YAAY,SAA8C;AACxD,UAAM,EAAE,kBAAkB,qBAAqB,IAAI;AACnD,SAAK,OAAO,IAAI,0BAA0B;AAAA,MACxC,QAAQ,QAAQ;AAAA,MAChB,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,MAC5D,GAAI,QAAQ,sBAAsB,SAC9B,EAAE,mBAAmB,QAAQ,kBAAkB,IAC/C,CAAC;AAAA,MACL,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,MAC1C,GAAI,QAAQ,iBAAiB,EAAE,gBAAgB,QAAQ,eAAe,IAAI,CAAC;AAAA,MAC3E,GAAI,QAAQ,kBAAkB,EAAE,iBAAiB,QAAQ,gBAAgB,IAAI,CAAC;AAAA,MAC9E,SAAS;AAAA,QACP,eAAe;AAAA,QACf,cAAc,CAAC,UAAU,qBAAqB,MAAM,KAAK;AAAA,QACzD,aAAa,CAAC,UAAU,cAAc,MAAM,KAAK;AAAA,QACjD,kBAAkB,CAAC,UAAU,mBAAmB,MAAM,KAAK;AAAA,QAC3D,cAAc,CAAC,UAAU,qBAAqB,MAAM,KAAK;AAAA,QACzD,uBAAuB,SAAS;AAC9B,cAAI,QAAQ,qBAAqB,kBAAkB;AACjD,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AACA,cAAI,QAAQ,yBAAyB,sBAAsB;AACzD,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,sBAAsB,QAAQ;AAC5B,cACE,OAAO,qBAAqB,oBAC5B,OAAO,yBAAyB,sBAChC;AACA,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,0BAA0B,SAAS,QAAQ;AACzC,cAAI,QAAQ,6BAA6B,OAAO,kBAAkB;AAChE,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AACA,cAAI,QAAQ,+BAA+B,OAAO,oBAAoB;AACpE,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,2BAA2B,aAAa,UAAU;AAChD,cACE,YAAY,qBAAqB,oBACjC,YAAY,OAAO,OAAO,YAC1B,YAAY,OAAO,qBAAqB,oBACxC,YAAY,OAAO,yBAAyB,sBAC5C;AACA,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,YAAY,OAAO;AACjB,iBAAO,qBAAqB,MAAM;AAAA,YAChC,iBAAiB;AAAA,YACjB,aAAa,MAAM,QAAQ;AAAA,YAC3B;AAAA,YACA;AAAA,YACA,UAAU,MAAM,QAAQ;AAAA,YACxB,OAAO,MAAM;AAAA,YACb,cAAc,MAAM;AAAA,YACpB,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,OAAO,MAAM;AAAA,UACf,CAAC;AAAA,QACH;AAAA,QACA,eAAe,SAAS,WAAW;AACjC,cACE,QAAQ,qBAAqB,oBAC7B,QAAQ,yBAAyB,sBACjC;AACA,kBAAM,IAAI;AAAA,cACR,sBAAsB,QAAQ,WAAW;AAAA,YAC3C;AAAA,UACF;AACA,iBAAO;AAAA,YAA0B;AAAA,YAAS;AAAA,YAAW;AAAA,YAAW,CAAC,UAC/D,qBAAqB,MAAM,KAAK;AAAA,UAClC;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,QAAQ,UAAoD;AAC1D,WAAO,KAAK,KAAK,QAAQ,QAAQ;AAAA,EACnC;AAAA,EAEA,IAAI,SAAwE;AAC1E,WAAO,KAAK,KAAK,IAAI,OAAO;AAAA,EAC9B;AAAA,EAEA,QAAQ,aAAuD;AAC7D,WAAO,KAAK,KAAK,QAAQ,WAAW;AAAA,EACtC;AAAA,EAEA,kBAAmD;AACjD,WAAO,KAAK,KAAK,gBAAgB;AAAA,EACnC;AAAA,EAEA,cAA6B;AAC3B,WAAO,KAAK,KAAK,YAAY;AAAA,EAC/B;AACF;AAEO,SAAS,qCACd,QACA,WAC+B;AAC/B,QAAM,UAAU,qBAAqB,MAAM,OAAO,OAAO;AACzD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS;AAAA,MAA0B;AAAA,MAAS;AAAA,MAAW;AAAA,MAAW,CAAC,UACjE,qBAAqB,MAAM,KAAK;AAAA,IAClC;AAAA,EACF;AACF;AA6BO,IAAM,gCAAN,MAAoC;AAAA,EACxB;AAAA,EAOjB,YAAY,SAA+C;AACzD,UAAM,EAAE,mBAAmB,qBAAqB,IAAI;AACpD,SAAK,OAAO,IAAI,0BAA0B;AAAA,MACxC,QAAQ,QAAQ;AAAA,MAChB,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,MAC5D,GAAI,QAAQ,sBAAsB,SAC9B,EAAE,mBAAmB,QAAQ,kBAAkB,IAC/C,CAAC;AAAA,MACL,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,MAC1C,GAAI,QAAQ,iBAAiB,EAAE,gBAAgB,QAAQ,eAAe,IAAI,CAAC;AAAA,MAC3E,GAAI,QAAQ,kBAAkB,EAAE,iBAAiB,QAAQ,gBAAgB,IAAI,CAAC;AAAA,MAC9E,SAAS;AAAA,QACP,eAAe;AAAA,QACf,cAAc,CAAC,UAAU,sBAAsB,MAAM,KAAK;AAAA,QAC1D,aAAa,CAAC,UAAU,eAAe,MAAM,KAAK;AAAA,QAClD,kBAAkB,CAAC,UAAU,oBAAoB,MAAM,KAAK;AAAA,QAC5D,cAAc,CAAC,UAAU,sBAAsB,MAAM,KAAK;AAAA,QAC1D,uBAAuB,SAAS;AAC9B,cAAI,QAAQ,sBAAsB,mBAAmB;AACnD,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AACA,cAAI,QAAQ,yBAAyB,sBAAsB;AACzD,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,sBAAsB,QAAQ;AAC5B,cACE,OAAO,sBAAsB,qBAC7B,OAAO,yBAAyB,sBAChC;AACA,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,0BAA0B,SAAS,QAAQ;AACzC,cAAI,QAAQ,6BAA6B,OAAO,kBAAkB;AAChE,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,2BAA2B,aAAa,UAAU;AAChD,cACE,YAAY,sBAAsB,qBAClC,YAAY,OAAO,OAAO,YAC1B,YAAY,OAAO,sBAAsB,qBACzC,YAAY,OAAO,yBAAyB,sBAC5C;AACA,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,YAAY,OAAO;AACjB,iBAAO,sBAAsB,MAAM;AAAA,YACjC,iBAAiB;AAAA,YACjB,aAAa,MAAM,QAAQ;AAAA,YAC3B;AAAA,YACA;AAAA,YACA,UAAU,MAAM,QAAQ;AAAA,YACxB,OAAO,MAAM;AAAA,YACb,cAAc,MAAM;AAAA,YACpB,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,OAAO,MAAM;AAAA,UACf,CAAC;AAAA,QACH;AAAA,QACA,eAAe,SAAS,WAAW;AACjC,cACE,QAAQ,sBAAsB,qBAC9B,QAAQ,yBAAyB,sBACjC;AACA,kBAAM,IAAI;AAAA,cACR,sBAAsB,QAAQ,WAAW;AAAA,YAC3C;AAAA,UACF;AACA,iBAAO;AAAA,YAA0B;AAAA,YAAS;AAAA,YAAW;AAAA,YAAY,CAAC,UAChE,sBAAsB,MAAM,KAAK;AAAA,UACnC;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,QAAQ,UAAqD;AAC3D,WAAO,KAAK,KAAK,QAAQ,QAAQ;AAAA,EACnC;AAAA,EAEA,IAAI,SAA0E;AAC5E,WAAO,KAAK,KAAK,IAAI,OAAO;AAAA,EAC9B;AAAA,EAEA,QAAQ,aAAwD;AAC9D,WAAO,KAAK,KAAK,QAAQ,WAAW;AAAA,EACtC;AAAA,EAEA,kBAAoD;AAClD,WAAO,KAAK,KAAK,gBAAgB;AAAA,EACnC;AAAA,EAEA,cAA6B;AAC3B,WAAO,KAAK,KAAK,YAAY;AAAA,EAC/B;AACF;AAEO,SAAS,sCACd,QACA,WACgC;AAChC,QAAM,UAAU,sBAAsB,MAAM,OAAO,OAAO;AAC1D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS;AAAA,MAA0B;AAAA,MAAS;AAAA,MAAW;AAAA,MAAY,CAAC,UAClE,sBAAsB,MAAM,KAAK;AAAA,IACnC;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/controller-core.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport {\n  BrowserActionCommand,\n  BrowserActionReceipt,\n  BrowserObservation,\n  BrowserProtectedAuthFillCommand,\n  BrowserProtectedAuthFillReceipt,\n  BrowserProtectedAuthObservation,\n  BrowserTarget,\n  ComputerActionCommand,\n  ComputerActionReceipt,\n  ComputerObservation,\n  ComputerTarget,\n  type BrowserActionCommand as BrowserActionCommandValue,\n  type BrowserActionReceipt as BrowserActionReceiptValue,\n  type BrowserObservation as BrowserObservationValue,\n  type BrowserProtectedAuthFillCommand as BrowserProtectedAuthFillCommandValue,\n  type BrowserProtectedAuthFillReceipt as BrowserProtectedAuthFillReceiptValue,\n  type BrowserProtectedAuthObservation as BrowserProtectedAuthObservationValue,\n  type BrowserTarget as BrowserTargetValue,\n  type ComputerActionCommand as ComputerActionCommandValue,\n  type ComputerActionReceipt as ComputerActionReceiptValue,\n  type ComputerObservation as ComputerObservationValue,\n  type ComputerTarget as ComputerTargetValue,\n} from \"@opengeni/contracts\";\nimport {\n  InteractionControllerCore,\n  InteractionControllerError,\n  InteractionDefiniteDriverError,\n  recoverInteractionReceipt,\n  type InteractionControllerErrorCode,\n  type InteractionOperationJournalRecord,\n} from \"./controller-core\";\n\nexport {\n  InteractionControllerError,\n  InteractionDefiniteDriverError,\n  type InteractionControllerErrorCode,\n};\n\nexport type BrowserInteractionDriver = {\n  target(targetId: string): Promise<BrowserTargetValue | null>;\n  observe(targetId: string): Promise<BrowserObservationValue>;\n  validate?(command: BrowserActionCommandValue, target: BrowserTargetValue): Promise<void> | void;\n  dispatch(command: BrowserActionCommandValue): Promise<BrowserObservationValue | null>;\n};\n\nexport type BrowserInteractionAuthority = {\n  authorizeDispatch(command: BrowserActionCommandValue): Promise<void> | void;\n};\n\nexport type BrowserOperationJournalRecord =\n  InteractionOperationJournalRecord<BrowserActionReceiptValue>;\n\nexport type BrowserInteractionControllerOptions = {\n  browserSessionId: string;\n  controllerGeneration: string;\n  driver: BrowserInteractionDriver;\n  authority?: BrowserInteractionAuthority;\n  maxJournalEntries?: number;\n  now?: () => Date;\n  initialJournal?: readonly BrowserOperationJournalRecord[];\n  onJournalRecord?: (record: BrowserOperationJournalRecord) => Promise<void> | void;\n};\n\n/** Placement-resident BrowserSession mutation authority. */\nexport class BrowserInteractionController {\n  private readonly core: InteractionControllerCore<\n    BrowserActionCommandValue,\n    BrowserTargetValue,\n    BrowserObservationValue,\n    BrowserActionReceiptValue\n  >;\n\n  constructor(options: BrowserInteractionControllerOptions) {\n    const { browserSessionId, controllerGeneration } = options;\n    this.core = new InteractionControllerCore({\n      driver: options.driver,\n      ...(options.authority ? { authority: options.authority } : {}),\n      ...(options.maxJournalEntries !== undefined\n        ? { maxJournalEntries: options.maxJournalEntries }\n        : {}),\n      ...(options.now ? { now: options.now } : {}),\n      ...(options.initialJournal ? { initialJournal: options.initialJournal } : {}),\n      ...(options.onJournalRecord ? { onJournalRecord: options.onJournalRecord } : {}),\n      adapter: {\n        resourceLabel: \"browser\",\n        parseCommand: (value) => BrowserActionCommand.parse(value),\n        parseTarget: (value) => BrowserTarget.parse(value),\n        parseObservation: (value) => BrowserObservation.parse(value),\n        parseReceipt: (value) => BrowserActionReceipt.parse(value),\n        assertCommandAuthority(command) {\n          if (command.browserSessionId !== browserSessionId) {\n            throw new InteractionControllerError(\n              \"resource_not_found\",\n              \"browser command targets another browser session\",\n            );\n          }\n          if (command.controllerGeneration !== controllerGeneration) {\n            throw new InteractionControllerError(\n              \"controller_stale\",\n              \"browser command targets a stale controller generation\",\n            );\n          }\n        },\n        assertTargetAuthority(target) {\n          if (\n            target.browserSessionId !== browserSessionId ||\n            target.controllerGeneration !== controllerGeneration\n          ) {\n            throw new InteractionControllerError(\n              \"controller_stale\",\n              \"browser target belongs to a stale controller generation\",\n            );\n          }\n        },\n        assertExpectedGenerations(command, target) {\n          if (command.expectedTargetGeneration !== target.targetGeneration) {\n            throw new InteractionControllerError(\n              \"target_stale\",\n              \"browser target changed before the command could dispatch\",\n              true,\n            );\n          }\n          if (command.expectedDocumentGeneration !== target.documentGeneration) {\n            throw new InteractionControllerError(\n              \"document_stale\",\n              \"browser document changed before the command could dispatch\",\n              true,\n            );\n          }\n        },\n        assertObservationAuthority(observation, targetId) {\n          if (\n            observation.browserSessionId !== browserSessionId ||\n            observation.target.id !== targetId ||\n            observation.target.browserSessionId !== browserSessionId ||\n            observation.target.controllerGeneration !== controllerGeneration\n          ) {\n            throw new InteractionControllerError(\n              \"driver_failed\",\n              \"browser driver returned an observation outside controller authority\",\n            );\n          }\n        },\n        makeReceipt(input) {\n          return BrowserActionReceipt.parse({\n            protocolVersion: 1,\n            operationId: input.command.operationId,\n            browserSessionId,\n            controllerGeneration,\n            targetId: input.command.targetId,\n            state: input.state,\n            dispatchedAt: input.dispatchedAt,\n            settledAt: input.settledAt,\n            observation: input.observation,\n            error: input.error,\n          });\n        },\n        recoverReceipt(receipt, settledAt) {\n          if (\n            receipt.browserSessionId !== browserSessionId ||\n            receipt.controllerGeneration !== controllerGeneration\n          ) {\n            throw new Error(\n              `restored operation ${receipt.operationId} is outside controller authority`,\n            );\n          }\n          return recoverInteractionReceipt(receipt, settledAt, \"browser\", (value) =>\n            BrowserActionReceipt.parse(value),\n          );\n        },\n      },\n    });\n  }\n\n  observe(targetId: string): Promise<BrowserObservationValue> {\n    return this.core.observe(targetId);\n  }\n\n  run(command: BrowserActionCommandValue): Promise<BrowserActionReceiptValue> {\n    return this.core.run(command);\n  }\n\n  receipt(operationId: string): BrowserActionReceiptValue | null {\n    return this.core.receipt(operationId);\n  }\n\n  journalSnapshot(): BrowserOperationJournalRecord[] {\n    return this.core.journalSnapshot();\n  }\n\n  waitForIdle(): Promise<void> {\n    return this.core.waitForIdle();\n  }\n}\n\nexport function recoverBrowserOperationJournalRecord(\n  record: BrowserOperationJournalRecord,\n  settledAt: string,\n): BrowserOperationJournalRecord {\n  const receipt = BrowserActionReceipt.parse(record.receipt);\n  return {\n    ...record,\n    receipt: recoverInteractionReceipt(receipt, settledAt, \"browser\", (value) =>\n      BrowserActionReceipt.parse(value),\n    ),\n  };\n}\n\nexport type BrowserProtectedAuthDriver = {\n  target(targetId: string): Promise<BrowserTargetValue | null>;\n  observe(targetId: string): Promise<BrowserProtectedAuthObservationValue>;\n  validate?(\n    command: BrowserProtectedAuthFillCommandValue,\n    target: BrowserTargetValue,\n  ): Promise<void> | void;\n  dispatch(\n    command: BrowserProtectedAuthFillCommandValue,\n  ): Promise<BrowserProtectedAuthObservationValue>;\n};\n\nexport type BrowserProtectedAuthAuthority = {\n  authorizeDispatch(command: BrowserProtectedAuthFillCommandValue): Promise<void> | void;\n};\n\nexport type BrowserProtectedAuthOperationJournalRecord =\n  InteractionOperationJournalRecord<BrowserProtectedAuthFillReceiptValue>;\n\nexport type BrowserProtectedAuthControllerOptions = {\n  browserSessionId: string;\n  controllerGeneration: string;\n  driver: BrowserProtectedAuthDriver;\n  authority?: BrowserProtectedAuthAuthority;\n  maxJournalEntries?: number;\n  now?: () => Date;\n  initialJournal?: readonly BrowserProtectedAuthOperationJournalRecord[];\n  onJournalRecord?: (record: BrowserProtectedAuthOperationJournalRecord) => Promise<void> | void;\n};\n\n/** Secret-bearing commands are admitted only through this controller-private\n * authority. Its durable digest binds all semantics plus credential version,\n * but deliberately excludes ephemeral password/TOTP value bytes. */\nexport class BrowserProtectedAuthController {\n  private readonly core: InteractionControllerCore<\n    BrowserProtectedAuthFillCommandValue,\n    BrowserTargetValue,\n    BrowserProtectedAuthObservationValue,\n    BrowserProtectedAuthFillReceiptValue\n  >;\n\n  constructor(options: BrowserProtectedAuthControllerOptions) {\n    const { browserSessionId, controllerGeneration } = options;\n    this.core = new InteractionControllerCore({\n      driver: options.driver,\n      ...(options.authority ? { authority: options.authority } : {}),\n      ...(options.maxJournalEntries !== undefined\n        ? { maxJournalEntries: options.maxJournalEntries }\n        : {}),\n      ...(options.now ? { now: options.now } : {}),\n      ...(options.initialJournal ? { initialJournal: options.initialJournal } : {}),\n      ...(options.onJournalRecord ? { onJournalRecord: options.onJournalRecord } : {}),\n      commandDigest: protectedAuthCommandDigest,\n      adapter: {\n        resourceLabel: \"browser protected fill\",\n        parseCommand: (value) => BrowserProtectedAuthFillCommand.parse(value),\n        parseTarget: (value) => BrowserTarget.parse(value),\n        parseObservation: (value) => BrowserProtectedAuthObservation.parse(value),\n        parseReceipt: (value) => BrowserProtectedAuthFillReceipt.parse(value),\n        assertCommandAuthority(command) {\n          if (command.browserSessionId !== browserSessionId) {\n            throw new InteractionControllerError(\n              \"resource_not_found\",\n              \"protected fill targets another browser session\",\n            );\n          }\n          if (command.controllerGeneration !== controllerGeneration) {\n            throw new InteractionControllerError(\n              \"controller_stale\",\n              \"protected fill targets a stale browser controller\",\n            );\n          }\n        },\n        assertTargetAuthority(target) {\n          if (\n            target.browserSessionId !== browserSessionId ||\n            target.controllerGeneration !== controllerGeneration\n          ) {\n            throw new InteractionControllerError(\n              \"controller_stale\",\n              \"protected-fill target belongs to a stale browser controller\",\n            );\n          }\n        },\n        assertExpectedGenerations(command, target) {\n          if (command.expectedTargetGeneration !== target.targetGeneration) {\n            throw new InteractionControllerError(\n              \"target_stale\",\n              \"browser target changed before protected fill\",\n              true,\n            );\n          }\n          if (command.expectedDocumentGeneration !== target.documentGeneration) {\n            throw new InteractionControllerError(\n              \"document_stale\",\n              \"browser document changed before protected fill\",\n              true,\n            );\n          }\n        },\n        assertObservationAuthority(observation, targetId) {\n          if (\n            observation.target.id !== targetId ||\n            observation.target.browserSessionId !== browserSessionId ||\n            observation.target.controllerGeneration !== controllerGeneration\n          ) {\n            throw new InteractionControllerError(\n              \"driver_failed\",\n              \"protected-fill driver returned a result outside controller authority\",\n            );\n          }\n        },\n        makeReceipt(input) {\n          return BrowserProtectedAuthFillReceipt.parse({\n            protocolVersion: 1,\n            operationId: input.command.operationId,\n            browserSessionId,\n            controllerGeneration,\n            targetId: input.command.targetId,\n            state: input.state,\n            dispatchedAt: input.dispatchedAt,\n            settledAt: input.settledAt,\n            observation: input.observation,\n            error: input.error,\n          });\n        },\n        recoverReceipt(receipt, settledAt) {\n          if (\n            receipt.browserSessionId !== browserSessionId ||\n            receipt.controllerGeneration !== controllerGeneration\n          ) {\n            throw new Error(\n              `restored protected-fill operation ${receipt.operationId} is outside controller authority`,\n            );\n          }\n          return recoverInteractionReceipt(receipt, settledAt, \"browser protected fill\", (value) =>\n            BrowserProtectedAuthFillReceipt.parse(value),\n          );\n        },\n      },\n    });\n  }\n\n  run(\n    command: BrowserProtectedAuthFillCommandValue,\n  ): Promise<BrowserProtectedAuthFillReceiptValue> {\n    return this.core.run(command);\n  }\n\n  receipt(operationId: string): BrowserProtectedAuthFillReceiptValue | null {\n    return this.core.receipt(operationId);\n  }\n\n  journalSnapshot(): BrowserProtectedAuthOperationJournalRecord[] {\n    return this.core.journalSnapshot();\n  }\n\n  waitForIdle(): Promise<void> {\n    return this.core.waitForIdle();\n  }\n}\n\nexport function recoverBrowserProtectedAuthOperationJournalRecord(\n  record: BrowserProtectedAuthOperationJournalRecord,\n  settledAt: string,\n): BrowserProtectedAuthOperationJournalRecord {\n  const receipt = BrowserProtectedAuthFillReceipt.parse(record.receipt);\n  return {\n    ...record,\n    receipt: recoverInteractionReceipt(receipt, settledAt, \"browser protected fill\", (value) =>\n      BrowserProtectedAuthFillReceipt.parse(value),\n    ),\n  };\n}\n\nfunction protectedAuthCommandDigest(command: BrowserProtectedAuthFillCommandValue): string {\n  const { fields, ...metadata } = command;\n  const secretFree = {\n    ...metadata,\n    fields: fields.map(({ value: _value, ...field }) => field),\n  };\n  return createHash(\"sha256\").update(canonicalJson(secretFree), \"utf8\").digest(\"hex\");\n}\n\nfunction canonicalJson(value: unknown): string {\n  return JSON.stringify(canonicalJsonValue(value));\n}\n\nfunction canonicalJsonValue(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(canonicalJsonValue);\n  if (value !== null && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.entries(value as Record<string, unknown>)\n        .filter(([, entry]) => entry !== undefined)\n        .sort(([left], [right]) => left.localeCompare(right))\n        .map(([key, entry]) => [key, canonicalJsonValue(entry)]),\n    );\n  }\n  return value;\n}\n\nexport type ComputerInteractionDriver = {\n  target(targetId: string): Promise<ComputerTargetValue | null>;\n  observe(targetId: string): Promise<ComputerObservationValue>;\n  validate?(command: ComputerActionCommandValue, target: ComputerTargetValue): Promise<void> | void;\n  dispatch(command: ComputerActionCommandValue): Promise<ComputerObservationValue | null>;\n};\n\nexport type ComputerInteractionAuthority = {\n  authorizeDispatch(command: ComputerActionCommandValue): Promise<void> | void;\n};\n\nexport type ComputerOperationJournalRecord =\n  InteractionOperationJournalRecord<ComputerActionReceiptValue>;\n\nexport type ComputerInteractionControllerOptions = {\n  computerSessionId: string;\n  controllerGeneration: string;\n  driver: ComputerInteractionDriver;\n  authority?: ComputerInteractionAuthority;\n  maxJournalEntries?: number;\n  now?: () => Date;\n  initialJournal?: readonly ComputerOperationJournalRecord[];\n  onJournalRecord?: (record: ComputerOperationJournalRecord) => Promise<void> | void;\n};\n\n/** Placement-resident ComputerSession mutation authority. Linux AT-SPI/X11,\n * macOS AX/ScreenCaptureKit, and later UIA adapters share this exact core. */\nexport class ComputerInteractionController {\n  private readonly core: InteractionControllerCore<\n    ComputerActionCommandValue,\n    ComputerTargetValue,\n    ComputerObservationValue,\n    ComputerActionReceiptValue\n  >;\n\n  constructor(options: ComputerInteractionControllerOptions) {\n    const { computerSessionId, controllerGeneration } = options;\n    this.core = new InteractionControllerCore({\n      driver: options.driver,\n      ...(options.authority ? { authority: options.authority } : {}),\n      ...(options.maxJournalEntries !== undefined\n        ? { maxJournalEntries: options.maxJournalEntries }\n        : {}),\n      ...(options.now ? { now: options.now } : {}),\n      ...(options.initialJournal ? { initialJournal: options.initialJournal } : {}),\n      ...(options.onJournalRecord ? { onJournalRecord: options.onJournalRecord } : {}),\n      adapter: {\n        resourceLabel: \"computer\",\n        parseCommand: (value) => ComputerActionCommand.parse(value),\n        parseTarget: (value) => ComputerTarget.parse(value),\n        parseObservation: (value) => ComputerObservation.parse(value),\n        parseReceipt: (value) => ComputerActionReceipt.parse(value),\n        assertCommandAuthority(command) {\n          if (command.computerSessionId !== computerSessionId) {\n            throw new InteractionControllerError(\n              \"resource_not_found\",\n              \"computer command targets another computer session\",\n            );\n          }\n          if (command.controllerGeneration !== controllerGeneration) {\n            throw new InteractionControllerError(\n              \"controller_stale\",\n              \"computer command targets a stale controller generation\",\n            );\n          }\n        },\n        assertTargetAuthority(target) {\n          if (\n            target.computerSessionId !== computerSessionId ||\n            target.controllerGeneration !== controllerGeneration\n          ) {\n            throw new InteractionControllerError(\n              \"controller_stale\",\n              \"computer target belongs to a stale controller generation\",\n            );\n          }\n        },\n        assertExpectedGenerations(command, target) {\n          if (command.expectedTargetGeneration !== target.targetGeneration) {\n            throw new InteractionControllerError(\n              \"target_stale\",\n              \"computer target changed before the command could dispatch\",\n              true,\n            );\n          }\n        },\n        assertObservationAuthority(observation, targetId) {\n          if (\n            observation.computerSessionId !== computerSessionId ||\n            observation.target.id !== targetId ||\n            observation.target.computerSessionId !== computerSessionId ||\n            observation.target.controllerGeneration !== controllerGeneration\n          ) {\n            throw new InteractionControllerError(\n              \"driver_failed\",\n              \"computer driver returned an observation outside controller authority\",\n            );\n          }\n        },\n        makeReceipt(input) {\n          return ComputerActionReceipt.parse({\n            protocolVersion: 1,\n            operationId: input.command.operationId,\n            computerSessionId,\n            controllerGeneration,\n            targetId: input.command.targetId,\n            state: input.state,\n            dispatchedAt: input.dispatchedAt,\n            settledAt: input.settledAt,\n            observation: input.observation,\n            error: input.error,\n          });\n        },\n        recoverReceipt(receipt, settledAt) {\n          if (\n            receipt.computerSessionId !== computerSessionId ||\n            receipt.controllerGeneration !== controllerGeneration\n          ) {\n            throw new Error(\n              `restored operation ${receipt.operationId} is outside controller authority`,\n            );\n          }\n          return recoverInteractionReceipt(receipt, settledAt, \"computer\", (value) =>\n            ComputerActionReceipt.parse(value),\n          );\n        },\n      },\n    });\n  }\n\n  observe(targetId: string): Promise<ComputerObservationValue> {\n    return this.core.observe(targetId);\n  }\n\n  run(command: ComputerActionCommandValue): Promise<ComputerActionReceiptValue> {\n    return this.core.run(command);\n  }\n\n  receipt(operationId: string): ComputerActionReceiptValue | null {\n    return this.core.receipt(operationId);\n  }\n\n  journalSnapshot(): ComputerOperationJournalRecord[] {\n    return this.core.journalSnapshot();\n  }\n\n  waitForIdle(): Promise<void> {\n    return this.core.waitForIdle();\n  }\n}\n\nexport function recoverComputerOperationJournalRecord(\n  record: ComputerOperationJournalRecord,\n  settledAt: string,\n): ComputerOperationJournalRecord {\n  const receipt = ComputerActionReceipt.parse(record.receipt);\n  return {\n    ...record,\n    receipt: recoverInteractionReceipt(receipt, settledAt, \"computer\", (value) =>\n      ComputerActionReceipt.parse(value),\n    ),\n  };\n}\n","import { createHash } from \"node:crypto\";\nimport type { InteractionError, InteractionOperationState } from \"@opengeni/contracts\";\n\nexport type InteractionControllerErrorCode = InteractionError[\"code\"] | \"journal_full\";\n\n/** A safe, typed rejection known not to have dispatched a side effect. */\nexport class InteractionControllerError extends Error {\n  constructor(\n    readonly code: InteractionControllerErrorCode,\n    message: string,\n    readonly retryable = false,\n  ) {\n    super(message);\n    this.name = \"InteractionControllerError\";\n  }\n}\n\n/** Driver proof that a dispatched command definitively failed without an ambiguous outcome. */\nexport class InteractionDefiniteDriverError extends Error {\n  constructor(\n    readonly code: InteractionError[\"code\"],\n    message: string,\n    readonly retryable = false,\n  ) {\n    super(message);\n    this.name = \"InteractionDefiniteDriverError\";\n  }\n}\n\nexport type InteractionCoreCommand = {\n  operationId: string;\n  controllerGeneration: string;\n  targetId: string;\n};\n\nexport type InteractionCoreTarget = {\n  id: string;\n  controllerGeneration: string;\n};\n\nexport type InteractionCoreObservation<TTarget extends InteractionCoreTarget> = {\n  target: TTarget;\n};\n\nexport type InteractionCoreReceipt<TObservation> = {\n  operationId: string;\n  controllerGeneration: string;\n  targetId: string;\n  state: InteractionOperationState;\n  dispatchedAt: string | null;\n  settledAt: string | null;\n  observation: TObservation | null;\n  error: InteractionError | null;\n};\n\nexport type InteractionOperationJournalRecord<TReceipt> = {\n  operationId: string;\n  commandDigest: string;\n  receipt: TReceipt;\n};\n\ntype InteractionDriver<\n  TCommand extends InteractionCoreCommand,\n  TTarget extends InteractionCoreTarget,\n  TObservation extends InteractionCoreObservation<TTarget>,\n> = {\n  target(targetId: string): Promise<TTarget | null>;\n  observe(targetId: string): Promise<TObservation>;\n  validate?(command: TCommand, target: TTarget): Promise<void> | void;\n  dispatch(command: TCommand): Promise<TObservation | null>;\n};\n\ntype InteractionCoreAdapter<\n  TCommand extends InteractionCoreCommand,\n  TTarget extends InteractionCoreTarget,\n  TObservation extends InteractionCoreObservation<TTarget>,\n  TReceipt extends InteractionCoreReceipt<TObservation>,\n> = {\n  resourceLabel: string;\n  parseCommand(value: unknown): TCommand;\n  parseTarget(value: unknown): TTarget;\n  parseObservation(value: unknown): TObservation;\n  parseReceipt(value: unknown): TReceipt;\n  assertCommandAuthority(command: TCommand): void;\n  assertTargetAuthority(target: TTarget): void;\n  assertExpectedGenerations(command: TCommand, target: TTarget): void;\n  assertObservationAuthority(observation: TObservation, targetId: string): void;\n  makeReceipt(input: {\n    command: TCommand;\n    state: InteractionOperationState;\n    dispatchedAt: string | null;\n    settledAt: string | null;\n    observation: TObservation | null;\n    error: InteractionError | null;\n  }): TReceipt;\n  recoverReceipt(receipt: TReceipt, settledAt: string): TReceipt;\n};\n\ntype InteractionCoreAuthority<TCommand> = {\n  authorizeDispatch(command: TCommand): Promise<void> | void;\n};\n\nexport type InteractionControllerCoreOptions<\n  TCommand extends InteractionCoreCommand,\n  TTarget extends InteractionCoreTarget,\n  TObservation extends InteractionCoreObservation<TTarget>,\n  TReceipt extends InteractionCoreReceipt<TObservation>,\n> = {\n  driver: InteractionDriver<TCommand, TTarget, TObservation>;\n  adapter: InteractionCoreAdapter<TCommand, TTarget, TObservation, TReceipt>;\n  authority?: InteractionCoreAuthority<TCommand>;\n  maxJournalEntries?: number;\n  now?: () => Date;\n  initialJournal?: readonly InteractionOperationJournalRecord<TReceipt>[];\n  onJournalRecord?: (record: InteractionOperationJournalRecord<TReceipt>) => Promise<void> | void;\n  /** Override only when a private command contains ephemeral secret material.\n   * The callback must bind every non-secret semantic input while excluding the\n   * value bytes themselves and return lowercase SHA-256. */\n  commandDigest?: (command: TCommand) => string;\n};\n\ntype JournalEntry<TReceipt> = InteractionOperationJournalRecord<TReceipt> & {\n  completion: Promise<TReceipt>;\n  preparationPersisted: Promise<boolean>;\n};\n\nconst terminalStates = new Set<InteractionOperationState>([\n  \"completed\",\n  \"failed\",\n  \"outcome_unknown\",\n]);\n\n/**\n * Resource-neutral placement mutation authority. Public Browser and Computer\n * controllers supply only their schemas and generation semantics; journaling,\n * idempotency, target-local serialization, and crash policy stay identical.\n */\nexport class InteractionControllerCore<\n  TCommand extends InteractionCoreCommand,\n  TTarget extends InteractionCoreTarget,\n  TObservation extends InteractionCoreObservation<TTarget>,\n  TReceipt extends InteractionCoreReceipt<TObservation>,\n> {\n  private readonly driver: InteractionDriver<TCommand, TTarget, TObservation>;\n  private readonly adapter: InteractionCoreAdapter<TCommand, TTarget, TObservation, TReceipt>;\n  private readonly authority: InteractionCoreAuthority<TCommand> | undefined;\n  private readonly maxJournalEntries: number;\n  private readonly now: () => Date;\n  private readonly onJournalRecord:\n    | ((record: InteractionOperationJournalRecord<TReceipt>) => Promise<void> | void)\n    | undefined;\n  private readonly commandDigest: (command: TCommand) => string;\n  private readonly journal = new Map<string, JournalEntry<TReceipt>>();\n  private readonly targetTails = new Map<string, Promise<void>>();\n\n  constructor(\n    options: InteractionControllerCoreOptions<TCommand, TTarget, TObservation, TReceipt>,\n  ) {\n    this.driver = options.driver;\n    this.adapter = options.adapter;\n    this.authority = options.authority;\n    this.maxJournalEntries = options.maxJournalEntries ?? 10_000;\n    this.now = options.now ?? (() => new Date());\n    this.onJournalRecord = options.onJournalRecord;\n    this.commandDigest = options.commandDigest ?? digestJson;\n    if (!Number.isSafeInteger(this.maxJournalEntries) || this.maxJournalEntries < 1) {\n      throw new Error(\"maxJournalEntries must be a positive safe integer\");\n    }\n    for (const record of options.initialJournal ?? []) this.restoreJournalRecord(record);\n  }\n\n  async observe(targetId: string): Promise<TObservation> {\n    const target = await this.requireCurrentTarget(targetId);\n    const observed = this.adapter.parseObservation(await this.driver.observe(target.id));\n    this.adapter.assertObservationAuthority(observed, target.id);\n    return observed;\n  }\n\n  run(commandInput: TCommand): Promise<TReceipt> {\n    const command = this.adapter.parseCommand(commandInput);\n    this.adapter.assertCommandAuthority(command);\n    const commandDigest = this.commandDigest(command);\n    if (!/^[0-9a-f]{64}$/u.test(commandDigest)) {\n      throw new Error(`${this.adapter.resourceLabel} command digest must be lowercase SHA-256`);\n    }\n    const existing = this.journal.get(command.operationId);\n    if (existing) {\n      if (existing.commandDigest !== commandDigest) {\n        throw new InteractionControllerError(\n          \"operation_conflict\",\n          `operation id is already bound to a different ${this.adapter.resourceLabel} command`,\n        );\n      }\n      return existing.completion;\n    }\n\n    this.makeJournalSpace();\n    const prepared = this.makeReceipt(command, \"prepared\", null, null, null, null);\n    const entry: JournalEntry<TReceipt> = {\n      operationId: command.operationId,\n      commandDigest,\n      receipt: prepared,\n      completion: Promise.resolve(prepared),\n      preparationPersisted: this.publish(command.operationId, commandDigest, prepared).then(\n        () => true,\n        () => false,\n      ),\n    };\n    this.journal.set(command.operationId, entry);\n\n    const previous = this.targetTails.get(command.targetId) ?? Promise.resolve();\n    entry.completion = previous.then(async () => await this.execute(entry, command));\n    const tail = entry.completion.then(\n      () => undefined,\n      () => undefined,\n    );\n    this.targetTails.set(command.targetId, tail);\n    void tail.finally(() => {\n      if (this.targetTails.get(command.targetId) === tail)\n        this.targetTails.delete(command.targetId);\n    });\n    return entry.completion;\n  }\n\n  receipt(operationId: string): TReceipt | null {\n    return this.journal.get(operationId)?.receipt ?? null;\n  }\n\n  journalSnapshot(): InteractionOperationJournalRecord<TReceipt>[] {\n    return [...this.journal.values()].map(({ operationId, commandDigest, receipt }) => ({\n      operationId,\n      commandDigest,\n      receipt,\n    }));\n  }\n\n  /** Wait until every command already admitted to a target queue settles.\n   * Callers must fence new dispatch through `authority` before awaiting this. */\n  async waitForIdle(): Promise<void> {\n    while (this.targetTails.size > 0) await Promise.all([...this.targetTails.values()]);\n  }\n\n  private async execute(entry: JournalEntry<TReceipt>, command: TCommand): Promise<TReceipt> {\n    if (!(await entry.preparationPersisted)) {\n      return await this.failBeforeDispatch(\n        entry,\n        command,\n        `${this.adapter.resourceLabel} operation journal rejected the command before dispatch`,\n      );\n    }\n\n    try {\n      await this.authority?.authorizeDispatch(command);\n      const target = await this.requireCurrentTarget(command.targetId);\n      this.adapter.assertExpectedGenerations(command, target);\n      await this.driver.validate?.(command, target);\n    } catch (error) {\n      return await this.settle(\n        entry,\n        this.makeReceipt(\n          command,\n          \"failed\",\n          null,\n          this.timestamp(),\n          null,\n          safePredispatchError(error, this.adapter.resourceLabel),\n        ),\n      );\n    }\n\n    const dispatchedAt = this.timestamp();\n    const dispatched = this.makeReceipt(command, \"dispatched\", dispatchedAt, null, null, null);\n    try {\n      await this.publish(entry.operationId, entry.commandDigest, dispatched);\n      entry.receipt = dispatched;\n    } catch {\n      return await this.failBeforeDispatch(\n        entry,\n        command,\n        `${this.adapter.resourceLabel} operation journal became unavailable before dispatch`,\n      );\n    }\n\n    try {\n      const dispatchedObservation = await this.driver.dispatch(command);\n      const observation =\n        dispatchedObservation === null\n          ? null\n          : this.adapter.parseObservation(dispatchedObservation);\n      if (observation) this.adapter.assertObservationAuthority(observation, command.targetId);\n      const completed = this.makeReceipt(\n        command,\n        \"completed\",\n        dispatchedAt,\n        this.timestamp(),\n        observation,\n        null,\n      );\n      try {\n        await this.publish(entry.operationId, entry.commandDigest, completed);\n        entry.receipt = completed;\n        return completed;\n      } catch {\n        return await this.settle(\n          entry,\n          this.makeReceipt(command, \"outcome_unknown\", dispatchedAt, this.timestamp(), null, {\n            code: \"controller_lost\",\n            message: `${this.adapter.resourceLabel} command completed but its durable outcome could not be recorded`,\n            retryable: false,\n          }),\n        );\n      }\n    } catch (error) {\n      if (error instanceof InteractionDefiniteDriverError) {\n        return await this.settle(\n          entry,\n          this.makeReceipt(command, \"failed\", dispatchedAt, this.timestamp(), null, {\n            code: error.code,\n            message: error.message,\n            retryable: error.retryable,\n          }),\n        );\n      }\n      return await this.settle(\n        entry,\n        this.makeReceipt(command, \"outcome_unknown\", dispatchedAt, this.timestamp(), null, {\n          code: \"controller_lost\",\n          message: `${this.adapter.resourceLabel} command outcome is unknown after dispatch`,\n          retryable: false,\n        }),\n      );\n    }\n  }\n\n  private async requireCurrentTarget(targetId: string): Promise<TTarget> {\n    const target = await this.driver.target(targetId);\n    if (!target) {\n      throw new InteractionControllerError(\n        \"target_not_found\",\n        `${this.adapter.resourceLabel} target does not exist`,\n      );\n    }\n    const parsed = this.adapter.parseTarget(target);\n    this.adapter.assertTargetAuthority(parsed);\n    return parsed;\n  }\n\n  private makeReceipt(\n    command: TCommand,\n    state: InteractionOperationState,\n    dispatchedAt: string | null,\n    settledAt: string | null,\n    observation: TObservation | null,\n    error: InteractionError | null,\n  ): TReceipt {\n    return this.adapter.makeReceipt({\n      command,\n      state,\n      dispatchedAt,\n      settledAt,\n      observation,\n      error,\n    });\n  }\n\n  private async settle(entry: JournalEntry<TReceipt>, receipt: TReceipt): Promise<TReceipt> {\n    entry.receipt = receipt;\n    try {\n      await this.publish(entry.operationId, entry.commandDigest, receipt);\n    } catch {\n      // Controller-lifetime terminal truth remains authoritative. A restored\n      // dispatched receipt is always recovered as outcome_unknown, never replayed.\n    }\n    return receipt;\n  }\n\n  private async failBeforeDispatch(\n    entry: JournalEntry<TReceipt>,\n    command: TCommand,\n    message: string,\n  ): Promise<TReceipt> {\n    return await this.settle(\n      entry,\n      this.makeReceipt(command, \"failed\", null, this.timestamp(), null, {\n        code: \"driver_failed\",\n        message,\n        retryable: true,\n      }),\n    );\n  }\n\n  private async publish(\n    operationId: string,\n    commandDigest: string,\n    receipt: TReceipt,\n  ): Promise<void> {\n    await this.onJournalRecord?.({ operationId, commandDigest, receipt });\n  }\n\n  private timestamp(): string {\n    return this.now().toISOString();\n  }\n\n  private makeJournalSpace(): void {\n    while (this.journal.size >= this.maxJournalEntries) {\n      const terminal = [...this.journal.entries()].find(([, entry]) =>\n        terminalStates.has(entry.receipt.state),\n      );\n      if (!terminal) {\n        throw new InteractionControllerError(\n          \"journal_full\",\n          `${this.adapter.resourceLabel} operation journal has no safely evictable terminal entry`,\n          true,\n        );\n      }\n      this.journal.delete(terminal[0]);\n    }\n  }\n\n  private restoreJournalRecord(record: InteractionOperationJournalRecord<TReceipt>): void {\n    if (this.journal.has(record.operationId)) {\n      throw new Error(`duplicate restored operation id: ${record.operationId}`);\n    }\n    const parsed = this.adapter.parseReceipt(record.receipt);\n    if (parsed.operationId !== record.operationId) {\n      throw new Error(`restored operation ${record.operationId} has another receipt id`);\n    }\n    const receipt = this.adapter.recoverReceipt(parsed, this.timestamp());\n    const entry: JournalEntry<TReceipt> = {\n      operationId: record.operationId,\n      commandDigest: record.commandDigest,\n      receipt,\n      completion: Promise.resolve(receipt),\n      preparationPersisted: Promise.resolve(true),\n    };\n    this.journal.set(record.operationId, entry);\n  }\n}\n\nexport function recoverInteractionReceipt<TReceipt extends InteractionCoreReceipt<unknown>>(\n  receipt: TReceipt,\n  settledAt: string,\n  resourceLabel: string,\n  parse: (value: unknown) => TReceipt,\n): TReceipt {\n  if (terminalStates.has(receipt.state)) return receipt;\n  return parse({\n    ...receipt,\n    state: receipt.state === \"dispatched\" ? \"outcome_unknown\" : \"failed\",\n    settledAt,\n    observation: null,\n    error:\n      receipt.state === \"dispatched\"\n        ? {\n            code: \"controller_lost\",\n            message: `${resourceLabel} controller restarted after command dispatch`,\n            retryable: false,\n          }\n        : {\n            code: \"controller_lost\",\n            message: `${resourceLabel} controller restarted before command dispatch`,\n            retryable: true,\n          },\n  });\n}\n\nfunction safePredispatchError(error: unknown, resourceLabel: string): InteractionError {\n  if (error instanceof InteractionControllerError && error.code !== \"journal_full\") {\n    return {\n      code: error.code,\n      message: error.message,\n      retryable: error.retryable,\n    };\n  }\n  return {\n    code: \"driver_failed\",\n    message: `${resourceLabel} command failed before dispatch`,\n    retryable: false,\n  };\n}\n\nfunction digestJson(value: unknown): string {\n  return createHash(\"sha256\").update(canonicalJson(value), \"utf8\").digest(\"hex\");\n}\n\nfunction canonicalJson(value: unknown): string {\n  return JSON.stringify(canonicalJsonValue(value));\n}\n\nfunction canonicalJsonValue(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(canonicalJsonValue);\n  if (value !== null && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.entries(value as Record<string, unknown>)\n        .sort(([left], [right]) => left.localeCompare(right))\n        .map(([key, entry]) => [key, canonicalJsonValue(entry)]),\n    );\n  }\n  return value;\n}\n"],"mappings":";AAAA,SAAS,cAAAA,mBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAYK;;;ACxBP,SAAS,kBAAkB;AAMpB,IAAM,6BAAN,cAAyC,MAAM;AAAA,EACpD,YACW,MACT,SACS,YAAY,OACrB;AACA,UAAM,OAAO;AAJJ;AAEA;AAGT,SAAK,OAAO;AAAA,EACd;AACF;AAGO,IAAM,iCAAN,cAA6C,MAAM;AAAA,EACxD,YACW,MACT,SACS,YAAY,OACrB;AACA,UAAM,OAAO;AAJJ;AAEA;AAGT,SAAK,OAAO;AAAA,EACd;AACF;AAmGA,IAAM,iBAAiB,oBAAI,IAA+B;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOM,IAAM,4BAAN,MAKL;AAAA,EACiB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA,UAAU,oBAAI,IAAoC;AAAA,EAClD,cAAc,oBAAI,IAA2B;AAAA,EAE9D,YACE,SACA;AACA,SAAK,SAAS,QAAQ;AACtB,SAAK,UAAU,QAAQ;AACvB,SAAK,YAAY,QAAQ;AACzB,SAAK,oBAAoB,QAAQ,qBAAqB;AACtD,SAAK,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC1C,SAAK,kBAAkB,QAAQ;AAC/B,SAAK,gBAAgB,QAAQ,iBAAiB;AAC9C,QAAI,CAAC,OAAO,cAAc,KAAK,iBAAiB,KAAK,KAAK,oBAAoB,GAAG;AAC/E,YAAM,IAAI,MAAM,mDAAmD;AAAA,IACrE;AACA,eAAW,UAAU,QAAQ,kBAAkB,CAAC,EAAG,MAAK,qBAAqB,MAAM;AAAA,EACrF;AAAA,EAEA,MAAM,QAAQ,UAAyC;AACrD,UAAM,SAAS,MAAM,KAAK,qBAAqB,QAAQ;AACvD,UAAM,WAAW,KAAK,QAAQ,iBAAiB,MAAM,KAAK,OAAO,QAAQ,OAAO,EAAE,CAAC;AACnF,SAAK,QAAQ,2BAA2B,UAAU,OAAO,EAAE;AAC3D,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,cAA2C;AAC7C,UAAM,UAAU,KAAK,QAAQ,aAAa,YAAY;AACtD,SAAK,QAAQ,uBAAuB,OAAO;AAC3C,UAAM,gBAAgB,KAAK,cAAc,OAAO;AAChD,QAAI,CAAC,kBAAkB,KAAK,aAAa,GAAG;AAC1C,YAAM,IAAI,MAAM,GAAG,KAAK,QAAQ,aAAa,2CAA2C;AAAA,IAC1F;AACA,UAAM,WAAW,KAAK,QAAQ,IAAI,QAAQ,WAAW;AACrD,QAAI,UAAU;AACZ,UAAI,SAAS,kBAAkB,eAAe;AAC5C,cAAM,IAAI;AAAA,UACR;AAAA,UACA,gDAAgD,KAAK,QAAQ,aAAa;AAAA,QAC5E;AAAA,MACF;AACA,aAAO,SAAS;AAAA,IAClB;AAEA,SAAK,iBAAiB;AACtB,UAAM,WAAW,KAAK,YAAY,SAAS,YAAY,MAAM,MAAM,MAAM,IAAI;AAC7E,UAAM,QAAgC;AAAA,MACpC,aAAa,QAAQ;AAAA,MACrB;AAAA,MACA,SAAS;AAAA,MACT,YAAY,QAAQ,QAAQ,QAAQ;AAAA,MACpC,sBAAsB,KAAK,QAAQ,QAAQ,aAAa,eAAe,QAAQ,EAAE;AAAA,QAC/E,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AACA,SAAK,QAAQ,IAAI,QAAQ,aAAa,KAAK;AAE3C,UAAM,WAAW,KAAK,YAAY,IAAI,QAAQ,QAAQ,KAAK,QAAQ,QAAQ;AAC3E,UAAM,aAAa,SAAS,KAAK,YAAY,MAAM,KAAK,QAAQ,OAAO,OAAO,CAAC;AAC/E,UAAM,OAAO,MAAM,WAAW;AAAA,MAC5B,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,SAAK,YAAY,IAAI,QAAQ,UAAU,IAAI;AAC3C,SAAK,KAAK,QAAQ,MAAM;AACtB,UAAI,KAAK,YAAY,IAAI,QAAQ,QAAQ,MAAM;AAC7C,aAAK,YAAY,OAAO,QAAQ,QAAQ;AAAA,IAC5C,CAAC;AACD,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,QAAQ,aAAsC;AAC5C,WAAO,KAAK,QAAQ,IAAI,WAAW,GAAG,WAAW;AAAA,EACnD;AAAA,EAEA,kBAAiE;AAC/D,WAAO,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,aAAa,eAAe,QAAQ,OAAO;AAAA,MAClF;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE;AAAA,EACJ;AAAA;AAAA;AAAA,EAIA,MAAM,cAA6B;AACjC,WAAO,KAAK,YAAY,OAAO,EAAG,OAAM,QAAQ,IAAI,CAAC,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC;AAAA,EACpF;AAAA,EAEA,MAAc,QAAQ,OAA+B,SAAsC;AACzF,QAAI,CAAE,MAAM,MAAM,sBAAuB;AACvC,aAAO,MAAM,KAAK;AAAA,QAChB;AAAA,QACA;AAAA,QACA,GAAG,KAAK,QAAQ,aAAa;AAAA,MAC/B;AAAA,IACF;AAEA,QAAI;AACF,YAAM,KAAK,WAAW,kBAAkB,OAAO;AAC/C,YAAM,SAAS,MAAM,KAAK,qBAAqB,QAAQ,QAAQ;AAC/D,WAAK,QAAQ,0BAA0B,SAAS,MAAM;AACtD,YAAM,KAAK,OAAO,WAAW,SAAS,MAAM;AAAA,IAC9C,SAAS,OAAO;AACd,aAAO,MAAM,KAAK;AAAA,QAChB;AAAA,QACA,KAAK;AAAA,UACH;AAAA,UACA;AAAA,UACA;AAAA,UACA,KAAK,UAAU;AAAA,UACf;AAAA,UACA,qBAAqB,OAAO,KAAK,QAAQ,aAAa;AAAA,QACxD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,eAAe,KAAK,UAAU;AACpC,UAAM,aAAa,KAAK,YAAY,SAAS,cAAc,cAAc,MAAM,MAAM,IAAI;AACzF,QAAI;AACF,YAAM,KAAK,QAAQ,MAAM,aAAa,MAAM,eAAe,UAAU;AACrE,YAAM,UAAU;AAAA,IAClB,QAAQ;AACN,aAAO,MAAM,KAAK;AAAA,QAChB;AAAA,QACA;AAAA,QACA,GAAG,KAAK,QAAQ,aAAa;AAAA,MAC/B;AAAA,IACF;AAEA,QAAI;AACF,YAAM,wBAAwB,MAAM,KAAK,OAAO,SAAS,OAAO;AAChE,YAAM,cACJ,0BAA0B,OACtB,OACA,KAAK,QAAQ,iBAAiB,qBAAqB;AACzD,UAAI,YAAa,MAAK,QAAQ,2BAA2B,aAAa,QAAQ,QAAQ;AACtF,YAAM,YAAY,KAAK;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,QACA,KAAK,UAAU;AAAA,QACf;AAAA,QACA;AAAA,MACF;AACA,UAAI;AACF,cAAM,KAAK,QAAQ,MAAM,aAAa,MAAM,eAAe,SAAS;AACpE,cAAM,UAAU;AAChB,eAAO;AAAA,MACT,QAAQ;AACN,eAAO,MAAM,KAAK;AAAA,UAChB;AAAA,UACA,KAAK,YAAY,SAAS,mBAAmB,cAAc,KAAK,UAAU,GAAG,MAAM;AAAA,YACjF,MAAM;AAAA,YACN,SAAS,GAAG,KAAK,QAAQ,aAAa;AAAA,YACtC,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,UAAI,iBAAiB,gCAAgC;AACnD,eAAO,MAAM,KAAK;AAAA,UAChB;AAAA,UACA,KAAK,YAAY,SAAS,UAAU,cAAc,KAAK,UAAU,GAAG,MAAM;AAAA,YACxE,MAAM,MAAM;AAAA,YACZ,SAAS,MAAM;AAAA,YACf,WAAW,MAAM;AAAA,UACnB,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO,MAAM,KAAK;AAAA,QAChB;AAAA,QACA,KAAK,YAAY,SAAS,mBAAmB,cAAc,KAAK,UAAU,GAAG,MAAM;AAAA,UACjF,MAAM;AAAA,UACN,SAAS,GAAG,KAAK,QAAQ,aAAa;AAAA,UACtC,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,qBAAqB,UAAoC;AACrE,UAAM,SAAS,MAAM,KAAK,OAAO,OAAO,QAAQ;AAChD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI;AAAA,QACR;AAAA,QACA,GAAG,KAAK,QAAQ,aAAa;AAAA,MAC/B;AAAA,IACF;AACA,UAAM,SAAS,KAAK,QAAQ,YAAY,MAAM;AAC9C,SAAK,QAAQ,sBAAsB,MAAM;AACzC,WAAO;AAAA,EACT;AAAA,EAEQ,YACN,SACA,OACA,cACA,WACA,aACA,OACU;AACV,WAAO,KAAK,QAAQ,YAAY;AAAA,MAC9B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,OAAO,OAA+B,SAAsC;AACxF,UAAM,UAAU;AAChB,QAAI;AACF,YAAM,KAAK,QAAQ,MAAM,aAAa,MAAM,eAAe,OAAO;AAAA,IACpE,QAAQ;AAAA,IAGR;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,mBACZ,OACA,SACA,SACmB;AACnB,WAAO,MAAM,KAAK;AAAA,MAChB;AAAA,MACA,KAAK,YAAY,SAAS,UAAU,MAAM,KAAK,UAAU,GAAG,MAAM;AAAA,QAChE,MAAM;AAAA,QACN;AAAA,QACA,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,QACZ,aACA,eACA,SACe;AACf,UAAM,KAAK,kBAAkB,EAAE,aAAa,eAAe,QAAQ,CAAC;AAAA,EACtE;AAAA,EAEQ,YAAoB;AAC1B,WAAO,KAAK,IAAI,EAAE,YAAY;AAAA,EAChC;AAAA,EAEQ,mBAAyB;AAC/B,WAAO,KAAK,QAAQ,QAAQ,KAAK,mBAAmB;AAClD,YAAM,WAAW,CAAC,GAAG,KAAK,QAAQ,QAAQ,CAAC,EAAE;AAAA,QAAK,CAAC,CAAC,EAAE,KAAK,MACzD,eAAe,IAAI,MAAM,QAAQ,KAAK;AAAA,MACxC;AACA,UAAI,CAAC,UAAU;AACb,cAAM,IAAI;AAAA,UACR;AAAA,UACA,GAAG,KAAK,QAAQ,aAAa;AAAA,UAC7B;AAAA,QACF;AAAA,MACF;AACA,WAAK,QAAQ,OAAO,SAAS,CAAC,CAAC;AAAA,IACjC;AAAA,EACF;AAAA,EAEQ,qBAAqB,QAA2D;AACtF,QAAI,KAAK,QAAQ,IAAI,OAAO,WAAW,GAAG;AACxC,YAAM,IAAI,MAAM,oCAAoC,OAAO,WAAW,EAAE;AAAA,IAC1E;AACA,UAAM,SAAS,KAAK,QAAQ,aAAa,OAAO,OAAO;AACvD,QAAI,OAAO,gBAAgB,OAAO,aAAa;AAC7C,YAAM,IAAI,MAAM,sBAAsB,OAAO,WAAW,yBAAyB;AAAA,IACnF;AACA,UAAM,UAAU,KAAK,QAAQ,eAAe,QAAQ,KAAK,UAAU,CAAC;AACpE,UAAM,QAAgC;AAAA,MACpC,aAAa,OAAO;AAAA,MACpB,eAAe,OAAO;AAAA,MACtB;AAAA,MACA,YAAY,QAAQ,QAAQ,OAAO;AAAA,MACnC,sBAAsB,QAAQ,QAAQ,IAAI;AAAA,IAC5C;AACA,SAAK,QAAQ,IAAI,OAAO,aAAa,KAAK;AAAA,EAC5C;AACF;AAEO,SAAS,0BACd,SACA,WACA,eACA,OACU;AACV,MAAI,eAAe,IAAI,QAAQ,KAAK,EAAG,QAAO;AAC9C,SAAO,MAAM;AAAA,IACX,GAAG;AAAA,IACH,OAAO,QAAQ,UAAU,eAAe,oBAAoB;AAAA,IAC5D;AAAA,IACA,aAAa;AAAA,IACb,OACE,QAAQ,UAAU,eACd;AAAA,MACE,MAAM;AAAA,MACN,SAAS,GAAG,aAAa;AAAA,MACzB,WAAW;AAAA,IACb,IACA;AAAA,MACE,MAAM;AAAA,MACN,SAAS,GAAG,aAAa;AAAA,MACzB,WAAW;AAAA,IACb;AAAA,EACR,CAAC;AACH;AAEA,SAAS,qBAAqB,OAAgB,eAAyC;AACrF,MAAI,iBAAiB,8BAA8B,MAAM,SAAS,gBAAgB;AAChF,WAAO;AAAA,MACL,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM;AAAA,MACf,WAAW,MAAM;AAAA,IACnB;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,GAAG,aAAa;AAAA,IACzB,WAAW;AAAA,EACb;AACF;AAEA,SAAS,WAAW,OAAwB;AAC1C,SAAO,WAAW,QAAQ,EAAE,OAAO,cAAc,KAAK,GAAG,MAAM,EAAE,OAAO,KAAK;AAC/E;AAEA,SAAS,cAAc,OAAwB;AAC7C,SAAO,KAAK,UAAU,mBAAmB,KAAK,CAAC;AACjD;AAEA,SAAS,mBAAmB,OAAyB;AACnD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,kBAAkB;AAC7D,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,KAAgC,EAC5C,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,mBAAmB,KAAK,CAAC,CAAC;AAAA,IAC3D;AAAA,EACF;AACA,SAAO;AACT;;;ADjbO,IAAM,+BAAN,MAAmC;AAAA,EACvB;AAAA,EAOjB,YAAY,SAA8C;AACxD,UAAM,EAAE,kBAAkB,qBAAqB,IAAI;AACnD,SAAK,OAAO,IAAI,0BAA0B;AAAA,MACxC,QAAQ,QAAQ;AAAA,MAChB,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,MAC5D,GAAI,QAAQ,sBAAsB,SAC9B,EAAE,mBAAmB,QAAQ,kBAAkB,IAC/C,CAAC;AAAA,MACL,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,MAC1C,GAAI,QAAQ,iBAAiB,EAAE,gBAAgB,QAAQ,eAAe,IAAI,CAAC;AAAA,MAC3E,GAAI,QAAQ,kBAAkB,EAAE,iBAAiB,QAAQ,gBAAgB,IAAI,CAAC;AAAA,MAC9E,SAAS;AAAA,QACP,eAAe;AAAA,QACf,cAAc,CAAC,UAAU,qBAAqB,MAAM,KAAK;AAAA,QACzD,aAAa,CAAC,UAAU,cAAc,MAAM,KAAK;AAAA,QACjD,kBAAkB,CAAC,UAAU,mBAAmB,MAAM,KAAK;AAAA,QAC3D,cAAc,CAAC,UAAU,qBAAqB,MAAM,KAAK;AAAA,QACzD,uBAAuB,SAAS;AAC9B,cAAI,QAAQ,qBAAqB,kBAAkB;AACjD,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AACA,cAAI,QAAQ,yBAAyB,sBAAsB;AACzD,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,sBAAsB,QAAQ;AAC5B,cACE,OAAO,qBAAqB,oBAC5B,OAAO,yBAAyB,sBAChC;AACA,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,0BAA0B,SAAS,QAAQ;AACzC,cAAI,QAAQ,6BAA6B,OAAO,kBAAkB;AAChE,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,cACA;AAAA,YACF;AAAA,UACF;AACA,cAAI,QAAQ,+BAA+B,OAAO,oBAAoB;AACpE,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,2BAA2B,aAAa,UAAU;AAChD,cACE,YAAY,qBAAqB,oBACjC,YAAY,OAAO,OAAO,YAC1B,YAAY,OAAO,qBAAqB,oBACxC,YAAY,OAAO,yBAAyB,sBAC5C;AACA,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,YAAY,OAAO;AACjB,iBAAO,qBAAqB,MAAM;AAAA,YAChC,iBAAiB;AAAA,YACjB,aAAa,MAAM,QAAQ;AAAA,YAC3B;AAAA,YACA;AAAA,YACA,UAAU,MAAM,QAAQ;AAAA,YACxB,OAAO,MAAM;AAAA,YACb,cAAc,MAAM;AAAA,YACpB,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,OAAO,MAAM;AAAA,UACf,CAAC;AAAA,QACH;AAAA,QACA,eAAe,SAAS,WAAW;AACjC,cACE,QAAQ,qBAAqB,oBAC7B,QAAQ,yBAAyB,sBACjC;AACA,kBAAM,IAAI;AAAA,cACR,sBAAsB,QAAQ,WAAW;AAAA,YAC3C;AAAA,UACF;AACA,iBAAO;AAAA,YAA0B;AAAA,YAAS;AAAA,YAAW;AAAA,YAAW,CAAC,UAC/D,qBAAqB,MAAM,KAAK;AAAA,UAClC;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,QAAQ,UAAoD;AAC1D,WAAO,KAAK,KAAK,QAAQ,QAAQ;AAAA,EACnC;AAAA,EAEA,IAAI,SAAwE;AAC1E,WAAO,KAAK,KAAK,IAAI,OAAO;AAAA,EAC9B;AAAA,EAEA,QAAQ,aAAuD;AAC7D,WAAO,KAAK,KAAK,QAAQ,WAAW;AAAA,EACtC;AAAA,EAEA,kBAAmD;AACjD,WAAO,KAAK,KAAK,gBAAgB;AAAA,EACnC;AAAA,EAEA,cAA6B;AAC3B,WAAO,KAAK,KAAK,YAAY;AAAA,EAC/B;AACF;AAEO,SAAS,qCACd,QACA,WAC+B;AAC/B,QAAM,UAAU,qBAAqB,MAAM,OAAO,OAAO;AACzD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS;AAAA,MAA0B;AAAA,MAAS;AAAA,MAAW;AAAA,MAAW,CAAC,UACjE,qBAAqB,MAAM,KAAK;AAAA,IAClC;AAAA,EACF;AACF;AAmCO,IAAM,iCAAN,MAAqC;AAAA,EACzB;AAAA,EAOjB,YAAY,SAAgD;AAC1D,UAAM,EAAE,kBAAkB,qBAAqB,IAAI;AACnD,SAAK,OAAO,IAAI,0BAA0B;AAAA,MACxC,QAAQ,QAAQ;AAAA,MAChB,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,MAC5D,GAAI,QAAQ,sBAAsB,SAC9B,EAAE,mBAAmB,QAAQ,kBAAkB,IAC/C,CAAC;AAAA,MACL,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,MAC1C,GAAI,QAAQ,iBAAiB,EAAE,gBAAgB,QAAQ,eAAe,IAAI,CAAC;AAAA,MAC3E,GAAI,QAAQ,kBAAkB,EAAE,iBAAiB,QAAQ,gBAAgB,IAAI,CAAC;AAAA,MAC9E,eAAe;AAAA,MACf,SAAS;AAAA,QACP,eAAe;AAAA,QACf,cAAc,CAAC,UAAU,gCAAgC,MAAM,KAAK;AAAA,QACpE,aAAa,CAAC,UAAU,cAAc,MAAM,KAAK;AAAA,QACjD,kBAAkB,CAAC,UAAU,gCAAgC,MAAM,KAAK;AAAA,QACxE,cAAc,CAAC,UAAU,gCAAgC,MAAM,KAAK;AAAA,QACpE,uBAAuB,SAAS;AAC9B,cAAI,QAAQ,qBAAqB,kBAAkB;AACjD,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AACA,cAAI,QAAQ,yBAAyB,sBAAsB;AACzD,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,sBAAsB,QAAQ;AAC5B,cACE,OAAO,qBAAqB,oBAC5B,OAAO,yBAAyB,sBAChC;AACA,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,0BAA0B,SAAS,QAAQ;AACzC,cAAI,QAAQ,6BAA6B,OAAO,kBAAkB;AAChE,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,cACA;AAAA,YACF;AAAA,UACF;AACA,cAAI,QAAQ,+BAA+B,OAAO,oBAAoB;AACpE,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,2BAA2B,aAAa,UAAU;AAChD,cACE,YAAY,OAAO,OAAO,YAC1B,YAAY,OAAO,qBAAqB,oBACxC,YAAY,OAAO,yBAAyB,sBAC5C;AACA,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,YAAY,OAAO;AACjB,iBAAO,gCAAgC,MAAM;AAAA,YAC3C,iBAAiB;AAAA,YACjB,aAAa,MAAM,QAAQ;AAAA,YAC3B;AAAA,YACA;AAAA,YACA,UAAU,MAAM,QAAQ;AAAA,YACxB,OAAO,MAAM;AAAA,YACb,cAAc,MAAM;AAAA,YACpB,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,OAAO,MAAM;AAAA,UACf,CAAC;AAAA,QACH;AAAA,QACA,eAAe,SAAS,WAAW;AACjC,cACE,QAAQ,qBAAqB,oBAC7B,QAAQ,yBAAyB,sBACjC;AACA,kBAAM,IAAI;AAAA,cACR,qCAAqC,QAAQ,WAAW;AAAA,YAC1D;AAAA,UACF;AACA,iBAAO;AAAA,YAA0B;AAAA,YAAS;AAAA,YAAW;AAAA,YAA0B,CAAC,UAC9E,gCAAgC,MAAM,KAAK;AAAA,UAC7C;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,IACE,SAC+C;AAC/C,WAAO,KAAK,KAAK,IAAI,OAAO;AAAA,EAC9B;AAAA,EAEA,QAAQ,aAAkE;AACxE,WAAO,KAAK,KAAK,QAAQ,WAAW;AAAA,EACtC;AAAA,EAEA,kBAAgE;AAC9D,WAAO,KAAK,KAAK,gBAAgB;AAAA,EACnC;AAAA,EAEA,cAA6B;AAC3B,WAAO,KAAK,KAAK,YAAY;AAAA,EAC/B;AACF;AAEO,SAAS,kDACd,QACA,WAC4C;AAC5C,QAAM,UAAU,gCAAgC,MAAM,OAAO,OAAO;AACpE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS;AAAA,MAA0B;AAAA,MAAS;AAAA,MAAW;AAAA,MAA0B,CAAC,UAChF,gCAAgC,MAAM,KAAK;AAAA,IAC7C;AAAA,EACF;AACF;AAEA,SAAS,2BAA2B,SAAuD;AACzF,QAAM,EAAE,QAAQ,GAAG,SAAS,IAAI;AAChC,QAAM,aAAa;AAAA,IACjB,GAAG;AAAA,IACH,QAAQ,OAAO,IAAI,CAAC,EAAE,OAAO,QAAQ,GAAG,MAAM,MAAM,KAAK;AAAA,EAC3D;AACA,SAAOC,YAAW,QAAQ,EAAE,OAAOC,eAAc,UAAU,GAAG,MAAM,EAAE,OAAO,KAAK;AACpF;AAEA,SAASA,eAAc,OAAwB;AAC7C,SAAO,KAAK,UAAUC,oBAAmB,KAAK,CAAC;AACjD;AAEA,SAASA,oBAAmB,OAAyB;AACnD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAIA,mBAAkB;AAC7D,MAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,KAAgC,EAC5C,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,UAAU,MAAS,EACzC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,KAAK,cAAc,KAAK,CAAC,EACnD,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAKA,oBAAmB,KAAK,CAAC,CAAC;AAAA,IAC3D;AAAA,EACF;AACA,SAAO;AACT;AA6BO,IAAM,gCAAN,MAAoC;AAAA,EACxB;AAAA,EAOjB,YAAY,SAA+C;AACzD,UAAM,EAAE,mBAAmB,qBAAqB,IAAI;AACpD,SAAK,OAAO,IAAI,0BAA0B;AAAA,MACxC,QAAQ,QAAQ;AAAA,MAChB,GAAI,QAAQ,YAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,MAC5D,GAAI,QAAQ,sBAAsB,SAC9B,EAAE,mBAAmB,QAAQ,kBAAkB,IAC/C,CAAC;AAAA,MACL,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,MAC1C,GAAI,QAAQ,iBAAiB,EAAE,gBAAgB,QAAQ,eAAe,IAAI,CAAC;AAAA,MAC3E,GAAI,QAAQ,kBAAkB,EAAE,iBAAiB,QAAQ,gBAAgB,IAAI,CAAC;AAAA,MAC9E,SAAS;AAAA,QACP,eAAe;AAAA,QACf,cAAc,CAAC,UAAU,sBAAsB,MAAM,KAAK;AAAA,QAC1D,aAAa,CAAC,UAAU,eAAe,MAAM,KAAK;AAAA,QAClD,kBAAkB,CAAC,UAAU,oBAAoB,MAAM,KAAK;AAAA,QAC5D,cAAc,CAAC,UAAU,sBAAsB,MAAM,KAAK;AAAA,QAC1D,uBAAuB,SAAS;AAC9B,cAAI,QAAQ,sBAAsB,mBAAmB;AACnD,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AACA,cAAI,QAAQ,yBAAyB,sBAAsB;AACzD,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,sBAAsB,QAAQ;AAC5B,cACE,OAAO,sBAAsB,qBAC7B,OAAO,yBAAyB,sBAChC;AACA,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,0BAA0B,SAAS,QAAQ;AACzC,cAAI,QAAQ,6BAA6B,OAAO,kBAAkB;AAChE,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,2BAA2B,aAAa,UAAU;AAChD,cACE,YAAY,sBAAsB,qBAClC,YAAY,OAAO,OAAO,YAC1B,YAAY,OAAO,sBAAsB,qBACzC,YAAY,OAAO,yBAAyB,sBAC5C;AACA,kBAAM,IAAI;AAAA,cACR;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,YAAY,OAAO;AACjB,iBAAO,sBAAsB,MAAM;AAAA,YACjC,iBAAiB;AAAA,YACjB,aAAa,MAAM,QAAQ;AAAA,YAC3B;AAAA,YACA;AAAA,YACA,UAAU,MAAM,QAAQ;AAAA,YACxB,OAAO,MAAM;AAAA,YACb,cAAc,MAAM;AAAA,YACpB,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,OAAO,MAAM;AAAA,UACf,CAAC;AAAA,QACH;AAAA,QACA,eAAe,SAAS,WAAW;AACjC,cACE,QAAQ,sBAAsB,qBAC9B,QAAQ,yBAAyB,sBACjC;AACA,kBAAM,IAAI;AAAA,cACR,sBAAsB,QAAQ,WAAW;AAAA,YAC3C;AAAA,UACF;AACA,iBAAO;AAAA,YAA0B;AAAA,YAAS;AAAA,YAAW;AAAA,YAAY,CAAC,UAChE,sBAAsB,MAAM,KAAK;AAAA,UACnC;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,QAAQ,UAAqD;AAC3D,WAAO,KAAK,KAAK,QAAQ,QAAQ;AAAA,EACnC;AAAA,EAEA,IAAI,SAA0E;AAC5E,WAAO,KAAK,KAAK,IAAI,OAAO;AAAA,EAC9B;AAAA,EAEA,QAAQ,aAAwD;AAC9D,WAAO,KAAK,KAAK,QAAQ,WAAW;AAAA,EACtC;AAAA,EAEA,kBAAoD;AAClD,WAAO,KAAK,KAAK,gBAAgB;AAAA,EACnC;AAAA,EAEA,cAA6B;AAC3B,WAAO,KAAK,KAAK,YAAY;AAAA,EAC/B;AACF;AAEO,SAAS,sCACd,QACA,WACgC;AAChC,QAAM,UAAU,sBAAsB,MAAM,OAAO,OAAO;AAC1D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS;AAAA,MAA0B;AAAA,MAAS;AAAA,MAAW;AAAA,MAAY,CAAC,UAClE,sBAAsB,MAAM,KAAK;AAAA,IACnC;AAAA,EACF;AACF;","names":["createHash","createHash","canonicalJson","canonicalJsonValue"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/interaction",
-  "version": "0.2.2",
+  "version": "0.4.1",
   "description": "Provider-neutral browser and computer interaction controller for OpenGeni.",
   "license": "Apache-2.0",
   "repository": {
@@ -34,7 +34,7 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/contracts": "^0.44.1"
+    "@opengeni/contracts": "^0.50.0"
   },
   "engines": {
     "node": ">=18"

package/src/controller-core.ts

@@ -67,7 +67,7 @@ type InteractionDriver<
   target(targetId: string): Promise<TTarget | null>;
   observe(targetId: string): Promise<TObservation>;
   validate?(command: TCommand, target: TTarget): Promise<void> | void;
-  dispatch(command: TCommand): Promise<TObservation>;
+  dispatch(command: TCommand): Promise<TObservation | null>;
 };
 
 type InteractionCoreAdapter<
@@ -113,6 +113,10 @@ export type InteractionControllerCoreOptions<
   now?: () => Date;
   initialJournal?: readonly InteractionOperationJournalRecord<TReceipt>[];
   onJournalRecord?: (record: InteractionOperationJournalRecord<TReceipt>) => Promise<void> | void;
+  /** Override only when a private command contains ephemeral secret material.
+   * The callback must bind every non-secret semantic input while excluding the
+   * value bytes themselves and return lowercase SHA-256. */
+  commandDigest?: (command: TCommand) => string;
 };
 
 type JournalEntry<TReceipt> = InteractionOperationJournalRecord<TReceipt> & {
@@ -145,6 +149,7 @@ export class InteractionControllerCore<
   private readonly onJournalRecord:
     | ((record: InteractionOperationJournalRecord<TReceipt>) => Promise<void> | void)
     | undefined;
+  private readonly commandDigest: (command: TCommand) => string;
   private readonly journal = new Map<string, JournalEntry<TReceipt>>();
   private readonly targetTails = new Map<string, Promise<void>>();
 
@@ -157,6 +162,7 @@ export class InteractionControllerCore<
     this.maxJournalEntries = options.maxJournalEntries ?? 10_000;
     this.now = options.now ?? (() => new Date());
     this.onJournalRecord = options.onJournalRecord;
+    this.commandDigest = options.commandDigest ?? digestJson;
     if (!Number.isSafeInteger(this.maxJournalEntries) || this.maxJournalEntries < 1) {
       throw new Error("maxJournalEntries must be a positive safe integer");
     }
@@ -173,7 +179,10 @@ export class InteractionControllerCore<
   run(commandInput: TCommand): Promise<TReceipt> {
     const command = this.adapter.parseCommand(commandInput);
     this.adapter.assertCommandAuthority(command);
-    const commandDigest = digestJson(command);
+    const commandDigest = this.commandDigest(command);
+    if (!/^[0-9a-f]{64}$/u.test(commandDigest)) {
+      throw new Error(`${this.adapter.resourceLabel} command digest must be lowercase SHA-256`);
+    }
     const existing = this.journal.get(command.operationId);
     if (existing) {
       if (existing.commandDigest !== commandDigest) {
@@ -273,8 +282,12 @@ export class InteractionControllerCore<
     }
 
     try {
-      const observation = this.adapter.parseObservation(await this.driver.dispatch(command));
-      this.adapter.assertObservationAuthority(observation, command.targetId);
+      const dispatchedObservation = await this.driver.dispatch(command);
+      const observation =
+        dispatchedObservation === null
+          ? null
+          : this.adapter.parseObservation(dispatchedObservation);
+      if (observation) this.adapter.assertObservationAuthority(observation, command.targetId);
       const completed = this.makeReceipt(
         command,
         "completed",

package/src/index.ts

@@ -1,7 +1,11 @@
+import { createHash } from "node:crypto";
 import {
   BrowserActionCommand,
   BrowserActionReceipt,
   BrowserObservation,
+  BrowserProtectedAuthFillCommand,
+  BrowserProtectedAuthFillReceipt,
+  BrowserProtectedAuthObservation,
   BrowserTarget,
   ComputerActionCommand,
   ComputerActionReceipt,
@@ -10,6 +14,9 @@ import {
   type BrowserActionCommand as BrowserActionCommandValue,
   type BrowserActionReceipt as BrowserActionReceiptValue,
   type BrowserObservation as BrowserObservationValue,
+  type BrowserProtectedAuthFillCommand as BrowserProtectedAuthFillCommandValue,
+  type BrowserProtectedAuthFillReceipt as BrowserProtectedAuthFillReceiptValue,
+  type BrowserProtectedAuthObservation as BrowserProtectedAuthObservationValue,
   type BrowserTarget as BrowserTargetValue,
   type ComputerActionCommand as ComputerActionCommandValue,
   type ComputerActionReceipt as ComputerActionReceiptValue,
@@ -35,7 +42,7 @@ export type BrowserInteractionDriver = {
   target(targetId: string): Promise<BrowserTargetValue | null>;
   observe(targetId: string): Promise<BrowserObservationValue>;
   validate?(command: BrowserActionCommandValue, target: BrowserTargetValue): Promise<void> | void;
-  dispatch(command: BrowserActionCommandValue): Promise<BrowserObservationValue>;
+  dispatch(command: BrowserActionCommandValue): Promise<BrowserObservationValue | null>;
 };
 
 export type BrowserInteractionAuthority = {
@@ -112,12 +119,14 @@ export class BrowserInteractionController {
             throw new InteractionControllerError(
               "target_stale",
               "browser target changed before the command could dispatch",
+              true,
             );
           }
           if (command.expectedDocumentGeneration !== target.documentGeneration) {
             throw new InteractionControllerError(
               "document_stale",
               "browser document changed before the command could dispatch",
+              true,
             );
           }
         },
@@ -199,11 +208,212 @@ export function recoverBrowserOperationJournalRecord(
   };
 }
 
+export type BrowserProtectedAuthDriver = {
+  target(targetId: string): Promise<BrowserTargetValue | null>;
+  observe(targetId: string): Promise<BrowserProtectedAuthObservationValue>;
+  validate?(
+    command: BrowserProtectedAuthFillCommandValue,
+    target: BrowserTargetValue,
+  ): Promise<void> | void;
+  dispatch(
+    command: BrowserProtectedAuthFillCommandValue,
+  ): Promise<BrowserProtectedAuthObservationValue>;
+};
+
+export type BrowserProtectedAuthAuthority = {
+  authorizeDispatch(command: BrowserProtectedAuthFillCommandValue): Promise<void> | void;
+};
+
+export type BrowserProtectedAuthOperationJournalRecord =
+  InteractionOperationJournalRecord<BrowserProtectedAuthFillReceiptValue>;
+
+export type BrowserProtectedAuthControllerOptions = {
+  browserSessionId: string;
+  controllerGeneration: string;
+  driver: BrowserProtectedAuthDriver;
+  authority?: BrowserProtectedAuthAuthority;
+  maxJournalEntries?: number;
+  now?: () => Date;
+  initialJournal?: readonly BrowserProtectedAuthOperationJournalRecord[];
+  onJournalRecord?: (record: BrowserProtectedAuthOperationJournalRecord) => Promise<void> | void;
+};
+
+/** Secret-bearing commands are admitted only through this controller-private
+ * authority. Its durable digest binds all semantics plus credential version,
+ * but deliberately excludes ephemeral password/TOTP value bytes. */
+export class BrowserProtectedAuthController {
+  private readonly core: InteractionControllerCore<
+    BrowserProtectedAuthFillCommandValue,
+    BrowserTargetValue,
+    BrowserProtectedAuthObservationValue,
+    BrowserProtectedAuthFillReceiptValue
+  >;
+
+  constructor(options: BrowserProtectedAuthControllerOptions) {
+    const { browserSessionId, controllerGeneration } = options;
+    this.core = new InteractionControllerCore({
+      driver: options.driver,
+      ...(options.authority ? { authority: options.authority } : {}),
+      ...(options.maxJournalEntries !== undefined
+        ? { maxJournalEntries: options.maxJournalEntries }
+        : {}),
+      ...(options.now ? { now: options.now } : {}),
+      ...(options.initialJournal ? { initialJournal: options.initialJournal } : {}),
+      ...(options.onJournalRecord ? { onJournalRecord: options.onJournalRecord } : {}),
+      commandDigest: protectedAuthCommandDigest,
+      adapter: {
+        resourceLabel: "browser protected fill",
+        parseCommand: (value) => BrowserProtectedAuthFillCommand.parse(value),
+        parseTarget: (value) => BrowserTarget.parse(value),
+        parseObservation: (value) => BrowserProtectedAuthObservation.parse(value),
+        parseReceipt: (value) => BrowserProtectedAuthFillReceipt.parse(value),
+        assertCommandAuthority(command) {
+          if (command.browserSessionId !== browserSessionId) {
+            throw new InteractionControllerError(
+              "resource_not_found",
+              "protected fill targets another browser session",
+            );
+          }
+          if (command.controllerGeneration !== controllerGeneration) {
+            throw new InteractionControllerError(
+              "controller_stale",
+              "protected fill targets a stale browser controller",
+            );
+          }
+        },
+        assertTargetAuthority(target) {
+          if (
+            target.browserSessionId !== browserSessionId ||
+            target.controllerGeneration !== controllerGeneration
+          ) {
+            throw new InteractionControllerError(
+              "controller_stale",
+              "protected-fill target belongs to a stale browser controller",
+            );
+          }
+        },
+        assertExpectedGenerations(command, target) {
+          if (command.expectedTargetGeneration !== target.targetGeneration) {
+            throw new InteractionControllerError(
+              "target_stale",
+              "browser target changed before protected fill",
+              true,
+            );
+          }
+          if (command.expectedDocumentGeneration !== target.documentGeneration) {
+            throw new InteractionControllerError(
+              "document_stale",
+              "browser document changed before protected fill",
+              true,
+            );
+          }
+        },
+        assertObservationAuthority(observation, targetId) {
+          if (
+            observation.target.id !== targetId ||
+            observation.target.browserSessionId !== browserSessionId ||
+            observation.target.controllerGeneration !== controllerGeneration
+          ) {
+            throw new InteractionControllerError(
+              "driver_failed",
+              "protected-fill driver returned a result outside controller authority",
+            );
+          }
+        },
+        makeReceipt(input) {
+          return BrowserProtectedAuthFillReceipt.parse({
+            protocolVersion: 1,
+            operationId: input.command.operationId,
+            browserSessionId,
+            controllerGeneration,
+            targetId: input.command.targetId,
+            state: input.state,
+            dispatchedAt: input.dispatchedAt,
+            settledAt: input.settledAt,
+            observation: input.observation,
+            error: input.error,
+          });
+        },
+        recoverReceipt(receipt, settledAt) {
+          if (
+            receipt.browserSessionId !== browserSessionId ||
+            receipt.controllerGeneration !== controllerGeneration
+          ) {
+            throw new Error(
+              `restored protected-fill operation ${receipt.operationId} is outside controller authority`,
+            );
+          }
+          return recoverInteractionReceipt(receipt, settledAt, "browser protected fill", (value) =>
+            BrowserProtectedAuthFillReceipt.parse(value),
+          );
+        },
+      },
+    });
+  }
+
+  run(
+    command: BrowserProtectedAuthFillCommandValue,
+  ): Promise<BrowserProtectedAuthFillReceiptValue> {
+    return this.core.run(command);
+  }
+
+  receipt(operationId: string): BrowserProtectedAuthFillReceiptValue | null {
+    return this.core.receipt(operationId);
+  }
+
+  journalSnapshot(): BrowserProtectedAuthOperationJournalRecord[] {
+    return this.core.journalSnapshot();
+  }
+
+  waitForIdle(): Promise<void> {
+    return this.core.waitForIdle();
+  }
+}
+
+export function recoverBrowserProtectedAuthOperationJournalRecord(
+  record: BrowserProtectedAuthOperationJournalRecord,
+  settledAt: string,
+): BrowserProtectedAuthOperationJournalRecord {
+  const receipt = BrowserProtectedAuthFillReceipt.parse(record.receipt);
+  return {
+    ...record,
+    receipt: recoverInteractionReceipt(receipt, settledAt, "browser protected fill", (value) =>
+      BrowserProtectedAuthFillReceipt.parse(value),
+    ),
+  };
+}
+
+function protectedAuthCommandDigest(command: BrowserProtectedAuthFillCommandValue): string {
+  const { fields, ...metadata } = command;
+  const secretFree = {
+    ...metadata,
+    fields: fields.map(({ value: _value, ...field }) => field),
+  };
+  return createHash("sha256").update(canonicalJson(secretFree), "utf8").digest("hex");
+}
+
+function canonicalJson(value: unknown): string {
+  return JSON.stringify(canonicalJsonValue(value));
+}
+
+function canonicalJsonValue(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(canonicalJsonValue);
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value as Record<string, unknown>)
+        .filter(([, entry]) => entry !== undefined)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, entry]) => [key, canonicalJsonValue(entry)]),
+    );
+  }
+  return value;
+}
+
 export type ComputerInteractionDriver = {
   target(targetId: string): Promise<ComputerTargetValue | null>;
   observe(targetId: string): Promise<ComputerObservationValue>;
   validate?(command: ComputerActionCommandValue, target: ComputerTargetValue): Promise<void> | void;
-  dispatch(command: ComputerActionCommandValue): Promise<ComputerObservationValue>;
+  dispatch(command: ComputerActionCommandValue): Promise<ComputerObservationValue | null>;
 };
 
 export type ComputerInteractionAuthority = {
@@ -281,6 +491,7 @@ export class ComputerInteractionController {
             throw new InteractionControllerError(
               "target_stale",
               "computer target changed before the command could dispatch",
+              true,
             );
           }
         },