@wenathlan/saddle 1.8.17 → 2.0.2

package/dist/webhook/signature.js

@@ -1,7 +0,0 @@
-/**
- * webhook signatures use hmac sha256 and keep secrets outside serialized events.
- */
-import { constanttimeequal, hmacsha256 } from "../core/hash.js";
-export function webhooksig(payload, secret) { return hmacsha256(typeof payload === "string" ? payload : JSON.stringify(payload), secret); }
-export function webhookverify(payload, signature, secret) { return constanttimeequal(webhooksig(payload, secret), signature); }
-//# sourceMappingURL=signature.js.map

package/dist/webhook/signature.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"signature.js","sourceRoot":"","sources":["../../webhook/signature.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEhE,MAAM,UAAU,UAAU,CAAC,OAAO,EAAE,MAAM,IAAI,OAAO,UAAU,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AAC3I,MAAM,UAAU,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,OAAO,iBAAiB,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC"}

package/dist/workflow/manifest.d.ts

@@ -1,22 +0,0 @@
-/**
- * workflow manifests describe the same job surface for different forge runtimes.
- */
-export declare const forgeprofiles: readonly string[];
-export declare function workflowmanifest(options?: {}): {
-    name: any;
-    command: any;
-    trigger: any;
-    inputs: any;
-    platforms: any;
-    environment: any;
-    artifacts: any;
-    timeoutminutes: any;
-    publicrunner: any;
-};
-export declare function workflowinputs(manifest: any): {
-    name: any;
-    command: any;
-    timeoutminutes: any;
-    artifacts: any;
-};
-//# sourceMappingURL=manifest.d.ts.map

package/dist/workflow/manifest.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../workflow/manifest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,aAAa,mBAAwE,CAAC;AAEnG,wBAAgB,gBAAgB,CAAC,OAAO,KAAK;IAGzC,IAAI;IACJ,OAAO;IACP,OAAO;IACP,MAAM;IACN,SAAS;IACT,WAAW;IACX,SAAS;IACT,cAAc;IACd,YAAY;EAEf;AAED,wBAAgB,cAAc,CAAC,QAAQ,KAAA;IAAa,IAAI;IAAiB,OAAO;IAAoB,cAAc;IAA2B,SAAS;EAAmC"}

package/dist/workflow/manifest.js

@@ -1,21 +0,0 @@
-/**
- * workflow manifests describe the same job surface for different forge runtimes.
- */
-export const forgeprofiles = Object.freeze(["github", "forgejo", "gitea", "woodpecker", "gitlab"]);
-export function workflowmanifest(options = {}) {
-    if (!options.name || !options.command)
-        throw new TypeError("workflow manifest requires name and command");
-    return {
-        name: options.name,
-        command: options.command,
-        trigger: options.trigger ?? ["manual", "dispatch"],
-        inputs: options.inputs ?? {},
-        platforms: options.platforms ?? forgeprofiles,
-        environment: options.environment ?? {},
-        artifacts: options.artifacts ?? ["results/**"],
-        timeoutminutes: options.timeoutminutes ?? 30,
-        publicrunner: options.publicrunner ?? true
-    };
-}
-export function workflowinputs(manifest) { return { name: manifest.name, command: manifest.command, timeoutminutes: manifest.timeoutminutes, artifacts: manifest.artifacts.join(",") }; }
-//# sourceMappingURL=manifest.js.map

package/dist/workflow/manifest.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../workflow/manifest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEnG,MAAM,UAAU,gBAAgB,CAAC,OAAO,GAAG,EAAE;IAC3C,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IAC1G,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC;QAClD,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,aAAa;QAC7C,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;QACtC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC,YAAY,CAAC;QAC9C,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE;QAC5C,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAQ,IAAI,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC"}

package/dist/workflow/registry.d.ts

@@ -1,7 +0,0 @@
-export declare function workflowregistry(): {
-    register(manifest: any): any;
-    get(name: any): any;
-    render(name: any, forge: any): any;
-    list(): any[];
-};
-//# sourceMappingURL=registry.d.ts.map

package/dist/workflow/registry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../workflow/registry.ts"],"names":[],"mappings":"AAMA,wBAAgB,gBAAgB;;;;;EAS/B"}

package/dist/workflow/registry.js

@@ -1,18 +0,0 @@
-/**
- * workflow registry stores generated manifests and templates for later dispatch.
- */
-import { forgeprofiles } from "./manifest.js";
-import { forgejoworkflow, giteaworkflow, githubworkflow, gitlabworkflow, woodpeckerworkflow } from "./templates.js";
-export function workflowregistry() {
-    const manifests = new Map();
-    const renderers = { github: githubworkflow, forgejo: forgejoworkflow, gitea: giteaworkflow, woodpecker: woodpeckerworkflow, gitlab: gitlabworkflow };
-    return {
-        register(manifest) { manifests.set(manifest.name, manifest); return manifest; },
-        get(name) { return manifests.get(name) ?? null; },
-        render(name, forge) { if (!renderers[forge] || !forgeprofiles.includes(forge))
-            throw new TypeError(`unsupported forge: ${forge}`); const manifest = manifests.get(name); if (!manifest)
-            throw new Error(`workflow not found: ${name}`); return renderers[forge](manifest); },
-        list() { return [...manifests.values()]; }
-    };
-}
-//# sourceMappingURL=registry.js.map

package/dist/workflow/registry.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../workflow/registry.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACrJ,OAAO;QACL,QAAQ,CAAC,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC;QAC/E,GAAG,CAAC,IAAI,IAAI,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5Q,IAAI,KAAK,OAAO,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;KAC3C,CAAC;AACJ,CAAC"}

package/dist/workflow/templates.d.ts

@@ -1,6 +0,0 @@
-export declare function githubworkflow(manifest: any): string;
-export declare function forgejoworkflow(manifest: any): string;
-export declare function giteaworkflow(manifest: any): string;
-export declare function woodpeckerworkflow(manifest: any): string;
-export declare function gitlabworkflow(manifest: any): string;
-//# sourceMappingURL=templates.d.ts.map

package/dist/workflow/templates.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../workflow/templates.ts"],"names":[],"mappings":"AAKA,wBAAgB,cAAc,CAAC,QAAQ,KAAA,UAGtC;AAED,wBAAgB,eAAe,CAAC,QAAQ,KAAA,UAAkD;AAC1F,wBAAgB,aAAa,CAAC,QAAQ,KAAA,UAAgD;AACtF,wBAAgB,kBAAkB,CAAC,QAAQ,KAAA,UAC1C;AACD,wBAAgB,cAAc,CAAC,QAAQ,KAAA,UAA2P"}

package/dist/workflow/templates.js

@@ -1,18 +0,0 @@
-/**
- * workflow templates use explicit environment names and keep provider secrets external.
- */
-import { workflowinputs } from "./manifest.js";
-export function githubworkflow(manifest) {
-    const input = workflowinputs(manifest);
-    return `name: ${manifest.name}\non:\n  workflow_dispatch:\n    inputs:\n      jobid:\n        required: true\n        type: string\n      command:\n        required: true\n        type: string\n        default: ${manifest.command}\n  repository_dispatch:\n    types: [saddle-job]\npermissions:\n  contents: read\njobs:\n  process:\n    runs-on: ubuntu-latest\n    timeout-minutes: ${input.timeoutminutes}\n    steps:\n      - uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 26.7.0\n      - run: npm ci\n      - run: \${{ github.event.inputs.command || '${manifest.command}' }}\n        env:\n          SBOT_JOB_ID: \${{ github.event.inputs.jobid || github.event.client_payload.jobid }}\n      - uses: actions/upload-artifact@v4\n        with:\n          name: saddle-results\n          path: ${manifest.artifacts.join("\n            ")}\n          if-no-files-found: ignore\n`;
-}
-export function forgejoworkflow(manifest) { return genericworkflow(manifest, "forgejo"); }
-export function giteaworkflow(manifest) { return genericworkflow(manifest, "gitea"); }
-export function woodpeckerworkflow(manifest) {
-    return `when:\n  - event: push\n  - event: manual\nsteps:\n  process:\n    image: node:26.7.0\n    commands:\n      - npm ci\n      - ${manifest.command}\n`;
-}
-export function gitlabworkflow(manifest) { return `stages:\n  - process\nprocess:\n  stage: process\n  image: node:26.7.0\n  script:\n    - npm ci\n    - ${manifest.command}\n  artifacts:\n    when: always\n    paths:\n${manifest.artifacts.map((item) => `      - ${item}`).join("\n")}\n`; }
-function genericworkflow(manifest, name) {
-    return `name: ${manifest.name}\non:\n  workflow_dispatch:\njobs:\n  process:\n    runs-on: ubuntu-latest\n    timeout-minutes: ${manifest.timeoutminutes}\n    steps:\n      - uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 26.7.0\n      - run: npm ci\n      - run: ${manifest.command}\n`;
-}
-//# sourceMappingURL=templates.js.map

package/dist/workflow/templates.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../workflow/templates.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,UAAU,cAAc,CAAC,QAAQ;IACrC,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,SAAS,QAAQ,CAAC,IAAI,wLAAwL,QAAQ,CAAC,OAAO,0JAA0J,KAAK,CAAC,cAAc,+MAA+M,QAAQ,CAAC,OAAO,+NAA+N,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,yCAAyC,CAAC;AACt6B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAQ,IAAI,OAAO,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;AAC1F,MAAM,UAAU,aAAa,CAAC,QAAQ,IAAI,OAAO,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AACtF,MAAM,UAAU,kBAAkB,CAAC,QAAQ;IAAI,OAAO,iIAAiI,QAAQ,CAAC,OAAO,IAAI,CAAC;AAC5M,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,QAAQ,IAAI,OAAO,0GAA0G,QAAQ,CAAC,OAAO,iDAAiD,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAElS,SAAS,eAAe,CAAC,QAAQ,EAAE,IAAI;IAAI,OAAO,SAAS,QAAQ,CAAC,IAAI,oGAAoG,QAAQ,CAAC,cAAc,0KAA0K,QAAQ,CAAC,OAAO,IAAI,CAAC;AAClY,CAAC"}

package/dist/workflow/triggers.d.ts

@@ -1,64 +0,0 @@
-/**
- * workflow triggers normalize manual, event, schedule and retry starts without binding a forge.
- */
-export declare const triggernames: readonly string[];
-/** Validates and normalizes a trigger declaration. */
-export declare function workflowtriggers(value?: string[]): string[];
-/** Matches a workflow trigger against an incoming event without executing it. */
-export declare function triggermatch(manifest: any, event?: {}): {
-    matched: boolean;
-    type: string;
-    reason: string;
-    errors?: undefined;
-    inputs?: undefined;
-    requestid?: undefined;
-} | {
-    matched: boolean;
-    type: string;
-    reason: string;
-    errors: any[];
-    inputs?: undefined;
-    requestid?: undefined;
-} | {
-    reason?: undefined;
-    errors?: undefined;
-    matched: boolean;
-    type: string;
-    inputs: {};
-    requestid: any;
-};
-/** Validates and normalizes caller-supplied workflow inputs against a manifest schema. */
-export declare function validateworkflowinputs(manifest: any, values?: {}): {
-    valid: boolean;
-    values: {};
-    errors: any[];
-};
-/** Keeps trigger declarations and produces deterministic matching results. */
-export declare function triggerregistry(): {
-    register: (manifest: any) => any;
-    get: (name: any) => any;
-    match: (name: any, event: any) => {
-        matched: boolean;
-        type: string;
-        reason: string;
-        errors?: undefined;
-        inputs?: undefined;
-        requestid?: undefined;
-    } | {
-        matched: boolean;
-        type: string;
-        reason: string;
-        errors: any[];
-        inputs?: undefined;
-        requestid?: undefined;
-    } | {
-        reason?: undefined;
-        errors?: undefined;
-        matched: boolean;
-        type: string;
-        inputs: {};
-        requestid: any;
-    };
-    list: () => any[];
-};
-//# sourceMappingURL=triggers.d.ts.map

package/dist/workflow/triggers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"triggers.d.ts","sourceRoot":"","sources":["../../workflow/triggers.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,eAAO,MAAM,YAAY,mBAAqF,CAAC;AAE/G,sDAAsD;AACtD,wBAAgB,gBAAgB,CAAC,KAAK,WAAa,YAIlD;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,QAAQ,KAAA,EAAE,KAAK,KAAK;;;;;;;;;;;;;;;;;;;;;EAQhD;AAED,0FAA0F;AAC1F,wBAAgB,sBAAsB,CAAC,QAAQ,KAAA,EAAE,MAAM,KAAK;;;;EAoB3D;AAED,8EAA8E;AAC9E,wBAAgB,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;EAO9B"}

package/dist/workflow/triggers.js

@@ -1,99 +0,0 @@
-/**
- * workflow triggers normalize manual, event, schedule and retry starts without binding a forge.
- */
-export const triggernames = Object.freeze(["manual", "dispatch", "webhook", "schedule", "retry", "heartbeat"]);
-/** Validates and normalizes a trigger declaration. */
-export function workflowtriggers(value = ["manual"]) {
-    const list = Array.isArray(value) ? value : [value];
-    if (list.length === 0 || list.some((name) => !triggernames.includes(name)))
-        throw new TypeError("workflow trigger is unsupported");
-    return [...new Set(list)];
-}
-/** Matches a workflow trigger against an incoming event without executing it. */
-export function triggermatch(manifest, event = {}) {
-    const triggers = workflowtriggers(manifest?.trigger);
-    const type = String(event.type ?? "manual");
-    if (!triggers.includes(type))
-        return { matched: false, type, reason: "trigger-not-declared" };
-    if (type === "schedule" && event.at !== undefined && Number(event.at) > Date.now())
-        return { matched: false, type, reason: "not-due" };
-    const validation = validateworkflowinputs(manifest, event.inputs ?? {});
-    if (!validation.valid)
-        return { matched: false, type, reason: "invalid-inputs", errors: validation.errors };
-    return { matched: true, type, inputs: validation.values, requestid: event.requestid ?? `${manifest.name}/${type}/${stablevalue(event)}` };
-}
-/** Validates and normalizes caller-supplied workflow inputs against a manifest schema. */
-export function validateworkflowinputs(manifest, values = {}) {
-    const schema = manifest?.inputs ?? {};
-    const source = values && typeof values === "object" && !Array.isArray(values) ? values : {};
-    const errors = [];
-    const normalized = {};
-    for (const name of Object.keys(source))
-        if (!Object.hasOwn(schema, name))
-            errors.push({ name, reason: "unknown-input" });
-    for (const [name, declaration] of Object.entries(schema)) {
-        const rule = typeof declaration === "string" ? { type: declaration } : declaration ?? {};
-        let value = source[name];
-        if (value === undefined && rule.default !== undefined)
-            value = rule.default;
-        if (value === undefined) {
-            if (rule.required)
-                errors.push({ name, reason: "required" });
-            continue;
-        }
-        const converted = convertinput(value, rule.type ?? "string");
-        if (converted.error) {
-            errors.push({ name, reason: converted.error });
-            continue;
-        }
-        if (Array.isArray(rule.choices) && !rule.choices.includes(converted.value)) {
-            errors.push({ name, reason: "choice" });
-            continue;
-        }
-        normalized[name] = converted.value;
-    }
-    return { valid: errors.length === 0, values: normalized, errors };
-}
-/** Keeps trigger declarations and produces deterministic matching results. */
-export function triggerregistry() {
-    const values = new Map();
-    function register(manifest) { if (!manifest?.name)
-        throw new TypeError("trigger manifest requires name"); const normalized = { ...manifest, trigger: workflowtriggers(manifest.trigger) }; values.set(normalized.name, normalized); return normalized; }
-    function get(name) { return values.get(name); }
-    function match(name, event) { const manifest = get(name); if (!manifest)
-        throw new Error(`workflow not found: ${name}`); return triggermatch(manifest, event); }
-    function list() { return [...values.values()].map((manifest) => ({ ...manifest, trigger: [...manifest.trigger] })); }
-    return { register, get, match, list };
-}
-function convertinput(value, type) {
-    if (type === "string")
-        return { value: String(value) };
-    if (type === "number") {
-        const number = typeof value === "number" ? value : Number(value);
-        return Number.isFinite(number) ? { value: number } : { error: "number" };
-    }
-    if (type === "boolean") {
-        if (value === true || value === "true")
-            return { value: true };
-        if (value === false || value === "false")
-            return { value: false };
-        return { error: "boolean" };
-    }
-    if (type === "json") {
-        try {
-            return { value: typeof value === "string" ? JSON.parse(value) : value };
-        }
-        catch {
-            return { error: "json" };
-        }
-    }
-    return { error: "type" };
-}
-function stablevalue(value) {
-    if (Array.isArray(value))
-        return `[${value.map(stablevalue).join(",")}]`;
-    if (value && typeof value === "object")
-        return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stablevalue(value[key])}`).join(",")}}`;
-    return JSON.stringify(value);
-}
-//# sourceMappingURL=triggers.js.map

package/dist/workflow/triggers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"triggers.js","sourceRoot":"","sources":["../../workflow/triggers.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AAE/G,sDAAsD;AACtD,MAAM,UAAU,gBAAgB,CAAC,KAAK,GAAG,CAAC,QAAQ,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACnI,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,QAAQ,EAAE,KAAK,GAAG,EAAE;IAC/C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC9F,IAAI,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACvI,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IAC5G,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;AAC5I,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,EAAE;IAC1D,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,MAAM,MAAM,GAAG,EAAE,CAAC;IAClB,MAAM,UAAU,GAAG,EAAE,CAAC;IACtB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IACzH,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;QACzF,IAAI,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAC7D,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAClF,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAClI,UAAU,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;IACrC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACpE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,eAAe;IAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;IACzB,SAAS,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC,CAAC,MAAM,UAAU,GAAG,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;IACxP,SAAS,GAAG,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/C,SAAS,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAChK,SAAS,IAAI,KAAK,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrH,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,YAAY,CAAC,KAAK,EAAE,IAAI;IAC/B,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACvD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAAC,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAAC,CAAC;IACtK,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAAC,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,OAAO;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAAC,CAAC;IAC3L,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,OAAO,EAAE,KAAK,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,CAAC;IAAC,CAAC;IAC7I,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,KAAK;IACxB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACzE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC5J,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC"}

package/docs/plans/00.index.md

@@ -1,50 +0,0 @@
-# Index
-
-Project: **UKA** — computer use agent, sandbox for AI and captcha bypass. Super bot with computational memory. Package `@wenathlan/saddle`. Domain acquired.
-
-Theme: computer use, bypasses, captcha, sandbox for AI, container for AI, multi-platform bot, storage-to-compute memory transformation.
-
-## Planning Documents (`docs/plans`)
-
-| # | File | Subject |
-|---|------|---------|
-| 01 | [architecture.md](./01.architecture.md) | General system architecture |
-| 02 | [research.computer.use.md](./02.research.computer.use.md) | Research: computer use agents 2026 |
-| 03 | [research.captcha.bypass.md](./03.research.captcha.bypass.md) | Research: hcaptcha cloudflare recaptcha bypass |
-| 04 | [research.sandbox.ai.md](./04.research.sandbox.ai.md) | Research: virtual sandbox and containers for AI |
-| 05 | [capture.platform.md](./05.capture.platform.md) | Browser movement capture platform |
-| 06 | [dependencies.md](./06.dependencies.md) | 60+ project dependencies |
-| 07 | [captcha.test.page.md](./07.captcha.test.page.md) | Test page with hcaptcha cloudflare |
-| 08 | [production.infra.md](./08.production.infra.md) | Production infra (vercel/netlify) and sandbox backend |
-| 09 | [database.schema.md](./09.database.schema.md) | Database schema (drizzle/prisma/mysql2) |
-| 10 | [cloudinary.storage.md](./10.cloudinary.storage.md) | Data storage on cloudinary |
-| 11 | [movement.logs.json.md](./11.movement.logs.json.md) | JSON movement log format (brave) |
-| 12 | [research.atlas.agent.browser.md](./12.research.atlas.agent.browser.md) | Atlas: agent browser repos with same classification |
-| 28 | [action.plan.md](./28.action.plan.md) | Action plan and next steps |
-
-## Super Bot Documentation (`docs/plans`)
-
-| # | File | Subject |
-|---|------|---------|
-| 45 | [robotarchitecture.md](./45.robotarchitecture.md) | Super bot architecture overview |
-| 37 | [deploystrategy.md](./37.deploystrategy.md) | Deploy strategies (Netlify, Vercel, CI/CD, Docker, VM) |
-| 36 | [computational.memory.md](./36.computational.memory.md) | Storage-to-compute memory transformation system |
-| 39 | [multi.platform.bot.md](./39.multi.platform.bot.md) | Multi-platform bot (GitHub, GitLab, Forgejo, Gitea, Discord) |
-| 40 | [npm.publish.md](./40.npm.publish.md) | NPM package publishing (`@wenathlan/saddle`) |
-| 46 | [scdnintegration.md](./46.scdnintegration.md) | SCDN integration for assets and deployment |
-| 44 | [reference.md](./44.reference.md) | Reference index for all saddle documentation |
-| 33 | [bots.codigo.revisao.md](./33.bots.codigo.revisao.md) | Best AI code review bots (research) |
-| 32 | [bots.automacao.computacional.md](./32.bots.automacao.computacional.md) | Best computational automation bots (research) |
-| 34 | [bots.seguranca.cicd.md](./34.bots.seguranca.cicd.md) | Bot research (security + CI/CD) |
-
-## Folders
-
-- `docs/plans/` — planning and research (this index)
-- `docs/talks/` — decision transcripts
-- `docs/logs/` — JSON movement logs from Brave (`examplesession.json`)
-- `tests/` — unit tests (`examples/`, `output/`, `scripts/`)
-- `web/` — production site, deployed to Vercel or Netlify (files at root, no `src/`)
-
-## Phase Decision
-
-We are in **planning + research**. Platform implementation starts **only after user approval** (see `28.action.plan.md`).

package/docs/plans/01.architecture.md

@@ -1,86 +0,0 @@
-# 01 Architecture
-
-## Goal
-
-Build **UKA**, a computer use agent for ai that:
-
-1. Captures human movement in the browser (virtual mouse, virtual arrow, click, rotation, coordinates) in a real environment (brave / chromium).
-2. Exports movement as json logs to `docs/logs/`.
-3. Runs in a virtual sandbox to isolate ai agent execution.
-4. Faces strong captchas (hcaptcha, cloudflare turnstile, recaptcha) in controlled tests, opening test pages in brave.
-5. Persists data in production via a deployed site (vercel/netlify) plus db (drizzle/prisma/mysql2) plus cloudinary.
-
-## Architecture rules (skill arch)
-
-- No `src/` folder. Logic lives at the root of `web/`.
-- No vercel functions. No netlify functions. Use prisma, drizzle, mysql2, socket.
-- No localhost. Host is parametrized (`host`). Ports randomized then locked.
-- Files lowercase. No underscore. No hyphen. English docs. Jsdoc comments.
-- Logic grouped. Up to 20 related logics per file.
-- Runs as a library across modes (computer, browser, cli, binary, headless, etc).
-
-## Atlas (the browser)
-
-Atlas is the real browser component of UKA. It works across the 30 modes from the
-architecture skill (computer, browser, cli, binary, headless, etc) and its primary
-job is to bypass hcaptcha so the agent can act. It serves both the agent and the
-sandbox, and talks to our own database on vercel/netlify. See
-[12 research atlas agent browser](./12-research-atlas-agent-browser.md) for the
-prior-art survey and the p1 stealth / p2 vlm / p3 token fallback layering.
-
-## Components
-
-```
-atlas (web/atlas.js + deps)
-  - real browser across 30 modes
-  - stealth layer + hcaptcha bypass (vlm or token api fallback)
-  - feeds agent and sandbox
-
-capture ui (web/*.html + web/capture.js)
-  - virtual arrow / virtual mouse injected via cdp
-  - captures click, drag, scroll, coordinates, rotation
-  - exports json to docs/logs/
-
-sandbox (web/ + @vercel/sandbox)
-  - isolated firecracker microvm per session/agent
-  - chrome/brave ready, novnc streaming
-  - api https (post/get) to the deployed site
-
-production backend (web/, deployed to vercel/netlify)
-  - open node server (hono/express), not platform functions
-  - db (drizzle + mysql2 + prisma schema)
-  - cloudinary for assets and replays
-```
-
-## Main flows
-
-### A. Capture (local/dev)
-1. Open brave via playwright/chromium with `chrome.debugger` (cdp).
-2. Inject svg cursor sprite plus event listeners (`Input.dispatchMouseEvent`).
-3. Record each event with timestamp, type, coordinates, target, rng seed.
-4. Compact trajectories and export to `docs/logs/<session>.json`.
-
-### B. Captcha test
-1. Open test page (`tests/examples/hcaptchatest.html` or a real site).
-2. Run solver (hcaptcha challenger / vision) or record manual bypass.
-3. Save evidence (screenshot, token, log) to `tests/output/`.
-
-### C. Production
-1. Agent calls the deployed site api (`web/`).
-2. Backend writes session to db (drizzle/mysql2) and assets to cloudinary.
-3. Logs and replays available via get https.
-
-## Key technologies (details in `06-dependencies.md`)
-
-- Browser automation: `playwright`, `puppeteer`, `chromium-bidi`, `@playwright/test`
-- Human mouse: `bezier-js`, `@napi-rs/canvas`, `d3`
-- Ai / vision: `ai`, `@ai-sdk/*`, `@xenova/transformers`, `onnxruntime-web`, `tesseract.js`
-- Sandbox: `@vercel/sandbox`, `vercel`
-- Server: `hono`, `express`, `cors`, `helmet`, `socket.io` (socket realtime)
-- Db: `drizzle-orm`, `mysql2`, `@prisma/client`, `prisma`
-- Storage: `cloudinary`
-- Validation: `zod`, `valibot`, `arktype`
-
-## Next steps
-
-See `action-plan.md`. Implementation starts after user approval.

package/docs/plans/02.research.computer.use.md

@@ -1,58 +0,0 @@
-# 02 — Pesquisa: Computer Use Agents (2026)
-
-## Estado da arte
-
-Em 2026, *computer-use agents* deixaram de ser protótipos e entraram em produção para
-tarefas restritas e supervisionadas. Principais provedores e frameworks:
-
-- **Anthropic Computer Use** (`computer_use_20251124`): ferramentas `computer` (mouse/teclado),
-  `text_editor`, `bash`. Recomenda rodar em **VMs/containers com privilégios mínimos**.
-- **OpenAI Operator / CUA**: 87% de sucesso em sites JS complexos; 58% no WebArena.
-- **Google Project Mariner**: 83.5% WebVoyager, 84% ScreenSpot.
-- **Microsoft UFO²**: funde Windows UI Automation + OmniParser (visão).
-- **browser-use** (open source): 89.1% WebVoyager (abordagem híbrida DOM + visão).
-
-### Benchmarks
-- **OSWorld:** humano 72.36% vs SOTA ~12–20% (desktop ainda imaturo).
-- **WebArena:** tops ~71%, produção na faixa 50–60%.
-- **WebVoyager:** browser-use 89.1% (híbrido).
-
-### Conclusão de arquitetura
-Ganham abordagens **híbridas**:
-1. Raciocínio por **DOM / accessibility tree** para elementos estruturados.
-2. **Visão** (VLM) para layouts não-padrão, canvas, imagens.
-3. **Scripts determinísticos** para validação e replay.
-4. **Verificação** (screenshot antes/depois, diff de elementos).
-
-## Projetos de referência encontrados
-
-| Projeto | Diferencial relevante para UKA |
-|---------|-------------------------------|
-| [agentbrowser](https://github.com/AshtonVaughan/agentbrowser) | Cursor visível humano via CDP, trilha SVG, trajetórias Bézier com jitter/overshoot, **traces JSONL** em `~/.agentbrowser/traces/`, replay determinístico por seed, bypass de Cloudflare/OneTrust |
-| [humanjs](https://github.com/totigm/humanjs) | Playwright humanizado: curvas Bézier, ritmo de digitação, scroll, **personalidades** (careful/fast/distracted/precise), gravador → JSON timeline, MCP server |
-| [human-browser-use](https://github.com/andyless/human-browser-use) | Extensão p/ browser-use: trajetória Bézier, typing lognormal, scroll inercial, stealth fingerprint (`navigator.webdriver`, WebGL, canvas) |
-| [agentic-stealth-browser](https://github.com/shanewas/agentic-stealth-browser) | TLS spoofing (JA3/JA4), fingerprint, recovery chain (detecta captcha → rotaciona proxy), account warming |
-| [mantis](https://github.com/mercurialsolo/mantis) | Agent perception-reasoning-action em Xvfb+Chrome+xdotool (sem fingerprint Playwright), vídeo screencast, deploy em Baseten/Modal/EKS/GKE |
-| [win-pilot-mcp](https://github.com/omidmanoochehri/win-pilot-mcp) | MCP Windows computer-use: screen capture, OCR, mouse humano, logging estruturado, replay de macros |
-| [cloakbrowser-human](https://github.com/evelaa123/cloakbrowser-human) | Wrapper Playwright que adiciona camada **comportamental** (mouse Bézier, typing, scroll) — complementa stealth de fingerprint |
-
-## Padrões de movimento humano (extraídos da pesquisa)
-
-- **Trajetória do mouse:** curva Bézier única, velocidade variável por arc-length:
-  - 0–5%: ramp-up (0.3x → 2.5x)
-  - 5–75%: cruise (2.3–2.5x) com variação senoidal
-  - 75–100%: ease-out cúbico (2.5x → 0.3x)
-  - sub-pixel drift final (σ 0.3–1.5px)
-  - duração via **Lei de Fitts**: `0.05 + 0.07*log2(1 + distance/20)` s
-- **Overshoot:** ~15% de chance, auto-aumenta em movimentos longos.
-- **Typing:** inter-key delay lognormal (μ=4.17, σ=0.3 → ~65ms), bigram speedup, 2% typo.
-- **Scroll:** wheel events com acel/decel, overshoot, settle delay.
-- **Stealth:** `navigator.webdriver → undefined`, spoof de plugins/WebGL/canvas, flags de launch.
-
-## Aplicação no UKA
-
-- Implementar `HumanCursor` (SVG overlay + CDP `Input.dispatchMouseEvent`) inspirado no
-  agentbrowser/humanjs, com trajetórias Bézier + jitter + overshoot determinísticas por seed.
-- Gravar **todos os eventos** como `SessionEvent` tipado → exportar JSON para `docs/logs/`.
-- Usar replay determinístico (seed) para testes reprodutíveis.
-- Tratar GUI como imagem (visão) + DOM/accessibility para alvos estruturados.

package/docs/plans/03.research.captcha.bypass.md

@@ -1,68 +0,0 @@
-# 03 — Pesquisa: hCaptcha / Cloudflare / reCAPTCHA Bypass
-
-## Contexto
-
-O UKA precisa **testar** a capacidade do computer-use de enfrentar captchas fortes. A
-pesquisa abaixo levanta abordagens open-source e comerciais (uso edUKAcional / automação
-supervisionada).
-
-## hCaptcha
-
-### hcaptcha-challenger (QIN2DIM) — referência principal
-- Resolve hCaptcha com **LLM multimodal** (sem Tampermonkey, sem serviço anti-captcha 3º).
-- Modelos plugáveis (ONNX):
-  - `image_label_binary` → ResNet ✅
-  - `image_label_area_select: point` → YOLOv8 ✅
-  - `image_label_area_select: bounding box` → YOLOv8 segmentation
-  - `image_drag_drop` → Spatial Chain-of-Thought ✅
-  - `image_label_multiple_choice` → ViT zero-shot
-- Pipeline: `install()` → `AgentT.from_page()` → `handle_checkbox()` → `execute()` loop.
-- Deps: `playwright`, `httpx`, `opencv-python`, `pillow`, `loguru`, `pydantic-settings`.
-
-### Outros solvers
-- **hCaptcha-Solver (Camoufox + Multibot):** usa Camoufox p/ HSW token + Groq vision +
-  **geração de movimento de mouse realista** (Multibot API). Lida com `image_label_binary`,
-  `area_select`, `drag_drop`. Requer proxy.
-- **maximedrn/hcaptcha-solver-python-selenium:** userscript Tampermonkey + Selenium (edUKAcional).
-- **auto-captcha-solver / auto-captcha (NopeCHA):** detecta hCaptcha, reCAPTCHA v2/v3,
-  Cloudflare Turnstile via **API de token NopeCHA**; injeta token automaticamente. Tem MCP
-  server e CLI. Tipos: hCaptcha ✅, reCAPTCHA v2/v3 ✅, Turnstile ⚠️ (lento).
-
-## Cloudflare (Turnstile / interstitials)
-
-- **agentic-stealth-browser** passa Cloudflare interstitial usando TLS spoofing + fingerprint
-  + comportamento humano + **recovery chain** (detecta captcha → rotaciona proxy/sessão → retry).
-- **auto-captcha** resolve Turnstile via NopeCHA (fila lenta, requer proxy em produção).
-- **captcha-solver (CloakBrowser + 2Captcha/CapSolver):** Turnstile resolvido em ~5s via
-  ClickSolver (free) ou fallback pago.
-
-## reCAPTCHA
-
-- v2/v3/Enterprise: cobertos por hcaptcha-challenger (via proxy), auto-captcha (NopeCHA),
-  2Captcha, CapSolver.
-
-## Capes (tipos suportados por 2Captcha/CapSolver — 30+)
-
-reCAPTCHA v2/v3/Enterprise, Cloudflare Turnstile, hCaptcha, FunCaptcha (Arkose), GeeTest,
-KeyCaptcha, Amazon WAF, DataDome, Akamai, Imperva, Friendly, MTCaptcha, Lemin, Cutcaptcha,
-Tencent, Yandex, ALTCHA, Prosopo, entre outros.
-
-## Camadas de defesa que o UKA deve considerar
-
-| Camada | O que ataca | Mitigação no UKA |
-|--------|-------------|------------------|
-| Fingerprint (WebDriver, CDP, headless, GPU) | detecta automação | stealth JS + Brave real/CDP, spoof WebGL/canvas |
-| Comportamental (mouse/keyboard/scroll) | analisa padrões | trajetórias Bézier humanas, typing lognormal |
-| TLS (JA3/JA4) | identifica cliente | TLS regional / proxy residencial sticky |
-| IP reputation | bloqueia faixas | proxies residenciais com sessão sticky |
-| Captcha | desafio final | solver VLM (hcaptcha-challenger) ou token API |
-
-## Aplicação no UKA
-
-- Criar `tests/examples/hcaptcha-test.html` (página de teste local) + usar sites reais fortes
-  (Cloudflare, Google reCAPTCHA demo, hCaptcha demo) no Brave.
-- Pipeline de teste: abrir → detectar captcha → resolver (VLM ou token API) → registrar
-  token/screenshot/log em `tests/output/`.
-- **Não** usar para abuso: foco em automação supervisionada e pesquisa.
-- Dependências relevantes: `playwright`, `puppeteer`, `@xenova/transformers`,
-  `onnxruntime-web`, `tesseract.js`, `cloudinary` (evidências).

package/docs/plans/04.research.sandbox.ai.md

@@ -1,52 +0,0 @@
-# 04 — Pesquisa: Sandbox Virtual e Containers para IA
-
-## Por que sandbox?
-
-Computer-use agents executam código/inputs não confiáveis (saída de LLM, uploads de
-usuário). Rodar em sandbox isola a execução, impede acesso ao sistema de produção e limita
-recursos. A pesquisa mostra que provedores ladearam para **microVMs Firecracker**.
-
-## Vercel Sandbox (opção principal do UKA)
-
-- Compute primitive para rodar código não confiável com segurança (AI agents, code gen).
-- **Firecracker microVM** por sandbox, filesystem e rede próprios, isolamento forte.
-- Runtimes: `node26/24/22`, `python3.13`. Default `node24`.
-- Cada sandbox roda como `vercel-sandbox` (sudo disponível), working dir `/vercel/sandbox`.
-- Startup em **milissegundos**; suporta Docker/FUSE dentro do microVM (privilégio elevado).
-- **Credential brokering:** injeta secrets em requests de saída sem expor dentro do VM
-  (`console.log(process.env)` não vaza a chave).
-- **Network policy:** allowlist de domínios, atualizável em runtime.
-- SDK JS e Python; CLI. Multi-agent isolation (usuário Linux por agente, grupos p/ compartilhar).
-
-### AI SDK Computer Use (vercel-labs) — template de referência
-- Next.js + AI SDK + Claude Sonnet 4.5 + **Vercel Sandbox**.
-- Snapshot pré-construído com: **Xvnc**, **openbox**, **noVNC + websockify**, **Google
-  Chrome**, **xdotool + ImageMagick**.
-- Fluxo: User ↔ Chat UI ↔ AI SDK ↔ Claude → Vercel Sandbox (desktop via noVNC iframe).
-- Ferramentas: `computer` (screenshot/click/type/scroll) + `bash`.
-- Env: `ANTHROPIC_API_KEY`, `SANDBOX_SNAPSHOT_ID`, `VERCEL_OIDC_TOKEN`/`VERCEL_TOKEN`.
-
-### vercel-labs/agent-browser (serverless)
-- CLI Rust nativo; roda agent-browser + Chrome em Vercel Sandbox microVM efêmero.
-- Helper `@agent-browser/sandbox/vercel` + `@vercel/sandbox`.
-
-### vercel-labs/sandcastle (PoC desktop)
-- Desktop Linux web sobre Vercel Sandbox. Stack: Next.js, Tailwind, **Zustand + SWR**,
-  **Neon Postgres + Drizzle ORM**, `@vercel/sandbox`, code-server, Xpra. Auth password/OAuth.
-
-## Outras opções
-
-- **Modal / Baseten / EKS / GKE** (usados pelo mantis) — containers Docker customizados.
-- **Daytona / Cloudflare** — alternativas de sandbox (citadas mas com menos fit p/ TS).
-- **Containers Docker locais** (xdotool + Xvfb + Chromium) para dev sem nuvem.
-
-## Decisão para o UKA
-
-- **Produção:** Vercel Sandbox como camada de execução do computer-use; site de controle
-  deployado em **Vercel** (ou Netlify) (`web/`).
-- **Banco:** criado no deploy (Drizzle/LibSQL ou Prisma em Neon/Turso), conforme `09-esquema-banco-dados.md`.
-- **Armazenamento:** Cloudinary para assets/replays (`10-cloudinary-storage.md`).
-- **Dev local:** Brave real via Playwright/CDP para a plataforma de captura (`05-plataforma-captura-movimentos.md`).
-- **Comunicação:** requests **POST/GET HTTPS** do agente → site deployado → DB + Cloudinary.
-- Dependências: `@vercel/sandbox`, `vercel`, `@netlify/blobs`, `@netlify/functions`,
-  `hono`/`express`, `drizzle-orm`, `@libsql/client`, `socket.io`.