@xenosystem/agent-sdk 0.10.35 → 0.10.37

package/dist/automation/index.js

@@ -1,4 +1,4 @@
-var V=1;var Je=new Set(["browser.navigate","browser.back","browser.forward","browser.reload","browser.wait","browser.snapshot","browser.screenshot","browser.locate","browser.tabs.list","browser.tabs.open","browser.console.read","browser.network.read","browser.storage.read","browser.page-errors.read"]),qe=new Set(["browser.click","browser.type","browser.key","browser.select","browser.scroll","browser.tabs.close","browser.upload","browser.download","browser.record.start","browser.record.stop"]),ze=new Set(["computer.observe","computer.screenshot","computer.window-state","computer.wait"]),Ke=new Set(["computer.point","computer.click","computer.double-click","computer.right-click","computer.drag","computer.type","computer.key","computer.scroll","computer.launch"]),le=[...Je,...qe,...ze,...Ke];function X(e){if(Je.has(e))return{operation:e,surface:"browser",effect:"observe",evidence:{before:"disabled",after:e==="browser.wait"||e==="browser.tabs.list"?"optional":"required",recording:"optional"}};if(qe.has(e)){let t=e==="browser.record.start"||e==="browser.record.stop";return{operation:e,surface:"browser",effect:"act",evidence:{before:"required",after:"required",recording:e==="browser.record.stop"?"required":"optional"}}}if(ze.has(e))return{operation:e,surface:"computer",effect:"observe",evidence:{before:"disabled",after:e==="computer.wait"?"optional":"required",recording:"optional"}};if(Ke.has(e))return{operation:e,surface:"computer",effect:"act",evidence:{before:"required",after:"required",recording:"optional"}};throw new TypeError(`Unsupported XENO automation operation: ${e}`)}function Ye(e){return Je.has(e)||qe.has(e)||ze.has(e)||Ke.has(e)}var l=class extends Error{constructor(r,n,o,i){super(n,i);this.code=r;this.detail=o;this.name="XenoAutomationError"}code;detail};import{createHash as Xo}from"node:crypto";import{arch as Do}from"node:os";import{existsSync as Xt,realpathSync as Rn}from"node:fs";import{dirname as _n,isAbsolute as On,join as Nn,resolve as Te,sep as kn}from"node:path";var Xn=/^(?:con|prn|aux|nul|clock\$|com[1-9]|lpt[1-9])(?:\..*)?$/i;function Dn(e){return e.replace(/\//g,"\\")}function Ln(e){let t=[],r=Dn(e),n=r.toLowerCase();if(r.startsWith("\\\\?\\")||r.startsWith("\\\\.\\")||r.startsWith("\\??\\"))return t.push({code:"DEVICE_PATH",message:"Extended-length, NT, and Windows device paths are not accepted at security boundaries."}),t;if(r.startsWith("\\\\"))return t.push({code:"UNC_PATH",message:"UNC paths are not accepted at security boundaries."}),t;/^[a-z]:($|[^\\])/i.test(r)?t.push({code:"DRIVE_RELATIVE_PATH",message:"Drive-relative Windows paths are ambiguous and are not accepted."}):/^\\(?!\\)/.test(r)&&t.push({code:"ROOT_RELATIVE_PATH",message:"Root-relative Windows paths are ambiguous and are not accepted."});let o=/^[a-z]:/i.test(r)?2:0;r.slice(o).includes(":")&&t.push({code:"ALTERNATE_DATA_STREAM",message:"Windows alternate data stream paths are not accepted."});for(let i of r.split("\\"))!i||i==="."||i===".."||/^[a-z]:$/i.test(i)||((i.endsWith(".")||i.endsWith(" "))&&t.push({code:"NON_CANONICAL_SEGMENT",message:`Windows path segment has an ambiguous trailing character: ${i}`}),Xn.test(i)&&t.push({code:"RESERVED_DEVICE_NAME",message:`Windows reserved device name is not accepted: ${i}`}));return(n.includes("\\globalroot\\")||n.includes("\\device\\"))&&t.push({code:"DEVICE_PATH",message:"Windows object-manager device paths are not accepted."}),t}function Mn(e,t=process.platform){return e.length===0?[{code:"EMPTY_PATH",message:"Empty paths are not accepted."}]:e.includes("\0")?[{code:"NUL_BYTE",message:"Paths containing NUL bytes are not accepted."}]:t==="win32"||/^[a-z]:/i.test(e)||e.startsWith("\\")?Ln(e):[]}function Un(e){let r=Te(e),n=[];for(;!Xt(r);){let i=_n(r);if(i===r)break;n.unshift(r.slice(i.length).replace(/^[/\\]+/,"")),r=i}let o=Xt(r)?Rn.native(r):r;return{canonicalPath:n.reduce((i,a)=>Nn(i,a),o),existingAncestor:o}}function J(e,t){let r=t?.platform??process.platform,n=Mn(e,r);if(n.length>0){let a=new Error(`${n[0].code}: ${n[0].message}`);throw a.name="SecurityPathError",a}let o=On(e)?Te(e):Te(t?.baseDirectory??process.cwd(),e),i=Un(o);return{input:e,absolutePath:o,...i}}function Dt(e){let t=Te(e);return process.platform==="win32"?t.toLowerCase():t}function Lt(e,t){let r;try{r=Dt(J(e).canonicalPath)}catch{return!1}for(let n of t){let o;try{o=Dt(J(n).canonicalPath)}catch{continue}if(r===o||r.startsWith(o+kn))return!0}return!1}import{existsSync as Mt,mkdirSync as xs,renameSync as Ps,rmSync as Rs,writeFileSync as _s}from"node:fs";import{join as Ut}from"node:path";var Ns=String.raw`
+var G=1;var ze=new Set(["browser.navigate","browser.back","browser.forward","browser.reload","browser.wait","browser.snapshot","browser.screenshot","browser.locate","browser.tabs.list","browser.tabs.open","browser.console.read","browser.network.read","browser.storage.read","browser.page-errors.read"]),Je=new Set(["browser.click","browser.type","browser.key","browser.select","browser.scroll","browser.tabs.close","browser.upload","browser.download","browser.record.start","browser.record.stop"]),Ke=new Set(["computer.observe","computer.screenshot","computer.window-state","computer.wait"]),Ye=new Set(["computer.point","computer.click","computer.double-click","computer.right-click","computer.drag","computer.type","computer.key","computer.scroll","computer.launch"]),se=[...ze,...Je,...Ke,...Ye];function X(e){if(ze.has(e))return{operation:e,surface:"browser",effect:"observe",evidence:{before:"disabled",after:e==="browser.wait"||e==="browser.tabs.list"?"optional":"required",recording:"optional"}};if(Je.has(e)){let t=e==="browser.record.start"||e==="browser.record.stop";return{operation:e,surface:"browser",effect:"act",evidence:{before:"required",after:"required",recording:e==="browser.record.stop"?"required":"optional"}}}if(Ke.has(e))return{operation:e,surface:"computer",effect:"observe",evidence:{before:"disabled",after:e==="computer.wait"?"optional":"required",recording:"optional"}};if(Ye.has(e))return{operation:e,surface:"computer",effect:"act",evidence:{before:"required",after:"required",recording:"optional"}};throw new TypeError(`Unsupported XENO automation operation: ${e}`)}function Ze(e){return ze.has(e)||Je.has(e)||Ke.has(e)||Ye.has(e)}var d=class extends Error{constructor(r,n,o,i){super(n,i);this.code=r;this.detail=o;this.name="XenoAutomationError"}code;detail};import{createHash as No}from"node:crypto";import{arch as ko}from"node:os";import{existsSync as Vt,realpathSync as Pn}from"node:fs";import{dirname as xn,isAbsolute as Rn,join as On,resolve as Pe,sep as _n}from"node:path";var Nn=/^(?:con|prn|aux|nul|clock\$|com[1-9]|lpt[1-9])(?:\..*)?$/i;function kn(e){return e.replace(/\//g,"\\")}function Xn(e){let t=[],r=kn(e),n=r.toLowerCase();if(r.startsWith("\\\\?\\")||r.startsWith("\\\\.\\")||r.startsWith("\\??\\"))return t.push({code:"DEVICE_PATH",message:"Extended-length, NT, and Windows device paths are not accepted at security boundaries."}),t;if(r.startsWith("\\\\"))return t.push({code:"UNC_PATH",message:"UNC paths are not accepted at security boundaries."}),t;/^[a-z]:($|[^\\])/i.test(r)?t.push({code:"DRIVE_RELATIVE_PATH",message:"Drive-relative Windows paths are ambiguous and are not accepted."}):/^\\(?!\\)/.test(r)&&t.push({code:"ROOT_RELATIVE_PATH",message:"Root-relative Windows paths are ambiguous and are not accepted."});let o=/^[a-z]:/i.test(r)?2:0;r.slice(o).includes(":")&&t.push({code:"ALTERNATE_DATA_STREAM",message:"Windows alternate data stream paths are not accepted."});for(let i of r.split("\\"))!i||i==="."||i===".."||/^[a-z]:$/i.test(i)||((i.endsWith(".")||i.endsWith(" "))&&t.push({code:"NON_CANONICAL_SEGMENT",message:`Windows path segment has an ambiguous trailing character: ${i}`}),Nn.test(i)&&t.push({code:"RESERVED_DEVICE_NAME",message:`Windows reserved device name is not accepted: ${i}`}));return(n.includes("\\globalroot\\")||n.includes("\\device\\"))&&t.push({code:"DEVICE_PATH",message:"Windows object-manager device paths are not accepted."}),t}function Dn(e,t=process.platform){return e.length===0?[{code:"EMPTY_PATH",message:"Empty paths are not accepted."}]:e.includes("\0")?[{code:"NUL_BYTE",message:"Paths containing NUL bytes are not accepted."}]:t==="win32"||/^[a-z]:/i.test(e)||e.startsWith("\\")?Xn(e):[]}function Ln(e){let r=Pe(e),n=[];for(;!Vt(r);){let i=xn(r);if(i===r)break;n.unshift(r.slice(i.length).replace(/^[/\\]+/,"")),r=i}let o=Vt(r)?Pn.native(r):r;return{canonicalPath:n.reduce((i,a)=>On(i,a),o),existingAncestor:o}}function Z(e,t){let r=t?.platform??process.platform,n=Dn(e,r);if(n.length>0){let a=new Error(`${n[0].code}: ${n[0].message}`);throw a.name="SecurityPathError",a}let o=Rn(e)?Pe(e):Pe(t?.baseDirectory??process.cwd(),e),i=Ln(o);return{input:e,absolutePath:o,...i}}function Ft(e){let t=Pe(e);return process.platform==="win32"?t.toLowerCase():t}function jt(e,t){let r;try{r=Ft(Z(e).canonicalPath)}catch{return!1}for(let n of t){let o;try{o=Ft(Z(n).canonicalPath)}catch{continue}if(r===o||r.startsWith(o+_n))return!0}return!1}import{existsSync as Ht,mkdirSync as gs,renameSync as hs,rmSync as As,writeFileSync as ys}from"node:fs";import{join as Gt}from"node:path";var ws=String.raw`
 using System;
 using System.ComponentModel;
 using System.Runtime.InteropServices;
@@ -39,6 +39,7 @@ namespace Xeno.Security
         private const Int32 TokenIntegrityLevel = 25;
         private const Int32 JobObjectExtendedLimitInformation = 9;
         private const Int32 PROC_THREAD_ATTRIBUTE_HANDLE_LIST = 0x00020002;
+        private const Int32 PROC_THREAD_ATTRIBUTE_JOB_LIST = 0x0002000D;
         private const UInt32 INFINITE = 0xFFFFFFFF;
 
         [StructLayout(LayoutKind.Sequential)]
@@ -531,17 +532,17 @@ namespace Xeno.Security
             }
         }
 
-        private static void InitializeHandleAllowlist(ref STARTUPINFOEX startup, out IntPtr handleBuffer)
+        private static void InitializeHandleAllowlist(ref STARTUPINFOEX startup, IntPtr job, out IntPtr handleBuffer)
         {
             IntPtr requiredSize = IntPtr.Zero;
-            InitializeProcThreadAttributeList(IntPtr.Zero, 1, 0, ref requiredSize);
+            InitializeProcThreadAttributeList(IntPtr.Zero, 2, 0, ref requiredSize);
             if (requiredSize == IntPtr.Zero)
                 ThrowLastError("InitializeProcThreadAttributeList(size)");
             startup.lpAttributeList = Marshal.AllocHGlobal(requiredSize);
-            if (!InitializeProcThreadAttributeList(startup.lpAttributeList, 1, 0, ref requiredSize))
+            if (!InitializeProcThreadAttributeList(startup.lpAttributeList, 2, 0, ref requiredSize))
                 ThrowLastError("InitializeProcThreadAttributeList");
 
-            handleBuffer = Marshal.AllocHGlobal(IntPtr.Size * 3);
+            handleBuffer = Marshal.AllocHGlobal(IntPtr.Size * 4);
             Marshal.WriteIntPtr(handleBuffer, 0, startup.StartupInfo.hStdInput);
             Marshal.WriteIntPtr(handleBuffer, IntPtr.Size, startup.StartupInfo.hStdOutput);
             Marshal.WriteIntPtr(handleBuffer, IntPtr.Size * 2, startup.StartupInfo.hStdError);
@@ -554,6 +555,14 @@ namespace Xeno.Security
                 IntPtr.Zero,
                 IntPtr.Zero))
                 ThrowLastError("UpdateProcThreadAttribute(HANDLE_LIST)");
+            // Membership must exist at creation; a later assignment leaves a
+            // suspended orphan if the helper is killed between those calls.
+            IntPtr jobBuffer = IntPtr.Add(handleBuffer, IntPtr.Size * 3);
+            Marshal.WriteIntPtr(jobBuffer, job);
+            if (!UpdateProcThreadAttribute(startup.lpAttributeList, 0,
+                new IntPtr(PROC_THREAD_ATTRIBUTE_JOB_LIST), jobBuffer,
+                new IntPtr(IntPtr.Size), IntPtr.Zero, IntPtr.Zero))
+                ThrowLastError("UpdateProcThreadAttribute(JOB_LIST)");
         }
 
         private static void ApplyIntegrity(IntPtr token, string integritySid, string label_)
@@ -828,7 +837,7 @@ namespace Xeno.Security
                 MarkInheritable(startup.StartupInfo.hStdInput);
                 MarkInheritable(startup.StartupInfo.hStdOutput);
                 MarkInheritable(startup.StartupInfo.hStdError);
-                InitializeHandleAllowlist(ref startup, out handleBuffer);
+                InitializeHandleAllowlist(ref startup, job, out handleBuffer);
                 var commandLine = new StringBuilder("\"" + shell + "\" /d /s /c \"" + command + "\"");
                 bool created = restrictedToken
                     ? CreateProcessAsUser(
@@ -864,10 +873,12 @@ namespace Xeno.Security
                             : "CreateProcessAsUser (window station/desktop grant failed first: " + desktopGrantError + ")")
                         : "CreateProcess");
                 }
-                if (!AssignProcessToJobObject(job, processInfo.hProcess))
+                if (Environment.GetEnvironmentVariable("XENO_CONTAINMENT_DIAGNOSTICS") == "1"
+                    && Environment.GetEnvironmentVariable("XENO_RESTRICTED_CREATE_BARRIER") == "1")
                 {
-                    TerminateProcess(processInfo.hProcess, 126);
-                    ThrowLastError("AssignProcessToJobObject");
+                    Console.Error.WriteLine("[xeno-containment] suspended-child=" + processInfo.dwProcessId);
+                    Console.Error.Flush();
+                    System.Threading.Thread.Sleep(10000);
                 }
                 if (ResumeThread(processInfo.hThread) == UInt32.MaxValue)
                 {
@@ -896,7 +907,7 @@ namespace Xeno.Security
         }
     }
 }
-`,ks=String.raw`
+`,bs=String.raw`
 public static class Program
 {
     private static string Decode(string name)
@@ -922,17 +933,17 @@ public static class Program
         return Xeno.Security.RestrictedProcessLauncher.Run(command, cwd, lowIntegrity, restrictedToken, tokenProbe);
     }
 }
-`;function $t(){let e=process.env.SystemRoot??process.env.WINDIR;if(e){let t=Ut(e,"Microsoft.NET","Framework64","v4.0.30319","csc.exe");if(Mt(t))return t;let r=Ut(e,"Microsoft.NET","Framework","v4.0.30319","csc.exe");if(Mt(r))return r}return null}import{spawnSync as Bt}from"node:child_process";import{accessSync as $n,constants as Bn,existsSync as Fn,realpathSync as Vn,statSync as jn}from"node:fs";import{delimiter as Hn,isAbsolute as Gn,join as Wn,resolve as Jn}from"node:path";var jt="XENO_BWRAP_PROFILE_OK",Ft=5e3,Ze;function Vt(e){try{return!Fn(e)||!jn(e).isFile()?null:($n(e,Bn.X_OK),Vn(e))}catch{return null}}function qn(){let e=process.env.XENO_BWRAP_PATH?.trim();if(e)return Vt(Gn(e)?e:Jn(e));let t=["/usr/bin/bwrap","/bin/bwrap",...(process.env.PATH??"").split(Hn).filter(Boolean).map(r=>Wn(r,"bwrap"))];for(let r of new Set(t)){let n=Vt(r);if(n)return n}return null}function zn(){return["--die-with-parent","--new-session","--unshare-user","--unshare-pid","--unshare-uts","--unshare-ipc","--ro-bind","/","/","--proc","/proc","--dev","/dev","--chdir","/","--","/bin/sh","-c",`test -r /proc/self/status && printf ${jt}`]}function Ht(){let e=[process.platform,process.env.XENO_BWRAP_PATH??"",process.env.PATH??""].join("\0");if(Ze?.key===e)return{...Ze.capability};let t;if(process.platform!=="linux")t={available:!1,reason:"The bubblewrap process-hardening profile can only be probed on a Linux host."};else{let r=qn();if(!r)t={available:!1,reason:"bubblewrap is not installed or is not executable."};else{let n=Bt(r,["--version"],{encoding:"utf8",timeout:Ft}),o=Bt(r,zn(),{encoding:"utf8",timeout:Ft,env:process.env}),i=n.status===0?n.stdout.trim():void 0;if(o.status===0&&o.stdout===jt)t={available:!0,executable:r,...i?{version:i}:{},reason:`An active ${i??"bubblewrap"} namespace profile passed its mount, PID, user, IPC, UTS, /proc, and /dev probe.`};else{let a=[o.error?.message,o.stderr.trim(),o.signal?`signal ${o.signal}`:void 0,o.status!==null?`exit ${o.status}`:void 0].filter(Boolean).join("; ");t={available:!1,executable:r,...i?{version:i}:{},reason:`bubblewrap was found but its active namespace profile failed${a?`: ${a}`:"."}`}}}}return Ze={key:e,capability:t},{...t}}import{createHash as Kn,createPublicKey as Yn,verify as Zn}from"node:crypto";import{readFileSync as Qn,statSync as eo}from"node:fs";import{isAbsolute as to}from"node:path";var Qe="xeno.containment-certification.v1",Gt=512*1024,ro=744*60*60*1e3,Wt=Object.freeze(["allowedFilesystemRead","allowedFilesystemWrite","outsideFilesystemReadDenied","outsideFilesystemWriteDenied","unlistedFilesystemReadDenied","unlistedFilesystemWriteDenied","symlinkEscapeDenied","networkDefaultDeny","environmentSecretsExcluded","childProcessPolicyInherited","standardCommandLaunch","processTreeCleanup","timeoutEnforced","hostPolicyRecoveryClean","uiRestrictionsEnforced"]),I=class extends Error{constructor(t){super(`CONTAINMENT_CERTIFICATION_INVALID: ${t}`),this.name="ContainmentCertificationError"}};function no(e){let t={...e};return delete t.signature,Buffer.from(JSON.stringify(tt(t)),"utf8")}function Jt(e,t,r=new Date){if(!to(e.manifestPath))throw new I("manifestPath must be absolute");ue(e.candidateSha256,"candidateSha256");let n=eo(e.manifestPath);if(!n.isFile())throw new I("manifestPath must reference a regular file");if(n.size<=0||n.size>Gt)throw new I(`manifest size must be between 1 and ${Gt} bytes`);let o=Qn(e.manifestPath),i;try{i=JSON.parse(o.toString("utf8"))}catch{throw new I("manifest is not valid JSON")}let a=oo(i);if(e.expectedCertificationId&&a.certificationId!==e.expectedCertificationId)throw new I("certificationId does not match the host binding");if(a.candidate.sha256.toLowerCase()!==e.candidateSha256.toLowerCase())throw new I("candidate digest does not match the running candidate binding");if(a.platform.os!==t.platform||a.platform.arch!==t.arch)throw new I("certification platform or architecture does not match this host");if(a.adapter.name!==t.name||a.adapter.version!==t.version||a.adapter.backend!==t.backend||a.adapter.isolationTier!==t.isolationTier||a.adapter.nativeBinarySha256.toLowerCase()!==t.nativeBinarySha256.toLowerCase())throw new I("certified adapter identity does not match the installed native adapter");let s=et(a.issuedAt,"issuedAt"),c=et(a.expiresAt,"expiresAt");if(c<=s)throw new I("expiresAt must be later than issuedAt");if(c-s>ro)throw new I("certification lifetime exceeds 31 days");if(r.getTime()<s-5*6e4)throw new I("certification is not active yet");if(r.getTime()>=c)throw new I("certification has expired");for(let m of Wt)if(a.conformance.checks[m]!==!0)throw new I(`required conformance check did not pass: ${m}`);if(!a.approvals.some(m=>m.role==="security-reviewer"&&m.subject!==a.issuedBy))throw new I("an independent security-reviewer approval is required");let d=e.trustedPublicKeys[a.signature.keyId];if(!d)throw new I("signature key is not trusted by this host");let A;try{A=Buffer.from(a.signature.value,"base64")}catch{throw new I("signature is not valid base64")}if(A.length!==64)throw new I("Ed25519 signature must be 64 bytes");let y=!1;try{y=Zn(null,no(a),Yn(d),A)}catch{throw new I("signature key or value is invalid")}if(!y)throw new I("signature verification failed");return{manifest:a,manifestSha256:Kn("sha256").update(o).digest("hex")}}function oo(e){let t=j(e,"manifest");if(t.schemaVersion!==Qe)throw new I(`schemaVersion must be ${Qe}`);let r=v(t.certificationId,"certificationId"),n=j(t.candidate,"candidate"),o=j(t.adapter,"adapter"),i=j(t.platform,"platform"),a=j(t.conformance,"conformance"),s=j(a.checks,"conformance.checks"),c=j(t.signature,"signature"),d=t.approvals;if(!Array.isArray(d)||d.length===0)throw new I("approvals must contain at least one approval");let A=d.map((N,x)=>{let E=j(N,`approvals[${x}]`),ce=v(E.role,`approvals[${x}].role`);if(ce!=="security-reviewer"&&ce!=="release-reviewer")throw new I(`approvals[${x}].role is invalid`);let Se=ce;et(v(E.approvedAt,`approvals[${x}].approvedAt`),`approvals[${x}].approvedAt`);let de=v(E.approvalSha256,`approvals[${x}].approvalSha256`);return ue(de,`approvals[${x}].approvalSha256`),{subject:v(E.subject,`approvals[${x}].subject`),role:Se,approvedAt:E.approvedAt,approvalArtifactId:v(E.approvalArtifactId,`approvals[${x}].approvalArtifactId`),approvalSha256:de}}),y=v(o.backend,"adapter.backend");if(y!=="processcontainer"&&y!=="bubblewrap"&&y!=="seatbelt")throw new I("adapter.backend is invalid");let m=v(i.os,"platform.os"),w=v(i.arch,"platform.arch");if(v(c.algorithm,"signature.algorithm")!=="ed25519")throw new I("signature.algorithm must be ed25519");let b={};for(let N of Wt){if(s[N]!==!0)throw new I(`conformance.checks.${N} must be true`);b[N]=!0}let C=v(o.nativeBinarySha256,"adapter.nativeBinarySha256"),O=v(n.sha256,"candidate.sha256"),D=v(a.reportSha256,"conformance.reportSha256");if(ue(C,"adapter.nativeBinarySha256"),ue(O,"candidate.sha256"),ue(D,"conformance.reportSha256"),a.passed!==!0)throw new I("conformance.passed must be true");return{schemaVersion:Qe,certificationId:r,candidate:{product:v(n.product,"candidate.product"),version:v(n.version,"candidate.version"),sha256:O},adapter:{name:o.name==="microsoft-mxc"?"microsoft-mxc":io(),version:v(o.version,"adapter.version"),backend:y,isolationTier:v(o.isolationTier,"adapter.isolationTier"),nativeBinarySha256:C},platform:{os:m,arch:w},conformance:{reportArtifactId:v(a.reportArtifactId,"conformance.reportArtifactId"),reportSha256:D,passed:!0,checks:b},issuedAt:v(t.issuedAt,"issuedAt"),expiresAt:v(t.expiresAt,"expiresAt"),issuedBy:v(t.issuedBy,"issuedBy"),approvals:A,signature:{algorithm:"ed25519",keyId:v(c.keyId,"signature.keyId"),value:v(c.value,"signature.value")}}}function io(){throw new I("adapter.name must be microsoft-mxc")}function j(e,t){if(!e||typeof e!="object"||Array.isArray(e))throw new I(`${t} must be an object`);return e}function v(e,t){if(typeof e!="string"||e.trim().length===0)throw new I(`${t} must be a non-empty string`);return e}function ue(e,t){if(!/^[a-f0-9]{64}$/i.test(e))throw new I(`${t} must be a SHA-256 hex digest`)}function et(e,t){let r=Date.parse(e);if(!Number.isFinite(r))throw new I(`${t} must be an ISO timestamp`);return r}function tt(e){return Array.isArray(e)?e.map(tt):e&&typeof e=="object"?Object.fromEntries(Object.entries(e).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>[t,tt(r)])):e}import{createHash as Ce,randomUUID as ao}from"node:crypto";import{accessSync as so,chmodSync as qt,constants as co,existsSync as xe,lstatSync as ot,mkdirSync as lo,readFileSync as fe,realpathSync as uo,renameSync as po,statSync as fo,unlinkSync as mo,writeFileSync as go}from"node:fs";import{tmpdir as ho}from"node:os";import{dirname as Qt,isAbsolute as zt,join as q,parse as zs}from"node:path";import{spawnSync as Kt}from"node:child_process";import{fileURLToPath as Ao}from"node:url";var Yt="microsoft-mxc",pe="0.7.0";var yo="@microsoft/mxc-sdk",Io="sha512-EWhz2pKkcPluZHAOI1yneV+JK0NO/3hdh7nABBb0x4PjyUWMeSWPTBAjtIu+BhtMYOqlaijSPZMZ0Hs/J4ZL4A==",ec=10*6e4,wo=Object.freeze({"win32-x64-wxc-exec.exe":"db0a3422be9e1b396cc1b2547c70ff16b27412438a31c10a45abf370cac86ae2","win32-arm64-wxc-exec.exe":"e430d0e4f44f616e91db684f8d825a6dc93e06a1262b8d00bcaac7522a317aab","linux-x64-lxc-exec":"1efe3f817f5ae9ba9f9f2fd59142e79b2dde7a4dd024576b0ddb635fc87edeb5","linux-arm64-lxc-exec":"fdc00ccecf362ae3ddd8ccad93fd7c8b5b1f03c68897ab05ef1c9f1d327ea3fe","darwin-arm64-mxc-exec-mac":"77c07a86f483ed91dd5be290cd77878ac0c56fe113cdb8c764e7e5201c744ad2"}),tc=Object.freeze({"win32-x64-wxc-host-prep.exe":"531fb3cdb4b0c964908fd71b71d40961417afb399cbab72f92a25e95309a6416","win32-arm64-wxc-host-prep.exe":"3ef702332286a39153fc259310b5021e3de3c191751d7522684f6475f73af5ef"});function bo(e){return e.some(t=>t.includes("wxc-host-prep prepare-system-drive")||t.includes("wxc-host-prep prepare-null-device"))}function Eo(e,t){if(e!=="win32"&&e!=="linux"&&e!=="darwin"||t!=="x64"&&t!=="arm64"||e==="darwin"&&t!=="arm64")return;let r=e==="win32"?"wxc-exec.exe":e==="darwin"?"mxc-exec-mac":"lxc-exec",n=wo[`${e}-${t}-${r}`];return n?{platform:e,arch:t,binaryName:r,sha256:n}:void 0}var rt;function er(e={}){if(rt&&!e.refresh)return Zt(rt);let t=vo();return rt=t,Zt(t)}function vo(){let e=process.platform,t=process.arch,r=Eo(e,t),n=!!r,o=So();if(!o)return n?R(`reviewed MXC ${pe} native assets are not installed`,!1,!0):R(nt(e,t),!1,!1);let i=Qt(o);if(!n)return R(nt(e,t),!0,!1,{packageRoot:i});let a="";try{let m=JSON.parse(fe(o,"utf8"));if(a=String(m.version??""),m.sourcePackage?.name!==yo||m.sourcePackage.version!==pe||m.sourcePackage.integrity!==Io)return R("MXC native asset provenance metadata is invalid",!0,!0,{packageRoot:i})}catch{return R("MXC package metadata is unreadable",!0,!0,{packageRoot:i})}if(a!==pe)return R(`MXC version ${a||"unknown"} is installed; XENO requires exactly ${pe}`,!0,!0,{packageRoot:i});if(!r)return R(nt(e,t),!0,!1,{packageRoot:i});let s=q(i,"bin",t,r.binaryName);if(!xe(s)||!fo(s).isFile())return R(`MXC native binary is missing: ${r.binaryName}`,!0,!0,{packageRoot:i,version:a});let c=s;try{c=To(s,r)}catch(m){return R(`MXC packaged native binary could not be materialized: ${m instanceof Error?m.message:String(m)}`,!0,!0,{packageRoot:i,version:a})}if(e!=="win32")try{so(c,co.X_OK)}catch{return R(`MXC native binary is not executable: ${r.binaryName}`,!0,!0,{packageRoot:i,version:a})}let d=Ce("sha256").update(fe(c)).digest("hex"),A=r.sha256;if(!A||d!==A)return R(`MXC native binary digest is not trusted for ${e}/${t}`,!0,!0,{packageRoot:i,version:a});if(e==="win32"){let m=Kt(c,["--probe"],{encoding:"utf8",timeout:5e3,windowsHide:!0});if(m.error||m.status!==0)return R(`MXC native probe failed: ${m.error?.message??(m.stderr.trim()||`exit ${m.status}`)}`,!0,!0,{packageRoot:i,version:a});let w;try{w=JSON.parse(m.stdout)}catch{return R("MXC native probe returned invalid JSON",!0,!0,{packageRoot:i,version:a})}let h=typeof w.tier=="string"?w.tier:"unknown",b=Array.isArray(w.warnings)?w.warnings.filter(D=>typeof D=="string"):[],C=w.probes&&typeof w.probes=="object"?w.probes:void 0,O=C?.uiCapabilities&&typeof C.uiCapabilities=="object"?Object.fromEntries(Object.entries(C.uiCapabilities).filter(D=>typeof D[1]=="boolean")):void 0;return{installed:!0,supported:!0,available:!0,name:Yt,version:a,packageRoot:i,nativeBinaryPath:c,nativeBinarySha256:d,backend:"processcontainer",isolationTier:h,platform:e,arch:t,warnings:b,needsHostPreparation:bo(b),reason:`MXC ${a} processcontainer is installed (${h}).`,...O?{uiCapabilities:O}:{}}}if(e==="linux"){let m=Kt("bwrap",["--version"],{encoding:"utf8",timeout:5e3});if(m.error||m.status!==0)return R("MXC requires bubblewrap on PATH for the stable Linux process adapter",!0,!0,{packageRoot:i,version:a})}let y=e==="darwin"?"seatbelt":"bubblewrap";return{installed:!0,supported:!0,available:!0,name:Yt,version:a,packageRoot:i,nativeBinaryPath:c,nativeBinarySha256:d,backend:y,isolationTier:y,platform:e,arch:t,warnings:[],needsHostPreparation:!1,reason:`MXC ${a} ${y} adapter is installed.`}}function So(){let e=process.resourcesPath,t=process.env.XENO_MXC_ASSET_ROOT?.trim(),r=typeof __dirname=="string"?__dirname:Qt(Ao(import.meta.url)),n=[...e&&zt(e)?[q(e,"mxc","package.json")]:[],...t&&zt(t)?[q(t,"package.json")]:[],q(r,"..","native","mxc","package.json"),q(r,"..","..","native","mxc","package.json")];for(let o of n){if(!xe(o))continue;let i=ot(o);if(!(!i.isFile()||i.isSymbolicLink()))return uo(o)}}function To(e,t){if(!!!process.pkg)return e;let n=q(ho(),"xeno-mxc",pe,t.sha256);lo(n,{recursive:!0,mode:448});let o=q(n,t.binaryName);if(xe(o)){let c=ot(o);if(!c.isFile()||c.isSymbolicLink())throw new Error("materialized MXC path is not a regular file");if(Ce("sha256").update(fe(o)).digest("hex")!==t.sha256)throw new Error("materialized MXC binary digest is invalid");return process.platform!=="win32"&&qt(o,448),o}let i=fe(e);if(Ce("sha256").update(i).digest("hex")!==t.sha256)throw new Error("embedded MXC binary digest is invalid");let s=`${o}.${process.pid}.${ao()}.tmp`;go(s,i,{flag:"wx",mode:448});try{po(s,o)}catch(c){try{mo(s)}catch{}if(!xe(o))throw c;let d=ot(o);if((d.isFile()&&!d.isSymbolicLink()?Ce("sha256").update(fe(o)).digest("hex"):"")!==t.sha256)throw c}return process.platform!=="win32"&&qt(o,448),o}function nt(e,t){return e!=="win32"&&e!=="linux"&&e!=="darwin"?`MXC has no stable process adapter for ${e}/${t}`:t!=="x64"&&t!=="arm64"?`MXC does not ship a ${e}/${t} native adapter`:"MXC Seatbelt currently ships for macOS ARM64 only"}function R(e,t=!1,r=!1,n={}){return{...n,installed:t,supported:r,available:!1,warnings:[],needsHostPreparation:!1,reason:e}}function Zt(e){return{...e,warnings:[...e.warnings],...e.uiCapabilities?{uiCapabilities:{...e.uiCapabilities}}:{}}}var z=class extends Error{code;constructor(t,r){super(`${t}: ${r}`),this.name="ExecutionSecurityError",this.code=t}},Co=Object.freeze({policyEnforcement:!0,restrictedIdentity:!1,lowIntegrity:!1,processTreeControl:!1,filesystemIsolation:!1,networkIsolation:!1,inheritedHandleAllowlist:!1,environmentSanitization:!0}),xo=Object.freeze({policyEnforcement:!0,restrictedIdentity:!0,lowIntegrity:!0,processTreeControl:!0,filesystemIsolation:!1,networkIsolation:!1,inheritedHandleAllowlist:!0,environmentSanitization:!0}),Po=Object.freeze({policyEnforcement:!0,restrictedIdentity:!0,lowIntegrity:!1,processTreeControl:!0,filesystemIsolation:!1,networkIsolation:!1,inheritedHandleAllowlist:!1,environmentSanitization:!0}),Ro=Object.freeze({policyEnforcement:!0,restrictedIdentity:!0,lowIntegrity:!1,processTreeControl:!0,filesystemIsolation:!0,networkIsolation:!0,inheritedHandleAllowlist:!0,environmentSanitization:!0}),it=Object.freeze({policyEnforcement:!0,restrictedIdentity:!1,lowIntegrity:!1,processTreeControl:!1,filesystemIsolation:!1,networkIsolation:!1,inheritedHandleAllowlist:!1,environmentSanitization:!0});function _o(e){let t=e?.executionLevel;if(e?.requireOsContainment&&t&&t!=="contained")throw new z("SECURITY_POLICY_INVALID","requireOsContainment is a strict contained-mode compatibility flag and conflicts with the requested executionLevel.");return t??(e?.requireOsContainment?"contained":"policy-only")}function Oo(e){return e?.trustMode??"trusted-workspace"}function tr(e,t=process.platform,r){if(e==="policy-only")return{available:!0,requestedLevel:e,effectiveLevel:"policy-only",adapter:"policy-enforcer",isolation:"policy-only",certified:!0,capabilities:{...Co},limitations:["No restricted process identity.","No filesystem isolation.","No network isolation."],reason:"Policy and permission checks are active without operating-system process isolation."};if(e==="process-hardened"){if(t==="win32"&&$t())return{available:!0,requestedLevel:e,effectiveLevel:"process-hardened",adapter:"windows-restricted-token-job",isolation:"process-hardening",certified:!0,capabilities:{...xo},limitations:["Filesystem reads are not isolated.","Network access is not isolated.","This mode is not suitable for untrusted code."],reason:"Windows restricted-token, low-integrity, explicit-handle, and kill-on-close Job Object process hardening is available."};if(t==="linux"){let o=Ht();return o.available?{available:!0,requestedLevel:e,effectiveLevel:"process-hardened",adapter:"linux-bubblewrap",isolation:"process-hardening",certified:!0,capabilities:{...Po},limitations:["Filesystem reads are not isolated; the host root is mounted read-only.","Network access is not isolated.","Inherited file descriptors are limited by the host launcher rather than an adapter-owned allowlist.","This mode is not suitable for untrusted code."],reason:`linux-bubblewrap is available: ${o.reason}`}:{available:!1,requestedLevel:e,effectiveLevel:"unavailable",adapter:"unavailable",isolation:"none",certified:!1,capabilities:{...it},limitations:["No certified process-hardening adapter is available for this platform."],reason:`Linux bubblewrap process hardening is unavailable: ${o.reason}`}}return{available:!1,requestedLevel:e,effectiveLevel:"unavailable",adapter:"unavailable",isolation:"none",certified:!1,capabilities:{...it},limitations:["No certified process-hardening adapter is available for this platform."],reason:t==="win32"?"The Windows .NET Framework C# compiler is unavailable, so the restricted-token launcher cannot start.":`No certified process-hardened adapter is implemented for ${t}.`}}if(t!==process.platform)return Pe(t,`Native containment for ${t} cannot be certified from a ${process.platform} host.`);let n=er();if(!n.available||!n.name||!n.version||!n.backend||!n.isolationTier||!n.nativeBinarySha256||!n.platform||!n.arch)return Pe(t,n.reason,n);if(!r)return Pe(t,`${n.reason} A signed candidate-bound XENO containment certification was not supplied.`,n);try{let o={name:n.name,version:n.version,backend:n.backend,isolationTier:n.isolationTier,nativeBinarySha256:n.nativeBinarySha256,platform:n.platform,arch:n.arch},i=Jt(r,o);return{available:!0,requestedLevel:e,effectiveLevel:"contained",adapter:"microsoft-mxc",isolation:"filesystem-network",certified:!0,capabilities:{...Ro},limitations:[...n.warnings],reason:`${n.reason} Signed XENO certification ${i.manifest.certificationId} is valid for this candidate.`,adapterVersion:n.version,backend:n.backend,isolationTier:n.isolationTier,nativeBinarySha256:n.nativeBinarySha256,certificationArtifactId:i.manifest.certificationId,certificationManifestSha256:i.manifestSha256,needsHostPreparation:n.needsHostPreparation}}catch(o){return Pe(t,o instanceof Error?o.message:"Containment certification validation failed.",n)}}function No(e,t){if(Oo(e)==="untrusted"&&t!=="contained")throw new z("UNTRUSTED_EXECUTION_DISABLED","Untrusted execution requires certified contained mode; policy-only and process-hardened modes are trusted-workspace features.")}function ko(e){let t=e.requestedLevel==="contained"?"CONTAINMENT_UNAVAILABLE":"PROCESS_HARDENING_UNAVAILABLE";return new z(t,e.reason)}function rr(e,t=process.platform){let r=_o(e);No(e,r);let n=tr(r,t,e.containmentCertification);if(!n.available)throw ko(n);if(r==="process-hardened"&&e.allowNetwork!==!0)throw new z("NETWORK_ISOLATION_UNAVAILABLE","Process-hardened execution cannot enforce network denial. Set allowNetwork=true explicitly for a trusted workspace or request certified contained mode.");if(r!=="policy-only"){let o=J(e.workingDirectory??process.cwd()).canonicalPath,i=[...e.allowedDirectories,...e.temporaryDirectories??[]];if(!Lt(o,i))throw new z("SECURITY_POLICY_INVALID",`Secured process working directory is outside the canonical allowed directories: ${o}`)}return n}function Pe(e,t,r){let n=r?.available===!0;return{available:!1,requestedLevel:"contained",effectiveLevel:"unavailable",adapter:n?"microsoft-mxc":"unavailable",isolation:n?"filesystem-network":"none",certified:!1,capabilities:{...it},limitations:["Contained mode remains fail-closed until a signed, candidate-bound XENO certification is valid.",...r?.warnings??[],...e==="win32"&&!n?["Windows restricted-token execution is process hardening only."]:[]],reason:t,...r?.version?{adapterVersion:r.version}:{},...r?.backend?{backend:r.backend}:{},...r?.isolationTier?{isolationTier:r.isolationTier}:{},...r?.nativeBinarySha256?{nativeBinarySha256:r.nativeBinarySha256}:{},...r?{needsHostPreparation:r.needsHostPreparation}:{}}}var ir=1,S=class extends Error{constructor(r,n){super(n);this.code=r;this.name="XenoSecureExecutionContractError"}code};function ar(e){let t=e.platform??process.platform,r=e.policy.executionLevel??(e.policy.requireOsContainment?"contained":"policy-only"),n=e.adapterStatus??rr(e.policy,t);if(!n.available||n.effectiveLevel==="unavailable")throw new S("SECURITY_CONTRACT_UNAVAILABLE",n.reason);if(n.requestedLevel!==r||n.effectiveLevel!==r)throw new S("SECURITY_CONTRACT_INVALID","Execution adapter status does not match the requested security level");let i=(e.now??(()=>new Date().toISOString()))(),a=me([...e.policy.allowedDirectories,...e.policy.temporaryDirectories??[],e.policy.workingDirectory??process.cwd()],e.policy.workingDirectory,t),s=me(e.filesystem?.readRoots??a,e.policy.workingDirectory,t),c=e.profile.capabilities.permissionProfile==="read-only",d=c?[]:me(e.filesystem?.writeRoots??a,e.policy.workingDirectory,t),A=c?[]:me(e.filesystem?.executeRoots??a,e.policy.workingDirectory,t),y=me(e.filesystem?.deniedRoots??e.policy.deniedDirectories??[],e.policy.workingDirectory,t),m=n.capabilities.filesystemIsolation?"os":"policy",w=n.capabilities.networkIsolation?"os":r==="process-hardened"?"none":"policy",h=r==="contained"?"deny":e.network?.default??(e.policy.allowNetwork?"allow":"deny"),b=w==="none";if(b&&(!e.policy.allowNetwork||h!=="allow"))throw new S("SECURITY_CONTRACT_INVALID","An adapter without network isolation requires explicit unrestricted-network acknowledgement");if(c&&(e.browser?.mode==="act"||e.computer?.mode==="act"||(e.secrets?.length??0)>0))throw new S("SECURITY_CONTRACT_INVALID","Read-only Agent Profiles cannot receive browser action, computer action, or secret projection authority");let C=e.certificationArtifactId??n.certificationArtifactId;if(e.certificationArtifactId&&n.certificationArtifactId&&e.certificationArtifactId!==n.certificationArtifactId)throw new S("SECURITY_CONTRACT_INVALID","Requested certification artifact does not match the adapter certification");if(r==="contained"&&!C)throw new S("SECURITY_CONTRACT_INVALID","Contained execution requires a candidate-bound certification artifact");let O=re(e.environment?.deniedKeys??[]),D=new Set(O),N=ge(e.browser?.allowedDomains??[]),x=ge(e.browser?.readAllowedDomains??N),E=ge(e.browser?.actAllowedDomains??N),ce=ge([...N,...x,...E]),Se={schemaVersion:ir,contractId:e.contractId,createdAt:i,...e.expiresAt?{expiresAt:e.expiresAt}:{},identity:{...e.identity},requestedLevel:r,effectiveLevel:n.effectiveLevel,trustMode:e.policy.trustMode??"trusted-workspace",profile:{id:e.profile.profile.id,version:e.profile.profile.version,fingerprint:e.profile.fingerprint,permissionProfile:e.profile.capabilities.permissionProfile},filesystem:{enforcement:m,readRoots:s,writeRoots:d,executeRoots:A,deniedRoots:y},network:{enforcement:w,default:h,allowDestinations:nr(e.network?.allowDestinations??[]),denyDestinations:nr(e.network?.denyDestinations??[]),dns:e.network?.dns??((e.network?.allowDestinations?.length??0)>0||h==="allow"?"system":"disabled"),...e.network?.proxyUrl?{proxyUrl:e.network.proxyUrl}:{},downloads:e.network?.downloads??"deny",acknowledgedUnrestricted:b},process:{processTreeControl:n.capabilities.processTreeControl,cleanup:n.capabilities.processTreeControl?"kill-tree":"best-effort",inheritedHandleAllowlist:n.capabilities.inheritedHandleAllowlist,...Bo(e.process)},environment:{inheritance:e.environment?.inheritance??"allowlist",allowedKeys:re(e.environment?.allowedKeys??e.policy.containedEnvironmentAllowlist??[]).filter(Pn=>!D.has(Pn)),deniedKeys:O},secrets:$o(e.secrets??[]),externalActions:{default:e.profile.capabilities.externalActions.default,overrides:{...e.profile.capabilities.externalActions.overrides},requireCurrentTurnApproval:re(e.profile.capabilities.externalActions.requireCurrentTurnApproval),requireCapabilityLease:!0},browser:{mode:e.browser?.mode??"none",profile:e.browser?.profile??"ephemeral",allowedDomains:ce,readAllowedDomains:x,actAllowedDomains:E,deniedDomains:ge(e.browser?.deniedDomains??[]),allowedSchemes:Mo(e.browser?.allowedSchemes??["https"]),allowedPorts:Uo(e.browser?.allowedPorts??[443]),redirectPolicy:e.browser?.redirectPolicy??"policy",allowLoopbackDevelopment:e.browser?.allowLoopbackDevelopment??!1,downloads:e.browser?.downloads??"deny",uploads:e.browser?.uploads??"deny",recording:e.browser?.recording??"disabled"},computer:{mode:e.computer?.mode??"none",allowedApplications:re(e.computer?.allowedApplications??[]),sensitiveRegionRedaction:e.computer?.sensitiveRegionRedaction??!0,humanStopRequired:e.computer?.humanStopRequired??!0},capabilityLeaseIds:re(e.capabilityLeaseIds??[]),adapter:{id:n.adapter,version:e.adapterVersion??n.adapterVersion??"1",platform:t,architecture:e.architecture??Do(),certified:n.certified,...C?{certificationArtifactId:C}:{},capabilities:{...n.capabilities},limitations:[...n.limitations]},...e.auditEventIds?{auditEventIds:re(e.auditEventIds)}:{}},de={...Se,fingerprint:sr(Se)};return st(de),de}function Lo(e){let t=[];if(!e||typeof e!="object")return["Contract must be an object"];if(e.schemaVersion!==ir&&t.push("Unsupported schemaVersion"),e.contractId?.trim()||t.push("contractId is required"),(!e.identity?.runId?.trim()||!e.identity?.agentId?.trim())&&t.push("runId and agentId are required"),or(e.createdAt)||t.push("createdAt must be an ISO 8601 timestamp"),e.expiresAt&&(!or(e.expiresAt)||Date.parse(e.expiresAt)<=Date.parse(e.createdAt))&&t.push("expiresAt must be later than createdAt"),e.requestedLevel!==e.effectiveLevel&&t.push("requestedLevel and effectiveLevel must match"),e.trustMode==="untrusted"&&e.effectiveLevel!=="contained"&&t.push("Untrusted execution requires contained mode"),e.effectiveLevel==="contained"&&(e.adapter.certified||t.push("Contained mode requires a certified adapter"),e.adapter.certificationArtifactId||t.push("Contained mode requires a certification artifact"),(!e.adapter.capabilities.filesystemIsolation||e.filesystem.enforcement!=="os")&&t.push("Contained mode requires OS filesystem isolation"),(!e.adapter.capabilities.networkIsolation||e.network.enforcement!=="os")&&t.push("Contained mode requires OS network isolation"),e.network.default!=="deny"&&t.push("Contained networking must default deny")),e.network.enforcement==="none"&&!e.network.acknowledgedUnrestricted&&t.push("Unrestricted networking must be explicitly acknowledged"),e.filesystem.writeRoots.length>0&&e.profile.permissionProfile==="read-only"&&t.push("Read-only profiles cannot receive write roots"),(!Array.isArray(e.browser.readAllowedDomains)||!Array.isArray(e.browser.actAllowedDomains))&&t.push("Browser read/action domain policies are required"),(!Array.isArray(e.browser.allowedSchemes)||e.browser.allowedSchemes.some(r=>r!=="http"&&r!=="https"))&&t.push("Browser allowed schemes are invalid"),(!Array.isArray(e.browser.allowedPorts)||e.browser.allowedPorts.some(r=>!Number.isInteger(r)||r<1||r>65535))&&t.push("Browser allowed ports are invalid"),e.secrets.some(r=>!r.secretId.trim())&&t.push("Secret projections require non-empty secret IDs"),new Set(e.secrets.map(r=>r.secretId)).size!==e.secrets.length&&t.push("Secret IDs must be unique"),new Set(e.capabilityLeaseIds).size!==e.capabilityLeaseIds.length&&t.push("Capability lease IDs must be unique"),/^[a-f0-9]{64}$/.test(e.profile.fingerprint)||t.push("Profile fingerprint is invalid"),!/^[a-f0-9]{64}$/.test(e.fingerprint))t.push("Contract fingerprint is invalid");else{let r={...e};delete r.fingerprint,sr(r)!==e.fingerprint&&t.push("Contract fingerprint does not match content")}return t}function st(e){let t=Lo(e);if(t.length>0){let r=t.includes("Contract fingerprint does not match content");throw new S(r?"SECURITY_CONTRACT_FINGERPRINT_MISMATCH":"SECURITY_CONTRACT_INVALID",t.join("; "))}}function sr(e){return Xo("sha256").update(JSON.stringify(at(e))).digest("hex")}function re(e){return[...new Set(e.map(t=>t.trim()).filter(Boolean))].sort().map(t=>t)}function me(e,t,r){return[...new Set(e.map(n=>J(n,{baseDirectory:t,platform:r}).canonicalPath))].sort((n,o)=>n.localeCompare(o))}function nr(e){let t=new Map;for(let r of e){if(!r.host?.trim())throw new S("SECURITY_CONTRACT_INVALID","Network destinations require a host");if(r.host.includes("*"))throw new S("SECURITY_CONTRACT_INVALID","Network destinations cannot contain wildcards");if(r.port!==void 0&&(!Number.isInteger(r.port)||r.port<1||r.port>65535))throw new S("SECURITY_CONTRACT_INVALID","Network destination port is invalid");let n={...r,host:r.host.trim().toLowerCase().replace(/\.$/,"")};t.set(`${n.scheme??""}:${n.host}:${n.port??""}`,n)}return[...t.values()].sort((r,n)=>r.host.localeCompare(n.host)||(r.port??0)-(n.port??0))}function ge(e){let t=new Set;for(let r of e){let n=r.trim().toLowerCase().replace(/\.$/,"");if(!n)continue;if(n.includes("*")||n.includes("://")||n.includes("/")||n.includes(":"))throw new S("SECURITY_CONTRACT_INVALID",`Browser domain rule is invalid: ${r}`);let o=n.startsWith(".")?n.slice(1):n;if(!/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/.test(o)&&o!=="localhost")throw new S("SECURITY_CONTRACT_INVALID",`Browser domain rule is invalid: ${r}`);t.add(n)}return[...t].sort((r,n)=>r.localeCompare(n))}function Mo(e){for(let t of e)if(t!=="http"&&t!=="https")throw new S("SECURITY_CONTRACT_INVALID",`Browser scheme is invalid: ${t}`);return[...new Set(e)].sort()}function Uo(e){for(let t of e)if(!Number.isInteger(t)||t<1||t>65535)throw new S("SECURITY_CONTRACT_INVALID",`Browser port is invalid: ${t}`);return[...new Set(e)].sort((t,r)=>t-r)}function $o(e){let t=new Map;for(let r of e){if(!r.secretId?.trim())throw new S("SECURITY_CONTRACT_INVALID","Secret projections require an ID");if(t.has(r.secretId))throw new S("SECURITY_CONTRACT_INVALID",`Secret ${r.secretId} is projected more than once`);t.set(r.secretId,{...r})}return[...t.values()].sort((r,n)=>r.secretId.localeCompare(n.secretId))}function Bo(e){let t={};for(let[r,n]of Object.entries(e??{})){if(!Number.isSafeInteger(n)||Number(n)<1)throw new S("SECURITY_CONTRACT_INVALID",`${r} must be a positive safe integer`);Object.assign(t,{[r]:n})}return t}function at(e){return Array.isArray(e)?e.map(at):!e||typeof e!="object"?e:Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>[t,at(r)]))}function or(e){return typeof e=="string"&&e.includes("T")&&Number.isFinite(Date.parse(e))}var Fo=/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$/,cr=1048576;function fr(e){(!e||typeof e!="object")&&$("Automation request must be an object"),e.protocolVersion!==1&&$("Unsupported automation protocol version"),ne(e.operationId,"operationId"),ne(e.idempotencyKey,"idempotencyKey"),ne(e.capabilityLeaseId,"capabilityLeaseId"),ne(e.governingToolName,"governingToolName"),(!Number.isSafeInteger(e.expectedLeaseVersion)||e.expectedLeaseVersion<1)&&$("expectedLeaseVersion must be a positive safe integer"),hr(e.requestedAt)||$("requestedAt must be an ISO 8601 timestamp"),Ye(e.operation)||$(`Unsupported automation operation: ${e.operation}`),(!e.parameters||typeof e.parameters!="object"||Array.isArray(e.parameters))&&$("parameters must be a JSON object");let t;try{t=Buffer.byteLength(JSON.stringify(e.parameters),"utf8")}catch(r){throw new l("AUTOMATION_REQUEST_INVALID","parameters must be serializable JSON",void 0,{cause:r})}if(t>cr&&$(`parameters exceed ${cr} bytes`),ne(e.identity?.runId,"identity.runId"),ne(e.identity?.agentId,"identity.agentId"),st(e.executionContract),Vo(e),!e.executionContract.capabilityLeaseIds.includes(e.capabilityLeaseId))throw new l("AUTOMATION_CONTRACT_INVALID",`Capability lease ${e.capabilityLeaseId} is not bound to the execution contract`);if(e.executionContract.expiresAt&&Date.parse(e.executionContract.expiresAt)<=Date.now())throw new l("AUTOMATION_CONTRACT_EXPIRED","Execution contract has expired")}function _e(e){(!e||typeof e!="object")&&L("Adapter manifest must be an object"),e.protocolVersion!==1&&L("Adapter protocol version is unsupported"),Re(e.adapterId,"adapterId"),Re(e.adapterVersion,"adapterVersion"),Re(e.platform,"platform"),Re(e.architecture,"architecture"),e.targetBinding!=="atomic-preflight"&&L("Adapter must implement atomic preflight target binding"),(!Array.isArray(e.operations)||e.operations.length===0)&&L("Adapter must declare operations");let t=new Set;for(let r of e.operations)Ye(r)||L(`Adapter declares unknown operation ${r}`),t.has(r)&&L(`Adapter declares duplicate operation ${r}`),t.add(r);e.certified&&!e.certificationArtifactId&&L("A certified automation adapter requires a certification artifact"),Array.isArray(e.limitations)||L("Adapter limitations must be an array"),e.operations.some(r=>r.startsWith("browser."))&&(!e.policyEnforcement.domain||!e.policyEnforcement.scheme||!e.policyEnforcement.port)&&L("Browser adapters must enforce domain, scheme, and port policy"),e.operations.some(r=>r.startsWith("computer."))&&!e.supports.immediateStop&&L("Computer-use adapters must support immediate stop")}function dt(e,t,r){let n=X(e.operation);if(!t.operations.includes(e.operation))throw new l("AUTOMATION_OPERATION_UNSUPPORTED",`Adapter ${t.adapterId} does not support ${e.operation}`);if(n.surface==="browser"){let o=e.executionContract.browser.mode;if(o==="none"||n.effect==="act"&&o!=="act")throw new l("AUTOMATION_POLICY_DENIED",`Execution contract denies ${e.operation}`);if(jo(e,r,n.effect==="act"),e.operation==="browser.download"&&e.executionContract.browser.downloads==="deny")throw new l("AUTOMATION_POLICY_DENIED","Execution contract denies browser downloads");if(e.operation==="browser.upload"&&e.executionContract.browser.uploads==="deny")throw new l("AUTOMATION_POLICY_DENIED","Execution contract denies browser uploads");if(e.operation.startsWith("browser.record.")&&e.executionContract.browser.recording!=="bounded")throw new l("AUTOMATION_POLICY_DENIED","Execution contract denies browser recording")}else{let o=e.executionContract.computer.mode;if(o==="none"||n.effect==="act"&&o!=="act")throw new l("AUTOMATION_POLICY_DENIED",`Execution contract denies ${e.operation}`);let i=e.executionContract.computer.allowedApplications,a=e.operation==="computer.launch"?Go(e):r.applicationId??e.declaredTarget?.applicationId;if((e.operation==="computer.launch"||i.length>0)&&(!a||!i.includes(a)))throw new l("AUTOMATION_POLICY_DENIED",`Application ${a??"<unknown>"} is not allowed`)}}function mr(e,t){let r=X(e.operation),n=r.surface==="browser"?r.effect==="act"?"browser-act":"browser-read":r.effect==="act"?"computer-act":"computer-observe";return{subject:{runId:e.identity.runId,agentId:e.identity.agentId,...e.identity.turnId?{turnId:e.identity.turnId}:{},toolName:e.governingToolName,operationId:e.operationId},kind:n,operation:e.operation,...dr(e,t)?{resource:dr(e,t)}:{},...ur(t)?{destination:ur(t)}:{}}}function dr(e,t){return e.declaredTarget?.resource??Ho(t)}function gr(e){let t=X(e.operation).evidence,r=e.evidencePolicy??{},n=ct(t.before,r.before),o=ct(t.after,r.after),i=ct(t.recording,r.recording),a=r.retainUntil;return a&&!hr(a)&&$("evidencePolicy.retainUntil must be an ISO 8601 timestamp"),{before:n,after:o,recording:i,sensitivity:r.sensitivity??"confidential",...a?{retainUntil:a}:{},...r.legalHold!==void 0?{legalHold:r.legalHold}:{}}}function Vo(e){let t=e.executionContract.identity,r=["runId","agentId","sessionId","turnId","taskId","workspaceId"];for(let n of r){let o=t[n],i=e.identity[n];if(o!==void 0&&o!==i)throw new l("AUTOMATION_IDENTITY_MISMATCH",`Automation identity ${n} does not match the execution contract`)}}function jo(e,t,r){let n=t.url??t.origin??e.declaredTarget?.url??e.declaredTarget?.origin;if(!n){if(["browser.tabs.list","browser.wait"].includes(e.operation))return;throw new l("AUTOMATION_PREFLIGHT_INVALID","Browser preflight did not bind an effective URL")}let o;try{o=new URL(n)}catch{throw new l("AUTOMATION_POLICY_DENIED","Browser target URL is invalid")}if(o.username||o.password)throw new l("AUTOMATION_POLICY_DENIED","Browser target URLs cannot contain credentials");let i=o.protocol.replace(/:$/,"");i!=="http"&&i!=="https"&&K(`Browser scheme ${o.protocol} is not supported`);let a=i,s=o.hostname.toLowerCase().replace(/\.$/,""),c=o.port?Number(o.port):a==="https"?443:80,d=e.executionContract.browser,A=Wo(s);if(pr(s,d.deniedDomains)&&K(`Browser domain ${s} is denied`),lr(o,e.executionContract.network.denyDestinations)&&K(`Network policy explicitly denies ${a}://${s}:${c}`),A&&d.allowLoopbackDevelopment)return;d.allowedSchemes.includes(a)||K(`Browser scheme ${o.protocol} is not allowed`),d.allowedPorts.includes(c)||K(`Browser port ${c} is not allowed`);let y=r?d.actAllowedDomains:d.readAllowedDomains;pr(s,y)||K(`Browser domain ${s} is outside the ${r?"action":"read"} allowlist`),e.executionContract.network.default==="deny"&&(lr(o,e.executionContract.network.allowDestinations)||K(`Network policy does not allow ${a}://${s}:${c}`))}function lr(e,t){let r=e.protocol.replace(/:$/,""),n=e.hostname.toLowerCase().replace(/\.$/,""),o=e.port?Number(e.port):r==="https"?443:80;return t.some(i=>{let a=i.scheme?.replace(/^custom:/,"");return i.host===n&&(i.port===void 0||i.port===o)&&(a===void 0||a===r)})}function Ho(e){return e.resource??e.tabId??e.pageId??e.deviceId??e.applicationId}function ur(e){let t=e.origin??e.url;if(!t)return e.domain;try{return new URL(t).origin}catch{return t}}function Go(e){let t=e.parameters.target,r=t&&typeof t=="object"&&!Array.isArray(t)?t.app_id:void 0,n=e.parameters.applicationId??r??e.declaredTarget?.applicationId;return typeof n=="string"&&n.length>0?n:void 0}function pr(e,t){return t.some(r=>{let n=r.toLowerCase();if(n.startsWith(".")){let o=n.slice(1);return e===o||e.endsWith(`.${o}`)}return e===n})}function Wo(e){return e==="localhost"||e==="127.0.0.1"||e==="[::1]"||e==="::1"}function ct(e,t){let r={disabled:0,optional:1,required:2};return!t||r[t]<=r[e]?e:t}function ne(e,t){(typeof e!="string"||!Fo.test(e))&&$(`${t} is invalid`)}function Re(e,t){(typeof e!="string"||e.trim().length===0||e.length>256)&&L(`${t} is invalid`)}function hr(e){return typeof e=="string"&&e.includes("T")&&Number.isFinite(Date.parse(e))}function K(e){throw new l("AUTOMATION_POLICY_DENIED",e)}function $(e){throw new l("AUTOMATION_REQUEST_INVALID",e)}function L(e){throw new l("AUTOMATION_OPERATION_UNSUPPORTED",e)}import{createHash as ui}from"node:crypto";var Ar=["plan","requirements","design","task-graph","patch","diff","file","document","diagram","screenshot","recording","browser-snapshot","test-report","review-report","security-report","performance-report","release-report","sbom","provenance","attestation","page"],yr=["draft","pending_review","approved","rejected","superseded","archived"],Ir=["public","internal","confidential","restricted"],wr=["agent","tool","user","system","integration"],br=["requirement","design-decision","risk","task","agent","run","tool-call","edit","commit","test-case","test-run","finding","approval","artifact","release","claim"],Er=["decomposes","depends_on","implements","changes","tests","verifies","finds","fixes","reviews","approves","rejects","supersedes","derived_from","produced_by","supports_claim","contradicts_claim","released_as"];import{Buffer as vr}from"node:buffer";import{createHash as Jo}from"node:crypto";function Y(e){return{algorithm:"sha256",value:Jo("sha256").update(e).digest("hex")}}var qo=/^[a-z0-9][a-z0-9._/-]{0,127}$/,Oe="custom:";function he(e,t=Oe){return e.startsWith(t)?qo.test(e.slice(t.length)):!1}var oe=class extends Error{code="ARTIFACT_INVALID";issues;constructor(t,r){super(t),this.name="XenoArtifactValidationError",this.issues=r.map(n=>({...n}))}},lt=class extends Error{constructor(r,n){super(`Artifact state cannot transition from ${r} to ${n}`);this.fromState=r;this.toState=n;this.name="XenoArtifactStateTransitionError"}fromState;toState;code="ARTIFACT_STATE_TRANSITION_INVALID"},zo={draft:["pending_review","superseded","archived"],pending_review:["approved","rejected","superseded","archived"],approved:["superseded","archived"],rejected:["superseded","archived"],superseded:["archived"],archived:[]},Ko="[\\u0000-\\u001f\\u007f]",Yo=new RegExp(Ko),Sr=/^[a-f0-9]{64}$/,Zo=/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/,Qo=new Set(yr),ei=new Set(Ir),ti=new Set(wr),ri=new Set(Ar),ni=new Set(br),oi=new Set(Er);function u(e,t,r,n){e.push({path:t,code:r,message:n})}function f(e,t,r,n=1024){return typeof e!="string"||e.trim().length===0?(u(r,t,"required_string","Value must be a non-empty string"),!1):(e.length>n&&u(r,t,"string_too_long",`Value must not exceed ${n} characters`),Yo.test(e)&&u(r,t,"control_character","Value must not contain control characters"),!0)}function Ae(e,t,r){e!==void 0&&(!Number.isFinite(Date.parse(e))||!e.includes("T"))&&u(r,t,"invalid_timestamp","Value must be an ISO 8601 timestamp")}function Z(e,t,r,n){typeof e=="string"&&e.startsWith(t)&&(he(e,t)||u(n,r,"invalid_custom_name",`Custom name after ${t} is invalid`))}function Tr(e,t,r){if(!e||typeof e!="object"){u(r,t,"missing_actor","Actor is required");return}f(e.kind,`${t}.kind`,r,64),ti.has(e.kind)||u(r,`${t}.kind`,"unknown_actor_kind","Actor kind is not supported"),f(e.id,`${t}.id`,r,512),e?.displayName!==void 0&&f(e.displayName,`${t}.displayName`,r,512),e?.profileFingerprint!==void 0&&!/^[a-f0-9]{64}$/.test(e.profileFingerprint)&&u(r,`${t}.profileFingerprint`,"invalid_fingerprint","Profile fingerprint must be 64 lowercase hexadecimal characters")}function ut(e,t,r){if(!e||typeof e!="object"){u(r,t,"invalid_anchor","Anchor must be an object");return}switch(e.kind){case"file":f(e.path,`${t}.path`,r,4096);break;case"source-line":f(e.path,`${t}.path`,r,4096),(!Number.isInteger(e.startLine)||e.startLine<1)&&u(r,`${t}.startLine`,"invalid_line","startLine must be a positive integer"),e.endLine!==void 0&&(!Number.isInteger(e.endLine)||e.endLine<e.startLine)&&u(r,`${t}.endLine`,"invalid_line_range","endLine must be greater than or equal to startLine");break;case"diff-hunk":f(e.path,`${t}.path`,r,4096),f(e.hunkId,`${t}.hunkId`,r,512);break;case"symbol":f(e.path,`${t}.path`,r,4096),f(e.symbol,`${t}.symbol`,r,1024);break;case"dom-node":f(e.pageId,`${t}.pageId`,r,512),!e.selector&&!e.accessibilityId&&!e.snapshotArtifactId&&u(r,t,"missing_dom_locator","DOM anchors require a selector, accessibility ID, or snapshot artifact ID");break;case"timeline":f(e.recordingArtifactId,`${t}.recordingArtifactId`,r,512),(!Number.isFinite(e.startMs)||e.startMs<0)&&u(r,`${t}.startMs`,"invalid_time","startMs must be a non-negative finite number"),e.endMs!==void 0&&(!Number.isFinite(e.endMs)||e.endMs<e.startMs)&&u(r,`${t}.endMs`,"invalid_time_range","endMs must be greater than or equal to startMs");break;case"region":f(e.mediaArtifactId,`${t}.mediaArtifactId`,r,512),[e.x,e.y,e.width,e.height].every(Number.isFinite)?(e.width<=0||e.height<=0)&&u(r,t,"invalid_region_size","Region width and height must be positive"):u(r,t,"invalid_region","Region coordinates must be finite numbers");break;case"artifact":f(e.artifactId,`${t}.artifactId`,r,512);break;default:typeof e.kind!="string"||!e.kind.startsWith("custom:")?u(r,`${t}.kind`,"unknown_anchor","Anchor kind is not supported"):Z(e.kind,"custom:",`${t}.kind`,r)}}function ye(e,t,r,n){if(!(e===null||typeof e=="string"||typeof e=="boolean")){if(typeof e=="number"){Number.isFinite(e)||u(r,t,"non_finite_number","JSON numbers must be finite");return}if(typeof e!="object"){u(r,t,"non_json_value","Value must be JSON-serializable");return}if(n.has(e)){u(r,t,"cyclic_value","Value must not contain cycles");return}if(n.add(e),Array.isArray(e))e.forEach((o,i)=>ye(o,`${t}[${i}]`,r,n));else for(let[o,i]of Object.entries(e))i===void 0?u(r,`${t}.${o}`,"undefined_value","Undefined is not valid JSON"):ye(i,`${t}.${o}`,r,n);n.delete(e)}}function ii(e){let t=[];if(!e||typeof e!="object")return[{path:"$",code:"invalid_artifact",message:"Artifact must be an object"}];if(e.schemaVersion!==1&&u(t,"schemaVersion","unsupported_schema",`schemaVersion must be ${1}`),f(e.artifactId,"artifactId",t,512),(!Number.isInteger(e.revision)||e.revision<1)&&u(t,"revision","invalid_revision","revision must be a positive integer"),f(e.kind,"kind",t,160),typeof e.kind=="string"&&!ri.has(e.kind)&&!e.kind.startsWith("custom:")&&u(t,"kind","unknown_artifact_kind","Artifact kind is not supported"),Z(e.kind,"custom:","kind",t),f(e.title,"title",t,1024),e.description!==void 0&&f(e.description,"description",t,32768),f(e.state,"state",t,64),Qo.has(e.state)||u(t,"state","unknown_state","Artifact state is not supported"),f(e.createdAt,"createdAt",t,128),Ae(e.createdAt,"createdAt",t),Ae(e.updatedAt,"updatedAt",t),e.updatedAt&&Number.isFinite(Date.parse(e.createdAt))&&Date.parse(e.updatedAt)<Date.parse(e.createdAt)&&u(t,"updatedAt","timestamp_order","updatedAt must not precede createdAt"),f(e.mediaType,"mediaType",t,255),f(e.sensitivity,"sensitivity",t,64),ei.has(e.sensitivity)||u(t,"sensitivity","unknown_sensitivity","Sensitivity is not supported"),e.identity)for(let[n,o]of Object.entries(e.identity))o!==void 0&&f(o,`identity.${n}`,t,512);if(!e.content||typeof e.content!="object")u(t,"content","missing_content","content descriptor is required");else{!e.content.hash||typeof e.content.hash!="object"?u(t,"content.hash","missing_hash","content hash is required"):(f(e.content.hash.algorithm,"content.hash.algorithm",t,128),Z(e.content.hash.algorithm,"custom:","content.hash.algorithm",t),typeof e.content.hash.algorithm=="string"&&e.content.hash.algorithm!=="sha256"&&!e.content.hash.algorithm.startsWith("custom:")&&u(t,"content.hash.algorithm","unknown_hash_algorithm","Hash algorithm is not supported"),f(e.content.hash.value,"content.hash.value",t,512),e.content.hash.algorithm==="sha256"&&!Sr.test(e.content.hash.value)&&u(t,"content.hash.value","invalid_sha256","SHA-256 hash must be 64 lowercase hexadecimal characters")),(!Number.isSafeInteger(e.content.sizeBytes)||e.content.sizeBytes<0)&&u(t,"content.sizeBytes","invalid_size","sizeBytes must be a non-negative safe integer");let n=e.content.storage;if(!n||typeof n!="object")u(t,"content.storage","missing_storage","storage reference is required");else if(n.type==="inline")if(n.text===void 0==(n.base64===void 0))u(t,"content.storage","invalid_inline_storage","Inline storage requires exactly one of text or base64");else{let o;n.text!==void 0?o=vr.from(n.text,"utf8"):n.base64!==void 0&&(Zo.test(n.base64)?o=vr.from(n.base64,"base64"):u(t,"content.storage.base64","invalid_base64","Inline base64 content is malformed")),o&&e.content.sizeBytes!==o.byteLength&&u(t,"content.sizeBytes","content_size_mismatch","sizeBytes does not match inline content"),o&&e.content.hash.algorithm==="sha256"&&Y(o).value!==e.content.hash.value&&u(t,"content.hash.value","content_hash_mismatch","Hash does not match inline content")}else n.type==="file"?f(n.path,"content.storage.path",t,4096):n.type==="blob"?f(n.uri,"content.storage.uri",t,8192):n.type==="git"?(f(n.commit,"content.storage.commit",t,512),f(n.path,"content.storage.path",t,4096)):n.type==="url"?(f(n.url,"content.storage.url",t,8192),Ae(n.expiresAt,"content.storage.expiresAt",t)):n.type==="external"?(f(n.provider,"content.storage.provider",t,255),f(n.locator,"content.storage.locator",t,8192)):u(t,"content.storage.type","unknown_storage","Storage type is not supported");e.content.encoding!==void 0&&(typeof e.content.encoding!="string"||e.content.encoding!=="utf8"&&e.content.encoding!=="base64"&&e.content.encoding!=="binary"&&!e.content.encoding.startsWith("custom:"))&&u(t,"content.encoding","unknown_encoding","Content encoding is not supported"),Z(e.content.encoding,"custom:","content.encoding",t)}!e.provenance||typeof e.provenance!="object"?u(t,"provenance","missing_provenance","provenance is required"):(Tr(e.provenance.producer,"provenance.producer",t),e.provenance.capabilityLeaseIds?.forEach((n,o)=>f(n,`provenance.capabilityLeaseIds[${o}]`,t,512)),e.provenance.sourceArtifactIds?.forEach((n,o)=>f(n,`provenance.sourceArtifactIds[${o}]`,t,512)),e.provenance.attributes&&ye(e.provenance.attributes,"provenance.attributes",t,new Set));let r=new Set;return e.relationships?.forEach((n,o)=>{let i=`relationships[${o}]`;f(n.relation,`${i}.relation`,t,160),typeof n.relation=="string"&&!oi.has(n.relation)&&!n.relation.startsWith("custom:")&&u(t,`${i}.relation`,"unknown_relationship","Relationship type is not supported"),Z(n.relation,"custom:",`${i}.relation`,t),f(n.target?.type,`${i}.target.type`,t,160),typeof n.target?.type=="string"&&!ni.has(n.target.type)&&!n.target.type.startsWith("custom:")&&u(t,`${i}.target.type`,"unknown_reference_type","Evidence reference type is not supported"),Z(n.target?.type,"custom:",`${i}.target.type`,t),f(n.target?.id,`${i}.target.id`,t,512);let a=`${n.relation}:${n.target?.type}:${n.target?.id}:${n.target?.revision??""}`;r.has(a)&&u(t,i,"duplicate_relationship","Duplicate relationship"),r.add(a),n.attributes&&ye(n.attributes,`${i}.attributes`,t,new Set)}),e.anchors?.forEach((n,o)=>ut(n,`anchors[${o}]`,t)),e.revision===1&&e.predecessorRevision!==void 0&&u(t,"predecessorRevision","unexpected_predecessor","First revision cannot have a predecessor"),e.revision>1&&(!Number.isInteger(e.predecessorRevision)||(e.predecessorRevision??0)>=e.revision)&&u(t,"predecessorRevision","invalid_predecessor","Later revisions require an earlier predecessor revision"),Ae(e.retention?.retainUntil,"retention.retainUntil",t),e.retention?.legalHold!==void 0&&typeof e.retention.legalHold!="boolean"&&u(t,"retention.legalHold","invalid_boolean","legalHold must be a boolean"),e.extensions&&ye(e.extensions,"extensions",t,new Set),t}function Ne(e){let t=ii(e);if(t.length>0)throw new oe("XENO artifact validation failed",t)}function ai(e,t){return zo[e].includes(t)}function ke(e,t){if(!ai(e,t))throw new lt(e,t)}function pt(e,t){let r=[];return e.schemaVersion!==1&&u(r,"schemaVersion","unsupported_schema",`schemaVersion must be ${1}`),f(e.eventId,"eventId",r,512),f(e.artifactId,"artifactId",r,512),(!Number.isInteger(e.artifactRevision)||e.artifactRevision<1)&&u(r,"artifactRevision","invalid_revision","artifactRevision must be a positive integer"),(!Number.isInteger(e.sequence)||e.sequence<1)&&u(r,"sequence","invalid_sequence","sequence must be a positive integer"),f(e.recordedAt,"recordedAt",r,128),Ae(e.recordedAt,"recordedAt",r),Tr(e.actor,"actor",r),!e.artifactHash||typeof e.artifactHash!="object"?u(r,"artifactHash","missing_hash","Artifact hash is required"):(f(e.artifactHash.algorithm,"artifactHash.algorithm",r,128),Z(e.artifactHash.algorithm,"custom:","artifactHash.algorithm",r),f(e.artifactHash.value,"artifactHash.value",r,512),e.artifactHash.algorithm==="sha256"&&!Sr.test(e.artifactHash.value)&&u(r,"artifactHash.value","invalid_sha256","SHA-256 hash must be 64 lowercase hexadecimal characters"),typeof e.artifactHash.algorithm=="string"&&e.artifactHash.algorithm!=="sha256"&&!e.artifactHash.algorithm.startsWith("custom:")&&u(r,"artifactHash.algorithm","unknown_hash_algorithm","Hash algorithm is not supported")),["review-requested","comment-added","comment-resolved","comment-reopened","decision-recorded","review-withdrawn"].includes(e.type)||u(r,"type","unknown_review_event","Review event type is not supported"),e.type==="comment-added"?(f(e.commentId,"commentId",r,512),f(e.body,"body",r,65536),e.anchor&&ut(e.anchor,"anchor",r)):e.type==="comment-resolved"||e.type==="comment-reopened"?f(e.commentId,"commentId",r,512):e.type==="decision-recorded"&&(["approved","rejected","changes_requested"].includes(e.decision)||u(r,"decision","unknown_review_decision","Review decision is not supported"),e.scope&&ut(e.scope,"scope",r)),t&&(e.artifactId!==t.artifactId&&u(r,"artifactId","artifact_mismatch","Review event targets a different artifact"),e.artifactRevision!==t.revision&&u(r,"artifactRevision","revision_mismatch","Review event targets a different revision"),e.artifactHash&&(e.artifactHash.algorithm!==t.content.hash.algorithm||e.artifactHash.value!==t.content.hash.value)&&u(r,"artifactHash","hash_mismatch","Review event hash does not match the artifact revision")),r}function ft(e){let t="not_requested",r,n,o,i=0,a=new Set,s=new Set;for(let c of[...e].sort((d,A)=>d.sequence-A.sequence))o=c.recordedAt,c.type==="review-requested"?t="pending":c.type==="review-withdrawn"?t="withdrawn":c.type==="comment-added"?(a.add(c.commentId),s.delete(c.commentId),t==="not_requested"&&(t="pending")):c.type==="comment-resolved"?s.add(c.commentId):c.type==="comment-reopened"?s.delete(c.commentId):c.type==="decision-recorded"&&(c.scope?i+=1:(r=c.decision,n=c.eventId,t=c.decision));return{status:t,totalComments:a.size,unresolvedComments:[...a].filter(c=>!s.has(c)).length,...r?{latestDecision:r}:{},...n?{latestDecisionEventId:n}:{},...i>0?{scopedDecisionCount:i}:{},...o?{lastReviewedAt:o}:{}}}var p=class extends Error{constructor(r,n,o,i){super(n,i);this.code=r;this.detail=o;this.name="XenoArtifactRepositoryError"}code;detail},we=class{records=new Map;currentRevisions=new Map;now;idFactory;eventIds=new Set;idCounter=0;constructor(t={}){this.now=t.now??(()=>new Date().toISOString()),this.idFactory=t.idFactory??(r=>(this.idCounter+=1,`${r}_${Date.now().toString(36)}_${this.idCounter.toString(36)}`)),t.initialState&&this.hydrate(t.initialState)}exportState(){let t=[...this.records.values()].flatMap(r=>[...r.values()]).sort(Cr).map(r=>({artifact:Ie(r.artifact),recordVersion:r.recordVersion,lifecycleEvents:structuredClone(r.lifecycleEvents),reviewEvents:structuredClone(r.reviewEvents)}));return{schemaVersion:1,records:t}}async create(t){if(Ne(t),this.assertInitialState(t),t.revision!==1)throw new p("ARTIFACT_REVISION_INVALID","A new artifact must begin at revision 1",{artifactId:t.artifactId,revision:t.revision});if(this.records.has(t.artifactId))throw new p("ARTIFACT_ALREADY_EXISTS",`Artifact ${t.artifactId} already exists`,{artifactId:t.artifactId});let r=Ie(t),n=this.createLifecycleEvent({artifact:r,sequence:1,actor:r.provenance.producer,fromState:null,toState:r.state,reason:"artifact-created"}),o={artifact:r,recordVersion:1,lifecycleEvents:[n],reviewEvents:[]};return this.records.set(r.artifactId,new Map([[r.revision,o]])),this.currentRevisions.set(r.artifactId,r.revision),Q(o)}async createRevision(t,r={}){Ne(t),this.assertInitialState(t);let n=this.getMutable(t.artifactId);this.assertVersion(n,r.expectedRecordVersion);let o=n.artifact.revision+1;if(t.revision!==o||t.predecessorRevision!==n.artifact.revision)throw new p("ARTIFACT_REVISION_INVALID",`Revision ${t.revision} does not follow current revision ${n.artifact.revision}`,{artifactId:t.artifactId,currentRevision:n.artifact.revision,requestedRevision:t.revision});if(ci(t,n.artifact))throw new p("ARTIFACT_CONTENT_UNCHANGED","A new artifact revision must have a different content hash",{artifactId:t.artifactId,revision:t.revision});if(n.artifact.state==="archived")throw new p("ARTIFACT_REVISION_INVALID","Archived artifacts cannot receive new revisions",{artifactId:t.artifactId,revision:n.artifact.revision});if(n.artifact.state!=="superseded"){ke(n.artifact.state,"superseded");let c=this.now(),d=this.createLifecycleEvent({artifact:n.artifact,sequence:n.lifecycleEvents.length+1,actor:r.actor??t.provenance.producer,fromState:n.artifact.state,toState:"superseded",reason:r.reason??`superseded-by-revision-${t.revision}`,recordedAt:c});n.artifact.state="superseded",n.artifact.updatedAt=c,n.lifecycleEvents.push(d),n.recordVersion+=1}let i=Ie(t),a=this.createLifecycleEvent({artifact:i,sequence:1,actor:r.actor??i.provenance.producer,fromState:null,toState:i.state,reason:r.reason??`revision-created-from-${n.artifact.revision}`}),s={artifact:i,recordVersion:1,lifecycleEvents:[a],reviewEvents:[]};return this.records.get(i.artifactId)?.set(i.revision,s),this.currentRevisions.set(i.artifactId,i.revision),Q(s)}async get(t,r){let n=this.records.get(t);if(!n)return;let o=r??this.currentRevisions.get(t);if(o===void 0)return;let i=n.get(o);return i?Q(i):void 0}async require(t,r){let n=await this.get(t,r);if(!n)throw new p("ARTIFACT_NOT_FOUND",`Artifact ${t}${r===void 0?"":` revision ${r}`} was not found`,{artifactId:t,...r===void 0?{}:{revision:r}});return n}async list(t={}){let r=[];for(let[n,o]of this.records)if(!(t.artifactIds&&!t.artifactIds.includes(n)))if(t.includeSuperseded)r.push(...o.values());else{let i=this.currentRevisions.get(n);if(i!==void 0){let a=o.get(i);a&&r.push(a)}}return r.filter(n=>di(n.artifact,t)).sort(Cr).map(Q)}async listRevisions(t){let r=this.records.get(t);return r?[...r.values()].sort((n,o)=>n.artifact.revision-o.artifact.revision).map(Q):[]}async transition(t){let r=this.getMutable(t.artifactId,t.revision);if(this.assertVersion(r,t.expectedRecordVersion),ke(r.artifact.state,t.toState),t.toState==="approved"||t.toState==="rejected"){let a=t.reviewEventId?r.reviewEvents.find(c=>c.eventId===t.reviewEventId&&c.type==="decision-recorded"):void 0,s=ft(r.reviewEvents);if(!a||a.decision!==t.toState||s.latestDecisionEventId!==a.eventId)throw new p("ARTIFACT_REVIEW_DECISION_REQUIRED",`Transition to ${t.toState} requires a matching decision event`,{artifactId:t.artifactId,revision:r.artifact.revision});if(t.toState==="approved"&&s.unresolvedComments>0)throw new p("ARTIFACT_UNRESOLVED_COMMENTS",`Artifact has ${s.unresolvedComments} unresolved review comment(s)`,{artifactId:t.artifactId,revision:r.artifact.revision,unresolvedComments:s.unresolvedComments})}let n=this.now(),o=r.artifact.state,i=this.createLifecycleEvent({artifact:r.artifact,sequence:r.lifecycleEvents.length+1,actor:t.actor,fromState:o,toState:t.toState,reason:t.reason,reviewEventId:t.reviewEventId,recordedAt:n});return r.artifact.state=t.toState,r.artifact.updatedAt=n,r.lifecycleEvents.push(i),r.recordVersion+=1,Q(r)}async appendReviewEvent(t){let r=t.event,n=this.getMutable(r.artifactId,r.artifactRevision);if(this.assertVersion(n,t.expectedRecordVersion),n.artifact.state==="archived"||n.artifact.state==="superseded")throw new p("ARTIFACT_REVIEW_INVALID",`Cannot append review events to a ${n.artifact.state} artifact revision`,{artifactId:r.artifactId,revision:r.artifactRevision});if(this.assertReviewCommentState(n,r),(r.type==="review-requested"||r.type==="review-withdrawn"||r.type==="decision-recorded")&&n.artifact.state!=="pending_review")throw new p("ARTIFACT_REVIEW_INVALID",`${r.type} requires an artifact in pending_review state`,{artifactId:r.artifactId,revision:r.artifactRevision});let o={...structuredClone(r),schemaVersion:1,eventId:this.nextEventId("review_event"),sequence:n.reviewEvents.length+1,recordedAt:this.now()},i=pt(o,n.artifact);if(i.length>0)throw new oe("XENO artifact review event validation failed",i);return n.reviewEvents.push(o),n.recordVersion+=1,Q(n)}getMutable(t,r){let n=this.records.get(t),o=r??this.currentRevisions.get(t),i=o===void 0?void 0:n?.get(o);if(!i)throw new p("ARTIFACT_NOT_FOUND",`Artifact ${t}${r===void 0?"":` revision ${r}`} was not found`,{artifactId:t,...r===void 0?{}:{revision:r}});return i}assertVersion(t,r){if(r!==void 0&&r!==t.recordVersion)throw new p("ARTIFACT_CONFLICT",`Expected record version ${r}, found ${t.recordVersion}`,{artifactId:t.artifact.artifactId,revision:t.artifact.revision,expectedRecordVersion:r,actualRecordVersion:t.recordVersion})}assertInitialState(t){if(t.state!=="draft"&&t.state!=="pending_review")throw new p("ARTIFACT_REVISION_INVALID","New artifact revisions must begin in draft or pending_review state",{artifactId:t.artifactId,revision:t.revision})}assertReviewCommentState(t,r){if(r.type==="comment-added"){if(t.reviewEvents.some(i=>i.type==="comment-added"&&i.commentId===r.commentId))throw new p("ARTIFACT_REVIEW_INVALID",`Comment ${r.commentId} already exists`);if(r.parentCommentId&&!t.reviewEvents.some(i=>i.type==="comment-added"&&i.commentId===r.parentCommentId))throw new p("ARTIFACT_REVIEW_INVALID",`Parent comment ${r.parentCommentId} does not exist`);return}if(r.type!=="comment-resolved"&&r.type!=="comment-reopened")return;if(!t.reviewEvents.some(i=>i.type==="comment-added"&&i.commentId===r.commentId))throw new p("ARTIFACT_REVIEW_INVALID",`Comment ${r.commentId} does not exist`);let o=li(t.reviewEvents,r.commentId);if(r.type==="comment-resolved"&&o.resolved)throw new p("ARTIFACT_REVIEW_INVALID",`Comment ${r.commentId} is already resolved`);if(r.type==="comment-reopened"&&!o.resolved)throw new p("ARTIFACT_REVIEW_INVALID",`Comment ${r.commentId} is not resolved`)}createLifecycleEvent(t){return{schemaVersion:1,eventId:this.nextEventId("artifact_event"),artifactId:t.artifact.artifactId,revision:t.artifact.revision,sequence:t.sequence,recordedAt:t.recordedAt??this.now(),actor:{...t.actor},fromState:t.fromState,toState:t.toState,...t.reason?{reason:t.reason}:{},...t.reviewEventId?{reviewEventId:t.reviewEventId}:{}}}nextEventId(t){let r=this.idFactory(t);if(typeof r!="string"||r.trim().length===0||this.eventIds.has(r))throw new p("ARTIFACT_CONFLICT",`Event ID factory produced an invalid or duplicate ${t} ID`);return this.eventIds.add(r),r}hydrate(t){if(t.schemaVersion!==1||!Array.isArray(t.records))throw new p("ARTIFACT_REVISION_INVALID","Artifact repository state has an unsupported schema or record collection");let r=[...t.records].sort((n,o)=>n.artifact.artifactId.localeCompare(o.artifact.artifactId)||n.artifact.revision-o.artifact.revision);for(let n of r){let o=si(n,this.eventIds),i=this.records.get(o.artifact.artifactId);if(i||(i=new Map,this.records.set(o.artifact.artifactId,i)),i.has(o.artifact.revision))throw new p("ARTIFACT_REVISION_INVALID",`Duplicate persisted revision ${o.artifact.artifactId}:${o.artifact.revision}`);i.set(o.artifact.revision,o),this.currentRevisions.set(o.artifact.artifactId,o.artifact.revision)}for(let[n,o]of this.records){let i=[...o.values()].sort((a,s)=>a.artifact.revision-s.artifact.revision);for(let a=0;a<i.length;a+=1){let s=i[a],c=a+1;if(s.artifact.revision!==c)throw new p("ARTIFACT_REVISION_INVALID",`Persisted artifact ${n} is missing revision ${c}`);if(a===0&&s.artifact.predecessorRevision!==void 0)throw new p("ARTIFACT_REVISION_INVALID",`Initial revision for ${n} cannot declare a predecessor`);if(a>0&&s.artifact.predecessorRevision!==c-1)throw new p("ARTIFACT_REVISION_INVALID",`Persisted revision ${n}:${c} has an invalid predecessor`);if(a<i.length-1&&s.artifact.state!=="superseded")throw new p("ARTIFACT_REVISION_INVALID",`Non-current revision ${n}:${c} must be superseded`)}}}};function si(e,t){if(Ne(e.artifact),!Number.isInteger(e.recordVersion)||e.recordVersion<1)throw new p("ARTIFACT_REVISION_INVALID","Persisted artifact recordVersion must be a positive integer",{artifactId:e.artifact.artifactId,revision:e.artifact.revision});if(!Array.isArray(e.lifecycleEvents)||e.lifecycleEvents.length===0||!Array.isArray(e.reviewEvents))throw new p("ARTIFACT_REVISION_INVALID","Persisted artifact records require lifecycle and review event arrays",{artifactId:e.artifact.artifactId,revision:e.artifact.revision});let r=e.lifecycleEvents.length+e.reviewEvents.length;if(e.recordVersion!==r)throw new p("ARTIFACT_REVISION_INVALID",`Persisted record version ${e.recordVersion} does not match ${r} mutations`,{artifactId:e.artifact.artifactId,revision:e.artifact.revision});let n=null;for(let i=0;i<e.lifecycleEvents.length;i+=1){let a=e.lifecycleEvents[i];if(a.schemaVersion!==1||a.artifactId!==e.artifact.artifactId||a.revision!==e.artifact.revision||a.sequence!==i+1||a.fromState!==n||typeof a.eventId!="string"||a.eventId.length===0||t.has(a.eventId)||!Number.isFinite(Date.parse(a.recordedAt)))throw new p("ARTIFACT_REVISION_INVALID",`Persisted lifecycle event ${i+1} is invalid`,{artifactId:e.artifact.artifactId,revision:e.artifact.revision});if(n===null){if(a.toState!=="draft"&&a.toState!=="pending_review")throw new p("ARTIFACT_REVISION_INVALID","A persisted artifact must begin in draft or pending_review state",{artifactId:e.artifact.artifactId,revision:e.artifact.revision})}else ke(n,a.toState);t.add(a.eventId),n=a.toState}if(n!==e.artifact.state)throw new p("ARTIFACT_REVISION_INVALID","Persisted artifact state does not match its lifecycle tail",{artifactId:e.artifact.artifactId,revision:e.artifact.revision});let o=new Map;for(let i=0;i<e.reviewEvents.length;i+=1){let a=e.reviewEvents[i];if(a.sequence!==i+1||t.has(a.eventId))throw new p("ARTIFACT_REVIEW_INVALID",`Persisted review event ${i+1} has an invalid sequence or duplicate ID`,{artifactId:e.artifact.artifactId,revision:e.artifact.revision});let s=pt(a,e.artifact);if(s.length>0)throw new oe("Persisted XENO artifact review event validation failed",s);if(a.type==="comment-added"){if(o.has(a.commentId)||a.parentCommentId!==void 0&&!o.has(a.parentCommentId))throw new p("ARTIFACT_REVIEW_INVALID",`Persisted comment ${a.commentId} has an invalid identity or parent`);o.set(a.commentId,!1)}else if(a.type==="comment-resolved"||a.type==="comment-reopened"){let c=o.get(a.commentId);if(c===void 0||a.type==="comment-resolved"&&c||a.type==="comment-reopened"&&!c)throw new p("ARTIFACT_REVIEW_INVALID",`Persisted comment transition for ${a.commentId} is invalid`);o.set(a.commentId,a.type==="comment-resolved")}t.add(a.eventId)}return{artifact:Ie(e.artifact),recordVersion:e.recordVersion,lifecycleEvents:structuredClone(e.lifecycleEvents),reviewEvents:structuredClone(e.reviewEvents)}}function ci(e,t){return e.content.hash.algorithm===t.content.hash.algorithm&&e.content.hash.value===t.content.hash.value}function di(e,t){return!(t.kinds&&!t.kinds.includes(e.kind)||t.states&&!t.states.includes(e.state)||t.runId&&e.identity?.runId!==t.runId||t.sessionId&&e.identity?.sessionId!==t.sessionId||t.turnId&&e.identity?.turnId!==t.turnId||t.taskId&&e.identity?.taskId!==t.taskId||t.workspaceId&&e.identity?.workspaceId!==t.workspaceId||t.repositoryId&&e.identity?.repositoryId!==t.repositoryId||t.producerId&&e.provenance.producer.id!==t.producerId||t.sensitivity&&!t.sensitivity.includes(e.sensitivity))}function Cr(e,t){return e.artifact.createdAt.localeCompare(t.artifact.createdAt)||e.artifact.artifactId.localeCompare(t.artifact.artifactId)||e.artifact.revision-t.artifact.revision}function li(e,t){let r=!1;for(let n of e)(n.type==="comment-resolved"||n.type==="comment-reopened")&&n.commentId===t&&(r=n.type==="comment-resolved");return{resolved:r}}function Ie(e){return structuredClone(e)}function Q(e){return{artifact:Ie(e.artifact),recordVersion:e.recordVersion,etag:`${e.artifact.artifactId}:${e.artifact.revision}:${e.recordVersion}`,lifecycleEvents:structuredClone(e.lifecycleEvents),reviewEvents:structuredClone(e.reviewEvents),reviewSummary:ft(e.reviewEvents)}}var mt=32*1024*1024,pi=1024*1024*1024,fi=/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$/;function gt(e){let r=(e.now??(()=>new Date().toISOString()))(),n=new Set;return e.evidence.map((o,i)=>{if(gi(o),n.has(o.evidenceId))throw new l("AUTOMATION_EVIDENCE_INVALID",`Duplicate evidence ID ${o.evidenceId}`);n.add(o.evidenceId);let a=mi(o),s=ui("sha256").update(`${e.request.operationId}\0${o.evidenceId}\0${a.hash.value}`).digest("hex").slice(0,32);return{schemaVersion:1,artifactId:`automation_${s}`,revision:1,kind:o.kind,title:o.title,...o.description?{description:o.description}:{},state:"draft",createdAt:r,mediaType:o.mediaType,sensitivity:o.sensitivity??e.policy.sensitivity,identity:{...e.request.identity},content:a,provenance:{producer:{kind:"tool",id:e.request.governingToolName,displayName:e.manifest.adapterId,profileFingerprint:e.request.executionContract.profile.fingerprint},operationId:e.request.operationId,executionContractFingerprint:e.request.executionContract.fingerprint,capabilityLeaseIds:[e.request.capabilityLeaseId],attributes:{automationProtocolVersion:e.request.protocolVersion,automationOperation:e.request.operation,automationEvidenceId:o.evidenceId,automationEvidencePhase:o.phase,adapterId:e.manifest.adapterId,adapterVersion:e.manifest.adapterVersion,evidenceIndex:i}},...o.anchors?{anchors:structuredClone(o.anchors)}:{},...e.policy.retainUntil||e.policy.legalHold!==void 0?{retention:{...e.policy.retainUntil?{retainUntil:e.policy.retainUntil}:{},...e.policy.legalHold!==void 0?{legalHold:e.policy.legalHold}:{}}}:{},extensions:{...o.extensions??{},xenoAutomation:{phase:o.phase,adapter:e.manifest.adapterId,certifiedAdapter:e.manifest.certified}}}})}async function be(e,t){if(!e)return t.map(n=>structuredClone(n));let r=[];for(let n of t)try{let o=await e.create(n);r.push(o.artifact)}catch(o){if(o instanceof p&&o.code==="ARTIFACT_ALREADY_EXISTS"){let i=await e.require(n.artifactId,n.revision);if(i.artifact.content.hash.value===n.content.hash.value){r.push(i.artifact);continue}}throw new l("AUTOMATION_EVIDENCE_PERSISTENCE_FAILED",`Failed to persist automation evidence ${n.artifactId}`,{artifactId:n.artifactId},{cause:o})}return r}function Xe(e,t,r){if(t[r]==="required"&&!e.some(n=>n.phase===r))throw new l("AUTOMATION_EVIDENCE_REQUIRED",`Automation operation requires ${r} evidence before it can be trusted`)}function mi(e){if(e.content.type==="text"){let t=Buffer.byteLength(e.content.text,"utf8");return xr(t),{hash:Y(e.content.text),sizeBytes:t,storage:{type:"inline",text:e.content.text},encoding:"utf8",...e.redactedPreview?{redactedPreview:e.redactedPreview}:{}}}if(e.content.type==="base64"){let t=hi(e.content.base64);return xr(t.byteLength),{hash:Y(t),sizeBytes:t.byteLength,storage:{type:"inline",base64:e.content.base64},encoding:"base64",...e.redactedPreview?{redactedPreview:e.redactedPreview}:{}}}if(!Number.isSafeInteger(e.content.sizeBytes)||e.content.sizeBytes<0||e.content.sizeBytes>pi)throw new l("AUTOMATION_EVIDENCE_INVALID","Referenced evidence size is invalid");if(!e.content.hash?.algorithm||!e.content.hash.value)throw new l("AUTOMATION_EVIDENCE_INVALID","Referenced evidence requires a content hash");if(e.content.hash.algorithm==="sha256"&&!/^[a-f0-9]{64}$/.test(e.content.hash.value))throw new l("AUTOMATION_EVIDENCE_INVALID","Referenced evidence SHA-256 is invalid");return{hash:{...e.content.hash},sizeBytes:e.content.sizeBytes,storage:structuredClone(e.content.storage),...e.content.encoding?{encoding:e.content.encoding}:{},...e.redactedPreview?{redactedPreview:e.redactedPreview}:{}}}function gi(e){(!e||typeof e!="object")&&B("Evidence must be an object"),fi.test(e.evidenceId)||B("Evidence ID is invalid"),["before","action","after","recording","diagnostic"].includes(e.phase)||B("Evidence phase is invalid"),(!e.kind||!e.title?.trim()||e.title.length>512)&&B("Evidence kind and title are required"),/^[\w!#$&^_.+-]+\/[\w!#$&^_.+-]+(?:;.*)?$/.test(e.mediaType)||B("Evidence media type is invalid")}function hi(e){(e.length===0||e.length>Math.ceil(mt/3)*4+4)&&B("Inline base64 evidence is empty or too large"),(!/^[A-Za-z0-9+/]*={0,2}$/.test(e)||e.length%4!==0)&&B("Inline evidence is not canonical base64");let t=Buffer.from(e,"base64");return t.toString("base64")!==e&&B("Inline evidence is not canonical base64"),t}function xr(e){e>mt&&B(`Inline evidence exceeds ${mt} bytes`)}function B(e){throw new l("AUTOMATION_EVIDENCE_INVALID",e)}import{createHash as Ii}from"node:crypto";import{createHash as Ai,randomUUID as yi}from"node:crypto";var Pr=16*1024*1024;async function _r(e,t,r,n){await e.assertCurrent(t);let o={operationId:t.operationId,fingerprint:r,ownerToken:yi()},i=await e.journal.begin(o);if(await e.assertCurrent(t),!i.claimed){if(i.record.outcome.kind!=="result")throw H();let m=await e.artifactRepository.require(i.record.outcome.artifactId,1),w=m.artifact;if(w.content.storage.type!=="inline"||w.content.encoding!=="utf8"||w.provenance.operationId!==t.operationId||w.extensions?.automationRequestFingerprint!==r)throw H();let h=w.content.storage.text;if(typeof h!="string"||Buffer.byteLength(h)>Pr||De(h)!==i.record.outcome.sha256||w.content.hash.value!==i.record.outcome.sha256)throw H();let b=JSON.parse(h);return Rr(b,t),await e.assertCurrent(t),{...b,replayed:!0}}let a="automation-consume:"+De(t.operationId+"\0"+r),s=await n(a);Rr(s,t);let c=JSON.stringify(s),d=Buffer.byteLength(c);if(d>Pr)throw H();let A=De(c),y={schemaVersion:1,artifactId:"automation_result_"+De(t.operationId+"\0"+r),revision:1,kind:"custom:automation-result",title:"Governed automation outcome",state:"draft",createdAt:s.completedAt,mediaType:"application/json",sensitivity:"restricted",identity:{...t.identity},content:{hash:{algorithm:"sha256",value:A},sizeBytes:d,encoding:"utf8",storage:{type:"inline",text:c}},provenance:{producer:{kind:"system",id:"xeno-governed-automation"},operationId:t.operationId,executionContractFingerprint:t.executionContract.fingerprint,capabilityLeaseIds:[t.capabilityLeaseId]},extensions:{automationRequestFingerprint:r}};return await e.assertCurrent(t),await be(e.artifactRepository,[y]),await e.journal.finish(o,{kind:"result",artifactId:y.artifactId,sha256:A}),await e.assertCurrent(t),{...s,replayed:!1}}function Rr(e,t){if(!e||typeof e!="object")throw H();let r=e;if(r.operationId!==t.operationId||!["ok","error","cancelled","denied","evidence-incomplete"].includes(r.status)||!r.target||!Array.isArray(r.artifacts)||!r.lease||!r.adapter)throw H()}function De(e){return Ai("sha256").update(e).digest("hex")}function H(){return new l("AUTOMATION_OUTCOME_PENDING","Automation outcome is pending or unknown; recover the same operation rather than dispatching it again")}var Or=3e4,Nr=1e3,Me=class{adapter;leaseAuthority;durable;artifactRepository;now;executions=new Map;active=new Map;constructor(t){if(this.adapter=t.adapter,this.leaseAuthority=t.leaseAuthority,!!t.leaseAuthority==!!t.durable)throw new Error("Choose exactly one legacy or durable automation authority");this.durable=t.durable,this.artifactRepository=t.durable?.artifactRepository??t.artifactRepository,this.now=t.now??(()=>new Date().toISOString())}execute(t,r){t=structuredClone(t);let n=Si(t),o=this.executions.get(t.operationId);if(o){if(o.fingerprint!==n)throw new l("AUTOMATION_OPERATION_CONFLICT",`Operation ${t.operationId} was already submitted with different authority or parameters`);if(this.durable){let c=this.durable;return c.assertCurrent(t).then(()=>o.promise).then(async d=>(await c.assertCurrent(t),structuredClone(d)))}return o.promise}if(this.active.size>=Nr)throw new l("AUTOMATION_OPERATION_CONFLICT","Automation active-operation capacity reached");let i=new AbortController,a=Ti(r,i);this.active.set(t.operationId,i);let s=(this.durable?_r(this.durable,t,n,c=>this.executeFresh(t,i.signal,c)):this.executeFresh(t,i.signal)).finally(()=>{a(),this.active.delete(t.operationId)});return this.executions.set(t.operationId,{fingerprint:n,promise:s}),this.durable&&s.then(()=>this.executions.delete(t.operationId),()=>this.executions.delete(t.operationId)),this.trimIdempotencyRecords(),s}async stop(t,r="human-stop"){let n=this.active.get(t);return n?(n.abort(new Error(r)),await this.adapter.stop?.(t,r),!0):!1}async executeFresh(t,r,n){fr(t),Le(r);let o=await this.adapter.manifest();_e(o);let i=X(t.operation),a=gr(t),s=this.now(),c=await this.adapter.preflight(t,r);wi(c,this.now()),dt(t,o,c.observedTarget),Le(r);let d=c.evidence??[];Xe(d,a,"before");let A=await be(this.artifactRepository,gt({request:t,manifest:o,policy:a,evidence:d,now:this.now}));if(Le(r),Date.parse(c.expiresAt)<=Date.parse(this.now()))throw new l("AUTOMATION_PREFLIGHT_INVALID","Automation preflight expired before authority consumption");let y=mr(t,c.observedTarget),m;if(this.durable){await this.durable.assertCurrent(t);let E=await this.durable.consume(n,t.capabilityLeaseId,t.expectedLeaseVersion,y);if(E.executionDisposition!=="dispatch-once"||E.replayed)throw H();m=E.lease,await this.durable.assertCurrent(t)}else m=await this.leaseAuthority.consume(t.capabilityLeaseId,t.expectedLeaseVersion,y);let w={contractFingerprint:t.executionContract.fingerprint,lease:m,capabilityUse:y},h;try{Le(r),h=await this.adapter.execute(t,c,w,r)}catch(E){return ht({request:t,manifest:o,descriptorEffect:i.effect,target:c.observedTarget,lease:m,artifacts:A,startedAt:s,completedAt:this.now(),status:r.aborted?"cancelled":"error",code:r.aborted?"AUTOMATION_CANCELLED":"AUTOMATION_ADAPTER_ERROR",message:r.aborted?"Automation operation was stopped":Ci(E)})}if(bi(h),h.operationId!==void 0&&h.operationId!==t.operationId)throw new l("AUTOMATION_RESPONSE_INVALID","Adapter returned another operation identity");let b=Ei(c.observedTarget,h.observedTarget),C;try{dt(t,o,h.observedTarget)}catch(E){C=E instanceof Error?E:new Error(String(E))}let O=h.evidence??[];vi(d,O);let D=[],N;try{Xe(O,a,"after"),Xe([...d,...O],a,"recording"),D=await be(this.artifactRepository,gt({request:t,manifest:o,policy:a,evidence:O,now:this.now}))}catch(E){N=E instanceof Error?E:new Error(String(E))}let x=[...A,...D];return b||C?ht({request:t,manifest:o,descriptorEffect:i.effect,target:h.observedTarget,lease:m,artifacts:x,startedAt:h.startedAt,completedAt:h.completedAt,status:"error",code:"AUTOMATION_TARGET_CHANGED",message:b??C.message}):N?ht({request:t,manifest:o,descriptorEffect:i.effect,target:h.observedTarget,lease:m,artifacts:x,startedAt:h.startedAt,completedAt:h.completedAt,status:"evidence-incomplete",code:"AUTOMATION_EVIDENCE_INCOMPLETE",message:N.message}):{operationId:t.operationId,status:h.status,effect:i.effect,startedAt:h.startedAt,completedAt:h.completedAt,adapter:kr(o),target:structuredClone(h.observedTarget),...h.data!==void 0?{data:structuredClone(h.data)}:{},artifacts:x,lease:Xr(m),...h.error?{error:{...h.error}}:{}}}trimIdempotencyRecords(){for(;this.executions.size>Nr;){let t=this.executions.keys().next().value;if(!t||this.active.has(t))break;this.executions.delete(t)}}};function wi(e,t){if(!e||typeof e!="object"||!e.token?.trim())throw new l("AUTOMATION_PREFLIGHT_INVALID","Adapter returned an invalid preflight token");let r=Date.parse(e.preparedAt),n=Date.parse(e.expiresAt),o=Date.parse(t);if(!Number.isFinite(r)||!Number.isFinite(n)||n<=r||n<=o)throw new l("AUTOMATION_PREFLIGHT_INVALID","Adapter returned an expired or invalid preflight window");if(n-r>Or)throw new l("AUTOMATION_PREFLIGHT_INVALID",`Preflight TTL exceeds ${Or} ms`);if(!e.observedTarget||typeof e.observedTarget!="object")throw new l("AUTOMATION_PREFLIGHT_INVALID","Adapter did not bind an observed target")}function bi(e){if(!e||typeof e!="object")throw new l("AUTOMATION_REQUEST_INVALID","Adapter returned no result");if(!["ok","denied","cancelled","error"].includes(e.status))throw new l("AUTOMATION_REQUEST_INVALID","Adapter returned an invalid status");if(!Number.isFinite(Date.parse(e.startedAt))||!Number.isFinite(Date.parse(e.completedAt)))throw new l("AUTOMATION_REQUEST_INVALID","Adapter result timestamps are invalid");if(Date.parse(e.completedAt)<Date.parse(e.startedAt))throw new l("AUTOMATION_REQUEST_INVALID","Adapter completion precedes its start");if(!e.observedTarget||typeof e.observedTarget!="object")throw new l("AUTOMATION_REQUEST_INVALID","Adapter result has no observed target")}function Ei(e,t){let r=["tabId","deviceId","displayId"];for(let n of r)if(e[n]!==void 0&&e[n]!==t[n])return`Adapter changed bound ${n} between preflight and execution`}function vi(e,t){let r=new Set(e.map(n=>n.evidenceId));for(let n of t){if(r.has(n.evidenceId))throw new l("AUTOMATION_EVIDENCE_INVALID",`Duplicate evidence ID ${n.evidenceId}`);r.add(n.evidenceId)}}function ht(e){return{operationId:e.request.operationId,status:e.status,effect:e.descriptorEffect,startedAt:e.startedAt,completedAt:e.completedAt,adapter:kr(e.manifest),target:structuredClone(e.target),artifacts:e.artifacts,lease:Xr(e.lease),error:{code:e.code,message:e.message}}}function kr(e){return{adapterId:e.adapterId,adapterVersion:e.adapterVersion,platform:e.platform,architecture:e.architecture}}function Xr(e){return{leaseId:e.leaseId,version:e.version,state:e.state,useCount:e.useCount}}function Si(e){return Ii("sha256").update(JSON.stringify(At(e))).digest("hex")}function At(e){return Array.isArray(e)?e.map(At):!e||typeof e!="object"?e:Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>[t,At(r)]))}function Ti(e,t){if(!e)return()=>{};let r=()=>t.abort(e.reason);return e.aborted?r():e.addEventListener("abort",r,{once:!0}),()=>e.removeEventListener("abort",r)}function Le(e){if(e.aborted)throw new l("AUTOMATION_CANCELLED","Automation operation was stopped before dispatch")}function Ci(e){return e instanceof Error&&e.message.slice(0,1024)||"Automation adapter failed"}import{isAbsolute as xi}from"node:path";async function ed(e){if(!xi(e))throw Error("Automation journal requires an absolute host-owned path");let{DatabaseSync:t}=await import("node:sqlite");return new yt(new t(e))}var yt=class{constructor(t){this.database=t;try{if(t.exec("PRAGMA busy_timeout=0; PRAGMA synchronous=FULL; CREATE TABLE IF NOT EXISTS automation_execution_schema(id INTEGER PRIMARY KEY CHECK(id=1),version INTEGER NOT NULL); INSERT OR IGNORE INTO automation_execution_schema VALUES(1,1);"),t.prepare("SELECT version FROM automation_execution_schema WHERE id=1").get()?.version!==1)throw Error("Unsupported automation execution journal");t.exec("CREATE TABLE IF NOT EXISTS automation_executions(id TEXT PRIMARY KEY,body TEXT NOT NULL)")}catch(r){throw t.close(),this.closed=!0,r}}database;closed=!1;async begin(t){return t=structuredClone(t),It(t),ie(t,["operationId","fingerprint","ownerToken"]),this.transaction(()=>{let r=this.read(t.operationId);if(r){if(r.fingerprint!==t.fingerprint)throw Ue();return{claimed:!1,record:r}}let n=this.database.prepare("SELECT COUNT(*) AS count FROM automation_executions").get()?.count;if(typeof n!="number"||n>=1e5)throw Error("Automation journal capacity reached; explicit archival required");let o={schemaVersion:1,...t,outcome:{kind:"pending"}};return this.database.prepare("INSERT INTO automation_executions(id,body) VALUES(?,?)").run(t.operationId,Dr(o)),{claimed:!0,record:o}})}async get(t){if(typeof t!="string"||!t.trim()||t.length>1024)throw Error("Invalid automation journal identity");return this.transaction(()=>this.read(t))}async finish(t,r){t=structuredClone(t),r=structuredClone(r),It(t),ie(t,["operationId","fingerprint","ownerToken"]);let n={schemaVersion:1,...t,outcome:r};return wt(n),this.transaction(()=>{let o=this.read(t.operationId);if(!o||o.fingerprint!==t.fingerprint||o.ownerToken!==t.ownerToken)throw Ue();if(o.outcome.kind!=="pending"){if(JSON.stringify(o.outcome)!==JSON.stringify(r))throw Ue();return}this.database.prepare("UPDATE automation_executions SET body=? WHERE id=?").run(Dr(n),t.operationId)})}close(){this.closed||(this.closed=!0,this.database.close())}read(t){let r=this.database.prepare("SELECT CASE WHEN length(body)<=16384 THEN body ELSE NULL END AS body FROM automation_executions WHERE id=?").get(t);if(!r)return;if(typeof r.body!="string")throw Error("Corrupt automation journal size");let n=JSON.parse(r.body);if(wt(n),n.operationId!==t)throw Ue();return n}async transaction(t){let r=Date.now()+1e3;for(;;){if(this.closed)throw Error("Automation journal closed");let n=!1;try{this.database.exec("BEGIN IMMEDIATE"),n=!0;let o=t();return this.database.exec("COMMIT"),o}catch(o){if(n)try{this.database.exec("ROLLBACK")}catch{}if(Date.now()>=r||!/SQLITE_BUSY|database is locked/.test(String(o)))throw o;await new Promise(i=>setTimeout(i,10))}}}};function It(e){for(let t of[e.operationId,e.ownerToken])if(typeof t!="string"||!t.trim()||t.length>1024)throw Error("Invalid automation journal identity");if(!/^[a-f0-9]{64}$/.test(e.fingerprint))throw Error("Invalid automation journal fingerprint")}function wt(e){if(!e||typeof e!="object")throw Error("Invalid automation journal record");let t=e;if(It(t),ie(t,["schemaVersion","operationId","fingerprint","ownerToken","outcome"]),t.schemaVersion!==1||!t.outcome)throw Error("Invalid automation journal schema");let r=t.outcome;if(r.kind==="result"){if(ie(r,["kind","artifactId","sha256"]),typeof r.artifactId!="string"||!r.artifactId||r.artifactId.length>256||!/^[a-f0-9]{64}$/.test(r.sha256))throw Error("Invalid automation result reference")}else if(r.kind==="failed"){if(ie(r,["kind","code"]),typeof r.code!="string"||!/^AUTOMATION_[A-Z_]{1,100}$/.test(r.code))throw Error("Invalid automation failure code")}else if(r.kind==="pending")ie(r,["kind"]);else throw Error("Invalid automation journal outcome")}function ie(e,t){if(Array.isArray(e)||Object.keys(e).some(r=>!t.includes(r)))throw Error("Unexpected automation journal fields")}function Dr(e){wt(e);let t=JSON.stringify(e);if(t.length>16384)throw Error("Automation journal record too large");return t}function Ue(){return new l("AUTOMATION_OPERATION_CONFLICT","Automation operation identity or owner conflicts with durable state")}function Pi(e,t=()=>new Date().toISOString()){let r=[];Ri(r,"manifest.valid",()=>_e(e));let n=new Set(e.operations);return ae(r,n,e.supports.consoleInspection,"browser.console.read","console inspection"),ae(r,n,e.supports.networkInspection,"browser.network.read","network inspection"),ae(r,n,e.supports.storageInspection,"browser.storage.read","storage inspection"),ae(r,n,e.supports.pageErrorInspection,"browser.page-errors.read","page-error inspection"),ae(r,n,e.supports.recordings,"browser.record.start","recording start"),ae(r,n,e.supports.recordings,"browser.record.stop","recording stop"),n.has("browser.upload")&&G(r,"policy.upload",e.policyEnforcement.upload,"Upload policy is enforced"),n.has("browser.download")&&G(r,"policy.download",e.policyEnforcement.download,"Download policy is enforced"),[...n].some(o=>o.startsWith("browser."))&&(G(r,"policy.redirect",e.policyEnforcement.redirect,"Redirect policy is enforced"),G(r,"control.handback",e.supports.deterministicHandback,"Deterministic hand-back is supported")),[...n].some(o=>o.startsWith("computer."))&&(G(r,"control.stop",e.supports.immediateStop,"Immediate human stop is supported"),G(r,"privacy.redaction",e.supports.sensitiveRegionRedaction,"Sensitive-region redaction is supported")),G(r,"certification.binding",!e.certified||!!e.certificationArtifactId,e.certified?"Certification artifact is bound":"Adapter does not claim certification"),{protocolVersion:1,adapter:{adapterId:e.adapterId,adapterVersion:e.adapterVersion,platform:e.platform,architecture:e.architecture},generatedAt:t(),passed:r.every(o=>o.status==="pass"),checks:r}}function id(e){let r=Pi(e).checks.filter(n=>n.status==="fail");if(r.length>0)throw new l("AUTOMATION_OPERATION_UNSUPPORTED",r.map(n=>`${n.id}: ${n.message}`).join("; "))}function ae(e,t,r,n,o){let i=t.has(n);G(e,`capability.${n}`,r===i,r===i?`${o} declaration matches the operation catalog`:`${o} declaration does not match ${n}`)}function Ri(e,t,r){try{r(),e.push({id:t,status:"pass",message:"Manifest satisfies the protocol contract"})}catch(n){e.push({id:t,status:"fail",message:n instanceof Error?n.message:String(n)})}}function G(e,t,r,n){e.push({id:t,status:r?"pass":"fail",message:n})}var _i=6e4,Oi=48*1024*1024,Lr=class{endpoint;token;timeoutMs;maxResponseBytes;fetchImpl;constructor(t){if(this.endpoint=Ni(t.baseUrl),this.token=ki(t.token),this.timeoutMs=Mr(t.timeoutMs??_i,1e3,3e5,"timeoutMs"),this.maxResponseBytes=Mr(t.maxResponseBytes??Oi,1024,128*1024*1024,"maxResponseBytes"),this.fetchImpl=t.fetch??globalThis.fetch,typeof this.fetchImpl!="function")throw new l("AUTOMATION_TRANSPORT_ERROR","A Fetch API implementation is required")}manifest(){return this.request("manifest","GET")}preflight(t,r){return this.request("preflight","POST",t,r)}execute(t,r,n,o){return this.request("execute","POST",{request:t,preflight:r,grant:n},o)}async stop(t,r){await this.request("stop","POST",{operationId:t,reason:r.slice(0,512)})}async request(t,r,n,o){let i=new AbortController,a=Li(o,i),s=setTimeout(()=>i.abort(new Error("automation transport timeout")),this.timeoutMs);s.unref?.();try{let c=new URL(t,this.endpoint),d=await this.fetchImpl(c,{method:r,redirect:"error",cache:"no-store",credentials:"omit",headers:{authorization:`Bearer ${this.token}`,accept:"application/json",...r==="POST"?{"content-type":"application/json"}:{}},...r==="POST"?{body:JSON.stringify(n??{})}:{},signal:i.signal}),A=await Xi(d,this.maxResponseBytes);if(!d.ok){let y=Di(A);throw new l("AUTOMATION_TRANSPORT_ERROR",`XENO Browser rejected ${t}: ${y.message}`,{status:d.status,route:t,adapterCode:y.code})}if(!bt(A)||A.ok!==!0||!("result"in A))throw new l("AUTOMATION_RESPONSE_INVALID",`XENO Browser returned an invalid ${t} envelope`);return A.result}catch(c){if(c instanceof l)throw c;let d=o?.aborted;throw new l(d?"AUTOMATION_CANCELLED":"AUTOMATION_TRANSPORT_ERROR",d?"Automation transport was stopped":`XENO Browser ${t} transport failed`,{route:t},{cause:c})}finally{clearTimeout(s),a()}}};function Ni(e){let t;try{t=new URL(e)}catch(n){throw new l("AUTOMATION_TRANSPORT_ERROR","XENO Browser base URL is invalid",void 0,{cause:n})}if(t.protocol!=="http:"&&t.protocol!=="https:")throw new l("AUTOMATION_TRANSPORT_ERROR","XENO Browser transport requires HTTP(S)");if(t.username||t.password||t.search||t.hash)throw new l("AUTOMATION_TRANSPORT_ERROR","XENO Browser base URL cannot contain credentials, query, or fragment");let r=t.hostname.toLowerCase().replace(/^\[|\]$/g,"").replace(/\.$/,"");if(r!=="localhost"&&r!=="127.0.0.1"&&r!=="::1")throw new l("AUTOMATION_TRANSPORT_ERROR","XENO Browser transport must use a loopback host");if(!t.port)throw new l("AUTOMATION_TRANSPORT_ERROR","XENO Browser transport requires an explicit port");return t.pathname="/v1/automation/",t}function ki(e){if(typeof e!="string"||e.length<32||e.length>512||/\s/.test(e))throw new l("AUTOMATION_TRANSPORT_ERROR","XENO Browser session token is invalid");return e}async function Xi(e,t){let r=Number(e.headers.get("content-length"));if(Number.isFinite(r)&&r>t)throw new l("AUTOMATION_RESPONSE_INVALID",`XENO Browser response exceeds ${t} bytes`);if(e.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase()!=="application/json")throw new l("AUTOMATION_RESPONSE_INVALID","XENO Browser response is not application/json");if(!e.body)throw new l("AUTOMATION_RESPONSE_INVALID","XENO Browser response body is missing");let o=e.body.getReader(),i=[],a=0;for(;;){let{done:d,value:A}=await o.read();if(d)break;if(a+=A.byteLength,a>t)throw await o.cancel("response too large"),new l("AUTOMATION_RESPONSE_INVALID",`XENO Browser response exceeds ${t} bytes`);i.push(A)}let s=new Uint8Array(a),c=0;for(let d of i)s.set(d,c),c+=d.byteLength;try{return JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(s))}catch(d){throw new l("AUTOMATION_RESPONSE_INVALID","XENO Browser response contains invalid JSON",void 0,{cause:d})}}function Di(e){return bt(e)&&bt(e.error)?{code:typeof e.error.code=="string"?e.error.code.slice(0,128):"UNKNOWN",message:typeof e.error.message=="string"?e.error.message.slice(0,1024):"request failed"}:{code:"UNKNOWN",message:"request failed"}}function Li(e,t){if(!e)return()=>{};let r=()=>t.abort(e.reason);return e.aborted?r():e.addEventListener("abort",r,{once:!0}),()=>e.removeEventListener("abort",r)}function Mr(e,t,r,n){if(!Number.isSafeInteger(e)||e<t||e>r)throw new l("AUTOMATION_TRANSPORT_ERROR",`${n} must be an integer from ${t} to ${r}`);return e}function bt(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}import{randomUUID as Mi}from"node:crypto";var Be=["browser.navigate","browser.back","browser.forward","browser.reload","browser.wait","browser.snapshot","browser.screenshot","browser.locate","browser.tabs.list","browser.tabs.open","browser.console.read","browser.network.read","browser.storage.read","browser.page-errors.read","browser.click","browser.type","browser.key","browser.select","browser.scroll","browser.tabs.close","browser.upload","browser.download"],Ee=class{constructor(t){this.options=t;if(this.base=Bi(t.baseUrl),this.fetchImpl=t.fetch??globalThis.fetch,this.timeoutMs=t.timeoutMs??6e4,!Fi(t.token))throw new Error("XENO browser control-plane token is invalid")}options;base;fetchImpl;timeoutMs;async manifest(){let t=await this.call("health",void 0),r=Be.filter(n=>t.verbs?.includes(Ur(n))??!1);return{protocolVersion:1,adapterId:this.options.driver==="extension"?"xeno-extension-native":"xeno-browser-native",adapterVersion:t.version??"unknown",platform:process.platform,architecture:process.arch,operations:r,targetBinding:"atomic-preflight",profileIsolation:this.options.driver==="browser"?"both":"none",supports:{accessibilitySnapshots:!0,screenshots:!0,recordings:!1,consoleInspection:!0,networkInspection:!0,storageInspection:r.includes("browser.storage.read"),pageErrorInspection:!0,visibleCoControl:!0,deterministicHandback:!0,immediateStop:!0,sensitiveRegionRedaction:!1},policyEnforcement:{domain:!0,scheme:!0,port:!0,redirect:!0,upload:r.includes("browser.upload"),download:r.includes("browser.download")},certified:!1,limitations:[`${this.options.driver==="extension"?"Extension":"Browser"} transport is policy-enforced but not release-certified`,"sensitive-region screenshot redaction is not available"]}}async preflight(t,r){$i(t.operation);let n=await this.call("health",void 0,r);if(!n.verbs?.includes(Ur(t.operation)))throw new Error(`${this.options.driver} driver does not support ${t.operation}`);let o=Vr(n.activeTab),i=se(t.parameters.tabId)??t.declaredTarget?.tabId;if(i&&o&&i!==o)throw new Error(`Requested tab ${i} is not the active browser tab ${o}`);let a=$r(t,o);Br(t,a);let s=new Date;return{token:`${t.operationId}:${o??"unbound"}:${Mi()}`,preparedAt:s.toISOString(),expiresAt:new Date(s.getTime()+2e4).toISOString(),observedTarget:a,...Hr(t.operation)?{evidence:[await this.snapshotEvidence(t,"before",r)]}:{},adapterState:{activeTab:o??null,driver:this.options.driver}}}async execute(t,r,n,o){let i=new Date().toISOString(),a=await this.call("health",void 0,o),s=Vr(a.activeTab);if(r.observedTarget.tabId&&s!==r.observedTarget.tabId)throw new Error("Active browser tab changed after atomic preflight");Br(t,r.observedTarget);try{let c=jr(t.operation,t.parameters),d=await this.call(c.verb,c.params,o),A=$r(t,s),y=t.operation==="browser.wait"||t.operation==="browser.tabs.list"?[]:[await this.resultEvidence(t,d,o)];return{status:"ok",startedAt:i,completedAt:new Date().toISOString(),observedTarget:A,data:ji(d),...y.length?{evidence:y}:{}}}catch(c){let d={code:Gi(c),message:Hi(c),retryable:!1};return{status:Wi(c),startedAt:i,completedAt:new Date().toISOString(),observedTarget:r.observedTarget,error:d,evidence:[{evidenceId:`${t.operationId}-after-failure`,phase:"after",kind:"browser-snapshot",title:`${t.operation} failed attempt`,mediaType:"application/json",content:{type:"text",text:JSON.stringify({error:d})},sensitivity:"restricted"}]}}}async stop(t,r){await this.call("stop",{})}async resultEvidence(t,r,n){return t.operation==="browser.screenshot"?Ui(t,"after",r):this.snapshotEvidence(t,"after",n)}async snapshotEvidence(t,r,n){let o=await this.call("observe",{limit:1e3},n);return{evidenceId:`${t.operationId}-${r}`,phase:r,kind:"browser-snapshot",title:`${t.operation} ${r} state`,mediaType:"application/json",content:{type:"text",text:JSON.stringify(o)},sensitivity:"restricted"}}async call(t,r,n){let o=new AbortController,i=()=>o.abort(n?.reason);n?.aborted?i():n?.addEventListener("abort",i,{once:!0});let a=setTimeout(()=>o.abort(new Error("browser control-plane timeout")),this.timeoutMs);a.unref?.();try{let s=await this.fetchImpl(new URL(`/v1/browser/${t}`,this.base),{method:t==="health"?"GET":"POST",redirect:"error",cache:"no-store",credentials:"omit",headers:{authorization:`Bearer ${this.options.token}`,accept:"application/json",...t==="health"?{}:{"content-type":"application/json"}},...t==="health"?{}:{body:JSON.stringify(r??{})},signal:o.signal}),c=await s.json();if(!s.ok||c.ok!==!0)throw Object.assign(new Error(c.error?.message??`Browser ${t} failed with HTTP ${s.status}`),{code:c.error?.code??`HTTP_${s.status}`,status:s.status});return c.result}finally{clearTimeout(a),n?.removeEventListener("abort",i)}}};function Ur(e){return jr(e,{}).verb}function jr(e,t){let r=Object.fromEntries(Object.entries(t).filter(([n])=>n!=="tabId"));switch(e){case"browser.navigate":return{verb:"navigate",params:r};case"browser.back":return{verb:"back",params:{}};case"browser.forward":return{verb:"forward",params:{}};case"browser.reload":return{verb:"reload",params:{}};case"browser.wait":return{verb:"wait",params:t.until==="ms"?{milliseconds:t.value??0}:{until:"load",timeout_ms:t.value??3e4}};case"browser.snapshot":return{verb:"observe",params:{limit:t.limit??1e3}};case"browser.screenshot":return{verb:"screenshot",params:{}};case"browser.locate":return{verb:"find",params:r};case"browser.tabs.list":return{verb:"tabs_list",params:{}};case"browser.tabs.open":return{verb:"tabs_new",params:r};case"browser.tabs.close":return{verb:"tabs_close",params:{id:t.tabId}};case"browser.console.read":return{verb:"console_log",params:r};case"browser.network.read":return{verb:"network_log",params:r};case"browser.page-errors.read":return{verb:"console_log",params:{...r,level:"error"}};case"browser.storage.read":return{verb:"storage",params:{}};case"browser.click":return{verb:"click",params:r};case"browser.type":return{verb:"type",params:{selector:t.selector,text:t.text,clear_first:t.clear,press_enter:t.submit}};case"browser.key":return{verb:"key",params:{combo:t.combo}};case"browser.select":return{verb:"select",params:r};case"browser.scroll":return{verb:"scroll",params:r};case"browser.upload":return{verb:"attach_file",params:{selector:t.selector,backendNodeId:t.backendNodeId,host_paths:t.hostPaths,drop:t.drop}};case"browser.download":return{verb:"download",params:{to_path:t.toPath,trigger:t.trigger}};default:throw new Error(`Unsupported browser operation ${e}`)}}function Ui(e,t,r){let n=$e(r)?r:{},o=se(n.base64)??Vi(se(n.screenshot));if(!o)throw new Error("Browser screenshot did not return image bytes");let i=se(n.format)??(se(n.screenshot)?.startsWith("data:image/jpeg")?"jpeg":"png");return{evidenceId:`${e.operationId}-${t}`,phase:t,kind:"screenshot",title:`${e.operation} result`,mediaType:i==="jpeg"?"image/jpeg":"image/png",content:{type:"base64",base64:o},sensitivity:"restricted"}}function $r(e,t){let r=se(e.parameters.url)??e.declaredTarget?.url;return{...e.declaredTarget??{},...r?{url:r}:{},...t?{tabId:t}:{}}}function Br(e,t){if(e.operation==="browser.upload"&&e.executionContract.browser.uploads==="deny")throw Object.assign(new Error("Browser uploads are denied by the execution contract"),{code:"POLICY_DENIED"});if(e.operation==="browser.download"&&e.executionContract.browser.downloads==="deny")throw Object.assign(new Error("Browser downloads are denied by the execution contract"),{code:"POLICY_DENIED"});let r=t.url??t.origin;if(!r)return;let n=new URL(r),o=e.executionContract.browser,i=n.protocol.replace(/:$/,"");if(!o.allowedSchemes?.includes(i))throw Object.assign(new Error(`Browser scheme ${i} is denied`),{code:"POLICY_DENIED"});let a=n.port?Number(n.port):i==="http"?80:443;if(!o.allowedPorts?.includes(a))throw Object.assign(new Error(`Browser port ${a} is denied`),{code:"POLICY_DENIED"});let s=n.hostname.toLowerCase();if(o.deniedDomains?.some(d=>Fr(s,d)))throw Object.assign(new Error(`Browser domain ${s} is denied`),{code:"POLICY_DENIED"});let c=e.operation.startsWith("browser.")&&Hr(e.operation)?o.actAllowedDomains:o.readAllowedDomains;if(c&&c.length>0&&!c.some(d=>Fr(s,d)))throw Object.assign(new Error(`Browser domain ${s} is outside the allowed scope`),{code:"POLICY_DENIED"})}function Fr(e,t){let r=t.toLowerCase().replace(/^\*\./,".");return r.startsWith(".")?e.endsWith(r)||e===r.slice(1):e===r}function Hr(e){return["browser.navigate","browser.back","browser.forward","browser.reload","browser.tabs.open","browser.click","browser.type","browser.key","browser.select","browser.scroll","browser.tabs.close","browser.upload","browser.download"].includes(e)}function $i(e){if(!Be.includes(e))throw new Error(`Unsupported browser operation ${e}`)}function Bi(e){let t=new URL(e),r=t.hostname.toLowerCase().replace(/^\[|\]$/g,"");if(t.protocol!=="http:"||!["localhost","127.0.0.1","::1"].includes(r)||!t.port)throw new Error("Browser control plane must be an explicit HTTP loopback URL");return t}function Fi(e){return typeof e=="string"&&e.length>=32&&e.length<=512&&!/\s/.test(e)}function Vr(e){return typeof e=="string"||typeof e=="number"?String(e):void 0}function se(e){return typeof e=="string"&&e.length>0?e:void 0}function Vi(e){return e?.match(/^data:image\/(?:png|jpeg);base64,(.+)$/)?.[1]}function ji(e){return JSON.parse(JSON.stringify(e??null))}function $e(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}function Hi(e){return e instanceof Error?e.message.slice(0,1024):String(e).slice(0,1024)}function Gi(e){return $e(e)&&typeof e.code=="string"?e.code:"BROWSER_OPERATION_FAILED"}function Wi(e){return $e(e)&&(e.status===403||e.status===409||e.code==="POLICY_DENIED")?"denied":$e(e)&&e.name==="AbortError"?"cancelled":"error"}import{existsSync as yn,readFileSync as In}from"node:fs";import{homedir as es}from"node:os";import{join as gn,resolve as ve}from"node:path";import{randomUUID as rn}from"node:crypto";import{mkdir as nn,open as Zr,readFile as oa,stat as on,unlink as ia}from"node:fs/promises";import{basename as Qr,dirname as en,join as aa,resolve as sa}from"node:path";import*as M from"node:fs/promises";var Ji=new Set(["EACCES","EBUSY","EPERM"]),qi=[10,20,40,80,160,320,640];async function Gr(e,t){for(let r=0;;r+=1)try{await M.rename(e,t);return}catch(n){let o=n.code,i=qi[r];if(process.platform!=="win32"||!o||!Ji.has(o)||i===void 0)throw n;await new Promise(a=>setTimeout(a,i))}}import{mkdirSync as zi,readFileSync as Ki,rmSync as Jr,writeFileSync as Yi}from"node:fs";import{hostname as qr}from"node:os";import{dirname as Zi}from"node:path";function Qi(){return new Date().toISOString()}function ea(){return new Date(Date.now()-Math.floor(process.uptime()*1e3)).toISOString()}function zr(e){try{return JSON.parse(Ki(e,"utf8"))}catch{return null}}function ta(e){if(!e||e<=0)return!1;try{return process.kill(e,0),!0}catch{return!1}}function ra(e){return e.hostname!==qr()?!0:ta(e.pid)}function Wr(e,t){zi(Zi(e),{recursive:!0}),Yi(e,JSON.stringify(t,null,2)+`
-`,{encoding:"utf8",flag:"wx"})}function na(e,t){let r=zr(e);r?.pid!==t.pid||r.hostname!==t.hostname||Jr(e,{force:!0})}function Kr(e,t,r){let n=Qi(),o={schemaVersion:1,name:t,pid:process.pid,hostname:qr(),processStartedAt:ea(),version:r,acquiredAt:n,updatedAt:n};try{Wr(e,o)}catch(i){if(i.code!=="EEXIST")throw i;let s=zr(e);if(s&&ra(s))throw new Error(`${t} is already locked by PID ${s.pid} on ${s.hostname}.`);Jr(e,{force:!0}),Wr(e,o)}return{record:o,release:()=>{na(e,o)}}}var Yr="0.10.35";var an=1,ca="repository.v1.json",da=5e3,la=20,ua=64*1024*1024,Fe=class{directory;snapshotPath;backupPath;lockPath;now;lockTimeoutMs;lockRetryMs;maxSnapshotBytes;onRecovery;mutationTail=Promise.resolve();constructor(t){if(!t||typeof t.directory!="string"||t.directory.trim().length===0)throw new TypeError("Artifact repository directory is required");let r=t.snapshotFileName??ca;if(Qr(r)!==r||!/^[A-Za-z0-9_.-]+$/.test(r))throw new TypeError("Artifact snapshot filename must be a safe basename");this.directory=sa(t.directory),this.snapshotPath=aa(this.directory,r),this.backupPath=`${this.snapshotPath}.bak`,this.lockPath=`${this.snapshotPath}.lock`,this.now=t.now??(()=>new Date().toISOString()),this.lockTimeoutMs=Et(t.lockTimeoutMs,da,100,6e4,"lockTimeoutMs"),this.lockRetryMs=Et(t.lockRetryMs,la,1,1e3,"lockRetryMs"),this.maxSnapshotBytes=Et(t.maxSnapshotBytes,ua,1024,1024*1024*1024,"maxSnapshotBytes"),this.onRecovery=t.onRecovery}async create(t){return this.mutate(r=>r.create(t))}async createRevision(t,r){return this.mutate(n=>n.createRevision(t,r))}async get(t,r){return(await this.load()).repository.get(t,r)}async require(t,r){return(await this.load()).repository.require(t,r)}async list(t){return(await this.load()).repository.list(t)}async listRevisions(t){return(await this.load()).repository.listRevisions(t)}async transition(t){return this.mutate(r=>r.transition(t))}async appendReviewEvent(t){return this.mutate(r=>r.appendReviewEvent(t))}async inspectSnapshot(){return this.readSnapshot(this.snapshotPath,!0)}async mutate(t){return this.enqueueMutation(async()=>{let r=await this.acquireLock();try{let n=await this.load(),o=await t(n.repository);return await this.persist(n),o}finally{r.release()}})}async enqueueMutation(t){let r=this.mutationTail.then(t,t);return this.mutationTail=r.then(()=>{},()=>{}),r}async acquireLock(){let t=Date.now(),r;for(;Date.now()-t<=this.lockTimeoutMs;)try{return Kr(this.lockPath,`artifact-repository:${Qr(this.snapshotPath)}`,Yr)}catch(n){if(!(n instanceof Error)||!/already locked by PID/.test(n.message))throw n;r=n,await ha(this.lockRetryMs)}throw new p("ARTIFACT_PERSISTENCE_LOCKED",`Artifact repository remained locked for ${this.lockTimeoutMs}ms`,{snapshotPath:this.snapshotPath},{cause:r})}async load(){let t,r,n=!1;try{r=await this.readSnapshot(this.snapshotPath,!1)}catch(i){t=Ve(i)}if(!r&&(t||await ga(this.backupPath)))try{let i=await this.readSnapshot(this.backupPath,!0);i&&(this.onRecovery?.({snapshotPath:this.snapshotPath,backupPath:this.backupPath,reason:t?.message??"primary snapshot missing"}),r=i,n=!0)}catch(i){throw t?new p("ARTIFACT_PERSISTENCE_CORRUPT","Artifact repository primary and backup snapshots are unreadable",{snapshotPath:this.snapshotPath,backupPath:this.backupPath},{cause:new AggregateError([t,Ve(i)])}):i}if(!r&&t)throw t;let o=r?.state??{schemaVersion:1,records:[]};return{repository:new we({now:this.now,idFactory:i=>`${i}_${rn()}`,initialState:o}),generation:r?.generation??0,createdAt:r?.createdAt??this.now(),hasSnapshot:r!==void 0,recoveredFromBackup:n,...r?{sourceSnapshot:r}:{}}}async persist(t){let r=this.now(),o={...{schemaVersion:an,generation:t.generation,createdAt:t.createdAt,updatedAt:r,state:t.repository.exportState()},generation:t.generation+1},i=fa(o),a=`${JSON.stringify(i,null,2)}
-`;if(Buffer.byteLength(a,"utf8")>this.maxSnapshotBytes)throw new p("ARTIFACT_PERSISTENCE_IO",`Artifact repository snapshot exceeds ${this.maxSnapshotBytes} bytes`,{snapshotPath:this.snapshotPath,maxSnapshotBytes:this.maxSnapshotBytes});await nn(this.directory,{recursive:!0,mode:448}),t.hasSnapshot&&!t.recoveredFromBackup&&t.sourceSnapshot&&await tn(this.backupPath,`${JSON.stringify(t.sourceSnapshot,null,2)}
-`),await tn(this.snapshotPath,a)}async readSnapshot(t,r){let n;try{n=await on(t)}catch(o){if(!r&&St(o,"ENOENT")||r&&St(o,"ENOENT"))return;throw Tt("Unable to inspect artifact repository snapshot",t,o)}if(!n.isFile()||n.size>this.maxSnapshotBytes)throw new p("ARTIFACT_PERSISTENCE_CORRUPT","Artifact repository snapshot is not a bounded regular file",{snapshotPath:t,sizeBytes:n.size,maxSnapshotBytes:this.maxSnapshotBytes});try{let o=await oa(t);if(o.byteLength>this.maxSnapshotBytes)throw new Error("snapshot grew beyond the configured size limit while reading");return pa(JSON.parse(o.toString("utf8")),t)}catch(o){throw o instanceof p?o:Tt("Unable to parse artifact repository snapshot",t,o,!0)}}};function pa(e,t){if(!vt(e)||e.schemaVersion!==an||!Number.isInteger(e.generation)||e.generation<0||typeof e.createdAt!="string"||!Number.isFinite(Date.parse(e.createdAt))||typeof e.updatedAt!="string"||!Number.isFinite(Date.parse(e.updatedAt))||!vt(e.state)||e.state.schemaVersion!==1||!Array.isArray(e.state.records)||!vt(e.checksum)||e.checksum.algorithm!=="sha256"||typeof e.checksum.value!="string")throw new p("ARTIFACT_PERSISTENCE_CORRUPT","Artifact repository snapshot envelope is invalid",{snapshotPath:t});let r=e,n=ma(r),o=sn(n);if(r.checksum.value!==o)throw new p("ARTIFACT_PERSISTENCE_CORRUPT","Artifact repository snapshot checksum does not match its payload",{snapshotPath:t});return new we({initialState:r.state}),structuredClone(r)}function fa(e){return{...structuredClone(e),checksum:{algorithm:"sha256",value:sn(e)}}}function ma(e){return{schemaVersion:e.schemaVersion,generation:e.generation,createdAt:e.createdAt,updatedAt:e.updatedAt,state:e.state}}function sn(e){return Y(JSON.stringify(e)).value}async function tn(e,t){await nn(en(e),{recursive:!0,mode:448});let r=`${e}.tmp.${process.pid}.${rn()}`,n;try{n=await Zr(r,"wx",384),await n.writeFile(t,{encoding:"utf8"}),await n.sync(),await n.close(),n=void 0,await Gr(r,e);try{let o=await Zr(en(e),"r");try{await o.sync()}finally{await o.close()}}catch{}}finally{n&&await n.close().catch(()=>{}),await ia(r).catch(()=>{})}}function Et(e,t,r,n,o){if(e===void 0)return t;if(!Number.isInteger(e)||e<r||e>n)throw new TypeError(`${o} must be an integer between ${r} and ${n}`);return e}function vt(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function St(e,t){return e instanceof Error&&e.code===t}async function ga(e){try{return(await on(e)).isFile()}catch(t){if(St(t,"ENOENT"))return!1;throw Tt("Unable to inspect artifact repository backup",e,t)}}function Ve(e){return e instanceof Error?e:new Error(String(e))}function Tt(e,t,r,n=!1){return new p(n?"ARTIFACT_PERSISTENCE_CORRUPT":"ARTIFACT_PERSISTENCE_IO",`${e}: ${Ve(r).message}`,{snapshotPath:t},{cause:Ve(r)})}function ha(e){return new Promise(t=>setTimeout(t,e))}import{homedir as Aa,platform as ya,release as Ia}from"node:os";var Rd=ya();var _d=Ia(),Od=Aa();var Md=10080*60*1e3;var wa=2,Ct=["publish","deploy","push","send","purchase","sign","file-legal","change-infrastructure"];function ba(e){return Array.from(new Set((e??[]).map(t=>t.trim()).filter(Boolean)))}function F(e){return{schemaVersion:wa,id:e.id,version:"1.0.0",displayName:e.displayName,description:e.description,kind:e.kind??"primary",prompt:e.prompt,capabilities:{tools:e.toolPolicy??{mode:"inherit"},skills:{preload:e.skills??[],...e.skillAllow?{allow:e.skillAllow}:{},deny:[]},hooks:[],permissionProfile:e.permissionProfile??"default",externalActions:{default:e.externalDefault??"ask",...e.externalOverrides?{overrides:e.externalOverrides}:{},requireCurrentTurnApproval:e.currentTurnApproval??[]}},memory:{scope:e.memoryScope??"project",role:e.id,soul:e.soul??"read"},execution:{defaultMode:e.defaultMode??"chat",allowedModes:e.allowedModes??["chat","plan","execute","review"],isolation:e.isolation??"none",allowBackground:e.allowBackground??!0,planForComplexTasks:e.planForComplexTasks??!0,defaultDryRun:e.defaultDryRun??!1},completion:{evidence:e.evidence??[],requirePrimarySources:e.primarySources??!1,requireCurrentInformation:e.currentInformation??!1,requireHumanReview:e.humanReview??!1,stopConditions:e.stopConditions??["The requested outcome is complete and required evidence has been reported.","A real authorization, information, or external-state blocker prevents safe progress."]},presentation:{label:e.displayName,color:e.color,glyph:e.glyph},tags:ba(e.tags)}}var Fd=[F({id:"assistant",displayName:"Assistant",description:"General-purpose XENO collaborator for mixed research, planning, and implementation work.",prompt:["Work as a thoughtful generalist. Establish the user's actual outcome, inspect relevant context, and take scoped action.","Escalate into a narrower specialist profile when domain risk or task depth warrants it."].join(`
-`),toolPolicy:{mode:"inherit"},skills:[],memoryScope:"user",evidence:["file-references"],currentTurnApproval:[...Ct],color:"cyan",glyph:"\u25A0",tags:["general","primary"]}),F({id:"swe",displayName:"Software Engineer",description:"Repository-aware software engineer for careful implementation, debugging, refactoring, and verification.",prompt:["Inspect the repository before editing. Follow project instructions and preserve unrelated work.","Trace the smallest root cause, implement the narrowest coherent change, and verify from focused checks outward.","Do not claim completion without concrete test, typecheck, build, or runtime evidence appropriate to the risk."].join(`
-`),toolPolicy:{mode:"default"},skills:["debug","run","verify"],permissionProfile:"trusted-dev",soul:"learn",evidence:["file-references","tests","typecheck","build","diff"],currentTurnApproval:["publish","deploy","push","change-infrastructure"],color:"green",glyph:"\u25C6",tags:["engineering","implementation"]}),F({id:"reviewer",displayName:"Code Reviewer",description:"Read-only reviewer focused on correctness, regressions, safety, tests, and maintainability.",prompt:["Lead with concrete findings ordered by severity. Cite exact file locations and explain impact.","Do not edit code. Distinguish confirmed defects from risks and questions. State when no material finding is present."].join(`
-`),kind:"subagent",toolPolicy:{mode:"readOnly"},skills:["code-review","verify"],permissionProfile:"read-only",memoryScope:"session",soul:"read",allowedModes:["chat","review"],defaultMode:"review",evidence:["file-references","diff"],externalDefault:"deny",color:"yellow",glyph:"\u25C7",tags:["engineering","review","read-only"]}),F({id:"writer",displayName:"Writer",description:"Audience-aware writer and editor for clear, accurate, structurally coherent content.",prompt:["Determine audience, purpose, voice, format, and source constraints before drafting.","Preserve factual meaning, avoid invented claims, and revise for clarity, rhythm, consistency, and usefulness."].join(`
-`),toolPolicy:{mode:"default",allow:["Read","Glob","Grep","LS","Write","Edit","WebSearch","WebFetch","Think","AskUser","Skill"]},skills:["verify"],evidence:["sources","file-references","diff"],currentTurnApproval:["send","publish"],color:"magenta",glyph:"\u2726",tags:["writing","editing"]}),F({id:"research",displayName:"Researcher",description:"Evidence-first researcher for questions, comparisons, synthesis, and source-backed analysis.",prompt:["Break the question into verifiable claims. Prefer primary and authoritative sources, compare dates, and cite near each claim.","Separate sourced fact, inference, uncertainty, and recommendation. Do not make changes unless the user explicitly expands scope."].join(`
-`),toolPolicy:{mode:"readOnly"},skills:["verify"],permissionProfile:"default",memoryScope:"session",soul:"read",allowedModes:["chat","plan","review"],evidence:["sources","file-references"],primarySources:!0,currentInformation:!0,externalDefault:"deny",color:"blue",glyph:"\u25C8",tags:["research","qa","read-only"]}),F({id:"product",displayName:"Product",description:"Product strategist for problem framing, requirements, sequencing, metrics, and trade-off decisions.",prompt:["Start from the user problem and observable outcome. Distinguish evidence, assumptions, constraints, and open decisions.","Translate strategy into testable requirements, acceptance criteria, telemetry, risks, and a sequenced delivery path."].join(`
-`),toolPolicy:{mode:"default",allow:["Read","Glob","Grep","LS","Write","Edit","WebSearch","WebFetch","Think","AskUser","Skill"]},skills:["verify"],evidence:["sources","file-references","diff"],currentTurnApproval:["send","publish","change-infrastructure"],color:"cyan",glyph:"\u25A3",tags:["product","planning"]}),F({id:"ci",displayName:"CI Engineer",description:"Continuous-integration specialist for reproducing, repairing, and hardening automated gates.",prompt:["Identify the exact failing job and command. Reproduce it locally or in an equivalent immutable environment before patching.","Fix only the underlying failure, retain logs as evidence, and rerun the matching gate before broader validation."].join(`
-`),toolPolicy:{mode:"default"},skills:["ci-repair","debug","run","verify"],permissionProfile:"trusted-dev",soul:"learn",evidence:["tests","typecheck","build","diff"],currentTurnApproval:["push","deploy","change-infrastructure"],color:"green",glyph:"\u25A4",tags:["engineering","ci","automation"]}),F({id:"devops",displayName:"DevOps and Release",description:"Dry-run-first infrastructure and release specialist with explicit external-action gates.",prompt:["Inspect the release or infrastructure contract first. Build an immutable candidate and produce reproducible evidence.","Default to plan, preview, dry-run, and local verification. Never publish, deploy, push, sign, purchase, or mutate infrastructure unless the current user turn explicitly authorizes that exact action and target.","For releases, preserve SDK-before-CLI dependency order and verify the public artifact after publication."].join(`
-`),toolPolicy:{mode:"default"},skills:["release","run","verify"],permissionProfile:"default",memoryScope:"project",soul:"learn",isolation:"worktree",defaultMode:"plan",defaultDryRun:!0,evidence:["tests","build","diff","deployment-proof","human-review"],humanReview:!0,currentTurnApproval:["publish","deploy","push","purchase","sign","change-infrastructure"],color:"yellow",glyph:"\u2B22",tags:["devops","release","infrastructure"]}),F({id:"legal-research",displayName:"Legal Research",description:"Restricted legal-information researcher that produces sourced analysis for qualified human review.",prompt:["Identify jurisdiction, effective date, parties, and the precise legal question before analyzing it.","Use current primary legal sources wherever possible. Cite each material proposition and distinguish law, interpretation, uncertainty, and practical next steps.","Provide legal information, not professional representation. Never sign, file, submit, contact a party, accept terms, or make a payment."].join(`
-`),toolPolicy:{mode:"readOnly"},skills:["verify"],permissionProfile:"default",memoryScope:"session",soul:"disabled",allowedModes:["chat","plan","review"],defaultMode:"review",evidence:["sources","human-review"],primarySources:!0,currentInformation:!0,humanReview:!0,externalDefault:"deny",color:"red",glyph:"\xA7",tags:["legal","research","restricted","read-only"],stopConditions:["The jurisdiction or effective date is unknown and materially changes the answer.","The task requires legal representation, filing, signature, payment, or contact with a third party.","The sourced analysis is complete and clearly marked for qualified human review."]})];var dn=1,T=class extends Error{constructor(r,n,o){super(n);this.code=r;this.detail=o;this.name="XenoCapabilityLeaseError"}code;detail},Ea=new Set(["filesystem-write","process-execute","network-connect","secret-use","external-action","browser-act","computer-act"]),va=new Set(Ct),Sa=new Set(["filesystem-read","filesystem-write","process-execute","network-connect","secret-use","external-action","browser-read","browser-act","computer-observe","computer-act","tool-invoke"]),Ta=new Set(["cli","hub","ide","api","hosted"]),Ca=/^[a-f0-9]{64}$/;function xa(e,t){ln(e);let r=e.scope,n=r.governingToolName??e.subject.toolName;if(r.kind!=="external-action"){if(!n)return{eligible:!1,approvalRequirement:"principal",reason:"Non-external capability requests must identify the governing tool."};let o=Ra(t,n,r.effect);if(!o.eligible)return o}if(t.capabilities.permissionProfile==="read-only"&&r.effect!=="read")return{eligible:!1,approvalRequirement:"principal",reason:"The active read-only permission profile cannot request mutating, executable, or external authority."};if(r.kind==="external-action"){let o=r.externalAction;if(!o)return{eligible:!1,approvalRequirement:"current-turn",reason:"External-action capability requests require an exact action."};let i=t.capabilities.externalActions,a=i.overrides?.[o]??i.default;if(a==="deny")return{eligible:!1,approvalRequirement:"current-turn",profileDecision:a,reason:`Agent Profile ${t.profile.id} denies external action ${o}.`};let s=a==="ask"||i.requireCurrentTurnApproval.includes(o);return s&&!e.subject.turnId?{eligible:!1,approvalRequirement:"current-turn",profileDecision:a,reason:`External action ${o} requires a subject turn ID for current-turn approval.`}:{eligible:!0,approvalRequirement:s?"current-turn":"principal",profileDecision:a,reason:s?`External action ${o} requires approval in the active turn.`:`External action ${o} is requestable but still requires a bounded lease approval.`}}return{eligible:!0,approvalRequirement:"principal",reason:`Capability ${r.kind} is requestable within Agent Profile ${t.profile.id}.`}}function ln(e){if(!e||typeof e!="object")throw g("Capability lease request must be an object");if(k(e.subject?.runId,"subject.runId"),k(e.subject?.agentId,"subject.agentId"),e.subject?.turnId!==void 0&&k(e.subject.turnId,"subject.turnId"),k(e.reason,"reason",8192),te(e.requestedBy,"requestedBy"),_a(e.scope),e.policyFingerprints?.forEach(t=>He(t,"policyFingerprints")),e.maxUses!==void 0&&(!Number.isInteger(e.maxUses)||e.maxUses<1))throw g("maxUses must be a positive integer");if(e.durationMs!==void 0&&(!Number.isSafeInteger(e.durationMs)||e.durationMs<1))throw g("durationMs must be a positive safe integer");if(e.requestTtlMs!==void 0&&(!Number.isSafeInteger(e.requestTtlMs)||e.requestTtlMs<1))throw g("requestTtlMs must be a positive safe integer")}var je=class e{leases=new Map;now;idFactory;maximumDurationMs;maximumRequestTtlMs;maximumUses;idCounter=0;constructor(t={}){this.now=t.now??(()=>new Date().toISOString()),this.idFactory=t.idFactory??(()=>`lease_${Date.now().toString(36)}_${(++this.idCounter).toString(36)}`),this.maximumDurationMs=t.maximumDurationMs??15*6e4,this.maximumRequestTtlMs=t.maximumRequestTtlMs??5*6e4,this.maximumUses=t.maximumUses??100}static fromPersistedLease(t,r={}){Pa(t);let n=new e(r);return n.leases.set(t.leaseId,W(t)),n}request(t,r){let n=xa(t,r);if(!n.eligible)throw new T("LEASE_NOT_REQUESTABLE",n.reason);let o=t.leaseId??this.idFactory();if(k(o,"leaseId"),this.leases.has(o))throw new T("LEASE_CONFLICT",`Capability lease ${o} already exists`);let i=this.now(),a=Math.min(t.durationMs??6e4,this.maximumDurationMs),s=Math.min(t.requestTtlMs??5*6e4,this.maximumRequestTtlMs),c=Math.min(t.maxUses??1,this.maximumUses),d={schemaVersion:dn,leaseId:o,version:1,state:"requested",subject:Na(t.subject),scope:ka(t.scope),reason:t.reason,requestedAt:i,requestExpiresAt:cn(i,s),durationMs:a,maxUses:c,useCount:0,childInheritance:t.childInheritance??"none",approvalRequirement:n.approvalRequirement,requestedBy:{...t.requestedBy},profileFingerprint:r.fingerprint,policyFingerprints:ee(t.policyFingerprints??[]),...t.auditEventIds?{auditEventIds:ee(t.auditEventIds)}:{},...t.evidenceArtifactIds?{evidenceArtifactIds:ee(t.evidenceArtifactIds)}:{}};return this.leases.set(o,d),W(d)}approve(t){let r=this.requireMutable(t.leaseId);if(this.assertVersion(r,t.expectedVersion),this.refreshState(r),r.state!=="requested")throw new T("LEASE_CONFLICT",`Capability lease ${r.leaseId} is ${r.state}`);if(te(t.approvedBy,"approvedBy"),un(t.approvalContext),r.approvalRequirement==="current-turn"&&(!r.subject.turnId||t.approvalContext.turnId!==r.subject.turnId))throw new T("LEASE_APPROVAL_REQUIRED","Capability lease requires approval bound to the requesting turn");let n=this.now();return r.state="active",r.version+=1,r.activatedAt=n,r.expiresAt=cn(n,r.durationMs),r.approvedBy={...t.approvedBy},r.approvalContext={...t.approvalContext},W(r)}deny(t){let r=this.requireMutable(t.leaseId);if(this.assertVersion(r,t.expectedVersion),this.refreshState(r),r.state!=="requested")throw new T("LEASE_CONFLICT",`Capability lease ${r.leaseId} is ${r.state}`);return te(t.deniedBy,"deniedBy"),r.state="denied",r.version+=1,r.deniedAt=this.now(),r.deniedBy={...t.deniedBy},W(r)}revoke(t){let r=this.requireMutable(t.leaseId);if(this.assertVersion(r,t.expectedVersion),this.refreshState(r),r.state!=="active")throw new T("LEASE_CONFLICT",`Only active leases can be revoked; ${r.leaseId} is ${r.state}`);return te(t.revokedBy,"revokedBy"),r.state="revoked",r.version+=1,r.revokedAt=this.now(),r.revokedBy={...t.revokedBy},W(r)}consume(t,r,n){let o=this.requireMutable(t);if(this.assertVersion(o,r),this.refreshState(o),o.state==="requested")throw new T("LEASE_APPROVAL_REQUIRED",`Capability lease ${t} is not approved`);if(o.state==="expired")throw new T("LEASE_EXPIRED",`Capability lease ${t} expired`);if(o.state==="revoked")throw new T("LEASE_REVOKED",`Capability lease ${t} was revoked`);if(o.state==="exhausted")throw new T("LEASE_EXHAUSTED",`Capability lease ${t} is exhausted`);if(o.state!=="active")throw new T("LEASE_SCOPE_MISMATCH",`Capability lease ${t} is ${o.state}`);return Oa(o,n),o.useCount+=1,o.version+=1,o.useCount>=o.maxUses&&(o.state="exhausted",o.exhaustedAt=this.now()),W(o)}get(t){let r=this.leases.get(t);if(r)return this.refreshState(r),W(r)}list(t){let r=[];for(let n of this.leases.values())this.refreshState(n),!(t?.runId&&n.subject.runId!==t.runId)&&(t?.agentId&&n.subject.agentId!==t.agentId||t?.turnId&&n.subject.turnId!==t.turnId||r.push(W(n)));return r.sort((n,o)=>n.requestedAt.localeCompare(o.requestedAt)||n.leaseId.localeCompare(o.leaseId))}requireMutable(t){let r=this.leases.get(t);if(!r)throw new T("LEASE_NOT_FOUND",`Capability lease ${t} was not found`);return r}assertVersion(t,r){if(t.version!==r)throw new T("LEASE_CONFLICT",`Expected capability lease version ${r}, found ${t.version}`,{leaseId:t.leaseId,expectedVersion:r,actualVersion:t.version})}refreshState(t){let r=Date.parse(this.now()),n=t.state==="requested"?Date.parse(t.requestExpiresAt):Date.parse(t.expiresAt??"");(t.state==="requested"||t.state==="active")&&Number.isFinite(n)&&r>=n&&(t.state="expired",t.version+=1,t.expiredAt=this.now())}};function Pa(e){if(!e||typeof e!="object"||Array.isArray(e)||JSON.stringify(e).length>65536)throw g("Invalid persisted lease row");let t=e;if(t.schemaVersion!==dn)throw g("Unsupported persisted lease schema");if(ln(t),k(t.leaseId,"leaseId"),He(t.profileFingerprint,"profileFingerprint"),!Array.isArray(t.policyFingerprints))throw g("policyFingerprints must be an array");if(t.policyFingerprints.forEach(r=>He(r,"policyFingerprint")),!Number.isSafeInteger(t.durationMs)||t.durationMs<1||!Number.isSafeInteger(t.maxUses)||t.maxUses<1)throw g("Invalid persisted lease limits");if(!Number.isSafeInteger(t.version)||t.version<1||!Number.isSafeInteger(t.useCount)||t.useCount<0||t.useCount>t.maxUses)throw g("Invalid persisted lease counters");if(!["requested","active","denied","revoked","expired","exhausted"].includes(t.state))throw g("Invalid persisted lease state");if(!["principal","current-turn"].includes(t.approvalRequirement)||!["none","explicit"].includes(t.childInheritance))throw g("Invalid persisted lease authority");for(let r of["requestedAt","requestExpiresAt","activatedAt","expiresAt","expiredAt","deniedAt","revokedAt","exhaustedAt"])if((r==="requestedAt"||r==="requestExpiresAt"||t[r]!==void 0)&&(typeof t[r]!="string"||!Number.isFinite(Date.parse(t[r]))))throw g(`Invalid persisted ${r}`);if(Date.parse(t.requestExpiresAt)<=Date.parse(t.requestedAt))throw g("Invalid persisted request expiry");if(["active","revoked","exhausted"].includes(t.state)||t.useCount>0){if(!t.activatedAt||!t.expiresAt||!t.approvedBy||!t.approvalContext||t.version<2)throw g("Persisted approval is incomplete");if(te(t.approvedBy,"approvedBy"),un(t.approvalContext),Date.parse(t.expiresAt)!==Date.parse(t.activatedAt)+t.durationMs)throw g("Persisted expiry does not match approved duration");if(t.approvalRequirement==="current-turn"&&(!t.subject.turnId||t.approvalContext.turnId!==t.subject.turnId))throw g("Persisted turn approval does not match")}if(t.state==="requested"&&(t.version!==1||t.useCount!==0||t.approvedBy))throw g("Invalid requested lease");if(t.state==="active"&&t.useCount>=t.maxUses)throw g("Active lease is exhausted");if(t.state==="exhausted"&&t.useCount!==t.maxUses)throw g("Invalid exhausted lease");if(t.state==="revoked"){if(!t.revokedAt||!t.revokedBy)throw g("Missing revocation");te(t.revokedBy,"revokedBy")}if(t.state==="denied"){if(!t.deniedAt||!t.deniedBy)throw g("Missing denial");te(t.deniedBy,"deniedBy")}if(t.state==="expired"&&!t.expiredAt)throw g("Missing expiry transition")}function Ra(e,t,r){let n=e.capabilities.tools,o=t.trim().toLowerCase(),i=a=>a?.some(s=>s==="*"||s.trim().toLowerCase()===o)??!1;return n.mode==="none"||i(n.deny)?{eligible:!1,approvalRequirement:"principal",reason:`Agent Profile ${e.profile.id} denies tool ${t}.`}:n.allow&&!i(n.allow)?{eligible:!1,approvalRequirement:"principal",reason:`Tool ${t} is outside the Agent Profile allowlist.`}:n.mode==="readOnly"&&r!=="read"?{eligible:!1,approvalRequirement:"principal",reason:`Tool ${t} cannot request ${r} authority in read-only mode.`}:{eligible:!0,approvalRequirement:"principal",reason:`Tool ${t} is requestable.`}}function _a(e){if(!e||typeof e!="object")throw g("scope is required");if(k(e.kind,"scope.kind"),!Sa.has(e.kind)&&!e.kind.startsWith("custom:"))throw g("scope.kind is not supported");if(e.kind.startsWith(Oe)&&!he(e.kind))throw g("Custom capability kind is invalid");if(!["read","write","execute","external"].includes(e.effect))throw g("scope.effect is invalid");let t={"filesystem-read":"read","filesystem-write":"write","process-execute":"execute","network-connect":"external","secret-use":"external","external-action":"external","browser-read":"read","browser-act":"external","computer-observe":"read","computer-act":"external"};if(t[e.kind]&&t[e.kind]!==e.effect)throw g(`${e.kind} capability scopes must use ${t[e.kind]} effect`);if(!Array.isArray(e.operations)||e.operations.length===0)throw g("scope.operations must contain at least one operation");if(e.operations.forEach(r=>k(r,"scope.operations")),e.resources?.forEach(r=>k(r,"scope.resources",8192)),e.destinations?.forEach(r=>k(r,"scope.destinations",8192)),e.secretIds?.forEach(r=>k(r,"scope.secretIds",512)),e.kind==="external-action"){if(!e.externalAction||!va.has(e.externalAction))throw g("External-action scopes require a supported exact action");if(e.effect!=="external")throw g("External-action scopes must use external effect")}if(e.kind==="network-connect"&&(!e.destinations||e.destinations.length===0))throw g("Network capability scopes require at least one destination");if(e.kind==="secret-use"&&(!e.secretIds||e.secretIds.length===0))throw g("Secret capability scopes require at least one secret ID");if(Ea.has(e.kind)&&[...e.resources??[],...e.destinations??[],...e.secretIds??[]].some(n=>n.includes("*")))throw g("High-impact capability scopes cannot use wildcard resources")}function Oa(e,t){let r=e.subject;if(r.runId!==t.subject.runId||r.agentId!==t.subject.agentId)throw _(e,"run or agent subject");if(r.turnId&&r.turnId!==t.subject.turnId)throw _(e,"turn subject");if(r.toolName&&r.toolName!==t.subject.toolName)throw _(e,"tool subject");if(r.operationId&&r.operationId!==t.subject.operationId)throw _(e,"operation subject");if(e.scope.kind!==t.kind)throw _(e,"capability kind");if(!e.scope.operations.includes(t.operation))throw _(e,"operation");if(e.scope.resources?.length&&!t.resource)throw _(e,"resource");if(e.scope.destinations?.length&&!t.destination)throw _(e,"destination");if(e.scope.secretIds?.length&&!t.secretId)throw _(e,"secret");if(e.scope.externalAction&&!t.externalAction)throw _(e,"external action");if(t.resource&&!e.scope.resources?.includes(t.resource))throw _(e,"resource");if(t.destination&&!e.scope.destinations?.includes(t.destination))throw _(e,"destination");if(t.secretId&&!e.scope.secretIds?.includes(t.secretId))throw _(e,"secret");if(t.externalAction&&e.scope.externalAction!==t.externalAction)throw _(e,"external action")}function un(e){if(!e||typeof e!="object")throw g("approvalContext is required");if(k(e.surface,"approvalContext.surface"),!Ta.has(e.surface)&&!e.surface.startsWith("custom:"))throw g("approvalContext.surface is not supported");if(e.surface.startsWith(Oe)&&!he(e.surface))throw g("Custom approval surface is invalid");e.promptHash!==void 0&&He(e.promptHash,"approvalContext.promptHash")}function te(e,t){if(!e||typeof e!="object")throw g(`${t} is required`);if(!["agent","tool","user","system","integration"].includes(e.kind))throw g(`${t}.kind is invalid`);k(e.id,`${t}.id`)}function He(e,t){if(!Ca.test(e))throw g(`${t} must be a 64-character lowercase hexadecimal fingerprint`)}function k(e,t,r=1024){if(typeof e!="string"||e.trim().length===0||e.length>r)throw g(`${t} must be a non-empty string no longer than ${r} characters`)}function g(e){return new T("LEASE_INVALID",e)}function _(e,t){return new T("LEASE_SCOPE_MISMATCH",`Capability use is outside lease ${e.leaseId} ${t} scope`)}function cn(e,t){return new Date(Date.parse(e)+t).toISOString()}function ee(e){return[...new Set(e)]}function Na(e){return{...e}}function ka(e){return{...e,operations:ee(e.operations),...e.resources?{resources:ee(e.resources)}:{},...e.destinations?{destinations:ee(e.destinations)}:{},...e.secretIds?{secretIds:ee(e.secretIds)}:{}}}function W(e){return structuredClone(e)}import{createHash as Xa,randomUUID as Da}from"node:crypto";var La=8*1024*1024,Ma=4;function fn(e){return Ka(e.operations??le).map(r=>Ua(r,e.runtime))}function Ua(e,t){return{definition:{name:e,description:ja(e),input_schema:$a(e)},projectPolicyInput(r){let n=Wa(e,r),o=Ga(e,r);return{observabilityInput:n,permissionInput:o,permissionPreview:Ja(e,r),approvalKey:`xeno-automation:${e}:${Ya(r)}`,riskLevel:Ha(e)}},async execute(r,n){let o=n?.authorization;if(!o||o.toolName!==e)return{success:!1,output:"",error:"Governed automation requires a host-issued authorization receipt",errorCode:"AUTOMATION_AUTHORIZATION_RECEIPT_REQUIRED",retryable:!1};let i=n.operationId??`automation_${Da()}`,a=Pt(e,r);n.reportProgress?.({activity:"state",message:`Authorizing ${e}`});try{let s=await t.execute({operation:e,governingToolName:e,operationId:i,idempotencyKey:i,parameters:structuredClone(r),...a?{declaredTarget:a}:{},authorization:o,...n.signal?{signal:n.signal}:{},...n.reportProgress?{reportProgress:n.reportProgress}:{}}),c=s.status==="ok";return{success:c,output:JSON.stringify(qa(s)),...c?{}:{error:s.error?.message??`Governed automation ended with ${s.status}`,errorCode:s.error?.code??`AUTOMATION_${s.status.toUpperCase().replaceAll("-","_")}`},assistantContent:za(s),evidence:s.artifacts.map(d=>({id:d.artifactId,kind:"artifact",status:s.status==="evidence-incomplete"?"failed":"verified",observedAt:d.updatedAt??d.createdAt,operationId:i,detail:{artifact_kind:d.kind,revision:d.revision,sensitivity:d.sensitivity}})),retryable:s.error?.retryable??!1}}catch(s){let c=n.signal?.aborted===!0;return{success:!1,output:"",error:c?"Governed automation was stopped":Za(s),errorCode:c?"AUTOMATION_CANCELLED":Qa(s),retryable:!c}}}}}function $a(e){let t=Ba(e),r=Fa(e);return{type:"object",properties:t,...r.length>0?{required:r}:{},...e==="browser.locate"?{oneOf:[{required:["selector"]},{required:["text"]}]}:{},additionalProperties:!1}}function Ba(e){let t=(a,s=8192)=>({type:"string",minLength:1,maxLength:s,description:a}),r={type:"number"},n={type:"boolean"},o={type:"object",properties:{x:r,y:r},required:["x","y"],additionalProperties:!1},i={deviceId:t("Target xeno-use device ID.",256),applicationId:t("Expected or launch-target application ID.",512),displayId:t("Target display ID.",256)};switch(e){case"browser.navigate":return{url:t("Destination URL."),waitUntil:{enum:["load","none"]},tabId:t("Expected active tab ID. Hosts with multiple visible tabs should require this.",256)};case"browser.wait":return{until:{enum:["load","ms"]},value:{type:"integer",minimum:0,maximum:6e4}};case"browser.snapshot":return{mode:{enum:["text","html","markdown","a11y"]},tabId:t("Expected active tab ID.",256)};case"browser.screenshot":return{tabId:t("Expected active tab ID.",256)};case"browser.locate":return{selector:t("CSS selector."),text:t("Visible text to locate.")};case"browser.click":return{selector:t("CSS selector returned by browser.snapshot or browser.locate."),tabId:t("Expected active tab ID.",256)};case"browser.type":return{selector:t("CSS selector."),text:{type:"string",maxLength:65536},clear:n,submit:n,tabId:t("Expected active tab ID.",256)};case"browser.key":return{combo:t("Key combo such as Control+a or Enter.",256),tabId:t("Expected active tab ID.",256)};case"browser.select":return{selector:t("CSS selector."),value:t("Option value."),tabId:t("Expected active tab ID.",256)};case"browser.scroll":return{selector:t("Optional CSS selector."),dx:r,dy:r,tabId:t("Expected active tab ID.",256)};case"browser.tabs.open":return{url:t("URL to open in an isolated browser tab.")};case"browser.tabs.close":return{tabId:t("Tab ID to close.",256)};case"browser.console.read":case"browser.network.read":case"browser.page-errors.read":return{limit:{type:"integer",minimum:1,maximum:1e3},clear:n,tabId:t("Expected active tab ID.",256)};case"browser.storage.read":return{tabId:t("Expected active tab ID.",256)};case"browser.upload":return{selector:t("File input or drop-target selector."),backendNodeId:{type:"integer",minimum:1},hostPaths:{type:"array",items:t("Host file path.",32768),minItems:1,maxItems:64},drop:n,tabId:t("Expected active tab ID.",256)};case"browser.download":return{toPath:t("Approved destination path.",32768),trigger:{type:"object",properties:{url:t("Download URL."),selector:t("Download trigger selector.")},oneOf:[{required:["url"]},{required:["selector"]}],additionalProperties:!1},tabId:t("Expected active tab ID.",256)};case"browser.record.start":return{maxDurationMs:{type:"integer",minimum:1e3,maximum:6e4},intervalMs:{type:"integer",minimum:100,maximum:5e3},tabId:t("Expected active tab ID.",256)};case"browser.record.stop":return{tabId:t("Expected active tab ID.",256)};case"computer.observe":case"computer.screenshot":case"computer.window-state":return i;case"computer.point":return{...i,point:o,durationMs:{type:"integer",minimum:0,maximum:6e4}};case"computer.click":return{...i,point:o,button:{enum:["left","right","middle"]},modifiers:Va()};case"computer.double-click":case"computer.right-click":return{...i,point:o};case"computer.drag":return{...i,from:o,to:o,durationMs:{type:"integer",minimum:0,maximum:6e4}};case"computer.type":return{...i,text:{type:"string",maxLength:65536}};case"computer.key":return{...i,combo:t("Key combo such as Control+a or Enter.",256)};case"computer.scroll":return{...i,at:o,delta:o};case"computer.wait":return{...i,milliseconds:{type:"integer",minimum:0,maximum:3e5}};case"computer.launch":return{...i,applicationId:t("Explicitly allowlisted application ID.",512)};case"browser.back":case"browser.forward":case"browser.reload":return{tabId:t("Expected active tab ID.",256)};case"browser.tabs.list":return{}}}function Fa(e){switch(e){case"browser.navigate":case"browser.tabs.open":return["url"];case"browser.click":return["selector"];case"browser.type":return["selector","text"];case"browser.key":return["combo"];case"browser.select":return["selector","value"];case"browser.upload":return["hostPaths"];case"browser.download":return["toPath","trigger"];case"computer.point":case"computer.click":case"computer.double-click":case"computer.right-click":return["point"];case"computer.drag":return["from","to"];case"computer.type":return["text"];case"computer.key":return["combo"];case"computer.scroll":return["at","delta"];case"computer.launch":return["applicationId"];default:return[]}}function Va(){return{type:"object",properties:{shift:{type:"boolean"},ctrl:{type:"boolean"},alt:{type:"boolean"},meta:{type:"boolean"}},additionalProperties:!1}}function ja(e){let t=X(e),r=e.split(".").slice(1).join(" ");return`${t.effect==="act"?"Act on":"Inspect"} the ${t.surface} using governed ${r} automation. The host requires policy approval, an exact capability lease, target-bound preflight, and durable evidence.`}function Ha(e){return X(e).effect==="observe"?e==="browser.navigate"||e==="browser.tabs.open"?"medium":"low":["browser.type","browser.upload","browser.download","computer.type","computer.key","computer.launch"].includes(e)?"high":"medium"}function Ga(e,t){let r=Pt(e,t),n={operation:e};r&&(n.target=r);for(let o of["selector","clear","submit","combo","value","dx","dy","point","from","to","at","delta","milliseconds"])t[o]!==void 0&&(n[o]=structuredClone(t[o]));return typeof t.text=="string"&&(n.text=`[redacted ${t.text.length} characters]`),Array.isArray(t.hostPaths)&&(n.hostPaths=t.hostPaths.map(()=>"[redacted host path]")),typeof t.toPath=="string"&&(n.toPath="[redacted destination path]"),n}function Wa(e,t){let r=structuredClone(t);return typeof r.text=="string"&&(r.text=`[redacted ${r.text.length} characters]`),Array.isArray(r.hostPaths)&&(r.hostPaths=r.hostPaths.map(()=>"[redacted host path]")),typeof r.toPath=="string"&&(r.toPath="[redacted destination path]"),mn(r.trigger)&&typeof r.trigger.url=="string"&&(r.trigger={...r.trigger,url:pn(r.trigger.url)}),typeof r.url=="string"&&(r.url=pn(r.url)),{operation:e,...r}}function Ja(e,t){let r=Pt(e,t),n=r?.url??r?.applicationId??r?.deviceId??r?.tabId??r?.resource??"current target";return`${e} on ${n}`}function Pt(e,t){let r={};return typeof t.url=="string"&&(r.url=t.url),typeof t.tabId=="string"&&(r.tabId=t.tabId),typeof t.deviceId=="string"&&(r.deviceId=t.deviceId),typeof t.applicationId=="string"&&(r.applicationId=t.applicationId),typeof t.displayId=="string"&&(r.displayId=t.displayId),(e==="browser.navigate"||e==="browser.tabs.list"||e==="browser.tabs.open")&&(r.resource="browser-tabs"),Object.keys(r).length>0?r:void 0}function qa(e){return{operationId:e.operationId,status:e.status,effect:e.effect,startedAt:e.startedAt,completedAt:e.completedAt,adapter:e.adapter,target:e.target,...e.data!==void 0?{data:e.data}:{},artifacts:e.artifacts.map(t=>({artifactId:t.artifactId,revision:t.revision,kind:t.kind,title:t.title,state:t.state,mediaType:t.mediaType,sensitivity:t.sensitivity,hash:t.content.hash,sizeBytes:t.content.sizeBytes})),lease:e.lease,...e.error?{error:e.error}:{}}}function za(e){let t=[];for(let r of e.artifacts){if(t.length>=Ma||!r.mediaType.startsWith("image/"))continue;let n=r.content.storage;if(n.type!=="inline"||typeof n.base64!="string")continue;let o=Math.floor(n.base64.length*.75);o<=0||o>La||t.push({type:"image_url",image_url:{url:`data:${r.mediaType};base64,${n.base64}`,detail:"high"}})}return t}function Ka(e){let t=new Set(le),r=new Set;for(let n of e){if(!t.has(n))throw new TypeError(`Unsupported XENO automation operation: ${String(n)}`);r.add(n)}return Array.from(r)}function Ya(e){return Xa("sha256").update(xt(e)).digest("hex")}function xt(e){return Array.isArray(e)?`[${e.map(xt).join(",")}]`:mn(e)?`{${Object.keys(e).sort().map(t=>`${JSON.stringify(t)}:${xt(e[t])}`).join(",")}}`:JSON.stringify(e)??"null"}function pn(e){try{let t=new URL(e);return`${t.origin}${t.pathname}`}catch{return"[invalid URL]"}}function Za(e){return e instanceof Error?e.message:String(e)}function Qa(e){return e&&typeof e=="object"&&"code"in e&&typeof e.code=="string"?e.code:"AUTOMATION_EXECUTION_FAILED"}function mn(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}var wn=[...Be],ts=wn.filter(e=>!["browser.storage.read","browser.upload","browser.download"].includes(e)),rs=le.filter(e=>e.startsWith("computer.")),Rt=6e4,_t=class{constructor(t){this.options=t;this.environment=t.environment??bn()}options;leases=new je({maximumDurationMs:Rt,maximumUses:1});activeExecutors=new Map;environment;browserAdapter;computerAdapter;register(t){if(this.options.safeMode)return 0;let r=[];return Ot(this.environment.browser)&&r.push(...as(this.environment.browser.driver)),Nt(this.environment.computer)&&r.push(...rs),r.length===0?0:(t.registerAll(fn({runtime:this,operations:r})),r.length)}async execute(t){if(this.options.safeMode)throw new Error("Governed automation is disabled in safe mode");gs(t);let r=X(t.operation),n=this.options.profile(),o={runId:this.options.runId,agentId:this.options.agentId??"agent-main",...this.options.sessionId?{sessionId:this.options.sessionId}:{},turnId:t.authorization.turnId,...this.options.workspaceId?{workspaceId:this.options.workspaceId}:{}},i=ps(t.operation,t.declaredTarget,this.environment),a=r.surface==="browser"?r.effect==="act"?"browser-act":"browser-read":r.effect==="act"?"computer-act":"computer-observe",s=r.effect==="act"?"external":"read",c=fs(i),d=ms(i),A=this.leases.request({subject:{...o,toolName:t.governingToolName,operationId:t.operationId},scope:{kind:a,effect:s,operations:[t.operation],...c?{resources:[c]}:{},...d?{destinations:[d]}:{},governingToolName:t.governingToolName},reason:`${t.operation} authorized by the CLI policy and permission layers`,requestedBy:{kind:"agent",id:o.agentId,profileFingerprint:n.fingerprint},durationMs:Rt,requestTtlMs:3e4,maxUses:1,childInheritance:"none",policyFingerprints:[n.fingerprint]},n),y=this.leases.approve({leaseId:A.leaseId,expectedVersion:A.version,approvedBy:{kind:"integration",id:`xeno-${this.options.surface}-permission-engine`,displayName:`XENO ${this.options.surface.toUpperCase()} permission engine`},approvalContext:{surface:this.options.surface,turnId:t.authorization.turnId,messageId:t.authorization.toolCallId}}),m=await this.adapterFor(r.surface),w=ar({contractId:`contract-${t.operationId}`,identity:o,policy:this.securityPolicy(),profile:n,...this.options.securityStatus?{adapterStatus:this.options.securityStatus}:{},filesystem:{readRoots:[ve(this.options.cwd())],writeRoots:[ve(this.options.cwd())],executeRoots:[ve(this.options.cwd())]},network:us(i,this.environment),browser:r.surface==="browser"?ds(r.effect,i,this.environment):{mode:"none"},computer:r.surface==="computer"?ls(r.effect,this.environment):{mode:"none"},capabilityLeaseIds:[y.leaseId],expiresAt:new Date(Date.now()+Rt).toISOString()});await this.audit({eventType:"automation_lease_approved",traceId:t.authorization.turnId,operation:t.operation,operationId:t.operationId,leaseId:y.leaseId,contractFingerprint:w.fingerprint,permissionReason:t.authorization.permission.reason});let h=new Me({adapter:m,leaseAuthority:this.leases,artifactRepository:new Fe({directory:ve(this.options.cwd(),".xeno","artifacts")})});this.activeExecutors.set(t.operationId,h),t.reportProgress?.({activity:"state",message:`Executing governed ${t.operation}`});try{let b=await h.execute({protocolVersion:1,operationId:t.operationId,idempotencyKey:t.idempotencyKey,requestedAt:new Date().toISOString(),identity:o,governingToolName:t.governingToolName,operation:t.operation,parameters:hs(t.parameters),...i?{declaredTarget:i}:{},executionContract:w,capabilityLeaseId:y.leaseId,expectedLeaseVersion:y.version},t.signal);return await this.audit({eventType:b.status==="ok"?"automation_completed":"automation_failed",traceId:t.authorization.turnId,operation:t.operation,operationId:t.operationId,leaseId:y.leaseId,contractFingerprint:w.fingerprint,status:b.status,artifactIds:b.artifacts.map(C=>C.artifactId)}),b}catch(b){throw await this.audit({eventType:"automation_failed",traceId:t.authorization.turnId,operation:t.operation,operationId:t.operationId,leaseId:y.leaseId,contractFingerprint:w.fingerprint,status:b instanceof Error?b.name:"error"}),b}finally{this.activeExecutors.delete(t.operationId)}}async stop(t,r="human-stop"){let n=this.activeExecutors.get(t);return n?n.stop(t,r):!1}securityPolicy(){let t=this.options.securityPolicy?.();if(t)return t;let r=ve(this.options.cwd());return{allowedDirectories:[r],workingDirectory:r,capabilities:{terminal:!0,fileRead:!0,fileWrite:!0,appLaunch:!0},executionLevel:"policy-only",trustMode:"trusted-workspace",allowNetwork:!1}}adapterFor(t){if(t==="browser"){let n=this.environment.browser;if(!Ot(n))throw new Error(vn(n));return this.browserAdapter??=new Ee({baseUrl:n.baseUrl,token:n.token,driver:n.driver}),this.browserAdapter}let r=this.environment.computer;if(!Nt(r))throw new Error(Sn(r));return this.computerAdapter??=En(r),this.computerAdapter}async audit(t){try{await this.options.onAudit?.(t)}catch{}}};function al(e){return new _t(e)}function sl(e){if(e)return async t=>{let r=X(t.operation).effect;await e.append({trace_id:t.traceId,event_type:t.eventType,actor:"system",risk_level:r==="act"?"high":"low",...t.eventType==="automation_lease_approved"?{decision:"allow"}:{},status:t.eventType==="automation_failed"?"error":"ok",...t.eventType==="automation_failed"&&t.status?{reason:t.status}:{},metadata:{operation:t.operation,operation_id:t.operationId,lease_id:t.leaseId,contract_fingerprint:t.contractFingerprint,result_status:t.status,artifact_ids:t.artifactIds,permission_reason:t.permissionReason}})}}async function cl(e=bn()){let t=await Promise.all([hn("browser",e),hn("computer",e)]);return{schemaVersion:1,protocolVersion:1,enabled:t.some(r=>r.configured),surfaces:t,docs:"docs/GOVERNED_AUTOMATION.md"}}function bn(e=process.env){let t=e.XENO_BROWSER_DRIVER==="extension"?"extension":"browser",r=os(e,t),n=U(e.XENO_BROWSER_AUTOMATION_URL)??r?.baseUrl,o=U(e.XENO_BROWSER_AUTOMATION_TOKEN)??r?.token,i=U(e.XENO_USE_BASE_URL),a=U(e.XENO_USE_TOKEN)??ns(e.XENO_USE_TOKEN_FILE),s=U(e.XENO_USE_DEVICE_ID);return{browser:{driver:t,...n?{baseUrl:n}:{},...o?{token:o}:{},readDomains:Ge(e.XENO_BROWSER_READ_DOMAINS),actDomains:Ge(e.XENO_BROWSER_ACT_DOMAINS),deniedDomains:Ge(e.XENO_BROWSER_DENIED_DOMAINS),ports:ys(e.XENO_BROWSER_ALLOWED_PORTS,[443]),allowLoopbackDevelopment:e.XENO_BROWSER_ALLOW_LOOPBACK_DEVELOPMENT==="1",uploads:An(e.XENO_BROWSER_UPLOADS,"prompt"),downloads:An(e.XENO_BROWSER_DOWNLOADS,"prompt"),recording:e.XENO_BROWSER_RECORDING==="bounded"?"bounded":"disabled"},computer:{...i?{baseUrl:i}:{},...a?{token:a}:{},...s?{deviceId:s}:{},allowedApplications:Ge(e.XENO_USE_ALLOWED_APPLICATIONS)}}}function ns(e){let t=U(e);if(!(!t||!yn(t)))try{return U(In(t,"utf8"))}catch{return}}function os(e,t){let n=U(e.XENO_BROWSER_SESSION_FILE)??(t==="extension"?U(e.XENO_EXTENSION_SESSION_FILE)??gn(es(),".xeno","use-drivers","xeno-extension.json"):U(e.XENO_SESSION_FILE)??(e.APPDATA?gn(e.APPDATA,"xeno-browser","session.json"):void 0));if(!(!n||!yn(n)))try{let o=JSON.parse(In(n,"utf8")),i=Number(o.port),a=typeof o.token=="string"?o.token:"",s=typeof o.driver=="string"?o.driver:void 0;return!Number.isSafeInteger(i)||i<=0||i>65535||!is(a)||s&&s!==(t==="extension"?"xeno-extension-native":"xeno-browser-loopback")?void 0:{baseUrl:`http://127.0.0.1:${i}`,token:a}}catch{return}}function is(e){return e.length>=32&&e.length<=512&&!/\s/.test(e)}function as(e){return e==="extension"?[...ts]:[...wn]}async function hn(e,t){let r=e==="browser"?t.browser:t.computer,n=e==="browser"?Ot(t.browser):Nt(t.computer),o=!!r&&Object.values(r).some(i=>typeof i=="string"&&i.length>0);if(!n)return{surface:e,configured:!1,available:!1,certified:!1,operations:[],limitations:["Adapter credentials are not completely configured."],...o?{error:e==="browser"?vn(t.browser):Sn(t.computer)}:{}};try{let a=await(e==="browser"?new Ee({baseUrl:t.browser.baseUrl,token:t.browser.token,driver:t.browser.driver}):await En(t.computer)).manifest();return cs(e,a)}catch(i){return{surface:e,configured:!0,available:!1,certified:!1,operations:[],limitations:["Configured adapter is unavailable."],error:kt(i)}}}async function En(e){let t=await ss(),r=new t.Use({baseUrl:e.baseUrl,token:e.token});return new t.XenoUseComputerAutomationAdapter({use:r,...e.deviceId?{defaultDeviceId:e.deviceId}:{}})}async function ss(){try{let e="@xeno-use/sdk",t="@xeno-use/agent-sdk-pack",[r,n]=await Promise.all([import(e),import(t)]);if(typeof r.Use!="function"||typeof n.XenoUseComputerAutomationAdapter!="function")throw new Error("installed xeno-use packages do not expose the governed adapter contract");return{Use:r.Use,XenoUseComputerAutomationAdapter:n.XenoUseComputerAutomationAdapter}}catch(e){throw new Error(`Computer automation requires @xeno-use/sdk and @xeno-use/agent-sdk-pack: ${kt(e)}`)}}function cs(e,t){return{surface:e,configured:!0,available:!0,certified:t.certified,adapterId:t.adapterId,adapterVersion:t.adapterVersion,operations:[...t.operations],limitations:[...t.limitations]}}function ds(e,t,r){let n=r.browser,o=Tn(t),i=o&&!As(o.hostname)?o.hostname:void 0,a=We([...n.readDomains,...i?[i]:[]]),s=We([...n.actDomains,...e==="act"&&i?[i]:[]]),c=xn([...n.ports,...o?[Cn(o)]:[]]);return{mode:e==="act"?"act":"read",profile:"ephemeral",readAllowedDomains:a,actAllowedDomains:s,deniedDomains:n.deniedDomains,allowedSchemes:n.allowLoopbackDevelopment?["https","http"]:["https"],allowedPorts:c,redirectPolicy:"policy",allowLoopbackDevelopment:n.allowLoopbackDevelopment,uploads:n.uploads,downloads:n.downloads,recording:n.recording}}function ls(e,t){return{mode:e==="act"?"act":"observe",allowedApplications:t.computer?.allowedApplications??[],sensitiveRegionRedaction:!0,humanStopRequired:!0}}function us(e,t){let r=[],n=Tn(e);n&&r.push({scheme:n.protocol.replace(/:$/,""),host:n.hostname.toLowerCase(),port:Cn(n)});for(let o of We([...t.browser?.readDomains??[],...t.browser?.actDomains??[]]))if(!(o.startsWith(".")||o.includes("*")))for(let i of t.browser?.ports??[443])r.push({scheme:i===80?"http":"https",host:o,port:i});return{default:"deny",allowDestinations:Is(r)}}function ps(e,t,r){if(!e.startsWith("computer."))return t;let n=t?.deviceId??r.computer?.deviceId,o=t?.applicationId;if(!(!n&&!o&&!t))return{...t??{},...n?{deviceId:n}:{}}}function fs(e){return e?.resource??e?.tabId??e?.pageId??e?.deviceId??e?.applicationId}function ms(e){let t=e?.origin??e?.url;if(!t)return e?.domain;try{return new URL(t).origin}catch{return t}}function gs(e){let t=e.authorization;if(!t||t.toolName!==e.governingToolName||!t.permission.allowed||!t.policy.allowed)throw new Error("Automation authorization receipt does not match the governing tool")}function hs(e){try{return JSON.parse(JSON.stringify(e))}catch(t){throw new Error(`Automation parameters are not JSON serializable: ${kt(t)}`)}}function Ot(e){return!!e?.baseUrl&&!!e.token}function Nt(e){return!!e?.baseUrl&&!!e.token&&!!e.deviceId}function vn(e){return`Browser automation configuration is incomplete; missing ${[e?.baseUrl?"":"XENO_BROWSER_AUTOMATION_URL",e?.token?"":"XENO_BROWSER_AUTOMATION_TOKEN"].filter(Boolean).join(", ")}`}function Sn(e){return`Computer automation configuration is incomplete; missing ${[e?.baseUrl?"":"XENO_USE_BASE_URL",e?.token?"":"XENO_USE_TOKEN",e?.deviceId?"":"XENO_USE_DEVICE_ID"].filter(Boolean).join(", ")}`}function Tn(e){let t=e?.url??e?.origin;if(t)try{return new URL(t)}catch{return}}function Cn(e){return e.port?Number(e.port):e.protocol==="http:"?80:443}function As(e){let t=e.toLowerCase().replace(/^\[|\]$/g,"");return t==="localhost"||t==="127.0.0.1"||t==="::1"}function Ge(e){return We((e??"").split(",").map(t=>t.trim().toLowerCase()).filter(Boolean))}function ys(e,t){let r=(e??"").split(",").map(n=>Number(n.trim())).filter(n=>Number.isSafeInteger(n)&&n>0&&n<=65535);return r.length>0?xn(r):t}function An(e,t){return e==="deny"||e==="prompt"||e==="allow"?e:t}function U(e){let t=e?.trim();return t||void 0}function We(e){return[...new Set(e)]}function xn(e){return[...new Set(e)].sort((t,r)=>t-r)}function Is(e){let t=new Set;return e.filter(r=>{let n=`${r.scheme??""}:${r.host}:${r.port??""}`;return t.has(n)?!1:(t.add(n),!0)})}function kt(e){return e instanceof Error?e.message:String(e)}function dl(e){let t=["XENO governed automation",""];for(let r of e.surfaces){let n=r.configured?r.available?"available":"unavailable":"not configured",o=r.certified?"certified":"not release-certified";t.push(`${r.surface}: ${n}; ${o}`),r.adapterId&&t.push(`  adapter: ${r.adapterId}@${r.adapterVersion??"unknown"}`),r.operations.length>0&&t.push(`  operations: ${r.operations.length}`);for(let i of r.limitations)t.push(`  limitation: ${i}`);r.error&&t.push(`  error: ${r.error}`)}return t.push("",`Docs: ${e.docs}`),t.join(`
-`)}export{_t as CliGovernedAutomationRuntime,yt as SqliteAutomationExecutionJournal,le as XENO_AUTOMATION_OPERATIONS,V as XENO_AUTOMATION_PROTOCOL_VERSION,Be as XENO_BROWSER_CONTROL_PLANE_OPERATIONS,l as XenoAutomationError,Ee as XenoBrowserControlPlaneAdapter,Me as XenoGovernedAutomationExecutor,_t as XenoHostGovernedAutomationRuntime,Lr as XenoLoopbackAutomationAdapter,Xe as assertRequiredXenoAutomationEvidence,_e as assertValidXenoAutomationAdapterManifest,fr as assertValidXenoAutomationRequest,id as assertXenoAutomationAdapterConformant,dt as assertXenoAutomationAuthority,mr as buildXenoAutomationCapabilityUse,sl as createCliAutomationAuditSink,al as createCliGovernedAutomationRuntime,Pi as createXenoAutomationConformanceReport,fn as createXenoGovernedAutomationTools,sl as createXenoHostAutomationAuditSink,al as createXenoHostGovernedAutomationRuntime,X as describeXenoAutomationOperation,cl as inspectCliAutomationStatus,cl as inspectXenoHostAutomationStatus,Ye as isXenoAutomationOperation,gt as materializeXenoAutomationEvidence,ed as openSqliteAutomationExecutionJournal,H as pending,be as persistXenoAutomationEvidence,bn as readCliAutomationEnvironment,bn as readXenoHostAutomationEnvironment,dl as renderCliAutomationStatus,dl as renderXenoHostAutomationStatus,gr as resolveXenoAutomationEvidencePolicy,_r as runDurableAutomation};
+`;function Wt(){let e=process.env.SystemRoot??process.env.WINDIR;if(e){let t=Gt(e,"Microsoft.NET","Framework64","v4.0.30319","csc.exe");if(Ht(t))return t;let r=Gt(e,"Microsoft.NET","Framework","v4.0.30319","csc.exe");if(Ht(r))return r}return null}import{spawnSync as qt}from"node:child_process";import{accessSync as Mn,constants as Un,existsSync as Bn,realpathSync as $n,statSync as Vn}from"node:fs";import{delimiter as Fn,isAbsolute as jn,join as Hn,resolve as Gn}from"node:path";var Kt="XENO_BWRAP_PROFILE_OK",zt=5e3,Qe;function Jt(e){try{return!Bn(e)||!Vn(e).isFile()?null:(Mn(e,Un.X_OK),$n(e))}catch{return null}}function Wn(){let e=process.env.XENO_BWRAP_PATH?.trim();if(e)return Jt(jn(e)?e:Gn(e));let t=["/usr/bin/bwrap","/bin/bwrap",...(process.env.PATH??"").split(Fn).filter(Boolean).map(r=>Hn(r,"bwrap"))];for(let r of new Set(t)){let n=Jt(r);if(n)return n}return null}function qn(){return["--die-with-parent","--new-session","--unshare-user","--unshare-pid","--unshare-uts","--unshare-ipc","--ro-bind","/","/","--proc","/proc","--dev","/dev","--chdir","/","--","/bin/sh","-c",`test -r /proc/self/status && printf ${Kt}`]}function Yt(){let e=[process.platform,process.env.XENO_BWRAP_PATH??"",process.env.PATH??""].join("\0");if(Qe?.key===e)return{...Qe.capability};let t;if(process.platform!=="linux")t={available:!1,reason:"The bubblewrap process-hardening profile can only be probed on a Linux host."};else{let r=Wn();if(!r)t={available:!1,reason:"bubblewrap is not installed or is not executable."};else{let n=qt(r,["--version"],{encoding:"utf8",timeout:zt}),o=qt(r,qn(),{encoding:"utf8",timeout:zt,env:process.env}),i=n.status===0?n.stdout.trim():void 0;if(o.status===0&&o.stdout===Kt)t={available:!0,executable:r,...i?{version:i}:{},reason:`An active ${i??"bubblewrap"} namespace profile passed its mount, PID, user, IPC, UTS, /proc, and /dev probe.`};else{let a=[o.error?.message,o.stderr.trim(),o.signal?`signal ${o.signal}`:void 0,o.status!==null?`exit ${o.status}`:void 0].filter(Boolean).join("; ");t={available:!1,executable:r,...i?{version:i}:{},reason:`bubblewrap was found but its active namespace profile failed${a?`: ${a}`:"."}`}}}}return Qe={key:e,capability:t},{...t}}import{createHash as zn,createPublicKey as Jn,verify as Kn}from"node:crypto";import{readFileSync as Yn,statSync as Zn}from"node:fs";import{isAbsolute as Qn}from"node:path";var et="xeno.containment-certification.v1",Zt=512*1024,eo=744*60*60*1e3,Qt=Object.freeze(["allowedFilesystemRead","allowedFilesystemWrite","outsideFilesystemReadDenied","outsideFilesystemWriteDenied","unlistedFilesystemReadDenied","unlistedFilesystemWriteDenied","symlinkEscapeDenied","networkDefaultDeny","environmentSecretsExcluded","childProcessPolicyInherited","standardCommandLaunch","processTreeCleanup","timeoutEnforced","hostPolicyRecoveryClean","uiRestrictionsEnforced"]),w=class extends Error{constructor(t){super(`CONTAINMENT_CERTIFICATION_INVALID: ${t}`),this.name="ContainmentCertificationError"}};function to(e){let t={...e};return delete t.signature,Buffer.from(JSON.stringify(rt(t)),"utf8")}function er(e,t,r=new Date){if(!Qn(e.manifestPath))throw new w("manifestPath must be absolute");me(e.candidateSha256,"candidateSha256");let n=Zn(e.manifestPath);if(!n.isFile())throw new w("manifestPath must reference a regular file");if(n.size<=0||n.size>Zt)throw new w(`manifest size must be between 1 and ${Zt} bytes`);let o=Yn(e.manifestPath),i;try{i=JSON.parse(o.toString("utf8"))}catch{throw new w("manifest is not valid JSON")}let a=ro(i);if(e.expectedCertificationId&&a.certificationId!==e.expectedCertificationId)throw new w("certificationId does not match the host binding");if(a.candidate.sha256.toLowerCase()!==e.candidateSha256.toLowerCase())throw new w("candidate digest does not match the running candidate binding");if(a.platform.os!==t.platform||a.platform.arch!==t.arch)throw new w("certification platform or architecture does not match this host");if(a.adapter.name!==t.name||a.adapter.version!==t.version||a.adapter.backend!==t.backend||a.adapter.isolationTier!==t.isolationTier||a.adapter.nativeBinarySha256.toLowerCase()!==t.nativeBinarySha256.toLowerCase())throw new w("certified adapter identity does not match the installed native adapter");let c=tt(a.issuedAt,"issuedAt"),s=tt(a.expiresAt,"expiresAt");if(s<=c)throw new w("expiresAt must be later than issuedAt");if(s-c>eo)throw new w("certification lifetime exceeds 31 days");if(r.getTime()<c-5*6e4)throw new w("certification is not active yet");if(r.getTime()>=s)throw new w("certification has expired");for(let p of Qt)if(a.conformance.checks[p]!==!0)throw new w(`required conformance check did not pass: ${p}`);if(!a.approvals.some(p=>p.role==="security-reviewer"&&p.subject!==a.issuedBy))throw new w("an independent security-reviewer approval is required");let l=e.trustedPublicKeys[a.signature.keyId];if(!l)throw new w("signature key is not trusted by this host");let y;try{y=Buffer.from(a.signature.value,"base64")}catch{throw new w("signature is not valid base64")}if(y.length!==64)throw new w("Ed25519 signature must be 64 bytes");let A=!1;try{A=Kn(null,to(a),Jn(l),y)}catch{throw new w("signature key or value is invalid")}if(!A)throw new w("signature verification failed");return{manifest:a,manifestSha256:zn("sha256").update(o).digest("hex")}}function ro(e){let t=W(e,"manifest");if(t.schemaVersion!==et)throw new w(`schemaVersion must be ${et}`);let r=S(t.certificationId,"certificationId"),n=W(t.candidate,"candidate"),o=W(t.adapter,"adapter"),i=W(t.platform,"platform"),a=W(t.conformance,"conformance"),c=W(a.checks,"conformance.checks"),s=W(t.signature,"signature"),l=t.approvals;if(!Array.isArray(l)||l.length===0)throw new w("approvals must contain at least one approval");let y=l.map((b,v)=>{let I=W(b,`approvals[${v}]`),L=S(I.role,`approvals[${v}].role`);if(L!=="security-reviewer"&&L!=="release-reviewer")throw new w(`approvals[${v}].role is invalid`);let Y=L;tt(S(I.approvedAt,`approvals[${v}].approvedAt`),`approvals[${v}].approvedAt`);let fe=S(I.approvalSha256,`approvals[${v}].approvalSha256`);return me(fe,`approvals[${v}].approvalSha256`),{subject:S(I.subject,`approvals[${v}].subject`),role:Y,approvedAt:I.approvedAt,approvalArtifactId:S(I.approvalArtifactId,`approvals[${v}].approvalArtifactId`),approvalSha256:fe}}),A=S(o.backend,"adapter.backend");if(A!=="processcontainer"&&A!=="bubblewrap"&&A!=="seatbelt")throw new w("adapter.backend is invalid");let p=S(i.os,"platform.os"),E=S(i.arch,"platform.arch");if(S(s.algorithm,"signature.algorithm")!=="ed25519")throw new w("signature.algorithm must be ed25519");let P={};for(let b of Qt){if(c[b]!==!0)throw new w(`conformance.checks.${b} must be true`);P[b]=!0}let T=S(o.nativeBinarySha256,"adapter.nativeBinarySha256"),x=S(n.sha256,"candidate.sha256"),_=S(a.reportSha256,"conformance.reportSha256");if(me(T,"adapter.nativeBinarySha256"),me(x,"candidate.sha256"),me(_,"conformance.reportSha256"),a.passed!==!0)throw new w("conformance.passed must be true");return{schemaVersion:et,certificationId:r,candidate:{product:S(n.product,"candidate.product"),version:S(n.version,"candidate.version"),sha256:x},adapter:{name:o.name==="microsoft-mxc"?"microsoft-mxc":no(),version:S(o.version,"adapter.version"),backend:A,isolationTier:S(o.isolationTier,"adapter.isolationTier"),nativeBinarySha256:T},platform:{os:p,arch:E},conformance:{reportArtifactId:S(a.reportArtifactId,"conformance.reportArtifactId"),reportSha256:_,passed:!0,checks:P},issuedAt:S(t.issuedAt,"issuedAt"),expiresAt:S(t.expiresAt,"expiresAt"),issuedBy:S(t.issuedBy,"issuedBy"),approvals:y,signature:{algorithm:"ed25519",keyId:S(s.keyId,"signature.keyId"),value:S(s.value,"signature.value")}}}function no(){throw new w("adapter.name must be microsoft-mxc")}function W(e,t){if(!e||typeof e!="object"||Array.isArray(e))throw new w(`${t} must be an object`);return e}function S(e,t){if(typeof e!="string"||e.trim().length===0)throw new w(`${t} must be a non-empty string`);return e}function me(e,t){if(!/^[a-f0-9]{64}$/i.test(e))throw new w(`${t} must be a SHA-256 hex digest`)}function tt(e,t){let r=Date.parse(e);if(!Number.isFinite(r))throw new w(`${t} must be an ISO timestamp`);return r}function rt(e){return Array.isArray(e)?e.map(rt):e&&typeof e=="object"?Object.fromEntries(Object.entries(e).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>[t,rt(r)])):e}import{createHash as xe,randomUUID as oo}from"node:crypto";import{accessSync as io,chmodSync as tr,constants as ao,existsSync as Re,lstatSync as it,mkdirSync as so,readFileSync as he,realpathSync as co,renameSync as lo,statSync as uo,unlinkSync as po,writeFileSync as fo}from"node:fs";import{tmpdir as mo}from"node:os";import{dirname as ar,isAbsolute as rr,join as Q,parse as Ms}from"node:path";import{spawnSync as nr}from"node:child_process";import{fileURLToPath as go}from"node:url";var or="microsoft-mxc",ge="0.7.0";var ho="@microsoft/mxc-sdk",Ao="sha512-EWhz2pKkcPluZHAOI1yneV+JK0NO/3hdh7nABBb0x4PjyUWMeSWPTBAjtIu+BhtMYOqlaijSPZMZ0Hs/J4ZL4A==",Fs=10*6e4,yo=Object.freeze({"win32-x64-wxc-exec.exe":"db0a3422be9e1b396cc1b2547c70ff16b27412438a31c10a45abf370cac86ae2","win32-arm64-wxc-exec.exe":"e430d0e4f44f616e91db684f8d825a6dc93e06a1262b8d00bcaac7522a317aab","linux-x64-lxc-exec":"1efe3f817f5ae9ba9f9f2fd59142e79b2dde7a4dd024576b0ddb635fc87edeb5","linux-arm64-lxc-exec":"fdc00ccecf362ae3ddd8ccad93fd7c8b5b1f03c68897ab05ef1c9f1d327ea3fe","darwin-arm64-mxc-exec-mac":"77c07a86f483ed91dd5be290cd77878ac0c56fe113cdb8c764e7e5201c744ad2"}),js=Object.freeze({"win32-x64-wxc-host-prep.exe":"531fb3cdb4b0c964908fd71b71d40961417afb399cbab72f92a25e95309a6416","win32-arm64-wxc-host-prep.exe":"3ef702332286a39153fc259310b5021e3de3c191751d7522684f6475f73af5ef"});function Io(e){return e.some(t=>t.includes("wxc-host-prep prepare-system-drive")||t.includes("wxc-host-prep prepare-null-device"))}function wo(e,t){if(e!=="win32"&&e!=="linux"&&e!=="darwin"||t!=="x64"&&t!=="arm64"||e==="darwin"&&t!=="arm64")return;let r=e==="win32"?"wxc-exec.exe":e==="darwin"?"mxc-exec-mac":"lxc-exec",n=yo[`${e}-${t}-${r}`];return n?{platform:e,arch:t,binaryName:r,sha256:n}:void 0}var nt;function sr(e={}){if(nt&&!e.refresh)return ir(nt);let t=bo();return nt=t,ir(t)}function bo(){let e=process.platform,t=process.arch,r=wo(e,t),n=!!r,o=Eo();if(!o)return n?N(`reviewed MXC ${ge} native assets are not installed`,!1,!0):N(ot(e,t),!1,!1);let i=ar(o);if(!n)return N(ot(e,t),!0,!1,{packageRoot:i});let a="";try{let p=JSON.parse(he(o,"utf8"));if(a=String(p.version??""),p.sourcePackage?.name!==ho||p.sourcePackage.version!==ge||p.sourcePackage.integrity!==Ao)return N("MXC native asset provenance metadata is invalid",!0,!0,{packageRoot:i})}catch{return N("MXC package metadata is unreadable",!0,!0,{packageRoot:i})}if(a!==ge)return N(`MXC version ${a||"unknown"} is installed; XENO requires exactly ${ge}`,!0,!0,{packageRoot:i});if(!r)return N(ot(e,t),!0,!1,{packageRoot:i});let c=Q(i,"bin",t,r.binaryName);if(!Re(c)||!uo(c).isFile())return N(`MXC native binary is missing: ${r.binaryName}`,!0,!0,{packageRoot:i,version:a});let s=c;try{s=vo(c,r)}catch(p){return N(`MXC packaged native binary could not be materialized: ${p instanceof Error?p.message:String(p)}`,!0,!0,{packageRoot:i,version:a})}if(e!=="win32")try{io(s,ao.X_OK)}catch{return N(`MXC native binary is not executable: ${r.binaryName}`,!0,!0,{packageRoot:i,version:a})}let l=xe("sha256").update(he(s)).digest("hex"),y=r.sha256;if(!y||l!==y)return N(`MXC native binary digest is not trusted for ${e}/${t}`,!0,!0,{packageRoot:i,version:a});if(e==="win32"){let p=nr(s,["--probe"],{encoding:"utf8",timeout:5e3,windowsHide:!0});if(p.error||p.status!==0)return N(`MXC native probe failed: ${p.error?.message??(p.stderr.trim()||`exit ${p.status}`)}`,!0,!0,{packageRoot:i,version:a});let E;try{E=JSON.parse(p.stdout)}catch{return N("MXC native probe returned invalid JSON",!0,!0,{packageRoot:i,version:a})}let m=typeof E.tier=="string"?E.tier:"unknown",P=Array.isArray(E.warnings)?E.warnings.filter(_=>typeof _=="string"):[],T=E.probes&&typeof E.probes=="object"?E.probes:void 0,x=T?.uiCapabilities&&typeof T.uiCapabilities=="object"?Object.fromEntries(Object.entries(T.uiCapabilities).filter(_=>typeof _[1]=="boolean")):void 0;return{installed:!0,supported:!0,available:!0,name:or,version:a,packageRoot:i,nativeBinaryPath:s,nativeBinarySha256:l,backend:"processcontainer",isolationTier:m,platform:e,arch:t,warnings:P,needsHostPreparation:Io(P),reason:`MXC ${a} processcontainer is installed (${m}).`,...x?{uiCapabilities:x}:{}}}if(e==="linux"){let p=nr("bwrap",["--version"],{encoding:"utf8",timeout:5e3});if(p.error||p.status!==0)return N("MXC requires bubblewrap on PATH for the stable Linux process adapter",!0,!0,{packageRoot:i,version:a})}let A=e==="darwin"?"seatbelt":"bubblewrap";return{installed:!0,supported:!0,available:!0,name:or,version:a,packageRoot:i,nativeBinaryPath:s,nativeBinarySha256:l,backend:A,isolationTier:A,platform:e,arch:t,warnings:[],needsHostPreparation:!1,reason:`MXC ${a} ${A} adapter is installed.`}}function Eo(){let e=process.resourcesPath,t=process.env.XENO_MXC_ASSET_ROOT?.trim(),r=typeof __dirname=="string"?__dirname:ar(go(import.meta.url)),n=[...e&&rr(e)?[Q(e,"mxc","package.json")]:[],...t&&rr(t)?[Q(t,"package.json")]:[],Q(r,"..","native","mxc","package.json"),Q(r,"..","..","native","mxc","package.json")];for(let o of n){if(!Re(o))continue;let i=it(o);if(!(!i.isFile()||i.isSymbolicLink()))return co(o)}}function vo(e,t){if(!!!process.pkg)return e;let n=Q(mo(),"xeno-mxc",ge,t.sha256);so(n,{recursive:!0,mode:448});let o=Q(n,t.binaryName);if(Re(o)){let s=it(o);if(!s.isFile()||s.isSymbolicLink())throw new Error("materialized MXC path is not a regular file");if(xe("sha256").update(he(o)).digest("hex")!==t.sha256)throw new Error("materialized MXC binary digest is invalid");return process.platform!=="win32"&&tr(o,448),o}let i=he(e);if(xe("sha256").update(i).digest("hex")!==t.sha256)throw new Error("embedded MXC binary digest is invalid");let c=`${o}.${process.pid}.${oo()}.tmp`;fo(c,i,{flag:"wx",mode:448});try{lo(c,o)}catch(s){try{po(c)}catch{}if(!Re(o))throw s;let l=it(o);if((l.isFile()&&!l.isSymbolicLink()?xe("sha256").update(he(o)).digest("hex"):"")!==t.sha256)throw s}return process.platform!=="win32"&&tr(o,448),o}function ot(e,t){return e!=="win32"&&e!=="linux"&&e!=="darwin"?`MXC has no stable process adapter for ${e}/${t}`:t!=="x64"&&t!=="arm64"?`MXC does not ship a ${e}/${t} native adapter`:"MXC Seatbelt currently ships for macOS ARM64 only"}function N(e,t=!1,r=!1,n={}){return{...n,installed:t,supported:r,available:!1,warnings:[],needsHostPreparation:!1,reason:e}}function ir(e){return{...e,warnings:[...e.warnings],...e.uiCapabilities?{uiCapabilities:{...e.uiCapabilities}}:{}}}var ee=class extends Error{code;constructor(t,r){super(`${t}: ${r}`),this.name="ExecutionSecurityError",this.code=t}},So=Object.freeze({policyEnforcement:!0,restrictedIdentity:!1,lowIntegrity:!1,processTreeControl:!1,filesystemIsolation:!1,networkIsolation:!1,inheritedHandleAllowlist:!1,environmentSanitization:!0}),To=Object.freeze({policyEnforcement:!0,restrictedIdentity:!0,lowIntegrity:!0,processTreeControl:!0,filesystemIsolation:!1,networkIsolation:!1,inheritedHandleAllowlist:!0,environmentSanitization:!0}),Co=Object.freeze({policyEnforcement:!0,restrictedIdentity:!0,lowIntegrity:!1,processTreeControl:!0,filesystemIsolation:!1,networkIsolation:!1,inheritedHandleAllowlist:!1,environmentSanitization:!0}),Po=Object.freeze({policyEnforcement:!0,restrictedIdentity:!0,lowIntegrity:!1,processTreeControl:!0,filesystemIsolation:!0,networkIsolation:!0,inheritedHandleAllowlist:!0,environmentSanitization:!0}),at=Object.freeze({policyEnforcement:!0,restrictedIdentity:!1,lowIntegrity:!1,processTreeControl:!1,filesystemIsolation:!1,networkIsolation:!1,inheritedHandleAllowlist:!1,environmentSanitization:!0});function xo(e){let t=e?.executionLevel;if(e?.requireOsContainment&&t&&t!=="contained")throw new ee("SECURITY_POLICY_INVALID","requireOsContainment is a strict contained-mode compatibility flag and conflicts with the requested executionLevel.");return t??(e?.requireOsContainment?"contained":"policy-only")}function Ro(e){return e?.trustMode??"trusted-workspace"}function cr(e,t=process.platform,r){if(e==="policy-only")return{available:!0,requestedLevel:e,effectiveLevel:"policy-only",adapter:"policy-enforcer",isolation:"policy-only",certified:!0,capabilities:{...So},limitations:["No restricted process identity.","No filesystem isolation.","No network isolation."],reason:"Policy and permission checks are active without operating-system process isolation."};if(e==="process-hardened"){if(t==="win32"&&Wt())return{available:!0,requestedLevel:e,effectiveLevel:"process-hardened",adapter:"windows-restricted-token-job",isolation:"process-hardening",certified:!0,capabilities:{...To},limitations:["Filesystem reads are not isolated.","Network access is not isolated.","This mode is not suitable for untrusted code."],reason:"Windows restricted-token, low-integrity, explicit-handle, and kill-on-close Job Object process hardening is available."};if(t==="linux"){let o=Yt();return o.available?{available:!0,requestedLevel:e,effectiveLevel:"process-hardened",adapter:"linux-bubblewrap",isolation:"process-hardening",certified:!0,capabilities:{...Co},limitations:["Filesystem reads are not isolated; the host root is mounted read-only.","Network access is not isolated.","Inherited file descriptors are limited by the host launcher rather than an adapter-owned allowlist.","This mode is not suitable for untrusted code."],reason:`linux-bubblewrap is available: ${o.reason}`}:{available:!1,requestedLevel:e,effectiveLevel:"unavailable",adapter:"unavailable",isolation:"none",certified:!1,capabilities:{...at},limitations:["No certified process-hardening adapter is available for this platform."],reason:`Linux bubblewrap process hardening is unavailable: ${o.reason}`}}return{available:!1,requestedLevel:e,effectiveLevel:"unavailable",adapter:"unavailable",isolation:"none",certified:!1,capabilities:{...at},limitations:["No certified process-hardening adapter is available for this platform."],reason:t==="win32"?"The Windows .NET Framework C# compiler is unavailable, so the restricted-token launcher cannot start.":`No certified process-hardened adapter is implemented for ${t}.`}}if(t!==process.platform)return Oe(t,`Native containment for ${t} cannot be certified from a ${process.platform} host.`);let n=sr();if(!n.available||!n.name||!n.version||!n.backend||!n.isolationTier||!n.nativeBinarySha256||!n.platform||!n.arch)return Oe(t,n.reason,n);if(!r)return Oe(t,`${n.reason} A signed candidate-bound XENO containment certification was not supplied.`,n);try{let o={name:n.name,version:n.version,backend:n.backend,isolationTier:n.isolationTier,nativeBinarySha256:n.nativeBinarySha256,platform:n.platform,arch:n.arch},i=er(r,o);return{available:!0,requestedLevel:e,effectiveLevel:"contained",adapter:"microsoft-mxc",isolation:"filesystem-network",certified:!0,capabilities:{...Po},limitations:[...n.warnings],reason:`${n.reason} Signed XENO certification ${i.manifest.certificationId} is valid for this candidate.`,adapterVersion:n.version,backend:n.backend,isolationTier:n.isolationTier,nativeBinarySha256:n.nativeBinarySha256,certificationArtifactId:i.manifest.certificationId,certificationManifestSha256:i.manifestSha256,needsHostPreparation:n.needsHostPreparation}}catch(o){return Oe(t,o instanceof Error?o.message:"Containment certification validation failed.",n)}}function Oo(e,t){if(Ro(e)==="untrusted"&&t!=="contained")throw new ee("UNTRUSTED_EXECUTION_DISABLED","Untrusted execution requires certified contained mode; policy-only and process-hardened modes are trusted-workspace features.")}function _o(e){let t=e.requestedLevel==="contained"?"CONTAINMENT_UNAVAILABLE":"PROCESS_HARDENING_UNAVAILABLE";return new ee(t,e.reason)}function dr(e,t=process.platform){let r=xo(e);Oo(e,r);let n=cr(r,t,e.containmentCertification);if(!n.available)throw _o(n);if(r==="process-hardened"&&e.allowNetwork!==!0)throw new ee("NETWORK_ISOLATION_UNAVAILABLE","Process-hardened execution cannot enforce network denial. Set allowNetwork=true explicitly for a trusted workspace or request certified contained mode.");if(r!=="policy-only"){let o=Z(e.workingDirectory??process.cwd()).canonicalPath,i=[...e.allowedDirectories,...e.temporaryDirectories??[]];if(!jt(o,i))throw new ee("SECURITY_POLICY_INVALID",`Secured process working directory is outside the canonical allowed directories: ${o}`)}return n}function Oe(e,t,r){let n=r?.available===!0;return{available:!1,requestedLevel:"contained",effectiveLevel:"unavailable",adapter:n?"microsoft-mxc":"unavailable",isolation:n?"filesystem-network":"none",certified:!1,capabilities:{...at},limitations:["Contained mode remains fail-closed until a signed, candidate-bound XENO certification is valid.",...r?.warnings??[],...e==="win32"&&!n?["Windows restricted-token execution is process hardening only."]:[]],reason:t,...r?.version?{adapterVersion:r.version}:{},...r?.backend?{backend:r.backend}:{},...r?.isolationTier?{isolationTier:r.isolationTier}:{},...r?.nativeBinarySha256?{nativeBinarySha256:r.nativeBinarySha256}:{},...r?{needsHostPreparation:r.needsHostPreparation}:{}}}var pr=1,C=class extends Error{constructor(r,n){super(n);this.code=r;this.name="XenoSecureExecutionContractError"}code};function fr(e){let t=e.platform??process.platform,r=e.policy.executionLevel??(e.policy.requireOsContainment?"contained":"policy-only"),n=e.adapterStatus??dr(e.policy,t);if(!n.available||n.effectiveLevel==="unavailable")throw new C("SECURITY_CONTRACT_UNAVAILABLE",n.reason);if(n.requestedLevel!==r||n.effectiveLevel!==r)throw new C("SECURITY_CONTRACT_INVALID","Execution adapter status does not match the requested security level");let i=(e.now??(()=>new Date().toISOString()))(),a=Ae([...e.policy.allowedDirectories,...e.policy.temporaryDirectories??[],e.policy.workingDirectory??process.cwd()],e.policy.workingDirectory,t),c=Ae(e.filesystem?.readRoots??a,e.policy.workingDirectory,t),s=e.profile.capabilities.permissionProfile==="read-only",l=s?[]:Ae(e.filesystem?.writeRoots??a,e.policy.workingDirectory,t),y=s?[]:Ae(e.filesystem?.executeRoots??a,e.policy.workingDirectory,t),A=Ae(e.filesystem?.deniedRoots??e.policy.deniedDirectories??[],e.policy.workingDirectory,t),p=n.capabilities.filesystemIsolation?"os":"policy",E=n.capabilities.networkIsolation?"os":r==="process-hardened"?"none":"policy",m=r==="contained"?"deny":e.network?.default??(e.policy.allowNetwork?"allow":"deny"),P=E==="none";if(P&&(!e.policy.allowNetwork||m!=="allow"))throw new C("SECURITY_CONTRACT_INVALID","An adapter without network isolation requires explicit unrestricted-network acknowledgement");if(s&&(e.browser?.mode==="act"||e.computer?.mode==="act"||(e.secrets?.length??0)>0))throw new C("SECURITY_CONTRACT_INVALID","Read-only Agent Profiles cannot receive browser action, computer action, or secret projection authority");let T=e.certificationArtifactId??n.certificationArtifactId;if(e.certificationArtifactId&&n.certificationArtifactId&&e.certificationArtifactId!==n.certificationArtifactId)throw new C("SECURITY_CONTRACT_INVALID","Requested certification artifact does not match the adapter certification");if(r==="contained"&&!T)throw new C("SECURITY_CONTRACT_INVALID","Contained execution requires a candidate-bound certification artifact");let x=ce(e.environment?.deniedKeys??[]),_=new Set(x),b=ye(e.browser?.allowedDomains??[]),v=ye(e.browser?.readAllowedDomains??b),I=ye(e.browser?.actAllowedDomains??b),L=ye([...b,...v,...I]),Y={schemaVersion:pr,contractId:e.contractId,createdAt:i,...e.expiresAt?{expiresAt:e.expiresAt}:{},identity:{...e.identity},requestedLevel:r,effectiveLevel:n.effectiveLevel,trustMode:e.policy.trustMode??"trusted-workspace",profile:{id:e.profile.profile.id,version:e.profile.profile.version,fingerprint:e.profile.fingerprint,permissionProfile:e.profile.capabilities.permissionProfile},filesystem:{enforcement:p,readRoots:c,writeRoots:l,executeRoots:y,deniedRoots:A},network:{enforcement:E,default:m,allowDestinations:lr(e.network?.allowDestinations??[]),denyDestinations:lr(e.network?.denyDestinations??[]),dns:e.network?.dns??((e.network?.allowDestinations?.length??0)>0||m==="allow"?"system":"disabled"),...e.network?.proxyUrl?{proxyUrl:e.network.proxyUrl}:{},downloads:e.network?.downloads??"deny",acknowledgedUnrestricted:P},process:{processTreeControl:n.capabilities.processTreeControl,cleanup:n.capabilities.processTreeControl?"kill-tree":"best-effort",inheritedHandleAllowlist:n.capabilities.inheritedHandleAllowlist,...Uo(e.process)},environment:{inheritance:e.environment?.inheritance??"allowlist",allowedKeys:ce(e.environment?.allowedKeys??e.policy.containedEnvironmentAllowlist??[]).filter(Cn=>!_.has(Cn)),deniedKeys:x},secrets:Mo(e.secrets??[]),externalActions:{default:e.profile.capabilities.externalActions.default,overrides:{...e.profile.capabilities.externalActions.overrides},requireCurrentTurnApproval:ce(e.profile.capabilities.externalActions.requireCurrentTurnApproval),requireCapabilityLease:!0},browser:{mode:e.browser?.mode??"none",profile:e.browser?.profile??"ephemeral",allowedDomains:L,readAllowedDomains:v,actAllowedDomains:I,deniedDomains:ye(e.browser?.deniedDomains??[]),allowedSchemes:Do(e.browser?.allowedSchemes??["https"]),allowedPorts:Lo(e.browser?.allowedPorts??[443]),redirectPolicy:e.browser?.redirectPolicy??"policy",allowLoopbackDevelopment:e.browser?.allowLoopbackDevelopment??!1,downloads:e.browser?.downloads??"deny",uploads:e.browser?.uploads??"deny",recording:e.browser?.recording??"disabled"},computer:{mode:e.computer?.mode??"none",allowedApplications:ce(e.computer?.allowedApplications??[]),sensitiveRegionRedaction:e.computer?.sensitiveRegionRedaction??!0,humanStopRequired:e.computer?.humanStopRequired??!0},capabilityLeaseIds:ce(e.capabilityLeaseIds??[]),adapter:{id:n.adapter,version:e.adapterVersion??n.adapterVersion??"1",platform:t,architecture:e.architecture??ko(),certified:n.certified,...T?{certificationArtifactId:T}:{},capabilities:{...n.capabilities},limitations:[...n.limitations]},...e.auditEventIds?{auditEventIds:ce(e.auditEventIds)}:{}},fe={...Y,fingerprint:mr(Y)};return ct(fe),fe}function Xo(e){let t=[];if(!e||typeof e!="object")return["Contract must be an object"];if(e.schemaVersion!==pr&&t.push("Unsupported schemaVersion"),e.contractId?.trim()||t.push("contractId is required"),(!e.identity?.runId?.trim()||!e.identity?.agentId?.trim())&&t.push("runId and agentId are required"),ur(e.createdAt)||t.push("createdAt must be an ISO 8601 timestamp"),e.expiresAt&&(!ur(e.expiresAt)||Date.parse(e.expiresAt)<=Date.parse(e.createdAt))&&t.push("expiresAt must be later than createdAt"),e.requestedLevel!==e.effectiveLevel&&t.push("requestedLevel and effectiveLevel must match"),e.trustMode==="untrusted"&&e.effectiveLevel!=="contained"&&t.push("Untrusted execution requires contained mode"),e.effectiveLevel==="contained"&&(e.adapter.certified||t.push("Contained mode requires a certified adapter"),e.adapter.certificationArtifactId||t.push("Contained mode requires a certification artifact"),(!e.adapter.capabilities.filesystemIsolation||e.filesystem.enforcement!=="os")&&t.push("Contained mode requires OS filesystem isolation"),(!e.adapter.capabilities.networkIsolation||e.network.enforcement!=="os")&&t.push("Contained mode requires OS network isolation"),e.network.default!=="deny"&&t.push("Contained networking must default deny")),e.network.enforcement==="none"&&!e.network.acknowledgedUnrestricted&&t.push("Unrestricted networking must be explicitly acknowledged"),e.filesystem.writeRoots.length>0&&e.profile.permissionProfile==="read-only"&&t.push("Read-only profiles cannot receive write roots"),(!Array.isArray(e.browser.readAllowedDomains)||!Array.isArray(e.browser.actAllowedDomains))&&t.push("Browser read/action domain policies are required"),(!Array.isArray(e.browser.allowedSchemes)||e.browser.allowedSchemes.some(r=>r!=="http"&&r!=="https"))&&t.push("Browser allowed schemes are invalid"),(!Array.isArray(e.browser.allowedPorts)||e.browser.allowedPorts.some(r=>!Number.isInteger(r)||r<1||r>65535))&&t.push("Browser allowed ports are invalid"),e.secrets.some(r=>!r.secretId.trim())&&t.push("Secret projections require non-empty secret IDs"),new Set(e.secrets.map(r=>r.secretId)).size!==e.secrets.length&&t.push("Secret IDs must be unique"),new Set(e.capabilityLeaseIds).size!==e.capabilityLeaseIds.length&&t.push("Capability lease IDs must be unique"),/^[a-f0-9]{64}$/.test(e.profile.fingerprint)||t.push("Profile fingerprint is invalid"),!/^[a-f0-9]{64}$/.test(e.fingerprint))t.push("Contract fingerprint is invalid");else{let r={...e};delete r.fingerprint,mr(r)!==e.fingerprint&&t.push("Contract fingerprint does not match content")}return t}function ct(e){let t=Xo(e);if(t.length>0){let r=t.includes("Contract fingerprint does not match content");throw new C(r?"SECURITY_CONTRACT_FINGERPRINT_MISMATCH":"SECURITY_CONTRACT_INVALID",t.join("; "))}}function mr(e){return No("sha256").update(JSON.stringify(st(e))).digest("hex")}function ce(e){return[...new Set(e.map(t=>t.trim()).filter(Boolean))].sort().map(t=>t)}function Ae(e,t,r){return[...new Set(e.map(n=>Z(n,{baseDirectory:t,platform:r}).canonicalPath))].sort((n,o)=>n.localeCompare(o))}function lr(e){let t=new Map;for(let r of e){if(!r.host?.trim())throw new C("SECURITY_CONTRACT_INVALID","Network destinations require a host");if(r.host.includes("*"))throw new C("SECURITY_CONTRACT_INVALID","Network destinations cannot contain wildcards");if(r.port!==void 0&&(!Number.isInteger(r.port)||r.port<1||r.port>65535))throw new C("SECURITY_CONTRACT_INVALID","Network destination port is invalid");let n={...r,host:r.host.trim().toLowerCase().replace(/\.$/,"")};t.set(`${n.scheme??""}:${n.host}:${n.port??""}`,n)}return[...t.values()].sort((r,n)=>r.host.localeCompare(n.host)||(r.port??0)-(n.port??0))}function ye(e){let t=new Set;for(let r of e){let n=r.trim().toLowerCase().replace(/\.$/,"");if(!n)continue;if(n.includes("*")||n.includes("://")||n.includes("/")||n.includes(":"))throw new C("SECURITY_CONTRACT_INVALID",`Browser domain rule is invalid: ${r}`);let o=n.startsWith(".")?n.slice(1):n;if(!/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/.test(o)&&o!=="localhost")throw new C("SECURITY_CONTRACT_INVALID",`Browser domain rule is invalid: ${r}`);t.add(n)}return[...t].sort((r,n)=>r.localeCompare(n))}function Do(e){for(let t of e)if(t!=="http"&&t!=="https")throw new C("SECURITY_CONTRACT_INVALID",`Browser scheme is invalid: ${t}`);return[...new Set(e)].sort()}function Lo(e){for(let t of e)if(!Number.isInteger(t)||t<1||t>65535)throw new C("SECURITY_CONTRACT_INVALID",`Browser port is invalid: ${t}`);return[...new Set(e)].sort((t,r)=>t-r)}function Mo(e){let t=new Map;for(let r of e){if(!r.secretId?.trim())throw new C("SECURITY_CONTRACT_INVALID","Secret projections require an ID");if(t.has(r.secretId))throw new C("SECURITY_CONTRACT_INVALID",`Secret ${r.secretId} is projected more than once`);t.set(r.secretId,{...r})}return[...t.values()].sort((r,n)=>r.secretId.localeCompare(n.secretId))}function Uo(e){let t={};for(let[r,n]of Object.entries(e??{})){if(!Number.isSafeInteger(n)||Number(n)<1)throw new C("SECURITY_CONTRACT_INVALID",`${r} must be a positive safe integer`);Object.assign(t,{[r]:n})}return t}function st(e){return Array.isArray(e)?e.map(st):!e||typeof e!="object"?e:Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>[t,st(r)]))}function ur(e){return typeof e=="string"&&e.includes("T")&&Number.isFinite(Date.parse(e))}var Bo=/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$/,gr=1048576;function q(e){(!e||typeof e!="object")&&F("Automation request must be an object"),e.protocolVersion!==1&&F("Unsupported automation protocol version"),de(e.operationId,"operationId"),de(e.idempotencyKey,"idempotencyKey"),de(e.capabilityLeaseId,"capabilityLeaseId"),de(e.governingToolName,"governingToolName"),(!Number.isSafeInteger(e.expectedLeaseVersion)||e.expectedLeaseVersion<1)&&F("expectedLeaseVersion must be a positive safe integer"),Er(e.requestedAt)||F("requestedAt must be an ISO 8601 timestamp"),Ze(e.operation)||F(`Unsupported automation operation: ${e.operation}`),(!e.parameters||typeof e.parameters!="object"||Array.isArray(e.parameters))&&F("parameters must be a JSON object");let t;try{t=Buffer.byteLength(JSON.stringify(e.parameters),"utf8")}catch(r){throw new d("AUTOMATION_REQUEST_INVALID","parameters must be serializable JSON",void 0,{cause:r})}if(t>gr&&F(`parameters exceed ${gr} bytes`),de(e.identity?.runId,"identity.runId"),de(e.identity?.agentId,"identity.agentId"),ct(e.executionContract),$o(e),!e.executionContract.capabilityLeaseIds.includes(e.capabilityLeaseId))throw new d("AUTOMATION_CONTRACT_INVALID",`Capability lease ${e.capabilityLeaseId} is not bound to the execution contract`);if(e.executionContract.expiresAt&&Date.parse(e.executionContract.expiresAt)<=Date.now())throw new d("AUTOMATION_CONTRACT_EXPIRED","Execution contract has expired")}function U(e){(!e||typeof e!="object")&&M("Adapter manifest must be an object"),e.protocolVersion!==1&&M("Adapter protocol version is unsupported"),_e(e.adapterId,"adapterId"),_e(e.adapterVersion,"adapterVersion"),_e(e.platform,"platform"),_e(e.architecture,"architecture"),e.targetBinding!=="atomic-preflight"&&M("Adapter must implement atomic preflight target binding"),(!Array.isArray(e.operations)||e.operations.length===0)&&M("Adapter must declare operations");let t=new Set;for(let r of e.operations)Ze(r)||M(`Adapter declares unknown operation ${r}`),t.has(r)&&M(`Adapter declares duplicate operation ${r}`),t.add(r);e.certified&&!e.certificationArtifactId&&M("A certified automation adapter requires a certification artifact"),Array.isArray(e.limitations)||M("Adapter limitations must be an array"),e.operations.some(r=>r.startsWith("browser."))&&(!e.policyEnforcement.domain||!e.policyEnforcement.scheme||!e.policyEnforcement.port)&&M("Browser adapters must enforce domain, scheme, and port policy"),e.operations.some(r=>r.startsWith("computer."))&&!e.supports.immediateStop&&M("Computer-use adapters must support immediate stop")}function lt(e,t){let r=X(e.operation);if(!t.operations.includes(e.operation))throw new d("AUTOMATION_OPERATION_UNSUPPORTED",`Adapter ${t.adapterId} does not support ${e.operation}`);if(r.surface==="browser"){let n=e.executionContract.browser.mode;if(n==="none"||r.effect==="act"&&n!=="act")throw new d("AUTOMATION_POLICY_DENIED",`Execution contract denies ${e.operation}`);if(e.operation==="browser.download"&&e.executionContract.browser.downloads==="deny")throw new d("AUTOMATION_POLICY_DENIED","Execution contract denies browser downloads");if(e.operation==="browser.upload"&&e.executionContract.browser.uploads==="deny")throw new d("AUTOMATION_POLICY_DENIED","Execution contract denies browser uploads");if(e.operation.startsWith("browser.record.")&&e.executionContract.browser.recording!=="bounded")throw new d("AUTOMATION_POLICY_DENIED","Execution contract denies browser recording")}else{let n=e.executionContract.computer.mode;if(n==="none"||r.effect==="act"&&n!=="act")throw new d("AUTOMATION_POLICY_DENIED",`Execution contract denies ${e.operation}`);if(e.executionContract.computer.sensitiveRegionRedaction&&t.supports.sensitiveRegionRedaction!==!0)throw new d("AUTOMATION_POLICY_DENIED","Owning adapter cannot satisfy required sensitive-region redaction; preflight capture refused.")}}function ut(e,t,r){lt(e,t);let n=X(e.operation);if(n.surface==="browser")Vo(e,r,n.effect==="act");else{let o=e.executionContract.computer.allowedApplications,i=e.operation==="computer.launch"?jo(e):r.applicationId??e.declaredTarget?.applicationId;if((e.operation==="computer.launch"||o.length>0)&&(!i||!o.includes(i)))throw new d("AUTOMATION_POLICY_DENIED",`Application ${i??"<unknown>"} is not allowed`)}}function wr(e,t){let r=X(e.operation),n=r.surface==="browser"?r.effect==="act"?"browser-act":"browser-read":r.effect==="act"?"computer-act":"computer-observe";return{subject:{runId:e.identity.runId,agentId:e.identity.agentId,...e.identity.turnId?{turnId:e.identity.turnId}:{},toolName:e.governingToolName,operationId:e.operationId},kind:n,operation:e.operation,...hr(e,t)?{resource:hr(e,t)}:{},...yr(t)?{destination:yr(t)}:{}}}function hr(e,t){return Fo(t)??e.declaredTarget?.resource}function br(e){let t=X(e.operation).evidence,r=e.evidencePolicy??{},n=dt(t.before,r.before),o=dt(t.after,r.after),i=dt(t.recording,r.recording),a=r.retainUntil;return a&&!Er(a)&&F("evidencePolicy.retainUntil must be an ISO 8601 timestamp"),{before:n,after:o,recording:i,sensitivity:r.sensitivity??"confidential",...a?{retainUntil:a}:{},...r.legalHold!==void 0?{legalHold:r.legalHold}:{}}}function $o(e){let t=e.executionContract.identity,r=["runId","agentId","sessionId","turnId","taskId","workspaceId"];for(let n of r){let o=t[n],i=e.identity[n];if(o!==void 0&&o!==i)throw new d("AUTOMATION_IDENTITY_MISMATCH",`Automation identity ${n} does not match the execution contract`)}}function Vo(e,t,r){let n=t.url??t.origin??e.declaredTarget?.url??e.declaredTarget?.origin;if(!n){if(["browser.tabs.list","browser.wait"].includes(e.operation))return;throw new d("AUTOMATION_PREFLIGHT_INVALID","Browser preflight did not bind an effective URL")}let o;try{o=new URL(n)}catch{throw new d("AUTOMATION_POLICY_DENIED","Browser target URL is invalid")}if(o.username||o.password)throw new d("AUTOMATION_POLICY_DENIED","Browser target URLs cannot contain credentials");let i=o.protocol.replace(/:$/,"");i!=="http"&&i!=="https"&&te(`Browser scheme ${o.protocol} is not supported`);let a=i,c=o.hostname.toLowerCase().replace(/\.$/,""),s=o.port?Number(o.port):a==="https"?443:80,l=e.executionContract.browser,y=Ho(c);if(Ir(c,l.deniedDomains)&&te(`Browser domain ${c} is denied`),Ar(o,e.executionContract.network.denyDestinations)&&te(`Network policy explicitly denies ${a}://${c}:${s}`),y&&l.allowLoopbackDevelopment)return;l.allowedSchemes.includes(a)||te(`Browser scheme ${o.protocol} is not allowed`),l.allowedPorts.includes(s)||te(`Browser port ${s} is not allowed`);let A=r?l.actAllowedDomains:l.readAllowedDomains;Ir(c,A)||te(`Browser domain ${c} is outside the ${r?"action":"read"} allowlist`),e.executionContract.network.default==="deny"&&(Ar(o,e.executionContract.network.allowDestinations)||te(`Network policy does not allow ${a}://${c}:${s}`))}function Ar(e,t){let r=e.protocol.replace(/:$/,""),n=e.hostname.toLowerCase().replace(/\.$/,""),o=e.port?Number(e.port):r==="https"?443:80;return t.some(i=>{let a=i.scheme?.replace(/^custom:/,"");return i.host===n&&(i.port===void 0||i.port===o)&&(a===void 0||a===r)})}function Fo(e){return e.resource??e.tabId??e.pageId??e.deviceId??e.applicationId}function yr(e){let t=e.origin??e.url;if(!t)return e.domain;try{return new URL(t).origin}catch{return t}}function jo(e){let t=e.parameters.target,r=t&&typeof t=="object"&&!Array.isArray(t)?t.app_id:void 0,n=e.parameters.applicationId??r??e.declaredTarget?.applicationId;return typeof n=="string"&&n.length>0?n:void 0}function Ir(e,t){return t.some(r=>{let n=r.toLowerCase();if(n.startsWith(".")){let o=n.slice(1);return e===o||e.endsWith(`.${o}`)}return e===n})}function Ho(e){return e==="localhost"||e==="127.0.0.1"||e==="[::1]"||e==="::1"}function dt(e,t){let r={disabled:0,optional:1,required:2};return!t||r[t]<=r[e]?e:t}function de(e,t){(typeof e!="string"||!Bo.test(e))&&F(`${t} is invalid`)}function _e(e,t){(typeof e!="string"||e.trim().length===0||e.length>256)&&M(`${t} is invalid`)}function Er(e){return typeof e=="string"&&e.includes("T")&&Number.isFinite(Date.parse(e))}function te(e){throw new d("AUTOMATION_POLICY_DENIED",e)}function F(e){throw new d("AUTOMATION_REQUEST_INVALID",e)}function M(e){throw new d("AUTOMATION_OPERATION_UNSUPPORTED",e)}import{createHash as di}from"node:crypto";var vr=["plan","requirements","design","task-graph","patch","diff","file","document","diagram","screenshot","recording","browser-snapshot","test-report","review-report","security-report","performance-report","release-report","sbom","provenance","attestation","page"],Sr=["draft","pending_review","approved","rejected","superseded","archived"],Tr=["public","internal","confidential","restricted"],Cr=["agent","tool","user","system","integration"],Pr=["requirement","design-decision","risk","task","agent","run","tool-call","edit","commit","test-case","test-run","finding","approval","artifact","release","claim"],xr=["decomposes","depends_on","implements","changes","tests","verifies","finds","fixes","reviews","approves","rejects","supersedes","derived_from","produced_by","supports_claim","contradicts_claim","released_as"];import{Buffer as Rr}from"node:buffer";import{createHash as Go}from"node:crypto";function re(e){return{algorithm:"sha256",value:Go("sha256").update(e).digest("hex")}}var Wo=/^[a-z0-9][a-z0-9._/-]{0,127}$/,Ne="custom:";function Ie(e,t=Ne){return e.startsWith(t)?Wo.test(e.slice(t.length)):!1}var le=class extends Error{code="ARTIFACT_INVALID";issues;constructor(t,r){super(t),this.name="XenoArtifactValidationError",this.issues=r.map(n=>({...n}))}},pt=class extends Error{constructor(r,n){super(`Artifact state cannot transition from ${r} to ${n}`);this.fromState=r;this.toState=n;this.name="XenoArtifactStateTransitionError"}fromState;toState;code="ARTIFACT_STATE_TRANSITION_INVALID"},qo={draft:["pending_review","superseded","archived"],pending_review:["approved","rejected","superseded","archived"],approved:["superseded","archived"],rejected:["superseded","archived"],superseded:["archived"],archived:[]},zo="[\\u0000-\\u001f\\u007f]",Jo=new RegExp(zo),Or=/^[a-f0-9]{64}$/,Ko=/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/,Yo=new Set(Sr),Zo=new Set(Tr),Qo=new Set(Cr),ei=new Set(vr),ti=new Set(Pr),ri=new Set(xr);function u(e,t,r,n){e.push({path:t,code:r,message:n})}function g(e,t,r,n=1024){return typeof e!="string"||e.trim().length===0?(u(r,t,"required_string","Value must be a non-empty string"),!1):(e.length>n&&u(r,t,"string_too_long",`Value must not exceed ${n} characters`),Jo.test(e)&&u(r,t,"control_character","Value must not contain control characters"),!0)}function we(e,t,r){e!==void 0&&(!Number.isFinite(Date.parse(e))||!e.includes("T"))&&u(r,t,"invalid_timestamp","Value must be an ISO 8601 timestamp")}function ne(e,t,r,n){typeof e=="string"&&e.startsWith(t)&&(Ie(e,t)||u(n,r,"invalid_custom_name",`Custom name after ${t} is invalid`))}function _r(e,t,r){if(!e||typeof e!="object"){u(r,t,"missing_actor","Actor is required");return}g(e.kind,`${t}.kind`,r,64),Qo.has(e.kind)||u(r,`${t}.kind`,"unknown_actor_kind","Actor kind is not supported"),g(e.id,`${t}.id`,r,512),e?.displayName!==void 0&&g(e.displayName,`${t}.displayName`,r,512),e?.profileFingerprint!==void 0&&!/^[a-f0-9]{64}$/.test(e.profileFingerprint)&&u(r,`${t}.profileFingerprint`,"invalid_fingerprint","Profile fingerprint must be 64 lowercase hexadecimal characters")}function ft(e,t,r){if(!e||typeof e!="object"){u(r,t,"invalid_anchor","Anchor must be an object");return}switch(e.kind){case"file":g(e.path,`${t}.path`,r,4096);break;case"source-line":g(e.path,`${t}.path`,r,4096),(!Number.isInteger(e.startLine)||e.startLine<1)&&u(r,`${t}.startLine`,"invalid_line","startLine must be a positive integer"),e.endLine!==void 0&&(!Number.isInteger(e.endLine)||e.endLine<e.startLine)&&u(r,`${t}.endLine`,"invalid_line_range","endLine must be greater than or equal to startLine");break;case"diff-hunk":g(e.path,`${t}.path`,r,4096),g(e.hunkId,`${t}.hunkId`,r,512);break;case"symbol":g(e.path,`${t}.path`,r,4096),g(e.symbol,`${t}.symbol`,r,1024);break;case"dom-node":g(e.pageId,`${t}.pageId`,r,512),!e.selector&&!e.accessibilityId&&!e.snapshotArtifactId&&u(r,t,"missing_dom_locator","DOM anchors require a selector, accessibility ID, or snapshot artifact ID");break;case"timeline":g(e.recordingArtifactId,`${t}.recordingArtifactId`,r,512),(!Number.isFinite(e.startMs)||e.startMs<0)&&u(r,`${t}.startMs`,"invalid_time","startMs must be a non-negative finite number"),e.endMs!==void 0&&(!Number.isFinite(e.endMs)||e.endMs<e.startMs)&&u(r,`${t}.endMs`,"invalid_time_range","endMs must be greater than or equal to startMs");break;case"region":g(e.mediaArtifactId,`${t}.mediaArtifactId`,r,512),[e.x,e.y,e.width,e.height].every(Number.isFinite)?(e.width<=0||e.height<=0)&&u(r,t,"invalid_region_size","Region width and height must be positive"):u(r,t,"invalid_region","Region coordinates must be finite numbers");break;case"artifact":g(e.artifactId,`${t}.artifactId`,r,512);break;default:typeof e.kind!="string"||!e.kind.startsWith("custom:")?u(r,`${t}.kind`,"unknown_anchor","Anchor kind is not supported"):ne(e.kind,"custom:",`${t}.kind`,r)}}function be(e,t,r,n){if(!(e===null||typeof e=="string"||typeof e=="boolean")){if(typeof e=="number"){Number.isFinite(e)||u(r,t,"non_finite_number","JSON numbers must be finite");return}if(typeof e!="object"){u(r,t,"non_json_value","Value must be JSON-serializable");return}if(n.has(e)){u(r,t,"cyclic_value","Value must not contain cycles");return}if(n.add(e),Array.isArray(e))e.forEach((o,i)=>be(o,`${t}[${i}]`,r,n));else for(let[o,i]of Object.entries(e))i===void 0?u(r,`${t}.${o}`,"undefined_value","Undefined is not valid JSON"):be(i,`${t}.${o}`,r,n);n.delete(e)}}function ni(e){let t=[];if(!e||typeof e!="object")return[{path:"$",code:"invalid_artifact",message:"Artifact must be an object"}];if(e.schemaVersion!==1&&u(t,"schemaVersion","unsupported_schema",`schemaVersion must be ${1}`),g(e.artifactId,"artifactId",t,512),(!Number.isInteger(e.revision)||e.revision<1)&&u(t,"revision","invalid_revision","revision must be a positive integer"),g(e.kind,"kind",t,160),typeof e.kind=="string"&&!ei.has(e.kind)&&!e.kind.startsWith("custom:")&&u(t,"kind","unknown_artifact_kind","Artifact kind is not supported"),ne(e.kind,"custom:","kind",t),g(e.title,"title",t,1024),e.description!==void 0&&g(e.description,"description",t,32768),g(e.state,"state",t,64),Yo.has(e.state)||u(t,"state","unknown_state","Artifact state is not supported"),g(e.createdAt,"createdAt",t,128),we(e.createdAt,"createdAt",t),we(e.updatedAt,"updatedAt",t),e.updatedAt&&Number.isFinite(Date.parse(e.createdAt))&&Date.parse(e.updatedAt)<Date.parse(e.createdAt)&&u(t,"updatedAt","timestamp_order","updatedAt must not precede createdAt"),g(e.mediaType,"mediaType",t,255),g(e.sensitivity,"sensitivity",t,64),Zo.has(e.sensitivity)||u(t,"sensitivity","unknown_sensitivity","Sensitivity is not supported"),e.identity)for(let[n,o]of Object.entries(e.identity))o!==void 0&&g(o,`identity.${n}`,t,512);if(!e.content||typeof e.content!="object")u(t,"content","missing_content","content descriptor is required");else{!e.content.hash||typeof e.content.hash!="object"?u(t,"content.hash","missing_hash","content hash is required"):(g(e.content.hash.algorithm,"content.hash.algorithm",t,128),ne(e.content.hash.algorithm,"custom:","content.hash.algorithm",t),typeof e.content.hash.algorithm=="string"&&e.content.hash.algorithm!=="sha256"&&!e.content.hash.algorithm.startsWith("custom:")&&u(t,"content.hash.algorithm","unknown_hash_algorithm","Hash algorithm is not supported"),g(e.content.hash.value,"content.hash.value",t,512),e.content.hash.algorithm==="sha256"&&!Or.test(e.content.hash.value)&&u(t,"content.hash.value","invalid_sha256","SHA-256 hash must be 64 lowercase hexadecimal characters")),(!Number.isSafeInteger(e.content.sizeBytes)||e.content.sizeBytes<0)&&u(t,"content.sizeBytes","invalid_size","sizeBytes must be a non-negative safe integer");let n=e.content.storage;if(!n||typeof n!="object")u(t,"content.storage","missing_storage","storage reference is required");else if(n.type==="inline")if(n.text===void 0==(n.base64===void 0))u(t,"content.storage","invalid_inline_storage","Inline storage requires exactly one of text or base64");else{let o;n.text!==void 0?o=Rr.from(n.text,"utf8"):n.base64!==void 0&&(Ko.test(n.base64)?o=Rr.from(n.base64,"base64"):u(t,"content.storage.base64","invalid_base64","Inline base64 content is malformed")),o&&e.content.sizeBytes!==o.byteLength&&u(t,"content.sizeBytes","content_size_mismatch","sizeBytes does not match inline content"),o&&e.content.hash.algorithm==="sha256"&&re(o).value!==e.content.hash.value&&u(t,"content.hash.value","content_hash_mismatch","Hash does not match inline content")}else n.type==="file"?g(n.path,"content.storage.path",t,4096):n.type==="blob"?g(n.uri,"content.storage.uri",t,8192):n.type==="git"?(g(n.commit,"content.storage.commit",t,512),g(n.path,"content.storage.path",t,4096)):n.type==="url"?(g(n.url,"content.storage.url",t,8192),we(n.expiresAt,"content.storage.expiresAt",t)):n.type==="external"?(g(n.provider,"content.storage.provider",t,255),g(n.locator,"content.storage.locator",t,8192)):u(t,"content.storage.type","unknown_storage","Storage type is not supported");e.content.encoding!==void 0&&(typeof e.content.encoding!="string"||e.content.encoding!=="utf8"&&e.content.encoding!=="base64"&&e.content.encoding!=="binary"&&!e.content.encoding.startsWith("custom:"))&&u(t,"content.encoding","unknown_encoding","Content encoding is not supported"),ne(e.content.encoding,"custom:","content.encoding",t)}!e.provenance||typeof e.provenance!="object"?u(t,"provenance","missing_provenance","provenance is required"):(_r(e.provenance.producer,"provenance.producer",t),e.provenance.capabilityLeaseIds?.forEach((n,o)=>g(n,`provenance.capabilityLeaseIds[${o}]`,t,512)),e.provenance.sourceArtifactIds?.forEach((n,o)=>g(n,`provenance.sourceArtifactIds[${o}]`,t,512)),e.provenance.attributes&&be(e.provenance.attributes,"provenance.attributes",t,new Set));let r=new Set;return e.relationships?.forEach((n,o)=>{let i=`relationships[${o}]`;g(n.relation,`${i}.relation`,t,160),typeof n.relation=="string"&&!ri.has(n.relation)&&!n.relation.startsWith("custom:")&&u(t,`${i}.relation`,"unknown_relationship","Relationship type is not supported"),ne(n.relation,"custom:",`${i}.relation`,t),g(n.target?.type,`${i}.target.type`,t,160),typeof n.target?.type=="string"&&!ti.has(n.target.type)&&!n.target.type.startsWith("custom:")&&u(t,`${i}.target.type`,"unknown_reference_type","Evidence reference type is not supported"),ne(n.target?.type,"custom:",`${i}.target.type`,t),g(n.target?.id,`${i}.target.id`,t,512);let a=`${n.relation}:${n.target?.type}:${n.target?.id}:${n.target?.revision??""}`;r.has(a)&&u(t,i,"duplicate_relationship","Duplicate relationship"),r.add(a),n.attributes&&be(n.attributes,`${i}.attributes`,t,new Set)}),e.anchors?.forEach((n,o)=>ft(n,`anchors[${o}]`,t)),e.revision===1&&e.predecessorRevision!==void 0&&u(t,"predecessorRevision","unexpected_predecessor","First revision cannot have a predecessor"),e.revision>1&&(!Number.isInteger(e.predecessorRevision)||(e.predecessorRevision??0)>=e.revision)&&u(t,"predecessorRevision","invalid_predecessor","Later revisions require an earlier predecessor revision"),we(e.retention?.retainUntil,"retention.retainUntil",t),e.retention?.legalHold!==void 0&&typeof e.retention.legalHold!="boolean"&&u(t,"retention.legalHold","invalid_boolean","legalHold must be a boolean"),e.extensions&&be(e.extensions,"extensions",t,new Set),t}function ke(e){let t=ni(e);if(t.length>0)throw new le("XENO artifact validation failed",t)}function oi(e,t){return qo[e].includes(t)}function Xe(e,t){if(!oi(e,t))throw new pt(e,t)}function mt(e,t){let r=[];return e.schemaVersion!==1&&u(r,"schemaVersion","unsupported_schema",`schemaVersion must be ${1}`),g(e.eventId,"eventId",r,512),g(e.artifactId,"artifactId",r,512),(!Number.isInteger(e.artifactRevision)||e.artifactRevision<1)&&u(r,"artifactRevision","invalid_revision","artifactRevision must be a positive integer"),(!Number.isInteger(e.sequence)||e.sequence<1)&&u(r,"sequence","invalid_sequence","sequence must be a positive integer"),g(e.recordedAt,"recordedAt",r,128),we(e.recordedAt,"recordedAt",r),_r(e.actor,"actor",r),!e.artifactHash||typeof e.artifactHash!="object"?u(r,"artifactHash","missing_hash","Artifact hash is required"):(g(e.artifactHash.algorithm,"artifactHash.algorithm",r,128),ne(e.artifactHash.algorithm,"custom:","artifactHash.algorithm",r),g(e.artifactHash.value,"artifactHash.value",r,512),e.artifactHash.algorithm==="sha256"&&!Or.test(e.artifactHash.value)&&u(r,"artifactHash.value","invalid_sha256","SHA-256 hash must be 64 lowercase hexadecimal characters"),typeof e.artifactHash.algorithm=="string"&&e.artifactHash.algorithm!=="sha256"&&!e.artifactHash.algorithm.startsWith("custom:")&&u(r,"artifactHash.algorithm","unknown_hash_algorithm","Hash algorithm is not supported")),["review-requested","comment-added","comment-resolved","comment-reopened","decision-recorded","review-withdrawn"].includes(e.type)||u(r,"type","unknown_review_event","Review event type is not supported"),e.type==="comment-added"?(g(e.commentId,"commentId",r,512),g(e.body,"body",r,65536),e.anchor&&ft(e.anchor,"anchor",r)):e.type==="comment-resolved"||e.type==="comment-reopened"?g(e.commentId,"commentId",r,512):e.type==="decision-recorded"&&(["approved","rejected","changes_requested"].includes(e.decision)||u(r,"decision","unknown_review_decision","Review decision is not supported"),e.scope&&ft(e.scope,"scope",r)),t&&(e.artifactId!==t.artifactId&&u(r,"artifactId","artifact_mismatch","Review event targets a different artifact"),e.artifactRevision!==t.revision&&u(r,"artifactRevision","revision_mismatch","Review event targets a different revision"),e.artifactHash&&(e.artifactHash.algorithm!==t.content.hash.algorithm||e.artifactHash.value!==t.content.hash.value)&&u(r,"artifactHash","hash_mismatch","Review event hash does not match the artifact revision")),r}function gt(e){let t="not_requested",r,n,o,i=0,a=new Set,c=new Set;for(let s of[...e].sort((l,y)=>l.sequence-y.sequence))o=s.recordedAt,s.type==="review-requested"?t="pending":s.type==="review-withdrawn"?t="withdrawn":s.type==="comment-added"?(a.add(s.commentId),c.delete(s.commentId),t==="not_requested"&&(t="pending")):s.type==="comment-resolved"?c.add(s.commentId):s.type==="comment-reopened"?c.delete(s.commentId):s.type==="decision-recorded"&&(s.scope?i+=1:(r=s.decision,n=s.eventId,t=s.decision));return{status:t,totalComments:a.size,unresolvedComments:[...a].filter(s=>!c.has(s)).length,...r?{latestDecision:r}:{},...n?{latestDecisionEventId:n}:{},...i>0?{scopedDecisionCount:i}:{},...o?{lastReviewedAt:o}:{}}}var f=class extends Error{constructor(r,n,o,i){super(n,i);this.code=r;this.detail=o;this.name="XenoArtifactRepositoryError"}code;detail},ve=class{records=new Map;currentRevisions=new Map;now;idFactory;eventIds=new Set;idCounter=0;constructor(t={}){this.now=t.now??(()=>new Date().toISOString()),this.idFactory=t.idFactory??(r=>(this.idCounter+=1,`${r}_${Date.now().toString(36)}_${this.idCounter.toString(36)}`)),t.initialState&&this.hydrate(t.initialState)}exportState(){let t=[...this.records.values()].flatMap(r=>[...r.values()]).sort(Nr).map(r=>({artifact:Ee(r.artifact),recordVersion:r.recordVersion,lifecycleEvents:structuredClone(r.lifecycleEvents),reviewEvents:structuredClone(r.reviewEvents)}));return{schemaVersion:1,records:t}}async create(t){if(ke(t),this.assertInitialState(t),t.revision!==1)throw new f("ARTIFACT_REVISION_INVALID","A new artifact must begin at revision 1",{artifactId:t.artifactId,revision:t.revision});if(this.records.has(t.artifactId))throw new f("ARTIFACT_ALREADY_EXISTS",`Artifact ${t.artifactId} already exists`,{artifactId:t.artifactId});let r=Ee(t),n=this.createLifecycleEvent({artifact:r,sequence:1,actor:r.provenance.producer,fromState:null,toState:r.state,reason:"artifact-created"}),o={artifact:r,recordVersion:1,lifecycleEvents:[n],reviewEvents:[]};return this.records.set(r.artifactId,new Map([[r.revision,o]])),this.currentRevisions.set(r.artifactId,r.revision),oe(o)}async createRevision(t,r={}){ke(t),this.assertInitialState(t);let n=this.getMutable(t.artifactId);this.assertVersion(n,r.expectedRecordVersion);let o=n.artifact.revision+1;if(t.revision!==o||t.predecessorRevision!==n.artifact.revision)throw new f("ARTIFACT_REVISION_INVALID",`Revision ${t.revision} does not follow current revision ${n.artifact.revision}`,{artifactId:t.artifactId,currentRevision:n.artifact.revision,requestedRevision:t.revision});if(ai(t,n.artifact))throw new f("ARTIFACT_CONTENT_UNCHANGED","A new artifact revision must have a different content hash",{artifactId:t.artifactId,revision:t.revision});if(n.artifact.state==="archived")throw new f("ARTIFACT_REVISION_INVALID","Archived artifacts cannot receive new revisions",{artifactId:t.artifactId,revision:n.artifact.revision});if(n.artifact.state!=="superseded"){Xe(n.artifact.state,"superseded");let s=this.now(),l=this.createLifecycleEvent({artifact:n.artifact,sequence:n.lifecycleEvents.length+1,actor:r.actor??t.provenance.producer,fromState:n.artifact.state,toState:"superseded",reason:r.reason??`superseded-by-revision-${t.revision}`,recordedAt:s});n.artifact.state="superseded",n.artifact.updatedAt=s,n.lifecycleEvents.push(l),n.recordVersion+=1}let i=Ee(t),a=this.createLifecycleEvent({artifact:i,sequence:1,actor:r.actor??i.provenance.producer,fromState:null,toState:i.state,reason:r.reason??`revision-created-from-${n.artifact.revision}`}),c={artifact:i,recordVersion:1,lifecycleEvents:[a],reviewEvents:[]};return this.records.get(i.artifactId)?.set(i.revision,c),this.currentRevisions.set(i.artifactId,i.revision),oe(c)}async get(t,r){let n=this.records.get(t);if(!n)return;let o=r??this.currentRevisions.get(t);if(o===void 0)return;let i=n.get(o);return i?oe(i):void 0}async require(t,r){let n=await this.get(t,r);if(!n)throw new f("ARTIFACT_NOT_FOUND",`Artifact ${t}${r===void 0?"":` revision ${r}`} was not found`,{artifactId:t,...r===void 0?{}:{revision:r}});return n}async list(t={}){let r=[];for(let[n,o]of this.records)if(!(t.artifactIds&&!t.artifactIds.includes(n)))if(t.includeSuperseded)r.push(...o.values());else{let i=this.currentRevisions.get(n);if(i!==void 0){let a=o.get(i);a&&r.push(a)}}return r.filter(n=>si(n.artifact,t)).sort(Nr).map(oe)}async listRevisions(t){let r=this.records.get(t);return r?[...r.values()].sort((n,o)=>n.artifact.revision-o.artifact.revision).map(oe):[]}async transition(t){let r=this.getMutable(t.artifactId,t.revision);if(this.assertVersion(r,t.expectedRecordVersion),Xe(r.artifact.state,t.toState),t.toState==="approved"||t.toState==="rejected"){let a=t.reviewEventId?r.reviewEvents.find(s=>s.eventId===t.reviewEventId&&s.type==="decision-recorded"):void 0,c=gt(r.reviewEvents);if(!a||a.decision!==t.toState||c.latestDecisionEventId!==a.eventId)throw new f("ARTIFACT_REVIEW_DECISION_REQUIRED",`Transition to ${t.toState} requires a matching decision event`,{artifactId:t.artifactId,revision:r.artifact.revision});if(t.toState==="approved"&&c.unresolvedComments>0)throw new f("ARTIFACT_UNRESOLVED_COMMENTS",`Artifact has ${c.unresolvedComments} unresolved review comment(s)`,{artifactId:t.artifactId,revision:r.artifact.revision,unresolvedComments:c.unresolvedComments})}let n=this.now(),o=r.artifact.state,i=this.createLifecycleEvent({artifact:r.artifact,sequence:r.lifecycleEvents.length+1,actor:t.actor,fromState:o,toState:t.toState,reason:t.reason,reviewEventId:t.reviewEventId,recordedAt:n});return r.artifact.state=t.toState,r.artifact.updatedAt=n,r.lifecycleEvents.push(i),r.recordVersion+=1,oe(r)}async appendReviewEvent(t){let r=t.event,n=this.getMutable(r.artifactId,r.artifactRevision);if(this.assertVersion(n,t.expectedRecordVersion),n.artifact.state==="archived"||n.artifact.state==="superseded")throw new f("ARTIFACT_REVIEW_INVALID",`Cannot append review events to a ${n.artifact.state} artifact revision`,{artifactId:r.artifactId,revision:r.artifactRevision});if(this.assertReviewCommentState(n,r),(r.type==="review-requested"||r.type==="review-withdrawn"||r.type==="decision-recorded")&&n.artifact.state!=="pending_review")throw new f("ARTIFACT_REVIEW_INVALID",`${r.type} requires an artifact in pending_review state`,{artifactId:r.artifactId,revision:r.artifactRevision});let o={...structuredClone(r),schemaVersion:1,eventId:this.nextEventId("review_event"),sequence:n.reviewEvents.length+1,recordedAt:this.now()},i=mt(o,n.artifact);if(i.length>0)throw new le("XENO artifact review event validation failed",i);return n.reviewEvents.push(o),n.recordVersion+=1,oe(n)}getMutable(t,r){let n=this.records.get(t),o=r??this.currentRevisions.get(t),i=o===void 0?void 0:n?.get(o);if(!i)throw new f("ARTIFACT_NOT_FOUND",`Artifact ${t}${r===void 0?"":` revision ${r}`} was not found`,{artifactId:t,...r===void 0?{}:{revision:r}});return i}assertVersion(t,r){if(r!==void 0&&r!==t.recordVersion)throw new f("ARTIFACT_CONFLICT",`Expected record version ${r}, found ${t.recordVersion}`,{artifactId:t.artifact.artifactId,revision:t.artifact.revision,expectedRecordVersion:r,actualRecordVersion:t.recordVersion})}assertInitialState(t){if(t.state!=="draft"&&t.state!=="pending_review")throw new f("ARTIFACT_REVISION_INVALID","New artifact revisions must begin in draft or pending_review state",{artifactId:t.artifactId,revision:t.revision})}assertReviewCommentState(t,r){if(r.type==="comment-added"){if(t.reviewEvents.some(i=>i.type==="comment-added"&&i.commentId===r.commentId))throw new f("ARTIFACT_REVIEW_INVALID",`Comment ${r.commentId} already exists`);if(r.parentCommentId&&!t.reviewEvents.some(i=>i.type==="comment-added"&&i.commentId===r.parentCommentId))throw new f("ARTIFACT_REVIEW_INVALID",`Parent comment ${r.parentCommentId} does not exist`);return}if(r.type!=="comment-resolved"&&r.type!=="comment-reopened")return;if(!t.reviewEvents.some(i=>i.type==="comment-added"&&i.commentId===r.commentId))throw new f("ARTIFACT_REVIEW_INVALID",`Comment ${r.commentId} does not exist`);let o=ci(t.reviewEvents,r.commentId);if(r.type==="comment-resolved"&&o.resolved)throw new f("ARTIFACT_REVIEW_INVALID",`Comment ${r.commentId} is already resolved`);if(r.type==="comment-reopened"&&!o.resolved)throw new f("ARTIFACT_REVIEW_INVALID",`Comment ${r.commentId} is not resolved`)}createLifecycleEvent(t){return{schemaVersion:1,eventId:this.nextEventId("artifact_event"),artifactId:t.artifact.artifactId,revision:t.artifact.revision,sequence:t.sequence,recordedAt:t.recordedAt??this.now(),actor:{...t.actor},fromState:t.fromState,toState:t.toState,...t.reason?{reason:t.reason}:{},...t.reviewEventId?{reviewEventId:t.reviewEventId}:{}}}nextEventId(t){let r=this.idFactory(t);if(typeof r!="string"||r.trim().length===0||this.eventIds.has(r))throw new f("ARTIFACT_CONFLICT",`Event ID factory produced an invalid or duplicate ${t} ID`);return this.eventIds.add(r),r}hydrate(t){if(t.schemaVersion!==1||!Array.isArray(t.records))throw new f("ARTIFACT_REVISION_INVALID","Artifact repository state has an unsupported schema or record collection");let r=[...t.records].sort((n,o)=>n.artifact.artifactId.localeCompare(o.artifact.artifactId)||n.artifact.revision-o.artifact.revision);for(let n of r){let o=ii(n,this.eventIds),i=this.records.get(o.artifact.artifactId);if(i||(i=new Map,this.records.set(o.artifact.artifactId,i)),i.has(o.artifact.revision))throw new f("ARTIFACT_REVISION_INVALID",`Duplicate persisted revision ${o.artifact.artifactId}:${o.artifact.revision}`);i.set(o.artifact.revision,o),this.currentRevisions.set(o.artifact.artifactId,o.artifact.revision)}for(let[n,o]of this.records){let i=[...o.values()].sort((a,c)=>a.artifact.revision-c.artifact.revision);for(let a=0;a<i.length;a+=1){let c=i[a],s=a+1;if(c.artifact.revision!==s)throw new f("ARTIFACT_REVISION_INVALID",`Persisted artifact ${n} is missing revision ${s}`);if(a===0&&c.artifact.predecessorRevision!==void 0)throw new f("ARTIFACT_REVISION_INVALID",`Initial revision for ${n} cannot declare a predecessor`);if(a>0&&c.artifact.predecessorRevision!==s-1)throw new f("ARTIFACT_REVISION_INVALID",`Persisted revision ${n}:${s} has an invalid predecessor`);if(a<i.length-1&&c.artifact.state!=="superseded")throw new f("ARTIFACT_REVISION_INVALID",`Non-current revision ${n}:${s} must be superseded`)}}}};function ii(e,t){if(ke(e.artifact),!Number.isInteger(e.recordVersion)||e.recordVersion<1)throw new f("ARTIFACT_REVISION_INVALID","Persisted artifact recordVersion must be a positive integer",{artifactId:e.artifact.artifactId,revision:e.artifact.revision});if(!Array.isArray(e.lifecycleEvents)||e.lifecycleEvents.length===0||!Array.isArray(e.reviewEvents))throw new f("ARTIFACT_REVISION_INVALID","Persisted artifact records require lifecycle and review event arrays",{artifactId:e.artifact.artifactId,revision:e.artifact.revision});let r=e.lifecycleEvents.length+e.reviewEvents.length;if(e.recordVersion!==r)throw new f("ARTIFACT_REVISION_INVALID",`Persisted record version ${e.recordVersion} does not match ${r} mutations`,{artifactId:e.artifact.artifactId,revision:e.artifact.revision});let n=null;for(let i=0;i<e.lifecycleEvents.length;i+=1){let a=e.lifecycleEvents[i];if(a.schemaVersion!==1||a.artifactId!==e.artifact.artifactId||a.revision!==e.artifact.revision||a.sequence!==i+1||a.fromState!==n||typeof a.eventId!="string"||a.eventId.length===0||t.has(a.eventId)||!Number.isFinite(Date.parse(a.recordedAt)))throw new f("ARTIFACT_REVISION_INVALID",`Persisted lifecycle event ${i+1} is invalid`,{artifactId:e.artifact.artifactId,revision:e.artifact.revision});if(n===null){if(a.toState!=="draft"&&a.toState!=="pending_review")throw new f("ARTIFACT_REVISION_INVALID","A persisted artifact must begin in draft or pending_review state",{artifactId:e.artifact.artifactId,revision:e.artifact.revision})}else Xe(n,a.toState);t.add(a.eventId),n=a.toState}if(n!==e.artifact.state)throw new f("ARTIFACT_REVISION_INVALID","Persisted artifact state does not match its lifecycle tail",{artifactId:e.artifact.artifactId,revision:e.artifact.revision});let o=new Map;for(let i=0;i<e.reviewEvents.length;i+=1){let a=e.reviewEvents[i];if(a.sequence!==i+1||t.has(a.eventId))throw new f("ARTIFACT_REVIEW_INVALID",`Persisted review event ${i+1} has an invalid sequence or duplicate ID`,{artifactId:e.artifact.artifactId,revision:e.artifact.revision});let c=mt(a,e.artifact);if(c.length>0)throw new le("Persisted XENO artifact review event validation failed",c);if(a.type==="comment-added"){if(o.has(a.commentId)||a.parentCommentId!==void 0&&!o.has(a.parentCommentId))throw new f("ARTIFACT_REVIEW_INVALID",`Persisted comment ${a.commentId} has an invalid identity or parent`);o.set(a.commentId,!1)}else if(a.type==="comment-resolved"||a.type==="comment-reopened"){let s=o.get(a.commentId);if(s===void 0||a.type==="comment-resolved"&&s||a.type==="comment-reopened"&&!s)throw new f("ARTIFACT_REVIEW_INVALID",`Persisted comment transition for ${a.commentId} is invalid`);o.set(a.commentId,a.type==="comment-resolved")}t.add(a.eventId)}return{artifact:Ee(e.artifact),recordVersion:e.recordVersion,lifecycleEvents:structuredClone(e.lifecycleEvents),reviewEvents:structuredClone(e.reviewEvents)}}function ai(e,t){return e.content.hash.algorithm===t.content.hash.algorithm&&e.content.hash.value===t.content.hash.value}function si(e,t){return!(t.kinds&&!t.kinds.includes(e.kind)||t.states&&!t.states.includes(e.state)||t.runId&&e.identity?.runId!==t.runId||t.sessionId&&e.identity?.sessionId!==t.sessionId||t.turnId&&e.identity?.turnId!==t.turnId||t.taskId&&e.identity?.taskId!==t.taskId||t.workspaceId&&e.identity?.workspaceId!==t.workspaceId||t.repositoryId&&e.identity?.repositoryId!==t.repositoryId||t.producerId&&e.provenance.producer.id!==t.producerId||t.sensitivity&&!t.sensitivity.includes(e.sensitivity))}function Nr(e,t){return e.artifact.createdAt.localeCompare(t.artifact.createdAt)||e.artifact.artifactId.localeCompare(t.artifact.artifactId)||e.artifact.revision-t.artifact.revision}function ci(e,t){let r=!1;for(let n of e)(n.type==="comment-resolved"||n.type==="comment-reopened")&&n.commentId===t&&(r=n.type==="comment-resolved");return{resolved:r}}function Ee(e){return structuredClone(e)}function oe(e){return{artifact:Ee(e.artifact),recordVersion:e.recordVersion,etag:`${e.artifact.artifactId}:${e.artifact.revision}:${e.recordVersion}`,lifecycleEvents:structuredClone(e.lifecycleEvents),reviewEvents:structuredClone(e.reviewEvents),reviewSummary:gt(e.reviewEvents)}}var ht=32*1024*1024,li=1024*1024*1024,ui=/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$/;function At(e){let r=(e.now??(()=>new Date().toISOString()))(),n=new Set;return e.evidence.map((o,i)=>{if(fi(o),n.has(o.evidenceId))throw new d("AUTOMATION_EVIDENCE_INVALID",`Duplicate evidence ID ${o.evidenceId}`);n.add(o.evidenceId);let a=pi(o),c=di("sha256").update(`${e.request.operationId}\0${o.evidenceId}\0${a.hash.value}`).digest("hex").slice(0,32);return{schemaVersion:1,artifactId:`automation_${c}`,revision:1,kind:o.kind,title:o.title,...o.description?{description:o.description}:{},state:"draft",createdAt:r,mediaType:o.mediaType,sensitivity:o.sensitivity??e.policy.sensitivity,identity:{...e.request.identity},content:a,provenance:{producer:{kind:"tool",id:e.request.governingToolName,displayName:e.manifest.adapterId,profileFingerprint:e.request.executionContract.profile.fingerprint},operationId:e.request.operationId,executionContractFingerprint:e.request.executionContract.fingerprint,capabilityLeaseIds:[e.request.capabilityLeaseId],attributes:{automationProtocolVersion:e.request.protocolVersion,automationOperation:e.request.operation,automationEvidenceId:o.evidenceId,automationEvidencePhase:o.phase,adapterId:e.manifest.adapterId,adapterVersion:e.manifest.adapterVersion,evidenceIndex:i}},...o.anchors?{anchors:structuredClone(o.anchors)}:{},...e.policy.retainUntil||e.policy.legalHold!==void 0?{retention:{...e.policy.retainUntil?{retainUntil:e.policy.retainUntil}:{},...e.policy.legalHold!==void 0?{legalHold:e.policy.legalHold}:{}}}:{},extensions:{...o.extensions??{},xenoAutomation:{phase:o.phase,adapter:e.manifest.adapterId,certifiedAdapter:e.manifest.certified}}}})}async function Se(e,t){if(!e)return t.map(n=>structuredClone(n));let r=[];for(let n of t)try{let o=await e.create(n);r.push(o.artifact)}catch(o){if(o instanceof f&&o.code==="ARTIFACT_ALREADY_EXISTS"){let i=await e.require(n.artifactId,n.revision);if(i.artifact.content.hash.value===n.content.hash.value){r.push(i.artifact);continue}}throw new d("AUTOMATION_EVIDENCE_PERSISTENCE_FAILED",`Failed to persist automation evidence ${n.artifactId}`,{artifactId:n.artifactId},{cause:o})}return r}function De(e,t,r){if(t[r]==="required"&&!e.some(n=>n.phase===r))throw new d("AUTOMATION_EVIDENCE_REQUIRED",`Automation operation requires ${r} evidence before it can be trusted`)}function pi(e){if(e.content.type==="text"){let t=Buffer.byteLength(e.content.text,"utf8");return kr(t),{hash:re(e.content.text),sizeBytes:t,storage:{type:"inline",text:e.content.text},encoding:"utf8",...e.redactedPreview?{redactedPreview:e.redactedPreview}:{}}}if(e.content.type==="base64"){let t=mi(e.content.base64);return kr(t.byteLength),{hash:re(t),sizeBytes:t.byteLength,storage:{type:"inline",base64:e.content.base64},encoding:"base64",...e.redactedPreview?{redactedPreview:e.redactedPreview}:{}}}if(!Number.isSafeInteger(e.content.sizeBytes)||e.content.sizeBytes<0||e.content.sizeBytes>li)throw new d("AUTOMATION_EVIDENCE_INVALID","Referenced evidence size is invalid");if(!e.content.hash?.algorithm||!e.content.hash.value)throw new d("AUTOMATION_EVIDENCE_INVALID","Referenced evidence requires a content hash");if(e.content.hash.algorithm==="sha256"&&!/^[a-f0-9]{64}$/.test(e.content.hash.value))throw new d("AUTOMATION_EVIDENCE_INVALID","Referenced evidence SHA-256 is invalid");return{hash:{...e.content.hash},sizeBytes:e.content.sizeBytes,storage:structuredClone(e.content.storage),...e.content.encoding?{encoding:e.content.encoding}:{},...e.redactedPreview?{redactedPreview:e.redactedPreview}:{}}}function fi(e){(!e||typeof e!="object")&&j("Evidence must be an object"),ui.test(e.evidenceId)||j("Evidence ID is invalid"),["before","action","after","recording","diagnostic"].includes(e.phase)||j("Evidence phase is invalid"),(!e.kind||!e.title?.trim()||e.title.length>512)&&j("Evidence kind and title are required"),/^[\w!#$&^_.+-]+\/[\w!#$&^_.+-]+(?:;.*)?$/.test(e.mediaType)||j("Evidence media type is invalid")}function mi(e){(e.length===0||e.length>Math.ceil(ht/3)*4+4)&&j("Inline base64 evidence is empty or too large"),(!/^[A-Za-z0-9+/]*={0,2}$/.test(e)||e.length%4!==0)&&j("Inline evidence is not canonical base64");let t=Buffer.from(e,"base64");return t.toString("base64")!==e&&j("Inline evidence is not canonical base64"),t}function kr(e){e>ht&&j(`Inline evidence exceeds ${ht} bytes`)}function j(e){throw new d("AUTOMATION_EVIDENCE_INVALID",e)}import{createHash as Ai}from"node:crypto";import{createHash as gi,randomUUID as hi}from"node:crypto";var Xr=16*1024*1024;async function Lr(e,t,r,n){await e.assertCurrent(t);let o={operationId:t.operationId,fingerprint:r,ownerToken:hi()},i=await e.journal.begin(o);if(await e.assertCurrent(t),!i.claimed){if(i.record.outcome.kind!=="result")throw z();let p=await e.artifactRepository.require(i.record.outcome.artifactId,1),E=p.artifact;if(E.content.storage.type!=="inline"||E.content.encoding!=="utf8"||E.provenance.operationId!==t.operationId||E.extensions?.automationRequestFingerprint!==r)throw z();let m=E.content.storage.text;if(typeof m!="string"||Buffer.byteLength(m)>Xr||Le(m)!==i.record.outcome.sha256||E.content.hash.value!==i.record.outcome.sha256)throw z();let P=JSON.parse(m);return Dr(P,t),await e.assertCurrent(t),{...P,replayed:!0}}let a="automation-consume:"+Le(t.operationId+"\0"+r),c=await n(a);Dr(c,t);let s=JSON.stringify(c),l=Buffer.byteLength(s);if(l>Xr)throw z();let y=Le(s),A={schemaVersion:1,artifactId:"automation_result_"+Le(t.operationId+"\0"+r),revision:1,kind:"custom:automation-result",title:"Governed automation outcome",state:"draft",createdAt:c.completedAt,mediaType:"application/json",sensitivity:"restricted",identity:{...t.identity},content:{hash:{algorithm:"sha256",value:y},sizeBytes:l,encoding:"utf8",storage:{type:"inline",text:s}},provenance:{producer:{kind:"system",id:"xeno-governed-automation"},operationId:t.operationId,executionContractFingerprint:t.executionContract.fingerprint,capabilityLeaseIds:[t.capabilityLeaseId]},extensions:{automationRequestFingerprint:r}};return await e.assertCurrent(t),await Se(e.artifactRepository,[A]),await e.journal.finish(o,{kind:"result",artifactId:A.artifactId,sha256:y}),await e.assertCurrent(t),{...c,replayed:!1}}function Dr(e,t){if(!e||typeof e!="object")throw z();let r=e;if(r.operationId!==t.operationId||!["ok","error","cancelled","denied","evidence-incomplete"].includes(r.status)||!r.target||!Array.isArray(r.artifacts)||!r.lease||!r.adapter)throw z()}function Le(e){return gi("sha256").update(e).digest("hex")}function z(){return new d("AUTOMATION_OUTCOME_PENDING","Automation outcome is pending or unknown; recover the same operation rather than dispatching it again")}var Mr=3e4,Ur=1e3,Me=class{adapter;leaseAuthority;durable;artifactRepository;now;assertCurrent;executions=new Map;active=new Map;constructor(t){if(this.adapter=t.adapter,this.leaseAuthority=t.leaseAuthority,!!t.leaseAuthority==!!t.durable)throw new Error("Choose exactly one legacy or durable automation authority");this.durable=t.durable,this.artifactRepository=t.durable?.artifactRepository??t.artifactRepository,this.now=t.now??(()=>new Date().toISOString()),this.assertCurrent=t.assertCurrent||t.adapter.assertCurrent?async r=>{await t.assertCurrent?.(r),await t.adapter.assertCurrent?.(r)}:void 0,this.onPreflight=t.onPreflight,this.onGrant=t.onGrant}onPreflight;onGrant;execute(t,r){t=structuredClone(t);let n=Ei(t),o=this.executions.get(t.operationId);if(o){if(o.fingerprint!==n)throw new d("AUTOMATION_OPERATION_CONFLICT",`Operation ${t.operationId} was already submitted with different authority or parameters`);if(this.durable){let l=this.durable;return l.assertCurrent(t).then(()=>this.assertCurrent?.(t)).then(()=>o.promise).then(async y=>(await l.assertCurrent(t),await this.assertCurrent?.(t),structuredClone(y)))}return this.assertCurrent?Promise.resolve(this.assertCurrent(t)).then(()=>o.promise).then(async l=>(await this.assertCurrent?.(t),structuredClone(l))):o.promise}if(this.active.size>=Ur)throw new d("AUTOMATION_OPERATION_CONFLICT","Automation active-operation capacity reached");let i=new AbortController,a=vi(r,i);this.active.set(t.operationId,i);let c=this.durable,s=(c?Lr({...c,assertCurrent:async l=>{await c.assertCurrent(l),await this.assertCurrent?.(l)}},t,n,l=>this.executeFresh(t,i.signal,l)):this.executeFresh(t,i.signal)).finally(()=>{a(),this.active.delete(t.operationId)});return this.executions.set(t.operationId,{fingerprint:n,promise:s}),this.durable&&s.then(()=>this.executions.delete(t.operationId),()=>this.executions.delete(t.operationId)),this.trimIdempotencyRecords(),s}async stop(t,r="human-stop"){let n=this.active.get(t);return n?(n.abort(new Error(r)),await this.adapter.stop?.(t,r),!0):!1}async executeFresh(t,r,n){q(t),await this.assertCurrent?.(t),B(r);let o=await this.adapter.manifest();U(o),lt(t,o);let i=X(t.operation),a=br(t),c=this.now(),s=await this.adapter.preflight(t,r);yi(s,this.now()),ut(t,o,s.observedTarget),B(r),await this.onPreflight?.(structuredClone(t),structuredClone(s),r),B(r);let l=s.evidence??[];q(t),await this.assertCurrent?.(t),B(r),De(l,a,"before");let y=await Se(this.artifactRepository,At({request:t,manifest:o,policy:a,evidence:l,now:this.now}));if(B(r),Date.parse(s.expiresAt)<=Date.parse(this.now()))throw new d("AUTOMATION_PREFLIGHT_INVALID","Automation preflight expired before authority consumption");let A=wr(t,s.observedTarget);await this.assertCurrent?.(t);let p;if(this.durable){await this.durable.assertCurrent(t);let I=await this.durable.consume(n,t.capabilityLeaseId,t.expectedLeaseVersion,A);if(I.executionDisposition!=="dispatch-once"||I.replayed)throw z();p=I.lease,await this.durable.assertCurrent(t)}else p=await this.leaseAuthority.consume(t.capabilityLeaseId,t.expectedLeaseVersion,A);let E={contractFingerprint:t.executionContract.fingerprint,lease:p,capabilityUse:A};await this.onGrant?.(structuredClone(t),structuredClone(s),structuredClone(E),r),B(r);let m;try{B(r),q(t),await this.assertCurrent?.(t),B(r),m=await this.adapter.execute(t,s,E,r)}catch(I){return yt({request:t,manifest:o,descriptorEffect:i.effect,target:s.observedTarget,lease:p,artifacts:y,startedAt:c,completedAt:this.now(),status:r.aborted?"cancelled":"error",code:r.aborted?"AUTOMATION_CANCELLED":"AUTOMATION_ADAPTER_ERROR",message:r.aborted?"Automation operation was stopped":Si(I)})}if(Ii(m),B(r),q(t),await this.assertCurrent?.(t),m.operationId!==void 0&&m.operationId!==t.operationId)throw new d("AUTOMATION_RESPONSE_INVALID","Adapter returned another operation identity");let P=wi(s.observedTarget,m.observedTarget),T;try{ut(t,o,m.observedTarget)}catch(I){T=I instanceof Error?I:new Error(String(I))}if(P||T)return yt({request:t,manifest:o,descriptorEffect:i.effect,target:s.observedTarget,lease:p,artifacts:y,startedAt:m.startedAt,completedAt:m.completedAt,status:"error",code:"AUTOMATION_TARGET_CHANGED",message:P??T.message});if(m.status!=="ok")return{operationId:t.operationId,status:m.status,effect:i.effect,startedAt:m.startedAt,completedAt:m.completedAt,adapter:It(o),target:structuredClone(m.observedTarget),artifacts:y,lease:wt(p),error:m.error?{...m.error}:{code:"AUTOMATION_ADAPTER_ERROR",message:"Owning adapter refused the operation."}};let x=m.evidence??[];bi(l,x);let _=[],b;try{De(x,a,"after"),De([...l,...x],a,"recording"),_=await Se(this.artifactRepository,At({request:t,manifest:o,policy:a,evidence:x,now:this.now}))}catch(I){b=I instanceof Error?I:new Error(String(I))}let v=[...y,..._];return B(r),q(t),await this.assertCurrent?.(t),b?yt({request:t,manifest:o,descriptorEffect:i.effect,target:m.observedTarget,lease:p,artifacts:v,startedAt:m.startedAt,completedAt:m.completedAt,status:"evidence-incomplete",code:"AUTOMATION_EVIDENCE_INCOMPLETE",message:b.message}):{operationId:t.operationId,status:m.status,effect:i.effect,startedAt:m.startedAt,completedAt:m.completedAt,adapter:It(o),target:structuredClone(m.observedTarget),...m.data!==void 0?{data:structuredClone(m.data)}:{},artifacts:v,lease:wt(p),...m.error?{error:{...m.error}}:{}}}trimIdempotencyRecords(){for(;this.executions.size>Ur;){let t=this.executions.keys().next().value;if(!t||this.active.has(t))break;this.executions.delete(t)}}};function yi(e,t){if(!e||typeof e!="object"||!e.token?.trim())throw new d("AUTOMATION_PREFLIGHT_INVALID","Adapter returned an invalid preflight token");let r=Date.parse(e.preparedAt),n=Date.parse(e.expiresAt),o=Date.parse(t);if(!Number.isFinite(r)||!Number.isFinite(n)||n<=r||n<=o)throw new d("AUTOMATION_PREFLIGHT_INVALID","Adapter returned an expired or invalid preflight window");if(n-r>Mr)throw new d("AUTOMATION_PREFLIGHT_INVALID",`Preflight TTL exceeds ${Mr} ms`);if(!e.observedTarget||typeof e.observedTarget!="object")throw new d("AUTOMATION_PREFLIGHT_INVALID","Adapter did not bind an observed target")}function Ii(e){if(!e||typeof e!="object")throw new d("AUTOMATION_REQUEST_INVALID","Adapter returned no result");if(!["ok","denied","cancelled","error"].includes(e.status))throw new d("AUTOMATION_REQUEST_INVALID","Adapter returned an invalid status");if(!Number.isFinite(Date.parse(e.startedAt))||!Number.isFinite(Date.parse(e.completedAt)))throw new d("AUTOMATION_REQUEST_INVALID","Adapter result timestamps are invalid");if(Date.parse(e.completedAt)<Date.parse(e.startedAt))throw new d("AUTOMATION_REQUEST_INVALID","Adapter completion precedes its start");if(!e.observedTarget||typeof e.observedTarget!="object")throw new d("AUTOMATION_REQUEST_INVALID","Adapter result has no observed target")}function wi(e,t){let r=["tabId","pageId","deviceId","applicationId","displayId"];for(let n of r)if(e[n]!==void 0&&e[n]!==t[n])return`Adapter changed bound ${n} between preflight and execution`}function bi(e,t){let r=new Set(e.map(n=>n.evidenceId));for(let n of t){if(r.has(n.evidenceId))throw new d("AUTOMATION_EVIDENCE_INVALID",`Duplicate evidence ID ${n.evidenceId}`);r.add(n.evidenceId)}}function yt(e){return{operationId:e.request.operationId,status:e.status,effect:e.descriptorEffect,startedAt:e.startedAt,completedAt:e.completedAt,adapter:It(e.manifest),target:structuredClone(e.target),artifacts:e.artifacts,lease:wt(e.lease),error:{code:e.code,message:e.message}}}function It(e){return{adapterId:e.adapterId,adapterVersion:e.adapterVersion,platform:e.platform,architecture:e.architecture}}function wt(e){return{leaseId:e.leaseId,version:e.version,state:e.state,useCount:e.useCount}}function Ei(e){return Ai("sha256").update(JSON.stringify(bt(e))).digest("hex")}function bt(e){return Array.isArray(e)?e.map(bt):!e||typeof e!="object"?e:Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>[t,bt(r)]))}function vi(e,t){if(!e)return()=>{};let r=()=>t.abort(e.reason);return e.aborted?r():e.addEventListener("abort",r,{once:!0}),()=>e.removeEventListener("abort",r)}function B(e){if(e.aborted)throw new d("AUTOMATION_CANCELLED","Automation operation was stopped before dispatch")}function Si(e){return e instanceof Error&&e.message.slice(0,1024)||"Automation adapter failed"}import{isAbsolute as Ti}from"node:path";async function Fc(e){if(!Ti(e))throw Error("Automation journal requires an absolute host-owned path");let{DatabaseSync:t}=await import("node:sqlite");return new Et(new t(e))}var Et=class{constructor(t){this.database=t;try{if(t.exec("PRAGMA busy_timeout=0; PRAGMA synchronous=FULL; CREATE TABLE IF NOT EXISTS automation_execution_schema(id INTEGER PRIMARY KEY CHECK(id=1),version INTEGER NOT NULL); INSERT OR IGNORE INTO automation_execution_schema VALUES(1,1);"),t.prepare("SELECT version FROM automation_execution_schema WHERE id=1").get()?.version!==1)throw Error("Unsupported automation execution journal");t.exec("CREATE TABLE IF NOT EXISTS automation_executions(id TEXT PRIMARY KEY,body TEXT NOT NULL)")}catch(r){throw t.close(),this.closed=!0,r}}database;closed=!1;async begin(t){return t=structuredClone(t),vt(t),ue(t,["operationId","fingerprint","ownerToken"]),this.transaction(()=>{let r=this.read(t.operationId);if(r){if(r.fingerprint!==t.fingerprint)throw Ue();return{claimed:!1,record:r}}let n=this.database.prepare("SELECT COUNT(*) AS count FROM automation_executions").get()?.count;if(typeof n!="number"||n>=1e5)throw Error("Automation journal capacity reached; explicit archival required");let o={schemaVersion:1,...t,outcome:{kind:"pending"}};return this.database.prepare("INSERT INTO automation_executions(id,body) VALUES(?,?)").run(t.operationId,Br(o)),{claimed:!0,record:o}})}async get(t){if(typeof t!="string"||!t.trim()||t.length>1024)throw Error("Invalid automation journal identity");return this.transaction(()=>this.read(t))}async finish(t,r){t=structuredClone(t),r=structuredClone(r),vt(t),ue(t,["operationId","fingerprint","ownerToken"]);let n={schemaVersion:1,...t,outcome:r};return St(n),this.transaction(()=>{let o=this.read(t.operationId);if(!o||o.fingerprint!==t.fingerprint||o.ownerToken!==t.ownerToken)throw Ue();if(o.outcome.kind!=="pending"){if(JSON.stringify(o.outcome)!==JSON.stringify(r))throw Ue();return}this.database.prepare("UPDATE automation_executions SET body=? WHERE id=?").run(Br(n),t.operationId)})}close(){this.closed||(this.closed=!0,this.database.close())}read(t){let r=this.database.prepare("SELECT CASE WHEN length(body)<=16384 THEN body ELSE NULL END AS body FROM automation_executions WHERE id=?").get(t);if(!r)return;if(typeof r.body!="string")throw Error("Corrupt automation journal size");let n=JSON.parse(r.body);if(St(n),n.operationId!==t)throw Ue();return n}async transaction(t){let r=Date.now()+1e3;for(;;){if(this.closed)throw Error("Automation journal closed");let n=!1;try{this.database.exec("BEGIN IMMEDIATE"),n=!0;let o=t();return this.database.exec("COMMIT"),o}catch(o){if(n)try{this.database.exec("ROLLBACK")}catch{}if(Date.now()>=r||!/SQLITE_BUSY|database is locked/.test(String(o)))throw o;await new Promise(i=>setTimeout(i,10))}}}};function vt(e){for(let t of[e.operationId,e.ownerToken])if(typeof t!="string"||!t.trim()||t.length>1024)throw Error("Invalid automation journal identity");if(!/^[a-f0-9]{64}$/.test(e.fingerprint))throw Error("Invalid automation journal fingerprint")}function St(e){if(!e||typeof e!="object")throw Error("Invalid automation journal record");let t=e;if(vt(t),ue(t,["schemaVersion","operationId","fingerprint","ownerToken","outcome"]),t.schemaVersion!==1||!t.outcome)throw Error("Invalid automation journal schema");let r=t.outcome;if(r.kind==="result"){if(ue(r,["kind","artifactId","sha256"]),typeof r.artifactId!="string"||!r.artifactId||r.artifactId.length>256||!/^[a-f0-9]{64}$/.test(r.sha256))throw Error("Invalid automation result reference")}else if(r.kind==="failed"){if(ue(r,["kind","code"]),typeof r.code!="string"||!/^AUTOMATION_[A-Z_]{1,100}$/.test(r.code))throw Error("Invalid automation failure code")}else if(r.kind==="pending")ue(r,["kind"]);else throw Error("Invalid automation journal outcome")}function ue(e,t){if(Array.isArray(e)||Object.keys(e).some(r=>!t.includes(r)))throw Error("Unexpected automation journal fields")}function Br(e){St(e);let t=JSON.stringify(e);if(t.length>16384)throw Error("Automation journal record too large");return t}function Ue(){return new d("AUTOMATION_OPERATION_CONFLICT","Automation operation identity or owner conflicts with durable state")}function Ci(e,t=()=>new Date().toISOString()){let r=[];Pi(r,"manifest.valid",()=>U(e));let n=new Set(e.operations);return pe(r,n,e.supports.consoleInspection,"browser.console.read","console inspection"),pe(r,n,e.supports.networkInspection,"browser.network.read","network inspection"),pe(r,n,e.supports.storageInspection,"browser.storage.read","storage inspection"),pe(r,n,e.supports.pageErrorInspection,"browser.page-errors.read","page-error inspection"),pe(r,n,e.supports.recordings,"browser.record.start","recording start"),pe(r,n,e.supports.recordings,"browser.record.stop","recording stop"),n.has("browser.upload")&&J(r,"policy.upload",e.policyEnforcement.upload,"Upload policy is enforced"),n.has("browser.download")&&J(r,"policy.download",e.policyEnforcement.download,"Download policy is enforced"),[...n].some(o=>o.startsWith("browser."))&&(J(r,"policy.redirect",e.policyEnforcement.redirect,"Redirect policy is enforced"),J(r,"control.handback",e.supports.deterministicHandback,"Deterministic hand-back is supported")),[...n].some(o=>o.startsWith("computer."))&&(J(r,"control.stop",e.supports.immediateStop,"Immediate human stop is supported"),J(r,"privacy.redaction",e.supports.sensitiveRegionRedaction,"Sensitive-region redaction is supported")),J(r,"certification.binding",!e.certified||!!e.certificationArtifactId,e.certified?"Certification artifact is bound":"Adapter does not claim certification"),{protocolVersion:1,adapter:{adapterId:e.adapterId,adapterVersion:e.adapterVersion,platform:e.platform,architecture:e.architecture},generatedAt:t(),passed:r.every(o=>o.status==="pass"),checks:r}}function qc(e){let r=Ci(e).checks.filter(n=>n.status==="fail");if(r.length>0)throw new d("AUTOMATION_OPERATION_UNSUPPORTED",r.map(n=>`${n.id}: ${n.message}`).join("; "))}function pe(e,t,r,n,o){let i=t.has(n);J(e,`capability.${n}`,r===i,r===i?`${o} declaration matches the operation catalog`:`${o} declaration does not match ${n}`)}function Pi(e,t,r){try{r(),e.push({id:t,status:"pass",message:"Manifest satisfies the protocol contract"})}catch(n){e.push({id:t,status:"fail",message:n instanceof Error?n.message:String(n)})}}function J(e,t,r,n){e.push({id:t,status:r?"pass":"fail",message:n})}var xi=6e4,Ri=48*1024*1024,Be=class{endpoint;token;timeoutMs;maxResponseBytes;fetchImpl;ownedView;constructor(t){if(this.endpoint=Oi(t.baseUrl),this.token=_i(t.token),this.timeoutMs=$r(t.timeoutMs??xi,1e3,3e5,"timeoutMs"),this.maxResponseBytes=$r(t.maxResponseBytes??Ri,1024,128*1024*1024,"maxResponseBytes"),this.fetchImpl=t.fetch??globalThis.fetch,t.ownedView&&(!/^[a-f0-9]{64}$/.test(t.ownedView.ownerId)||!t.ownedView.sessionId?.trim()))throw new d("AUTOMATION_REQUEST_INVALID","Owned Browser frame binding is invalid.");if(this.ownedView=t.ownedView?Object.freeze({...t.ownedView}):void 0,typeof this.fetchImpl!="function")throw new d("AUTOMATION_TRANSPORT_ERROR","A Fetch API implementation is required")}manifest(){return this.request("manifest","GET")}async preflight(t,r){let n=await this.request("preflight","POST",t,r);if(this.ownedView&&t.operation==="browser.screenshot"){let o=t.declaredTarget?.tabId;if(!o||n.observedTarget.tabId!==o||t.identity.sessionId!==this.ownedView.sessionId)throw new d("AUTOMATION_IDENTITY_MISMATCH","Owned capture requires the exact host session and tab.");let i=await this.request(`target?tabId=${encodeURIComponent(o)}`,"GET",void 0,r);if(i.tabId!==o||!Number.isSafeInteger(i.documentEpoch)||i.documentEpoch<0)throw new d("AUTOMATION_TARGET_CHANGED","Owned capture target metadata changed.");return{...n,adapterState:{...n.adapterState,ownedViewDocumentEpoch:i.documentEpoch}}}return n}async execute(t,r,n,o){if(this.ownedView&&t.operation==="browser.screenshot"){let i=t.declaredTarget?.tabId,a=r.adapterState?.ownedViewDocumentEpoch;if(!i||r.observedTarget.tabId!==i||t.identity.sessionId!==this.ownedView.sessionId||!Number.isSafeInteger(a))throw new d("AUTOMATION_IDENTITY_MISMATCH","Owned frame does not bind this request.");let c=new Date().toISOString(),s=await this.request("view-frame","POST",{version:1,...this.ownedView,tabId:i,documentEpoch:a,request:t,preflight:r,grant:n},o);if(s.version!==1||s.ownerId!==this.ownedView.ownerId||s.sessionId!==this.ownedView.sessionId||s.tabId!==i||s.documentEpoch!==a||s.mediaType!=="image/png"||!Number.isFinite(Date.parse(s.capturedAt))||Date.parse(s.capturedAt)<Date.parse(c)||s.origin!==new URL(r.observedTarget.url??r.observedTarget.origin??"").origin||typeof s.base64!="string"||s.base64.length>5592408||!/^[A-Za-z0-9+/]+={0,2}$/.test(s.base64)||s.base64.length%4!==0)throw new d("AUTOMATION_RESPONSE_INVALID","Owned Browser returned a changed or oversized frame.");o.throwIfAborted(),q(t);let l=Buffer.from(s.base64,"base64");if(l.length<24||l.length>4*1024*1024||l.subarray(0,8).toString("hex")!=="89504e470d0a1a0a"||l.readUInt32BE(16)<1||l.readUInt32BE(20)<1||l.readUInt32BE(16)*l.readUInt32BE(20)>2073600)throw new d("AUTOMATION_RESPONSE_INVALID","Owned Browser returned invalid bounded PNG bytes.");return{operationId:t.operationId,status:"ok",startedAt:c,completedAt:s.capturedAt,observedTarget:r.observedTarget,evidence:[{evidenceId:`${t.operationId}.after`,phase:"after",kind:"screenshot",title:"Owned Browser frame",mediaType:"image/png",content:{type:"base64",base64:s.base64},sensitivity:"restricted"}]}}return this.request("execute","POST",{request:t,preflight:r,grant:n},o)}async stop(t,r){await this.request("stop","POST",{operationId:t,reason:r.slice(0,512)})}async request(t,r,n,o){let i=new AbortController,a=Xi(o,i),c=setTimeout(()=>i.abort(new Error("automation transport timeout")),this.timeoutMs);try{if(i.signal.aborted)throw new Error("Automation was cancelled before dispatch");let s=new URL(t,this.endpoint),l=this.fetchImpl(s,{method:r,redirect:"error",cache:"no-store",credentials:"omit",headers:{authorization:`Bearer ${this.token}`,accept:"application/json",...r==="POST"?{"content-type":"application/json"}:{}},...r==="POST"?{body:JSON.stringify(n??{})}:{},signal:i.signal});l.then(p=>{i.signal.aborted&&p.body?.cancel().catch(()=>{})},()=>{});let y=await Tt(l,i.signal),A=await Tt(Ni(y,this.maxResponseBytes,i.signal),i.signal);if(!y.ok){let p=ki(A);throw new d("AUTOMATION_TRANSPORT_ERROR",`XENO Browser rejected ${t}: ${p.message}`,{status:y.status,route:t,adapterCode:p.code})}if(!Ct(A)||A.ok!==!0||!("result"in A))throw new d("AUTOMATION_RESPONSE_INVALID",`XENO Browser returned an invalid ${t} envelope`);return A.result}catch(s){if(s instanceof d)throw s;let l=o?.aborted;throw new d(l?"AUTOMATION_CANCELLED":"AUTOMATION_TRANSPORT_ERROR",l?"Automation transport was stopped":`XENO Browser ${t} transport failed`,{route:t},{cause:s})}finally{clearTimeout(c),a()}}};function Oi(e){let t;try{t=new URL(e)}catch(n){throw new d("AUTOMATION_TRANSPORT_ERROR","XENO Browser base URL is invalid",void 0,{cause:n})}if(t.protocol!=="http:"&&t.protocol!=="https:")throw new d("AUTOMATION_TRANSPORT_ERROR","XENO Browser transport requires HTTP(S)");if(t.username||t.password||t.search||t.hash)throw new d("AUTOMATION_TRANSPORT_ERROR","XENO Browser base URL cannot contain credentials, query, or fragment");let r=t.hostname.toLowerCase().replace(/^\[|\]$/g,"").replace(/\.$/,"");if(r!=="localhost"&&r!=="127.0.0.1"&&r!=="::1")throw new d("AUTOMATION_TRANSPORT_ERROR","XENO Browser transport must use a loopback host");if(!t.port)throw new d("AUTOMATION_TRANSPORT_ERROR","XENO Browser transport requires an explicit port");return t.pathname="/v1/automation/",t}function _i(e){if(typeof e!="string"||e.length<32||e.length>512||/\s/.test(e))throw new d("AUTOMATION_TRANSPORT_ERROR","XENO Browser session token is invalid");return e}async function Ni(e,t,r){let n=Number(e.headers.get("content-length"));if(Number.isFinite(n)&&n>t)throw new d("AUTOMATION_RESPONSE_INVALID",`XENO Browser response exceeds ${t} bytes`);if(e.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase()!=="application/json")throw new d("AUTOMATION_RESPONSE_INVALID","XENO Browser response is not application/json");if(!e.body)throw new d("AUTOMATION_RESPONSE_INVALID","XENO Browser response body is missing");let i=e.body.getReader(),a=[],c=0;try{for(;;){let{done:y,value:A}=await Tt(i.read(),r);if(y)break;if(c+=A.byteLength,c>t)throw await i.cancel("response too large"),new d("AUTOMATION_RESPONSE_INVALID",`XENO Browser response exceeds ${t} bytes`);a.push(A)}}finally{i.cancel().catch(()=>{}),i.releaseLock()}let s=new Uint8Array(c),l=0;for(let y of a)s.set(y,l),l+=y.byteLength;try{return JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(s))}catch(y){throw new d("AUTOMATION_RESPONSE_INVALID","XENO Browser response contains invalid JSON",void 0,{cause:y})}}async function Tt(e,t){let r,n=new Promise((o,i)=>{r=()=>i(t.reason??new Error("Automation operation cancelled")),t.addEventListener("abort",r,{once:!0}),t.aborted&&r()});try{return await Promise.race([e,n])}finally{t.removeEventListener("abort",r)}}function ki(e){return Ct(e)&&Ct(e.error)?{code:typeof e.error.code=="string"?e.error.code.slice(0,128):"UNKNOWN",message:typeof e.error.message=="string"?e.error.message.slice(0,1024):"request failed"}:{code:"UNKNOWN",message:"request failed"}}function Xi(e,t){if(!e)return()=>{};let r=()=>t.abort(e.reason);return e.aborted?r():e.addEventListener("abort",r,{once:!0}),()=>e.removeEventListener("abort",r)}function $r(e,t,r,n){if(!Number.isSafeInteger(e)||e<t||e>r)throw new d("AUTOMATION_TRANSPORT_ERROR",`${n} must be an integer from ${t} to ${r}`);return e}function Ct(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}var td=["browser.navigate","browser.back","browser.forward","browser.reload","browser.wait","browser.snapshot","browser.screenshot","browser.locate","browser.tabs.list","browser.tabs.open","browser.console.read","browser.network.read","browser.storage.read","browser.page-errors.read","browser.click","browser.type","browser.key","browser.select","browser.scroll","browser.tabs.close","browser.upload","browser.download"],Te=class extends Be{driver;constructor(t){super(t),this.driver=t.driver}async manifest(){let t=await super.manifest();if(U(t),!(this.driver==="browser"?["xeno-browser","xeno-browser-native"]:["xeno-extension-native","xeno-extension"]).includes(t.adapterId)||t.operations.some(n=>!n.startsWith("browser.")))throw new d("AUTOMATION_OPERATION_UNSUPPORTED","Configured Browser driver returned a different owning adapter contract.");return t}};import{existsSync as hn,readFileSync as An}from"node:fs";import{randomUUID as Wa}from"node:crypto";import{homedir as qa}from"node:os";import{join as fn,resolve as Ce}from"node:path";import{randomUUID as Zr}from"node:crypto";import{mkdir as Qr,open as zr,readFile as Wi,stat as en,unlink as qi}from"node:fs/promises";import{basename as Jr,dirname as Kr,join as zi,resolve as Ji}from"node:path";import*as $ from"node:fs/promises";var Di=new Set(["EACCES","EBUSY","EPERM"]),Li=[10,20,40,80,160,320,640];async function Vr(e,t){for(let r=0;;r+=1)try{await $.rename(e,t);return}catch(n){let o=n.code,i=Li[r];if(process.platform!=="win32"||!o||!Di.has(o)||i===void 0)throw n;await new Promise(a=>setTimeout(a,i))}}import{mkdirSync as Mi,readFileSync as Ui,rmSync as jr,writeFileSync as Bi}from"node:fs";import{hostname as Hr}from"node:os";import{dirname as $i}from"node:path";function Vi(){return new Date().toISOString()}function Fi(){return new Date(Date.now()-Math.floor(process.uptime()*1e3)).toISOString()}function Gr(e){try{return JSON.parse(Ui(e,"utf8"))}catch{return null}}function ji(e){if(!e||e<=0)return!1;try{return process.kill(e,0),!0}catch{return!1}}function Hi(e){return e.hostname!==Hr()?!0:ji(e.pid)}function Fr(e,t){Mi($i(e),{recursive:!0}),Bi(e,JSON.stringify(t,null,2)+`
+`,{encoding:"utf8",flag:"wx"})}function Gi(e,t){let r=Gr(e);r?.pid!==t.pid||r.hostname!==t.hostname||jr(e,{force:!0})}function Wr(e,t,r){let n=Vi(),o={schemaVersion:1,name:t,pid:process.pid,hostname:Hr(),processStartedAt:Fi(),version:r,acquiredAt:n,updatedAt:n};try{Fr(e,o)}catch(i){if(i.code!=="EEXIST")throw i;let c=Gr(e);if(c&&Hi(c))throw new Error(`${t} is already locked by PID ${c.pid} on ${c.hostname}.`);jr(e,{force:!0}),Fr(e,o)}return{record:o,release:()=>{Gi(e,o)}}}var qr="0.10.37";var tn=1,Ki="repository.v1.json",Yi=5e3,Zi=20,Qi=64*1024*1024,$e=class{directory;snapshotPath;backupPath;lockPath;now;lockTimeoutMs;lockRetryMs;maxSnapshotBytes;onRecovery;mutationTail=Promise.resolve();constructor(t){if(!t||typeof t.directory!="string"||t.directory.trim().length===0)throw new TypeError("Artifact repository directory is required");let r=t.snapshotFileName??Ki;if(Jr(r)!==r||!/^[A-Za-z0-9_.-]+$/.test(r))throw new TypeError("Artifact snapshot filename must be a safe basename");this.directory=Ji(t.directory),this.snapshotPath=zi(this.directory,r),this.backupPath=`${this.snapshotPath}.bak`,this.lockPath=`${this.snapshotPath}.lock`,this.now=t.now??(()=>new Date().toISOString()),this.lockTimeoutMs=Pt(t.lockTimeoutMs,Yi,100,6e4,"lockTimeoutMs"),this.lockRetryMs=Pt(t.lockRetryMs,Zi,1,1e3,"lockRetryMs"),this.maxSnapshotBytes=Pt(t.maxSnapshotBytes,Qi,1024,1024*1024*1024,"maxSnapshotBytes"),this.onRecovery=t.onRecovery}async create(t){return this.mutate(r=>r.create(t))}async createRevision(t,r){return this.mutate(n=>n.createRevision(t,r))}async get(t,r){return(await this.load()).repository.get(t,r)}async require(t,r){return(await this.load()).repository.require(t,r)}async list(t){return(await this.load()).repository.list(t)}async listRevisions(t){return(await this.load()).repository.listRevisions(t)}async transition(t){return this.mutate(r=>r.transition(t))}async appendReviewEvent(t){return this.mutate(r=>r.appendReviewEvent(t))}async inspectSnapshot(){return this.readSnapshot(this.snapshotPath,!0)}async mutate(t){return this.enqueueMutation(async()=>{let r=await this.acquireLock();try{let n=await this.load(),o=await t(n.repository);return await this.persist(n),o}finally{r.release()}})}async enqueueMutation(t){let r=this.mutationTail.then(t,t);return this.mutationTail=r.then(()=>{},()=>{}),r}async acquireLock(){let t=Date.now(),r;for(;Date.now()-t<=this.lockTimeoutMs;)try{return Wr(this.lockPath,`artifact-repository:${Jr(this.snapshotPath)}`,qr)}catch(n){if(!(n instanceof Error)||!/already locked by PID/.test(n.message))throw n;r=n,await oa(this.lockRetryMs)}throw new f("ARTIFACT_PERSISTENCE_LOCKED",`Artifact repository remained locked for ${this.lockTimeoutMs}ms`,{snapshotPath:this.snapshotPath},{cause:r})}async load(){let t,r,n=!1;try{r=await this.readSnapshot(this.snapshotPath,!1)}catch(i){t=Ve(i)}if(!r&&(t||await na(this.backupPath)))try{let i=await this.readSnapshot(this.backupPath,!0);i&&(this.onRecovery?.({snapshotPath:this.snapshotPath,backupPath:this.backupPath,reason:t?.message??"primary snapshot missing"}),r=i,n=!0)}catch(i){throw t?new f("ARTIFACT_PERSISTENCE_CORRUPT","Artifact repository primary and backup snapshots are unreadable",{snapshotPath:this.snapshotPath,backupPath:this.backupPath},{cause:new AggregateError([t,Ve(i)])}):i}if(!r&&t)throw t;let o=r?.state??{schemaVersion:1,records:[]};return{repository:new ve({now:this.now,idFactory:i=>`${i}_${Zr()}`,initialState:o}),generation:r?.generation??0,createdAt:r?.createdAt??this.now(),hasSnapshot:r!==void 0,recoveredFromBackup:n,...r?{sourceSnapshot:r}:{}}}async persist(t){let r=this.now(),o={...{schemaVersion:tn,generation:t.generation,createdAt:t.createdAt,updatedAt:r,state:t.repository.exportState()},generation:t.generation+1},i=ta(o),a=`${JSON.stringify(i,null,2)}
+`;if(Buffer.byteLength(a,"utf8")>this.maxSnapshotBytes)throw new f("ARTIFACT_PERSISTENCE_IO",`Artifact repository snapshot exceeds ${this.maxSnapshotBytes} bytes`,{snapshotPath:this.snapshotPath,maxSnapshotBytes:this.maxSnapshotBytes});await Qr(this.directory,{recursive:!0,mode:448}),t.hasSnapshot&&!t.recoveredFromBackup&&t.sourceSnapshot&&await Yr(this.backupPath,`${JSON.stringify(t.sourceSnapshot,null,2)}
+`),await Yr(this.snapshotPath,a)}async readSnapshot(t,r){let n;try{n=await en(t)}catch(o){if(!r&&Rt(o,"ENOENT")||r&&Rt(o,"ENOENT"))return;throw Ot("Unable to inspect artifact repository snapshot",t,o)}if(!n.isFile()||n.size>this.maxSnapshotBytes)throw new f("ARTIFACT_PERSISTENCE_CORRUPT","Artifact repository snapshot is not a bounded regular file",{snapshotPath:t,sizeBytes:n.size,maxSnapshotBytes:this.maxSnapshotBytes});try{let o=await Wi(t);if(o.byteLength>this.maxSnapshotBytes)throw new Error("snapshot grew beyond the configured size limit while reading");return ea(JSON.parse(o.toString("utf8")),t)}catch(o){throw o instanceof f?o:Ot("Unable to parse artifact repository snapshot",t,o,!0)}}};function ea(e,t){if(!xt(e)||e.schemaVersion!==tn||!Number.isInteger(e.generation)||e.generation<0||typeof e.createdAt!="string"||!Number.isFinite(Date.parse(e.createdAt))||typeof e.updatedAt!="string"||!Number.isFinite(Date.parse(e.updatedAt))||!xt(e.state)||e.state.schemaVersion!==1||!Array.isArray(e.state.records)||!xt(e.checksum)||e.checksum.algorithm!=="sha256"||typeof e.checksum.value!="string")throw new f("ARTIFACT_PERSISTENCE_CORRUPT","Artifact repository snapshot envelope is invalid",{snapshotPath:t});let r=e,n=ra(r),o=rn(n);if(r.checksum.value!==o)throw new f("ARTIFACT_PERSISTENCE_CORRUPT","Artifact repository snapshot checksum does not match its payload",{snapshotPath:t});return new ve({initialState:r.state}),structuredClone(r)}function ta(e){return{...structuredClone(e),checksum:{algorithm:"sha256",value:rn(e)}}}function ra(e){return{schemaVersion:e.schemaVersion,generation:e.generation,createdAt:e.createdAt,updatedAt:e.updatedAt,state:e.state}}function rn(e){return re(JSON.stringify(e)).value}async function Yr(e,t){await Qr(Kr(e),{recursive:!0,mode:448});let r=`${e}.tmp.${process.pid}.${Zr()}`,n;try{n=await zr(r,"wx",384),await n.writeFile(t,{encoding:"utf8"}),await n.sync(),await n.close(),n=void 0,await Vr(r,e);try{let o=await zr(Kr(e),"r");try{await o.sync()}finally{await o.close()}}catch{}}finally{n&&await n.close().catch(()=>{}),await qi(r).catch(()=>{})}}function Pt(e,t,r,n,o){if(e===void 0)return t;if(!Number.isInteger(e)||e<r||e>n)throw new TypeError(`${o} must be an integer between ${r} and ${n}`);return e}function xt(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function Rt(e,t){return e instanceof Error&&e.code===t}async function na(e){try{return(await en(e)).isFile()}catch(t){if(Rt(t,"ENOENT"))return!1;throw Ot("Unable to inspect artifact repository backup",e,t)}}function Ve(e){return e instanceof Error?e:new Error(String(e))}function Ot(e,t,r,n=!1){return new f(n?"ARTIFACT_PERSISTENCE_CORRUPT":"ARTIFACT_PERSISTENCE_IO",`${e}: ${Ve(r).message}`,{snapshotPath:t},{cause:Ve(r)})}function oa(e){return new Promise(t=>setTimeout(t,e))}import{homedir as ia,platform as aa,release as sa}from"node:os";var Sd=aa();var Td=sa(),Cd=ia();var Nd=10080*60*1e3;var ca=2,_t=["publish","deploy","push","send","purchase","sign","file-legal","change-infrastructure"];function da(e){return Array.from(new Set((e??[]).map(t=>t.trim()).filter(Boolean)))}function H(e){return{schemaVersion:ca,id:e.id,version:"1.0.0",displayName:e.displayName,description:e.description,kind:e.kind??"primary",prompt:e.prompt,capabilities:{tools:e.toolPolicy??{mode:"inherit"},skills:{preload:e.skills??[],...e.skillAllow?{allow:e.skillAllow}:{},deny:[]},hooks:[],permissionProfile:e.permissionProfile??"default",externalActions:{default:e.externalDefault??"ask",...e.externalOverrides?{overrides:e.externalOverrides}:{},requireCurrentTurnApproval:e.currentTurnApproval??[]}},memory:{scope:e.memoryScope??"project",role:e.id,soul:e.soul??"read"},execution:{defaultMode:e.defaultMode??"chat",allowedModes:e.allowedModes??["chat","plan","execute","review"],isolation:e.isolation??"none",allowBackground:e.allowBackground??!0,planForComplexTasks:e.planForComplexTasks??!0,defaultDryRun:e.defaultDryRun??!1},completion:{evidence:e.evidence??[],requirePrimarySources:e.primarySources??!1,requireCurrentInformation:e.currentInformation??!1,requireHumanReview:e.humanReview??!1,stopConditions:e.stopConditions??["The requested outcome is complete and required evidence has been reported.","A real authorization, information, or external-state blocker prevents safe progress."]},presentation:{label:e.displayName,color:e.color,glyph:e.glyph},tags:da(e.tags)}}var Md=[H({id:"assistant",displayName:"Assistant",description:"General-purpose XENO collaborator for mixed research, planning, and implementation work.",prompt:["Work as a thoughtful generalist. Establish the user's actual outcome, inspect relevant context, and take scoped action.","Escalate into a narrower specialist profile when domain risk or task depth warrants it."].join(`
+`),toolPolicy:{mode:"inherit"},skills:[],memoryScope:"user",evidence:["file-references"],currentTurnApproval:[..._t],color:"cyan",glyph:"\u25A0",tags:["general","primary"]}),H({id:"swe",displayName:"Software Engineer",description:"Repository-aware software engineer for careful implementation, debugging, refactoring, and verification.",prompt:["Inspect the repository before editing. Follow project instructions and preserve unrelated work.","Trace the smallest root cause, implement the narrowest coherent change, and verify from focused checks outward.","Do not claim completion without concrete test, typecheck, build, or runtime evidence appropriate to the risk."].join(`
+`),toolPolicy:{mode:"default"},skills:["debug","run","verify"],permissionProfile:"trusted-dev",soul:"learn",evidence:["file-references","tests","typecheck","build","diff"],currentTurnApproval:["publish","deploy","push","change-infrastructure"],color:"green",glyph:"\u25C6",tags:["engineering","implementation"]}),H({id:"reviewer",displayName:"Code Reviewer",description:"Read-only reviewer focused on correctness, regressions, safety, tests, and maintainability.",prompt:["Lead with concrete findings ordered by severity. Cite exact file locations and explain impact.","Do not edit code. Distinguish confirmed defects from risks and questions. State when no material finding is present."].join(`
+`),kind:"subagent",toolPolicy:{mode:"readOnly"},skills:["code-review","verify"],permissionProfile:"read-only",memoryScope:"session",soul:"read",allowedModes:["chat","review"],defaultMode:"review",evidence:["file-references","diff"],externalDefault:"deny",color:"yellow",glyph:"\u25C7",tags:["engineering","review","read-only"]}),H({id:"writer",displayName:"Writer",description:"Audience-aware writer and editor for clear, accurate, structurally coherent content.",prompt:["Determine audience, purpose, voice, format, and source constraints before drafting.","Preserve factual meaning, avoid invented claims, and revise for clarity, rhythm, consistency, and usefulness."].join(`
+`),toolPolicy:{mode:"default",allow:["Read","Glob","Grep","LS","Write","Edit","WebSearch","WebFetch","Think","AskUser","Skill"]},skills:["verify"],evidence:["sources","file-references","diff"],currentTurnApproval:["send","publish"],color:"magenta",glyph:"\u2726",tags:["writing","editing"]}),H({id:"research",displayName:"Researcher",description:"Evidence-first researcher for questions, comparisons, synthesis, and source-backed analysis.",prompt:["Break the question into verifiable claims. Prefer primary and authoritative sources, compare dates, and cite near each claim.","Separate sourced fact, inference, uncertainty, and recommendation. Do not make changes unless the user explicitly expands scope."].join(`
+`),toolPolicy:{mode:"readOnly"},skills:["verify"],permissionProfile:"default",memoryScope:"session",soul:"read",allowedModes:["chat","plan","review"],evidence:["sources","file-references"],primarySources:!0,currentInformation:!0,externalDefault:"deny",color:"blue",glyph:"\u25C8",tags:["research","qa","read-only"]}),H({id:"product",displayName:"Product",description:"Product strategist for problem framing, requirements, sequencing, metrics, and trade-off decisions.",prompt:["Start from the user problem and observable outcome. Distinguish evidence, assumptions, constraints, and open decisions.","Translate strategy into testable requirements, acceptance criteria, telemetry, risks, and a sequenced delivery path."].join(`
+`),toolPolicy:{mode:"default",allow:["Read","Glob","Grep","LS","Write","Edit","WebSearch","WebFetch","Think","AskUser","Skill"]},skills:["verify"],evidence:["sources","file-references","diff"],currentTurnApproval:["send","publish","change-infrastructure"],color:"cyan",glyph:"\u25A3",tags:["product","planning"]}),H({id:"ci",displayName:"CI Engineer",description:"Continuous-integration specialist for reproducing, repairing, and hardening automated gates.",prompt:["Identify the exact failing job and command. Reproduce it locally or in an equivalent immutable environment before patching.","Fix only the underlying failure, retain logs as evidence, and rerun the matching gate before broader validation."].join(`
+`),toolPolicy:{mode:"default"},skills:["ci-repair","debug","run","verify"],permissionProfile:"trusted-dev",soul:"learn",evidence:["tests","typecheck","build","diff"],currentTurnApproval:["push","deploy","change-infrastructure"],color:"green",glyph:"\u25A4",tags:["engineering","ci","automation"]}),H({id:"devops",displayName:"DevOps and Release",description:"Dry-run-first infrastructure and release specialist with explicit external-action gates.",prompt:["Inspect the release or infrastructure contract first. Build an immutable candidate and produce reproducible evidence.","Default to plan, preview, dry-run, and local verification. Never publish, deploy, push, sign, purchase, or mutate infrastructure unless the current user turn explicitly authorizes that exact action and target.","For releases, preserve SDK-before-CLI dependency order and verify the public artifact after publication."].join(`
+`),toolPolicy:{mode:"default"},skills:["release","run","verify"],permissionProfile:"default",memoryScope:"project",soul:"learn",isolation:"worktree",defaultMode:"plan",defaultDryRun:!0,evidence:["tests","build","diff","deployment-proof","human-review"],humanReview:!0,currentTurnApproval:["publish","deploy","push","purchase","sign","change-infrastructure"],color:"yellow",glyph:"\u2B22",tags:["devops","release","infrastructure"]}),H({id:"legal-research",displayName:"Legal Research",description:"Restricted legal-information researcher that produces sourced analysis for qualified human review.",prompt:["Identify jurisdiction, effective date, parties, and the precise legal question before analyzing it.","Use current primary legal sources wherever possible. Cite each material proposition and distinguish law, interpretation, uncertainty, and practical next steps.","Provide legal information, not professional representation. Never sign, file, submit, contact a party, accept terms, or make a payment."].join(`
+`),toolPolicy:{mode:"readOnly"},skills:["verify"],permissionProfile:"default",memoryScope:"session",soul:"disabled",allowedModes:["chat","plan","review"],defaultMode:"review",evidence:["sources","human-review"],primarySources:!0,currentInformation:!0,humanReview:!0,externalDefault:"deny",color:"red",glyph:"\xA7",tags:["legal","research","restricted","read-only"],stopConditions:["The jurisdiction or effective date is unknown and materially changes the answer.","The task requires legal representation, filing, signature, payment, or contact with a third party.","The sourced analysis is complete and clearly marked for qualified human review."]})];var on=1,R=class extends Error{constructor(r,n,o){super(n);this.code=r;this.detail=o;this.name="XenoCapabilityLeaseError"}code;detail},la=new Set(["filesystem-write","process-execute","network-connect","secret-use","external-action","browser-act","computer-act"]),ua=new Set(_t),pa=new Set(["filesystem-read","filesystem-write","process-execute","network-connect","secret-use","external-action","browser-read","browser-act","computer-observe","computer-act","tool-invoke"]),fa=new Set(["cli","hub","ide","api","hosted"]),ma=/^[a-f0-9]{64}$/;function ga(e,t){an(e);let r=e.scope,n=r.governingToolName??e.subject.toolName;if(r.kind!=="external-action"){if(!n)return{eligible:!1,approvalRequirement:"principal",reason:"Non-external capability requests must identify the governing tool."};let o=Aa(t,n,r.effect);if(!o.eligible)return o}if(t.capabilities.permissionProfile==="read-only"&&r.effect!=="read")return{eligible:!1,approvalRequirement:"principal",reason:"The active read-only permission profile cannot request mutating, executable, or external authority."};if(r.kind==="external-action"){let o=r.externalAction;if(!o)return{eligible:!1,approvalRequirement:"current-turn",reason:"External-action capability requests require an exact action."};let i=t.capabilities.externalActions,a=i.overrides?.[o]??i.default;if(a==="deny")return{eligible:!1,approvalRequirement:"current-turn",profileDecision:a,reason:`Agent Profile ${t.profile.id} denies external action ${o}.`};let c=a==="ask"||i.requireCurrentTurnApproval.includes(o);return c&&!e.subject.turnId?{eligible:!1,approvalRequirement:"current-turn",profileDecision:a,reason:`External action ${o} requires a subject turn ID for current-turn approval.`}:{eligible:!0,approvalRequirement:c?"current-turn":"principal",profileDecision:a,reason:c?`External action ${o} requires approval in the active turn.`:`External action ${o} is requestable but still requires a bounded lease approval.`}}return{eligible:!0,approvalRequirement:"principal",reason:`Capability ${r.kind} is requestable within Agent Profile ${t.profile.id}.`}}function an(e){if(!e||typeof e!="object")throw h("Capability lease request must be an object");if(D(e.subject?.runId,"subject.runId"),D(e.subject?.agentId,"subject.agentId"),e.subject?.turnId!==void 0&&D(e.subject.turnId,"subject.turnId"),D(e.reason,"reason",8192),ae(e.requestedBy,"requestedBy"),ya(e.scope),e.policyFingerprints?.forEach(t=>je(t,"policyFingerprints")),e.maxUses!==void 0&&(!Number.isInteger(e.maxUses)||e.maxUses<1))throw h("maxUses must be a positive integer");if(e.durationMs!==void 0&&(!Number.isSafeInteger(e.durationMs)||e.durationMs<1))throw h("durationMs must be a positive safe integer");if(e.requestTtlMs!==void 0&&(!Number.isSafeInteger(e.requestTtlMs)||e.requestTtlMs<1))throw h("requestTtlMs must be a positive safe integer")}var Fe=class e{leases=new Map;now;idFactory;maximumDurationMs;maximumRequestTtlMs;maximumUses;idCounter=0;constructor(t={}){this.now=t.now??(()=>new Date().toISOString()),this.idFactory=t.idFactory??(()=>`lease_${Date.now().toString(36)}_${(++this.idCounter).toString(36)}`),this.maximumDurationMs=t.maximumDurationMs??15*6e4,this.maximumRequestTtlMs=t.maximumRequestTtlMs??5*6e4,this.maximumUses=t.maximumUses??100}static fromPersistedLease(t,r={}){ha(t);let n=new e(r);return n.leases.set(t.leaseId,K(t)),n}request(t,r){let n=ga(t,r);if(!n.eligible)throw new R("LEASE_NOT_REQUESTABLE",n.reason);let o=t.leaseId??this.idFactory();if(D(o,"leaseId"),this.leases.has(o))throw new R("LEASE_CONFLICT",`Capability lease ${o} already exists`);let i=this.now(),a=Math.min(t.durationMs??6e4,this.maximumDurationMs),c=Math.min(t.requestTtlMs??5*6e4,this.maximumRequestTtlMs),s=Math.min(t.maxUses??1,this.maximumUses),l={schemaVersion:on,leaseId:o,version:1,state:"requested",subject:wa(t.subject),scope:ba(t.scope),reason:t.reason,requestedAt:i,requestExpiresAt:nn(i,c),durationMs:a,maxUses:s,useCount:0,childInheritance:t.childInheritance??"none",approvalRequirement:n.approvalRequirement,requestedBy:{...t.requestedBy},profileFingerprint:r.fingerprint,policyFingerprints:ie(t.policyFingerprints??[]),...t.auditEventIds?{auditEventIds:ie(t.auditEventIds)}:{},...t.evidenceArtifactIds?{evidenceArtifactIds:ie(t.evidenceArtifactIds)}:{}};return this.leases.set(o,l),K(l)}approve(t){let r=this.requireMutable(t.leaseId);if(this.assertVersion(r,t.expectedVersion),this.refreshState(r),r.state!=="requested")throw new R("LEASE_CONFLICT",`Capability lease ${r.leaseId} is ${r.state}`);if(ae(t.approvedBy,"approvedBy"),sn(t.approvalContext),r.approvalRequirement==="current-turn"&&(!r.subject.turnId||t.approvalContext.turnId!==r.subject.turnId))throw new R("LEASE_APPROVAL_REQUIRED","Capability lease requires approval bound to the requesting turn");let n=this.now();return r.state="active",r.version+=1,r.activatedAt=n,r.expiresAt=nn(n,r.durationMs),r.approvedBy={...t.approvedBy},r.approvalContext={...t.approvalContext},K(r)}deny(t){let r=this.requireMutable(t.leaseId);if(this.assertVersion(r,t.expectedVersion),this.refreshState(r),r.state!=="requested")throw new R("LEASE_CONFLICT",`Capability lease ${r.leaseId} is ${r.state}`);return ae(t.deniedBy,"deniedBy"),r.state="denied",r.version+=1,r.deniedAt=this.now(),r.deniedBy={...t.deniedBy},K(r)}revoke(t){let r=this.requireMutable(t.leaseId);if(this.assertVersion(r,t.expectedVersion),this.refreshState(r),r.state!=="active")throw new R("LEASE_CONFLICT",`Only active leases can be revoked; ${r.leaseId} is ${r.state}`);return ae(t.revokedBy,"revokedBy"),r.state="revoked",r.version+=1,r.revokedAt=this.now(),r.revokedBy={...t.revokedBy},K(r)}consume(t,r,n){let o=this.requireMutable(t);if(this.assertVersion(o,r),this.refreshState(o),o.state==="requested")throw new R("LEASE_APPROVAL_REQUIRED",`Capability lease ${t} is not approved`);if(o.state==="expired")throw new R("LEASE_EXPIRED",`Capability lease ${t} expired`);if(o.state==="revoked")throw new R("LEASE_REVOKED",`Capability lease ${t} was revoked`);if(o.state==="exhausted")throw new R("LEASE_EXHAUSTED",`Capability lease ${t} is exhausted`);if(o.state!=="active")throw new R("LEASE_SCOPE_MISMATCH",`Capability lease ${t} is ${o.state}`);return Ia(o,n),o.useCount+=1,o.version+=1,o.useCount>=o.maxUses&&(o.state="exhausted",o.exhaustedAt=this.now()),K(o)}get(t){let r=this.leases.get(t);if(r)return this.refreshState(r),K(r)}list(t){let r=[];for(let n of this.leases.values())this.refreshState(n),!(t?.runId&&n.subject.runId!==t.runId)&&(t?.agentId&&n.subject.agentId!==t.agentId||t?.turnId&&n.subject.turnId!==t.turnId||r.push(K(n)));return r.sort((n,o)=>n.requestedAt.localeCompare(o.requestedAt)||n.leaseId.localeCompare(o.leaseId))}requireMutable(t){let r=this.leases.get(t);if(!r)throw new R("LEASE_NOT_FOUND",`Capability lease ${t} was not found`);return r}assertVersion(t,r){if(t.version!==r)throw new R("LEASE_CONFLICT",`Expected capability lease version ${r}, found ${t.version}`,{leaseId:t.leaseId,expectedVersion:r,actualVersion:t.version})}refreshState(t){let r=Date.parse(this.now()),n=t.state==="requested"?Date.parse(t.requestExpiresAt):Date.parse(t.expiresAt??"");(t.state==="requested"||t.state==="active")&&Number.isFinite(n)&&r>=n&&(t.state="expired",t.version+=1,t.expiredAt=this.now())}};function ha(e){if(!e||typeof e!="object"||Array.isArray(e)||JSON.stringify(e).length>65536)throw h("Invalid persisted lease row");let t=e;if(t.schemaVersion!==on)throw h("Unsupported persisted lease schema");if(an(t),D(t.leaseId,"leaseId"),je(t.profileFingerprint,"profileFingerprint"),!Array.isArray(t.policyFingerprints))throw h("policyFingerprints must be an array");if(t.policyFingerprints.forEach(r=>je(r,"policyFingerprint")),!Number.isSafeInteger(t.durationMs)||t.durationMs<1||!Number.isSafeInteger(t.maxUses)||t.maxUses<1)throw h("Invalid persisted lease limits");if(!Number.isSafeInteger(t.version)||t.version<1||!Number.isSafeInteger(t.useCount)||t.useCount<0||t.useCount>t.maxUses)throw h("Invalid persisted lease counters");if(!["requested","active","denied","revoked","expired","exhausted"].includes(t.state))throw h("Invalid persisted lease state");if(!["principal","current-turn"].includes(t.approvalRequirement)||!["none","explicit"].includes(t.childInheritance))throw h("Invalid persisted lease authority");for(let r of["requestedAt","requestExpiresAt","activatedAt","expiresAt","expiredAt","deniedAt","revokedAt","exhaustedAt"])if((r==="requestedAt"||r==="requestExpiresAt"||t[r]!==void 0)&&(typeof t[r]!="string"||!Number.isFinite(Date.parse(t[r]))))throw h(`Invalid persisted ${r}`);if(Date.parse(t.requestExpiresAt)<=Date.parse(t.requestedAt))throw h("Invalid persisted request expiry");if(["active","revoked","exhausted"].includes(t.state)||t.useCount>0){if(!t.activatedAt||!t.expiresAt||!t.approvedBy||!t.approvalContext||t.version<2)throw h("Persisted approval is incomplete");if(ae(t.approvedBy,"approvedBy"),sn(t.approvalContext),Date.parse(t.expiresAt)!==Date.parse(t.activatedAt)+t.durationMs)throw h("Persisted expiry does not match approved duration");if(t.approvalRequirement==="current-turn"&&(!t.subject.turnId||t.approvalContext.turnId!==t.subject.turnId))throw h("Persisted turn approval does not match")}if(t.state==="requested"&&(t.version!==1||t.useCount!==0||t.approvedBy))throw h("Invalid requested lease");if(t.state==="active"&&t.useCount>=t.maxUses)throw h("Active lease is exhausted");if(t.state==="exhausted"&&t.useCount!==t.maxUses)throw h("Invalid exhausted lease");if(t.state==="revoked"){if(!t.revokedAt||!t.revokedBy)throw h("Missing revocation");ae(t.revokedBy,"revokedBy")}if(t.state==="denied"){if(!t.deniedAt||!t.deniedBy)throw h("Missing denial");ae(t.deniedBy,"deniedBy")}if(t.state==="expired"&&!t.expiredAt)throw h("Missing expiry transition")}function Aa(e,t,r){let n=e.capabilities.tools,o=t.trim().toLowerCase(),i=a=>a?.some(c=>c==="*"||c.trim().toLowerCase()===o)??!1;return n.mode==="none"||i(n.deny)?{eligible:!1,approvalRequirement:"principal",reason:`Agent Profile ${e.profile.id} denies tool ${t}.`}:n.allow&&!i(n.allow)?{eligible:!1,approvalRequirement:"principal",reason:`Tool ${t} is outside the Agent Profile allowlist.`}:n.mode==="readOnly"&&r!=="read"?{eligible:!1,approvalRequirement:"principal",reason:`Tool ${t} cannot request ${r} authority in read-only mode.`}:{eligible:!0,approvalRequirement:"principal",reason:`Tool ${t} is requestable.`}}function ya(e){if(!e||typeof e!="object")throw h("scope is required");if(D(e.kind,"scope.kind"),!pa.has(e.kind)&&!e.kind.startsWith("custom:"))throw h("scope.kind is not supported");if(e.kind.startsWith(Ne)&&!Ie(e.kind))throw h("Custom capability kind is invalid");if(!["read","write","execute","external"].includes(e.effect))throw h("scope.effect is invalid");let t={"filesystem-read":"read","filesystem-write":"write","process-execute":"execute","network-connect":"external","secret-use":"external","external-action":"external","browser-read":"read","browser-act":"external","computer-observe":"read","computer-act":"external"};if(t[e.kind]&&t[e.kind]!==e.effect)throw h(`${e.kind} capability scopes must use ${t[e.kind]} effect`);if(!Array.isArray(e.operations)||e.operations.length===0)throw h("scope.operations must contain at least one operation");if(e.operations.forEach(r=>D(r,"scope.operations")),e.resources?.forEach(r=>D(r,"scope.resources",8192)),e.destinations?.forEach(r=>D(r,"scope.destinations",8192)),e.secretIds?.forEach(r=>D(r,"scope.secretIds",512)),e.kind==="external-action"){if(!e.externalAction||!ua.has(e.externalAction))throw h("External-action scopes require a supported exact action");if(e.effect!=="external")throw h("External-action scopes must use external effect")}if(e.kind==="network-connect"&&(!e.destinations||e.destinations.length===0))throw h("Network capability scopes require at least one destination");if(e.kind==="secret-use"&&(!e.secretIds||e.secretIds.length===0))throw h("Secret capability scopes require at least one secret ID");if(la.has(e.kind)&&[...e.resources??[],...e.destinations??[],...e.secretIds??[]].some(n=>n.includes("*")))throw h("High-impact capability scopes cannot use wildcard resources")}function Ia(e,t){let r=e.subject;if(r.runId!==t.subject.runId||r.agentId!==t.subject.agentId)throw k(e,"run or agent subject");if(r.turnId&&r.turnId!==t.subject.turnId)throw k(e,"turn subject");if(r.toolName&&r.toolName!==t.subject.toolName)throw k(e,"tool subject");if(r.operationId&&r.operationId!==t.subject.operationId)throw k(e,"operation subject");if(e.scope.kind!==t.kind)throw k(e,"capability kind");if(!e.scope.operations.includes(t.operation))throw k(e,"operation");if(e.scope.resources?.length&&!t.resource)throw k(e,"resource");if(e.scope.destinations?.length&&!t.destination)throw k(e,"destination");if(e.scope.secretIds?.length&&!t.secretId)throw k(e,"secret");if(e.scope.externalAction&&!t.externalAction)throw k(e,"external action");if(t.resource&&!e.scope.resources?.includes(t.resource))throw k(e,"resource");if(t.destination&&!e.scope.destinations?.includes(t.destination))throw k(e,"destination");if(t.secretId&&!e.scope.secretIds?.includes(t.secretId))throw k(e,"secret");if(t.externalAction&&e.scope.externalAction!==t.externalAction)throw k(e,"external action")}function sn(e){if(!e||typeof e!="object")throw h("approvalContext is required");if(D(e.surface,"approvalContext.surface"),!fa.has(e.surface)&&!e.surface.startsWith("custom:"))throw h("approvalContext.surface is not supported");if(e.surface.startsWith(Ne)&&!Ie(e.surface))throw h("Custom approval surface is invalid");e.promptHash!==void 0&&je(e.promptHash,"approvalContext.promptHash")}function ae(e,t){if(!e||typeof e!="object")throw h(`${t} is required`);if(!["agent","tool","user","system","integration"].includes(e.kind))throw h(`${t}.kind is invalid`);D(e.id,`${t}.id`)}function je(e,t){if(!ma.test(e))throw h(`${t} must be a 64-character lowercase hexadecimal fingerprint`)}function D(e,t,r=1024){if(typeof e!="string"||e.trim().length===0||e.length>r)throw h(`${t} must be a non-empty string no longer than ${r} characters`)}function h(e){return new R("LEASE_INVALID",e)}function k(e,t){return new R("LEASE_SCOPE_MISMATCH",`Capability use is outside lease ${e.leaseId} ${t} scope`)}function nn(e,t){return new Date(Date.parse(e)+t).toISOString()}function ie(e){return[...new Set(e)]}function wa(e){return{...e}}function ba(e){return{...e,operations:ie(e.operations),...e.resources?{resources:ie(e.resources)}:{},...e.destinations?{destinations:ie(e.destinations)}:{},...e.secretIds?{secretIds:ie(e.secretIds)}:{}}}function K(e){return structuredClone(e)}import{createHash as Ea,randomUUID as va}from"node:crypto";var Sa=8*1024*1024,Ta=4;function dn(e){return Ua(e.operations??se).map(r=>Ca(r,e.runtime))}function Ca(e,t){return{definition:{name:e,description:_a(e),input_schema:Pa(e)},projectPolicyInput(r){let n=Xa(e,r),o=ka(e,r);return{observabilityInput:n,permissionInput:o,permissionPreview:Da(e,r),approvalKey:`xeno-automation:${e}:${Ba(r)}`,riskLevel:Na(e)}},async execute(r,n){if(e==="browser.screenshot"&&(typeof r.tabId!="string"||!r.tabId.trim()))return{success:!1,output:"",error:"Screen capture requires an explicit authorized tabId.",errorCode:"AUTOMATION_CAPTURE_TARGET_REQUIRED",retryable:!1};let o=n?.authorization;if(!o||o.toolName!==e)return{success:!1,output:"",error:"Governed automation requires a host-issued authorization receipt",errorCode:"AUTOMATION_AUTHORIZATION_RECEIPT_REQUIRED",retryable:!1};let i=n.operationId??`automation_${va()}`,a=kt(e,r);n.reportProgress?.({activity:"state",message:`Authorizing ${e}`});try{let c=await t.execute({operation:e,governingToolName:e,operationId:i,idempotencyKey:i,parameters:structuredClone(r),...a?{declaredTarget:a}:{},authorization:o,...n.signal?{signal:n.signal}:{},...n.reportProgress?{reportProgress:n.reportProgress}:{}}),s=c.status==="ok";return{success:s,output:JSON.stringify(La(c)),...s?{}:{error:c.error?.message??`Governed automation ended with ${c.status}`,errorCode:c.error?.code??`AUTOMATION_${c.status.toUpperCase().replaceAll("-","_")}`},assistantContent:Ma(c),evidence:c.artifacts.map(l=>({id:l.artifactId,kind:"artifact",status:c.status==="evidence-incomplete"?"failed":"verified",observedAt:l.updatedAt??l.createdAt,operationId:i,detail:{artifact_kind:l.kind,revision:l.revision,sensitivity:l.sensitivity}})),retryable:c.error?.retryable??!1}}catch(c){let s=n.signal?.aborted===!0;return{success:!1,output:"",error:s?"Governed automation was stopped":$a(c),errorCode:s?"AUTOMATION_CANCELLED":Va(c),retryable:!1}}}}}function Pa(e){let t=xa(e),r=Ra(e);return{type:"object",properties:t,...r.length>0?{required:r}:{},...e==="browser.locate"?{oneOf:[{required:["selector"]},{required:["text"]}]}:{},additionalProperties:!1}}function xa(e){let t=(a,c=8192)=>({type:"string",minLength:1,maxLength:c,description:a}),r={type:"number"},n={type:"boolean"},o={type:"object",properties:{x:r,y:r},required:["x","y"],additionalProperties:!1},i={deviceId:t("Target xeno-use device ID.",256),applicationId:t("Expected or launch-target application ID.",512),displayId:t("Target display ID.",256)};switch(e){case"browser.navigate":return{url:t("Destination URL."),waitUntil:{enum:["load","none"]},tabId:t("Expected active tab ID. Hosts with multiple visible tabs should require this.",256)};case"browser.wait":return{until:{enum:["load","ms"]},value:{type:"integer",minimum:0,maximum:6e4}};case"browser.snapshot":return{mode:{enum:["text","html","markdown","a11y"]},tabId:t("Expected active tab ID.",256)};case"browser.screenshot":return{tabId:t("Expected active tab ID.",256)};case"browser.locate":return{selector:t("CSS selector."),text:t("Visible text to locate.")};case"browser.click":return{selector:t("CSS selector returned by browser.snapshot or browser.locate."),tabId:t("Expected active tab ID.",256)};case"browser.type":return{selector:t("CSS selector."),text:{type:"string",maxLength:65536},clear:n,submit:n,tabId:t("Expected active tab ID.",256)};case"browser.key":return{combo:t("Key combo such as Control+a or Enter.",256),tabId:t("Expected active tab ID.",256)};case"browser.select":return{selector:t("CSS selector."),value:t("Option value."),tabId:t("Expected active tab ID.",256)};case"browser.scroll":return{selector:t("Optional CSS selector."),dx:r,dy:r,tabId:t("Expected active tab ID.",256)};case"browser.tabs.open":return{url:t("URL to open in an isolated browser tab.")};case"browser.tabs.close":return{tabId:t("Tab ID to close.",256)};case"browser.console.read":case"browser.network.read":case"browser.page-errors.read":return{limit:{type:"integer",minimum:1,maximum:1e3},clear:n,tabId:t("Expected active tab ID.",256)};case"browser.storage.read":return{tabId:t("Expected active tab ID.",256)};case"browser.upload":return{selector:t("File input or drop-target selector."),backendNodeId:{type:"integer",minimum:1},hostPaths:{type:"array",items:t("Host file path.",32768),minItems:1,maxItems:64},drop:n,tabId:t("Expected active tab ID.",256)};case"browser.download":return{toPath:t("Approved destination path.",32768),trigger:{type:"object",properties:{url:t("Download URL."),selector:t("Download trigger selector.")},oneOf:[{required:["url"]},{required:["selector"]}],additionalProperties:!1},tabId:t("Expected active tab ID.",256)};case"browser.record.start":return{maxDurationMs:{type:"integer",minimum:1e3,maximum:6e4},intervalMs:{type:"integer",minimum:100,maximum:5e3},tabId:t("Expected active tab ID.",256)};case"browser.record.stop":return{tabId:t("Expected active tab ID.",256)};case"computer.observe":case"computer.screenshot":case"computer.window-state":return i;case"computer.point":return{...i,point:o,durationMs:{type:"integer",minimum:0,maximum:6e4}};case"computer.click":return{...i,point:o,button:{enum:["left","right","middle"]},modifiers:Oa()};case"computer.double-click":case"computer.right-click":return{...i,point:o};case"computer.drag":return{...i,from:o,to:o,durationMs:{type:"integer",minimum:0,maximum:6e4}};case"computer.type":return{...i,text:{type:"string",maxLength:65536}};case"computer.key":return{...i,combo:t("Key combo such as Control+a or Enter.",256)};case"computer.scroll":return{...i,at:o,delta:o};case"computer.wait":return{...i,milliseconds:{type:"integer",minimum:0,maximum:3e5}};case"computer.launch":return{...i,applicationId:t("Explicitly allowlisted application ID.",512)};case"browser.back":case"browser.forward":case"browser.reload":return{tabId:t("Expected active tab ID.",256)};case"browser.tabs.list":return{}}}function Ra(e){switch(e){case"browser.navigate":case"browser.tabs.open":return["url"];case"browser.click":return["selector"];case"browser.type":return["selector","text"];case"browser.key":return["combo"];case"browser.select":return["selector","value"];case"browser.upload":return["hostPaths"];case"browser.download":return["toPath","trigger"];case"browser.screenshot":return["tabId"];case"computer.point":case"computer.click":case"computer.double-click":case"computer.right-click":return["point"];case"computer.drag":return["from","to"];case"computer.type":return["text"];case"computer.key":return["combo"];case"computer.scroll":return["at","delta"];case"computer.launch":return["applicationId"];default:return[]}}function Oa(){return{type:"object",properties:{shift:{type:"boolean"},ctrl:{type:"boolean"},alt:{type:"boolean"},meta:{type:"boolean"}},additionalProperties:!1}}function _a(e){let t=X(e),r=e.split(".").slice(1).join(" ");return`${t.effect==="act"?"Act on":"Inspect"} the ${t.surface} using governed ${r} automation. The host requires policy approval, an exact capability lease, target-bound preflight, and durable evidence.`}function Na(e){return X(e).effect==="observe"?e==="browser.navigate"||e==="browser.tabs.open"?"medium":"low":["browser.type","browser.upload","browser.download","computer.type","computer.key","computer.launch"].includes(e)?"high":"medium"}function ka(e,t){let r=kt(e,t),n={operation:e};r&&(n.target=r);for(let o of["selector","clear","submit","combo","value","dx","dy","point","from","to","at","delta","milliseconds"])t[o]!==void 0&&(n[o]=structuredClone(t[o]));return typeof t.text=="string"&&(n.text=`[redacted ${t.text.length} characters]`),Array.isArray(t.hostPaths)&&(n.hostPaths=t.hostPaths.map(()=>"[redacted host path]")),typeof t.toPath=="string"&&(n.toPath="[redacted destination path]"),n}function Xa(e,t){let r=structuredClone(t);return typeof r.text=="string"&&(r.text=`[redacted ${r.text.length} characters]`),Array.isArray(r.hostPaths)&&(r.hostPaths=r.hostPaths.map(()=>"[redacted host path]")),typeof r.toPath=="string"&&(r.toPath="[redacted destination path]"),ln(r.trigger)&&typeof r.trigger.url=="string"&&(r.trigger={...r.trigger,url:cn(r.trigger.url)}),typeof r.url=="string"&&(r.url=cn(r.url)),{operation:e,...r}}function Da(e,t){let r=kt(e,t),n=r?.url??r?.applicationId??r?.deviceId??r?.tabId??r?.resource??"current target";return`${e} on ${n}`}function kt(e,t){let r={};return typeof t.url=="string"&&(r.url=t.url),typeof t.tabId=="string"&&(r.tabId=t.tabId),typeof t.deviceId=="string"&&(r.deviceId=t.deviceId),typeof t.applicationId=="string"&&(r.applicationId=t.applicationId),typeof t.displayId=="string"&&(r.displayId=t.displayId),(e==="browser.navigate"||e==="browser.tabs.list"||e==="browser.tabs.open")&&(r.resource="browser-tabs"),Object.keys(r).length>0?r:void 0}function La(e){return{operationId:e.operationId,status:e.status,effect:e.effect,startedAt:e.startedAt,completedAt:e.completedAt,adapter:e.adapter,target:e.target,...e.data!==void 0?{data:e.data}:{},artifacts:e.artifacts.map(t=>({artifactId:t.artifactId,revision:t.revision,kind:t.kind,title:t.title,state:t.state,mediaType:t.mediaType,sensitivity:t.sensitivity,hash:t.content.hash,sizeBytes:t.content.sizeBytes})),lease:e.lease,...e.error?{error:e.error}:{}}}function Ma(e){let t=[];for(let r of e.artifacts){if(t.length>=Ta||!r.mediaType.startsWith("image/"))continue;let n=r.content.storage;if(n.type!=="inline"||typeof n.base64!="string")continue;let o=Math.floor(n.base64.length*.75);o<=0||o>Sa||t.push({type:"image_url",image_url:{url:`data:${r.mediaType};base64,${n.base64}`,detail:"high"}})}return t}function Ua(e){let t=new Set(se),r=new Set;for(let n of e){if(!t.has(n))throw new TypeError(`Unsupported XENO automation operation: ${String(n)}`);r.add(n)}return Array.from(r)}function Ba(e){return Ea("sha256").update(Nt(e)).digest("hex")}function Nt(e){return Array.isArray(e)?`[${e.map(Nt).join(",")}]`:ln(e)?`{${Object.keys(e).sort().map(t=>`${JSON.stringify(t)}:${Nt(e[t])}`).join(",")}}`:JSON.stringify(e)??"null"}function cn(e){try{let t=new URL(e);return`${t.origin}${t.pathname}`}catch{return"[invalid URL]"}}function $a(e){return e instanceof Error?e.message:String(e)}function Va(e){return e&&typeof e=="object"&&"code"in e&&typeof e.code=="string"?e.code:"AUTOMATION_EXECUTION_FAILED"}function ln(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}import{createHash as Fa}from"node:crypto";var ja=Symbol.for("@xenosystem/agent-sdk/tool-authorization/v1"),Ha=globalThis,Ga=Ha[ja]??=new WeakMap;function pn(e,t,r){let n=Ga.get(e);if(!n?.active||n.toolName!==t||e.toolName!==t||e.permission?.allowed!==!0||e.policy?.allowed!==!0||n.fingerprint!==un(r)||n.receiptFingerprint!==un(e))throw Object.assign(new Error("Governed execution requires the current exact orchestrator authorization"),{code:"AUTOMATION_AUTHORIZATION_RECEIPT_REQUIRED",retryable:!1})}function un(e){return Fa("sha256").update(JSON.stringify(Xt(structuredClone(e),0))).digest("hex")}function Xt(e,t){if(t>128)throw Error("Tool authorization input depth exceeded");if(Array.isArray(e))return e.map(r=>Xt(r,t+1));if(e!==null&&typeof e=="object")return Object.fromEntries(Object.entries(e).filter(([,r])=>r!==void 0).sort(([r],[n])=>r<n?-1:r>n?1:0).map(([r,n])=>[r,Xt(n,t+1)]));if(typeof e=="number"&&!Number.isFinite(e))throw Error("Tool authorization input must be finite");if(!["string","number","boolean"].includes(typeof e)&&e!==null)throw Error("Tool authorization input is not JSON data");return e}var za=se.filter(e=>e.startsWith("browser.")),Ja=se.filter(e=>e.startsWith("computer.")),Dt=6e4,Mt=class{constructor(t){this.options=t;this.environment=t.environment??yn()}options;leases=new Fe({maximumDurationMs:Dt,maximumUses:1});activeExecutors=new Map;environment;browserAdapter;computerAdapter;verifiedOperations=[];registered=new Map;register(t){if(this.options.safeMode)return 0;let r=this.verifiedOperations;if(r.length===0)return 0;let n=dn({runtime:this,operations:r});for(let o of n)if(t.has(o.definition.name)&&!this.registered.get(t)?.some(i=>i.definition.name===o.definition.name&&t.get(i.definition.name)===i))throw new Error("Automation capability registration conflicts with another tool owner.");return t.registerAll(n),this.registered.set(t,n),r.length}async registerVerified(t){for(let[n,o]of this.registered)for(let i of o)n.get(i.definition.name)===i&&n.unregister(i.definition.name);if(this.registered.clear(),this.verifiedOperations=[],this.options.safeMode)return 0;let r=[];for(let n of["browser","computer"])if(!(n==="computer"&&!this.options.computerHostAuthority)&&!(n==="browser"?!Ut(this.environment.browser):!We(this.environment.computer,!!this.options.computerAdapter)))try{let o=await this.adapterFor(n),i=await o.manifest();if(U(i),n==="computer"&&Ge("observe",this.environment).sensitiveRegionRedaction&&i.supports.sensitiveRegionRedaction!==!0)continue;let a=n==="browser"?za:Ja;r.push(...i.operations.filter(c=>a.includes(c)))}catch{}return this.verifiedOperations=[...new Set(r)],this.register(t)}async execute(t){if(this.options.safeMode)throw new Error("Governed automation is disabled in safe mode");if(Lt(t),t.operation==="browser.screenshot"&&!t.declaredTarget?.tabId?.trim())throw new Error("Screen capture requires an explicit authorized tabId.");let r=X(t.operation),n=r.surface==="computer"?this.options.computerHostAuthority:void 0;if(r.surface==="computer"&&!n)throw new Error("Computer automation requires independent host operation authority.");let o=await this.adapterFor(r.surface),i=await o.manifest();if(U(i),r.surface==="computer"&&Ge(r.effect,this.environment).sensitiveRegionRedaction&&i.supports.sensitiveRegionRedaction!==!0)throw new Error("Owning computer adapter cannot satisfy this host's required sensitive-region redaction.");if(!i.operations.includes(t.operation))throw new Error("Owning adapter no longer supports this operation; refresh capability discovery.");let a=this.options.profile(),c={runId:this.options.runId,agentId:this.options.agentId??"agent-main",...this.options.sessionId?{sessionId:this.options.sessionId}:{},turnId:t.authorization.turnId,...this.options.workspaceId?{workspaceId:this.options.workspaceId}:{}},s=os(t.operation,t.declaredTarget,this.environment),l=r.surface==="browser"?r.effect==="act"?"browser-act":"browser-read":r.effect==="act"?"computer-act":"computer-observe",y=r.effect==="act"?"external":"read",A=`lease-${Wa()}`,p=(b,v,I)=>{if(t.signal?.throwIfAborted(),b!==A||v!==2||this.options.profile().fingerprint!==a.fingerprint)throw new Error("Automation lease authority changed during preflight; obtain fresh authorization.");let L=this.leases.request({leaseId:A,subject:{runId:c.runId,agentId:c.agentId,turnId:c.turnId,toolName:t.governingToolName,operationId:t.operationId},scope:{kind:l,effect:y,operations:[t.operation],...I.resource?{resources:[I.resource]}:{},...I.destination?{destinations:[I.destination]}:{},governingToolName:t.governingToolName},reason:`${t.operation} authorized by the CLI policy and permission layers`,requestedBy:{kind:"agent",id:c.agentId,profileFingerprint:a.fingerprint},durationMs:Dt,requestTtlMs:3e4,maxUses:1,childInheritance:"none",policyFingerprints:[a.fingerprint]},a),Y=this.leases.approve({leaseId:L.leaseId,expectedVersion:L.version,approvedBy:{kind:"integration",id:`xeno-${this.options.surface}-permission-engine`,displayName:`XENO ${this.options.surface.toUpperCase()} permission engine`},approvalContext:{surface:this.options.surface,turnId:t.authorization.turnId,messageId:t.authorization.toolCallId}});return this.leases.consume(Y.leaseId,Y.version,I)},E=fr({contractId:`contract-${t.operationId}`,identity:c,policy:this.securityPolicy(),profile:a,...this.options.securityStatus?{adapterStatus:this.options.securityStatus}:{},filesystem:{readRoots:[Ce(this.options.cwd())],writeRoots:[Ce(this.options.cwd())],executeRoots:[Ce(this.options.cwd())]},network:ns(s,this.environment),browser:r.surface==="browser"?rs(r.effect,s,this.environment):{mode:"none"},computer:r.surface==="computer"?Ge(r.effect,this.environment):{mode:"none"},capabilityLeaseIds:[A],expiresAt:new Date(Date.now()+Dt).toISOString()}),m={protocolVersion:1,operationId:t.operationId,idempotencyKey:t.idempotencyKey,requestedAt:new Date().toISOString(),identity:c,governingToolName:t.governingToolName,operation:t.operation,parameters:is(t.parameters),...s?{declaredTarget:s}:{},executionContract:E,capabilityLeaseId:A,expectedLeaseVersion:2},P=new AbortController,T=P.signal,x=()=>P.abort(t.signal?.reason);t.signal?.aborted?x():t.signal?.addEventListener("abort",x,{once:!0});let _=new Me({adapter:o,assertCurrent:async b=>{if(T.throwIfAborted(),Lt(t),this.options.profile().fingerprint!==a.fingerprint)throw new Error("Automation authority changed during execution; evidence release refused.");await n?.assertCurrent(structuredClone(b))},...n?{onPreflight:(b,v,I)=>n.recordPreflight(b,v,I),onGrant:(b,v,I,L)=>n.recordGrant(b,v,I,L)}:{},leaseAuthority:{consume:async(b,v,I)=>{let L=p(b,v,I);return await this.audit({eventType:"automation_lease_approved",traceId:t.authorization.turnId,operation:t.operation,operationId:t.operationId,leaseId:A,contractFingerprint:E.fingerprint,permissionReason:t.authorization.permission.reason}),L}},artifactRepository:new $e({directory:Ce(this.options.cwd(),".xeno","artifacts")})});if(this.activeExecutors.has(t.operationId)||this.activeExecutors.size>=64)throw t.signal?.removeEventListener("abort",x),Object.assign(new Error("Host automation operation identity is already active or capacity is reached."),{code:"AUTOMATION_OPERATION_CONFLICT",retryable:!1});this.activeExecutors.set(t.operationId,{executor:_,controller:P});try{t.reportProgress?.({activity:"state",message:`Executing governed ${t.operation}`}),await n?.begin(structuredClone(m),{authorization:t.authorization,profileFingerprint:a.fingerprint,assertCurrent:()=>{if(T.throwIfAborted(),Lt(t),this.options.profile().fingerprint!==a.fingerprint)throw new Error("Computer host profile authority changed.")}},T);let b=await _.execute(m,T);return await this.audit({eventType:b.status==="ok"?"automation_completed":"automation_failed",traceId:t.authorization.turnId,operation:t.operation,operationId:t.operationId,leaseId:A,contractFingerprint:E.fingerprint,status:b.status,artifactIds:b.artifacts.map(v=>v.artifactId)}),b}catch(b){throw await this.audit({eventType:"automation_failed",traceId:t.authorization.turnId,operation:t.operation,operationId:t.operationId,leaseId:A,contractFingerprint:E.fingerprint,status:b instanceof Error?b.name:"error"}),b}finally{t.signal?.removeEventListener("abort",x);try{await n?.finish(structuredClone(m))}finally{this.activeExecutors.delete(t.operationId)}}}async stop(t,r="human-stop"){let n=this.activeExecutors.get(t);return n?(n.controller.abort(new Error(r)),await n.executor.stop(t,r),!0):!1}securityPolicy(){let t=this.options.securityPolicy?.();if(t)return t;let r=Ce(this.options.cwd());return{allowedDirectories:[r],workingDirectory:r,capabilities:{terminal:!0,fileRead:!0,fileWrite:!0,appLaunch:!0},executionLevel:"policy-only",trustMode:"trusted-workspace",allowNetwork:!1}}adapterFor(t){if(t==="browser"){let n=this.environment.browser;if(!Ut(n))throw new Error(wn(n));return this.browserAdapter??=new Te({baseUrl:n.baseUrl,token:n.token,driver:n.driver,...n.ownedView?{ownedView:n.ownedView}:{}}),this.browserAdapter}let r=this.environment.computer;if(!We(r,!!this.options.computerAdapter))throw new Error(Bt(r,!!this.options.computerAdapter));return this.computerAdapter??=this.options.computerAdapter?Promise.resolve(this.options.computerAdapter):In(r,this.options.computerOwnerAdmission),this.computerAdapter}async audit(t){try{await this.options.onAudit?.(t)}catch{}}};function sl(e){return new Mt(e)}function cl(e){if(e)return async t=>{let r=X(t.operation).effect;await e.append({trace_id:t.traceId,event_type:t.eventType,actor:"system",risk_level:r==="act"?"high":"low",...t.eventType==="automation_lease_approved"?{decision:"allow"}:{},status:t.eventType==="automation_failed"?"error":"ok",...t.eventType==="automation_failed"&&t.status?{reason:t.status}:{},metadata:{operation:t.operation,operation_id:t.operationId,lease_id:t.leaseId,contract_fingerprint:t.contractFingerprint,result_status:t.status,artifact_ids:t.artifactIds,permission_reason:t.permissionReason}})}}async function dl(e=yn()){let t=await Promise.all([mn("browser",e),mn("computer",e)]);return{schemaVersion:1,protocolVersion:1,enabled:t.some(r=>r.configured),surfaces:t,docs:"docs/GOVERNED_AUTOMATION.md"}}function yn(e=process.env){let t=e.XENO_BROWSER_DRIVER==="extension"?"extension":"browser",r=Ya(e,t),n=V(e.XENO_BROWSER_AUTOMATION_URL)??r?.baseUrl,o=V(e.XENO_BROWSER_AUTOMATION_TOKEN)??r?.token,i=V(e.XENO_USE_BASE_URL),a=V(e.XENO_USE_TOKEN)??Ka(e.XENO_USE_TOKEN_FILE),c=V(e.XENO_USE_DEVICE_ID);return{browser:{driver:t,...n?{baseUrl:n}:{},...o?{token:o}:{},readDomains:He(e.XENO_BROWSER_READ_DOMAINS),actDomains:He(e.XENO_BROWSER_ACT_DOMAINS),deniedDomains:He(e.XENO_BROWSER_DENIED_DOMAINS),ports:as(e.XENO_BROWSER_ALLOWED_PORTS,[443]),allowLoopbackDevelopment:e.XENO_BROWSER_ALLOW_LOOPBACK_DEVELOPMENT==="1",uploads:gn(e.XENO_BROWSER_UPLOADS,"prompt"),downloads:gn(e.XENO_BROWSER_DOWNLOADS,"prompt"),recording:e.XENO_BROWSER_RECORDING==="bounded"?"bounded":"disabled"},computer:{...i?{baseUrl:i}:{},...a?{token:a}:{},...c?{deviceId:c}:{},allowedApplications:He(e.XENO_USE_ALLOWED_APPLICATIONS)}}}function Ka(e){let t=V(e);if(!(!t||!hn(t)))try{return V(An(t,"utf8"))}catch{return}}function Ya(e,t){let n=V(e.XENO_BROWSER_SESSION_FILE)??(t==="extension"?V(e.XENO_EXTENSION_SESSION_FILE)??fn(qa(),".xeno","use-drivers","xeno-extension.json"):V(e.XENO_SESSION_FILE)??(e.APPDATA?fn(e.APPDATA,"xeno-browser","session.json"):void 0));if(!(!n||!hn(n)))try{let o=JSON.parse(An(n,"utf8")),i=Number(o.port),a=typeof o.token=="string"?o.token:"",c=typeof o.driver=="string"?o.driver:void 0;return!Number.isSafeInteger(i)||i<=0||i>65535||!Za(a)||c&&c!==(t==="extension"?"xeno-extension-native":"xeno-browser-loopback")?void 0:{baseUrl:`http://127.0.0.1:${i}`,token:a}}catch{return}}function Za(e){return e.length>=32&&e.length<=512&&!/\s/.test(e)}async function mn(e,t){let r=e==="browser"?t.browser:t.computer,n=e==="browser"?Ut(t.browser):We(t.computer),o=!!r&&Object.values(r).some(i=>typeof i=="string"&&i.length>0);if(!n)return{surface:e,configured:!1,available:!1,certified:!1,operations:[],limitations:["Adapter credentials are not completely configured."],...o?{error:e==="browser"?wn(t.browser):Bt(t.computer)}:{}};try{let a=await(e==="browser"?new Te({baseUrl:t.browser.baseUrl,token:t.browser.token,driver:t.browser.driver,...t.browser.ownedView?{ownedView:t.browser.ownedView}:{}}):await In(t.computer)).manifest();if(U(a),e==="computer"&&Ge("observe",t).sensitiveRegionRedaction&&a.supports.sensitiveRegionRedaction!==!0)throw new Error("Owning computer adapter cannot satisfy this host's required sensitive-region redaction.");return ts(e,a)}catch(i){return{surface:e,configured:!0,available:!1,certified:!1,operations:[],limitations:["Configured adapter is unavailable."],error:$t(i)}}}async function In(e,t){if(e={...e},!We(e))throw new Error(Bt(e));let r=await es(),n=new r.Use({baseUrl:e.baseUrl,...e.authorize?{authorize:Qa(e.authorize)}:{token:e.token}});return new r.XenoUseComputerAutomationAdapter({use:n,...e.deviceId?{defaultDeviceId:e.deviceId}:{},...t?{executingPrincipalId:t.executingPrincipalId,authorizeOwner:t.authorize}:{}})}function Qa(e){return async(t,r)=>{try{let n=await e(t,r);if(n?.tokenType==="DPoP")return n}catch{}throw Object.assign(new Error("Canonical computer request authorization is unavailable."),{code:"AUTOMATION_AUTHORIZATION_UNAVAILABLE",retryable:!1})}}async function es(){try{let e="@xeno-use/sdk",t="@xeno-use/agent-sdk-pack",[r,n]=await Promise.all([import(e),import(t)]);if(typeof r.Use!="function"||typeof n.XenoUseComputerAutomationAdapter!="function")throw new Error("installed xeno-use packages do not expose the governed adapter contract");return{Use:r.Use,XenoUseComputerAutomationAdapter:n.XenoUseComputerAutomationAdapter}}catch(e){throw new Error(`Computer automation requires @xeno-use/sdk and @xeno-use/agent-sdk-pack: ${$t(e)}`)}}function ts(e,t){return{surface:e,configured:!0,available:!0,certified:t.certified,adapterId:t.adapterId,adapterVersion:t.adapterVersion,operations:[...t.operations],limitations:[...t.limitations]}}function rs(e,t,r){let n=r.browser,o=En(t),i=o&&!Sn(o.hostname)?o.hostname:void 0,a=qe([...n.readDomains,...i?[i]:[]]),c=qe([...n.actDomains,...e==="act"&&i?[i]:[]]),s=Tn([...n.ports,...o?[vn(o)]:[]]);return{mode:e==="act"?"act":"read",profile:"ephemeral",readAllowedDomains:a,actAllowedDomains:c,deniedDomains:n.deniedDomains,allowedSchemes:n.allowLoopbackDevelopment?["https","http"]:["https"],allowedPorts:s,redirectPolicy:"policy",allowLoopbackDevelopment:n.allowLoopbackDevelopment,uploads:n.uploads,downloads:n.downloads,recording:n.recording}}function Ge(e,t){return{mode:e==="act"?"act":"observe",allowedApplications:t.computer?.allowedApplications??[],sensitiveRegionRedaction:!0,humanStopRequired:!0}}function ns(e,t){let r=[],n=En(e);n&&r.push({scheme:n.protocol.replace(/:$/,""),host:n.hostname.toLowerCase(),port:vn(n)});for(let o of qe([...t.browser?.readDomains??[],...t.browser?.actDomains??[]]))if(!(o.startsWith(".")||o.includes("*")))for(let i of t.browser?.ports??[443])r.push({scheme:i===80?"http":"https",host:o,port:i});return{default:"deny",allowDestinations:ss(r)}}function os(e,t,r){if(!e.startsWith("computer."))return t;let n=t?.deviceId??r.computer?.deviceId,o=t?.applicationId;if(!(!n&&!o&&!t))return{...t??{},...n?{deviceId:n}:{}}}function Lt(e){let t=e.authorization;if(!t||t.toolName!==e.governingToolName||!t.permission.allowed||!t.policy.allowed)throw new Error("Automation authorization receipt does not match the governing tool");pn(t,e.governingToolName,e.parameters)}function is(e){try{return JSON.parse(JSON.stringify(e))}catch(t){throw new Error(`Automation parameters are not JSON serializable: ${$t(t)}`)}}function Ut(e){return!!e?.baseUrl&&!!e.token}function We(e,t=!1){return bn(e,t)===void 0}function wn(e){return`Browser automation configuration is incomplete; missing ${[e?.baseUrl?"":"XENO_BROWSER_AUTOMATION_URL",e?.token?"":"XENO_BROWSER_AUTOMATION_TOKEN"].filter(Boolean).join(", ")}`}function Bt(e,t=!1){return bn(e,t)??"Computer automation configuration is unavailable."}function bn(e,t){let r=e?.token!==void 0,n=e?.authorize!==void 0;if(r&&n)return"Computer automation requires exactly one bootstrap token or canonical request authorizer.";if(n&&typeof e?.authorize!="function")return"Computer automation requires a callable canonical request authorizer.";if(r&&(typeof e?.token!="string"||!e.token.trim()))return"Computer automation bootstrap token is invalid.";if(e?.baseUrl!==void 0)try{let i=new URL(e.baseUrl);if(i.username||i.password||i.search||i.hash||i.pathname!=="/"||i.protocol!=="https:"&&!(i.protocol==="http:"&&Sn(i.hostname)&&!n))return"Computer automation requires an HTTPS origin; explicit bootstrap compatibility may use loopback HTTP only."}catch{return"Computer automation endpoint must be a valid origin."}let o=[!t&&!e?.baseUrl?"XENO_USE_BASE_URL":"",!t&&!r&&!n?"XENO_USE_TOKEN or canonical request authorizer":"",e?.deviceId?.trim()?"":"XENO_USE_DEVICE_ID"].filter(Boolean);return o.length?`Computer automation configuration is incomplete; missing ${o.join(", ")}`:void 0}function En(e){let t=e?.url??e?.origin;if(t)try{return new URL(t)}catch{return}}function vn(e){return e.port?Number(e.port):e.protocol==="http:"?80:443}function Sn(e){let t=e.toLowerCase().replace(/^\[|\]$/g,"");return t==="localhost"||t==="127.0.0.1"||t==="::1"}function He(e){return qe((e??"").split(",").map(t=>t.trim().toLowerCase()).filter(Boolean))}function as(e,t){let r=(e??"").split(",").map(n=>Number(n.trim())).filter(n=>Number.isSafeInteger(n)&&n>0&&n<=65535);return r.length>0?Tn(r):t}function gn(e,t){return e==="deny"||e==="prompt"||e==="allow"?e:t}function V(e){let t=e?.trim();return t||void 0}function qe(e){return[...new Set(e)]}function Tn(e){return[...new Set(e)].sort((t,r)=>t-r)}function ss(e){let t=new Set;return e.filter(r=>{let n=`${r.scheme??""}:${r.host}:${r.port??""}`;return t.has(n)?!1:(t.add(n),!0)})}function $t(e){return e instanceof Error?e.message:String(e)}function ll(e){let t=["XENO governed automation",""];for(let r of e.surfaces){let n=r.configured?r.available?"available":"unavailable":"not configured",o=r.certified?"certified":"not release-certified";t.push(`${r.surface}: ${n}; ${o}`),r.adapterId&&t.push(`  adapter: ${r.adapterId}@${r.adapterVersion??"unknown"}`),r.operations.length>0&&t.push(`  operations: ${r.operations.length}`);for(let i of r.limitations)t.push(`  limitation: ${i}`);r.error&&t.push(`  error: ${r.error}`)}return t.push("",`Docs: ${e.docs}`),t.join(`
+`)}export{Mt as CliGovernedAutomationRuntime,Et as SqliteAutomationExecutionJournal,se as XENO_AUTOMATION_OPERATIONS,G as XENO_AUTOMATION_PROTOCOL_VERSION,td as XENO_BROWSER_CONTROL_PLANE_OPERATIONS,d as XenoAutomationError,Te as XenoBrowserControlPlaneAdapter,Me as XenoGovernedAutomationExecutor,Mt as XenoHostGovernedAutomationRuntime,Be as XenoLoopbackAutomationAdapter,De as assertRequiredXenoAutomationEvidence,U as assertValidXenoAutomationAdapterManifest,q as assertValidXenoAutomationRequest,qc as assertXenoAutomationAdapterConformant,lt as assertXenoAutomationAdapterRequirements,ut as assertXenoAutomationAuthority,wr as buildXenoAutomationCapabilityUse,cl as createCliAutomationAuditSink,sl as createCliGovernedAutomationRuntime,Ci as createXenoAutomationConformanceReport,dn as createXenoGovernedAutomationTools,cl as createXenoHostAutomationAuditSink,sl as createXenoHostGovernedAutomationRuntime,X as describeXenoAutomationOperation,dl as inspectCliAutomationStatus,dl as inspectXenoHostAutomationStatus,Ze as isXenoAutomationOperation,At as materializeXenoAutomationEvidence,Fc as openSqliteAutomationExecutionJournal,z as pending,Se as persistXenoAutomationEvidence,yn as readCliAutomationEnvironment,yn as readXenoHostAutomationEnvironment,ll as renderCliAutomationStatus,ll as renderXenoHostAutomationStatus,br as resolveXenoAutomationEvidencePolicy,Lr as runDurableAutomation};