@ai-sdk/harness-acp 1.0.7 → 1.0.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/harness-acp",
-  "version": "1.0.7",
+  "version": "1.0.9",
   "type": "module",
   "license": "Apache-2.0",
   "sideEffects": false,
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "ws": "^8.21.0",
-    "@ai-sdk/harness": "1.0.70",
+    "@ai-sdk/harness": "1.0.72",
     "@ai-sdk/provider-utils": "5.0.27"
   },
   "peerDependencies": {

package/src/acp-harness.ts

@@ -33,6 +33,8 @@ export type ACPHarnessSettings<TBuiltinTools extends ToolSet = {}> = {
   readonly executable: ACPV1Settings['executable'];
   readonly args?: ACPV1Settings['args'];
   readonly forwardEnv?: ACPV1Settings['forwardEnv'];
+  readonly credentialEnv?: ACPV1Settings['credentialEnv'];
+  readonly credentialBrokering?: ACPV1Settings['credentialBrokering'];
   readonly env?: ACPV1Settings['env'];
   readonly authentication?: ACPV1Settings['authentication'];
   readonly providerAuthentication?: ACPV1Settings['providerAuthentication'];
@@ -94,6 +96,14 @@ const acpResumeStateSchema = z.object({
 export function createACP<TBuiltinTools extends ToolSet = {}>(
   settings: ACPHarnessSettings<TBuiltinTools>,
 ): HarnessV1<TBuiltinTools> {
+  if (
+    (settings.credentialEnv == null) !==
+    (settings.credentialBrokering == null)
+  ) {
+    throw new Error(
+      'ACP credentialEnv and credentialBrokering must be configured together.',
+    );
+  }
   if (
     settings.mcpServers != null &&
     Object.prototype.hasOwnProperty.call(

package/src/index.ts

@@ -20,6 +20,7 @@ export type {
   ACPToolKind,
 } from './acp-tool-call';
 export type {
+  ACPCredentialBrokering,
   ACPAuthentication,
   ACPInstructionMapping,
   ACPNpmLockedSource,

package/src/v1/acp-bootstrap.ts

@@ -0,0 +1,119 @@
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import type { HarnessV1Bootstrap } from '@ai-sdk/harness';
+import {
+  createImplementationDescriptor,
+  createImplementationInstallCommand,
+  createImplementationManifest,
+  getImplementationLockfile,
+  type ACPNpmImplementation,
+} from './implementation';
+
+export function createACPBootstrap({
+  harnessId,
+  implementation,
+}: {
+  readonly harnessId: string;
+  readonly implementation: ACPNpmImplementation;
+}): {
+  readonly bootstrapDir: string;
+  readonly getBootstrap: () => Promise<HarnessV1Bootstrap>;
+} {
+  const bootstrapDir = `.harness-bootstrap/${harnessId}`;
+  let cachedBootstrap: HarnessV1Bootstrap | undefined;
+
+  return {
+    bootstrapDir,
+    getBootstrap: async () => {
+      if (cachedBootstrap != null) return cachedBootstrap;
+      const [bridgePackage, bridgeLock, bridge, hostToolMCP] =
+        await Promise.all([
+          readBridgeAsset({ name: 'package.json' }),
+          readBridgeAsset({ name: 'pnpm-lock.yaml' }),
+          readBridgeAsset({ name: 'index.mjs' }),
+          readBridgeAsset({ name: 'host-tool-mcp.mjs' }),
+        ]);
+      const implementationLock = getImplementationLockfile({
+        implementation,
+      });
+      cachedBootstrap = {
+        harnessId,
+        bootstrapDir,
+        files: [
+          {
+            path: `${bootstrapDir}/package.json`,
+            content: bridgePackage,
+          },
+          {
+            path: `${bootstrapDir}/pnpm-lock.yaml`,
+            content: bridgeLock,
+          },
+          { path: `${bootstrapDir}/bridge.mjs`, content: bridge },
+          {
+            path: `${bootstrapDir}/host-tool-mcp.mjs`,
+            content: hostToolMCP,
+          },
+          {
+            path: `${bootstrapDir}/implementation/package.json`,
+            content: createImplementationManifest({ implementation }),
+          },
+          {
+            path: `${bootstrapDir}/implementation/implementation.json`,
+            content: createImplementationDescriptor({ implementation }),
+          },
+          ...(implementationLock == null
+            ? []
+            : [
+                {
+                  path: `${bootstrapDir}/implementation/pnpm-lock.yaml`,
+                  content: implementationLock,
+                },
+              ]),
+        ],
+        commands: [
+          {
+            command: 'pnpm install --frozen-lockfile --store-dir .pnpm-store',
+          },
+          {
+            command: createImplementationInstallCommand({
+              implementationDir: 'implementation',
+              storeDir: '../.pnpm-store',
+              implementation,
+            }),
+          },
+        ],
+      };
+      return cachedBootstrap;
+    },
+  };
+}
+
+async function readBridgeAsset({ name }: { name: string }): Promise<string> {
+  const candidates = resolveBridgeAssetCandidates({
+    name,
+    moduleUrl: import.meta.url,
+  });
+  let lastError: unknown;
+  for (const url of candidates) {
+    try {
+      return await readFile(fileURLToPath(url), 'utf8');
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+      lastError = error;
+    }
+  }
+  throw lastError ?? new Error(`ACP bridge asset not found: ${name}`);
+}
+
+export function resolveBridgeAssetCandidates({
+  name,
+  moduleUrl,
+}: {
+  name: string;
+  moduleUrl: string | URL;
+}): URL[] {
+  return [
+    new URL(`./bridge/${name}`, moduleUrl),
+    new URL(`../bridge/${name}`, moduleUrl),
+  ];
+}

package/src/v1/acp-v1-harness.ts

@@ -1,14 +1,12 @@
 import { createHash, randomBytes } from 'node:crypto';
-import { readFile } from 'node:fs/promises';
 import { posix } from 'node:path';
-import { fileURLToPath } from 'node:url';
 import {
   HarnessCapabilityUnsupportedError,
   harnessV1DiagnosticFromBridgeFrame,
   type HarnessV1,
-  type HarnessV1Bootstrap,
   type HarnessV1DebugConfig,
   type HarnessV1NetworkSandboxSession,
+  type HarnessV1PortEndpoint,
   type HarnessV1PromptControl,
   type HarnessV1Session,
   type HarnessV1StreamPart,
@@ -22,9 +20,11 @@ import {
   drainBridgeProcessStream,
   forwardBridgeProcessStream,
   markBridgeStarting,
+  maskSandboxCredentials,
   resolveSandboxHomeDir,
   SandboxChannel,
   shellQuote,
+  warnCredentialBrokeringUnavailable,
   waitForBridgeReady,
 } from '@ai-sdk/harness/utils';
 import {
@@ -43,14 +43,11 @@ import {
 import type { ACPToolCall } from '../acp-tool-call';
 import {
   createACPV1Implementation,
-  createImplementationDescriptor,
   createImplementationIdentity,
-  createImplementationInstallCommand,
-  createImplementationManifest,
-  getImplementationLockfile,
   resolveImplementationEnvironment,
   validateACPV1Implementation,
 } from './implementation';
+import { createACPBootstrap } from './acp-bootstrap';
 import {
   outboundMessageSchema,
   type ACPBuiltinToolMapping,
@@ -61,6 +58,7 @@ import {
   type StartMessage,
 } from './acp-v1-bridge-protocol';
 import { createACPBridgeEnvironment } from './bridge/acp-v1-bridge-environment';
+import { resolveACPLaunchEnvironment } from './bridge/protocol-configuration';
 import {
   createACPColdSessionState,
   createACPTurnStartConfig,
@@ -128,6 +126,14 @@ export function createACPV1<TBuiltinTools extends ToolSet = {}>({
     HarnessV1<TBuiltinTools>['lifecycleStateSchema']
   >;
 }): HarnessV1<TBuiltinTools> {
+  if (
+    (settings.credentialEnv == null) !==
+    (settings.credentialBrokering == null)
+  ) {
+    throw new Error(
+      'ACP credentialEnv and credentialBrokering must be configured together.',
+    );
+  }
   if (
     settings.mcpServers != null &&
     Object.prototype.hasOwnProperty.call(
@@ -146,10 +152,10 @@ export function createACPV1<TBuiltinTools extends ToolSet = {}>({
   }
   const implementation = createACPV1Implementation({ settings });
   validateACPV1Implementation(implementation);
-
-  const BOOTSTRAP_DIR = `.harness-bootstrap/${settings.harnessId}`;
-
-  let cachedBootstrap: HarnessV1Bootstrap | undefined;
+  const bootstrap = createACPBootstrap({
+    harnessId: settings.harnessId,
+    implementation,
+  });
   const permissionModeMapping = isCompletePermissionModeMapping({
     value: settings.permissionModeMapping,
   })
@@ -163,71 +169,7 @@ export function createACPV1<TBuiltinTools extends ToolSet = {}>({
     supportsBuiltinToolApprovals: true,
     supportsBuiltinToolFiltering: false,
     lifecycleStateSchema,
-    getBootstrap: async () => {
-      if (cachedBootstrap != null) return cachedBootstrap;
-      const [bridgePackage, bridgeLock, bridge, hostToolMCP] =
-        await Promise.all([
-          readBridgeAsset({ name: 'package.json' }),
-          readBridgeAsset({ name: 'pnpm-lock.yaml' }),
-          readBridgeAsset({ name: 'index.mjs' }),
-          readBridgeAsset({ name: 'host-tool-mcp.mjs' }),
-        ]);
-      const implementationLock = getImplementationLockfile({
-        implementation,
-      });
-      cachedBootstrap = {
-        harnessId: settings.harnessId,
-        bootstrapDir: BOOTSTRAP_DIR,
-        files: [
-          {
-            path: `${BOOTSTRAP_DIR}/package.json`,
-            content: bridgePackage,
-          },
-          {
-            path: `${BOOTSTRAP_DIR}/pnpm-lock.yaml`,
-            content: bridgeLock,
-          },
-          { path: `${BOOTSTRAP_DIR}/bridge.mjs`, content: bridge },
-          {
-            path: `${BOOTSTRAP_DIR}/host-tool-mcp.mjs`,
-            content: hostToolMCP,
-          },
-          {
-            path: `${BOOTSTRAP_DIR}/implementation/package.json`,
-            content: createImplementationManifest({
-              implementation,
-            }),
-          },
-          {
-            path: `${BOOTSTRAP_DIR}/implementation/implementation.json`,
-            content: createImplementationDescriptor({
-              implementation,
-            }),
-          },
-          ...(implementationLock == null
-            ? []
-            : [
-                {
-                  path: `${BOOTSTRAP_DIR}/implementation/pnpm-lock.yaml`,
-                  content: implementationLock,
-                },
-              ]),
-        ],
-        commands: [
-          {
-            command: 'pnpm install --frozen-lockfile --store-dir .pnpm-store',
-          },
-          {
-            command: createImplementationInstallCommand({
-              implementationDir: 'implementation',
-              storeDir: '../.pnpm-store',
-              implementation,
-            }),
-          },
-        ],
-      };
-      return cachedBootstrap;
-    },
+    getBootstrap: bootstrap.getBootstrap,
     doStart: async startOptions => {
       if (startOptions.builtinToolFiltering != null) {
         throw unsupported({
@@ -267,10 +209,75 @@ export function createACPV1<TBuiltinTools extends ToolSet = {}>({
         compatibility: providerAuthenticationCompatibility,
       });
       const sandboxSession = startOptions.sandboxSession;
+      const implementationEnvironment = resolveImplementationEnvironment({
+        implementation,
+        env,
+      });
+      let sandboxImplementationEnvironment = implementationEnvironment;
+      let sandboxProviderAuthenticationEnvironment =
+        resolvedProviderAuthentication.env;
+      let sandboxProviderEnvironment: Record<string, string> | undefined;
+
+      if (
+        settings.credentialBrokering != null &&
+        sandboxSession.addRequestTransformations != null
+      ) {
+        const providerEnvironment = resolveProviderEnvironment({
+          resolvedProviderAuthentication,
+          clientApp,
+        });
+        const credentialEnvironmentVariables = [
+          ...new Set([
+            ...(settings.credentialEnv ?? []),
+            'AI_GATEWAY_API_KEY',
+            'VERCEL_OIDC_TOKEN',
+          ]),
+        ];
+        const requestTransformations = settings.credentialBrokering({
+          env: {
+            ...implementationEnvironment,
+            ...providerEnvironment,
+          },
+        });
+        if (requestTransformations.length > 0) {
+          await sandboxSession.addRequestTransformations(
+            requestTransformations,
+          );
+        }
+        sandboxImplementationEnvironment = maskSandboxCredentials({
+          environment: implementationEnvironment,
+          credentialEnvironmentVariables,
+        });
+
+        /*
+         * Gateway profiles are resolved on the host twice: real values feed
+         * the transformation callback, while the bridge receives only a
+         * structurally equivalent environment with credential placeholders.
+         * Resolving the profile inside the sandbox would require serializing
+         * the Gateway credential into the bridge process environment.
+         */
+        sandboxProviderEnvironment = maskSandboxCredentials({
+          environment: resolveProviderEnvironment({
+            resolvedProviderAuthentication,
+            clientApp,
+            gatewayApiKey: 'AI_GATEWAY_API_KEY',
+          }),
+          credentialEnvironmentVariables,
+        });
+        sandboxProviderAuthenticationEnvironment = Object.fromEntries(
+          Object.entries(resolvedProviderAuthentication.env).filter(
+            ([key]) =>
+              key !== 'AI_SDK_ACP_GATEWAY_API_KEY' &&
+              key !== 'AI_SDK_ACP_GATEWAY_BASE_URL',
+          ),
+        );
+      } else if (settings.credentialBrokering != null) {
+        warnCredentialBrokeringUnavailable();
+      }
       const sandbox = sandboxSession.restricted();
       const resolvedBridgeDir = posix.resolve(
         sandboxSession.defaultWorkingDirectory,
-        BOOTSTRAP_DIR,
+        bootstrap.bootstrapDir,
       );
       const resolvedImplementationDir = `${resolvedBridgeDir}/implementation`;
       const workDir = startOptions.sessionWorkDir;
@@ -357,13 +364,16 @@ export function createACPV1<TBuiltinTools extends ToolSet = {}>({
         }
         if (coords != null) {
           try {
-            const attachUrl =
-              (await sandboxSession.getPortUrl({
-                port: coords.port,
-                protocol: 'ws',
-              })) + `?agent_bridge_token=${encodeURIComponent(coords.token)}`;
+            const endpoint = await sandboxSession.getPortEndpoint({
+              port: coords.port,
+              protocol: 'ws',
+            });
+            const attachEndpoint = withBridgeToken({
+              endpoint,
+              token: coords.token,
+            });
             const attachChannel: ACPChannel = new SandboxChannel({
-              connect: () => openWebSocket({ url: attachUrl }),
+              connect: () => openWebSocket(attachEndpoint),
               outboundSchema: outboundMessageSchema,
               initialLastSeenEventId: coords.lastSeenEventId,
               onDiagnostic,
@@ -508,17 +518,15 @@ export function createACPV1<TBuiltinTools extends ToolSet = {}>({
           ` --implementation-dir ${shellQuote(resolvedImplementationDir)}` +
           ` --bridge-type ${shellQuote(settings.harnessId)}`,
         env: {
-          ...resolveImplementationEnvironment({
-            implementation,
-            env,
-          }),
+          ...sandboxImplementationEnvironment,
           ...createACPBridgeEnvironment({
             authentication: settings.authentication,
             providerAuthentication:
               resolvedProviderAuthentication.providerAuthentication,
+            providerEnvironment: sandboxProviderEnvironment,
             sessionMeta: settings.session?.meta,
           }),
-          ...resolvedProviderAuthentication.env,
+          ...sandboxProviderAuthenticationEnvironment,
           BRIDGE_CHANNEL_TOKEN: token,
           BRIDGE_WS_PORT: String(port),
           ...(respawnStrategy?.mode === 'disk-replay'
@@ -563,13 +571,13 @@ export function createACPV1<TBuiltinTools extends ToolSet = {}>({
       });
       void drainBridgeProcessStream(proc.stdout);
 
-      const wsUrl =
-        (await sandboxSession.getPortUrl({
-          port: boundPort,
-          protocol: 'ws',
-        })) + `?agent_bridge_token=${encodeURIComponent(token)}`;
+      const endpoint = await sandboxSession.getPortEndpoint({
+        port: boundPort,
+        protocol: 'ws',
+      });
+      const bridgeEndpoint = withBridgeToken({ endpoint, token });
       const channel: ACPChannel = new SandboxChannel({
-        connect: () => openWebSocket({ url: wsUrl }),
+        connect: () => openWebSocket(bridgeEndpoint),
         outboundSchema: outboundMessageSchema,
         ...(respawnStrategy?.mode === 'disk-replay'
           ? { initialLastSeenEventId: respawnStrategy.afterSeq }
@@ -677,34 +685,54 @@ export function createACPV1<TBuiltinTools extends ToolSet = {}>({
   };
 }
 
-async function readBridgeAsset({ name }: { name: string }): Promise<string> {
-  const candidates = resolveBridgeAssetCandidates({
-    name,
-    moduleUrl: import.meta.url,
-  });
-  let lastError: unknown;
-  for (const url of candidates) {
-    try {
-      return await readFile(fileURLToPath(url), 'utf8');
-    } catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
-      lastError = error;
-    }
+function resolveProviderEnvironment({
+  resolvedProviderAuthentication,
+  clientApp,
+  gatewayApiKey,
+}: {
+  resolvedProviderAuthentication: ReturnType<
+    typeof resolveACPProviderAuthentication
+  >;
+  clientApp: ACPClientApp;
+  gatewayApiKey?: string;
+}): Record<string, string> {
+  if (
+    resolvedProviderAuthentication.providerAuthentication?.type !== 'ai-gateway'
+  ) {
+    return {};
   }
-  throw lastError ?? new Error(`ACP bridge asset not found: ${name}`);
+  return resolveACPLaunchEnvironment({
+    providerAuthentication:
+      resolvedProviderAuthentication.providerAuthentication,
+    gateway: {
+      apiKey:
+        gatewayApiKey ??
+        requireResolvedEnvironmentValue({
+          environment: resolvedProviderAuthentication.env,
+          name: 'AI_SDK_ACP_GATEWAY_API_KEY',
+        }),
+      baseUrl: requireResolvedEnvironmentValue({
+        environment: resolvedProviderAuthentication.env,
+        name: 'AI_SDK_ACP_GATEWAY_BASE_URL',
+      }),
+      clientAppName: clientApp.name,
+      clientAppVersion: clientApp.version,
+    },
+  });
 }
 
-export function resolveBridgeAssetCandidates({
+function requireResolvedEnvironmentValue({
+  environment,
   name,
-  moduleUrl,
 }: {
+  environment: Readonly<Record<string, string>>;
   name: string;
-  moduleUrl: string | URL;
-}): URL[] {
-  return [
-    new URL(`./bridge/${name}`, moduleUrl),
-    new URL(`../bridge/${name}`, moduleUrl),
-  ];
+}): string {
+  const value = environment[name];
+  if (value == null) {
+    throw new Error(`ACP resolved environment value ${name} is unavailable.`);
+  }
+  return value;
 }
 
 function resolveBridgePort({
@@ -726,9 +754,14 @@ function resolveBridgePort({
   });
 }
 
-function openWebSocket({ url }: { url: string }): Promise<WebSocket> {
+function openWebSocket({
+  url,
+  headers,
+}: HarnessV1PortEndpoint): Promise<WebSocket> {
   return new Promise((resolve, reject) => {
-    const ws = new WebSocket(url);
+    const ws = new WebSocket(url, {
+      headers: headers == null ? undefined : { ...headers },
+    });
     const onOpen = () => {
       ws.off('error', onError);
       resolve(ws);
@@ -742,6 +775,18 @@ function openWebSocket({ url }: { url: string }): Promise<WebSocket> {
   });
 }
 
+function withBridgeToken({
+  endpoint,
+  token,
+}: {
+  endpoint: HarnessV1PortEndpoint;
+  token: string;
+}): HarnessV1PortEndpoint {
+  const bridgeUrl = new URL(endpoint.url);
+  bridgeUrl.searchParams.set('agent_bridge_token', token);
+  return { ...endpoint, url: bridgeUrl.toString() };
+}
+
 function restoreColdACPSession({
   channel,
   harnessId,

package/src/v1/acp-v1-settings.ts

@@ -1,4 +1,7 @@
-import type { HarnessV1PermissionMode } from '@ai-sdk/harness';
+import type {
+  HarnessV1PermissionMode,
+  HarnessV1RequestTransformation,
+} from '@ai-sdk/harness';
 import type { ACPToolCall } from '../acp-tool-call';
 
 export type ACPSerializablePrimitive = string | number | boolean | null;
@@ -60,6 +63,12 @@ export type ACPProviderAuthentication = {
   };
 };
 
+export type ACPCredentialBrokering = ({
+  env,
+}: {
+  env: Readonly<Record<string, string>>;
+}) => ReadonlyArray<HarnessV1RequestTransformation>;
+
 export type ACPPermissionModeTarget =
   | {
       readonly type: 'session-mode';
@@ -101,6 +110,8 @@ export type ACPV1Settings = {
   readonly executable: string;
   readonly args?: ReadonlyArray<string>;
   readonly forwardEnv?: ReadonlyArray<string>;
+  readonly credentialEnv?: ReadonlyArray<string>;
+  readonly credentialBrokering?: ACPCredentialBrokering;
   /**
    * Runtime environment values that are safe to persist in bootstrap and
    * lifecycle compatibility identity.

package/src/v1/bridge/acp-v1-bridge-environment.ts

@@ -57,24 +57,28 @@ export type ACPResolvedProviderAuthentication = z.infer<
 export type ACPBridgeConfiguration = {
   readonly authentication?: ACPAuthentication;
   readonly providerAuthentication?: ACPResolvedProviderAuthentication;
+  readonly providerEnvironment?: Readonly<Record<string, string>>;
   readonly sessionMeta?: Readonly<Record<string, ACPSerializableValue>>;
 };
 
 const bridgeConfigurationSchema: z.ZodType<ACPBridgeConfiguration> = z.object({
   authentication: authenticationSchema.optional(),
   providerAuthentication: providerAuthenticationSchema.optional(),
+  providerEnvironment: z.record(z.string(), z.string()).optional(),
   sessionMeta: serializableRecordSchema.optional(),
 });
 
 export function createACPBridgeEnvironment({
   authentication,
   providerAuthentication,
+  providerEnvironment,
   sessionMeta,
 }: ACPBridgeConfiguration): Record<string, string> {
   return {
     [ACP_BRIDGE_CONFIGURATION_ENV]: JSON.stringify({
       ...(authentication == null ? {} : { authentication }),
       ...(providerAuthentication == null ? {} : { providerAuthentication }),
+      ...(providerEnvironment == null ? {} : { providerEnvironment }),
       ...(sessionMeta == null ? {} : { sessionMeta }),
     }),
   };

package/src/v1/bridge/index.ts

@@ -326,6 +326,7 @@ async function ensureSession({
   const fingerprint = JSON.stringify({
     authentication: bridgeConfiguration.authentication,
     providerAuthentication: bridgeConfiguration.providerAuthentication,
+    providerEnvironment: bridgeConfiguration.providerEnvironment,
     sessionMeta: bridgeConfiguration.sessionMeta,
     instructionMapping: start.instructionMapping,
     permissionMode: start.permissionMode,
@@ -360,15 +361,16 @@ async function ensureSession({
   }
 
   const clientApp = resolveClientApp();
-  const gateway =
-    bridgeConfiguration.providerAuthentication?.type === 'ai-gateway'
-      ? resolveGatewayValues({ clientApp })
-      : undefined;
   const authentication = bridgeConfiguration.authentication;
-  const launchEnv = resolveACPLaunchEnvironment({
-    providerAuthentication: bridgeConfiguration.providerAuthentication,
-    gateway,
-  });
+  const launchEnv =
+    bridgeConfiguration.providerEnvironment ??
+    resolveACPLaunchEnvironment({
+      providerAuthentication: bridgeConfiguration.providerAuthentication,
+      gateway:
+        bridgeConfiguration.providerAuthentication?.type === 'ai-gateway'
+          ? resolveGatewayValues({ clientApp })
+          : undefined,
+    });
   const instructionConfiguration = await resolveACPInstructionConfiguration({
     instructions: start.instructions,
     instructionMapping: start.instructionMapping,