@b00dea/cockpit 0.1.0 → 0.1.1

package/dist/browser/commands.js

@@ -4,6 +4,7 @@ import { readBoundedFile } from '../bounded-read.js';
 import { isIP } from 'node:net';
 import { dirname, isAbsolute, relative, resolve } from 'node:path';
 import { errorCause, snapshotJson, RefusalError, hasErrorCode } from '../environment/contract.js';
+import { redactSensitiveMessage } from '../environment/sensitive.js';
 import {} from '../environment/state.js';
 import { cockpitCommand } from '../fix-catalogue.js';
 import { assertBrowserStorageStateCurrent, browserRuntimeControlAuthorities, browserRuntimeControlPorts } from './runtime.js';
@@ -164,7 +165,81 @@ function publicAuthentication(value) {
     return value.posture !== 'real' ? { posture: value.posture }
         : { posture: 'real', role: value.role, policy: value.policy };
 }
-function parseObservation(value, kind, origin) {
+const MAX_DIAGNOSTIC_ENTRIES = 20;
+const MAX_EXCERPT_MESSAGES = 5;
+const MAX_EXCERPT_MESSAGE_BYTES = 240;
+const EXCERPT_OMITTED = 'browser.data is not isolated, non-production and non-restored, so page message text is never read; the counts and entries above still apply';
+const isCount = (value) => Number.isSafeInteger(value) && value >= 0;
+const exactKeys = (row, keys) => Object.keys(row).sort().join(',') === keys.sort().join(',');
+const isRecord = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const diagnosticPath = (value) => typeof value === 'string' && value.length <= 200 && /^\/[^\s?#\x00-\x1f\x7f]*$/.test(value);
+function parseDiagnosticEntry(value) {
+    if (!isRecord(value))
+        return undefined;
+    if (value.kind === 'console') {
+        const keys = ['kind', ...value.path !== undefined ? ['path'] : [], ...value.line !== undefined ? ['line'] : []];
+        if (!exactKeys(value, keys) || value.path !== undefined && !diagnosticPath(value.path) || value.line !== undefined && !isCount(value.line))
+            return undefined;
+        return { kind: 'console', ...value.path !== undefined ? { path: value.path } : {}, ...value.line !== undefined ? { line: value.line } : {} };
+    }
+    if (value.kind === 'pageerror') {
+        return exactKeys(value, ['kind', 'name']) && typeof value.name === 'string' && /^[A-Za-z0-9_$.]{1,64}$/.test(value.name)
+            ? { kind: 'pageerror', name: value.name } : undefined;
+    }
+    if (value.kind !== 'request' || typeof value.method !== 'string' || !/^[A-Z]{1,16}$/.test(value.method) || !diagnosticPath(value.path))
+        return undefined;
+    if (exactKeys(value, ['kind', 'method', 'path', 'status'])) {
+        return Number.isInteger(value.status) && value.status >= 400 && value.status <= 599
+            ? { kind: 'request', method: value.method, path: value.path, status: value.status } : undefined;
+    }
+    return exactKeys(value, ['kind', 'method', 'path', 'failure']) && typeof value.failure === 'string' && /^ERR_[A-Z0-9_]{1,64}$/.test(value.failure)
+        ? { kind: 'request', method: value.method, path: value.path, failure: value.failure } : undefined;
+}
+// Page text is kept as work-order evidence, so a URL loses its query string and fragment and anything
+// secret-shaped is redacted; text that cannot be redacted is withheld, never kept raw.
+function sanitizeExcerpt(text) {
+    const redacted = redactSensitiveMessage(text.replace(/(\b[a-z][a-z0-9+.-]*:\/\/[^\s?#]*)[?#]\S*/gi, '$1')) ?? '[withheld]';
+    let bounded = redacted;
+    while (Buffer.byteLength(bounded) > MAX_EXCERPT_MESSAGE_BYTES)
+        bounded = bounded.slice(0, -1);
+    return bounded;
+}
+function parseMessages(value) {
+    if (!Array.isArray(value) || value.length > MAX_EXCERPT_MESSAGES)
+        return undefined;
+    const messages = [];
+    for (const row of value) {
+        if (!isRecord(row) || !exactKeys(row, ['kind', 'text']) || row.kind !== 'console' && row.kind !== 'pageerror' || typeof row.text !== 'string'
+            || row.text.length === 0 || Buffer.byteLength(row.text) > MAX_EXCERPT_MESSAGE_BYTES || /[\x00-\x1f\x7f]/.test(row.text))
+            return undefined;
+        messages.push({ kind: row.kind, text: sanitizeExcerpt(row.text) });
+    }
+    return { trust: 'untrusted-page-content', messages };
+}
+// The operation reads message text only when asked to, so its presence must match the posture exactly.
+function parseDiagnostics(value, excerptAllowed) {
+    if (!isRecord(value) || !exactKeys(value, ['consoleErrors', 'consoleWarnings', 'pageErrors', 'failedRequests', 'abortedRequests', 'thirdParty', 'entries', 'omitted', ...excerptAllowed ? ['messages'] : []]))
+        return undefined;
+    const { consoleErrors, consoleWarnings, pageErrors, failedRequests, abortedRequests, thirdParty, entries, omitted } = value;
+    if (![consoleErrors, consoleWarnings, pageErrors, failedRequests, abortedRequests, omitted].every(isCount)
+        || !isRecord(thirdParty) || !exactKeys(thirdParty, ['requests', 'failed']) || !isCount(thirdParty.requests) || !isCount(thirdParty.failed)
+        || !Array.isArray(entries) || entries.length > MAX_DIAGNOSTIC_ENTRIES)
+        return undefined;
+    const parsed = entries.map(parseDiagnosticEntry);
+    if (parsed.some(entry => entry === undefined))
+        return undefined;
+    const excerpt = excerptAllowed ? parseMessages(value.messages) : { omitted: EXCERPT_OMITTED };
+    if (!excerpt)
+        return undefined;
+    // Every finding is either listed or counted as omitted, so the listing can never hide one.
+    if (parsed.length + omitted !== consoleErrors + pageErrors + failedRequests)
+        return undefined;
+    return { consoleErrors: consoleErrors, consoleWarnings: consoleWarnings, pageErrors: pageErrors,
+        failedRequests: failedRequests, abortedRequests: abortedRequests,
+        thirdParty: { requests: thirdParty.requests, failed: thirdParty.failed }, entries: parsed, omitted: omitted, excerpt };
+}
+const routeVerdict = (diagnostics) => diagnostics.consoleErrors + diagnostics.pageErrors + diagnostics.failedRequests > 0 ? 'findings' : 'clean';
+function parseObservation(value, kind, origin, excerptAllowed) {
     let parsed;
     // Child stdout can be quoted by a parse error; the caller refuses with its own fixed message.
     try {
@@ -176,7 +251,7 @@ function parseObservation(value, kind, origin) {
     if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
         return undefined;
     const row = parsed;
-    const expected = kind === 'drive' ? ['finalUrl', 'operation', 'schema'] : ['evidence', 'finalUrl', 'operation', 'schema'];
+    const expected = kind === 'drive' ? ['diagnostics', 'finalUrl', 'operation', 'schema'] : ['evidence', 'finalUrl', 'operation', 'schema'];
     if (Object.keys(row).sort().join(',') !== expected.sort().join(',') || row.schema !== 'cockpit-browser-observation/v1' || row.operation !== kind || typeof row.finalUrl !== 'string')
         return undefined;
     let final;
@@ -189,8 +264,10 @@ function parseObservation(value, kind, origin) {
     }
     if (final.origin !== origin || final.username || final.password || final.hash)
         return undefined;
-    if (kind === 'drive')
-        return { finalUrl: final.href };
+    if (kind === 'drive') {
+        const diagnostics = parseDiagnostics(row.diagnostics, excerptAllowed);
+        return diagnostics ? { finalUrl: final.href, diagnostics } : undefined;
+    }
     if (!row.evidence || typeof row.evidence !== 'object' || Array.isArray(row.evidence))
         return undefined;
     const evidence = row.evidence;
@@ -249,14 +326,14 @@ function ensureArtifactRoot(root) {
     }
     return undefined;
 }
-async function run(input, client, policy, auth, deadline, authorization) {
+async function run(input, client, surfaces, policy, auth, deadline, authorization) {
     const receipts = [];
     if (input.kind === 'screenshot') {
         const unavailable = ensureArtifactRoot(client.artifactRoot);
         if (unavailable)
             return refusal(unavailable);
     }
-    for (const surface of policy.surfaces) {
+    for (const surface of surfaces) {
         // Only the runtime's own fixed-text TypeError escapes the revalidation (it replaces filesystem
         // errors with that text), so the refusal names the condition instead.
         try {
@@ -285,7 +362,7 @@ async function run(input, client, policy, auth, deadline, authorization) {
         if (authenticated.execution.exitCode !== 0) {
             return refusal(`Browser ${input.kind} operation failed without a valid bounded diagnostic for ${surface.name}`);
         }
-        const observation = parseObservation(authenticated.stdout, input.kind, policy.origin);
+        const observation = parseObservation(authenticated.stdout, input.kind, policy.origin, input.runtime.dataQualifies);
         if (!observation)
             return refusal(`Browser ${input.kind} returned no bound application-driving observation for ${surface.name}`);
         try {
@@ -309,13 +386,37 @@ async function run(input, client, policy, auth, deadline, authorization) {
             receipts.push({ ...base, screenshot: { path, ...observation.evidence } });
         }
         else
-            receipts.push(base);
+            receipts.push({ ...base, diagnostics: observation.diagnostics, verdict: routeVerdict(observation.diagnostics) });
     }
     const receipt = { kind: input.kind, activation: 'application',
-        authentication: publicAuthentication(auth), surfaces: receipts };
+        authentication: publicAuthentication(auth), surfaces: receipts,
+        ...input.kind === 'drive' ? { verdict: receipts.some(row => row.verdict === 'findings') ? 'findings' : 'clean' } : {} };
     issuedReceipts.add(receipt);
     return { kind: 'complete', receipt };
 }
+// A route is chosen by its declared name or its declared path; anything else is refused with the choices.
+function selectRoutes(input) {
+    if (input.route === undefined)
+        return input.policy.surfaces;
+    const route = input.route;
+    const origin = new URL(input.policy.origin);
+    let href;
+    if (route.startsWith('/') && !route.startsWith('//')) {
+        // `new URL` throws TypeError for an address it cannot parse; such a route can only match by name.
+        try {
+            href = new URL(route, origin).href;
+        }
+        catch (error) {
+            if (!(error instanceof TypeError))
+                throw error;
+        }
+    }
+    const surface = input.policy.surfaces.find(row => row.name === route || href !== undefined && row.url === href);
+    if (surface)
+        return [surface];
+    // The route is the caller's own input, so it is safe to echo back.
+    return `Browser route ${JSON.stringify(route)} is not declared; declared routes are ${input.policy.surfaces.map(row => `${row.name} (${new URL(row.url).pathname + new URL(row.url).search})`).join(', ')}`;
+}
 export async function executeBrowserCommand(value) {
     const deadline = Date.now() + COMMAND_TIMEOUT_MS;
     const input = value;
@@ -338,12 +439,15 @@ export async function executeBrowserCommand(value) {
             + 'a remote browser reaches host addresses only through that exposure, so it would look for the application inside its own container. '
             + 'Use a 127.0.0.1, localhost or .localhost origin (an IPv6 literal is never tunnelled), or widen network_exposure with a network_exposure_reason');
     }
+    const selected = selectRoutes(input);
+    if (typeof selected === 'string')
+        return refusal(selected);
     const auth = authentication(input);
     if (!auth)
         return refusal(input.runtime.authentication.posture === 'real'
             ? 'Browser command requires a declared seeded role and matching coordination authority' : 'Bypassed browser authentication cannot accept role or state input');
     const admitted = await withBrowserProjectOperationAdmission(client, input.runtime, {
         origin: input.policy.origin, ...(auth.posture === 'real' ? { role: auth.role } : {}), ...(input.state ? { state: input.state } : {}),
-    }, authorization => run(input, client, input.policy, auth, deadline, authorization));
+    }, authorization => run(input, client, selected, input.policy, auth, deadline, authorization));
     return admitted.kind === 'admitted' ? admitted.value : refusal(admitted.reason);
 }

package/dist/browser/runtime.d.ts

@@ -100,6 +100,7 @@ export declare function resolveBrowserRuntime(input: BrowserRuntimeInput, coordi
         states: any[];
         claim: "exclusive" | "per-worker";
     };
+    dataQualifies: boolean;
     preapproval: "eligible" | "not-requested";
     networkExposure: string;
     networkExposureReason?: string | undefined;

package/dist/browser/runtime.js

@@ -123,7 +123,8 @@ export function resolveBrowserRuntime(input, coordinationNamespace) {
         || typeof input.data.reachesProduction !== 'boolean' || typeof input.requestPreapproval !== 'boolean') {
         throw new RefusalError('browser data posture must be explicit');
     }
-    if (input.requestPreapproval && (input.data.mode === 'restored' || !input.data.isolated || input.data.reachesProduction)) {
+    const dataQualifies = input.data.mode !== 'restored' && input.data.isolated && !input.data.reachesProduction;
+    if (input.requestPreapproval && !dataQualifies) {
         throw new RefusalError('browser preapproval requires isolated empty or seeded data with no production reach');
     }
     const projection = {
@@ -141,6 +142,8 @@ export function resolveBrowserRuntime(input, coordinationNamespace) {
         authentication: signedOut
             ? { posture: signedOut, policy: 'none', states: [] }
             : { posture: 'real', policy: input.authentication.policy, states: states.map((state) => ({ ...state })), claim: input.authentication.policy === 'serialized' ? 'exclusive' : 'per-worker' },
+        // The posture alone, whatever request_preapproval says: it also gates message excerpts in drive receipts.
+        dataQualifies,
         preapproval: input.requestPreapproval ? 'eligible' : 'not-requested',
         networkExposure: networkExposure.value,
         ...(networkExposure.reason ? { networkExposureReason: networkExposure.reason } : {}),

package/dist/browser/surfaces.d.ts

@@ -3,9 +3,9 @@ import { type ExecuteProbeOutcome } from '../environment-exec/execute.js';
 import { type StateNamespace } from '../environment/state.js';
 import type { RenderedSurfaceFile } from '../surfaces/contract.js';
 import { type GuardSurfaceTarget } from '../surfaces/harness-registry.js';
-import { type McpDeclaration } from '../surfaces/mcp.js';
+import { type McpStdioDeclaration } from '../surfaces/mcp.js';
 import { type BrowserRuntimeProjection } from './runtime.js';
-export type BrowserTestPackage = Readonly<{
+type BrowserTestPackage = Readonly<{
     directory: string;
     manifest: {
         readonly bytes: string;
@@ -34,12 +34,12 @@ export interface BrowserSurfaceInput {
         readonly target: GuardSurfaceTarget;
         readonly version: string;
     }[];
-    readonly mcp: McpDeclaration;
+    readonly mcp: McpStdioDeclaration;
     readonly approved: boolean;
     readonly testPackage: BrowserTestPackage | null;
     readonly skillTemplate: string;
 }
-export interface BrowserTransportRow {
+interface BrowserTransportRow {
     readonly target: GuardSurfaceTarget;
     readonly version: string;
     readonly transport: 'mcp' | 'cli';
@@ -84,7 +84,7 @@ export interface BrowserProjectClient {
         maxBytes: number;
     }>;
 }
-export interface BrowserProjectOperation {
+interface BrowserProjectOperation {
     readonly kind: 'drive' | 'screenshot';
     readonly surface: Readonly<{
         name: string;
@@ -97,7 +97,7 @@ export interface BrowserProjectOperation {
 export interface BrowserProjectOperationAuthorization {
     readonly kind: 'browser-project-operation-authorization';
 }
-export interface BrowserProjectOperationAdmissionInput {
+interface BrowserProjectOperationAdmissionInput {
     readonly origin: string;
     readonly role?: string;
     readonly state?: Readonly<{
@@ -114,7 +114,7 @@ export declare function observeBrowserProjectPackage(input: Readonly<{
     artifactRoot: string;
 }>): BrowserTestPackage;
 export declare function authenticateBrowserProjectClient(value: unknown, runtime: BrowserRuntimeProjection): BrowserProjectClient | undefined;
-export type BrowserProjectOperationNotAdmitted = Readonly<{
+type BrowserProjectOperationNotAdmitted = Readonly<{
     kind: 'unadmitted';
     cause: string;
 }>;

package/dist/browser/surfaces.js

@@ -238,6 +238,7 @@ function operationStep(client, runtime, operation, remaining, origin, statePath,
         '--control-ports', JSON.stringify(controlPorts),
         '--url', operation.surface.url, '--origin', origin, '--timeout', String(remaining),
         ...(statePath ? ['--state-proof', statePath] : []),
+        ...(operation.kind === 'drive' && runtime.dataQualifies ? ['--messages'] : []),
         ...(operation.output && artifactIdentity ? ['--output', operation.output, '--output-name', basename(operation.output),
             '--artifact-root', client.artifactRoot, '--artifact-dev', String(artifactIdentity.dev), '--artifact-ino', String(artifactIdentity.ino),
             '--artifact-birthtime-ns', artifactIdentity.birthtimeNs] : [])];
@@ -489,6 +490,8 @@ export function renderBrowserSurfaces(input) {
     const server = collected.result.servers[0];
     if (server.name !== 'playwright')
         throw new RefusalError('browser MCP declaration must be the playwright server');
+    if (!('command' in server))
+        throw new RefusalError('the playwright MCP server must be a local command, not a remote URL');
     if (server.cwd !== data.cockpitDirectory) {
         throw new RefusalError('the playwright MCP declaration must come from a sibling whose dir is the cockpit directory itself (dir = "."), so the server starts there');
     }
@@ -537,6 +540,8 @@ export function renderBrowserSurfaces(input) {
             continue;
         if (ownRows.some(row => row.transport === 'mcp' && row.declaration === 'instructed')) {
             const native = collected.result.harnesses.find(row => row.target === harness.target).servers[0];
+            if (!('command' in native))
+                throw new RefusalError('the playwright MCP server must be a local command, not a remote URL');
             files.push(nativeMcp(harness.target, native.command, native.args));
         }
         files.push(renderSkill(data.skillTemplate, harness.target, ownRows, runtime));

package/dist/canonical-json.d.ts

@@ -0,0 +1,2 @@
+/** JSON with object keys sorted at every depth, so equal values serialise to identical bytes whatever order their keys were written in. */
+export declare function canonicalJson(value: unknown): string;

package/dist/canonical-json.js

@@ -0,0 +1,5 @@
+/** JSON with object keys sorted at every depth, so equal values serialise to identical bytes whatever order their keys were written in. */
+export function canonicalJson(value) {
+    return JSON.stringify(value, (_key, item) => item !== null && typeof item === 'object' && !Array.isArray(item)
+        ? Object.fromEntries(Object.entries(item).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) : item);
+}

package/dist/cli-main.d.ts

@@ -2,7 +2,7 @@ import { type EvaluatorTool } from './schema.js';
 import { type ScaffoldBackingService } from './init/scaffold.js';
 import { type ReleaseMetadataTransport } from './freshness.js';
 import { type HandlerIdentifier, type WorkHandlerIdentifier } from './command-table.js';
-import type { FixContext } from './fix-catalogue.js';
+import { type FixContext } from './fix-catalogue.js';
 import { type Diagnostic } from './diagnostics.js';
 import { type UnattendedInit } from './init/command.js';
 import { type InitApplicationInput, type InitApplicationOutcome, type InitResult } from './environment/init-application.js';
@@ -10,14 +10,17 @@ import { type RegistryResolveCommandInput } from './registry-resolve/command.js'
 import { type SetupCommandInput } from './setup/command.js';
 import { type DoctorCommandInput } from './environment/application/doctor.js';
 import { type PreflightCommandInput } from './environment/application/health.js';
+import { type ConfirmCommandInput } from './environment/application/confirm.js';
 import { type DownCommandInput, type ResetCommandInput, type SleepCommandInput, type UpCommandInput } from './environment/application/lifecycle-context.js';
 import { type SiblingAddInput, type SiblingRemoveInput } from './environment/sibling-registration.js';
 import { type ToolChangeInput } from './environment/tool-registration.js';
+import { type PullCommandInput, type UseCommandInput } from './environment/application/siblings.js';
 import { type SetupRefusalEvidence } from './environment/contract.js';
 import { type GeneratedEnvironmentCommandInput } from './generated-environment/command.js';
 import type { GeneratedStaleRemovalApproval, GeneratedStaleRemovalApprovalRequest } from './environment/generated-application/shared.js';
 import { type SurfaceSelftestDraftInput, type SurfaceSelftestExecutableCandidate, type SurfaceSelftestProbeSpecificationsCandidate } from './environment/selftest-application.js';
-import { loadOperatorPolicy } from './environment/operator-application.js';
+import { loadOperatorPolicy, type StacksPruneOperatorSession } from './environment/operator-application.js';
+import { type StacksPruneScope } from './environment/stack-inventory-prune.js';
 import type { WorkApplicationRequest } from './work-orders/application.js';
 export interface CliIo {
     stdout: Pick<NodeJS.WriteStream, 'write'>;
@@ -33,6 +36,7 @@ export interface CliIo {
     confirmSelftestExecutable?: (candidate: SurfaceSelftestExecutableCandidate) => Promise<string | undefined>;
     confirmSelftestProbeSpecifications?: (candidate: SurfaceSelftestProbeSpecificationsCandidate) => Promise<string | undefined>;
     confirmStaleRemoval?: (request: GeneratedStaleRemovalApprovalRequest) => Promise<string | undefined>;
+    confirmStacksPrune?: (preview: CommandOutcome) => Promise<string | undefined>;
 }
 export interface CliRuntime {
     readonly env?: Readonly<Record<string, string | undefined>>;
@@ -55,11 +59,31 @@ interface WorkCommandInput {
 }
 interface HandlerInputById extends Record<WorkHandlerIdentifier, WorkCommandInput> {
     check: GeneratedEnvironmentCommandInput;
+    'docs-check': Readonly<{
+        configPath: string;
+    }>;
+    confirm: ConfirmCommandInput;
     init: InitApplicationInput & Readonly<{
         unattended?: UnattendedInit;
     }>;
     doctor: DoctorCommandInput;
     down: DownCommandInput;
+    exec: Readonly<{
+        configPath: string;
+        service: string;
+        argv: readonly [string, ...string[]];
+    }>;
+    ps: Readonly<{
+        configPath: string;
+    }>;
+    restart: Readonly<{
+        configPath: string;
+        service: string;
+    }>;
+    rebuild: Readonly<{
+        configPath: string;
+        service: string;
+    }>;
     logs: Readonly<{
         configPath: string;
         service: string;
@@ -95,19 +119,28 @@ interface HandlerInputById extends Record<WorkHandlerIdentifier, WorkCommandInpu
         configPath: string;
         argv: readonly [string, ...string[]];
         sessionId: string;
+        profiles: readonly string[];
     }>;
     sleep: SleepCommandInput;
+    stacks: Readonly<{
+        configPath: string;
+        operation: 'list' | 'prune';
+    }>;
     sync: GeneratedEnvironmentCommandInput & Readonly<{
         dryRun?: boolean;
         adopt?: readonly string[];
         authorizeStaleRemoval?: (request: GeneratedStaleRemovalApprovalRequest) => Promise<GeneratedStaleRemovalApproval | undefined>;
     }>;
-    up: UpCommandInput;
+    up: UpCommandInput & Readonly<{
+        profiles: readonly string[];
+    }>;
     upgrade: Readonly<{
         configPath: string;
         version?: string;
         dryRun: boolean;
     }>;
+    use: Omit<UseCommandInput, 'env'>;
+    pull: Omit<PullCommandInput, 'env'>;
 }
 export type CommandHandlers = {
     [Identifier in HandlerIdentifier]: (input: HandlerInputById[Identifier]) => Promise<Identifier extends 'init' ? InitApplicationOutcome : CommandOutcome>;
@@ -124,6 +157,10 @@ interface OperatorWorkBinding {
 export type CliHandlerOverrides = Partial<CommandHandlers> & Readonly<{
     beginOperatorWorkApplication?: (input: WorkCommandInput) => Promise<OperatorWorkBinding | CommandOutcome>;
     beginOperatorReset?: (input: ResetCommandInput) => Promise<OperatorResetBinding | CommandOutcome>;
+    beginStacksPrune?: (input: Readonly<{
+        configPath: string;
+        scope: StacksPruneScope;
+    }>) => Promise<StacksPruneOperatorSession | CommandOutcome>;
     loadPolicy?: typeof loadOperatorPolicy;
     scaffoldCompose?: (input: ComposeScaffoldRequest) => Promise<CommandOutcome>;
 }>;