@calltelemetry/ct-lab-mcp 0.8.124 → 0.8.126

package/dist/bin/ct-lab-executor.js

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
 /** ct-lab-executor: the in-lab half of lab_ssh (ADR 0934). */
 import { CanonicalLabBridge } from "../src/canonical/bridge.js";
+import { ClaimResolvingExecutor } from "../src/lab-exec/claim-resolve.js";
+import { defaultOperatorClaimClient } from "../src/tools/renewal-claim.js";
 import { LocalLabExecutor } from "../src/lab-exec/executor.js";
 import { createLabExecServer } from "../src/lab-exec/server.js";
 const bridge = new CanonicalLabBridge({ required: true });
@@ -10,7 +12,7 @@ if (!bridge.isConfigured) {
 }
 const port = Number(process.env.CT_LAB_EXECUTOR_PORT || 8090);
 createLabExecServer({
-    executor: new LocalLabExecutor(bridge),
+    executor: new ClaimResolvingExecutor(new LocalLabExecutor(bridge), defaultOperatorClaimClient()),
     access: {
         ENVIRONMENT: process.env.ENVIRONMENT,
         ACCESS_TEAM_DOMAIN: process.env.ACCESS_TEAM_DOMAIN,

package/dist/src/generated-version.d.ts

@@ -2,5 +2,5 @@
  * Auto-synced package version fallback for non-filesystem runtimes (Cloudflare Workers).
  * Updated automatically during release publication in .github/workflows/publish.yml.
  */
-export declare const PACKAGE_VERSION = "0.8.124";
+export declare const PACKAGE_VERSION = "0.8.126";
 //# sourceMappingURL=generated-version.d.ts.map

package/dist/src/generated-version.js

@@ -2,5 +2,5 @@
  * Auto-synced package version fallback for non-filesystem runtimes (Cloudflare Workers).
  * Updated automatically during release publication in .github/workflows/publish.yml.
  */
-export const PACKAGE_VERSION = "0.8.124";
+export const PACKAGE_VERSION = "0.8.126";
 //# sourceMappingURL=generated-version.js.map

package/dist/src/lab-exec/claim-resolve.d.ts

@@ -0,0 +1,214 @@
+/**
+ * claimId -> assetId resolution for lab_ssh (REL-1961, ADR 0934). Runs wherever the
+ * Kubernetes API is reachable (the lab executor), never in the Worker. Reads one
+ * ApplianceClaim by name (RBAC: get on applianceclaims) and uses spec.vmName, the
+ * canonical asset ID. An unresolvable claim yields a structured ct-lab-vm-ssh-result/v1
+ * envelope and no ssh attempt.
+ */
+import type { LabSshInput } from "./contract.js";
+import type { LabExecCaller, LabExecOutcome, LabExecutor } from "./executor.js";
+export interface ClaimReader {
+    getClaim(name: string): Promise<any>;
+}
+export declare class ClaimResolvingExecutor implements LabExecutor {
+    private readonly inner;
+    private readonly claims;
+    constructor(inner: LabExecutor, claims: ClaimReader);
+    get location(): "local" | "remote";
+    claimsList(input: unknown, caller?: LabExecCaller): Promise<{
+        [x: string]: unknown;
+        content: ({
+            type: "text";
+            text: string;
+            annotations?: {
+                audience?: ("user" | "assistant")[] | undefined;
+                priority?: number | undefined;
+                lastModified?: string | undefined;
+            } | undefined;
+            _meta?: {
+                [x: string]: unknown;
+            } | undefined;
+        } | {
+            type: "image";
+            data: string;
+            mimeType: string;
+            annotations?: {
+                audience?: ("user" | "assistant")[] | undefined;
+                priority?: number | undefined;
+                lastModified?: string | undefined;
+            } | undefined;
+            _meta?: {
+                [x: string]: unknown;
+            } | undefined;
+        } | {
+            type: "audio";
+            data: string;
+            mimeType: string;
+            annotations?: {
+                audience?: ("user" | "assistant")[] | undefined;
+                priority?: number | undefined;
+                lastModified?: string | undefined;
+            } | undefined;
+            _meta?: {
+                [x: string]: unknown;
+            } | undefined;
+        } | {
+            uri: string;
+            name: string;
+            type: "resource_link";
+            description?: string | undefined;
+            mimeType?: string | undefined;
+            size?: number | undefined;
+            annotations?: {
+                audience?: ("user" | "assistant")[] | undefined;
+                priority?: number | undefined;
+                lastModified?: string | undefined;
+            } | undefined;
+            _meta?: {
+                [x: string]: unknown;
+            } | undefined;
+            icons?: {
+                src: string;
+                mimeType?: string | undefined;
+                sizes?: string[] | undefined;
+                theme?: "light" | "dark" | undefined;
+            }[] | undefined;
+            title?: string | undefined;
+        } | {
+            type: "resource";
+            resource: {
+                uri: string;
+                text: string;
+                mimeType?: string | undefined;
+                _meta?: {
+                    [x: string]: unknown;
+                } | undefined;
+            } | {
+                uri: string;
+                blob: string;
+                mimeType?: string | undefined;
+                _meta?: {
+                    [x: string]: unknown;
+                } | undefined;
+            };
+            annotations?: {
+                audience?: ("user" | "assistant")[] | undefined;
+                priority?: number | undefined;
+                lastModified?: string | undefined;
+            } | undefined;
+            _meta?: {
+                [x: string]: unknown;
+            } | undefined;
+        })[];
+        _meta?: {
+            [x: string]: unknown;
+            progressToken?: string | number | undefined;
+            "io.modelcontextprotocol/related-task"?: {
+                taskId: string;
+            } | undefined;
+        } | undefined;
+        structuredContent?: {
+            [x: string]: unknown;
+        } | undefined;
+        isError?: boolean | undefined;
+    }>;
+    claimsGet(input: unknown, caller?: LabExecCaller): Promise<{
+        [x: string]: unknown;
+        content: ({
+            type: "text";
+            text: string;
+            annotations?: {
+                audience?: ("user" | "assistant")[] | undefined;
+                priority?: number | undefined;
+                lastModified?: string | undefined;
+            } | undefined;
+            _meta?: {
+                [x: string]: unknown;
+            } | undefined;
+        } | {
+            type: "image";
+            data: string;
+            mimeType: string;
+            annotations?: {
+                audience?: ("user" | "assistant")[] | undefined;
+                priority?: number | undefined;
+                lastModified?: string | undefined;
+            } | undefined;
+            _meta?: {
+                [x: string]: unknown;
+            } | undefined;
+        } | {
+            type: "audio";
+            data: string;
+            mimeType: string;
+            annotations?: {
+                audience?: ("user" | "assistant")[] | undefined;
+                priority?: number | undefined;
+                lastModified?: string | undefined;
+            } | undefined;
+            _meta?: {
+                [x: string]: unknown;
+            } | undefined;
+        } | {
+            uri: string;
+            name: string;
+            type: "resource_link";
+            description?: string | undefined;
+            mimeType?: string | undefined;
+            size?: number | undefined;
+            annotations?: {
+                audience?: ("user" | "assistant")[] | undefined;
+                priority?: number | undefined;
+                lastModified?: string | undefined;
+            } | undefined;
+            _meta?: {
+                [x: string]: unknown;
+            } | undefined;
+            icons?: {
+                src: string;
+                mimeType?: string | undefined;
+                sizes?: string[] | undefined;
+                theme?: "light" | "dark" | undefined;
+            }[] | undefined;
+            title?: string | undefined;
+        } | {
+            type: "resource";
+            resource: {
+                uri: string;
+                text: string;
+                mimeType?: string | undefined;
+                _meta?: {
+                    [x: string]: unknown;
+                } | undefined;
+            } | {
+                uri: string;
+                blob: string;
+                mimeType?: string | undefined;
+                _meta?: {
+                    [x: string]: unknown;
+                } | undefined;
+            };
+            annotations?: {
+                audience?: ("user" | "assistant")[] | undefined;
+                priority?: number | undefined;
+                lastModified?: string | undefined;
+            } | undefined;
+            _meta?: {
+                [x: string]: unknown;
+            } | undefined;
+        })[];
+        _meta?: {
+            [x: string]: unknown;
+            progressToken?: string | number | undefined;
+            "io.modelcontextprotocol/related-task"?: {
+                taskId: string;
+            } | undefined;
+        } | undefined;
+        structuredContent?: {
+            [x: string]: unknown;
+        } | undefined;
+        isError?: boolean | undefined;
+    }>;
+    ssh(input: LabSshInput, caller?: LabExecCaller): Promise<LabExecOutcome>;
+}
+//# sourceMappingURL=claim-resolve.d.ts.map

package/dist/src/lab-exec/claim-resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-resolve.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/claim-resolve.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGhF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CACtC;AAyBD,qBAAa,sBAAuB,YAAW,WAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAe,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAA3C,KAAK,EAAE,WAAW,EAAmB,MAAM,EAAE,WAAW;IAErF,IAAI,QAAQ,uBAAkC;IAE9C,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKjD,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAK1C,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;CAkB/E"}

package/dist/src/lab-exec/claim-resolve.js

@@ -0,0 +1,64 @@
+import { labSshCommandSha256, LAB_SSH_ASSET_ID } from "./contract.js";
+import { VM_SSH_RESULT_SCHEMA } from "./result.js";
+function notFound(error) {
+    const e = error;
+    return e?.status === 404 || String(e?.message ?? "").includes("(404)");
+}
+function refusal(input, classification, message) {
+    const envelope = {
+        schema: VM_SSH_RESULT_SCHEMA,
+        asset_id: input.claimId ?? "",
+        claim_id: input.claimId ?? "",
+        target_mode: input.targetMode,
+        exit_code: 1,
+        classification,
+        stdout: "",
+        stderr: message,
+        stdout_truncated: false,
+        stderr_truncated: false,
+        duration_ms: 0,
+        command_sha256: labSshCommandSha256(input.command),
+    };
+    return { exitCode: 0, stdout: JSON.stringify(envelope), stderr: "" };
+}
+export class ClaimResolvingExecutor {
+    inner;
+    claims;
+    constructor(inner, claims) {
+        this.inner = inner;
+        this.claims = claims;
+    }
+    get location() { return this.inner.location; }
+    claimsList(input, caller) {
+        if (!this.inner.claimsList)
+            throw new Error("inner executor has no claim plane");
+        return this.inner.claimsList(input, caller);
+    }
+    claimsGet(input, caller) {
+        if (!this.inner.claimsGet)
+            throw new Error("inner executor has no claim plane");
+        return this.inner.claimsGet(input, caller);
+    }
+    async ssh(input, caller) {
+        if (!input.claimId)
+            return this.inner.ssh(input, caller);
+        let claim;
+        try {
+            claim = await this.claims.getClaim(input.claimId);
+        }
+        catch (error) {
+            if (!notFound(error))
+                throw error;
+        }
+        if (!claim || claim.__notFound || claim.metadata?.deletionTimestamp || claim.metadata?.name !== input.claimId) {
+            return refusal(input, "claim_not_found", `no live ApplianceClaim named '${input.claimId}'`);
+        }
+        const assetId = claim.spec?.vmName;
+        if (typeof assetId !== "string" || !LAB_SSH_ASSET_ID.test(assetId)) {
+            return refusal(input, "claim_has_no_asset", `ApplianceClaim '${input.claimId}' does not name a guest (spec.vmName); use assetId from list_inventory`);
+        }
+        const { claimId: _claimId, ...rest } = input;
+        return this.inner.ssh({ ...rest, assetId }, caller);
+    }
+}
+//# sourceMappingURL=claim-resolve.js.map

package/dist/src/lab-exec/claim-resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-resolve.js","sourceRoot":"","sources":["../../../src/lab-exec/claim-resolve.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAMnD,SAAS,QAAQ,CAAC,KAAc;IAC9B,MAAM,CAAC,GAAG,KAA0D,CAAC;IACrE,OAAO,CAAC,EAAE,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,OAAO,CAAC,KAAkB,EAAE,cAAsB,EAAE,OAAe;IAC1E,MAAM,QAAQ,GAAG;QACf,MAAM,EAAE,oBAAoB;QAC5B,QAAQ,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;QAC7B,QAAQ,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;QAC7B,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,SAAS,EAAE,CAAC;QACZ,cAAc;QACd,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,OAAO;QACf,gBAAgB,EAAE,KAAK;QACvB,gBAAgB,EAAE,KAAK;QACvB,WAAW,EAAE,CAAC;QACd,cAAc,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;KACnD,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,OAAO,sBAAsB;IACJ;IAAqC;IAAlE,YAA6B,KAAkB,EAAmB,MAAmB;QAAxD,UAAK,GAAL,KAAK,CAAa;QAAmB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEzF,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE9C,UAAU,CAAC,KAAc,EAAE,MAAsB;QAC/C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,SAAS,CAAC,KAAc,EAAE,MAAsB;QAC9C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAkB,EAAE,MAAsB;QAClD,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,KAAU,CAAC;QACf,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,iBAAiB,IAAI,KAAK,CAAC,QAAQ,EAAE,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YAC9G,OAAO,OAAO,CAAC,KAAK,EAAE,iBAAiB,EAAE,iCAAiC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;QACnC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACnE,OAAO,OAAO,CAAC,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,KAAK,CAAC,OAAO,wEAAwE,CAAC,CAAC;QACxJ,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;CACF"}

package/dist/src/lab-exec/contract.d.ts

@@ -1,5 +1,7 @@
 import { z } from "zod";
 export declare const LAB_SSH_ASSET_ID: RegExp;
+/** Kubernetes DNS-1123 subdomain: the ApplianceClaim metadata.name (for example claim-uat-1815-302). */
+export declare const LAB_SSH_CLAIM_ID: RegExp;
 export declare const LAB_SSH_HOST_KEY: RegExp;
 export declare const LAB_SSH_IPV4: RegExp;
 export declare const LAB_SSH_MAX_COMMAND_BYTES = 65536;
@@ -14,7 +16,8 @@ export declare const LabSshTargetSchema: z.ZodObject<{
     hostKeySha256?: string | undefined;
 }>;
 export declare const LabSshInputShape: {
-    assetId: z.ZodString;
+    assetId: z.ZodOptional<z.ZodString>;
+    claimId: z.ZodOptional<z.ZodString>;
     command: z.ZodString;
     timeoutSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
     targetMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["resolve", "assert", "override"]>>>;
@@ -30,7 +33,8 @@ export declare const LabSshInputShape: {
     }>>;
 };
 export declare const LabSshInputSchema: z.ZodEffects<z.ZodObject<{
-    assetId: z.ZodString;
+    assetId: z.ZodOptional<z.ZodString>;
+    claimId: z.ZodOptional<z.ZodString>;
     command: z.ZodString;
     timeoutSeconds: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
     targetMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["resolve", "assert", "override"]>>>;
@@ -47,38 +51,42 @@ export declare const LabSshInputSchema: z.ZodEffects<z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     command: string;
     timeoutSeconds: number;
-    assetId: string;
     targetMode: "resolve" | "assert" | "override";
+    claimId?: string | undefined;
     target?: {
         host?: string | undefined;
         hostKeySha256?: string | undefined;
     } | undefined;
+    assetId?: string | undefined;
 }, {
     command: string;
-    assetId: string;
+    claimId?: string | undefined;
     target?: {
         host?: string | undefined;
         hostKeySha256?: string | undefined;
     } | undefined;
     timeoutSeconds?: number | undefined;
+    assetId?: string | undefined;
     targetMode?: "resolve" | "assert" | "override" | undefined;
 }>, {
     command: string;
     timeoutSeconds: number;
-    assetId: string;
     targetMode: "resolve" | "assert" | "override";
+    claimId?: string | undefined;
     target?: {
         host?: string | undefined;
         hostKeySha256?: string | undefined;
     } | undefined;
+    assetId?: string | undefined;
 }, {
     command: string;
-    assetId: string;
+    claimId?: string | undefined;
     target?: {
         host?: string | undefined;
         hostKeySha256?: string | undefined;
     } | undefined;
     timeoutSeconds?: number | undefined;
+    assetId?: string | undefined;
     targetMode?: "resolve" | "assert" | "override" | undefined;
 }>;
 export type LabSshInput = z.output<typeof LabSshInputSchema>;

package/dist/src/lab-exec/contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/contract.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,gBAAgB,QAAiC,CAAC;AAC/D,eAAO,MAAM,gBAAgB,QAA+B,CAAC;AAC7D,eAAO,MAAM,YAAY,QAAwE,CAAC;AAClG,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,eAAO,MAAM,kBAAkB;;;;;;;;;EAKpB,CAAC;AAEZ,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;CAU5B,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAa1B,CAAC;AAEL,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE7D,0GAA0G;AAC1G,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAE5D;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,CAOvD"}
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/contract.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,gBAAgB,QAAiC,CAAC;AAC/D,wGAAwG;AACxG,eAAO,MAAM,gBAAgB,QAA6C,CAAC;AAC3E,eAAO,MAAM,gBAAgB,QAA+B,CAAC;AAC7D,eAAO,MAAM,YAAY,QAAwE,CAAC;AAClG,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,eAAO,MAAM,kBAAkB;;;;;;;;;EAKpB,CAAC;AAEZ,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;CAY5B,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgB1B,CAAC;AAEL,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE7D,0GAA0G;AAC1G,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAE5D;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,CAQvD"}

package/dist/src/lab-exec/contract.js

@@ -5,6 +5,8 @@
 import { createHash } from "node:crypto";
 import { z } from "zod";
 export const LAB_SSH_ASSET_ID = /^[a-z0-9][a-z0-9._-]{0,127}$/;
+/** Kubernetes DNS-1123 subdomain: the ApplianceClaim metadata.name (for example claim-uat-1815-302). */
+export const LAB_SSH_CLAIM_ID = /^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/;
 export const LAB_SSH_HOST_KEY = /^SHA256:[A-Za-z0-9+/]{43}$/;
 export const LAB_SSH_IPV4 = /^(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)$/;
 export const LAB_SSH_MAX_COMMAND_BYTES = 65_536;
@@ -15,8 +17,10 @@ export const LabSshTargetSchema = z
 })
     .strict();
 export const LabSshInputShape = {
-    assetId: z.string().regex(LAB_SSH_ASSET_ID)
-        .describe("Exact lab asset ID of the guest (from list_appliance_claims or list_inventory). The MCP resolves address, host key and credentials."),
+    assetId: z.string().regex(LAB_SSH_ASSET_ID).optional()
+        .describe("Exact lab asset ID of the guest (from list_appliance_claims or list_inventory). Provide exactly one of assetId or claimId. The MCP resolves address, host key and credentials."),
+    claimId: z.string().regex(LAB_SSH_CLAIM_ID).optional()
+        .describe("ApplianceClaim name (for example claim-uat-1815-302) as shown by list_appliance_claims. Alternative to assetId: the MCP resolves the claim's guest asset ID itself. Provide exactly one of assetId or claimId."),
     command: z.string().min(1).max(LAB_SSH_MAX_COMMAND_BYTES)
         .describe("Shell command run on the guest as `bash -c <command>`. Use `sudo -n` for root, and `sudo -n docker exec calltelemetry-db-1 psql -U calltelemetry -d calltelemetry_prod -t -A -c '<sql>'` for database queries."),
     timeoutSeconds: z.number().int().min(1).max(600).optional().default(60)
@@ -29,6 +33,9 @@ export const LabSshInputSchema = z
     .object(LabSshInputShape)
     .strict()
     .superRefine((value, ctx) => {
+    if ((value.assetId === undefined) === (value.claimId === undefined)) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["assetId"], message: "provide exactly one of assetId or claimId" });
+    }
     if (Buffer.byteLength(value.command, "utf8") > LAB_SSH_MAX_COMMAND_BYTES) {
         ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["command"], message: "command exceeds 64 KiB" });
     }
@@ -47,6 +54,8 @@ export function labSshCommandSha256(command) {
     return createHash("sha256").update(labSshRemoteTokens(command).join("\0")).digest("hex");
 }
 export function labSshArgv(input) {
+    if (!input.assetId)
+        throw new Error("labSshArgv requires a resolved assetId");
     const argv = ["vm", "ssh", "--asset-id", input.assetId, "--json", "--timeout-seconds", String(input.timeoutSeconds)];
     const flag = input.targetMode === "assert" ? "--expect" : input.targetMode === "override" ? "--override" : undefined;
     if (flag && input.target?.host)

package/dist/src/lab-exec/contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../../src/lab-exec/contract.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAC7D,MAAM,CAAC,MAAM,YAAY,GAAG,qEAAqE,CAAC;AAClG,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEhD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IACtG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;CACrH,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;SACxC,QAAQ,CAAC,qIAAqI,CAAC;IAClJ,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC;SACtD,QAAQ,CAAC,gNAAgN,CAAC;IAC7N,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;SACpE,QAAQ,CAAC,mDAAmD,CAAC;IAChE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;SAChF,QAAQ,CAAC,mKAAmK,CAAC;IAChL,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;CAC1H,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC,gBAAgB,CAAC;KACxB,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,yBAAyB,EAAE,CAAC;QACzE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACnD,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC,CAAC;IACzI,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;QAC3F,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,cAAc,KAAK,CAAC,UAAU,mDAAmD,EAAE,CAAC,CAAC;IAC9J,CAAC;AACH,CAAC,CAAC,CAAC;AAIL,0GAA0G;AAC1G,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAkB;IAC3C,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IACrH,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACrH,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,aAAa;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1G,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../../src/lab-exec/contract.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AAC/D,wGAAwG;AACxG,MAAM,CAAC,MAAM,gBAAgB,GAAG,0CAA0C,CAAC;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAC7D,MAAM,CAAC,MAAM,YAAY,GAAG,qEAAqE,CAAC;AAClG,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEhD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IACtG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;CACrH,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;SACnD,QAAQ,CAAC,gLAAgL,CAAC;IAC7L,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;SACnD,QAAQ,CAAC,gNAAgN,CAAC;IAC7N,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC;SACtD,QAAQ,CAAC,gNAAgN,CAAC;IAC7N,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;SACpE,QAAQ,CAAC,mDAAmD,CAAC;IAChE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;SAChF,QAAQ,CAAC,mKAAmK,CAAC;IAChL,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;CAC1H,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC,gBAAgB,CAAC;KACxB,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,yBAAyB,EAAE,CAAC;QACzE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACnD,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC,CAAC;IACzI,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;QAC3F,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,cAAc,KAAK,CAAC,UAAU,mDAAmD,EAAE,CAAC,CAAC;IAC9J,CAAC;AACH,CAAC,CAAC,CAAC;AAIL,0GAA0G;AAC1G,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAkB;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IACrH,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACrH,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,aAAa;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1G,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/lab-exec/executor.d.ts

@@ -1,4 +1,5 @@
 import type { CanonicalCommandResult } from "../canonical/types.js";
+import type { CallToolResult } from "../types/mcp.js";
 import { type LabSshInput } from "./contract.js";
 /** Portal identity, used only for audit; authorization already happened at the portal. */
 export interface LabExecCaller {
@@ -14,6 +15,9 @@ export interface LabExecOutcome {
 export interface LabExecutor {
     readonly location: "local" | "remote";
     ssh(input: LabSshInput, caller?: LabExecCaller): Promise<LabExecOutcome>;
+    /** Read-only claim discovery (REL-1961). Returns the exact tool result the local handler produces. */
+    claimsList?(input: unknown, caller?: LabExecCaller): Promise<CallToolResult>;
+    claimsGet?(input: unknown, caller?: LabExecCaller): Promise<CallToolResult>;
 }
 export declare class LocalLabExecutor implements LabExecutor {
     private readonly bridge;
@@ -21,6 +25,8 @@ export declare class LocalLabExecutor implements LabExecutor {
     constructor(bridge: {
         run(args: string[], timeoutMs?: number): Promise<CanonicalCommandResult>;
     });
+    claimsList(input: unknown): Promise<CallToolResult>;
+    claimsGet(input: unknown): Promise<CallToolResult>;
     ssh(input: LabSshInput): Promise<LabExecOutcome>;
 }
 //# sourceMappingURL=executor.d.ts.map

package/dist/src/lab-exec/executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAE7D,0FAA0F;AAC1F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAC;IACtC,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1E;AAKD,qBAAa,gBAAiB,YAAW,WAAW;IAGtC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,QAAQ,CAAC,QAAQ,EAAG,OAAO,CAAU;gBAER,MAAM,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;KAAE;IAE3G,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;CASvD"}
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAE7D,0FAA0F;AAC1F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAC;IACtC,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACzE,sGAAsG;IACtG,UAAU,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7E,SAAS,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC7E;AAKD,qBAAa,gBAAiB,YAAW,WAAW;IAGtC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,QAAQ,CAAC,QAAQ,EAAG,OAAO,CAAU;gBAER,MAAM,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;KAAE;IAEjH,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAInD,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAI5C,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;CAUvD"}

package/dist/src/lab-exec/executor.js

@@ -1,3 +1,4 @@
+import { handleGetApplianceClaim, handleListApplianceClaims } from "../tools/appliance-claim-tools.js";
 import { labSshArgv } from "./contract.js";
 /** Bridge headroom beyond the CLI's own --timeout-seconds for resolution and cleanup. */
 const RESOLUTION_GRACE_MS = 30_000;
@@ -7,7 +8,15 @@ export class LocalLabExecutor {
     constructor(bridge) {
         this.bridge = bridge;
     }
+    claimsList(input) {
+        return handleListApplianceClaims(input);
+    }
+    claimsGet(input) {
+        return handleGetApplianceClaim(input);
+    }
     async ssh(input) {
+        if (!input.assetId)
+            throw new Error("LocalLabExecutor requires a resolved assetId; wrap it in ClaimResolvingExecutor to accept claimId");
         const result = await this.bridge.run(labSshArgv(input), input.timeoutSeconds * 1000 + RESOLUTION_GRACE_MS);
         return {
             exitCode: result.exitCode,

package/dist/src/lab-exec/executor.js.map

@@ -1 +1 @@
-{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../src/lab-exec/executor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAoB,MAAM,eAAe,CAAC;AAoB7D,yFAAyF;AACzF,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,MAAM,OAAO,gBAAgB;IAGE;IAFpB,QAAQ,GAAG,OAAgB,CAAC;IAErC,YAA6B,MAAoF;QAApF,WAAM,GAAN,MAAM,CAA8E;IAAG,CAAC;IAErH,KAAK,CAAC,GAAG,CAAC,KAAkB;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,cAAc,GAAG,IAAI,GAAG,mBAAmB,CAAC,CAAC;QAC3G,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../src/lab-exec/executor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACvG,OAAO,EAAE,UAAU,EAAoB,MAAM,eAAe,CAAC;AAuB7D,yFAAyF;AACzF,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,MAAM,OAAO,gBAAgB;IAGE;IAFpB,QAAQ,GAAG,OAAgB,CAAC;IAErC,YAA6B,MAAoF;QAApF,WAAM,GAAN,MAAM,CAA8E;IAAG,CAAC;IAErH,UAAU,CAAC,KAAc;QACvB,OAAO,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,SAAS,CAAC,KAAc;QACtB,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAkB;QAC1B,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACzI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,cAAc,GAAG,IAAI,GAAG,mBAAmB,CAAC,CAAC;QAC3G,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;IACJ,CAAC;CACF"}

package/dist/src/lab-exec/remote.d.ts

@@ -1,7 +1,11 @@
 /** Worker-side client for the lab executor behind Cloudflare Tunnel + Access (ADR 0934). */
+import type { CallToolResult } from "../types/mcp.js";
 import type { LabSshInput } from "./contract.js";
 import type { LabExecCaller, LabExecOutcome, LabExecutor } from "./executor.js";
 export declare const LAB_EXEC_PATH = "/v1/lab-exec/ssh";
+/** Read-only claim discovery routes (REL-1961). The zone WAF skip rule allows exactly these paths. */
+export declare const LAB_EXEC_CLAIMS_LIST_PATH = "/v1/lab-exec/claims/list";
+export declare const LAB_EXEC_CLAIMS_GET_PATH = "/v1/lab-exec/claims/get";
 /** Audit-only; the executor trusts it because only the Worker's service token can reach it. */
 export declare const LAB_EXEC_CALLER_HEADER = "X-CT-Lab-Caller";
 export interface RemoteLabExecutorOptions {
@@ -15,5 +19,8 @@ export declare class RemoteLabExecutor implements LabExecutor {
     readonly location: "remote";
     constructor(options: RemoteLabExecutorOptions);
     ssh(input: LabSshInput, caller?: LabExecCaller): Promise<LabExecOutcome>;
+    claimsList(input: unknown, caller?: LabExecCaller): Promise<CallToolResult>;
+    claimsGet(input: unknown, caller?: LabExecCaller): Promise<CallToolResult>;
+    private claims;
 }
 //# sourceMappingURL=remote.d.ts.map

package/dist/src/lab-exec/remote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/remote.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEhF,eAAO,MAAM,aAAa,qBAAqB,CAAC;AAChD,+FAA+F;AAC/F,eAAO,MAAM,sBAAsB,oBAAoB,CAAC;AAGxD,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,qBAAa,iBAAkB,YAAW,WAAW;IAGvC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,QAAQ,CAAC,QAAQ,EAAG,QAAQ,CAAU;gBAET,OAAO,EAAE,wBAAwB;IAIxD,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;CAwB/E"}
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/remote.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEhF,eAAO,MAAM,aAAa,qBAAqB,CAAC;AAChD,sGAAsG;AACtG,eAAO,MAAM,yBAAyB,6BAA6B,CAAC;AACpE,eAAO,MAAM,wBAAwB,4BAA4B,CAAC;AAElE,+FAA+F;AAC/F,eAAO,MAAM,sBAAsB,oBAAoB,CAAC;AAGxD,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,qBAAa,iBAAkB,YAAW,WAAW;IAGvC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,QAAQ,CAAC,QAAQ,EAAG,QAAQ,CAAU;gBAET,OAAO,EAAE,wBAAwB;IAIxD,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAyB9E,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAI3E,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;YAI5D,MAAM;CAmBrB"}

package/dist/src/lab-exec/remote.js

@@ -1,4 +1,8 @@
 export const LAB_EXEC_PATH = "/v1/lab-exec/ssh";
+/** Read-only claim discovery routes (REL-1961). The zone WAF skip rule allows exactly these paths. */
+export const LAB_EXEC_CLAIMS_LIST_PATH = "/v1/lab-exec/claims/list";
+export const LAB_EXEC_CLAIMS_GET_PATH = "/v1/lab-exec/claims/get";
+const CLAIMS_TIMEOUT_MS = 30_000;
 /** Audit-only; the executor trusts it because only the Worker's service token can reach it. */
 export const LAB_EXEC_CALLER_HEADER = "X-CT-Lab-Caller";
 const TRANSPORT_GRACE_MS = 45_000;
@@ -35,5 +39,31 @@ export class RemoteLabExecutor {
             ...(body.timedOut ? { timedOut: true } : {}),
         };
     }
+    claimsList(input, caller) {
+        return this.claims(LAB_EXEC_CLAIMS_LIST_PATH, input, caller);
+    }
+    claimsGet(input, caller) {
+        return this.claims(LAB_EXEC_CLAIMS_GET_PATH, input, caller);
+    }
+    async claims(path, input, caller) {
+        const headers = {
+            "content-type": "application/json",
+            "CF-Access-Client-Id": this.options.clientId,
+            "CF-Access-Client-Secret": this.options.clientSecret,
+        };
+        if (caller?.identity)
+            headers[LAB_EXEC_CALLER_HEADER] = caller.identity;
+        const response = await (this.options.fetchImpl ?? fetch)(new URL(path, this.options.url), {
+            method: "POST",
+            headers,
+            body: JSON.stringify(input ?? {}),
+            signal: AbortSignal.timeout(CLAIMS_TIMEOUT_MS),
+        });
+        const body = (await response.json().catch(() => undefined));
+        if (!response.ok || !body || !Array.isArray(body.content)) {
+            throw new Error(`lab executor HTTP ${response.status}`);
+        }
+        return body;
+    }
 }
 //# sourceMappingURL=remote.js.map

package/dist/src/lab-exec/remote.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../../src/lab-exec/remote.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAChD,+FAA+F;AAC/F,MAAM,CAAC,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AACxD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AASlC,MAAM,OAAO,iBAAiB;IAGC;IAFpB,QAAQ,GAAG,QAAiB,CAAC;IAEtC,YAA6B,OAAiC;QAAjC,YAAO,GAAP,OAAO,CAA0B;QAC5D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACpG,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAkB,EAAE,MAAsB;QAClD,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC5C,yBAAyB,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;SACrD,CAAC;QACF,IAAI,MAAM,EAAE,QAAQ;YAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;YACjG,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,GAAG,IAAI,GAAG,kBAAkB,CAAC;SAC9E,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAwC,CAAC;QACnG,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../../src/lab-exec/remote.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAChD,sGAAsG;AACtG,MAAM,CAAC,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AACpE,MAAM,CAAC,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAClE,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,+FAA+F;AAC/F,MAAM,CAAC,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AACxD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AASlC,MAAM,OAAO,iBAAiB;IAGC;IAFpB,QAAQ,GAAG,QAAiB,CAAC;IAEtC,YAA6B,OAAiC;QAAjC,YAAO,GAAP,OAAO,CAA0B;QAC5D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACpG,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAkB,EAAE,MAAsB;QAClD,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC5C,yBAAyB,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;SACrD,CAAC;QACF,IAAI,MAAM,EAAE,QAAQ;YAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;YACjG,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,GAAG,IAAI,GAAG,kBAAkB,CAAC;SAC9E,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAwC,CAAC;QACnG,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC;IACJ,CAAC;IAED,UAAU,CAAC,KAAc,EAAE,MAAsB;QAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,SAAS,CAAC,KAAc,EAAE,MAAsB;QAC9C,OAAO,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,KAAc,EAAE,MAAsB;QACvE,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC5C,yBAAyB,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;SACrD,CAAC;QACF,IAAI,MAAM,EAAE,QAAQ;YAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;YACxF,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC;SAC/C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAA+B,CAAC;QAC1F,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/src/lab-exec/result.d.ts

@@ -1,5 +1,5 @@
 import { CallToolResult } from "../types/mcp.js";
 import type { LabExecOutcome } from "./executor.js";
 export declare const VM_SSH_RESULT_SCHEMA = "ct-lab-vm-ssh-result/v1";
-export declare function labSshToolResult(outcome: LabExecOutcome, assetId: string): CallToolResult;
+export declare function labSshToolResult(outcome: LabExecOutcome, assetId: string | undefined): CallToolResult;
 //# sourceMappingURL=result.d.ts.map

package/dist/src/lab-exec/result.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/result.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAyB,MAAM,iBAAiB,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAyB9D,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CA+BzF"}
+{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/result.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAyB,MAAM,iBAAiB,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAyB9D,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,CA+BrG"}

package/dist/src/lab-exec/result.js

@@ -13,7 +13,7 @@ export function labSshToolResult(outcome, assetId) {
     const envelope = outcome.exitCode === 0 && !outcome.timedOut ? parseVmSshResult(outcome.stdout) : undefined;
     if (!envelope) {
         return createToolErrorResult("LAB_SSH_UNAVAILABLE", outcome.stderr
-            || (outcome.timedOut ? "lab_ssh timed out before the canonical lab CLI answered" : "canonical lab CLI returned no vm ssh result"), { operation: "lab_ssh", assetId, exitCode: outcome.exitCode, ...(outcome.timedOut ? { timedOut: true } : {}) });
+            || (outcome.timedOut ? "lab_ssh timed out before the canonical lab CLI answered" : "canonical lab CLI returned no vm ssh result"), { operation: "lab_ssh", ...(assetId ? { assetId } : {}), exitCode: outcome.exitCode, ...(outcome.timedOut ? { timedOut: true } : {}) });
     }
     const structuredContent = {
         assetId: envelope.asset_id,