@calltelemetry/ct-lab-mcp 0.8.127 → 0.8.129

package/dist/src/generated-version.d.ts

@@ -2,5 +2,5 @@
  * Auto-synced package version fallback for non-filesystem runtimes (Cloudflare Workers).
  * Updated automatically during release publication in .github/workflows/publish.yml.
  */
-export declare const PACKAGE_VERSION = "0.8.127";
+export declare const PACKAGE_VERSION = "0.8.129";
 //# sourceMappingURL=generated-version.d.ts.map

package/dist/src/generated-version.js

@@ -2,5 +2,5 @@
  * Auto-synced package version fallback for non-filesystem runtimes (Cloudflare Workers).
  * Updated automatically during release publication in .github/workflows/publish.yml.
  */
-export const PACKAGE_VERSION = "0.8.127";
+export const PACKAGE_VERSION = "0.8.129";
 //# sourceMappingURL=generated-version.js.map

package/dist/src/lab-exec/claim-resolve.d.ts

@@ -5,7 +5,7 @@
  * canonical asset ID. An unresolvable claim yields a structured ct-lab-vm-ssh-result/v1
  * envelope and no ssh attempt.
  */
-import type { LabSshInput } from "./contract.js";
+import type { LabHostCertInput, LabHostKeyEnrollInput, LabSshInput } from "./contract.js";
 import type { LabExecCaller, LabExecOutcome, LabExecutor } from "./executor.js";
 export interface ClaimReader {
     getClaim(name: string): Promise<any>;
@@ -403,6 +403,11 @@ export declare class ClaimResolvingExecutor implements LabExecutor {
         } | undefined;
         isError?: boolean | undefined;
     }>;
+    /**
+     * REL-1972: a successful, non-dry-run renew re-issues the guest's host certificate so its validity follows the
+     * renewed TTL. Best effort: the renew already happened, so any failure here is reported in `hostCert`, never thrown.
+     */
+    private withRenewedHostCert;
     claimsDelete(input: unknown, caller?: LabExecCaller): Promise<{
         [x: string]: unknown;
         content: ({
@@ -597,6 +602,10 @@ export declare class ClaimResolvingExecutor implements LabExecutor {
         } | undefined;
         isError?: boolean | undefined;
     }>;
+    /** Resolve a claim to its guest asset ID, or return the refusal reason. */
+    private resolveAsset;
+    hostCert(input: LabHostCertInput, caller?: LabExecCaller): Promise<LabExecOutcome>;
+    hostKeyEnroll(input: LabHostKeyEnrollInput, caller?: LabExecCaller): Promise<LabExecOutcome>;
     ssh(input: LabSshInput, caller?: LabExecCaller): Promise<LabExecOutcome>;
 }
 //# sourceMappingURL=claim-resolve.d.ts.map

package/dist/src/lab-exec/claim-resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claim-resolve.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/claim-resolve.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGhF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CACtC;AAyBD,qBAAa,sBAAuB,YAAW,WAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAe,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAA3C,KAAK,EAAE,WAAW,EAAmB,MAAM,EAAE,WAAW;IAErF,IAAI,QAAQ,uBAAkC;IAE9C,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKjD,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKhD,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKnD,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKlD,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKnD,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAK5C,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;CAkB/E"}
+{"version":3,"file":"claim-resolve.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/claim-resolve.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG1F,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGhF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CACtC;AAyBD,qBAAa,sBAAuB,YAAW,WAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAe,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAA3C,KAAK,EAAE,WAAW,EAAmB,MAAM,EAAE,WAAW;IAErF,IAAI,QAAQ,uBAAkC;IAE9C,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKjD,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKhD,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAK7C,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAMxD;;;OAGG;YACW,mBAAmB;IA2BjC,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKnD,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKlD,2EAA2E;YAC7D,YAAY;IAiBpB,QAAQ,CAAC,KAAK,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAoBlF,aAAa,CAAC,KAAK,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAoB5F,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;CAO/E"}

package/dist/src/lab-exec/claim-resolve.js

@@ -1,5 +1,5 @@
 import { labSshCommandSha256, LAB_SSH_ASSET_ID } from "./contract.js";
-import { VM_SSH_RESULT_SCHEMA } from "./result.js";
+import { HOST_CERT_RESULT_SCHEMA, HOST_KEY_ENROLL_RESULT_SCHEMA, VM_SSH_RESULT_SCHEMA, hostCertRenewSummary } from "./result.js";
 function notFound(error) {
     const e = error;
     return e?.status === 404 || String(e?.message ?? "").includes("(404)");
@@ -44,10 +44,47 @@ export class ClaimResolvingExecutor {
             throw new Error("inner executor has no claim plane");
         return this.inner.claimsCreate(input, caller);
     }
-    claimsRenew(input, caller) {
+    async claimsRenew(input, caller) {
         if (!this.inner.claimsRenew)
             throw new Error("inner executor has no claim plane");
-        return this.inner.claimsRenew(input, caller);
+        const result = await this.inner.claimsRenew(input, caller);
+        return this.withRenewedHostCert(result, caller);
+    }
+    /**
+     * REL-1972: a successful, non-dry-run renew re-issues the guest's host certificate so its validity follows the
+     * renewed TTL. Best effort: the renew already happened, so any failure here is reported in `hostCert`, never thrown.
+     */
+    async withRenewedHostCert(result, caller) {
+        const block = result.content?.[0];
+        if (result.isError === true || block?.type !== "text")
+            return result;
+        let body;
+        try {
+            body = JSON.parse(block.text);
+        }
+        catch {
+            return result;
+        }
+        if (body.success !== true || body.dryRun === true || typeof body.claim !== "string")
+            return result;
+        let hostCert;
+        try {
+            const resolved = await this.resolveAsset(body.claim);
+            if (!("assetId" in resolved)) {
+                hostCert = { status: "skipped", reason: resolved.classification };
+            }
+            else if (!this.inner.hostCertAfterRenew) {
+                hostCert = { status: "skipped", reason: "host_cert_not_supported" };
+            }
+            else {
+                hostCert = hostCertRenewSummary(await this.inner.hostCertAfterRenew(resolved.assetId, caller));
+            }
+        }
+        catch {
+            hostCert = { status: "error", reason: "host_cert_unavailable" };
+        }
+        const content = [{ type: "text", text: JSON.stringify({ ...body, hostCert }, null, 2) }, ...result.content.slice(1)];
+        return { ...result, content };
     }
     claimsDelete(input, caller) {
         if (!this.inner.claimsDelete)
@@ -59,26 +96,75 @@ export class ClaimResolvingExecutor {
             throw new Error("inner executor has no claim plane");
         return this.inner.claimsPause(input, caller);
     }
-    async ssh(input, caller) {
-        if (!input.claimId)
-            return this.inner.ssh(input, caller);
+    /** Resolve a claim to its guest asset ID, or return the refusal reason. */
+    async resolveAsset(claimId) {
         let claim;
         try {
-            claim = await this.claims.getClaim(input.claimId);
+            claim = await this.claims.getClaim(claimId);
         }
         catch (error) {
             if (!notFound(error))
                 throw error;
         }
-        if (!claim || claim.__notFound || claim.metadata?.deletionTimestamp || claim.metadata?.name !== input.claimId) {
-            return refusal(input, "claim_not_found", `no live ApplianceClaim named '${input.claimId}'`);
+        if (!claim || claim.__notFound || claim.metadata?.deletionTimestamp || claim.metadata?.name !== claimId) {
+            return { classification: "claim_not_found", message: `no live ApplianceClaim named '${claimId}'` };
         }
         const assetId = claim.spec?.vmName;
         if (typeof assetId !== "string" || !LAB_SSH_ASSET_ID.test(assetId)) {
-            return refusal(input, "claim_has_no_asset", `ApplianceClaim '${input.claimId}' does not name a guest (spec.vmName); use assetId from list_inventory`);
+            return { classification: "claim_has_no_asset", message: `ApplianceClaim '${claimId}' does not name a guest (spec.vmName); use assetId from list_inventory` };
+        }
+        return { assetId };
+    }
+    async hostCert(input, caller) {
+        if (!this.inner.hostCert)
+            throw new Error("inner executor has no host certificate support");
+        if (!input.claimId)
+            return this.inner.hostCert(input, caller);
+        const resolved = await this.resolveAsset(input.claimId);
+        if (!("assetId" in resolved)) {
+            const receipt = {
+                schema: HOST_CERT_RESULT_SCHEMA,
+                asset_id: input.claimId,
+                claim_id: input.claimId,
+                apply: input.apply,
+                status: "refused",
+                reason: resolved.classification,
+                detail: resolved.message,
+            };
+            return { exitCode: 0, stdout: JSON.stringify(receipt), stderr: "" };
+        }
+        const { claimId: _claimId, ...rest } = input;
+        return this.inner.hostCert({ ...rest, assetId: resolved.assetId }, caller);
+    }
+    async hostKeyEnroll(input, caller) {
+        if (!this.inner.hostKeyEnroll)
+            throw new Error("inner executor has no host-key enrollment");
+        if (!input.claimId)
+            return this.inner.hostKeyEnroll(input, caller);
+        const resolved = await this.resolveAsset(input.claimId);
+        if (!("assetId" in resolved)) {
+            const receipt = {
+                schema: HOST_KEY_ENROLL_RESULT_SCHEMA,
+                asset_id: input.claimId,
+                claim_id: input.claimId,
+                apply: input.apply,
+                status: "refused",
+                reason: resolved.classification,
+                detail: resolved.message,
+            };
+            return { exitCode: 0, stdout: JSON.stringify(receipt), stderr: "" };
         }
         const { claimId: _claimId, ...rest } = input;
-        return this.inner.ssh({ ...rest, assetId }, caller);
+        return this.inner.hostKeyEnroll({ ...rest, assetId: resolved.assetId }, caller);
+    }
+    async ssh(input, caller) {
+        if (!input.claimId)
+            return this.inner.ssh(input, caller);
+        const resolved = await this.resolveAsset(input.claimId);
+        if (!("assetId" in resolved))
+            return refusal(input, resolved.classification, resolved.message);
+        const { claimId: _claimId, ...rest } = input;
+        return this.inner.ssh({ ...rest, assetId: resolved.assetId }, caller);
     }
 }
 //# sourceMappingURL=claim-resolve.js.map

package/dist/src/lab-exec/claim-resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"claim-resolve.js","sourceRoot":"","sources":["../../../src/lab-exec/claim-resolve.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAMnD,SAAS,QAAQ,CAAC,KAAc;IAC9B,MAAM,CAAC,GAAG,KAA0D,CAAC;IACrE,OAAO,CAAC,EAAE,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,OAAO,CAAC,KAAkB,EAAE,cAAsB,EAAE,OAAe;IAC1E,MAAM,QAAQ,GAAG;QACf,MAAM,EAAE,oBAAoB;QAC5B,QAAQ,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;QAC7B,QAAQ,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;QAC7B,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,SAAS,EAAE,CAAC;QACZ,cAAc;QACd,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,OAAO;QACf,gBAAgB,EAAE,KAAK;QACvB,gBAAgB,EAAE,KAAK;QACvB,WAAW,EAAE,CAAC;QACd,cAAc,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;KACnD,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,OAAO,sBAAsB;IACJ;IAAqC;IAAlE,YAA6B,KAAkB,EAAmB,MAAmB;QAAxD,UAAK,GAAL,KAAK,CAAa;QAAmB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEzF,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE9C,UAAU,CAAC,KAAc,EAAE,MAAsB;QAC/C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,SAAS,CAAC,KAAc,EAAE,MAAsB;QAC9C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,YAAY,CAAC,KAAc,EAAE,MAAsB;QACjD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,WAAW,CAAC,KAAc,EAAE,MAAsB;QAChD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,YAAY,CAAC,KAAc,EAAE,MAAsB;QACjD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,WAAW,CAAC,KAAc,EAAE,MAAsB;QAChD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAkB,EAAE,MAAsB;QAClD,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,KAAU,CAAC;QACf,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,iBAAiB,IAAI,KAAK,CAAC,QAAQ,EAAE,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YAC9G,OAAO,OAAO,CAAC,KAAK,EAAE,iBAAiB,EAAE,iCAAiC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;QACnC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACnE,OAAO,OAAO,CAAC,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,KAAK,CAAC,OAAO,wEAAwE,CAAC,CAAC;QACxJ,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;CACF"}
+{"version":3,"file":"claim-resolve.js","sourceRoot":"","sources":["../../../src/lab-exec/claim-resolve.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGtE,OAAO,EAAE,uBAAuB,EAAE,6BAA6B,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAMjI,SAAS,QAAQ,CAAC,KAAc;IAC9B,MAAM,CAAC,GAAG,KAA0D,CAAC;IACrE,OAAO,CAAC,EAAE,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,OAAO,CAAC,KAAkB,EAAE,cAAsB,EAAE,OAAe;IAC1E,MAAM,QAAQ,GAAG;QACf,MAAM,EAAE,oBAAoB;QAC5B,QAAQ,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;QAC7B,QAAQ,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;QAC7B,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,SAAS,EAAE,CAAC;QACZ,cAAc;QACd,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,OAAO;QACf,gBAAgB,EAAE,KAAK;QACvB,gBAAgB,EAAE,KAAK;QACvB,WAAW,EAAE,CAAC;QACd,cAAc,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;KACnD,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,OAAO,sBAAsB;IACJ;IAAqC;IAAlE,YAA6B,KAAkB,EAAmB,MAAmB;QAAxD,UAAK,GAAL,KAAK,CAAa;QAAmB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEzF,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE9C,UAAU,CAAC,KAAc,EAAE,MAAsB;QAC/C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,SAAS,CAAC,KAAc,EAAE,MAAsB;QAC9C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,YAAY,CAAC,KAAc,EAAE,MAAsB;QACjD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAc,EAAE,MAAsB;QACtD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,mBAAmB,CAAC,MAAsB,EAAE,MAAsB;QAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,EAAE,IAAI,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QACrE,IAAI,IAA8D,CAAC;QACnE,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;QACnG,IAAI,QAAiC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrD,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,EAAE,CAAC;gBAC7B,QAAQ,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC;YACpE,CAAC;iBAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;gBAC1C,QAAQ,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,oBAAoB,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAClE,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9H,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,YAAY,CAAC,KAAc,EAAE,MAAsB;QACjD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,WAAW,CAAC,KAAc,EAAE,MAAsB;QAChD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,2EAA2E;IACnE,KAAK,CAAC,YAAY,CAAC,OAAe;QACxC,IAAI,KAAU,CAAC;QACf,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,iBAAiB,IAAI,KAAK,CAAC,QAAQ,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YACxG,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,OAAO,EAAE,iCAAiC,OAAO,GAAG,EAAE,CAAC;QACrG,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;QACnC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,OAAO,EAAE,mBAAmB,OAAO,wEAAwE,EAAE,CAAC;QAC/J,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAuB,EAAE,MAAsB;QAC5D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC5F,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG;gBACd,MAAM,EAAE,uBAAuB;gBAC/B,QAAQ,EAAE,KAAK,CAAC,OAAO;gBACvB,QAAQ,EAAE,KAAK,CAAC,OAAO;gBACvB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,QAAQ,CAAC,cAAc;gBAC/B,MAAM,EAAE,QAAQ,CAAC,OAAO;aACzB,CAAC;YACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAA4B,EAAE,MAAsB;QACtE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC5F,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG;gBACd,MAAM,EAAE,6BAA6B;gBACrC,QAAQ,EAAE,KAAK,CAAC,OAAO;gBACvB,QAAQ,EAAE,KAAK,CAAC,OAAO;gBACvB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,QAAQ,CAAC,cAAc;gBAC/B,MAAM,EAAE,QAAQ,CAAC,OAAO;aACzB,CAAC;YACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAkB,EAAE,MAAsB;QAClD,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC;YAAE,OAAO,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/F,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IACxE,CAAC;CACF"}

package/dist/src/lab-exec/contract.d.ts

@@ -94,4 +94,85 @@ export type LabSshInput = z.output<typeof LabSshInputSchema>;
 export declare function labSshRemoteTokens(command: string): string[];
 export declare function labSshCommandSha256(command: string): string;
 export declare function labSshArgv(input: LabSshInput): string[];
+/**
+ * lab_host_key_enroll input contract (REL-1971). Runs the canonical `vm enroll-host-key`
+ * ladder for one claimed guest. A dry run is the default; `apply` publishes the ADR 0918
+ * v2 claim-store access entry after the pin is proven.
+ */
+export declare const LabHostKeyEnrollInputShape: {
+    assetId: z.ZodOptional<z.ZodString>;
+    claimId: z.ZodOptional<z.ZodString>;
+    apply: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+};
+export declare const LabHostKeyEnrollInputSchema: z.ZodEffects<z.ZodObject<{
+    assetId: z.ZodOptional<z.ZodString>;
+    claimId: z.ZodOptional<z.ZodString>;
+    apply: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strict", z.ZodTypeAny, {
+    apply: boolean;
+    claimId?: string | undefined;
+    assetId?: string | undefined;
+}, {
+    claimId?: string | undefined;
+    assetId?: string | undefined;
+    apply?: boolean | undefined;
+}>, {
+    apply: boolean;
+    claimId?: string | undefined;
+    assetId?: string | undefined;
+}, {
+    claimId?: string | undefined;
+    assetId?: string | undefined;
+    apply?: boolean | undefined;
+}>;
+export type LabHostKeyEnrollInput = z.output<typeof LabHostKeyEnrollInputSchema>;
+/** The ladder can read the host key over the pinned serial console, so allow a long run. */
+export declare const LAB_HOST_KEY_ENROLL_TIMEOUT_MS = 180000;
+export declare function labHostKeyEnrollArgv(input: LabHostKeyEnrollInput): string[];
+/** Plain DNS host name (no wildcard, no leading dash) for an extra certificate principal. */
+export declare const LAB_HOST_CERT_PRINCIPAL: RegExp;
+/**
+ * lab_host_cert input contract (REL-1972, ADR 0939). Signs and installs the lab host CA certificate for one
+ * already-enrolled claimed guest. A dry run is the default; `apply` signs with the CA key and installs.
+ */
+export declare const LabHostCertInputShape: {
+    assetId: z.ZodOptional<z.ZodString>;
+    claimId: z.ZodOptional<z.ZodString>;
+    apply: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    principals: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+};
+export declare const LabHostCertInputSchema: z.ZodEffects<z.ZodObject<{
+    assetId: z.ZodOptional<z.ZodString>;
+    claimId: z.ZodOptional<z.ZodString>;
+    apply: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    principals: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strict", z.ZodTypeAny, {
+    apply: boolean;
+    claimId?: string | undefined;
+    assetId?: string | undefined;
+    principals?: string[] | undefined;
+}, {
+    claimId?: string | undefined;
+    assetId?: string | undefined;
+    apply?: boolean | undefined;
+    principals?: string[] | undefined;
+}>, {
+    apply: boolean;
+    claimId?: string | undefined;
+    assetId?: string | undefined;
+    principals?: string[] | undefined;
+}, {
+    claimId?: string | undefined;
+    assetId?: string | undefined;
+    apply?: boolean | undefined;
+    principals?: string[] | undefined;
+}>;
+export type LabHostCertInput = z.output<typeof LabHostCertInputSchema>;
+/** Signing, install over the pinned hop and two CA-only verifications can take a while. */
+export declare const LAB_HOST_CERT_TIMEOUT_MS = 180000;
+/** Best-effort re-issue after a claim renew: bounded so it never delays the renew answer for long. */
+export declare const LAB_HOST_CERT_RENEW_TIMEOUT_MS = 90000;
+export declare function labHostCertArgv(input: LabHostCertInput): string[];
+/** Claim-renew path: re-bind the stored entry to the renewed TTL, then certify. Always applies. */
+export declare function labHostCertAfterRenewArgv(assetId: string): string[];
 //# sourceMappingURL=contract.d.ts.map

package/dist/src/lab-exec/contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/contract.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,gBAAgB,QAAiC,CAAC;AAC/D,wGAAwG;AACxG,eAAO,MAAM,gBAAgB,QAA6C,CAAC;AAC3E,eAAO,MAAM,gBAAgB,QAA+B,CAAC;AAC7D,eAAO,MAAM,YAAY,QAAwE,CAAC;AAClG,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,eAAO,MAAM,kBAAkB;;;;;;;;;EAKpB,CAAC;AAEZ,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;CAY5B,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgB1B,CAAC;AAEL,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE7D,0GAA0G;AAC1G,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAE5D;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,CAQvD"}
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/contract.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,gBAAgB,QAAiC,CAAC;AAC/D,wGAAwG;AACxG,eAAO,MAAM,gBAAgB,QAA6C,CAAC;AAC3E,eAAO,MAAM,gBAAgB,QAA+B,CAAC;AAC7D,eAAO,MAAM,YAAY,QAAwE,CAAC;AAClG,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,eAAO,MAAM,kBAAkB;;;;;;;;;EAKpB,CAAC;AAEZ,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;CAY5B,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgB1B,CAAC;AAEL,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE7D,0GAA0G;AAC1G,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAE5D;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,CAQvD;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;CAOtC,CAAC;AAEF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;EAOpC,CAAC;AAEL,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEjF,4FAA4F;AAC5F,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAEtD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAG3E;AAED,6FAA6F;AAC7F,eAAO,MAAM,uBAAuB,QAA+G,CAAC;AAEpJ;;;GAGG;AACH,eAAO,MAAM,qBAAqB;;;;;CASjC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;EAO/B,CAAC;AAEL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEvE,2FAA2F;AAC3F,eAAO,MAAM,wBAAwB,SAAU,CAAC;AAChD,sGAAsG;AACtG,eAAO,MAAM,8BAA8B,QAAS,CAAC;AAErD,wBAAgB,eAAe,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAOjE;AAED,mGAAmG;AACnG,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAEnE"}

package/dist/src/lab-exec/contract.js

@@ -65,4 +65,73 @@ export function labSshArgv(input) {
     argv.push("--", ...labSshRemoteTokens(input.command));
     return argv;
 }
+/**
+ * lab_host_key_enroll input contract (REL-1971). Runs the canonical `vm enroll-host-key`
+ * ladder for one claimed guest. A dry run is the default; `apply` publishes the ADR 0918
+ * v2 claim-store access entry after the pin is proven.
+ */
+export const LabHostKeyEnrollInputShape = {
+    assetId: z.string().regex(LAB_SSH_ASSET_ID).optional()
+        .describe("Exact lab asset ID of the claimed runtime guest. Provide exactly one of assetId or claimId."),
+    claimId: z.string().regex(LAB_SSH_CLAIM_ID).optional()
+        .describe("ApplianceClaim name (for example claim-uat-1815-302). The MCP resolves the claim's guest asset ID itself. Provide exactly one of assetId or claimId."),
+    apply: z.boolean().optional().default(false)
+        .describe("false (default): read-only dry run that reports the observed pin and what would be published. true: publish the v2 access entry after the pin is proven; an already-enrolled guest is left untouched."),
+};
+export const LabHostKeyEnrollInputSchema = z
+    .object(LabHostKeyEnrollInputShape)
+    .strict()
+    .superRefine((value, ctx) => {
+    if ((value.assetId === undefined) === (value.claimId === undefined)) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["assetId"], message: "provide exactly one of assetId or claimId" });
+    }
+});
+/** The ladder can read the host key over the pinned serial console, so allow a long run. */
+export const LAB_HOST_KEY_ENROLL_TIMEOUT_MS = 180_000;
+export function labHostKeyEnrollArgv(input) {
+    if (!input.assetId)
+        throw new Error("labHostKeyEnrollArgv requires a resolved assetId");
+    return ["vm", "enroll-host-key", "--asset-id", input.assetId, ...(input.apply ? ["--apply"] : [])];
+}
+/** Plain DNS host name (no wildcard, no leading dash) for an extra certificate principal. */
+export const LAB_HOST_CERT_PRINCIPAL = /^(?=.{1,253}$)[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*$/;
+/**
+ * lab_host_cert input contract (REL-1972, ADR 0939). Signs and installs the lab host CA certificate for one
+ * already-enrolled claimed guest. A dry run is the default; `apply` signs with the CA key and installs.
+ */
+export const LabHostCertInputShape = {
+    assetId: z.string().regex(LAB_SSH_ASSET_ID).optional()
+        .describe("Exact lab asset ID of the enrolled, claimed runtime guest. Provide exactly one of assetId or claimId."),
+    claimId: z.string().regex(LAB_SSH_CLAIM_ID).optional()
+        .describe("ApplianceClaim name (for example claim-uat-1663-final-367). The MCP resolves the claim's guest asset ID itself. Provide exactly one of assetId or claimId."),
+    apply: z.boolean().optional().default(false)
+        .describe("false (default): read-only plan that reports principals, validity and whether the installed certificate is already current. true: sign with the lab host CA and install the certificate; an already-current certificate is left untouched."),
+    principals: z.array(z.string().regex(LAB_HOST_CERT_PRINCIPAL)).max(8).optional()
+        .describe("Extra plain DNS host names to certify besides the guest IP (no wildcards)."),
+};
+export const LabHostCertInputSchema = z
+    .object(LabHostCertInputShape)
+    .strict()
+    .superRefine((value, ctx) => {
+    if ((value.assetId === undefined) === (value.claimId === undefined)) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["assetId"], message: "provide exactly one of assetId or claimId" });
+    }
+});
+/** Signing, install over the pinned hop and two CA-only verifications can take a while. */
+export const LAB_HOST_CERT_TIMEOUT_MS = 180_000;
+/** Best-effort re-issue after a claim renew: bounded so it never delays the renew answer for long. */
+export const LAB_HOST_CERT_RENEW_TIMEOUT_MS = 90_000;
+export function labHostCertArgv(input) {
+    if (!input.assetId)
+        throw new Error("labHostCertArgv requires a resolved assetId");
+    return [
+        "vm", "host-cert", "--asset-id", input.assetId,
+        ...(input.apply ? ["--apply"] : []),
+        ...(input.principals ?? []).flatMap((principal) => ["--principal", principal]),
+    ];
+}
+/** Claim-renew path: re-bind the stored entry to the renewed TTL, then certify. Always applies. */
+export function labHostCertAfterRenewArgv(assetId) {
+    return ["vm", "host-cert", "--asset-id", assetId, "--apply", "--after-renew"];
+}
 //# sourceMappingURL=contract.js.map

package/dist/src/lab-exec/contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../../src/lab-exec/contract.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AAC/D,wGAAwG;AACxG,MAAM,CAAC,MAAM,gBAAgB,GAAG,0CAA0C,CAAC;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAC7D,MAAM,CAAC,MAAM,YAAY,GAAG,qEAAqE,CAAC;AAClG,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEhD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IACtG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;CACrH,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;SACnD,QAAQ,CAAC,gLAAgL,CAAC;IAC7L,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;SACnD,QAAQ,CAAC,gNAAgN,CAAC;IAC7N,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC;SACtD,QAAQ,CAAC,gNAAgN,CAAC;IAC7N,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;SACpE,QAAQ,CAAC,mDAAmD,CAAC;IAChE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;SAChF,QAAQ,CAAC,mKAAmK,CAAC;IAChL,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;CAC1H,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC,gBAAgB,CAAC;KACxB,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,yBAAyB,EAAE,CAAC;QACzE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACnD,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC,CAAC;IACzI,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;QAC3F,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,cAAc,KAAK,CAAC,UAAU,mDAAmD,EAAE,CAAC,CAAC;IAC9J,CAAC;AACH,CAAC,CAAC,CAAC;AAIL,0GAA0G;AAC1G,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAkB;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IACrH,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACrH,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,aAAa;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1G,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../../src/lab-exec/contract.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AAC/D,wGAAwG;AACxG,MAAM,CAAC,MAAM,gBAAgB,GAAG,0CAA0C,CAAC;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAC7D,MAAM,CAAC,MAAM,YAAY,GAAG,qEAAqE,CAAC;AAClG,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEhD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IACtG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;CACrH,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;SACnD,QAAQ,CAAC,gLAAgL,CAAC;IAC7L,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;SACnD,QAAQ,CAAC,gNAAgN,CAAC;IAC7N,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC;SACtD,QAAQ,CAAC,gNAAgN,CAAC;IAC7N,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;SACpE,QAAQ,CAAC,mDAAmD,CAAC;IAChE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;SAChF,QAAQ,CAAC,mKAAmK,CAAC;IAChL,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;CAC1H,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC,gBAAgB,CAAC;KACxB,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,yBAAyB,EAAE,CAAC;QACzE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACnD,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC,CAAC;IACzI,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;QAC3F,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,cAAc,KAAK,CAAC,UAAU,mDAAmD,EAAE,CAAC,CAAC;IAC9J,CAAC;AACH,CAAC,CAAC,CAAC;AAIL,0GAA0G;AAC1G,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAkB;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IACrH,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACrH,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,aAAa;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1G,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;SACnD,QAAQ,CAAC,6FAA6F,CAAC;IAC1G,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;SACnD,QAAQ,CAAC,sJAAsJ,CAAC;IACnK,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SACzC,QAAQ,CAAC,uMAAuM,CAAC;CACrN,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC,0BAA0B,CAAC;KAClC,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;IACzH,CAAC;AACH,CAAC,CAAC,CAAC;AAIL,4FAA4F;AAC5F,MAAM,CAAC,MAAM,8BAA8B,GAAG,OAAO,CAAC;AAEtD,MAAM,UAAU,oBAAoB,CAAC,KAA4B;IAC/D,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxF,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,MAAM,uBAAuB,GAAG,4GAA4G,CAAC;AAEpJ;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;SACnD,QAAQ,CAAC,uGAAuG,CAAC;IACpH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;SACnD,QAAQ,CAAC,4JAA4J,CAAC;IACzK,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SACzC,QAAQ,CAAC,4OAA4O,CAAC;IACzP,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;SAC7E,QAAQ,CAAC,4EAA4E,CAAC;CAC1F,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC,qBAAqB,CAAC;KAC7B,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;IACzH,CAAC;AACH,CAAC,CAAC,CAAC;AAIL,2FAA2F;AAC3F,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAChD,sGAAsG;AACtG,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAErD,MAAM,UAAU,eAAe,CAAC,KAAuB;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACnF,OAAO;QACL,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO;QAC9C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AAChF,CAAC"}

package/dist/src/lab-exec/executor.d.ts

@@ -1,6 +1,6 @@
 import type { CanonicalCommandResult } from "../canonical/types.js";
 import type { CallToolResult } from "../types/mcp.js";
-import { type LabSshInput } from "./contract.js";
+import { type LabHostCertInput, type LabHostKeyEnrollInput, type LabSshInput } from "./contract.js";
 /** Portal identity, used only for audit; authorization already happened at the portal. */
 export interface LabExecCaller {
     readonly identity?: string;
@@ -15,6 +15,12 @@ export interface LabExecOutcome {
 export interface LabExecutor {
     readonly location: "local" | "remote";
     ssh(input: LabSshInput, caller?: LabExecCaller): Promise<LabExecOutcome>;
+    /** Host-key enrollment ladder (REL-1971). Dry run unless input.apply. */
+    hostKeyEnroll?(input: LabHostKeyEnrollInput, caller?: LabExecCaller): Promise<LabExecOutcome>;
+    /** Lab host CA certificate (REL-1972). Dry run unless input.apply. */
+    hostCert?(input: LabHostCertInput, caller?: LabExecCaller): Promise<LabExecOutcome>;
+    /** Best-effort certificate re-issue after a claim renew (REL-1972): re-binds the stored entry, then certifies. */
+    hostCertAfterRenew?(assetId: string, caller?: LabExecCaller): Promise<LabExecOutcome>;
     /** Read-only claim discovery (REL-1961). Returns the exact tool result the local handler produces. */
     claimsList?(input: unknown, caller?: LabExecCaller): Promise<CallToolResult>;
     claimsGet?(input: unknown, caller?: LabExecCaller): Promise<CallToolResult>;
@@ -36,6 +42,10 @@ export declare class LocalLabExecutor implements LabExecutor {
     claimsRenew(input: unknown): Promise<CallToolResult>;
     claimsDelete(input: unknown): Promise<CallToolResult>;
     claimsPause(input: unknown): Promise<CallToolResult>;
+    hostKeyEnroll(input: LabHostKeyEnrollInput): Promise<LabExecOutcome>;
+    hostCert(input: LabHostCertInput): Promise<LabExecOutcome>;
+    hostCertAfterRenew(assetId: string): Promise<LabExecOutcome>;
+    private outcome;
     ssh(input: LabSshInput): Promise<LabExecOutcome>;
 }
 //# sourceMappingURL=executor.d.ts.map

package/dist/src/lab-exec/executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAStD,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAE7D,0FAA0F;AAC1F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAC;IACtC,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACzE,sGAAsG;IACtG,UAAU,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7E,SAAS,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5E,2FAA2F;IAC3F,YAAY,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/E,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9E,YAAY,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/E,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC/E;AAKD,qBAAa,gBAAiB,YAAW,WAAW;IAGtC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,QAAQ,CAAC,QAAQ,EAAG,OAAO,CAAU;gBAER,MAAM,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;KAAE;IAEjH,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAInD,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAIlD,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAIrD,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAIpD,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAIrD,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAI9C,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;CAUvD"}
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAStD,OAAO,EAQL,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,WAAW,EACjB,MAAM,eAAe,CAAC;AAEvB,0FAA0F;AAC1F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAC;IACtC,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACzE,yEAAyE;IACzE,aAAa,CAAC,CAAC,KAAK,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9F,sEAAsE;IACtE,QAAQ,CAAC,CAAC,KAAK,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACpF,kHAAkH;IAClH,kBAAkB,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACtF,sGAAsG;IACtG,UAAU,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7E,SAAS,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5E,2FAA2F;IAC3F,YAAY,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/E,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9E,YAAY,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/E,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC/E;AAKD,qBAAa,gBAAiB,YAAW,WAAW;IAGtC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,QAAQ,CAAC,QAAQ,EAAG,OAAO,CAAU;gBAER,MAAM,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;KAAE;IAEjH,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAInD,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAIlD,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAIrD,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAIpD,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAIrD,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAI9C,aAAa,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,cAAc,CAAC;IAWpE,QAAQ,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC;IAK1D,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAIlE,OAAO,CAAC,OAAO;IAST,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;CAUvD"}

package/dist/src/lab-exec/executor.js

@@ -1,5 +1,5 @@
 import { handleCreateApplianceClaim, handleDeleteApplianceClaim, handleGetApplianceClaim, handleListApplianceClaims, handlePauseApplianceClaim, handleRenewApplianceClaim, } from "../tools/appliance-claim-tools.js";
-import { labSshArgv } from "./contract.js";
+import { LAB_HOST_CERT_RENEW_TIMEOUT_MS, LAB_HOST_CERT_TIMEOUT_MS, LAB_HOST_KEY_ENROLL_TIMEOUT_MS, labHostCertAfterRenewArgv, labHostCertArgv, labHostKeyEnrollArgv, labSshArgv, } from "./contract.js";
 /** Bridge headroom beyond the CLI's own --timeout-seconds for resolution and cleanup. */
 const RESOLUTION_GRACE_MS = 30_000;
 export class LocalLabExecutor {
@@ -26,6 +26,33 @@ export class LocalLabExecutor {
     claimsPause(input) {
         return handlePauseApplianceClaim(input);
     }
+    async hostKeyEnroll(input) {
+        if (!input.assetId)
+            throw new Error("LocalLabExecutor requires a resolved assetId; wrap it in ClaimResolvingExecutor to accept claimId");
+        const result = await this.bridge.run(labHostKeyEnrollArgv(input), LAB_HOST_KEY_ENROLL_TIMEOUT_MS);
+        return {
+            exitCode: result.exitCode,
+            stdout: result.stdout,
+            stderr: result.stderr,
+            ...(result.timedOut ? { timedOut: true } : {}),
+        };
+    }
+    async hostCert(input) {
+        if (!input.assetId)
+            throw new Error("LocalLabExecutor requires a resolved assetId; wrap it in ClaimResolvingExecutor to accept claimId");
+        return this.outcome(await this.bridge.run(labHostCertArgv(input), LAB_HOST_CERT_TIMEOUT_MS));
+    }
+    async hostCertAfterRenew(assetId) {
+        return this.outcome(await this.bridge.run(labHostCertAfterRenewArgv(assetId), LAB_HOST_CERT_RENEW_TIMEOUT_MS));
+    }
+    outcome(result) {
+        return {
+            exitCode: result.exitCode,
+            stdout: result.stdout,
+            stderr: result.stderr,
+            ...(result.timedOut ? { timedOut: true } : {}),
+        };
+    }
     async ssh(input) {
         if (!input.assetId)
             throw new Error("LocalLabExecutor requires a resolved assetId; wrap it in ClaimResolvingExecutor to accept claimId");

package/dist/src/lab-exec/executor.js.map

@@ -1 +1 @@
-{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../src/lab-exec/executor.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAoB,MAAM,eAAe,CAAC;AA4B7D,yFAAyF;AACzF,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,MAAM,OAAO,gBAAgB;IAGE;IAFpB,QAAQ,GAAG,OAAgB,CAAC;IAErC,YAA6B,MAAoF;QAApF,WAAM,GAAN,MAAM,CAA8E;IAAG,CAAC;IAErH,UAAU,CAAC,KAAc;QACvB,OAAO,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,SAAS,CAAC,KAAc;QACtB,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,YAAY,CAAC,KAAc;QACzB,OAAO,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,WAAW,CAAC,KAAc;QACxB,OAAO,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,YAAY,CAAC,KAAc;QACzB,OAAO,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,WAAW,CAAC,KAAc;QACxB,OAAO,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAkB;QAC1B,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACzI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,cAAc,GAAG,IAAI,GAAG,mBAAmB,CAAC,CAAC;QAC3G,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../src/lab-exec/executor.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,8BAA8B,EAC9B,yBAAyB,EACzB,eAAe,EACf,oBAAoB,EACpB,UAAU,GAIX,MAAM,eAAe,CAAC;AAkCvB,yFAAyF;AACzF,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,MAAM,OAAO,gBAAgB;IAGE;IAFpB,QAAQ,GAAG,OAAgB,CAAC;IAErC,YAA6B,MAAoF;QAApF,WAAM,GAAN,MAAM,CAA8E;IAAG,CAAC;IAErH,UAAU,CAAC,KAAc;QACvB,OAAO,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,SAAS,CAAC,KAAc;QACtB,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,YAAY,CAAC,KAAc;QACzB,OAAO,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,WAAW,CAAC,KAAc;QACxB,OAAO,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,YAAY,CAAC,KAAc;QACzB,OAAO,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,WAAW,CAAC,KAAc;QACxB,OAAO,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAA4B;QAC9C,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACzI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,8BAA8B,CAAC,CAAC;QAClG,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAuB;QACpC,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACzI,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC/F,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAe;QACtC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,OAAO,CAAC,EAAE,8BAA8B,CAAC,CAAC,CAAC;IACjH,CAAC;IAEO,OAAO,CAAC,MAA8B;QAC5C,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAkB;QAC1B,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACzI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,cAAc,GAAG,IAAI,GAAG,mBAAmB,CAAC,CAAC;QAC3G,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;IACJ,CAAC;CACF"}

package/dist/src/lab-exec/remote.d.ts

@@ -1,8 +1,12 @@
 /** Worker-side client for the lab executor behind Cloudflare Tunnel + Access (ADR 0934). */
 import type { CallToolResult } from "../types/mcp.js";
-import type { LabSshInput } from "./contract.js";
+import { type LabHostCertInput, type LabHostKeyEnrollInput, type LabSshInput } from "./contract.js";
 import type { LabExecCaller, LabExecOutcome, LabExecutor } from "./executor.js";
 export declare const LAB_EXEC_PATH = "/v1/lab-exec/ssh";
+/** Host-key enrollment route (REL-1971). The zone WAF skip rule allows exactly this path. */
+export declare const LAB_EXEC_HOST_KEY_ENROLL_PATH = "/v1/lab-exec/host-key-enroll";
+/** Lab host CA certificate route (REL-1972). The zone WAF skip rule allows exactly this path. */
+export declare const LAB_EXEC_HOST_CERT_PATH = "/v1/lab-exec/host-cert";
 /** Read-only claim discovery routes (REL-1961). The zone WAF skip rule allows exactly these paths. */
 export declare const LAB_EXEC_CLAIMS_LIST_PATH = "/v1/lab-exec/claims/list";
 export declare const LAB_EXEC_CLAIMS_GET_PATH = "/v1/lab-exec/claims/get";
@@ -24,6 +28,8 @@ export declare class RemoteLabExecutor implements LabExecutor {
     readonly location: "remote";
     constructor(options: RemoteLabExecutorOptions);
     ssh(input: LabSshInput, caller?: LabExecCaller): Promise<LabExecOutcome>;
+    hostKeyEnroll(input: LabHostKeyEnrollInput, caller?: LabExecCaller): Promise<LabExecOutcome>;
+    hostCert(input: LabHostCertInput, caller?: LabExecCaller): Promise<LabExecOutcome>;
     claimsList(input: unknown, caller?: LabExecCaller): Promise<CallToolResult>;
     claimsGet(input: unknown, caller?: LabExecCaller): Promise<CallToolResult>;
     claimsCreate(input: unknown, caller?: LabExecCaller): Promise<CallToolResult>;

package/dist/src/lab-exec/remote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/remote.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEhF,eAAO,MAAM,aAAa,qBAAqB,CAAC;AAChD,sGAAsG;AACtG,eAAO,MAAM,yBAAyB,6BAA6B,CAAC;AACpE,eAAO,MAAM,wBAAwB,4BAA4B,CAAC;AAClE,2FAA2F;AAC3F,eAAO,MAAM,2BAA2B,+BAA+B,CAAC;AACxE,eAAO,MAAM,0BAA0B,8BAA8B,CAAC;AACtE,eAAO,MAAM,2BAA2B,+BAA+B,CAAC;AACxE,eAAO,MAAM,0BAA0B,8BAA8B,CAAC;AAGtE,+FAA+F;AAC/F,eAAO,MAAM,sBAAsB,oBAAoB,CAAC;AAGxD,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,qBAAa,iBAAkB,YAAW,WAAW;IAGvC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,QAAQ,CAAC,QAAQ,EAAG,QAAQ,CAAU;gBAET,OAAO,EAAE,wBAAwB;IAIxD,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAyB9E,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAI3E,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAI1E,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAI7E,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAI5E,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAI7E,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;YAI9D,MAAM;CAmBrB"}
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/remote.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAA4D,KAAK,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAC9J,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEhF,eAAO,MAAM,aAAa,qBAAqB,CAAC;AAChD,6FAA6F;AAC7F,eAAO,MAAM,6BAA6B,iCAAiC,CAAC;AAC5E,iGAAiG;AACjG,eAAO,MAAM,uBAAuB,2BAA2B,CAAC;AAChE,sGAAsG;AACtG,eAAO,MAAM,yBAAyB,6BAA6B,CAAC;AACpE,eAAO,MAAM,wBAAwB,4BAA4B,CAAC;AAClE,2FAA2F;AAC3F,eAAO,MAAM,2BAA2B,+BAA+B,CAAC;AACxE,eAAO,MAAM,0BAA0B,8BAA8B,CAAC;AACtE,eAAO,MAAM,2BAA2B,+BAA+B,CAAC;AACxE,eAAO,MAAM,0BAA0B,8BAA8B,CAAC;AAKtE,+FAA+F;AAC/F,eAAO,MAAM,sBAAsB,oBAAoB,CAAC;AAGxD,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,qBAAa,iBAAkB,YAAW,WAAW;IAGvC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,QAAQ,CAAC,QAAQ,EAAG,QAAQ,CAAU;gBAET,OAAO,EAAE,wBAAwB;IAIxD,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAyBxE,aAAa,CAAC,KAAK,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAyB5F,QAAQ,CAAC,KAAK,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAyBxF,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAI3E,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAI1E,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAI7E,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAI5E,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAI7E,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;YAI9D,MAAM;CAmBrB"}