@calltelemetry/ct-lab-mcp 0.8.128 → 0.8.130

package/README.md

@@ -100,7 +100,7 @@ than use the legacy Node VMID/name slot state when the bridge is unavailable.
 - **Claim custody annotation** (REL-1746; slots and reservation Leases are retired): Proxmox claim creation requires the actual canonical node, explicit VMID and VM name in `ct-lab`, with a finite TTL. The original-owner record lives on the claim itself as annotation `calltelemetry.com/claim-custody` (`claim-custody/v1`: guest tuple, phase, operation nonce, creation-request hash, context, provider binding), written in the same single create call as the claim. No Lease is ever created, renewed or required; per-guest serialization is in-process keyed by node and VMID, and the existing claim-occupancy scan plus the claim UID/resourceVersion protect against other actors. Whole effective immutable CRD fields and creation labels are rehashed on retry and deletion; only the declared lifecycle fields and stale label can change. A matching name alone grants no custody. Claims created before the retirement still carry a `ct-physical-slot-reservation.*` Lease: the MCP verifies them read-only (reporting `custody.source: "legacy-lease"`, `migration: "operator-pending"`) and the appliance operator converts them into the annotation; the MCP never writes a Lease.
 - **One configured Kubernetes claim backend**: ApplianceClaim CRUD and read-only legacy reservation Lease reads share one backend resolver. Local stdio deployments must set an absolute `LAB_CLAIM_KUBECONFIG`, the exact `LAB_CLAIM_K8S_CONTEXT`, and an HTTPS-origin `LAB_CLAIM_K8S_SERVER`; the selected kubeconfig is validated against that server before a request. In-cluster deployments must set the context/server and provide the service-account token and CA for that same cluster. Cross-cluster deployments use the explicit kubeconfig path. The process never falls back to `KUBECONFIG`, `~/.kube/config`, or an embedded server, and a missing or mismatched binding is refused before any claim effect. The container image is published to Docker Hub by the Docker Build and Publish workflow, which only builds and pushes; it does not edit any cluster manifest. ct-lab-mcp is not Flux-deployed, and the retired DOKS cluster is no longer a target.
 - **Original UID deletion**: `delete_appliance_claim` requires `expectedUid` from the independently observed original claim. It verifies the claim custody record (or legacy Lease, read-only), then requests only claim deletion with UID/resourceVersion `DeleteOptions` preconditions; the operator owns teardown and must independently prove original guest, owned-volume and original-UID absence before releasing custody. A claim with neither a custody annotation nor a legacy Lease is refused (`NoClaimCustody`).
-- **Guarded image import**: `claimed_import_qcow` creates a bare claim, waits for an operator to set it `Ready` (default 120 s, `CT_LAB_CLAIM_RECONCILE_TIMEOUT_MS`; a claim no operator reconciles fails with `CLAIM_NOT_RECONCILED` before any image import, because the claim plane and the operator's cluster differ), then invokes the canonical `vm provision --source published-qcow` lifecycle. Its actual default bridge keeps host CPU semantics; portable first-power qualification uses the separate explicit canonical source route. Returned, thrown and uncertain import errors retain the claim and its custody record and preserve diagnostics. This path requires the qualified controller and operator successors; a source pin alone does not establish deployed readiness.
+- **Guarded image import**: `claimed_import_qcow` (and `proxmox_import_qcow`) fail closed with `CANONICAL_OPERATION_REQUIRES_BRIDGE` when the MCP server process has no canonical bridge (`CT_LAB_CANONICAL_CLI` unset); this is by design and not fixable from the tool call. Run the same operation through `lab-inventory vm provision --source published-qcow` (dry-run, then apply) from the operator machine or a lab-LAN host, or use a gateway started with `CT_LAB_CANONICAL_CLI`. `claimed_import_qcow` creates a bare claim, waits for an operator to set it `Ready` (default 120 s, `CT_LAB_CLAIM_RECONCILE_TIMEOUT_MS`; a claim no operator reconciles fails with `CLAIM_NOT_RECONCILED` before any image import, because the claim plane and the operator's cluster differ), then invokes the canonical `vm provision --source published-qcow` lifecycle. Its actual default bridge keeps host CPU semantics; portable first-power qualification uses the separate explicit canonical source route. Returned, thrown and uncertain import errors retain the claim and its custody record and preserve diagnostics. This path requires the qualified controller and operator successors; a source pin alone does not establish deployed readiness.
 - **Legacy SDK effects**: Direct SDK guest creation/clone/power/config/destruction, unguarded script guest writes and generic guest SSH authentication/commands are unavailable without the implemented canonical lifecycle. No caller flag or environment switch enables the retired effects. The historical purge daemon reports `authority_required` with zero releases/destruction and keeps all protection records. Provider inventory reads and implemented typed canonical operations remain available.
 
 - **Sideloaded Appliance Management Runner**: `sideload_appliance_runner` executes isolated runner actions (`execute`, `container_override`, `systemd_reset`, `diagnostic_bundle`) over SSH (port 2222) using ephemeral runner payloads, eliminating brittleness and version drift from mutating `/home/calltelemetry/cli.sh`.

package/dist/src/generated-version.d.ts

@@ -2,5 +2,5 @@
  * Auto-synced package version fallback for non-filesystem runtimes (Cloudflare Workers).
  * Updated automatically during release publication in .github/workflows/publish.yml.
  */
-export declare const PACKAGE_VERSION = "0.8.128";
+export declare const PACKAGE_VERSION = "0.8.130";
 //# sourceMappingURL=generated-version.d.ts.map

package/dist/src/generated-version.js

@@ -2,5 +2,5 @@
  * Auto-synced package version fallback for non-filesystem runtimes (Cloudflare Workers).
  * Updated automatically during release publication in .github/workflows/publish.yml.
  */
-export const PACKAGE_VERSION = "0.8.128";
+export const PACKAGE_VERSION = "0.8.130";
 //# sourceMappingURL=generated-version.js.map

package/dist/src/lab-exec/claim-resolve.d.ts

@@ -5,7 +5,7 @@
  * canonical asset ID. An unresolvable claim yields a structured ct-lab-vm-ssh-result/v1
  * envelope and no ssh attempt.
  */
-import type { LabHostKeyEnrollInput, LabSshInput } from "./contract.js";
+import type { LabHostCertInput, LabHostKeyEnrollInput, LabSshInput } from "./contract.js";
 import type { LabExecCaller, LabExecOutcome, LabExecutor } from "./executor.js";
 export interface ClaimReader {
     getClaim(name: string): Promise<any>;
@@ -403,6 +403,11 @@ export declare class ClaimResolvingExecutor implements LabExecutor {
         } | undefined;
         isError?: boolean | undefined;
     }>;
+    /**
+     * REL-1972: a successful, non-dry-run renew re-issues the guest's host certificate so its validity follows the
+     * renewed TTL. Best effort: the renew already happened, so any failure here is reported in `hostCert`, never thrown.
+     */
+    private withRenewedHostCert;
     claimsDelete(input: unknown, caller?: LabExecCaller): Promise<{
         [x: string]: unknown;
         content: ({
@@ -599,6 +604,7 @@ export declare class ClaimResolvingExecutor implements LabExecutor {
     }>;
     /** Resolve a claim to its guest asset ID, or return the refusal reason. */
     private resolveAsset;
+    hostCert(input: LabHostCertInput, caller?: LabExecCaller): Promise<LabExecOutcome>;
     hostKeyEnroll(input: LabHostKeyEnrollInput, caller?: LabExecCaller): Promise<LabExecOutcome>;
     ssh(input: LabSshInput, caller?: LabExecCaller): Promise<LabExecOutcome>;
 }

package/dist/src/lab-exec/claim-resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claim-resolve.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/claim-resolve.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAExE,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGhF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CACtC;AAyBD,qBAAa,sBAAuB,YAAW,WAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAe,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAA3C,KAAK,EAAE,WAAW,EAAmB,MAAM,EAAE,WAAW;IAErF,IAAI,QAAQ,uBAAkC;IAE9C,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKjD,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKhD,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKnD,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKlD,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKnD,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKlD,2EAA2E;YAC7D,YAAY;IAiBpB,aAAa,CAAC,KAAK,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAoB5F,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;CAO/E"}
+{"version":3,"file":"claim-resolve.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/claim-resolve.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG1F,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGhF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CACtC;AAyBD,qBAAa,sBAAuB,YAAW,WAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAe,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAA3C,KAAK,EAAE,WAAW,EAAmB,MAAM,EAAE,WAAW;IAErF,IAAI,QAAQ,uBAAkC;IAE9C,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKjD,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKhD,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAK7C,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAMxD;;;OAGG;YACW,mBAAmB;IA2BjC,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKnD,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKlD,2EAA2E;YAC7D,YAAY;IAiBpB,QAAQ,CAAC,KAAK,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAoBlF,aAAa,CAAC,KAAK,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAoB5F,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;CAO/E"}

package/dist/src/lab-exec/claim-resolve.js

@@ -1,5 +1,5 @@
 import { labSshCommandSha256, LAB_SSH_ASSET_ID } from "./contract.js";
-import { HOST_KEY_ENROLL_RESULT_SCHEMA, VM_SSH_RESULT_SCHEMA } from "./result.js";
+import { HOST_CERT_RESULT_SCHEMA, HOST_KEY_ENROLL_RESULT_SCHEMA, VM_SSH_RESULT_SCHEMA, hostCertRenewSummary } from "./result.js";
 function notFound(error) {
     const e = error;
     return e?.status === 404 || String(e?.message ?? "").includes("(404)");
@@ -44,10 +44,47 @@ export class ClaimResolvingExecutor {
             throw new Error("inner executor has no claim plane");
         return this.inner.claimsCreate(input, caller);
     }
-    claimsRenew(input, caller) {
+    async claimsRenew(input, caller) {
         if (!this.inner.claimsRenew)
             throw new Error("inner executor has no claim plane");
-        return this.inner.claimsRenew(input, caller);
+        const result = await this.inner.claimsRenew(input, caller);
+        return this.withRenewedHostCert(result, caller);
+    }
+    /**
+     * REL-1972: a successful, non-dry-run renew re-issues the guest's host certificate so its validity follows the
+     * renewed TTL. Best effort: the renew already happened, so any failure here is reported in `hostCert`, never thrown.
+     */
+    async withRenewedHostCert(result, caller) {
+        const block = result.content?.[0];
+        if (result.isError === true || block?.type !== "text")
+            return result;
+        let body;
+        try {
+            body = JSON.parse(block.text);
+        }
+        catch {
+            return result;
+        }
+        if (body.success !== true || body.dryRun === true || typeof body.claim !== "string")
+            return result;
+        let hostCert;
+        try {
+            const resolved = await this.resolveAsset(body.claim);
+            if (!("assetId" in resolved)) {
+                hostCert = { status: "skipped", reason: resolved.classification };
+            }
+            else if (!this.inner.hostCertAfterRenew) {
+                hostCert = { status: "skipped", reason: "host_cert_not_supported" };
+            }
+            else {
+                hostCert = hostCertRenewSummary(await this.inner.hostCertAfterRenew(resolved.assetId, caller));
+            }
+        }
+        catch {
+            hostCert = { status: "error", reason: "host_cert_unavailable" };
+        }
+        const content = [{ type: "text", text: JSON.stringify({ ...body, hostCert }, null, 2) }, ...result.content.slice(1)];
+        return { ...result, content };
     }
     claimsDelete(input, caller) {
         if (!this.inner.claimsDelete)
@@ -78,6 +115,27 @@ export class ClaimResolvingExecutor {
         }
         return { assetId };
     }
+    async hostCert(input, caller) {
+        if (!this.inner.hostCert)
+            throw new Error("inner executor has no host certificate support");
+        if (!input.claimId)
+            return this.inner.hostCert(input, caller);
+        const resolved = await this.resolveAsset(input.claimId);
+        if (!("assetId" in resolved)) {
+            const receipt = {
+                schema: HOST_CERT_RESULT_SCHEMA,
+                asset_id: input.claimId,
+                claim_id: input.claimId,
+                apply: input.apply,
+                status: "refused",
+                reason: resolved.classification,
+                detail: resolved.message,
+            };
+            return { exitCode: 0, stdout: JSON.stringify(receipt), stderr: "" };
+        }
+        const { claimId: _claimId, ...rest } = input;
+        return this.inner.hostCert({ ...rest, assetId: resolved.assetId }, caller);
+    }
     async hostKeyEnroll(input, caller) {
         if (!this.inner.hostKeyEnroll)
             throw new Error("inner executor has no host-key enrollment");

package/dist/src/lab-exec/claim-resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"claim-resolve.js","sourceRoot":"","sources":["../../../src/lab-exec/claim-resolve.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,6BAA6B,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAMlF,SAAS,QAAQ,CAAC,KAAc;IAC9B,MAAM,CAAC,GAAG,KAA0D,CAAC;IACrE,OAAO,CAAC,EAAE,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,OAAO,CAAC,KAAkB,EAAE,cAAsB,EAAE,OAAe;IAC1E,MAAM,QAAQ,GAAG;QACf,MAAM,EAAE,oBAAoB;QAC5B,QAAQ,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;QAC7B,QAAQ,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;QAC7B,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,SAAS,EAAE,CAAC;QACZ,cAAc;QACd,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,OAAO;QACf,gBAAgB,EAAE,KAAK;QACvB,gBAAgB,EAAE,KAAK;QACvB,WAAW,EAAE,CAAC;QACd,cAAc,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;KACnD,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,OAAO,sBAAsB;IACJ;IAAqC;IAAlE,YAA6B,KAAkB,EAAmB,MAAmB;QAAxD,UAAK,GAAL,KAAK,CAAa;QAAmB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEzF,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE9C,UAAU,CAAC,KAAc,EAAE,MAAsB;QAC/C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,SAAS,CAAC,KAAc,EAAE,MAAsB;QAC9C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,YAAY,CAAC,KAAc,EAAE,MAAsB;QACjD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,WAAW,CAAC,KAAc,EAAE,MAAsB;QAChD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,YAAY,CAAC,KAAc,EAAE,MAAsB;QACjD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,WAAW,CAAC,KAAc,EAAE,MAAsB;QAChD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,2EAA2E;IACnE,KAAK,CAAC,YAAY,CAAC,OAAe;QACxC,IAAI,KAAU,CAAC;QACf,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,iBAAiB,IAAI,KAAK,CAAC,QAAQ,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YACxG,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,OAAO,EAAE,iCAAiC,OAAO,GAAG,EAAE,CAAC;QACrG,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;QACnC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,OAAO,EAAE,mBAAmB,OAAO,wEAAwE,EAAE,CAAC;QAC/J,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAA4B,EAAE,MAAsB;QACtE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC5F,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG;gBACd,MAAM,EAAE,6BAA6B;gBACrC,QAAQ,EAAE,KAAK,CAAC,OAAO;gBACvB,QAAQ,EAAE,KAAK,CAAC,OAAO;gBACvB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,QAAQ,CAAC,cAAc;gBAC/B,MAAM,EAAE,QAAQ,CAAC,OAAO;aACzB,CAAC;YACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAkB,EAAE,MAAsB;QAClD,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC;YAAE,OAAO,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/F,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IACxE,CAAC;CACF"}
+{"version":3,"file":"claim-resolve.js","sourceRoot":"","sources":["../../../src/lab-exec/claim-resolve.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGtE,OAAO,EAAE,uBAAuB,EAAE,6BAA6B,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAMjI,SAAS,QAAQ,CAAC,KAAc;IAC9B,MAAM,CAAC,GAAG,KAA0D,CAAC;IACrE,OAAO,CAAC,EAAE,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,OAAO,CAAC,KAAkB,EAAE,cAAsB,EAAE,OAAe;IAC1E,MAAM,QAAQ,GAAG;QACf,MAAM,EAAE,oBAAoB;QAC5B,QAAQ,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;QAC7B,QAAQ,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;QAC7B,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,SAAS,EAAE,CAAC;QACZ,cAAc;QACd,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,OAAO;QACf,gBAAgB,EAAE,KAAK;QACvB,gBAAgB,EAAE,KAAK;QACvB,WAAW,EAAE,CAAC;QACd,cAAc,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;KACnD,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,OAAO,sBAAsB;IACJ;IAAqC;IAAlE,YAA6B,KAAkB,EAAmB,MAAmB;QAAxD,UAAK,GAAL,KAAK,CAAa;QAAmB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEzF,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE9C,UAAU,CAAC,KAAc,EAAE,MAAsB;QAC/C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,SAAS,CAAC,KAAc,EAAE,MAAsB;QAC9C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,YAAY,CAAC,KAAc,EAAE,MAAsB;QACjD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAc,EAAE,MAAsB;QACtD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,mBAAmB,CAAC,MAAsB,EAAE,MAAsB;QAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,EAAE,IAAI,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QACrE,IAAI,IAA8D,CAAC;QACnE,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;QACnG,IAAI,QAAiC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrD,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,EAAE,CAAC;gBAC7B,QAAQ,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC;YACpE,CAAC;iBAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;gBAC1C,QAAQ,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,oBAAoB,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAClE,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9H,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,YAAY,CAAC,KAAc,EAAE,MAAsB;QACjD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,WAAW,CAAC,KAAc,EAAE,MAAsB;QAChD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,2EAA2E;IACnE,KAAK,CAAC,YAAY,CAAC,OAAe;QACxC,IAAI,KAAU,CAAC;QACf,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,iBAAiB,IAAI,KAAK,CAAC,QAAQ,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YACxG,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,OAAO,EAAE,iCAAiC,OAAO,GAAG,EAAE,CAAC;QACrG,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;QACnC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,OAAO,EAAE,mBAAmB,OAAO,wEAAwE,EAAE,CAAC;QAC/J,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAuB,EAAE,MAAsB;QAC5D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC5F,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG;gBACd,MAAM,EAAE,uBAAuB;gBAC/B,QAAQ,EAAE,KAAK,CAAC,OAAO;gBACvB,QAAQ,EAAE,KAAK,CAAC,OAAO;gBACvB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,QAAQ,CAAC,cAAc;gBAC/B,MAAM,EAAE,QAAQ,CAAC,OAAO;aACzB,CAAC;YACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAA4B,EAAE,MAAsB;QACtE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC5F,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG;gBACd,MAAM,EAAE,6BAA6B;gBACrC,QAAQ,EAAE,KAAK,CAAC,OAAO;gBACvB,QAAQ,EAAE,KAAK,CAAC,OAAO;gBACvB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,QAAQ,CAAC,cAAc;gBAC/B,MAAM,EAAE,QAAQ,CAAC,OAAO;aACzB,CAAC;YACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAkB,EAAE,MAAsB;QAClD,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC;YAAE,OAAO,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/F,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IACxE,CAAC;CACF"}

package/dist/src/lab-exec/contract.d.ts

@@ -129,4 +129,50 @@ export type LabHostKeyEnrollInput = z.output<typeof LabHostKeyEnrollInputSchema>
 /** The ladder can read the host key over the pinned serial console, so allow a long run. */
 export declare const LAB_HOST_KEY_ENROLL_TIMEOUT_MS = 180000;
 export declare function labHostKeyEnrollArgv(input: LabHostKeyEnrollInput): string[];
+/** Plain DNS host name (no wildcard, no leading dash) for an extra certificate principal. */
+export declare const LAB_HOST_CERT_PRINCIPAL: RegExp;
+/**
+ * lab_host_cert input contract (REL-1972, ADR 0939). Signs and installs the lab host CA certificate for one
+ * already-enrolled claimed guest. A dry run is the default; `apply` signs with the CA key and installs.
+ */
+export declare const LabHostCertInputShape: {
+    assetId: z.ZodOptional<z.ZodString>;
+    claimId: z.ZodOptional<z.ZodString>;
+    apply: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    principals: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+};
+export declare const LabHostCertInputSchema: z.ZodEffects<z.ZodObject<{
+    assetId: z.ZodOptional<z.ZodString>;
+    claimId: z.ZodOptional<z.ZodString>;
+    apply: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    principals: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strict", z.ZodTypeAny, {
+    apply: boolean;
+    claimId?: string | undefined;
+    assetId?: string | undefined;
+    principals?: string[] | undefined;
+}, {
+    claimId?: string | undefined;
+    assetId?: string | undefined;
+    apply?: boolean | undefined;
+    principals?: string[] | undefined;
+}>, {
+    apply: boolean;
+    claimId?: string | undefined;
+    assetId?: string | undefined;
+    principals?: string[] | undefined;
+}, {
+    claimId?: string | undefined;
+    assetId?: string | undefined;
+    apply?: boolean | undefined;
+    principals?: string[] | undefined;
+}>;
+export type LabHostCertInput = z.output<typeof LabHostCertInputSchema>;
+/** Signing, install over the pinned hop and two CA-only verifications can take a while. */
+export declare const LAB_HOST_CERT_TIMEOUT_MS = 180000;
+/** Best-effort re-issue after a claim renew: bounded so it never delays the renew answer for long. */
+export declare const LAB_HOST_CERT_RENEW_TIMEOUT_MS = 90000;
+export declare function labHostCertArgv(input: LabHostCertInput): string[];
+/** Claim-renew path: re-bind the stored entry to the renewed TTL, then certify. Always applies. */
+export declare function labHostCertAfterRenewArgv(assetId: string): string[];
 //# sourceMappingURL=contract.d.ts.map

package/dist/src/lab-exec/contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/contract.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,gBAAgB,QAAiC,CAAC;AAC/D,wGAAwG;AACxG,eAAO,MAAM,gBAAgB,QAA6C,CAAC;AAC3E,eAAO,MAAM,gBAAgB,QAA+B,CAAC;AAC7D,eAAO,MAAM,YAAY,QAAwE,CAAC;AAClG,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,eAAO,MAAM,kBAAkB;;;;;;;;;EAKpB,CAAC;AAEZ,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;CAY5B,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgB1B,CAAC;AAEL,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE7D,0GAA0G;AAC1G,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAE5D;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,CAQvD;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;CAOtC,CAAC;AAEF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;EAOpC,CAAC;AAEL,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEjF,4FAA4F;AAC5F,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAEtD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAG3E"}
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/contract.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,gBAAgB,QAAiC,CAAC;AAC/D,wGAAwG;AACxG,eAAO,MAAM,gBAAgB,QAA6C,CAAC;AAC3E,eAAO,MAAM,gBAAgB,QAA+B,CAAC;AAC7D,eAAO,MAAM,YAAY,QAAwE,CAAC;AAClG,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,eAAO,MAAM,kBAAkB;;;;;;;;;EAKpB,CAAC;AAEZ,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;CAY5B,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgB1B,CAAC;AAEL,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE7D,0GAA0G;AAC1G,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAE5D;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,EAAE,CAQvD;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;CAOtC,CAAC;AAEF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;EAOpC,CAAC;AAEL,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEjF,4FAA4F;AAC5F,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAEtD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAG3E;AAED,6FAA6F;AAC7F,eAAO,MAAM,uBAAuB,QAA+G,CAAC;AAEpJ;;;GAGG;AACH,eAAO,MAAM,qBAAqB;;;;;CASjC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;EAO/B,CAAC;AAEL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEvE,2FAA2F;AAC3F,eAAO,MAAM,wBAAwB,SAAU,CAAC;AAChD,sGAAsG;AACtG,eAAO,MAAM,8BAA8B,QAAS,CAAC;AAErD,wBAAgB,eAAe,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAOjE;AAED,mGAAmG;AACnG,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAEnE"}

package/dist/src/lab-exec/contract.js

@@ -93,4 +93,45 @@ export function labHostKeyEnrollArgv(input) {
         throw new Error("labHostKeyEnrollArgv requires a resolved assetId");
     return ["vm", "enroll-host-key", "--asset-id", input.assetId, ...(input.apply ? ["--apply"] : [])];
 }
+/** Plain DNS host name (no wildcard, no leading dash) for an extra certificate principal. */
+export const LAB_HOST_CERT_PRINCIPAL = /^(?=.{1,253}$)[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*$/;
+/**
+ * lab_host_cert input contract (REL-1972, ADR 0939). Signs and installs the lab host CA certificate for one
+ * already-enrolled claimed guest. A dry run is the default; `apply` signs with the CA key and installs.
+ */
+export const LabHostCertInputShape = {
+    assetId: z.string().regex(LAB_SSH_ASSET_ID).optional()
+        .describe("Exact lab asset ID of the enrolled, claimed runtime guest. Provide exactly one of assetId or claimId."),
+    claimId: z.string().regex(LAB_SSH_CLAIM_ID).optional()
+        .describe("ApplianceClaim name (for example claim-uat-1663-final-367). The MCP resolves the claim's guest asset ID itself. Provide exactly one of assetId or claimId."),
+    apply: z.boolean().optional().default(false)
+        .describe("false (default): read-only plan that reports principals, validity and whether the installed certificate is already current. true: sign with the lab host CA and install the certificate; an already-current certificate is left untouched."),
+    principals: z.array(z.string().regex(LAB_HOST_CERT_PRINCIPAL)).max(8).optional()
+        .describe("Extra plain DNS host names to certify besides the guest IP (no wildcards)."),
+};
+export const LabHostCertInputSchema = z
+    .object(LabHostCertInputShape)
+    .strict()
+    .superRefine((value, ctx) => {
+    if ((value.assetId === undefined) === (value.claimId === undefined)) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["assetId"], message: "provide exactly one of assetId or claimId" });
+    }
+});
+/** Signing, install over the pinned hop and two CA-only verifications can take a while. */
+export const LAB_HOST_CERT_TIMEOUT_MS = 180_000;
+/** Best-effort re-issue after a claim renew: bounded so it never delays the renew answer for long. */
+export const LAB_HOST_CERT_RENEW_TIMEOUT_MS = 90_000;
+export function labHostCertArgv(input) {
+    if (!input.assetId)
+        throw new Error("labHostCertArgv requires a resolved assetId");
+    return [
+        "vm", "host-cert", "--asset-id", input.assetId,
+        ...(input.apply ? ["--apply"] : []),
+        ...(input.principals ?? []).flatMap((principal) => ["--principal", principal]),
+    ];
+}
+/** Claim-renew path: re-bind the stored entry to the renewed TTL, then certify. Always applies. */
+export function labHostCertAfterRenewArgv(assetId) {
+    return ["vm", "host-cert", "--asset-id", assetId, "--apply", "--after-renew"];
+}
 //# sourceMappingURL=contract.js.map

package/dist/src/lab-exec/contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../../src/lab-exec/contract.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AAC/D,wGAAwG;AACxG,MAAM,CAAC,MAAM,gBAAgB,GAAG,0CAA0C,CAAC;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAC7D,MAAM,CAAC,MAAM,YAAY,GAAG,qEAAqE,CAAC;AAClG,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEhD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IACtG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;CACrH,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;SACnD,QAAQ,CAAC,gLAAgL,CAAC;IAC7L,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;SACnD,QAAQ,CAAC,gNAAgN,CAAC;IAC7N,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC;SACtD,QAAQ,CAAC,gNAAgN,CAAC;IAC7N,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;SACpE,QAAQ,CAAC,mDAAmD,CAAC;IAChE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;SAChF,QAAQ,CAAC,mKAAmK,CAAC;IAChL,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;CAC1H,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC,gBAAgB,CAAC;KACxB,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,yBAAyB,EAAE,CAAC;QACzE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACnD,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC,CAAC;IACzI,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;QAC3F,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,cAAc,KAAK,CAAC,UAAU,mDAAmD,EAAE,CAAC,CAAC;IAC9J,CAAC;AACH,CAAC,CAAC,CAAC;AAIL,0GAA0G;AAC1G,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAkB;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IACrH,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACrH,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,aAAa;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1G,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;SACnD,QAAQ,CAAC,6FAA6F,CAAC;IAC1G,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;SACnD,QAAQ,CAAC,sJAAsJ,CAAC;IACnK,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SACzC,QAAQ,CAAC,uMAAuM,CAAC;CACrN,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC,0BAA0B,CAAC;KAClC,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;IACzH,CAAC;AACH,CAAC,CAAC,CAAC;AAIL,4FAA4F;AAC5F,MAAM,CAAC,MAAM,8BAA8B,GAAG,OAAO,CAAC;AAEtD,MAAM,UAAU,oBAAoB,CAAC,KAA4B;IAC/D,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxF,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACrG,CAAC"}
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../../src/lab-exec/contract.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AAC/D,wGAAwG;AACxG,MAAM,CAAC,MAAM,gBAAgB,GAAG,0CAA0C,CAAC;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAC7D,MAAM,CAAC,MAAM,YAAY,GAAG,qEAAqE,CAAC;AAClG,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEhD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IACtG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;CACrH,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;SACnD,QAAQ,CAAC,gLAAgL,CAAC;IAC7L,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;SACnD,QAAQ,CAAC,gNAAgN,CAAC;IAC7N,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC;SACtD,QAAQ,CAAC,gNAAgN,CAAC;IAC7N,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;SACpE,QAAQ,CAAC,mDAAmD,CAAC;IAChE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;SAChF,QAAQ,CAAC,mKAAmK,CAAC;IAChL,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;CAC1H,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC,gBAAgB,CAAC;KACxB,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,yBAAyB,EAAE,CAAC;QACzE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACnD,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC,CAAC;IACzI,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;QAC3F,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,cAAc,KAAK,CAAC,UAAU,mDAAmD,EAAE,CAAC,CAAC;IAC9J,CAAC;AACH,CAAC,CAAC,CAAC;AAIL,0GAA0G;AAC1G,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAkB;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IACrH,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACrH,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,aAAa;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1G,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;SACnD,QAAQ,CAAC,6FAA6F,CAAC;IAC1G,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;SACnD,QAAQ,CAAC,sJAAsJ,CAAC;IACnK,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SACzC,QAAQ,CAAC,uMAAuM,CAAC;CACrN,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC,0BAA0B,CAAC;KAClC,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;IACzH,CAAC;AACH,CAAC,CAAC,CAAC;AAIL,4FAA4F;AAC5F,MAAM,CAAC,MAAM,8BAA8B,GAAG,OAAO,CAAC;AAEtD,MAAM,UAAU,oBAAoB,CAAC,KAA4B;IAC/D,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxF,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,MAAM,uBAAuB,GAAG,4GAA4G,CAAC;AAEpJ;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;SACnD,QAAQ,CAAC,uGAAuG,CAAC;IACpH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;SACnD,QAAQ,CAAC,4JAA4J,CAAC;IACzK,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SACzC,QAAQ,CAAC,4OAA4O,CAAC;IACzP,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;SAC7E,QAAQ,CAAC,4EAA4E,CAAC;CAC1F,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC,qBAAqB,CAAC;KAC7B,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;IACzH,CAAC;AACH,CAAC,CAAC,CAAC;AAIL,2FAA2F;AAC3F,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAChD,sGAAsG;AACtG,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAErD,MAAM,UAAU,eAAe,CAAC,KAAuB;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACnF,OAAO;QACL,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO;QAC9C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AAChF,CAAC"}

package/dist/src/lab-exec/executor.d.ts

@@ -1,6 +1,6 @@
 import type { CanonicalCommandResult } from "../canonical/types.js";
 import type { CallToolResult } from "../types/mcp.js";
-import { type LabHostKeyEnrollInput, type LabSshInput } from "./contract.js";
+import { type LabHostCertInput, type LabHostKeyEnrollInput, type LabSshInput } from "./contract.js";
 /** Portal identity, used only for audit; authorization already happened at the portal. */
 export interface LabExecCaller {
     readonly identity?: string;
@@ -17,6 +17,10 @@ export interface LabExecutor {
     ssh(input: LabSshInput, caller?: LabExecCaller): Promise<LabExecOutcome>;
     /** Host-key enrollment ladder (REL-1971). Dry run unless input.apply. */
     hostKeyEnroll?(input: LabHostKeyEnrollInput, caller?: LabExecCaller): Promise<LabExecOutcome>;
+    /** Lab host CA certificate (REL-1972). Dry run unless input.apply. */
+    hostCert?(input: LabHostCertInput, caller?: LabExecCaller): Promise<LabExecOutcome>;
+    /** Best-effort certificate re-issue after a claim renew (REL-1972): re-binds the stored entry, then certifies. */
+    hostCertAfterRenew?(assetId: string, caller?: LabExecCaller): Promise<LabExecOutcome>;
     /** Read-only claim discovery (REL-1961). Returns the exact tool result the local handler produces. */
     claimsList?(input: unknown, caller?: LabExecCaller): Promise<CallToolResult>;
     claimsGet?(input: unknown, caller?: LabExecCaller): Promise<CallToolResult>;
@@ -39,6 +43,9 @@ export declare class LocalLabExecutor implements LabExecutor {
     claimsDelete(input: unknown): Promise<CallToolResult>;
     claimsPause(input: unknown): Promise<CallToolResult>;
     hostKeyEnroll(input: LabHostKeyEnrollInput): Promise<LabExecOutcome>;
+    hostCert(input: LabHostCertInput): Promise<LabExecOutcome>;
+    hostCertAfterRenew(assetId: string): Promise<LabExecOutcome>;
+    private outcome;
     ssh(input: LabSshInput): Promise<LabExecOutcome>;
 }
 //# sourceMappingURL=executor.d.ts.map

package/dist/src/lab-exec/executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAStD,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,WAAW,EACjB,MAAM,eAAe,CAAC;AAEvB,0FAA0F;AAC1F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAC;IACtC,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACzE,yEAAyE;IACzE,aAAa,CAAC,CAAC,KAAK,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9F,sGAAsG;IACtG,UAAU,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7E,SAAS,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5E,2FAA2F;IAC3F,YAAY,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/E,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9E,YAAY,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/E,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC/E;AAKD,qBAAa,gBAAiB,YAAW,WAAW;IAGtC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,QAAQ,CAAC,QAAQ,EAAG,OAAO,CAAU;gBAER,MAAM,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;KAAE;IAEjH,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAInD,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAIlD,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAIrD,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAIpD,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAIrD,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAI9C,aAAa,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,cAAc,CAAC;IAWpE,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;CAUvD"}
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAStD,OAAO,EAQL,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,WAAW,EACjB,MAAM,eAAe,CAAC;AAEvB,0FAA0F;AAC1F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAC;IACtC,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACzE,yEAAyE;IACzE,aAAa,CAAC,CAAC,KAAK,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9F,sEAAsE;IACtE,QAAQ,CAAC,CAAC,KAAK,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACpF,kHAAkH;IAClH,kBAAkB,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACtF,sGAAsG;IACtG,UAAU,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7E,SAAS,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5E,2FAA2F;IAC3F,YAAY,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/E,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9E,YAAY,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/E,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC/E;AAKD,qBAAa,gBAAiB,YAAW,WAAW;IAGtC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,QAAQ,CAAC,QAAQ,EAAG,OAAO,CAAU;gBAER,MAAM,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;KAAE;IAEjH,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAInD,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAIlD,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAIrD,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAIpD,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAIrD,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAI9C,aAAa,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,cAAc,CAAC;IAWpE,QAAQ,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC;IAK1D,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAIlE,OAAO,CAAC,OAAO;IAST,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;CAUvD"}

package/dist/src/lab-exec/executor.js

@@ -1,5 +1,5 @@
 import { handleCreateApplianceClaim, handleDeleteApplianceClaim, handleGetApplianceClaim, handleListApplianceClaims, handlePauseApplianceClaim, handleRenewApplianceClaim, } from "../tools/appliance-claim-tools.js";
-import { LAB_HOST_KEY_ENROLL_TIMEOUT_MS, labHostKeyEnrollArgv, labSshArgv, } from "./contract.js";
+import { LAB_HOST_CERT_RENEW_TIMEOUT_MS, LAB_HOST_CERT_TIMEOUT_MS, LAB_HOST_KEY_ENROLL_TIMEOUT_MS, labHostCertAfterRenewArgv, labHostCertArgv, labHostKeyEnrollArgv, labSshArgv, } from "./contract.js";
 /** Bridge headroom beyond the CLI's own --timeout-seconds for resolution and cleanup. */
 const RESOLUTION_GRACE_MS = 30_000;
 export class LocalLabExecutor {
@@ -37,6 +37,22 @@ export class LocalLabExecutor {
             ...(result.timedOut ? { timedOut: true } : {}),
         };
     }
+    async hostCert(input) {
+        if (!input.assetId)
+            throw new Error("LocalLabExecutor requires a resolved assetId; wrap it in ClaimResolvingExecutor to accept claimId");
+        return this.outcome(await this.bridge.run(labHostCertArgv(input), LAB_HOST_CERT_TIMEOUT_MS));
+    }
+    async hostCertAfterRenew(assetId) {
+        return this.outcome(await this.bridge.run(labHostCertAfterRenewArgv(assetId), LAB_HOST_CERT_RENEW_TIMEOUT_MS));
+    }
+    outcome(result) {
+        return {
+            exitCode: result.exitCode,
+            stdout: result.stdout,
+            stderr: result.stderr,
+            ...(result.timedOut ? { timedOut: true } : {}),
+        };
+    }
     async ssh(input) {
         if (!input.assetId)
             throw new Error("LocalLabExecutor requires a resolved assetId; wrap it in ClaimResolvingExecutor to accept claimId");

package/dist/src/lab-exec/executor.js.map

@@ -1 +1 @@
-{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../src/lab-exec/executor.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,UAAU,GAGX,MAAM,eAAe,CAAC;AA8BvB,yFAAyF;AACzF,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,MAAM,OAAO,gBAAgB;IAGE;IAFpB,QAAQ,GAAG,OAAgB,CAAC;IAErC,YAA6B,MAAoF;QAApF,WAAM,GAAN,MAAM,CAA8E;IAAG,CAAC;IAErH,UAAU,CAAC,KAAc;QACvB,OAAO,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,SAAS,CAAC,KAAc;QACtB,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,YAAY,CAAC,KAAc;QACzB,OAAO,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,WAAW,CAAC,KAAc;QACxB,OAAO,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,YAAY,CAAC,KAAc;QACzB,OAAO,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,WAAW,CAAC,KAAc;QACxB,OAAO,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAA4B;QAC9C,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACzI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,8BAA8B,CAAC,CAAC;QAClG,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAkB;QAC1B,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACzI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,cAAc,GAAG,IAAI,GAAG,mBAAmB,CAAC,CAAC;QAC3G,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../src/lab-exec/executor.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,8BAA8B,EAC9B,yBAAyB,EACzB,eAAe,EACf,oBAAoB,EACpB,UAAU,GAIX,MAAM,eAAe,CAAC;AAkCvB,yFAAyF;AACzF,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,MAAM,OAAO,gBAAgB;IAGE;IAFpB,QAAQ,GAAG,OAAgB,CAAC;IAErC,YAA6B,MAAoF;QAApF,WAAM,GAAN,MAAM,CAA8E;IAAG,CAAC;IAErH,UAAU,CAAC,KAAc;QACvB,OAAO,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,SAAS,CAAC,KAAc;QACtB,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,YAAY,CAAC,KAAc;QACzB,OAAO,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,WAAW,CAAC,KAAc;QACxB,OAAO,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,YAAY,CAAC,KAAc;QACzB,OAAO,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,WAAW,CAAC,KAAc;QACxB,OAAO,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAA4B;QAC9C,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACzI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,8BAA8B,CAAC,CAAC;QAClG,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAuB;QACpC,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACzI,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC/F,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAe;QACtC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,OAAO,CAAC,EAAE,8BAA8B,CAAC,CAAC,CAAC;IACjH,CAAC;IAEO,OAAO,CAAC,MAA8B;QAC5C,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAkB;QAC1B,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACzI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,cAAc,GAAG,IAAI,GAAG,mBAAmB,CAAC,CAAC;QAC3G,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;IACJ,CAAC;CACF"}

package/dist/src/lab-exec/remote.d.ts

@@ -1,10 +1,12 @@
 /** Worker-side client for the lab executor behind Cloudflare Tunnel + Access (ADR 0934). */
 import type { CallToolResult } from "../types/mcp.js";
-import { type LabHostKeyEnrollInput, type LabSshInput } from "./contract.js";
+import { type LabHostCertInput, type LabHostKeyEnrollInput, type LabSshInput } from "./contract.js";
 import type { LabExecCaller, LabExecOutcome, LabExecutor } from "./executor.js";
 export declare const LAB_EXEC_PATH = "/v1/lab-exec/ssh";
 /** Host-key enrollment route (REL-1971). The zone WAF skip rule allows exactly this path. */
 export declare const LAB_EXEC_HOST_KEY_ENROLL_PATH = "/v1/lab-exec/host-key-enroll";
+/** Lab host CA certificate route (REL-1972). The zone WAF skip rule allows exactly this path. */
+export declare const LAB_EXEC_HOST_CERT_PATH = "/v1/lab-exec/host-cert";
 /** Read-only claim discovery routes (REL-1961). The zone WAF skip rule allows exactly these paths. */
 export declare const LAB_EXEC_CLAIMS_LIST_PATH = "/v1/lab-exec/claims/list";
 export declare const LAB_EXEC_CLAIMS_GET_PATH = "/v1/lab-exec/claims/get";
@@ -27,6 +29,7 @@ export declare class RemoteLabExecutor implements LabExecutor {
     constructor(options: RemoteLabExecutorOptions);
     ssh(input: LabSshInput, caller?: LabExecCaller): Promise<LabExecOutcome>;
     hostKeyEnroll(input: LabHostKeyEnrollInput, caller?: LabExecCaller): Promise<LabExecOutcome>;
+    hostCert(input: LabHostCertInput, caller?: LabExecCaller): Promise<LabExecOutcome>;
     claimsList(input: unknown, caller?: LabExecCaller): Promise<CallToolResult>;
     claimsGet(input: unknown, caller?: LabExecCaller): Promise<CallToolResult>;
     claimsCreate(input: unknown, caller?: LabExecCaller): Promise<CallToolResult>;

package/dist/src/lab-exec/remote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/remote.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAkC,KAAK,qBAAqB,EAAE,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAC7G,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEhF,eAAO,MAAM,aAAa,qBAAqB,CAAC;AAChD,6FAA6F;AAC7F,eAAO,MAAM,6BAA6B,iCAAiC,CAAC;AAC5E,sGAAsG;AACtG,eAAO,MAAM,yBAAyB,6BAA6B,CAAC;AACpE,eAAO,MAAM,wBAAwB,4BAA4B,CAAC;AAClE,2FAA2F;AAC3F,eAAO,MAAM,2BAA2B,+BAA+B,CAAC;AACxE,eAAO,MAAM,0BAA0B,8BAA8B,CAAC;AACtE,eAAO,MAAM,2BAA2B,+BAA+B,CAAC;AACxE,eAAO,MAAM,0BAA0B,8BAA8B,CAAC;AAGtE,+FAA+F;AAC/F,eAAO,MAAM,sBAAsB,oBAAoB,CAAC;AAGxD,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,qBAAa,iBAAkB,YAAW,WAAW;IAGvC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,QAAQ,CAAC,QAAQ,EAAG,QAAQ,CAAU;gBAET,OAAO,EAAE,wBAAwB;IAIxD,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAyBxE,aAAa,CAAC,KAAK,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAyBlG,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAI3E,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAI1E,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAI7E,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAI5E,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAI7E,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;YAI9D,MAAM;CAmBrB"}
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/remote.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAA4D,KAAK,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAC9J,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEhF,eAAO,MAAM,aAAa,qBAAqB,CAAC;AAChD,6FAA6F;AAC7F,eAAO,MAAM,6BAA6B,iCAAiC,CAAC;AAC5E,iGAAiG;AACjG,eAAO,MAAM,uBAAuB,2BAA2B,CAAC;AAChE,sGAAsG;AACtG,eAAO,MAAM,yBAAyB,6BAA6B,CAAC;AACpE,eAAO,MAAM,wBAAwB,4BAA4B,CAAC;AAClE,2FAA2F;AAC3F,eAAO,MAAM,2BAA2B,+BAA+B,CAAC;AACxE,eAAO,MAAM,0BAA0B,8BAA8B,CAAC;AACtE,eAAO,MAAM,2BAA2B,+BAA+B,CAAC;AACxE,eAAO,MAAM,0BAA0B,8BAA8B,CAAC;AAKtE,+FAA+F;AAC/F,eAAO,MAAM,sBAAsB,oBAAoB,CAAC;AAGxD,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,qBAAa,iBAAkB,YAAW,WAAW;IAGvC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,QAAQ,CAAC,QAAQ,EAAG,QAAQ,CAAU;gBAET,OAAO,EAAE,wBAAwB;IAIxD,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAyBxE,aAAa,CAAC,KAAK,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAyB5F,QAAQ,CAAC,KAAK,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAyBxF,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAI3E,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAI1E,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAI7E,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAI5E,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAI7E,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;YAI9D,MAAM;CAmBrB"}

package/dist/src/lab-exec/remote.js

@@ -1,7 +1,9 @@
-import { LAB_HOST_KEY_ENROLL_TIMEOUT_MS } from "./contract.js";
+import { LAB_HOST_CERT_TIMEOUT_MS, LAB_HOST_KEY_ENROLL_TIMEOUT_MS } from "./contract.js";
 export const LAB_EXEC_PATH = "/v1/lab-exec/ssh";
 /** Host-key enrollment route (REL-1971). The zone WAF skip rule allows exactly this path. */
 export const LAB_EXEC_HOST_KEY_ENROLL_PATH = "/v1/lab-exec/host-key-enroll";
+/** Lab host CA certificate route (REL-1972). The zone WAF skip rule allows exactly this path. */
+export const LAB_EXEC_HOST_CERT_PATH = "/v1/lab-exec/host-cert";
 /** Read-only claim discovery routes (REL-1961). The zone WAF skip rule allows exactly these paths. */
 export const LAB_EXEC_CLAIMS_LIST_PATH = "/v1/lab-exec/claims/list";
 export const LAB_EXEC_CLAIMS_GET_PATH = "/v1/lab-exec/claims/get";
@@ -12,6 +14,8 @@ export const LAB_EXEC_CLAIMS_DELETE_PATH = "/v1/lab-exec/claims/delete";
 export const LAB_EXEC_CLAIMS_PAUSE_PATH = "/v1/lab-exec/claims/pause";
 const CLAIMS_TIMEOUT_MS = 30_000;
 const CLAIMS_MUTATION_TIMEOUT_MS = 60_000;
+/** Renew also re-issues the host certificate (REL-1972), which the executor bounds at 90 s. */
+const CLAIMS_RENEW_TIMEOUT_MS = 150_000;
 /** Audit-only; the executor trusts it because only the Worker's service token can reach it. */
 export const LAB_EXEC_CALLER_HEADER = "X-CT-Lab-Caller";
 const TRANSPORT_GRACE_MS = 45_000;
@@ -73,6 +77,31 @@ export class RemoteLabExecutor {
             ...(body.timedOut ? { timedOut: true } : {}),
         };
     }
+    async hostCert(input, caller) {
+        const headers = {
+            "content-type": "application/json",
+            "CF-Access-Client-Id": this.options.clientId,
+            "CF-Access-Client-Secret": this.options.clientSecret,
+        };
+        if (caller?.identity)
+            headers[LAB_EXEC_CALLER_HEADER] = caller.identity;
+        const response = await (this.options.fetchImpl ?? fetch)(new URL(LAB_EXEC_HOST_CERT_PATH, this.options.url), {
+            method: "POST",
+            headers,
+            body: JSON.stringify(input),
+            signal: AbortSignal.timeout(LAB_HOST_CERT_TIMEOUT_MS + TRANSPORT_GRACE_MS),
+        });
+        const body = (await response.json().catch(() => undefined));
+        if (!response.ok || !body || typeof body.exitCode !== "number") {
+            throw new Error(`lab executor HTTP ${response.status}`);
+        }
+        return {
+            exitCode: body.exitCode,
+            stdout: String(body.stdout ?? ""),
+            stderr: String(body.stderr ?? ""),
+            ...(body.timedOut ? { timedOut: true } : {}),
+        };
+    }
     claimsList(input, caller) {
         return this.claims(LAB_EXEC_CLAIMS_LIST_PATH, input, caller);
     }
@@ -83,7 +112,7 @@ export class RemoteLabExecutor {
         return this.claims(LAB_EXEC_CLAIMS_CREATE_PATH, input, caller, CLAIMS_MUTATION_TIMEOUT_MS);
     }
     claimsRenew(input, caller) {
-        return this.claims(LAB_EXEC_CLAIMS_RENEW_PATH, input, caller, CLAIMS_MUTATION_TIMEOUT_MS);
+        return this.claims(LAB_EXEC_CLAIMS_RENEW_PATH, input, caller, CLAIMS_RENEW_TIMEOUT_MS);
     }
     claimsDelete(input, caller) {
         return this.claims(LAB_EXEC_CLAIMS_DELETE_PATH, input, caller, CLAIMS_MUTATION_TIMEOUT_MS);

package/dist/src/lab-exec/remote.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../../src/lab-exec/remote.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,8BAA8B,EAAgD,MAAM,eAAe,CAAC;AAG7G,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAChD,6FAA6F;AAC7F,MAAM,CAAC,MAAM,6BAA6B,GAAG,8BAA8B,CAAC;AAC5E,sGAAsG;AACtG,MAAM,CAAC,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AACpE,MAAM,CAAC,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAClE,2FAA2F;AAC3F,MAAM,CAAC,MAAM,2BAA2B,GAAG,4BAA4B,CAAC;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;AACtE,MAAM,CAAC,MAAM,2BAA2B,GAAG,4BAA4B,CAAC;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;AACtE,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,+FAA+F;AAC/F,MAAM,CAAC,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AACxD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AASlC,MAAM,OAAO,iBAAiB;IAGC;IAFpB,QAAQ,GAAG,QAAiB,CAAC;IAEtC,YAA6B,OAAiC;QAAjC,YAAO,GAAP,OAAO,CAA0B;QAC5D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACpG,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAkB,EAAE,MAAsB;QAClD,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC5C,yBAAyB,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;SACrD,CAAC;QACF,IAAI,MAAM,EAAE,QAAQ;YAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;YACjG,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,GAAG,IAAI,GAAG,kBAAkB,CAAC;SAC9E,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAwC,CAAC;QACnG,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAA4B,EAAE,MAAsB;QACtE,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC5C,yBAAyB,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;SACrD,CAAC;QACF,IAAI,MAAM,EAAE,QAAQ;YAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,6BAA6B,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;YACjH,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,8BAA8B,GAAG,kBAAkB,CAAC;SACjF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAwC,CAAC;QACnG,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC;IACJ,CAAC;IAED,UAAU,CAAC,KAAc,EAAE,MAAsB;QAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,SAAS,CAAC,KAAc,EAAE,MAAsB;QAC9C,OAAO,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IAED,YAAY,CAAC,KAAc,EAAE,MAAsB;QACjD,OAAO,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAC7F,CAAC;IAED,WAAW,CAAC,KAAc,EAAE,MAAsB;QAChD,OAAO,IAAI,CAAC,MAAM,CAAC,0BAA0B,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAC5F,CAAC;IAED,YAAY,CAAC,KAAc,EAAE,MAAsB;QACjD,OAAO,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAC7F,CAAC;IAED,WAAW,CAAC,KAAc,EAAE,MAAsB;QAChD,OAAO,IAAI,CAAC,MAAM,CAAC,0BAA0B,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAC5F,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,KAAc,EAAE,MAAsB,EAAE,SAAS,GAAG,iBAAiB;QACtG,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC5C,yBAAyB,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;SACrD,CAAC;QACF,IAAI,MAAM,EAAE,QAAQ;YAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;YACxF,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAA+B,CAAC;QAC1F,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../../src/lab-exec/remote.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAuE,MAAM,eAAe,CAAC;AAG9J,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAChD,6FAA6F;AAC7F,MAAM,CAAC,MAAM,6BAA6B,GAAG,8BAA8B,CAAC;AAC5E,iGAAiG;AACjG,MAAM,CAAC,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AAChE,sGAAsG;AACtG,MAAM,CAAC,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AACpE,MAAM,CAAC,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAClE,2FAA2F;AAC3F,MAAM,CAAC,MAAM,2BAA2B,GAAG,4BAA4B,CAAC;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;AACtE,MAAM,CAAC,MAAM,2BAA2B,GAAG,4BAA4B,CAAC;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;AACtE,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,+FAA+F;AAC/F,MAAM,uBAAuB,GAAG,OAAO,CAAC;AACxC,+FAA+F;AAC/F,MAAM,CAAC,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AACxD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AASlC,MAAM,OAAO,iBAAiB;IAGC;IAFpB,QAAQ,GAAG,QAAiB,CAAC;IAEtC,YAA6B,OAAiC;QAAjC,YAAO,GAAP,OAAO,CAA0B;QAC5D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACpG,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAkB,EAAE,MAAsB;QAClD,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC5C,yBAAyB,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;SACrD,CAAC;QACF,IAAI,MAAM,EAAE,QAAQ;YAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;YACjG,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,GAAG,IAAI,GAAG,kBAAkB,CAAC;SAC9E,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAwC,CAAC;QACnG,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAA4B,EAAE,MAAsB;QACtE,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC5C,yBAAyB,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;SACrD,CAAC;QACF,IAAI,MAAM,EAAE,QAAQ;YAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,6BAA6B,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;YACjH,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,8BAA8B,GAAG,kBAAkB,CAAC;SACjF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAwC,CAAC;QACnG,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAuB,EAAE,MAAsB;QAC5D,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC5C,yBAAyB,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;SACrD,CAAC;QACF,IAAI,MAAM,EAAE,QAAQ;YAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;YAC3G,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,wBAAwB,GAAG,kBAAkB,CAAC;SAC3E,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAwC,CAAC;QACnG,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC;IACJ,CAAC;IAED,UAAU,CAAC,KAAc,EAAE,MAAsB;QAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,SAAS,CAAC,KAAc,EAAE,MAAsB;QAC9C,OAAO,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IAED,YAAY,CAAC,KAAc,EAAE,MAAsB;QACjD,OAAO,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAC7F,CAAC;IAED,WAAW,CAAC,KAAc,EAAE,MAAsB;QAChD,OAAO,IAAI,CAAC,MAAM,CAAC,0BAA0B,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACzF,CAAC;IAED,YAAY,CAAC,KAAc,EAAE,MAAsB;QACjD,OAAO,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAC7F,CAAC;IAED,WAAW,CAAC,KAAc,EAAE,MAAsB;QAChD,OAAO,IAAI,CAAC,MAAM,CAAC,0BAA0B,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAC5F,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,KAAc,EAAE,MAAsB,EAAE,SAAS,GAAG,iBAAiB;QACtG,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC5C,yBAAyB,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;SACrD,CAAC;QACF,IAAI,MAAM,EAAE,QAAQ;YAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;YACxF,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAA+B,CAAC;QAC1F,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/src/lab-exec/result.d.ts

@@ -13,5 +13,18 @@ interface HostKeyEnrollReceipt {
 /** Parse the CLI receipt. It is printed for every status, including refused and blocked (exit 1). */
 export declare function parseHostKeyEnrollReceipt(stdout: string): HostKeyEnrollReceipt | undefined;
 export declare function hostKeyEnrollToolResult(outcome: LabExecOutcome, id: string | undefined): CallToolResult;
+export declare const HOST_CERT_RESULT_SCHEMA = "calltelemetry-lab-host-cert/v1";
+interface HostCertReceipt {
+    schema: string;
+    asset_id?: string;
+    status: string;
+    reason?: string | null;
+    [key: string]: unknown;
+}
+/** Parse the CLI receipt. It is printed for every status, including refused and blocked (exit 1). */
+export declare function parseHostCertReceipt(stdout: string): HostCertReceipt | undefined;
+export declare function hostCertToolResult(outcome: LabExecOutcome, id: string | undefined): CallToolResult;
+/** Fixed-field summary of a host-cert receipt for the claim-renew answer and audit line. No keys, no CA line. */
+export declare function hostCertRenewSummary(outcome: LabExecOutcome): Record<string, unknown>;
 export {};
 //# sourceMappingURL=result.d.ts.map

package/dist/src/lab-exec/result.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/result.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAyB,MAAM,iBAAiB,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAyB9D,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,CA+BrG;AAED,eAAO,MAAM,6BAA6B,yCAAyC,CAAC;AAEpF,UAAU,oBAAoB;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,qGAAqG;AACrG,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAO1F;AAID,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,CAiBvG"}
+{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../../../src/lab-exec/result.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAyB,MAAM,iBAAiB,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAyB9D,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,CA+BrG;AAED,eAAO,MAAM,6BAA6B,yCAAyC,CAAC;AAEpF,UAAU,oBAAoB;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,qGAAqG;AACrG,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAO1F;AAID,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,CAiBvG;AAED,eAAO,MAAM,uBAAuB,mCAAmC,CAAC;AAExE,UAAU,eAAe;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,qGAAqG;AACrG,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAOhF;AAID,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,CAiBlG;AAED,iHAAiH;AACjH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAarF"}

package/dist/src/lab-exec/result.js

@@ -63,4 +63,47 @@ export function hostKeyEnrollToolResult(outcome, id) {
         ...(failed ? { isError: true } : {}),
     };
 }
+export const HOST_CERT_RESULT_SCHEMA = "calltelemetry-lab-host-cert/v1";
+/** Parse the CLI receipt. It is printed for every status, including refused and blocked (exit 1). */
+export function parseHostCertReceipt(stdout) {
+    try {
+        const value = JSON.parse(stdout);
+        return value && value.schema === HOST_CERT_RESULT_SCHEMA && typeof value.status === "string" ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+const HOST_CERT_OK = new Set(["planned", "already-current", "issued"]);
+export function hostCertToolResult(outcome, id) {
+    const receipt = outcome.timedOut ? undefined : parseHostCertReceipt(outcome.stdout);
+    if (!receipt) {
+        return createToolErrorResult("LAB_HOST_CERT_UNAVAILABLE", outcome.stderr
+            || (outcome.timedOut ? "lab_host_cert timed out before the canonical lab CLI answered; the outcome is unconfirmed, so dry-run again before retrying" : "canonical lab CLI returned no host-cert receipt"), { operation: "lab_host_cert", ...(id ? { assetId: id } : {}), exitCode: outcome.exitCode, ...(outcome.timedOut ? { timedOut: true } : {}) });
+    }
+    const failed = !HOST_CERT_OK.has(receipt.status);
+    const summary = `${receipt.status}${receipt.reason ? ` (${receipt.reason})` : ""}`;
+    return {
+        content: [{ type: "text", text: `${summary}\n${JSON.stringify(receipt, null, 2)}` }],
+        structuredContent: receipt,
+        ...(failed ? { isError: true } : {}),
+    };
+}
+/** Fixed-field summary of a host-cert receipt for the claim-renew answer and audit line. No keys, no CA line. */
+export function hostCertRenewSummary(outcome) {
+    if (outcome.timedOut)
+        return { status: "timeout", reason: "host_cert_timed_out" };
+    const receipt = parseHostCertReceipt(outcome.stdout);
+    if (!receipt)
+        return { status: "error", reason: "host_cert_unavailable" };
+    const installed = receipt.installed_certificate;
+    const binding = receipt.claim_binding;
+    return {
+        status: receipt.status.slice(0, 64),
+        ...(typeof receipt.reason === "string" ? { reason: receipt.reason.slice(0, 64) } : {}),
+        ...(typeof receipt.valid_until === "string" ? { validUntil: receipt.valid_until } : {}),
+        ...(typeof installed?.valid_to === "string" ? { installedValidTo: installed.valid_to } : {}),
+        ...(binding && typeof binding.expires_at === "string" ? { claimBindingExpiresAt: binding.expires_at, claimBindingRebound: binding.rebound === true } : {}),
+    };
+}
 //# sourceMappingURL=result.js.map