@straiffi/archon 1.8.20 → 1.8.22

package/dist/server/lib/dockerSandboxNetworkPolicy.js

@@ -0,0 +1,222 @@
+import { SbxContractFailure, asRecord, parseJsonObject, requireSuccessfulCommand, } from './dockerSandboxExecutionEnvironment.js';
+const POLICY_LS_COMMAND = 'policy ls';
+const POLICY_ALLOW_COMMAND = 'policy allow';
+const POLICY_CHECK_COMMAND = 'policy check';
+const POLICY_RM_COMMAND = 'policy rm';
+const SANDBOX_SCOPE_PREFIX = 'sandbox:';
+const assertBoundedArgument = (name, value) => {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+        throw new Error(`${name} must be a non-empty string`);
+    }
+};
+const dedupe = (values) => [...new Set(values)];
+const scopedNetworkRulesForSandbox = (rules, sandboxName) => rules.filter(rule => rule.scope === `${SANDBOX_SCOPE_PREFIX}${sandboxName}` && rule.resourceType === 'network');
+export const parseScopedSbxPolicyLsOutput = (output) => {
+    const record = parseJsonObject(POLICY_LS_COMMAND, output);
+    if (!Array.isArray(record.rules)) {
+        throw new SbxContractFailure(POLICY_LS_COMMAND, 'sbx policy ls returned an unsupported schema');
+    }
+    return record.rules.map((value, index) => {
+        const rule = asRecord(value);
+        const requiredStringFields = ['id', 'scope', 'resource_type', 'decision', 'status'];
+        const hasRequiredStrings = rule !== null && requiredStringFields.every(field => (typeof rule[field] === 'string' && rule[field].length > 0));
+        const resources = rule?.resources;
+        const hasValidResources = Array.isArray(resources)
+            && resources.every(resource => typeof resource === 'string' && resource.length > 0);
+        if (!hasRequiredStrings || !hasValidResources) {
+            throw new SbxContractFailure(POLICY_LS_COMMAND, `sbx policy ls rule ${index} was unrecognized`);
+        }
+        return {
+            id: rule.id,
+            scope: rule.scope,
+            resourceType: rule.resource_type,
+            decision: rule.decision,
+            resources: [...resources],
+            status: rule.status,
+        };
+    });
+};
+export const parseSbxPolicyCheckOutput = (output, target, sandboxName) => {
+    const record = parseJsonObject(POLICY_CHECK_COMMAND, output);
+    const normalizedTarget = /:\d+$/.test(target) ? target : `${target}:443`;
+    if (record.action !== 'net:connect:tcp'
+        ||
+            record.context !== `${SANDBOX_SCOPE_PREFIX}${sandboxName}`
+        || record.type !== 'network'
+        || record.resource_type !== 'net:domain'
+        || record.target !== normalizedTarget
+        || record.resource_value !== normalizedTarget) {
+        throw new SbxContractFailure(POLICY_CHECK_COMMAND, 'sbx policy check returned a response that does not match the requested destination context');
+    }
+    const governance = asRecord(record.governance);
+    if (governance?.active !== true) {
+        throw new SbxContractFailure(POLICY_CHECK_COMMAND, 'sbx policy check did not report active network governance');
+    }
+    if (typeof record.allowed !== 'boolean') {
+        throw new SbxContractFailure(POLICY_CHECK_COMMAND, 'sbx policy check returned an unsupported schema');
+    }
+    return {
+        target,
+        decision: record.allowed ? 'allow' : 'deny',
+        rawDecision: null,
+        evaluatedRuleId: null,
+    };
+};
+export const parseSbxPolicyAllowOutput = (output, sandboxName, requestedResources) => {
+    const trimmed = output.trim();
+    if (trimmed.length === 0) {
+        throw new SbxContractFailure(POLICY_ALLOW_COMMAND, 'sbx policy allow returned no created rule identifiers');
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(trimmed);
+    }
+    catch (error) {
+        throw new SbxContractFailure(POLICY_ALLOW_COMMAND, 'sbx policy allow returned invalid JSON', { cause: error });
+    }
+    const values = Array.isArray(parsed) ? parsed : [parsed];
+    const requested = new Set(requestedResources);
+    const returnedResources = new Set();
+    const ids = [];
+    for (const value of values) {
+        const rule = asRecord(value);
+        const resources = rule?.resources;
+        if (!rule
+            || typeof rule.id !== 'string'
+            || rule.id.length === 0
+            || rule.scope !== `${SANDBOX_SCOPE_PREFIX}${sandboxName}`
+            || rule.resource_type !== 'network'
+            || rule.decision !== 'allow'
+            || rule.status !== 'active'
+            || !Array.isArray(resources)
+            || resources.length === 0
+            || !resources.every(resource => typeof resource === 'string' && requested.has(resource))) {
+            throw new SbxContractFailure(POLICY_ALLOW_COMMAND, 'sbx policy allow returned an unqualified scoped rule');
+        }
+        ids.push(rule.id);
+        resources.forEach(resource => returnedResources.add(resource));
+    }
+    if (returnedResources.size !== requested.size || [...requested].some(resource => !returnedResources.has(resource))) {
+        throw new SbxContractFailure(POLICY_ALLOW_COMMAND, 'sbx policy allow did not create the exact requested resources');
+    }
+    return ids;
+};
+export const assertExactSandboxNetworkAllowlist = (rules, requestedResources) => {
+    const requested = new Set(requestedResources);
+    const activeAllows = rules.filter(rule => rule.status === 'active' && rule.decision === 'allow');
+    const effectiveResources = new Set(activeAllows.flatMap(rule => rule.resources));
+    const broaderResources = [...effectiveResources].filter(resource => !requested.has(resource));
+    const missingResources = [...requested].filter(resource => !effectiveResources.has(resource));
+    if (broaderResources.length > 0 || missingResources.length > 0) {
+        const details = [
+            broaderResources.length > 0 ? `broader active resources: ${broaderResources.join(', ')}` : null,
+            missingResources.length > 0 ? `missing resources: ${missingResources.join(', ')}` : null,
+        ].filter((detail) => detail !== null);
+        throw new SbxContractFailure(POLICY_LS_COMMAND, `Sandbox network rules do not exactly match the requested allowlist (${details.join('; ')})`);
+    }
+};
+export const inspectSandboxNetworkRules = async (runner, sandboxName, options = {}) => {
+    assertBoundedArgument('Docker Sandbox name', sandboxName);
+    const result = await runner.run(['policy', 'ls', sandboxName, '--json', '--wide'], options);
+    requireSuccessfulCommand(POLICY_LS_COMMAND, result);
+    return scopedNetworkRulesForSandbox(parseScopedSbxPolicyLsOutput(result.stdout), sandboxName);
+};
+const sandboxApplicationLocks = new Map();
+const withSandboxApplicationLock = async (sandboxName, operation) => {
+    const previous = sandboxApplicationLocks.get(sandboxName) ?? Promise.resolve();
+    const gate = previous.then(() => undefined, () => undefined);
+    let release;
+    const current = new Promise(resolve => {
+        release = resolve;
+    });
+    sandboxApplicationLocks.set(sandboxName, current);
+    await gate;
+    try {
+        return await operation();
+    }
+    finally {
+        release();
+        if (sandboxApplicationLocks.get(sandboxName) === current) {
+            sandboxApplicationLocks.delete(sandboxName);
+        }
+    }
+};
+export const applyScopedNetworkRules = (runner, sandboxName, resources, options = {}) => withSandboxApplicationLock(sandboxName, async () => {
+    assertBoundedArgument('Docker Sandbox name', sandboxName);
+    const requested = dedupe(resources);
+    requested.forEach(resource => assertBoundedArgument('Network resource', resource));
+    if (requested.length === 0) {
+        return [];
+    }
+    const existing = await inspectSandboxNetworkRules(runner, sandboxName, options);
+    const covered = new Set(existing
+        .filter(rule => rule.status === 'active' && rule.decision === 'allow')
+        .flatMap(rule => rule.resources));
+    const missing = requested.filter(resource => !covered.has(resource));
+    if (missing.length === 0) {
+        return [];
+    }
+    const result = await runner.run(['policy', 'allow', 'network', '--sandbox', sandboxName, missing.join(',')], options);
+    requireSuccessfulCommand(POLICY_ALLOW_COMMAND, result);
+    return parseSbxPolicyAllowOutput(result.stdout, sandboxName, missing);
+});
+export const checkDestinationAccess = async (runner, sandboxName, target, options = {}) => {
+    assertBoundedArgument('Docker Sandbox name', sandboxName);
+    assertBoundedArgument('Network destination target', target);
+    const result = await runner.run(['policy', 'check', 'network', '--sandbox', sandboxName, target, '--json'], options);
+    requireSuccessfulCommand(POLICY_CHECK_COMMAND, result);
+    return parseSbxPolicyCheckOutput(result.stdout, target, sandboxName);
+};
+export const inspectGlobalNetworkPosture = async (runner, options = {}) => {
+    const result = await runner.run(['policy', 'ls', '--json', '--wide'], options);
+    requireSuccessfulCommand(POLICY_LS_COMMAND, result);
+    return classifyGlobalNetworkPosture(parseScopedSbxPolicyLsOutput(result.stdout));
+};
+const CATCH_ALL_RESOURCES = new Set(['**', '*', '*:*', 'any']);
+const isCatchAllRule = (rule) => (rule.resources.length === 0
+    || rule.resources.some(resource => CATCH_ALL_RESOURCES.has(resource.trim().toLowerCase())));
+export const classifyGlobalNetworkPosture = (rules) => {
+    const activeGlobalNetworkRules = rules.filter(rule => (rule.scope === 'global' && rule.resourceType === 'network' && rule.status === 'active'));
+    if (activeGlobalNetworkRules.length === 0) {
+        return 'none_initialized';
+    }
+    const catchAllRules = activeGlobalNetworkRules.filter(isCatchAllRule);
+    if (catchAllRules.length === 0) {
+        return 'mixed';
+    }
+    const decisions = new Set(catchAllRules.map(rule => rule.decision));
+    if (decisions.size > 1) {
+        return 'unknown';
+    }
+    const decision = [...decisions][0];
+    const hasResourceSpecificAllowException = activeGlobalNetworkRules.some(rule => (!isCatchAllRule(rule) && rule.decision === 'allow'));
+    if (decision === 'deny' && hasResourceSpecificAllowException) {
+        return 'mixed';
+    }
+    if (decision === 'allow') {
+        return 'allow_all';
+    }
+    if (decision === 'deny') {
+        return 'deny_all';
+    }
+    return 'unknown';
+};
+export const removeScopedNetworkRules = async (runner, sandboxName, ruleIds, options = {}) => {
+    assertBoundedArgument('Docker Sandbox name', sandboxName);
+    const ids = dedupe(ruleIds);
+    ids.forEach(id => assertBoundedArgument('Network policy rule ID', id));
+    if (ids.length === 0) {
+        return;
+    }
+    const scoped = await inspectSandboxNetworkRules(runner, sandboxName, options);
+    const owned = new Set(scoped.map(rule => rule.id));
+    const foreign = ids.filter(id => !owned.has(id));
+    if (foreign.length > 0) {
+        throw new SbxContractFailure(POLICY_RM_COMMAND, `Refusing to remove network policy rules Archon did not create for sandbox ${sandboxName}`);
+    }
+    for (const id of ids) {
+        const result = await runner.run(['policy', 'rm', 'network', '--sandbox', sandboxName, '--id', id], options);
+        requireSuccessfulCommand(POLICY_RM_COMMAND, result);
+    }
+};
+//# sourceMappingURL=dockerSandboxNetworkPolicy.js.map

package/dist/server/lib/dockerSandboxNetworkPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dockerSandboxNetworkPolicy.js","sourceRoot":"","sources":["../../../server/lib/dockerSandboxNetworkPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,QAAQ,EACR,eAAe,EACf,wBAAwB,GAGzB,MAAM,wCAAwC,CAAA;AAuB/C,MAAM,iBAAiB,GAAG,WAAW,CAAA;AACrC,MAAM,oBAAoB,GAAG,cAAc,CAAA;AAC3C,MAAM,oBAAoB,GAAG,cAAc,CAAA;AAC3C,MAAM,iBAAiB,GAAG,WAAW,CAAA;AAErC,MAAM,oBAAoB,GAAG,UAAU,CAAA;AAEvC,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAA;IACvD,CAAC;AACH,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,MAAyB,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;AAElE,MAAM,4BAA4B,GAAG,CACnC,KAAsC,EACtC,WAAmB,EACnB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,GAAG,oBAAoB,GAAG,WAAW,EAAE,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAA;AAEpH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,MAAc,EAAmC,EAAE;IAC9F,MAAM,MAAM,GAAG,eAAe,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,8CAA8C,CAAC,CAAA;IACjG,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC5B,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,CAAU,CAAA;QAC5F,MAAM,kBAAkB,GAAG,IAAI,KAAK,IAAI,IAAI,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAC9E,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,IAAI,CAAC,KAAK,CAAY,CAAC,MAAM,GAAG,CAAC,CACtE,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,CAAA;QACjC,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;eAC7C,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACrF,IAAI,CAAC,kBAAkB,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC9C,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,sBAAsB,KAAK,mBAAmB,CAAC,CAAA;QACjG,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAY;YACrB,KAAK,EAAE,IAAI,CAAC,KAAe;YAC3B,YAAY,EAAE,IAAI,CAAC,aAAuB;YAC1C,QAAQ,EAAE,IAAI,CAAC,QAAkB;YACjC,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAgB;SAC9B,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,MAAc,EACd,MAAc,EACd,WAAmB,EACQ,EAAE;IAC7B,MAAM,MAAM,GAAG,eAAe,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAA;IAC5D,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,MAAM,CAAA;IACxE,IACE,MAAM,CAAC,MAAM,KAAK,iBAAiB;;YAEnC,MAAM,CAAC,OAAO,KAAK,GAAG,oBAAoB,GAAG,WAAW,EAAE;WACvD,MAAM,CAAC,IAAI,KAAK,SAAS;WACzB,MAAM,CAAC,aAAa,KAAK,YAAY;WACrC,MAAM,CAAC,MAAM,KAAK,gBAAgB;WAClC,MAAM,CAAC,cAAc,KAAK,gBAAgB,EAC7C,CAAC;QACD,MAAM,IAAI,kBAAkB,CAC1B,oBAAoB,EACpB,4FAA4F,CAC7F,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAA+B,CAAA;IAC5E,IAAI,UAAU,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,kBAAkB,CAC1B,oBAAoB,EACpB,2DAA2D,CAC5D,CAAA;IACH,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,iDAAiD,CAAC,CAAA;IACvG,CAAC;IACD,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QAC3C,WAAW,EAAE,IAAI;QACjB,eAAe,EAAE,IAAI;KACtB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,MAAc,EACd,WAAmB,EACnB,kBAAqC,EAClB,EAAE;IACrB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,uDAAuD,CAAC,CAAA;IAC7G,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,wCAAwC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAChH,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IACxD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC7C,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC3C,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC5B,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,CAAA;QACjC,IACE,CAAC,IAAI;eACF,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ;eAC3B,IAAI,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC;eACpB,IAAI,CAAC,KAAK,KAAK,GAAG,oBAAoB,GAAG,WAAW,EAAE;eACtD,IAAI,CAAC,aAAa,KAAK,SAAS;eAChC,IAAI,CAAC,QAAQ,KAAK,OAAO;eACzB,IAAI,CAAC,MAAM,KAAK,QAAQ;eACxB,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;eACzB,SAAS,CAAC,MAAM,KAAK,CAAC;eACtB,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EACxF,CAAC;YACD,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,sDAAsD,CAAC,CAAA;QAC5G,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACjB,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAkB,CAAC,CAAC,CAAA;IAC1E,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACnH,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,+DAA+D,CAAC,CAAA;IACrH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAChD,KAAsC,EACtC,kBAAqC,EACrC,EAAE;IACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAA;IAChG,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;IAChF,MAAM,gBAAgB,GAAG,CAAC,GAAG,kBAAkB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC7F,MAAM,gBAAgB,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC7F,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAG;YACd,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,6BAA6B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;YAC/F,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;SACzF,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAA;QACvD,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,uEAAuE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7F,CAAA;IACH,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,EAC7C,MAAwB,EACxB,WAAmB,EACnB,UAA6B,EAAE,EACW,EAAE;IAC5C,qBAAqB,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAA;IACzD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAA;IAC3F,wBAAwB,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;IACnD,OAAO,4BAA4B,CAAC,4BAA4B,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAA;AAC/F,CAAC,CAAA;AAED,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAyB,CAAA;AAEhE,MAAM,0BAA0B,GAAG,KAAK,EACtC,WAAmB,EACnB,SAA2B,EACf,EAAE;IACd,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAA;IAC9E,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAC5D,IAAI,OAAoB,CAAA;IACxB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;QAC1C,OAAO,GAAG,OAAO,CAAA;IACnB,CAAC,CAAC,CAAA;IACF,uBAAuB,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,IAAI,CAAA;IACV,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAA;IAC1B,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAA;QACT,IAAI,uBAAuB,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,OAAO,EAAE,CAAC;YACzD,uBAAuB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QAC7C,CAAC;IACH,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,MAAwB,EACxB,WAAmB,EACnB,SAA4B,EAC5B,UAA6B,EAAE,EACH,EAAE,CAAC,0BAA0B,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE;IAClF,qBAAqB,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAA;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,CAAA;IACnC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,qBAAqB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,CAAA;IAClF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;IAC/E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ;SAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC;SACrE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;IACnC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;IACpE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAC7B,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAC3E,OAAO,CACR,CAAA;IACD,wBAAwB,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAA;IACtD,OAAO,yBAAyB,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;AACvE,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EACzC,MAAwB,EACxB,WAAmB,EACnB,MAAc,EACd,UAA6B,EAAE,EACK,EAAE;IACtC,qBAAqB,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAA;IACzD,qBAAqB,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAA;IAC3D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAC7B,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAC1E,OAAO,CACR,CAAA;IACD,wBAAwB,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAA;IACtD,OAAO,yBAAyB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAA;AACtE,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,EAC9C,MAAwB,EACxB,UAA6B,EAAE,EACY,EAAE;IAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAA;IAC9E,wBAAwB,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;IACnD,OAAO,4BAA4B,CAAC,4BAA4B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;AAClF,CAAC,CAAA;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;AAE9D,MAAM,cAAc,GAAG,CAAC,IAA0B,EAAE,EAAE,CAAC,CACrD,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;OACxB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAC3F,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,KAAsC,EACJ,EAAE;IACpC,MAAM,wBAAwB,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CACpD,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CACvF,CAAC,CAAA;IACF,IAAI,wBAAwB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,kBAAkB,CAAA;IAC3B,CAAC;IACD,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;IACrE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;IACnE,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;IAClC,MAAM,iCAAiC,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAC9E,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CACnD,CAAC,CAAA;IACF,IAAI,QAAQ,KAAK,MAAM,IAAI,iCAAiC,EAAE,CAAC;QAC7D,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,WAAW,CAAA;IACpB,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAC3C,MAAwB,EACxB,WAAmB,EACnB,OAA0B,EAC1B,UAA6B,EAAE,EAChB,EAAE;IACjB,qBAAqB,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAA;IACzD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IAC3B,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,qBAAqB,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC,CAAA;IACtE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAM;IACR,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;IAClD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAChD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,6EAA6E,WAAW,EAAE,CAC3F,CAAA;IACH,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAA;QAC3G,wBAAwB,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;IACrD,CAAC;AACH,CAAC,CAAA"}

package/dist/server/lib/executionCredentialCapabilities.js

@@ -0,0 +1,106 @@
+import { QUALIFIED_DOCKER_SANDBOX_TEMPLATES, QUALIFIED_SBX_VERSION, } from './dockerSandboxExecutionEnvironment.js';
+const QUALIFIED_OPENCODE_API_KEY_SERVICES = [
+    'anthropic',
+    'google',
+    'groq',
+    'mistral',
+    'opencode',
+    'opencode-go',
+    'openai',
+    'openrouter',
+    'xai',
+];
+export const QUALIFIED_EXECUTION_CREDENTIAL_TUPLES = (QUALIFIED_OPENCODE_API_KEY_SERVICES.map(modelProvider => ({
+    executionProvider: 'docker_sandbox',
+    providerVersion: QUALIFIED_SBX_VERSION,
+    template: QUALIFIED_DOCKER_SANDBOX_TEMPLATES.opencode,
+    agent: 'opencode',
+    modelProvider,
+    authenticationMode: 'api_key',
+    workload: 'build',
+    inventoryState: 'stored',
+    classification: 'brokered_api_key',
+})));
+const normalizedId = (value) => value?.trim().toLowerCase() || null;
+const findQualifiedTuple = (input) => {
+    const modelProvider = normalizedId(input.modelProvider);
+    const inventoryService = normalizedId(input.inventory.service);
+    return QUALIFIED_EXECUTION_CREDENTIAL_TUPLES.find(tuple => (tuple.executionProvider === input.executionProvider
+        && tuple.providerVersion === input.providerVersion
+        && tuple.template === input.template
+        && tuple.agent === input.agent
+        && tuple.modelProvider === modelProvider
+        && tuple.modelProvider === inventoryService
+        && tuple.authenticationMode === input.authenticationMode
+        && tuple.workload === input.workload
+        && tuple.inventoryState === input.inventory.state
+        && (input.inventory.scope === 'global' || input.inventory.scope === 'exact_sandbox')));
+};
+const classifyCredential = (input) => {
+    if (input.executionProvider === 'host') {
+        return input.requestedProtection === 'legacy_host_inheritance' ? 'legacy_host_inherited' : 'unavailable';
+    }
+    if (findQualifiedTuple(input)) {
+        return 'brokered_api_key';
+    }
+    if (input.guestExposure === 'file') {
+        return 'file_exposed';
+    }
+    if (input.guestExposure === 'environment') {
+        return 'environment_exposed';
+    }
+    if (input.guestExposure === 'stored') {
+        return 'guest_stored';
+    }
+    if (!input.providerVersion
+        || !input.template
+        || !input.modelProvider
+        || !input.authenticationMode
+        || input.inventory.acquisition === 'unavailable'
+        || input.inventory.state === 'unknown'
+        || input.inventory.scope === 'unknown'
+        || input.guestExposure === 'unknown') {
+        return 'unknown';
+    }
+    return 'unavailable';
+};
+const satisfiesProtection = (classification, requestedProtection) => requestedProtection === null
+    || (requestedProtection === 'docker_brokered'
+        && (classification === 'brokered_api_key' || classification === 'brokered_oauth'))
+    || (requestedProtection === 'legacy_host_inheritance' && classification === 'legacy_host_inherited');
+const remediationFor = (input, classification, satisfiesRequestedProtection) => {
+    if (satisfiesRequestedProtection && classification !== 'unknown' && classification !== 'unavailable') {
+        return null;
+    }
+    if (input.inventory.acquisition === 'unavailable') {
+        return 'Refresh the redacted Docker credential inventory, then validate the exact agent, provider, and authentication mode.';
+    }
+    if (input.authenticationMode === 'oauth' && input.agent === 'opencode') {
+        return 'OpenCode OAuth is unavailable until Docker supports and Archon qualifies this exact provider, template, and agent flow.';
+    }
+    if (classification === 'unavailable' && input.modelProvider) {
+        return `Configure a qualified ${input.modelProvider} credential outside Archon, then validate the exact destination.`;
+    }
+    return 'Select a qualified execution provider, version, template, agent, model provider, and authentication mode.';
+};
+export const resolveExecutionCredentialCapability = (input) => {
+    const classification = classifyCredential(input);
+    const satisfiesRequestedProtection = satisfiesProtection(classification, input.requestedProtection);
+    return {
+        execution_provider: input.executionProvider,
+        provider_version: input.providerVersion,
+        template: input.template,
+        agent: input.agent,
+        model_provider: normalizedId(input.modelProvider),
+        authentication_mode: input.authenticationMode,
+        workload: input.workload,
+        inventory: input.inventory,
+        requested_protection: input.requestedProtection,
+        requirement_fingerprint: input.requirementFingerprint,
+        destination: input.destination,
+        classification,
+        satisfies_requested_protection: satisfiesRequestedProtection,
+        remediation: remediationFor(input, classification, satisfiesRequestedProtection),
+    };
+};
+//# sourceMappingURL=executionCredentialCapabilities.js.map

package/dist/server/lib/executionCredentialCapabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executionCredentialCapabilities.js","sourceRoot":"","sources":["../../../server/lib/executionCredentialCapabilities.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,kCAAkC,EAClC,qBAAqB,GACtB,MAAM,wCAAwC,CAAA;AAsE/C,MAAM,mCAAmC,GAAG;IAC1C,WAAW;IACX,QAAQ;IACR,MAAM;IACN,SAAS;IACT,UAAU;IACV,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,KAAK;CACG,CAAA;AAEV,MAAM,CAAC,MAAM,qCAAqC,GAAwC,CACxF,mCAAmC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IACxD,iBAAiB,EAAE,gBAAyB;IAC5C,eAAe,EAAE,qBAAqB;IACtC,QAAQ,EAAE,kCAAkC,CAAC,QAAQ;IACrD,KAAK,EAAE,UAAmB;IAC1B,aAAa;IACb,kBAAkB,EAAE,SAAkB;IACtC,QAAQ,EAAE,OAAgB;IAC1B,cAAc,EAAE,QAAiB;IACjC,cAAc,EAAE,kBAA2B;CAC5C,CAAC,CAAC,CACJ,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,KAAoB,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,IAAI,CAAA;AAElF,MAAM,kBAAkB,GAAG,CAAC,KAAyC,EAAE,EAAE;IACvE,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;IACvD,MAAM,gBAAgB,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IAC9D,OAAO,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CACzD,KAAK,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;WAChD,KAAK,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe;WAC/C,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;WACjC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;WAC3B,KAAK,CAAC,aAAa,KAAK,aAAa;WACrC,KAAK,CAAC,aAAa,KAAK,gBAAgB;WACxC,KAAK,CAAC,kBAAkB,KAAK,KAAK,CAAC,kBAAkB;WACrD,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;WACjC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK;WAC9C,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,eAAe,CAAC,CACrF,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,KAAyC,EAAqC,EAAE;IAC1G,IAAI,KAAK,CAAC,iBAAiB,KAAK,MAAM,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,mBAAmB,KAAK,yBAAyB,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,aAAa,CAAA;IAC1G,CAAC;IACD,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,kBAAkB,CAAA;IAC3B,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACnC,OAAO,cAAc,CAAA;IACvB,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;QAC1C,OAAO,qBAAqB,CAAA;IAC9B,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,cAAc,CAAA;IACvB,CAAC;IACD,IACE,CAAC,KAAK,CAAC,eAAe;WACnB,CAAC,KAAK,CAAC,QAAQ;WACf,CAAC,KAAK,CAAC,aAAa;WACpB,CAAC,KAAK,CAAC,kBAAkB;WACzB,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,aAAa;WAC7C,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS;WACnC,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS;WACnC,KAAK,CAAC,aAAa,KAAK,SAAS,EACpC,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,aAAa,CAAA;AACtB,CAAC,CAAA;AAED,MAAM,mBAAmB,GAAG,CAC1B,cAAiD,EACjD,mBAA8E,EAC9E,EAAE,CAAC,mBAAmB,KAAK,IAAI;OAC5B,CAAC,mBAAmB,KAAK,iBAAiB;WACxC,CAAC,cAAc,KAAK,kBAAkB,IAAI,cAAc,KAAK,gBAAgB,CAAC,CAAC;OACjF,CAAC,mBAAmB,KAAK,yBAAyB,IAAI,cAAc,KAAK,uBAAuB,CAAC,CAAA;AAEtG,MAAM,cAAc,GAAG,CACrB,KAAyC,EACzC,cAAiD,EACjD,4BAAqC,EACrC,EAAE;IACF,IAAI,4BAA4B,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,aAAa,EAAE,CAAC;QACrG,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;QAClD,OAAO,qHAAqH,CAAA;IAC9H,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,KAAK,OAAO,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACvE,OAAO,yHAAyH,CAAA;IAClI,CAAC;IACD,IAAI,cAAc,KAAK,aAAa,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QAC5D,OAAO,yBAAyB,KAAK,CAAC,aAAa,kEAAkE,CAAA;IACvH,CAAC;IACD,OAAO,2GAA2G,CAAA;AACpH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAClD,KAAyC,EACV,EAAE;IACjC,MAAM,cAAc,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAChD,MAAM,4BAA4B,GAAG,mBAAmB,CAAC,cAAc,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAA;IACnG,OAAO;QACL,kBAAkB,EAAE,KAAK,CAAC,iBAAiB;QAC3C,gBAAgB,EAAE,KAAK,CAAC,eAAe;QACvC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC;QACjD,mBAAmB,EAAE,KAAK,CAAC,kBAAkB;QAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,oBAAoB,EAAE,KAAK,CAAC,mBAAmB;QAC/C,uBAAuB,EAAE,KAAK,CAAC,sBAAsB;QACrD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc;QACd,8BAA8B,EAAE,4BAA4B;QAC5D,WAAW,EAAE,cAAc,CAAC,KAAK,EAAE,cAAc,EAAE,4BAA4B,CAAC;KACjF,CAAA;AACH,CAAC,CAAA"}

package/dist/server/lib/executionEnvironment.js.map

@@ -1 +1 @@
-{"version":3,"file":"executionEnvironment.js","sourceRoot":"","sources":["../../../server/lib/executionEnvironment.ts"],"names":[],"mappings":"AA+EA,MAAM,OAAO,oCAAqC,SAAQ,KAAK;IACpD,QAAQ,CAA4B;IAE7C,YAAY,QAAoC,EAAE,OAAe,EAAE,UAAwB,EAAE;QAC3F,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,sCAAsC,CAAA;QAClD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAgBD,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,IAAI,CAAiC;IACrC,QAAQ,CAAQ;IAEzB,YACE,IAAqC,EACrC,QAAgB,EAChB,OAAe,EACf,OAAqB;QAErB,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAA;QACzC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAED,MAAM,OAAO,sCAAuC,SAAQ,2BAA2B;IACrF,YAAY,QAAgB,EAAE,OAAe,EAAE,UAAwB,EAAE;QACvE,KAAK,CAAC,sBAAsB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QACzD,IAAI,CAAC,IAAI,GAAG,wCAAwC,CAAA;IACtD,CAAC;CACF;AAED,MAAM,OAAO,sCAAuC,SAAQ,2BAA2B;IAC5E,UAAU,CAAQ;IAE3B,YAAY,QAAgB,EAAE,UAAkB,EAAE,OAAe,EAAE,UAAwB,EAAE;QAC3F,KAAK,CAAC,wBAAwB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QAC3D,IAAI,CAAC,IAAI,GAAG,wCAAwC,CAAA;QACpD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;IAC9B,CAAC;CACF;AAED,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAClD,QAAgB,EAChB,OAAe,EACf,KAAc,EACd,EAAE;IACF,MAAM,IAAI,GAAI,KAAsC,EAAE,IAAI,KAAK,QAAQ;QACrE,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,kBAAkB,CAAA;IACtB,MAAM,OAAO,GAAG,IAAI,KAAK,wBAAwB;QAC/C,CAAC,CAAC,uBAAuB,QAAQ,gCAAgC,OAAO,GAAG;QAC3E,CAAC,CAAC,uBAAuB,QAAQ,sBAAsB,OAAO,GAAG,CAAA;IAEnE,OAAO,IAAI,2BAA2B,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;AACnF,CAAC,CAAA"}
+{"version":3,"file":"executionEnvironment.js","sourceRoot":"","sources":["../../../server/lib/executionEnvironment.ts"],"names":[],"mappings":"AAqGA,MAAM,OAAO,oCAAqC,SAAQ,KAAK;IACpD,QAAQ,CAA4B;IAE7C,YAAY,QAAoC,EAAE,OAAe,EAAE,UAAwB,EAAE;QAC3F,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,sCAAsC,CAAA;QAClD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAgBD,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,IAAI,CAAiC;IACrC,QAAQ,CAAQ;IAEzB,YACE,IAAqC,EACrC,QAAgB,EAChB,OAAe,EACf,OAAqB;QAErB,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAA;QACzC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAED,MAAM,OAAO,sCAAuC,SAAQ,2BAA2B;IACrF,YAAY,QAAgB,EAAE,OAAe,EAAE,UAAwB,EAAE;QACvE,KAAK,CAAC,sBAAsB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QACzD,IAAI,CAAC,IAAI,GAAG,wCAAwC,CAAA;IACtD,CAAC;CACF;AAED,MAAM,OAAO,sCAAuC,SAAQ,2BAA2B;IAC5E,UAAU,CAAQ;IAE3B,YAAY,QAAgB,EAAE,UAAkB,EAAE,OAAe,EAAE,UAAwB,EAAE;QAC3F,KAAK,CAAC,wBAAwB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QAC3D,IAAI,CAAC,IAAI,GAAG,wCAAwC,CAAA;QACpD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;IAC9B,CAAC;CACF;AAED,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAClD,QAAgB,EAChB,OAAe,EACf,KAAc,EACd,EAAE;IACF,MAAM,IAAI,GAAI,KAAsC,EAAE,IAAI,KAAK,QAAQ;QACrE,CAAC,CAAC,wBAAwB;QAC1B,CAAC,CAAC,kBAAkB,CAAA;IACtB,MAAM,OAAO,GAAG,IAAI,KAAK,wBAAwB;QAC/C,CAAC,CAAC,uBAAuB,QAAQ,gCAAgC,OAAO,GAAG;QAC3E,CAAC,CAAC,uBAAuB,QAAQ,sBAAsB,OAAO,GAAG,CAAA;IAEnE,OAAO,IAAI,2BAA2B,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;AACnF,CAAC,CAAA"}

package/dist/server/lib/executionEnvironmentContexts.js

@@ -1,4 +1,5 @@
 import db from '../db.js';
+import { EXECUTION_ENVIRONMENT_AUTHENTICATION_MODES, EXECUTION_ENVIRONMENT_CREDENTIAL_DELIVERIES } from './types.js';
 const parseSnapshot = (value) => {
     if (!value) {
         return null;
@@ -15,6 +16,7 @@ const parseSnapshot = (value) => {
     }
 };
 const hasString = (value, key) => typeof value[key] === 'string';
+const parseEnumValue = (allowed, value) => (typeof value === 'string' && allowed.includes(value) ? value : null);
 const isPlacementSnapshot = (value) => {
     const scope = value.scope;
     if (!hasString(value, 'provider')
@@ -44,6 +46,10 @@ const parseAuthority = (row) => {
         : null;
     const capabilities = value?.capabilities;
     const degradationReasons = value?.degradation_reasons;
+    const runAuthorityValue = parseSnapshot(row.run_authority_json);
+    const runAuthority = runAuthorityValue?.schema_version === 1
+        ? runAuthorityValue
+        : null;
     return {
         schema_version: value?.schema_version === 1 ? 1 : null,
         provider: value?.provider === 'docker_sandbox' ? value.provider : null,
@@ -67,10 +73,38 @@ const parseAuthority = (row) => {
             ? degradationReasons
             : null,
         agent: value?.agent === 'opencode' || value?.agent === 'claude' ? value.agent : null,
-        authentication_mode: value?.authentication_mode === 'validated_guest' ? value.authentication_mode : null,
-        credential_delivery: value?.credential_delivery === 'sandbox_template' ? value.credential_delivery : null,
+        authentication_mode: parseEnumValue(EXECUTION_ENVIRONMENT_AUTHENTICATION_MODES, value?.authentication_mode),
+        credential_delivery: parseEnumValue(EXECUTION_ENVIRONMENT_CREDENTIAL_DELIVERIES, value?.credential_delivery),
+        run_authority: runAuthority,
     };
 };
+const serializeHostAuthorityContext = (authority) => ({
+    relationship: 'execution',
+    lease_active: false,
+    authority: {
+        schema_version: 1,
+        provider: authority.effective.provider,
+        provider_version: null,
+        environment_id: authority.effective.environment_id,
+        environment_revision: authority.effective.environment_revision,
+        environment_validation_fingerprint: authority.effective.environment_validation_fingerprint,
+        target: {
+            kind: authority.target.kind,
+            key: authority.target.key,
+            workspace_path: authority.target.workspace_path,
+        },
+        capabilities: null,
+        degradation_reasons: [...authority.degradations],
+        agent: authority.agent.agent,
+        authentication_mode: null,
+        credential_delivery: null,
+        run_authority: authority,
+    },
+    placement: null,
+    live_environment: null,
+    bound_at: '',
+    released_at: null,
+});
 const serializeContext = (row) => {
     const authority = parseAuthority(row);
     const parsedPlacementValue = parseSnapshot(row.placement_json);
@@ -114,12 +148,15 @@ export const listExecutionEnvironmentContextsForRuns = (projectId, executionRunI
         return new Map();
     }
     const placeholders = executionRunIds.map(() => '?').join(', ');
+    const hasRunAuthorities = Boolean(db.prepare(`
+    SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'execution_run_authorities'
+  `).get());
     const rows = db.prepare(`
     SELECT binding.execution_run_id, binding.relationship,
       binding.environment_id AS binding_environment_id,
       binding.environment_revision AS binding_environment_revision,
       binding.environment_validation_fingerprint AS binding_environment_validation_fingerprint,
-      binding.authority_json,
+      binding.authority_json, ${hasRunAuthorities ? 'run_authority.authority_json' : 'NULL'} AS run_authority_json,
       binding.placement_json, binding.bound_at, binding.released_at, environment.id,
       environment.provider_kind, environment.provider_version, environment.target_kind,
       environment.target_key, environment.target_workspace_path, environment.environment_revision,
@@ -128,6 +165,9 @@ export const listExecutionEnvironmentContextsForRuns = (projectId, executionRunI
     LEFT JOIN execution_environments environment
       ON environment.id = binding.environment_id
       AND environment.project_id = binding.project_id
+    ${hasRunAuthorities ? `LEFT JOIN execution_run_authorities run_authority
+      ON run_authority.execution_run_id = binding.execution_run_id
+      AND run_authority.project_id = binding.project_id` : ''}
     WHERE binding.project_id = ? AND binding.execution_run_id IN (${placeholders})
     ORDER BY binding.bound_at DESC, binding.environment_id DESC
   `).all(projectId, ...executionRunIds);
@@ -138,6 +178,22 @@ export const listExecutionEnvironmentContextsForRuns = (projectId, executionRunI
             contexts.set(runId, serializeContext(row));
         }
     }
+    const authorityRows = hasRunAuthorities ? db.prepare(`
+    SELECT execution_run_id, authority_json, created_at
+    FROM execution_run_authorities
+    WHERE project_id = ? AND execution_run_id IN (${placeholders})
+  `).all(projectId, ...executionRunIds) : [];
+    for (const row of authorityRows) {
+        if (contexts.has(row.execution_run_id)) {
+            continue;
+        }
+        const value = parseSnapshot(row.authority_json);
+        if (value?.schema_version !== 1) {
+            continue;
+        }
+        const context = serializeHostAuthorityContext(value);
+        contexts.set(row.execution_run_id, { ...context, bound_at: row.created_at });
+    }
     return contexts;
 };
 export const getExecutionEnvironmentContextForRun = (projectId, executionRunId) => (listExecutionEnvironmentContextsForRuns(projectId, [executionRunId]).get(executionRunId) ?? null);

package/dist/server/lib/executionEnvironmentContexts.js.map

@@ -1 +1 @@
-{"version":3,"file":"executionEnvironmentContexts.js","sourceRoot":"","sources":["../../../server/lib/executionEnvironmentContexts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,UAAU,CAAA;AA6BzB,MAAM,aAAa,GAAG,CAAC,KAAoB,EAAkC,EAAE;IAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAA;QAC3C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,MAAiC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,KAA8B,EAAE,GAAW,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAA;AAEjG,MAAM,mBAAmB,GAAG,CAAC,KAA8B,EAAE,EAAE;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACzB,IACE,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC;WAC1B,CAAC,SAAS,CAAC,KAAK,EAAE,iBAAiB,CAAC;WACpC,CAAC,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC;WAClC,OAAO,KAAK,CAAC,mBAAmB,KAAK,QAAQ;WAC7C,CAAC,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC;WACnC,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC;WAC9B,OAAO,KAAK,KAAK,QAAQ;WACzB,KAAK,KAAK,IAAI;WACd,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EACvB,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,UAAU,GAAG,KAAgC,CAAA;IACnD,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,gBAAgB,IAAI,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;WAC1E,CAAC,UAAU,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;WAClH,CAAC,UAAU,CAAC,IAAI,KAAK,eAAe,IAAI,SAAS,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAA;AACnF,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,GAAe,EAA+C,EAAE;IACtF,IAAI,GAAG,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;QACrC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,CAAA;IAC5B,MAAM,WAAW,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACzF,CAAC,CAAC,MAAiC;QACnC,CAAC,CAAC,IAAI,CAAA;IACR,MAAM,YAAY,GAAG,KAAK,EAAE,YAAY,CAAA;IACxC,MAAM,kBAAkB,GAAG,KAAK,EAAE,mBAAmB,CAAA;IACrD,OAAO;QACL,cAAc,EAAE,KAAK,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QACtD,QAAQ,EAAE,KAAK,EAAE,QAAQ,KAAK,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;QACtE,gBAAgB,EAAE,OAAO,KAAK,EAAE,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI;QAC7F,cAAc,EAAE,KAAK,EAAE,cAAc,KAAK,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QAClG,oBAAoB,EAAE,KAAK,EAAE,oBAAoB,KAAK,GAAG,CAAC,4BAA4B;YACpF,CAAC,CAAC,KAAK,CAAC,oBAAoB;YAC5B,CAAC,CAAC,IAAI;QACR,kCAAkC,EAChC,KAAK,EAAE,kCAAkC,KAAK,GAAG,CAAC,0CAA0C;YAC1F,CAAC,CAAC,KAAK,CAAC,kCAAkC;YAC1C,CAAC,CAAC,IAAI;QACV,MAAM,EAAE;YACN,IAAI,EAAE,OAAO,WAAW,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;YACrE,GAAG,EAAE,OAAO,WAAW,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YAClE,cAAc,EAAE,OAAO,WAAW,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;SACpG;QACD,YAAY,EAAE,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;YACrG,CAAC,CAAC,YAAuC;YACzC,CAAC,CAAC,IAAI;QACR,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC;YACtH,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,IAAI;QACR,KAAK,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,IAAI,KAAK,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QACpF,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,KAAK,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI;QACxG,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,KAAK,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI;KAC1G,CAAA;AACH,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,GAAe,EAA+B,EAAE;IACxE,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;IACrC,MAAM,oBAAoB,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAC9D,MAAM,eAAe,GAAG,oBAAoB,IAAI,mBAAmB,CAAC,oBAAoB,CAAC;QACvF,CAAC,CAAC,oBAAkD;QACpD,CAAC,CAAC,IAAI,CAAA;IACR,MAAM,SAAS,GAAG,eAAe;WAC5B,eAAe,CAAC,aAAa,KAAK,GAAG,CAAC,sBAAsB;WAC5D,eAAe,CAAC,mBAAmB,KAAK,GAAG,CAAC,4BAA4B;WACxE,eAAe,CAAC,cAAc,KAAK,GAAG,CAAC,gBAAgB;QAC1D,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,IAAI,CAAA;IACR,OAAO;QACL,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,YAAY,EAAE,GAAG,CAAC,WAAW,KAAK,IAAI;QACtC,SAAS;QACT,SAAS;QACT,gBAAgB,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,WAAW;eACnF,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,qBAAqB,IAAI,GAAG,CAAC,oBAAoB,KAAK,IAAI;eAChF,GAAG,CAAC,kCAAkC,IAAI,GAAG,CAAC,eAAe;YAChE,CAAC,CAAC;gBACE,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;gBACtC,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;gBAChD,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;gBAC9C,kCAAkC,EAAE,GAAG,CAAC,kCAAkC;gBAC1E,eAAe,EAAE,GAAG,CAAC,eAAe;aACrC;YACH,CAAC,CAAC,IAAI;QACR,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,uCAAuC,GAAG,CACrD,SAAiB,EACjB,eAAkC,EACQ,EAAE;IAC5C,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;GAE/C,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QACT,OAAO,IAAI,GAAG,EAAE,CAAA;IAClB,CAAC;IACD,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9D,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;;;;;;;;;;oEAc0C,YAAY;;GAE7E,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,eAAe,CAAiB,CAAA;IACrD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuC,CAAA;IAC/D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,gBAAgB,CAAA;QAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAClD,SAAiB,EACjB,cAAsB,EACc,EAAE,CAAC,CACvC,uCAAuC,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CACjG,CAAA"}
+{"version":3,"file":"executionEnvironmentContexts.js","sourceRoot":"","sources":["../../../server/lib/executionEnvironmentContexts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,UAAU,CAAA;AAEzB,OAAO,EAAE,0CAA0C,EAAE,2CAA2C,EAAE,MAAM,YAAY,CAAA;AAgCpH,MAAM,aAAa,GAAG,CAAC,KAAoB,EAAkC,EAAE;IAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAA;QAC3C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,MAAiC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,KAA8B,EAAE,GAAW,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAA;AAEjG,MAAM,cAAc,GAAG,CAAmB,OAAqB,EAAE,KAAc,EAAY,EAAE,CAAC,CAC5F,OAAO,KAAK,KAAK,QAAQ,IAAK,OAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAU,CAAC,CAAC,CAAC,IAAI,CAChG,CAAA;AAED,MAAM,mBAAmB,GAAG,CAAC,KAA8B,EAAE,EAAE;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACzB,IACE,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC;WAC1B,CAAC,SAAS,CAAC,KAAK,EAAE,iBAAiB,CAAC;WACpC,CAAC,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC;WAClC,OAAO,KAAK,CAAC,mBAAmB,KAAK,QAAQ;WAC7C,CAAC,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC;WACnC,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC;WAC9B,OAAO,KAAK,KAAK,QAAQ;WACzB,KAAK,KAAK,IAAI;WACd,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EACvB,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,UAAU,GAAG,KAAgC,CAAA;IACnD,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,gBAAgB,IAAI,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;WAC1E,CAAC,UAAU,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;WAClH,CAAC,UAAU,CAAC,IAAI,KAAK,eAAe,IAAI,SAAS,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAA;AACnF,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,GAAe,EAA+C,EAAE;IACtF,IAAI,GAAG,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;QACrC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,CAAA;IAC5B,MAAM,WAAW,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACzF,CAAC,CAAC,MAAiC;QACnC,CAAC,CAAC,IAAI,CAAA;IACR,MAAM,YAAY,GAAG,KAAK,EAAE,YAAY,CAAA;IACxC,MAAM,kBAAkB,GAAG,KAAK,EAAE,mBAAmB,CAAA;IACrD,MAAM,iBAAiB,GAAG,aAAa,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC/D,MAAM,YAAY,GAAG,iBAAiB,EAAE,cAAc,KAAK,CAAC;QAC1D,CAAC,CAAC,iBAAkD;QACpD,CAAC,CAAC,IAAI,CAAA;IACR,OAAO;QACL,cAAc,EAAE,KAAK,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QACtD,QAAQ,EAAE,KAAK,EAAE,QAAQ,KAAK,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;QACtE,gBAAgB,EAAE,OAAO,KAAK,EAAE,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI;QAC7F,cAAc,EAAE,KAAK,EAAE,cAAc,KAAK,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QAClG,oBAAoB,EAAE,KAAK,EAAE,oBAAoB,KAAK,GAAG,CAAC,4BAA4B;YACpF,CAAC,CAAC,KAAK,CAAC,oBAAoB;YAC5B,CAAC,CAAC,IAAI;QACR,kCAAkC,EAChC,KAAK,EAAE,kCAAkC,KAAK,GAAG,CAAC,0CAA0C;YAC1F,CAAC,CAAC,KAAK,CAAC,kCAAkC;YAC1C,CAAC,CAAC,IAAI;QACV,MAAM,EAAE;YACN,IAAI,EAAE,OAAO,WAAW,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;YACrE,GAAG,EAAE,OAAO,WAAW,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YAClE,cAAc,EAAE,OAAO,WAAW,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;SACpG;QACD,YAAY,EAAE,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;YACrG,CAAC,CAAC,YAAuC;YACzC,CAAC,CAAC,IAAI;QACR,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC;YACtH,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,IAAI;QACR,KAAK,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,IAAI,KAAK,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QACpF,mBAAmB,EAAE,cAAc,CACjC,0CAA0C,EAC1C,KAAK,EAAE,mBAAmB,CAC3B;QACD,mBAAmB,EAAE,cAAc,CACjC,2CAA2C,EAC3C,KAAK,EAAE,mBAAmB,CAC3B;QACD,aAAa,EAAE,YAAY;KAC5B,CAAA;AACH,CAAC,CAAA;AAED,MAAM,6BAA6B,GAAG,CACpC,SAAwC,EACX,EAAE,CAAC,CAAC;IACjC,YAAY,EAAE,WAAW;IACzB,YAAY,EAAE,KAAK;IACnB,SAAS,EAAE;QACT,cAAc,EAAE,CAAC;QACjB,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,QAAQ;QACtC,gBAAgB,EAAE,IAAI;QACtB,cAAc,EAAE,SAAS,CAAC,SAAS,CAAC,cAAc;QAClD,oBAAoB,EAAE,SAAS,CAAC,SAAS,CAAC,oBAAoB;QAC9D,kCAAkC,EAAE,SAAS,CAAC,SAAS,CAAC,kCAAkC;QAC1F,MAAM,EAAE;YACN,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI;YAC3B,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;YACzB,cAAc,EAAE,SAAS,CAAC,MAAM,CAAC,cAAc;SAChD;QACD,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,CAAC,GAAG,SAAS,CAAC,YAAY,CAAC;QAChD,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK;QAC5B,mBAAmB,EAAE,IAAI;QACzB,mBAAmB,EAAE,IAAI;QACzB,aAAa,EAAE,SAAS;KACzB;IACD,SAAS,EAAE,IAAI;IACf,gBAAgB,EAAE,IAAI;IACtB,QAAQ,EAAE,EAAE;IACZ,WAAW,EAAE,IAAI;CAClB,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,CAAC,GAAe,EAA+B,EAAE;IACxE,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;IACrC,MAAM,oBAAoB,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAC9D,MAAM,eAAe,GAAG,oBAAoB,IAAI,mBAAmB,CAAC,oBAAoB,CAAC;QACvF,CAAC,CAAC,oBAAkD;QACpD,CAAC,CAAC,IAAI,CAAA;IACR,MAAM,SAAS,GAAG,eAAe;WAC5B,eAAe,CAAC,aAAa,KAAK,GAAG,CAAC,sBAAsB;WAC5D,eAAe,CAAC,mBAAmB,KAAK,GAAG,CAAC,4BAA4B;WACxE,eAAe,CAAC,cAAc,KAAK,GAAG,CAAC,gBAAgB;QAC1D,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,IAAI,CAAA;IACR,OAAO;QACL,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,YAAY,EAAE,GAAG,CAAC,WAAW,KAAK,IAAI;QACtC,SAAS;QACT,SAAS;QACT,gBAAgB,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,WAAW;eACnF,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,qBAAqB,IAAI,GAAG,CAAC,oBAAoB,KAAK,IAAI;eAChF,GAAG,CAAC,kCAAkC,IAAI,GAAG,CAAC,eAAe;YAChE,CAAC,CAAC;gBACE,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;gBACtC,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;gBAChD,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;gBAC9C,kCAAkC,EAAE,GAAG,CAAC,kCAAkC;gBAC1E,eAAe,EAAE,GAAG,CAAC,eAAe;aACrC;YACH,CAAC,CAAC,IAAI;QACR,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,uCAAuC,GAAG,CACrD,SAAiB,EACjB,eAAkC,EACQ,EAAE;IAC5C,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;GAE/C,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QACT,OAAO,IAAI,GAAG,EAAE,CAAA;IAClB,CAAC;IACD,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9D,MAAM,iBAAiB,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC;;GAE5C,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;IACT,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;gCAKM,iBAAiB,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,MAAM;;;;;;;;;MASrF,iBAAiB,CAAC,CAAC,CAAC;;wDAE8B,CAAC,CAAC,CAAC,EAAE;oEACO,YAAY;;GAE7E,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,eAAe,CAAiB,CAAA;IACrD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuC,CAAA;IAC/D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,gBAAgB,CAAA;QAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC;;;oDAGH,YAAY;GAC7D,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,eAAe,CAIlC,CAAC,CAAC,CAAC,EAAE,CAAA;IACP,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACvC,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QAC/C,IAAI,KAAK,EAAE,cAAc,KAAK,CAAC,EAAE,CAAC;YAChC,SAAQ;QACV,CAAC;QACD,MAAM,OAAO,GAAG,6BAA6B,CAAC,KAAsC,CAAC,CAAA;QACrF,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;IAC9E,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAClD,SAAiB,EACjB,cAAsB,EACc,EAAE,CAAC,CACvC,uCAAuC,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CACjG,CAAA"}

package/dist/server/lib/executionEnvironmentLifecycle.js

@@ -1,6 +1,40 @@
 import { createHash } from 'crypto';
 import { ExecutionEnvironmentUnsupportedFailure } from './executionEnvironment.js';
 export const EXECUTION_ENVIRONMENT_VALIDATION_FINGERPRINT_FORMAT = 'archon-environment-validation-v1';
+const MAX_NETWORK_DESTINATION_HOST_BYTES = 253;
+export const normalizeExecutionEnvironmentDestinations = (destinations) => {
+    const normalized = [];
+    const seen = new Set();
+    for (const destination of destinations) {
+        if (typeof destination?.host !== 'string') {
+            throw new Error('Network destination host must be a string');
+        }
+        const host = destination.host.trim().toLowerCase();
+        if (host.length === 0
+            || Buffer.byteLength(host, 'utf8') > MAX_NETWORK_DESTINATION_HOST_BYTES) {
+            throw new Error(`Network destination host must contain between 1 and ${MAX_NETWORK_DESTINATION_HOST_BYTES} bytes`);
+        }
+        const rawPort = destination.port;
+        let port;
+        if (rawPort !== undefined && rawPort !== null) {
+            if (typeof rawPort !== 'number'
+                || !Number.isSafeInteger(rawPort)
+                || rawPort < 1
+                || rawPort > 65535) {
+                throw new Error('Network destination port must be an integer between 1 and 65535');
+            }
+            port = rawPort;
+        }
+        const key = `${host}:${port ?? ''}`;
+        if (seen.has(key)) {
+            continue;
+        }
+        seen.add(key);
+        normalized.push(port === undefined ? { host } : { host, port });
+    }
+    return normalized;
+};
+export const networkDestinationTarget = (destination) => destination.port === undefined ? destination.host : `${destination.host}:${destination.port}`;
 const assertFingerprintComponent = (value, name) => {
     if (value.length === 0 || Buffer.byteLength(value, 'utf8') > 500) {
         throw new Error(`${name} must contain between 1 and 500 bytes`);

package/dist/server/lib/executionEnvironmentLifecycle.js.map

@@ -1 +1 @@
-{"version":3,"file":"executionEnvironmentLifecycle.js","sourceRoot":"","sources":["../../../server/lib/executionEnvironmentLifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,OAAO,EAAE,sCAAsC,EAAE,MAAM,2BAA2B,CAAA;AAGlF,MAAM,CAAC,MAAM,mDAAmD,GAAG,kCAAkC,CAAA;AAsDrG,MAAM,0BAA0B,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,EAAE;IACjE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAA;IACjE,CAAC;AACH,CAAC,CAAA;AAED,MAAM,0BAA0B,GAAG,CAAC,IAAmC,EAAE,IAAY,EAAE,KAAa,EAAE,EAAE;IACtG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACxC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,MAAM,CAAC,CAAA;IAC/C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAClB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAC3B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAC/D,KAA4C,EACL,EAAE;IACzC,IAAI,KAAK,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC/E,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,0BAA0B,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAA;IACjF,0BAA0B,CAAC,KAAK,CAAC,4BAA4B,EAAE,iCAAiC,CAAC,CAAA;IACjG,0BAA0B,CAAC,KAAK,CAAC,sBAAsB,EAAE,0BAA0B,CAAC,CAAA;IACpF,0BAA0B,CAAC,KAAK,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAA;IAC9E,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACpE,IACE,gBAAgB,CAAC,MAAM,KAAK,CAAC;WAC1B,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,QAAQ,CAAC,EAC7E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;IAChF,CAAC;IACD,OAAO;QACL,aAAa,EAAE,QAAQ;QACvB,QAAQ,EAAE,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE;QAC/B,gBAAgB;QAChB,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;QAChE,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;KAC/C,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sCAAsC,GAAG,CACpD,KAA4C,EACpC,EAAE;IACV,MAAM,SAAS,GAAG,iDAAiD,CAAC,KAAK,CAAC,CAAA;IAC1E,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACjC,0BAA0B,CAAC,IAAI,EAAE,QAAQ,EAAE,mDAAmD,CAAC,CAAA;IAC/F,0BAA0B,CAAC,IAAI,EAAE,gBAAgB,EAAE,SAAS,CAAC,aAAa,CAAC,CAAA;IAC3E,0BAA0B,CAAC,IAAI,EAAE,eAAe,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC1E,0BAA0B,CAAC,IAAI,EAAE,gBAAgB,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC5E,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,gBAAgB,EAAE,CAAC;QAC/C,0BAA0B,CAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAA;IAC7D,CAAC;IACD,0BAA0B,CAAC,IAAI,EAAE,iCAAiC,EAAE,SAAS,CAAC,4BAA4B,CAAC,CAAA;IAC3G,0BAA0B,CAAC,IAAI,EAAE,0BAA0B,EAAE,SAAS,CAAC,sBAAsB,CAAC,CAAA;IAC9F,0BAA0B,CAAC,IAAI,EAAE,uBAAuB,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAA;IACxF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,QAAgB,EAChB,WAA4C,EAC5C,oBAAwD,EACxD,EAAE;IACF,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;QACpD,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YAC5B,MAAM,IAAI,sCAAsC,CAC9C,QAAQ,EACR,UAAU,EACV,uBAAuB,QAAQ,oCAAoC,UAAU,MAAM,OAAO,IAAI,CAC/F,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAA"}
+{"version":3,"file":"executionEnvironmentLifecycle.js","sourceRoot":"","sources":["../../../server/lib/executionEnvironmentLifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,OAAO,EAAE,sCAAsC,EAAE,MAAM,2BAA2B,CAAA;AAGlF,MAAM,CAAC,MAAM,mDAAmD,GAAG,kCAAkC,CAAA;AA2CrG,MAAM,kCAAkC,GAAG,GAAG,CAAA;AAE9C,MAAM,CAAC,MAAM,yCAAyC,GAAG,CACvD,YAIG,EACgD,EAAE;IACrD,MAAM,UAAU,GAA6C,EAAE,CAAA;IAC/D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,OAAO,WAAW,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;QAC9D,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAClD,IACE,IAAI,CAAC,MAAM,KAAK,CAAC;eACd,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,kCAAkC,EACvE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,kCAAkC,QAAQ,CAAC,CAAA;QACpH,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAA;QAChC,IAAI,IAAwB,CAAA;QAC5B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC9C,IACE,OAAO,OAAO,KAAK,QAAQ;mBACxB,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;mBAC9B,OAAO,GAAG,CAAC;mBACX,OAAO,GAAG,KAAK,EAClB,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;YACpF,CAAC;YACD,IAAI,GAAG,OAAO,CAAA;QAChB,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,IAAI,IAAI,EAAE,EAAE,CAAA;QACnC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,WAAmD,EAC3C,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,IAAI,EAAE,CAAA;AAmB1G,MAAM,0BAA0B,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,EAAE;IACjE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAA;IACjE,CAAC;AACH,CAAC,CAAA;AAED,MAAM,0BAA0B,GAAG,CAAC,IAAmC,EAAE,IAAY,EAAE,KAAa,EAAE,EAAE;IACtG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACxC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,MAAM,CAAC,CAAA;IAC/C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAClB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAC3B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAC/D,KAA4C,EACL,EAAE;IACzC,IAAI,KAAK,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC/E,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,0BAA0B,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAA;IACjF,0BAA0B,CAAC,KAAK,CAAC,4BAA4B,EAAE,iCAAiC,CAAC,CAAA;IACjG,0BAA0B,CAAC,KAAK,CAAC,sBAAsB,EAAE,0BAA0B,CAAC,CAAA;IACpF,0BAA0B,CAAC,KAAK,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAA;IAC9E,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACpE,IACE,gBAAgB,CAAC,MAAM,KAAK,CAAC;WAC1B,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,QAAQ,CAAC,EAC7E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;IAChF,CAAC;IACD,OAAO;QACL,aAAa,EAAE,QAAQ;QACvB,QAAQ,EAAE,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE;QAC/B,gBAAgB;QAChB,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;QAChE,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;KAC/C,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sCAAsC,GAAG,CACpD,KAA4C,EACpC,EAAE;IACV,MAAM,SAAS,GAAG,iDAAiD,CAAC,KAAK,CAAC,CAAA;IAC1E,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACjC,0BAA0B,CAAC,IAAI,EAAE,QAAQ,EAAE,mDAAmD,CAAC,CAAA;IAC/F,0BAA0B,CAAC,IAAI,EAAE,gBAAgB,EAAE,SAAS,CAAC,aAAa,CAAC,CAAA;IAC3E,0BAA0B,CAAC,IAAI,EAAE,eAAe,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC1E,0BAA0B,CAAC,IAAI,EAAE,gBAAgB,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC5E,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,gBAAgB,EAAE,CAAC;QAC/C,0BAA0B,CAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAA;IAC7D,CAAC;IACD,0BAA0B,CAAC,IAAI,EAAE,iCAAiC,EAAE,SAAS,CAAC,4BAA4B,CAAC,CAAA;IAC3G,0BAA0B,CAAC,IAAI,EAAE,0BAA0B,EAAE,SAAS,CAAC,sBAAsB,CAAC,CAAA;IAC9F,0BAA0B,CAAC,IAAI,EAAE,uBAAuB,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAA;IACxF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,QAAgB,EAChB,WAA4C,EAC5C,oBAAwD,EACxD,EAAE;IACF,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;QACpD,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YAC5B,MAAM,IAAI,sCAAsC,CAC9C,QAAQ,EACR,UAAU,EACV,uBAAuB,QAAQ,oCAAoC,UAAU,MAAM,OAAO,IAAI,CAC/F,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAA"}