hammerkit 1.23.0 → 1.25.0

package/dist/server/proposals-api.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleProposals = exports.mayApprove = void 0;
+const zod_1 = require("zod");
+const bundle_1 = require("../remote/bundle");
+const definitions_1 = require("./definitions");
+const http_1 = require("./http");
+const oauth_1 = require("./oauth");
+const policy_1 = require("./policy");
+const proposals_1 = require("./proposals");
+const server_config_1 = require("./server-config");
+const decisionSchema = zod_1.z.object({ reason: zod_1.z.string().max(500).optional() }).strict();
+const same = (a, b) => a.iss === b.iss && a.sub === b.sub;
+// Whoever approves publishes it, and uses the accounts its proposer did not: a
+// version that names an account is approved by somebody the account trusts.
+const mayApprove = (grant, proposal) => (0, policy_1.mayPublish)(grant) && proposal.missing.every((account) => (0, policy_1.canUse)(grant, account));
+exports.mayApprove = mayApprove;
+// What the caller is shown of a proposal: what it is, who proposed it and the
+// version it would replace, so the files can be compared.
+function toView(store, proposal, principal, grant) {
+    const latest = store.find(proposal.name, 'latest')?.hash ?? null;
+    const stale = proposal.state === 'waiting' && latest !== proposal.base;
+    return {
+        ...proposal,
+        // the version it follows is fixed when it is proposed; if another one was
+        // published since, it can only be rejected
+        latest,
+        stale,
+        mine: same(proposal.proposedBy, principal),
+        // approving needs the permission to publish, the accounts the proposer lacked, and
+        // somebody else's proposal
+        canDecide: proposal.state === 'waiting' && !stale && (0, exports.mayApprove)(grant, proposal) && !same(proposal.proposedBy, principal),
+    };
+}
+/**
+ * New versions of build files that wait for an approval. Whoever may only
+ * propose a version (`builds: propose`), or publishes one that names accounts they
+ * do not use, puts one here; someone who may publish, and uses those accounts,
+ * approves it, and it is published then.
+ *
+ *   GET  /v1/proposals                          the ones the caller proposed or may decide
+ *   GET  /v1/proposals/<name>/<hash>            one of them
+ *   GET  /v1/proposals/<name>/<hash>/files      its files, for who decides
+ *   POST /v1/proposals/<name>/<hash>/approve    publish it (body: optional {reason})
+ *   POST /v1/proposals/<name>/<hash>/reject     drop it
+ */
+async function handleProposals(config, store, proposals, log, principal, req, res, url) {
+    const match = /^\/v1\/proposals(?:\/([^/]+)\/([^/]+)(?:\/(files|approve|reject))?)?$/.exec(url.pathname);
+    if (!match) {
+        return false;
+    }
+    const [, name, hash, action] = match;
+    const grant = (0, policy_1.getGrant)(config.entitlements, principal);
+    // what the caller neither proposed nor may decide does not exist for them
+    const visible = (proposal) => same(proposal.proposedBy, principal) || (0, policy_1.mayPublish)(grant);
+    if (name === undefined) {
+        if (req.method !== 'GET') {
+            (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'GET' });
+            return true;
+        }
+        (0, http_1.send)(res, 200, {
+            proposals: proposals
+                .all()
+                .filter(visible)
+                .map((proposal) => toView(store, proposal, principal, grant)),
+        });
+        return true;
+    }
+    if (!server_config_1.definitionName.safeParse(name).success || !bundle_1.HASH_PATTERN.test(hash)) {
+        (0, http_1.send)(res, 404, { error: 'not found' });
+        return true;
+    }
+    const proposal = proposals.get(name, hash);
+    if (!action) {
+        if (req.method !== 'GET') {
+            (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'GET' });
+            return true;
+        }
+        proposal && visible(proposal)
+            ? (0, http_1.send)(res, 200, toView(store, proposal, principal, grant))
+            : (0, http_1.send)(res, 404, { error: 'not found' });
+        return true;
+    }
+    if (action === 'files') {
+        if (req.method !== 'GET') {
+            (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'GET' });
+            return true;
+        }
+        // the files are for who decides, and for who wrote them
+        const bundle = proposal && visible(proposal) ? proposals.bundle(name, hash) : undefined;
+        bundle ? (0, http_1.send)(res, 200, bundle) : (0, http_1.send)(res, 404, { error: 'not found' });
+        return true;
+    }
+    if (req.method !== 'POST') {
+        (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'POST' });
+        return true;
+    }
+    const body = decisionSchema.safeParse(req.headers['content-type'] ? await (0, http_1.readJson)(req) : {});
+    if (!body.success) {
+        const issue = body.error.issues[0];
+        (0, http_1.send)(res, 400, { error: `${issue.path.join('.') || 'request'}: ${issue.message}` });
+        return true;
+    }
+    const outcome = action === 'approve' ? 'approved' : 'rejected';
+    try {
+        const result = await proposals.decide(principal, name, hash, outcome, (proposed) => (0, exports.mayApprove)(grant, proposed), async (bundle) => {
+            const proposed = proposals.get(name, hash);
+            // looked at again here, just before it is published
+            const latest = store.find(name, 'latest')?.hash ?? null;
+            if (proposed && latest !== proposed.base) {
+                throw new proposals_1.StaleProposalError(proposed.base, latest);
+            }
+            await store.publish(name, bundle, proposed?.proposedBy ?? principal, principal);
+        }, body.data.reason);
+        log(`${action} proposal=${name}@${hash} iss=${principal.iss} sub=${principal.sub} result=${result.status}${body.data.reason ? ` reason=${(0, oauth_1.quote)(body.data.reason)}` : ''}`);
+        switch (result.status) {
+            case 'ok':
+                (0, http_1.send)(res, 200, toView(store, result.proposal, principal, grant));
+                break;
+            case 'own-proposal':
+                (0, http_1.send)(res, 403, { error: 'a version is approved by somebody else than who proposed it' });
+                break;
+            case 'not-waiting':
+                (0, http_1.send)(res, 409, { error: `the proposal is ${result.state}, it does not wait for an approval` });
+                break;
+            default:
+                (0, http_1.send)(res, 404, { error: 'not found' });
+        }
+    }
+    catch (e) {
+        if (e instanceof proposals_1.StaleProposalError) {
+            log(`${action} proposal=${name}@${hash} iss=${principal.iss} sub=${principal.sub} result=stale`);
+            (0, http_1.send)(res, 409, { error: e.message });
+            return true;
+        }
+        if (e instanceof definitions_1.DefinitionError) {
+            (0, http_1.send)(res, 400, { error: `the build file does not load: ${e.message}` });
+            return true;
+        }
+        throw e;
+    }
+    return true;
+}
+exports.handleProposals = handleProposals;
+//# sourceMappingURL=proposals-api.js.map

package/dist/server/proposals.js

@@ -0,0 +1,173 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProposalRegistry = exports.StaleProposalError = exports.CooldownError = exports.ProposalError = void 0;
+const units_1 = require("../utils/units");
+class ProposalError extends Error {
+    constructor() {
+        super(...arguments);
+        // what the caller is told
+        this.status = 503;
+    }
+}
+exports.ProposalError = ProposalError;
+// The caller proposes too soon after a rejection
+class CooldownError extends ProposalError {
+    constructor() {
+        super(...arguments);
+        this.status = 429;
+    }
+}
+exports.CooldownError = CooldownError;
+// The build file moved on since the proposal was made
+class StaleProposalError extends Error {
+    constructor(base, latest) {
+        super(`the build file changed since this was proposed (it follows ${base ?? 'nothing'}, the latest is ${latest ?? 'nothing'}), propose it again on top of the latest`);
+        this.base = base;
+        this.latest = latest;
+    }
+}
+exports.StaleProposalError = StaleProposalError;
+// The proposals of the server, in memory: a restart forgets what waits, and
+// whoever proposed it proposes it again. Nothing in here is runnable.
+class ProposalRegistry {
+    constructor(options = {}) {
+        this.entries = new Map();
+        this.closed = false;
+        this.maxWaiting = options.maxWaiting ?? 100;
+        this.timeout = options.timeout ?? 60 * 60 * 1000;
+        this.keep = options.keep ?? 100;
+        this.cooldown = options.cooldown ?? 0;
+        this.now = options.now ?? Date.now;
+    }
+    // Proposing what already waits is not an error and changes nothing.
+    propose(version, bundle, proposer, missing = [], base = null) {
+        if (this.closed) {
+            throw new ProposalError('the server is shutting down');
+        }
+        const key = this.key(version.name, version.hash);
+        const existing = this.entries.get(key);
+        if (existing && existing.proposal.state === 'waiting') {
+            return { proposal: { ...existing.proposal }, created: false };
+        }
+        this.checkCooldown(version, proposer);
+        if (this.waiting().length >= this.maxWaiting) {
+            throw new ProposalError('too many build file versions are waiting for an approval');
+        }
+        const proposal = {
+            name: version.name,
+            hash: version.hash,
+            entry: version.entry,
+            tasks: version.tasks,
+            services: version.services,
+            accounts: version.accounts ?? [],
+            missing,
+            plan: version.plan ?? {},
+            base,
+            proposedBy: { iss: proposer.iss, sub: proposer.sub },
+            createdAt: new Date(this.now()).toISOString(),
+            expiresAt: new Date(this.now() + this.timeout).toISOString(),
+            state: 'waiting',
+        };
+        const entry = { proposal, bundle };
+        entry.timer = setTimeout(() => this.settle(entry, 'expired'), this.timeout);
+        entry.timer.unref();
+        this.entries.delete(key);
+        this.entries.set(key, entry);
+        this.evict();
+        return { proposal: { ...proposal }, created: true };
+    }
+    waiting() {
+        return [...this.entries.values()].filter((e) => e.proposal.state === 'waiting').map((e) => ({ ...e.proposal }));
+    }
+    // Everything kept, newest first.
+    all() {
+        return [...this.entries.values()].map((e) => ({ ...e.proposal })).reverse();
+    }
+    get(name, hash) {
+        const entry = this.entries.get(this.key(name, hash));
+        return entry ? { ...entry.proposal } : undefined;
+    }
+    // The files of one that still waits, for whoever decides on it.
+    bundle(name, hash) {
+        return this.entries.get(this.key(name, hash))?.bundle;
+    }
+    // An approval publishes the files first (`publish`), and only then is the
+    // proposal approved, so it never claims a version that is not there. Nobody
+    // decides on their own proposal.
+    async decide(decider, name, hash, outcome, mayDecide, publish, reason) {
+        const entry = this.entries.get(this.key(name, hash));
+        if (!entry || !mayDecide(entry.proposal)) {
+            return { status: 'not-found' };
+        }
+        if (entry.proposal.proposedBy.iss === decider.iss && entry.proposal.proposedBy.sub === decider.sub) {
+            return { status: 'own-proposal' };
+        }
+        if (entry.proposal.state !== 'waiting' || !entry.bundle) {
+            return { status: 'not-waiting', state: entry.proposal.state };
+        }
+        if (outcome === 'approved') {
+            await publish(entry.bundle);
+            if (entry.proposal.state !== 'waiting') {
+                return { status: 'not-waiting', state: entry.proposal.state };
+            }
+        }
+        this.settle(entry, outcome, { iss: decider.iss, sub: decider.sub }, reason);
+        return { status: 'ok', proposal: { ...entry.proposal } };
+    }
+    close() {
+        this.closed = true;
+        for (const entry of this.entries.values()) {
+            if (entry.timer) {
+                clearTimeout(entry.timer);
+                entry.timer = undefined;
+            }
+        }
+    }
+    settle(entry, state, by, reason) {
+        if (entry.proposal.state !== 'waiting') {
+            return;
+        }
+        if (entry.timer) {
+            clearTimeout(entry.timer);
+            entry.timer = undefined;
+        }
+        entry.proposal.state = state;
+        entry.proposal.decidedAt = new Date(this.now()).toISOString();
+        if (by) {
+            entry.proposal.decidedBy = by;
+        }
+        if (reason) {
+            entry.proposal.reason = reason;
+        }
+        entry.bundle = undefined;
+    }
+    // A rejection is a no; a proposal that only ran out of time is not.
+    checkCooldown(version, proposer) {
+        if (this.cooldown <= 0) {
+            return;
+        }
+        for (const { proposal } of this.entries.values()) {
+            if (proposal.state !== 'rejected' || proposal.name !== version.name) {
+                continue;
+            }
+            const left = Date.parse(proposal.decidedAt ?? '') + this.cooldown - this.now();
+            const sameVersion = proposal.hash === version.hash;
+            const sameProposer = proposal.proposedBy.iss === proposer.iss && proposal.proposedBy.sub === proposer.sub;
+            if (left > 0 && (sameVersion || sameProposer)) {
+                throw new CooldownError(`${sameVersion ? 'this version was' : 'a version of this build file by you was'} rejected, ` +
+                    `propose again in ${(0, units_1.formatDuration)(Math.ceil(left / 1000) * 1000)}`);
+            }
+        }
+    }
+    evict() {
+        const decided = [...this.entries.entries()].filter(([, e]) => e.proposal.state !== 'waiting');
+        for (const [key] of decided.slice(0, Math.max(0, decided.length - this.keep))) {
+            this.entries.delete(key);
+        }
+    }
+    key(name, hash) {
+        return `${name}@${hash}`;
+    }
+}
+exports.ProposalRegistry = ProposalRegistry;
+//# sourceMappingURL=proposals.js.map

package/dist/server/repo-access.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RepoAccess = void 0;
+const redact_1 = require("../utils/redact");
+const provider_values_1 = require("../secrets/provider-values");
+const git_checkout_1 = require("./git-checkout");
+const repo_1 = require("./repo");
+// A token is read again after this long, so a short-lived one (a GitHub App
+// installation token minted by the provider command) is not used up and a revoked one
+// stops working soon.
+const TOKEN_TTL_MS = 60 * 1000;
+// A run waits for the repository at submit, not forever
+const RESOLVE_TIMEOUT_MS = 30 * 1000;
+/**
+ * The repositories a server can run code from. What may be read is the operator's
+ * `sources` list; who may name which of them is the entitlement's `repos`. The read
+ * credential is a secret of a provider, read as a service account that nobody can use
+ * in a task. It is handed to git for one fetch through the environment of that git
+ * process (never an argument, never `.git/config`, never the environment of a task)
+ * and masked in whatever the run logs.
+ */
+class RepoAccess {
+    constructor(config, 
+    // the base environment of the server's runs, with `hosted` set
+    environment, options = {}) {
+        this.config = config;
+        this.environment = environment;
+        this.options = options;
+        this.tokens = new Map();
+        this.now = options.now ?? Date.now;
+    }
+    // The first source that covers the repository: patterns are listed from the most
+    // specific to the least.
+    source(repo) {
+        return this.config.sources.find((source) => (0, repo_1.matchesAnyRepo)([source.match], repo));
+    }
+    readable(repo) {
+        return this.source(repo) !== undefined;
+    }
+    url(repo) {
+        return this.options.url ? this.options.url(repo) : `https://${repo}.git`;
+    }
+    // The commit a ref points to now, or an error that says what is wrong with the ref.
+    async resolve(repo, ref, signal) {
+        const timeout = AbortSignal.timeout(RESOLVE_TIMEOUT_MS);
+        const abort = signal ? AbortSignal.any([signal, timeout]) : timeout;
+        if (this.options.resolve) {
+            return this.options.resolve(repo, ref, abort);
+        }
+        const credentials = await this.credentials(repo);
+        try {
+            return await (0, git_checkout_1.resolveRef)(this.url(repo), ref, credentials.env, abort);
+        }
+        catch (e) {
+            throw this.scrub(e, credentials.values);
+        }
+    }
+    /**
+     * The environment a git process needs to read the repository: the allowlisted
+     * variables of the server, and the token as a header of requests to that host. The
+     * values are what the run has to mask.
+     */
+    async credentials(repo) {
+        const env = {};
+        for (const [key, value] of Object.entries(this.environment.processEnvs)) {
+            if (value !== undefined) {
+                env[key] = value;
+            }
+        }
+        const secret = this.source(repo)?.secret;
+        if (!secret) {
+            return { env, values: [] };
+        }
+        const token = await this.token(secret);
+        const host = repo.split('/')[0];
+        const header = `Authorization: Basic ${Buffer.from(`${secret.username}:${token}`).toString('base64')}`;
+        env.GIT_CONFIG_COUNT = '1';
+        env.GIT_CONFIG_KEY_0 = `http.https://${host}/.extraHeader`;
+        env.GIT_CONFIG_VALUE_0 = header;
+        return { env, values: [token, header] };
+    }
+    async token(secret) {
+        const key = `${secret.account}\0${secret.from}`;
+        const known = this.tokens.get(key);
+        if (known && this.now() - known.at < TOKEN_TTL_MS) {
+            return known.value;
+        }
+        const catalog = this.environment.hosted?.catalog;
+        const kind = secret.from.substring(0, secret.from.indexOf(':'));
+        const ref = secret.from.substring(secret.from.indexOf(':') + 1);
+        const provider = catalog.providers[kind];
+        const account = catalog.accounts[secret.account];
+        const credentials = account?.providers[kind];
+        if (!provider || !credentials) {
+            throw new Error(`the source credential ${secret.from} as ${secret.account} is not defined`);
+        }
+        // a fresh environment per read: values are kept here and for a short time only
+        const registry = (0, redact_1.createSecretRegistry)();
+        const environment = {
+            ...this.environment,
+            secrets: registry,
+            hosted: { catalog, accounts: [secret.account] },
+        };
+        let value;
+        try {
+            value = await (0, provider_values_1.fetchProviderValue)({ definition: provider, account: { name: secret.account, env: credentials.env } }, ref, environment);
+        }
+        catch (e) {
+            throw new Error(`could not read the source credential ${secret.from}: ${e instanceof Error ? e.message : e}`);
+        }
+        if (value.length === 0) {
+            throw new Error(`the source credential ${secret.from} is empty`);
+        }
+        this.tokens.set(key, { value, at: this.now() });
+        return value;
+    }
+    // An error as the caller may read it: without the token.
+    scrub(error, values) {
+        const registry = (0, redact_1.createSecretRegistry)();
+        values.forEach((value) => registry.register(value));
+        const message = error instanceof Error ? error.message : String(error);
+        const scrubbed = new (error instanceof Error ? error.constructor : Error)(registry.redact(message));
+        return scrubbed;
+    }
+}
+exports.RepoAccess = RepoAccess;
+//# sourceMappingURL=repo-access.js.map

package/dist/server/repo.js

@@ -0,0 +1,94 @@
+"use strict";
+// Repositories are named `host/path`, such as `github.com/corp/payments` or
+// `gitlab.corp.com/platform/team/tool`, so one pattern can cover a GitHub
+// organisation or a GitLab group with its subgroups. Names are compared in
+// lower case: both hosts treat them that way.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.matchesRef = exports.matchesAnyRepo = exports.matchesRepo = exports.normalizeRepoPattern = exports.isRepoPattern = exports.normalizeRepo = void 0;
+const SEGMENT = /^[a-z0-9._-]+$/;
+const PATTERN_SEGMENT = /^[a-z0-9._*-]+$/;
+// `host/path` of what a caller or an operator wrote, or null when it is not a
+// plain repository address: no credentials, port, query, option-like names or
+// `..`. A scheme (`https://`) and a trailing `.git` are accepted and dropped.
+function normalizeRepo(input) {
+    let value = input.trim().toLowerCase();
+    value = value.replace(/^https:\/\//, '');
+    value = value.replace(/\.git$/, '').replace(/\/+$/, '');
+    const parts = value.split('/');
+    if (parts.length < 2 || parts.length > 12) {
+        return null;
+    }
+    const [host, ...path] = parts;
+    if (!/^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/.test(host) || host.includes('..')) {
+        return null;
+    }
+    if (path.some((part) => !SEGMENT.test(part) || part === '.' || part === '..' || part.startsWith('-'))) {
+        return null;
+    }
+    return [host, ...path].join('/');
+}
+exports.normalizeRepo = normalizeRepo;
+// A pattern is a repository where a segment may hold `*` (any characters but `/`),
+// and the last one may be `**`: everything below, subgroups included.
+function isRepoPattern(input) {
+    const value = input
+        .trim()
+        .toLowerCase()
+        .replace(/^https:\/\//, '')
+        .replace(/\/+$/, '');
+    const parts = value.split('/');
+    if (parts.length < 2 || !/^[a-z0-9*]([a-z0-9.*-]*[a-z0-9*])?$/.test(parts[0])) {
+        return false;
+    }
+    return parts.slice(1).every((part, index, rest) => {
+        if (part === '**') {
+            return index === rest.length - 1;
+        }
+        return PATTERN_SEGMENT.test(part) && part !== '.' && part !== '..' && !part.startsWith('-') && !part.includes('**');
+    });
+}
+exports.isRepoPattern = isRepoPattern;
+function normalizeRepoPattern(input) {
+    return input
+        .trim()
+        .toLowerCase()
+        .replace(/^https:\/\//, '')
+        .replace(/\/+$/, '');
+}
+exports.normalizeRepoPattern = normalizeRepoPattern;
+function matchesRepo(pattern, repo) {
+    const parts = normalizeRepoPattern(pattern).split('/');
+    const target = repo.split('/');
+    const last = parts[parts.length - 1];
+    if (last === '**') {
+        const fixed = parts.slice(0, -1);
+        return target.length > fixed.length && fixed.every((part, index) => segmentMatches(part, target[index]));
+    }
+    return parts.length === target.length && parts.every((part, index) => segmentMatches(part, target[index]));
+}
+exports.matchesRepo = matchesRepo;
+function segmentMatches(pattern, segment) {
+    const regex = pattern
+        .split('*')
+        .map((part) => part.replace(/[.+?^${}()|[\]\\]/g, '\\$&'))
+        .join('[^/]*');
+    return new RegExp(`^${regex}$`).test(segment);
+}
+function matchesAnyRepo(patterns, repo) {
+    return patterns.some((pattern) => matchesRepo(pattern, repo));
+}
+exports.matchesAnyRepo = matchesAnyRepo;
+// A ref is matched as written: `main`, `release/*` (one level) or `release/**`.
+function matchesRef(patterns, ref) {
+    return patterns.some((pattern) => {
+        const parts = pattern.split('/');
+        const target = ref.split('/');
+        if (parts[parts.length - 1] === '**') {
+            const fixed = parts.slice(0, -1);
+            return target.length > fixed.length && fixed.every((part, index) => segmentMatches(part, target[index]));
+        }
+        return parts.length === target.length && parts.every((part, index) => segmentMatches(part, target[index]));
+    });
+}
+exports.matchesRef = matchesRef;
+//# sourceMappingURL=repo.js.map

package/dist/server/run-environment.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runEnvironment = void 0;
+// What a run sees of the server's environment: the variables the operator listed
+// in `runs.env.allow`, and the fixed ones of `runs.env.set`. The credentials of a
+// run are not among them, they exist only as the secrets of an account.
+function runEnvironment(config, processEnvs) {
+    const passed = {};
+    for (const name of config.runs.env.allow) {
+        // Windows names are not case sensitive
+        const windows = process.platform === 'win32';
+        const key = Object.keys(processEnvs).find((k) => k === name || (windows && k.toLowerCase() === name.toLowerCase()));
+        if (key !== undefined && processEnvs[key] !== undefined) {
+            passed[name] = processEnvs[key];
+        }
+    }
+    return { ...passed, ...config.runs.env.set };
+}
+exports.runEnvironment = runEnvironment;
+//# sourceMappingURL=run-environment.js.map

package/dist/server/run-plan.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.planRun = exports.getRunScopes = void 0;
+const parse_label_arguments_1 = require("../parser/parse-label-arguments");
+const plan_1 = require("./plan");
+function labels(values) {
+    return values && values.length > 0 ? (0, parse_label_arguments_1.parseLabelArguments)(values) : undefined;
+}
+// The tasks in the order they were named, one scope each; by labels when none is.
+function getRunScopes(tasks, options) {
+    return tasks.length > 0
+        ? tasks.map((task) => ({
+            name: task,
+            scope: { taskName: task, environmentName: options.env ?? null },
+        }))
+        : [
+            {
+                name: 'labels',
+                scope: {
+                    filterLabels: labels(options.filter),
+                    excludeLabels: labels(options.exclude),
+                    environmentName: options.env ?? null,
+                },
+            },
+        ];
+}
+exports.getRunScopes = getRunScopes;
+/**
+ * What a run will do, read with the engine from the files of the version it is
+ * pinned to and with the environment a run has: the same function answers at
+ * submit, and again in the executor, so what was approved is what runs.
+ */
+async function planRun(bundle, run, environment, policy) {
+    const plan = {};
+    for (const { scope } of getRunScopes(run.tasks, run.options)) {
+        Object.assign(plan, (await (0, plan_1.planBundle)(bundle, environment, { scope, policy })).plan);
+    }
+    return {
+        plan,
+        accounts: [...new Set(Object.values(plan).flatMap((entry) => entry.accounts))].sort(),
+    };
+}
+exports.planRun = planRun;
+//# sourceMappingURL=run-plan.js.map