hammerkit 1.24.0 → 1.25.0

package/dist/optimizer/get-cache-directory.js

@@ -14,7 +14,12 @@ function getCacheStatsFile(cacheId) {
     return (0, path_1.join)(getCacheDirectory(cacheId), 'stats.json');
 }
 exports.getCacheStatsFile = getCacheStatsFile;
+// `HAMMERKIT_DIR` puts hammerkit's directory (the cache) elsewhere than below the home directory;
+// a server uses it to keep the caches of runs apart.
 function getHammerkitDirectory() {
+    if (process.env.HAMMERKIT_DIR) {
+        return process.env.HAMMERKIT_DIR;
+    }
     if (process.platform === 'win32') {
         return (0, path_1.join)(process.env.APPDATA, 'hammerkit');
     }

package/dist/planner/work-secret.js

@@ -66,9 +66,13 @@ function parseSecretSource(secret, ref, cwd, envs, catalog, taskAccount, label)
     if (providerRef.length === 0 || providerRef.startsWith('-')) {
         throw new Error(`${label}: a reference for ${kind} must not be empty or start with -`);
     }
-    const accountName = secret.account ?? taskAccount ?? Object.values(catalog.accounts).find((a) => a.default)?.name;
+    const accountName = catalog.explicitAccounts
+        ? secret.account
+        : secret.account ?? taskAccount ?? Object.values(catalog.accounts).find((a) => a.default)?.name;
     if (!accountName) {
-        throw new Error(`${label}: ${kind}:${providerRef} needs an account, and none is named or marked default: true`);
+        throw new Error(catalog.explicitAccounts
+            ? `${label}: ${kind}:${providerRef} needs account: on the secret, a server uses neither a task's account nor a default`
+            : `${label}: ${kind}:${providerRef} needs an account, and none is named or marked default: true`);
     }
     const account = catalog.accounts[accountName];
     if (!account) {

package/dist/program.js

@@ -27,6 +27,7 @@ const units_1 = require("./utils/units");
 const cache_inventory_1 = require("./cache/cache-inventory");
 const remote_commands_1 = require("./remote/remote-commands");
 const server_command_1 = require("./server/server-command");
+const run_worker_command_1 = require("./server/run-worker-command");
 async function createCli(fileName, environment, workScope) {
     const { ctx, scope } = await (0, schema_parser_1.createParseContext)(fileName, environment);
     const referencedScope = await (0, reference_parser_1.parseReferences)(ctx, scope, environment);
@@ -105,6 +106,7 @@ function parseWorkLabelScope(options) {
 async function getProgram(environment, argv) {
     const program = new commander_1.Command();
     (0, server_command_1.registerServerCommand)(program, environment);
+    (0, run_worker_command_1.registerRunWorkerCommand)(program, environment);
     const parsed = (0, parse_set_arguments_1.parseSetArguments)(argv);
     const args = parsed.args;
     environment.processEnvs = { ...environment.processEnvs, ...parsed.values };

package/dist/remote/remote-commands.js

@@ -108,7 +108,7 @@ function registerRemoteCommands(program, environment, buildFile) {
             const me = await (0, server_client_1.getMe)(server, result.accessToken);
             environment.stdout.write(`signed in to ${name} as ${me.sub}\n`);
             environment.stdout.write(me.accounts.length > 0
-                ? `service accounts: ${me.accounts.join(', ')}\n`
+                ? `service accounts: ${me.accounts.map((a) => `${(0, server_client_1.printable)(a.name)} (${a.level})`).join(', ')}\n`
                 : 'you have no service accounts on this server\n');
         }
         catch (e) {
@@ -131,21 +131,25 @@ function registerRemoteCommands(program, environment, buildFile) {
         const chosen = await getServer(name);
         const token = await (0, credentials_1.getAccessToken)(environment, chosen.name, chosen.server);
         const me = await (0, server_client_1.getMe)(chosen.server, token);
-        environment.stdout.write(`${chosen.name}: ${me.sub} (${me.iss})\n`);
-        if (me.accounts.length === 0 && !(me.request && me.request.length > 0)) {
+        const { body } = await (0, server_client_1.callServer)(chosen.server, token, 'GET', '/v1/accounts');
+        environment.stdout.write(`${chosen.name}: ${(0, server_client_1.printable)(me.sub)} (${(0, server_client_1.printable)(me.iss)})\n`);
+        if (body.accounts.length === 0) {
             environment.stdout.write('no service accounts\n');
         }
-        for (const account of me.accounts) {
-            environment.stdout.write(`${account}${account === me.default ? colors_1.default.green(' (default)') : ''}\n`);
+        for (const account of body.accounts) {
+            const level = account.level === 'use' ? 'use' : 'request, somebody who uses it approves';
+            environment.stdout.write(`${colors_1.default.bold((0, server_client_1.printable)(account.name))}  ${level}${account.description ? `  ${(0, server_client_1.printable)(account.description)}` : ''}  from ${account.sources.map(server_client_1.printable).join(', ')}\n`);
         }
-        if (me.publish && me.publish.length > 0) {
-            environment.stdout.write(`may publish build files: ${me.publish.join(', ')}\n`);
+        if (me.builds) {
+            const may = {
+                run: 'run published build files',
+                propose: 'propose build files, which somebody who publishes approves',
+                publish: 'publish build files',
+            }[me.builds];
+            environment.stdout.write(`you may ${may}\n`);
         }
-        if (me.propose && me.propose.length > 0) {
-            environment.stdout.write(`may propose build files, which need an approval: ${me.propose.join(', ')}\n`);
-        }
-        if (me.request && me.request.length > 0) {
-            environment.stdout.write(`may request runs, which an admin approves: ${me.request.join(', ')}\n`);
+        if (me.repos.length > 0) {
+            environment.stdout.write(`repositories: ${me.repos.map(server_client_1.printable).join(', ')}\n`);
         }
     }));
     (0, remote_work_commands_1.registerWorkCommands)(remote, { environment, buildFile, getServer, guarded });

package/dist/remote/remote-work-commands.js

@@ -28,11 +28,38 @@ function describe(run) {
         `${colors_1.default.bold((0, server_client_1.printable)(run.id))}  requested by ${(0, server_client_1.printable)(run.requestedBy.sub)} (${(0, server_client_1.printable)(run.requestedBy.iss)})`,
         `  ${(0, server_client_1.printable)(run.definition.name)} ${(0, server_client_1.printable)(run.definition.hash)}`,
         `  tasks: ${run.tasks.length > 0 ? run.tasks.map(server_client_1.printable).join(', ') : 'selected by labels'}`,
-        `  account ${run.account === null ? 'none' : (0, server_client_1.printable)(run.account)}, source ${(0, server_client_1.printable)(source)}${options ? `, ${(0, server_client_1.printable)(options)}` : ''}`,
-        `  needs the approval of an admin of ${run.account === null ? 'none' : (0, server_client_1.printable)(run.account)}`,
-        `  decide before ${(0, server_client_1.printable)(run.approval?.expiresAt ?? '-')}`,
+        `  accounts: ${run.accounts.length > 0 ? run.accounts.map(server_client_1.printable).join(', ') : 'none'}, source ${(0, server_client_1.printable)(source)}${options ? `, ${(0, server_client_1.printable)(options)}` : ''}`,
+        ...(run.approvals ?? []).map((approval) => `  ${(0, server_client_1.printable)(approval.account)}: ${approval.approvedBy
+            ? `approved by ${(0, server_client_1.printable)(approval.approvedBy.sub)}`
+            : 'waits for somebody who uses it to approve'}`),
+        ...flagLines(run),
+        `  decide before ${(0, server_client_1.printable)(run.approvals?.[0]?.expiresAt ?? '-')}`,
     ];
 }
+// What to look at first, one line.
+function flagLines(run) {
+    const flagged = Object.entries(run.plan ?? {}).filter(([, entry]) => entry.flags.length > 0);
+    return flagged.length > 0
+        ? [
+            `  look at: ${flagged
+                .map(([name, entry]) => `${(0, server_client_1.printable)(name)} (${entry.flags.map(server_client_1.printable).join(', ')})`)
+                .join(', ')}`,
+        ]
+        : [];
+}
+// The tasks and services the run executes and what each does, never a secret's value.
+function describePlan(plan) {
+    return Object.entries(plan).flatMap(([name, entry]) => [
+        `  ${colors_1.default.bold((0, server_client_1.printable)(name))}  ${entry.kind}, ${(0, server_client_1.printable)(entry.runtime)}${entry.image ? ` ${(0, server_client_1.printable)(entry.image)}` : ''}${entry.flags.length > 0 ? `  [${entry.flags.map(server_client_1.printable).join(', ')}]` : ''}`,
+        ...entry.cmds.map((cmd) => `    $ ${(0, server_client_1.printable)(cmd)}`),
+        ...(entry.deps.length > 0 ? [`    after: ${entry.deps.map(server_client_1.printable).join(', ')}`] : []),
+        ...(entry.needs.length > 0 ? [`    needs: ${entry.needs.map(server_client_1.printable).join(', ')}`] : []),
+        ...entry.secrets.map((secret) => `    secret ${(0, server_client_1.printable)(secret.from)}${secret.account ? ` as ${(0, server_client_1.printable)(secret.account)}` : ''} -> ${(0, server_client_1.printable)(secret.target)}`),
+        ...(entry.mounts.length > 0 ? [`    mounts: ${entry.mounts.map(server_client_1.printable).join(', ')}`] : []),
+        ...(entry.ports.length > 0 ? [`    ports: ${entry.ports.map(server_client_1.printable).join(', ')}`] : []),
+        ...(entry.generates.length > 0 ? [`    generates: ${entry.generates.map(server_client_1.printable).join(', ')}`] : []),
+    ]);
+}
 function registerWorkCommands(remote, context) {
     const { environment, buildFile, getServer, guarded } = context;
     const connect = async (name) => {
@@ -75,6 +102,20 @@ function registerWorkCommands(remote, context) {
             }
         }
     }));
+    remote
+        .command('show <run> [server]')
+        .description('show a run that waits for your approval in full: the commands, secrets and accounts of its tasks')
+        .action(guarded('Remote show was not successful', async (run, name) => {
+        if (!RUN_ID.test(run)) {
+            throw new Error(`${(0, server_client_1.printable)(run)} is not a run id, list them with: hammerkit remote approvals`);
+        }
+        const { server, token } = await connect(name);
+        const view = (await (0, server_client_1.callServer)(server, token, 'GET', `/v1/approvals/${run}`)).body;
+        for (const line of describe(view)) {
+            environment.stdout.write(`${line}\n`);
+        }
+        environment.stdout.write(view.plan ? `${describePlan(view.plan).join('\n')}\n` : 'the server did not record what its tasks do\n');
+    }));
     remote
         .command('proposals [server]')
         .description('list the proposed versions of build files you made or may approve')
@@ -92,6 +133,17 @@ function registerWorkCommands(remote, context) {
             environment.stdout.write(`${colors_1.default.bold(`${(0, server_client_1.printable)(proposal.name)}@${(0, server_client_1.printable)(proposal.hash)}`)}  proposed by ${who}, ${state}\n`);
             const names = [...proposal.tasks, ...proposal.services];
             environment.stdout.write(`  tasks and services: ${names.map(server_client_1.printable).join(', ') || 'none'}\n`);
+            if (proposal.accounts.length > 0) {
+                environment.stdout.write(`  accounts: ${proposal.accounts.map(server_client_1.printable).join(', ')}${proposal.missing.length > 0
+                    ? `, the proposer does not use ${proposal.missing.map(server_client_1.printable).join(', ')}`
+                    : ''}\n`);
+            }
+            for (const line of flagLines(proposal)) {
+                environment.stdout.write(`${line}\n`);
+            }
+            if (proposal.stale) {
+                environment.stdout.write(`  stale: ${(0, server_client_1.printable)(proposal.name)} has a newer version, reject it and propose again on top of it\n`);
+            }
             if (proposal.state === 'waiting') {
                 environment.stdout.write(`  decide before ${(0, server_client_1.printable)(proposal.expiresAt)}\n`);
             }
@@ -117,9 +169,29 @@ function registerWorkCommands(remote, context) {
             : undefined;
         environment.stdout.write(`${(0, server_client_1.printable)(proposal.name)}@${(0, server_client_1.printable)(proposal.hash)} on ${serverName}, proposed by ${(0, server_client_1.printable)(view.proposedBy.sub)} (${(0, server_client_1.printable)(view.proposedBy.iss)})\n`);
         environment.stdout.write(base ? `compared with ${(0, server_client_1.printable)(view.base)}\n` : 'no version is published yet, everything is new\n');
+        if (view.stale) {
+            environment.stdout.write(`warning: ${(0, server_client_1.printable)(proposal.name)} has a newer version (${(0, server_client_1.printable)(view.latest)}), this can only be rejected\n`);
+        }
         const lines = (0, text_diff_1.diffBundles)(base, proposed);
         environment.stdout.write(lines.length > 0 ? `${lines.join('\n')}\n` : 'the files are the same\n');
     }));
+    for (const action of ['yank', 'unyank']) {
+        remote
+            .command(`${action} <version> [server]`)
+            .description(action === 'yank'
+            ? 'pull a published version (name@hash) back: no run starts from it and it is not latest'
+            : 'let a yanked version (name@hash) go on')
+            .addOption(new commander_1.Option('--reason <text>', 'why, shown to whoever tries to run it').argParser((value) => value))
+            .action(guarded(`Remote ${action} was not successful`, async (target, name, options) => {
+            const version = parseProposal(target);
+            if (!version) {
+                throw new Error(`${(0, server_client_1.printable)(target)} is not a version, name it like payments@sha256:...`);
+            }
+            const { name: serverName, server, token } = await connect(name);
+            await (0, server_client_1.callServer)(server, token, 'POST', `/v1/definitions/${encodeURIComponent(version.name)}/${version.hash}/${action}`, options.reason ? { reason: options.reason } : undefined);
+            environment.stdout.write(`${action === 'yank' ? 'yanked' : 'let go on'} ${(0, server_client_1.printable)(target)} on ${serverName}\n`);
+        }));
+    }
     for (const action of ['approve', 'reject']) {
         remote
             .command(`${action} <target> [server]`)

package/dist/schema/reference-parser.js

@@ -26,8 +26,12 @@ async function parseReferences(ctx, mainScope, environment) {
         projectRoot: await (0, project_root_1.findProjectRoot)(mainScope.cwd, environment),
     };
     for (const file of Object.values(ctx.files)) {
+        if (environment.hosted && (file.schema.secretProviders || file.schema.secretAccounts)) {
+            throw new Error(`${file.fileName} declares secret providers or accounts, which a server defines in its own config`);
+        }
         if (!reference.envFiles[file.cwd]) {
-            reference.envFiles[file.cwd] = await (0, read_env_file_1.readEnvFile)(file.cwd, environment);
+            // a server does not read the `.env` of a checkout: it is code of the project
+            reference.envFiles[file.cwd] = environment.hosted ? {} : await (0, read_env_file_1.readEnvFile)(file.cwd, environment);
         }
         const buildFileEnvs = file.schema.envs;
         if (file.schema.tasks) {
@@ -92,7 +96,9 @@ async function parseReferences(ctx, mainScope, environment) {
         resolveInit(reference, service);
     }
     reference.caches = (0, resolve_cache_1.withBuiltinCaches)(declaredCaches);
-    reference.secrets = (0, secret_catalog_1.collectSecretCatalog)(Object.values(ctx.files), environment, reference);
+    reference.secrets = environment.hosted
+        ? { ...environment.hosted.catalog, explicitAccounts: true }
+        : (0, secret_catalog_1.collectSecretCatalog)(Object.values(ctx.files), environment, reference);
     return reference;
 }
 exports.parseReferences = parseReferences;

package/dist/secrets/provider-values.js

@@ -16,6 +16,10 @@ function keyOf(binding, ref) {
     return [binding.definition.name, binding.account.name, ref].join('\0');
 }
 function fetchProviderValue(binding, ref, environment) {
+    const allowed = environment.hosted?.accounts;
+    if (allowed && !allowed.includes(binding.account.name)) {
+        return Promise.reject(new Error(`the run may not read secrets as ${binding.account.name}`));
+    }
     let values = runs.get(environment);
     if (!values) {
         values = new Map();

package/dist/server/accounts-api.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleAccounts = void 0;
+const http_1 = require("./http");
+const policy_1 = require("./policy");
+/**
+ * Who the caller is and what they may do:
+ *
+ *   GET /v1/me         identity, accounts with their level, repositories and the builds level
+ *   GET /v1/accounts   the accounts the caller has a level on, with what the operator says about them
+ */
+async function handleAccounts(config, log, principal, req, res, url) {
+    if (url.pathname !== '/v1/me' && url.pathname !== '/v1/accounts') {
+        return false;
+    }
+    if (req.method !== 'GET') {
+        (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'GET' });
+        return true;
+    }
+    const grant = (0, policy_1.getGrant)(config.entitlements, principal);
+    const accounts = Object.entries(grant.accounts)
+        .sort(([a], [b]) => (a < b ? -1 : 1))
+        .map(([name, level]) => ({ name, level }));
+    if (url.pathname === '/v1/me') {
+        log(`grant iss=${principal.iss} sub=${principal.sub} accounts=[${accounts
+            .map((account) => `${account.name}:${account.level}`)
+            .join(',')}] entitlements=[${grant.matched.join(',')}]`);
+        (0, http_1.send)(res, 200, { iss: principal.iss, sub: principal.sub, accounts, repos: grant.repos, builds: grant.builds });
+        return true;
+    }
+    (0, http_1.send)(res, 200, {
+        accounts: accounts.map(({ name, level }) => ({
+            name,
+            ...(config.accounts[name]?.description ? { description: config.accounts[name].description } : {}),
+            level,
+            sources: config.accounts[name]?.source ?? ['upload', 'ref'],
+        })),
+    });
+    return true;
+}
+exports.handleAccounts = handleAccounts;
+//# sourceMappingURL=accounts-api.js.map

package/dist/server/approvals-api.js

@@ -17,15 +17,16 @@ function toApprovalView(run) {
         createdAt: run.createdAt,
         definition: run.definition,
         tasks: run.tasks,
-        account: run.account,
+        accounts: run.accounts,
+        plan: run.plan,
         source: run.source,
         options: run.options,
-        approval: run.approval,
+        approvals: run.approvals,
     };
 }
 /**
- * The runs waiting for an approval, which an admin of the service account they
- * use gives:
+ * The runs waiting for an approval, which somebody who uses the accounts they
+ * need gives (one person is enough when they use all of them):
  *
  *   GET  /v1/approvals                  the runs the caller may approve
  *   GET  /v1/approvals/<id>             one of them
@@ -42,7 +43,7 @@ async function handleApprovals(config, registry, log, principal, req, res, url)
     }
     const [, id, action] = match;
     const grant = (0, policy_1.getGrant)(config.entitlements, principal);
-    const canDecide = (account) => (0, policy_1.isAdmin)(grant, account);
+    const canDecide = (account) => (0, policy_1.canUse)(grant, account);
     if (!id) {
         if (req.method !== 'GET') {
             (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'GET' });
@@ -50,7 +51,8 @@ async function handleApprovals(config, registry, log, principal, req, res, url)
         }
         const open = registry
             .waiting()
-            .filter((run) => !(run.owner.iss === principal.iss && run.owner.sub === principal.sub) && canDecide(run.account));
+            .filter((run) => !(run.owner.iss === principal.iss && run.owner.sub === principal.sub) &&
+            (run.approvals ?? []).some((approval) => !approval.approvedBy && canDecide(approval.account)));
         (0, http_1.send)(res, 200, { approvals: open.map(toApprovalView) });
         return true;
     }
@@ -90,6 +92,9 @@ async function handleApprovals(config, registry, log, principal, req, res, url)
         case 'not-waiting':
             (0, http_1.send)(res, 409, { error: `the run is ${result.state}, it does not wait for an approval` });
             break;
+        case 'already-approved':
+            (0, http_1.send)(res, 409, { error: 'you approved all you can, the run waits for somebody who uses the other accounts' });
+            break;
         default:
             (0, http_1.send)(res, 404, { error: 'not found' });
     }

package/dist/server/definitions-api.js

@@ -1,9 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleDefinitions = void 0;
+const zod_1 = require("zod");
 const bundle_1 = require("../remote/bundle");
 const definitions_1 = require("./definitions");
 const http_1 = require("./http");
+const oauth_1 = require("./oauth");
 const policy_1 = require("./policy");
 const proposals_1 = require("./proposals");
 const server_config_1 = require("./server-config");
@@ -18,13 +20,16 @@ const MAX_PUBLISH_BYTES = bundle_1.MAX_BUNDLE_BYTES * 2;
  *   GET  /v1/definitions/<name>                 the versions of one
  *   GET  /v1/definitions/<name>/<hash|latest>   one version
  *   GET  /v1/definitions/<name>/<hash|latest>/files   the files of one version
+ *   POST /v1/definitions/<name>/<hash>/yank     pull a version back (body: optional {reason})
+ *   POST /v1/definitions/<name>/<hash>/unyank   let it go on
  */
 async function handleDefinitions(config, store, proposals, log, principal, req, res, url) {
-    const match = /^\/v1\/definitions(?:\/([^/]+)(?:\/([^/]+)(\/files)?)?)?$/.exec(url.pathname);
+    const match = /^\/v1\/definitions(?:\/([^/]+)(?:\/([^/]+)(\/files|\/yank|\/unyank)?)?)?$/.exec(url.pathname);
     if (!match) {
         return false;
     }
-    const [, name, version, files] = match;
+    const [, name, version, suffix] = match;
+    const files = suffix === '/files';
     const grant = (0, policy_1.getGrant)(config.entitlements, principal);
     if (name !== undefined && !server_config_1.definitionName.safeParse(name).success) {
         (0, http_1.send)(res, 404, { error: 'not found' });
@@ -34,8 +39,14 @@ async function handleDefinitions(config, store, proposals, log, principal, req,
         await publish(config, store, proposals, log, principal, name, req, res);
         return true;
     }
+    if ((suffix === '/yank' || suffix === '/unyank') && req.method === 'POST') {
+        await yank(config, store, log, principal, name, version, suffix === '/unyank', req, res);
+        return true;
+    }
     if (req.method !== 'GET') {
-        (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: name !== undefined && !version ? 'GET, PUT' : 'GET' });
+        (0, http_1.send)(res, 405, { error: 'method not allowed' }, {
+            allow: suffix === '/yank' || suffix === '/unyank' ? 'POST' : name !== undefined && !version ? 'GET, PUT' : 'GET',
+        });
         return true;
     }
     // what the caller may not see does not exist for them
@@ -71,12 +82,40 @@ async function handleDefinitions(config, store, proposals, log, principal, req,
     return true;
 }
 exports.handleDefinitions = handleDefinitions;
+const yankSchema = zod_1.z.object({ reason: zod_1.z.string().max(500).optional() }).strict();
+// Yanking is allowed to who publishes the build file or uses an account the version
+// uses; letting a version go on again is the publisher's call.
+async function yank(config, store, log, principal, name, hash, undo, req, res) {
+    const grant = (0, policy_1.getGrant)(config.entitlements, principal);
+    const version = bundle_1.HASH_PATTERN.test(hash) ? store.find(name, hash) : undefined;
+    if (!version || !(0, policy_1.maySeeDefinitions)(grant)) {
+        (0, http_1.send)(res, 404, { error: 'not found' });
+        return;
+    }
+    if (undo ? !(0, policy_1.mayPublish)(grant) : !(0, policy_1.mayYank)(grant, version)) {
+        log(`refuse ${undo ? 'unyank' : 'yank'} ${name}@${hash} iss=${principal.iss} sub=${principal.sub}`);
+        (0, http_1.send)(res, 403, {
+            error: undo
+                ? 'a version is let go on by who publishes the build file'
+                : 'a version is yanked by who publishes the build file or uses an account it uses',
+        });
+        return;
+    }
+    const body = yankSchema.safeParse(req.headers['content-type'] ? await (0, http_1.readJson)(req) : {});
+    if (!body.success) {
+        const issue = body.error.issues[0];
+        (0, http_1.send)(res, 400, { error: `${issue.path.join('.') || 'request'}: ${issue.message}` });
+        return;
+    }
+    const changed = await store.yank(name, hash, principal, { reason: body.data.reason, undo });
+    log(`${undo ? 'unyank' : 'yank'} ${name}@${hash} iss=${principal.iss} sub=${principal.sub}${body.data.reason ? ` reason=${(0, oauth_1.quote)(body.data.reason)}` : ''}`);
+    (0, http_1.send)(res, 200, changed);
+}
 async function publish(config, store, proposals, log, principal, name, req, res) {
     const grant = (0, policy_1.getGrant)(config.entitlements, principal);
-    const direct = (0, policy_1.mayPublish)(grant, name);
-    if (!direct && !(0, policy_1.mayPropose)(grant, name)) {
-        log(`refuse publish iss=${principal.iss} sub=${principal.sub}: build file ${name} is not granted`);
-        (0, http_1.send)(res, 403, { error: `you may not publish ${name}` });
+    if (!(0, policy_1.mayPublish)(grant) && !(0, policy_1.mayPropose)(grant)) {
+        log(`refuse publish iss=${principal.iss} sub=${principal.sub}: no builds permission`);
+        (0, http_1.send)(res, 403, { error: `you may not publish ${name}, it needs builds: propose or publish` });
         return;
     }
     const parsed = bundle_1.bundleSchema.safeParse(await (0, http_1.readJson)(req, MAX_PUBLISH_BYTES));
@@ -86,22 +125,27 @@ async function publish(config, store, proposals, log, principal, name, req, res)
         return;
     }
     try {
-        if (!direct) {
-            // a version can't run before it is approved, but it has to load, as it would
-            // have when published, so the approver is not asked about a broken one
-            const { version, existing } = await store.prepare(name, parsed.data, principal);
-            if (existing) {
-                (0, http_1.send)(res, 200, { ...existing, created: false });
-                return;
-            }
-            const { proposal, created } = proposals.propose(version, parsed.data, principal);
-            log(`propose ${name} ${proposal.hash} iss=${principal.iss} sub=${principal.sub} created=${created} tasks=${proposal.tasks.length}`);
+        // a version can't run before it is approved, but it has to load, as it would
+        // have when published, so the approver is not asked about a broken one
+        const { version, existing } = await store.prepare(name, parsed.data, principal, {
+            noRemote: !(0, policy_1.mayPublish)(grant),
+        });
+        if (existing) {
+            (0, http_1.send)(res, 200, { ...existing, created: false });
+            return;
+        }
+        // a version that names an account is published by somebody who uses it; anyone
+        // else proposes it, and somebody who does approves it (four eyes)
+        const missing = (version.accounts ?? []).filter((account) => !(0, policy_1.canUse)(grant, account));
+        if (!(0, policy_1.mayPublish)(grant) || missing.length > 0) {
+            const { proposal, created } = proposals.propose(version, parsed.data, principal, missing, store.find(name, 'latest')?.hash ?? null);
+            log(`propose ${name} ${proposal.hash} iss=${principal.iss} sub=${principal.sub} created=${created} tasks=${proposal.tasks.length} missing=[${missing.join(',')}]`);
             (0, http_1.send)(res, created ? 202 : 200, { ...proposal, created });
             return;
         }
-        const { version, created } = await store.publish(name, parsed.data, principal);
-        log(`publish ${name} ${version.hash} iss=${principal.iss} sub=${principal.sub} created=${created} tasks=${version.tasks.length}`);
-        (0, http_1.send)(res, created ? 201 : 200, { ...version, created });
+        const { version: published, created } = await store.publish(name, parsed.data, principal);
+        log(`publish ${name} ${published.hash} iss=${principal.iss} sub=${principal.sub} created=${created} tasks=${published.tasks.length}`);
+        (0, http_1.send)(res, created ? 201 : 200, { ...published, created });
     }
     catch (e) {
         if (e instanceof definitions_1.DefinitionError) {
@@ -110,7 +154,7 @@ async function publish(config, store, proposals, log, principal, name, req, res)
             return;
         }
         if (e instanceof proposals_1.ProposalError) {
-            (0, http_1.send)(res, 503, { error: e.message });
+            (0, http_1.send)(res, e.status, { error: e.message });
             return;
         }
         throw e;