hammerkit 1.27.0-next.21 → 1.27.0-next.23

package/dist/schema/reference-parser.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.findService = exports.findTask = exports.parseReferences = void 0;
+exports.findService = exports.findTask = exports.parseReferences = exports.getPublishedFiles = void 0;
 const build_file_task_schema_1 = require("./build-file-task-schema");
 const build_file_service_schema_1 = require("./build-file-service-schema");
 const split_name_1 = require("../planner/utils/split-name");
@@ -10,11 +10,59 @@ const merge_environment_variables_1 = require("../environment/merge-environment-
 const resolve_cache_1 = require("../cache/resolve-cache");
 const project_root_1 = require("../planner/project-root");
 const secret_catalog_1 = require("../secrets/secret-catalog");
+const host_config_1 = require("../remote/host-config");
+// The providers and accounts of the host config, see HostSecretDeclarations
+async function readHostSecrets(environment) {
+    const config = await (0, host_config_1.readHostConfig)(environment);
+    return {
+        fileName: (0, host_config_1.getHostConfigPath)(environment),
+        secretProviders: config.secretProviders,
+        secretAccounts: config.secretAccounts,
+    };
+}
+// What a task or service names that a server left out (`publish: false`)
+class UnpublishedError extends Error {
+    constructor(name, reason) {
+        super(`${name} is not published (${reason})`);
+        this.name = name;
+        this.reason = reason;
+    }
+}
+// The task or service `user` names another one by, which a server left out: the error says
+// which published one still needs it, as an error elsewhere is left as it is
+function findPublished(user, verb, find) {
+    try {
+        return find();
+    }
+    catch (e) {
+        if (e instanceof UnpublishedError) {
+            throw new Error(`${user} ${verb} ${e.name}, which is not published (${e.reason})`);
+        }
+        throw e;
+    }
+}
+// The build files a server publishes: the entry file and what it includes or references,
+// except through an include with `publish: false`. The key of each is in ctx.files.
+function getPublishedFiles(mainScope) {
+    const published = new Set([mainScope]);
+    const queue = [mainScope];
+    for (let scope = queue.shift(); scope; scope = queue.shift()) {
+        for (const reference of Object.values(scope.references)) {
+            if (reference.publish && !published.has(reference.scope)) {
+                published.add(reference.scope);
+                queue.push(reference.scope);
+            }
+        }
+    }
+    return published;
+}
+exports.getPublishedFiles = getPublishedFiles;
 function combinePath(namePrefix, name) {
     return namePrefix.length > 0 ? `${namePrefix}:${name}` : name;
 }
 async function parseReferences(ctx, mainScope, environment) {
     const declaredCaches = {};
+    const unpublished = {};
     const reference = {
         files: {},
         tasks: {},
@@ -24,9 +72,28 @@ async function parseReferences(ctx, mainScope, environment) {
         caches: {},
         secrets: (0, secret_catalog_1.emptySecretCatalog)(),
         projectRoot: await (0, project_root_1.findProjectRoot)(mainScope.cwd, environment),
+        unpublished,
+    };
+    // a server leaves out what is not published: it doesn't run, and isn't checked against
+    // its policy. Locally everything is there.
+    const publishedFiles = environment.hosted ? getPublishedFiles(mainScope) : null;
+    const isLeftOut = (file, name, schema) => {
+        if (!publishedFiles) {
+            return false;
+        }
+        if (!publishedFiles.has(file)) {
+            unpublished[name] = 'its build file is included with publish: false';
+        }
+        else if (schema.publish === false) {
+            unpublished[name] = 'publish: false';
+        }
+        return name in unpublished;
     };
     for (const file of Object.values(ctx.files)) {
-        if (environment.hosted && (file.schema.secretProviders || file.schema.secretAccounts)) {
+        // what a server leaves out of a file it doesn't publish: its tasks and services (see
+        // isLeftOut), and where it would run or store things, which only a local run reads
+        const published = !publishedFiles || publishedFiles.has(file);
+        if (published && environment.hosted && (file.schema.secretProviders || file.schema.secretAccounts)) {
             throw new Error(`${file.fileName} declares secret providers or accounts, which a server defines in its own config`);
         }
         if (!reference.envFiles[file.cwd]) {
@@ -38,6 +105,9 @@ async function parseReferences(ctx, mainScope, environment) {
             for (const [taskName, task] of Object.entries(file.schema.tasks)) {
                 const taskEnvs = (0, merge_environment_variables_1.mergeEnvironmentVariables)(task.envs, buildFileEnvs);
                 const relativeName = combinePath(file.namePrefix, taskName);
+                if (isLeftOut(file, relativeName, task)) {
+                    continue;
+                }
                 reference.tasks[relativeName] = {
                     type: 'task',
                     schema: task,
@@ -51,7 +121,7 @@ async function parseReferences(ctx, mainScope, environment) {
                 };
             }
         }
-        if (file.schema.environments) {
+        if (file.schema.environments && published) {
             for (const [envName, env] of Object.entries(file.schema.environments)) {
                 reference.environments[envName] = {
                     type: 'environment',
@@ -61,7 +131,7 @@ async function parseReferences(ctx, mainScope, environment) {
                 };
             }
         }
-        if (file.schema.caches) {
+        if (file.schema.caches && published) {
             for (const [cacheName, cache] of Object.entries(file.schema.caches)) {
                 declaredCaches[cacheName] = cache;
             }
@@ -69,6 +139,9 @@ async function parseReferences(ctx, mainScope, environment) {
         if (file.schema.services) {
             for (const [serviceName, service] of Object.entries(file.schema.services)) {
                 const relativeName = combinePath(file.namePrefix, serviceName);
+                if (isLeftOut(file, relativeName, service)) {
+                    continue;
+                }
                 const serviceEnvs = (0, merge_environment_variables_1.mergeEnvironmentVariables)((0, build_file_service_schema_1.isBuildFileKubernetesServiceSchema)(service) ? {} : service.envs, buildFileEnvs);
                 reference.services[relativeName] = {
                     type: 'service',
@@ -98,7 +171,7 @@ async function parseReferences(ctx, mainScope, environment) {
     reference.caches = (0, resolve_cache_1.withBuiltinCaches)(declaredCaches);
     reference.secrets = environment.hosted
         ? { ...environment.hosted.catalog, explicitAccounts: true }
-        : (0, secret_catalog_1.collectSecretCatalog)(Object.values(ctx.files), environment, reference);
+        : (0, secret_catalog_1.collectSecretCatalog)(Object.values(ctx.files), environment, reference, await readHostSecrets(environment));
     return reference;
 }
 exports.parseReferences = parseReferences;
@@ -122,7 +195,8 @@ function applySchemaExtension(reference, task) {
         task.extension = 'applied';
         return;
     }
-    const extend = findTask(reference, task.scope, task.schema.extend, null).task;
+    const name = task.schema.extend;
+    const extend = findPublished(task.relativeName, 'extends', () => findTask(reference, task.scope, name, null)).task;
     applySchemaExtension(reference, extend);
     task.schema.shell = task.schema.shell ?? extend.schema.shell;
     task.schema.cache = task.schema.cache ?? extend.schema.cache;
@@ -182,7 +256,7 @@ function extendObject(base, extend) {
 }
 function resolveDeps(reference, taskOrService, scope, schema) {
     for (const depName of schema.deps || []) {
-        const depTask = findTask(reference, scope, depName, null);
+        const depTask = findPublished(taskOrService.relativeName, 'depends on', () => findTask(reference, scope, depName, null));
         taskOrService.deps.push({
             task: depTask.task,
             type: depTask.type,
@@ -195,7 +269,8 @@ function resolveInit(reference, service) {
     if ((0, build_file_service_schema_1.isBuildFileKubernetesServiceSchema)(service.schema) || !service.schema.init) {
         return;
     }
-    const initTask = findTask(reference, service.scope, service.schema.init, null);
+    const init = service.schema.init;
+    const initTask = findPublished(service.relativeName, 'runs as init', () => findTask(reference, service.scope, init, null));
     service.init = {
         task: initTask.task,
         type: initTask.type,
@@ -213,13 +288,13 @@ function resolveNeeds(reference, taskOrService, scope, schema) {
                 // the host name it is reached by: a service of an include, `services:postgres`, as
                 // `services-postgres`, since Docker and DNS take no colon
                 relativeName: needName.replace(/:/g, '-'),
-                service: findService(reference, scope, needName),
+                service: findPublished(taskOrService.relativeName, 'needs', () => findService(reference, scope, needName)),
             });
         }
         else {
             taskOrService.needs.push({
                 relativeName: needName.name,
-                service: findService(reference, scope, needName.service),
+                service: findPublished(taskOrService.relativeName, 'needs', () => findService(reference, scope, needName.service)),
             });
         }
     }
@@ -230,6 +305,7 @@ function resolveNeeds(reference, taskOrService, scope, schema) {
     }
 }
 function findTask(ctx, scope, name, type) {
+    refuseNotFetched(scope, name);
     const ref = (0, split_name_1.splitName)(name);
     if (ref.prefix) {
         if (scope.references[ref.prefix]) {
@@ -245,15 +321,25 @@ function findTask(ctx, scope, name, type) {
     throw new Error('unable to find ' + name); // TODO improve
 }
 exports.findTask = findTask;
+// A name in a git source a server did not fetch, since it is left out
+function refuseNotFetched(scope, name) {
+    if (scope.notFetched) {
+        throw new UnpublishedError(combinePath(scope.namePrefix, name), 'its build file is included with publish: false');
+    }
+}
 function resolveTask(ctx, scope, name, type) {
     const fullName = combinePath(scope.namePrefix, name);
     const buildFileTask = ctx.tasks[fullName];
+    if (!buildFileTask && ctx.unpublished?.[fullName]) {
+        throw new UnpublishedError(fullName, ctx.unpublished[fullName]);
+    }
     if (!buildFileTask) {
         throw new Error('unable to find ' + fullName);
     }
     return { task: buildFileTask, type };
 }
 function findService(ctx, scope, name) {
+    refuseNotFetched(scope, name);
     const ref = (0, split_name_1.splitName)(name);
     if (ref.prefix) {
         if (scope.references[ref.prefix]) {
@@ -272,6 +358,9 @@ exports.findService = findService;
 function resolveService(ctx, scope, name) {
     const fullName = combinePath(scope.namePrefix, name);
     const service = ctx.services[fullName];
+    if (!service && ctx.unpublished?.[fullName]) {
+        throw new UnpublishedError(fullName, ctx.unpublished[fullName]);
+    }
     if (!service) {
         throw new Error('unable to find ' + fullName);
     }

package/dist/schema/schema-parser.js

@@ -13,60 +13,79 @@ async function createParseContext(fileName, environment, options) {
         files: {},
         refreshed: options?.refresh ? new Map() : undefined,
         directory: options?.directory,
+        checkGitSource: options?.checkGitSource,
     };
     const scope = await appendBuildFile(workDirectory(ctx, (0, path_1.dirname)(fileName)), ctx, environment, fileName, []);
     return { ctx, scope };
 }
 exports.createParseContext = createParseContext;
-async function appendBuildFile(cwd, ctx, environment, fileName, namePrefix, remote, inputs) {
+async function appendBuildFile(cwd, ctx, environment, fileName, namePrefix, remote, inputs, 
+// on a server: the file is included with `publish: false`, or below such an include
+leftOut = false) {
     const relativeName = namePrefix.join(':');
-    // the same file included with other inputs is another set of tasks
-    const key = inputs ? `${cwd}:${fileName}:${JSON.stringify(inputs)}` : `${cwd}:${fileName}`;
+    // the same file included with other inputs is another set of tasks, and on a server a
+    // file left out is another one than the same file published (its git sources differ)
+    const key = `${cwd}:${fileName}${inputs ? `:${JSON.stringify(inputs)}` : ''}${leftOut ? ':left-out' : ''}`;
     if (ctx.files[key]) {
         return ctx.files[key];
     }
     const input = await (0, read_build_file_1.read)(fileName, environment);
     const result = await build_file_schema_1.buildFileSchema.safeParseAsync(input);
-    if (result.success) {
-        const scope = {
-            fileName,
-            cwd,
-            schema: inputs ? applyInputs(result.data, inputs, namePrefix, fileName) : result.data,
-            namePrefix: relativeName,
-            remote,
-            inputs,
-            references: {},
-        };
-        ctx.files[key] = scope;
-        if (scope.schema.references) {
-            for (const referenceName of Object.keys(scope.schema.references)) {
-                const target = await locateInclude(ctx, scope, scope.schema.references[referenceName], 
-                // a remote file's paths resolve within its repository
-                remote ? (0, path_1.dirname)(scope.fileName) : readDirectory(ctx, scope.cwd), environment);
-                const referenceScope = await appendBuildFile(workDirectory(ctx, (0, path_1.dirname)(target.fileName)), ctx, environment, target.fileName, [...namePrefix, referenceName], target.remote, target.inputs);
-                if (scope.references[referenceName]) {
-                    throw new Error(referenceName + ' already exists');
-                }
-                scope.references[referenceName] = { type: 'reference', scope: referenceScope };
+    if (!result.success) {
+        throw new parse_error_1.ParseError(result.error, fileName);
+    }
+    const scope = {
+        fileName,
+        cwd,
+        schema: inputs ? applyInputs(result.data, inputs, namePrefix, fileName) : result.data,
+        namePrefix: relativeName,
+        remote,
+        inputs,
+        references: {},
+    };
+    ctx.files[key] = scope;
+    for (const block of ['references', 'includes']) {
+        for (const [name, include] of Object.entries(scope.schema[block] ?? {})) {
+            if (scope.references[name]) {
+                throw new Error(name + ' already exists');
             }
-        }
-        if (scope.schema.includes) {
-            for (const includeName of Object.keys(scope.schema.includes)) {
-                const target = await locateInclude(ctx, scope, scope.schema.includes[includeName], (0, path_1.dirname)(scope.fileName), environment);
-                const includeScope = await appendBuildFile(cwd, ctx, environment, target.fileName, [...namePrefix, includeName], target.remote, target.inputs);
-                if (scope.references[includeName]) {
-                    throw new Error(includeName + ' already exists');
-                }
-                scope.references[includeName] = { type: 'include', scope: includeScope };
+            const publish = (0, build_file_include_schema_1.isPublished)(include);
+            const type = block === 'references' ? 'reference' : 'include';
+            // a server does not fetch what it leaves out: it doesn't run, and isn't checked
+            const leaveOut = !!environment.hosted && (leftOut || !publish);
+            if ((0, build_file_include_schema_1.isGitSource)(include) && leaveOut) {
+                scope.references[name] = { type, publish, scope: notFetched(cwd, [...namePrefix, name], include) };
+                continue;
+            }
+            if ((0, build_file_include_schema_1.isGitSource)(include)) {
+                ctx.checkGitSource?.(include, scope, block, name);
             }
+            const target = await locateInclude(ctx, scope, include, block === 'references'
+                ? // a remote file's paths resolve within its repository
+                    remote
+                        ? (0, path_1.dirname)(scope.fileName)
+                        : readDirectory(ctx, scope.cwd)
+                : (0, path_1.dirname)(scope.fileName), environment);
+            const targetScope = await appendBuildFile(
+            // a reference works in its own directory, an include in the one of the including file
+            block === 'references' ? workDirectory(ctx, (0, path_1.dirname)(target.fileName)) : cwd, ctx, environment, target.fileName, [...namePrefix, name], target.remote, target.inputs, leaveOut);
+            scope.references[name] = { type, scope: targetScope, publish };
         }
-        return scope;
-    }
-    else {
-        throw new parse_error_1.ParseError(result.error, fileName);
     }
+    return scope;
 }
 exports.appendBuildFile = appendBuildFile;
+// The scope of a git source a server does not fetch, see ParseScope.notFetched
+function notFetched(cwd, namePrefix, include) {
+    return {
+        fileName: `${include.git}${include.path ? ` ${include.path}` : ''}`,
+        cwd,
+        schema: {},
+        namePrefix: namePrefix.join(':'),
+        references: {},
+        notFetched: true,
+    };
+}
 // The directory a build file works in, for the directory it was read from: the same
 // one, unless the files were read from elsewhere (see BuildFileDirectory).
 function workDirectory(ctx, directory) {

package/dist/secrets/command-secret-provider.js

@@ -150,9 +150,11 @@ function candidates(command, path) {
             .map((dir) => (0, path_1.resolve)(dir, command));
     return bases.flatMap((base) => extensions.map((extension) => base + extension));
 }
+// bigint: a Windows file id has more digits than a number keeps, and two files whose ids
+// round to the same number would be the same file
 function statOf(path) {
     try {
-        const stat = (0, fs_1.statSync)(path);
+        const stat = (0, fs_1.statSync)(path, { bigint: true });
         return stat.isFile() ? stat : null;
     }
     catch {

package/dist/secrets/secret-catalog.js

@@ -11,10 +11,12 @@ function emptySecretCatalog() {
 exports.emptySecretCatalog = emptySecretCatalog;
 const FULL_COMMIT = /^[0-9a-f]{40}$/i;
 // Providers and accounts are global names, like caches, collected from every
-// loaded build file. A name declared twice is an error rather than a silent
-// override: which definition runs with a service account's credential must not
-// depend on include order.
-function collectSecretCatalog(files, environment, context) {
+// loaded build file. A name declared twice is an error rather than a silent override:
+// which definition runs with a service account's credential must not depend on include
+// order. The host config then replaces what the build files declare, name by name (and
+// its default account replaces theirs): the machine that runs a task says how it reads
+// secrets, and a build file that still declares them loads as it is.
+function collectSecretCatalog(files, environment, context, host) {
     const catalog = emptySecretCatalog();
     for (const file of files) {
         const providers = Object.entries(file.schema.secretProviders ?? {});
@@ -28,25 +30,13 @@ function collectSecretCatalog(files, environment, context) {
             if (catalog.providers[name]) {
                 throw new Error(`secret provider ${name} is declared in ${catalog.providers[name].declaredIn} and in ${file.fileName}`);
             }
-            catalog.providers[name] = {
-                name,
-                type: 'command',
-                command: provider.command.map((part) => applyEnvs(part, envs)),
-                env: provider.env ?? {},
-                timeoutMs: (0, units_1.parseDuration)(provider.timeout ?? DEFAULT_TIMEOUT),
-                declaredIn: file.fileName,
-            };
+            catalog.providers[name] = toProvider(name, provider, envs, file.fileName);
         }
         for (const [name, account] of accounts) {
             if (catalog.accounts[name]) {
                 throw new Error(`secret account ${name} is declared in ${catalog.accounts[name].declaredIn} and in ${file.fileName}`);
             }
-            catalog.accounts[name] = {
-                name,
-                default: account.default ?? false,
-                providers: account.providers,
-                declaredIn: file.fileName,
-            };
+            catalog.accounts[name] = toAccount(name, account, file.fileName);
         }
     }
     const defaults = Object.values(catalog.accounts).filter((account) => account.default);
@@ -55,14 +45,48 @@ function collectSecretCatalog(files, environment, context) {
     }
     for (const account of Object.values(catalog.accounts)) {
         for (const provider of Object.keys(account.providers)) {
-            if (!catalog.providers[provider]) {
+            if (!catalog.providers[provider] && !host?.secretProviders?.[provider]) {
                 throw new Error(`secret account ${account.name} (${account.declaredIn}) names provider ${provider}, which is not declared`);
             }
         }
     }
+    if (host) {
+        // the host config has no envs of its own: `${NAME}` is read from the process
+        for (const [name, provider] of Object.entries(host.secretProviders ?? {})) {
+            catalog.providers[name] = toProvider(name, provider, {}, host.fileName);
+        }
+        const accounts = Object.entries(host.secretAccounts ?? {});
+        const hostDefaults = accounts.filter(([, account]) => account.default);
+        if (hostDefaults.length > 1) {
+            throw new Error(`more than one default secret account: ${hostDefaults.map(([name]) => name).join(', ')} (${host.fileName})`);
+        }
+        if (hostDefaults.length > 0) {
+            for (const account of Object.values(catalog.accounts)) {
+                account.default = false;
+            }
+        }
+        // a provider an account of the host names is only checked when a secret uses it:
+        // a project that doesn't declare it, and reads no secret, loads anyway
+        for (const [name, account] of accounts) {
+            catalog.accounts[name] = toAccount(name, account, host.fileName);
+        }
+    }
     return catalog;
 }
 exports.collectSecretCatalog = collectSecretCatalog;
+function toProvider(name, provider, envs, declaredIn) {
+    return {
+        name,
+        type: 'command',
+        command: provider.command.map((part) => applyEnvs(part, envs)),
+        env: provider.env ?? {},
+        timeoutMs: (0, units_1.parseDuration)(provider.timeout ?? DEFAULT_TIMEOUT),
+        declaredIn,
+    };
+}
+function toAccount(name, account, declaredIn) {
+    return { name, default: account.default ?? false, providers: account.providers, declaredIn };
+}
 // A tag or branch can be moved, and a moved file runs with the credentials of a
 // service account: providers and accounts from a git include are pinned.
 function requirePinnedSource(file) {

package/dist/server/definitions-api.js

@@ -23,10 +23,22 @@ const MAX_PUBLISH_BYTES = bundle_1.MAX_BUNDLE_BYTES * 2;
  *   GET  /v1/definitions/<hash>          one version, with `arguments`: per task null when
  *                                        a run of it may pass arguments, else why not
  *   GET  /v1/definitions/<hash>/files    its files
+ *   POST /v1/definitions/plan            what publishing a bundle would do: plans it with this
+ *                                        server's policy and stores nothing. For anybody with
+ *                                        a `builds` level, `run` too
  *   POST /v1/definitions/<hash>/yank     pull it back (body: optional {reason})
  *   POST /v1/definitions/<hash>/unyank   let it go on
  */
 async function handleDefinitions(config, store, proposals, log, principal, req, res, url) {
+    if (url.pathname === '/v1/definitions/plan') {
+        if (req.method !== 'POST') {
+            (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'POST' });
+        }
+        else {
+            await plan(config, store, log, principal, req, res);
+        }
+        return true;
+    }
     const match = /^\/v1\/definitions(?:\/([^/]+)(\/files|\/yank|\/unyank)?)?$/.exec(url.pathname);
     if (!match) {
         return false;
@@ -124,6 +136,55 @@ async function yank(config, store, log, principal, hash, undo, req, res) {
     log(`${undo ? 'unyank' : 'yank'} ${hash} iss=${principal.iss} sub=${principal.sub}${body.data.reason ? ` reason=${(0, oauth_1.quote)(body.data.reason)}` : ''}`);
     (0, http_1.send)(res, 200, changed);
 }
+// Answers what POST /v1/definitions would: the version with its plan, and whether the
+// caller would publish or propose it. A developer checks a build file against the policy
+// before the account that publishes does. Nothing is stored, nothing is logged but the call.
+async function plan(config, store, log, principal, req, res) {
+    const grant = (0, policy_1.getGrant)(config.entitlements, principal);
+    if (grant.builds === null) {
+        (0, http_1.send)(res, 403, { error: 'you may not check build files, it needs builds: run, propose or publish' });
+        return;
+    }
+    const parsed = bundle_1.bundleSchema.safeParse(await (0, http_1.readJson)(req, MAX_PUBLISH_BYTES));
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        (0, http_1.send)(res, 400, { error: `${issue.path.join('.') || 'request'}: ${issue.message}` });
+        return;
+    }
+    try {
+        // like a proposal: a caller who may not publish does not make the server fetch
+        const { version, existing } = await store.prepare(parsed.data, principal, {
+            noRemote: (0, policy_1.mayPublish)(grant) ? undefined : 'check',
+        });
+        const missing = (version.accounts ?? []).filter((account) => !(0, policy_1.canUse)(grant, account));
+        const outcome = existing
+            ? 'already published'
+            : (0, policy_1.mayPublish)(grant) && missing.length === 0
+                ? 'published'
+                : (0, policy_1.mayPublish)(grant) || (0, policy_1.mayPropose)(grant)
+                    ? 'proposed'
+                    : null;
+        log(`plan ${version.hash} iss=${principal.iss} sub=${principal.sub} tasks=${version.tasks.length}`);
+        (0, http_1.send)(res, 200, {
+            hash: version.hash,
+            tasks: version.tasks,
+            services: version.services,
+            plan: version.plan,
+            accounts: version.accounts,
+            outcome,
+            // a yanked version is not checked again: it is the one that was published
+            ...(existing?.yanked ? { yanked: true } : {}),
+            ...(missing.length > 0 ? { missing } : {}),
+        });
+    }
+    catch (e) {
+        if (e instanceof definitions_1.DefinitionError) {
+            (0, http_1.send)(res, 400, { error: `the build file does not load: ${e.message}` });
+            return;
+        }
+        throw e;
+    }
+}
 async function publish(config, store, proposals, log, principal, req, res) {
     const grant = (0, policy_1.getGrant)(config.entitlements, principal);
     if (!(0, policy_1.mayPublish)(grant) && !(0, policy_1.mayPropose)(grant)) {
@@ -151,7 +212,7 @@ async function publish(config, store, proposals, log, principal, req, res) {
         // a version can't run before it is approved, but it has to load, as it would
         // have when published, so the approver is not asked about a broken one
         const { version, existing } = await store.prepare(parsed.data, principal, {
-            noRemote: !(0, policy_1.mayPublish)(grant),
+            noRemote: (0, policy_1.mayPublish)(grant) ? undefined : 'proposal',
             annotations,
         });
         if (existing) {

package/dist/server/executor.js

@@ -238,6 +238,7 @@ class HostExecutor {
                         }
                         : {}),
                     ...(placed ? { kubernetes: placed.kubernetes } : {}),
+                    ...(!placed && this.options.capabilityRuntime ? { capabilityRuntime: this.options.capabilityRuntime } : {}),
                 }, cwd, { ...this.processEnvironment(home, cache), ...placed?.env }, context, abortCtrl.signal);
             }
             finally {