@calltelemetry/ct-lab-mcp 0.1.0

package/dist/src/guardrails/safety.js

@@ -0,0 +1,217 @@
+/**
+ * Safety Guardrails Engine
+ * Protects core infrastructure, persistent fixtures, and template VMs against disruptive or destructive operations.
+ * Enforces non-bypassable guardrails across Proxmox VE and VMware ESXi.
+ */
+import { ProtectedVmViolationError } from "./types.js";
+export * from "./types.js";
+export class SafetyGuardrailEngine {
+    protectedVmIds;
+    protectedNamePatterns;
+    protectedTags;
+    constructor(customProtectedVmIds = [], options = {}) {
+        // Standard protected core lab fixtures across Proxmox VE & VMware ESXi
+        this.protectedVmIds = new Set([
+            // Proxmox Core Fixtures
+            100, // OpenClaw1
+            101, // ctclaw
+            102, // 0.8.7-stable / import fixture
+            103, // CUBE voice gateways
+            104, // CUCM15-PMX-PUBLISHER
+            // VMware ESXi Core Fixtures
+            "CUCM14-01-6-30",
+            "CUCM15-01-6-29",
+            "CUCM15-02-6-30",
+            "CUCM-115Cluster1",
+            "CUBE-8000V-[SIP-LAB]-cube-lab",
+            "GH-Runner",
+            "LAB-K8S-192.168.125.118",
+            "CT-087-STABLE-TEMPLATE",
+            "CT-ALMALINUX9-TEMPLATE",
+            "CT-ALMALINUX9-MINI-TEMPLATE",
+            ...customProtectedVmIds,
+            ...(options.customProtectedVmIds || [])
+        ]);
+        this.protectedNamePatterns = [
+            /^(cucm|cube|cat8000v|openclaw|ctclaw|infra|pve|gh-runner|lab-k8s)/i,
+            /(publisher|subscriber|golden|base-template|persistent)/i,
+            /^template-/i,
+            /cucm/i,
+            /cube/i,
+            /cat8000v/i,
+            /gh-runner/i,
+            /lab-k8s/i,
+            /almalinux.*template/i,
+            /stable.*template/i,
+            ...(options.customProtectedPatterns || [])
+        ];
+        this.protectedTags = new Set([
+            "protected",
+            "persistent",
+            "fixture",
+            "infra",
+            "cucm",
+            "cube",
+            "production",
+            "do-not-delete",
+            "runner",
+            "ci",
+            "k8s",
+            "golden",
+            "cat8000v",
+            "voice",
+            ...(options.customProtectedTags || []).map((t) => t.toLowerCase().trim())
+        ]);
+    }
+    /**
+     * Check whether a VM is considered protected by ID, template flag, name, tag, or note.
+     */
+    isProtected(vm) {
+        const vmName = vm.name || `VM-${vm.vmid}`;
+        const vmidStr = String(vm.vmid).trim();
+        const vmidNum = typeof vm.vmid === "number" ? vm.vmid : parseInt(vmidStr, 10);
+        // 1. Check explicit protected VMID (number or string identifier)
+        if (this.protectedVmIds.has(vm.vmid) || this.protectedVmIds.has(vmidStr)) {
+            return {
+                protected: true,
+                reason: `VMID ${vm.vmid} is in the explicit protected core infrastructure list (e.g. CUCM/fixtures)`
+            };
+        }
+        // 2. Check numeric template VMID range (9000-9999) for Proxmox
+        if (!isNaN(vmidNum) && vmidNum >= 9000 && vmidNum <= 9999) {
+            return {
+                protected: true,
+                reason: `VMID ${vm.vmid} falls within the reserved template VMID range (9000-9999)`
+            };
+        }
+        // 3. Check Proxmox/ESXi template flag
+        if (vm.template === true ||
+            vm.template === 1 ||
+            vm.template === "1" ||
+            vm.template === "true" ||
+            vm.isTemplate === true) {
+            return {
+                protected: true,
+                reason: `VM ${vm.vmid} ('${vmName}') is configured as a Proxmox VM template`
+            };
+        }
+        // 4. Check explicit isProtected flag
+        if (vm.isProtected === true) {
+            return {
+                protected: true,
+                reason: vm.protectionReason || `VM ${vm.vmid} ('${vmName}') has explicit protection flag enabled`
+            };
+        }
+        // 5. Check name patterns
+        if (vm.name) {
+            for (const pattern of this.protectedNamePatterns) {
+                if (pattern.test(vm.name)) {
+                    return {
+                        protected: true,
+                        reason: `VM name '${vm.name}' matches protected pattern ${pattern}`
+                    };
+                }
+            }
+        }
+        // 6. Check protected tags
+        const tags = this.normalizeTags(vm.tags);
+        for (const tag of tags) {
+            if (this.protectedTags.has(tag)) {
+                return {
+                    protected: true,
+                    reason: `VM ${vm.vmid} contains protected tag '${tag}'`
+                };
+            }
+        }
+        // 7. Check protected annotations / notes
+        if (vm.notes) {
+            const notesLower = vm.notes.toLowerCase();
+            if (notesLower.includes("never destroy") ||
+                notesLower.includes("do not stop") ||
+                notesLower.includes("do not delete") ||
+                notesLower.includes("protected") ||
+                notesLower.includes("core server") ||
+                notesLower.includes("required for tests") ||
+                notesLower.includes("core infrastructure")) {
+                return {
+                    protected: true,
+                    reason: `VM ${vm.vmid} notes indicate protected status ('${vm.notes.trim()}')`
+                };
+            }
+        }
+        return { protected: false };
+    }
+    /**
+     * Validates if the requested action is permitted on the target VM.
+     * Throws ProtectedVmViolationError if a destructive/disruptive action is attempted on a protected VM.
+     * This check is NON-BYPASSABLE, even if force === true.
+     */
+    validateAction(vm, action, _force = false) {
+        const normalizedAction = (action || "").toLowerCase().trim();
+        const vmName = vm.name || `VM-${vm.vmid}`;
+        // Read-only actions and start (power on) are permitted
+        const isSafeAction = ["status", "config", "rrddata", "start"].includes(normalizedAction);
+        if (isSafeAction) {
+            return;
+        }
+        const protection = this.isProtected(vm);
+        if (protection.protected) {
+            // Destructive and disruptive actions are ALWAYS rejected on protected VMs
+            const isDisruptiveOrDestructive = [
+                "stop",
+                "shutdown",
+                "reboot",
+                "reset",
+                "suspend",
+                "destroy",
+                "delete",
+                "force-stop"
+            ].includes(normalizedAction);
+            if (isDisruptiveOrDestructive) {
+                throw new ProtectedVmViolationError(vm.vmid, vmName, normalizedAction, protection.reason || "Protected infrastructure policy");
+            }
+        }
+    }
+    /**
+     * Helper to normalize tags from array or delimited string.
+     */
+    normalizeTags(tags) {
+        if (!tags)
+            return [];
+        if (Array.isArray(tags)) {
+            return tags.map((t) => t.toLowerCase().trim()).filter(Boolean);
+        }
+        return tags
+            .split(/[;, ]+/)
+            .map((t) => t.toLowerCase().trim())
+            .filter(Boolean);
+    }
+    /**
+     * Add additional protected VMID at runtime.
+     */
+    addProtectedVmId(vmid) {
+        this.protectedVmIds.add(vmid);
+    }
+    /**
+     * Get list of all explicitly protected VMIDs.
+     */
+    getProtectedVmIds() {
+        return Array.from(this.protectedVmIds).sort((a, b) => {
+            if (typeof a === "number" && typeof b === "number")
+                return a - b;
+            return String(a).localeCompare(String(b));
+        });
+    }
+}
+/**
+ * Default global instance of SafetyGuardrailEngine
+ */
+export const defaultSafetyGuardrailEngine = new SafetyGuardrailEngine();
+/**
+ * Convenience function conforming to PROJECT.md interface contract:
+ * assertActionPermitted(vm, action, force)
+ */
+export function assertActionPermitted(vm, action, force = false, engine = defaultSafetyGuardrailEngine) {
+    engine.validateAction(vm, action, force);
+}
+//# sourceMappingURL=safety.js.map

package/dist/src/guardrails/safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safety.js","sourceRoot":"","sources":["../../../src/guardrails/safety.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAGL,yBAAyB,EAG1B,MAAM,YAAY,CAAC;AAEpB,cAAc,YAAY,CAAC;AAE3B,MAAM,OAAO,qBAAqB;IACxB,cAAc,CAAuB;IACrC,qBAAqB,CAAW;IAChC,aAAa,CAAc;IAEnC,YAAY,uBAA4C,EAAE,EAAE,UAAkC,EAAE;QAC9F,uEAAuE;QACvE,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,CAAC;YAC5B,wBAAwB;YACxB,GAAG,EAAE,YAAY;YACjB,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,gCAAgC;YACrC,GAAG,EAAE,sBAAsB;YAC3B,GAAG,EAAE,uBAAuB;YAE5B,4BAA4B;YAC5B,gBAAgB;YAChB,gBAAgB;YAChB,gBAAgB;YAChB,kBAAkB;YAClB,+BAA+B;YAC/B,WAAW;YACX,yBAAyB;YACzB,wBAAwB;YACxB,wBAAwB;YACxB,6BAA6B;YAE7B,GAAG,oBAAoB;YACvB,GAAG,CAAC,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,qBAAqB,GAAG;YAC3B,oEAAoE;YACpE,yDAAyD;YACzD,aAAa;YACb,OAAO;YACP,OAAO;YACP,WAAW;YACX,YAAY;YACZ,UAAU;YACV,sBAAsB;YACtB,mBAAmB;YACnB,GAAG,CAAC,OAAO,CAAC,uBAAuB,IAAI,EAAE,CAAC;SAC3C,CAAC;QAEF,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,CAAC;YAC3B,WAAW;YACX,YAAY;YACZ,SAAS;YACT,OAAO;YACP,MAAM;YACN,MAAM;YACN,YAAY;YACZ,eAAe;YACf,QAAQ;YACR,IAAI;YACJ,KAAK;YACL,QAAQ;YACR,UAAU;YACV,OAAO;YACP,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;SAC1E,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,EAAY;QACtB,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAE9E,iEAAiE;QACjE,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACzE,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,6EAA6E;aACrG,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YAC1D,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,4DAA4D;aACpF,CAAC;QACJ,CAAC;QAED,sCAAsC;QACtC,IACE,EAAE,CAAC,QAAQ,KAAK,IAAI;YACpB,EAAE,CAAC,QAAQ,KAAK,CAAC;YACjB,EAAE,CAAC,QAAQ,KAAK,GAAG;YACnB,EAAE,CAAC,QAAQ,KAAK,MAAM;YACtB,EAAE,CAAC,UAAU,KAAK,IAAI,EACtB,CAAC;YACD,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,MAAM,EAAE,CAAC,IAAI,MAAM,MAAM,2CAA2C;aAC7E,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,IAAI,EAAE,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,EAAE,CAAC,gBAAgB,IAAI,MAAM,EAAE,CAAC,IAAI,MAAM,MAAM,yCAAyC;aAClG,CAAC;QACJ,CAAC;QAED,yBAAyB;QACzB,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACZ,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBACjD,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,OAAO;wBACL,SAAS,EAAE,IAAI;wBACf,MAAM,EAAE,YAAY,EAAE,CAAC,IAAI,+BAA+B,OAAO,EAAE;qBACpE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,0BAA0B;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChC,OAAO;oBACL,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,MAAM,EAAE,CAAC,IAAI,4BAA4B,GAAG,GAAG;iBACxD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAC1C,IACE,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC;gBACpC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAClC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC;gBACpC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAChC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAClC,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC;gBACzC,UAAU,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAC1C,CAAC;gBACD,OAAO;oBACL,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,MAAM,EAAE,CAAC,IAAI,sCAAsC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI;iBAC/E,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,EAAY,EAAE,MAAoB,EAAE,MAAM,GAAG,KAAK;QAC/D,MAAM,gBAAgB,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAE1C,uDAAuD;QACvD,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACzF,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YACzB,0EAA0E;YAC1E,MAAM,yBAAyB,GAAG;gBAChC,MAAM;gBACN,UAAU;gBACV,QAAQ;gBACR,OAAO;gBACP,SAAS;gBACT,SAAS;gBACT,QAAQ;gBACR,YAAY;aACb,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;YAE7B,IAAI,yBAAyB,EAAE,CAAC;gBAC9B,MAAM,IAAI,yBAAyB,CACjC,EAAE,CAAC,IAAI,EACP,MAAM,EACN,gBAAgB,EAChB,UAAU,CAAC,MAAM,IAAI,iCAAiC,CACvD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,IAAwB;QAC5C,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,IAAI;aACR,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;aAClC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,IAAqB;QACpC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACnD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,qBAAqB,EAAE,CAAC;AAExE;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,EAAY,EACZ,MAAoB,EACpB,KAAK,GAAG,KAAK,EACb,SAAgC,4BAA4B;IAE5D,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC"}

package/dist/src/guardrails/types.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Safety Guardrails Engine Data Types
+ */
+import { HostId } from "../slot/types.js";
+export interface VmTarget {
+    vmid: number | string;
+    name?: string;
+    template?: boolean | number | string;
+    tags?: string[] | string;
+    notes?: string;
+    hostId?: HostId;
+    hypervisorType?: "proxmox" | "esxi";
+    isTemplate?: boolean;
+    isProtected?: boolean;
+    protectionReason?: string;
+}
+export type VmActionType = "status" | "config" | "rrddata" | "start" | "stop" | "shutdown" | "reboot" | "reset" | "suspend" | "destroy" | "delete" | "clone" | string;
+export declare class ProtectedVmViolationError extends Error {
+    readonly code = "PROTECTED_VM_VIOLATION";
+    readonly vmid: number | string;
+    readonly vmName: string;
+    readonly action: string;
+    readonly reason: string;
+    constructor(vmid: number | string, vmName: string, action: string, reason: string);
+}
+export interface ProtectionCheckResult {
+    protected: boolean;
+    reason?: string;
+}
+export interface SafetyGuardrailOptions {
+    customProtectedVmIds?: (number | string)[];
+    customProtectedNames?: string[];
+    customProtectedPatterns?: RegExp[];
+    customProtectedTags?: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/guardrails/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/guardrails/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IACpC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,OAAO,GACP,MAAM,GACN,UAAU,GACV,QAAQ,GACR,OAAO,GACP,SAAS,GACT,SAAS,GACT,QAAQ,GACR,OAAO,GACP,MAAM,CAAC;AAEX,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,4BAA4B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CASlF;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,oBAAoB,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IAC3C,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC"}

package/dist/src/guardrails/types.js

@@ -0,0 +1,20 @@
+/**
+ * Safety Guardrails Engine Data Types
+ */
+export class ProtectedVmViolationError extends Error {
+    code = "PROTECTED_VM_VIOLATION";
+    vmid;
+    vmName;
+    action;
+    reason;
+    constructor(vmid, vmName, action, reason) {
+        const message = `PROTECTED_VM_VIOLATION: Cannot execute '${action}' on protected VM ${vmid} ('${vmName}'). Reason: ${reason}. Destructive/disruptive operations on protected infrastructure are strictly forbidden.`;
+        super(message);
+        this.name = "ProtectedVmViolationError";
+        this.vmid = vmid;
+        this.vmName = vmName;
+        this.action = action;
+        this.reason = reason;
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/src/guardrails/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/guardrails/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAgCH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,GAAG,wBAAwB,CAAC;IAChC,IAAI,CAAkB;IACtB,MAAM,CAAS;IACf,MAAM,CAAS;IACf,MAAM,CAAS;IAExB,YAAY,IAAqB,EAAE,MAAc,EAAE,MAAc,EAAE,MAAc;QAC/E,MAAM,OAAO,GAAG,2CAA2C,MAAM,qBAAqB,IAAI,MAAM,MAAM,eAAe,MAAM,yFAAyF,CAAC;QACrN,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF"}

package/dist/src/hypervisors/esxi/client.d.ts

@@ -0,0 +1,103 @@
+/**
+ * VMware ESXi Hypervisor Driver
+ * Implements IHypervisorDriver for VMware ESXi standalone and vCenter managed hosts.
+ * Supports govc CLI execution and VMware REST/SOAP API fallback.
+ */
+import { IHypervisorDriver, HostCapacity, UnifiedVmRecord, CloneVmParams, ProvisionVmResult } from "../types.js";
+import { EsxiHostConfig } from "../../credentials/types.js";
+import { SafetyGuardrailEngine } from "../../guardrails/safety.js";
+export interface EsxiVmSummary {
+    name: string;
+    path: string;
+    powerState: "poweredOn" | "poweredOff" | "suspended" | "unknown";
+    memoryMb: number;
+    cpuCores: number;
+    ipAddress?: string;
+    isTemplate: boolean;
+    annotation?: string;
+    tags?: string[];
+}
+export interface IEsxiClient {
+    readonly hostConfig: EsxiHostConfig;
+    getHostSummary(): Promise<{
+        cpuCores: number;
+        cpuUsageMhz?: number;
+        memoryTotalMb: number;
+        memoryUsedMb: number;
+        datastoreTotalGb: number;
+        datastoreFreeGb: number;
+    }>;
+    listVms(): Promise<EsxiVmSummary[]>;
+    getVm(vmName: string): Promise<EsxiVmSummary | null>;
+    cloneVm(sourceVmName: string, targetVmName: string, options?: {
+        memoryMb?: number;
+        cpuCores?: number;
+        datastore?: string;
+        network?: string;
+    }): Promise<{
+        success: boolean;
+        taskRef?: string;
+        vmName: string;
+    }>;
+    startVm(vmName: string): Promise<void>;
+    stopVm(vmName: string, force?: boolean): Promise<void>;
+    rebootVm(vmName: string): Promise<void>;
+    destroyVm(vmName: string): Promise<void>;
+}
+/**
+ * Real govc execution client
+ */
+export declare class GovcClient implements IEsxiClient {
+    readonly hostConfig: EsxiHostConfig;
+    constructor(hostConfig: EsxiHostConfig);
+    private getGovcEnv;
+    private execGovc;
+    getHostSummary(): Promise<{
+        cpuCores: number;
+        cpuUsageMhz?: number;
+        memoryTotalMb: number;
+        memoryUsedMb: number;
+        datastoreTotalGb: number;
+        datastoreFreeGb: number;
+    }>;
+    listVms(): Promise<EsxiVmSummary[]>;
+    getVm(vmName: string): Promise<EsxiVmSummary | null>;
+    cloneVm(sourceVmName: string, targetVmName: string, options?: {
+        memoryMb?: number;
+        cpuCores?: number;
+        datastore?: string;
+        network?: string;
+    }): Promise<{
+        success: boolean;
+        taskRef?: string;
+        vmName: string;
+    }>;
+    startVm(vmName: string): Promise<void>;
+    stopVm(vmName: string, force?: boolean): Promise<void>;
+    rebootVm(vmName: string): Promise<void>;
+    destroyVm(vmName: string): Promise<void>;
+}
+/**
+ * VMware ESXi Hypervisor Driver implementing polymorphic IHypervisorDriver
+ */
+export declare class EsxiDriver implements IHypervisorDriver {
+    readonly hostName: string;
+    readonly hypervisorType: "esxi";
+    readonly hostConfig: EsxiHostConfig;
+    private client;
+    private safetyEngine;
+    constructor(hostConfig: EsxiHostConfig, client?: IEsxiClient, safetyEngine?: SafetyGuardrailEngine);
+    get rawClient(): IEsxiClient;
+    getHostCapacity(): Promise<HostCapacity>;
+    listVms(): Promise<UnifiedVmRecord[]>;
+    getVm(vmIdOrName: string | number): Promise<UnifiedVmRecord | null>;
+    cloneVm(params: CloneVmParams): Promise<ProvisionVmResult>;
+    startVm(vmIdOrName: string | number): Promise<void>;
+    stopVm(vmIdOrName: string | number, force?: boolean): Promise<void>;
+    rebootVm(vmIdOrName: string | number): Promise<void>;
+    destroyVm(vmIdOrName: string | number): Promise<void>;
+    private isProtectedVmName;
+    private validateSafety;
+    private mapToUnifiedVm;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/src/hypervisors/esxi/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../../src/hypervisors/esxi/client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,aAAa,EACb,iBAAiB,EAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAgC,MAAM,4BAA4B,CAAC;AAOjG,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,WAAW,GAAG,YAAY,GAAG,WAAW,GAAG,SAAS,CAAC;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,cAAc,IAAI,OAAO,CAAC;QACxB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,EAAE,MAAM,CAAC;QACrB,gBAAgB,EAAE,MAAM,CAAC;QACzB,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC,CAAC;IACH,OAAO,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACpC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACrD,OAAO,CACL,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GACA,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED;;GAEG;AACH,qBAAa,UAAW,YAAW,WAAW;IAC5C,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;gBAExB,UAAU,EAAE,cAAc;IAItC,OAAO,CAAC,UAAU;YAcJ,QAAQ;IAahB,cAAc,IAAI,OAAO,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,EAAE,MAAM,CAAC;QACrB,gBAAgB,EAAE,MAAM,CAAC;QACzB,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IA4BI,OAAO,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAuCnC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAMpD,OAAO,CACX,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;QACP,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KACb,GACL,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAc5D,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAKpD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG/C;AAED;;GAEG;AACH,qBAAa,UAAW,YAAW,iBAAiB;IAClD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAU;IACzC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,YAAY,CAAwB;gBAG1C,UAAU,EAAE,cAAc,EAC1B,MAAM,CAAC,EAAE,WAAW,EACpB,YAAY,GAAE,qBAAoD;IAQpE,IAAI,SAAS,IAAI,WAAW,CAE3B;IAEK,eAAe,IAAI,OAAO,CAAC,YAAY,CAAC;IAoExC,OAAO,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAKrC,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IASnE,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmD1D,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQnD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjE,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUpD,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU3D,OAAO,CAAC,iBAAiB;IA0BzB,OAAO,CAAC,cAAc;IAiBtB,OAAO,CAAC,cAAc;CA+DvB"}