@calltelemetry/ct-lab-mcp 0.8.101 → 0.8.103

package/README.md

@@ -469,16 +469,22 @@ consumer update workflow.
   `baseVersion` plus `webImage`; install uses the GCS base. Never VMID 182.
 - `proxmox_import_qcow` wraps canonical `lab-inventory vm provision --source published-qcow` (the `vm import-qcow` apply is retired); `osVersion` is required
   (plan by default; apply needs the exact asset, vm prefix, VMID, and
-  `confirmImageSha256`). `imageUrl` is exactly one of two identity URLs on the
-  DigitalOcean Spaces release host
-  `calltelemetry-releases-nyc3.nyc3.digitaloceanspaces.com` (https only; no
-  query string, fragment, userinfo, or port; the retired GCS host is refused,
-  ADR 0735):
-  - published: `https://<host>/ovas/ct-<version>.qcow2`
-  - private CI candidate for an unpublished RC (ADR 0727):
-    `https://<host>/candidates/<version>/<run_id>/ct-<version>.qcow2`, where
-    `<version>` has four numeric parts with an optional `-rc<N>` and is
-    identical in both path positions, and `<run_id>` is 6-20 digits.
+  `confirmImageSha256`). `imageUrl` is exactly one of two identity URL shapes
+  (https only; no query string, fragment, userinfo, or port; the retired GCS
+  host is refused, ADR 0735):
+  - published, on the DigitalOcean Spaces release host
+    `calltelemetry-releases-nyc3.nyc3.digitaloceanspaces.com`:
+    `https://<host>/ovas/ct-<version>.qcow2`
+  - private CI candidate for an unpublished RC (ADR 0727), on Cloudflare R2
+    (REL-1785), path-style with the bucket as the first path segment:
+    `https://<32-hex-account-id>.r2.cloudflarestorage.com/ct-ci-candidates/candidates/<version>/<run_id>/ct-<version>.qcow2`,
+    where `<version>` has four numeric parts with an optional `-rc<N>` and is
+    identical in both path positions, and `<run_id>` is 6-20 digits. The
+    virtual-hosted R2 form is not accepted. During the 30-day migration window
+    after the candidate flip, the legacy Spaces candidate host
+    `calltelemetry-ci-candidates-nyc3.nyc3.digitaloceanspaces.com` (same path,
+    without the bucket segment) is also accepted; that branch is marked for
+    removal in `src/tools/import-qcow.ts`.
 
   Candidates are private and digest-bound: the SHA-256 binding
   (`imageSha256` + `confirmImageSha256`) is mandatory for both shapes and the

package/assets/stig/SHA256SUMS

@@ -1,12 +1,12 @@
 a5f48191effe1b243c4d4fc5565cbbe31b6a6085aedf9a3b924e68d0b9ae399c  files/ct-luks-firstboot.service
 5dc732b176181200ed18e6cf2448551d7c5e1a31cbd7bd9f4cbda4d30a4ad2eb  files/ct-luks-firstboot.sh
 dc035a0b24f24ff1a0e75fbbb9ff20262c1f83ef41d6c4e35a9bf7895ffd72e5  ks.cfg.pkrtpl
-97cda67f5851fcfd05a9a8dd4b0f885f9b5bad2ff85570935f14555356edbcdf  scripts/assess.sh
-7c8b9f536f7d2fa81b26b125a8edccf7bc64c9959e5d5ce6482bab231e21ecd2  scripts/errata.sh
-9780d258e74fb8eb997a27c6866ddc3fdd78f54c5e61eb616618c5a3445056ef  scripts/remediate.sh
+754bca832971810ee205a642513fd74aca1fc40144ba9d4a170a08d4ef56551c  scripts/assess.sh
+d7b5e50d146755d396ea4c938c69aab9e3d1e6bac148318f0b79e22ee1c5c037  scripts/errata.sh
+3adb14b0eec917109719b2cb47708c552c835a871b5f7626958f055d55e64781  scripts/remediate.sh
 5e3760cfd6a752b5c97e6e1f6f557df385f4be3d2a4acc1b125480f785b0dbcb  scripts/seal.sh
-43560c40096a28b180685fe1383344a6d454a3a18666f2ead4a1ddd3d72ed7fd  tailoring.xml
-9a7e78eefcb3d8ce28dc137e56dc43ae6b6f3ba4bdecf9f3c0abe64658432105  template.pkr.hcl
+aa3d5fb5b798b5f07b2381e3d3b7063b7cd8758b25d4ebbdbc86095265003837  tailoring.xml
+a71df76318bf0e71eba9723f759c8398b3112e870d035f8cc6badd92a052a84f  template.pkr.hcl
 eb119e742a4791404ca298c962515ffe3492814dfc72aecac16c420ccb3b0ccc  guest/keyhash.sh
 3a964e9dc60fcb7492fabf2117fa04d91e0f5e34d0b3b1fe003aa7253f0daeeb  guest/read-recovery.sh
 921ce015bb3f5188ccd861aef30fb1aed2588e729c371c3c8379802ce0c24be1  guest/scan.sh

package/assets/stig/scripts/assess.sh

@@ -1,17 +1,40 @@
 #!/bin/bash
-# Final STIG assessment of the rebooted image. Reports are copied to the controller.
+# Final assessment of the rebooted image with BOTH scanners:
+#   1. SSG 0.1.82 tailored profile (stig_ct)
+#   2. DISA's official V2R8 SCAP benchmark, profile MAC-1_Classified
+# The build user still exists while this runs, so the SSG scan uses a derived build-time
+# tailoring (tailoring-build.xml) that additionally authorizes ctbuild. The shipped
+# tailoring.xml, used by every clone scan, does not list ctbuild. Files over 5 MB are stored
+# xz -9e with the sha256 of the raw and the xz recorded.
 set -euo pipefail
 
 evidence=/root/stig-evidence
 out=/home/${BUILD_USER}/stig-report
+disa="$evidence/U_RHEL_8_V2R8_STIG_SCAP_1-3_Benchmark.xml"
+disa_profile=xccdf_mil.disa.stig_profile_MAC-1_Classified
+
+sed 's/|ctadmin)\$</|ctadmin|ctbuild)$</' "$evidence/tailoring.xml" > "$evidence/tailoring-build.xml"
+grep -q '|ctadmin|ctbuild)\$<' "$evidence/tailoring-build.xml"
+diff <(sed 's/|ctbuild//' "$evidence/tailoring-build.xml") "$evidence/tailoring.xml" >/dev/null   # only that one token differs
+sha256sum "$evidence/tailoring-build.xml" > "$evidence/tailoring-build.sha256"
+
 rc=0
 oscap xccdf eval \
-  --tailoring-file "$evidence/tailoring.xml" \
+  --tailoring-file "$evidence/tailoring-build.xml" \
   --profile xccdf_com.calltelemetry_profile_stig_ct \
   --results-arf "$evidence/final-arf.xml" \
   --report "$evidence/final-report.html" \
   "$evidence/ssg-rhel8-ds.xml" > "$evidence/final-stdout.txt" 2>&1 || rc=$?
-echo "oscap eval exit=$rc"
+echo "oscap SSG eval exit=$rc"
+[ "$rc" -eq 0 ] || [ "$rc" -eq 2 ]
+
+rc=0
+oscap xccdf eval \
+  --profile "$disa_profile" \
+  --results-arf "$evidence/final-disa-arf.xml" \
+  --report "$evidence/final-disa-report.html" \
+  "$disa" > "$evidence/final-disa-stdout.txt" 2>&1 || rc=$?
+echo "oscap DISA eval exit=$rc"
 [ "$rc" -eq 0 ] || [ "$rc" -eq 2 ]
 
 {
@@ -21,19 +44,38 @@ echo "oscap eval exit=$rc"
   grep -E '^(NAME|VERSION_ID)=' /etc/os-release
   rpm -q scap-security-guide openscap-scanner
   echo "tailoring_sha256=$(cut -d" " -f1 "$evidence/tailoring.sha256")"
+  echo "tailoring_build_sha256=$(cut -d" " -f1 "$evidence/tailoring-build.sha256")"
   echo "ds_sha256=$(sha256sum "$evidence/ssg-rhel8-ds.xml" | cut -d" " -f1)"
+  echo "disa_benchmark_sha256=$(sha256sum "$disa" | cut -d" " -f1)"
+  echo "disa_profile=$disa_profile"
   echo "dnf_security_outstanding=$(dnf -q updateinfo list security 2>/dev/null | grep -c . || true)"
   lsblk -f > "$evidence/lsblk.txt"; cryptsetup luksDump "$(blkid -t TYPE=crypto_LUKS -o device | head -n1)" > "$evidence/luksdump-template.txt" 2>&1 || true
   for r in pass fail notapplicable notchecked informational error; do
     echo "result_${r}=$(grep -c "^Result.*${r}\$" "$evidence/final-stdout.txt" || true)"
   done
+  for r in pass fail notapplicable notchecked informational error unknown; do
+    echo "disa_result_${r}=$(grep -c "^Result.*${r}\$" "$evidence/final-disa-stdout.txt" || true)"
+  done
 } > "$evidence/summary.txt"
 cat "$evidence/summary.txt"
 rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' | sort > "$evidence/rpm-qa-final.txt"
 grep -B2 -E '^Result.*fail$' "$evidence/final-stdout.txt" | grep '^Rule' | sed 's/^Rule[[:space:]]*//' > "$evidence/failed-rules.txt" || true
+grep -B2 -E '^Result.*fail$' "$evidence/final-disa-stdout.txt" | grep '^Rule' | sed 's/^Rule[[:space:]]*//' > "$evidence/failed-rules-disa.txt" || true
+
+# Raw files over 5 MB: keep only the xz -9e, with raw and xz sha256 sidecars.
+for f in final-arf.xml final-disa-arf.xml; do
+  if [ "$(stat -c %s "$evidence/$f")" -gt 5242880 ]; then
+    sha256sum "$evidence/$f" | cut -d" " -f1 > "$evidence/$f.raw.sha256"
+    xz -9e -f "$evidence/$f"
+    sha256sum "$evidence/$f.xz" | cut -d" " -f1 > "$evidence/$f.xz.sha256"
+  fi
+done
 
 rm -rf "$out"
 install -d -o "${BUILD_USER}" -g "${BUILD_USER}" -m 0700 "$out"
-cp "$evidence"/{lsblk.txt,luksdump-template.txt,tailoring.xml,tailoring.sha256,errata.txt,final-arf.xml,final-report.html,final-stdout.txt,summary.txt,failed-rules.txt,remediate-report.html,remediate-stdout.txt,rpm-qa-final.txt} "$out/"
+cd "$evidence"
+cp lsblk.txt luksdump-template.txt tailoring.xml tailoring.sha256 tailoring-build.xml tailoring-build.sha256 errata.txt kernels.txt \
+   final-report.html final-stdout.txt final-disa-report.html final-disa-stdout.txt summary.txt failed-rules.txt failed-rules-disa.txt \
+   remediate-report.html remediate-stdout.txt rpm-qa-final.txt final-arf.xml* final-disa-arf.xml* "$out/"
 cp -r "$evidence/install-time-oscap" "$out/" 2>/dev/null || true
 chown -R "${BUILD_USER}:${BUILD_USER}" "$out"

package/assets/stig/scripts/errata.sh

@@ -11,7 +11,7 @@ dnf -y update
 install -d -m 0700 /root/stig-evidence
 rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' | sort > /root/stig-evidence/rpm-qa-post-errata.txt
 {
-  echo "kernel_installed=$(rpm -q kernel --qf '%{VERSION}-%{RELEASE}.%{ARCH}\n' | sort -V | tail -n1)"
+  echo "kernel_installed=$(rpm -q kernel --last | head -n1 | awk '{print $1}' | sed 's/^kernel-//')"   # newest installed (sort -V ranks the GA release above .174.1)
   echo "security_advisories_outstanding=$(dnf -q updateinfo list security 2>/dev/null | grep -c . || true)"
   echo "errata_applied=$(date -u +%FT%TZ)"
 } > /root/stig-evidence/errata.txt

package/assets/stig/scripts/remediate.sh

@@ -12,11 +12,50 @@ evidence=/root/stig-evidence
 install -d -m 0700 "$evidence"
 cp "$ds" "$evidence/ssg-rhel8-ds.xml"
 cp "$TAILORING" "$evidence/tailoring.xml"
+# DISA's own SCAP benchmark (second scanner), pinned by sha256 and shipped for clone scans.
+echo "${DISA_BENCHMARK_SHA256}  ${DISA_BENCHMARK}" | sha256sum -c -
+install -m 0600 "$DISA_BENCHMARK" "$evidence/U_RHEL_8_V2R8_STIG_SCAP_1-3_Benchmark.xml"
 sha256sum "$evidence/tailoring.xml" > "$evidence/tailoring.sha256"
 rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' | sort > "$evidence/rpm-qa-pre-remediate.txt"
 cp /root/anaconda-ks.cfg "$evidence/" 2>/dev/null || true
 cp -r /root/openscap_data "$evidence/install-time-oscap" 2>/dev/null || true
 
+# --- stale GA kernel (RHEL-08 scanners report an installed vulnerable kernel even when not booted) ---
+# errata.sh rebooted into the newest kernel. Remove every other installonly kernel, then the
+# rescue entry: it is a copy of the GA kernel written at install and is not an RPM.
+running="$(uname -r)"
+stale="$(rpm -qa --qf '%{NAME} %{VERSION}-%{RELEASE}.%{ARCH}\n' \
+  | awk -v r="$running" '$1 ~ /^kernel(-core|-modules|-modules-extra|-devel|-debug.*)?$/ && $2 != r {print $1 "-" $2}')"
+echo "removing stale kernel packages: ${stale:-none}"
+# shellcheck disable=SC2086
+[ -z "$stale" ] || dnf -y remove $stale
+rm -f /boot/vmlinuz-0-rescue-* /boot/initramfs-0-rescue-* /boot/loader/entries/*-0-rescue.conf
+n="$(rpm -q kernel-core --qf '%{VERSION}-%{RELEASE}.%{ARCH}\n' | wc -l)"
+[ "$n" -eq 1 ] && [ "$(rpm -q kernel-core --qf '%{VERSION}-%{RELEASE}.%{ARCH}')" = "$running" ] \
+  || { echo "ERROR: expected only running kernel $running installed" >&2; rpm -q kernel kernel-core kernel-modules >&2; exit 1; }
+{ echo "running=$running"; rpm -qa 'kernel*' | sort; grubby --info=ALL | grep -E '^(index|kernel)='; ls /boot/loader/entries; } | tee "$evidence/kernels.txt"
+[ "$(grubby --info=ALL | grep -c '^kernel=')" -eq 1 ] || { echo "ERROR: more than one boot entry" >&2; exit 1; }
+[ "$(grubby --default-kernel)" = "/boot/vmlinuz-$running" ]
+
+# --- offline-bundle repo stanza (D-009; RHEL-08-010370 needs every repo section to carry gpgcheck=1) ---
+# The sealed image has no RHSM repos. A disabled placeholder keeps the DISA test meaningful: any
+# offline repository the appliance adds must be defined here (or in a sibling file) with gpgcheck=1.
+# Comments must not contain a left bracket: DISA's OVAL regex treats it as a section start.
+cat > /etc/yum.repos.d/ct-offline.repo <<'REPO'
+# Call Telemetry offline servicing bundle (placeholder). Point baseurl at the mounted bundle
+# and set enabled=1 only while installing from it. Packages and metadata must be signed.
+[ct-offline]
+name=Call Telemetry offline bundle
+baseurl=file:///opt/ct-offline/repo
+enabled=0
+gpgcheck=1
+repo_gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
+REPO
+chmod 0644 /etc/yum.repos.d/ct-offline.repo
+restorecon -F /etc/yum.repos.d/ct-offline.repo
+grep -qE '^gpgcheck[[:space:]]*=[[:space:]]*1$' /etc/dnf/dnf.conf && grep -qE '^localpkg_gpgcheck[[:space:]]*=[[:space:]]*1$' /etc/dnf/dnf.conf
+
 # --- clone first-boot encryption (D-020) ---
 install -m 0755 "$FILES_DIR/ct-luks-firstboot.sh" /usr/local/sbin/ct-luks-firstboot.sh
 install -m 0644 "$FILES_DIR/ct-luks-firstboot.service" /etc/systemd/system/ct-luks-firstboot.service
@@ -123,5 +162,11 @@ oscap xccdf eval \
 echo "oscap remediate exit=$rc"
 [ "$rc" -eq 0 ] || [ "$rc" -eq 2 ]
 
+# --- root password aging (RHEL-08-020180/020210; SSG's STIG profile does not select the root rules) ---
+# Root is locked; the setting is stored in /etc/shadow and survives cloning.
+chage -m 1 -M 60 root
+[ "$(chage -l root | sed -n 's/^Minimum number of days between password change[^:]*:[[:space:]]*//p')" = 1 ]
+[ "$(chage -l root | sed -n 's/^Maximum number of days between password change[^:]*:[[:space:]]*//p')" = 60 ]
+
 fips-mode-setup --check
 (sleep 3; systemctl reboot) >/dev/null 2>&1 &

package/assets/stig/tailoring.xml

@@ -3,14 +3,16 @@
      Only values the STIG leaves to the organization are set; no rule is selected out.
      accounts_authorized_local_users: the STIG requires the organization to define the
      authorized local accounts. The list is the RHEL 8 minimal system accounts present on
-     the image, the CallTelemetry administrator (ctadmin, created by cloud-init on clones),
-     and ctbuild (temporary Packer build account, deleted when the template is sealed). -->
+     the image, and the Call Telemetry administrator (ctadmin, created by cloud-init on clones).
+     The temporary Packer build account (ctbuild) is NOT authorized here: it is deleted when the
+     template is sealed, so a clone never has it. assess.sh evaluates the template with a derived
+     build-time copy of this file that adds ctbuild (tailoring-build.xml); clone scans use this file. -->
 <xccdf-1.2:Tailoring xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" id="xccdf_com.calltelemetry_tailoring_stig_ct">
   <xccdf-1.2:benchmark href="ssg-rhel8-ds.xml"/>
   <xccdf-1.2:version time="2026-10-16T00:00:00">1</xccdf-1.2:version>
   <xccdf-1.2:Profile id="xccdf_com.calltelemetry_profile_stig_ct" extends="xccdf_org.ssgproject.content_profile_stig">
     <xccdf-1.2:title>DISA RHEL 8 STIG - CallTelemetry organization-defined values</xccdf-1.2:title>
     <xccdf-1.2:description>Extends the SSG STIG profile; sets only organization-defined variables.</xccdf-1.2:description>
-    <xccdf-1.2:set-value idref="xccdf_org.ssgproject.content_value_var_accounts_authorized_local_users_regex">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|dbus|systemd-coredump|systemd-resolve|tss|polkitd|clevis|unbound|sssd|fapolicyd|chrony|sshd|postfix|ctadmin|ctbuild)$</xccdf-1.2:set-value>
+    <xccdf-1.2:set-value idref="xccdf_org.ssgproject.content_value_var_accounts_authorized_local_users_regex">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|dbus|systemd-coredump|systemd-resolve|tss|polkitd|clevis|unbound|sssd|fapolicyd|chrony|sshd|postfix|ctadmin)$</xccdf-1.2:set-value>
   </xccdf-1.2:Profile>
 </xccdf-1.2:Tailoring>

package/assets/stig/template.pkr.hcl

@@ -95,6 +95,11 @@ variable "ssg_datastream_sha256" {
   type    = string
   default = "82592d3cff74a82ce652a65ba67cd755cf57550269798d4c449c2069417c1028"
 }
+variable "disa_benchmark" { type = string }
+variable "disa_benchmark_sha256" {
+  type    = string
+  default = "968978518f7cd110e55fdd6a6a9bad0725a8e2177c0ef317650374ffce10c5d3"
+}
 variable "evidence_dir" { type = string }
 
 locals {
@@ -110,7 +115,7 @@ source "proxmox-iso" "rhel810_stig" {
   vm_id                    = var.vm_id
   vm_name                  = var.template_name
   template_name            = var.template_name
-  template_description     = "RHEL 8.10 DISA STIG template. SSG 0.1.82 / RHEL 8 STIG V2R8. Built ${timestamp()}. LUKS2 PV with template bootstrap key; each clone re-encrypts and binds its own TPM2 at first boot."
+  template_description     = "RHEL 8.10 DISA STIG template. SSG 0.1.82 + DISA V2R8 SCAP benchmark. Built ${timestamp()}. LUKS2 PV with template bootstrap key; each clone re-encrypts and binds its own TPM2 at first boot."
   tags                     = "rhel8-stig-template;ssg-0-1-82;stig-v2r8"
   os                       = "l26"
   machine                  = "q35"
@@ -198,6 +203,10 @@ build {
     source      = var.tailoring_file
     destination = "/home/${var.ssh_username}/tailoring.xml"
   }
+  provisioner "file" {
+    source      = var.disa_benchmark
+    destination = "/home/${var.ssh_username}/disa-benchmark.xml"
+  }
   provisioner "file" {
     source      = "${path.root}/files"
     destination = "/home/${var.ssh_username}/"
@@ -222,6 +231,8 @@ build {
       "SSG_DATASTREAM=/home/${var.ssh_username}/ssg-rhel8-ds.xml",
       "SSG_DATASTREAM_SHA256=${var.ssg_datastream_sha256}",
       "TAILORING=/home/${var.ssh_username}/tailoring.xml",
+      "DISA_BENCHMARK=/home/${var.ssh_username}/disa-benchmark.xml",
+      "DISA_BENCHMARK_SHA256=${var.disa_benchmark_sha256}",
       "FILES_DIR=/home/${var.ssh_username}/files",
       "BUILD_USER=${var.ssh_username}",
       "DNS_SERVERS=${var.dns_servers}",

package/dist/src/generated-version.d.ts

@@ -2,5 +2,5 @@
  * Auto-synced package version fallback for non-filesystem runtimes (Cloudflare Workers).
  * Updated automatically during release publication in .github/workflows/publish.yml.
  */
-export declare const PACKAGE_VERSION = "0.8.101";
+export declare const PACKAGE_VERSION = "0.8.103";
 //# sourceMappingURL=generated-version.d.ts.map

package/dist/src/generated-version.js

@@ -2,5 +2,5 @@
  * Auto-synced package version fallback for non-filesystem runtimes (Cloudflare Workers).
  * Updated automatically during release publication in .github/workflows/publish.yml.
  */
-export const PACKAGE_VERSION = "0.8.101";
+export const PACKAGE_VERSION = "0.8.103";
 //# sourceMappingURL=generated-version.js.map

package/dist/src/stig/live.d.ts

@@ -1,4 +1,5 @@
 import type { BuildMaterial, ClaimPort, ClaimRecord, GuestShell, Materials, PackerPort, PveShell, RunOpts, SecretStore, ShellResult, StigDeps, StigProvider } from "./ports.js";
+import { type StigNode } from "./nodes.js";
 /** assets/stig next to dist/src/stig (published) or next to src/stig (dev). */
 export declare function defaultAssetsDir(): string;
 export declare class SshPveShell implements PveShell {
@@ -46,6 +47,7 @@ export declare class LabClaims implements ClaimPort {
         vmid: number;
         vmName: string;
         ttlHours: number;
+        node: string;
         stig: Record<string, unknown>;
     }): Promise<ClaimRecord>;
     waitReady(name: string): Promise<ClaimRecord>;
@@ -89,6 +91,8 @@ export declare class CliStigProvider implements StigProvider {
     private call;
     clone(a: {
         operationId: string;
+        hostAssetId: string;
+        untagged: boolean;
         name: string;
         templateName: string;
         vmid: number;
@@ -101,10 +105,11 @@ export declare class CliStigProvider implements StigProvider {
     }>;
     destroyTemplate(a: {
         operationId: string;
+        hostAssetId: string;
         name: string;
         vmid: number;
     }): Promise<void>;
-    guestIp(vmid: number): Promise<string>;
+    guestIp(vmid: number, hostAssetId: string): Promise<string>;
 }
 export declare function defaultRunDir(): string;
 /** The lab-inventory CLI path when the canonical bridge is configured (CT_LAB_CANONICAL_CLI). */
@@ -112,5 +117,6 @@ export declare function canonicalCli(env?: NodeJS.ProcessEnv): string | undefine
 export declare function liveDeps(opts?: {
     baseDir?: string;
     log?: (line: string) => void;
+    node?: StigNode;
 }): StigDeps;
 //# sourceMappingURL=live.d.ts.map

package/dist/src/stig/live.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live.d.ts","sourceRoot":"","sources":["../../../src/stig/live.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACV,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAC9I,MAAM,YAAY,CAAC;AAUpB,+EAA+E;AAC/E,wBAAgB,gBAAgB,IAAI,MAAM,CAQzC;AAkBD,qBAAa,WAAY,YAAW,QAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAA0D,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAnF,IAAI,SAAwD,EAAmB,IAAI,SAAS;IACzH,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;CAI1D;AAED,qBAAa,aAAc,YAAW,UAAU;IAC9C,OAAO,CAAC,IAAI,CAAa;IAAC,OAAO,CAAC,OAAO,CAAM;IAAC,OAAO,CAAC,KAAK,CAAM;IAAC,OAAO,CAAC,EAAE,CAAM;IACpF,SAAS,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAC/E,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAC3B,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,GAAG;IAGL,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAQ3G,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAO5F,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKhE;AAED,qBAAa,cAAe,YAAW,WAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAkD,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAhF,OAAO,SAAgD,EAAmB,MAAM,SAAsC;IAC7I,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAK9C,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAUtD;AAED,qBAAa,SAAU,YAAW,SAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAC/B,OAAO,CAAC,IAAI;IAIN,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAK9B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAI9C,MAAM,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAKhI,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAK7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAM1E,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAKvE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI/D;AAED,qBAAa,SAAU,YAAW,UAAU;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAU,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAxC,GAAG,EAAE,MAAM,EAAmB,UAAU,qBAA6C;IAC5G,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IAMhC,KAAK,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;CAW1G;AAED,qBAAa,aAAc,YAAW,SAAS;IAC7C,OAAO,CAAC,OAAO;IAIf,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAK7B,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK3C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAO9F,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;CAe3E;AAED;;;GAGG;AACH,qBAAa,eAAgB,YAAW,YAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAU,OAAO,CAAC,QAAQ,CAAC,IAAI;IAA6E,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAvI,GAAG,EAAE,MAAM,EAAmB,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,CAAO,EAAmB,OAAO,SAAW;YAEjK,IAAI;IAWZ,KAAK,CAAC,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAiBjM,eAAe,CAAC,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtF,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAI7C;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,iGAAiG;AACjG,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAGrF;AAED,wBAAgB,QAAQ,CAAC,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO,GAAG,QAAQ,CAYhG"}
+{"version":3,"file":"live.d.ts","sourceRoot":"","sources":["../../../src/stig/live.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACV,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAC9I,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAwB,KAAK,QAAQ,EAAE,MAAM,YAAY,CAAC;AASjE,+EAA+E;AAC/E,wBAAgB,gBAAgB,IAAI,MAAM,CAQzC;AAkBD,qBAAa,WAAY,YAAW,QAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAiE,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAA1F,IAAI,SAA+D,EAAmB,IAAI,SAAS;IAChI,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;CAI1D;AAED,qBAAa,aAAc,YAAW,UAAU;IAC9C,OAAO,CAAC,IAAI,CAAa;IAAC,OAAO,CAAC,OAAO,CAAM;IAAC,OAAO,CAAC,KAAK,CAAM;IAAC,OAAO,CAAC,EAAE,CAAM;IACpF,SAAS,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAC/E,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAC3B,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,GAAG;IAGL,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAQ3G,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAO5F,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKhE;AAED,qBAAa,cAAe,YAAW,WAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAkD,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAhF,OAAO,SAAgD,EAAmB,MAAM,SAAsC;IAC7I,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAK9C,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAUtD;AAED,qBAAa,SAAU,YAAW,SAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAC/B,OAAO,CAAC,IAAI;IAIN,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAK9B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAI9C,MAAM,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAK9I,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAK7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAM1E,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAKvE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI/D;AAED,qBAAa,SAAU,YAAW,UAAU;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAU,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAxC,GAAG,EAAE,MAAM,EAAmB,UAAU,qBAA6C;IAC5G,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IAMhC,KAAK,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;CAW1G;AAED,qBAAa,aAAc,YAAW,SAAS;IAC7C,OAAO,CAAC,OAAO;IAIf,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAK7B,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK3C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAO9F,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;CAe3E;AAED;;;GAGG;AACH,qBAAa,eAAgB,YAAW,YAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAU,OAAO,CAAC,QAAQ,CAAC,IAAI;IAA6E,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAvI,GAAG,EAAE,MAAM,EAAmB,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,CAAO,EAAmB,OAAO,SAAW;YAEjK,IAAI;IAWZ,KAAK,CAAC,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAiBzO,eAAe,CAAC,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ3G,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAIlE;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,iGAAiG;AACjG,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAGrF;AAED,wBAAgB,QAAQ,CAAC,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,QAAQ,CAAA;CAAO,GAAG,QAAQ,CAajH"}

package/dist/src/stig/live.js

@@ -13,6 +13,7 @@ import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import { redact } from "./model.js";
+import { STIG_NODES, stigNode } from "./nodes.js";
 import { handleCreateApplianceClaim, handleDeleteApplianceClaim, handleGetApplianceClaim, handlePauseApplianceClaim, handleRenewApplianceClaim, queryKubernetesApi, } from "../tools/appliance-claim-tools.js";
 import { awaitClaimReconciled } from "../tools/claim-reconcile-gate.js";
 import { runLabKubectl } from "../tools/kubernetes-backend.js";
@@ -54,7 +55,7 @@ function run(file, args, opts = {}) {
 export class SshPveShell {
     host;
     user;
-    constructor(host = process.env.CT_LAB_STIG_PVE_HOST ?? "192.168.123.178", user = "root") {
+    constructor(host = process.env.CT_LAB_STIG_PVE_HOST ?? STIG_NODES.minis.pveHost, user = "root") {
         this.host = host;
         this.user = user;
     }
@@ -145,7 +146,7 @@ export class LabClaims {
         return r.isError ? null : (this.text(r)?.claim ?? null);
     }
     async create(a) {
-        const r = await handleCreateApplianceClaim({ name: a.name, vmid: a.vmid, vmName: a.vmName, node: "minis", profile: "bare", ttlHours: a.ttlHours, stig: a.stig });
+        const r = await handleCreateApplianceClaim({ name: a.name, vmid: a.vmid, vmName: a.vmName, node: a.node, profile: "bare", ttlHours: a.ttlHours, stig: a.stig });
         if (r.isError)
             throw new Error(`claim creation failed: ${r.content?.[0]?.text ?? "unknown"}`);
         return this.text(r).claim;
@@ -287,7 +288,7 @@ export class CliStigProvider {
             const hashFile = join(dir, "hash");
             writeFileSync(keyFile, a.sshPublicKey, { mode: 0o600 });
             writeFileSync(hashFile, a.passwordHash, { mode: 0o600 });
-            const base = ["stig", "clone", "--operation-id", a.operationId, "--name", a.name, "--template-name", a.templateName,
+            const base = ["stig", "clone", "--host-asset-id", a.hostAssetId, ...(a.untagged ? ["--untagged"] : []), "--operation-id", a.operationId, "--name", a.name, "--template-name", a.templateName,
                 "--ssh-key-file", keyFile, "--password-hash-file", hashFile, "--vmid", String(a.vmid),
                 ...a.dns.flatMap((d) => ["--dns", d]), ...a.claimedVmids.flatMap((v) => ["--claimed-vmid", String(v)])];
             const plan = await this.call(base);
@@ -303,7 +304,7 @@ export class CliStigProvider {
         }
     }
     async destroyTemplate(a) {
-        const base = ["stig", "destroy-template", "--operation-id", a.operationId, "--name", a.name, "--vmid", String(a.vmid)];
+        const base = ["stig", "destroy-template", "--host-asset-id", a.hostAssetId, "--operation-id", a.operationId, "--name", a.name, "--vmid", String(a.vmid)];
         const plan = await this.call(base);
         if (!plan?.eligible || !plan.plan_digest)
             throw new Error(`lab-inventory stig destroy-template plan is not eligible: ${(plan?.blocking_reasons ?? []).join(", ")}`);
@@ -311,8 +312,8 @@ export class CliStigProvider {
         if (receipt?.status !== "completed")
             throw new Error("lab-inventory stig destroy-template did not complete");
     }
-    async guestIp(vmid) {
-        const out = await this.call(["stig", "guest-ip", "--vmid", String(vmid), "--timeout", "20"], 60_000);
+    async guestIp(vmid, hostAssetId) {
+        const out = await this.call(["stig", "guest-ip", "--host-asset-id", hostAssetId, "--vmid", String(vmid), "--timeout", "20"], 60_000);
         return typeof out?.ipv4 === "string" ? out.ipv4 : "";
     }
 }
@@ -325,12 +326,13 @@ export function canonicalCli(env = process.env) {
     return p && existsSync(p) ? p : undefined;
 }
 export function liveDeps(opts = {}) {
+    const nodeCfg = stigNode(opts.node);
     const assetsDir = defaultAssetsDir();
     const baseDir = opts.baseDir ?? defaultRunDir();
     mkdirSync(baseDir, { recursive: true, mode: 0o700 });
     return {
         provider: canonicalCli() ? new CliStigProvider(canonicalCli()) : undefined,
-        pve: new SshPveShell(), guest: new SshGuestShell(), secrets: new DopplerSecrets(), claims: new LabClaims(),
+        pve: new SshPveShell(opts.node ? nodeCfg.pveHost : undefined), guest: new SshGuestShell(), secrets: new DopplerSecrets(), claims: new LabClaims(),
         packer: new PackerCli(assetsDir), materials: new NodeMaterials(),
         clock: { now: () => Date.now(), sleep: (ms) => new Promise((r) => setTimeout(r, ms)) },
         log: { info: (line) => (opts.log ?? ((l) => process.stderr.write(`[stig] ${l}\n`)))(line) },

package/dist/src/stig/live.js.map

@@ -1 +1 @@
-{"version":3,"file":"live.js","sourceRoot":"","sources":["../../../src/stig/live.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChI,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAItC,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACpC,OAAO,EACL,0BAA0B,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,yBAAyB,EAC1G,yBAAyB,EAAE,kBAAkB,GAC9C,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAE/D,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AACtC,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB;IAC9B,8FAA8F;IAC9F,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,GAAG,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,EAAE,CAAC;QAChE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7B,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAEnE,SAAS,GAAG,CAAC,IAAY,EAAE,IAAc,EAAE,OAA8C,EAAE;IACzF,OAAO,IAAI,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACnG,IAAI,MAAM,GAAG,EAAE,CAAC;QAAC,IAAI,MAAM,GAAG,EAAE,CAAC;QAAC,IAAI,OAAO,GAAG,KAAK,CAAC;QACtD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC;QAChI,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;QACnG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,WAAW;IACO;IAA+E;IAA5G,YAA6B,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,iBAAiB,EAAmB,OAAO,MAAM;QAA5F,SAAI,GAAJ,IAAI,CAAwD;QAAmB,SAAI,GAAJ,IAAI,CAAS;IAAG,CAAC;IAC7H,GAAG,CAAC,MAAc,EAAE,IAAc;QAChC,oFAAoF;QACpF,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,WAAW,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACrI,CAAC;CACF;AAED,MAAM,OAAO,aAAa;IAChB,IAAI,GAAG,SAAS,CAAC;IAAS,OAAO,GAAG,EAAE,CAAC;IAAS,KAAK,GAAG,EAAE,CAAC;IAAS,EAAE,GAAG,EAAE,CAAC;IACpF,SAAS,CAAC,GAA8D,IAAU,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IACtK,SAAS,CAAC,EAAU,IAAU,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,OAAe;QAC1B,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,2BAA2B;YAC9G,IAAI,EAAE,sBAAsB,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,yBAAyB,OAAO,EAAE,CAAC,CAAC;IAC3I,CAAC;IACO,GAAG,CAAC,OAAe,EAAE,CAAW,EAAE,OAAO,GAAG,KAAK;QACvD,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,CAA0D;QACxF,IAAI,CAAC,CAAC,EAAE,IAAI;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACrF,8FAA8F;QAC9F,MAAM,IAAI,GAAG,oBAAoB,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;QACrE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,QAAQ,IAAI,kBAAkB,IAAI,YAAY,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACpJ,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,OAA6B,EAAE,KAAa,EAAE,UAAU,GAAG,MAAM;QAC7E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrF,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,IAAY,IAAsB,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IAChH,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,QAAgB;QAC7C,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,IAAI,MAAM,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACvI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IACI;IAA0E;IAAvG,YAA6B,UAAU,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,cAAc,EAAmB,SAAS,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,KAAK;QAAtH,YAAO,GAAP,OAAO,CAAgD;QAAmB,WAAM,GAAN,MAAM,CAAsC;IAAG,CAAC;IACvJ,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAClF,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QACxH,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvF,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,KAAa;QACnC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAClF,0FAA0F;QAC1F,MAAM,IAAI,OAAO,CAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YACtJ,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACjH,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,SAAS;IACH,EAAE,GAAG,QAAQ,CAAC;IACvB,IAAI,CAAC,MAAW;QACtB,MAAM,KAAK,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACnC,OAAO,KAAK,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC;IACD,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAQ,MAAM,kBAAkB,CAAC,+CAA+C,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACpH,IAAI,GAAG,EAAE,KAAK;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;IACvH,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,MAAM,CAAC,GAAG,MAAM,uBAAuB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC;IAC1D,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,CAAkG;QAC7G,MAAM,CAAC,GAAG,MAAM,0BAA0B,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACjK,IAAI,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA2B,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAS,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;QACvG,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5B,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,IAAY;QAC1B,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,GAAG,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,yBAAyB,GAAG,CAAC,MAAM,yBAAyB,CAAC,CAAC;QAChH,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAE,CAAC;IACjC,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,WAAmC;QAC9D,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,+CAA+C,IAAI,CAAC,EAAE,oBAAoB,IAAI,EAAE,CAAC;QAC9F,MAAM,OAAO,GAAQ,MAAM,kBAAkB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,OAAO;YAAE,MAAM,aAAa,CAAC,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClI,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,WAAmB;QAC3C,MAAM,CAAC,GAAG,MAAM,yBAAyB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAwB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAS,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;QACpG,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7C,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,MAAe,EAAE,MAAe;QACxD,MAAM,CAAC,GAAG,MAAM,yBAAyB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QACtG,IAAI,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAwB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAS,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,WAAmB;QAC5C,MAAM,CAAC,GAAG,MAAM,0BAA0B,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAyB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAS,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;IACvG,CAAC;CACF;AAED,MAAM,OAAO,SAAS;IACS;IAA8B;IAA3D,YAA6B,GAAW,EAAmB,aAAa,OAAO,CAAC,GAAG,CAAC,8BAA8B;QAArF,QAAG,GAAH,GAAG,CAAQ;QAAmB,eAAU,GAAV,UAAU,CAA6C;IAAG,CAAC;IACtH,KAAK,CAAC,OAAO;QACX,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAChF,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,KAAK,CAAC,CAAiF;QACrF,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACpI,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC;QACvJ,OAAO,IAAI,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC9B,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACtE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/F,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,aAAa;IAChB,OAAO;QACb,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAC5D,OAAO,UAAU,CAAC,yCAAyC,CAAC,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvH,CAAC;IACD,WAAW,CAAC,MAAc;QACxB,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,CAAC,MAAM,GAAG,MAAM;YAAE,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACnG,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAClG,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,KAAa;QACzC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC;YAAE,IAAI,UAAU,CAAC,CAAC,CAAC;gBAAE,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,MAAM,SAAS,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,mCAAmC;QACzI,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,GAAG,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,KAAa;QAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,KAAK,EAAE,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC1F,MAAM,aAAa,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;QAAC,MAAM,YAAY,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;QAAC,MAAM,aAAa,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC1G,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,aAAa,CAAC,EAAE,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAU,EAAE,CAAC;YACtI,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5E,OAAO;YACL,iBAAiB,EAAE,GAAG,CAAC,cAAc,EAAE,YAAY,EAAE,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,aAAa;YAChG,iBAAiB,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC;YACxD,UAAU,EAAE,4BAA4B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE;SACjH,CAAC;IACJ,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,eAAe;IACG;IAA8B;IAAkG;IAA7J,YAA6B,GAAW,EAAmB,OAA4E,GAAG,EAAmB,UAAU,MAAM,EAAE;QAAlJ,QAAG,GAAH,GAAG,CAAQ;QAAmB,SAAI,GAAJ,IAAI,CAA2E;QAAmB,YAAO,GAAP,OAAO,CAAW;IAAG,CAAC;IAE3K,KAAK,CAAC,IAAI,CAAC,IAAc,EAAE,SAAS,GAAG,OAAO;QACpD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACzD,IAAI,IAAI,GAAQ,IAAI,CAAC;QACrB,IAAI,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC3H,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,CAA+J;QACzK,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QACzD,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACzE,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClH,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,YAAY;gBACjH,gBAAgB,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;gBACrF,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1G,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,IAAI,EAAE,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzJ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;YAC9H,IAAI,OAAO,EAAE,MAAM,KAAK,WAAW,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;YACzJ,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;gBAAS,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,CAAsD;QAC1E,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACvH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,IAAI,EAAE,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpK,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;QAC5H,IAAI,OAAO,EAAE,MAAM,KAAK,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC/G,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACrG,OAAO,OAAO,GAAG,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;CACF;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,cAAc,CAAC,CAAC;AAC1F,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,MAAM,CAAC,GAAG,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;IAC3C,OAAO,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAA2D,EAAE;IACpF,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,aAAa,EAAE,CAAC;IAChD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,OAAO;QACL,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,YAAY,EAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3E,GAAG,EAAE,IAAI,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,SAAS,EAAE;QAC1G,MAAM,EAAE,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,aAAa,EAAE;QAChE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE;QACtF,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;QAC3F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC;KACnF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"live.js","sourceRoot":"","sources":["../../../src/stig/live.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChI,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAItC,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAiB,MAAM,YAAY,CAAC;AACjE,OAAO,EACL,0BAA0B,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,yBAAyB,EAC1G,yBAAyB,EAAE,kBAAkB,GAC9C,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAE/D,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AACtC,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB;IAC9B,8FAA8F;IAC9F,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,GAAG,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,EAAE,CAAC;QAChE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7B,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAEnE,SAAS,GAAG,CAAC,IAAY,EAAE,IAAc,EAAE,OAA8C,EAAE;IACzF,OAAO,IAAI,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACnG,IAAI,MAAM,GAAG,EAAE,CAAC;QAAC,IAAI,MAAM,GAAG,EAAE,CAAC;QAAC,IAAI,OAAO,GAAG,KAAK,CAAC;QACtD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC;QAChI,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;QACnG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,WAAW;IACO;IAAsF;IAAnH,YAA6B,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,UAAU,CAAC,KAAK,CAAC,OAAO,EAAmB,OAAO,MAAM;QAAnG,SAAI,GAAJ,IAAI,CAA+D;QAAmB,SAAI,GAAJ,IAAI,CAAS;IAAG,CAAC;IACpI,GAAG,CAAC,MAAc,EAAE,IAAc;QAChC,oFAAoF;QACpF,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,WAAW,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACrI,CAAC;CACF;AAED,MAAM,OAAO,aAAa;IAChB,IAAI,GAAG,SAAS,CAAC;IAAS,OAAO,GAAG,EAAE,CAAC;IAAS,KAAK,GAAG,EAAE,CAAC;IAAS,EAAE,GAAG,EAAE,CAAC;IACpF,SAAS,CAAC,GAA8D,IAAU,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IACtK,SAAS,CAAC,EAAU,IAAU,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,OAAe;QAC1B,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,2BAA2B;YAC9G,IAAI,EAAE,sBAAsB,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,yBAAyB,OAAO,EAAE,CAAC,CAAC;IAC3I,CAAC;IACO,GAAG,CAAC,OAAe,EAAE,CAAW,EAAE,OAAO,GAAG,KAAK;QACvD,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,CAA0D;QACxF,IAAI,CAAC,CAAC,EAAE,IAAI;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACrF,8FAA8F;QAC9F,MAAM,IAAI,GAAG,oBAAoB,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;QACrE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,QAAQ,IAAI,kBAAkB,IAAI,YAAY,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACpJ,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,OAA6B,EAAE,KAAa,EAAE,UAAU,GAAG,MAAM;QAC7E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrF,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,IAAY,IAAsB,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IAChH,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,QAAgB;QAC7C,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,IAAI,MAAM,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACvI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IACI;IAA0E;IAAvG,YAA6B,UAAU,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,cAAc,EAAmB,SAAS,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,KAAK;QAAtH,YAAO,GAAP,OAAO,CAAgD;QAAmB,WAAM,GAAN,MAAM,CAAsC;IAAG,CAAC;IACvJ,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAClF,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QACxH,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvF,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,KAAa;QACnC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAClF,0FAA0F;QAC1F,MAAM,IAAI,OAAO,CAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YACtJ,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACjH,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,SAAS;IACH,EAAE,GAAG,QAAQ,CAAC;IACvB,IAAI,CAAC,MAAW;QACtB,MAAM,KAAK,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACnC,OAAO,KAAK,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC;IACD,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAQ,MAAM,kBAAkB,CAAC,+CAA+C,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACpH,IAAI,GAAG,EAAE,KAAK;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;IACvH,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,MAAM,CAAC,GAAG,MAAM,uBAAuB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC;IAC1D,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,CAAgH;QAC3H,MAAM,CAAC,GAAG,MAAM,0BAA0B,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAChK,IAAI,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA2B,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAS,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;QACvG,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5B,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,IAAY;QAC1B,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,GAAG,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,yBAAyB,GAAG,CAAC,MAAM,yBAAyB,CAAC,CAAC;QAChH,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAE,CAAC;IACjC,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,WAAmC;QAC9D,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,+CAA+C,IAAI,CAAC,EAAE,oBAAoB,IAAI,EAAE,CAAC;QAC9F,MAAM,OAAO,GAAQ,MAAM,kBAAkB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,OAAO;YAAE,MAAM,aAAa,CAAC,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClI,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,WAAmB;QAC3C,MAAM,CAAC,GAAG,MAAM,yBAAyB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAwB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAS,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;QACpG,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7C,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,MAAe,EAAE,MAAe;QACxD,MAAM,CAAC,GAAG,MAAM,yBAAyB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QACtG,IAAI,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAwB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAS,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,WAAmB;QAC5C,MAAM,CAAC,GAAG,MAAM,0BAA0B,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAyB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAS,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;IACvG,CAAC;CACF;AAED,MAAM,OAAO,SAAS;IACS;IAA8B;IAA3D,YAA6B,GAAW,EAAmB,aAAa,OAAO,CAAC,GAAG,CAAC,8BAA8B;QAArF,QAAG,GAAH,GAAG,CAAQ;QAAmB,eAAU,GAAV,UAAU,CAA6C;IAAG,CAAC;IACtH,KAAK,CAAC,OAAO;QACX,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAChF,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,KAAK,CAAC,CAAiF;QACrF,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACpI,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC;QACvJ,OAAO,IAAI,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC9B,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACtE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/F,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,aAAa;IAChB,OAAO;QACb,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAC5D,OAAO,UAAU,CAAC,yCAAyC,CAAC,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvH,CAAC;IACD,WAAW,CAAC,MAAc;QACxB,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,CAAC,MAAM,GAAG,MAAM;YAAE,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACnG,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAClG,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,KAAa;QACzC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC;YAAE,IAAI,UAAU,CAAC,CAAC,CAAC;gBAAE,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,MAAM,SAAS,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,mCAAmC;QACzI,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,GAAG,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,KAAa;QAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,KAAK,EAAE,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC1F,MAAM,aAAa,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;QAAC,MAAM,YAAY,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;QAAC,MAAM,aAAa,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC1G,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,aAAa,CAAC,EAAE,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAU,EAAE,CAAC;YACtI,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5E,OAAO;YACL,iBAAiB,EAAE,GAAG,CAAC,cAAc,EAAE,YAAY,EAAE,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,aAAa;YAChG,iBAAiB,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC;YACxD,UAAU,EAAE,4BAA4B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE;SACjH,CAAC;IACJ,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,eAAe;IACG;IAA8B;IAAkG;IAA7J,YAA6B,GAAW,EAAmB,OAA4E,GAAG,EAAmB,UAAU,MAAM,EAAE;QAAlJ,QAAG,GAAH,GAAG,CAAQ;QAAmB,SAAI,GAAJ,IAAI,CAA2E;QAAmB,YAAO,GAAP,OAAO,CAAW;IAAG,CAAC;IAE3K,KAAK,CAAC,IAAI,CAAC,IAAc,EAAE,SAAS,GAAG,OAAO;QACpD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACzD,IAAI,IAAI,GAAQ,IAAI,CAAC;QACrB,IAAI,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC3H,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,CAAuM;QACjN,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QACzD,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACzE,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClH,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,YAAY;gBAC1L,gBAAgB,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;gBACrF,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1G,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,IAAI,EAAE,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzJ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;YAC9H,IAAI,OAAO,EAAE,MAAM,KAAK,WAAW,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;YACzJ,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;gBAAS,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,CAA2E;QAC/F,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,CAAC,CAAC,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzJ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,IAAI,EAAE,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpK,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;QAC5H,IAAI,OAAO,EAAE,MAAM,KAAK,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC/G,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,WAAmB;QAC7C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACrI,OAAO,OAAO,GAAG,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;CACF;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,cAAc,CAAC,CAAC;AAC1F,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,MAAM,CAAC,GAAG,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;IAC3C,OAAO,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAA4E,EAAE;IACrG,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,aAAa,EAAE,CAAC;IAChD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,OAAO;QACL,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,YAAY,EAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3E,GAAG,EAAE,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,SAAS,EAAE;QACjJ,MAAM,EAAE,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,aAAa,EAAE;QAChE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE;QACtF,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;QAC3F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC;KACnF,CAAC;AACJ,CAAC"}

package/dist/src/stig/model.d.ts

@@ -17,7 +17,8 @@ export declare const STIG_TEMPLATE_PREFIX = "rhel810-stig-";
 export declare const STIG_MODES: readonly ["build-template", "clone", "validate"];
 export type StigMode = (typeof STIG_MODES)[number];
 export declare const STIG_DATASTREAM_SHA256 = "82592d3cff74a82ce652a65ba67cd755cf57550269798d4c449c2069417c1028";
-export declare const STIG_TAILORING_SHA256 = "43560c40096a28b180685fe1383344a6d454a3a18666f2ead4a1ddd3d72ed7fd";
+export declare const STIG_TAILORING_SHA256 = "aa3d5fb5b798b5f07b2381e3d3b7063b7cd8758b25d4ebbdbc86095265003837";
+export declare const DISA_BENCHMARK_SHA256 = "968978518f7cd110e55fdd6a6a9bad0725a8e2177c0ef317650374ffce10c5d3";
 export declare const STIG_PROFILE_ID = "xccdf_com.calltelemetry_profile_stig_ct";
 export declare const STIG_DVD_ISO = "synology-cisco-isos:iso/rhel-8.10-x86_64-dvd.iso";
 export declare const STIG_PINS: Readonly<{
@@ -144,6 +145,14 @@ export type RenewalPlan = {
 export declare function planTemplateRenewal(claim: any, now?: number, marginHours?: number): RenewalPlan;
 export declare function assertPoolBelow(percent: unknown, limit?: number): void;
 export declare function assertSingleReencrypt(claims: any[], selfName: string): void;
+/** A running, non-template guest tagged rhel8-stig-clone for under this long may still be re-encrypting. */
+export declare const STIG_REENCRYPT_WINDOW_SECONDS: number;
+export declare const STIG_CLONE_TAG = "rhel8-stig-clone";
+/**
+ * Proxmox-level one-at-a-time guard: it sees clones from every path (the tools, the shell recipe) because it reads the
+ * guest tag and uptime rather than a claim annotation. `ownVmid` is the clone being created, which is never "another".
+ */
+export declare function assertNoYoungStigClone(guests: Array<Record<string, any>>, ownVmid?: number): void;
 export declare function assertTemplateReleaseAllowed(input: {
     guest: {
         vmid: number;

package/dist/src/stig/model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../../src/stig/model.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,eAAO,MAAM,eAAe,2BAA2B,CAAC;AACxD,eAAO,MAAM,uBAAuB,mCAAmC,CAAC;AACxE,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AAClE,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AACpE,eAAO,MAAM,mBAAmB,0CAA0C,CAAC;AAC3E,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAC9C,eAAO,MAAM,kBAAkB,OAAO,CAAC;AACvC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,eAAO,MAAM,oBAAoB,kBAAkB,CAAC;AACpD,eAAO,MAAM,UAAU,kDAAmD,CAAC;AAC3E,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AACnD,eAAO,MAAM,sBAAsB,qEAAqE,CAAC;AACzG,eAAO,MAAM,qBAAqB,qEAAqE,CAAC;AACxG,eAAO,MAAM,eAAe,4CAA4C,CAAC;AACzE,eAAO,MAAM,YAAY,qDAAqD,CAAC;AAC/E,eAAO,MAAM,SAAS;;;;;EAAiG,CAAC;AAExH,eAAO,MAAM,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC,CAInE,CAAC;AACH,2GAA2G;AAC3G,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAA0B,CAAC;AAE7E,eAAO,MAAM,UAAU,oFAAqF,CAAC;AAC7G,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,sBAAsB,CAAC;IACtC,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE,YAAY,CAAC;IACtB,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAC;CAClF;AAED,eAAO,MAAM,eAAe,+FAAsC,CAAC;AACnE,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AAC1E,eAAO,MAAM,eAAe,iDAAiD,CAAC;AAC9E,eAAO,MAAM,mBAAmB,8CAA8C,CAAC;AAE/E,6FAA6F;AAC7F,MAAM,WAAW,QAAQ;IAAG,OAAO,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE;AAE1F,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,mBAAmB,CAAC;IACnC,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACpD,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAQD,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAahC,4GAA4G;AAC5G,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAM,GAAG,IAAI,CAchE;AAED,2FAA2F;AAC3F,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM3C;AAQD,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;CAAE,CA+ClH;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,CAOtD;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAWnM;AAID,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ5D;AAID,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAMvD;AAED,sGAAsG;AACtG,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAO/D;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,UAAU,CAInE;AAQD,kHAAkH;AAClH,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,CAK9I;AAED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,SAAY,GAAG,UAAU,CAI3F;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,IAAI,EACb,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,QAAQ,CAAA;CAAO,GACtJ,kBAAkB,CAqBpB;AAMD,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,OAAO,GAAG,kBAAkB,GAAG,IAAI,CAiB5E;AAED,kHAAkH;AAClH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,SAA2B,GAAG;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAA;CAAE,GAAG,IAAI,CAUtI;AACD,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAI7B,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAK5C;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACtG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,SAAa,EAAE,WAAW,SAAI,GAAG,WAAW,CAO9F;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,SAA0B,GAAG,IAAI,CAGvF;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAU3E;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CASnM;AAID,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMzE"}
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../../src/stig/model.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,eAAO,MAAM,eAAe,2BAA2B,CAAC;AACxD,eAAO,MAAM,uBAAuB,mCAAmC,CAAC;AACxE,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AAClE,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AACpE,eAAO,MAAM,mBAAmB,0CAA0C,CAAC;AAC3E,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAC9C,eAAO,MAAM,kBAAkB,OAAO,CAAC;AACvC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,eAAO,MAAM,oBAAoB,kBAAkB,CAAC;AACpD,eAAO,MAAM,UAAU,kDAAmD,CAAC;AAC3E,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AACnD,eAAO,MAAM,sBAAsB,qEAAqE,CAAC;AACzG,eAAO,MAAM,qBAAqB,qEAAqE,CAAC;AACxG,eAAO,MAAM,qBAAqB,qEAAqE,CAAC;AACxG,eAAO,MAAM,eAAe,4CAA4C,CAAC;AACzE,eAAO,MAAM,YAAY,qDAAqD,CAAC;AAC/E,eAAO,MAAM,SAAS;;;;;EAAiG,CAAC;AAExH,eAAO,MAAM,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC,CAInE,CAAC;AACH,2GAA2G;AAC3G,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAA0B,CAAC;AAE7E,eAAO,MAAM,UAAU,oFAAqF,CAAC;AAC7G,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,sBAAsB,CAAC;IACtC,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE,YAAY,CAAC;IACtB,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAC;CAClF;AAED,eAAO,MAAM,eAAe,+FAAsC,CAAC;AACnE,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AAC1E,eAAO,MAAM,eAAe,iDAAiD,CAAC;AAC9E,eAAO,MAAM,mBAAmB,8CAA8C,CAAC;AAE/E,6FAA6F;AAC7F,MAAM,WAAW,QAAQ;IAAG,OAAO,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE;AAE1F,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,mBAAmB,CAAC;IACnC,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACpD,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAQD,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAahC,4GAA4G;AAC5G,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAM,GAAG,IAAI,CAchE;AAED,2FAA2F;AAC3F,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM3C;AAQD,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;CAAE,CA+ClH;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,CAOtD;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAWnM;AAID,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ5D;AAID,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAMvD;AAED,sGAAsG;AACtG,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAO/D;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,UAAU,CAInE;AAQD,kHAAkH;AAClH,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,CAK9I;AAED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,SAAY,GAAG,UAAU,CAI3F;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,IAAI,EACb,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,QAAQ,CAAA;CAAO,GACtJ,kBAAkB,CAqBpB;AAMD,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,OAAO,GAAG,kBAAkB,GAAG,IAAI,CAiB5E;AAED,kHAAkH;AAClH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,SAA2B,GAAG;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAA;CAAE,GAAG,IAAI,CAUtI;AACD,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAI7B,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAK5C;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACtG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,SAAa,EAAE,WAAW,SAAI,GAAG,WAAW,CAO9F;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,SAA0B,GAAG,IAAI,CAGvF;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAU3E;AAED,4GAA4G;AAC5G,eAAO,MAAM,6BAA6B,QAAW,CAAC;AACtD,eAAO,MAAM,cAAc,qBAAqB,CAAC;AAEjD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAQjG;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CASnM;AAID,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMzE"}

package/dist/src/stig/model.js

@@ -16,7 +16,8 @@ export const STIG_POOL_LIMIT_PERCENT = 70;
 export const STIG_TEMPLATE_PREFIX = "rhel810-stig-";
 export const STIG_MODES = ["build-template", "clone", "validate"];
 export const STIG_DATASTREAM_SHA256 = "82592d3cff74a82ce652a65ba67cd755cf57550269798d4c449c2069417c1028";
-export const STIG_TAILORING_SHA256 = "43560c40096a28b180685fe1383344a6d454a3a18666f2ead4a1ddd3d72ed7fd";
+export const STIG_TAILORING_SHA256 = "aa3d5fb5b798b5f07b2381e3d3b7063b7cd8758b25d4ebbdbc86095265003837";
+export const DISA_BENCHMARK_SHA256 = "968978518f7cd110e55fdd6a6a9bad0725a8e2177c0ef317650374ffce10c5d3";
 export const STIG_PROFILE_ID = "xccdf_com.calltelemetry_profile_stig_ct";
 export const STIG_DVD_ISO = "synology-cisco-isos:iso/rhel-8.10-x86_64-dvd.iso";
 export const STIG_PINS = Object.freeze({ ssg: "0.1.82", stig: "V2R8", packer: "1.16.0", packerProxmoxPlugin: "1.2.4" });
@@ -356,6 +357,23 @@ export function assertSingleReencrypt(claims, selfName) {
         }
     }
 }
+/** A running, non-template guest tagged rhel8-stig-clone for under this long may still be re-encrypting. */
+export const STIG_REENCRYPT_WINDOW_SECONDS = 4 * 3600;
+export const STIG_CLONE_TAG = "rhel8-stig-clone";
+/**
+ * Proxmox-level one-at-a-time guard: it sees clones from every path (the tools, the shell recipe) because it reads the
+ * guest tag and uptime rather than a claim annotation. `ownVmid` is the clone being created, which is never "another".
+ */
+export function assertNoYoungStigClone(guests, ownVmid) {
+    for (const g of guests || []) {
+        if (g.vmid === ownVmid || g.template === 1 || g.template === true || g.status !== "running")
+            continue;
+        const tags = String(g.tags ?? g.config?.tags ?? "").replace(/,/g, ";").split(";");
+        if (tags.includes(STIG_CLONE_TAG) && typeof g.uptime === "number" && g.uptime < STIG_REENCRYPT_WINDOW_SECONDS) {
+            throw new Error(`guest ${g.vmid} (${g.name}) is a STIG clone that may still be re-encrypting; only one at a time`);
+        }
+    }
+}
 export function assertTemplateReleaseAllowed(input) {
     const { guest, claim, destroyConfirmed } = input;
     if (!(guest?.template === 1 || guest?.template === true))