@calltelemetry/ct-lab-mcp 0.8.104 → 0.8.106

package/README.md

@@ -472,9 +472,19 @@ consumer update workflow.
   `confirmImageSha256`). `imageUrl` is exactly one of two identity URL shapes
   (https only; no query string, fragment, userinfo, or port; the retired GCS
   host is refused, ADR 0735):
-  - published, on the DigitalOcean Spaces release host
-    `calltelemetry-releases-nyc3.nyc3.digitaloceanspaces.com`:
-    `https://<host>/ovas/ct-<version>.qcow2`
+  - published, on the R2-backed download Worker host (REL-1785, ADR 0873/0874),
+    served at the host root (the Worker maps it to R2 key
+    `ovas/ct-<version>.qcow2`):
+    `https://download.calltelemetry.com/ct-<version>[-rc<N>].qcow2`, where
+    `<version>` has four numeric parts (the same pinned pattern as a
+    candidate). The retired DigitalOcean Spaces release host is refused. The
+    Worker answers 403 to unsigned requests, so a published import requires an
+    operator-minted, Worker-signed fetch URL in the gateway process environment
+    as `CT_IMPORT_QCOW_DOWNLOAD_URL` (ADR 0880): the unsigned URL above plus
+    exactly `expires` and `signature`. It is never a tool input, is forwarded
+    to the canonical CLI only through the child environment (as for candidates),
+    and a published request without it is refused before any claim or provider
+    call (no unsigned fallback; the message never echoes a URL).
   - private CI candidate for an unpublished RC (ADR 0727), on Cloudflare R2
     (REL-1785), path-style with the bucket as the first path segment:
     `https://<32-hex-account-id>.r2.cloudflarestorage.com/ct-ci-candidates/candidates/<version>/<run_id>/ct-<version>.qcow2`,

package/assets/stig/SHA256SUMS

@@ -16,3 +16,4 @@ eb119e742a4791404ca298c962515ffe3492814dfc72aecac16c420ccb3b0ccc  guest/keyhash.
 6b3eab512392c9b68499cb3b4a753377bcc499b810e7259d8ede5e10861bf674  guest/verify-root.sh
 770cbf1c4ea374772d6e80734b1fe4d7d7f5826c8c528a5371f4dfea196479d7  guest/verify-user.sh
 b4a37a0425369c99dfe9b63086155b7ffaa0ef73f98b158143ecb0cd84d45d94  guest/scan-disa.sh
+65e5a3ca041b44d496e81cd961c3fa70ac0bf6804ef9b3f48a9997fa83902d07  image/verify-image.sh

package/assets/stig/image/verify-image.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+# Verify a published STIG image on the host that runs it (read-only; no secrets).
+# Run on a Proxmox node:  ssh root@<node> "STORE=/mnt/pve/ct-stig-images TPL=<template> FPR=<fingerprint> bash -s" < verify-image.sh
+# Checks, with the pinned evidence-key fingerprint: public key fingerprint, index.json signature,
+# template.json sha256 + signature, qcow2 sha256 + signature. Exit 0 and VERIFY_OK on success.
+set -euo pipefail
+: "${STORE:?}" "${TPL:?}" "${FPR:?}"
+cd "$STORE/rhel8-stig"
+H="$(mktemp -d /tmp/stgv.XXXXXX)"; chmod 700 "$H"
+trap 'gpgconf --homedir "$H" --kill all >/dev/null 2>&1; rm -rf "$H"' EXIT
+G="gpg --homedir $H --batch --no-tty --yes"
+$G --import stig-evidence-signing.pub.asc >/dev/null 2>&1
+$G --list-keys --with-colons 2>/dev/null | grep -q "^fpr:::::::::$FPR:" || { echo "pubkey fingerprint mismatch" >&2; exit 1; }
+vok() { $G --status-fd 1 --verify "$2" "$1" 2>/dev/null | grep VALIDSIG | grep -q "$FPR" || { echo "BAD signature: $1" >&2; exit 1; }; }
+vok index.json index.json.asc
+read -r QS TS < <(python3 -I - "$TPL" <<'PY'
+import json, sys
+i = json.load(open("index.json"))
+v = [x for x in i["versions"] if x["name"] == sys.argv[1]]
+if not v: sys.exit("template not in index.json")
+print(v[0]["qcow2_sha256"], v[0]["template_json_sha256"])
+PY
+)
+[ "$(sha256sum "$TPL/template.json" | cut -d' ' -f1)" = "$TS" ] || { echo "template.json sha256 mismatch" >&2; exit 1; }
+vok "$TPL/template.json" "$TPL/template.json.asc"
+[ "$(sha256sum "../import/$TPL.qcow2" | cut -d' ' -f1)" = "$QS" ] || { echo "qcow2 sha256 mismatch" >&2; exit 1; }
+vok "../import/$TPL.qcow2" "$TPL/$TPL.qcow2.asc"
+echo "VERIFY_OK qcow2_sha256=$QS template_json_sha256=$TS"

package/dist/src/generated-version.d.ts

@@ -2,5 +2,5 @@
  * Auto-synced package version fallback for non-filesystem runtimes (Cloudflare Workers).
  * Updated automatically during release publication in .github/workflows/publish.yml.
  */
-export declare const PACKAGE_VERSION = "0.8.104";
+export declare const PACKAGE_VERSION = "0.8.106";
 //# sourceMappingURL=generated-version.d.ts.map

package/dist/src/generated-version.js

@@ -2,5 +2,5 @@
  * Auto-synced package version fallback for non-filesystem runtimes (Cloudflare Workers).
  * Updated automatically during release publication in .github/workflows/publish.yml.
  */
-export const PACKAGE_VERSION = "0.8.104";
+export const PACKAGE_VERSION = "0.8.106";
 //# sourceMappingURL=generated-version.js.map

package/dist/src/stig/dist.d.ts

@@ -0,0 +1,121 @@
+export declare const TEMPLATE_JSON_SCHEMA = "calltelemetry-rhel8-stig-template/v1";
+export declare const INDEX_SCHEMA = "calltelemetry-rhel8-stig-index/v1";
+export declare const PUBLISH_RECEIPT_SCHEMA = "calltelemetry-rhel8-stig-publish-receipt/v1";
+export declare const SYNC_RECEIPT_SCHEMA = "calltelemetry-rhel8-stig-sync-receipt/v1";
+export declare const EXPORT_DONE = "PUBLISH_EXPORT_DONE";
+export declare const SYNC_DONE = "SYNC_CREATE_DONE";
+export declare const DISK_OPTIONS = "cache=none,discard=on,iothread=1,replicate=0";
+export declare const EFIDISK = "efitype=4m,ms-cert=2023k,pre-enrolled-keys=1";
+export declare const TPM_NOTE = "version=v2.0 (fresh per clone)";
+type Json = Record<string, any>;
+export declare function assertTemplateName(name: string): string;
+/** Python `json.dump(obj, indent=2, sort_keys=True)` plus the trailing newline the scripts add. */
+export declare function pyJson(value: unknown): string;
+/** Python `datetime.now(utc).strftime("%Y-%m-%dT%H:%M:%SZ")`. */
+export declare const utcStamp: (ms: number) => string;
+/** Python `shlex.quote`. */
+export declare function shlexQuote(s: string): string;
+export declare const baseLv: (vmid: number) => string;
+/**
+ * The detached export script (publish.sh REMOTE heredoc). The base LV must be read-only; it is activated with -K only
+ * when inactive and deactivated afterwards, so it is never made writable.
+ */
+export declare function buildExportScript(a: {
+    template: string;
+    vmid: number;
+    store?: string;
+}): string;
+/** `qm config` text to a map (key: value, split on the first ": "). */
+export declare function parseQmConfig(text: string): Record<string, string>;
+/** Python `urllib.parse.unquote` for the percent-encoded description Proxmox stores. */
+export declare function pyUnquote(s: string): string;
+export interface TemplateJsonInput {
+    template: string;
+    vmid: number;
+    qcowSha256: string;
+    qcowBytes: number;
+    virtualBytes: number;
+    qmConfig: string;
+    /** keys like result_pass, disa_result_fail */
+    scan: Record<string, number>;
+    receiptSha256: string | null;
+    manifestSha256: string | null;
+    publishedMs: number;
+    store?: string;
+}
+export declare function buildTemplateJson(i: TemplateJsonInput): Json;
+/** Receipt-summary counts as the summary.txt-style keys the scripts publish (result_pass, disa_result_fail, ...). */
+export declare function scanFromSummary(summary: {
+    counts: Record<string, number>;
+    disa?: {
+        counts: Record<string, number>;
+    };
+} | null | undefined): Record<string, number>;
+export interface IndexEntry {
+    name: string;
+    build_vmid: number;
+    qcow2: string;
+    qcow2_sha256: string;
+    qcow2_bytes: number;
+    qcow2_signature: string;
+    template_json: string;
+    template_json_sha256: string;
+    template_json_signature: string;
+    published: string;
+}
+export interface StigIndex {
+    schema: string;
+    signing_key_fpr: string;
+    latest: string;
+    retention: number;
+    versions: IndexEntry[];
+}
+/** The index entry for one published template is verified when it lists the template (the node-side signature check is separate). */
+export declare function indexHas(index: Json | null, template: string): boolean;
+export declare function parseIndex(text: string | null): Json;
+/** Every name in an existing index.json must be a template name before it is copied or reaches `rm -rf`. */
+export declare function assertIndexNames(index: Json): void;
+/** The index position the template would take (0 = newest). */
+export declare function indexRank(old: Json, template: string): number;
+export declare function buildIndex(a: {
+    old: Json;
+    template: string;
+    vmid: number;
+    qcowSha256: string;
+    qcowBytes: number;
+    templateJsonSha256: string;
+    publishedMs: number;
+    keep?: number;
+}): {
+    index: StigIndex;
+    dropped: string[];
+};
+export declare function buildPublishReceipt(a: {
+    template: Json;
+    index: StigIndex;
+    buildNode: string;
+    pruned: string[];
+}): Json;
+export declare function buildSyncReceipt(a: {
+    template: string;
+    node: string;
+    vmid: number;
+    claim: string;
+    mode: string;
+    qcowSha256: string;
+    thin: string;
+    lvSizeBytes: number;
+    mappedPercent: number;
+    syncedMs: number;
+}): Json;
+export declare function validateTemplateJson(t: unknown, template: string): Json;
+/** The detached `qm create` + `qm template` script (sync.sh python heredoc). Bridge has no VLAN tag: the tag belongs to clones. */
+export declare function buildQmCreateScript(a: {
+    template: Json;
+    vmid: number;
+    thin: string;
+    bridge: string;
+    store?: string;
+}): string;
+export {};
+//# sourceMappingURL=dist.d.ts.map

package/dist/src/stig/dist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dist.d.ts","sourceRoot":"","sources":["../../../src/stig/dist.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,oBAAoB,yCAAyC,CAAC;AAC3E,eAAO,MAAM,YAAY,sCAAsC,CAAC;AAChE,eAAO,MAAM,sBAAsB,gDAAgD,CAAC;AACpF,eAAO,MAAM,mBAAmB,6CAA6C,CAAC;AAC9E,eAAO,MAAM,WAAW,wBAAwB,CAAC;AACjD,eAAO,MAAM,SAAS,qBAAqB,CAAC;AAC5C,eAAO,MAAM,YAAY,iDAAiD,CAAC;AAC3E,eAAO,MAAM,OAAO,iDAAiD,CAAC;AACtE,eAAO,MAAM,QAAQ,mCAAmC,CAAC;AAEzD,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAIhC,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGvD;AAED,mGAAmG;AACnG,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAG7C;AAED,iEAAiE;AACjE,eAAO,MAAM,QAAQ,GAAI,IAAI,MAAM,KAAG,MAA8D,CAAC;AAErG,4BAA4B;AAC5B,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAG5C;AAID,eAAO,MAAM,MAAM,GAAI,MAAM,MAAM,KAAG,MAAmC,CAAC;AAE1E;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAuB/F;AAID,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQlE;AAED,wFAAwF;AACxF,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAI3C;AAYD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAe5D;AAED,qHAAqH;AACrH,wBAAgB,eAAe,CAAC,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMjK;AAID,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IACpH,aAAa,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAC;IAAC,uBAAuB,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;CACzG;AACD,MAAM,WAAW,SAAS;IAAG,MAAM,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;CAAE;AAEjI,qIAAqI;AACrI,wBAAgB,QAAQ,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAKpD;AAED,4GAA4G;AAC5G,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,CAMlD;AAED,+DAA+D;AAC/D,wBAAgB,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG7D;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE;IAAE,GAAG,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAe3N;AAID,wBAAgB,mBAAmB,CAAC,CAAC,EAAE;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAQtH;AAED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAOvN;AAID,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAcvE;AAED,mIAAmI;AACnI,wBAAgB,mBAAmB,CAAC,CAAC,EAAE;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAU7H"}

package/dist/src/stig/dist.js

@@ -0,0 +1,234 @@
+/**
+ * STIG image distribution: pure builders for the published artifacts (export script, template.json, index.json,
+ * `qm create` script, receipts). Every output mirrors the ct-meta `rhel8-stig-template` scripts (publish.sh,
+ * sync.sh) and `tools/stig-parity.mjs dist` diffs them against those scripts. No I/O here.
+ */
+import { STIG_EVIDENCE_FPR, STIG_STORE, STIG_IMAGE_KEEP_VERSIONS } from "./nodes.js";
+export const TEMPLATE_JSON_SCHEMA = "calltelemetry-rhel8-stig-template/v1";
+export const INDEX_SCHEMA = "calltelemetry-rhel8-stig-index/v1";
+export const PUBLISH_RECEIPT_SCHEMA = "calltelemetry-rhel8-stig-publish-receipt/v1";
+export const SYNC_RECEIPT_SCHEMA = "calltelemetry-rhel8-stig-sync-receipt/v1";
+export const EXPORT_DONE = "PUBLISH_EXPORT_DONE";
+export const SYNC_DONE = "SYNC_CREATE_DONE";
+export const DISK_OPTIONS = "cache=none,discard=on,iothread=1,replicate=0";
+export const EFIDISK = "efitype=4m,ms-cert=2023k,pre-enrolled-keys=1";
+export const TPM_NOTE = "version=v2.0 (fresh per clone)";
+const TEMPLATE_NAME = /^rhel810-stig-\d{8}-\d{4}$/;
+const SHA256 = /^[a-f0-9]{64}$/;
+export function assertTemplateName(name) {
+    if (!TEMPLATE_NAME.test(name))
+        throw new Error("template name must look like rhel810-stig-YYYYMMDD-VMID");
+    return name;
+}
+/** Python `json.dump(obj, indent=2, sort_keys=True)` plus the trailing newline the scripts add. */
+export function pyJson(value) {
+    const norm = (v) => (Array.isArray(v) ? v.map(norm) : v && typeof v === "object" ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, norm(v[k])])) : v);
+    return `${JSON.stringify(norm(value), null, 2).replace(/[\u0080-\uFFFF]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`)}\n`;
+}
+/** Python `datetime.now(utc).strftime("%Y-%m-%dT%H:%M:%SZ")`. */
+export const utcStamp = (ms) => new Date(ms).toISOString().replace(/\.\d{3}Z$/, "Z");
+/** Python `shlex.quote`. */
+export function shlexQuote(s) {
+    if (s === "")
+        return "''";
+    return /[^A-Za-z0-9_@%+=:,./-]/.test(s) ? `'${s.replace(/'/g, `'"'"'`)}'` : s;
+}
+/* ------------------------------------------------------------------ export */
+export const baseLv = (vmid) => `pve/base-${vmid}-disk-1`;
+/**
+ * The detached export script (publish.sh REMOTE heredoc). The base LV must be read-only; it is activated with -K only
+ * when inactive and deactivated afterwards, so it is never made writable.
+ */
+export function buildExportScript(a) {
+    const store = a.store ?? STIG_STORE.mount;
+    const { template: tpl, vmid } = a;
+    return [
+        "set -euo pipefail",
+        `lv=${baseLv(vmid)}`,
+        `out=${store}/import/${tpl}.qcow2`,
+        `attr_before="$(lvs --noheadings -o lv_attr $lv | tr -d ' ')"`,
+        "activated=0",
+        `case "$attr_before" in ?r*) ;; *) echo "base LV is not read-only ($attr_before)"; exit 1;; esac`,
+        `if [ "$(lvs --noheadings -o lv_active $lv | tr -d ' ')" != active ]; then lvchange -ay -K $lv; activated=1; fi`,
+        `rm -f "$out.partial"`,
+        `qemu-img convert -f raw -O qcow2 -c -m 4 "/dev/$lv" "$out.partial"`,
+        `qemu-img check "$out.partial" >/dev/null`,
+        `mv "$out.partial" "$out"`,
+        `[ "$activated" = 1 ] && lvchange -an $lv`,
+        `attr_after="$(lvs --noheadings -o lv_attr $lv | tr -d ' ')"`,
+        `echo "lv_attr before=$attr_before after=$attr_after activated_by_publish=$activated"`,
+        `qemu-img info --output=json "$out" > "${store}/rhel8-stig/${tpl}.qemu-img-info.json"`,
+        `sha256sum "$out" | cut -d' ' -f1 > "${store}/rhel8-stig/${tpl}.qcow2.sha256"`,
+        `echo ${EXPORT_DONE}`,
+        "",
+    ].join("\n");
+}
+/* ------------------------------------------------------------ template.json */
+/** `qm config` text to a map (key: value, split on the first ": "). */
+export function parseQmConfig(text) {
+    const cfg = {};
+    for (const line of text.split("\n")) {
+        if (line === "")
+            continue;
+        const i = line.indexOf(": ");
+        if (i < 0)
+            cfg[line] = "";
+        else
+            cfg[line.slice(0, i)] = line.slice(i + 2);
+    }
+    return cfg;
+}
+/** Python `urllib.parse.unquote` for the percent-encoded description Proxmox stores. */
+export function pyUnquote(s) {
+    return s.replace(/(?:%[0-9A-Fa-f]{2})+/g, (m) => {
+        try {
+            return decodeURIComponent(m);
+        }
+        catch {
+            return Buffer.from(m.replace(/%/g, ""), "hex").toString("latin1");
+        }
+    });
+}
+const need = (cfg, key) => {
+    const v = cfg[key];
+    if (v === undefined)
+        throw new Error(`qm config of the template has no ${key}`);
+    return v;
+};
+const intOf = (v, what) => {
+    if (!/^\d+$/.test(v))
+        throw new Error(`${what} is not an integer`);
+    return Number.parseInt(v, 10);
+};
+export function buildTemplateJson(i) {
+    const cfg = parseQmConfig(i.qmConfig);
+    const hardware = {
+        bios: need(cfg, "bios"), machine: need(cfg, "machine"), cpu: need(cfg, "cpu"), cores: intOf(need(cfg, "cores"), "cores"),
+        sockets: intOf(cfg.sockets ?? "1", "sockets"), memory_mb: intOf(need(cfg, "memory"), "memory"), scsihw: need(cfg, "scsihw"),
+        ostype: need(cfg, "ostype"), agent: cfg.agent ?? "1", numa: cfg.numa ?? "0",
+        disk_bytes: i.virtualBytes, disk_options: DISK_OPTIONS, efidisk: EFIDISK, tpm: TPM_NOTE, cloudinit: "ide0",
+        tags: cfg.tags ?? "", net0_model: "virtio",
+    };
+    return {
+        schema: TEMPLATE_JSON_SCHEMA, name: i.template, build_vmid: i.vmid, published: utcStamp(i.publishedMs),
+        description: pyUnquote(cfg.description ?? ""),
+        image: { file: `${i.store ?? STIG_STORE.name}:import/${i.template}.qcow2`, format: "qcow2", compressed: true, sha256: i.qcowSha256, bytes: i.qcowBytes, virtual_bytes: i.virtualBytes },
+        hardware, scan: i.scan, receipt_sha256: i.receiptSha256, evidence_manifest_sha256: i.manifestSha256,
+    };
+}
+/** Receipt-summary counts as the summary.txt-style keys the scripts publish (result_pass, disa_result_fail, ...). */
+export function scanFromSummary(summary) {
+    const scan = {};
+    if (!summary)
+        return scan;
+    for (const [k, v] of Object.entries(summary.counts))
+        scan[`result_${k}`] = v;
+    if (summary.disa)
+        for (const [k, v] of Object.entries(summary.disa.counts))
+            scan[`disa_result_${k}`] = v;
+    return scan;
+}
+/** The index entry for one published template is verified when it lists the template (the node-side signature check is separate). */
+export function indexHas(index, template) {
+    return Array.isArray(index?.versions) && index.versions.some((v) => v?.name === template);
+}
+export function parseIndex(text) {
+    if (!text || !text.trim())
+        return {};
+    const parsed = JSON.parse(text);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        throw new Error("index.json is not an object");
+    return parsed;
+}
+/** Every name in an existing index.json must be a template name before it is copied or reaches `rm -rf`. */
+export function assertIndexNames(index) {
+    if (index.versions === undefined)
+        return;
+    if (!Array.isArray(index.versions))
+        throw new Error("index.json versions is not a list");
+    for (const v of index.versions) {
+        if (typeof v?.name !== "string" || !TEMPLATE_NAME.test(v.name))
+            throw new Error(`index.json lists an invalid template name (${JSON.stringify(String(v?.name)).slice(0, 60)}); refusing to rewrite it`);
+    }
+}
+/** The index position the template would take (0 = newest). */
+export function indexRank(old, template) {
+    const names = new Set([template, ...(Array.isArray(old?.versions) ? old.versions.map((v) => v.name) : [])]);
+    return [...names].sort().reverse().indexOf(template);
+}
+export function buildIndex(a) {
+    const keep = a.keep ?? STIG_IMAGE_KEEP_VERSIONS;
+    const old = Array.isArray(a.old?.versions) ? a.old.versions : [];
+    const entry = {
+        name: a.template, build_vmid: a.vmid, qcow2: `import/${a.template}.qcow2`, qcow2_sha256: a.qcowSha256, qcow2_bytes: a.qcowBytes,
+        qcow2_signature: `rhel8-stig/${a.template}/${a.template}.qcow2.asc`, template_json: `rhel8-stig/${a.template}/template.json`,
+        template_json_sha256: a.templateJsonSha256, template_json_signature: `rhel8-stig/${a.template}/template.json.asc`, published: utcStamp(a.publishedMs),
+    };
+    const versions = [entry, ...old.filter((v) => v.name !== a.template)];
+    versions.sort((x, y) => (x.name < y.name ? 1 : x.name > y.name ? -1 : 0)); // reverse by name, as Python's sort(reverse=True)
+    const kept = versions.slice(0, keep);
+    return {
+        index: { schema: INDEX_SCHEMA, signing_key_fpr: STIG_EVIDENCE_FPR, latest: kept[0].name, retention: keep, versions: kept },
+        dropped: versions.slice(keep).map((v) => v.name),
+    };
+}
+/* ----------------------------------------------------------------- receipts */
+export function buildPublishReceipt(a) {
+    const t = a.template;
+    const i = a.index;
+    return {
+        schema: PUBLISH_RECEIPT_SCHEMA, template: t.name, build_node: a.buildNode, published: t.published,
+        qcow2_sha256: t.image.sha256, qcow2_bytes: t.image.bytes, virtual_bytes: t.image.virtual_bytes,
+        template_json_sha256: i.versions[0].name === t.name ? i.versions[0].template_json_sha256 : null,
+        signing_key_fpr: i.signing_key_fpr, latest: i.latest, versions: i.versions.map((v) => v.name), pruned: a.pruned, scan: t.scan,
+    };
+}
+export function buildSyncReceipt(a) {
+    return {
+        schema: SYNC_RECEIPT_SCHEMA, template: a.template, node: a.node, vmid: a.vmid, claim: a.claim, mode: a.mode, qcow2_sha256: a.qcowSha256,
+        verified: Object.fromEntries(["index_signature", "template_json_signature", "qcow2_signature", "qcow2_sha256", "template_json_sha256"].map((k) => [k, true])),
+        thin_storage: a.thin, disk_virtual_bytes: Math.trunc(a.lvSizeBytes), disk_mapped_bytes: Math.trunc(a.lvSizeBytes * a.mappedPercent / 100),
+        disk_mapped_percent: a.mappedPercent, synced: utcStamp(a.syncedMs),
+    };
+}
+/* ---------------------------------------------------------------- qm create */
+export function validateTemplateJson(t, template) {
+    const bad = (m) => { throw new Error(`template.json refused: ${m}`); };
+    if (!t || typeof t !== "object")
+        return bad("not an object");
+    const j = t;
+    if (j.schema !== TEMPLATE_JSON_SCHEMA)
+        bad(`schema is not ${TEMPLATE_JSON_SCHEMA}`);
+    if (j.name !== template)
+        bad("name does not match the requested template");
+    const img = j.image;
+    if (!img || img.file !== `${STIG_STORE.name}:import/${template}.qcow2` || img.format !== "qcow2" || !SHA256.test(img.sha256))
+        bad("image block is not the published qcow2");
+    const h = j.hardware;
+    if (!h || typeof h !== "object")
+        return bad("hardware missing");
+    for (const k of ["bios", "machine", "cpu", "scsihw", "ostype", "agent", "numa", "disk_options", "efidisk"])
+        if (typeof h[k] !== "string" || h[k] === "")
+            bad(`hardware.${k} missing`);
+    for (const k of ["cores", "sockets", "memory_mb"])
+        if (!Number.isInteger(h[k]) || h[k] < 1)
+            bad(`hardware.${k} must be a positive integer`);
+    if (typeof h.tags !== "string" || typeof j.description !== "string")
+        bad("tags or description missing");
+    return j;
+}
+/** The detached `qm create` + `qm template` script (sync.sh python heredoc). Bridge has no VLAN tag: the tag belongs to clones. */
+export function buildQmCreateScript(a) {
+    const t = a.template;
+    const h = t.hardware;
+    const store = a.store ?? STIG_STORE.name;
+    const img = String(t.image.file).split(":").slice(1).join(":");
+    const args = ["qm", "create", String(a.vmid), "--name", t.name, "--bios", h.bios, "--machine", h.machine, "--cpu", h.cpu,
+        "--cores", String(h.cores), "--sockets", String(h.sockets), "--memory", String(h.memory_mb),
+        "--scsihw", h.scsihw, "--ostype", h.ostype, "--agent", h.agent, "--numa", h.numa,
+        "--net0", `virtio,bridge=${a.bridge}`, "--tags", h.tags, "--description", t.description,
+        "--efidisk0", `${a.thin}:1,${h.efidisk}`, "--ide0", `${a.thin}:cloudinit`,
+        "--scsi0", `${a.thin}:0,import-from=${store}:${img},${h.disk_options}`, "--boot", "order=scsi0"];
+    return `set -euo pipefail\n${args.map(shlexQuote).join(" ")}\nqm template ${a.vmid}\necho ${SYNC_DONE}\n`;
+}
+//# sourceMappingURL=dist.js.map

package/dist/src/stig/dist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dist.js","sourceRoot":"","sources":["../../../src/stig/dist.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAErF,MAAM,CAAC,MAAM,oBAAoB,GAAG,sCAAsC,CAAC;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,mCAAmC,CAAC;AAChE,MAAM,CAAC,MAAM,sBAAsB,GAAG,6CAA6C,CAAC;AACpF,MAAM,CAAC,MAAM,mBAAmB,GAAG,0CAA0C,CAAC;AAC9E,MAAM,CAAC,MAAM,WAAW,GAAG,qBAAqB,CAAC;AACjD,MAAM,CAAC,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAC5C,MAAM,CAAC,MAAM,YAAY,GAAG,8CAA8C,CAAC;AAC3E,MAAM,CAAC,MAAM,OAAO,GAAG,8CAA8C,CAAC;AACtE,MAAM,CAAC,MAAM,QAAQ,GAAG,gCAAgC,CAAC;AAGzD,MAAM,aAAa,GAAG,4BAA4B,CAAC;AACnD,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAEhC,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC1G,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,MAAM,IAAI,GAAG,CAAC,CAAM,EAAO,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxK,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC;AAC/I,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AAErG,4BAA4B;AAC5B,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,YAAY,IAAI,SAAS,CAAC;AAE1E;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAqD;IACrF,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAC1C,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAClC,OAAO;QACL,mBAAmB;QACnB,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE;QACpB,OAAO,KAAK,WAAW,GAAG,QAAQ;QAClC,8DAA8D;QAC9D,aAAa;QACb,iGAAiG;QACjG,gHAAgH;QAChH,sBAAsB;QACtB,oEAAoE;QACpE,0CAA0C;QAC1C,0BAA0B;QAC1B,0CAA0C;QAC1C,6DAA6D;QAC7D,sFAAsF;QACtF,yCAAyC,KAAK,eAAe,GAAG,sBAAsB;QACtF,uCAAuC,KAAK,eAAe,GAAG,gBAAgB;QAC9E,QAAQ,WAAW,EAAE;QACrB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,gFAAgF;AAEhF,uEAAuE;AACvE,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;;YAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,SAAS,CAAC,CAAS;IACjC,OAAO,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE;QAC9C,IAAI,CAAC;YAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;IACpH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,GAA2B,EAAE,GAAW,EAAU,EAAE;IAChE,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;IAChF,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AACF,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,IAAY,EAAU,EAAE;IAChD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC,CAAC;AAiBF,MAAM,UAAU,iBAAiB,CAAC,CAAoB;IACpD,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG;QACf,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QACxH,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC;QAC3H,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG;QAC3E,UAAU,EAAE,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM;QAC1G,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,UAAU,EAAE,QAAQ;KAC3C,CAAC;IACF,OAAO;QACL,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;QACtG,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;QAC7C,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,WAAW,CAAC,CAAC,QAAQ,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,YAAY,EAAE;QACvL,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,aAAa,EAAE,wBAAwB,EAAE,CAAC,CAAC,cAAc;KACpG,CAAC;AACJ,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,eAAe,CAAC,OAAyG;IACvI,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,IAAI;QAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IACzG,OAAO,IAAI,CAAC;AACd,CAAC;AAUD,qIAAqI;AACrI,MAAM,UAAU,QAAQ,CAAC,KAAkB,EAAE,QAAgB;IAC3D,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,KAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAmB;IAC5C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACnH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,gBAAgB,CAAC,KAAW;IAC1C,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACzF,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,CAAC;IACzM,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,SAAS,CAAC,GAAS,EAAE,QAAgB;IACnD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1H,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAuJ;IAChL,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,wBAAwB,CAAC;IAChD,MAAM,GAAG,GAAiB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAe;QACxB,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,QAAQ,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC,SAAS;QAC/H,eAAe,EAAE,cAAc,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,YAAY,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,QAAQ,gBAAgB;QAC5H,oBAAoB,EAAE,CAAC,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAAC,QAAQ,oBAAoB,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;KACtJ,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kDAAkD;IAC7H,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACrC,OAAO;QACL,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC1H,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,MAAM,UAAU,mBAAmB,CAAC,CAA4E;IAC9G,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IACxC,OAAO;QACL,MAAM,EAAE,sBAAsB,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;QACjG,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa;QAC9F,oBAAoB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI;QAC/F,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;KAC9H,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,CAAgL;IAC/M,OAAO;QACL,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,UAAU;QACvI,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,cAAc,EAAE,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7J,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,aAAa,GAAG,GAAG,CAAC;QACzI,mBAAmB,EAAE,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,MAAM,UAAU,oBAAoB,CAAC,CAAU,EAAE,QAAgB;IAC/D,MAAM,GAAG,GAAG,CAAC,CAAS,EAAS,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7D,MAAM,CAAC,GAAG,CAAS,CAAC;IACpB,IAAI,CAAC,CAAC,MAAM,KAAK,oBAAoB;QAAE,GAAG,CAAC,iBAAiB,oBAAoB,EAAE,CAAC,CAAC;IACpF,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,GAAG,CAAC,4CAA4C,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC;IACpB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,UAAU,CAAC,IAAI,WAAW,QAAQ,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,GAAG,CAAC,wCAAwC,CAAC,CAAC;IAC5K,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IACrB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChE,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,CAAC;QAAE,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACtL,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,YAAY,CAAC,6BAA6B,CAAC,CAAC;IAC5I,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QAAE,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACxG,OAAO,CAAC,CAAC;AACX,CAAC;AAED,mIAAmI;AACnI,MAAM,UAAU,mBAAmB,CAAC,CAAiF;IACnH,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC;IACrF,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG;QACtH,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI;QAChF,QAAQ,EAAE,iBAAiB,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,WAAW;QACvF,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,YAAY;QACzE,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,kBAAkB,KAAK,IAAI,GAAG,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IACnG,OAAO,sBAAsB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,UAAU,SAAS,IAAI,CAAC;AAC5G,CAAC"}

package/dist/src/stig/distribution.d.ts

@@ -0,0 +1,80 @@
+import { type StigNodeName } from "./nodes.js";
+import type { StigDeps } from "./ports.js";
+export declare const SYNC_CLAIM_TTL_HOURS = 6;
+/** The detached job outlived the poll budget; it keeps running and nothing is cleaned up. Re-apply to keep waiting. */
+export declare class StillRunningError extends Error {
+    constructor(what: string);
+}
+export interface PublishPlan {
+    mode: "plan";
+    template: string;
+    vmid: number | null;
+    buildNode: StigNodeName;
+    host: string;
+    store: string;
+    keepVersions: number;
+    noop: boolean;
+    force: boolean;
+    published: boolean;
+    receiptFound: boolean;
+    steps: readonly string[];
+    planDigest: string;
+}
+export interface SyncPlan {
+    mode: "plan";
+    template: string;
+    node: StigNodeName;
+    host: string;
+    claim: string;
+    claimNode: string;
+    vmid: number | null;
+    thin: string;
+    bridge: string;
+    noop: boolean;
+    syncMode: "synced" | "origin" | "already-present" | "adopted" | "resume";
+    poolPercent: number | null;
+    poolMaxPercent: number;
+    blockedBy: string | null;
+    steps: readonly string[];
+    planDigest: string;
+}
+export declare const PUBLISH_STEPS: readonly ["verify-published", "export", "template-json", "sign", "index", "upload", "prune", "verify", "receipt"];
+export declare const SYNC_STEPS: readonly ["claim", "verify", "qm-create", "template", "renew", "receipt"];
+export declare class StigDistribution {
+    private readonly d;
+    constructor(d: StigDeps);
+    private log;
+    private sh;
+    private buildNode;
+    private distDir;
+    /** true when index.json lists the template and the node-side verification (fingerprint, signatures, sha256) passes. */
+    private verifiedOn;
+    planPublish(i: {
+        template: string;
+        force?: boolean;
+    }): Promise<PublishPlan>;
+    publish(i: {
+        template: string;
+        force?: boolean;
+        apply?: boolean;
+        planDigest?: string;
+        receiptPath?: string;
+        manifestPath?: string;
+    }): Promise<any>;
+    private exec;
+    /** An unreachable node counts as busy: pruning is the one irreversible step. */
+    private anyNodeImporting;
+    planSync(i: {
+        template: string;
+        node: string;
+    }): Promise<SyncPlan>;
+    sync(i: {
+        template: string;
+        node: string;
+        apply?: boolean;
+        planDigest?: string;
+    }): Promise<any>;
+    /** Destroys a half-created VM (only if it is the one this sync named) and releases the claim. Never called once the template is final. */
+    private cleanup;
+}
+//# sourceMappingURL=distribution.d.ts.map

package/dist/src/stig/distribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"distribution.d.ts","sourceRoot":"","sources":["../../../src/stig/distribution.ts"],"names":[],"mappings":"AAUA,OAAO,EAEU,KAAK,YAAY,EACjC,MAAM,YAAY,CAAC;AAOpB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAItC,uHAAuH;AACvH,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,IAAI,EAAE,MAAM;CACzB;AASD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAChI,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;CACxH;AACD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACxH,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,iBAAiB,GAAG,SAAS,GAAG,QAAQ,CAAC;IACtH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;CAC5H;AAED,eAAO,MAAM,aAAa,mHAAoH,CAAC;AAC/I,eAAO,MAAM,UAAU,2EAA4E,CAAC;AAEpG,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAAD,CAAC,EAAE,QAAQ;IAExC,OAAO,CAAC,GAAG;IACX,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,OAAO;IAEf,uHAAuH;YACzG,UAAU;IAMlB,WAAW,CAAC,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IA2B3E,OAAO,CAAC,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;YA2F1I,IAAI;IAKlB,gFAAgF;YAClE,gBAAgB;IASxB,QAAQ,CAAC,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IA+BlE,IAAI,CAAC,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IA+DrG,0IAA0I;YAC5H,OAAO;CAatB"}