@calltelemetry/ct-lab-mcp 0.8.105 → 0.8.107

package/dist/src/stig/evidence.d.ts

@@ -0,0 +1,135 @@
+import type { StigDeps } from "./ports.js";
+export declare const SKILL_REL = "plugins/ct-lab/skills/rhel8-stig-template";
+export declare const LEDGER_REL = "knowledge/rhel8-stig";
+export declare const OVAL_FEED_URL = "https://security.access.redhat.com/data/oval/v2/RHEL8/rhel-8.oval.xml.bz2";
+/** The stage order of evidence.sh (its STAGES array); the parity test compares `evidence.sh --list`. */
+export declare const EVIDENCE_STAGES: readonly ["preflight", "scan", "oval", "keyhash", "collect", "verify", "receipt", "e1", "e7", "e3", "e6", "e8", "e5", "report", "e2", "e4", "e10", "docs", "distribution", "sign", "explorer", "resign", "verify-bundle", "tests"];
+export type EvidenceStage = (typeof EVIDENCE_STAGES)[number];
+/** Stages that read the clone (guest or hypervisor, read-only). */
+export declare const CLONE_STAGES: readonly ["scan", "oval", "keyhash", "collect", "verify"];
+/** Generator stages that are one python invocation. */
+export declare const GENERATOR_STAGES: readonly ["e1", "e7", "e3", "e6", "e8", "e5", "report", "e2", "e4", "e10", "docs"];
+declare const shq: (s: string) => string;
+export interface EvidenceCtx {
+    /** ct-meta checkout (reads the skill's tools and pins). */
+    ctMeta: string;
+    template: string;
+    clone: string;
+    /** knowledge/rhel8-stig layout the generators write into. */
+    planRoot: string;
+    /** clone run state (evidence.sh `runs/clone-<name>`). */
+    state: string;
+    /** template build evidence (evidence.sh `runs/<template>`). */
+    runDir: string;
+    manualStigZip: string;
+    schemaDir: string;
+    ssgDatastream: string;
+    benchmarkZip?: string;
+    benchmarkXml?: string;
+    today: string;
+    claimUid: string;
+    python?: string;
+}
+export declare const skillDir: (ctMeta: string) => string;
+export declare const pinsFile: (ctMeta: string) => string;
+export declare const tailoringFile: (ctMeta: string) => string;
+/**
+ * The argument list evidence.sh passes the generator of `stage` (null for stages that are not one python call).
+ * `receipt` yields the receipt gate; `verify-bundle` the bundle verification; `preflight` the pins check.
+ */
+export declare function generatorCommand(stage: EvidenceStage, c: EvidenceCtx): string[] | null;
+/**
+ * The plan root is written (and, when scratch, re-seeded) by the tool, so it must never be, contain or sit inside the ct-meta
+ * checkout or the ledger, except the ledger itself; a scratch root must be new, empty, or one this tool seeded.
+ */
+export declare function assertSafePlanRoot(planRoot: string, ctMeta: string, ledger: string, baseDir: string): void;
+export interface EvidenceInput {
+    cloneName?: string;
+    claimName?: string;
+    template: string;
+    node?: string;
+    /** ct-meta checkout that holds the skill (tools, pins) and the ledger layout. */
+    ctMetaPath: string;
+    /** Where the generators write (knowledge/rhel8-stig layout). Default: a scratch copy under the run directory; the ledger is never written unless this names it. */
+    planRoot?: string;
+    /** Template build evidence directory (contains evidence/stig-report): needed to write the receipt for this clone. */
+    templateRunDir?: string;
+    manualStigZip?: string;
+    schemaDir?: string;
+    ssgDatastream?: string;
+    benchmarkZip?: string;
+    benchmarkXml?: string;
+    /** Directory holding publish-<template>.json and sync-<template>-<node>.json (default: <run dir>/dist). */
+    distDir?: string;
+    today?: string;
+    from?: EvidenceStage;
+    only?: EvidenceStage;
+    force?: boolean;
+    noSign?: boolean;
+    skipTests?: boolean;
+    apply?: boolean;
+    planDigest?: string;
+}
+export interface EvidenceStageState {
+    stage: EvidenceStage;
+    kind: "clone-read" | "controller";
+    state: "pending" | "current" | "not-selected";
+}
+export interface EvidencePlan {
+    mode: "plan";
+    cloneName: string;
+    claim: string;
+    claimUid: string;
+    node: string;
+    template: string;
+    vmid: number;
+    planRoot: string;
+    ledger: boolean;
+    ctMeta: string;
+    receiptSource: "regenerate" | "ledger";
+    stages: EvidenceStageState[];
+    guards: string[];
+    planDigest: string;
+}
+export interface StageOutcome {
+    stage: EvidenceStage;
+    status: "ran" | "skipped-current" | "skipped";
+    detail?: string;
+    ms: number;
+}
+export declare class EvidenceError extends Error {
+}
+export declare class StigEvidence {
+    private readonly d;
+    constructor(d: StigDeps);
+    private log;
+    private resolveInputs;
+    /** Read-only checks plus the stage table. Throws when a guard refuses. */
+    plan(i: EvidenceInput): Promise<EvidencePlan>;
+    collect(i: EvidenceInput): Promise<any>;
+    private apply;
+    private runStage;
+    private genEnv;
+    private gen;
+    private preflight;
+    /** SBOM schemas pinned by sha256 (evidence-pins.json); downloaded when the cache is missing or stale. */
+    private fetchSchemas;
+    private oval;
+    /** Read-only host facts for E3/E6/E7/E8 (clone.sh `do_collect`). */
+    private collectHost;
+    /** receipt.sh (receipt.py plus the artifact copies) then the receipt gate; or the gate alone when the ledger holds the receipt. */
+    /**
+     * clone.sh `scan` stores an ARF over 5 MB as `.xz` with `.raw.sha256` and `.xz.sha256` beside it; validate_stig_claim leaves the
+     * raw file. Normalize to the shell recipe's form (idempotent), because receipt.sh and the E2 generator read the `.xz`.
+     */
+    private compressScanArtifacts;
+    private receipt;
+    private distribution;
+    /** A scratch plan root is a copy of the ledger without this template's evidence (and, when the receipt is regenerated, its receipt files). */
+    private seedPlanRoot;
+    private receiptOf;
+}
+/** [evidence file, guest script, add the rpm-inventory header]. Order = clone.sh `do_collect`. */
+declare const COLLECT_FILES: ReadonlyArray<readonly [string, string, boolean]>;
+export { COLLECT_FILES, shq };
+//# sourceMappingURL=evidence.d.ts.map

package/dist/src/stig/evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../../src/stig/evidence.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,eAAO,MAAM,SAAS,8CAA8C,CAAC;AACrE,eAAO,MAAM,UAAU,yBAAyB,CAAC;AACjD,eAAO,MAAM,aAAa,8EAA8E,CAAC;AAIzG,wGAAwG;AACxG,eAAO,MAAM,eAAe,oOAGlB,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAC7D,mEAAmE;AACnE,eAAO,MAAM,YAAY,2DAA4D,CAAC;AACtF,uDAAuD;AACvD,eAAO,MAAM,gBAAgB,oFAAqF,CAAC;AASnH,QAAA,MAAM,GAAG,GAAI,GAAG,MAAM,KAAG,MAAyC,CAAC;AAInE,MAAM,WAAW,WAAW;IAC1B,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,QAAQ,GAAI,QAAQ,MAAM,KAAG,MAAiC,CAAC;AAE5E,eAAO,MAAM,QAAQ,GAAI,QAAQ,MAAM,KAAG,MAAiE,CAAC;AAC5G,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,KAAG,MAA4D,CAAC;AAU5G;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,EAAE,WAAW,GAAG,MAAM,EAAE,GAAG,IAAI,CA2BtF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAU1G;AAID,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAC;IACnB,mKAAmK;IACnK,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qHAAqH;IACrH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2GAA2G;IAC3G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IAAG,KAAK,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,YAAY,GAAG,YAAY,CAAC;IAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,cAAc,CAAA;CAAE;AAC9I,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IACjG,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,YAAY,GAAG,QAAQ,CAAC;IAC1F,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;CACpE;AACD,MAAM,WAAW,YAAY;IAAG,KAAK,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,KAAK,GAAG,iBAAiB,GAAG,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE;AAElI,qBAAa,aAAc,SAAQ,KAAK;CAAG;AAI3C,qBAAa,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAAD,CAAC,EAAE,QAAQ;IAExC,OAAO,CAAC,GAAG;IAEX,OAAO,CAAC,aAAa;IAwBrB,0EAA0E;IACpE,IAAI,CAAC,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IAgD7C,OAAO,CAAC,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC;YAS/B,KAAK;YAsCL,QAAQ;IAwDtB,OAAO,CAAC,MAAM;YAIA,GAAG;YAUH,SAAS;IAiBvB,yGAAyG;YAC3F,YAAY;YAcZ,IAAI;IAkClB,oEAAoE;YACtD,WAAW;IAsBzB,mIAAmI;IACnI;;;OAGG;YACW,qBAAqB;YAYrB,OAAO;YAkCP,YAAY;IAkB1B,8IAA8I;IAC9I,OAAO,CAAC,YAAY;IAyBpB,OAAO,CAAC,SAAS;CA4ClB;AAED,kGAAkG;AAClG,QAAA,MAAM,aAAa,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAYpE,CAAC;AAEF,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC"}