@calltelemetry/ct-lab-mcp 0.8.144 → 0.8.146

package/README.md

@@ -911,3 +911,16 @@ issuing one.
 MIT © 2026 [Call Telemetry](https://calltelemetry.com) / Contributors
 
 See [resource admission and runtime activation](docs/runbooks/resource-admission.md) for compatibility fields and release verification.
+
+
+## Per-claim credential Secret (UAT-1663)
+
+Dynamic guest credentials no longer go to Doppler. Each ApplianceClaim has one Kubernetes Secret
+`claim-<claim name>-credentials` in `ct-lab` (label `calltelemetry.com/credential-kind: claim-guest`, ownerReference to the
+claim so Kubernetes garbage-collects it; claim release/destroy also deletes it explicitly and idempotently). Allowed keys:
+`credential.json`, `claim-entry.json`, `admin-password`, `ssh-password`, `ssh-private-key`, `LAB_RHEL8_RECOVERY`,
+`LAB_RHEL8_PROVISIONING`, `LAB_RHEL8_OBSERVER`, `LAB_RHEL8_REGISTRATION`. `src/credentials/claim-secret.ts` is the only writer
+(exact-name GET/POST/PATCH/DELETE through the hardened claim transport; no Secret list; a Secret without the credential-kind
+label is never overwritten). `CredentialResolver.resolveGuestCredential({ claimName | vmUuid })` reads Secret-first and falls
+back to the Doppler `LAB_VM_CREDENTIALS_<UUID>` entry only as a read-only result marked `legacy: true` for not-yet-migrated
+guests. Doppler keeps static secrets only; `test/credentials/no-doppler-claim-writes.test.ts` fails if src/ can write to it.

package/dist/src/appliance/executor.d.ts

@@ -1,7 +1,7 @@
 /**
  * Remote Appliance SSH Executor using pure-JS ssh2 Client
  *
- * Connects to Call Telemetry appliances on Port 2222 using Doppler-resolved credentials.
+ * Connects to Call Telemetry appliances on Port 2222 using credentials from the claim Secret claim-<name>-credentials (legacy Doppler read-only fallback).
  * Handles connect & execution timeouts, and guarantees output sanitization & secret redaction.
  */
 import { ApplianceExecParams, ApplianceExecResult, IApplianceExecutor } from "./types.js";

package/dist/src/appliance/executor.js

@@ -1,7 +1,7 @@
 /**
  * Remote Appliance SSH Executor using pure-JS ssh2 Client
  *
- * Connects to Call Telemetry appliances on Port 2222 using Doppler-resolved credentials.
+ * Connects to Call Telemetry appliances on Port 2222 using credentials from the claim Secret claim-<name>-credentials (legacy Doppler read-only fallback).
  * Handles connect & execution timeouts, and guarantees output sanitization & secret redaction.
  */
 import { logger } from "../utils/logger.js";

package/dist/src/credentials/claim-secret.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Per-claim credential Secret (contract ct-lab-claim-credentials/v1).
+ *
+ * Dynamic guest credentials live in ONE Kubernetes Secret per ApplianceClaim in `ct-lab`, named
+ * `claim-<claim name>-credentials`, owned (ownerReference) by the claim so Kubernetes garbage-collects it.
+ * Doppler holds only static secrets; it is read here only as an explicitly marked legacy fallback by the resolver.
+ *
+ * Never logs or returns a value in an error; names and key names only.
+ */
+import { CLAIM_SECRET_DATA_KEYS, type ClaimApi } from "../tools/claim-kubernetes.js";
+export { CLAIM_SECRET_DATA_KEYS };
+export type ClaimSecretKey = typeof CLAIM_SECRET_DATA_KEYS[number];
+export type ClaimSecretWriter = "ct-appliance-operator" | "ct-qualification-controller" | "ct-lab-mcp" | "lab-inventory";
+export declare const CLAIM_SECRET_NAMESPACE = "ct-lab";
+export declare const CREDENTIAL_KIND_LABEL = "calltelemetry.com/credential-kind";
+export declare const CREDENTIAL_KIND_VALUE = "claim-guest";
+export declare const MANAGED_BY_LABEL = "app.kubernetes.io/managed-by";
+export declare const CLAIM_LABEL = "calltelemetry.com/claim";
+export declare const VM_UUID_LABEL = "calltelemetry.com/vm-uuid";
+export declare const CLAIM_NAME_ANNOTATION = "calltelemetry.com/claim-name";
+export declare const CLAIM_UID_ANNOTATION = "calltelemetry.com/claim-uid";
+export declare const CREDENTIAL_KEY_ANNOTATION = "calltelemetry.com/credential-key";
+export type ClaimSecretData = Partial<Record<ClaimSecretKey, string>>;
+export interface ClaimSecretReadResult {
+    name: string;
+    data: ClaimSecretData;
+    keys: ClaimSecretKey[];
+}
+/** `claim-<name>-credentials`. Literal; a result over 253 characters or an invalid claim name is refused. */
+export declare function claimCredentialSecretName(claimName: string): string;
+/** Legacy Doppler key name for a guest: LAB_VM_CREDENTIALS_<UUID upper, - -> _>. */
+export declare function legacyCredentialKey(vmUuid: string): string;
+export declare function normalizeUuid(vmUuid: string): string;
+/** Throws on an unknown key or a non-string/empty value. Never echoes a value. */
+export declare function assertAllowedKeys(data: Record<string, unknown>): asserts data is ClaimSecretData;
+export interface BuildSecretInput {
+    claimName: string;
+    data: ClaimSecretData;
+    managedBy?: ClaimSecretWriter;
+    claimUid?: string;
+    vmUuid?: string;
+}
+/** The full Secret for first creation. ownerReference only when the claim exists (claimUid given). */
+export declare function buildClaimCredentialSecret(input: BuildSecretInput): {
+    apiVersion: string;
+    kind: string;
+    type: string;
+    metadata: {
+        ownerReferences?: {
+            apiVersion: string;
+            kind: string;
+            name: string;
+            uid: string;
+            controller: boolean;
+            blockOwnerDeletion: boolean;
+        }[] | undefined;
+        name: string;
+        namespace: string;
+        labels: Record<string, string>;
+        annotations: Record<string, string>;
+    };
+    data: {
+        [k: string]: string;
+    };
+};
+/** JSON merge-patch carrying only the keys the writer owns (other keys are untouched) plus identity metadata. */
+export declare function buildClaimCredentialPatch(input: BuildSecretInput & {
+    adoptOwner?: boolean;
+}): {
+    metadata: {
+        ownerReferences?: {
+            apiVersion: string;
+            kind: string;
+            name: string;
+            uid: string;
+            controller: boolean;
+            blockOwnerDeletion: boolean;
+        }[] | undefined;
+        labels: Record<string, string>;
+        annotations: Record<string, string>;
+    };
+    data: {
+        [k: string]: string;
+    };
+};
+export interface WriteResult {
+    action: "created" | "patched";
+    name: string;
+    keys: ClaimSecretKey[];
+    owned: boolean;
+}
+/**
+ * Create the claim's Secret or merge-patch the writer's keys into it. Refuses a Secret that lacks the
+ * `credential-kind: claim-guest` label. Without a live claim the Secret is created un-owned (the operator adopts it).
+ */
+export declare function writeClaimCredentialSecret(input: {
+    claimName: string;
+    data: ClaimSecretData;
+    managedBy?: ClaimSecretWriter;
+    vmUuid?: string;
+}, api?: ClaimApi): Promise<WriteResult>;
+/** Read a claim's credential Secret (null when absent or when it is not a claim-guest Secret). Values are returned to the caller only. */
+export declare function readClaimCredentialSecret(claimName: string, api?: ClaimApi): Promise<ClaimSecretReadResult | null>;
+export interface DeleteResult {
+    name: string;
+    deleted: boolean;
+    error?: string;
+}
+/** Idempotent explicit delete (404 is fine). Never throws: GC by ownerReference is the backstop. */
+export declare function deleteClaimCredentialSecret(claimName: string, api?: ClaimApi): Promise<DeleteResult>;
+/** uuid -> claim name via the existing claim list (never a Secret list). Matches claim label/annotation/status vm uuid. */
+export declare function findClaimNameByVmUuid(vmUuid: string, api?: ClaimApi): Promise<string | null>;
+export declare function readClaimCredentialByVmUuid(vmUuid: string, api?: ClaimApi): Promise<(ClaimSecretReadResult & {
+    claimName: string;
+}) | null>;
+//# sourceMappingURL=claim-secret.d.ts.map

package/dist/src/credentials/claim-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-secret.d.ts","sourceRoot":"","sources":["../../../src/credentials/claim-secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACqB,sBAAsB,EAAoD,KAAK,QAAQ,EAClH,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAClC,MAAM,MAAM,cAAc,GAAG,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAC;AACnE,MAAM,MAAM,iBAAiB,GAAG,uBAAuB,GAAG,6BAA6B,GAAG,YAAY,GAAG,eAAe,CAAC;AAEzH,eAAO,MAAM,sBAAsB,WAAW,CAAC;AAC/C,eAAO,MAAM,qBAAqB,sCAAsC,CAAC;AACzE,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AACnD,eAAO,MAAM,gBAAgB,iCAAiC,CAAC;AAC/D,eAAO,MAAM,WAAW,4BAA4B,CAAC;AACrD,eAAO,MAAM,aAAa,8BAA8B,CAAC;AACzD,eAAO,MAAM,qBAAqB,iCAAiC,CAAC;AACpE,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AAClE,eAAO,MAAM,yBAAyB,qCAAqC,CAAC;AAK5E,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;AACtE,MAAM,WAAW,qBAAqB;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,cAAc,EAAE,CAAA;CAAE;AAEtG,6GAA6G;AAC7G,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAInE;AAGD,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAG1D;AACD,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIpD;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,eAAe,CAKhG;AAoBD,MAAM,WAAW,gBAAgB;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,eAAe,CAAC;IAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AACjJ,sGAAsG;AACtG,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,gBAAgB;;;;;;;;;;;;;;;;;;;;;EAYjE;AACD,iHAAiH;AACjH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,gBAAgB,GAAG;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE;;;;;;;;;;;;;;;;EAQ3F;AASD,MAAM,WAAW,WAAW;IAAG,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,cAAc,EAAE,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE;AACpH;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,eAAe,CAAC;IAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACnG,GAAG,GAAE,QAA2B,GAC/B,OAAO,CAAC,WAAW,CAAC,CAwBtB;AAaD,0IAA0I;AAC1I,wBAAsB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,GAAE,QAA2B,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAK1I;AAED,MAAM,WAAW,YAAY;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE;AAChF,oGAAoG;AACpG,wBAAsB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,GAAE,QAA2B,GAAG,OAAO,CAAC,YAAY,CAAC,CAW5H;AAED,2HAA2H;AAC3H,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,GAAE,QAA2B,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAcpH;AACD,wBAAsB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,GAAE,QAA2B,GAAG,OAAO,CAAC,CAAC,qBAAqB,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAAC,CAKnK"}

package/dist/src/credentials/claim-secret.js

@@ -0,0 +1,198 @@
+/**
+ * Per-claim credential Secret (contract ct-lab-claim-credentials/v1).
+ *
+ * Dynamic guest credentials live in ONE Kubernetes Secret per ApplianceClaim in `ct-lab`, named
+ * `claim-<claim name>-credentials`, owned (ownerReference) by the claim so Kubernetes garbage-collects it.
+ * Doppler holds only static secrets; it is read here only as an explicitly marked legacy fallback by the resolver.
+ *
+ * Never logs or returns a value in an error; names and key names only.
+ */
+import { CLAIM_SECRETS_COLLECTION, CLAIM_SECRET_DATA_KEYS, CLAIM_SECRET_NAME, ClaimApiError, createClaimApi, } from "../tools/claim-kubernetes.js";
+export { CLAIM_SECRET_DATA_KEYS };
+export const CLAIM_SECRET_NAMESPACE = "ct-lab";
+export const CREDENTIAL_KIND_LABEL = "calltelemetry.com/credential-kind";
+export const CREDENTIAL_KIND_VALUE = "claim-guest";
+export const MANAGED_BY_LABEL = "app.kubernetes.io/managed-by";
+export const CLAIM_LABEL = "calltelemetry.com/claim";
+export const VM_UUID_LABEL = "calltelemetry.com/vm-uuid";
+export const CLAIM_NAME_ANNOTATION = "calltelemetry.com/claim-name";
+export const CLAIM_UID_ANNOTATION = "calltelemetry.com/claim-uid";
+export const CREDENTIAL_KEY_ANNOTATION = "calltelemetry.com/credential-key";
+const CLAIMS_PATH = "/apis/calltelemetry.com/v1alpha1/namespaces/ct-lab/applianceclaims";
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const LABEL_VALUE_RE = /^(?:[A-Za-z0-9](?:[A-Za-z0-9_.-]{0,61}[A-Za-z0-9])?)?$/;
+/** `claim-<name>-credentials`. Literal; a result over 253 characters or an invalid claim name is refused. */
+export function claimCredentialSecretName(claimName) {
+    const name = `claim-${claimName}-credentials`;
+    if (name.length > 253 || !CLAIM_SECRET_NAME.test(name) || !/^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/.test(claimName))
+        throw new Error("claim credential Secret name refused");
+    return name;
+}
+const secretPath = (claimName) => `${CLAIM_SECRETS_COLLECTION}/${claimCredentialSecretName(claimName)}`;
+/** Legacy Doppler key name for a guest: LAB_VM_CREDENTIALS_<UUID upper, - -> _>. */
+export function legacyCredentialKey(vmUuid) {
+    const id = normalizeUuid(vmUuid);
+    return `LAB_VM_CREDENTIALS_${id.toUpperCase().replace(/-/g, "_")}`;
+}
+export function normalizeUuid(vmUuid) {
+    const id = vmUuid.trim().toLowerCase();
+    if (!UUID_RE.test(id))
+        throw new Error("vm uuid must be a hyphenated SMBIOS UUID");
+    return id;
+}
+/** Throws on an unknown key or a non-string/empty value. Never echoes a value. */
+export function assertAllowedKeys(data) {
+    for (const [key, value] of Object.entries(data)) {
+        if (!CLAIM_SECRET_DATA_KEYS.includes(key))
+            throw new Error(`claim credential Secret key refused: ${key}`);
+        if (typeof value !== "string" || value.length === 0)
+            throw new Error(`claim credential Secret value for ${key} must be a non-empty string`);
+    }
+}
+const b64 = (v) => Buffer.from(v, "utf8").toString("base64");
+function ownerReference(claimName, claim) {
+    return { apiVersion: "calltelemetry.com/v1alpha1", kind: "ApplianceClaim", name: claimName, uid: claim.uid, controller: false, blockOwnerDeletion: false };
+}
+function metadataFor(claimName, managedBy, claim, vmUuid) {
+    const labels = { [CREDENTIAL_KIND_LABEL]: CREDENTIAL_KIND_VALUE, [MANAGED_BY_LABEL]: managedBy };
+    if (claimName.length <= 63 && LABEL_VALUE_RE.test(claimName))
+        labels[CLAIM_LABEL] = claimName;
+    const annotations = { [CLAIM_NAME_ANNOTATION]: claimName };
+    if (claim)
+        annotations[CLAIM_UID_ANNOTATION] = claim.uid;
+    if (vmUuid) {
+        const id = normalizeUuid(vmUuid);
+        labels[VM_UUID_LABEL] = id;
+        annotations[CREDENTIAL_KEY_ANNOTATION] = legacyCredentialKey(id);
+    }
+    return { labels, annotations };
+}
+/** The full Secret for first creation. ownerReference only when the claim exists (claimUid given). */
+export function buildClaimCredentialSecret(input) {
+    assertAllowedKeys(input.data);
+    const claim = input.claimUid ? { uid: input.claimUid } : null;
+    const { labels, annotations } = metadataFor(input.claimName, input.managedBy ?? "ct-lab-mcp", claim, input.vmUuid);
+    return {
+        apiVersion: "v1", kind: "Secret", type: "Opaque",
+        metadata: {
+            name: claimCredentialSecretName(input.claimName), namespace: CLAIM_SECRET_NAMESPACE, labels, annotations,
+            ...(claim ? { ownerReferences: [ownerReference(input.claimName, claim)] } : {}),
+        },
+        data: Object.fromEntries(Object.entries(input.data).map(([k, v]) => [k, b64(v)])),
+    };
+}
+/** JSON merge-patch carrying only the keys the writer owns (other keys are untouched) plus identity metadata. */
+export function buildClaimCredentialPatch(input) {
+    assertAllowedKeys(input.data);
+    const claim = input.claimUid ? { uid: input.claimUid } : null;
+    const { labels, annotations } = metadataFor(input.claimName, input.managedBy ?? "ct-lab-mcp", claim, input.vmUuid);
+    return {
+        metadata: { labels, annotations, ...(claim && input.adoptOwner ? { ownerReferences: [ownerReference(input.claimName, claim)] } : {}) },
+        data: Object.fromEntries(Object.entries(input.data).map(([k, v]) => [k, b64(v)])),
+    };
+}
+function isGuestSecret(secret) { return secret?.metadata?.labels?.[CREDENTIAL_KIND_LABEL] === CREDENTIAL_KIND_VALUE; }
+async function liveClaim(api, claimName) {
+    const claim = await api.request(`${CLAIMS_PATH}/${claimName}`, "GET");
+    return typeof claim?.metadata?.uid === "string" && claim.metadata.uid ? { uid: claim.metadata.uid } : null;
+}
+/**
+ * Create the claim's Secret or merge-patch the writer's keys into it. Refuses a Secret that lacks the
+ * `credential-kind: claim-guest` label. Without a live claim the Secret is created un-owned (the operator adopts it).
+ */
+export async function writeClaimCredentialSecret(input, api = createClaimApi()) {
+    assertAllowedKeys(input.data);
+    const name = claimCredentialSecretName(input.claimName);
+    const keys = Object.keys(input.data);
+    const claim = await liveClaim(api, input.claimName);
+    const common = { ...input, ...(claim ? { claimUid: claim.uid } : {}) };
+    const patch = async (existing) => {
+        if (!isGuestSecret(existing))
+            throw new Error(`refusing to overwrite Secret ${name}: it lacks label ${CREDENTIAL_KIND_LABEL}=${CREDENTIAL_KIND_VALUE}`);
+        const hasOwner = Array.isArray(existing.metadata?.ownerReferences) && existing.metadata.ownerReferences.some((o) => o?.kind === "ApplianceClaim" && o?.uid === claim?.uid);
+        await api.request(secretPath(input.claimName), "PATCH", buildClaimCredentialPatch({ ...common, adoptOwner: Boolean(claim) && !hasOwner }));
+        return { action: "patched", name, keys, owned: Boolean(claim) };
+    };
+    const existing = await api.request(secretPath(input.claimName), "GET");
+    if (existing)
+        return patch(existing);
+    try {
+        await api.request(CLAIM_SECRETS_COLLECTION, "POST", buildClaimCredentialSecret(common));
+        return { action: "created", name, keys, owned: Boolean(claim) };
+    }
+    catch (error) {
+        if (error instanceof ClaimApiError && error.status === 409) {
+            const raced = await api.request(secretPath(input.claimName), "GET");
+            if (raced)
+                return patch(raced);
+        }
+        throw error;
+    }
+}
+/** Decode the allowed keys of a Secret; unknown keys are ignored. */
+function decode(secret) {
+    const out = {};
+    const data = secret?.data;
+    if (!data || typeof data !== "object")
+        return out;
+    for (const key of CLAIM_SECRET_DATA_KEYS) {
+        const raw = data[key];
+        if (typeof raw === "string" && raw.length > 0)
+            out[key] = Buffer.from(raw, "base64").toString("utf8");
+    }
+    return out;
+}
+/** Read a claim's credential Secret (null when absent or when it is not a claim-guest Secret). Values are returned to the caller only. */
+export async function readClaimCredentialSecret(claimName, api = createClaimApi()) {
+    const secret = await api.request(secretPath(claimName), "GET");
+    if (!secret || !isGuestSecret(secret))
+        return null;
+    const data = decode(secret);
+    return { name: claimCredentialSecretName(claimName), data, keys: Object.keys(data) };
+}
+/** Idempotent explicit delete (404 is fine). Never throws: GC by ownerReference is the backstop. */
+export async function deleteClaimCredentialSecret(claimName, api = createClaimApi()) {
+    let name;
+    try {
+        name = claimCredentialSecretName(claimName);
+    }
+    catch (e) {
+        return { name: `claim-${claimName}-credentials`, deleted: false, error: String(e.message) };
+    }
+    try {
+        await api.request(secretPath(claimName), "DELETE", { apiVersion: "v1", kind: "DeleteOptions" });
+        return { name, deleted: true };
+    }
+    catch (error) {
+        if (error instanceof ClaimApiError && error.status === 404)
+            return { name, deleted: false };
+        // Only the status/name; remote text is never echoed.
+        return { name, deleted: false, error: error instanceof ClaimApiError ? `delete failed (${error.status ?? "unknown"})` : "delete failed" };
+    }
+}
+/** uuid -> claim name via the existing claim list (never a Secret list). Matches claim label/annotation/status vm uuid. */
+export async function findClaimNameByVmUuid(vmUuid, api = createClaimApi()) {
+    const id = normalizeUuid(vmUuid);
+    let path = `${CLAIMS_PATH}?limit=500`;
+    for (let page = 0; page < 20; page++) {
+        const list = await api.request(path, "GET");
+        for (const item of list?.items ?? []) {
+            const candidates = [item?.metadata?.labels?.[VM_UUID_LABEL], item?.metadata?.annotations?.[VM_UUID_LABEL], item?.status?.vmUuid, item?.status?.smbiosUuid, item?.spec?.vmUuid];
+            if (candidates.some(c => typeof c === "string" && c.toLowerCase() === id) && typeof item.metadata?.name === "string")
+                return item.metadata.name;
+        }
+        const next = list?.metadata?.continue;
+        if (!next || !/^[A-Za-z0-9%._~-]+$/.test(next))
+            return null;
+        path = `${CLAIMS_PATH}?limit=500&continue=${next}`;
+    }
+    return null;
+}
+export async function readClaimCredentialByVmUuid(vmUuid, api = createClaimApi()) {
+    const claimName = await findClaimNameByVmUuid(vmUuid, api);
+    if (!claimName)
+        return null;
+    const read = await readClaimCredentialSecret(claimName, api);
+    return read ? { ...read, claimName } : null;
+}
+//# sourceMappingURL=claim-secret.js.map

package/dist/src/credentials/claim-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-secret.js","sourceRoot":"","sources":["../../../src/credentials/claim-secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,wBAAwB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,GACnG,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAIlC,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAAC;AAC/C,MAAM,CAAC,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AACzE,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AACnD,MAAM,CAAC,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AACrD,MAAM,CAAC,MAAM,aAAa,GAAG,2BAA2B,CAAC;AACzD,MAAM,CAAC,MAAM,qBAAqB,GAAG,8BAA8B,CAAC;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,kCAAkC,CAAC;AAC5E,MAAM,WAAW,GAAG,oEAAoE,CAAC;AACzF,MAAM,OAAO,GAAG,gEAAgE,CAAC;AACjF,MAAM,cAAc,GAAG,wDAAwD,CAAC;AAKhF,6GAA6G;AAC7G,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,MAAM,IAAI,GAAG,SAAS,SAAS,cAAc,CAAC;IAC9C,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACzK,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,GAAG,wBAAwB,IAAI,yBAAyB,CAAC,SAAS,CAAC,EAAE,CAAC;AAEhH,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,sBAAsB,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;AACrE,CAAC;AACD,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACnF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,IAA6B;IAC7D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,CAAE,sBAA4C,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;QACjI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,6BAA6B,CAAC,CAAC;IAC9I,CAAC;AACH,CAAC;AACD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAGrE,SAAS,cAAc,CAAC,SAAiB,EAAE,KAAoB;IAC7D,OAAO,EAAE,UAAU,EAAE,4BAA4B,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;AAC7J,CAAC;AACD,SAAS,WAAW,CAAC,SAAiB,EAAE,SAA4B,EAAE,KAA2B,EAAE,MAAe;IAChH,MAAM,MAAM,GAA2B,EAAE,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,EAAE,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,CAAC;IACzH,IAAI,SAAS,CAAC,MAAM,IAAI,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,MAAM,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC;IAC9F,MAAM,WAAW,GAA2B,EAAE,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,CAAC;IACnF,IAAI,KAAK;QAAE,WAAW,CAAC,oBAAoB,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC;IACzD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC;QAC3B,WAAW,CAAC,yBAAyB,CAAC,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC;AAGD,sGAAsG;AACtG,MAAM,UAAU,0BAA0B,CAAC,KAAuB;IAChE,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnH,OAAO;QACL,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ;QAChD,QAAQ,EAAE;YACR,IAAI,EAAE,yBAAyB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,EAAE,WAAW;YACxG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF;QACD,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAW,CAAC,CAAC,CAAC,CAAC;KAC5F,CAAC;AACJ,CAAC;AACD,iHAAiH;AACjH,MAAM,UAAU,yBAAyB,CAAC,KAAkD;IAC1F,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnH,OAAO;QACL,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QACtI,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAW,CAAC,CAAC,CAAC,CAAC;KAC5F,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAW,IAAa,OAAO,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,qBAAqB,CAAC,KAAK,qBAAqB,CAAC,CAAC,CAAC;AAEpI,KAAK,UAAU,SAAS,CAAC,GAAa,EAAE,SAAiB;IACvD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,WAAW,IAAI,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC;IACtE,OAAO,OAAO,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7G,CAAC;AAGD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAmG,EACnG,MAAgB,cAAc,EAAE;IAEhC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACvE,MAAM,KAAK,GAAG,KAAK,EAAE,QAAa,EAAwB,EAAE;QAC1D,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,oBAAoB,qBAAqB,IAAI,qBAAqB,EAAE,CAAC,CAAC;QACxJ,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,gBAAgB,IAAI,CAAC,EAAE,GAAG,KAAK,KAAK,EAAE,GAAG,CAAC,CAAC;QAChL,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,yBAAyB,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC3I,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IAClE,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;IACvE,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,MAAM,EAAE,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC;QACxF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,aAAa,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;YACpE,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,SAAS,MAAM,CAAC,MAAW;IACzB,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,sBAAsB,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,0IAA0I;AAC1I,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,SAAiB,EAAE,MAAgB,cAAc,EAAE;IACjG,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,EAAE,IAAI,EAAE,yBAAyB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAqB,EAAE,CAAC;AAC3G,CAAC;AAGD,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,SAAiB,EAAE,MAAgB,cAAc,EAAE;IACnG,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QAAC,IAAI,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,SAAS,SAAS,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAAC,CAAC;IACpK,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAChG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,IAAI,KAAK,YAAY,aAAa,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5F,qDAAqD;QACrD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,aAAa,CAAC,CAAC,CAAC,kBAAkB,KAAK,CAAC,MAAM,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;IAC5I,CAAC;AACH,CAAC;AAED,2HAA2H;AAC3H,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAc,EAAE,MAAgB,cAAc,EAAE;IAC1F,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI,GAAG,GAAG,WAAW,YAAY,CAAC;IACtC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5C,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC/K,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,IAAI,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAClJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC;QACtC,IAAI,CAAC,IAAI,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5D,IAAI,GAAG,GAAG,WAAW,uBAAuB,IAAI,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,MAAc,EAAE,MAAgB,cAAc,EAAE;IAChG,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC"}

package/dist/src/credentials/guest-credential.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Guest credential resolution, Secret-first.
+ *
+ * 1. The claim's Secret `claim-<name>-credentials` (by claim name, or by SMBIOS uuid via the claim list).
+ * 2. LEGACY, read-only: the Doppler config entry LAB_VM_CREDENTIALS_<UUID>, only when no Secret exists
+ *    (not-yet-migrated entries). The result is explicitly marked `legacy: true`; nothing is ever written back.
+ */
+import type { ClaimApi } from "../tools/claim-kubernetes.js";
+import { type ClaimSecretData } from "./claim-secret.js";
+import type { VmCredentialConfig } from "./types.js";
+export interface GuestCredentialQuery {
+    claimName?: string;
+    vmUuid?: string;
+}
+export interface GuestCredentialResolution {
+    source: "claim-secret" | "legacy-doppler";
+    /** True for the Doppler fallback: the entry has not been migrated to a claim Secret. */
+    legacy: boolean;
+    claimName?: string;
+    vmCredentials: VmCredentialConfig;
+}
+export interface GuestCredentialDeps {
+    api?: ClaimApi;
+    /** Reads one legacy Doppler secret by key; undefined when absent or Doppler is not configured. */
+    legacyRead?: (key: string) => Promise<string | undefined>;
+}
+/** Map `credential.json` (v1: {ssh:{...}} or flat) and the plain keys onto a VmCredentialConfig. */
+export declare function vmCredentialsFromSecretData(data: ClaimSecretData): VmCredentialConfig | null;
+/** Default legacy reader: the whole Doppler config via the config-scoped token, picking one key. Read-only. */
+export declare function dopplerLegacyReader(env?: Record<string, string | undefined>): (key: string) => Promise<string | undefined>;
+export declare function resolveGuestCredential(query: GuestCredentialQuery, deps?: GuestCredentialDeps): Promise<GuestCredentialResolution | null>;
+//# sourceMappingURL=guest-credential.d.ts.map

package/dist/src/credentials/guest-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guest-credential.d.ts","sourceRoot":"","sources":["../../../src/credentials/guest-credential.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAE7D,OAAO,EACiF,KAAK,eAAe,EAC3G,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,WAAW,oBAAoB;IAAG,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AAC7E,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,cAAc,GAAG,gBAAgB,CAAC;IAC1C,wFAAwF;IACxF,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,kBAAkB,CAAC;CACnC;AACD,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,kGAAkG;IAClG,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC3D;AAED,oGAAoG;AACpG,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,eAAe,GAAG,kBAAkB,GAAG,IAAI,CAc5F;AAED,+GAA+G;AAC/G,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAOvI;AAED,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,oBAAoB,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAyBnJ"}

package/dist/src/credentials/guest-credential.js

@@ -0,0 +1,74 @@
+import { DopplerClient } from "./doppler.js";
+import { findClaimNameByVmUuid, legacyCredentialKey, normalizeUuid, readClaimCredentialSecret, } from "./claim-secret.js";
+/** Map `credential.json` (v1: {ssh:{...}} or flat) and the plain keys onto a VmCredentialConfig. */
+export function vmCredentialsFromSecretData(data) {
+    let parsed;
+    if (data["credential.json"]) {
+        try {
+            parsed = JSON.parse(data["credential.json"]);
+        }
+        catch {
+            parsed = undefined;
+        }
+    }
+    const ssh = parsed?.ssh ?? parsed;
+    const password = ssh?.password ?? ssh?.pass ?? data["ssh-password"] ?? data["admin-password"];
+    const privateKey = ssh?.privateKey ?? ssh?.private_key ?? data["ssh-private-key"];
+    if (!password && !privateKey)
+        return null;
+    return {
+        username: ssh?.username ?? ssh?.user ?? "calltelemetry",
+        password: password || undefined,
+        privateKey: privateKey || undefined,
+        passphrase: ssh?.passphrase,
+        port: ssh?.port ? Number(ssh.port) : 2222,
+    };
+}
+/** Default legacy reader: the whole Doppler config via the config-scoped token, picking one key. Read-only. */
+export function dopplerLegacyReader(env = process.env) {
+    return async (key) => {
+        const token = env.DOPPLER_TOKEN;
+        if (!token)
+            return undefined;
+        const secrets = await new DopplerClient({ token, project: env.DOPPLER_PROJECT, config: env.DOPPLER_CONFIG }).downloadSecrets();
+        return secrets[key];
+    };
+}
+export async function resolveGuestCredential(query, deps = {}) {
+    if (!query.claimName && !query.vmUuid)
+        throw new Error("claimName or vmUuid is required");
+    let api = deps.api;
+    if (!api) {
+        const { createClaimApi } = await import("../tools/claim-kubernetes.js");
+        api = createClaimApi();
+    }
+    let claimName = query.claimName;
+    let secretError;
+    try {
+        if (!claimName && query.vmUuid)
+            claimName = (await findClaimNameByVmUuid(query.vmUuid, api)) ?? undefined;
+        if (claimName) {
+            const secret = await readClaimCredentialSecret(claimName, api);
+            const vmCredentials = secret ? vmCredentialsFromSecretData(secret.data) : null;
+            if (vmCredentials)
+                return { source: "claim-secret", legacy: false, claimName, vmCredentials };
+        }
+    }
+    catch (error) {
+        secretError = error;
+    }
+    // LEGACY read-only fallback (static / not-yet-migrated entries). Needs a uuid to know the key.
+    if (query.vmUuid) {
+        const read = deps.legacyRead ?? dopplerLegacyReader();
+        const raw = await read(legacyCredentialKey(normalizeUuid(query.vmUuid)));
+        if (raw) {
+            const vmCredentials = vmCredentialsFromSecretData({ "credential.json": raw });
+            if (vmCredentials)
+                return { source: "legacy-doppler", legacy: true, ...(claimName ? { claimName } : {}), vmCredentials };
+        }
+    }
+    if (secretError)
+        throw secretError;
+    return null;
+}
+//# sourceMappingURL=guest-credential.js.map

package/dist/src/credentials/guest-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guest-credential.js","sourceRoot":"","sources":["../../../src/credentials/guest-credential.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,qBAAqB,EAAE,mBAAmB,EAAE,aAAa,EAAE,yBAAyB,GACrF,MAAM,mBAAmB,CAAC;AAiB3B,oGAAoG;AACpG,MAAM,UAAU,2BAA2B,CAAC,IAAqB;IAC/D,IAAI,MAAW,CAAC;IAChB,IAAI,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,GAAG,SAAS,CAAC;QAAC,CAAC;IAAC,CAAC;IACpH,MAAM,GAAG,GAAG,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC;IAClC,MAAM,QAAQ,GAAG,GAAG,EAAE,QAAQ,IAAI,GAAG,EAAE,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9F,MAAM,UAAU,GAAG,GAAG,EAAE,UAAU,IAAI,GAAG,EAAE,WAAW,IAAI,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAClF,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO;QACL,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,GAAG,EAAE,IAAI,IAAI,eAAe;QACvD,QAAQ,EAAE,QAAQ,IAAI,SAAS;QAC/B,UAAU,EAAE,UAAU,IAAI,SAAS;QACnC,UAAU,EAAE,GAAG,EAAE,UAAU;QAC3B,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;KAC1C,CAAC;AACJ,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,mBAAmB,CAAC,MAA0C,OAAO,CAAC,GAAG;IACvF,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC;QAC/H,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAA2B,EAAE,OAA4B,EAAE;IACtG,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC1F,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACnB,IAAI,CAAC,GAAG,EAAE,CAAC;QAAC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;QAAC,GAAG,GAAG,cAAc,EAAE,CAAC;IAAC,CAAC;IAC9G,IAAI,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAChC,IAAI,WAAoB,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM;YAAE,SAAS,GAAG,CAAC,MAAM,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC;QAC1G,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAC/D,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,2BAA2B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/E,IAAI,aAAa;gBAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QAChG,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,WAAW,GAAG,KAAK,CAAC;IAAC,CAAC;IACxC,+FAA+F;IAC/F,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,EAAE,CAAC;QACtD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACzE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,aAAa,GAAG,2BAA2B,CAAC,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9E,IAAI,aAAa;gBAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC;QAC3H,CAAC;IACH,CAAC;IACD,IAAI,WAAW;QAAE,MAAM,WAAW,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/credentials/remediation.js

@@ -46,7 +46,7 @@ const CANONICAL_ALTERNATIVE = "Reads that do not need this aggregate bundle: lis
     "canonical lab-inventory CLI), the ApplianceClaim tools, and `lab-inventory` itself. Legacy tools such as " +
     "list_slots stay blocked with CREDENTIALS_UNAVAILABLE until the bundle resolves; do not inject unrelated hosts' " +
     "credentials just to unblock one VM. A shared appliance login is not required: guests are dynamic, and their " +
-    "per-VM `LAB_VM_CREDENTIALS_<UUID>` secrets belong to the canonical CLI.";
+    "per-guest credentials live in the claim Kubernetes Secret `claim-<name>-credentials` in ct-lab (legacy `LAB_VM_CREDENTIALS_<UUID>` Doppler entries are read-only fallbacks) and belong to the canonical CLI.";
 const VERIFY_STEP = "Reload the server (manage_mcp_server reload, or restart the harness) and call credential_status again: the " +
     "tier should read direct_env or doppler_api and the legacy aggregate source resolved. A host listed here as " +
     "reachable is the only evidence the credentials work; mock mode (CT_LAB_MCP_ALLOW_MOCK=1) is for offline tests " +

package/dist/src/credentials/remediation.js.map

@@ -1 +1 @@
-{"version":3,"file":"remediation.js","sourceRoot":"","sources":["../../../src/credentials/remediation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA6BH,MAAM,GAAG,GAAG,CAAC,GAAQ,EAAE,GAAW,EAAW,EAAE,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACrG,MAAM,MAAM,GAAG,CAAC,GAAQ,EAAE,IAAc,EAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAExF,SAAS,mBAAmB,CAAC,GAAQ,EAAE,MAAc;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,KAAK,EAAE,GAAG,MAAM,UAAU,EAAE,GAAG,MAAM,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC;IACpG,MAAM,IAAI,GACR,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,WAAW,CAAC;QAC9B,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,UAAU,EAAE,GAAG,MAAM,cAAc,CAAC,CAAC;YAC1D,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,cAAc,EAAE,GAAG,MAAM,kBAAkB,CAAC,CAAC,CAAC;QACtE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/G,OAAO,QAAQ,IAAI,IAAI,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAAW,OAAO,CAAC,GAAG;IACjE,OAAO;QACL;YACE,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,mBAAmB,CAAC,GAAG,EAAE,cAAc,CAAC;YACjD,KAAK,EAAE,6EAA6E;SACrF;QACD;YACE,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,mBAAmB,CAAC,GAAG,EAAE,oBAAoB,CAAC,IAAI,mBAAmB,CAAC,GAAG,EAAE,mBAAmB,CAAC;YACxG,KAAK,EAAE,yFAAyF;SACjG;QACD;YACE,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,IAAI;YACd,OAAO,EACL,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;gBACrD,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,6BAA6B,EAAE,yBAAyB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;oBAChG,MAAM,CAAC,GAAG,EAAE,CAAC,6BAA6B,EAAE,yBAAyB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;YACtG,KAAK,EAAE,qGAAqG;SAC7G;KACF,CAAC;AACJ,CAAC;AAED,MAAM,qBAAqB,GACzB,iHAAiH;IACjH,2GAA2G;IAC3G,iHAAiH;IACjH,8GAA8G;IAC9G,yEAAyE,CAAC;AAE5E,MAAM,WAAW,GACf,6GAA6G;IAC7G,6GAA6G;IAC7G,gHAAgH;IAChH,mCAAmC,CAAC;AAEtC,MAAM,UAAU,0BAA0B,CACxC,KAAoF,EACpF,MAAW,OAAO,CAAC,GAAG;IAEtB,MAAM,SAAS,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzE,MAAM,qBAAqB,GAAG,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,IAAI,sBAAsB,CAAC;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,WAAW,GAAG,GAAa,EAAE,CAAC;QAClC,sEAAsE;YACpE,gHAAgH;QAClH,0GAA0G;YACxG,yGAAyG;YACzG,0GAA0G;YAC1G,uGAAuG;YACvG,wEAAwE;YACxE,uDAAuD;QACzD,qBAAqB;YACnB,CAAC,CAAC,oGAAoG;gBACpG,4FAA4F;YAC9F,CAAC,CAAC,uGAAuG;gBACvG,wGAAwG;KAC7G,CAAC;IAEF,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CACR,6GAA6G;YAC3G,gGAAgG,EAClG,iHAAiH,EACjH,+EAA+E,CAChF,CAAC;IACJ,CAAC;SAAM,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CACR,iFACE,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAC5F,GAAG,EACH,GAAG,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAC1B,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CACR,mDAAmD;YACjD,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9D,GAAG,CACN,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC;IAE/C,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM;QACvC,CAAC,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC;QACrF,CAAC,CAAC,wDAAwD,CAAC;IAC7D,MAAM,QAAQ,GACZ,MAAM,KAAK,qBAAqB;QAC9B,CAAC,CAAC,6FAA6F;QAC/F,CAAC,CAAC,0CAA0C,YAAY,iDAAiD;YACvG,mIAAmI;YACnI,wGAAwG;YACxG,uBAAuB,CAAC;IAE9B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"remediation.js","sourceRoot":"","sources":["../../../src/credentials/remediation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA6BH,MAAM,GAAG,GAAG,CAAC,GAAQ,EAAE,GAAW,EAAW,EAAE,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACrG,MAAM,MAAM,GAAG,CAAC,GAAQ,EAAE,IAAc,EAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAExF,SAAS,mBAAmB,CAAC,GAAQ,EAAE,MAAc;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,KAAK,EAAE,GAAG,MAAM,UAAU,EAAE,GAAG,MAAM,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC;IACpG,MAAM,IAAI,GACR,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,WAAW,CAAC;QAC9B,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,UAAU,EAAE,GAAG,MAAM,cAAc,CAAC,CAAC;YAC1D,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,cAAc,EAAE,GAAG,MAAM,kBAAkB,CAAC,CAAC,CAAC;QACtE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/G,OAAO,QAAQ,IAAI,IAAI,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAAW,OAAO,CAAC,GAAG;IACjE,OAAO;QACL;YACE,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,mBAAmB,CAAC,GAAG,EAAE,cAAc,CAAC;YACjD,KAAK,EAAE,6EAA6E;SACrF;QACD;YACE,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,mBAAmB,CAAC,GAAG,EAAE,oBAAoB,CAAC,IAAI,mBAAmB,CAAC,GAAG,EAAE,mBAAmB,CAAC;YACxG,KAAK,EAAE,yFAAyF;SACjG;QACD;YACE,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,IAAI;YACd,OAAO,EACL,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;gBACrD,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,6BAA6B,EAAE,yBAAyB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;oBAChG,MAAM,CAAC,GAAG,EAAE,CAAC,6BAA6B,EAAE,yBAAyB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;YACtG,KAAK,EAAE,qGAAqG;SAC7G;KACF,CAAC;AACJ,CAAC;AAED,MAAM,qBAAqB,GACzB,iHAAiH;IACjH,2GAA2G;IAC3G,iHAAiH;IACjH,8GAA8G;IAC9G,8MAA8M,CAAC;AAEjN,MAAM,WAAW,GACf,6GAA6G;IAC7G,6GAA6G;IAC7G,gHAAgH;IAChH,mCAAmC,CAAC;AAEtC,MAAM,UAAU,0BAA0B,CACxC,KAAoF,EACpF,MAAW,OAAO,CAAC,GAAG;IAEtB,MAAM,SAAS,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzE,MAAM,qBAAqB,GAAG,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,IAAI,sBAAsB,CAAC;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,WAAW,GAAG,GAAa,EAAE,CAAC;QAClC,sEAAsE;YACpE,gHAAgH;QAClH,0GAA0G;YACxG,yGAAyG;YACzG,0GAA0G;YAC1G,uGAAuG;YACvG,wEAAwE;YACxE,uDAAuD;QACzD,qBAAqB;YACnB,CAAC,CAAC,oGAAoG;gBACpG,4FAA4F;YAC9F,CAAC,CAAC,uGAAuG;gBACvG,wGAAwG;KAC7G,CAAC;IAEF,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CACR,6GAA6G;YAC3G,gGAAgG,EAClG,iHAAiH,EACjH,+EAA+E,CAChF,CAAC;IACJ,CAAC;SAAM,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CACR,iFACE,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAC5F,GAAG,EACH,GAAG,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAC1B,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CACR,mDAAmD;YACjD,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9D,GAAG,CACN,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC;IAE/C,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM;QACvC,CAAC,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC;QACrF,CAAC,CAAC,wDAAwD,CAAC;IAC7D,MAAM,QAAQ,GACZ,MAAM,KAAK,qBAAqB;QAC9B,CAAC,CAAC,6FAA6F;QAC/F,CAAC,CAAC,0CAA0C,YAAY,iDAAiD;YACvG,mIAAmI;YACnI,wGAAwG;YACxG,uBAAuB,CAAC;IAE9B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC;AAC/D,CAAC"}

package/dist/src/credentials/resolver.d.ts

@@ -6,6 +6,7 @@
  * Tier 3: In-Memory Mock Fallback
  */
 import { ProxmoxHostConfig, EsxiHostConfig, ResolutionOptions, CredentialResolutionResult, CanonicalCredentialEnv } from "./types.js";
+import { type GuestCredentialDeps, type GuestCredentialQuery, type GuestCredentialResolution } from "./guest-credential.js";
 export declare const DEFAULT_DOPPLER_TIMEOUT_MS = 8000;
 export declare const MIN_DOPPLER_TIMEOUT_MS = 250;
 export declare const MAX_DOPPLER_TIMEOUT_MS = 30000;
@@ -53,6 +54,12 @@ export declare class CredentialResolver {
      * Extract Appliance / VM credentials (LAB_VM_CREDENTIALS_* or LAB_VM_CREDENTIALS JSON/slug).
      */
     private extractVmCredentials;
+    /**
+     * Per-guest credential, Secret-first: the claim's Secret `claim-<name>-credentials` (by claim name, or by SMBIOS uuid
+     * through the claim list); only when none exists, a read-only Doppler LAB_VM_CREDENTIALS_<UUID> entry marked
+     * `legacy: true`. Dynamic claim credentials are never written to Doppler.
+     */
+    resolveGuestCredential(query: GuestCredentialQuery, deps?: GuestCredentialDeps): Promise<GuestCredentialResolution | null>;
     private createMockResult;
     private createMockProxmoxHost;
     private createMockVmCredentials;

package/dist/src/credentials/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/credentials/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,iBAAiB,EAEjB,cAAc,EAEd,iBAAiB,EACjB,0BAA0B,EAE1B,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAcpB,eAAO,MAAM,0BAA0B,OAAQ,CAAC;AAChD,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAC1C,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,CAMvF;AAkCD;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,iBAAiB,GAAG,cAAc,EACxC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,sBAAsB,CAiCxB;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAA6B;IACtE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAwB;IAClE,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAmB;IAE9D;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,eAAe;IASvB;;;;;;;;;OASG;IACG,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAuMnF;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAgHhC;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAM7B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IA+F5B,OAAO,CAAC,gBAAgB;IAiBxB,OAAO,CAAC,qBAAqB;IAuB7B,OAAO,CAAC,uBAAuB;IAS/B,OAAO,CAAC,kBAAkB;CAwB3B;AAED,eAAO,MAAM,kBAAkB,oBAA2B,CAAC"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/credentials/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,iBAAiB,EAEjB,cAAc,EAEd,iBAAiB,EACjB,0BAA0B,EAE1B,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAA0B,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,KAAK,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAapJ,eAAO,MAAM,0BAA0B,OAAQ,CAAC;AAChD,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAC1C,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,CAMvF;AAkCD;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,iBAAiB,GAAG,cAAc,EACxC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,sBAAsB,CAiCxB;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAA6B;IACtE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAwB;IAClE,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAmB;IAE9D;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,eAAe;IASvB;;;;;;;;;OASG;IACG,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAuMnF;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAgHhC;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAM7B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IA+F5B;;;;OAIG;IACG,sBAAsB,CAAC,KAAK,EAAE,oBAAoB,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAUhI,OAAO,CAAC,gBAAgB;IAiBxB,OAAO,CAAC,qBAAqB;IAuB7B,OAAO,CAAC,uBAAuB;IAS/B,OAAO,CAAC,kBAAkB;CAwB3B;AAED,eAAO,MAAM,kBAAkB,oBAA2B,CAAC"}

package/dist/src/credentials/resolver.js

@@ -6,6 +6,7 @@
  * Tier 3: In-Memory Mock Fallback
  */
 import { DopplerClient } from "./doppler.js";
+import { resolveGuestCredential } from "./guest-credential.js";
 import { registerSecret } from "../utils/redactor.js";
 import { logger } from "../utils/logger.js";
 import { CredentialResolutionError } from "./errors.js";
@@ -468,6 +469,22 @@ export class CredentialResolver {
         }
         return null;
     }
+    /**
+     * Per-guest credential, Secret-first: the claim's Secret `claim-<name>-credentials` (by claim name, or by SMBIOS uuid
+     * through the claim list); only when none exists, a read-only Doppler LAB_VM_CREDENTIALS_<UUID> entry marked
+     * `legacy: true`. Dynamic claim credentials are never written to Doppler.
+     */
+    async resolveGuestCredential(query, deps) {
+        const result = await resolveGuestCredential(query, deps);
+        if (result) {
+            registerSecret(result.vmCredentials.password ?? "");
+            if (result.vmCredentials.privateKey)
+                registerSecret(result.vmCredentials.privateKey);
+            if (result.legacy)
+                logger.warn(`Guest credential for ${result.claimName ?? "uuid lookup"} came from the legacy Doppler entry; it is not migrated to a claim Secret.`);
+        }
+        return result;
+    }
     createMockResult() {
         const proxmoxHosts = [
             this.createMockProxmoxHost("proxmox-lab", this.defaultLabProtectedVmids),