@calltelemetry/ct-lab-mcp 0.8.97 → 0.8.99

package/assets/stig/template.pkr.hcl

@@ -0,0 +1,252 @@
+packer {
+  required_version = "= 1.16.0"
+  required_plugins {
+    proxmox = {
+      version = "= 1.2.4"
+      source  = "github.com/hashicorp/proxmox"
+    }
+  }
+}
+
+variable "proxmox_url" { type = string }
+variable "proxmox_username" { type = string }
+variable "proxmox_token" {
+  type      = string
+  sensitive = true
+}
+variable "proxmox_node" {
+  type    = string
+  default = "minis"
+}
+variable "vm_id" { type = number }
+variable "template_name" { type = string }
+variable "disk_storage_pool" {
+  type    = string
+  default = "local-lvm"
+}
+variable "bridge" {
+  type    = string
+  default = "vmbr0"
+}
+variable "vlan_tag" {
+  type    = string
+  default = "" # untagged lab network: VLAN126 has no internet egress/DNS, and the build needs RHSM errata
+}
+variable "disk_size" {
+  type    = string
+  default = "128G"
+}
+variable "vcpus" {
+  type    = number
+  default = 4
+}
+variable "memory_mb" {
+  type    = number
+  default = 8192
+}
+variable "iso_file" {
+  type    = string
+  default = "synology-cisco-isos:iso/rhel-8.10-x86_64-dvd.iso"
+}
+
+variable "ssh_username" {
+  type    = string
+  default = "ctbuild"
+}
+variable "ssh_private_key_file" { type = string }
+variable "ssh_public_key" { type = string }
+variable "build_password" {
+  type      = string
+  sensitive = true
+}
+variable "build_password_hash" {
+  type      = string
+  sensitive = true
+}
+variable "grub_pbkdf2" {
+  type      = string
+  sensitive = true
+}
+
+variable "luks_bootstrap" {
+  type      = string
+  sensitive = true
+}
+variable "rhsm_org" {
+  type      = string
+  sensitive = true
+}
+variable "rhsm_key" {
+  type      = string
+  sensitive = true
+}
+variable "dns_servers" {
+  type    = string
+  default = "192.168.126.1,192.168.68.125"
+}
+variable "ntp_servers" {
+  type    = string
+  default = "0.rhel.pool.ntp.org,1.rhel.pool.ntp.org"
+}
+variable "tailoring_file" { type = string }
+
+variable "ssg_datastream" { type = string }
+variable "ssg_datastream_sha256" {
+  type    = string
+  default = "82592d3cff74a82ce652a65ba67cd755cf57550269798d4c449c2069417c1028"
+}
+variable "evidence_dir" { type = string }
+
+locals {
+  sudo = "echo '${var.build_password}' | sudo -S -p '' env {{ .Vars }} bash '{{ .Path }}'"
+}
+
+source "proxmox-iso" "rhel810_stig" {
+  proxmox_url              = var.proxmox_url
+  username                 = var.proxmox_username
+  token                    = var.proxmox_token
+  insecure_skip_tls_verify = true # lab self-signed PVE certificate
+  node                     = var.proxmox_node
+  vm_id                    = var.vm_id
+  vm_name                  = var.template_name
+  template_name            = var.template_name
+  template_description     = "RHEL 8.10 DISA STIG template. SSG 0.1.82 / RHEL 8 STIG V2R8. Built ${timestamp()}. LUKS2 PV with template bootstrap key; each clone re-encrypts and binds its own TPM2 at first boot."
+  tags                     = "rhel8-stig-template;ssg-0-1-82;stig-v2r8"
+  os                       = "l26"
+  machine                  = "q35"
+  bios                     = "ovmf"
+  cpu_type                 = "host"
+  cores                    = var.vcpus
+  memory                   = var.memory_mb
+  qemu_agent               = true
+  scsi_controller          = "virtio-scsi-single"
+  boot                     = "order=scsi0;ide2;net0"
+  onboot                   = false
+
+  efi_config {
+    efi_storage_pool  = var.disk_storage_pool
+    efi_type          = "4m"
+    pre_enrolled_keys = true
+  }
+
+  boot_iso {
+    type         = "ide"
+    index        = "2"
+    iso_file     = var.iso_file
+    iso_checksum = "sha256:9b3c8e31bc2cdd2de9cf96abb3726347f5840ff3b176270647b3e66639af291b"
+    unmount      = true
+  }
+
+  additional_iso_files {
+    type             = "ide"
+    index            = "3"
+    iso_storage_pool = "local"
+    cd_label         = "OEMDRV"
+    cd_content = {
+      "ks.cfg" = templatefile("${path.root}/ks.cfg.pkrtpl", {
+        hostname            = var.template_name
+        ssh_username        = var.ssh_username
+        ssh_public_key      = trimspace(var.ssh_public_key)
+        build_password_hash = var.build_password_hash
+        grub_pbkdf2         = var.grub_pbkdf2
+        luks_bootstrap      = var.luks_bootstrap
+      })
+    }
+    unmount           = true
+    keep_cdrom_device = false
+  }
+
+  disks {
+    type         = "scsi"
+    storage_pool = var.disk_storage_pool
+    disk_size    = var.disk_size
+    discard      = true
+    io_thread    = true
+  }
+
+  network_adapters {
+    model    = "virtio"
+    bridge   = var.bridge
+    vlan_tag = var.vlan_tag
+  }
+
+  cloud_init              = true
+  cloud_init_storage_pool = var.disk_storage_pool
+
+  boot_wait = "3m15s" # OVMF reaches the DVD GRUB menu ~3m after power-on on minis
+  boot_command = [
+    "<up><wait>e<wait><down><down><end>",
+    " fips=1 inst.text inst.ks=hd:LABEL=OEMDRV:/ks.cfg",
+    "<leftCtrlOn>x<leftCtrlOff>",
+  ]
+
+  communicator         = "ssh"
+  ssh_username         = var.ssh_username
+  ssh_private_key_file = var.ssh_private_key_file
+  ssh_timeout          = "75m"
+}
+
+build {
+  name    = "rhel810-stig-template"
+  sources = ["source.proxmox-iso.rhel810_stig"]
+
+  provisioner "file" {
+    source      = var.ssg_datastream
+    destination = "/home/${var.ssh_username}/ssg-rhel8-ds.xml"
+  }
+  provisioner "file" {
+    source      = var.tailoring_file
+    destination = "/home/${var.ssh_username}/tailoring.xml"
+  }
+  provisioner "file" {
+    source      = "${path.root}/files"
+    destination = "/home/${var.ssh_username}/"
+  }
+
+  # Current errata through RHSM, then reboot into the updated kernel.
+  provisioner "shell" {
+    execute_command = local.sudo
+    environment_vars = [
+      "RHSM_ORG=${var.rhsm_org}",
+      "RHSM_KEY=${var.rhsm_key}",
+    ]
+    scripts           = ["${path.root}/scripts/errata.sh"]
+    expect_disconnect = true
+  }
+
+  # Organization settings + pinned SSG STIG remediation, then reboot.
+  provisioner "shell" {
+    pause_before    = "90s"
+    execute_command = local.sudo
+    environment_vars = [
+      "SSG_DATASTREAM=/home/${var.ssh_username}/ssg-rhel8-ds.xml",
+      "SSG_DATASTREAM_SHA256=${var.ssg_datastream_sha256}",
+      "TAILORING=/home/${var.ssh_username}/tailoring.xml",
+      "FILES_DIR=/home/${var.ssh_username}/files",
+      "BUILD_USER=${var.ssh_username}",
+      "DNS_SERVERS=${var.dns_servers}",
+      "NTP_SERVERS=${var.ntp_servers}",
+    ]
+    scripts           = ["${path.root}/scripts/remediate.sh"]
+    expect_disconnect = true
+  }
+
+  provisioner "shell" {
+    pause_before     = "90s"
+    execute_command  = local.sudo
+    environment_vars = ["BUILD_USER=${var.ssh_username}"]
+    scripts          = ["${path.root}/scripts/assess.sh"]
+  }
+
+  provisioner "file" {
+    direction   = "download"
+    source      = "/home/${var.ssh_username}/stig-report/"
+    destination = "${var.evidence_dir}/"
+  }
+
+  provisioner "shell" {
+    execute_command  = local.sudo
+    environment_vars = ["BUILD_USER=${var.ssh_username}"]
+    scripts          = ["${path.root}/scripts/seal.sh"]
+  }
+}

package/dist/src/credentials/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./types.js";
 export * from "./doppler.js";
 export * from "./resolver.js";
+export * from "./remediation.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/src/credentials/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/credentials/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/credentials/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC"}

package/dist/src/credentials/index.js

@@ -1,4 +1,5 @@
 export * from "./types.js";
 export * from "./doppler.js";
 export * from "./resolver.js";
+export * from "./remediation.js";
 //# sourceMappingURL=index.js.map

package/dist/src/credentials/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/credentials/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/credentials/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC"}

package/dist/src/credentials/remediation.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Actionable credential remediation for credential_status and the
+ * CREDENTIALS_UNAVAILABLE gate.
+ *
+ * The resolver's own `remediation` string is generic (and leads with mock
+ * mode). In a governed local-stdio install the failure is almost always the
+ * same: the harness that spawned this process never injected the lab
+ * variables, and the governed runtime wrapper strips DOPPLER_TOKEN so the
+ * Tier-2 Doppler path is unreachable. This module inspects which variable
+ * groups the process actually received (names only, never values) and says
+ * exactly what to change.
+ */
+import type { CredentialResolutionError } from "./errors.js";
+export interface CredentialGroupStatus {
+    group: "proxmox-lab" | "proxmox-mini" | "appliance-ssh";
+    present: boolean;
+    /** Variable names that satisfy this group (name-only; never values). */
+    needs: string;
+}
+export interface CredentialRemediation {
+    /** One sentence naming the concrete gap; safe to embed in an error. */
+    headline: string;
+    /** Ordered, copy-pasteable steps. Never contains a secret value. */
+    steps: string[];
+    /** Which variable groups the aggregate resolver found in this process. */
+    inspected: CredentialGroupStatus[];
+    dopplerTokenInProcess: boolean;
+}
+type Env = Record<string, string | undefined>;
+export declare function inspectCredentialEnvironment(env?: Env): CredentialGroupStatus[];
+export declare function buildCredentialRemediation(error: Pick<CredentialResolutionError, "reason" | "missing" | "message"> | undefined, env?: Env): CredentialRemediation;
+export {};
+//# sourceMappingURL=remediation.d.ts.map

package/dist/src/credentials/remediation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediation.d.ts","sourceRoot":"","sources":["../../../src/credentials/remediation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,aAAa,GAAG,cAAc,GAAG,eAAe,CAAC;IACxD,OAAO,EAAE,OAAO,CAAC;IACjB,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,0EAA0E;IAC1E,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACnC,qBAAqB,EAAE,OAAO,CAAC;CAChC;AAED,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAe9C,wBAAgB,4BAA4B,CAAC,GAAG,GAAE,GAAiB,GAAG,qBAAqB,EAAE,CAqB5F;AAcD,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,IAAI,CAAC,yBAAyB,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC,GAAG,SAAS,EACpF,GAAG,GAAE,GAAiB,GACrB,qBAAqB,CAqEvB"}

package/dist/src/credentials/remediation.js

@@ -0,0 +1,105 @@
+/**
+ * Actionable credential remediation for credential_status and the
+ * CREDENTIALS_UNAVAILABLE gate.
+ *
+ * The resolver's own `remediation` string is generic (and leads with mock
+ * mode). In a governed local-stdio install the failure is almost always the
+ * same: the harness that spawned this process never injected the lab
+ * variables, and the governed runtime wrapper strips DOPPLER_TOKEN so the
+ * Tier-2 Doppler path is unreachable. This module inspects which variable
+ * groups the process actually received (names only, never values) and says
+ * exactly what to change.
+ */
+const set = (env, key) => typeof env[key] === "string" && env[key].length > 0;
+const anySet = (env, keys) => keys.some((key) => set(env, key));
+function proxmoxGroupPresent(env, prefix) {
+    const endpoint = anySet(env, [`${prefix}URL`, `${prefix}BASE_URL`, `${prefix}HOST`, `${prefix}IP`]);
+    const auth = set(env, `${prefix}API_TOKEN`) ||
+        (anySet(env, [`${prefix}TOKEN_ID`, `${prefix}API_TOKEN_ID`]) &&
+            anySet(env, [`${prefix}TOKEN_SECRET`, `${prefix}API_TOKEN_SECRET`])) ||
+        (anySet(env, [`${prefix}USERNAME`, `${prefix}USER`]) && anySet(env, [`${prefix}PASSWORD`, `${prefix}PASS`]));
+    return endpoint && auth;
+}
+export function inspectCredentialEnvironment(env = process.env) {
+    return [
+        {
+            group: "proxmox-lab",
+            present: proxmoxGroupPresent(env, "LAB_PROXMOX_"),
+            needs: "LAB_PROXMOX_URL (or _HOST) + LAB_PROXMOX_API_TOKEN (or _USERNAME/_PASSWORD)",
+        },
+        {
+            group: "proxmox-mini",
+            present: proxmoxGroupPresent(env, "LAB_PROXMOX_MINIS_") || proxmoxGroupPresent(env, "LAB_PROXMOX_MINI_"),
+            needs: "LAB_PROXMOX_MINIS_URL (or _HOST) + LAB_PROXMOX_MINIS_API_TOKEN (or _USERNAME/_PASSWORD)",
+        },
+        {
+            group: "appliance-ssh",
+            present: anySet(env, ["LAB_VM_CREDENTIALS", "VM_CREDENTIALS"]) ||
+                (anySet(env, ["LAB_VM_CREDENTIALS_USERNAME", "LAB_VM_CREDENTIALS_USER", "LAB_VM_USER", "VM_USER"]) &&
+                    anySet(env, ["LAB_VM_CREDENTIALS_PASSWORD", "LAB_VM_CREDENTIALS_PASS", "LAB_VM_PASS", "VM_PASS"])),
+            needs: "LAB_VM_CREDENTIALS (JSON or user:pass) or LAB_VM_CREDENTIALS_USERNAME + LAB_VM_CREDENTIALS_PASSWORD",
+        },
+    ];
+}
+const CANONICAL_ALTERNATIVE = "Reads that do not need this aggregate bundle: list_hosts and list_inventory (target-scoped credentials via the " +
+    "canonical lab-inventory CLI), the ApplianceClaim tools, and `lab-inventory` itself. Legacy tools such as " +
+    "list_slots stay blocked with CREDENTIALS_UNAVAILABLE until the bundle resolves; do not inject unrelated hosts' " +
+    "credentials just to unblock one VM.";
+const VERIFY_STEP = "Reload the server (manage_mcp_server reload, or restart the harness) and call credential_status again: the " +
+    "tier should read direct_env or doppler_api and the legacy aggregate source resolved. A host listed here as " +
+    "reachable is the only evidence the credentials work; mock mode (CT_LAB_MCP_ALLOW_MOCK=1) is for offline tests " +
+    "and its results are not evidence.";
+export function buildCredentialRemediation(error, env = process.env) {
+    const inspected = inspectCredentialEnvironment(env);
+    const missingGroups = inspected.filter((g) => !g.present);
+    const dopplerTokenInProcess = set(env, "DOPPLER_TOKEN");
+    const reason = error?.reason ?? "no_credentials_found";
+    const steps = [];
+    const injectSteps = () => [
+        "Confirm the source has the values (names only; never print values): " +
+            "`doppler secrets --only-names --project ai-workspace --config dev | grep -E 'LAB_PROXMOX|LAB_VM_CREDENTIALS'`.",
+        "Inject them into this process from the parent, because it only sees the environment its harness gave it " +
+            "(DOPPLER_PROJECT/DOPPLER_CONFIG are not credentials). Either add `env` refs to the ct-lab entry of the " +
+            "harness MCP config, e.g. `\"LAB_PROXMOX_URL\": \"doppler://ai-workspace/dev/LAB_PROXMOX_URL\"` for each " +
+            "variable below, which the governed runtime wrapper (tools/mcp-runtime-exec.mjs) resolves through the " +
+            "Doppler CLI without a login prompt, or start the harness itself under " +
+            "`doppler run --project ai-workspace --config dev --`.",
+        dopplerTokenInProcess
+            ? "DOPPLER_TOKEN is present in this process, so the Tier-2 Doppler API path was attempted; check the " +
+                "`doppler_unreachable` / `partial_credentials` detail above instead of the injection steps."
+            : "A DOPPLER_TOKEN exported in the harness is not enough: the governed runtime wrapper strips it before " +
+                "spawning this server (by design), so the Doppler API tier is unreachable here. Use the env refs above.",
+    ];
+    if (reason === "doppler_unreachable") {
+        steps.push("The Doppler API tier was attempted and failed. Check that DOPPLER_TOKEN is a valid config-scoped token for " +
+            "DOPPLER_PROJECT/DOPPLER_CONFIG (not expired or revoked) and that api.doppler.com is reachable.", "The fetch is bounded by CT_LAB_MCP_RESOLVE_TIMEOUT_MS (default 8000, 250-30000); raise it only for a slow link.", "Or bypass Doppler by injecting the variables directly (see the groups below).");
+    }
+    else if (reason === "partial_credentials") {
+        steps.push(`The aggregate resolver found some but not all required groups; still missing: ${(error?.missing.length ? error.missing : missingGroups.map((g) => g.group)).join(", ") || "unknown"}.`, ...injectSteps().slice(1));
+    }
+    else {
+        steps.push(...injectSteps());
+    }
+    if (missingGroups.length > 0) {
+        steps.push("Variable groups still missing from this process: " +
+            missingGroups.map((g) => `${g.group} (${g.needs})`).join("; ") +
+            ".");
+    }
+    if (missingGroups.some((g) => g.group === "appliance-ssh")) {
+        steps.push("Note: the aggregate resolver reads one shared appliance login (LAB_VM_CREDENTIALS or the _USERNAME/_PASSWORD " +
+            "pair). Per-VM `LAB_VM_CREDENTIALS_<UUID>` secrets are consumed only by the canonical CLI and do not satisfy " +
+            "it; if the secret store has no shared entry the aggregate bundle cannot resolve from it.");
+    }
+    steps.push(CANONICAL_ALTERNATIVE, VERIFY_STEP);
+    const groupSummary = missingGroups.length
+        ? `no ${missingGroups.map((g) => g.group).join(", ")} variables reached this process`
+        : "the expected variables are present but did not resolve";
+    const headline = reason === "doppler_unreachable"
+        ? "The Doppler API tier failed; fix the token/connectivity or inject LAB_* variables directly."
+        : `Aggregate lab credentials unavailable: ${groupSummary}. Inject LAB_PROXMOX_*, LAB_PROXMOX_MINIS_* and ` +
+            "LAB_VM_CREDENTIALS from the parent (doppler:// env refs in the MCP config, or run the harness under " +
+            "`doppler run`); credential_status lists the exact steps. list_hosts/list_inventory and claim tools do " +
+            "not need this bundle.";
+    return { headline, steps, inspected, dopplerTokenInProcess };
+}
+//# sourceMappingURL=remediation.js.map

package/dist/src/credentials/remediation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediation.js","sourceRoot":"","sources":["../../../src/credentials/remediation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAuBH,MAAM,GAAG,GAAG,CAAC,GAAQ,EAAE,GAAW,EAAW,EAAE,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACrG,MAAM,MAAM,GAAG,CAAC,GAAQ,EAAE,IAAc,EAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAExF,SAAS,mBAAmB,CAAC,GAAQ,EAAE,MAAc;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,KAAK,EAAE,GAAG,MAAM,UAAU,EAAE,GAAG,MAAM,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC;IACpG,MAAM,IAAI,GACR,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,WAAW,CAAC;QAC9B,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,UAAU,EAAE,GAAG,MAAM,cAAc,CAAC,CAAC;YAC1D,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,cAAc,EAAE,GAAG,MAAM,kBAAkB,CAAC,CAAC,CAAC;QACtE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/G,OAAO,QAAQ,IAAI,IAAI,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAAW,OAAO,CAAC,GAAG;IACjE,OAAO;QACL;YACE,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,mBAAmB,CAAC,GAAG,EAAE,cAAc,CAAC;YACjD,KAAK,EAAE,6EAA6E;SACrF;QACD;YACE,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,mBAAmB,CAAC,GAAG,EAAE,oBAAoB,CAAC,IAAI,mBAAmB,CAAC,GAAG,EAAE,mBAAmB,CAAC;YACxG,KAAK,EAAE,yFAAyF;SACjG;QACD;YACE,KAAK,EAAE,eAAe;YACtB,OAAO,EACL,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;gBACrD,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,6BAA6B,EAAE,yBAAyB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;oBAChG,MAAM,CAAC,GAAG,EAAE,CAAC,6BAA6B,EAAE,yBAAyB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;YACtG,KAAK,EAAE,qGAAqG;SAC7G;KACF,CAAC;AACJ,CAAC;AAED,MAAM,qBAAqB,GACzB,iHAAiH;IACjH,2GAA2G;IAC3G,iHAAiH;IACjH,qCAAqC,CAAC;AAExC,MAAM,WAAW,GACf,6GAA6G;IAC7G,6GAA6G;IAC7G,gHAAgH;IAChH,mCAAmC,CAAC;AAEtC,MAAM,UAAU,0BAA0B,CACxC,KAAoF,EACpF,MAAW,OAAO,CAAC,GAAG;IAEtB,MAAM,SAAS,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,qBAAqB,GAAG,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,IAAI,sBAAsB,CAAC;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,WAAW,GAAG,GAAa,EAAE,CAAC;QAClC,sEAAsE;YACpE,gHAAgH;QAClH,0GAA0G;YACxG,yGAAyG;YACzG,0GAA0G;YAC1G,uGAAuG;YACvG,wEAAwE;YACxE,uDAAuD;QACzD,qBAAqB;YACnB,CAAC,CAAC,oGAAoG;gBACpG,4FAA4F;YAC9F,CAAC,CAAC,uGAAuG;gBACvG,wGAAwG;KAC7G,CAAC;IAEF,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CACR,6GAA6G;YAC3G,gGAAgG,EAClG,iHAAiH,EACjH,+EAA+E,CAChF,CAAC;IACJ,CAAC;SAAM,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CACR,iFACE,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAC5F,GAAG,EACH,GAAG,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAC1B,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CACR,mDAAmD;YACjD,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9D,GAAG,CACN,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,EAAE,CAAC;QAC3D,KAAK,CAAC,IAAI,CACR,+GAA+G;YAC7G,8GAA8G;YAC9G,0FAA0F,CAC7F,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC;IAE/C,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM;QACvC,CAAC,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC;QACrF,CAAC,CAAC,wDAAwD,CAAC;IAC7D,MAAM,QAAQ,GACZ,MAAM,KAAK,qBAAqB;QAC9B,CAAC,CAAC,6FAA6F;QAC/F,CAAC,CAAC,0CAA0C,YAAY,kDAAkD;YACxG,sGAAsG;YACtG,wGAAwG;YACxG,uBAAuB,CAAC;IAE9B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC;AAC/D,CAAC"}

package/dist/src/generated-version.d.ts

@@ -2,5 +2,5 @@
  * Auto-synced package version fallback for non-filesystem runtimes (Cloudflare Workers).
  * Updated automatically during release publication in .github/workflows/publish.yml.
  */
-export declare const PACKAGE_VERSION = "0.8.97";
+export declare const PACKAGE_VERSION = "0.8.99";
 //# sourceMappingURL=generated-version.d.ts.map

package/dist/src/generated-version.js

@@ -2,5 +2,5 @@
  * Auto-synced package version fallback for non-filesystem runtimes (Cloudflare Workers).
  * Updated automatically during release publication in .github/workflows/publish.yml.
  */
-export const PACKAGE_VERSION = "0.8.97";
+export const PACKAGE_VERSION = "0.8.99";
 //# sourceMappingURL=generated-version.js.map

package/dist/src/stig/live.d.ts

@@ -0,0 +1,116 @@
+import type { BuildMaterial, ClaimPort, ClaimRecord, GuestShell, Materials, PackerPort, PveShell, RunOpts, SecretStore, ShellResult, StigDeps, StigProvider } from "./ports.js";
+/** assets/stig next to dist/src/stig (published) or next to src/stig (dev). */
+export declare function defaultAssetsDir(): string;
+export declare class SshPveShell implements PveShell {
+    private readonly host;
+    private readonly user;
+    constructor(host?: string, user?: string);
+    run(script: string, opts?: RunOpts): Promise<ShellResult>;
+}
+export declare class SshGuestShell implements GuestShell {
+    private user;
+    private keyFile;
+    private known;
+    private ip;
+    configure(cfg: {
+        user: string;
+        keyFile: string;
+        knownHostsFile: string;
+    }): void;
+    setTarget(ip: string): void;
+    private opts;
+    private ssh;
+    runScript(script: string, o?: {
+        sudo?: boolean;
+        stdin?: string;
+        timeoutMs?: number;
+    }): Promise<ShellResult>;
+    waitSsh(hostKey: "accept-new" | "yes", tries: number, intervalMs?: number): Promise<boolean>;
+    fileExists(path: string): Promise<boolean>;
+    fetchDir(remote: string, localDir: string): Promise<void>;
+}
+export declare class DopplerSecrets implements SecretStore {
+    private readonly project;
+    private readonly config;
+    constructor(project?: string, config?: string);
+    get(name: string): Promise<string | undefined>;
+    set(name: string, value: string): Promise<void>;
+}
+export declare class LabClaims implements ClaimPort {
+    private readonly ns;
+    private text;
+    list(): Promise<ClaimRecord[]>;
+    get(name: string): Promise<ClaimRecord | null>;
+    create(a: {
+        name: string;
+        vmid: number;
+        vmName: string;
+        ttlHours: number;
+        stig: Record<string, unknown>;
+    }): Promise<ClaimRecord>;
+    waitReady(name: string): Promise<ClaimRecord>;
+    annotate(name: string, annotations: Record<string, string>): Promise<void>;
+    renew(name: string, extendHours: number): Promise<{
+        ttlHours: number;
+    }>;
+    pause(name: string, paused: boolean, reason?: string): Promise<void>;
+    delete(name: string, expectedUid: string): Promise<void>;
+}
+export declare class PackerCli implements PackerPort {
+    private readonly cwd;
+    private readonly pluginPath;
+    constructor(cwd: string, pluginPath?: string | undefined);
+    version(): Promise<string>;
+    build(a: {
+        vars: Record<string, string>;
+        env: Record<string, string>;
+        logFile: string;
+    }): Promise<number>;
+}
+export declare class NodeMaterials implements Materials {
+    private openssl;
+    randomAlnum(length: number): string;
+    sha512Crypt(plain: string): Promise<string>;
+    sshKeypair(dir: string, label: string): Promise<{
+        privateKeyFile: string;
+        publicKey: string;
+    }>;
+    buildMaterial(runDir: string, label: string): Promise<BuildMaterial>;
+}
+/**
+ * Canonical provider: the `lab-inventory stig` verbs (plan, then apply with the plan digest). Secrets travel in 0600
+ * files inside a private temp directory that is removed afterwards; argv carries only public values.
+ */
+export declare class CliStigProvider implements StigProvider {
+    private readonly cli;
+    private readonly exec;
+    private readonly tmpRoot;
+    constructor(cli: string, exec?: (file: string, args: string[], o?: RunOpts) => Promise<ShellResult>, tmpRoot?: string);
+    private call;
+    clone(a: {
+        operationId: string;
+        name: string;
+        templateName: string;
+        vmid: number;
+        claimedVmids: number[];
+        sshPublicKey: string;
+        passwordHash: string;
+        dns: string[];
+    }): Promise<{
+        vmid: number;
+    }>;
+    destroyTemplate(a: {
+        operationId: string;
+        name: string;
+        vmid: number;
+    }): Promise<void>;
+    guestIp(vmid: number): Promise<string>;
+}
+export declare function defaultRunDir(): string;
+/** The lab-inventory CLI path when the canonical bridge is configured (CT_LAB_CANONICAL_CLI). */
+export declare function canonicalCli(env?: NodeJS.ProcessEnv): string | undefined;
+export declare function liveDeps(opts?: {
+    baseDir?: string;
+    log?: (line: string) => void;
+}): StigDeps;
+//# sourceMappingURL=live.d.ts.map

package/dist/src/stig/live.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live.d.ts","sourceRoot":"","sources":["../../../src/stig/live.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACV,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAC9I,MAAM,YAAY,CAAC;AAWpB,+EAA+E;AAC/E,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAkBD,qBAAa,WAAY,YAAW,QAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAA0D,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAnF,IAAI,SAAwD,EAAmB,IAAI,SAAS;IACzH,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;CAI1D;AAED,qBAAa,aAAc,YAAW,UAAU;IAC9C,OAAO,CAAC,IAAI,CAAa;IAAC,OAAO,CAAC,OAAO,CAAM;IAAC,OAAO,CAAC,KAAK,CAAM;IAAC,OAAO,CAAC,EAAE,CAAM;IACpF,SAAS,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAC/E,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAC3B,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,GAAG;IAGL,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAQ3G,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAO5F,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKhE;AAED,qBAAa,cAAe,YAAW,WAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAkD,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAhF,OAAO,SAAgD,EAAmB,MAAM,SAAsC;IAC7I,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAK9C,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAUtD;AAED,qBAAa,SAAU,YAAW,SAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAC/B,OAAO,CAAC,IAAI;IAIN,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAK9B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAI9C,MAAM,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAKhI,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAK7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAM1E,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAKvE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI/D;AAED,qBAAa,SAAU,YAAW,UAAU;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAU,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAxC,GAAG,EAAE,MAAM,EAAmB,UAAU,qBAA6C;IAC5G,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IAMhC,KAAK,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;CAW1G;AAED,qBAAa,aAAc,YAAW,SAAS;IAC7C,OAAO,CAAC,OAAO;IAIf,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAK7B,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK3C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAO9F,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;CAe3E;AAED;;;GAGG;AACH,qBAAa,eAAgB,YAAW,YAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAU,OAAO,CAAC,QAAQ,CAAC,IAAI;IAA6E,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAvI,GAAG,EAAE,MAAM,EAAmB,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,CAAO,EAAmB,OAAO,SAAW;YAEjK,IAAI;IAWZ,KAAK,CAAC,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAiBjM,eAAe,CAAC,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtF,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAI7C;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,iGAAiG;AACjG,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAGrF;AAED,wBAAgB,QAAQ,CAAC,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO,GAAG,QAAQ,CAYhG"}