@calltelemetry/ct-lab-mcp 0.8.97 → 0.8.99

package/dist/src/stig/model.js

@@ -0,0 +1,384 @@
+/**
+ * RHEL 8.10 STIG model: descriptor, receipt summary, guards and state machine (pure, no I/O).
+ *
+ * Mirror of ct-appliance-operator `src/stig.mjs` (docs/design/stig-claims.md). Both are tested against the same
+ * fixtures; keep them in step. The executor (Packer, qm, oscap) lives in ./runner.ts.
+ */
+import { isDeepStrictEqual } from "node:util";
+export const STIG_ANNOTATION = "calltelemetry.com/stig";
+export const STIG_RECEIPT_ANNOTATION = "calltelemetry.com/stig-receipt";
+export const STIG_STEP_ANNOTATION = "calltelemetry.com/stig-step";
+export const STIG_DESCRIPTOR_SCHEMA = "calltelemetry-stig-claim/v1";
+export const STIG_RECEIPT_SCHEMA = "calltelemetry-stig-receipt-summary/v1";
+export const STIG_ANNOTATION_MAX_BYTES = 2048;
+export const STIG_TTL_CAP_HOURS = 8760;
+export const STIG_POOL_LIMIT_PERCENT = 70;
+export const STIG_TEMPLATE_PREFIX = "rhel810-stig-";
+export const STIG_MODES = ["build-template", "clone", "validate"];
+export const STIG_DATASTREAM_SHA256 = "82592d3cff74a82ce652a65ba67cd755cf57550269798d4c449c2069417c1028";
+export const STIG_TAILORING_SHA256 = "43560c40096a28b180685fe1383344a6d454a3a18666f2ead4a1ddd3d72ed7fd";
+export const STIG_PROFILE_ID = "xccdf_com.calltelemetry_profile_stig_ct";
+export const STIG_DVD_ISO = "synology-cisco-isos:iso/rhel-8.10-x86_64-dvd.iso";
+export const STIG_PINS = Object.freeze({ ssg: "0.1.82", stig: "V2R8", packer: "1.16.0", packerProxmoxPlugin: "1.2.4" });
+export const STIG_STEPS = Object.freeze({
+    "build-template": ["claim", "packer", "errata", "remediate", "scan", "seal", "verify-template", "renew", "complete"],
+    clone: ["claim", "pool-guard", "clone", "tpm", "cloud-init", "boot", "reencrypt", "escrow", "verify", "trim", "complete"],
+    validate: ["preflight", "scan", "receipt", "annotate", "complete"],
+});
+/** Steps during which a clone's disk is being fully re-allocated; only one clone may be here at a time. */
+export const STIG_REENCRYPT_STEPS = ["boot", "reencrypt"];
+export const COUNT_KEYS = ["pass", "fail", "notapplicable", "notchecked", "informational", "error"];
+export const DISA_COUNT_KEYS = [...COUNT_KEYS, "unknown"];
+export const DISA_PROFILE_ID = "xccdf_mil.disa.stig_profile_MAC-1_Classified";
+export const DISA_BENCHMARK_FILE = "U_RHEL_8_V2R8_STIG_SCAP_1-3_Benchmark.xml";
+const IPV4 = /^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/;
+const HOST = /^[A-Za-z0-9]([A-Za-z0-9.-]{0,251}[A-Za-z0-9])?$/;
+const SEMVER = /^\d+\.\d+\.\d+$/;
+const SHA256 = /^[a-f0-9]{64}$/;
+const TEMPLATE_REF = /^rhel810-stig-\d{8}-\d{4}$/;
+const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+/* ---------------------------------------------------------------- secrets */
+const SECRET_KEY = /pass(word|phrase)|secret|token|private|api[-_]?key|credential/i;
+const SECRET_VALUE = [
+    /-----BEGIN [A-Z ]*(PRIVATE KEY|CERTIFICATE)/,
+    /\$[156y]\$[./A-Za-z0-9]{1,16}\$[./A-Za-z0-9]{8,}/,
+    /\bgh[pousr]_[A-Za-z0-9]{20,}/,
+    /PVEAPIToken=/i,
+];
+/** Throws when a value carries secret material by value. Names of secrets (e.g. `doppler:KEY`) are fine. */
+export function assertNoSecrets(value, path = "$") {
+    if (typeof value === "string") {
+        if (SECRET_VALUE.some((re) => re.test(value)))
+            throw new Error(`secret material refused at ${path}`);
+        const long = value.length >= 40 && /^[A-Za-z0-9+/=_-]+$/.test(value) && !/^[a-f0-9]{40,128}$/.test(value);
+        if (long)
+            throw new Error(`secret-like value refused at ${path}`);
+        return;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((item, i) => assertNoSecrets(item, `${path}[${i}]`));
+        return;
+    }
+    if (isObject(value)) {
+        for (const [key, item] of Object.entries(value)) {
+            if (SECRET_KEY.test(key) && typeof item === "string" && item.length >= 8)
+                throw new Error(`secret field refused at ${path}.${key}`);
+            assertNoSecrets(item, `${path}.${key}`);
+        }
+    }
+}
+/** Masks anything secret-looking in a log line. Applied to every line the runner emits. */
+export function redact(text) {
+    return String(text)
+        .replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(-----END [A-Z ]*PRIVATE KEY-----|$)/g, "[redacted-key]")
+        .replace(/\$[156y]\$[./A-Za-z0-9]{1,16}\$[./A-Za-z0-9]{8,}/g, "[redacted-hash]")
+        .replace(/PVEAPIToken=\S+/gi, "PVEAPIToken=[redacted]")
+        .replace(/((?:pass(?:word|phrase)|secret|token|api[-_]?key)[A-Za-z_]*\s*[=:]\s*)\S+/gi, "$1[redacted]");
+}
+/* ------------------------------------------------------------- descriptor */
+function exactKeys(obj, allowed, path, errors) {
+    for (const key of Object.keys(obj))
+        if (!allowed.includes(key))
+            errors.push(`${path}.${key} is unknown`);
+}
+export function validateStigDescriptor(d) {
+    const errors = [];
+    if (!isObject(d))
+        return { ok: false, errors: ["descriptor must be an object"], value: null };
+    exactKeys(d, ["schema", "mode", "profile", "template", "tailoring", "site", "pins"], "$", errors);
+    if (d.schema !== STIG_DESCRIPTOR_SCHEMA)
+        errors.push(`schema must be ${STIG_DESCRIPTOR_SCHEMA}`);
+    if (!STIG_MODES.includes(d.mode))
+        errors.push(`mode must be one of ${STIG_MODES.join(", ")}`);
+    if (d.profile !== "rhel8-stig")
+        errors.push("profile must be rhel8-stig");
+    if (d.mode === "build-template") {
+        if (d.template !== undefined)
+            errors.push("build-template must not name a template");
+    }
+    else if (STIG_MODES.includes(d.mode)) {
+        if (!isObject(d.template))
+            errors.push("template is required for clone and validate");
+    }
+    if (isObject(d.template)) {
+        exactKeys(d.template, ["ref", "vmid"], "$.template", errors);
+        if (typeof d.template.ref !== "string" || !TEMPLATE_REF.test(d.template.ref))
+            errors.push("template.ref must look like rhel810-stig-YYYYMMDD-VMID");
+        if (!Number.isInteger(d.template.vmid) || d.template.vmid < 100 || d.template.vmid > 8999)
+            errors.push("template.vmid must be an integer 100-8999");
+    }
+    if (!isObject(d.tailoring))
+        errors.push("tailoring is required");
+    else {
+        exactKeys(d.tailoring, ["ref", "sha256"], "$.tailoring", errors);
+        if (typeof d.tailoring.ref !== "string" || !/^xccdf_[A-Za-z0-9._-]+_profile_[A-Za-z0-9._-]+$/.test(d.tailoring.ref))
+            errors.push("tailoring.ref must be an XCCDF profile id");
+        if (d.tailoring.sha256 !== undefined && !SHA256.test(d.tailoring.sha256))
+            errors.push("tailoring.sha256 must be a sha256 hex digest");
+    }
+    if (!isObject(d.site))
+        errors.push("site is required");
+    else {
+        exactKeys(d.site, ["dns", "ntp", "adminKeyRef"], "$.site", errors);
+        if (!Array.isArray(d.site.dns) || d.site.dns.length < 1 || d.site.dns.length > 4 || !d.site.dns.every((ip) => typeof ip === "string" && IPV4.test(ip)))
+            errors.push("site.dns must be 1-4 IPv4 addresses");
+        if (!Array.isArray(d.site.ntp) || d.site.ntp.length > 4 || !d.site.ntp.every((h) => typeof h === "string" && (IPV4.test(h) || HOST.test(h))))
+            errors.push("site.ntp must be up to 4 hosts or IPv4 addresses");
+        if (typeof d.site.adminKeyRef !== "string" || !/^doppler:[A-Z][A-Z0-9_]{2,127}$/.test(d.site.adminKeyRef))
+            errors.push("site.adminKeyRef must be doppler:<KEY_NAME> (a name, never a value)");
+    }
+    if (!isObject(d.pins))
+        errors.push("pins is required");
+    else {
+        exactKeys(d.pins, ["ssg", "stig", "packer", "packerProxmoxPlugin"], "$.pins", errors);
+        if (typeof d.pins.ssg !== "string" || !SEMVER.test(d.pins.ssg))
+            errors.push("pins.ssg must be a pinned x.y.z version");
+        if (typeof d.pins.stig !== "string" || !/^V\d+R\d+$/.test(d.pins.stig))
+            errors.push("pins.stig must look like V2R8");
+        if (typeof d.pins.packer !== "string" || !SEMVER.test(d.pins.packer))
+            errors.push("pins.packer must be a pinned x.y.z version");
+        if (typeof d.pins.packerProxmoxPlugin !== "string" || !SEMVER.test(d.pins.packerProxmoxPlugin))
+            errors.push("pins.packerProxmoxPlugin must be a pinned x.y.z version");
+    }
+    if (errors.length === 0) {
+        try {
+            assertNoSecrets(d);
+        }
+        catch (error) {
+            errors.push(error.message);
+        }
+    }
+    return { ok: errors.length === 0, errors, value: errors.length === 0 ? d : null };
+}
+export function stigDescriptor(claim) {
+    if (isObject(claim?.spec?.stig))
+        return claim.spec.stig;
+    const raw = claim?.metadata?.annotations?.[STIG_ANNOTATION];
+    if (raw === undefined || raw === null)
+        return null;
+    if (typeof raw !== "string")
+        throw new Error("stig annotation must be a string");
+    if (Buffer.byteLength(raw) > STIG_ANNOTATION_MAX_BYTES)
+        throw new Error(`stig annotation exceeds ${STIG_ANNOTATION_MAX_BYTES} bytes`);
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        throw new Error("stig annotation is not valid JSON");
+    }
+}
+/** The default descriptor for a mode, from the verified pins and site values. */
+export function defaultDescriptor(mode, opts) {
+    const d = {
+        schema: STIG_DESCRIPTOR_SCHEMA, mode, profile: "rhel8-stig",
+        ...(mode === "build-template" ? {} : { template: opts.template }),
+        tailoring: { ref: "xccdf_com.calltelemetry_profile_stig_ct", ...(opts.tailoringSha256 ? { sha256: opts.tailoringSha256 } : {}) },
+        site: { dns: opts.dns ?? ["192.168.126.1", "192.168.68.125"], ntp: opts.ntp ?? [], adminKeyRef: opts.adminKeyRef },
+        pins: { ...STIG_PINS },
+    };
+    const checked = validateStigDescriptor(d);
+    if (!checked.ok)
+        throw new Error(`invalid STIG descriptor: ${checked.errors.join("; ")}`);
+    return d;
+}
+/* ------------------------------------------------------- scan result parsing */
+export function parseKv(text) {
+    const out = {};
+    for (const line of String(text).split("\n")) {
+        if (!line.includes("=") || line.startsWith("#"))
+            continue;
+        const i = line.indexOf("=");
+        out[line.slice(0, i).trim()] = line.slice(i + 1).trim();
+    }
+    return out;
+}
+const emptyCounts = () => ({ pass: 0, fail: 0, notapplicable: 0, notchecked: 0, informational: 0, error: 0 });
+export function countArfResults(xml) {
+    const counts = emptyCounts();
+    const re = /<(?:\w+:)?rule-result\b[^>]*>[\s\S]*?<(?:\w+:)?result>(\w+)<\//g;
+    let m;
+    while ((m = re.exec(String(xml))) !== null)
+        if (m[1] in counts)
+            counts[m[1]] += 1;
+    return counts;
+}
+/** Same counting as the shell recipe: `grep -c "^Result.*<kind>$"` over `oscap xccdf eval` stdout. */
+export function parseOscapStdoutCounts(text) {
+    const counts = emptyCounts();
+    for (const line of String(text).split("\n")) {
+        const m = /^Result.*?(pass|fail|notapplicable|notchecked|informational|error)$/.exec(line);
+        if (m)
+            counts[m[1]] += 1;
+    }
+    return counts;
+}
+export function countsFromKv(kv) {
+    const counts = emptyCounts();
+    for (const k of COUNT_KEYS)
+        counts[k] = Number.parseInt(kv[`result_${k}`] ?? "0", 10) || 0;
+    return counts;
+}
+function failZeroOf(counts) {
+    const c = counts || {};
+    const total = DISA_COUNT_KEYS.reduce((n, k) => n + (Number.isInteger(c[k]) ? c[k] : 0), 0);
+    return total > 0 && c.fail === 0 && (c.error ?? 0) === 0;
+}
+/** fail=0 gate. With a DISA scan present, BOTH scans must be fail=0 (and error=0); an empty scan never passes. */
+export function receiptGate(counts, disa) {
+    const ssg = failZeroOf(counts);
+    if (disa === undefined)
+        return { failZero: ssg };
+    const d = failZeroOf(disa);
+    return { failZero: ssg && d, disaFailZero: d };
+}
+export function disaCountsFromKv(kv, prefix = "result_") {
+    const counts = { ...emptyCounts(), unknown: 0 };
+    for (const k of DISA_COUNT_KEYS)
+        counts[k] = Number.parseInt(kv[`${prefix}${k}`] ?? "0", 10) || 0;
+    return counts;
+}
+export function buildReceiptSummary(receipt, opts = {}) {
+    const mode = opts.mode || "clone";
+    const scan = mode === "build-template" ? receipt.template_scan : receipt.clone_scan;
+    const counts = countsFromKv(Object.fromEntries(Object.entries(scan || {}).map(([k, v]) => [k, String(v)])));
+    const art = receipt.artifacts_sha256 || {};
+    return {
+        schema: STIG_RECEIPT_SCHEMA, mode, template: receipt.template?.name, counts, gate: receiptGate(counts, opts.disa?.counts),
+        ...(opts.disa ? { disa: opts.disa } : {}),
+        versions: {
+            rhel: receipt.os?.release, kernel: receipt.os?.kernel, ssg: receipt.stig?.ssg_datastream_version,
+            stig: receipt.stig?.version, packer: STIG_PINS.packer, packerProxmoxPlugin: STIG_PINS.packerProxmoxPlugin,
+            ...(opts.openscap ? { openscap: opts.openscap } : {}),
+        },
+        sha256: {
+            datastream: receipt.stig?.datastream_sha256, tailoring: receipt.stig?.tailoring_sha256,
+            arf: opts.arfSha256 || (mode === "build-template" ? art.template_arf : art.clone_arf),
+            report: opts.reportSha256 || (mode === "build-template" ? art.template_report_html : art.clone_report_html),
+        },
+        ...(opts.keyDigest ? { keyDigest: opts.keyDigest } : {}),
+        validatedAt: opts.validatedAt || new Date().toISOString(),
+    };
+}
+const SUMMARY_KEYS = ["schema", "mode", "template", "counts", "gate", "disa", "versions", "sha256", "keyDigest", "validatedAt"];
+const VERSION_KEYS = ["rhel", "kernel", "ssg", "stig", "openscap", "packer", "packerProxmoxPlugin"];
+const SHA_KEYS = ["datastream", "tailoring", "arf", "report"];
+export function validateReceiptSummary(s) {
+    if (!isObject(s) || s.schema !== STIG_RECEIPT_SCHEMA)
+        return null;
+    if (Object.keys(s).some((k) => !SUMMARY_KEYS.includes(k)))
+        return null;
+    if (!STIG_MODES.includes(s.mode) || typeof s.template !== "string" || !TEMPLATE_REF.test(s.template))
+        return null;
+    if (!isObject(s.counts) || COUNT_KEYS.some((k) => !Number.isInteger(s.counts[k]) || s.counts[k] < 0) || Object.keys(s.counts).length !== COUNT_KEYS.length)
+        return null;
+    if (!isObject(s.versions) || Object.keys(s.versions).some((k) => !VERSION_KEYS.includes(k) || typeof s.versions[k] !== "string" || s.versions[k].length > 80))
+        return null;
+    if (!isObject(s.sha256) || Object.keys(s.sha256).some((k) => !SHA_KEYS.includes(k) || !SHA256.test(s.sha256[k])))
+        return null;
+    if (s.keyDigest !== undefined && !SHA256.test(s.keyDigest))
+        return null;
+    if (s.disa !== undefined) {
+        const d = s.disa;
+        if (!isObject(d) || Object.keys(d).some((k) => !["profile", "benchmarkSha256", "counts"].includes(k)))
+            return null;
+        if (typeof d.profile !== "string" || !/^xccdf_[A-Za-z0-9._-]+$/.test(d.profile) || !SHA256.test(d.benchmarkSha256))
+            return null;
+        if (!isObject(d.counts) || DISA_COUNT_KEYS.some((k) => !Number.isInteger(d.counts[k]) || d.counts[k] < 0) || Object.keys(d.counts).length !== DISA_COUNT_KEYS.length)
+            return null;
+    }
+    if (typeof s.validatedAt !== "string" || s.validatedAt.length > 40)
+        return null;
+    try {
+        assertNoSecrets(s);
+    }
+    catch {
+        return null;
+    }
+    return { ...s, gate: receiptGate(s.counts, s.disa?.counts) };
+}
+/** Same projection the operator performs (CT_OPERATOR_STIG=1), so a tool can show what status.stig will carry. */
+export function stigStatusPreview(claim, now = new Date().toISOString()) {
+    const raw = claim?.metadata?.annotations?.[STIG_RECEIPT_ANNOTATION];
+    if (typeof raw !== "string" || Buffer.byteLength(raw) > STIG_ANNOTATION_MAX_BYTES)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    const summary = validateReceiptSummary(parsed);
+    if (!summary)
+        return null;
+    return summary.gate.failZero
+        ? { stig: summary }
+        : { stig: summary, conditions: [{ type: "StigGateFailed", status: "True", lastTransitionTime: now, reason: "FailZeroNotMet", message: `fail=${summary.counts.fail} error=${summary.counts.error}${summary.disa ? ` disaFail=${summary.disa.counts.fail} disaError=${summary.disa.counts.error}` : ""}` }] };
+}
+export { isDeepStrictEqual };
+/* ------------------------------------------------------------------ guards */
+export function capTtl(hours) {
+    if (!Number.isInteger(hours))
+        throw new Error("ttlHours must be an integer");
+    if (hours <= 0)
+        throw new Error("ttlHours must be finite (> 0); permanent claims are GitOps fixtures");
+    if (hours > STIG_TTL_CAP_HOURS)
+        throw new Error(`ttlHours ${hours} is above the ${STIG_TTL_CAP_HOURS}h cap`);
+    return hours;
+}
+export function planTemplateRenewal(claim, now = Date.now(), marginHours = 1) {
+    const start = Date.parse(claim?.status?.completionTime || "");
+    const previous = claim?.spec?.ttlHours ?? 24;
+    const elapsedHours = Number.isFinite(start) ? Math.max(0, Math.ceil((now - start) / 3_600_000)) : 0;
+    const extendHours = STIG_TTL_CAP_HOURS - elapsedHours - marginHours;
+    if (extendHours < 1)
+        return { ok: false, error: `claim is ${elapsedHours}h old; no renewal headroom under the ${STIG_TTL_CAP_HOURS}h cap`, elapsedHours };
+    return { ok: true, elapsedHours, extendHours, previousTtlHours: previous, newTtlHours: Math.max(previous, elapsedHours + extendHours) };
+}
+export function assertPoolBelow(percent, limit = STIG_POOL_LIMIT_PERCENT) {
+    if (typeof percent !== "number" || !Number.isFinite(percent))
+        throw new Error("thin pool usage is unreadable; refusing to re-encrypt");
+    if (percent > limit)
+        throw new Error(`thin pool at ${percent}% exceeds the ${limit}% limit; trim or free space before re-encrypting`);
+}
+export function assertSingleReencrypt(claims, selfName) {
+    for (const c of claims || []) {
+        if (c?.metadata?.name === selfName)
+            continue;
+        const step = c?.metadata?.annotations?.[STIG_STEP_ANNOTATION];
+        let d = null;
+        try {
+            d = stigDescriptor(c);
+        }
+        catch { /* unreadable descriptor: not a re-encrypting clone */ }
+        if (d?.mode === "clone" && STIG_REENCRYPT_STEPS.includes(step)) {
+            throw new Error(`clone ${c.metadata.name} is still re-encrypting; only one at a time`);
+        }
+    }
+}
+export function assertTemplateReleaseAllowed(input) {
+    const { guest, claim, destroyConfirmed } = input;
+    if (!(guest?.template === 1 || guest?.template === true))
+        throw new Error(`VM ${guest?.vmid} is not a template; use delete_appliance_claim`);
+    if (typeof guest.name !== "string" || !guest.name.startsWith(STIG_TEMPLATE_PREFIX))
+        throw new Error(`template name must start with ${STIG_TEMPLATE_PREFIX}`);
+    if (claim?.spec?.vmid !== guest.vmid || claim?.spec?.vmName !== guest.name)
+        throw new Error("the claim does not name this template (vmid and vmName)");
+    const d = stigDescriptor(claim);
+    if (d?.mode !== "build-template")
+        throw new Error("the claim is not a build-template STIG claim");
+    if (destroyConfirmed !== true)
+        throw new Error("template destroy must be explicitly confirmed");
+    return { ok: true, sequence: ["destroy-template", "delete-claim"] };
+}
+/* ------------------------------------------------------------ state machine */
+export function nextStigStep(mode, current) {
+    const steps = STIG_STEPS[mode];
+    if (!steps)
+        throw new Error(`unknown mode ${mode}`);
+    const i = steps.indexOf(current);
+    if (i < 0)
+        throw new Error(`unknown step ${current} for mode ${mode}`);
+    return steps[i + 1] ?? null;
+}
+//# sourceMappingURL=model.js.map

package/dist/src/stig/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../src/stig/model.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,MAAM,CAAC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,gCAAgC,CAAC;AACxE,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAClE,MAAM,CAAC,MAAM,sBAAsB,GAAG,6BAA6B,CAAC;AACpE,MAAM,CAAC,MAAM,mBAAmB,GAAG,uCAAuC,CAAC;AAC3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAC9C,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AACvC,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAC1C,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAC;AACpD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,gBAAgB,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAE3E,MAAM,CAAC,MAAM,sBAAsB,GAAG,kEAAkE,CAAC;AACzG,MAAM,CAAC,MAAM,qBAAqB,GAAG,kEAAkE,CAAC;AACxG,MAAM,CAAC,MAAM,eAAe,GAAG,yCAAyC,CAAC;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG,kDAAkD,CAAC;AAC/E,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,CAAC;AAExH,MAAM,CAAC,MAAM,UAAU,GAAkD,MAAM,CAAC,MAAM,CAAC;IACrF,gBAAgB,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,UAAU,CAAC;IACpH,KAAK,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC;IACzH,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC;CACnE,CAAC,CAAC;AACH,2GAA2G;AAC3G,MAAM,CAAC,MAAM,oBAAoB,GAAsB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,OAAO,CAAU,CAAC;AAa7G,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAG,UAAU,EAAE,SAAS,CAAU,CAAC;AAEnE,MAAM,CAAC,MAAM,eAAe,GAAG,8CAA8C,CAAC;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,2CAA2C,CAAC;AAkB/E,MAAM,IAAI,GAAG,uFAAuF,CAAC;AACrG,MAAM,IAAI,GAAG,iDAAiD,CAAC;AAC/D,MAAM,MAAM,GAAG,iBAAiB,CAAC;AACjC,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAChC,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAGlD,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAiB,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEzH,8EAA8E;AAE9E,MAAM,UAAU,GAAG,gEAAgE,CAAC;AACpF,MAAM,YAAY,GAAG;IACnB,6CAA6C;IAC7C,kDAAkD;IAClD,8BAA8B;IAC9B,eAAe;CAChB,CAAC;AAEF,4GAA4G;AAC5G,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,IAAI,GAAG,GAAG;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;QACrG,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1G,IAAI,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACzG,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;YACpI,eAAe,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,MAAM,CAAC,IAAI,CAAC;SAChB,OAAO,CAAC,iFAAiF,EAAE,gBAAgB,CAAC;SAC5G,OAAO,CAAC,mDAAmD,EAAE,iBAAiB,CAAC;SAC/E,OAAO,CAAC,mBAAmB,EAAE,wBAAwB,CAAC;SACtD,OAAO,CAAC,6EAA6E,EAAE,cAAc,CAAC,CAAC;AAC5G,CAAC;AAED,8EAA8E;AAE9E,SAAS,SAAS,CAAC,GAAS,EAAE,OAAiB,EAAE,IAAY,EAAE,MAAgB;IAC7E,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,aAAa,CAAC,CAAC;AAC3G,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,CAAU;IAC/C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,8BAA8B,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9F,SAAS,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAClG,IAAI,CAAC,CAAC,MAAM,KAAK,sBAAsB;QAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,sBAAsB,EAAE,CAAC,CAAC;IACjG,IAAI,CAAE,UAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,uBAAuB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrH,IAAI,CAAC,CAAC,OAAO,KAAK,YAAY;QAAE,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAE1E,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACvF,CAAC;SAAM,IAAK,UAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QACpJ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IACtJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;SAC5D,CAAC;QACJ,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,CAAC,SAAS,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,iDAAiD,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC9K,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IACxI,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;SAClD,CAAC;QACJ,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAW,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACpN,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QACvN,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;IAChM,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;SAClD,CAAC;QACJ,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,qBAAqB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtF,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QACvH,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACrH,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAChI,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,mBAAmB,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IACzK,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAE,CAA+B,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACnH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAU;IACvC,IAAI,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;IACxD,MAAM,GAAG,GAAG,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,eAAe,CAAC,CAAC;IAC5D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACjF,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,yBAAyB;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,yBAAyB,QAAQ,CAAC,CAAC;IACtI,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAAC,CAAC;AACjG,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,iBAAiB,CAAC,IAAc,EAAE,IAAiI;IACjL,MAAM,CAAC,GAAmB;QACxB,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY;QAC3D,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjE,SAAS,EAAE,EAAE,GAAG,EAAE,yCAAyC,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAChI,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;QAClH,IAAI,EAAE,EAAE,GAAG,SAAS,EAAE;KACL,CAAC;IACpB,MAAM,OAAO,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,OAAO,CAAC,CAAC;AACX,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC1D,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,WAAW,GAAG,GAAe,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;AAE1H,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,iEAAiE,CAAC;IAC7E,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM;YAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAqB,CAAC,IAAI,CAAC,CAAC;IACtG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,qEAAqE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3F,IAAI,CAAC;YAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAqB,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAA0B;IACrD,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,MAAuC;IACzD,MAAM,CAAC,GAAG,MAAM,IAAI,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvG,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,WAAW,CAAC,MAAuC,EAAE,IAA0B;IAC7F,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IACjD,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,EAA0B,EAAE,MAAM,GAAG,SAAS;IAC7E,MAAM,MAAM,GAAG,EAAE,GAAG,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,EAAgB,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,eAAe;QAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAClG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAa,EACb,OAAqJ,EAAE;IAEvJ,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IACpF,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5G,MAAM,GAAG,GAAG,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;IAC3C,OAAO;QACL,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACzH,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,QAAQ,EAAE;YACR,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,sBAAsB;YAChG,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,mBAAmB,EAAE,SAAS,CAAC,mBAAmB;YACzG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,MAAM,EAAE;YACN,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,gBAAgB;YACtF,GAAG,EAAE,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;YACrF,MAAM,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC;SAC5G;QACD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC1D,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AAChI,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC;AACpG,MAAM,QAAQ,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;AAE9D,MAAM,UAAU,sBAAsB,CAAC,CAAU;IAC/C,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC;IAClE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,CAAE,UAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACxK,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3K,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9H,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACnH,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC;YAAE,OAAO,IAAI,CAAC;QAChI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;IACpL,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,CAAC;QAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAClD,OAAO,EAAE,GAAI,CAAmC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;AAClG,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,iBAAiB,CAAC,KAAU,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAC1E,MAAM,GAAG,GAAG,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,uBAAuB,CAAC,CAAC;IACpE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,yBAAyB;QAAE,OAAO,IAAI,CAAC;IAC/F,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACxD,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ;QAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACnB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,OAAO,CAAC,MAAM,CAAC,IAAI,UAAU,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,cAAc,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AAChT,CAAC;AACD,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B,+EAA+E;AAE/E,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC7E,IAAI,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACvG,IAAI,KAAK,GAAG,kBAAkB;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,iBAAiB,kBAAkB,OAAO,CAAC,CAAC;IAC7G,OAAO,KAAK,CAAC;AACf,CAAC;AAMD,MAAM,UAAU,mBAAmB,CAAC,KAAU,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,WAAW,GAAG,CAAC;IAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,KAAK,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC7C,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpG,MAAM,WAAW,GAAG,kBAAkB,GAAG,YAAY,GAAG,WAAW,CAAC;IACpE,IAAI,WAAW,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,YAAY,wCAAwC,kBAAkB,OAAO,EAAE,YAAY,EAAE,CAAC;IAC1J,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC;AAC1I,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAgB,EAAE,KAAK,GAAG,uBAAuB;IAC/E,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACvI,IAAI,OAAO,GAAG,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,iBAAiB,KAAK,kDAAkD,CAAC,CAAC;AACxI,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAa,EAAE,QAAgB;IACnE,KAAK,MAAM,CAAC,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,KAAK,QAAQ;YAAE,SAAS;QAC7C,MAAM,IAAI,GAAG,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,oBAAoB,CAAC,CAAC;QAC9D,IAAI,CAAC,GAAgB,IAAI,CAAC;QAC1B,IAAI,CAAC;YAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,sDAAsD,CAAC,CAAC;QAC/F,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO,IAAI,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,6CAA6C,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAoH;IAC/J,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;IACjD,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,KAAK,CAAC,IAAI,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,gDAAgD,CAAC,CAAC;IAC7I,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,oBAAoB,EAAE,CAAC,CAAC;IAC7J,IAAI,KAAK,EAAE,IAAI,EAAE,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACvJ,MAAM,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,IAAI,KAAK,gBAAgB;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClG,IAAI,gBAAgB,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAChG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,kBAAkB,EAAE,cAAc,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,gFAAgF;AAEhF,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAe;IACxD,MAAM,KAAK,GAAI,UAAgD,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,aAAa,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;AAC9B,CAAC"}

package/dist/src/stig/ports.d.ts

@@ -0,0 +1,149 @@
+/**
+ * Ports the STIG runner depends on. Every side effect (Proxmox shell, guest SSH, Doppler, Packer, claims, key
+ * material, time) crosses one of these, so the runner is unit-testable with fakes and the live adapters in
+ * ./live.ts are the only code that touches the lab.
+ */
+export interface ShellResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+export interface RunOpts {
+    stdin?: string;
+    timeoutMs?: number;
+}
+/** root shell on the Proxmox host (interim path: the canonical bridge has no clone-with-fresh-TPM verb yet). */
+export interface PveShell {
+    run(script: string, opts?: RunOpts): Promise<ShellResult>;
+}
+/** SSH to one clone as the cloud-init admin. Scripts run as files so stdin stays free for the sudo password. */
+export interface GuestShell {
+    configure(cfg: {
+        user: string;
+        keyFile: string;
+        knownHostsFile: string;
+    }): void;
+    setTarget(ip: string): void;
+    /** Runs `script` (file contents) with bash. When `sudo` is set, `stdin` is `<sudo password>\n<extra stdin>`. */
+    runScript(script: string, opts?: {
+        sudo?: boolean;
+        stdin?: string;
+        timeoutMs?: number;
+    }): Promise<ShellResult>;
+    /** true once `ssh true` succeeds; hostKey "accept-new" pins on first contact, "yes" requires the pinned key. */
+    waitSsh(hostKey: "accept-new" | "yes", tries: number, intervalMs?: number): Promise<boolean>;
+    fileExists(path: string): Promise<boolean>;
+    /** Copies a remote directory's contents into a local directory. */
+    fetchDir(remote: string, localDir: string): Promise<void>;
+}
+/** Doppler by NAME. Values never appear in logs or return values of the runner. */
+export interface SecretStore {
+    get(name: string): Promise<string | undefined>;
+    set(name: string, value: string): Promise<void>;
+}
+export interface ClaimRecord {
+    metadata: {
+        name: string;
+        uid: string;
+        annotations?: Record<string, string>;
+    };
+    spec: Record<string, any>;
+    status?: Record<string, any>;
+}
+export interface ClaimPort {
+    list(): Promise<ClaimRecord[]>;
+    get(name: string): Promise<ClaimRecord | null>;
+    /** Guarded create (custody annotation included). Must be profile=bare with a finite TTL. */
+    create(a: {
+        name: string;
+        vmid: number;
+        vmName: string;
+        ttlHours: number;
+        stig: Record<string, unknown>;
+    }): Promise<ClaimRecord>;
+    /** Blocks until an operator reconciled the claim to Ready, or throws. */
+    waitReady(name: string): Promise<ClaimRecord>;
+    annotate(name: string, annotations: Record<string, string>): Promise<void>;
+    renew(name: string, extendHours: number): Promise<{
+        ttlHours: number;
+    }>;
+    pause(name: string, paused: boolean, reason?: string): Promise<void>;
+    delete(name: string, expectedUid: string): Promise<void>;
+}
+export interface PackerPort {
+    version(): Promise<string>;
+    build(a: {
+        vars: Record<string, string>;
+        env: Record<string, string>;
+        logFile: string;
+    }): Promise<number>;
+}
+export interface BuildMaterial {
+    sshPrivateKeyFile: string;
+    sshPublicKey: string;
+    buildPassword: string;
+    buildPasswordHash: string;
+    grubPbkdf2: string;
+    luksBootstrap: string;
+}
+/** Key material generation (ssh-keygen ECDSA P-256, OpenSSL 3 sha512-crypt, PBKDF2). */
+export interface Materials {
+    buildMaterial(runDir: string, label: string): Promise<BuildMaterial>;
+    /** ECDSA P-256 key pair into `dir`; returns the public key line. FIPS rejects ed25519. */
+    sshKeypair(dir: string, label: string): Promise<{
+        privateKeyFile: string;
+        publicKey: string;
+    }>;
+    randomAlnum(length: number): string;
+    sha512Crypt(plain: string): Promise<string>;
+}
+export interface Clock {
+    now(): number;
+    sleep(ms: number): Promise<void>;
+}
+export interface Logger {
+    info(line: string): void;
+}
+/**
+ * Canonical Proxmox mutations (the lab-inventory `stig` verbs). When present, the runner uses it instead of raw `qm`
+ * over SSH for clone (full clone, fresh TPM, cloud-init, VLAN126, start), template destroy and the guest-agent IP.
+ */
+export interface StigProvider {
+    clone(a: {
+        operationId: string;
+        name: string;
+        templateName: string;
+        vmid: number;
+        claimedVmids: number[];
+        sshPublicKey: string;
+        passwordHash: string;
+        dns: string[];
+    }): Promise<{
+        vmid: number;
+    }>;
+    destroyTemplate(a: {
+        operationId: string;
+        name: string;
+        vmid: number;
+    }): Promise<void>;
+    guestIp(vmid: number): Promise<string>;
+}
+export interface StigDeps {
+    /** Canonical provider for guest mutations; absent means the root-SSH `qm` fallback. */
+    provider?: StigProvider;
+    pve: PveShell;
+    guest: GuestShell;
+    secrets: SecretStore;
+    claims: ClaimPort;
+    packer: PackerPort;
+    materials: Materials;
+    clock: Clock;
+    log: Logger;
+    /** Directory for run evidence (mode 0700, never committed). */
+    baseDir: string;
+    /** Directory holding the shipped recipe (assets/stig). */
+    assetsDir: string;
+    /** Reads a file of the shipped recipe. */
+    readAsset(relative: string): string;
+}
+//# sourceMappingURL=ports.d.ts.map

package/dist/src/stig/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../../../src/stig/ports.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,WAAW;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAC7E,MAAM,WAAW,OAAO;IAAG,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AAE/D,gHAAgH;AAChH,MAAM,WAAW,QAAQ;IAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;CAAE;AAEvF,gHAAgH;AAChH,MAAM,WAAW,UAAU;IACzB,SAAS,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAChF,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gHAAgH;IAChH,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/G,gHAAgH;IAChH,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7F,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,WAAW;IAAG,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE;AAEvK,MAAM,WAAW,SAAS;IACxB,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC/C,4FAA4F;IAC5F,MAAM,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjI,yEAAyE;IACzE,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,KAAK,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3G;AAED,MAAM,WAAW,aAAa;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wFAAwF;AACxF,MAAM,WAAW,SAAS;IACxB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACrE,0FAA0F;IAC1F,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/F,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,KAAK;IAAG,GAAG,IAAI,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE;AAE1E,MAAM,WAAW,MAAM;IAAG,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AAEpD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClM,eAAe,CAAC,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,QAAQ;IACvB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,GAAG,EAAE,QAAQ,CAAC;IACd,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC;IACrB,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,EAAE,KAAK,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;CACrC"}

package/dist/src/stig/ports.js

@@ -0,0 +1,7 @@
+/**
+ * Ports the STIG runner depends on. Every side effect (Proxmox shell, guest SSH, Doppler, Packer, claims, key
+ * material, time) crosses one of these, so the runner is unit-testable with fakes and the live adapters in
+ * ./live.ts are the only code that touches the lab.
+ */
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/src/stig/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/stig/ports.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/src/stig/receipt.d.ts

@@ -0,0 +1,35 @@
+type Json = Record<string, any>;
+export declare const MANUAL_EVIDENCE_NOTES: Readonly<Record<string, string>>;
+export declare const sha256File: (path: string) => string;
+/** Python `datetime.fromtimestamp(mtime, utc).isoformat()`: microsecond precision, +00:00 suffix. */
+export declare function pythonIsoUtc(mtimeNs: bigint): string;
+export interface ReceiptInputs {
+    /** Template run name, e.g. rhel810-stig-20261016-8102. */
+    template: string;
+    clone: string;
+    /** runs/<template> directory (contains evidence/stig-report). */
+    runDir: string;
+    /** runs/clone-<clone> directory (contains evidence/ and verify.txt, keyhash.txt). */
+    cloneDir: string;
+    /** runs/clone-<proof> directory used for the two-clone proof. */
+    proofDir: string;
+    proofName?: string;
+    /** Pinned SSG datastream; when absent the digest recorded in summary.txt is used. */
+    datastreamPath?: string;
+}
+export declare function buildReceipt(i: ReceiptInputs): Json;
+export declare function renderReceiptMarkdown(rec: Json, summary: {
+    result_pass: string;
+    result_fail: string;
+    result_notapplicable: string;
+    result_notchecked: string;
+}, cloneSummary: Record<string, string>, errataApplied: string | undefined, securityOutstanding: string | undefined, manualEvidence: string): string;
+/** Convenience: build both artifacts from evidence on disk. */
+export declare function buildReceiptFiles(i: ReceiptInputs): {
+    json: string;
+    markdown: string;
+    receipt: Json;
+};
+export declare const SCAN_COUNT_KEYS: readonly ["pass", "fail", "notapplicable", "notchecked", "informational", "error"];
+export {};
+//# sourceMappingURL=receipt.d.ts.map

package/dist/src/stig/receipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt.d.ts","sourceRoot":"","sources":["../../../src/stig/receipt.ts"],"names":[],"mappings":"AAUA,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAEhC,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWjE,CAAC;AAEH,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,KAAG,MAAuE,CAAC;AAElH,qGAAqG;AACrG,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUpD;AAED,MAAM,WAAW,aAAa;IAC5B,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,aAAa,GAAG,IAAI,CAyCnD;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,EAAE,MAAM,GAAG,SAAS,EAAE,mBAAmB,EAAE,MAAM,GAAG,SAAS,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAsBjT;AAED,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,CASrG;AAED,eAAO,MAAM,eAAe,oFAAa,CAAC"}