@calltelemetry/ct-lab-mcp 0.8.98 → 0.8.100

package/dist/src/stig/receipt.js

@@ -0,0 +1,112 @@
+/**
+ * STIG receipt builder: a faithful port of the known-good `receipt.sh` (ct-meta rhel8-stig-template skill).
+ * Reads run evidence from disk, returns the same JSON object and Markdown the shell recipe writes.
+ * Parity with the shell output is asserted by test/stig/receipt.test.ts and tools/stig-parity.mjs.
+ */
+import { createHash } from "node:crypto";
+import { readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { parseKv, COUNT_KEYS } from "./model.js";
+export const MANUAL_EVIDENCE_NOTES = Object.freeze({
+    encrypt_partitions: "LUKS2 on the LVM PV; see 'encrypt_partitions' sections of manual-evidence (lsblk -f, luksDump header).",
+    security_patches_up_to_date: "dnf updateinfo security count after errata (0 outstanding); see manual-evidence.",
+    selinux_user_login_roles: "semanage login -l: __default__ -> staff_u; sudo elevates to sysadm_r.",
+    configured_firewalld_default_deny: "default zone drop; drop zone lists only ssh (see manual-evidence).",
+    configure_firewalld_ports: "only ssh allowed in drop zone (see manual-evidence).",
+    account_temp_expire_date: "no temporary accounts exist (see manual-evidence).",
+    accounts_user_home_paths_only: "manual: no user PATH points outside local directories; default profile only.",
+    ssh_keys_passphrase_protected: "no private SSH keys in user homes (see manual-evidence).",
+    sssd_has_trust_anchor: "customer supplies the CAC trust anchor; certmap rule present in /etc/sssd/sssd.conf.",
+    auditd_audispd_configure_sufficiently_large_partition: "audit log LV is 8 GiB (see manual-evidence).",
+});
+export const sha256File = (path) => createHash("sha256").update(readFileSync(path)).digest("hex");
+/** Python `datetime.fromtimestamp(mtime, utc).isoformat()`: microsecond precision, +00:00 suffix. */
+export function pythonIsoUtc(mtimeNs) {
+    let micros = mtimeNs / 1000n;
+    const rem = mtimeNs % 1000n;
+    if (rem > 500n || (rem === 500n && micros % 2n === 1n))
+        micros += 1n; // round half even, like float->datetime
+    const ms = Number(micros / 1000n);
+    const us = Number(micros % 1000n);
+    const iso = new Date(ms).toISOString(); // 2026-10-16T16:09:03.387Z
+    const base = iso.slice(0, 19);
+    const frac = String(Number(iso.slice(20, 23))).padStart(3, "0") + String(us).padStart(3, "0");
+    return frac === "000000" ? `${base}+00:00` : `${base}.${frac}+00:00`;
+}
+export function buildReceipt(i) {
+    const ev = join(i.runDir, "evidence", "stig-report");
+    const read = (p) => readFileSync(p, "utf8");
+    const summ = parseKv(read(join(ev, "summary.txt")));
+    const err = parseKv(read(join(ev, "errata.txt")));
+    const csum = parseKv(read(join(i.cloneDir, "evidence", "clone-summary.txt")));
+    const ver = parseKv(read(join(i.cloneDir, "verify.txt")));
+    const nc = [...read(join(i.cloneDir, "evidence", "clone-notchecked.txt")).matchAll(/Title\s+(.*)\nRule\s+xccdf_org\.ssgproject\.content_rule_(\S+)/g)];
+    const proofName = i.proofName ?? "ct-rhel8-stig-proof2";
+    const keyhash = read(join(i.cloneDir, "keyhash.txt")).trim();
+    const proofHash = read(join(i.proofDir, "keyhash.txt")).trim();
+    const scanOf = (kv) => Object.fromEntries(Object.entries(kv).filter(([k]) => k.startsWith("result_")).map(([k, v]) => [k, Number.parseInt(v, 10)]));
+    const built = pythonIsoUtc(statSync(join(ev, "summary.txt"), { bigint: true }).mtimeNs);
+    const ssgRpm = read(join(ev, "summary.txt")).split("\n").filter((l) => l.startsWith("scap-security-guide"))[0].trim();
+    return {
+        template: { name: i.template, vmid: Number.parseInt(i.template.slice(i.template.lastIndexOf("-") + 1), 10), built },
+        os: { release: summ.VERSION_ID.replace(/^"|"$/g, ""), kernel: summ.kernel, errata: err },
+        stig: {
+            name: "DISA RHEL 8 STIG", version: "V2R8", profile: "xccdf_org.ssgproject.content_profile_stig",
+            tailored_profile: "xccdf_com.calltelemetry_profile_stig_ct", ssg_rpm: ssgRpm, ssg_datastream_version: "0.1.82",
+            datastream_sha256: i.datastreamPath ? sha256File(i.datastreamPath) : summ.ds_sha256,
+            tailoring_sha256: sha256File(join(ev, "tailoring.xml")),
+        },
+        template_scan: scanOf(summ),
+        clone_scan: { clone: i.clone, ...scanOf(csum) },
+        notchecked: nc.map((m) => ({ rule: m[2], title: m[1], manual_evidence: MANUAL_EVIDENCE_NOTES[m[2]] ?? "manual review required" })),
+        artifacts_sha256: {
+            template_arf: sha256File(join(ev, "final-arf.xml")),
+            template_report_html: sha256File(join(ev, "final-report.html")),
+            template_rpm_list: sha256File(join(ev, "rpm-qa-final.txt")),
+            clone_arf: sha256File(join(i.cloneDir, "evidence", "clone-arf.xml")),
+            clone_report_html: sha256File(join(i.cloneDir, "evidence", "clone-report.html")),
+        },
+        clone_verification: ver,
+        luks_two_clone_proof: {
+            volume_key_sha256: { [i.clone]: keyhash, [`${proofName} (released after proof)`]: proofHash },
+            keys_differ: keyhash !== proofHash,
+            reboot_unattended_tpm_unlock: "both clones rebooted and returned over SSH with no console input; verified after reboot",
+        },
+    };
+}
+export function renderReceiptMarkdown(rec, summary, cloneSummary, errataApplied, securityOutstanding, manualEvidence) {
+    const md = [
+        `# STIG receipt: ${rec.template.name}`, "",
+        `- RHEL ${rec.os.release}, kernel \`${rec.os.kernel}\`, errata applied ${errataApplied} (security advisories outstanding: ${securityOutstanding})`,
+        `- DISA RHEL 8 STIG V2R8, SSG ${rec.stig.ssg_datastream_version} datastream sha256 \`${rec.stig.datastream_sha256}\``,
+        `- Profile \`${rec.stig.profile}\` tailored by \`${rec.stig.tailored_profile}\`, tailoring sha256 \`${rec.stig.tailoring_sha256}\``,
+        `- Template VMID ${rec.template.vmid}, built ${rec.template.built}`,
+        "", "## Scan counts", "", "| scan | pass | fail | notapplicable | notchecked |", "|---|---|---|---|---|",
+        `| template | ${summary.result_pass} | ${summary.result_fail} | ${summary.result_notapplicable} | ${summary.result_notchecked} |`,
+        `| clone ${rec.clone_scan.clone} | ${cloneSummary.result_pass} | ${cloneSummary.result_fail} | ${cloneSummary.result_notapplicable} | ${cloneSummary.result_notchecked} |`,
+        "", "## Notchecked rules (manual evidence)", "",
+        ...rec.notchecked.map((n) => `- \`${n.rule}\`: ${n.manual_evidence}`),
+        "", "## Artifact sha256", "",
+        ...Object.entries(rec.artifacts_sha256).map(([k, v]) => `- ${k}: \`${v}\``),
+        "", "## Clone verification", "", "```",
+        ...Object.entries(rec.clone_verification).map(([k, v]) => `${k}=${v}`),
+        "```", "", "## LUKS two-clone proof", "",
+        ...Object.entries(rec.luks_two_clone_proof.volume_key_sha256).map(([k, v]) => `- volume key sha256 (${k}): \`${v}\``),
+        `- keys differ: ${rec.luks_two_clone_proof.keys_differ ? "True" : "False"}; both clones rebooted and unlocked unattended via TPM2`, "",
+        "## Manual evidence (clone)", "", "```", manualEvidence.trim(), "```", "",
+    ];
+    return md.join("\n");
+}
+/** Convenience: build both artifacts from evidence on disk. */
+export function buildReceiptFiles(i) {
+    const ev = join(i.runDir, "evidence", "stig-report");
+    const summ = parseKv(readFileSync(join(ev, "summary.txt"), "utf8"));
+    const err = parseKv(readFileSync(join(ev, "errata.txt"), "utf8"));
+    const csum = parseKv(readFileSync(join(i.cloneDir, "evidence", "clone-summary.txt"), "utf8"));
+    const receipt = buildReceipt(i);
+    const manual = readFileSync(join(i.cloneDir, "evidence", "clone-manual-evidence.txt"), "utf8");
+    const markdown = renderReceiptMarkdown(receipt, summ, csum, err.errata_applied, summ.dnf_security_outstanding, manual);
+    return { json: JSON.stringify(receipt, null, 2), markdown, receipt };
+}
+export const SCAN_COUNT_KEYS = COUNT_KEYS;
+//# sourceMappingURL=receipt.js.map

package/dist/src/stig/receipt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt.js","sourceRoot":"","sources":["../../../src/stig/receipt.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAIjD,MAAM,CAAC,MAAM,qBAAqB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACnF,kBAAkB,EAAE,wGAAwG;IAC5H,2BAA2B,EAAE,kFAAkF;IAC/G,wBAAwB,EAAE,uEAAuE;IACjG,iCAAiC,EAAE,oEAAoE;IACvG,yBAAyB,EAAE,sDAAsD;IACjF,wBAAwB,EAAE,oDAAoD;IAC9E,6BAA6B,EAAE,8EAA8E;IAC7G,6BAA6B,EAAE,0DAA0D;IACzF,qBAAqB,EAAE,sFAAsF;IAC7G,qDAAqD,EAAE,8CAA8C;CACtG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAElH,qGAAqG;AACrG,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,IAAI,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;IAC7B,MAAM,GAAG,GAAG,OAAO,GAAG,KAAK,CAAC;IAC5B,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC;QAAE,MAAM,IAAI,EAAE,CAAC,CAAC,wCAAwC;IAC9G,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,2BAA2B;IACnE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9F,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,QAAQ,CAAC;AACvE,CAAC;AAiBD,MAAM,UAAU,YAAY,CAAC,CAAgB;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC,CAAC,QAAQ,CAAC,iEAAiE,CAAC,CAAC,CAAC;IACvJ,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,sBAAsB,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAG,CAAC,EAA0B,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5K,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAEtH,OAAO;QACL,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE;QACnH,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE;QACxF,IAAI,EAAE;YACJ,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,2CAA2C;YAC/F,gBAAgB,EAAE,yCAAyC,EAAE,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,QAAQ;YAC9G,iBAAiB,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS;YACnF,gBAAgB,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;SACxD;QACD,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC;QAC3B,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE;QAC/C,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,wBAAwB,EAAE,CAAC,CAAC;QAClI,gBAAgB,EAAE;YAChB,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;YACnD,oBAAoB,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;YAC/D,iBAAiB,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC;YAC3D,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;YACpE,iBAAiB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,mBAAmB,CAAC,CAAC;SACjF;QACD,kBAAkB,EAAE,GAAG;QACvB,oBAAoB,EAAE;YACpB,iBAAiB,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,SAAS,yBAAyB,CAAC,EAAE,SAAS,EAAE;YAC7F,WAAW,EAAE,OAAO,KAAK,SAAS;YAClC,4BAA4B,EAAE,yFAAyF;SACxH;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAS,EAAE,OAA8G,EAAE,YAAoC,EAAE,aAAiC,EAAE,mBAAuC,EAAE,cAAsB;IACvS,MAAM,EAAE,GAAG;QACT,mBAAmB,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE;QAC1C,UAAU,GAAG,CAAC,EAAE,CAAC,OAAO,cAAc,GAAG,CAAC,EAAE,CAAC,MAAM,sBAAsB,aAAa,sCAAsC,mBAAmB,GAAG;QAClJ,gCAAgC,GAAG,CAAC,IAAI,CAAC,sBAAsB,wBAAwB,GAAG,CAAC,IAAI,CAAC,iBAAiB,IAAI;QACrH,eAAe,GAAG,CAAC,IAAI,CAAC,OAAO,oBAAoB,GAAG,CAAC,IAAI,CAAC,gBAAgB,0BAA0B,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI;QACnI,mBAAmB,GAAG,CAAC,QAAQ,CAAC,IAAI,WAAW,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE;QACnE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,qDAAqD,EAAE,uBAAuB;QACxG,gBAAgB,OAAO,CAAC,WAAW,MAAM,OAAO,CAAC,WAAW,MAAM,OAAO,CAAC,oBAAoB,MAAM,OAAO,CAAC,iBAAiB,IAAI;QACjI,WAAW,GAAG,CAAC,UAAU,CAAC,KAAK,MAAM,YAAY,CAAC,WAAW,MAAM,YAAY,CAAC,WAAW,MAAM,YAAY,CAAC,oBAAoB,MAAM,YAAY,CAAC,iBAAiB,IAAI;QAC1K,EAAE,EAAE,uCAAuC,EAAE,EAAE;QAC/C,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,eAAe,EAAE,CAAC;QAC3E,EAAE,EAAE,oBAAoB,EAAE,EAAE;QAC5B,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAC3E,EAAE,EAAE,uBAAuB,EAAE,EAAE,EAAE,KAAK;QACtC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,KAAK,EAAE,EAAE,EAAE,yBAAyB,EAAE,EAAE;QACxC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrH,kBAAkB,GAAG,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,yDAAyD,EAAE,EAAE;QACtI,4BAA4B,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE;KAC1E,CAAC;IACF,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAAC,CAAgB;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,2BAA2B,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/F,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAW,EAAE,IAAI,EAAE,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;IAC9H,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,UAAU,CAAC"}

package/dist/src/stig/runner.d.ts

@@ -0,0 +1,109 @@
+import { type StigCounts, type StigDescriptor, type StigReceiptSummary, stigStatusPreview } from "./model.js";
+import type { ClaimRecord, StigDeps } from "./ports.js";
+export declare const BUILD_CLAIM_TTL_HOURS = 6;
+export declare const DEFAULT_CLONE_TTL_HOURS = 48;
+export declare const VMID_RANGE: {
+    readonly min: 8100;
+    readonly max: 8899;
+};
+export interface ClonePlan {
+    mode: "plan";
+    cloneName: string;
+    claim: string;
+    vmid: number;
+    template: {
+        ref: string;
+        vmid: number;
+    };
+    ttlHours: number;
+    poolPercent: number;
+    poolMaxPercent: number;
+    poolOk: boolean;
+    blockedBy: string | null;
+    escrowKey: string;
+    steps: readonly string[];
+    planDigest: string;
+}
+export interface BuildPlan {
+    mode: "plan";
+    name: string;
+    claim: string;
+    vmid: number;
+    claimTtlHours: number;
+    steps: readonly string[];
+    preflight: {
+        packer: string;
+        dvd: boolean;
+        datastreamSha256: string;
+    };
+    planDigest: string;
+}
+export declare class StigRunner {
+    private readonly d;
+    private static reencrypting;
+    constructor(d: StigDeps);
+    private log;
+    private listGuests;
+    private pickVmid;
+    private poolPercent;
+    private newestTemplate;
+    private step;
+    private ensureDir;
+    private writeSecretFile;
+    planClone(i: {
+        cloneName: string;
+        templateRef?: string;
+        ttlHours?: number;
+        dns?: string[];
+        ntp?: string[];
+        poolMaxPercent?: number;
+    }): Promise<ClonePlan>;
+    createClone(i: {
+        cloneName: string;
+        apply?: boolean;
+        planDigest?: string;
+        templateRef?: string;
+        ttlHours?: number;
+        dns?: string[];
+        ntp?: string[];
+        poolMaxPercent?: number;
+    }): Promise<any>;
+    private applyClone;
+    private pveOk;
+    private verifyGuest;
+    planBuild(i: {
+        name?: string;
+        ssgDatastream: string;
+        ssgDatastreamSha256: string;
+        now?: string;
+    }): Promise<BuildPlan>;
+    build(i: {
+        name?: string;
+        ssgDatastream: string;
+        ssgDatastreamSha256: string;
+        now?: string;
+        apply?: boolean;
+        planDigest?: string;
+        dns?: string[];
+        ntp?: string[];
+    }): Promise<any>;
+    private annotateSummary;
+    validate(i: {
+        cloneName: string;
+        requireDisa?: boolean;
+    }): Promise<any>;
+    getReceipt(i: {
+        claim: string;
+    }): Promise<{
+        claim: string;
+        descriptor: Record<string, any> | null;
+        summary: StigReceiptSummary | null;
+        statusPreview: ReturnType<typeof stigStatusPreview>;
+    }>;
+    releaseTemplate(i: {
+        claim: string;
+        confirmDestroy: boolean;
+    }): Promise<any>;
+}
+export type { StigCounts, StigDescriptor, ClaimRecord };
+//# sourceMappingURL=runner.d.ts.map

package/dist/src/stig/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/stig/runner.ts"],"names":[],"mappings":"AAWA,OAAO,EAGL,KAAK,UAAU,EAAE,KAAK,cAAc,EAAE,KAAK,kBAAkB,EAEyB,iBAAiB,EAExG,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,WAAW,EAAe,QAAQ,EAAE,MAAM,YAAY,CAAC;AAErE,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,eAAO,MAAM,UAAU;;;CAAoC,CAAC;AAW5D,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxF,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzG,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;CACjE;AACD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3F,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,OAAO,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,UAAU;IAET,OAAO,CAAC,QAAQ,CAAC,CAAC;IAD9B,OAAO,CAAC,MAAM,CAAC,YAAY,CAAS;gBACP,CAAC,EAAE,QAAQ;IAExC,OAAO,CAAC,GAAG;YAIG,UAAU;YAMV,QAAQ;YAQR,WAAW;IAQzB,OAAO,CAAC,cAAc;YAIR,IAAI;IAIlB,OAAO,CAAC,SAAS;IAEjB,OAAO,CAAC,eAAe;IAIjB,SAAS,CAAC,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAsBzJ,WAAW,CAAC,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;YAYnL,UAAU;YA8FV,KAAK;YAML,WAAW;IAkBnB,SAAS,CAAC,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAiBrH,KAAK,CAAC,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;YA2EzK,eAAe;IASvB,QAAQ,CAAC,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAsDvE,UAAU,CAAC,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;QAAC,aAAa,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;KAAE,CAAC;IAW7L,eAAe,CAAC,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;CAcnF;AAcD,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC"}