@soyrageagency/proxmox-mcp 1.0.0

package/dist/resilience/report.js

@@ -0,0 +1,264 @@
+/**
+ * Resilience evidence reports — control mapping, rendering & persistence.
+ *
+ * Turns a finished run into audit-grade artefacts: a signed JSON record
+ * (machine-readable), a Markdown report (diff-able, lives in git) and a
+ * branded HTML report that prints straight to PDF for an auditor. Each report
+ * maps its result onto concrete ISO 27001 / NIS2 / DORA controls.
+ *
+ * Part of Proxmox MCP Server.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { BRAND } from "../branding.js";
+/** The compliance controls each capability produces evidence for. */
+export const CONTROLS = {
+    "backup-verify": [
+        { framework: "ISO 27001", clause: "A.8.13", title: "Information backup" },
+        { framework: "ISO 27001", clause: "A.5.29", title: "ICT readiness for business continuity" },
+        { framework: "NIS2", clause: "Art. 21(2)(c)", title: "Backup management & crisis management" },
+        { framework: "DORA", clause: "Art. 12", title: "Backup, restoration & recovery" },
+    ],
+    "patch-orchestrate": [
+        { framework: "ISO 27001", clause: "A.8.8", title: "Management of technical vulnerabilities" },
+        { framework: "ISO 27001", clause: "A.8.32", title: "Change management" },
+        { framework: "NIS2", clause: "Art. 21(2)(e)", title: "Security in acquisition, development & maintenance" },
+        { framework: "DORA", clause: "Art. 9", title: "Protection & prevention" },
+    ],
+    "dr-drill": [
+        { framework: "ISO 27001", clause: "A.5.30", title: "ICT readiness for business continuity" },
+        { framework: "NIS2", clause: "Art. 21(2)(c)", title: "Business continuity & disaster recovery" },
+        { framework: "DORA", clause: "Art. 11", title: "Response & recovery" },
+        { framework: "DORA", clause: "Art. 24-25", title: "Digital operational resilience testing" },
+    ],
+};
+const MARK = { pass: "PASS", fail: "FAIL", warn: "WARN", skip: "SKIP" };
+const GLYPH = { pass: "✓", fail: "✗", warn: "!", skip: "·" };
+const HTML_COLOR = { pass: "#2f9e57", fail: "#d64545", warn: "#c9922e", skip: "#8a95a8" };
+/** Format seconds as "4m 12s" / "1h 03m" / "45s". */
+export function dur(sec) {
+    if (!Number.isFinite(sec) || sec < 0)
+        return "—";
+    const h = Math.floor(sec / 3600);
+    const m = Math.floor((sec % 3600) / 60);
+    const s = Math.round(sec % 60);
+    if (h > 0)
+        return `${h}h ${String(m).padStart(2, "0")}m`;
+    if (m > 0)
+        return `${m}m ${String(s).padStart(2, "0")}s`;
+    return `${s}s`;
+}
+/** A one-line verdict banner for the console/MCP text result. */
+export function verdict(r) {
+    const badge = MARK[r.outcome];
+    return `[${badge}] ${r.title} — ${r.summary}`;
+}
+/** Reduce a report to a compact dashboard summary. */
+export function summarize(r) {
+    let metric = "";
+    if (r.capability === "backup-verify") {
+        const checks = r.items.reduce((a, it) => a + it.checks.length, 0);
+        const passed = r.items.reduce((a, it) => a + it.checks.filter((c) => c.outcome === "pass").length, 0);
+        metric = `${passed}/${checks} checks · RTO ${dur(Math.max(0, ...r.items.map((i) => i.restoreSec)))}`;
+    }
+    else if (r.capability === "patch-orchestrate") {
+        metric = `${r.patched} patched · ${r.rolledBack} rolled back`;
+    }
+    else {
+        metric = `RTO ${dur(r.rtoSec)} · RPO ${dur(r.rpoSec)}`;
+    }
+    return {
+        capability: r.capability,
+        title: r.title,
+        outcome: r.outcome,
+        finishedAt: r.finishedAt,
+        metric,
+        signedBy: r.signature ? r.signature.keyFingerprint.slice(0, 12) : "",
+        id: r.id,
+    };
+}
+function checkLine(c) {
+    const ms = c.ms !== undefined ? ` (${c.ms} ms)` : "";
+    return `- ${GLYPH[c.outcome]} **${c.label}** — ${c.detail}${ms}`;
+}
+function controlsTable(controls) {
+    const rows = controls.map((c) => `| ${c.framework} | ${c.clause} | ${c.title} |`).join("\n");
+    return `| Framework | Control | Title |\n| --- | --- | --- |\n${rows}`;
+}
+function signatureBlock(r) {
+    if (!r.signature)
+        return "_Unsigned._";
+    const s = r.signature;
+    return [
+        `- **Algorithm:** ${s.algorithm}`,
+        `- **Signed at:** ${s.signedAt}`,
+        `- **Payload SHA-256:** \`${s.digest}\``,
+        `- **Signature (base64):** \`${s.signature}\``,
+        `- **Key fingerprint:** \`${s.keyFingerprint}\``,
+        "",
+        "Verify offline with the bundled public key:",
+        "",
+        "```",
+        s.publicKeyPem,
+        "```",
+    ].join("\n");
+}
+/** Render a report as a Markdown evidence document. */
+export function renderMarkdown(r) {
+    const head = [
+        `# ${r.title}`,
+        "",
+        `**Verdict:** ${MARK[r.outcome]}  ·  **Report ID:** \`${r.id}\`${r.demo ? "  ·  _demo data_" : ""}`,
+        "",
+        `- **Started:** ${r.startedAt}`,
+        `- **Finished:** ${r.finishedAt}`,
+        `- **Duration:** ${dur(r.durationSec)}`,
+        `- **Summary:** ${r.summary}`,
+        "",
+    ];
+    const body = [];
+    if (r.capability === "backup-verify") {
+        const rep = r;
+        body.push(`## Verified backups`, "", `Ephemeral guests were fenced onto the isolated bridge \`${rep.isolatedBridge}\` and destroyed after testing.`, "");
+        for (const it of rep.items) {
+            body.push(`### ${GLYPH[it.outcome]} ${it.name} (VMID ${it.vmid})`, "", `- Archive: \`${it.archive}\` (age ${dur(it.archiveAgeSec)})`, `- Restored to ephemeral VMID ${it.ephemeralVmid} in **${dur(it.restoreSec)}** (measured RTO)`, `- Cleanup: ${it.cleanedUp ? "ephemeral guest destroyed ✓" : "**left behind — investigate**"}`, "", ...it.checks.map(checkLine), "");
+        }
+    }
+    else if (r.capability === "patch-orchestrate") {
+        const rep = r;
+        body.push(`## Patch run`, "", `Maintenance window: ${rep.window || "anytime"}. Guests are patched in dependency order; any guest failing its post-patch health check is rolled back to its pre-patch snapshot automatically.`, "", `| Batch | Guest | Snapshot | Updates | Health | Result |`, `| --- | --- | --- | --- | --- | --- |`, ...rep.steps.map((s) => `| ${s.batch} | ${s.name} (${s.vmid}) | \`${s.snapshot}\` | ${s.updates} | ${GLYPH[s.health.outcome]} ${s.health.detail} | ${s.rolledBack ? "ROLLED BACK" : MARK[s.outcome]} |`), "", `**${rep.patched} patched, ${rep.rolledBack} automatically rolled back.**`, "");
+    }
+    else {
+        const rep = r;
+        body.push(`## Disaster-recovery drill`, "", `- Runbook: **${rep.runbook}**`, `- Environment: **${rep.environment}** (never production)`, `- Measured RTO: **${dur(rep.rtoSec)}** · RPO: **${dur(rep.rpoSec)}**`, "", `| # | Action | Target | Result | Detail |`, `| --- | --- | --- | --- | --- |`, ...rep.steps.map((s) => `| ${s.index} | ${s.action} | ${s.target} | ${GLYPH[s.outcome]} ${MARK[s.outcome]} | ${s.detail} |`), "");
+    }
+    const tail = [
+        `## Compliance mapping`,
+        "",
+        "This evidence supports the following controls:",
+        "",
+        controlsTable(r.controls),
+        "",
+        `## Signature`,
+        "",
+        signatureBlock(r),
+        "",
+        "---",
+        "",
+        `Generated by **${BRAND.product}** — ${BRAND.author} · ${BRAND.url}`,
+        `Support the project: ${BRAND.donate}`,
+        "",
+    ];
+    return [...head, ...body, ...tail].join("\n");
+}
+const esc = (s) => s.replace(/[&<>]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;" }[c]));
+/** Render a branded, printable HTML evidence report. */
+export function renderHtml(r) {
+    const accent = "#3b9ef0";
+    const pill = (o) => `<span class="pill" style="background:${HTML_COLOR[o]}">${MARK[o]}</span>`;
+    const detail = [];
+    if (r.capability === "backup-verify") {
+        const rep = r;
+        detail.push(`<p class="muted">Ephemeral guests fenced onto isolated bridge <code>${esc(rep.isolatedBridge)}</code> and destroyed after testing.</p>`);
+        for (const it of rep.items) {
+            detail.push(`<div class="card"><h3>${pill(it.outcome)} ${esc(it.name)} <span class="muted">VMID ${it.vmid}</span></h3>`, `<p class="muted">Archive <code>${esc(it.archive)}</code> · age ${dur(it.archiveAgeSec)} · restored to VMID ${it.ephemeralVmid} in <strong>${dur(it.restoreSec)}</strong> (RTO) · ${it.cleanedUp ? "cleaned up" : "<strong>not cleaned up</strong>"}</p>`, `<table class="checks">${it.checks
+                .map((c) => `<tr><td class="g" style="color:${HTML_COLOR[c.outcome]}">${GLYPH[c.outcome]}</td><td>${esc(c.label)}</td><td class="muted">${esc(c.detail)}</td><td class="muted">${c.ms !== undefined ? c.ms + " ms" : ""}</td></tr>`)
+                .join("")}</table></div>`);
+        }
+    }
+    else if (r.capability === "patch-orchestrate") {
+        const rep = r;
+        detail.push(`<p class="muted">Maintenance window: ${esc(rep.window || "anytime")}. Patched in dependency order; failed health checks trigger an automatic rollback.</p>`, `<table class="grid"><tr><th>Batch</th><th>Guest</th><th>Snapshot</th><th>Updates</th><th>Health</th><th>Result</th></tr>`, ...rep.steps.map((s) => `<tr><td>${s.batch}</td><td>${esc(s.name)} <span class="muted">${s.vmid}</span></td><td><code>${esc(s.snapshot)}</code></td><td>${s.updates}</td><td style="color:${HTML_COLOR[s.health.outcome]}">${GLYPH[s.health.outcome]} ${esc(s.health.detail)}</td><td>${s.rolledBack ? '<span class="pill" style="background:' + HTML_COLOR.warn + '">ROLLED BACK</span>' : pill(s.outcome)}</td></tr>`), `</table><p><strong>${rep.patched} patched, ${rep.rolledBack} automatically rolled back.</strong></p>`);
+    }
+    else {
+        const rep = r;
+        detail.push(`<p class="muted">Runbook <strong>${esc(rep.runbook)}</strong> · environment <strong>${esc(rep.environment)}</strong> · RTO <strong>${dur(rep.rtoSec)}</strong> · RPO <strong>${dur(rep.rpoSec)}</strong></p>`, `<table class="grid"><tr><th>#</th><th>Action</th><th>Target</th><th>Result</th><th>Detail</th></tr>`, ...rep.steps.map((s) => `<tr><td>${s.index}</td><td>${esc(s.action)}</td><td>${esc(s.target)}</td><td style="color:${HTML_COLOR[s.outcome]}">${GLYPH[s.outcome]} ${MARK[s.outcome]}</td><td class="muted">${esc(s.detail)}</td></tr>`), `</table>`);
+    }
+    const controls = r.controls
+        .map((c) => `<tr><td><strong>${esc(c.framework)}</strong></td><td>${esc(c.clause)}</td><td>${esc(c.title)}</td></tr>`)
+        .join("");
+    const sig = r.signature;
+    const sigHtml = sig
+        ? `<table class="kv">
+         <tr><td>Algorithm</td><td>${esc(sig.algorithm)}</td></tr>
+         <tr><td>Signed at</td><td>${esc(sig.signedAt)}</td></tr>
+         <tr><td>Payload SHA-256</td><td><code>${esc(sig.digest)}</code></td></tr>
+         <tr><td>Signature</td><td><code class="wrap">${esc(sig.signature)}</code></td></tr>
+         <tr><td>Key fingerprint</td><td><code>${esc(sig.keyFingerprint)}</code></td></tr>
+       </table>
+       <details><summary>Public key (verify offline)</summary><pre>${esc(sig.publicKeyPem)}</pre></details>`
+        : "<p class='muted'>Unsigned.</p>";
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8">
+<title>${esc(r.title)}</title>
+<style>
+  :root{--accent:${accent};--ink:#111;--mute:#8b8b86;--line:#e7e3da;--bg:#f3f1ea;--grid:rgba(17,17,17,.035)}
+  *{box-sizing:border-box}
+  body{font:14px/1.55 Inter,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;color:var(--ink);margin:0;
+    background-color:var(--bg);background-image:linear-gradient(var(--grid) 1px,transparent 1px),linear-gradient(90deg,var(--grid) 1px,transparent 1px);background-size:46px 46px}
+  .page{max-width:900px;margin:28px auto;background:#fff;border:1px solid var(--line);border-radius:18px;overflow:hidden}
+  header{padding:30px 40px 24px;border-bottom:1px solid var(--line)}
+  header .brand{font-weight:800;letter-spacing:.12em;color:var(--accent);font-size:11.5px}
+  header h1{margin:.45em 0 .35em;font-size:26px;font-weight:800;letter-spacing:-.03em}
+  .pill{display:inline-block;color:#fff;border-radius:999px;padding:3px 12px;font-size:12px;font-weight:700;letter-spacing:.03em}
+  main{padding:26px 40px 40px}
+  h2{font-size:13px;text-transform:uppercase;letter-spacing:.07em;color:var(--mute);border-bottom:1px solid var(--line);padding-bottom:7px;margin-top:30px;font-weight:700}
+  h3{font-size:15px;margin:.4em 0}
+  .muted{color:var(--mute)}
+  code{background:#f2f0ea;border-radius:5px;padding:1px 5px;font-size:12px}
+  code.wrap{word-break:break-all}
+  .meta{display:grid;grid-template-columns:repeat(4,1fr);gap:12px;margin-top:18px}
+  .meta div{background:#faf9f5;border:1px solid var(--line);border-radius:12px;padding:12px 14px;color:var(--ink)}
+  .meta span{display:block;font-size:10px;text-transform:uppercase;letter-spacing:.08em;color:#a7a299;font-weight:700}
+  .meta strong{font-size:17px;font-weight:800;letter-spacing:-.02em}
+  table{width:100%;border-collapse:collapse;margin:10px 0}
+  table.grid th,table.grid td{border-bottom:1px solid #f0ede5;padding:7px 8px;text-align:left;font-size:13px}
+  table.grid th{color:var(--mute);font-size:10.5px;text-transform:uppercase;letter-spacing:.05em;font-weight:700}
+  table.checks td{padding:4px 8px;border-bottom:1px solid #f4f2ec}
+  table.checks td.g{width:20px;font-weight:700}
+  table.kv td{padding:5px 8px;border-bottom:1px solid #f4f2ec;vertical-align:top}
+  table.kv td:first-child{color:var(--mute);width:150px}
+  .card{border:1px solid var(--line);border-radius:14px;padding:14px 16px;margin:12px 0;background:#fbfaf6}
+  pre{background:#111;color:#c7d2e0;padding:12px;border-radius:8px;overflow:auto;font-size:11px}
+  footer{padding:20px 40px;border-top:1px solid var(--line);color:var(--mute);font-size:12px;display:flex;justify-content:space-between}
+  a{color:var(--accent)}
+  @media print{body{background:#fff}.page{border:none}}
+</style></head><body><div class="page">
+  <header>
+    <div class="brand">SOYRAGE AGENCY · RESILIENCE EVIDENCE</div>
+    <h1>${esc(r.title)}</h1>
+    <div>${pill(r.outcome)} &nbsp;<span class="muted">Report ID ${esc(r.id)}${r.demo ? " · demo data" : ""}</span></div>
+    <div class="meta">
+      <div><span>Started</span><strong style="font-size:13px">${esc(r.startedAt.replace("T", " ").slice(0, 19))}</strong></div>
+      <div><span>Finished</span><strong style="font-size:13px">${esc(r.finishedAt.replace("T", " ").slice(0, 19))}</strong></div>
+      <div><span>Duration</span><strong>${dur(r.durationSec)}</strong></div>
+      <div><span>Verdict</span><strong style="color:${HTML_COLOR[r.outcome]}">${MARK[r.outcome]}</strong></div>
+    </div>
+  </header>
+  <main>
+    <p>${esc(r.summary)}</p>
+    <h2>Results</h2>
+    ${detail.join("\n")}
+    <h2>Compliance mapping</h2>
+    <table class="grid"><tr><th>Framework</th><th>Control</th><th>Title</th></tr>${controls}</table>
+    <h2>Signature</h2>
+    ${sigHtml}
+  </main>
+  <footer>
+    <span>Generated by ${esc(BRAND.product)} — ${esc(BRAND.author)}</span>
+    <span><a href="${BRAND.url}">${esc(BRAND.url)}</a> · <a href="${BRAND.donate}">Support</a></span>
+  </footer>
+</div></body></html>`;
+}
+/** Persist a report as JSON + Markdown + HTML under `outDir`. Returns paths. */
+export function writeReports(r, outDir) {
+    mkdirSync(outDir, { recursive: true });
+    const base = join(outDir, r.id);
+    const paths = { json: `${base}.json`, markdown: `${base}.md`, html: `${base}.html` };
+    writeFileSync(paths.json, JSON.stringify(r, null, 2));
+    writeFileSync(paths.markdown, renderMarkdown(r));
+    writeFileSync(paths.html, renderHtml(r));
+    return paths;
+}
+//# sourceMappingURL=report.js.map

package/dist/resilience/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/resilience/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAavC,qEAAqE;AACrE,MAAM,CAAC,MAAM,QAAQ,GAAqC;IACxD,eAAe,EAAE;QACf,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,oBAAoB,EAAE;QACzE,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,uCAAuC,EAAE;QAC5F,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,uCAAuC,EAAE;QAC9F,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,gCAAgC,EAAE;KAClF;IACD,mBAAmB,EAAE;QACnB,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,yCAAyC,EAAE;QAC7F,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE;QACxE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,oDAAoD,EAAE;QAC3G,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,yBAAyB,EAAE;KAC1E;IACD,UAAU,EAAE;QACV,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,uCAAuC,EAAE;QAC5F,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,yCAAyC,EAAE;QAChG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAAE;QACtE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,wCAAwC,EAAE;KAC7F;CACF,CAAC;AAEF,MAAM,IAAI,GAA4B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACjG,MAAM,KAAK,GAA4B,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACtF,MAAM,UAAU,GAA4B,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAEnH,qDAAqD;AACrD,MAAM,UAAU,GAAG,CAAC,GAAW;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACjD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;IACzD,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;IACzD,OAAO,GAAG,CAAC,GAAG,CAAC;AACjB,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,OAAO,CAAC,CAAmB;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,IAAI,KAAK,KAAK,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;AAChD,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,SAAS,CAAC,CAAmB;IAC3C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,CAAC,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACtG,MAAM,GAAG,GAAG,MAAM,IAAI,MAAM,iBAAiB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACvG,CAAC;SAAM,IAAI,CAAC,CAAC,UAAU,KAAK,mBAAmB,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,UAAU,cAAc,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,MAAM;QACN,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QACpE,EAAE,EAAE,CAAC,CAAC,EAAE;KACT,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,CAAc;IAC/B,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,aAAa,CAAC,QAAsB;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7F,OAAO,yDAAyD,IAAI,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,cAAc,CAAC,CAAmB;IACzC,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,OAAO,aAAa,CAAC;IACvC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;IACtB,OAAO;QACL,oBAAoB,CAAC,CAAC,SAAS,EAAE;QACjC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;QAChC,4BAA4B,CAAC,CAAC,MAAM,IAAI;QACxC,+BAA+B,CAAC,CAAC,SAAS,IAAI;QAC9C,4BAA4B,CAAC,CAAC,cAAc,IAAI;QAChD,EAAE;QACF,6CAA6C;QAC7C,EAAE;QACF,KAAK;QACL,CAAC,CAAC,YAAY;QACd,KAAK;KACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,cAAc,CAAC,CAAmB;IAChD,MAAM,IAAI,GAAG;QACX,KAAK,CAAC,CAAC,KAAK,EAAE;QACd,EAAE;QACF,gBAAgB,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,EAAE;QACnG,EAAE;QACF,kBAAkB,CAAC,CAAC,SAAS,EAAE;QAC/B,mBAAmB,CAAC,CAAC,UAAU,EAAE;QACjC,mBAAmB,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE;QACvC,kBAAkB,CAAC,CAAC,OAAO,EAAE;QAC7B,EAAE;KACH,CAAC;IAEF,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,CAAC,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,CAAuB,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,EAAE,2DAA2D,GAAG,CAAC,cAAc,iCAAiC,EAAE,EAAE,CAAC,CAAC;QACzJ,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,CACP,OAAO,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC,IAAI,GAAG,EACvD,EAAE,EACF,gBAAgB,EAAE,CAAC,OAAO,WAAW,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,EAC7D,gCAAgC,EAAE,CAAC,aAAa,SAAS,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,mBAAmB,EAC9F,cAAc,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,+BAA+B,EAAE,EAC9F,EAAE,EACF,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAC3B,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,CAAC,UAAU,KAAK,mBAAmB,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,CAAgB,CAAC;QAC7B,IAAI,CAAC,IAAI,CACP,cAAc,EACd,EAAE,EACF,uBAAuB,GAAG,CAAC,MAAM,IAAI,SAAS,iJAAiJ,EAC/L,EAAE,EACF,0DAA0D,EAC1D,uCAAuC,EACvC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CACd,CAAC,CAAC,EAAE,EAAE,CACJ,KAAK,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,QAAQ,QAAQ,CAAC,CAAC,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAClL,EACD,EAAE,EACF,KAAK,GAAG,CAAC,OAAO,aAAa,GAAG,CAAC,UAAU,+BAA+B,EAC1E,EAAE,CACH,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,CAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,CACP,4BAA4B,EAC5B,EAAE,EACF,gBAAgB,GAAG,CAAC,OAAO,IAAI,EAC/B,oBAAoB,GAAG,CAAC,WAAW,uBAAuB,EAC1D,qBAAqB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EACtE,EAAE,EACF,2CAA2C,EAC3C,iCAAiC,EACjC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CACd,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,MAAM,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,IAAI,CAC3G,EACD,EAAE,CACH,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG;QACX,uBAAuB;QACvB,EAAE;QACF,gDAAgD;QAChD,EAAE;QACF,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzB,EAAE;QACF,cAAc;QACd,EAAE;QACF,cAAc,CAAC,CAAC,CAAC;QACjB,EAAE;QACF,KAAK;QACL,EAAE;QACF,kBAAkB,KAAK,CAAC,OAAO,QAAQ,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,GAAG,EAAE;QACpE,wBAAwB,KAAK,CAAC,MAAM,EAAE;QACtC,EAAE;KACH,CAAC;IAEF,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAY,CAAA,CAAC,CAAC;AAEzH,wDAAwD;AACxD,MAAM,UAAU,UAAU,CAAC,CAAmB;IAC5C,MAAM,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAC1B,wCAAwC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAE7E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,CAAuB,CAAC;QACpC,MAAM,CAAC,IAAI,CACT,uEAAuE,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,0CAA0C,CACzI,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CACT,yBAAyB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC,IAAI,cAAc,EAC3G,kCAAkC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,uBAAuB,EAAE,CAAC,aAAa,eAAe,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,iCAAiC,MAAM,EACzP,yBAAyB,EAAE,CAAC,MAAM;iBAC/B,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,kCAAkC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,0BAA0B,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,CAC1N;iBACA,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAC5B,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,CAAC,UAAU,KAAK,mBAAmB,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,CAAgB,CAAC;QAC7B,MAAM,CAAC,IAAI,CACT,wCAAwC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,wFAAwF,EAC5J,0HAA0H,EAC1H,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CACd,CAAC,CAAC,EAAE,EAAE,CACJ,WAAW,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,IAAI,yBAAyB,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,OAAO,yBAAyB,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,uCAAuC,GAAG,UAAU,CAAC,IAAI,GAAG,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAClY,EACD,sBAAsB,GAAG,CAAC,OAAO,aAAa,GAAG,CAAC,UAAU,0CAA0C,CACvG,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,CAAa,CAAC;QAC1B,MAAM,CAAC,IAAI,CACT,oCAAoC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,mCAAmC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,2BAA2B,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,2BAA2B,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,EAC9M,qGAAqG,EACrG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CACd,CAAC,CAAC,EAAE,EAAE,CACJ,WAAW,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,yBAAyB,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAChN,EACD,UAAU,CACX,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ;SACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,qBAAqB,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;SACrH,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC;IACxB,MAAM,OAAO,GAAG,GAAG;QACjB,CAAC,CAAC;qCAC+B,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC;qCAClB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;iDACL,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;wDACR,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC;iDACzB,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC;;qEAEH,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,kBAAkB;QACxG,CAAC,CAAC,gCAAgC,CAAC;IAErC,OAAO;SACA,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;;mBAEF,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAkCf,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;WACX,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,wCAAwC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE;;gEAE1C,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;iEAC9C,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;0CACvE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;sDACN,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;;;;SAItF,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;;MAEjB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;;mFAE4D,QAAQ;;MAErF,OAAO;;;yBAGY,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;qBAC7C,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,KAAK,CAAC,MAAM;;qBAE3D,CAAC;AACtB,CAAC;AASD,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,CAAmB,EAAE,MAAc;IAC9D,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,KAAK,GAAgB,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;IAClG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACtD,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/resilience/runbook.d.ts

@@ -0,0 +1,42 @@
+/**
+ * DR runbook parser (declarative YAML, dependency-free).
+ *
+ * Disaster-recovery drills are driven by a small, declarative runbook so the
+ * plan lives in version control next to the infrastructure — not in a Word
+ * document from 2019 that nobody has ever executed. This parses the safe subset
+ * of YAML the runbook schema needs (top-level scalars + a `steps:` sequence of
+ * mappings); a JSON runbook is accepted too.
+ *
+ * Part of Proxmox MCP Server.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+/** A single declarative recovery step. */
+export interface RunbookStep {
+    /** restore | start | healthcheck | verify-file | failover | notify | teardown | wait */
+    action: string;
+    guest?: string;
+    /** Backup selector for `restore` (e.g. "latest"). */
+    from?: string;
+    /** Health check kind for `healthcheck` (service | db | http). */
+    check?: string;
+    /** File path for `verify-file`. */
+    path?: string;
+    /** Free-form note surfaced in the drill minutes. */
+    note?: string;
+}
+/** A parsed, validated recovery runbook. */
+export interface Runbook {
+    name: string;
+    /** Target environment — the drill refuses to touch anything named "production". */
+    environment: string;
+    description: string;
+    /** Recovery Point Objective the drill asserts (hours). */
+    rpoHours: number;
+    steps: RunbookStep[];
+}
+/**
+ * Parse a declarative runbook from YAML (subset) or JSON text. Throws a clear
+ * error if the document is malformed or references an unknown action.
+ */
+export declare function parseRunbook(text: string): Runbook;

package/dist/resilience/runbook.js

@@ -0,0 +1,165 @@
+/**
+ * DR runbook parser (declarative YAML, dependency-free).
+ *
+ * Disaster-recovery drills are driven by a small, declarative runbook so the
+ * plan lives in version control next to the infrastructure — not in a Word
+ * document from 2019 that nobody has ever executed. This parses the safe subset
+ * of YAML the runbook schema needs (top-level scalars + a `steps:` sequence of
+ * mappings); a JSON runbook is accepted too.
+ *
+ * Part of Proxmox MCP Server.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+const KNOWN_ACTIONS = new Set([
+    "restore",
+    "start",
+    "healthcheck",
+    "verify-file",
+    "failover",
+    "notify",
+    "teardown",
+    "wait",
+]);
+/** Strip surrounding quotes and unescape a scalar. */
+function scalar(raw) {
+    const v = raw.trim();
+    if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) {
+        return v.slice(1, -1);
+    }
+    return v;
+}
+/** Indentation width (spaces) of a line. */
+function indentOf(line) {
+    return line.length - line.trimStart().length;
+}
+/** Remove a trailing ` # comment`, respecting quoted strings. Keeps indentation. */
+function stripInlineComment(line) {
+    let quote = null;
+    for (let i = 0; i < line.length; i++) {
+        const c = line[i];
+        if (quote) {
+            if (c === quote)
+                quote = null;
+        }
+        else if (c === '"' || c === "'") {
+            quote = c;
+        }
+        else if (c === "#" && (i === 0 || line[i - 1] === " " || line[i - 1] === "\t")) {
+            return line.slice(0, i).replace(/\s+$/, "");
+        }
+    }
+    return line;
+}
+/**
+ * Parse a declarative runbook from YAML (subset) or JSON text. Throws a clear
+ * error if the document is malformed or references an unknown action.
+ */
+export function parseRunbook(text) {
+    const trimmed = text.trim();
+    const raw = trimmed.startsWith("{")
+        ? JSON.parse(trimmed)
+        : parseYaml(trimmed);
+    const name = String(raw.name ?? "").trim();
+    if (!name)
+        throw new Error("Runbook is missing a `name`.");
+    const environment = String(raw.environment ?? "staging").trim();
+    if (/prod/i.test(environment)) {
+        throw new Error(`Runbook environment "${environment}" looks like production. DR drills must ` +
+            "target an isolated test environment — refusing to run.");
+    }
+    const stepsRaw = Array.isArray(raw.steps) ? raw.steps : [];
+    if (stepsRaw.length === 0)
+        throw new Error("Runbook has no `steps`.");
+    const steps = stepsRaw.map((s, i) => {
+        const action = String(s.action ?? "").trim();
+        if (!KNOWN_ACTIONS.has(action)) {
+            throw new Error(`Step ${i + 1} has unknown action "${action}". Known actions: ${[...KNOWN_ACTIONS].join(", ")}.`);
+        }
+        return {
+            action,
+            guest: s.guest !== undefined ? String(s.guest) : undefined,
+            from: s.from !== undefined ? String(s.from) : undefined,
+            check: s.check !== undefined ? String(s.check) : undefined,
+            path: s.path !== undefined ? String(s.path) : undefined,
+            note: s.note !== undefined ? String(s.note) : undefined,
+        };
+    });
+    return {
+        name,
+        environment,
+        description: String(raw.description ?? "").trim(),
+        rpoHours: Number(raw.rpoHours ?? 24),
+        steps,
+    };
+}
+/**
+ * Minimal YAML reader for the runbook schema: top-level `key: value` scalars
+ * and a single `steps:` block that is a sequence of mappings. Deliberately not
+ * a general YAML parser — it covers exactly what a runbook needs.
+ */
+function parseYaml(text) {
+    const lines = text
+        .split(/\r?\n/)
+        .map((l) => stripInlineComment(l.replace(/\t/g, "  ")))
+        .filter((l) => l.trim() !== "" && !l.trim().startsWith("#"));
+    const root = {};
+    let i = 0;
+    while (i < lines.length) {
+        const line = lines[i];
+        if (indentOf(line) !== 0) {
+            throw new Error(`Unexpected indentation at: "${line.trim()}"`);
+        }
+        const colon = line.indexOf(":");
+        if (colon === -1)
+            throw new Error(`Expected "key: value" at: "${line.trim()}"`);
+        const key = line.slice(0, colon).trim();
+        const rest = line.slice(colon + 1).trim();
+        if (rest === "" && key === "steps") {
+            const [items, next] = parseSequence(lines, i + 1);
+            root[key] = items;
+            i = next;
+            continue;
+        }
+        root[key] = rest === "" ? "" : scalar(rest);
+        i += 1;
+    }
+    return root;
+}
+/** Parse a sequence of mappings starting at `start`; returns [items, nextIndex]. */
+function parseSequence(lines, start) {
+    const items = [];
+    let i = start;
+    let itemIndent = -1;
+    let current = null;
+    while (i < lines.length) {
+        const line = lines[i];
+        const indent = indentOf(line);
+        if (indent === 0)
+            break; // back to top level
+        const trimmed = line.trim();
+        if (trimmed.startsWith("- ")) {
+            if (itemIndent === -1)
+                itemIndent = indent;
+            if (indent !== itemIndent)
+                break;
+            current = {};
+            items.push(current);
+            const inline = trimmed.slice(2).trim();
+            const colon = inline.indexOf(":");
+            if (colon !== -1)
+                current[inline.slice(0, colon).trim()] = scalar(inline.slice(colon + 1));
+        }
+        else if (current && indent > itemIndent) {
+            const colon = trimmed.indexOf(":");
+            if (colon !== -1)
+                current[trimmed.slice(0, colon).trim()] = scalar(trimmed.slice(colon + 1));
+        }
+        else {
+            break;
+        }
+        i += 1;
+    }
+    return [items, i];
+}
+//# sourceMappingURL=runbook.js.map

package/dist/resilience/runbook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runbook.js","sourceRoot":"","sources":["../../src/resilience/runbook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA4BH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,SAAS;IACT,OAAO;IACP,aAAa;IACb,aAAa;IACb,UAAU;IACV,QAAQ;IACR,UAAU;IACV,MAAM;CACP,CAAC,CAAC;AAEH,sDAAsD;AACtD,SAAS,MAAM,CAAC,GAAW;IACzB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACrF,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,4CAA4C;AAC5C,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC;AAC/C,CAAC;AAED,oFAAoF;AACpF,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;QAChC,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,KAAK,GAAG,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YACjF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,GAAG,GAA4B,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAC1D,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAA6B;QAClD,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAEvB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,IAAI,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,wBAAwB,WAAW,0CAA0C;YAC3E,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,KAAwC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAEtE,MAAM,KAAK,GAAkB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,QAAQ,CAAC,GAAG,CAAC,wBAAwB,MAAM,qBAAqB,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjG,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM;YACN,KAAK,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;YAC1D,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YACvD,KAAK,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;YAC1D,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YACvD,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SACxD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,WAAW;QACX,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QACjD,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;QACpC,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAG,IAAI;SACf,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;SACtD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/D,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE1C,IAAI,IAAI,KAAK,EAAE,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACnC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAClB,CAAC,GAAG,IAAI,CAAC;YACT,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,SAAS,aAAa,CAAC,KAAe,EAAE,KAAa;IACnD,MAAM,KAAK,GAAmC,EAAE,CAAC;IACjD,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC;IACpB,IAAI,OAAO,GAAmC,IAAI,CAAC;IAEnD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,MAAM,KAAK,CAAC;YAAE,MAAM,CAAC,oBAAoB;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,IAAI,UAAU,KAAK,CAAC,CAAC;gBAAE,UAAU,GAAG,MAAM,CAAC;YAC3C,IAAI,MAAM,KAAK,UAAU;gBAAE,MAAM;YACjC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,KAAK,KAAK,CAAC,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7F,CAAC;aAAM,IAAI,OAAO,IAAI,MAAM,GAAG,UAAU,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,KAAK,KAAK,CAAC,CAAC;gBAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC;aAAM,CAAC;YACN,MAAM;QACR,CAAC;QACD,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACpB,CAAC"}

package/dist/resilience/signing.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Evidence signing (Ed25519, zero external dependencies).
+ *
+ * Compliance evidence is only useful if it can be trusted. Every resilience
+ * report is signed with an Ed25519 key so an auditor can verify — offline, with
+ * only the bundled public key — that the report was produced by this system on
+ * the stated date and has not been altered since.
+ *
+ * The private key lives on disk (generated on first use, or supplied via
+ * PROXMOX_MCP_SIGNING_KEY). Reports embed the public key + its fingerprint, so
+ * verification never needs the secret.
+ *
+ * Part of Proxmox MCP Server.
+ * Crafted by SoyRage Agency — https://soyrage.es/
+ * MIT licensed (see LICENSE).
+ */
+import { type KeyObject } from "node:crypto";
+import type { Signature } from "./types.js";
+/** Deterministically serialise a value so the digest is stable across runs. */
+export declare function canonical(value: unknown): string;
+/** SHA-256 hex digest of a string. */
+export declare function sha256(text: string): string;
+/**
+ * Load the signing key from `keyPath`, generating and persisting a fresh
+ * Ed25519 keypair there on first use. Returns both key objects.
+ */
+export declare function loadSigningKey(keyPath: string): {
+    priv: KeyObject;
+    pub: KeyObject;
+};
+/** Public-key fingerprint: SHA-256 of the DER SPKI, hex, colon-grouped short form. */
+export declare function fingerprint(pub: KeyObject): string;
+/**
+ * Sign a report payload. The signature covers the SHA-256 digest of the
+ * canonical (key-sorted) JSON of `payload` — i.e. the whole report minus the
+ * signature block itself.
+ */
+export declare function signPayload(payload: unknown, keyPath: string, signedAt: string): Signature;
+/**
+ * Verify a report's signature against its embedded public key. Returns true
+ * only if the digest matches the payload AND the signature matches the digest.
+ */
+export declare function verifySignature(payload: unknown, sig: Signature): boolean;