@eudiplo/cli 7.0.1-main.dc652b3 → 7.1.0

package/README.md

@@ -5,9 +5,11 @@ instance and deployment-driver commands for local Docker Compose demos.
 
 ## Quick Start
 
-`npx` is provided by npm, which is installed with Node.js. It is not bundled with
-operating systems by default, so install a current Node.js distribution first if
-`npx` is missing.
+This package is the npm distribution of the **EUDIPLO CLI** and requires
+Node.js 22+.
+
+For users who do not want a local Node.js dependency, use the standalone CLI
+installer instead: `curl -fsSL https://eudiplo.dev/install.sh | bash`
 
 ```bash
 npx @eudiplo/cli demo
@@ -29,6 +31,10 @@ Tag selection defaults to the CLI version. For prerelease versions containing
 The generated demo config remains editable after creation. Existing files are
 preserved unless you pass `--force`.
 
+The standalone CLI and this npm package are two distributions of the same
+`eudiplo` command. The standalone CLI removes the Node.js requirement, but
+Docker and Docker Compose are still required for the demo deployment.
+
 ## Package and Binary Names
 
 The npm package is scoped as `@eudiplo/cli`, while the installed binary is
@@ -53,6 +59,9 @@ eudiplo instance add production --url https://eudiplo.example.com
 eudiplo doctor --instance production
 eudiplo status --instance production
 eudiplo config validate
+eudiplo config validate tenant ./assets/config/root
+eudiplo config validate tenants ./assets/config
+eudiplo config validate tenants ./assets/config --format json
 eudiplo --version
 eudiplo version
 ```
@@ -61,6 +70,26 @@ eudiplo version
 `version` also checks the npm registry and reports whether an update is
 available.
 
+`config validate tenant <path>` validates a single tenant's config-import
+files, and `config validate tenants <path>` validates every tenant directory
+under a configuration root. Both commands parse and validate every supported
+resource file (tenant metadata, clients, key chains, credential configs,
+issuance configs, presentation configs, status lists, trust lists, attribute
+providers, webhook endpoints, registrar config, and tenant-specific KMS
+config) against the same JSON Schemas the backend uses for config-import,
+without starting EUDIPLO, connecting to a database, or writing anything.
+Unresolved `${VAR}` placeholders without a default are reported without ever
+printing resolved secret values. Add `--format json` for a machine-readable
+report suitable for CI. The command exits non-zero when any selected tenant
+fails validation.
+
+`src/config-validate/registry.json` is the single source of truth mapping
+each tenant config-import file/folder to its resource type and schema. `pnpm
+run gen:api` regenerates the schemas, the CLI-bundled subset in
+`templates/schemas/`, and the corresponding `json.schemas` editor
+associations in the repository's `.vscode/settings.json` from this file, so
+none of them can drift from one another.
+
 Compose driver commands require a `compose` instance:
 
 ```bash
@@ -117,6 +146,8 @@ The build synchronizes and validates bundled CLI assets from canonical sources:
 
 - `deployment/docker-compose/docker-compose.yml`
 - `assets/config/demo/**`
+- `schemas/*.schema.json` referenced by `src/config-validate/registry.json`
+  (regenerate with `pnpm run gen:api` after changing backend import schemas)
 
 ## Single Executable Application
 

package/dist/config-validate/index.d.ts

@@ -0,0 +1,4 @@
+export { loadTenantConfigSchemas } from "./schemas.js";
+export { validateTenantDirectory, validateTenantsRoot } from "./validator.js";
+export { buildJsonReport, formatTextReport } from "./report.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/config-validate/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config-validate/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC"}

package/dist/config-validate/index.js

@@ -0,0 +1,4 @@
+export { loadTenantConfigSchemas } from "./schemas.js";
+export { validateTenantDirectory, validateTenantsRoot } from "./validator.js";
+export { buildJsonReport, formatTextReport } from "./report.js";
+//# sourceMappingURL=index.js.map

package/dist/config-validate/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config-validate/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC"}

package/dist/config-validate/registry.d.ts

@@ -0,0 +1,5 @@
+import type { TenantResourceDefinition } from "./types.js";
+/** Entries actually scanned by the CLI validator (excludes editor-authoring-only schemas). */
+export declare const CLI_VALIDATED_REGISTRY: readonly TenantResourceDefinition[];
+export declare function requiredSchemaFiles(): string[];
+//# sourceMappingURL=registry.d.ts.map

package/dist/config-validate/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/config-validate/registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAK3D,8FAA8F;AAC9F,eAAO,MAAM,sBAAsB,EAAE,SAAS,wBAAwB,EACM,CAAC;AAE7E,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAE9C"}

package/dist/config-validate/registry.js

@@ -0,0 +1,8 @@
+import registryData from "./registry.json" with { type: "json" };
+const TENANT_RESOURCE_REGISTRY = registryData;
+/** Entries actually scanned by the CLI validator (excludes editor-authoring-only schemas). */
+export const CLI_VALIDATED_REGISTRY = TENANT_RESOURCE_REGISTRY.filter((entry) => entry.cliValidated !== false);
+export function requiredSchemaFiles() {
+    return Array.from(new Set(CLI_VALIDATED_REGISTRY.map((entry) => entry.schemaFile)));
+}
+//# sourceMappingURL=registry.js.map

package/dist/config-validate/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/config-validate/registry.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAGjE,MAAM,wBAAwB,GAC1B,YAA0C,CAAC;AAE/C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,sBAAsB,GAC/B,wBAAwB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC;AAE7E,MAAM,UAAU,mBAAmB;IAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC"}

package/dist/config-validate/registry.json

@@ -0,0 +1,138 @@
+[
+    {
+        "kind": "file",
+        "file": "info.json",
+        "resourceType": "tenant metadata",
+        "schemaFile": "ImportTenantDto.schema.json",
+        "required": true,
+        "fileMatch": [
+            "/assets/config/*/info.json",
+            "/apps/backend/test/fixtures/*/info.json"
+        ]
+    },
+    {
+        "kind": "file",
+        "file": "registrar.json",
+        "resourceType": "registrar config",
+        "schemaFile": "CreateRegistrarConfigDto.schema.json",
+        "required": false,
+        "fileMatch": [
+            "/assets/config/*/registrar*.json",
+            "/apps/backend/test/fixtures/*/registrar*.json"
+        ]
+    },
+    {
+        "kind": "file",
+        "file": "kms.json",
+        "resourceType": "tenant KMS config",
+        "schemaFile": "KmsConfigDto.schema.json",
+        "required": false,
+        "fileMatch": [
+            "/assets/config/kms.json",
+            "/assets/config/*/kms.json",
+            "/apps/backend/test/fixtures/kms.json",
+            "/apps/backend/test/fixtures/*/kms.json"
+        ]
+    },
+    {
+        "kind": "directory",
+        "subfolder": "clients",
+        "resourceType": "client config",
+        "schemaFile": "CreateClientDto.schema.json",
+        "fileMatch": [
+            "/assets/config/*/clients/*.json",
+            "/apps/backend/test/fixtures/*/clients/*.json"
+        ]
+    },
+    {
+        "kind": "directory",
+        "subfolder": "key-chains",
+        "resourceType": "key-chain",
+        "schemaFile": "KeyChainImportDto.schema.json",
+        "fileMatch": [
+            "/assets/config/*/key-chains/*.json",
+            "/apps/backend/test/fixtures/*/key-chains/*.json"
+        ]
+    },
+    {
+        "kind": "directory",
+        "subfolder": "certs",
+        "resourceType": "certificate",
+        "schemaFile": "CertImportDto.schema.json",
+        "cliValidated": false,
+        "fileMatch": [
+            "/assets/config/*/certs/*.json",
+            "/apps/backend/test/fixtures/*/certs/*.json"
+        ]
+    },
+    {
+        "kind": "directory",
+        "subfolder": "attribute-providers",
+        "resourceType": "attribute provider",
+        "schemaFile": "CreateAttributeProviderDto.schema.json",
+        "fileMatch": [
+            "/assets/config/*/attribute-providers/*.json",
+            "/apps/backend/test/fixtures/*/attribute-providers/*.json"
+        ]
+    },
+    {
+        "kind": "directory",
+        "subfolder": "webhook-endpoints",
+        "resourceType": "webhook endpoint",
+        "schemaFile": "CreateWebhookEndpointDto.schema.json",
+        "fileMatch": [
+            "/assets/config/*/webhook-endpoints/*.json",
+            "/apps/backend/test/fixtures/*/webhook-endpoints/*.json"
+        ]
+    },
+    {
+        "kind": "directory",
+        "subfolder": "issuance",
+        "resourceType": "issuance config",
+        "schemaFile": "IssuanceConfig.schema.json",
+        "fileMatch": [
+            "/assets/config/*/issuance/issuance.json",
+            "/apps/backend/test/fixtures/*/issuance/issuance.json"
+        ]
+    },
+    {
+        "kind": "directory",
+        "subfolder": "issuance/credentials",
+        "resourceType": "credential config",
+        "schemaFile": "CredentialConfigCreate.schema.json",
+        "fileMatch": [
+            "/assets/config/*/issuance/credentials/*.json",
+            "/apps/backend/test/fixtures/*/issuance/credentials/*.json"
+        ]
+    },
+    {
+        "kind": "directory",
+        "subfolder": "issuance/status-lists",
+        "resourceType": "status list",
+        "schemaFile": "StatusListImportDto.schema.json",
+        "fileMatch": [
+            "/assets/config/*/issuance/status-lists/*.json",
+            "/apps/backend/test/fixtures/*/issuance/status-lists/*.json"
+        ]
+    },
+    {
+        "kind": "directory",
+        "subfolder": "trust-lists",
+        "resourceType": "trustlist",
+        "schemaFile": "TrustListCreateDto.schema.json",
+        "fileMatch": [
+            "/assets/config/*/trust-lists/*.json",
+            "/apps/backend/test/fixtures/*/trust-lists/*.json"
+        ]
+    },
+    {
+        "kind": "directory",
+        "subfolder": "presentation",
+        "resourceType": "presentation config",
+        "schemaFile": "PresentationConfigCreateDto.schema.json",
+        "fileMatch": [
+            "/assets/config/*/presentation/*.json",
+            "/apps/backend/test/fixtures/*/presentation/*.json"
+        ]
+    }
+]

package/dist/config-validate/report.d.ts

@@ -0,0 +1,21 @@
+import type { TenantValidationResult } from "./types.js";
+export declare function buildJsonReport(results: TenantValidationResult[]): {
+    valid: boolean;
+    tenants: {
+        id: string;
+        valid: boolean;
+        files: number;
+        errors: {
+            file: string;
+            path: string | undefined;
+            message: string;
+        }[];
+    }[];
+    summary: {
+        tenants: number;
+        files: number;
+        errors: number;
+    };
+};
+export declare function formatTextReport(scope: "tenant" | "tenants", rootPath: string, results: TenantValidationResult[]): string;
+//# sourceMappingURL=report.d.ts.map

package/dist/config-validate/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/config-validate/report.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAmB,MAAM,YAAY,CAAC;AAE1E,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,EAAE;IAEzD,KAAK;IACL,OAAO;;;;;;;;;;IAUP,OAAO;QACH,OAAO;QACP,KAAK;QACL,MAAM;;EAGjB;AAED,wBAAgB,gBAAgB,CAC5B,KAAK,EAAE,QAAQ,GAAG,SAAS,EAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,sBAAsB,EAAE,GAClC,MAAM,CASR"}

package/dist/config-validate/report.js

@@ -0,0 +1,78 @@
+export function buildJsonReport(results) {
+    return {
+        valid: results.every((result) => result.valid),
+        tenants: results.map((result) => ({
+            id: result.id,
+            valid: result.valid,
+            files: result.files,
+            errors: result.errors.map((error) => ({
+                file: error.file,
+                path: error.path,
+                message: error.message,
+            })),
+        })),
+        summary: {
+            tenants: results.length,
+            files: results.reduce((sum, result) => sum + result.files, 0),
+            errors: results.reduce((sum, result) => sum + result.errors.length, 0),
+        },
+    };
+}
+export function formatTextReport(scope, rootPath, results) {
+    const header = scope === "tenants"
+        ? `Validating tenant configuration root: ${rootPath}`
+        : `Validating tenant configuration: ${rootPath}`;
+    const lines = [header, "", ...results.flatMap(formatTenantBlock), formatSummaryLine(results)];
+    return `${lines.join("\n")}\n`;
+}
+function formatTenantBlock(result) {
+    const lines = [`${result.valid ? "PASS" : "FAIL"} ${result.id}`];
+    if (result.valid) {
+        for (const [resourceType, count] of Object.entries(result.resourceCounts)) {
+            lines.push(`  ${count} ${pluralize(resourceType, count)}`);
+        }
+    }
+    else {
+        lines.push(...formatTenantErrors(result.errors));
+    }
+    lines.push("");
+    return lines;
+}
+function formatTenantErrors(errors) {
+    const lines = [];
+    for (const [file, issues] of groupErrorsByFile(errors)) {
+        lines.push(`  ${file}`);
+        for (const issue of issues) {
+            lines.push(`    ${formatIssueMessage(issue)}`);
+        }
+    }
+    return lines;
+}
+function formatIssueMessage(issue) {
+    return issue.path ? `${issue.path}: ${issue.message}` : issue.message;
+}
+function formatSummaryLine(results) {
+    const totalFiles = results.reduce((sum, result) => sum + result.files, 0);
+    const totalErrors = results.reduce((sum, result) => sum + result.errors.length, 0);
+    if (totalErrors === 0) {
+        return `Validated ${results.length} tenant(s) and ${totalFiles} configuration file(s).\nNo errors found.`;
+    }
+    const failedTenants = results.filter((result) => !result.valid).length;
+    return `Validation failed: ${totalErrors} error(s) in ${failedTenants} tenant(s).`;
+}
+function groupErrorsByFile(errors) {
+    const grouped = new Map();
+    for (const error of errors) {
+        const existing = grouped.get(error.file);
+        if (existing) {
+            existing.push(error);
+            continue;
+        }
+        grouped.set(error.file, [error]);
+    }
+    return Array.from(grouped.entries());
+}
+function pluralize(label, count) {
+    return count === 1 ? label : `${label}s`;
+}
+//# sourceMappingURL=report.js.map

package/dist/config-validate/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/config-validate/report.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,eAAe,CAAC,OAAiC;IAC7D,OAAO;QACH,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9B,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAClC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;aACzB,CAAC,CAAC;SACN,CAAC,CAAC;QACH,OAAO,EAAE;YACL,OAAO,EAAE,OAAO,CAAC,MAAM;YACvB,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAC7D,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;SACzE;KACJ,CAAC;AACN,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC5B,KAA2B,EAC3B,QAAgB,EAChB,OAAiC;IAEjC,MAAM,MAAM,GACR,KAAK,KAAK,SAAS;QACf,CAAC,CAAC,yCAAyC,QAAQ,EAAE;QACrD,CAAC,CAAC,oCAAoC,QAAQ,EAAE,CAAC;IAEzD,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IAE9F,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,SAAS,iBAAiB,CAAC,MAA8B;IACrD,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAEjE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;YACxE,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;IACL,CAAC;SAAM,CAAC;QACJ,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAyB;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,OAAO,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAsB;IAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;AAC1E,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAiC;IACxD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAEnF,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,aAAa,OAAO,CAAC,MAAM,kBAAkB,UAAU,2CAA2C,CAAC;IAC9G,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IACvE,OAAO,sBAAsB,WAAW,gBAAgB,aAAa,aAAa,CAAC;AACvF,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAyB;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA6B,CAAC;IACrD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,SAAS;QACb,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,KAAa;IAC3C,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC;AAC7C,CAAC"}

package/dist/config-validate/schemas.d.ts

@@ -0,0 +1,2 @@
+export declare function loadTenantConfigSchemas(): Promise<Map<string, Record<string, unknown>>>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/config-validate/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/config-validate/schemas.ts"],"names":[],"mappings":"AAKA,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAmB7F"}

package/dist/config-validate/schemas.js

@@ -0,0 +1,24 @@
+import { readCliTextAsset } from "../sea-assets.js";
+import { requiredSchemaFiles } from "./registry.js";
+const manifestAssetKey = "templates/schemas.manifest.json";
+export async function loadTenantConfigSchemas() {
+    const manifest = await readSchemaManifest();
+    const schemas = new Map();
+    for (const schemaFile of requiredSchemaFiles()) {
+        if (!manifest.includes(schemaFile)) {
+            throw new Error(`Bundled schema manifest is missing "${schemaFile}". Run "pnpm --filter @eudiplo/cli assets:sync".`);
+        }
+        const text = await readCliTextAsset(`templates/schemas/${schemaFile}`, new URL(`../../templates/schemas/${schemaFile}`, import.meta.url));
+        schemas.set(schemaFile, JSON.parse(text));
+    }
+    return schemas;
+}
+async function readSchemaManifest() {
+    const text = await readCliTextAsset(manifestAssetKey, new URL("../../templates/schemas.manifest.json", import.meta.url));
+    const parsed = JSON.parse(text);
+    if (!Array.isArray(parsed) || !parsed.every((item) => typeof item === "string")) {
+        throw new Error("Bundled schema manifest is malformed.");
+    }
+    return parsed;
+}
+//# sourceMappingURL=schemas.js.map

package/dist/config-validate/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/config-validate/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,gBAAgB,GAAG,iCAAiC,CAAC;AAE3D,MAAM,CAAC,KAAK,UAAU,uBAAuB;IACzC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmC,CAAC;IAE3D,KAAK,MAAM,UAAU,IAAI,mBAAmB,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACX,uCAAuC,UAAU,kDAAkD,CACtG,CAAC;QACN,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAC/B,qBAAqB,UAAU,EAAE,EACjC,IAAI,GAAG,CAAC,2BAA2B,UAAU,EAAE,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CACpE,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC7B,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAC/B,gBAAgB,EAChB,IAAI,GAAG,CAAC,uCAAuC,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CACpE,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/config-validate/types.d.ts

@@ -0,0 +1,33 @@
+export type FixedFileResourceDefinition = {
+    kind: "file";
+    file: string;
+    resourceType: string;
+    schemaFile: string;
+    required: boolean;
+    /** Editor (`.vscode/settings.json`) `json.schemas` fileMatch globs generated for this entry. */
+    fileMatch: string[];
+    /** Set to false for schemas that aren't scanned by the CLI validator (editor authoring only). */
+    cliValidated?: boolean;
+};
+export type DirectoryResourceDefinition = {
+    kind: "directory";
+    subfolder: string;
+    resourceType: string;
+    schemaFile: string;
+    fileMatch: string[];
+    cliValidated?: boolean;
+};
+export type TenantResourceDefinition = FixedFileResourceDefinition | DirectoryResourceDefinition;
+export interface ValidationIssue {
+    file: string;
+    path?: string;
+    message: string;
+}
+export interface TenantValidationResult {
+    id: string;
+    valid: boolean;
+    files: number;
+    errors: ValidationIssue[];
+    resourceCounts: Record<string, number>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/config-validate/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config-validate/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,2BAA2B,GAAG;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,gGAAgG;IAChG,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iGAAiG;IACjG,YAAY,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,YAAY,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,2BAA2B,GAAG,2BAA2B,CAAC;AAEjG,MAAM,WAAW,eAAe;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C"}

package/dist/config-validate/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/config-validate/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/config-validate/types.ts"],"names":[],"mappings":""}

package/dist/config-validate/validator.d.ts

@@ -0,0 +1,4 @@
+import type { TenantValidationResult } from "./types.js";
+export declare function validateTenantsRoot(rootPath: string, schemas: Map<string, Record<string, unknown>>, env: NodeJS.ProcessEnv): Promise<TenantValidationResult[]>;
+export declare function validateTenantDirectory(tenantPath: string, tenantId: string, schemas: Map<string, Record<string, unknown>>, env: NodeJS.ProcessEnv): Promise<TenantValidationResult>;
+//# sourceMappingURL=validator.d.ts.map

package/dist/config-validate/validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../src/config-validate/validator.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAGR,sBAAsB,EAEzB,MAAM,YAAY,CAAC;AAYpB,wBAAsB,mBAAmB,CACrC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC7C,GAAG,EAAE,MAAM,CAAC,UAAU,GACvB,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAanC;AAED,wBAAsB,uBAAuB,CACzC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC7C,GAAG,EAAE,MAAM,CAAC,UAAU,GACvB,OAAO,CAAC,sBAAsB,CAAC,CA4BjC"}

package/dist/config-validate/validator.js

@@ -0,0 +1,185 @@
+import { existsSync } from "node:fs";
+import { readdir, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import Ajv2020 from "ajv/dist/2020";
+import { CLI_VALIDATED_REGISTRY } from "./registry.js";
+const PLACEHOLDER_PATTERN = /\$\{([A-Z0-9_]+)(?::([^}]*))?\}/g;
+async function discoverTenantDirectories(rootPath) {
+    const entries = await readdir(rootPath, { withFileTypes: true });
+    return entries
+        .filter((entry) => entry.isDirectory())
+        .map((entry) => entry.name)
+        .sort((left, right) => left.localeCompare(right));
+}
+export async function validateTenantsRoot(rootPath, schemas, env) {
+    if (!existsSync(rootPath)) {
+        throw new Error(`Configuration root not found: ${rootPath}`);
+    }
+    const tenantIds = await discoverTenantDirectories(rootPath);
+    const results = [];
+    for (const tenantId of tenantIds) {
+        results.push(await validateTenantDirectory(join(rootPath, tenantId), tenantId, schemas, env));
+    }
+    return results;
+}
+export async function validateTenantDirectory(tenantPath, tenantId, schemas, env) {
+    if (!existsSync(tenantPath)) {
+        throw new Error(`Tenant directory not found: ${tenantPath}`);
+    }
+    const state = {
+        getValidator: createValidatorFactory(schemas),
+        env,
+        errors: [],
+        resourceCounts: {},
+        files: 0,
+    };
+    for (const entry of CLI_VALIDATED_REGISTRY) {
+        if (entry.kind === "file") {
+            await validateFixedFileEntry(tenantPath, entry, state);
+        }
+        else {
+            await validateDirectoryEntry(tenantPath, entry, state);
+        }
+    }
+    return {
+        id: tenantId,
+        valid: state.errors.length === 0,
+        files: state.files,
+        errors: state.errors,
+        resourceCounts: state.resourceCounts,
+    };
+}
+function createValidatorFactory(schemas) {
+    const ajv = new Ajv2020({ allErrors: true, strict: false });
+    const validators = new Map();
+    return (schemaFile) => {
+        const cached = validators.get(schemaFile);
+        if (cached) {
+            return cached;
+        }
+        const schema = schemas.get(schemaFile);
+        if (!schema) {
+            throw new Error(`No bundled schema found for "${schemaFile}".`);
+        }
+        const validator = ajv.compile(schema);
+        validators.set(schemaFile, validator);
+        return validator;
+    };
+}
+async function validateFixedFileEntry(tenantPath, entry, state) {
+    const filePath = join(tenantPath, entry.file);
+    if (!existsSync(filePath)) {
+        if (entry.required) {
+            state.errors.push({
+                file: entry.file,
+                message: `Missing required ${entry.resourceType} file`,
+            });
+        }
+        return;
+    }
+    state.files += 1;
+    await recordValidationOutcome(filePath, entry.file, entry.resourceType, entry.schemaFile, state);
+}
+async function validateDirectoryEntry(tenantPath, entry, state) {
+    const directoryPath = join(tenantPath, entry.subfolder);
+    if (!existsSync(directoryPath)) {
+        return;
+    }
+    const dirEntries = (await readdir(directoryPath, { withFileTypes: true }))
+        .filter((dirEntry) => dirEntry.isFile() && dirEntry.name.endsWith(".json"))
+        .sort((left, right) => left.name.localeCompare(right.name));
+    for (const dirEntry of dirEntries) {
+        const relativeFile = `${entry.subfolder}/${dirEntry.name}`;
+        const filePath = join(directoryPath, dirEntry.name);
+        state.files += 1;
+        await recordValidationOutcome(filePath, relativeFile, entry.resourceType, entry.schemaFile, state);
+    }
+}
+async function recordValidationOutcome(filePath, relativeFile, resourceType, schemaFile, state) {
+    const isValid = await validateResourceFile(filePath, relativeFile, schemaFile, state.getValidator, state.env, state.errors);
+    if (isValid) {
+        state.resourceCounts[resourceType] = (state.resourceCounts[resourceType] ?? 0) + 1;
+    }
+}
+async function validateResourceFile(filePath, relativeFile, schemaFile, getValidator, env, errors) {
+    let raw;
+    try {
+        raw = await readFile(filePath, "utf8");
+    }
+    catch (error) {
+        errors.push({
+            file: relativeFile,
+            message: `Failed to read file: ${error.message}`,
+        });
+        return false;
+    }
+    let payload;
+    try {
+        payload = JSON.parse(raw);
+    }
+    catch (error) {
+        errors.push({ file: relativeFile, message: `Invalid JSON: ${error.message}` });
+        return false;
+    }
+    const errorsBefore = errors.length;
+    const resolved = resolvePlaceholders(payload, env, relativeFile, errors);
+    if (errors.length > errorsBefore) {
+        return false;
+    }
+    const validate = getValidator(schemaFile);
+    if (!validate(resolved)) {
+        for (const issue of validate.errors ?? []) {
+            errors.push({
+                file: relativeFile,
+                path: formatErrorPath(issue),
+                message: issue.message ?? "Invalid value",
+            });
+        }
+        return false;
+    }
+    return true;
+}
+function formatErrorPath(issue) {
+    const path = issue.instancePath.replace(/^\//, "").replaceAll("/", ".");
+    if (path) {
+        return path;
+    }
+    const missingProperty = issue.params
+        ?.missingProperty;
+    return missingProperty;
+}
+/**
+ * Resolves ${VAR} / ${VAR:default} placeholders for schema validation without ever
+ * emitting resolved secret values in error output; unresolved required placeholders
+ * are reported by reference to their variable name only.
+ */
+function resolvePlaceholders(value, env, file, errors) {
+    if (typeof value === "string") {
+        return value.replace(PLACEHOLDER_PATTERN, (match, varName, defaultValue) => {
+            const envValue = env[varName];
+            if (envValue !== undefined && envValue !== "") {
+                return envValue;
+            }
+            if (defaultValue !== undefined) {
+                return defaultValue;
+            }
+            errors.push({
+                file,
+                message: `Unresolved placeholder \${${varName}}: no environment value or default is available`,
+            });
+            return match;
+        });
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => resolvePlaceholders(item, env, file, errors));
+    }
+    if (value && typeof value === "object") {
+        const result = {};
+        for (const [key, val] of Object.entries(value)) {
+            result[key] = resolvePlaceholders(val, env, file, errors);
+        }
+        return result;
+    }
+    return value;
+}
+//# sourceMappingURL=validator.js.map