@xemahq/installation-tenancy 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,175 @@
+Xema Business Source License 1.1
+
+License text copyright (c) 2020 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+-----------------------------------------------------------------------------
+
+Parameters
+
+Licensor:  Neuralchowder Inc.
+
+Licensed Work:  Xema. The Licensed Work is (c) 2026 Neuralchowder Inc.
+
+  The Licensed Work includes, without limitation, Xema Core, Xema Runtime,
+  Xema Kernel, Xema control plane, Xema application runtime, Xema biome
+  runtime, Xema biome registry, Xema store services, Xema orchestration
+  services, Xema agents, Xema skills, Xema memory services, Xema APIs, Xema
+  user interfaces, Xema command-line tools, Xema deployment artifacts, Xema
+  templates, Xema specifications, Xema schemas, Xema manifests, Xema
+  documentation, Xema examples, and all source code, object code, binaries,
+  packages, modules, configuration files, manifests, schemas, examples,
+  templates, documentation, and derivative works included in or distributed
+  as part of the Xema software project.
+
+  The Licensed Work does not include any third-party software, libraries,
+  dependencies, packages, assets, or components that are distributed with the
+  Licensed Work but are governed by their own separate license terms. Such
+  third-party materials remain subject to their respective licenses.
+
+  A specific file, package, component, or directory may state that it is
+  governed by a different license. In that case, that specific file, package,
+  component, or directory is governed by the license expressly stated therein.
+
+Additional Use Grant:
+
+  You may make production use of the Licensed Work, provided that your use
+  does not include offering, providing, making available, distributing,
+  hosting, managing, embedding, reselling, white-labeling, sublicensing,
+  commercializing, or otherwise making the Licensed Work, or any modified
+  version or derivative work of the Licensed Work, available to Third Parties
+  as part of a Competitive Offering.
+
+The following definitions and clarifications form part of, and govern
+the interpretation of, the Additional Use Grant set out above.
+
+  1. "Production Use" means any use of the Licensed Work other than for
+     development, testing, evaluation, demonstration, experimentation,
+     benchmarking, or other non-production purposes.
+
+  2. "Affiliate" means any entity that, directly or indirectly,
+     controls, is controlled by, or is under common control with you,
+     where "control" means ownership of more than fifty percent (50%) of
+     the voting interests of the entity, or the power to direct its
+     management.
+
+  3. "Third Party" means any natural person or legal entity other than
+     you and your Affiliates.
+
+  4. "Competitive Offering" means any product or service, made available
+     to one or more Third Parties for a fee or other consideration
+     (including without limitation on a paid, subscription,
+     advertising-supported, hosted, or managed-service basis), that is
+     offered or marketed as, or that competes with, a software platform,
+     runtime, orchestration system, agent or automation system,
+     extension or distribution marketplace, or other software system
+     that provides, in substantial part, the same or substantially
+     similar capabilities as those provided by the Licensed Work. A
+     product or service is a Competitive Offering whether the Licensed
+     Work is provided in whole or in part, alone or bundled with other
+     software, and whether modified or unmodified.
+
+  5. Providing, hosting, or managing the Licensed Work for a Third Party,
+     or otherwise making the Licensed Work available to a Third Party as
+     a hosted or managed service such that the Third Party obtains the
+     principal value or functionality of the Licensed Work, is a
+     Competitive Offering and is not permitted by the Additional Use
+     Grant.
+
+  6. Subject to the foregoing, the Additional Use Grant permits you to
+     make Production Use of the Licensed Work for your own internal
+     business purposes and to build, operate, and provide your own
+     products and services to Third Parties, provided that the Licensed
+     Work itself (whether modified or unmodified) is not the product or
+     service, and is not a Competitive Offering, made available to those
+     Third Parties.
+
+  7. You may modify the Licensed Work and create derivative works for
+     any purpose permitted by this License. Any Production Use of such
+     modified or derivative works remains subject to the same
+     restrictions as the Licensed Work, including the prohibition on
+     Competitive Offerings.
+
+  8. Use of the Licensed Work by your own employees, contractors, and
+     agents, acting on your behalf and for your benefit, is not by
+     itself making the Licensed Work available to a Third Party.
+
+  9. Embedding or distributing the Licensed Work as a component of your
+     own product or service is permitted only where the Licensed Work
+     does not constitute the principal value of that product or service
+     and the product or service is not a Competitive Offering.
+
+  10. Nothing in this Additional Use Grant grants any right to use any
+      name, trademark, service mark, or logo of the Licensor or its
+      Affiliates, except as reasonably required for customary
+      attribution.
+
+  11. The rights stated in this Additional Use Grant are the maximum
+      rights granted for Production Use prior to the Change Date. Any
+      Production Use not expressly permitted requires a separate
+      commercial license from the Licensor.
+
+  12. If any provision of this Additional Use Grant is held invalid or
+      unenforceable, that provision shall be limited or eliminated to
+      the minimum extent necessary so that the remainder of this
+      Additional Use Grant, and of this License, remains in full force
+      and effect. The Licensor reserves all rights not expressly granted
+      by this License.
+
+
+Change Date:  Four years from the date the specific version of the Licensed
+  Work is first publicly released by Licensor.
+
+Change License:  Mozilla Public License, Version 2.0
+
+For information about alternative licensing arrangements, commercial
+licensing, enterprise licensing, OEM licensing, appliance licensing, managed
+service licensing, cloud provider licensing, or other commercial use of the
+Licensed Work, please contact: licensing@neuralchowder.com
+
+-----------------------------------------------------------------------------
+
+Notice
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph above
+terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works of
+the Licensed Work, are subject to this License. This License applies separately
+for each version of the Licensed Work and the Change Date may vary for each
+version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or modified
+form from a third party, the terms and conditions set forth in this License
+apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of Licensor
+or its affiliates, provided that you may use a trademark or logo of Licensor
+as expressly required by this License.
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON AN
+"AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS, EXPRESS
+OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND TITLE.

package/README.md

@@ -1,3 +1,9 @@
-# Temporary Holding Version
+# @xemahq/installation-tenancy
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The typed core of `xema installation`: the `XemaInstallationInventory` schema
+(v1) with its JSON Schema export, the generic `VersionedDocumentReader` (shared
+with the CLI config documents), and the per-backend tenancy providers that
+create, verify and delete one installation's slice of shared servers.
+
+Package code never reads `process.env`: admin connections and options are typed
+and injected by the caller.

package/dist/deployment-root/claims.d.ts

@@ -0,0 +1,8 @@
+import type { DeploymentDeclaration } from './read';
+import type { TenancySpecs } from '../installation/context';
+import type { ClaimedByBackend } from '../installation/import';
+import type { KeyBoundOnServer } from '../openbao/lifecycle';
+export declare function claimsOf(declaration: DeploymentDeclaration, specs: TenancySpecs): ClaimedByBackend;
+export declare function specsDeclared(base: TenancySpecs, declaration: DeploymentDeclaration): TenancySpecs;
+export declare function specsWithKeyBound(base: TenancySpecs, found: readonly KeyBoundOnServer[]): TenancySpecs;
+//# sourceMappingURL=claims.d.ts.map

package/dist/deployment-root/claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../src/deployment-root/claims.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAqD7D,wBAAgB,QAAQ,CAAC,WAAW,EAAE,qBAAqB,EAAE,KAAK,EAAE,YAAY,GAAG,gBAAgB,CAiDlG;AAGD,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,qBAAqB,GAAG,YAAY,CAelG;AAWD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,gBAAgB,EAAE,GAAG,YAAY,CAuBtG"}

package/dist/deployment-root/claims.js

@@ -0,0 +1,144 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.claimsOf = claimsOf;
+exports.specsDeclared = specsDeclared;
+exports.specsWithKeyBound = specsWithKeyBound;
+const identities_1 = require("../etcd/identities");
+const enums_1 = require("../inventory/enums");
+const identifiers_1 = require("../naming/identifiers");
+const installation_names_1 = require("../naming/installation-names");
+const spec_1 = require("../object-store/spec");
+const member_auth_1 = require("../openbao/member-auth");
+const member_env_1 = require("../openbao/member-env");
+const operations_1 = require("../openbao/operations");
+const errors_1 = require("../provider/errors");
+const spec_2 = require("../temporal/spec");
+function grammarClaims(specs) {
+    const claims = {};
+    const etcd = specs[enums_1.Backend.Etcd];
+    if (etcd !== undefined) {
+        claims[enums_1.Backend.Etcd] = (0, identities_1.etcdIdentities)(etcd).flatMap((i) => [
+            { kind: enums_1.EtcdResourceKind.User, name: i.subject },
+            { kind: enums_1.EtcdResourceKind.Role, name: i.subject },
+        ]);
+    }
+    const openBao = specs[enums_1.Backend.OpenBao];
+    if (openBao !== undefined) {
+        claims[enums_1.Backend.OpenBao] = [
+            { kind: enums_1.OpenBaoResourceKind.Mount, name: (0, installation_names_1.installationNames)(openBao.installation).openBaoMount },
+            { kind: enums_1.OpenBaoResourceKind.Policy, name: (0, operations_1.brokerPolicyName)(openBao.installation) },
+            { kind: enums_1.OpenBaoResourceKind.Policy, name: (0, member_env_1.memberEnvReadName)(openBao.installation) },
+            ...(openBao.memberEnvKeyBound ?? []).map((p) => ({ kind: enums_1.OpenBaoResourceKind.AuthMount, name: (0, installation_names_1.jwtMountOf)(openBao.installation, p.process) })),
+            ...(0, member_auth_1.memberEnvRoleTargets)(openBao).map((t) => ({ kind: enums_1.OpenBaoResourceKind.Role, name: `${t.authMount}/${t.role}` })),
+        ];
+    }
+    const temporal = specs[enums_1.Backend.Temporal];
+    if (temporal !== undefined) {
+        claims[enums_1.Backend.Temporal] = [
+            { kind: enums_1.TemporalResourceKind.Namespace, name: (0, installation_names_1.installationNames)(temporal.installation).temporalNamespace },
+            ...spec_2.NAMESPACE_SEARCH_ATTRIBUTES.map((a) => ({ kind: enums_1.TemporalResourceKind.SearchAttribute, name: a.name })),
+        ];
+    }
+    const openFga = specs[enums_1.Backend.OpenFga];
+    if (openFga !== undefined) {
+        claims[enums_1.Backend.OpenFga] = [{ kind: enums_1.OpenFgaResourceKind.Store, name: (0, installation_names_1.installationNames)(openFga.installation).openFgaStore }];
+    }
+    const identity = specs[enums_1.Backend.Identity];
+    if (identity !== undefined) {
+        claims[enums_1.Backend.Identity] = [
+            { kind: enums_1.IdentityResourceKind.Installation, name: identity.realm },
+            ...(openBao?.memberEnvKeyBound ?? []).map((p) => ({ kind: enums_1.IdentityResourceKind.WorkloadProcess, name: p.process })),
+        ];
+    }
+    return claims;
+}
+function claimsOf(declaration, specs) {
+    const { postgres, redisAclUsers, objectStore, keycloakRealm } = declaration;
+    const derived = grammarClaims(specs);
+    const merged = (backend, declared) => [
+        ...declared,
+        ...(derived[backend] ?? []),
+    ];
+    const kcSpec = specs[enums_1.Backend.Keycloak];
+    const storeSpec = specs[enums_1.Backend.ObjectStore];
+    return {
+        ...derived,
+        ...(postgres === undefined
+            ? {}
+            : {
+                [enums_1.Backend.Postgres]: merged(enums_1.Backend.Postgres, [
+                    { kind: enums_1.PostgresResourceKind.Role, name: postgres.appRole },
+                    { kind: enums_1.PostgresResourceKind.Role, name: postgres.provisionerRole },
+                    { kind: enums_1.PostgresResourceKind.Database, name: (0, identifiers_1.extensionTemplateName)(postgres.appRole) },
+                    ...postgres.databases.flatMap((d) => [
+                        { kind: enums_1.PostgresResourceKind.Database, name: d.name },
+                        ...d.extensions.map((e) => ({ kind: enums_1.PostgresResourceKind.Extension, name: `${d.name}/${e}` })),
+                    ]),
+                ]),
+            }),
+        ...(redisAclUsers === undefined ? {} : { [enums_1.Backend.Redis]: redisAclUsers.map((name) => ({ kind: enums_1.RedisResourceKind.AclUser, name })) }),
+        ...(objectStore === undefined
+            ? {}
+            : {
+                [enums_1.Backend.ObjectStore]: [
+                    { kind: enums_1.ObjectStoreResourceKind.User, name: objectStore.user },
+                    { kind: enums_1.ObjectStoreResourceKind.Policy, name: (0, installation_names_1.installationNames)(declaration.installation).objectStorePolicy },
+                    ...[...new Set([...objectStore.buckets, ...(storeSpec === undefined ? [] : (0, spec_1.bucketNames)(storeSpec))])].map((name) => ({
+                        kind: enums_1.ObjectStoreResourceKind.Bucket,
+                        name,
+                    })),
+                ],
+            }),
+        ...(keycloakRealm === undefined || kcSpec === undefined
+            ? {}
+            : {
+                [enums_1.Backend.Keycloak]: [
+                    { kind: enums_1.KeycloakResourceKind.Realm, name: keycloakRealm },
+                    { kind: enums_1.KeycloakResourceKind.Client, name: kcSpec.adminClientId },
+                    ...(kcSpec.bootstrapClients ?? []).map((name) => ({ kind: enums_1.KeycloakResourceKind.Client, name })),
+                    ...(kcSpec.webClient === undefined ? [] : [{ kind: enums_1.KeycloakResourceKind.Client, name: kcSpec.webClient.clientId }]),
+                ],
+            }),
+    };
+}
+function specsDeclared(base, declaration) {
+    const { postgres, objectStore, keycloakRealm } = declaration;
+    const pgBase = base[enums_1.Backend.Postgres];
+    const storeBase = base[enums_1.Backend.ObjectStore];
+    const kcBase = base[enums_1.Backend.Keycloak];
+    return {
+        ...base,
+        ...(postgres !== undefined && pgBase !== undefined
+            ? { [enums_1.Backend.Postgres]: { ...pgBase, appRole: postgres.appRole, provisionerRole: postgres.provisionerRole, databases: postgres.databases } }
+            : {}),
+        ...(objectStore !== undefined && storeBase !== undefined
+            ? { [enums_1.Backend.ObjectStore]: { ...storeBase, bucketPrefix: objectStore.bucketPrefix } }
+            : {}),
+        ...(keycloakRealm !== undefined && kcBase !== undefined ? { [enums_1.Backend.Keycloak]: { ...kcBase, realm: keycloakRealm } } : {}),
+    };
+}
+function specsWithKeyBound(base, found) {
+    const openBao = base[enums_1.Backend.OpenBao];
+    if (openBao === undefined) {
+        return base;
+    }
+    const realms = [...new Set(found.map((f) => f.realm))];
+    if (realms.length > 1) {
+        throw new errors_1.TenancyRefusalError(`the key-bound processes of ${openBao.installation} name ${String(realms.length)} identity realms (${realms.join(', ')}); one installation has one`);
+    }
+    const processes = found.map((f) => f.process);
+    const { memberEnvKeyBound: _keyBound, identityRealm: _realm, ...rest } = openBao;
+    const kubernetesReaders = (openBao.memberEnvKubernetes ?? []).map((k) => k.process);
+    const readers = openBao.memberEnvReaders.filter((r) => processes.includes(r) || kubernetesReaders.includes(r));
+    const { [enums_1.Backend.Identity]: identity, ...others } = base;
+    const realm = realms[0];
+    if (realm === undefined) {
+        return { ...others, [enums_1.Backend.OpenBao]: { ...rest, memberEnvReaders: readers } };
+    }
+    return {
+        ...others,
+        [enums_1.Backend.OpenBao]: { ...rest, memberEnvKeyBound: processes.map((process) => ({ process })), memberEnvReaders: readers, identityRealm: realm },
+        ...(identity === undefined ? {} : { [enums_1.Backend.Identity]: { ...identity, realm } }),
+    };
+}
+//# sourceMappingURL=claims.js.map

package/dist/deployment-root/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../src/deployment-root/claims.ts"],"names":[],"mappings":";;AA8EA,4BAiDC;AAGD,sCAeC;AAWD,8CAuBC;AAnLD,mDAAoD;AACpD,8CAW4B;AAC5B,uDAA8D;AAC9D,qEAA6E;AAC7E,+CAAmD;AACnD,wDAA8D;AAC9D,sDAA0D;AAC1D,sDAAyD;AACzD,+CAAyD;AACzD,2CAA+D;AAa/D,SAAS,aAAa,CAAC,KAAmB;IACxC,MAAM,MAAM,GAA6C,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,eAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,CAAC,eAAO,CAAC,IAAI,CAAC,GAAG,IAAA,2BAAc,EAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACzD,EAAE,IAAI,EAAE,wBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;YAChD,EAAE,IAAI,EAAE,wBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;SACjD,CAAU,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,eAAO,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,eAAO,CAAC,OAAO,CAAC,GAAG;YACxB,EAAE,IAAI,EAAE,2BAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,IAAA,sCAAiB,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,YAAY,EAAE;YAC/F,EAAE,IAAI,EAAE,2BAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAA,6BAAgB,EAAC,OAAO,CAAC,YAAY,CAAC,EAAE;YAClF,EAAE,IAAI,EAAE,2BAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC,YAAY,CAAC,EAAE;YACnF,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,2BAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAA,+BAAU,EAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC7I,GAAG,IAAA,kCAAoB,EAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,2BAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;SAC3G,CAAC;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,eAAO,CAAC,QAAQ,CAAC,GAAG;YACzB,EAAE,IAAI,EAAE,4BAAoB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAA,sCAAiB,EAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,iBAAiB,EAAE;YAC1G,GAAG,kCAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,4BAAoB,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;SACjG,CAAC;IACb,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,eAAO,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,eAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,2BAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,IAAA,sCAAiB,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,YAAY,EAAE,CAAU,CAAC;IACvI,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,eAAO,CAAC,QAAQ,CAAC,GAAG;YACzB,EAAE,IAAI,EAAE,4BAAoB,CAAC,YAAY,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE;YACjE,GAAG,CAAC,OAAO,EAAE,iBAAiB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,4BAAoB,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;SAC3G,CAAC;IACb,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAOD,SAAgB,QAAQ,CAAC,WAAkC,EAAE,KAAmB;IAC9E,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,WAAW,CAAC;IAC5E,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,CAAC,OAAgB,EAAE,QAAmD,EAA6C,EAAE,CAAC;QACnI,GAAG,QAAQ;QACX,GAAG,CAAE,OAAO,CAAC,OAAO,CAA2D,IAAI,EAAE,CAAC;KACvF,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,eAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,KAAK,CAAC,eAAO,CAAC,WAAW,CAAC,CAAC;IAC7C,OAAO;QACL,GAAG,OAAO;QACV,GAAG,CAAC,QAAQ,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,CAAC,eAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,eAAO,CAAC,QAAQ,EAAE;oBAC3C,EAAE,IAAI,EAAE,4BAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE;oBAC3D,EAAE,IAAI,EAAE,4BAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,eAAe,EAAE;oBACnE,EAAE,IAAI,EAAE,4BAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAA,mCAAqB,EAAC,QAAQ,CAAC,OAAO,CAAC,EAAE;oBACtF,GAAG,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;wBACnC,EAAE,IAAI,EAAE,4BAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;wBACrD,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,4BAAoB,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;qBAC/F,CAAC;iBACH,CAAC;aACH,CAAC;QACN,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,eAAO,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,yBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACrI,GAAG,CAAC,WAAW,KAAK,SAAS;YAC3B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,CAAC,eAAO,CAAC,WAAW,CAAC,EAAE;oBACrB,EAAE,IAAI,EAAE,+BAAuB,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE;oBAC9D,EAAE,IAAI,EAAE,+BAAuB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAA,sCAAiB,EAAC,WAAW,CAAC,YAAY,CAAC,CAAC,iBAAiB,EAAE;oBAE7G,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAA,kBAAW,EAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wBACnH,IAAI,EAAE,+BAAuB,CAAC,MAAM;wBACpC,IAAI;qBACL,CAAC,CAAC;iBACJ;aACF,CAAC;QACN,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;YACrD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,CAAC,eAAO,CAAC,QAAQ,CAAC,EAAE;oBAClB,EAAE,IAAI,EAAE,4BAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE;oBACzD,EAAE,IAAI,EAAE,4BAAoB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,aAAa,EAAE;oBACjE,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,4BAAoB,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC/F,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,4BAAoB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;iBACpH;aACF,CAAC;KACa,CAAC;AACxB,CAAC;AAGD,SAAgB,aAAa,CAAC,IAAkB,EAAE,WAAkC;IAClF,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,WAAW,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,eAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAO,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,eAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO;QACL,GAAG,IAAI;QACP,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;YAChD,CAAC,CAAC,EAAE,CAAC,eAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,EAAE;YAC5I,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;YACtD,CAAC,CAAC,EAAE,CAAC,eAAO,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,EAAE;YACrF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,eAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5H,CAAC;AACJ,CAAC;AAWD,SAAgB,iBAAiB,CAAC,IAAkB,EAAE,KAAkC;IACtF,MAAM,OAAO,GAAG,IAAI,CAAC,eAAO,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,OAAO,CAAC,YAAY,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACrL,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IACjF,MAAM,iBAAiB,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/G,MAAM,EAAE,CAAC,eAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,eAAO,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,CAAC;IAClF,CAAC;IACD,OAAO;QACL,GAAG,MAAM;QACT,CAAC,eAAO,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,iBAAiB,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE;QAC7I,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,eAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;KAClF,CAAC;AACJ,CAAC"}

package/dist/deployment-root/index.d.ts

@@ -0,0 +1,3 @@
+export * from './claims';
+export * from './read';
+//# sourceMappingURL=index.d.ts.map

package/dist/deployment-root/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/deployment-root/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,QAAQ,CAAC"}

package/dist/deployment-root/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./claims"), exports);
+__exportStar(require("./read"), exports);
+//# sourceMappingURL=index.js.map

package/dist/deployment-root/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/deployment-root/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,yCAAuB"}

package/dist/deployment-root/read.d.ts

@@ -0,0 +1,26 @@
+import type { TenancyEndpoints } from '../installation/context';
+export declare class DeploymentRootError extends Error {
+    constructor(message: string);
+}
+export interface DeploymentDeclaration {
+    readonly installation: string;
+    readonly kubernetesContext?: string;
+    readonly endpoints: TenancyEndpoints;
+    readonly postgres?: {
+        readonly appRole: string;
+        readonly provisionerRole: string;
+        readonly databases: readonly {
+            readonly name: string;
+            readonly extensions: readonly string[];
+        }[];
+    };
+    readonly redisAclUsers?: readonly string[];
+    readonly objectStore?: {
+        readonly user: string;
+        readonly bucketPrefix: string;
+        readonly buckets: readonly string[];
+    };
+    readonly keycloakRealm?: string;
+}
+export declare function readDeploymentRoot(root: string): DeploymentDeclaration;
+//# sourceMappingURL=read.d.ts.map

package/dist/deployment-root/read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../src/deployment-root/read.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAGD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,SAAS,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;SAAE,EAAE,CAAC;KAClG,CAAC;IACF,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IACrH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AA+DD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,CAqDtE"}

package/dist/deployment-root/read.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeploymentRootError = void 0;
+exports.readDeploymentRoot = readDeploymentRoot;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const yaml_1 = require("yaml");
+class DeploymentRootError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'DeploymentRootError';
+    }
+}
+exports.DeploymentRootError = DeploymentRootError;
+const isMapping = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+function load(root, file) {
+    const path = (0, node_path_1.join)(root, file);
+    if (!(0, node_fs_1.existsSync)(path)) {
+        return undefined;
+    }
+    const parsed = (0, yaml_1.parse)((0, node_fs_1.readFileSync)(path, 'utf8'));
+    if (!isMapping(parsed)) {
+        throw new DeploymentRootError(`${path} must be a mapping`);
+    }
+    return parsed;
+}
+function text(source, file, ...path) {
+    let at = source;
+    for (const key of path) {
+        if (!isMapping(at)) {
+            return undefined;
+        }
+        at = at[key];
+    }
+    if (at === undefined) {
+        return undefined;
+    }
+    if (typeof at !== 'string' && typeof at !== 'number') {
+        throw new DeploymentRootError(`${file}: ${path.join('.')} must be a string`);
+    }
+    return String(at);
+}
+function section(source, key) {
+    const value = source?.[key];
+    return isMapping(value) ? value : undefined;
+}
+function hostPort(source, file, key) {
+    const host = text(source, file, key, 'host');
+    const port = text(source, file, key, 'port');
+    return host === undefined || port === undefined ? undefined : `${host}:${port}`;
+}
+function endpointOfUrl(value, file, key) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new DeploymentRootError(`${file}: ${key} is not a URL`);
+    }
+    return `${url.hostname}:${url.port === '' ? (url.protocol === 'https:' ? '443' : '80') : url.port}`;
+}
+function readDeploymentRoot(root) {
+    const deployment = load(root, 'deployment.yaml');
+    const infra = load(root, 'infra.yaml');
+    const inputs = load(root, 'secret-inputs.yaml');
+    const installation = text(deployment, 'deployment.yaml', 'name');
+    if (installation === undefined) {
+        throw new DeploymentRootError(`${(0, node_path_1.join)(root, 'deployment.yaml')} has no name: the installation cannot be named`);
+    }
+    const endpoints = {};
+    const set = (backend, endpoint) => {
+        if (endpoint !== undefined) {
+            endpoints[backend] = endpoint;
+        }
+    };
+    set('postgres', hostPort(infra, 'infra.yaml', 'postgres'));
+    set('etcd', hostPort(infra, 'infra.yaml', 'etcd'));
+    set('redis', hostPort(infra, 'infra.yaml', 'redis'));
+    set('objectStore', hostPort(infra, 'infra.yaml', 'minio'));
+    set('temporal', hostPort(infra, 'infra.yaml', 'temporal'));
+    const baoAddress = text(infra, 'infra.yaml', 'hostCustody', 'openbao', 'address');
+    set('openbao', baoAddress === undefined ? undefined : endpointOfUrl(baoAddress, 'infra.yaml', 'hostCustody.openbao.address'));
+    const issuer = text(inputs, 'secret-inputs.yaml', 'keycloak', 'issuer');
+    set('keycloak', issuer === undefined ? undefined : endpointOfUrl(issuer, 'secret-inputs.yaml', 'keycloak.issuer'));
+    const pg = section(inputs, 'postgres');
+    const extensions = section(pg, 'extensions');
+    const appRole = text(inputs, 'secret-inputs.yaml', 'postgres', 'role');
+    const provisionerRole = text(inputs, 'secret-inputs.yaml', 'postgres', 'provisionerRole');
+    const databaseKeys = Object.keys(pg ?? {}).filter((k) => k.endsWith('Database')).sort();
+    const databases = databaseKeys.map((key) => {
+        const name = text(inputs, 'secret-inputs.yaml', 'postgres', key) ?? '';
+        const listed = extensions?.[key];
+        return { name, extensions: Array.isArray(listed) ? listed.map(String).sort() : [] };
+    });
+    const store = section(inputs, 'objectStore');
+    const user = text(inputs, 'secret-inputs.yaml', 'objectStore', 'accessKey');
+    const prefix = text(inputs, 'secret-inputs.yaml', 'objectStore', 'blobContainerPrefix');
+    const bundle = text(inputs, 'secret-inputs.yaml', 'objectStore', 'bundleBucket');
+    const aclUser = text(infra, 'infra.yaml', 'redis', 'fence', 'aclUser');
+    const erasureUser = text(infra, 'infra.yaml', 'redis', 'fence', 'erasureAclUser');
+    const realm = text(infra, 'infra.yaml', 'identity', 'realm');
+    return {
+        installation,
+        ...(text(deployment, 'deployment.yaml', 'k8sContext') === undefined ? {} : { kubernetesContext: text(deployment, 'deployment.yaml', 'k8sContext') }),
+        endpoints,
+        ...(appRole !== undefined && provisionerRole !== undefined ? { postgres: { appRole, provisionerRole, databases } } : {}),
+        ...(aclUser === undefined ? {} : { redisAclUsers: [aclUser, ...(erasureUser === undefined ? [] : [erasureUser])] }),
+        ...(store !== undefined && user !== undefined && prefix !== undefined
+            ? { objectStore: { user, bucketPrefix: prefix, buckets: [prefix, ...(bundle === undefined ? [] : [bundle])] } }
+            : {}),
+        ...(realm === undefined ? {} : { keycloakRealm: realm }),
+    };
+}
+//# sourceMappingURL=read.js.map

package/dist/deployment-root/read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.js","sourceRoot":"","sources":["../../src/deployment-root/read.ts"],"names":[],"mappings":";;;AA2FA,gDAqDC;AAhJD,qCAAmD;AACnD,yCAAiC;AAEjC,+BAA0C;AAK1C,MAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AALD,kDAKC;AAmBD,MAAM,SAAS,GAAG,CAAC,KAAc,EAAoB,EAAE,CACrD,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEvE,SAAS,IAAI,CAAC,IAAY,EAAE,IAAY;IACtC,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAY,IAAA,YAAS,EAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,mBAAmB,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAGD,SAAS,IAAI,CAAC,MAA2B,EAAE,IAAY,EAAE,GAAG,IAAc;IACxE,IAAI,EAAE,GAAY,MAAM,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YACnB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IACD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QACrD,MAAM,IAAI,mBAAmB,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,MAA2B,EAAE,GAAW;IACvD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,SAAS,QAAQ,CAAC,MAA2B,EAAE,IAAY,EAAE,GAAW;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;AAClF,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY,EAAE,GAAW;IAC7D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,GAAG,IAAI,KAAK,GAAG,eAAe,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;AACtG,CAAC;AAOD,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACjE,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,mBAAmB,CAAC,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,iBAAiB,CAAC,gDAAgD,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,QAA4B,EAAQ,EAAE;QAClE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,SAAS,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC;QAChC,CAAC;IACH,CAAC,CAAC;IACF,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;IAC3D,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAClF,GAAG,CAAC,SAAS,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,YAAY,EAAE,6BAA6B,CAAC,CAAC,CAAC;IAC9H,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACxE,GAAG,CAAC,UAAU,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAEnH,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAC1F,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxF,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACtF,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,aAAa,EAAE,qBAAqB,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAE7D,OAAO;QACL,YAAY;QACZ,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,YAAY,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,YAAY,CAAW,EAAE,CAAC;QAC9J,SAAS;QACT,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxH,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACnH,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;YACnE,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC/G,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;KACzD,CAAC;AACJ,CAAC"}

package/dist/etcd/apply.d.ts

@@ -0,0 +1,6 @@
+import { type EtcdAdminConnection } from './connection';
+import type { Backend } from '../inventory/enums';
+import type { InstallationSecretWriter } from '../provider/secrets';
+import type { AppliedResource, ResourceAction } from '../provider/types';
+export declare function applyEtcd(action: ResourceAction<Backend.Etcd>, connection: EtcdAdminConnection, secrets: InstallationSecretWriter): Promise<AppliedResource<Backend.Etcd>>;
+//# sourceMappingURL=apply.d.ts.map

package/dist/etcd/apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/etcd/apply.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,KAAK,mBAAmB,EAAoB,MAAM,cAAc,CAAC;AAazG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAsDzE,wBAAsB,SAAS,CAC7B,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EACpC,UAAU,EAAE,mBAAmB,EAC/B,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAiBxC"}

package/dist/etcd/apply.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyEtcd = applyEtcd;
+const connection_1 = require("./connection");
+const operations_1 = require("./operations");
+const spec_1 = require("./spec");
+const errors_1 = require("../provider/errors");
+const generate_secret_1 = require("../provider/generate-secret");
+async function applyRole(session, intent) {
+    if (!(await (0, operations_1.roleExists)(session, intent.subject))) {
+        await session.call('/v3/auth/role/add', { name: intent.subject });
+    }
+    const held = await (0, operations_1.rolePermissions)(session, intent.subject);
+    if ((0, operations_1.isExactGrant)(held, intent.permission, intent.prefix)) {
+        return;
+    }
+    if (held.length > 0) {
+        await session.call('/v3/auth/role/delete', { role: intent.subject });
+        await session.call('/v3/auth/role/add', { name: intent.subject });
+    }
+    await (0, operations_1.grantPrefix)(session, intent.subject, intent.permission, intent.prefix);
+}
+async function applyUser(session, connection, secrets, intent) {
+    const password = await secrets.ensureGenerated(intent.passwordSecret, generate_secret_1.generateSecretValue);
+    const roles = await (0, operations_1.userRoles)(session, intent.subject);
+    const foreign = (roles ?? []).filter((role) => role !== intent.subject);
+    if (foreign.length > 0) {
+        throw new errors_1.TenancyRefusalError(`refusing to change etcd user ${intent.subject}: it holds role(s) ${foreign.join(', ')}, which this installation does not manage`);
+    }
+    let created = false;
+    if (roles === undefined) {
+        await session.call('/v3/auth/user/add', { name: intent.subject, password });
+        created = true;
+    }
+    if (!(roles ?? []).includes(intent.subject)) {
+        await session.call('/v3/auth/user/grant', { user: intent.subject, role: intent.subject });
+    }
+    if (!created) {
+        try {
+            await (0, connection_1.openSession)(connection, { username: intent.subject, password });
+        }
+        catch (err) {
+            if (!(0, operations_1.isAuthenticationFailure)(err)) {
+                throw err;
+            }
+            await session.call('/v3/auth/user/changepw', { name: intent.subject, password });
+        }
+    }
+}
+async function applyEtcd(action, connection, secrets) {
+    const { intent } = action;
+    (0, spec_1.validateEtcdSpec)({ installation: intent.installation, servicesRead: true }, connection.username);
+    const session = await (0, connection_1.openSession)(connection, connection);
+    try {
+        if (intent.type === spec_1.EtcdIntentKind.Role) {
+            await applyRole(session, intent);
+        }
+        else {
+            await applyUser(session, connection, secrets, intent);
+        }
+    }
+    catch (err) {
+        if (err instanceof connection_1.EtcdRequestError && err.isPermissionDenied) {
+            throw new errors_1.TenancyRefusalError(`etcd admin ${connection.username} may not provision: ${err.detail}`);
+        }
+        throw err;
+    }
+    return action.resource;
+}
+//# sourceMappingURL=apply.js.map