@xemahq/xema 0.12.0 → 0.14.0

package/dist/runtime/installation/support-bundle.js

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSupportBundle = createSupportBundle;
+exports.writeSupportBundle = writeSupportBundle;
+exports.verifySupportBundle = verifySupportBundle;
+exports.redactSupportValue = redactSupportValue;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const serialization_1 = require("./serialization");
+const url_security_1 = require("../secrets/url-security");
+function createSupportBundle(config, desiredPlan, status, createdAt = new Date().toISOString()) {
+    const payload = {
+        config: redactSupportValue(config),
+        desiredPlan: redactSupportValue(desiredPlan),
+        status,
+        logMetadata: {
+            includedContent: false,
+            workloads: status.observed.workloads,
+        },
+    };
+    return {
+        schemaVersion: 1,
+        createdAt,
+        payload,
+        manifest: {
+            algorithm: 'sha256',
+            payloadHash: (0, serialization_1.hashInstallation)(payload),
+        },
+    };
+}
+function writeSupportBundle(outputPath, bundle, opts = {}) {
+    const directory = (0, node_path_1.dirname)(outputPath);
+    (0, node_fs_1.mkdirSync)(directory, { recursive: true, mode: 0o700 });
+    const temporary = (0, node_path_1.join)(directory, `.support-bundle.${String(process.pid)}.${Date.now().toString(36)}.tmp`);
+    const fd = (0, node_fs_1.openSync)(temporary, 'wx', 0o600);
+    try {
+        (0, node_fs_1.writeFileSync)(fd, `${(0, serialization_1.serializeInstallation)(bundle)}\n`, 'utf8');
+        (0, node_fs_1.fsyncSync)(fd);
+    }
+    finally {
+        (0, node_fs_1.closeSync)(fd);
+    }
+    try {
+        if (opts.overwrite === true) {
+            (0, node_fs_1.renameSync)(temporary, outputPath);
+        }
+        else {
+            try {
+                (0, node_fs_1.linkSync)(temporary, outputPath);
+            }
+            catch (error) {
+                if (error.code === 'EEXIST') {
+                    throw new Error(`Support bundle output already exists at ${outputPath}; pass --force to replace it.`);
+                }
+                throw error;
+            }
+            (0, node_fs_1.rmSync)(temporary);
+        }
+        const directoryFd = (0, node_fs_1.openSync)(directory, 'r');
+        try {
+            (0, node_fs_1.fsyncSync)(directoryFd);
+        }
+        finally {
+            (0, node_fs_1.closeSync)(directoryFd);
+        }
+    }
+    catch (error) {
+        (0, node_fs_1.rmSync)(temporary, { force: true });
+        throw error;
+    }
+}
+function verifySupportBundle(bundle) {
+    return bundle.manifest.payloadHash === (0, serialization_1.hashInstallation)(bundle.payload);
+}
+function redactSupportValue(value, parentKey = '') {
+    if (typeof value === 'string') {
+        if (parentKey === 'locator' ||
+            parentKey === 'env' ||
+            parentKey === 'path') {
+            return '<redacted-reference>';
+        }
+        return redactUrlCredentials(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map((entry) => redactSupportValue(entry, parentKey));
+    }
+    if (value === null || typeof value !== 'object') {
+        return value;
+    }
+    return Object.fromEntries(Object.entries(value).map(([key, child]) => [
+        key,
+        sensitiveKey(key) ? '<redacted>' : redactSupportValue(child, key),
+    ]));
+}
+function sensitiveKey(key) {
+    if (/^secretRefs?$/i.test(key) || key === 'secrets') {
+        return false;
+    }
+    return (0, url_security_1.isSensitiveCredentialKey)(key);
+}
+function redactUrlCredentials(value) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return value;
+    }
+    let redacted = false;
+    if (parsed.username.length > 0) {
+        parsed.username = '<redacted>';
+        redacted = true;
+    }
+    if (parsed.password.length > 0) {
+        parsed.password = '<redacted>';
+        redacted = true;
+    }
+    for (const key of [...parsed.searchParams.keys()]) {
+        if (sensitiveKey(key)) {
+            parsed.searchParams.set(key, '<redacted>');
+            redacted = true;
+        }
+    }
+    if (!redacted) {
+        return value;
+    }
+    parsed.hash = '';
+    return parsed.toString();
+}
+//# sourceMappingURL=support-bundle.js.map

package/dist/runtime/installation/support-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"support-bundle.js","sourceRoot":"","sources":["../../../src/runtime/installation/support-bundle.ts"],"names":[],"mappings":";;AAwCA,kDAwBC;AAED,gDA4CC;AAED,kDAIC;AAED,gDAyBC;AA/ID,qCASiB;AACjB,yCAA0C;AAE1C,mDAA0E;AAC1E,0DAAmE;AA2BnE,SAAgB,mBAAmB,CACjC,MAAkB,EAClB,WAAqC,EACrC,MAAgC,EAChC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAEpC,MAAM,OAAO,GAAyC;QACpD,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC;QAClC,WAAW,EAAE,kBAAkB,CAAC,WAAW,CAAC;QAC5C,MAAM;QACN,WAAW,EAAE;YACX,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;SACrC;KACF,CAAC;IACF,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,SAAS;QACT,OAAO;QACP,QAAQ,EAAE;YACR,SAAS,EAAE,QAAQ;YACnB,WAAW,EAAE,IAAA,gCAAgB,EAAC,OAAO,CAAC;SACvC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,kBAAkB,CAChC,UAAkB,EAClB,MAAiC,EACjC,OAA0C,EAAE;IAE5C,MAAM,SAAS,GAAG,IAAA,mBAAO,EAAC,UAAU,CAAC,CAAC;IACtC,IAAA,mBAAS,EAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,IAAA,gBAAI,EACpB,SAAS,EACT,mBAAmB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CACxE,CAAC;IACF,MAAM,EAAE,GAAG,IAAA,kBAAQ,EAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,IAAA,uBAAa,EAAC,EAAE,EAAE,GAAG,IAAA,qCAAqB,EAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChE,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,IAAA,oBAAU,EAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,IAAA,kBAAQ,EAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACvD,MAAM,IAAI,KAAK,CACb,2CAA2C,UAAU,+BAA+B,CACrF,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAA,gBAAM,EAAC,SAAS,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,WAAW,GAAG,IAAA,kBAAQ,EAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,IAAA,mBAAS,EAAC,WAAW,CAAC,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,IAAA,mBAAS,EAAC,WAAW,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAA,gBAAM,EAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,mBAAmB,CACjC,MAAiC;IAEjC,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,KAAK,IAAA,gCAAgB,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED,SAAgB,kBAAkB,CAAC,KAAc,EAAE,SAAS,GAAG,EAAE;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IACE,SAAS,KAAK,SAAS;YACvB,SAAS,KAAK,KAAK;YACnB,SAAS,KAAK,MAAM,EACpB,CAAC;YACD,OAAO,sBAAsB,CAAC;QAChC,CAAC;QACD,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAA0C,CAAC,CAAC,GAAG,CAC5D,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAChB,GAAG;QACH,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC;KAClE,CACF,CACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAA,uCAAwB,EAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAQ,GAAG,YAAY,CAAC;QAC/B,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAQ,GAAG,YAAY,CAAC;QAC/B,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAClD,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAC3C,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;IACjB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC"}

package/dist/runtime/installation/validation.d.ts

@@ -0,0 +1,8 @@
+import { type ParsedXemaInstallation } from './contract';
+import { type InstallationIssue } from './diagnostics';
+export interface InstallationValidation {
+    readonly installation?: ParsedXemaInstallation;
+    readonly issues: readonly InstallationIssue[];
+}
+export declare function validateXemaInstallation(raw: unknown): InstallationValidation;
+//# sourceMappingURL=validation.d.ts.map

package/dist/runtime/installation/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/runtime/installation/validation.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAO9E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC;IAC/C,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC/C;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,CA2B7E"}

package/dist/runtime/installation/validation.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateXemaInstallation = validateXemaInstallation;
+const zod_1 = require("zod");
+const contract_1 = require("./contract");
+const diagnostics_1 = require("./diagnostics");
+const common_1 = require("./validators/common");
+const infrastructure_1 = require("./validators/infrastructure");
+const operational_1 = require("./validators/operational");
+const profile_1 = require("./validators/profile");
+const secrets_1 = require("./validators/secrets");
+function validateXemaInstallation(raw) {
+    let installation;
+    try {
+        installation = contract_1.XemaInstallationSchema.parse(raw);
+    }
+    catch (error) {
+        if (!(error instanceof zod_1.ZodError)) {
+            throw error;
+        }
+        return {
+            issues: error.issues.map((issue) => ({
+                kind: diagnostics_1.InstallationIssueKind.Invalid,
+                code: 'SCHEMA_INVALID',
+                path: issue.path.join('.'),
+                message: issue.message,
+            })),
+        };
+    }
+    const issues = [
+        ...(0, common_1.validateUniqueEntries)(installation),
+        ...(0, infrastructure_1.validateInfrastructure)(installation),
+        ...(0, secrets_1.validateSecretReferences)(installation),
+        ...(0, profile_1.validateProfile)(installation),
+        ...(0, operational_1.validateOperationalPolicy)(installation),
+    ];
+    return { installation, issues };
+}
+//# sourceMappingURL=validation.js.map

package/dist/runtime/installation/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../src/runtime/installation/validation.ts"],"names":[],"mappings":";;AAkBA,4DA2BC;AA7CD,6BAA+B;AAE/B,yCAGoB;AACpB,+CAA8E;AAC9E,gDAA4D;AAC5D,gEAAqE;AACrE,0DAAqE;AACrE,kDAAuD;AACvD,kDAAgE;AAOhE,SAAgB,wBAAwB,CAAC,GAAY;IACnD,IAAI,YAAoC,CAAC;IACzC,IAAI,CAAC;QACH,YAAY,GAAG,iCAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,cAAQ,CAAC,EAAE,CAAC;YACjC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACnC,IAAI,EAAE,mCAAqB,CAAC,OAAO;gBACnC,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG;QACb,GAAG,IAAA,8BAAqB,EAAC,YAAY,CAAC;QACtC,GAAG,IAAA,uCAAsB,EAAC,YAAY,CAAC;QACvC,GAAG,IAAA,kCAAwB,EAAC,YAAY,CAAC;QACzC,GAAG,IAAA,yBAAe,EAAC,YAAY,CAAC;QAChC,GAAG,IAAA,uCAAyB,EAAC,YAAY,CAAC;KAC3C,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC"}

package/dist/runtime/installation/validators/common.d.ts

@@ -0,0 +1,4 @@
+import { type InstallationIssue } from '../diagnostics';
+import type { ParsedXemaInstallation } from '../contract';
+export declare function validateUniqueEntries(installation: ParsedXemaInstallation): readonly InstallationIssue[];
+//# sourceMappingURL=common.d.ts.map

package/dist/runtime/installation/validators/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,sBAAsB,GACnC,SAAS,iBAAiB,EAAE,CAyB9B"}

package/dist/runtime/installation/validators/common.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateUniqueEntries = validateUniqueEntries;
+const diagnostics_1 = require("../diagnostics");
+function validateUniqueEntries(installation) {
+    return [
+        ...duplicateIssues(installation.infrastructure.map((binding) => binding.component), 'infrastructure', 'DUPLICATE_INFRASTRUCTURE_COMPONENT'),
+        ...duplicateIssues(installation.secrets.map((secret) => secret.name), 'secrets', 'DUPLICATE_SECRET_REFERENCE'),
+        ...duplicateIssues(installation.domains.map((domain) => `${domain.purpose}:${domain.hostname}`), 'domains', 'DUPLICATE_DOMAIN'),
+        ...duplicateIssues(installation.deployment.regions ?? [], 'deployment.regions', 'DUPLICATE_REGION'),
+    ];
+}
+function duplicateIssues(values, path, code) {
+    const seen = new Set();
+    const duplicates = new Set();
+    for (const value of values) {
+        if (seen.has(value)) {
+            duplicates.add(value);
+        }
+        seen.add(value);
+    }
+    return [...duplicates].sort().map((value) => ({
+        kind: diagnostics_1.InstallationIssueKind.Invalid,
+        code,
+        path,
+        message: `contains duplicate entry "${value}"`,
+    }));
+}
+//# sourceMappingURL=common.js.map

package/dist/runtime/installation/validators/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/common.ts"],"names":[],"mappings":";;AAIA,sDA2BC;AA/BD,gDAA+E;AAI/E,SAAgB,qBAAqB,CACnC,YAAoC;IAEpC,OAAO;QACL,GAAG,eAAe,CAChB,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAC/D,gBAAgB,EAChB,oCAAoC,CACrC;QACD,GAAG,eAAe,CAChB,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EACjD,SAAS,EACT,4BAA4B,CAC7B;QACD,GAAG,eAAe,CAChB,YAAY,CAAC,OAAO,CAAC,GAAG,CACtB,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CACnD,EACD,SAAS,EACT,kBAAkB,CACnB;QACD,GAAG,eAAe,CAChB,YAAY,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,EACrC,oBAAoB,EACpB,kBAAkB,CACnB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,MAAyB,EACzB,IAAY,EACZ,IAAY;IAEZ,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI,EAAE,mCAAqB,CAAC,OAAO;QACnC,IAAI;QACJ,IAAI;QACJ,OAAO,EAAE,6BAA6B,KAAK,GAAG;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/runtime/installation/validators/infrastructure.d.ts

@@ -0,0 +1,4 @@
+import { type InstallationIssue } from '../diagnostics';
+import type { ParsedXemaInstallation } from '../contract';
+export declare function validateInfrastructure(installation: ParsedXemaInstallation): readonly InstallationIssue[];
+//# sourceMappingURL=infrastructure.d.ts.map

package/dist/runtime/installation/validators/infrastructure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infrastructure.d.ts","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/infrastructure.ts"],"names":[],"mappings":"AAGA,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,sBAAsB,GACnC,SAAS,iBAAiB,EAAE,CAuD9B"}

package/dist/runtime/installation/validators/infrastructure.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateInfrastructure = validateInfrastructure;
+const schema_1 = require("../../config/schema");
+const infra_catalog_1 = require("../../infra/infra-catalog");
+const url_security_1 = require("../../secrets/url-security");
+const diagnostics_1 = require("../diagnostics");
+function validateInfrastructure(installation) {
+    const issues = [];
+    for (const binding of installation.infrastructure) {
+        const path = `infrastructure.${binding.component}`;
+        if (binding.ownership === schema_1.InfraMode.External &&
+            binding.endpoint === undefined) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Unresolved,
+                code: 'EXTERNAL_ENDPOINT_REQUIRED',
+                path: `${path}.endpoint`,
+                message: 'external infrastructure requires an endpoint',
+            });
+        }
+        if (binding.component === schema_1.InfraComponent.Postgres &&
+            binding.ownership === schema_1.InfraMode.External &&
+            binding.secretRefs.length !== 1) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Unresolved,
+                code: 'POSTGRES_SECRET_REFERENCE_REQUIRED',
+                path: `${path}.secretRefs`,
+                message: 'external PostgreSQL requires exactly one password secret reference',
+            });
+        }
+        if (binding.ownership !== schema_1.InfraMode.External &&
+            binding.endpoint !== undefined) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Invalid,
+                code: 'ENDPOINT_NOT_ALLOWED',
+                path: `${path}.endpoint`,
+                message: `endpoint is not allowed for ${binding.ownership} infrastructure`,
+            });
+        }
+        if (binding.ownership === schema_1.InfraMode.Disabled &&
+            infra_catalog_1.INFRA_CATALOG[binding.component].mandatory) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Invalid,
+                code: 'MANDATORY_INFRASTRUCTURE_DISABLED',
+                path: `${path}.ownership`,
+                message: 'mandatory infrastructure cannot be disabled',
+            });
+        }
+        if (binding.endpoint !== undefined) {
+            validateEndpoint(binding.endpoint, `${path}.endpoint`, issues);
+        }
+    }
+    return issues;
+}
+function validateEndpoint(endpoint, path, issues) {
+    let parsed;
+    try {
+        parsed = new URL(endpoint);
+    }
+    catch {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'ENDPOINT_INVALID',
+            path,
+            message: 'must be an absolute URL',
+        });
+        return;
+    }
+    if ((0, url_security_1.urlContainsCredentialMaterial)(parsed)) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'SECRET_VALUE_IN_ENDPOINT',
+            path,
+            message: 'must reference credentials through secretRefs, never inline values',
+        });
+    }
+}
+//# sourceMappingURL=infrastructure.js.map

package/dist/runtime/installation/validators/infrastructure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infrastructure.js","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/infrastructure.ts"],"names":[],"mappings":";;AAOA,wDAyDC;AAhED,gDAAgE;AAChE,6DAA0D;AAC1D,6DAA2E;AAC3E,gDAA+E;AAI/E,SAAgB,sBAAsB,CACpC,YAAoC;IAEpC,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,cAAc,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,kBAAkB,OAAO,CAAC,SAAS,EAAE,CAAC;QACnD,IACE,OAAO,CAAC,SAAS,KAAK,kBAAS,CAAC,QAAQ;YACxC,OAAO,CAAC,QAAQ,KAAK,SAAS,EAC9B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,UAAU;gBACtC,IAAI,EAAE,4BAA4B;gBAClC,IAAI,EAAE,GAAG,IAAI,WAAW;gBACxB,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;QACD,IACE,OAAO,CAAC,SAAS,KAAK,uBAAc,CAAC,QAAQ;YAC7C,OAAO,CAAC,SAAS,KAAK,kBAAS,CAAC,QAAQ;YACxC,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAC/B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,UAAU;gBACtC,IAAI,EAAE,oCAAoC;gBAC1C,IAAI,EAAE,GAAG,IAAI,aAAa;gBAC1B,OAAO,EACL,oEAAoE;aACvE,CAAC,CAAC;QACL,CAAC;QACD,IACE,OAAO,CAAC,SAAS,KAAK,kBAAS,CAAC,QAAQ;YACxC,OAAO,CAAC,QAAQ,KAAK,SAAS,EAC9B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;gBACnC,IAAI,EAAE,sBAAsB;gBAC5B,IAAI,EAAE,GAAG,IAAI,WAAW;gBACxB,OAAO,EAAE,+BAA+B,OAAO,CAAC,SAAS,iBAAiB;aAC3E,CAAC,CAAC;QACL,CAAC;QACD,IACE,OAAO,CAAC,SAAS,KAAK,kBAAS,CAAC,QAAQ;YACxC,6BAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,SAAS,EAC1C,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;gBACnC,IAAI,EAAE,mCAAmC;gBACzC,IAAI,EAAE,GAAG,IAAI,YAAY;gBACzB,OAAO,EAAE,6CAA6C;aACvD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,WAAW,EAAE,MAAM,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAgB,EAChB,IAAY,EACZ,MAA2B;IAE3B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,kBAAkB;YACxB,IAAI;YACJ,OAAO,EAAE,yBAAyB;SACnC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,IAAA,4CAA6B,EAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,0BAA0B;YAChC,IAAI;YACJ,OAAO,EACL,oEAAoE;SACvE,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/runtime/installation/validators/operational.d.ts

@@ -0,0 +1,4 @@
+import { type ParsedXemaInstallation } from '../contract';
+import { type InstallationIssue } from '../diagnostics';
+export declare function validateOperationalPolicy(installation: ParsedXemaInstallation): readonly InstallationIssue[];
+//# sourceMappingURL=operational.d.ts.map

package/dist/runtime/installation/validators/operational.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operational.d.ts","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/operational.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,sBAAsB,EAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE/E,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,sBAAsB,GACnC,SAAS,iBAAiB,EAAE,CAM9B"}

package/dist/runtime/installation/validators/operational.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateOperationalPolicy = validateOperationalPolicy;
+const contract_1 = require("../contract");
+const diagnostics_1 = require("../diagnostics");
+function validateOperationalPolicy(installation) {
+    return [
+        ...validateStorage(installation),
+        ...validateCapacity(installation),
+        ...validateUpgrade(installation),
+    ];
+}
+function validateStorage(installation) {
+    const issues = [];
+    if (installation.storage.class === contract_1.StorageClass.External &&
+        installation.storage.externalBinding === undefined) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Unresolved,
+            code: 'EXTERNAL_STORAGE_BINDING_REQUIRED',
+            path: 'storage.externalBinding',
+            message: 'external storage requires a binding reference',
+        });
+    }
+    if (installation.storage.class !== contract_1.StorageClass.External &&
+        installation.storage.externalBinding !== undefined) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'EXTERNAL_STORAGE_BINDING_NOT_ALLOWED',
+            path: 'storage.externalBinding',
+            message: 'externalBinding is only valid for external storage',
+        });
+    }
+    if (installation.storage.backup.mode === contract_1.BackupMode.Disabled &&
+        installation.storage.backup.destinationSecretRef !== undefined) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'BACKUP_DESTINATION_NOT_ALLOWED',
+            path: 'storage.backup.destinationSecretRef',
+            message: 'a disabled backup policy cannot declare a destination',
+        });
+    }
+    if (installation.deployment.profile ===
+        contract_1.InstallationDeploymentProfile.Regulated &&
+        installation.storage.backup.mode !== undefined &&
+        installation.storage.backup.mode !== contract_1.BackupMode.Continuous) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'REGULATED_BACKUP_REQUIRED',
+            path: 'storage.backup.mode',
+            message: 'regulated installations require continuous backup',
+        });
+    }
+    if (installation.deployment.profile ===
+        contract_1.InstallationDeploymentProfile.Regulated &&
+        installation.domains.some((domain) => domain.tls.mode === contract_1.TlsMode.Disabled)) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'REGULATED_TLS_REQUIRED',
+            path: 'domains',
+            message: 'regulated installation domains require TLS',
+        });
+    }
+    for (const domain of installation.domains) {
+        const path = `domains.${domain.purpose}.${domain.hostname}.tls.secretRef`;
+        if (domain.tls.mode === contract_1.TlsMode.External &&
+            domain.tls.secretRef === undefined) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Unresolved,
+                code: 'EXTERNAL_TLS_SECRET_REQUIRED',
+                path,
+                message: 'external TLS requires a certificate secret reference',
+            });
+        }
+        if (domain.tls.mode !== contract_1.TlsMode.External &&
+            domain.tls.secretRef !== undefined) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Invalid,
+                code: 'TLS_SECRET_NOT_ALLOWED',
+                path,
+                message: `a ${domain.tls.mode} TLS policy cannot declare an external certificate secret`,
+            });
+        }
+    }
+    return issues;
+}
+function validateCapacity(installation) {
+    const { minReplicas, maxReplicas } = installation.capacity;
+    if (minReplicas !== undefined &&
+        maxReplicas !== undefined &&
+        minReplicas > maxReplicas) {
+        return [
+            {
+                kind: diagnostics_1.InstallationIssueKind.Invalid,
+                code: 'CAPACITY_RANGE_INVALID',
+                path: 'capacity',
+                message: 'minReplicas cannot exceed maxReplicas',
+            },
+        ];
+    }
+    return [];
+}
+function validateUpgrade(installation) {
+    const { channel, releaseRef } = installation.upgrade;
+    if (channel === contract_1.UpgradeChannel.Pinned && releaseRef === undefined) {
+        return [
+            {
+                kind: diagnostics_1.InstallationIssueKind.Unresolved,
+                code: 'PINNED_RELEASE_REQUIRED',
+                path: 'upgrade.releaseRef',
+                message: 'pinned upgrade channel requires a releaseRef',
+            },
+        ];
+    }
+    if (channel !== contract_1.UpgradeChannel.Pinned && releaseRef !== undefined) {
+        return [
+            {
+                kind: diagnostics_1.InstallationIssueKind.Invalid,
+                code: 'RELEASE_REF_NOT_ALLOWED',
+                path: 'upgrade.releaseRef',
+                message: 'releaseRef is only valid for the pinned upgrade channel',
+            },
+        ];
+    }
+    return [];
+}
+//# sourceMappingURL=operational.js.map

package/dist/runtime/installation/validators/operational.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operational.js","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/operational.ts"],"names":[],"mappings":";;AAUA,8DAQC;AAlBD,0CAOqB;AACrB,gDAA+E;AAE/E,SAAgB,yBAAyB,CACvC,YAAoC;IAEpC,OAAO;QACL,GAAG,eAAe,CAAC,YAAY,CAAC;QAChC,GAAG,gBAAgB,CAAC,YAAY,CAAC;QACjC,GAAG,eAAe,CAAC,YAAY,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,YAAoC;IAEpC,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IACE,YAAY,CAAC,OAAO,CAAC,KAAK,KAAK,uBAAY,CAAC,QAAQ;QACpD,YAAY,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,EAClD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,UAAU;YACtC,IAAI,EAAE,mCAAmC;YACzC,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,+CAA+C;SACzD,CAAC,CAAC;IACL,CAAC;IACD,IACE,YAAY,CAAC,OAAO,CAAC,KAAK,KAAK,uBAAY,CAAC,QAAQ;QACpD,YAAY,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,EAClD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,sCAAsC;YAC5C,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,oDAAoD;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,IACE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,qBAAU,CAAC,QAAQ;QACxD,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,KAAK,SAAS,EAC9D,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,gCAAgC;YACtC,IAAI,EAAE,qCAAqC;YAC3C,OAAO,EAAE,uDAAuD;SACjE,CAAC,CAAC;IACL,CAAC;IACD,IACE,YAAY,CAAC,UAAU,CAAC,OAAO;QAC7B,wCAA6B,CAAC,SAAS;QACzC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;QAC9C,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,qBAAU,CAAC,UAAU,EAC1D,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,mDAAmD;SAC7D,CAAC,CAAC;IACL,CAAC;IACD,IACE,YAAY,CAAC,UAAU,CAAC,OAAO;QAC7B,wCAA6B,CAAC,SAAS;QACzC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,kBAAO,CAAC,QAAQ,CAAC,EAC3E,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,4CAA4C;SACtD,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,WAAW,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,gBAAgB,CAAC;QAC1E,IACE,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,kBAAO,CAAC,QAAQ;YACpC,MAAM,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,EAClC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,UAAU;gBACtC,IAAI,EAAE,8BAA8B;gBACpC,IAAI;gBACJ,OAAO,EAAE,sDAAsD;aAChE,CAAC,CAAC;QACL,CAAC;QACD,IACE,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,kBAAO,CAAC,QAAQ;YACpC,MAAM,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,EAClC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;gBACnC,IAAI,EAAE,wBAAwB;gBAC9B,IAAI;gBACJ,OAAO,EAAE,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,2DAA2D;aACzF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CACvB,YAAoC;IAEpC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;IAC3D,IACE,WAAW,KAAK,SAAS;QACzB,WAAW,KAAK,SAAS;QACzB,WAAW,GAAG,WAAW,EACzB,CAAC;QACD,OAAO;YACL;gBACE,IAAI,EAAE,mCAAqB,CAAC,OAAO;gBACnC,IAAI,EAAE,wBAAwB;gBAC9B,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,uCAAuC;aACjD;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CACtB,YAAoC;IAEpC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC;IACrD,IAAI,OAAO,KAAK,yBAAc,CAAC,MAAM,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAClE,OAAO;YACL;gBACE,IAAI,EAAE,mCAAqB,CAAC,UAAU;gBACtC,IAAI,EAAE,yBAAyB;gBAC/B,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,8CAA8C;aACxD;SACF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,yBAAc,CAAC,MAAM,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAClE,OAAO;YACL;gBACE,IAAI,EAAE,mCAAqB,CAAC,OAAO;gBACnC,IAAI,EAAE,yBAAyB;gBAC/B,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,yDAAyD;aACnE;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/runtime/installation/validators/profile.d.ts

@@ -0,0 +1,4 @@
+import { type ParsedXemaInstallation } from '../contract';
+import { type InstallationIssue } from '../diagnostics';
+export declare function validateProfile(installation: ParsedXemaInstallation): readonly InstallationIssue[];
+//# sourceMappingURL=profile.d.ts.map

package/dist/runtime/installation/validators/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE/E,wBAAgB,eAAe,CAC7B,YAAY,EAAE,sBAAsB,GACnC,SAAS,iBAAiB,EAAE,CA6E9B"}

package/dist/runtime/installation/validators/profile.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateProfile = validateProfile;
+const contract_1 = require("../contract");
+const diagnostics_1 = require("../diagnostics");
+function validateProfile(installation) {
+    const issues = [];
+    const { profile, substrate } = installation.deployment;
+    const regions = installation.deployment.regions ?? [];
+    if (profile === contract_1.InstallationDeploymentProfile.MultiRegion) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Unsupported,
+            code: 'MULTI_REGION_NOT_EXECUTABLE',
+            path: 'deployment.profile',
+            message: 'multi-region is accepted as declared intent but this compiler version cannot produce an executable plan',
+        });
+    }
+    if (profile === contract_1.InstallationDeploymentProfile.Developer &&
+        substrate !== undefined &&
+        substrate !== contract_1.InstallationSubstrate.Local) {
+        issues.push(profileSubstrateIssue(profile, contract_1.InstallationSubstrate.Local));
+    }
+    if (profile === contract_1.InstallationDeploymentProfile.StarterPme &&
+        substrate === contract_1.InstallationSubstrate.Cluster) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'PROFILE_SUBSTRATE_MISMATCH',
+            path: 'deployment.substrate',
+            message: 'starter-pme supports local or single-node substrate',
+        });
+    }
+    if ((profile === contract_1.InstallationDeploymentProfile.HighAvailability ||
+        profile === contract_1.InstallationDeploymentProfile.Regulated ||
+        profile === contract_1.InstallationDeploymentProfile.MultiRegion) &&
+        substrate !== undefined &&
+        substrate !== contract_1.InstallationSubstrate.Cluster) {
+        issues.push(profileSubstrateIssue(profile, contract_1.InstallationSubstrate.Cluster));
+    }
+    if (profile !== contract_1.InstallationDeploymentProfile.MultiRegion &&
+        installation.deployment.regions !== undefined &&
+        regions.length !== 1) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'PROFILE_REGION_MISMATCH',
+            path: 'deployment.regions',
+            message: `${profile} requires exactly one explicitly declared region when regions are overridden`,
+        });
+    }
+    if (profile === contract_1.InstallationDeploymentProfile.MultiRegion &&
+        regions.length > 0 &&
+        regions.length < 2) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Unresolved,
+            code: 'MULTI_REGION_REQUIRES_REGIONS',
+            path: 'deployment.regions',
+            message: 'multi-region requires at least two regions',
+        });
+    }
+    if (profile === contract_1.InstallationDeploymentProfile.Regulated &&
+        installation.tenancy.isolation === contract_1.TenantIsolation.Shared) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'REGULATED_SHARED_ISOLATION',
+            path: 'tenancy.isolation',
+            message: 'regulated installations cannot use shared tenant isolation',
+        });
+    }
+    return issues;
+}
+function profileSubstrateIssue(profile, required) {
+    return {
+        kind: diagnostics_1.InstallationIssueKind.Invalid,
+        code: 'PROFILE_SUBSTRATE_MISMATCH',
+        path: 'deployment.substrate',
+        message: `${profile} requires ${required} substrate`,
+    };
+}
+//# sourceMappingURL=profile.js.map

package/dist/runtime/installation/validators/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/profile.ts"],"names":[],"mappings":";;AAQA,0CA+EC;AAvFD,0CAKqB;AACrB,gDAA+E;AAE/E,SAAgB,eAAe,CAC7B,YAAoC;IAEpC,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,UAAU,CAAC;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC;IAEtD,IAAI,OAAO,KAAK,wCAA6B,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,WAAW;YACvC,IAAI,EAAE,6BAA6B;YACnC,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EACL,yGAAyG;SAC5G,CAAC,CAAC;IACL,CAAC;IACD,IACE,OAAO,KAAK,wCAA6B,CAAC,SAAS;QACnD,SAAS,KAAK,SAAS;QACvB,SAAS,KAAK,gCAAqB,CAAC,KAAK,EACzC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,gCAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,IACE,OAAO,KAAK,wCAA6B,CAAC,UAAU;QACpD,SAAS,KAAK,gCAAqB,CAAC,OAAO,EAC3C,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CAAC;IACL,CAAC;IACD,IACE,CAAC,OAAO,KAAK,wCAA6B,CAAC,gBAAgB;QACzD,OAAO,KAAK,wCAA6B,CAAC,SAAS;QACnD,OAAO,KAAK,wCAA6B,CAAC,WAAW,CAAC;QACxD,SAAS,KAAK,SAAS;QACvB,SAAS,KAAK,gCAAqB,CAAC,OAAO,EAC3C,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,gCAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,IACE,OAAO,KAAK,wCAA6B,CAAC,WAAW;QACrD,YAAY,CAAC,UAAU,CAAC,OAAO,KAAK,SAAS;QAC7C,OAAO,CAAC,MAAM,KAAK,CAAC,EACpB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,yBAAyB;YAC/B,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,GAAG,OAAO,8EAA8E;SAClG,CAAC,CAAC;IACL,CAAC;IACD,IACE,OAAO,KAAK,wCAA6B,CAAC,WAAW;QACrD,OAAO,CAAC,MAAM,GAAG,CAAC;QAClB,OAAO,CAAC,MAAM,GAAG,CAAC,EAClB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,UAAU;YACtC,IAAI,EAAE,+BAA+B;YACrC,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,4CAA4C;SACtD,CAAC,CAAC;IACL,CAAC;IACD,IACE,OAAO,KAAK,wCAA6B,CAAC,SAAS;QACnD,YAAY,CAAC,OAAO,CAAC,SAAS,KAAK,0BAAe,CAAC,MAAM,EACzD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,4DAA4D;SACtE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAsC,EACtC,QAA+B;IAE/B,OAAO;QACL,IAAI,EAAE,mCAAqB,CAAC,OAAO;QACnC,IAAI,EAAE,4BAA4B;QAClC,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,GAAG,OAAO,aAAa,QAAQ,YAAY;KACrD,CAAC;AACJ,CAAC"}

package/dist/runtime/installation/validators/secrets.d.ts

@@ -0,0 +1,4 @@
+import { type ParsedXemaInstallation } from '../contract';
+import { type InstallationIssue } from '../diagnostics';
+export declare function validateSecretReferences(installation: ParsedXemaInstallation): readonly InstallationIssue[];
+//# sourceMappingURL=secrets.d.ts.map

package/dist/runtime/installation/validators/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE/E,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,sBAAsB,GACnC,SAAS,iBAAiB,EAAE,CAsC9B"}