@xemahq/xema 0.13.0 → 0.14.0

package/dist/runtime/installation/state-store.js

@@ -0,0 +1,257 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InstallationStateStore = void 0;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const compiler_1 = require("./compiler");
+const serialization_1 = require("./serialization");
+const PRIVATE_DIRECTORY_MODE = 0o700;
+const PRIVATE_FILE_MODE = 0o600;
+class InstallationStateStore {
+    root;
+    constructor(opts = {}) {
+        this.root = opts.root ?? (0, node_path_1.join)((0, node_os_1.homedir)(), '.xema', 'installations');
+    }
+    read(installationId) {
+        const path = this.appliedPath(installationId);
+        const directory = (0, node_path_1.dirname)(path);
+        if (!(0, node_fs_1.existsSync)(directory)) {
+            return undefined;
+        }
+        assertPrivateDirectory(directory);
+        if (!(0, node_fs_1.existsSync)(path)) {
+            return undefined;
+        }
+        const parsed = JSON.parse(readPrivateFile(path));
+        return parseAppliedState(parsed, path);
+    }
+    write(plan, appliedAt = new Date().toISOString()) {
+        const state = {
+            schemaVersion: 1,
+            appliedAt,
+            planHash: plan.planHash,
+            plan,
+        };
+        writeJsonAtomically(this.appliedPath(plan.installationId), state);
+        return state;
+    }
+    acquireApplyLock(installationId) {
+        const path = (0, node_path_1.join)(this.installationDirectory(installationId), 'apply.lock');
+        const recoveryPath = `${path}.recovery`;
+        ensurePrivateDirectory((0, node_path_1.dirname)(path));
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            const owner = {
+                pid: process.pid,
+                token: (0, node_crypto_1.randomUUID)(),
+                acquiredAt: new Date().toISOString(),
+            };
+            try {
+                writeExclusiveFile(path, owner);
+                let released = false;
+                return () => {
+                    if (!released) {
+                        assertLockOwnership(path, owner.token);
+                        released = true;
+                        (0, node_fs_1.rmSync)(path, { force: true });
+                    }
+                };
+            }
+            catch (error) {
+                const code = error.code;
+                if (code !== 'EEXIST') {
+                    throw error;
+                }
+                const existing = readLockOwner(path);
+                if (existing === undefined) {
+                    throw new Error(`Installation "${installationId}" has an unreadable apply lock at ${path}; remove it only after confirming no apply process is running.`);
+                }
+                if (processIsAlive(existing.pid)) {
+                    throw new Error(`Installation "${installationId}" is already being applied by process ${String(existing.pid)}.`);
+                }
+                const releaseRecovery = acquireRecoveryLock(recoveryPath, installationId);
+                try {
+                    const rechecked = readLockOwner(path);
+                    if (rechecked === undefined ||
+                        rechecked.token !== existing.token ||
+                        processIsAlive(rechecked.pid)) {
+                        throw new Error(`Installation "${installationId}" apply-lock ownership changed during stale-lock recovery; retry after the active apply completes.`);
+                    }
+                    (0, node_fs_1.rmSync)(path);
+                }
+                finally {
+                    releaseRecovery();
+                }
+            }
+        }
+        throw new Error(`Could not acquire the apply lock for installation "${installationId}".`);
+    }
+    appliedPath(installationId) {
+        return (0, node_path_1.join)(this.installationDirectory(installationId), 'last-applied.json');
+    }
+    installationDirectory(installationId) {
+        if (!/^[A-Za-z0-9._-]+$/.test(installationId)) {
+            throw new Error(`Installation id "${installationId}" is unsafe for local state storage.`);
+        }
+        return (0, node_path_1.join)(this.root, installationId);
+    }
+}
+exports.InstallationStateStore = InstallationStateStore;
+function parseAppliedState(value, path) {
+    if (value === null ||
+        typeof value !== 'object' ||
+        value.schemaVersion !== 1) {
+        throw new Error(`Applied installation state is invalid: ${path}`);
+    }
+    const state = value;
+    if (typeof state.appliedAt !== 'string' ||
+        !Number.isFinite(Date.parse(state.appliedAt)) ||
+        typeof state.planHash !== 'string' ||
+        !/^[a-f0-9]{64}$/.test(state.planHash) ||
+        state.plan === undefined ||
+        state.plan.planHash !== state.planHash) {
+        throw new Error(`Applied installation state is corrupt: ${path}`);
+    }
+    const { planHash: _planHash, ...planPayload } = state.plan;
+    if ((0, serialization_1.hashInstallation)(planPayload) !== state.planHash) {
+        throw new Error(`Applied installation state hash is invalid: ${path}`);
+    }
+    let plan;
+    try {
+        plan = (0, compiler_1.compileXemaInstallation)(planPayload);
+    }
+    catch {
+        throw new Error(`Applied installation state plan is invalid: ${path}`);
+    }
+    if (plan.planHash !== state.planHash) {
+        throw new Error(`Applied installation state plan is non-canonical: ${path}`);
+    }
+    return {
+        schemaVersion: 1,
+        appliedAt: state.appliedAt,
+        planHash: state.planHash,
+        plan,
+    };
+}
+function readLockOwner(path) {
+    try {
+        const value = JSON.parse(readPrivateFile(path));
+        return typeof value.pid === 'number' &&
+            Number.isInteger(value.pid) &&
+            typeof value.token === 'string' &&
+            value.token.length > 0 &&
+            typeof value.acquiredAt === 'string'
+            ? value
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function processIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+function writeJsonAtomically(path, value) {
+    const directory = (0, node_path_1.dirname)(path);
+    ensurePrivateDirectory(directory);
+    const temporary = (0, node_path_1.join)(directory, `.last-applied.${String(process.pid)}.${Date.now().toString(36)}.tmp`);
+    const fd = (0, node_fs_1.openSync)(temporary, 'wx', PRIVATE_FILE_MODE);
+    try {
+        (0, node_fs_1.writeFileSync)(fd, `${(0, serialization_1.serializeInstallation)(value)}\n`, 'utf8');
+        (0, node_fs_1.fsyncSync)(fd);
+    }
+    finally {
+        (0, node_fs_1.closeSync)(fd);
+    }
+    try {
+        (0, node_fs_1.renameSync)(temporary, path);
+        const directoryFd = (0, node_fs_1.openSync)(directory, 'r');
+        try {
+            (0, node_fs_1.fsyncSync)(directoryFd);
+        }
+        finally {
+            (0, node_fs_1.closeSync)(directoryFd);
+        }
+    }
+    catch (error) {
+        (0, node_fs_1.rmSync)(temporary, { force: true });
+        throw error;
+    }
+}
+function ensurePrivateDirectory(directory) {
+    (0, node_fs_1.mkdirSync)(directory, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });
+    assertPrivateDirectory(directory);
+}
+function assertPrivateDirectory(directory) {
+    const stat = (0, node_fs_1.lstatSync)(directory);
+    if (!stat.isDirectory() ||
+        !ownedByCurrentUser(stat.uid) ||
+        (process.platform !== 'win32' && (stat.mode & 0o077) !== 0)) {
+        throw new Error(`Installation state directory is unsafe at ${directory}; expected an installer-owned directory with mode 0700.`);
+    }
+}
+function readPrivateFile(path) {
+    let fd;
+    try {
+        fd = (0, node_fs_1.openSync)(path, node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NOFOLLOW ?? 0));
+        const stat = (0, node_fs_1.fstatSync)(fd);
+        if (!stat.isFile() ||
+            !ownedByCurrentUser(stat.uid) ||
+            (process.platform !== 'win32' && (stat.mode & 0o077) !== 0)) {
+            throw new Error(`Installation state file is unsafe at ${path}; expected an installer-owned regular file with mode 0600.`);
+        }
+        return (0, node_fs_1.readFileSync)(fd, 'utf8');
+    }
+    finally {
+        if (fd !== undefined) {
+            (0, node_fs_1.closeSync)(fd);
+        }
+    }
+}
+function writeExclusiveFile(path, value) {
+    const fd = (0, node_fs_1.openSync)(path, 'wx', PRIVATE_FILE_MODE);
+    try {
+        (0, node_fs_1.writeFileSync)(fd, `${(0, serialization_1.serializeInstallation)(value)}\n`, 'utf8');
+        (0, node_fs_1.fsyncSync)(fd);
+    }
+    finally {
+        (0, node_fs_1.closeSync)(fd);
+    }
+}
+function acquireRecoveryLock(path, installationId) {
+    const owner = {
+        pid: process.pid,
+        token: (0, node_crypto_1.randomUUID)(),
+        acquiredAt: new Date().toISOString(),
+    };
+    try {
+        writeExclusiveFile(path, owner);
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST') {
+            throw error;
+        }
+        throw new Error(`Installation "${installationId}" stale-lock recovery is already in progress. Retry after it completes.`);
+    }
+    return () => {
+        assertLockOwnership(path, owner.token);
+        (0, node_fs_1.rmSync)(path);
+    };
+}
+function assertLockOwnership(path, token) {
+    const owner = readLockOwner(path);
+    if (owner?.token !== token) {
+        throw new Error(`Installation apply lock ownership changed unexpectedly at ${path}; refusing to remove another process's lock.`);
+    }
+}
+function ownedByCurrentUser(uid) {
+    return typeof process.getuid !== 'function' || process.getuid() === uid;
+}
+//# sourceMappingURL=state-store.js.map

package/dist/runtime/installation/state-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-store.js","sourceRoot":"","sources":["../../../src/runtime/installation/state-store.ts"],"names":[],"mappings":";;;AAAA,6CAAyC;AACzC,qCAaiB;AACjB,qCAAkC;AAClC,yCAA0C;AAE1C,yCAGoB;AACpB,mDAA0E;AAmB1E,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,MAAa,sBAAsB;IAChB,IAAI,CAAS;IAE9B,YAAmB,OAAsC,EAAE;QACzD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;IACrE,CAAC;IAEM,IAAI,CAAC,cAAsB;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,IAAA,oBAAU,EAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAY,CAAC;QAC5D,OAAO,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAEM,KAAK,CACV,IAA8B,EAC9B,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAEpC,MAAM,KAAK,GAA6B;YACtC,aAAa,EAAE,CAAC;YAChB,SAAS;YACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI;SACL,CAAC;QACF,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;IAEM,gBAAgB,CAAC,cAAsB;QAC5C,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC,EAAE,YAAY,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAG,GAAG,IAAI,WAAW,CAAC;QACxC,sBAAsB,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC;QACtC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,KAAK,GAAc;gBACvB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,IAAA,wBAAU,GAAE;gBACnB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC;YACF,IAAI,CAAC;gBACH,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAChC,IAAI,QAAQ,GAAG,KAAK,CAAC;gBACrB,OAAO,GAAG,EAAE;oBACV,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;wBACvC,QAAQ,GAAG,IAAI,CAAC;wBAChB,IAAA,gBAAM,EAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBAChC,CAAC;gBACH,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;gBACnD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtB,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CACb,iBAAiB,cAAc,qCAAqC,IAAI,gEAAgE,CACzI,CAAC;gBACJ,CAAC;gBACD,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjC,MAAM,IAAI,KAAK,CACb,iBAAiB,cAAc,yCAAyC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAChG,CAAC;gBACJ,CAAC;gBACD,MAAM,eAAe,GAAG,mBAAmB,CACzC,YAAY,EACZ,cAAc,CACf,CAAC;gBACF,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;oBACtC,IACE,SAAS,KAAK,SAAS;wBACvB,SAAS,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;wBAClC,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,EAC7B,CAAC;wBACD,MAAM,IAAI,KAAK,CACb,iBAAiB,cAAc,oGAAoG,CACpI,CAAC;oBACJ,CAAC;oBACD,IAAA,gBAAM,EAAC,IAAI,CAAC,CAAC;gBACf,CAAC;wBAAS,CAAC;oBACT,eAAe,EAAE,CAAC;gBACpB,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sDAAsD,cAAc,IAAI,CACzE,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,cAAsB;QACxC,OAAO,IAAA,gBAAI,EACT,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC,EAC1C,mBAAmB,CACpB,CAAC;IACJ,CAAC;IAEO,qBAAqB,CAAC,cAAsB;QAClD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,oBAAoB,cAAc,sCAAsC,CACzE,CAAC;QACJ,CAAC;QACD,OAAO,IAAA,gBAAI,EAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACzC,CAAC;CACF;AAhHD,wDAgHC;AAED,SAAS,iBAAiB,CACxB,KAAc,EACd,IAAY;IAEZ,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACxB,KAAqC,CAAC,aAAa,KAAK,CAAC,EAC1D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,KAAK,GAAG,KAA0C,CAAC;IACzD,IACE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QACtC,KAAK,CAAC,IAAI,KAAK,SAAS;QACxB,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,WAAW,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC;IAC3D,IAAI,IAAA,gCAAgB,EAAC,WAAW,CAAC,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,+CAA+C,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,IAA8B,CAAC;IACnC,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,kCAAuB,EAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,+CAA+C,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,qDAAqD,IAAI,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI;KACL,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAuB,CAAC;QACtE,OAAO,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;YAClC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC;YAC3B,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAC/B,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YACtB,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;YACpC,CAAC,CAAE,KAAmB;YACtB,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,KAAc;IACvD,MAAM,SAAS,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC;IAChC,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAA,gBAAI,EACpB,SAAS,EACT,iBAAiB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CACtE,CAAC;IACF,MAAM,EAAE,GAAG,IAAA,kBAAQ,EAAC,SAAS,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,IAAA,uBAAa,EAAC,EAAE,EAAE,GAAG,IAAA,qCAAqB,EAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,IAAA,oBAAU,EAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,IAAA,kBAAQ,EAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,IAAA,mBAAS,EAAC,WAAW,CAAC,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,IAAA,mBAAS,EAAC,WAAW,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAA,gBAAM,EAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,SAAiB;IAC/C,IAAA,mBAAS,EAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACxE,sBAAsB,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,sBAAsB,CAAC,SAAiB;IAC/C,MAAM,IAAI,GAAG,IAAA,mBAAS,EAAC,SAAS,CAAC,CAAC;IAClC,IACE,CAAC,IAAI,CAAC,WAAW,EAAE;QACnB,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7B,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAC3D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,6CAA6C,SAAS,yDAAyD,CAChH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,IAAA,kBAAQ,EAAC,IAAI,EAAE,mBAAS,CAAC,QAAQ,GAAG,CAAC,mBAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;QAC3B,IACE,CAAC,IAAI,CAAC,MAAM,EAAE;YACd,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAC3D,CAAC;YACD,MAAM,IAAI,KAAK,CACb,wCAAwC,IAAI,4DAA4D,CACzG,CAAC;QACJ,CAAC;QACD,OAAO,IAAA,sBAAY,EAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAAc;IACtD,MAAM,EAAE,GAAG,IAAA,kBAAQ,EAAC,IAAI,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,IAAA,uBAAa,EAAC,EAAE,EAAE,GAAG,IAAA,qCAAqB,EAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,cAAsB;IAC/D,MAAM,KAAK,GAAc;QACvB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK,EAAE,IAAA,wBAAU,GAAE;QACnB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC;IACF,IAAI,CAAC;QACH,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iBAAiB,cAAc,yEAAyE,CACzG,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,EAAE;QACV,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACvC,IAAA,gBAAM,EAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,KAAa;IACtD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,KAAK,EAAE,KAAK,KAAK,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,6DAA6D,IAAI,8CAA8C,CAChH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC;AAC1E,CAAC"}

package/dist/runtime/installation/status.d.ts

@@ -0,0 +1,30 @@
+import { Substrate } from '../config/schema';
+import type { CompiledXemaInstallation } from './compiler';
+import type { InstallationStateStore } from './state-store';
+export declare enum InstallationObservedCondition {
+    Running = "running",
+    Stopped = "stopped",
+    Degraded = "degraded",
+    Unavailable = "unavailable"
+}
+export interface ObservedInstallationState {
+    readonly substrate: Substrate;
+    readonly condition: InstallationObservedCondition;
+    readonly workloads: readonly {
+        readonly name: string;
+        readonly state: string;
+    }[];
+    readonly detail?: string;
+}
+export interface InstallationStatusReport {
+    readonly installationId: string;
+    readonly desiredPlanHash: string;
+    readonly appliedPlanHash?: string;
+    readonly desiredAppliedDrift: boolean;
+    readonly observedAppliedDrift: boolean;
+    readonly observed: ObservedInstallationState;
+}
+export declare function installationStatus(desired: CompiledXemaInstallation, substrate: Substrate, store: InstallationStateStore): Promise<InstallationStatusReport>;
+export declare function installationStatusFromObserved(desired: CompiledXemaInstallation, store: InstallationStateStore, observed: ObservedInstallationState): InstallationStatusReport;
+export declare function observeInstallation(substrate: Substrate): Promise<ObservedInstallationState>;
+//# sourceMappingURL=status.d.ts.map

package/dist/runtime/installation/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/runtime/installation/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAK7C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAE5D,oBAAY,6BAA6B;IACvC,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,WAAW,gBAAgB;CAC5B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;IAClD,QAAQ,CAAC,SAAS,EAAE,SAAS;QAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,EAAE,CAAC;IACJ,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;CAC9C;AAED,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,wBAAwB,EACjC,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,wBAAwB,CAAC,CAMnC;AAED,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,wBAAwB,EACjC,KAAK,EAAE,sBAAsB,EAC7B,QAAQ,EAAE,yBAAyB,GAClC,wBAAwB,CAc1B;AAED,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,yBAAyB,CAAC,CASpC"}

package/dist/runtime/installation/status.js

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InstallationObservedCondition = void 0;
+exports.installationStatus = installationStatus;
+exports.installationStatusFromObserved = installationStatusFromObserved;
+exports.observeInstallation = observeInstallation;
+const schema_1 = require("../config/schema");
+const run_manifest_1 = require("../run-manifest");
+const docker_cli_1 = require("../runner/docker-cli");
+const helm_cli_1 = require("../runner/helm-cli");
+var InstallationObservedCondition;
+(function (InstallationObservedCondition) {
+    InstallationObservedCondition["Running"] = "running";
+    InstallationObservedCondition["Stopped"] = "stopped";
+    InstallationObservedCondition["Degraded"] = "degraded";
+    InstallationObservedCondition["Unavailable"] = "unavailable";
+})(InstallationObservedCondition || (exports.InstallationObservedCondition = InstallationObservedCondition = {}));
+async function installationStatus(desired, substrate, store) {
+    return installationStatusFromObserved(desired, store, await observeInstallation(substrate));
+}
+function installationStatusFromObserved(desired, store, observed) {
+    const applied = store.read(desired.installationId);
+    return {
+        installationId: desired.installationId,
+        desiredPlanHash: desired.planHash,
+        ...(applied === undefined ? {} : { appliedPlanHash: applied.planHash }),
+        desiredAppliedDrift: applied === undefined || applied.planHash !== desired.planHash,
+        observedAppliedDrift: applied === undefined
+            ? observed.condition !== InstallationObservedCondition.Stopped
+            : observed.condition !== InstallationObservedCondition.Running,
+        observed,
+    };
+}
+async function observeInstallation(substrate) {
+    switch (substrate) {
+        case schema_1.Substrate.Native:
+            return observeNative();
+        case schema_1.Substrate.Container:
+            return observeContainers();
+        case schema_1.Substrate.Helm:
+            return observeHelm();
+    }
+}
+function observeNative() {
+    const services = (0, run_manifest_1.readRunManifest)();
+    const workloads = services.map((service) => ({
+        name: service.name,
+        state: processIsAlive(service.pid) ? 'running' : 'stale',
+    }));
+    const running = workloads.filter((workload) => workload.state === 'running');
+    return {
+        substrate: schema_1.Substrate.Native,
+        condition: workloads.length === 0
+            ? InstallationObservedCondition.Stopped
+            : running.length === workloads.length
+                ? InstallationObservedCondition.Running
+                : InstallationObservedCondition.Degraded,
+        workloads,
+    };
+}
+async function observeContainers() {
+    const docker = new docker_cli_1.DockerCli();
+    if (!(await docker.available())) {
+        return {
+            substrate: schema_1.Substrate.Container,
+            condition: InstallationObservedCondition.Unavailable,
+            workloads: [],
+            detail: 'container runtime is not reachable',
+        };
+    }
+    const output = await docker.run([
+        'ps',
+        '-a',
+        '--filter',
+        'label=xema.launcher',
+        '--format',
+        '{{.Names}}\t{{.State}}',
+    ]);
+    const workloads = parseWorkloadLines(output);
+    return {
+        substrate: schema_1.Substrate.Container,
+        condition: conditionForWorkloads(workloads, 'running'),
+        workloads,
+    };
+}
+async function observeHelm() {
+    const helm = new helm_cli_1.HelmCli();
+    if (!(await helm.available())) {
+        return {
+            substrate: schema_1.Substrate.Helm,
+            condition: InstallationObservedCondition.Unavailable,
+            workloads: [],
+            detail: 'helm is not reachable',
+        };
+    }
+    const output = await helm.exec(['list', '-q', '--namespace', helm.namespace]);
+    const names = output
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0);
+    const workloads = names.map((name) => ({ name, state: 'deployed' }));
+    return {
+        substrate: schema_1.Substrate.Helm,
+        condition: conditionForWorkloads(workloads, 'deployed'),
+        workloads,
+    };
+}
+function parseWorkloadLines(output) {
+    return output
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0)
+        .map((line) => {
+        const [name, state] = line.split('\t');
+        if (name === undefined || state === undefined) {
+            throw new Error(`Unexpected container status row: ${line}`);
+        }
+        return { name, state };
+    });
+}
+function conditionForWorkloads(workloads, healthyState) {
+    if (workloads.length === 0) {
+        return InstallationObservedCondition.Stopped;
+    }
+    return workloads.every((workload) => workload.state === healthyState)
+        ? InstallationObservedCondition.Running
+        : InstallationObservedCondition.Degraded;
+}
+function processIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+//# sourceMappingURL=status.js.map

package/dist/runtime/installation/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/runtime/installation/status.ts"],"names":[],"mappings":";;;AAkCA,gDAUC;AAED,wEAkBC;AAED,kDAWC;AA7ED,6CAA6C;AAC7C,kDAAkD;AAClD,qDAAiD;AACjD,iDAA6C;AAK7C,IAAY,6BAKX;AALD,WAAY,6BAA6B;IACvC,oDAAmB,CAAA;IACnB,oDAAmB,CAAA;IACnB,sDAAqB,CAAA;IACrB,4DAA2B,CAAA;AAC7B,CAAC,EALW,6BAA6B,6CAA7B,6BAA6B,QAKxC;AAqBM,KAAK,UAAU,kBAAkB,CACtC,OAAiC,EACjC,SAAoB,EACpB,KAA6B;IAE7B,OAAO,8BAA8B,CACnC,OAAO,EACP,KAAK,EACL,MAAM,mBAAmB,CAAC,SAAS,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,SAAgB,8BAA8B,CAC5C,OAAiC,EACjC,KAA6B,EAC7B,QAAmC;IAEnC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACnD,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,eAAe,EAAE,OAAO,CAAC,QAAQ;QACjC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvE,mBAAmB,EACjB,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;QAChE,oBAAoB,EAClB,OAAO,KAAK,SAAS;YACnB,CAAC,CAAC,QAAQ,CAAC,SAAS,KAAK,6BAA6B,CAAC,OAAO;YAC9D,CAAC,CAAC,QAAQ,CAAC,SAAS,KAAK,6BAA6B,CAAC,OAAO;QAClE,QAAQ;KACT,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,mBAAmB,CACvC,SAAoB;IAEpB,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,kBAAS,CAAC,MAAM;YACnB,OAAO,aAAa,EAAE,CAAC;QACzB,KAAK,kBAAS,CAAC,SAAS;YACtB,OAAO,iBAAiB,EAAE,CAAC;QAC7B,KAAK,kBAAS,CAAC,IAAI;YACjB,OAAO,WAAW,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,QAAQ,GAAG,IAAA,8BAAe,GAAE,CAAC;IACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;KACzD,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC7E,OAAO;QACL,SAAS,EAAE,kBAAS,CAAC,MAAM;QAC3B,SAAS,EACP,SAAS,CAAC,MAAM,KAAK,CAAC;YACpB,CAAC,CAAC,6BAA6B,CAAC,OAAO;YACvC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;gBACnC,CAAC,CAAC,6BAA6B,CAAC,OAAO;gBACvC,CAAC,CAAC,6BAA6B,CAAC,QAAQ;QAC9C,SAAS;KACV,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB;IAC9B,MAAM,MAAM,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC/B,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,SAAS,EAAE,kBAAS,CAAC,SAAS;YAC9B,SAAS,EAAE,6BAA6B,CAAC,WAAW;YACpD,SAAS,EAAE,EAAE;YACb,MAAM,EAAE,oCAAoC;SAC7C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC;QAC9B,IAAI;QACJ,IAAI;QACJ,UAAU;QACV,qBAAqB;QACrB,UAAU;QACV,wBAAwB;KACzB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO;QACL,SAAS,EAAE,kBAAS,CAAC,SAAS;QAC9B,SAAS,EAAE,qBAAqB,CAAC,SAAS,EAAE,SAAS,CAAC;QACtD,SAAS;KACV,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,MAAM,IAAI,GAAG,IAAI,kBAAO,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,SAAS,EAAE,kBAAS,CAAC,IAAI;YACzB,SAAS,EAAE,6BAA6B,CAAC,WAAW;YACpD,SAAS,EAAE,EAAE;YACb,MAAM,EAAE,uBAAuB;SAChC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,MAAM;SACjB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO;QACL,SAAS,EAAE,kBAAS,CAAC,IAAI;QACzB,SAAS,EAAE,qBAAqB,CAAC,SAAS,EAAE,UAAU,CAAC;QACvD,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAc;IAEd,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,qBAAqB,CAC5B,SAAgD,EAChD,YAAoB;IAEpB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,6BAA6B,CAAC,OAAO,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,KAAK,YAAY,CAAC;QACnE,CAAC,CAAC,6BAA6B,CAAC,OAAO;QACvC,CAAC,CAAC,6BAA6B,CAAC,QAAQ,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3D,CAAC;AACH,CAAC"}

package/dist/runtime/installation/support-bundle.d.ts

@@ -0,0 +1,30 @@
+import type { CompiledXemaInstallation } from './compiler';
+import type { InstallationStatusReport } from './status';
+import type { XemaConfig } from '../config/schema';
+export interface InstallationSupportBundle {
+    readonly schemaVersion: 1;
+    readonly createdAt: string;
+    readonly payload: {
+        readonly config: unknown;
+        readonly desiredPlan: unknown;
+        readonly status: InstallationStatusReport;
+        readonly logMetadata: {
+            readonly includedContent: false;
+            readonly workloads: readonly {
+                readonly name: string;
+                readonly state: string;
+            }[];
+        };
+    };
+    readonly manifest: {
+        readonly algorithm: 'sha256';
+        readonly payloadHash: string;
+    };
+}
+export declare function createSupportBundle(config: XemaConfig, desiredPlan: CompiledXemaInstallation, status: InstallationStatusReport, createdAt?: string): InstallationSupportBundle;
+export declare function writeSupportBundle(outputPath: string, bundle: InstallationSupportBundle, opts?: Readonly<{
+    overwrite?: boolean;
+}>): void;
+export declare function verifySupportBundle(bundle: InstallationSupportBundle): boolean;
+export declare function redactSupportValue(value: unknown, parentKey?: string): unknown;
+//# sourceMappingURL=support-bundle.d.ts.map

package/dist/runtime/installation/support-bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"support-bundle.d.ts","sourceRoot":"","sources":["../../../src/runtime/installation/support-bundle.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;QAC9B,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;QAC1C,QAAQ,CAAC,WAAW,EAAE;YACpB,QAAQ,CAAC,eAAe,EAAE,KAAK,CAAC;YAChC,QAAQ,CAAC,SAAS,EAAE,SAAS;gBAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;aACxB,EAAE,CAAC;SACL,CAAC;KACH,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;CACH;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,wBAAwB,EACrC,MAAM,EAAE,wBAAwB,EAChC,SAAS,SAA2B,GACnC,yBAAyB,CAmB3B;AAED,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,yBAAyB,EACjC,IAAI,GAAE,QAAQ,CAAC;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,CAAM,GAC3C,IAAI,CAwCN;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAET;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,SAAK,GAAG,OAAO,CAyB1E"}

package/dist/runtime/installation/support-bundle.js

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSupportBundle = createSupportBundle;
+exports.writeSupportBundle = writeSupportBundle;
+exports.verifySupportBundle = verifySupportBundle;
+exports.redactSupportValue = redactSupportValue;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const serialization_1 = require("./serialization");
+const url_security_1 = require("../secrets/url-security");
+function createSupportBundle(config, desiredPlan, status, createdAt = new Date().toISOString()) {
+    const payload = {
+        config: redactSupportValue(config),
+        desiredPlan: redactSupportValue(desiredPlan),
+        status,
+        logMetadata: {
+            includedContent: false,
+            workloads: status.observed.workloads,
+        },
+    };
+    return {
+        schemaVersion: 1,
+        createdAt,
+        payload,
+        manifest: {
+            algorithm: 'sha256',
+            payloadHash: (0, serialization_1.hashInstallation)(payload),
+        },
+    };
+}
+function writeSupportBundle(outputPath, bundle, opts = {}) {
+    const directory = (0, node_path_1.dirname)(outputPath);
+    (0, node_fs_1.mkdirSync)(directory, { recursive: true, mode: 0o700 });
+    const temporary = (0, node_path_1.join)(directory, `.support-bundle.${String(process.pid)}.${Date.now().toString(36)}.tmp`);
+    const fd = (0, node_fs_1.openSync)(temporary, 'wx', 0o600);
+    try {
+        (0, node_fs_1.writeFileSync)(fd, `${(0, serialization_1.serializeInstallation)(bundle)}\n`, 'utf8');
+        (0, node_fs_1.fsyncSync)(fd);
+    }
+    finally {
+        (0, node_fs_1.closeSync)(fd);
+    }
+    try {
+        if (opts.overwrite === true) {
+            (0, node_fs_1.renameSync)(temporary, outputPath);
+        }
+        else {
+            try {
+                (0, node_fs_1.linkSync)(temporary, outputPath);
+            }
+            catch (error) {
+                if (error.code === 'EEXIST') {
+                    throw new Error(`Support bundle output already exists at ${outputPath}; pass --force to replace it.`);
+                }
+                throw error;
+            }
+            (0, node_fs_1.rmSync)(temporary);
+        }
+        const directoryFd = (0, node_fs_1.openSync)(directory, 'r');
+        try {
+            (0, node_fs_1.fsyncSync)(directoryFd);
+        }
+        finally {
+            (0, node_fs_1.closeSync)(directoryFd);
+        }
+    }
+    catch (error) {
+        (0, node_fs_1.rmSync)(temporary, { force: true });
+        throw error;
+    }
+}
+function verifySupportBundle(bundle) {
+    return bundle.manifest.payloadHash === (0, serialization_1.hashInstallation)(bundle.payload);
+}
+function redactSupportValue(value, parentKey = '') {
+    if (typeof value === 'string') {
+        if (parentKey === 'locator' ||
+            parentKey === 'env' ||
+            parentKey === 'path') {
+            return '<redacted-reference>';
+        }
+        return redactUrlCredentials(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map((entry) => redactSupportValue(entry, parentKey));
+    }
+    if (value === null || typeof value !== 'object') {
+        return value;
+    }
+    return Object.fromEntries(Object.entries(value).map(([key, child]) => [
+        key,
+        sensitiveKey(key) ? '<redacted>' : redactSupportValue(child, key),
+    ]));
+}
+function sensitiveKey(key) {
+    if (/^secretRefs?$/i.test(key) || key === 'secrets') {
+        return false;
+    }
+    return (0, url_security_1.isSensitiveCredentialKey)(key);
+}
+function redactUrlCredentials(value) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return value;
+    }
+    let redacted = false;
+    if (parsed.username.length > 0) {
+        parsed.username = '<redacted>';
+        redacted = true;
+    }
+    if (parsed.password.length > 0) {
+        parsed.password = '<redacted>';
+        redacted = true;
+    }
+    for (const key of [...parsed.searchParams.keys()]) {
+        if (sensitiveKey(key)) {
+            parsed.searchParams.set(key, '<redacted>');
+            redacted = true;
+        }
+    }
+    if (!redacted) {
+        return value;
+    }
+    parsed.hash = '';
+    return parsed.toString();
+}
+//# sourceMappingURL=support-bundle.js.map

package/dist/runtime/installation/support-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"support-bundle.js","sourceRoot":"","sources":["../../../src/runtime/installation/support-bundle.ts"],"names":[],"mappings":";;AAwCA,kDAwBC;AAED,gDA4CC;AAED,kDAIC;AAED,gDAyBC;AA/ID,qCASiB;AACjB,yCAA0C;AAE1C,mDAA0E;AAC1E,0DAAmE;AA2BnE,SAAgB,mBAAmB,CACjC,MAAkB,EAClB,WAAqC,EACrC,MAAgC,EAChC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAEpC,MAAM,OAAO,GAAyC;QACpD,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC;QAClC,WAAW,EAAE,kBAAkB,CAAC,WAAW,CAAC;QAC5C,MAAM;QACN,WAAW,EAAE;YACX,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;SACrC;KACF,CAAC;IACF,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,SAAS;QACT,OAAO;QACP,QAAQ,EAAE;YACR,SAAS,EAAE,QAAQ;YACnB,WAAW,EAAE,IAAA,gCAAgB,EAAC,OAAO,CAAC;SACvC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,kBAAkB,CAChC,UAAkB,EAClB,MAAiC,EACjC,OAA0C,EAAE;IAE5C,MAAM,SAAS,GAAG,IAAA,mBAAO,EAAC,UAAU,CAAC,CAAC;IACtC,IAAA,mBAAS,EAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,IAAA,gBAAI,EACpB,SAAS,EACT,mBAAmB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CACxE,CAAC;IACF,MAAM,EAAE,GAAG,IAAA,kBAAQ,EAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,IAAA,uBAAa,EAAC,EAAE,EAAE,GAAG,IAAA,qCAAqB,EAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChE,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,IAAA,oBAAU,EAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,IAAA,kBAAQ,EAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACvD,MAAM,IAAI,KAAK,CACb,2CAA2C,UAAU,+BAA+B,CACrF,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAA,gBAAM,EAAC,SAAS,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,WAAW,GAAG,IAAA,kBAAQ,EAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,IAAA,mBAAS,EAAC,WAAW,CAAC,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,IAAA,mBAAS,EAAC,WAAW,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAA,gBAAM,EAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,mBAAmB,CACjC,MAAiC;IAEjC,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,KAAK,IAAA,gCAAgB,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED,SAAgB,kBAAkB,CAAC,KAAc,EAAE,SAAS,GAAG,EAAE;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IACE,SAAS,KAAK,SAAS;YACvB,SAAS,KAAK,KAAK;YACnB,SAAS,KAAK,MAAM,EACpB,CAAC;YACD,OAAO,sBAAsB,CAAC;QAChC,CAAC;QACD,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAA0C,CAAC,CAAC,GAAG,CAC5D,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAChB,GAAG;QACH,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC;KAClE,CACF,CACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAA,uCAAwB,EAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAQ,GAAG,YAAY,CAAC;QAC/B,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAQ,GAAG,YAAY,CAAC;QAC/B,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAClD,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAC3C,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;IACjB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC"}

package/dist/runtime/installation/validation.d.ts

@@ -0,0 +1,8 @@
+import { type ParsedXemaInstallation } from './contract';
+import { type InstallationIssue } from './diagnostics';
+export interface InstallationValidation {
+    readonly installation?: ParsedXemaInstallation;
+    readonly issues: readonly InstallationIssue[];
+}
+export declare function validateXemaInstallation(raw: unknown): InstallationValidation;
+//# sourceMappingURL=validation.d.ts.map

package/dist/runtime/installation/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/runtime/installation/validation.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAO9E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC;IAC/C,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC/C;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,CA2B7E"}