@xemahq/xema 0.13.0 → 0.14.0

package/dist/runtime/installation/validation.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateXemaInstallation = validateXemaInstallation;
+const zod_1 = require("zod");
+const contract_1 = require("./contract");
+const diagnostics_1 = require("./diagnostics");
+const common_1 = require("./validators/common");
+const infrastructure_1 = require("./validators/infrastructure");
+const operational_1 = require("./validators/operational");
+const profile_1 = require("./validators/profile");
+const secrets_1 = require("./validators/secrets");
+function validateXemaInstallation(raw) {
+    let installation;
+    try {
+        installation = contract_1.XemaInstallationSchema.parse(raw);
+    }
+    catch (error) {
+        if (!(error instanceof zod_1.ZodError)) {
+            throw error;
+        }
+        return {
+            issues: error.issues.map((issue) => ({
+                kind: diagnostics_1.InstallationIssueKind.Invalid,
+                code: 'SCHEMA_INVALID',
+                path: issue.path.join('.'),
+                message: issue.message,
+            })),
+        };
+    }
+    const issues = [
+        ...(0, common_1.validateUniqueEntries)(installation),
+        ...(0, infrastructure_1.validateInfrastructure)(installation),
+        ...(0, secrets_1.validateSecretReferences)(installation),
+        ...(0, profile_1.validateProfile)(installation),
+        ...(0, operational_1.validateOperationalPolicy)(installation),
+    ];
+    return { installation, issues };
+}
+//# sourceMappingURL=validation.js.map

package/dist/runtime/installation/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../src/runtime/installation/validation.ts"],"names":[],"mappings":";;AAkBA,4DA2BC;AA7CD,6BAA+B;AAE/B,yCAGoB;AACpB,+CAA8E;AAC9E,gDAA4D;AAC5D,gEAAqE;AACrE,0DAAqE;AACrE,kDAAuD;AACvD,kDAAgE;AAOhE,SAAgB,wBAAwB,CAAC,GAAY;IACnD,IAAI,YAAoC,CAAC;IACzC,IAAI,CAAC;QACH,YAAY,GAAG,iCAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,cAAQ,CAAC,EAAE,CAAC;YACjC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACnC,IAAI,EAAE,mCAAqB,CAAC,OAAO;gBACnC,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG;QACb,GAAG,IAAA,8BAAqB,EAAC,YAAY,CAAC;QACtC,GAAG,IAAA,uCAAsB,EAAC,YAAY,CAAC;QACvC,GAAG,IAAA,kCAAwB,EAAC,YAAY,CAAC;QACzC,GAAG,IAAA,yBAAe,EAAC,YAAY,CAAC;QAChC,GAAG,IAAA,uCAAyB,EAAC,YAAY,CAAC;KAC3C,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC"}

package/dist/runtime/installation/validators/common.d.ts

@@ -0,0 +1,4 @@
+import { type InstallationIssue } from '../diagnostics';
+import type { ParsedXemaInstallation } from '../contract';
+export declare function validateUniqueEntries(installation: ParsedXemaInstallation): readonly InstallationIssue[];
+//# sourceMappingURL=common.d.ts.map

package/dist/runtime/installation/validators/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,sBAAsB,GACnC,SAAS,iBAAiB,EAAE,CAyB9B"}

package/dist/runtime/installation/validators/common.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateUniqueEntries = validateUniqueEntries;
+const diagnostics_1 = require("../diagnostics");
+function validateUniqueEntries(installation) {
+    return [
+        ...duplicateIssues(installation.infrastructure.map((binding) => binding.component), 'infrastructure', 'DUPLICATE_INFRASTRUCTURE_COMPONENT'),
+        ...duplicateIssues(installation.secrets.map((secret) => secret.name), 'secrets', 'DUPLICATE_SECRET_REFERENCE'),
+        ...duplicateIssues(installation.domains.map((domain) => `${domain.purpose}:${domain.hostname}`), 'domains', 'DUPLICATE_DOMAIN'),
+        ...duplicateIssues(installation.deployment.regions ?? [], 'deployment.regions', 'DUPLICATE_REGION'),
+    ];
+}
+function duplicateIssues(values, path, code) {
+    const seen = new Set();
+    const duplicates = new Set();
+    for (const value of values) {
+        if (seen.has(value)) {
+            duplicates.add(value);
+        }
+        seen.add(value);
+    }
+    return [...duplicates].sort().map((value) => ({
+        kind: diagnostics_1.InstallationIssueKind.Invalid,
+        code,
+        path,
+        message: `contains duplicate entry "${value}"`,
+    }));
+}
+//# sourceMappingURL=common.js.map

package/dist/runtime/installation/validators/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/common.ts"],"names":[],"mappings":";;AAIA,sDA2BC;AA/BD,gDAA+E;AAI/E,SAAgB,qBAAqB,CACnC,YAAoC;IAEpC,OAAO;QACL,GAAG,eAAe,CAChB,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAC/D,gBAAgB,EAChB,oCAAoC,CACrC;QACD,GAAG,eAAe,CAChB,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EACjD,SAAS,EACT,4BAA4B,CAC7B;QACD,GAAG,eAAe,CAChB,YAAY,CAAC,OAAO,CAAC,GAAG,CACtB,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CACnD,EACD,SAAS,EACT,kBAAkB,CACnB;QACD,GAAG,eAAe,CAChB,YAAY,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,EACrC,oBAAoB,EACpB,kBAAkB,CACnB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,MAAyB,EACzB,IAAY,EACZ,IAAY;IAEZ,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI,EAAE,mCAAqB,CAAC,OAAO;QACnC,IAAI;QACJ,IAAI;QACJ,OAAO,EAAE,6BAA6B,KAAK,GAAG;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/runtime/installation/validators/infrastructure.d.ts

@@ -0,0 +1,4 @@
+import { type InstallationIssue } from '../diagnostics';
+import type { ParsedXemaInstallation } from '../contract';
+export declare function validateInfrastructure(installation: ParsedXemaInstallation): readonly InstallationIssue[];
+//# sourceMappingURL=infrastructure.d.ts.map

package/dist/runtime/installation/validators/infrastructure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infrastructure.d.ts","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/infrastructure.ts"],"names":[],"mappings":"AAGA,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,sBAAsB,GACnC,SAAS,iBAAiB,EAAE,CAuD9B"}

package/dist/runtime/installation/validators/infrastructure.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateInfrastructure = validateInfrastructure;
+const schema_1 = require("../../config/schema");
+const infra_catalog_1 = require("../../infra/infra-catalog");
+const url_security_1 = require("../../secrets/url-security");
+const diagnostics_1 = require("../diagnostics");
+function validateInfrastructure(installation) {
+    const issues = [];
+    for (const binding of installation.infrastructure) {
+        const path = `infrastructure.${binding.component}`;
+        if (binding.ownership === schema_1.InfraMode.External &&
+            binding.endpoint === undefined) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Unresolved,
+                code: 'EXTERNAL_ENDPOINT_REQUIRED',
+                path: `${path}.endpoint`,
+                message: 'external infrastructure requires an endpoint',
+            });
+        }
+        if (binding.component === schema_1.InfraComponent.Postgres &&
+            binding.ownership === schema_1.InfraMode.External &&
+            binding.secretRefs.length !== 1) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Unresolved,
+                code: 'POSTGRES_SECRET_REFERENCE_REQUIRED',
+                path: `${path}.secretRefs`,
+                message: 'external PostgreSQL requires exactly one password secret reference',
+            });
+        }
+        if (binding.ownership !== schema_1.InfraMode.External &&
+            binding.endpoint !== undefined) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Invalid,
+                code: 'ENDPOINT_NOT_ALLOWED',
+                path: `${path}.endpoint`,
+                message: `endpoint is not allowed for ${binding.ownership} infrastructure`,
+            });
+        }
+        if (binding.ownership === schema_1.InfraMode.Disabled &&
+            infra_catalog_1.INFRA_CATALOG[binding.component].mandatory) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Invalid,
+                code: 'MANDATORY_INFRASTRUCTURE_DISABLED',
+                path: `${path}.ownership`,
+                message: 'mandatory infrastructure cannot be disabled',
+            });
+        }
+        if (binding.endpoint !== undefined) {
+            validateEndpoint(binding.endpoint, `${path}.endpoint`, issues);
+        }
+    }
+    return issues;
+}
+function validateEndpoint(endpoint, path, issues) {
+    let parsed;
+    try {
+        parsed = new URL(endpoint);
+    }
+    catch {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'ENDPOINT_INVALID',
+            path,
+            message: 'must be an absolute URL',
+        });
+        return;
+    }
+    if ((0, url_security_1.urlContainsCredentialMaterial)(parsed)) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'SECRET_VALUE_IN_ENDPOINT',
+            path,
+            message: 'must reference credentials through secretRefs, never inline values',
+        });
+    }
+}
+//# sourceMappingURL=infrastructure.js.map

package/dist/runtime/installation/validators/infrastructure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infrastructure.js","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/infrastructure.ts"],"names":[],"mappings":";;AAOA,wDAyDC;AAhED,gDAAgE;AAChE,6DAA0D;AAC1D,6DAA2E;AAC3E,gDAA+E;AAI/E,SAAgB,sBAAsB,CACpC,YAAoC;IAEpC,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,cAAc,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,kBAAkB,OAAO,CAAC,SAAS,EAAE,CAAC;QACnD,IACE,OAAO,CAAC,SAAS,KAAK,kBAAS,CAAC,QAAQ;YACxC,OAAO,CAAC,QAAQ,KAAK,SAAS,EAC9B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,UAAU;gBACtC,IAAI,EAAE,4BAA4B;gBAClC,IAAI,EAAE,GAAG,IAAI,WAAW;gBACxB,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;QACD,IACE,OAAO,CAAC,SAAS,KAAK,uBAAc,CAAC,QAAQ;YAC7C,OAAO,CAAC,SAAS,KAAK,kBAAS,CAAC,QAAQ;YACxC,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAC/B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,UAAU;gBACtC,IAAI,EAAE,oCAAoC;gBAC1C,IAAI,EAAE,GAAG,IAAI,aAAa;gBAC1B,OAAO,EACL,oEAAoE;aACvE,CAAC,CAAC;QACL,CAAC;QACD,IACE,OAAO,CAAC,SAAS,KAAK,kBAAS,CAAC,QAAQ;YACxC,OAAO,CAAC,QAAQ,KAAK,SAAS,EAC9B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;gBACnC,IAAI,EAAE,sBAAsB;gBAC5B,IAAI,EAAE,GAAG,IAAI,WAAW;gBACxB,OAAO,EAAE,+BAA+B,OAAO,CAAC,SAAS,iBAAiB;aAC3E,CAAC,CAAC;QACL,CAAC;QACD,IACE,OAAO,CAAC,SAAS,KAAK,kBAAS,CAAC,QAAQ;YACxC,6BAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,SAAS,EAC1C,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;gBACnC,IAAI,EAAE,mCAAmC;gBACzC,IAAI,EAAE,GAAG,IAAI,YAAY;gBACzB,OAAO,EAAE,6CAA6C;aACvD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,WAAW,EAAE,MAAM,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAgB,EAChB,IAAY,EACZ,MAA2B;IAE3B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,kBAAkB;YACxB,IAAI;YACJ,OAAO,EAAE,yBAAyB;SACnC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,IAAA,4CAA6B,EAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,0BAA0B;YAChC,IAAI;YACJ,OAAO,EACL,oEAAoE;SACvE,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/runtime/installation/validators/operational.d.ts

@@ -0,0 +1,4 @@
+import { type ParsedXemaInstallation } from '../contract';
+import { type InstallationIssue } from '../diagnostics';
+export declare function validateOperationalPolicy(installation: ParsedXemaInstallation): readonly InstallationIssue[];
+//# sourceMappingURL=operational.d.ts.map

package/dist/runtime/installation/validators/operational.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operational.d.ts","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/operational.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,sBAAsB,EAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE/E,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,sBAAsB,GACnC,SAAS,iBAAiB,EAAE,CAM9B"}

package/dist/runtime/installation/validators/operational.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateOperationalPolicy = validateOperationalPolicy;
+const contract_1 = require("../contract");
+const diagnostics_1 = require("../diagnostics");
+function validateOperationalPolicy(installation) {
+    return [
+        ...validateStorage(installation),
+        ...validateCapacity(installation),
+        ...validateUpgrade(installation),
+    ];
+}
+function validateStorage(installation) {
+    const issues = [];
+    if (installation.storage.class === contract_1.StorageClass.External &&
+        installation.storage.externalBinding === undefined) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Unresolved,
+            code: 'EXTERNAL_STORAGE_BINDING_REQUIRED',
+            path: 'storage.externalBinding',
+            message: 'external storage requires a binding reference',
+        });
+    }
+    if (installation.storage.class !== contract_1.StorageClass.External &&
+        installation.storage.externalBinding !== undefined) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'EXTERNAL_STORAGE_BINDING_NOT_ALLOWED',
+            path: 'storage.externalBinding',
+            message: 'externalBinding is only valid for external storage',
+        });
+    }
+    if (installation.storage.backup.mode === contract_1.BackupMode.Disabled &&
+        installation.storage.backup.destinationSecretRef !== undefined) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'BACKUP_DESTINATION_NOT_ALLOWED',
+            path: 'storage.backup.destinationSecretRef',
+            message: 'a disabled backup policy cannot declare a destination',
+        });
+    }
+    if (installation.deployment.profile ===
+        contract_1.InstallationDeploymentProfile.Regulated &&
+        installation.storage.backup.mode !== undefined &&
+        installation.storage.backup.mode !== contract_1.BackupMode.Continuous) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'REGULATED_BACKUP_REQUIRED',
+            path: 'storage.backup.mode',
+            message: 'regulated installations require continuous backup',
+        });
+    }
+    if (installation.deployment.profile ===
+        contract_1.InstallationDeploymentProfile.Regulated &&
+        installation.domains.some((domain) => domain.tls.mode === contract_1.TlsMode.Disabled)) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'REGULATED_TLS_REQUIRED',
+            path: 'domains',
+            message: 'regulated installation domains require TLS',
+        });
+    }
+    for (const domain of installation.domains) {
+        const path = `domains.${domain.purpose}.${domain.hostname}.tls.secretRef`;
+        if (domain.tls.mode === contract_1.TlsMode.External &&
+            domain.tls.secretRef === undefined) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Unresolved,
+                code: 'EXTERNAL_TLS_SECRET_REQUIRED',
+                path,
+                message: 'external TLS requires a certificate secret reference',
+            });
+        }
+        if (domain.tls.mode !== contract_1.TlsMode.External &&
+            domain.tls.secretRef !== undefined) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Invalid,
+                code: 'TLS_SECRET_NOT_ALLOWED',
+                path,
+                message: `a ${domain.tls.mode} TLS policy cannot declare an external certificate secret`,
+            });
+        }
+    }
+    return issues;
+}
+function validateCapacity(installation) {
+    const { minReplicas, maxReplicas } = installation.capacity;
+    if (minReplicas !== undefined &&
+        maxReplicas !== undefined &&
+        minReplicas > maxReplicas) {
+        return [
+            {
+                kind: diagnostics_1.InstallationIssueKind.Invalid,
+                code: 'CAPACITY_RANGE_INVALID',
+                path: 'capacity',
+                message: 'minReplicas cannot exceed maxReplicas',
+            },
+        ];
+    }
+    return [];
+}
+function validateUpgrade(installation) {
+    const { channel, releaseRef } = installation.upgrade;
+    if (channel === contract_1.UpgradeChannel.Pinned && releaseRef === undefined) {
+        return [
+            {
+                kind: diagnostics_1.InstallationIssueKind.Unresolved,
+                code: 'PINNED_RELEASE_REQUIRED',
+                path: 'upgrade.releaseRef',
+                message: 'pinned upgrade channel requires a releaseRef',
+            },
+        ];
+    }
+    if (channel !== contract_1.UpgradeChannel.Pinned && releaseRef !== undefined) {
+        return [
+            {
+                kind: diagnostics_1.InstallationIssueKind.Invalid,
+                code: 'RELEASE_REF_NOT_ALLOWED',
+                path: 'upgrade.releaseRef',
+                message: 'releaseRef is only valid for the pinned upgrade channel',
+            },
+        ];
+    }
+    return [];
+}
+//# sourceMappingURL=operational.js.map

package/dist/runtime/installation/validators/operational.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operational.js","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/operational.ts"],"names":[],"mappings":";;AAUA,8DAQC;AAlBD,0CAOqB;AACrB,gDAA+E;AAE/E,SAAgB,yBAAyB,CACvC,YAAoC;IAEpC,OAAO;QACL,GAAG,eAAe,CAAC,YAAY,CAAC;QAChC,GAAG,gBAAgB,CAAC,YAAY,CAAC;QACjC,GAAG,eAAe,CAAC,YAAY,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,YAAoC;IAEpC,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IACE,YAAY,CAAC,OAAO,CAAC,KAAK,KAAK,uBAAY,CAAC,QAAQ;QACpD,YAAY,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,EAClD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,UAAU;YACtC,IAAI,EAAE,mCAAmC;YACzC,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,+CAA+C;SACzD,CAAC,CAAC;IACL,CAAC;IACD,IACE,YAAY,CAAC,OAAO,CAAC,KAAK,KAAK,uBAAY,CAAC,QAAQ;QACpD,YAAY,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,EAClD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,sCAAsC;YAC5C,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,oDAAoD;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,IACE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,qBAAU,CAAC,QAAQ;QACxD,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,KAAK,SAAS,EAC9D,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,gCAAgC;YACtC,IAAI,EAAE,qCAAqC;YAC3C,OAAO,EAAE,uDAAuD;SACjE,CAAC,CAAC;IACL,CAAC;IACD,IACE,YAAY,CAAC,UAAU,CAAC,OAAO;QAC7B,wCAA6B,CAAC,SAAS;QACzC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;QAC9C,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,qBAAU,CAAC,UAAU,EAC1D,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,mDAAmD;SAC7D,CAAC,CAAC;IACL,CAAC;IACD,IACE,YAAY,CAAC,UAAU,CAAC,OAAO;QAC7B,wCAA6B,CAAC,SAAS;QACzC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,kBAAO,CAAC,QAAQ,CAAC,EAC3E,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,4CAA4C;SACtD,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,WAAW,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,gBAAgB,CAAC;QAC1E,IACE,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,kBAAO,CAAC,QAAQ;YACpC,MAAM,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,EAClC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,UAAU;gBACtC,IAAI,EAAE,8BAA8B;gBACpC,IAAI;gBACJ,OAAO,EAAE,sDAAsD;aAChE,CAAC,CAAC;QACL,CAAC;QACD,IACE,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,kBAAO,CAAC,QAAQ;YACpC,MAAM,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,EAClC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;gBACnC,IAAI,EAAE,wBAAwB;gBAC9B,IAAI;gBACJ,OAAO,EAAE,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,2DAA2D;aACzF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CACvB,YAAoC;IAEpC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;IAC3D,IACE,WAAW,KAAK,SAAS;QACzB,WAAW,KAAK,SAAS;QACzB,WAAW,GAAG,WAAW,EACzB,CAAC;QACD,OAAO;YACL;gBACE,IAAI,EAAE,mCAAqB,CAAC,OAAO;gBACnC,IAAI,EAAE,wBAAwB;gBAC9B,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,uCAAuC;aACjD;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CACtB,YAAoC;IAEpC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC;IACrD,IAAI,OAAO,KAAK,yBAAc,CAAC,MAAM,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAClE,OAAO;YACL;gBACE,IAAI,EAAE,mCAAqB,CAAC,UAAU;gBACtC,IAAI,EAAE,yBAAyB;gBAC/B,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,8CAA8C;aACxD;SACF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,yBAAc,CAAC,MAAM,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAClE,OAAO;YACL;gBACE,IAAI,EAAE,mCAAqB,CAAC,OAAO;gBACnC,IAAI,EAAE,yBAAyB;gBAC/B,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,yDAAyD;aACnE;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/runtime/installation/validators/profile.d.ts

@@ -0,0 +1,4 @@
+import { type ParsedXemaInstallation } from '../contract';
+import { type InstallationIssue } from '../diagnostics';
+export declare function validateProfile(installation: ParsedXemaInstallation): readonly InstallationIssue[];
+//# sourceMappingURL=profile.d.ts.map

package/dist/runtime/installation/validators/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE/E,wBAAgB,eAAe,CAC7B,YAAY,EAAE,sBAAsB,GACnC,SAAS,iBAAiB,EAAE,CA6E9B"}

package/dist/runtime/installation/validators/profile.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateProfile = validateProfile;
+const contract_1 = require("../contract");
+const diagnostics_1 = require("../diagnostics");
+function validateProfile(installation) {
+    const issues = [];
+    const { profile, substrate } = installation.deployment;
+    const regions = installation.deployment.regions ?? [];
+    if (profile === contract_1.InstallationDeploymentProfile.MultiRegion) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Unsupported,
+            code: 'MULTI_REGION_NOT_EXECUTABLE',
+            path: 'deployment.profile',
+            message: 'multi-region is accepted as declared intent but this compiler version cannot produce an executable plan',
+        });
+    }
+    if (profile === contract_1.InstallationDeploymentProfile.Developer &&
+        substrate !== undefined &&
+        substrate !== contract_1.InstallationSubstrate.Local) {
+        issues.push(profileSubstrateIssue(profile, contract_1.InstallationSubstrate.Local));
+    }
+    if (profile === contract_1.InstallationDeploymentProfile.StarterPme &&
+        substrate === contract_1.InstallationSubstrate.Cluster) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'PROFILE_SUBSTRATE_MISMATCH',
+            path: 'deployment.substrate',
+            message: 'starter-pme supports local or single-node substrate',
+        });
+    }
+    if ((profile === contract_1.InstallationDeploymentProfile.HighAvailability ||
+        profile === contract_1.InstallationDeploymentProfile.Regulated ||
+        profile === contract_1.InstallationDeploymentProfile.MultiRegion) &&
+        substrate !== undefined &&
+        substrate !== contract_1.InstallationSubstrate.Cluster) {
+        issues.push(profileSubstrateIssue(profile, contract_1.InstallationSubstrate.Cluster));
+    }
+    if (profile !== contract_1.InstallationDeploymentProfile.MultiRegion &&
+        installation.deployment.regions !== undefined &&
+        regions.length !== 1) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'PROFILE_REGION_MISMATCH',
+            path: 'deployment.regions',
+            message: `${profile} requires exactly one explicitly declared region when regions are overridden`,
+        });
+    }
+    if (profile === contract_1.InstallationDeploymentProfile.MultiRegion &&
+        regions.length > 0 &&
+        regions.length < 2) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Unresolved,
+            code: 'MULTI_REGION_REQUIRES_REGIONS',
+            path: 'deployment.regions',
+            message: 'multi-region requires at least two regions',
+        });
+    }
+    if (profile === contract_1.InstallationDeploymentProfile.Regulated &&
+        installation.tenancy.isolation === contract_1.TenantIsolation.Shared) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'REGULATED_SHARED_ISOLATION',
+            path: 'tenancy.isolation',
+            message: 'regulated installations cannot use shared tenant isolation',
+        });
+    }
+    return issues;
+}
+function profileSubstrateIssue(profile, required) {
+    return {
+        kind: diagnostics_1.InstallationIssueKind.Invalid,
+        code: 'PROFILE_SUBSTRATE_MISMATCH',
+        path: 'deployment.substrate',
+        message: `${profile} requires ${required} substrate`,
+    };
+}
+//# sourceMappingURL=profile.js.map

package/dist/runtime/installation/validators/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/profile.ts"],"names":[],"mappings":";;AAQA,0CA+EC;AAvFD,0CAKqB;AACrB,gDAA+E;AAE/E,SAAgB,eAAe,CAC7B,YAAoC;IAEpC,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,UAAU,CAAC;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC;IAEtD,IAAI,OAAO,KAAK,wCAA6B,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,WAAW;YACvC,IAAI,EAAE,6BAA6B;YACnC,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EACL,yGAAyG;SAC5G,CAAC,CAAC;IACL,CAAC;IACD,IACE,OAAO,KAAK,wCAA6B,CAAC,SAAS;QACnD,SAAS,KAAK,SAAS;QACvB,SAAS,KAAK,gCAAqB,CAAC,KAAK,EACzC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,gCAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,IACE,OAAO,KAAK,wCAA6B,CAAC,UAAU;QACpD,SAAS,KAAK,gCAAqB,CAAC,OAAO,EAC3C,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CAAC;IACL,CAAC;IACD,IACE,CAAC,OAAO,KAAK,wCAA6B,CAAC,gBAAgB;QACzD,OAAO,KAAK,wCAA6B,CAAC,SAAS;QACnD,OAAO,KAAK,wCAA6B,CAAC,WAAW,CAAC;QACxD,SAAS,KAAK,SAAS;QACvB,SAAS,KAAK,gCAAqB,CAAC,OAAO,EAC3C,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,gCAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,IACE,OAAO,KAAK,wCAA6B,CAAC,WAAW;QACrD,YAAY,CAAC,UAAU,CAAC,OAAO,KAAK,SAAS;QAC7C,OAAO,CAAC,MAAM,KAAK,CAAC,EACpB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,yBAAyB;YAC/B,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,GAAG,OAAO,8EAA8E;SAClG,CAAC,CAAC;IACL,CAAC;IACD,IACE,OAAO,KAAK,wCAA6B,CAAC,WAAW;QACrD,OAAO,CAAC,MAAM,GAAG,CAAC;QAClB,OAAO,CAAC,MAAM,GAAG,CAAC,EAClB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,UAAU;YACtC,IAAI,EAAE,+BAA+B;YACrC,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,4CAA4C;SACtD,CAAC,CAAC;IACL,CAAC;IACD,IACE,OAAO,KAAK,wCAA6B,CAAC,SAAS;QACnD,YAAY,CAAC,OAAO,CAAC,SAAS,KAAK,0BAAe,CAAC,MAAM,EACzD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,4DAA4D;SACtE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAsC,EACtC,QAA+B;IAE/B,OAAO;QACL,IAAI,EAAE,mCAAqB,CAAC,OAAO;QACnC,IAAI,EAAE,4BAA4B;QAClC,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,GAAG,OAAO,aAAa,QAAQ,YAAY;KACrD,CAAC;AACJ,CAAC"}

package/dist/runtime/installation/validators/secrets.d.ts

@@ -0,0 +1,4 @@
+import { type ParsedXemaInstallation } from '../contract';
+import { type InstallationIssue } from '../diagnostics';
+export declare function validateSecretReferences(installation: ParsedXemaInstallation): readonly InstallationIssue[];
+//# sourceMappingURL=secrets.d.ts.map

package/dist/runtime/installation/validators/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE/E,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,sBAAsB,GACnC,SAAS,iBAAiB,EAAE,CAsC9B"}

package/dist/runtime/installation/validators/secrets.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateSecretReferences = validateSecretReferences;
+const contract_1 = require("../contract");
+const diagnostics_1 = require("../diagnostics");
+function validateSecretReferences(installation) {
+    const issues = [];
+    const declared = new Set(installation.secrets.map((secret) => secret.name));
+    const referenced = collectReferences(installation);
+    for (const reference of referenced) {
+        if (!declared.has(reference.ref)) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Unresolved,
+                code: 'SECRET_REFERENCE_UNRESOLVED',
+                path: reference.path,
+                message: `references undeclared secret "${reference.ref}"`,
+            });
+        }
+    }
+    for (const secret of installation.secrets) {
+        const locatorRequired = secret.provider !== contract_1.SecretReferenceProvider.Prompt &&
+            secret.provider !== contract_1.SecretReferenceProvider.ManagedLocal;
+        if (locatorRequired && secret.locator === undefined) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Unresolved,
+                code: 'SECRET_LOCATOR_REQUIRED',
+                path: `secrets.${secret.name}.locator`,
+                message: `${secret.provider} secret reference requires a locator`,
+            });
+        }
+        if (!locatorRequired && secret.locator !== undefined) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Invalid,
+                code: 'SECRET_LOCATOR_NOT_ALLOWED',
+                path: `secrets.${secret.name}.locator`,
+                message: `${secret.provider} secret reference cannot carry a locator`,
+            });
+        }
+    }
+    return issues;
+}
+function collectReferences(installation) {
+    const referenced = [];
+    for (const binding of installation.infrastructure) {
+        for (const ref of binding.secretRefs) {
+            referenced.push({
+                ref,
+                path: `infrastructure.${binding.component}.secretRefs`,
+            });
+        }
+    }
+    for (const domain of installation.domains) {
+        if (domain.tls.secretRef !== undefined) {
+            referenced.push({
+                ref: domain.tls.secretRef,
+                path: `domains.${domain.purpose}.${domain.hostname}.tls.secretRef`,
+            });
+        }
+    }
+    if (installation.storage.backup.destinationSecretRef !== undefined) {
+        referenced.push({
+            ref: installation.storage.backup.destinationSecretRef,
+            path: 'storage.backup.destinationSecretRef',
+        });
+    }
+    return referenced;
+}
+//# sourceMappingURL=secrets.js.map

package/dist/runtime/installation/validators/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/secrets.ts"],"names":[],"mappings":";;AAMA,4DAwCC;AA9CD,0CAGqB;AACrB,gDAA+E;AAE/E,SAAgB,wBAAwB,CACtC,YAAoC;IAEpC,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAEnD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,UAAU;gBACtC,IAAI,EAAE,6BAA6B;gBACnC,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,OAAO,EAAE,iCAAiC,SAAS,CAAC,GAAG,GAAG;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,eAAe,GACnB,MAAM,CAAC,QAAQ,KAAK,kCAAuB,CAAC,MAAM;YAClD,MAAM,CAAC,QAAQ,KAAK,kCAAuB,CAAC,YAAY,CAAC;QAC3D,IAAI,eAAe,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,UAAU;gBACtC,IAAI,EAAE,yBAAyB;gBAC/B,IAAI,EAAE,WAAW,MAAM,CAAC,IAAI,UAAU;gBACtC,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,sCAAsC;aAClE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;gBACnC,IAAI,EAAE,4BAA4B;gBAClC,IAAI,EAAE,WAAW,MAAM,CAAC,IAAI,UAAU;gBACtC,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,0CAA0C;aACtE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACxB,YAAoC;IAEpC,MAAM,UAAU,GAAyC,EAAE,CAAC;IAC5D,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,cAAc,EAAE,CAAC;QAClD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACrC,UAAU,CAAC,IAAI,CAAC;gBACd,GAAG;gBACH,IAAI,EAAE,kBAAkB,OAAO,CAAC,SAAS,aAAa;aACvD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvC,UAAU,CAAC,IAAI,CAAC;gBACd,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS;gBACzB,IAAI,EAAE,WAAW,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,gBAAgB;aACnE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACnE,UAAU,CAAC,IAAI,CAAC;YACd,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB;YACrD,IAAI,EAAE,qCAAqC;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/runtime/launch-plan-format.d.ts

@@ -0,0 +1,3 @@
+import type { LaunchPlan } from './launch';
+export declare function formatLaunchPlan(plan: LaunchPlan): string;
+//# sourceMappingURL=launch-plan-format.d.ts.map

package/dist/runtime/launch-plan-format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch-plan-format.d.ts","sourceRoot":"","sources":["../../src/runtime/launch-plan-format.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAQ3C,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAqEzD"}

package/dist/runtime/launch-plan-format.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatLaunchPlan = formatLaunchPlan;
+function formatLaunchPlan(plan) {
+    const lines = [];
+    const rule = '─'.repeat(72);
+    lines.push('xema — boot preview  (dry run: nothing was started)');
+    lines.push(rule);
+    lines.push(`substrate : ${plan.substrate}`);
+    lines.push(`edition   : ${plan.lock.path} (${plan.lock.source})`);
+    const managed = plan.infra.managed.length > 0
+        ? plan.infra.managed.map((m) => m.component).join(', ')
+        : '(none — assumed already running)';
+    lines.push(`infra     : ${managed}`);
+    if (plan.addedPrerequisites.length > 0) {
+        lines.push(`prereqs   : +${String(plan.addedPrerequisites.length)} hard prerequisite(s) pulled in: ` +
+            plan.addedPrerequisites.join(', '));
+    }
+    if (plan.skippedOptionalBiomes.length > 0) {
+        lines.push(`optional  : skipping optional biome(s) not explicitly included: ` +
+            `${plan.skippedOptionalBiomes.join(', ')} (add them to app.include, or use include: 'all')`);
+    }
+    if (plan.infraWarnings.length > 0) {
+        for (const w of plan.infraWarnings) {
+            lines.push(`warn      : ${w}`);
+        }
+    }
+    lines.push('');
+    lines.push(`services  : ${String(plan.roster.length)} across ${String(plan.waves.length)} wave(s) ` +
+        `(waves boot in order; members within a wave boot concurrently)`);
+    lines.push(rule);
+    const nameWidth = Math.min(40, Math.max(20, ...plan.roster.map((e) => e.name.length)));
+    for (const wave of plan.waves) {
+        lines.push(`wave ${String(wave.index)} — ${wave.tier}  (${String(wave.members.length)})`);
+        const members = [...wave.members].sort((a, b) => a.name.localeCompare(b.name));
+        for (const m of members) {
+            const port = plan.ports.get(m.name);
+            const portCol = port !== undefined ? `:${String(port)}` : '(image)';
+            const from = m.sourceRoot ?? m.servicePath ?? '';
+            const src = m.sourceName ? ` [${m.sourceName}]` : '';
+            lines.push(`  ${m.name.padEnd(nameWidth)} ${portCol.padEnd(8)} ${from}${src}`.trimEnd());
+        }
+    }
+    if (plan.unresolvedSources.length > 0) {
+        lines.push(rule);
+        lines.push('unresolved (offline preview — would clone):');
+        for (const note of plan.unresolvedSources) {
+            lines.push(`  ${note}`);
+        }
+    }
+    lines.push(rule);
+    lines.push('Native services run compiled dist/main.js — build changed services first ' +
+        '(`pnpm --filter <svc> build`) or use `xema dev --watch`.');
+    lines.push('Re-run without --dry-run to boot.');
+    return lines.join('\n');
+}
+//# sourceMappingURL=launch-plan-format.js.map

package/dist/runtime/launch-plan-format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch-plan-format.js","sourceRoot":"","sources":["../../src/runtime/launch-plan-format.ts"],"names":[],"mappings":";;AAQA,4CAqEC;AArED,SAAgB,gBAAgB,CAAC,IAAgB;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAE5B,KAAK,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5C,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAClE,MAAM,OAAO,GACX,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACvD,CAAC,CAAC,kCAAkC,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CACR,gBAAgB,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,mCAAmC;YACvF,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CACrC,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CACR,kEAAkE;YAChE,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,mDAAmD,CAC9F,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,eAAe,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW;QACtF,gEAAgE,CACnE,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEjB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,EAAE,EACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CACvD,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,QAAQ,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1F,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/E,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAGpE,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,KAAK,CAAC,IAAI,CACR,2EAA2E;QACzE,0DAA0D,CAC7D,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/runtime/launch.d.ts

@@ -1,22 +1,44 @@
-import { type XemaConfig } from './config/schema';
+import { Substrate, type XemaConfig } from './config/schema';
+import { resolveInfraPlan } from './infra/infra-plan';
 import { type RosterEntry, type RosterInclude, type RosterSelection } from './roster';
 import { type BringUpResult, type LifecycleEvent } from './supervisor';
+import { deriveWaves } from './waves';
 export interface LaunchOptions {
     readonly config: XemaConfig;
     readonly includeWeb: boolean;
+    readonly installationIdentity?: string;
     readonly lockPathOverride?: string | undefined;
     readonly bootGraphPathOverride?: string | undefined;
     readonly onEvent?: (event: LifecycleEvent) => void;
     readonly log?: (line: string) => void;
+    readonly offline?: boolean;
+    readonly includeBiomes?: readonly string[];
 }
 export interface LaunchHandle {
     readonly result: BringUpResult;
     readonly roster: readonly RosterEntry[];
     shutdown(): Promise<void>;
 }
-export declare function launch(opts: LaunchOptions): Promise<LaunchHandle>;
+export interface LaunchPlan {
+    readonly substrate: Substrate;
+    readonly lock: {
+        readonly path: string;
+        readonly source: string;
+    };
+    readonly roster: readonly RosterEntry[];
+    readonly waves: ReturnType<typeof deriveWaves>;
+    readonly ports: ReadonlyMap<string, number>;
+    readonly infra: ReturnType<typeof resolveInfraPlan>;
+    readonly addedPrerequisites: readonly string[];
+    readonly skippedOptionalBiomes: readonly string[];
+    readonly infraWarnings: readonly string[];
+    readonly unresolvedSources: readonly string[];
+}
+export declare function resolveLaunchPlan(opts: LaunchOptions): LaunchPlan;
+export declare function unionIncludeServices(include: RosterInclude, services: readonly string[]): RosterInclude;
+export declare function launch(opts: LaunchOptions, preResolved?: LaunchPlan): Promise<LaunchHandle>;
 export declare function buildSelection(config: XemaConfig, includeWeb: boolean): RosterSelection;
-export declare function normalizeInclude(include: 'all' | readonly string[], features: readonly string[]): RosterInclude;
+export declare function normalizeInclude(include: 'all' | 'default' | 'minimal' | readonly string[], features: readonly string[]): RosterInclude;
 export declare function splitIncludeTokens(tokens: readonly string[]): {
     tiers: string[];
     services: string[];