@xemahq/xema 0.13.0 → 0.15.0

package/dist/assets/distribution-assets.manifest.json

@@ -0,0 +1,147 @@
+{
+  "schemaVersion": 2,
+  "generatedBy": "apps/xema-cli/scripts/sync-distribution-assets.cjs",
+  "distributionsRepo": "xema-dev/xema-distributions",
+  "bootGraph": {
+    "repo": "xema-dev/xema-monorepo",
+    "sourcePath": "tooling/boundaries/boot-graph.json",
+    "sourceCommit": "188e186ab6c0dce9d8471dda79a01dcb8b10cdc3"
+  },
+  "editions": [
+    {
+      "id": "minimal",
+      "sourceCommit": "a9f07bb526f6bd5dab3095a25f0a1cf79838aa56",
+      "inputHash": "091de7a7d4344d071cf7037371459b4480c6d5e2b71c438b8f1a3d2c64e49028",
+      "files": [
+        "minimal/distribution.lock.json",
+        "minimal/images.lock.json"
+      ]
+    },
+    {
+      "id": "core",
+      "sourceCommit": "a9f07bb526f6bd5dab3095a25f0a1cf79838aa56",
+      "inputHash": "b23658d09c43bc861d26b08698501215b2fdbb993384551a7cf5504b5bcde17f",
+      "files": [
+        "core/distribution.lock.json",
+        "core/images.lock.json"
+      ]
+    },
+    {
+      "id": "starter",
+      "sourceCommit": "a9f07bb526f6bd5dab3095a25f0a1cf79838aa56",
+      "inputHash": "35ca95b72c9a875738d2789a9d77de27c3a131a6f3c9f956cb2e31aae3a7f3a1",
+      "files": [
+        "starter/distribution.lock.json",
+        "starter/images.lock.json"
+      ]
+    },
+    {
+      "id": "oss",
+      "sourceCommit": "a9f07bb526f6bd5dab3095a25f0a1cf79838aa56",
+      "inputHash": "fc3ef58c7a803719a7d87a14646bb016d3ccd5cc22f3f149668de077db5bd695",
+      "files": [
+        "oss/distribution.lock.json",
+        "oss/images.lock.json"
+      ]
+    },
+    {
+      "id": "appliance-lean",
+      "sourceCommit": "a9f07bb526f6bd5dab3095a25f0a1cf79838aa56",
+      "inputHash": "2f25dc50f30af61e5f927f630ce84e3325b0ff390114d0f5d56cabe61a4774f8",
+      "files": [
+        "appliance-lean/distribution.lock.json",
+        "appliance-lean/images.lock.json"
+      ]
+    },
+    {
+      "id": "appliance-base",
+      "sourceCommit": "a9f07bb526f6bd5dab3095a25f0a1cf79838aa56",
+      "inputHash": "cca9b83b8d49efcaa4a388ef3fa4236d77ba06f9038f234f545a30395fdb7e56",
+      "files": [
+        "appliance-base/distribution.lock.json",
+        "appliance-base/images.lock.json"
+      ]
+    },
+    {
+      "id": "cloud",
+      "sourceCommit": "a9f07bb526f6bd5dab3095a25f0a1cf79838aa56",
+      "inputHash": "b730e838abc3bffef0c93d39c67bea14d56814a3731e35117bf6b33abc195a0a",
+      "files": [
+        "cloud/distribution.lock.json",
+        "cloud/images.lock.json"
+      ]
+    }
+  ],
+  "excludedEditions": {
+    "xema-internal": "operator-audience edition (pulls the operator-only fleet-management biome). @xemahq/xema is a PUBLIC npm package; operator inventory does not belong in it. Operators run it from the aggregator checkout or with --lock."
+  },
+  "packageAssets": [
+    "keycloak/realm-xema.json"
+  ],
+  "files": [
+    {
+      "path": "appliance-base/distribution.lock.json",
+      "sha256": "45b694b487b5a4379ec9686da9480aa27ae5ec93b48804f4f59cd620bdf8a033"
+    },
+    {
+      "path": "appliance-base/images.lock.json",
+      "sha256": "614c6f7560f62f812dd6850c90d4f8d30233cfe68d95245cb4893a5485fbf290"
+    },
+    {
+      "path": "appliance-lean/distribution.lock.json",
+      "sha256": "6d0b593c81ac7d2b44ce9495b9c44f829db983fc697ad00a659ad2ba1b4f6990"
+    },
+    {
+      "path": "appliance-lean/images.lock.json",
+      "sha256": "7e7050308e5bdf56e904d88e5504c72021ce923ee650f274316d40ca5e86c12c"
+    },
+    {
+      "path": "boot-graph.json",
+      "sha256": "b939e59d761b04fa9391797c3eccd32a89ebc737ff18401cd577656b391e24d9"
+    },
+    {
+      "path": "cloud/distribution.lock.json",
+      "sha256": "1091f3438cbf8fbc6beb5921dbc580f6c95f88bf2c2d7c03d459019187ce12e6"
+    },
+    {
+      "path": "cloud/images.lock.json",
+      "sha256": "e2d72dcde09e9c91e538aa212607c6cc8cbec1806cfe4952ea733d194cf8994e"
+    },
+    {
+      "path": "core/distribution.lock.json",
+      "sha256": "92a03a92a0ed781ec61bc01a58d7bb88a32f7ec50552855d387cc5890ba4e67a"
+    },
+    {
+      "path": "core/images.lock.json",
+      "sha256": "d85b2b1d1297de04b455d85035801a81f7de4bca51653eeba73f4d1dbe41437c"
+    },
+    {
+      "path": "keycloak/realm-xema.json",
+      "sha256": "39f802bcdd4757cc22d71dd0a583f6ff41b0b3d63818c735b9902575b3784320"
+    },
+    {
+      "path": "minimal/distribution.lock.json",
+      "sha256": "c910b0f896f22354bb75fe1b3bf194d184918f3e6d3bea71c82dbf6086b9f949"
+    },
+    {
+      "path": "minimal/images.lock.json",
+      "sha256": "0b4e804568f90f80f688f15d42bb58031c9a17b1c26c141c4d9d5def971c0ae2"
+    },
+    {
+      "path": "oss/distribution.lock.json",
+      "sha256": "23ad8fc7170deebe1b4f0bb1e9f123cb23a0475f3b3b75214b1411c949b62e6c"
+    },
+    {
+      "path": "oss/images.lock.json",
+      "sha256": "5c4c1160ca630ba4f1adc2c1c0a9df6e6309926f5bd5a44cb3218433b0fe9dd4"
+    },
+    {
+      "path": "starter/distribution.lock.json",
+      "sha256": "a556077cc4797fc8d9a82d38b2a38465b8a6c7b0a034fef7575cc880338e7be8"
+    },
+    {
+      "path": "starter/images.lock.json",
+      "sha256": "9fd8911cfa008c1ef63443dd225522d2ca636f5a6a8f86da5353606ad0dcfec8"
+    }
+  ]
+}

package/dist/assets/keycloak/realm-xema.json

@@ -0,0 +1,412 @@
+{
+  "realm": "${XEMA_KEYCLOAK_REALM}",
+  "displayName": "Xema Platform",
+  "enabled": true,
+  "sslRequired": "external",
+  "registrationAllowed": true,
+  "registrationEmailAsUsername": true,
+  "rememberMe": true,
+  "verifyEmail": false,
+  "loginWithEmailAllowed": true,
+  "duplicateEmailsAllowed": false,
+  "resetPasswordAllowed": true,
+  "editUsernameAllowed": false,
+  "bruteForceProtected": false,
+  "eventsEnabled": true,
+  "eventsListeners": [
+    "jboss-logging"
+  ],
+  "enabledEventTypes": [
+    "LOGIN",
+    "LOGIN_ERROR",
+    "REGISTER",
+    "REGISTER_ERROR",
+    "LOGOUT",
+    "CODE_TO_TOKEN"
+  ],
+  "adminEventsEnabled": true,
+  "adminEventsDetailsEnabled": true,
+  "roles": {
+    "realm": [
+      {
+        "name": "platform_admin",
+        "description": "Platform Administrator - full platform access",
+        "composite": false
+      },
+      {
+        "name": "platform_support",
+        "description": "Platform Support - read-only platform access",
+        "composite": false
+      },
+      {
+        "name": "user",
+        "description": "Default user role",
+        "composite": false
+      },
+      {
+        "name": "micro-service",
+        "description": "Role for BACKEND and INTEGRATION services",
+        "composite": false
+      }
+    ]
+  },
+  "defaultDefaultClientScopes": [
+    "roles",
+    "basic"
+  ],
+  "defaultOptionalClientScopes": [
+    "offline_access"
+  ],
+  "clientScopes": [
+    {
+      "name": "openid",
+      "description": "OpenID Connect scope",
+      "protocol": "openid-connect",
+      "attributes": {
+        "include.in.token.scope": "false",
+        "display.on.consent.screen": "false"
+      },
+      "protocolMappers": []
+    },
+    {
+      "name": "roles",
+      "description": "OpenID Connect scope for add user roles to the access token",
+      "protocol": "openid-connect",
+      "attributes": {
+        "include.in.token.scope": "false",
+        "display.on.consent.screen": "true",
+        "consent.screen.text": "${rolesScopeConsentText}"
+      },
+      "protocolMappers": [
+        {
+          "name": "sub",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-sub-mapper",
+          "consentRequired": false,
+          "config": {
+            "introspection.token.claim": "true",
+            "access.token.claim": "true"
+          }
+        },
+        {
+          "name": "email",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-usermodel-attribute-mapper",
+          "consentRequired": false,
+          "config": {
+            "claim.name": "email",
+            "user.attribute": "email",
+            "jsonType.label": "String",
+            "id.token.claim": "true",
+            "access.token.claim": "true",
+            "introspection.token.claim": "true",
+            "userinfo.token.claim": "true"
+          }
+        },
+        {
+          "name": "preferred_username",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-usermodel-attribute-mapper",
+          "consentRequired": false,
+          "config": {
+            "claim.name": "preferred_username",
+            "user.attribute": "username",
+            "jsonType.label": "String",
+            "id.token.claim": "true",
+            "access.token.claim": "true",
+            "introspection.token.claim": "true",
+            "userinfo.token.claim": "true"
+          }
+        },
+        {
+          "name": "realm roles",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-usermodel-realm-role-mapper",
+          "consentRequired": false,
+          "config": {
+            "claim.name": "realm_access.roles",
+            "jsonType.label": "String",
+            "multivalued": "true",
+            "id.token.claim": "true",
+            "access.token.claim": "true",
+            "introspection.token.claim": "true",
+            "userinfo.token.claim": "true"
+          }
+        },
+        {
+          "name": "client roles",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-usermodel-client-role-mapper",
+          "consentRequired": false,
+          "config": {
+            "claim.name": "resource_access.${client_id}.roles",
+            "jsonType.label": "String",
+            "multivalued": "true",
+            "id.token.claim": "true",
+            "access.token.claim": "true",
+            "introspection.token.claim": "true",
+            "userinfo.token.claim": "true"
+          }
+        },
+        {
+          "name": "audience resolve",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-audience-resolve-mapper",
+          "consentRequired": false,
+          "config": {
+            "introspection.token.claim": "true",
+            "access.token.claim": "true"
+          }
+        }
+      ]
+    },
+    {
+      "name": "user-api",
+      "description": "User API standard claims",
+      "protocol": "openid-connect",
+      "attributes": {
+        "include.in.token.scope": "true",
+        "display.on.consent.screen": "false"
+      },
+      "protocolMappers": [
+        {
+          "name": "platform-roles-mapper",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-usermodel-realm-role-mapper",
+          "config": {
+            "claim.name": "platform_roles",
+            "jsonType.label": "String",
+            "multivalued": "true",
+            "id.token.claim": "false",
+            "access.token.claim": "true",
+            "userinfo.token.claim": "false"
+          }
+        }
+      ]
+    },
+    {
+      "name": "entitlement",
+      "description": "Client scope for entitlement tokens",
+      "protocol": "openid-connect",
+      "attributes": {
+        "include.in.token.scope": "false",
+        "display.on.consent.screen": "true",
+        "consent.screen.text": "${entitlementScopeConsentText}"
+      },
+      "protocolMappers": [
+        {
+          "name": "token_type",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-hardcoded-claim-mapper",
+          "config": {
+            "claim.name": "token_type",
+            "claim.value": "entitlement",
+            "jsonType.label": "String",
+            "id.token.claim": "true",
+            "access.token.claim": "true",
+            "userinfo.token.claim": "false"
+          }
+        },
+        {
+          "name": "active_org_slug",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-usermodel-attribute-mapper",
+          "config": {
+            "claim.name": "active_org_slug",
+            "user.attribute": "active_org_slug",
+            "jsonType.label": "String",
+            "id.token.claim": "true",
+            "access.token.claim": "true",
+            "userinfo.token.claim": "false"
+          }
+        },
+        {
+          "name": "org_roles",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-usermodel-attribute-mapper",
+          "config": {
+            "claim.name": "org_roles",
+            "user.attribute": "org_roles",
+            "jsonType.label": "JSON",
+            "id.token.claim": "true",
+            "access.token.claim": "true",
+            "userinfo.token.claim": "false",
+            "multivalued": "true"
+          }
+        },
+        {
+          "name": "platform_roles",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-usermodel-realm-role-mapper",
+          "config": {
+            "claim.name": "platform_roles",
+            "jsonType.label": "String",
+            "id.token.claim": "true",
+            "access.token.claim": "true",
+            "userinfo.token.claim": "false",
+            "multivalued": "true"
+          }
+        }
+      ]
+    }
+  ],
+  "clients": [
+    {
+      "clientId": "user-api",
+      "name": "User API Backend",
+      "description": "User API confidential client for backend operations",
+      "enabled": true,
+      "clientAuthenticatorType": "client-secret",
+      "secret": "${XEMA_KEYCLOAK_CLIENT_SECRET}",
+      "redirectUris": [
+        "http://localhost:3000/*",
+        "http://127.0.0.1:3000/*",
+        "http://localhost:3100/*",
+        "http://127.0.0.1:3100/*"
+      ],
+      "webOrigins": [
+        "http://localhost:3000",
+        "http://127.0.0.1:3000",
+        "http://localhost:3100",
+        "http://127.0.0.1:3100"
+      ],
+      "publicClient": false,
+      "protocol": "openid-connect",
+      "standardFlowEnabled": false,
+      "implicitFlowEnabled": false,
+      "directAccessGrantsEnabled": false,
+      "serviceAccountsEnabled": true,
+      "authorizationServicesEnabled": false,
+      "fullScopeAllowed": true,
+      "defaultClientScopes": [
+        "roles",
+        "openid"
+      ],
+      "attributes": {
+        "access.token.lifespan": "900",
+        "standard.token.exchange.enabled": "true",
+        "standard.token.exchange.enableRefreshRequestedTokenType": "SAME_SESSION"
+      }
+    },
+    {
+      "clientId": "web-app",
+      "name": "Frontend Application",
+      "description": "Public client for frontend applications",
+      "enabled": true,
+      "publicClient": true,
+      "redirectUris": [
+        "http://localhost:3000/*",
+        "http://127.0.0.1:3000/*",
+        "http://localhost:3100/*",
+        "http://127.0.0.1:3100/*"
+      ],
+      "webOrigins": [
+        "http://localhost:3000",
+        "http://127.0.0.1:3000",
+        "http://localhost:3100",
+        "http://127.0.0.1:3100"
+      ],
+      "protocol": "openid-connect",
+      "standardFlowEnabled": true,
+      "implicitFlowEnabled": false,
+      "directAccessGrantsEnabled": false,
+      "defaultClientScopes": [
+        "roles",
+        "openid"
+      ],
+      "optionalClientScopes": [
+        "entitlement"
+      ],
+      "fullScopeAllowed": true,
+      "protocolMappers": [
+        {
+          "name": "user-api-audience",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-audience-mapper",
+          "consentRequired": false,
+          "config": {
+            "included.client.audience": "user-api",
+            "id.token.claim": "false",
+            "access.token.claim": "true",
+            "introspection.token.claim": "true"
+          }
+        }
+      ]
+    },
+    {
+      "clientId": "xema-cli",
+      "name": "Xema CLI",
+      "description": "Public device-authorization client for the Xema command-line interface",
+      "enabled": true,
+      "publicClient": true,
+      "protocol": "openid-connect",
+      "serviceAccountsEnabled": false,
+      "standardFlowEnabled": false,
+      "implicitFlowEnabled": false,
+      "directAccessGrantsEnabled": false,
+      "defaultClientScopes": [
+        "openid",
+        "profile",
+        "email"
+      ],
+      "optionalClientScopes": [
+        "offline_access"
+      ],
+      "attributes": {
+        "oauth2.device.authorization.grant.enabled": "true",
+        "serviceType": "PUBLIC_DEVICE"
+      }
+    }
+  ],
+  "users": [
+    {
+      "username": "${XEMA_KEYCLOAK_ADMIN_USERNAME}",
+      "email": "${XEMA_KEYCLOAK_ADMIN_USERNAME}",
+      "firstName": "Admin",
+      "lastName": "User",
+      "enabled": true,
+      "emailVerified": true,
+      "credentials": [
+        {
+          "type": "password",
+          "value": "${XEMA_KEYCLOAK_ADMIN_PASSWORD}",
+          "temporary": false
+        }
+      ],
+      "realmRoles": [
+        "platform_admin",
+        "user"
+      ],
+      "attributes": {
+        "platformRoles": [
+          "platform_admin"
+        ]
+      }
+    },
+    {
+      "username": "service-account-user-api",
+      "enabled": true,
+      "serviceAccountClientId": "user-api",
+      "realmRoles": [
+        "micro-service"
+      ],
+      "clientRoles": {
+        "realm-management": [
+          "realm-admin"
+        ]
+      }
+    }
+  ],
+  "components": {
+    "org.keycloak.userprofile.UserProfileProvider": [
+      {
+        "providerId": "declarative-user-profile",
+        "config": {
+          "kc.user.profile.config": [
+            "{\"attributes\":[{\"name\":\"username\",\"displayName\":\"${username}\",\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]}},{\"name\":\"email\",\"displayName\":\"${email}\",\"required\":{\"roles\":[\"user\"]},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]}},{\"name\":\"firstName\",\"displayName\":\"${firstName}\",\"required\":{\"roles\":[\"user\"]},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]}},{\"name\":\"lastName\",\"displayName\":\"${lastName}\",\"required\":{\"roles\":[\"user\"]},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]}},{\"name\":\"platformRoles\",\"displayName\":\"Platform Roles\",\"permissions\":{\"view\":[\"admin\"],\"edit\":[\"admin\"]},\"multivalued\":true}],\"unmanagedAttributePolicy\":\"ADMIN_EDIT\"}"
+          ]
+        }
+      }
+    ]
+  }
+}