@xemahq/xema 0.13.0 → 0.15.0

package/dist/commands/installation.js

@@ -0,0 +1,258 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerCommand = registerCommand;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const yaml_1 = require("yaml");
+const cli_errors_1 = require("../lib/cli-errors");
+const exit_codes_1 = require("../lib/exit-codes");
+const loader_1 = require("../runtime/config/loader");
+const foreground_1 = require("../runtime/foreground");
+const installation_1 = require("../runtime/installation");
+const launch_1 = require("../runtime/launch");
+const managed_local_secret_store_1 = require("../runtime/secrets/managed-local-secret-store");
+function registerCommand(program) {
+    const installation = program
+        .command('installation')
+        .summary('Plan, apply, inspect, and diagnose this Xema installation')
+        .description('Create or validate XemaInstallation setup documents and compile the current ' +
+        'xema.config.yaml launcher input through the same desired-state engine.');
+    installation
+        .command('init')
+        .summary('Create a developer, starter, or single-node installation file')
+        .requiredOption('--profile <profile>', `One of: ${(0, installation_1.setupInstallationProfiles)().join(' | ')}`)
+        .option('--name <name>', 'Installation name', 'xema')
+        .option('--edition <edition>', 'Distribution edition', 'oss')
+        .option('--output <path>', 'Output installation file', 'xema.installation.yaml')
+        .option('--force', 'Replace an existing installation file', false)
+        .action(async (opts) => {
+        await runGuarded('init', async () => {
+            const output = (0, node_path_1.resolve)(opts.output);
+            if ((0, node_fs_1.existsSync)(output) && !opts.force) {
+                throw new Error(`Installation output already exists at ${output}; pass --force to replace it.`);
+            }
+            const profile = (0, installation_1.parseSetupInstallationProfile)(opts.profile);
+            const template = (0, installation_1.createInstallationProfileTemplate)(profile, opts.name, opts.edition);
+            const desired = (0, installation_1.compileXemaInstallation)(template);
+            (0, installation_1.renderInstallationSetup)(desired);
+            (0, node_fs_1.writeFileSync)(output, (0, yaml_1.stringify)(template), {
+                encoding: 'utf8',
+                flag: opts.force ? 'w' : 'wx',
+            });
+            console.log(`Wrote ${output} for ${profile} (${desired.effectivePlanHash}).`);
+            console.log(`Next: xema installation doctor --file ${JSON.stringify(output)}`);
+        });
+    });
+    installation
+        .command('doctor')
+        .summary('Validate setup profile, provider readiness, and render obligations')
+        .requiredOption('--file <path>', 'Path to xema.installation.yaml')
+        .option('--available-provider <provider...>', 'Explicitly confirm configured Kubernetes/external provider availability')
+        .action(async (opts) => {
+        await runGuarded('doctor', async () => {
+            const path = (0, node_path_1.resolve)(opts.file);
+            const desired = (0, installation_1.compileXemaInstallation)((0, yaml_1.parse)((0, node_fs_1.readFileSync)(path, 'utf8')));
+            const readiness = await providerReadiness(desired, opts.availableProvider ?? [], path);
+            const rendering = (0, installation_1.renderInstallationSetup)(desired, {
+                providers: readiness,
+            });
+            console.log(`Profile: ${rendering.profile}`);
+            console.log(`Effective hash: ${rendering.effectivePlanHash}`);
+            console.log(`Providers: ${readiness.length === 0 ? 'none required' : 'ready'}`);
+            console.log(`Artifacts: ${String(rendering.artifacts.length)}`);
+            console.log(`Obligations: ${rendering.renderedArtifacts
+                .map((item) => item.obligation)
+                .join(', ')}`);
+            if (rendering.profile === installation_1.InstallationProfile.SingleNodeProduction) {
+                console.log('Executor: unavailable — single-node apply requires an artifact-consuming Kubernetes executor; the per-service Helm runner is not accepted as readiness proof.');
+            }
+            else {
+                console.log('Readiness: apply will prove the exact distribution-lock workload roster before committing state.');
+            }
+            console.log('Setup doctor passed without applying side effects.');
+        });
+    });
+    installation
+        .command('plan')
+        .summary('Compile and display a redacted deterministic installation plan')
+        .option('--config <path>', 'Path to xema.config.yaml')
+        .action(async (opts) => {
+        await runGuarded('plan', async () => {
+            const loaded = loadAndCompile(opts);
+            console.log((0, installation_1.formatInstallationPlan)((0, installation_1.planInstallation)(loaded.desired, new installation_1.InstallationStateStore())));
+        });
+    });
+    installation
+        .command('apply')
+        .summary('Apply the compiled installation plan through the shared launcher')
+        .option('--config <path>', 'Path to xema.config.yaml')
+        .option('--web', 'Also start the host-shell frontend', false)
+        .option('--detach', 'Return after container workloads are ready (container substrate only)', false)
+        .option('--allow-destructive', 'Authorize a reviewed destructive installation transition', false)
+        .action(async (opts) => {
+        await runGuarded('apply', async () => {
+            const loaded = loadAndCompile(opts);
+            const store = new installation_1.InstallationStateStore();
+            const preview = (0, installation_1.planInstallation)(loaded.desired, store);
+            console.log((0, installation_1.formatInstallationPlan)(preview));
+            const rendering = (0, installation_1.renderCurrentLauncherPlan)(loaded.desired);
+            const result = await (0, installation_1.applyInstallation)(loaded.desired, store, (onReady) => (0, foreground_1.bringUpForeground)({
+                config: rendering.config,
+                includeWeb: rendering.config.app.web.enabled,
+                detach: opts.detach,
+                installationIdentity: loaded.installationIdentity,
+                installationId: loaded.desired.metadata.name,
+                planHash: loaded.desired.effectivePlanHash,
+                onReady: async (handle) => {
+                    await onReady(await (0, installation_1.proveLocalLaunchReadiness)(handle, loaded.desired.effectivePlanHash));
+                },
+            }), {
+                allowDestructive: opts.allowDestructive,
+                forceExecution: true,
+                renderedArtifacts: rendering.renderedArtifacts,
+            });
+            console.log(result.executed
+                ? `Applied installation plan ${result.desired.effectivePlanHash}.`
+                : `No changes — installation plan ${result.desired.effectivePlanHash} is already applied.`);
+        });
+    });
+    installation
+        .command('status')
+        .summary('Compare desired, last-applied, and observed installation state')
+        .option('--config <path>', 'Path to xema.config.yaml')
+        .action(async (opts) => {
+        await runGuarded('status', async () => {
+            const loaded = loadAndCompile(opts);
+            const store = new installation_1.InstallationStateStore();
+            const observedPlan = store.read(loaded.desired.metadata.name)?.plan ?? loaded.desired;
+            const expectation = resolveStatusExpectation(loaded, observedPlan);
+            const report = await (0, installation_1.installationStatus)(loaded.desired, store, expectation);
+            console.log(JSON.stringify(report, null, 2));
+        });
+    });
+    installation
+        .command('support-bundle')
+        .summary('Write a redacted, integrity-hashed diagnostic bundle')
+        .option('--config <path>', 'Path to xema.config.yaml')
+        .option('--output <path>', 'Output JSON path')
+        .option('--force', 'Replace an existing output file', false)
+        .action(async (opts) => {
+        await runGuarded('support-bundle', async () => {
+            const loaded = loadAndCompile(opts);
+            const store = new installation_1.InstallationStateStore();
+            const observedPlan = store.read(loaded.desired.metadata.name)?.plan ?? loaded.desired;
+            const expectation = resolveStatusExpectation(loaded, observedPlan);
+            const report = await (0, installation_1.installationStatus)(loaded.desired, store, expectation);
+            const bundle = (0, installation_1.createSupportBundle)(loaded.config, loaded.desired, report);
+            const output = (0, node_path_1.resolve)(opts.output ?? `xema-support-${loaded.desired.metadata.name}.json`);
+            (0, installation_1.writeSupportBundle)(output, bundle, { overwrite: opts.force });
+            console.log(`Wrote redacted support bundle ${output} (${bundle.manifest.algorithm}:${bundle.manifest.payloadHash}).`);
+        });
+    });
+}
+function resolveStatusExpectation(loaded, observedPlan) {
+    const config = observedPlan.effectivePlanHash === loaded.desired.effectivePlanHash
+        ? loaded.config
+        : (0, installation_1.launcherConfigFromInstallation)(observedPlan);
+    const plan = (0, launch_1.resolveLaunchPlan)({
+        config,
+        includeWeb: config.app.web.enabled,
+        installationIdentity: loaded.installationIdentity,
+        offline: true,
+    });
+    return (0, installation_1.readinessExpectationFromLaunchPlan)(plan, observedPlan.effectivePlanHash, observedPlan.metadata.name);
+}
+async function providerReadiness(desired, available, installationIdentity) {
+    const declared = new Set();
+    const baseDirectory = (0, node_path_1.dirname)(installationIdentity);
+    for (const value of available) {
+        if (!Object.values(installation_1.SecretReferenceProvider).includes(value)) {
+            throw new Error(`Unknown secret provider readiness value "${value}".`);
+        }
+        declared.add(value);
+    }
+    const readiness = new Map();
+    for (const binding of desired.spec.secrets) {
+        const provider = binding.provider;
+        if (provider === installation_1.SecretReferenceProvider.Environment) {
+            const value = process.env[binding.variable];
+            if (value === undefined || value.length === 0) {
+                throw new Error(`Environment provider is unresolved for binding "${binding.name}"; ${binding.variable} is unset or empty.`);
+            }
+            readiness.set(provider, { provider, available: true });
+            continue;
+        }
+        if (provider === installation_1.SecretReferenceProvider.File) {
+            const path = (0, node_path_1.isAbsolute)(binding.path)
+                ? binding.path
+                : (0, node_path_1.resolve)(baseDirectory, binding.path);
+            const metadata = (0, node_fs_1.lstatSync)(path);
+            if (!metadata.isFile() || metadata.size === 0) {
+                throw new Error(`File provider is unresolved for binding "${binding.name}"; its source must be a non-empty regular file.`);
+            }
+            if (process.platform !== 'win32' && (metadata.mode & 0o077) !== 0) {
+                throw new Error(`File provider is unsafe for binding "${binding.name}"; its source must have mode 0600 or stricter.`);
+            }
+            readiness.set(provider, { provider, available: true });
+            continue;
+        }
+        if (provider === installation_1.SecretReferenceProvider.Prompt) {
+            if (process.stdin.isTTY !== true || process.stderr.isTTY !== true) {
+                throw new Error(`Prompt provider is unavailable for binding "${binding.name}" outside an interactive terminal.`);
+            }
+            readiness.set(provider, { provider, available: true });
+            continue;
+        }
+        if (provider === installation_1.SecretReferenceProvider.ManagedLocal) {
+            const store = new managed_local_secret_store_1.ManagedLocalSecretStore({ installationIdentity });
+            if (!(await store.verify(binding.entry))) {
+                throw new Error(`Managed-local binding "${binding.name}" has no authenticated immutable entry "${binding.entry}".`);
+            }
+            readiness.set(provider, {
+                provider,
+                available: true,
+                keyRef: store.keyReference(),
+                resolvedEntries: [
+                    ...(readiness.get(provider)?.resolvedEntries ?? []),
+                    binding.entry,
+                ],
+            });
+            continue;
+        }
+        if (!declared.has(provider)) {
+            throw new Error(`Secret provider ${provider} has not been confirmed available; no fallback provider was attempted.`);
+        }
+        readiness.set(provider, { provider, available: true });
+    }
+    return [...readiness.values()];
+}
+function loadAndCompile(opts) {
+    return (0, cli_errors_1.asConfigError)(() => {
+        const loaded = (0, loader_1.loadXemaConfig)({ explicit: opts.config });
+        const sourceConfig = opts.web === true
+            ? {
+                ...loaded.config,
+                app: {
+                    ...loaded.config.app,
+                    web: { ...loaded.config.app.web, enabled: true },
+                },
+            }
+            : loaded.config;
+        const desired = (0, installation_1.compileCurrentInstallation)(sourceConfig, loaded.installationIdentity);
+        return {
+            config: sourceConfig,
+            installationIdentity: loaded.installationIdentity,
+            desired,
+        };
+    });
+}
+async function runGuarded(command, operation) {
+    try {
+        await operation();
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        (0, exit_codes_1.exitWith)((0, cli_errors_1.lifecycleExitCode)(error), `xema installation ${command} failed: ${message}`);
+    }
+}
+//# sourceMappingURL=installation.js.map

package/dist/commands/installation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installation.js","sourceRoot":"","sources":["../../src/commands/installation.ts"],"names":[],"mappings":";;AAqEA,0CA4NC;AAjSD,qCAKiB;AACjB,yCAAyD;AAEzD,+BAAsE;AAEtE,kDAAqE;AACrE,kDAA6C;AAC7C,qDAA0D;AAC1D,sDAA0D;AAC1D,0DAoBiC;AACjC,8CAAsD;AACtD,8FAAwF;AAiCxF,SAAgB,eAAe,CAAC,OAAgB;IAC9C,MAAM,YAAY,GAAG,OAAO;SACzB,OAAO,CAAC,cAAc,CAAC;SACvB,OAAO,CAAC,2DAA2D,CAAC;SACpE,WAAW,CACV,8EAA8E;QAC5E,wEAAwE,CAC3E,CAAC;IAEJ,YAAY;SACT,OAAO,CAAC,MAAM,CAAC;SACf,OAAO,CAAC,+DAA+D,CAAC;SACxE,cAAc,CACb,qBAAqB,EACrB,WAAW,IAAA,wCAAyB,GAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CACrD;SACA,MAAM,CAAC,eAAe,EAAE,mBAAmB,EAAE,MAAM,CAAC;SACpD,MAAM,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,KAAK,CAAC;SAC5D,MAAM,CAAC,iBAAiB,EAAE,0BAA0B,EAAE,wBAAwB,CAAC;SAC/E,MAAM,CAAC,SAAS,EAAE,uCAAuC,EAAE,KAAK,CAAC;SACjE,MAAM,CAAC,KAAK,EAAE,IAA6B,EAAE,EAAE;QAC9C,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;YAClC,MAAM,MAAM,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,IAAA,oBAAU,EAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CACb,yCAAyC,MAAM,+BAA+B,CAC/E,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,IAAA,4CAA6B,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5D,MAAM,QAAQ,GAAG,IAAA,gDAAiC,EAChD,OAAO,EACP,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,OAAO,CACb,CAAC;YACF,MAAM,OAAO,GAAG,IAAA,sCAAuB,EAAC,QAAQ,CAAC,CAAC;YAClD,IAAA,sCAAuB,EAAC,OAAO,CAAC,CAAC;YACjC,IAAA,uBAAa,EAAC,MAAM,EAAE,IAAA,gBAAa,EAAC,QAAQ,CAAC,EAAE;gBAC7C,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;aAC9B,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CACT,SAAS,MAAM,QAAQ,OAAO,KAAK,OAAO,CAAC,iBAAiB,IAAI,CACjE,CAAC;YACF,OAAO,CAAC,GAAG,CACT,yCAAyC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAClE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,YAAY;SACT,OAAO,CAAC,QAAQ,CAAC;SACjB,OAAO,CAAC,oEAAoE,CAAC;SAC7E,cAAc,CAAC,eAAe,EAAE,gCAAgC,CAAC;SACjE,MAAM,CACL,oCAAoC,EACpC,yEAAyE,CAC1E;SACA,MAAM,CAAC,KAAK,EAAE,IAA+B,EAAE,EAAE;QAChD,MAAM,UAAU,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YACpC,MAAM,IAAI,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,OAAO,GAAG,IAAA,sCAAuB,EACrC,IAAA,YAAS,EAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CACjD,CAAC;YACF,MAAM,SAAS,GAAG,MAAM,iBAAiB,CACvC,OAAO,EACP,IAAI,CAAC,iBAAiB,IAAI,EAAE,EAC5B,IAAI,CACL,CAAC;YACF,MAAM,SAAS,GAAG,IAAA,sCAAuB,EAAC,OAAO,EAAE;gBACjD,SAAS,EAAE,SAAS;aACrB,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,YAAY,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,mBAAmB,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC;YAC9D,OAAO,CAAC,GAAG,CACT,cAAc,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,EAAE,CACnE,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChE,OAAO,CAAC,GAAG,CACT,gBAAgB,SAAS,CAAC,iBAAiB;iBACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;iBAC9B,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;YACF,IAAI,SAAS,CAAC,OAAO,KAAK,kCAAmB,CAAC,oBAAoB,EAAE,CAAC;gBACnE,OAAO,CAAC,GAAG,CACT,+JAA+J,CAChK,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,kGAAkG,CACnG,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,YAAY;SACT,OAAO,CAAC,MAAM,CAAC;SACf,OAAO,CAAC,gEAAgE,CAAC;SACzE,MAAM,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;SACrD,MAAM,CAAC,KAAK,EAAE,IAAyB,EAAE,EAAE;QAC1C,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;YAClC,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YACpC,OAAO,CAAC,GAAG,CACT,IAAA,qCAAsB,EACpB,IAAA,+BAAgB,EAAC,MAAM,CAAC,OAAO,EAAE,IAAI,qCAAsB,EAAE,CAAC,CAC/D,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,YAAY;SACT,OAAO,CAAC,OAAO,CAAC;SAChB,OAAO,CAAC,kEAAkE,CAAC;SAC3E,MAAM,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;SACrD,MAAM,CAAC,OAAO,EAAE,oCAAoC,EAAE,KAAK,CAAC;SAC5D,MAAM,CACL,UAAU,EACV,uEAAuE,EACvE,KAAK,CACN;SACA,MAAM,CACL,qBAAqB,EACrB,0DAA0D,EAC1D,KAAK,CACN;SACA,MAAM,CAAC,KAAK,EAAE,IAA8B,EAAE,EAAE;QAC/C,MAAM,UAAU,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACnC,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,qCAAsB,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAA,+BAAgB,EAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,IAAA,qCAAsB,EAAC,OAAO,CAAC,CAAC,CAAC;YAC7C,MAAM,SAAS,GAAG,IAAA,wCAAyB,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,MAAM,IAAA,gCAAiB,EACpC,MAAM,CAAC,OAAO,EACd,KAAK,EACL,CAAC,OAAO,EAAE,EAAE,CACV,IAAA,8BAAiB,EAAC;gBAChB,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO;gBAC5C,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;gBACjD,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAC5C,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,iBAAiB;gBAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBACxB,MAAM,OAAO,CACX,MAAM,IAAA,wCAAyB,EAC7B,MAAM,EACN,MAAM,CAAC,OAAO,CAAC,iBAAiB,CACjC,CACF,CAAC;gBACJ,CAAC;aACF,CAAC,EACJ;gBACE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBAGvC,cAAc,EAAE,IAAI;gBACpB,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;aAC/C,CACF,CAAC;YACF,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,QAAQ;gBACb,CAAC,CAAC,6BAA6B,MAAM,CAAC,OAAO,CAAC,iBAAiB,GAAG;gBAClE,CAAC,CAAC,kCAAkC,MAAM,CAAC,OAAO,CAAC,iBAAiB,sBAAsB,CAC7F,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,YAAY;SACT,OAAO,CAAC,QAAQ,CAAC;SACjB,OAAO,CAAC,gEAAgE,CAAC;SACzE,MAAM,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;SACrD,MAAM,CAAC,KAAK,EAAE,IAAyB,EAAE,EAAE;QAC1C,MAAM,UAAU,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YACpC,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,qCAAsB,EAAE,CAAC;YAC3C,MAAM,YAAY,GAChB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC;YACnE,MAAM,WAAW,GAAG,wBAAwB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACnE,MAAM,MAAM,GAAG,MAAM,IAAA,iCAAkB,EACrC,MAAM,CAAC,OAAO,EACd,KAAK,EACL,WAAW,CACZ,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,YAAY;SACT,OAAO,CAAC,gBAAgB,CAAC;SACzB,OAAO,CAAC,sDAAsD,CAAC;SAC/D,MAAM,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;SACrD,MAAM,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;SAC7C,MAAM,CAAC,SAAS,EAAE,iCAAiC,EAAE,KAAK,CAAC;SAC3D,MAAM,CAAC,KAAK,EAAE,IAAgC,EAAE,EAAE;QACjD,MAAM,UAAU,CAAC,gBAAgB,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,qCAAsB,EAAE,CAAC;YAC3C,MAAM,YAAY,GAChB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC;YACnE,MAAM,WAAW,GAAG,wBAAwB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACnE,MAAM,MAAM,GAAG,MAAM,IAAA,iCAAkB,EACrC,MAAM,CAAC,OAAO,EACd,KAAK,EACL,WAAW,CACZ,CAAC;YACF,MAAM,MAAM,GAAG,IAAA,kCAAmB,EAChC,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,OAAO,EACd,MAAM,CACP,CAAC;YACF,MAAM,MAAM,GAAG,IAAA,mBAAO,EACpB,IAAI,CAAC,MAAM,IAAI,gBAAgB,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CACnE,CAAC;YACF,IAAA,iCAAkB,EAAC,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9D,OAAO,CAAC,GAAG,CACT,iCAAiC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,IAAI,CACzG,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAAyC,EACzC,YAA2D;IAE3D,MAAM,MAAM,GACV,YAAY,CAAC,iBAAiB,KAAK,MAAM,CAAC,OAAO,CAAC,iBAAiB;QACjE,CAAC,CAAC,MAAM,CAAC,MAAM;QACf,CAAC,CAAC,IAAA,6CAA8B,EAAC,YAAY,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAA,0BAAiB,EAAC;QAC7B,MAAM;QACN,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO;QAClC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IACH,OAAO,IAAA,iDAAkC,EACvC,IAAI,EACJ,YAAY,CAAC,iBAAiB,EAC9B,YAAY,CAAC,QAAQ,CAAC,IAAI,CAC3B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,OAAmD,EACnD,SAA4B,EAC5B,oBAA4B;IAS5B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IACpD,MAAM,aAAa,GAAG,IAAA,mBAAO,EAAC,oBAAoB,CAAC,CAAC;IACpD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IACE,CAAC,MAAM,CAAC,MAAM,CAAC,sCAAuB,CAAC,CAAC,QAAQ,CAC9C,KAAgC,CACjC,EACD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,KAAK,IAAI,CAAC,CAAC;QACzE,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,KAAgC,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAQtB,CAAC;IACJ,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,QAAQ,KAAK,sCAAuB,CAAC,WAAW,EAAE,CAAC;YACrD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CACb,mDAAmD,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,QAAQ,qBAAqB,CAC3G,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,KAAK,sCAAuB,CAAC,IAAI,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,IAAA,sBAAU,EAAC,OAAO,CAAC,IAAI,CAAC;gBACnC,CAAC,CAAC,OAAO,CAAC,IAAI;gBACd,CAAC,CAAC,IAAA,mBAAO,EAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,IAAA,mBAAS,EAAC,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CACb,4CAA4C,OAAO,CAAC,IAAI,iDAAiD,CAC1G,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,KAAK,CACb,wCAAwC,OAAO,CAAC,IAAI,gDAAgD,CACrG,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,KAAK,sCAAuB,CAAC,MAAM,EAAE,CAAC;YAChD,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBAClE,MAAM,IAAI,KAAK,CACb,+CAA+C,OAAO,CAAC,IAAI,oCAAoC,CAChG,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,KAAK,sCAAuB,CAAC,YAAY,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,IAAI,oDAAuB,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CACb,0BAA0B,OAAO,CAAC,IAAI,2CAA2C,OAAO,CAAC,KAAK,IAAI,CACnG,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE;gBACtB,QAAQ;gBACR,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,KAAK,CAAC,YAAY,EAAE;gBAC5B,eAAe,EAAE;oBACf,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,eAAe,IAAI,EAAE,CAAC;oBACnD,OAAO,CAAC,KAAK;iBACd;aACF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,wEAAwE,CACpG,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CAAC,IAAyB;IAK/C,OAAO,IAAA,0BAAa,EAAC,GAAG,EAAE;QACxB,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACzD,MAAM,YAAY,GAChB,IAAI,CAAC,GAAG,KAAK,IAAI;YACf,CAAC,CAAC;gBACE,GAAG,MAAM,CAAC,MAAM;gBAChB,GAAG,EAAE;oBACH,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG;oBACpB,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;iBACjD;aACF;YACH,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;QACpB,MAAM,OAAO,GAAG,IAAA,yCAA0B,EACxC,YAAY,EACZ,MAAM,CAAC,oBAAoB,CAC5B,CAAC;QACF,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;YACjD,OAAO;SACR,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,SAA8B;IAE9B,IAAI,CAAC;QACH,MAAM,SAAS,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,IAAA,qBAAQ,EACN,IAAA,8BAAiB,EAAC,KAAK,CAAC,EACxB,qBAAqB,OAAO,YAAY,OAAO,EAAE,CAClD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/commands/license.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+export declare function registerCommand(program: Command): void;
+//# sourceMappingURL=license.d.ts.map

package/dist/commands/license.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../../src/commands/license.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYzC,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsCtD"}

package/dist/commands/license.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerCommand = registerCommand;
+const node_fs_1 = require("node:fs");
+const exit_codes_1 = require("../lib/exit-codes");
+const loader_1 = require("../runtime/config/loader");
+const license_report_1 = require("../runtime/license/license-report");
+const license_store_1 = require("../runtime/license/license-store");
+const resolve_license_1 = require("../runtime/license/resolve-license");
+const store_license_1 = require("../runtime/license/store-license");
+function registerCommand(program) {
+    const license = program
+        .command('license')
+        .summary('Inspect and apply the Xema license')
+        .description('A license says which editions, biomes and capability classes this ' +
+        'installation may run. The open-source edition needs no license at all — ' +
+        'one is compiled into the CLI — so these commands are for a commercial ' +
+        'or appliance license.');
+    license
+        .command('apply')
+        .argument('<file>', 'File holding the license (a single-line compact JWS), or `-` for stdin.')
+        .summary('Install or replace this machine\'s license')
+        .description('Verify a license and store it in the credential store ' +
+        `(${license_store_1.LICENSE_STORE_DESCRIPTION}). The file is read, never echoed. A license ` +
+        'that does not verify is REFUSED and nothing is written.')
+        .action((file) => {
+        runApply(file);
+    });
+    license
+        .command('show')
+        .summary('Report the license state and what it entitles')
+        .description('Print which license is in force, where it sits on the expiry ladder, and ' +
+        'whether it entitles the configured edition. Never prints the license itself.')
+        .option('--config <path>', 'Path to xema.config.yaml (selects the edition).')
+        .action((opts) => {
+        runShow(opts.config);
+    });
+}
+function readLicenseInput(file) {
+    const raw = file === '-' ? (0, node_fs_1.readFileSync)(0, 'utf8') : (0, node_fs_1.readFileSync)(file, 'utf8');
+    const token = raw.trim();
+    if (token.length === 0) {
+        throw new Error(file === '-'
+            ? 'stdin carried no license.'
+            : `${file} is empty — it must hold the license token.`);
+    }
+    return token;
+}
+function runApply(file) {
+    let token;
+    try {
+        token = readLicenseInput(file);
+    }
+    catch (err) {
+        return (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.ConfigurationError, `xema license apply: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const stored = (0, store_license_1.storeCustomerLicense)(token);
+    if (!stored.ok) {
+        return (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.ConfigurationError, [
+            `xema license apply: refused — the license did not verify (${stored.code}).`,
+            `  ${stored.message}`,
+            '',
+            stored.remediation,
+        ].join('\n'));
+    }
+    console.log(`✓ License stored — ${license_store_1.LICENSE_STORE_DESCRIPTION}`);
+    console.log(`  ${(0, license_report_1.describeLicenseState)(stored.resolution)}`);
+    for (const warning of (0, license_report_1.licenseWarnings)(stored.resolution)) {
+        console.log(`  ${warning}`);
+    }
+    console.log('');
+    console.log('Check what it entitles with `xema license show`.');
+    (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.Ok);
+}
+function runShow(configPath) {
+    const resolution = (0, resolve_license_1.resolveEffectiveLicense)();
+    if (!resolution.ok) {
+        return (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.GenericError, [
+            `xema license: no license is in force (${resolution.code}).`,
+            `  ${resolution.message}`,
+            '',
+            resolution.remediation,
+        ].join('\n'));
+    }
+    console.log((0, license_report_1.describeLicenseState)(resolution));
+    const { config } = (0, loader_1.loadXemaConfig)(configPath !== undefined ? { explicit: configPath } : {});
+    for (const line of (0, license_report_1.describeEditionEntitlement)((0, license_report_1.evaluateEditionEntitlement)(resolution, config.edition))) {
+        console.log(line);
+    }
+    const warnings = (0, license_report_1.licenseWarnings)(resolution);
+    for (const warning of warnings) {
+        console.log('');
+        console.log(warning);
+    }
+    (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.Ok);
+}
+//# sourceMappingURL=license.js.map

package/dist/commands/license.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license.js","sourceRoot":"","sources":["../../src/commands/license.ts"],"names":[],"mappings":";;AA0BA,0CAsCC;AAhED,qCAAuC;AAEvC,kDAA8D;AAC9D,qDAA0D;AAC1D,sEAK2C;AAC3C,oEAA6E;AAC7E,wEAA6E;AAC7E,oEAAwE;AAcxE,SAAgB,eAAe,CAAC,OAAgB;IAC9C,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,OAAO,CAAC,oCAAoC,CAAC;SAC7C,WAAW,CACV,oEAAoE;QAClE,0EAA0E;QAC1E,wEAAwE;QACxE,uBAAuB,CAC1B,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,QAAQ,CACP,QAAQ,EACR,yEAAyE,CAC1E;SACA,OAAO,CAAC,4CAA4C,CAAC;SACrD,WAAW,CACV,wDAAwD;QACtD,IAAI,yCAAyB,+CAA+C;QAC5E,yDAAyD,CAC5D;SACA,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;QACvB,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,OAAO,CAAC,+CAA+C,CAAC;SACxD,WAAW,CACV,2EAA2E;QACzE,8EAA8E,CACjF;SACA,MAAM,CAAC,iBAAiB,EAAE,iDAAiD,CAAC;SAC5E,MAAM,CAAC,CAAC,IAAyB,EAAE,EAAE;QACpC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACP,CAAC;AAGD,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,GAAG,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAA,sBAAY,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,IAAI,KAAK,GAAG;YACV,CAAC,CAAC,2BAA2B;YAC7B,CAAC,CAAC,GAAG,IAAI,6CAA6C,CACzD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAA,qBAAQ,EACb,4BAAe,CAAC,kBAAkB,EAClC,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,oCAAoB,EAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,IAAA,qBAAQ,EACb,4BAAe,CAAC,kBAAkB,EAClC;YACE,6DAA6D,MAAM,CAAC,IAAI,IAAI;YAC5E,KAAK,MAAM,CAAC,OAAO,EAAE;YACrB,EAAE;YACF,MAAM,CAAC,WAAW;SACnB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,sBAAsB,yCAAyB,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,qCAAoB,EAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC5D,KAAK,MAAM,OAAO,IAAI,IAAA,gCAAe,EAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,IAAA,qBAAQ,EAAC,4BAAe,CAAC,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,OAAO,CAAC,UAA8B;IAC7C,MAAM,UAAU,GAAG,IAAA,yCAAuB,GAAE,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,IAAA,qBAAQ,EACb,4BAAe,CAAC,YAAY,EAC5B;YACE,yCAAyC,UAAU,CAAC,IAAI,IAAI;YAC5D,KAAK,UAAU,CAAC,OAAO,EAAE;YACzB,EAAE;YACF,UAAU,CAAC,WAAW;SACvB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAA,qCAAoB,EAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,uBAAc,EAC/B,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CACzD,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,IAAA,2CAA0B,EAC3C,IAAA,2CAA0B,EAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CACvD,EAAE,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,gCAAe,EAAC,UAAU,CAAC,CAAC;IAC7C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IACD,IAAA,qBAAQ,EAAC,4BAAe,CAAC,EAAE,CAAC,CAAC;AAC/B,CAAC"}

package/dist/commands/login.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from 'commander';
+export declare const ISSUER_ENV_VAR = "XEMA_ISSUER";
+export declare function registerCommand(program: Command): void;
+//# sourceMappingURL=login.d.ts.map

package/dist/commands/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzC,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAQ5C,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2BtD"}

package/dist/commands/login.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ISSUER_ENV_VAR = void 0;
+exports.registerCommand = registerCommand;
+const exit_codes_1 = require("../lib/exit-codes");
+const device_flow_1 = require("../runtime/auth/device-flow");
+const session_auth_1 = require("../runtime/auth/session-auth");
+const session_store_1 = require("../runtime/auth/session-store");
+const token_claims_1 = require("../runtime/auth/token-claims");
+exports.ISSUER_ENV_VAR = 'XEMA_ISSUER';
+function registerCommand(program) {
+    program
+        .command('login')
+        .description('Sign in to a Xema deployment via device-code login')
+        .option('--endpoint <url>', 'Platform API base URL (or env XEMA_ENDPOINT)')
+        .option('--issuer <url>', `OIDC issuer URL (or env ${exports.ISSUER_ENV_VAR})`)
+        .option('--client-id <id>', `Realm client id used for the device grant (default: ${device_flow_1.DEFAULT_CLI_CLIENT_ID})`)
+        .action(async (opts) => {
+        await runLogin(opts);
+    });
+    program
+        .command('logout')
+        .description('Remove the stored Xema session')
+        .action(() => {
+        runLogout();
+    });
+    program
+        .command('whoami')
+        .description('Show the current Xema session')
+        .action(async () => {
+        await runWhoami();
+    });
+}
+function requireValue(fromFlag, envVar, flagName, label) {
+    const value = fromFlag ?? process.env[envVar];
+    if (value === undefined || value.length === 0) {
+        return (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.ConfigurationError, `No ${label}. Pass ${flagName} <url> or set ${envVar}.`);
+    }
+    return value;
+}
+async function runLogin(opts) {
+    const endpoint = requireValue(opts.endpoint, 'XEMA_ENDPOINT', '--endpoint', 'platform endpoint').replace(/\/+$/, '');
+    const issuer = requireValue(opts.issuer, exports.ISSUER_ENV_VAR, '--issuer', 'OIDC issuer').replace(/\/+$/, '');
+    const clientId = opts.clientId !== undefined && opts.clientId.length > 0
+        ? opts.clientId
+        : device_flow_1.DEFAULT_CLI_CLIENT_ID;
+    const deps = (0, device_flow_1.defaultDeviceFlowDeps)();
+    try {
+        const endpoints = await (0, device_flow_1.discoverOidcEndpoints)(issuer, deps);
+        const authorization = await (0, device_flow_1.requestDeviceAuthorization)(endpoints, clientId, deps);
+        console.log('');
+        console.log(`  Open:  ${authorization.verificationUri}`);
+        console.log(`  Code:  ${authorization.userCode}`);
+        if (authorization.verificationUriComplete !== undefined) {
+            console.log('');
+            console.log(`  Or go straight to: ${authorization.verificationUriComplete}`);
+        }
+        console.log('');
+        console.log('Waiting for approval…');
+        const tokens = await (0, device_flow_1.pollForDeviceTokens)(endpoints, clientId, authorization, deps);
+        const subject = (0, token_claims_1.displaySubjectFromToken)(tokens.accessToken);
+        const session = {
+            endpoint,
+            issuer: endpoints.issuer,
+            clientId,
+            accessToken: tokens.accessToken,
+            ...(tokens.refreshToken !== undefined
+                ? { refreshToken: tokens.refreshToken }
+                : {}),
+            expiresAt: tokens.expiresAt,
+            ...(subject !== undefined ? { subject } : {}),
+        };
+        (0, session_store_1.writeSession)(session);
+        console.log('');
+        console.log(subject !== undefined
+            ? `Signed in as ${subject} → ${endpoint}`
+            : `Signed in → ${endpoint}`);
+        if (tokens.refreshToken === undefined) {
+            console.log('Note: the identity provider returned no refresh token, so this ' +
+                'session ends when the access token expires. Enable the ' +
+                '`offline_access` scope on the realm client to keep it alive.');
+        }
+        console.log(`Session stored at ${session_store_1.SESSION_FILE}`);
+    }
+    catch (err) {
+        if (err instanceof device_flow_1.DeviceFlowError) {
+            (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.GenericError, err.message);
+        }
+        throw err;
+    }
+}
+function runLogout() {
+    const removed = (0, session_store_1.clearSession)();
+    (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.Ok, removed
+        ? `Signed out — removed ${session_store_1.SESSION_FILE}`
+        : 'No stored Xema session; nothing to remove.');
+}
+async function runWhoami() {
+    let stored;
+    try {
+        stored = (0, session_store_1.readSession)();
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        return (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.ConfigurationError, detail);
+    }
+    if (stored === undefined) {
+        return (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.NotFound, 'Not signed in. Run `xema login`.');
+    }
+    let session;
+    try {
+        session = await (0, session_auth_1.loadUsableSession)();
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        return (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.ConfigurationError, detail);
+    }
+    if (session === undefined) {
+        return (0, exit_codes_1.exitWith)(exit_codes_1.XemaCliExitCode.NotFound, 'Not signed in. Run `xema login`.');
+    }
+    console.log(`Subject : ${session.subject ?? '(unknown)'}`);
+    console.log(`Endpoint: ${session.endpoint}`);
+    console.log(`Issuer  : ${session.issuer}`);
+    console.log(`Client  : ${session.clientId}`);
+    console.log(`Expires : ${new Date(session.expiresAt).toISOString()}`);
+}
+//# sourceMappingURL=login.js.map

package/dist/commands/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":";;;AA+CA,0CA2BC;AAzDD,kDAA8D;AAC9D,6DAOqC;AACrC,+DAAiE;AACjE,iEAMuC;AACvC,+DAAuE;AAK1D,QAAA,cAAc,GAAG,aAAa,CAAC;AAQ5C,SAAgB,eAAe,CAAC,OAAgB;IAC9C,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,oDAAoD,CAAC;SACjE,MAAM,CAAC,kBAAkB,EAAE,8CAA8C,CAAC;SAC1E,MAAM,CAAC,gBAAgB,EAAE,2BAA2B,sBAAc,GAAG,CAAC;SACtE,MAAM,CACL,kBAAkB,EAClB,uDAAuD,mCAAqB,GAAG,CAChF;SACA,MAAM,CAAC,KAAK,EAAE,IAAkB,EAAE,EAAE;QACnC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,gCAAgC,CAAC;SAC7C,MAAM,CAAC,GAAG,EAAE;QACX,SAAS,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,SAAS,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACP,CAAC;AAGD,SAAS,YAAY,CACnB,QAA4B,EAC5B,MAAc,EACd,QAAgB,EAChB,KAAa;IAEb,MAAM,KAAK,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAA,qBAAQ,EACb,4BAAe,CAAC,kBAAkB,EAClC,MAAM,KAAK,UAAU,QAAQ,iBAAiB,MAAM,GAAG,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAkB;IACxC,MAAM,QAAQ,GAAG,YAAY,CAC3B,IAAI,CAAC,QAAQ,EACb,eAAe,EACf,YAAY,EACZ,mBAAmB,CACpB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,YAAY,CACzB,IAAI,CAAC,MAAM,EACX,sBAAc,EACd,UAAU,EACV,aAAa,CACd,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtB,MAAM,QAAQ,GACZ,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACrD,CAAC,CAAC,IAAI,CAAC,QAAQ;QACf,CAAC,CAAC,mCAAqB,CAAC;IAE5B,MAAM,IAAI,GAAG,IAAA,mCAAqB,GAAE,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,IAAA,mCAAqB,EAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,aAAa,GAAG,MAAM,IAAA,wCAA0B,EACpD,SAAS,EACT,QAAQ,EACR,IAAI,CACL,CAAC;QAIF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,YAAY,aAAa,CAAC,eAAe,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,YAAY,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;QAClD,IAAI,aAAa,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,wBAAwB,aAAa,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAErC,MAAM,MAAM,GAAG,MAAM,IAAA,iCAAmB,EACtC,SAAS,EACT,QAAQ,EACR,aAAa,EACb,IAAI,CACL,CAAC;QAEF,MAAM,OAAO,GAAG,IAAA,sCAAuB,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAgB;YAC3B,QAAQ;YAIR,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,QAAQ;YACR,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;gBACvC,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC;QACF,IAAA,4BAAY,EAAC,OAAO,CAAC,CAAC;QAEtB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,OAAO,KAAK,SAAS;YACnB,CAAC,CAAC,gBAAgB,OAAO,MAAM,QAAQ,EAAE;YACzC,CAAC,CAAC,eAAe,QAAQ,EAAE,CAC9B,CAAC;QACF,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,CACT,iEAAiE;gBAC/D,yDAAyD;gBACzD,8DAA8D,CACjE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,qBAAqB,4BAAY,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,6BAAe,EAAE,CAAC;YACnC,IAAA,qBAAQ,EAAC,4BAAe,CAAC,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,OAAO,GAAG,IAAA,4BAAY,GAAE,CAAC;IAC/B,IAAA,qBAAQ,EACN,4BAAe,CAAC,EAAE,EAClB,OAAO;QACL,CAAC,CAAC,wBAAwB,4BAAY,EAAE;QACxC,CAAC,CAAC,4CAA4C,CACjD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,2BAAW,GAAE,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,IAAA,qBAAQ,EAAC,4BAAe,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAA,qBAAQ,EACb,4BAAe,CAAC,QAAQ,EACxB,kCAAkC,CACnC,CAAC;IACJ,CAAC;IAID,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAA,gCAAiB,GAAE,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,IAAA,qBAAQ,EAAC,4BAAe,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,IAAA,qBAAQ,EACb,4BAAe,CAAC,QAAQ,EACxB,kCAAkC,CACnC,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC"}

package/dist/commands/logs.d.ts

@@ -1,3 +1,24 @@
+import { XemaCliExitCode } from '../lib/exit-codes';
+import { loadXemaConfig } from '../runtime/config/loader';
+import { DockerCli } from '../runtime/runner/docker-cli';
+import { HelmCli } from '../runtime/runner/helm-cli';
+import { KubeCli } from '../runtime/runner/kube-cli';
 import type { Command } from 'commander';
+interface LogsOptions {
+    follow?: boolean;
+    config?: string;
+}
+export interface LogsSeams {
+    readonly docker?: DockerCli;
+    readonly helm?: HelmCli;
+    readonly kube?: KubeCli;
+    readonly loadConfig?: typeof loadXemaConfig;
+}
+export interface LogsOutcome {
+    readonly exitCode: XemaCliExitCode;
+    readonly lines: readonly string[];
+}
 export declare function registerCommand(program: Command): void;
+export declare function runLogs(service: string | undefined, opts?: LogsOptions, seams?: LogsSeams): Promise<LogsOutcome>;
+export {};
 //# sourceMappingURL=logs.d.ts.map

package/dist/commands/logs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logs.d.ts","sourceRoot":"","sources":["../../src/commands/logs.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAWzC,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CActD"}
+{"version":3,"file":"logs.d.ts","sourceRoot":"","sources":["../../src/commands/logs.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAM1D,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAGrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsBzC,UAAU,WAAW;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAGD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,cAAc,CAAC;CAC7C;AAOD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAwBtD;AAaD,wBAAsB,OAAO,CAC3B,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,IAAI,GAAE,WAAgB,EACtB,KAAK,GAAE,SAAc,GACpB,OAAO,CAAC,WAAW,CAAC,CAoBtB"}