@xemahq/xema 0.13.0 → 0.15.0

package/dist/runtime/infra/infra-catalog.js

@@ -1,7 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SHARED_BIOMES_DATABASE = exports.OBJECT_STORE_BUCKETS = exports.INFRA_COMPONENTS = exports.INFRA_CATALOG = void 0;
+exports.SHARED_BIOMES_DATABASE = exports.OBJECT_STORE_BUCKETS = exports.INFRA_COMPONENTS = exports.INFRA_CATALOG = exports.KEYCLOAK_IMPORT_DIR = exports.OPENFGA_DATABASE = exports.KEYCLOAK_DATABASE = exports.TEMPORAL_DEFAULT_RETENTION = exports.TEMPORAL_NAMESPACE = exports.KEYCLOAK_ADMIN_USERNAME = exports.KEYCLOAK_ADMIN_CLIENT_ID = exports.DEFAULT_KEYCLOAK_REALM = exports.InfraHealthProbeKind = void 0;
+exports.assertCatalogIsComplete = assertCatalogIsComplete;
 const schema_1 = require("../config/schema");
+var InfraHealthProbeKind;
+(function (InfraHealthProbeKind) {
+    InfraHealthProbeKind["ContainerExec"] = "container-exec";
+    InfraHealthProbeKind["HostHttp"] = "host-http";
+})(InfraHealthProbeKind || (exports.InfraHealthProbeKind = InfraHealthProbeKind = {}));
+exports.DEFAULT_KEYCLOAK_REALM = 'xema';
+exports.KEYCLOAK_ADMIN_CLIENT_ID = 'user-api';
+exports.KEYCLOAK_ADMIN_USERNAME = 'admin@xema.dev';
+exports.TEMPORAL_NAMESPACE = 'xema';
+exports.TEMPORAL_DEFAULT_RETENTION = '30d';
+exports.KEYCLOAK_DATABASE = 'keycloak_db';
+exports.OPENFGA_DATABASE = 'openfga';
+exports.KEYCLOAK_IMPORT_DIR = '/opt/keycloak/data/import';
 exports.INFRA_CATALOG = Object.freeze({
     [schema_1.InfraComponent.Postgres]: {
         component: schema_1.InfraComponent.Postgres,
@@ -9,9 +23,15 @@ exports.INFRA_CATALOG = Object.freeze({
         managed: {
             image: 'pgvector/pgvector:pg16',
             containerName: 'xema-postgres',
+            startupBudgetMs: 60_000,
             ports: [[5432, 5432]],
             dataPath: '/var/lib/postgresql/data',
-            healthCmd: 'pg_isready -U postgres',
+            health: {
+                kind: InfraHealthProbeKind.ContainerExec,
+                command: 'pg_isready -U "$POSTGRES_USER"',
+            },
+            dependsOn: [],
+            requiresDatabases: [],
         },
     },
     [schema_1.InfraComponent.Redis]: {
@@ -20,9 +40,15 @@ exports.INFRA_CATALOG = Object.freeze({
         managed: {
             image: 'redis:7-alpine',
             containerName: 'xema-redis',
+            startupBudgetMs: 30_000,
             ports: [[6379, 6379]],
             dataPath: '/data',
-            healthCmd: 'redis-cli ping',
+            health: {
+                kind: InfraHealthProbeKind.ContainerExec,
+                command: 'redis-cli ping',
+            },
+            dependsOn: [],
+            requiresDatabases: [],
         },
         defaultLocalUrl: 'redis://127.0.0.1:6379',
     },
@@ -32,9 +58,15 @@ exports.INFRA_CATALOG = Object.freeze({
         managed: {
             image: 'quay.io/coreos/etcd:v3.6.4',
             containerName: 'xema-etcd',
+            startupBudgetMs: 30_000,
             ports: [[2379, 2379]],
             dataPath: '/etcd-data',
-            healthCmd: 'etcdctl endpoint health',
+            health: {
+                kind: InfraHealthProbeKind.ContainerExec,
+                command: 'etcdctl endpoint health',
+            },
+            dependsOn: [],
+            requiresDatabases: [],
         },
         defaultLocalUrl: '127.0.0.1:2379',
     },
@@ -42,10 +74,28 @@ exports.INFRA_CATALOG = Object.freeze({
         component: schema_1.InfraComponent.Keycloak,
         mandatory: true,
         managed: {
-            image: 'quay.io/keycloak/keycloak:26.0',
+            image: 'quay.io/keycloak/keycloak:26.6.2',
             containerName: 'xema-keycloak',
-            ports: [[8180, 8080]],
-            healthCmd: '/opt/healthcheck.sh',
+            startupBudgetMs: 300_000,
+            ports: [
+                [8180, 8080],
+                [9180, 9000],
+            ],
+            command: [
+                'start',
+                '--http-enabled=true',
+                '--http-port=8080',
+                '--hostname-strict=false',
+                '--import-realm',
+            ],
+            health: {
+                kind: InfraHealthProbeKind.HostHttp,
+                hostPort: 9180,
+                path: '/health/ready',
+                expectBody: 'UP',
+            },
+            dependsOn: [schema_1.InfraComponent.Postgres],
+            requiresDatabases: [exports.KEYCLOAK_DATABASE],
         },
         defaultLocalUrl: 'http://127.0.0.1:8180',
     },
@@ -55,12 +105,19 @@ exports.INFRA_CATALOG = Object.freeze({
         managed: {
             image: 'minio/minio:RELEASE.2025-01-20T14-49-07Z',
             containerName: 'xema-minio',
+            startupBudgetMs: 60_000,
             ports: [
                 [9000, 9000],
                 [9001, 9001],
             ],
             dataPath: '/data',
-            healthCmd: 'mc ready local',
+            health: {
+                kind: InfraHealthProbeKind.ContainerExec,
+                command: 'mc ready local',
+            },
+            command: ['server', '/data', '--console-address', ':9001'],
+            dependsOn: [],
+            requiresDatabases: [],
         },
         defaultLocalUrl: 'http://127.0.0.1:9000',
     },
@@ -70,9 +127,15 @@ exports.INFRA_CATALOG = Object.freeze({
         managed: {
             image: 'opensearchproject/opensearch:2.18.0',
             containerName: 'xema-opensearch',
+            startupBudgetMs: 180_000,
             ports: [[9200, 9200]],
             dataPath: '/usr/share/opensearch/data',
-            healthCmd: 'curl -fsS http://localhost:9200/_cluster/health',
+            health: {
+                kind: InfraHealthProbeKind.ContainerExec,
+                command: 'curl -fsS http://localhost:9200/_cluster/health',
+            },
+            dependsOn: [],
+            requiresDatabases: [],
         },
         defaultLocalUrl: 'http://127.0.0.1:9200',
     },
@@ -82,10 +145,24 @@ exports.INFRA_CATALOG = Object.freeze({
         managed: {
             image: 'openfga/openfga:v1.16.1',
             containerName: 'xema-openfga',
+            startupBudgetMs: 120_000,
             ports: [
                 [8088, 8080],
                 [8081, 8081],
             ],
+            command: ['run'],
+            health: {
+                kind: InfraHealthProbeKind.HostHttp,
+                hostPort: 8088,
+                path: '/healthz',
+                expectBody: 'SERVING',
+            },
+            dependsOn: [schema_1.InfraComponent.Postgres],
+            requiresDatabases: [exports.OPENFGA_DATABASE],
+            preStart: {
+                containerName: 'xema-openfga-migrate',
+                command: ['migrate'],
+            },
         },
         defaultLocalUrl: 'http://127.0.0.1:8088',
     },
@@ -95,12 +172,18 @@ exports.INFRA_CATALOG = Object.freeze({
         managed: {
             image: 'gitea/gitea:1.25-rootless',
             containerName: 'xema-gitea',
+            startupBudgetMs: 120_000,
             ports: [
                 [3000, 3000],
                 [2222, 2222],
             ],
             dataPath: '/var/lib/gitea',
-            healthCmd: 'wget -qO- http://localhost:3000/api/v1/version',
+            health: {
+                kind: InfraHealthProbeKind.ContainerExec,
+                command: 'wget -qO- http://localhost:3000/api/v1/version',
+            },
+            dependsOn: [],
+            requiresDatabases: [],
         },
         defaultLocalUrl: 'http://127.0.0.1:3000',
     },
@@ -110,7 +193,14 @@ exports.INFRA_CATALOG = Object.freeze({
         managed: {
             image: 'temporalio/auto-setup:1.28.2',
             containerName: 'xema-temporal',
+            startupBudgetMs: 300_000,
             ports: [[7233, 7233]],
+            health: {
+                kind: InfraHealthProbeKind.ContainerExec,
+                command: `tctl --address $(hostname -i):7233 --ns ${exports.TEMPORAL_NAMESPACE} namespace desc`,
+            },
+            dependsOn: [schema_1.InfraComponent.Postgres],
+            requiresDatabases: [],
         },
         defaultLocalUrl: '127.0.0.1:7233',
     },
@@ -125,4 +215,106 @@ exports.OBJECT_STORE_BUCKETS = Object.freeze([
     'artifact-store-web-biome-remotes',
 ]);
 exports.SHARED_BIOMES_DATABASE = 'xema_biomes';
+const DATABASE_NAME_PATTERN = /^[a-z_][a-z0-9_]*$/;
+function assertCatalogIsComplete(catalog = exports.INFRA_CATALOG) {
+    const problems = [];
+    const known = new Set(Object.values(schema_1.InfraComponent));
+    for (const component of Object.values(schema_1.InfraComponent)) {
+        const entry = catalog[component];
+        if (entry === undefined) {
+            problems.push(`${component}: no catalog entry`);
+            continue;
+        }
+        if (entry.component !== component) {
+            problems.push(`${component}: entry declares component "${entry.component}"`);
+        }
+        const spec = entry.managed;
+        if (spec.image.trim() === '' || spec.containerName.trim() === '') {
+            problems.push(`${component}: image and containerName are required`);
+        }
+        if (spec.ports.length === 0) {
+            problems.push(`${component}: at least one published port is required`);
+        }
+        if (!Number.isFinite(spec.startupBudgetMs) || spec.startupBudgetMs <= 0) {
+            problems.push(`${component}: startupBudgetMs must be a positive number of milliseconds`);
+        }
+        problems.push(...healthProbeProblems(component, spec));
+        for (const database of spec.requiresDatabases) {
+            if (!DATABASE_NAME_PATTERN.test(database)) {
+                problems.push(`${component}: requiresDatabases entry "${database}" is not a plain identifier`);
+            }
+        }
+        for (const dependency of spec.dependsOn) {
+            if (!known.has(dependency)) {
+                problems.push(`${component}: dependsOn unknown component "${dependency}"`);
+            }
+            if (dependency === component) {
+                problems.push(`${component}: dependsOn itself`);
+            }
+        }
+        if (spec.preStart !== undefined &&
+            (spec.preStart.command.length === 0 ||
+                spec.preStart.containerName === spec.containerName)) {
+            problems.push(`${component}: preStart needs its own container name and a non-empty command`);
+        }
+    }
+    problems.push(...dependencyCycleProblems(catalog));
+    if (problems.length > 0) {
+        throw new Error('The managed-infra catalog is invalid — every component must be startable ' +
+            'AND health-gated:\n' +
+            problems.map((p) => `  - ${p}`).join('\n'));
+    }
+}
+function healthProbeProblems(component, spec) {
+    const probe = spec.health;
+    if (probe === undefined) {
+        return [
+            `${component}: no health probe. A component that cannot be health-gated ` +
+                'must not be assumed healthy — give it a probe or remove it.',
+        ];
+    }
+    if (probe.kind === InfraHealthProbeKind.ContainerExec) {
+        return probe.command.trim() === ''
+            ? [`${component}: container-exec health probe has an empty command`]
+            : [];
+    }
+    const problems = [];
+    if (!probe.path.startsWith('/')) {
+        problems.push(`${component}: host-http health path must start with "/"`);
+    }
+    if (probe.expectBody.trim() === '') {
+        problems.push(`${component}: host-http health probe must assert a body substring`);
+    }
+    if (!spec.ports.some(([hostPort]) => hostPort === probe.hostPort)) {
+        problems.push(`${component}: host-http health probe targets host port ${String(probe.hostPort)}, ` +
+            'which the component does not publish');
+    }
+    return problems;
+}
+function dependencyCycleProblems(catalog) {
+    const problems = [];
+    const state = new Map();
+    const visit = (component, trail) => {
+        const current = state.get(component);
+        if (current === 'done') {
+            return;
+        }
+        if (current === 'visiting') {
+            problems.push(`dependency cycle: ${[...trail, component].join(' -> ')}`);
+            return;
+        }
+        state.set(component, 'visiting');
+        for (const dependency of catalog[component]?.managed.dependsOn ?? []) {
+            if (dependency !== component && catalog[dependency] !== undefined) {
+                visit(dependency, [...trail, component]);
+            }
+        }
+        state.set(component, 'done');
+    };
+    for (const component of Object.values(schema_1.InfraComponent)) {
+        visit(component, []);
+    }
+    return problems;
+}
+assertCatalogIsComplete();
 //# sourceMappingURL=infra-catalog.js.map

package/dist/runtime/infra/infra-catalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"infra-catalog.js","sourceRoot":"","sources":["../../../src/runtime/infra/infra-catalog.ts"],"names":[],"mappings":";;;AAAA,6CAAkD;AAiCrC,QAAA,aAAa,GAAwD,MAAM,CAAC,MAAM,CAAC;IAC9F,CAAC,uBAAc,CAAC,QAAQ,CAAC,EAAE;QACzB,SAAS,EAAE,uBAAc,CAAC,QAAQ;QAClC,SAAS,EAAE,IAAI;QACf,OAAO,EAAE;YACP,KAAK,EAAE,wBAAwB;YAC/B,aAAa,EAAE,eAAe;YAC9B,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACrB,QAAQ,EAAE,0BAA0B;YACpC,SAAS,EAAE,wBAAwB;SACpC;KACF;IACD,CAAC,uBAAc,CAAC,KAAK,CAAC,EAAE;QACtB,SAAS,EAAE,uBAAc,CAAC,KAAK;QAC/B,SAAS,EAAE,IAAI;QACf,OAAO,EAAE;YACP,KAAK,EAAE,gBAAgB;YACvB,aAAa,EAAE,YAAY;YAC3B,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACrB,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,gBAAgB;SAC5B;QACD,eAAe,EAAE,wBAAwB;KAC1C;IACD,CAAC,uBAAc,CAAC,IAAI,CAAC,EAAE;QACrB,SAAS,EAAE,uBAAc,CAAC,IAAI;QAC9B,SAAS,EAAE,IAAI;QACf,OAAO,EAAE;YACP,KAAK,EAAE,4BAA4B;YACnC,aAAa,EAAE,WAAW;YAC1B,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACrB,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,yBAAyB;SACrC;QACD,eAAe,EAAE,gBAAgB;KAClC;IACD,CAAC,uBAAc,CAAC,QAAQ,CAAC,EAAE;QACzB,SAAS,EAAE,uBAAc,CAAC,QAAQ;QAClC,SAAS,EAAE,IAAI;QACf,OAAO,EAAE;YACP,KAAK,EAAE,gCAAgC;YACvC,aAAa,EAAE,eAAe;YAC9B,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACrB,SAAS,EAAE,qBAAqB;SACjC;QACD,eAAe,EAAE,uBAAuB;KACzC;IACD,CAAC,uBAAc,CAAC,WAAW,CAAC,EAAE;QAC5B,SAAS,EAAE,uBAAc,CAAC,WAAW;QACrC,SAAS,EAAE,IAAI;QACf,OAAO,EAAE;YACP,KAAK,EAAE,0CAA0C;YACjD,aAAa,EAAE,YAAY;YAC3B,KAAK,EAAE;gBACL,CAAC,IAAI,EAAE,IAAI,CAAC;gBACZ,CAAC,IAAI,EAAE,IAAI,CAAC;aACb;YACD,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,gBAAgB;SAC5B;QACD,eAAe,EAAE,uBAAuB;KACzC;IACD,CAAC,uBAAc,CAAC,MAAM,CAAC,EAAE;QACvB,SAAS,EAAE,uBAAc,CAAC,MAAM;QAChC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE;YACP,KAAK,EAAE,qCAAqC;YAC5C,aAAa,EAAE,iBAAiB;YAChC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACrB,QAAQ,EAAE,4BAA4B;YACtC,SAAS,EAAE,iDAAiD;SAC7D;QACD,eAAe,EAAE,uBAAuB;KACzC;IACD,CAAC,uBAAc,CAAC,GAAG,CAAC,EAAE;QACpB,SAAS,EAAE,uBAAc,CAAC,GAAG;QAC7B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE;YACP,KAAK,EAAE,yBAAyB;YAChC,aAAa,EAAE,cAAc;YAC7B,KAAK,EAAE;gBACL,CAAC,IAAI,EAAE,IAAI,CAAC;gBACZ,CAAC,IAAI,EAAE,IAAI,CAAC;aACb;SACF;QACD,eAAe,EAAE,uBAAuB;KACzC;IACD,CAAC,uBAAc,CAAC,GAAG,CAAC,EAAE;QACpB,SAAS,EAAE,uBAAc,CAAC,GAAG;QAC7B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE;YACP,KAAK,EAAE,2BAA2B;YAClC,aAAa,EAAE,YAAY;YAC3B,KAAK,EAAE;gBACL,CAAC,IAAI,EAAE,IAAI,CAAC;gBACZ,CAAC,IAAI,EAAE,IAAI,CAAC;aACb;YACD,QAAQ,EAAE,gBAAgB;YAC1B,SAAS,EAAE,gDAAgD;SAC5D;QACD,eAAe,EAAE,uBAAuB;KACzC;IACD,CAAC,uBAAc,CAAC,QAAQ,CAAC,EAAE;QACzB,SAAS,EAAE,uBAAc,CAAC,QAAQ;QAClC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE;YACP,KAAK,EAAE,8BAA8B;YACrC,aAAa,EAAE,eAAe;YAC9B,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;SACtB;QACD,eAAe,EAAE,gBAAgB;KAClC;CACF,CAAC,CAAC;AAGU,QAAA,gBAAgB,GAA8B,MAAM,CAAC,MAAM,CACtE,MAAM,CAAC,MAAM,CAAC,uBAAc,CAAC,CAC9B,CAAC;AAOW,QAAA,oBAAoB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACnE,6BAA6B;IAC7B,2BAA2B;IAC3B,yBAAyB;IACzB,gBAAgB;IAChB,gBAAgB;IAChB,kCAAkC;CACnC,CAAC,CAAC;AAGU,QAAA,sBAAsB,GAAG,aAAa,CAAC"}
+{"version":3,"file":"infra-catalog.js","sourceRoot":"","sources":["../../../src/runtime/infra/infra-catalog.ts"],"names":[],"mappings":";;;AA+YA,0DAiEC;AAhdD,6CAAkD;AA8BlD,IAAY,oBAGX;AAHD,WAAY,oBAAoB;IAC9B,wDAAgC,CAAA;IAChC,8CAAsB,CAAA;AACxB,CAAC,EAHW,oBAAoB,oCAApB,oBAAoB,QAG/B;AAwEY,QAAA,sBAAsB,GAAG,MAAM,CAAC;AAShC,QAAA,wBAAwB,GAAG,UAAU,CAAC;AAGtC,QAAA,uBAAuB,GAAG,gBAAgB,CAAC;AAQ3C,QAAA,kBAAkB,GAAG,MAAM,CAAC;AAG5B,QAAA,0BAA0B,GAAG,KAAK,CAAC;AAGnC,QAAA,iBAAiB,GAAG,aAAa,CAAC;AAGlC,QAAA,gBAAgB,GAAG,SAAS,CAAC;AAG7B,QAAA,mBAAmB,GAAG,2BAA2B,CAAC;AAElD,QAAA,aAAa,GAEtB,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,uBAAc,CAAC,QAAQ,CAAC,EAAE;QACzB,SAAS,EAAE,uBAAc,CAAC,QAAQ;QAClC,SAAS,EAAE,IAAI;QACf,OAAO,EAAE;YACP,KAAK,EAAE,wBAAwB;YAC/B,aAAa,EAAE,eAAe;YAC9B,eAAe,EAAE,MAAM;YACvB,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACrB,QAAQ,EAAE,0BAA0B;YACpC,MAAM,EAAE;gBACN,IAAI,EAAE,oBAAoB,CAAC,aAAa;gBACxC,OAAO,EAAE,gCAAgC;aAC1C;YACD,SAAS,EAAE,EAAE;YACb,iBAAiB,EAAE,EAAE;SACtB;KACF;IACD,CAAC,uBAAc,CAAC,KAAK,CAAC,EAAE;QACtB,SAAS,EAAE,uBAAc,CAAC,KAAK;QAC/B,SAAS,EAAE,IAAI;QACf,OAAO,EAAE;YACP,KAAK,EAAE,gBAAgB;YACvB,aAAa,EAAE,YAAY;YAC3B,eAAe,EAAE,MAAM;YACvB,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACrB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE;gBACN,IAAI,EAAE,oBAAoB,CAAC,aAAa;gBACxC,OAAO,EAAE,gBAAgB;aAC1B;YACD,SAAS,EAAE,EAAE;YACb,iBAAiB,EAAE,EAAE;SACtB;QACD,eAAe,EAAE,wBAAwB;KAC1C;IACD,CAAC,uBAAc,CAAC,IAAI,CAAC,EAAE;QACrB,SAAS,EAAE,uBAAc,CAAC,IAAI;QAC9B,SAAS,EAAE,IAAI;QACf,OAAO,EAAE;YACP,KAAK,EAAE,4BAA4B;YACnC,aAAa,EAAE,WAAW;YAC1B,eAAe,EAAE,MAAM;YACvB,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACrB,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE;gBACN,IAAI,EAAE,oBAAoB,CAAC,aAAa;gBACxC,OAAO,EAAE,yBAAyB;aACnC;YACD,SAAS,EAAE,EAAE;YACb,iBAAiB,EAAE,EAAE;SACtB;QACD,eAAe,EAAE,gBAAgB;KAClC;IACD,CAAC,uBAAc,CAAC,QAAQ,CAAC,EAAE;QACzB,SAAS,EAAE,uBAAc,CAAC,QAAQ;QAClC,SAAS,EAAE,IAAI;QACf,OAAO,EAAE;YAKP,KAAK,EAAE,kCAAkC;YACzC,aAAa,EAAE,eAAe;YAE9B,eAAe,EAAE,OAAO;YAMxB,KAAK,EAAE;gBACL,CAAC,IAAI,EAAE,IAAI,CAAC;gBACZ,CAAC,IAAI,EAAE,IAAI,CAAC;aACb;YAMD,OAAO,EAAE;gBACP,OAAO;gBACP,qBAAqB;gBACrB,kBAAkB;gBAClB,yBAAyB;gBACzB,gBAAgB;aACjB;YACD,MAAM,EAAE;gBAKN,IAAI,EAAE,oBAAoB,CAAC,QAAQ;gBACnC,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,eAAe;gBACrB,UAAU,EAAE,IAAI;aACjB;YACD,SAAS,EAAE,CAAC,uBAAc,CAAC,QAAQ,CAAC;YACpC,iBAAiB,EAAE,CAAC,yBAAiB,CAAC;SACvC;QACD,eAAe,EAAE,uBAAuB;KACzC;IACD,CAAC,uBAAc,CAAC,WAAW,CAAC,EAAE;QAC5B,SAAS,EAAE,uBAAc,CAAC,WAAW;QACrC,SAAS,EAAE,IAAI;QACf,OAAO,EAAE;YACP,KAAK,EAAE,0CAA0C;YACjD,aAAa,EAAE,YAAY;YAC3B,eAAe,EAAE,MAAM;YACvB,KAAK,EAAE;gBACL,CAAC,IAAI,EAAE,IAAI,CAAC;gBACZ,CAAC,IAAI,EAAE,IAAI,CAAC;aACb;YACD,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE;gBACN,IAAI,EAAE,oBAAoB,CAAC,aAAa;gBACxC,OAAO,EAAE,gBAAgB;aAC1B;YACD,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,CAAC;YAC1D,SAAS,EAAE,EAAE;YACb,iBAAiB,EAAE,EAAE;SACtB;QACD,eAAe,EAAE,uBAAuB;KACzC;IAMD,CAAC,uBAAc,CAAC,MAAM,CAAC,EAAE;QACvB,SAAS,EAAE,uBAAc,CAAC,MAAM;QAChC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE;YACP,KAAK,EAAE,qCAAqC;YAC5C,aAAa,EAAE,iBAAiB;YAEhC,eAAe,EAAE,OAAO;YACxB,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACrB,QAAQ,EAAE,4BAA4B;YACtC,MAAM,EAAE;gBACN,IAAI,EAAE,oBAAoB,CAAC,aAAa;gBACxC,OAAO,EAAE,iDAAiD;aAC3D;YACD,SAAS,EAAE,EAAE;YACb,iBAAiB,EAAE,EAAE;SACtB;QACD,eAAe,EAAE,uBAAuB;KACzC;IACD,CAAC,uBAAc,CAAC,GAAG,CAAC,EAAE;QACpB,SAAS,EAAE,uBAAc,CAAC,GAAG;QAC7B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE;YACP,KAAK,EAAE,yBAAyB;YAChC,aAAa,EAAE,cAAc;YAC7B,eAAe,EAAE,OAAO;YACxB,KAAK,EAAE;gBACL,CAAC,IAAI,EAAE,IAAI,CAAC;gBACZ,CAAC,IAAI,EAAE,IAAI,CAAC;aACb;YACD,OAAO,EAAE,CAAC,KAAK,CAAC;YAChB,MAAM,EAAE;gBAGN,IAAI,EAAE,oBAAoB,CAAC,QAAQ;gBACnC,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,UAAU;gBAChB,UAAU,EAAE,SAAS;aACtB;YACD,SAAS,EAAE,CAAC,uBAAc,CAAC,QAAQ,CAAC;YACpC,iBAAiB,EAAE,CAAC,wBAAgB,CAAC;YAGrC,QAAQ,EAAE;gBACR,aAAa,EAAE,sBAAsB;gBACrC,OAAO,EAAE,CAAC,SAAS,CAAC;aACrB;SACF;QACD,eAAe,EAAE,uBAAuB;KACzC;IACD,CAAC,uBAAc,CAAC,GAAG,CAAC,EAAE;QACpB,SAAS,EAAE,uBAAc,CAAC,GAAG;QAC7B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE;YACP,KAAK,EAAE,2BAA2B;YAClC,aAAa,EAAE,YAAY;YAC3B,eAAe,EAAE,OAAO;YACxB,KAAK,EAAE;gBACL,CAAC,IAAI,EAAE,IAAI,CAAC;gBACZ,CAAC,IAAI,EAAE,IAAI,CAAC;aACb;YACD,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE;gBACN,IAAI,EAAE,oBAAoB,CAAC,aAAa;gBACxC,OAAO,EAAE,gDAAgD;aAC1D;YACD,SAAS,EAAE,EAAE;YACb,iBAAiB,EAAE,EAAE;SACtB;QACD,eAAe,EAAE,uBAAuB;KACzC;IACD,CAAC,uBAAc,CAAC,QAAQ,CAAC,EAAE;QACzB,SAAS,EAAE,uBAAc,CAAC,QAAQ;QAClC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE;YACP,KAAK,EAAE,8BAA8B;YACrC,aAAa,EAAE,eAAe;YAE9B,eAAe,EAAE,OAAO;YACxB,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACrB,MAAM,EAAE;gBAIN,IAAI,EAAE,oBAAoB,CAAC,aAAa;gBACxC,OAAO,EAAE,2CAA2C,0BAAkB,iBAAiB;aACxF;YACD,SAAS,EAAE,CAAC,uBAAc,CAAC,QAAQ,CAAC;YAGpC,iBAAiB,EAAE,EAAE;SACtB;QACD,eAAe,EAAE,gBAAgB;KAClC;CACF,CAAC,CAAC;AAGU,QAAA,gBAAgB,GAA8B,MAAM,CAAC,MAAM,CACtE,MAAM,CAAC,MAAM,CAAC,uBAAc,CAAC,CAC9B,CAAC;AAOW,QAAA,oBAAoB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACnE,6BAA6B;IAC7B,2BAA2B;IAC3B,yBAAyB;IACzB,gBAAgB;IAChB,gBAAgB;IAChB,kCAAkC;CACnC,CAAC,CAAC;AAGU,QAAA,sBAAsB,GAAG,aAAa,CAAC;AAMpD,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;AAOnD,SAAgB,uBAAuB,CACrC,UAA+D,qBAAa;IAE5E,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,uBAAc,CAAC,CAAC,CAAC;IAE7D,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,uBAAc,CAAC,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,oBAAoB,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CACX,GAAG,SAAS,+BAA+B,KAAK,CAAC,SAAS,GAAG,CAC9D,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC;QAC3B,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACjE,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,wCAAwC,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,2CAA2C,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,EAAE,CAAC;YACxE,QAAQ,CAAC,IAAI,CACX,GAAG,SAAS,6DAA6D,CAC1E,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QACvD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC9C,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1C,QAAQ,CAAC,IAAI,CACX,GAAG,SAAS,8BAA8B,QAAQ,6BAA6B,CAChF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,kCAAkC,UAAU,GAAG,CAAC,CAAC;YAC7E,CAAC;YACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,oBAAoB,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,IACE,IAAI,CAAC,QAAQ,KAAK,SAAS;YAC3B,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBACjC,IAAI,CAAC,QAAQ,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa,CAAC,EACrD,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,GAAG,SAAS,iEAAiE,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;IAEnD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,2EAA2E;YACzE,qBAAqB;YACrB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,SAAyB,EACzB,IAAsB;IAEtB,MAAM,KAAK,GAAiC,IAAI,CAAC,MAAM,CAAC;IACxD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO;YACL,GAAG,SAAS,6DAA6D;gBACvE,6DAA6D;SAChE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,CAAC,aAAa,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;YAChC,CAAC,CAAC,CAAC,GAAG,SAAS,oDAAoD,CAAC;YACpE,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,6CAA6C,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,uDAAuD,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CACX,GAAG,SAAS,8CAA8C,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;YAClF,sCAAsC,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAGD,SAAS,uBAAuB,CAC9B,OAA4D;IAE5D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuC,CAAC;IAC7D,MAAM,KAAK,GAAG,CAAC,SAAyB,EAAE,KAAuB,EAAQ,EAAE;QACzE,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CACX,qBAAqB,CAAC,GAAG,KAAK,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAC1D,CAAC;YACF,OAAO;QACT,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACjC,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;YACrE,IAAI,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;gBAClE,KAAK,CAAC,UAAU,EAAE,CAAC,GAAG,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,uBAAc,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,uBAAuB,EAAE,CAAC"}

package/dist/runtime/infra/infra-environment.d.ts

@@ -0,0 +1,10 @@
+import { InfraComponent } from '../config/schema';
+import type { PostgresEndpoint } from './postgres-endpoint';
+import type { LocalInfrastructureCredentials } from '../secrets/managed-local-store';
+export interface InfraEnvironmentContext {
+    readonly credentials?: LocalInfrastructureCredentials;
+    readonly postgres: PostgresEndpoint;
+    readonly realm: string;
+}
+export declare function infraContainerEnvironment(component: InfraComponent, ctx: InfraEnvironmentContext): Readonly<Record<string, string>>;
+//# sourceMappingURL=infra-environment.d.ts.map

package/dist/runtime/infra/infra-environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-environment.d.ts","sourceRoot":"","sources":["../../../src/runtime/infra/infra-environment.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAEV,8BAA8B,EAC/B,MAAM,gCAAgC,CAAC;AAgBxC,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,8BAA8B,CAAC;IAEtD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IAEpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,cAAc,EACzB,GAAG,EAAE,uBAAuB,GAC3B,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAsElC"}

package/dist/runtime/infra/infra-environment.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.infraContainerEnvironment = infraContainerEnvironment;
+const infra_catalog_1 = require("./infra-catalog");
+const schema_1 = require("../config/schema");
+function infraContainerEnvironment(component, ctx) {
+    switch (component) {
+        case schema_1.InfraComponent.Postgres: {
+            const credentials = requireCredentials(ctx, 'postgres', component);
+            return {
+                POSTGRES_USER: credentials.username,
+                POSTGRES_PASSWORD: credentials.password,
+            };
+        }
+        case schema_1.InfraComponent.ObjectStore: {
+            const credentials = requireCredentials(ctx, 'objectStore', component);
+            return {
+                MINIO_ROOT_USER: credentials.username,
+                MINIO_ROOT_PASSWORD: credentials.password,
+            };
+        }
+        case schema_1.InfraComponent.Keycloak: {
+            const postgres = requireCredentials(ctx, 'postgres', component);
+            const admin = requireCredentials(ctx, 'keycloakAdmin', component);
+            return {
+                KC_BOOTSTRAP_ADMIN_USERNAME: admin.username,
+                KC_BOOTSTRAP_ADMIN_PASSWORD: admin.password,
+                KC_DB: 'postgres',
+                KC_DB_URL: `jdbc:postgresql://${ctx.postgres.host}:${String(ctx.postgres.port)}/${infra_catalog_1.KEYCLOAK_DATABASE}`,
+                KC_DB_USERNAME: postgres.username,
+                KC_DB_PASSWORD: postgres.password,
+                KC_HEALTH_ENABLED: 'true',
+                KC_HTTP_ENABLED: 'true',
+                KC_HOSTNAME_STRICT: 'false',
+            };
+        }
+        case schema_1.InfraComponent.Temporal: {
+            const postgres = requireCredentials(ctx, 'postgres', component);
+            return {
+                DB: 'postgres12',
+                DB_PORT: String(ctx.postgres.port),
+                POSTGRES_SEEDS: ctx.postgres.host,
+                POSTGRES_USER: postgres.username,
+                POSTGRES_PWD: postgres.password,
+                DBNAME: 'temporal',
+                VISIBILITY_DBNAME: 'temporal_visibility',
+                DEFAULT_NAMESPACE: infra_catalog_1.TEMPORAL_NAMESPACE,
+                DEFAULT_NAMESPACE_RETENTION: infra_catalog_1.TEMPORAL_DEFAULT_RETENTION,
+                SKIP_ADD_CUSTOM_SEARCH_ATTRIBUTES: 'true',
+            };
+        }
+        case schema_1.InfraComponent.Fga: {
+            const postgres = requireCredentials(ctx, 'postgres', component);
+            return {
+                OPENFGA_DATASTORE_ENGINE: 'postgres',
+                OPENFGA_DATASTORE_URI: `postgres://${encodeURIComponent(postgres.username)}:` +
+                    `${encodeURIComponent(postgres.password)}@` +
+                    `${ctx.postgres.host}:${String(ctx.postgres.port)}/${infra_catalog_1.OPENFGA_DATABASE}?sslmode=disable`,
+                OPENFGA_LOG_LEVEL: 'warn',
+            };
+        }
+        case schema_1.InfraComponent.Redis:
+        case schema_1.InfraComponent.Etcd:
+        case schema_1.InfraComponent.Search:
+        case schema_1.InfraComponent.Git:
+            return {};
+    }
+}
+function requireCredentials(ctx, key, component) {
+    const credentials = ctx.credentials?.[key];
+    if (credentials === undefined) {
+        throw new Error(`Managed-local "${key}" credentials were not resolved before starting ${component}.`);
+    }
+    return credentials;
+}
+//# sourceMappingURL=infra-environment.js.map

package/dist/runtime/infra/infra-environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-environment.js","sourceRoot":"","sources":["../../../src/runtime/infra/infra-environment.ts"],"names":[],"mappings":";;AAoCA,8DAyEC;AA7GD,mDAKyB;AACzB,6CAAkD;AA8BlD,SAAgB,yBAAyB,CACvC,SAAyB,EACzB,GAA4B;IAE5B,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,uBAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7B,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YACnE,OAAO;gBACL,aAAa,EAAE,WAAW,CAAC,QAAQ;gBACnC,iBAAiB,EAAE,WAAW,CAAC,QAAQ;aACxC,CAAC;QACJ,CAAC;QACD,KAAK,uBAAc,CAAC,WAAW,CAAC,CAAC,CAAC;YAChC,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;YACtE,OAAO;gBACL,eAAe,EAAE,WAAW,CAAC,QAAQ;gBACrC,mBAAmB,EAAE,WAAW,CAAC,QAAQ;aAC1C,CAAC;QACJ,CAAC;QACD,KAAK,uBAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YAChE,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;YAClE,OAAO;gBAIL,2BAA2B,EAAE,KAAK,CAAC,QAAQ;gBAC3C,2BAA2B,EAAE,KAAK,CAAC,QAAQ;gBAC3C,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,qBAAqB,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,iCAAiB,EAAE;gBACrG,cAAc,EAAE,QAAQ,CAAC,QAAQ;gBACjC,cAAc,EAAE,QAAQ,CAAC,QAAQ;gBAEjC,iBAAiB,EAAE,MAAM;gBACzB,eAAe,EAAE,MAAM;gBACvB,kBAAkB,EAAE,OAAO;aAC5B,CAAC;QACJ,CAAC;QACD,KAAK,uBAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YAChE,OAAO;gBAEL,EAAE,EAAE,YAAY;gBAChB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAClC,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI;gBACjC,aAAa,EAAE,QAAQ,CAAC,QAAQ;gBAChC,YAAY,EAAE,QAAQ,CAAC,QAAQ;gBAC/B,MAAM,EAAE,UAAU;gBAClB,iBAAiB,EAAE,qBAAqB;gBACxC,iBAAiB,EAAE,kCAAkB;gBACrC,2BAA2B,EAAE,0CAA0B;gBAGvD,iCAAiC,EAAE,MAAM;aAC1C,CAAC;QACJ,CAAC;QACD,KAAK,uBAAc,CAAC,GAAG,CAAC,CAAC,CAAC;YACxB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YAChE,OAAO;gBACL,wBAAwB,EAAE,UAAU;gBACpC,qBAAqB,EACnB,cAAc,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG;oBACtD,GAAG,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG;oBAC3C,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,gCAAgB,kBAAkB;gBACzF,iBAAiB,EAAE,MAAM;aAC1B,CAAC;QACJ,CAAC;QACD,KAAK,uBAAc,CAAC,KAAK,CAAC;QAC1B,KAAK,uBAAc,CAAC,IAAI,CAAC;QACzB,KAAK,uBAAc,CAAC,MAAM,CAAC;QAC3B,KAAK,uBAAc,CAAC,GAAG;YACrB,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,GAA4B,EAC5B,GAAyC,EACzC,SAAyB;IAEzB,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,mDAAmD,SAAS,GAAG,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/runtime/infra/infra-plan.d.ts

@@ -1,4 +1,4 @@
-import { InfraMode, type InfraComponent, type InfraComponentConfig, type XemaConfig } from '../config/schema';
+import { InfraComponent, InfraMode, type InfraComponentConfig, type XemaConfig } from '../config/schema';
 export interface ResolvedInfraComponent {
     readonly component: InfraComponent;
     readonly mode: InfraMode;
@@ -12,5 +12,6 @@ export interface InfraPlan {
     readonly byComponent: ReadonlyMap<InfraComponent, ResolvedInfraComponent>;
     readonly warnings: readonly string[];
 }
+export declare const MANAGED_KEYCLOAK_LIMITATION_WARNING: string;
 export declare function resolveInfraPlan(config: XemaConfig): InfraPlan;
 //# sourceMappingURL=infra-plan.d.ts.map

package/dist/runtime/infra/infra-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infra-plan.d.ts","sourceRoot":"","sources":["../../../src/runtime/infra/infra-plan.ts"],"names":[],"mappings":"AACA,OAAO,EACL,SAAS,EACT,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,UAAU,EAChB,MAAM,kBAAkB,CAAC;AAgB1B,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;CACvC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACpD,QAAQ,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACrD,QAAQ,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACrD,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC;IAC1E,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAID,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAgD9D"}
+{"version":3,"file":"infra-plan.d.ts","sourceRoot":"","sources":["../../../src/runtime/infra/infra-plan.ts"],"names":[],"mappings":"AACA,OAAO,EACL,cAAc,EACd,SAAS,EACT,KAAK,oBAAoB,EACzB,KAAK,UAAU,EAChB,MAAM,kBAAkB,CAAC;AAgB1B,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;CACvC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACpD,QAAQ,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACrD,QAAQ,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACrD,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC;IAC1E,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAkBD,eAAO,MAAM,mCAAmC,QAMO,CAAC;AAExD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAmD9D"}

package/dist/runtime/infra/infra-plan.js

@@ -1,9 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.MANAGED_KEYCLOAK_LIMITATION_WARNING = void 0;
 exports.resolveInfraPlan = resolveInfraPlan;
 const infra_catalog_1 = require("./infra-catalog");
 const schema_1 = require("../config/schema");
 const DEFAULT_MODE = schema_1.InfraMode.Managed;
+exports.MANAGED_KEYCLOAK_LIMITATION_WARNING = 'infra.keycloak is managed — the launcher runs the stock Keycloak image with the ' +
+    'realm it ships, so identity-api\'s Keycloak plugin is NOT loaded: no ' +
+    '`identity-api-provisioner` event listener (users are provisioned when identity-api ' +
+    'first sees them, not at login time) and no `nc-scoped-claims-mapper` (the ' +
+    '`scoped_claims` request parameter is inert). Point infra.keycloak at an "external" ' +
+    'Keycloak carrying that plugin when you need either.';
 function resolveInfraPlan(config) {
     const managed = [];
     const external = [];
@@ -38,6 +45,9 @@ function resolveInfraPlan(config) {
         const resolved = { component, mode: schema_1.InfraMode.Managed, config: raw };
         managed.push(resolved);
         byComponent.set(component, resolved);
+        if (component === schema_1.InfraComponent.Keycloak) {
+            warnings.push(exports.MANAGED_KEYCLOAK_LIMITATION_WARNING);
+        }
     }
     return { managed, external, disabled, byComponent, warnings };
 }

package/dist/runtime/infra/infra-plan.js.map

@@ -1 +1 @@
-{"version":3,"file":"infra-plan.js","sourceRoot":"","sources":["../../../src/runtime/infra/infra-plan.ts"],"names":[],"mappings":";;AAwCA,4CAgDC;AAxFD,mDAAkE;AAClE,6CAK0B;AAgC1B,MAAM,YAAY,GAAG,kBAAS,CAAC,OAAO,CAAC;AAEvC,SAAgB,gBAAgB,CAAC,MAAkB;IACjD,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,EAA0C,CAAC;IACtE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,SAAS,IAAI,gCAAgB,EAAE,CAAC;QACzC,MAAM,GAAG,GAAyB,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACpF,MAAM,OAAO,GAAG,6BAAa,CAAC,SAAS,CAAC,CAAC;QAEzC,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAS,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,oBAAoB,SAAS,0CAA0C;oBACrE,sEAAsE,CACzE,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAA2B,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YACpF,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxB,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACrC,QAAQ,CAAC,IAAI,CACX,SAAS,SAAS,mEAAmE;gBACnF,yDAAyD,CAC5D,CAAC;YACF,SAAS;QACX,CAAC;QAED,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAS,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CACb,oBAAoB,SAAS,gDAAgD;oBAC3E,wEAAwE,CAC3E,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAA2B,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YAClG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxB,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACrC,SAAS;QACX,CAAC;QAGD,MAAM,QAAQ,GAA2B,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvB,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAChE,CAAC"}
+{"version":3,"file":"infra-plan.js","sourceRoot":"","sources":["../../../src/runtime/infra/infra-plan.ts"],"names":[],"mappings":";;;AA8DA,4CAmDC;AAjHD,mDAAkE;AAClE,6CAK0B;AAgC1B,MAAM,YAAY,GAAG,kBAAS,CAAC,OAAO,CAAC;AAgB1B,QAAA,mCAAmC,GAC9C,kFAAkF;IAClF,uEAAuE;IACvE,qFAAqF;IACrF,4EAA4E;IAC5E,qFAAqF;IACrF,qDAAqD,CAAC;AAExD,SAAgB,gBAAgB,CAAC,MAAkB;IACjD,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,EAA0C,CAAC;IACtE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,SAAS,IAAI,gCAAgB,EAAE,CAAC;QACzC,MAAM,GAAG,GAAyB,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACpF,MAAM,OAAO,GAAG,6BAAa,CAAC,SAAS,CAAC,CAAC;QAEzC,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAS,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,oBAAoB,SAAS,0CAA0C;oBACrE,sEAAsE,CACzE,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAA2B,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YACpF,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxB,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACrC,QAAQ,CAAC,IAAI,CACX,SAAS,SAAS,mEAAmE;gBACnF,yDAAyD,CAC5D,CAAC;YACF,SAAS;QACX,CAAC;QAED,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAS,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CACb,oBAAoB,SAAS,gDAAgD;oBAC3E,wEAAwE,CAC3E,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAA2B,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YAClG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxB,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACrC,SAAS;QACX,CAAC;QAGD,MAAM,QAAQ,GAA2B,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvB,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,SAAS,KAAK,uBAAc,CAAC,QAAQ,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,2CAAmC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAChE,CAAC"}

package/dist/runtime/infra/infra-runner.d.ts

@@ -1,27 +1,42 @@
 import { InfraComponent } from '../config/schema';
 import type { InfraPlan } from './infra-plan';
 import type { RosterEntry } from '../roster';
+import type { LocalInfrastructureCredentials } from '../secrets/managed-local-store';
 export interface ManagedInfraHandle {
     readonly component: InfraComponent;
     readonly containerName: string;
 }
 export interface InfraRunnerOptions {
     readonly network: string;
+    readonly installationId: string;
     readonly bin?: string;
     readonly volumePrefix?: string;
     readonly healthTimeoutMs?: number;
+    readonly credentials?: LocalInfrastructureCredentials;
+    readonly keycloakRealm: string;
+    readonly stateRoot?: string;
 }
 export declare class InfraRunner {
     private readonly opts;
     private readonly docker;
     private readonly volumePrefix;
     constructor(opts: InfraRunnerOptions);
+    assertCredentialStoreCompatible(plan: InfraPlan, hasCredentialStore: boolean): Promise<void>;
     bringUp(plan: InfraPlan): Promise<ManagedInfraHandle[]>;
     waitHealthy(plan: InfraPlan): Promise<void>;
     bootstrap(plan: InfraPlan, roster: readonly RosterEntry[]): Promise<void>;
+    private provisionDependencies;
+    private startComponent;
+    private gate;
+    private probe;
     private isContainerRunning;
-    private bootstrapPostgres;
+    private createDatabases;
     private bootstrapObjectStore;
     private execOk;
+    private componentEnvironment;
+    private postgresEndpoint;
+    private assertPostgresIsManaged;
+    private requireCredentials;
 }
+export declare function dependencyWaves(plan: InfraPlan): ReadonlyArray<readonly InfraComponent[]>;
 //# sourceMappingURL=infra-runner.d.ts.map

package/dist/runtime/infra/infra-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infra-runner.d.ts","sourceRoot":"","sources":["../../../src/runtime/infra/infra-runner.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAgB7C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAKD,qBAAa,WAAW;IAIV,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;gBAET,IAAI,EAAE,kBAAkB;IAK/C,OAAO,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAkCvD,WAAW,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA2B3C,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;YA0BjE,kBAAkB;YAalB,iBAAiB;YAyBjB,oBAAoB;YAkBpB,MAAM;CAQrB"}
+{"version":3,"file":"infra-runner.d.ts","sourceRoot":"","sources":["../../../src/runtime/infra/infra-runner.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,cAAc,EAAwB,MAAM,kBAAkB,CAAC;AAOxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAEV,8BAA8B,EAC/B,MAAM,gCAAgC,CAAC;AAoBxC,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAK/B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,8BAA8B,CAAC;IAEtD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAM/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAMD,qBAAa,WAAW;IAIV,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;gBAET,IAAI,EAAE,kBAAkB;IAS/C,+BAA+B,CACnC,IAAI,EAAE,SAAS,EACf,kBAAkB,EAAE,OAAO,GAC1B,OAAO,CAAC,IAAI,CAAC;IAuCV,OAAO,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAgDvD,WAAW,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAS3C,SAAS,CACb,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,SAAS,WAAW,EAAE,GAC7B,OAAO,CAAC,IAAI,CAAC;YAoCF,qBAAqB;YAmCrB,cAAc;YAuDd,IAAI;YA6BJ,KAAK;YA2BL,kBAAkB;YAmBlB,eAAe;YA8Bf,oBAAoB;YAsBpB,MAAM;IASpB,OAAO,CAAC,oBAAoB;IAa5B,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,uBAAuB;IAiB/B,OAAO,CAAC,kBAAkB;CAY3B;AAOD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,SAAS,GACd,aAAa,CAAC,SAAS,cAAc,EAAE,CAAC,CAmC1C"}