@xemahq/xema 0.13.0 → 0.15.0

package/dist/runtime/installation/setup-renderer.js

@@ -0,0 +1,238 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderInstallationSetup = renderInstallationSetup;
+const contract_1 = require("./contract");
+const diff_1 = require("./diff");
+const serialization_1 = require("./serialization");
+const RENDERER_ID = 'xema-cli-installation-setup/v1';
+const MATERIAL_OBLIGATIONS = [
+    diff_1.InstallationRenderObligation.RuntimeReconfigure,
+    diff_1.InstallationRenderObligation.WorkloadRollout,
+    diff_1.InstallationRenderObligation.InfrastructureReconcile,
+    diff_1.InstallationRenderObligation.DataAndRecoveryReconcile,
+];
+function renderInstallationSetup(installation, opts = {}) {
+    assertSupportedProfile(installation.spec.profile);
+    assertProfilePlacement(installation);
+    const providers = assertProvidersReady(installation, opts.providers ?? []);
+    const artifacts = artifactModels(installation, providers)
+        .map((candidate) => renderArtifact(installation, candidate))
+        .sort((left, right) => left.path.localeCompare(right.path));
+    const renderedArtifacts = MATERIAL_OBLIGATIONS.map((obligation) => {
+        const obligationArtifacts = artifacts.filter((artifact) => artifact.obligation === obligation);
+        if (obligationArtifacts.length === 0) {
+            throw new Error(`Installation setup renderer left obligation ${obligation} unresolved.`);
+        }
+        return {
+            obligation,
+            rendererId: RENDERER_ID,
+            effectivePlanHash: installation.effectivePlanHash,
+            artifactDigest: `sha256:${(0, serialization_1.hashInstallation)(obligationArtifacts.map(({ path, digest }) => ({ path, digest })))}`,
+        };
+    });
+    return {
+        rendererId: RENDERER_ID,
+        profile: installation.spec.profile,
+        effectivePlanHash: installation.effectivePlanHash,
+        artifacts,
+        renderedArtifacts,
+    };
+}
+function artifactModels(installation, providers) {
+    switch (installation.spec.profile) {
+        case contract_1.InstallationProfile.Developer:
+        case contract_1.InstallationProfile.Starter:
+            return localArtifactModels(installation, providers);
+        case contract_1.InstallationProfile.SingleNodeProduction:
+            return singleNodeArtifactModels(installation, providers);
+        case contract_1.InstallationProfile.BusinessHa:
+        case contract_1.InstallationProfile.EnterpriseRegulated:
+        case contract_1.InstallationProfile.HostedCell:
+            return unsupported(installation.spec.profile);
+    }
+}
+function localArtifactModels(installation, providers) {
+    const spec = installation.spec;
+    return [
+        {
+            path: 'runtime/config.json',
+            obligation: diff_1.InstallationRenderObligation.RuntimeReconfigure,
+            kind: 'LocalRuntimeConfiguration',
+            spec: {
+                lifecycle: spec.lifecycle,
+                security: spec.security,
+                observability: spec.observability,
+                capacity: spec.capacity,
+            },
+        },
+        {
+            path: 'launcher/workloads.json',
+            obligation: diff_1.InstallationRenderObligation.WorkloadRollout,
+            kind: 'LocalWorkloadPlan',
+            spec: {
+                distribution: spec.distribution,
+                features: spec.features,
+                sources: spec.sources,
+                domains: spec.domains,
+                upgrade: spec.upgrade,
+            },
+        },
+        {
+            path: 'bootstrap/local.json',
+            obligation: diff_1.InstallationRenderObligation.InfrastructureReconcile,
+            kind: 'LocalBootstrapPlan',
+            spec: {
+                profile: spec.profile,
+                target: spec.target,
+                operator: spec.operator,
+                infrastructure: spec.infrastructure,
+                secrets: renderedSecretBindings(spec.secrets, providers),
+            },
+        },
+        {
+            path: 'storage/policy.json',
+            obligation: diff_1.InstallationRenderObligation.DataAndRecoveryReconcile,
+            kind: 'LocalDataPolicy',
+            spec: {
+                tenancy: spec.tenancy,
+                storage: spec.storage,
+                recovery: spec.recovery,
+            },
+        },
+    ];
+}
+function singleNodeArtifactModels(installation, providers) {
+    const spec = installation.spec;
+    return [
+        {
+            path: 'observability/config.json',
+            obligation: diff_1.InstallationRenderObligation.RuntimeReconfigure,
+            kind: 'SingleNodeObservabilityConfiguration',
+            spec: {
+                lifecycle: spec.lifecycle,
+                security: spec.security,
+                observability: spec.observability,
+            },
+        },
+        {
+            path: 'helm/xema.values.json',
+            obligation: diff_1.InstallationRenderObligation.WorkloadRollout,
+            kind: 'SingleNodeHelmValues',
+            spec: {
+                distribution: spec.distribution,
+                features: spec.features,
+                capacity: spec.capacity,
+                domains: spec.domains,
+                sources: spec.sources,
+            },
+        },
+        {
+            path: 'upgrade/policy.json',
+            obligation: diff_1.InstallationRenderObligation.WorkloadRollout,
+            kind: 'SingleNodeUpgradePolicy',
+            spec: { upgrade: spec.upgrade },
+        },
+        {
+            path: 'bootstrap/cluster.json',
+            obligation: diff_1.InstallationRenderObligation.InfrastructureReconcile,
+            kind: 'SingleNodeBootstrapPlan',
+            spec: {
+                profile: spec.profile,
+                target: spec.target,
+                operator: spec.operator,
+                infrastructure: spec.infrastructure,
+                storage: spec.storage,
+                secrets: renderedSecretBindings(spec.secrets, providers),
+            },
+        },
+        {
+            path: 'backup/policy.json',
+            obligation: diff_1.InstallationRenderObligation.DataAndRecoveryReconcile,
+            kind: 'SingleNodeBackupPolicy',
+            spec: {
+                tenancy: spec.tenancy,
+                recovery: spec.recovery,
+            },
+        },
+    ];
+}
+function renderedSecretBindings(bindings, providers) {
+    return bindings.map((binding) => ({
+        ...binding,
+        ...(binding.provider === contract_1.SecretReferenceProvider.ManagedLocal
+            ? { keyRef: providers.get(binding.provider)?.keyRef }
+            : {}),
+    }));
+}
+function renderArtifact(installation, model) {
+    const content = `${(0, serialization_1.serializeInstallation)({
+        apiVersion: 'setup.xema.dev/v1',
+        kind: model.kind,
+        effectivePlanHash: installation.effectivePlanHash,
+        spec: model.spec,
+    })}\n`;
+    return {
+        path: model.path,
+        mediaType: 'application/json',
+        obligation: model.obligation,
+        effectivePlanHash: installation.effectivePlanHash,
+        digest: `sha256:${(0, serialization_1.hashInstallation)({
+            path: model.path,
+            effectivePlanHash: installation.effectivePlanHash,
+            content,
+        })}`,
+        content,
+    };
+}
+function assertProvidersReady(installation, readiness) {
+    const providers = new Map();
+    for (const item of readiness) {
+        if (providers.has(item.provider)) {
+            throw new Error(`Secret provider readiness was declared more than once for ${item.provider}.`);
+        }
+        providers.set(item.provider, item);
+    }
+    for (const binding of installation.spec.secrets) {
+        const provider = providers.get(binding.provider);
+        if (provider?.available !== true) {
+            throw new Error(`Secret provider ${binding.provider} is unavailable for binding "${binding.name}"; no fallback provider was attempted.`);
+        }
+        if (binding.provider === contract_1.SecretReferenceProvider.ManagedLocal &&
+            (provider.keyRef === undefined || provider.keyRef.length === 0)) {
+            throw new Error(`Managed-local binding "${binding.name}" has no custody key reference.`);
+        }
+        if (binding.provider === contract_1.SecretReferenceProvider.ManagedLocal &&
+            !provider.resolvedEntries?.includes(binding.entry)) {
+            throw new Error(`Managed-local binding "${binding.name}" has no authenticated immutable entry "${binding.entry}".`);
+        }
+    }
+    return providers;
+}
+function assertSupportedProfile(profile) {
+    if (profile === contract_1.InstallationProfile.BusinessHa ||
+        profile === contract_1.InstallationProfile.EnterpriseRegulated ||
+        profile === contract_1.InstallationProfile.HostedCell) {
+        unsupported(profile);
+    }
+}
+function assertProfilePlacement(installation) {
+    const spec = installation.spec;
+    if ((spec.profile === contract_1.InstallationProfile.Developer ||
+        spec.profile === contract_1.InstallationProfile.Starter) &&
+        (spec.lifecycle.environment !== contract_1.LifecycleEnvironment.Development ||
+            spec.target.kind !== contract_1.InstallationTargetKind.LocalMachine)) {
+        throw new Error(`Installation setup renderer requires ${spec.profile} to use a development lifecycle on a local-machine target.`);
+    }
+    if (spec.profile === contract_1.InstallationProfile.SingleNodeProduction &&
+        (spec.lifecycle.environment !== contract_1.LifecycleEnvironment.Production ||
+            spec.target.kind !== contract_1.InstallationTargetKind.SingleNodeKubernetes ||
+            spec.capacity.minReplicas !== 1 ||
+            spec.capacity.maxReplicas !== 1 ||
+            spec.capacity.zones !== 1)) {
+        throw new Error('Installation setup renderer requires single-node-production to use one production Kubernetes node in one zone.');
+    }
+}
+function unsupported(profile) {
+    throw new Error(`Installation setup renderer does not support profile ${profile}; no artifacts were produced.`);
+}
+//# sourceMappingURL=setup-renderer.js.map

package/dist/runtime/installation/setup-renderer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-renderer.js","sourceRoot":"","sources":["../../../src/runtime/installation/setup-renderer.ts"],"names":[],"mappings":";;AAyDA,0DAmCC;AA5FD,yCAKoB;AACpB,iCAGgB;AAChB,mDAA0E;AAI1E,MAAM,WAAW,GAAG,gCAAgC,CAAC;AACrD,MAAM,oBAAoB,GAAG;IAC3B,mCAA4B,CAAC,kBAAkB;IAC/C,mCAA4B,CAAC,eAAe;IAC5C,mCAA4B,CAAC,uBAAuB;IACpD,mCAA4B,CAAC,wBAAwB;CAC7C,CAAC;AAqCX,SAAgB,uBAAuB,CACrC,YAAsC,EACtC,OAAuC,EAAE;IAEzC,sBAAsB,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,cAAc,CAAC,YAAY,EAAE,SAAS,CAAC;SACtD,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;SAC3D,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;QAChE,MAAM,mBAAmB,GAAG,SAAS,CAAC,MAAM,CAC1C,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,KAAK,UAAU,CACjD,CAAC;QACF,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,+CAA+C,UAAU,cAAc,CACxE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,UAAU;YACV,UAAU,EAAE,WAAW;YACvB,iBAAiB,EAAE,YAAY,CAAC,iBAAiB;YACjD,cAAc,EAAE,UAAU,IAAA,gCAAgB,EACxC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAClE,EAAE;SACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO;QACL,UAAU,EAAE,WAAW;QACvB,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO;QAClC,iBAAiB,EAAE,YAAY,CAAC,iBAAiB;QACjD,SAAS;QACT,iBAAiB;KAClB,CAAC;AACJ,CAAC;AASD,SAAS,cAAc,CACrB,YAAsC,EACtC,SAAwE;IAExE,QAAQ,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,KAAK,8BAAmB,CAAC,SAAS,CAAC;QACnC,KAAK,8BAAmB,CAAC,OAAO;YAC9B,OAAO,mBAAmB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACtD,KAAK,8BAAmB,CAAC,oBAAoB;YAC3C,OAAO,wBAAwB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC3D,KAAK,8BAAmB,CAAC,UAAU,CAAC;QACpC,KAAK,8BAAmB,CAAC,mBAAmB,CAAC;QAC7C,KAAK,8BAAmB,CAAC,UAAU;YACjC,OAAO,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,YAAsC,EACtC,SAAwE;IAExE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC;IAC/B,OAAO;QACL;YACE,IAAI,EAAE,qBAAqB;YAC3B,UAAU,EAAE,mCAA4B,CAAC,kBAAkB;YAC3D,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE;gBACJ,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB;SACF;QACD;YACE,IAAI,EAAE,yBAAyB;YAC/B,UAAU,EAAE,mCAA4B,CAAC,eAAe;YACxD,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE;gBACJ,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB;SACF;QACD;YACE,IAAI,EAAE,sBAAsB;YAC5B,UAAU,EAAE,mCAA4B,CAAC,uBAAuB;YAChE,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE;gBACJ,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,OAAO,EAAE,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;aACzD;SACF;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,UAAU,EAAE,mCAA4B,CAAC,wBAAwB;YACjE,IAAI,EAAE,iBAAiB;YACvB,IAAI,EAAE;gBACJ,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,YAAsC,EACtC,SAAwE;IAExE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC;IAC/B,OAAO;QACL;YACE,IAAI,EAAE,2BAA2B;YACjC,UAAU,EAAE,mCAA4B,CAAC,kBAAkB;YAC3D,IAAI,EAAE,sCAAsC;YAC5C,IAAI,EAAE;gBACJ,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC;SACF;QACD;YACE,IAAI,EAAE,uBAAuB;YAC7B,UAAU,EAAE,mCAA4B,CAAC,eAAe;YACxD,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE;gBACJ,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB;SACF;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,UAAU,EAAE,mCAA4B,CAAC,eAAe;YACxD,IAAI,EAAE,yBAAyB;YAC/B,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SAChC;QACD;YACE,IAAI,EAAE,wBAAwB;YAC9B,UAAU,EAAE,mCAA4B,CAAC,uBAAuB;YAChE,IAAI,EAAE,yBAAyB;YAC/B,IAAI,EAAE;gBACJ,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;aACzD;SACF;QACD;YACE,IAAI,EAAE,oBAAoB;YAC1B,UAAU,EAAE,mCAA4B,CAAC,wBAAwB;YACjE,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE;gBACJ,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAAqD,EACrD,SAAwE;IAExE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAChC,GAAG,OAAO;QACV,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,kCAAuB,CAAC,YAAY;YAC3D,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE;YACrD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,cAAc,CACrB,YAAsC,EACtC,KAAoB;IAEpB,MAAM,OAAO,GAAG,GAAG,IAAA,qCAAqB,EAAC;QACvC,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,iBAAiB,EAAE,YAAY,CAAC,iBAAiB;QACjD,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,IAAI,CAAC;IACP,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,kBAAkB;QAC7B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,iBAAiB,EAAE,YAAY,CAAC,iBAAiB;QACjD,MAAM,EAAE,UAAU,IAAA,gCAAgB,EAAC;YACjC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,iBAAiB,EAAE,YAAY,CAAC,iBAAiB;YACjD,OAAO;SACR,CAAC,EAAE;QACJ,OAAO;KACR,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,YAAsC,EACtC,SAA6C;IAE7C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC9E,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,6DAA6D,IAAI,CAAC,QAAQ,GAAG,CAC9E,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,QAAQ,EAAE,SAAS,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,mBAAmB,OAAO,CAAC,QAAQ,gCAAgC,OAAO,CAAC,IAAI,wCAAwC,CACxH,CAAC;QACJ,CAAC;QACD,IACE,OAAO,CAAC,QAAQ,KAAK,kCAAuB,CAAC,YAAY;YACzD,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,EAC/D,CAAC;YACD,MAAM,IAAI,KAAK,CACb,0BAA0B,OAAO,CAAC,IAAI,iCAAiC,CACxE,CAAC;QACJ,CAAC;QACD,IACE,OAAO,CAAC,QAAQ,KAAK,kCAAuB,CAAC,YAAY;YACzD,CAAC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAClD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,0BAA0B,OAAO,CAAC,IAAI,2CAA2C,OAAO,CAAC,KAAK,IAAI,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,sBAAsB,CAAC,OAA4B;IAC1D,IACE,OAAO,KAAK,8BAAmB,CAAC,UAAU;QAC1C,OAAO,KAAK,8BAAmB,CAAC,mBAAmB;QACnD,OAAO,KAAK,8BAAmB,CAAC,UAAU,EAC1C,CAAC;QACD,WAAW,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,YAAsC;IACpE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC;IAC/B,IACE,CAAC,IAAI,CAAC,OAAO,KAAK,8BAAmB,CAAC,SAAS;QAC7C,IAAI,CAAC,OAAO,KAAK,8BAAmB,CAAC,OAAO,CAAC;QAC/C,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,KAAK,+BAAoB,CAAC,WAAW;YAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,iCAAsB,CAAC,YAAY,CAAC,EAC3D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,wCAAwC,IAAI,CAAC,OAAO,4DAA4D,CACjH,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,OAAO,KAAK,8BAAmB,CAAC,oBAAoB;QACzD,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,KAAK,+BAAoB,CAAC,UAAU;YAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,iCAAsB,CAAC,oBAAoB;YAChE,IAAI,CAAC,QAAQ,CAAC,WAAW,KAAK,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,WAAW,KAAK,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,CAAC,EAC5B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAA4B;IAC/C,MAAM,IAAI,KAAK,CACb,wDAAwD,OAAO,+BAA+B,CAC/F,CAAC;AACJ,CAAC"}

package/dist/runtime/installation/state-store.d.ts

@@ -0,0 +1,28 @@
+import { type CompiledXemaInstallation } from './compiler';
+import { type InstallationRenderAcknowledgement } from './diff';
+export interface AppliedInstallationState {
+    readonly schemaVersion: 2;
+    readonly appliedAt: string;
+    readonly effectivePlanHash: string;
+    readonly renderedArtifacts: readonly InstallationRenderAcknowledgement[];
+    readonly plan: CompiledXemaInstallation;
+}
+export interface InstallationStateStoreOptions {
+    readonly root?: string;
+}
+export declare class InstallationStateStore {
+    private readonly root;
+    constructor(opts?: InstallationStateStoreOptions);
+    read(installationId: string): AppliedInstallationState | undefined;
+    write(plan: CompiledXemaInstallation, renderedArtifacts: readonly InstallationRenderAcknowledgement[], appliedAt?: string): AppliedInstallationState;
+    acquireApplyLock(installationId: string): () => void;
+    acquireLocalRuntimeLock(): () => void;
+    claimLocalRuntimeOwner(installationId: string): void;
+    assertLocalRuntimeOwner(installationId: string): void;
+    releaseLocalRuntimeOwner(installationId: string): void;
+    private acquireLock;
+    private appliedPath;
+    private localRuntimeOwnerPath;
+    private installationDirectory;
+}
+//# sourceMappingURL=state-store.d.ts.map

package/dist/runtime/installation/state-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-store.d.ts","sourceRoot":"","sources":["../../../src/runtime/installation/state-store.ts"],"names":[],"mappings":"AAkBA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,YAAY,CAAC;AACpB,OAAO,EAEL,KAAK,iCAAiC,EACvC,MAAM,QAAQ,CAAC;AAGhB,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,iBAAiB,EAAE,SAAS,iCAAiC,EAAE,CAAC;IACzE,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;CACzC;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAgBD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAEX,IAAI,GAAE,6BAAkC;IAIpD,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS;IAclE,KAAK,CACV,IAAI,EAAE,wBAAwB,EAC9B,iBAAiB,EAAE,SAAS,iCAAiC,EAAE,EAC/D,SAAS,SAA2B,GACnC,wBAAwB;IAiBpB,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,IAAI;IAapD,uBAAuB,IAAI,MAAM,IAAI;IAKrC,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI;IAqBpD,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI;IAkBrD,wBAAwB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI;IAiB7D,OAAO,CAAC,WAAW;IA6DnB,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,qBAAqB;CAQ9B"}

package/dist/runtime/installation/state-store.js

@@ -0,0 +1,377 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InstallationStateStore = void 0;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const compiler_1 = require("./compiler");
+const diff_1 = require("./diff");
+const serialization_1 = require("./serialization");
+const PRIVATE_DIRECTORY_MODE = 0o700;
+const PRIVATE_FILE_MODE = 0o600;
+class InstallationStateStore {
+    root;
+    constructor(opts = {}) {
+        this.root = opts.root ?? (0, node_path_1.join)((0, node_os_1.homedir)(), '.xema', 'installations');
+    }
+    read(installationId) {
+        const path = this.appliedPath(installationId);
+        const directory = (0, node_path_1.dirname)(path);
+        if (!(0, node_fs_1.existsSync)(directory)) {
+            return undefined;
+        }
+        assertPrivateDirectory(directory);
+        if (!(0, node_fs_1.existsSync)(path)) {
+            return undefined;
+        }
+        const parsed = JSON.parse(readPrivateFile(path));
+        return parseAppliedState(parsed, path);
+    }
+    write(plan, renderedArtifacts, appliedAt = new Date().toISOString()) {
+        validateRenderedArtifacts(renderedArtifacts, plan.effectivePlanHash, `new state for ${plan.metadata.name}`);
+        const state = {
+            schemaVersion: 2,
+            appliedAt,
+            effectivePlanHash: plan.effectivePlanHash,
+            renderedArtifacts,
+            plan,
+        };
+        writeJsonAtomically(this.appliedPath(plan.metadata.name), state);
+        return state;
+    }
+    acquireApplyLock(installationId) {
+        const path = (0, node_path_1.join)(this.installationDirectory(installationId), 'apply.lock');
+        return this.acquireLock(path, `Installation "${installationId}"`);
+    }
+    acquireLocalRuntimeLock() {
+        const path = (0, node_path_1.join)(this.root, '.local-runtime', 'apply.lock');
+        return this.acquireLock(path, 'Local runtime');
+    }
+    claimLocalRuntimeOwner(installationId) {
+        const path = this.localRuntimeOwnerPath();
+        ensurePrivateDirectory((0, node_path_1.dirname)(path));
+        if ((0, node_fs_1.existsSync)(path)) {
+            const owner = parseLocalRuntimeOwner(JSON.parse(readPrivateFile(path)), path);
+            if (owner.installationId !== installationId) {
+                throw new Error(`Local managed runtime data is owned by installation "${owner.installationId}", not "${installationId}". Purge the owning installation before reusing fixed local volumes and ports.`);
+            }
+            return;
+        }
+        writeJsonAtomically(path, {
+            installationId,
+            claimedAt: new Date().toISOString(),
+        });
+    }
+    assertLocalRuntimeOwner(installationId) {
+        const path = this.localRuntimeOwnerPath();
+        if (!(0, node_fs_1.existsSync)(path)) {
+            throw new Error(`Local managed runtime has no durable owner record; refusing destructive cleanup for installation "${installationId}".`);
+        }
+        const owner = parseLocalRuntimeOwner(JSON.parse(readPrivateFile(path)), path);
+        if (owner.installationId !== installationId) {
+            throw new Error(`Local managed runtime data is owned by installation "${owner.installationId}", not "${installationId}".`);
+        }
+    }
+    releaseLocalRuntimeOwner(installationId) {
+        const path = this.localRuntimeOwnerPath();
+        if (!(0, node_fs_1.existsSync)(path)) {
+            return;
+        }
+        const owner = parseLocalRuntimeOwner(JSON.parse(readPrivateFile(path)), path);
+        if (owner.installationId !== installationId) {
+            throw new Error(`Refusing to release local runtime data owned by installation "${owner.installationId}".`);
+        }
+        (0, node_fs_1.rmSync)(path);
+    }
+    acquireLock(path, subject) {
+        const recoveryPath = `${path}.recovery`;
+        ensurePrivateDirectory((0, node_path_1.dirname)(path));
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            const owner = {
+                pid: process.pid,
+                token: (0, node_crypto_1.randomUUID)(),
+                acquiredAt: new Date().toISOString(),
+            };
+            try {
+                writeExclusiveFile(path, owner);
+                let released = false;
+                return () => {
+                    if (!released) {
+                        assertLockOwnership(path, owner.token);
+                        released = true;
+                        (0, node_fs_1.rmSync)(path, { force: true });
+                    }
+                };
+            }
+            catch (error) {
+                const code = error.code;
+                if (code !== 'EEXIST') {
+                    throw error;
+                }
+                const existing = readLockOwner(path);
+                if (existing === undefined) {
+                    throw new Error(`${subject} has an unreadable apply lock at ${path}; remove it only after confirming no apply process is running.`);
+                }
+                if (processIsAlive(existing.pid)) {
+                    throw new Error(`${subject} is already being applied by process ${String(existing.pid)}.`);
+                }
+                const releaseRecovery = acquireRecoveryLock(recoveryPath, subject);
+                try {
+                    const rechecked = readLockOwner(path);
+                    if (rechecked === undefined ||
+                        rechecked.token !== existing.token ||
+                        processIsAlive(rechecked.pid)) {
+                        throw new Error(`${subject} apply-lock ownership changed during stale-lock recovery; retry after the active apply completes.`);
+                    }
+                    (0, node_fs_1.rmSync)(path);
+                }
+                finally {
+                    releaseRecovery();
+                }
+            }
+        }
+        throw new Error(`Could not acquire the apply lock for ${subject}.`);
+    }
+    appliedPath(installationId) {
+        return (0, node_path_1.join)(this.installationDirectory(installationId), 'last-applied.json');
+    }
+    localRuntimeOwnerPath() {
+        return (0, node_path_1.join)(this.root, '.local-runtime', 'owner.json');
+    }
+    installationDirectory(installationId) {
+        if (!/^[A-Za-z0-9._-]+$/.test(installationId)) {
+            throw new Error(`Installation id "${installationId}" is unsafe for local state storage.`);
+        }
+        return (0, node_path_1.join)(this.root, installationId);
+    }
+}
+exports.InstallationStateStore = InstallationStateStore;
+function parseAppliedState(value, path) {
+    if (value === null || typeof value !== 'object') {
+        throw new Error(`Applied installation state is invalid: ${path}`);
+    }
+    const schemaVersion = value.schemaVersion;
+    if (schemaVersion === 1) {
+        throw new Error(`Applied installation state schema v1 is incompatible with effective-plan renderer evidence; re-apply the installation to create schema v2 state: ${path}`);
+    }
+    if (schemaVersion !== 2) {
+        throw new Error(`Applied installation state schema is unsupported: ${path}`);
+    }
+    const state = value;
+    if (typeof state.appliedAt !== 'string' ||
+        !Number.isFinite(Date.parse(state.appliedAt)) ||
+        typeof state.effectivePlanHash !== 'string' ||
+        !/^[a-f0-9]{64}$/.test(state.effectivePlanHash) ||
+        !Array.isArray(state.renderedArtifacts) ||
+        state.plan === undefined ||
+        state.plan.effectivePlanHash !== state.effectivePlanHash) {
+        throw new Error(`Applied installation state is corrupt: ${path}`);
+    }
+    validateRenderedArtifacts(state.renderedArtifacts, state.effectivePlanHash, path);
+    const { effectivePlanHash: _effectivePlanHash, ...planPayload } = state.plan;
+    if ((0, serialization_1.hashInstallation)((0, compiler_1.effectivePayload)(planPayload)) !== state.effectivePlanHash) {
+        throw new Error(`Applied installation state hash is invalid: ${path}`);
+    }
+    let plan;
+    try {
+        plan = (0, compiler_1.compileXemaInstallation)(planPayload);
+    }
+    catch {
+        throw new Error(`Applied installation state plan is invalid: ${path}`);
+    }
+    if (plan.effectivePlanHash !== state.effectivePlanHash) {
+        throw new Error(`Applied installation state plan is non-canonical: ${path}`);
+    }
+    return {
+        schemaVersion: 2,
+        appliedAt: state.appliedAt,
+        effectivePlanHash: state.effectivePlanHash,
+        renderedArtifacts: state.renderedArtifacts,
+        plan,
+    };
+}
+function parseLocalRuntimeOwner(value, path) {
+    if (typeof value !== 'object' || value === null) {
+        throw new Error(`Local runtime owner record is invalid at ${path}.`);
+    }
+    const record = value;
+    if (typeof record.installationId !== 'string' ||
+        record.installationId.length === 0 ||
+        typeof record.claimedAt !== 'string' ||
+        record.claimedAt.length === 0) {
+        throw new Error(`Local runtime owner record is invalid at ${path}.`);
+    }
+    return {
+        installationId: record.installationId,
+        claimedAt: record.claimedAt,
+    };
+}
+const RENDER_OBLIGATIONS = new Set(Object.values(diff_1.InstallationRenderObligation));
+function validateRenderedArtifacts(value, effectivePlanHash, path) {
+    const seen = new Set();
+    for (const entry of value) {
+        if (entry === null || typeof entry !== 'object') {
+            throw new Error(`Applied installation renderer evidence is corrupt: ${path}`);
+        }
+        const evidence = entry;
+        if (evidence.obligation === undefined ||
+            !RENDER_OBLIGATIONS.has(evidence.obligation) ||
+            seen.has(evidence.obligation) ||
+            typeof evidence.rendererId !== 'string' ||
+            evidence.rendererId.length === 0 ||
+            evidence.effectivePlanHash !== effectivePlanHash ||
+            typeof evidence.artifactDigest !== 'string' ||
+            !/^sha256:[a-f0-9]{64}$/.test(evidence.artifactDigest)) {
+            throw new Error(`Applied installation renderer evidence is corrupt: ${path}`);
+        }
+        seen.add(evidence.obligation);
+    }
+    for (const required of [
+        diff_1.InstallationRenderObligation.RuntimeReconfigure,
+        diff_1.InstallationRenderObligation.WorkloadRollout,
+        diff_1.InstallationRenderObligation.InfrastructureReconcile,
+        diff_1.InstallationRenderObligation.DataAndRecoveryReconcile,
+    ]) {
+        if (!seen.has(required)) {
+            throw new Error(`Applied installation renderer evidence is incomplete (${required}): ${path}`);
+        }
+    }
+}
+function readLockOwner(path) {
+    try {
+        const value = JSON.parse(readPrivateFile(path));
+        return typeof value.pid === 'number' &&
+            Number.isInteger(value.pid) &&
+            typeof value.token === 'string' &&
+            value.token.length > 0 &&
+            typeof value.acquiredAt === 'string'
+            ? value
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function processIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+function writeJsonAtomically(path, value) {
+    const directory = (0, node_path_1.dirname)(path);
+    ensurePrivateDirectory(directory);
+    const temporary = (0, node_path_1.join)(directory, `.last-applied.${String(process.pid)}.${Date.now().toString(36)}.tmp`);
+    const fd = (0, node_fs_1.openSync)(temporary, 'wx', PRIVATE_FILE_MODE);
+    try {
+        (0, node_fs_1.writeFileSync)(fd, `${(0, serialization_1.serializeInstallation)(value)}\n`, 'utf8');
+        (0, node_fs_1.fsyncSync)(fd);
+    }
+    finally {
+        (0, node_fs_1.closeSync)(fd);
+    }
+    try {
+        (0, node_fs_1.renameSync)(temporary, path);
+        const directoryFd = (0, node_fs_1.openSync)(directory, 'r');
+        try {
+            (0, node_fs_1.fsyncSync)(directoryFd);
+        }
+        finally {
+            (0, node_fs_1.closeSync)(directoryFd);
+        }
+    }
+    catch (error) {
+        (0, node_fs_1.rmSync)(temporary, { force: true });
+        throw error;
+    }
+}
+function ensurePrivateDirectory(directory) {
+    (0, node_fs_1.mkdirSync)(directory, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });
+    assertPrivateDirectory(directory);
+}
+function assertPrivateDirectory(directory) {
+    const stat = (0, node_fs_1.lstatSync)(directory);
+    if (!stat.isDirectory() ||
+        !ownedByCurrentUser(stat.uid) ||
+        (process.platform !== 'win32' && (stat.mode & 0o077) !== 0)) {
+        throw new Error(`Installation state directory is unsafe at ${directory}; expected an installer-owned directory with mode 0700.`);
+    }
+}
+function readPrivateFile(path) {
+    let fd;
+    try {
+        fd = (0, node_fs_1.openSync)(path, node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NOFOLLOW ?? 0));
+        const stat = (0, node_fs_1.fstatSync)(fd);
+        if (!stat.isFile() ||
+            !ownedByCurrentUser(stat.uid) ||
+            (process.platform !== 'win32' && (stat.mode & 0o077) !== 0)) {
+            throw new Error(`Installation state file is unsafe at ${path}; expected an installer-owned regular file with mode 0600.`);
+        }
+        return (0, node_fs_1.readFileSync)(fd, 'utf8');
+    }
+    finally {
+        if (fd !== undefined) {
+            (0, node_fs_1.closeSync)(fd);
+        }
+    }
+}
+function writeExclusiveFile(path, value) {
+    const fd = (0, node_fs_1.openSync)(path, 'wx', PRIVATE_FILE_MODE);
+    try {
+        (0, node_fs_1.writeFileSync)(fd, `${(0, serialization_1.serializeInstallation)(value)}\n`, 'utf8');
+        (0, node_fs_1.fsyncSync)(fd);
+    }
+    finally {
+        (0, node_fs_1.closeSync)(fd);
+    }
+}
+function acquireRecoveryLock(path, subject) {
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        const owner = {
+            pid: process.pid,
+            token: (0, node_crypto_1.randomUUID)(),
+            acquiredAt: new Date().toISOString(),
+        };
+        try {
+            writeExclusiveFile(path, owner);
+            return () => {
+                assertLockOwnership(path, owner.token);
+                (0, node_fs_1.rmSync)(path);
+            };
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST') {
+                throw error;
+            }
+            const existing = readLockOwner(path);
+            if (existing === undefined) {
+                throw new Error(`${subject} has an unreadable stale-lock recovery lease at ${path}; remove it only after confirming no apply process is running.`);
+            }
+            if (processIsAlive(existing.pid)) {
+                throw new Error(`${subject} stale-lock recovery is already in progress by process ${String(existing.pid)}. Retry after it completes.`);
+            }
+            const rechecked = readLockOwner(path);
+            if (rechecked === undefined ||
+                rechecked.token !== existing.token ||
+                processIsAlive(rechecked.pid)) {
+                throw new Error(`${subject} stale-lock recovery ownership changed; retry after the active recovery completes.`);
+            }
+            (0, node_fs_1.rmSync)(path);
+        }
+    }
+    throw new Error(`Could not acquire stale-lock recovery for ${subject}.`);
+}
+function assertLockOwnership(path, token) {
+    const owner = readLockOwner(path);
+    if (owner?.token !== token) {
+        throw new Error(`Installation apply lock ownership changed unexpectedly at ${path}; refusing to remove another process's lock.`);
+    }
+}
+function ownedByCurrentUser(uid) {
+    return typeof process.getuid !== 'function' || process.getuid() === uid;
+}
+//# sourceMappingURL=state-store.js.map