@xemahq/xema 0.13.0 → 0.15.0

package/dist/runtime/installation/validators/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,sBAAsB,GACnC,SAAS,iBAAiB,EAAE,CAwC9B"}

package/dist/runtime/installation/validators/common.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateUniqueEntries = validateUniqueEntries;
+const diagnostics_1 = require("../diagnostics");
+function validateUniqueEntries(installation) {
+    return [
+        ...duplicateIssues(installation.spec.infrastructure.map((binding) => binding.component), 'spec.infrastructure', 'DUPLICATE_INFRASTRUCTURE_COMPONENT'),
+        ...duplicateIssues(installation.spec.secrets.map((secret) => secret.name), 'spec.secrets', 'DUPLICATE_SECRET_REFERENCE'),
+        ...duplicateIssues(installation.spec.domains.map((domain) => `${domain.purpose}:${domain.hostname}`), 'spec.domains', 'DUPLICATE_DOMAIN'),
+        ...duplicateIssues(installation.spec.target.zones ?? [], 'spec.target.zones', 'DUPLICATE_ZONE'),
+        ...duplicateIssues(installation.spec.sources.map((source) => source.name), 'spec.sources', 'DUPLICATE_SOURCE'),
+        ...duplicateIssues(installation.spec.features.include, 'spec.features.include', 'DUPLICATE_FEATURE_INCLUDE'),
+        ...duplicateIssues(installation.spec.features.exclude, 'spec.features.exclude', 'DUPLICATE_FEATURE_EXCLUDE'),
+    ];
+}
+function duplicateIssues(values, path, code) {
+    const seen = new Set();
+    const duplicates = new Set();
+    for (const value of values) {
+        if (seen.has(value)) {
+            duplicates.add(value);
+        }
+        seen.add(value);
+    }
+    return [...duplicates].sort().map((value) => ({
+        kind: diagnostics_1.InstallationIssueKind.Invalid,
+        code,
+        path,
+        message: `contains duplicate entry "${value}"`,
+    }));
+}
+//# sourceMappingURL=common.js.map

package/dist/runtime/installation/validators/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/common.ts"],"names":[],"mappings":";;AAIA,sDA0CC;AA9CD,gDAA+E;AAI/E,SAAgB,qBAAqB,CACnC,YAAoC;IAEpC,OAAO;QACL,GAAG,eAAe,CAChB,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EACpE,qBAAqB,EACrB,oCAAoC,CACrC;QACD,GAAG,eAAe,CAChB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EACtD,cAAc,EACd,4BAA4B,CAC7B;QACD,GAAG,eAAe,CAChB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAC3B,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CACnD,EACD,cAAc,EACd,kBAAkB,CACnB;QACD,GAAG,eAAe,CAChB,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EACpC,mBAAmB,EACnB,gBAAgB,CACjB;QACD,GAAG,eAAe,CAChB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EACtD,cAAc,EACd,kBAAkB,CACnB;QACD,GAAG,eAAe,CAChB,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAClC,uBAAuB,EACvB,2BAA2B,CAC5B;QACD,GAAG,eAAe,CAChB,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAClC,uBAAuB,EACvB,2BAA2B,CAC5B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,MAAyB,EACzB,IAAY,EACZ,IAAY;IAEZ,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI,EAAE,mCAAqB,CAAC,OAAO;QACnC,IAAI;QACJ,IAAI;QACJ,OAAO,EAAE,6BAA6B,KAAK,GAAG;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/runtime/installation/validators/infrastructure.d.ts

@@ -0,0 +1,4 @@
+import { type InstallationIssue } from '../diagnostics';
+import type { ParsedXemaInstallation } from '../contract';
+export declare function validateInfrastructure(installation: ParsedXemaInstallation): readonly InstallationIssue[];
+//# sourceMappingURL=infrastructure.d.ts.map

package/dist/runtime/installation/validators/infrastructure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infrastructure.d.ts","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/infrastructure.ts"],"names":[],"mappings":"AAGA,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,sBAAsB,GACnC,SAAS,iBAAiB,EAAE,CA6E9B"}

package/dist/runtime/installation/validators/infrastructure.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateInfrastructure = validateInfrastructure;
+const schema_1 = require("../../config/schema");
+const infra_catalog_1 = require("../../infra/infra-catalog");
+const url_security_1 = require("../../secrets/url-security");
+const diagnostics_1 = require("../diagnostics");
+function validateInfrastructure(installation) {
+    const issues = [];
+    for (const binding of installation.spec.infrastructure) {
+        const path = `spec.infrastructure.${binding.component}`;
+        if (binding.ownership === schema_1.InfraMode.External &&
+            binding.endpoint === undefined) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Unresolved,
+                code: 'EXTERNAL_ENDPOINT_REQUIRED',
+                path: `${path}.endpoint`,
+                message: 'external infrastructure requires an endpoint',
+            });
+        }
+        if (binding.component === schema_1.InfraComponent.Postgres &&
+            binding.ownership === schema_1.InfraMode.External &&
+            binding.secretRefs.length !== 1) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Unresolved,
+                code: 'POSTGRES_SECRET_REFERENCE_REQUIRED',
+                path: `${path}.secretRefs`,
+                message: 'external PostgreSQL requires exactly one password secret reference',
+            });
+        }
+        if (binding.ownership !== schema_1.InfraMode.External &&
+            binding.endpoint !== undefined) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Invalid,
+                code: 'ENDPOINT_NOT_ALLOWED',
+                path: `${path}.endpoint`,
+                message: `endpoint is not allowed for ${binding.ownership} infrastructure`,
+            });
+        }
+        if (binding.ownership === schema_1.InfraMode.Disabled &&
+            infra_catalog_1.INFRA_CATALOG[binding.component].mandatory) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Invalid,
+                code: 'MANDATORY_INFRASTRUCTURE_DISABLED',
+                path: `${path}.ownership`,
+                message: 'mandatory infrastructure cannot be disabled',
+            });
+        }
+        if (binding.endpoint !== undefined) {
+            validateEndpoint(binding.endpoint, `${path}.endpoint`, issues);
+        }
+        if (binding.realm !== undefined &&
+            binding.component !== schema_1.InfraComponent.Keycloak) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Invalid,
+                code: 'REALM_COMPONENT_INVALID',
+                path: `${path}.realm`,
+                message: 'realm is only valid for identity infrastructure',
+            });
+        }
+        if (binding.bucketPrefix !== undefined &&
+            binding.component !== schema_1.InfraComponent.ObjectStore) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Invalid,
+                code: 'BUCKET_PREFIX_COMPONENT_INVALID',
+                path: `${path}.bucketPrefix`,
+                message: 'bucketPrefix is only valid for object-store infrastructure',
+            });
+        }
+    }
+    return issues;
+}
+function validateEndpoint(endpoint, path, issues) {
+    let parsed;
+    try {
+        parsed = new URL(endpoint);
+    }
+    catch {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'ENDPOINT_INVALID',
+            path,
+            message: 'must be an absolute URL',
+        });
+        return;
+    }
+    if ((0, url_security_1.urlContainsCredentialMaterial)(parsed)) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'SECRET_VALUE_IN_ENDPOINT',
+            path,
+            message: 'must reference credentials through secretRefs, never inline values',
+        });
+    }
+}
+//# sourceMappingURL=infrastructure.js.map

package/dist/runtime/installation/validators/infrastructure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infrastructure.js","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/infrastructure.ts"],"names":[],"mappings":";;AAOA,wDA+EC;AAtFD,gDAAgE;AAChE,6DAA0D;AAC1D,6DAA2E;AAC3E,gDAA+E;AAI/E,SAAgB,sBAAsB,CACpC,YAAoC;IAEpC,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,uBAAuB,OAAO,CAAC,SAAS,EAAE,CAAC;QACxD,IACE,OAAO,CAAC,SAAS,KAAK,kBAAS,CAAC,QAAQ;YACxC,OAAO,CAAC,QAAQ,KAAK,SAAS,EAC9B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,UAAU;gBACtC,IAAI,EAAE,4BAA4B;gBAClC,IAAI,EAAE,GAAG,IAAI,WAAW;gBACxB,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;QACD,IACE,OAAO,CAAC,SAAS,KAAK,uBAAc,CAAC,QAAQ;YAC7C,OAAO,CAAC,SAAS,KAAK,kBAAS,CAAC,QAAQ;YACxC,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAC/B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,UAAU;gBACtC,IAAI,EAAE,oCAAoC;gBAC1C,IAAI,EAAE,GAAG,IAAI,aAAa;gBAC1B,OAAO,EACL,oEAAoE;aACvE,CAAC,CAAC;QACL,CAAC;QACD,IACE,OAAO,CAAC,SAAS,KAAK,kBAAS,CAAC,QAAQ;YACxC,OAAO,CAAC,QAAQ,KAAK,SAAS,EAC9B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;gBACnC,IAAI,EAAE,sBAAsB;gBAC5B,IAAI,EAAE,GAAG,IAAI,WAAW;gBACxB,OAAO,EAAE,+BAA+B,OAAO,CAAC,SAAS,iBAAiB;aAC3E,CAAC,CAAC;QACL,CAAC;QACD,IACE,OAAO,CAAC,SAAS,KAAK,kBAAS,CAAC,QAAQ;YACxC,6BAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,SAAS,EAC1C,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;gBACnC,IAAI,EAAE,mCAAmC;gBACzC,IAAI,EAAE,GAAG,IAAI,YAAY;gBACzB,OAAO,EAAE,6CAA6C;aACvD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,WAAW,EAAE,MAAM,CAAC,CAAC;QACjE,CAAC;QACD,IACE,OAAO,CAAC,KAAK,KAAK,SAAS;YAC3B,OAAO,CAAC,SAAS,KAAK,uBAAc,CAAC,QAAQ,EAC7C,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;gBACnC,IAAI,EAAE,yBAAyB;gBAC/B,IAAI,EAAE,GAAG,IAAI,QAAQ;gBACrB,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;QACD,IACE,OAAO,CAAC,YAAY,KAAK,SAAS;YAClC,OAAO,CAAC,SAAS,KAAK,uBAAc,CAAC,WAAW,EAChD,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;gBACnC,IAAI,EAAE,iCAAiC;gBACvC,IAAI,EAAE,GAAG,IAAI,eAAe;gBAC5B,OAAO,EAAE,4DAA4D;aACtE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAgB,EAChB,IAAY,EACZ,MAA2B;IAE3B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,kBAAkB;YACxB,IAAI;YACJ,OAAO,EAAE,yBAAyB;SACnC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,IAAA,4CAA6B,EAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,0BAA0B;YAChC,IAAI;YACJ,OAAO,EACL,oEAAoE;SACvE,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/runtime/installation/validators/operational.d.ts

@@ -0,0 +1,4 @@
+import { type ParsedXemaInstallation } from '../contract';
+import { type InstallationIssue } from '../diagnostics';
+export declare function validateOperationalPolicy(installation: ParsedXemaInstallation): readonly InstallationIssue[];
+//# sourceMappingURL=operational.d.ts.map

package/dist/runtime/installation/validators/operational.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operational.d.ts","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/operational.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,sBAAsB,EAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE/E,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,sBAAsB,GACnC,SAAS,iBAAiB,EAAE,CA+J9B"}

package/dist/runtime/installation/validators/operational.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateOperationalPolicy = validateOperationalPolicy;
+const contract_1 = require("../contract");
+const diagnostics_1 = require("../diagnostics");
+function validateOperationalPolicy(installation) {
+    const spec = installation.spec;
+    const issues = [];
+    if (spec.features.selection === contract_1.FeatureSelectionMode.Explicit &&
+        spec.features.include.length === 0) {
+        issues.push(issue('FEATURE_INCLUDE_REQUIRED', 'spec.features.include', 'explicit feature selection requires at least one included roster entry', diagnostics_1.InstallationIssueKind.Unresolved));
+    }
+    if (spec.features.selection !== undefined &&
+        spec.features.selection !== contract_1.FeatureSelectionMode.Explicit &&
+        spec.features.include.length > 0) {
+        issues.push(issue('FEATURE_INCLUDE_NOT_ALLOWED', 'spec.features.include', 'feature include entries are only valid with explicit selection'));
+    }
+    if (spec.storage.class === contract_1.StorageClass.External &&
+        spec.storage.externalBinding === undefined) {
+        issues.push(issue('EXTERNAL_STORAGE_BINDING_REQUIRED', 'spec.storage.externalBinding', 'external storage requires a binding reference', diagnostics_1.InstallationIssueKind.Unresolved));
+    }
+    if (spec.storage.class !== contract_1.StorageClass.External &&
+        spec.storage.externalBinding !== undefined) {
+        issues.push(issue('EXTERNAL_STORAGE_BINDING_NOT_ALLOWED', 'spec.storage.externalBinding', 'externalBinding is only valid for external storage'));
+    }
+    if (spec.recovery.mode === contract_1.BackupMode.Disabled &&
+        spec.recovery.destinationSecretRef !== undefined) {
+        issues.push(issue('BACKUP_DESTINATION_NOT_ALLOWED', 'spec.recovery.destinationSecretRef', 'a disabled recovery policy cannot declare a destination'));
+    }
+    if (spec.profile === contract_1.InstallationProfile.EnterpriseRegulated &&
+        spec.recovery.mode !== undefined &&
+        spec.recovery.mode !== contract_1.BackupMode.Continuous) {
+        issues.push(issue('REGULATED_BACKUP_REQUIRED', 'spec.recovery.mode', 'enterprise-regulated installations require continuous backup'));
+    }
+    if (spec.profile === contract_1.InstallationProfile.EnterpriseRegulated &&
+        spec.domains.some((domain) => domain.tls.mode === contract_1.TlsMode.Disabled)) {
+        issues.push(issue('REGULATED_TLS_REQUIRED', 'spec.domains', 'enterprise-regulated installation domains require TLS'));
+    }
+    for (const domain of spec.domains) {
+        const path = `spec.domains.${domain.purpose}.${domain.hostname}.tls.secretRef`;
+        if (domain.tls.mode === contract_1.TlsMode.External &&
+            domain.tls.secretRef === undefined) {
+            issues.push(issue('EXTERNAL_TLS_SECRET_REQUIRED', path, 'external TLS requires a certificate secret reference', diagnostics_1.InstallationIssueKind.Unresolved));
+        }
+        if (domain.tls.mode !== contract_1.TlsMode.External &&
+            domain.tls.secretRef !== undefined) {
+            issues.push(issue('TLS_SECRET_NOT_ALLOWED', path, `a ${domain.tls.mode} TLS policy cannot declare an external certificate secret`));
+        }
+    }
+    if (spec.capacity.minReplicas !== undefined &&
+        spec.capacity.maxReplicas !== undefined &&
+        spec.capacity.minReplicas > spec.capacity.maxReplicas) {
+        issues.push(issue('CAPACITY_RANGE_INVALID', 'spec.capacity', 'minReplicas cannot exceed maxReplicas'));
+    }
+    if (spec.upgrade.channel === contract_1.UpgradeChannel.Pinned &&
+        spec.upgrade.releaseRef === undefined) {
+        issues.push(issue('PINNED_RELEASE_REQUIRED', 'spec.upgrade.releaseRef', 'pinned upgrade channel requires a releaseRef', diagnostics_1.InstallationIssueKind.Unresolved));
+    }
+    if (spec.upgrade.channel !== contract_1.UpgradeChannel.Pinned &&
+        spec.upgrade.releaseRef !== undefined) {
+        issues.push(issue('RELEASE_REF_NOT_ALLOWED', 'spec.upgrade.releaseRef', 'releaseRef is only valid for the pinned upgrade channel'));
+    }
+    return issues;
+}
+function issue(code, path, message, kind = diagnostics_1.InstallationIssueKind.Invalid) {
+    return { kind, code, path, message };
+}
+//# sourceMappingURL=operational.js.map

package/dist/runtime/installation/validators/operational.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operational.js","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/operational.ts"],"names":[],"mappings":";;AAWA,8DAiKC;AA5KD,0CAQqB;AACrB,gDAA+E;AAE/E,SAAgB,yBAAyB,CACvC,YAAoC;IAEpC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC;IAC/B,MAAM,MAAM,GAAwB,EAAE,CAAC;IAEvC,IACE,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,+BAAoB,CAAC,QAAQ;QACzD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAClC,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,0BAA0B,EAC1B,uBAAuB,EACvB,wEAAwE,EACxE,mCAAqB,CAAC,UAAU,CACjC,CACF,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS;QACrC,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,+BAAoB,CAAC,QAAQ;QACzD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAChC,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,6BAA6B,EAC7B,uBAAuB,EACvB,gEAAgE,CACjE,CACF,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,uBAAY,CAAC,QAAQ;QAC5C,IAAI,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,EAC1C,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,mCAAmC,EACnC,8BAA8B,EAC9B,+CAA+C,EAC/C,mCAAqB,CAAC,UAAU,CACjC,CACF,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,uBAAY,CAAC,QAAQ;QAC5C,IAAI,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,EAC1C,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,sCAAsC,EACtC,8BAA8B,EAC9B,oDAAoD,CACrD,CACF,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,qBAAU,CAAC,QAAQ;QAC1C,IAAI,CAAC,QAAQ,CAAC,oBAAoB,KAAK,SAAS,EAChD,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,gCAAgC,EAChC,oCAAoC,EACpC,yDAAyD,CAC1D,CACF,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,OAAO,KAAK,8BAAmB,CAAC,mBAAmB;QACxD,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS;QAChC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,qBAAU,CAAC,UAAU,EAC5C,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,2BAA2B,EAC3B,oBAAoB,EACpB,8DAA8D,CAC/D,CACF,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,OAAO,KAAK,8BAAmB,CAAC,mBAAmB;QACxD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,kBAAO,CAAC,QAAQ,CAAC,EACnE,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,wBAAwB,EACxB,cAAc,EACd,uDAAuD,CACxD,CACF,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,gBAAgB,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,gBAAgB,CAAC;QAC/E,IACE,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,kBAAO,CAAC,QAAQ;YACpC,MAAM,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,EAClC,CAAC;YACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,8BAA8B,EAC9B,IAAI,EACJ,sDAAsD,EACtD,mCAAqB,CAAC,UAAU,CACjC,CACF,CAAC;QACJ,CAAC;QACD,IACE,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,kBAAO,CAAC,QAAQ;YACpC,MAAM,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,EAClC,CAAC;YACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,wBAAwB,EACxB,IAAI,EACJ,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,2DAA2D,CAChF,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IACE,IAAI,CAAC,QAAQ,CAAC,WAAW,KAAK,SAAS;QACvC,IAAI,CAAC,QAAQ,CAAC,WAAW,KAAK,SAAS;QACvC,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EACrD,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,wBAAwB,EACxB,eAAe,EACf,uCAAuC,CACxC,CACF,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,yBAAc,CAAC,MAAM;QAC9C,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,EACrC,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,yBAAyB,EACzB,yBAAyB,EACzB,8CAA8C,EAC9C,mCAAqB,CAAC,UAAU,CACjC,CACF,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,yBAAc,CAAC,MAAM;QAC9C,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,EACrC,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,yBAAyB,EACzB,yBAAyB,EACzB,yDAAyD,CAC1D,CACF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CACZ,IAAY,EACZ,IAAY,EACZ,OAAe,EACf,IAAI,GAAG,mCAAqB,CAAC,OAAO;IAEpC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACvC,CAAC"}

package/dist/runtime/installation/validators/profile.d.ts

@@ -0,0 +1,4 @@
+import { type ParsedXemaInstallation } from '../contract';
+import { type InstallationIssue } from '../diagnostics';
+export declare function validateProfile(installation: ParsedXemaInstallation): readonly InstallationIssue[];
+//# sourceMappingURL=profile.d.ts.map

package/dist/runtime/installation/validators/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,sBAAsB,EAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AA4B/E,wBAAgB,eAAe,CAC7B,YAAY,EAAE,sBAAsB,GACnC,SAAS,iBAAiB,EAAE,CA2D9B"}

package/dist/runtime/installation/validators/profile.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateProfile = validateProfile;
+const contract_1 = require("../contract");
+const diagnostics_1 = require("../diagnostics");
+const PROFILE_TARGETS = {
+    [contract_1.InstallationProfile.Developer]: [contract_1.InstallationTargetKind.LocalMachine],
+    [contract_1.InstallationProfile.Starter]: [
+        contract_1.InstallationTargetKind.LocalMachine,
+        contract_1.InstallationTargetKind.SingleNodeKubernetes,
+    ],
+    [contract_1.InstallationProfile.SingleNodeProduction]: [
+        contract_1.InstallationTargetKind.SingleNodeKubernetes,
+        contract_1.InstallationTargetKind.CustomerKubernetes,
+    ],
+    [contract_1.InstallationProfile.BusinessHa]: [
+        contract_1.InstallationTargetKind.CustomerKubernetes,
+        contract_1.InstallationTargetKind.HostedCell,
+    ],
+    [contract_1.InstallationProfile.EnterpriseRegulated]: [
+        contract_1.InstallationTargetKind.CustomerKubernetes,
+        contract_1.InstallationTargetKind.HostedCell,
+    ],
+    [contract_1.InstallationProfile.HostedCell]: [
+        contract_1.InstallationTargetKind.CustomerKubernetes,
+        contract_1.InstallationTargetKind.HostedCell,
+    ],
+};
+function validateProfile(installation) {
+    const issues = [];
+    const spec = installation.spec;
+    const target = spec.target.kind;
+    if (target !== undefined && !PROFILE_TARGETS[spec.profile].includes(target)) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'PROFILE_TARGET_MISMATCH',
+            path: 'spec.target.kind',
+            message: `${spec.profile} does not support target ${target}`,
+        });
+    }
+    if ((spec.target.zones?.length ?? 0) > 0 &&
+        spec.target.region === undefined) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Unresolved,
+            code: 'TARGET_REGION_REQUIRED',
+            path: 'spec.target.region',
+            message: 'explicit zones require one explicit target region',
+        });
+    }
+    if (spec.profile === contract_1.InstallationProfile.EnterpriseRegulated &&
+        spec.tenancy.isolation === contract_1.TenantIsolation.Shared) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'REGULATED_SHARED_ISOLATION',
+            path: 'spec.tenancy.isolation',
+            message: 'enterprise-regulated installations cannot use shared isolation',
+        });
+    }
+    if (spec.profile === contract_1.InstallationProfile.HostedCell &&
+        spec.operator.kind !== undefined &&
+        spec.operator.kind !== contract_1.InstallationOperatorKind.Platform) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'HOSTED_CELL_OPERATOR_INVALID',
+            path: 'spec.operator.kind',
+            message: 'hosted-cell installations require the platform operator',
+        });
+    }
+    if (spec.profile === contract_1.InstallationProfile.Developer &&
+        spec.lifecycle.environment === contract_1.LifecycleEnvironment.Production) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'DEVELOPER_PRODUCTION_INVALID',
+            path: 'spec.lifecycle.environment',
+            message: 'the developer profile cannot be used for a production lifecycle environment',
+        });
+    }
+    return issues;
+}
+//# sourceMappingURL=profile.js.map

package/dist/runtime/installation/validators/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/profile.ts"],"names":[],"mappings":";;AAoCA,0CA6DC;AAjGD,0CAOqB;AACrB,gDAA+E;AAE/E,MAAM,eAAe,GAEjB;IACF,CAAC,8BAAmB,CAAC,SAAS,CAAC,EAAE,CAAC,iCAAsB,CAAC,YAAY,CAAC;IACtE,CAAC,8BAAmB,CAAC,OAAO,CAAC,EAAE;QAC7B,iCAAsB,CAAC,YAAY;QACnC,iCAAsB,CAAC,oBAAoB;KAC5C;IACD,CAAC,8BAAmB,CAAC,oBAAoB,CAAC,EAAE;QAC1C,iCAAsB,CAAC,oBAAoB;QAC3C,iCAAsB,CAAC,kBAAkB;KAC1C;IACD,CAAC,8BAAmB,CAAC,UAAU,CAAC,EAAE;QAChC,iCAAsB,CAAC,kBAAkB;QACzC,iCAAsB,CAAC,UAAU;KAClC;IACD,CAAC,8BAAmB,CAAC,mBAAmB,CAAC,EAAE;QACzC,iCAAsB,CAAC,kBAAkB;QACzC,iCAAsB,CAAC,UAAU;KAClC;IACD,CAAC,8BAAmB,CAAC,UAAU,CAAC,EAAE;QAChC,iCAAsB,CAAC,kBAAkB;QACzC,iCAAsB,CAAC,UAAU;KAClC;CACF,CAAC;AAEF,SAAgB,eAAe,CAC7B,YAAoC;IAEpC,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAChC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,yBAAyB;YAC/B,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,4BAA4B,MAAM,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IACD,IACE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,EAChC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,UAAU;YACtC,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,mDAAmD;SAC7D,CAAC,CAAC;IACL,CAAC;IACD,IACE,IAAI,CAAC,OAAO,KAAK,8BAAmB,CAAC,mBAAmB;QACxD,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,0BAAe,CAAC,MAAM,EACjD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,gEAAgE;SAC1E,CAAC,CAAC;IACL,CAAC;IACD,IACE,IAAI,CAAC,OAAO,KAAK,8BAAmB,CAAC,UAAU;QAC/C,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS;QAChC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,mCAAwB,CAAC,QAAQ,EACxD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,yDAAyD;SACnE,CAAC,CAAC;IACL,CAAC;IACD,IACE,IAAI,CAAC,OAAO,KAAK,8BAAmB,CAAC,SAAS;QAC9C,IAAI,CAAC,SAAS,CAAC,WAAW,KAAK,+BAAoB,CAAC,UAAU,EAC9D,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,4BAA4B;YAClC,OAAO,EACL,6EAA6E;SAChF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/runtime/installation/validators/secrets.d.ts

@@ -0,0 +1,4 @@
+import { type ParsedXemaInstallation } from '../contract';
+import { type InstallationIssue } from '../diagnostics';
+export declare function validateSecretReferences(installation: ParsedXemaInstallation): readonly InstallationIssue[];
+//# sourceMappingURL=secrets.d.ts.map

package/dist/runtime/installation/validators/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE/E,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,sBAAsB,GACnC,SAAS,iBAAiB,EAAE,CAmD9B"}

package/dist/runtime/installation/validators/secrets.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateSecretReferences = validateSecretReferences;
+const contract_1 = require("../contract");
+const diagnostics_1 = require("../diagnostics");
+function validateSecretReferences(installation) {
+    const issues = [];
+    const declared = new Set(installation.spec.secrets.map((secret) => secret.name));
+    const referenced = collectReferences(installation);
+    for (const reference of referenced) {
+        if (!declared.has(reference.ref)) {
+            issues.push({
+                kind: diagnostics_1.InstallationIssueKind.Unresolved,
+                code: 'SECRET_REFERENCE_UNRESOLVED',
+                path: reference.path,
+                message: `references undeclared secret "${reference.ref}"`,
+            });
+        }
+    }
+    const interactive = installation.spec.secrets.filter((secret) => secret.provider === contract_1.SecretReferenceProvider.Environment ||
+        secret.provider === contract_1.SecretReferenceProvider.File ||
+        secret.provider === contract_1.SecretReferenceProvider.Prompt);
+    if (interactive.length > 0 &&
+        (installation.spec.profile !== contract_1.InstallationProfile.Developer &&
+            installation.spec.profile !== contract_1.InstallationProfile.Starter)) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'DEVELOPER_SECRET_WORKFLOW_REQUIRED',
+            path: 'spec.secrets',
+            message: 'environment, file, and prompt bindings are restricted to developer or starter setup workflows',
+        });
+    }
+    if (interactive.length > 0 &&
+        installation.spec.lifecycle.environment !==
+            contract_1.LifecycleEnvironment.Development) {
+        issues.push({
+            kind: diagnostics_1.InstallationIssueKind.Invalid,
+            code: 'DEVELOPER_SECRET_WORKFLOW_REQUIRED',
+            path: 'spec.secrets',
+            message: 'environment, file, and prompt bindings require a development lifecycle and the explicit developer-interactive workflow',
+        });
+    }
+    return issues;
+}
+function collectReferences(installation) {
+    const referenced = [];
+    for (const binding of installation.spec.infrastructure) {
+        for (const ref of binding.secretRefs) {
+            referenced.push({
+                ref,
+                path: `spec.infrastructure.${binding.component}.secretRefs`,
+            });
+        }
+    }
+    for (const domain of installation.spec.domains) {
+        if (domain.tls.secretRef !== undefined) {
+            referenced.push({
+                ref: domain.tls.secretRef,
+                path: `spec.domains.${domain.purpose}.${domain.hostname}.tls.secretRef`,
+            });
+        }
+    }
+    if (installation.spec.recovery.destinationSecretRef !== undefined) {
+        referenced.push({
+            ref: installation.spec.recovery.destinationSecretRef,
+            path: 'spec.recovery.destinationSecretRef',
+        });
+    }
+    if (installation.spec.observability.exportSecretRef !== undefined) {
+        referenced.push({
+            ref: installation.spec.observability.exportSecretRef,
+            path: 'spec.observability.exportSecretRef',
+        });
+    }
+    for (const source of installation.spec.sources) {
+        if ('authSecretRef' in source && source.authSecretRef !== undefined) {
+            referenced.push({
+                ref: source.authSecretRef,
+                path: `spec.sources.${source.name}.authSecretRef`,
+            });
+        }
+    }
+    return referenced;
+}
+//# sourceMappingURL=secrets.js.map

package/dist/runtime/installation/validators/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../../src/runtime/installation/validators/secrets.ts"],"names":[],"mappings":";;AAQA,4DAqDC;AA7DD,0CAKqB;AACrB,gDAA+E;AAE/E,SAAgB,wBAAwB,CACtC,YAAoC;IAEpC,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CACvD,CAAC;IACF,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAEnD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mCAAqB,CAAC,UAAU;gBACtC,IAAI,EAAE,6BAA6B;gBACnC,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,OAAO,EAAE,iCAAiC,SAAS,CAAC,GAAG,GAAG;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAClD,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,QAAQ,KAAK,kCAAuB,CAAC,WAAW;QACvD,MAAM,CAAC,QAAQ,KAAK,kCAAuB,CAAC,IAAI;QAChD,MAAM,CAAC,QAAQ,KAAK,kCAAuB,CAAC,MAAM,CACrD,CAAC;IACF,IACE,WAAW,CAAC,MAAM,GAAG,CAAC;QACtB,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,KAAK,8BAAmB,CAAC,SAAS;YAC1D,YAAY,CAAC,IAAI,CAAC,OAAO,KAAK,8BAAmB,CAAC,OAAO,CAAC,EAC5D,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,oCAAoC;YAC1C,IAAI,EAAE,cAAc;YACpB,OAAO,EACL,+FAA+F;SAClG,CAAC,CAAC;IACL,CAAC;IACD,IACE,WAAW,CAAC,MAAM,GAAG,CAAC;QACtB,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW;YACrC,+BAAoB,CAAC,WAAW,EAClC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mCAAqB,CAAC,OAAO;YACnC,IAAI,EAAE,oCAAoC;YAC1C,IAAI,EAAE,cAAc;YACpB,OAAO,EACL,wHAAwH;SAC3H,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACxB,YAAoC;IAEpC,MAAM,UAAU,GAAyC,EAAE,CAAC;IAC5D,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACvD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACrC,UAAU,CAAC,IAAI,CAAC;gBACd,GAAG;gBACH,IAAI,EAAE,uBAAuB,OAAO,CAAC,SAAS,aAAa;aAC5D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvC,UAAU,CAAC,IAAI,CAAC;gBACd,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS;gBACzB,IAAI,EAAE,gBAAgB,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,gBAAgB;aACxE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAClE,UAAU,CAAC,IAAI,CAAC;YACd,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB;YACpD,IAAI,EAAE,oCAAoC;SAC3C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAClE,UAAU,CAAC,IAAI,CAAC;YACd,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe;YACpD,IAAI,EAAE,oCAAoC;SAC3C,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/C,IAAI,eAAe,IAAI,MAAM,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACpE,UAAU,CAAC,IAAI,CAAC;gBACd,GAAG,EAAE,MAAM,CAAC,aAAa;gBACzB,IAAI,EAAE,gBAAgB,MAAM,CAAC,IAAI,gBAAgB;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/runtime/launch-plan-format.d.ts

@@ -0,0 +1,3 @@
+import type { LaunchPlan } from './launch';
+export declare function formatLaunchPlan(plan: LaunchPlan): string;
+//# sourceMappingURL=launch-plan-format.d.ts.map

package/dist/runtime/launch-plan-format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch-plan-format.d.ts","sourceRoot":"","sources":["../../src/runtime/launch-plan-format.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAQ3C,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAqEzD"}

package/dist/runtime/launch-plan-format.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatLaunchPlan = formatLaunchPlan;
+function formatLaunchPlan(plan) {
+    const lines = [];
+    const rule = '─'.repeat(72);
+    lines.push('xema — boot preview  (dry run: nothing was started)');
+    lines.push(rule);
+    lines.push(`substrate : ${plan.substrate}`);
+    lines.push(`edition   : ${plan.lock.path} (${plan.lock.source})`);
+    const managed = plan.infra.managed.length > 0
+        ? plan.infra.managed.map((m) => m.component).join(', ')
+        : '(none — assumed already running)';
+    lines.push(`infra     : ${managed}`);
+    if (plan.addedPrerequisites.length > 0) {
+        lines.push(`prereqs   : +${String(plan.addedPrerequisites.length)} hard prerequisite(s) pulled in: ` +
+            plan.addedPrerequisites.join(', '));
+    }
+    if (plan.skippedOptionalBiomes.length > 0) {
+        lines.push(`optional  : skipping optional biome(s) not explicitly included: ` +
+            `${plan.skippedOptionalBiomes.join(', ')} (add them to app.include, or use include: 'all')`);
+    }
+    if (plan.infraWarnings.length > 0) {
+        for (const w of plan.infraWarnings) {
+            lines.push(`warn      : ${w}`);
+        }
+    }
+    lines.push('');
+    lines.push(`services  : ${String(plan.roster.length)} across ${String(plan.waves.length)} wave(s) ` +
+        `(waves boot in order; members within a wave boot concurrently)`);
+    lines.push(rule);
+    const nameWidth = Math.min(40, Math.max(20, ...plan.roster.map((e) => e.name.length)));
+    for (const wave of plan.waves) {
+        lines.push(`wave ${String(wave.index)} — ${wave.tier}  (${String(wave.members.length)})`);
+        const members = [...wave.members].sort((a, b) => a.name.localeCompare(b.name));
+        for (const m of members) {
+            const port = plan.ports.get(m.name);
+            const portCol = port !== undefined ? `:${String(port)}` : '(image)';
+            const from = m.sourceRoot ?? m.servicePath ?? '';
+            const src = m.sourceName ? ` [${m.sourceName}]` : '';
+            lines.push(`  ${m.name.padEnd(nameWidth)} ${portCol.padEnd(8)} ${from}${src}`.trimEnd());
+        }
+    }
+    if (plan.unresolvedSources.length > 0) {
+        lines.push(rule);
+        lines.push('unresolved (offline preview — would clone):');
+        for (const note of plan.unresolvedSources) {
+            lines.push(`  ${note}`);
+        }
+    }
+    lines.push(rule);
+    lines.push('Native services run compiled dist/main.js — build changed services first ' +
+        '(`pnpm --filter <svc> build`) or use `xema dev --watch`.');
+    lines.push('Re-run without --dry-run to boot.');
+    return lines.join('\n');
+}
+//# sourceMappingURL=launch-plan-format.js.map

package/dist/runtime/launch-plan-format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch-plan-format.js","sourceRoot":"","sources":["../../src/runtime/launch-plan-format.ts"],"names":[],"mappings":";;AAQA,4CAqEC;AArED,SAAgB,gBAAgB,CAAC,IAAgB;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAE5B,KAAK,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5C,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAClE,MAAM,OAAO,GACX,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACvD,CAAC,CAAC,kCAAkC,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CACR,gBAAgB,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,mCAAmC;YACvF,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CACrC,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CACR,kEAAkE;YAChE,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,mDAAmD,CAC9F,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,eAAe,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW;QACtF,gEAAgE,CACnE,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEjB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,EAAE,EACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CACvD,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,QAAQ,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1F,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/E,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAGpE,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,KAAK,CAAC,IAAI,CACR,2EAA2E;QACzE,0DAA0D,CAC7D,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/runtime/launch.d.ts

@@ -1,22 +1,54 @@
-import { type XemaConfig } from './config/schema';
+import { Substrate, type XemaConfig } from './config/schema';
+import { resolveInfraPlan } from './infra/infra-plan';
 import { type RosterEntry, type RosterInclude, type RosterSelection } from './roster';
 import { type BringUpResult, type LifecycleEvent } from './supervisor';
+import { deriveWaves } from './waves';
+import type { HelmReleaseRendering } from './installation/helm-release';
 export interface LaunchOptions {
     readonly config: XemaConfig;
     readonly includeWeb: boolean;
+    readonly installationIdentity?: string;
+    readonly installationId?: string;
     readonly lockPathOverride?: string | undefined;
     readonly bootGraphPathOverride?: string | undefined;
     readonly onEvent?: (event: LifecycleEvent) => void;
     readonly log?: (line: string) => void;
+    readonly planHash?: string;
+    readonly offline?: boolean;
+    readonly includeBiomes?: readonly string[];
+    readonly helmRelease?: HelmReleaseRendering;
+    readonly allowEmulatedPlatform?: boolean;
 }
 export interface LaunchHandle {
     readonly result: BringUpResult;
+    readonly plan: LaunchPlan;
+    readonly installationId: string;
+    readonly planHash: string;
+    readonly executionId: string;
     readonly roster: readonly RosterEntry[];
     shutdown(): Promise<void>;
 }
-export declare function launch(opts: LaunchOptions): Promise<LaunchHandle>;
+export interface LaunchPlan {
+    readonly substrate: Substrate;
+    readonly lock: {
+        readonly path: string;
+        readonly source: string;
+    };
+    readonly roster: readonly RosterEntry[];
+    readonly waves: ReturnType<typeof deriveWaves>;
+    readonly ports: ReadonlyMap<string, number>;
+    readonly infra: ReturnType<typeof resolveInfraPlan>;
+    readonly addedPrerequisites: readonly string[];
+    readonly skippedOptionalBiomes: readonly string[];
+    readonly infraWarnings: readonly string[];
+    readonly unresolvedSources: readonly string[];
+    readonly helmNamespace?: string;
+}
+export declare function resolveLaunchPlan(opts: LaunchOptions): LaunchPlan;
+export declare function unionIncludeServices(include: RosterInclude, services: readonly string[]): RosterInclude;
+export declare function launch(opts: LaunchOptions, preResolved?: LaunchPlan): Promise<LaunchHandle>;
 export declare function buildSelection(config: XemaConfig, includeWeb: boolean): RosterSelection;
-export declare function normalizeInclude(include: 'all' | readonly string[], features: readonly string[]): RosterInclude;
+export declare function normalizeInclude(include: 'all' | 'default' | 'minimal' | readonly string[], features: readonly string[]): RosterInclude;
 export declare function splitIncludeTokens(tokens: readonly string[]): {
     tiers: string[];
     services: string[];

package/dist/runtime/launch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"launch.d.ts","sourceRoot":"","sources":["../../src/runtime/launch.ts"],"names":[],"mappings":"AAQA,OAAO,EAAwC,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAOxF,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,eAAe,EACrB,MAAM,UAAU,CAAC;AAMlB,OAAO,EAAc,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAYnF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;IACnD,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAOD,wBAAsB,MAAM,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAkJvE;AAgCD,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,GAAG,eAAe,CAQvF;AAYD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,KAAK,GAAG,SAAS,MAAM,EAAE,EAClC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,aAAa,CAMf;AAGD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG;IAC7D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAWA"}
+{"version":3,"file":"launch.d.ts","sourceRoot":"","sources":["../../src/runtime/launch.ts"],"names":[],"mappings":"AAoBA,OAAO,EAGL,SAAS,EACT,KAAK,UAAU,EAChB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAYtD,OAAO,EAOL,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,eAAe,EACrB,MAAM,UAAU,CAAC;AA2BlB,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAGL,WAAW,EACZ,MAAM,SAAS,CAAC;AAKjB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAexE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAE7B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAEvC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;IACnD,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAEtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAQ3B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAU3B,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAQ3C,QAAQ,CAAC,WAAW,CAAC,EAAE,oBAAoB,CAAC;IAO5C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAE/B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAQD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC;IAEpD,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IAM/C,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IAElD,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAM1C,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAM9C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AASD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,UAAU,CAiIjE;AAQD,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,aAAa,CAcf;AAqED,wBAAsB,MAAM,CAC1B,IAAI,EAAE,aAAa,EACnB,WAAW,CAAC,EAAE,UAAU,GACvB,OAAO,CAAC,YAAY,CAAC,CA0BvB;AAwaD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,OAAO,GAClB,eAAe,CAQjB;AAcD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,KAAK,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,EAC1D,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,aAAa,CAsBf;AAGD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG;IAC7D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAWA"}