@xemahq/xema 0.59.0 → 0.60.1

package/dist/runtime/tenancy/servers.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readServersDeclaration = readServersDeclaration;
+exports.readServersFile = readServersFile;
+const node_fs_1 = require("node:fs");
+const installation_tenancy_1 = require("@xemahq/installation-tenancy");
+const yaml_1 = require("yaml");
+const cli_errors_1 = require("../../lib/cli-errors");
+const SERVER_KEYS = [...Object.values(installation_tenancy_1.Backend), ...Object.values(installation_tenancy_1.DeclaredServer)];
+const POOLER_FIELDS = ['endpoint', 'sslParams'];
+const INSTALLER_FIELDS = ['realm', 'clientId', 'secretName'];
+function text(path, what, value) {
+    if (typeof value !== 'string' || value.trim() === '') {
+        throw new cli_errors_1.CliConfigurationError(`${path}: ${what} must be a non-empty string`);
+    }
+    return value.trim();
+}
+function poolerOf(path, value) {
+    if (!isMapping(value)) {
+        throw new cli_errors_1.CliConfigurationError(`${path}: postgres.pooler must be a mapping of ${POOLER_FIELDS.join(', ')}`);
+    }
+    const unknown = Object.keys(value).filter((key) => !POOLER_FIELDS.includes(key));
+    if (unknown.length > 0) {
+        throw new cli_errors_1.CliConfigurationError(`${path}: postgres.pooler has unknown keys ${unknown.join(', ')}`);
+    }
+    return {
+        endpoint: text(path, 'postgres.pooler.endpoint', value.endpoint),
+        sslParams: text(path, 'postgres.pooler.sslParams', value.sslParams),
+    };
+}
+function isMapping(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function installerOf(path, value) {
+    if (!isMapping(value)) {
+        throw new cli_errors_1.CliConfigurationError(`${path}: identity.installer must be a mapping of ${INSTALLER_FIELDS.join(', ')}`);
+    }
+    const unknown = Object.keys(value).filter((key) => !INSTALLER_FIELDS.includes(key));
+    if (unknown.length > 0) {
+        throw new cli_errors_1.CliConfigurationError(`${path}: identity.installer has unknown keys ${unknown.join(', ')}`);
+    }
+    return {
+        realm: text(path, 'identity.installer.realm', value.realm),
+        clientId: text(path, 'identity.installer.clientId', value.clientId),
+        secretName: text(path, 'identity.installer.secretName', value.secretName),
+    };
+}
+function readServersDeclaration(path) {
+    let parsed;
+    try {
+        parsed = (0, yaml_1.parse)((0, node_fs_1.readFileSync)(path, 'utf8'));
+    }
+    catch (error) {
+        throw new cli_errors_1.CliConfigurationError(`cannot read the servers file ${path}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!isMapping(parsed)) {
+        throw new cli_errors_1.CliConfigurationError(`${path} must be a mapping of backend to endpoint`);
+    }
+    const endpoints = {};
+    let identityInstaller;
+    let postgresPooler;
+    for (const [key, value] of Object.entries(parsed)) {
+        if (!SERVER_KEYS.includes(key)) {
+            throw new cli_errors_1.CliConfigurationError(`${path}: '${key}' is not a backend (${SERVER_KEYS.join(', ')})`);
+        }
+        if (key === installation_tenancy_1.Backend.Identity && isMapping(value)) {
+            const extra = Object.keys(value).filter((entry) => entry !== 'endpoint' && entry !== 'installer');
+            if (extra.length > 0) {
+                throw new cli_errors_1.CliConfigurationError(`${path}: identity has unknown keys ${extra.join(', ')}`);
+            }
+            endpoints[installation_tenancy_1.Backend.Identity] = text(path, 'the endpoint of identity', value.endpoint);
+            if (value.installer !== undefined) {
+                identityInstaller = installerOf(path, value.installer);
+            }
+            continue;
+        }
+        if (key === installation_tenancy_1.Backend.Postgres && isMapping(value)) {
+            const extra = Object.keys(value).filter((entry) => entry !== 'endpoint' && entry !== 'pooler');
+            if (extra.length > 0) {
+                throw new cli_errors_1.CliConfigurationError(`${path}: postgres has unknown keys ${extra.join(', ')}`);
+            }
+            endpoints[installation_tenancy_1.Backend.Postgres] = text(path, 'the endpoint of postgres', value.endpoint);
+            if (value.pooler !== undefined) {
+                postgresPooler = poolerOf(path, value.pooler);
+            }
+            continue;
+        }
+        if (typeof value !== 'string' || value.trim() === '') {
+            throw new cli_errors_1.CliConfigurationError(`${path}: the endpoint of ${key} must be a non-empty string`);
+        }
+        endpoints[key] = value.trim();
+    }
+    return {
+        endpoints,
+        ...(identityInstaller === undefined ? {} : { identityInstaller }),
+        ...(postgresPooler === undefined ? {} : { postgresPooler }),
+    };
+}
+function readServersFile(path) {
+    return readServersDeclaration(path).endpoints;
+}
+//# sourceMappingURL=servers.js.map

package/dist/runtime/tenancy/servers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"servers.js","sourceRoot":"","sources":["../../../src/runtime/tenancy/servers.ts"],"names":[],"mappings":";;AAmFA,wDAiDC;AAED,0CAEC;AAxID,qCAAuC;AAEvC,uEAAoH;AACpH,+BAA0C;AAE1C,qDAA6D;AAE7D,MAAM,WAAW,GAAsB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,8BAAO,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,qCAAc,CAAC,CAAC,CAAC;AA2BrG,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,WAAW,CAAU,CAAC;AACzD,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,CAAU,CAAC;AAEtE,SAAS,IAAI,CAAC,IAAY,EAAE,IAAY,EAAE,KAAc;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,kCAAqB,CAAC,GAAG,IAAI,KAAK,IAAI,6BAA6B,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAc;IAC5C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,kCAAqB,CAAC,GAAG,IAAI,0CAA0C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAE,aAAmC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACxG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,kCAAqB,CAAC,GAAG,IAAI,sCAAsC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,0BAA0B,EAAE,KAAK,CAAC,QAAQ,CAAC;QAChE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,2BAA2B,EAAE,KAAK,CAAC,SAAS,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAAc;IAC/C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,kCAAqB,CAAC,GAAG,IAAI,6CAA6C,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAE,gBAAsC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3G,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,kCAAqB,CAAC,GAAG,IAAI,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,0BAA0B,EAAE,KAAK,CAAC,KAAK,CAAC;QAC1D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,6BAA6B,EAAE,KAAK,CAAC,QAAQ,CAAC;QACnE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,+BAA+B,EAAE,KAAK,CAAC,UAAU,CAAC;KAC1E,CAAC;AACJ,CAAC;AAQD,SAAgB,sBAAsB,CAAC,IAAY;IACjD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,YAAS,EAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kCAAqB,CAAC,gCAAgC,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrI,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,kCAAqB,CAAC,GAAG,IAAI,2CAA2C,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,SAAS,GAA8D,EAAE,CAAC;IAChF,IAAI,iBAA2D,CAAC;IAChE,IAAI,cAAqD,CAAC;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,kCAAqB,CAAC,GAAG,IAAI,MAAM,GAAG,uBAAuB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,GAAG,KAAK,8BAAO,CAAC,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,WAAW,CAAC,CAAC;YAClG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,kCAAqB,CAAC,GAAG,IAAI,+BAA+B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5F,CAAC;YACD,SAAS,CAAC,8BAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,0BAA0B,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACrF,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClC,iBAAiB,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACzD,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,8BAAO,CAAC,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,QAAQ,CAAC,CAAC;YAC/F,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,kCAAqB,CAAC,GAAG,IAAI,+BAA+B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5F,CAAC;YACD,SAAS,CAAC,8BAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,0BAA0B,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACrF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,kCAAqB,CAAC,GAAG,IAAI,qBAAqB,GAAG,6BAA6B,CAAC,CAAC;QAChG,CAAC;QACD,SAAS,CAAC,GAAuC,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACpE,CAAC;IACD,OAAO;QACL,SAAS;QACT,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjE,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe,CAAC,IAAY;IAC1C,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC"}

package/dist/runtime/tenancy/session.d.ts

@@ -0,0 +1,19 @@
+import { type AuthorityOptions, type InstallationContext, type InventoryPersister, type OpenFgaInput, type TenancyEndpoints, type TenancySpecs, type XemaInstallationInventory } from '@xemahq/installation-tenancy';
+import type { IdentityInstallerDeclaration, PostgresPoolerDeclaration } from './servers';
+import type { InstallationStateStore } from '../installation/state-store';
+export declare const AUTHORITY_OPTIONS: AuthorityOptions;
+export declare function inventoryPersister(path: string, store: InstallationStateStore): InventoryPersister;
+export declare function loadInventory(installation: string, path: string | undefined, store: InstallationStateStore): XemaInstallationInventory | undefined;
+export interface TenancySessionInput {
+    readonly installation: string;
+    readonly endpoints: TenancyEndpoints;
+    readonly specs: TenancySpecs;
+    readonly authority: string;
+    readonly persister: InventoryPersister;
+    readonly openFga?: OpenFgaInput;
+    readonly identityInstaller?: IdentityInstallerDeclaration;
+    readonly postgresPooler?: PostgresPoolerDeclaration;
+    readonly keycloakEndpoint?: string;
+}
+export declare function openTenancy(input: TenancySessionInput): Promise<InstallationContext>;
+//# sourceMappingURL=session.d.ts.map

package/dist/runtime/tenancy/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/runtime/tenancy/session.ts"],"names":[],"mappings":"AAEA,OAAO,EAQL,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EAEvB,KAAK,YAAY,EAEjB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,yBAAyB,EAC/B,MAAM,8BAA8B,CAAC;AAKtC,OAAO,KAAK,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACzF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAG1E,eAAO,MAAM,iBAAiB,EAAE,gBAQ/B,CAAC;AAGF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,GAAG,kBAAkB,CAOlG;AAGD,wBAAgB,aAAa,CAC3B,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,KAAK,EAAE,sBAAsB,GAC5B,yBAAyB,GAAG,SAAS,CAOvC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IAEvC,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAEhC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,4BAA4B,CAAC;IAE1D,QAAQ,CAAC,cAAc,CAAC,EAAE,yBAAyB,CAAC;IAEpD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AA0BD,wBAAsB,WAAW,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgC1F"}

package/dist/runtime/tenancy/session.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTHORITY_OPTIONS = void 0;
+exports.inventoryPersister = inventoryPersister;
+exports.loadInventory = loadInventory;
+exports.openTenancy = openTenancy;
+const node_fs_1 = require("node:fs");
+const installation_tenancy_1 = require("@xemahq/installation-tenancy");
+const identity_installer_1 = require("./identity-installer");
+const cli_errors_1 = require("../../lib/cli-errors");
+exports.AUTHORITY_OPTIONS = {
+    requestTimeoutMs: 30_000,
+    postgresSsl: false,
+    postgresMaintenanceDatabase: 'postgres',
+    redisTls: false,
+    keycloakLoginRealm: 'master',
+    objectStoreRegion: 'us-east-1',
+    temporalApiKey: false,
+};
+function inventoryPersister(path, store) {
+    return {
+        persist(inventory) {
+            (0, installation_tenancy_1.writeInventory)(path, inventory);
+            store.writeInventoryCache(inventory.installation, (0, node_fs_1.readFileSync)(path, 'utf8'));
+        },
+    };
+}
+function loadInventory(installation, path, store) {
+    const source = path ?? store.inventoryCachePath(installation);
+    if (path !== undefined && !(0, node_fs_1.existsSync)(path)) {
+        return undefined;
+    }
+    const text = path === undefined ? store.readInventoryCache(installation) : (0, node_fs_1.readFileSync)(path, 'utf8');
+    return text === undefined ? undefined : (0, installation_tenancy_1.parseInventoryText)(text, source);
+}
+async function openFgaConnection(input, endpoint, secrets) {
+    if (input.openFga !== undefined) {
+        return { endpoint, presharedKey: input.openFga.presharedKey, requestTimeoutMs: exports.AUTHORITY_OPTIONS.requestTimeoutMs };
+    }
+    const path = (0, installation_tenancy_1.openFgaPresharedPath)((0, installation_tenancy_1.installationNames)(input.installation));
+    const presharedKey = await secrets.read(path);
+    if (presharedKey === undefined) {
+        throw new cli_errors_1.CliConfigurationError(`the openFga endpoint is known but its preshared key is not provided and the installation mount holds none at ${path}; declare the fga key in the installation file's infrastructure binding`);
+    }
+    return { endpoint, presharedKey, requestTimeoutMs: exports.AUTHORITY_OPTIONS.requestTimeoutMs };
+}
+async function openTenancy(input) {
+    const endpoints = {
+        ...input.endpoints,
+        ...(input.openFga === undefined ? {} : { [installation_tenancy_1.Backend.OpenFga]: input.openFga.endpoint }),
+    };
+    const backends = Object.keys(endpoints).filter((backend) => backend !== installation_tenancy_1.Backend.OpenFga);
+    const identityInstaller = await (0, identity_installer_1.resolveIdentityInstaller)({
+        endpoints,
+        installer: input.identityInstaller,
+        keycloakEndpoint: input.keycloakEndpoint,
+        requestTimeoutMs: exports.AUTHORITY_OPTIONS.requestTimeoutMs,
+    });
+    const connections = (0, installation_tenancy_1.connectionsFromAuthority)(input.authority, endpoints, backends, {
+        ...exports.AUTHORITY_OPTIONS,
+        ...(identityInstaller === undefined ? {} : { identityInstaller }),
+    });
+    const openBao = connections[installation_tenancy_1.Backend.OpenBao];
+    if (openBao === undefined) {
+        throw new cli_errors_1.CliConfigurationError('the servers file must name openbao: a new installation keeps its secrets only there');
+    }
+    const secrets = new installation_tenancy_1.OpenBaoSecretWriter(openBao);
+    const openFgaEndpoint = endpoints[installation_tenancy_1.Backend.OpenFga];
+    return {
+        installation: input.installation,
+        specs: input.specs,
+        connections: openFgaEndpoint === undefined ? connections : { ...connections, [installation_tenancy_1.Backend.OpenFga]: await openFgaConnection(input, openFgaEndpoint, secrets) },
+        endpoints,
+        secrets,
+        persister: input.persister,
+        ...(input.postgresPooler === undefined ? {} : { postgresPooler: input.postgresPooler }),
+    };
+}
+//# sourceMappingURL=session.js.map

package/dist/runtime/tenancy/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/runtime/tenancy/session.ts"],"names":[],"mappings":";;;AAuCA,gDAOC;AAGD,sCAWC;AA0CD,kCAgCC;AAtID,qCAAmD;AAEnD,uEAiBsC;AAEtC,6DAAgE;AAChE,qDAA6D;AAMhD,QAAA,iBAAiB,GAAqB;IACjD,gBAAgB,EAAE,MAAM;IACxB,WAAW,EAAE,KAAK;IAClB,2BAA2B,EAAE,UAAU;IACvC,QAAQ,EAAE,KAAK;IACf,kBAAkB,EAAE,QAAQ;IAC5B,iBAAiB,EAAE,WAAW;IAC9B,cAAc,EAAE,KAAK;CACtB,CAAC;AAGF,SAAgB,kBAAkB,CAAC,IAAY,EAAE,KAA6B;IAC5E,OAAO;QACL,OAAO,CAAC,SAAoC;YAC1C,IAAA,qCAAc,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAChC,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,YAAY,EAAE,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC;AAGD,SAAgB,aAAa,CAC3B,YAAoB,EACpB,IAAwB,EACxB,KAA6B;IAE7B,MAAM,MAAM,GAAG,IAAI,IAAI,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC9D,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtG,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,yCAAkB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3E,CAAC;AAuBD,KAAK,UAAU,iBAAiB,CAC9B,KAA0B,EAC1B,QAAgB,EAChB,OAA4B;IAE5B,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,gBAAgB,EAAE,yBAAiB,CAAC,gBAAgB,EAAE,CAAC;IACtH,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,2CAAoB,EAAC,IAAA,wCAAiB,EAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,kCAAqB,CAC7B,gHAAgH,IAAI,yEAAyE,CAC9L,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,EAAE,yBAAiB,CAAC,gBAAgB,EAAE,CAAC;AAC1F,CAAC;AAGM,KAAK,UAAU,WAAW,CAAC,KAA0B;IAC1D,MAAM,SAAS,GAAqB;QAClC,GAAG,KAAK,CAAC,SAAS;QAClB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,8BAAO,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;KACtF,CAAC;IAEF,MAAM,QAAQ,GAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAuB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,8BAAO,CAAC,OAAO,CAAC,CAAC;IAChH,MAAM,iBAAiB,GAAG,MAAM,IAAA,6CAAwB,EAAC;QACvD,SAAS;QACT,SAAS,EAAE,KAAK,CAAC,iBAAiB;QAClC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,gBAAgB,EAAE,yBAAiB,CAAC,gBAAgB;KACrD,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,IAAA,+CAAwB,EAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE;QACjF,GAAG,yBAAiB;QACpB,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC;KAClE,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,WAAW,CAAC,8BAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,kCAAqB,CAAC,qFAAqF,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,0CAAmB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,eAAe,GAAG,SAAS,CAAC,8BAAO,CAAC,OAAO,CAAC,CAAC;IACnD,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,CAAC,8BAAO,CAAC,OAAO,CAAC,EAAE,MAAM,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE;QAC1J,SAAS;QACT,OAAO;QACP,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;KACxF,CAAC;AACJ,CAAC"}

package/dist/runtime/tenancy/specs.d.ts

@@ -0,0 +1,27 @@
+import { type TenancyEndpoints, type TenancySpecs, type XemaInstallationInventory } from '@xemahq/installation-tenancy';
+import type { ParsedXemaInstallation } from '../installation/contract';
+export declare const NAMESPACE_RETENTION_DAYS = 7;
+export declare const BROKER_PATH_PREFIX = "tenant-credentials";
+export declare const IDENTITY_ADMIN_CLIENT_ID = "identity-api";
+export declare const WEB_CLIENT_ID = "web-app";
+export declare const OPENBAO_KUBERNETES_AUTH_MOUNT = "kubernetes";
+export declare function requireSeedIdentityEndpoints(endpoints: TenancyEndpoints): void;
+export declare function tenancySpecsFromInstallation(installation: {
+    readonly metadata: ParsedXemaInstallation['metadata'];
+    readonly spec: {
+        readonly profile: ParsedXemaInstallation['spec']['profile'];
+        readonly operator: {
+            readonly namespace?: string | undefined;
+        };
+        readonly features: {
+            readonly web: boolean;
+        };
+        readonly domains: ParsedXemaInstallation['spec']['domains'];
+        readonly capacity: {
+            readonly maxConcurrentSessions: number;
+            readonly maxReplicas: number;
+        };
+    };
+}, endpoints: TenancyEndpoints, seedProcesses: readonly string[], memberDatabases: readonly string[], env: NodeJS.ProcessEnv, pooled: boolean): TenancySpecs;
+export declare function tenancySpecsFromInventory(inventory: XemaInstallationInventory, endpoints: TenancyEndpoints): TenancySpecs;
+//# sourceMappingURL=specs.d.ts.map

package/dist/runtime/tenancy/specs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"specs.d.ts","sourceRoot":"","sources":["../../../src/runtime/tenancy/specs.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,yBAAyB,EAC/B,MAAM,8BAA8B,CAAC;AAUtC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAIvE,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD,eAAO,MAAM,wBAAwB,iBAAiB,CAAC;AAEvD,eAAO,MAAM,aAAa,YAAY,CAAC;AAQvC,eAAO,MAAM,6BAA6B,eAAe,CAAC;AAO1D,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,gBAAgB,GAAG,IAAI,CAc9E;AA6BD,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE;IACZ,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACtD,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5D,QAAQ,CAAC,QAAQ,EAAE;YAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;SAAE,CAAC;QAC/D,QAAQ,CAAC,QAAQ,EAAE;YAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;SAAE,CAAC;QAC7C,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC;QAE5D,QAAQ,CAAC,QAAQ,EAAE;YACjB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;YACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;SAC9B,CAAC;KACH,CAAC;CACH,EACD,SAAS,EAAE,gBAAgB,EAE3B,aAAa,EAAE,SAAS,MAAM,EAAE,EAEhC,eAAe,EAAE,SAAS,MAAM,EAAE,EAElC,GAAG,EAAE,MAAM,CAAC,UAAU,EAEtB,MAAM,EAAE,OAAO,GACd,YAAY,CA+Ed;AASD,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,yBAAyB,EAAE,SAAS,EAAE,gBAAgB,GAAG,YAAY,CASzH"}

package/dist/runtime/tenancy/specs.js

@@ -0,0 +1,129 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OPENBAO_KUBERNETES_AUTH_MOUNT = exports.WEB_CLIENT_ID = exports.IDENTITY_ADMIN_CLIENT_ID = exports.BROKER_PATH_PREFIX = exports.NAMESPACE_RETENTION_DAYS = void 0;
+exports.requireSeedIdentityEndpoints = requireSeedIdentityEndpoints;
+exports.tenancySpecsFromInstallation = tenancySpecsFromInstallation;
+exports.tenancySpecsFromInventory = tenancySpecsFromInventory;
+const installation_tenancy_1 = require("@xemahq/installation-tenancy");
+const cli_errors_1 = require("../../lib/cli-errors");
+const browser_origins_1 = require("../browser-origins");
+const schema_1 = require("../config/schema");
+const infra_catalog_1 = require("../infra/infra-catalog");
+const to_current_config_1 = require("../installation/to-current-config");
+const helm_cli_1 = require("../runner/helm-cli");
+const seed_platform_endpoints_1 = require("../seed/seed-platform-endpoints");
+exports.NAMESPACE_RETENTION_DAYS = 7;
+exports.BROKER_PATH_PREFIX = 'tenant-credentials';
+exports.IDENTITY_ADMIN_CLIENT_ID = 'identity-api';
+exports.WEB_CLIENT_ID = 'web-app';
+exports.OPENBAO_KUBERNETES_AUTH_MOUNT = 'kubernetes';
+function requireSeedIdentityEndpoints(endpoints) {
+    if (endpoints[installation_tenancy_1.Backend.OpenBao] === undefined) {
+        return;
+    }
+    const missing = [installation_tenancy_1.Backend.Identity, installation_tenancy_1.Backend.Keycloak].filter((backend) => endpoints[backend] === undefined);
+    if (missing.length > 0) {
+        throw new cli_errors_1.CliConfigurationError(`The seed needs identity, so the servers must declare ${missing.map((backend) => `the ${backend} endpoint`).join(' and ')} ` +
+            'beside openbao. Add it to --servers.');
+    }
+    if (endpoints[installation_tenancy_1.DeclaredServer.EventHub] === undefined) {
+        (0, seed_platform_endpoints_1.requireSeedEventHubUrl)(undefined);
+    }
+}
+function memberLogins(installation, seedProcesses, env) {
+    if ((0, to_current_config_1.substrateForProfile)(installation.spec.profile) !== schema_1.Substrate.Helm) {
+        return { memberEnvKeyBound: seedProcesses.map((process) => ({ process })) };
+    }
+    const namespace = (0, helm_cli_1.resolveHelmNamespace)(installation.spec.operator.namespace, env);
+    return {
+        memberEnvKubernetes: seedProcesses.map((process) => ({ process, authMount: exports.OPENBAO_KUBERNETES_AUTH_MOUNT, namespace })),
+    };
+}
+function tenancySpecsFromInstallation(installation, endpoints, seedProcesses, memberDatabases, env, pooled) {
+    const id = installation.metadata.name;
+    const demand = (0, installation_tenancy_1.postgresConnectionDemand)({
+        maxConcurrentSessions: installation.spec.capacity.maxConcurrentSessions,
+        maxReplicas: installation.spec.capacity.maxReplicas,
+        pooled,
+    });
+    const appRole = `xema_${id.replace(/-/g, '_')}`;
+    const webOrigins = (0, browser_origins_1.installationWebOrigins)(installation);
+    const wanted = (backend) => endpoints[backend] !== undefined;
+    const wantsIdentity = wanted(installation_tenancy_1.Backend.Identity) && endpoints[installation_tenancy_1.Backend.Keycloak] !== undefined;
+    const identityRealm = id;
+    const openBao = {
+        installation: id,
+        brokerPathPrefix: exports.BROKER_PATH_PREFIX,
+        ...memberLogins(installation, seedProcesses, env),
+        memberEnvReaders: [...seedProcesses],
+        ...(wantsIdentity ? { identityRealm } : {}),
+    };
+    return {
+        ...(wanted(installation_tenancy_1.Backend.OpenBao) ? { [installation_tenancy_1.Backend.OpenBao]: openBao } : {}),
+        ...(wanted(installation_tenancy_1.Backend.Postgres)
+            ? {
+                [installation_tenancy_1.Backend.Postgres]: {
+                    installation: id,
+                    appRole,
+                    appConnectionLimit: demand.appConnectionLimit,
+                    provisionerRole: `${appRole}_provisioner`,
+                    provisionerConnectionLimit: demand.provisionerConnectionLimit,
+                    adoptRoles: [],
+                    databases: [
+                        { name: `${appRole}_biomes`, extensions: [...installation_tenancy_1.TEMPLATE_EXTENSIONS] },
+                        ...[...new Set(memberDatabases)].sort().map((member) => ({ name: (0, installation_tenancy_1.memberDatabaseName)(member), extensions: [] })),
+                    ],
+                },
+            }
+            : {}),
+        ...(wanted(installation_tenancy_1.Backend.Etcd) ? { [installation_tenancy_1.Backend.Etcd]: { installation: id, servicesRead: true } } : {}),
+        ...(wanted(installation_tenancy_1.Backend.Redis) ? { [installation_tenancy_1.Backend.Redis]: { installation: id } } : {}),
+        ...(wanted(installation_tenancy_1.Backend.ObjectStore)
+            ? { [installation_tenancy_1.Backend.ObjectStore]: { installation: id, bucketPrefix: id, logicalBuckets: [...infra_catalog_1.OBJECT_STORE_BUCKETS] } }
+            : {}),
+        ...(wanted(installation_tenancy_1.Backend.Temporal)
+            ? { [installation_tenancy_1.Backend.Temporal]: { installation: id, retentionDays: exports.NAMESPACE_RETENTION_DAYS, nexusEndpoints: [] } }
+            : {}),
+        ...(wanted(installation_tenancy_1.Backend.OpenFga) ? { [installation_tenancy_1.Backend.OpenFga]: { installation: id } } : {}),
+        ...(wantsIdentity
+            ? {
+                [installation_tenancy_1.Backend.Identity]: {
+                    installation: id,
+                    realm: identityRealm,
+                    adminClientId: exports.IDENTITY_ADMIN_CLIENT_ID,
+                    keycloakUrl: endpoints[installation_tenancy_1.Backend.Keycloak],
+                },
+            }
+            : {}),
+        ...(wanted(installation_tenancy_1.Backend.Keycloak)
+            ? {
+                [installation_tenancy_1.Backend.Keycloak]: {
+                    installation: id,
+                    realm: id,
+                    displayName: id,
+                    adminClientId: exports.IDENTITY_ADMIN_CLIENT_ID,
+                    ...(webOrigins.length === 0
+                        ? {}
+                        : {
+                            webClient: {
+                                clientId: exports.WEB_CLIENT_ID,
+                                redirectUris: webOrigins.map((origin) => `${origin}/*`),
+                                webOrigins,
+                            },
+                        }),
+                },
+            }
+            : {}),
+    };
+}
+function tenancySpecsFromInventory(inventory, endpoints) {
+    const keycloakUrl = endpoints[installation_tenancy_1.Backend.Keycloak];
+    const realm = inventory.fences.find((f) => f.backend === installation_tenancy_1.Backend.Keycloak);
+    if (endpoints[installation_tenancy_1.Backend.Identity] === undefined || keycloakUrl === undefined || realm === undefined) {
+        return {};
+    }
+    return {
+        [installation_tenancy_1.Backend.Identity]: { installation: inventory.installation, realm: realm.realm, adminClientId: exports.IDENTITY_ADMIN_CLIENT_ID, keycloakUrl },
+    };
+}
+//# sourceMappingURL=specs.js.map

package/dist/runtime/tenancy/specs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"specs.js","sourceRoot":"","sources":["../../../src/runtime/tenancy/specs.ts"],"names":[],"mappings":";;;AA8CA,oEAcC;AA6BD,oEAuGC;AASD,8DASC;AAlND,uEAWsC;AAEtC,qDAA6D;AAC7D,wDAA4D;AAC5D,6CAA6C;AAC7C,0DAA8D;AAC9D,yEAAwE;AACxE,iDAA0D;AAC1D,6EAAyE;AAM5D,QAAA,wBAAwB,GAAG,CAAC,CAAC;AAE7B,QAAA,kBAAkB,GAAG,oBAAoB,CAAC;AAE1C,QAAA,wBAAwB,GAAG,cAAc,CAAC;AAE1C,QAAA,aAAa,GAAG,SAAS,CAAC;AAQ1B,QAAA,6BAA6B,GAAG,YAAY,CAAC;AAO1D,SAAgB,4BAA4B,CAAC,SAA2B;IACtE,IAAI,SAAS,CAAC,8BAAO,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,8BAAO,CAAC,QAAQ,EAAE,8BAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC;IAC3G,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,kCAAqB,CAC7B,wDAAwD,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,WAAW,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG;YAC1H,sCAAsC,CACzC,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,qCAAc,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;QACrD,IAAA,gDAAsB,EAAC,SAAS,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAQD,SAAS,YAAY,CACnB,YAAgK,EAChK,aAAgC,EAChC,GAAsB;IAEtB,IAAI,IAAA,uCAAmB,EAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,kBAAS,CAAC,IAAI,EAAE,CAAC;QACtE,OAAO,EAAE,iBAAiB,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,SAAS,GAAG,IAAA,+BAAoB,EAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAClF,OAAO;QACL,mBAAmB,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,qCAA6B,EAAE,SAAS,EAAE,CAAC,CAAC;KACxH,CAAC;AACJ,CAAC;AASD,SAAgB,4BAA4B,CAC1C,YAaC,EACD,SAA2B,EAE3B,aAAgC,EAEhC,eAAkC,EAElC,GAAsB,EAEtB,MAAe;IAEf,MAAM,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;IACtC,MAAM,MAAM,GAAG,IAAA,+CAAwB,EAAC;QACtC,qBAAqB,EAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB;QACvE,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW;QACnD,MAAM;KACP,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;IAChD,MAAM,UAAU,GAAG,IAAA,wCAAsB,EAAC,YAAY,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,CAAC,OAAwB,EAAW,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC;IACvF,MAAM,aAAa,GAAG,MAAM,CAAC,8BAAO,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,8BAAO,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;IAE5F,MAAM,aAAa,GAAG,EAAE,CAAC;IACzB,MAAM,OAAO,GAAuB;QAClC,YAAY,EAAE,EAAE;QAChB,gBAAgB,EAAE,0BAAkB;QACpC,GAAG,YAAY,CAAC,YAAY,EAAE,aAAa,EAAE,GAAG,CAAC;QAEjD,gBAAgB,EAAE,CAAC,GAAG,aAAa,CAAC;QACpC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC;IACF,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,8BAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,8BAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,8BAAO,CAAC,QAAQ,CAAC;YAC1B,CAAC,CAAC;gBACE,CAAC,8BAAO,CAAC,QAAQ,CAAC,EAAE;oBAClB,YAAY,EAAE,EAAE;oBAChB,OAAO;oBACP,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;oBAC7C,eAAe,EAAE,GAAG,OAAO,cAAc;oBACzC,0BAA0B,EAAE,MAAM,CAAC,0BAA0B;oBAC7D,UAAU,EAAE,EAAE;oBACd,SAAS,EAAE;wBACT,EAAE,IAAI,EAAE,GAAG,OAAO,SAAS,EAAE,UAAU,EAAE,CAAC,GAAG,0CAAmB,CAAC,EAAE;wBACnE,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAA,yCAAkB,EAAC,MAAM,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;qBAChH;iBACF;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,8BAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,8BAAO,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,GAAG,CAAC,MAAM,CAAC,8BAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,8BAAO,CAAC,KAAK,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,MAAM,CAAC,8BAAO,CAAC,WAAW,CAAC;YAC7B,CAAC,CAAC,EAAE,CAAC,8BAAO,CAAC,WAAW,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC,GAAG,oCAAoB,CAAC,EAAE,EAAE;YAC9G,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,8BAAO,CAAC,QAAQ,CAAC;YAC1B,CAAC,CAAC,EAAE,CAAC,8BAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,aAAa,EAAE,gCAAwB,EAAE,cAAc,EAAE,EAAE,EAAE,EAAE;YAC3G,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,8BAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,8BAAO,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,aAAa;YACf,CAAC,CAAC;gBAEE,CAAC,8BAAO,CAAC,QAAQ,CAAC,EAAE;oBAClB,YAAY,EAAE,EAAE;oBAChB,KAAK,EAAE,aAAa;oBACpB,aAAa,EAAE,gCAAwB;oBACvC,WAAW,EAAE,SAAS,CAAC,8BAAO,CAAC,QAAQ,CAAC;iBACzC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,8BAAO,CAAC,QAAQ,CAAC;YAC1B,CAAC,CAAC;gBACE,CAAC,8BAAO,CAAC,QAAQ,CAAC,EAAE;oBAClB,YAAY,EAAE,EAAE;oBAChB,KAAK,EAAE,EAAE;oBACT,WAAW,EAAE,EAAE;oBACf,aAAa,EAAE,gCAAwB;oBACvC,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;wBACzB,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC;4BACE,SAAS,EAAE;gCACT,QAAQ,EAAE,qBAAa;gCACvB,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC;gCACvD,UAAU;6BACX;yBACF,CAAC;iBACP;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AASD,SAAgB,yBAAyB,CAAC,SAAoC,EAAE,SAA2B;IACzG,MAAM,WAAW,GAAG,SAAS,CAAC,8BAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,8BAAO,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,SAAS,CAAC,8BAAO,CAAC,QAAQ,CAAC,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAClG,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL,CAAC,8BAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,aAAa,EAAE,gCAAwB,EAAE,WAAW,EAAE;KACvI,CAAC;AACJ,CAAC"}

package/examples/01-local-native.yaml

@@ -15,9 +15,7 @@ infra:
   # If you want the launcher to manage infra too, use the container substrate
   # (see 02-local-container-full.yaml).
   postgres:
-    { mode: external, url: postgresql://xema@127.0.0.1:5432, secretRef: postgres-password }
+    { mode: external, url: postgresql://xema@127.0.0.1:5432, passwordEnv: XEMA_POSTGRES_PASSWORD }
   redis:    { mode: external, url: redis://127.0.0.1:6379 }
   etcd:     { mode: external, url: http://127.0.0.1:2379 }
   keycloak: { mode: external, url: http://127.0.0.1:8180, realm: xema }
-secrets:
-  postgres-password: { from: env, env: XEMA_POSTGRES_PASSWORD }

package/examples/02-local-container-full.yaml

@@ -16,5 +16,3 @@ infra:
   objectStore: { mode: managed }
   temporal:    { mode: managed }
   git:         { mode: disabled }
-secrets:
-  OPENCODE_SERVER_PASSWORD: { from: prompt }

package/examples/03-byo-infra.yaml

@@ -12,7 +12,7 @@ infra:
     {
       mode: external,
       url: postgresql://app@db.corp.internal:5432,
-      secretRef: corp-postgres-password,
+      passwordEnv: XEMA_POSTGRES_PASSWORD,
     }
   keycloak: { mode: external, url: https://sso.corp/realms/xema, realm: xema }
   objectStore:
@@ -20,7 +20,3 @@ infra:
   redis: { mode: managed }
   etcd: { mode: managed }
   temporal: { mode: disabled } # this install doesn't use durable workflows
-secrets:
-  corp-postgres-password: { from: env, env: XEMA_POSTGRES_PASSWORD }
-  S3_ACCESS_KEY_ID: { from: env }
-  S3_SECRET_ACCESS_KEY: { from: env }

package/examples/06-biome-sources.yaml

@@ -48,8 +48,6 @@ sources:
 
 infra:
   postgres:
-    { mode: external, url: postgresql://xema@127.0.0.1:5432, secretRef: postgres-password }
+    { mode: external, url: postgresql://xema@127.0.0.1:5432, passwordEnv: XEMA_POSTGRES_PASSWORD }
   redis:    { mode: external, url: redis://127.0.0.1:6379 }
   keycloak: { mode: external, url: http://127.0.0.1:8180, realm: xema }
-secrets:
-  postgres-password: { from: env, env: XEMA_POSTGRES_PASSWORD }

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.59.0",
+  "version": "0.60.1",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/xema-dev/xema-cli.git",
-    "directory": "apps/xema-cli"
+    "url": "git+https://github.com/xema-dev/xema-base.git",
+    "directory": "cli"
   },
-  "license": "Apache-2.0",
+  "license": "LicenseRef-Xema-BSL-1.1",
   "description": "Xema global CLI. Single binary day-0 onboarding: `npm i -g @xemahq/xema && xema dev` boots the whole stack; `xema biome scaffold` / `install` / `publish` / `lint` author and ship biomes; `xema run <capability>` invokes through the local capability-router. Multi-platform: works without pnpm or any monorepo clone.",
   "type": "commonjs",
   "engines": {
@@ -28,10 +28,6 @@
       "types": "./dist/publisher.d.ts",
       "require": "./dist/publisher.js",
       "default": "./dist/publisher.js"
-    },
-    "./candidate-edition": {
-      "import": "./edition/candidate-edition.mjs",
-      "default": "./edition/candidate-edition.mjs"
     }
   },
   "bin": {
@@ -39,12 +35,6 @@
   },
   "files": [
     "dist",
-    "edition/**/*.mjs",
-    "edition/*.json",
-    "!edition/**/*.test.mjs",
-    "!edition/**/*-contract-tests.mjs",
-    "!edition/test-fixtures/**",
-    "edition/README.md",
     "xema.config.example.yaml",
     "examples/**/*"
   ],
@@ -53,54 +43,59 @@
     "access": "public"
   },
   "dependencies": {
-    "@nestjs/common": "^11.1.18",
-    "@nestjs/core": "^11.1.18",
-    "@nestjs/platform-express": "^11.1.28",
-    "@xemahq/biome-sdk": "^22.0.0",
-    "@xemahq/biome-supply-chain": "^0.5.0",
     "@xemahq/distribution-source-hash": "^0.2.2",
-    "@xemahq/dsl": "^0.28.0",
-    "@xemahq/identity-client": "^0.36.0",
-    "@xemahq/contracts": "^0.119.0",
-    "@xemahq/kernel-state-runtime": "^0.8.0",
-    "@xemahq/license-verifier": "^0.2.0",
-    "@xemahq/release-policy": "^17.6.0",
-    "@xemahq/service-registry-nest": "^0.12.2",
+    "@xemahq/identity-client": "^0.41.0",
     "commander": "^12.1.0",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.2",
+    "tar": "^7",
     "tsx": "^4.19.2",
     "yaml": "^2.6.1",
-    "zod": "^4.3.6"
+    "zod": "^4.6.1",
+    "@xemahq/edition-tooling": "^0.1.0",
+    "@xemahq/biome-bundle-pack": "^0.2.0",
+    "@xemahq/dsl": "^0.30.0",
+    "@xemahq/installation-tenancy": "^0.2.0",
+    "@xemahq/biome-supply-chain": "^0.9.0",
+    "@xemahq/biome-sdk": "^25.0.0",
+    "@xemahq/release-policy": "^20.0.0",
+    "@xemahq/biome-host-api-client": "^0.9.0",
+    "@xemahq/composed-process-host": "^0.2.0",
+    "@xemahq/xema-service-nest": "^20.0.0",
+    "@xemahq/contracts": "^0.120.0",
+    "@xemahq/oci-closure": "^0.1.0",
+    "@xemahq/license-verifier": "^0.3.1",
+    "@xemahq/workload-identity": "^0.5.0"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",
+    "@playwright/test": "^1.64.1",
     "@types/node": "25.2.3",
-    "@xemahq/biome-host-api-client": "^0.3.31",
-    "@xemahq/eslint-config": "^0.9.2",
-    "esbuild": "0.28.2",
     "eslint": "^9.39.4",
     "jest": "^30.3.0",
     "prettier": "3.6.2",
     "ts-jest": "^29.4.9",
     "ts-node": "^10.9.2",
-    "typescript": "5.9.3"
+    "typescript": "5.9.3",
+    "@xemahq/biome-test": "^0.1.0",
+    "@xemahq/eslint-config": "^0.14.3"
   },
   "scripts": {
     "clean": "rm -rf dist",
-    "build": "tsc -p tsconfig.build.json && node ./scripts/post-build.cjs && node ./scripts/build-evidence-verifier.mjs",
+    "build": "tsc -p tsconfig.build.json && node ./scripts/post-build.cjs",
     "sync:assets": "node ./scripts/sync-distribution-assets.cjs",
     "verify:pack": "node ./scripts/verify-packed-assets.cjs",
     "format": "prettier --write \"src/**/*.ts\"",
     "start": "node ./dist/cli.js",
     "lint": "eslint . --max-warnings 0",
     "lint:fix": "eslint . --fix",
-    "test": "jest --config jest.config.cjs && pnpm run test:edition",
-    "test:edition": "node --test \"edition/*.test.mjs\" \"edition/*-contract-tests.mjs\"",
-    "typecheck": "tsc --noEmit"
+    "test": "jest --config jest.config.cjs",
+    "typecheck": "tsc --noEmit",
+    "check:test-surface": "node scripts/check-test-surface.mjs",
+    "scenarios": "playwright test -c tests/scenarios"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:bdd50b327d2da70bdc17c4cdcfce8ed38500fbd68aea8f23029c53d45ddbcb86",
-    "sha": "9e648fd62243cb0fc9df74680ce6c2a110a901ad"
+    "sourceDigest": "sha256:38fb72757f8cea9ad5be8976be2de3b3d53e0a5965bd7cf7a2e598280a6a263d",
+    "sha": "a32f8f5509b7ea239deb38216e4996e6286b10e8"
   }
 }

package/xema.config.example.yaml

@@ -20,7 +20,7 @@ infra:
   git: { mode: disabled } # optional (SCM integration)
   temporal: { mode: managed } # optional (durable workflows)
   # Example BYO:
-  # postgres: { mode: external, url: postgresql://xema@db.example.com:5432, secretRef: postgres-password }
+  # postgres: { mode: external, url: postgresql://xema@db.example.com:5432, passwordEnv: XEMA_POSTGRES_PASSWORD }
   # keycloak: { mode: external, url: https://sso.example.com/realms/xema, realm: xema }
   # objectStore: { mode: external, url: https://s3.example.com }
 
@@ -38,12 +38,3 @@ app:
 state:
   workspaces:
     driver: docker_local # docker_local (container) | host_path (native)
-
-# ── secrets the launcher must obtain (never dev-defaulted in production) ──────
-secrets:
-  OPENCODE_SERVER_PASSWORD: { from: prompt }
-  # postgres-password: { from: env, env: XEMA_POSTGRES_PASSWORD }
-  # S3_ACCESS_KEY_ID: { from: env }
-  # S3_SECRET_ACCESS_KEY: { from: env }
-  # DELEGATED_SESSION_JWT_PRIVATE_KEY: { from: file, path: ./keys/session.pem }
-  # LLM_PROVIDER_ANTHROPIC_API_KEY: { from: env }