@xemahq/xema 0.59.1 → 0.60.1

package/dist/runtime/launch.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveLaunchPlan = resolveLaunchPlan;
-exports.unionIncludeServices = unionIncludeServices;
 exports.launch = launch;
 exports.requireInstallationIdentity = requireInstallationIdentity;
 exports.buildSelection = buildSelection;
@@ -9,15 +8,11 @@ exports.normalizeInclude = normalizeInclude;
 exports.splitIncludeTokens = splitIncludeTokens;
 const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
-const node_path_1 = require("node:path");
 const distribution_1 = require("@xemahq/contracts/distribution");
-const backing_registration_1 = require("./backing-registration");
 const boot_graph_loader_1 = require("./boot-graph-loader");
-const cleanup_1 = require("./cleanup");
 const schema_1 = require("./config/schema");
 const local_custody_1 = require("./custody/local-custody");
 const openbao_local_constants_1 = require("./custody/openbao-local-constants");
-const infra_catalog_1 = require("./infra/infra-catalog");
 const infra_plan_1 = require("./infra/infra-plan");
 const infra_runner_1 = require("./infra/infra-runner");
 const keycloak_realm_1 = require("./infra/keycloak-realm");
@@ -25,29 +20,30 @@ const registry_credential_1 = require("./license/registry-credential");
 const resolve_license_1 = require("./license/resolve-license");
 const lock_loader_1 = require("./lock-loader");
 const paths_1 = require("./paths");
-const port_map_1 = require("./port-map");
 const roster_1 = require("./roster");
-const run_manifest_1 = require("./run-manifest");
 const container_preflight_1 = require("./runner/container-preflight");
 const container_runner_1 = require("./runner/container-runner");
+const docker_cli_1 = require("./runner/docker-cli");
 const helm_cli_1 = require("./runner/helm-cli");
 const helm_pre_install_1 = require("./runner/helm-pre-install");
 const helm_runner_1 = require("./runner/helm-runner");
-const native_runner_1 = require("./runner/native-runner");
-const generated_platform_secrets_1 = require("./secrets/generated-platform-secrets");
 const managed_local_store_1 = require("./secrets/managed-local-store");
-const resolver_1 = require("./secrets/resolver");
+const closure_native_1 = require("./seed/closure-native");
+const launch_env_1 = require("./seed/launch-env");
+const seed_container_1 = require("./seed/seed-container");
+const seed_facts_1 = require("./seed/seed-facts");
+const seed_helm_1 = require("./seed/seed-helm");
+const seed_launcher_1 = require("./seed/seed-launcher");
+const seed_options_1 = require("./seed/seed-options");
+const seed_platform_endpoints_1 = require("./seed/seed-platform-endpoints");
+const seed_record_1 = require("./seed/seed-record");
+const seed_resolved_deployment_1 = require("./seed/seed-resolved-deployment");
 const credentials_1 = require("./sources/credentials");
-const manifest_walk_1 = require("./sources/manifest-walk");
-const resolver_2 = require("./sources/resolver");
-const supervisor_1 = require("./supervisor");
+const resolver_1 = require("./sources/resolver");
 const unit_type_1 = require("./unit-type");
 const waves_1 = require("./waves");
-const carved_installs_1 = require("../dev/carved-installs");
-const env_defaults_1 = require("../dev/env-defaults");
 const KNOWN_TIERS = new Set(Object.keys(distribution_1.PLATFORM_SERVICE_TIER_RANK).filter((tier) => tier !== 'infra'));
 const NETWORK = 'xema';
-const CONTAINER_PORT = container_runner_1.DEFAULT_CONTAINER_SERVICE_PORT;
 function resolveLaunchPlan(opts) {
     const { config } = opts;
     const log = opts.log ?? (() => undefined);
@@ -59,23 +55,17 @@ function resolveLaunchPlan(opts) {
         envVar: process.env.XEMA_DISTRIBUTION_LOCK_PATH,
     });
     const usesImages = substrate === schema_1.Substrate.Container || substrate === schema_1.Substrate.Helm;
-    let imagesByService;
-    if (usesImages) {
-        imagesByService = (0, lock_loader_1.loadImageLock)({
-            edition: config.edition,
-        }).imagesByService;
-    }
+    const seedImage = usesImages
+        ? (0, lock_loader_1.loadSeedImage)({ edition: config.edition })
+        : undefined;
     const bootGraph = (0, boot_graph_loader_1.loadBootGraph)({
         explicit: opts.bootGraphPathOverride,
         envVar: process.env.XEMA_BOOT_GRAPH_PATH,
     });
-    const nativeServicePaths = !usesImages
-        ? collectNativeServicePaths()
-        : undefined;
-    const baseIndex = (0, roster_1.buildLockIndex)(lock, imagesByService, nativeServicePaths);
+    const baseIndex = (0, roster_1.buildLockIndex)(lock);
     const unresolvedSources = [];
     const index = config.sources.length > 0
-        ? (0, resolver_2.composeSourceIndex)(baseIndex, config.sources, {
+        ? (0, resolver_1.composeSourceIndex)(baseIndex, config.sources, {
             edition: config.edition,
             usesImages,
             credentials: new credentials_1.CredentialResolver(),
@@ -85,13 +75,6 @@ function resolveLaunchPlan(opts) {
         })
         : baseIndex;
     let selection = buildSelection(config, opts.includeWeb);
-    if (opts.includeBiomes !== undefined && opts.includeBiomes.length > 0) {
-        const biomeServices = (0, roster_1.servicesForBiomes)(index, opts.includeBiomes);
-        selection = {
-            ...selection,
-            include: unionIncludeServices(selection.include, biomeServices),
-        };
-    }
     const usesDefaultSet = selection.include === 'default' ||
         (typeof selection.include === 'object' &&
             selection.include.withDefault === true);
@@ -118,7 +101,6 @@ function resolveLaunchPlan(opts) {
                 .map((v) => `  ${v.service} (${v.serviceTier}) → ${v.requires} (${v.requiresTier})`)
                 .join('\n'));
     }
-    const ports = (0, port_map_1.assignPorts)(roster);
     return {
         substrate,
         lock: {
@@ -128,36 +110,21 @@ function resolveLaunchPlan(opts) {
         },
         roster,
         waves,
-        ports,
         infra,
         addedPrerequisites,
         skippedOptionalBiomes,
         infraWarnings: infra.warnings,
         unresolvedSources,
+        seed: (0, seed_options_1.buildSeedLaunchOptions)(config, process.env, opts.seedInstallation === undefined ? undefined : (0, seed_platform_endpoints_1.declaredEventHubUrl)(opts.seedInstallation.inventory)),
+        seedProcesses: (0, closure_native_1.nativeSeedProcesses)(),
+        ...(seedImage !== undefined ? { seedImage } : {}),
         ...(substrate === schema_1.Substrate.Helm
             ? {
-                helmNamespace: opts.helmRelease?.namespace ??
-                    process.env.XEMA_NAMESPACE ??
-                    helm_cli_1.DEFAULT_HELM_NAMESPACE,
+                helmNamespace: (0, helm_cli_1.resolveHelmNamespace)(opts.helmRelease?.namespace, process.env),
             }
             : {}),
     };
 }
-function unionIncludeServices(include, services) {
-    if (include === 'all') {
-        return 'all';
-    }
-    if (include === 'default') {
-        return { services: [...services], withDefault: true };
-    }
-    if (include === 'minimal') {
-        return { services: [...services], withMinimal: true };
-    }
-    return {
-        ...include,
-        services: [...new Set([...(include.services ?? []), ...services])],
-    };
-}
 function seedServicesForClosure(include, index) {
     if (include === 'default') {
         return (0, roster_1.defaultSelectedServiceNames)(index);
@@ -183,28 +150,36 @@ function seedServicesForClosure(include, index) {
     }
     return [...seed];
 }
-function collectNativeServicePaths() {
-    const root = (0, paths_1.findMonorepoRoot)();
-    if (root === null) {
-        return undefined;
-    }
-    const map = new Map();
-    for (const biome of (0, manifest_walk_1.walkBiomeManifests)(root).biomes) {
-        for (const svc of biome.services) {
-            map.set(svc.name, svc.servicePath);
-        }
-    }
-    return map;
-}
 async function launch(opts, preResolved) {
     const log = opts.log ?? (() => undefined);
     const installationIdentity = requireInstallationIdentity(opts);
-    (0, resolver_1.assertSecretMaterializationSupported)(opts.config, opts.config.app.substrate);
-    const declared = await new resolver_1.SecretResolver({
-        cwd: secretResolutionDirectory(installationIdentity),
-    }).resolve(opts.config);
-    const secrets = await (0, generated_platform_secrets_1.withGeneratedPlatformSecrets)(declared, installationIdentity);
     const plan = preResolved ?? resolveLaunchPlan(opts);
+    logPlanSummary(plan, log);
+    (0, launch_env_1.requireBundleRegistry)(plan.seed?.bundleRegistry);
+    (0, seed_platform_endpoints_1.requireSeedEventHubUrl)(plan.seed?.eventHubUrl);
+    const input = {
+        plan,
+        installationId: launchInstallationId(opts, installationIdentity),
+        planHash: opts.planHash ?? (0, node_crypto_1.randomUUID)(),
+        executionId: (0, node_crypto_1.randomUUID)(),
+        log,
+    };
+    switch (plan.substrate) {
+        case schema_1.Substrate.Native:
+            return (0, seed_launcher_1.launchSeed)({
+                ...input,
+                prepareDeliveries: async () => (0, launch_env_1.nativeSeedDelivery)(requireSeedInstallation(opts), plan.seedProcesses, {
+                    lock: { path: plan.lock.path, sha256: plan.lock.sha256 },
+                    resolvedDeployment: await resolveSeedDeployment(plan, opts, input.installationId),
+                }),
+            });
+        case schema_1.Substrate.Container:
+            return launchContainerSeed(plan, opts, input);
+        case schema_1.Substrate.Helm:
+            return launchHelmSeed(plan, opts, input);
+    }
+}
+function logPlanSummary(plan, log) {
     for (const warning of plan.infraWarnings) {
         log(`WARN  ${warning}`);
     }
@@ -216,34 +191,30 @@ async function launch(opts, preResolved) {
         log(`optional : skipping optional biome(s) not explicitly included: ${plan.skippedOptionalBiomes.join(', ')} ` +
             `(add them to app.include, or use include: 'all')`);
     }
-    return executeLaunchPlan(plan, opts, secrets);
 }
-async function executeLaunchPlan(plan, opts, secrets) {
-    const { config } = opts;
-    const log = opts.log ?? (() => undefined);
-    const { substrate, roster, waves, ports, infra } = plan;
-    const installationIdentity = requireInstallationIdentity(opts);
-    const installationId = opts.installationId ??
+function launchInstallationId(opts, installationIdentity) {
+    return (opts.installationId ??
         `local-${(0, node_crypto_1.createHash)('sha256')
             .update(installationIdentity)
             .digest('hex')
-            .slice(0, 20)}`;
-    const planHash = opts.planHash ?? (0, node_crypto_1.randomUUID)();
-    const executionId = (0, node_crypto_1.randomUUID)();
+            .slice(0, 20)}`);
+}
+async function launchContainerSeed(plan, opts, input) {
+    const { infra, seedImage } = plan;
+    const { installationId, log } = input;
+    const installationIdentity = requireInstallationIdentity(opts);
+    if (seedImage === undefined) {
+        throw new Error('A container launch plan carries no seed image.');
+    }
+    (0, seed_platform_endpoints_1.requireReachableServerEndpoints)(requireSeedInstallation(opts).inventory, schema_1.Substrate.Container);
     let managedCredentials;
     const managesPostgres = infra.managed.some((entry) => entry.component === schema_1.InfraComponent.Postgres);
     const managesObjectStore = infra.managed.some((entry) => entry.component === schema_1.InfraComponent.ObjectStore);
     const managesKeycloak = infra.managed.some((entry) => entry.component === schema_1.InfraComponent.Keycloak);
-    const usesManagedLocalCredentials = managesPostgres || managesObjectStore || managesKeycloak;
-    const credentialStore = usesManagedLocalCredentials
-        ? new managed_local_store_1.ManagedLocalCredentialStore({
+    if (managesPostgres || managesObjectStore || managesKeycloak) {
+        const credentialStore = new managed_local_store_1.ManagedLocalCredentialStore({
             installationIdentity,
-        })
-        : undefined;
-    if (substrate === schema_1.Substrate.Container && usesManagedLocalCredentials) {
-        if (credentialStore === undefined) {
-            throw new Error('Managed-local credential store was not initialized for container launch.');
-        }
+        });
         const existingManagedCredentials = await credentialStore.load();
         const compatibilityRunner = new infra_runner_1.InfraRunner({
             network: NETWORK,
@@ -257,44 +228,19 @@ async function executeLaunchPlan(plan, opts, secrets) {
         managedCredentials =
             existingManagedCredentials ?? (await credentialStore.getOrCreate());
     }
-    else if (substrate === schema_1.Substrate.Native && usesManagedLocalCredentials) {
-        if (credentialStore === undefined) {
-            throw new Error('Managed-local credential store was not initialized for native launch.');
-        }
-        managedCredentials =
-            (await credentialStore.load()) ??
-                nativeBackingCredentials(process.env, {
-                    postgres: managesPostgres,
-                    objectStore: managesObjectStore,
-                });
-    }
-    if (substrate === schema_1.Substrate.Native) {
-        const { killed, skipped } = (0, run_manifest_1.reapStaleServices)();
-        if (killed.length > 0 || skipped.length > 0) {
-            log(`reaped   : ${String(killed.length)} stale service(s)` +
-                (skipped.length > 0
-                    ? `, ${String(skipped.length)} skipped (unconfirmed)`
-                    : ''));
-        }
-    }
-    if (substrate === schema_1.Substrate.Container) {
-        const preflight = await (0, container_preflight_1.runContainerPreflight)({
-            roster,
-            allowEmulatedPlatform: opts.allowEmulatedPlatform === true,
-            registryCredentials: registry_credential_1.LicenseRegistryCredentials.fromResolution((0, resolve_license_1.resolveEffectiveLicense)()),
-        });
-        const preflightReport = (0, container_preflight_1.formatContainerPreflight)(preflight);
-        if (preflightReport.length > 0) {
-            log(preflightReport);
-        }
-        (0, container_preflight_1.assertContainerPreflightPassed)(preflight);
-        await (0, container_runner_1.reconcileInstallationServiceContainers)(installationId);
-    }
-    if (substrate === schema_1.Substrate.Helm && infra.managed.length > 0) {
-        log(`infra    : ${infra.managed.map((m) => m.component).join(', ')} are managed IN-CLUSTER ` +
-            'on the Helm substrate — the launcher starts and bootstraps nothing locally.');
-    }
-    else if (infra.managed.length > 0) {
+    const preflight = await (0, container_preflight_1.runContainerPreflight)({
+        images: [seedImage],
+        allowEmulatedPlatform: opts.allowEmulatedPlatform === true,
+        registryCredentials: registry_credential_1.LicenseRegistryCredentials.fromResolution((0, resolve_license_1.resolveEffectiveLicense)()),
+    });
+    const preflightReport = (0, container_preflight_1.formatContainerPreflight)(preflight);
+    if (preflightReport.length > 0) {
+        log(preflightReport);
+    }
+    (0, container_preflight_1.assertContainerPreflightPassed)(preflight);
+    await (0, container_runner_1.reconcileInstallationServiceContainers)(installationId);
+    (0, seed_record_1.removeSeedRecord)(installationId);
+    if (infra.managed.length > 0) {
         const infraRunner = new infra_runner_1.InfraRunner({
             network: NETWORK,
             installationId,
@@ -303,178 +249,83 @@ async function executeLaunchPlan(plan, opts, secrets) {
                 ? { credentials: managedCredentials }
                 : {}),
         });
-        if (substrate === schema_1.Substrate.Container) {
-            log(`infra    : bringing up ${infra.managed.map((m) => m.component).join(', ')}`);
-            await infraRunner.bringUp(infra);
-            await infraRunner.waitHealthy(infra);
-        }
-        await infraRunner.bootstrap(infra, roster);
+        log(`infra    : bringing up ${infra.managed.map((m) => m.component).join(', ')}`);
+        await infraRunner.bringUp(infra);
+        await infraRunner.waitHealthy(infra);
+        await infraRunner.bootstrap(infra, plan.roster);
         log('infra    : bootstrapped (per-service databases, object-store buckets)');
     }
-    const custody = substrate !== schema_1.Substrate.Helm &&
-        roster.some((service) => service.name === openbao_local_constants_1.CREDENTIAL_BROKER_SERVICE_NAME)
-        ? await (0, local_custody_1.provisionLocalCustody)({
+    if (plan.roster.some((service) => service.name === openbao_local_constants_1.CREDENTIAL_BROKER_SERVICE_NAME)) {
+        await (0, local_custody_1.provisionLocalCustody)({
             network: NETWORK,
             installationId,
             installationIdentity,
-        })
-        : undefined;
-    if (custody !== undefined) {
-        log('custody  : local OpenBao ready (initialised, unsealed, broker token minted)');
-    }
-    const runner = selectRunner(plan, opts);
-    if (plan.substrate === schema_1.Substrate.Helm) {
-        if (!(runner instanceof helm_runner_1.HelmRunner)) {
-            throw new Error('A Helm launch resolved a non-Helm runner — chart pre-flight cannot be skipped by ' +
-                'substituting a runner, because that would install releases with neither chart ' +
-                'resolution nor signature verification.');
-        }
-        for (const line of await (0, helm_pre_install_1.runHelmPreInstallGates)({
-            runner,
-            roster,
-            credentials: registry_credential_1.LicenseRegistryCredentials.fromResolution((0, resolve_license_1.resolveEffectiveLicense)()),
-        })) {
-            log(line);
-        }
-    }
-    const supervisor = new supervisor_1.Supervisor({
-        roster,
-        waves,
-        runner,
-        config,
-        infra,
-        substrate,
-        ports,
-        distributionLockPath: plan.lock.path,
-        distributionLockSha256: plan.lock.sha256,
-        installationId,
-        planHash,
-        executionId,
-        secrets,
-        ...(managedCredentials !== undefined ? { managedCredentials } : {}),
-        ...(custody !== undefined ? { custody } : {}),
-        containerPort: CONTAINER_PORT,
-        ...(opts.onEvent ? { onEvent: opts.onEvent } : {}),
-    });
-    let backingHandle;
-    if (substrate === schema_1.Substrate.Native) {
-        const monorepoRoot = (0, paths_1.findMonorepoRoot)();
-        if (monorepoRoot !== null) {
-            await (0, carved_installs_1.ensureCarvedInstalls)(roster, monorepoRoot, log);
-        }
-        const backingDeclarations = (0, env_defaults_1.backingServiceDeclarations)();
-        backingHandle = await (0, backing_registration_1.registerBackingSubmodules)({
-            etcdEndpoints: resolveEtcdEndpoints(infra),
-            declarations: backingDeclarations,
-            log,
         });
-        log(`registry : registered ${String(backingDeclarations.length)} backing services into etcd ` +
-            `(${backingDeclarations
-                .map((d) => (d.openapiUrl === undefined ? d.name : `${d.name} +spec`))
-                .join(', ')})`);
-    }
-    let result;
-    try {
-        result = await supervisor.bringUp();
-    }
-    catch (err) {
-        try {
-            await (0, cleanup_1.runCleanupOperations)([
-                {
-                    operation: 'stop partially-started supervised workloads',
-                    run: () => supervisor.shutdown(),
-                },
-                ...(backingHandle === undefined
-                    ? []
-                    : [
-                        {
-                            operation: 'deregister partially-started backing services',
-                            run: () => backingHandle.close(),
-                        },
-                    ]),
-            ]);
-        }
-        catch (cleanupError) {
-            throw (0, cleanup_1.combineOperationAndCleanupErrors)('workload bring-up', err, cleanupError);
-        }
-        throw err;
-    }
-    return {
-        result,
-        plan,
-        installationId,
-        planHash,
-        executionId,
-        roster,
-        shutdown: async () => {
-            await (0, cleanup_1.runCleanupOperations)([
-                {
-                    operation: 'stop supervised workloads',
-                    run: () => supervisor.shutdown(),
-                },
-                ...(backingHandle === undefined
-                    ? []
-                    : [
-                        {
-                            operation: 'deregister backing services',
-                            run: () => backingHandle.close(),
-                        },
-                    ]),
-            ]);
+        log('custody  : local OpenBao ready (initialised, unsealed)');
+    }
+    const docker = new docker_cli_1.DockerCli();
+    const resolvedDeployment = await resolveSeedDeployment(plan, opts, installationId);
+    const deliveries = await (0, launch_env_1.containerSeedDelivery)({
+        source: requireSeedInstallation(opts),
+        docker,
+        image: seedImage,
+        edition: {
+            lockSha256: plan.lock.sha256,
+            resolvedDeployment: { sha256: resolvedDeployment.sha256, runtimeNamespace: resolvedDeployment.runtimeNamespace },
         },
-    };
+    });
+    return (0, seed_container_1.launchSeedContainer)({
+        ...input,
+        deliveries,
+        docker,
+        network: NETWORK,
+        resolvedDeploymentHostPath: resolvedDeployment.path,
+    });
 }
-function resolveEtcdEndpoints(infra) {
-    const etcd = infra.byComponent.get(schema_1.InfraComponent.Etcd);
-    if (etcd?.mode === schema_1.InfraMode.External && etcd.url) {
-        return [etcd.url.replace(/^https?:\/\//, '')];
+function resolveSeedDeployment(plan, opts, installationId) {
+    const edition = opts.config.edition;
+    return (0, seed_resolved_deployment_1.writeSeedResolvedDeployment)({
+        installationId,
+        editionId: edition,
+        distributionLockPath: plan.lock.path,
+        imagesLockPath: (0, paths_1.resolveImageLockPath)({ edition }).path,
+        authorizationLockPath: (0, paths_1.resolveAuthorizationLockPath)({ edition }).path,
+    });
+}
+async function launchHelmSeed(plan, opts, input) {
+    const { infra, seedImage } = plan;
+    if (seedImage === undefined) {
+        throw new Error('A Helm launch plan carries no seed image.');
     }
-    const managedDefault = infra_catalog_1.INFRA_CATALOG[schema_1.InfraComponent.Etcd].defaultLocalUrl;
-    if (managedDefault === undefined) {
-        throw new Error('resolveEtcdEndpoints: infra catalog has no defaultLocalUrl for etcd; cannot resolve the KernelState endpoint.');
+    if (infra.managed.length > 0) {
+        input.log(`infra    : ${infra.managed.map((m) => m.component).join(', ')} are managed IN-CLUSTER ` +
+            'on the Helm substrate — the launcher starts and bootstraps nothing locally.');
     }
-    return [managedDefault.replace(/^https?:\/\//, '')];
+    (0, seed_platform_endpoints_1.requireReachableServerEndpoints)(requireSeedInstallation(opts).inventory, schema_1.Substrate.Helm);
+    const runner = helmSeedRunner(plan, opts);
+    for (const line of await (0, helm_pre_install_1.runHelmPreInstallGates)({
+        runner,
+        images: [seedImage],
+        charts: [seed_facts_1.SEED_COMPOSED_PROCESS_NAME],
+        credentials: registry_credential_1.LicenseRegistryCredentials.fromResolution((0, resolve_license_1.resolveEffectiveLicense)()),
+    })) {
+        input.log(line);
+    }
+    if (plan.helmNamespace === undefined) {
+        throw new Error('A Helm launch plan carries no release namespace.');
+    }
+    const deliveries = await (0, launch_env_1.helmSeedDelivery)({
+        source: requireSeedInstallation(opts),
+        image: seedImage,
+        namespace: plan.helmNamespace,
+    });
+    return (0, seed_helm_1.launchSeedRelease)({ ...input, deliveries, runner });
 }
-function nativeBackingCredentials(env, required) {
-    let postgres;
-    if (required.postgres) {
-        const databaseUrl = env.DATABASE_URL;
-        if (databaseUrl === undefined || databaseUrl.length === 0) {
-            throw new Error('Native managed PostgreSQL requires DATABASE_URL with explicit credentials.');
-        }
-        let parsed;
-        try {
-            parsed = new URL(databaseUrl);
-        }
-        catch {
-            throw new Error('Native managed PostgreSQL DATABASE_URL is invalid.');
-        }
-        if (parsed.protocol !== 'postgres:' && parsed.protocol !== 'postgresql:') {
-            throw new Error('Native managed PostgreSQL DATABASE_URL must use the postgres or postgresql scheme.');
-        }
-        const username = decodeURIComponent(parsed.username);
-        const password = decodeURIComponent(parsed.password);
-        if (username.length === 0 || password.length === 0) {
-            throw new Error('Native managed PostgreSQL DATABASE_URL must include an explicit username and password.');
-        }
-        postgres = { username, password };
+function requireSeedInstallation(opts) {
+    if (opts.seedInstallation === undefined) {
+        throw new Error('A launch needs the installation its seed environment is built from (inventory and secrets) and none was given.');
     }
-    let objectStore;
-    if (required.objectStore) {
-        const username = env.S3_ACCESS_KEY_ID;
-        const password = env.S3_SECRET_ACCESS_KEY;
-        if (username === undefined ||
-            username.length === 0 ||
-            password === undefined ||
-            password.length === 0) {
-            throw new Error('Native managed object storage requires S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY.');
-        }
-        objectStore = { username, password };
-    }
-    return {
-        ...(postgres !== undefined ? { postgres } : {}),
-        ...(objectStore !== undefined ? { objectStore } : {}),
-    };
+    return opts.seedInstallation;
 }
 function requireInstallationIdentity(opts) {
     const identity = opts
@@ -486,32 +337,17 @@ function requireInstallationIdentity(opts) {
     }
     return identity;
 }
-function secretResolutionDirectory(installationIdentity) {
-    return (0, node_fs_1.statSync)(installationIdentity).isDirectory()
-        ? installationIdentity
-        : (0, node_path_1.dirname)(installationIdentity);
-}
-function selectRunner(plan, opts) {
-    if (plan.substrate === schema_1.Substrate.Container) {
-        return new container_runner_1.ContainerRunner({
-            network: NETWORK,
-            containerPort: CONTAINER_PORT,
-            distributionLockPath: plan.lock.path,
-        });
-    }
-    if (plan.substrate === schema_1.Substrate.Helm) {
-        if (opts.helmRelease === undefined || plan.helmNamespace === undefined) {
-            throw new Error('A Helm launch requires a rendered installation: run `xema up` / `xema serve --substrate appliance`, ' +
-                'which compiles the XemaInstallation and renders the release namespace + declared posture. ' +
-                'Installing releases without them would leave workloads carrying neither the plan identity ' +
-                'nor the declared policy.');
-        }
-        return new helm_runner_1.HelmRunner({
-            namespace: plan.helmNamespace,
-            values: opts.helmRelease.values,
-        });
-    }
-    return new native_runner_1.NativeRunner();
+function helmSeedRunner(plan, opts) {
+    if (opts.helmRelease === undefined || plan.helmNamespace === undefined) {
+        throw new Error('A Helm launch requires a rendered installation: run `xema up` with the appliance substrate, ' +
+            'which compiles the XemaInstallation and renders the release namespace + declared posture. ' +
+            'Installing the release without them would leave the workload carrying neither the plan identity ' +
+            'nor the declared policy.');
+    }
+    return new helm_runner_1.HelmRunner({
+        namespace: plan.helmNamespace,
+        values: opts.helmRelease.values,
+    });
 }
 function buildSelection(config, includeWeb) {
     const include = normalizeInclude(config.app.include, config.app.features);