@xemahq/xema 0.59.1 → 0.60.1

package/dist/runtime/seed/substrate-facts.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IMAGE_SANDBOX_ROOT = exports.IMAGE_BIOMES_RUNTIME_ROOT = exports.IMAGE_BIOMES_ROOT = exports.KERNEL_STATE_PROFILE_CLUSTER = exports.BlobStorageBackend = exports.CatalogSource = exports.SandboxPtyProvider = exports.SubstrateFactName = void 0;
+exports.substrateFacts = substrateFacts;
+const schema_1 = require("../config/schema");
+var SubstrateFactName;
+(function (SubstrateFactName) {
+    SubstrateFactName["SandboxPtyProvider"] = "BIOME_SANDBOX_PTY_PROVIDER";
+    SubstrateFactName["SandboxPtyRoot"] = "BIOME_SANDBOX_PTY_ROOT";
+    SubstrateFactName["CatalogSource"] = "XEMA_CATALOG_SOURCE";
+    SubstrateFactName["ForbidCatalogScan"] = "XEMA_FORBID_CATALOG_SCAN";
+    SubstrateFactName["BiomeScanRootsServer"] = "XEMA_BIOME_SCAN_ROOTS_SERVER";
+    SubstrateFactName["BiomeScanRootsWeb"] = "XEMA_BIOME_SCAN_ROOTS_WEB";
+    SubstrateFactName["BiomeRuntimeRoot"] = "XEMA_BIOME_RUNTIME_ROOT";
+    SubstrateFactName["BlobStorageBackend"] = "BLOB_STORAGE_BACKEND";
+    SubstrateFactName["KernelStateProfile"] = "XEMA_KERNEL_STATE_PROFILE";
+    SubstrateFactName["ControlPlaneNamespace"] = "XEMA_CONTROL_PLANE_NAMESPACE";
+    SubstrateFactName["BiomeApiK8sNamespace"] = "BIOME_API_K8S_NAMESPACE";
+    SubstrateFactName["BiomeApiBaseDomain"] = "BIOME_API_BASE_DOMAIN";
+    SubstrateFactName["AdapterHostPullSecret"] = "BIOME_ADAPTER_HOST_PULL_SECRET";
+})(SubstrateFactName || (exports.SubstrateFactName = SubstrateFactName = {}));
+var SandboxPtyProvider;
+(function (SandboxPtyProvider) {
+    SandboxPtyProvider["Local"] = "local";
+})(SandboxPtyProvider || (exports.SandboxPtyProvider = SandboxPtyProvider = {}));
+var CatalogSource;
+(function (CatalogSource) {
+    CatalogSource["Lock"] = "lock";
+})(CatalogSource || (exports.CatalogSource = CatalogSource = {}));
+var BlobStorageBackend;
+(function (BlobStorageBackend) {
+    BlobStorageBackend["S3"] = "s3";
+})(BlobStorageBackend || (exports.BlobStorageBackend = BlobStorageBackend = {}));
+exports.KERNEL_STATE_PROFILE_CLUSTER = 'cluster';
+exports.IMAGE_BIOMES_ROOT = '/app/biomes';
+exports.IMAGE_BIOMES_RUNTIME_ROOT = '/app/biomes-runtime';
+exports.IMAGE_SANDBOX_ROOT = '/tmp/biome-sandboxes';
+function stated(entries) {
+    return Object.fromEntries(entries.flatMap(([name, value]) => (value === undefined ? [] : [[name, requireValue(value, name)]])));
+}
+function commonFacts(roots) {
+    return {
+        [SubstrateFactName.SandboxPtyProvider]: SandboxPtyProvider.Local,
+        [SubstrateFactName.CatalogSource]: CatalogSource.Lock,
+        [SubstrateFactName.ForbidCatalogScan]: 'true',
+        [SubstrateFactName.BlobStorageBackend]: BlobStorageBackend.S3,
+        [SubstrateFactName.KernelStateProfile]: exports.KERNEL_STATE_PROFILE_CLUSTER,
+        [SubstrateFactName.BiomeScanRootsWeb]: '',
+        ...stated([
+            [SubstrateFactName.SandboxPtyRoot, roots.sandbox],
+            [SubstrateFactName.BiomeRuntimeRoot, roots.runtime],
+            [
+                SubstrateFactName.BiomeScanRootsServer,
+                roots.biomes === undefined ? undefined : [roots.biomes, `${roots.biomes}/kernel`, `${roots.biomes}/platform`].join(','),
+            ],
+        ]),
+    };
+}
+const IMAGE_ROOTS = {
+    biomes: exports.IMAGE_BIOMES_ROOT,
+    runtime: exports.IMAGE_BIOMES_RUNTIME_ROOT,
+    sandbox: exports.IMAGE_SANDBOX_ROOT,
+};
+function requireValue(value, name) {
+    if (value === '') {
+        throw new Error(`${name} must not be empty`);
+    }
+    return value;
+}
+function substrateFacts(input) {
+    switch (input.substrate) {
+        case schema_1.Substrate.Native:
+            return commonFacts({
+                biomes: input.paths.biomesRoot,
+                runtime: input.paths.biomesRuntimeRoot,
+                sandbox: input.paths.sandboxRoot,
+            });
+        case schema_1.Substrate.Container:
+            return commonFacts(IMAGE_ROOTS);
+        case schema_1.Substrate.Helm:
+            return {
+                ...commonFacts(IMAGE_ROOTS),
+                ...stated([
+                    [SubstrateFactName.ControlPlaneNamespace, input.helm.namespace],
+                    [SubstrateFactName.BiomeApiK8sNamespace, input.helm.biomeApiNamespace],
+                    [SubstrateFactName.BiomeApiBaseDomain, input.helm.biomeApiBaseDomain],
+                    [SubstrateFactName.AdapterHostPullSecret, input.helm.adapterHostPullSecret],
+                ]),
+            };
+    }
+}
+//# sourceMappingURL=substrate-facts.js.map

package/dist/runtime/seed/substrate-facts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"substrate-facts.js","sourceRoot":"","sources":["../../../src/runtime/seed/substrate-facts.ts"],"names":[],"mappings":";;;AAsHA,wCAqBC;AA3ID,6CAA6C;AAS7C,IAAY,iBAcX;AAdD,WAAY,iBAAiB;IAC3B,sEAAiD,CAAA;IACjD,8DAAyC,CAAA;IACzC,0DAAqC,CAAA;IACrC,mEAA8C,CAAA;IAC9C,0EAAqD,CAAA;IACrD,oEAA+C,CAAA;IAC/C,iEAA4C,CAAA;IAC5C,gEAA2C,CAAA;IAC3C,qEAAgD,CAAA;IAChD,2EAAsD,CAAA;IACtD,qEAAgD,CAAA;IAChD,iEAA4C,CAAA;IAC5C,6EAAwD,CAAA;AAC1D,CAAC,EAdW,iBAAiB,iCAAjB,iBAAiB,QAc5B;AAGD,IAAY,kBAEX;AAFD,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;AACjB,CAAC,EAFW,kBAAkB,kCAAlB,kBAAkB,QAE7B;AAGD,IAAY,aAEX;AAFD,WAAY,aAAa;IACvB,8BAAa,CAAA;AACf,CAAC,EAFW,aAAa,6BAAb,aAAa,QAExB;AAED,IAAY,kBAEX;AAFD,WAAY,kBAAkB;IAC5B,+BAAS,CAAA;AACX,CAAC,EAFW,kBAAkB,kCAAlB,kBAAkB,QAE7B;AAGY,QAAA,4BAA4B,GAAG,SAAS,CAAC;AAGzC,QAAA,iBAAiB,GAAG,aAAa,CAAC;AAClC,QAAA,yBAAyB,GAAG,qBAAqB,CAAC;AAClD,QAAA,kBAAkB,GAAG,sBAAsB,CAAC;AAkCzD,SAAS,MAAM,CAAC,OAAwE;IACtF,OAAO,MAAM,CAAC,WAAW,CACvB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAU,CAAC,CAAC,CAAC,CAC9G,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAY;IAC/B,OAAO;QACL,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,KAAK;QAChE,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,IAAI;QACrD,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,MAAM;QAC7C,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,EAAE;QAC7D,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,oCAA4B;QACpE,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,EAAE;QACzC,GAAG,MAAM,CAAC;YACR,CAAC,iBAAiB,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC;YACjD,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC;YACnD;gBACE,iBAAiB,CAAC,oBAAoB;gBACtC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,SAAS,EAAE,GAAG,KAAK,CAAC,MAAM,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aACxH;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAU;IACzB,MAAM,EAAE,yBAAiB;IACzB,OAAO,EAAE,iCAAyB;IAClC,OAAO,EAAE,0BAAkB;CAC5B,CAAC;AAEF,SAAS,YAAY,CAAC,KAAa,EAAE,IAAY;IAC/C,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAGD,SAAgB,cAAc,CAAC,KAA0B;IACvD,QAAQ,KAAK,CAAC,SAAS,EAAE,CAAC;QACxB,KAAK,kBAAS,CAAC,MAAM;YACnB,OAAO,WAAW,CAAC;gBACjB,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;gBAC9B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB;gBACtC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;aACjC,CAAC,CAAC;QACL,KAAK,kBAAS,CAAC,SAAS;YACtB,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC;QAClC,KAAK,kBAAS,CAAC,IAAI;YACjB,OAAO;gBACL,GAAG,WAAW,CAAC,WAAW,CAAC;gBAC3B,GAAG,MAAM,CAAC;oBACR,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;oBAC/D,CAAC,iBAAiB,CAAC,oBAAoB,EAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;oBACtE,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC;oBACrE,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC;iBAC5E,CAAC;aACH,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/runtime/seed/supervisor-contract.d.ts

@@ -0,0 +1,9 @@
+import { type SupervisorLaunchOptions } from '@xemahq/xema-service-nest';
+export declare const SUPERVISOR_PACKAGE = "@xemahq/composed-process-host";
+export declare const SUPERVISOR_BIN_NAME = "xema-composed-process";
+export declare class SupervisorEntryUnavailableError extends Error {
+    constructor(detail: string, options?: ErrorOptions);
+}
+export declare function resolveSupervisorBin(resolveEntry?: (specifier: string) => string): string;
+export declare function supervisorArgv(options: Omit<SupervisorLaunchOptions, 'advertiseHost'> & Partial<Pick<SupervisorLaunchOptions, 'advertiseHost'>>): string[];
+//# sourceMappingURL=supervisor-contract.d.ts.map

package/dist/runtime/seed/supervisor-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor-contract.d.ts","sourceRoot":"","sources":["../../../src/runtime/seed/supervisor-contract.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,2BAA2B,CAAC;AAWnC,eAAO,MAAM,kBAAkB,kCAAkC,CAAC;AAClE,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAG3D,qBAAa,+BAAgC,SAAQ,KAAK;gBACrC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAS1D;AAGD,wBAAgB,oBAAoB,CAClC,YAAY,GAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAA0C,GAC9E,MAAM,CAaR;AA+BD,wBAAgB,cAAc,CAC5B,OAAO,EAAE,IAAI,CAAC,uBAAuB,EAAE,eAAe,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,uBAAuB,EAAE,eAAe,CAAC,CAAC,GAChH,MAAM,EAAE,CASV"}

package/dist/runtime/seed/supervisor-contract.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SupervisorEntryUnavailableError = exports.SUPERVISOR_BIN_NAME = exports.SUPERVISOR_PACKAGE = void 0;
+exports.resolveSupervisorBin = resolveSupervisorBin;
+exports.supervisorArgv = supervisorArgv;
+const node_fs_1 = require("node:fs");
+const node_module_1 = require("node:module");
+const node_path_1 = require("node:path");
+const xema_service_nest_1 = require("@xemahq/xema-service-nest");
+exports.SUPERVISOR_PACKAGE = '@xemahq/composed-process-host';
+exports.SUPERVISOR_BIN_NAME = 'xema-composed-process';
+class SupervisorEntryUnavailableError extends Error {
+    constructor(detail, options) {
+        super(`The seed supervisor entry is unavailable: ${detail} ` +
+            `\`xema up\` launches the \`${exports.SUPERVISOR_BIN_NAME}\` bin of ${exports.SUPERVISOR_PACKAGE} ` +
+            'and has no other way to start the platform.', options);
+        this.name = 'SupervisorEntryUnavailableError';
+    }
+}
+exports.SupervisorEntryUnavailableError = SupervisorEntryUnavailableError;
+function resolveSupervisorBin(resolveEntry = (0, node_module_1.createRequire)(__filename).resolve) {
+    let packageJsonPath;
+    try {
+        packageJsonPath = findPackageJson(resolveEntry(exports.SUPERVISOR_PACKAGE));
+    }
+    catch (error) {
+        throw new SupervisorEntryUnavailableError(`${exports.SUPERVISOR_PACKAGE} is not installed.`, { cause: error });
+    }
+    const manifest = JSON.parse((0, node_fs_1.readFileSync)(packageJsonPath, 'utf8'));
+    const bin = readBin(manifest);
+    if (bin === undefined) {
+        throw new SupervisorEntryUnavailableError(`${exports.SUPERVISOR_PACKAGE} declares no \`${exports.SUPERVISOR_BIN_NAME}\` bin.`);
+    }
+    return (0, node_path_1.resolve)((0, node_path_1.dirname)(packageJsonPath), bin);
+}
+function findPackageJson(entryPath) {
+    let dir = (0, node_path_1.dirname)(entryPath);
+    while (!(0, node_fs_1.existsSync)((0, node_path_1.join)(dir, 'package.json'))) {
+        const parent = (0, node_path_1.dirname)(dir);
+        if (parent === dir) {
+            throw new Error(`No package.json above ${entryPath}.`);
+        }
+        dir = parent;
+    }
+    return (0, node_path_1.join)(dir, 'package.json');
+}
+function readBin(manifest) {
+    if (typeof manifest !== 'object' || manifest === null || !('bin' in manifest)) {
+        return undefined;
+    }
+    const bin = manifest.bin;
+    if (typeof bin !== 'object' || bin === null || !(exports.SUPERVISOR_BIN_NAME in bin)) {
+        return undefined;
+    }
+    const entry = bin[exports.SUPERVISOR_BIN_NAME];
+    return typeof entry === 'string' ? entry : undefined;
+}
+function supervisorArgv(options) {
+    const argv = [];
+    for (const field of Object.keys(xema_service_nest_1.SUPERVISOR_LAUNCH_FLAGS)) {
+        const value = options[field];
+        if (value !== undefined) {
+            argv.push(xema_service_nest_1.SUPERVISOR_LAUNCH_FLAGS[field], String(value));
+        }
+    }
+    return argv;
+}
+//# sourceMappingURL=supervisor-contract.js.map

package/dist/runtime/seed/supervisor-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor-contract.js","sourceRoot":"","sources":["../../../src/runtime/seed/supervisor-contract.ts"],"names":[],"mappings":";;;AAoCA,oDAeC;AA+BD,wCAWC;AA7FD,qCAAmD;AACnD,6CAA4C;AAC5C,yCAAmD;AAEnD,iEAImC;AAWtB,QAAA,kBAAkB,GAAG,+BAA+B,CAAC;AACrD,QAAA,mBAAmB,GAAG,uBAAuB,CAAC;AAG3D,MAAa,+BAAgC,SAAQ,KAAK;IACxD,YAAmB,MAAc,EAAE,OAAsB;QACvD,KAAK,CACH,6CAA6C,MAAM,GAAG;YACpD,8BAA8B,2BAAmB,aAAa,0BAAkB,GAAG;YACnF,6CAA6C,EAC/C,OAAO,CACR,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF;AAVD,0EAUC;AAGD,SAAgB,oBAAoB,CAClC,eAA8C,IAAA,2BAAa,EAAC,UAAU,CAAC,CAAC,OAAO;IAE/E,IAAI,eAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,eAAe,GAAG,eAAe,CAAC,YAAY,CAAC,0BAAkB,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,+BAA+B,CAAC,GAAG,0BAAkB,oBAAoB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,QAAQ,GAAY,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,+BAA+B,CAAC,GAAG,0BAAkB,kBAAkB,2BAAmB,SAAS,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,IAAA,mBAAO,EAAC,IAAA,mBAAO,EAAC,eAAe,CAAC,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAGD,SAAS,eAAe,CAAC,SAAiB;IACxC,IAAI,GAAG,GAAG,IAAA,mBAAO,EAAC,SAAS,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,yBAAyB,SAAS,GAAG,CAAC,CAAC;QACzD,CAAC;QACD,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAA,gBAAI,EAAC,GAAG,EAAE,cAAc,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,OAAO,CAAC,QAAiB;IAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,CAAC;QAC9E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;IACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,2BAAmB,IAAI,GAAG,CAAC,EAAE,CAAC;QAC7E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAI,GAA+B,CAAC,2BAAmB,CAAC,CAAC;IACpE,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAMD,SAAgB,cAAc,CAC5B,OAAiH;IAEjH,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,2CAAuB,CAA4B,EAAE,CAAC;QACpF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,2CAAuB,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/runtime/seed/workload-identity-facts.d.ts

@@ -0,0 +1,17 @@
+import type { XemaInstallationInventory } from '@xemahq/installation-tenancy';
+export interface WorkloadIdentityInventoryFacts {
+    readonly realm: string;
+    readonly audience: string;
+    readonly serviceId: string;
+    readonly keySecret: string;
+    readonly authMount: string;
+    readonly keyBound: {
+        readonly issuer: string;
+        readonly subject: string;
+        readonly assertionAudience: string;
+    };
+}
+export declare function workloadIdentityFacts(inventory: XemaInstallationInventory, process: string): WorkloadIdentityInventoryFacts;
+export declare function keyBoundDeclarationJson(facts: WorkloadIdentityInventoryFacts, attestationFile: string): string;
+export declare function assertEd25519Pkcs8Pem(pem: string, secretName: string): string;
+//# sourceMappingURL=workload-identity-facts.d.ts.map

package/dist/runtime/seed/workload-identity-facts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workload-identity-facts.d.ts","sourceRoot":"","sources":["../../../src/runtime/seed/workload-identity-facts.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAO9E,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;KACpC,CAAC;CACH;AAuBD,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,yBAAyB,EAAE,OAAO,EAAE,MAAM,GAAG,8BAA8B,CAa3H;AAGD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,8BAA8B,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAW9G;AAGD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAU7E"}

package/dist/runtime/seed/workload-identity-facts.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.workloadIdentityFacts = workloadIdentityFacts;
+exports.keyBoundDeclarationJson = keyBoundDeclarationJson;
+exports.assertEd25519Pkcs8Pem = assertEd25519Pkcs8Pem;
+const node_crypto_1 = require("node:crypto");
+const workload_identity_1 = require("@xemahq/workload-identity");
+const FIELDS = [
+    ['realm', (facts) => facts.realm],
+    ['audience', (facts) => facts.audience],
+    ['serviceId', (facts) => facts.serviceId],
+    ['keySecret', (facts) => facts.keySecret],
+    ['authMount', (facts) => facts.authMount],
+    ['keyBound.issuer', (facts) => facts.keyBound?.issuer],
+    ['keyBound.subject', (facts) => facts.keyBound?.subject],
+    ['keyBound.assertionAudience', (facts) => facts.keyBound?.assertionAudience],
+];
+function workloadIdentityFacts(inventory, process) {
+    const recorded = inventory.workloadIdentity?.processes?.[process] ?? {};
+    const missing = FIELDS.filter(([, read]) => {
+        const value = read(recorded);
+        return value === undefined || value === '';
+    }).map(([path]) => `workloadIdentity.processes[${process}].${path}`);
+    if (missing.length > 0) {
+        throw new Error(`The seed's workload identity off Kubernetes needs the installation inventory of "${inventory.installation}" to record ` +
+            `${missing.join(', ')}; the installation's onboarding records them.`);
+    }
+    return recorded;
+}
+function keyBoundDeclarationJson(facts, attestationFile) {
+    const json = JSON.stringify({
+        realm: facts.realm,
+        audience: facts.audience,
+        attestationFile,
+        serviceId: facts.serviceId,
+        attestation: workload_identity_1.WorkloadAttestationMode.KeyBoundAssertion,
+        keyBound: facts.keyBound,
+    });
+    (0, workload_identity_1.parseWorkloadIdentityDeclaration)(json);
+    return json;
+}
+function assertEd25519Pkcs8Pem(pem, secretName) {
+    try {
+        const key = (0, node_crypto_1.createPrivateKey)({ key: pem, format: 'pem', type: 'pkcs8' });
+        if (key.asymmetricKeyType === 'ed25519') {
+            return pem;
+        }
+    }
+    catch {
+    }
+    throw new Error(`The secret "${secretName}" is not an Ed25519 private key in PKCS#8 PEM form.`);
+}
+//# sourceMappingURL=workload-identity-facts.js.map

package/dist/runtime/seed/workload-identity-facts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workload-identity-facts.js","sourceRoot":"","sources":["../../../src/runtime/seed/workload-identity-facts.ts"],"names":[],"mappings":";;AA8CA,sDAaC;AAGD,0DAWC;AAGD,sDAUC;AAtFD,6CAA+C;AAE/C,iEAAsG;AAgCtG,MAAM,MAAM,GAAmF;IAC7F,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;IACjC,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;IACvC,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACzC,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACzC,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACzC,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC;IACtD,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC;IACxD,CAAC,4BAA4B,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,iBAAiB,CAAC;CAC7E,CAAC;AAGF,SAAgB,qBAAqB,CAAC,SAAoC,EAAE,OAAe;IACzF,MAAM,QAAQ,GAAI,SAAsD,CAAC,gBAAgB,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACtH,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,8BAA8B,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,oFAAoF,SAAS,CAAC,YAAY,cAAc;YACtH,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,+CAA+C,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,QAA0C,CAAC;AACpD,CAAC;AAGD,SAAgB,uBAAuB,CAAC,KAAqC,EAAE,eAAuB;IACpG,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,eAAe;QACf,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,2CAAuB,CAAC,iBAAiB;QACtD,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,IAAA,oDAAgC,EAAC,IAAI,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,SAAgB,qBAAqB,CAAC,GAAW,EAAE,UAAkB;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,8BAAgB,EAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACzE,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;IAET,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,qDAAqD,CAAC,CAAC;AAClG,CAAC"}

package/dist/runtime/sources/schema.d.ts

@@ -6,6 +6,7 @@ export declare enum SourceKind {
     Oci = "oci",
     Git = "git"
 }
+export declare const CredentialFreeHttpUrlSchema: z.ZodString;
 export declare const WorkspaceSourceSchema: z.ZodObject<{
     kind: z.ZodLiteral<SourceKind.Workspace>;
     root: z.ZodOptional<z.ZodString>;
@@ -27,6 +28,7 @@ export declare const NpmSourceSchema: z.ZodObject<{
     name: z.ZodString;
 }, z.core.$strict>;
 export type NpmSource = z.infer<typeof NpmSourceSchema>;
+export declare const OciRegistrySchema: z.ZodString;
 export declare const OciSourceSchema: z.ZodObject<{
     kind: z.ZodLiteral<SourceKind.Oci>;
     registry: z.ZodString;

package/dist/runtime/sources/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/runtime/sources/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAyBxB,oBAAY,UAAU;IAEpB,SAAS,cAAc;IAEvB,YAAY,iBAAiB;IAE7B,GAAG,QAAQ;IAEX,GAAG,QAAQ;IAEX,GAAG,QAAQ;CACZ;AA8BD,eAAO,MAAM,qBAAqB;;;;kBAMvB,CAAC;AACZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAQpE,eAAO,MAAM,wBAAwB;;;;;kBAO1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAQ1E,eAAO,MAAM,eAAe;;;;;;kBAWjB,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAGxD,eAAO,MAAM,eAAe;;;;;kBAYjB,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAQxD,eAAO,MAAM,eAAe;;;;;;;kBAcxB,CAAC;AACL,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAM3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAQ1D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAAwC,CAAC;AACzE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/runtime/sources/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAyBxB,oBAAY,UAAU;IAEpB,SAAS,cAAc;IAEvB,YAAY,iBAAiB;IAE7B,GAAG,QAAQ;IAEX,GAAG,QAAQ;IAEX,GAAG,QAAQ;CACZ;AAUD,eAAO,MAAM,2BAA2B,aAKpC,CAAC;AAeL,eAAO,MAAM,qBAAqB;;;;kBAMvB,CAAC;AACZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAQpE,eAAO,MAAM,wBAAwB;;;;;kBAO1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAQ1E,eAAO,MAAM,eAAe;;;;;;kBAWjB,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAGxD,eAAO,MAAM,iBAAiB,aAK1B,CAAC;AAGL,eAAO,MAAM,eAAe;;;;;kBAOjB,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAQxD,eAAO,MAAM,eAAe;;;;;;;kBAcxB,CAAC;AACL,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAM3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAQ1D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAAwC,CAAC;AACzE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/runtime/sources/schema.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SourcesConfigSchema = exports.SourceSpecSchema = exports.GitSourceSchema = exports.OciSourceSchema = exports.NpmSourceSchema = exports.DistributionSourceSchema = exports.WorkspaceSourceSchema = exports.SourceKind = void 0;
+exports.SourcesConfigSchema = exports.SourceSpecSchema = exports.GitSourceSchema = exports.OciSourceSchema = exports.OciRegistrySchema = exports.NpmSourceSchema = exports.DistributionSourceSchema = exports.WorkspaceSourceSchema = exports.CredentialFreeHttpUrlSchema = exports.SourceKind = void 0;
 const zod_1 = require("zod");
 var SourceKind;
 (function (SourceKind) {
@@ -16,7 +16,7 @@ const SourceBaseSchema = {
         .min(1)
         .regex(/^[a-z][a-z0-9-]*$/, 'source name must be lowercase kebab-case'),
 };
-const CredentialFreeHttpUrlSchema = zod_1.z
+exports.CredentialFreeHttpUrlSchema = zod_1.z
     .string()
     .url()
     .superRefine((value, ctx) => {
@@ -48,7 +48,7 @@ exports.NpmSourceSchema = zod_1.z
     .object({
     ...SourceBaseSchema,
     kind: zod_1.z.literal(SourceKind.Npm),
-    registryUrl: CredentialFreeHttpUrlSchema.optional(),
+    registryUrl: exports.CredentialFreeHttpUrlSchema.optional(),
     scope: zod_1.z
         .string()
         .regex(/^@[a-z0-9][a-z0-9-]*$/, 'scope must look like @scope')
@@ -56,16 +56,17 @@ exports.NpmSourceSchema = zod_1.z
     authTokenEnv: zod_1.z.string().min(1).optional(),
 })
     .strict();
+exports.OciRegistrySchema = zod_1.z
+    .string()
+    .min(1)
+    .superRefine((value, ctx) => {
+    validateCredentialFreeRegistry(value, ctx);
+});
 exports.OciSourceSchema = zod_1.z
     .object({
     ...SourceBaseSchema,
     kind: zod_1.z.literal(SourceKind.Oci),
-    registry: zod_1.z
-        .string()
-        .min(1)
-        .superRefine((value, ctx) => {
-        validateCredentialFreeRegistry(value, ctx);
-    }),
+    registry: exports.OciRegistrySchema,
     authTokenEnv: zod_1.z.string().min(1).optional(),
 })
     .strict();

package/dist/runtime/sources/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/runtime/sources/schema.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAyBxB,IAAY,UAWX;AAXD,WAAY,UAAU;IAEpB,qCAAuB,CAAA;IAEvB,2CAA6B,CAAA;IAE7B,yBAAW,CAAA;IAEX,yBAAW,CAAA;IAEX,yBAAW,CAAA;AACb,CAAC,EAXW,UAAU,0BAAV,UAAU,QAWrB;AAGD,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,OAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CAAC,mBAAmB,EAAE,0CAA0C,CAAC;CAC1E,CAAC;AAEF,MAAM,2BAA2B,GAAG,OAAC;KAClC,MAAM,EAAE;KACR,GAAG,EAAE;KACL,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,yBAAyB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC,CAAC,CAAC;AAEL,MAAM,0BAA0B,GAAG,OAAC;KACjC,MAAM,EAAE;KACR,GAAG,CAAC,uBAAuB,CAAC;KAC5B,KAAK,CAAC,cAAc,EAAE,yBAAyB,CAAC;KAChD,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,yBAAyB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC,CAAC,CAAC;AAOQ,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,GAAG,gBAAgB;IACnB,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;IACrC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnC,CAAC;KACD,MAAM,EAAE,CAAC;AASC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,GAAG,gBAAgB;IACnB,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;IACxC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AASC,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,GAAG,gBAAgB;IACnB,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;IAC/B,WAAW,EAAE,2BAA2B,CAAC,QAAQ,EAAE;IACnD,KAAK,EAAE,OAAC;SACL,MAAM,EAAE;SACR,KAAK,CAAC,uBAAuB,EAAE,6BAA6B,CAAC;SAC7D,QAAQ,EAAE;IACb,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,GAAG,gBAAgB;IACnB,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;IAC/B,QAAQ,EAAE,OAAC;SACR,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,8BAA8B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC,CAAC;IACJ,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AASC,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,GAAG,gBAAgB;IACnB,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;IAC/B,GAAG,EAAE,0BAA0B;IAC/B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjC,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE1C,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,0DAA0D,CAAC,CAAC,QAAQ,EAAE;CACnH,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,EAAE;IAC/F,OAAO,EAAE,0EAA0E;IACnF,IAAI,EAAE,CAAC,cAAc,CAAC;CACvB,CAAC,CAAC;AAGQ,QAAA,gBAAgB,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3D,6BAAqB;IACrB,gCAAwB;IACxB,uBAAe;IACf,uBAAe;IACf,uBAAe;CAChB,CAAC,CAAC;AASU,QAAA,mBAAmB,GAAG,OAAC,CAAC,KAAK,CAAC,wBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAGzE,SAAS,yBAAyB,CAAC,KAAa,EAAE,GAAoB;IACpE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IACE,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAC1B,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EACtB,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,wFAAwF;SAC3F,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CACrC,KAAa,EACb,GAAoB;IAEpB,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,0FAA0F;SAC7F,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,yBAAyB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/runtime/sources/schema.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAyBxB,IAAY,UAWX;AAXD,WAAY,UAAU;IAEpB,qCAAuB,CAAA;IAEvB,2CAA6B,CAAA;IAE7B,yBAAW,CAAA;IAEX,yBAAW,CAAA;IAEX,yBAAW,CAAA;AACb,CAAC,EAXW,UAAU,0BAAV,UAAU,QAWrB;AAGD,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,OAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CAAC,mBAAmB,EAAE,0CAA0C,CAAC;CAC1E,CAAC;AAEW,QAAA,2BAA2B,GAAG,OAAC;KACzC,MAAM,EAAE;KACR,GAAG,EAAE;KACL,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,yBAAyB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC,CAAC,CAAC;AAEL,MAAM,0BAA0B,GAAG,OAAC;KACjC,MAAM,EAAE;KACR,GAAG,CAAC,uBAAuB,CAAC;KAC5B,KAAK,CAAC,cAAc,EAAE,yBAAyB,CAAC;KAChD,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,yBAAyB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC,CAAC,CAAC;AAOQ,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,GAAG,gBAAgB;IACnB,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;IACrC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnC,CAAC;KACD,MAAM,EAAE,CAAC;AASC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,GAAG,gBAAgB;IACnB,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;IACxC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AASC,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,GAAG,gBAAgB;IACnB,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;IAC/B,WAAW,EAAE,mCAA2B,CAAC,QAAQ,EAAE;IACnD,KAAK,EAAE,OAAC;SACL,MAAM,EAAE;SACR,KAAK,CAAC,uBAAuB,EAAE,6BAA6B,CAAC;SAC7D,QAAQ,EAAE;IACb,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,iBAAiB,GAAG,OAAC;KAC/B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,8BAA8B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AAGQ,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,GAAG,gBAAgB;IACnB,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;IAC/B,QAAQ,EAAE,yBAAiB;IAC3B,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AASC,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,GAAG,gBAAgB;IACnB,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;IAC/B,GAAG,EAAE,0BAA0B;IAC/B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjC,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE1C,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,0DAA0D,CAAC,CAAC,QAAQ,EAAE;CACnH,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,EAAE;IAC/F,OAAO,EAAE,0EAA0E;IACnF,IAAI,EAAE,CAAC,cAAc,CAAC;CACvB,CAAC,CAAC;AAGQ,QAAA,gBAAgB,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3D,6BAAqB;IACrB,gCAAwB;IACxB,uBAAe;IACf,uBAAe;IACf,uBAAe;CAChB,CAAC,CAAC;AASU,QAAA,mBAAmB,GAAG,OAAC,CAAC,KAAK,CAAC,wBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAGzE,SAAS,yBAAyB,CAAC,KAAa,EAAE,GAAoB;IACpE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IACE,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAC1B,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EACtB,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,wFAAwF;SAC3F,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CACrC,KAAa,EACb,GAAoB;IAEpB,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,0FAA0F;SAC7F,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,yBAAyB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}

package/dist/runtime/store-client.d.ts

@@ -25,15 +25,6 @@ export interface StoreListingVersion {
     readonly archivedAt?: string | null;
     readonly notes?: string | null;
 }
-export interface StoreInstall {
-    readonly id: string;
-    readonly listingVersionId: string;
-    readonly orgId: string;
-    readonly projectId?: string | null;
-    readonly installedAt: string;
-    readonly uninstalledAt?: string | null;
-    readonly versionConstraint: string;
-}
 export interface StorePagination {
     readonly total: number;
     readonly limit: number;
@@ -55,5 +46,4 @@ export declare function listListings(target: ControlPlaneTarget, query: ListList
 }>;
 export declare function getListing(target: ControlPlaneTarget, id: string): Promise<StoreListing>;
 export declare function listListingVersions(target: ControlPlaneTarget, id: string): Promise<readonly StoreListingVersion[]>;
-export declare function uninstallInstall(target: ControlPlaneTarget, installId: string): Promise<StoreInstall>;
 //# sourceMappingURL=store-client.d.ts.map

package/dist/runtime/store-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store-client.d.ts","sourceRoot":"","sources":["../../src/runtime/store-client.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAe,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAU5E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAM3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAID,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAGD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAGD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAID,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AA8ED,wBAAsB,YAAY,CAChC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC;IAAE,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;IAAC,UAAU,EAAE,eAAe,CAAA;CAAE,CAAC,CAO7E;AAGD,wBAAsB,UAAU,CAC9B,MAAM,EAAE,kBAAkB,EAC1B,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,YAAY,CAAC,CAOvB;AAGD,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,kBAAkB,EAC1B,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAOzC;AAID,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,kBAAkB,EAC1B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,YAAY,CAAC,CAOvB"}
+{"version":3,"file":"store-client.d.ts","sourceRoot":"","sources":["../../src/runtime/store-client.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAe,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAU5E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAM3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAID,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAGD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAID,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AA8ED,wBAAsB,YAAY,CAChC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC;IAAE,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;IAAC,UAAU,EAAE,eAAe,CAAA;CAAE,CAAC,CAO7E;AAGD,wBAAsB,UAAU,CAC9B,MAAM,EAAE,kBAAkB,EAC1B,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,YAAY,CAAC,CAOvB;AAGD,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,kBAAkB,EAC1B,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAOzC"}

package/dist/runtime/store-client.js

@@ -3,7 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.listListings = listListings;
 exports.getListing = getListing;
 exports.listListingVersions = listListingVersions;
-exports.uninstallInstall = uninstallInstall;
 const control_plane_1 = require("../lib/control-plane");
 const exit_codes_1 = require("../lib/exit-codes");
 const http_error_1 = require("../lib/http-error");
@@ -65,8 +64,4 @@ async function listListingVersions(target, id) {
     const body = await request(target, 'GET', `/listings/${encodeURIComponent(id)}/versions`);
     return body.data ?? [];
 }
-async function uninstallInstall(target, installId) {
-    const body = await request(target, 'POST', `/installs/${encodeURIComponent(installId)}/uninstall`);
-    return body.data;
-}
 //# sourceMappingURL=store-client.js.map

package/dist/runtime/store-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"store-client.js","sourceRoot":"","sources":["../../src/runtime/store-client.ts"],"names":[],"mappings":";;AAiLA,oCAUC;AAGD,gCAUC;AAGD,kDAUC;AAID,4CAUC;AA1MD,wDAA4E;AAC5E,kDAA8D;AAC9D,kDAAuD;AAyFvD,KAAK,UAAU,OAAO,CACpB,MAA0B,EAC1B,MAAsB,EACtB,IAAY;IAEZ,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;IACvC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM;YACN,OAAO,EAAE,IAAA,2BAAW,EAAC,MAAM,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,IAAA,qBAAQ,EACb,4BAAe,CAAC,YAAY,EAC5B,6BAA6B,GAAG,KAAK,MAAM,EAAE,CAC9C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,IAAA,qBAAQ,EACb,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,4BAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,4BAAe,CAAC,YAAY,EAC5E,cAAc,MAAM,IAAI,IAAI,MAAM,GAAG,CAAC,MAAM,IAAI;YAC9C,IAAA,+BAAkB,EAAC,GAAG,CAAC,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CACzD,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAM,CAAC;AACxD,CAAC;AAGD,SAAS,iBAAiB,CAAC,KAAwB;IACjD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC7B,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvC,CAAC;AAGM,KAAK,UAAU,YAAY,CAChC,MAA0B,EAC1B,KAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,MAAM,EACN,KAAK,EACL,YAAY,iBAAiB,CAAC,KAAK,CAAC,EAAE,CACvC,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AACpE,CAAC;AAGM,KAAK,UAAU,UAAU,CAC9B,MAA0B,EAC1B,EAAU;IAEV,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,MAAM,EACN,KAAK,EACL,aAAa,kBAAkB,CAAC,EAAE,CAAC,EAAE,CACtC,CAAC;IACF,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAGM,KAAK,UAAU,mBAAmB,CACvC,MAA0B,EAC1B,EAAU;IAEV,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,MAAM,EACN,KAAK,EACL,aAAa,kBAAkB,CAAC,EAAE,CAAC,WAAW,CAC/C,CAAC;IACF,OAAO,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;AACzB,CAAC;AAIM,KAAK,UAAU,gBAAgB,CACpC,MAA0B,EAC1B,SAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,MAAM,EACN,MAAM,EACN,aAAa,kBAAkB,CAAC,SAAS,CAAC,YAAY,CACvD,CAAC;IACF,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC"}
+{"version":3,"file":"store-client.js","sourceRoot":"","sources":["../../src/runtime/store-client.ts"],"names":[],"mappings":";;AAoKA,oCAUC;AAGD,gCAUC;AAGD,kDAUC;AAjLD,wDAA4E;AAC5E,kDAA8D;AAC9D,kDAAuD;AA8EvD,KAAK,UAAU,OAAO,CACpB,MAA0B,EAC1B,MAAsB,EACtB,IAAY;IAEZ,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;IACvC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM;YACN,OAAO,EAAE,IAAA,2BAAW,EAAC,MAAM,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,IAAA,qBAAQ,EACb,4BAAe,CAAC,YAAY,EAC5B,6BAA6B,GAAG,KAAK,MAAM,EAAE,CAC9C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,IAAA,qBAAQ,EACb,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,4BAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,4BAAe,CAAC,YAAY,EAC5E,cAAc,MAAM,IAAI,IAAI,MAAM,GAAG,CAAC,MAAM,IAAI;YAC9C,IAAA,+BAAkB,EAAC,GAAG,CAAC,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CACzD,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAM,CAAC;AACxD,CAAC;AAGD,SAAS,iBAAiB,CAAC,KAAwB;IACjD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC7B,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvC,CAAC;AAGM,KAAK,UAAU,YAAY,CAChC,MAA0B,EAC1B,KAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,MAAM,EACN,KAAK,EACL,YAAY,iBAAiB,CAAC,KAAK,CAAC,EAAE,CACvC,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AACpE,CAAC;AAGM,KAAK,UAAU,UAAU,CAC9B,MAA0B,EAC1B,EAAU;IAEV,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,MAAM,EACN,KAAK,EACL,aAAa,kBAAkB,CAAC,EAAE,CAAC,EAAE,CACtC,CAAC;IACF,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAGM,KAAK,UAAU,mBAAmB,CACvC,MAA0B,EAC1B,EAAU;IAEV,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,MAAM,EACN,KAAK,EACL,aAAa,kBAAkB,CAAC,EAAE,CAAC,WAAW,CAC/C,CAAC;IACF,OAAO,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;AACzB,CAAC"}

package/dist/runtime/tenancy/identity-installer.d.ts

@@ -0,0 +1,11 @@
+import { type IdentityInstallerOptions, type TenancyEndpoints } from '@xemahq/installation-tenancy';
+import type { IdentityInstallerDeclaration } from './servers';
+import type { ParsedXemaInstallation } from '../installation/contract';
+export declare function keycloakBindingEndpoint(installation: Pick<ParsedXemaInstallation['spec'], 'infrastructure'>): string | undefined;
+export declare function resolveIdentityInstaller(input: {
+    readonly endpoints: TenancyEndpoints;
+    readonly installer: IdentityInstallerDeclaration | undefined;
+    readonly keycloakEndpoint: string | undefined;
+    readonly requestTimeoutMs: number;
+}): Promise<IdentityInstallerOptions | undefined>;
+//# sourceMappingURL=identity-installer.d.ts.map

package/dist/runtime/tenancy/identity-installer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-installer.d.ts","sourceRoot":"","sources":["../../../src/runtime/tenancy/identity-installer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,KAAK,wBAAwB,EAAE,KAAK,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAK7G,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAKvE,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC,GAAG,MAAM,GAAG,SAAS,CAEhI;AAYD,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,4BAA4B,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CA6BhD"}

package/dist/runtime/tenancy/identity-installer.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.keycloakBindingEndpoint = keycloakBindingEndpoint;
+exports.resolveIdentityInstaller = resolveIdentityInstaller;
+const installation_tenancy_1 = require("@xemahq/installation-tenancy");
+const cli_errors_1 = require("../../lib/cli-errors");
+const schema_1 = require("../config/schema");
+const DISCOVERY_PATH = '.well-known/openid-configuration';
+function keycloakBindingEndpoint(installation) {
+    return installation.infrastructure.find((entry) => entry.component === schema_1.InfraComponent.Keycloak)?.endpoint;
+}
+async function resolveIdentityInstaller(input) {
+    if (input.endpoints[installation_tenancy_1.Backend.Identity] === undefined) {
+        return undefined;
+    }
+    if (input.installer === undefined) {
+        throw new cli_errors_1.CliConfigurationError('The servers file names identity but not identity.installer {realm, clientId, secretName}: the platform installer client identity-api onboarding authenticates as.');
+    }
+    if (input.keycloakEndpoint === undefined) {
+        throw new cli_errors_1.CliConfigurationError('Identity onboarding finds the operator-plane realm through the keycloak infrastructure binding, and none declares an endpoint.');
+    }
+    const url = `${input.keycloakEndpoint.replace(/\/+$/, '')}/realms/${encodeURIComponent(input.installer.realm)}/${DISCOVERY_PATH}`;
+    let document;
+    try {
+        const response = await fetch(url, { signal: AbortSignal.timeout(input.requestTimeoutMs) });
+        if (!response.ok) {
+            throw new Error(`answered ${String(response.status)}`);
+        }
+        document = (await response.json());
+    }
+    catch (error) {
+        throw new cli_errors_1.CliConfigurationError(`OIDC discovery at ${url} failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (typeof document.token_endpoint !== 'string' || document.token_endpoint === '') {
+        throw new cli_errors_1.CliConfigurationError(`OIDC discovery at ${url} states no token_endpoint.`);
+    }
+    return { clientId: input.installer.clientId, secretName: input.installer.secretName, platformTokenEndpoint: document.token_endpoint };
+}
+//# sourceMappingURL=identity-installer.js.map

package/dist/runtime/tenancy/identity-installer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-installer.js","sourceRoot":"","sources":["../../../src/runtime/tenancy/identity-installer.ts"],"names":[],"mappings":";;AAWA,0DAEC;AAYD,4DAkCC;AA3DD,uEAA6G;AAE7G,qDAA6D;AAC7D,6CAAkD;AAKlD,MAAM,cAAc,GAAG,kCAAkC,CAAC;AAG1D,SAAgB,uBAAuB,CAAC,YAAoE;IAC1G,OAAO,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,uBAAc,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;AAC5G,CAAC;AAYM,KAAK,UAAU,wBAAwB,CAAC,KAK9C;IACC,IAAI,KAAK,CAAC,SAAS,CAAC,8BAAO,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,kCAAqB,CAC7B,mKAAmK,CACpK,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,IAAI,kCAAqB,CAC7B,gIAAgI,CACjI,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,cAAc,EAAE,CAAC;IAClI,IAAI,QAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,YAAY,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAc,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kCAAqB,CAAC,qBAAqB,GAAG,YAAY,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChI,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,cAAc,KAAK,QAAQ,IAAI,QAAQ,CAAC,cAAc,KAAK,EAAE,EAAE,CAAC;QAClF,MAAM,IAAI,kCAAqB,CAAC,qBAAqB,GAAG,4BAA4B,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,qBAAqB,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC;AACxI,CAAC"}

package/dist/runtime/tenancy/import-cache.d.ts

@@ -0,0 +1,5 @@
+import { type InventoryPersister, type XemaInstallationInventory } from '@xemahq/installation-tenancy';
+import type { InstallationStateStore } from '../installation/state-store';
+export declare function assertImportKeepsCache(imported: XemaInstallationInventory, store: InstallationStateStore): void;
+export declare function importPersister(explicitPath: string | undefined, path: string, store: InstallationStateStore): InventoryPersister;
+//# sourceMappingURL=import-cache.d.ts.map

package/dist/runtime/tenancy/import-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-cache.d.ts","sourceRoot":"","sources":["../../../src/runtime/tenancy/import-cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,kBAAkB,EAAE,KAAK,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAKvH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAU1E,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,yBAAyB,EAAE,KAAK,EAAE,sBAAsB,GAAG,IAAI,CAc/G;AAGD,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,GAAG,kBAAkB,CAIjI"}

package/dist/runtime/tenancy/import-cache.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertImportKeepsCache = assertImportKeepsCache;
+exports.importPersister = importPersister;
+const installation_tenancy_1 = require("@xemahq/installation-tenancy");
+const session_1 = require("./session");
+const cli_errors_1 = require("../../lib/cli-errors");
+const keyOf = (r) => `${r.backend}/${r.kind}/${r.name}`;
+function assertImportKeepsCache(imported, store) {
+    const cached = (0, session_1.loadInventory)(imported.installation, undefined, store);
+    if (cached === undefined) {
+        return;
+    }
+    const found = new Set(imported.resources.map(keyOf));
+    const missing = cached.resources.map(keyOf).filter((key) => !found.has(key));
+    if (missing.length > 0) {
+        throw new cli_errors_1.CliConfigurationError(`import refused, nothing written: the cached inventory ${store.inventoryCachePath(imported.installation)} holds ${String(missing.length)} resource(s) the import did not find:\n${missing
+            .map((key) => `  ${key}`)
+            .join('\n')}\nReplacing it would leave them unreachable by delete. Write the import elsewhere with --inventory <path> (the cache is then left untouched), or restore the missing resources and import again.`);
+    }
+}
+function importPersister(explicitPath, path, store) {
+    return explicitPath === undefined
+        ? (0, session_1.inventoryPersister)(path, store)
+        : { persist: (inventory) => { (0, installation_tenancy_1.writeInventory)(path, inventory); } };
+}
+//# sourceMappingURL=import-cache.js.map

package/dist/runtime/tenancy/import-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-cache.js","sourceRoot":"","sources":["../../../src/runtime/tenancy/import-cache.ts"],"names":[],"mappings":";;AAeA,wDAcC;AAGD,0CAIC;AApCD,uEAAuH;AAEvH,uCAA8D;AAC9D,qDAA6D;AAI7D,MAAM,KAAK,GAAG,CAAC,CAAkD,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAQjH,SAAgB,sBAAsB,CAAC,QAAmC,EAAE,KAA6B;IACvG,MAAM,MAAM,GAAG,IAAA,uBAAa,EAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACtE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,kCAAqB,CAC7B,yDAAyD,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,UAAU,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,0CAA0C,OAAO;aACtL,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;aACxB,IAAI,CAAC,IAAI,CAAC,kMAAkM,CAChN,CAAC;IACJ,CAAC;AACH,CAAC;AAGD,SAAgB,eAAe,CAAC,YAAgC,EAAE,IAAY,EAAE,KAA6B;IAC3G,OAAO,YAAY,KAAK,SAAS;QAC/B,CAAC,CAAC,IAAA,4BAAkB,EAAC,IAAI,EAAE,KAAK,CAAC;QACjC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,SAAoC,EAAQ,EAAE,GAAG,IAAA,qCAAc,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxG,CAAC"}

package/dist/runtime/tenancy/openfga.d.ts

@@ -0,0 +1,4 @@
+import { type ParsedXemaInstallation } from '../installation/contract';
+import type { OpenFgaInput } from '@xemahq/installation-tenancy';
+export declare function openFgaInputOf(installation: Pick<ParsedXemaInstallation['spec'], 'infrastructure' | 'secrets'>, env: NodeJS.ProcessEnv): OpenFgaInput | undefined;
+//# sourceMappingURL=openfga.d.ts.map

package/dist/runtime/tenancy/openfga.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openfga.d.ts","sourceRoot":"","sources":["../../../src/runtime/tenancy/openfga.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2B,KAAK,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAEhG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAWjE,wBAAgB,cAAc,CAC5B,YAAY,EAAE,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC,EAChF,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,YAAY,GAAG,SAAS,CAqB1B"}

package/dist/runtime/tenancy/openfga.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openFgaInputOf = openFgaInputOf;
+const cli_errors_1 = require("../../lib/cli-errors");
+const schema_1 = require("../config/schema");
+const contract_1 = require("../installation/contract");
+function openFgaInputOf(installation, env) {
+    const binding = installation.infrastructure.find((entry) => entry.component === schema_1.InfraComponent.Fga);
+    if (binding?.endpoint === undefined) {
+        return undefined;
+    }
+    const [secretName, ...extra] = binding.secretRefs;
+    if (extra.length > 0) {
+        throw new Error(`The fga infrastructure binding names ${String(binding.secretRefs.length)} secrets; it takes at most the preshared key.`);
+    }
+    if (secretName === undefined) {
+        throw new cli_errors_1.CliConfigurationError('The fga infrastructure binding has an endpoint but names no secret; the OpenFGA backend needs its preshared key (add the secret to the binding\'s secretRefs).');
+    }
+    const secret = installation.secrets.find((entry) => entry.name === secretName);
+    if (secret === undefined || secret.provider !== contract_1.SecretReferenceProvider.Environment) {
+        throw new Error(`The fga preshared key "${secretName}" must be declared as an Environment secret in spec.secrets.`);
+    }
+    const value = env[secret.variable];
+    if (value === undefined || value === '') {
+        throw new Error(`The fga preshared key "${secretName}" is read from ${secret.variable}, which is unset or empty.`);
+    }
+    return { endpoint: binding.endpoint, presharedKey: value };
+}
+//# sourceMappingURL=openfga.js.map

package/dist/runtime/tenancy/openfga.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openfga.js","sourceRoot":"","sources":["../../../src/runtime/tenancy/openfga.ts"],"names":[],"mappings":";;AAeA,wCAwBC;AAvCD,qDAA6D;AAC7D,6CAAkD;AAClD,uDAAgG;AAahG,SAAgB,cAAc,CAC5B,YAAgF,EAChF,GAAsB;IAEtB,MAAM,OAAO,GAAG,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,uBAAc,CAAC,GAAG,CAAC,CAAC;IACpG,IAAI,OAAO,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,+CAA+C,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,kCAAqB,CAAC,gKAAgK,CAAC,CAAC;IACpM,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAC/E,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,kCAAuB,CAAC,WAAW,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,0BAA0B,UAAU,8DAA8D,CAAC,CAAC;IACtH,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,0BAA0B,UAAU,kBAAkB,MAAM,CAAC,QAAQ,4BAA4B,CAAC,CAAC;IACrH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AAC7D,CAAC"}

package/dist/runtime/tenancy/servers.d.ts

@@ -0,0 +1,18 @@
+import { type TenancyEndpoints } from '@xemahq/installation-tenancy';
+export interface IdentityInstallerDeclaration {
+    readonly realm: string;
+    readonly clientId: string;
+    readonly secretName: string;
+}
+export interface PostgresPoolerDeclaration {
+    readonly endpoint: string;
+    readonly sslParams: string;
+}
+export interface ServersDeclaration {
+    readonly endpoints: TenancyEndpoints;
+    readonly identityInstaller?: IdentityInstallerDeclaration;
+    readonly postgresPooler?: PostgresPoolerDeclaration;
+}
+export declare function readServersDeclaration(path: string): ServersDeclaration;
+export declare function readServersFile(path: string): TenancyEndpoints;
+//# sourceMappingURL=servers.d.ts.map

package/dist/runtime/tenancy/servers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"servers.d.ts","sourceRoot":"","sources":["../../../src/runtime/tenancy/servers.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiD,KAAK,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAYpH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAGD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IAErC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,4BAA4B,CAAC;IAE1D,QAAQ,CAAC,cAAc,CAAC,EAAE,yBAAyB,CAAC;CACrD;AAmDD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAiDvE;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAE9D"}