# Definitions and installations

Prefer the [XML schemas dialect](schema-manual://schema-xml-1/authoring) for embedded schemas. It supports native form annotations such as `input-type="password"`, `related-resource="device"`, `editor-language="lua"`, and `property-order`. Existing JSON text and CDATA remain supported; each resource keeps its existing validation and execution restrictions.

The source authors a definition, not an installation. Constants, Lua, resources,
handler connections, protocol settings, and the JSON Schema configuration
schema belong in the definition. Controller IDs, site addresses, usernames,
passwords, certificates, tokens, and other site-specific values belong to an
EdgeApp installation.

Declare accepted installation values as properties in `<config-schema>`. Use
`${config:NAME}` in configurable string fields. Secret-bearing XML elements use
`config="NAME"` and cannot contain literal values. At installation time,
`EdgeAppInstallation.variables` is checked against the schema and sent to the
controller, where bindings are resolved.

This invalid definition references a configuration name that it did not
advertise. The compiler rejects it.

```xml
<edge-app format="1" handle="invalid-binding" name="Invalid binding">
  <handlers>
    <handler name="receive"><![CDATA[return true]]></handler>
  </handlers>
  <mqtt-brokers>
    <broker name="plant" url="${config:MQTT_URL}">
      <subscriptions>
        <subscription topic="plant/events" handler="receive"/>
      </subscriptions>
    </broker>
  </mqtt-brokers>
</edge-app>
```