@treeseed/sdk 0.13.0-rc.100 → 0.13.0-rc.101

package/dist/.treeseed-build-complete.json

@@ -1 +1 @@
-{"completedAt":"2026-09-08T18:31:30.621Z"}
+{"completedAt":"2026-09-09T04:49:43.782Z"}

package/dist/capacity-provider/capability-ontology.d.ts

@@ -703,9 +703,6 @@ export declare const capabilityDemandSchema: z.ZodObject<{
     demandDigest: z.ZodString;
 }, "strict", z.ZodTypeAny, {
     schemaVersion: "treeseed.capability-demand/v1";
-    permissionClasses: string[];
-    contextModes: string[];
-    ontologyGeneration: number;
     requirements: {
         configuration: Record<string, {
             requirement: "required" | "preferred";
@@ -717,6 +714,9 @@ export declare const capabilityDemandSchema: z.ZodObject<{
         alternativeGroup: string | null;
         requiredFeatures: string[];
     }[];
+    permissionClasses: string[];
+    contextModes: string[];
+    ontologyGeneration: number;
     resolved: {
         id: string;
         version: string;
@@ -737,9 +737,6 @@ export declare const capabilityDemandSchema: z.ZodObject<{
     demandDigest: string;
 }, {
     schemaVersion: "treeseed.capability-demand/v1";
-    permissionClasses: string[];
-    contextModes: string[];
-    ontologyGeneration: number;
     requirements: {
         requirement: "required" | "preferred";
         capabilityId: string;
@@ -751,6 +748,9 @@ export declare const capabilityDemandSchema: z.ZodObject<{
         alternativeGroup?: string | null | undefined;
         requiredFeatures?: string[] | undefined;
     }[];
+    permissionClasses: string[];
+    contextModes: string[];
+    ontologyGeneration: number;
     resolved: {
         id: string;
         version: string;

package/dist/deployment/index.d.ts

@@ -1,4 +1,5 @@
 export * from './schemas.js';
+export * from './postgres/contracts.js';
 export * from './canonical.js';
 export * from './catalog.js';
 export * from './topology.js';

package/dist/deployment/index.js

@@ -1,4 +1,5 @@
 export * from "./schemas.js";
+export * from "./postgres/contracts.js";
 export * from "./canonical.js";
 export * from "./catalog.js";
 export * from "./topology.js";

package/dist/deployment/postgres/contracts.d.ts

@@ -0,0 +1,399 @@
+import { z } from 'zod';
+/** Package-owned requirements, not an instruction to start another server. */
+export declare const postgresRequirementSchema: z.ZodObject<{
+    id: z.ZodString;
+    componentId: z.ZodString;
+    enabled: z.ZodBoolean;
+    supportedMajors: z.ZodEffects<z.ZodArray<z.ZodNumber, "atleastone">, [number, ...number[]], [number, ...number[]]>;
+    extensions: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>;
+    runtimeConnectionLimit: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    componentId: string;
+    enabled: boolean;
+    supportedMajors: [number, ...number[]];
+    extensions: string[];
+    runtimeConnectionLimit: number;
+}, {
+    id: string;
+    componentId: string;
+    enabled: boolean;
+    supportedMajors: [number, ...number[]];
+    extensions: string[];
+    runtimeConnectionLimit: number;
+}>;
+/** Deployment owns the selected server and its bootstrap authority. No credentials here. */
+export declare const postgresServerSchema: z.ZodObject<{
+    id: z.ZodString;
+    installationId: z.ZodString;
+    environment: z.ZodEnum<["staging", "production"]>;
+    mode: z.ZodEnum<["shared", "dedicated", "external"]>;
+    hostname: z.ZodString;
+    port: z.ZodNumber;
+    major: z.ZodNumber;
+    extensions: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>;
+    tls: z.ZodObject<{
+        mode: z.ZodLiteral<"verify-full">;
+        trustReference: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        mode: "verify-full";
+        trustReference: string;
+    }, {
+        mode: "verify-full";
+        trustReference: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    mode: "external" | "shared" | "dedicated";
+    environment: "production" | "staging";
+    port: number;
+    major: number;
+    tls: {
+        mode: "verify-full";
+        trustReference: string;
+    };
+    extensions: string[];
+    installationId: string;
+    hostname: string;
+}, {
+    id: string;
+    mode: "external" | "shared" | "dedicated";
+    environment: "production" | "staging";
+    port: number;
+    major: number;
+    tls: {
+        mode: "verify-full";
+        trustReference: string;
+    };
+    extensions: string[];
+    installationId: string;
+    hostname: string;
+}>;
+export declare const postgresAllocationSchema: z.ZodEffects<z.ZodObject<{
+    requirementId: z.ZodString;
+    serverId: z.ZodString;
+    database: z.ZodEffects<z.ZodString, string, string>;
+    ownerRole: z.ZodEffects<z.ZodString, string, string>;
+    migrationRole: z.ZodEffects<z.ZodString, string, string>;
+    runtimeRole: z.ZodEffects<z.ZodString, string, string>;
+    migrationCredentialReference: z.ZodString;
+    runtimeCredentialReference: z.ZodString;
+    onDisable: z.ZodLiteral<"preserve">;
+}, "strict", z.ZodTypeAny, {
+    requirementId: string;
+    serverId: string;
+    database: string;
+    ownerRole: string;
+    migrationRole: string;
+    runtimeRole: string;
+    migrationCredentialReference: string;
+    runtimeCredentialReference: string;
+    onDisable: "preserve";
+}, {
+    requirementId: string;
+    serverId: string;
+    database: string;
+    ownerRole: string;
+    migrationRole: string;
+    runtimeRole: string;
+    migrationCredentialReference: string;
+    runtimeCredentialReference: string;
+    onDisable: "preserve";
+}>, {
+    requirementId: string;
+    serverId: string;
+    database: string;
+    ownerRole: string;
+    migrationRole: string;
+    runtimeRole: string;
+    migrationCredentialReference: string;
+    runtimeCredentialReference: string;
+    onDisable: "preserve";
+}, {
+    requirementId: string;
+    serverId: string;
+    database: string;
+    ownerRole: string;
+    migrationRole: string;
+    runtimeRole: string;
+    migrationCredentialReference: string;
+    runtimeCredentialReference: string;
+    onDisable: "preserve";
+}>;
+/** One installation/environment. Explicit allocations may select dedicated servers. */
+export declare const postgresTopologySchema: z.ZodEffects<z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.postgres-topology/v1">;
+    installationId: z.ZodString;
+    environment: z.ZodEnum<["staging", "production"]>;
+    servers: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        installationId: z.ZodString;
+        environment: z.ZodEnum<["staging", "production"]>;
+        mode: z.ZodEnum<["shared", "dedicated", "external"]>;
+        hostname: z.ZodString;
+        port: z.ZodNumber;
+        major: z.ZodNumber;
+        extensions: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>;
+        tls: z.ZodObject<{
+            mode: z.ZodLiteral<"verify-full">;
+            trustReference: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            mode: "verify-full";
+            trustReference: string;
+        }, {
+            mode: "verify-full";
+            trustReference: string;
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        mode: "external" | "shared" | "dedicated";
+        environment: "production" | "staging";
+        port: number;
+        major: number;
+        tls: {
+            mode: "verify-full";
+            trustReference: string;
+        };
+        extensions: string[];
+        installationId: string;
+        hostname: string;
+    }, {
+        id: string;
+        mode: "external" | "shared" | "dedicated";
+        environment: "production" | "staging";
+        port: number;
+        major: number;
+        tls: {
+            mode: "verify-full";
+            trustReference: string;
+        };
+        extensions: string[];
+        installationId: string;
+        hostname: string;
+    }>, "many">;
+    requirements: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        componentId: z.ZodString;
+        enabled: z.ZodBoolean;
+        supportedMajors: z.ZodEffects<z.ZodArray<z.ZodNumber, "atleastone">, [number, ...number[]], [number, ...number[]]>;
+        extensions: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>;
+        runtimeConnectionLimit: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        componentId: string;
+        enabled: boolean;
+        supportedMajors: [number, ...number[]];
+        extensions: string[];
+        runtimeConnectionLimit: number;
+    }, {
+        id: string;
+        componentId: string;
+        enabled: boolean;
+        supportedMajors: [number, ...number[]];
+        extensions: string[];
+        runtimeConnectionLimit: number;
+    }>, "many">;
+    allocations: z.ZodArray<z.ZodEffects<z.ZodObject<{
+        requirementId: z.ZodString;
+        serverId: z.ZodString;
+        database: z.ZodEffects<z.ZodString, string, string>;
+        ownerRole: z.ZodEffects<z.ZodString, string, string>;
+        migrationRole: z.ZodEffects<z.ZodString, string, string>;
+        runtimeRole: z.ZodEffects<z.ZodString, string, string>;
+        migrationCredentialReference: z.ZodString;
+        runtimeCredentialReference: z.ZodString;
+        onDisable: z.ZodLiteral<"preserve">;
+    }, "strict", z.ZodTypeAny, {
+        requirementId: string;
+        serverId: string;
+        database: string;
+        ownerRole: string;
+        migrationRole: string;
+        runtimeRole: string;
+        migrationCredentialReference: string;
+        runtimeCredentialReference: string;
+        onDisable: "preserve";
+    }, {
+        requirementId: string;
+        serverId: string;
+        database: string;
+        ownerRole: string;
+        migrationRole: string;
+        runtimeRole: string;
+        migrationCredentialReference: string;
+        runtimeCredentialReference: string;
+        onDisable: "preserve";
+    }>, {
+        requirementId: string;
+        serverId: string;
+        database: string;
+        ownerRole: string;
+        migrationRole: string;
+        runtimeRole: string;
+        migrationCredentialReference: string;
+        runtimeCredentialReference: string;
+        onDisable: "preserve";
+    }, {
+        requirementId: string;
+        serverId: string;
+        database: string;
+        ownerRole: string;
+        migrationRole: string;
+        runtimeRole: string;
+        migrationCredentialReference: string;
+        runtimeCredentialReference: string;
+        onDisable: "preserve";
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.postgres-topology/v1";
+    environment: "production" | "staging";
+    installationId: string;
+    servers: {
+        id: string;
+        mode: "external" | "shared" | "dedicated";
+        environment: "production" | "staging";
+        port: number;
+        major: number;
+        tls: {
+            mode: "verify-full";
+            trustReference: string;
+        };
+        extensions: string[];
+        installationId: string;
+        hostname: string;
+    }[];
+    requirements: {
+        id: string;
+        componentId: string;
+        enabled: boolean;
+        supportedMajors: [number, ...number[]];
+        extensions: string[];
+        runtimeConnectionLimit: number;
+    }[];
+    allocations: {
+        requirementId: string;
+        serverId: string;
+        database: string;
+        ownerRole: string;
+        migrationRole: string;
+        runtimeRole: string;
+        migrationCredentialReference: string;
+        runtimeCredentialReference: string;
+        onDisable: "preserve";
+    }[];
+}, {
+    schemaVersion: "treeseed.postgres-topology/v1";
+    environment: "production" | "staging";
+    installationId: string;
+    servers: {
+        id: string;
+        mode: "external" | "shared" | "dedicated";
+        environment: "production" | "staging";
+        port: number;
+        major: number;
+        tls: {
+            mode: "verify-full";
+            trustReference: string;
+        };
+        extensions: string[];
+        installationId: string;
+        hostname: string;
+    }[];
+    requirements: {
+        id: string;
+        componentId: string;
+        enabled: boolean;
+        supportedMajors: [number, ...number[]];
+        extensions: string[];
+        runtimeConnectionLimit: number;
+    }[];
+    allocations: {
+        requirementId: string;
+        serverId: string;
+        database: string;
+        ownerRole: string;
+        migrationRole: string;
+        runtimeRole: string;
+        migrationCredentialReference: string;
+        runtimeCredentialReference: string;
+        onDisable: "preserve";
+    }[];
+}>, {
+    schemaVersion: "treeseed.postgres-topology/v1";
+    environment: "production" | "staging";
+    installationId: string;
+    servers: {
+        id: string;
+        mode: "external" | "shared" | "dedicated";
+        environment: "production" | "staging";
+        port: number;
+        major: number;
+        tls: {
+            mode: "verify-full";
+            trustReference: string;
+        };
+        extensions: string[];
+        installationId: string;
+        hostname: string;
+    }[];
+    requirements: {
+        id: string;
+        componentId: string;
+        enabled: boolean;
+        supportedMajors: [number, ...number[]];
+        extensions: string[];
+        runtimeConnectionLimit: number;
+    }[];
+    allocations: {
+        requirementId: string;
+        serverId: string;
+        database: string;
+        ownerRole: string;
+        migrationRole: string;
+        runtimeRole: string;
+        migrationCredentialReference: string;
+        runtimeCredentialReference: string;
+        onDisable: "preserve";
+    }[];
+}, {
+    schemaVersion: "treeseed.postgres-topology/v1";
+    environment: "production" | "staging";
+    installationId: string;
+    servers: {
+        id: string;
+        mode: "external" | "shared" | "dedicated";
+        environment: "production" | "staging";
+        port: number;
+        major: number;
+        tls: {
+            mode: "verify-full";
+            trustReference: string;
+        };
+        extensions: string[];
+        installationId: string;
+        hostname: string;
+    }[];
+    requirements: {
+        id: string;
+        componentId: string;
+        enabled: boolean;
+        supportedMajors: [number, ...number[]];
+        extensions: string[];
+        runtimeConnectionLimit: number;
+    }[];
+    allocations: {
+        requirementId: string;
+        serverId: string;
+        database: string;
+        ownerRole: string;
+        migrationRole: string;
+        runtimeRole: string;
+        migrationCredentialReference: string;
+        runtimeCredentialReference: string;
+        onDisable: "preserve";
+    }[];
+}>;
+export type PostgresRequirement = z.infer<typeof postgresRequirementSchema>;
+export type PostgresServer = z.infer<typeof postgresServerSchema>;
+export type PostgresAllocation = z.infer<typeof postgresAllocationSchema>;
+export type PostgresTopology = z.infer<typeof postgresTopologySchema>;

package/dist/deployment/postgres/contracts.js

@@ -0,0 +1,77 @@
+import { z } from "zod";
+const id = z.string().regex(/^[a-z][a-z0-9-]{0,62}$/u);
+const sqlName = z.string().regex(/^[a-z][a-z0-9_]{0,62}$/u).refine((value) => value !== "postgres" && !value.startsWith("pg_"), "Application identifiers must not use PostgreSQL administrative names.");
+const unique = (values) => new Set(values).size === values.length;
+const postgresRequirementSchema = z.object({
+  id,
+  componentId: id,
+  enabled: z.boolean(),
+  supportedMajors: z.array(z.number().int().min(14).max(99)).nonempty().refine(unique),
+  extensions: z.array(sqlName).refine(unique),
+  runtimeConnectionLimit: z.number().int().min(1).max(1e3)
+}).strict();
+const postgresServerSchema = z.object({
+  id,
+  installationId: id,
+  environment: z.enum(["staging", "production"]),
+  mode: z.enum(["shared", "dedicated", "external"]),
+  hostname: z.string().max(253).regex(/^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/u),
+  port: z.number().int().min(1).max(65535),
+  major: z.number().int().min(14).max(99),
+  extensions: z.array(sqlName).refine(unique),
+  tls: z.object({ mode: z.literal("verify-full"), trustReference: id }).strict()
+}).strict();
+const postgresAllocationSchema = z.object({
+  requirementId: id,
+  serverId: id,
+  database: sqlName,
+  ownerRole: sqlName,
+  migrationRole: sqlName,
+  runtimeRole: sqlName,
+  migrationCredentialReference: id,
+  runtimeCredentialReference: id,
+  onDisable: z.literal("preserve")
+}).strict().superRefine((value, context) => {
+  if (!unique([value.ownerRole, value.migrationRole, value.runtimeRole])) context.addIssue({ code: z.ZodIssueCode.custom, message: "Owner, migration and runtime roles must be distinct." });
+  if (value.migrationCredentialReference === value.runtimeCredentialReference) context.addIssue({ code: z.ZodIssueCode.custom, message: "Migration and runtime credentials must be distinct." });
+});
+const postgresTopologySchema = z.object({
+  schemaVersion: z.literal("treeseed.postgres-topology/v1"),
+  installationId: id,
+  environment: z.enum(["staging", "production"]),
+  servers: z.array(postgresServerSchema),
+  requirements: z.array(postgresRequirementSchema),
+  allocations: z.array(postgresAllocationSchema)
+}).strict().superRefine((value, context) => {
+  const fail = (message) => context.addIssue({ code: z.ZodIssueCode.custom, message });
+  if (!unique(value.servers.map((server) => server.id)) || !unique(value.requirements.map((requirement) => requirement.id)) || !unique(value.allocations.map((allocation) => allocation.requirementId))) fail("Server, requirement and allocation identities must be unique.");
+  if (value.servers.filter((server) => server.mode === "shared").length > 1) fail("An environment has at most one default shared server.");
+  if (value.servers.some((server) => server.installationId !== value.installationId || server.environment !== value.environment)) fail("Servers must belong to this installation and environment.");
+  const databases = /* @__PURE__ */ new Set(), roles = /* @__PURE__ */ new Set();
+  for (const allocation of value.allocations) {
+    const server = value.servers.find((entry) => entry.id === allocation.serverId);
+    const requirement = value.requirements.find((entry) => entry.id === allocation.requirementId);
+    if (!server || !requirement) {
+      fail("Allocation references an unknown server or requirement.");
+      continue;
+    }
+    if (!requirement.supportedMajors.includes(server.major) || requirement.extensions.some((extension) => !server.extensions.includes(extension))) fail("Server does not satisfy package version/extension requirements.");
+    const databaseKey = `${server.id}:${allocation.database}`;
+    if (databases.has(databaseKey)) fail("Applications must not share an allocated database.");
+    databases.add(databaseKey);
+    for (const role of [allocation.ownerRole, allocation.migrationRole, allocation.runtimeRole]) {
+      const key = `${server.id}:${role}`;
+      if (roles.has(key)) fail("Applications must not share database roles.");
+      roles.add(key);
+    }
+  }
+  for (const requirement of value.requirements) {
+    if (requirement.enabled && !value.allocations.some((allocation) => allocation.requirementId === requirement.id)) fail("Enabled database requirements need explicit allocations.");
+  }
+});
+export {
+  postgresAllocationSchema,
+  postgresRequirementSchema,
+  postgresServerSchema,
+  postgresTopologySchema
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.100",
+  "version": "0.13.0-rc.101",
   "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
   "license": "Apache-2.0",
   "repository": {