@treeseed/sdk 0.13.0-rc.100 → 0.13.0-rc.102

package/dist/deployment/postgres/contracts.d.ts

@@ -0,0 +1,418 @@
+import { z } from 'zod';
+/** Package-owned requirements, not an instruction to start another server. */
+export declare const postgresRequirementSchema: z.ZodObject<{
+    id: z.ZodString;
+    componentId: z.ZodString;
+    enabled: z.ZodBoolean;
+    supportedMajors: z.ZodEffects<z.ZodArray<z.ZodNumber, "atleastone">, [number, ...number[]], [number, ...number[]]>;
+    extensions: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>;
+    runtimeConnectionLimit: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    componentId: string;
+    enabled: boolean;
+    supportedMajors: [number, ...number[]];
+    extensions: string[];
+    runtimeConnectionLimit: number;
+}, {
+    id: string;
+    componentId: string;
+    enabled: boolean;
+    supportedMajors: [number, ...number[]];
+    extensions: string[];
+    runtimeConnectionLimit: number;
+}>;
+/** Immutable component requirement. Installation activation supplies componentId/enabled. */
+export declare const postgresComponentRequirementSchema: z.ZodObject<Omit<{
+    id: z.ZodString;
+    componentId: z.ZodString;
+    enabled: z.ZodBoolean;
+    supportedMajors: z.ZodEffects<z.ZodArray<z.ZodNumber, "atleastone">, [number, ...number[]], [number, ...number[]]>;
+    extensions: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>;
+    runtimeConnectionLimit: z.ZodNumber;
+}, "componentId" | "enabled">, "strict", z.ZodTypeAny, {
+    id: string;
+    supportedMajors: [number, ...number[]];
+    extensions: string[];
+    runtimeConnectionLimit: number;
+}, {
+    id: string;
+    supportedMajors: [number, ...number[]];
+    extensions: string[];
+    runtimeConnectionLimit: number;
+}>;
+/** Deployment owns the selected server and its bootstrap authority. No credentials here. */
+export declare const postgresServerSchema: z.ZodObject<{
+    id: z.ZodString;
+    installationId: z.ZodString;
+    environment: z.ZodEnum<["staging", "production"]>;
+    mode: z.ZodEnum<["shared", "dedicated", "external"]>;
+    hostname: z.ZodString;
+    port: z.ZodNumber;
+    major: z.ZodNumber;
+    extensions: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>;
+    tls: z.ZodObject<{
+        mode: z.ZodLiteral<"verify-full">;
+        trustReference: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        mode: "verify-full";
+        trustReference: string;
+    }, {
+        mode: "verify-full";
+        trustReference: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    mode: "shared" | "dedicated" | "external";
+    environment: "production" | "staging";
+    port: number;
+    major: number;
+    extensions: string[];
+    installationId: string;
+    hostname: string;
+    tls: {
+        mode: "verify-full";
+        trustReference: string;
+    };
+}, {
+    id: string;
+    mode: "shared" | "dedicated" | "external";
+    environment: "production" | "staging";
+    port: number;
+    major: number;
+    extensions: string[];
+    installationId: string;
+    hostname: string;
+    tls: {
+        mode: "verify-full";
+        trustReference: string;
+    };
+}>;
+export declare const postgresAllocationSchema: z.ZodEffects<z.ZodObject<{
+    requirementId: z.ZodString;
+    serverId: z.ZodString;
+    database: z.ZodEffects<z.ZodString, string, string>;
+    ownerRole: z.ZodEffects<z.ZodString, string, string>;
+    migrationRole: z.ZodEffects<z.ZodString, string, string>;
+    runtimeRole: z.ZodEffects<z.ZodString, string, string>;
+    migrationCredentialReference: z.ZodString;
+    runtimeCredentialReference: z.ZodString;
+    onDisable: z.ZodLiteral<"preserve">;
+}, "strict", z.ZodTypeAny, {
+    requirementId: string;
+    serverId: string;
+    database: string;
+    ownerRole: string;
+    migrationRole: string;
+    runtimeRole: string;
+    migrationCredentialReference: string;
+    runtimeCredentialReference: string;
+    onDisable: "preserve";
+}, {
+    requirementId: string;
+    serverId: string;
+    database: string;
+    ownerRole: string;
+    migrationRole: string;
+    runtimeRole: string;
+    migrationCredentialReference: string;
+    runtimeCredentialReference: string;
+    onDisable: "preserve";
+}>, {
+    requirementId: string;
+    serverId: string;
+    database: string;
+    ownerRole: string;
+    migrationRole: string;
+    runtimeRole: string;
+    migrationCredentialReference: string;
+    runtimeCredentialReference: string;
+    onDisable: "preserve";
+}, {
+    requirementId: string;
+    serverId: string;
+    database: string;
+    ownerRole: string;
+    migrationRole: string;
+    runtimeRole: string;
+    migrationCredentialReference: string;
+    runtimeCredentialReference: string;
+    onDisable: "preserve";
+}>;
+/** One installation/environment. Explicit allocations may select dedicated servers. */
+export declare const postgresTopologySchema: z.ZodEffects<z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.postgres-topology/v1">;
+    installationId: z.ZodString;
+    environment: z.ZodEnum<["staging", "production"]>;
+    servers: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        installationId: z.ZodString;
+        environment: z.ZodEnum<["staging", "production"]>;
+        mode: z.ZodEnum<["shared", "dedicated", "external"]>;
+        hostname: z.ZodString;
+        port: z.ZodNumber;
+        major: z.ZodNumber;
+        extensions: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>;
+        tls: z.ZodObject<{
+            mode: z.ZodLiteral<"verify-full">;
+            trustReference: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            mode: "verify-full";
+            trustReference: string;
+        }, {
+            mode: "verify-full";
+            trustReference: string;
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        mode: "shared" | "dedicated" | "external";
+        environment: "production" | "staging";
+        port: number;
+        major: number;
+        extensions: string[];
+        installationId: string;
+        hostname: string;
+        tls: {
+            mode: "verify-full";
+            trustReference: string;
+        };
+    }, {
+        id: string;
+        mode: "shared" | "dedicated" | "external";
+        environment: "production" | "staging";
+        port: number;
+        major: number;
+        extensions: string[];
+        installationId: string;
+        hostname: string;
+        tls: {
+            mode: "verify-full";
+            trustReference: string;
+        };
+    }>, "many">;
+    requirements: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        componentId: z.ZodString;
+        enabled: z.ZodBoolean;
+        supportedMajors: z.ZodEffects<z.ZodArray<z.ZodNumber, "atleastone">, [number, ...number[]], [number, ...number[]]>;
+        extensions: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>;
+        runtimeConnectionLimit: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        componentId: string;
+        enabled: boolean;
+        supportedMajors: [number, ...number[]];
+        extensions: string[];
+        runtimeConnectionLimit: number;
+    }, {
+        id: string;
+        componentId: string;
+        enabled: boolean;
+        supportedMajors: [number, ...number[]];
+        extensions: string[];
+        runtimeConnectionLimit: number;
+    }>, "many">;
+    allocations: z.ZodArray<z.ZodEffects<z.ZodObject<{
+        requirementId: z.ZodString;
+        serverId: z.ZodString;
+        database: z.ZodEffects<z.ZodString, string, string>;
+        ownerRole: z.ZodEffects<z.ZodString, string, string>;
+        migrationRole: z.ZodEffects<z.ZodString, string, string>;
+        runtimeRole: z.ZodEffects<z.ZodString, string, string>;
+        migrationCredentialReference: z.ZodString;
+        runtimeCredentialReference: z.ZodString;
+        onDisable: z.ZodLiteral<"preserve">;
+    }, "strict", z.ZodTypeAny, {
+        requirementId: string;
+        serverId: string;
+        database: string;
+        ownerRole: string;
+        migrationRole: string;
+        runtimeRole: string;
+        migrationCredentialReference: string;
+        runtimeCredentialReference: string;
+        onDisable: "preserve";
+    }, {
+        requirementId: string;
+        serverId: string;
+        database: string;
+        ownerRole: string;
+        migrationRole: string;
+        runtimeRole: string;
+        migrationCredentialReference: string;
+        runtimeCredentialReference: string;
+        onDisable: "preserve";
+    }>, {
+        requirementId: string;
+        serverId: string;
+        database: string;
+        ownerRole: string;
+        migrationRole: string;
+        runtimeRole: string;
+        migrationCredentialReference: string;
+        runtimeCredentialReference: string;
+        onDisable: "preserve";
+    }, {
+        requirementId: string;
+        serverId: string;
+        database: string;
+        ownerRole: string;
+        migrationRole: string;
+        runtimeRole: string;
+        migrationCredentialReference: string;
+        runtimeCredentialReference: string;
+        onDisable: "preserve";
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.postgres-topology/v1";
+    environment: "production" | "staging";
+    installationId: string;
+    servers: {
+        id: string;
+        mode: "shared" | "dedicated" | "external";
+        environment: "production" | "staging";
+        port: number;
+        major: number;
+        extensions: string[];
+        installationId: string;
+        hostname: string;
+        tls: {
+            mode: "verify-full";
+            trustReference: string;
+        };
+    }[];
+    requirements: {
+        id: string;
+        componentId: string;
+        enabled: boolean;
+        supportedMajors: [number, ...number[]];
+        extensions: string[];
+        runtimeConnectionLimit: number;
+    }[];
+    allocations: {
+        requirementId: string;
+        serverId: string;
+        database: string;
+        ownerRole: string;
+        migrationRole: string;
+        runtimeRole: string;
+        migrationCredentialReference: string;
+        runtimeCredentialReference: string;
+        onDisable: "preserve";
+    }[];
+}, {
+    schemaVersion: "treeseed.postgres-topology/v1";
+    environment: "production" | "staging";
+    installationId: string;
+    servers: {
+        id: string;
+        mode: "shared" | "dedicated" | "external";
+        environment: "production" | "staging";
+        port: number;
+        major: number;
+        extensions: string[];
+        installationId: string;
+        hostname: string;
+        tls: {
+            mode: "verify-full";
+            trustReference: string;
+        };
+    }[];
+    requirements: {
+        id: string;
+        componentId: string;
+        enabled: boolean;
+        supportedMajors: [number, ...number[]];
+        extensions: string[];
+        runtimeConnectionLimit: number;
+    }[];
+    allocations: {
+        requirementId: string;
+        serverId: string;
+        database: string;
+        ownerRole: string;
+        migrationRole: string;
+        runtimeRole: string;
+        migrationCredentialReference: string;
+        runtimeCredentialReference: string;
+        onDisable: "preserve";
+    }[];
+}>, {
+    schemaVersion: "treeseed.postgres-topology/v1";
+    environment: "production" | "staging";
+    installationId: string;
+    servers: {
+        id: string;
+        mode: "shared" | "dedicated" | "external";
+        environment: "production" | "staging";
+        port: number;
+        major: number;
+        extensions: string[];
+        installationId: string;
+        hostname: string;
+        tls: {
+            mode: "verify-full";
+            trustReference: string;
+        };
+    }[];
+    requirements: {
+        id: string;
+        componentId: string;
+        enabled: boolean;
+        supportedMajors: [number, ...number[]];
+        extensions: string[];
+        runtimeConnectionLimit: number;
+    }[];
+    allocations: {
+        requirementId: string;
+        serverId: string;
+        database: string;
+        ownerRole: string;
+        migrationRole: string;
+        runtimeRole: string;
+        migrationCredentialReference: string;
+        runtimeCredentialReference: string;
+        onDisable: "preserve";
+    }[];
+}, {
+    schemaVersion: "treeseed.postgres-topology/v1";
+    environment: "production" | "staging";
+    installationId: string;
+    servers: {
+        id: string;
+        mode: "shared" | "dedicated" | "external";
+        environment: "production" | "staging";
+        port: number;
+        major: number;
+        extensions: string[];
+        installationId: string;
+        hostname: string;
+        tls: {
+            mode: "verify-full";
+            trustReference: string;
+        };
+    }[];
+    requirements: {
+        id: string;
+        componentId: string;
+        enabled: boolean;
+        supportedMajors: [number, ...number[]];
+        extensions: string[];
+        runtimeConnectionLimit: number;
+    }[];
+    allocations: {
+        requirementId: string;
+        serverId: string;
+        database: string;
+        ownerRole: string;
+        migrationRole: string;
+        runtimeRole: string;
+        migrationCredentialReference: string;
+        runtimeCredentialReference: string;
+        onDisable: "preserve";
+    }[];
+}>;
+export type PostgresRequirement = z.infer<typeof postgresRequirementSchema>;
+export type PostgresServer = z.infer<typeof postgresServerSchema>;
+export type PostgresAllocation = z.infer<typeof postgresAllocationSchema>;
+export type PostgresTopology = z.infer<typeof postgresTopologySchema>;

package/dist/deployment/postgres/contracts.js

@@ -0,0 +1,79 @@
+import { z } from "zod";
+const id = z.string().regex(/^[a-z][a-z0-9-]{0,62}$/u);
+const sqlName = z.string().regex(/^[a-z][a-z0-9_]{0,62}$/u).refine((value) => value !== "postgres" && !value.startsWith("pg_"), "Application identifiers must not use PostgreSQL administrative names.");
+const unique = (values) => new Set(values).size === values.length;
+const postgresRequirementSchema = z.object({
+  id,
+  componentId: id,
+  enabled: z.boolean(),
+  supportedMajors: z.array(z.number().int().min(14).max(99)).nonempty().refine(unique),
+  extensions: z.array(sqlName).refine(unique),
+  runtimeConnectionLimit: z.number().int().min(1).max(1e3)
+}).strict();
+const postgresComponentRequirementSchema = postgresRequirementSchema.omit({ componentId: true, enabled: true });
+const postgresServerSchema = z.object({
+  id,
+  installationId: id,
+  environment: z.enum(["staging", "production"]),
+  mode: z.enum(["shared", "dedicated", "external"]),
+  hostname: z.string().max(253).regex(/^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/u),
+  port: z.number().int().min(1).max(65535),
+  major: z.number().int().min(14).max(99),
+  extensions: z.array(sqlName).refine(unique),
+  tls: z.object({ mode: z.literal("verify-full"), trustReference: id }).strict()
+}).strict();
+const postgresAllocationSchema = z.object({
+  requirementId: id,
+  serverId: id,
+  database: sqlName,
+  ownerRole: sqlName,
+  migrationRole: sqlName,
+  runtimeRole: sqlName,
+  migrationCredentialReference: id,
+  runtimeCredentialReference: id,
+  onDisable: z.literal("preserve")
+}).strict().superRefine((value, context) => {
+  if (!unique([value.ownerRole, value.migrationRole, value.runtimeRole])) context.addIssue({ code: z.ZodIssueCode.custom, message: "Owner, migration and runtime roles must be distinct." });
+  if (value.migrationCredentialReference === value.runtimeCredentialReference) context.addIssue({ code: z.ZodIssueCode.custom, message: "Migration and runtime credentials must be distinct." });
+});
+const postgresTopologySchema = z.object({
+  schemaVersion: z.literal("treeseed.postgres-topology/v1"),
+  installationId: id,
+  environment: z.enum(["staging", "production"]),
+  servers: z.array(postgresServerSchema),
+  requirements: z.array(postgresRequirementSchema),
+  allocations: z.array(postgresAllocationSchema)
+}).strict().superRefine((value, context) => {
+  const fail = (message) => context.addIssue({ code: z.ZodIssueCode.custom, message });
+  if (!unique(value.servers.map((server) => server.id)) || !unique(value.requirements.map((requirement) => requirement.id)) || !unique(value.allocations.map((allocation) => allocation.requirementId))) fail("Server, requirement and allocation identities must be unique.");
+  if (value.servers.filter((server) => server.mode === "shared").length > 1) fail("An environment has at most one default shared server.");
+  if (value.servers.some((server) => server.installationId !== value.installationId || server.environment !== value.environment)) fail("Servers must belong to this installation and environment.");
+  const databases = /* @__PURE__ */ new Set(), roles = /* @__PURE__ */ new Set();
+  for (const allocation of value.allocations) {
+    const server = value.servers.find((entry) => entry.id === allocation.serverId);
+    const requirement = value.requirements.find((entry) => entry.id === allocation.requirementId);
+    if (!server || !requirement) {
+      fail("Allocation references an unknown server or requirement.");
+      continue;
+    }
+    if (!requirement.supportedMajors.includes(server.major) || requirement.extensions.some((extension) => !server.extensions.includes(extension))) fail("Server does not satisfy package version/extension requirements.");
+    const databaseKey = `${server.id}:${allocation.database}`;
+    if (databases.has(databaseKey)) fail("Applications must not share an allocated database.");
+    databases.add(databaseKey);
+    for (const role of [allocation.ownerRole, allocation.migrationRole, allocation.runtimeRole]) {
+      const key = `${server.id}:${role}`;
+      if (roles.has(key)) fail("Applications must not share database roles.");
+      roles.add(key);
+    }
+  }
+  for (const requirement of value.requirements) {
+    if (requirement.enabled && !value.allocations.some((allocation) => allocation.requirementId === requirement.id)) fail("Enabled database requirements need explicit allocations.");
+  }
+});
+export {
+  postgresAllocationSchema,
+  postgresComponentRequirementSchema,
+  postgresRequirementSchema,
+  postgresServerSchema,
+  postgresTopologySchema
+};