@treeseed/sdk 0.13.0-rc.102 → 0.13.0-rc.103

package/dist/.treeseed-build-complete.json

@@ -1 +1 @@
-{"completedAt":"2026-09-09T05:56:47.945Z"}
+{"completedAt":"2026-09-09T06:37:08.486Z"}

package/dist/deployment/index.d.ts

@@ -1,5 +1,6 @@
 export * from './schemas.js';
 export * from './postgres/contracts.js';
+export * from './postgres/requirements.js';
 export * from './canonical.js';
 export * from './catalog.js';
 export * from './topology.js';

package/dist/deployment/index.js

@@ -1,5 +1,6 @@
 export * from "./schemas.js";
 export * from "./postgres/contracts.js";
+export * from "./postgres/requirements.js";
 export * from "./canonical.js";
 export * from "./catalog.js";
 export * from "./topology.js";

package/dist/deployment/postgres/contracts.js

@@ -48,7 +48,7 @@ const postgresTopologySchema = z.object({
   if (!unique(value.servers.map((server) => server.id)) || !unique(value.requirements.map((requirement) => requirement.id)) || !unique(value.allocations.map((allocation) => allocation.requirementId))) fail("Server, requirement and allocation identities must be unique.");
   if (value.servers.filter((server) => server.mode === "shared").length > 1) fail("An environment has at most one default shared server.");
   if (value.servers.some((server) => server.installationId !== value.installationId || server.environment !== value.environment)) fail("Servers must belong to this installation and environment.");
-  const databases = /* @__PURE__ */ new Set(), roles = /* @__PURE__ */ new Set();
+  const databases = /* @__PURE__ */ new Set(), roles = /* @__PURE__ */ new Set(), credentials = /* @__PURE__ */ new Set();
   for (const allocation of value.allocations) {
     const server = value.servers.find((entry) => entry.id === allocation.serverId);
     const requirement = value.requirements.find((entry) => entry.id === allocation.requirementId);
@@ -60,6 +60,10 @@ const postgresTopologySchema = z.object({
     const databaseKey = `${server.id}:${allocation.database}`;
     if (databases.has(databaseKey)) fail("Applications must not share an allocated database.");
     databases.add(databaseKey);
+    for (const reference of [allocation.migrationCredentialReference, allocation.runtimeCredentialReference]) {
+      if (credentials.has(reference)) fail("Applications must not share database credential references.");
+      credentials.add(reference);
+    }
     for (const role of [allocation.ownerRole, allocation.migrationRole, allocation.runtimeRole]) {
       const key = `${server.id}:${role}`;
       if (roles.has(key)) fail("Applications must not share database roles.");

package/dist/deployment/postgres/requirements.d.ts

@@ -0,0 +1,14 @@
+/** Call after artifact authenticity verification, with the complete selected
+ * component inventory. Host configuration cannot weaken a package requirement.
+ */
+export declare function verifyHostPostgresRequirements(hostInput: unknown, releaseInputs: unknown[]): {
+    verified: true;
+    requirements: {
+        id: string;
+        componentId: string;
+        enabled: boolean;
+        supportedMajors: [number, ...number[]];
+        extensions: string[];
+        runtimeConnectionLimit: number;
+    }[];
+};

package/dist/deployment/postgres/requirements.js

@@ -0,0 +1,30 @@
+import { componentReleaseSchema, hostConfigurationSchema } from "../schemas.js";
+import { canonicalDeploymentJson, deploymentDigest } from "../canonical.js";
+function verifyHostPostgresRequirements(hostInput, releaseInputs) {
+  const host = hostConfigurationSchema.parse(hostInput);
+  const releases = releaseInputs.map((input) => componentReleaseSchema.parse(input));
+  if (new Set(releases.map((item) => item.componentId)).size !== releases.length) throw new Error("Duplicate component release inventory");
+  if (Object.entries(host.components).some(([id, selection]) => selection.enabled && !releases.some((release) => release.componentId === id))) throw new Error("Selected component release inventory is incomplete");
+  const requirements = [];
+  for (const release of releases) {
+    const selection = host.components[release.componentId];
+    if (!selection) continue;
+    if (deploymentDigest(release.runtime) !== release.runtimeDigest) throw new Error("Component runtime digest mismatch");
+    for (const requirement of release.runtime.postgresRequirements ?? []) requirements.push({
+      ...requirement,
+      componentId: release.componentId,
+      enabled: selection.enabled
+    });
+  }
+  if (new Set(requirements.map((item) => item.id)).size !== requirements.length) throw new Error("Component database requirement identities collide");
+  const normalize = (items) => items.map((item) => ({
+    ...item,
+    supportedMajors: [...item.supportedMajors].sort((a, b) => a - b),
+    extensions: [...item.extensions].sort()
+  })).sort((a, b) => a.id.localeCompare(b.id));
+  if (canonicalDeploymentJson(normalize(requirements)) !== canonicalDeploymentJson(normalize(host.postgres?.requirements ?? []))) throw new Error("Host database requirements differ from selected immutable components");
+  return { verified: true, requirements };
+}
+export {
+  verifyHostPostgresRequirements
+};

package/dist/deployment/schemas.d.ts

@@ -552,7 +552,7 @@ export declare const hostComponentSchema: z.ZodObject<{
         };
     }> | undefined;
 }>;
-export declare const hostConfigurationSchema: z.ZodObject<{
+export declare const hostConfigurationSchema: z.ZodEffects<z.ZodObject<{
     schemaVersion: z.ZodLiteral<"treeseed.host/v1">;
     configurationId: z.ZodString;
     generation: z.ZodNumber;
@@ -908,6 +908,278 @@ export declare const hostConfigurationSchema: z.ZodObject<{
             };
         }> | undefined;
     }>>;
+    postgres: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        schemaVersion: z.ZodLiteral<"treeseed.postgres-topology/v1">;
+        installationId: z.ZodString;
+        environment: z.ZodEnum<["staging", "production"]>;
+        servers: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            installationId: z.ZodString;
+            environment: z.ZodEnum<["staging", "production"]>;
+            mode: z.ZodEnum<["shared", "dedicated", "external"]>;
+            hostname: z.ZodString;
+            port: z.ZodNumber;
+            major: z.ZodNumber;
+            extensions: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>;
+            tls: z.ZodObject<{
+                mode: z.ZodLiteral<"verify-full">;
+                trustReference: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                mode: "verify-full";
+                trustReference: string;
+            }, {
+                mode: "verify-full";
+                trustReference: string;
+            }>;
+        }, "strict", z.ZodTypeAny, {
+            id: string;
+            mode: "shared" | "dedicated" | "external";
+            environment: "production" | "staging";
+            port: number;
+            major: number;
+            extensions: string[];
+            installationId: string;
+            hostname: string;
+            tls: {
+                mode: "verify-full";
+                trustReference: string;
+            };
+        }, {
+            id: string;
+            mode: "shared" | "dedicated" | "external";
+            environment: "production" | "staging";
+            port: number;
+            major: number;
+            extensions: string[];
+            installationId: string;
+            hostname: string;
+            tls: {
+                mode: "verify-full";
+                trustReference: string;
+            };
+        }>, "many">;
+        requirements: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            componentId: z.ZodString;
+            enabled: z.ZodBoolean;
+            supportedMajors: z.ZodEffects<z.ZodArray<z.ZodNumber, "atleastone">, [number, ...number[]], [number, ...number[]]>;
+            extensions: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>;
+            runtimeConnectionLimit: z.ZodNumber;
+        }, "strict", z.ZodTypeAny, {
+            id: string;
+            componentId: string;
+            enabled: boolean;
+            supportedMajors: [number, ...number[]];
+            extensions: string[];
+            runtimeConnectionLimit: number;
+        }, {
+            id: string;
+            componentId: string;
+            enabled: boolean;
+            supportedMajors: [number, ...number[]];
+            extensions: string[];
+            runtimeConnectionLimit: number;
+        }>, "many">;
+        allocations: z.ZodArray<z.ZodEffects<z.ZodObject<{
+            requirementId: z.ZodString;
+            serverId: z.ZodString;
+            database: z.ZodEffects<z.ZodString, string, string>;
+            ownerRole: z.ZodEffects<z.ZodString, string, string>;
+            migrationRole: z.ZodEffects<z.ZodString, string, string>;
+            runtimeRole: z.ZodEffects<z.ZodString, string, string>;
+            migrationCredentialReference: z.ZodString;
+            runtimeCredentialReference: z.ZodString;
+            onDisable: z.ZodLiteral<"preserve">;
+        }, "strict", z.ZodTypeAny, {
+            requirementId: string;
+            serverId: string;
+            database: string;
+            ownerRole: string;
+            migrationRole: string;
+            runtimeRole: string;
+            migrationCredentialReference: string;
+            runtimeCredentialReference: string;
+            onDisable: "preserve";
+        }, {
+            requirementId: string;
+            serverId: string;
+            database: string;
+            ownerRole: string;
+            migrationRole: string;
+            runtimeRole: string;
+            migrationCredentialReference: string;
+            runtimeCredentialReference: string;
+            onDisable: "preserve";
+        }>, {
+            requirementId: string;
+            serverId: string;
+            database: string;
+            ownerRole: string;
+            migrationRole: string;
+            runtimeRole: string;
+            migrationCredentialReference: string;
+            runtimeCredentialReference: string;
+            onDisable: "preserve";
+        }, {
+            requirementId: string;
+            serverId: string;
+            database: string;
+            ownerRole: string;
+            migrationRole: string;
+            runtimeRole: string;
+            migrationCredentialReference: string;
+            runtimeCredentialReference: string;
+            onDisable: "preserve";
+        }>, "many">;
+    }, "strict", z.ZodTypeAny, {
+        schemaVersion: "treeseed.postgres-topology/v1";
+        environment: "production" | "staging";
+        installationId: string;
+        servers: {
+            id: string;
+            mode: "shared" | "dedicated" | "external";
+            environment: "production" | "staging";
+            port: number;
+            major: number;
+            extensions: string[];
+            installationId: string;
+            hostname: string;
+            tls: {
+                mode: "verify-full";
+                trustReference: string;
+            };
+        }[];
+        requirements: {
+            id: string;
+            componentId: string;
+            enabled: boolean;
+            supportedMajors: [number, ...number[]];
+            extensions: string[];
+            runtimeConnectionLimit: number;
+        }[];
+        allocations: {
+            requirementId: string;
+            serverId: string;
+            database: string;
+            ownerRole: string;
+            migrationRole: string;
+            runtimeRole: string;
+            migrationCredentialReference: string;
+            runtimeCredentialReference: string;
+            onDisable: "preserve";
+        }[];
+    }, {
+        schemaVersion: "treeseed.postgres-topology/v1";
+        environment: "production" | "staging";
+        installationId: string;
+        servers: {
+            id: string;
+            mode: "shared" | "dedicated" | "external";
+            environment: "production" | "staging";
+            port: number;
+            major: number;
+            extensions: string[];
+            installationId: string;
+            hostname: string;
+            tls: {
+                mode: "verify-full";
+                trustReference: string;
+            };
+        }[];
+        requirements: {
+            id: string;
+            componentId: string;
+            enabled: boolean;
+            supportedMajors: [number, ...number[]];
+            extensions: string[];
+            runtimeConnectionLimit: number;
+        }[];
+        allocations: {
+            requirementId: string;
+            serverId: string;
+            database: string;
+            ownerRole: string;
+            migrationRole: string;
+            runtimeRole: string;
+            migrationCredentialReference: string;
+            runtimeCredentialReference: string;
+            onDisable: "preserve";
+        }[];
+    }>, {
+        schemaVersion: "treeseed.postgres-topology/v1";
+        environment: "production" | "staging";
+        installationId: string;
+        servers: {
+            id: string;
+            mode: "shared" | "dedicated" | "external";
+            environment: "production" | "staging";
+            port: number;
+            major: number;
+            extensions: string[];
+            installationId: string;
+            hostname: string;
+            tls: {
+                mode: "verify-full";
+                trustReference: string;
+            };
+        }[];
+        requirements: {
+            id: string;
+            componentId: string;
+            enabled: boolean;
+            supportedMajors: [number, ...number[]];
+            extensions: string[];
+            runtimeConnectionLimit: number;
+        }[];
+        allocations: {
+            requirementId: string;
+            serverId: string;
+            database: string;
+            ownerRole: string;
+            migrationRole: string;
+            runtimeRole: string;
+            migrationCredentialReference: string;
+            runtimeCredentialReference: string;
+            onDisable: "preserve";
+        }[];
+    }, {
+        schemaVersion: "treeseed.postgres-topology/v1";
+        environment: "production" | "staging";
+        installationId: string;
+        servers: {
+            id: string;
+            mode: "shared" | "dedicated" | "external";
+            environment: "production" | "staging";
+            port: number;
+            major: number;
+            extensions: string[];
+            installationId: string;
+            hostname: string;
+            tls: {
+                mode: "verify-full";
+                trustReference: string;
+            };
+        }[];
+        requirements: {
+            id: string;
+            componentId: string;
+            enabled: boolean;
+            supportedMajors: [number, ...number[]];
+            extensions: string[];
+            runtimeConnectionLimit: number;
+        }[];
+        allocations: {
+            requirementId: string;
+            serverId: string;
+            database: string;
+            ownerRole: string;
+            migrationRole: string;
+            runtimeRole: string;
+            migrationCredentialReference: string;
+            runtimeCredentialReference: string;
+            onDisable: "preserve";
+        }[];
+    }>>;
     network: z.ZodObject<{
         manager: z.ZodObject<{
             binding: z.ZodString;
@@ -1556,6 +1828,400 @@ export declare const hostConfigurationSchema: z.ZodObject<{
         provider: "file" | "systemd-credential";
         reference: string;
     }>;
+    postgres?: {
+        schemaVersion: "treeseed.postgres-topology/v1";
+        environment: "production" | "staging";
+        installationId: string;
+        servers: {
+            id: string;
+            mode: "shared" | "dedicated" | "external";
+            environment: "production" | "staging";
+            port: number;
+            major: number;
+            extensions: string[];
+            installationId: string;
+            hostname: string;
+            tls: {
+                mode: "verify-full";
+                trustReference: string;
+            };
+        }[];
+        requirements: {
+            id: string;
+            componentId: string;
+            enabled: boolean;
+            supportedMajors: [number, ...number[]];
+            extensions: string[];
+            runtimeConnectionLimit: number;
+        }[];
+        allocations: {
+            requirementId: string;
+            serverId: string;
+            database: string;
+            ownerRole: string;
+            migrationRole: string;
+            runtimeRole: string;
+            migrationCredentialReference: string;
+            runtimeCredentialReference: string;
+            onDisable: "preserve";
+        }[];
+    } | undefined;
+    security?: {
+        sandbox: {
+            runtime: "kata-runtime-rs-qemu";
+            profiles: {
+                id: string;
+                guestImage: string;
+                guestImageDigest: string;
+            }[];
+            required: boolean;
+            brokerSocket: string;
+            modelGateway: {
+                provider: "openai";
+                upstreamBaseUrl: "https://api.openai.com";
+                allowedModels: string[];
+            };
+        };
+        providerVolume: {
+            encryption: "luks2";
+            backingPath: string;
+            mountPath: string;
+            sizeBytes: number;
+            unlock: "systemd-credential" | "tpm2";
+            recoveryRequired: true;
+        };
+        applicationEncryption: {
+            provider: "systemd-credential";
+            activeKeyVersion: number;
+            diagnosticsKeyVersion: number;
+        };
+    } | undefined;
+}, {
+    schemaVersion: "treeseed.host/v1";
+    runtime: {
+        management: "external" | "managed";
+        environment?: "development" | "production" | undefined;
+        dataRoot?: string | undefined;
+    };
+    components: Record<string, {
+        enabled: boolean;
+        track: "development" | "stable";
+        resources?: {
+            cpuCores?: number | undefined;
+            memoryBytes?: number | undefined;
+            storageBytes?: number | undefined;
+            gpuDevices?: string[] | undefined;
+        } | undefined;
+        profile?: string | undefined;
+        aliases?: Record<string, string> | undefined;
+        configuration?: Record<string, unknown> | undefined;
+        connections?: Record<string, {
+            kind: "local";
+            componentId: string;
+            serviceId: string;
+            endpointId: string;
+        } | {
+            kind: "remote";
+            audience: string;
+            url: string;
+            authentication: {
+                mode: "none" | "application" | "mtls" | "bearer";
+                secretRef?: string | undefined;
+            };
+            tls: {
+                trust: "secret" | "system" | "spki";
+                serverName?: string | undefined;
+                caSecretRef?: string | undefined;
+                spkiSha256?: string | undefined;
+            };
+            healthGate: {
+                timeoutSeconds: number;
+                protocol: "http" | "tcp" | "https";
+                path?: string | undefined;
+            };
+        }> | undefined;
+    }>;
+    network: {
+        manager: {
+            binding: string;
+            aliases?: string[] | undefined;
+            sans?: string[] | undefined;
+            trustedLanCidrs?: string[] | undefined;
+        };
+    };
+    host: {
+        id: string;
+        role: string;
+        architecture: "amd64";
+    };
+    generation: number;
+    configurationId: string;
+    updates: {
+        development: {
+            pollSeconds: 60;
+        };
+        stable: {
+            metadataPollSeconds: number;
+            maintenanceWindow: {
+                weekday: "monday" | "tuesday" | "wednesday" | "thursday" | "friday" | "saturday" | "sunday";
+                localTime: string;
+                jitterMinutes: number;
+            };
+        };
+        defaultTrack: "development" | "stable";
+    };
+    fleet: {
+        rolloutGroup: string;
+        receiptReporting: {
+            enabled: boolean;
+            intervalSeconds: number;
+            connection?: {
+                kind: "local";
+                componentId: string;
+                serviceId: string;
+                endpointId: string;
+            } | {
+                kind: "remote";
+                audience: string;
+                url: string;
+                authentication: {
+                    mode: "none" | "application" | "mtls" | "bearer";
+                    secretRef?: string | undefined;
+                };
+                tls: {
+                    trust: "secret" | "system" | "spki";
+                    serverName?: string | undefined;
+                    caSecretRef?: string | undefined;
+                    spkiSha256?: string | undefined;
+                };
+                healthGate: {
+                    timeoutSeconds: number;
+                    protocol: "http" | "tcp" | "https";
+                    path?: string | undefined;
+                };
+            } | undefined;
+        };
+    };
+    secrets: Record<string, {
+        provider: "file" | "systemd-credential";
+        reference: string;
+    }>;
+    postgres?: {
+        schemaVersion: "treeseed.postgres-topology/v1";
+        environment: "production" | "staging";
+        installationId: string;
+        servers: {
+            id: string;
+            mode: "shared" | "dedicated" | "external";
+            environment: "production" | "staging";
+            port: number;
+            major: number;
+            extensions: string[];
+            installationId: string;
+            hostname: string;
+            tls: {
+                mode: "verify-full";
+                trustReference: string;
+            };
+        }[];
+        requirements: {
+            id: string;
+            componentId: string;
+            enabled: boolean;
+            supportedMajors: [number, ...number[]];
+            extensions: string[];
+            runtimeConnectionLimit: number;
+        }[];
+        allocations: {
+            requirementId: string;
+            serverId: string;
+            database: string;
+            ownerRole: string;
+            migrationRole: string;
+            runtimeRole: string;
+            migrationCredentialReference: string;
+            runtimeCredentialReference: string;
+            onDisable: "preserve";
+        }[];
+    } | undefined;
+    security?: {
+        sandbox: {
+            runtime: "kata-runtime-rs-qemu";
+            profiles: {
+                id: string;
+                guestImage: string;
+                guestImageDigest: string;
+            }[];
+            required: boolean;
+            brokerSocket: string;
+            modelGateway: {
+                provider: "openai";
+                upstreamBaseUrl: "https://api.openai.com";
+                allowedModels: string[];
+            };
+        };
+        providerVolume: {
+            encryption: "luks2";
+            backingPath: string;
+            mountPath: string;
+            sizeBytes: number;
+            unlock: "systemd-credential" | "tpm2";
+            recoveryRequired: true;
+        };
+        applicationEncryption: {
+            provider: "systemd-credential";
+            activeKeyVersion: number;
+            diagnosticsKeyVersion: number;
+        };
+    } | undefined;
+}>, {
+    schemaVersion: "treeseed.host/v1";
+    runtime: {
+        environment: "development" | "production";
+        management: "external" | "managed";
+        dataRoot?: string | undefined;
+    };
+    components: Record<string, {
+        resources: {
+            gpuDevices: string[];
+            cpuCores?: number | undefined;
+            memoryBytes?: number | undefined;
+            storageBytes?: number | undefined;
+        };
+        enabled: boolean;
+        track: "development" | "stable";
+        aliases: Record<string, string>;
+        configuration: Record<string, unknown>;
+        connections: Record<string, {
+            kind: "local";
+            componentId: string;
+            serviceId: string;
+            endpointId: string;
+        } | {
+            kind: "remote";
+            audience: string;
+            url: string;
+            authentication: {
+                mode: "none" | "application" | "mtls" | "bearer";
+                secretRef?: string | undefined;
+            };
+            tls: {
+                trust: "secret" | "system" | "spki";
+                serverName?: string | undefined;
+                caSecretRef?: string | undefined;
+                spkiSha256?: string | undefined;
+            };
+            healthGate: {
+                timeoutSeconds: number;
+                protocol: "http" | "tcp" | "https";
+                path?: string | undefined;
+            };
+        }>;
+        profile?: string | undefined;
+    }>;
+    network: {
+        manager: {
+            aliases: string[];
+            binding: string;
+            sans: string[];
+            trustedLanCidrs: string[];
+        };
+    };
+    host: {
+        id: string;
+        role: string;
+        architecture: "amd64";
+    };
+    generation: number;
+    configurationId: string;
+    updates: {
+        development: {
+            pollSeconds: 60;
+        };
+        stable: {
+            metadataPollSeconds: number;
+            maintenanceWindow: {
+                weekday: "monday" | "tuesday" | "wednesday" | "thursday" | "friday" | "saturday" | "sunday";
+                localTime: string;
+                jitterMinutes: number;
+            };
+        };
+        defaultTrack: "development" | "stable";
+    };
+    fleet: {
+        rolloutGroup: string;
+        receiptReporting: {
+            enabled: boolean;
+            intervalSeconds: number;
+            connection?: {
+                kind: "local";
+                componentId: string;
+                serviceId: string;
+                endpointId: string;
+            } | {
+                kind: "remote";
+                audience: string;
+                url: string;
+                authentication: {
+                    mode: "none" | "application" | "mtls" | "bearer";
+                    secretRef?: string | undefined;
+                };
+                tls: {
+                    trust: "secret" | "system" | "spki";
+                    serverName?: string | undefined;
+                    caSecretRef?: string | undefined;
+                    spkiSha256?: string | undefined;
+                };
+                healthGate: {
+                    timeoutSeconds: number;
+                    protocol: "http" | "tcp" | "https";
+                    path?: string | undefined;
+                };
+            } | undefined;
+        };
+    };
+    secrets: Record<string, {
+        provider: "file" | "systemd-credential";
+        reference: string;
+    }>;
+    postgres?: {
+        schemaVersion: "treeseed.postgres-topology/v1";
+        environment: "production" | "staging";
+        installationId: string;
+        servers: {
+            id: string;
+            mode: "shared" | "dedicated" | "external";
+            environment: "production" | "staging";
+            port: number;
+            major: number;
+            extensions: string[];
+            installationId: string;
+            hostname: string;
+            tls: {
+                mode: "verify-full";
+                trustReference: string;
+            };
+        }[];
+        requirements: {
+            id: string;
+            componentId: string;
+            enabled: boolean;
+            supportedMajors: [number, ...number[]];
+            extensions: string[];
+            runtimeConnectionLimit: number;
+        }[];
+        allocations: {
+            requirementId: string;
+            serverId: string;
+            database: string;
+            ownerRole: string;
+            migrationRole: string;
+            runtimeRole: string;
+            migrationCredentialReference: string;
+            runtimeCredentialReference: string;
+            onDisable: "preserve";
+        }[];
+    } | undefined;
     security?: {
         sandbox: {
             runtime: "kata-runtime-rs-qemu";
@@ -1696,6 +2362,44 @@ export declare const hostConfigurationSchema: z.ZodObject<{
         provider: "file" | "systemd-credential";
         reference: string;
     }>;
+    postgres?: {
+        schemaVersion: "treeseed.postgres-topology/v1";
+        environment: "production" | "staging";
+        installationId: string;
+        servers: {
+            id: string;
+            mode: "shared" | "dedicated" | "external";
+            environment: "production" | "staging";
+            port: number;
+            major: number;
+            extensions: string[];
+            installationId: string;
+            hostname: string;
+            tls: {
+                mode: "verify-full";
+                trustReference: string;
+            };
+        }[];
+        requirements: {
+            id: string;
+            componentId: string;
+            enabled: boolean;
+            supportedMajors: [number, ...number[]];
+            extensions: string[];
+            runtimeConnectionLimit: number;
+        }[];
+        allocations: {
+            requirementId: string;
+            serverId: string;
+            database: string;
+            ownerRole: string;
+            migrationRole: string;
+            runtimeRole: string;
+            migrationCredentialReference: string;
+            runtimeCredentialReference: string;
+            onDisable: "preserve";
+        }[];
+    } | undefined;
     security?: {
         sandbox: {
             runtime: "kata-runtime-rs-qemu";

package/dist/deployment/schemas.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { AI_MODE_INTERNAL_PATH } from "./ai-mode.js";
-import { postgresComponentRequirementSchema } from "./postgres/contracts.js";
+import { postgresComponentRequirementSchema, postgresTopologySchema } from "./postgres/contracts.js";
 const identifier = z.string().regex(/^[a-z][a-z0-9.-]{1,63}$/u);
 const digest = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
 const gitCommit = z.string().regex(/^[a-f0-9]{40}$/u);
@@ -121,6 +121,7 @@ const hostConfigurationSchema = z.object({
     development: z.object({ pollSeconds: z.literal(60) }).strict()
   }).strict(),
   components: z.record(identifier, hostComponentSchema),
+  postgres: postgresTopologySchema.optional(),
   network: z.object({
     manager: z.object({ binding, aliases: z.array(localAlias).default([]), sans: z.array(z.string().min(1)).default([]), trustedLanCidrs: z.array(z.string().min(1)).default([]) }).strict()
   }).strict(),
@@ -149,7 +150,21 @@ const hostConfigurationSchema = z.object({
     providerVolume: z.object({ encryption: z.literal("luks2"), backingPath: z.string().startsWith("/"), mountPath: z.string().startsWith("/"), sizeBytes: z.number().int().min(1073741824), unlock: z.enum(["tpm2", "systemd-credential"]), recoveryRequired: z.literal(true) }).strict(),
     applicationEncryption: z.object({ provider: z.literal("systemd-credential"), activeKeyVersion: z.number().int().positive(), diagnosticsKeyVersion: z.number().int().positive() }).strict()
   }).strict().optional()
-}).strict();
+}).strict().superRefine((host, context) => {
+  if (!host.postgres) return;
+  const fail = (message) => context.addIssue({ code: z.ZodIssueCode.custom, path: ["postgres"], message });
+  for (const requirement of host.postgres.requirements) {
+    if (!host.components[requirement.componentId] || host.components[requirement.componentId].enabled !== requirement.enabled) fail("Database requirements must match configured component activation.");
+  }
+  for (const allocation of host.postgres.allocations) {
+    if (!host.postgres.requirements.find((item) => item.id === allocation.requirementId)?.enabled) continue;
+    for (const reference of [allocation.migrationCredentialReference, allocation.runtimeCredentialReference]) {
+      if (host.secrets[reference]?.provider !== "systemd-credential" || host.secrets[reference]?.reference !== `/etc/treeseed/credentials/${reference}.cred`) fail("Database credentials require explicit fixed OS custody bindings.");
+    }
+    const server = host.postgres.servers.find((item) => item.id === allocation.serverId);
+    if (server.mode !== "external" && !host.components.postgres?.enabled) fail("Managed database allocations require the PostgreSQL component.");
+  }
+});
 const packageEndpointSchema = z.object({
   id: identifier,
   protocol: z.enum(["http", "https", "tcp"]),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.102",
+  "version": "0.13.0-rc.103",
   "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
   "license": "Apache-2.0",
   "repository": {