@treeseed/sdk 0.13.0-rc.102 → 0.13.0-rc.104

package/dist/deployment/schemas.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { AI_MODE_INTERNAL_PATH } from "./ai-mode.js";
-import { postgresComponentRequirementSchema } from "./postgres/contracts.js";
+import { postgresComponentRequirementSchema, postgresTopologySchema } from "./postgres/contracts.js";
 const identifier = z.string().regex(/^[a-z][a-z0-9.-]{1,63}$/u);
 const digest = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
 const gitCommit = z.string().regex(/^[a-f0-9]{40}$/u);
@@ -121,6 +121,7 @@ const hostConfigurationSchema = z.object({
     development: z.object({ pollSeconds: z.literal(60) }).strict()
   }).strict(),
   components: z.record(identifier, hostComponentSchema),
+  postgres: postgresTopologySchema.optional(),
   network: z.object({
     manager: z.object({ binding, aliases: z.array(localAlias).default([]), sans: z.array(z.string().min(1)).default([]), trustedLanCidrs: z.array(z.string().min(1)).default([]) }).strict()
   }).strict(),
@@ -149,7 +150,21 @@ const hostConfigurationSchema = z.object({
     providerVolume: z.object({ encryption: z.literal("luks2"), backingPath: z.string().startsWith("/"), mountPath: z.string().startsWith("/"), sizeBytes: z.number().int().min(1073741824), unlock: z.enum(["tpm2", "systemd-credential"]), recoveryRequired: z.literal(true) }).strict(),
     applicationEncryption: z.object({ provider: z.literal("systemd-credential"), activeKeyVersion: z.number().int().positive(), diagnosticsKeyVersion: z.number().int().positive() }).strict()
   }).strict().optional()
-}).strict();
+}).strict().superRefine((host, context) => {
+  if (!host.postgres) return;
+  const fail = (message) => context.addIssue({ code: z.ZodIssueCode.custom, path: ["postgres"], message });
+  for (const requirement of host.postgres.requirements) {
+    if (!host.components[requirement.componentId] || host.components[requirement.componentId].enabled !== requirement.enabled) fail("Database requirements must match configured component activation.");
+  }
+  for (const allocation of host.postgres.allocations) {
+    if (!host.postgres.requirements.find((item) => item.id === allocation.requirementId)?.enabled) continue;
+    for (const reference of [allocation.migrationCredentialReference, allocation.runtimeCredentialReference]) {
+      if (host.secrets[reference]?.provider !== "systemd-credential" || host.secrets[reference]?.reference !== `/etc/treeseed/credentials/${reference}.cred`) fail("Database credentials require explicit fixed OS custody bindings.");
+    }
+    const server = host.postgres.servers.find((item) => item.id === allocation.serverId);
+    if (server.mode !== "external" && !host.components.postgres?.enabled) fail("Managed database allocations require the PostgreSQL component.");
+  }
+});
 const packageEndpointSchema = z.object({
   id: identifier,
   protocol: z.enum(["http", "https", "tcp"]),
@@ -205,6 +220,12 @@ const packageRuntimeSchema = z.object({
   configuration: componentRuntimeConfigurationSchema,
   // Optional without a default: parsing published artifacts must not change their digest.
   postgresRequirements: z.array(postgresComponentRequirementSchema).max(32).optional(),
+  postgresLifecycle: z.array(z.object({
+    requirementId: identifier,
+    credentialOwner: z.object({ uid: z.number().int().min(0).max(65535), gid: z.number().int().min(0).max(65535) }).strict(),
+    migration: z.object({ composeService: identifier, completion: z.enum(["exit-zero", "healthy-stop"]), timeoutSeconds: z.number().int().min(1).max(3600) }).strict(),
+    runtimeServices: z.array(identifier).min(1).max(128)
+  }).strict()).max(32).optional(),
   services: z.array(z.object({ id: identifier, composeService: identifier, endpoints: z.array(packageEndpointSchema) }).strict()).min(1),
   stateVolumes: z.array(z.object({ id: identifier, volume: z.string().min(1), backup: z.enum(["required", "optional", "none"]) }).strict()),
   migrations: z.array(z.object({ id: identifier, order: z.number().int().nonnegative(), backupRequired: z.boolean() }).strict()),
@@ -236,6 +257,15 @@ const packageRuntimeSchema = z.object({
 }).strict().superRefine((runtime, context) => {
   const requirements = runtime.postgresRequirements ?? [];
   if (new Set(requirements.map(({ id }) => id)).size !== requirements.length) context.addIssue({ code: z.ZodIssueCode.custom, path: ["postgresRequirements"], message: "PostgreSQL requirement identities must be unique within a component." });
+  const lifecycles = runtime.postgresLifecycle ?? [];
+  const lifecycleFailure = () => context.addIssue({ code: z.ZodIssueCode.custom, path: ["postgresLifecycle"], message: "Each database requirement needs a distinct declared migration service and explicit runtime services." });
+  if (lifecycles.length !== requirements.length || new Set(lifecycles.map((item) => item.requirementId)).size !== lifecycles.length) lifecycleFailure();
+  const composeServices = new Set(runtime.services.map((item) => item.composeService));
+  const migrationServices = new Set(lifecycles.map((item) => item.migration.composeService));
+  if (migrationServices.size !== lifecycles.length) lifecycleFailure();
+  for (const item of lifecycles) {
+    if (!requirements.some((requirement) => requirement.id === item.requirementId) || !composeServices.has(item.migration.composeService) || new Set(item.runtimeServices).size !== item.runtimeServices.length || item.runtimeServices.some((service) => !composeServices.has(service) || migrationServices.has(service))) lifecycleFailure();
+  }
   const endpointIds = runtime.services.flatMap((service) => service.endpoints.map((endpoint) => `${service.id}.${endpoint.id}`));
   if (new Set(endpointIds).size !== endpointIds.length) context.addIssue({ code: z.ZodIssueCode.custom, path: ["services"], message: "Endpoint identities must be unique within a component." });
   for (const file of runtime.configuration.files) if (!file.path.startsWith(`/etc/treeseed/components/${runtime.componentId}/`)) context.addIssue({ code: z.ZodIssueCode.custom, path: ["configuration", "files"], message: `Configuration file ${file.id} is outside component ${runtime.componentId} custody.` });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.102",
+  "version": "0.13.0-rc.104",
   "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
   "license": "Apache-2.0",
   "repository": {