sea-dev 1.0.0

package/docs/widget-ng-apf-packaging-spec.md

@@ -0,0 +1,43 @@
+# @sea-dev/widget-ng Packaging & SSR Hardening
+
+## Summary
+- Deliver Angular Package Format output for `@sea-dev/widget-ng` via `ng-packagr`.
+- Raise the peer dependency floor to Angular 17+ to match the block template syntax already in use.
+- Fix SSR readiness gaps in `SeaPdfViewerComponent` by guarding browser‑only APIs.
+
+## Background
+- The previous build pipeline ran plain `tsc`, emitting ESM artifacts without Angular partial compilation metadata.
+- Consumers embedding the widget into Angular CLI builds hit compatibility issues (AOT/SSR/JIT regressions).
+- Labeled “SSR ready”, yet `SeaPdfViewerComponent` accessed `window`/`document` unguarded, crashing Angular Universal.
+- The README advertised Angular 16 compatibility despite the template syntax requiring Angular 17+.
+
+## Scope
+- Library build change (ng-packagr configuration and new `tsconfig.lib.json`).
+- Peer dependency updates and documentation alignment.
+- Runtime guards for browser-only functionality in the PDF viewer.
+- Lockfile refresh stemming from package installation.
+
+## Out of Scope
+- Any breaking API changes in the widget surface.
+- Style customization API (`./styles` secondary entry) – simply removed because the target file did not exist.
+- Additional testing or CI wiring for publishing.
+
+## Decisions
+1. Use `ng-packagr` with a top-level script (`pnpm --filter @sea-dev/widget-ng build`) to emit APF bundles.
+2. Include `tslib` as a runtime dependency; keep all other Angular packages as peers.
+3. Require Angular 17+ explicitly in peer deps and README.
+4. Remove the `exports["./styles"]` path rather than shipping a synthetic stylesheet.
+5. Inject `PLATFORM_ID` / `DOCUMENT` and guard DOM access in `SeaPdfViewerComponent`.
+
+## Risks / Mitigations
+- **Risk:** Consumers depending on the old `./styles` path will fail to resolve it.  
+  **Mitigation:** Documented removal; provide alternative guidance if requests arise.
+- **Risk:** Build pipeline now depends on `ng-packagr`; missing install will break `build` script.  
+  **Mitigation:** Added dependency and lockfile entry; ensure CI installs workspace dependencies.
+- **Risk:** SSR guard regressions due to missed browser-only APIs elsewhere.  
+  **Mitigation:** Performed targeted audit of PDF viewer; future passes may be needed for other components.
+
+## Follow-up Tasks
+- [ ] Communicate Angular 17+ requirement to integration partners.
+- [ ] Add CI step to run `pnpm --filter @sea-dev/widget-ng build` to catch regressions.
+- [ ] Consider publishing guidance for style overrides (since the `./styles` entry was removed).

package/infra/k8s/charts/seadotdev/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: seadotdev
+description: sea.dev application suite
+type: application
+version: 0.1.0
+appVersion: "1.0.0"

package/infra/k8s/charts/seadotdev/templates/_helpers.tpl

@@ -0,0 +1,27 @@
+{{/*
+Common labels applied to all resources
+*/}}
+{{- define "seadotdev.labels" -}}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+app.kubernetes.io/part-of: seadotdev
+helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+{{- end }}
+
+{{/*
+Selector labels for a specific component
+*/}}
+{{- define "seadotdev.selectorLabels" -}}
+app.kubernetes.io/name: {{ .name }}
+app.kubernetes.io/instance: {{ .release }}
+{{- end }}
+
+{{/*
+Full image reference: registry/repository:tag
+*/}}
+{{- define "seadotdev.image" -}}
+{{- if .global.registry -}}
+{{ .global.registry }}/{{ .repository }}:{{ .tag | default .global.imageTag }}
+{{- else -}}
+{{ .repository }}:{{ .tag | default .global.imageTag }}
+{{- end -}}
+{{- end }}

package/infra/k8s/charts/seadotdev/templates/api-v2.yaml

@@ -0,0 +1,105 @@
+{{- if .Values.apiV2.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: api-v2
+  labels:
+    {{- include "seadotdev.labels" . | nindent 4 }}
+    app.kubernetes.io/name: api-v2
+spec:
+  {{- if not .Values.apiV2.autoscaling.enabled }}
+  replicas: {{ .Values.apiV2.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: api-v2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: api-v2
+        {{- include "seadotdev.labels" . | nindent 8 }}
+    spec:
+      containers:
+        - name: api-v2
+          image: {{ include "seadotdev.image" (dict "global" .Values.global "repository" .Values.apiV2.image.repository) }}
+          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+          ports:
+            - containerPort: {{ .Values.apiV2.port }}
+              protocol: TCP
+          envFrom:
+            - secretRef:
+                name: seadotdev-app-secrets
+          env:
+            - name: NODE_ENV
+              value: production
+            - name: PORT
+              value: "{{ .Values.apiV2.port }}"
+            - name: HOST
+              value: "0.0.0.0"
+          resources:
+            {{- toYaml .Values.apiV2.resources | nindent 12 }}
+          livenessProbe:
+            httpGet:
+              path: {{ .Values.apiV2.healthCheckPath }}
+              port: {{ .Values.apiV2.port }}
+            initialDelaySeconds: 15
+            periodSeconds: 15
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.apiV2.healthCheckPath }}
+              port: {{ .Values.apiV2.port }}
+            initialDelaySeconds: 5
+            periodSeconds: 5
+      terminationGracePeriodSeconds: 30
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: api-v2
+  labels:
+    {{- include "seadotdev.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+    - port: {{ .Values.apiV2.port }}
+      targetPort: {{ .Values.apiV2.port }}
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: api-v2
+---
+{{- if .Values.apiV2.autoscaling.enabled }}
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: api-v2
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: api-v2
+  minReplicas: {{ .Values.apiV2.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.apiV2.autoscaling.maxReplicas }}
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.apiV2.autoscaling.targetCPU }}
+{{- end }}
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: api-v2
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: api-v2
+{{- end }}

package/infra/k8s/charts/seadotdev/templates/external-secrets.yaml

@@ -0,0 +1,83 @@
+{{/*
+ExternalSecret — pulls secrets from the cloud-specific backend
+and creates a K8s Secret that all pods reference.
+When switching clouds, update the SecretStore — pods don't change.
+*/}}
+apiVersion: external-secrets.io/v1beta1
+kind: SecretStore
+metadata:
+  name: seadotdev-secrets
+  labels:
+    {{- include "seadotdev.labels" . | nindent 4 }}
+spec:
+  {{- if eq .Values.global.secretsBackend "aws" }}
+  provider:
+    aws:
+      service: SecretsManager
+      region: eu-central-1
+  {{- else if eq .Values.global.secretsBackend "gcp" }}
+  provider:
+    gcpsm:
+      projectID: seadotdev-app
+  {{- else if eq .Values.global.secretsBackend "vault" }}
+  provider:
+    vault:
+      server: "https://vault.internal:8200"
+      path: "secret"
+      auth:
+        kubernetes:
+          mountPath: "kubernetes"
+          role: "seadotdev"
+  {{- end }}
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: seadotdev-app-secrets
+  labels:
+    {{- include "seadotdev.labels" . | nindent 4 }}
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: seadotdev-secrets
+    kind: SecretStore
+  target:
+    name: seadotdev-app-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: DATABASE_URL
+      remoteRef:
+        key: seadotdev/DATABASE_URL
+    - secretKey: DATABASE_URL_STAGING
+      remoteRef:
+        key: seadotdev/DATABASE_URL_STAGING
+    - secretKey: BETTER_AUTH_SECRET
+      remoteRef:
+        key: seadotdev/BETTER_AUTH_SECRET
+    - secretKey: ANTHROPIC_API_KEY
+      remoteRef:
+        key: seadotdev/ANTHROPIC_API_KEY
+    - secretKey: OPENAI_API_KEY
+      remoteRef:
+        key: seadotdev/OPENAI_API_KEY
+    - secretKey: HATCHET_CLIENT_TOKEN
+      remoteRef:
+        key: seadotdev/HATCHET_CLIENT_TOKEN
+    - secretKey: GOOGLE_GENERATIVE_AI_API_KEY
+      remoteRef:
+        key: seadotdev/GOOGLE_GENERATIVE_AI_API_KEY
+    - secretKey: AZURE_STORAGE_KEY
+      remoteRef:
+        key: seadotdev/AZURE_STORAGE_KEY
+    - secretKey: AZURE_DOCUMENT_AI_SECRET
+      remoteRef:
+        key: seadotdev/AZURE_DOCUMENT_AI_SECRET
+    - secretKey: POLAR_ACCESS_TOKEN
+      remoteRef:
+        key: seadotdev/POLAR_ACCESS_TOKEN
+    - secretKey: POLAR_WEBHOOK_SECRET
+      remoteRef:
+        key: seadotdev/POLAR_WEBHOOK_SECRET
+    - secretKey: ENCRYPTION_KEYS
+      remoteRef:
+        key: seadotdev/ENCRYPTION_KEYS

package/infra/k8s/charts/seadotdev/templates/ingress.yaml

@@ -0,0 +1,54 @@
+{{/*
+Ingress — uses ingress-nginx (portable across all K8s clusters).
+cert-manager handles TLS via Let's Encrypt.
+*/}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: seadotdev
+  labels:
+    {{- include "seadotdev.labels" . | nindent 4 }}
+  annotations:
+    {{- if .Values.ingress.tls.enabled }}
+    cert-manager.io/cluster-issuer: {{ .Values.ingress.tls.clusterIssuer }}
+    {{- end }}
+    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "120"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "120"
+    {{- with .Values.ingress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- if .Values.ingress.tls.enabled }}
+  tls:
+    - hosts:
+        - {{ .Values.global.domain }}
+        - {{ .Values.global.apiDomain }}
+      secretName: seadotdev-tls
+  {{- end }}
+  rules:
+    {{- if .Values.mainApp.enabled }}
+    - host: {{ .Values.mainApp.ingress.host | default .Values.global.domain }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: main-app
+                port:
+                  number: {{ .Values.mainApp.port }}
+    {{- end }}
+    {{- if .Values.apiV2.enabled }}
+    - host: {{ .Values.apiV2.ingress.host | default .Values.global.apiDomain }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: api-v2
+                port:
+                  number: {{ .Values.apiV2.port }}
+    {{- end }}

package/infra/k8s/charts/seadotdev/templates/main-app.yaml

@@ -0,0 +1,104 @@
+{{- if .Values.mainApp.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: main-app
+  labels:
+    {{- include "seadotdev.labels" . | nindent 4 }}
+    app.kubernetes.io/name: main-app
+spec:
+  {{- if not .Values.mainApp.autoscaling.enabled }}
+  replicas: {{ .Values.mainApp.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: main-app
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: main-app
+        {{- include "seadotdev.labels" . | nindent 8 }}
+    spec:
+      containers:
+        - name: main-app
+          image: {{ include "seadotdev.image" (dict "global" .Values.global "repository" .Values.mainApp.image.repository) }}
+          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+          ports:
+            - containerPort: {{ .Values.mainApp.port }}
+              protocol: TCP
+          envFrom:
+            - secretRef:
+                name: seadotdev-app-secrets
+          env:
+            - name: NODE_ENV
+              value: production
+            - name: PORT
+              value: "{{ .Values.mainApp.port }}"
+          resources:
+            {{- toYaml .Values.mainApp.resources | nindent 12 }}
+          livenessProbe:
+            httpGet:
+              path: /
+              port: {{ .Values.mainApp.port }}
+            initialDelaySeconds: 30
+            periodSeconds: 15
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /
+              port: {{ .Values.mainApp.port }}
+            initialDelaySeconds: 10
+            periodSeconds: 5
+      terminationGracePeriodSeconds: 30
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: main-app
+  labels:
+    {{- include "seadotdev.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+    - port: {{ .Values.mainApp.port }}
+      targetPort: {{ .Values.mainApp.port }}
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: main-app
+---
+{{- if .Values.mainApp.autoscaling.enabled }}
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: main-app
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: main-app
+  minReplicas: {{ .Values.mainApp.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.mainApp.autoscaling.maxReplicas }}
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.mainApp.autoscaling.targetCPU }}
+{{- end }}
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: main-app
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: main-app
+{{- end }}

package/infra/k8s/charts/seadotdev/templates/workers.yaml

@@ -0,0 +1,182 @@
+{{/*
+Workers — no ingress, no service (they pull from Hatchet).
+KEDA handles scale-to-zero autoscaling.
+*/}}
+
+{{- if .Values.extractionWorker.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: extraction-worker
+  labels:
+    {{- include "seadotdev.labels" . | nindent 4 }}
+    app.kubernetes.io/name: extraction-worker
+spec:
+  {{- if not .Values.extractionWorker.autoscaling.enabled }}
+  replicas: {{ .Values.extractionWorker.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: extraction-worker
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: extraction-worker
+        {{- include "seadotdev.labels" . | nindent 8 }}
+    spec:
+      containers:
+        - name: extraction-worker
+          image: {{ include "seadotdev.image" (dict "global" .Values.global "repository" .Values.extractionWorker.image.repository) }}
+          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+          {{- if .Values.extractionWorker.command }}
+          command:
+            {{- toYaml .Values.extractionWorker.command | nindent 12 }}
+          {{- end }}
+          envFrom:
+            - secretRef:
+                name: seadotdev-app-secrets
+          env:
+            - name: NODE_ENV
+              value: production
+          resources:
+            {{- toYaml .Values.extractionWorker.resources | nindent 12 }}
+      terminationGracePeriodSeconds: 120  # Allow in-flight tasks to finish
+---
+{{- if and .Values.extractionWorker.autoscaling.enabled .Values.extractionWorker.autoscaling.keda.enabled }}
+apiVersion: keda.sh/v1alpha1
+kind: ScaledObject
+metadata:
+  name: extraction-worker
+spec:
+  scaleTargetRef:
+    name: extraction-worker
+  pollingInterval: {{ .Values.extractionWorker.autoscaling.keda.pollingInterval }}
+  cooldownPeriod: {{ .Values.extractionWorker.autoscaling.keda.cooldownPeriod }}
+  minReplicaCount: {{ .Values.extractionWorker.autoscaling.minReplicas }}
+  maxReplicaCount: {{ .Values.extractionWorker.autoscaling.maxReplicas }}
+  triggers:
+    # CPU-based fallback — replace with Hatchet queue metric when available
+    - type: cpu
+      metadata:
+        type: Utilization
+        value: "70"
+{{- end }}
+{{- end }}
+
+---
+
+{{- if .Values.extractionWorkerAgentic.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: extraction-worker-agentic
+  labels:
+    {{- include "seadotdev.labels" . | nindent 4 }}
+    app.kubernetes.io/name: extraction-worker-agentic
+spec:
+  {{- if not .Values.extractionWorkerAgentic.autoscaling.enabled }}
+  replicas: {{ .Values.extractionWorkerAgentic.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: extraction-worker-agentic
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: extraction-worker-agentic
+        {{- include "seadotdev.labels" . | nindent 8 }}
+    spec:
+      containers:
+        - name: extraction-worker-agentic
+          image: {{ include "seadotdev.image" (dict "global" .Values.global "repository" .Values.extractionWorkerAgentic.image.repository) }}
+          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+          {{- if .Values.extractionWorkerAgentic.command }}
+          command:
+            {{- toYaml .Values.extractionWorkerAgentic.command | nindent 12 }}
+          {{- end }}
+          envFrom:
+            - secretRef:
+                name: seadotdev-app-secrets
+          env:
+            - name: NODE_ENV
+              value: production
+          resources:
+            {{- toYaml .Values.extractionWorkerAgentic.resources | nindent 12 }}
+      terminationGracePeriodSeconds: 120
+---
+{{- if and .Values.extractionWorkerAgentic.autoscaling.enabled .Values.extractionWorkerAgentic.autoscaling.keda.enabled }}
+apiVersion: keda.sh/v1alpha1
+kind: ScaledObject
+metadata:
+  name: extraction-worker-agentic
+spec:
+  scaleTargetRef:
+    name: extraction-worker-agentic
+  pollingInterval: {{ .Values.extractionWorkerAgentic.autoscaling.keda.pollingInterval }}
+  cooldownPeriod: {{ .Values.extractionWorkerAgentic.autoscaling.keda.cooldownPeriod }}
+  minReplicaCount: {{ .Values.extractionWorkerAgentic.autoscaling.minReplicas }}
+  maxReplicaCount: {{ .Values.extractionWorkerAgentic.autoscaling.maxReplicas }}
+  triggers:
+    - type: cpu
+      metadata:
+        type: Utilization
+        value: "70"
+{{- end }}
+{{- end }}
+
+---
+
+{{- if .Values.conversionWorker.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: conversion-worker
+  labels:
+    {{- include "seadotdev.labels" . | nindent 4 }}
+    app.kubernetes.io/name: conversion-worker
+spec:
+  {{- if not .Values.conversionWorker.autoscaling.enabled }}
+  replicas: {{ .Values.conversionWorker.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: conversion-worker
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: conversion-worker
+        {{- include "seadotdev.labels" . | nindent 8 }}
+    spec:
+      containers:
+        - name: conversion-worker
+          image: {{ include "seadotdev.image" (dict "global" .Values.global "repository" .Values.conversionWorker.image.repository) }}
+          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+          envFrom:
+            - secretRef:
+                name: seadotdev-app-secrets
+          env:
+            - name: NODE_ENV
+              value: production
+          resources:
+            {{- toYaml .Values.conversionWorker.resources | nindent 12 }}
+      terminationGracePeriodSeconds: 60
+---
+{{- if and .Values.conversionWorker.autoscaling.enabled .Values.conversionWorker.autoscaling.keda.enabled }}
+apiVersion: keda.sh/v1alpha1
+kind: ScaledObject
+metadata:
+  name: conversion-worker
+spec:
+  scaleTargetRef:
+    name: conversion-worker
+  pollingInterval: {{ .Values.conversionWorker.autoscaling.keda.pollingInterval }}
+  cooldownPeriod: {{ .Values.conversionWorker.autoscaling.keda.cooldownPeriod }}
+  minReplicaCount: {{ .Values.conversionWorker.autoscaling.minReplicas }}
+  maxReplicaCount: {{ .Values.conversionWorker.autoscaling.maxReplicas }}
+  triggers:
+    - type: cpu
+      metadata:
+        type: Utilization
+        value: "70"
+{{- end }}
+{{- end }}