feat(ddl): publish systemplane schema + default seed as importable artifacts

[jeffersonrodrigues92]

What

Expose the canonical systemplane DDL and a universal default seed from the importable root package (github.com/LerianStudio/lib-systemplane, package systemplane) so consumers can fold systemplane schema provisioning into their own migration pipelines (e.g. a consumer's make systemplane-ddl copying the artifacts into migrations/), instead of relying on the lib's runtime runSchema.

Public API (stable contract — consumers code against these exact names)

In package systemplane (repo root):

• func SchemaSQL() string — full schema DDL.
• func DefaultSeedSQL() string — universal default seed INSERTs.

Both are backed by //go:embed of ddl/schema.sql and ddl/default_seed.sql.

Artifacts

ddl/schema.sql

Byte-faithful to the runtime DDL emitted by internal/postgres/postgres_schema.go and internal/manager/schema.go, with the table fixed to systemplane_entries and the NOTIFY channel fixed to systemplane_changes (the Manager's defaultChannel). The published artifact is static — no table/channel placeholders. It contains, in order:

1. CREATE TABLE IF NOT EXISTS systemplane_entries (...)
2. CREATE OR REPLACE FUNCTION systemplane_notify_v3() — byte-copied as-is, not modified/upgraded.
3. DROP TRIGGER IF EXISTS + CREATE TRIGGER systemplane_notify_trigger AFTER INSERT OR DELETE ... and systemplane_notify_update_trigger AFTER UPDATE ... WHEN (OLD IS DISTINCT FROM NEW).

ddl/default_seed.sql

Universal neutral baseline for namespace runtime_config, INSERT ... ON CONFLICT (namespace, "key") DO NOTHING. JSONB encoding matches the lib's runtime seedDefaults (json.Marshal).

Drift prevention

Chose the consistency test (the documented fallback), not a runtime refactor. Reason: the runtime runSchema in both internal/postgres and internal/manager parameterizes table/channel via fmt.Sprintf and carries #nosec identifier-validation invariants; rendering those two paths from a single static embed would be invasive and would force placeholder logic back into a deliberately-static artifact. Instead, ddl_test.go asserts the embedded ddl/schema.sql contains every canonical fragment the runtime emits, so a future runtime DDL change forces the embed to be updated in lock-step.

Debatable universal default-seed values — please review

These become every consumer's default, so flagging the judgment calls:

• rate_limit.enabled = false — seeded off as a neutral universal default. A consumer that expects rate limiting on by default would need to override.
• cors.allowed_origins = "" — intentionally empty/neutral (no dev origin baked in).
• cors.allowed_methods = "GET,POST,PUT,PATCH,DELETE,OPTIONS" and cors.allowed_headers = "Origin,Content-Type,Accept,Authorization" — reasonable defaults but opinionated; confirm the exact method/header lists.
• Other seeded values: app.log_level="info", rate_limit.max=100, rate_limit.expiry_sec=60, idempotency.require_redis=false, idempotency.duplicate_guard_ttl_seconds=300.

Verification

• go build ./... — green
• go vet ./... — green
• go test -tags=unit ./... — green (206 passed)
• golangci-lint run --build-tags unit ./... — no issues

Note

No tag created/pushed — the human tags the beta after approval.

🤖 Generated with Claude Code

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: a0aea65f-cf92-4509-9a8f-582151450ef3

📥 Commits

Reviewing files that changed from the base of the PR and between 6a6eee9 and b186679.

📒 Files selected for processing (5)

• CHANGELOG.md
• ddl.go
• ddl/default_seed.sql
• ddl/schema.sql
• ddl_test.go

---

Walkthrough

This PR exports canonical, embedded SQL artifacts (systemplane_entries schema DDL and default runtime_config seed data) to downstream consumers via two new public Go functions: SchemaSQL() and DefaultSeedSQL(). A comprehensive test suite validates that the embedded SQL contains expected fragments, and a changelog entry documents the feature.

Changes

Canonical SQL DDL and Seed Artifacts

Layer / File(s)	Summary
Database schema and notification mechanism ddl/schema.sql	Defines the systemplane_entries table with composite primary key (namespace, "key"), JSONB value storage, and audit columns. Implements systemplane_notify_v3() PL/pgSQL trigger function that emits structured JSON payloads via PostgreSQL pg_notify on the fixed systemplane_changes channel. Two idempotent triggers (INSERT/DELETE and UPDATE-with-change-detection) invoke the notification function.
Default runtime_config seed ddl/default_seed.sql	Seeds neutral baseline configuration keys (logging, CORS, rate limiting, Redis guards) into the runtime_config namespace with audit metadata. Uses ON CONFLICT (namespace, "key") DO NOTHING to preserve operator-configured values on re-application.
Embedded SQL accessor functions ddl.go	Embeds ddl/schema.sql and ddl/default_seed.sql using //go:embed. Exports SchemaSQL() and DefaultSeedSQL() functions that return the embedded SQL strings as strings for consumption by downstream migration and seeding pipelines.
SQL artifact validation tests ddl_test.go	Validates that SchemaSQL() and DefaultSeedSQL() return non-empty strings and contain all expected canonical SQL fragments (table definition, triggers, INSERT statements, conflict resolution clauses) via substring assertion.
Changelog documentation CHANGELOG.md	Documents the new SchemaSQL() and DefaultSeedSQL() exported functions, embedding sources, static identifiers, and test coverage.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[lerian-studio]

🔍 PR Validation Summary

🚫 PR Blocked — 1 blocking failure

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	❌ failure	yes
PR Description	✅ success	yes
PR Size	⏭️ skipped	no
Auto Labels	⏭️ skipped	no
PR Metadata	⏭️ skipped	no

Fix the blocking checks above before merge.

---

_{🔍 View workflow run}

[lerian-studio]

🔒 Security Scan Results — lib-systemplane

✅ PR Mergeable — no blocking findings

Stage	Status	Blocking?
Filesystem Scan	✅ Clean	—
Docker Image Scan	➖ Skipped	—
Docker Hub Health Score	➖ Skipped	—
Pre-release Version Check	✅ Clean	—

Trivy

Filesystem Scan

✅ No vulnerabilities or secrets found.

---

Pre-release Version Check

✅ No unstable version pins found.

---

_{🔍 View full scan logs}

[lerian-studio]

📊 Unit Test Coverage Report: app

Metric	Value
Overall Coverage	80.6% ✅ PASS
Threshold	80%

Coverage by Package

Package	Coverage
github.com/LerianStudio/lib-systemplane/admin	88.4%
github.com/LerianStudio/lib-systemplane/internal/client	80.7%
github.com/LerianStudio/lib-systemplane/internal/debounce	73.1%
github.com/LerianStudio/lib-systemplane/internal/manager	87.4%
github.com/LerianStudio/lib-systemplane/internal/mongodb	97.5%
github.com/LerianStudio/lib-systemplane/internal/postgres	100.0%
github.com/LerianStudio/lib-systemplane	94.8%

---

Generated by Go PR Analysis workflow