salmon-ops-0.3.0.0: CHANGELOG.md

# Revision history for salmon-ops

## 0.3.0.0 -- 2026-10-31

Breaking: `Salmon.Builtin.CommandLine`'s `RunServe` constructor gained fields (start-up
options, `--once`, `--linger`) and `ReportFormat` gained a constructor (`ReportTextJsonLog`).
Requires `salmon-core ^>=0.1.0.0` (unchanged).

Packaging: every external dependency now carries a PVP upper bound (`^>=` the version built on
GHC 9.10.3; `base` keeps its range).

`run serve`:

* `--once` ends the loop after the first convergence pass and exits with its verdict (0 only
  when the pass converged with nothing left); it starts with supervision off. `--linger SECONDS`
  keeps `--listen`/`--http`/`--http-tcp` answering reads from the final world that long after.
  In the library: `Serve.Ending` (`UntilQuit` | `AfterFirstPass`) and `serveSayingEnding`;
  existing entry points keep `UntilQuit`.
* `--json-log FILE`: the text reports on the terminal as before, plus the objects `--json`
  would print appended to FILE, one per line. Excludes `--json`.
* `--no-supervise` and `--up-directive FILE` run `supervise off` and `up-directive FILE` as
  the loop's first commands, ahead of any other input, so a loop started by a unit file needs
  nothing typed. `Serve.linesProducer` and `Serve.quoteArg` are exported for the same purpose.

New builtins:

* `ClickHouse`: the official image as a system-scope quadlet with watched `config.d`/`users.d`
  drop-ins; `CREATE DATABASE IF NOT EXISTS`, users whose password is a pre-provisioned file,
  database-level grants checked on `system.grants`, and `sourceReadGrant` (`GRANT READ ON S3`)
  for PeerDB. Nothing drops or revokes.
* `Postgres.Logical`: the prerequisites of logical replication (`wal_level = logical`, the
  `REPLICATION` attribute, a publication of exactly the declared tables, a `pgoutput` slot),
  each with a check and no down.
* `PeerDB`: Postgres and ClickHouse peers and CDC mirrors through PeerDB's flow API. A mirror
  that exists with other peers or tables, or has failed, is refused, never changed or recreated;
  nothing is dropped.

## 0.2.0.0 -- 2026-10-23

Breaking: several exported records gained or changed fields (e.g. `Gcp.Compute`'s instance,
`Client.Model`'s model) and some exported functions changed signature. Requires
`salmon-core ^>=0.1.0.0` (unchanged).

Packaging: a manual `http-server` flag (default on). `constraints: salmon-ops -http-server`
builds the library without `Salmon.Actions.Serve.Http` and without warp, warp-tls and wai, for a
binary that never serves HTTP; `run serve` then refuses `--http`/`--http-tcp`. The listener
configuration (`Bind`, `TlsBind`, `SessionPolicy`, `readTokenFile`) is now defined in
`Salmon.Actions.Serve.HttpBind` and still re-exported by `Salmon.Actions.Serve.Http`.

New builtins:

* `Podman.Quadlet`: containers as systemd services (bind volumes, `UserNS=keep-id`, readiness
  wait, registry login from a GCE instance, container jobs); `Systemd.Job`: oneshot units, timers
  and a node reading how the last run went.
* Postgres high availability: `Patroni`, `PgBackRest` (archive, PITR, replica method),
  `Haproxy` routing to the leader by health check, `Etcd` join phase.
* `PgTextSearch`, `ClipCpp` (embeddings for pgvector), `Plakar` integrations and GCS store.
* `LlamaServer.llamaEmbed`: one text's vector from a running llama-server, for a loader.
* `SecretDelivery` (a pre-provisioned secret onto a machine), `Deferred` (a sub-graph built at
  `up` from a value read then), `Netbird` peer enrolment, `PortMapping` (UPnP-IGD via `upnpc`),
  `Rsync.receiveDir`.
* GCP: `Gcp.CloudDns` (managed zones; A, AAAA, CNAME, TXT, MX record sets); the load balancer
  as one node per resource (HTTPS proxy, managed and replaceable certificates, host/path rules,
  backend buckets, redirects, path rewrites, removal of what is no longer declared);
  `Gcp.Storage` bucket IAM, lifecycle, website settings and published directories;
  `Gcp.Compute` pinned internal address, access scopes, machine-type resize, run limit;
  `Gcp.Core` declared gcloud account; Cloud Run min instances and always-allocated CPU.
* `Salmon.Builtin.Guarded` / `Salmon.Op.Guard`: guarded risky operations (preconditions in
  `check`, park on failure, hold siblings).

Behaviour:

* Processes started for a node no longer inherit the pass's standard input.
* `Binary`: choose where a command's stdout/stderr go, with per-node log lines
  (`Salmon.Builtin.NodeLog`); `Ssh`/`Self` follow a remote call's output and reports.
* `Dag.foldDag` visits each node once instead of each occurrence.
* `Query`/`serve`: paths are matched, never listed; a retraction redescribes nothing.
* Web UI: compact DAG layout, `/history` timeline, `Conflicting` pairs side by side.
* Web UI: an optional Tramaj card template per node (`withCardTemplate`), served on `/dag` as
  `template` and drawn in place of the default card; presentation only, not part of the
  representative.
* `Builtin.Cards`: opt-in card templates for `filecontents`, `dir`, `systemdService` and
  Postgres `database` (`withCard (Cards.fileContents path) op`); no builtin attaches one itself.

## 0.1.0.0 -- 2026-10-01

* First release.