feat(sdl): preserve TEE param through builder round-trip

[baktun14]

Refs CON-463

Problem

The SDL builder's form model only mirrors a subset of service params (just permissions). Switching from the YAML editor to the SDL builder and back dropped params.tee — the TEE / confidential-compute field. Users authoring tee in YAML lost it the moment they touched the visual builder.

Fix

Round-trip params.tee through the builder without exposing it in the form UI (which doesn't support editing it yet):

• sdlBuilder.ts — add tee: "cpu" | "cpu-gpu" to the params zod schema, and make permissions optional so a tee-only service still validates.
• sdlImport.ts — capture svc.params.tee onto the service model on import.
• sdlGenerator.ts — re-emit params.tee on generate, merged with any existing params (e.g. log-collector permissions).

The builder UI is untouched — tee is preserved invisibly.

Tests

Added test-first (TDD); new specs:

• generator emits tee (standalone, and merged alongside log-collector permissions)
• import captures tee onto the service model
• no-tee baseline leaves params undefined
• full import → regenerate round-trip preserves tee

All sdl/builder specs green (63 passing). eslint clean; tsc introduces no new errors (the repo's pre-existing 87 unrelated errors in auth/api-keys specs are unchanged).

Note

This mirrors the same fix landed on the console-air fork.

Summary by CodeRabbit

• New Features
  • Added an optional TEE (Trusted Execution Environment) parameter for services, supporting CPU and CPU-GPU modes.
  • Made service permissions optional to allow more flexible service configuration.
• Improved SDL Handling
  • SDL import/export now preserves TEE (and existing params) across round-trips, including when permissions are present.
• Tests
  • Added unit test coverage for SDL import and regeneration behavior related to params.tee.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds params.tee ("cpu" | "cpu-gpu") as a pass-through field in the SDL builder. The Zod schema gains the optional tee enum and makes permissions optional. Import copies svc.params.tee onto the service model; generator writes it back into the output SDL params. Tests cover import, roundtrip, and merge with log-collector permissions.

Changes

TEE param round-trip through SDL builder

Layer / File(s)	Summary
ServiceSchema tee field and optional permissions apps/deploy-web/src/types/sdlBuilder/sdlBuilder.ts	Adds optional tee: z.enum(["cpu", "cpu-gpu"]) to params and makes permissions optional.
Import and generator tee preservation apps/deploy-web/src/utils/sdl/sdlImport.ts, apps/deploy-web/src/utils/sdl/sdlGenerator.ts	importSimpleSdl copies svc.params?.tee onto the service model; generateSdl merges service.params.tee into the output SDL params object alongside any existing fields.
Import and generator tee tests apps/deploy-web/src/utils/sdl/sdlImport.spec.ts, apps/deploy-web/src/utils/sdl/sdlGenerator.spec.ts	Adds teeSdl(tee) helper and tests for tee import, absent-tee → undefined params, full roundtrip preservation, and tee+permissions co-existence in generated SDL.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested reviewers

• stalniy

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/sdl-preserve-tee-param

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.24%. Comparing base (60fd607) to head (58464dc).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3345      +/-   ##
==========================================
- Coverage   69.63%   68.24%   -1.39%     
==========================================
  Files        1088      998      -90     
  Lines       26660    24337    -2323     
  Branches     6414     5952     -462     
==========================================
- Hits        18564    16610    -1954     
+ Misses       7106     6769     -337     
+ Partials      990      958      -32     

Flag	Coverage Δ		*Carryforward flag
api	84.98% <ø> (ø)		Carriedforward from 60fd607
deploy-web	55.21% <ø> (ø)		Carriedforward from 60fd607
log-collector	?
notifications	91.44% <ø> (ø)		Carriedforward from 60fd607
provider-console	81.38% <ø> (ø)		Carriedforward from 60fd607
provider-inventory	?
provider-proxy	86.26% <ø> (ø)		Carriedforward from 60fd607
tx-signer	?

*This pull request uses carry forward flags. Click here to find out more.

Files with missing lines	Coverage Δ
apps/deploy-web/src/types/sdlBuilder/sdlBuilder.ts	54.34% <ø> (ø)
apps/deploy-web/src/utils/sdl/sdlGenerator.ts	57.54% <ø> (ø)
apps/deploy-web/src/utils/sdl/sdlImport.ts	84.95% <ø> (ø)

... and 90 files with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/deploy-web/src/utils/sdl/sdlImport.spec.ts`:
- Line 216: The roundtrip test contains multiple declarations of the variable
`const parsed` in the same scope, causing TypeScript redeclaration errors.
Locate all instances of `const parsed` declarations in the test block around
line 216 and rename the duplicate declarations to have unique variable names
that reflect what each one is parsing (for example, use different names like
`const parsedRegenerated` or `const parsedOriginal` to distinguish between
different yaml.load calls). This will resolve the compilation error while
maintaining code clarity.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 0771b2f6-7255-4a14-9c0e-8636561b297c

📥 Commits

Reviewing files that changed from the base of the PR and between 92d0d0d and 58464dc.

📒 Files selected for processing (5)

• apps/deploy-web/src/types/sdlBuilder/sdlBuilder.ts
• apps/deploy-web/src/utils/sdl/sdlGenerator.spec.ts
• apps/deploy-web/src/utils/sdl/sdlGenerator.ts
• apps/deploy-web/src/utils/sdl/sdlImport.spec.ts
• apps/deploy-web/src/utils/sdl/sdlImport.ts

🚧 Files skipped from review as they are similar to previous changes (4)

• apps/deploy-web/src/utils/sdl/sdlGenerator.ts
• apps/deploy-web/src/types/sdlBuilder/sdlBuilder.ts
• apps/deploy-web/src/utils/sdl/sdlGenerator.spec.ts
• apps/deploy-web/src/utils/sdl/sdlImport.ts