@celilo/cli 0.8.2 → 0.9.1

package/src/services/programmatic-responder.aspect.test.ts

@@ -0,0 +1,157 @@
+/**
+ * Regression: the programmatic responder (`celilo events respond`) must handle
+ * `aspect.required.*` so a HEADLESS deploy of a module with a base_module_aspect
+ * can be approved without a TTY.
+ *
+ * Before the fix it watched only config/secret/ensure/interview — never aspect —
+ * so a headless deploy whose aspect consent wasn't pre-recorded emitted
+ * `aspect.required.<m>.<role>` and hung forever (busInterview uses timeoutMs:0;
+ * no responder ever replied). This reproduced the ISS-0156 cutover hang and is
+ * the core of #262.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { defineEvents, openBus } from '@celilo/event-bus';
+import { closeDb, getDb } from '../db/client';
+import { runMigrations } from '../db/migrate';
+import { type AspectRequiredPayload, EVENT_TYPES } from './bus-interview';
+import { startProgrammaticResponder } from './programmatic-responder';
+
+const NO_SCHEMAS = defineEvents({});
+
+const ASPECT_PAYLOAD: AspectRequiredPayload = {
+  module: 'technitium',
+  role: 'dns-client-config',
+  zones: ['dmz', 'app', 'secure', 'internal'],
+  triggers: ['on_install'],
+  trigger: 'on_install',
+  reason: 'no_approval',
+};
+
+/** Emit the aspect-consent query and return the responder's decision, or null. */
+async function askAspectConsent(
+  busPath: string,
+  module: string,
+  role: string,
+  payload: AspectRequiredPayload,
+): Promise<boolean | null> {
+  const bus = openBus({ dbPath: busPath, events: NO_SCHEMAS });
+  try {
+    const replies = await bus.query(
+      EVENT_TYPES.aspectRequired(module, role) as never,
+      payload as never,
+      {
+        timeoutMs: 3000,
+        pollIntervalMs: 100,
+        expect: 'first',
+      },
+    );
+    if (replies.length === 0) return null;
+    return (replies[0].payload as { consented?: boolean }).consented ?? null;
+  } finally {
+    bus.close();
+  }
+}
+
+describe('programmatic responder — aspect.required consent (#262)', () => {
+  let dir: string;
+  let busPath: string;
+  let db: ReturnType<typeof getDb>;
+
+  beforeEach(async () => {
+    dir = mkdtempSync(join(tmpdir(), 'celilo-resp-aspect-'));
+    process.env.CELILO_DB_PATH = join(dir, 'celilo.db');
+    busPath = join(dir, 'bus.db');
+    await runMigrations(process.env.CELILO_DB_PATH);
+    db = getDb();
+  });
+
+  afterEach(() => {
+    closeDb();
+    rmSync(dir, { recursive: true, force: true });
+    process.env.CELILO_DB_PATH = undefined;
+  });
+
+  it('approves (consented=true) when the policy approves the module', async () => {
+    const handle = startProgrammaticResponder({
+      busDbPath: busPath,
+      db,
+      onMissing: 'skip',
+      values: { aspects: { technitium: true } },
+    });
+    try {
+      const decision = await askAspectConsent(
+        busPath,
+        'technitium',
+        'dns-client-config',
+        ASPECT_PAYLOAD,
+      );
+      expect(decision).toBe(true);
+    } finally {
+      handle.close();
+    }
+  });
+
+  it("approves via the '*' wildcard policy", async () => {
+    const handle = startProgrammaticResponder({
+      busDbPath: busPath,
+      db,
+      onMissing: 'skip',
+      values: { aspects: { '*': true } },
+    });
+    try {
+      const decision = await askAspectConsent(
+        busPath,
+        'technitium',
+        'dns-client-config',
+        ASPECT_PAYLOAD,
+      );
+      expect(decision).toBe(true);
+    } finally {
+      handle.close();
+    }
+  });
+
+  it('refuses (consented=false) when the policy denies the module', async () => {
+    const handle = startProgrammaticResponder({
+      busDbPath: busPath,
+      db,
+      onMissing: 'skip',
+      values: { aspects: { technitium: false } },
+    });
+    try {
+      const decision = await askAspectConsent(
+        busPath,
+        'technitium',
+        'dns-client-config',
+        ASPECT_PAYLOAD,
+      );
+      expect(decision).toBe(false);
+    } finally {
+      handle.close();
+    }
+  });
+
+  it('does not reply when no aspect policy is provided (onMissing: skip)', async () => {
+    const handle = startProgrammaticResponder({
+      busDbPath: busPath,
+      db,
+      onMissing: 'skip',
+      values: {},
+    });
+    try {
+      const decision = await askAspectConsent(
+        busPath,
+        'technitium',
+        'dns-client-config',
+        ASPECT_PAYLOAD,
+      );
+      expect(decision).toBeNull();
+    } finally {
+      handle.close();
+    }
+  });
+});

package/src/services/programmatic-responder.ts

@@ -21,6 +21,7 @@ import type { DbClient } from '../db/client';
 import { generateSecret } from '../secrets/generators';
 import { getOrCreateMasterKey } from '../secrets/master-key';
 import type {
+  AspectRequiredPayload,
   ConfigRequiredPayload,
   EnsureRequiredPayload,
   InterviewRequiredPayload,
@@ -66,6 +67,17 @@ export interface ResponderValues {
    * (string for text/select, string[] for multiselect, boolean for confirm).
    */
   interview?: Record<string, unknown>;
+  /**
+   * Aspect-consent decisions for a module's `base_module_aspect`
+   * (ISS-0027 / #262). When a HEADLESS deploy emits
+   * `aspect.required.<module>.<role>`, the responder replies
+   * `{ consented }` so the fan-out is approved/denied without a TTY —
+   * the gap that hung the ISS-0156 cutover. Lookup precedence:
+   * `<module>.<role>`, then `<module>`, then the `'*'` wildcard.
+   * Absent → the responder skips (onMissing), exactly like an unmapped
+   * config value — it never silently approves an un-policied aspect.
+   */
+  aspects?: Record<string, boolean>;
 }
 
 export interface ProgrammaticResponderOptions {
@@ -117,6 +129,7 @@ export interface ProgrammaticResponderHandle {
   seenSecretPayloads(): SecretRequiredPayload[];
   seenEnsurePayloads(): EnsureRequiredPayload[];
   seenInterviewPayloads(): InterviewRequiredPayload[];
+  seenAspectPayloads(): AspectRequiredPayload[];
   /** Stop watching. Caller still owns the db client. */
   close(): void;
 }
@@ -136,6 +149,7 @@ export function startProgrammaticResponder(
   const seenSecret: SecretRequiredPayload[] = [];
   const seenEnsure: EnsureRequiredPayload[] = [];
   const seenInterview: InterviewRequiredPayload[] = [];
+  const seenAspect: AspectRequiredPayload[] = [];
   let lastActivityAt = Date.now();
 
   const me = opts.emittedBy ?? 'programmatic';
@@ -308,6 +322,41 @@ export function startProgrammaticResponder(
     answered.push({ type: event.type, key: lookupKey });
   });
 
+  // Aspect consent (ISS-0027 / #262): a headless deploy about to fan out a
+  // module's base_module_aspect emits `aspect.required.<module>.<role>` and
+  // waits (busInterview, timeoutMs:0). Without this watch the responder never
+  // replied → the deploy hung forever (the ISS-0156 cutover failure). We reply
+  // per the `aspects` policy; an un-policied aspect is skipped, never approved.
+  const aspectWatch = bus.watch('aspect.required.*.*', async (event) => {
+    if (event.replyFor !== null) return;
+    lastActivityAt = Date.now();
+
+    const payload = event.payload as AspectRequiredPayload;
+    if (!payload || typeof payload.module !== 'string' || typeof payload.role !== 'string') {
+      missed.push({ type: event.type, key: '?', reason: 'malformed payload' });
+      return;
+    }
+    seenAspect.push(payload);
+
+    // Precedence: exact "<module>.<role>", then "<module>", then "*" wildcard.
+    const lookupKey = `${payload.module}.${payload.role}`;
+    const decision =
+      opts.values.aspects?.[lookupKey] ??
+      opts.values.aspects?.[payload.module] ??
+      opts.values.aspects?.['*'];
+    if (decision === undefined) {
+      handleMissing(event.type, lookupKey, `no aspect decision for "${lookupKey}"`);
+      return;
+    }
+
+    bus.emitRaw(
+      `${event.type}.reply`,
+      { consented: decision },
+      { replyFor: event.id, emittedBy: me },
+    );
+    answered.push({ type: event.type, key: lookupKey });
+  });
+
   // Liveness probe: a non-interactive caller (e.g. `module generate`
   // with no TTY) emits `responder.probe` to detect whether any
   // responder is listening before calling busInterview (which waits
@@ -331,11 +380,13 @@ export function startProgrammaticResponder(
     seenSecretPayloads: () => [...seenSecret],
     seenEnsurePayloads: () => [...seenEnsure],
     seenInterviewPayloads: () => [...seenInterview],
+    seenAspectPayloads: () => [...seenAspect],
     close: () => {
       configWatch.close();
       secretWatch.close();
       ensureWatch.close();
       interviewWatch.close();
+      aspectWatch.close();
       probeWatch.close();
       bus.close();
     },

package/src/templates/generator.ts

@@ -27,7 +27,11 @@ import {
   findBrokenCapabilityDerivations,
 } from '../services/fleet-checks';
 import { selectInfrastructure } from '../services/infrastructure-selector';
-import { deleteModuleConfig, upsertModuleConfig } from '../services/module-config';
+import {
+  deleteModuleConfig,
+  getModuleConfigValue,
+  upsertModuleConfig,
+} from '../services/module-config';
 import type { InfrastructureSelection } from '../types/infrastructure';
 import { convertSecretsToJinja } from '../variables/ansible-resolver';
 import { buildResolutionContext } from '../variables/context';
@@ -730,6 +734,50 @@ export async function generateTemplates(options: GenerateOptions): Promise<Gener
     }
   }
 
+  // Dedicated DNS-ingress IP (ISS-0156). A dns_internal provider now deploys into
+  // a PROTECTED zone (dmz) so it can see protected-zone query sources for
+  // split-horizon views (v2/INTERNAL_DNS_ZONE_VIEWS.md). `internal` devices have
+  // no route into the 10-net, so they reach the resolver through a firewall DNAT
+  // on a dedicated `internal`-subnet address. A module opts in by declaring a
+  // `dns_ingress_ip` infrastructure variable; we allocate a free IP from the
+  // `internal` subnet via IPAM and RESERVE it (so it's never re-handed-out),
+  // idempotently (reuse the stored value on re-generate). The resolver's
+  // on_install passes it to firewall.exposeService({ ingressIp }).
+  const wantsDnsIngress = manifest.variables?.owns?.some(
+    (v) => v.name === 'dns_ingress_ip' && v.source === 'infrastructure',
+  );
+  if (wantsDnsIngress) {
+    const existing = getModuleConfigValue(moduleId, 'dns_ingress_ip', db)?.value;
+    if (typeof existing === 'string' && existing.length > 0) {
+      log.success(`Using existing DNS-ingress IP ${existing} for ${moduleId}`);
+    } else {
+      const subnetRow = db.$client
+        .prepare('SELECT value FROM system_config WHERE key = ?')
+        .get('network.internal.subnet') as { value: string } | undefined;
+      if (!subnetRow?.value) {
+        return {
+          success: false,
+          error:
+            'network.internal.subnet is not configured — required to allocate the ' +
+            'dns_internal DNS-ingress IP (ISS-0156). Ensure the internal network is set up first.',
+        };
+      }
+      const { allocateIPFromSubnet, reserveIP } = await import('../ipam/allocator');
+      const { stripCIDR } = await import('../ipam/subnet-parser');
+      try {
+        const ip = stripCIDR(await allocateIPFromSubnet(subnetRow.value, 'internal', db));
+        await reserveIP(ip, 'internal', `dns-ingress:${moduleId}`, null, db);
+        upsertModuleConfig(db, moduleId, 'dns_ingress_ip', ip);
+        log.success(`Allocated DNS-ingress IP ${ip} (internal subnet) for ${moduleId}`);
+      } catch (error) {
+        return {
+          success: false,
+          error: `DNS-ingress IP allocation failed: ${error instanceof Error ? error.message : String(error)}`,
+        };
+      }
+    }
+  }
+
   // Infrastructure Properties Resolution (Proxmox provider config)
   // For Proxmox services, extract provider config and store as temporary values
   // This happens during generation so templates can access target_node, lxc_template, etc.

package/src/utils/shell.test.ts

@@ -1,11 +1,5 @@
 import { describe, expect, test } from 'bun:test';
-import {
-  needsEscaping,
-  safeShellEscape,
-  shellEscape,
-  shellEscapeArray,
-  validatePath,
-} from './shell';
+import { shellEscape } from './shell';
 
 describe('shellEscape', () => {
   describe('simple paths', () => {
@@ -176,162 +170,6 @@ describe('shellEscape', () => {
   });
 });
 
-describe('shellEscapeArray', () => {
-  test('escapes array of simple paths', () => {
-    const paths = ['/tmp/test1', '/tmp/test2', '/tmp/test3'];
-    expect(shellEscapeArray(paths)).toEqual(["'/tmp/test1'", "'/tmp/test2'", "'/tmp/test3'"]);
-  });
-
-  test('escapes array of paths with spaces', () => {
-    const paths = ['/tmp/test one', '/tmp/test two'];
-    expect(shellEscapeArray(paths)).toEqual(["'/tmp/test one'", "'/tmp/test two'"]);
-  });
-
-  test('escapes empty array', () => {
-    expect(shellEscapeArray([])).toEqual([]);
-  });
-
-  test('escapes array with mixed path types', () => {
-    const paths = ['/tmp/simple', '/tmp/with spaces', "/tmp/with'quote", '/tmp/$special'];
-    expect(shellEscapeArray(paths)).toEqual([
-      "'/tmp/simple'",
-      "'/tmp/with spaces'",
-      "'/tmp/with'\\''quote'",
-      "'/tmp/$special'",
-    ]);
-  });
-});
-
-describe('needsEscaping', () => {
-  test('returns false for simple path', () => {
-    expect(needsEscaping('/tmp/test')).toBe(false);
-  });
-
-  test('returns false for path with only alphanumeric and slashes', () => {
-    expect(needsEscaping('/usr/local/bin/test123')).toBe(false);
-  });
-
-  test('returns false for path with hyphens and underscores', () => {
-    expect(needsEscaping('/tmp/test-module_v1')).toBe(false);
-  });
-
-  test('returns false for path with dots', () => {
-    expect(needsEscaping('./relative/path.txt')).toBe(false);
-  });
-
-  test('returns true for path with space', () => {
-    expect(needsEscaping('/tmp/test module')).toBe(true);
-  });
-
-  test('returns true for path with single quote', () => {
-    expect(needsEscaping("/tmp/Bob's Files")).toBe(true);
-  });
-
-  test('returns true for path with double quote', () => {
-    expect(needsEscaping('/tmp/"test"')).toBe(true);
-  });
-
-  test('returns true for path with dollar sign', () => {
-    expect(needsEscaping('/tmp/$VAR')).toBe(true);
-  });
-
-  test('returns true for path with backtick', () => {
-    expect(needsEscaping('/tmp/`cmd`')).toBe(true);
-  });
-
-  test('returns true for path with special shell characters', () => {
-    const specialChars = [
-      '!',
-      '&',
-      '|',
-      ';',
-      '<',
-      '>',
-      '(',
-      ')',
-      '[',
-      ']',
-      '{',
-      '}',
-      '*',
-      '?',
-      '~',
-      '#',
-      '\\',
-    ];
-    for (const char of specialChars) {
-      expect(needsEscaping(`/tmp/test${char}`)).toBe(true);
-    }
-  });
-});
-
-describe('validatePath', () => {
-  test('accepts valid simple path', () => {
-    expect(() => validatePath('/tmp/test')).not.toThrow();
-  });
-
-  test('accepts path with spaces', () => {
-    expect(() => validatePath('/tmp/test module')).not.toThrow();
-  });
-
-  test('accepts path with special characters', () => {
-    expect(() => validatePath('/tmp/$VAR/test')).not.toThrow();
-  });
-
-  test('accepts relative path', () => {
-    expect(() => validatePath('./modules/homebridge')).not.toThrow();
-  });
-
-  test('accepts path traversal (..)', () => {
-    expect(() => validatePath('../../etc/passwd')).not.toThrow();
-  });
-
-  test('throws on empty string', () => {
-    expect(() => validatePath('')).toThrow('Path cannot be empty');
-  });
-
-  test('throws on whitespace-only string', () => {
-    expect(() => validatePath('   ')).toThrow('Path cannot be empty');
-  });
-
-  test('throws on null byte', () => {
-    expect(() => validatePath('/tmp/test\0file')).toThrow('Path cannot contain null bytes');
-  });
-
-  test('throws on extremely long path', () => {
-    const longPath = `/tmp/${'a'.repeat(5000)}`;
-    expect(() => validatePath(longPath)).toThrow('Path exceeds maximum length');
-  });
-
-  test('accepts path at maximum length', () => {
-    const maxPath = `/tmp/${'a'.repeat(4090)}`; // Total ~4096
-    expect(() => validatePath(maxPath)).not.toThrow();
-  });
-});
-
-describe('safeShellEscape', () => {
-  test('validates and escapes valid path', () => {
-    expect(safeShellEscape('/tmp/test')).toBe("'/tmp/test'");
-  });
-
-  test('validates and escapes path with spaces', () => {
-    expect(safeShellEscape('/tmp/test module')).toBe("'/tmp/test module'");
-  });
-
-  test('throws on empty path', () => {
-    expect(() => safeShellEscape('')).toThrow('Path cannot be empty');
-  });
-
-  test('throws on null byte', () => {
-    expect(() => safeShellEscape('/tmp/test\0')).toThrow('Path cannot contain null bytes');
-  });
-
-  test('throws on extremely long path', () => {
-    const longPath = `/tmp/${'a'.repeat(5000)}`;
-    expect(() => safeShellEscape(longPath)).toThrow('Path exceeds maximum length');
-  });
-});
-
 describe('usage examples', () => {
   test('example: cd command with spaces', () => {
     const modulePath = '/Users/user/Library/Application Support/celilo';

package/src/utils/shell.ts

@@ -57,103 +57,3 @@ export function shellEscape(path: string): string {
 
   return `'${escaped}'`;
 }
-
-/**
- * Escapes an array of paths for shell usage.
- *
- * @param paths - Array of paths to escape
- * @returns Array of shell-escaped strings
- *
- * @example
- * ```typescript
- * const paths = ['/tmp/test', '/Users/user/My Files'];
- * const escaped = shellEscapeArray(paths);
- * // Returns: ["'/tmp/test'", "'/Users/user/My Files'"]
- *
- * // Use in command
- * execSync(`cp ${escaped.join(' ')} /dest/`);
- * ```
- */
-export function shellEscapeArray(paths: string[]): string[] {
-  return paths.map((p) => shellEscape(p));
-}
-
-/**
- * Checks if a path contains characters that require escaping.
- *
- * This is primarily for logging/debugging - you should ALWAYS escape paths
- * regardless of this check for security and reliability.
- *
- * @param path - Path to check
- * @returns True if path contains special characters
- *
- * @example
- * ```typescript
- * needsEscaping('/tmp/test')              // false
- * needsEscaping('/tmp/test module')       // true (space)
- * needsEscaping('/tmp/Bob\'s Files')      // true (quote)
- * needsEscaping('/tmp/test$var')          // true (special char)
- * ```
- */
-export function needsEscaping(path: string): boolean {
-  // Characters that require escaping in shell:
-  // - Spaces
-  // - Quotes (single and double)
-  // - Shell special characters: $ ` ! & | ; < > ( ) [ ] { } * ? ~ #
-  // - Backslash
-  const specialChars = /[ '"$`!&|;<>()[\]{}*?~#\\]/;
-
-  return specialChars.test(path);
-}
-
-/**
- * Validates a path before escaping (throws on clearly invalid inputs).
- *
- * Note: This does NOT validate that the path exists or is accessible,
- * only that it's not obviously malicious or invalid.
- *
- * @param path - Path to validate
- * @throws {Error} If path is clearly invalid or suspicious
- *
- * @example
- * ```typescript
- * validatePath('/tmp/test')           // OK
- * validatePath('')                    // throws: empty path
- * validatePath('../../../etc/passwd') // OK (relative paths allowed)
- * ```
- */
-export function validatePath(path: string): void {
-  if (!path || path.trim().length === 0) {
-    throw new Error('Path cannot be empty or whitespace-only');
-  }
-
-  // Check for null bytes (security risk)
-  if (path.includes('\0')) {
-    throw new Error('Path cannot contain null bytes');
-  }
-
-  // Check for extremely long paths (likely an error)
-  if (path.length > 4096) {
-    throw new Error('Path exceeds maximum length (4096 characters)');
-  }
-}
-
-/**
- * Safe shell escape with validation.
- *
- * Convenience function that validates then escapes a path.
- *
- * @param path - Path to validate and escape
- * @returns Shell-escaped string
- * @throws {Error} If path is invalid
- *
- * @example
- * ```typescript
- * safeShellEscape('/tmp/My Files')  // Returns: '/tmp/My Files'
- * safeShellEscape('')               // Throws: Path cannot be empty
- * ```
- */
-export function safeShellEscape(path: string): string {
-  validatePath(path);
-  return shellEscape(path);
-}

package/src/validation/schemas.ts

@@ -126,11 +126,6 @@ export const CLIServerResponseSchema = z.object({
 
 export type CLIServerResponse = z.infer<typeof CLIServerResponseSchema>;
 
-/**
- * Array of strings (for inventory groups, etc.)
- */
-export const StringArraySchema = z.array(z.string());
-
 /**
  * Helper: Parse JSON with Zod validation
  * Wraps JSON.parse() with schema validation and user-friendly error messages

package/src/variables/context.ts

@@ -8,6 +8,7 @@ import {
   machines,
   moduleConfigs,
   moduleInfrastructure,
+  moduleSystems,
   modules,
   secrets,
   systemConfig,
@@ -264,20 +265,48 @@ export async function buildResolutionContext(
     const systemResources = getSingularSystemSpec(manifest);
 
     if (systemResources) {
-      // Map manifest fields to module variable names and apply defaults
+      // The DEPLOYED size is the SYSTEM's canonical state (ISS-0150), seeded from
+      // requires.system at first provision and thereafter owned by
+      // `celilo proxmox … resize`. So sizing flows: module_systems → these config
+      // vars → `$self:{cores,memory,disk}` in the instance Terraform.
+      //
+      // Precedence: the recorded system size WINS and overwrites the cached
+      // config (a resize must propagate on the next generate); only when this
+      // module has no recorded system size yet (the very first provision, before
+      // recordDeployedSystemForModule runs below) do we fall back to
+      // requires.system — and seed-when-unset, matching the prior behavior so the
+      // first-deploy / golden output is unchanged. `requires.system` stays the
+      // minimum floor, never the canonical size. (CLAUDE.md / ISS-0150.)
+      const sizedRow = db
+        .select({
+          cpu: moduleSystems.cpu,
+          memory: moduleSystems.memory,
+          disk: moduleSystems.disk,
+        })
+        .from(moduleSystems)
+        .where(eq(moduleSystems.moduleId, moduleId))
+        .all()
+        .find((r) => r.cpu != null || r.memory != null || r.disk != null);
+
       const resourceMappings: Array<{
         manifestKey: keyof typeof systemResources;
         configKey: string;
+        systemValue: number | null | undefined;
       }> = [
-        { manifestKey: 'cpu', configKey: 'cores' }, // manifest.requires.system.cpu → cores variable
-        { manifestKey: 'memory', configKey: 'memory' },
-        { manifestKey: 'disk', configKey: 'disk' },
-        { manifestKey: 'storage', configKey: 'storage' },
+        { manifestKey: 'cpu', configKey: 'cores', systemValue: sizedRow?.cpu }, // requires.system.cpu → cores
+        { manifestKey: 'memory', configKey: 'memory', systemValue: sizedRow?.memory },
+        { manifestKey: 'disk', configKey: 'disk', systemValue: sizedRow?.disk },
+        { manifestKey: 'storage', configKey: 'storage', systemValue: undefined }, // pool name, not sizing
       ];
 
-      for (const { manifestKey, configKey } of resourceMappings) {
+      for (const { manifestKey, configKey, systemValue } of resourceMappings) {
+        if (systemValue != null) {
+          // Canonical system size — always wins so a resize propagates.
+          upsertModuleConfig(db, moduleId, configKey, systemValue);
+          selfConfig[configKey] = String(systemValue);
+          continue;
+        }
         const value = systemResources[manifestKey];
-
         // Manifest fields are typed (cpu: number, storage: string, etc.).
         // Pass them through unstringified so valueJson preserves the
         // shape — see comment in the variable-defaults block above.