@crvouga/dev-fleet 0.0.0-stage → 0.2.0

package/mise.toml

@@ -0,0 +1,110 @@
+# Shared workstation toolchain. Bootstrap installs this globally; projects may override it.
+# Commit mise.lock whenever changing these pins.
+# min_version is also the exact mise bootstrap/bootstrap.sh installs; bump the
+# mise_*_sha256 digests under [vars] with it.
+min_version = "2026.10.24"
+
+[settings]
+lockfile = true
+lockfile_platforms = ["linux-x64", "linux-arm64", "macos-x64", "macos-arm64", "windows-x64"]
+
+[tools]
+gh = "2.103.3"
+shellcheck = "0.11.0"
+actionlint = "1.7.12"
+opentofu = "1.13.0"
+bun = "1.4.4"
+node = "26.13.0"
+atlas = { version = "1.3.0", os = ["linux", "macos"], lazy = true }
+azure-cli = { version = "2.91.0", lazy = true }
+# CLI proxy backups on the manager (cliproxy/scripts/install-dependencies).
+restic = { version = "0.19.1", os = ["linux", "macos"], lazy = true }
+# Replicates the fleet state database to the storage bucket (src/state).
+litestream = { version = "0.5.18", os = ["linux", "macos"], lazy = true }
+pnpm = "12.16.1"
+"npm:@yarnpkg/cli-dist" = "4.18.1"
+deno = "2.9.8"
+python = "3.15.2"
+uv = "0.13.6"
+go = "1.27.3"
+jq = "1.8.2"
+yq = "4.54.1"
+ripgrep = "15.2.0"
+fd = "10.5.0"
+fzf = "0.74.5"
+bat = "0.26.1"
+delta = "0.18.2"
+git-lfs = "3.8.1"
+docker-cli = "29.9.2"
+"npm:vercel" = "65.8.0"
+"npm:wrangler" = "4.156.0"
+railway = "5.71.0"
+"aqua:anomalyco/opencode" = "1.19.5"
+vault = "2.2.1"
+claude = "2.1.314"
+codex = "0.166.0"
+gemini = { version = "0.66.0", allow_builds = ["@lydell/node-pty"] }
+copilot = "1.0.105"
+# Agent CLIs without a registry backend: exact vendor artifacts, checksums in mise.lock.
+"http:grok" = { version = "1.0.77", os = ["linux", "macos"], bin = "grok", platforms = { linux-x64 = { url = "https://x.ai/cli/grok-{{version}}-linux-x86_64" }, linux-arm64 = { url = "https://x.ai/cli/grok-{{version}}-linux-aarch64" }, macos-x64 = { url = "https://x.ai/cli/grok-{{version}}-macos-x86_64" }, macos-arm64 = { url = "https://x.ai/cli/grok-{{version}}-macos-aarch64" } } }
+"http:antigravity" = { version = "1.5.3", os = ["linux", "macos"], bin = "antigravity", platforms = { linux-x64 = { url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.5.3-6604829099950080/linux-x64/cli_linux_x64.tar.gz" }, linux-arm64 = { url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.5.3-6604829099950080/linux-arm/cli_linux_arm64.tar.gz" }, macos-x64 = { url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.5.3-6604829099950080/darwin-x64/cli_mac_x64.tar.gz" }, macos-arm64 = { url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.5.3-6604829099950080/darwin-arm/cli_mac_arm64.tar.gz" } } }
+
+"aws" = { version = "2.39.2", os = ["linux", "macos"] }
+"rust" = "1.99.1"
+"cmake" = "4.4.5"
+"ninja" = "1.13.2"
+"just" = "1.59.0"
+"gitleaks" = "8.30.1"
+"shfmt" = "3.14.1"
+"sops" = "3.13.3"
+"age" = "1.3.2"
+"kubectl" = "1.37.2"
+"helm" = "4.3.1"
+"xh" = "0.26.3"
+"usql" = "0.21.6"
+"java" = { version = "temurin-25.0.5+8.0.LTS", lazy = true }
+"dotnet" = { version = "10.0.403", lazy = true, lazy_bins = ["dotnet"] }
+"gcloud" = { version = "591.0.0", lazy = true }
+"npm:@devcontainers/cli" = "0.90.0"
+# pino's 9.x backport was manually published; integrity and all published JS
+# were checked against pinojs/pino v9.14.0. Keep the exception version-specific.
+"npm:@modelcontextprotocol/inspector" = { version = "2.13.0", lazy = true, lazy_bins = ["mcp-inspector", "inspector", "mcpdo"], trust_policy_excludes = ["pino@9.14.0"] }
+"aws-cdk" = { version = "2.1146.1", lazy = true }
+"aws-sam" = { version = "1.171.0", lazy = true, os = ["linux", "macos"] }
+
+# Keep self-updaters from bypassing the reviewed toolchain lock.
+[env]
+DISABLE_AUTOUPDATER = "1"
+COPILOT_AUTO_UPDATE = "false"
+GROK_DISABLE_AUTOUPDATER = "1"
+# Antigravity ignores "1"; only "true" stops its in-place self-updater.
+AGY_CLI_DISABLE_AUTO_UPDATE = "true"
+
+[vars]
+# mise itself, installed by bootstrap/bootstrap.sh before mise can read this
+# file: the version is min_version above, these are its release archives
+# (SHASUMS256.txt of that release).
+mise_linux_x64_sha256 = "9a6c9c55f5c6372d0af70a9979fe6d742aea3793267a929e1738022143c466cc"
+mise_linux_arm64_sha256 = "8c8f5d7f748bf3aef431dc50f0ad776270f36025c788aa21c74e2fabdbbd6d3e"
+mise_macos_x64_sha256 = "83a36355bf6ee7c1660300e12dd94464de5c672dab1b8cc33ec4d19356e7ddac"
+mise_macos_arm64_sha256 = "aa2fc59242db108f97ea9fb2d2e2cb42ff1467fcafe3c91e48d51c841ba67a65"
+# Official native Ubuntu server distribution; bootstrap/native-t3.ts owns installation.
+t3_version = "0.1.8-nightly.20261106.4262"
+t3_linux_x64_sha256 = "5df94ca15c4f68f749fa5540fbb9d5ca879ca8750ac43dd2704f6a18899ed6d5"
+t3_linux_arm64_sha256 = "0649615c4a294eee40bc753c8668e4a83c5c3620794f2163758f8dc48a39b880"
+# Official T3 Code desktop .deb (same release). Workers run this GUI app as their
+# only T3 process; it embeds the server. Upstream SHA256SUMS omits .deb files,
+# so these digests were computed from the release assets.
+t3_desktop_amd64_sha256 = "952703bd48b87029a4f9a2b275aeeb79bc74eacf01867784ab6878adecaf03d7"
+t3_desktop_arm64_sha256 = "ae8a32a71a32760831af40a16cae9aabe8683b7021df6b899b57e8d559a7e777"
+# Official AWS v2 Windows MSI, same version as tools.aws; checked before execution.
+aws_windows_msi_sha256 = "c7857d5981e68396852e8b7eca0b1772f1c99b34d4938075857d45ec9c232113"
+# Docker Desktop supplies the macOS engine, Compose and Buildx as one vendor bundle.
+# Official release/checksums: https://docs.docker.com/desktop/release-notes/#4980
+docker_desktop_version = "4.98.0"
+docker_desktop_build = "245422"
+docker_desktop_arm64_sha256 = "9c6f13ce4edda2abf20d801552b6acb96acd3d64b3e91b50c4484353802758b5"
+docker_desktop_amd64_sha256 = "96b53f9a4a807b6be6207d18f360b9778ff481e1d94b5027bdf1ae2a22d837cb"
+
+# Minimal remote development baseline; versions are resolved exclusively by tools + mise.lock.
+worker_tools = "bun,node,gh,python,uv,docker-cli,vault,jq,codex,claude,aqua:anomalyco/opencode,gemini,copilot,http:grok,http:antigravity"

package/package.json

@@ -1,6 +1,76 @@
 {
   "name": "@crvouga/dev-fleet",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "Keeps a set of development machines in sync: one manager and many workers",
+  "license": "MIT",
+  "repository": "github:crvouga/dev-fleet",
+  "homepage": "https://github.com/crvouga/dev-fleet#readme",
+  "bugs": {
+    "url": "https://github.com/crvouga/dev-fleet/issues"
+  },
+  "type": "module",
+  "bin": {
+    "devfleet": "./bin/devfleet.mjs"
+  },
+  "files": [
+    "bin",
+    "llms.txt",
+    "docs",
+    "src",
+    "agents",
+    "ansible",
+    "bootstrap",
+    "cliproxy",
+    "schema",
+    "examples",
+    ".mise",
+    "mise.toml",
+    "mise.lock",
+    "!**/*.test.ts",
+    "!**/test_*.py",
+    "!**/tests",
+    "!**/__pycache__"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "devfleet": "bun src/cli/cli.ts",
+    "bootstrap": "bun bootstrap/npm.ts",
+    "tc": "tsc --noEmit",
+    "lint": "eslint . --max-warnings 0",
+    "format": "prettier --check .",
+    "test": "bun test",
+    "test:cliproxy": "DEVFLEET_CONFIG=$PWD/examples/fleet.json python3 -B -m unittest discover -s cliproxy/tests -p \"test_*.py\"",
+    "lint:cliproxy": "DEVFLEET_CONFIG=$PWD/examples/fleet.json python3 -B cliproxy/scripts/check.py",
+    "check": "bun run format && bun run tc && bun run lint && bun test && bun run lint:cliproxy && bun run test:cliproxy"
+  },
+  "dependencies": {
+    "@inquirer/prompts": "8.7.5",
+    "boxen": "9.0.0",
+    "bun": "1.4.4",
+    "chalk": "6.0.1",
+    "cli-table3": "0.6.5",
+    "commander": "15.0.0",
+    "fuse.js": "7.5.0",
+    "ora": "10.0.0",
+    "yaml": "^2.8.0"
+  },
+  "devDependencies": {
+    "@cucumber/cucumber-expressions": "20.1.0",
+    "@cucumber/gherkin": "42.0.1",
+    "@cucumber/messages": "34.2.1",
+    "@eslint/js": "^9.25.0",
+    "@types/bun": "^1.3.9",
+    "@types/node": "^22.15.29",
+    "eslint": "^9.25.0",
+    "prettier": "^3.8.1",
+    "typescript": "~5.9.2",
+    "typescript-eslint": "^8.58.0"
+  },
+  "packageManager": "bun@1.4.4",
+  "engines": {
+    "node": ">=22"
+  },
+  "gitHead": "6dee8455d48203125eb5c0546c3c4446034fca85"
+}

package/schema/fleet.schema.json

@@ -0,0 +1,420 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Fleet topology: one manager (the human's machine, which runs every singleton service) and stateless Linux workers. Local paths remain in roster overrides.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "version",
+    "manager",
+    "workers",
+    "services",
+    "ubuntu",
+    "source",
+    "secrets"
+  ],
+  "properties": {
+    "$schema": {
+      "type": "string"
+    },
+    "version": {
+      "const": 3
+    },
+    "manager": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "The singleton manager: the human's machine that runs fleet-sync and hosts every singleton service (CLI proxy, Beszel hub).",
+      "required": ["id", "os", "network", "neverSleepOnPower"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^[a-z][a-z0-9-]{0,62}$",
+          "description": "A short stable id for the manager, used in reports."
+        },
+        "os": {
+          "const": "macOS"
+        },
+        "network": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["tailscaleName", "user"],
+          "properties": {
+            "tailscaleName": {
+              "type": "string",
+              "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]{0,252}$",
+              "description": "The manager's Tailscale MagicDNS name, without the trailing dot (tailscale status --json: .Self.DNSName)."
+            },
+            "user": {
+              "type": "string",
+              "pattern": "^[a-z_][a-z0-9_.-]{0,31}$",
+              "description": "The manager's login name (id -un)."
+            }
+          }
+        },
+        "neverSleepOnPower": {
+          "const": true,
+          "description": "Workers depend on the manager's singleton services, so it never sleeps on AC power."
+        }
+      }
+    },
+    "workers": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 64,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "ssh", "os"],
+        "properties": {
+          "id": {
+            "type": "string",
+            "pattern": "^[a-z][a-z0-9-]{0,62}$",
+            "description": "A short stable id for the worker. The first worker listed is the canary: a revision new to the fleet must pass there before the others receive it."
+          },
+          "ssh": {
+            "type": "string",
+            "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]{0,252}$",
+            "description": "The worker's Host alias in the manager's ~/.ssh/config. It must work with BatchMode=yes and a host key already in known_hosts."
+          },
+          "os": {
+            "const": "linux",
+            "description": "Workers are the Linux boxes: stateless, replaceable, never hosting a singleton service."
+          },
+          "network": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["tailscaleName", "user", "sshPort", "t3Port"],
+            "properties": {
+              "tailscaleName": {
+                "type": "string",
+                "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]{0,252}$",
+                "description": "The worker's Tailscale MagicDNS name, without the trailing dot."
+              },
+              "user": {
+                "type": "string",
+                "pattern": "^[a-z_][a-z0-9_-]{0,31}$",
+                "description": "The non-root worker account that can use sudo."
+              },
+              "sshPort": {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 65535,
+                "description": "The port sshd listens on, normally 22."
+              },
+              "t3Port": {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 65535,
+                "description": "The port the worker T3 server listens on, normally 3773."
+              }
+            }
+          }
+        }
+      }
+    },
+    "services": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["proxy", "monitoring"],
+      "description": "Singleton services. Every one runs on the manager; workers are clients only.",
+      "properties": {
+        "proxy": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["endpoint"],
+          "properties": {
+            "endpoint": {
+              "type": "string",
+              "pattern": "^https://[A-Za-z0-9.-]+$",
+              "description": "Public HTTPS origin of the CLI proxy every node uses."
+            }
+          }
+        },
+        "monitoring": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "hubPort",
+            "publicUrl",
+            "managerAccount",
+            "viewerAccount"
+          ],
+          "properties": {
+            "hubPort": {
+              "const": 8443
+            },
+            "publicUrl": {
+              "type": "string",
+              "pattern": "^https://[A-Za-z0-9.-]+$",
+              "description": "Public dashboard origin."
+            },
+            "managerAccount": {
+              "type": "string",
+              "format": "email",
+              "description": "Beszel account the manager enrolls nodes with."
+            },
+            "viewerAccount": {
+              "type": "string",
+              "format": "email",
+              "description": "Read-only Beszel account visitors are signed in as."
+            }
+          }
+        }
+      }
+    },
+    "ubuntu": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["release", "architectures"],
+      "properties": {
+        "release": {
+          "const": "26.04"
+        },
+        "architectures": {
+          "const": ["amd64", "arm64"]
+        }
+      },
+      "description": "The supported worker release and architectures (fixed)."
+    },
+    "worker": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "requiredCapabilities",
+        "githubLogin",
+        "vaultUser",
+        "toolchain",
+        "agentProfile",
+        "unattendedSudo",
+        "persistentT3",
+        "neverSleep"
+      ],
+      "properties": {
+        "requiredCapabilities": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "enum": [
+              "github",
+              "vault",
+              "t3",
+              "toolchain",
+              "workstation",
+              "worker"
+            ]
+          },
+          "description": "Readiness checks every worker must pass; normally all six."
+        },
+        "githubLogin": {
+          "type": "string",
+          "pattern": "^[a-zA-Z0-9-]{1,39}$",
+          "description": "The GitHub login every worker must be signed in as."
+        },
+        "vaultUser": {
+          "type": "string",
+          "pattern": "^[a-zA-Z0-9_.-]{1,64}$",
+          "description": "The Vault user each worker's own token is issued for."
+        },
+        "toolchain": {
+          "const": "mise.lock"
+        },
+        "agentProfile": {
+          "const": "proxy"
+        },
+        "unattendedSudo": {
+          "const": true
+        },
+        "persistentT3": {
+          "const": true
+        },
+        "neverSleep": {
+          "const": true
+        }
+      },
+      "description": "Policy every worker must meet. All but the two logins and the capabilities are fixed."
+    },
+    "source": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["repository"],
+      "description": "The Git repository machines take dev-fleet's code from: the one the package you run was published from, or your fork. Nodes only accept source from it.",
+      "properties": {
+        "repository": {
+          "type": "string",
+          "pattern": "^https://[A-Za-z0-9.-]+/[A-Za-z0-9._/-]+\\.git$"
+        }
+      }
+    },
+    "state": {
+      "description": "The bucket that holds the fleet state (the roster, the approved revision and the configuration last applied). Any S3-compatible service, or a directory. Never credentials: a devfleet command reads those from DEVFLEET_BUCKET_ACCESS_KEY_ID and DEVFLEET_BUCKET_SECRET_ACCESS_KEY.",
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["bucket"],
+          "properties": {
+            "bucket": {
+              "type": "string",
+              "pattern": "^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$"
+            },
+            "endpoint": {
+              "type": "string",
+              "description": "The https origin of the S3 service; omit for AWS S3.",
+              "pattern": "^https://[A-Za-z0-9.-]{1,253}(:[0-9]{1,5})?$"
+            },
+            "region": {
+              "type": "string",
+              "pattern": "^[a-z0-9-]{1,32}$"
+            },
+            "prefix": {
+              "type": "string",
+              "description": "Key prefix, so one bucket can hold several fleets. Default: dev-fleet.",
+              "pattern": "^[A-Za-z0-9][A-Za-z0-9._/-]{0,199}$"
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["directory"],
+          "properties": {
+            "directory": {
+              "type": "string",
+              "description": "An absolute path on an attached disk or a mounted share.",
+              "pattern": "^/"
+            }
+          }
+        }
+      ]
+    },
+    "secrets": {
+      "description": "Where this fleet keeps its secrets. env: DEVFLEET_SECRET_<NAME>; file: one file per secret; sops: one encrypted document; vault: a KV v2 location per secret.",
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["provider"],
+          "properties": {
+            "provider": {
+              "const": "env"
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["provider"],
+          "properties": {
+            "provider": {
+              "const": "file"
+            },
+            "directory": {
+              "type": "string"
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["provider", "file"],
+          "properties": {
+            "provider": {
+              "const": "sops"
+            },
+            "file": {
+              "type": "string"
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["provider", "address", "mount", "locations"],
+          "properties": {
+            "provider": {
+              "const": "vault"
+            },
+            "address": {
+              "type": "string",
+              "pattern": "^https://[A-Za-z0-9.-]+$"
+            },
+            "mount": {
+              "type": "string"
+            },
+            "locations": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": [
+                "proxy-client-key",
+                "monitoring-account-password",
+                "monitoring-tunnel-token",
+                "proxy-tunnel-token"
+              ],
+              "properties": {
+                "proxy-client-key": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["path", "field"],
+                  "properties": {
+                    "path": {
+                      "type": "string",
+                      "pattern": "^[A-Za-z0-9._/-]+$"
+                    },
+                    "field": {
+                      "type": "string",
+                      "pattern": "^[A-Za-z0-9_]+$"
+                    }
+                  }
+                },
+                "monitoring-account-password": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["path", "field"],
+                  "properties": {
+                    "path": {
+                      "type": "string",
+                      "pattern": "^[A-Za-z0-9._/-]+$"
+                    },
+                    "field": {
+                      "type": "string",
+                      "pattern": "^[A-Za-z0-9_]+$"
+                    }
+                  }
+                },
+                "monitoring-tunnel-token": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["path", "field"],
+                  "properties": {
+                    "path": {
+                      "type": "string",
+                      "pattern": "^[A-Za-z0-9._/-]+$"
+                    },
+                    "field": {
+                      "type": "string",
+                      "pattern": "^[A-Za-z0-9_]+$"
+                    }
+                  }
+                },
+                "proxy-tunnel-token": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["path", "field"],
+                  "properties": {
+                    "path": {
+                      "type": "string",
+                      "pattern": "^[A-Za-z0-9._/-]+$"
+                    },
+                    "field": {
+                      "type": "string",
+                      "pattern": "^[A-Za-z0-9_]+$"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      ]
+    }
+  }
+}

package/schema/roster.schema.json

@@ -0,0 +1,77 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Developer fleet roster (not infrastructure inventory)",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "nodes"],
+  "properties": {
+    "$schema": {
+      "type": "string"
+    },
+    "version": {
+      "const": 1
+    },
+    "nodes": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 64,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "ssh", "workspace"],
+        "properties": {
+          "id": {
+            "type": "string",
+            "pattern": "^[a-z][a-z0-9-]{0,62}$"
+          },
+          "ssh": {
+            "type": "string",
+            "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]{0,252}$"
+          },
+          "workspace": {
+            "type": "string",
+            "maxLength": 4096,
+            "pattern": "^/[^\\u0000-\\u001f\\u007f]*$"
+          },
+          "runtime": {
+            "type": "string",
+            "maxLength": 4096,
+            "pattern": "^/[^\\u0000-\\u001f\\u007f]*$"
+          },
+          "required": {
+            "type": "array",
+            "uniqueItems": true,
+            "default": ["github", "vault", "t3", "toolchain"],
+            "items": {
+              "enum": [
+                "github",
+                "vault",
+                "t3",
+                "vscode",
+                "toolchain",
+                "codex",
+                "claude",
+                "services",
+                "workstation",
+                "worker"
+              ]
+            }
+          },
+          "tailscaleId": {
+            "type": "string",
+            "pattern": "^[a-zA-Z0-9:_-]{1,128}$",
+            "description": "Explicitly enrolled stable Tailscale device ID; replacements require reenrollment."
+          },
+          "bootstrapViaSsh": {
+            "type": "boolean",
+            "description": "Explicit permission to bootstrap an enrolled node over its trusted SSH route while Tailscale is unavailable; does not accept host keys or replace device identities."
+          },
+          "t3EnvironmentId": {
+            "type": "string",
+            "pattern": "^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$"
+          }
+        }
+      }
+    }
+  }
+}