@fastagent-sh/fastagent 0.24.3 → 0.25.0

package/dist/deploy/docker/plan.js

@@ -4,6 +4,7 @@ import { deploymentLoginCommand } from "../box-shell.js";
 import { SECRETS_DIRNAME } from "../../paths.js";
 const MOUNT = "/data";
 export const DOCKER_COMPOSE_FILE = "fastagent.compose.yml";
+export const DOCKER_VALUE_FILE = `${SECRETS_DIRNAME}/production/.env`;
 const GENERATED_COMPOSE_MARKER = "# Generated by `fastagent deploy docker`";
 export const MIN_DOCKER_COMPOSE_VERSION = "2.3.3";
 /** Pinned: generated deployment artifacts must not silently move when Cloudflare publishes `latest`. */
@@ -31,10 +32,7 @@ function composeInterpolation(name) {
     return `\${${name}:-}`;
 }
 function composeYaml(input) {
-    // Compose sits beside the Dockerfile, under the agent prefix; the build context is always the WORKSPACE, so it
-    // climbs back out of the one-level prefix deploy requires.
-    const context = "..";
-    const dockerfile = `${input.agentPrefix}Dockerfile`;
+    // Compose sits beside the Dockerfile, in the agent directory, which is the build context.
     const tunnelService = input.tunnel
         ? `
   # Cloudflare Quick Tunnel: ephemeral URL, generated only with \`deploy docker --tunnel\`.
@@ -69,8 +67,8 @@ name: ${input.projectName}
 services:
   agent:
     build:
-      context: ${context}
-      dockerfile: ${dockerfile}
+      context: .
+      dockerfile: Dockerfile
     ports:
       - "127.0.0.1:${input.port}:${input.port}"
     # The deployed environment's own declaration, read by the container itself. \`env_file\`, not per-name
@@ -78,12 +76,13 @@ services:
     # source a deployment must not have. A FIXED path, never the builder's FASTAGENT_SECRETS_DIR — this file is a
     # committed artifact and must mean the same thing on every machine. \`deploy\` creates it if it is missing.
     env_file:
-      - ${SECRETS_DIRNAME}/.env
+      - ${DOCKER_VALUE_FILE}
     environment:
       PORT: "${input.port}"
-      # Machinery on the ONE state volume: mutable state and credentials (logged in on the box). Pinned AFTER
-      # env_file so a local path in that file (the scaffold lists these) cannot send the container's state, sessions
-      # or credentials somewhere outside the volume — or at a host path that does not exist here at all.
+      # Machinery on the ONE state volume: mutable state and credentials (logged in on the box); the agent's content
+      # is linked there by the release itself. Pinned AFTER env_file so a local path in that file (the scaffold lists
+      # these) cannot send the container's state, sessions or credentials somewhere outside the volume — or at a
+      # host path that does not exist here at all.
       FASTAGENT_STATE_DIR: "${MOUNT}/.state"
       FASTAGENT_SECRETS_DIR: "${MOUNT}/.secrets"
       FASTAGENT_AUTH_PATH: "${MOUNT}/.secrets/auth.json"
@@ -106,7 +105,7 @@ volumes:
 }
 /** Compute local-Docker artifacts + the runbook; no Docker process is touched here. */
 export function planDockerDeploy(input) {
-    const composePath = `${input.agentPrefix}${DOCKER_COMPOSE_FILE}`;
+    const composePath = DOCKER_COMPOSE_FILE;
     const artifacts = [{ path: composePath, content: composeYaml(input) }, ...containerArtifacts(input)];
     // One spelling for every command: the generated file names the value file itself (`env_file`), so no command
     // needs a flag to reach the deployed environment's declaration.
@@ -121,13 +120,13 @@ export function planDockerDeploy(input) {
     if (secrets.length > 0) {
         runbook.push(`# Environment: the container reads ${input.valueFile} whole (Compose \`env_file\`) — that file declares the`, `# deployed environment (in CI, write it before running the command):`, ...secrets.map((secret) => `#   ${secret.name}: ${secret.hint}`));
     }
-    runbook.push(`# Run from the WORKSPACE ROOT (the directory containing ${input.agentPrefix}).`, `# The build bakes the whole directory as the agent's workspace; only the agent's own`, `# dependencies (${input.agentPrefix}package.json) are installed.`);
-    runbook.push(``, `# Before building a new definition release, run \`fastagent deploy docker\` to refresh its manifest.`, `# The Compose volume at ${MOUNT} retains the workspace, state and credentials.`, `${compose} up -d --build`, `curl --fail http://127.0.0.1:${input.port}/health`, ...(input.boxLogin
+    runbook.push(`# Run from the agent directory. The build bakes it as the definition and installs its`, `# package.json dependencies.`);
+    runbook.push(``, `# Before building a new definition release, run \`fastagent deploy docker\` to refresh its manifest.`, `# The Compose volume at ${MOUNT} retains the deployed definition, state and credentials.`, `# --pull: the base image is a floating tag, and a copy cached here may be older than the runtime floor.`, `${compose} build --pull`, `${compose} up -d`, `curl --fail http://127.0.0.1:${input.port}/health`, ...(input.boxLogin
         ? [
             `# Model auth: once it is up, the deployment logs in to ${input.boxLogin} itself:`,
             `${deploymentLoginCommand("docker", input.boxLogin)}`,
         ]
-        : []), ``, `# Operate it:`, `${compose} logs -f agent`, `${compose} ps`, `${compose} down        # stops containers; keeps the state volume`, `# ${compose} down -v   # DESTRUCTIVE: deletes workspace, credentials and all agent state`);
+        : []), ``, `# Operate it:`, `${compose} logs -f agent`, `${compose} ps`, `${compose} down        # stops containers; keeps the state volume`, `# ${compose} down -v   # DESTRUCTIVE: deletes credentials and all agent state`);
     if (input.tunnel) {
         runbook.push(``, `# Quick Tunnel: \`--run\` starts the Compose tunnel service and reads its ephemeral public URL.`, `# Telegram/Feishu/Lark and locally onboarded Slack auto-register; manual Slack prints its console URL. Re-run after the`, `# tunnel container/Docker daemon restarts: a new Quick Tunnel URL must replace the old webhook URL.`, `${compose} logs -f tunnel`);
     }

package/dist/deploy/docker/run.d.ts

@@ -4,7 +4,7 @@ import type { DeclaredChannel } from "../../channels/discover.ts";
 import type { RegistrationOutcome } from "../../channels/registration.ts";
 import type { CliRunner } from "../runner.ts";
 export interface DockerRunPlan {
-    /** Compose file relative to the runner cwd (the workspace root). */
+    /** Compose file relative to the runner cwd (the agent directory). */
     composeFile: string;
     /** Container port from config; used to ask Compose for the effective published host port. */
     port: number;
@@ -15,7 +15,7 @@ export interface DockerRunPlan {
     secrets: Record<string, string>;
     /** Declared names the value file supplies no value for — the run gates on these before any side effect. */
     missingSecrets: string[];
-    /** That value file, workspace-relative, so the gate names the file this deploy actually read. */
+    /** That value file, agent-dir-relative, so the gate names the file this deploy actually read. */
     valueFile: string;
     /** Register the deployment's webhooks against the tunnel URL, reporting what each registrar answered. */
     announce: DockerAnnounce;

package/dist/deploy/docker/run.js

@@ -14,8 +14,8 @@ export function localUrlFromComposePort(stdout) {
     return port ? `http://127.0.0.1:${port}` : undefined;
 }
 /**
- * The FIRST boot seeds the whole workspace onto the volume (the image's `node_modules` included) before it binds a
- * port, so this budget covers a copy on a slow Docker Desktop disk, not a listen.
+ * The boot publishes the definition onto the volume (the image's `node_modules` included) before it binds a port,
+ * so this budget covers a copy on a slow Docker Desktop disk, not a listen.
  */
 const defaultHealthProbe = (healthUrl, stillStarting) => waitForHealth(healthUrl, 180_000, 500, stillStarting);
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
@@ -107,7 +107,11 @@ export async function deployDockerRun(plan, docker, log, healthProbe = defaultHe
         }
     }
     log(`building and reconciling ${plan.composeFile}…`);
-    if ((await docker([...compose, "up", "-d", "--build"])).code !== 0) {
+    // `--pull`: the base image is a floating tag, and a copy cached here may be older than the runtime floor.
+    if ((await docker([...compose, "build", "--pull"])).code !== 0) {
+        return gate(`\`docker compose build\` failed — see the Docker output above; fix it and re-run`);
+    }
+    if ((await docker([...compose, "up", "-d"])).code !== 0) {
         return gate(`\`docker compose up\` failed — see the Docker output above; fix ${plan.composeFile} and re-run`);
     }
     // Detached `up` can return 0 just before a bad command exits.
@@ -133,7 +137,7 @@ export async function deployDockerRun(plan, docker, log, healthProbe = defaultHe
         return ps.code !== 0 || ps.stdout.split(/\s+/).includes("agent");
     };
     if (!url && plan.boxLogin) {
-        // The login runs in the prepared workspace, with the CLI the first boot installs: it needs the box READY, and
+        // The login runs in the deployed definition, with the CLI the first boot installs: it needs the box READY, and
         // with no published port the only place to ask `/health` is inside the container.
         log("agent is running (no host-published port found); waiting for /health inside the container before login…");
         if (!(await containerHealthy(docker, compose, plan.port, stillStarting))) {

package/dist/deploy/fly/plan.d.ts

@@ -22,7 +22,7 @@ export interface FlyPlanInput extends ContainerInput {
      * carries.
      */
     secrets?: readonly DeploymentSecret[];
-    /** `routines/` declares a cron — one of the things that forces a machine up (deploy/residency.ts). */
+    /** `schedules/` declares a schedule — one of the things that forces a machine up (deploy/residency.ts). */
     hasCron: boolean;
 }
 export interface FlyPlan {

package/dist/deploy/fly/plan.js

@@ -1,21 +1,13 @@
 import { webhookRunbook } from "../channel-ingress.js";
-import { containerArtifacts } from "../container.js";
+import { containerArtifacts, imageHasGit } from "../container.js";
 import { deploymentLoginCommand } from "../box-shell.js";
-import { CRON_CAN_BE_EXTERNAL, WAKEUPS_WHEN_ASLEEP, residencyFor } from "../residency.js";
+import { WAKEUPS_WHEN_ASLEEP, residencyFor } from "../residency.js";
 function flyToml(appName, port, residency) {
     // WHY is residency.ts's to decide; the SETTING and its wording are Fly's. Anything else is an edit to the
     // generated file, which is the artifact's job.
     const min = residency
         ? `  min_machines_running = 1         # ${residency.why}`
         : `  min_machines_running = 0         # scale to zero — ${WAKEUPS_WHEN_ASLEEP}`;
-    // The one reason with a way out gets it stated NEXT TO the line it is about, which is where an operator reading
-    // `min_machines_running = 1` and wondering what it costs them is looking.
-    const alternative = residency?.reason === CRON_CAN_BE_EXTERNAL
-        ? `  # …or keep the time somewhere else and set this to 0: a scheduler you own (Fly Cron Manager,\n` +
-            `  # supercronic, GitHub Actions) calls \`POST /run\`, which runs one declared unit of work by name.\n` +
-            `  # It is an API, not a clock: read its contract first — docs/api-reference.md#post-run.\n` +
-            `  # At 0, ${WAKEUPS_WHEN_ASLEEP}.\n`
-        : "";
     // Suspend, not stop: a resume is fast enough that a webhook does not time out. Edit the line to change it.
     const stopLine = `  auto_stop_machines = "suspend"   # suspend on idle (fast resume on the next webhook)`;
     return `${GENERATED_FLY_TOML_MARKER}. Edit freely — it is not regenerated unless you pass --force.
@@ -35,10 +27,10 @@ primary_region = "iad"  # set your region (list: \`fly platform regions\`)
 ${stopLine}
   auto_start_machines = true
 ${min}
-${alternative}
+
 [mounts]
   source = "data"
-  destination = "/data"            # workspace, state and credentials survive stop/suspend/redeploy
+  destination = "/data"            # state and credentials survive stop/suspend/redeploy
   initial_size = "1gb"             # the volume is created by the FIRST deploy — it is pinned to one host, and only
                                    # deploy tells the scheduler which machine (size + image) must fit there too
 
@@ -55,8 +47,7 @@ export function isGeneratedFlyToml(content) {
 /** Compute the Fly deploy plan from the resolved definition. */
 export function planFlyDeploy(input) {
     const { appName, port, channels } = input;
-    // Artifacts sit under the agent prefix, so they never touch the workspace's own deploy files.
-    const flyTomlPath = `${input.agentPrefix}fly.toml`;
+    const flyTomlPath = "fly.toml";
     const artifacts = [
         {
             path: flyTomlPath,
@@ -65,7 +56,7 @@ export function planFlyDeploy(input) {
         ...containerArtifacts(input),
     ];
     const secrets = input.secrets ?? [];
-    const deployCmd = `fly deploy . --config ${flyTomlPath} --dockerfile ${input.agentPrefix}Dockerfile --app ${appName}`;
+    const deployCmd = `fly deploy . --config ${flyTomlPath} --dockerfile Dockerfile --app ${appName}`;
     const runbook = [
         `# Deploy "${appName}" to Fly.io. ${flyTomlPath} / Dockerfile(.dockerignore) are generated above.`,
         `# Prereqs: flyctl installed (https://fly.io/docs/flyctl/install) and \`fly auth login\`.`,
@@ -74,7 +65,7 @@ export function planFlyDeploy(input) {
         `# Fly app names are GLOBALLY unique: if this fails as taken, set a unique "app" in fly.toml and`,
         `# re-run \`fastagent deploy fly\` — the runbook follows fly.toml's app name.`,
         `fly apps create ${appName}`,
-        `# The volume (workspace, state, credentials — kept across stop/suspend/redeploy) is created by the deploy`,
+        `# The volume (definition, state, credentials — kept across stop/suspend/redeploy) is created by the deploy`,
         `# below, in primary_region and sized by [mounts].initial_size. Creating it yourself first pins it to a host`,
         `# picked without the machine, which can fail the deploy with "insufficient resources … existing volume".`,
         ``,
@@ -88,13 +79,13 @@ export function planFlyDeploy(input) {
     if (secrets.length > 0) {
         runbook.push(``, `# Secrets (replace each <value>):`, ...secrets.map((s) => `#   ${s.name}: ${s.hint}`), `fly secrets set --app ${appName} ${secrets.map((s) => `${s.name}=<value>`).join(" ")}`);
     }
-    runbook.push(``, `# The build context is the WORKSPACE ROOT (the whole directory is baked as the agent's cwd).`, `# The config/Dockerfile live under ${input.agentPrefix} so they never collide with the workspace's own.`, `# Before a new definition release, run \`fastagent deploy fly\` to refresh the release manifest.`, `# Run this from the workspace root:`, deployCmd);
-    runbook.push(``, `# The volume keeps /data/base (including uncommitted work), .state and .secrets across restarts and deploys.`, `# Each generated release replaces only /data/base/${input.agentPrefix}; other workspace files are initialized once.`, input.shipsGit
-        ? `# Git is available for optional collaboration. Verify uploaded history with \`git status\`; clone if the host stripped it.`
-        : `# To use Git for collaboration, add deploy: { apt: ["git"] }. Storage durability does not require Git.`);
+    runbook.push(``, `# The build context is the agent directory, baked as the definition.`, `# Before a new definition release, run \`fastagent deploy fly\` to refresh the release manifest.`, `# Run this from the agent directory:`, deployCmd);
+    runbook.push(``, `# The volume keeps .state and .secrets across restarts and deploys; each release replaces /data/definition.`, imageHasGit(input)
+        ? `# Git is installed (the definition ships its .git, github content is cloned here, or context.json declares it in aptPackages).`
+        : `# To give the agent git, declare it: fastagent env add apt:git`);
     // The credential is created on the box, never carried: the box is then the only holder of its grant.
     if (input.boxLogin) {
-        runbook.push(``, `# Model auth: once it is up, the deployment logs in to ${input.boxLogin} itself (from this workspace):`, `${deploymentLoginCommand("fly", input.boxLogin)}`);
+        runbook.push(``, `# Model auth: once it is up, the deployment logs in to ${input.boxLogin} itself (from the agent directory):`, `${deploymentLoginCommand("fly", input.boxLogin)}`);
     }
     // The fastagent-only post-step: point each channel at the live URL.
     const steps = webhookRunbook(`https://${appName}.fly.dev`, channels);

package/dist/deploy/fly/run.d.ts

@@ -9,22 +9,26 @@ export interface FlyRunPlan {
     secrets: Record<string, string>;
     /** Declared names the value file supplies no value for — the run gates on these before any side effect. */
     missingSecrets: string[];
-    /** That value file, workspace-relative, so the gate names the file this deploy actually read. */
+    /** That value file, agent-dir-relative, so the gate names the file this deploy actually read. */
     valueFile: string;
     /** Every declared channel and its ingress — the driver asks which of them have a webhook. */
     channels: readonly DeclaredChannel[];
-    /** fly.toml path passed to `fly deploy -c` (relative to the run cwd = the workspace root). */
+    /** fly.toml path passed to `fly deploy -c` (relative to the run cwd = the agent directory). */
     flyConfig: string;
-    /**
-     * Dockerfile path passed explicitly (`fastagent/Dockerfile`, with the workspace as context — flyctl would otherwise
-     * resolve it relative to the config's own directory).
-     */
+    /** Dockerfile path passed explicitly, relative to the run cwd (the build context). */
     dockerfile: string;
     /**
      * Log the box in (`fastagent login --deployment`) once it is up and before any webhook is pointed at it: a channel pointed at
      * a box with no model credential answers every message with a failure. Resolves a gate line, or undefined.
      */
     boxLogin?: BoxLoginStep;
+    /**
+     * Sign the host's CLI in when it is signed out, through whoever can (host-login.ts): resolves a gate line, or
+     * undefined once signed in. Absent: nobody can, and the run stops naming how.
+     */
+    hostLogin?: () => Promise<string | undefined>;
+    /** The command a coding agent runs to deploy this, its person's steps handed to its user (`--run --json`). */
+    forAgent: string;
 }
 /** Done, or a gate the operator must clear before re-running (printed + non-zero exit by the CLI). */
 export type FlyRunOutcome = {

package/dist/deploy/fly/run.js

@@ -1,6 +1,6 @@
 import { loginGate, publicHealthGate, registerWebhooks, } from "../channel-ingress.js";
 import { readOutput } from "../runner.js";
-import { missingValuesGate } from "../secrets.js";
+import { hostSignedOutGate, missingValuesGate } from "../secrets.js";
 /**
  * The `Type` values that put an app on `https://<app>.fly.dev`, BY FAMILY — one entry per allocate command, because
  * that is the granularity the answer is acted on at.
@@ -30,14 +30,19 @@ export function listHasName(stdout, name) {
 }
 export async function deployFlyRun(plan, fly, log, registrars, healthProbe) {
     const gate = (g) => ({ ok: false, gate: g });
-    // 1.
-    if ((await fly(["auth", "whoami"], { capture: true })).code !== 0) {
-        return gate("not logged in to Fly — run `fly auth login` (opens a browser), or set FLY_API_TOKEN, then re-run");
-    }
-    // 2. Gate missing required secret VALUES before any side effect (no half-created infra).
+    // 1. Gate missing required secret VALUES before any side effect (no half-created infra), and before asking a
+    // person to sign in for a deploy that would stop here anyway.
     const missingValues = missingValuesGate(plan.missingSecrets, plan.valueFile);
     if (missingValues)
         return gate(missingValues);
+    // 2.
+    if ((await fly(["auth", "whoami"], { capture: true })).code !== 0) {
+        const failed = plan.hostLogin
+            ? await plan.hostLogin()
+            : hostSignedOutGate("Fly", "fly auth login", "FLY_API_TOKEN", plan.forAgent);
+        if (failed)
+            return gate(failed);
+    }
     // 3.
     const appExists = await readOutput(fly, "fly", ["apps", "list", "--json"], (out) => listHasName(out, plan.appName));
     if ("gate" in appExists)

package/dist/deploy/hosts.d.ts

@@ -8,7 +8,8 @@
  * Three edits: a directory beside this file (copy `fly/`: `plan.ts` pure, `run.ts` driving the host
  * CLI behind the runner seam), its `HostDeploy` in `cli/commands/deploy/<host>.ts` (kept-file
  * semantics, gates, the drive glue — the half that may exit the process), and its name in the array
- * below. `deploy/` itself is a neutral kernel plus one directory per host; nothing host-specific
+ * below. Locally known refusals belong in `HostDeploy.validate`: the dispatcher runs it before app onboarding
+ * and again on the facts onboarding produces. `deploy/` itself is a neutral kernel plus one directory per host; nothing host-specific
  * belongs in the kernel, and no host may hold a fact about another one (a host-only flag is a row in
  * `HOST_ONLY_FLAGS` in `cli/commands/deploy.ts`, warning elsewhere; `--tunnel` stays a usage GATE in `runDeploy`
  * because a refusal is not a row).

package/dist/deploy/hosts.js

@@ -8,7 +8,8 @@
  * Three edits: a directory beside this file (copy `fly/`: `plan.ts` pure, `run.ts` driving the host
  * CLI behind the runner seam), its `HostDeploy` in `cli/commands/deploy/<host>.ts` (kept-file
  * semantics, gates, the drive glue — the half that may exit the process), and its name in the array
- * below. `deploy/` itself is a neutral kernel plus one directory per host; nothing host-specific
+ * below. Locally known refusals belong in `HostDeploy.validate`: the dispatcher runs it before app onboarding
+ * and again on the facts onboarding produces. `deploy/` itself is a neutral kernel plus one directory per host; nothing host-specific
  * belongs in the kernel, and no host may hold a fact about another one (a host-only flag is a row in
  * `HOST_ONLY_FLAGS` in `cli/commands/deploy.ts`, warning elsewhere; `--tunnel` stays a usage GATE in `runDeploy`
  * because a refusal is not a row).

package/dist/deploy/preflight.d.ts

@@ -1,7 +1,6 @@
-import { type FastagentConfig } from "../engines/pi/config.ts";
-import { type ResolvedPlacement } from "../paths.ts";
+import type { AgentConfig } from "../harnesses/pi-durable/define.ts";
 import { type DeclaredChannel } from "../channels/discover.ts";
-import { type DeclaredSecret } from "../declared-secrets.ts";
+import type { DeclaredSecret } from "../declared-secrets.ts";
 import { type ContainerInput } from "./container.ts";
 import { type DeploymentSecret } from "./secrets.ts";
 /** A stderr line the CLI prints (`[fastagent] warn: …` / `[fastagent] note: …`). */
@@ -14,31 +13,27 @@ interface DeployFacts {
     messages: DeployMessage[];
     /** Every declared channel with the ingress its module shape says it has, custom ones included. */
     channels: DeclaredChannel[];
-    /**
-     * `routines/` declares at least one cron — the one residency reason with an external substitute: `POST /run` lets
-     * someone else's clock run a declared routine, so an operator who wants scale-to-zero has an option here.
-     */
+    /** `src/schedules/` declares at least one schedule. */
     hasCron: boolean;
     /**
      * The deployed environment's declaration, read ONCE here so the plan side and the run side cannot disagree about
      * what this deployment carries. The environment running `deploy` is deliberately absent from it (§9).
      */
     values: ReadonlyMap<string, string>;
-    /** That file, workspace-relative — the name every "set it here" message must use. */
+    /** That file, agent-dir-relative — the name every "set it here" message must use. */
     valueFile: string;
     /**
-     * The variable the value file carries the model's key in (the provider's own, or a models.json `"$NAME"`), or
-     * undefined when no key travels that way ({@link credentialRoute}).
+     * The variable the value file carries the model's key in, or undefined when no key travels that way
+     * ({@link credentialRoute}).
      */
     modelAuth: string | undefined;
     /**
      * The provider the deployment must log in to itself (`fastagent login --deployment`): the model's credential does
-     * not travel, because it is neither a variable in the value file nor carried by the definition (a models.json
-     * literal `apiKey` or `!command`). Nothing from this machine's credentials file is ever copied, so a login on the
-     * box is its only holder.
+     * not travel, because it is neither a variable in the value file nor resolved by the definition's own provider code.
+     * Nothing from this machine's credentials file is ever copied, so a login on the box is its only holder.
      */
     boxLogin: string | undefined;
-    /** Every tool/routine/channel declaration — the names the value file must supply, by declaring file. */
+    /** Every declaration the definition makes — the names the value file must supply, by declaring file. */
     declaredSecrets: DeclaredSecret[];
     /** The runbook's variable list: the declared names, then everything else the value file carries. */
     secrets: DeploymentSecret[];
@@ -63,21 +58,24 @@ export interface DeployReport {
     issue(text: string): void;
 }
 interface PreflightInput {
-    placement: ResolvedPlacement;
-    config: FastagentConfig;
+    agentDir: string;
+    config: AgentConfig;
     /** `--run` fully deploys, so a definition that resolves NO model is a GATE (a known crash-loop); else it warns. */
     run: boolean;
     /** `--force` regenerates the artifacts fastagent OWNS, so a kept `.dockerignore`'s content checks do not apply. */
     force: boolean;
-    /** The target delivers cron slots from an external clock and holds no resident process (AgentCore). */
-    externalClock?: boolean;
     /**
-     * Does this target publish the serve at a URL anyone can dial? True for every host that mints one (Fly, Railway,
-     * a Docker box); false for AgentCore, where the container is reachable only through the Runtime's IAM and the
-     * forwarder's shared secret. Kept apart from {@link externalClock} on purpose — they happen to agree on AgentCore
-     * today, and answering two questions with one boolean is how the answer to one of them goes wrong later.
+     * The target holds no resident process (AgentCore): what wakes it is outside it (webhooks, alarms), so the notes
+     * about keeping one machine running do not apply.
+     */
+    noResidentProcess?: boolean;
+    /**
+     * Does every deployment start this host's storage over (AgentCore)? Then a clone the instance made, and anything the
+     * agent did in it, does not outlive a release. Its own question, apart from {@link noResidentProcess}.
      */
-    publicUrl?: boolean;
+    storageResets?: boolean;
+    /** Does this deployment serve the Agent API under `/v1` (deploy/api.ts)? Then a Caller with its key reaches it. */
+    servesApi?: boolean;
 }
 /** Run the host-neutral pre-flight. */
 export declare function preflightDeploy(input: PreflightInput): Promise<DeployPreflight>;