@forgezero/agent 0.1.117 → 0.1.119

package/README.md

@@ -5,7 +5,7 @@
   and commit the generator and rendered files together.
 -->
 
-# @forgezero/agent
+# Compute Agent and CLI
 
 The node agent deploys on a compute; tenant mode also holds one complete project across environments in RAM and serves it over a group-scoped unix socket, while platform mode never duplicates the API vault.
 
@@ -99,8 +99,12 @@ export default defineDeployment({
 	  resources: { cpuCores: input.ref('cpuCores'), memoryMiB: input.ref('memoryMiB'), storageGiB: input.ref('storageGiB') },
 	  os: 'ubuntu-24.04', runtime: 'oci-runc', sharing: 'shared', reuse: 'prefer',
 	  provisioning: {
-	    planKey: 'app-small', regionKey: 'default', imageKey: 'ubuntu-24.04-x64',
-	    environmentKey: 'production', ownership: 'platform', maxMonthlySpendMinor: '25000'
+	    regionKey: 'default', imageKey: 'ubuntu-24.04-x64', environmentKey: 'production', ownership: 'platform',
+	    resources: {
+	      physicalCores: 1, vcpu: 2, memoryGib: 2, diskGib: 16,
+	      egressGuaranteedMbps: 100, egressBurstMbps: 200, confidential: false
+	    },
+	    monthlyAmountCents: '1200', maxMonthlySpendMinor: '25000'
 	  },
 	  connectivity: {
 	    private: { mode: 'private-lan' },

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.117";
+var VERSION3 = "0.1.119";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.117";
+var VERSION = "0.1.119";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/community-rehearsal-host.js

@@ -55,24 +55,31 @@ var OS_CATALOG = [
   }
 ];
 var SOFTWARE_CATALOG = [
-  { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "docker", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "containerd", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "kata-containers", version: "4.0.0", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "nginx", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "arangodb", version: "3.11.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "cloudflare-warp", version: "2026.6.822.0-min", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "docker", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "containerd", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "nginx", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "ufw", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "openssh-client", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+  { id: "bun", version: "1.3.14", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "kata-containers", version: "4.0.0", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "arangodb", version: "3.11.14", billingClass: "paid-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflared", version: "2026.7.3", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflare-warp", version: "2026.6.822.0-min", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
 ];
+var softwareBillingClass = (requirement) => {
+  const entry = SOFTWARE_CATALOG.find((candidate) => candidate.id === requirement.id && candidate.version === requirement.version);
+  if (!entry)
+    throw new Error(`unsupported software billing coordinate: ${requirement.id}@${requirement.version}`);
+  return entry.billingClass;
+};
+var countPaidManagedSoftware = (requirements) => new Set(requirements.filter((requirement) => softwareBillingClass(requirement) === "paid-managed").map((requirement) => `${requirement.id}@${requirement.version}`)).size;
 var UBUNTU_2604_X64 = [
   { requirement: { id: "bun", version: "1.3.14" } },
   { requirement: { id: "docker", version: "ubuntu-26.04" } },

package/dist/definition.js

@@ -55,24 +55,31 @@ var OS_CATALOG = [
   }
 ];
 var SOFTWARE_CATALOG = [
-  { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "docker", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "containerd", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "kata-containers", version: "4.0.0", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "nginx", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "arangodb", version: "3.11.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "cloudflare-warp", version: "2026.6.822.0-min", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "docker", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "containerd", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "nginx", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "ufw", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "openssh-client", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+  { id: "bun", version: "1.3.14", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "kata-containers", version: "4.0.0", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "arangodb", version: "3.11.14", billingClass: "paid-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflared", version: "2026.7.3", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflare-warp", version: "2026.6.822.0-min", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
 ];
+var softwareBillingClass = (requirement) => {
+  const entry = SOFTWARE_CATALOG.find((candidate) => candidate.id === requirement.id && candidate.version === requirement.version);
+  if (!entry)
+    throw new Error(`unsupported software billing coordinate: ${requirement.id}@${requirement.version}`);
+  return entry.billingClass;
+};
+var countPaidManagedSoftware = (requirements) => new Set(requirements.filter((requirement) => softwareBillingClass(requirement) === "paid-managed").map((requirement) => `${requirement.id}@${requirement.version}`)).size;
 var UBUNTU_2604_X64 = [
   { requirement: { id: "bun", version: "1.3.14" } },
   { requirement: { id: "docker", version: "ubuntu-26.04" } },

package/dist/deploy-compiler.d.ts

@@ -10,12 +10,21 @@ export interface DeploymentCompilation {
 }
 export type DeploymentInitRuntime = 'native' | 'containerd' | 'kata-snp';
 export interface DeploymentInitProvisioning {
-    planKey: string;
     regionKey: string;
     imageKey: string;
     environmentKey: string;
     ownership: 'platform' | 'tenant-metal';
     metalHostname?: string;
+    resources: {
+        physicalCores: number;
+        vcpu: number;
+        memoryGib: number;
+        diskGib: number;
+        egressGuaranteedMbps: number;
+        egressBurstMbps: number;
+        confidential: boolean;
+    };
+    monthlyAmountCents: string;
     maxMonthlySpendMinor: string;
 }
 export interface DeploymentInitOptions {

package/dist/deploy-compiler.js

@@ -910,13 +910,30 @@ function compileDeployment(sourceValue) {
       fail(`deployment.spec.targets.${targetName}.allocation.execution`, "cannot satisfy required confidential compute.");
     if (target.provisioning !== undefined) {
       const provisioning = object(target.provisioning, `deployment.spec.targets.${targetName}.provisioning`);
-      exact3(provisioning, ["planKey", "regionKey", "imageKey", "environmentKey", "ownership", "metalHostname", "maxMonthlySpendMinor"], `deployment.spec.targets.${targetName}.provisioning`);
-      for (const key of ["planKey", "regionKey", "imageKey", "environmentKey"])
+      exact3(provisioning, ["regionKey", "imageKey", "environmentKey", "ownership", "metalHostname", "resources", "monthlyAmountCents", "maxMonthlySpendMinor"], `deployment.spec.targets.${targetName}.provisioning`);
+      for (const key of ["regionKey", "imageKey", "environmentKey"])
         named(provisioning[key], `deployment.spec.targets.${targetName}.provisioning.${key}`);
       if (!["platform", "tenant-metal"].includes(String(provisioning.ownership)) || provisioning.ownership === "tenant-metal" !== Boolean(provisioning.metalHostname))
         fail(`deployment.spec.targets.${targetName}.provisioning.ownership`, "must bind platform capacity or one tenant metal hostname.");
       if (provisioning.metalHostname !== undefined && !/^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?$/.test(String(provisioning.metalHostname)))
         fail(`deployment.spec.targets.${targetName}.provisioning.metalHostname`, "is invalid.");
+      const provisionedResources = object(provisioning.resources, `deployment.spec.targets.${targetName}.provisioning.resources`);
+      exact3(provisionedResources, ["physicalCores", "vcpu", "memoryGib", "diskGib", "egressGuaranteedMbps", "egressBurstMbps", "confidential"], `deployment.spec.targets.${targetName}.provisioning.resources`);
+      integer(provisionedResources.physicalCores, `deployment.spec.targets.${targetName}.provisioning.resources.physicalCores`, 1, 1024);
+      integer(provisionedResources.vcpu, `deployment.spec.targets.${targetName}.provisioning.resources.vcpu`, 1, 4096);
+      integer(provisionedResources.memoryGib, `deployment.spec.targets.${targetName}.provisioning.resources.memoryGib`, 1, 4194304);
+      integer(provisionedResources.diskGib, `deployment.spec.targets.${targetName}.provisioning.resources.diskGib`, 1, 1048576);
+      integer(provisionedResources.egressGuaranteedMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressGuaranteedMbps`, 0, 1e7);
+      integer(provisionedResources.egressBurstMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressBurstMbps`, Number(provisionedResources.egressGuaranteedMbps), 1e7);
+      if (typeof provisionedResources.confidential !== "boolean")
+        fail(`deployment.spec.targets.${targetName}.provisioning.resources.confidential`, "must be boolean.");
+      if (typeof capacity.cpuCores === "number" && Number(provisionedResources.vcpu) < capacity.cpuCores || typeof capacity.memoryMiB === "number" && Number(provisionedResources.memoryGib) * 1024 < capacity.memoryMiB || typeof capacity.storageGiB === "number" && Number(provisionedResources.diskGib) < capacity.storageGiB) {
+        fail(`deployment.spec.targets.${targetName}.provisioning.resources`, "must satisfy the per-slot allocation minimum.");
+      }
+      if ((selector.confidentialCompute === "required" || allocation.execution === "oci-kata-qemu-snp") && provisionedResources.confidential !== true)
+        fail(`deployment.spec.targets.${targetName}.provisioning.resources.confidential`, "must be true for confidential execution.");
+      if (typeof provisioning.monthlyAmountCents !== "string" || !/^\d{1,18}$/.test(provisioning.monthlyAmountCents))
+        fail(`deployment.spec.targets.${targetName}.provisioning.monthlyAmountCents`, "must be a bounded USD-cent amount.");
       if (typeof provisioning.maxMonthlySpendMinor !== "string" || !/^\d{1,18}$/.test(provisioning.maxMonthlySpendMinor))
         fail(`deployment.spec.targets.${targetName}.provisioning.maxMonthlySpendMinor`, "must be a bounded decimal minor-unit amount.");
     }
@@ -1266,13 +1283,24 @@ function initCoordinates(options) {
     throw new Error("reuse require cannot include provisioning coordinates");
   if (options.provisioning !== undefined) {
     for (const [label, value] of Object.entries({
-      plan: options.provisioning.planKey,
       region: options.provisioning.regionKey,
       image: options.provisioning.imageKey,
       environment: options.provisioning.environmentKey
     }))
       if (!/^[a-z][a-z0-9-]{0,62}$/.test(value))
         throw new Error(`deployment provisioning ${label} must be a lowercase typed name`);
+    const resources = options.provisioning.resources;
+    for (const [label, value] of Object.entries(resources).filter(([key]) => key !== "confidential")) {
+      if (!Number.isSafeInteger(value) || Number(value) < 0)
+        throw new Error(`deployment provisioning ${label} must be a non-negative integer`);
+    }
+    if (resources.physicalCores < 1 || resources.vcpu < result.cpuCores || resources.memoryGib * 1024 < result.memoryMiB || resources.diskGib < result.storageGiB || resources.egressBurstMbps < resources.egressGuaranteedMbps) {
+      throw new Error("deployment provisioning resources must satisfy the target allocation and bandwidth bounds");
+    }
+    if (result.isolation === "sev-snp" && !resources.confidential)
+      throw new Error("deployment provisioning must provide confidential capacity for sev-snp");
+    if (!/^\d{1,18}$/.test(options.provisioning.monthlyAmountCents))
+      throw new Error("deployment provisioning monthly amount must be a bounded USD-cent amount");
     if (!/^\d{1,18}$/.test(options.provisioning.maxMonthlySpendMinor))
       throw new Error("deployment provisioning monthly spend must be a bounded decimal minor-unit amount");
     if (options.provisioning.ownership === "tenant-metal" && !options.provisioning.metalHostname)
@@ -1289,7 +1317,7 @@ function defaultTypeScriptDeployment(name, options = {}) {
   const execution = selected.runtime === "native" ? "native" : selected.runtime === "containerd" ? "oci-runc" : "oci-kata-qemu-snp";
   const hostPackageVersion = selected.operatingSystem === "ubuntu-24.04" ? "ubuntu-24.04" : "ubuntu-26.04";
   const provisioningBlock = selected.provisioning === undefined ? "" : `,
-				provisioning: { planKey: '${selected.provisioning.planKey}', regionKey: '${selected.provisioning.regionKey}', imageKey: '${selected.provisioning.imageKey}', environmentKey: '${selected.provisioning.environmentKey}', ownership: '${selected.provisioning.ownership}',${selected.provisioning.metalHostname ? ` metalHostname: '${selected.provisioning.metalHostname}',` : ""} maxMonthlySpendMinor: '${selected.provisioning.maxMonthlySpendMinor}' }`;
+				provisioning: { regionKey: '${selected.provisioning.regionKey}', imageKey: '${selected.provisioning.imageKey}', environmentKey: '${selected.provisioning.environmentKey}', ownership: '${selected.provisioning.ownership}',${selected.provisioning.metalHostname ? ` metalHostname: '${selected.provisioning.metalHostname}',` : ""} resources: ${JSON.stringify(selected.provisioning.resources)}, monthlyAmountCents: '${selected.provisioning.monthlyAmountCents}', maxMonthlySpendMinor: '${selected.provisioning.maxMonthlySpendMinor}' }`;
   const requirementBlock = selected.runtime === "native" ? `bun: providers.bun.require()` : selected.runtime === "containerd" ? `containerd: providers.containerd.require({ version: '${hostPackageVersion}' }),
 			nginx: providers.nginx.require({ version: '${hostPackageVersion}' })` : `containerd: providers.containerd.require(),
 			kata: providers.kata.require(),

package/dist/deploy-file.js

@@ -55,24 +55,31 @@ var OS_CATALOG = [
   }
 ];
 var SOFTWARE_CATALOG = [
-  { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "docker", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "containerd", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "kata-containers", version: "4.0.0", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "nginx", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "arangodb", version: "3.11.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "cloudflare-warp", version: "2026.6.822.0-min", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "docker", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "containerd", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "nginx", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "ufw", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "openssh-client", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+  { id: "bun", version: "1.3.14", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "kata-containers", version: "4.0.0", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "arangodb", version: "3.11.14", billingClass: "paid-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflared", version: "2026.7.3", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflare-warp", version: "2026.6.822.0-min", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
 ];
+var softwareBillingClass = (requirement) => {
+  const entry = SOFTWARE_CATALOG.find((candidate) => candidate.id === requirement.id && candidate.version === requirement.version);
+  if (!entry)
+    throw new Error(`unsupported software billing coordinate: ${requirement.id}@${requirement.version}`);
+  return entry.billingClass;
+};
+var countPaidManagedSoftware = (requirements) => new Set(requirements.filter((requirement) => softwareBillingClass(requirement) === "paid-managed").map((requirement) => `${requirement.id}@${requirement.version}`)).size;
 var UBUNTU_2604_X64 = [
   { requirement: { id: "bun", version: "1.3.14" } },
   { requirement: { id: "docker", version: "ubuntu-26.04" } },

package/dist/deploy-plan-runner.js

@@ -910,13 +910,30 @@ function compileDeployment(sourceValue) {
       fail(`deployment.spec.targets.${targetName}.allocation.execution`, "cannot satisfy required confidential compute.");
     if (target.provisioning !== undefined) {
       const provisioning = object(target.provisioning, `deployment.spec.targets.${targetName}.provisioning`);
-      exact3(provisioning, ["planKey", "regionKey", "imageKey", "environmentKey", "ownership", "metalHostname", "maxMonthlySpendMinor"], `deployment.spec.targets.${targetName}.provisioning`);
-      for (const key of ["planKey", "regionKey", "imageKey", "environmentKey"])
+      exact3(provisioning, ["regionKey", "imageKey", "environmentKey", "ownership", "metalHostname", "resources", "monthlyAmountCents", "maxMonthlySpendMinor"], `deployment.spec.targets.${targetName}.provisioning`);
+      for (const key of ["regionKey", "imageKey", "environmentKey"])
         named(provisioning[key], `deployment.spec.targets.${targetName}.provisioning.${key}`);
       if (!["platform", "tenant-metal"].includes(String(provisioning.ownership)) || provisioning.ownership === "tenant-metal" !== Boolean(provisioning.metalHostname))
         fail(`deployment.spec.targets.${targetName}.provisioning.ownership`, "must bind platform capacity or one tenant metal hostname.");
       if (provisioning.metalHostname !== undefined && !/^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?$/.test(String(provisioning.metalHostname)))
         fail(`deployment.spec.targets.${targetName}.provisioning.metalHostname`, "is invalid.");
+      const provisionedResources = object(provisioning.resources, `deployment.spec.targets.${targetName}.provisioning.resources`);
+      exact3(provisionedResources, ["physicalCores", "vcpu", "memoryGib", "diskGib", "egressGuaranteedMbps", "egressBurstMbps", "confidential"], `deployment.spec.targets.${targetName}.provisioning.resources`);
+      integer(provisionedResources.physicalCores, `deployment.spec.targets.${targetName}.provisioning.resources.physicalCores`, 1, 1024);
+      integer(provisionedResources.vcpu, `deployment.spec.targets.${targetName}.provisioning.resources.vcpu`, 1, 4096);
+      integer(provisionedResources.memoryGib, `deployment.spec.targets.${targetName}.provisioning.resources.memoryGib`, 1, 4194304);
+      integer(provisionedResources.diskGib, `deployment.spec.targets.${targetName}.provisioning.resources.diskGib`, 1, 1048576);
+      integer(provisionedResources.egressGuaranteedMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressGuaranteedMbps`, 0, 1e7);
+      integer(provisionedResources.egressBurstMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressBurstMbps`, Number(provisionedResources.egressGuaranteedMbps), 1e7);
+      if (typeof provisionedResources.confidential !== "boolean")
+        fail(`deployment.spec.targets.${targetName}.provisioning.resources.confidential`, "must be boolean.");
+      if (typeof capacity.cpuCores === "number" && Number(provisionedResources.vcpu) < capacity.cpuCores || typeof capacity.memoryMiB === "number" && Number(provisionedResources.memoryGib) * 1024 < capacity.memoryMiB || typeof capacity.storageGiB === "number" && Number(provisionedResources.diskGib) < capacity.storageGiB) {
+        fail(`deployment.spec.targets.${targetName}.provisioning.resources`, "must satisfy the per-slot allocation minimum.");
+      }
+      if ((selector.confidentialCompute === "required" || allocation.execution === "oci-kata-qemu-snp") && provisionedResources.confidential !== true)
+        fail(`deployment.spec.targets.${targetName}.provisioning.resources.confidential`, "must be true for confidential execution.");
+      if (typeof provisioning.monthlyAmountCents !== "string" || !/^\d{1,18}$/.test(provisioning.monthlyAmountCents))
+        fail(`deployment.spec.targets.${targetName}.provisioning.monthlyAmountCents`, "must be a bounded USD-cent amount.");
       if (typeof provisioning.maxMonthlySpendMinor !== "string" || !/^\d{1,18}$/.test(provisioning.maxMonthlySpendMinor))
         fail(`deployment.spec.targets.${targetName}.provisioning.maxMonthlySpendMinor`, "must be a bounded decimal minor-unit amount.");
     }

package/dist/deploy-plan.js

@@ -910,13 +910,30 @@ function compileDeployment(sourceValue) {
       fail(`deployment.spec.targets.${targetName}.allocation.execution`, "cannot satisfy required confidential compute.");
     if (target.provisioning !== undefined) {
       const provisioning = object(target.provisioning, `deployment.spec.targets.${targetName}.provisioning`);
-      exact3(provisioning, ["planKey", "regionKey", "imageKey", "environmentKey", "ownership", "metalHostname", "maxMonthlySpendMinor"], `deployment.spec.targets.${targetName}.provisioning`);
-      for (const key of ["planKey", "regionKey", "imageKey", "environmentKey"])
+      exact3(provisioning, ["regionKey", "imageKey", "environmentKey", "ownership", "metalHostname", "resources", "monthlyAmountCents", "maxMonthlySpendMinor"], `deployment.spec.targets.${targetName}.provisioning`);
+      for (const key of ["regionKey", "imageKey", "environmentKey"])
         named(provisioning[key], `deployment.spec.targets.${targetName}.provisioning.${key}`);
       if (!["platform", "tenant-metal"].includes(String(provisioning.ownership)) || provisioning.ownership === "tenant-metal" !== Boolean(provisioning.metalHostname))
         fail(`deployment.spec.targets.${targetName}.provisioning.ownership`, "must bind platform capacity or one tenant metal hostname.");
       if (provisioning.metalHostname !== undefined && !/^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?$/.test(String(provisioning.metalHostname)))
         fail(`deployment.spec.targets.${targetName}.provisioning.metalHostname`, "is invalid.");
+      const provisionedResources = object(provisioning.resources, `deployment.spec.targets.${targetName}.provisioning.resources`);
+      exact3(provisionedResources, ["physicalCores", "vcpu", "memoryGib", "diskGib", "egressGuaranteedMbps", "egressBurstMbps", "confidential"], `deployment.spec.targets.${targetName}.provisioning.resources`);
+      integer(provisionedResources.physicalCores, `deployment.spec.targets.${targetName}.provisioning.resources.physicalCores`, 1, 1024);
+      integer(provisionedResources.vcpu, `deployment.spec.targets.${targetName}.provisioning.resources.vcpu`, 1, 4096);
+      integer(provisionedResources.memoryGib, `deployment.spec.targets.${targetName}.provisioning.resources.memoryGib`, 1, 4194304);
+      integer(provisionedResources.diskGib, `deployment.spec.targets.${targetName}.provisioning.resources.diskGib`, 1, 1048576);
+      integer(provisionedResources.egressGuaranteedMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressGuaranteedMbps`, 0, 1e7);
+      integer(provisionedResources.egressBurstMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressBurstMbps`, Number(provisionedResources.egressGuaranteedMbps), 1e7);
+      if (typeof provisionedResources.confidential !== "boolean")
+        fail(`deployment.spec.targets.${targetName}.provisioning.resources.confidential`, "must be boolean.");
+      if (typeof capacity.cpuCores === "number" && Number(provisionedResources.vcpu) < capacity.cpuCores || typeof capacity.memoryMiB === "number" && Number(provisionedResources.memoryGib) * 1024 < capacity.memoryMiB || typeof capacity.storageGiB === "number" && Number(provisionedResources.diskGib) < capacity.storageGiB) {
+        fail(`deployment.spec.targets.${targetName}.provisioning.resources`, "must satisfy the per-slot allocation minimum.");
+      }
+      if ((selector.confidentialCompute === "required" || allocation.execution === "oci-kata-qemu-snp") && provisionedResources.confidential !== true)
+        fail(`deployment.spec.targets.${targetName}.provisioning.resources.confidential`, "must be true for confidential execution.");
+      if (typeof provisioning.monthlyAmountCents !== "string" || !/^\d{1,18}$/.test(provisioning.monthlyAmountCents))
+        fail(`deployment.spec.targets.${targetName}.provisioning.monthlyAmountCents`, "must be a bounded USD-cent amount.");
       if (typeof provisioning.maxMonthlySpendMinor !== "string" || !/^\d{1,18}$/.test(provisioning.maxMonthlySpendMinor))
         fail(`deployment.spec.targets.${targetName}.provisioning.maxMonthlySpendMinor`, "must be a bounded decimal minor-unit amount.");
     }

package/dist/deploy.d.ts

@@ -185,12 +185,21 @@ export interface TargetDefinition {
     };
     /** Required only when the control plane may create capacity after reuse is exhausted. */
     provisioning?: {
-        planKey: string;
         regionKey: string;
         imageKey: string;
         environmentKey: string;
         ownership: 'platform' | 'tenant-metal';
         metalHostname?: string;
+        resources: {
+            physicalCores: number;
+            vcpu: number;
+            memoryGib: number;
+            diskGib: number;
+            egressGuaranteedMbps: number;
+            egressBurstMbps: number;
+            confidential: boolean;
+        };
+        monthlyAmountCents: string;
         maxMonthlySpendMinor: string;
     };
     /** Per-slot connectivity intent. Credential names resolve through the scoped Vault, never to plan values. */

package/dist/deployment.d.ts

@@ -1,6 +1,6 @@
 import { type DrainReport, type QueueTask } from '@forgezero/runtime/queue';
 import { type GitHostResolver } from './git-egress';
-import type { SoftwareRequirement } from './software';
+import { type SoftwareRequirement } from './software';
 import type { DeploymentService } from './definition';
 import type { ServiceActivationState } from './service-supervisor';
 import type { ContainerActivateRequest, ContainerBuildRequest, ContainerBuildResult } from './container-supervisor';
@@ -74,6 +74,8 @@ export interface DeploymentResult {
     profile: string;
     /** Resolved only from the validated plan and its bounded inputs at this revision. */
     resolvedTargets?: readonly ResolvedDeploymentTarget[];
+    /** Distinct paid catalogue entries successfully managed on this compute. */
+    paidManagedSoftwareCount: number;
     release: string;
     ok: boolean;
     phases: readonly RunResult[];
@@ -123,12 +125,21 @@ export interface ResolvedDeploymentTarget {
         existing: 'prefer' | 'require';
     };
     provisioning?: {
-        planKey: string;
         regionKey: string;
         imageKey: string;
         environmentKey: string;
         ownership: 'platform' | 'tenant-metal';
         metalHostname?: string;
+        resources: {
+            physicalCores: number;
+            vcpu: number;
+            memoryGib: number;
+            diskGib: number;
+            egressGuaranteedMbps: number;
+            egressBurstMbps: number;
+            confidential: boolean;
+        };
+        monthlyAmountCents: string;
         maxMonthlySpendMinor: string;
     };
     connectivity?: {