@forgezero/agent 0.1.117 → 0.1.119

package/dist/fz-agent.js

@@ -5051,24 +5051,31 @@ var OS_CATALOG = [
   }
 ];
 var SOFTWARE_CATALOG = [
-  { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "docker", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "containerd", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "kata-containers", version: "4.0.0", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "nginx", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "arangodb", version: "3.11.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "cloudflare-warp", version: "2026.6.822.0-min", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "docker", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "containerd", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "nginx", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "ufw", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "openssh-client", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+  { id: "bun", version: "1.3.14", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "kata-containers", version: "4.0.0", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "arangodb", version: "3.11.14", billingClass: "paid-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflared", version: "2026.7.3", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflare-warp", version: "2026.6.822.0-min", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
 ];
+var softwareBillingClass = (requirement) => {
+  const entry = SOFTWARE_CATALOG.find((candidate) => candidate.id === requirement.id && candidate.version === requirement.version);
+  if (!entry)
+    throw new Error(`unsupported software billing coordinate: ${requirement.id}@${requirement.version}`);
+  return entry.billingClass;
+};
+var countPaidManagedSoftware = (requirements) => new Set(requirements.filter((requirement) => softwareBillingClass(requirement) === "paid-managed").map((requirement) => `${requirement.id}@${requirement.version}`)).size;
 var UBUNTU_2604_X64 = [
   { requirement: { id: "bun", version: "1.3.14" } },
   { requirement: { id: "docker", version: "ubuntu-26.04" } },
@@ -7160,13 +7167,30 @@ function compileDeployment(sourceValue) {
       fail(`deployment.spec.targets.${targetName}.allocation.execution`, "cannot satisfy required confidential compute.");
     if (target.provisioning !== undefined) {
       const provisioning = object(target.provisioning, `deployment.spec.targets.${targetName}.provisioning`);
-      exact3(provisioning, ["planKey", "regionKey", "imageKey", "environmentKey", "ownership", "metalHostname", "maxMonthlySpendMinor"], `deployment.spec.targets.${targetName}.provisioning`);
-      for (const key of ["planKey", "regionKey", "imageKey", "environmentKey"])
+      exact3(provisioning, ["regionKey", "imageKey", "environmentKey", "ownership", "metalHostname", "resources", "monthlyAmountCents", "maxMonthlySpendMinor"], `deployment.spec.targets.${targetName}.provisioning`);
+      for (const key of ["regionKey", "imageKey", "environmentKey"])
         named(provisioning[key], `deployment.spec.targets.${targetName}.provisioning.${key}`);
       if (!["platform", "tenant-metal"].includes(String(provisioning.ownership)) || provisioning.ownership === "tenant-metal" !== Boolean(provisioning.metalHostname))
         fail(`deployment.spec.targets.${targetName}.provisioning.ownership`, "must bind platform capacity or one tenant metal hostname.");
       if (provisioning.metalHostname !== undefined && !/^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?$/.test(String(provisioning.metalHostname)))
         fail(`deployment.spec.targets.${targetName}.provisioning.metalHostname`, "is invalid.");
+      const provisionedResources = object(provisioning.resources, `deployment.spec.targets.${targetName}.provisioning.resources`);
+      exact3(provisionedResources, ["physicalCores", "vcpu", "memoryGib", "diskGib", "egressGuaranteedMbps", "egressBurstMbps", "confidential"], `deployment.spec.targets.${targetName}.provisioning.resources`);
+      integer(provisionedResources.physicalCores, `deployment.spec.targets.${targetName}.provisioning.resources.physicalCores`, 1, 1024);
+      integer(provisionedResources.vcpu, `deployment.spec.targets.${targetName}.provisioning.resources.vcpu`, 1, 4096);
+      integer(provisionedResources.memoryGib, `deployment.spec.targets.${targetName}.provisioning.resources.memoryGib`, 1, 4194304);
+      integer(provisionedResources.diskGib, `deployment.spec.targets.${targetName}.provisioning.resources.diskGib`, 1, 1048576);
+      integer(provisionedResources.egressGuaranteedMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressGuaranteedMbps`, 0, 1e7);
+      integer(provisionedResources.egressBurstMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressBurstMbps`, Number(provisionedResources.egressGuaranteedMbps), 1e7);
+      if (typeof provisionedResources.confidential !== "boolean")
+        fail(`deployment.spec.targets.${targetName}.provisioning.resources.confidential`, "must be boolean.");
+      if (typeof capacity.cpuCores === "number" && Number(provisionedResources.vcpu) < capacity.cpuCores || typeof capacity.memoryMiB === "number" && Number(provisionedResources.memoryGib) * 1024 < capacity.memoryMiB || typeof capacity.storageGiB === "number" && Number(provisionedResources.diskGib) < capacity.storageGiB) {
+        fail(`deployment.spec.targets.${targetName}.provisioning.resources`, "must satisfy the per-slot allocation minimum.");
+      }
+      if ((selector.confidentialCompute === "required" || allocation.execution === "oci-kata-qemu-snp") && provisionedResources.confidential !== true)
+        fail(`deployment.spec.targets.${targetName}.provisioning.resources.confidential`, "must be true for confidential execution.");
+      if (typeof provisioning.monthlyAmountCents !== "string" || !/^\d{1,18}$/.test(provisioning.monthlyAmountCents))
+        fail(`deployment.spec.targets.${targetName}.provisioning.monthlyAmountCents`, "must be a bounded USD-cent amount.");
       if (typeof provisioning.maxMonthlySpendMinor !== "string" || !/^\d{1,18}$/.test(provisioning.maxMonthlySpendMinor))
         fail(`deployment.spec.targets.${targetName}.provisioning.maxMonthlySpendMinor`, "must be a bounded decimal minor-unit amount.");
     }
@@ -8283,6 +8307,7 @@ function createDeploymentManager(options) {
     const planPath = join2(release, DEPLOY_PLAN_FILE);
     if (existsSync4(planPath)) {
       const plan = parseDeploymentPlan(readDefinition(planPath));
+      const paidManagedSoftware = new Set;
       for (const workflow of Object.values(plan.spec.workflows))
         for (const stage2 of Object.values(workflow.stages)) {
           if (stage2.strategy.mode === "rolling" || stage2.strategy.mode === "canary" || Object.values(stage2.steps).some((step2) => step2.scope.kind === "target-batches")) {
@@ -8443,6 +8468,11 @@ function createDeploymentManager(options) {
             return { id: id2, version: requirement2.version };
           });
           await options.ensureSoftware(requirements);
+          for (const requirement2 of requirements) {
+            if (countPaidManagedSoftware([requirement2]) === 1) {
+              paidManagedSoftware.add(`${requirement2.id}@${requirement2.version}`);
+            }
+          }
           return { changed: true };
         },
         "forgezero.network/ensure@1": async ({ resolved }) => {
@@ -8677,6 +8707,7 @@ function createDeploymentManager(options) {
         phases: [phase],
         execution: deploymentExecution([phase]),
         resolvedTargets,
+        paidManagedSoftwareCount: paidManagedSoftware.size,
         ...capacity2 ? { capacity: capacity2 } : {}
       };
     }
@@ -8793,6 +8824,7 @@ function createDeploymentManager(options) {
       definitionDigest,
       definitionVersion: 2,
       profile: options.profile,
+      paidManagedSoftwareCount: countPaidManagedSoftware(selectedProfile.software),
       release,
       ok: true,
       phases,
@@ -9121,6 +9153,7 @@ async function pullDeploymentOnce(options) {
     definitionDigest: result.definitionDigest,
     definitionVersion: result.definitionVersion,
     profile: result.profile,
+    paidManagedSoftwareCount: result.paidManagedSoftwareCount,
     execution: result.execution,
     ...result.resolvedTargets ? { resolvedTargets: result.resolvedTargets.map((target) => ({
       ...target,
@@ -9601,7 +9634,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.117";
+var VERSION2 = "0.1.119";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {
@@ -18795,6 +18828,7 @@ export {
   startAgentHeartbeat,
   startAgent,
   stageAgentRelease,
+  softwareBillingClass,
   selectAgentRelease,
   runAgent,
   restoreAgentRelease,
@@ -18854,6 +18888,7 @@ export {
   createDeploymentSecretResolver,
   createDeploymentManager,
   createAgentTelemetry,
+  countPaidManagedSoftware,
   configuredAgentSeed,
   configureMeshConnector,
   compareVersions,

package/dist/fz.js

@@ -4634,7 +4634,7 @@ var VaultError, runtimeEnvironment = () => typeof process !== "undefined" && pro
   } catch {
     return;
   }
-}, VERSION = "0.1.21";
+}, VERSION = "0.1.22";
 var init_dist = __esm(() => {
   init_identity();
   VaultError = class VaultError extends Error {
@@ -4841,7 +4841,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.117";
+var VERSION2 = "0.1.119";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -4873,23 +4873,23 @@ var OS_CATALOG = [
   }
 ];
 var SOFTWARE_CATALOG = [
-  { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "docker", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "containerd", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "kata-containers", version: "4.0.0", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "nginx", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "arangodb", version: "3.11.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "cloudflare-warp", version: "2026.6.822.0-min", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "docker", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "containerd", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "nginx", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "ufw", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "openssh-client", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+  { id: "bun", version: "1.3.14", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "kata-containers", version: "4.0.0", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "arangodb", version: "3.11.14", billingClass: "paid-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflared", version: "2026.7.3", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflare-warp", version: "2026.6.822.0-min", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
 ];
 var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
   "data-root": "/var/lib/docker",
@@ -11349,13 +11349,30 @@ function compileDeployment(sourceValue) {
       fail2(`deployment.spec.targets.${targetName}.allocation.execution`, "cannot satisfy required confidential compute.");
     if (target.provisioning !== undefined) {
       const provisioning = object(target.provisioning, `deployment.spec.targets.${targetName}.provisioning`);
-      exact3(provisioning, ["planKey", "regionKey", "imageKey", "environmentKey", "ownership", "metalHostname", "maxMonthlySpendMinor"], `deployment.spec.targets.${targetName}.provisioning`);
-      for (const key of ["planKey", "regionKey", "imageKey", "environmentKey"])
+      exact3(provisioning, ["regionKey", "imageKey", "environmentKey", "ownership", "metalHostname", "resources", "monthlyAmountCents", "maxMonthlySpendMinor"], `deployment.spec.targets.${targetName}.provisioning`);
+      for (const key of ["regionKey", "imageKey", "environmentKey"])
         named(provisioning[key], `deployment.spec.targets.${targetName}.provisioning.${key}`);
       if (!["platform", "tenant-metal"].includes(String(provisioning.ownership)) || provisioning.ownership === "tenant-metal" !== Boolean(provisioning.metalHostname))
         fail2(`deployment.spec.targets.${targetName}.provisioning.ownership`, "must bind platform capacity or one tenant metal hostname.");
       if (provisioning.metalHostname !== undefined && !/^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?$/.test(String(provisioning.metalHostname)))
         fail2(`deployment.spec.targets.${targetName}.provisioning.metalHostname`, "is invalid.");
+      const provisionedResources = object(provisioning.resources, `deployment.spec.targets.${targetName}.provisioning.resources`);
+      exact3(provisionedResources, ["physicalCores", "vcpu", "memoryGib", "diskGib", "egressGuaranteedMbps", "egressBurstMbps", "confidential"], `deployment.spec.targets.${targetName}.provisioning.resources`);
+      integer(provisionedResources.physicalCores, `deployment.spec.targets.${targetName}.provisioning.resources.physicalCores`, 1, 1024);
+      integer(provisionedResources.vcpu, `deployment.spec.targets.${targetName}.provisioning.resources.vcpu`, 1, 4096);
+      integer(provisionedResources.memoryGib, `deployment.spec.targets.${targetName}.provisioning.resources.memoryGib`, 1, 4194304);
+      integer(provisionedResources.diskGib, `deployment.spec.targets.${targetName}.provisioning.resources.diskGib`, 1, 1048576);
+      integer(provisionedResources.egressGuaranteedMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressGuaranteedMbps`, 0, 1e7);
+      integer(provisionedResources.egressBurstMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressBurstMbps`, Number(provisionedResources.egressGuaranteedMbps), 1e7);
+      if (typeof provisionedResources.confidential !== "boolean")
+        fail2(`deployment.spec.targets.${targetName}.provisioning.resources.confidential`, "must be boolean.");
+      if (typeof capacity.cpuCores === "number" && Number(provisionedResources.vcpu) < capacity.cpuCores || typeof capacity.memoryMiB === "number" && Number(provisionedResources.memoryGib) * 1024 < capacity.memoryMiB || typeof capacity.storageGiB === "number" && Number(provisionedResources.diskGib) < capacity.storageGiB) {
+        fail2(`deployment.spec.targets.${targetName}.provisioning.resources`, "must satisfy the per-slot allocation minimum.");
+      }
+      if ((selector.confidentialCompute === "required" || allocation.execution === "oci-kata-qemu-snp") && provisionedResources.confidential !== true)
+        fail2(`deployment.spec.targets.${targetName}.provisioning.resources.confidential`, "must be true for confidential execution.");
+      if (typeof provisioning.monthlyAmountCents !== "string" || !/^\d{1,18}$/.test(provisioning.monthlyAmountCents))
+        fail2(`deployment.spec.targets.${targetName}.provisioning.monthlyAmountCents`, "must be a bounded USD-cent amount.");
       if (typeof provisioning.maxMonthlySpendMinor !== "string" || !/^\d{1,18}$/.test(provisioning.maxMonthlySpendMinor))
         fail2(`deployment.spec.targets.${targetName}.provisioning.maxMonthlySpendMinor`, "must be a bounded decimal minor-unit amount.");
     }
@@ -11701,13 +11718,24 @@ function initCoordinates(options) {
     throw new Error("reuse require cannot include provisioning coordinates");
   if (options.provisioning !== undefined) {
     for (const [label, value] of Object.entries({
-      plan: options.provisioning.planKey,
       region: options.provisioning.regionKey,
       image: options.provisioning.imageKey,
       environment: options.provisioning.environmentKey
     }))
       if (!/^[a-z][a-z0-9-]{0,62}$/.test(value))
         throw new Error(`deployment provisioning ${label} must be a lowercase typed name`);
+    const resources = options.provisioning.resources;
+    for (const [label, value] of Object.entries(resources).filter(([key]) => key !== "confidential")) {
+      if (!Number.isSafeInteger(value) || Number(value) < 0)
+        throw new Error(`deployment provisioning ${label} must be a non-negative integer`);
+    }
+    if (resources.physicalCores < 1 || resources.vcpu < result.cpuCores || resources.memoryGib * 1024 < result.memoryMiB || resources.diskGib < result.storageGiB || resources.egressBurstMbps < resources.egressGuaranteedMbps) {
+      throw new Error("deployment provisioning resources must satisfy the target allocation and bandwidth bounds");
+    }
+    if (result.isolation === "sev-snp" && !resources.confidential)
+      throw new Error("deployment provisioning must provide confidential capacity for sev-snp");
+    if (!/^\d{1,18}$/.test(options.provisioning.monthlyAmountCents))
+      throw new Error("deployment provisioning monthly amount must be a bounded USD-cent amount");
     if (!/^\d{1,18}$/.test(options.provisioning.maxMonthlySpendMinor))
       throw new Error("deployment provisioning monthly spend must be a bounded decimal minor-unit amount");
     if (options.provisioning.ownership === "tenant-metal" && !options.provisioning.metalHostname)
@@ -11724,7 +11752,7 @@ function defaultTypeScriptDeployment(name, options = {}) {
   const execution = selected.runtime === "native" ? "native" : selected.runtime === "containerd" ? "oci-runc" : "oci-kata-qemu-snp";
   const hostPackageVersion = selected.operatingSystem === "ubuntu-24.04" ? "ubuntu-24.04" : "ubuntu-26.04";
   const provisioningBlock = selected.provisioning === undefined ? "" : `,
-				provisioning: { planKey: '${selected.provisioning.planKey}', regionKey: '${selected.provisioning.regionKey}', imageKey: '${selected.provisioning.imageKey}', environmentKey: '${selected.provisioning.environmentKey}', ownership: '${selected.provisioning.ownership}',${selected.provisioning.metalHostname ? ` metalHostname: '${selected.provisioning.metalHostname}',` : ""} maxMonthlySpendMinor: '${selected.provisioning.maxMonthlySpendMinor}' }`;
+				provisioning: { regionKey: '${selected.provisioning.regionKey}', imageKey: '${selected.provisioning.imageKey}', environmentKey: '${selected.provisioning.environmentKey}', ownership: '${selected.provisioning.ownership}',${selected.provisioning.metalHostname ? ` metalHostname: '${selected.provisioning.metalHostname}',` : ""} resources: ${JSON.stringify(selected.provisioning.resources)}, monthlyAmountCents: '${selected.provisioning.monthlyAmountCents}', maxMonthlySpendMinor: '${selected.provisioning.maxMonthlySpendMinor}' }`;
   const requirementBlock = selected.runtime === "native" ? `bun: providers.bun.require()` : selected.runtime === "containerd" ? `containerd: providers.containerd.require({ version: '${hostPackageVersion}' }),
 			nginx: providers.nginx.require({ version: '${hostPackageVersion}' })` : `containerd: providers.containerd.require(),
 			kata: providers.kata.require(),
@@ -18771,9 +18799,6 @@ function parseOptions(argv2) {
         options.deployReuse = value;
       else
         options.optionError = "--reuse must be require or prefer.";
-    } else if (token === "--provision-plan") {
-      options.deployProvisionPlan = argv2[++index];
-      options.deployInitCustomized = true;
     } else if (token === "--provision-region") {
       options.deployProvisionRegion = argv2[++index];
       options.deployInitCustomized = true;
@@ -18793,6 +18818,26 @@ function parseOptions(argv2) {
     } else if (token === "--provision-metal") {
       options.deployProvisionMetal = argv2[++index];
       options.deployInitCustomized = true;
+    } else if (["--provision-physical-cores", "--provision-vcpu", "--provision-memory-gib", "--provision-disk-gib", "--provision-guaranteed-mbps", "--provision-burst-mbps"].includes(token)) {
+      const value = Number(argv2[++index] ?? "");
+      options.deployInitCustomized = true;
+      if (!Number.isSafeInteger(value) || value < 0)
+        options.optionError = `${token} must be a non-negative integer.`;
+      else if (token === "--provision-physical-cores")
+        options.deployProvisionPhysicalCores = value;
+      else if (token === "--provision-vcpu")
+        options.deployProvisionVcpu = value;
+      else if (token === "--provision-memory-gib")
+        options.deployProvisionMemoryGib = value;
+      else if (token === "--provision-disk-gib")
+        options.deployProvisionDiskGib = value;
+      else if (token === "--provision-guaranteed-mbps")
+        options.deployProvisionGuaranteedMbps = value;
+      else
+        options.deployProvisionBurstMbps = value;
+    } else if (token === "--provision-monthly-amount-cents") {
+      options.deployProvisionMonthlyAmountCents = argv2[++index];
+      options.deployInitCustomized = true;
     } else if (token === "--max-monthly-spend-minor") {
       options.deployMaxMonthlySpendMinor = argv2[++index];
       options.deployInitCustomized = true;
@@ -20581,20 +20626,35 @@ async function cmdDeploy(options, args) {
         reuse: options.deployReuse,
         profile: options.deployProfile,
         ...[
-          options.deployProvisionPlan,
           options.deployProvisionRegion,
           options.deployProvisionImage,
           options.deployProvisionEnvironment,
           options.deployProvisionOwnership,
+          options.deployProvisionPhysicalCores,
+          options.deployProvisionVcpu,
+          options.deployProvisionMemoryGib,
+          options.deployProvisionDiskGib,
+          options.deployProvisionGuaranteedMbps,
+          options.deployProvisionBurstMbps,
+          options.deployProvisionMonthlyAmountCents,
           options.deployMaxMonthlySpendMinor
         ].some((value) => value !== undefined) ? {
           provisioning: {
-            planKey: options.deployProvisionPlan ?? "",
             regionKey: options.deployProvisionRegion ?? "",
             imageKey: options.deployProvisionImage ?? "",
             environmentKey: options.deployProvisionEnvironment ?? "",
             ownership: options.deployProvisionOwnership ?? "platform",
             ...options.deployProvisionMetal ? { metalHostname: options.deployProvisionMetal } : {},
+            resources: {
+              physicalCores: options.deployProvisionPhysicalCores ?? 0,
+              vcpu: options.deployProvisionVcpu ?? 0,
+              memoryGib: options.deployProvisionMemoryGib ?? 0,
+              diskGib: options.deployProvisionDiskGib ?? 0,
+              egressGuaranteedMbps: options.deployProvisionGuaranteedMbps ?? 0,
+              egressBurstMbps: options.deployProvisionBurstMbps ?? 0,
+              confidential: options.deployIsolation === "sev-snp"
+            },
+            monthlyAmountCents: options.deployProvisionMonthlyAmountCents ?? "",
             maxMonthlySpendMinor: options.deployMaxMonthlySpendMinor ?? ""
           }
         } : {}
@@ -20933,9 +20993,13 @@ function usage() {
 	 --storage-gib <n>       Reserved storage GiB per compute
 	 --sharing <mode>       exclusive or shared (native requires exclusive)
 	 --reuse <mode>         require existing capacity or prefer reuse then approved provisioning
-	 --provision-plan <key> --provision-region <key> --provision-image <key>
+	 --provision-region <key> --provision-image <key>
 	 --provision-environment <key> --provision-ownership <platform|tenant-metal>
 	 --provision-metal <host>      Required only for tenant-metal ownership
+	 --provision-physical-cores <n> --provision-vcpu <n>
+	 --provision-memory-gib <n> --provision-disk-gib <n>
+	 --provision-guaranteed-mbps <n> --provision-burst-mbps <n>
+	 --provision-monthly-amount-cents <n> Exact approved USD cost per created compute
 	 --max-monthly-spend-minor <n> Hard approved scale-out spend ceiling
     --force                 Init may replace an existing generated target
 

package/dist/index.d.ts

@@ -42,7 +42,7 @@ export type { AgentRelease, StagedAgentRelease, UpdateCommand, UpdateCommandResu
 export { activateAgentRelease, probeAgentSocket, readAgentUpdateReceipt, recoverInterruptedAgentUpdate, requestAgentUpdate, startAgentUpdateHelper, AGENT_UPDATE_GROUP, AGENT_UPDATE_HELPER_UNIT_PATH, AGENT_UPDATE_JOURNAL, AGENT_UPDATE_RECEIPT } from './agent-update-helper';
 export type { AgentUpdateOutcome, AgentUpdateReceipt, AgentUpdateRequest, AgentUpdateResponse } from './agent-update-helper';
 export { DEFAULT_SOFTWARE_HELPER_SOCKET, requestSoftware, startSoftwareHelper, SOFTWARE_HELPER_GROUP, SOFTWARE_HELPER_UNIT_PATH } from './software-helper';
-export { ensureSoftwareRequirements, observeSoftwareHost, validateSoftwareRequirements, OS_CATALOG, SOFTWARE_CATALOG } from './software';
+export { countPaidManagedSoftware, ensureSoftwareRequirements, observeSoftwareHost, softwareBillingClass, validateSoftwareRequirements, OS_CATALOG, SOFTWARE_CATALOG } from './software';
 export type { CatalogStatus, DeploymentChannel, OsCatalogEntry, SoftwareCatalogEntry, SoftwareCommandResult, SoftwareExec, SoftwareId, SoftwareObservation, SoftwareRequirement } from './software';
 export { AGENT_EGRESS_TABLE, BLOCKED_IPV4, BLOCKED_IPV6, SYSTEMD_RESOLVED_ADDRESS, SYSTEMD_RESOLVED_STUB, applyAgentEgressPolicy, normalizeEgressTcpPorts, renderAgentEgressNft, superviseAgentEgressPolicy, systemdAgentEgressDirectives, verifyAgentEgressPolicy } from './egress-policy';
 export type { EgressCommand, EgressCommandResult } from './egress-policy';

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.117";
+var VERSION = "0.1.119";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/metal-helper-socket.js

@@ -195,24 +195,31 @@ var OS_CATALOG = [
   }
 ];
 var SOFTWARE_CATALOG = [
-  { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "docker", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "containerd", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "kata-containers", version: "4.0.0", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "nginx", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "arangodb", version: "3.11.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "cloudflare-warp", version: "2026.6.822.0-min", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "docker", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "containerd", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "nginx", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "ufw", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "openssh-client", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+  { id: "bun", version: "1.3.14", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "kata-containers", version: "4.0.0", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "arangodb", version: "3.11.14", billingClass: "paid-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflared", version: "2026.7.3", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflare-warp", version: "2026.6.822.0-min", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
 ];
+var softwareBillingClass = (requirement) => {
+  const entry = SOFTWARE_CATALOG.find((candidate) => candidate.id === requirement.id && candidate.version === requirement.version);
+  if (!entry)
+    throw new Error(`unsupported software billing coordinate: ${requirement.id}@${requirement.version}`);
+  return entry.billingClass;
+};
+var countPaidManagedSoftware = (requirements) => new Set(requirements.filter((requirement) => softwareBillingClass(requirement) === "paid-managed").map((requirement) => `${requirement.id}@${requirement.version}`)).size;
 var UBUNTU_2604_X64 = [
   { requirement: { id: "bun", version: "1.3.14" } },
   { requirement: { id: "docker", version: "ubuntu-26.04" } },

package/dist/metal-provision.js

@@ -195,24 +195,31 @@ var OS_CATALOG = [
   }
 ];
 var SOFTWARE_CATALOG = [
-  { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "docker", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "containerd", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "kata-containers", version: "4.0.0", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "nginx", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "arangodb", version: "3.11.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "cloudflare-warp", version: "2026.6.822.0-min", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "docker", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "containerd", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "nginx", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "ufw", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "openssh-client", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+  { id: "bun", version: "1.3.14", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "kata-containers", version: "4.0.0", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "arangodb", version: "3.11.14", billingClass: "paid-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflared", version: "2026.7.3", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflare-warp", version: "2026.6.822.0-min", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
 ];
+var softwareBillingClass = (requirement) => {
+  const entry = SOFTWARE_CATALOG.find((candidate) => candidate.id === requirement.id && candidate.version === requirement.version);
+  if (!entry)
+    throw new Error(`unsupported software billing coordinate: ${requirement.id}@${requirement.version}`);
+  return entry.billingClass;
+};
+var countPaidManagedSoftware = (requirements) => new Set(requirements.filter((requirement) => softwareBillingClass(requirement) === "paid-managed").map((requirement) => `${requirement.id}@${requirement.version}`)).size;
 var UBUNTU_2604_X64 = [
   { requirement: { id: "bun", version: "1.3.14" } },
   { requirement: { id: "docker", version: "ubuntu-26.04" } },

package/dist/operator-bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.117";
+var VERSION = "0.1.119";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/platform-bootstrap-runtime.js

@@ -55,24 +55,31 @@ var OS_CATALOG = [
   }
 ];
 var SOFTWARE_CATALOG = [
-  { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "docker", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "containerd", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "kata-containers", version: "4.0.0", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "nginx", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "arangodb", version: "3.11.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "cloudflare-warp", version: "2026.6.822.0-min", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "docker", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "containerd", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "nginx", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "ufw", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "openssh-client", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+  { id: "bun", version: "1.3.14", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "kata-containers", version: "4.0.0", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "arangodb", version: "3.11.14", billingClass: "paid-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflared", version: "2026.7.3", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflare-warp", version: "2026.6.822.0-min", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-26.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-24.04", billingClass: "free-managed", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
 ];
+var softwareBillingClass = (requirement) => {
+  const entry = SOFTWARE_CATALOG.find((candidate) => candidate.id === requirement.id && candidate.version === requirement.version);
+  if (!entry)
+    throw new Error(`unsupported software billing coordinate: ${requirement.id}@${requirement.version}`);
+  return entry.billingClass;
+};
+var countPaidManagedSoftware = (requirements) => new Set(requirements.filter((requirement) => softwareBillingClass(requirement) === "paid-managed").map((requirement) => `${requirement.id}@${requirement.version}`)).size;
 var UBUNTU_2604_X64 = [
   { requirement: { id: "bun", version: "1.3.14" } },
   { requirement: { id: "docker", version: "ubuntu-26.04" } },