@forgezero/agent 0.1.135 → 0.1.136

package/dist/operator-bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.135";
+var VERSION = "0.1.136";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3070,6 +3070,10 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       throw new Error("platform genesis vCPU count cannot be smaller than physical cores");
     const memoryGib = integer(input.memoryGib, 1, 8192, "memory");
     const diskGib = integer(input.diskGib, 8, 65536, "disk");
+    const diskEncryption = input.diskEncryption ?? "none";
+    if (!["none", "luks2"].includes(diskEncryption)) {
+      throw new Error("platform genesis disk encryption mode is unsupported");
+    }
     const egressGuaranteedMbps = integer(input.egressGuaranteedMbps, 0, 1e6, "guaranteed egress");
     const egressBurstMbps = integer(input.egressBurstMbps, egressGuaranteedMbps, 1e6, "burst egress");
     return {
@@ -3081,6 +3085,7 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       vcpu,
       memoryGib,
       diskGib,
+      diskEncryption,
       egressGuaranteedMbps,
       egressBurstMbps,
       confidential: input.confidential
@@ -3111,6 +3116,7 @@ var claimFor = (guest, keys, action) => {
       vcpu: guest.vcpu,
       memoryGib: guest.memoryGib,
       diskGib: guest.diskGib,
+      diskEncryption: guest.diskEncryption,
       egressGuaranteedMbps: guest.egressGuaranteedMbps,
       egressBurstMbps: guest.egressBurstMbps,
       confidential: guest.confidential
@@ -3200,6 +3206,7 @@ function validatePlatformInitialInventory(value) {
       "vcpu",
       "memoryGib",
       "diskGib",
+      "diskEncryption",
       "egressGuaranteedMbps",
       "egressBurstMbps",
       "confidential",
@@ -5230,6 +5237,7 @@ function strictBootstrapDocument(value) {
           "vcpu",
           "memoryGib",
           "diskGib",
+          "diskEncryption",
           "egressGuaranteedMbps",
           "egressBurstMbps",
           "confidential",
@@ -6194,6 +6202,7 @@ async function applyMetalBootstrap(config, options) {
     "qemu-utils",
     "cloud-image-utils",
     "lvm2",
+    "cryptsetup",
     "nftables",
     "curl",
     "ca-certificates"
@@ -6634,11 +6643,12 @@ var validateMetalRequestValue = (value, options = {}) => {
       "vcpu",
       "memoryGib",
       "diskGib",
+      "diskEncryption",
       "egressGuaranteedMbps",
       "egressBurstMbps",
       "confidential"
     ], label);
-    if (typeof row.name !== "string" || typeof row.address !== "string" || typeof row.imageKey !== "string" || row.cpuPoolKey !== undefined && typeof row.cpuPoolKey !== "string" || !["physicalCores", "vcpu", "memoryGib", "diskGib", "egressGuaranteedMbps", "egressBurstMbps"].every((key) => typeof row[key] === "number") || typeof row.confidential !== "boolean") {
+    if (typeof row.name !== "string" || typeof row.address !== "string" || typeof row.imageKey !== "string" || row.cpuPoolKey !== undefined && typeof row.cpuPoolKey !== "string" || !["physicalCores", "vcpu", "memoryGib", "diskGib", "egressGuaranteedMbps", "egressBurstMbps"].every((key) => typeof row[key] === "number") || row.diskEncryption !== undefined && !["none", "luks2"].includes(row.diskEncryption) || typeof row.confidential !== "boolean") {
       throw new Error(`${label} has invalid resource coordinates`);
     }
     return {
@@ -6650,6 +6660,7 @@ var validateMetalRequestValue = (value, options = {}) => {
       vcpu: row.vcpu,
       memoryGib: row.memoryGib,
       diskGib: row.diskGib,
+      diskEncryption: row.diskEncryption ?? "none",
       egressGuaranteedMbps: row.egressGuaranteedMbps,
       egressBurstMbps: row.egressBurstMbps,
       confidential: row.confidential

package/dist/platform-bootstrap-runtime.d.ts

@@ -11,6 +11,7 @@ export interface PlatformInitialInventoryCompute {
     vcpu: number;
     memoryGib: number;
     diskGib: number;
+    diskEncryption?: 'none' | 'luks2';
     egressGuaranteedMbps: number;
     egressBurstMbps: number;
     confidential: true;

package/dist/platform-bootstrap-runtime.js

@@ -652,6 +652,10 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       throw new Error("platform genesis vCPU count cannot be smaller than physical cores");
     const memoryGib = integer(input.memoryGib, 1, 8192, "memory");
     const diskGib = integer(input.diskGib, 8, 65536, "disk");
+    const diskEncryption = input.diskEncryption ?? "none";
+    if (!["none", "luks2"].includes(diskEncryption)) {
+      throw new Error("platform genesis disk encryption mode is unsupported");
+    }
     const egressGuaranteedMbps = integer(input.egressGuaranteedMbps, 0, 1e6, "guaranteed egress");
     const egressBurstMbps = integer(input.egressBurstMbps, egressGuaranteedMbps, 1e6, "burst egress");
     return {
@@ -663,6 +667,7 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       vcpu,
       memoryGib,
       diskGib,
+      diskEncryption,
       egressGuaranteedMbps,
       egressBurstMbps,
       confidential: input.confidential
@@ -693,6 +698,7 @@ var claimFor = (guest, keys, action) => {
       vcpu: guest.vcpu,
       memoryGib: guest.memoryGib,
       diskGib: guest.diskGib,
+      diskEncryption: guest.diskEncryption,
       egressGuaranteedMbps: guest.egressGuaranteedMbps,
       egressBurstMbps: guest.egressBurstMbps,
       confidential: guest.confidential
@@ -799,6 +805,7 @@ function validatePlatformInitialInventory(value) {
       "vcpu",
       "memoryGib",
       "diskGib",
+      "diskEncryption",
       "egressGuaranteedMbps",
       "egressBurstMbps",
       "confidential",

package/dist/platform-fleet-verification.js

@@ -3049,7 +3049,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.135";
+var VERSION3 = "0.1.136";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -4168,6 +4168,10 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       throw new Error("platform genesis vCPU count cannot be smaller than physical cores");
     const memoryGib = integer(input.memoryGib, 1, 8192, "memory");
     const diskGib = integer(input.diskGib, 8, 65536, "disk");
+    const diskEncryption = input.diskEncryption ?? "none";
+    if (!["none", "luks2"].includes(diskEncryption)) {
+      throw new Error("platform genesis disk encryption mode is unsupported");
+    }
     const egressGuaranteedMbps = integer(input.egressGuaranteedMbps, 0, 1e6, "guaranteed egress");
     const egressBurstMbps = integer(input.egressBurstMbps, egressGuaranteedMbps, 1e6, "burst egress");
     return {
@@ -4179,6 +4183,7 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       vcpu,
       memoryGib,
       diskGib,
+      diskEncryption,
       egressGuaranteedMbps,
       egressBurstMbps,
       confidential: input.confidential
@@ -4209,6 +4214,7 @@ var claimFor = (guest, keys, action) => {
       vcpu: guest.vcpu,
       memoryGib: guest.memoryGib,
       diskGib: guest.diskGib,
+      diskEncryption: guest.diskEncryption,
       egressGuaranteedMbps: guest.egressGuaranteedMbps,
       egressBurstMbps: guest.egressBurstMbps,
       confidential: guest.confidential
@@ -4315,6 +4321,7 @@ function validatePlatformInitialInventory(value) {
       "vcpu",
       "memoryGib",
       "diskGib",
+      "diskEncryption",
       "egressGuaranteedMbps",
       "egressBurstMbps",
       "confidential",

package/dist/platform-genesis.d.ts

@@ -14,6 +14,7 @@ export interface PlatformGenesisGuest {
     vcpu: number;
     memoryGib: number;
     diskGib: number;
+    diskEncryption?: 'none' | 'luks2';
     egressGuaranteedMbps: number;
     egressBurstMbps: number;
     confidential: boolean;

package/dist/platform-genesis.js

@@ -652,6 +652,10 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       throw new Error("platform genesis vCPU count cannot be smaller than physical cores");
     const memoryGib = integer(input.memoryGib, 1, 8192, "memory");
     const diskGib = integer(input.diskGib, 8, 65536, "disk");
+    const diskEncryption = input.diskEncryption ?? "none";
+    if (!["none", "luks2"].includes(diskEncryption)) {
+      throw new Error("platform genesis disk encryption mode is unsupported");
+    }
     const egressGuaranteedMbps = integer(input.egressGuaranteedMbps, 0, 1e6, "guaranteed egress");
     const egressBurstMbps = integer(input.egressBurstMbps, egressGuaranteedMbps, 1e6, "burst egress");
     return {
@@ -663,6 +667,7 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       vcpu,
       memoryGib,
       diskGib,
+      diskEncryption,
       egressGuaranteedMbps,
       egressBurstMbps,
       confidential: input.confidential
@@ -693,6 +698,7 @@ var claimFor = (guest, keys, action) => {
       vcpu: guest.vcpu,
       memoryGib: guest.memoryGib,
       diskGib: guest.diskGib,
+      diskEncryption: guest.diskEncryption,
       egressGuaranteedMbps: guest.egressGuaranteedMbps,
       egressBurstMbps: guest.egressBurstMbps,
       confidential: guest.confidential

package/dist/provision.js

@@ -3049,7 +3049,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.135";
+var VERSION3 = "0.1.136";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provisioning-pull.d.ts

@@ -17,6 +17,8 @@ interface RemoteProvisionClaimBase {
         vcpu: number;
         memoryGib: number;
         diskGib: number;
+        /** Absent only on pre-encryption claims; normalized to `none` by the Metal Agent. */
+        diskEncryption?: 'none' | 'luks2';
         egressGuaranteedMbps: number;
         egressBurstMbps: number;
         confidential: boolean;

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.135";
+export declare const VERSION = "0.1.136";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.135",
+  "version": "0.1.136",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",