@forgezero/agent 0.1.26 → 0.1.27

package/dist/agent-update-helper.js

@@ -0,0 +1,366 @@
+// src/agent-update.ts
+import { createHash, timingSafeEqual, randomUUID } from "node:crypto";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readlinkSync,
+  renameSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync
+} from "node:fs";
+import { dirname, join, resolve } from "node:path";
+var DEFAULT_AGENT_RELEASE_ROOT = "/opt/forgezero/agent";
+var DEFAULT_AGENT_UPDATE_SOCKET = "/run/forgezero-update/helper.sock";
+var MAX_AGENT_TARBALL_BYTES = 32 * 1024 * 1024;
+var VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+var REGISTRY = "registry.npmjs.org";
+function validateAgentRelease(release) {
+  if (release?.package !== "@forgezero/agent")
+    throw new Error("agent update package is fixed");
+  if (!VERSION.test(release.version))
+    throw new Error("agent update version must be exact semver");
+  const expectedTarball = `/@forgezero/agent/-/agent-${release.version}.tgz`;
+  let url;
+  try {
+    url = new URL(release.tarball);
+  } catch {
+    throw new Error("agent update tarball URL is malformed");
+  }
+  if (url.protocol !== "https:" || url.hostname !== REGISTRY || url.port || url.username || url.password || url.search || url.hash || url.pathname !== expectedTarball)
+    throw new Error("agent update tarball must be the exact official npm artifact");
+  const match = /^sha512-([A-Za-z0-9+/]+={0,2})$/.exec(release.integrity);
+  if (!match || Buffer.from(match[1], "base64").length !== 64) {
+    throw new Error("agent update requires one sha512 npm integrity");
+  }
+  return release;
+}
+function compareVersions(left, right) {
+  if (!VERSION.test(left) || !VERSION.test(right))
+    throw new Error("agent version must be exact semver");
+  const a = left.split(".").map(Number);
+  const b = right.split(".").map(Number);
+  for (let index = 0;index < 3; index += 1) {
+    if (a[index] > b[index])
+      return 1;
+    if (a[index] < b[index])
+      return -1;
+  }
+  return 0;
+}
+var command = async (input) => {
+  const child = Bun.spawn([input.command, ...input.args], {
+    cwd: input.cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" }
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  return { exitCode, output: `${stdout}${stderr}` };
+};
+var checked = async (run, input, label) => {
+  const result = await run(input);
+  if (result.exitCode !== 0)
+    throw new Error(`${label} failed: ${result.output.trim()}`);
+  return result;
+};
+async function validateReleaseDirectory(directory, release, run) {
+  const manifest = JSON.parse(readFileSync(join(directory, "package.json"), "utf8"));
+  if (manifest.name !== release.package || manifest.version !== release.version) {
+    throw new Error("agent update manifest does not match the selected release");
+  }
+  const agent = join(directory, "dist", "fz-agent.js");
+  const cli = join(directory, "dist", "fz.js");
+  for (const binary of [agent, cli]) {
+    if (!readFileSync(binary, "utf8").startsWith(`#!/usr/bin/env bun
+`)) {
+      throw new Error("agent update artifact is not a self-contained Bun executable");
+    }
+    chmodSync(binary, 493);
+  }
+  const version = (await checked(run, { command: agent, args: ["--version"] }, "agent update smoke test")).output.trim();
+  if (version !== release.version)
+    throw new Error(`agent update binary reports ${version}`);
+}
+async function stageAgentRelease(releaseInput, options) {
+  const release = validateAgentRelease(releaseInput);
+  if (compareVersions(release.version, options.currentVersion) <= 0) {
+    throw new Error(`agent update ${release.version} is not newer than ${options.currentVersion}`);
+  }
+  const root = resolve(options.root ?? DEFAULT_AGENT_RELEASE_ROOT);
+  const versions = join(root, "versions");
+  const finalDirectory = join(versions, release.version);
+  const currentLink = join(root, "current");
+  const stage = join(versions, `.${release.version}.${randomUUID()}.staging`);
+  const archive = join(stage, "agent.tgz");
+  const unpacked = join(stage, "unpacked");
+  const run = options.run ?? command;
+  mkdirSync(unpacked, { recursive: true, mode: 448 });
+  try {
+    const response = await (options.fetch ?? globalThis.fetch)(release.tarball, {
+      redirect: "error",
+      signal: AbortSignal.timeout(30000)
+    });
+    if (!response.ok)
+      throw new Error(`npm returned HTTP ${response.status}`);
+    const declared = Number(response.headers.get("content-length") ?? "0");
+    if (declared > MAX_AGENT_TARBALL_BYTES)
+      throw new Error("agent update tarball exceeds the size limit");
+    const bytes = Buffer.from(await response.arrayBuffer());
+    if (bytes.length === 0 || bytes.length > MAX_AGENT_TARBALL_BYTES) {
+      throw new Error("agent update tarball is empty or exceeds the size limit");
+    }
+    const expected = Buffer.from(release.integrity.slice("sha512-".length), "base64");
+    const actual = createHash("sha512").update(bytes).digest();
+    if (!timingSafeEqual(actual, expected))
+      throw new Error("agent update integrity mismatch");
+    writeFileSync(archive, bytes, { mode: 384, flag: "wx" });
+    await checked(run, {
+      command: "/usr/bin/tar",
+      args: [
+        "-xzf",
+        archive,
+        "-C",
+        unpacked,
+        "--strip-components=1",
+        "package/package.json",
+        "package/dist/fz-agent.js",
+        "package/dist/fz.js"
+      ]
+    }, "agent update extraction");
+    await validateReleaseDirectory(unpacked, release, run);
+    if (!existsSync(finalDirectory))
+      renameSync(unpacked, finalDirectory);
+    else
+      await validateReleaseDirectory(finalDirectory, release, run);
+    if (!existsSync(currentLink)) {
+      throw new Error("agent update requires an active immutable release to roll back to");
+    }
+    const previousTarget = readlinkSync(currentLink);
+    return {
+      version: release.version,
+      directory: finalDirectory,
+      previousTarget,
+      nextTarget: join("versions", release.version),
+      currentLink
+    };
+  } finally {
+    rmSync(stage, { recursive: true, force: true });
+  }
+}
+function selectAgentRelease(staged) {
+  const next = join(dirname(staged.currentLink), `.current.${randomUUID()}.next`);
+  try {
+    symlinkSync(staged.nextTarget, next);
+    renameSync(next, staged.currentLink);
+  } finally {
+    rmSync(next, { force: true });
+  }
+}
+function restoreAgentRelease(staged) {
+  const next = join(dirname(staged.currentLink), `.current.${randomUUID()}.rollback`);
+  try {
+    symlinkSync(staged.previousTarget, next);
+    renameSync(next, staged.currentLink);
+  } finally {
+    rmSync(next, { force: true });
+  }
+}
+
+// src/agent-update-helper.ts
+import { chmodSync as chmodSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { connect, createServer } from "node:net";
+import { dirname as dirname2 } from "node:path";
+import { DEFAULT_SOCKET } from "@forgezero/vault";
+var AGENT_UPDATE_GROUP = "forgezero-update";
+var AGENT_UPDATE_HELPER_UNIT_PATH = "/etc/systemd/system/forgezero-agent-update-helper.service";
+var AGENT_UPDATE_RECEIPT = "/var/lib/forgezero/agent-update.json";
+var MAX_REQUEST_BYTES = 8 * 1024;
+var COMPUTE_HELPER_UNITS = [
+  "forgezero-deploy-runner.service",
+  "forgezero-lifecycle-helper.service",
+  "forgezero-software-helper.service"
+];
+var runCommand = async (input) => {
+  const child = Bun.spawn([input.command, ...input.args], {
+    cwd: input.cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" }
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  return { exitCode, output: `${stdout}${stderr}` };
+};
+var runOk = async (run, command2, args) => (await run({ command: command2, args })).exitCode === 0;
+function probeAgentSocket(socketPath = DEFAULT_SOCKET, timeoutMs = 5000) {
+  return new Promise((resolve2) => {
+    const socket = connect(socketPath);
+    let settled = false;
+    let buffer = "";
+    const finish = (value) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve2(value);
+    };
+    const timer = setTimeout(() => finish(false), timeoutMs);
+    socket.on("connect", () => socket.write(`{"op":"identity"}
+`));
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      const newline = buffer.indexOf(`
+`);
+      if (newline < 0)
+        return;
+      try {
+        const response = JSON.parse(buffer.slice(0, newline));
+        finish(response.ok === false && response.error?.code === "APP_OPERATION_REFUSED");
+      } catch {
+        finish(false);
+      }
+    });
+    socket.on("error", () => finish(false));
+  });
+}
+async function activateAgentRelease(staged, options = {}) {
+  const run = options.run ?? runCommand;
+  const target = options.target ?? "compute";
+  const probe = options.probe ?? (target === "compute" ? () => probeAgentSocket() : async () => await runOk(run, "/usr/bin/systemctl", ["is-active", "--quiet", "forgezero-metal-agent.service"]) && await runOk(run, "/usr/bin/systemctl", ["is-active", "--quiet", "forgezero-metal-helper.service"]));
+  const restart = async () => {
+    const helpers = target === "compute" ? COMPUTE_HELPER_UNITS : ["forgezero-metal-helper.service"];
+    for (const unit of helpers) {
+      await run({ command: "/usr/bin/systemctl", args: ["try-restart", unit] });
+    }
+    const service = target === "compute" ? "forgezero-agent.service" : "forgezero-metal-agent.service";
+    const restarted = await runOk(run, "/usr/bin/systemctl", ["restart", service]);
+    if (!restarted)
+      throw new Error(`systemd could not restart ${service}`);
+  };
+  let selected = false;
+  try {
+    selectAgentRelease(staged);
+    selected = true;
+    await restart();
+    if (!await probe())
+      throw new Error("the replacement Agent did not answer its retained Vault socket");
+    const receipt = options.receiptPath ?? AGENT_UPDATE_RECEIPT;
+    mkdirSync2(dirname2(receipt), { recursive: true, mode: 493 });
+    const next = `${receipt}.next`;
+    writeFileSync2(next, JSON.stringify({
+      version: staged.version,
+      outcome: "active",
+      updatedAtTs: (options.now ?? Date.now)()
+    }) + `
+`, { mode: 420 });
+    renameSync2(next, receipt);
+    run({
+      command: "/usr/bin/systemctl",
+      args: ["try-restart", "--no-block", "forgezero-agent-update-helper.service"]
+    });
+    return { ok: true, version: staged.version };
+  } catch (cause) {
+    const reason = cause instanceof Error ? cause.message : String(cause);
+    if (selected) {
+      restoreAgentRelease(staged);
+      await restart();
+    }
+    return { ok: false, rolledBack: selected, reason };
+  }
+}
+function startAgentUpdateHelper(options = {}) {
+  const socketPath = options.socketPath ?? DEFAULT_AGENT_UPDATE_SOCKET;
+  if (existsSync2(socketPath))
+    unlinkSync(socketPath);
+  mkdirSync2(dirname2(socketPath), { recursive: true, mode: 488 });
+  const setTimer = options.setTimer ?? ((callback, ms) => setTimeout(callback, ms));
+  const activate = options.activate ?? ((staged, target) => activateAgentRelease(staged, { target }));
+  const server = createServer((socket) => {
+    let buffer = "";
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      if (Buffer.byteLength(buffer) > MAX_REQUEST_BYTES) {
+        socket.end(`${JSON.stringify({ ok: false, error: { code: "TOO_LARGE", message: "update request too large" } })}
+`);
+        return;
+      }
+      const newline = buffer.indexOf(`
+`);
+      if (newline < 0)
+        return;
+      const line = buffer.slice(0, newline);
+      buffer = "";
+      Promise.resolve().then(() => JSON.parse(line)).then(async (request) => {
+        if (request.op !== "apply")
+          throw new Error("unknown update operation");
+        if (request.target !== "compute" && request.target !== "metal") {
+          throw new Error("agent update target is invalid");
+        }
+        const staged = await stageAgentRelease(request.release, {
+          currentVersion: request.currentVersion,
+          root: options.root ?? DEFAULT_AGENT_RELEASE_ROOT
+        });
+        const response = { ok: true, status: "staged", version: staged.version };
+        socket.end(`${JSON.stringify(response)}
+`, () => {
+          setTimer(() => void activate(staged, request.target), 100);
+        });
+      }).catch((cause) => {
+        const response = {
+          ok: false,
+          error: { code: "UPDATE_REFUSED", message: cause instanceof Error ? cause.message : String(cause) }
+        };
+        socket.end(`${JSON.stringify(response)}
+`);
+      });
+    });
+    socket.on("error", () => socket.destroy());
+  });
+  server.listen(socketPath, () => chmodSync2(socketPath, 432));
+  return server;
+}
+function requestAgentUpdate(request, socketPath = DEFAULT_AGENT_UPDATE_SOCKET, timeoutMs = 90000) {
+  return new Promise((resolve2, reject) => {
+    const socket = connect(socketPath, () => socket.write(`${JSON.stringify(request)}
+`));
+    let buffer = "";
+    socket.setTimeout(timeoutMs, () => {
+      socket.destroy();
+      reject(new Error("agent update helper did not answer before its deadline"));
+    });
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      const newline = buffer.indexOf(`
+`);
+      if (newline < 0)
+        return;
+      socket.end();
+      try {
+        resolve2(JSON.parse(buffer.slice(0, newline)));
+      } catch (cause) {
+        reject(cause);
+      }
+    });
+    socket.on("error", reject);
+  });
+}
+export {
+  startAgentUpdateHelper,
+  requestAgentUpdate,
+  probeAgentSocket,
+  activateAgentRelease,
+  AGENT_UPDATE_RECEIPT,
+  AGENT_UPDATE_HELPER_UNIT_PATH,
+  AGENT_UPDATE_GROUP
+};

package/dist/agent-update.d.ts

@@ -0,0 +1,46 @@
+/** A release selected by the API and delivered inside the PQ-sealed response. */
+export interface AgentRelease {
+    package: '@forgezero/agent';
+    version: string;
+    integrity: string;
+    tarball: string;
+}
+export interface UpdateCommand {
+    command: string;
+    args: readonly string[];
+    cwd?: string;
+}
+export interface UpdateCommandResult {
+    exitCode: number;
+    output: string;
+}
+export interface StagedAgentRelease {
+    version: string;
+    directory: string;
+    previousTarget: string;
+    nextTarget: string;
+    currentLink: string;
+}
+export declare const DEFAULT_AGENT_RELEASE_ROOT = "/opt/forgezero/agent";
+export declare const DEFAULT_AGENT_UPDATE_SOCKET = "/run/forgezero-update/helper.sock";
+export declare const MAX_AGENT_TARBALL_BYTES: number;
+/** Root helper input is data, never a command or filesystem path. */
+export declare function validateAgentRelease(release: AgentRelease): AgentRelease;
+export declare function compareVersions(left: string, right: string): number;
+/**
+ * Download, verify and atomically select one self-contained Agent release.
+ *
+ * The published `fz-agent.js` and `fz.js` are dependency-bundled. No package
+ * manager executes lifecycle scripts on a compute, and no mutable global
+ * node_modules tree sits underneath a running daemon.
+ */
+export declare function stageAgentRelease(releaseInput: AgentRelease, options: {
+    currentVersion: string;
+    root?: string;
+    fetch?: typeof globalThis.fetch;
+    run?: (input: UpdateCommand) => Promise<UpdateCommandResult>;
+}): Promise<StagedAgentRelease>;
+/** Select the already-verified immutable directory immediately before restart. */
+export declare function selectAgentRelease(staged: StagedAgentRelease): void;
+/** Roll back only to the exact link target captured before activation. */
+export declare function restoreAgentRelease(staged: StagedAgentRelease): void;

package/dist/agent-update.js

@@ -0,0 +1,184 @@
+// src/agent-update.ts
+import { createHash, timingSafeEqual, randomUUID } from "node:crypto";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readlinkSync,
+  renameSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync
+} from "node:fs";
+import { dirname, join, resolve } from "node:path";
+var DEFAULT_AGENT_RELEASE_ROOT = "/opt/forgezero/agent";
+var DEFAULT_AGENT_UPDATE_SOCKET = "/run/forgezero-update/helper.sock";
+var MAX_AGENT_TARBALL_BYTES = 32 * 1024 * 1024;
+var VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+var REGISTRY = "registry.npmjs.org";
+function validateAgentRelease(release) {
+  if (release?.package !== "@forgezero/agent")
+    throw new Error("agent update package is fixed");
+  if (!VERSION.test(release.version))
+    throw new Error("agent update version must be exact semver");
+  const expectedTarball = `/@forgezero/agent/-/agent-${release.version}.tgz`;
+  let url;
+  try {
+    url = new URL(release.tarball);
+  } catch {
+    throw new Error("agent update tarball URL is malformed");
+  }
+  if (url.protocol !== "https:" || url.hostname !== REGISTRY || url.port || url.username || url.password || url.search || url.hash || url.pathname !== expectedTarball)
+    throw new Error("agent update tarball must be the exact official npm artifact");
+  const match = /^sha512-([A-Za-z0-9+/]+={0,2})$/.exec(release.integrity);
+  if (!match || Buffer.from(match[1], "base64").length !== 64) {
+    throw new Error("agent update requires one sha512 npm integrity");
+  }
+  return release;
+}
+function compareVersions(left, right) {
+  if (!VERSION.test(left) || !VERSION.test(right))
+    throw new Error("agent version must be exact semver");
+  const a = left.split(".").map(Number);
+  const b = right.split(".").map(Number);
+  for (let index = 0;index < 3; index += 1) {
+    if (a[index] > b[index])
+      return 1;
+    if (a[index] < b[index])
+      return -1;
+  }
+  return 0;
+}
+var command = async (input) => {
+  const child = Bun.spawn([input.command, ...input.args], {
+    cwd: input.cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" }
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  return { exitCode, output: `${stdout}${stderr}` };
+};
+var checked = async (run, input, label) => {
+  const result = await run(input);
+  if (result.exitCode !== 0)
+    throw new Error(`${label} failed: ${result.output.trim()}`);
+  return result;
+};
+async function validateReleaseDirectory(directory, release, run) {
+  const manifest = JSON.parse(readFileSync(join(directory, "package.json"), "utf8"));
+  if (manifest.name !== release.package || manifest.version !== release.version) {
+    throw new Error("agent update manifest does not match the selected release");
+  }
+  const agent = join(directory, "dist", "fz-agent.js");
+  const cli = join(directory, "dist", "fz.js");
+  for (const binary of [agent, cli]) {
+    if (!readFileSync(binary, "utf8").startsWith(`#!/usr/bin/env bun
+`)) {
+      throw new Error("agent update artifact is not a self-contained Bun executable");
+    }
+    chmodSync(binary, 493);
+  }
+  const version = (await checked(run, { command: agent, args: ["--version"] }, "agent update smoke test")).output.trim();
+  if (version !== release.version)
+    throw new Error(`agent update binary reports ${version}`);
+}
+async function stageAgentRelease(releaseInput, options) {
+  const release = validateAgentRelease(releaseInput);
+  if (compareVersions(release.version, options.currentVersion) <= 0) {
+    throw new Error(`agent update ${release.version} is not newer than ${options.currentVersion}`);
+  }
+  const root = resolve(options.root ?? DEFAULT_AGENT_RELEASE_ROOT);
+  const versions = join(root, "versions");
+  const finalDirectory = join(versions, release.version);
+  const currentLink = join(root, "current");
+  const stage = join(versions, `.${release.version}.${randomUUID()}.staging`);
+  const archive = join(stage, "agent.tgz");
+  const unpacked = join(stage, "unpacked");
+  const run = options.run ?? command;
+  mkdirSync(unpacked, { recursive: true, mode: 448 });
+  try {
+    const response = await (options.fetch ?? globalThis.fetch)(release.tarball, {
+      redirect: "error",
+      signal: AbortSignal.timeout(30000)
+    });
+    if (!response.ok)
+      throw new Error(`npm returned HTTP ${response.status}`);
+    const declared = Number(response.headers.get("content-length") ?? "0");
+    if (declared > MAX_AGENT_TARBALL_BYTES)
+      throw new Error("agent update tarball exceeds the size limit");
+    const bytes = Buffer.from(await response.arrayBuffer());
+    if (bytes.length === 0 || bytes.length > MAX_AGENT_TARBALL_BYTES) {
+      throw new Error("agent update tarball is empty or exceeds the size limit");
+    }
+    const expected = Buffer.from(release.integrity.slice("sha512-".length), "base64");
+    const actual = createHash("sha512").update(bytes).digest();
+    if (!timingSafeEqual(actual, expected))
+      throw new Error("agent update integrity mismatch");
+    writeFileSync(archive, bytes, { mode: 384, flag: "wx" });
+    await checked(run, {
+      command: "/usr/bin/tar",
+      args: [
+        "-xzf",
+        archive,
+        "-C",
+        unpacked,
+        "--strip-components=1",
+        "package/package.json",
+        "package/dist/fz-agent.js",
+        "package/dist/fz.js"
+      ]
+    }, "agent update extraction");
+    await validateReleaseDirectory(unpacked, release, run);
+    if (!existsSync(finalDirectory))
+      renameSync(unpacked, finalDirectory);
+    else
+      await validateReleaseDirectory(finalDirectory, release, run);
+    if (!existsSync(currentLink)) {
+      throw new Error("agent update requires an active immutable release to roll back to");
+    }
+    const previousTarget = readlinkSync(currentLink);
+    return {
+      version: release.version,
+      directory: finalDirectory,
+      previousTarget,
+      nextTarget: join("versions", release.version),
+      currentLink
+    };
+  } finally {
+    rmSync(stage, { recursive: true, force: true });
+  }
+}
+function selectAgentRelease(staged) {
+  const next = join(dirname(staged.currentLink), `.current.${randomUUID()}.next`);
+  try {
+    symlinkSync(staged.nextTarget, next);
+    renameSync(next, staged.currentLink);
+  } finally {
+    rmSync(next, { force: true });
+  }
+}
+function restoreAgentRelease(staged) {
+  const next = join(dirname(staged.currentLink), `.current.${randomUUID()}.rollback`);
+  try {
+    symlinkSync(staged.previousTarget, next);
+    renameSync(next, staged.currentLink);
+  } finally {
+    rmSync(next, { force: true });
+  }
+}
+export {
+  validateAgentRelease,
+  stageAgentRelease,
+  selectAgentRelease,
+  restoreAgentRelease,
+  compareVersions,
+  MAX_AGENT_TARBALL_BYTES,
+  DEFAULT_AGENT_UPDATE_SOCKET,
+  DEFAULT_AGENT_RELEASE_ROOT
+};

package/dist/definition.d.ts

@@ -1,10 +1,6 @@
 import type { Pipeline, PipelineStep } from './pipeline';
+import { type SoftwareRequirement } from './software';
 export declare const PIPELINE_VERSION: 1;
-export interface SoftwareRequirement {
-    name: string;
-    check: string;
-    install: string;
-}
 export interface PipelineRole {
     name: string;
     software: readonly SoftwareRequirement[];
@@ -29,5 +25,3 @@ export declare class DefinitionError extends Error {
 /** Validate parsed YAML before any command from it is allowed to run. */
 export declare function parseDeployDefinition(value: unknown): DeployDefinition;
 export declare function phasePipeline(definition: DeployDefinition, phase: DeployStep['phase']): Pipeline;
-/** Turn one role's declared software checks into the same executable pipeline shape. */
-export declare function prerequisitePipeline(definition: DeployDefinition, roleName: string): Pipeline;