@forgezero/agent 0.1.26 → 0.1.28

package/dist/definition.js

@@ -1,3 +1,94 @@
+// src/software.ts
+import { readFileSync } from "node:fs";
+var BUN_INSTALLER_SHA256 = "bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd";
+var ARANGO_SHA256 = "b5a9197b4343f2ed554e1ebc1ef8e6529c7c39cde0035cdc311a4747a3355066";
+var CLOUDFLARED_SHA256 = "9d71c677db00134c1bd4144b7783486b654ad281b1ea62b4972098d19f770f17";
+var UBUNTU_2604_X64 = [
+  {
+    requirement: { id: "bun", version: "1.3.14" },
+    check: 'test "$(/usr/local/bin/bun --version 2>/dev/null)" = 1.3.14',
+    install: `tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT; ` + `curl -fsSL https://bun.sh/install -o "$tmp/install"; ` + `echo "${BUN_INSTALLER_SHA256}  $tmp/install" | sha256sum -c -; ` + `BUN_INSTALL="$tmp/bun" BUN_VERSION=1.3.14 bash "$tmp/install" >/dev/null; ` + `install -d -m 0755 /usr/local/lib/forgezero/runtime; ` + `install -m 0755 "$tmp/bun/bin/bun" /usr/local/lib/forgezero/runtime/bun.next; ` + `mv -Tf /usr/local/lib/forgezero/runtime/bun.next /usr/local/lib/forgezero/runtime/bun; ` + `ln -sfn /usr/local/lib/forgezero/runtime/bun /usr/local/bin/bun`
+  },
+  {
+    requirement: { id: "nginx", version: "ubuntu-26.04" },
+    check: "command -v nginx >/dev/null && systemctl is-active --quiet nginx",
+    install: "DEBIAN_FRONTEND=noninteractive apt-get update -qq && apt-get install -y nginx && systemctl enable --now nginx"
+  },
+  {
+    requirement: { id: "arangodb", version: "3.11.14" },
+    check: `arangod --version 2>/dev/null | head -1 | grep -q '3.11.14'`,
+    install: `tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT; ` + `curl -fsSL 'https://download.arangodb.com/arangodb311/DEBIAN/amd64/arangodb3_3.11.14-1_amd64.deb' -o "$tmp/arangodb.deb"; ` + `echo "${ARANGO_SHA256}  $tmp/arangodb.deb" | sha256sum -c -; ` + `DEBIAN_FRONTEND=noninteractive dpkg -i "$tmp/arangodb.deb" >/dev/null 2>&1 || ` + `DEBIAN_FRONTEND=noninteractive apt-get -y -f install`
+  },
+  {
+    requirement: { id: "cloudflared", version: "2026.7.3" },
+    check: `cloudflared --version 2>/dev/null | grep -q '2026.7.3'`,
+    install: `tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT; ` + `curl -fsSL 'https://github.com/cloudflare/cloudflared/releases/download/2026.7.3/cloudflared-linux-amd64' -o "$tmp/cloudflared"; ` + `echo "${CLOUDFLARED_SHA256}  $tmp/cloudflared" | sha256sum -c -; ` + `install -m 0755 "$tmp/cloudflared" /usr/local/bin/cloudflared`
+  },
+  {
+    requirement: { id: "ufw", version: "ubuntu-26.04" },
+    check: "command -v ufw >/dev/null",
+    install: "DEBIAN_FRONTEND=noninteractive apt-get update -qq && apt-get install -y ufw"
+  }
+];
+function observeSoftwareHost(osRelease = readFileSync("/etc/os-release", "utf8"), architecture = process.arch) {
+  const values = Object.fromEntries(osRelease.split(`
+`).flatMap((line) => {
+    const separator = line.indexOf("=");
+    return separator > 0 ? [[line.slice(0, separator), line.slice(separator + 1).replace(/^['"]|['"]$/g, "")]] : [];
+  }));
+  return {
+    os: { id: (values.ID ?? "unknown").toLowerCase(), versionId: values.VERSION_ID ?? "unknown" },
+    architecture
+  };
+}
+function validateSoftwareRequirements(value) {
+  if (!Array.isArray(value) || value.length > 32)
+    throw new Error("software requirements must be an array of at most 32 entries");
+  const seen = new Set;
+  return value.map((item) => {
+    if (!item || typeof item !== "object" || Array.isArray(item))
+      throw new Error("software requirement must be an object");
+    const row = item;
+    if (Object.keys(row).some((key) => key !== "id" && key !== "version")) {
+      throw new Error("software requirement contains an unknown field");
+    }
+    if (!["bun", "nginx", "arangodb", "cloudflared", "ufw"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
+      throw new Error("software requirement coordinate is invalid");
+    }
+    const requirement = { id: row.id, version: row.version };
+    if (seen.has(requirement.id))
+      throw new Error(`duplicate software requirement: ${requirement.id}`);
+    seen.add(requirement.id);
+    return requirement;
+  });
+}
+async function ensureSoftwareRequirements(requirementsInput, options) {
+  const requirements = validateSoftwareRequirements(requirementsInput);
+  const observation = options.observation ?? observeSoftwareHost();
+  if (observation.os.id !== "ubuntu" || observation.os.versionId !== "26.04" || observation.architecture !== "x64") {
+    throw new Error(`unsupported software strategy: ${observation.os.id} ${observation.os.versionId} ${observation.architecture}`);
+  }
+  const results = [];
+  for (const requirement of requirements) {
+    const strategy = UBUNTU_2604_X64.find(({ requirement: candidate }) => candidate.id === requirement.id && candidate.version === requirement.version);
+    if (!strategy)
+      throw new Error(`unsupported software requirement: ${requirement.id}@${requirement.version}`);
+    const before = await options.exec(strategy.check);
+    if (before.exitCode === 0) {
+      results.push({ ...requirement, changed: false });
+      continue;
+    }
+    const installed = await options.exec(strategy.install);
+    if (installed.exitCode !== 0)
+      throw new Error(`could not install ${requirement.id}@${requirement.version}: ${installed.output.trim()}`);
+    const after = await options.exec(strategy.check);
+    if (after.exitCode !== 0)
+      throw new Error(`${requirement.id}@${requirement.version} did not pass its post-install check`);
+    results.push({ ...requirement, changed: true });
+  }
+  return results;
+}
+
 // src/definition.ts
 var PIPELINE_VERSION = 1;
 
@@ -56,15 +147,7 @@ function parseDeployDefinition(value) {
     }
     return {
       name: text(role.name, `roles[${index}].name`),
-      software: role.software.map((rawSoftware, softwareIndex) => {
-        const software = record(rawSoftware, `roles[${index}].software[${softwareIndex}]`);
-        exactKeys(software, ["name", "check", "install"], `roles[${index}].software[${softwareIndex}]`);
-        return {
-          name: text(software.name, `roles[${index}].software[${softwareIndex}].name`),
-          check: text(software.check, `roles[${index}].software[${softwareIndex}].check`),
-          install: text(software.install, `roles[${index}].software[${softwareIndex}].install`)
-        };
-      })
+      software: validateSoftwareRequirements(role.software)
     };
   });
   if (new Set(roles.map((role) => role.name)).size !== roles.length) {
@@ -132,21 +215,7 @@ function phasePipeline(definition, phase) {
     steps: definition.steps.filter((step) => step.phase === phase)
   };
 }
-function prerequisitePipeline(definition, roleName) {
-  const role = definition.roles.find((candidate) => candidate.name === roleName);
-  if (!role)
-    throw new DefinitionError(`pipeline role does not exist: ${roleName}.`);
-  return {
-    name: `${definition.name}:prerequisites:${role.name}`,
-    requireAttestation: definition.requireAttestation,
-    steps: role.software.map((software) => ({
-      name: `prepare ${software.name}`,
-      run: `${software.check} >/dev/null 2>&1 || { ${software.install}; ${software.check}; }`
-    }))
-  };
-}
 export {
-  prerequisitePipeline,
   phasePipeline,
   parseDeployDefinition,
   PIPELINE_VERSION,

package/dist/deployment-pull.d.ts

@@ -7,6 +7,8 @@ export interface RemoteDeploymentClaim {
     claimToken: string;
     claimExpiresAtTs: number;
     attempt: number;
+    /** True on exactly one compute in a clustered delivery. */
+    coordinator: boolean;
     source: {
         repository: string;
         branch: string;

package/dist/deployment.d.ts

@@ -1,4 +1,5 @@
 import { type DrainReport, type QueueTask } from '@forgezero/runtime/queue';
+import type { SoftwareRequirement } from './software';
 import { type RunResult } from './pipeline';
 import type { SecretCache } from './cache';
 import type { AttestationSource } from './socket';
@@ -60,6 +61,8 @@ export interface DeploymentOptions {
     width?: number;
     /** Project commands run through a credential-free Unix identity in production. */
     projectExec?: (input: CommandInput) => Promise<CommandResult>;
+    /** Root-owned fixed strategy helper; repository data contains coordinates only. */
+    ensureSoftware?: (requirements: readonly SoftwareRequirement[]) => Promise<unknown>;
     exec?: (input: CommandInput) => Promise<CommandResult>;
     now?: () => number;
     readDefinition?: (path: string) => unknown;