@forgezero/agent 0.1.29 → 0.1.31

package/dist/fz-agent.js

@@ -4886,6 +4886,16 @@ import { readFileSync } from "fs";
 var BUN_INSTALLER_SHA256 = "bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd";
 var ARANGO_SHA256 = "b5a9197b4343f2ed554e1ebc1ef8e6529c7c39cde0035cdc311a4747a3355066";
 var CLOUDFLARED_SHA256 = "9d71c677db00134c1bd4144b7783486b654ad281b1ea62b4972098d19f770f17";
+var OS_CATALOG = [
+  { id: "ubuntu", version: "26.04", architecture: "x64", status: "active" }
+];
+var SOFTWARE_CATALOG = [
+  { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "arangodb", version: "3.11.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+];
 var UBUNTU_2604_X64 = [
   {
     requirement: { id: "bun", version: "1.3.14" },
@@ -4924,7 +4934,7 @@ function observeSoftwareHost(osRelease = readFileSync("/etc/os-release", "utf8")
     architecture
   };
 }
-function validateSoftwareRequirements(value) {
+function validateSoftwareRequirements(value, _options = {}) {
   if (!Array.isArray(value) || value.length > 32)
     throw new Error("software requirements must be an array of at most 32 entries");
   const seen = new Set;
@@ -4942,13 +4952,18 @@ function validateSoftwareRequirements(value) {
     if (seen.has(requirement.id))
       throw new Error(`duplicate software requirement: ${requirement.id}`);
     seen.add(requirement.id);
+    const catalog = SOFTWARE_CATALOG.find((candidate) => candidate.id === requirement.id && candidate.version === requirement.version);
+    if (!catalog || catalog.status !== "active") {
+      throw new Error(`software requirement is not active: ${requirement.id}@${requirement.version}`);
+    }
     return requirement;
   });
 }
 async function ensureSoftwareRequirements(requirementsInput, options) {
   const requirements = validateSoftwareRequirements(requirementsInput);
   const observation = options.observation ?? observeSoftwareHost();
-  if (observation.os.id !== "ubuntu" || observation.os.versionId !== "26.04" || observation.architecture !== "x64") {
+  const os = OS_CATALOG.find((candidate) => candidate.id === observation.os.id && candidate.version === observation.os.versionId && candidate.architecture === observation.architecture);
+  if (!os || os.status !== "active") {
     throw new Error(`unsupported software strategy: ${observation.os.id} ${observation.os.versionId} ${observation.architecture}`);
   }
   const results = [];
@@ -4973,7 +4988,8 @@ async function ensureSoftwareRequirements(requirementsInput, options) {
 }
 
 // src/definition.ts
-var PIPELINE_VERSION = 1;
+var PIPELINE_VERSION = 2;
+var DEPLOY_SCHEMA_URL = "https://www.forgezero.net/schemas/deploy-v2.json";
 
 class DefinitionError extends Error {
   constructor(message) {
@@ -4998,6 +5014,7 @@ var exactKeys = (value, allowed, where) => {
   if (unknown.length > 0)
     throw new DefinitionError(`${where} contains unknown field(s): ${unknown.join(", ")}.`);
 };
+var NAME = /^[a-z][a-z0-9-]{0,62}$/;
 var RESERVED_STEP_ENV = new Set([
   "PATH",
   "HOME",
@@ -5010,46 +5027,67 @@ var RESERVED_STEP_ENV = new Set([
   "GIT_SSH",
   "GIT_SSH_COMMAND"
 ]);
-function parseDeployDefinition(value) {
+function parseDeployDefinition(value, options = {}) {
   const root = record(value, "pipeline");
-  exactKeys(root, ["version", "name", "requireAttestation", "roles", "steps"], "pipeline");
+  exactKeys(root, ["$schema", "version", "name", "requireAttestation", "profiles", "steps"], "pipeline");
+  if (root.$schema !== undefined && root.$schema !== DEPLOY_SCHEMA_URL) {
+    throw new DefinitionError(`pipeline.$schema must be ${DEPLOY_SCHEMA_URL}.`);
+  }
   if (root.version !== PIPELINE_VERSION) {
     throw new DefinitionError(`pipeline.version must be ${PIPELINE_VERSION}.`);
   }
-  if (!Array.isArray(root.roles) || root.roles.length === 0) {
-    throw new DefinitionError("pipeline.roles must contain at least one role.");
+  if (root.requireAttestation !== undefined && typeof root.requireAttestation !== "boolean") {
+    throw new DefinitionError("pipeline.requireAttestation must be a boolean.");
+  }
+  const rawProfiles = record(root.profiles, "pipeline.profiles");
+  const profileEntries = Object.entries(rawProfiles);
+  if (profileEntries.length === 0 || profileEntries.length > 32) {
+    throw new DefinitionError("pipeline.profiles must contain from 1 to 32 named profiles.");
   }
   if (!Array.isArray(root.steps) || root.steps.length === 0) {
     throw new DefinitionError("pipeline.steps must contain at least one step.");
   }
-  const roles = root.roles.map((raw, index) => {
-    const role = record(raw, `roles[${index}]`);
-    exactKeys(role, ["name", "software"], `roles[${index}]`);
-    if (!Array.isArray(role.software)) {
-      throw new DefinitionError(`roles[${index}].software must be an array.`);
+  const profiles = {};
+  for (const [name2, raw] of profileEntries) {
+    if (!NAME.test(name2))
+      throw new DefinitionError(`pipeline profile name is invalid: ${name2}.`);
+    const profile = record(raw, `profiles.${name2}`);
+    exactKeys(profile, ["software"], `profiles.${name2}`);
+    if (!Array.isArray(profile.software)) {
+      throw new DefinitionError(`profiles.${name2}.software must be an array.`);
     }
-    return {
-      name: text(role.name, `roles[${index}].name`),
-      software: validateSoftwareRequirements(role.software)
-    };
-  });
-  if (new Set(roles.map((role) => role.name)).size !== roles.length) {
-    throw new DefinitionError("pipeline.roles must have unique names.");
+    profiles[name2] = { software: validateSoftwareRequirements(profile.software, options) };
   }
   const phases = new Set(["build", "release", "migrate", "health"]);
   const steps = root.steps.map((raw, index) => {
     const step = record(raw, `steps[${index}]`);
-    exactKeys(step, ["name", "run", "phase", "secrets", "once", "always", "timeoutMs", "when"], `steps[${index}]`);
+    exactKeys(step, ["name", "run", "phase", "scope", "profiles", "secrets", "always", "timeoutMs", "when"], `steps[${index}]`);
     const phase = text(step.phase, `steps[${index}].phase`);
     if (!phases.has(phase))
       throw new DefinitionError(`steps[${index}].phase is not supported.`);
-    if (step.secrets !== undefined && (!Array.isArray(step.secrets) || step.secrets.some((name) => typeof name !== "string" || !/^[A-Z_][A-Z0-9_]*$/.test(name)))) {
+    if (step.scope !== "target" && step.scope !== "release") {
+      throw new DefinitionError(`steps[${index}].scope must be target or release.`);
+    }
+    if (step.always !== undefined && typeof step.always !== "boolean") {
+      throw new DefinitionError(`steps[${index}].always must be a boolean.`);
+    }
+    let selectedProfiles;
+    if (step.profiles !== undefined) {
+      if (!Array.isArray(step.profiles) || step.profiles.length === 0 || step.profiles.some((name2) => typeof name2 !== "string" || !Object.hasOwn(profiles, name2))) {
+        throw new DefinitionError(`steps[${index}].profiles must name existing profiles.`);
+      }
+      selectedProfiles = [...step.profiles];
+      if (new Set(selectedProfiles).size !== selectedProfiles.length) {
+        throw new DefinitionError(`steps[${index}].profiles must not contain duplicates.`);
+      }
+    }
+    if (step.secrets !== undefined && (!Array.isArray(step.secrets) || step.secrets.some((name2) => typeof name2 !== "string" || !/^[A-Z_][A-Z0-9_]*$/.test(name2)))) {
       throw new DefinitionError(`steps[${index}].secrets must contain names only.`);
     }
     if (Array.isArray(step.secrets) && new Set(step.secrets).size !== step.secrets.length) {
       throw new DefinitionError(`steps[${index}].secrets must not contain duplicates.`);
     }
-    if (Array.isArray(step.secrets) && step.secrets.some((name) => RESERVED_STEP_ENV.has(String(name)))) {
+    if (Array.isArray(step.secrets) && step.secrets.some((name2) => RESERVED_STEP_ENV.has(String(name2)))) {
       throw new DefinitionError(`steps[${index}].secrets may not replace process-control environment variables.`);
     }
     const timeoutMs = step.timeoutMs === undefined ? undefined : Number(step.timeoutMs);
@@ -5060,11 +5098,11 @@ function parseDeployDefinition(value) {
     if (step.when !== undefined) {
       const conditions = record(step.when, `steps[${index}].when`);
       when = {};
-      for (const [name, expected] of Object.entries(conditions)) {
-        if (!/^[A-Z_][A-Z0-9_]*$/.test(name) || typeof expected !== "string" || expected.length === 0) {
+      for (const [name2, expected] of Object.entries(conditions)) {
+        if (!/^[A-Z_][A-Z0-9_]*$/.test(name2) || typeof expected !== "string" || expected.length === 0) {
           throw new DefinitionError(`steps[${index}].when must map environment names to non-empty strings.`);
         }
-        when[name] = expected;
+        when[name2] = expected;
       }
       if (Object.keys(when).length === 0)
         throw new DefinitionError(`steps[${index}].when must not be empty.`);
@@ -5073,8 +5111,9 @@ function parseDeployDefinition(value) {
       name: text(step.name, `steps[${index}].name`),
       run: text(step.run, `steps[${index}].run`),
       phase,
+      scope: step.scope,
+      profiles: selectedProfiles,
       secrets: step.secrets,
-      once: step.once === true,
       always: step.always === true,
       timeoutMs,
       when
@@ -5083,15 +5122,32 @@ function parseDeployDefinition(value) {
   if (new Set(steps.map((step) => step.name)).size !== steps.length) {
     throw new DefinitionError("pipeline.steps must have unique names.");
   }
+  const name = text(root.name, "pipeline.name");
+  if (name.length > 120)
+    throw new DefinitionError("pipeline.name must be at most 120 characters.");
   return {
     version: PIPELINE_VERSION,
-    name: text(root.name, "pipeline.name"),
+    name,
     requireAttestation: root.requireAttestation === true,
-    roles,
+    profiles,
     steps
   };
 }
 
+// src/deploy-file.ts
+import { createHash } from "crypto";
+var stable = (value) => {
+  if (Array.isArray(value))
+    return `[${value.map(stable).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).filter(([, entry]) => entry !== undefined).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${stable(entry)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+};
+function deployDefinitionDigest(definition) {
+  return `sha256:${createHash("sha256").update(stable(definition)).digest("hex")}`;
+}
+
 // src/pipeline.ts
 class PipelineError extends Error {
   code;
@@ -5217,7 +5273,7 @@ function createDeploymentManager(options) {
   const exec = options.exec ?? shell;
   const projectExec = options.projectExec ?? exec;
   const now = options.now ?? Date.now;
-  const readDefinition = options.readDefinition ?? ((path) => Bun.YAML.parse(readFileSync2(path, "utf8")));
+  const readDefinition = options.readDefinition ?? ((path) => JSON.parse(readFileSync2(path, "utf8")));
   const credentialsDirectory = process.env.CREDENTIALS_DIRECTORY;
   const gitCredentialPath = options.gitCredentialPath ?? (credentialsDirectory ? join(credentialsDirectory, "git-deploy-key") : undefined);
   const knownHostsPath = options.knownHostsPath ?? "/etc/forgezero/git/known_hosts";
@@ -5332,22 +5388,23 @@ function createDeploymentManager(options) {
     if (request.revision && head !== request.revision) {
       throw new DeploymentError("SOURCE_FAILED", `Git checked out ${head}, not requested ${request.revision}.`);
     }
-    const definition = parseDeployDefinition(readDefinition(join(release, ".fz", "deploy.yaml")));
-    const selectedRole = definition.roles.find((candidate) => candidate.name === options.role);
-    if (!selectedRole)
-      throw new DeploymentError("PIPELINE_FAILED", `pipeline role does not exist: ${options.role}.`);
-    if (selectedRole.software.length > 0) {
+    const definition = parseDeployDefinition(readDefinition(join(release, ".fz", "deploy.json")));
+    const definitionDigest = deployDefinitionDigest(definition);
+    const selectedProfile = definition.profiles[options.profile];
+    if (!selectedProfile)
+      throw new DeploymentError("PIPELINE_FAILED", `pipeline profile does not exist: ${options.profile}.`);
+    if (selectedProfile.software.length > 0) {
       if (!options.ensureSoftware) {
         throw new DeploymentError("PIPELINE_FAILED", "the supervised software helper is unavailable");
       }
-      await options.ensureSoftware(selectedRole.software);
+      await options.ensureSoftware(selectedProfile.software);
     }
     const phaseEnvironment = {
       ...options.environment ?? {},
       FZ_RELEASE: release,
       FZ_DEPLOY_REVISION: head,
       FZ_DEPLOY_BRANCH: options.branch,
-      FZ_DEPLOY_ROLE: options.role,
+      FZ_DEPLOY_PROFILE: options.profile,
       ...options.publicApiUrl ? { PUBLIC_API_URL: options.publicApiUrl } : {}
     };
     const phaseExec = ({ command, env: secrets, timeoutMs }) => projectExec({ command, cwd: release, env: { ...phaseEnvironment, ...secrets }, timeoutMs });
@@ -5363,7 +5420,7 @@ function createDeploymentManager(options) {
         return {
           name: `${definition.name}:${phase}`,
           requireAttestation: definition.requireAttestation,
-          steps: definition.steps.filter((step) => step.phase === phase && (!step.once || request.coordinator === true) && (!step.when || Object.entries(step.when).every(([name, expected]) => phaseEnvironment[name] === expected)))
+          steps: definition.steps.filter((step) => step.phase === phase && (!step.profiles || step.profiles.includes(options.profile)) && (step.scope === "target" || request.releaseExecutor === true) && (!step.when || Object.entries(step.when).every(([name, expected]) => phaseEnvironment[name] === expected)))
         };
       })
     ].filter((pipeline) => pipeline.steps.length > 0);
@@ -5382,6 +5439,9 @@ function createDeploymentManager(options) {
       repository: options.repository,
       branch: options.branch,
       revision: head,
+      definitionDigest,
+      definitionVersion: definition.version,
+      profile: options.profile,
       release,
       ok: true,
       phases
@@ -5400,7 +5460,7 @@ function createDeploymentManager(options) {
       return revision.toLowerCase();
     },
     deploy(request = {}) {
-      const revisionKey = request.revision ? `${request.revision.toLowerCase()}:${request.coordinator === true ? "coordinator" : "node"}` : undefined;
+      const revisionKey = request.revision ? `${request.revision.toLowerCase()}:${request.releaseExecutor === true ? "release" : "target"}` : undefined;
       if (revisionKey) {
         const existing = activeRevisions.get(revisionKey);
         if (existing)
@@ -5592,7 +5652,7 @@ async function deployClaim(options, claim) {
   schedule();
   let result;
   try {
-    result = await manager.deploy({ revision: claim.revision, coordinator: claim.coordinator }).result;
+    result = await manager.deploy({ revision: claim.revision, releaseExecutor: claim.releaseExecutor }).result;
   } finally {
     stopped = true;
     clearTimer(timer);
@@ -5645,7 +5705,10 @@ async function pullDeploymentOnce(options) {
     claimToken: claim.claimToken,
     ok: true,
     detail: `Deployed ${result.revision}.`,
-    release: result.release
+    release: result.release,
+    definitionDigest: result.definitionDigest,
+    definitionVersion: result.definitionVersion,
+    profile: result.profile
   });
   return { status: "deployed", claim, result };
 }
@@ -6064,7 +6127,7 @@ import { chmodSync as chmodSync5, existsSync as existsSync6, unlinkSync as unlin
 import { connect as connect2, createServer as createServer3 } from "net";
 
 // src/metal-provision.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import {
   existsSync as existsSync5,
   mkdirSync as mkdirSync3,
@@ -6217,8 +6280,8 @@ function membersOfLinuxList(value, label) {
     throw new MetalProvisionError(`${label} list overlaps itself`);
   return members;
 }
-var guestNameFor = (computeKey) => `fzg-${createHash("sha256").update(computeKey).digest("hex").slice(0, 16)}`;
-var tapNameFor = (computeKey) => `fzt${createHash("sha256").update(computeKey).digest("hex").slice(0, 12)}`;
+var guestNameFor = (computeKey) => `fzg-${createHash2("sha256").update(computeKey).digest("hex").slice(0, 16)}`;
+var tapNameFor = (computeKey) => `fzt${createHash2("sha256").update(computeKey).digest("hex").slice(0, 12)}`;
 var macForAddress = (address) => {
   const octets = address.split(".").map(Number);
   if (octets.length !== 4 || octets.some((value) => !Number.isInteger(value) || value < 0 || value > 255)) {
@@ -6300,7 +6363,7 @@ function allocateAddress(profile, computeKey, rows) {
     return existing.address;
   const used = new Set(rows.map((row) => row.address));
   const width = profile.addressEnd - profile.addressStart + 1;
-  const start = createHash("sha256").update(computeKey).digest().readUInt16BE(0) % width;
+  const start = createHash2("sha256").update(computeKey).digest().readUInt16BE(0) % width;
   for (let offset = 0;offset < width; offset += 1) {
     const last = profile.addressStart + (start + offset) % width;
     const address = `${profile.subnetPrefix}.${last}`;
@@ -7515,7 +7578,7 @@ function materializeWarpMdm(options) {
 }
 
 // src/agent-update.ts
-import { createHash as createHash2, timingSafeEqual, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash3, timingSafeEqual, randomUUID as randomUUID2 } from "crypto";
 import {
   chmodSync as chmodSync9,
   existsSync as existsSync10,
@@ -7633,7 +7696,7 @@ async function stageAgentRelease(releaseInput, options) {
       throw new Error("agent update tarball is empty or exceeds the size limit");
     }
     const expected = Buffer.from(release.integrity.slice("sha512-".length), "base64");
-    const actual = createHash2("sha512").update(bytes).digest();
+    const actual = createHash3("sha512").update(bytes).digest();
     if (!timingSafeEqual(actual, expected))
       throw new Error("agent update integrity mismatch");
     writeFileSync6(archive, bytes, { mode: 384, flag: "wx" });
@@ -7875,7 +7938,7 @@ function requestAgentUpdate(request, socketPath = DEFAULT_AGENT_UPDATE_SOCKET, t
 import { readFileSync as readFileSync7 } from "fs";
 
 // src/version.ts
-var VERSION2 = "0.1.29";
+var VERSION2 = "0.1.31";
 
 // src/agent-heartbeat.ts
 var unquote = (value) => value.replace(/^['"]|['"]$/g, "");
@@ -8164,7 +8227,7 @@ if (import.meta.main) {
       "  FZ_SEED_PATH       legacy/dev seed file (default: " + DEFAULT_SEED_PATH + ")",
       "  FZ_NODE_KEY      override the node key  (default: derived from the seed)",
       "",
-      "  deploy [--revision=<full-sha>] [--coordinator]",
+      "  deploy [--revision=<full-sha>] [--release-executor]",
       "  identity            print this sealed seed's public identity",
       "  enrol               consume a systemd-loaded compute capability",
       "  metal-helper --profile=/etc/forgezero/metal.json",
@@ -8221,9 +8284,9 @@ if (import.meta.main) {
     const profilePath = args.find((arg) => arg.startsWith("--profile="))?.slice("--profile=".length);
     if (!profilePath)
       throw new Error("metal-helper requires --profile=/absolute/path.json");
-    const profile = JSON.parse(readFileSync8(profilePath, "utf8"));
+    const profile2 = JSON.parse(readFileSync8(profilePath, "utf8"));
     const helper = startMetalHelper({
-      profile,
+      profile: profile2,
       socketPath: process.env.FZ_METAL_HELPER_SOCKET ?? DEFAULT_METAL_HELPER_SOCKET
     });
     console.log(`[metal-helper] listening on ${process.env.FZ_METAL_HELPER_SOCKET ?? DEFAULT_METAL_HELPER_SOCKET}`);
@@ -8339,8 +8402,8 @@ if (import.meta.main) {
     const profilePath = args.find((arg) => arg.startsWith("--profile="))?.slice("--profile=".length);
     if (!profilePath)
       throw new Error("metal-isolation requires --profile=/absolute/path.json");
-    const profile = JSON.parse(readFileSync8(profilePath, "utf8"));
-    await applyMetalIsolation(profile);
+    const profile2 = JSON.parse(readFileSync8(profilePath, "utf8"));
+    await applyMetalIsolation(profile2);
     console.log("[metal-isolation] host and guest cgroup boundaries active");
     process.exit(0);
   }
@@ -8468,7 +8531,7 @@ if (import.meta.main) {
       op: "deploy",
       request: {
         revision: revisionArg?.slice("--revision=".length),
-        coordinator: args.includes("--coordinator")
+        releaseExecutor: args.includes("--release-executor")
       }
     } : command2 === "cancel" ? { op: "cancel", id: idArg?.slice("--id=".length) ?? "" } : ["pause-key", "resume-key", "stop-key", "start-key"].includes(command2) ? {
       op: command2,
@@ -8575,19 +8638,19 @@ if (import.meta.main) {
   } : systemdDeploymentSecrets;
   const repository = process.env.FZ_DEPLOY_REPO;
   const branch = process.env.FZ_DEPLOY_BRANCH;
-  const role = process.env.FZ_DEPLOY_ROLE;
+  const profile = process.env.FZ_DEPLOY_PROFILE;
   const root = process.env.FZ_DEPLOY_ROOT;
   const pullEnabled = process.env.FZ_DEPLOY_PULL === "true" && Boolean(process.env.FZ_API);
   if (pullEnabled && !binding) {
     throw new Error("agent: outbound guest deployment requires a persisted tenant enrolment binding");
   }
-  if (root && (repository && branch && role || pullEnabled)) {
+  if (root && (repository && branch && profile || pullEnabled)) {
     const managers = new Map;
     const managerOptions = (source, key) => ({
       key,
       repository: source.repository,
       branch: source.branch,
-      role: source.role,
+      profile: source.profile,
       sourceAuth: source.auth,
       root,
       publicApiUrl: process.env.FZ_PUBLIC_API_URL,
@@ -8604,7 +8667,7 @@ if (import.meta.main) {
       ensureSoftware: (requirements) => requestSoftware(requirements, process.env.FZ_SOFTWARE_HELPER_SOCKET ?? DEFAULT_SOFTWARE_HELPER_SOCKET),
       projectExec: process.env.FZ_DEPLOY_RUNNER_SOCKET ? (input) => requestDeploymentCommand(input, process.env.FZ_DEPLOY_RUNNER_SOCKET) : undefined
     });
-    const staticManager = repository && branch && role ? createDeploymentManager(managerOptions({ repository, branch, role }, process.env.FZ_DEPLOY_KEY ?? `${repository}:${branch}:${role}`)) : undefined;
+    const staticManager = repository && branch && profile ? createDeploymentManager(managerOptions({ repository, branch, profile }, process.env.FZ_DEPLOY_KEY ?? `${repository}:${branch}:${profile}`)) : undefined;
     if (staticManager)
       managers.set("__static__", staticManager);
     const control = staticManager ? startControlServer(staticManager, process.env.FZ_CONTROL_SOCKET ?? DEFAULT_CONTROL_SOCKET) : undefined;
@@ -8620,7 +8683,7 @@ if (import.meta.main) {
           claim.pipelineKey,
           claim.source.repository,
           claim.source.branch,
-          claim.source.role,
+          claim.source.profile,
           JSON.stringify(claim.source.auth ?? null)
         ].join("\x00");
         const existing = managers.get(cacheKey);
@@ -8818,6 +8881,8 @@ export {
   SUPPORTED_GUEST_IMAGE,
   SOFTWARE_HELPER_UNIT_PATH,
   SOFTWARE_HELPER_GROUP,
+  SOFTWARE_CATALOG,
+  OS_CATALOG,
   MAX_AGENT_TARBALL_BYTES,
   DeploymentError,
   DEFAULT_SOFTWARE_HELPER_SOCKET,