@forgezero/agent 0.1.30 → 0.1.31

package/dist/fz-agent.js

@@ -4934,7 +4934,7 @@ function observeSoftwareHost(osRelease = readFileSync("/etc/os-release", "utf8")
     architecture
   };
 }
-function validateSoftwareRequirements(value, options = {}) {
+function validateSoftwareRequirements(value, _options = {}) {
   if (!Array.isArray(value) || value.length > 32)
     throw new Error("software requirements must be an array of at most 32 entries");
   const seen = new Set;
@@ -4953,8 +4953,8 @@ function validateSoftwareRequirements(value, options = {}) {
       throw new Error(`duplicate software requirement: ${requirement.id}`);
     seen.add(requirement.id);
     const catalog = SOFTWARE_CATALOG.find((candidate) => candidate.id === requirement.id && candidate.version === requirement.version);
-    if (!catalog || catalog.status === "retired" || options.channel !== "development" && catalog.status !== "active") {
-      throw new Error(`software requirement is not available for ${options.channel ?? "production"}: ${requirement.id}@${requirement.version}`);
+    if (!catalog || catalog.status !== "active") {
+      throw new Error(`software requirement is not active: ${requirement.id}@${requirement.version}`);
     }
     return requirement;
   });
@@ -4989,6 +4989,7 @@ async function ensureSoftwareRequirements(requirementsInput, options) {
 
 // src/definition.ts
 var PIPELINE_VERSION = 2;
+var DEPLOY_SCHEMA_URL = "https://www.forgezero.net/schemas/deploy-v2.json";
 
 class DefinitionError extends Error {
   constructor(message) {
@@ -5026,15 +5027,18 @@ var RESERVED_STEP_ENV = new Set([
   "GIT_SSH",
   "GIT_SSH_COMMAND"
 ]);
-function parseDeployDefinition(value) {
+function parseDeployDefinition(value, options = {}) {
   const root = record(value, "pipeline");
   exactKeys(root, ["$schema", "version", "name", "requireAttestation", "profiles", "steps"], "pipeline");
-  if (root.$schema !== undefined && (typeof root.$schema !== "string" || !root.$schema.startsWith("https://"))) {
-    throw new DefinitionError("pipeline.$schema must be an HTTPS URL.");
+  if (root.$schema !== undefined && root.$schema !== DEPLOY_SCHEMA_URL) {
+    throw new DefinitionError(`pipeline.$schema must be ${DEPLOY_SCHEMA_URL}.`);
   }
   if (root.version !== PIPELINE_VERSION) {
     throw new DefinitionError(`pipeline.version must be ${PIPELINE_VERSION}.`);
   }
+  if (root.requireAttestation !== undefined && typeof root.requireAttestation !== "boolean") {
+    throw new DefinitionError("pipeline.requireAttestation must be a boolean.");
+  }
   const rawProfiles = record(root.profiles, "pipeline.profiles");
   const profileEntries = Object.entries(rawProfiles);
   if (profileEntries.length === 0 || profileEntries.length > 32) {
@@ -5044,15 +5048,15 @@ function parseDeployDefinition(value) {
     throw new DefinitionError("pipeline.steps must contain at least one step.");
   }
   const profiles = {};
-  for (const [name, raw] of profileEntries) {
-    if (!NAME.test(name))
-      throw new DefinitionError(`pipeline profile name is invalid: ${name}.`);
-    const profile = record(raw, `profiles.${name}`);
-    exactKeys(profile, ["software"], `profiles.${name}`);
+  for (const [name2, raw] of profileEntries) {
+    if (!NAME.test(name2))
+      throw new DefinitionError(`pipeline profile name is invalid: ${name2}.`);
+    const profile = record(raw, `profiles.${name2}`);
+    exactKeys(profile, ["software"], `profiles.${name2}`);
     if (!Array.isArray(profile.software)) {
-      throw new DefinitionError(`profiles.${name}.software must be an array.`);
+      throw new DefinitionError(`profiles.${name2}.software must be an array.`);
     }
-    profiles[name] = { software: validateSoftwareRequirements(profile.software) };
+    profiles[name2] = { software: validateSoftwareRequirements(profile.software, options) };
   }
   const phases = new Set(["build", "release", "migrate", "health"]);
   const steps = root.steps.map((raw, index) => {
@@ -5064,9 +5068,12 @@ function parseDeployDefinition(value) {
     if (step.scope !== "target" && step.scope !== "release") {
       throw new DefinitionError(`steps[${index}].scope must be target or release.`);
     }
+    if (step.always !== undefined && typeof step.always !== "boolean") {
+      throw new DefinitionError(`steps[${index}].always must be a boolean.`);
+    }
     let selectedProfiles;
     if (step.profiles !== undefined) {
-      if (!Array.isArray(step.profiles) || step.profiles.length === 0 || step.profiles.some((name) => typeof name !== "string" || !Object.hasOwn(profiles, name))) {
+      if (!Array.isArray(step.profiles) || step.profiles.length === 0 || step.profiles.some((name2) => typeof name2 !== "string" || !Object.hasOwn(profiles, name2))) {
         throw new DefinitionError(`steps[${index}].profiles must name existing profiles.`);
       }
       selectedProfiles = [...step.profiles];
@@ -5074,13 +5081,13 @@ function parseDeployDefinition(value) {
         throw new DefinitionError(`steps[${index}].profiles must not contain duplicates.`);
       }
     }
-    if (step.secrets !== undefined && (!Array.isArray(step.secrets) || step.secrets.some((name) => typeof name !== "string" || !/^[A-Z_][A-Z0-9_]*$/.test(name)))) {
+    if (step.secrets !== undefined && (!Array.isArray(step.secrets) || step.secrets.some((name2) => typeof name2 !== "string" || !/^[A-Z_][A-Z0-9_]*$/.test(name2)))) {
       throw new DefinitionError(`steps[${index}].secrets must contain names only.`);
     }
     if (Array.isArray(step.secrets) && new Set(step.secrets).size !== step.secrets.length) {
       throw new DefinitionError(`steps[${index}].secrets must not contain duplicates.`);
     }
-    if (Array.isArray(step.secrets) && step.secrets.some((name) => RESERVED_STEP_ENV.has(String(name)))) {
+    if (Array.isArray(step.secrets) && step.secrets.some((name2) => RESERVED_STEP_ENV.has(String(name2)))) {
       throw new DefinitionError(`steps[${index}].secrets may not replace process-control environment variables.`);
     }
     const timeoutMs = step.timeoutMs === undefined ? undefined : Number(step.timeoutMs);
@@ -5091,11 +5098,11 @@ function parseDeployDefinition(value) {
     if (step.when !== undefined) {
       const conditions = record(step.when, `steps[${index}].when`);
       when = {};
-      for (const [name, expected] of Object.entries(conditions)) {
-        if (!/^[A-Z_][A-Z0-9_]*$/.test(name) || typeof expected !== "string" || expected.length === 0) {
+      for (const [name2, expected] of Object.entries(conditions)) {
+        if (!/^[A-Z_][A-Z0-9_]*$/.test(name2) || typeof expected !== "string" || expected.length === 0) {
           throw new DefinitionError(`steps[${index}].when must map environment names to non-empty strings.`);
         }
-        when[name] = expected;
+        when[name2] = expected;
       }
       if (Object.keys(when).length === 0)
         throw new DefinitionError(`steps[${index}].when must not be empty.`);
@@ -5115,15 +5122,32 @@ function parseDeployDefinition(value) {
   if (new Set(steps.map((step) => step.name)).size !== steps.length) {
     throw new DefinitionError("pipeline.steps must have unique names.");
   }
+  const name = text(root.name, "pipeline.name");
+  if (name.length > 120)
+    throw new DefinitionError("pipeline.name must be at most 120 characters.");
   return {
     version: PIPELINE_VERSION,
-    name: text(root.name, "pipeline.name"),
+    name,
     requireAttestation: root.requireAttestation === true,
     profiles,
     steps
   };
 }
 
+// src/deploy-file.ts
+import { createHash } from "crypto";
+var stable = (value) => {
+  if (Array.isArray(value))
+    return `[${value.map(stable).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).filter(([, entry]) => entry !== undefined).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${stable(entry)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+};
+function deployDefinitionDigest(definition) {
+  return `sha256:${createHash("sha256").update(stable(definition)).digest("hex")}`;
+}
+
 // src/pipeline.ts
 class PipelineError extends Error {
   code;
@@ -5365,6 +5389,7 @@ function createDeploymentManager(options) {
       throw new DeploymentError("SOURCE_FAILED", `Git checked out ${head}, not requested ${request.revision}.`);
     }
     const definition = parseDeployDefinition(readDefinition(join(release, ".fz", "deploy.json")));
+    const definitionDigest = deployDefinitionDigest(definition);
     const selectedProfile = definition.profiles[options.profile];
     if (!selectedProfile)
       throw new DeploymentError("PIPELINE_FAILED", `pipeline profile does not exist: ${options.profile}.`);
@@ -5414,6 +5439,9 @@ function createDeploymentManager(options) {
       repository: options.repository,
       branch: options.branch,
       revision: head,
+      definitionDigest,
+      definitionVersion: definition.version,
+      profile: options.profile,
       release,
       ok: true,
       phases
@@ -5677,7 +5705,10 @@ async function pullDeploymentOnce(options) {
     claimToken: claim.claimToken,
     ok: true,
     detail: `Deployed ${result.revision}.`,
-    release: result.release
+    release: result.release,
+    definitionDigest: result.definitionDigest,
+    definitionVersion: result.definitionVersion,
+    profile: result.profile
   });
   return { status: "deployed", claim, result };
 }
@@ -6096,7 +6127,7 @@ import { chmodSync as chmodSync5, existsSync as existsSync6, unlinkSync as unlin
 import { connect as connect2, createServer as createServer3 } from "net";
 
 // src/metal-provision.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import {
   existsSync as existsSync5,
   mkdirSync as mkdirSync3,
@@ -6249,8 +6280,8 @@ function membersOfLinuxList(value, label) {
     throw new MetalProvisionError(`${label} list overlaps itself`);
   return members;
 }
-var guestNameFor = (computeKey) => `fzg-${createHash("sha256").update(computeKey).digest("hex").slice(0, 16)}`;
-var tapNameFor = (computeKey) => `fzt${createHash("sha256").update(computeKey).digest("hex").slice(0, 12)}`;
+var guestNameFor = (computeKey) => `fzg-${createHash2("sha256").update(computeKey).digest("hex").slice(0, 16)}`;
+var tapNameFor = (computeKey) => `fzt${createHash2("sha256").update(computeKey).digest("hex").slice(0, 12)}`;
 var macForAddress = (address) => {
   const octets = address.split(".").map(Number);
   if (octets.length !== 4 || octets.some((value) => !Number.isInteger(value) || value < 0 || value > 255)) {
@@ -6332,7 +6363,7 @@ function allocateAddress(profile, computeKey, rows) {
     return existing.address;
   const used = new Set(rows.map((row) => row.address));
   const width = profile.addressEnd - profile.addressStart + 1;
-  const start = createHash("sha256").update(computeKey).digest().readUInt16BE(0) % width;
+  const start = createHash2("sha256").update(computeKey).digest().readUInt16BE(0) % width;
   for (let offset = 0;offset < width; offset += 1) {
     const last = profile.addressStart + (start + offset) % width;
     const address = `${profile.subnetPrefix}.${last}`;
@@ -7547,7 +7578,7 @@ function materializeWarpMdm(options) {
 }
 
 // src/agent-update.ts
-import { createHash as createHash2, timingSafeEqual, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash3, timingSafeEqual, randomUUID as randomUUID2 } from "crypto";
 import {
   chmodSync as chmodSync9,
   existsSync as existsSync10,
@@ -7665,7 +7696,7 @@ async function stageAgentRelease(releaseInput, options) {
       throw new Error("agent update tarball is empty or exceeds the size limit");
     }
     const expected = Buffer.from(release.integrity.slice("sha512-".length), "base64");
-    const actual = createHash2("sha512").update(bytes).digest();
+    const actual = createHash3("sha512").update(bytes).digest();
     if (!timingSafeEqual(actual, expected))
       throw new Error("agent update integrity mismatch");
     writeFileSync6(archive, bytes, { mode: 384, flag: "wx" });
@@ -7907,7 +7938,7 @@ function requestAgentUpdate(request, socketPath = DEFAULT_AGENT_UPDATE_SOCKET, t
 import { readFileSync as readFileSync7 } from "fs";
 
 // src/version.ts
-var VERSION2 = "0.1.30";
+var VERSION2 = "0.1.31";
 
 // src/agent-heartbeat.ts
 var unquote = (value) => value.replace(/^['"]|['"]$/g, "");