@forgezero/agent 0.1.39 → 0.1.40

package/dist/credential-schema.js

@@ -0,0 +1,335 @@
+// src/cache.ts
+class CacheError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "CacheError";
+  }
+}
+var DEFAULT_TTL_MS = 60000;
+var DEFAULT_MAX_STALE_MS = 300000;
+function createSecretCache(options) {
+  let entries = new Map;
+  const now = options.now ?? (() => Date.now());
+  const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+  const maxStaleMs = options.maxStaleMs ?? DEFAULT_MAX_STALE_MS;
+  let cursor = 0;
+  let replicated = false;
+  let lastSyncOkMs = now();
+  const fetchScope = async () => {
+    const next = new Map;
+    if (!options.list)
+      return { entries: next, loaded: 0, failed: [] };
+    const names = await options.list();
+    const failed = [];
+    for (const name of names) {
+      try {
+        const result = await options.fetch(name);
+        next.set(name, { value: result.value, version: result.version, fetchedAtMs: now() });
+      } catch {
+        failed.push(name);
+      }
+    }
+    return { entries: next, loaded: next.size, failed };
+  };
+  const loadScope = async () => {
+    if (!options.list)
+      return { loaded: 0, failed: [] };
+    const snapshot = await fetchScope();
+    entries = snapshot.entries;
+    replicated = snapshot.failed.length === 0;
+    return { loaded: snapshot.loaded, failed: snapshot.failed };
+  };
+  const refreshScope = async () => {
+    const snapshot = await fetchScope();
+    if (snapshot.failed.length > 0) {
+      throw new CacheError("FETCH_FAILED", `Could not refresh ${snapshot.failed.length} assigned vault ${snapshot.failed.length === 1 ? "entry" : "entries"}.`);
+    }
+    entries = snapshot.entries;
+    replicated = true;
+  };
+  return {
+    names: () => [...entries.keys()],
+    get replica() {
+      return replicated;
+    },
+    load: loadScope,
+    get cursor() {
+      return cursor;
+    },
+    async get(name) {
+      const staleFor = now() - lastSyncOkMs;
+      if (staleFor > maxStaleMs) {
+        throw new CacheError("STALE", `Synchronisation has not succeeded for ${Math.round(staleFor / 1000)}s, so this ` + "cache can no longer vouch for what it holds. Refusing rather than serving a value " + "that may already be revoked.");
+      }
+      const cached = entries.get(name);
+      if (cached && now() - cached.fetchedAtMs < ttlMs)
+        return cached.value;
+      let fetched;
+      try {
+        fetched = await options.fetch(name);
+      } catch (cause) {
+        if (cached)
+          return cached.value;
+        throw new CacheError("FETCH_FAILED", cause instanceof Error ? cause.message : `Could not fetch ${name}.`);
+      }
+      entries.set(name, { ...fetched, fetchedAtMs: now() });
+      return fetched.value;
+    },
+    async sync() {
+      const result = await options.changes(cursor);
+      if (result.resync) {
+        const dropped = [...entries.keys()];
+        if (options.list) {
+          await refreshScope();
+        } else {
+          entries.clear();
+        }
+        cursor = 0;
+        lastSyncOkMs = now();
+        return { invalidated: dropped, cursor: 0, resync: true };
+      }
+      if (options.list && result.changed.length > 0) {
+        const held = new Set(entries.keys());
+        await refreshScope();
+        cursor = result.version;
+        lastSyncOkMs = now();
+        return {
+          invalidated: result.changed.filter((name) => held.has(name) || entries.has(name)),
+          cursor,
+          resync: false
+        };
+      }
+      const invalidated = [];
+      for (const name of result.changed) {
+        if (entries.delete(name))
+          invalidated.push(name);
+      }
+      cursor = result.version;
+      lastSyncOkMs = now();
+      return { invalidated, cursor, resync: false };
+    },
+    clear() {
+      entries.clear();
+      cursor = 0;
+    },
+    staleForMs: () => now() - lastSyncOkMs
+  };
+}
+
+// src/signed-node-http.ts
+import {
+  encodeSignatureHeader,
+  generateResponseRecipient,
+  openResponse,
+  RESPONSE_KEY_HEADER,
+  signRequest
+} from "@forgezero/runtime/identity";
+
+class SignedNodeHttpError extends Error {
+  status;
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+    this.name = "SignedNodeHttpError";
+  }
+}
+function signedNodeApiUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("Agent API URL must be an absolute HTTPS URL.");
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1";
+  if (url.protocol !== "https:" && !(loopback && url.protocol === "http:") || url.username || url.password || url.search || url.hash) {
+    throw new Error("Agent API URL must be HTTPS without credentials, query or fragment.");
+  }
+  return url;
+}
+async function postSignedNode(options, path, body) {
+  const url = signedNodeApiUrl(options.apiUrl);
+  url.pathname = `${url.pathname.replace(/\/$/, "")}/${path.replace(/^\//, "")}`.replace(/\/+/g, "/");
+  url.search = "";
+  url.hash = "";
+  const raw = JSON.stringify(body);
+  const recipient = generateResponseRecipient();
+  const envelope = signRequest(options.keys, options.nodeKey, {
+    method: "POST",
+    path: url.pathname,
+    query: "",
+    body: raw,
+    responseKey: recipient.publicKey
+  });
+  const signature = encodeSignatureHeader(envelope);
+  const response = await (options.fetch ?? globalThis.fetch)(url, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      "x-fz-node": options.nodeKey,
+      "x-fz-signature": signature,
+      [RESPONSE_KEY_HEADER]: recipient.publicKey
+    },
+    body: raw,
+    signal: AbortSignal.timeout(options.requestTimeoutMs ?? 15000)
+  });
+  const payload = await response.json().catch(() => null);
+  if (!response.ok) {
+    const failure = payload;
+    const reason = failure ? failure.error?.message ?? failure.message : undefined;
+    throw new SignedNodeHttpError(response.status, reason || `signed node request returned HTTP ${response.status}`);
+  }
+  try {
+    return await openResponse(recipient.secretKey, signature, payload);
+  } catch {
+    throw new SignedNodeHttpError(502, "The node response was not sealed to this request.");
+  }
+}
+
+// src/node-vault.ts
+var SCOPE_PART = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/;
+function projectVaultCacheKey(coordinate) {
+  if (!SCOPE_PART.test(coordinate.environment) || !SCOPE_PART.test(coordinate.name)) {
+    throw new Error("node vault coordinate is malformed");
+  }
+  return JSON.stringify([coordinate.environment, coordinate.name]);
+}
+function projectVaultCoordinate(key) {
+  let value;
+  try {
+    value = JSON.parse(key);
+  } catch {
+    throw new Error("node vault cache key is malformed");
+  }
+  if (!Array.isArray(value) || value.length !== 2 || typeof value[0] !== "string" || typeof value[1] !== "string" || !SCOPE_PART.test(value[0]) || !SCOPE_PART.test(value[1]))
+    throw new Error("node vault cache key is malformed");
+  return { environment: value[0], name: value[1] };
+}
+function tenantNodeApiUrl(apiUrl, tenantSlug) {
+  if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(tenantSlug))
+    throw new Error("tenant slug is malformed");
+  const url = signedNodeApiUrl(apiUrl);
+  url.pathname = `/api/t/${encodeURIComponent(tenantSlug)}`;
+  url.search = "";
+  url.hash = "";
+  return url.toString().replace(/\/$/, "");
+}
+function createNodeVaultCache(options) {
+  const post = (operation, body) => postSignedNode(options, `v1/node/vault/${operation}`, body);
+  return createSecretCache({
+    ttlMs: options.ttlMs,
+    maxStaleMs: options.maxStaleMs,
+    list: async () => {
+      const payload = await post("list", {});
+      if (!Array.isArray(payload.entries) || payload.entries.some((entry) => !entry || typeof entry.environment !== "string" || typeof entry.name !== "string")) {
+        throw new Error("node vault list response is malformed");
+      }
+      return payload.entries.map(projectVaultCacheKey);
+    },
+    fetch: async (key) => {
+      const coordinate = projectVaultCoordinate(key);
+      const payload = await post("read", coordinate);
+      if (typeof payload.value !== "string" || !Number.isSafeInteger(payload.version)) {
+        throw new Error("node vault read response is malformed");
+      }
+      return { value: payload.value, version: payload.version };
+    },
+    changes: async (since) => {
+      const payload = await post("changes", { since });
+      if (!Number.isSafeInteger(payload.version) || !Array.isArray(payload.changed) || payload.changed.some((entry) => !entry || typeof entry.environment !== "string" || typeof entry.name !== "string"))
+        throw new Error("node vault changes response is malformed");
+      return {
+        version: payload.version,
+        changed: payload.changed.map(projectVaultCacheKey),
+        resync: payload.resync
+      };
+    }
+  });
+}
+function startNodeVaultSync(cache, options = {}) {
+  const interval = Math.max(1000, options.intervalMs ?? 30000);
+  const setTimer = options.setTimer ?? ((callback, ms) => setTimeout(callback, ms));
+  const clearTimer = options.clearTimer ?? ((handle) => clearTimeout(handle));
+  let stopped = false;
+  let timer;
+  let active = null;
+  const schedule = () => {
+    if (!stopped)
+      timer = setTimer(tick, interval);
+  };
+  const tick = () => {
+    if (stopped || active)
+      return;
+    const sync = () => cache.sync();
+    active = (options.telemetry ? options.telemetry.observe("vault.sync", sync) : sync()).then((result) => options.onEvent?.("synced", result)).catch((cause) => options.onEvent?.("sync-failed", cause)).finally(() => {
+      active = null;
+      schedule();
+    });
+  };
+  schedule();
+  return {
+    async stop() {
+      stopped = true;
+      clearTimer(timer);
+      await active;
+    }
+  };
+}
+
+// src/credential-schema.ts
+var AGENT_CREDENTIAL_LOCATIONS = [
+  "operator",
+  "metal",
+  "platform-compute",
+  "tenant-compute"
+];
+var AGENT_CREDENTIAL_POLICY = {
+  operator: { vault: false, systemdFallback: false, attendedFile: true },
+  metal: { vault: false, systemdFallback: true, attendedFile: false },
+  "platform-compute": { vault: true, systemdFallback: true, attendedFile: false },
+  "tenant-compute": { vault: true, systemdFallback: true, attendedFile: false }
+};
+var CREDENTIAL_NAME = /^[A-Z_][A-Z0-9_]*$/;
+var SCOPE_PART2 = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/;
+function deploymentCredentialSchema(input) {
+  if (!SCOPE_PART2.test(input.projectKey) || !SCOPE_PART2.test(input.environmentKey)) {
+    throw new Error("agent: deployment credential scope is malformed");
+  }
+  const systemd = [...new Set(input.systemdCredentials ?? [])].sort();
+  for (const name of systemd) {
+    if (!CREDENTIAL_NAME.test(name)) {
+      throw new Error(`agent: invalid pipeline credential name ${name}.`);
+    }
+  }
+  return {
+    version: 1,
+    location: input.realm === "platform" ? "platform-compute" : "tenant-compute",
+    projectKey: input.projectKey,
+    environmentKey: input.environmentKey,
+    credentials: systemd.map((name) => ({
+      name,
+      vaultCacheKey: projectVaultCacheKey({ environment: input.environmentKey, name }),
+      systemdCredential: name
+    }))
+  };
+}
+function credentialBinding(schema, name) {
+  if (!CREDENTIAL_NAME.test(name))
+    throw new Error(`agent: invalid pipeline credential name ${name}.`);
+  const declared = schema.credentials.find((entry) => entry.name === name);
+  return declared ?? {
+    name,
+    vaultCacheKey: projectVaultCacheKey({ environment: schema.environmentKey, name })
+  };
+}
+var METAL_SYSTEMD_CREDENTIALS = {
+  identity: "metal-agent-seed"
+};
+export {
+  deploymentCredentialSchema,
+  credentialBinding,
+  METAL_SYSTEMD_CREDENTIALS,
+  AGENT_CREDENTIAL_POLICY,
+  AGENT_CREDENTIAL_LOCATIONS
+};

package/dist/definition.js

@@ -28,8 +28,8 @@ var UBUNTU_2604_X64 = [
   },
   {
     requirement: { id: "arangodb", version: "3.11.14" },
-    check: `arangod --version 2>/dev/null | head -1 | grep -q '3.11.14'`,
-    install: `tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT; ` + `curl -fsSL 'https://download.arangodb.com/arangodb311/DEBIAN/amd64/arangodb3_3.11.14-1_amd64.deb' -o "$tmp/arangodb.deb"; ` + `echo "${ARANGO_SHA256}  $tmp/arangodb.deb" | sha256sum -c -; ` + `DEBIAN_FRONTEND=noninteractive dpkg -i "$tmp/arangodb.deb" >/dev/null 2>&1 || ` + `DEBIAN_FRONTEND=noninteractive apt-get -y -f install`
+    check: `arangod --version 2>/dev/null | head -1 | grep -q '3.11.14' && ` + `! systemctl is-active --quiet arangodb3.service && ` + `! systemctl is-enabled --quiet arangodb3.service`,
+    install: `tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT; ` + `curl -fsSL 'https://download.arangodb.com/arangodb311/DEBIAN/amd64/arangodb3_3.11.14-1_amd64.deb' -o "$tmp/arangodb.deb"; ` + `echo "${ARANGO_SHA256}  $tmp/arangodb.deb" | sha256sum -c -; ` + `DEBIAN_FRONTEND=noninteractive dpkg -i "$tmp/arangodb.deb" >/dev/null 2>&1 || ` + `DEBIAN_FRONTEND=noninteractive apt-get -y -f install; ` + `systemctl disable --now arangodb3.service`
   },
   {
     requirement: { id: "cloudflared", version: "2026.7.3" },

package/dist/deploy-file.js

@@ -28,8 +28,8 @@ var UBUNTU_2604_X64 = [
   },
   {
     requirement: { id: "arangodb", version: "3.11.14" },
-    check: `arangod --version 2>/dev/null | head -1 | grep -q '3.11.14'`,
-    install: `tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT; ` + `curl -fsSL 'https://download.arangodb.com/arangodb311/DEBIAN/amd64/arangodb3_3.11.14-1_amd64.deb' -o "$tmp/arangodb.deb"; ` + `echo "${ARANGO_SHA256}  $tmp/arangodb.deb" | sha256sum -c -; ` + `DEBIAN_FRONTEND=noninteractive dpkg -i "$tmp/arangodb.deb" >/dev/null 2>&1 || ` + `DEBIAN_FRONTEND=noninteractive apt-get -y -f install`
+    check: `arangod --version 2>/dev/null | head -1 | grep -q '3.11.14' && ` + `! systemctl is-active --quiet arangodb3.service && ` + `! systemctl is-enabled --quiet arangodb3.service`,
+    install: `tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT; ` + `curl -fsSL 'https://download.arangodb.com/arangodb311/DEBIAN/amd64/arangodb3_3.11.14-1_amd64.deb' -o "$tmp/arangodb.deb"; ` + `echo "${ARANGO_SHA256}  $tmp/arangodb.deb" | sha256sum -c -; ` + `DEBIAN_FRONTEND=noninteractive dpkg -i "$tmp/arangodb.deb" >/dev/null 2>&1 || ` + `DEBIAN_FRONTEND=noninteractive apt-get -y -f install; ` + `systemctl disable --now arangodb3.service`
   },
   {
     requirement: { id: "cloudflared", version: "2026.7.3" },