@forgezero/agent 0.1.40 → 0.1.42

package/dist/otel-collector.d.ts

@@ -0,0 +1,18 @@
+export declare const FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";
+export declare const FORGEZERO_OTEL_COLLECTOR_VERSION = "0.157.0";
+export declare const FORGEZERO_OTEL_COLLECTOR_SHA256 = "2937cf24892af55b143c072fddece17862239cf78280620029276493eb81beae";
+export interface OtelCollectorHost {
+    write(path: string, content: string, mode: number): void;
+    exec(argv: readonly string[]): Promise<{
+        exitCode: number;
+        output?: string;
+        stdout?: string;
+        stderr?: string;
+    }>;
+}
+export declare function renderForgeZeroOtelCollector(exportEndpoint: string): {
+    config: string;
+    unit: string;
+};
+/** Install one exact official collector release and converge its separate unit. */
+export declare function ensureForgeZeroOtelCollector(host: OtelCollectorHost, exportEndpoint: string): Promise<void>;

package/dist/pipeline.d.ts

@@ -36,7 +36,8 @@
 export type StepOutcome = 'ok' | 'failed' | 'skipped';
 export interface PipelineStep {
     name: string;
-    run: string;
+    /** Exact executable and arguments. No shell parses, expands or joins these values. */
+    exec: readonly string[];
     /** Secret names this step needs. Nothing it does not name is in its env. */
     secrets?: readonly string[];
     /** Run even when an earlier step failed — cleanup, teardown, notifications. */
@@ -80,7 +81,7 @@ export interface RunOptions {
     secret(name: string): Promise<string>;
     /** Spawns a step. Injected, so a pipeline is testable without a shell. */
     exec(input: {
-        command: string;
+        argv: readonly string[];
         env: Record<string, string>;
         timeoutMs?: number;
     }): Promise<{

package/dist/pipeline.js

@@ -54,7 +54,7 @@ async function runPipeline(options) {
     let exitCode;
     let output;
     try {
-      const result = await options.exec({ command: step.run, env, timeoutMs: step.timeoutMs });
+      const result = await options.exec({ argv: step.exec, env, timeoutMs: step.timeoutMs });
       exitCode = result.exitCode;
       output = result.output;
     } catch (cause) {

package/dist/platform-bootstrap-runtime.d.ts

@@ -1,14 +1,25 @@
-/** Typed, side-effect-free host runtime plans used by `fz bootstrap platform`. */
+/** Typed host runtime plans used by `fz bootstrap platform`. */
 export type PlatformSoftwareProfile = 'platform-db-api' | 'platform-api';
 export type PlatformDatabaseRole = 'master' | 'joiner' | 'none';
 export type ApiSlot = 'blue' | 'green';
+export type PlatformBootstrapEmail = {
+    provider: 'smtp';
+    host: string;
+    port: number;
+    user: string;
+    from: string;
+} | {
+    provider: 'jetemail';
+    from: string;
+    eu: boolean;
+};
 export interface PlatformSharedEnvironment {
     softwareProfile: PlatformSoftwareProfile;
     databaseRole: PlatformDatabaseRole;
     databaseCoordinators: string[];
     databaseAddress?: string;
     databaseMaster?: string;
-    databaseNetworkMode: 'private-lan' | 'cloudflare-warp';
+    databaseNetworkMode: 'private-lan';
     databaseReplicationFactor: number;
     databaseWriteConcern: number;
     databaseUser: string;
@@ -30,12 +41,7 @@ export interface PlatformSharedEnvironment {
     otlpFlushIntervalMs: number;
     otlpTraceSampleRatio: number;
     custodianEmail?: string;
-    smtp?: {
-        host: string;
-        port: number;
-        user?: string;
-        from: string;
-    };
+    email?: PlatformBootstrapEmail;
     backup?: {
         endpoint: string;
         region: string;
@@ -48,30 +54,28 @@ export interface PlatformSharedEnvironment {
         kvNamespaceId: string;
         tunnelId: string;
         tunnelService: string;
-        warp?: {
-            organization: string;
-            virtualNetworkId: string;
-            deviceProfileId: string;
-        };
+    };
+    realtime?: {
+        workerScriptName: string;
+        endpoint: string;
+        producer: string;
     };
     repository: string;
     branch: string;
     deployProfile: string;
 }
-export declare function validatePlatformSharedEnvironment(input: PlatformSharedEnvironment, options?: {
-    allowPendingCloudflareHandoff?: boolean;
-}): PlatformSharedEnvironment;
+export declare function validatePlatformSharedEnvironment(input: PlatformSharedEnvironment): PlatformSharedEnvironment;
 /** Render only non-secret runtime coordinates. Passwords/tokens have no field in this contract. */
 export declare function renderPlatformSharedEnvironment(input: PlatformSharedEnvironment): string;
 export interface SystemdCredentialSpec {
-    name: 'arangodb-jwt' | 'seed-sync-root' | 'bootstrap-smtp-password' | 'cloudflare-kv-token' | 'cloudflare-network-token';
+    name: 'arangodb-jwt' | 'seed-sync-root' | 'bootstrap-smtp-password' | 'bootstrap-jetemail-api-key' | 'CF_API_TOKEN' | 'REALTIME_PUBLISH_SECRET' | 'REALTIME_TICKET_SECRET';
     encryptedPath: string;
     required: boolean;
 }
 export declare function platformApiCredentialSpecs(options: {
-    smtp: boolean;
+    emailProvider?: PlatformBootstrapEmail['provider'];
     cloudflareKv: boolean;
-    cloudflareNetwork: boolean;
+    realtime: boolean;
 }): SystemdCredentialSpec[];
 export interface ApiRuntimeRenderOptions {
     serviceUser: string;
@@ -99,8 +103,8 @@ export declare function renderPlatformNginx(input: {
     site: string;
 };
 export interface ActivationBoundary {
-    command: '/usr/local/libexec/forgezero-activate';
-    argv: [string];
+    command: '/usr/local/lib/forgezero/agent/fz-agent';
+    argv: ['platform-activate', '--config=/etc/forgezero/deploy-activation.json', string];
     runAs: 'root';
     invoker: 'forgezero-runner';
 }
@@ -124,6 +128,20 @@ export declare function renderPlatformActivationFiles(input: PlatformActivationC
     helper: string;
     sudoers: string;
 };
+export interface PlatformActivationCommandResult {
+    exitCode: number;
+    output: string;
+}
+export type PlatformActivationExec = (argv: readonly string[]) => Promise<PlatformActivationCommandResult>;
+/** Agent-native blue/green activation with health and nginx rollback. */
+export declare function activatePlatformRelease(config: PlatformActivationConfig, requestedRelease: string, options?: {
+    exec?: PlatformActivationExec;
+    fetch?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+}): Promise<{
+    release: string;
+    slot: ApiSlot;
+}>;
 export interface LocalOtlpProofPlan {
     unitCheck: {
         command: 'systemctl';

package/dist/platform-bootstrap-runtime.js

@@ -1,4 +1,21 @@
 // src/platform-bootstrap-runtime.ts
+import {
+  chmodSync,
+  chownSync,
+  copyFileSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  writeFileSync
+} from "node:fs";
+import { join } from "node:path";
 var safeAtom = (name, value) => {
   if (!value || /[\0\r\n]/.test(value))
     throw new Error(`${name} must be non-empty and single-line.`);
@@ -35,7 +52,7 @@ var systemdValue = (name, raw) => {
   const value = raw;
   return `"${value.replaceAll("\\", "\\\\").replaceAll('"', "\\\"").replaceAll("$", "\\$")}"`;
 };
-function validatePlatformSharedEnvironment(input, options = {}) {
+function validatePlatformSharedEnvironment(input) {
   if (input.softwareProfile === "platform-api" !== (input.databaseRole === "none")) {
     throw new Error("platform-api requires database role none; platform-db-api requires master or joiner.");
   }
@@ -45,14 +62,26 @@ function validatePlatformSharedEnvironment(input, options = {}) {
   const coordinators = input.databaseCoordinators.map(privateCoordinator);
   if (new Set(coordinators).size !== coordinators.length)
     throw new Error("databaseCoordinators must be unique.");
-  if (!["private-lan", "cloudflare-warp"].includes(input.databaseNetworkMode)) {
-    throw new Error("Database networking must be private-lan or cloudflare-warp.");
+  if (input.databaseNetworkMode !== "private-lan") {
+    throw new Error("Attended platform bootstrap supports only private-lan database networking.");
   }
   boundedInteger("databaseReplicationFactor", input.databaseReplicationFactor, 1, 16);
   boundedInteger("databaseWriteConcern", input.databaseWriteConcern, 1, 16);
   if (input.databaseWriteConcern > input.databaseReplicationFactor) {
     throw new Error("databaseWriteConcern cannot exceed databaseReplicationFactor.");
   }
+  if (input.email?.provider === "smtp") {
+    safeAtom("email.host", input.email.host);
+    boundedInteger("email.port", input.email.port, 1, 65535);
+    safeAtom("email.user", input.email.user);
+    safeAtom("email.from", input.email.from);
+  } else if (input.email?.provider === "jetemail") {
+    safeAtom("email.from", input.email.from);
+    if (typeof input.email.eu !== "boolean")
+      throw new Error("JetEmail eu must be boolean.");
+  } else if (input.email !== undefined) {
+    throw new Error("Bootstrap email provider must be smtp or jetemail.");
+  }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
   boundedInteger("seedSyncMembers", input.seedSyncMembers, 1, 64);
   boundedInteger("concurrencyLimit", input.concurrencyLimit, 1, 1e6);
@@ -85,13 +114,6 @@ function validatePlatformSharedEnvironment(input, options = {}) {
     if (url.username || url.password || url.hash)
       throw new Error("Seed peers cannot contain credentials or fragments.");
   }
-  if (input.smtp) {
-    safeAtom("smtp.host", input.smtp.host);
-    boundedInteger("smtp.port", input.smtp.port, 1, 65535);
-    safeAtom("smtp.from", input.smtp.from);
-    if (input.smtp.user)
-      safeAtom("smtp.user", input.smtp.user);
-  }
   if (input.backup) {
     httpsOrigin("backup.endpoint", input.backup.endpoint);
     for (const [name, value] of Object.entries(input.backup))
@@ -104,14 +126,12 @@ function validatePlatformSharedEnvironment(input, options = {}) {
     const service = new URL(input.cloudflare.tunnelService);
     if (service.protocol !== "http:" || !["127.0.0.1", "localhost", "::1"].includes(service.hostname) || service.username || service.password || service.search || service.hash)
       throw new Error("Cloudflare Tunnel service must be loopback HTTP.");
-    if (input.cloudflare.warp) {
-      if (!/^[A-Za-z0-9][A-Za-z0-9-]{0,62}$/.test(input.cloudflare.warp.organization) || !/^[0-9a-f-]{36}$/i.test(input.cloudflare.warp.virtualNetworkId) || !/^[A-Za-z0-9_-]{1,128}$/.test(input.cloudflare.warp.deviceProfileId)) {
-        throw new Error("Cloudflare WARP organization, VNET or device profile is malformed.");
-      }
-    }
   }
-  if (!options.allowPendingCloudflareHandoff && input.databaseNetworkMode === "cloudflare-warp" !== Boolean(input.cloudflare?.warp)) {
-    throw new Error("cloudflare-warp networking requires its exact enrolled Cloudflare coordinates.");
+  if (input.realtime) {
+    input.realtime.endpoint = httpsOrigin("realtime.endpoint", input.realtime.endpoint);
+    if (!/^[a-z0-9][a-z0-9_-]{0,62}$/.test(input.realtime.workerScriptName) || !/^[A-Za-z0-9][A-Za-z0-9_.:@/-]{0,127}$/.test(input.realtime.producer)) {
+      throw new Error("realtime.producer is invalid.");
+    }
   }
   return {
     ...input,
@@ -166,10 +186,12 @@ function renderPlatformSharedEnvironment(input) {
     FZ_PROFILE: value.deployProfile,
     FZ_REPO: value.repository,
     FZ_BRANCH: value.branch,
-    FZ_SMTP_HOST: value.smtp?.host ?? "",
-    FZ_SMTP_PORT: value.smtp ? String(value.smtp.port) : "",
-    FZ_SMTP_USER: value.smtp?.user ?? "",
-    FZ_SMTP_FROM: value.smtp?.from ?? "",
+    FZ_EMAIL_PROVIDER: value.email?.provider ?? "",
+    FZ_SMTP_HOST: value.email?.provider === "smtp" ? value.email.host : "",
+    FZ_SMTP_PORT: value.email?.provider === "smtp" ? String(value.email.port) : "",
+    FZ_SMTP_USER: value.email?.provider === "smtp" ? value.email.user : "",
+    FZ_EMAIL_FROM: value.email?.from ?? "",
+    FZ_JETEMAIL_EU: value.email?.provider === "jetemail" ? String(value.email.eu) : "",
     BACKUP_S3_ENDPOINT: value.backup?.endpoint ?? "",
     BACKUP_S3_REGION: value.backup?.region ?? "",
     BACKUP_S3_BUCKET: value.backup?.bucket ?? "",
@@ -179,9 +201,9 @@ function renderPlatformSharedEnvironment(input) {
     FZ_CF_KV_NAMESPACE_ID: value.cloudflare?.kvNamespaceId ?? "",
     FZ_CF_TUNNEL_ID: value.cloudflare?.tunnelId ?? "",
     FZ_CF_TUNNEL_SERVICE: value.cloudflare?.tunnelService ?? "",
-    FZ_WARP_ORGANIZATION: value.cloudflare?.warp?.organization ?? "",
-    FZ_CF_VIRTUAL_NETWORK_ID: value.cloudflare?.warp?.virtualNetworkId ?? "",
-    FZ_CF_WARP_POLICY_ID: value.cloudflare?.warp?.deviceProfileId ?? ""
+    FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
+    FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
+    FZ_REALTIME_PRODUCER: value.realtime?.producer ?? ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
 ` + Object.entries(entries).map(([key, entry]) => `${key}=${systemdValue(key, entry)}`).join(`
@@ -190,9 +212,11 @@ function renderPlatformSharedEnvironment(input) {
 }
 function platformApiCredentialSpecs(options) {
   const optional = [
-    ["bootstrap-smtp-password", options.smtp],
-    ["cloudflare-kv-token", options.cloudflareKv],
-    ["cloudflare-network-token", options.cloudflareNetwork]
+    ["bootstrap-smtp-password", options.emailProvider === "smtp"],
+    ["bootstrap-jetemail-api-key", options.emailProvider === "jetemail"],
+    ["CF_API_TOKEN", options.cloudflareKv],
+    ["REALTIME_PUBLISH_SECRET", options.realtime],
+    ["REALTIME_TICKET_SECRET", options.realtime]
   ];
   return [
     { name: "arangodb-jwt", encryptedPath: "/etc/forgezero/creds/arangodb-jwt.cred", required: true },
@@ -299,7 +323,12 @@ function planPlatformActivation(releasesDirectory, releasePath) {
   if (!releasePath.startsWith(`${root}/`) || releasePath === root || releasePath.includes("/../")) {
     throw new Error("Release must be an immutable child of the releases directory.");
   }
-  return { command: "/usr/local/libexec/forgezero-activate", argv: [releasePath], runAs: "root", invoker: "forgezero-runner" };
+  return {
+    command: "/usr/local/lib/forgezero/agent/fz-agent",
+    argv: ["platform-activate", "--config=/etc/forgezero/deploy-activation.json", releasePath],
+    runAs: "root",
+    invoker: "forgezero-runner"
+  };
 }
 function renderPlatformActivationFiles(input) {
   if (!input.root.startsWith("/") || /[\0\r\n]/.test(input.root))
@@ -326,43 +355,136 @@ function renderPlatformActivationFiles(input) {
   ].join(`
 `) + `
 `;
-  const helper = `#!/usr/bin/env bash
-set -Eeuo pipefail
-source /etc/forgezero/deploy.env
-[[ $# == 1 ]] || { echo "usage: forgezero-activate <release>" >&2; exit 2; }
-release="$(realpath -e "$1")"; releases="$(realpath -e "$FZ_DIR/releases")"; slots="$FZ_DIR/slots"
-install -d -o root -g root -m 0755 "$slots"
-case "$release/" in "$releases"/*/) ;; *) echo "release is outside $releases" >&2; exit 2 ;; esac
-[[ -f "$release/.fz/deploy.json" && -s "$release/src/index.ts" && -s "$release/bun.lock" ]] || { echo "release is incomplete" >&2; exit 2; }
-slot_file="$FZ_DIR/.forge-slot"; previous_slot="$(cat "$slot_file" 2>/dev/null || true)"
-if [[ "$previous_slot" == blue ]]; then target=green; port="$FZ_GREEN_PORT"; else target=blue; port="$FZ_BLUE_PORT"; fi
-target_link="$slots/$target"; previous_target_link="$(readlink -f "$target_link" 2>/dev/null || true)"
-chown -R root:"$FZ_USER" "$release"; chmod -R a-w "$release"; find "$release" -type d -exec chmod a+rx {} +; find "$release" -type f -exec chmod a+r {} +
-ln -sfn "$release" "$target_link"; systemctl restart "forgezero@\${target}.service"
-healthy=0; for _ in $(seq 1 30); do curl -fsS --max-time 2 "http://127.0.0.1:\${port}\${FZ_HEALTH_PATH}" >/dev/null 2>&1 && { healthy=1; break; }; sleep 1; done
-if (( ! healthy )); then systemctl stop "forgezero@\${target}.service" || true; [[ -n "$previous_target_link" && -d "$previous_target_link" ]] && ln -sfn "$previous_target_link" "$target_link" || rm -f "$target_link"; exit 1; fi
-upstream=/etc/nginx/conf.d/forgezero-upstream.conf; backup="$(mktemp -p /run forgezero-upstream.XXXXXX)"; [[ -f "$upstream" ]] && cp "$upstream" "$backup" || : >"$backup"
-printf 'upstream forgezero { server 127.0.0.1:%s; }\\n' "$port" >"$upstream"
-if ! nginx -t || ! nginx -s reload; then [[ -s "$backup" ]] && cp "$backup" "$upstream" || rm -f "$upstream"; rm -f "$backup"; systemctl stop "forgezero@\${target}.service" || true; [[ -n "$previous_target_link" && -d "$previous_target_link" ]] && ln -sfn "$previous_target_link" "$target_link" || rm -f "$target_link"; nginx -t >/dev/null 2>&1 && nginx -s reload || true; exit 1; fi
-rm -f "$backup"; printf '%s\\n' "$target" >"$slot_file"
-# New nginx workers select the new slot after reload. Keep the old slot alive
-# while old workers drain in-flight requests and upgraded connections.
-if [[ -n "$previous_slot" && "$previous_slot" != "$target" ]]; then
-  sleep_seconds="$(( (FZ_DRAIN_DEADLINE_MS + 999) / 1000 ))"
-  sleep "$sleep_seconds"
-  systemctl stop "forgezero@\${previous_slot}.service" || true
-fi
-mapfile -t old < <(find "$releases" -mindepth 1 -maxdepth 1 -type d -printf '%T@ %p\\n' | sort -rn | tail -n "+$((FZ_KEEP_RELEASES + 1))" | cut -d' ' -f2-)
-for path in "\${old[@]}"; do [[ "$path" == "$release" ]] || rm -rf -- "$path"; done
-printf 'promoted %s on %s\\n' "$release" "$target"
+  const helper = `${JSON.stringify({ ...input, drainDeadlineMs }, null, 2)}
 `;
   return {
     environment,
     helper,
-    sudoers: `forgezero-runner ALL=(root) NOPASSWD: /usr/local/libexec/forgezero-activate *
+    sudoers: `forgezero-runner ALL=(root) NOPASSWD: /usr/local/lib/forgezero/agent/fz-agent platform-activate --config=/etc/forgezero/deploy-activation.json *
 `
   };
 }
+var platformExec = async (argv) => {
+  const child = Bun.spawn([...argv], { stdout: "pipe", stderr: "pipe", env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" } });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  return { exitCode, output: `${stdout}${stderr}` };
+};
+var replaceLink = (path, target) => {
+  const pending = `${path}.next`;
+  rmSync(pending, { force: true });
+  if (!target) {
+    rmSync(path, { force: true });
+    return;
+  }
+  symlinkSync(target, pending);
+  renameSync(pending, path);
+};
+var secureRelease = (path, uid, gid) => {
+  const visit = (current) => {
+    const metadata = lstatSync(current);
+    if (metadata.isSymbolicLink())
+      throw new Error("release contains a symbolic link");
+    chownSync(current, uid, gid);
+    chmodSync(current, metadata.isDirectory() ? 365 : 292);
+    if (metadata.isDirectory())
+      for (const name of readdirSync(current))
+        visit(join(current, name));
+  };
+  visit(path);
+};
+async function activatePlatformRelease(config, requestedRelease, options = {}) {
+  const rendered = renderPlatformActivationFiles(config);
+  const normalized = JSON.parse(rendered.helper);
+  const releases = realpathSync(join(normalized.root, "releases"));
+  const release = realpathSync(requestedRelease);
+  if (!release.startsWith(`${releases}/`) || release === releases)
+    throw new Error("release is outside configured releases directory");
+  for (const required of [".fz/deploy.json", "src/index.ts", "bun.lock"]) {
+    const metadata = statSync(join(release, required));
+    if (!metadata.isFile() || metadata.size < 1)
+      throw new Error(`release is incomplete: ${required}`);
+  }
+  const exec = options.exec ?? platformExec;
+  const request = options.fetch ?? fetch;
+  const sleep = options.sleep ?? Bun.sleep;
+  const slots = join(normalized.root, "slots");
+  mkdirSync(slots, { recursive: true, mode: 493 });
+  const slotFile = join(normalized.root, ".forge-slot");
+  const previousSlot = existsSync(slotFile) ? readFileSync(slotFile, "utf8").trim() : undefined;
+  const target = previousSlot === "blue" ? "green" : "blue";
+  const port = target === "blue" ? normalized.bluePort : normalized.greenPort;
+  const targetLink = join(slots, target);
+  let previousTarget;
+  try {
+    previousTarget = realpathSync(targetLink);
+  } catch {}
+  const user = await exec(["/usr/bin/id", "-u", normalized.serviceUser]);
+  const group = await exec(["/usr/bin/id", "-g", normalized.serviceUser]);
+  if (user.exitCode !== 0 || group.exitCode !== 0)
+    throw new Error("activation service identity does not exist");
+  secureRelease(release, Number(user.output.trim()), Number(group.output.trim()));
+  replaceLink(targetLink, release);
+  const service = `forgezero@${target}.service`;
+  const restart = await exec(["/usr/bin/systemctl", "restart", service]);
+  if (restart.exitCode !== 0) {
+    replaceLink(targetLink, previousTarget);
+    throw new Error("target slot failed to start");
+  }
+  let healthy = false;
+  for (let attempt = 0;attempt < 30; attempt += 1) {
+    try {
+      const response = await request(`http://127.0.0.1:${port}${normalized.healthPath}`, { signal: AbortSignal.timeout(2000) });
+      healthy = response.ok;
+    } catch {}
+    if (healthy)
+      break;
+    await sleep(1000);
+  }
+  const stopTarget = async () => {
+    await exec(["/usr/bin/systemctl", "stop", service]);
+    replaceLink(targetLink, previousTarget);
+  };
+  if (!healthy) {
+    await stopTarget();
+    throw new Error("target slot failed its health deadline");
+  }
+  const upstream = "/etc/nginx/conf.d/forgezero-upstream.conf";
+  const backup = `${upstream}.forgezero-backup`;
+  if (existsSync(upstream))
+    copyFileSync(upstream, backup);
+  else
+    rmSync(backup, { force: true });
+  writeFileSync(upstream, `upstream forgezero { server 127.0.0.1:${port}; }
+`, { mode: 420 });
+  const test = await exec(["/usr/sbin/nginx", "-t"]);
+  const reload = test.exitCode === 0 ? await exec(["/usr/sbin/nginx", "-s", "reload"]) : test;
+  if (reload.exitCode !== 0) {
+    if (existsSync(backup))
+      renameSync(backup, upstream);
+    else
+      rmSync(upstream, { force: true });
+    await exec(["/usr/sbin/nginx", "-t"]);
+    await exec(["/usr/sbin/nginx", "-s", "reload"]);
+    await stopTarget();
+    throw new Error("nginx refused the promoted upstream");
+  }
+  rmSync(backup, { force: true });
+  writeFileSync(slotFile, `${target}
+`, { mode: 420 });
+  if (previousSlot && previousSlot !== target) {
+    await sleep(normalized.drainDeadlineMs);
+    await exec(["/usr/bin/systemctl", "stop", `forgezero@${previousSlot}.service`]);
+  }
+  const old = readdirSync(releases, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join(releases, entry.name)).sort((left, right) => statSync(right).mtimeMs - statSync(left).mtimeMs).slice(normalized.keepReleases);
+  for (const path of old)
+    if (path !== release)
+      rmSync(path, { recursive: true, force: true });
+  return { release, slot: target };
+}
 function validateCollectorUnit(unit) {
   if (!/^[A-Za-z0-9][A-Za-z0-9_.@-]{0,127}\.service$/.test(unit))
     throw new Error("Invalid OTLP collector service unit.");
@@ -407,5 +529,6 @@ export {
   renderPlatformActivationFiles,
   platformApiCredentialSpecs,
   planPlatformActivation,
-  planLocalOtlpProof
+  planLocalOtlpProof,
+  activatePlatformRelease
 };

package/dist/platform-fleet-verification.d.ts

@@ -0,0 +1,19 @@
+import { type BootstrapStatus } from './bootstrap';
+export interface PlatformFleetVerificationRuntime {
+    uid(): number;
+    bootstrapStatus(): Promise<BootstrapStatus>;
+    characterDevice(path: string): boolean;
+    exec(argv: readonly string[]): Promise<{
+        exitCode: number;
+        output: string;
+    }>;
+}
+export interface PlatformFleetVerificationResult {
+    ok: true;
+    agentVersion: string;
+    bootstrap: BootstrapStatus;
+    sevGuest: true;
+    failedUnits: readonly never[];
+}
+/** One closed, read-only host proof used by the operator fleet rehearsal. */
+export declare function verifyPlatformFleetHost(expectedVersion: string, runtime?: PlatformFleetVerificationRuntime): Promise<PlatformFleetVerificationResult>;