@forgezero/agent 0.1.52 → 0.1.55

package/dist/deploy-compiler.js

@@ -0,0 +1,1050 @@
+// @bun
+// src/deploy-plan.ts
+import { createHash } from "crypto";
+
+// src/deploy-actions.ts
+var row = (value, where) => {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`${where} must be an object`);
+  return value;
+};
+var exact = (value, keys, where) => {
+  const unknown = Object.keys(value).filter((key) => !keys.includes(key));
+  if (unknown.length)
+    throw new Error(`${where} contains unknown field(s): ${unknown.join(", ")}`);
+  for (const key of keys)
+    if (value[key] === undefined)
+      throw new Error(`${where} requires ${key}`);
+};
+var component = (value, components, where) => {
+  if (typeof value !== "string" || !components[value])
+    throw new Error(`${where}.component must name an existing component`);
+  return components[value];
+};
+var exactArgv = (value, where) => {
+  if (!Array.isArray(value) || value.length < 1 || value.length > 256 || value.some((entry) => typeof entry !== "string" || entry.length < 1 || entry.length > 16384 || entry.includes("\x00")))
+    throw new Error(`${where} requires a bounded exact argv array`);
+  const executable = value[0].split("/").at(-1).toLowerCase();
+  if (["sh", "bash", "dash", "zsh", "ksh", "fish", "busybox", "env"].includes(executable))
+    throw new Error(`${where} cannot invoke a command dispatcher`);
+};
+function validateBuiltInAction(definition, context, where) {
+  if (!definition.uses.startsWith("forgezero."))
+    return;
+  const withValue = row(definition.with, `${where}.with`);
+  if (definition.uses === "forgezero.software/ensure@1") {
+    exact(withValue, ["requirements"], `${where}.with`);
+    if (!Array.isArray(withValue.requirements) || withValue.requirements.length < 1 || withValue.requirements.length > 64 || withValue.requirements.some((name) => typeof name !== "string" || !context.requirements[name]))
+      throw new Error(`${where}.with.requirements must name existing requirements`);
+    return;
+  }
+  if (definition.uses === "forgezero.exec/argv@1") {
+    const allowed = ["component", "argv", "credentials"];
+    const unknown = Object.keys(withValue).filter((key) => !allowed.includes(key));
+    if (unknown.length)
+      throw new Error(`${where}.with contains unknown field(s): ${unknown.join(", ")}`);
+    component(withValue.component, context.components, `${where}.with`);
+    exactArgv(withValue.argv, `${where}.with.argv`);
+    if (withValue.credentials !== undefined) {
+      const bindings = row(withValue.credentials, `${where}.with.credentials`);
+      for (const [environment, credentialName] of Object.entries(bindings))
+        if (!/^[A-Z_][A-Z0-9_]*$/.test(environment) || typeof credentialName !== "string" || !context.credentials[credentialName])
+          throw new Error(`${where}.with.credentials contains an invalid binding`);
+    }
+    return;
+  }
+  if (["forgezero.oci/build@1", "forgezero.oci/pull@1"].includes(definition.uses)) {
+    const allowed = definition.uses.endsWith("/build@1") ? ["component", "noCache"] : ["component"];
+    const unknown = Object.keys(withValue).filter((key) => !allowed.includes(key));
+    if (unknown.length)
+      throw new Error(`${where}.with contains unknown field(s): ${unknown.join(", ")}`);
+    const selected = component(withValue.component, context.components, `${where}.with`);
+    if (selected.kind !== "application" || selected.runtime.kind !== "container")
+      throw new Error(`${where}.with.component must use a container runtime`);
+    if (withValue.noCache !== undefined && typeof withValue.noCache !== "boolean")
+      throw new Error(`${where}.with.noCache must be a boolean`);
+    return;
+  }
+  if (["forgezero.service/deploy@1", "forgezero.service/promote@1", "forgezero.health/http@1", "forgezero.storage/verify@1"].includes(definition.uses)) {
+    const allowed = definition.uses === "forgezero.service/deploy@1" || definition.uses === "forgezero.service/promote@1" ? ["component", "imageDigest"] : ["component"];
+    const unknown = Object.keys(withValue).filter((key) => !allowed.includes(key));
+    if (unknown.length)
+      throw new Error(`${where}.with contains unknown field(s): ${unknown.join(", ")}`);
+    component(withValue.component, context.components, `${where}.with`);
+    return;
+  }
+  throw new Error(`${where}.uses is an unknown ForgeZero action`);
+}
+// src/deploy-providers.ts
+var plain = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
+var exact2 = (row2, keys, provider) => {
+  const unknown = Object.keys(row2).filter((key) => !keys.includes(key));
+  if (unknown.length)
+    throw new Error(`${provider} config contains unknown field(s): ${unknown.join(", ")}`);
+  for (const key of keys)
+    if (row2[key] === undefined)
+      throw new Error(`${provider} config requires ${key}`);
+};
+var absolute = (value) => typeof value === "string" && /^\/(?:[A-Za-z0-9._-]+\/?)*$/.test(value) && !value.includes("..");
+function validateBuiltInProvider(requirement2, where) {
+  const row2 = plain(requirement2.config);
+  if (!requirement2.provider.startsWith("forgezero."))
+    return;
+  const expected = {
+    "forgezero.bun": { capability: "runtime.javascript", versions: ["1.3.14"], keys: ["installScope"] },
+    "forgezero.docker": { capability: "runtime.container", versions: ["ubuntu-26.04"], keys: ["installScope", "storageDriver", "dataRoot", "liveRestore", "logDriver", "defaultNetwork", "rootless"] },
+    "forgezero.nginx": { capability: "proxy.http", versions: ["ubuntu-26.04"], keys: ["installScope", "websocket", "maximumBodyMiB", "workerProcesses", "workerConnections"] },
+    "forgezero.arangodb": { capability: "database.arangodb", versions: ["3.11.14"], keys: ["installScope", "runtime", "dataPath", "bind"] },
+    "forgezero.cloudflared": { capability: "network.public-tunnel", versions: ["2026.7.3"], keys: ["installScope", "mode"] },
+    "forgezero.warp": { capability: "network.private", versions: ["2026.6.822.0-min"], keys: ["installScope", "mode"] },
+    "forgezero.ufw": { capability: "security.firewall", versions: ["ubuntu-26.04"], keys: ["installScope", "defaultIncoming", "defaultOutgoing"] },
+    "forgezero.openssh": { capability: "transport.ssh", versions: ["ubuntu-26.04"], keys: ["installScope", "mode"] },
+    "forgezero.systemd": { capability: "service.manager", versions: ["ubuntu-26.04"], keys: ["installScope", "credentials", "serviceSandbox"] }
+  };
+  const contract = expected[requirement2.provider];
+  if (!contract)
+    throw new Error(`${where} uses unknown built-in provider ${requirement2.provider}`);
+  if (requirement2.contract !== 1 || requirement2.capability !== contract.capability || !contract.versions.includes(requirement2.version))
+    throw new Error(`${where} provider coordinate is unsupported`);
+  exact2(row2, contract.keys, requirement2.provider);
+  if (row2.installScope !== "host")
+    throw new Error(`${where}.config.installScope must be host`);
+  if (requirement2.provider === "forgezero.docker") {
+    if (row2.storageDriver !== "overlay2" || row2.dataRoot !== "/var/lib/docker" || row2.liveRestore !== true || row2.logDriver !== "local" || row2.defaultNetwork !== "bridge" || row2.rootless !== false)
+      throw new Error(`${where} Docker config is unsupported by the fixed host strategy`);
+  }
+  if (requirement2.provider === "forgezero.nginx" && (typeof row2.websocket !== "boolean" || !Number.isInteger(row2.maximumBodyMiB) || Number(row2.maximumBodyMiB) < 1 || Number(row2.maximumBodyMiB) > 1024 || !(row2.workerProcesses === "auto" || Number.isInteger(row2.workerProcesses)) || !Number.isInteger(row2.workerConnections)))
+    throw new Error(`${where} Nginx config is invalid`);
+  if (requirement2.provider === "forgezero.arangodb" && (row2.runtime !== "native" || !absolute(row2.dataPath) || row2.bind !== "private"))
+    throw new Error(`${where} ArangoDB config is invalid`);
+}
+
+// src/deploy-plan.ts
+var DEPLOY_PLAN_FORMAT = "forgezero-deployment-plan";
+var DEPLOY_PLAN_VERSION = 1;
+
+class DeploymentPlanError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DeploymentPlanError";
+  }
+}
+var NAME = /^[a-z][A-Za-z0-9-]{0,62}$/;
+var COORDINATE = /^[a-z][a-z0-9.-]{0,127}$/;
+var ACTION = /^[a-z][a-z0-9.-]{0,127}\/[a-z][a-z0-9.-]{0,127}@[1-9][0-9]{0,5}$/;
+var VERSION = /^[A-Za-z0-9][A-Za-z0-9.+_-]{0,63}$/;
+var ABSOLUTE_PATH = /^\/(?:[A-Za-z0-9._-]+\/?)*$/;
+var HEALTH_PATH = /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]{0,255}$/;
+var fail = (where, message) => {
+  throw new DeploymentPlanError(`${where} ${message}`);
+};
+var object = (value, where) => {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    fail(where, "must be an object.");
+  return value;
+};
+var exact3 = (value, allowed, where) => {
+  const unknown = Object.keys(value).filter((key) => !allowed.includes(key));
+  if (unknown.length)
+    fail(where, `contains unknown field(s): ${unknown.join(", ")}.`);
+};
+var named = (value, where) => {
+  if (typeof value !== "string" || !NAME.test(value))
+    fail(where, "must be a lowercase typed name.");
+  return value;
+};
+var boundedString = (value, where, maximum = 256) => {
+  if (typeof value !== "string" || value.length < 1 || value.length > maximum || value.includes("\x00"))
+    fail(where, `must be a non-empty string of at most ${maximum} characters.`);
+  return value;
+};
+var integer = (value, where, minimum, maximum) => {
+  if (!Number.isInteger(value) || value < minimum || value > maximum)
+    fail(where, `must be an integer from ${minimum} to ${maximum}.`);
+  return value;
+};
+var number = (value, where, minimum, maximum) => {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < minimum || value > maximum)
+    fail(where, `must be a finite number from ${minimum} to ${maximum}.`);
+  return value;
+};
+function canonicalJson(value) {
+  if (value === null || typeof value === "boolean" || typeof value === "string")
+    return JSON.stringify(value);
+  if (typeof value === "number") {
+    if (!Number.isFinite(value))
+      throw new DeploymentPlanError("deployment data contains a non-finite number.");
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  if (value && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype) {
+    return `{${Object.entries(value).filter(([, entry]) => entry !== undefined).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`).join(",")}}`;
+  }
+  throw new DeploymentPlanError("deployment data must contain only plain JSON values.");
+}
+function deploymentSourceDigest(source) {
+  return `sha256:${createHash("sha256").update(canonicalJson(source)).digest("hex")}`;
+}
+function reference(value, where) {
+  const row2 = object(value, where);
+  exact3(row2, ["$ref"], where);
+  const coordinate = boundedString(row2.$ref, `${where}.$ref`, 256);
+  if (!/^(inputs\.[a-z][A-Za-z0-9-]{0,62}|steps\.[a-z][A-Za-z0-9-]{0,62}\.(status|outputs\.[a-z][A-Za-z0-9-]{0,62})|components\.[a-z][A-Za-z0-9-]{0,62}\.[a-z][A-Za-z0-9-]{0,62}|targets\.[a-z][A-Za-z0-9-]{0,62}\.[a-z][A-Za-z0-9-]{0,62}|deployment\.[a-z][A-Za-z0-9-]{0,62})$/.test(coordinate)) {
+    fail(where, "contains an unsupported reference.");
+  }
+  return { $ref: coordinate };
+}
+function operand(value, where) {
+  if (value === null || ["string", "number", "boolean"].includes(typeof value)) {
+    if (typeof value === "number" && !Number.isFinite(value))
+      fail(where, "must be finite.");
+    return value;
+  }
+  return reference(value, where);
+}
+function condition(value, where, depth = 0) {
+  if (depth > 16)
+    fail(where, "is nested too deeply.");
+  const row2 = object(value, where);
+  if (Object.keys(row2).length !== 1)
+    fail(where, "must contain exactly one operator.");
+  const [operator, body] = Object.entries(row2)[0];
+  if (operator === "all" || operator === "any") {
+    if (!Array.isArray(body) || body.length < 1 || body.length > 32)
+      fail(where, `${operator} must contain 1 to 32 conditions.`);
+    const entries = body;
+    return { [operator]: entries.map((entry, index) => condition(entry, `${where}.${operator}[${index}]`, depth + 1)) };
+  }
+  if (operator === "not")
+    return { not: condition(body, `${where}.not`, depth + 1) };
+  if (["equals", "notEquals", "greaterThan", "greaterThanOrEqual", "lessThan", "lessThanOrEqual", "contains", "startsWith"].includes(operator)) {
+    if (!Array.isArray(body) || body.length !== 2)
+      fail(where, `${operator} must contain two operands.`);
+    const entries = body;
+    return { [operator]: [operand(entries[0], `${where}.${operator}[0]`), operand(entries[1], `${where}.${operator}[1]`)] };
+  }
+  if (operator === "exists")
+    return { exists: reference(body, `${where}.exists`) };
+  if (["succeeded", "failed", "changed"].includes(operator))
+    return { [operator]: named(body, `${where}.${operator}`) };
+  return fail(where, `uses unsupported operator ${operator}.`);
+}
+function jsonValue(value, where, depth = 0) {
+  if (depth > 16)
+    fail(where, "is nested too deeply.");
+  if (value === null || typeof value === "string" || typeof value === "boolean")
+    return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value))
+      fail(where, "must be finite.");
+    return value;
+  }
+  if (Array.isArray(value)) {
+    if (value.length > 1000)
+      fail(where, "contains more than 1000 entries.");
+    return value.map((entry, index) => jsonValue(entry, `${where}[${index}]`, depth + 1));
+  }
+  const row2 = object(value, where);
+  if (Object.keys(row2).length > 1000)
+    fail(where, "contains more than 1000 fields.");
+  return Object.fromEntries(Object.entries(row2).map(([key, entry]) => [key, jsonValue(entry, `${where}.${key}`, depth + 1)]));
+}
+function validateInput(value, where) {
+  const row2 = object(value, where);
+  const type = row2.type;
+  const common = ["type", "required", "default"];
+  if (row2.required !== undefined && typeof row2.required !== "boolean")
+    fail(`${where}.required`, "must be a boolean.");
+  if (type === "string") {
+    exact3(row2, [...common, "minimumLength", "maximumLength", "pattern"], where);
+    if (row2.default !== undefined)
+      boundedString(row2.default, `${where}.default`, 16384);
+    if (row2.minimumLength !== undefined)
+      integer(row2.minimumLength, `${where}.minimumLength`, 0, 16384);
+    if (row2.maximumLength !== undefined)
+      integer(row2.maximumLength, `${where}.maximumLength`, 1, 16384);
+    if (row2.pattern !== undefined) {
+      const pattern = boundedString(row2.pattern, `${where}.pattern`, 512);
+      try {
+        new RegExp(pattern);
+      } catch {
+        fail(`${where}.pattern`, "must be a valid regular expression.");
+      }
+    }
+  } else if (type === "integer" || type === "number") {
+    exact3(row2, [...common, "minimum", "maximum"], where);
+    if (row2.default !== undefined)
+      number(row2.default, `${where}.default`, -Number.MAX_SAFE_INTEGER, Number.MAX_SAFE_INTEGER);
+    if (row2.minimum !== undefined)
+      number(row2.minimum, `${where}.minimum`, -Number.MAX_SAFE_INTEGER, Number.MAX_SAFE_INTEGER);
+    if (row2.maximum !== undefined)
+      number(row2.maximum, `${where}.maximum`, -Number.MAX_SAFE_INTEGER, Number.MAX_SAFE_INTEGER);
+    if (type === "integer" && row2.default !== undefined && !Number.isInteger(row2.default))
+      fail(`${where}.default`, "must be an integer.");
+  } else if (type === "boolean") {
+    exact3(row2, common, where);
+    if (row2.default !== undefined && typeof row2.default !== "boolean")
+      fail(`${where}.default`, "must be a boolean.");
+  } else if (type === "enum") {
+    exact3(row2, [...common, "values"], where);
+    if (!Array.isArray(row2.values) || row2.values.length < 1 || row2.values.length > 64)
+      fail(`${where}.values`, "must contain 1 to 64 values.");
+    const values = row2.values.map((entry, index) => boundedString(entry, `${where}.values[${index}]`, 128));
+    if (new Set(values).size !== values.length)
+      fail(`${where}.values`, "must be unique.");
+    if (row2.default !== undefined && !values.includes(row2.default))
+      fail(`${where}.default`, "must be an enum value.");
+  } else if (type === "hostname") {
+    exact3(row2, common, where);
+    if (row2.default !== undefined && !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(String(row2.default)))
+      fail(`${where}.default`, "must be a hostname.");
+  } else
+    fail(`${where}.type`, "is unsupported.");
+  return row2;
+}
+function validateRequirement(value, where) {
+  const row2 = object(value, where);
+  exact3(row2, ["capability", "provider", "contract", "version", "config", "when"], where);
+  if (!COORDINATE.test(String(row2.capability)))
+    fail(`${where}.capability`, "is invalid.");
+  if (!COORDINATE.test(String(row2.provider)))
+    fail(`${where}.provider`, "is invalid.");
+  integer(row2.contract, `${where}.contract`, 1, 65535);
+  if (typeof row2.version !== "string" || !VERSION.test(row2.version))
+    fail(`${where}.version`, "is invalid.");
+  jsonValue(row2.config, `${where}.config`);
+  if (row2.when !== undefined)
+    condition(row2.when, `${where}.when`);
+  const requirement2 = row2;
+  validateBuiltInProvider(requirement2, where);
+  return requirement2;
+}
+function validateArgv(value, where) {
+  if (!Array.isArray(value) || value.length < 1 || value.length > 256)
+    fail(where, "must contain 1 to 256 arguments.");
+  let bytes = 0;
+  const values = value.map((entry, index) => {
+    const result = boundedString(entry, `${where}[${index}]`, 16384);
+    bytes += Buffer.byteLength(result);
+    return result;
+  });
+  if (bytes > 64 * 1024)
+    fail(where, "is larger than 64 KiB.");
+  const executable = values[0].split("/").at(-1).toLowerCase();
+  if (["sh", "bash", "dash", "zsh", "ksh", "fish", "busybox", "env"].includes(executable))
+    fail(`${where}[0]`, "may not invoke a command dispatcher.");
+  return values;
+}
+function validateResources(value, where) {
+  const row2 = object(value, where);
+  exact3(row2, ["cpu", "memory", "pids", "io"], where);
+  if (row2.cpu !== undefined) {
+    const cpu = object(row2.cpu, `${where}.cpu`);
+    exact3(cpu, ["limit", "weight", "pinning"], `${where}.cpu`);
+    number(cpu.limit, `${where}.cpu.limit`, 0.01, 1024);
+    if (cpu.weight !== undefined)
+      integer(cpu.weight, `${where}.cpu.weight`, 1, 1e4);
+    if (cpu.pinning !== undefined && !["automatic", "dedicated"].includes(String(cpu.pinning)))
+      fail(`${where}.cpu.pinning`, "is unsupported.");
+  }
+  if (row2.memory !== undefined) {
+    const memory = object(row2.memory, `${where}.memory`);
+    exact3(memory, ["limitMiB", "reservationMiB", "swap"], `${where}.memory`);
+    integer(memory.limitMiB, `${where}.memory.limitMiB`, 16, 16777216);
+    if (memory.reservationMiB !== undefined && integer(memory.reservationMiB, `${where}.memory.reservationMiB`, 1, memory.limitMiB) > memory.limitMiB)
+      fail(`${where}.memory.reservationMiB`, "must not exceed limitMiB.");
+    if (memory.swap !== undefined && !["disabled", "bounded"].includes(String(memory.swap)))
+      fail(`${where}.memory.swap`, "is unsupported.");
+  }
+  if (row2.pids !== undefined) {
+    const pids = object(row2.pids, `${where}.pids`);
+    exact3(pids, ["limit"], `${where}.pids`);
+    integer(pids.limit, `${where}.pids.limit`, 1, 1048576);
+  }
+  if (row2.io !== undefined) {
+    const io = object(row2.io, `${where}.io`);
+    exact3(io, ["weight", "readBps", "writeBps", "readIops", "writeIops"], `${where}.io`);
+    for (const key of Object.keys(io))
+      integer(io[key], `${where}.io.${key}`, 1, Number.MAX_SAFE_INTEGER);
+  }
+}
+function validateStorage(value, where) {
+  const row2 = object(value, where);
+  if (row2.class === "ephemeral") {
+    exact3(row2, ["class", "path", "type", "sizeMiB"], where);
+    if (row2.type !== "tmpfs")
+      fail(`${where}.type`, "must be tmpfs.");
+    integer(row2.sizeMiB, `${where}.sizeMiB`, 1, 1048576);
+  } else if (row2.class === "persistent") {
+    exact3(row2, ["class", "name", "path", "minimumFreePercent"], where);
+    named(row2.name, `${where}.name`);
+    if (row2.minimumFreePercent !== undefined)
+      integer(row2.minimumFreePercent, `${where}.minimumFreePercent`, 1, 95);
+  } else if (row2.class === "database") {
+    exact3(row2, ["class", "name", "path", "minimumFreePercent", "minimumIops", "latencyTargetMs"], where);
+    named(row2.name, `${where}.name`);
+    integer(row2.minimumFreePercent, `${where}.minimumFreePercent`, 1, 95);
+    if (row2.minimumIops !== undefined)
+      integer(row2.minimumIops, `${where}.minimumIops`, 1, 1e8);
+    if (row2.latencyTargetMs !== undefined)
+      number(row2.latencyTargetMs, `${where}.latencyTargetMs`, 0.01, 60000);
+  } else
+    fail(`${where}.class`, "is unsupported.");
+  if (typeof row2.path !== "string" || !ABSOLUTE_PATH.test(row2.path) || row2.path.includes(".."))
+    fail(`${where}.path`, "must be a normalized absolute path.");
+}
+function validateNetwork(value, where) {
+  const row2 = object(value, where);
+  exact3(row2, ["ingress", "private", "public", "container"], where);
+  if (row2.ingress !== undefined) {
+    const ingress = object(row2.ingress, `${where}.ingress`);
+    exact3(ingress, ["exposure", "stablePort"], `${where}.ingress`);
+    if (!["loopback", "private", "public"].includes(String(ingress.exposure)))
+      fail(`${where}.ingress.exposure`, "is unsupported.");
+    if (ingress.stablePort !== undefined)
+      integer(ingress.stablePort, `${where}.ingress.stablePort`, 1, 65535);
+  }
+  if (row2.private !== undefined) {
+    const privateNetwork = object(row2.private, `${where}.private`);
+    exact3(privateNetwork, ["mode", "preferences"], `${where}.private`);
+    if (!["private-lan", "cloudflare-warp", "auto"].includes(String(privateNetwork.mode)))
+      fail(`${where}.private.mode`, "is unsupported.");
+    if (privateNetwork.preferences !== undefined && (!Array.isArray(privateNetwork.preferences) || privateNetwork.preferences.length < 1 || privateNetwork.preferences.length > 2 || privateNetwork.preferences.some((entry) => !["private-lan", "cloudflare-warp"].includes(String(entry))) || new Set(privateNetwork.preferences).size !== privateNetwork.preferences.length))
+      fail(`${where}.private.preferences`, "is invalid.");
+  }
+  if (row2.public !== undefined) {
+    const publicNetwork = object(row2.public, `${where}.public`);
+    exact3(publicNetwork, ["mode", "optional"], `${where}.public`);
+    if (!["disabled", "cloudflare-tunnel"].includes(String(publicNetwork.mode)))
+      fail(`${where}.public.mode`, "is unsupported.");
+    if (publicNetwork.optional !== undefined && typeof publicNetwork.optional !== "boolean")
+      fail(`${where}.public.optional`, "must be a boolean.");
+  }
+  if (row2.container !== undefined) {
+    const container = object(row2.container, `${where}.container`);
+    exact3(container, ["mode", "network"], `${where}.container`);
+    if (!["bridge", "host"].includes(String(container.mode)))
+      fail(`${where}.container.mode`, "is unsupported.");
+    if (container.network !== undefined)
+      named(container.network, `${where}.container.network`);
+  }
+}
+function validateComponent(value, where, targetNames, requirements) {
+  const row2 = object(value, where);
+  if (!targetNames.has(String(row2.target)))
+    fail(`${where}.target`, "must name an existing target.");
+  if (row2.kind === "application") {
+    exact3(row2, ["kind", "target", "runtime", "service", "resources", "storage", "network", "rollout"], where);
+    const runtime = object(row2.runtime, `${where}.runtime`);
+    const runtimeRequirement = requirements.get(String(runtime.requirement));
+    if (!runtimeRequirement)
+      fail(`${where}.runtime.requirement`, "must name an existing requirement.");
+    if (runtime.kind === "native") {
+      exact3(runtime, ["kind", "provider", "requirement", "argv"], `${where}.runtime`);
+      validateArgv(runtime.argv, `${where}.runtime.argv`);
+    } else if (runtime.kind === "container") {
+      exact3(runtime, ["kind", "provider", "requirement", "image", "entrypoint", "security"], `${where}.runtime`);
+      const image = object(runtime.image, `${where}.runtime.image`);
+      exact3(image, ["source"], `${where}.runtime.image`);
+      const source = object(image.source, `${where}.runtime.image.source`);
+      if (source.kind === "build") {
+        exact3(source, ["kind", "context", "dockerfile"], `${where}.runtime.image.source`);
+        boundedString(source.context, `${where}.runtime.image.source.context`, 512);
+        boundedString(source.dockerfile, `${where}.runtime.image.source.dockerfile`, 512);
+      } else if (source.kind === "registry") {
+        exact3(source, ["kind", "reference"], `${where}.runtime.image.source`);
+        if (!/^[-a-zA-Z0-9./:_@]+$/.test(boundedString(source.reference, `${where}.runtime.image.source.reference`, 512)))
+          fail(`${where}.runtime.image.source.reference`, "is invalid.");
+      } else
+        fail(`${where}.runtime.image.source.kind`, "is unsupported.");
+      if (runtime.entrypoint !== undefined)
+        validateArgv(runtime.entrypoint, `${where}.runtime.entrypoint`);
+      const security = object(runtime.security, `${where}.runtime.security`);
+      exact3(security, ["privileged", "noNewPrivileges", "root", "dropCapabilities"], `${where}.runtime.security`);
+      if (security.privileged !== false || security.noNewPrivileges !== true)
+        fail(`${where}.runtime.security`, "must disable privileged mode and enable noNewPrivileges.");
+      if (!["read-only", "writable"].includes(String(security.root)))
+        fail(`${where}.runtime.security.root`, "is unsupported.");
+      if (!Array.isArray(security.dropCapabilities) || !security.dropCapabilities.includes("ALL"))
+        fail(`${where}.runtime.security.dropCapabilities`, "must include ALL.");
+    } else
+      fail(`${where}.runtime.kind`, "is unsupported.");
+    if (!COORDINATE.test(String(runtime.provider)))
+      fail(`${where}.runtime.provider`, "is invalid.");
+    if (runtimeRequirement && runtime.provider !== runtimeRequirement.provider)
+      fail(`${where}.runtime.provider`, "must match its requirement provider.");
+    if (runtimeRequirement && runtime.kind === "container" && runtimeRequirement.capability !== "runtime.container")
+      fail(`${where}.runtime.requirement`, "must provide runtime.container.");
+    if (runtimeRequirement && runtime.kind === "native" && !runtimeRequirement.capability.startsWith("runtime."))
+      fail(`${where}.runtime.requirement`, "must provide a runtime capability.");
+    const service = object(row2.service, `${where}.service`);
+    exact3(service, ["protocol", "port", "health", "websocket", "maximumConnections"], `${where}.service`);
+    if (service.protocol !== "http")
+      fail(`${where}.service.protocol`, "must be http.");
+    integer(service.port, `${where}.service.port`, 1, 65535);
+    const health = object(service.health, `${where}.service.health`);
+    exact3(health, ["protocol", "method", "path", "expectedStatus", "timeoutMs", "intervalMs", "attempts"], `${where}.service.health`);
+    if (health.protocol !== "http" || !["GET", "HEAD"].includes(String(health.method)) || typeof health.path !== "string" || !HEALTH_PATH.test(health.path) || health.path.includes("..") || health.path.includes("//"))
+      fail(`${where}.service.health`, "is invalid.");
+    if (!Array.isArray(health.expectedStatus) || health.expectedStatus.length < 1 || health.expectedStatus.length > 16 || health.expectedStatus.some((status) => !Number.isInteger(status) || status < 100 || status > 599))
+      fail(`${where}.service.health.expectedStatus`, "is invalid.");
+    integer(health.timeoutMs, `${where}.service.health.timeoutMs`, 100, 300000);
+    if (health.intervalMs !== undefined)
+      integer(health.intervalMs, `${where}.service.health.intervalMs`, 100, 300000);
+    if (health.attempts !== undefined)
+      integer(health.attempts, `${where}.service.health.attempts`, 1, 1000);
+    if (service.websocket !== undefined && typeof service.websocket !== "boolean")
+      fail(`${where}.service.websocket`, "must be a boolean.");
+    if (service.maximumConnections !== undefined)
+      integer(service.maximumConnections, `${where}.service.maximumConnections`, 1, 1e7);
+    validateResources(row2.resources, `${where}.resources`);
+    if (runtime.kind === "container") {
+      const resources = object(row2.resources, `${where}.resources`);
+      for (const required of ["cpu", "memory", "pids"])
+        if (resources[required] === undefined)
+          fail(`${where}.resources.${required}`, "is required for a bounded container.");
+      if (row2.network === undefined)
+        fail(`${where}.network`, "is required for a container.");
+      const network = object(row2.network, `${where}.network`);
+      if (network.container === undefined)
+        fail(`${where}.network.container`, "must select bridge or reviewed host networking.");
+    }
+    if (row2.storage !== undefined) {
+      if (!Array.isArray(row2.storage) || row2.storage.length > 32)
+        fail(`${where}.storage`, "must contain at most 32 mounts.");
+      row2.storage.forEach((entry, index) => validateStorage(entry, `${where}.storage[${index}]`));
+    }
+    if (row2.network !== undefined)
+      validateNetwork(row2.network, `${where}.network`);
+    const rollout = object(row2.rollout, `${where}.rollout`);
+    exact3(rollout, ["strategy", "proxy", "drainMs", "automaticRollback"], `${where}.rollout`);
+    if (!["direct", "blue-green", "rolling", "canary"].includes(String(rollout.strategy)))
+      fail(`${where}.rollout.strategy`, "is unsupported.");
+    if (rollout.proxy !== undefined)
+      named(rollout.proxy, `${where}.rollout.proxy`);
+    if (rollout.strategy !== "direct") {
+      const proxyRequirement = requirements.get(String(rollout.proxy));
+      if (!proxyRequirement || proxyRequirement.capability !== "proxy.http")
+        fail(`${where}.rollout.proxy`, "must name a proxy.http requirement for managed rollout.");
+    }
+    if (rollout.drainMs !== undefined)
+      integer(rollout.drainMs, `${where}.rollout.drainMs`, 0, 600000);
+    if (rollout.automaticRollback !== undefined && typeof rollout.automaticRollback !== "boolean")
+      fail(`${where}.rollout.automaticRollback`, "must be a boolean.");
+  } else if (row2.kind === "database") {
+    exact3(row2, ["kind", "target", "runtime", "topology", "resources", "storage", "network"], where);
+    const runtime = object(row2.runtime, `${where}.runtime`);
+    exact3(runtime, ["provider", "requirement", "mode"], `${where}.runtime`);
+    const databaseRequirement = requirements.get(String(runtime.requirement));
+    if (!databaseRequirement)
+      fail(`${where}.runtime.requirement`, "must name an existing requirement.");
+    if (databaseRequirement && (runtime.provider !== databaseRequirement.provider || databaseRequirement.capability !== "database.arangodb"))
+      fail(`${where}.runtime.requirement`, "must match a database.arangodb provider requirement.");
+    if (databaseRequirement && databaseRequirement.config.runtime !== runtime.mode)
+      fail(`${where}.runtime.mode`, "must match the provider runtime mode.");
+    if (runtime.mode !== "native")
+      fail(`${where}.runtime.mode`, "must be native in deployment plan v1.");
+    const topology = object(row2.topology, `${where}.topology`);
+    if (topology.mode === "standalone")
+      exact3(topology, ["mode"], `${where}.topology`);
+    else if (topology.mode === "cluster") {
+      exact3(topology, ["mode", "bootstrapMembers", "replicationFactor", "writeConcern", "additionalJoiners"], `${where}.topology`);
+      integer(topology.bootstrapMembers, `${where}.topology.bootstrapMembers`, 3, 9);
+      integer(topology.replicationFactor, `${where}.topology.replicationFactor`, 1, 16);
+      integer(topology.writeConcern, `${where}.topology.writeConcern`, 1, topology.replicationFactor);
+      if (!["allowed", "disabled"].includes(String(topology.additionalJoiners)))
+        fail(`${where}.topology.additionalJoiners`, "is unsupported.");
+    } else
+      fail(`${where}.topology.mode`, "is unsupported.");
+    if (row2.resources !== undefined)
+      validateResources(row2.resources, `${where}.resources`);
+    validateStorage(row2.storage, `${where}.storage`);
+    if (row2.storage.class !== "database")
+      fail(`${where}.storage.class`, "must be database.");
+    validateNetwork(row2.network, `${where}.network`);
+  } else
+    fail(`${where}.kind`, "is unsupported.");
+  return row2;
+}
+function validateStep(value, where, targets, context) {
+  const row2 = object(value, where);
+  exact3(row2, ["uses", "with", "if", "scope", "timeoutMs", "retry", "failure", "compensate"], where);
+  if (typeof row2.uses !== "string" || !ACTION.test(row2.uses))
+    fail(`${where}.uses`, "must be a versioned action coordinate.");
+  jsonValue(row2.with, `${where}.with`);
+  if (row2.if !== undefined)
+    condition(row2.if, `${where}.if`);
+  const scope = object(row2.scope, `${where}.scope`);
+  if (scope.kind === "release-executor")
+    exact3(scope, ["kind"], `${where}.scope`);
+  else if (scope.kind === "elected-one") {
+    exact3(scope, ["kind", "group"], `${where}.scope`);
+    named(scope.group, `${where}.scope.group`);
+  } else if (scope.kind === "each-target") {
+    exact3(scope, ["kind", "target"], `${where}.scope`);
+    if (!targets.has(String(scope.target)))
+      fail(`${where}.scope.target`, "must name an existing target.");
+  } else if (scope.kind === "target-batches") {
+    exact3(scope, ["kind", "target", "size"], `${where}.scope`);
+    if (!targets.has(String(scope.target)))
+      fail(`${where}.scope.target`, "must name an existing target.");
+    integer(scope.size, `${where}.scope.size`, 1, 32);
+  } else
+    fail(`${where}.scope.kind`, "is unsupported.");
+  if (row2.timeoutMs !== undefined)
+    integer(row2.timeoutMs, `${where}.timeoutMs`, 1, 86400000);
+  if (row2.retry !== undefined) {
+    const retry = object(row2.retry, `${where}.retry`);
+    exact3(retry, ["attempts", "backoff", "retryOn"], `${where}.retry`);
+    integer(retry.attempts, `${where}.retry.attempts`, 1, 20);
+    const backoff = object(retry.backoff, `${where}.retry.backoff`);
+    exact3(backoff, ["kind", "initialMs", "maximumMs"], `${where}.retry.backoff`);
+    if (!["fixed", "linear", "exponential"].includes(String(backoff.kind)))
+      fail(`${where}.retry.backoff.kind`, "is unsupported.");
+    integer(backoff.initialMs, `${where}.retry.backoff.initialMs`, 0, 300000);
+    integer(backoff.maximumMs, `${where}.retry.backoff.maximumMs`, backoff.initialMs, 3600000);
+    if (retry.retryOn !== undefined && (!Array.isArray(retry.retryOn) || retry.retryOn.length > 8 || retry.retryOn.some((entry) => !["network", "timeout", "provider-unavailable", "rate-limited", "conflict"].includes(String(entry))) || new Set(retry.retryOn).size !== retry.retryOn.length))
+      fail(`${where}.retry.retryOn`, "is invalid.");
+  }
+  if (row2.failure !== undefined) {
+    const failure = object(row2.failure, `${where}.failure`);
+    exact3(failure, ["policy"], `${where}.failure`);
+    if (!["continue", "stop", "rollback-stage", "rollback-deployment", "compensate", "manual-intervention"].includes(String(failure.policy)))
+      fail(`${where}.failure.policy`, "is unsupported.");
+  }
+  if (row2.compensate !== undefined) {
+    const compensate = object(row2.compensate, `${where}.compensate`);
+    exact3(compensate, ["uses", "with"], `${where}.compensate`);
+    if (typeof compensate.uses !== "string" || !ACTION.test(compensate.uses))
+      fail(`${where}.compensate.uses`, "must be a versioned action coordinate.");
+    jsonValue(compensate.with, `${where}.compensate.with`);
+    if (row2.failure?.policy !== "compensate")
+      fail(`${where}.compensate`, "requires failure.policy compensate.");
+  }
+  const definition = row2;
+  validateBuiltInAction(definition, context, where);
+  if (definition.compensate)
+    validateBuiltInAction({ uses: definition.compensate.uses, with: definition.compensate.with, scope: definition.scope }, context, `${where}.compensate`);
+  return definition;
+}
+function topologicalStages(stages, workflow) {
+  const names = Object.keys(stages);
+  const nameSet = new Set(names);
+  for (const name of names)
+    for (const dependency of stages[name].dependsOn ?? []) {
+      if (!nameSet.has(dependency))
+        fail(`workflows.${workflow}.stages.${name}.dependsOn`, `names missing stage ${dependency}.`);
+      if (dependency === name)
+        fail(`workflows.${workflow}.stages.${name}.dependsOn`, "cannot depend on itself.");
+    }
+  const visiting = new Set;
+  const visited = new Set;
+  const ordered = [];
+  const visit = (name) => {
+    if (visiting.has(name))
+      fail(`workflows.${workflow}.stages`, "contains a dependency cycle.");
+    if (visited.has(name))
+      return;
+    visiting.add(name);
+    for (const dependency of stages[name].dependsOn ?? [])
+      visit(dependency);
+    visiting.delete(name);
+    visited.add(name);
+    ordered.push(name);
+  };
+  for (const name of names.sort())
+    visit(name);
+  return ordered;
+}
+function validateStage(value, where, targets, context) {
+  const row2 = object(value, where);
+  exact3(row2, ["dependsOn", "if", "strategy", "steps"], where);
+  if (row2.dependsOn !== undefined && (!Array.isArray(row2.dependsOn) || row2.dependsOn.length > 64 || row2.dependsOn.some((entry) => typeof entry !== "string" || !NAME.test(entry)) || new Set(row2.dependsOn).size !== row2.dependsOn.length))
+    fail(`${where}.dependsOn`, "is invalid.");
+  if (row2.if !== undefined)
+    condition(row2.if, `${where}.if`);
+  const strategy = object(row2.strategy, `${where}.strategy`);
+  exact3(strategy, ["mode", "maximumConcurrency", "batchSize", "minimumHealthy", "increments", "observationMs"], `${where}.strategy`);
+  if (!["sequential", "parallel", "rolling", "blue-green", "canary"].includes(String(strategy.mode)))
+    fail(`${where}.strategy.mode`, "is unsupported.");
+  if (strategy.maximumConcurrency !== undefined)
+    integer(strategy.maximumConcurrency, `${where}.strategy.maximumConcurrency`, 1, 1024);
+  if (strategy.batchSize !== undefined)
+    integer(strategy.batchSize, `${where}.strategy.batchSize`, 1, 1024);
+  if (strategy.minimumHealthy !== undefined)
+    integer(strategy.minimumHealthy, `${where}.strategy.minimumHealthy`, 0, 1024);
+  if (strategy.increments !== undefined && (!Array.isArray(strategy.increments) || strategy.increments.length < 1 || strategy.increments.length > 20 || strategy.increments.some((entry) => !Number.isInteger(entry) || entry < 1 || entry > 100) || strategy.increments.at(-1) !== 100))
+    fail(`${where}.strategy.increments`, "must end at 100 and contain bounded percentages.");
+  if (strategy.observationMs !== undefined)
+    integer(strategy.observationMs, `${where}.strategy.observationMs`, 1000, 86400000);
+  if (strategy.mode === "canary" && strategy.increments === undefined)
+    fail(`${where}.strategy.increments`, "is required for canary mode.");
+  if (strategy.mode === "rolling" && strategy.batchSize === undefined)
+    fail(`${where}.strategy.batchSize`, "is required for rolling mode.");
+  const steps = object(row2.steps, `${where}.steps`);
+  const entries = Object.entries(steps);
+  if (entries.length < 1 || entries.length > 256)
+    fail(`${where}.steps`, "must contain 1 to 256 steps.");
+  for (const [name, stepValue] of entries) {
+    named(name, `${where}.steps key`);
+    validateStep(stepValue, `${where}.steps.${name}`, targets, context);
+  }
+  return row2;
+}
+function compileDeployment(sourceValue) {
+  const source = object(sourceValue, "deployment");
+  exact3(source, ["apiVersion", "kind", "metadata", "spec"], "deployment");
+  if (source.apiVersion !== "deploy.forgezero.net/v1")
+    fail("deployment.apiVersion", "must be deploy.forgezero.net/v1.");
+  if (source.kind !== "Deployment")
+    fail("deployment.kind", "must be Deployment.");
+  const metadata = object(source.metadata, "deployment.metadata");
+  exact3(metadata, ["name", "description"], "deployment.metadata");
+  const name = named(metadata.name, "deployment.metadata.name");
+  if (metadata.description !== undefined)
+    boundedString(metadata.description, "deployment.metadata.description", 1024);
+  const spec = object(source.spec, "deployment.spec");
+  exact3(spec, ["security", "inputs", "credentials", "targets", "requirements", "components", "workflows"], "deployment.spec");
+  if (spec.security !== undefined) {
+    const security = object(spec.security, "deployment.spec.security");
+    exact3(security, ["attestation"], "deployment.spec.security");
+    if (security.attestation !== undefined && !["required", "preferred", "disabled"].includes(String(security.attestation)))
+      fail("deployment.spec.security.attestation", "is unsupported.");
+  }
+  const inputs = object(spec.inputs ?? {}, "deployment.spec.inputs");
+  if (Object.keys(inputs).length > 128)
+    fail("deployment.spec.inputs", "contains more than 128 inputs.");
+  for (const [inputName, value] of Object.entries(inputs)) {
+    named(inputName, "deployment.spec.inputs key");
+    validateInput(value, `deployment.spec.inputs.${inputName}`);
+  }
+  const credentials = object(spec.credentials ?? {}, "deployment.spec.credentials");
+  if (Object.keys(credentials).length > 128)
+    fail("deployment.spec.credentials", "contains more than 128 credentials.");
+  for (const [credentialName, value] of Object.entries(credentials)) {
+    named(credentialName, "deployment.spec.credentials key");
+    const credential = object(value, `deployment.spec.credentials.${credentialName}`);
+    exact3(credential, ["schema", "source"], `deployment.spec.credentials.${credentialName}`);
+    if (!ACTION.test(String(credential.schema)))
+      fail(`deployment.spec.credentials.${credentialName}.schema`, "must be a versioned schema coordinate.");
+    const credentialSource = object(credential.source, `deployment.spec.credentials.${credentialName}.source`);
+    exact3(credentialSource, ["kind", "name", "fallback"], `deployment.spec.credentials.${credentialName}.source`);
+    if (!["vault", "systemd"].includes(String(credentialSource.kind)))
+      fail(`deployment.spec.credentials.${credentialName}.source.kind`, "is unsupported.");
+    named(credentialSource.name, `deployment.spec.credentials.${credentialName}.source.name`);
+    if (credentialSource.fallback !== undefined && (credentialSource.kind !== "vault" || credentialSource.fallback !== "systemd"))
+      fail(`deployment.spec.credentials.${credentialName}.source.fallback`, "may only be systemd behind Vault.");
+  }
+  const targets = object(spec.targets, "deployment.spec.targets");
+  const targetEntries = Object.entries(targets);
+  if (targetEntries.length < 1 || targetEntries.length > 64)
+    fail("deployment.spec.targets", "must contain 1 to 64 targets.");
+  const targetNames = new Set(targetEntries.map(([targetName]) => named(targetName, "deployment.spec.targets key")));
+  for (const [targetName, value] of targetEntries) {
+    const target = object(value, `deployment.spec.targets.${targetName}`);
+    exact3(target, ["kind", "selector", "cardinality", "placement"], `deployment.spec.targets.${targetName}`);
+    if (target.kind !== "compute")
+      fail(`deployment.spec.targets.${targetName}.kind`, "must be compute.");
+    const selector = object(target.selector, `deployment.spec.targets.${targetName}.selector`);
+    exact3(selector, ["profiles", "confidentialCompute", "labels"], `deployment.spec.targets.${targetName}.selector`);
+    if (!Array.isArray(selector.profiles) || selector.profiles.length < 1 || selector.profiles.length > 32 || selector.profiles.some((profile) => typeof profile !== "string" || !NAME.test(profile)) || new Set(selector.profiles).size !== selector.profiles.length)
+      fail(`deployment.spec.targets.${targetName}.selector.profiles`, "is invalid.");
+    if (selector.confidentialCompute !== undefined && !["required", "preferred", "disabled"].includes(String(selector.confidentialCompute)))
+      fail(`deployment.spec.targets.${targetName}.selector.confidentialCompute`, "is unsupported.");
+    if (selector.labels !== undefined)
+      jsonValue(selector.labels, `deployment.spec.targets.${targetName}.selector.labels`);
+    const cardinality = object(target.cardinality, `deployment.spec.targets.${targetName}.cardinality`);
+    exact3(cardinality, ["minimum", "desired", "maximum"], `deployment.spec.targets.${targetName}.cardinality`);
+    const minimum = integer(cardinality.minimum, `deployment.spec.targets.${targetName}.cardinality.minimum`, 1, 1024);
+    const maximum = integer(cardinality.maximum, `deployment.spec.targets.${targetName}.cardinality.maximum`, minimum, 1024);
+    if (typeof cardinality.desired === "number")
+      integer(cardinality.desired, `deployment.spec.targets.${targetName}.cardinality.desired`, minimum, maximum);
+    else
+      reference(cardinality.desired, `deployment.spec.targets.${targetName}.cardinality.desired`);
+    if (target.placement !== undefined)
+      jsonValue(target.placement, `deployment.spec.targets.${targetName}.placement`);
+  }
+  const requirements = object(spec.requirements ?? {}, "deployment.spec.requirements");
+  if (Object.keys(requirements).length > 64)
+    fail("deployment.spec.requirements", "contains more than 64 requirements.");
+  const requirementDefinitions = new Map;
+  const requiredProviders = new Map;
+  for (const [requirementName, value] of Object.entries(requirements)) {
+    named(requirementName, "deployment.spec.requirements key");
+    const requirementValue = validateRequirement(value, `deployment.spec.requirements.${requirementName}`);
+    requirementDefinitions.set(requirementName, requirementValue);
+    const key = `${requirementValue.provider}@${requirementValue.contract}:${requirementValue.capability}`;
+    requiredProviders.set(key, { provider: requirementValue.provider, contract: requirementValue.contract, capability: requirementValue.capability });
+  }
+  const components = object(spec.components, "deployment.spec.components");
+  const componentEntries = Object.entries(components);
+  if (componentEntries.length < 1 || componentEntries.length > 128)
+    fail("deployment.spec.components", "must contain 1 to 128 components.");
+  for (const [componentName, value] of componentEntries) {
+    named(componentName, "deployment.spec.components key");
+    validateComponent(value, `deployment.spec.components.${componentName}`, targetNames, requirementDefinitions);
+  }
+  const actionContext = {
+    components,
+    requirements,
+    credentials
+  };
+  const workflows = object(spec.workflows, "deployment.spec.workflows");
+  const workflowEntries = Object.entries(workflows);
+  if (workflowEntries.length < 1 || workflowEntries.length > 32)
+    fail("deployment.spec.workflows", "must contain 1 to 32 workflows.");
+  const plannedWorkflows = [];
+  for (const [workflowName, value] of workflowEntries.sort(([left], [right]) => left.localeCompare(right))) {
+    named(workflowName, "deployment.spec.workflows key");
+    const workflowValue = object(value, `deployment.spec.workflows.${workflowName}`);
+    exact3(workflowValue, ["concurrency", "stages"], `deployment.spec.workflows.${workflowName}`);
+    if (workflowValue.concurrency !== undefined) {
+      const concurrency = object(workflowValue.concurrency, `deployment.spec.workflows.${workflowName}.concurrency`);
+      exact3(concurrency, ["group", "limit"], `deployment.spec.workflows.${workflowName}.concurrency`);
+      boundedString(concurrency.group, `deployment.spec.workflows.${workflowName}.concurrency.group`, 256);
+      integer(concurrency.limit, `deployment.spec.workflows.${workflowName}.concurrency.limit`, 1, 1024);
+    }
+    const stages = object(workflowValue.stages, `deployment.spec.workflows.${workflowName}.stages`);
+    if (Object.keys(stages).length < 1 || Object.keys(stages).length > 64)
+      fail(`deployment.spec.workflows.${workflowName}.stages`, "must contain 1 to 64 stages.");
+    for (const [stageName, stageValue] of Object.entries(stages)) {
+      named(stageName, `deployment.spec.workflows.${workflowName}.stages key`);
+      validateStage(stageValue, `deployment.spec.workflows.${workflowName}.stages.${stageName}`, targetNames, actionContext);
+    }
+    const stepIds = new Set;
+    const plannedStages = topologicalStages(stages, workflowName).map((stageName) => {
+      const stageValue = stages[stageName];
+      const plannedSteps = Object.entries(stageValue.steps).map(([stepName, stepValue]) => {
+        if (stepIds.has(stepName))
+          fail(`deployment.spec.workflows.${workflowName}`, `contains duplicate step id ${stepName}.`);
+        stepIds.add(stepName);
+        return { id: stepName, ...stepValue };
+      });
+      return { id: stageName, ...stageValue.dependsOn ? { dependsOn: [...stageValue.dependsOn].sort() } : {}, ...stageValue.if ? { if: stageValue.if } : {}, strategy: stageValue.strategy, steps: plannedSteps };
+    });
+    plannedWorkflows.push({ id: workflowName, ...workflowValue.concurrency ? { concurrency: workflowValue.concurrency } : {}, stages: plannedStages });
+  }
+  const typedSource = source;
+  return {
+    format: DEPLOY_PLAN_FORMAT,
+    version: DEPLOY_PLAN_VERSION,
+    sourceDigest: deploymentSourceDigest(typedSource),
+    name,
+    ...metadata.description ? { description: metadata.description } : {},
+    requiredProviders: [...requiredProviders.values()].sort((left, right) => `${left.provider}:${left.contract}:${left.capability}`.localeCompare(`${right.provider}:${right.contract}:${right.capability}`)),
+    spec: {
+      ...spec.security ? { security: spec.security } : {},
+      inputs,
+      credentials,
+      targets,
+      requirements,
+      components,
+      workflows: plannedWorkflows
+    }
+  };
+}
+function deploymentPlanDigest(plan) {
+  return `sha256:${createHash("sha256").update(canonicalJson(plan)).digest("hex")}`;
+}
+function parseDeploymentPlan(value) {
+  const row2 = object(value, "plan");
+  exact3(row2, ["format", "version", "sourceDigest", "name", "description", "requiredProviders", "spec"], "plan");
+  if (row2.format !== DEPLOY_PLAN_FORMAT || row2.version !== DEPLOY_PLAN_VERSION)
+    fail("plan", "uses an unsupported format or version.");
+  if (typeof row2.sourceDigest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(row2.sourceDigest))
+    fail("plan.sourceDigest", "is invalid.");
+  named(row2.name, "plan.name");
+  if (row2.description !== undefined)
+    boundedString(row2.description, "plan.description", 1024);
+  if (!Array.isArray(row2.requiredProviders) || row2.requiredProviders.length > 64)
+    fail("plan.requiredProviders", "must be a bounded array.");
+  for (const [index, provider] of row2.requiredProviders.entries()) {
+    const item = object(provider, `plan.requiredProviders[${index}]`);
+    exact3(item, ["provider", "contract", "capability"], `plan.requiredProviders[${index}]`);
+    if (!COORDINATE.test(String(item.provider)) || !COORDINATE.test(String(item.capability)))
+      fail(`plan.requiredProviders[${index}]`, "contains an invalid coordinate.");
+    integer(item.contract, `plan.requiredProviders[${index}].contract`, 1, 65535);
+  }
+  const spec = object(row2.spec, "plan.spec");
+  const workflows = spec.workflows;
+  if (!Array.isArray(workflows))
+    fail("plan.spec.workflows", "must be an array.");
+  const sourceWorkflows = {};
+  for (const [workflowIndex, workflow] of workflows.entries()) {
+    const item = object(workflow, `plan.spec.workflows[${workflowIndex}]`);
+    exact3(item, ["id", "concurrency", "stages"], `plan.spec.workflows[${workflowIndex}]`);
+    const workflowId = named(item.id, `plan.spec.workflows[${workflowIndex}].id`);
+    if (sourceWorkflows[workflowId])
+      fail("plan.spec.workflows", `contains duplicate workflow ${workflowId}.`);
+    if (!Array.isArray(item.stages))
+      fail(`plan.spec.workflows[${workflowIndex}].stages`, "must be an array.");
+    const sourceStages = {};
+    for (const [stageIndex, stage] of item.stages.entries()) {
+      const stageItem = object(stage, `plan.spec.workflows[${workflowIndex}].stages[${stageIndex}]`);
+      exact3(stageItem, ["id", "dependsOn", "if", "strategy", "steps"], `plan.spec.workflows[${workflowIndex}].stages[${stageIndex}]`);
+      const stageId = named(stageItem.id, `plan.spec.workflows[${workflowIndex}].stages[${stageIndex}].id`);
+      if (sourceStages[stageId])
+        fail(`plan.spec.workflows[${workflowIndex}].stages`, `contains duplicate stage ${stageId}.`);
+      if (!Array.isArray(stageItem.steps))
+        fail(`plan.spec.workflows[${workflowIndex}].stages[${stageIndex}].steps`, "must be an array.");
+      const sourceSteps = {};
+      for (const [stepIndex, step2] of stageItem.steps.entries()) {
+        const stepItem = object(step2, `plan.spec.workflows[${workflowIndex}].stages[${stageIndex}].steps[${stepIndex}]`);
+        const stepId = named(stepItem.id, `plan.spec.workflows[${workflowIndex}].stages[${stageIndex}].steps[${stepIndex}].id`);
+        if (sourceSteps[stepId])
+          fail(`plan.spec.workflows[${workflowIndex}].stages[${stageIndex}].steps`, `contains duplicate step ${stepId}.`);
+        const { id: _id3, ...stepWithoutId } = stepItem;
+        sourceSteps[stepId] = stepWithoutId;
+      }
+      const { id: _id2, steps: _steps, ...stageWithoutId } = stageItem;
+      sourceStages[stageId] = { ...stageWithoutId, steps: sourceSteps };
+    }
+    const { id: _id, stages: _stages, ...workflowWithoutId } = item;
+    sourceWorkflows[workflowId] = { ...workflowWithoutId, stages: sourceStages };
+  }
+  const { workflows: _workflows, ...specWithoutWorkflows } = spec;
+  const reconstructed = {
+    apiVersion: "deploy.forgezero.net/v1",
+    kind: "Deployment",
+    metadata: { name: row2.name, ...row2.description ? { description: row2.description } : {} },
+    spec: { ...specWithoutWorkflows, workflows: sourceWorkflows }
+  };
+  const compiled = compileDeployment(reconstructed);
+  return { ...compiled, sourceDigest: row2.sourceDigest };
+}
+
+// src/deploy-compiler.ts
+import { existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "fs";
+import { dirname, isAbsolute, relative, resolve, sep } from "path";
+import { pathToFileURL } from "url";
+var DEPLOY_SOURCE_FILE = "forgezero.deploy.ts";
+var DEPLOY_PLAN_FILE = ".fz/deploy.plan.json";
+function safeName(value) {
+  const result = value.toLowerCase().replace(/^@[^/]+\//, "").replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63);
+  return /^[a-z]/.test(result) ? result : `app-${result || "service"}`;
+}
+function defaultTypeScriptDeployment(name) {
+  return `import { actions, application, defineDeployment, input, providers, stage, target, workflow } from '@forgezero/agent/deploy';
+
+export default defineDeployment({
+	apiVersion: 'deploy.forgezero.net/v1',
+	kind: 'Deployment',
+	metadata: { name: '${safeName(name)}' },
+	spec: {
+		security: { attestation: 'preferred' },
+		inputs: { replicas: input.integer({ minimum: 1, maximum: 32, default: 1 }) },
+		targets: {
+			app: target.compute({
+				selector: { profiles: ['app'] },
+				cardinality: { minimum: 1, desired: input.ref('replicas'), maximum: 32 }
+			})
+		},
+		requirements: { bun: providers.bun.require() },
+		components: {
+			app: application({
+				target: 'app',
+				runtime: { kind: 'native', provider: 'forgezero.bun', requirement: 'bun', argv: ['/usr/local/bin/bun', 'run', 'start'] },
+				service: { protocol: 'http', port: 3000, health: { protocol: 'http', method: 'GET', path: '/health', expectedStatus: [200], timeoutMs: 5_000 } },
+				resources: {},
+				rollout: { strategy: 'direct' }
+			})
+		},
+		workflows: {
+			deploy: workflow({
+				stages: {
+					build: stage({ strategy: { mode: 'sequential' }, steps: {
+						build: actions.exec.argv(
+							{ component: 'app', argv: ['/usr/local/bin/fz-agent', 'pipeline-todo', 'replace with the project build argv'] },
+							{ scope: { kind: 'each-target', target: 'app' }, timeoutMs: 600_000 }
+						)
+					} }),
+					release: stage({ dependsOn: ['build'], strategy: { mode: 'sequential' }, steps: {
+						start: actions.exec.argv(
+							{ component: 'app', argv: ['/usr/local/bin/fz-agent', 'pipeline-todo', 'replace with the project release argv'] },
+							{ scope: { kind: 'each-target', target: 'app' }, timeoutMs: 120_000 }
+						)
+					} }),
+					verify: stage({ dependsOn: ['release'], strategy: { mode: 'parallel' }, steps: {
+						health: actions.service.health({ component: 'app' }, { scope: { kind: 'each-target', target: 'app' }, timeoutMs: 30_000 })
+					} })
+				}
+			})
+		}
+	}
+});
+`;
+}
+function initializeTypeScriptDeployment(rootValue, options) {
+  const path = localPath(rootValue, DEPLOY_SOURCE_FILE, "deployment source");
+  if (existsSync(path) && !options.force)
+    throw new Error(`${DEPLOY_SOURCE_FILE} already exists; use --force only when replacing it deliberately`);
+  writeFileSync(path, defaultTypeScriptDeployment(options.name), { mode: 420, flag: options.force ? "w" : "wx" });
+  return path;
+}
+function inside(root, path) {
+  const nested = relative(root, path);
+  return nested === "" || !nested.startsWith(`..${sep}`) && nested !== ".." && !isAbsolute(nested);
+}
+function localPath(rootValue, value, label) {
+  const root = resolve(rootValue);
+  const path = resolve(root, value);
+  if (!inside(root, path))
+    throw new Error(`${label} must remain inside the project root`);
+  return path;
+}
+async function loadDeploymentSource(root, sourceFile = DEPLOY_SOURCE_FILE) {
+  const source = localPath(root, sourceFile, "deployment source");
+  if (!existsSync(source))
+    throw new Error(`${sourceFile} does not exist`);
+  const status = lstatSync(source);
+  if (!status.isFile() || status.isSymbolicLink() || status.size > 2 * 1024 * 1024)
+    throw new Error("deployment source must be one bounded regular file");
+  const module = await import(`${pathToFileURL(source).href}?forgezero=${status.mtimeMs}`);
+  if (module.default === undefined)
+    throw new Error(`${sourceFile} must export one default deployment definition`);
+  return module.default;
+}
+async function compileDeploymentProject(rootValue, options = {}) {
+  const root = resolve(rootValue);
+  const sourceFile = options.sourceFile ?? DEPLOY_SOURCE_FILE;
+  const outputFile = options.outputFile ?? DEPLOY_PLAN_FILE;
+  const source = localPath(root, sourceFile, "deployment source");
+  const output = localPath(root, outputFile, "deployment output");
+  const plan = compileDeployment(await loadDeploymentSource(root, sourceFile));
+  const bytes = `${canonicalJson(plan)}
+`;
+  parseDeploymentPlan(JSON.parse(bytes));
+  const previous = existsSync(output) ? readFileSync(output, "utf8") : undefined;
+  const changed = previous !== bytes;
+  if (options.write !== false && changed) {
+    mkdirSync(dirname(output), { recursive: true, mode: 493 });
+    const temporary = `${output}.new-${process.pid}`;
+    try {
+      writeFileSync(temporary, bytes, { mode: 420, flag: "wx" });
+      renameSync(temporary, output);
+    } finally {
+      rmSync(temporary, { force: true });
+    }
+  }
+  return { source, output, plan, digest: deploymentPlanDigest(plan), changed };
+}
+function inspectCompiledDeployment(rootValue, outputFile = DEPLOY_PLAN_FILE) {
+  const path = localPath(rootValue, outputFile, "deployment output");
+  if (!existsSync(path))
+    throw new Error(`${outputFile} does not exist; run \`fz deploy compile\``);
+  const status = lstatSync(path);
+  if (!status.isFile() || status.isSymbolicLink() || status.size > 4194304)
+    throw new Error("deployment plan must be one bounded regular file");
+  const plan = parseDeploymentPlan(JSON.parse(readFileSync(path, "utf8")));
+  return { path, plan, digest: deploymentPlanDigest(plan) };
+}
+export {
+  loadDeploymentSource,
+  inspectCompiledDeployment,
+  initializeTypeScriptDeployment,
+  defaultTypeScriptDeployment,
+  compileDeploymentProject,
+  DEPLOY_SOURCE_FILE,
+  DEPLOY_PLAN_FILE
+};