@forgezero/agent 0.1.53 → 0.1.55

package/README.md

@@ -59,7 +59,11 @@ Every row links to the detailed explanation and named-import/example area below.
 | @forgezero/agent/mesh-connector | Fixed Cloudflare Mesh/WARP connector enrollment using only the unit-loaded connector credential. | Bun/Node host | [Details + example](#forgezero-agent-mesh-connector) |
 | @forgezero/agent/compute | Compute claim, renewal, execution and completion client contracts. | Bun/Node host | [Details + example](#forgezero-agent-compute) |
 | @forgezero/agent/credential-schema | Canonical systemd credential names and validation shared by bootstrap and services. | Bun/Node host | [Details + example](#forgezero-agent-credential-schema) |
-| @forgezero/agent/definition | Validated project deployment definition and workload profiles. | Bun/Node host | [Details + example](#forgezero-agent-definition) |
+| @forgezero/agent/definition | Legacy version 3 JSON deployment compatibility contract. | Bun/Node host | [Details + example](#forgezero-agent-definition) |
+| @forgezero/agent/deploy | Typed deployment authoring builders, built-in provider requirements and versioned action constructors. | Bun/Node host | [Details + example](#forgezero-agent-deploy) |
+| @forgezero/agent/deploy-plan | Runtime validation, canonicalization and semantic digest for inert deployment plans. | Bun/Node host | [Details + example](#forgezero-agent-deploy-plan) |
+| @forgezero/agent/deploy-plan-runner | Conditional DAG execution with bounded retry, compensation and failure policy over injected action handlers. | Bun/Node host | [Details + example](#forgezero-agent-deploy-plan-runner) |
+| @forgezero/agent/deploy-compiler | Explicit developer/CI compiler from forgezero.deploy.ts to canonical .fz/deploy.plan.json; never used to execute project TypeScript in production. | Bun/Node host | [Details + example](#forgezero-agent-deploy-compiler) |
 | @forgezero/agent/deploy-file | Read and validate a checked-out .fz deployment file without executing project input. | Bun/Node host | [Details + example](#forgezero-agent-deploy-file) |
 | @forgezero/agent/metal-bootstrap | Physical-metal bootstrap planning, application and status evidence. | Bun/Node host | [Details + example](#forgezero-agent-metal-bootstrap) |
 | @forgezero/agent/metal-provision | Validated confidential guest provisioning profiles and cloud-init rendering. | Bun/Node host | [Details + example](#forgezero-agent-metal-provision) |
@@ -75,6 +79,9 @@ Every row links to the detailed explanation and named-import/example area below.
 ## Commands
 
 bun add -g @forgezero/agent — Install the version-matched fz operator CLI and fz-agent daemon.
+fz deploy init — Create a typed forgezero.deploy.ts and its canonical inert execution plan.
+fz deploy compile — Compile and validate TypeScript deployment intent into .fz/deploy.plan.json.
+fz deploy check — Refuse stale plans, unsafe provider/action coordinates and unresolved deployment blockers.
 fz bootstrap platform remote prepare --bootstrap-config /secure/forgezero/development/dev-fz-n1-remote.json — Dry-plan one pinned operator-to-guest bootstrap; add --apply only after review.
 fz bootstrap platform --help — Inspect attended platform bootstrap inputs before applying them.
 fz bootstrap metal --help — Inspect the identity-only physical provisioner bootstrap.
@@ -83,6 +90,9 @@ fz status — Read installed service and bootstrap evidence.
 
 ```text
 bun add -g @forgezero/agent
+fz deploy init
+fz deploy compile
+fz deploy check
 fz bootstrap platform remote prepare --bootstrap-config /secure/forgezero/development/dev-fz-n1-remote.json
 fz bootstrap platform --help
 fz bootstrap metal --help
@@ -393,13 +403,111 @@ import type { AgentCredentialLocation, DeploymentCredentialBinding, DeploymentCr
 <a id="forgezero-agent-definition"></a>
 ## @forgezero/agent/definition
 
-Validated project deployment definition and workload profiles. Named value imports: DEPLOY_SCHEMA_URL, DefinitionError, PIPELINE_VERSION, parseDeployDefinition, phasePipeline, validateDeploymentService. Named type imports: DeployDefinition, DeployStep, DeploymentPortAllocation, DeploymentService, PipelineProfile. Import only the names used by this file.
+Legacy version 3 JSON deployment compatibility contract. Named value imports: DEPLOY_SCHEMA_URL, DefinitionError, PIPELINE_VERSION, parseDeployDefinition, phasePipeline, validateDeploymentService. Named type imports: DeployDefinition, DeployStep, DeploymentPortAllocation, DeploymentService, PipelineProfile. Import only the names used by this file.
 
 ```text
 import { DEPLOY_SCHEMA_URL, DefinitionError, PIPELINE_VERSION, parseDeployDefinition, phasePipeline, validateDeploymentService } from '@forgezero/agent/definition';
 import type { DeployDefinition, DeployStep, DeploymentPortAllocation, DeploymentService, PipelineProfile } from '@forgezero/agent/definition';
 ```
 
+<a id="forgezero-agent-deploy"></a>
+## @forgezero/agent/deploy
+
+Typed deployment authoring builders, built-in provider requirements and versioned action constructors. Named value imports: actions, application, conditions, credential, database, defineDeployment, input, providers, ref, requirement, stage, step, target, workflow. Named type imports: ApplicationComponent, ApplicationRuntime, ArangoDbProviderConfig, BunProviderConfig, CloudflaredProviderConfig, ComponentDefinition, Condition, ConditionOperand, CredentialDefinition, DatabaseComponent, DeploymentSource, DockerProviderConfig, HealthDefinition, InputDefinition, JsonObject, JsonPrimitive, JsonValue, NetworkDefinition, NginxProviderConfig, OpenSshProviderConfig, RequirementDefinition, ResolvableJsonObject, ResolvableJsonValue, ResourceDefinition, RetryDefinition, StageDefinition, StepScope, StorageMount, SystemdProviderConfig, TargetDefinition, UfwProviderConfig, ValueReference, WarpProviderConfig, WorkflowDefinition, WorkflowStepDefinition. Import only the names used by this file.
+
+```text
+import { actions, application, conditions, credential, database, defineDeployment } from '@forgezero/agent/deploy';
+import { input, providers, ref, requirement, stage, step } from '@forgezero/agent/deploy';
+import { target, workflow } from '@forgezero/agent/deploy';
+import type { ApplicationComponent, ApplicationRuntime, ArangoDbProviderConfig, BunProviderConfig, CloudflaredProviderConfig, ComponentDefinition } from '@forgezero/agent/deploy';
+import type { Condition, ConditionOperand, CredentialDefinition, DatabaseComponent, DeploymentSource, DockerProviderConfig } from '@forgezero/agent/deploy';
+import type { HealthDefinition, InputDefinition, JsonObject, JsonPrimitive, JsonValue, NetworkDefinition } from '@forgezero/agent/deploy';
+import type { NginxProviderConfig, OpenSshProviderConfig, RequirementDefinition, ResolvableJsonObject, ResolvableJsonValue, ResourceDefinition } from '@forgezero/agent/deploy';
+import type { RetryDefinition, StageDefinition, StepScope, StorageMount, SystemdProviderConfig, TargetDefinition } from '@forgezero/agent/deploy';
+import type { UfwProviderConfig, ValueReference, WarpProviderConfig, WorkflowDefinition, WorkflowStepDefinition } from '@forgezero/agent/deploy';
+```
+
+## @forgezero/agent/deploy — Author a typed native or Docker deployment
+
+TypeScript is authoring only. The checked-in canonical plan is what Agents validate and execute. Docker is additive: native Bun/ArangoDB remains available, while container applications must declare hard CPU, memory and PID limits, storage class, loopback ingress and a fixed health gate.
+
+```text
+import { actions, application, defineDeployment, providers, stage, target, workflow } from '@forgezero/agent/deploy';
+
+export default defineDeployment({
+  apiVersion: 'deploy.forgezero.net/v1', kind: 'Deployment',
+  metadata: { name: 'orders-api' },
+  spec: {
+    targets: { api: target.compute({ selector: { profiles: ['api'] }, cardinality: { minimum: 1, desired: 2, maximum: 16 } }) },
+    requirements: { docker: providers.docker.require(), nginx: providers.nginx.require() },
+    components: {
+      api: application({
+        target: 'api',
+        runtime: { kind: 'container', provider: 'forgezero.docker', requirement: 'docker', image: { source: { kind: 'build', context: '.', dockerfile: 'Dockerfile' } }, security: { privileged: false, noNewPrivileges: true, root: 'read-only', dropCapabilities: ['ALL'] } },
+        service: { protocol: 'http', port: 3000, health: { protocol: 'http', method: 'GET', path: '/health', expectedStatus: [200], timeoutMs: 2000 } },
+        resources: { cpu: { limit: 2 }, memory: { limitMiB: 2048, swap: 'disabled' }, pids: { limit: 256 } },
+        storage: [{ class: 'ephemeral', path: '/tmp', type: 'tmpfs', sizeMiB: 128 }],
+        network: { ingress: { exposure: 'loopback', stablePort: 3000 }, container: { mode: 'bridge', network: 'api' } },
+        rollout: { strategy: 'blue-green', proxy: 'nginx', automaticRollback: true }
+      })
+    },
+    workflows: { deploy: workflow({ stages: { prepare: stage({ strategy: { mode: 'sequential' }, steps: { software: actions.software.ensure({ requirements: ['docker', 'nginx'] }, { scope: { kind: 'each-target', target: 'api' } }) } }) } }) }
+  }
+});
+```
+
+<a id="forgezero-agent-deploy-plan"></a>
+## @forgezero/agent/deploy-plan
+
+Runtime validation, canonicalization and semantic digest for inert deployment plans. Named value imports: DEPLOY_PLAN_FORMAT, DEPLOY_PLAN_VERSION, DeploymentPlanError, canonicalJson, compileDeployment, deploymentPlanDigest, deploymentSourceDigest, parseDeploymentPlan. Named type imports: DeploymentPlan, PlannedStage, PlannedStep, PlannedWorkflow. Import only the names used by this file.
+
+```text
+import { DEPLOY_PLAN_FORMAT, DEPLOY_PLAN_VERSION, DeploymentPlanError, canonicalJson, compileDeployment, deploymentPlanDigest } from '@forgezero/agent/deploy-plan';
+import { deploymentSourceDigest, parseDeploymentPlan } from '@forgezero/agent/deploy-plan';
+import type { DeploymentPlan, PlannedStage, PlannedStep, PlannedWorkflow } from '@forgezero/agent/deploy-plan';
+```
+
+<a id="forgezero-agent-deploy-plan-runner"></a>
+## @forgezero/agent/deploy-plan-runner
+
+Conditional DAG execution with bounded retry, compensation and failure policy over injected action handlers. Named value imports: DeploymentActionError, evaluateCondition, runDeploymentPlan. Named type imports: ActionContext, ActionExecutionResult, ActionFailureKind, ActionHandler, PlanRunResult, PlanStepStatus, RunDeploymentPlanOptions, StepExecutionRecord. Import only the names used by this file.
+
+```text
+import { DeploymentActionError, evaluateCondition, runDeploymentPlan } from '@forgezero/agent/deploy-plan-runner';
+import type { ActionContext, ActionExecutionResult, ActionFailureKind, ActionHandler, PlanRunResult, PlanStepStatus } from '@forgezero/agent/deploy-plan-runner';
+import type { RunDeploymentPlanOptions, StepExecutionRecord } from '@forgezero/agent/deploy-plan-runner';
+```
+
+## @forgezero/agent/deploy-plan-runner — Extend the plan with a namespaced action
+
+Public projects can define a versioned action coordinate and install an exact handler. Built-in forgezero.* coordinates stay closed; unknown built-ins fail validation.
+
+```text
+import { actions } from '@forgezero/agent/deploy';
+import { runDeploymentPlan } from '@forgezero/agent/deploy-plan-runner';
+
+const notify = actions.extension('example.notifications/publish@1', { channel: 'deployments' }, {
+  scope: { kind: 'release-executor' },
+  retry: { attempts: 3, backoff: { kind: 'exponential', initialMs: 250, maximumMs: 5000 }, retryOn: ['network'] }
+});
+
+await runDeploymentPlan({
+  plan, workflow: 'deploy', inputs: {},
+  actions: { 'example.notifications/publish@1': async ({ resolved }) => ({ changed: true, evidence: resolved }) }
+});
+```
+
+<a id="forgezero-agent-deploy-compiler"></a>
+## @forgezero/agent/deploy-compiler
+
+Explicit developer/CI compiler from forgezero.deploy.ts to canonical .fz/deploy.plan.json; never used to execute project TypeScript in production. Named value imports: DEPLOY_PLAN_FILE, DEPLOY_SOURCE_FILE, compileDeploymentProject, defaultTypeScriptDeployment, initializeTypeScriptDeployment, inspectCompiledDeployment, loadDeploymentSource. Named type imports: DeploymentCompilation. Import only the names used by this file.
+
+```text
+import { DEPLOY_PLAN_FILE, DEPLOY_SOURCE_FILE, compileDeploymentProject, defaultTypeScriptDeployment, initializeTypeScriptDeployment, inspectCompiledDeployment } from '@forgezero/agent/deploy-compiler';
+import { loadDeploymentSource } from '@forgezero/agent/deploy-compiler';
+import type { DeploymentCompilation } from '@forgezero/agent/deploy-compiler';
+```
+
 <a id="forgezero-agent-deploy-file"></a>
 ## @forgezero/agent/deploy-file
 
@@ -414,11 +522,11 @@ import type { DeployFileSummary, InitializedDeployFile } from '@forgezero/agent/
 <a id="forgezero-agent-metal-bootstrap"></a>
 ## @forgezero/agent/metal-bootstrap
 
-Physical-metal bootstrap planning, application and status evidence. Named value imports: METAL_BOOTSTRAP_STATE_PATH, MetalBootstrapError, applyMetalBootstrap, metalBootstrapStatus, planMetalBootstrap, readMetalBootstrapConfig, renderMetalUnits, validateMetalBootstrapConfig, validateOwnerOnlyPath. Named type imports: MetalBootstrapApplyOptions, MetalBootstrapConfig, MetalBootstrapExec, MetalBootstrapPlan, MetalBootstrapResult, MetalBootstrapStatus. Import only the names used by this file.
+Physical-metal bootstrap planning, application and status evidence. Named value imports: METAL_BOOTSTRAP_STATE_PATH, MetalBootstrapError, applyMetalBootstrap, metalBootstrapStatus, normalizeMetalPublicIdentity, planMetalBootstrap, readMetalBootstrapConfig, renderMetalUnits, validateMetalBootstrapConfig, validateOwnerOnlyPath. Named type imports: MetalBootstrapApplyOptions, MetalBootstrapConfig, MetalBootstrapExec, MetalBootstrapPlan, MetalBootstrapResult, MetalBootstrapStatus. Import only the names used by this file.
 
 ```text
-import { METAL_BOOTSTRAP_STATE_PATH, MetalBootstrapError, applyMetalBootstrap, metalBootstrapStatus, planMetalBootstrap, readMetalBootstrapConfig } from '@forgezero/agent/metal-bootstrap';
-import { renderMetalUnits, validateMetalBootstrapConfig, validateOwnerOnlyPath } from '@forgezero/agent/metal-bootstrap';
+import { METAL_BOOTSTRAP_STATE_PATH, MetalBootstrapError, applyMetalBootstrap, metalBootstrapStatus, normalizeMetalPublicIdentity, planMetalBootstrap } from '@forgezero/agent/metal-bootstrap';
+import { readMetalBootstrapConfig, renderMetalUnits, validateMetalBootstrapConfig, validateOwnerOnlyPath } from '@forgezero/agent/metal-bootstrap';
 import type { MetalBootstrapApplyOptions, MetalBootstrapConfig, MetalBootstrapExec, MetalBootstrapPlan, MetalBootstrapResult, MetalBootstrapStatus } from '@forgezero/agent/metal-bootstrap';
 ```
 
@@ -491,11 +599,11 @@ if (!validate(deploymentDefinition)) throw new Error(JSON.stringify(validate.err
 <a id="forgezero-agent-software"></a>
 ## @forgezero/agent/software
 
-Exact managed-software inventory, requirement and evidence contracts. Named value imports: BUN_RELEASE_SHA256, OS_CATALOG, PINNED_BUN_VERSION, SOFTWARE_CATALOG, ensureSoftwareRequirements, executeSoftwareOperation, observeSoftwareHost, validateSoftwareRequirements. Named type imports: CatalogStatus, DeploymentChannel, OsCatalogEntry, SoftwareCatalogEntry, SoftwareCommandResult, SoftwareExec, SoftwareId, SoftwareObservation, SoftwareOperation, SoftwareRequirement. Import only the names used by this file.
+Exact managed-software inventory, requirement and evidence contracts. Named value imports: BUN_RELEASE_SHA256, OS_CATALOG, PINNED_BUN_VERSION, SOFTWARE_CATALOG, ensureSoftwareRequirements, executeSoftwareOperation, observeSoftwareHost, runSoftwareCommand, softwareSpawnFailure, validateSoftwareRequirements. Named type imports: CatalogStatus, DeploymentChannel, OsCatalogEntry, SoftwareCatalogEntry, SoftwareCommandResult, SoftwareExec, SoftwareId, SoftwareObservation, SoftwareOperation, SoftwareRequirement. Import only the names used by this file.
 
 ```text
 import { BUN_RELEASE_SHA256, OS_CATALOG, PINNED_BUN_VERSION, SOFTWARE_CATALOG, ensureSoftwareRequirements, executeSoftwareOperation } from '@forgezero/agent/software';
-import { observeSoftwareHost, validateSoftwareRequirements } from '@forgezero/agent/software';
+import { observeSoftwareHost, runSoftwareCommand, softwareSpawnFailure, validateSoftwareRequirements } from '@forgezero/agent/software';
 import type { CatalogStatus, DeploymentChannel, OsCatalogEntry, SoftwareCatalogEntry, SoftwareCommandResult, SoftwareExec } from '@forgezero/agent/software';
 import type { SoftwareId, SoftwareObservation, SoftwareOperation, SoftwareRequirement } from '@forgezero/agent/software';
 ```
@@ -503,10 +611,11 @@ import type { SoftwareId, SoftwareObservation, SoftwareOperation, SoftwareRequir
 <a id="forgezero-agent-software-helper"></a>
 ## @forgezero/agent/software-helper
 
-Root-owned fixed installation/update boundary for declared software. Named value imports: DEFAULT_SOFTWARE_HELPER_SOCKET, SOFTWARE_HELPER_GROUP, SOFTWARE_HELPER_UNIT_PATH, requestServiceActivation, requestSoftware, startSoftwareHelper. Named type imports: none. Import only the names used by this file.
+Root-owned fixed installation/update boundary for declared software. Named value imports: DEFAULT_SOFTWARE_HELPER_SOCKET, SOFTWARE_HELPER_GROUP, SOFTWARE_HELPER_UNIT_PATH, requestContainerActivation, requestContainerBuild, requestServiceActivation, requestSoftware, startSoftwareHelper. Named type imports: none. Import only the names used by this file.
 
 ```text
-import { DEFAULT_SOFTWARE_HELPER_SOCKET, SOFTWARE_HELPER_GROUP, SOFTWARE_HELPER_UNIT_PATH, requestServiceActivation, requestSoftware, startSoftwareHelper } from '@forgezero/agent/software-helper';
+import { DEFAULT_SOFTWARE_HELPER_SOCKET, SOFTWARE_HELPER_GROUP, SOFTWARE_HELPER_UNIT_PATH, requestContainerActivation, requestContainerBuild, requestServiceActivation } from '@forgezero/agent/software-helper';
+import { requestSoftware, startSoftwareHelper } from '@forgezero/agent/software-helper';
 ```
 
 <a id="forgezero-agent-ubuntu"></a>

package/dist/agent-heartbeat.js

@@ -749,7 +749,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.53";
+var VERSION3 = "0.1.55";
 
 // src/agent-heartbeat.ts
 var unquote = (value) => value.replace(/^['"]|['"]$/g, "");

package/dist/bootstrap.js

@@ -1180,15 +1180,15 @@ async function finalizeCloudflareBootstrapAcceptance(request, fetcher = fetch) {
 import { createHash, createHmac, randomBytes as randomBytes3 } from "crypto";
 import {
   chmodSync as chmodSync2,
-  existsSync as existsSync3,
+  existsSync as existsSync4,
   lstatSync as lstatSync2,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync3,
-  renameSync as renameSync3,
-  rmSync as rmSync3,
-  writeFileSync as writeFileSync3
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync4,
+  renameSync as renameSync4,
+  rmSync as rmSync4,
+  writeFileSync as writeFileSync4
 } from "fs";
-import { dirname as dirname4 } from "path";
+import { dirname as dirname5 } from "path";
 import { fileURLToPath } from "url";
 
 // src/agent-update-helper.ts
@@ -1207,11 +1207,19 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.53";
+var VERSION = "0.1.55";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
 var BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f";
+var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
+  "data-root": "/var/lib/docker",
+  "storage-driver": "overlay2",
+  "live-restore": true,
+  "log-driver": "local",
+  "log-opts": { "max-size": "10m", "max-file": "3" }
+}, null, 2)}
+`;
 
 // src/service-supervisor.ts
 import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "fs";
@@ -1273,6 +1281,39 @@ var defaultHost = {
   now: Date.now
 };
 
+// src/container-supervisor.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync as readdirSync2, realpathSync as realpathSync2, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname3, resolve as resolve3, sep as sep2 } from "path";
+var defaultHost2 = {
+  realpath: realpathSync2,
+  exists: existsSync2,
+  read: (path) => readFileSync2(path, "utf8"),
+  write(path, content, mode) {
+    mkdirSync2(dirname3(path), { recursive: true, mode: 493 });
+    const next = `${path}.next`;
+    writeFileSync2(next, content, { mode });
+    renameSync2(next, path);
+  },
+  remove: (path) => rmSync2(path, { force: true }),
+  list: (path) => existsSync2(path) ? readdirSync2(path) : [],
+  mkdir: (path, mode) => mkdirSync2(path, { recursive: true, mode }),
+  async exec(argv) {
+    const child = Bun.spawn([...argv], { stdout: "pipe", stderr: "pipe", env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C" } });
+    const [stdout, stderr, exitCode] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
+    return { exitCode, output: `${stdout}${stderr}` };
+  },
+  async health(port, path, timeoutMs, method, expectedStatus) {
+    try {
+      const response = await fetch(`http://127.0.0.1:${port}${path}`, { method, redirect: "manual", signal: AbortSignal.timeout(timeoutMs) });
+      return expectedStatus.includes(response.status);
+    } catch {
+      return false;
+    }
+  },
+  sleep: (ms) => Bun.sleep(ms),
+  now: Date.now
+};
+
 // src/software-helper.ts
 var DEFAULT_SOFTWARE_HELPER_SOCKET = "/run/forgezero-software/helper.sock";
 var SOFTWARE_HELPER_GROUP = "forgezero-software";
@@ -2255,17 +2296,17 @@ import { randomBytes as randomBytes2 } from "crypto";
 import {
   chmodSync,
   copyFileSync,
-  existsSync as existsSync2,
+  existsSync as existsSync3,
   lstatSync,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync2,
-  realpathSync as realpathSync2,
-  renameSync as renameSync2,
-  rmSync as rmSync2,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync3,
+  realpathSync as realpathSync3,
+  renameSync as renameSync3,
+  rmSync as rmSync3,
   symlinkSync,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync3
 } from "fs";
-import { dirname as dirname3 } from "path";
+import { dirname as dirname4 } from "path";
 async function readCapabilities(run) {
   const answers = {};
   const checks = Object.entries(CAPABILITY_CHECKS);
@@ -2324,28 +2365,28 @@ var runProvisionOperation = async (operation) => {
   }
   if (operation.kind === "install-runtime") {
     const release = `/opt/forgezero/agent/versions/${operation.version}`;
-    mkdirSync2(`${release}/dist`, { recursive: true, mode: 493 });
-    mkdirSync2(dirname3(operation.binary), { recursive: true, mode: 493 });
+    mkdirSync3(`${release}/dist`, { recursive: true, mode: 493 });
+    mkdirSync3(dirname4(operation.binary), { recursive: true, mode: 493 });
     copyFileSync(operation.source, `${release}/dist/fz-agent.js`);
     chmodSync(`${release}/dist/fz-agent.js`, 493);
-    const gitSshSource = `${dirname3(operation.source)}/fz-git-ssh.js`;
-    if (!existsSync2(gitSshSource))
+    const gitSshSource = `${dirname4(operation.source)}/fz-git-ssh.js`;
+    if (!existsSync3(gitSshSource))
       return { stdout: "packaged fz-git-ssh.js is missing", exitCode: 1 };
     copyFileSync(gitSshSource, `${release}/dist/fz-git-ssh.js`);
     chmodSync(`${release}/dist/fz-git-ssh.js`, 493);
     const pending = "/opt/forgezero/agent/current.next";
-    rmSync2(pending, { force: true });
+    rmSync3(pending, { force: true });
     symlinkSync(`versions/${operation.version}`, pending);
-    renameSync2(pending, "/opt/forgezero/agent/current");
-    rmSync2(operation.binary, { force: true });
+    renameSync3(pending, "/opt/forgezero/agent/current");
+    rmSync3(operation.binary, { force: true });
     symlinkSync("/opt/forgezero/agent/current/dist/fz-agent.js", operation.binary);
     const gitSshBinary = "/usr/local/lib/forgezero/agent/fz-git-ssh";
-    rmSync2(gitSshBinary, { force: true });
+    rmSync3(gitSshBinary, { force: true });
     symlinkSync("/opt/forgezero/agent/current/dist/fz-git-ssh.js", gitSshBinary);
     return { stdout: "", exitCode: 0 };
   }
   if (operation.kind === "ensure-seed") {
-    if (existsSync2(operation.credential) && lstatSync(operation.credential).size > 0)
+    if (existsSync3(operation.credential) && lstatSync(operation.credential).size > 0)
       return { stdout: "", exitCode: 0 };
     const seed = randomBytes2(32).toString("base64url");
     const result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=agent-seed", "-", operation.credential], seed);
@@ -2357,9 +2398,9 @@ var runProvisionOperation = async (operation) => {
     const key = "/run/forgezero-git-deploy-key";
     const publicKey = `${key}.pub`;
     try {
-      if (!existsSync2(operation.credential) || lstatSync(operation.credential).size < 1) {
-        rmSync2(key, { force: true });
-        rmSync2(publicKey, { force: true });
+      if (!existsSync3(operation.credential) || lstatSync(operation.credential).size < 1) {
+        rmSync3(key, { force: true });
+        rmSync3(publicKey, { force: true });
         let result = await fixed(["/usr/bin/ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-C", "forgezero-compute", "-f", key]);
         if (result.exitCode !== 0)
           return result;
@@ -2368,8 +2409,8 @@ var runProvisionOperation = async (operation) => {
           return result;
         chmodSync(operation.credential, 256);
       }
-      if (!existsSync2(operation.publicKey) || lstatSync(operation.publicKey).size < 1) {
-        if (!existsSync2(key)) {
+      if (!existsSync3(operation.publicKey) || lstatSync(operation.publicKey).size < 1) {
+        if (!existsSync3(key)) {
           const decrypted = await fixed(["/usr/bin/systemd-creds", "decrypt", "--name=git-deploy-key", operation.credential, key]);
           if (decrypted.exitCode !== 0)
             return decrypted;
@@ -2377,25 +2418,25 @@ var runProvisionOperation = async (operation) => {
         const derived = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
         if (derived.exitCode !== 0)
           return derived;
-        writeFileSync2(operation.publicKey, `${derived.stdout.trim()} forgezero-compute
+        writeFileSync3(operation.publicKey, `${derived.stdout.trim()} forgezero-compute
 `, { mode: 292 });
       }
       return { stdout: "", exitCode: 0 };
     } finally {
-      rmSync2(key, { force: true });
-      rmSync2(publicKey, { force: true });
+      rmSync3(key, { force: true });
+      rmSync3(publicKey, { force: true });
     }
   }
   if (operation.kind === "ensure-bootstrap-ssh-identity") {
     const key = "/run/forgezero-bootstrap-ssh-key";
     const generatedPublicKey = `${key}.pub`;
     try {
-      if (!existsSync2(operation.credential) || lstatSync(operation.credential).size < 1) {
-        rmSync2(key, { force: true });
-        rmSync2(generatedPublicKey, { force: true });
+      if (!existsSync3(operation.credential) || lstatSync(operation.credential).size < 1) {
+        rmSync3(key, { force: true });
+        rmSync3(generatedPublicKey, { force: true });
         let result;
         if (operation.source) {
-          const source = existsSync2(operation.source) ? lstatSync(operation.source) : undefined;
+          const source = existsSync3(operation.source) ? lstatSync(operation.source) : undefined;
           if (!source?.isFile() || source.isSymbolicLink() || source.uid !== 0 || source.nlink !== 1 || (source.mode & 63) !== 0 || source.size < 32 || source.size > 16 * 1024) {
             return { stdout: "bootstrap SSH private-key source is missing or unsafe", exitCode: 1 };
           }
@@ -2415,8 +2456,8 @@ var runProvisionOperation = async (operation) => {
           return result;
         chmodSync(operation.credential, 256);
       }
-      if (!existsSync2(operation.publicKey) || lstatSync(operation.publicKey).size < 1) {
-        if (!existsSync2(key)) {
+      if (!existsSync3(operation.publicKey) || lstatSync(operation.publicKey).size < 1) {
+        if (!existsSync3(key)) {
           const decrypted = await fixed(["/usr/bin/systemd-creds", "decrypt", "--name=bootstrap-ssh-key", operation.credential, key]);
           if (decrypted.exitCode !== 0)
             return decrypted;
@@ -2426,28 +2467,28 @@ var runProvisionOperation = async (operation) => {
         if (derived.exitCode !== 0 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}\s*$/.test(derived.stdout)) {
           return { stdout: "bootstrap SSH public key derivation failed", exitCode: 1 };
         }
-        mkdirSync2(dirname3(operation.publicKey), { recursive: true, mode: 493 });
-        writeFileSync2(operation.publicKey, `${derived.stdout.trim()} forgezero-bootstrap-runner
+        mkdirSync3(dirname4(operation.publicKey), { recursive: true, mode: 493 });
+        writeFileSync3(operation.publicKey, `${derived.stdout.trim()} forgezero-bootstrap-runner
 `, { mode: 292 });
         chmodSync(operation.publicKey, 292);
       }
       if (operation.source)
-        rmSync2(operation.source, { force: true });
+        rmSync3(operation.source, { force: true });
       return { stdout: "", exitCode: 0 };
     } finally {
-      rmSync2(key, { force: true });
-      rmSync2(generatedPublicKey, { force: true });
+      rmSync3(key, { force: true });
+      rmSync3(generatedPublicKey, { force: true });
     }
   }
   if (operation.kind === "ensure-enrolment") {
-    if (existsSync2(operation.state) && lstatSync(operation.state).size > 0 || existsSync2(operation.credential) && lstatSync(operation.credential).size > 0)
+    if (existsSync3(operation.state) && lstatSync(operation.state).size > 0 || existsSync3(operation.credential) && lstatSync(operation.credential).size > 0)
       return { stdout: "", exitCode: 0 };
-    if (!existsSync2(operation.source))
+    if (!existsSync3(operation.source))
       return { stdout: "enrolment source is missing", exitCode: 1 };
     const result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=enrol-token", operation.source, operation.credential]);
     if (result.exitCode === 0) {
       chmodSync(operation.credential, 256);
-      rmSync2(operation.source, { force: true });
+      rmSync3(operation.source, { force: true });
     }
     return result;
   }
@@ -2462,7 +2503,7 @@ var runProvisionOperation = async (operation) => {
     return { stdout: `socket did not become ready: ${operation.path}`, exitCode: 1 };
   }
   if (operation.kind === "verify-file")
-    return existsSync2(operation.path) && lstatSync(operation.path).size > 0 ? { stdout: "", exitCode: 0 } : { stdout: "required file is empty", exitCode: 1 };
+    return existsSync3(operation.path) && lstatSync(operation.path).size > 0 ? { stdout: "", exitCode: 0 } : { stdout: "required file is empty", exitCode: 1 };
   if (operation.kind === "verify-egress") {
     const active = await fixed(["/usr/bin/systemctl", "is-active", "forgezero-agent-egress.service"]);
     if (active.exitCode !== 0)
@@ -2478,31 +2519,31 @@ var runProvisionOperation = async (operation) => {
   if (operation.kind === "verify-resolved-stub") {
     try {
       const expected = "/run/systemd/resolve/stub-resolv.conf";
-      return realpathSync2("/etc/resolv.conf") === expected && realpathSync2(expected) === expected ? { stdout: expected, exitCode: 0 } : { stdout: "resolver stub mismatch", exitCode: 1 };
+      return realpathSync3("/etc/resolv.conf") === expected && realpathSync3(expected) === expected ? { stdout: expected, exitCode: 0 } : { stdout: "resolver stub mismatch", exitCode: 1 };
     } catch {
       return { stdout: "resolver stub missing", exitCode: 1 };
     }
   }
   if (operation.kind === "install-warp") {
-    const os = readFileSync2("/etc/os-release", "utf8");
+    const os = readFileSync3("/etc/os-release", "utf8");
     if (!/^ID=ubuntu$/m.test(os) || !/^VERSION_ID="?26\.04"?$/m.test(os))
       return { stdout: "unsupported WARP host OS", exitCode: 1 };
     const response = await fetch("https://pkg.cloudflareclient.com/pubkey.gpg", { signal: AbortSignal.timeout(30000) });
     if (!response.ok)
       return { stdout: `WARP key HTTP ${response.status}`, exitCode: 1 };
-    mkdirSync2("/usr/share/keyrings", { recursive: true, mode: 493 });
-    mkdirSync2("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
-    mkdirSync2("/etc/systemd/system/warp-svc.service.d", { recursive: true, mode: 493 });
+    mkdirSync3("/usr/share/keyrings", { recursive: true, mode: 493 });
+    mkdirSync3("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
+    mkdirSync3("/etc/systemd/system/warp-svc.service.d", { recursive: true, mode: 493 });
     const key = "/run/cloudflare-warp-key.gpg";
-    writeFileSync2(key, new Uint8Array(await response.arrayBuffer()), { mode: 384 });
+    writeFileSync3(key, new Uint8Array(await response.arrayBuffer()), { mode: 384 });
     let result = await fixed(["/usr/bin/gpg", "--batch", "--yes", "--dearmor", "-o", "/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", key]);
-    rmSync2(key, { force: true });
+    rmSync3(key, { force: true });
     if (result.exitCode !== 0)
       return result;
     const codename = os.match(/^VERSION_CODENAME=(.+)$/m)?.[1]?.replace(/^"|"$/g, "");
     if (!codename)
       return { stdout: "Ubuntu codename missing", exitCode: 1 };
-    writeFileSync2("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ ${codename} main
+    writeFileSync3("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ ${codename} main
 `, { mode: 420 });
     result = await fixed(["/usr/bin/apt-get", "update", "-qq"]);
     return result.exitCode === 0 ? fixed(["/usr/bin/apt-get", "install", "-y", "cloudflare-warp"]) : result;
@@ -4175,7 +4216,7 @@ function readBootstrapConfig(path) {
   if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.uid !== (process.getuid?.() ?? metadata.uid) || metadata.nlink !== 1 || (metadata.mode & 63) !== 0 || metadata.size > 64 * 1024) {
     throw new Error("bootstrap config must be an owner-only regular file with one link and at most 64 KiB");
   }
-  return validateBootstrapConfig(strictBootstrapDocument(JSON.parse(readFileSync3(path, "utf8"))));
+  return validateBootstrapConfig(strictBootstrapDocument(JSON.parse(readFileSync4(path, "utf8"))));
 }
 function localBootstrapHost() {
   const execute = async (argv, options = {}) => {
@@ -4193,17 +4234,17 @@ function localBootstrapHost() {
   };
   return {
     uid: () => process.getuid?.() ?? -1,
-    exists: existsSync3,
-    read: (path) => readFileSync3(path, "utf8"),
+    exists: existsSync4,
+    read: (path) => readFileSync4(path, "utf8"),
     write(path, content, mode) {
-      mkdirSync3(dirname4(path), { recursive: true, mode: 493 });
+      mkdirSync4(dirname5(path), { recursive: true, mode: 493 });
       const temporary = `${path}.next.${process.pid}`;
-      writeFileSync3(temporary, content, { mode });
+      writeFileSync4(temporary, content, { mode });
       chmodSync2(temporary, mode);
-      renameSync3(temporary, path);
+      renameSync4(temporary, path);
     },
-    mkdir: (path, mode) => mkdirSync3(path, { recursive: true, mode }),
-    remove: (path) => rmSync3(path, { force: true }),
+    mkdir: (path, mode) => mkdirSync4(path, { recursive: true, mode }),
+    remove: (path) => rmSync4(path, { force: true }),
     inspect(path) {
       const value = lstatSync2(path);
       return { regular: value.isFile(), symbolic: value.isSymbolicLink(), uid: value.uid, mode: value.mode, links: value.nlink, size: value.size };
@@ -4227,7 +4268,7 @@ function localBootstrapHost() {
     async installAgent(config, enrolTokenSourcePath) {
       const capabilities = await readCapabilities(localRunner);
       const deployRoot = config.deployRoot ?? "/opt/forgezero";
-      const hasBinding = config.kind === "enrolled-compute" || Boolean(enrolTokenSourcePath) || existsSync3("/var/lib/forgezero/enrolment.json");
+      const hasBinding = config.kind === "enrolled-compute" || Boolean(enrolTokenSourcePath) || existsSync4("/var/lib/forgezero/enrolment.json");
       if (config.kind === "platform") {
         const lifecycle = config.database.role === "none" ? {
           apiUnits: ["forgezero@blue.service", "forgezero@green.service"],
@@ -4239,8 +4280,8 @@ function localBootstrapHost() {
           databaseHealthUrl: `http://${config.database.address}:8529/_api/version`,
           databasePorts: [8529]
         };
-        mkdirSync3(dirname4(LIFECYCLE_PROFILE), { recursive: true, mode: 493 });
-        writeFileSync3(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
+        mkdirSync4(dirname5(LIFECYCLE_PROFILE), { recursive: true, mode: 493 });
+        writeFileSync4(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
 `, { mode: 256 });
       }
       const plan = planInstall({
@@ -4281,8 +4322,8 @@ function localBootstrapHost() {
         } : {}
       });
       for (const unit of [{ path: plan.unitPath, unit: plan.unit }, ...plan.auxiliaryUnits]) {
-        mkdirSync3(dirname4(unit.path), { recursive: true, mode: 493 });
-        writeFileSync3(unit.path, unit.unit, { mode: 420 });
+        mkdirSync4(dirname5(unit.path), { recursive: true, mode: 493 });
+        writeFileSync4(unit.path, unit.unit, { mode: 420 });
       }
       await applyPlan(plan, localRunner);
       return plan;