@forgezero/agent 0.1.62 → 0.1.64

package/dist/cli/agent-install.d.ts

@@ -45,6 +45,8 @@ export interface InstallOptions {
     controlSocketPath?: string;
     repository?: string;
     branch?: string;
+    bootstrapBundlePath?: string;
+    bootstrapBundleManifestPath?: string;
     profile?: string;
     deployRoot?: string;
     publicApiUrl?: string;

package/dist/community-rehearsal-host.js

@@ -31,7 +31,8 @@ var SOFTWARE_CATALOG = [
   { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "cloudflare-warp", version: "2026.6.822.0-min", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+  { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
 ];
 var UBUNTU_2604_X64 = [
   { requirement: { id: "bun", version: "1.3.14" } },
@@ -41,7 +42,8 @@ var UBUNTU_2604_X64 = [
   { requirement: { id: "cloudflared", version: "2026.7.3" } },
   { requirement: { id: "cloudflare-warp", version: "2026.6.822.0-min" } },
   { requirement: { id: "ufw", version: "ubuntu-26.04" } },
-  { requirement: { id: "openssh-client", version: "ubuntu-26.04" } }
+  { requirement: { id: "openssh-client", version: "ubuntu-26.04" } },
+  { requirement: { id: "git", version: "ubuntu-26.04" } }
 ];
 var path = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 var DOCKER_DAEMON_PATH = "/etc/docker/daemon.json";
@@ -128,7 +130,7 @@ async function executeSoftwareOperation(operation) {
         const supported = observed && observed.some((part, index) => part > minimum[index] && observed.slice(0, index).every((prior, priorIndex) => prior === minimum[priorIndex])) || observed?.every((part, index) => part === minimum[index]);
         return { ...result, exitCode: result.exitCode === 0 && supported ? 0 : 1 };
       });
-    const binaries = software === "ufw" ? ["/usr/sbin/ufw"] : ["/usr/bin/ssh", "/usr/bin/scp", "/usr/bin/ssh-keyscan", "/usr/bin/ssh-keygen"];
+    const binaries = software === "ufw" ? ["/usr/sbin/ufw"] : software === "git" ? ["/usr/bin/git"] : ["/usr/bin/ssh", "/usr/bin/scp", "/usr/bin/ssh-keyscan", "/usr/bin/ssh-keygen"];
     try {
       binaries.forEach((binary) => accessSync(binary));
       return { exitCode: 0, output: "" };
@@ -136,7 +138,7 @@ async function executeSoftwareOperation(operation) {
       return { exitCode: 1, output: cause instanceof Error ? cause.message : String(cause) };
     }
   }
-  if (software === "docker" || software === "nginx" || software === "ufw" || software === "openssh-client") {
+  if (software === "docker" || software === "nginx" || software === "ufw" || software === "openssh-client" || software === "git") {
     const packageName = software === "openssh-client" ? "openssh-client" : software === "docker" ? "docker.io" : software;
     const installed = await aptInstall(packageName);
     if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")
@@ -236,7 +238,7 @@ function validateSoftwareRequirements(value, _options = {}) {
     if (Object.keys(row).some((key) => key !== "id" && key !== "version")) {
       throw new Error("software requirement contains an unknown field");
     }
-    if (!["bun", "docker", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
+    if (!["bun", "docker", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client", "git"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
       throw new Error("software requirement coordinate is invalid");
     }
     const requirement = { id: row.id, version: row.version };

package/dist/definition.js

@@ -31,7 +31,8 @@ var SOFTWARE_CATALOG = [
   { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "cloudflare-warp", version: "2026.6.822.0-min", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+  { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
 ];
 var UBUNTU_2604_X64 = [
   { requirement: { id: "bun", version: "1.3.14" } },
@@ -41,7 +42,8 @@ var UBUNTU_2604_X64 = [
   { requirement: { id: "cloudflared", version: "2026.7.3" } },
   { requirement: { id: "cloudflare-warp", version: "2026.6.822.0-min" } },
   { requirement: { id: "ufw", version: "ubuntu-26.04" } },
-  { requirement: { id: "openssh-client", version: "ubuntu-26.04" } }
+  { requirement: { id: "openssh-client", version: "ubuntu-26.04" } },
+  { requirement: { id: "git", version: "ubuntu-26.04" } }
 ];
 var path = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 var DOCKER_DAEMON_PATH = "/etc/docker/daemon.json";
@@ -128,7 +130,7 @@ async function executeSoftwareOperation(operation) {
         const supported = observed && observed.some((part, index) => part > minimum[index] && observed.slice(0, index).every((prior, priorIndex) => prior === minimum[priorIndex])) || observed?.every((part, index) => part === minimum[index]);
         return { ...result, exitCode: result.exitCode === 0 && supported ? 0 : 1 };
       });
-    const binaries = software === "ufw" ? ["/usr/sbin/ufw"] : ["/usr/bin/ssh", "/usr/bin/scp", "/usr/bin/ssh-keyscan", "/usr/bin/ssh-keygen"];
+    const binaries = software === "ufw" ? ["/usr/sbin/ufw"] : software === "git" ? ["/usr/bin/git"] : ["/usr/bin/ssh", "/usr/bin/scp", "/usr/bin/ssh-keyscan", "/usr/bin/ssh-keygen"];
     try {
       binaries.forEach((binary) => accessSync(binary));
       return { exitCode: 0, output: "" };
@@ -136,7 +138,7 @@ async function executeSoftwareOperation(operation) {
       return { exitCode: 1, output: cause instanceof Error ? cause.message : String(cause) };
     }
   }
-  if (software === "docker" || software === "nginx" || software === "ufw" || software === "openssh-client") {
+  if (software === "docker" || software === "nginx" || software === "ufw" || software === "openssh-client" || software === "git") {
     const packageName = software === "openssh-client" ? "openssh-client" : software === "docker" ? "docker.io" : software;
     const installed = await aptInstall(packageName);
     if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")
@@ -236,7 +238,7 @@ function validateSoftwareRequirements(value, _options = {}) {
     if (Object.keys(row).some((key) => key !== "id" && key !== "version")) {
       throw new Error("software requirement contains an unknown field");
     }
-    if (!["bun", "docker", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
+    if (!["bun", "docker", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client", "git"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
       throw new Error("software requirement coordinate is invalid");
     }
     const requirement = { id: row.id, version: row.version };

package/dist/deploy-file.js

@@ -31,7 +31,8 @@ var SOFTWARE_CATALOG = [
   { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "cloudflare-warp", version: "2026.6.822.0-min", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+  { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
 ];
 var UBUNTU_2604_X64 = [
   { requirement: { id: "bun", version: "1.3.14" } },
@@ -41,7 +42,8 @@ var UBUNTU_2604_X64 = [
   { requirement: { id: "cloudflared", version: "2026.7.3" } },
   { requirement: { id: "cloudflare-warp", version: "2026.6.822.0-min" } },
   { requirement: { id: "ufw", version: "ubuntu-26.04" } },
-  { requirement: { id: "openssh-client", version: "ubuntu-26.04" } }
+  { requirement: { id: "openssh-client", version: "ubuntu-26.04" } },
+  { requirement: { id: "git", version: "ubuntu-26.04" } }
 ];
 var path = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 var DOCKER_DAEMON_PATH = "/etc/docker/daemon.json";
@@ -128,7 +130,7 @@ async function executeSoftwareOperation(operation) {
         const supported = observed && observed.some((part, index) => part > minimum[index] && observed.slice(0, index).every((prior, priorIndex) => prior === minimum[priorIndex])) || observed?.every((part, index) => part === minimum[index]);
         return { ...result, exitCode: result.exitCode === 0 && supported ? 0 : 1 };
       });
-    const binaries = software === "ufw" ? ["/usr/sbin/ufw"] : ["/usr/bin/ssh", "/usr/bin/scp", "/usr/bin/ssh-keyscan", "/usr/bin/ssh-keygen"];
+    const binaries = software === "ufw" ? ["/usr/sbin/ufw"] : software === "git" ? ["/usr/bin/git"] : ["/usr/bin/ssh", "/usr/bin/scp", "/usr/bin/ssh-keyscan", "/usr/bin/ssh-keygen"];
     try {
       binaries.forEach((binary) => accessSync(binary));
       return { exitCode: 0, output: "" };
@@ -136,7 +138,7 @@ async function executeSoftwareOperation(operation) {
       return { exitCode: 1, output: cause instanceof Error ? cause.message : String(cause) };
     }
   }
-  if (software === "docker" || software === "nginx" || software === "ufw" || software === "openssh-client") {
+  if (software === "docker" || software === "nginx" || software === "ufw" || software === "openssh-client" || software === "git") {
     const packageName = software === "openssh-client" ? "openssh-client" : software === "docker" ? "docker.io" : software;
     const installed = await aptInstall(packageName);
     if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")
@@ -236,7 +238,7 @@ function validateSoftwareRequirements(value, _options = {}) {
     if (Object.keys(row).some((key) => key !== "id" && key !== "version")) {
       throw new Error("software requirement contains an unknown field");
     }
-    if (!["bun", "docker", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
+    if (!["bun", "docker", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client", "git"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
       throw new Error("software requirement coordinate is invalid");
     }
     const requirement = { id: row.id, version: row.version };

package/dist/deployment.d.ts

@@ -8,6 +8,7 @@ import { type RunResult } from './pipeline';
 import type { SecretCache } from './cache';
 import type { AttestationSource } from './socket';
 import { type CapacityCalibration, type CapacityCalibrationOptions } from './capacity-calibration';
+import { type BootstrapBundleManifest } from './bootstrap-bundle';
 export interface CommandInput {
     argv: readonly string[];
     cwd?: string;
@@ -33,6 +34,8 @@ export interface DeploymentResult {
     definitionDigest: string;
     definitionVersion: number;
     profile: string;
+    /** Resolved only from the validated plan and its bounded inputs at this revision. */
+    resolvedTargets?: readonly ResolvedDeploymentTarget[];
     release: string;
     ok: boolean;
     phases: readonly RunResult[];
@@ -43,6 +46,15 @@ export interface DeploymentResult {
         };
     };
 }
+export interface ResolvedDeploymentTarget {
+    name: string;
+    profiles: readonly string[];
+    confidentialCompute: 'required' | 'preferred' | 'disabled';
+    labels: Readonly<Record<string, string>>;
+    minimum: number;
+    desired: number;
+    maximum: number;
+}
 /**
  * How the credential-bearing agent may read one server-owned Git source.
  * Secret values never appear in a deployment claim or checked-in pipeline.
@@ -55,12 +67,27 @@ export type GitSourceAuth = {
     kind: 'vault-token';
     secret: string;
     username?: string;
+}
+/** One-claim credential delivered only inside the hybrid-sealed node response. */
+ | {
+    kind: 'ephemeral-token';
+    token: string;
+    expiresAtTs: number;
+    username?: string;
 };
 export interface DeploymentOptions {
     /** Queue key. The same deployment target is serial; different targets may run in parallel. */
     key: string;
     repository: string;
     branch: string;
+    /**
+     * Release-generation-one source copied by the attended operator. It is a
+     * local Git bundle, never a network credential or a persistent CI source.
+     */
+    bootstrapBundle?: {
+        path: string;
+        manifest: BootstrapBundleManifest;
+    };
     profile: string;
     root: string;
     publicApiUrl?: string;