@forgezero/agent 0.1.63 → 0.1.65

package/dist/fz-agent.js

@@ -7505,10 +7505,28 @@ function createDeploymentManager(options) {
       const inputValues = {};
       for (const [name, definition2] of Object.entries(plan.spec.inputs ?? {})) {
         const raw = options.environment?.[name];
-        if (raw === undefined)
+        if (raw === undefined) {
+          if (definition2.default !== undefined)
+            inputValues[name] = definition2.default;
           continue;
+        }
         inputValues[name] = definition2.type === "boolean" ? raw === "true" : definition2.type === "integer" || definition2.type === "number" ? Number(raw) : raw;
       }
+      const resolvedTargets = Object.entries(plan.spec.targets).filter(([, target]) => target.selector.profiles.includes(options.profile)).map(([name, target]) => {
+        const desired = typeof target.cardinality.desired === "number" ? target.cardinality.desired : target.cardinality.desired.$ref.startsWith("inputs.") ? inputValues[target.cardinality.desired.$ref.slice("inputs.".length)] : undefined;
+        if (!Number.isSafeInteger(desired) || Number(desired) < target.cardinality.minimum || Number(desired) > target.cardinality.maximum) {
+          throw new DeploymentError("PIPELINE_FAILED", `target ${name} desired cardinality did not resolve to a bounded integer`);
+        }
+        return {
+          name,
+          profiles: [...target.selector.profiles],
+          confidentialCompute: target.selector.confidentialCompute ?? "disabled",
+          labels: { ...target.selector.labels ?? {} },
+          minimum: target.cardinality.minimum,
+          desired: Number(desired),
+          maximum: target.cardinality.maximum
+        };
+      });
       const projectExec2 = options.projectExec ?? spawnExact;
       const materializePlanArgv = (argv2) => argv2.map((argument) => {
         if (argument === "${FZ_RELEASE}")
@@ -7668,11 +7686,12 @@ function createDeploymentManager(options) {
         branch: options.branch,
         revision: head,
         definitionDigest: plan.sourceDigest,
-        definitionVersion: plan.version,
+        definitionVersion: 2,
         profile: options.profile,
         release,
         ok: true,
-        phases: [phase]
+        phases: [phase],
+        resolvedTargets
       };
     }
     const definition = parseDeployDefinition(readDefinition(join2(release, ".fz", "deploy.json")));
@@ -7785,7 +7804,7 @@ function createDeploymentManager(options) {
       branch: options.branch,
       revision: head,
       definitionDigest,
-      definitionVersion: definition.version,
+      definitionVersion: 2,
       profile: options.profile,
       release,
       ok: true,
@@ -8071,6 +8090,11 @@ async function pullDeploymentOnce(options) {
     definitionDigest: result.definitionDigest,
     definitionVersion: result.definitionVersion,
     profile: result.profile,
+    ...result.resolvedTargets ? { resolvedTargets: result.resolvedTargets.map((target) => ({
+      ...target,
+      profiles: [...target.profiles],
+      labels: { ...target.labels }
+    })) } : {},
     ...result.capacity ? { capacity: {
       recommendedConcurrency: result.capacity.recommendedConcurrency,
       stopReason: result.capacity.stopReason,
@@ -8542,7 +8566,7 @@ function assertSupportedGuestImage(imageKey) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.63";
+var VERSION2 = "0.1.65";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {
@@ -14007,17 +14031,16 @@ function agentUnit(options) {
   if (Boolean(options.pullMigrations) !== Boolean(options.lifecycleProfilePath)) {
     throw new Error("migration pull and lifecycle profile must be supplied together");
   }
-  const bootstrapEnabled = Boolean(options.pullBootstrap && options.bootstrapSshCredentialPath && options.bootstrapSshPublicKeyPath && options.bootstrapTargetTelemetryEndpoint);
-  if ([
-    options.pullBootstrap,
-    options.bootstrapSshCredentialPath,
-    options.bootstrapSshPublicKeyPath,
-    options.bootstrapTargetTelemetryEndpoint
-  ].some(Boolean) && !bootstrapEnabled) {
-    throw new Error("bootstrap pull, SSH credential, public key and target telemetry endpoint must be supplied together");
+  const bootstrapIdentityEnabled = Boolean(options.bootstrapSshCredentialPath && options.bootstrapSshPublicKeyPath);
+  if (Boolean(options.bootstrapSshCredentialPath) !== Boolean(options.bootstrapSshPublicKeyPath)) {
+    throw new Error("bootstrap SSH credential and public key paths must be supplied together");
+  }
+  const bootstrapEnabled = Boolean(options.pullBootstrap);
+  if (bootstrapEnabled && (!bootstrapIdentityEnabled || !options.bootstrapTargetTelemetryEndpoint) || !bootstrapEnabled && options.bootstrapTargetTelemetryEndpoint) {
+    throw new Error("bootstrap pull, SSH identity and target telemetry endpoint must be supplied together");
   }
   const lifecycleHelperSocketPath = lifecycleEnabled ? systemdPath(options.lifecycleHelperSocketPath ?? LIFECYCLE_HELPER_SOCKET, "lifecycle helper socket") : undefined;
-  const bootstrapSshCredentialPath = bootstrapEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
+  const bootstrapSshCredentialPath = bootstrapIdentityEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
   const warpValues = [
     options.warpOrganization,
     options.warpClientIdCredentialPath,
@@ -14256,15 +14279,13 @@ function planProvision(options) {
   if (Boolean(options.pullMigrations) !== Boolean(options.lifecycleProfilePath)) {
     throw new Error("migration pull and lifecycle profile must be supplied together");
   }
-  const bootstrapEnabled = Boolean(options.pullBootstrap && options.bootstrapSshCredentialPath && options.bootstrapSshPublicKeyPath && options.bootstrapTargetTelemetryEndpoint);
-  if ([
-    options.pullBootstrap,
-    options.bootstrapSshCredentialPath,
-    options.bootstrapSshPublicKeyPath,
-    options.bootstrapSshSourcePath,
-    options.bootstrapTargetTelemetryEndpoint
-  ].some(Boolean) && !bootstrapEnabled) {
-    throw new Error("bootstrap pull, SSH credential, public key and target telemetry endpoint must be supplied together");
+  const bootstrapIdentityEnabled = Boolean(options.bootstrapSshCredentialPath && options.bootstrapSshPublicKeyPath);
+  if (Boolean(options.bootstrapSshCredentialPath) !== Boolean(options.bootstrapSshPublicKeyPath) || options.bootstrapSshSourcePath && !bootstrapIdentityEnabled) {
+    throw new Error("bootstrap SSH credential and public key paths must be supplied together");
+  }
+  const bootstrapEnabled = Boolean(options.pullBootstrap);
+  if (bootstrapEnabled && (!bootstrapIdentityEnabled || !options.bootstrapTargetTelemetryEndpoint) || !bootstrapEnabled && options.bootstrapTargetTelemetryEndpoint) {
+    throw new Error("bootstrap pull, SSH identity and target telemetry endpoint must be supplied together");
   }
   const warpValues = [
     options.warpOrganization,
@@ -14274,13 +14295,13 @@ function planProvision(options) {
   const warpEnabled = warpValues.every(Boolean);
   if (warpValues.some(Boolean) && !warpEnabled)
     throw new Error("WARP configuration must be supplied together");
-  const enrolmentEnabled = Boolean(options.enrolTokenCredentialPath && options.enrolStatePath);
-  if (Boolean(options.enrolTokenCredentialPath) !== Boolean(options.enrolStatePath) || options.enrolTokenSourcePath && !enrolmentEnabled) {
-    throw new Error("direct enrolment credential and state paths must be supplied together");
+  const enrolmentEnabled = Boolean(options.enrolTokenCredentialPath);
+  if (options.enrolTokenCredentialPath && !options.enrolStatePath || options.enrolTokenSourcePath && (!options.enrolTokenCredentialPath || !options.enrolStatePath)) {
+    throw new Error("direct enrolment credential requires its durable state path");
   }
   const enrolTokenSourcePath = options.enrolTokenSourcePath ? systemdPath(options.enrolTokenSourcePath, "enrolment source") : undefined;
   const enrolTokenCredentialPath = enrolmentEnabled ? systemdPath(options.enrolTokenCredentialPath, "enrolment credential") : undefined;
-  const enrolStatePath = enrolmentEnabled ? systemdPath(options.enrolStatePath, "enrolment state") : undefined;
+  const enrolStatePath = options.enrolStatePath ? systemdPath(options.enrolStatePath, "enrolment state") : undefined;
   const enrolStateDir = enrolStatePath?.replace(/\/[^/]+$/, "");
   const sourceBinPath = options.sourceBinPath ? systemdPath(options.sourceBinPath, "agent source binary") : undefined;
   const binPath = options.binPath ? systemdPath(options.binPath, "agent binary") : undefined;
@@ -14292,8 +14313,8 @@ function planProvision(options) {
   const gitPublicKeyDir = gitPublicKeyPath?.replace(/\/[^/]+$/, "");
   const lifecycleProfilePath = lifecycleEnabled ? systemdPath(options.lifecycleProfilePath, "lifecycle profile") : undefined;
   const lifecycleHelperSocketPath = lifecycleEnabled ? systemdPath(options.lifecycleHelperSocketPath ?? LIFECYCLE_HELPER_SOCKET, "lifecycle helper socket") : undefined;
-  const bootstrapSshCredentialPath = bootstrapEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
-  const bootstrapSshPublicKeyPath = bootstrapEnabled ? systemdPath(options.bootstrapSshPublicKeyPath, "bootstrap SSH public key") : undefined;
+  const bootstrapSshCredentialPath = bootstrapIdentityEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
+  const bootstrapSshPublicKeyPath = bootstrapIdentityEnabled ? systemdPath(options.bootstrapSshPublicKeyPath, "bootstrap SSH public key") : undefined;
   const bootstrapSshSourcePath = options.bootstrapSshSourcePath ? systemdPath(options.bootstrapSshSourcePath, "bootstrap SSH private-key source") : undefined;
   const bootstrapSshPublicKeyDir = bootstrapSshPublicKeyPath?.replace(/\/[^/]+$/, "");
   const warpClientIdCredentialPath = warpEnabled ? systemdPath(options.warpClientIdCredentialPath, "WARP client-id credential") : undefined;
@@ -14393,7 +14414,7 @@ function planProvision(options) {
         step2("Git deploy identity directory", { kind: "directories", directories: [{ path: gitPublicKeyDir, mode: 493, owner: "root", group: "root" }] }),
         step2("unique encrypted Git deploy identity", { kind: "ensure-git-identity", credential: gitCredentialPath, publicKey: gitPublicKeyPath })
       ] : [],
-      ...bootstrapEnabled ? [
+      ...bootstrapIdentityEnabled ? [
         step2("bootstrap SSH public identity directory", { kind: "directories", directories: [
           { path: bootstrapSshPublicKeyDir, mode: 493, owner: "root", group: "root" }
         ] }),
@@ -14429,6 +14450,10 @@ function planProvision(options) {
         { argv: ["/usr/bin/rm", "-f", "/etc/systemd/system/forgezero-deploy-runner.socket"] },
         { argv: ["/usr/bin/systemctl", "daemon-reload"] }
       ] })] : [],
+      ...enrolStatePath && !enrolmentEnabled ? [step2("retire consumed enrolment unit", { kind: "commands", commands: [
+        { argv: ["/usr/bin/systemctl", "disable", "--now", "forgezero-agent-enrol.service"], acceptedExitCodes: [0, 1, 5] },
+        { argv: ["/usr/bin/rm", "-f", ENROLMENT_UNIT_PATH] }
+      ] })] : [],
       step2("enable and converge services", { kind: "commands", commands: [
         { argv: ["/usr/bin/systemctl", "enable", ...enabledUnits] },
         { argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-agent.service"], acceptedExitCodes: [0, 1] },
@@ -14945,6 +14970,65 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     problems.push("durable Agent enrolment state is missing");
   return { initialized: problems.length === 0, kind: state.kind, profile: state.profile, services, problems };
 }
+function planBootstrapAgentInstall(config, phase, context) {
+  const { capabilities, hasBinding, hasEnrolCredential, initialBundle } = context;
+  if (phase === "bootstrap") {
+    if (config.kind !== "platform" || hasBinding || !initialBundle) {
+      throw new Error("release-one Agent install requires an unbound platform host and verified bootstrap bundle");
+    }
+  } else if (phase === "enrol") {
+    if (hasBinding || !hasEnrolCredential) {
+      throw new Error("Agent enrolment requires one unbound host and its sealed one-use credential");
+    }
+  } else if (!hasBinding) {
+    throw new Error("bound Agent convergence requires durable enrolment state");
+  }
+  const bound = phase === "bound";
+  const enrolling = phase === "enrol";
+  const authenticated = enrolling || bound;
+  const bootstrapRunner = platformBootstrapRunner(config) || config.kind === "enrolled-compute" && Boolean(config.bootstrapRunner);
+  const options = {
+    capabilities,
+    socketPath: DEFAULT_SOCKET,
+    seedPath: "/var/lib/forgezero/node.seed",
+    controlSocketPath: CONTROL_SOCKET,
+    repository: phase === "bootstrap" ? initialBundle.path : bound && config.kind === "enrolled-compute" ? config.repository : undefined,
+    branch: phase === "bootstrap" ? initialBundle.manifest.branch : bound && config.kind === "enrolled-compute" ? config.branch : undefined,
+    bootstrapBundlePath: phase === "bootstrap" ? initialBundle.path : undefined,
+    bootstrapBundleManifestPath: phase === "bootstrap" ? initialBundle.manifestPath : undefined,
+    profile: config.profile,
+    deployRoot: config.deployRoot ?? "/opt/forgezero",
+    deploymentCredentials: config.deploymentCredentials,
+    publicApiUrl: config.apiUrl,
+    gitCredentialPath: authenticated && config.kind === "enrolled-compute" && config.gitDeployKey ? "/etc/forgezero/creds/git-deploy-key.cred" : undefined,
+    gitPublicKeyPath: authenticated && config.kind === "enrolled-compute" && config.gitDeployKey ? "/etc/forgezero/git/deploy.pub" : undefined,
+    generateGitIdentity: authenticated && config.kind === "enrolled-compute" && config.gitDeployKey === true,
+    pullDeployments: bound,
+    pullMigrations: bound && config.kind === "platform",
+    pullBootstrap: bound && bootstrapRunner,
+    bootstrapSshCredentialPath: authenticated && bootstrapRunner ? BOOTSTRAP_SSH_CREDENTIAL : undefined,
+    bootstrapSshSourcePath: enrolling && config.kind === "enrolled-compute" ? config.bootstrapRunner?.sshPrivateKeyFile : undefined,
+    bootstrapSshPublicKeyPath: authenticated && bootstrapRunner ? BOOTSTRAP_SSH_PUBLIC_KEY : undefined,
+    bootstrapTargetTelemetryEndpoint: bound && bootstrapRunner ? platformBootstrapRunner(config) ? config.telemetryEndpoint : config.kind === "enrolled-compute" ? config.bootstrapRunner?.targetTelemetryEndpoint : undefined : undefined,
+    lifecycleProfilePath: bound && config.kind === "platform" ? LIFECYCLE_PROFILE : undefined,
+    enforceEgress: true,
+    nodeHostname: config.nodeHostname,
+    telemetryEndpoint: config.telemetryEndpoint,
+    binPath: "/usr/local/lib/forgezero/agent/fz-agent",
+    sourceBinPath: PACKAGED_AGENT_BIN,
+    ...enrolling ? {
+      enrolTokenCredentialPath: ENROL_CREDENTIAL,
+      enrolStatePath: "/var/lib/forgezero/enrolment.json"
+    } : bound ? { enrolStatePath: "/var/lib/forgezero/enrolment.json" } : {},
+    ...authenticated ? {
+      apiUrl: config.apiUrl,
+      project: config.kind === "enrolled-compute" ? config.realm : "platform",
+      environment: config.kind === "enrolled-compute" ? undefined : config.environment,
+      nodeLabel: config.kind === "enrolled-compute" ? config.nodeHostname : config.computeReference
+    } : {}
+  };
+  return planInstall(options);
+}
 function localBootstrapHost() {
   const execute3 = async (argv2, options = {}) => {
     const child = Bun.spawn([...argv2], { stdin: options.stdin === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
@@ -14992,10 +15076,10 @@ function localBootstrapHost() {
         throw new Error(`Agent software requirements failed: ${result.output.trim()}`);
       return result;
     },
-    async installAgent(config) {
+    async installAgent(config, phase) {
       const capabilities = await readCapabilities(localRunner);
-      const deployRoot = config.deployRoot ?? "/opt/forgezero";
       const hasBinding = existsSync20("/var/lib/forgezero/enrolment.json");
+      const hasEnrolCredential = existsSync20(ENROL_CREDENTIAL);
       const initialBundle = config.kind === "platform" && !existsSync20(BOOTSTRAP_RELEASE_EVIDENCE) ? {
         path: config.bootstrapBundle.bundleFile,
         manifestPath: config.bootstrapBundle.manifestFile,
@@ -15016,45 +15100,11 @@ function localBootstrapHost() {
         writeFileSync15(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
 `, { mode: 256 });
       }
-      const plan = planInstall({
+      const plan = planBootstrapAgentInstall(config, phase, {
         capabilities,
-        socketPath: DEFAULT_SOCKET,
-        seedPath: "/var/lib/forgezero/node.seed",
-        controlSocketPath: "/run/forgezero/control.sock",
-        repository: initialBundle?.path ?? (config.kind === "enrolled-compute" ? config.repository : undefined),
-        branch: initialBundle?.manifest.branch ?? (config.kind === "enrolled-compute" ? config.branch : undefined),
-        bootstrapBundlePath: initialBundle?.path,
-        bootstrapBundleManifestPath: initialBundle?.manifestPath,
-        profile: config.kind === "platform" ? config.profile : config.profile,
-        deployRoot,
-        deploymentCredentials: config.deploymentCredentials,
-        publicApiUrl: config.apiUrl,
-        gitCredentialPath: config.kind === "enrolled-compute" && config.gitDeployKey ? "/etc/forgezero/creds/git-deploy-key.cred" : undefined,
-        gitPublicKeyPath: config.kind === "enrolled-compute" && config.gitDeployKey ? "/etc/forgezero/git/deploy.pub" : undefined,
-        generateGitIdentity: config.kind === "enrolled-compute" && config.gitDeployKey === true,
-        pullDeployments: hasBinding,
-        pullMigrations: config.kind === "platform" && hasBinding,
-        pullBootstrap: platformBootstrapRunner(config) || config.kind === "enrolled-compute" && Boolean(config.bootstrapRunner),
-        bootstrapSshCredentialPath: platformBootstrapRunner(config) || config.kind === "enrolled-compute" && config.bootstrapRunner ? BOOTSTRAP_SSH_CREDENTIAL : undefined,
-        bootstrapSshSourcePath: config.kind === "enrolled-compute" ? config.bootstrapRunner?.sshPrivateKeyFile : undefined,
-        bootstrapSshPublicKeyPath: platformBootstrapRunner(config) || config.kind === "enrolled-compute" && config.bootstrapRunner ? BOOTSTRAP_SSH_PUBLIC_KEY : undefined,
-        bootstrapTargetTelemetryEndpoint: platformBootstrapRunner(config) ? config.telemetryEndpoint : config.kind === "enrolled-compute" ? config.bootstrapRunner?.targetTelemetryEndpoint : undefined,
-        lifecycleProfilePath: config.kind === "platform" ? LIFECYCLE_PROFILE : undefined,
-        enforceEgress: true,
-        nodeHostname: config.nodeHostname,
-        telemetryEndpoint: config.telemetryEndpoint,
-        binPath: "/usr/local/lib/forgezero/agent/fz-agent",
-        sourceBinPath: PACKAGED_AGENT_BIN,
-        ...existsSync20(ENROL_CREDENTIAL) || hasBinding ? {
-          enrolTokenCredentialPath: existsSync20(ENROL_CREDENTIAL) ? ENROL_CREDENTIAL : undefined,
-          enrolStatePath: "/var/lib/forgezero/enrolment.json"
-        } : {},
-        ...hasBinding ? {
-          apiUrl: config.apiUrl,
-          project: config.kind === "enrolled-compute" ? config.realm : "platform",
-          environment: config.kind === "enrolled-compute" ? undefined : config.environment,
-          nodeLabel: config.kind === "enrolled-compute" ? config.nodeHostname : config.computeReference
-        } : {}
+        hasBinding,
+        hasEnrolCredential,
+        initialBundle
       });
       for (const unit3 of [{ path: plan.unitPath, unit: plan.unit }, ...plan.auxiliaryUnits]) {
         mkdirSync15(dirname10(unit3.path), { recursive: true, mode: 493 });