@forgezero/agent 0.1.65 → 0.1.67

package/dist/platform-bootstrap-runtime.js

@@ -1,21 +1,480 @@
-// src/platform-bootstrap-runtime.ts
+// src/software.ts
+import { createHash } from "node:crypto";
 import {
+  accessSync,
   chmodSync,
-  chownSync,
   copyFileSync,
   existsSync,
-  lstatSync,
+  mkdtempSync,
   mkdirSync,
   readFileSync,
-  readdirSync,
-  realpathSync,
   renameSync,
   rmSync,
-  statSync,
   symlinkSync,
+  unlinkSync,
   writeFileSync
 } from "node:fs";
+import { tmpdir } from "node:os";
 import { join } from "node:path";
+var PINNED_BUN_VERSION = "1.3.14";
+var BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f";
+var ARANGO_SHA256 = "b5a9197b4343f2ed554e1ebc1ef8e6529c7c39cde0035cdc311a4747a3355066";
+var CLOUDFLARED_SHA256 = "9d71c677db00134c1bd4144b7783486b654ad281b1ea62b4972098d19f770f17";
+var OS_CATALOG = [
+  {
+    id: "ubuntu",
+    version: "26.04",
+    architecture: "x64",
+    status: "active",
+    imageKey: "ubuntu-resolute-20260731",
+    imageLabel: "Ubuntu 26.04 LTS Resolute",
+    imageVersion: "2026-07-31",
+    imageUrl: "https://cloud-images.ubuntu.com/releases/resolute/release-20260731/ubuntu-26.04-server-cloudimg-amd64.img",
+    imageSha256: "9dc7c5363c0146a08ba0c9aa834d82c2c6dfbb1c471ad9a2f0aba1189e21be05",
+    confidentialModes: ["sev-snp"]
+  },
+  {
+    id: "ubuntu",
+    version: "24.04",
+    architecture: "x64",
+    status: "active",
+    imageKey: "ubuntu-noble-20260705",
+    imageLabel: "Ubuntu 24.04 LTS Noble",
+    imageVersion: "2026-07-05",
+    imageUrl: "https://cloud-images.ubuntu.com/releases/noble/release-20260705/ubuntu-24.04-server-cloudimg-amd64.img",
+    imageSha256: "ffe6203da54deeb6db5d2a98a83f9ec8e55f149d3f7ba622e1abe5fa966ee3d6",
+    confidentialModes: []
+  }
+];
+var SOFTWARE_CATALOG = [
+  { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "arangodb", version: "3.11.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflare-warp", version: "2026.6.822.0-min", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+];
+var UBUNTU_2604_X64 = [
+  { requirement: { id: "bun", version: "1.3.14" } },
+  { requirement: { id: "docker", version: "ubuntu-26.04" } },
+  { requirement: { id: "nginx", version: "ubuntu-26.04" } },
+  { requirement: { id: "arangodb", version: "3.11.14" } },
+  { requirement: { id: "cloudflared", version: "2026.7.3" } },
+  { requirement: { id: "cloudflare-warp", version: "2026.6.822.0-min" } },
+  { requirement: { id: "ufw", version: "ubuntu-26.04" } },
+  { requirement: { id: "openssh-client", version: "ubuntu-26.04" } },
+  { requirement: { id: "git", version: "ubuntu-26.04" } }
+];
+var UBUNTU_2404_X64 = [
+  { requirement: { id: "bun", version: "1.3.14" } },
+  { requirement: { id: "docker", version: "ubuntu-24.04" } },
+  { requirement: { id: "nginx", version: "ubuntu-24.04" } },
+  { requirement: { id: "ufw", version: "ubuntu-24.04" } },
+  { requirement: { id: "openssh-client", version: "ubuntu-24.04" } },
+  { requirement: { id: "git", version: "ubuntu-24.04" } }
+];
+var strategiesFor = (observation) => observation.os.id === "ubuntu" && observation.architecture === "x64" ? observation.os.versionId === "26.04" ? UBUNTU_2604_X64 : observation.os.versionId === "24.04" ? UBUNTU_2404_X64 : undefined : undefined;
+var path = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+var DOCKER_DAEMON_PATH = "/etc/docker/daemon.json";
+var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
+  "data-root": "/var/lib/docker",
+  "storage-driver": "overlay2",
+  "live-restore": true,
+  "log-driver": "local",
+  "log-opts": { "max-size": "10m", "max-file": "3" }
+}, null, 2)}
+`;
+var softwareSpawnFailure = (cause, argv) => cause.code === "ENOENT" ? { exitCode: 127, output: `executable is absent: ${argv[0]}` } : undefined;
+var runSoftwareCommand = async (argv, env = {}) => {
+  let child;
+  try {
+    child = Bun.spawn([...argv], { stdout: "pipe", stderr: "pipe", env: { PATH: path, LANG: "C", LC_ALL: "C", ...env } });
+  } catch (cause) {
+    const failure = softwareSpawnFailure(cause, argv);
+    if (failure)
+      return failure;
+    throw cause;
+  }
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  return { exitCode, output: `${stdout}${stderr}` };
+};
+var run = runSoftwareCommand;
+var download = async (url, destination, sha256) => {
+  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(120000) });
+  if (!response.ok)
+    throw new Error(`download failed with HTTP ${response.status}`);
+  const bytes = new Uint8Array(await response.arrayBuffer());
+  if (createHash("sha256").update(bytes).digest("hex") !== sha256)
+    throw new Error("download checksum mismatch");
+  writeFileSync(destination, bytes, { mode: 384, flag: "wx" });
+};
+var successful = (result, pattern) => result.exitCode === 0 && (!pattern || pattern.test(result.output));
+var aptInstall = async (name) => {
+  const environment = { DEBIAN_FRONTEND: "noninteractive" };
+  const update = await run(["/usr/bin/apt-get", "update", "-qq"], environment);
+  return update.exitCode === 0 ? run(["/usr/bin/apt-get", "install", "-y", name], environment) : update;
+};
+async function executeSoftwareOperation(operation) {
+  const { software, version } = operation;
+  if (![...UBUNTU_2604_X64, ...UBUNTU_2404_X64].some(({ requirement }) => requirement.id === software && requirement.version === version)) {
+    return { exitCode: 2, output: "unsupported software operation" };
+  }
+  if (operation.kind === "check") {
+    if (software === "bun")
+      return run(["/usr/local/bin/bun", "--version"]).then((r) => ({ ...r, exitCode: successful(r, /^1\.3\.14\s*$/m) ? 0 : 1 }));
+    if (software === "docker") {
+      const binary = await run(["/usr/bin/docker", "--version"]);
+      if (!successful(binary, /Docker version/))
+        return { ...binary, exitCode: 1 };
+      if (!existsSync(DOCKER_DAEMON_PATH) || readFileSync(DOCKER_DAEMON_PATH, "utf8") !== DOCKER_DAEMON_CONFIG)
+        return { exitCode: 1, output: "Docker daemon policy is absent or differs from the reviewed ForgeZero policy" };
+      const active = await run(["/usr/bin/systemctl", "is-active", "--quiet", "docker.service"]);
+      return active.exitCode === 0 ? { exitCode: 0, output: binary.output } : active;
+    }
+    if (software === "nginx") {
+      const binary = await run(["/usr/sbin/nginx", "-v"]);
+      return binary.exitCode === 0 ? run(["/usr/bin/systemctl", "is-active", "--quiet", "nginx.service"]) : binary;
+    }
+    if (software === "arangodb") {
+      const binary = await run(["/usr/sbin/arangod", "--version"]);
+      if (!successful(binary, /3\.11\.14/))
+        return { ...binary, exitCode: 1 };
+      const [active, enabled] = await Promise.all([
+        run(["/usr/bin/systemctl", "is-active", "--quiet", "arangodb3.service"]),
+        run(["/usr/bin/systemctl", "is-enabled", "--quiet", "arangodb3.service"])
+      ]);
+      return active.exitCode !== 0 && enabled.exitCode !== 0 ? { exitCode: 0, output: binary.output } : { exitCode: 1, output: "vendor standalone unit remains active or enabled" };
+    }
+    if (software === "cloudflared")
+      return run(["/usr/local/bin/cloudflared", "--version"]).then((r) => ({ ...r, exitCode: successful(r, /2026\.7\.3/) ? 0 : 1 }));
+    if (software === "cloudflare-warp")
+      return run(["/usr/bin/warp-cli", "--version"]).then((result) => {
+        const match = result.output.match(/(\d{4})\.(\d+)\.(\d+)\.(\d+)/);
+        const observed = match?.slice(1).map(Number);
+        const minimum = [2026, 6, 822, 0];
+        const supported = observed && observed.some((part, index) => part > minimum[index] && observed.slice(0, index).every((prior, priorIndex) => prior === minimum[priorIndex])) || observed?.every((part, index) => part === minimum[index]);
+        return { ...result, exitCode: result.exitCode === 0 && supported ? 0 : 1 };
+      });
+    const binaries = software === "ufw" ? ["/usr/sbin/ufw"] : software === "git" ? ["/usr/bin/git"] : ["/usr/bin/ssh", "/usr/bin/scp", "/usr/bin/ssh-keyscan", "/usr/bin/ssh-keygen"];
+    try {
+      binaries.forEach((binary) => accessSync(binary));
+      return { exitCode: 0, output: "" };
+    } catch (cause) {
+      return { exitCode: 1, output: cause instanceof Error ? cause.message : String(cause) };
+    }
+  }
+  if (software === "docker" || software === "nginx" || software === "ufw" || software === "openssh-client" || software === "git") {
+    const packageName = software === "openssh-client" ? "openssh-client" : software === "docker" ? "docker.io" : software;
+    const installed = await aptInstall(packageName);
+    if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")
+      return installed;
+    if (software === "docker") {
+      mkdirSync("/etc/docker", { recursive: true, mode: 493 });
+      if (existsSync(DOCKER_DAEMON_PATH) && readFileSync(DOCKER_DAEMON_PATH, "utf8") !== DOCKER_DAEMON_CONFIG) {
+        return { exitCode: 2, output: "refusing to overwrite an existing Docker daemon configuration that differs from the reviewed ForgeZero policy" };
+      }
+      if (!existsSync(DOCKER_DAEMON_PATH))
+        writeFileSync(DOCKER_DAEMON_PATH, DOCKER_DAEMON_CONFIG, { mode: 420, flag: "wx" });
+      const enabled = await run(["/usr/bin/systemctl", "enable", "docker.service"]);
+      return enabled.exitCode === 0 ? run(["/usr/bin/systemctl", "restart", "docker.service"]) : enabled;
+    }
+    return run(["/usr/bin/systemctl", "enable", "--now", `${software}.service`]);
+  }
+  const directory = mkdtempSync(join(tmpdir(), "forgezero-software-"));
+  try {
+    if (software === "cloudflare-warp") {
+      const key = join(directory, "cloudflare-warp-key.gpg");
+      await download("https://pkg.cloudflareclient.com/pubkey.gpg", key, "0f37fc298c98e88ee3c0ee68c95b69f1dba9eb477abe3167e13982105911264d");
+      mkdirSync("/usr/share/keyrings", { recursive: true, mode: 493 });
+      const dearmored = await run([
+        "/usr/bin/gpg",
+        "--batch",
+        "--yes",
+        "--dearmor",
+        "-o",
+        "/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg",
+        key
+      ]);
+      if (dearmored.exitCode !== 0)
+        return dearmored;
+      mkdirSync("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
+      writeFileSync("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ resolute main
+`, { mode: 420 });
+      return aptInstall("cloudflare-warp");
+    }
+    if (software === "bun") {
+      const archive = join(directory, "bun.zip");
+      await download("https://github.com/oven-sh/bun/releases/download/bun-v1.3.14/bun-linux-x64.zip", archive, BUN_RELEASE_SHA256);
+      const unpacked = join(directory, "unpacked");
+      mkdirSync(unpacked, { mode: 448 });
+      const unzipped = await run(["/usr/bin/unzip", "-q", archive, "-d", unpacked]);
+      if (unzipped.exitCode !== 0)
+        return unzipped;
+      mkdirSync("/usr/local/lib/forgezero/runtime", { recursive: true, mode: 493 });
+      copyFileSync(join(unpacked, "bun-linux-x64", "bun"), "/usr/local/lib/forgezero/runtime/bun.next");
+      chmodSync("/usr/local/lib/forgezero/runtime/bun.next", 493);
+      renameSync("/usr/local/lib/forgezero/runtime/bun.next", "/usr/local/lib/forgezero/runtime/bun");
+      try {
+        unlinkSync("/usr/local/bin/bun");
+      } catch {}
+      symlinkSync("/usr/local/lib/forgezero/runtime/bun", "/usr/local/bin/bun");
+      return { exitCode: 0, output: "" };
+    }
+    if (software === "cloudflared") {
+      const binary = join(directory, "cloudflared");
+      await download("https://github.com/cloudflare/cloudflared/releases/download/2026.7.3/cloudflared-linux-amd64", binary, CLOUDFLARED_SHA256);
+      chmodSync(binary, 493);
+      copyFileSync(binary, "/usr/local/bin/cloudflared");
+      chmodSync("/usr/local/bin/cloudflared", 493);
+      return { exitCode: 0, output: "" };
+    }
+    const deb = join(directory, "arangodb.deb");
+    await download("https://download.arangodb.com/arangodb311/DEBIAN/amd64/arangodb3_3.11.14-1_amd64.deb", deb, ARANGO_SHA256);
+    let installed = await run(["/usr/bin/dpkg", "-i", deb], { DEBIAN_FRONTEND: "noninteractive" });
+    if (installed.exitCode !== 0)
+      installed = await run(["/usr/bin/apt-get", "-y", "-f", "install"], { DEBIAN_FRONTEND: "noninteractive" });
+    if (installed.exitCode !== 0)
+      return installed;
+    await run(["/usr/bin/systemctl", "disable", "--now", "arangodb3.service"]);
+    return { exitCode: 0, output: "" };
+  } finally {
+    rmSync(directory, { recursive: true, force: true });
+  }
+}
+function observeSoftwareHost(osRelease = readFileSync("/etc/os-release", "utf8"), architecture = process.arch) {
+  const values = Object.fromEntries(osRelease.split(`
+`).flatMap((line) => {
+    const separator = line.indexOf("=");
+    return separator > 0 ? [[line.slice(0, separator), line.slice(separator + 1).replace(/^['"]|['"]$/g, "")]] : [];
+  }));
+  return {
+    os: { id: (values.ID ?? "unknown").toLowerCase(), versionId: values.VERSION_ID ?? "unknown" },
+    architecture
+  };
+}
+function validateSoftwareRequirements(value, _options = {}) {
+  if (!Array.isArray(value) || value.length > 32)
+    throw new Error("software requirements must be an array of at most 32 entries");
+  const seen = new Set;
+  return value.map((item) => {
+    if (!item || typeof item !== "object" || Array.isArray(item))
+      throw new Error("software requirement must be an object");
+    const row = item;
+    if (Object.keys(row).some((key) => key !== "id" && key !== "version")) {
+      throw new Error("software requirement contains an unknown field");
+    }
+    if (!["bun", "docker", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client", "git"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
+      throw new Error("software requirement coordinate is invalid");
+    }
+    const requirement = { id: row.id, version: row.version };
+    if (seen.has(requirement.id))
+      throw new Error(`duplicate software requirement: ${requirement.id}`);
+    seen.add(requirement.id);
+    const catalog = SOFTWARE_CATALOG.find((candidate) => candidate.id === requirement.id && candidate.version === requirement.version);
+    if (!catalog || catalog.status !== "active") {
+      throw new Error(`software requirement is not active: ${requirement.id}@${requirement.version}`);
+    }
+    return requirement;
+  });
+}
+async function ensureSoftwareRequirements(requirementsInput, options) {
+  const requirements = validateSoftwareRequirements(requirementsInput);
+  const observation = options.observation ?? observeSoftwareHost();
+  const os = OS_CATALOG.find((candidate) => candidate.id === observation.os.id && candidate.version === observation.os.versionId && candidate.architecture === observation.architecture);
+  if (!os || os.status !== "active") {
+    throw new Error(`unsupported software strategy: ${observation.os.id} ${observation.os.versionId} ${observation.architecture}`);
+  }
+  const results = [];
+  for (const requirement of requirements) {
+    const strategy = strategiesFor(observation)?.find(({ requirement: candidate }) => candidate.id === requirement.id && candidate.version === requirement.version);
+    if (!strategy)
+      throw new Error(`unsupported software requirement: ${requirement.id}@${requirement.version}`);
+    const before = await options.exec({ kind: "check", software: requirement.id, version: requirement.version });
+    if (before.exitCode === 0) {
+      results.push({ ...requirement, changed: false });
+      continue;
+    }
+    const installed = await options.exec({ kind: "install", software: requirement.id, version: requirement.version });
+    if (installed.exitCode !== 0)
+      throw new Error(`could not install ${requirement.id}@${requirement.version}: ${installed.output.trim()}`);
+    const after = await options.exec({ kind: "check", software: requirement.id, version: requirement.version });
+    if (after.exitCode !== 0)
+      throw new Error(`${requirement.id}@${requirement.version} did not pass its post-install check`);
+    results.push({ ...requirement, changed: true });
+  }
+  return results;
+}
+
+// src/ubuntu.ts
+var current = OS_CATALOG[0];
+var SUPPORTED_GUEST_IMAGE = Object.freeze({
+  key: current.imageKey,
+  family: `${current.id}-${current.version}`,
+  version: current.imageVersion,
+  label: current.imageLabel,
+  url: current.imageUrl,
+  sha256: current.imageSha256
+});
+var SUPPORTED_GUEST_IMAGES = Object.freeze(OS_CATALOG.filter(({ status }) => status === "active").map(({ id, imageKey, imageLabel, imageVersion, version, confidentialModes }) => ({
+  key: imageKey,
+  label: imageLabel,
+  family: `${id}-${version}`,
+  version: imageVersion,
+  confidential: confidentialModes.some((mode) => mode === "sev-snp")
+})));
+function supportedGuestImage(imageKey) {
+  return SUPPORTED_GUEST_IMAGES.find(({ key }) => key === imageKey);
+}
+function assertSupportedGuestImage(imageKey, confidential = false) {
+  const selected = OS_CATALOG.find((entry) => entry.status === "active" && entry.imageKey === imageKey);
+  if (!selected) {
+    throw new Error(`unsupported guest image ${imageKey}; supported images: ${SUPPORTED_GUEST_IMAGES.map(({ key }) => key).join(", ")}`);
+  }
+  if (confidential && !selected.confidentialModes.some((mode) => mode === "sev-snp")) {
+    throw new Error(`guest image ${imageKey} is not approved for SEV-SNP`);
+  }
+}
+
+// src/platform-genesis.ts
+var SAFE_NAME = /^[a-z][a-z0-9-]{0,62}$/;
+var SAFE_POOL = /^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$/;
+var PRIVATE_V4 = /^(?:10\.(?:\d{1,3}\.){2}\d{1,3}|192\.168\.(?:\d{1,3})\.(?:\d{1,3})|172\.(?:1[6-9]|2\d|3[01])\.(?:\d{1,3})\.(?:\d{1,3}))$/;
+var integer = (value, minimum, maximum, label) => {
+  if (!Number.isInteger(value) || value < minimum || value > maximum) {
+    throw new Error(`platform genesis ${label} is outside the supported range`);
+  }
+  return value;
+};
+function validatePlatformGenesisGuests(guests, expectedCount = 3) {
+  if (!Array.isArray(guests) || guests.length !== expectedCount) {
+    throw new Error(`platform genesis requires exactly ${expectedCount} reviewed guest requests`);
+  }
+  const names = new Set;
+  const addresses = new Set;
+  const pools = new Set;
+  return guests.map((input) => {
+    if (!input || typeof input !== "object" || !SAFE_NAME.test(input.name)) {
+      throw new Error("platform genesis guest name is malformed");
+    }
+    if (!PRIVATE_V4.test(input.address))
+      throw new Error("platform genesis guest address must be private IPv4");
+    if (typeof input.confidential !== "boolean")
+      throw new Error("platform genesis confidential requirement is missing");
+    assertSupportedGuestImage(input.imageKey, input.confidential);
+    if (input.cpuPoolKey !== undefined && !SAFE_POOL.test(input.cpuPoolKey)) {
+      throw new Error("platform genesis CPU pool key is malformed");
+    }
+    if (names.has(input.name) || addresses.has(input.address) || input.cpuPoolKey !== undefined && pools.has(input.cpuPoolKey)) {
+      throw new Error("platform genesis guest names, addresses and explicit CPU pools must be unique");
+    }
+    names.add(input.name);
+    addresses.add(input.address);
+    if (input.cpuPoolKey !== undefined)
+      pools.add(input.cpuPoolKey);
+    const physicalCores = integer(input.physicalCores, 1, 256, "physical core count");
+    const vcpu = integer(input.vcpu, 1, 512, "vCPU count");
+    if (vcpu < physicalCores)
+      throw new Error("platform genesis vCPU count cannot be smaller than physical cores");
+    const memoryGib = integer(input.memoryGib, 1, 8192, "memory");
+    const diskGib = integer(input.diskGib, 8, 65536, "disk");
+    const egressGuaranteedMbps = integer(input.egressGuaranteedMbps, 0, 1e6, "guaranteed egress");
+    const egressBurstMbps = integer(input.egressBurstMbps, egressGuaranteedMbps, 1e6, "burst egress");
+    return {
+      name: input.name,
+      address: input.address,
+      imageKey: input.imageKey,
+      ...input.cpuPoolKey ? { cpuPoolKey: input.cpuPoolKey } : {},
+      physicalCores,
+      vcpu,
+      memoryGib,
+      diskGib,
+      egressGuaranteedMbps,
+      egressBurstMbps,
+      confidential: input.confidential
+    };
+  });
+}
+var publicKey = (value) => {
+  const normalized = value.trim();
+  if (!/^ssh-(?:ed25519|rsa) [A-Za-z0-9+/]+={0,3}(?: [^\r\n]+)?$/.test(normalized)) {
+    throw new Error("platform genesis SSH public key is malformed");
+  }
+  return normalized;
+};
+var claimFor = (guest, keys, action) => {
+  const common = {
+    computeKey: `platform:${guest.name}`,
+    claimToken: "offline-platform-genesis",
+    claimExpiresAtTs: Number.MAX_SAFE_INTEGER,
+    attempt: 1,
+    bootstrap: { kind: "platform-genesis" },
+    spec: {
+      reference: `platform:${guest.name}`,
+      imageKey: guest.imageKey,
+      guestName: guest.name,
+      guestAddress: guest.address,
+      ...guest.cpuPoolKey ? { cpuPoolKey: guest.cpuPoolKey } : {},
+      physicalCores: guest.physicalCores,
+      vcpu: guest.vcpu,
+      memoryGib: guest.memoryGib,
+      diskGib: guest.diskGib,
+      egressGuaranteedMbps: guest.egressGuaranteedMbps,
+      egressBurstMbps: guest.egressBurstMbps,
+      confidential: guest.confidential
+    }
+  };
+  if (action === "delete")
+    return { ...common, action: "delete" };
+  return { ...common, action: "create", access: { sshUser: "forgezero", sshPublicKeys: [...keys] } };
+};
+function platformGenesisClaims(guests, sshPublicKeys) {
+  const reviewed = validatePlatformGenesisGuests(guests);
+  const keys = [...new Set(sshPublicKeys.map(publicKey))];
+  if (keys.length === 0)
+    throw new Error("platform genesis requires at least one operator SSH public key");
+  return reviewed.map((guest) => claimFor(guest, keys, "create"));
+}
+function platformCommunityRehearsalClaims(seedGuests, rehearsalGuest, sshPublicKeys) {
+  const reviewed = validatePlatformGenesisGuests([...seedGuests, rehearsalGuest], 4);
+  const keys = [...new Set(sshPublicKeys.map(publicKey))];
+  if (keys.length === 0)
+    throw new Error("platform genesis requires at least one operator SSH public key");
+  return reviewed.map((guest) => claimFor(guest, keys, "create"));
+}
+function platformCommunityRehearsalDeletionClaims(seedGuests, rehearsalGuest) {
+  return validatePlatformGenesisGuests([...seedGuests, rehearsalGuest], 4).map((guest) => claimFor(guest, [], "delete"));
+}
+
+// src/platform-bootstrap-runtime.ts
+import {
+  chmodSync as chmodSync2,
+  chownSync,
+  copyFileSync as copyFileSync2,
+  existsSync as existsSync2,
+  lstatSync,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  readdirSync,
+  realpathSync,
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  statSync,
+  symlinkSync as symlinkSync2,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { join as join2 } from "node:path";
 var safeAtom = (name, value) => {
   if (!value || /[\0\r\n]/.test(value))
     throw new Error(`${name} must be non-empty and single-line.`);
@@ -46,6 +505,50 @@ var httpsOrigin = (name, raw) => {
   }
   return value.origin;
 };
+function validatePlatformInitialInventory(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
+    throw new Error("initial platform inventory coordinates are invalid");
+  }
+  safeAtom("initialInventory.region.label", value.region.label);
+  if (value.region.city !== undefined)
+    safeAtom("initialInventory.region.city", value.region.city);
+  const computes = validatePlatformGenesisGuests(value.computes.map((compute) => {
+    if (!compute || typeof compute !== "object" || Array.isArray(compute) || Object.keys(compute).some((key) => ![
+      "name",
+      "address",
+      "imageKey",
+      "cpuPoolKey",
+      "physicalCores",
+      "vcpu",
+      "memoryGib",
+      "diskGib",
+      "egressGuaranteedMbps",
+      "egressBurstMbps",
+      "confidential",
+      "databaseRole",
+      "databaseAgency"
+    ].includes(key)))
+      throw new Error("initial platform compute contains unknown fields");
+    return compute;
+  }));
+  for (let index = 0;index < computes.length; index += 1) {
+    const declared = value.computes[index];
+    const expectedRole = index === 0 ? "master" : "joiner";
+    if (declared.databaseRole !== expectedRole || declared.databaseAgency !== "member" || declared.confidential !== true) {
+      throw new Error("initial platform inventory requires one master, two joiners, three Agency members and confidential compute");
+    }
+  }
+  return {
+    metalHostname: value.metalHostname,
+    region: { ...value.region },
+    computes: value.computes.map((compute, index) => ({
+      ...computes[index],
+      databaseRole: compute.databaseRole,
+      databaseAgency: compute.databaseAgency,
+      confidential: true
+    }))
+  };
+}
 var systemdValue = (name, raw) => {
   if (/[\0\r\n]/.test(raw))
     throw new Error(`${name} must be single-line.`);
@@ -131,12 +634,14 @@ function validatePlatformSharedEnvironment(input) {
       throw new Error("realtime.producer is invalid.");
     }
   }
+  const initialInventory = input.initialInventory ? validatePlatformInitialInventory(input.initialInventory) : undefined;
   return {
     ...input,
     databaseCoordinators: coordinators,
     appOrigin: httpsOrigin("appOrigin", input.appOrigin),
     apiOrigin: httpsOrigin("apiOrigin", input.apiOrigin),
-    agentOtlpEndpoint: httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint)
+    agentOtlpEndpoint: httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint),
+    ...initialInventory ? { initialInventory } : {}
   };
 }
 function renderPlatformSharedEnvironment(input) {
@@ -199,7 +704,8 @@ function renderPlatformSharedEnvironment(input) {
     FZ_CF_TUNNEL_SERVICE: value.cloudflare?.tunnelService ?? "",
     FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
     FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
-    FZ_REALTIME_PRODUCER: value.realtime?.producer ?? ""
+    FZ_REALTIME_PRODUCER: value.realtime?.producer ?? "",
+    FZ_PLATFORM_INITIAL_INVENTORY: value.initialInventory ? JSON.stringify(value.initialInventory) : ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
 ` + Object.entries(entries).map(([key, entry]) => `${key}=${systemdValue(key, entry)}`).join(`
@@ -226,8 +732,8 @@ function platformApiCredentialSpecs(options) {
   ];
 }
 function renderPlatformApiUnits(input) {
-  for (const path of [input.sharedDirectory, input.sharedEnvironmentFile, input.slotsDirectory]) {
-    if (!path.startsWith("/") || /[\r\n]/.test(path))
+  for (const path2 of [input.sharedDirectory, input.sharedEnvironmentFile, input.slotsDirectory]) {
+    if (!path2.startsWith("/") || /[\r\n]/.test(path2))
       throw new Error("Runtime paths must be absolute and single-line.");
   }
   if (!/^[a-z_][a-z0-9_-]{0,31}$/.test(input.serviceUser))
@@ -370,51 +876,51 @@ var platformExec = async (argv) => {
   ]);
   return { exitCode, output: `${stdout}${stderr}` };
 };
-var replaceLink = (path, target) => {
-  const pending = `${path}.next`;
-  rmSync(pending, { force: true });
+var replaceLink = (path2, target) => {
+  const pending = `${path2}.next`;
+  rmSync2(pending, { force: true });
   if (!target) {
-    rmSync(path, { force: true });
+    rmSync2(path2, { force: true });
     return;
   }
-  symlinkSync(target, pending);
-  renameSync(pending, path);
+  symlinkSync2(target, pending);
+  renameSync2(pending, path2);
 };
-var secureRelease = (path, uid, gid) => {
-  const visit = (current) => {
-    const metadata = lstatSync(current);
+var secureRelease = (path2, uid, gid) => {
+  const visit = (current2) => {
+    const metadata = lstatSync(current2);
     if (metadata.isSymbolicLink())
       throw new Error("release contains a symbolic link");
-    chownSync(current, uid, gid);
-    chmodSync(current, metadata.isDirectory() ? 365 : 292);
+    chownSync(current2, uid, gid);
+    chmodSync2(current2, metadata.isDirectory() ? 365 : 292);
     if (metadata.isDirectory())
-      for (const name of readdirSync(current))
-        visit(join(current, name));
+      for (const name of readdirSync(current2))
+        visit(join2(current2, name));
   };
-  visit(path);
+  visit(path2);
 };
 async function activatePlatformRelease(config, requestedRelease, options = {}) {
   const rendered = renderPlatformActivationFiles(config);
   const normalized = JSON.parse(rendered.helper);
-  const releases = realpathSync(join(normalized.root, "releases"));
+  const releases = realpathSync(join2(normalized.root, "releases"));
   const release = realpathSync(requestedRelease);
   if (!release.startsWith(`${releases}/`) || release === releases)
     throw new Error("release is outside configured releases directory");
   for (const required of ["forgezero.deploy.ts", ".fz/deploy.plan.json", "src/index.ts", "bun.lock"]) {
-    const metadata = statSync(join(release, required));
+    const metadata = statSync(join2(release, required));
     if (!metadata.isFile() || metadata.size < 1)
       throw new Error(`release is incomplete: ${required}`);
   }
   const exec = options.exec ?? platformExec;
   const request = options.fetch ?? fetch;
   const sleep = options.sleep ?? Bun.sleep;
-  const slots = join(normalized.root, "slots");
-  mkdirSync(slots, { recursive: true, mode: 493 });
-  const slotFile = join(normalized.root, ".forge-slot");
-  const previousSlot = existsSync(slotFile) ? readFileSync(slotFile, "utf8").trim() : undefined;
+  const slots = join2(normalized.root, "slots");
+  mkdirSync2(slots, { recursive: true, mode: 493 });
+  const slotFile = join2(normalized.root, ".forge-slot");
+  const previousSlot = existsSync2(slotFile) ? readFileSync2(slotFile, "utf8").trim() : undefined;
   const target = previousSlot === "blue" ? "green" : "blue";
   const port = target === "blue" ? normalized.bluePort : normalized.greenPort;
-  const targetLink = join(slots, target);
+  const targetLink = join2(slots, target);
   let previousTarget;
   try {
     previousTarget = realpathSync(targetLink);
@@ -451,35 +957,35 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
   }
   const upstream = "/etc/nginx/conf.d/forgezero-upstream.conf";
   const backup = `${upstream}.forgezero-backup`;
-  if (existsSync(upstream))
-    copyFileSync(upstream, backup);
+  if (existsSync2(upstream))
+    copyFileSync2(upstream, backup);
   else
-    rmSync(backup, { force: true });
-  writeFileSync(upstream, `upstream forgezero { server 127.0.0.1:${port}; }
+    rmSync2(backup, { force: true });
+  writeFileSync2(upstream, `upstream forgezero { server 127.0.0.1:${port}; }
 `, { mode: 420 });
   const test = await exec(["/usr/sbin/nginx", "-t"]);
   const reload = test.exitCode === 0 ? await exec(["/usr/sbin/nginx", "-s", "reload"]) : test;
   if (reload.exitCode !== 0) {
-    if (existsSync(backup))
-      renameSync(backup, upstream);
+    if (existsSync2(backup))
+      renameSync2(backup, upstream);
     else
-      rmSync(upstream, { force: true });
+      rmSync2(upstream, { force: true });
     await exec(["/usr/sbin/nginx", "-t"]);
     await exec(["/usr/sbin/nginx", "-s", "reload"]);
     await stopTarget();
     throw new Error("nginx refused the promoted upstream");
   }
-  rmSync(backup, { force: true });
-  writeFileSync(slotFile, `${target}
+  rmSync2(backup, { force: true });
+  writeFileSync2(slotFile, `${target}
 `, { mode: 420 });
   if (previousSlot && previousSlot !== target) {
     await sleep(normalized.drainDeadlineMs);
     await exec(["/usr/bin/systemctl", "stop", `forgezero@${previousSlot}.service`]);
   }
-  const old = readdirSync(releases, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join(releases, entry.name)).sort((left, right) => statSync(right).mtimeMs - statSync(left).mtimeMs).slice(normalized.keepReleases);
-  for (const path of old)
-    if (path !== release)
-      rmSync(path, { recursive: true, force: true });
+  const old = readdirSync(releases, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join2(releases, entry.name)).sort((left, right) => statSync(right).mtimeMs - statSync(left).mtimeMs).slice(normalized.keepReleases);
+  for (const path2 of old)
+    if (path2 !== release)
+      rmSync2(path2, { recursive: true, force: true });
   return { release, slot: target };
 }
 function validateCollectorUnit(unit) {
@@ -520,6 +1026,7 @@ function planLocalOtlpProof(endpoint, collectorUnit) {
 }
 export {
   validatePlatformSharedEnvironment,
+  validatePlatformInitialInventory,
   renderPlatformSharedEnvironment,
   renderPlatformNginx,
   renderPlatformApiUnits,