@forgezero/agent 0.1.65 → 0.1.67

package/dist/metal-provision.js

@@ -138,34 +138,368 @@ function shapeEgressUnitDirectives(tap, guaranteedMbps, burstMbps) {
 }
 var tapFor = (guestIndex) => `tap${guestIndex}`;
 
+// src/software.ts
+import { createHash } from "node:crypto";
+import {
+  accessSync,
+  chmodSync,
+  copyFileSync,
+  existsSync,
+  mkdtempSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  symlinkSync,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+var PINNED_BUN_VERSION = "1.3.14";
+var BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f";
+var ARANGO_SHA256 = "b5a9197b4343f2ed554e1ebc1ef8e6529c7c39cde0035cdc311a4747a3355066";
+var CLOUDFLARED_SHA256 = "9d71c677db00134c1bd4144b7783486b654ad281b1ea62b4972098d19f770f17";
+var OS_CATALOG = [
+  {
+    id: "ubuntu",
+    version: "26.04",
+    architecture: "x64",
+    status: "active",
+    imageKey: "ubuntu-resolute-20260731",
+    imageLabel: "Ubuntu 26.04 LTS Resolute",
+    imageVersion: "2026-07-31",
+    imageUrl: "https://cloud-images.ubuntu.com/releases/resolute/release-20260731/ubuntu-26.04-server-cloudimg-amd64.img",
+    imageSha256: "9dc7c5363c0146a08ba0c9aa834d82c2c6dfbb1c471ad9a2f0aba1189e21be05",
+    confidentialModes: ["sev-snp"]
+  },
+  {
+    id: "ubuntu",
+    version: "24.04",
+    architecture: "x64",
+    status: "active",
+    imageKey: "ubuntu-noble-20260705",
+    imageLabel: "Ubuntu 24.04 LTS Noble",
+    imageVersion: "2026-07-05",
+    imageUrl: "https://cloud-images.ubuntu.com/releases/noble/release-20260705/ubuntu-24.04-server-cloudimg-amd64.img",
+    imageSha256: "ffe6203da54deeb6db5d2a98a83f9ec8e55f149d3f7ba622e1abe5fa966ee3d6",
+    confidentialModes: []
+  }
+];
+var SOFTWARE_CATALOG = [
+  { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "arangodb", version: "3.11.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflare-warp", version: "2026.6.822.0-min", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+];
+var UBUNTU_2604_X64 = [
+  { requirement: { id: "bun", version: "1.3.14" } },
+  { requirement: { id: "docker", version: "ubuntu-26.04" } },
+  { requirement: { id: "nginx", version: "ubuntu-26.04" } },
+  { requirement: { id: "arangodb", version: "3.11.14" } },
+  { requirement: { id: "cloudflared", version: "2026.7.3" } },
+  { requirement: { id: "cloudflare-warp", version: "2026.6.822.0-min" } },
+  { requirement: { id: "ufw", version: "ubuntu-26.04" } },
+  { requirement: { id: "openssh-client", version: "ubuntu-26.04" } },
+  { requirement: { id: "git", version: "ubuntu-26.04" } }
+];
+var UBUNTU_2404_X64 = [
+  { requirement: { id: "bun", version: "1.3.14" } },
+  { requirement: { id: "docker", version: "ubuntu-24.04" } },
+  { requirement: { id: "nginx", version: "ubuntu-24.04" } },
+  { requirement: { id: "ufw", version: "ubuntu-24.04" } },
+  { requirement: { id: "openssh-client", version: "ubuntu-24.04" } },
+  { requirement: { id: "git", version: "ubuntu-24.04" } }
+];
+var strategiesFor = (observation) => observation.os.id === "ubuntu" && observation.architecture === "x64" ? observation.os.versionId === "26.04" ? UBUNTU_2604_X64 : observation.os.versionId === "24.04" ? UBUNTU_2404_X64 : undefined : undefined;
+var path = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+var DOCKER_DAEMON_PATH = "/etc/docker/daemon.json";
+var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
+  "data-root": "/var/lib/docker",
+  "storage-driver": "overlay2",
+  "live-restore": true,
+  "log-driver": "local",
+  "log-opts": { "max-size": "10m", "max-file": "3" }
+}, null, 2)}
+`;
+var softwareSpawnFailure = (cause, argv) => cause.code === "ENOENT" ? { exitCode: 127, output: `executable is absent: ${argv[0]}` } : undefined;
+var runSoftwareCommand = async (argv, env = {}) => {
+  let child;
+  try {
+    child = Bun.spawn([...argv], { stdout: "pipe", stderr: "pipe", env: { PATH: path, LANG: "C", LC_ALL: "C", ...env } });
+  } catch (cause) {
+    const failure = softwareSpawnFailure(cause, argv);
+    if (failure)
+      return failure;
+    throw cause;
+  }
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  return { exitCode, output: `${stdout}${stderr}` };
+};
+var run = runSoftwareCommand;
+var download = async (url, destination, sha256) => {
+  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(120000) });
+  if (!response.ok)
+    throw new Error(`download failed with HTTP ${response.status}`);
+  const bytes = new Uint8Array(await response.arrayBuffer());
+  if (createHash("sha256").update(bytes).digest("hex") !== sha256)
+    throw new Error("download checksum mismatch");
+  writeFileSync(destination, bytes, { mode: 384, flag: "wx" });
+};
+var successful = (result, pattern) => result.exitCode === 0 && (!pattern || pattern.test(result.output));
+var aptInstall = async (name) => {
+  const environment = { DEBIAN_FRONTEND: "noninteractive" };
+  const update = await run(["/usr/bin/apt-get", "update", "-qq"], environment);
+  return update.exitCode === 0 ? run(["/usr/bin/apt-get", "install", "-y", name], environment) : update;
+};
+async function executeSoftwareOperation(operation) {
+  const { software, version } = operation;
+  if (![...UBUNTU_2604_X64, ...UBUNTU_2404_X64].some(({ requirement }) => requirement.id === software && requirement.version === version)) {
+    return { exitCode: 2, output: "unsupported software operation" };
+  }
+  if (operation.kind === "check") {
+    if (software === "bun")
+      return run(["/usr/local/bin/bun", "--version"]).then((r) => ({ ...r, exitCode: successful(r, /^1\.3\.14\s*$/m) ? 0 : 1 }));
+    if (software === "docker") {
+      const binary = await run(["/usr/bin/docker", "--version"]);
+      if (!successful(binary, /Docker version/))
+        return { ...binary, exitCode: 1 };
+      if (!existsSync(DOCKER_DAEMON_PATH) || readFileSync(DOCKER_DAEMON_PATH, "utf8") !== DOCKER_DAEMON_CONFIG)
+        return { exitCode: 1, output: "Docker daemon policy is absent or differs from the reviewed ForgeZero policy" };
+      const active = await run(["/usr/bin/systemctl", "is-active", "--quiet", "docker.service"]);
+      return active.exitCode === 0 ? { exitCode: 0, output: binary.output } : active;
+    }
+    if (software === "nginx") {
+      const binary = await run(["/usr/sbin/nginx", "-v"]);
+      return binary.exitCode === 0 ? run(["/usr/bin/systemctl", "is-active", "--quiet", "nginx.service"]) : binary;
+    }
+    if (software === "arangodb") {
+      const binary = await run(["/usr/sbin/arangod", "--version"]);
+      if (!successful(binary, /3\.11\.14/))
+        return { ...binary, exitCode: 1 };
+      const [active, enabled] = await Promise.all([
+        run(["/usr/bin/systemctl", "is-active", "--quiet", "arangodb3.service"]),
+        run(["/usr/bin/systemctl", "is-enabled", "--quiet", "arangodb3.service"])
+      ]);
+      return active.exitCode !== 0 && enabled.exitCode !== 0 ? { exitCode: 0, output: binary.output } : { exitCode: 1, output: "vendor standalone unit remains active or enabled" };
+    }
+    if (software === "cloudflared")
+      return run(["/usr/local/bin/cloudflared", "--version"]).then((r) => ({ ...r, exitCode: successful(r, /2026\.7\.3/) ? 0 : 1 }));
+    if (software === "cloudflare-warp")
+      return run(["/usr/bin/warp-cli", "--version"]).then((result) => {
+        const match = result.output.match(/(\d{4})\.(\d+)\.(\d+)\.(\d+)/);
+        const observed = match?.slice(1).map(Number);
+        const minimum = [2026, 6, 822, 0];
+        const supported = observed && observed.some((part, index) => part > minimum[index] && observed.slice(0, index).every((prior, priorIndex) => prior === minimum[priorIndex])) || observed?.every((part, index) => part === minimum[index]);
+        return { ...result, exitCode: result.exitCode === 0 && supported ? 0 : 1 };
+      });
+    const binaries = software === "ufw" ? ["/usr/sbin/ufw"] : software === "git" ? ["/usr/bin/git"] : ["/usr/bin/ssh", "/usr/bin/scp", "/usr/bin/ssh-keyscan", "/usr/bin/ssh-keygen"];
+    try {
+      binaries.forEach((binary) => accessSync(binary));
+      return { exitCode: 0, output: "" };
+    } catch (cause) {
+      return { exitCode: 1, output: cause instanceof Error ? cause.message : String(cause) };
+    }
+  }
+  if (software === "docker" || software === "nginx" || software === "ufw" || software === "openssh-client" || software === "git") {
+    const packageName = software === "openssh-client" ? "openssh-client" : software === "docker" ? "docker.io" : software;
+    const installed = await aptInstall(packageName);
+    if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")
+      return installed;
+    if (software === "docker") {
+      mkdirSync("/etc/docker", { recursive: true, mode: 493 });
+      if (existsSync(DOCKER_DAEMON_PATH) && readFileSync(DOCKER_DAEMON_PATH, "utf8") !== DOCKER_DAEMON_CONFIG) {
+        return { exitCode: 2, output: "refusing to overwrite an existing Docker daemon configuration that differs from the reviewed ForgeZero policy" };
+      }
+      if (!existsSync(DOCKER_DAEMON_PATH))
+        writeFileSync(DOCKER_DAEMON_PATH, DOCKER_DAEMON_CONFIG, { mode: 420, flag: "wx" });
+      const enabled = await run(["/usr/bin/systemctl", "enable", "docker.service"]);
+      return enabled.exitCode === 0 ? run(["/usr/bin/systemctl", "restart", "docker.service"]) : enabled;
+    }
+    return run(["/usr/bin/systemctl", "enable", "--now", `${software}.service`]);
+  }
+  const directory = mkdtempSync(join(tmpdir(), "forgezero-software-"));
+  try {
+    if (software === "cloudflare-warp") {
+      const key = join(directory, "cloudflare-warp-key.gpg");
+      await download("https://pkg.cloudflareclient.com/pubkey.gpg", key, "0f37fc298c98e88ee3c0ee68c95b69f1dba9eb477abe3167e13982105911264d");
+      mkdirSync("/usr/share/keyrings", { recursive: true, mode: 493 });
+      const dearmored = await run([
+        "/usr/bin/gpg",
+        "--batch",
+        "--yes",
+        "--dearmor",
+        "-o",
+        "/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg",
+        key
+      ]);
+      if (dearmored.exitCode !== 0)
+        return dearmored;
+      mkdirSync("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
+      writeFileSync("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ resolute main
+`, { mode: 420 });
+      return aptInstall("cloudflare-warp");
+    }
+    if (software === "bun") {
+      const archive = join(directory, "bun.zip");
+      await download("https://github.com/oven-sh/bun/releases/download/bun-v1.3.14/bun-linux-x64.zip", archive, BUN_RELEASE_SHA256);
+      const unpacked = join(directory, "unpacked");
+      mkdirSync(unpacked, { mode: 448 });
+      const unzipped = await run(["/usr/bin/unzip", "-q", archive, "-d", unpacked]);
+      if (unzipped.exitCode !== 0)
+        return unzipped;
+      mkdirSync("/usr/local/lib/forgezero/runtime", { recursive: true, mode: 493 });
+      copyFileSync(join(unpacked, "bun-linux-x64", "bun"), "/usr/local/lib/forgezero/runtime/bun.next");
+      chmodSync("/usr/local/lib/forgezero/runtime/bun.next", 493);
+      renameSync("/usr/local/lib/forgezero/runtime/bun.next", "/usr/local/lib/forgezero/runtime/bun");
+      try {
+        unlinkSync("/usr/local/bin/bun");
+      } catch {}
+      symlinkSync("/usr/local/lib/forgezero/runtime/bun", "/usr/local/bin/bun");
+      return { exitCode: 0, output: "" };
+    }
+    if (software === "cloudflared") {
+      const binary = join(directory, "cloudflared");
+      await download("https://github.com/cloudflare/cloudflared/releases/download/2026.7.3/cloudflared-linux-amd64", binary, CLOUDFLARED_SHA256);
+      chmodSync(binary, 493);
+      copyFileSync(binary, "/usr/local/bin/cloudflared");
+      chmodSync("/usr/local/bin/cloudflared", 493);
+      return { exitCode: 0, output: "" };
+    }
+    const deb = join(directory, "arangodb.deb");
+    await download("https://download.arangodb.com/arangodb311/DEBIAN/amd64/arangodb3_3.11.14-1_amd64.deb", deb, ARANGO_SHA256);
+    let installed = await run(["/usr/bin/dpkg", "-i", deb], { DEBIAN_FRONTEND: "noninteractive" });
+    if (installed.exitCode !== 0)
+      installed = await run(["/usr/bin/apt-get", "-y", "-f", "install"], { DEBIAN_FRONTEND: "noninteractive" });
+    if (installed.exitCode !== 0)
+      return installed;
+    await run(["/usr/bin/systemctl", "disable", "--now", "arangodb3.service"]);
+    return { exitCode: 0, output: "" };
+  } finally {
+    rmSync(directory, { recursive: true, force: true });
+  }
+}
+function observeSoftwareHost(osRelease = readFileSync("/etc/os-release", "utf8"), architecture = process.arch) {
+  const values = Object.fromEntries(osRelease.split(`
+`).flatMap((line) => {
+    const separator = line.indexOf("=");
+    return separator > 0 ? [[line.slice(0, separator), line.slice(separator + 1).replace(/^['"]|['"]$/g, "")]] : [];
+  }));
+  return {
+    os: { id: (values.ID ?? "unknown").toLowerCase(), versionId: values.VERSION_ID ?? "unknown" },
+    architecture
+  };
+}
+function validateSoftwareRequirements(value, _options = {}) {
+  if (!Array.isArray(value) || value.length > 32)
+    throw new Error("software requirements must be an array of at most 32 entries");
+  const seen = new Set;
+  return value.map((item) => {
+    if (!item || typeof item !== "object" || Array.isArray(item))
+      throw new Error("software requirement must be an object");
+    const row = item;
+    if (Object.keys(row).some((key) => key !== "id" && key !== "version")) {
+      throw new Error("software requirement contains an unknown field");
+    }
+    if (!["bun", "docker", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client", "git"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
+      throw new Error("software requirement coordinate is invalid");
+    }
+    const requirement = { id: row.id, version: row.version };
+    if (seen.has(requirement.id))
+      throw new Error(`duplicate software requirement: ${requirement.id}`);
+    seen.add(requirement.id);
+    const catalog = SOFTWARE_CATALOG.find((candidate) => candidate.id === requirement.id && candidate.version === requirement.version);
+    if (!catalog || catalog.status !== "active") {
+      throw new Error(`software requirement is not active: ${requirement.id}@${requirement.version}`);
+    }
+    return requirement;
+  });
+}
+async function ensureSoftwareRequirements(requirementsInput, options) {
+  const requirements = validateSoftwareRequirements(requirementsInput);
+  const observation = options.observation ?? observeSoftwareHost();
+  const os = OS_CATALOG.find((candidate) => candidate.id === observation.os.id && candidate.version === observation.os.versionId && candidate.architecture === observation.architecture);
+  if (!os || os.status !== "active") {
+    throw new Error(`unsupported software strategy: ${observation.os.id} ${observation.os.versionId} ${observation.architecture}`);
+  }
+  const results = [];
+  for (const requirement of requirements) {
+    const strategy = strategiesFor(observation)?.find(({ requirement: candidate }) => candidate.id === requirement.id && candidate.version === requirement.version);
+    if (!strategy)
+      throw new Error(`unsupported software requirement: ${requirement.id}@${requirement.version}`);
+    const before = await options.exec({ kind: "check", software: requirement.id, version: requirement.version });
+    if (before.exitCode === 0) {
+      results.push({ ...requirement, changed: false });
+      continue;
+    }
+    const installed = await options.exec({ kind: "install", software: requirement.id, version: requirement.version });
+    if (installed.exitCode !== 0)
+      throw new Error(`could not install ${requirement.id}@${requirement.version}: ${installed.output.trim()}`);
+    const after = await options.exec({ kind: "check", software: requirement.id, version: requirement.version });
+    if (after.exitCode !== 0)
+      throw new Error(`${requirement.id}@${requirement.version} did not pass its post-install check`);
+    results.push({ ...requirement, changed: true });
+  }
+  return results;
+}
+
 // src/ubuntu.ts
+var current = OS_CATALOG[0];
 var SUPPORTED_GUEST_IMAGE = Object.freeze({
-  key: "ubuntu-resolute-20260731",
-  family: "ubuntu-26.04",
-  version: "2026-07-31",
-  label: "Ubuntu 26.04 LTS Resolute",
-  url: "https://cloud-images.ubuntu.com/releases/resolute/release-20260731/ubuntu-26.04-server-cloudimg-amd64.img",
-  sha256: "9dc7c5363c0146a08ba0c9aa834d82c2c6dfbb1c471ad9a2f0aba1189e21be05"
+  key: current.imageKey,
+  family: `${current.id}-${current.version}`,
+  version: current.imageVersion,
+  label: current.imageLabel,
+  url: current.imageUrl,
+  sha256: current.imageSha256
 });
-function assertSupportedGuestImage(imageKey) {
-  if (imageKey !== SUPPORTED_GUEST_IMAGE.key) {
-    throw new Error(`unsupported guest image ${imageKey}; ForgeZero currently supports only ${SUPPORTED_GUEST_IMAGE.key}`);
+var SUPPORTED_GUEST_IMAGES = Object.freeze(OS_CATALOG.filter(({ status }) => status === "active").map(({ id, imageKey, imageLabel, imageVersion, version, confidentialModes }) => ({
+  key: imageKey,
+  label: imageLabel,
+  family: `${id}-${version}`,
+  version: imageVersion,
+  confidential: confidentialModes.some((mode) => mode === "sev-snp")
+})));
+function supportedGuestImage(imageKey) {
+  return SUPPORTED_GUEST_IMAGES.find(({ key }) => key === imageKey);
+}
+function assertSupportedGuestImage(imageKey, confidential = false) {
+  const selected = OS_CATALOG.find((entry) => entry.status === "active" && entry.imageKey === imageKey);
+  if (!selected) {
+    throw new Error(`unsupported guest image ${imageKey}; supported images: ${SUPPORTED_GUEST_IMAGES.map(({ key }) => key).join(", ")}`);
+  }
+  if (confidential && !selected.confidentialModes.some((mode) => mode === "sev-snp")) {
+    throw new Error(`guest image ${imageKey} is not approved for SEV-SNP`);
   }
 }
 
 // src/metal-provision.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import {
-  existsSync,
-  mkdirSync,
-  readFileSync,
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
   readdirSync,
-  rmSync,
+  rmSync as rmSync2,
   statSync,
-  unlinkSync,
-  writeFileSync
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync2
 } from "node:fs";
-import { dirname, isAbsolute, join } from "node:path";
+import { dirname, isAbsolute, join as join2 } from "node:path";
 import { isIP } from "node:net";
 var SAFE_NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}$/;
 var DEVICE = /^[a-zA-Z][a-zA-Z0-9_.-]{0,14}$/;
@@ -193,8 +527,8 @@ function membersOfLinuxList(value, label) {
     throw new MetalProvisionError(`${label} list overlaps itself`);
   return members;
 }
-var guestNameFor = (computeKey) => `fzg-${createHash("sha256").update(computeKey).digest("hex").slice(0, 16)}`;
-var tapNameFor = (computeKey) => `fzt${createHash("sha256").update(computeKey).digest("hex").slice(0, 12)}`;
+var guestNameFor = (computeKey) => `fzg-${createHash2("sha256").update(computeKey).digest("hex").slice(0, 16)}`;
+var tapNameFor = (computeKey) => `fzt${createHash2("sha256").update(computeKey).digest("hex").slice(0, 12)}`;
 var macForAddress = (address) => {
   const octets = address.split(".").map(Number);
   if (octets.length !== 4 || octets.some((value) => !Number.isInteger(value) || value < 0 || value > 255)) {
@@ -211,8 +545,8 @@ function validateMetalProfile(profile) {
     throw new MetalProvisionError("invalid subnet prefix");
   if (!Number.isInteger(profile.addressStart) || !Number.isInteger(profile.addressEnd) || profile.addressStart < 2 || profile.addressEnd > 254 || profile.addressStart > profile.addressEnd)
     throw new MetalProvisionError("invalid guest address range");
-  for (const path of [profile.stateDir, profile.seedDir, profile.unitDir]) {
-    if (!isAbsolute(path))
+  for (const path2 of [profile.stateDir, profile.seedDir, profile.unitDir]) {
+    if (!isAbsolute(path2))
       throw new MetalProvisionError("metal paths must be absolute");
   }
   new URL(profile.apiUrl);
@@ -225,9 +559,16 @@ function validateMetalProfile(profile) {
   if (telemetryEndpoint.protocol !== "https:" || telemetryEndpoint.username || telemetryEndpoint.password || telemetryEndpoint.search || telemetryEndpoint.hash || isIP(telemetryEndpoint.hostname) !== 0 || !telemetryEndpoint.hostname.includes(".") || telemetryEndpoint.hostname === "localhost" || telemetryEndpoint.hostname.endsWith(".local"))
     throw new MetalProvisionError("Agent telemetry endpoint must be a public HTTPS DNS coordinate without credentials, query or fragment");
   const imageKeys = Object.keys(profile.images);
-  if (imageKeys.length !== 1 || imageKeys[0] !== SUPPORTED_GUEST_IMAGE.key || profile.images[SUPPORTED_GUEST_IMAGE.key]?.sha256 !== SUPPORTED_GUEST_IMAGE.sha256) {
-    throw new MetalProvisionError(`metal profile must contain only the pinned ${SUPPORTED_GUEST_IMAGE.key} image contract`);
+  if (imageKeys.length === 0)
+    throw new MetalProvisionError("metal profile requires at least one pinned guest image");
+  for (const imageKey of imageKeys) {
+    const catalog = OS_CATALOG.find((entry) => entry.status === "active" && entry.imageKey === imageKey);
+    if (!catalog || profile.images[imageKey]?.sha256 !== catalog.imageSha256) {
+      throw new MetalProvisionError(`metal profile image ${imageKey} does not match the pinned OS catalog`);
+    }
   }
+  if (profile.confidential && !imageKeys.some((key) => OS_CATALOG.find((entry) => entry.imageKey === key)?.confidentialModes.some((mode) => mode === "sev-snp")))
+    throw new MetalProvisionError("confidential metal profile requires a pinned SEV-SNP guest image");
   if (!Array.isArray(profile.cpuPools) || profile.cpuPools.length === 0) {
     throw new MetalProvisionError("at least one exclusive CPU pool is required");
   }
@@ -274,9 +615,9 @@ function validateMetalProfile(profile) {
   }
 }
 var readManifests = (stateDir) => {
-  if (!existsSync(stateDir))
+  if (!existsSync2(stateDir))
     return [];
-  return readdirSync(stateDir).filter((name) => name.endsWith(".json")).map((name) => JSON.parse(readFileSync(join(stateDir, name), "utf8")));
+  return readdirSync(stateDir).filter((name) => name.endsWith(".json")).map((name) => JSON.parse(readFileSync2(join2(stateDir, name), "utf8")));
 };
 function allocateAddress(profile, computeKey, rows) {
   const existing = rows.find((row) => row.computeKey === computeKey);
@@ -284,7 +625,7 @@ function allocateAddress(profile, computeKey, rows) {
     return existing.address;
   const used = new Set(rows.map((row) => row.address));
   const width = profile.addressEnd - profile.addressStart + 1;
-  const start = createHash("sha256").update(computeKey).digest().readUInt16BE(0) % width;
+  const start = createHash2("sha256").update(computeKey).digest().readUInt16BE(0) % width;
   for (let offset = 0;offset < width; offset += 1) {
     const last = profile.addressStart + (start + offset) % width;
     const address = `${profile.subnetPrefix}.${last}`;
@@ -334,7 +675,7 @@ function allocateCpuPool(profile, claim, rows) {
   return selected;
 }
 var base64 = (value) => Buffer.from(value).toString("base64");
-var yamlFile = (path, content, permissions) => `  - path: ${JSON.stringify(path)}
+var yamlFile = (path2, content, permissions) => `  - path: ${JSON.stringify(path2)}
     permissions: '${permissions}'
     encoding: b64
     content: ${base64(content)}
@@ -446,7 +787,7 @@ var checked = async (exec, argv) => {
 };
 async function provisionMetalGuest(profile, claim, exec) {
   validateMetalProfile(profile);
-  assertSupportedGuestImage(claim.spec.imageKey);
+  assertSupportedGuestImage(claim.spec.imageKey, claim.spec.confidential);
   if (!claim.computeKey || !claim.spec.reference || !SAFE_NAME.test(claim.spec.imageKey) || claim.spec.guestName !== undefined && !SAFE_NAME.test(claim.spec.guestName) || claim.spec.cpuPoolKey !== undefined && !SAFE_NAME.test(claim.spec.cpuPoolKey) || !Number.isInteger(claim.spec.physicalCores) || claim.spec.physicalCores < 1 || claim.spec.physicalCores > 256 || !Number.isInteger(claim.spec.vcpu) || claim.spec.vcpu < 1 || claim.spec.vcpu > 512 || !Number.isInteger(claim.spec.memoryGib) || claim.spec.memoryGib < 1 || claim.spec.memoryGib > 8192 || !Number.isInteger(claim.spec.diskGib) || claim.spec.diskGib < 8 || claim.spec.diskGib > 65536 || !Number.isInteger(claim.spec.egressGuaranteedMbps) || claim.spec.egressGuaranteedMbps < 0 || !Number.isInteger(claim.spec.egressBurstMbps) || claim.spec.egressBurstMbps < claim.spec.egressGuaranteedMbps)
     throw new MetalProvisionError("invalid compute claim");
   const image = profile.images[claim.spec.imageKey];
@@ -458,8 +799,8 @@ async function provisionMetalGuest(profile, claim, exec) {
   const digest = (await checked(exec, ["sha256sum", image.path])).stdout.trim().split(/\s+/)[0];
   if (digest !== image.sha256)
     throw new MetalProvisionError("configured image checksum mismatch");
-  for (const path of [profile.stateDir, profile.seedDir, profile.unitDir])
-    mkdirSync(path, { recursive: true, mode: 448 });
+  for (const path2 of [profile.stateDir, profile.seedDir, profile.unitDir])
+    mkdirSync2(path2, { recursive: true, mode: 448 });
   const manifests = readManifests(profile.stateDir);
   if (claim.access) {
     if (!/^[a-z_][a-z0-9_-]{0,31}$/.test(claim.access.sshUser)) {
@@ -472,7 +813,7 @@ async function provisionMetalGuest(profile, claim, exec) {
   const conflictingName = manifests.find((row) => row.name === name && row.computeKey !== claim.computeKey);
   if (conflictingName)
     throw new MetalProvisionError("requested guest name is already allocated");
-  const manifestPath = join(profile.stateDir, `${name}.json`);
+  const manifestPath = join2(profile.stateDir, `${name}.json`);
   const prior = manifests.find((row) => row.computeKey === claim.computeKey);
   if (prior && prior.reference !== claim.spec.reference)
     throw new MetalProvisionError("compute identity conflicts with host inventory");
@@ -489,7 +830,7 @@ async function provisionMetalGuest(profile, claim, exec) {
     allowedMemoryNodes: cpuPool.memoryNodes,
     phase: "allocating"
   };
-  const save = () => writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}
+  const save = () => writeFileSync2(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `, { mode: 384 });
   save();
   const lv = `/dev/${profile.volumeGroup}/${name}`;
@@ -501,11 +842,11 @@ async function provisionMetalGuest(profile, claim, exec) {
     manifest.phase = "image-ready";
     save();
   }
-  const seedBase = join(profile.seedDir, name);
+  const seedBase = join2(profile.seedDir, name);
   const init = cloudInit(profile, claim, manifest);
-  writeFileSync(`${seedBase}-user-data`, init.userData, { mode: 384 });
-  writeFileSync(`${seedBase}-meta-data`, init.metaData, { mode: 384 });
-  writeFileSync(`${seedBase}-network-config`, init.networkConfig, { mode: 384 });
+  writeFileSync2(`${seedBase}-user-data`, init.userData, { mode: 384 });
+  writeFileSync2(`${seedBase}-meta-data`, init.metaData, { mode: 384 });
+  writeFileSync2(`${seedBase}-network-config`, init.networkConfig, { mode: 384 });
   const seed = `${seedBase}-seed.iso`;
   await checked(exec, [
     "cloud-localds",
@@ -537,9 +878,9 @@ async function provisionMetalGuest(profile, claim, exec) {
     throw new MetalProvisionError("confidential compute requested but host SNP profile is absent");
   }
   const service = `forgezero-guest@${name}.service`;
-  const unitPath = join(profile.unitDir, service);
-  mkdirSync(dirname(unitPath), { recursive: true });
-  writeFileSync(unitPath, guestUnit(spec), { mode: 420 });
+  const unitPath = join2(profile.unitDir, service);
+  mkdirSync2(dirname(unitPath), { recursive: true });
+  writeFileSync2(unitPath, guestUnit(spec), { mode: 420 });
   await checked(exec, ["systemctl", "daemon-reload"]);
   if (prior?.phase === "running") {
     await checked(exec, ["systemctl", "restart", service]);
@@ -555,11 +896,11 @@ function legacyPlatformManifest(profile, claim, name) {
   if (claim.bootstrap?.kind !== "platform-genesis" || claim.computeKey !== `platform:${name}` || claim.spec.reference !== `platform:${name}` || claim.spec.guestAddress === undefined)
     return;
   const legacyDir = profile.legacyStateDir ?? "/etc/forgezero/guests";
-  const legacyPath = join(legacyDir, `${name}.conf`);
-  if (!existsSync(legacyPath))
+  const legacyPath = join2(legacyDir, `${name}.conf`);
+  if (!existsSync2(legacyPath))
     return;
   const values = new Map;
-  for (const line of readFileSync(legacyPath, "utf8").split(/\r?\n/)) {
+  for (const line of readFileSync2(legacyPath, "utf8").split(/\r?\n/)) {
     if (!line || line.startsWith("#"))
       continue;
     const match = /^([A-Z][A-Z0-9_]*)=([^\s'"`$;|&<>]+)$/.exec(line);
@@ -589,13 +930,13 @@ async function removeMetalGuest(profile, claim, exec) {
   if (claim.action !== "delete")
     throw new MetalProvisionError("create claim cannot remove a guest");
   const name = claim.spec.guestName ?? guestNameFor(claim.computeKey);
-  const manifestPath = join(profile.stateDir, `${name}.json`);
+  const manifestPath = join2(profile.stateDir, `${name}.json`);
   const service = `forgezero-guest@${name}.service`;
-  const unitPath = join(profile.unitDir, service);
+  const unitPath = join2(profile.unitDir, service);
   const lv = `/dev/${profile.volumeGroup}/${name}`;
-  const manifest = existsSync(manifestPath) ? JSON.parse(readFileSync(manifestPath, "utf8")) : legacyPlatformManifest(profile, claim, name);
+  const manifest = existsSync2(manifestPath) ? JSON.parse(readFileSync2(manifestPath, "utf8")) : legacyPlatformManifest(profile, claim, name);
   if (!manifest) {
-    const seedBase = join(profile.seedDir, name);
+    const seedBase = join2(profile.seedDir, name);
     const localArtifacts = [
       unitPath,
       `${seedBase}-seed.iso`,
@@ -603,7 +944,7 @@ async function removeMetalGuest(profile, claim, exec) {
       `${seedBase}-meta-data`,
       `${seedBase}-network-config`
     ];
-    if (localArtifacts.some(existsSync)) {
+    if (localArtifacts.some(existsSync2)) {
       throw new MetalProvisionError("guest artifacts exist without owned inventory");
     }
     const [volume, active] = await Promise.all([
@@ -620,7 +961,7 @@ async function removeMetalGuest(profile, claim, exec) {
   if (!currentIdentity && !legacyPlatformIdentity) {
     throw new MetalProvisionError("compute identity conflicts with host inventory");
   }
-  if (existsSync(unitPath))
+  if (existsSync2(unitPath))
     await checked(exec, ["systemctl", "disable", "--now", service]);
   else if (legacyPlatformIdentity)
     await checked(exec, ["systemctl", "disable", "--now", service]);
@@ -629,23 +970,23 @@ async function removeMetalGuest(profile, claim, exec) {
   }
   if ((await exec(["lvs", "--noheadings", lv])).exitCode === 0)
     await checked(exec, ["lvremove", "-fy", lv]);
-  for (const path of [
+  for (const path2 of [
     unitPath,
-    join(profile.seedDir, `${name}-seed.iso`),
-    join(profile.seedDir, `${name}-user-data`),
-    join(profile.seedDir, `${name}-meta-data`),
-    join(profile.seedDir, `${name}-network-config`),
+    join2(profile.seedDir, `${name}-seed.iso`),
+    join2(profile.seedDir, `${name}-user-data`),
+    join2(profile.seedDir, `${name}-meta-data`),
+    join2(profile.seedDir, `${name}-network-config`),
     manifestPath
   ])
-    if (existsSync(path))
-      unlinkSync(path);
+    if (existsSync2(path2))
+      unlinkSync2(path2);
   if (legacyPlatformIdentity) {
-    const legacyConfig = join(profile.legacyStateDir ?? "/etc/forgezero/guests", `${name}.conf`);
-    const legacyDropIn = join(profile.unitDir, `${service}.d`);
-    if (existsSync(legacyConfig))
-      unlinkSync(legacyConfig);
-    if (existsSync(legacyDropIn))
-      rmSync(legacyDropIn, { recursive: true });
+    const legacyConfig = join2(profile.legacyStateDir ?? "/etc/forgezero/guests", `${name}.conf`);
+    const legacyDropIn = join2(profile.unitDir, `${service}.d`);
+    if (existsSync2(legacyConfig))
+      unlinkSync2(legacyConfig);
+    if (existsSync2(legacyDropIn))
+      rmSync2(legacyDropIn, { recursive: true });
   }
   await checked(exec, ["systemctl", "daemon-reload"]);
   return {};