@forgezero/agent 0.1.65 → 0.1.68

package/dist/platform-fleet-verification.js

@@ -699,7 +699,30 @@ var BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cb
 var ARANGO_SHA256 = "b5a9197b4343f2ed554e1ebc1ef8e6529c7c39cde0035cdc311a4747a3355066";
 var CLOUDFLARED_SHA256 = "9d71c677db00134c1bd4144b7783486b654ad281b1ea62b4972098d19f770f17";
 var OS_CATALOG = [
-  { id: "ubuntu", version: "26.04", architecture: "x64", status: "active" }
+  {
+    id: "ubuntu",
+    version: "26.04",
+    architecture: "x64",
+    status: "active",
+    imageKey: "ubuntu-resolute-20260731",
+    imageLabel: "Ubuntu 26.04 LTS Resolute",
+    imageVersion: "2026-07-31",
+    imageUrl: "https://cloud-images.ubuntu.com/releases/resolute/release-20260731/ubuntu-26.04-server-cloudimg-amd64.img",
+    imageSha256: "9dc7c5363c0146a08ba0c9aa834d82c2c6dfbb1c471ad9a2f0aba1189e21be05",
+    confidentialModes: ["sev-snp"]
+  },
+  {
+    id: "ubuntu",
+    version: "24.04",
+    architecture: "x64",
+    status: "active",
+    imageKey: "ubuntu-noble-20260705",
+    imageLabel: "Ubuntu 24.04 LTS Noble",
+    imageVersion: "2026-07-05",
+    imageUrl: "https://cloud-images.ubuntu.com/releases/noble/release-20260705/ubuntu-24.04-server-cloudimg-amd64.img",
+    imageSha256: "ffe6203da54deeb6db5d2a98a83f9ec8e55f149d3f7ba622e1abe5fa966ee3d6",
+    confidentialModes: []
+  }
 ];
 var SOFTWARE_CATALOG = [
   { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
@@ -710,7 +733,12 @@ var SOFTWARE_CATALOG = [
   { id: "cloudflare-warp", version: "2026.6.822.0-min", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
 ];
 var UBUNTU_2604_X64 = [
   { requirement: { id: "bun", version: "1.3.14" } },
@@ -723,6 +751,15 @@ var UBUNTU_2604_X64 = [
   { requirement: { id: "openssh-client", version: "ubuntu-26.04" } },
   { requirement: { id: "git", version: "ubuntu-26.04" } }
 ];
+var UBUNTU_2404_X64 = [
+  { requirement: { id: "bun", version: "1.3.14" } },
+  { requirement: { id: "docker", version: "ubuntu-24.04" } },
+  { requirement: { id: "nginx", version: "ubuntu-24.04" } },
+  { requirement: { id: "ufw", version: "ubuntu-24.04" } },
+  { requirement: { id: "openssh-client", version: "ubuntu-24.04" } },
+  { requirement: { id: "git", version: "ubuntu-24.04" } }
+];
+var strategiesFor = (observation) => observation.os.id === "ubuntu" && observation.architecture === "x64" ? observation.os.versionId === "26.04" ? UBUNTU_2604_X64 : observation.os.versionId === "24.04" ? UBUNTU_2404_X64 : undefined : undefined;
 var path = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 var DOCKER_DAEMON_PATH = "/etc/docker/daemon.json";
 var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
@@ -769,7 +806,7 @@ var aptInstall = async (name) => {
 };
 async function executeSoftwareOperation(operation) {
   const { software, version } = operation;
-  if (!UBUNTU_2604_X64.some(({ requirement }) => requirement.id === software && requirement.version === version)) {
+  if (![...UBUNTU_2604_X64, ...UBUNTU_2404_X64].some(({ requirement }) => requirement.id === software && requirement.version === version)) {
     return { exitCode: 2, output: "unsupported software operation" };
   }
   if (operation.kind === "check") {
@@ -939,7 +976,7 @@ async function ensureSoftwareRequirements(requirementsInput, options) {
   }
   const results = [];
   for (const requirement of requirements) {
-    const strategy = UBUNTU_2604_X64.find(({ requirement: candidate }) => candidate.id === requirement.id && candidate.version === requirement.version);
+    const strategy = strategiesFor(observation)?.find(({ requirement: candidate }) => candidate.id === requirement.id && candidate.version === requirement.version);
     if (!strategy)
       throw new Error(`unsupported software requirement: ${requirement.id}@${requirement.version}`);
     const before = await options.exec({ kind: "check", software: requirement.id, version: requirement.version });
@@ -2088,7 +2125,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.65";
+var VERSION3 = "0.1.68";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -3075,6 +3112,146 @@ function planProvision(options) {
   };
 }
 
+// src/ubuntu.ts
+var current = OS_CATALOG[0];
+var SUPPORTED_GUEST_IMAGE = Object.freeze({
+  key: current.imageKey,
+  family: `${current.id}-${current.version}`,
+  version: current.imageVersion,
+  label: current.imageLabel,
+  url: current.imageUrl,
+  sha256: current.imageSha256
+});
+var SUPPORTED_GUEST_IMAGES = Object.freeze(OS_CATALOG.filter(({ status }) => status === "active").map(({ id, imageKey, imageLabel, imageVersion, version, confidentialModes }) => ({
+  key: imageKey,
+  label: imageLabel,
+  family: `${id}-${version}`,
+  version: imageVersion,
+  confidential: confidentialModes.some((mode) => mode === "sev-snp")
+})));
+function supportedGuestImage(imageKey) {
+  return SUPPORTED_GUEST_IMAGES.find(({ key }) => key === imageKey);
+}
+function assertSupportedGuestImage(imageKey, confidential = false) {
+  const selected = OS_CATALOG.find((entry) => entry.status === "active" && entry.imageKey === imageKey);
+  if (!selected) {
+    throw new Error(`unsupported guest image ${imageKey}; supported images: ${SUPPORTED_GUEST_IMAGES.map(({ key }) => key).join(", ")}`);
+  }
+  if (confidential && !selected.confidentialModes.some((mode) => mode === "sev-snp")) {
+    throw new Error(`guest image ${imageKey} is not approved for SEV-SNP`);
+  }
+}
+
+// src/platform-genesis.ts
+var SAFE_NAME = /^[a-z][a-z0-9-]{0,62}$/;
+var SAFE_POOL = /^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$/;
+var PRIVATE_V4 = /^(?:10\.(?:\d{1,3}\.){2}\d{1,3}|192\.168\.(?:\d{1,3})\.(?:\d{1,3})|172\.(?:1[6-9]|2\d|3[01])\.(?:\d{1,3})\.(?:\d{1,3}))$/;
+var integer = (value, minimum, maximum, label) => {
+  if (!Number.isInteger(value) || value < minimum || value > maximum) {
+    throw new Error(`platform genesis ${label} is outside the supported range`);
+  }
+  return value;
+};
+function validatePlatformGenesisGuests(guests, expectedCount = 3) {
+  if (!Array.isArray(guests) || guests.length !== expectedCount) {
+    throw new Error(`platform genesis requires exactly ${expectedCount} reviewed guest requests`);
+  }
+  const names = new Set;
+  const addresses = new Set;
+  const pools = new Set;
+  return guests.map((input) => {
+    if (!input || typeof input !== "object" || !SAFE_NAME.test(input.name)) {
+      throw new Error("platform genesis guest name is malformed");
+    }
+    if (!PRIVATE_V4.test(input.address))
+      throw new Error("platform genesis guest address must be private IPv4");
+    if (typeof input.confidential !== "boolean")
+      throw new Error("platform genesis confidential requirement is missing");
+    assertSupportedGuestImage(input.imageKey, input.confidential);
+    if (input.cpuPoolKey !== undefined && !SAFE_POOL.test(input.cpuPoolKey)) {
+      throw new Error("platform genesis CPU pool key is malformed");
+    }
+    if (names.has(input.name) || addresses.has(input.address) || input.cpuPoolKey !== undefined && pools.has(input.cpuPoolKey)) {
+      throw new Error("platform genesis guest names, addresses and explicit CPU pools must be unique");
+    }
+    names.add(input.name);
+    addresses.add(input.address);
+    if (input.cpuPoolKey !== undefined)
+      pools.add(input.cpuPoolKey);
+    const physicalCores = integer(input.physicalCores, 1, 256, "physical core count");
+    const vcpu = integer(input.vcpu, 1, 512, "vCPU count");
+    if (vcpu < physicalCores)
+      throw new Error("platform genesis vCPU count cannot be smaller than physical cores");
+    const memoryGib = integer(input.memoryGib, 1, 8192, "memory");
+    const diskGib = integer(input.diskGib, 8, 65536, "disk");
+    const egressGuaranteedMbps = integer(input.egressGuaranteedMbps, 0, 1e6, "guaranteed egress");
+    const egressBurstMbps = integer(input.egressBurstMbps, egressGuaranteedMbps, 1e6, "burst egress");
+    return {
+      name: input.name,
+      address: input.address,
+      imageKey: input.imageKey,
+      ...input.cpuPoolKey ? { cpuPoolKey: input.cpuPoolKey } : {},
+      physicalCores,
+      vcpu,
+      memoryGib,
+      diskGib,
+      egressGuaranteedMbps,
+      egressBurstMbps,
+      confidential: input.confidential
+    };
+  });
+}
+var publicKey = (value) => {
+  const normalized = value.trim();
+  if (!/^ssh-(?:ed25519|rsa) [A-Za-z0-9+/]+={0,3}(?: [^\r\n]+)?$/.test(normalized)) {
+    throw new Error("platform genesis SSH public key is malformed");
+  }
+  return normalized;
+};
+var claimFor = (guest, keys, action) => {
+  const common = {
+    computeKey: `platform:${guest.name}`,
+    claimToken: "offline-platform-genesis",
+    claimExpiresAtTs: Number.MAX_SAFE_INTEGER,
+    attempt: 1,
+    bootstrap: { kind: "platform-genesis" },
+    spec: {
+      reference: `platform:${guest.name}`,
+      imageKey: guest.imageKey,
+      guestName: guest.name,
+      guestAddress: guest.address,
+      ...guest.cpuPoolKey ? { cpuPoolKey: guest.cpuPoolKey } : {},
+      physicalCores: guest.physicalCores,
+      vcpu: guest.vcpu,
+      memoryGib: guest.memoryGib,
+      diskGib: guest.diskGib,
+      egressGuaranteedMbps: guest.egressGuaranteedMbps,
+      egressBurstMbps: guest.egressBurstMbps,
+      confidential: guest.confidential
+    }
+  };
+  if (action === "delete")
+    return { ...common, action: "delete" };
+  return { ...common, action: "create", access: { sshUser: "forgezero", sshPublicKeys: [...keys] } };
+};
+function platformGenesisClaims(guests, sshPublicKeys) {
+  const reviewed = validatePlatformGenesisGuests(guests);
+  const keys = [...new Set(sshPublicKeys.map(publicKey))];
+  if (keys.length === 0)
+    throw new Error("platform genesis requires at least one operator SSH public key");
+  return reviewed.map((guest) => claimFor(guest, keys, "create"));
+}
+function platformCommunityRehearsalClaims(seedGuests, rehearsalGuest, sshPublicKeys) {
+  const reviewed = validatePlatformGenesisGuests([...seedGuests, rehearsalGuest], 4);
+  const keys = [...new Set(sshPublicKeys.map(publicKey))];
+  if (keys.length === 0)
+    throw new Error("platform genesis requires at least one operator SSH public key");
+  return reviewed.map((guest) => claimFor(guest, keys, "create"));
+}
+function platformCommunityRehearsalDeletionClaims(seedGuests, rehearsalGuest) {
+  return validatePlatformGenesisGuests([...seedGuests, rehearsalGuest], 4).map((guest) => claimFor(guest, [], "delete"));
+}
+
 // src/platform-bootstrap-runtime.ts
 import {
   chmodSync as chmodSync5,
@@ -3123,6 +3300,50 @@ var httpsOrigin = (name, raw) => {
   }
   return value.origin;
 };
+function validatePlatformInitialInventory(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
+    throw new Error("initial platform inventory coordinates are invalid");
+  }
+  safeAtom("initialInventory.region.label", value.region.label);
+  if (value.region.city !== undefined)
+    safeAtom("initialInventory.region.city", value.region.city);
+  const computes = validatePlatformGenesisGuests(value.computes.map((compute) => {
+    if (!compute || typeof compute !== "object" || Array.isArray(compute) || Object.keys(compute).some((key) => ![
+      "name",
+      "address",
+      "imageKey",
+      "cpuPoolKey",
+      "physicalCores",
+      "vcpu",
+      "memoryGib",
+      "diskGib",
+      "egressGuaranteedMbps",
+      "egressBurstMbps",
+      "confidential",
+      "databaseRole",
+      "databaseAgency"
+    ].includes(key)))
+      throw new Error("initial platform compute contains unknown fields");
+    return compute;
+  }));
+  for (let index = 0;index < computes.length; index += 1) {
+    const declared = value.computes[index];
+    const expectedRole = index === 0 ? "master" : "joiner";
+    if (declared.databaseRole !== expectedRole || declared.databaseAgency !== "member" || declared.confidential !== true) {
+      throw new Error("initial platform inventory requires one master, two joiners, three Agency members and confidential compute");
+    }
+  }
+  return {
+    metalHostname: value.metalHostname,
+    region: { ...value.region },
+    computes: value.computes.map((compute, index) => ({
+      ...computes[index],
+      databaseRole: compute.databaseRole,
+      databaseAgency: compute.databaseAgency,
+      confidential: true
+    }))
+  };
+}
 var systemdValue = (name, raw) => {
   if (/[\0\r\n]/.test(raw))
     throw new Error(`${name} must be single-line.`);
@@ -3208,12 +3429,14 @@ function validatePlatformSharedEnvironment(input) {
       throw new Error("realtime.producer is invalid.");
     }
   }
+  const initialInventory = input.initialInventory ? validatePlatformInitialInventory(input.initialInventory) : undefined;
   return {
     ...input,
     databaseCoordinators: coordinators,
     appOrigin: httpsOrigin("appOrigin", input.appOrigin),
     apiOrigin: httpsOrigin("apiOrigin", input.apiOrigin),
-    agentOtlpEndpoint: httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint)
+    agentOtlpEndpoint: httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint),
+    ...initialInventory ? { initialInventory } : {}
   };
 }
 function renderPlatformSharedEnvironment(input) {
@@ -3276,7 +3499,8 @@ function renderPlatformSharedEnvironment(input) {
     FZ_CF_TUNNEL_SERVICE: value.cloudflare?.tunnelService ?? "",
     FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
     FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
-    FZ_REALTIME_PRODUCER: value.realtime?.producer ?? ""
+    FZ_REALTIME_PRODUCER: value.realtime?.producer ?? "",
+    FZ_PLATFORM_INITIAL_INVENTORY: value.initialInventory ? JSON.stringify(value.initialInventory) : ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
 ` + Object.entries(entries).map(([key, entry]) => `${key}=${systemdValue(key, entry)}`).join(`
@@ -3458,15 +3682,15 @@ var replaceLink = (path2, target) => {
   renameSync6(pending, path2);
 };
 var secureRelease = (path2, uid, gid) => {
-  const visit = (current) => {
-    const metadata = lstatSync(current);
+  const visit = (current2) => {
+    const metadata = lstatSync(current2);
     if (metadata.isSymbolicLink())
       throw new Error("release contains a symbolic link");
-    chownSync(current, uid, gid);
-    chmodSync5(current, metadata.isDirectory() ? 365 : 292);
+    chownSync(current2, uid, gid);
+    chmodSync5(current2, metadata.isDirectory() ? 365 : 292);
     if (metadata.isDirectory())
-      for (const name of readdirSync3(current))
-        visit(join5(current, name));
+      for (const name of readdirSync3(current2))
+        visit(join5(current2, name));
   };
   visit(path2);
 };
@@ -3719,11 +3943,11 @@ var runProvisionOperation = async (operation) => {
   }
   if (operation.kind === "ensure-git-identity") {
     const key = "/run/forgezero-git-deploy-key";
-    const publicKey = `${key}.pub`;
+    const publicKey2 = `${key}.pub`;
     try {
       if (!existsSync8(operation.credential) || lstatSync2(operation.credential).size < 1) {
         rmSync7(key, { force: true });
-        rmSync7(publicKey, { force: true });
+        rmSync7(publicKey2, { force: true });
         let result = await fixed(["/usr/bin/ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-C", "forgezero-compute", "-f", key]);
         if (result.exitCode !== 0)
           return result;
@@ -3747,7 +3971,7 @@ var runProvisionOperation = async (operation) => {
       return { stdout: "", exitCode: 0 };
     } finally {
       rmSync7(key, { force: true });
-      rmSync7(publicKey, { force: true });
+      rmSync7(publicKey2, { force: true });
     }
   }
   if (operation.kind === "ensure-bootstrap-ssh-identity") {
@@ -3941,7 +4165,7 @@ import { dirname as dirname8, isAbsolute, resolve as resolve6 } from "node:path"
 var BOOTSTRAP_BUNDLE_FORMAT = 1;
 var BOOTSTRAP_BUNDLE_KIND = "forgezero-api-git-bundle";
 var MAX_BOOTSTRAP_BUNDLE_BYTES = 512 * 1024 * 1024;
-var branchName = (value) => {
+var bootstrapBundleBranch = (value) => {
   if (typeof value !== "string" || !/^[A-Za-z0-9](?:[A-Za-z0-9._/-]{0,126}[A-Za-z0-9])?$/.test(value) || value.includes("..") || value.includes("//") || value.startsWith("-")) {
     throw new Error("bootstrap bundle branch is malformed");
   }
@@ -3958,7 +4182,7 @@ function parseBootstrapBundleManifest(value) {
   if (source.format !== BOOTSTRAP_BUNDLE_FORMAT || source.kind !== BOOTSTRAP_BUNDLE_KIND) {
     throw new Error("bootstrap bundle manifest format is unsupported");
   }
-  branchName(source.branch);
+  bootstrapBundleBranch(source.branch);
   if (typeof source.revision !== "string" || !/^[a-f0-9]{40}$/.test(source.revision)) {
     throw new Error("bootstrap bundle revision must be an exact lowercase Git commit");
   }

package/dist/platform-genesis-config.d.ts

@@ -1,7 +1,13 @@
 import { type PlatformBootstrapConfig } from './bootstrap';
+import { type PlatformGenesisGuest } from './platform-genesis';
 export interface PlatformGenesisNodeConfigInput {
     nodeHostname: string;
     cloudflareHandoffFile: string;
 }
+export interface PlatformGenesisRegionInput {
+    label: string;
+    country: string;
+    city?: string;
+}
 /** Expand one reviewed common template into the exact three genesis hosts. */
-export declare function platformGenesisBootstrapConfigs(template: PlatformBootstrapConfig, nodes: readonly PlatformGenesisNodeConfigInput[]): readonly PlatformBootstrapConfig[];
+export declare function platformGenesisBootstrapConfigs(template: PlatformBootstrapConfig, guests: readonly PlatformGenesisGuest[], nodes: readonly PlatformGenesisNodeConfigInput[], metalHostname: string, region: PlatformGenesisRegionInput): readonly PlatformBootstrapConfig[];

package/dist/platform-genesis.d.ts

@@ -1,28 +1,27 @@
 import type { RemoteProvisionClaim } from './provisioning-pull';
-export declare const PLATFORM_GENESIS_ENVIRONMENTS: readonly ["production", "development"];
-export type PlatformGenesisEnvironment = (typeof PLATFORM_GENESIS_ENVIRONMENTS)[number];
+/**
+ * One reviewed guest request. The Metal Agent does not know or infer an
+ * environment, product tier, tenant, or development shape: all differences are
+ * desired-state coordinates supplied by the same authority that requests the
+ * compute.
+ */
 export interface PlatformGenesisGuest {
     name: string;
     address: string;
-    cpuPoolKey: string;
+    imageKey: string;
+    cpuPoolKey?: string;
     physicalCores: number;
     vcpu: number;
     memoryGib: number;
     diskGib: number;
     egressGuaranteedMbps: number;
     egressBurstMbps: number;
+    confidential: boolean;
 }
-/** Package-owned provisioning coordinates for the exact three-node platform seed. */
-export declare const PLATFORM_GENESIS_FLEETS: Record<PlatformGenesisEnvironment, readonly PlatformGenesisGuest[]>;
-/**
- * The disposable Community acceptance fleet adds one ordinary post-genesis
- * Coordinator/DBServer host. It is deliberately not part of the three-member
- * platform seed and never acquires Agency authority from this provisioning
- * claim. The rehearsal controller installs that database role later.
- */
-export declare const DEVELOPMENT_COMMUNITY_REHEARSAL_GUEST: PlatformGenesisGuest;
-export declare function platformGenesisClaims(environment: PlatformGenesisEnvironment, sshPublicKeys: readonly string[]): readonly RemoteProvisionClaim[];
-/** Exact disposable four-host development fleet: three seed guests plus n4. */
-export declare function platformCommunityRehearsalClaims(sshPublicKeys: readonly string[]): readonly RemoteProvisionClaim[];
-/** Exact inverse of the disposable four-host rehearsal claims. */
-export declare function platformCommunityRehearsalDeletionClaims(sshPublicKeys: readonly string[]): readonly RemoteProvisionClaim[];
+export declare function validatePlatformGenesisGuests(guests: readonly PlatformGenesisGuest[], expectedCount?: number): readonly PlatformGenesisGuest[];
+/** Convert reviewed desired state into the ordinary Metal provisioning claim. */
+export declare function platformGenesisClaims(guests: readonly PlatformGenesisGuest[], sshPublicKeys: readonly string[]): readonly RemoteProvisionClaim[];
+/** Add one explicitly reviewed disposable node to the same three guest requests. */
+export declare function platformCommunityRehearsalClaims(seedGuests: readonly PlatformGenesisGuest[], rehearsalGuest: PlatformGenesisGuest, sshPublicKeys: readonly string[]): readonly RemoteProvisionClaim[];
+/** Exact inverse of the reviewed disposable four-host request. */
+export declare function platformCommunityRehearsalDeletionClaims(seedGuests: readonly PlatformGenesisGuest[], rehearsalGuest: PlatformGenesisGuest): readonly RemoteProvisionClaim[];