@forgezero/agent 0.1.73 → 0.1.75

package/dist/fz.js

@@ -4634,7 +4634,7 @@ var VaultError, runtimeEnvironment = () => typeof process !== "undefined" && pro
   } catch {
     return;
   }
-}, VERSION = "0.1.13";
+}, VERSION = "0.1.15";
 var init_dist = __esm(() => {
   init_identity();
   VaultError = class VaultError extends Error {
@@ -4829,7 +4829,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.73";
+var VERSION2 = "0.1.75";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -4863,6 +4863,8 @@ var OS_CATALOG = [
 var SOFTWARE_CATALOG = [
   { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "docker", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "kata-containers", version: "4.0.0", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "nginx", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "arangodb", version: "3.11.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
@@ -4871,6 +4873,7 @@ var SOFTWARE_CATALOG = [
   { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "docker", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "nginx", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "ufw", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "openssh-client", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
@@ -4895,7 +4898,7 @@ function validateSoftwareRequirements(value, _options = {}) {
     if (Object.keys(row).some((key) => key !== "id" && key !== "version")) {
       throw new Error("software requirement contains an unknown field");
     }
-    if (!["bun", "docker", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client", "git"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
+    if (!["bun", "docker", "containerd", "kata-containers", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client", "git"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
       throw new Error("software requirement coordinate is invalid");
     }
     const requirement = { id: row.id, version: row.version };
@@ -10399,6 +10402,13 @@ function validateBuiltInAction(definition, context, where) {
       throw new Error(`${where}.with.requirements must name existing requirements`);
     return;
   }
+  if (definition.uses === "forgezero.network/ensure@1") {
+    exact(withValue, ["target"], `${where}.with`);
+    if (typeof withValue.target !== "string" || !Object.values(context.components).some((entry) => entry.target === withValue.target)) {
+      throw new Error(`${where}.with.target must name a target used by a component`);
+    }
+    return;
+  }
   if (definition.uses === "forgezero.exec/argv@1") {
     const allowed = ["component", "argv", "credentials"];
     const unknown = Object.keys(withValue).filter((key) => !allowed.includes(key));
@@ -10454,6 +10464,8 @@ function validateBuiltInProvider(requirement2, where) {
   const expected = {
     "forgezero.bun": { capability: "runtime.javascript", versions: ["1.3.14"], keys: ["installScope"] },
     "forgezero.docker": { capability: "runtime.container", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "storageDriver", "dataRoot", "liveRestore", "logDriver", "defaultNetwork", "rootless"] },
+    "forgezero.containerd": { capability: "runtime.container", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "runtimeClass", "namespace", "snapshotter"] },
+    "forgezero.kata": { capability: "runtime.container", versions: ["4.0.0"], keys: ["installScope", "runtimeClass", "namespace", "hypervisor", "confidentialGuest"] },
     "forgezero.nginx": { capability: "proxy.http", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "websocket", "maximumBodyMiB", "workerProcesses", "workerConnections"] },
     "forgezero.arangodb": { capability: "database.arangodb", versions: ["3.11.14"], keys: ["installScope", "runtime", "dataPath", "bind"] },
     "forgezero.cloudflared": { capability: "network.public-tunnel", versions: ["2026.7.3"], keys: ["installScope", "mode"] },
@@ -10474,6 +10486,10 @@ function validateBuiltInProvider(requirement2, where) {
     if (row2.storageDriver !== "overlay2" || row2.dataRoot !== "/var/lib/docker" || row2.liveRestore !== true || row2.logDriver !== "local" || row2.defaultNetwork !== "bridge" || row2.rootless !== false)
       throw new Error(`${where} Docker config is unsupported by the fixed host strategy`);
   }
+  if (requirement2.provider === "forgezero.containerd" && (row2.runtimeClass !== "runc" || row2.namespace !== "forgezero" || row2.snapshotter !== "overlayfs"))
+    throw new Error(`${where} containerd config is unsupported by the fixed host strategy`);
+  if (requirement2.provider === "forgezero.kata" && (row2.runtimeClass !== "kata-qemu-snp" || row2.namespace !== "forgezero" || row2.hypervisor !== "qemu" || row2.confidentialGuest !== "sev-snp"))
+    throw new Error(`${where} Kata config is unsupported by the fixed host strategy`);
   if (requirement2.provider === "forgezero.nginx" && (typeof row2.websocket !== "boolean" || !Number.isInteger(row2.maximumBodyMiB) || Number(row2.maximumBodyMiB) < 1 || Number(row2.maximumBodyMiB) > 1024 || !(row2.workerProcesses === "auto" || Number.isInteger(row2.workerProcesses)) || !Number.isInteger(row2.workerConnections)))
     throw new Error(`${where} Nginx config is invalid`);
   if (requirement2.provider === "forgezero.arangodb" && (row2.runtime !== "native" || !absolute(row2.dataPath) || row2.bind !== "private"))
@@ -10551,7 +10567,7 @@ function reference(value, where) {
   const row2 = object(value, where);
   exact3(row2, ["$ref"], where);
   const coordinate = boundedString(row2.$ref, `${where}.$ref`, 256);
-  if (!/^(inputs\.[a-z][A-Za-z0-9-]{0,62}|steps\.[a-z][A-Za-z0-9-]{0,62}\.(status|outputs\.[a-z][A-Za-z0-9-]{0,62})|components\.[a-z][A-Za-z0-9-]{0,62}\.[a-z][A-Za-z0-9-]{0,62}|targets\.[a-z][A-Za-z0-9-]{0,62}\.[a-z][A-Za-z0-9-]{0,62}|deployment\.[a-z][A-Za-z0-9-]{0,62})$/.test(coordinate)) {
+  if (!/^(inputs\.[a-z][A-Za-z0-9-]{0,62}|steps\.[a-z][A-Za-z0-9-]{0,62}\.(status|outputs\.[a-z][A-Za-z0-9-]{0,62})|components\.[a-z][A-Za-z0-9-]{0,62}\.[a-z][A-Za-z0-9-]{0,62}|targets\.[a-z][A-Za-z0-9-]{0,62}\.[a-z][A-Za-z0-9-]{0,62}|deployment\.[a-z][A-Za-z0-9-]{0,62}|execution\.(targetName|slot|releaseExecutor|runtime|cpuCores|memoryMiB|storageGiB))$/.test(coordinate)) {
     fail2(where, "contains an unsupported reference.");
   }
   return { $ref: coordinate };
@@ -10791,10 +10807,9 @@ function validateNetwork(value, where) {
       named(container.network, `${where}.container.network`);
   }
 }
-function validateComponent(value, where, targetNames, requirements) {
+function validateComponent(value, where, targets, requirements) {
   const row2 = object(value, where);
-  if (!targetNames.has(String(row2.target)))
-    fail2(`${where}.target`, "must name an existing target.");
+  const selectedTarget = targets.get(String(row2.target)) ?? fail2(`${where}.target`, "must name an existing target.");
   if (row2.kind === "application") {
     exact3(row2, ["kind", "target", "runtime", "service", "resources", "storage", "network", "rollout"], where);
     const runtime = object(row2.runtime, `${where}.runtime`);
@@ -10805,7 +10820,9 @@ function validateComponent(value, where, targetNames, requirements) {
       exact3(runtime, ["kind", "provider", "requirement", "argv"], `${where}.runtime`);
       validateArgv(runtime.argv, `${where}.runtime.argv`);
     } else if (runtime.kind === "container") {
-      exact3(runtime, ["kind", "provider", "requirement", "image", "entrypoint", "security"], `${where}.runtime`);
+      exact3(runtime, ["kind", "provider", "requirement", "runtimeClass", "image", "entrypoint", "security"], `${where}.runtime`);
+      if (runtime.runtimeClass !== undefined && !["runc", "kata-qemu-snp"].includes(String(runtime.runtimeClass)))
+        fail2(`${where}.runtime.runtimeClass`, "is unsupported.");
       const image = object(runtime.image, `${where}.runtime.image`);
       exact3(image, ["source"], `${where}.runtime.image`);
       const source = object(image.source, `${where}.runtime.image.source`);
@@ -10839,6 +10856,23 @@ function validateComponent(value, where, targetNames, requirements) {
       fail2(`${where}.runtime.requirement`, "must provide runtime.container.");
     if (runtimeRequirement && runtime.kind === "native" && !runtimeRequirement.capability.startsWith("runtime."))
       fail2(`${where}.runtime.requirement`, "must provide a runtime capability.");
+    const execution = selectedTarget.allocation.execution;
+    if (execution === "native" && runtime.kind !== "native")
+      fail2(`${where}.runtime.kind`, "must be native for the selected target.");
+    if (execution !== "native" && runtime.kind !== "container")
+      fail2(`${where}.runtime.kind`, "must be container for the selected target.");
+    if (runtime.kind === "container" && execution === "oci-runc") {
+      if (!["forgezero.containerd", "forgezero.docker"].includes(String(runtime.provider)))
+        fail2(`${where}.runtime.provider`, "must be forgezero.containerd for an OCI runc target.");
+      if (runtime.runtimeClass !== undefined && runtime.runtimeClass !== "runc")
+        fail2(`${where}.runtime.runtimeClass`, "must be runc for the selected target.");
+    }
+    if (runtime.kind === "container" && execution === "oci-kata-qemu-snp") {
+      if (runtime.provider !== "forgezero.kata")
+        fail2(`${where}.runtime.provider`, "must be forgezero.kata for a Kata QEMU SNP target.");
+      if (runtime.runtimeClass !== "kata-qemu-snp")
+        fail2(`${where}.runtime.runtimeClass`, "must be kata-qemu-snp for the selected target.");
+    }
     const service = object(row2.service, `${where}.service`);
     exact3(service, ["protocol", "port", "health", "websocket", "maximumConnections"], `${where}.service`);
     if (service.protocol !== "http")
@@ -10870,6 +10904,18 @@ function validateComponent(value, where, targetNames, requirements) {
       const network = object(row2.network, `${where}.network`);
       if (network.container === undefined)
         fail2(`${where}.network.container`, "must select bridge or reviewed host networking.");
+      if (selectedTarget.allocation.sharing === "shared") {
+        if (object(runtime.security, `${where}.runtime.security`).root !== "read-only")
+          fail2(`${where}.runtime.security.root`, "must be read-only on a shared compute.");
+        if (network.container.mode !== "bridge")
+          fail2(`${where}.network.container.mode`, "must be bridge on a shared compute.");
+        if (Array.isArray(row2.storage) && row2.storage.some((mount) => mount.class !== "ephemeral")) {
+          fail2(`${where}.storage`, "may contain only size-bounded tmpfs mounts on a shared compute.");
+        }
+      }
+    }
+    if (runtime.kind === "native" && selectedTarget.allocation.sharing !== "exclusive") {
+      fail2(`${where}.target`, "native applications require an exclusive compute.");
     }
     if (row2.storage !== undefined) {
       if (!Array.isArray(row2.storage) || row2.storage.length > 32)
@@ -10906,6 +10952,8 @@ function validateComponent(value, where, targetNames, requirements) {
       fail2(`${where}.runtime.mode`, "must match the provider runtime mode.");
     if (runtime.mode !== "native")
       fail2(`${where}.runtime.mode`, "must be native in deployment plan v1.");
+    if (selectedTarget.allocation.execution !== "native")
+      fail2(`${where}.target`, "must select a native execution target for database components.");
     const topology = object(row2.topology, `${where}.topology`);
     if (topology.mode === "standalone")
       exact3(topology, ["mode"], `${where}.topology`);
@@ -11102,15 +11150,20 @@ function compileDeployment(sourceValue) {
   if (targetEntries.length < 1 || targetEntries.length > 64)
     fail2("deployment.spec.targets", "must contain 1 to 64 targets.");
   const targetNames = new Set(targetEntries.map(([targetName]) => named(targetName, "deployment.spec.targets key")));
+  const targetDefinitions = new Map;
   for (const [targetName, value] of targetEntries) {
     const target = object(value, `deployment.spec.targets.${targetName}`);
-    exact3(target, ["kind", "selector", "cardinality", "placement"], `deployment.spec.targets.${targetName}`);
+    exact3(target, ["kind", "selector", "cardinality", "allocation", "provisioning", "connectivity", "placement"], `deployment.spec.targets.${targetName}`);
     if (target.kind !== "compute")
       fail2(`deployment.spec.targets.${targetName}.kind`, "must be compute.");
     const selector = object(target.selector, `deployment.spec.targets.${targetName}.selector`);
-    exact3(selector, ["profiles", "confidentialCompute", "labels"], `deployment.spec.targets.${targetName}.selector`);
+    exact3(selector, ["profiles", "operatingSystem", "confidentialCompute", "labels"], `deployment.spec.targets.${targetName}.selector`);
     if (!Array.isArray(selector.profiles) || selector.profiles.length < 1 || selector.profiles.length > 32 || selector.profiles.some((profile) => typeof profile !== "string" || !NAME3.test(profile)) || new Set(selector.profiles).size !== selector.profiles.length)
       fail2(`deployment.spec.targets.${targetName}.selector.profiles`, "is invalid.");
+    const operatingSystem = object(selector.operatingSystem, `deployment.spec.targets.${targetName}.selector.operatingSystem`);
+    exact3(operatingSystem, ["id", "version", "architecture"], `deployment.spec.targets.${targetName}.selector.operatingSystem`);
+    if (operatingSystem.id !== "ubuntu" || !["24.04", "26.04"].includes(String(operatingSystem.version)) || operatingSystem.architecture !== "x64")
+      fail2(`deployment.spec.targets.${targetName}.selector.operatingSystem`, "is unsupported.");
     if (selector.confidentialCompute !== undefined && !["required", "preferred", "disabled"].includes(String(selector.confidentialCompute)))
       fail2(`deployment.spec.targets.${targetName}.selector.confidentialCompute`, "is unsupported.");
     if (selector.labels !== undefined)
@@ -11123,8 +11176,108 @@ function compileDeployment(sourceValue) {
       integer(cardinality.desired, `deployment.spec.targets.${targetName}.cardinality.desired`, minimum, maximum);
     else
       reference(cardinality.desired, `deployment.spec.targets.${targetName}.cardinality.desired`);
+    const allocation = object(target.allocation, `deployment.spec.targets.${targetName}.allocation`);
+    exact3(allocation, ["execution", "sharing", "resources", "existing"], `deployment.spec.targets.${targetName}.allocation`);
+    if (!["native", "oci-runc", "oci-kata-qemu-snp"].includes(String(allocation.execution)))
+      fail2(`deployment.spec.targets.${targetName}.allocation.execution`, "is unsupported.");
+    if (!["exclusive", "shared"].includes(String(allocation.sharing)))
+      fail2(`deployment.spec.targets.${targetName}.allocation.sharing`, "is unsupported.");
+    if (!["prefer", "require"].includes(String(allocation.existing)))
+      fail2(`deployment.spec.targets.${targetName}.allocation.existing`, "is unsupported.");
+    const capacity = object(allocation.resources, `deployment.spec.targets.${targetName}.allocation.resources`);
+    exact3(capacity, ["cpuCores", "memoryMiB", "storageGiB"], `deployment.spec.targets.${targetName}.allocation.resources`);
+    const capacityValue = (value2, where, minimumValue, maximumValue) => {
+      if (typeof value2 === "number")
+        integer(value2, where, minimumValue, maximumValue);
+      else
+        reference(value2, where);
+    };
+    capacityValue(capacity.cpuCores, `deployment.spec.targets.${targetName}.allocation.resources.cpuCores`, 1, 1024);
+    capacityValue(capacity.memoryMiB, `deployment.spec.targets.${targetName}.allocation.resources.memoryMiB`, 128, 4194304);
+    capacityValue(capacity.storageGiB, `deployment.spec.targets.${targetName}.allocation.resources.storageGiB`, 1, 1048576);
+    if (allocation.execution === "oci-kata-qemu-snp" && selector.confidentialCompute !== "required")
+      fail2(`deployment.spec.targets.${targetName}.selector.confidentialCompute`, "must be required for Kata QEMU SNP.");
+    if ((allocation.execution === "oci-kata-qemu-snp" || selector.confidentialCompute === "required") && operatingSystem.version !== "26.04")
+      fail2(`deployment.spec.targets.${targetName}.selector.operatingSystem.version`, "must be Ubuntu 26.04 for SEV-SNP.");
+    if (allocation.execution !== "oci-kata-qemu-snp" && selector.confidentialCompute === "required" && allocation.execution !== "native")
+      fail2(`deployment.spec.targets.${targetName}.allocation.execution`, "cannot satisfy required confidential compute.");
+    if (target.provisioning !== undefined) {
+      const provisioning = object(target.provisioning, `deployment.spec.targets.${targetName}.provisioning`);
+      exact3(provisioning, ["planKey", "regionKey", "imageKey", "environmentKey", "ownership", "metalHostname", "maxMonthlySpendMinor"], `deployment.spec.targets.${targetName}.provisioning`);
+      for (const key of ["planKey", "regionKey", "imageKey", "environmentKey"])
+        named(provisioning[key], `deployment.spec.targets.${targetName}.provisioning.${key}`);
+      if (!["platform", "tenant-metal"].includes(String(provisioning.ownership)) || provisioning.ownership === "tenant-metal" !== Boolean(provisioning.metalHostname))
+        fail2(`deployment.spec.targets.${targetName}.provisioning.ownership`, "must bind platform capacity or one tenant metal hostname.");
+      if (provisioning.metalHostname !== undefined && !/^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?$/.test(String(provisioning.metalHostname)))
+        fail2(`deployment.spec.targets.${targetName}.provisioning.metalHostname`, "is invalid.");
+      if (typeof provisioning.maxMonthlySpendMinor !== "string" || !/^\d{1,18}$/.test(provisioning.maxMonthlySpendMinor))
+        fail2(`deployment.spec.targets.${targetName}.provisioning.maxMonthlySpendMinor`, "must be a bounded decimal minor-unit amount.");
+    }
+    if (allocation.existing === "prefer" && target.provisioning === undefined)
+      fail2(`deployment.spec.targets.${targetName}.provisioning`, "is required when placement may provision after reuse.");
+    if (allocation.existing === "require" && target.provisioning !== undefined)
+      fail2(`deployment.spec.targets.${targetName}.provisioning`, "must be omitted for reuse-only placement.");
+    if (target.connectivity !== undefined) {
+      const connectivity = object(target.connectivity, `deployment.spec.targets.${targetName}.connectivity`);
+      exact3(connectivity, ["private", "public"], `deployment.spec.targets.${targetName}.connectivity`);
+      const declaredPrivate = connectivity.private === undefined ? undefined : object(connectivity.private, `deployment.spec.targets.${targetName}.connectivity.private`);
+      if (declaredPrivate?.mode === "cloudflare-warp" && allocation.sharing !== "exclusive")
+        fail2(`deployment.spec.targets.${targetName}.allocation.sharing`, "must be exclusive for a Cloudflare WARP connector.");
+      if (connectivity.private !== undefined) {
+        const privateNetwork = declaredPrivate;
+        if (privateNetwork.mode === "cloudflare-warp") {
+          exact3(privateNetwork, ["mode", "credential", "network"], `deployment.spec.targets.${targetName}.connectivity.private`);
+          if (!credentials[named(privateNetwork.credential, `deployment.spec.targets.${targetName}.connectivity.private.credential`)])
+            fail2(`deployment.spec.targets.${targetName}.connectivity.private.credential`, "must name a declared credential.");
+          if (typeof privateNetwork.network === "string")
+            named(privateNetwork.network, `deployment.spec.targets.${targetName}.connectivity.private.network`);
+          else
+            reference(privateNetwork.network, `deployment.spec.targets.${targetName}.connectivity.private.network`);
+        } else {
+          exact3(privateNetwork, ["mode"], `deployment.spec.targets.${targetName}.connectivity.private`);
+          if (!["disabled", "private-lan"].includes(String(privateNetwork.mode)))
+            fail2(`deployment.spec.targets.${targetName}.connectivity.private.mode`, "is unsupported.");
+        }
+      }
+      if (connectivity.public !== undefined) {
+        const publicNetwork = object(connectivity.public, `deployment.spec.targets.${targetName}.connectivity.public`);
+        if (publicNetwork.mode === "cloudflare-tunnel") {
+          exact3(publicNetwork, ["mode", "credential", "zone", "hostname"], `deployment.spec.targets.${targetName}.connectivity.public`);
+          if (!credentials[named(publicNetwork.credential, `deployment.spec.targets.${targetName}.connectivity.public.credential`)])
+            fail2(`deployment.spec.targets.${targetName}.connectivity.public.credential`, "must name a declared credential.");
+          if (typeof publicNetwork.zone === "string") {
+            if (!/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(publicNetwork.zone))
+              fail2(`deployment.spec.targets.${targetName}.connectivity.public.zone`, "is invalid.");
+          } else
+            reference(publicNetwork.zone, `deployment.spec.targets.${targetName}.connectivity.public.zone`);
+          const hostname = object(publicNetwork.hostname, `deployment.spec.targets.${targetName}.connectivity.public.hostname`);
+          const value2 = (coordinate, where, pattern) => {
+            if (typeof coordinate === "string") {
+              if (!pattern.test(coordinate))
+                fail2(where, "is invalid.");
+            } else
+              reference(coordinate, where);
+          };
+          if (hostname.mode === "static") {
+            exact3(hostname, ["mode", "label"], `deployment.spec.targets.${targetName}.connectivity.public.hostname`);
+            value2(hostname.label, `deployment.spec.targets.${targetName}.connectivity.public.hostname.label`, /^[a-z0-9](?:[a-z0-9-]{0,48}[a-z0-9])?$/);
+          } else if (hostname.mode === "indexed") {
+            exact3(hostname, ["mode", "prefix", "startAt"], `deployment.spec.targets.${targetName}.connectivity.public.hostname`);
+            value2(hostname.prefix, `deployment.spec.targets.${targetName}.connectivity.public.hostname.prefix`, /^[a-z0-9](?:[a-z0-9-]{0,48}[a-z0-9])?$/);
+            if (hostname.startAt !== undefined)
+              integer(hostname.startAt, `deployment.spec.targets.${targetName}.connectivity.public.hostname.startAt`, 0, 1e6);
+          } else
+            fail2(`deployment.spec.targets.${targetName}.connectivity.public.hostname.mode`, "is unsupported.");
+        } else {
+          exact3(publicNetwork, ["mode"], `deployment.spec.targets.${targetName}.connectivity.public`);
+          if (publicNetwork.mode !== "disabled")
+            fail2(`deployment.spec.targets.${targetName}.connectivity.public.mode`, "is unsupported.");
+        }
+      }
+    }
     if (target.placement !== undefined)
       jsonValue(target.placement, `deployment.spec.targets.${targetName}.placement`);
+    targetDefinitions.set(targetName, target);
   }
   const requirements = object(spec.requirements ?? {}, "deployment.spec.requirements");
   if (Object.keys(requirements).length > 64)
@@ -11138,13 +11291,34 @@ function compileDeployment(sourceValue) {
     const key = `${requirementValue.provider}@${requirementValue.contract}:${requirementValue.capability}`;
     requiredProviders.set(key, { provider: requirementValue.provider, contract: requirementValue.contract, capability: requirementValue.capability });
   }
+  for (const [targetName, target] of targetDefinitions) {
+    if (target.connectivity?.public?.mode === "cloudflare-tunnel" && ![...requirementDefinitions.values()].some(({ capability }) => capability === "network.public-tunnel")) {
+      fail2(`deployment.spec.targets.${targetName}.connectivity.public`, "requires one network.public-tunnel provider requirement.");
+    }
+    if (target.connectivity?.private?.mode === "cloudflare-warp" && ![...requirementDefinitions.values()].some(({ capability }) => capability === "network.private")) {
+      fail2(`deployment.spec.targets.${targetName}.connectivity.private`, "requires one network.private provider requirement.");
+    }
+  }
   const components = object(spec.components, "deployment.spec.components");
   const componentEntries = Object.entries(components);
   if (componentEntries.length < 1 || componentEntries.length > 128)
     fail2("deployment.spec.components", "must contain 1 to 128 components.");
   for (const [componentName, value] of componentEntries) {
     named(componentName, "deployment.spec.components key");
-    validateComponent(value, `deployment.spec.components.${componentName}`, targetNames, requirementDefinitions);
+    validateComponent(value, `deployment.spec.components.${componentName}`, targetDefinitions, requirementDefinitions);
+  }
+  for (const [targetName, target] of targetDefinitions) {
+    if (target.connectivity?.public?.mode !== "cloudflare-tunnel")
+      continue;
+    const publicApplications = componentEntries.filter(([, component2]) => {
+      const candidate = component2;
+      return candidate.kind === "application" && candidate.target === targetName && candidate.network?.public?.mode === "cloudflare-tunnel";
+    });
+    if (publicApplications.length !== 1)
+      fail2(`deployment.spec.targets.${targetName}.connectivity.public`, "requires exactly one application on the target with network.public cloudflare-tunnel.");
+    const application = publicApplications[0][1];
+    if (application.kind !== "application" || !application.network?.ingress?.stablePort)
+      fail2(`deployment.spec.components.${publicApplications[0][0]}.network.ingress`, "requires one stablePort for Tunnel ingress.");
   }
   const actionContext = {
     components,
@@ -11186,6 +11360,14 @@ function compileDeployment(sourceValue) {
     });
     plannedWorkflows.push({ id: workflowName, ...workflowValue.concurrency ? { concurrency: workflowValue.concurrency } : {}, stages: plannedStages });
   }
+  const deployWorkflow = plannedWorkflows.find(({ id: id2 }) => id2 === "deploy");
+  for (const [targetName, target] of targetDefinitions) {
+    if (!target.connectivity || target.connectivity.public?.mode !== "cloudflare-tunnel" && target.connectivity.private?.mode !== "cloudflare-warp")
+      continue;
+    const ensures = deployWorkflow?.stages.flatMap(({ steps }) => steps).filter((step3) => step3.uses === "forgezero.network/ensure@1" && step3.with.target === targetName && (step3.scope.kind === "each-target" || step3.scope.kind === "target-batches") && step3.scope.target === targetName) ?? [];
+    if (ensures.length !== 1)
+      fail2(`deployment.spec.workflows.deploy`, `must contain exactly one network.ensure step scoped to connected target ${targetName}.`);
+  }
   const typedSource = source;
   return {
     format: DEPLOY_PLAN_FORMAT,
@@ -11294,8 +11476,10 @@ export default defineDeployment({
 		inputs: { replicas: input.integer({ minimum: 1, maximum: 32, default: 1 }) },
 		targets: {
 			app: target.compute({
-				selector: { profiles: ['app'] },
-				cardinality: { minimum: 1, desired: input.ref('replicas'), maximum: 32 }
+				profiles: ['app'],
+				replicas: { minimum: 1, desired: input.ref('replicas'), maximum: 32 },
+				resources: { cpuCores: 1, memoryMiB: 512, storageGiB: 8 },
+				os: 'ubuntu-24.04', runtime: 'native', isolation: 'standard', reuse: 'require'
 			})
 		},
 		requirements: { bun: providers.bun.require() },
@@ -11843,6 +12027,10 @@ function validatePlatformSharedEnvironment(input) {
   const coordinators = input.databaseCoordinators.map(privateCoordinator);
   if (new Set(coordinators).size !== coordinators.length)
     throw new Error("databaseCoordinators must be unique.");
+  const readPreferred = (input.databaseReadPreferredCoordinators ?? []).map(privateCoordinator);
+  if (new Set(readPreferred).size !== readPreferred.length || readPreferred.some((url) => !coordinators.includes(url))) {
+    throw new Error("databaseReadPreferredCoordinators must be a unique subset of databaseCoordinators.");
+  }
   if (input.databaseNetworkMode !== "private-lan") {
     throw new Error("Attended platform bootstrap supports only private-lan database networking.");
   }
@@ -11916,6 +12104,7 @@ function validatePlatformSharedEnvironment(input) {
   return {
     ...input,
     databaseCoordinators: coordinators,
+    databaseReadPreferredCoordinators: readPreferred,
     appOrigin: httpsOrigin("appOrigin", input.appOrigin),
     apiOrigin: httpsOrigin("apiOrigin", input.apiOrigin),
     agentOtlpEndpoint: httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint),
@@ -11929,6 +12118,8 @@ function renderPlatformSharedEnvironment(input) {
   const entries = {
     ARANGO_URL: value.databaseCoordinators[0],
     ARANGO_URLS: value.databaseCoordinators.join(","),
+    ARANGO_READ_PREFERRED_URLS: (value.databaseReadPreferredCoordinators ?? []).join(","),
+    ARANGO_READ_PREFERRED_FALLBACK: "balanced",
     ARANGO_DB: "fz",
     FZ_DATABASE_MODE: "platform",
     ARANGO_USER: value.databaseUser,
@@ -13788,6 +13979,10 @@ function validateBootstrapConfig(value) {
   if (!["member", "none"].includes(value.database.agency) || value.database.role === "master" && value.database.agency !== "member" || value.database.role === "none" && value.database.agency !== "none") {
     throw new Error("database role and Agency participation disagree");
   }
+  value.database.readPreferred ??= false;
+  if (value.database.readPreferred && (value.database.role !== "joiner" || value.database.agency !== "none")) {
+    throw new Error("read-preferred database routing requires an extra non-Agency joiner");
+  }
   if (value.database.role !== "none" && !value.database.address)
     throw new Error("database nodes require a private address");
   if (value.database.role === "joiner" && !value.database.master)
@@ -13807,6 +14002,10 @@ function validateBootstrapConfig(value) {
   if (runtime.softwareProfile !== value.profile || runtime.databaseRole !== value.database.role || runtime.nodeHostname !== value.nodeHostname || runtime.apiOrigin !== api.origin || runtime.databaseCoordinators.join(",") !== write.join(",")) {
     throw new Error("platform runtime coordinates disagree with immutable bootstrap coordinates");
   }
+  const ownCoordinator = value.database.address ? `http://${value.database.address}:8529` : undefined;
+  if (Boolean(ownCoordinator && (runtime.databaseReadPreferredCoordinators ?? []).includes(ownCoordinator)) !== value.database.readPreferred) {
+    throw new Error("runtime read-preferred coordinator set disagrees with this node database routing intent");
+  }
   if (runtime.deployProfile !== value.environment)
     throw new Error("runtime deployment profile disagrees with bootstrap environment");
   if (value.database.address !== runtime.databaseAddress || value.database.master !== runtime.databaseMaster) {
@@ -14118,6 +14317,7 @@ function bootstrapIdentity(config) {
       role: config.database.role,
       serverMode: config.database.serverMode,
       agency: config.database.agency,
+      readPreferred: config.database.readPreferred,
       address: config.database.address ?? null,
       master: config.database.master ?? null,
       coordinators: config.database.coordinators
@@ -14153,7 +14353,7 @@ function parseStoredState(raw) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error("bootstrap state is malformed");
   const state = value;
-  if (state.format !== 2 || !["platform", "enrolled-compute"].includes(state.kind ?? "") || !/^[a-f0-9]{64}$/.test(state.identityDigest ?? "") || typeof state.profile !== "string" || typeof state.nodeHostname !== "string" || typeof state.apiUrl !== "string" || state.kind === "platform" && !["member", "none"].includes(state.databaseAgency ?? "")) {
+  if (state.format !== 2 || !["platform", "enrolled-compute"].includes(state.kind ?? "") || !/^[a-f0-9]{64}$/.test(state.identityDigest ?? "") || typeof state.profile !== "string" || typeof state.nodeHostname !== "string" || typeof state.apiUrl !== "string" || state.kind === "platform" && (!["member", "none"].includes(state.databaseAgency ?? "") || typeof state.databaseReadPreferred !== "boolean")) {
     throw new Error("bootstrap state is legacy or incomplete; refusing an unbound repair");
   }
   return state;
@@ -14203,6 +14403,7 @@ function stateFor(config, cloudflare, previousCloudflareTunnelId) {
       environment: config.environment,
       databaseRole: config.database.role,
       databaseAgency: config.database.agency,
+      databaseReadPreferred: config.database.readPreferred,
       databaseServerMode: config.database.serverMode,
       databaseAddress: config.database.address,
       databaseCoordinators: config.database.coordinators,
@@ -14707,7 +14908,7 @@ function strictBootstrapDocument(value) {
     exactKeys2(root.firewall, ["enabled", "sshPort", "privateCidrs"], "firewall config");
     if (root.cloudflareHandoff !== undefined)
       exactKeys2(root.cloudflareHandoff, ["handoffFile", "nodeName"], "Cloudflare handoff");
-    exactKeys2(root.database, ["role", "agency", "serverMode", "address", "master", "coordinators"], "database config");
+    exactKeys2(root.database, ["role", "agency", "readPreferred", "serverMode", "address", "master", "coordinators"], "database config");
     exactKeys2(root.enrolment, ["source"], "platform enrolment config");
     const runtime = exactKeys2(root.runtime, [
       "environment",
@@ -14751,7 +14952,8 @@ function strictBootstrapDocument(value) {
       "backup",
       "cloudflare",
       "realtime",
-      "initialInventory"
+      "initialInventory",
+      "databaseReadPreferredCoordinators"
     ], "runtime environment");
     const environment = runtime.environment;
     if (environment.initialInventory !== undefined) {
@@ -17073,6 +17275,7 @@ function platformGenesisBootstrapConfigs(template, guests, nodes, metalHostname,
     config.database = {
       role,
       agency: "member",
+      readPreferred: false,
       serverMode: "default",
       address: guest.address,
       ...role === "joiner" ? { master } : {},
@@ -17087,6 +17290,7 @@ function platformGenesisBootstrapConfigs(template, guests, nodes, metalHostname,
       softwareProfile: "platform-db-api",
       databaseRole: role,
       databaseCoordinators: coordinators,
+      databaseReadPreferredCoordinators: [],
       databaseAddress: guest.address,
       databaseMaster: role === "joiner" ? master : undefined,
       nodeHostname: node.nodeHostname,
@@ -18419,6 +18623,7 @@ function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint)
   const profile = genesis ? "platform-db-api" : bootstrapAnswer("Profile (platform-db-api/platform-api)", "platform-db-api");
   const role = genesis ? "master" : profile === "platform-api" ? "none" : bootstrapAnswer("Database role (master/joiner)", "master");
   const agency = genesis ? "member" : role === "master" ? "member" : role === "none" ? "none" : bootstrapAnswer("Agency participation (member/none)", "member");
+  const readPreferred = !genesis && role === "joiner" && agency === "none" ? bootstrapBoolean("Prefer this Coordinator for explicitly read-safe queries?", "no") : false;
   const serverMode = "default";
   const address = genesis ? fleet[0].address : role === "none" ? undefined : bootstrapAnswer("Private database address");
   const master = role === "joiner" ? bootstrapAnswer("Master starter private address") : undefined;
@@ -18463,6 +18668,7 @@ function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint)
     database: {
       role,
       agency,
+      readPreferred,
       serverMode,
       address,
       master,
@@ -18474,6 +18680,7 @@ function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint)
         softwareProfile: profile,
         databaseRole: role,
         databaseCoordinators: coordinators,
+        databaseReadPreferredCoordinators: readPreferred && address ? [`http://${address}:8529`] : [],
         databaseAddress: address,
         databaseMaster: master,
         databaseNetworkMode,
@@ -19254,6 +19461,24 @@ async function cmdDeploy(options, args) {
       return 0;
     }
     const pipelineKey = required(options.pipelineKey, "--pipeline");
+    if (operation === "plan") {
+      const revision = required(options.revision, "--revision").toLowerCase();
+      if (!/^[a-f0-9]{40}$/.test(revision))
+        throw new Error("--revision must be a full 40-character Git commit.");
+      const compiled = inspectCompiledDeployment(options.projectRoot);
+      let inputs;
+      if (options.data !== undefined) {
+        const parsed = JSON.parse(options.data === "-" ? await Bun.stdin.text() : options.data);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+          throw new Error("--data must be one JSON object of typed deployment inputs.");
+        inputs = parsed;
+      }
+      out.line(JSON.stringify(await deploymentRequest(options, "/plan", {
+        method: "POST",
+        body: { pipelineKey, revision, plan: compiled.plan, ...inputs ? { inputs } : {} }
+      }), null, 2));
+      return 0;
+    }
     if (operation === "attach") {
       if (options.targets.length === 0)
         throw new Error("At least one --target <compute>@<profile> is required.");
@@ -19299,7 +19524,7 @@ async function cmdDeploy(options, args) {
       out.line(JSON.stringify(await deploymentRequest(options, "/rotate", { method: "POST", body: { pipelineKey } }), null, 2));
       return 0;
     }
-    out.fail("Usage: fz deploy init|compile|check|sync|catalog|list|connect|attach|runs|release|enable|disable|target-enable|target-disable|rotate");
+    out.fail("Usage: fz deploy init|compile|check|sync|catalog|list|connect|plan|attach|runs|release|enable|disable|target-enable|target-disable|rotate");
     return 2;
   } catch (cause) {
     out.fail(cause instanceof Error ? cause.message : String(cause));
@@ -19376,7 +19601,10 @@ function usage() {
     fz deploy sync          Prove readiness and print the Git synchronization rule
     fz deploy catalog       List selectable tested OS/software coordinates
 	 fz deploy list          List pipelines for .fz/config.json's project
-	 fz deploy connect       Create a repository pipeline and attach compute targets
+	 fz deploy connect       Create a repository pipeline; optional --target values
+	                         are manual anchors, not required for automatic placement
+	 fz deploy plan          Approve the compiled plan at --revision and let the API
+	                         reuse idle compute before bounded provisioning
 	 fz deploy attach        Attach --target <compute>@<profile> to a pipeline
 	 fz deploy runs          Show pipeline deployment runs
 	 fz deploy release       Queue one exact --revision; --wait for completion

package/dist/index.d.ts

@@ -13,6 +13,7 @@ export { AGENT_CREDENTIAL_LOCATIONS, AGENT_CREDENTIAL_POLICY, METAL_SYSTEMD_CRED
 export type { AgentCredentialLocation, DeploymentCredentialBinding, DeploymentCredentialSchema } from './credential-schema';
 export { createDeploymentManager, DeploymentError } from './deployment';
 export type { DeploymentManager, DeploymentOptions, DeploymentRequest, DeploymentResult } from './deployment';
+export { DeploymentInputError, resolveDeploymentInputs, resolveDeploymentTargets } from './deployment-targets';
 export { DEFAULT_CONTROL_SOCKET, requestControl, startControlServer } from './control';
 export { pullDeploymentOnce, startDeploymentPull } from './deployment-pull';
 export type { DeploymentPullOptions, RemoteDeploymentClaim, PullResult } from './deployment-pull';

package/dist/metal-bootstrap.js

@@ -354,7 +354,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.73";
+var VERSION = "0.1.75";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";