@forgezero/agent 0.1.74 → 0.1.76

package/dist/fz.js

@@ -4634,7 +4634,7 @@ var VaultError, runtimeEnvironment = () => typeof process !== "undefined" && pro
   } catch {
     return;
   }
-}, VERSION = "0.1.14";
+}, VERSION = "0.1.15";
 var init_dist = __esm(() => {
   init_identity();
   VaultError = class VaultError extends Error {
@@ -4810,9 +4810,17 @@ async function spawnWith(command, env, report = () => {}, options = {}) {
 }
 
 // src/cli/index.ts
-init_dist();
 import { existsSync as existsSync12, lstatSync as lstatSync10, mkdirSync as mkdirSync13, readFileSync as readFileSync15, writeFileSync as writeFileSync13 } from "fs";
 import { basename as basename3, dirname as dirname14, isAbsolute as isAbsolute7, join as join12, resolve as resolve11 } from "path";
+
+// src/process-input.ts
+async function writeAndCloseProcessInput(input, value) {
+  input.write(value);
+  await input.end();
+}
+
+// src/cli/index.ts
+init_dist();
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { hostname } from "os";
 
@@ -4829,7 +4837,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.74";
+var VERSION2 = "0.1.76";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -4863,6 +4871,8 @@ var OS_CATALOG = [
 var SOFTWARE_CATALOG = [
   { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "docker", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "kata-containers", version: "4.0.0", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "nginx", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "arangodb", version: "3.11.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
@@ -4871,6 +4881,7 @@ var SOFTWARE_CATALOG = [
   { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "docker", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "containerd", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "nginx", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "ufw", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "openssh-client", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
@@ -4895,7 +4906,7 @@ function validateSoftwareRequirements(value, _options = {}) {
     if (Object.keys(row).some((key) => key !== "id" && key !== "version")) {
       throw new Error("software requirement contains an unknown field");
     }
-    if (!["bun", "docker", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client", "git"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
+    if (!["bun", "docker", "containerd", "kata-containers", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client", "git"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
       throw new Error("software requirement coordinate is invalid");
     }
     const requirement = { id: row.id, version: row.version };
@@ -6383,10 +6394,8 @@ var fixed = async (argv2, stdin) => {
     stderr: "pipe",
     env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C", DEBIAN_FRONTEND: "noninteractive" }
   });
-  if (stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
-    child.stdin.write(stdin);
-    child.stdin.end();
-  }
+  if (stdin !== undefined && child.stdin && typeof child.stdin !== "number")
+    await writeAndCloseProcessInput(child.stdin, stdin);
   const [stdout, stderr, exitCode] = await Promise.all([
     new Response(child.stdout).text(),
     new Response(child.stderr).text(),
@@ -10399,6 +10408,13 @@ function validateBuiltInAction(definition, context, where) {
       throw new Error(`${where}.with.requirements must name existing requirements`);
     return;
   }
+  if (definition.uses === "forgezero.network/ensure@1") {
+    exact(withValue, ["target"], `${where}.with`);
+    if (typeof withValue.target !== "string" || !Object.values(context.components).some((entry) => entry.target === withValue.target)) {
+      throw new Error(`${where}.with.target must name a target used by a component`);
+    }
+    return;
+  }
   if (definition.uses === "forgezero.exec/argv@1") {
     const allowed = ["component", "argv", "credentials"];
     const unknown = Object.keys(withValue).filter((key) => !allowed.includes(key));
@@ -10454,6 +10470,8 @@ function validateBuiltInProvider(requirement2, where) {
   const expected = {
     "forgezero.bun": { capability: "runtime.javascript", versions: ["1.3.14"], keys: ["installScope"] },
     "forgezero.docker": { capability: "runtime.container", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "storageDriver", "dataRoot", "liveRestore", "logDriver", "defaultNetwork", "rootless"] },
+    "forgezero.containerd": { capability: "runtime.container", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "runtimeClass", "namespace", "snapshotter"] },
+    "forgezero.kata": { capability: "runtime.container", versions: ["4.0.0"], keys: ["installScope", "runtimeClass", "namespace", "hypervisor", "confidentialGuest"] },
     "forgezero.nginx": { capability: "proxy.http", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "websocket", "maximumBodyMiB", "workerProcesses", "workerConnections"] },
     "forgezero.arangodb": { capability: "database.arangodb", versions: ["3.11.14"], keys: ["installScope", "runtime", "dataPath", "bind"] },
     "forgezero.cloudflared": { capability: "network.public-tunnel", versions: ["2026.7.3"], keys: ["installScope", "mode"] },
@@ -10474,6 +10492,10 @@ function validateBuiltInProvider(requirement2, where) {
     if (row2.storageDriver !== "overlay2" || row2.dataRoot !== "/var/lib/docker" || row2.liveRestore !== true || row2.logDriver !== "local" || row2.defaultNetwork !== "bridge" || row2.rootless !== false)
       throw new Error(`${where} Docker config is unsupported by the fixed host strategy`);
   }
+  if (requirement2.provider === "forgezero.containerd" && (row2.runtimeClass !== "runc" || row2.namespace !== "forgezero" || row2.snapshotter !== "overlayfs"))
+    throw new Error(`${where} containerd config is unsupported by the fixed host strategy`);
+  if (requirement2.provider === "forgezero.kata" && (row2.runtimeClass !== "kata-qemu-snp" || row2.namespace !== "forgezero" || row2.hypervisor !== "qemu" || row2.confidentialGuest !== "sev-snp"))
+    throw new Error(`${where} Kata config is unsupported by the fixed host strategy`);
   if (requirement2.provider === "forgezero.nginx" && (typeof row2.websocket !== "boolean" || !Number.isInteger(row2.maximumBodyMiB) || Number(row2.maximumBodyMiB) < 1 || Number(row2.maximumBodyMiB) > 1024 || !(row2.workerProcesses === "auto" || Number.isInteger(row2.workerProcesses)) || !Number.isInteger(row2.workerConnections)))
     throw new Error(`${where} Nginx config is invalid`);
   if (requirement2.provider === "forgezero.arangodb" && (row2.runtime !== "native" || !absolute(row2.dataPath) || row2.bind !== "private"))
@@ -10551,7 +10573,7 @@ function reference(value, where) {
   const row2 = object(value, where);
   exact3(row2, ["$ref"], where);
   const coordinate = boundedString(row2.$ref, `${where}.$ref`, 256);
-  if (!/^(inputs\.[a-z][A-Za-z0-9-]{0,62}|steps\.[a-z][A-Za-z0-9-]{0,62}\.(status|outputs\.[a-z][A-Za-z0-9-]{0,62})|components\.[a-z][A-Za-z0-9-]{0,62}\.[a-z][A-Za-z0-9-]{0,62}|targets\.[a-z][A-Za-z0-9-]{0,62}\.[a-z][A-Za-z0-9-]{0,62}|deployment\.[a-z][A-Za-z0-9-]{0,62})$/.test(coordinate)) {
+  if (!/^(inputs\.[a-z][A-Za-z0-9-]{0,62}|steps\.[a-z][A-Za-z0-9-]{0,62}\.(status|outputs\.[a-z][A-Za-z0-9-]{0,62})|components\.[a-z][A-Za-z0-9-]{0,62}\.[a-z][A-Za-z0-9-]{0,62}|targets\.[a-z][A-Za-z0-9-]{0,62}\.[a-z][A-Za-z0-9-]{0,62}|deployment\.[a-z][A-Za-z0-9-]{0,62}|execution\.(targetName|slot|releaseExecutor|runtime|cpuCores|memoryMiB|storageGiB))$/.test(coordinate)) {
     fail2(where, "contains an unsupported reference.");
   }
   return { $ref: coordinate };
@@ -10791,10 +10813,9 @@ function validateNetwork(value, where) {
       named(container.network, `${where}.container.network`);
   }
 }
-function validateComponent(value, where, targetNames, requirements) {
+function validateComponent(value, where, targets, requirements) {
   const row2 = object(value, where);
-  if (!targetNames.has(String(row2.target)))
-    fail2(`${where}.target`, "must name an existing target.");
+  const selectedTarget = targets.get(String(row2.target)) ?? fail2(`${where}.target`, "must name an existing target.");
   if (row2.kind === "application") {
     exact3(row2, ["kind", "target", "runtime", "service", "resources", "storage", "network", "rollout"], where);
     const runtime = object(row2.runtime, `${where}.runtime`);
@@ -10805,7 +10826,9 @@ function validateComponent(value, where, targetNames, requirements) {
       exact3(runtime, ["kind", "provider", "requirement", "argv"], `${where}.runtime`);
       validateArgv(runtime.argv, `${where}.runtime.argv`);
     } else if (runtime.kind === "container") {
-      exact3(runtime, ["kind", "provider", "requirement", "image", "entrypoint", "security"], `${where}.runtime`);
+      exact3(runtime, ["kind", "provider", "requirement", "runtimeClass", "image", "entrypoint", "security"], `${where}.runtime`);
+      if (runtime.runtimeClass !== undefined && !["runc", "kata-qemu-snp"].includes(String(runtime.runtimeClass)))
+        fail2(`${where}.runtime.runtimeClass`, "is unsupported.");
       const image = object(runtime.image, `${where}.runtime.image`);
       exact3(image, ["source"], `${where}.runtime.image`);
       const source = object(image.source, `${where}.runtime.image.source`);
@@ -10839,6 +10862,23 @@ function validateComponent(value, where, targetNames, requirements) {
       fail2(`${where}.runtime.requirement`, "must provide runtime.container.");
     if (runtimeRequirement && runtime.kind === "native" && !runtimeRequirement.capability.startsWith("runtime."))
       fail2(`${where}.runtime.requirement`, "must provide a runtime capability.");
+    const execution = selectedTarget.allocation.execution;
+    if (execution === "native" && runtime.kind !== "native")
+      fail2(`${where}.runtime.kind`, "must be native for the selected target.");
+    if (execution !== "native" && runtime.kind !== "container")
+      fail2(`${where}.runtime.kind`, "must be container for the selected target.");
+    if (runtime.kind === "container" && execution === "oci-runc") {
+      if (!["forgezero.containerd", "forgezero.docker"].includes(String(runtime.provider)))
+        fail2(`${where}.runtime.provider`, "must be forgezero.containerd for an OCI runc target.");
+      if (runtime.runtimeClass !== undefined && runtime.runtimeClass !== "runc")
+        fail2(`${where}.runtime.runtimeClass`, "must be runc for the selected target.");
+    }
+    if (runtime.kind === "container" && execution === "oci-kata-qemu-snp") {
+      if (runtime.provider !== "forgezero.kata")
+        fail2(`${where}.runtime.provider`, "must be forgezero.kata for a Kata QEMU SNP target.");
+      if (runtime.runtimeClass !== "kata-qemu-snp")
+        fail2(`${where}.runtime.runtimeClass`, "must be kata-qemu-snp for the selected target.");
+    }
     const service = object(row2.service, `${where}.service`);
     exact3(service, ["protocol", "port", "health", "websocket", "maximumConnections"], `${where}.service`);
     if (service.protocol !== "http")
@@ -10870,6 +10910,18 @@ function validateComponent(value, where, targetNames, requirements) {
       const network = object(row2.network, `${where}.network`);
       if (network.container === undefined)
         fail2(`${where}.network.container`, "must select bridge or reviewed host networking.");
+      if (selectedTarget.allocation.sharing === "shared") {
+        if (object(runtime.security, `${where}.runtime.security`).root !== "read-only")
+          fail2(`${where}.runtime.security.root`, "must be read-only on a shared compute.");
+        if (network.container.mode !== "bridge")
+          fail2(`${where}.network.container.mode`, "must be bridge on a shared compute.");
+        if (Array.isArray(row2.storage) && row2.storage.some((mount) => mount.class !== "ephemeral")) {
+          fail2(`${where}.storage`, "may contain only size-bounded tmpfs mounts on a shared compute.");
+        }
+      }
+    }
+    if (runtime.kind === "native" && selectedTarget.allocation.sharing !== "exclusive") {
+      fail2(`${where}.target`, "native applications require an exclusive compute.");
     }
     if (row2.storage !== undefined) {
       if (!Array.isArray(row2.storage) || row2.storage.length > 32)
@@ -10906,6 +10958,8 @@ function validateComponent(value, where, targetNames, requirements) {
       fail2(`${where}.runtime.mode`, "must match the provider runtime mode.");
     if (runtime.mode !== "native")
       fail2(`${where}.runtime.mode`, "must be native in deployment plan v1.");
+    if (selectedTarget.allocation.execution !== "native")
+      fail2(`${where}.target`, "must select a native execution target for database components.");
     const topology = object(row2.topology, `${where}.topology`);
     if (topology.mode === "standalone")
       exact3(topology, ["mode"], `${where}.topology`);
@@ -11102,15 +11156,20 @@ function compileDeployment(sourceValue) {
   if (targetEntries.length < 1 || targetEntries.length > 64)
     fail2("deployment.spec.targets", "must contain 1 to 64 targets.");
   const targetNames = new Set(targetEntries.map(([targetName]) => named(targetName, "deployment.spec.targets key")));
+  const targetDefinitions = new Map;
   for (const [targetName, value] of targetEntries) {
     const target = object(value, `deployment.spec.targets.${targetName}`);
-    exact3(target, ["kind", "selector", "cardinality", "placement"], `deployment.spec.targets.${targetName}`);
+    exact3(target, ["kind", "selector", "cardinality", "allocation", "provisioning", "connectivity", "placement"], `deployment.spec.targets.${targetName}`);
     if (target.kind !== "compute")
       fail2(`deployment.spec.targets.${targetName}.kind`, "must be compute.");
     const selector = object(target.selector, `deployment.spec.targets.${targetName}.selector`);
-    exact3(selector, ["profiles", "confidentialCompute", "labels"], `deployment.spec.targets.${targetName}.selector`);
+    exact3(selector, ["profiles", "operatingSystem", "confidentialCompute", "labels"], `deployment.spec.targets.${targetName}.selector`);
     if (!Array.isArray(selector.profiles) || selector.profiles.length < 1 || selector.profiles.length > 32 || selector.profiles.some((profile) => typeof profile !== "string" || !NAME3.test(profile)) || new Set(selector.profiles).size !== selector.profiles.length)
       fail2(`deployment.spec.targets.${targetName}.selector.profiles`, "is invalid.");
+    const operatingSystem = object(selector.operatingSystem, `deployment.spec.targets.${targetName}.selector.operatingSystem`);
+    exact3(operatingSystem, ["id", "version", "architecture"], `deployment.spec.targets.${targetName}.selector.operatingSystem`);
+    if (operatingSystem.id !== "ubuntu" || !["24.04", "26.04"].includes(String(operatingSystem.version)) || operatingSystem.architecture !== "x64")
+      fail2(`deployment.spec.targets.${targetName}.selector.operatingSystem`, "is unsupported.");
     if (selector.confidentialCompute !== undefined && !["required", "preferred", "disabled"].includes(String(selector.confidentialCompute)))
       fail2(`deployment.spec.targets.${targetName}.selector.confidentialCompute`, "is unsupported.");
     if (selector.labels !== undefined)
@@ -11123,8 +11182,108 @@ function compileDeployment(sourceValue) {
       integer(cardinality.desired, `deployment.spec.targets.${targetName}.cardinality.desired`, minimum, maximum);
     else
       reference(cardinality.desired, `deployment.spec.targets.${targetName}.cardinality.desired`);
+    const allocation = object(target.allocation, `deployment.spec.targets.${targetName}.allocation`);
+    exact3(allocation, ["execution", "sharing", "resources", "existing"], `deployment.spec.targets.${targetName}.allocation`);
+    if (!["native", "oci-runc", "oci-kata-qemu-snp"].includes(String(allocation.execution)))
+      fail2(`deployment.spec.targets.${targetName}.allocation.execution`, "is unsupported.");
+    if (!["exclusive", "shared"].includes(String(allocation.sharing)))
+      fail2(`deployment.spec.targets.${targetName}.allocation.sharing`, "is unsupported.");
+    if (!["prefer", "require"].includes(String(allocation.existing)))
+      fail2(`deployment.spec.targets.${targetName}.allocation.existing`, "is unsupported.");
+    const capacity = object(allocation.resources, `deployment.spec.targets.${targetName}.allocation.resources`);
+    exact3(capacity, ["cpuCores", "memoryMiB", "storageGiB"], `deployment.spec.targets.${targetName}.allocation.resources`);
+    const capacityValue = (value2, where, minimumValue, maximumValue) => {
+      if (typeof value2 === "number")
+        integer(value2, where, minimumValue, maximumValue);
+      else
+        reference(value2, where);
+    };
+    capacityValue(capacity.cpuCores, `deployment.spec.targets.${targetName}.allocation.resources.cpuCores`, 1, 1024);
+    capacityValue(capacity.memoryMiB, `deployment.spec.targets.${targetName}.allocation.resources.memoryMiB`, 128, 4194304);
+    capacityValue(capacity.storageGiB, `deployment.spec.targets.${targetName}.allocation.resources.storageGiB`, 1, 1048576);
+    if (allocation.execution === "oci-kata-qemu-snp" && selector.confidentialCompute !== "required")
+      fail2(`deployment.spec.targets.${targetName}.selector.confidentialCompute`, "must be required for Kata QEMU SNP.");
+    if ((allocation.execution === "oci-kata-qemu-snp" || selector.confidentialCompute === "required") && operatingSystem.version !== "26.04")
+      fail2(`deployment.spec.targets.${targetName}.selector.operatingSystem.version`, "must be Ubuntu 26.04 for SEV-SNP.");
+    if (allocation.execution !== "oci-kata-qemu-snp" && selector.confidentialCompute === "required" && allocation.execution !== "native")
+      fail2(`deployment.spec.targets.${targetName}.allocation.execution`, "cannot satisfy required confidential compute.");
+    if (target.provisioning !== undefined) {
+      const provisioning = object(target.provisioning, `deployment.spec.targets.${targetName}.provisioning`);
+      exact3(provisioning, ["planKey", "regionKey", "imageKey", "environmentKey", "ownership", "metalHostname", "maxMonthlySpendMinor"], `deployment.spec.targets.${targetName}.provisioning`);
+      for (const key of ["planKey", "regionKey", "imageKey", "environmentKey"])
+        named(provisioning[key], `deployment.spec.targets.${targetName}.provisioning.${key}`);
+      if (!["platform", "tenant-metal"].includes(String(provisioning.ownership)) || provisioning.ownership === "tenant-metal" !== Boolean(provisioning.metalHostname))
+        fail2(`deployment.spec.targets.${targetName}.provisioning.ownership`, "must bind platform capacity or one tenant metal hostname.");
+      if (provisioning.metalHostname !== undefined && !/^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?$/.test(String(provisioning.metalHostname)))
+        fail2(`deployment.spec.targets.${targetName}.provisioning.metalHostname`, "is invalid.");
+      if (typeof provisioning.maxMonthlySpendMinor !== "string" || !/^\d{1,18}$/.test(provisioning.maxMonthlySpendMinor))
+        fail2(`deployment.spec.targets.${targetName}.provisioning.maxMonthlySpendMinor`, "must be a bounded decimal minor-unit amount.");
+    }
+    if (allocation.existing === "prefer" && target.provisioning === undefined)
+      fail2(`deployment.spec.targets.${targetName}.provisioning`, "is required when placement may provision after reuse.");
+    if (allocation.existing === "require" && target.provisioning !== undefined)
+      fail2(`deployment.spec.targets.${targetName}.provisioning`, "must be omitted for reuse-only placement.");
+    if (target.connectivity !== undefined) {
+      const connectivity = object(target.connectivity, `deployment.spec.targets.${targetName}.connectivity`);
+      exact3(connectivity, ["private", "public"], `deployment.spec.targets.${targetName}.connectivity`);
+      const declaredPrivate = connectivity.private === undefined ? undefined : object(connectivity.private, `deployment.spec.targets.${targetName}.connectivity.private`);
+      if (declaredPrivate?.mode === "cloudflare-warp" && allocation.sharing !== "exclusive")
+        fail2(`deployment.spec.targets.${targetName}.allocation.sharing`, "must be exclusive for a Cloudflare WARP connector.");
+      if (connectivity.private !== undefined) {
+        const privateNetwork = declaredPrivate;
+        if (privateNetwork.mode === "cloudflare-warp") {
+          exact3(privateNetwork, ["mode", "credential", "network"], `deployment.spec.targets.${targetName}.connectivity.private`);
+          if (!credentials[named(privateNetwork.credential, `deployment.spec.targets.${targetName}.connectivity.private.credential`)])
+            fail2(`deployment.spec.targets.${targetName}.connectivity.private.credential`, "must name a declared credential.");
+          if (typeof privateNetwork.network === "string")
+            named(privateNetwork.network, `deployment.spec.targets.${targetName}.connectivity.private.network`);
+          else
+            reference(privateNetwork.network, `deployment.spec.targets.${targetName}.connectivity.private.network`);
+        } else {
+          exact3(privateNetwork, ["mode"], `deployment.spec.targets.${targetName}.connectivity.private`);
+          if (!["disabled", "private-lan"].includes(String(privateNetwork.mode)))
+            fail2(`deployment.spec.targets.${targetName}.connectivity.private.mode`, "is unsupported.");
+        }
+      }
+      if (connectivity.public !== undefined) {
+        const publicNetwork = object(connectivity.public, `deployment.spec.targets.${targetName}.connectivity.public`);
+        if (publicNetwork.mode === "cloudflare-tunnel") {
+          exact3(publicNetwork, ["mode", "credential", "zone", "hostname"], `deployment.spec.targets.${targetName}.connectivity.public`);
+          if (!credentials[named(publicNetwork.credential, `deployment.spec.targets.${targetName}.connectivity.public.credential`)])
+            fail2(`deployment.spec.targets.${targetName}.connectivity.public.credential`, "must name a declared credential.");
+          if (typeof publicNetwork.zone === "string") {
+            if (!/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(publicNetwork.zone))
+              fail2(`deployment.spec.targets.${targetName}.connectivity.public.zone`, "is invalid.");
+          } else
+            reference(publicNetwork.zone, `deployment.spec.targets.${targetName}.connectivity.public.zone`);
+          const hostname = object(publicNetwork.hostname, `deployment.spec.targets.${targetName}.connectivity.public.hostname`);
+          const value2 = (coordinate, where, pattern) => {
+            if (typeof coordinate === "string") {
+              if (!pattern.test(coordinate))
+                fail2(where, "is invalid.");
+            } else
+              reference(coordinate, where);
+          };
+          if (hostname.mode === "static") {
+            exact3(hostname, ["mode", "label"], `deployment.spec.targets.${targetName}.connectivity.public.hostname`);
+            value2(hostname.label, `deployment.spec.targets.${targetName}.connectivity.public.hostname.label`, /^[a-z0-9](?:[a-z0-9-]{0,48}[a-z0-9])?$/);
+          } else if (hostname.mode === "indexed") {
+            exact3(hostname, ["mode", "prefix", "startAt"], `deployment.spec.targets.${targetName}.connectivity.public.hostname`);
+            value2(hostname.prefix, `deployment.spec.targets.${targetName}.connectivity.public.hostname.prefix`, /^[a-z0-9](?:[a-z0-9-]{0,48}[a-z0-9])?$/);
+            if (hostname.startAt !== undefined)
+              integer(hostname.startAt, `deployment.spec.targets.${targetName}.connectivity.public.hostname.startAt`, 0, 1e6);
+          } else
+            fail2(`deployment.spec.targets.${targetName}.connectivity.public.hostname.mode`, "is unsupported.");
+        } else {
+          exact3(publicNetwork, ["mode"], `deployment.spec.targets.${targetName}.connectivity.public`);
+          if (publicNetwork.mode !== "disabled")
+            fail2(`deployment.spec.targets.${targetName}.connectivity.public.mode`, "is unsupported.");
+        }
+      }
+    }
     if (target.placement !== undefined)
       jsonValue(target.placement, `deployment.spec.targets.${targetName}.placement`);
+    targetDefinitions.set(targetName, target);
   }
   const requirements = object(spec.requirements ?? {}, "deployment.spec.requirements");
   if (Object.keys(requirements).length > 64)
@@ -11138,13 +11297,34 @@ function compileDeployment(sourceValue) {
     const key = `${requirementValue.provider}@${requirementValue.contract}:${requirementValue.capability}`;
     requiredProviders.set(key, { provider: requirementValue.provider, contract: requirementValue.contract, capability: requirementValue.capability });
   }
+  for (const [targetName, target] of targetDefinitions) {
+    if (target.connectivity?.public?.mode === "cloudflare-tunnel" && ![...requirementDefinitions.values()].some(({ capability }) => capability === "network.public-tunnel")) {
+      fail2(`deployment.spec.targets.${targetName}.connectivity.public`, "requires one network.public-tunnel provider requirement.");
+    }
+    if (target.connectivity?.private?.mode === "cloudflare-warp" && ![...requirementDefinitions.values()].some(({ capability }) => capability === "network.private")) {
+      fail2(`deployment.spec.targets.${targetName}.connectivity.private`, "requires one network.private provider requirement.");
+    }
+  }
   const components = object(spec.components, "deployment.spec.components");
   const componentEntries = Object.entries(components);
   if (componentEntries.length < 1 || componentEntries.length > 128)
     fail2("deployment.spec.components", "must contain 1 to 128 components.");
   for (const [componentName, value] of componentEntries) {
     named(componentName, "deployment.spec.components key");
-    validateComponent(value, `deployment.spec.components.${componentName}`, targetNames, requirementDefinitions);
+    validateComponent(value, `deployment.spec.components.${componentName}`, targetDefinitions, requirementDefinitions);
+  }
+  for (const [targetName, target] of targetDefinitions) {
+    if (target.connectivity?.public?.mode !== "cloudflare-tunnel")
+      continue;
+    const publicApplications = componentEntries.filter(([, component2]) => {
+      const candidate = component2;
+      return candidate.kind === "application" && candidate.target === targetName && candidate.network?.public?.mode === "cloudflare-tunnel";
+    });
+    if (publicApplications.length !== 1)
+      fail2(`deployment.spec.targets.${targetName}.connectivity.public`, "requires exactly one application on the target with network.public cloudflare-tunnel.");
+    const application = publicApplications[0][1];
+    if (application.kind !== "application" || !application.network?.ingress?.stablePort)
+      fail2(`deployment.spec.components.${publicApplications[0][0]}.network.ingress`, "requires one stablePort for Tunnel ingress.");
   }
   const actionContext = {
     components,
@@ -11186,6 +11366,14 @@ function compileDeployment(sourceValue) {
     });
     plannedWorkflows.push({ id: workflowName, ...workflowValue.concurrency ? { concurrency: workflowValue.concurrency } : {}, stages: plannedStages });
   }
+  const deployWorkflow = plannedWorkflows.find(({ id: id2 }) => id2 === "deploy");
+  for (const [targetName, target] of targetDefinitions) {
+    if (!target.connectivity || target.connectivity.public?.mode !== "cloudflare-tunnel" && target.connectivity.private?.mode !== "cloudflare-warp")
+      continue;
+    const ensures = deployWorkflow?.stages.flatMap(({ steps }) => steps).filter((step3) => step3.uses === "forgezero.network/ensure@1" && step3.with.target === targetName && (step3.scope.kind === "each-target" || step3.scope.kind === "target-batches") && step3.scope.target === targetName) ?? [];
+    if (ensures.length !== 1)
+      fail2(`deployment.spec.workflows.deploy`, `must contain exactly one network.ensure step scoped to connected target ${targetName}.`);
+  }
   const typedSource = source;
   return {
     format: DEPLOY_PLAN_FORMAT,
@@ -11294,8 +11482,10 @@ export default defineDeployment({
 		inputs: { replicas: input.integer({ minimum: 1, maximum: 32, default: 1 }) },
 		targets: {
 			app: target.compute({
-				selector: { profiles: ['app'] },
-				cardinality: { minimum: 1, desired: input.ref('replicas'), maximum: 32 }
+				profiles: ['app'],
+				replicas: { minimum: 1, desired: input.ref('replicas'), maximum: 32 },
+				resources: { cpuCores: 1, memoryMiB: 512, storageGiB: 8 },
+				os: 'ubuntu-24.04', runtime: 'native', isolation: 'standard', reuse: 'require'
 			})
 		},
 		requirements: { bun: providers.bun.require() },
@@ -14893,8 +15083,7 @@ function localBootstrapHost() {
   const execute = async (argv2, options = {}) => {
     const child = Bun.spawn([...argv2], { stdin: options.stdin === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
     if (options.stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
-      child.stdin.write(options.stdin);
-      child.stdin.end();
+      await writeAndCloseProcessInput(child.stdin, options.stdin);
     }
     const [stdout, stderr, exitCode] = await Promise.all([
       new Response(child.stdout).text(),
@@ -16634,8 +16823,7 @@ var defaultExec3 = async (argv2, options = {}) => {
     }
   });
   if (options.stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
-    child.stdin.write(options.stdin);
-    child.stdin.end();
+    await writeAndCloseProcessInput(child.stdin, options.stdin);
   }
   const [stdout, stderr, exitCode] = await Promise.all([
     new Response(child.stdout).text(),
@@ -18099,9 +18287,8 @@ async function cmdAgent(options, args) {
         mkdirSync13(dirname14(enrolTokenCredentialPath), { recursive: true, mode: 448 });
         const sealing = Bun.spawn(["systemd-creds", "encrypt", "--name=enrol-token", "-", enrolTokenCredentialPath], { stdin: "pipe", stdout: "ignore", stderr: "pipe" });
         if (sealing.stdin && typeof sealing.stdin !== "number") {
-          sealing.stdin.write(`${token}
+          await writeAndCloseProcessInput(sealing.stdin, `${token}
 `);
-          sealing.stdin.end();
         }
         const error = await new Response(sealing.stderr).text();
         if (await sealing.exited !== 0)
@@ -19277,6 +19464,24 @@ async function cmdDeploy(options, args) {
       return 0;
     }
     const pipelineKey = required(options.pipelineKey, "--pipeline");
+    if (operation === "plan") {
+      const revision = required(options.revision, "--revision").toLowerCase();
+      if (!/^[a-f0-9]{40}$/.test(revision))
+        throw new Error("--revision must be a full 40-character Git commit.");
+      const compiled = inspectCompiledDeployment(options.projectRoot);
+      let inputs;
+      if (options.data !== undefined) {
+        const parsed = JSON.parse(options.data === "-" ? await Bun.stdin.text() : options.data);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+          throw new Error("--data must be one JSON object of typed deployment inputs.");
+        inputs = parsed;
+      }
+      out.line(JSON.stringify(await deploymentRequest(options, "/plan", {
+        method: "POST",
+        body: { pipelineKey, revision, plan: compiled.plan, ...inputs ? { inputs } : {} }
+      }), null, 2));
+      return 0;
+    }
     if (operation === "attach") {
       if (options.targets.length === 0)
         throw new Error("At least one --target <compute>@<profile> is required.");
@@ -19322,7 +19527,7 @@ async function cmdDeploy(options, args) {
       out.line(JSON.stringify(await deploymentRequest(options, "/rotate", { method: "POST", body: { pipelineKey } }), null, 2));
       return 0;
     }
-    out.fail("Usage: fz deploy init|compile|check|sync|catalog|list|connect|attach|runs|release|enable|disable|target-enable|target-disable|rotate");
+    out.fail("Usage: fz deploy init|compile|check|sync|catalog|list|connect|plan|attach|runs|release|enable|disable|target-enable|target-disable|rotate");
     return 2;
   } catch (cause) {
     out.fail(cause instanceof Error ? cause.message : String(cause));
@@ -19399,7 +19604,10 @@ function usage() {
     fz deploy sync          Prove readiness and print the Git synchronization rule
     fz deploy catalog       List selectable tested OS/software coordinates
 	 fz deploy list          List pipelines for .fz/config.json's project
-	 fz deploy connect       Create a repository pipeline and attach compute targets
+	 fz deploy connect       Create a repository pipeline; optional --target values
+	                         are manual anchors, not required for automatic placement
+	 fz deploy plan          Approve the compiled plan at --revision and let the API
+	                         reuse idle compute before bounded provisioning
 	 fz deploy attach        Attach --target <compute>@<profile> to a pipeline
 	 fz deploy runs          Show pipeline deployment runs
 	 fz deploy release       Queue one exact --revision; --wait for completion

package/dist/index.d.ts

@@ -13,6 +13,7 @@ export { AGENT_CREDENTIAL_LOCATIONS, AGENT_CREDENTIAL_POLICY, METAL_SYSTEMD_CRED
 export type { AgentCredentialLocation, DeploymentCredentialBinding, DeploymentCredentialSchema } from './credential-schema';
 export { createDeploymentManager, DeploymentError } from './deployment';
 export type { DeploymentManager, DeploymentOptions, DeploymentRequest, DeploymentResult } from './deployment';
+export { DeploymentInputError, resolveDeploymentInputs, resolveDeploymentTargets } from './deployment-targets';
 export { DEFAULT_CONTROL_SOCKET, requestControl, startControlServer } from './control';
 export { pullDeploymentOnce, startDeploymentPull } from './deployment-pull';
 export type { DeploymentPullOptions, RemoteDeploymentClaim, PullResult } from './deployment-pull';

package/dist/metal-bootstrap.js

@@ -354,7 +354,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.74";
+var VERSION = "0.1.76";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";