@forgezero/agent 0.1.81 → 0.1.83

package/dist/fz.js

@@ -4634,7 +4634,7 @@ var VaultError, runtimeEnvironment = () => typeof process !== "undefined" && pro
   } catch {
     return;
   }
-}, VERSION = "0.1.15";
+}, VERSION = "0.1.16";
 var init_dist = __esm(() => {
   init_identity();
   VaultError = class VaultError extends Error {
@@ -4811,7 +4811,7 @@ async function spawnWith(command, env, report = () => {}, options = {}) {
 
 // src/cli/index.ts
 import { existsSync as existsSync12, lstatSync as lstatSync10, mkdirSync as mkdirSync13, readFileSync as readFileSync16, writeFileSync as writeFileSync13 } from "fs";
-import { basename as basename3, dirname as dirname14, isAbsolute as isAbsolute7, join as join12, resolve as resolve12 } from "path";
+import { basename as basename3, dirname as dirname14, isAbsolute as isAbsolute7, join as join13, resolve as resolve12 } from "path";
 
 // src/process-input.ts
 async function writeAndCloseProcessInput(input, value) {
@@ -4821,7 +4821,7 @@ async function writeAndCloseProcessInput(input, value) {
 
 // src/cli/index.ts
 init_dist();
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { fileURLToPath as fileURLToPath4 } from "url";
 import { hostname } from "os";
 
 // src/agent-update.ts
@@ -4837,7 +4837,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.81";
+var VERSION2 = "0.1.83";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -10365,9 +10365,10 @@ function initializeDeployFile(root, options = {}) {
 }
 
 // src/deploy-compiler.ts
-import { existsSync as existsSync6, lstatSync as lstatSync2, mkdirSync as mkdirSync6, readFileSync as readFileSync6, renameSync as renameSync5, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname5, isAbsolute, relative, resolve as resolve4, sep as sep3 } from "path";
-import { pathToFileURL } from "url";
+import { existsSync as existsSync6, lstatSync as lstatSync2, mkdirSync as mkdirSync6, mkdtempSync, readFileSync as readFileSync6, renameSync as renameSync5, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
+import { tmpdir } from "os";
+import { dirname as dirname5, isAbsolute, join as join5, relative, resolve as resolve4, sep as sep3 } from "path";
+import { fileURLToPath, pathToFileURL } from "url";
 
 // src/deploy-plan.ts
 import { createHash as createHash2 } from "crypto";
@@ -11518,37 +11519,72 @@ function safeName2(value) {
   const result = value.toLowerCase().replace(/^@[^/]+\//, "").replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63);
   return /^[a-z]/.test(result) ? result : `app-${result || "service"}`;
 }
-function defaultTypeScriptDeployment(name) {
-  return `import { actions, application, defineDeployment, input, providers, stage, target, workflow } from '@forgezero/agent/deploy';
-
-export default defineDeployment({
-	apiVersion: 'deploy.forgezero.net/v1',
-	kind: 'Deployment',
-	metadata: { name: '${safeName2(name)}' },
-	spec: {
-		security: { attestation: 'preferred' },
-		inputs: { replicas: input.integer({ minimum: 1, maximum: 32, default: 1 }) },
-		targets: {
-			app: target.compute({
-				profiles: ['app'],
-				replicas: { minimum: 1, desired: input.ref('replicas'), maximum: 32 },
-				resources: { cpuCores: 1, memoryMiB: 512, storageGiB: 8 },
-				os: 'ubuntu-24.04', runtime: 'native', isolation: 'standard', reuse: 'require'
-			})
-		},
-		requirements: { bun: providers.bun.require() },
-		components: {
+function initCoordinates(options) {
+  const runtime = options.runtime ?? "native";
+  const isolation = options.isolation ?? (runtime === "kata-snp" ? "sev-snp" : "standard");
+  const operatingSystem = options.operatingSystem ?? (isolation === "sev-snp" ? "ubuntu-26.04" : "ubuntu-24.04");
+  const result = {
+    runtime,
+    isolation,
+    operatingSystem,
+    replicas: options.replicas ?? 1,
+    cpuCores: options.cpuCores ?? 1,
+    memoryMiB: options.memoryMiB ?? 512,
+    storageGiB: options.storageGiB ?? 8,
+    sharing: options.sharing ?? "exclusive",
+    reuse: options.reuse ?? "require",
+    profile: options.profile ?? "app"
+  };
+  if (!/^[a-z][a-z0-9-]{0,62}$/.test(result.profile))
+    throw new Error("deployment profile must be a lowercase typed name");
+  if (!Number.isSafeInteger(result.replicas) || result.replicas < 1 || result.replicas > 1024)
+    throw new Error("deployment replicas must be an integer from 1 to 1024");
+  if (!Number.isSafeInteger(result.cpuCores) || result.cpuCores < 1 || result.cpuCores > 1024)
+    throw new Error("deployment CPU cores must be an integer from 1 to 1024");
+  if (!Number.isSafeInteger(result.memoryMiB) || result.memoryMiB < 128 || result.memoryMiB > 4194304)
+    throw new Error("deployment memory must be an integer from 128 to 4194304 MiB");
+  if (!Number.isSafeInteger(result.storageGiB) || result.storageGiB < 1 || result.storageGiB > 1048576)
+    throw new Error("deployment storage must be an integer from 1 to 1048576 GiB");
+  if (runtime === "kata-snp" && isolation !== "sev-snp")
+    throw new Error("kata-snp requires sev-snp isolation");
+  if (runtime === "containerd" && isolation === "sev-snp")
+    throw new Error("containerd runc cannot provide sev-snp; use kata-snp");
+  if (isolation === "sev-snp" && operatingSystem !== "ubuntu-26.04")
+    throw new Error("sev-snp requires ubuntu-26.04");
+  if (runtime === "native" && result.sharing !== "exclusive")
+    throw new Error("native deployments require exclusive compute");
+  return result;
+}
+function defaultTypeScriptDeployment(name, options = {}) {
+  const selected = initCoordinates(options);
+  const execution = selected.runtime === "native" ? "native" : selected.runtime === "containerd" ? "oci-runc" : "oci-kata-qemu-snp";
+  const hostPackageVersion = selected.operatingSystem === "ubuntu-24.04" ? "ubuntu-24.04" : "ubuntu-26.04";
+  const requirementBlock = selected.runtime === "native" ? `bun: providers.bun.require()` : selected.runtime === "containerd" ? `containerd: providers.containerd.require({ version: '${hostPackageVersion}' }),
+			nginx: providers.nginx.require({ version: '${hostPackageVersion}' })` : `containerd: providers.containerd.require(),
+			kata: providers.kata.require(),
+			nginx: providers.nginx.require()`;
+  const componentBlock = selected.runtime === "native" ? `
 			app: application({
 				target: 'app',
 				runtime: { kind: 'native', provider: 'forgezero.bun', requirement: 'bun', argv: ['/usr/local/bin/bun', 'run', 'start'] },
 				service: { protocol: 'http', port: 3000, health: { protocol: 'http', method: 'GET', path: '/health', expectedStatus: [200], timeoutMs: 5_000 } },
 				resources: {},
 				rollout: { strategy: 'direct' }
-			})
-		},
-		workflows: {
-			deploy: workflow({
-				stages: {
+			})` : `
+			app: application({
+				target: 'app',
+				runtime: {
+					kind: 'container', provider: '${selected.runtime === "containerd" ? "forgezero.containerd" : "forgezero.kata"}', requirement: '${selected.runtime === "containerd" ? "containerd" : "kata"}', runtimeClass: '${selected.runtime === "containerd" ? "runc" : "kata-qemu-snp"}',
+					image: { source: { kind: 'build', context: '.', dockerfile: 'Dockerfile' } },
+					security: { privileged: false, noNewPrivileges: true, root: 'read-only', dropCapabilities: ['ALL'] }
+				},
+				service: { protocol: 'http', port: 3000, health: { protocol: 'http', method: 'GET', path: '/health', expectedStatus: [200], timeoutMs: 5_000 } },
+				resources: { cpu: { limit: ${selected.cpuCores} }, memory: { limitMiB: ${selected.memoryMiB}, swap: 'disabled' }, pids: { limit: 256 } },
+				storage: [{ class: 'ephemeral', path: '/tmp', type: 'tmpfs', sizeMiB: ${Math.min(128, Math.max(16, Math.floor(selected.memoryMiB / 4)))} }],
+				network: { ingress: { exposure: 'loopback', stablePort: 3000 }, container: { mode: 'bridge', network: 'app' } },
+				rollout: { strategy: 'blue-green', proxy: 'nginx', drainMs: 30_000, automaticRollback: true }
+			})`;
+  const workflowBlock = selected.runtime === "native" ? `
 					build: stage({ strategy: { mode: 'sequential' }, steps: {
 						build: actions.exec.argv(
 							{ component: 'app', argv: ['/usr/local/bin/fz-agent', 'pipeline-todo', 'replace with the project build argv'] },
@@ -11563,7 +11599,42 @@ export default defineDeployment({
 					} }),
 					verify: stage({ dependsOn: ['release'], strategy: { mode: 'parallel' }, steps: {
 						health: actions.service.health({ component: 'app' }, { scope: { kind: 'each-target', target: 'app' }, timeoutMs: 30_000 })
-					} })
+					} })` : `
+					prepare: stage({ strategy: { mode: 'sequential' }, steps: {
+						software: actions.software.ensure({ requirements: [${selected.runtime === "containerd" ? "'containerd', 'nginx'" : "'containerd', 'kata', 'nginx'"}] }, { scope: { kind: 'each-target', target: 'app' }, timeoutMs: 900_000 }),
+						review: actions.exec.argv({ component: 'app', argv: ['/usr/local/bin/fz-agent', 'pipeline-todo', 'review the Dockerfile and container entrypoint'] }, { scope: { kind: 'release-executor' } })
+					} }),
+					build: stage({ dependsOn: ['prepare'], strategy: { mode: 'sequential' }, steps: {
+						image: actions.container.build({ component: 'app' }, { scope: { kind: 'release-executor' }, timeoutMs: 900_000 })
+					} }),
+					release: stage({ dependsOn: ['build'], strategy: { mode: 'blue-green', maximumConcurrency: 1, minimumHealthy: 1 }, steps: {
+						promote: actions.service.promote({ component: 'app', imageDigest: { $ref: 'steps.image.outputs.digest' } }, { scope: { kind: 'each-target', target: 'app' }, timeoutMs: 180_000 })
+					} }),
+					verify: stage({ dependsOn: ['release'], strategy: { mode: 'parallel' }, steps: {
+						health: actions.service.health({ component: 'app' }, { scope: { kind: 'each-target', target: 'app' }, timeoutMs: 30_000 })
+					} })`;
+  return `import { actions, application, defineDeployment, providers, stage, target, workflow } from '@forgezero/agent/deploy';
+
+export default defineDeployment({
+	apiVersion: 'deploy.forgezero.net/v1',
+	kind: 'Deployment',
+	metadata: { name: '${safeName2(name)}' },
+	spec: {
+		security: { attestation: '${selected.isolation === "sev-snp" ? "required" : "preferred"}' },
+		targets: {
+			app: target.compute({
+				profiles: ['${selected.profile}'], replicas: ${selected.replicas},
+				resources: { cpuCores: ${selected.cpuCores}, memoryMiB: ${selected.memoryMiB}, storageGiB: ${selected.storageGiB} },
+				os: '${selected.operatingSystem}', runtime: '${execution}', isolation: '${selected.isolation}',
+				sharing: '${selected.sharing}', reuse: '${selected.reuse}'
+			})
+		},
+		requirements: { ${requirementBlock} },
+		components: {${componentBlock}
+		},
+		workflows: {
+			deploy: workflow({
+				stages: {${workflowBlock}
 				}
 			})
 		}
@@ -11575,7 +11646,7 @@ function initializeTypeScriptDeployment(rootValue, options) {
   const path = localPath(rootValue, DEPLOY_SOURCE_FILE, "deployment source");
   if (existsSync6(path) && !options.force)
     throw new Error(`${DEPLOY_SOURCE_FILE} already exists; use --force only when replacing it deliberately`);
-  writeFileSync6(path, defaultTypeScriptDeployment(options.name), { mode: 420, flag: options.force ? "w" : "wx" });
+  writeFileSync6(path, defaultTypeScriptDeployment(options.name, options), { mode: 420, flag: options.force ? "w" : "wx" });
   return path;
 }
 function inside(root, path) {
@@ -11596,10 +11667,35 @@ async function loadDeploymentSource(root, sourceFile = DEPLOY_SOURCE_FILE) {
   const status = lstatSync2(source);
   if (!status.isFile() || status.isSymbolicLink() || status.size > 2 * 1024 * 1024)
     throw new Error("deployment source must be one bounded regular file");
-  const module = await import(`${pathToFileURL(source).href}?forgezero=${status.mtimeMs}`);
-  if (module.default === undefined)
-    throw new Error(`${sourceFile} must export one default deployment definition`);
-  return module.default;
+  const builtDeploy = new URL("./deploy.js", import.meta.url);
+  const sourceDeploy = new URL("./deploy.ts", import.meta.url);
+  const deployModule = existsSync6(fileURLToPath(builtDeploy)) ? builtDeploy.href : sourceDeploy.href;
+  const result = await Bun.build({
+    entrypoints: [source],
+    target: "bun",
+    format: "esm",
+    minify: false,
+    plugins: [{
+      name: "forgezero-deploy-authoring",
+      setup(builder) {
+        builder.onResolve({ filter: /^@forgezero\/agent\/deploy$/ }, () => ({ path: fileURLToPath(deployModule) }));
+      }
+    }]
+  });
+  if (!result.success || result.outputs.length !== 1) {
+    throw new Error(`deployment source compilation failed: ${result.logs.map((entry) => entry.message).join("; ")}`);
+  }
+  const directory = mkdtempSync(join5(tmpdir(), "forgezero-deploy-compile-"));
+  const compiled = join5(directory, "deployment.mjs");
+  try {
+    writeFileSync6(compiled, Buffer.from(await result.outputs[0].arrayBuffer()), { mode: 384, flag: "wx" });
+    const module = await import(`${pathToFileURL(compiled).href}?forgezero=${status.mtimeMs}`);
+    if (module.default === undefined)
+      throw new Error(`${sourceFile} must export one default deployment definition`);
+    return module.default;
+  } finally {
+    rmSync4(directory, { recursive: true, force: true });
+  }
 }
 async function compileDeploymentProject(rootValue, options = {}) {
   const root = resolve4(rootValue);
@@ -11733,7 +11829,7 @@ import {
   unlinkSync,
   writeFileSync as writeFileSync7
 } from "fs";
-import { dirname as dirname6, join as join5 } from "path";
+import { dirname as dirname6, join as join6 } from "path";
 import { homedir } from "os";
 var EMPTY2 = () => ({ version: 1, sessions: {} });
 function canonicalApi(value) {
@@ -11751,8 +11847,8 @@ ${realm.trim() || "platform"}`).toString("base64url");
 function defaultSessionPath(env = process.env) {
   if (env.FZ_SESSION_FILE?.trim())
     return env.FZ_SESSION_FILE.trim();
-  const state = env.XDG_STATE_HOME?.trim() || join5(homedir(), ".local", "state");
-  return join5(state, "forgezero", "sessions.json");
+  const state = env.XDG_STATE_HOME?.trim() || join6(homedir(), ".local", "state");
+  return join6(state, "forgezero", "sessions.json");
 }
 function assertPrivate(path, kind) {
   if (!existsSync7(path))
@@ -11851,7 +11947,7 @@ import {
   writeFileSync as writeFileSync9
 } from "fs";
 import { dirname as dirname9 } from "path";
-import { fileURLToPath } from "url";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/ubuntu.ts
 var current = OS_CATALOG[0];
@@ -11896,7 +11992,6 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
   }
   const names = new Set;
   const addresses = new Set;
-  const pools = new Set;
   return guests.map((input) => {
     if (!input || typeof input !== "object" || !SAFE_NAME.test(input.name)) {
       throw new Error("platform genesis guest name is malformed");
@@ -11909,13 +12004,11 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
     if (input.cpuPoolKey !== undefined && !SAFE_POOL.test(input.cpuPoolKey)) {
       throw new Error("platform genesis CPU pool key is malformed");
     }
-    if (names.has(input.name) || addresses.has(input.address) || input.cpuPoolKey !== undefined && pools.has(input.cpuPoolKey)) {
-      throw new Error("platform genesis guest names, addresses and explicit CPU pools must be unique");
+    if (names.has(input.name) || addresses.has(input.address)) {
+      throw new Error("platform genesis guest names and addresses must be unique");
     }
     names.add(input.name);
     addresses.add(input.address);
-    if (input.cpuPoolKey !== undefined)
-      pools.add(input.cpuPoolKey);
     const physicalCores = integer2(input.physicalCores, 1, 256, "physical core count");
     const vcpu = integer2(input.vcpu, 1, 512, "vCPU count");
     if (vcpu < physicalCores)
@@ -12430,7 +12523,7 @@ function planLocalOtlpProof(endpoint, collectorUnit) {
 import { constants } from "fs";
 import { createHmac, randomUUID } from "crypto";
 import { chmod, lstat, mkdir, open, readdir, rename, rmdir, stat, unlink } from "fs/promises";
-import { dirname as dirname7, join as join6, resolve as resolve5 } from "path";
+import { dirname as dirname7, join as join7, resolve as resolve5 } from "path";
 import { isIP as isIP3 } from "net";
 
 // src/cloudflare-edge.ts
@@ -13102,7 +13195,7 @@ function cloudflareHostHandoffPath(checkpointPath, nodeName) {
   const normalized = nodeName.trim().toLowerCase();
   if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(normalized))
     throw new Error("Cloudflare host handoff node name is invalid");
-  return join6(`${resolve5(checkpointPath)}.hosts`, `${normalized}.json`);
+  return join7(`${resolve5(checkpointPath)}.hosts`, `${normalized}.json`);
 }
 async function readCloudflareHostHandoff(handoffPath, nodeName) {
   let parsed;
@@ -13484,7 +13577,7 @@ async function removeCloudflareBootstrapSecrets(checkpointPath, output) {
       throw new Error("Cloudflare host handoff directory contains unexpected files; refusing secret cleanup");
     }
     for (const name of expected)
-      await unlink(join6(directory, name));
+      await unlink(join7(directory, name));
     await rmdir(directory);
   }
   await unlink(resolve5(checkpointPath));
@@ -13926,7 +14019,7 @@ var LIFECYCLE_PROFILE = "/etc/forgezero/lifecycle.json";
 var CONTROL_SOCKET = "/run/forgezero/control.sock";
 var CLOUDFLARED_METRICS_ADDRESS = "127.0.0.1:20241";
 var CLOUDFLARED_DIAGNOSTICS_URL = `http://${CLOUDFLARED_METRICS_ADDRESS}/diag/tunnel`;
-var PACKAGED_AGENT_BIN = fileURLToPath(new URL("./fz-agent.js", import.meta.url));
+var PACKAGED_AGENT_BIN = fileURLToPath2(new URL("./fz-agent.js", import.meta.url));
 var privateOrigin = (value) => {
   let url;
   try {
@@ -14153,7 +14246,7 @@ var unitEscape = (value) => {
 };
 function databaseUnit(config) {
   const db = config.database;
-  const join7 = db.role === "joiner" ? ` --starter.join=${unitEscape(db.master)}` : "";
+  const join8 = db.role === "joiner" ? ` --starter.join=${unitEscape(db.master)}` : "";
   const agency = db.agency === "none" ? " --cluster.start-agent=false --cluster.start-coordinator=true --cluster.start-dbserver=true" : "";
   return `[Unit]
 Description=ForgeZero ArangoDB Community 3.11.14 cluster (${db.role}; agency=${db.agency})
@@ -14165,7 +14258,7 @@ Type=simple
 User=arangodb
 Group=arangodb
 LoadCredentialEncrypted=arangodb-jwt:${JWT_CREDENTIAL}
-ExecStart=/usr/bin/arangodb --starter.mode=cluster --starter.address=${unitEscape(db.address)} --starter.host=${unitEscape(db.address)} --starter.data-dir=/var/lib/forgezero-cluster --auth.jwt-secret=%d/arangodb-jwt${join7}${agency}
+ExecStart=/usr/bin/arangodb --starter.mode=cluster --starter.address=${unitEscape(db.address)} --starter.host=${unitEscape(db.address)} --starter.data-dir=/var/lib/forgezero-cluster --auth.jwt-secret=%d/arangodb-jwt${join8}${agency}
 Restart=always
 RestartSec=5
 UMask=0077
@@ -15492,11 +15585,11 @@ async function runCloudflareBootstrapFinalizeCommand(configPath, dependencies =
 
 // src/operator-bootstrap.ts
 import { createHash as createHash6, randomBytes as randomBytes9 } from "crypto";
-import { chmodSync as chmodSync6, lstatSync as lstatSync7, mkdirSync as mkdirSync12, mkdtempSync, readFileSync as readFileSync12, rmSync as rmSync7, writeFileSync as writeFileSync12 } from "fs";
+import { chmodSync as chmodSync6, lstatSync as lstatSync7, mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync2, readFileSync as readFileSync12, rmSync as rmSync7, writeFileSync as writeFileSync12 } from "fs";
 import { isIP as isIP6 } from "net";
-import { tmpdir } from "os";
-import { basename as basename2, dirname as dirname13, isAbsolute as isAbsolute5, join as join10, resolve as resolve9 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { tmpdir as tmpdir2 } from "os";
+import { basename as basename2, dirname as dirname13, isAbsolute as isAbsolute5, join as join11, resolve as resolve9 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/metal-bootstrap.ts
 import { createHash as createHash5, randomBytes as randomBytes8 } from "crypto";
@@ -15515,15 +15608,15 @@ import {
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync11
 } from "fs";
-import { dirname as dirname12, isAbsolute as isAbsolute4, join as join9, resolve as resolve8 } from "path";
+import { dirname as dirname12, isAbsolute as isAbsolute4, join as join10, resolve as resolve8 } from "path";
 import { isIP as isIP5 } from "net";
 
 // src/metal-isolation.ts
 import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 
 // src/metal-provision.ts
-import { dirname as dirname11, isAbsolute as isAbsolute3, join as join7 } from "path";
+import { dirname as dirname11, isAbsolute as isAbsolute3, join as join8 } from "path";
 import { isIP as isIP4 } from "net";
 var SAFE_NAME2 = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}$/;
 var DEVICE = /^[a-zA-Z][a-zA-Z0-9_.-]{0,14}$/;
@@ -15719,15 +15812,15 @@ async function applyMetalIsolation(profile, exec = defaultExec) {
   await requireGuestsInSlice(exec);
   const unitDir = profile.unitDir;
   mkdirSync10(unitDir, { recursive: true });
-  writeFileSync10(join8(unitDir, "forgezero-guests.slice"), metalGuestSliceUnit(profile), { mode: 420 });
+  writeFileSync10(join9(unitDir, "forgezero-guests.slice"), metalGuestSliceUnit(profile), { mode: 420 });
   for (const unit of ["system.slice", "user.slice"]) {
-    const directory = join8(unitDir, `${unit}.d`);
+    const directory = join9(unitDir, `${unit}.d`);
     mkdirSync10(directory, { recursive: true });
-    writeFileSync10(join8(directory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "slice"), { mode: 420 });
+    writeFileSync10(join9(directory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "slice"), { mode: 420 });
   }
-  const initDirectory = join8(unitDir, "init.scope.d");
+  const initDirectory = join9(unitDir, "init.scope.d");
   mkdirSync10(initDirectory, { recursive: true });
-  writeFileSync10(join8(initDirectory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "scope"), { mode: 420 });
+  writeFileSync10(join9(initDirectory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "scope"), { mode: 420 });
   await checked4(exec, ["systemctl", "daemon-reload"]);
   await requireGuestsInSlice(exec);
   const properties = [`AllowedCPUs=${profile.housekeepingCpus}`];
@@ -16107,9 +16200,9 @@ var installAgentBinary = (source, version) => {
   validateAgentSourcePath(source);
   const release = `/opt/forgezero/agent/versions/${version}/dist`;
   mkdirSync11(release, { recursive: true, mode: 493 });
-  copyFileSync2(source, join9(release, "fz-agent.js"));
-  chmodSync5(join9(release, "fz-agent.js"), 493);
-  chownSync(join9(release, "fz-agent.js"), 0, 0);
+  copyFileSync2(source, join10(release, "fz-agent.js"));
+  chmodSync5(join10(release, "fz-agent.js"), 493);
+  chownSync(join10(release, "fz-agent.js"), 0, 0);
   mkdirSync11("/opt/forgezero/agent", { recursive: true, mode: 493 });
   for (const [link, target] of [
     ["/opt/forgezero/agent/current.next", `versions/${version}`],
@@ -16259,7 +16352,7 @@ async function applyMetalBootstrap(config, options) {
   }
   await applyMetalIsolation(config.profile, (argv2) => exec(argv2));
   for (const [unit, body] of Object.entries(renderMetalUnits(config)))
-    atomicWrite2(join9(UNIT_DIRECTORY, unit), body, 420);
+    atomicWrite2(join10(UNIT_DIRECTORY, unit), body, 420);
   await runChecked(exec, ["/usr/bin/systemctl", "daemon-reload"]);
   await runChecked(exec, [
     "/usr/bin/systemctl",
@@ -16393,7 +16486,7 @@ async function metalBootstrapStatus(exec = defaultExec2) {
     "forgezero-metal-agent-egress.service",
     "forgezero-metal-agent.service"
   ]) {
-    if (!existsSync10(join9(UNIT_DIRECTORY, unit)))
+    if (!existsSync10(join10(UNIT_DIRECTORY, unit)))
       units[unit] = "missing";
     else
       units[unit] = (await exec(["/usr/bin/systemctl", "is-active", "--quiet", unit])).exitCode === 0 ? "active" : "inactive";
@@ -16922,7 +17015,7 @@ function writeKnownHosts(request, directory) {
   const lines = [`fz-operator-target ${request.target.hostKey}`];
   if (request.target.jump)
     lines.push(`${hostLabel(request.target.jump.address, request.target.jump.port)} ${request.target.jump.hostKey}`);
-  const path = join10(directory, "known_hosts");
+  const path = join11(directory, "known_hosts");
   writeFileSync12(path, `${lines.join(`
 `)}
 `, { mode: 384, flag: "wx" });
@@ -17012,7 +17105,7 @@ async function collectOperatorGuestHostKeys(request, options = {}, includeRehear
   publicIdentity(request.target.identityPublicKeyFile);
   socketPath(request.target.agentSocket);
   const exec = options.exec ?? defaultExec3;
-  const directory = mkdtempSync(join10(tmpdir(), "forgezero-operator-host-keys-"));
+  const directory = mkdtempSync2(join11(tmpdir2(), "forgezero-operator-host-keys-"));
   try {
     const knownHosts = writeKnownHosts(request, directory);
     const nodes = [];
@@ -17048,7 +17141,7 @@ async function stageConfig(config, directory) {
   const staged = [];
   for (const [name, source] of secretSources(config)) {
     const bytes = ownerFile(source, SECRET_LIMIT, name);
-    const local = join10(directory, name);
+    const local = join11(directory, name);
     writeFileSync12(local, bytes, { mode: 384, flag: "wx" });
     staged.push(name);
     const remotePath = `${REMOTE_STAGE}/${name}`;
@@ -17068,7 +17161,7 @@ async function stageConfig(config, directory) {
     manifestFile: `${REMOTE_STAGE}/bootstrap-api.bundle.json`,
     branch: bundle.manifest.branch
   };
-  const path = join10(directory, "platform-config.json");
+  const path = join11(directory, "platform-config.json");
   writeFileSync12(path, `${JSON.stringify(rewritten, null, 2)}
 `, { mode: 384, flag: "wx" });
   return { path, files: staged, bundleFiles };
@@ -17078,14 +17171,14 @@ function stageMetalConfig(config, directory) {
   const files = [];
   if (config.agentSeedFile) {
     const name = "metal-agent-seed";
-    writeFileSync12(join10(directory, name), ownerFile(config.agentSeedFile, SECRET_LIMIT, name), {
+    writeFileSync12(join11(directory, name), ownerFile(config.agentSeedFile, SECRET_LIMIT, name), {
       mode: 384,
       flag: "wx"
     });
     rewritten.agentSeedFile = `${REMOTE_STAGE}/${name}`;
     files.push(name);
   }
-  const path = join10(directory, "metal-config.json");
+  const path = join11(directory, "metal-config.json");
   writeFileSync12(path, `${JSON.stringify(rewritten, null, 2)}
 `, { mode: 384, flag: "wx" });
   return { path, files };
@@ -17097,15 +17190,15 @@ async function verifiedBunArchive(directory, fetcher) {
   const bytes = new Uint8Array(await response.arrayBuffer());
   if (createHash6("sha256").update(bytes).digest("hex") !== BUN_RELEASE_SHA256)
     throw new Error("pinned Bun checksum mismatch");
-  const path = join10(directory, "bun.zip");
+  const path = join11(directory, "bun.zip");
   writeFileSync12(path, bytes, { mode: 384, flag: "wx" });
   return path;
 }
 async function installPackagedAgent(request, knownHosts, exec, directory, remoteTemp, options) {
   const artifacts = [
-    [options.fzCliPath ?? fileURLToPath2(new URL("./fz.js", import.meta.url)), "fz.js"],
-    [options.fzAgentPath ?? fileURLToPath2(new URL("./fz-agent.js", import.meta.url)), "fz-agent.js"],
-    [options.fzGitSshPath ?? fileURLToPath2(new URL("./fz-git-ssh.js", import.meta.url)), "fz-git-ssh.js"]
+    [options.fzCliPath ?? fileURLToPath3(new URL("./fz.js", import.meta.url)), "fz.js"],
+    [options.fzAgentPath ?? fileURLToPath3(new URL("./fz-agent.js", import.meta.url)), "fz-agent.js"],
+    [options.fzGitSshPath ?? fileURLToPath3(new URL("./fz-git-ssh.js", import.meta.url)), "fz-git-ssh.js"]
   ];
   for (const [artifact] of artifacts) {
     if (!readFileSync12(artifact).length)
@@ -17148,7 +17241,7 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
   publicIdentity(request.target.identityPublicKeyFile);
   socketPath(request.target.agentSocket);
   const exec = options.exec ?? defaultExec3;
-  const directory = mkdtempSync(join10(tmpdir(), "forgezero-operator-bootstrap-"));
+  const directory = mkdtempSync2(join11(tmpdir2(), "forgezero-operator-bootstrap-"));
   const remoteTemp = `/tmp/forgezero-operator-${randomBytes9(12).toString("hex")}`;
   let knownHosts = "";
   try {
@@ -17165,7 +17258,7 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
     await installPackagedAgent(request, knownHosts, exec, directory, remoteTemp, options);
     await copy(exec, request, knownHosts, staged.path, `${remoteTemp}/platform-config.json`, true);
     for (const name of staged.files)
-      await copy(exec, request, knownHosts, join10(directory, name), `${remoteTemp}/${name}`, true);
+      await copy(exec, request, knownHosts, join11(directory, name), `${remoteTemp}/${name}`, true);
     for (const bundle of staged.bundleFiles)
       await copy(exec, request, knownHosts, bundle.source, `${remoteTemp}/${bundle.name}`, true);
     for (const name of ["platform-config.json", ...staged.files, ...staged.bundleFiles.map(({ name: name2 }) => name2)])
@@ -17213,7 +17306,7 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
   publicIdentity(request.target.identityPublicKeyFile);
   socketPath(request.target.agentSocket);
   const exec = options.exec ?? defaultExec3;
-  const directory = mkdtempSync(join10(tmpdir(), "forgezero-operator-metal-"));
+  const directory = mkdtempSync2(join11(tmpdir2(), "forgezero-operator-metal-"));
   const remoteTemp = `/tmp/forgezero-operator-${randomBytes9(12).toString("hex")}`;
   let knownHosts = "";
   try {
@@ -17246,7 +17339,7 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
     await installPackagedAgent(request, knownHosts, exec, directory, remoteTemp, options);
     await copy(exec, request, knownHosts, staged.path, `${remoteTemp}/metal-config.json`, true);
     for (const name of staged.files)
-      await copy(exec, request, knownHosts, join10(directory, name), `${remoteTemp}/${name}`, true);
+      await copy(exec, request, knownHosts, join11(directory, name), `${remoteTemp}/${name}`, true);
     for (const name of ["metal-config.json", ...staged.files])
       await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0600", `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`], "remote metal handoff", true);
     const initialized = await remoteRegularFileExists(exec, request, knownHosts, "/etc/forgezero/metal.initialized.json");
@@ -17515,7 +17608,7 @@ async function applyHostMaintenance(request, runtime = localRuntime()) {
 
 // src/cli/maintenance.ts
 import { existsSync as existsSync11, lstatSync as lstatSync9, readFileSync as readFileSync14, realpathSync as realpathSync5 } from "fs";
-import { isAbsolute as isAbsolute6, join as join11, relative as relative2, resolve as resolve10 } from "path";
+import { isAbsolute as isAbsolute6, join as join12, relative as relative2, resolve as resolve10 } from "path";
 var API_OPERATION_ENTRYPOINTS = {
   "dev-reset": ["src", "server", "maintenance", "dev-reset.ts"],
   "db-backup": ["src", "server", "maintenance", "snapshot-backup.ts"],
@@ -17584,7 +17677,7 @@ function unsupportedRepositoryCliOption(argv2) {
   return;
 }
 function manifestName(root) {
-  const manifestPath = join11(root, "package.json");
+  const manifestPath = join12(root, "package.json");
   if (!existsSync11(manifestPath)) {
     throw new Error(`No package.json exists at repository root ${root}.`);
   }
@@ -17600,7 +17693,7 @@ function manifestName(root) {
   return name;
 }
 function checkedEntrypoint(root, parts) {
-  const candidate = join11(root, ...parts);
+  const candidate = join12(root, ...parts);
   if (!existsSync11(candidate) || !lstatSync9(candidate).isFile()) {
     throw new Error(`The reviewed operation entrypoint is missing: ${candidate}`);
   }
@@ -17628,7 +17721,7 @@ function resolveRepositoryOperation(operation, requestedRoot) {
       };
     }
     if (name === "forgezero") {
-      const apiRoot = realpathSync5(join11(root, "api"));
+      const apiRoot = realpathSync5(join12(root, "api"));
       if (manifestName(apiRoot) !== "@forgezero/api") {
         throw new Error(`${apiRoot} is not the ForgeZero API package.`);
       }
@@ -17670,7 +17763,7 @@ function resolveRepositoryOperation(operation, requestedRoot) {
       ])
     };
   }
-  const rehearsalRoot = join11(root, "tests", "rehearsals", "community-cluster-api");
+  const rehearsalRoot = join12(root, "tests", "rehearsals", "community-cluster-api");
   return {
     operation,
     root,
@@ -17724,7 +17817,7 @@ function planAppBuild(input) {
 
 // src/cli/index.ts
 var DEFAULT_MODE = (THRESHOLD_MODES.find((mode) => mode.threshold === 1 && mode.total === 1) ?? THRESHOLD_MODES[0]).id;
-var PACKAGED_AGENT_BIN2 = fileURLToPath3(new URL("./fz-agent.js", import.meta.url));
+var PACKAGED_AGENT_BIN2 = fileURLToPath4(new URL("./fz-agent.js", import.meta.url));
 function parseOptions(argv2) {
   const options = {
     api: process.env.FZ_API ?? "http://localhost:8787",
@@ -17747,6 +17840,14 @@ function parseOptions(argv2) {
     deploySoftware: [],
     deployChannel: "production",
     requireAttestation: false,
+    deployInitCustomized: false,
+    deployRuntime: "native",
+    deployReplicas: 1,
+    deployCpuCores: 1,
+    deployMemoryMiB: 512,
+    deployStorageGiB: 8,
+    deploySharing: "exclusive",
+    deployReuse: "require",
     force: false,
     noBrowser: false,
     provider: "github",
@@ -17798,7 +17899,55 @@ function parseOptions(argv2) {
         options.optionError = "--channel must be production or development.";
     } else if (token === "--attestation")
       options.requireAttestation = true;
-    else if (token === "--force")
+    else if (token === "--runtime") {
+      const value = argv2[++index];
+      options.deployInitCustomized = true;
+      if (value === "native" || value === "containerd" || value === "kata-snp")
+        options.deployRuntime = value;
+      else
+        options.optionError = "--runtime must be native, containerd, or kata-snp.";
+    } else if (token === "--os") {
+      const value = argv2[++index];
+      options.deployInitCustomized = true;
+      if (value === "ubuntu-24.04" || value === "ubuntu-26.04")
+        options.deployOperatingSystem = value;
+      else
+        options.optionError = "--os must be ubuntu-24.04 or ubuntu-26.04.";
+    } else if (token === "--isolation") {
+      const value = argv2[++index];
+      options.deployInitCustomized = true;
+      if (value === "standard" || value === "sev-snp")
+        options.deployIsolation = value;
+      else
+        options.optionError = "--isolation must be standard or sev-snp.";
+    } else if (["--replicas", "--cpu-cores", "--memory-mib", "--storage-gib"].includes(token)) {
+      const value = Number(argv2[++index] ?? "");
+      options.deployInitCustomized = true;
+      if (!Number.isSafeInteger(value) || value < 1)
+        options.optionError = `${token} must be a positive integer.`;
+      else if (token === "--replicas")
+        options.deployReplicas = value;
+      else if (token === "--cpu-cores")
+        options.deployCpuCores = value;
+      else if (token === "--memory-mib")
+        options.deployMemoryMiB = value;
+      else
+        options.deployStorageGiB = value;
+    } else if (token === "--sharing") {
+      const value = argv2[++index];
+      options.deployInitCustomized = true;
+      if (value === "exclusive" || value === "shared")
+        options.deploySharing = value;
+      else
+        options.optionError = "--sharing must be exclusive or shared.";
+    } else if (token === "--reuse") {
+      const value = argv2[++index];
+      options.deployInitCustomized = true;
+      if (value === "require" || value === "prefer")
+        options.deployReuse = value;
+      else
+        options.optionError = "--reuse must be require or prefer.";
+    } else if (token === "--force")
       options.force = true;
     else if (token === "--browser")
       options.noBrowser = false;
@@ -18614,7 +18763,7 @@ function interactiveGenesisGuests() {
     name: bootstrapAnswer(`Guest ${index} name`),
     address: bootstrapAnswer(`Guest ${index} private IPv4`),
     imageKey: bootstrapAnswer(`Guest ${index} OS image key`, SUPPORTED_GUEST_IMAGE.key),
-    cpuPoolKey: bootstrapAnswer(`Guest ${index} exclusive CPU pool key`),
+    cpuPoolKey: bootstrapAnswer(`Guest ${index} preferred NUMA CPU pool key (capacity is sliced by request)`),
     physicalCores: bootstrapNumber(`Guest ${index} physical cores`),
     vcpu: bootstrapNumber(`Guest ${index} vCPUs`),
     memoryGib: bootstrapNumber(`Guest ${index} memory GiB`),
@@ -18634,10 +18783,10 @@ function interactiveGenesisGuests() {
 function writeMetalOperatorFiles(directory) {
   const output = genesisOutputDirectory(directory);
   const config = interactiveMetalBootstrap();
-  const metalConfig = writeBootstrapConfig(join12(output, "metal.json"), config);
+  const metalConfig = writeBootstrapConfig(join13(output, "metal.json"), config);
   const identity = operatorIdentityCoordinates();
   const target = interactiveOperatorHop("Metal", { user: "root" });
-  const remoteRequest = writeOperatorMetalBootstrapRequest(join12(output, "metal-remote.json"), {
+  const remoteRequest = writeOperatorMetalBootstrapRequest(join13(output, "metal-remote.json"), {
     kind: "metal-remote",
     metalConfigFile: metalConfig,
     target: { ...target, ...identity },
@@ -18655,7 +18804,7 @@ function writePlatformGenesisFleet(directory) {
   const metalHostname = readMetalBootstrapConfig(metalRequest.metalConfigFile, {
     allowHistoricalRelease: true
   }).metalHostname;
-  const checkpointPath = join12(output, "cloudflare-handoff.json");
+  const checkpointPath = join13(output, "cloudflare-handoff.json");
   const template = interactiveBootstrap("platform", fleet, checkpointPath);
   const region = {
     label: bootstrapAnswer(`Region ${template.runtime.environment.nodeRegion} display label`),
@@ -18670,7 +18819,7 @@ function writePlatformGenesisFleet(directory) {
     cloudflareHandoffFile: cloudflareHostHandoffPath(checkpointPath, guest.name)
   });
   const realtimeEnabled = bootstrapBoolean("Configure existing Worker realtime fan-out?", "yes");
-  const cloudflareConfig = writeBootstrapConfig(join12(output, "cloudflare.json"), createCloudflareBootstrapDiscoveryCommandConfig({
+  const cloudflareConfig = writeBootstrapConfig(join13(output, "cloudflare.json"), createCloudflareBootstrapDiscoveryCommandConfig({
     checkpointPath,
     discovery: {
       zoneName: bootstrapAnswer("Cloudflare DNS zone name", "forgezero.net"),
@@ -18688,7 +18837,7 @@ function writePlatformGenesisFleet(directory) {
       tunnelName: bootstrapAnswer(`${guest.name} Tunnel name`, guest.name)
     }))
   }));
-  const cloudflareAcceptance = join12(output, "cloudflare-acceptance.json");
+  const cloudflareAcceptance = join13(output, "cloudflare-acceptance.json");
   const configs = platformGenesisBootstrapConfigs(template, fleet, nodes, metalHostname, region).map((config) => {
     const path = `${output}/${config.computeReference}-platform.json`;
     writeBootstrapConfig(path, config);
@@ -18697,7 +18846,7 @@ function writePlatformGenesisFleet(directory) {
   const requests = configs.map((platformConfigFile, index) => {
     const guest = fleet[index];
     const host = guestHostKeys.nodes.find(({ name }) => name === guest.name);
-    return writeOperatorPlatformBootstrapRequest(join12(output, `${guest.name}-remote.json`), {
+    return writeOperatorPlatformBootstrapRequest(join13(output, `${guest.name}-remote.json`), {
       kind: "platform-remote",
       platformConfigFile,
       target: {
@@ -18718,7 +18867,7 @@ function writePlatformGenesisFleet(directory) {
       }
     });
   });
-  const fleetRequest = writeOperatorPlatformBootstrapFleetRequest(join12(output, "platform-fleet-remote.json"), requests, { configFile: cloudflareConfig, acceptanceFile: cloudflareAcceptance });
+  const fleetRequest = writeOperatorPlatformBootstrapFleetRequest(join13(output, "platform-fleet-remote.json"), requests, { configFile: cloudflareConfig, acceptanceFile: cloudflareAcceptance });
   return { configs, requests, fleetRequest, cloudflareConfig, cloudflareAcceptance };
 }
 function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint) {
@@ -19457,7 +19606,7 @@ async function cmdDeploy(options, args) {
     if (options.optionError)
       throw new Error(options.optionError);
     if (operation === "init") {
-      if (options.deploySoftware.length > 0 || options.deployProfile !== "app" || options.requireAttestation) {
+      if (!options.deployInitCustomized && (options.deploySoftware.length > 0 || options.deployProfile !== "app" || options.requireAttestation)) {
         const created = initializeDeployFile(options.projectRoot, {
           name: options.projectName,
           profile: options.deployProfile,
@@ -19472,7 +19621,23 @@ async function cmdDeploy(options, args) {
           out.ok(`Initialized legacy .fz/deploy.json (${created.summary.digest}).`);
         return 0;
       }
-      initializeTypeScriptDeployment(options.projectRoot, { name: options.projectName ?? basename3(resolve12(options.projectRoot)), force: options.force });
+      if (options.deployInitCustomized && (options.deploySoftware.length > 0 || options.requireAttestation)) {
+        throw new Error("typed runtime initialization selects its tested software and attestation from --runtime/--isolation; do not combine --software or --attestation");
+      }
+      initializeTypeScriptDeployment(options.projectRoot, {
+        name: options.projectName ?? basename3(resolve12(options.projectRoot)),
+        force: options.force,
+        runtime: options.deployRuntime,
+        operatingSystem: options.deployOperatingSystem,
+        isolation: options.deployIsolation,
+        replicas: options.deployReplicas,
+        cpuCores: options.deployCpuCores,
+        memoryMiB: options.deployMemoryMiB,
+        storageGiB: options.deployStorageGiB,
+        sharing: options.deploySharing,
+        reuse: options.deployReuse,
+        profile: options.deployProfile
+      });
       const compiled = await compileDeploymentProject(options.projectRoot);
       if (options.json)
         out.line(JSON.stringify({ source: compiled.source, output: compiled.output, digest: compiled.digest }, null, 2));
@@ -19724,7 +19889,9 @@ function usage() {
 	 fz project check        Fail when truth sources or generated adapters drift
 	 fz app build            Build the static App for a numbered local/development/
 	                         production choice, --profile, or an explicit --api origin
-    fz deploy init          Create forgezero.deploy.ts and its fail-safe canonical plan
+	 fz deploy init          Create forgezero.deploy.ts and its fail-safe canonical plan;
+	                         select native, containerd runc, or Kata QEMU SNP and
+	                         explicit per-compute resources with the options below
     fz deploy compile       Compile TypeScript into .fz/deploy.plan.json
     fz deploy check         Validate source, plan, actions, providers and topology
     fz deploy sync          Prove readiness and print the Git synchronization rule
@@ -19795,6 +19962,15 @@ function usage() {
     --software <key@ver>    Initial tested software coordinate; repeatable
     --channel <name>        Catalog view: production or development (shows testing)
     --attestation           Require hardware attestation for every deploy step
+	 --runtime <mode>        native, containerd, or kata-snp
+	 --os <image>            ubuntu-24.04 or ubuntu-26.04 (SNP requires 26.04)
+	 --isolation <mode>      standard or sev-snp
+	 --replicas <n>          Exact initial compute cardinality (default 1)
+	 --cpu-cores <n>         Reserved CPU cores per compute
+	 --memory-mib <n>        Reserved memory MiB per compute
+	 --storage-gib <n>       Reserved storage GiB per compute
+	 --sharing <mode>       exclusive or shared (native requires exclusive)
+	 --reuse <mode>         require existing capacity or prefer reuse then approved provisioning
     --force                 Init may replace an existing generated target
 
   REMOTE DEPLOY OPTIONS