@vibesdotdev/platform 0.0.0-stage → 1.0.0-rc.2

package/dist/fleets/pairing/platform/platform-discovery.d.ts

@@ -0,0 +1,56 @@
+/**
+ * `fleet/discovery/platform` — platform-pairing discovery+authz adapter
+ * (fleet.md §4.6).
+ *
+ * Finds hosts the *platform record API* already knows (`status: active`) and
+ * registers each as a `runtime/rpc` http or relay target. It is also the
+ * *connection-credential* adapter: it stamps the caller's canonical
+ * `CredentialReference` into `auth` so the transport can authenticate the
+ * connection without the descriptor carrying bearer bytes.
+ *
+ * TWO BOUNDARIES THIS ADAPTER HOLDS (do not regress):
+ *  1. It does NOT own the pairing handshake. The operator runs `vibes pair --code
+ *     ABC`; the platform record API validates it and writes the host record. This
+ *     adapter consumes the *result* — an active host with a daemon URL — and makes
+ *     it discoverable (fleet.md §4.6, §10 q3). Doc-03's pairing flow is preserved.
+ *  2. `auth` is a *connection* credential only. A bearer token opens a transport;
+ *     it never authorizes the invokes that ride it. Per-invoke authz + friction
+ *     are L5's two callee gates (correction #5). This adapter never resolves the
+ *     credential to a plaintext token — it emits a `CredentialReference` the
+ *     transport resolves at connect time through its injected environment or
+ *     secrets-store reader.
+ *
+ * THE PLATFORM CALL IS A PORT (`PlatformHostDirectory`), injected by the caller.
+ * The CONTRACT is the deliverable — a test supplies a mock directory; production
+ * wires the real platform host record API. This package never calls a cloud
+ * endpoint directly.
+ */
+import { type RuntimeRpcDescriptor, type CredentialReference } from '@vibesdotdev/kernel-rpc';
+import type { FleetDiscoveryAdapter } from '@vibesdotdev/platform/fleets/pairing';
+import { PLATFORM_DISCOVERY_ADAPTER_ID, type PlatformHostRecord, type PlatformHostDirectory, type PlatformDiscoveryOptions } from './ids.ts';
+export { PLATFORM_DISCOVERY_ADAPTER_ID, type PlatformHostRecord, type PlatformHostDirectory, type PlatformDiscoveryOptions };
+/** Return the connection-credential reference for a host. Never a resolved token. */
+export declare function platformAuthReference(record: PlatformHostRecord): CredentialReference;
+/**
+ * Build the `runtime/rpc` descriptor for one platform host record.
+ *
+ * Two reachability shapes (exactly one of `relayBrokerOrigin` / `daemonOrigin`):
+ *   - relay  — a NAT'd home machine reachable through the broker DO (the daemon
+ *              dials out). `transport:'relay'`, target `{ brokerOrigin, hostId }`.
+ *   - http   — a directly-addressable host (e.g. a public-IP cloud VM) reachable
+ *              at its daemon origin. `transport:'http'`, target `{ origin }`.
+ *
+ * `auth` carries a canonical `CredentialReference` either way. Validates
+ * against L4a's frozen `RuntimeRpcDescriptorSchema`.
+ */
+export declare function buildPlatformRpcDescriptor(record: PlatformHostRecord): RuntimeRpcDescriptor;
+/**
+ * Create the platform-pairing discovery adapter over an injected directory port.
+ * `discover()` lists the active hosts and yields one `runtime/rpc` descriptor
+ * per host (http or relay transport + an unresolved `auth` reference).
+ *
+ * No teardown: this adapter found existing, platform-owned hosts; it never
+ * created them (correction #4). It has no `destroy`.
+ */
+export declare function createPlatformDiscoveryAdapter(directory: PlatformHostDirectory, options?: PlatformDiscoveryOptions): FleetDiscoveryAdapter;
+//# sourceMappingURL=platform-discovery.d.ts.map

package/dist/fleets/pairing/platform/platform-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-discovery.d.ts","sourceRoot":"","sources":["../../../../src/fleets/pairing/platform/platform-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAEN,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EACN,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,MAAM,UAAU,CAAC;AAIlB,OAAO,EACN,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,CAAC;AAEF,qFAAqF;AACrF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,GAAG,mBAAmB,CAErF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,GAAG,oBAAoB,CA2C3F;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC7C,SAAS,EAAE,qBAAqB,EAChC,OAAO,GAAE,wBAA6B,GACpC,qBAAqB,CAWvB"}

package/dist/fleets/pairing/platform/platform-discovery.js

@@ -0,0 +1,113 @@
+/**
+ * `fleet/discovery/platform` — platform-pairing discovery+authz adapter
+ * (fleet.md §4.6).
+ *
+ * Finds hosts the *platform record API* already knows (`status: active`) and
+ * registers each as a `runtime/rpc` http or relay target. It is also the
+ * *connection-credential* adapter: it stamps the caller's canonical
+ * `CredentialReference` into `auth` so the transport can authenticate the
+ * connection without the descriptor carrying bearer bytes.
+ *
+ * TWO BOUNDARIES THIS ADAPTER HOLDS (do not regress):
+ *  1. It does NOT own the pairing handshake. The operator runs `vibes pair --code
+ *     ABC`; the platform record API validates it and writes the host record. This
+ *     adapter consumes the *result* — an active host with a daemon URL — and makes
+ *     it discoverable (fleet.md §4.6, §10 q3). Doc-03's pairing flow is preserved.
+ *  2. `auth` is a *connection* credential only. A bearer token opens a transport;
+ *     it never authorizes the invokes that ride it. Per-invoke authz + friction
+ *     are L5's two callee gates (correction #5). This adapter never resolves the
+ *     credential to a plaintext token — it emits a `CredentialReference` the
+ *     transport resolves at connect time through its injected environment or
+ *     secrets-store reader.
+ *
+ * THE PLATFORM CALL IS A PORT (`PlatformHostDirectory`), injected by the caller.
+ * The CONTRACT is the deliverable — a test supplies a mock directory; production
+ * wires the real platform host record API. This package never calls a cloud
+ * endpoint directly.
+ */
+import { RuntimeRpcDescriptorSchema } from '@vibesdotdev/kernel-rpc';
+import { PLATFORM_DISCOVERY_ADAPTER_ID } from "./ids.js";
+// Re-export the static descriptor identity + port types so the public surface
+// (index.ts and tests) stays centralized in the identity module.
+export { PLATFORM_DISCOVERY_ADAPTER_ID };
+/** Return the connection-credential reference for a host. Never a resolved token. */
+export function platformAuthReference(record) {
+    return { ...record.connectionCredential };
+}
+/**
+ * Build the `runtime/rpc` descriptor for one platform host record.
+ *
+ * Two reachability shapes (exactly one of `relayBrokerOrigin` / `daemonOrigin`):
+ *   - relay  — a NAT'd home machine reachable through the broker DO (the daemon
+ *              dials out). `transport:'relay'`, target `{ brokerOrigin, hostId }`.
+ *   - http   — a directly-addressable host (e.g. a public-IP cloud VM) reachable
+ *              at its daemon origin. `transport:'http'`, target `{ origin }`.
+ *
+ * `auth` carries a canonical `CredentialReference` either way. Validates
+ * against L4a's frozen `RuntimeRpcDescriptorSchema`.
+ */
+export function buildPlatformRpcDescriptor(record) {
+    const base = {
+        id: record.hostRecordId,
+        kind: 'runtime/rpc',
+        name: `Platform host ${record.hostId}`,
+        enabled: true,
+        // Connection credential ONLY (correction #5) — a reference, never a token.
+        auth: platformAuthReference(record)
+    };
+    let descriptor;
+    if (record.relayBrokerOrigin) {
+        // Relay reachability: route through the broker DO. The daemon holds the
+        // reverse socket; the consumer's relay client transport dials the broker.
+        const brokerOrigin = new URL(record.relayBrokerOrigin).origin;
+        descriptor = {
+            ...base,
+            description: `Paired platform host (record ${record.hostRecordId}), reachable via the relay broker.`,
+            transport: 'relay',
+            target: { transport: 'relay', brokerOrigin, hostId: record.hostId, actingOrgId: record.actingOrgId }
+        };
+    }
+    else if (record.daemonOrigin) {
+        // Direct reachability: the host exposes a daemon at a routable origin.
+        const origin = new URL(record.daemonOrigin).origin;
+        descriptor = {
+            ...base,
+            description: `Paired platform host (record ${record.hostRecordId}), reachable over its daemon endpoint.`,
+            transport: 'http',
+            target: { transport: 'http', origin }
+        };
+    }
+    else {
+        throw new Error(`fleet/discovery/platform: host ${record.hostId} has neither a relayBrokerOrigin ` +
+            `nor a daemonOrigin — it is not reachable and cannot be made discoverable.`);
+    }
+    if (record.remoteScope)
+        descriptor.remoteScope = record.remoteScope;
+    const ok = RuntimeRpcDescriptorSchema.safeParse(descriptor);
+    if (!ok.success) {
+        throw new Error(`fleet/discovery/platform: built an invalid runtime/rpc descriptor: ${ok.error.message}`);
+    }
+    return descriptor;
+}
+/**
+ * Create the platform-pairing discovery adapter over an injected directory port.
+ * `discover()` lists the active hosts and yields one `runtime/rpc` descriptor
+ * per host (http or relay transport + an unresolved `auth` reference).
+ *
+ * No teardown: this adapter found existing, platform-owned hosts; it never
+ * created them (correction #4). It has no `destroy`.
+ */
+export function createPlatformDiscoveryAdapter(directory, options = {}) {
+    return {
+        id: PLATFORM_DISCOVERY_ADAPTER_ID,
+        async *discover(signal) {
+            const records = await directory.listActiveHosts(options.pairingCode);
+            for (const record of records) {
+                if (signal?.aborted)
+                    return;
+                yield buildPlatformRpcDescriptor(record);
+            }
+        }
+    };
+}
+//# sourceMappingURL=platform-discovery.js.map

package/dist/fleets/pairing/platform/platform-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-discovery.js","sourceRoot":"","sources":["../../../../src/fleets/pairing/platform/platform-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EACN,0BAA0B,EAG1B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACN,6BAA6B,EAI7B,MAAM,UAAU,CAAC;AAElB,8EAA8E;AAC9E,iEAAiE;AACjE,OAAO,EACN,6BAA6B,EAI7B,CAAC;AAEF,qFAAqF;AACrF,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC/D,OAAO,EAAE,GAAG,MAAM,CAAC,oBAAoB,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAA0B;IACpE,MAAM,IAAI,GAAG;QACZ,EAAE,EAAE,MAAM,CAAC,YAAY;QACvB,IAAI,EAAE,aAAsB;QAC5B,IAAI,EAAE,iBAAiB,MAAM,CAAC,MAAM,EAAE;QACtC,OAAO,EAAE,IAAI;QACb,2EAA2E;QAC3E,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC;KACnC,CAAC;IAEF,IAAI,UAAgC,CAAC;IACrC,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9B,wEAAwE;QACxE,0EAA0E;QAC1E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC;QAC9D,UAAU,GAAG;YACZ,GAAG,IAAI;YACP,WAAW,EAAE,gCAAgC,MAAM,CAAC,YAAY,oCAAoC;YACpG,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE;SACpG,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QAChC,uEAAuE;QACvE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;QACnD,UAAU,GAAG;YACZ,GAAG,IAAI;YACP,WAAW,EAAE,gCAAgC,MAAM,CAAC,YAAY,wCAAwC;YACxG,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;SACrC,CAAC;IACH,CAAC;SAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACd,kCAAkC,MAAM,CAAC,MAAM,mCAAmC;YACjF,2EAA2E,CAC5E,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,WAAW;QAAE,UAAU,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACpE,MAAM,EAAE,GAAG,0BAA0B,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,sEAAsE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC7C,SAAgC,EAChC,UAAoC,EAAE;IAEtC,OAAO;QACN,EAAE,EAAE,6BAA6B;QACjC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAoB;YACnC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACrE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC9B,IAAI,MAAM,EAAE,OAAO;oBAAE,OAAO;gBAC5B,MAAM,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAC1C,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/fleets/provision/build-runner-setup.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Build-runner toolchain provisioning for fleet hosts (build-job capable).
+ *
+ * A freshly provisioned fleet droplet ships only the compiled `vibes` daemon —
+ * it has neither `git` (the daemon's build-job checkout runs `git clone`, see
+ * `fleet-daemon/src/host-agent/build-job-executor.ts` `checkoutSource`)
+ * nor `bun` (build steps run under it). Any dispatched `infra/build-job` action
+ * therefore fails on a bare host. This module renders the bash that installs
+ * that toolchain so the host can actually service the `infra/build-job`
+ * capability its daemon advertises by default
+ * (`fleet-daemon/src/host-agent/system-info.ts` `defaultActionCapabilities`).
+ *
+ * The script is a caller-supplied `extraScript` for `buildFleetCloudInit` — it
+ * is appended AFTER daemon enrollment is wired, inside the same
+ * `#!/bin/bash` + `set -euo pipefail` cloud-init shell. Because the same string
+ * flows through platform-web's `handleHostProvision` (workerd), this is a pure
+ * string builder: NO Node/Bun APIs, no filesystem, no secrets.
+ *
+ * Idempotency: guards every reinstall (git/unzip via `command -v`, bun via an
+ * executable check), so re-running cloud-init is a no-op.
+ *
+ * PATH: the fleet daemon runs as a systemd SYSTEM unit (`HOME=/root`, no login
+ * shell). systemd's default `PATH` includes `/usr/local/bin` and `/usr/bin` but
+ * NOT `/root/.bun/bin`. `apt-get` puts `git` at `/usr/bin/git` (already on that
+ * PATH); the bun installer drops it under `/root/.bun/bin`, so we symlink it to
+ * `/usr/local/bin/bun`. The daemon's heartbeat re-runs capability discovery
+ * (`Bun.which('git' | 'bun')`) live, so the next heartbeat re-advertises the
+ * `git.*`/`bun.*` tool capabilities once this lands — no daemon restart needed.
+ */
+/** bun's official installer. Same trust posture as the `vibes` CLI installer already piped in `cloud-init.ts`. */
+export declare const BUILD_RUNNER_BUN_INSTALL_URL = "https://bun.sh/install";
+/** Canonical workspace Bun runtime; keep aligned with Developer config/bun-runtime.json. */
+export declare const BUILD_RUNNER_BUN_VERSION = "1.4.3";
+/** Where the bun installer drops the toolchain (root systemd context). */
+export declare const BUILD_RUNNER_BUN_INSTALL_DIR = "/root/.bun";
+/**
+ * Rust toolchain version for bridge-native builds — MUST match the DOKS build
+ * image (`infra/builders/bridge-linux/Dockerfile` `ARG RUST_VERSION`) and
+ * `apps/bridge-native/native/rust-toolchain.toml`. Installed on every
+ * build-runner so a `bridge-*` `infra/build-job` (which requires the
+ * `cargo.build` tool) matches — a CLI-only build never invokes cargo, so the
+ * extra install is harmless there. (The Zig 0.15 toolchain retired with
+ * cohort C10 of the bridge Zig→Rust port.)
+ */
+export declare const BUILD_RUNNER_RUST_VERSION = "1.96.1";
+/** Where rustup installs the toolchain (root systemd context). */
+export declare const BUILD_RUNNER_CARGO_INSTALL_DIR = "/root/.cargo";
+/** Stable marker comment — lets callers/tests detect the block in a rendered cloud-init. */
+export declare const BUILD_RUNNER_SETUP_MARKER = "vibes fleet build-runner toolchain (git + bun)";
+/** Stable marker for the optional private-clone git credential block. */
+export declare const BUILD_RUNNER_GIT_CREDENTIAL_MARKER = "vibes fleet build-runner git credential (private clone)";
+export interface BuildRunnerSetupOptions {
+    /**
+     * Optional GitHub access token. When present, the setup writes a root-only
+     * (0600) git credential so the daemon's plain `git clone` of a PRIVATE
+     * `github.com` repo authenticates via `x-access-token` — the same URL shape
+     * the DOKS build uses (`infra/image-build.ts`). The token is embedded in the
+     * cloud-init user_data (root-only file on the host, same trust surface as the
+     * enrollment token); prefer a short-TTL host and a fine-grained read-only
+     * token. Throws if the value isn't a well-formed GitHub token (no shell
+     * injection into the boot script).
+     */
+    githubToken?: string;
+}
+/**
+ * Returns the idempotent bash that installs `git` + `bun` on a fleet host and
+ * puts both on the daemon's systemd PATH. Intended as the `extraScript` for
+ * {@link buildFleetCloudInit}. Pure string builder (workerd-safe). When
+ * `options.githubToken` is set, also writes a root-only private-clone credential.
+ */
+export declare function buildBuildRunnerSetupScript(options?: BuildRunnerSetupOptions): string;
+//# sourceMappingURL=build-runner-setup.d.ts.map

package/dist/fleets/provision/build-runner-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-runner-setup.d.ts","sourceRoot":"","sources":["../../../src/fleets/provision/build-runner-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,kHAAkH;AAClH,eAAO,MAAM,4BAA4B,2BAA2B,CAAC;AACrE,4FAA4F;AAC5F,eAAO,MAAM,wBAAwB,UAAU,CAAC;AAChD,0EAA0E;AAC1E,eAAO,MAAM,4BAA4B,eAAe,CAAC;AACzD;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAClD,kEAAkE;AAClE,eAAO,MAAM,8BAA8B,iBAAiB,CAAC;AAC7D,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB,mDAAmD,CAAC;AAC1F,yEAAyE;AACzE,eAAO,MAAM,kCAAkC,4DAA4D,CAAC;AAO5G,MAAM,WAAW,uBAAuB;IACvC;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAmBD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,GAAE,uBAA4B,GAAG,MAAM,CAgDzF"}

package/dist/fleets/provision/build-runner-setup.js

@@ -0,0 +1,126 @@
+/**
+ * Build-runner toolchain provisioning for fleet hosts (build-job capable).
+ *
+ * A freshly provisioned fleet droplet ships only the compiled `vibes` daemon —
+ * it has neither `git` (the daemon's build-job checkout runs `git clone`, see
+ * `fleet-daemon/src/host-agent/build-job-executor.ts` `checkoutSource`)
+ * nor `bun` (build steps run under it). Any dispatched `infra/build-job` action
+ * therefore fails on a bare host. This module renders the bash that installs
+ * that toolchain so the host can actually service the `infra/build-job`
+ * capability its daemon advertises by default
+ * (`fleet-daemon/src/host-agent/system-info.ts` `defaultActionCapabilities`).
+ *
+ * The script is a caller-supplied `extraScript` for `buildFleetCloudInit` — it
+ * is appended AFTER daemon enrollment is wired, inside the same
+ * `#!/bin/bash` + `set -euo pipefail` cloud-init shell. Because the same string
+ * flows through platform-web's `handleHostProvision` (workerd), this is a pure
+ * string builder: NO Node/Bun APIs, no filesystem, no secrets.
+ *
+ * Idempotency: guards every reinstall (git/unzip via `command -v`, bun via an
+ * executable check), so re-running cloud-init is a no-op.
+ *
+ * PATH: the fleet daemon runs as a systemd SYSTEM unit (`HOME=/root`, no login
+ * shell). systemd's default `PATH` includes `/usr/local/bin` and `/usr/bin` but
+ * NOT `/root/.bun/bin`. `apt-get` puts `git` at `/usr/bin/git` (already on that
+ * PATH); the bun installer drops it under `/root/.bun/bin`, so we symlink it to
+ * `/usr/local/bin/bun`. The daemon's heartbeat re-runs capability discovery
+ * (`Bun.which('git' | 'bun')`) live, so the next heartbeat re-advertises the
+ * `git.*`/`bun.*` tool capabilities once this lands — no daemon restart needed.
+ */
+import { renderDockerInstallBlock } from "./workspace-host-setup.js";
+/** bun's official installer. Same trust posture as the `vibes` CLI installer already piped in `cloud-init.ts`. */
+export const BUILD_RUNNER_BUN_INSTALL_URL = 'https://bun.sh/install';
+/** Canonical workspace Bun runtime; keep aligned with Developer config/bun-runtime.json. */
+export const BUILD_RUNNER_BUN_VERSION = '1.4.3';
+/** Where the bun installer drops the toolchain (root systemd context). */
+export const BUILD_RUNNER_BUN_INSTALL_DIR = '/root/.bun';
+/**
+ * Rust toolchain version for bridge-native builds — MUST match the DOKS build
+ * image (`infra/builders/bridge-linux/Dockerfile` `ARG RUST_VERSION`) and
+ * `apps/bridge-native/native/rust-toolchain.toml`. Installed on every
+ * build-runner so a `bridge-*` `infra/build-job` (which requires the
+ * `cargo.build` tool) matches — a CLI-only build never invokes cargo, so the
+ * extra install is harmless there. (The Zig 0.15 toolchain retired with
+ * cohort C10 of the bridge Zig→Rust port.)
+ */
+export const BUILD_RUNNER_RUST_VERSION = '1.96.1';
+/** Where rustup installs the toolchain (root systemd context). */
+export const BUILD_RUNNER_CARGO_INSTALL_DIR = '/root/.cargo';
+/** Stable marker comment — lets callers/tests detect the block in a rendered cloud-init. */
+export const BUILD_RUNNER_SETUP_MARKER = 'vibes fleet build-runner toolchain (git + bun)';
+/** Stable marker for the optional private-clone git credential block. */
+export const BUILD_RUNNER_GIT_CREDENTIAL_MARKER = 'vibes fleet build-runner git credential (private clone)';
+/** GitHub tokens are `gho_`/`ghp_`/`ghs_`/`gho_`/`github_pat_` + url-safe chars. Reject anything else
+ * before it reaches a shell — the token is embedded in the boot script, so it must not carry quotes,
+ * whitespace, or shell metacharacters. */
+const GITHUB_TOKEN_PATTERN = /^(gh[posru]_[A-Za-z0-9]{20,255}|github_pat_[A-Za-z0-9_]{20,255})$/;
+function renderGitCredentialBlock(token) {
+    if (!GITHUB_TOKEN_PATTERN.test(token)) {
+        throw new Error('build-runner githubToken is not a well-formed GitHub token');
+    }
+    // Single-quoted, token validated to url-safe chars above — no interpolation risk.
+    return `
+# === ${BUILD_RUNNER_GIT_CREDENTIAL_MARKER} ===
+# Root-only (0600) credential so the daemon's \`git clone\` of a private github.com
+# repo authenticates. Token validated url-safe before render.
+umask 077
+git config --system credential.helper store
+git config --system 'credential.https://github.com.username' x-access-token
+printf 'https://x-access-token:%s@github.com\\n' '${token}' > /root/.git-credentials
+chmod 600 /root/.git-credentials
+`;
+}
+/**
+ * Returns the idempotent bash that installs `git` + `bun` on a fleet host and
+ * puts both on the daemon's systemd PATH. Intended as the `extraScript` for
+ * {@link buildFleetCloudInit}. Pure string builder (workerd-safe). When
+ * `options.githubToken` is set, also writes a root-only private-clone credential.
+ */
+export function buildBuildRunnerSetupScript(options = {}) {
+    const gitCredential = options.githubToken ? renderGitCredentialBlock(options.githubToken) : '';
+    return (`
+# === ${BUILD_RUNNER_SETUP_MARKER} — build-job hosts ===
+# Idempotent: guards reinstalls so a re-run of cloud-init is a no-op.
+set -euo pipefail
+export HOME=/root
+export DEBIAN_FRONTEND=noninteractive
+export BUN_INSTALL=${BUILD_RUNNER_BUN_INSTALL_DIR}
+
+if ! command -v git >/dev/null 2>&1 || ! command -v unzip >/dev/null 2>&1; then
+  apt-get update
+  apt-get install -y git unzip curl ca-certificates
+fi
+
+if [ ! -x "\${BUN_INSTALL}/bin/bun" ] || [ "$("\${BUN_INSTALL}/bin/bun" --version)" != "${BUILD_RUNNER_BUN_VERSION}" ]; then
+  curl -fsSL ${BUILD_RUNNER_BUN_INSTALL_URL} | bash -s "bun-v${BUILD_RUNNER_BUN_VERSION}"
+fi
+
+# Put bun on the daemon's PATH: the systemd system unit (HOME=/root, no login
+# shell) sees /usr/local/bin but not /root/.bun/bin. git lands in /usr/bin,
+# already on the default systemd PATH. No secrets written.
+ln -sf "\${BUN_INSTALL}/bin/bun" /usr/local/bin/bun
+ln -sf "\${BUN_INSTALL}/bin/bunx" /usr/local/bin/bunx
+
+# cargo (bridge-native build, pure Rust since cohort C10): rustup-install the
+# pinned toolchain and symlink cargo onto the daemon PATH so \`Bun.which('cargo')\`
+# advertises the cargo.build tool capability (system-info.ts EXEC_TOOL_IDS).
+# Mirrors the DOKS build image infra/builders/bridge-linux/Dockerfile.
+if [ ! -x ${BUILD_RUNNER_CARGO_INSTALL_DIR}/bin/cargo ]; then
+  curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs | sh -s -- -y --default-toolchain "${BUILD_RUNNER_RUST_VERSION}" --profile minimal
+fi
+ln -sf ${BUILD_RUNNER_CARGO_INSTALL_DIR}/bin/cargo /usr/local/bin/cargo
+ln -sf ${BUILD_RUNNER_CARGO_INSTALL_DIR}/bin/rustc /usr/local/bin/rustc
+
+# docker (Cloudflare Containers image builds and container-backed build jobs):
+# reuse workspace-host-setup's Docker Engine install block so the daemon's
+# heartbeat discovers docker (\`docker --version\` / \`docker.build\` tool capability).
+${renderDockerInstallBlock()}
+
+# Fail loudly if any tool is still missing — a bare host fails every build job.
+command -v git >/dev/null || { echo 'build-runner: git missing after install' >&2; exit 1; }
+test "$(/usr/local/bin/bun --version)" = "${BUILD_RUNNER_BUN_VERSION}" || { echo 'build-runner: wrong bun version after install' >&2; exit 1; }
+/usr/local/bin/cargo --version >/dev/null || { echo 'build-runner: cargo missing after install' >&2; exit 1; }
+docker --version >/dev/null || { echo 'build-runner: docker missing after install' >&2; exit 1; }
+`.trimStart() + gitCredential);
+}
+//# sourceMappingURL=build-runner-setup.js.map

package/dist/fleets/provision/build-runner-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-runner-setup.js","sourceRoot":"","sources":["../../../src/fleets/provision/build-runner-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAErE,kHAAkH;AAClH,MAAM,CAAC,MAAM,4BAA4B,GAAG,wBAAwB,CAAC;AACrE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAChD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,4BAA4B,GAAG,YAAY,CAAC;AACzD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC;AAClD,kEAAkE;AAClE,MAAM,CAAC,MAAM,8BAA8B,GAAG,cAAc,CAAC;AAC7D,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,gDAAgD,CAAC;AAC1F,yEAAyE;AACzE,MAAM,CAAC,MAAM,kCAAkC,GAAG,yDAAyD,CAAC;AAE5G;;0CAE0C;AAC1C,MAAM,oBAAoB,GAAG,mEAAmE,CAAC;AAgBjG,SAAS,wBAAwB,CAAC,KAAa;IAC9C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC/E,CAAC;IACD,kFAAkF;IAClF,OAAO;QACA,kCAAkC;;;;;;oDAMU,KAAK;;CAExD,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAmC,EAAE;IAChF,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,OAAO,CACN;QACM,yBAAyB;;;;;qBAKZ,4BAA4B;;;;;;;0FAOyC,wBAAwB;eACnG,4BAA4B,oBAAoB,wBAAwB;;;;;;;;;;;;;YAa3E,8BAA8B;kGACwD,yBAAyB;;SAElH,8BAA8B;SAC9B,8BAA8B;;;;;EAKrC,wBAAwB,EAAE;;;;4CAIgB,wBAAwB;;;CAGnE,CAAC,SAAS,EAAE,GAAG,aAAa,CAC3B,CAAC;AACH,CAAC"}

package/dist/fleets/provision/cloud-init.d.ts

@@ -0,0 +1,167 @@
+/**
+ * Shared cloud-init template for fleet-provisioned hosts (fleet-droplet F0.1).
+ *
+ * One template, two consumers: platform-web's `handleHostProvision` (the
+ * server-built `infra/sandbox` descriptor's user_data) and the fleet CLI
+ * launch path. The generated boot script:
+ *   1. curl-installs the `vibes` CLI from the public installer,
+ *   2. writes the one-time enrollment token into a root-only file (0600) at
+ *      `/root/.vibes/hosts/<host-id>.enroll-token` (the path `vibes fleet
+ *      daemon install` uses), the platform origin into a root-only env file
+ *      (0600) at `/etc/vibes/fleet-daemon.env`, and the daemon root's
+ *      `vibes.config.json` (`daemon-host-config.ts`): the host's declared
+ *      environment tier (`config['runtime.host'].environmentTier`) and the
+ *      fleet CLI plugin the daemon command needs,
+ *   3. writes a systemd SYSTEM unit whose working directory is the daemon root
+ *      and that runs `vibes fleet daemon --enroll-token-file <path>` headless
+ *      (the CLI binds that root from its cwd): argv carries
+ *      the token's PATH, never the token, so nothing sensitive appears in
+ *      `ps`; the daemon consumes and removes the file once it has persisted
+ *      the durable host token. The
+ *      `vibes fleet daemon install` service backend manages user units via
+ *      `systemctl --user`, which has no bus in cloud-init's root context, so
+ *      the unit is rendered here with the same `vibes-fleet-daemon-<host-id>`
+ *      naming,
+ *   4. verifies the installed CLI can run the daemon from the daemon root
+ *      (`vibes fleet daemon --help` exits 0 there) and ONLY THEN enables +
+ *      starts the unit.
+ *      `Restart=on-failure` retries transient enroll failures until the daemon
+ *      claims the token and persists the durable host token at
+ *      `/root/.vibes/hosts/<host-id>.json`; later runs ignore the (spent)
+ *      enroll token.
+ *
+ * Why the verify gate: the public installer ships a THIN SHIM and finishes it
+ * with `vibes update --global`, which needs the private `@vibesdotdev`
+ * registry. A bare droplet has no registry credential (none is embedded here —
+ * user_data is not a place for one), so that step fails and the installer
+ * deliberately exits 0 anyway. Without the gate, cloud-init enabled a unit
+ * whose binary exits 78 on every command; `Restart=on-failure` looped it
+ * forever and the platform showed "awaiting first heartbeat" indefinitely.
+ * With the gate, an unusable daemon writes {@link FLEET_DAEMON_UNUSABLE_MARKER_FILE}
+ * (`status=unusable`, `reason=...`, `remedy=...`), appends a timestamped line
+ * to {@link FLEET_CLOUD_INIT_LOG_FILE}, and leaves the unit written but
+ * DISABLED so an operator (or a later brokered install step) can repair the
+ * host graph and `systemctl enable --now` it.
+ *
+ * Why the daemon root declares the fleet CLI plugin and binds by cwd: the
+ * installer pulls the latest PUBLISHED CLI, not the one this template was
+ * built with, so the template may only rely on what every supported release
+ * accepts. A release whose global root does not compose `vibes fleet` (0.2.13)
+ * still composes it from a root that declares it; one that does registers it
+ * once (a plugin registers idempotently). Every release binds its workspace
+ * from the cwd, while 0.2.13 refuses `--workspace-root`, so neither unit
+ * passes that flag. The daemon reads its enrollment token from
+ * `--enroll-token-file` and its tier from the bound root.
+ *
+ * By default the unit runs `--relay` so the daemon dials OUT to the broker DO and
+ * a NAT'd droplet reachable only via public IP is still reachable over the relay
+ * by `getVibesRemote(hostId)` (the `--no-relay` default previously left provisioned
+ * hosts unreachable — fleet-relay NAT gap). Pass `relayReachable: false` for the
+ * legacy http-only public-IP path. The relay REQUIRES the same L5-gated pipeline
+ * (wired by construction in the daemon CLI), so relay-reachable never weakens the
+ * secure-by-default bind guards.
+ *
+ * Pure string builder: must stay workerd-safe (platform-web consumes it).
+ */
+export { BUILD_RUNNER_BUN_INSTALL_DIR, BUILD_RUNNER_BUN_INSTALL_URL, BUILD_RUNNER_BUN_VERSION, BUILD_RUNNER_SETUP_MARKER, buildBuildRunnerSetupScript } from './build-runner-setup.ts';
+export { DEFAULT_DESKTOP_SOURCE_REPO, DESKTOP_IMAGE_CONTEXT_DIR, DESKTOP_IMAGE_TAG, DESKTOP_HOST_SETUP_MARKER, buildDesktopHostSetupScript, type DesktopHostSetupOptions } from './desktop-host-setup.ts';
+export { GPU_HOST_SETUP_MARKER, buildGpuHostSetupScript } from './gpu-host-setup.ts';
+export declare const DEFAULT_VIBES_INSTALL_URL: string;
+export declare const FLEET_DAEMON_ENV_FILE = "/etc/vibes/fleet-daemon.env";
+/**
+ * The secret key an operator publishes the one-time enrollment token under
+ * (`vibes secrets exec --with VIBES_FLEET_ENROLL_TOKEN -- vibes fleet daemon`);
+ * the daemon resolves it through `runtime.resolveCredential`, never the raw
+ * process environment. Cloud-init writes a token file instead.
+ */
+export declare const FLEET_ENROLL_TOKEN_ENV = "VIBES_FLEET_ENROLL_TOKEN";
+/** The one-time enrollment token file cloud-init writes (0600) for `hostId`. */
+export declare function fleetCloudInitEnrollTokenFile(hostId: string): string;
+/** The root the provisioned daemon binds (its unit's working directory); it carries the declared tier and the fleet CLI plugin. */
+export declare function fleetCloudInitDaemonRoot(hostId: string): string;
+/** Installed CLI path the unit executes; the installer honours VIBES_INSTALL_DIR. */
+export declare const FLEET_CLOUD_INIT_VIBES_BIN = "/root/.local/bin/vibes";
+/**
+ * Written (0600, root) when the installed CLI cannot run `fleet daemon`. Key=value
+ * lines: `status=unusable`, `reason=<verify output>`, `checkedAt=<iso>`,
+ * `remedy=<what to run>`. Absent on a healthy host. A future host-side status
+ * report can forward this so the platform shows `daemon unusable: <reason>`.
+ */
+export declare const FLEET_DAEMON_UNUSABLE_MARKER_FILE = "/etc/vibes/fleet-daemon.unusable";
+/** Timestamped boot-script log (in addition to /var/log/cloud-init-output.log). */
+export declare const FLEET_CLOUD_INIT_LOG_FILE = "/root/.vibes/logs/vibes-fleet-cloud-init.log";
+/** The command whose exit status, run from the daemon root, decides whether the unit is enabled. */
+export declare const FLEET_DAEMON_VERIFY_COMMAND = "/root/.local/bin/vibes fleet daemon --help";
+/**
+ * Bunfig the brokered registry lease is written into (0600), resolved from the
+ * script's own HOME so a harness can run the rendered script under a temporary
+ * root instead of the real /root.
+ */
+export declare const FLEET_REGISTRY_BUNFIG_FILE = "${HOME}/.bunfig.toml";
+/**
+ * The bunfig `vibes update --global` requires, measured on a real droplet
+ * 2026-09-07. Every field matters and each was wrong once:
+ *
+ *  - the scope key carries its `@`. Bun matches either spelling, which is why
+ *    a `bun add @vibesdotdev/…` smoke test passed while the droplet failed —
+ *    but the CLI's own precondition looks for `"@vibesdotdev"` and exits 78
+ *    with "the @vibesdotdev package scope has no credential" without it.
+ *  - `linker = "hoisted"` is a measured decision, not a default: under
+ *    "isolated" a workspaces glob member that is not also a dependency is
+ *    never linked, which breaks the host graph.
+ *  - the token is an ENV VAR REFERENCE. Nothing writes a credential to the
+ *    droplet's disk; the lease is exported for the one command that needs it.
+ *
+ * Bunfig files do NOT merge — the one bun reads for an install replaces the
+ * rest — so this file must be complete, not a fragment. The shape is
+ * `renderSeedBunfig()` in @vibesdotdev/plugins; `cloud-init.test.ts` pins the
+ * two together.
+ */
+export declare const FLEET_REGISTRY_NPM_SCOPE = "@vibesdotdev";
+/** Registry the lease authenticates against; trailing slash as the seed writes it. */
+export declare const FLEET_REGISTRY_URL: string;
+/** Env var the bunfig references, and the one the lease is exported as. */
+export declare const FLEET_REGISTRY_TOKEN_ENV = "VIBES_REGISTRY_TOKEN";
+/** Bun linker the host graph requires. */
+export declare const FLEET_REGISTRY_LINKER = "hoisted";
+/**
+ * Optional host-local PM service. Harness binaries remain owned by their setup
+ * hooks. The daemon binds its workspace from its working directory, never an
+ * environment variable (rc02-rc03 §2.2); `--workspace-root` is refused by
+ * published CLIs the installer may pull.
+ */
+export declare function buildPmDaemonServiceScript(): string;
+export interface FleetCloudInitInput {
+    /** Start the host-local PM service after caller setup. Defaults to false. */
+    pmDaemon?: boolean;
+    /** Stable host id (kebab-case; becomes part of the unit name and paths). */
+    hostId: string;
+    /** One-time enrollment token from the platform (hashed at rest server-side). */
+    enrollToken: string;
+    /** Platform-web origin the daemon enrolls + heartbeats against. */
+    platformOrigin: string;
+    /** Capability labels the daemon reports in heartbeats (e.g. `sandbox:code-execution`). */
+    labels?: string[];
+    /** Public installer URL; defaults to the live CLI installer. */
+    installUrl?: string;
+    registryUrl?: string;
+    /**
+     * Whether the provisioned daemon dials OUT to the broker relay so a NAT'd
+     * droplet is reachable by `getVibesRemote(hostId)`. Defaults to `true`
+     * (`--relay`). Set `false` for the legacy http-only public-IP path
+     * (`--no-relay`). Either way the L5 gates are wired by construction.
+     */
+    relayReachable?: boolean;
+    /** Caller-supplied extra boot script, appended after enrollment is wired. */
+    extraScript?: string;
+    /**
+     * The host's environment tier, declared by whoever provisions it (no
+     * default). It becomes the daemon root's `config['runtime.host']`, so the
+     * daemon's credential reads (`runtime.resolveCredential`) have a tier.
+     */
+    /** Raw provisioning boundary value, admitted by the canonical environment-tier schema. */
+    environmentTier: string | undefined;
+}
+export declare function fleetDaemonServiceName(hostId: string): string;
+export declare function buildFleetCloudInit(input: FleetCloudInitInput): string;
+//# sourceMappingURL=cloud-init.d.ts.map

package/dist/fleets/provision/cloud-init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-init.d.ts","sourceRoot":"","sources":["../../../src/fleets/provision/cloud-init.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAKH,OAAO,EACN,4BAA4B,EAC5B,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,2BAA2B,EAC3B,MAAM,yBAAyB,CAAC;AAKjC,OAAO,EACN,2BAA2B,EAC3B,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,EACzB,2BAA2B,EAC3B,KAAK,uBAAuB,EAC5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAUrF,eAAO,MAAM,yBAAyB,QAA8D,CAAC;AACrG,eAAO,MAAM,qBAAqB,gCAAgC,CAAC;AACnE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAGjE,gFAAgF;AAChF,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpE;AACD,mIAAmI;AACnI,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE/D;AACD,qFAAqF;AACrF,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AACnE;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,qCAAqC,CAAC;AACpF,mFAAmF;AACnF,eAAO,MAAM,yBAAyB,iDAAiD,CAAC;AACxF,oGAAoG;AACpG,eAAO,MAAM,2BAA2B,+CAAsD,CAAC;AAE/F;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,wBAAwB,iBAAiB,CAAC;AAEvD,sFAAsF;AACtF,eAAO,MAAM,kBAAkB,QAA+D,CAAC;AAE/F,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAE/D,0CAA0C;AAC1C,eAAO,MAAM,qBAAqB,YAAY,CAAC;AAM/C;;;;;GAKG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAiCnD;AAED,MAAM,WAAW,mBAAmB;IACnC,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,cAAc,EAAE,MAAM,CAAC;IACvB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,0FAA0F;IAC1F,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7D;AAkBD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAgLtE"}