@forgezero/agent 0.1.112 → 0.1.114

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.112";
+var VERSION3 = "0.1.114";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.112";
+var VERSION = "0.1.114";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -4132,7 +4132,7 @@ User=arangodb
 Group=arangodb
 LoadCredentialEncrypted=arangodb-jwt:${JWT_CREDENTIAL}
 LoadCredentialEncrypted=arangodb-root-password:${ARANGO_ROOT_CREDENTIAL}
-ExecStart=/usr/bin/arangosh --server.endpoint tcp://${unitEscape(address)}:8529 --server.jwt-secret-keyfile %d/arangodb-jwt --javascript.execute-string 'const c=require("@arangodb").db._connection;let last;let ok=false;for(let i=0;i<90;i++){try{const v=c.GET("/_api/version?details=true");const s=c.GET("/_admin/status");const m=c.GET("/_admin/server/mode");if(!v.error&&v.version==="3.11.14"&&v.details&&v.details.license==="community"&&!s.error&&s.serverInfo&&s.serverInfo.role==="COORDINATOR"&&!m.error&&m.mode==="default"){ok=true;break;}last={v,s,m};}catch(e){last=String(e);}require("internal").wait(2);}if(!ok)throw new Error("writable Community Coordinator verification failed: "+JSON.stringify(last));const password=require("fs").read("%d/arangodb-root-password").trim();if(password.length<48)throw new Error("ArangoDB root credential is malformed");const secured=c.PATCH("/_api/user/root",{passwd:password,active:true});if(secured.error)throw new Error("ArangoDB root credential update failed: "+JSON.stringify(secured));'
+ExecStart=/usr/bin/arangosh --server.endpoint tcp://${unitEscape(address)}:8529 --server.jwt-secret-keyfile %d/arangodb-jwt --javascript.execute-string 'const c=require("@arangodb").db._connection;let last;let ok=false;for(let i=0;i<90;i++){try{const v=c.GET("/_api/version?details=true");const s=c.GET("/_admin/status");const m=c.GET("/_admin/server/mode");if(!v.error&&v.version==="3.11.14"&&v.details&&v.details.license==="community"&&!s.error&&s.serverInfo&&s.serverInfo.role==="COORDINATOR"&&!m.error&&m.mode==="default"){ok=true;break;}last={v,s,m};}catch(e){last=String(e);}require("internal").wait(2);}if(!ok)throw new Error("writable Community Coordinator verification failed: "+JSON.stringify(last));const password=require("fs").read("%d/arangodb-root-password").trim();if(password.length<48)throw new Error("ArangoDB root credential is malformed");const secured=c.PATCH("/_api/user/root",{passwd:password,active:true});if(secured.error&&secured.code!==409)throw new Error("ArangoDB root credential update failed: "+JSON.stringify(secured));'
 ExecStart=/usr/local/bin/fz-agent database-auth-verify --endpoint=http://${unitEscape(address)}:8529
 RemainAfterExit=yes
 TimeoutStartSec=200

package/dist/fz-agent.js

@@ -9528,7 +9528,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.112";
+var VERSION2 = "0.1.114";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4841,7 +4841,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.112";
+var VERSION2 = "0.1.114";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -14517,7 +14517,7 @@ User=arangodb
 Group=arangodb
 LoadCredentialEncrypted=arangodb-jwt:${JWT_CREDENTIAL}
 LoadCredentialEncrypted=arangodb-root-password:${ARANGO_ROOT_CREDENTIAL}
-ExecStart=/usr/bin/arangosh --server.endpoint tcp://${unitEscape(address)}:8529 --server.jwt-secret-keyfile %d/arangodb-jwt --javascript.execute-string 'const c=require("@arangodb").db._connection;let last;let ok=false;for(let i=0;i<90;i++){try{const v=c.GET("/_api/version?details=true");const s=c.GET("/_admin/status");const m=c.GET("/_admin/server/mode");if(!v.error&&v.version==="3.11.14"&&v.details&&v.details.license==="community"&&!s.error&&s.serverInfo&&s.serverInfo.role==="COORDINATOR"&&!m.error&&m.mode==="default"){ok=true;break;}last={v,s,m};}catch(e){last=String(e);}require("internal").wait(2);}if(!ok)throw new Error("writable Community Coordinator verification failed: "+JSON.stringify(last));const password=require("fs").read("%d/arangodb-root-password").trim();if(password.length<48)throw new Error("ArangoDB root credential is malformed");const secured=c.PATCH("/_api/user/root",{passwd:password,active:true});if(secured.error)throw new Error("ArangoDB root credential update failed: "+JSON.stringify(secured));'
+ExecStart=/usr/bin/arangosh --server.endpoint tcp://${unitEscape(address)}:8529 --server.jwt-secret-keyfile %d/arangodb-jwt --javascript.execute-string 'const c=require("@arangodb").db._connection;let last;let ok=false;for(let i=0;i<90;i++){try{const v=c.GET("/_api/version?details=true");const s=c.GET("/_admin/status");const m=c.GET("/_admin/server/mode");if(!v.error&&v.version==="3.11.14"&&v.details&&v.details.license==="community"&&!s.error&&s.serverInfo&&s.serverInfo.role==="COORDINATOR"&&!m.error&&m.mode==="default"){ok=true;break;}last={v,s,m};}catch(e){last=String(e);}require("internal").wait(2);}if(!ok)throw new Error("writable Community Coordinator verification failed: "+JSON.stringify(last));const password=require("fs").read("%d/arangodb-root-password").trim();if(password.length<48)throw new Error("ArangoDB root credential is malformed");const secured=c.PATCH("/_api/user/root",{passwd:password,active:true});if(secured.error&&secured.code!==409)throw new Error("ArangoDB root credential update failed: "+JSON.stringify(secured));'
 ExecStart=/usr/local/bin/fz-agent database-auth-verify --endpoint=http://${unitEscape(address)}:8529
 RemainAfterExit=yes
 TimeoutStartSec=200
@@ -17971,13 +17971,21 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
       if (typeof publicIdentity2 !== "string")
         throw new Error("remote Metal bootstrap omitted its public identity");
       const identity = parseMetalPublicIdentity(publicIdentity2);
-      writeOwnerJson2(request.metalIdentityEvidenceFile, {
+      const evidence = {
         format: 1,
         kind: "forgezero-operator-metal-identity",
         metalHostname: config.metalHostname,
         metalHostKeySha256: request.target.hostKeySha256,
         ...identity
-      }, "operator metal identity evidence");
+      };
+      if (existsSync11(request.metalIdentityEvidenceFile)) {
+        const current2 = readOperatorMetalIdentityEvidence(request.metalIdentityEvidenceFile, request);
+        if (current2.nodeKey !== evidence.nodeKey || current2.publicKeys.ed25519 !== evidence.publicKeys.ed25519 || current2.publicKeys.mlDsa !== evidence.publicKeys.mlDsa) {
+          throw new Error("remote Metal repair returned a different public identity");
+        }
+      } else {
+        writeOwnerJson2(request.metalIdentityEvidenceFile, evidence, "operator metal identity evidence");
+      }
     }
     return { plan, output };
   } finally {

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.112";
+var VERSION = "0.1.114";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.112";
+var VERSION = "0.1.114";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -4132,7 +4132,7 @@ User=arangodb
 Group=arangodb
 LoadCredentialEncrypted=arangodb-jwt:${JWT_CREDENTIAL}
 LoadCredentialEncrypted=arangodb-root-password:${ARANGO_ROOT_CREDENTIAL}
-ExecStart=/usr/bin/arangosh --server.endpoint tcp://${unitEscape(address)}:8529 --server.jwt-secret-keyfile %d/arangodb-jwt --javascript.execute-string 'const c=require("@arangodb").db._connection;let last;let ok=false;for(let i=0;i<90;i++){try{const v=c.GET("/_api/version?details=true");const s=c.GET("/_admin/status");const m=c.GET("/_admin/server/mode");if(!v.error&&v.version==="3.11.14"&&v.details&&v.details.license==="community"&&!s.error&&s.serverInfo&&s.serverInfo.role==="COORDINATOR"&&!m.error&&m.mode==="default"){ok=true;break;}last={v,s,m};}catch(e){last=String(e);}require("internal").wait(2);}if(!ok)throw new Error("writable Community Coordinator verification failed: "+JSON.stringify(last));const password=require("fs").read("%d/arangodb-root-password").trim();if(password.length<48)throw new Error("ArangoDB root credential is malformed");const secured=c.PATCH("/_api/user/root",{passwd:password,active:true});if(secured.error)throw new Error("ArangoDB root credential update failed: "+JSON.stringify(secured));'
+ExecStart=/usr/bin/arangosh --server.endpoint tcp://${unitEscape(address)}:8529 --server.jwt-secret-keyfile %d/arangodb-jwt --javascript.execute-string 'const c=require("@arangodb").db._connection;let last;let ok=false;for(let i=0;i<90;i++){try{const v=c.GET("/_api/version?details=true");const s=c.GET("/_admin/status");const m=c.GET("/_admin/server/mode");if(!v.error&&v.version==="3.11.14"&&v.details&&v.details.license==="community"&&!s.error&&s.serverInfo&&s.serverInfo.role==="COORDINATOR"&&!m.error&&m.mode==="default"){ok=true;break;}last={v,s,m};}catch(e){last=String(e);}require("internal").wait(2);}if(!ok)throw new Error("writable Community Coordinator verification failed: "+JSON.stringify(last));const password=require("fs").read("%d/arangodb-root-password").trim();if(password.length<48)throw new Error("ArangoDB root credential is malformed");const secured=c.PATCH("/_api/user/root",{passwd:password,active:true});if(secured.error&&secured.code!==409)throw new Error("ArangoDB root credential update failed: "+JSON.stringify(secured));'
 ExecStart=/usr/local/bin/fz-agent database-auth-verify --endpoint=http://${unitEscape(address)}:8529
 RemainAfterExit=yes
 TimeoutStartSec=200
@@ -7417,13 +7417,21 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
       if (typeof publicIdentity2 !== "string")
         throw new Error("remote Metal bootstrap omitted its public identity");
       const identity = parseMetalPublicIdentity(publicIdentity2);
-      writeOwnerJson2(request.metalIdentityEvidenceFile, {
+      const evidence = {
         format: 1,
         kind: "forgezero-operator-metal-identity",
         metalHostname: config.metalHostname,
         metalHostKeySha256: request.target.hostKeySha256,
         ...identity
-      }, "operator metal identity evidence");
+      };
+      if (existsSync7(request.metalIdentityEvidenceFile)) {
+        const current2 = readOperatorMetalIdentityEvidence(request.metalIdentityEvidenceFile, request);
+        if (current2.nodeKey !== evidence.nodeKey || current2.publicKeys.ed25519 !== evidence.publicKeys.ed25519 || current2.publicKeys.mlDsa !== evidence.publicKeys.mlDsa) {
+          throw new Error("remote Metal repair returned a different public identity");
+        }
+      } else {
+        writeOwnerJson2(request.metalIdentityEvidenceFile, evidence, "operator metal identity evidence");
+      }
     }
     return { plan, output };
   } finally {

package/dist/platform-fleet-verification.js

@@ -3004,7 +3004,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.112";
+var VERSION3 = "0.1.114";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provision.js

@@ -3004,7 +3004,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.112";
+var VERSION3 = "0.1.114";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.112";
+export declare const VERSION = "0.1.114";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.112",
+  "version": "0.1.114",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",