@forgezero/agent 0.1.113 → 0.1.114

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.113";
+var VERSION3 = "0.1.114";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.113";
+var VERSION = "0.1.114";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/fz-agent.js

@@ -9528,7 +9528,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.113";
+var VERSION2 = "0.1.114";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4841,7 +4841,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.113";
+var VERSION2 = "0.1.114";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -17971,13 +17971,21 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
       if (typeof publicIdentity2 !== "string")
         throw new Error("remote Metal bootstrap omitted its public identity");
       const identity = parseMetalPublicIdentity(publicIdentity2);
-      writeOwnerJson2(request.metalIdentityEvidenceFile, {
+      const evidence = {
         format: 1,
         kind: "forgezero-operator-metal-identity",
         metalHostname: config.metalHostname,
         metalHostKeySha256: request.target.hostKeySha256,
         ...identity
-      }, "operator metal identity evidence");
+      };
+      if (existsSync11(request.metalIdentityEvidenceFile)) {
+        const current2 = readOperatorMetalIdentityEvidence(request.metalIdentityEvidenceFile, request);
+        if (current2.nodeKey !== evidence.nodeKey || current2.publicKeys.ed25519 !== evidence.publicKeys.ed25519 || current2.publicKeys.mlDsa !== evidence.publicKeys.mlDsa) {
+          throw new Error("remote Metal repair returned a different public identity");
+        }
+      } else {
+        writeOwnerJson2(request.metalIdentityEvidenceFile, evidence, "operator metal identity evidence");
+      }
     }
     return { plan, output };
   } finally {

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.113";
+var VERSION = "0.1.114";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.113";
+var VERSION = "0.1.114";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -7417,13 +7417,21 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
       if (typeof publicIdentity2 !== "string")
         throw new Error("remote Metal bootstrap omitted its public identity");
       const identity = parseMetalPublicIdentity(publicIdentity2);
-      writeOwnerJson2(request.metalIdentityEvidenceFile, {
+      const evidence = {
         format: 1,
         kind: "forgezero-operator-metal-identity",
         metalHostname: config.metalHostname,
         metalHostKeySha256: request.target.hostKeySha256,
         ...identity
-      }, "operator metal identity evidence");
+      };
+      if (existsSync7(request.metalIdentityEvidenceFile)) {
+        const current2 = readOperatorMetalIdentityEvidence(request.metalIdentityEvidenceFile, request);
+        if (current2.nodeKey !== evidence.nodeKey || current2.publicKeys.ed25519 !== evidence.publicKeys.ed25519 || current2.publicKeys.mlDsa !== evidence.publicKeys.mlDsa) {
+          throw new Error("remote Metal repair returned a different public identity");
+        }
+      } else {
+        writeOwnerJson2(request.metalIdentityEvidenceFile, evidence, "operator metal identity evidence");
+      }
     }
     return { plan, output };
   } finally {

package/dist/platform-fleet-verification.js

@@ -3004,7 +3004,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.113";
+var VERSION3 = "0.1.114";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provision.js

@@ -3004,7 +3004,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.113";
+var VERSION3 = "0.1.114";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.113";
+export declare const VERSION = "0.1.114";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.113",
+  "version": "0.1.114",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",