@forgezero/agent 0.1.121 → 0.1.123

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.121";
+var VERSION3 = "0.1.123";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.121";
+var VERSION = "0.1.123";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/cli/maintenance.d.ts

@@ -6,6 +6,11 @@ export type RepositoryOperation = 'dev-reset' | 'db-backup' | 'db-recover' | 'db
  * error instead of a silently ignored mutation bypass such as --force.
  */
 export declare function unsupportedRepositoryCliOption(argv: readonly string[]): string | undefined;
+export declare function forwardedRepositoryOperationArguments(options: {
+    apply: boolean;
+    json: boolean;
+    disposableFleetConfirmation?: string;
+}, args: readonly string[]): string[];
 export interface ResolvedRepositoryOperation {
     operation: RepositoryOperation;
     root: string;

package/dist/community-rehearsal-host.d.ts

@@ -4,6 +4,11 @@ export declare const COMMUNITY_REHEARSAL_ROOT = "/opt/forgezero-rehearsals/commu
 export declare const COMMUNITY_DATABASE_ROOT = "/var/lib/forgezero-rehearsal-cluster";
 export declare const COMMUNITY_CREDENTIAL_PARENT = "/etc/forgezero-rehearsal";
 export declare const COMMUNITY_CREDENTIAL_ROOT = "/etc/forgezero-rehearsal/creds";
+export declare const COMMUNITY_REHEARSAL_STARTER_PORT = 18528;
+export declare const COMMUNITY_REHEARSAL_COORDINATOR_PORT = 18529;
+export declare const COMMUNITY_REHEARSAL_DATABASE_PORT_RANGE = "18528:18539";
+export declare const COMMUNITY_REHEARSAL_API_PORT = 18787;
+export declare const COMMUNITY_REHEARSAL_FIREWALL_COMMENT = "fz-community-rehearsal";
 export interface CommunityRehearsalNode {
     name: string;
     address: string;
@@ -41,6 +46,8 @@ export type CommunityRehearsalHostRequest = {
 export type CommunityHostOperation = {
     kind: 'remove-tree';
     path: typeof COMMUNITY_DATABASE_ROOT | typeof COMMUNITY_REHEARSAL_ROOT | typeof COMMUNITY_CREDENTIAL_PARENT;
+} | {
+    kind: 'clear-firewall';
 } | {
     kind: 'write';
     path: string;
@@ -67,5 +74,6 @@ export declare function planCommunityRehearsalPrepare(request: Extract<Community
 }>): CommunityHostOperation[];
 /** Remove only the dedicated rehearsal units, credentials, release and data. */
 export declare function planCommunityRehearsalCleanup(): CommunityHostOperation[];
+export declare function communityRehearsalFirewallRuleNumbers(status: string): number[];
 /** Execute only the dedicated four-node rehearsal operation selected by a typed request. */
 export declare function runCommunityRehearsalHost(request: CommunityRehearsalHostRequest): Promise<Record<string, unknown>>;

package/dist/community-rehearsal-host.js

@@ -572,6 +572,11 @@ var COMMUNITY_REHEARSAL_ROOT = "/opt/forgezero-rehearsals/community-cluster-api"
 var COMMUNITY_DATABASE_ROOT = "/var/lib/forgezero-rehearsal-cluster";
 var COMMUNITY_CREDENTIAL_PARENT = "/etc/forgezero-rehearsal";
 var COMMUNITY_CREDENTIAL_ROOT = "/etc/forgezero-rehearsal/creds";
+var COMMUNITY_REHEARSAL_STARTER_PORT = 18528;
+var COMMUNITY_REHEARSAL_COORDINATOR_PORT = 18529;
+var COMMUNITY_REHEARSAL_DATABASE_PORT_RANGE = "18528:18539";
+var COMMUNITY_REHEARSAL_API_PORT = 18787;
+var COMMUNITY_REHEARSAL_FIREWALL_COMMENT = "fz-community-rehearsal";
 var RELEASE = /^[a-f0-9]{64}$/;
 var SAFE_NAME = /^[a-z][a-z0-9-]{0,62}$/;
 async function ensureCommunityRehearsalArango(execute = executeSoftwareOperation) {
@@ -651,7 +656,7 @@ function parseCommunityRehearsalHostRequest(value) {
 }
 var databaseUnit = (node, topology) => {
   const starter = topology.find((entry) => entry.starter);
-  const join2 = node.starter ? "" : ` --starter.join=${starter.address}`;
+  const join2 = node.starter ? "" : ` --starter.join=${starter.address}:${COMMUNITY_REHEARSAL_STARTER_PORT}`;
   const role = node.agency ? "" : " --cluster.start-agent=false --cluster.start-coordinator=true --cluster.start-dbserver=true";
   return `[Unit]
 Description=ForgeZero isolated Community ${COMMUNITY_REHEARSAL_VERSION} rehearsal cluster
@@ -663,7 +668,7 @@ Type=simple
 User=arangodb
 Group=arangodb
 LoadCredentialEncrypted=arangodb-jwt:${COMMUNITY_CREDENTIAL_ROOT}/arangodb-jwt.cred
-ExecStart=/usr/bin/arangodb --starter.mode=cluster --starter.address=${node.address} --starter.host=${node.address} --starter.data-dir=${COMMUNITY_DATABASE_ROOT} --starter.disable-ipv6 --auth.jwt-secret=%d/arangodb-jwt${join2}${role}
+ExecStart=/usr/bin/arangodb --starter.mode=cluster --starter.address=${node.address} --starter.host=${node.address} --starter.port=${COMMUNITY_REHEARSAL_STARTER_PORT} --starter.data-dir=${COMMUNITY_DATABASE_ROOT} --starter.disable-ipv6 --auth.jwt-secret=%d/arangodb-jwt${join2}${role}
 Restart=always
 RestartSec=5
 LimitNOFILE=100000
@@ -687,8 +692,8 @@ WantedBy=multi-user.target
 `;
 };
 var apiUnit = (node, topology) => {
-  const urls = topology.map(({ address }) => `http://${address}:8529`).join(",");
-  const readPreferred = topology.filter(({ readPreferred: readPreferred2 }) => readPreferred2).map(({ address }) => `http://${address}:8529`).join(",");
+  const urls = topology.map(({ address }) => `http://${address}:${COMMUNITY_REHEARSAL_COORDINATOR_PORT}`).join(",");
+  const readPreferred = topology.filter(({ readPreferred: readPreferred2 }) => readPreferred2).map(({ address }) => `http://${address}:${COMMUNITY_REHEARSAL_COORDINATOR_PORT}`).join(",");
   return `[Unit]
 Description=ForgeZero typed Community cluster rehearsal API
 After=forgezero-rehearsal-db.service network-online.target
@@ -701,9 +706,9 @@ Group=forgezero
 WorkingDirectory=${COMMUNITY_REHEARSAL_ROOT}/current
 LoadCredentialEncrypted=arangodb-jwt:${COMMUNITY_CREDENTIAL_ROOT}/arangodb-jwt.cred
 Environment=HOST=127.0.0.1
-Environment=PORT=8787
+Environment=PORT=${COMMUNITY_REHEARSAL_API_PORT}
 Environment=NODE_NAME=${node.name}
-Environment=ARANGO_URL=http://127.0.0.1:8529
+Environment=ARANGO_URL=http://127.0.0.1:${COMMUNITY_REHEARSAL_COORDINATOR_PORT}
 Environment=ARANGO_URLS=${urls}
 Environment=ARANGO_READ_PREFERRED_URLS=${readPreferred}
 Environment=ARANGO_READ_PREFERRED_FALLBACK=error
@@ -734,6 +739,24 @@ function planCommunityRehearsalPrepare(request) {
     { kind: "exec", argv: ["/usr/sbin/arangod", "--version"] },
     { kind: "exec", argv: ["/usr/bin/systemctl", "stop", "forgezero-community-api.service"], accepted: [0, 5] },
     { kind: "exec", argv: ["/usr/bin/systemctl", "stop", "forgezero-rehearsal-db.service"], accepted: [0, 5] },
+    { kind: "clear-firewall" },
+    ...topology.map(({ address }) => ({
+      kind: "exec",
+      argv: [
+        "/usr/sbin/ufw",
+        "allow",
+        "from",
+        address,
+        "to",
+        "any",
+        "port",
+        COMMUNITY_REHEARSAL_DATABASE_PORT_RANGE,
+        "proto",
+        "tcp",
+        "comment",
+        COMMUNITY_REHEARSAL_FIREWALL_COMMENT
+      ]
+    })),
     { kind: "remove-tree", path: COMMUNITY_DATABASE_ROOT },
     { kind: "exec", argv: ["/usr/bin/install", "-d", "-m", "0700", "-o", "root", "-g", "root", COMMUNITY_CREDENTIAL_ROOT] },
     { kind: "exec", argv: ["/usr/bin/install", "-d", "-m", "0700", "-o", "arangodb", "-g", "arangodb", COMMUNITY_DATABASE_ROOT] },
@@ -762,6 +785,7 @@ function planCommunityRehearsalCleanup() {
     { kind: "remove-tree", path: COMMUNITY_DATABASE_ROOT },
     { kind: "remove-tree", path: COMMUNITY_REHEARSAL_ROOT },
     { kind: "remove-tree", path: COMMUNITY_CREDENTIAL_PARENT },
+    { kind: "clear-firewall" },
     { kind: "exec", argv: ["/usr/bin/systemctl", "daemon-reload"] },
     { kind: "exec", argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-community-api.service", "forgezero-rehearsal-db.service"], accepted: [0, 1, 5] }
   ];
@@ -781,6 +805,8 @@ async function applyOperations(operations) {
   for (const operation of operations) {
     if (operation.kind === "remove-tree")
       rmSync2(operation.path, { recursive: true, force: true });
+    else if (operation.kind === "clear-firewall")
+      await clearCommunityRehearsalFirewall();
     else if (operation.kind === "write") {
       mkdirSync2(dirname2(operation.path), { recursive: true });
       writeFileSync2(operation.path, operation.content, { mode: operation.mode });
@@ -803,8 +829,27 @@ async function applyOperations(operations) {
     }
   }
 }
+function communityRehearsalFirewallRuleNumbers(status) {
+  return status.split(/\r?\n/).flatMap((line) => {
+    if (!line.includes(`# ${COMMUNITY_REHEARSAL_FIREWALL_COMMENT}`))
+      return [];
+    const match = line.match(/^\[\s*(\d+)\]/);
+    return match ? [Number(match[1])] : [];
+  }).filter((number) => Number.isSafeInteger(number) && number > 0).sort((left, right) => right - left);
+}
+async function clearCommunityRehearsalFirewall() {
+  const status = await exec(["/usr/sbin/ufw", "status", "numbered"]);
+  if (status.exitCode !== 0)
+    throw new Error(`unable to inspect rehearsal firewall rules: ${status.output.trim()}`);
+  for (const number of communityRehearsalFirewallRuleNumbers(status.output)) {
+    const removed = await exec(["/usr/sbin/ufw", "--force", "delete", String(number)]);
+    if (removed.exitCode !== 0) {
+      throw new Error(`unable to remove rehearsal firewall rule ${number}: ${removed.output.trim()}`);
+    }
+  }
+}
 var responseFor = async (request) => {
-  const base = "http://127.0.0.1:8787";
+  const base = `http://127.0.0.1:${COMMUNITY_REHEARSAL_API_PORT}`;
   if (request.operation === "health")
     return fetch(`${base}/health`, { signal: AbortSignal.timeout(15000) });
   if (request.operation === "init")
@@ -866,7 +911,7 @@ async function runCommunityRehearsalHost(request) {
   }
   if (request.action === "database-ready" || request.action === "starter-ready" || request.action === "api-ready") {
     const starter = topology.find((entry) => entry.starter);
-    const url = request.action === "database-ready" ? "http://127.0.0.1:8529/_api/version" : request.action === "starter-ready" ? `http://${starter.address}:8528/version` : "http://127.0.0.1:8787/health";
+    const url = request.action === "database-ready" ? `http://127.0.0.1:${COMMUNITY_REHEARSAL_COORDINATOR_PORT}/_api/version` : request.action === "starter-ready" ? `http://${starter.address}:${COMMUNITY_REHEARSAL_STARTER_PORT}/version` : `http://127.0.0.1:${COMMUNITY_REHEARSAL_API_PORT}/health`;
     const response2 = await fetch(url, { signal: AbortSignal.timeout(2000) }).catch(() => {
       return;
     });
@@ -889,8 +934,14 @@ export {
   planCommunityRehearsalCleanup,
   parseCommunityRehearsalHostRequest,
   ensureCommunityRehearsalArango,
+  communityRehearsalFirewallRuleNumbers,
   COMMUNITY_REHEARSAL_VERSION,
+  COMMUNITY_REHEARSAL_STARTER_PORT,
   COMMUNITY_REHEARSAL_ROOT,
+  COMMUNITY_REHEARSAL_FIREWALL_COMMENT,
+  COMMUNITY_REHEARSAL_DATABASE_PORT_RANGE,
+  COMMUNITY_REHEARSAL_COORDINATOR_PORT,
+  COMMUNITY_REHEARSAL_API_PORT,
   COMMUNITY_DATABASE_ROOT,
   COMMUNITY_CREDENTIAL_ROOT,
   COMMUNITY_CREDENTIAL_PARENT

package/dist/fz-agent.js

@@ -9640,7 +9640,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.121";
+var VERSION2 = "0.1.123";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {
@@ -17120,6 +17120,11 @@ var COMMUNITY_REHEARSAL_ROOT = "/opt/forgezero-rehearsals/community-cluster-api"
 var COMMUNITY_DATABASE_ROOT = "/var/lib/forgezero-rehearsal-cluster";
 var COMMUNITY_CREDENTIAL_PARENT = "/etc/forgezero-rehearsal";
 var COMMUNITY_CREDENTIAL_ROOT = "/etc/forgezero-rehearsal/creds";
+var COMMUNITY_REHEARSAL_STARTER_PORT = 18528;
+var COMMUNITY_REHEARSAL_COORDINATOR_PORT = 18529;
+var COMMUNITY_REHEARSAL_DATABASE_PORT_RANGE = "18528:18539";
+var COMMUNITY_REHEARSAL_API_PORT = 18787;
+var COMMUNITY_REHEARSAL_FIREWALL_COMMENT = "fz-community-rehearsal";
 var RELEASE = /^[a-f0-9]{64}$/;
 var SAFE_NAME2 = /^[a-z][a-z0-9-]{0,62}$/;
 async function ensureCommunityRehearsalArango(execute3 = executeSoftwareOperation) {
@@ -17199,7 +17204,7 @@ function parseCommunityRehearsalHostRequest(value) {
 }
 var databaseUnit = (node, topology) => {
   const starter = topology.find((entry) => entry.starter);
-  const join12 = node.starter ? "" : ` --starter.join=${starter.address}`;
+  const join12 = node.starter ? "" : ` --starter.join=${starter.address}:${COMMUNITY_REHEARSAL_STARTER_PORT}`;
   const role = node.agency ? "" : " --cluster.start-agent=false --cluster.start-coordinator=true --cluster.start-dbserver=true";
   return `[Unit]
 Description=ForgeZero isolated Community ${COMMUNITY_REHEARSAL_VERSION} rehearsal cluster
@@ -17211,7 +17216,7 @@ Type=simple
 User=arangodb
 Group=arangodb
 LoadCredentialEncrypted=arangodb-jwt:${COMMUNITY_CREDENTIAL_ROOT}/arangodb-jwt.cred
-ExecStart=/usr/bin/arangodb --starter.mode=cluster --starter.address=${node.address} --starter.host=${node.address} --starter.data-dir=${COMMUNITY_DATABASE_ROOT} --starter.disable-ipv6 --auth.jwt-secret=%d/arangodb-jwt${join12}${role}
+ExecStart=/usr/bin/arangodb --starter.mode=cluster --starter.address=${node.address} --starter.host=${node.address} --starter.port=${COMMUNITY_REHEARSAL_STARTER_PORT} --starter.data-dir=${COMMUNITY_DATABASE_ROOT} --starter.disable-ipv6 --auth.jwt-secret=%d/arangodb-jwt${join12}${role}
 Restart=always
 RestartSec=5
 LimitNOFILE=100000
@@ -17235,8 +17240,8 @@ WantedBy=multi-user.target
 `;
 };
 var apiUnit = (node, topology) => {
-  const urls = topology.map(({ address }) => `http://${address}:8529`).join(",");
-  const readPreferred = topology.filter(({ readPreferred: readPreferred2 }) => readPreferred2).map(({ address }) => `http://${address}:8529`).join(",");
+  const urls = topology.map(({ address }) => `http://${address}:${COMMUNITY_REHEARSAL_COORDINATOR_PORT}`).join(",");
+  const readPreferred = topology.filter(({ readPreferred: readPreferred2 }) => readPreferred2).map(({ address }) => `http://${address}:${COMMUNITY_REHEARSAL_COORDINATOR_PORT}`).join(",");
   return `[Unit]
 Description=ForgeZero typed Community cluster rehearsal API
 After=forgezero-rehearsal-db.service network-online.target
@@ -17249,9 +17254,9 @@ Group=forgezero
 WorkingDirectory=${COMMUNITY_REHEARSAL_ROOT}/current
 LoadCredentialEncrypted=arangodb-jwt:${COMMUNITY_CREDENTIAL_ROOT}/arangodb-jwt.cred
 Environment=HOST=127.0.0.1
-Environment=PORT=8787
+Environment=PORT=${COMMUNITY_REHEARSAL_API_PORT}
 Environment=NODE_NAME=${node.name}
-Environment=ARANGO_URL=http://127.0.0.1:8529
+Environment=ARANGO_URL=http://127.0.0.1:${COMMUNITY_REHEARSAL_COORDINATOR_PORT}
 Environment=ARANGO_URLS=${urls}
 Environment=ARANGO_READ_PREFERRED_URLS=${readPreferred}
 Environment=ARANGO_READ_PREFERRED_FALLBACK=error
@@ -17282,6 +17287,24 @@ function planCommunityRehearsalPrepare(request) {
     { kind: "exec", argv: ["/usr/sbin/arangod", "--version"] },
     { kind: "exec", argv: ["/usr/bin/systemctl", "stop", "forgezero-community-api.service"], accepted: [0, 5] },
     { kind: "exec", argv: ["/usr/bin/systemctl", "stop", "forgezero-rehearsal-db.service"], accepted: [0, 5] },
+    { kind: "clear-firewall" },
+    ...topology.map(({ address }) => ({
+      kind: "exec",
+      argv: [
+        "/usr/sbin/ufw",
+        "allow",
+        "from",
+        address,
+        "to",
+        "any",
+        "port",
+        COMMUNITY_REHEARSAL_DATABASE_PORT_RANGE,
+        "proto",
+        "tcp",
+        "comment",
+        COMMUNITY_REHEARSAL_FIREWALL_COMMENT
+      ]
+    })),
     { kind: "remove-tree", path: COMMUNITY_DATABASE_ROOT },
     { kind: "exec", argv: ["/usr/bin/install", "-d", "-m", "0700", "-o", "root", "-g", "root", COMMUNITY_CREDENTIAL_ROOT] },
     { kind: "exec", argv: ["/usr/bin/install", "-d", "-m", "0700", "-o", "arangodb", "-g", "arangodb", COMMUNITY_DATABASE_ROOT] },
@@ -17310,6 +17333,7 @@ function planCommunityRehearsalCleanup() {
     { kind: "remove-tree", path: COMMUNITY_DATABASE_ROOT },
     { kind: "remove-tree", path: COMMUNITY_REHEARSAL_ROOT },
     { kind: "remove-tree", path: COMMUNITY_CREDENTIAL_PARENT },
+    { kind: "clear-firewall" },
     { kind: "exec", argv: ["/usr/bin/systemctl", "daemon-reload"] },
     { kind: "exec", argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-community-api.service", "forgezero-rehearsal-db.service"], accepted: [0, 1, 5] }
   ];
@@ -17329,6 +17353,8 @@ async function applyOperations(operations) {
   for (const operation of operations) {
     if (operation.kind === "remove-tree")
       rmSync13(operation.path, { recursive: true, force: true });
+    else if (operation.kind === "clear-firewall")
+      await clearCommunityRehearsalFirewall();
     else if (operation.kind === "write") {
       mkdirSync17(dirname15(operation.path), { recursive: true });
       writeFileSync17(operation.path, operation.content, { mode: operation.mode });
@@ -17351,8 +17377,27 @@ async function applyOperations(operations) {
     }
   }
 }
+function communityRehearsalFirewallRuleNumbers(status) {
+  return status.split(/\r?\n/).flatMap((line) => {
+    if (!line.includes(`# ${COMMUNITY_REHEARSAL_FIREWALL_COMMENT}`))
+      return [];
+    const match = line.match(/^\[\s*(\d+)\]/);
+    return match ? [Number(match[1])] : [];
+  }).filter((number2) => Number.isSafeInteger(number2) && number2 > 0).sort((left, right) => right - left);
+}
+async function clearCommunityRehearsalFirewall() {
+  const status = await exec(["/usr/sbin/ufw", "status", "numbered"]);
+  if (status.exitCode !== 0)
+    throw new Error(`unable to inspect rehearsal firewall rules: ${status.output.trim()}`);
+  for (const number2 of communityRehearsalFirewallRuleNumbers(status.output)) {
+    const removed = await exec(["/usr/sbin/ufw", "--force", "delete", String(number2)]);
+    if (removed.exitCode !== 0) {
+      throw new Error(`unable to remove rehearsal firewall rule ${number2}: ${removed.output.trim()}`);
+    }
+  }
+}
 var responseFor = async (request) => {
-  const base = "http://127.0.0.1:8787";
+  const base = `http://127.0.0.1:${COMMUNITY_REHEARSAL_API_PORT}`;
   if (request.operation === "health")
     return fetch(`${base}/health`, { signal: AbortSignal.timeout(15000) });
   if (request.operation === "init")
@@ -17414,7 +17459,7 @@ async function runCommunityRehearsalHost(request) {
   }
   if (request.action === "database-ready" || request.action === "starter-ready" || request.action === "api-ready") {
     const starter = topology.find((entry) => entry.starter);
-    const url = request.action === "database-ready" ? "http://127.0.0.1:8529/_api/version" : request.action === "starter-ready" ? `http://${starter.address}:8528/version` : "http://127.0.0.1:8787/health";
+    const url = request.action === "database-ready" ? `http://127.0.0.1:${COMMUNITY_REHEARSAL_COORDINATOR_PORT}/_api/version` : request.action === "starter-ready" ? `http://${starter.address}:${COMMUNITY_REHEARSAL_STARTER_PORT}/version` : `http://127.0.0.1:${COMMUNITY_REHEARSAL_API_PORT}/health`;
     const response2 = await fetch(url, { signal: AbortSignal.timeout(2000) }).catch(() => {
       return;
     });

package/dist/fz.js

@@ -4844,7 +4844,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.121";
+var VERSION2 = "0.1.123";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -18488,6 +18488,14 @@ function unsupportedRepositoryCliOption(argv2) {
   }
   return;
 }
+function forwardedRepositoryOperationArguments(options, args) {
+  return [
+    ...options.apply ? ["--apply"] : [],
+    ...options.json ? ["--json"] : [],
+    ...options.disposableFleetConfirmation ? [`--confirm-disposable-fleet=${options.disposableFleetConfirmation}`] : [],
+    ...args
+  ];
+}
 function manifestName(root) {
   const manifestPath = join12(root, "package.json");
   if (!existsSync12(manifestPath)) {
@@ -20436,11 +20444,7 @@ function repositoryOperationArguments(options, args) {
     throw new Error("--root requires a repository path.");
   if (unsupported)
     throw new Error(`${unsupported} is not valid for repository maintenance commands.`);
-  return [
-    ...options.apply ? ["--apply"] : [],
-    ...options.json ? ["--json"] : [],
-    ...args
-  ];
+  return forwardedRepositoryOperationArguments(options, args);
 }
 async function cmdDev(options, args) {
   if ((args[0] ?? "") !== "reset" || args.length !== 1) {

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.121";
+var VERSION = "0.1.123";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.121";
+var VERSION = "0.1.123";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/platform-fleet-verification.js

@@ -3020,7 +3020,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.121";
+var VERSION3 = "0.1.123";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provision.js

@@ -3020,7 +3020,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.121";
+var VERSION3 = "0.1.123";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.121";
+export declare const VERSION = "0.1.123";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.121",
+  "version": "0.1.123",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",