@forgezero/agent 0.1.125 → 0.1.128

package/dist/host-maintenance.js

@@ -62,7 +62,7 @@ function planHostMaintenance(request, runtime = localRuntime()) {
     "--pipe",
     "--collect",
     `--unit=forgezero-${request.operation}`,
-    "--property=User=forgezero",
+    "--property=User=forgezero-api",
     `--property=WorkingDirectory=${workingDirectory}`,
     `--property=EnvironmentFile=${SHARED_ENV}`,
     "--property=Environment=NODE_ENV=production",

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.125";
+var VERSION = "0.1.128";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.d.ts

@@ -89,7 +89,7 @@ export interface OperatorPlatformFleetCoordinates {
         databaseRole: 'master' | 'joiner';
     }[];
 }
-export type OperatorPlatformBootstrapMode = 'apply' | 'status';
+export type OperatorPlatformBootstrapMode = 'apply' | 'repair' | 'status';
 export type OperatorMetalBootstrapMode = 'apply' | 'genesis' | 'genesis-cleanup' | 'rehearsal' | 'rehearsal-cleanup' | 'host-keys' | 'rehearsal-host-keys' | 'status';
 export interface OperatorPlatformBootstrapPlan {
     kind: 'platform-remote';

package/dist/operator-bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.125";
+var VERSION = "0.1.128";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3805,7 +3805,7 @@ function validateEnrolledComputeBootstrapSecrets(config, input) {
     ...cloudflareConfigured ? validateCloudflareBootstrapSecretPair(source) : {}
   };
 }
-function validatePlatformBootstrapSecrets(config, input) {
+function validatePlatformBootstrapSecrets(config, input, options = {}) {
   if (!input || typeof input !== "object" || Array.isArray(input))
     throw new Error("bootstrap credential input must be an object");
   const source = input;
@@ -3833,7 +3833,8 @@ function validatePlatformBootstrapSecrets(config, input) {
     throw new Error("backup credential is malformed");
   }
   const cloudflareConfigured = Boolean(config.cloudflareHandoff || config.runtime.environment.cloudflare);
-  if (cloudflareConfigured !== Boolean(cloudflareTunnelToken && cloudflareApiToken)) {
+  const cloudflareCredentialsSupplied = Boolean(cloudflareTunnelToken || cloudflareApiToken);
+  if (!cloudflareConfigured && cloudflareCredentialsSupplied || cloudflareConfigured && !cloudflareCredentialsSupplied && !options.allowStoredCloudflareCredentials || Boolean(cloudflareTunnelToken) !== Boolean(cloudflareApiToken)) {
     throw new Error("Cloudflare configuration requires attended CF_TUNNEL_TOKEN and CF_API_TOKEN together");
   }
   if (cloudflareTunnelToken)
@@ -4759,7 +4760,9 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   const platformPrivate = config.kind === "platform" ? (() => {
     if (!secrets)
       throw new Error("platform apply requires attended credentials on stdin");
-    const checked4 = validatePlatformBootstrapSecrets(config, secrets);
+    const checked4 = validatePlatformBootstrapSecrets(config, secrets, {
+      allowStoredCloudflareCredentials: Boolean(installed?.cloudflare && config.cloudflareHandoff && !cloudflare)
+    });
     return {
       root: checked4.clusterBootstrapCode,
       email: checked4.emailSecret,
@@ -6713,12 +6716,12 @@ function planOperatorMetalBootstrap(request, mode) {
 var secretSources = (config) => [
   ...config.cloudflareHandoff ? [["cloudflare-handoff", config.cloudflareHandoff.handoffFile]] : []
 ];
-var attendedSecretNames = (config) => [
+var attendedSecretNames = (config, options = {}) => [
   "cluster-bootstrap-code",
   config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : "fz_smtp.password",
   ...config.enrolment.source === "api-token" ? ["enrol-token"] : [],
   ...config.runtime.environment.backup ? ["backup.s3.secretAccessKey"] : [],
-  ...config.cloudflareHandoff || config.runtime.environment.cloudflare ? ["CF_TUNNEL_TOKEN", "CF_API_TOKEN"] : []
+  ...!options.reuseBoundCloudflare && (config.cloudflareHandoff || config.runtime.environment.cloudflare) ? ["CF_TUNNEL_TOKEN", "CF_API_TOKEN"] : []
 ];
 function planOperatorPlatformBootstrap(request, mode) {
   const config = readBootstrapConfig(request.platformConfigFile);
@@ -6742,7 +6745,10 @@ function planOperatorPlatformBootstrap(request, mode) {
       "run typed fz bootstrap platform --apply from the local bundle",
       "remove transient local and remote staging data"
     ],
-    secretInputs: mode === "apply" ? [...attendedSecretNames(config), ...secretSources(config).map(([name]) => name)] : []
+    secretInputs: mode === "apply" || mode === "repair" ? [
+      ...attendedSecretNames(config, { reuseBoundCloudflare: mode === "repair" }),
+      ...mode === "repair" ? [] : secretSources(config).map(([name]) => name)
+    ] : []
   };
 }
 var fleetConfigIdentity = (config) => {
@@ -7172,10 +7178,10 @@ async function withOperatorGuestTransport(request, evidence, callback, options =
     rmSync6(directory, { recursive: true, force: true });
   }
 }
-async function stageConfig(config, directory) {
+async function stageConfig(config, directory, options = {}) {
   const rewritten = structuredClone(config);
   const staged = [];
-  for (const [name, source] of secretSources(config)) {
+  for (const [name, source] of options.reuseBoundCloudflare ? [] : secretSources(config)) {
     const bytes = ownerFile(source, SECRET_LIMIT, name);
     const local = join6(directory, name);
     writeFileSync8(local, bytes, { mode: 384, flag: "wx" });
@@ -7184,6 +7190,9 @@ async function stageConfig(config, directory) {
     if (name === "cloudflare-handoff")
       rewritten.cloudflareHandoff.handoffFile = remotePath;
   }
+  if (options.reuseBoundCloudflare && rewritten.cloudflareHandoff) {
+    rewritten.cloudflareHandoff.handoffFile = `${REMOTE_STAGE}/cloudflare-handoff`;
+  }
   const bundle = await readBootstrapBundle(config.bootstrapBundle.bundleFile, config.bootstrapBundle.manifestFile);
   if (bundle.manifest.branch !== config.bootstrapBundle.branch) {
     throw new Error("reviewed bootstrap config branch does not match the bundle manifest");
@@ -7290,8 +7299,12 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
     const config = readBootstrapConfig(request.platformConfigFile);
     if (config.kind !== "platform")
       throw new Error("operator bootstrap requires a platform config");
-    const secrets = mode === "apply" ? validatePlatformBootstrapSecrets(config, options.secrets) : undefined;
-    const staged = await stageConfig(config, directory);
+    const secrets = mode === "apply" || mode === "repair" ? validatePlatformBootstrapSecrets(config, options.secrets, {
+      allowStoredCloudflareCredentials: mode === "repair"
+    }) : undefined;
+    const staged = await stageConfig(config, directory, {
+      reuseBoundCloudflare: mode === "repair"
+    });
     await installPackagedAgent(request, knownHosts, exec, directory, remoteTemp, options);
     await copy(exec, request, knownHosts, staged.path, `${remoteTemp}/platform-config.json`, true);
     for (const name of staged.files)
@@ -7302,7 +7315,14 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
       await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0600", `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`], "remote bootstrap handoff", true);
     for (const { name } of staged.bundleFiles)
       await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0644", `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`], "remote bootstrap bundle", true);
-    const command = ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "platform", "credentials-stdin"];
+    const command = [
+      "/usr/bin/sudo",
+      "-n",
+      "/usr/local/bin/fz",
+      "bootstrap",
+      mode === "repair" ? "repair" : "platform",
+      "credentials-stdin"
+    ];
     command.push("--bootstrap-config", `${REMOTE_STAGE}/platform-config.json`, "--apply");
     const output = await remote(exec, request, knownHosts, command, "remote typed bootstrap", mode === "apply", secrets ? `${JSON.stringify(secrets)}
 ` : undefined, mode === "apply");

package/dist/platform-fleet-verification.js

@@ -3020,7 +3020,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.125";
+var VERSION3 = "0.1.128";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provision.js

@@ -3020,7 +3020,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.125";
+var VERSION3 = "0.1.128";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/recovery-host.d.ts

@@ -4,4 +4,13 @@ export interface RecoveryHostResult {
     stderr: string;
 }
 export type RecoveryHostExec = (argv: readonly string[]) => Promise<RecoveryHostResult>;
+export interface RecoveryBootstrapCoordinates {
+    profile: string;
+    role: string;
+    software: string;
+    apiOrigin: string;
+    edgeHostname: string;
+    databaseAddress?: string;
+}
+export declare function validateRecoveryBootstrapState(value: unknown, expected: RecoveryBootstrapCoordinates): void;
 export declare function runRecoveryHost(args: readonly string[], run?: RecoveryHostExec): Promise<void>;

package/dist/recovery-host.js

@@ -28,6 +28,26 @@ var nonEmpty = (path) => {
   if (!existsSync(path) || !statSync(path).isFile() || statSync(path).size < 1)
     throw new Error(`required file missing: ${path}`);
 };
+function validateRecoveryBootstrapState(value, expected) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("bootstrap state is malformed");
+  const state = value;
+  if (state.format !== 2 || state.kind !== "platform" || state.environment !== expected.profile || state.databaseRole !== expected.role || state.profile !== expected.software || state.apiUrl !== expected.apiOrigin || state.nodeHostname !== expected.edgeHostname || expected.databaseAddress !== undefined && state.databaseAddress !== expected.databaseAddress)
+    throw new Error("bootstrap state does not match reviewed recovery coordinates");
+}
+var exactBootstrapState = (expected) => {
+  const path = "/var/lib/forgezero/bootstrap.json";
+  nonEmpty(path);
+  if (statSync(path).size > 64 * 1024)
+    throw new Error("bootstrap state is oversized");
+  let value;
+  try {
+    value = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    throw new Error("bootstrap state is malformed");
+  }
+  validateRecoveryBootstrapState(value, expected);
+};
 var option = (args, name) => {
   const value = args.find((arg) => arg.startsWith(`--${name}=`))?.slice(name.length + 3);
   if (!value || /[\0\r\n]/.test(value))
@@ -51,15 +71,11 @@ async function runRecoveryHost(args, run = execute) {
     const apiOrigin = option(args, "api-origin");
     const edgeHostname = option(args, "edge-hostname");
     const databaseAddress = args.find((arg) => arg.startsWith("--db-address="))?.slice(13);
-    exactState("/opt/forgezero/.forge-state", `profile=${profile}`);
-    exactState("/opt/forgezero/.forge-state", `db_role=${role}`);
-    exactState("/opt/forgezero/.forge-state", `software_profile=${software}`);
-    if (databaseAddress)
-      exactState("/opt/forgezero/.forge-state", `db_address=${databaseAddress}`);
-    exactState("/opt/forgezero/shared/.env", "ARANGO_DB=fz");
-    exactState("/opt/forgezero/shared/.env", "FZ_DATABASE_MODE=platform");
-    exactState("/opt/forgezero/shared/.env", `API_ORIGIN=${apiOrigin}`);
-    exactState("/opt/forgezero/shared/.env", `FZ_NODE_HOSTNAME=${edgeHostname}`);
+    exactBootstrapState({ profile, role, software, apiOrigin, edgeHostname, ...databaseAddress ? { databaseAddress } : {} });
+    exactState("/opt/forgezero/shared/.env", 'ARANGO_DB="fz"');
+    exactState("/opt/forgezero/shared/.env", 'FZ_DATABASE_MODE="platform"');
+    exactState("/opt/forgezero/shared/.env", `API_ORIGIN="${apiOrigin}"`);
+    exactState("/opt/forgezero/shared/.env", `FZ_NODE_HOSTNAME="${edgeHostname}"`);
     nonEmpty("/etc/forgezero/creds/arangodb-jwt.cred");
     const hasDatabase = role !== "none";
     if (hasDatabase) {
@@ -103,7 +119,7 @@ async function runRecoveryHost(args, run = execute) {
       throw new Error("maintenance accepts only fz db argv");
     const slot = activeSlot();
     const properties = [
-      "--property=User=forgezero",
+      "--property=User=forgezero-api",
       `--property=WorkingDirectory=/opt/forgezero/slots/${slot}`,
       "--property=Environment=NODE_ENV=production",
       "--property=EnvironmentFile=/opt/forgezero/shared/.env",
@@ -120,5 +136,6 @@ async function runRecoveryHost(args, run = execute) {
   throw new Error("unknown recovery-host action");
 }
 export {
+  validateRecoveryBootstrapState,
   runRecoveryHost
 };

package/dist/ssh-bootstrap.d.ts

@@ -10,6 +10,7 @@ export interface RemoteSshBootstrapClaim {
     realm: string;
     projectKey: string;
     environmentKey: string;
+    runnerSshPublicKey: string;
     target: {
         host: string;
         port: number;
@@ -25,7 +26,12 @@ export interface RemoteSshBootstrapClaim {
             source: 'runner';
         } | {
             source: 'vault';
+            kind: 'private-key';
             privateKey: string;
+        } | {
+            source: 'vault';
+            kind: 'password';
+            password: string;
         };
     };
     enrolmentToken: string;
@@ -42,6 +48,7 @@ export interface RemoteMetalAdmissionClaim {
     label: string;
     regionKey: string;
     runnerNodeKey: string;
+    runnerSshPublicKey: string;
     challenge: string;
     provisioning: {
         volumeGroup: string;
@@ -109,6 +116,7 @@ export interface BootstrapCommandResult {
 export type BootstrapCommand = (argv: readonly string[], options?: {
     stdin?: string;
     secret?: boolean;
+    env?: Record<string, string>;
 }) => Promise<BootstrapCommandResult>;
 export interface SshBootstrapPullOptions {
     apiUrl: string;

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.125";
+export declare const VERSION = "0.1.128";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.125",
+  "version": "0.1.128",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",
@@ -16,8 +16,8 @@
     "@noble/post-quantum": "^0.6.1"
   },
   "dependencies": {
-    "@forgezero/runtime": "0.1.18",
-    "@forgezero/vault": "0.1.24",
+    "@forgezero/runtime": "0.1.19",
+    "@forgezero/vault": "0.1.25",
     "@noble/curves": "2.2.0",
     "@noble/hashes": "2.2.0",
     "@noble/post-quantum": "0.6.1",