@forgezero/agent 0.1.45 → 0.1.47

package/dist/agent-heartbeat.js

@@ -749,7 +749,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.45";
+var VERSION3 = "0.1.47";
 
 // src/agent-heartbeat.ts
 var unquote = (value) => value.replace(/^['"]|['"]$/g, "");

package/dist/bootstrap.js

@@ -1207,7 +1207,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.45";
+var VERSION = "0.1.47";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/fz-agent.js

@@ -7000,7 +7000,7 @@ function assertSupportedGuestImage(imageKey) {
 }
 
 // src/version.ts
-var VERSION = "0.1.45";
+var VERSION = "0.1.47";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {
@@ -10538,7 +10538,10 @@ var systemCommand = (argv2, stdin) => {
     stdin: stdin === undefined ? undefined : Buffer.from(stdin),
     stdout: "pipe",
     stderr: "pipe",
-    env: { PATH: "/usr/sbin:/usr/bin:/sbin:/bin" }
+    env: {
+      PATH: "/usr/sbin:/usr/bin:/sbin:/bin",
+      ...process.env.NOTIFY_SOCKET ? { NOTIFY_SOCKET: process.env.NOTIFY_SOCKET } : {}
+    }
   });
   return {
     exitCode: result.exitCode,

package/dist/fz.js

@@ -4830,7 +4830,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.45";
+var VERSION2 = "0.1.47";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -13634,6 +13634,23 @@ var SUPPORTED_BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dc
 
 class MetalBootstrapError extends Error {
 }
+function normalizeMetalPublicIdentity(value) {
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new MetalBootstrapError("metal public identity proof was invalid");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new MetalBootstrapError("metal public identity proof was invalid");
+  }
+  const identity = parsed;
+  const keys = identity.publicKeys;
+  if (Object.keys(identity).some((key) => !["nodeKey", "publicKeys"].includes(key)) || typeof identity.nodeKey !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(identity.nodeKey) || !keys || Object.keys(keys).some((key) => !["ed25519", "mlDsa"].includes(key)) || keys.ed25519 !== identity.nodeKey || typeof keys.mlDsa !== "string" || !/^[A-Za-z0-9_-]{1,8192}$/.test(keys.mlDsa)) {
+    throw new MetalBootstrapError("metal public identity proof was invalid");
+  }
+  return JSON.stringify(parsed);
+}
 var defaultExec2 = async (argv2, stdin) => {
   const child = Bun.spawn([...argv2], {
     stdin: stdin === undefined ? undefined : new Blob([stdin]),
@@ -14147,9 +14164,7 @@ async function applyMetalBootstrap(config, options) {
     AGENT_PATH,
     "identity"
   ]);
-  const publicIdentity = identity.stdout.trim();
-  if (!publicIdentity || /[\r\n]/.test(publicIdentity))
-    throw new MetalBootstrapError("metal public identity proof was invalid");
+  const publicIdentity = normalizeMetalPublicIdentity(identity.stdout.trim());
   const state = {
     initializedAt: new Date().toISOString(),
     role: "metal",

package/dist/metal-bootstrap.d.ts

@@ -42,6 +42,7 @@ export interface MetalBootstrapApplyOptions {
 }
 export declare class MetalBootstrapError extends Error {
 }
+export declare function normalizeMetalPublicIdentity(value: string): string;
 export declare function validateMetalBootstrapConfig(config: MetalBootstrapConfig): MetalBootstrapConfig;
 /** Reject symlinks and group/world access before parsing coordinates or entropy. */
 export declare function validateOwnerOnlyPath(path: string, requireRootOwner: boolean): void;

package/dist/metal-bootstrap.js

@@ -292,7 +292,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.45";
+var VERSION = "0.1.47";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";
@@ -466,6 +466,23 @@ var SUPPORTED_BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dc
 
 class MetalBootstrapError extends Error {
 }
+function normalizeMetalPublicIdentity(value) {
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new MetalBootstrapError("metal public identity proof was invalid");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new MetalBootstrapError("metal public identity proof was invalid");
+  }
+  const identity = parsed;
+  const keys = identity.publicKeys;
+  if (Object.keys(identity).some((key) => !["nodeKey", "publicKeys"].includes(key)) || typeof identity.nodeKey !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(identity.nodeKey) || !keys || Object.keys(keys).some((key) => !["ed25519", "mlDsa"].includes(key)) || keys.ed25519 !== identity.nodeKey || typeof keys.mlDsa !== "string" || !/^[A-Za-z0-9_-]{1,8192}$/.test(keys.mlDsa)) {
+    throw new MetalBootstrapError("metal public identity proof was invalid");
+  }
+  return JSON.stringify(parsed);
+}
 var defaultExec2 = async (argv, stdin) => {
   const child = Bun.spawn([...argv], {
     stdin: stdin === undefined ? undefined : new Blob([stdin]),
@@ -979,9 +996,7 @@ async function applyMetalBootstrap(config, options) {
     AGENT_PATH,
     "identity"
   ]);
-  const publicIdentity = identity.stdout.trim();
-  if (!publicIdentity || /[\r\n]/.test(publicIdentity))
-    throw new MetalBootstrapError("metal public identity proof was invalid");
+  const publicIdentity = normalizeMetalPublicIdentity(identity.stdout.trim());
   const state = {
     initializedAt: new Date().toISOString(),
     role: "metal",
@@ -1102,6 +1117,7 @@ export {
   renderMetalUnits,
   readMetalBootstrapConfig,
   planMetalBootstrap,
+  normalizeMetalPublicIdentity,
   metalBootstrapStatus,
   applyMetalBootstrap,
   MetalBootstrapError,

package/dist/operator-bootstrap.js

@@ -1207,7 +1207,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.45";
+var VERSION = "0.1.47";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -4538,6 +4538,23 @@ var SUPPORTED_BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dc
 
 class MetalBootstrapError extends Error {
 }
+function normalizeMetalPublicIdentity(value) {
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new MetalBootstrapError("metal public identity proof was invalid");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new MetalBootstrapError("metal public identity proof was invalid");
+  }
+  const identity = parsed;
+  const keys = identity.publicKeys;
+  if (Object.keys(identity).some((key) => !["nodeKey", "publicKeys"].includes(key)) || typeof identity.nodeKey !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(identity.nodeKey) || !keys || Object.keys(keys).some((key) => !["ed25519", "mlDsa"].includes(key)) || keys.ed25519 !== identity.nodeKey || typeof keys.mlDsa !== "string" || !/^[A-Za-z0-9_-]{1,8192}$/.test(keys.mlDsa)) {
+    throw new MetalBootstrapError("metal public identity proof was invalid");
+  }
+  return JSON.stringify(parsed);
+}
 var defaultExec2 = async (argv, stdin) => {
   const child = Bun.spawn([...argv], {
     stdin: stdin === undefined ? undefined : new Blob([stdin]),
@@ -5051,9 +5068,7 @@ async function applyMetalBootstrap(config, options) {
     AGENT_PATH,
     "identity"
   ]);
-  const publicIdentity = identity.stdout.trim();
-  if (!publicIdentity || /[\r\n]/.test(publicIdentity))
-    throw new MetalBootstrapError("metal public identity proof was invalid");
+  const publicIdentity = normalizeMetalPublicIdentity(identity.stdout.trim());
   const state = {
     initializedAt: new Date().toISOString(),
     role: "metal",

package/dist/platform-fleet-verification.js

@@ -1697,7 +1697,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.45";
+var VERSION3 = "0.1.47";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync2 } from "node:fs";

package/dist/provision.js

@@ -1697,7 +1697,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.45";
+var VERSION3 = "0.1.47";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync2 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.45";
+export declare const VERSION = "0.1.47";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.45",
+  "version": "0.1.47",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",