@forgezero/agent 0.1.46 → 0.1.48

package/dist/agent-heartbeat.js

@@ -749,7 +749,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.46";
+var VERSION3 = "0.1.48";
 
 // src/agent-heartbeat.ts
 var unquote = (value) => value.replace(/^['"]|['"]$/g, "");

package/dist/bootstrap.js

@@ -1207,7 +1207,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.46";
+var VERSION = "0.1.48";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/fz-agent.js

@@ -7000,7 +7000,7 @@ function assertSupportedGuestImage(imageKey) {
 }
 
 // src/version.ts
-var VERSION = "0.1.46";
+var VERSION = "0.1.48";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4830,7 +4830,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.46";
+var VERSION2 = "0.1.48";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -13634,6 +13634,23 @@ var SUPPORTED_BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dc
 
 class MetalBootstrapError extends Error {
 }
+function normalizeMetalPublicIdentity(value) {
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new MetalBootstrapError("metal public identity proof was invalid");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new MetalBootstrapError("metal public identity proof was invalid");
+  }
+  const identity = parsed;
+  const keys = identity.publicKeys;
+  if (Object.keys(identity).some((key) => !["nodeKey", "publicKeys"].includes(key)) || typeof identity.nodeKey !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(identity.nodeKey) || !keys || Object.keys(keys).some((key) => !["ed25519", "mlDsa"].includes(key)) || keys.ed25519 !== identity.nodeKey || typeof keys.mlDsa !== "string" || !/^[A-Za-z0-9_-]{1,8192}$/.test(keys.mlDsa)) {
+    throw new MetalBootstrapError("metal public identity proof was invalid");
+  }
+  return JSON.stringify(parsed);
+}
 var defaultExec2 = async (argv2, stdin) => {
   const child = Bun.spawn([...argv2], {
     stdin: stdin === undefined ? undefined : new Blob([stdin]),
@@ -14129,6 +14146,14 @@ async function applyMetalBootstrap(config, options) {
     "forgezero-metal-agent-egress.service",
     "forgezero-metal-agent.service"
   ]);
+  await runChecked(exec, [
+    "/usr/bin/systemctl",
+    "restart",
+    "forgezero-agent-update-helper.service",
+    "forgezero-metal-helper.service",
+    "forgezero-metal-agent-egress.service",
+    "forgezero-metal-agent.service"
+  ]);
   for (let attempt = 0;attempt < 100 && (!socketReady(HELPER_SOCKET) || !socketReady(UPDATE_SOCKET)); attempt += 1) {
     await Bun.sleep(100);
   }
@@ -14147,9 +14172,7 @@ async function applyMetalBootstrap(config, options) {
     AGENT_PATH,
     "identity"
   ]);
-  const publicIdentity = identity.stdout.trim();
-  if (!publicIdentity || /[\r\n]/.test(publicIdentity))
-    throw new MetalBootstrapError("metal public identity proof was invalid");
+  const publicIdentity = normalizeMetalPublicIdentity(identity.stdout.trim());
   const state = {
     initializedAt: new Date().toISOString(),
     role: "metal",

package/dist/metal-bootstrap.d.ts

@@ -42,6 +42,7 @@ export interface MetalBootstrapApplyOptions {
 }
 export declare class MetalBootstrapError extends Error {
 }
+export declare function normalizeMetalPublicIdentity(value: string): string;
 export declare function validateMetalBootstrapConfig(config: MetalBootstrapConfig): MetalBootstrapConfig;
 /** Reject symlinks and group/world access before parsing coordinates or entropy. */
 export declare function validateOwnerOnlyPath(path: string, requireRootOwner: boolean): void;

package/dist/metal-bootstrap.js

@@ -292,7 +292,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.46";
+var VERSION = "0.1.48";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";
@@ -466,6 +466,23 @@ var SUPPORTED_BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dc
 
 class MetalBootstrapError extends Error {
 }
+function normalizeMetalPublicIdentity(value) {
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new MetalBootstrapError("metal public identity proof was invalid");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new MetalBootstrapError("metal public identity proof was invalid");
+  }
+  const identity = parsed;
+  const keys = identity.publicKeys;
+  if (Object.keys(identity).some((key) => !["nodeKey", "publicKeys"].includes(key)) || typeof identity.nodeKey !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(identity.nodeKey) || !keys || Object.keys(keys).some((key) => !["ed25519", "mlDsa"].includes(key)) || keys.ed25519 !== identity.nodeKey || typeof keys.mlDsa !== "string" || !/^[A-Za-z0-9_-]{1,8192}$/.test(keys.mlDsa)) {
+    throw new MetalBootstrapError("metal public identity proof was invalid");
+  }
+  return JSON.stringify(parsed);
+}
 var defaultExec2 = async (argv, stdin) => {
   const child = Bun.spawn([...argv], {
     stdin: stdin === undefined ? undefined : new Blob([stdin]),
@@ -961,6 +978,14 @@ async function applyMetalBootstrap(config, options) {
     "forgezero-metal-agent-egress.service",
     "forgezero-metal-agent.service"
   ]);
+  await runChecked(exec, [
+    "/usr/bin/systemctl",
+    "restart",
+    "forgezero-agent-update-helper.service",
+    "forgezero-metal-helper.service",
+    "forgezero-metal-agent-egress.service",
+    "forgezero-metal-agent.service"
+  ]);
   for (let attempt = 0;attempt < 100 && (!socketReady(HELPER_SOCKET) || !socketReady(UPDATE_SOCKET)); attempt += 1) {
     await Bun.sleep(100);
   }
@@ -979,9 +1004,7 @@ async function applyMetalBootstrap(config, options) {
     AGENT_PATH,
     "identity"
   ]);
-  const publicIdentity = identity.stdout.trim();
-  if (!publicIdentity || /[\r\n]/.test(publicIdentity))
-    throw new MetalBootstrapError("metal public identity proof was invalid");
+  const publicIdentity = normalizeMetalPublicIdentity(identity.stdout.trim());
   const state = {
     initializedAt: new Date().toISOString(),
     role: "metal",
@@ -1102,6 +1125,7 @@ export {
   renderMetalUnits,
   readMetalBootstrapConfig,
   planMetalBootstrap,
+  normalizeMetalPublicIdentity,
   metalBootstrapStatus,
   applyMetalBootstrap,
   MetalBootstrapError,

package/dist/operator-bootstrap.js

@@ -1207,7 +1207,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.46";
+var VERSION = "0.1.48";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -4538,6 +4538,23 @@ var SUPPORTED_BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dc
 
 class MetalBootstrapError extends Error {
 }
+function normalizeMetalPublicIdentity(value) {
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new MetalBootstrapError("metal public identity proof was invalid");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new MetalBootstrapError("metal public identity proof was invalid");
+  }
+  const identity = parsed;
+  const keys = identity.publicKeys;
+  if (Object.keys(identity).some((key) => !["nodeKey", "publicKeys"].includes(key)) || typeof identity.nodeKey !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(identity.nodeKey) || !keys || Object.keys(keys).some((key) => !["ed25519", "mlDsa"].includes(key)) || keys.ed25519 !== identity.nodeKey || typeof keys.mlDsa !== "string" || !/^[A-Za-z0-9_-]{1,8192}$/.test(keys.mlDsa)) {
+    throw new MetalBootstrapError("metal public identity proof was invalid");
+  }
+  return JSON.stringify(parsed);
+}
 var defaultExec2 = async (argv, stdin) => {
   const child = Bun.spawn([...argv], {
     stdin: stdin === undefined ? undefined : new Blob([stdin]),
@@ -5033,6 +5050,14 @@ async function applyMetalBootstrap(config, options) {
     "forgezero-metal-agent-egress.service",
     "forgezero-metal-agent.service"
   ]);
+  await runChecked(exec, [
+    "/usr/bin/systemctl",
+    "restart",
+    "forgezero-agent-update-helper.service",
+    "forgezero-metal-helper.service",
+    "forgezero-metal-agent-egress.service",
+    "forgezero-metal-agent.service"
+  ]);
   for (let attempt = 0;attempt < 100 && (!socketReady(HELPER_SOCKET) || !socketReady(UPDATE_SOCKET)); attempt += 1) {
     await Bun.sleep(100);
   }
@@ -5051,9 +5076,7 @@ async function applyMetalBootstrap(config, options) {
     AGENT_PATH,
     "identity"
   ]);
-  const publicIdentity = identity.stdout.trim();
-  if (!publicIdentity || /[\r\n]/.test(publicIdentity))
-    throw new MetalBootstrapError("metal public identity proof was invalid");
+  const publicIdentity = normalizeMetalPublicIdentity(identity.stdout.trim());
   const state = {
     initializedAt: new Date().toISOString(),
     role: "metal",

package/dist/platform-fleet-verification.js

@@ -1697,7 +1697,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.46";
+var VERSION3 = "0.1.48";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync2 } from "node:fs";

package/dist/provision.js

@@ -1697,7 +1697,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.46";
+var VERSION3 = "0.1.48";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync2 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.46";
+export declare const VERSION = "0.1.48";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.46",
+  "version": "0.1.48",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",