@forgezero/agent 0.1.53 → 0.1.55

package/dist/operator-bootstrap.js

@@ -1180,15 +1180,15 @@ async function finalizeCloudflareBootstrapAcceptance(request, fetcher = fetch) {
 import { createHash, createHmac, randomBytes as randomBytes3 } from "crypto";
 import {
   chmodSync as chmodSync2,
-  existsSync as existsSync3,
+  existsSync as existsSync4,
   lstatSync as lstatSync2,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync3,
-  renameSync as renameSync3,
-  rmSync as rmSync3,
-  writeFileSync as writeFileSync3
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync4,
+  renameSync as renameSync4,
+  rmSync as rmSync4,
+  writeFileSync as writeFileSync4
 } from "fs";
-import { dirname as dirname4 } from "path";
+import { dirname as dirname5 } from "path";
 import { fileURLToPath } from "url";
 
 // src/agent-update-helper.ts
@@ -1207,11 +1207,19 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.53";
+var VERSION = "0.1.55";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
 var BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f";
+var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
+  "data-root": "/var/lib/docker",
+  "storage-driver": "overlay2",
+  "live-restore": true,
+  "log-driver": "local",
+  "log-opts": { "max-size": "10m", "max-file": "3" }
+}, null, 2)}
+`;
 
 // src/service-supervisor.ts
 import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "fs";
@@ -1273,6 +1281,39 @@ var defaultHost = {
   now: Date.now
 };
 
+// src/container-supervisor.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync as readdirSync2, realpathSync as realpathSync2, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname3, resolve as resolve3, sep as sep2 } from "path";
+var defaultHost2 = {
+  realpath: realpathSync2,
+  exists: existsSync2,
+  read: (path) => readFileSync2(path, "utf8"),
+  write(path, content, mode) {
+    mkdirSync2(dirname3(path), { recursive: true, mode: 493 });
+    const next = `${path}.next`;
+    writeFileSync2(next, content, { mode });
+    renameSync2(next, path);
+  },
+  remove: (path) => rmSync2(path, { force: true }),
+  list: (path) => existsSync2(path) ? readdirSync2(path) : [],
+  mkdir: (path, mode) => mkdirSync2(path, { recursive: true, mode }),
+  async exec(argv) {
+    const child = Bun.spawn([...argv], { stdout: "pipe", stderr: "pipe", env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C" } });
+    const [stdout, stderr, exitCode] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
+    return { exitCode, output: `${stdout}${stderr}` };
+  },
+  async health(port, path, timeoutMs, method, expectedStatus) {
+    try {
+      const response = await fetch(`http://127.0.0.1:${port}${path}`, { method, redirect: "manual", signal: AbortSignal.timeout(timeoutMs) });
+      return expectedStatus.includes(response.status);
+    } catch {
+      return false;
+    }
+  },
+  sleep: (ms) => Bun.sleep(ms),
+  now: Date.now
+};
+
 // src/software-helper.ts
 var DEFAULT_SOFTWARE_HELPER_SOCKET = "/run/forgezero-software/helper.sock";
 var SOFTWARE_HELPER_GROUP = "forgezero-software";
@@ -2255,17 +2296,17 @@ import { randomBytes as randomBytes2 } from "crypto";
 import {
   chmodSync,
   copyFileSync,
-  existsSync as existsSync2,
+  existsSync as existsSync3,
   lstatSync,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync2,
-  realpathSync as realpathSync2,
-  renameSync as renameSync2,
-  rmSync as rmSync2,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync3,
+  realpathSync as realpathSync3,
+  renameSync as renameSync3,
+  rmSync as rmSync3,
   symlinkSync,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync3
 } from "fs";
-import { dirname as dirname3 } from "path";
+import { dirname as dirname4 } from "path";
 async function readCapabilities(run) {
   const answers = {};
   const checks = Object.entries(CAPABILITY_CHECKS);
@@ -2324,28 +2365,28 @@ var runProvisionOperation = async (operation) => {
   }
   if (operation.kind === "install-runtime") {
     const release = `/opt/forgezero/agent/versions/${operation.version}`;
-    mkdirSync2(`${release}/dist`, { recursive: true, mode: 493 });
-    mkdirSync2(dirname3(operation.binary), { recursive: true, mode: 493 });
+    mkdirSync3(`${release}/dist`, { recursive: true, mode: 493 });
+    mkdirSync3(dirname4(operation.binary), { recursive: true, mode: 493 });
     copyFileSync(operation.source, `${release}/dist/fz-agent.js`);
     chmodSync(`${release}/dist/fz-agent.js`, 493);
-    const gitSshSource = `${dirname3(operation.source)}/fz-git-ssh.js`;
-    if (!existsSync2(gitSshSource))
+    const gitSshSource = `${dirname4(operation.source)}/fz-git-ssh.js`;
+    if (!existsSync3(gitSshSource))
       return { stdout: "packaged fz-git-ssh.js is missing", exitCode: 1 };
     copyFileSync(gitSshSource, `${release}/dist/fz-git-ssh.js`);
     chmodSync(`${release}/dist/fz-git-ssh.js`, 493);
     const pending = "/opt/forgezero/agent/current.next";
-    rmSync2(pending, { force: true });
+    rmSync3(pending, { force: true });
     symlinkSync(`versions/${operation.version}`, pending);
-    renameSync2(pending, "/opt/forgezero/agent/current");
-    rmSync2(operation.binary, { force: true });
+    renameSync3(pending, "/opt/forgezero/agent/current");
+    rmSync3(operation.binary, { force: true });
     symlinkSync("/opt/forgezero/agent/current/dist/fz-agent.js", operation.binary);
     const gitSshBinary = "/usr/local/lib/forgezero/agent/fz-git-ssh";
-    rmSync2(gitSshBinary, { force: true });
+    rmSync3(gitSshBinary, { force: true });
     symlinkSync("/opt/forgezero/agent/current/dist/fz-git-ssh.js", gitSshBinary);
     return { stdout: "", exitCode: 0 };
   }
   if (operation.kind === "ensure-seed") {
-    if (existsSync2(operation.credential) && lstatSync(operation.credential).size > 0)
+    if (existsSync3(operation.credential) && lstatSync(operation.credential).size > 0)
       return { stdout: "", exitCode: 0 };
     const seed = randomBytes2(32).toString("base64url");
     const result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=agent-seed", "-", operation.credential], seed);
@@ -2357,9 +2398,9 @@ var runProvisionOperation = async (operation) => {
     const key = "/run/forgezero-git-deploy-key";
     const publicKey = `${key}.pub`;
     try {
-      if (!existsSync2(operation.credential) || lstatSync(operation.credential).size < 1) {
-        rmSync2(key, { force: true });
-        rmSync2(publicKey, { force: true });
+      if (!existsSync3(operation.credential) || lstatSync(operation.credential).size < 1) {
+        rmSync3(key, { force: true });
+        rmSync3(publicKey, { force: true });
         let result = await fixed(["/usr/bin/ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-C", "forgezero-compute", "-f", key]);
         if (result.exitCode !== 0)
           return result;
@@ -2368,8 +2409,8 @@ var runProvisionOperation = async (operation) => {
           return result;
         chmodSync(operation.credential, 256);
       }
-      if (!existsSync2(operation.publicKey) || lstatSync(operation.publicKey).size < 1) {
-        if (!existsSync2(key)) {
+      if (!existsSync3(operation.publicKey) || lstatSync(operation.publicKey).size < 1) {
+        if (!existsSync3(key)) {
           const decrypted = await fixed(["/usr/bin/systemd-creds", "decrypt", "--name=git-deploy-key", operation.credential, key]);
           if (decrypted.exitCode !== 0)
             return decrypted;
@@ -2377,25 +2418,25 @@ var runProvisionOperation = async (operation) => {
         const derived = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
         if (derived.exitCode !== 0)
           return derived;
-        writeFileSync2(operation.publicKey, `${derived.stdout.trim()} forgezero-compute
+        writeFileSync3(operation.publicKey, `${derived.stdout.trim()} forgezero-compute
 `, { mode: 292 });
       }
       return { stdout: "", exitCode: 0 };
     } finally {
-      rmSync2(key, { force: true });
-      rmSync2(publicKey, { force: true });
+      rmSync3(key, { force: true });
+      rmSync3(publicKey, { force: true });
     }
   }
   if (operation.kind === "ensure-bootstrap-ssh-identity") {
     const key = "/run/forgezero-bootstrap-ssh-key";
     const generatedPublicKey = `${key}.pub`;
     try {
-      if (!existsSync2(operation.credential) || lstatSync(operation.credential).size < 1) {
-        rmSync2(key, { force: true });
-        rmSync2(generatedPublicKey, { force: true });
+      if (!existsSync3(operation.credential) || lstatSync(operation.credential).size < 1) {
+        rmSync3(key, { force: true });
+        rmSync3(generatedPublicKey, { force: true });
         let result;
         if (operation.source) {
-          const source = existsSync2(operation.source) ? lstatSync(operation.source) : undefined;
+          const source = existsSync3(operation.source) ? lstatSync(operation.source) : undefined;
           if (!source?.isFile() || source.isSymbolicLink() || source.uid !== 0 || source.nlink !== 1 || (source.mode & 63) !== 0 || source.size < 32 || source.size > 16 * 1024) {
             return { stdout: "bootstrap SSH private-key source is missing or unsafe", exitCode: 1 };
           }
@@ -2415,8 +2456,8 @@ var runProvisionOperation = async (operation) => {
           return result;
         chmodSync(operation.credential, 256);
       }
-      if (!existsSync2(operation.publicKey) || lstatSync(operation.publicKey).size < 1) {
-        if (!existsSync2(key)) {
+      if (!existsSync3(operation.publicKey) || lstatSync(operation.publicKey).size < 1) {
+        if (!existsSync3(key)) {
           const decrypted = await fixed(["/usr/bin/systemd-creds", "decrypt", "--name=bootstrap-ssh-key", operation.credential, key]);
           if (decrypted.exitCode !== 0)
             return decrypted;
@@ -2426,28 +2467,28 @@ var runProvisionOperation = async (operation) => {
         if (derived.exitCode !== 0 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}\s*$/.test(derived.stdout)) {
           return { stdout: "bootstrap SSH public key derivation failed", exitCode: 1 };
         }
-        mkdirSync2(dirname3(operation.publicKey), { recursive: true, mode: 493 });
-        writeFileSync2(operation.publicKey, `${derived.stdout.trim()} forgezero-bootstrap-runner
+        mkdirSync3(dirname4(operation.publicKey), { recursive: true, mode: 493 });
+        writeFileSync3(operation.publicKey, `${derived.stdout.trim()} forgezero-bootstrap-runner
 `, { mode: 292 });
         chmodSync(operation.publicKey, 292);
       }
       if (operation.source)
-        rmSync2(operation.source, { force: true });
+        rmSync3(operation.source, { force: true });
       return { stdout: "", exitCode: 0 };
     } finally {
-      rmSync2(key, { force: true });
-      rmSync2(generatedPublicKey, { force: true });
+      rmSync3(key, { force: true });
+      rmSync3(generatedPublicKey, { force: true });
     }
   }
   if (operation.kind === "ensure-enrolment") {
-    if (existsSync2(operation.state) && lstatSync(operation.state).size > 0 || existsSync2(operation.credential) && lstatSync(operation.credential).size > 0)
+    if (existsSync3(operation.state) && lstatSync(operation.state).size > 0 || existsSync3(operation.credential) && lstatSync(operation.credential).size > 0)
       return { stdout: "", exitCode: 0 };
-    if (!existsSync2(operation.source))
+    if (!existsSync3(operation.source))
       return { stdout: "enrolment source is missing", exitCode: 1 };
     const result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=enrol-token", operation.source, operation.credential]);
     if (result.exitCode === 0) {
       chmodSync(operation.credential, 256);
-      rmSync2(operation.source, { force: true });
+      rmSync3(operation.source, { force: true });
     }
     return result;
   }
@@ -2462,7 +2503,7 @@ var runProvisionOperation = async (operation) => {
     return { stdout: `socket did not become ready: ${operation.path}`, exitCode: 1 };
   }
   if (operation.kind === "verify-file")
-    return existsSync2(operation.path) && lstatSync(operation.path).size > 0 ? { stdout: "", exitCode: 0 } : { stdout: "required file is empty", exitCode: 1 };
+    return existsSync3(operation.path) && lstatSync(operation.path).size > 0 ? { stdout: "", exitCode: 0 } : { stdout: "required file is empty", exitCode: 1 };
   if (operation.kind === "verify-egress") {
     const active = await fixed(["/usr/bin/systemctl", "is-active", "forgezero-agent-egress.service"]);
     if (active.exitCode !== 0)
@@ -2478,31 +2519,31 @@ var runProvisionOperation = async (operation) => {
   if (operation.kind === "verify-resolved-stub") {
     try {
       const expected = "/run/systemd/resolve/stub-resolv.conf";
-      return realpathSync2("/etc/resolv.conf") === expected && realpathSync2(expected) === expected ? { stdout: expected, exitCode: 0 } : { stdout: "resolver stub mismatch", exitCode: 1 };
+      return realpathSync3("/etc/resolv.conf") === expected && realpathSync3(expected) === expected ? { stdout: expected, exitCode: 0 } : { stdout: "resolver stub mismatch", exitCode: 1 };
     } catch {
       return { stdout: "resolver stub missing", exitCode: 1 };
     }
   }
   if (operation.kind === "install-warp") {
-    const os = readFileSync2("/etc/os-release", "utf8");
+    const os = readFileSync3("/etc/os-release", "utf8");
     if (!/^ID=ubuntu$/m.test(os) || !/^VERSION_ID="?26\.04"?$/m.test(os))
       return { stdout: "unsupported WARP host OS", exitCode: 1 };
     const response = await fetch("https://pkg.cloudflareclient.com/pubkey.gpg", { signal: AbortSignal.timeout(30000) });
     if (!response.ok)
       return { stdout: `WARP key HTTP ${response.status}`, exitCode: 1 };
-    mkdirSync2("/usr/share/keyrings", { recursive: true, mode: 493 });
-    mkdirSync2("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
-    mkdirSync2("/etc/systemd/system/warp-svc.service.d", { recursive: true, mode: 493 });
+    mkdirSync3("/usr/share/keyrings", { recursive: true, mode: 493 });
+    mkdirSync3("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
+    mkdirSync3("/etc/systemd/system/warp-svc.service.d", { recursive: true, mode: 493 });
     const key = "/run/cloudflare-warp-key.gpg";
-    writeFileSync2(key, new Uint8Array(await response.arrayBuffer()), { mode: 384 });
+    writeFileSync3(key, new Uint8Array(await response.arrayBuffer()), { mode: 384 });
     let result = await fixed(["/usr/bin/gpg", "--batch", "--yes", "--dearmor", "-o", "/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", key]);
-    rmSync2(key, { force: true });
+    rmSync3(key, { force: true });
     if (result.exitCode !== 0)
       return result;
     const codename = os.match(/^VERSION_CODENAME=(.+)$/m)?.[1]?.replace(/^"|"$/g, "");
     if (!codename)
       return { stdout: "Ubuntu codename missing", exitCode: 1 };
-    writeFileSync2("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ ${codename} main
+    writeFileSync3("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ ${codename} main
 `, { mode: 420 });
     result = await fixed(["/usr/bin/apt-get", "update", "-qq"]);
     return result.exitCode === 0 ? fixed(["/usr/bin/apt-get", "install", "-y", "cloudflare-warp"]) : result;
@@ -4175,7 +4216,7 @@ function readBootstrapConfig(path) {
   if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.uid !== (process.getuid?.() ?? metadata.uid) || metadata.nlink !== 1 || (metadata.mode & 63) !== 0 || metadata.size > 64 * 1024) {
     throw new Error("bootstrap config must be an owner-only regular file with one link and at most 64 KiB");
   }
-  return validateBootstrapConfig(strictBootstrapDocument(JSON.parse(readFileSync3(path, "utf8"))));
+  return validateBootstrapConfig(strictBootstrapDocument(JSON.parse(readFileSync4(path, "utf8"))));
 }
 function localBootstrapHost() {
   const execute = async (argv, options = {}) => {
@@ -4193,17 +4234,17 @@ function localBootstrapHost() {
   };
   return {
     uid: () => process.getuid?.() ?? -1,
-    exists: existsSync3,
-    read: (path) => readFileSync3(path, "utf8"),
+    exists: existsSync4,
+    read: (path) => readFileSync4(path, "utf8"),
     write(path, content, mode) {
-      mkdirSync3(dirname4(path), { recursive: true, mode: 493 });
+      mkdirSync4(dirname5(path), { recursive: true, mode: 493 });
       const temporary = `${path}.next.${process.pid}`;
-      writeFileSync3(temporary, content, { mode });
+      writeFileSync4(temporary, content, { mode });
       chmodSync2(temporary, mode);
-      renameSync3(temporary, path);
+      renameSync4(temporary, path);
     },
-    mkdir: (path, mode) => mkdirSync3(path, { recursive: true, mode }),
-    remove: (path) => rmSync3(path, { force: true }),
+    mkdir: (path, mode) => mkdirSync4(path, { recursive: true, mode }),
+    remove: (path) => rmSync4(path, { force: true }),
     inspect(path) {
       const value = lstatSync2(path);
       return { regular: value.isFile(), symbolic: value.isSymbolicLink(), uid: value.uid, mode: value.mode, links: value.nlink, size: value.size };
@@ -4227,7 +4268,7 @@ function localBootstrapHost() {
     async installAgent(config, enrolTokenSourcePath) {
       const capabilities = await readCapabilities(localRunner);
       const deployRoot = config.deployRoot ?? "/opt/forgezero";
-      const hasBinding = config.kind === "enrolled-compute" || Boolean(enrolTokenSourcePath) || existsSync3("/var/lib/forgezero/enrolment.json");
+      const hasBinding = config.kind === "enrolled-compute" || Boolean(enrolTokenSourcePath) || existsSync4("/var/lib/forgezero/enrolment.json");
       if (config.kind === "platform") {
         const lifecycle = config.database.role === "none" ? {
           apiUnits: ["forgezero@blue.service", "forgezero@green.service"],
@@ -4239,8 +4280,8 @@ function localBootstrapHost() {
           databaseHealthUrl: `http://${config.database.address}:8529/_api/version`,
           databasePorts: [8529]
         };
-        mkdirSync3(dirname4(LIFECYCLE_PROFILE), { recursive: true, mode: 493 });
-        writeFileSync3(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
+        mkdirSync4(dirname5(LIFECYCLE_PROFILE), { recursive: true, mode: 493 });
+        writeFileSync4(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
 `, { mode: 256 });
       }
       const plan = planInstall({
@@ -4281,8 +4322,8 @@ function localBootstrapHost() {
         } : {}
       });
       for (const unit of [{ path: plan.unitPath, unit: plan.unit }, ...plan.auxiliaryUnits]) {
-        mkdirSync3(dirname4(unit.path), { recursive: true, mode: 493 });
-        writeFileSync3(unit.path, unit.unit, { mode: 420 });
+        mkdirSync4(dirname5(unit.path), { recursive: true, mode: 493 });
+        writeFileSync4(unit.path, unit.unit, { mode: 420 });
       }
       await applyPlan(plan, localRunner);
       return plan;
@@ -4296,26 +4337,26 @@ import {
   chmodSync as chmodSync3,
   chownSync,
   copyFileSync as copyFileSync2,
-  existsSync as existsSync4,
+  existsSync as existsSync5,
   lstatSync as lstatSync3,
-  mkdirSync as mkdirSync5,
-  readFileSync as readFileSync4,
-  realpathSync as realpathSync3,
-  renameSync as renameSync4,
+  mkdirSync as mkdirSync6,
+  readFileSync as readFileSync5,
+  realpathSync as realpathSync4,
+  renameSync as renameSync5,
   statSync,
   symlinkSync as symlinkSync2,
   unlinkSync,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync6
 } from "fs";
-import { dirname as dirname6, isAbsolute as isAbsolute2, join as join5, resolve as resolve3 } from "path";
+import { dirname as dirname7, isAbsolute as isAbsolute2, join as join5, resolve as resolve4 } from "path";
 import { isIP as isIP5 } from "net";
 
 // src/metal-isolation.ts
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "fs";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "fs";
 import { join as join4 } from "path";
 
 // src/metal-provision.ts
-import { dirname as dirname5, isAbsolute, join as join3 } from "path";
+import { dirname as dirname6, isAbsolute, join as join3 } from "path";
 import { isIP as isIP4 } from "net";
 
 // src/ubuntu.ts
@@ -4503,16 +4544,16 @@ async function applyMetalIsolation(profile, exec = defaultExec) {
   validateMetalProfile(profile);
   await requireGuestsInSlice(exec);
   const unitDir = profile.unitDir;
-  mkdirSync4(unitDir, { recursive: true });
-  writeFileSync4(join4(unitDir, "forgezero-guests.slice"), metalGuestSliceUnit(profile), { mode: 420 });
+  mkdirSync5(unitDir, { recursive: true });
+  writeFileSync5(join4(unitDir, "forgezero-guests.slice"), metalGuestSliceUnit(profile), { mode: 420 });
   for (const unit of ["system.slice", "user.slice"]) {
     const directory = join4(unitDir, `${unit}.d`);
-    mkdirSync4(directory, { recursive: true });
-    writeFileSync4(join4(directory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "slice"), { mode: 420 });
+    mkdirSync5(directory, { recursive: true });
+    writeFileSync5(join4(directory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "slice"), { mode: 420 });
   }
   const initDirectory = join4(unitDir, "init.scope.d");
-  mkdirSync4(initDirectory, { recursive: true });
-  writeFileSync4(join4(initDirectory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "scope"), { mode: 420 });
+  mkdirSync5(initDirectory, { recursive: true });
+  writeFileSync5(join4(initDirectory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "scope"), { mode: 420 });
   await checked3(exec, ["systemctl", "daemon-reload"]);
   await requireGuestsInSlice(exec);
   const properties = [`AllowedCPUs=${profile.housekeepingCpus}`];
@@ -4631,7 +4672,7 @@ function validateMetalBootstrapConfig(config) {
     throw new MetalBootstrapError("metal bootstrap uses fixed state, seed, and systemd unit directories");
   }
   const image = config.profile.images[Object.keys(config.profile.images)[0]];
-  if (!image.path.startsWith("/var/lib/forgezero/images/") || resolve3(image.path) !== image.path || /[\0\r\n]/.test(image.path)) {
+  if (!image.path.startsWith("/var/lib/forgezero/images/") || resolve4(image.path) !== image.path || /[\0\r\n]/.test(image.path)) {
     throw new MetalBootstrapError("the pinned guest image must use the fixed image directory");
   }
   if (config.profile.bunVersion !== SUPPORTED_BUN_VERSION || config.profile.bunReleaseSha256 !== SUPPORTED_BUN_RELEASE_SHA256 || config.profile.agentVersion !== VERSION) {
@@ -4666,11 +4707,11 @@ function validateMetalBootstrapConfig(config) {
   return config;
 }
 function validateOwnerOnlyPath(path, requireRootOwner) {
-  if (!isAbsolute2(path) || resolve3(path) !== path || path.includes("/../")) {
+  if (!isAbsolute2(path) || resolve4(path) !== path || path.includes("/../")) {
     throw new MetalBootstrapError("private bootstrap paths must be canonical absolute paths");
   }
   const metadata = lstatSync3(path);
-  if (!metadata.isFile() || metadata.isSymbolicLink() || realpathSync3(path) !== path) {
+  if (!metadata.isFile() || metadata.isSymbolicLink() || realpathSync4(path) !== path) {
     throw new MetalBootstrapError("private bootstrap path must be a regular non-symlink file");
   }
   if ((metadata.mode & 63) !== 0)
@@ -4687,7 +4728,7 @@ function readMetalBootstrapConfig(path) {
     throw new MetalBootstrapError("metal bootstrap config size is invalid");
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync4(path, "utf8"));
+    parsed = JSON.parse(readFileSync5(path, "utf8"));
   } catch {
     throw new MetalBootstrapError("metal bootstrap config is not valid JSON");
   }
@@ -4720,12 +4761,12 @@ function planMetalBootstrap(config) {
   };
 }
 var atomicWrite = (path, body, mode) => {
-  mkdirSync5(dirname6(path), { recursive: true, mode: 493 });
+  mkdirSync6(dirname7(path), { recursive: true, mode: 493 });
   const temporary = `${path}.next-${process.pid}`;
-  writeFileSync5(temporary, body, { mode, flag: "wx" });
+  writeFileSync6(temporary, body, { mode, flag: "wx" });
   chmodSync3(temporary, mode);
   chownSync(temporary, 0, 0);
-  renameSync4(temporary, path);
+  renameSync5(temporary, path);
 };
 var validateAgentSourcePath = (source) => {
   if (!isAbsolute2(source) || !lstatSync3(source).isFile() || lstatSync3(source).isSymbolicLink()) {
@@ -4892,11 +4933,11 @@ WantedBy=multi-user.target
 var installAgentBinary = (source, version) => {
   validateAgentSourcePath(source);
   const release = `/opt/forgezero/agent/versions/${version}/dist`;
-  mkdirSync5(release, { recursive: true, mode: 493 });
+  mkdirSync6(release, { recursive: true, mode: 493 });
   copyFileSync2(source, join5(release, "fz-agent.js"));
   chmodSync3(join5(release, "fz-agent.js"), 493);
   chownSync(join5(release, "fz-agent.js"), 0, 0);
-  mkdirSync5("/opt/forgezero/agent", { recursive: true, mode: 493 });
+  mkdirSync6("/opt/forgezero/agent", { recursive: true, mode: 493 });
   for (const [link, target] of [
     ["/opt/forgezero/agent/current.next", `versions/${version}`],
     [AGENT_PATH, "/opt/forgezero/agent/current/dist/fz-agent.js"]
@@ -4906,7 +4947,7 @@ var installAgentBinary = (source, version) => {
     } catch {}
     symlinkSync2(target, link);
     if (link.endsWith("current.next"))
-      renameSync4(link, "/opt/forgezero/agent/current");
+      renameSync5(link, "/opt/forgezero/agent/current");
   }
 };
 var preflight = async (config, exec) => {
@@ -4928,10 +4969,10 @@ var preflight = async (config, exec) => {
   ]);
   await runChecked(exec, ["/usr/sbin/vgs", config.profile.volumeGroup]);
   await runChecked(exec, ["/usr/sbin/ip", "link", "show", config.profile.bridge]);
-  if (!existsSync4("/dev/kvm"))
+  if (!existsSync5("/dev/kvm"))
     throw new MetalBootstrapError("/dev/kvm is required");
   if (config.profile.confidential) {
-    if (!existsSync4("/dev/sev"))
+    if (!existsSync5("/dev/sev"))
       throw new MetalBootstrapError("/dev/sev is required by the confidential profile");
     await runChecked(exec, ["/usr/bin/qemu-system-x86_64", "-object", "sev-snp-guest,help"]);
   }
@@ -4943,16 +4984,16 @@ var assertSupportedMetalHost = () => {
   if (process.platform !== "linux" || process.arch !== "x64") {
     throw new MetalBootstrapError("metal bootstrap supports only Ubuntu 26.04 x86_64 hosts");
   }
-  const release = readFileSync4("/etc/os-release", "utf8");
+  const release = readFileSync5("/etc/os-release", "utf8");
   if (!/^ID=ubuntu$/m.test(release) || !/^VERSION_ID="?26\.04"?$/m.test(release)) {
     throw new MetalBootstrapError("metal bootstrap supports only Ubuntu 26.04 x86_64 hosts");
   }
 };
 var ensurePinnedGuestImage = async (config, exec) => {
   const image = config.profile.images[SUPPORTED_GUEST_IMAGE.key];
-  if (existsSync4(image.path))
+  if (existsSync5(image.path))
     return;
-  mkdirSync5(dirname6(image.path), { recursive: true, mode: 493 });
+  mkdirSync6(dirname7(image.path), { recursive: true, mode: 493 });
   const temporary = `${image.path}.next-${process.pid}`;
   try {
     await runChecked(exec, [
@@ -4971,7 +5012,7 @@ var ensurePinnedGuestImage = async (config, exec) => {
       throw new MetalBootstrapError("downloaded guest image digest mismatch");
     chmodSync3(temporary, 292);
     chownSync(temporary, 0, 0);
-    renameSync4(temporary, image.path);
+    renameSync5(temporary, image.path);
   } catch (cause) {
     try {
       unlinkSync(temporary);
@@ -4984,11 +5025,11 @@ async function applyMetalBootstrap(config, options) {
   if ((options.getuid ?? process.getuid)?.() !== 0)
     throw new MetalBootstrapError("fz bootstrap metal --apply must run as root");
   assertSupportedMetalHost();
-  if (existsSync4(STATE_PATH2) && !options.repair)
+  if (existsSync5(STATE_PATH2) && !options.repair)
     throw new MetalBootstrapError("metal host is already initialized; use explicit repair");
   if (config.agentSeedFile)
     validateOwnerOnlyPath(config.agentSeedFile, true);
-  if (config.agentSeedFile && existsSync4(SEED_CREDENTIAL_PATH)) {
+  if (config.agentSeedFile && existsSync5(SEED_CREDENTIAL_PATH)) {
     throw new MetalBootstrapError("repair refuses replacement seed material while the sealed metal identity exists");
   }
   validateAgentSourcePath(options.agentSourcePath);
@@ -5015,9 +5056,9 @@ async function applyMetalBootstrap(config, options) {
   await preflight(config, exec);
   await ensureAccount(exec);
   installAgentBinary(options.agentSourcePath, config.profile.agentVersion);
-  mkdirSync5("/etc/forgezero/creds", { recursive: true, mode: 448 });
-  mkdirSync5(config.profile.stateDir, { recursive: true, mode: 448 });
-  mkdirSync5(config.profile.seedDir, { recursive: true, mode: 448 });
+  mkdirSync6("/etc/forgezero/creds", { recursive: true, mode: 448 });
+  mkdirSync6(config.profile.stateDir, { recursive: true, mode: 448 });
+  mkdirSync6(config.profile.seedDir, { recursive: true, mode: 448 });
   const persistedProfile = {
     ...config.profile,
     metalHostname: config.metalHostname,
@@ -5026,8 +5067,8 @@ async function applyMetalBootstrap(config, options) {
   };
   atomicWrite(PROFILE_PATH, `${JSON.stringify(persistedProfile, null, 2)}
 `, 384);
-  if (!existsSync4(SEED_CREDENTIAL_PATH)) {
-    const seed = config.agentSeedFile ? readFileSync4(config.agentSeedFile, "utf8").trim() : randomBytes4(32).toString("base64url");
+  if (!existsSync5(SEED_CREDENTIAL_PATH)) {
+    const seed = config.agentSeedFile ? readFileSync5(config.agentSeedFile, "utf8").trim() : randomBytes4(32).toString("base64url");
     if (seed.length < 32 || /[\0\r\n]/.test(seed))
       throw new MetalBootstrapError("metal Agent seed is invalid");
     await runChecked(exec, ["/usr/bin/systemd-creds", "encrypt", "--name=metal-agent-seed", "-", SEED_CREDENTIAL_PATH], `${seed}
@@ -5098,13 +5139,13 @@ async function metalBootstrapStatus(exec = defaultExec2) {
   const problems = [];
   let profileValid = false, imageVerified = false, metalHostname, profileSha256;
   let profileMode = null;
-  if (existsSync4(PROFILE_PATH)) {
+  if (existsSync5(PROFILE_PATH)) {
     try {
       const metadata = statSync(PROFILE_PATH);
       profileMode = metadata.mode & 511;
       if (profileMode !== 384 || metadata.uid !== 0)
         problems.push("metal profile is not root-owned mode 0600");
-      const persisted = JSON.parse(readFileSync4(PROFILE_PATH, "utf8"));
+      const persisted = JSON.parse(readFileSync5(PROFILE_PATH, "utf8"));
       const { metalHostname: profileHostname, hostTelemetryEndpoint, hostTelemetryUnit, ...profile } = persisted;
       validateMetalProfile(profile);
       profileValid = true;
@@ -5137,7 +5178,7 @@ async function metalBootstrapStatus(exec = defaultExec2) {
         problems.push("local OTLP metrics receiver did not accept a proof request");
       }
       const image = profile.images[Object.keys(profile.images)[0]];
-      if (existsSync4(image.path)) {
+      if (existsSync5(image.path)) {
         const digest = (await exec(["/usr/bin/sha256sum", image.path])).stdout.split(/\s+/)[0];
         imageVerified = digest === image.sha256;
       }
@@ -5148,9 +5189,9 @@ async function metalBootstrapStatus(exec = defaultExec2) {
     }
   } else
     problems.push("metal profile is missing");
-  if (existsSync4(STATE_PATH2)) {
+  if (existsSync5(STATE_PATH2)) {
     try {
-      const state = JSON.parse(readFileSync4(STATE_PATH2, "utf8"));
+      const state = JSON.parse(readFileSync5(STATE_PATH2, "utf8"));
       metalHostname = state.metalHostname;
       if (state.role !== "metal" || !metalHostname || state.profileSha256 !== profileSha256) {
         problems.push("metal initialized state does not bind the current profile");
@@ -5166,7 +5207,7 @@ async function metalBootstrapStatus(exec = defaultExec2) {
     "forgezero-metal-agent-egress.service",
     "forgezero-metal-agent.service"
   ]) {
-    if (!existsSync4(join5(UNIT_DIRECTORY, unit)))
+    if (!existsSync5(join5(UNIT_DIRECTORY, unit)))
       units[unit] = "missing";
     else
       units[unit] = (await exec(["/usr/bin/systemctl", "is-active", "--quiet", unit])).exitCode === 0 ? "active" : "inactive";
@@ -5180,7 +5221,7 @@ async function metalBootstrapStatus(exec = defaultExec2) {
   if (!updateSocketReady)
     problems.push("Agent update helper socket is not ready");
   return {
-    initialized: existsSync4(STATE_PATH2),
+    initialized: existsSync5(STATE_PATH2),
     profileValid,
     profileMode,
     imageVerified,
@@ -5194,7 +5235,7 @@ async function metalBootstrapStatus(exec = defaultExec2) {
 
 // src/operator-bootstrap.ts
 import { createHash as createHash3, randomBytes as randomBytes5 } from "crypto";
-import { lstatSync as lstatSync4, mkdtempSync, readFileSync as readFileSync5, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
+import { lstatSync as lstatSync4, mkdtempSync, readFileSync as readFileSync6, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "fs";
 import { isIP as isIP6 } from "net";
 import { tmpdir } from "os";
 import { basename, join as join6 } from "path";
@@ -5293,7 +5334,7 @@ var ownerFile = (path, limit, label) => {
   if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.uid !== uid || metadata.nlink !== 1 || (metadata.mode & 63) !== 0 || metadata.size < 1 || metadata.size > limit) {
     throw new Error(`${label} must be an owner-only regular file with one link and at most ${limit} bytes`);
   }
-  return readFileSync5(path);
+  return readFileSync6(path);
 };
 var publicIdentity = (path) => {
   if (!path.startsWith("/") || /[\r\n]/.test(path))
@@ -5303,7 +5344,7 @@ var publicIdentity = (path) => {
   if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.uid !== uid || metadata.nlink !== 1 || metadata.size > 16384) {
     throw new Error("SSH public key must be a caller-owned regular file with one link");
   }
-  const value = readFileSync5(path, "utf8").trim();
+  const value = readFileSync6(path, "utf8").trim();
   if (!/^ssh-(?:ed25519|rsa) [A-Za-z0-9+/]+={0,3}(?: [^\r\n]+)?$/.test(value)) {
     throw new Error("SSH public key is malformed");
   }
@@ -5507,7 +5548,7 @@ function writeKnownHosts(request, directory) {
   if (request.target.jump)
     lines.push(`${hostLabel(request.target.jump.address, request.target.jump.port)} ${request.target.jump.hostKey}`);
   const path = join6(directory, "known_hosts");
-  writeFileSync6(path, `${lines.join(`
+  writeFileSync7(path, `${lines.join(`
 `)}
 `, { mode: 384, flag: "wx" });
   return path;
@@ -5582,7 +5623,7 @@ function stageConfig(config, directory) {
   for (const [name, source] of secretSources(config)) {
     const bytes = ownerFile(source, SECRET_LIMIT, name);
     const local = join6(directory, name);
-    writeFileSync6(local, bytes, { mode: 384, flag: "wx" });
+    writeFileSync7(local, bytes, { mode: 384, flag: "wx" });
     staged.push(name);
     const remotePath = `${REMOTE_STAGE}/${name}`;
     if (name === "cluster-code")
@@ -5597,7 +5638,7 @@ function stageConfig(config, directory) {
       rewritten.cloudflareHandoff.handoffFile = remotePath;
   }
   const path = join6(directory, "platform-config.json");
-  writeFileSync6(path, `${JSON.stringify(rewritten, null, 2)}
+  writeFileSync7(path, `${JSON.stringify(rewritten, null, 2)}
 `, { mode: 384, flag: "wx" });
   return { path, files: staged };
 }
@@ -5606,7 +5647,7 @@ function stageMetalConfig(config, directory) {
   const files = [];
   if (config.agentSeedFile) {
     const name = "metal-agent-seed";
-    writeFileSync6(join6(directory, name), ownerFile(config.agentSeedFile, SECRET_LIMIT, name), {
+    writeFileSync7(join6(directory, name), ownerFile(config.agentSeedFile, SECRET_LIMIT, name), {
       mode: 384,
       flag: "wx"
     });
@@ -5614,7 +5655,7 @@ function stageMetalConfig(config, directory) {
     files.push(name);
   }
   const path = join6(directory, "metal-config.json");
-  writeFileSync6(path, `${JSON.stringify(rewritten, null, 2)}
+  writeFileSync7(path, `${JSON.stringify(rewritten, null, 2)}
 `, { mode: 384, flag: "wx" });
   return { path, files };
 }
@@ -5626,7 +5667,7 @@ async function verifiedBunArchive(directory, fetcher) {
   if (createHash3("sha256").update(bytes).digest("hex") !== BUN_RELEASE_SHA256)
     throw new Error("pinned Bun checksum mismatch");
   const path = join6(directory, "bun.zip");
-  writeFileSync6(path, bytes, { mode: 384, flag: "wx" });
+  writeFileSync7(path, bytes, { mode: 384, flag: "wx" });
   return path;
 }
 async function installPackagedAgent(request, knownHosts, exec, directory, remoteTemp, options) {
@@ -5636,7 +5677,7 @@ async function installPackagedAgent(request, knownHosts, exec, directory, remote
     [options.fzGitSshPath ?? fileURLToPath2(new URL("./fz-git-ssh.js", import.meta.url)), "fz-git-ssh.js"]
   ];
   for (const [artifact] of artifacts) {
-    if (!readFileSync5(artifact).length)
+    if (!readFileSync6(artifact).length)
       throw new Error(`packaged artifact is empty: ${basename(artifact)}`);
   }
   await remote(exec, request, knownHosts, ["/usr/bin/mkdir", "-m", "0700", remoteTemp], "remote staging");
@@ -5707,7 +5748,7 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
         return;
       });
     }
-    rmSync4(directory, { recursive: true, force: true });
+    rmSync5(directory, { recursive: true, force: true });
   }
 }
 async function applyOperatorMetalBootstrap(request, mode, options = {}) {
@@ -5759,7 +5800,7 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
         return;
       });
     }
-    rmSync4(directory, { recursive: true, force: true });
+    rmSync5(directory, { recursive: true, force: true });
   }
 }
 export {