@forgezero/agent 0.1.58 → 0.1.60

package/dist/platform-bootstrap-runtime.d.ts

@@ -68,7 +68,7 @@ export declare function validatePlatformSharedEnvironment(input: PlatformSharedE
 /** Render only non-secret runtime coordinates. Passwords/tokens have no field in this contract. */
 export declare function renderPlatformSharedEnvironment(input: PlatformSharedEnvironment): string;
 export interface SystemdCredentialSpec {
-    name: 'arangodb-jwt' | 'seed-sync-root' | 'bootstrap-smtp-password' | 'bootstrap-jetemail-api-key' | 'CF_API_TOKEN' | 'REALTIME_PUBLISH_SECRET' | 'REALTIME_TICKET_SECRET';
+    name: 'arangodb-jwt' | 'seed-sync-root' | 'fz_smtp.password' | 'fz_jetemail.apiKey' | 'CF_API_TOKEN' | 'CF_TUNNEL_TOKEN' | 'REALTIME_PUBLISH_SECRET' | 'REALTIME_TICKET_SECRET';
     encryptedPath: string;
     required: boolean;
 }

package/dist/platform-bootstrap-runtime.js

@@ -212,9 +212,10 @@ function renderPlatformSharedEnvironment(input) {
 }
 function platformApiCredentialSpecs(options) {
   const optional = [
-    ["bootstrap-smtp-password", options.emailProvider === "smtp"],
-    ["bootstrap-jetemail-api-key", options.emailProvider === "jetemail"],
+    ["fz_smtp.password", options.emailProvider === "smtp"],
+    ["fz_jetemail.apiKey", options.emailProvider === "jetemail"],
     ["CF_API_TOKEN", options.cloudflareKv],
+    ["CF_TUNNEL_TOKEN", options.cloudflareKv],
     ["REALTIME_PUBLISH_SECRET", options.realtime],
     ["REALTIME_TICKET_SECRET", options.realtime]
   ];

package/dist/platform-fleet-verification.js

@@ -2086,7 +2086,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.58";
+var VERSION3 = "0.1.60";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -2886,10 +2886,11 @@ function planProvision(options) {
   const warpEnabled = warpValues.every(Boolean);
   if (warpValues.some(Boolean) && !warpEnabled)
     throw new Error("WARP configuration must be supplied together");
-  const enrolmentEnabled = Boolean(options.enrolTokenSourcePath && options.enrolTokenCredentialPath && options.enrolStatePath);
-  if (Boolean(options.enrolTokenSourcePath) !== Boolean(options.enrolTokenCredentialPath) || Boolean(options.enrolTokenCredentialPath) !== Boolean(options.enrolStatePath))
-    throw new Error("direct enrolment paths must be supplied together");
-  const enrolTokenSourcePath = enrolmentEnabled ? systemdPath(options.enrolTokenSourcePath, "enrolment source") : undefined;
+  const enrolmentEnabled = Boolean(options.enrolTokenCredentialPath && options.enrolStatePath);
+  if (Boolean(options.enrolTokenCredentialPath) !== Boolean(options.enrolStatePath) || options.enrolTokenSourcePath && !enrolmentEnabled) {
+    throw new Error("direct enrolment credential and state paths must be supplied together");
+  }
+  const enrolTokenSourcePath = options.enrolTokenSourcePath ? systemdPath(options.enrolTokenSourcePath, "enrolment source") : undefined;
   const enrolTokenCredentialPath = enrolmentEnabled ? systemdPath(options.enrolTokenCredentialPath, "enrolment credential") : undefined;
   const enrolStatePath = enrolmentEnabled ? systemdPath(options.enrolStatePath, "enrolment state") : undefined;
   const enrolStateDir = enrolStatePath?.replace(/\/[^/]+$/, "");
@@ -3017,7 +3018,12 @@ function planProvision(options) {
       ] : [],
       ...enrolmentEnabled ? [
         step("enrolment state directory", { kind: "directories", directories: [{ path: enrolStateDir, mode: 448, owner: user, group: user }] }),
-        step("encrypted one-time enrolment capability", { kind: "ensure-enrolment", state: enrolStatePath, source: enrolTokenSourcePath, credential: enrolTokenCredentialPath })
+        ...enrolTokenSourcePath ? [step("encrypted one-time enrolment capability", {
+          kind: "ensure-enrolment",
+          state: enrolStatePath,
+          source: enrolTokenSourcePath,
+          credential: enrolTokenCredentialPath
+        })] : []
       ] : [],
       ...deploymentEnabled ? [step("deployment directories", { kind: "directories", directories: [
         { path: deployRoot, mode: 493, owner: "root", group: "root" },
@@ -3274,9 +3280,10 @@ function renderPlatformSharedEnvironment(input) {
 }
 function platformApiCredentialSpecs(options) {
   const optional = [
-    ["bootstrap-smtp-password", options.emailProvider === "smtp"],
-    ["bootstrap-jetemail-api-key", options.emailProvider === "jetemail"],
+    ["fz_smtp.password", options.emailProvider === "smtp"],
+    ["fz_jetemail.apiKey", options.emailProvider === "jetemail"],
     ["CF_API_TOKEN", options.cloudflareKv],
+    ["CF_TUNNEL_TOKEN", options.cloudflareKv],
     ["REALTIME_PUBLISH_SECRET", options.realtime],
     ["REALTIME_TICKET_SECRET", options.realtime]
   ];
@@ -3588,7 +3595,7 @@ function planLocalOtlpProof(endpoint, collectorUnit) {
 import { lstatSync as lstatSync4 } from "node:fs";
 
 // src/bootstrap.ts
-import { createHash as createHash5, createHmac, randomBytes as randomBytes3 } from "node:crypto";
+import { createHash as createHash5, createHmac as createHmac2, randomBytes as randomBytes2 } from "node:crypto";
 import {
   chmodSync as chmodSync7,
   existsSync as existsSync9,
@@ -3897,7 +3904,7 @@ async function applyPlan(plan, run2) {
 
 // src/cloudflare-bootstrap.ts
 import { constants } from "node:fs";
-import { randomBytes as randomBytes2, randomUUID as randomUUID3 } from "node:crypto";
+import { createHmac, randomUUID as randomUUID3 } from "node:crypto";
 import { chmod, lstat, mkdir, open, readdir, rename, rmdir, stat, unlink } from "node:fs/promises";
 import { dirname as dirname7, join as join6, resolve as resolve5 } from "node:path";
 import { isIP as isIP3 } from "node:net";
@@ -3919,6 +3926,7 @@ var JWT_CREDENTIAL = `${CREDS}/arangodb-jwt.cred`;
 var ENROL_CREDENTIAL = `${CREDS}/enrol-token.cred`;
 var TUNNEL_CREDENTIAL = `${CREDS}/CF_TUNNEL_CONNECTOR_TOKEN.cred`;
 var CF_API_CREDENTIAL = `${CREDS}/CF_API_TOKEN.cred`;
+var CF_TUNNEL_API_CREDENTIAL = `${CREDS}/CF_TUNNEL_TOKEN.cred`;
 var WARP_CONNECTOR_CREDENTIAL = `${CREDS}/CF_WARP_CONNECTOR_TOKEN.cred`;
 var REALTIME_PUBLISH_CREDENTIAL = `${CREDS}/REALTIME_PUBLISH_SECRET.cred`;
 var REALTIME_TICKET_CREDENTIAL = `${CREDS}/REALTIME_TICKET_SECRET.cred`;
@@ -4149,10 +4157,10 @@ function localBootstrapHost() {
         throw new Error(`Agent software requirements failed: ${result.output.trim()}`);
       return result;
     },
-    async installAgent(config, enrolTokenSourcePath) {
+    async installAgent(config) {
       const capabilities = await readCapabilities(localRunner);
       const deployRoot = config.deployRoot ?? "/opt/forgezero";
-      const hasBinding = config.kind === "enrolled-compute" || Boolean(enrolTokenSourcePath) || existsSync9("/var/lib/forgezero/enrolment.json");
+      const hasBinding = config.kind === "enrolled-compute" || existsSync9(ENROL_CREDENTIAL) || existsSync9("/var/lib/forgezero/enrolment.json");
       if (config.kind === "platform") {
         const lifecycle = config.database.role === "none" ? {
           apiUnits: ["forgezero@blue.service", "forgezero@green.service"],
@@ -4195,8 +4203,7 @@ function localBootstrapHost() {
         telemetryEndpoint: config.telemetryEndpoint,
         binPath: "/usr/local/lib/forgezero/agent/fz-agent",
         sourceBinPath: PACKAGED_AGENT_BIN,
-        ...config.kind === "enrolled-compute" || enrolTokenSourcePath ? {
-          enrolTokenSourcePath: config.kind === "enrolled-compute" ? config.enrolTokenFile : enrolTokenSourcePath,
+        ...hasBinding ? {
           enrolTokenCredentialPath: ENROL_CREDENTIAL,
           enrolStatePath: "/var/lib/forgezero/enrolment.json",
           apiUrl: config.apiUrl,

package/dist/platform-genesis.d.ts

@@ -24,3 +24,5 @@ export declare const DEVELOPMENT_COMMUNITY_REHEARSAL_GUEST: PlatformGenesisGuest
 export declare function platformGenesisClaims(environment: PlatformGenesisEnvironment, sshPublicKeys: readonly string[]): readonly RemoteProvisionClaim[];
 /** Exact disposable four-host development fleet: three seed guests plus n4. */
 export declare function platformCommunityRehearsalClaims(sshPublicKeys: readonly string[]): readonly RemoteProvisionClaim[];
+/** Exact inverse of the disposable four-host rehearsal claims. */
+export declare function platformCommunityRehearsalDeletionClaims(sshPublicKeys: readonly string[]): readonly RemoteProvisionClaim[];

package/dist/provision.js

@@ -2086,7 +2086,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.58";
+var VERSION3 = "0.1.60";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -2886,10 +2886,11 @@ function planProvision(options) {
   const warpEnabled = warpValues.every(Boolean);
   if (warpValues.some(Boolean) && !warpEnabled)
     throw new Error("WARP configuration must be supplied together");
-  const enrolmentEnabled = Boolean(options.enrolTokenSourcePath && options.enrolTokenCredentialPath && options.enrolStatePath);
-  if (Boolean(options.enrolTokenSourcePath) !== Boolean(options.enrolTokenCredentialPath) || Boolean(options.enrolTokenCredentialPath) !== Boolean(options.enrolStatePath))
-    throw new Error("direct enrolment paths must be supplied together");
-  const enrolTokenSourcePath = enrolmentEnabled ? systemdPath(options.enrolTokenSourcePath, "enrolment source") : undefined;
+  const enrolmentEnabled = Boolean(options.enrolTokenCredentialPath && options.enrolStatePath);
+  if (Boolean(options.enrolTokenCredentialPath) !== Boolean(options.enrolStatePath) || options.enrolTokenSourcePath && !enrolmentEnabled) {
+    throw new Error("direct enrolment credential and state paths must be supplied together");
+  }
+  const enrolTokenSourcePath = options.enrolTokenSourcePath ? systemdPath(options.enrolTokenSourcePath, "enrolment source") : undefined;
   const enrolTokenCredentialPath = enrolmentEnabled ? systemdPath(options.enrolTokenCredentialPath, "enrolment credential") : undefined;
   const enrolStatePath = enrolmentEnabled ? systemdPath(options.enrolStatePath, "enrolment state") : undefined;
   const enrolStateDir = enrolStatePath?.replace(/\/[^/]+$/, "");
@@ -3017,7 +3018,12 @@ function planProvision(options) {
       ] : [],
       ...enrolmentEnabled ? [
         step("enrolment state directory", { kind: "directories", directories: [{ path: enrolStateDir, mode: 448, owner: user, group: user }] }),
-        step("encrypted one-time enrolment capability", { kind: "ensure-enrolment", state: enrolStatePath, source: enrolTokenSourcePath, credential: enrolTokenCredentialPath })
+        ...enrolTokenSourcePath ? [step("encrypted one-time enrolment capability", {
+          kind: "ensure-enrolment",
+          state: enrolStatePath,
+          source: enrolTokenSourcePath,
+          credential: enrolTokenCredentialPath
+        })] : []
       ] : [],
       ...deploymentEnabled ? [step("deployment directories", { kind: "directories", directories: [
         { path: deployRoot, mode: 493, owner: "root", group: "root" },

package/dist/recovery-host.js

@@ -63,7 +63,7 @@ async function runRecoveryHost(args, run = execute) {
     nonEmpty("/etc/forgezero/creds/arangodb-jwt.cred");
     const hasDatabase = role !== "none";
     if (hasDatabase) {
-      nonEmpty("/etc/forgezero/creds/backup-s3-secret.cred");
+      nonEmpty("/etc/forgezero/creds/backup.s3.secretAccessKey.cred");
       nonEmpty("/etc/forgezero/creds/backup-recovery-root.cred");
     }
     const slot = activeSlot();
@@ -110,7 +110,7 @@ async function runRecoveryHost(args, run = execute) {
       "--property=LoadCredentialEncrypted=arangodb-jwt:/etc/forgezero/creds/arangodb-jwt.cred",
       ...args.includes("--fleet-fenced") ? ["--property=Environment=FZ_RECOVERY_FLEET_FENCED=all-api-and-scheduler-replicas-are-stopped"] : [],
       ...args.includes("--backup-credentials") ? [
-        "--property=LoadCredentialEncrypted=backup-s3-secret:/etc/forgezero/creds/backup-s3-secret.cred",
+        "--property=LoadCredentialEncrypted=backup.s3.secretAccessKey:/etc/forgezero/creds/backup.s3.secretAccessKey.cred",
         "--property=LoadCredentialEncrypted=backup-recovery-root:/etc/forgezero/creds/backup-recovery-root.cred"
       ] : []
     ];

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.58";
+export declare const VERSION = "0.1.60";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.58",
+  "version": "0.1.60",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",