@forgezero/agent 0.1.59 → 0.1.61

package/README.md

@@ -302,7 +302,7 @@ import type { OperatorPlatformBootstrapOptions, OperatorPlatformBootstrapPlan, O
 
 ## @forgezero/agent/operator-bootstrap — Run the same typed platform bootstrap from an operator laptop
 
-The request contains only an explicit target IP, pinned host public key/fingerprint, the caller public-key file, SSH-agent socket and a path to the reviewed platform config. Credential values stay in owner-only files, the private SSH key stays in the operator agent, and the default command is a non-contacting plan.
+The request contains only an explicit target IP, pinned host public key/fingerprint, the caller public-key file, SSH-agent socket and a path to the reviewed secret-free platform config. Credential values come from hidden prompts or authenticated SSH stdin and are sealed immediately as systemd credentials; the private SSH key stays in the operator agent, and the default command is a non-contacting plan.
 
 ```text
 fz bootstrap platform remote prepare \

package/dist/agent-heartbeat.js

@@ -749,7 +749,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.59";
+var VERSION3 = "0.1.61";
 
 // src/agent-heartbeat.ts
 var unquote = (value) => value.replace(/^['"]|['"]$/g, "");

package/dist/bootstrap.js

@@ -1240,7 +1240,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.59";
+var VERSION = "0.1.61";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/fz-agent.js

@@ -8448,7 +8448,7 @@ function assertSupportedGuestImage(imageKey) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.59";
+var VERSION2 = "0.1.61";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4829,7 +4829,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.59";
+var VERSION2 = "0.1.61";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -15586,6 +15586,17 @@ function platformCommunityRehearsalClaims(sshPublicKeys) {
     }
   }];
 }
+function platformCommunityRehearsalDeletionClaims(sshPublicKeys) {
+  return platformCommunityRehearsalClaims(sshPublicKeys).map((claim) => ({
+    computeKey: claim.computeKey,
+    claimToken: claim.claimToken,
+    claimExpiresAtTs: claim.claimExpiresAtTs,
+    attempt: claim.attempt,
+    action: "delete",
+    bootstrap: { kind: "platform-genesis" },
+    spec: claim.spec
+  }));
+}
 
 // src/operator-bootstrap.ts
 var REQUEST_LIMIT = 64 * 1024;
@@ -15739,17 +15750,17 @@ function readOperatorMetalBootstrapRequest(path) {
 }
 function planOperatorMetalBootstrap(request, mode) {
   const config = readMetalBootstrapConfig(request.metalConfigFile);
-  if (mode === "rehearsal" && request.genesis.environment !== "development") {
+  if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && request.genesis.environment !== "development") {
     throw new Error("the disposable four-node Community rehearsal is development-only");
   }
   const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
-  const claims = mode === "rehearsal" ? platformCommunityRehearsalClaims(keys) : platformGenesisClaims(request.genesis.environment, keys);
+  const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(keys) : platformCommunityRehearsalClaims(keys) : platformGenesisClaims(request.genesis.environment, keys);
   return {
     kind: "metal-remote",
     mode,
     mutation: mode !== "status",
     target: { address: request.target.address, port: request.target.port, user: request.target.user },
-    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "genesis" || mode === "rehearsal" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the fixed three-node seed plus ordinary n4 Community rehearsal claim to the constrained Metal helper" : "send three fixed platform-genesis claims to the constrained Metal helper"] : [
+    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the fixed three-node seed plus ordinary n4 Community rehearsal claim to the constrained Metal helper" : mode === "rehearsal-cleanup" ? "delete the exact disposable dev-fz-n1..n4 guests and their owned disks, units, seed data and inventory" : "send three fixed platform-genesis claims to the constrained Metal helper"] : [
       "verify pinned SSH transport and caller-approved SSH agent",
       "copy pinned Bun and packaged fz artifacts to private staging",
       "stage the strict owner-only metal config and optional seed handoff",
@@ -16043,10 +16054,10 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
       const output2 = await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "status"], "remote metal status");
       return { plan, output: output2 };
     }
-    if (mode === "genesis" || mode === "rehearsal") {
+    if (mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup") {
       const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
       const outputs = [];
-      const claims = mode === "rehearsal" ? platformCommunityRehearsalClaims(keys) : platformGenesisClaims(request.genesis.environment, keys);
+      const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(keys) : platformCommunityRehearsalClaims(keys) : platformGenesisClaims(request.genesis.environment, keys);
       for (const claim of claims) {
         outputs.push(await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/local/bin/fz-agent", "metal-apply", "--claim=-"], `provision ${claim.spec.guestName}`, false, `${JSON.stringify(claim)}
 `));
@@ -17488,8 +17499,8 @@ async function cmdBootstrap(options, args) {
     }
     if (operation === "metal" && args[1] === "remote") {
       const mode = args[2];
-      if (!mode || !["apply", "genesis", "rehearsal", "status"].includes(mode) || args[3] !== undefined) {
-        throw new Error("Usage: fz bootstrap metal remote <apply|genesis|rehearsal|status> --bootstrap-config <owner-only-request.json> [--apply]");
+      if (!mode || !["apply", "genesis", "rehearsal", "rehearsal-cleanup", "status"].includes(mode) || args[3] !== undefined) {
+        throw new Error("Usage: fz bootstrap metal remote <apply|genesis|rehearsal|rehearsal-cleanup|status> --bootstrap-config <owner-only-request.json> [--apply]");
       }
       if (!options.bootstrapConfigPath)
         throw new Error("remote metal bootstrap requires --bootstrap-config");
@@ -17607,7 +17618,7 @@ async function cmdBootstrap(options, args) {
       return 0;
     }
     if (!["platform", "repair"].includes(operation)) {
-      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [prepare|remote <prepare|apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|rehearsal|status>]|status|repair [--bootstrap-config <path>] [--apply]");
+      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [prepare|remote <prepare|apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|rehearsal|rehearsal-cleanup|status>]|status|repair [--bootstrap-config <path>] [--apply]");
     }
     const config = options.bootstrapConfigPath ? readBootstrapConfig(options.bootstrapConfigPath) : operation === "repair" ? (() => {
       throw new Error("repair requires --bootstrap-config so immutable coordinates are revalidated");
@@ -18199,7 +18210,7 @@ function usage() {
 	                         Persist secret-free public-node acceptance, then remove
 	                         the completed non-secret checkpoint and node handoffs
 	 fz bootstrap metal      Plan/install an identity-only physical provisioner
-	 fz bootstrap metal remote <apply|genesis|rehearsal|status>
+	 fz bootstrap metal remote <apply|genesis|rehearsal|rehearsal-cleanup|status>
 	                         Install/bootstrap one pinned blank metal target, then
 	                         provision the exact selected three-node genesis seed
 	 fz bootstrap status     Verify persisted profile and supervised units
@@ -18264,7 +18275,8 @@ function usage() {
     --json                  Machine-readable output
     --apply                 Apply the reviewed operation instead of planning it
 	 --bootstrap-config <p>  Private JSON coordinates for unattended bootstrap;
-	                           secret values remain in separate owner-only files
+	                           secrets come from hidden prompts or authenticated stdin
+	                           and are sealed immediately as systemd credentials
 	 --output <path>         Canonical absolute destination for generated bootstrap config
     --root <path>           Project root for project/deploy commands
     --name <name>           Project or deploy name during init

package/dist/metal-bootstrap.js

@@ -292,7 +292,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.59";
+var VERSION = "0.1.61";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.d.ts

@@ -26,7 +26,7 @@ export interface OperatorMetalBootstrapRequest {
     };
 }
 export type OperatorPlatformBootstrapMode = 'prepare' | 'apply' | 'status';
-export type OperatorMetalBootstrapMode = 'apply' | 'genesis' | 'rehearsal' | 'status';
+export type OperatorMetalBootstrapMode = 'apply' | 'genesis' | 'rehearsal' | 'rehearsal-cleanup' | 'status';
 export interface OperatorPlatformBootstrapPlan {
     kind: 'platform-remote';
     mode: OperatorPlatformBootstrapMode;

package/dist/operator-bootstrap.js

@@ -1240,7 +1240,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.59";
+var VERSION = "0.1.61";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -5443,6 +5443,17 @@ function platformCommunityRehearsalClaims(sshPublicKeys) {
     }
   }];
 }
+function platformCommunityRehearsalDeletionClaims(sshPublicKeys) {
+  return platformCommunityRehearsalClaims(sshPublicKeys).map((claim) => ({
+    computeKey: claim.computeKey,
+    claimToken: claim.claimToken,
+    claimExpiresAtTs: claim.claimExpiresAtTs,
+    attempt: claim.attempt,
+    action: "delete",
+    bootstrap: { kind: "platform-genesis" },
+    spec: claim.spec
+  }));
+}
 
 // src/operator-bootstrap.ts
 var REQUEST_LIMIT = 64 * 1024;
@@ -5596,17 +5607,17 @@ function readOperatorMetalBootstrapRequest(path) {
 }
 function planOperatorMetalBootstrap(request, mode) {
   const config = readMetalBootstrapConfig(request.metalConfigFile);
-  if (mode === "rehearsal" && request.genesis.environment !== "development") {
+  if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && request.genesis.environment !== "development") {
     throw new Error("the disposable four-node Community rehearsal is development-only");
   }
   const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
-  const claims = mode === "rehearsal" ? platformCommunityRehearsalClaims(keys) : platformGenesisClaims(request.genesis.environment, keys);
+  const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(keys) : platformCommunityRehearsalClaims(keys) : platformGenesisClaims(request.genesis.environment, keys);
   return {
     kind: "metal-remote",
     mode,
     mutation: mode !== "status",
     target: { address: request.target.address, port: request.target.port, user: request.target.user },
-    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "genesis" || mode === "rehearsal" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the fixed three-node seed plus ordinary n4 Community rehearsal claim to the constrained Metal helper" : "send three fixed platform-genesis claims to the constrained Metal helper"] : [
+    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the fixed three-node seed plus ordinary n4 Community rehearsal claim to the constrained Metal helper" : mode === "rehearsal-cleanup" ? "delete the exact disposable dev-fz-n1..n4 guests and their owned disks, units, seed data and inventory" : "send three fixed platform-genesis claims to the constrained Metal helper"] : [
       "verify pinned SSH transport and caller-approved SSH agent",
       "copy pinned Bun and packaged fz artifacts to private staging",
       "stage the strict owner-only metal config and optional seed handoff",
@@ -5900,10 +5911,10 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
       const output2 = await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "status"], "remote metal status");
       return { plan, output: output2 };
     }
-    if (mode === "genesis" || mode === "rehearsal") {
+    if (mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup") {
       const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
       const outputs = [];
-      const claims = mode === "rehearsal" ? platformCommunityRehearsalClaims(keys) : platformGenesisClaims(request.genesis.environment, keys);
+      const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(keys) : platformCommunityRehearsalClaims(keys) : platformGenesisClaims(request.genesis.environment, keys);
       for (const claim of claims) {
         outputs.push(await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/local/bin/fz-agent", "metal-apply", "--claim=-"], `provision ${claim.spec.guestName}`, false, `${JSON.stringify(claim)}
 `));

package/dist/platform-fleet-verification.js

@@ -2086,7 +2086,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.59";
+var VERSION3 = "0.1.61";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/platform-genesis.d.ts

@@ -24,3 +24,5 @@ export declare const DEVELOPMENT_COMMUNITY_REHEARSAL_GUEST: PlatformGenesisGuest
 export declare function platformGenesisClaims(environment: PlatformGenesisEnvironment, sshPublicKeys: readonly string[]): readonly RemoteProvisionClaim[];
 /** Exact disposable four-host development fleet: three seed guests plus n4. */
 export declare function platformCommunityRehearsalClaims(sshPublicKeys: readonly string[]): readonly RemoteProvisionClaim[];
+/** Exact inverse of the disposable four-host rehearsal claims. */
+export declare function platformCommunityRehearsalDeletionClaims(sshPublicKeys: readonly string[]): readonly RemoteProvisionClaim[];

package/dist/provision.js

@@ -2086,7 +2086,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.59";
+var VERSION3 = "0.1.61";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.59";
+export declare const VERSION = "0.1.61";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.59",
+  "version": "0.1.61",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",