@forgezero/agent 0.1.63 → 0.1.65

package/dist/platform-fleet-verification.js

@@ -2088,7 +2088,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.63";
+var VERSION3 = "0.1.65";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -2627,17 +2627,16 @@ function agentUnit(options) {
   if (Boolean(options.pullMigrations) !== Boolean(options.lifecycleProfilePath)) {
     throw new Error("migration pull and lifecycle profile must be supplied together");
   }
-  const bootstrapEnabled = Boolean(options.pullBootstrap && options.bootstrapSshCredentialPath && options.bootstrapSshPublicKeyPath && options.bootstrapTargetTelemetryEndpoint);
-  if ([
-    options.pullBootstrap,
-    options.bootstrapSshCredentialPath,
-    options.bootstrapSshPublicKeyPath,
-    options.bootstrapTargetTelemetryEndpoint
-  ].some(Boolean) && !bootstrapEnabled) {
-    throw new Error("bootstrap pull, SSH credential, public key and target telemetry endpoint must be supplied together");
+  const bootstrapIdentityEnabled = Boolean(options.bootstrapSshCredentialPath && options.bootstrapSshPublicKeyPath);
+  if (Boolean(options.bootstrapSshCredentialPath) !== Boolean(options.bootstrapSshPublicKeyPath)) {
+    throw new Error("bootstrap SSH credential and public key paths must be supplied together");
+  }
+  const bootstrapEnabled = Boolean(options.pullBootstrap);
+  if (bootstrapEnabled && (!bootstrapIdentityEnabled || !options.bootstrapTargetTelemetryEndpoint) || !bootstrapEnabled && options.bootstrapTargetTelemetryEndpoint) {
+    throw new Error("bootstrap pull, SSH identity and target telemetry endpoint must be supplied together");
   }
   const lifecycleHelperSocketPath = lifecycleEnabled ? systemdPath(options.lifecycleHelperSocketPath ?? LIFECYCLE_HELPER_SOCKET, "lifecycle helper socket") : undefined;
-  const bootstrapSshCredentialPath = bootstrapEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
+  const bootstrapSshCredentialPath = bootstrapIdentityEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
   const warpValues = [
     options.warpOrganization,
     options.warpClientIdCredentialPath,
@@ -2876,15 +2875,13 @@ function planProvision(options) {
   if (Boolean(options.pullMigrations) !== Boolean(options.lifecycleProfilePath)) {
     throw new Error("migration pull and lifecycle profile must be supplied together");
   }
-  const bootstrapEnabled = Boolean(options.pullBootstrap && options.bootstrapSshCredentialPath && options.bootstrapSshPublicKeyPath && options.bootstrapTargetTelemetryEndpoint);
-  if ([
-    options.pullBootstrap,
-    options.bootstrapSshCredentialPath,
-    options.bootstrapSshPublicKeyPath,
-    options.bootstrapSshSourcePath,
-    options.bootstrapTargetTelemetryEndpoint
-  ].some(Boolean) && !bootstrapEnabled) {
-    throw new Error("bootstrap pull, SSH credential, public key and target telemetry endpoint must be supplied together");
+  const bootstrapIdentityEnabled = Boolean(options.bootstrapSshCredentialPath && options.bootstrapSshPublicKeyPath);
+  if (Boolean(options.bootstrapSshCredentialPath) !== Boolean(options.bootstrapSshPublicKeyPath) || options.bootstrapSshSourcePath && !bootstrapIdentityEnabled) {
+    throw new Error("bootstrap SSH credential and public key paths must be supplied together");
+  }
+  const bootstrapEnabled = Boolean(options.pullBootstrap);
+  if (bootstrapEnabled && (!bootstrapIdentityEnabled || !options.bootstrapTargetTelemetryEndpoint) || !bootstrapEnabled && options.bootstrapTargetTelemetryEndpoint) {
+    throw new Error("bootstrap pull, SSH identity and target telemetry endpoint must be supplied together");
   }
   const warpValues = [
     options.warpOrganization,
@@ -2894,13 +2891,13 @@ function planProvision(options) {
   const warpEnabled = warpValues.every(Boolean);
   if (warpValues.some(Boolean) && !warpEnabled)
     throw new Error("WARP configuration must be supplied together");
-  const enrolmentEnabled = Boolean(options.enrolTokenCredentialPath && options.enrolStatePath);
-  if (Boolean(options.enrolTokenCredentialPath) !== Boolean(options.enrolStatePath) || options.enrolTokenSourcePath && !enrolmentEnabled) {
-    throw new Error("direct enrolment credential and state paths must be supplied together");
+  const enrolmentEnabled = Boolean(options.enrolTokenCredentialPath);
+  if (options.enrolTokenCredentialPath && !options.enrolStatePath || options.enrolTokenSourcePath && (!options.enrolTokenCredentialPath || !options.enrolStatePath)) {
+    throw new Error("direct enrolment credential requires its durable state path");
   }
   const enrolTokenSourcePath = options.enrolTokenSourcePath ? systemdPath(options.enrolTokenSourcePath, "enrolment source") : undefined;
   const enrolTokenCredentialPath = enrolmentEnabled ? systemdPath(options.enrolTokenCredentialPath, "enrolment credential") : undefined;
-  const enrolStatePath = enrolmentEnabled ? systemdPath(options.enrolStatePath, "enrolment state") : undefined;
+  const enrolStatePath = options.enrolStatePath ? systemdPath(options.enrolStatePath, "enrolment state") : undefined;
   const enrolStateDir = enrolStatePath?.replace(/\/[^/]+$/, "");
   const sourceBinPath = options.sourceBinPath ? systemdPath(options.sourceBinPath, "agent source binary") : undefined;
   const binPath = options.binPath ? systemdPath(options.binPath, "agent binary") : undefined;
@@ -2912,8 +2909,8 @@ function planProvision(options) {
   const gitPublicKeyDir = gitPublicKeyPath?.replace(/\/[^/]+$/, "");
   const lifecycleProfilePath = lifecycleEnabled ? systemdPath(options.lifecycleProfilePath, "lifecycle profile") : undefined;
   const lifecycleHelperSocketPath = lifecycleEnabled ? systemdPath(options.lifecycleHelperSocketPath ?? LIFECYCLE_HELPER_SOCKET, "lifecycle helper socket") : undefined;
-  const bootstrapSshCredentialPath = bootstrapEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
-  const bootstrapSshPublicKeyPath = bootstrapEnabled ? systemdPath(options.bootstrapSshPublicKeyPath, "bootstrap SSH public key") : undefined;
+  const bootstrapSshCredentialPath = bootstrapIdentityEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
+  const bootstrapSshPublicKeyPath = bootstrapIdentityEnabled ? systemdPath(options.bootstrapSshPublicKeyPath, "bootstrap SSH public key") : undefined;
   const bootstrapSshSourcePath = options.bootstrapSshSourcePath ? systemdPath(options.bootstrapSshSourcePath, "bootstrap SSH private-key source") : undefined;
   const bootstrapSshPublicKeyDir = bootstrapSshPublicKeyPath?.replace(/\/[^/]+$/, "");
   const warpClientIdCredentialPath = warpEnabled ? systemdPath(options.warpClientIdCredentialPath, "WARP client-id credential") : undefined;
@@ -3013,7 +3010,7 @@ function planProvision(options) {
         step("Git deploy identity directory", { kind: "directories", directories: [{ path: gitPublicKeyDir, mode: 493, owner: "root", group: "root" }] }),
         step("unique encrypted Git deploy identity", { kind: "ensure-git-identity", credential: gitCredentialPath, publicKey: gitPublicKeyPath })
       ] : [],
-      ...bootstrapEnabled ? [
+      ...bootstrapIdentityEnabled ? [
         step("bootstrap SSH public identity directory", { kind: "directories", directories: [
           { path: bootstrapSshPublicKeyDir, mode: 493, owner: "root", group: "root" }
         ] }),
@@ -3049,6 +3046,10 @@ function planProvision(options) {
         { argv: ["/usr/bin/rm", "-f", "/etc/systemd/system/forgezero-deploy-runner.socket"] },
         { argv: ["/usr/bin/systemctl", "daemon-reload"] }
       ] })] : [],
+      ...enrolStatePath && !enrolmentEnabled ? [step("retire consumed enrolment unit", { kind: "commands", commands: [
+        { argv: ["/usr/bin/systemctl", "disable", "--now", "forgezero-agent-enrol.service"], acceptedExitCodes: [0, 1, 5] },
+        { argv: ["/usr/bin/rm", "-f", ENROLMENT_UNIT_PATH] }
+      ] })] : [],
       step("enable and converge services", { kind: "commands", commands: [
         { argv: ["/usr/bin/systemctl", "enable", ...enabledUnits] },
         { argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-agent.service"], acceptedExitCodes: [0, 1] },
@@ -4167,6 +4168,65 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     problems.push("durable Agent enrolment state is missing");
   return { initialized: problems.length === 0, kind: state.kind, profile: state.profile, services, problems };
 }
+function planBootstrapAgentInstall(config, phase, context) {
+  const { capabilities, hasBinding, hasEnrolCredential, initialBundle } = context;
+  if (phase === "bootstrap") {
+    if (config.kind !== "platform" || hasBinding || !initialBundle) {
+      throw new Error("release-one Agent install requires an unbound platform host and verified bootstrap bundle");
+    }
+  } else if (phase === "enrol") {
+    if (hasBinding || !hasEnrolCredential) {
+      throw new Error("Agent enrolment requires one unbound host and its sealed one-use credential");
+    }
+  } else if (!hasBinding) {
+    throw new Error("bound Agent convergence requires durable enrolment state");
+  }
+  const bound = phase === "bound";
+  const enrolling = phase === "enrol";
+  const authenticated = enrolling || bound;
+  const bootstrapRunner = platformBootstrapRunner(config) || config.kind === "enrolled-compute" && Boolean(config.bootstrapRunner);
+  const options = {
+    capabilities,
+    socketPath: DEFAULT_SOCKET2,
+    seedPath: "/var/lib/forgezero/node.seed",
+    controlSocketPath: CONTROL_SOCKET,
+    repository: phase === "bootstrap" ? initialBundle.path : bound && config.kind === "enrolled-compute" ? config.repository : undefined,
+    branch: phase === "bootstrap" ? initialBundle.manifest.branch : bound && config.kind === "enrolled-compute" ? config.branch : undefined,
+    bootstrapBundlePath: phase === "bootstrap" ? initialBundle.path : undefined,
+    bootstrapBundleManifestPath: phase === "bootstrap" ? initialBundle.manifestPath : undefined,
+    profile: config.profile,
+    deployRoot: config.deployRoot ?? "/opt/forgezero",
+    deploymentCredentials: config.deploymentCredentials,
+    publicApiUrl: config.apiUrl,
+    gitCredentialPath: authenticated && config.kind === "enrolled-compute" && config.gitDeployKey ? "/etc/forgezero/creds/git-deploy-key.cred" : undefined,
+    gitPublicKeyPath: authenticated && config.kind === "enrolled-compute" && config.gitDeployKey ? "/etc/forgezero/git/deploy.pub" : undefined,
+    generateGitIdentity: authenticated && config.kind === "enrolled-compute" && config.gitDeployKey === true,
+    pullDeployments: bound,
+    pullMigrations: bound && config.kind === "platform",
+    pullBootstrap: bound && bootstrapRunner,
+    bootstrapSshCredentialPath: authenticated && bootstrapRunner ? BOOTSTRAP_SSH_CREDENTIAL : undefined,
+    bootstrapSshSourcePath: enrolling && config.kind === "enrolled-compute" ? config.bootstrapRunner?.sshPrivateKeyFile : undefined,
+    bootstrapSshPublicKeyPath: authenticated && bootstrapRunner ? BOOTSTRAP_SSH_PUBLIC_KEY : undefined,
+    bootstrapTargetTelemetryEndpoint: bound && bootstrapRunner ? platformBootstrapRunner(config) ? config.telemetryEndpoint : config.kind === "enrolled-compute" ? config.bootstrapRunner?.targetTelemetryEndpoint : undefined : undefined,
+    lifecycleProfilePath: bound && config.kind === "platform" ? LIFECYCLE_PROFILE : undefined,
+    enforceEgress: true,
+    nodeHostname: config.nodeHostname,
+    telemetryEndpoint: config.telemetryEndpoint,
+    binPath: "/usr/local/lib/forgezero/agent/fz-agent",
+    sourceBinPath: PACKAGED_AGENT_BIN,
+    ...enrolling ? {
+      enrolTokenCredentialPath: ENROL_CREDENTIAL,
+      enrolStatePath: "/var/lib/forgezero/enrolment.json"
+    } : bound ? { enrolStatePath: "/var/lib/forgezero/enrolment.json" } : {},
+    ...authenticated ? {
+      apiUrl: config.apiUrl,
+      project: config.kind === "enrolled-compute" ? config.realm : "platform",
+      environment: config.kind === "enrolled-compute" ? undefined : config.environment,
+      nodeLabel: config.kind === "enrolled-compute" ? config.nodeHostname : config.computeReference
+    } : {}
+  };
+  return planInstall(options);
+}
 function localBootstrapHost() {
   const execute = async (argv2, options = {}) => {
     const child = Bun.spawn([...argv2], { stdin: options.stdin === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
@@ -4214,10 +4274,10 @@ function localBootstrapHost() {
         throw new Error(`Agent software requirements failed: ${result.output.trim()}`);
       return result;
     },
-    async installAgent(config) {
+    async installAgent(config, phase) {
       const capabilities = await readCapabilities(localRunner);
-      const deployRoot = config.deployRoot ?? "/opt/forgezero";
       const hasBinding = existsSync10("/var/lib/forgezero/enrolment.json");
+      const hasEnrolCredential = existsSync10(ENROL_CREDENTIAL);
       const initialBundle = config.kind === "platform" && !existsSync10(BOOTSTRAP_RELEASE_EVIDENCE) ? {
         path: config.bootstrapBundle.bundleFile,
         manifestPath: config.bootstrapBundle.manifestFile,
@@ -4238,45 +4298,11 @@ function localBootstrapHost() {
         writeFileSync9(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
 `, { mode: 256 });
       }
-      const plan = planInstall({
+      const plan = planBootstrapAgentInstall(config, phase, {
         capabilities,
-        socketPath: DEFAULT_SOCKET2,
-        seedPath: "/var/lib/forgezero/node.seed",
-        controlSocketPath: "/run/forgezero/control.sock",
-        repository: initialBundle?.path ?? (config.kind === "enrolled-compute" ? config.repository : undefined),
-        branch: initialBundle?.manifest.branch ?? (config.kind === "enrolled-compute" ? config.branch : undefined),
-        bootstrapBundlePath: initialBundle?.path,
-        bootstrapBundleManifestPath: initialBundle?.manifestPath,
-        profile: config.kind === "platform" ? config.profile : config.profile,
-        deployRoot,
-        deploymentCredentials: config.deploymentCredentials,
-        publicApiUrl: config.apiUrl,
-        gitCredentialPath: config.kind === "enrolled-compute" && config.gitDeployKey ? "/etc/forgezero/creds/git-deploy-key.cred" : undefined,
-        gitPublicKeyPath: config.kind === "enrolled-compute" && config.gitDeployKey ? "/etc/forgezero/git/deploy.pub" : undefined,
-        generateGitIdentity: config.kind === "enrolled-compute" && config.gitDeployKey === true,
-        pullDeployments: hasBinding,
-        pullMigrations: config.kind === "platform" && hasBinding,
-        pullBootstrap: platformBootstrapRunner(config) || config.kind === "enrolled-compute" && Boolean(config.bootstrapRunner),
-        bootstrapSshCredentialPath: platformBootstrapRunner(config) || config.kind === "enrolled-compute" && config.bootstrapRunner ? BOOTSTRAP_SSH_CREDENTIAL : undefined,
-        bootstrapSshSourcePath: config.kind === "enrolled-compute" ? config.bootstrapRunner?.sshPrivateKeyFile : undefined,
-        bootstrapSshPublicKeyPath: platformBootstrapRunner(config) || config.kind === "enrolled-compute" && config.bootstrapRunner ? BOOTSTRAP_SSH_PUBLIC_KEY : undefined,
-        bootstrapTargetTelemetryEndpoint: platformBootstrapRunner(config) ? config.telemetryEndpoint : config.kind === "enrolled-compute" ? config.bootstrapRunner?.targetTelemetryEndpoint : undefined,
-        lifecycleProfilePath: config.kind === "platform" ? LIFECYCLE_PROFILE : undefined,
-        enforceEgress: true,
-        nodeHostname: config.nodeHostname,
-        telemetryEndpoint: config.telemetryEndpoint,
-        binPath: "/usr/local/lib/forgezero/agent/fz-agent",
-        sourceBinPath: PACKAGED_AGENT_BIN,
-        ...existsSync10(ENROL_CREDENTIAL) || hasBinding ? {
-          enrolTokenCredentialPath: existsSync10(ENROL_CREDENTIAL) ? ENROL_CREDENTIAL : undefined,
-          enrolStatePath: "/var/lib/forgezero/enrolment.json"
-        } : {},
-        ...hasBinding ? {
-          apiUrl: config.apiUrl,
-          project: config.kind === "enrolled-compute" ? config.realm : "platform",
-          environment: config.kind === "enrolled-compute" ? undefined : config.environment,
-          nodeLabel: config.kind === "enrolled-compute" ? config.nodeHostname : config.computeReference
-        } : {}
+        hasBinding,
+        hasEnrolCredential,
+        initialBundle
       });
       for (const unit2 of [{ path: plan.unitPath, unit: plan.unit }, ...plan.auxiliaryUnits]) {
         mkdirSync10(dirname9(unit2.path), { recursive: true, mode: 493 });

package/dist/provision.js

@@ -2088,7 +2088,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.63";
+var VERSION3 = "0.1.65";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -2627,17 +2627,16 @@ function agentUnit(options) {
   if (Boolean(options.pullMigrations) !== Boolean(options.lifecycleProfilePath)) {
     throw new Error("migration pull and lifecycle profile must be supplied together");
   }
-  const bootstrapEnabled = Boolean(options.pullBootstrap && options.bootstrapSshCredentialPath && options.bootstrapSshPublicKeyPath && options.bootstrapTargetTelemetryEndpoint);
-  if ([
-    options.pullBootstrap,
-    options.bootstrapSshCredentialPath,
-    options.bootstrapSshPublicKeyPath,
-    options.bootstrapTargetTelemetryEndpoint
-  ].some(Boolean) && !bootstrapEnabled) {
-    throw new Error("bootstrap pull, SSH credential, public key and target telemetry endpoint must be supplied together");
+  const bootstrapIdentityEnabled = Boolean(options.bootstrapSshCredentialPath && options.bootstrapSshPublicKeyPath);
+  if (Boolean(options.bootstrapSshCredentialPath) !== Boolean(options.bootstrapSshPublicKeyPath)) {
+    throw new Error("bootstrap SSH credential and public key paths must be supplied together");
+  }
+  const bootstrapEnabled = Boolean(options.pullBootstrap);
+  if (bootstrapEnabled && (!bootstrapIdentityEnabled || !options.bootstrapTargetTelemetryEndpoint) || !bootstrapEnabled && options.bootstrapTargetTelemetryEndpoint) {
+    throw new Error("bootstrap pull, SSH identity and target telemetry endpoint must be supplied together");
   }
   const lifecycleHelperSocketPath = lifecycleEnabled ? systemdPath(options.lifecycleHelperSocketPath ?? LIFECYCLE_HELPER_SOCKET, "lifecycle helper socket") : undefined;
-  const bootstrapSshCredentialPath = bootstrapEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
+  const bootstrapSshCredentialPath = bootstrapIdentityEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
   const warpValues = [
     options.warpOrganization,
     options.warpClientIdCredentialPath,
@@ -2876,15 +2875,13 @@ function planProvision(options) {
   if (Boolean(options.pullMigrations) !== Boolean(options.lifecycleProfilePath)) {
     throw new Error("migration pull and lifecycle profile must be supplied together");
   }
-  const bootstrapEnabled = Boolean(options.pullBootstrap && options.bootstrapSshCredentialPath && options.bootstrapSshPublicKeyPath && options.bootstrapTargetTelemetryEndpoint);
-  if ([
-    options.pullBootstrap,
-    options.bootstrapSshCredentialPath,
-    options.bootstrapSshPublicKeyPath,
-    options.bootstrapSshSourcePath,
-    options.bootstrapTargetTelemetryEndpoint
-  ].some(Boolean) && !bootstrapEnabled) {
-    throw new Error("bootstrap pull, SSH credential, public key and target telemetry endpoint must be supplied together");
+  const bootstrapIdentityEnabled = Boolean(options.bootstrapSshCredentialPath && options.bootstrapSshPublicKeyPath);
+  if (Boolean(options.bootstrapSshCredentialPath) !== Boolean(options.bootstrapSshPublicKeyPath) || options.bootstrapSshSourcePath && !bootstrapIdentityEnabled) {
+    throw new Error("bootstrap SSH credential and public key paths must be supplied together");
+  }
+  const bootstrapEnabled = Boolean(options.pullBootstrap);
+  if (bootstrapEnabled && (!bootstrapIdentityEnabled || !options.bootstrapTargetTelemetryEndpoint) || !bootstrapEnabled && options.bootstrapTargetTelemetryEndpoint) {
+    throw new Error("bootstrap pull, SSH identity and target telemetry endpoint must be supplied together");
   }
   const warpValues = [
     options.warpOrganization,
@@ -2894,13 +2891,13 @@ function planProvision(options) {
   const warpEnabled = warpValues.every(Boolean);
   if (warpValues.some(Boolean) && !warpEnabled)
     throw new Error("WARP configuration must be supplied together");
-  const enrolmentEnabled = Boolean(options.enrolTokenCredentialPath && options.enrolStatePath);
-  if (Boolean(options.enrolTokenCredentialPath) !== Boolean(options.enrolStatePath) || options.enrolTokenSourcePath && !enrolmentEnabled) {
-    throw new Error("direct enrolment credential and state paths must be supplied together");
+  const enrolmentEnabled = Boolean(options.enrolTokenCredentialPath);
+  if (options.enrolTokenCredentialPath && !options.enrolStatePath || options.enrolTokenSourcePath && (!options.enrolTokenCredentialPath || !options.enrolStatePath)) {
+    throw new Error("direct enrolment credential requires its durable state path");
   }
   const enrolTokenSourcePath = options.enrolTokenSourcePath ? systemdPath(options.enrolTokenSourcePath, "enrolment source") : undefined;
   const enrolTokenCredentialPath = enrolmentEnabled ? systemdPath(options.enrolTokenCredentialPath, "enrolment credential") : undefined;
-  const enrolStatePath = enrolmentEnabled ? systemdPath(options.enrolStatePath, "enrolment state") : undefined;
+  const enrolStatePath = options.enrolStatePath ? systemdPath(options.enrolStatePath, "enrolment state") : undefined;
   const enrolStateDir = enrolStatePath?.replace(/\/[^/]+$/, "");
   const sourceBinPath = options.sourceBinPath ? systemdPath(options.sourceBinPath, "agent source binary") : undefined;
   const binPath = options.binPath ? systemdPath(options.binPath, "agent binary") : undefined;
@@ -2912,8 +2909,8 @@ function planProvision(options) {
   const gitPublicKeyDir = gitPublicKeyPath?.replace(/\/[^/]+$/, "");
   const lifecycleProfilePath = lifecycleEnabled ? systemdPath(options.lifecycleProfilePath, "lifecycle profile") : undefined;
   const lifecycleHelperSocketPath = lifecycleEnabled ? systemdPath(options.lifecycleHelperSocketPath ?? LIFECYCLE_HELPER_SOCKET, "lifecycle helper socket") : undefined;
-  const bootstrapSshCredentialPath = bootstrapEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
-  const bootstrapSshPublicKeyPath = bootstrapEnabled ? systemdPath(options.bootstrapSshPublicKeyPath, "bootstrap SSH public key") : undefined;
+  const bootstrapSshCredentialPath = bootstrapIdentityEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
+  const bootstrapSshPublicKeyPath = bootstrapIdentityEnabled ? systemdPath(options.bootstrapSshPublicKeyPath, "bootstrap SSH public key") : undefined;
   const bootstrapSshSourcePath = options.bootstrapSshSourcePath ? systemdPath(options.bootstrapSshSourcePath, "bootstrap SSH private-key source") : undefined;
   const bootstrapSshPublicKeyDir = bootstrapSshPublicKeyPath?.replace(/\/[^/]+$/, "");
   const warpClientIdCredentialPath = warpEnabled ? systemdPath(options.warpClientIdCredentialPath, "WARP client-id credential") : undefined;
@@ -3013,7 +3010,7 @@ function planProvision(options) {
         step("Git deploy identity directory", { kind: "directories", directories: [{ path: gitPublicKeyDir, mode: 493, owner: "root", group: "root" }] }),
         step("unique encrypted Git deploy identity", { kind: "ensure-git-identity", credential: gitCredentialPath, publicKey: gitPublicKeyPath })
       ] : [],
-      ...bootstrapEnabled ? [
+      ...bootstrapIdentityEnabled ? [
         step("bootstrap SSH public identity directory", { kind: "directories", directories: [
           { path: bootstrapSshPublicKeyDir, mode: 493, owner: "root", group: "root" }
         ] }),
@@ -3049,6 +3046,10 @@ function planProvision(options) {
         { argv: ["/usr/bin/rm", "-f", "/etc/systemd/system/forgezero-deploy-runner.socket"] },
         { argv: ["/usr/bin/systemctl", "daemon-reload"] }
       ] })] : [],
+      ...enrolStatePath && !enrolmentEnabled ? [step("retire consumed enrolment unit", { kind: "commands", commands: [
+        { argv: ["/usr/bin/systemctl", "disable", "--now", "forgezero-agent-enrol.service"], acceptedExitCodes: [0, 1, 5] },
+        { argv: ["/usr/bin/rm", "-f", ENROLMENT_UNIT_PATH] }
+      ] })] : [],
       step("enable and converge services", { kind: "commands", commands: [
         { argv: ["/usr/bin/systemctl", "enable", ...enabledUnits] },
         { argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-agent.service"], acceptedExitCodes: [0, 1] },

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.63";
+export declare const VERSION = "0.1.65";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.63",
+  "version": "0.1.65",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",